Estimating Gaps in Martingales and Applications to Coin-Tossing: Constructions and Hardness

TL;DR

This paper constructs and analyzes martingales to understand the security gaps in distributed coin-tossing protocols, providing new bounds and techniques that improve upon previous results and are applicable to all initial biases.

Contribution

It introduces a geometric transformation-based inductive technique to estimate large gaps in martingales, leading to optimal bounds on security in coin-tossing protocols for all initial biases.

Findings

Constructed martingales with security bounds depending on initial bias X0

Established a lower bound on expected gap size at stopping times

Demonstrated the optimality of bounds with constructed martingales

Abstract

Consider designing a distributed coin-tossing protocol for n processors such that the probability of heads is X0 in [0,1], and an adversary can reset one processor to change the distribution of the final outcome. For X0=1/2, in the non-cryptographic setting, Blum's majority protocol is $\frac1{\sqrt{2\pi n}}$ insecure. For computationally bounded adversaries and any X0 in [0,1], the protocol of Moran,Naor,Segev (2009) is only O(1/n) insecure. In this paper, we study discrete-time martingales (X0,X1,..,Xn) such that Xi in [0,1], for all i in {0,..,n}, and Xn in {0,1}. In particular, for any X0 in [0,1], we construct martingales that yield $\frac12\sqrt{\frac{X_0(1-X_0)}{n}}$ insecure coin-tossing protocols with n-bit communication; irrespective of the number of bits required to represent the output distribution. Note that for sufficiently small X0, we achieve higher security than Moran et al's protocol even against computationally unbounded adversaries. For X0=1/2, our protocol requires only 40% of the processors to obtain the same security as the majority protocol. We introduce a new inductive technique that uses geometric transformations to estimate the large gaps in these martingales. For any X0 in [0,1], we show that there exists a stopping time $T$ such that $\mathbb{E}[|{X_T-X_{T-1}}|]\geq\frac2{\sqrt{2n-1}}\cdot X_0(1-X_0)$. The inductive technique also constructs martingales that demonstrate the optimality of our bound - we construct optimal martingales such that any $T$ has$\mathbb{E}[|{X_T-X_{T-1}}|]\leq\frac1{\sqrt{n}}\cdot\sqrt{X_0(1-X_0)}$. Our lower-bound holds for all X0 in [0,1]; while the previous bound of Cleve,Impagliazzo (1993) exists only for positive constant X0. Our approach only employs elementary techniques and avoids the complex probabilistic tools inherent to the approaches of Cleve,Impagliazzo (1993) and Beimel,Haitner,Makriyannis,Omri (2018).

Equations

$$\text{EX}|X_{\_}\tau -X_{\_}\tau -1|⩾\frac{2}{\sqrt{2n-1}}\cdot X_{\_}0(1-X_{\_}0)$$

$$\text{EX}|X_{\_}\tau -X_{\_}\tau -1|⩽\frac{1}{\sqrt{n}}\cdot \sqrt{X_{\_}0(1-X_{\_}0)}$$

$$\text{EX}|X_{\_}\tau -X_{\_}\tau -1|$$

$$C_{\_}n(X_{\_}0):=\underset{\_}{\inf }\mathcal{X}\underset{\_}{\sup }\tau \text{EX}|X_{\_}\tau -X_{\_}\tau -1|$$

$$\underset{\_}{\sup }\text{stopping time }\tau \text{EX}|X_{\_}\tau -X_{\_}\tau -1|⩾C_{\_}n(X_{\_}0),$$

$$\frac{2}{\sqrt{2n-1}}X(1-X)=:L_{\_}n(X)⩽C_{\_}n(X)⩽U_{\_}n(X):=\frac{1}{\sqrt{n}}\sqrt{X(1-X)}$$

$$\text{EX}{X}_{\_}i+1|E_{\_}1,E_{\_}2,\dots ,E_{\_}i=X_{\_}i$$

$${\mathrm{score}}_{\_}\ell (X,E,\tau ):=\text{EX}|X_{\_}\tau -X_{\_}\tau -1{|}^{\ell }$$

$${\tau }_{\_}\max (X,E,\ell ):=\underset{\_}{\mathrm{argmax}}\tau \in \mathcal{S}(X,E){\mathrm{score}}_{\_}\ell (X,E,\tau ),$$

$${\max \text{-}\mathrm{score}}_{\_}\ell (X,E):=\text{EX}|X_{\_}{\tau }_{\_}\max -X_{\_}{\tau }_{\_}\max -1{|}^{\ell }$$

$${\mathrm{opt}}_{\_}n(x^{\ast },\ell ):=\underset{\_}{\inf }(X,E)\in A_{\_}n(x^{\ast }){\max \text{-}\mathrm{score}}_{\_}\ell (X,E)$$

$$\underset{\_}{\sup }\text{stopping time }\tau \text{EX}|X_{\_}\tau -X_{\_}\tau -1|$$

$$C_{\_}n(X_{\_}0):=\underset{\_}{\inf }(X_{\_}0,\dots ,X_{\_}n)\underset{\_}{\sup }\text{stopping time }\tau \text{EX}|X_{\_}\tau -X_{\_}\tau -1|$$

$$h_{\_}1+\frac{h_{\_}1}{h_{\_}1+h_{\_}2}\cdot (h_{\_}2-h_{\_}1)=\frac{2h_{\_}1h_{\_}2}{h_{\_}1+h_{\_}2}.$$

$$p^{\left(j\right)}\max \left\{|x^{\left(j\right)}-x|,C_{\_}d-1(x^{\left(j\right)})\right\}$$

$$x_{\_}0=\frac{(f_{\_}n+1)-\sqrt{(f_{\_}n+1{)}^2-4x{f}_{\_}n}}{2f_{\_}n},$$

$$y_{\_}0$$

$$=\frac{f_{\_}{n}^2-1-(f_{\_}n+1{)}^2+4x{f}_{\_}n+2\sqrt{(f_{\_}n+1{)}^2-4x{f}_{\_}n}}{4f_{\_}n}$$

$$=\frac{(2x-1)f_{\_}n-1+\sqrt{(f_{\_}n+1{)}^2-4x{f}_{\_}n}}{2f_{\_}n}$$

$$y_{\_}1$$

$$=\frac{(1-2x)f_{\_}n-1+\sqrt{(f_{\_}n-1{)}^2+4x{f}_{\_}n}}{2f_{\_}n}$$

$$y_{\_}0$$

$$=\frac{\left(f_{\_}{n}^2+1+4z{f}_{\_}n\right)-(1+2z{f}_{\_}n{)}^2}{2f_{\_}n\left(\sqrt{f_{\_}{n}^2+1+4z{f}_{\_}n}+(1+2z{f}_{\_}n)\right)}$$

$$=\frac{(1-4z^2)}{2f_{\_}n}\cdot \frac{f_{\_}{n}^2}{\sqrt{f_{\_}{n}^2+1+4z{f}_{\_}n}+(1+2z{f}_{\_}n)}$$

$$y_{\_}1$$

$$=\frac{(1-4z^2)}{2f_{\_}n}\cdot \frac{f_{\_}{n}^2}{\sqrt{f_{\_}{n}^2+1-4z{f}_{\_}n}+(1-2z{f}_{\_}n)}$$

$$\ell$$

$$H.M.\left(y_{\_}0,y_{\_}1\right)$$

$$H.M.\left(\frac{2f_{\_}n}{1-4z^2}\cdot y_{\_}0,\frac{2f_{\_}n}{1-4z^2}\cdot y_{\_}1\right)$$

$$H.M.\left(\frac{f_{\_}{n}^2}{\sqrt{f_{\_}{n}^2+1+4z{f}_{\_}n}+(1+2z{f}_{\_}n)},\frac{f_{\_}{n}^2}{\sqrt{f_{\_}{n}^2+1-4z{f}_{\_}n}+(1-2z{f}_{\_}n)}\right)$$

$$A.M.\left(\frac{\sqrt{f_{\_}{n}^2+1+4z{f}_{\_}n}+(1+2z{f}_{\_}n)}{f_{\_}{n}^2},\frac{\sqrt{f_{\_}{n}^2+1-4z{f}_{\_}n}+(1-2z{f}_{\_}n)}{f_{\_}{n}^2}\right)$$

$$A.M.\left(\sqrt{f_{\_}{n}^2+1+4z{f}_{\_}n},\sqrt{f_{\_}{n}^2+1-4z{f}_{\_}n}\right)+1$$

$$x_{\_}0=\frac{(2x+u_{\_}{n}^2)-u_{\_}n\sqrt{u_{\_}{n}^2-4x^2+4x}}{2(1+u_{\_}{n}^2)},$$

$$y_{\_}0$$

Full text

In this paper, we study discrete-time martingales $(X_{\_}0,X_{\_}1,\dotsc,X_{\_}n)$ such that $X_{\_}i\in[0,1]$, for all $i\in\{0,\dotsc,n\}$, and $X_{\_}n\in{\{0,1\}}$. These martingales are commonplace in modeling stochastic processes like coin-tossing protocols in the information-theoretic setting mentioned above. In particular, for any $X_{\_}0\in[0,1]$, we construct martingales that yield $\frac{1}{2}\sqrt{\frac{X_{\_}0(1-X_{\_}0)}{n}}$ insecure coin-tossing protocols. For $X_{\_}0=1/2$, our protocol requires only 40% of the processors to achieve the same security as the majority protocol.

The technical heart of our paper is a new inductive technique that uses geometric transformations to precisely account for the large gaps in these martingales. For any $X_{\_}0\in[0,1]$, we show that there exists a stopping time $\tau$ such that

[TABLE]

The inductive technique simultaneously constructs martingales that demonstrate the optimality of our bound, i.e., a martingale where the gap corresponding to any stopping time is small. In particular, we construct optimal martingales such that any stopping time $\tau$ has

[TABLE]

Our lower-bound holds for all $X_{\_}0\in[0,1]$; while the previous bound of Cleve and Impagliazzo (1993) exists only for positive constant $X_{\_}0$. Conceptually, our approach only employs elementary techniques to analyze these martingales and entirely circumvents the complex probabilistic tools inherent to the approaches of Cleve and Impagliazzo (1993) and Beimel, Haitner, Makriyannis, and Omri (2018).

By appropriately restricting the set of possible stopping-times, we present representative applications to constructing distributed coin-tossing/dice-rolling protocols, discrete control processes, fail-stop attacking coin-tossing/dice-rolling protocols, and black-box separations.

1. 1 Introduction

2. 1.1 Our Contributions

3. 1.2 Prior Approaches to the General Martingale Problem

4. 2 Preliminaries

5. 3 Large Gaps in Martingales: A Geometric Approach

6. 3.1 Proof of Theorem 1.1

7. 3.2 Estimation of $C_{\_}n(X)$ : Proof of Lemma 1.2

8. 4 Applications

9. 4.1 Distributed Coin-Tossing Protocol

10. 4.2 Fail-stop Attacks on Coin-tossing/Dice-rolling Protocols

11. 4.2.1 Black-box Separation Results

12. 4.2.2 Detailed Discussion of Our Fail-stop Attack and Proofs

13. 4.2.3 Discussion of Specialized Stopping Time - Proof of Theorem 4.3

14. 4.3 Influencing Discrete Control Processes

15. 4.3.1 Influencing Multi-faceted Dice-rolls

16. 4.4 $L_{\_}2$ Gaps and their Tightness

17. 4.5 Alternate Proof for $U_{\_}{n+1}\succcurlyeq T(U_{\_}{n})$

18. References

19. A More Technical Proof of Theorem 1.1

1 Introduction

**A Representative Motivating Application. ** Consider a distributed protocol for $n$ processors to toss a coin, where a processor $i$ broadcasts her message in round $i$. At the end of the protocol, all processors reconstruct the common outcome from the public transcript. When all processors are honest, the probability of the final outcome being 1 is $X_{\_}0$ and the probability of the final outcome being 0 is $1-X_{\_}0$, i.e., the final outcome is a bias-$X_{\_}0$ coin. Suppose there is an adversary who can (adaptively) choose to restart one of the processors after seeing her message (i.e., the strong adaptive corruptions model introduced by Goldwasser, Kalai, and Park [20]); otherwise her presence is innocuous. Our objective is to design bias-$X_{\_}0$ coin-tossing protocols such that the adversary cannot change the distribution of the final outcomes significantly.

The Majority Protocol. Against computationally unbounded adversaries, (essentially) the only known protocol is the well-known majority protocol [10, 5, 13] for $X_{\_}0=1/2$. The majority protocol requests one uniformly random bit from each processor and the final outcome is the majority of these $n$ bits. An adversary can alter the probability of the final outcome being 1 by $\frac{1}{\sqrt{2\pi n}}$, i.e., the majority protocol is $\frac{1}{\sqrt{2\pi n}}$ insecure.

Our New Protocol. We shall prove a general martingale result in this paper that yields the following result as a corollary. For any $X_{\_}0\in[0,1]$, there exists an $n$-bit bias-$X_{\_}0$ coin-tossing protocol in the information-theoretic setting that is $\frac{1}{2}\sqrt{\frac{X_{\_}0(1-X_{\_}0)}{n}}$ insecure. In particular, for $X_{\_}0=1/2$, our protocol uses only 625 processors to reduce the insecurity to, say, 1%; while the majority protocol requires 1592 processors.

General Formal Framework: Martingales. Martingales are natural models for several stochastic processes. Intuitively, martingales correspond to a gradual release of information about an event. A priori, we know that the probability of the event is $X_{\_}0$. For instance, in a distributed $n$-party coin-tossing protocol the outcome being $1$ is the event of interest.

A discrete-time martingale $(X_{\_}0,X_{\_}1,\dotsc,X_{\_}n)$ represents the gradual release of information about the event over $n$ time-steps.111For the introduction, we do not explicitly mention the underlying filtration for brevity. The proofs, however, clearly mention the associated filtrations. For intuition, we can assume that $X_{\_}i$ represents the probability that the outcome of the coin-tossing protocol is $1$ after the first $i$ parties have broadcast their messages. Martingales have the unique property that if one computes the expected value of $X_{\_}j$, for $j>i$, at the end of time-step $i$, it is identical to the value of $X_{\_}i$. In this paper we shall consider martingales where, at the end of time-step $n$, we know for sure whether the event of interest has occurred or not. That is, we have $X_{\_}n\in{\{0,1\}}$.

A stopping time $\tau$ represents a time step $\in\{1,2,\dotsc,n\}$ where we stop the evolution of the martingale. The test of whether to stop the martingale at time-step $i$ is a function only of the information revealed so far. Furthermore, this stopping time need not be a constant. That is, for example, different transcripts of the coin-tossing protocol potentially have different stopping times.

Our Martingale Problem Statement. The inspiration of our approach is best motivated using a two-player game between, namely, the martingale designer and the adversary. Fix $n$ and $X_{\_}0$. The martingale designer presents a martingale ${\mathcal{X}}=(X_{\_}0,X_{\_}1,\dotsc,X_{\_}n)$ to the adversary and the adversary finds a stopping time $\tau$ that maximizes the following quantity.

[TABLE]

Intuitively, the adversary demonstrates the most severe susceptibility of the martingale by presenting the corresponding stopping time $\tau$ as a witness. The martingale designer’s objective is to design martingales that have less susceptibility. Our paper uses a geometric approach to inductively provide tight bounds on the least susceptibility of martingales for all $n\geqslant 1$ and $X_{\_}0\in[0,1]$, that is, the following quantity.

[TABLE]

This precise study of $C_{\_}n(X_{\_}0)$, for general $X_{\_}0\in[0,1]$, is motivated by natural applications in discrete process control as illustrated by the representative motivating problem. This paper, for representative applications of our results, considers $n$-processor distributed protocols and 2-party $n$-round protocols. The stopping time witnessing the highest susceptibility shall translate into appropriate adversarial strategies. These adversarial strategies shall imply hardness of computation results.

1.1 Our Contributions

We prove the following general martingale theorem.

Theorem 1.1**.**

Let $(X_{\_}0,X_{\_}1,\dotsc,X_{\_}n)$ be a discrete-time martingale such that $X_{\_}i\in[0,1]$, for all $i\in\{1,\dotsc,n\}$, and $X_{\_}n\in\{0,1\}$. Then, the following bound holds.

[TABLE]

where $C_{\_}1(X)=2X(1-X)$, and, for $n>1$, we obtain $C_{\_}n$ from $C_{\_}{n-1}$ recursively using the geometric transformation defined in Fig. 8.

Furthermore, for all $n\geqslant 1$ and $X_{\_}0\in[0,1]$, there exists a martingale $(X_{\_}0,\dotsc,X_{\_}n)$ (w.r.t. to the coordinate exposure filtration for ${\{0,1\}}^{n}$) such that for any stopping time $\tau$, it has $\EX{\lvert X_{\_}\tau-X_{\_}{\tau-1}\rvert}=C_{\_}n(X_{\_}0)$.

Intuitively, given a martingale, an adversary can identify a stopping time where the expected gap in the martingale is at least $C_{\_}n(X_{\_}0)$. Moreover, there exists a martingale that realizes the lower-bound in the tightest manner, i.e., all stopping times $\tau$ have identical susceptibility.

Next, we estimate the value of the function $C_{\_}n(X)$.

Lemma 1.2**.**

For $n\geqslant 1$ and $X\in[0,1]$, we have

[TABLE]

As a representative example, consider the case of $n=3$ and $X_{\_}0=1/2$. Fig. 1 presents the martingale corresponding to the 3-round majority protocol and highlights the stopping time witnessing the susceptibility of 0.3750. Fig. 2 presents the optimal 3-round coin-tossing protocol’s martingale that has susceptibility of 0.2407.

In the sequel, we highlight applications of Theorem 1.1 to protocol constructions and hardness of computation results using these estimates.

Remark 1.3** (Protocol Constructions).**

The optimal martingales naturally translate into $n$-bit distributed coin-tossing and multi-faceted dice rolling protocols.

Corollary 4.1*: For all $X_{\_}0\in[0,1]$, there exists an $n$-bit distributed bias-$X_{\_}0$ coin-tossing protocol for $n$ processors with the following security guarantee. Any (computationally unbounded) adversary who follows the protocol honestly and resets at most one of the processors during the execution of the protocol can change the probability of an outcome by at most $\frac{1}{2\sqrt{n}}\sqrt{X_{\_}0(1-X_{\_}0)}$.*

Remark 1.4** (Hardness of Computation Results).**

*The lower-bound on the maximum susceptibility helps demonstrate hardness of computation results. For $X_{\_}0=1/2$, Cleve and Impagliazzo [14] proved that one encounters $\lvert X_{\_}\tau-X_{\_}{\tau-1}\rvert\geqslant\frac{1}{32\sqrt{n}}$ with probability $\frac{1}{5}$. In other words, their bound guarantees that the expected gap in the martingale is at least $\frac{1}{160\sqrt{n}}$, which is significantly smaller than our bound $\frac{1}{2\sqrt{2n}}$. Hardness of computation results relying on [14] (and its extensions) work only for constant $0<X_{\_}0<1$.222Cleve and Impagliazzo set their problem as an optimization problem that trades off two conflicting objective functions. These objective functions have exponential dependence on $X_{\_}0(1-X_{\_}0)$. Consequently, if $X_{\_}0=1/\mathrm{poly}(n)$ or $X_{\_}0=1-1/\mathrm{poly}(n)$, then their lower bounds are extremely weak.

However, our lower-bound holds for all $X_{\_}0\in[0,1]$; for example, even when $1/\mathrm{poly}(n)\leqslant X_{\_}0\leqslant 1-1/\mathrm{poly}(n)$. Consequently, we extend existing hardness of computation results using our more general lower-bound.*

Theorem 4.2* extends the fail-stop attack of [14] on 2-party bias-$X_{\_}0$ coin-tossing protocols (in the information-theoretic commitment hybrid). For any $X_{\_}0\in[0,1]$, a fail-stop adversary can change the probability of the final outcome of any 2-party bias-$X_{\_}0$ coin-tossing protocol by $\geqslant\frac{\sqrt{2}}{12\sqrt{n+1}}X_{\_}0(1-X_{\_}0)$. This result is useful to demonstrate black-box separations results.* 2. 2.

Corollary 4.4* extends the black-box separation results of [15, 23, 16] separating (appropriate restrictions of) 2-party bias-$X_{\_}0$ coin tossing protocols from one-way functions. We illustrate a representative new result that follows as a consequence of Corollary 4.4. For constant $X_{\_}0\in(0,1)$, [15, 23, 16] rely on (the extensions of) [14] to show that it is highly unlikely that there exist 2-party bias-$X_{\_}0$ coin tossing protocols using one-way functions in a black-box manner achieving $o(1/\sqrt{n})$ unfairness [22]. Note that when $X_{\_}0=1/n$, there are secure 2-party coin tossing protocols with $1/2n$ unfairness (based on Corollary 4.1) even in the information-theoretic setting. Previous results cannot determine the limits to the unfairness of 2-party bias-$1/n$ fair coin-tossing protocols that use one-way functions in a black-box manner. Our black-box separation result (refer to Corollary 4.4) implies that it is highly unlikely to construct bias-$1/n$ coin using one-way functions in a black-box manner with $<\frac{\sqrt{2}}{12\cdot n^{3/2}}$ unfairness.* 3. 3.

Corollary 4.7* and Corollary 4.8 extend Cleve and Impagliazzo’s [14] result on influencing discrete control processes to arbitrary $X_{\_}0\in[0,1]$.*

1.2 Prior Approaches to the General Martingale Problem

Azuma-Hoeffding inequality [6, 25] states that if $\lvert X_{\_}i-X_{\_}{i-1}\rvert=o(1/\sqrt{n})$, for all $i\in\{1,\dotsc,n\}$, then, essentially, $\lvert X_{\_}n-X_{\_}0\rvert=o(1)$ with probability 1. That is, the final information $X_{\_}n$ remains close to the a priori information $X_{\_}0$. However, in our problem statement, we have $X_{\_}n\in{\{0,1\}}$. In particular, this constraint implies that the final information $X_{\_}n$ is significantly different from the a priori information $X_{\_}0$. So, the initial constraint “for all $i\in\{1,\dotsc,n\}$ we have $\lvert X_{\_}i-X_{\_}{i-1}\rvert=o(1/\sqrt{n})$” must be violated. What is the probability of this violation?

For $X_{\_}0=1/2$, Cleve and Impagliazzo [14] proved that there exists a round $i$ such that $\lvert X_{\_}i-X_{\_}{i-1}\rvert\geqslant\frac{1}{32\sqrt{n}}$ with probability $1/5$. We emphasize that the round $i$ is a random variable and not a constant. However, the definition of the “big jump” and the “probability to encounter big jumps” both are exponentially small function of $X_{\_}0$. So, the approach of Cleve and Impagliazzo is only applicable to constant $X_{\_}0\in(0,1)$. Recently, in an independent work, Beimel et al. [7] demonstrate an identical bound for weak martingales (that have some additional properties), which is used to model multi-party coin-tossing protocols.

For the upper-bound, on the other hand, Doob’s martingale corresponding to the majority protocol is the only known martingale for $X_{\_}0=1/2$ with a small maximum susceptibility. In general, to achieve arbitrary $X_{\_}0\in[0,1]$, one considers coin tossing protocols where the outcome is $1$ if the total number of heads in $n$ uniformly random coins surpasses an appropriate threshold.

2 Preliminaries

We denote the arithmetic mean of two numbers $x$ and $y$ as $\mathrm{A.M.}(x,y)\coloneqq(x+y)/{2}$. The geometric mean of these two numbers is denoted by $\mathrm{G.M.}(x,y)\coloneqq\sqrt{x\cdot y}$ and their harmonic mean is denoted by $\mathrm{H.M.}(x,y)\coloneqq\left(\left(x^{-1}+y^{-1}\right)/2\right)^{-1}=2xy/(x+y)$.

Martingales and Related Definitions. The conditional expectation of a random variable $X$ with respect to an event $\mathcal{E}$ denoted by $\EX{X|\mathcal{E}}$, is defined as $\EX{X\cdot\1{\mathcal{E}}}/\probX{\mathcal{E}}$. For a discrete random variable $Y$, the conditional expectation of $X$ with respect to $Y$, denoted by $\EX{X|Y}$, is a random variable that takes value $\EX{X|Y=y}$ with probability $\probX{Y=y}$, where $\EX{X|Y=y}$ denotes the conditional expectation of $X$ with respect to the event $\{\omega\in\Omega|Y(\omega)=y\}$.

Let $\Omega=\Omega_{\_}1\times\Omega_{\_}2\times\dotsi\times\Omega_{\_}n$ denote a sample space and $(E_{\_}1,E_{\_}2,\dotsc,E_{\_}n)$ be a joint distribution defined over $\Omega$ such that for each $i\in\{1,\dotsc,n\}$, $E_{\_}i$ is a random variable over $\Omega_{\_}i$. Let $X=\{X_{\_}i\}_{\_}{i=0}^{n}$ be a sequence of random variables defined over $\Omega$. We say that $X_{\_}j$ is $E_{\_}1,\dotsc,E_{\_}j$ measurable if there exists a function $g_{\_}j\colon\Omega_{\_}1\times\Omega_{\_}2\times\dotsi\times\Omega_{\_}j\to\mathbb{R}$ such that $X_{\_}j=g_{\_}j(E_{\_}1,\dotsc,E_{\_}j)$. Let $X=\{X_{\_}i\}_{\_}{i=0}^{n}$ be a discrete-time martingale sequence with respect to the sequence $E=\{E_{\_}i\}_{\_}{i=1}^{n}$. This statement implies that for each $i\in\{0,1,\dotsc,n\}$, we have

[TABLE]

Note that the definition of martingale implies $X_{\_}i$ to be $E_{\_}1,\dotsc,E_{\_}i$ measurable for each $i\in\{1,\dotsc,n\}$ and $X_{\_}0$ to be constant. In the sequel, we shall use $\{X=\{X_{\_}i\}_{\_}{i=0}^{n},E=\{E_{\_}i\}^{n}_{\_}{i=1}\}$ to denote a martingale sequence where for each $i=1,\dotsc,n$, $X_{\_}i\in[0,1]$, and $X_{\_}n\in\{0,1\}$. However, for brevity, we use $\left(X_{\_}0,X_{\_}1,\dotsc,X_{\_}n\right)$ to denote a martingale. Given a function $f\colon\Omega_{\_}1\times\Omega_{\_}2\times\dotsi\times\Omega_{\_}n\to\mathbb{R}$, if we define the random variable $Z_{\_}i\coloneqq\EX{f(E_{\_}1,\dotsc,E_{\_}n)|E_{\_}1,\dotsc,E_{\_}i}$, for each $i\in\{0,1,\dotsc,n\}$, then the sequence $Z=\{Z_{\_}i\}_{\_}{i=0}^{n}$ is a martingale with respect to $\{E_{\_}i\}_{\_}{i=1}^{n}$. This martingale is called the Doob’s martingale.

The random variable $\tau\colon\Omega\rightarrow\{0,1,\dotsc,n\}$ is called a stopping time if for each $k\in\{1,2,\dotsc,n\}$, the occurrence or non-occurrence of the event $\{\tau\leqslant k\}\coloneqq\{\omega\in\Omega|\tau(\omega)\leqslant k\}$ depends only on the values of random variables $E_{\_}1,E_{\_}2,\dotsc,E_{\_}k$. Equivalently, the random variable $\1{\tau\leqslant k}$ is $E_{\_}1,\dotsc,E_{\_}k$ measurable. Let $\mathcal{S}(X,E)$ denote the set of all stopping time random variables over the martingale sequence $\{X=\{X_{\_}i\}_{\_}{i=0}^{n},E=\{E_{\_}i\}^{n}_{\_}{i=1}\}$. For $\ell\in\{1,2\}$, we define the score of a martingale sequence $(X,E)$ with respect to a stopping time $\tau$ in the $L_{\_}\ell$-norm as the following quantity.

[TABLE]

We define the max stopping time as the stopping time that maximizes the score

[TABLE]

and the (corresponding) $\mathrm{max\textnormal{-}score}$ as

[TABLE]

Let $A_{\_}n(x^{*})$ denote the set of all discrete time martingales $\{X=\{X_{\_}i\}_{\_}{i=0}^{n},E=\{E_{\_}i\}_{\_}{i=1}^{n}\}$ such that $X_{\_}0=x^{*}$ and $X_{\_}n\in\{0,1\}$. We define optimal score as

[TABLE]

Representing a Martingale as a Tree. We interpret a discrete time martingale sequence $X=\{X_{\_}i\}_{\_}{i=0}^{n}$ defined over a sample space $\Omega=\Omega_{\_}1\times\dotsi\times\Omega_{\_}n$ as a tree of depth $n$ (see Fig. 3). For $i=0,\dotsc,n$, any node at depth $i$ has $\lvert\Omega_{\_}{i+1}\rvert$ children. In fact, for each $i$, the edge between a node at depth $i$ and a child at depth $(i+1)$ corresponds to a possible outcome that $E_{\_}{i+1}$ can take from the set $\Omega_{\_}{i+1}=\{x^{{\left(1\right)}},\dotsc,x^{{\left(t\right)}}\}$.

Each node $v$ at depth $i$ is represented by a unique path from root to $v$ like $(e_{\_}1,e_{\_}2,\dots,e_{\_}{i})$, which corresponds to the event $\{\omega\in\Omega|E_{\_}1(\omega)=e_{\_}1,\dots,E_{\_}{i}(\omega)=e_{\_}{i}\}$. Specifically, each path from root to a leaf in this tree, represents a unique outcome in the sample space $\Omega$.

Any subset of nodes in a tree that has the property that none of them is an ancestor of any other, is called an anti-chain. If we use our tree-based notation to represent a node $v$, i.e., the sequence of edges $e_{\_}1,\dots,e_{\_}i$ corresponding to the path from root to $v$, then any prefix-free subset of nodes is an anti-chain. Any anti-chain that is not a proper subset of another anti-chain is called a maximal anti-chain. A stopping time in a martingale corresponds to a unique maximal anti-chain in the martingale tree.

Geometric Definitions and Relations. Consider curves $C$ and $D$ defined by the zeroes of $Y=f(X)$ and $Y=g(X)$, respectively, where $X\in[0,1]$. We restrict to curves $C$ and $D$ such that each one of them have exactly one intersection with $X=x$, for any $x\in[0,1]$. Refer to Fig. 4 for intuition. Then, we say $C$ is above $D$, represented by $C\succcurlyeq D$, if, for each $x\in[0,1]$, we have $f(x)\geqslant g(x)$.

3 Large Gaps in Martingales: A Geometric Approach

This section presents a high-level overview of our proof strategy. In the sequel, we shall assume that we are working with discrete-time martingales $(X_{\_}0,X_{\_}1,\dotsc,X_{\_}n)$ such that $X_{\_}n\in{\{0,1\}}$.

Given a martingale $(X_{\_}0,\dotsc,X_{\_}n)$, its susceptibility is represented by the following quantity

[TABLE]

Intuitively, if a martingale has high susceptibility, then it has a stopping time such that the gap in the martingale while encountering the stopping time is large. Our objective is to characterize the least susceptibility that a martingale $(X_{\_}0,\dotsc,X_{\_}n)$ can achieve. More formally, given $n$ and $X_{\_}0$, characterize

[TABLE]

Our approach is to proceed by induction on $n$ to exactly characterize the curve $C_{\_}n(X)$, and our argument naturally constructs the best martingale that achieves $C_{\_}n(X_{\_}0)$.

We know that the base case is $C_{\_}1(X)=2X(1-X)$ (see Fig. 5 for this argument). 2. 2.

Given the curve $C_{\_}{n-1}(X)$, we identify a geometric transformation $T$ (see Fig. 8) that defines the curve $C_{\_}n(X)$ from the curve $C_{\_}{n-1}(X)$. Section 3.1 summarizes the proof of this inductive step that crucially relies on the geometric interpretation of the problem, which is one of our primary technical contributions. Furthermore, for any $n\geqslant 1$, there exist martingales such that its susceptibility is $C_{\_}n(X_{\_}0)$. 3. 3.

Finally, Section 3.2 proves that the curve $C_{\_}n(X)$ lies above the curve $L_{\_}n(X)\coloneqq\frac{2}{\sqrt{2n-1}}X(1-X)$ and below the curve $U_{\_}n(X)\coloneqq\frac{1}{\sqrt{n}}\sqrt{X(1-X)}$.

3.1 Proof of Theorem 1.1

Our objective is the following.

Given an arbitrary martingale $(X,E)$, find the maximum stopping time in this martingale, i.e., the stopping time $\tau_{\_}{\max}(X,E,1)$. 2. 2.

For any depth $n$ and bias $X_{\_}0$, construct a martingale that achieves the max-score. We refer to this martingale as the optimal martingale. A priori, this martingale need not be unique. However, we shall see that for each $X_{\_}0$, it is (essentially) a unique martingale.

We emphasize that even if we are only interested in the exact value of $C_{\_}n(X_{\_}0)$ for $X_{\_}0=1/2$, it is unavoidable to characterize $C_{\_}{n-1}(X)$, for all values of $X\in[0,1]$. Because, in a martingale $(X_{\_}0=1/2,X_{\_}1,\dotsc,X_{\_}n)$, the value of $X_{\_}1$ can be arbitrary. So, without a precise characterization of the value $C_{\_}{n-1}(X_{\_}1)$, it is not evident how to calculate the value of $C_{\_}n(X_{\_}0=1/2)$. Furthermore, understanding $C_{\_}n(X_{\_}0)$, for all $X_{\_}0\in[0,1]$, yields entirely new applications for our result.

Base Case of $n=1$. For a martingale $(X_{\_}0,X_{\_}1)$ of depth $n=1$, we have $X_{\_}1\in{\{0,1\}}$. Thus, without loss of generality, we assume that $E_{\_}1$ takes only two values (see Fig. 5). Then, it is easy to verify that the max-score is always equal to $2X_{\_}0(1-X_{\_}0)$. This score is witnessed by the stopping time $\tau=1$. So, we conclude that $\mathrm{opt}_{\_}1(X_{\_}0,1)=C_{\_}1(X_{\_}0)=2X_{\_}0(1-X_{\_}0)$

Inductive Step. $n=2$ (For Intuition). For simplicity, let us consider finite martingales, i.e., the sample space $\Omega_{\_}i$ of the random variable $E_{\_}i$ is finite. Suppose that the root $X_{\_}0=x$ in the corresponding martingale tree has $t$ children with values $x^{{\left(1\right)}},x^{{\left(2\right)}},\dotsc,x^{{\left(t\right)}}$, and the probability of choosing the $j$-th child is $p^{{\left(j\right)}}$, where $j\in\{1,\dotsc,t\}$ (see Fig. 6).

Given a martingale $(X_{\_}0,X_{\_}1,X_{\_}2)$, the adversary’s objective is to find the stopping time $\tau$ that maximizes the score $\EX{\lvert X_{\_}\tau-X_{\_}{\tau-1}\rvert}$. If the adversary chooses to stop at $\tau=0$, then the score $\EX{\lvert X_{\_}\tau-X_{\_}{\tau-1}\rvert}=0$, which is not a good strategy. So, for each $j$, the adversary chooses whether to stop at the child $x^{{\left(j\right)}}$, or continue to a stopping time in the sub-tree rooted at $x^{{\left(j\right)}}$. The adversary chooses the stopping time based on which of these two strategies yield a better score. If the adversary stops the martingale at child $j$, then the contribution of this decision to the score is $p^{{\left(j\right)}}\lvert x^{{\left(j\right)}}-x\rvert$. On the other hand, if she does not stop at child $j$, then the contribution from the sub-tree is guaranteed to be $p^{{\left(j\right)}}C_{\_}1(x^{{\left(j\right)}})$. Overall, from the $j$-th child, an adversary obtains a score that is at least $p^{{\left(j\right)}}\max\left\{\lvert x^{{\left(j\right)}}-x\rvert,C_{\_}1(x^{{\left(j\right)}})\right\}$.

Let $h^{{\left(j\right)}}\coloneqq\max\left\{\lvert x^{{\left(j\right)}}-x\rvert,C_{\_}1(x^{{\left(j\right)}})\right\}$. We represent the points $Z^{{\left(j\right)}}=(x^{{\left(j\right)}},h^{{\left(j\right)}})$ in a two dimensional plane. Then, clearly all these points lie on the solid curve defined by $\max\left\{\lvert X-x\rvert,C_{\_}1(X)\right\}$, see Fig. 7.

Since $(X,E)$ is a martingale, we have $x=\sum_{\_}{j=1}^{t}p^{{\left(j\right)}}x^{{\left(j\right)}}$ and the adversary’s strategy for finding $\tau_{\_}{\max}$ gives us $\mathrm{max\textnormal{-}score}_{\_}1(X,E)=\sum_{\_}{j=1}^{t}p^{{\left(j\right)}}h^{{\left(j\right)}}$. This observation implies that the coordinate $(x,\mathrm{max\textnormal{-}score}_{\_}1(X,E))=\sum_{\_}{j=1}^{t}p^{{\left(j\right)}}Z^{{\left(j\right)}}$. So, the point in the plane giving the adversary the maximum score for a tree of depth $n=2$ with bias $X_{\_}0=x$ lies in the intersection of the convex hull of the points $Z^{{\left(1\right)}},\dotsc,Z^{{\left(t\right)}}$, and the line $X=x$. Let us consider the martingale defined in Fig. 7 as a concrete example. Here $t=4$, and the points $Z^{{\left(1\right)}},Z^{{\left(2\right)}},Z^{{\left(3\right)}},Z^{{\left(4\right)}}$ lie on $\max\left\{\lvert X-x\rvert,C_{\_}1(X)\right\}$. The martingale designer specifies the probabilities $p^{(1)},p^{(2)},p^{(3)}$, and $p^{(4)}$, such that $p^{(1)}x^{(1)}+\dotsi+p^{(4)}x^{(4)}=x$. These probabilities are not represented in Fig. 7. Note that the point $\left(p^{(1)}x^{(1)}+\dots+p^{(4)}x^{(4)},p^{(1)}h^{(1)}+\dots+p^{(4)}h^{(4)}\right)$ representing the score of the adversary is the point $p^{(1)}Z^{(1)}+\dots+p^{(4)}Z^{(4)}$. This point lies inside the convex hull of the points $Z^{(1)},\dots,Z^{(4)}$ and on the line $X=p^{(1)}x^{(1)}+\dots+p^{(4)}x^{(4)}=x$. The exact location depends on $p^{(1)},\dots,p^{(4)}$.

The point $Q^{\prime}$ is the point with minimum height. Observe that the height of the point $Q^{\prime}$ is at least the height of the point $Q$. So, in any martingale, the adversary shall find a stopping time that scores more than (the height of) the point $Q$.

On the other hand, the martingale designer’s objective is to reduce the score that an adversary can achieve. So, the martingale designer chooses $t=2$, and the two points $Z^{{\left(1\right)}}=P_{\_}1$ and $Z^{{\left(2\right)}}=P_{\_}2$ to construct the optimum martingale. We apply this method for each $x\in[0,1]$ to find the corresponding point $Q$. That is, the locus of the point $Q$, for $x\in[0,1]$, yields the curve $C_{\_}2(X)$.

We claim that the height of the point $Q$ is the harmonic-mean of the heights of the points $P_{\_}1$ and $P_{\_}2$. This claim follows from elementary geometric facts. Let $h_{\_}1$ represent the height of the point $P_{\_}1$, and $h_{\_}2$ represent the height of the point $P_{\_}2$. Observe that the distance of $x-x_{\_}S(x)=h_{\_}1$ (because the line $\ell_{\_}1$ has slope $\pi-\pi/4$). Similarly, the distance of $x_{\_}L(x)-x=h_{\_}2$ (because the line $\ell_{\_}2$ has slope $\pi/4$). So, using properties of similar triangles, the height of $Q$ turns out to be

[TABLE]

This property inspires the definition of the geometric transformation $T$, see Fig. 8. Applying $T$ on the curve $C_{\_}1(X)$ yields the curve $C_{\_}2(X)$ for which we have $C_{\_}2(x)=\mathrm{opt}_{\_}2(x,1)$.

General Inductive Step. Note that a similar approach works for general $n=d\geqslant 2$. Fix $X_{\_}0$ and $n=d\geqslant 2$. We assume that the adversary can compute $C_{\_}{d-1}(X_{\_}1)$, for any $X_{\_}1\in[0,1]$.

Suppose the root in the corresponding martingale tree has $t$ children with values $x^{{\left(1\right)}},x^{{\left(2\right)}},\dotsc,x^{{\left(t\right)}}$, and the probability of choosing the $j$-th child is $p^{{\left(j\right)}}$ (see Fig. 6). Let $(X^{{\left(j\right)}},E^{{\left(j\right)}})$ represent the martingale associated with the sub-tree rooted at $x^{{\left(j\right)}}$.

For any $j\in\{1,\dotsc,t\}$, the adversary can choose to stop at the child $j$. This decision will contribute $\lvert x^{{\left(j\right)}}-x\rvert$ to the score with weight $p^{{\left(j\right)}}$. On the other hand, if she continues to the subtree rooted at $x^{{\left(j\right)}}$, she will get at least a contribution of $\mathrm{max\text{-}score}_{\_}1(X^{{\left(j\right)}},E^{{\left(j\right)}})$ with weight $p^{{\left(j\right)}}$. Therefore, the adversary can obtain the following contribution to her score

[TABLE]

Similar to the case of $n=2$, we define the points $Z^{{\left(1\right)}},\dotsc,Z^{{\left(t\right)}}$. For $n>2$, however, there is one difference from the $n=2$ case. The point $Z^{{\left(j\right)}}$ need not lie on the solid curve, but it can lie on or above it, i.e., they lie in the gray area of Fig. 9. This phenomenon is attributable to a suboptimal martingale designer producing martingales with suboptimal scores, i.e., strictly above the solid curve. For $n=1$, it happens to be the case that, there is (effectively) only one martingale that the martingale designer can design (the optimal tree). The adversary obtains a score that is at least the height of the point $Q^{\prime}$, which is at least the height of $Q$. On the other hand, the martingale designer can choose $t=2$, and $Z^{{\left(1\right)}}=P_{\_}1$ and $Z^{{\left(2\right)}}=P_{\_}2$ to define the optimum martingale. Again, the locus of the point $Q$ is defined by the curve $T(C_{\_}{d-1})$.

Conclusion. So, by induction, we have proved that $C_{\_}n(X)=T^{n-1}(C_{\_}1(X))$. Additionally, note that, during induction, in the optimum martingale, we always have $\lvert x^{{\left(0\right)}}-x\rvert=C_{\_}{n-1}(x^{{\left(0\right)}})$ and $\lvert x^{{\left(1\right)}}-x\rvert=C_{\_}{n-1}(x^{{\left(1\right)}})$. Intuitively, the decision to stop at $x^{{\left(j\right)}}$ or continue to the subtree rooted at $x^{{\left(j\right)}}$ has identical consequence. So, by induction, all stopping times in the optimum martingale have score $C_{\_}n(x)$.

Appendix A provides a more technical proof.

3.2 Estimation of $C_{\_}n(X)$ : Proof of Lemma 1.2

In this section, we prove Lemma 1.2, which tightly estimates the curve $C_{\_}n$.

Recall that we defined $L_{\_}n(X)=\frac{2}{\sqrt{2n-1}}X(1-X)$ and $U_{\_}n(X)=\frac{1}{\sqrt{n}}\sqrt{X(1-X)}$. Our objective is to inductively prove that $U_{\_}n\succcurlyeq C_{\_}n\succcurlyeq L_{\_}n$. To this end, we define the curve $G_{\_}n\coloneqq a_{\_}nX(1-X)$ where $a_{\_}1=2$ and $a_{\_}{n+1}=2\left(\frac{\sqrt{a_{\_}n^{2}+1}-1}{a_{\_}n}\right)$. Notice that $G_{\_}1(X)=L_{\_}1(X)$ for all $X\in[0,1]$. Moreover, it follows from Lemma 3.8 that $a_{\_}n\geqslant\frac{2}{\sqrt{2n-1}}$, and so $G_{\_}n\succcurlyeq L_{\_}n$. Observe that since we do not have a closed form for $G_{\_}n$, we use $L_{\_}n$ as a lower bound.

Proof 3.1**.**

Since $G_{\_}n\succcurlyeq L_{\_}n$, it is sufficient to prove by induction that $U_{\_}n\succcurlyeq C_{\_}n\succcurlyeq G_{\_}n$.

Base Case of $n=1$. Since, $C_{\_}1(X)=G_{\_}1(X)=2X(1-X)$, it is obvious that $C_{\_}1\succcurlyeq G_{\_}1$. Moreover, we know that $U_{\_}1(X)=\sqrt{X(1-X)}$. It is easy to verify that $U_{\_}1(X)\geqslant C_{\_}1(X)$ for all $X\in[0,1]$ which is equivalent to $U_{\_}1\succcurlyeq C_{\_}1$.

Inductive Argument.

Suppose we have $U_{\_}n\succcurlyeq C_{\_}n\succcurlyeq G_{\_}n$. Then, we have $T(U_{\_}n)\succcurlyeq T(C_{\_}n)\succcurlyeq T(G_{\_}n)$ (by Claim 1). Note that $C_{\_}{n+1}=T(C_{\_}n)$. We shall prove that $T(G_{\_}n)\succcurlyeq G_{\_}{n+1}$, and $U_{\_}{n+1}\succcurlyeq T(U_{\_}n)$ (refer to Claim 2 and Claim 4) respectively. Consequently, it follows that $U_{\_}{n+1}\succcurlyeq C_{\_}{n+1}\succcurlyeq G_{\_}{n+1}$. Fig. 10 pictorially summarizes this argument.

Claim 1**.**

Let $C$ and $D$ be concave downward curves in the domain $X\in[0,1]$, and both curves $C$ and $D$ are above the axis $Y=0$ and contain the points $(0,0)$ and $(1,0)$. Let $C$ and $D$ be curves such that $C\succcurlyeq D$ in the domain $X\in[0,1]$, then the curve $T(C)\succcurlyeq T(D)$.

Proof 3.2**.**

*See Fig. 11.

Observe that if the curves $C$ and $D$ are identical, then the result holds. So, let us assume that $C$ and $D$ are not identical. Note that if we have two distinct concave curves $C$ and $D$ such that $C\succcurlyeq D$ then these two curves cannot intersect at any additional point in the domain $(0,1)$. Fix $x\in(0,1)$. Let $Q_{\_}C=(x,y_{\_}C)$ be the intersection of the curve $T(C)$ with the line $X=x$. Similarly, let $y_{\_}D$ be the intersection of the curve $T(D)$ with the line $X=x$. Let $P$ be the point $(x,0)$. Let $\ell_{\_}0$ be the ray starting at $P$ with slope $135$-degrees. Let $\ell_{\_}1$ be the ray starting at $P$ with slope $45$-degrees. Let $\ell_{\_}0$ intersect the curves $D$ and $C$ at $L_{\_}{D}$ and $L_{\_}{C}$, respectively. And, let $\ell_{\_}1$ intersect the curves $D$ and $C$ at $R_{\_}D$ and $R_{\_}C$, respectively. Observe in the triangles $\Delta PL_{\_}CR_{\_}C$ and $\Delta PL_{\_}DR_{\_}D$ the line segment $L_{\_}CR_{\_}C$ does not intersect with the line segment $L_{\_}DR_{\_}D$. Otherwise, if the line segments $L_{\_}CR_{\_}C$ intersects with $L_{\_}DR_{\_}D$, then the distinct concave curves $C$ and $D$ intersect at some point with X-coordinate in $(0,1)$ as well (a contradiction).

Therefore, we have $L_{\_}CR_{\_}C\succcurlyeq L_{\_}DR_{\_}D$. Note that $y_{\_}C$ is the intersection of $L_{\_}CR_{\_}C$ with $X=x$, and $y_{\_}D$ is the intersection of $L_{\_}DR_{\_}D$ with $X=x$. So, we have $y_{\_}C\succcurlyeq y_{\_}D$.*

In the following claim, we show that the transformation of a curve whose characteristics are specified below, will be “above” the curve itself.

Claim 2**.**

Let $F_{\_}n$ be the curve above $Y=0$ defined by the zeros of the equation $Y=f_{\_}nX(1-X)$, where $f_{\_}1>0$ and $f_{\_}{n+1}=2\left(\frac{\sqrt{f_{\_}n^{2}+1}-1}{f_{\_}n}\right)$ for all $n\geqslant 1$. Then, we have $T(F_{\_}n)\succcurlyeq F_{\_}{n+1}$.

Proof 3.3**.**

For each $k$, the curve $F_{\_}k$ is a concave downward curve that contains the points $(0,0)$ and $(1,0)$, so based on Claim 3, for each $k$, the curve $T(F_{\_}k)$ is also concave downward and contains the points $(0,0)$ and $(1,0)$.

Let us fix $x\in[0,1]$ and let $x_{\_}0\in[0,1]$ denotes the smaller root of the two roots of the equation $x^{*}+f_{\_}nx^{*}(1-x^{*})=x$ and let $y_{\_}0$ be the value $f_{\_}nx_{\_}0(1-x_{\_}0)$. Moreover, let $x_{\_}1\in[0,1]$ denotes the larger root of the two roots of the equation $x^{*}-f_{\_}nx^{*}(1-x^{*})=x$ and let $y_{\_}1$ be the value $f_{\_}nx_{\_}1(1-x_{\_}1)$. So, we have

[TABLE]

and

[TABLE]

and since $F_{\_}n(x)=F_{\_}n(1-x)$ (i.e. $F_{\_}n$ is a symmetric curve around $\frac{1}{2}$), $y_{\_}1$ can be found by replacing $x$ with $1-x$ in the formula that we found for $y_{\_}0$.

[TABLE]

To prove the claim, it suffices to show that the harmonic mean of $y_{\_}0$ and $y_{\_}1$ is at least equal to $f_{\_}{n+1}\cdot x(1-x)$. We make the substitution $x=1/2-z$ and we need to consider only $z\in[0,1/2]$ because as mentioned earlier the curves are symmetric around the line $X=1/2$. From this substitution, we get

[TABLE]

And also,

[TABLE]

Let us define,

[TABLE]

Notice that $\ell=\frac{(1-4z^{2})}{2f_{\_}n}\left(\sqrt{f_{\_}n^{2}+1}-1\right)$. So, we need to prove the following

[TABLE]

We used the fact that for any $a,b$, $\mathrm{H.M.}(a,b)=\frac{2ab}{a+b}=\frac{1}{\mathrm{A.M.}(a,b)}$. The last inequality is due to RMS-AM inequality.

In the following claim, we show that the geometric transformation $T$ preserves some characteristics of the curve it is transforming - specifically if the original curve was concave downward and symmetric around $\frac{1}{2}$ then the new curve obtained will also retain these properties.

Claim 3**.**

Suppose the curve $C$ which is concave downward in the interval $X\in[0,1]$ and symmetric around $\frac{1}{2}$, and the points $(0,0)$ and $(1,0)$ lie on it - is given. Suppose the curve $F$ is a curve defined by applying transformation $T$, defined in Fig. 8, on curve $C$. Then, $F$ has the same properties i.e. $F$ is also concave downward, symmetric around $\frac{1}{2}$, and contains the points $(0,0)$ and $(1,0)$.

Proof 3.4**.**

Since $C$ is symmetric around $\frac{1}{2}$, the point $(x,y)$ lies on the curve if and only if the point $(1-x,y)$ lies on the curve. Suppose that the curve $C$ is defined by the zeros of the equation $Y=f(X)$ and the curve $T(C)$ is defined by the zeros of the equation $Y=g(X)$. Then, according to the definition of the transformation $T$, $g(x)=\mathrm{H.M.}(y^{(1)},y^{(2)})$ where $y^{(1)}=f(x^{(1)})$ and $y^{(2)}=f(x^{(2)})$ where $x^{(1)}$ is the solution of $X+f(X)=x$ and $x^{(2)}$ is the solution of $X-f(X)=x$. Note that since $f(x)=f(1-x)$, we have that $1-x^{(1)}$ is the solution of $X-f(X)=1-x$ and $1-x^{(2)}$ is the solution of the equation $X+f(X)=1-x$. Similarly, since $f(1-x^{(1)})=f(x^{(1)})=y^{(1)}$ and $f(1-x^{(2)})=f(x^{(2)})=y^{(2)}$, it follows that $g(1-x)=\mathrm{H.M.}(y^{(2)},y^{(1)})=g(x)$ which implies that $T(C)$ is symmetric around $\frac{1}{2}$. For $x=0$ or $x=1$, $y^{(1)}$ or $y^{(2)}$ is [math] and so $g(1)=g(0)=0$.

We provide a geometric proof to show that $F$ is concave downwards and use Fig. 12 as illustration. We know that a curve is concave downward in an interval if and only if the line that joins any two points of the curve is below the curve. Let us fix $x_{\_}1\leqslant x_{\_}3$ in $[0,1]$, see Fig. 12. The height of points $H_{\_}1,H_{\_}2,H_{\_}3$ are respectively the value of $T(C)$ at points $x_{\_}1,x_{\_}2,x_{\_}3$ respectively. Our goal is to show that $H_{\_}2$ is above the segment $H_{\_}1H_{\_}3$ for any choice of $x_{\_}2$. Observe that, $H_{\_}2$ lies on the segment $P_{\_}2Q_{\_}2$. Since $C$ is concave down, the segment $P_{\_}2Q_{\_}2$ is above the segment $F_{\_}1F_{\_}2$. Note that we are fixing $x_{\_}1$ and $x_{\_}3$ and allowing $x_{\_}2$ to change between $x_{\_}1$ and $x_{\_}3$. Then, we see that the segment $F_{\_}1F_{\_}2$ changes from $P_{\_}1Q_{\_}1$ to $P_{\_}3Q_{\_}3$ and is always above the segment $H_{\_}1H_{\_}3$.

Claim 4**.**

Let $U_{\_}n$ be defined by the zeros of the curve $Y=u_{\_}n\sqrt{X(1-X)}$, where $u_{\_}n>0$ for all $n\geqslant 1$ and $X\in[0,1]$. Then, we have $U_{\_}{n+1}\succcurlyeq T(U_{\_}n)$.

Proof 3.5**.**

Let $x_{\_}0$ be the smaller of the two roots of the equation $x_{\_}0+u_{\_}n\sqrt{x_{\_}0(1-x_{\_}0)}=x$, and $x_{\_}1$ be the larger of the two roots of the equation $x+u_{\_}n\sqrt{x_{\_}1(1-x_{\_}1)}=x_{\_}1$. So, we have

[TABLE]

Now, let $y_{\_}0=u_{\_}n\sqrt{x_{\_}0(1-x_{\_}0)}$. Then, we have

[TABLE]

We substitute $x=1/2-z$ and need to consider only $z\in[0,1/2]$ because the curves are symmetric around the line $X=1/2$. From this substitution, we have

[TABLE]

Now, the expression of $y_{\_}1=u_{\_}n\sqrt{x_{\_}1(1-x_{\_}1)}$ is

[TABLE]

Note that $u_{\_}{n+1}\sqrt{x(1-x)}=\frac{u_{\_}n}{\sqrt{u_{\_}n^{2}+1}}\sqrt{\frac{1}{4}-z^{2}}$.

Now,

[TABLE]

The final inequality follows from the HM-GM inequality and the following simplifications

[TABLE]

The following result is used in the proof of Lemma 3.8.

Lemma 3.6**.**

For $x\geqslant 0$, we have $\frac{1}{4\left(\sqrt{x+1}-\sqrt{x}\right)^{2}}\leqslant x+\frac{1}{2}$.

Proof 3.7**.**

[TABLE]

The last inequality follows from the RMS-AM inequality.

Lemma 3.8**.**

Suppose a sequence $a_{\_}1,a_{\_}2,\dots$ is given such that $a_{\_}{n+1}=2\left(\frac{\sqrt{a_{\_}n^{2}+1}-1}{a_{\_}n}\right)$, then

[TABLE]

Proof 3.9**.**

Let $b_{\_}j\coloneqq\frac{1}{a_{\_}j^{2}}$, so $a_{\_}j=\frac{1}{\sqrt{b_{\_}j}}$. Now, it follows from $a_{\_}{j+1}=2\left(\frac{\sqrt{a_{\_}j^{2}+1}-1}{a_{\_}j}\right)$ that $b_{\_}{j+1}=\frac{1}{4\left(\sqrt{b_{\_}{j}+1}-\sqrt{b_{\_}j}\right)^{2}}$ and according to Lemma 3.6, $b_{\_}{j+1}\leqslant b_{\_}j+\frac{1}{2}$, for $j\geqslant 1$. Therefore,

[TABLE]

Therefore,

[TABLE]

4 Applications

This section discusses various consequences of Theorem 1.1 and other related results.

4.1 Distributed Coin-Tossing Protocol

We consider constructing distributed $n$-processor coin-tossing protocols where the $i$-th processor broadcasts her message in the $i$-th round. We shall study this problem in the information-theoretic setting. Our objective is to design $n$-party distributed coin-tossing protocols where an adversary cannot bias the distribution of the final outcome significantly.

For $X_{\_}0=1/2$, one can consider the incredibly elegant “majority protocol” [10, 5, 13]. The $i$-th processor broadcasts a uniformly random bit in round $i$. The final outcome of the protocol is the majority of the $n$ outcomes, and an adversary can bias the final outcome by $\frac{1}{\sqrt{2\pi n}}$ by restarting a processor once [13].

We construct distributed $n$-party bias-$X_{\_}0$ coin-tossing protocols, for any $X_{\_}0\in[0,1]$, and our new protocol for $X_{\_}0=1/2$ is more robust to restarting attacks than this majority protocol. Fix $X_{\_}0\in[0,1]$ and $n\geqslant 1$. Consider the optimal martingale $(X_{\_}0,X_{\_}1,\dotsc,X_{\_}n)$ guaranteed by Theorem 1.1. The susceptibility corresponding to any stopping time is $=C_{\_}n(X_{\_}0)\leqslant U_{\_}n(X_{\_}0)=\frac{1}{\sqrt{n}}\sqrt{X_{\_}0(1-X_{\_}0)}$. Note that one can construct an $n$-party coin-tossing protocol where the $i$-th processor broadcasts the $i$-th message, and the corresponding Doob’s martingale is identical to this optimal martingale. An adversary who can restart a processor once biases the outcome of this protocol by at most $\frac{1}{2}C_{\_}n(X_{\_}0)$, this is discussed in Section 4.3.

Corollary 4.1** (Distributed Coin-tossing Protocols).**

For every $X_{\_}0\in[0,1]$ and $n\geqslant 1$ there exists an $n$-party bias-$X_{\_}0$ coin-tossing protocol such that any adversary who can restart a processor once causes the final outcome probability to deviate by $\leqslant\frac{1}{2}C_{\_}n(X_{\_}0)\leqslant\frac{1}{2}U_{\_}n(X_{\_}0)=\frac{1}{2\sqrt{n}}\sqrt{X_{\_}0(1-X_{\_}0)}$.

For $X_{\_}0=1/2$, our new protocol’s outcome can be changed by $\frac{1}{4\sqrt{n}}$, which is less than the $\frac{1}{\sqrt{2\pi n}}$ deviation of the majority protocol. However, we do not know whether there exists a computationally efficient algorithm implementing the coin-tossing protocols corresponding to the optimal martingales.

4.2 Fail-stop Attacks on Coin-tossing/Dice-rolling Protocols

A two-party $n$-round bias-$X_{\_}0$ coin-tossing protocol is an interactive protocol between two parties who send messages in alternate rounds, and $X_{\_}0$ is the probability of the coin-tossing protocol’s outcome being heads. Fair computation ensures that even if one of the parties aborts during the execution of the protocol, the other party outputs a (randomized) heads/tails outcome. This requirement of guaranteed output delivery is significantly stringent, and Cleve [13] demonstrated a computationally efficient attack strategy that alters the output-distribution by $O(1/n)$, i.e., any protocol is $O(1/n)$ unfair. Defining fairness and constructing fair protocols for general functionalities has been a field of highly influential research [21, 22, 8, 4, 2, 28, 3]. This interest stems primarily from the fact that fairness is a desirable attribute for secure-computation protocols in real-world applications. However, designing fair protocol even for simple functionalities like (bias-$1/2$) coin-tossing is challenging both in the two-party and the multi-party setting. In the multi-party setting, several works [5, 9, 1] explore fair coin-tossing where the number of adversarial parties is a constant fraction of the total number of parties. For a small number of parties, like the two-party and the three-party setting, constructing such protocols have been extremely challenging even against computationally bounded adversaries [29, 24, 12]. These constructions (roughly) match Cleve’s $O(1/n)$ lower-bound in the computational setting.

In the information-theoretic setting, Cleve and Impagliazzo [14] exhibited that any two-party $n$-round bias-$1/2$ coin-tossing protocol are $\frac{1}{2560\sqrt{n}}$ unfair. In particular, their adversary is a fail-stop adversary who follows the protocol honestly except aborting prematurely. In the information-theoretic commitment-hybrid, there are two-party $n$-round bias-1/2 coin-tossing protocols that have $\approx 1/\sqrt{n}$ unfairness [10, 5, 13]. This bound matches the lower-bound of $\Omega(1/\sqrt{n})$ by Cleve and Impagliazzo [14]. It seems that it is necessary to rely on strong computational hardness assumptions or use these primitives in a non-black box manner to beat the $1/\sqrt{n}$ bound [15, 23, 16, 7].

We generalize the result of Cleve and Impagliazzo [14] to all 2-party $n$-round bias-$X_{\_}0$ coin-tossing protocols (and improve the constants by two orders of magnitude). For $X_{\_}0=1/2$, our fail-stop adversary changes the final outcome probability by $\geqslant\frac{1}{24\sqrt{2}}\cdot\frac{1}{\sqrt{n+1}}$.

Theorem 4.2** (Fail-stop Attacks on Coin-tossing Protocols).**

For any two-party $n$-round bias-$X_{\_}0$ coin-tossing protocol, there exists a fail-stop adversary that changes the final outcome probability of the honest party by at least $\frac{1}{12}C^{\prime}_{\_}n(X_{\_}0)\geqslant\frac{1}{12}L^{\prime}_{\_}n(X_{\_}0)\coloneqq\frac{1}{12}\sqrt{\frac{2}{n+1}}X_{\_}0(1-X_{\_}0)$, where $C^{\prime}_{\_}1(X)\coloneqq X(1-X)$ and $C^{\prime}_{\_}n(X)\coloneqq{T}^{n-1}(C^{\prime}_{\_}1(X))$.

This theorem is not a direct consequence of Theorem 1.1. The proof relies on an entirely new inductive argument; however, the geometric technique for this recursion is similar to the proof strategy for Theorem 1.1.

Before proving the above theorem, we provide some insight into our approach. Let $\Pi=\left\langle A,B\right\rangle$ be an $n$-round bias-$X_{\_}0$ coin-tossing protocol between Alice and Bob. Without loss of generality, assume that Alice sends messages in rounds $1,3,\dotsc$, and Bob sends messages in rounds $2,4,\dotsc$. The random variable $(E_{\_}1,\dotsc,E_{\_}i)$ represents the partial transcript of the protocol at the end of round $i$. The random variable $X_{\_}i$ represents the expected probability of heads at the end of the protocol execution conditioned on the current partial transcript at the end of round $i$. Note that $(X=(X_{\_}i)_{\_}{i=0}^{n},E=(E_{\_}i)_{\_}{i=1}^{n})$ is a Doob’s martingale.

We construct fail-stop adversaries only. Suppose Alice has to send the message in round $(i+1)$ (i.e., $i$ is even), but she aborts. Then, the defense $D_{\_}i$ is the probability of Bob outputting heads. Similarly, suppose Bob is supposed to send the message in round $(i+1)$ (i.e., $i$ is odd), but he aborts. Then, we define $D_{\_}i$ as the probability of Alice outputting heads. Note that $D_{\_}i$ is $(E_{\_}1,\dotsc,E_{\_}i)$ measurable. In other words, the defense of round $i$ is a function only of the partial transcript at the end of that round.

The high-level idea of our construction of a good fail-stop attack is the following. We shall use a stopping time $\tau$ to identify appropriate partial transcripts of $\Pi$ to abort. Suppose we have already generated a partial transcript $(e_{\_}1,\dotsc,e_{\_}i)$ (refer Fig. 3), and the next messages that are possible are $e_{\_}{i+1}\in\Omega_{\_}{i+1}$. Suppose $\tau$ stops the martingale at $e_{\_}{i+1}=e^{{\left(j\right)}}$. Note that $X_{\_}{i+1}=x^{{\left(j\right)}}$ is the probability of heads conditioned on the transcript $\Pi$ being $(e_{\_}1,\dotsc,e_{\_}i,e_{\_}{i+1}=e^{{\left(j\right)}})$. Further, the defense of the other party is $D_{\_}i$.

If $i$ is even, then Alice is supposed to send the $(i+1)$-th message. So, the stopping time $\tau$ is indicating Alice to abort if the message in the next round she plans to send is $e^{{\left(j\right)}}$. Suppose $x^{{\left(j\right)}}\leqslant D_{\_}i$. Then, if Alice aborts when her next message is $e^{{\left(j\right)}}$, then she is increasing the probability of heads by $p^{{\left(j\right)}}\lvert x^{{\left(j\right)}}-D_{\_}i\rvert$.

So, the conclusion is the following. If $i$ is even and $x^{{\left(j\right)}}\leqslant D_{\_}i$ then the advice of $\tau$ will be helpful to an adversarial Alice who is interested in increasing the probability of heads, say $A^{+}$. If $x^{{\left(j\right)}}>D_{\_}i$, then the advice of $\tau$ will be helpful to an adversarial Alice who is interested in reducing the probability of heads, say $A^{-}$. Similarly, when $i$ is odd, the advice of $\tau$ is useful to either $B^{+}$ or $B^{-}$.

Specialized Stopping Time. For this discussion, let us consider Fig. 8. Note that if $X_{\_}1$ is very small (that is, $X_{\_}1<x_{\_}S(x)$) or $X_{\_}1$ is very large (that is, $X_{\_}1>x_{\_}L(x)$), then the adversary aborts. Furthermore, if $X_{\_}1$ is close to $X_{\_}0$ (that is, $X_{\_}1\in[x_{\_}S(x),x_{\_}L(x)]$), then the adversary does not abort and recursively constructs the optimum stopping time. In particular (refer to Fig. 6 and Fig. 7) if there exists $x^{{\left(j\right)}}$ and $x^{{\left(j^{\prime}\right)}}$ such that $x^{{\left(j\right)}}<x_{\_}S(x)$ and $x^{{\left(j^{\prime}\right)}}>x_{\_}L(x)$ then the adversary aborts in both these two cases. This step is crucial to arguing that the point $Q^{\prime}$ is higher than the point $Q$ in Fig. 7, which, in turn, is key to the transformation definition.

However, if a stopping time stops the martingale at high as well as low values of $X_{\_}i$ then it is not evident how to to translate the susceptibility corresponding to this stopping time into output-bias achieved by a fail-stop adversary. So, we restrict to specialized stopping times with the following property (we use Fig. 8 for reference in the following definition).

Fix $n$ and $X_{\_}0$. Pick any $i=n-d$ and fix $E_{\_}1=e_{\_}1,\dotsc,E_{\_}i=e_{\_}i$. Let $x=(X_{\_}i|E_{\_}1=e_{\_}1,\dotsc,E_{\_}i=e_{\_}i)$.

•

Either, the specialized stopping time stops for all $X_{\_}{i+1}<x_{\_}S(x)$ and recursively stops $X_{\_}{i+1}\geqslant x_{\_}S(x)$ later, or

•

The specialized stopping time stops all $X_{\_}{i+1}>x_{\_}L(x)$ and recursively stops $X_{\_}{i+1}\leqslant x_{\_}L(x)$ later.

Now, it is not evident whether specialized stopping times also have high susceptibility.

Theorem 4.3**.**

Let $(X_{\_}0,X_{\_}1,\dotsc,X_{\_}n)$ be a discrete-time martingale such that $X_{\_}i\in[0,1]$, for all $i\in\{1,\dotsc,n\}$, and $X_{\_}n\in\{0,1\}$. Then, the following bound holds.

[TABLE]

where $C^{\prime}_{\_}1(X)\coloneqq X(1-X)$ and $C^{\prime}_{\_}n(X)\coloneqq{T}^{n-1}(C^{\prime}_{\_}1(X))$.

Let us start with the base case $n=1$. Note that a specialized stopping time cannot stop the martingale at both low and high $X_{\_}1$. So, we consider stopping times $\tau\colon\Omega\to\{1,\dotsc,n,\infty\}$, where $\tau=\infty$ for a full transcript indicates that the adversary did not abort. Note that a specialized stopping time can either stop the martingale when $X_{\_}1=0$ or $X_{\_}1=1$. In either of these two cases, the susceptibility is $C^{\prime}_{\_}1(X_{\_}0)=X_{\_}0(1-X_{\_}0)$.

For $n\geqslant 2$, we show that the recursive definition of the transform $T$ continues to hold even for specialized stopping time (refer Fig. 13 for intuition). Note that the adversary chooses the stopping time that achieves the highest susceptibility. So, the maximum height of $Q^{\prime}$ and $Q^{\prime\prime}$ in Fig. 13 is greater than the height of $Q$. We emphasize that this proof crucially relies on the fact that $C^{\prime}_{\_}{n-1}(X)$ lies below the curve $Y=\min\{X,1-X\}$. So, our result holds because $C^{\prime}_{\_}1(X)$ lies below the curve $Y=\min\{X,1-X\}$. Section 4.2.3 presents the full proof.

Finally, we translate the susceptibility of a specialized stopping time into output-bias that a fail-stop adversary can enforce. Section 4.2.2 provides the full proof of Theorem 4.2.

4.2.1 Black-box Separation Results

Gordon and Katz [22] introduced the notion of $1/p$-unfair secure computation for a fine-grained study of fair computation of functionalities. In this terminology, Theorem 4.2 states that $\frac{c}{\sqrt{n+1}}X_{\_}0(1-X_{\_}0)$-unfair computation of a bias-$X_{\_}0$ coin is impossible for any positive constant $c<\frac{\sqrt{2}}{12}$ and $X_{\_}0\in[0,1]$.

Cleve and Impagliazzo’s result [14] states that $\frac{c}{\sqrt{n}}$-unfair secure computation of the bias-$1/2$ coin is impossible for any positive constant $c<\frac{1}{2560}$. This result on the hardness of computation of fair coin-tossing was translated into black-box separations results. These results [15, 23, 16], intuitively, indicate that it is unlikely that $\frac{c}{\sqrt{n}}$-unfair secure computation of the bias-$1/2$ coin exists, for $c<\frac{1}{2560}$, relying solely on the black-box use of one-way functions. We emphasize that there are several restrictions imposed on the protocols that these works [15, 23, 16] consider; detailing all of which is beyond the scope of this draft. Substituting the result of [14] by Theorem 4.2, extends the results of [15, 23, 16] to general bias-$X_{\_}0$ coin-tossing protocols.

Corollary 4.4** (Informal: Black-box Separation).**

For any $X_{\_}0\in[0,1]$ and positive constant $c<\frac{\sqrt{2}}{12}$, the existence of $\frac{c}{\sqrt{n+1}}X_{\_}0(1-X_{\_}0)$-unfair computation protocol for a bias-$X_{\_}0$ coin is black-box separated from the existence of one-way functions (restricted to the classes of protocols considered by [15, 23, 16]).

4.2.2 Detailed Discussion of Our Fail-stop Attack and Proofs

Given a stopping time $\tau$ we shall associate the following score with it

[TABLE]

Intuitively, this score correctly accounts for the increase and decrease in the probability of heads in every round $i$. 333 The score is slightly pessimistic, which, we argue, is also necessary. Note that our expression is of the form $\lvert\EX{(X_{\_}i-D_{\_}{i-1})\mathbbm{1}_{\_}{\tau=i}|\dotsc}\rvert$. One might naïvely consider using the expression $\EX{\lvert X_{\_}i-D_{\_}{i-1}\rvert\mathbbm{1}_{\_}{\tau=i}|\dotsc}$ instead. However, there is an issue. Suppose the stopping time stops the martingale for all children of $X_{\_}i$. This strategy causes the outcome to deviate by $\lvert X_{\_}i-D_{\_}i\rvert$, and our expression correctly accounts for it (because $\EX{X_{\_}{i+1}}=X_{\_}i$). However, the alternative expression accounts for it incorrectly. Basically, the alternative expression might not be translatable into a deviation of outcome by a fail-stop attacker.

Claim 5**.**

We prove the following two statements

• •

If $0\leqslant x^{(\ell)}\leqslant x_{\_}0\leqslant x\leqslant 1$, (where $x_{\_}0$ is the solution of equation $x-x_{\_}0=C^{{}^{\prime}}_{\_}d(x_{\_}0)$ in $[0,1]$), $x-D\geqslant\frac{2}{3}\left(x-x^{(\ell)}\right)\geqslant 0$, and $x-x^{(\ell)}\geqslant C^{{}^{\prime}}_{\_}d(x^{(l)})$, then,

[TABLE]

• •

If $0\leqslant x\leqslant x_{\_}1\leqslant x^{(r)}\leqslant 1$, (where $x_{\_}1$ is the solution of equation $x_{\_}1-x=C^{{}^{\prime}}_{\_}d(x_{\_}1)$ in $[0,1]$), $D-x\geqslant\frac{2}{3}\left(x^{(r)}-x\right)\geqslant 0$, and $\left(x^{(r)}-x\right)\geqslant C^{{}^{\prime}}_{\_}d(x^{(r)})$, then

[TABLE]

Proof 4.5**.**

We prove the first statement. Since for each $n$, $C^{{}^{\prime}}_{\_}n(x)=C^{{}^{\prime}}_{\_}n(1-x)$, the second part is implied by the first part by replacing $x,D,x^{(\ell)}$ with $1-x,1-D,x^{(r)}=1-x^{(\ell)}$.

In order to show the first part, it is sufficient to show that $\frac{2}{3}(x-x^{(\ell)})\geqslant\frac{1}{3}C^{{}^{\prime}}_{\_}{d+1}(x)$.

We know that

[TABLE]

We also know that

[TABLE]

and,

[TABLE]

Combining the above two relations we have

[TABLE]

The proof follows from observing that $x-D\geqslant\frac{2}{3}(x-x^{(\ell)})$ from our assumption.

We will use specialized stopping time defined in Section 4.2 to construct a stopping time for our fail-stop adversary. More formally, given a stopping time $\tau_{\_}1$ from Theorem 4.3 such that $\sup_{\_}{\tau_{\_}1}\EX{\lvert X_{\_}{\tau_{\_}1}-X_{\_}{{\tau_{\_}1}-1}\rvert}\geqslant C^{{}^{\prime}}_{\_}n(X_{\_}0)$, there exists a stopping time $\tau_{\_}2$ such that $S^{\prime}(\tau_{\_}2)\geqslant\frac{1}{3}C^{{}^{\prime}}_{\_}n(X_{\_}0)$.

Proof 4.6**.**

The proof will proceed by induction on $n$.

Base Case: For $n=1$, see Fig. 14.

Recall that $C^{{}^{\prime}}_{\_}1(x)=x(1-x)$. We have two cases

• •

If $D\geqslant x$, we define $\tau_{\_}2$ as the stopping time that stops only at [math]. Then, $D(1-x)\geqslant x(1-x)\geqslant\frac{1}{3}x(1-x)\geqslant\frac{1}{3}C^{{}^{\prime}}_{\_}1(x)$.

• •

If $D<x$, we define $\tau_{\_}2$ as the stopping time that stops only at $1$. Then $(1-D)x\geqslant x(1-x)\geqslant\frac{1}{3}x(1-x)\geqslant\frac{1}{3}C^{{}^{\prime}}_{\_}1(x)$. 2. 2.

Assume the claim is true for $n=d$, see Fig. 15.

For each edge $\left(x,x^{(j)}\right)$, if $|x-x^{(j)}|\geqslant C^{{}^{\prime}}_{\_}d\left(x^{(j)}\right)$, then mark the edge. Let

[TABLE]

Without loss of generality, we assume that the nodes are in-order.

Denote $\mathtt{Left}:=\{j:\ x^{(j)}\leqslant x\}\bigcap\mathtt{Marked}$ and $\mathtt{Right}:=\{j:\ x^{(j)}\geqslant x\}\bigcap\mathtt{Marked}$. We analyze three possible cases

• •

Case 1. No edges are marked. This means that for all $j$, $|x-x^{(j)}|\leqslant C^{{}^{\prime}}_{\_}d\left(x^{(j)}\right)$. The adversarial strategy is to recurse on the underlying subtrees. The overall deviation in this case is given by

[TABLE]

• •

Case 2. There exists a marked edge $j$ such that $D\leqslant\frac{x+2x^{(j)}}{3}$, and $x\geqslant x^{(j)}$, or $D\geqslant\frac{x+2x^{(j)}}{3}$, and $x^{(j)}\geqslant x$. The adversarial strategy is to abort at the parent.

Suppose $D\leqslant\frac{x+2x^{(j)}}{3}$ and $x\geqslant x^{(j)}$, then $x-D\geqslant\frac{2}{3}(x-x^{(j)})$, the rest follows from Claim 5. If $D\geqslant\frac{x+2x^{(j)}}{3}$ and $x^{(j)}\geqslant x$, then $D-x\geqslant\frac{2}{3}(x^{(j)}-x)$ and the rest again follows from Claim 5.

• •

If Case 1 and Case 2 are not satisfied, then $\mathtt{Marked}$ is not empty but for any marked edge $j$ that $x\geqslant x^{(j)}$, we have $D>\frac{x+2x^{(j)}}{3}$ and for any marked edge $j$ that $x\leqslant x^{(j)}$, we have $D<\frac{x+2x^{(j)}}{3}$. Note that since $\mathtt{Marked}$ is not empty, at least one of the two sets $\mathtt{Left}$ and $\mathtt{Right}$ is not empty. Two cases can happen:

• –

*Case 3.1 Both $\mathtt{Left}$ and $\mathtt{Right}$ are non-empty. *

Then there exist $\ell^{*}$ and $r^{*}$ such that $\frac{x+2x^{(\ell^{*})}}{3}<D<\frac{x+2x^{(r^{*})}}{3}$ where $\ell^{*}:=\max_{\_}\ell\mathtt{Left}$ and $r^{*}:=\min_{\_}r\mathtt{Right}$. There are two sub-cases in this scenario :

*Case 3.1.1 $\frac{x+2x^{(\ell^{*})}}{3}<D\leqslant x$. *

The adversarial strategy is to follow the strategy of $\tau_{\_}1$. If the strategy of $\tau_{\_}1$ is to abort on left marked edges and recurse on the rest, then we have the following analysis:

For any $\ell\in\mathtt{Left}$, $\ell\leqslant\ell^{*}$, and we have

[TABLE]

The total deviation from aborting on the left marked edges is given by

[TABLE]

The total deviation from recursing on the right edges and unmarked edges is given by

[TABLE]

The overall deviation is

[TABLE]

*In above, the last inequality holds due to the fact that $\tau_{\_}1$ is a specialized stopping time and martingale aborts on left marked edges and recurses on the rest which is exactly what $\tau_{\_}1$ suggests. *

If the strategy of $\tau_{\_}1$ is to abort on the right marked edges and recurse on the rest, then we have the following analysis.

For any $r\in\mathtt{Right}$ such that $r\geqslant r^{*}$, we have

[TABLE]

The total deviation from aborting on the right marked edges is given by

[TABLE]

The total deviation from recursing on the left edges and unmarked edges is given by

[TABLE]

The overall deviation is

[TABLE]

In above, the last inequality holds due to the fact that $\tau_{\_}1$ is a specialized stopping time and martingale aborts on right marked edges and recurses on the rest which is exactly what $\tau_{\_}1$ suggests.

• *

*Case 3.1.2. $x<D<\frac{x+2x^{(r^{*})}}{3}$. *

The adversarial strategy is the same as above : Follow the strategy of $\tau_{\_}1$. The analysis is almost identical to the one above due to symmetry.

• –

*Case 3.2. Either $\mathtt{Left}$ or $\mathtt{Right}$ is empty. *

*The adversarial strategy is to abort at all marked edges and recurse on all unmarked edges. *

Suppose $\mathtt{Right}$ is empty, then $\frac{x+2x^{(\ell^{*})}}{3}<D<x$, where $\ell^{*}:=\max_{\_}\ell\mathtt{Left}$. The analysis is the same as in Case 3.1.1. If $\mathtt{Left}$ is empty then the analysis is the same as Case 3.1.2.

The above proof shows that $S^{\prime}(\tau_{\_}2)\geqslant\frac{1}{3}C^{\prime}_{\_}n(X_{\_}0)$. In order to estimate $C^{\prime}_{\_}n(X_{\_}0)$, we define $L^{\prime}_{\_}n(X)=\sqrt{\frac{2}{n+1}}X(1-X)$ and claim that $C^{\prime}_{\_}n(X)\succcurlyeq L_{\_}n^{\prime}(X)$.

To prove our claim, we define the curve $G^{\prime}_{\_}n(X)\coloneqq a^{\prime}_{\_}nX(1-X)$ such that $a^{\prime}_{\_}1=1$ and $a^{\prime}_{\_}{n+1}=2\left(\frac{\sqrt{a^{\prime 2}_{\_}n+1}-1}{a^{\prime}_{\_}n}\right)$ for $n\geqslant 1$ and we prove by induction that $C^{\prime}_{\_}n\succcurlyeq G^{\prime}_{\_}n$ for all $n$ as below: (analogous to the one shown for Lemma 1.2)

Base Case of $n=1$. Since, $C^{\prime}_{\_}1(X)=G^{\prime}_{\_}1(X)=X(1-X)$, it is obvious that $C^{\prime}_{\_}1\succcurlyeq G^{\prime}_{\_}1$.

Inductive Argument. Suppose we have $C^{\prime}_{\_}n\succcurlyeq G^{\prime}_{\_}n$. Then, we have $T(C^{\prime}_{\_}n)\succcurlyeq T(G^{\prime}_{\_}n)$ (by Claim 1). Note that $C^{\prime}_{\_}{n+1}=T(C^{\prime}_{\_}n)$. We know that $T(G^{\prime}_{\_}n)\succcurlyeq G^{\prime}_{\_}{n+1}$ (refer to Claim 2 ). Consequently, it follows that $C^{\prime}_{\_}{n+1}\succcurlyeq G^{\prime}_{\_}{n+1}$.

So far, we have proved that $C^{\prime}_{\_}n\succcurlyeq G^{\prime}_{\_}n$ for all $n$. Recall that $G^{\prime}_{\_}n(X)\coloneqq a^{\prime}_{\_}nX(1-X)$ such that $a^{\prime}_{\_}1=1$ and $a^{\prime}_{\_}{n+1}=2\left(\frac{\sqrt{a^{\prime 2}_{\_}n+1}-1}{a^{\prime}_{\_}n}\right)$. Now, by using Lemma 3.8, we conclude that $a^{\prime}_{\_}n\geqslant\sqrt{\frac{2}{n+1}}$. Thus, $C^{\prime}_{\_}{n}\succcurlyeq L^{\prime}_{\_}{n}$. Now we can say that $S^{\prime}(\tau_{\_}2)\geqslant\frac{1}{3}C^{\prime}_{\_}n(X_{\_}0)\geqslant\frac{1}{3}L^{\prime}_{\_}n(X_{\_}0)$. Further, any contribution to this score is attributable to one of the following four interactions: (1) ${\left\langle{A^{+},B}\right\rangle}$ (i.e., adversarial Alice increasing the probability of heads by aborting), (2) ${\left\langle{A^{-},B}\right\rangle}$, (3) ${\left\langle{A,B^{+}}\right\rangle}$, and (4) ${\left\langle{A,B^{-}}\right\rangle}$. By an averaging argument, this implies that one of the parties can deviate the outcome of the other party by at least $\frac{1}{12}L^{\prime}_{\_}n(X_{\_}0)$. This concludes our proof of Theorem 4.2.

Similar to the previous section, Theorem 4.2 extends to $\omega$-faceted dice-rolling protocols by considering any subset $S\subseteq\{0,1,\dotsc,\omega-1\}$ of outcomes, and considering the final outcome being in $S$ as the interesting event for the martingale.

4.2.3 Discussion of Specialized Stopping Time - Proof of Theorem 4.3

Before proving the theorem, we define the sequence of functions $\{g_{\_}n\}_{\_}{n=1}^{\infty}$ recursively. Let $A_{\_}n(X_{\_}0)$ be the set of all martingales $X=\left(X_{\_}0,X_{\_}1,\dotsc,X_{\_}{n}\right)$ such that for each $0\leqslant i\leqslant n-1$, $X_{\_}i\in[0,1]$ and $X_{\_}n\in\{0,1\}$. We define

[TABLE]

where $\mathcal{F}_{\_}1(X_{\_}0,X_{\_}1):=\{\tau_{\_}1,\tau_{\_}2\}$ and $\tau_{\_}1$ is an stopping time defined on martingale $(X_{\_}0,X_{\_}1)$ such that $\tau_{\_}1(X_{\_}0,X_{\_}1)=1$ if $X_{\_}1=0$ and $\tau_{\_}1(X_{\_}0,X_{\_}1)=\infty$ if $X_{\_}1=1$; and $\tau_{\_}2(X_{\_}0,X_{\_}1)=1$ if $X_{\_}1=1$ and $\tau_{\_}2(X_{\_}0,X_{\_}1)=\infty$ if $X_{\_}1=0$. Note that $\mathcal{F}_{\_}1(X_{\_}0,X_{\_}1)$ represents the set of all specialized stopping times in martingale $(X_{\_}0,X_{\_}1)$. $A_{\_}1(X_{\_}0)$ consists of only one martingale and $\E|X_{\_}{\tau_{\_}1}-X_{\_}{\tau_{\_}1-1}|=\E|X_{\_}{\tau_{\_}2}-X_{\_}{\tau_{\_}2-1}|=X_{\_}0(1-X_{\_}0)$ which implies that $g_{\_}1(X_{\_}0)=X_{\_}0(1-X_{\_}0)$. We define

[TABLE]

where $\mathcal{F}_{\_}n(X_{\_}0,X_{\_}1,\dots,X_{\_}n)$ denotes the set of all specialized stopping times like $\tau$ defined on martingale $X=(X_{\_}0,X_{\_}1,\dots,X_{\_}n)$ which could be one of the following two cases:

Suppose $X_{\_}0=x$ and $X_{\_}1=x^{*}$. Then, let $x_{\_}0\in[0,1]$ be the solution of equation $x-x_{\_}0=g_{\_}{n-1}(x_{\_}0)$ and $x_{\_}1\in[0,1]$ be the solution of equation $x_{\_}1-x=g_{\_}{n-1}(x_{\_}1)$.

For all $x^{*}\leqslant x_{\_}0$, $\tau(x,x^{*},X_{\_}2,\dots,X_{\_}n)=1$ and for all $x^{*}>x_{\_}0$, $\tau(x,x^{*},X_{\_}2,\dots,X_{\_}n)=1+\tau^{{}^{\prime}}(x^{*},X_{\_}2,\dots,X_{\_}n)$ for some $\tau^{{}^{\prime}}\in\mathcal{F}_{\_}{n-1}(x^{*},X_{\_}2,\dots,X_{\_}n)$. This corresponds to the case that the specialized stopping time stops for all $x^{*}\leqslant x_{\_}0$ and recursively stops for all $x^{*}\geqslant x_{\_}0$ later. 2. 2.

For all $x^{*}\geqslant x_{\_}1$, $\tau(x,x^{*},X_{\_}2,\dots,X_{\_}n)=1$ and for all $x^{*}<x_{\_}1$, $\tau(x,x^{*},X_{\_}2,\dots,X_{\_}n)=1+\tau^{{}^{\prime}}(x^{*},X_{\_}2,\dots,X_{\_}n)$ for some $\tau^{{}^{\prime}}\in\mathcal{F}_{\_}{n-1}(x^{*},X_{\_}2,\dots,X_{\_}n)$. This corresponds to the case that the specialized stopping time stops for all $x^{*}\geqslant x_{\_}1$ and recursively stops for all $x^{*}\leqslant x_{\_}1$ later.

To prove Theorem 4.3, it suffices to prove the following claim.

Claim 6**.**

Let $C^{\prime}_{\_}1(x)=x(1-x)$ and the curve $C^{\prime}_{\_}n$ is achieved by applying transformation $T$ on the curve $C^{\prime}_{\_}{n-1}$ i.e. $C^{\prime}_{\_}n=T\left(C^{\prime}_{\_}{n-1}\right)$. Then, we have $g_{\_}n(x)=C^{\prime}_{\_}n(x)$ for any $x\in[0,1]$.

We first describe the intuitive idea behind the proof and then give a technical proof afterwards.

Proof Sketch. We use induction on $n$ to prove the claim. For $n=1$ and for each $x\in[0,1]$, we have $g_{\_}1(x)=x(1-x)=C^{\prime}_{\_}1(x)$. Now, we assume that for each $x\in[0,1]$, $g_{\_}n(x)=C^{\prime}_{\_}n(x)$. Since $C^{\prime}_{\_}{n+1}(X)=T\left(C^{\prime}_{\_}n(X)\right)$, it suffices to prove that $g_{\_}{n+1}(X)=T\left(g_{\_}n(X)\right)$ because it implies that $g_{\_}{n+1}(X)=T\left(g_{\_}n(X)\right)=T\left(C^{\prime}_{\_}n(X)\right)=C^{\prime}_{\_}{n+1}(X)$. Let us consider martingale $(X_{\_}0,X_{\_}1,\dots,X_{\_}n,X_{\_}{n+1})$ where $X_{\_}0=x$ and $X_{\_}1\in\{x^{(1)},\dots,x^{(t)}\}$. According to the induction hypothesis, the adversary is guaranteed to get $g_{\_}n(x^{(j)})=C^{\prime}_{\_}n(x^{(j)})$ as the score in any martingale of depth $n$ if she chooses an appropriate stopping time in $\mathcal{F}_{\_}n(x^{(j)},X_{\_}2,\dots,X_{\_}{n+1})$.

We define left marked edges as the set $\{j:x^{(j)}\leqslant x,\text{ and, }|x-x^{(j)}|\geqslant C^{{}^{\prime}}_{\_}{n}(x^{(j)})\}$ and right marked edges as the set $\{j:x^{(j)}\geqslant x,\text{ and, }|x-x^{(j)}|\geqslant C^{{}^{\prime}}_{\_}{n}(x^{(j)})\}$. Now, to prove that $g_{\_}{n+1}(X)=T\left(g_{\_}n(X)\right)$ it suffices to show that in any arbitrary martingale in $A_{\_}{n+1}(x)$, the maximum score that could be achieved by either stopping the martingale at only left marked edges at time $1$ or stopping the martingale at only right marked edges at time $1$, is always guaranteed to be greater than or equal to $T(g_{\_}n(x))=T(C^{\prime}_{\_}n(x))=C^{\prime}_{\_}{n+1}(x)$. In Fig. 13, we are considering a martingale $(x,X_{\_}1,\dots,X_{\_}n,X_{\_}{n+1})$ such that $X_{\_}1$ can take only two values either $x_{\_}{l}$ or $x_{\_}{r}$ with probabilities $p_{\_}l$ and $p_{\_}r$ respectively. Note that $x_{\_}{l}\leqslant x_{\_}S(x)$ and $x_{\_}L(x)\leqslant x_{\_}{r}$. Any specialized stopping time $\tau$ either stops at $x_{\_}l$ and continues at $x_{\_}r$ or stops at $x_{\_}r$ and continues at $x_{\_}l$. Here, the curve $C^{\prime}_{\_}{n}$ represents the points $(x,g_{\_}n(x))$ for $0\leqslant x\leqslant 1$. According to the induction hypothesis, in martingale $(x_{\_}l,X_{\_}2,\dots,X_{\_}n)$, the score $g_{\_}n(x_{\_}l)$ is guaranteed to be achieved (so the contribution of score when martingale doesn’t stop at this edge is $p_{\_}lg_{\_}n(x_{\_}l)$) but if martingale stops at time $1$ at edge $(x,x_{\_}l)$, then the contribution of score for this edge is $p_{\_}l|x-x_{\_}l|$. A similar thing can be said about $x_{\_}r$. We can observe that while the point $Q^{{}^{\prime\prime}}$ (which is the intersection of line $D_{\_}lU_{\_}r$ with line $X=x$ and its height corresponds to the score achieved when martingale stops at $x_{\_}r$ and continues at $x_{\_}l$) lies below the point $Q=(x,g_{\_}{n+1}(x))$ (which is the intersection of line $P_{\_}1P_{\_}2$ with line $X=x$ and its height corresponds to $T(g_{\_}n(x))$), the point $Q^{{}^{\prime}}$ (which is the intersection of line $U_{\_}lD_{\_}r$ with line $X=x$ and its height corresponds to the score achieved by stopping martingale at $x_{\_}l$ and allowing it to continue at $x_{\_}r$) is above the point $Q$. Observe that the maximum of the two scores achieved in these two strategies is always greater than or equal to $T(g_{\_}n(x))$. Moreover, if $x_{\_}S$ is chosen as $x_{\_}l$ and $x_{\_}L$ is chosen as $x_{\_}r$, then $Q=Q^{{}^{\prime}}=Q^{{}^{\prime\prime}}$ and the value $T(C^{\prime}_{\_}{n})(x)$ can be achieved for some martingale. This means that $g_{\_}{n+1}(x)=T(g_{\_}n(x))=T(C^{\prime}_{\_}n(x))=C^{\prime}_{\_}{n+1}(x)$ for any $x\in[0,1]$.

4.3 Influencing Discrete Control Processes

Lichtenstein et al. [27] considered the problem of an adversary influencing the outcome of a stochastic process through mild interventions. For example, an adversary attempts to bias the outcome of a distributed $n$-processor coin-tossing protocol, where, in the $i$-th round, the processor $i$ broadcasts her message. This model is also used to characterize randomness sources that are adversarially influenced, for example, [32, 26, 34, 30, 31, 33, 19, 17, 18, 11].

Consider the sample space $\Omega=\Omega_{\_}1\times\Omega_{\_}2\times\dotsi\times\Omega_{\_}n$ and a joint distribution $(E_{\_}1,\dotsc,E_{\_}n)$ over the sample space. We have a function $f\colon\Omega\to{\{0,1\}}$ such that $\EX{f(E_{\_}1,\dotsc,E_{\_}n)}=X_{\_}0$. This function represents the protocol that determines the final outcome from the public transcript. The filtration, at time-step $i$, reveals the value of the random variable $E_{\_}i$ to the adversary. We consider the corresponding Doob’s martingale $(X_{\_}0,X_{\_}1,\dotsc,X_{\_}n)$. Intuitively, $X_{\_}i$ represents the probability of $f(E_{\_}1,\dotsc,E_{\_}n)=1$ conditioned on the revealed values $(E_{\_}1=e_{\_}1,\dotsc,E_{\_}i=e_{\_}i)$. The adversary is allowed to intervene only once. She can choose to intervene at time-step $i$, reject the current sample $E_{\_}i=e_{\_}i$, and substitute it with a fresh sample from $E_{\_}i$. This intervention is identical to restarting the $i$-th processor if the adversary does not like her message. Note that this intervention changes the final outcome by

[TABLE]

We shall use a stopping time $\tau$ to represent the time-step where an adversary decides to intervene. However, for some $(E_{\_}1=e_{\_}1,\dotsc,E_{\_}n=e_{\_}n)$ the adversary may not choose to intervene. Consequently, we consider stopping times $\tau\colon\Omega\to\{1,\dotsc,n,\infty\}$, where the stopping time being $\infty$ corresponds to the event that the adversary did not choose to intervene. In the Doob martingale discussed above, as a direct consequence of Theorem 1.1, there exists a stopping time $\tau^{*}$ with susceptibility $\geqslant C_{\_}n(X_{\_}0)$. Note that susceptibility measures the expected (unsigned) magnitude of the deviation, if an adversary intervenes at $\tau^{*}$. Some of these contributions to susceptibility shall increase the probability of the final outcome being 1, and the remaining shall decrease the probability of the final outcome being 1. By an averaging argument, there exists a stopping time $\tau\colon\Omega\to\{1,\dotsc,n,\infty\}$ that biases the outcome of $f$ by at least $\geqslant\frac{1}{2}C_{\_}n(X_{\_}0)$, whence the following corollary.

Corollary 4.7** (Influencing Discrete Control Processes).**

Let $\Omega_{\_}1,\dotsc,\Omega_{\_}n$ be arbitrary sets, and $(E_{\_}1,\dotsc,E_{\_}n)$ be a joint distribution over the set $\Omega\coloneqq\Omega_{\_}1\times\dotsi\times\Omega_{\_}n$. Let $f\colon\Omega\to{\{0,1\}}$ be a function such that $\probX{f(E_{\_}1,\dotsc,E_{\_}n)=1}=X_{\_}0$. Then, there exists an adversarial strategy of intervening once to bias the probability of the outcome away from $X_{\_}0$ by $\geqslant\frac{1}{2}C_{\_}n(X_{\_}0)\geqslant\frac{1}{2}L_{\_}n(X_{\_}0)=\frac{1}{\sqrt{2n-1}}X_{\_}0(1-X_{\_}0)$.

The previous result of [14] applies only to $X_{\_}0=1/2$ and they ensure a deviation of $1/320\sqrt{n}$. For $X_{\_}0=1/2$, our result ensures a deviation of (roughly) $1/4\sqrt{2n}\approx 1/5.66\sqrt{n}$.

4.3.1 Influencing Multi-faceted Dice-rolls

Corollary 4.7 generalizes to the setting where $f\colon\Omega\to\{0,1,\dotsc,\omega-1\}$, i.e., the function $f$ outputs an arbitrary $\omega$-faceted dice roll. In fact, we quantify the deviation in the probability of any subset $S\subseteq\{0,1,\dotsc,\omega-1\}$ of outcomes caused by an adversary intervening once.

Corollary 4.8** (Influencing Multi-faceted Dice-Rolls).**

Let $\Omega_{\_}1,\dotsc,\Omega_{\_}n$ be arbitrary sets, and $(E_{\_}1,\dotsc,E_{\_}n)$ be a joint distribution over the set $\Omega\coloneqq\Omega_{\_}1\times\dotsi\times\Omega_{\_}n$. Let $f\colon\Omega\to\{0,1,\dotsc,\omega-1\}$ be a function with $\omega\geqslant 2$ outcomes, $S\subseteq\{0,1,\dotsc,\omega-1\}$ be any subset of outcomes, and $\probX{f(E_{\_}1,\dotsc,E_{\_}n)\in S}=X_{\_}0$. Then, there exists an adversarial strategy of intervening once to bias the probability of the outcome being in $S$ away from $X_{\_}0$ by $\geqslant\frac{1}{2}C_{\_}n(X_{\_}0)\geqslant\frac{1}{2}L_{\_}n(X_{\_}0)=\frac{1}{\sqrt{2n-1}}X_{\_}0(1-X_{\_}0)$.

Corollary 4.7 and Corollary 4.8 are equivalent to each other. Clearly Corollary 4.7 is a special case of Corollary 4.8. Corollary 4.8, in turn, follows from Corollary 4.7 by considering “$f(E_{\_}1,\dotsc,E_{\_}n)\in S$” as the interesting event for the martingale. We state these two results separately for conceptual clarity and ease of comparison with the prior work.

4.4 $L_{\_}2$ Gaps and their Tightness

Finally, to demonstrate the versatility of our geometric approach, we measure large $L_{\_}2$-norm gaps in martingales.

Theorem 4.9**.**

Let $(X_{\_}0,X_{\_}1,\dotsc,X_{\_}n)$ be a discrete-time martingale such that $X_{\_}n\in\{0,1\}$. Then, the following bound holds.

[TABLE]

Furthermore, for all $n\geqslant 1$ and $X_{\_}0\in[0,1]$, there exists a martingale $(X_{\_}0,\dotsc,X_{\_}n)$ such that for any stopping time $\tau$, it has $\EX{\left({X_{\_}\tau-X_{\_}{\tau-1}}\right)^{2}}=D_{\_}n(X_{\_}0)$.

Proof 4.10**.**

We shall proceed by induction on $n$.

Base Case $n=1$.* Note that in this case (see Fig. 5) the optimal stopping time is $\tau=1$.*

[TABLE]

General Inductive Step.* Let us fix $X_{\_}0=x$ and $n=d\geqslant 2$. We proceed analogous to the argument in Section 3. The adversary can either decide to stop at the child $j$ (see Fig. 6 for reference) or continue to the subtree rooted at it to find a better stopping time.*

Overall, the adversary gets the following contribution from the $j$-th child

[TABLE]

The adversary obtains a score that is at least the height of $Q$ in Fig. 17. Further, a martingale designer can choose $t=2$, and $Z^{{\left(1\right)}}=P_{\_}1$ and $Z^{{\left(2\right)}}=P_{\_}2$ to define the optimal martingale. Similar to Theorem 1.1, the scores corresponding to all possible stopping times in the optimal martingale are identical.

We can argue that the height of $Q$ is the geometric-mean of the heights of $P_{\_}1$ and $P_{\_}2$. This observation defines the geometric transformation $T^{\prime}$ in Fig. 16. For this transformation, we demonstrate that $D_{\_}n(X_{\_}0)=\frac{1}{n}X_{\_}0(1-X_{\_}0)$ is the solution to the recursion $D_{\_}n={T^{\prime}}^{n-1}(D_{\_}1)$ in Claim 7.

Claim 7**.**

Let $D_{\_}1$ be the curve defined as the zeros of the equation $Y=X(1-X)$ and for $n>1$, $D_{\_}n$ is obtained as applying the transformation $T^{\prime}$, defined in Fig. 16, to the curve $D_{\_}{n-1}$. We claim that for each $x\in[0,1]$, $D_{\_}n(x)=d_{\_}nx(1-x)$ where $d_{\_}n=\frac{1}{n}$.

Proof 4.11**.**

We use induction on $n$ to prove that for each $x\in[0,1]$, we have $D_{\_}n(x)=d_{\_}nx(1-x)$ where $d_{\_}n=\frac{1}{n}$. Base case $n=1$, is obvious. Now, assuming that $D_{\_}n(x)=d_{\_}nx(1-x)$ where $d_{\_}n=\frac{1}{n}$, we will prove that $D_{\_}{n+1}(x)=d_{\_}{n+1}x(1-x)$ where $d_{\_}{n+1}=\frac{1}{n+1}$. Let’s fix $x\in[0,1]$ and let $x_{\_}0$ and $x_{\_}1$ be respectively the smaller and larger root of the equation $d_{\_}nx^{*}(1-x^{*})=(x-x^{*})^{2}$. Then we have

[TABLE]

[TABLE]

Let $y_{\_}0=d_{\_}nx_{\_}0(1-x_{\_}0)$ and $y_{\_}1=d_{\_}nx_{\_}1(1-x_{\_}1)$, then we have the following relations:

[TABLE]

[TABLE]

Now, according to the definition of transformation $T^{\prime}$ in Fig. 16, we have $D_{\_}{n+1}(x)=\sqrt{y_{\_}0y_{\_}1}$ and:

[TABLE]

Note that, for any martingale $(X_{\_}0,\dotsc,X_{\_}n)$ with $X_{\_}n\in{\{0,1\}}$, we have $\EX{\sum_{\_}{i=1}^{n}(X_{\_}i-X_{\_}{i-1})^{2}}=\EX{X_{\_}n^{2}-X_{\_}0^{2}}=X_{\_}0(1-X_{\_}0)$. Therefore, by an averaging argument, there exists a round $i$ such that $\EX{(X_{\_}i-X_{\_}{i-1})^{2}}\geqslant\frac{1}{n}X_{\_}0(1-X_{\_}0)$. Theorem 4.9 proves the existence of a martingale that achieves the lower-bound even for non-constant stopping times. This result provides a technique to obtain the upper-bound to $C_{\_}n(X)$ in Lemma 1.2.

4.5 Alternate Proof for $U_{\_}{n+1}\succcurlyeq T(U_{\_}{n})$

Proof 4.12**.**

Recall that we defined $D_{\_}n$ as the zeros of the curve $Y=\frac{1}{n}X(1-X)$. Since $U_{\_}n$ is defined by the zeros of the curve $Y=\sqrt{\frac{1}{n}X(1-X)}$, by squaring the $Y$-values for $U_{\_}n$, we can obtain the curve $D_{\_}n$. This is illustrated in Fig. 18. Denote points on curve $U_{\_}n$ as $P_{\_}1:=(x_{\_}0,y_{\_}0)$, $P_{\_}2:=(x_{\_}1,y_{\_}1)$ and points on curve $D_{\_}n$ as $P^{\prime}_{\_}1:=(x_{\_}0,y^{\prime}_{\_}0)$, $P^{\prime}_{\_}2:=(x_{\_}1,y^{\prime}_{\_}1)$. In the left-hand figure, let $\alpha:=x-x_{\_}0$ and $\beta:=x_{\_}1-x$, then $y_{\_}0=\alpha$ and $y_{\_}1=\beta$ and $Q=H.M.(\alpha,\beta)$. After squaring, in the right-hand figure $Q=(H.M.(\alpha,\beta))^{2}$. Note by definition of the transformation $T^{\prime}$, we have that $Q^{\prime}=G.M.(\alpha^{2},\beta^{2})$. We show that $G.M.(\alpha^{2},\beta^{2})\geqslant(H.M.(\alpha,\beta))^{2}$ as follows

[TABLE]

which is true by the standard $G.M.\geqslant H.M.$ inequality. Now recall that the locus of the point $Q^{\prime}$ defines the curve $T^{\prime}(D_{\_}n)=D_{\_}{n+1}$ (From Claim 7) and we know that $D_{\_}{n+1}=U^{2}_{\_}{n+1}$. Also, after squaring the $Y$-axis, the locus of the point $Q$ defines the curve $T^{2}(U_{\_}n)$, therefore we have just shown that $U^{2}_{\_}{n+1}\succcurlyeq T^{2}(U_{\_}{n})$, which means that $U_{\_}{n+1}\succcurlyeq T(U_{\_}{n})$.

Note that, for any martingale $(X_{\_}0,\dotsc,X_{\_}n)$ with $X_{\_}n\in{\{0,1\}}$, we have $\EX{\sum_{\_}{i=1}^{n}(X_{\_}i-X_{\_}{i-1})^{2}}=\EX{X_{\_}n^{2}-X_{\_}0^{2}}=X_{\_}0(1-X_{\_}0)$. Therefore, by an averaging argument, there exists a round $i$ such that $\EX{(X_{\_}i-X_{\_}{i-1})^{2}}\geqslant\frac{1}{n}X_{\_}0(1-X_{\_}0)$. Theorem 4.9 proves the existence of a martingale that achieves the lower-bound even for non-constant stopping times.

This result provides an alternate technique to obtain the upper-bound to $C_{\_}n(X)$ in Lemma 1.2.

Appendix A More Technical Proof of Theorem 1.1

Claim 8**.**

For each $d\geqslant 1$, let $C_{\_}d$ denote a curve over $X\in[0,1]$ that includes all points $(x,\mathrm{opt}_{\_}d(x,1))$. Let $T$ be the transformation defined in Fig. 8. Then, $C_{\_}{d}=T^{d-1}(C_{\_}1)$ where $T^{0}$ denotes the identity transformation and $T^{k}$ denotes the transformation achieved by composing $T$ with itself $k$ times. Moreover, for every depth $d$, there exists a martingale of bias $x$ whose $\mathrm{max\textnormal{-}score}$ in $L_{\_}1$-norm is equal to $\mathrm{opt}_{\_}d(x,1)$ and for each $i=1,\dots,n$, $\lvert\Omega_{\_}i\rvert=2$.

Proof A.1**.**

*Let $C_{\_}1$ be the curve defined by the zeros of the equation $Y=2X(1-X)$ such that $Y\geqslant 0$. Let $C_{\_}{d+1}$ be the curve obtained by applying the transformation $T$ on $C_{\_}d$.

Let $X^{\prime}=\{X^{\prime}=\{X^{\prime}_{\_}i\}_{\_}{i=0}^{n},E^{\prime}=\{E^{\prime}_{\_}i\}_{\_}{i=1}^{n}\}$ be a martingale over the sample space $\Omega^{\prime}=\Omega^{\prime}_{\_}1\times\dots\times\Omega^{\prime}_{\_}n$ such that for each $i\in[n]$, $\Omega^{\prime}_{\_}i=\{0,1\},E^{\prime}_{\_}i(0)=l,E^{\prime}_{\_}i(1)=r,X^{\prime}_{\_}0=x$, for each $(e_{\_}1,e_{\_}2,\dots,e_{\_}{n-1})\in\{l,r\}^{n-1}$, $X^{\prime}_{\_}n(e_{\_}1,\dots,e_{\_}{n-1},l)=0$ and $X^{\prime}_{\_}n(e_{\_}1,\dots,e_{\_}{n-1},r)=1$, for each $i\in\{1,\dotsc,n-1\}$, $X^{\prime}_{\_}i(e_{\_}1,e_{\_}2,\dots,e_{\_}{i-1},l)$ is the $X$ coordinate of the interception of the line $Y=-X+X^{\prime}_{\_}{i-1}(e_{\_}1,\dots,e_{\_}{i-1})$ and the curve $C_{\_}{n-i}$, and $X^{\prime}_{\_}i(e_{\_}1,e_{\_}2,\dots,e_{\_}{i-1},r)$ is the $X$ coordinate of the interception of the line $Y=X-X^{\prime}_{\_}{i-1}(e_{\_}1,\dots,e_{\_}{i-1})$ and the curve $C_{\_}{n-i}$.

Moreover, for each $(e_{\_}1,e_{\_}2,\dots,e_{\_}{i-1})\in\{l,r\}^{i-1}$,*

[TABLE]

and

[TABLE]

*We claim that for each martingale $\{X=\{X_{\_}i\}_{\_}{i=1}^{n},E=\{E_{\_}i\}_{\_}{i=1}^{n}\}$ with respect to the sample space $\Omega=\Omega_{\_}1\times\dots\times\Omega_{\_}n$, we have $\mathrm{max\textnormal{-}score}_{\_}1(X,E)\geqslant\mathrm{max\textnormal{-}score}_{\_}1(X^{\prime},E^{\prime})$ and so $\mathrm{opt}_{\_}d(x,1)=\mathrm{max\textnormal{-}score}_{\_}1(X^{\prime},E^{\prime})$.

We prove our claim by induction on the depth of the martingale i.e. $n$.

For the base case $n=1$, suppose $\Omega_{\_}1=\{1,\dots,t\}$, $E_{\_}1(j)=e_{\_}1^{(j)}$. Without loss of generality, we assume that $X_{\_}1(e_{\_}1^{(1)})\leqslant X_{\_}1(e_{\_}1^{(2)})\dots\leqslant X_{\_}1(e_{\_}1^{(t)})$. Then there exist $p^{(1)},\dots,p^{(n)}$ such that $x=\sum_{\_}{j=1}^{t}p^{(j)}X_{\_}1(e_{\_}1^{(j)})$ and $\sum_{\_}{j=1}^{t}p^{(j)}=1$. In this case, since $X_{\_}1(e_{\_}1^{(j)})$ is [math] or $1$, there exists some $s$ such that $x=\sum_{\_}{j=s+1}^{t}p^{(j)}$ and*

[TABLE]

*But, the maximum score of a martingale $(X,E)$ with respect to $\Omega_{\_}1=\{0,1\}$ such that $\Pr[0]=x$ and $\Pr[1]=1-x$ is also $2x(1-x)$.

Suppose that the claim is true for depth $d$, and we want to prove it for the depth $d+1$.

Suppose that the martingale $\{X=\{X_{\_}i\}_{\_}{i=0}^{d+1},E=\{E_{\_}i\}^{d+1}_{\_}{i=1}\}$ over $\Omega=\Omega_{\_}1\times\Omega_{\_}2\times\dots\times\Omega_{\_}{d+1}$ is given such that $\Omega_{\_}1=\{1,\dots,t\}$ and for each $j\in\Omega_{\_}1$, $E_{\_}1(j)=e_{\_}1^{(j)}$.*

Note that for each $j\in\{1,2,\dotsc,t\}$, we define the martingale $\{V^{(j)}=\{V^{(j)}_{\_}i\}_{\_}{i=0}^{d},E^{(j)}=\{E^{(j)}_{\_}i\}_{\_}{i=2}^{d+1}\}$ over $\Omega_{\_}2\times\dots\times\Omega_{\_}{d+1}$ where $V^{(j)}_{\_}{i}(e_{\_}2,\dots,e_{\_}{d+1}):=X_{\_}{i+1}(e_{\_}1^{(j)},e_{\_}2,\dots,e_{\_}{d+1})$ is a martingale of depth $d$. Observe that for any $j$ and any value of $V_{\_}0=X_{\_}1(e_{\_}1^{(j)})$, there exists an stopping time $\tau^{(j)}_{\_}{max}(V^{(j)},E^{(j)}):\Omega_{\_}2\times\dots\times\Omega_{\_}{d+1}\rightarrow\{2,\dots,n\}$ that maximizes the score of the martingale $(V^{(j)},E^{(j)})$. Now, note that $\tau_{\_}{max}(X,E)(e_{\_}1^{(j)},e_{\_}2,\dots,e_{\_}{d+1})$ equals $1$ (which means that the martingale stops at time $1$) when

[TABLE]

or equals $\tau^{(j)}_{\_}{max}(V^{(j)},E^{(j)})(e_{\_}2,\dots,e_{\_}{d+1})$ when

[TABLE]

Let us define $B_{\_}j\coloneqq\mathrm{max}(\mathrm{max\textnormal{-}score}_{\_}1(V^{(j)},E^{(j)}),|X_{\_}0-X_{\_}1(e_{\_}1^{(j)})|)$. We represent each point $Z^{(j)}\eqqcolon(X_{\_}1(e_{\_}1^{(j)}),B_{\_}j)$ in a plane, see Fig. 9. In this plane, for each point $(x,y)$, the value $y$ represents the score of a stopping time in a martingale whose average is $x$ (the first value that the martingale takes). Since $X$ is a martingale, we have $X_{\_}0=\sum_{\_}{j=1}^{t}p^{(j)}X_{\_}1(e_{\_}1^{(j)})$. It also follows from the definition of $B_{\_}j$ that

[TABLE]

Therefore, we have

[TABLE]

Consequently, the point $(X_{\_}0,\mathrm{max\textnormal{-}score}_{\_}1(X,E))$ lies on the intersection of the line $X=X_{\_}0$ and the convex hull of the points $Z^{(1)},\dotsc,Z^{(t)}$ (Note that the argument is true even if we assume that $t$ is not finite).

It follows from the inductive hypothesis that for each $j$, there exists a martingale of depth $d$, $\{X^{\prime(j)}=\{X^{\prime(j)}_{\_}i\}_{\_}{i=1}^{d+1},E^{\prime(j)}=\{E^{\prime(j)}_{\_}i\}_{\_}{i=2}^{d+1}\}$ over $\Omega_{\_}2^{{}^{\prime}}\times\dots\times\Omega_{\_}{d+1}^{{}^{\prime}}$ such that $X^{\prime(j)}_{\_}1=X_{\_}1(e_{\_}1^{(j)})$ and for each $i\in\{2,\dots,d+1\}$, $|\Omega_{\_}i^{{}^{\prime}}|=2$ and $\mathrm{max\textnormal{-}score}_{\_}1(X^{\prime},E^{\prime})=\mathrm{opt}_{\_}d(X^{\prime(j)}_{\_}1,1)=\mathrm{opt}_{\_}d(X_{\_}1(e_{\_}1^{(j)}))$. Therefore, $\mathrm{max\textnormal{-}score}_{\_}1(V^{(j)},E^{(j)})\geqslant\mathrm{opt}_{\_}d(X_{\_}1(e_{\_}1^{(j)}),1)$. This implies that

[TABLE]

that means the points $Z^{(1)},\dotsc,Z^{(t)}$ lie above the curve defined by the zeros of the equation $Y=\mathrm{max}(\mathrm{opt}_{\_}{d}(X,1),|X_{\_}0-X|)=\mathrm{max}(C_{\_}d(X),|X-X_{\_}0|)$. Note that according to the inductive hypothesis, $C_{\_}d$ (the zeros of the equation $Y=\mathrm{opt}_{\_}{d}(X,1)$) is equal to the curve $T^{d-1}(C_{\_}1)$ which is concave downward as a consequence of Claim 3. Thus, the intersection of the line $X=X_{\_}0$ and the convex hull of the points $Z^{(1)},\dotsc,Z^{(t)}$ is above the point $Q=(x,C_{\_}{d+1}(x))$, see Fig. 9. Moreover, by choosing $t=2$ and $Z^{(1)}=P_{\_}1$ and $Z^{(2)}=P_{\_}2$, the score $T(C_{\_}d)(x)$ (point $Q$) can be achieved. But, note that according to the inductive hypothesis, the points $P_{\_}1$ and $P_{\_}2$ can be achieved by the martingale $\{X^{\prime(j)}=\{X^{\prime(j)}_{\_}i\}_{\_}{i=1}^{d+1},E^{\prime(j)}=\{E^{\prime(j)}_{\_}i\}_{\_}{i=2}^{d+1}\}$. This shows that the martingale of depth $d+1$ with optimal score is achieved when for each $i\in\{1,\dotsc,d+1\}$, $|\Omega_{\_}i|=2$. Also as mentioned earlier, the height of the point $Q$ is $T(C_{\_}d)(x)$ and according to induction hypothesis, $C_{\_}d(x)=T^{d-1}(C_{\_}1)(x)$, so $\mathrm{opt}_{\_}{d+1}(x,1)=T^{d}(C_{\_}1)(x)$.