# Quick Change Detection in Continuous-Time in Presence of a Covert Adversary

Amir Reza Ramtin, Philippe Nain, Don Towsley

► To cite this version:

Amir Reza Ramtin, Philippe Nain, Don Towsley. Quick Change Detection in Continuous-Time in Presence of a Covert Adversary. 2025. hal-05268481v2

HAL Id: hal-05268481

https://inria.hal.science/hal-05268481v2

Preprint submitted on 1 Nov 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
# Quickest Change Detection in Continuous-Time in Presence of a Covert Adversary

Amir Reza Ramtin, Philippe Nain, Don Towsley, Life Fellow, IEEE

**Abstract**—We investigate the problem of covert quickest change detection in a continuous-time setting, where a Brownian motion experiences a drift change at an unknown time. Unlike classical formulations, we consider a covert adversary who adjusts the post-change drift $\mu = \mu(\gamma)$ as a function of the false alarm constraint parameter $\gamma$, with the goal of remaining undetected for as long as possible. Leveraging the exact expressions for the average detection delay (ADD) and average time to false alarm (AT2FA) known for the continuous-time CuSum procedure, we rigorously analyze how the asymptotic behavior of ADD evolves as $\mu(\gamma) \to 0$ with increasing $\gamma$. Our results reveal that classical detection delay characterizations no longer hold in this regime. We derive sharp asymptotic expressions for the ADD under various convergence rates of $\mu(\gamma)$, identify precise conditions for maintaining covertness, and characterize the total damage inflicted by the adversary. We show that the adversary achieves maximal damage when the drift scales as $\mu(\gamma) = \Theta(1/\sqrt{\gamma})$, marking a fundamental trade-off between stealth and impact in continuous-time detection systems.

**Index Terms**—Continuous-time detection; Quickest change detection; CuSum procedure; Covert adversary; Brownian motion; Lambert function;

## I. INTRODUCTION

Quickest change detection (QCD) has long been a fundamental statistical technique for rapidly identifying changes in the underlying statistical properties of observed processes, with numerous critical applications ranging from quality control and finance to security and environmental monitoring [8], [9], [11]. Traditionally formulated in discrete-time settings, QCD methods have also been extensively developed and analyzed within continuous-time frameworks, where processes are monitored continuously rather than at discrete intervals. Continuous-time detection is particularly advantageous in settings requiring immediate responses to subtle or rapid shifts, as it allows for instantaneous detection of changes, thereby reducing reaction times and potential damages [2], [8], [9].

A classical and widely used method in continuous-time QCD is the continuous-time Cumulative Sum (CuSum) procedure, initially studied by Lorden [6] and subsequently generalized by Moustakides [7]. The continuous-time CuSum is known for its optimality under Lorden's minimax criterion, which aims to minimize the worst-case expected detection delay while controlling the average time between false alarms. Under this criterion, the CuSum procedure continuously accumulates evidence (in

the form of log-likelihood ratios) and signals a change once this cumulative evidence crosses a predetermined threshold [7], [8]. Precise characterizations of performance metrics, such as average time to false alarm (AT2FA) and average detection delay (ADD), are available in closed form for standard continuous-time models [7].

An important application of QCD is detecting the presence of an adversary [13]. However, classical analyses typically assume that the adversary is unaware of the detection mechanism. In adversarial environments, these assumptions may no longer hold. Specifically, an adversary, aware of the detection mechanism, may strategically adapt their behavior in response to detection thresholds. In this scenario, the adversary's statistical signature post-change increasingly resembles the pre-change condition as the false-alarm constraint (quantified by a parameter $\gamma$) becomes increasingly stringent. Such adaptive adversarial behavior challenges traditional assumptions and necessitates a deeper theoretical analysis of covert adversaries operating in a continuous-time setting.

The notion of covertness, first introduced by Bash et al. in the context of covert communication [1], captures the ability of a transmitter to remain undetectable by an observing warden during communication. Most existing work assumes that the detector knows the exact start time of any potential transmission. In contrast, we relax this assumption and extend the notion of covertness to a sequential detection framework, where adversaries deliberately behave in a way that keeps their activity concealed over extended periods. From the perspective of sequential detection, this gives rise to a fundamentally different adversarial strategy. Unlike traditional adversaries whose actions lead to detectable statistical deviations—enabling timely detection—covert adversaries aim to remain hidden by ensuring that ADD scales with the same order as AT2FA, thereby rendering the detector ineffective [5].

While prior work has studied covertness in discrete-time sequential detection [3], [5], [12], the continuous-time counterpart of this problem remains relatively unexplored. The works in [3], [5] have been largely confined to covert wireless communication scenarios, with assumptions tailored to that domain—such as specific channel models or power constraints—and have primarily focused on communication-centric performance metrics. In contrast, [12] considers an adversarial setting against the CuSum procedure under non-stationarity and without assuming that the AT2FA constraint is known to the adversary.

In this paper, we rigorously investigate covert adversaries in a continuous-time CuSum framework, where the post-change drift parameter is allowed to depend explicitly on the false-alarm constraint parameter $\gamma$. Specifically, we examine scenarios in which the drift parameter of the underlying continuous-

This research is supported by the DEVCOM Army Research Laboratory under Cooperative Agreement W911NF-17-2-0196 (IoBT CRA) and the National Science Foundation under Grant ECCS-2148159.

The authors are grateful to Professor Venugopal V. Veeravalli for helpful comments and suggestions.

A. R. Ramtin and D. Towsley are with the University of Massachusetts at Amherst, MA, USA (email: aramtin@cs.umass.edu, towsley@cs.umass.edu).

P. Nain is with Inria, France (email: philippe.nain@inria.fr).
time stochastic process approaches its pre-change value as $\gamma \to \infty$. Our analysis leverages classical exact results for continuous-time CuSum [7], extending their applicability to the asymptotic regime characterized by diminishing statistical differences between pre- and post-change processes.

Our continuous-time framework captures scenarios involving continuous monitoring and adopts Brownian motion, which is the standard model in continuous-time QCD. It introduces distinct analytical challenges due to continuous sample paths and the drift-threshold scaling with $\gamma$. We focus on the case of a known, fixed drift that depends on $\gamma$, which enables explicit characterization of the covertness-detection trade-off under stationary conditions, while the time-varying drift case—studied in [12] for the discrete-time setting—assumes an unknown false-alarm constraint, so its formulation differs more fundamentally than merely in the time domain.

We derive expressions for ADD under various regimes, determined by the rate at which the post-change drift vanishes with increasing $\gamma$. Our results show that the classical formulas for the ADD of CuSum, which assume a fixed drift, no longer hold in this asymptotic regime and must be carefully revised to reflect the vanishing signal structure introduced by a covert adversary.

We characterize precise conditions under which an adversary can maintain covertness and derive the corresponding scaling laws. Within the Brownian motion framework, adversarial behavior manifests through changes in the drift parameter. We analyze how the scaling of this drift—relative to the run-length constraint—affects covertness. We further quantify the adversarial damage, defined as the product of the drift magnitude and the average detection delay, and determine the regimes in which this damage is maximized while preserving covertness.

The remainder of the paper is structured as follows. In the next section, we briefly review the continuous-time CuSum procedure and Lorden's minimax detection framework. Section III develops our primary theoretical results. We then provide numerical evaluations that substantiate our theoretical results. Finally, we conclude with a summary.

## II. REVIEW OF QUICKEST CHANGE DETECTION IN CONTINUOUS-TIME

The material presented in this section can be found in [8, Section 6.4]. See also [2], [6], [7], [9]. In the continuous-time setting, the stochastic process {$Z_s, s \ge 0$} is continuously observed with the following dynamics

$$dZ_s = \begin{cases} dW_s, & s \le t, \\ \mu ds + dW_s, & s > t, \end{cases} \quad (1)$$

where {$W_s, s \ge 0$} is a standard Brownian motion. The drift parameter $\mu$ is known and (without loss of generality) positive. Denote by $\mathcal{F}_s = \sigma(Z_u, 0 \le u \le s)$ the smallest $\sigma$-field with respect to which process {$Z_u, 0 \le u \le s$} is measurable. In (1), $t$ is the (unknown) time when the change occurs. In words, before the change point the process {$Z_s, s \ge 0$} is a Brownian motion and after the change point it is a particular instance of an Ito process. No prior distribution on the change point $t$ is assumed (non-Bayesian setting).

The goal of quickest change detection is to minimize the delay between when a change occurs and when it is detected, while maintaining a low false alarm rate. More specifically, a

change detection algorithm is a stopping time $T$ with respect to the filtration {$\mathcal{F}_s, s \ge 0$}, that is {$T \le s \in \mathcal{F}_s$ for all $s \in [0, \infty)$. If $T \ge t$ a delayed detection is made otherwise a false alarm has occurred.

We denote by $\mathcal{T}$ the set of all stopping times with respect to {$\mathcal{F}_s, s \ge 0$}. Throughout $\mathbb{E}_t$ ($t \ge 0$) is the expectation operator associated with the model in (1); in particular, the operator $\mathbb{E}_0$ is associated with the situation when a change occurs at time $t=0$ whereas the operator $\mathbb{E}_\infty$ is associated with the situation where no change occurs.

In this work we consider the following optimization problem, due to Lorden [6], to find the best stopping time $T$ in $\mathcal{T}$:

$$\inf_{T \in \mathcal{T}} J(T) \quad \text{subject to} \quad \mathbb{E}_{\infty}[T] \ge \gamma, \quad (2)$$

with $\gamma > 0$, where

$$J(T) = \sup_{t \ge 0} \sup_{\mathcal{T}} \mathbb{E}_t[\max\{0, T-t\} | \mathcal{F}_t] \quad (3)$$

characterizes the worst-case expected delay. In (3) $\sup$ stands for essential supremum. The constraint in (2) expresses the fact that the false alarm rate should not exceed $1/\gamma$. Denote by $n(\gamma) = \inf_{T \in \mathcal{T}} \mathbb{E}_{\infty}[T] \ge \gamma$ $J(T)$, the optimal worst-case average detection delay.

It is known [8, Section 6.4.1] that the stopping time $T_h := \inf\{s \ge 0 : Y_s \ge h\}$ with $Y_s := U_s - M_s$ where $U_s := \mu Z_s - \frac{1}{2}\mu^2 s$ and $M_s := \inf_{0 \le r \le s} U_r$, with $h$ selected so that $\mathbb{E}_\infty[T_h] = \gamma$, solves (2). For any $T \in \mathcal{T}$, the worst-case detection delay occurs when $t=0$, namely, $J(T) = \mathbb{E}_0[T]$, which in turn implies from the optimality of $T_h$ that

$$n(\gamma) = \mathbb{E}_0[T_h]. \quad (4)$$

In addition [8, Prop. 6.8, p. 146],

$$\mathbb{E}_{\infty}[T_h] = \frac{2}{\mu^2}(e^h - h - 1), \quad (5)$$

$$\mathbb{E}_0[T_h] = \frac{2}{\mu^2}(e^{-h} + h - 1). \quad (6)$$

In [7] Moustakides generalized the model in (1) to the case when $\mu$ depends on $s$ and proposed a generalized version of Lorden's minimax criterion to find the optimal detection delay.

In the following, we will investigate the model in (1) when $\mu$ depends on $\gamma$ and $\lim_{\gamma \to \infty} \mu(\gamma) = 0$.

## III. CONDITIONS FOR COVERTNESS

In this section, we conduct an asymptotic analysis of the model in (1) as $\gamma \to \infty$, for the case where the drift $\mu$ depends on $\gamma$, denoted by $\mu(\gamma)$. We assume that $\mu(\gamma) > 0$ for all $\gamma > 0$ and $\lim_{\gamma \to \infty} \mu(\gamma) = 0$.

The covertness condition is defined by $n(\gamma)$ being of the same order of magnitude as the largest admissible lower bound on the expected time between false alarms, given by $\gamma$, i.e., $n(\gamma) = \Theta(\gamma)$. This ensures that detection does not become asymptotically faster than false alarming, keeping the detector ineffective. This scaling contrasts with the classical non-covert regime, where $n(\gamma) = O(\log \gamma)$. With this in mind, we address the following questions: (1) is it possible to have $n(\gamma) = \Theta(\gamma)$ and, if yes, (2) under what conditions?

Our analysis will use the Lambert function, defined as the solution of $W(z)e^{W(z)} = z$ [4]. When $z$ is real, $W(z)e^{W(z)} = z$ has a solution if and only if $z \ge -e^{-1}$. When $z \ge 0$, this
solution is unique, given by the main branch $W_0$ of $W$, and when $-e^{-1} \le z < 0$ there are two solutions given by the branches $W_0$ and $W_{-1}$ of $W$. In particular,

$$W_0(z) > -1 \quad \text{and} \quad W_{-1}(z) < -1 \quad \text{for} \quad -e^{-1} < z < 0, \quad (7)$$

and $W_0(-e^{-1}) = W_{-1}(-e^{-1}) = -1$. Last [4, p. 350]

$$W_{-1}(z) \sim \log(-z) - \log(-\log(-z)) \quad \text{as} \quad z \to 0 \text{ with } z < 0. \quad (8)$$

**Theorem 3.1 (Asymptotic behavior of $n(\gamma)$):** As $\gamma \to \infty$,

$$n(\gamma) \sim \begin{cases} \frac{2}{\mu(\gamma)^2} \log(\gamma\mu(\gamma)^2), & \text{if } \lim_{\gamma \to \infty} \gamma\mu(\gamma)^2 = \infty, \\ \frac{2}{\theta} G\left(\frac{1}{2}\theta\right) \gamma, & \text{if } \lim_{\gamma \to \infty} \gamma\mu(\gamma)^2 := \theta, \\ \gamma, & \text{if } \lim_{\gamma \to \infty} \gamma\mu(\gamma)^2 = 0, \end{cases} \quad (9)$$

with $\theta \in (0, \infty)$, where

$$G(x) = e^{1+x+W_{-1}(-e^{-1-x})} - W_{-1}(-e^{-1-x}) - x - 2, \quad x \ge 0 \quad (10)$$

The proof of Theorem 3.1 is based on Lemma 3.1 stated below, whose proof is given in the appendix.

**Lemma 3.1 (Optimal threshold):**

For every $\gamma > 0$, the equation $\mathbb{E}_{\infty}[T_h] = \gamma$ has a unique solution in $[0, \infty)$, given by

$$h(\gamma) = -1 - \frac{1}{2}\gamma\mu(\gamma)^2 - W_{-1}\left(-e^{-1-\frac{1}{2}\gamma\mu(\gamma)^2}\right). \quad (11)$$

**Proof of Theorem 3.1:** From (4), (6), (10), and (11), we have

$$n(\gamma) = \frac{2}{\mu(\gamma)^2} G\left(\frac{1}{2}\gamma\mu(\gamma)^2\right). \quad (12)$$

Assume first that $\lim_{\gamma \to \infty} \gamma\mu(\gamma)^2 = \infty$. From (8) we get $W_{-1}\left(-e^{-1-\frac{1}{2}\gamma\mu(\gamma)^2}\right) \sim \log(\gamma\mu(\gamma)^2)$ as $\gamma \to \infty$, yielding $G\left(\frac{1}{2}\gamma\mu(\gamma)^2\right) \sim \log(\gamma\mu(\gamma)^2)$ as $\gamma \to \infty$, and subsequently,

$$n(\gamma) \sim \frac{2}{\mu(\gamma)^2} \log(\gamma\mu(\gamma)^2), \quad \gamma \to \infty.$$

If $\lim_{\gamma \to \infty} \gamma\mu(\gamma)^2 = \theta \in (0, \infty)$, clearly from (12)

$$n(\gamma) \sim \frac{2}{\theta} G\left(\frac{1}{2}\theta\right) \gamma, \quad \gamma \to \infty.$$

Assume now that $\lim_{x \downarrow 0} \gamma\mu(\gamma)^2 = 0$. Let us prove that $\lim_{x \downarrow 0} \frac{G(x)}{x} = 1$, which will prove from (12) that $n(\gamma) \sim \gamma$ as $\gamma \to \infty$.

Since $G(0) = 0$, $\lim_{x \to 0} \frac{G(x)}{x}$ is the right hand derivative of $G(x)$ at $x = 0$. $W_{-1}(x)$ has the following derivative,

$$W'_{-1}(x) = \frac{W_{-1}(x)}{x(1+W_{-1}(x))}, \quad -e^{-1} < x < 0 \quad (13)$$

that follows from differentiating $W_{-1}(x)e^{W_{-1}(x)} = x$. Consequently, for $x > 0$, the derivative of $G(x)$ is given by

$$\begin{align*} G'(x) &= e^{-1-x} W'_{-1}(-e^{-1-x}) \left( e^{1+x+W_{-1}(-e^{-1-x})} - 1 \right) \\ &= \left( -\frac{W_{-1}(-e^{-1-x})}{1+W_{-1}(-e^{-1-x})} + 1 \right) e^{1+x+W_{-1}(-e^{-1-x})} \\ &\quad + \frac{W_{-1}(-e^{-1-x})}{1+W_{-1}(-e^{-1-x})} - 1, \\ &= \frac{e^{1+x+W_{-1}(-e^{-1-x})} - 1}{1+W_{-1}(-e^{-1-x})} = -\frac{1}{W_{-1}(-e^{-1-x})}. \end{align*}$$

Letting $x \to 0$ with $x > 0$, we see that $1 = \lim_{x \to 0} G'(x) = \lim_{x \to 0} \frac{G(x)}{x}$, which concludes the proof of Theorem 3.1.

According to our definition of covertness, given by $n(\gamma) = \Theta(\gamma)$, Theorem 3.1 shows that an adversary is covert if $\mu(\gamma)\sqrt{\gamma}$ converges to a finite limit as $\gamma \to \infty$.

**Remark 3.1 (Asymptotic behavior of optimal threshold $h$):**

$$\lim_{\gamma \to \infty} h(\gamma) = \begin{cases} \infty, & \text{if } \lim_{\gamma \to \infty} \gamma\mu(\gamma)^2 = \infty, \\ -1 - \frac{1}{2}\theta - W_{-1}(-e^{-1-\frac{1}{2}\theta}), & \text{if } \lim_{\gamma \to \infty} \gamma\mu(\gamma)^2 = \theta, \\ 1, & \text{if } \lim_{\gamma \to \infty} \gamma\mu(\gamma)^2 = 0. \end{cases}$$

The result when $\lim_{\gamma \to \infty} \gamma\mu(\gamma)^2 = \infty$ follows by applying the expansion in (8) to $h(\gamma)$ in (11), while the result when $\lim_{\gamma \to \infty} \gamma\mu(\gamma)^2 = 0$ follows from (11) and $W_{-1}(-e^{-1}) = -1$.

**Remark 3.2:** If $\lim_{\gamma \to \infty} \mu(\gamma) = \mu_0 \neq 0$ then $n(\gamma) \sim \frac{2}{\mu(\gamma)^2} \log \gamma$ by Theorem 3.1. In particular, this shows that $n(\gamma) = \Theta(\log(\gamma))$ in continuous-time.

**Remark 3.3:** It is worth noting that $\lim_{\theta \to 0} \frac{2}{\theta} G(\frac{1}{2}\theta)\gamma = \gamma$, since we have shown in the proof of Theorem 3.1 that $\lim_{x \to 0} \frac{G(x)}{x} = 1$, and that $\frac{2}{\theta} G(\frac{1}{2}\theta) \sim \frac{2}{\mu(\gamma)^2} \log(\gamma\mu(\gamma)^2)$ as $\theta \to \infty$ by using (8) and the definition of $G$, thereby showing that the r.h.s. of (9) is a continuous function of $\lim_{\gamma \to \infty} \gamma\mu(\gamma)^2$ whenever this limit exists.

## IV. NUMERICAL RESULTS

Let $\mu(\gamma) = \gamma^{-\delta}$ with $\delta \ge 0$. We find from Theorem 3.1

$$n(\gamma) \sim \begin{cases} 2(1 - 2\delta) \log(\gamma)\gamma^{2\delta}, & \text{if } 0 \le \delta < \frac{1}{2}, \\ 2G(\frac{1}{2})\gamma, & \text{if } \delta = \frac{1}{2}, \\ \gamma, & \text{if } \delta > \frac{1}{2}, \end{cases} \quad (14)$$

as $\gamma \to \infty$, with $2G(\frac{1}{2}) = 0.563...$. The mapping $\gamma \to n(\gamma)$ (defined in (4) and (6), with $h$ given in (11)) is displayed in Figure 1 for $\delta \in \{0.75, 2, 5\}$. We also plot the identity mapping $\gamma \to \gamma$ so that one can observe the speed at which $n(\gamma)$ converges to $\gamma$, as predicted by Theorem 3.1. Not surprisingly, the closer $\delta$ is to $\frac{1}{2}$ the longer it takes to converge to the asymptotic regime. To better quantity this visual observation, we have reported in Table I the metric $M(\gamma) = 100 \times |\frac{n(\gamma)-\gamma}{n(\gamma)}|$ for $\delta \in \{0.75, 2, 5\}$ and for increasing values of $\gamma$. We observe that $n(\gamma)$ converges quickly to $\gamma$ for $\delta = 2$ while for $\delta = 5$, $n(\gamma)$ matches $\gamma$ when $\gamma \ge 5$. Convergence is slow when $\delta = 0.75$.

<figure><img src="image_2.png" /><figcaption>Fig. 1: The mapping $\gamma \to n(\gamma)$ when $\mu(\gamma) = \gamma^{-\delta}$ for $\delta \in \{0.75, 2\}$ (dash-dotted lines), $\delta = 5$ (dashed line), and the identity mapping $\gamma \to \gamma$ (solid line).</figcaption></figure>

Figure 2(a) shows how the optimal threshold $h(\gamma)$, given in (11), varies with $\delta$ over the interval $[0, 1]$ for $\gamma \in \{10^3, 10^5, 10^8, 10^{12}\}$. Similarly, Figure 2(b) illustrates the behavior of $n(\gamma)/\gamma$ as a function of $\delta$, for the same values of $\gamma$. We observe that a clear phase transition emerges as $\delta$ crosses 0.5,
<table><caption>TABLE I: The metric $M(\gamma)$ for $\delta \in \{0.75, 2, 5\}$ and $\gamma \in \{2, 5, 10, 10^2, \dots, 10^5\}$.</caption><tr><td>γ =</td><td>2</td><td>5</td><td>10</td><td>10<sup>2</sup></td><td>10<sup>3</sup></td><td>10<sup>4</sup></td><td>10<sup>5</sup></td></tr><tr><td>δ = 0.75</td><td>63.7</td><td>49.4</td><td>41.9</td><td>22.2</td><td>12.2</td><td>6.78</td><td>3.79</td></tr><tr><td>δ = 2</td><td>24.9</td><td>6.05</td><td>2.12</td><td>0.07</td><td>0</td><td>0</td><td>0</td></tr><tr><td>δ = 5</td><td>2.97</td><td>0.04</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td></tr></table>

which corresponds to $\mu(\gamma) = 1/\sqrt{\gamma}$. This observation aligns with our theoretical findings.

<figure><img src="image_3.png" /><figcaption>Fig. 2: Phase transition analysis. As $\delta$ increases, (a) $h(\gamma)$ approaches zero and (b) the ratio $n(\gamma)/\gamma$ increases from 0 to 1, with the transition occurring at $\delta = 0.5$.</figcaption></figure>

Now, we define the adversarial damage as the expected drift accumulated by the adversary prior to detection, denoted by $D(\gamma) = \mu(\gamma)n(\gamma)$, which quantifies the expected displacement of the system's state from where it would have been had the adversary not intervened, providing a natural measure of the achievable cumulative deviation. Following (14), as $\gamma \to \infty$,

$$D(\gamma) \sim \begin{cases} 2(1 - 2\delta) \log(\gamma)\gamma^{\delta}, & \text{if } 0 \le \delta < \frac{1}{2}, \\ 2G(\frac{1}{2})\gamma^{1/2}, & \text{if } \delta = \frac{1}{2}, \\ \gamma^{1-\delta}, & \text{if } \delta > \frac{1}{2}. \end{cases}$$

From these expressions, $D(\gamma)$ is asymptotically maximized by $\delta = \frac{1}{2}$, resulting in a total damage of order $\Theta(\sqrt{\gamma})$. Figure 3 displays the mapping $\delta \to \log D(\gamma)$ for $\gamma \in \{10^6, 10^8, 10^{10}, 10^{12}\}$. The maximum damage occurs for $\delta \le \frac{1}{2}$; moreover, as $\gamma$ increases, the maximizer converges to $\delta = \frac{1}{2}$.

<figure><img src="image_4.png" /><figcaption>Fig. 3: Total damage analysis.</figcaption></figure>

## V. CONCLUSION

We introduced and analyzed a sequential detection problem when a covert adversary is present in a continuous-time setting where the post-change drift diminishes with the false alarm constraint parameter $\gamma$. By leveraging classical performance characterizations of the CuSum procedure, we rigorously established asymptotic expressions for the detection delay under vanishing drift. Our results identify the critical scaling regimes that govern covertness and show that adversarial damage is

maximized when the drift decays as $\Theta(1/\sqrt{\gamma})$. Numerical simulations illustrate and support the theoretical findings.

## APPENDIX

*Proof of Lemma 3.1:* Let $\gamma > 0$. Notice that $\xi(\gamma) := \frac{1}{2}\mu(\gamma)^2 \neq 0$ since, by assumption, $\mu(\gamma) > 0$ as $\gamma > 0$. This shows that $h = 0$ is not a solution of $e^h - h - 1 = \gamma\xi(\gamma)$. Let us find a strictly positive solution $h$ to the equation

$$e^h - h - 1 = \gamma\xi(\gamma). \quad (15)$$

Eq. (15) rewrites

$$-(h+r)e^{-(h+r)} = -e^{-r}, \quad (16)$$

with $r := 1+\gamma\xi(\gamma) > 1$. Since $-e^{-1} \le -e^{-r} < 0$, (16) has two solutions, $h_1 = -r - W_0(-e^{-r})$ and $h_2 = -r - W_{-1}(-e^{-r})$. From (7), $h_1 < -\gamma\xi(\gamma) < 0$, thereby implying that the solution we are looking for can only be $h = h_2$, namely,

$$h = -1 - \gamma\xi(\gamma) - W_{-1}(-e^{-1-\xi(\gamma)\gamma}). \quad (17)$$

It remains to check that $h$ in (17) is strictly positive for $\gamma > 0$.

This will be true if one shows that the mapping $\varphi: x \to x - W_{-1}(-e^x)$ is strictly positive for $x < -1$. We have $\varphi(-1) = 0$ since $W_{-1}(-e^{-1}) = -1$. On the other hand, by (13),

$$\varphi'(x) = 1 + e^x W'_{-1}(-e^x) = \frac{1}{1+W'_{-1}(-e^x)}, \quad \forall x < -1.$$

But $W_{-1}(-e^x) < -1$ for $x < -1$ from (7), which shows that $\varphi'(x) < 0$ for $x < -1$. Therefore, $x \to \varphi(x)$ is decreasing in $(-\infty, -1)$ and since $\varphi(-1) = 0$, this proves that $\varphi(x) > 0$ for $x < -1$. Therefore, $h$ in (17) is the unique strictly positive solution of the equation $\frac{1}{2}\mu(\gamma)^2(e^h - h - 1) = \gamma$ when $\gamma > 0$.

## REFERENCES

[1] B. A. Bash, D. Goeckel, and D. Towsley, "Limits of reliable communication with low probability of detection on AWGN channels," *IEEE Journal on Selected Areas in Communications*, Vol. 31, No. 9, pp. 1921-1930, 2013.

[2] M. Beibel, "A note on Rytov's Bayes approach to the minimax property of the CUSUM procedure," *Annals of Statistics*, Vol. 24, No. 2, pp. 1804-1812, 1996.

[3] M.-C. Chang and M. R. Bloch, "Covert sequential hypothesis testing," in *Proc. 2021 IEEE Information Theory Workshop (ITW)*, Kanazawa, Japan, pp. 1-6, 2021.

[4] R. M. Corless, G. H. Gonnet, D. E. G. Hare, D. J. Jeffrey, and D. E. Knuth, "On the Lambert W function," *Advances in Computational Mathematics*, Vol. 5, pp. 329-359, 1996.

[5] K.-W. Huang, H.-M. Wang, and H. V. Poor, "On covert communication against sequential change-point detection," *IEEE Transactions on Information Theory*, Vol. 67, No. 11, pp. 7285-7303, 2021.

[6] G. Lorden, "Procedure for reacting to a change in distribution," *The Annals of Mathematical Statistics*, Vol. 42, No. 6, pp. 1897-1908, 1971.

[7] G. V. Moustakides, "Optimal stopping times for detecting changes in distributions," *Annals of Statistics*, Vol. 14, No. 4, pp. 1379-1387, 1986.

[8] H. V. Poor and O. Hadjiliadis, *Quickest Detection*. Cambridge University Press, 2009.

[9] A. N. Shiryaev, "Minimax optimality of the method of cumulative sums (CUSUM) in the continuous case," *Russian Mathematical Surveys*, Vol. 51, No. 4, pp. 750-751, 1996.

[10] D. Siegmund, *Sequential Analysis, Tests and Confidence Intervals*. Springer Verlag, 1985.

[11] A. Tartakovsky, I. Nikiforov, and M. Basseville, *Sequential Analysis, Hypothesis Testing and Change Point Detection*. Chapman & Hall/CRC Press, Monographs on Statistics & Applied Probability, Vol. 136, 2014.

[12] A. Ramtin, Z. Hare, L. Kaplan, P. Nain, V. Veeravalli, and D. Towsley, "Quickest change detection in the presence of covert adversaries," in *Proc. MILCOM 2024 - IEEE Military Communications Conference (MILCOM)*, pp. 1-6, 2024.

[13] L. Xie, S. Zou, Y. Xie, and V. V. Veeravalli, "Sequential (quickest) change detection: Classical results and new directions," *IEEE Journal on Selected Areas in Information Theory*, vol. 2, no. 2, pp. 494-514, 2021.