# Risk Measures in Reliability Engineering: Comparison, Duality and Decision-Making

Marie Temple-Boyer, Emma Cussenot, Guillaume Perrin, Vincent Chabridon, Julien Pelamatti, Emmanuel Remy, Bertrand Iooss

► To cite this version:

Marie Temple-Boyer, Emma Cussenot, Guillaume Perrin, Vincent Chabridon, Julien Pelamatti, et al. Risk Measures in Reliability Engineering: Comparison, Duality and Decision-Making. 2025. [hal-05295409]

HAL Id: hal-05295409

https://hal.science/hal-05295409v1

Preprint submitted on 3 Oct 2025

**HAL** is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

Public Domain
Risk Measures in Reliability Engineering: Comparison,
Duality and Decision-Making

Marie Temple-Boyer<fnref n="1" />,<fnref n="2" />, Emma Cussenot<fnref n="3" />, Guillaume Perrin<fnref n="1" />, Vincent Chabridon<fnref n="2" />,
Julien Pelamatti<fnref n="2" />, Emmanuel Remy<fnref n="2" /> and Bertrand Iooss<fnref n="2" />

September, 2025

Abstract

In order to guarantee the reliability of industrial systems, statistical studies can be carried
out on a variable of interest, *Y*, or, more precisely, on a risk measure computed based on this
variable. This article studies and compares different risk measures, on the one hand, according to
their theoretical properties, and, on the other hand, according to their numerical estimation. In
particular, a distinction is proposed between risk measures homogeneous to the variable of interest
*Y* (margin, quantile, and superquantile) and risk measures homogeneous to a probability (failure
and buffered failure probability). More specifically, a duality between these two categories is devel-
oped, showing the equivalence of using a *Y*-homogeneous risk measure with a dual, homogeneous,
[0, 1]-homogeneous risk measure. Finally, a non-asymptotic statistical framework is proposed for
decision-making using these risk measures. The latter can be used in practice in the case where the
considered risk measures are the probability of failure and the quantile, and is equivalent, under
one assumption, to a quantile estimation using the Wilks' method.

Résumé

Afin de garantir la fiabilité de systèmes industriels, des études statistiques peuvent être menées vis-à-vis d'une variable d'intérêt Y, ou, plus exactement, sur une mesure de risque calculée à partir de cette variable. Cet article étudie et compare différentes mesures de risques, d'une part selon leurs propriétés théoriques, d'autre part selon leur estimation numérique. En particulier, une distinction est proposée entre des mesures de risque homogènes à la variable d'intérêt Y (marge, quantile et superquantile) et des mesures de risque homogènes à une probabilité (probabilité de défaillance et probabilité de défaillance amortie). Plus précisément, un principe de dualité entre ces deux catégories est développé, et permet de montrer l'équivalence d'utilisation d'une mesure de risque homogène à Y avec une mesure de risque duale homogène à une probabilité. Enfin, un cadre statistique non asymptotique est proposé pour aider à la prise de décision avec des mesures de risques. Ce dernier est utilisable en pratique dans le cas où les mesures de risque utilisées sont la probabilité de défaillance et le quantile, et est équivalent, sous une hypothèse, à l'estimation d'un quantile par la méthode de Wilks.

**Keywords:** uncertainty quantification, risk measures, quantile, value-at-risk, superquantile, conditional value-at-risk, margin, failure probability, buffered failure probability, decision-making.

<footnote n="1">¹ Université Gustave Eiffel, COSYS, 14-20 boulevard Newton, 77447 Champs-sur-Marne, France.
{marie.temple-boyer2, guillaume.perrin}@univ-eiffel.fr</footnote>

<footnote n="2">² EDF R&D, 6 quai Watier, 78401 Chatou, France.
{marie.temple-boyer,vincent.chabridon,julien.pelamatti,emmanuel.remy}@edf.fr</footnote>

<footnote n="3">³ CentraleSupélec, 3 rue Joliot Curie, 91190 Gif-sur-Yvette, France.
emma.cussenot@student-cs.fr</footnote>
# Contents

<table><tr><td>1 Introduction</td><td>2</td></tr><tr><td>2 Definition and examples of risk measures</td><td>4</td></tr><tr><td>2.1 Main desirable properties for risk measures</td><td>4</td></tr><tr><td>2.2 Main Y-homogeneous risk measures</td><td>6</td></tr><tr><td>2.3 Main [0, 1]-homogeneous risk measures</td><td>12</td></tr><tr><td>2.4 Synthesis</td><td>16</td></tr><tr><td>3 Duality of risk measures and decision-making</td><td>18</td></tr><tr><td>3.1 Dual risk measure of a Y-homogeneous risk measure</td><td>18</td></tr><tr><td>3.2 Duality examples</td><td>20</td></tr><tr><td>3.3 Dual properties</td><td>23</td></tr><tr><td>3.4 Synthesis</td><td>23</td></tr><tr><td>4 Practical statistical decision-making criterion</td><td>24</td></tr><tr><td>4.1 Limitations of the theoretical formalism in decision-making</td><td>24</td></tr><tr><td>4.2 From decision criteria on risk measures to decision criteria on risk measures estimators</td><td>25</td></tr><tr><td>4.3 Generic framework for practical decision-making</td><td>27</td></tr><tr><td>4.4 Application on quantile and failure probability</td><td>28</td></tr><tr><td>4.5 Towards an application to other risk measures</td><td>32</td></tr><tr><td>5 Numerical experiments</td><td>33</td></tr><tr><td>5.1 Presentation of the test cases</td><td>33</td></tr><tr><td>5.2 Behaviour of the estimators</td><td>35</td></tr><tr><td>5.3 Application to the decision-making framework</td><td>39</td></tr><tr><td>5.4 Synthesis</td><td>42</td></tr><tr><td>6 Discussion and conclusion</td><td>42</td></tr><tr><td>6.1 Discussion</td><td>42</td></tr><tr><td>6.2 Conclusion and perspectives</td><td>42</td></tr><tr><td>A Counter-examples of properties for some risk measures</td><td>44</td></tr><tr><td>B Complementary results on the continuity of risk measures</td><td>45</td></tr><tr><td>C Proofs of convergence of the estimators</td><td>48</td></tr><tr><td>D Proofs of duality results</td><td>50</td></tr><tr><td>E Proofs of practical decision-making results</td><td>52</td></tr><tr><td>F Computation of the risk measure of the academic test cases</td><td>55</td></tr></table>
# 1 Introduction

To ensure the reliability of critical power production systems, the nuclear industry (among other industries) uses numerical simulation tools coupled with uncertainty analyses to control the safety margins required by regulatory authorities. These critical systems are subject to numerous sources of uncertainty (e.g., intrinsic variability, statistical uncertainties, lack of knowledge, model errors), and a generic methodological approach, common to many industrial actors, is generally adopted [De Rocquigny et al., 2008, De Rocquigny, 2012, Blanchard et al., 2023]. Within this generic approach, reliability analysis generally consists in characterizing the behavior of systems in failure regimes that lead to undesirable consequences, whether human, environmental, societal, or financial [Bedford and Cooke, 2001, Modarres, 2006, Aven, 2012]. The main question is then to assess how rare and severe is the system failure. Depending on the application domain, the practices and criteria used in reliability analysis may vary. For example, in the electricity production field, one can mention the analyses conducted for thermal-hydraulic accidental analysis in nuclear safety for which a quantile of a random variable of interest (typically the peak cladding temperature) is estimated [Iooss and Marrel, 2019]. More generally, the Wilks' method for quantile estimation [Wilks, 1941] is the state of the art regarding nuclear safety [Kang et al., 2018, Porter, 2019, Van Dorp et al., 2023]. On the other hand, in the hydroelectric field, the reliability of penstocks is generally studied through the calculation of a failure probability [Ajenjo et al., 2023]. In other applications such as financial risk analysis, quantiles and superquantiles are most often considered [Norton et al., 2021, Powell and Allen, 2009, Hafsa, 2015]. All these quantities (quantile, superquantile, failure probability) can be referred to more generally as *risk measures*. In this article we aim to study the theoretical and numerical behaviors of several classical risk measures with respect to the properties specific to these mathematical objects, but also the adaptation of these risk measures to decision-making. Since we will often refer to these concepts of decision-making, we will regularly refer to an *analyst* or to a *decision-maker* to designate a person or group of persons that is in charge of the safety analysis of the system.

To go into more detail, let $Y \in \mathbb{R}$ be the *variable of interest* that is used to monitor the functioning of the system. We assume that this variable of interest is an indicator of the level of reliability of the system, with the convention that the greater $Y$, the less reliable the system (e.g., a critical temperature). In general, $Y$ is the output of a complex numerical code $g$, that simulates the system. To account for different sources of uncertainties, the input $X \in \mathbb{R}^d$ is modeled as a random vector [De Rocquigny et al., 2008, De Rocquigny, 2012, Blanchard et al., 2023]. As a consequence, $Y = g(X)$ is a random variable, and the reliability analysis is conducted within a probabilistic framework. Hence, we emphasize that the probability distribution of the variable of interest $Y$ is unknown. Less frequently, it may also not admit a variance or an expectation, and $Y$ does not necessarily have a density. From this variable of interest, we often consider a so-called *quantity of interest* that is a statistical quantity derived from this variable (typically, an expected value, a variance or any risk measure).

The main objectives of this article are threefold. (i) First, we aim at giving a catalogue of usual risk measures, along with their (standard) mathematical properties and a way to estimate them in a Monte Carlo setting. Our goal is not to rank these risk measures, but to give an insight on their strengths and weaknesses. (ii) Secondly, we want to highlight the benefit of distinguishing between two categories of risk measures: those which are homogeneous to the variable of interest $Y$, that we will call *Y-homogeneous risk measures*, and those which are homogeneous to a probability, that we will call $[0,1]$-homogeneous risk measures. Indeed, we show that these two categories can be linked using a decision criterion, or a duality, so that most standard risk measures can be grouped in pairs (one from each category). This duality can also be used to define new risk measures in a completely natural way, by seeking more systematically for dual measures for each risk measure (if these have not yet been defined). (iii) The third objective of this work is to develop a general formal framework for decision-making based on all these risk measures. In particular, we show that it is equivalent to work with an *Y*-homogeneous risk measure and with the dual $[0,1]$-homogeneous risk measure, when it comes to making decisions based on one of these risk measures. Furthermore, we will see that Wilks' quantile approach [Wilks, 1941] can be viewed as a special case of this general formalism.

The outline of this paper is as follows. First, in Section 2, we define the notion of risk measure and a list of mathematical properties that a risk measure can satisfy. We detail which of these properties are respected and give a statistical estimator for the following risk measures: the margin, the quantile,
the superquantile, the failure probability, and the buffered failure probability. Then, in Section 3, we propose a decision criterion using a risk measure, and construct a duality between Y-homogeneous risk measures and [0, 1]-homogeneous risk measures. In Section 4, we present a non-asymptotic, practical framework for decision-making purposes. This framework, applied to the failure probability and the quantile, generalizes, in particular, an approach related to Wilks' quantile. Then in Section 5 we propose some numerical experiments to illustrate the estimation of the different risk measures and the practical implementation of the proposed decision-making framework. Lastly, in Section 6, we provide a synthesis and conclusions on the proposed work, and identify some perspectives for future studies on the subject.

Before going any further on the core subject of paper, we would like to recall a few general notations that will be used throughout the paper.

# Notations

## General mathematical notations

* $[a, b]$, $(a, b)$, $[a, b)$ and $(a, b]$ for $-\infty \le a < b \le +\infty$: respectively closed, interval, open interval and semi-open intervals (as an example, $[a, b) := \{x \in \mathbb{R} : a \le x < b\}$).

* $\{x \in S : (*)\}$: set of $x \in S$ that verifies the condition $(*)$.

* $S^N$ for a set $S$: set of the sequences that take values in $S$.

* $\nabla h$ for $h$ a function from $\mathbb{R}^d$ to $\mathbb{R}$: gradient of $h$.

* $A^\top$ for $A$ a matrix: transposed matrix of $A$.

* $\inf f$ and $\sup f$ for $f$ a function: infimum and supremum of $f$.

## Probabilistic and statistical notations

* $(\Omega, \mathcal{F}, \mathbb{P})$: probability space.

* $E, V$: the set of all the real-valued random variable on $(\Omega, \mathcal{F}, \mathbb{P})$, a sub-space of $E$.

* $\mathbb{E}(Y), \sigma(Y), \text{Var}(Y)$: expectation, standard deviation and variance of random variable $Y$.

* $f_Y, F_Y$: probability density function (PDF) and cumulative distribution function (CDF) of random variable $Y$.

* a.s.: almost surely.

* $\sup(Y), \inf(Y)$: supremum and infimum of $Y$ defined as $\sup(Y) := \inf\{y \in \mathbb{R} : F_Y(y) = 1\} \in \mathbb{R} \cup \{+\infty\}$ and $\inf(Y) = \sup\{y \in \mathbb{R} : F_Y(y) = 0\} \in \mathbb{R} \cup \{-\infty\}$.

* $L^q(\Omega), \|\cdot\|_{L^q}$: subspace of random variables such that $\|Y\|_{L^q} := (\mathbb{E}(|Y|^q))^{\frac{1}{q}} < +\infty$.

* $L^\infty(\Omega), \|\cdot\|_{L^\infty}$: subspace of random variables that are bounded almost surely (and $\|Y\|_{L^\infty}$ is the infimum of the bounds).

* $\mathcal{N}(\mu, \sigma^2)$: normal distribution of expectation $\mu$ and standard deviation $\sigma > 0$.

* $\mathcal{E}(\mu)$: exponential distribution of parameter $\mu > 0$ with PDF $x \mapsto \mu \exp(-\mu x) \mathbb{1}_{\{x \ge 0\}}$.

* $\mathcal{U}(I)$: uniform distribution on an interval $I$ or discrete uniform distribution on the finite set $I$.

* $\mathcal{B}(p)$: Bernoulli distribution of parameter $0 \le p \le 1$.

* $\mathcal{B}(n, p)$: binomial distribution of parameter $n \in \mathbb{N}^*$ and $0 \le p \le 1$.

* $\mathcal{P}(a, k)$: Pareto distribution with associated PDF $y \mapsto k \frac{a^k}{y^{k+1}}$.

* $\bar{Y}_n, s_n$: estimator of the expectation, estimator of the standard-deviation.

* s.l.l.n.: strong law of large numbers.

* c.l.t.: central limit theorem.
## Notations for risk measures

* $\alpha \in (0,1)$: level of a quantile or level of conservatism.

* $s \in \mathbb{R}$: threshold.

* $q_{\alpha}(Y), \bar{q}_{\alpha}(Y)$: quantile and superquantile of level $\alpha$ of random variable $Y$.

* $q_{\alpha}^{-}(Y), q_{\alpha}^{+}(Y)$: lower and upper quantiles of level $\alpha$ of random variable $Y$ ($q_{\alpha}^{-}(Y) := q_{\alpha}(Y) := \inf\{y \in \mathbb{R}: F_{Y}(y) \ge \alpha\}$ and $q_{\alpha}^{+}(Y) := \sup\{y \in \mathbb{R}: F_{Y}(y) \le \alpha\}$).

* $p_s(Y), \bar{p}_s(Y)$: failure probability and buffered failure probability for threshold $s$ of random variable $Y$.

* $\text{mgn}(Y; \lambda)$: margin defined as $E(Y) + \lambda\sigma(Y)$ where $\lambda > 0$.

* $\mathcal{R}$ or $\mathcal{R}(\cdot)$: risk measure.

* $\mathcal{P}(\cdot)$: dual risk measure.

# 2 Definition and examples of risk measures

Let $(\Omega, \mathcal{F}, \mathbb{P})$ be a probability space, $E$ be the set of all the real-valued random variables on $(\Omega, \mathcal{F}, \mathbb{P})$ and $Y \in E$ be the real-valued random variable of interest for the system monitoring. Let us note that we may have $\mathbb{P}(Y = \sup(Y)) > 0$ but in any case we have $\mathbb{P}(Y = +\infty) = \mathbb{P}(Y = -\infty) = 0$. We recall that the greater $Y$, the less reliable the system. In order to assess the risk related to $Y$, we would like to associate to $Y$ a deterministic scalar $\mathcal{R}(Y)$. We will call such an application a risk measure. The interest of this notion is to be able to compare random variables. Indeed, the analyst can consider that $Y_1$ is safer than $Y_1$ if $\mathcal{R}(Y_1) \le \mathcal{R}(Y_2)$, or that $Y$ is safe for a security threshold $s \in \mathbb{R}$ if $\mathcal{R}(Y) \le s$. For $p \ge 1$, we denote by $L^p(\Omega)$ the subspace of the random variables $Y$ on $(\Omega, \mathcal{F}, \mathbb{P})$ such that $\|Y\|_{L^p} := E(|Y|^p) < +\infty$, and by $L^\infty(\Omega)$ the subspace of the random variables on $(\Omega, \mathcal{F}, \mathbb{P})$ that are bounded almost surely.

**Definition 1 (Risk measure).** Let $V$ be a vector subspace of $E$. A risk measure on $V$ is an application $\mathcal{R}: V \to \mathbb{R}$ which takes as entry a random variable $Y \in E$ and returns a real $\mathcal{R}(Y)$.

This definition is very general and covers a lot of quantities of interest, as for instance expectation, variance, standard-deviation, quantile, failure probability, etc. However, for a risk measure to be relevant, it is expected that it respects some properties. The study of several risk measures and their properties is the purpose of the rest of this section.

## 2.1 Main desirable properties for risk measures

Several desirable properties for risk measures have been established in [Artzner et al., 1999, Rockafellar and Royset, 2015], which are summarized in the following definition.

**Definition 2 (Risk measure properties).** Let $\mathcal{R}$ be a risk measure defined on $V$ a vector subspace of the real-valued random variables. We define the following properties:

1. (Monotony). If $(Y_1, Y_2) \in V^2$ are such that $Y_1 \le Y_2$ almost surely (a.s.), then $\mathcal{R}(Y_1) \le \mathcal{R}(Y_2)$.

2. (Continuity). For any $Y \in V$ and any $(Y_n)_{n \in \mathbb{N}} \in V^\mathbb{N}$ such that $Y_n \xrightarrow{n \to +\infty} Y$ for a type of convergence to be specified (in probability, for example), then $\mathcal{R}(Y_n) \xrightarrow{n \to +\infty} \mathcal{R}(Y)$.

3. (Positive homogeneity). For all $Y \in V$ and all $\lambda > 0$, then $\mathcal{R}(\lambda Y) = \lambda \mathcal{R}(Y)$.

4. (Translation invariance). For all $Y \in V$ and all $c \in \mathbb{R}$, then $\mathcal{R}(Y + c) = \mathcal{R}(Y) + c$.

5. (Constant equivalence). If $Y \in V$ and $c \in \mathbb{R}$ are such that $Y = c$ a.s., then $\mathcal{R}(Y) = c$.

6. (Risk aversion). For all $Y \in V$ that is not constant a.s., then $\mathcal{R}(Y) > E(Y)$.
7. (Subadditivity). For all $(Y_1, Y_2) \in V^2$, then $\mathcal{R}(Y_1 + Y_2) \le \mathcal{R}(Y_1) + \mathcal{R}(Y_2)$.

8. (Convexity). The mapping $\mathcal{R}: V \to \mathbb{R}$ is convex.

9. (Closedness). For all $c \in \mathbb{R}$, the set $\{Y \in V : \mathcal{R}(Y) \le c\}$ is closed for a type of convergence to be specified.

**Remark 1.** A risk measure is coherent [Artzner et al., 1999] if it is monotonic, positively homogeneous, constant equivalent and subadditive, and a risk measure is regular [Rockafellar and Royset, 2015] if it is convex, risk averse and respects to closedness. In this paper, we rather study the properties from Definition 2 one by one, and we do not use this designation.

The mathematical formulation of these properties calls for a few comments. To begin, we see that the monotony is in line with the intuition we have of a risk measure. Indeed if a random variable $Y_2$ is associated to a less reliable situation than $Y_1$, the risk measure has to reflect this relationship. A non-monotonic risk measure could lead to promote a situation that is almost surely less reliable.

The continuity depends on the type of convergence considered. For instance, a risk measure is continuous for the convergence in distribution if $Y_n \to Y$ in distribution implies that $\mathcal{R}(Y_n) \to \mathcal{R}(Y)$. The continuity also expresses a regularity, in the sense that it implies that two risk measures $\mathcal{R}(Y_0)$ and $\mathcal{R}(Y)$ are close from the moment that random variables $Y$ and $Y_0$ are close enough. When $(E, \|\cdot\|)$ is a normed vector space, the continuity for the convergence associated to the norm $\|\cdot\|$ is the continuity of the application $\mathcal{R}: (E, \|\cdot\|) \to (\mathbb{R}, |\cdot|)$. In this case, as an extension of the continuity, we may be interested in stronger regularity results, such as the Lipschitz continuity. In the following, we focus on the following types of convergence: almost surely, in $L^p$ for $1 \le p \le +\infty$, in probability and in distribution. A summary of the links between the different types of convergence is provided in Figure 22 from Appendix B.

The positive homogeneity expresses the homogeneity of the risk measure in the variable of interest $Y$. Among other things, with a positive homogeneous risk measure, a change of unit will not change the conclusion one could obtain. The translation invariance, the constant equivalence and the risk aversion also express the homogeneity of the risk measure in the variable of interest. The translation invariance guarantees that adding a constant will just add the same constant to the risk measure. The constant equivalence shows that a risk measure does not change a random variable that is almost surely constant. The risk aversion guarantees that the risk measure is always more penalizing than the expectation. Besides, the subadditivity shows that it is more reliable to consider two different systems together than individually.

Somewhat differently from from these previous properties, the convexity and the closedness are technical assumptions when dealing with optimization problems related to a risk measure. The convexity gives for instance useful properties when minimizing the risk measure. Note also that for a risk measure that is positively homogeneous, the convexity and the subadditivity are equivalent. Then, the closedness can be interpreted as follows: the closed balls for the pseudo-norm $\|\cdot\|_{\mathcal{R}}$ defined by $\|Y\|_{\mathcal{R}} = \mathcal{R}(|Y|)$ are closed in $V$ for the chosen type of convergence (for more details, see [Rockafellar and Uryasev, 2013] where the closedness is used for the $L^2$ convergence). In this article, we limit ourselves to the fact that the continuity for a given type of convergence implies the closedness for this same type of convergence.

**Remark 2.** If the risk measure $\mathcal{R}$ is positively homogeneous, constant equivalent, risk averse, monotonic and subadditive, then the mapping $Y \mapsto \|Y\|_{\mathcal{R}} := \mathcal{R}(|Y|)$ is a norm on $V$. Indeed, it is positive and positively homogeneous, and it respects the triangular inequality as the risk measure is monotonic and subadditive. Moreover, if $Y = 0$ a.s., then $\mathcal{R}(|Y|) = 0$ thanks to the constant equivalence. Last, if $Y$ is such that $\mathcal{R}(|Y|) = 0$, then $Y$ is almost surely constant. Indeed, if it was not the case, with the risk aversion we would have $0 = \mathcal{R}(|Y|) > \mathbb{E}(|Y|) \ge 0$. Hence using the constant equivalence, $Y = 0$ a.s. In such a case and when $(E, \|\cdot\|)$ is a normed space, then the closedness corresponds to the fact that the closed balls for $\|\cdot\|_{\mathcal{R}}$ are closed in $(E, \|\cdot\|)$.

In addition to the properties of Definition 2, the possibility to numerically estimate a risk measure is a very desirable feature. Indeed, a risk measure that respects all the properties listed in Definition 2 but that can not be numerically estimated is not usable in practical applications.
## 2.2 Main Y-homogeneous risk measures

In this part, we list classical Y-homogeneous risk measures, discuss their properties and present statistical estimators to estimate them when we have a set of copies of Y that are all statistically independent of each other, identically distributed, and have the same distribution as Y. For any random variable Y, we therefore note $(Y_1, ..., Y_n)$ this set of n independents, identically distributed (i.i.d.) copies of Y.

### 2.2.1 Margin and expectation

A first classical risk measure often encountered in engineering applications is the margin, whose formal definition is given below.

**Definition 3** (Margin and expectation). Let $\lambda > 0$. The margin is the risk measure that takes as an entry $Y \in L^2(\Omega)$ and returns $\text{mgn}(Y; \lambda) := \mathbb{E}(Y) + \lambda\sigma(Y)$, where $\mathbb{E}(Y)$ and $\sigma(Y)$ are respectively the expectation and the standard deviation of random variable $Y$.

The margin is a convenient risk measure: it is simple since its definition uses only the classical statistical objects that are the expectation and the standard-deviation. Adding the latter to the expectation represents a risk aversion, as the spreading of $Y$ increases the margin. The choice of the parameter $\lambda$ may be dictated by standards or experience feedback, depending on the risk aversion considered: the greater $\lambda$, the more risk-averse the margin. The expectation is a risk measure as well, but is rarely used in engineering applications. Note that the expectation can be seen as a limit case of the margin, when $\lambda$ tends to 0.

The margin and the expectation respect the positive homogeneity, the translation invariance and the constant equivalence. They are also subadditive as the standard deviation is a norm on $L^2(\Omega)$ and is therefore subjected to the triangular inequality. Hence, they are convex as well. Moreover, the margin is Lipschitz-continuous for the $L^2$ norm and the expectation is Lipschitz-continuous for the $L^1$ norm (and hence for the $L^2$ norm as well). As a consequence, they respect the closedness property for the corresponding norms.

The margin is risk averse whereas the expectation is not. However, the margin remains symmetric in the following sense: based on the standard deviation of $Y$, which is a global measure of uncertainty, it considers the same way a spreading of $Y$ towards the negative values than towards the positive values, which is not a feature we must necessarily seek, as there is no reason for a spreading towards the negative values to increase the risk. As a consequence, the margin does not respect the monotony. A counter-example with two dependent discrete random variables is provided in [Rockafellar and Royset, 2015], and we propose additional counter-examples with independent random variables in Appendix A.1 (for discrete random variables and random variables with PDF). In terms of numerical estimation using the set $(Y_1, ..., Y_n)$, the estimation of the margin just requires the simultaneous estimation of the expectation and of the variance of $Y$, as defined below.

**Definition 4** (Expectation and margin estimators). If $\bar{Y}_n := \frac{1}{n} \sum_{i=1}^n Y_i$ is the empirical estimator of the expectation of $Y$, and $\sigma_n^2 := \frac{1}{n} \sum_{i=1}^n (Y_i - \bar{Y}_n)^2$ is the empirical estimator of the variance of $Y$, $\widehat{\text{mgn}}_n := \bar{Y}_n + \lambda\sigma_n$ is an estimator of the margin.

Under relatively unrestricted assumptions, it can then be shown that these estimators of the expectation and margin have good statistical properties.

**Proposition 1** (Consistency and asymptotic normality of the expectation estimator). Let assume that $Y \in L^1(\Omega)$.

(i) The expectation estimator is strongly consistent and unbiased.

(ii) If $Y \in L^2(\Omega)$, then the expectation estimator is consistent for the $L^2$ convergence.

(iii) If $Y \in L^2(\Omega)$, then the expectation estimator is asymptotically normal: $(\sqrt{n}(\bar{Y}_n - \mathbb{E}(Y)))_{n \in \mathbb{N}}$ converges in distribution to $\mathcal{N}(0, \text{Var}(Y))$.

*Proof.* Proposition 1 is mainly a direct consequence of the strong law of large number (s.l.l.n.) [Shapiro et al., 2021] and the central limit theorem (c.l.t.). A proof can be found in Appendix C.1. $\square$

**Proposition 2** (Consistency and asymptotic normality of the margin estimator). Let assume that $Y \in L^2(\Omega)$.
(i) The margin estimator is strongly consistent and unbiased.

(ii) If $Y \in L^4(\Omega)$ and $\text{Var}(Y) > 0$, then the margin estimator is asymptotically normal: $(\sqrt{n}(\hat{mgn}_n - mgn(Y)))_{n \in \mathbb{N}}$ converges in distribution to $\mathcal{N}(0, \sigma_{mgn}^2)$, where $A^\top$ is the transpose of any matrix $A$ and where:

* $\sigma_{mgn}^2 = \nabla h(\mathbb{E}(Y), \mathbb{E}(Y^2))^\top \Sigma \nabla h(\mathbb{E}(Y), \mathbb{E}(Y^2))$,

* $\Sigma := \begin{bmatrix} \text{Var}(Y) & \text{Cov}(Y, Y^2) \\ \text{Cov}(Y, Y^2) & \text{Var}(Y^2) \end{bmatrix}$ is the covariance matrix of $(Y, Y^2)$,

* $h$ is the function defined by $h(m_1, m_2) = m_1 + \lambda \sqrt{m_2 - m_1^2}$, and $\nabla h$ is its gradient.

*Proof.* The proof of Proposition 2 relies on the c.l.t. and the delta-method (see [Shapiro et al., 2021] for a statement of the delta-method), and is also provided in Appendix C.1. □

Propositions 1 and 2 indeed assure us that both expectation and margin estimators are strongly consistent, and that they admit central limit convergence results, which gives an insight on the spreading of the estimator as the asymptotic variance can be easily computed and estimated. Indeed, in the case of the expectation, it is just the variance $Y$, and we can estimated it by $\sigma_n^2$. In the case of the margin, we can compute explicitly the gradient of function $h$,

$$ \nabla h(\mathbb{E}(Y), \mathbb{E}(Y^2)) = \left(1 - \lambda \frac{\mathbb{E}(Y)}{\sigma(Y)}, \frac{\lambda}{2\sigma(Y)}\right)^\top. $$

Then, the asymptotic variance is expressed in terms of $\mathbb{E}(Y)$, $\mathbb{E}(Y^2)$, $\mathbb{E}(Y^3)$ and $\mathbb{E}(Y^4)$ and all those quantities can be estimated using the sample $(Y_1, ..., Y_n)$. As a consequence, when estimating the expectation and the margin using a sample $(Y_1, ..., Y_n)$, the analyst has access to an estimation of the asymptotic variance, without any need of an other sampling, and can hence assess the accuracy of the estimation.

### 2.2.2 Quantile and worst-case

Another widely used risk measure is the quantile. It has the advantage of being well-defined for any real-valued random variable, without assuming any integrability condition. As a limit case of the quantile, we also define the worst-case in the following definition.

**Definition 5 (Quantile and worst-case).** The quantile of level $0 < \alpha < 1$ and the worst-case are respectively the risk measures

$$ q_{\alpha} : \begin{cases} E \rightarrow \mathbb{R} \\ Y \mapsto \inf\{y \in \mathbb{R} : F_Y(y) \ge \alpha\} \end{cases} \text{ and } \sup : \begin{cases} L^{\infty}(\Omega) \rightarrow \mathbb{R} \\ Y \mapsto \inf\{y \in \mathbb{R} : F_Y(y) = 1\} \end{cases}, $$

where $F_Y$ is the cumulative distribution function (CDF) of random variable $Y$.

In the same manner as parameter $\lambda$ for the margin, the value of $\alpha$ may be chosen according to standards or expertise feedback. Indeed, we always have the guarantee $\mathbb{P}(Y > q_{\alpha}(Y)) \le 1 - \alpha$. Usual values of $1 - \alpha$ in risk analysis are $10^{-2}$, $10^{-3}$ or even $10^{-6}$. When the CDF $F_Y$ of $Y$ is bijective (for instance for random variables with PDF that is strictly positive on $\mathbb{R}$) then the function $\alpha \mapsto q_{\alpha}(Y)$ is the inverse of function $y \mapsto F_Y(y)$.

The worst-case, which is the supremum of the values that can be reached by random variable $Y$, corresponds to the quantile for the specific value $\alpha = 1$. Hence, we may note it $q_1(Y)$ instead of $\sup(Y)$. It is a very conservative risk measure, in the sense that for any $Y \in E$ we have $Y \le \sup(Y)$ a.s. In practice, it is only relevant for random variables that are bounded almost surely (otherwise, it is infinite), which is a strong restriction (for instance, exponential, normal or geometric distributions do not verify this assumption).

Using some properties of the CDF, we can see that the quantile and the worst-case are monotonic, positively homogeneous, translation invariant and constant equivalent:

(i) If $Y_1 \le Y_2$ a.s., then for all $y \in \mathbb{R}$, we have $F_{Y_1}(y) \ge F_{Y_2}(y)$, which leads to $q_{\alpha}(Y_1) \le q_{\alpha}(Y_2)$.
(ii) For $\lambda > 0$, then for all $y \in \mathbb{R}$, we have $F_{\lambda Y}(\lambda y) = F_Y(y)$, which leads to the positive homogeneity.

(iii) For $c \in \mathbb{R}$ and $y \in \mathbb{R}$, we have $F_{Y+c}(y) = F_Y(y-c)$, which leads to the translation invariance.

(iv) Last, if there is $c \in \mathbb{R}$ such that $Y = c$ a.s., then for all $y \in \mathbb{R}$, we have $F_Y(y) = 0$ if $y < c$ and 1 otherwise, which leads to the constant equivalence.

In addition, it is straightforward to see that the worst-case is risk averse. Indeed, for all $Y \in L^\infty(\Omega)$, we have $Y \le \sup(Y)$ a.s., hence $E(Y) \le \sup(Y)$. Moreover, if $E(Y) = \sup(Y)$, then $\sup(Y) - Y$ is almost surely positive with a null expectation, which means that $\sup(Y) - Y = 0$ a.s. Hence, $Y$ is almost surely constant. The quantile is not risk averse in general. Counter-examples are given in Appendix A.2. Yet, for values of $\alpha$ close to 1 and for a lot of classical distributions (exponential, uniform, Gaussian and binomial for instance), the quantile is above the expectation.

The worst-case is subadditive. Hence, since it is positively homogeneous, it is convex as well. However, the lack of subadditivity of the quantile is detailed in [Artzner et al., 1999, Rockafellar and Royset, 2015, Labopin-Richard, 2016] (a counter-example is also provided in Appendix A.2).

**Remark 3 (Quasi-convexity of the quantile).** As a consequence of the lack of subadditivity, the quantile is not convex in general. However, it is quasi-convex with respect to the distribution of the random variable, but not in terms of the random variable itself, as mentioned in [Stenger et al., 2021]. Since the properties in Definition 2 are introduced in terms of the random variable, this quasi-convexity of the quantile will not be further analyzed in this article.

The worst-case is continuous for the norm $\|\cdot\|_{L^\infty}$ since $\|Y\|_{L^\infty} = \sup(|Y|)$. Rigorously speaking, the quantile is not continuous for the almost sure convergence (a counter-example is given in Appendix B.2). Nonetheless, if $(Y_n)_{n \in \mathbb{N}} \in E^\mathbb{N}$ converges in distribution to $Y \in E$, then the sequence of quantiles $(q_\alpha(Y_n))_{n \in \mathbb{N}}$ can be arbitrarily close to the quantile of level $\alpha$ of $Y$. This means that for any $\varepsilon > 0$, there exists $N \ge 0$ such that for any $n \ge N$, we have $q_\alpha^-(Y) - \varepsilon \le q_\alpha(Y_n) \le q_\alpha^+(Y_n) + \varepsilon$ where

$$q_{\alpha}^{-}(Y) = q_{\alpha}(Y) = \inf \{y \in \mathbb{R} : F_{Y}(y) \ge \alpha\}, \quad q_{\alpha}^{+}(Y) = \sup \{y \in \mathbb{R} : F_{Y}(y) \le \alpha\}.$$

A proof can be found in Appendix B.2. This result is not surprising, since our definition of the quantile is conventional: indeed, any $q \in (q_\alpha^-(Y), q_\alpha^+(Y))$ is such that $F_Y(q) = \alpha$ and henceforth could be called quantile. Definition 5 was only proposed to guarantee the existence and the uniqueness of the quantile considered. A consequence of this continuity result is that if $Y$ admits a density that is defined on an interval $I$, then any sequence that converges in law to $Y$ will have its sequence of quantiles that converges to the quantile of $Y$. As for the closedness, we cannot conclude easily since the continuity is partial. We just note that [Rockafellar and Uryasev, 2013] showed that the quantile is not closed for the $L^2$ convergence.

**Remark 4.** We will regularly see that a number of results are simplified when we assume that $Y$ has a density. Note, however, that the distribution of $Y$ is a priori unknown, and that it is often very difficult to determine a priori whether or not this density exists. Indeed, it is not because it is customary to model the uncertain input $X$ in engineering using random variables with density (Gaussian, exponential, uniform distributions) that this will result in an output $Y = g(X)$ with a density: a large number of system failures are related to threshold effects, which can cause switch-like behavior for the output, or concentrations of probabilities on certain values.

The estimation of the quantile using $(Y_1, ..., Y_n)$ generally relies on order statistics [Arnold et al., 2008]. Let $(Y_{(1,n)}, ..., Y_{(n,n)})$ be the order statistics of sample $(Y_1, ..., Y_n)$, i.e. a permutation of $(Y_1, ..., Y_n)$ so that $Y_{(1,n)} \le ... \le Y_{(n,n)}$, and for all $x \in \mathbb{R}$, let $\lceil x \rceil$ be the lowest integer that is greater or equal to $x$.

**Definition 6 (Quantile estimator).** Let $\alpha \in (0, 1]$. The estimator of $q_\alpha$ based on order statistics is defined by $\hat{q}_{\alpha,n} := Y_{\lceil \alpha n \rceil, n}$. The case $\alpha = 1$ corresponds to the worst-case estimator.

**Proposition 3 (Consistency and asymptotic normality of the quantile estimator).** Assume that $0 < \alpha < 1$.

(i) If the cardinality of $F_Y^{-1}(\{\alpha\})$ is 1 at the most, then the quantile estimator is strongly consistent.
(ii) If we further assume that $Y$ has a PDF $f_Y$ that is continuous in $q_\alpha$ and such that $f_Y(q_\alpha) > 0$, then the quantile estimator is asymptotically normal: $(\sqrt{n}(\hat{q}_{\alpha,n} - q_\alpha))_{n \in \mathbb{N}}$ converges in distribution to $N\left(0, \frac{\alpha(1-\alpha)}{f_Y(q_\alpha)^2}\right)$.

*Proof.* A proof of (i), inspired by [Delmas, 2009], can be found in the Appendix C.2. For a proof of (ii), see [Wilks, 1948] (Section 5.(c)). □

**Remark 5.** The condition for the strong consistency of the quantile in (i) is equivalent to the condition $q_\alpha(Y) = q_\alpha^+(Y)$. It means that there is at most one value of $y$ such that $F_Y(y) = \alpha$.

**Remark 6.** If we remove the assumption of the cardinality of $F^{-1}(\{\alpha\})$, then we have almost surely $\liminf_{n \to +\infty} \hat{q}_{\alpha,n} \ge q_\alpha$ and $\limsup_{n \to +\infty} \hat{q}_{\alpha,n} \le q_\alpha^+$. Hence, the quantile estimator can be as close as possible to the set of quantiles in $[q_\alpha, q_\alpha^+]$.

**Proposition 4** (Consistency of the worst-case estimator). The worst-case estimator is strongly consistent.

*Proof.* A proof, also inspired by [Delmas, 2009], can be found in the Appendix C.2. □

Quantile and worst-case estimators are both strongly consistent. There is a central limit theorem for the quantile estimator, but the asymptotic variance is expressed with respect to the PDF of $Y$ in $q_\alpha$. It is therefore not easy to estimate numerically this variance as this PDF is most of the time unknown. That being said, the quantile estimator from Definition 6 appears to be very convenient for its non asymptotic properties, as it will be detailed in Subsection 4.4.

### 2.2.3 Superquantile

The quantile guarantees that the probability of exceeding the quantile is lower or equal to $1 - \alpha$, but does not take into account the severity of the consequences associated with this exceedance. On the contrary and as mentioned in [Beaucourt et al., 2025], the superquantile [Rockafellar and Uryasev, 2000, Rockafellar and Uryasev, 2002] goes beyond this limitation, and allows the risk to be weighted in relation to the severity of the consequences, as illustrated in Figure 1, hence its widespread use in risk analysis.

**Definition 7.** The superquantile of level $0 < \alpha < 1$ is the risk measure

$$ \bar{q}_{\alpha}: \left\{ \begin{array}{ll} L^1(\Omega) & \rightarrow \mathbb{R} \\ Y & \mapsto \inf_{c \in \mathbb{R}} \left( c + \frac{1}{1-\alpha} \mathbb{E}([Y-c]_+) \right) \end{array} \right. , $$

where $[x]_+ := \max(x, 0)$ denotes the positive part of $x \in \mathbb{R}$.

**Remark 7** (Names and notations). In the financial community, different names and notations are used for the quantile and superquantile. The quantile is called value-at-risk and is noted VaR, and the superquantile is called Conditional Conditional value-at-risk and is noted CVaR.

It can be shown that for any $Y \in L^1(\Omega)$:

$$ \bar{q}_{\alpha}(Y) = q_{\alpha}(Y) + \frac{1}{1-\alpha} \mathbb{E}([Y - q_{\alpha}(Y)]_{+}). \quad (1) $$

*Proof.* The precise justification of this equality can be found in [Shapiro et al., 2021], and relies in particular on the fact that the function $\phi: c \mapsto c + \frac{1}{1-\alpha} \mathbb{E}([Y-c]_+)$ is convex and that its minimum is attained in the interval $[q_\alpha(Y), q_\alpha^+(Y)]$. □

The superquantile is therefore more conservative than the quantile, meaning that we always have $\bar{q}_\alpha(Y) \ge q_\alpha(Y)$ for any $Y \in L^1(\Omega)$ and any level $0 < \alpha < 1$. For any random variable $Y \in L^1(\Omega)$,
<figure><img src="image_1.png" /><figcaption>Figure 1: PDF of two random variables that have the same quantile but different superquantiles: a safer case in (1a) and a riskier one in (1b).</figcaption></figure>

another way of defining the superquantile, which may be more intuitive but not necessarily easier to use in practice, is given by:

$$ \bar{q}_{\alpha}(Y) = \frac{1}{1-\alpha} \int_{\alpha}^{1} q_{\beta}(Y) d\beta, \qquad (2) $$

which can be further simplified (see [Shapiro et al., 2021] for the proofs with the assumption that $F_Y$ is continuous in the quantile) in the case where $F_Y$ is continuous in the quantile $q_{\alpha}(Y)$, in the form:

$$ \bar{q}_{\alpha}(Y) = \frac{1}{1-\alpha} \mathbb{E}(Y \mathbf{1}_{\{Y \ge q_{\alpha}(Y)\}}) = \mathbb{E}(Y|Y \ge q_{\alpha}(Y)), \qquad (3) $$

where $\mathbb{E}(\cdot|\cdot)$ is the conditional expectation while $\mathbb{1}_{\{A\}}$ is the indicator function equal to 1 if A is true and 0 otherwise. As a consequence, Equation (3) always holds for a random variable admitting a PDF.

**Remark 8.** Although particularly easy to read and interpret, it is important to note that Equation (3) is subject to condition and does not hold in general. For instance, if $Y \sim \mathcal{U}(\{-1, 0, 1\})$ is a discrete random variable, then $\bar{q}_{\frac{1}{2}}(Y) = \frac{2}{3}$ but $\mathbb{E}(Y|Y \ge q_{\frac{1}{2}}(Y)) = \mathbb{E}(Y|Y \ge 0) = \frac{1}{2}$. Nevertheless, we see that Equations (1) and (2) hold for this example.

**Remark 9.** In Definition 7 of the superquantile, constant c can be seen as an amount of money to be invested in the system, while $\frac{1}{1-\alpha}\mathbb{E}([Y-c]_+)$ would correspond to the cost of the system knowing that we put an investment of c. Hence, the superquantile is the smallest total cost possible (see [Rockafellar and Royset, 2015] for a deeper insight about this interpretation). Equations (2) and (3) give other interpretations of the superquantile: Equation (2) expresses the superquantile as the average of the quantile on $[\alpha, 1]$ while (3) expresses it as the average of the random variable knowing that the latter is beyond its quantile.

If we now consider the properties of the superquantile, we can start by observing that, by definition, the superquantile is monotonic. With Equation (2), it is also straightforward to see that the superquantile is positively homogeneous, translation invariant and respects the constant equivalence [Rockafellar and Royset, 2015]. Moreover, since the function $(c, Y) \mapsto \phi_Y(c) := c + \frac{1}{1-\alpha}\mathbb{E}([Y-c]_+)$ is convex, we can also conclude that the superquantile is convex [Shapiro et al., 2021]. Since it is positively homogeneous, it is subadditive. Using Equation (1), we also see that the superquantile is risk averse. Indeed, for $Y \in L^1(\Omega)$ and $0 < \alpha < 1$, we have $\bar{q}_{\alpha}(Y) - \mathbb{E}(Y) = \mathbb{E}(\frac{1}{1-\alpha}[Y-q_{\alpha}(Y)]_+ - (Y-q_{\alpha}(Y))) \ge 0$ since $\frac{1}{1-\alpha}[Y-q_{\alpha}(Y)]_+ \ge Y-q_{\alpha}(Y)$ a.s. Besides, if $\bar{q}_{\alpha}(Y) = \mathbb{E}(Y)$, then $\frac{1}{1-\alpha}[Y-q_{\alpha}(Y)]_+ = Y-q_{\alpha}(Y)$ a.s., which means that $Y = q_{\alpha}(Y)$ a.s. Furthermore, the superquantile is continuous for the $L^1$ norm, as expressed in the following proposition. Hence, it respects the closedness property.
**Proposition 5** (Continuity of the superquantile for the $L^1$ norm). Let $(Y_n)_{n \in \mathbb{N}} \in L^1(\Omega)^{\mathbb{N}}$ be a sequence of random variables that converges in $L^1(\Omega)$ to $Y \in L^1(\Omega)$. Then $(\bar{q}_{\alpha}(Y_n))_{n \in \mathbb{N}}$ converges to $\bar{q}_{\alpha}(Y)$.

*Proof.* The proof of Proposition 5 is provided in Appendix B.3. □

At last, we also mention the following result, which can be found in [Mafusalov et al., 2018], as it will be useful for the definition of the buffered failure probability in Section 2.3.2.

**Proposition 6.** Let $Y \in L^1(\Omega)$ be a random variable. Then the superquantile $\alpha \mapsto \bar{q}_{\alpha}(Y)$ is strictly increasing from $[0, 1 - \eta)$ to $[\mathbb{E}(Y), \sup(Y))$, where $\eta = \mathbb{P}(Y = \sup(Y))$, and it is continuous on $[0, 1]$.

*Proof.* For $0 \le \alpha < \beta < 1$, using Equation (2), we have $\bar{q}_{\beta}(Y) - \bar{q}_{\alpha}(Y) = \frac{\beta - \alpha}{(1 - \beta)(1 - \alpha)} \int_{\beta}^{1} q_{\gamma}(Y) d\gamma - \frac{1}{1 - \alpha} \int_{\alpha}^{\beta} q_{\gamma}(Y) d\gamma \ge 0$, and the equality holds if and only if $q_{\alpha}(Y) = \sup(Y)$ i.e. $\alpha \ge 1 - \eta$. For the continuity on $[0, 1[$, this comes from Equation (2) and the fact that $\alpha \mapsto \int_{\alpha}^{1} q_{\beta}(Y) d\beta$ is continuous in $[0, 1[$. For the continuity in 1, this comes also from (2) and from the fact that $q_{\alpha}(Y)$ converges to $\sup(Y)$ as $\alpha$ tends to 1. □

**Remark 10** (Robustness with respect to $\alpha$). The continuity of the superquantile $\alpha \mapsto \bar{q}_{\alpha}(Y)$ gives a robustness with respect to $\alpha$. Indeed, the choice of $\alpha$ may somehow be arbitrary: value $\alpha = 0.99$ may be chosen, but $\alpha = 0.9861$ is not common. The continuity allows to smooth the dependence in $\alpha$: two different but close values of $\alpha$ leads to close superquantiles. This is not the case for the quantile, as it can have very sharp discontinuities when $Y$ is bimodal for instance.

**Remark 11** (Superquantile and optimization). Because it is convex, the superquantile is a very convenient tool in optimization problems under uncertainties. One can refer to [Filippi et al., 2020] to have examples in different domains. It was introduced in [Rockafellar and Uryasev, 2000] to deal with portfolio optimization. This article is not only interested to the usage of the superquantile in optimization problems, but more specifically in reliability and safety assessment, one of its advantage over the quantile being illustrated in Figure 1.

Definition 7 now allows us to construct the following natural estimator of the superquantile from the sample $(Y_1, ..., Y_n)$.

**Definition 8** (Superquantile estimator). The estimator

$$ \hat{q}_{\alpha,n} := \min_{c \in \mathbb{R}} \phi_n(c) = \min(\phi_n(Y_1), ..., \phi_n(Y_n)), $$

with $\phi_n(c) = c + \frac{1}{1 - \alpha} \frac{1}{n} \sum_{i=1}^{n} [Y_i - c]_+$, is a natural estimator of superquantile $\bar{q}_{\alpha}(Y)$.

**Remark 12.** Let us consider a realisation $(y_1, ..., y_n)$ of the random sample $(Y_1, ..., Y_n)$. Then the superquantile estimator from Definition 8 can be seen as a superquantile of a specific discrete random variable with values in $(y_1, ..., y_n)$. Let us first consider the case where $(y_1, ..., y_n)$ are two by two distinct. Let $Z$ be a discrete random variable such that $\forall i \in \{1, ..., n\}, \mathbb{P}(Z = y_i) = \frac{1}{n}$. Then $\hat{q}_{\alpha,n}(y_1, ..., y_n) = \bar{q}_{\alpha}(Z)$. If $(y_1, ..., y_n)$ are not two by two distinct, the former result is also valid if we slightly modify the distribution of $Z$ and impose that $\mathbb{P}(Z = y_i) = \frac{k(i)}{n}$ for any $1 \le i \le n$, where $k(i)$ is the number of elements of $(y_1, ..., y_n)$ that are equal to $y_i$.

An important consequence of Remark 12 is that any theoretical result on the superquantile is expected to be valid for the estimator of Definition 7, since it is itself a particular superquantile (for another random variable).

**Remark 13.** Other estimators of the superquantile can be found in the literature. For instance, inspired by Equation (3), $\frac{1}{1-\alpha} \frac{1}{n} \sum_{i=[\alpha n]+1}^{n} Y_{(i)}$ is another estimator of the superquantile estimator, which has been studied in detail in [Labopin-Richard, 2016] (section I.1). In this paper, the estimator from Definition 8 is preferred, because of its interpretation as a superquantile (see Remark 12).

**Proposition 7** (Consistency and asymptotic normality of superquantile estimator). Let $Y \in L^1(\Omega)$ and $0 < \alpha < 1$.
(i) The bias of the superquantile estimator is negative and its absolute value is decreasing: for any $n \in \mathbb{N}$, we have $\mathbb{E}(\hat{q}_{\alpha,n}) \le \mathbb{E}(\hat{q}_{\alpha,n+1}) \le \bar{q}_{\alpha}(Y)$.

(ii) The superquantile estimator is strongly consistent.

(iii) If $Y \in L^2(\Omega)$, then $(\sqrt{n}(\hat{q}_{\alpha,n} - \bar{q}_{\alpha}))_{n \in \mathbb{N}}$ converges in distribution to $\frac{1}{1-\alpha} \inf_{q \in [q_{\alpha}, q_{\alpha}^+]} Z_q$, where $(Z_q)_{q \in \mathbb{R}}$ is a centered Gaussian process with covariance function $(q_1, q_2) \mapsto \text{Cov}([Y - q_1]_+, [Y - q_2]_+)$. As a consequence, if we further assume that $q_{\alpha}(Y) = q_{\alpha}^+(Y)$, i.e. the cardinality if $F_Y^{-1}(\{\alpha\})$ is one at the most, then the superquantile estimator is asymptotically normal: $(\sqrt{n}(\hat{q}_{\alpha,n} - \bar{q}_{\alpha}))_{n \in \mathbb{N}}$ converges in distribution to $\mathcal{N}\left(0, \frac{1}{(1-\alpha)^2} \text{Var}([Y - q_{\alpha}]_+)\right)$.

*Proof.* The properties of the superquantile estimator given by Definition 7 have been studied in [Shapiro et al., 2021] in a more general framework (chapter 5, theorems 5.4 and 5.7 and proposition 5.6). The results of Proposition 7 are direct consequences of these developments. □

**Remark 14.** Proposition 7 implies that if $Y$ has a density whose support is an interval, then, for any $0 < \alpha < 1$, the superquantile estimator is asymptotically normal, and its variance can be estimated empirically from $(Y_1, \dots, Y_n)$. On the contrary, if there exists $y_1 < y_2$ such that $F_Y(y_1) = F_Y(y_2)$, then the superquantile estimator is not asymptotically normal. This particular case will be illustrated in Figure 17a of Section 5.

## 2.3 Main $[0, 1]$-homogeneous risk measures

In this part, we now list classical $[0, 1]$-homogeneous risk measures.

### 2.3.1 Failure probability

**Definition 9 (Failure probability).** The failure probability for the threshold $s \in \mathbb{R}$ is the risk measure
$$p_s: \begin{cases} E \rightarrow [0, 1] \\ Y \mapsto \mathbb{P}(Y > s) \end{cases}.$$

The failure probability is a widely used risk measure in reliability engineering [Morio and Balesdent, 2015, Rubino and Tuffin, 2007, Lemaire, 2013, Ajenjo et al., 2023]. By construction, it depends on the choice of a threshold $s$ (whose interpretation must therefore be clearly distinguished from the level $\alpha$ introduced in Section 2.2), which may again be dictated by standards or experience feedback. Yet, there is no standard value for this threshold, and knowledge on the system under study is required for this choice.

The failure probability is monotonic. Apart from this, the failure probability respects almost none of the properties listed in Definition 2. Indeed, it is neither positively homogeneous, translation invariant, constant equivalent, risk averse, subadditive nor convex (counter-examples can be proposed using exponential laws for the positive homogeneity, the translation invariance, the constant equivalence, the risk aversion and the subadditivity).

Strictly speaking, the failure probability is also not continuous, even for the norm $L^\infty$ (a counter-example can again be found in Appendix B.4). Nonetheless, there is the following strong result of continuity.

**Proposition 8.** Let $(Y_n)_{n \in \mathbb{N}} \in E^{\mathbb{N}}$ be a sequence of random variables that converges in distribution to $Y \in E$. Then $(s \mapsto p_s(Y_n))_{n \in \mathbb{N}}$ converges almost everywhere to $s \mapsto p_s(Y)$. More precisely, if $s \mapsto p_s(Y)$ is continuous in some $s_* \in \mathbb{R}$, then $(p_{s_*}(Y_n))_{n \in \mathbb{N}}$ converges to $(p_{s_*}(Y))$.

*Proof.* Since $(Y_n)_{n \in \mathbb{N}}$ converges in distribution to $Y$, then $(F_{Y_n})_{n \in \mathbb{N}}$ converges pointwise to $F_Y$ except in the points of discontinuity of $F_Y$ [Candelpergher, 2013]. Moreover, since $F_Y$ is monotonic, its points of discontinuity are countable. □

**Definition 10 (Failure probability estimator).** Let $s \in \mathbb{R}$. The crude Monte Carlo estimator of the failure probability is given by $\hat{p}_{s,n} := \frac{1}{n} \sum_{i=1}^{n} 1_{\{Y_i > s\}}$.
**Proposition 9.** (Consistency and asymptotic normality of the failure probability estimator) Let $Y \in E$ and $s \in \mathbb{R}$.

(i) The failure probability estimator is unbiased and consistent for the $L^2$ convergence.

(ii) The failure probability estimator is strongly consistent.

(iii) The failure probability estimator is asymptotically normal: $(\sqrt{n}(\hat{p}_{s,n} - p_s))_{n \in \mathbb{N}}$ converges in distribution to $\mathcal{N}(0, p_s(1 - p_s))$.

*Proof.* Proposition 9 is mainly a direct consequence of the s.l.l.n. and the c.l.t.. A proof can be found in Appendix C.3. □

**Proposition 10.** Let $Y \in E$ and $s \in \mathbb{R}$. Then $n\hat{p}_{s,n} \sim \mathcal{B}(n, p_s(Y))$.

*Proof.* This follows directly from the fact that $(1_{\{Y_i > s\}})_{1 \le i \le n}$ are i.i.d. following a Bernoulli distribution of parameter $p_s(Y)$. □

The failure probability estimator is very convenient: it is strongly consistent and asymptotically normal, and its asymptotic variance depends only on the real failure probability, and can hence be easily estimated. But Proposition 10 also characterizes the non-asymptotic distribution of this estimator, still as a function of a single unknown parameter (the failure probability), which is rare enough to be worth mentioning. This property will play a particularly important role when we discuss decision-making in Subsection 4.4.

**Remark 15.** This crude Monte estimator of the failure probability may appear simple. Even though, the fact that its distribution is explicitly known allows to perform non-asymptotic post-processing of the results, once an estimation has been made. This is done in [Betz et al., 2022] in a bayesian framework.

**Remark 16.** There exists plenty of methods to estimate $p_s(Y)$ in a more efficient manner than its crude Monte Carlo estimator. These methods (which include, in particular, importance sampling or splitting [Morio and Balesdent, 2015, Rubino and Tuffin, 2007]) are particularly important when estimating low values of $p_s(Y)$, but in most cases require the ability to plan experiments and thus to construct the set $(Y_1, \dots, Y_n)$ in an adaptive manner. In this work, however, we limit ourselves to cases where the information available for constructing the risk measures consists of a pre-existing set of n i.i.d. copies of $Y$, which is a less favorable context for implementing these more advanced estimators.

If $F_Y$ is bijective, then $\alpha \mapsto q_\alpha(Y)$ is bijective from $(0, 1)$ to $(\inf Y, \sup Y)$, where $\inf Y := \sup \{y \in \mathbb{R} : F_Y(y) = 0\} \in \mathbb{R} \cup \{-\infty\}$ is the infimum of $Y$. Then, the following equation holds:

$$p_s(Y) = \begin{cases} 1 & \text{if } s < \inf(Y), \\ 1 - q_s^{-1}(Y) & \text{if } \inf(Y) \le s < \sup(Y), \\ 0 & \text{if } \sup(Y) \le s, \end{cases} \quad (4)$$

where $s \mapsto q_s^{-1}(Y)$ is the inverse function of $\alpha \mapsto q_\alpha(Y)$, i.e. $F_Y$.

### 2.3.2 Buffered failure probability

The failure probability is the measure of a probability of exceedance, but is not sensitive to the level of exceedance, in the sense that we do not measure the fact that the values of $Y$, when they are greater than $s$, can greatly exceed $s$ or simply remain close to $s$. In the same way that the superquantile complements the quantile, the buffered failure probability [Mafusalov and Uryasev, 2018], inspired by Equation (4) and the relation it proposes between failure probability and quantile function, goes beyond this limitation, as illustrated in Figure 2.

**Definition 11.** (Buffered failure probability) The buffered failure probability for a threshold $s \in \mathbb{R}$ is the risk measure $\bar{p}_s : L^1(\Omega) \to [0, 1]$ defined for any $Y \in L^1(\Omega)$ by

$$\bar{p}_s(Y) := \begin{cases} 1 & \text{if } s < \mathbb{E}(Y), \\ 1 - \bar{q}_s^{-1}(Y) & \text{if } \mathbb{E}(Y) \le s < \sup(Y), \\ 0 & \text{if } \sup(Y) \le s, \end{cases}$$

where $s \mapsto \bar{q}_s^{-1}(Y)$ is the inverse function of the superquantile $\alpha \mapsto \bar{q}_\alpha(Y)$.
<figure><img src="image_2.png" /><figcaption>Figure 2: PDF of two random variables that have the same failure probability but different buffered failure probabilities. The first (2a) is by construction safer than the second (2b). The area filled in green corresponds to the failure probability $p_s$ and the area filled with purple dots corresponds to the buffered failure probability $\bar{p}_s$.</figcaption></figure>

**Remark 17.** Proposition 6 guarantees that Definition 11 is well posed.

As a reformulation of Definition 11, for $\mathbb{E}(Y) < s < \sup(Y)$, we have $\bar{p}_s(Y) = 1 - \gamma$ where $0 < \gamma < 1$ is such that $\bar{q}_\gamma(Y) = s$. Hence, the buffered failure probability is more conservative than the failure probability in the sense that for any $Y \in L^1(\Omega)$ and any $s \in \mathbb{R}$, we have $p_s(Y) \le \bar{p}_s(Y)$, as illustrated in Figure 3.

<figure><img src="image_3.png" /><figcaption>Figure 3: Illustration of the definition of the buffered failure probability, in the case where $Y$ admits a PDF. The area filled in green corresponds to the failure probability $p_s$ and the area filled with purple dots corresponds to the buffered failure probability $\bar{p}_s$.</figcaption></figure>

Definition 11 can be rewritten in a more compact form, as shown in [Mafusalov and Uryasev, 2018] (proposition 2.2), as for any $Y \in L^1(\Omega)$ we have:

$$ \bar{p}_s(Y) = \inf_{c \ge 0} \mathbb{E}([c(Y - s) + 1]_+) \text{ if } s < \sup(Y). \quad (5) $$
Moreover, if $\mathbb{E}(Y) < s < \sup(Y)$, this infimum is attained in any value of $c$ in $[\frac{1}{s-q_{\alpha}(Y)}, \frac{1}{s-q_{\alpha}^{+}(Y)}]$, where $0 < \alpha < 1$ is such that $\bar{q}_{\alpha}(Y) = s$ [Mafusalov et al., 2018] (2.7). The proof of Equation (5) relies heavily on Definition 7 of the superquantile.

**Remark 18.** If $\mathbb{E}(Y) < s < \sup(Y)$ then the set of minimisers $[\frac{1}{s-q_{\alpha}(Y)}, \frac{1}{s-q_{\alpha}^{+}(Y)}]$ (where $\alpha \in (0, 1)$ is such that $\bar{q}_{\alpha} = s$) is well defined since $q_{\alpha}(Y) \le q_{\alpha}^{+}(Y) < s$. Indeed, if $s = q_{\alpha}^{+}(Y)$ then $q_{\alpha}^{+}(Y) = \bar{q}_{\alpha}(Y)$ which leads to $q_{\alpha}(Y) = \sup(Y)$ using Definition 7 and the fact that $\bar{q}_{\alpha}(Y) = \phi(q_{\alpha}^{+}(Y))$, where $\phi(c) = c + \frac{1}{1-\alpha}\mathbb{E}([Y-c]_+)$. This is not possible since $q_{\alpha}(Y) = \bar{q}_{\alpha}(Y) < \sup(Y)$.

Since the superquantile is monotonic and $\alpha \mapsto \bar{q}_{\alpha}(Y)$ is strictly increasing, the buffered failure probability is monotonic. However, once again, since it takes its value in $[0, 1]$, the buffered failure probability is neither positively homogeneous, translation invariant, constant equivalent nor risk averse. Besides, it is not subadditive either (a counter-example is given in Appendix A.3). In addition, the buffered failure probability is not convex but it is quasi-convex, as proved in [Mafusalov and Uryasev, 2018]. The buffered failure probability is not continuous in general, even for the $\|\cdot\|_{L^{\infty}}$ norm (a counter-example is given in Appendix B.5). Yet, there is a result of continuity under condition, detailed in the following proposition.

**Proposition 11.** Let $(Y_n)_{n \in \mathbb{N}} \in L^1(\Omega)^{\mathbb{N}}$ be a sequence of random variables that converges in $L^1(\Omega)$ to $Y \in L^1(\Omega)$ and such that $(\sup(Y_n))_{n \in \mathbb{N}}$ converges to $\sup(Y)$ (where these values may be infinite). Let $s \in \mathbb{R}$ such that $s \neq \mathbb{E}(Y)$ and $s \neq \sup(Y)$. Then $\bar{p}_s(Y_n) \xrightarrow{n \to +\infty} \bar{p}_s(Y)$.

*Proof.* The proof of this proposition can be found in Appendix B.5. □

The technical hypothesis of the convergence of $(\sup(Y_n))_{n \in \mathbb{N}}$ to $\sup(Y)$ is convenient for the proof. Yet it is not a necessary condition for such a result to hold. We note that if there is convergence in $L^{\infty}$ or if all the random variables considered are unbounded, then this hypothesis holds.

**Remark 19** (Robustness with respect to threshold $s$). The buffered failure probability $s \mapsto \bar{p}_s(Y)$ has at most one point of discontinuity (and this discontinuity is at $\sup(Y)$, it it exists). More precisely, it is continuous and strictly decreasing on $[\mathbb{E}(Y), \sup(Y))$. This result comes from [Mafusalov and Uryasev, 2018] (Corollary 3.2). As mentioned in Remark 10 for the superquantile, this continuity in $s$ guarantees some robustness with respect to the choice of threshold $s$. When $Y$ admits atoms, the failure probability lacks such robustness.

**Definition 12** (Buffered failure probability estimator). We consider the buffered failure probability

$$ \hat{p}_{s,n} := \min_{c \ge 0} \left( \frac{1}{n} \sum_{i=1}^{n} [c(Y_i - s) + 1]_+ \right) \quad \text{if } s < \max(Y_1, \dots, Y_n), \quad 0 \text{ otherwise.} $$

The proposed estimator of the buffered failure probability is inspired by Equation (5). Its properties are studied in [Mafusalov et al., 2018] (theorem 2.1 and remarks 1 an 2) and in [Shapiro et al., 2021] (chapter 5, theorem 5.4 and 5.7 and proposition (5.6) in a more general framework). A summary of the main results, Proposition 12 and Corollary 1, are given below.

**Proposition 12.** Let $Y \in L^1(\Omega)$ and let $s \in \mathbb{R}$.

(i) If $s > \sup(Y)$, then for any $n \in \mathbb{N}$, we have $\hat{p}_{s,n} = 0 = \bar{p}_s$ a.s.

(ii) If $s = \sup(Y)$, then the buffered failure probability estimator is consistent in probability. If we assume moreover that $\mathbb{P}(Y = \sup(Y)) = 0$, then for any $n \in \mathbb{N}$, we have $\hat{p}_{s,n} = 0 = \bar{p}_s$ a.s.

(iii) If $s < \sup(Y)$, then we have the following.

* The bias of the buffered failure probability estimator is negative and its absolute value is decreasing: for any $n \in \mathbb{N}$, we have $\mathbb{E}(\hat{p}_{s,n}) \le \mathbb{E}(\hat{p}_{s,n+1}) \le \bar{p}_s$.

* The buffered failure probability estimator is strongly consistent.

* If we assume moreover that $Y \in L^2(\Omega)$, then $(\sqrt{n}(\hat{p}_{s,n} - \bar{p}_s))_{n \in \mathbb{N}}$ converges in distribution to $\inf_{c \in S_s} Z_c$ where $(Z_c)_{c \in \mathbb{R}}$ is a centered Gaussian process with covariance function $(c_1, c_2) \mapsto \text{Cov}([c_1(Y - s) + 1]_+, [c_2(Y - s) + 1]_+)$, and $S_s$ is the set of the minimizers of (5).
**Corollary 1.** Let $Y \in L^2(\Omega)$ and $s \in \mathbb{R}$ such that $\mathbb{E}(Y) < s < \sup(Y)$. Assume that the cardinality of $F_Y^{-1}(\{1 - \bar{p}_s(Y)\})$ is at most one. Then the buffered failure probability estimator is asymptotically normal: $(\sqrt{n}(\hat{p}_{s,n} - \bar{p}_s))_{n \in \mathbb{N}}$ converges in distribution to $\mathcal{N}\left(0, \text{Var}\left(\left[1 - \frac{Y-s}{q_{1-\bar{p}_s(Y)}(Y)-s}\right]_+\right)\right)$.

*Proof.* The former corollary directly follows from Proposition 12, because in this case, Equation (5) has exactly one solution. □

There are plenty of different cases in Proposition 12. Mainly, if $p(Y = \sup(Y)) = 0$ (e.g., $Y$ admits a density or $Y$ is unbounded), then the buffered probability estimator is strongly consistent, which covers a lot of cases. The condition for the asymptotic normality is a bit more restrictive: if $\mathbb{E}(Y) < s < \sup(Y)$, then there is an asymptotic normality. The asymptotic variance has not a simple expression, and its estimation from $(Y_1, \dots, Y_n)$ may not be easy. Let us recall that the case $s > \sup(Y)$ is not problematic, because then the buffered failure probability estimator is always equal to $0 = \bar{p}_s(Y)$.

**Remark 20.** Similarly as Remark 12 for the superquantile, a realisation of the buffered probability estimator can be seen as a theoretical buffered probability of a specific discrete random variable, which is the same as in Remark 12. As a consequence, any theoretical result that we have on the superquantile can be applied to its estimator provided by Definition 8.

## 2.4 Synthesis

Tables 1 and 2 summarize the properties that are respected by the risk measures that were introduced, alongside with some properties of their estimators.

Among these risk measures, we first notice that the expectation respects almost all the properties mentioned in Definition 2, except the risk aversion. It is a relevant risk measure when the outcome of the random variable is drawn many times and when the potentiality of a huge outcome is not an issue for the decision-maker. The margin is risk averse, but loses the monotony. This lack of monotony is a severe drawback for a risk measure, since it may mislead the decision-maker. Both margin and expectation can be estimated by a strongly consistent estimator that is asymptotically normal. Moreover, the asymptotic variance is explicitly expressed in terms of the moments of $Y$. As a consequence, when estimating the expectation (respectively the margin) with a sample $(Y_1, \dots, Y_n)$, the analyst can derive an approximation of the asymptotic variance of the estimator with the same sample by also estimating $\mathbb{E}(Y^2)$ (respectively $\mathbb{E}(Y^3)$ and $\mathbb{E}(Y^4)$).

The worst-case (or supremum) respects all the properties considered. Nevertheless, its continuity is very weak, since it is only true for the $L^\infty$ convergence (see Appendix B for complementary result on the continuity of the risk measures considered). In addition, it gives the value $+\infty$ for any random variable that is not bounded almost surely (e.g. normal, exponential and geometric distribution), which may be too conservative. Hence, the worst-case appears relevant only when dealing with bounded random variables. Last, the worst-case estimator is strongly consistent, but there is no asymptotic normality.

The quantile does not verify only few of the properties considered. First, it is not rigorously continuous. However, we have a partial result of continuity for the convergence in distribution, which is a kind of weak convergence. Hence, this continuity is rather strong (see Proposition 19 in Appendix B.2 for a formal result). The lack of risk aversion is a theoretical issue, but not a practical one. Indeed, for $\alpha$ close to 1, the random variables for which their quantile of level $\alpha$ is below their expectation are degenerate cases, and may never appear in practical applications. The lack of convexity and closedness may be an issue when dealing with optimization problems. If so, the superquantile would be preferred to the quantile, as it is done in [Rockafellar and Uryasev, 2000] for instance. Otherwise, those two properties are not essential when one aims to assess the risk and not to minimize it. Moreover, the quantile lacks subadditivity. From a financial point of view, [Artzner et al., 1999] explains that dealing with a risk measure that is not subadditive would create issues in the market, since an actor could prefer to cut its capital in two different portfolios rather than having just one. However, from an industrial point of view, $Y$ does not necessarily represent an amount of money, but may be an energy, a length or a temperature for example. Hence the meaning of summing two random variables $Y_1$ and $Y_2$ depends on the context, and the interpretation of the sum of two risks may sometimes be unclear.
On the contrary, the subadditivity is crucial for [Rockafellar and Royset, 2015], since for positively homogeneous risk measures, the subadditivity is equivalent to the convexity. Hence, when dealing with industrial problems, the lack of subadditivity may not be an issue, except if one aims at minimizing the risk measure, in which case the subadditivity is opportune, since it is equivalent to the convexity for positively homogeneous risk measures. Last, the quantile estimator is strongly consistent and asymptotically normal under some conditions, but the asymptotic variance of the quantile depends on the PDF of $Y$, and is hence difficult to estimate. However, the quantile, as an order statistics, can provide non asymptotic guarantee, as it is detailed in Subsection 4.4.

The superquantile respects all the properties from Definition 2. Its continuity is associated with the $L^1$ norm. It is well defined for any random variable that admits an expectation, and hence it is more versatile than the worst-case. The superquantile is a good candidate to replace the quantile when the lack of convexity is an issue for the analyst. Moreover, as illustrated in Figure 1, it gives a better understanding of the random variable above the quantile than the quantile itself. Moreover, its estimator is consistent and asymptotically normal. As a consequence, its numerical estimation is not an issue (see Section 5 for examples of estimation on academic cases).

The failure and the buffered failure probabilities are both monotonic. Rigorously speaking, none of them are continuous. Yet a partial result of continuity can be stated for the failure probability considering the convergence in distribution, as for the buffered failure probability considering the $L^1$ convergence. Both of them are not convex, even if the buffered failure probability is quasi-convex. None of them are positively homogeneous, translation invariant, constant equivalent, risk averse nor subadditive. Concerning the numerical estimation, the failure probability estimator is easy to compute and to interpret. Moreover, it is strongly consistent and asymptotically normal without any conditions, and the asymptotic variance can be easily approximated. As for it, the consistency and asymptotic normality of the buffered failure probability rely on some conditions. For instance, it is strongly consistent if $Y$ has a PDF or is unbounded. Its asymptotic variance is not straightforward to compute. Hence, the failure probability seems to be a more convenient risk measure, from a practical point of view, in comparison with the buffered failure probability. Moreover, Subsection 4.4 details how the analyst can obtain non asymptotic guarantee when assessing the reliability of a system using the failure probability.

Failure and buffered failure probability respect almost none of the properties from Definition 2 (see Table 2). This lack of properties does not testify of a shortage of the failure and buffered failure probabilities: no [0, 1]-homogeneous risk measures can admit the positive homogeneity, the translation invariance, the constant equivalence or the risk aversion. On the contrary, it emphasizes that these properties are not adapted for such risk measures. Moreover, the failure probability is closely linked to the quantile, and the buffered failure probability is closely linked to the superquantile. The next section details and generalizes this link, in order to construct a duality between $Y$-homogeneous risk measures and [0, 1]-homogeneous risk measures.

<table><caption>Table 1: Properties of the $Y$-homogeneous risk measures (“u.c.” means under condition, “cv.” means convergence and “a.n.” means asymptotic normality).</caption><thead><tr><th></th><th>Expectation</th><th>Margin</th><th>Worst-case</th><th>Quantile</th><th>Superquantile</th></tr></thead><tbody><tr><td>Subspace considered</td><td>$L^1(\Omega)$</td><td>$L^2(\Omega)$</td><td>$L^\infty(\Omega)$</td><td>$E$</td><td>$L^1(\Omega)$</td></tr><tr><td>Monotony</td><td>yes</td><td>no</td><td>yes</td><td>yes</td><td>yes</td></tr><tr><td>Continuity</td><td>yes for $\|\cdot\|_{L^1}$</td><td>yes for $\|\cdot\|_{L^2}$</td><td>yes for $\|\cdot\|_{L^\infty}$</td><td>u.c. for cv. in distribution</td><td>yes for $\|\cdot\|_{L^1}$</td></tr><tr><td>Positive homogeneity</td><td>yes</td><td>yes</td><td>yes</td><td>yes</td><td>yes</td></tr><tr><td>Translation invariance</td><td>yes</td><td>yes</td><td>yes</td><td>yes</td><td>yes</td></tr><tr><td>Constant equivalence</td><td>yes</td><td>yes</td><td>yes</td><td>yes</td><td>yes</td></tr><tr><td>Risk aversion</td><td>no</td><td>yes</td><td>yes</td><td>no</td><td>yes</td></tr><tr><td>Subadditivity</td><td>yes</td><td>yes</td><td>yes</td><td>no</td><td>yes</td></tr><tr><td>Convexity</td><td>yes</td><td>yes</td><td>yes</td><td>no</td><td>yes</td></tr><tr><td>Strong consistency</td><td>yes</td><td>yes</td><td>yes</td><td>yes</td><td>yes</td></tr><tr><td>Condition for<br>asymptotic normality</td><td>$Y \in L^2(\Omega)$</td><td>$Y \in L^4(\Omega)$</td><td>no a.n.</td><td>$Y$ has a PDF continuous in<br>$q_\alpha$ and $f_Y(q_\alpha) > 0$</td><td>$Y \in L^2(\Omega)$</td></tr><tr><td>Asymptotic variance</td><td>Var($Y$)</td><td>$\nabla h^\top \Sigma \nabla h$</td><td>None</td><td>$\frac{\alpha(1-\alpha)}{f_Y(q_\alpha)}$</td><td>$\frac{\text{Var}([Y - q_\alpha]_+)}{(1-\alpha)^2}$</td></tr></tbody></table>
<table><caption>Table 2: Properties of the [0, 1]-risk measures ("u.c." means under condition and "cv." means convergence).</caption><thead><tr><th></th><th>Failure probability</th><th>Buffered failure probability</th></tr></thead><tbody><tr><td>Subspace considered</td><td>E</td><td>L<sup>1</sup>(Ω)</td></tr><tr><td>Monotony</td><td>yes</td><td>yes</td></tr><tr><td>Continuity</td><td>u.c. for cv. in distribution</td><td>u.c. for ||·||<sub>L<sup>1</sup></sub></td></tr><tr><td>Positive homogeneity</td><td>no</td><td>no</td></tr><tr><td>Translation invariance</td><td>no</td><td>no</td></tr><tr><td>Constant equivalence</td><td>no</td><td>no</td></tr><tr><td>Risk aversion</td><td>no</td><td>no</td></tr><tr><td>Subadditivity</td><td>no</td><td>no</td></tr><tr><td>Convexity</td><td>no</td><td>no</td></tr><tr><td>Strong consistency</td><td>yes</td><td>u.c.</td></tr><tr><td>Condition for asymptotic normality</td><td>None</td><td>Y ∈ L<sup>2</sup>(Ω), E(Y) &lt; s &lt; sup(Y) and q<sub>1-<span style="text-decoration: overline">p</span><sub>s</sub>(Y)</sub> = q<sub>1-<span style="text-decoration: overline">p</span><sub>s</sub>(Y)</sub><sup>+</sup></td></tr><tr><td>Asymptotic variance</td><td>p<sub>s</sub>(1 - p<sub>s</sub>)</td><td>Var(<span style="text-decoration: overline">[1 - <div style="display: inline-block; vertical-align: middle; text-align: center;"><div style="border-bottom: 1px solid black; padding: 0 0.2em;">Y - s</div><div style="padding: 0 0.2em;">q<sub>1-<span style="text-decoration: overline">p</span><sub>s</sub></sub> - s</div>]</span><sub>+</sub></span>)</td></tr></tbody></table>

## 3 Duality of risk measures and decision-making

A risk measure taken in isolation has limited meaning: its operational value lies in the comparison between random variables it enables. This can be used in optimization problems, or in decision-making ones. We focus here on the latter. In practice, decision-making involves the comparison between the value of a risk measure applied to a random variable of interest Y and a threshold s. For instance, one might declare a system sufficiently safe if $R(Y) \le s$, where $R(Y)$ is a chosen risk measure and s reflects an acceptable safety threshold.

This simple criterion is widely used, but both its interpretation and robustness strongly depend on the nature of the risk measure and the choice of the threshold. Since these thresholds are often defined regarding either regulatory, physical, or economic considerations, it becomes crucial to understand how different risk measures relate to one another when used for the same decision task.

In this section, we highlight a key insight: when formulated as decision criteria with thresholds, several seemingly distinct risk measures become equivalent. For example, we will show that deciding whether a quantile is below a threshold is equivalent to checking if a failure probability is below a corresponding level; similarly, superquantile-based decisions can be reformulated in terms of buffered failure probabilities. These equivalences suggest the existence of a deeper structural relationship between the two introduced categories of risk measures, those homogeneous to the quantity of interest Y (e.g., quantile, superquantile), which yield thresholds in the same unit as Y, and those homogeneous to a probability in [0, 1] (e.g., failure probability, buffered failure probability), which yield thresholds interpretable as confidence or risk levels. We formalize this observation by introducing a notion of duality between these two classes of risk measures. For each Y-homogeneous risk measure, we define an associated dual risk measure that is [0, 1]-homogeneous, and vice versa. This duality is constructed through their shared decision criterion: both risk measures, though different in form, induce the same accept/reject decision for a well-chosen threshold.

This dual structure not only clarifies the interpretation of different risk measures, but also provides a way to move between formulations depending on the context—whether one prefers working with quantiles or probabilities, physical units or confidence levels.

### 3.1 Dual risk measure of a Y-homogeneous risk measure

The formalism of this section is intended to be as general as possible. We thus assume that we have access to a family of Y-homogeneous risk measures, which is noted $R := (R_\alpha(Y))_{0<\alpha<1}$, which is
defined on a subspace V, and which is parameterised by $\alpha \in (0, 1)$. The parameter $\alpha$ characterizes a level of conservatism: for any $Y \in V$, the greater $\alpha$, the greater the risk measure $\mathcal{R}_{\alpha}(Y)$. In other words, we focus in this Section on families of risk measures $(\mathcal{R}_{\alpha}(Y))_{0<\alpha<1}$ that are increasing in $\alpha$, that is to say verifying $\mathcal{R}_{\alpha}(Y) \le \mathcal{R}_{\beta}(Y)$ for any $Y \in V$ and any $\alpha \le \beta$. The quantile and the superquantile are two examples of risk measures that verify this property.

**Definition 13** (Dual risk measure). The dual risk measure of $(\mathcal{R}_{\alpha})_{0<\alpha<1}$ is the family of $[0, 1]$-homogeneous risk measures $\mathcal{P} := (\mathcal{P}_s)_{s \in \mathbb{R}}$ defined for all $Y \in V$ and all $s \in \mathbb{R}$ by $\mathcal{P}_s(Y) = 1 - \mathcal{R}_Y^{-1}(s)$ where $\mathcal{R}_Y^{-1}(s) := \sup \{\alpha \in (0, 1) : \mathcal{R}_{\alpha}(Y) \le s\}$ is a generalised inverse of $\alpha \mapsto \mathcal{R}_{\alpha}(Y)$ (under the convention that $\sup \emptyset = 0$).

The interest of the dual risk measure then relies on the following Proposition.

**Proposition 13.** Let $Y \in V$ be a random variable. If $\alpha \mapsto \mathcal{R}_{\alpha}(Y)$ is left-continuous then

$$ \forall (\alpha, s) \in (0, 1) \times \mathbb{R}, \quad \mathcal{R}_{\alpha}(Y) \le s \iff \mathcal{P}_s(Y) \le 1 - \alpha. \qquad (6) $$

*Proof.* The proof of this proposition can be found in Appendix D.1. □

Hence, provided we have chosen a couple $(\alpha, s)$ composed of $0 < \alpha < 1$ a level of conservatism and $s \in \mathbb{R}$ a threshold, a decision made on the basis of the Y-homogeneous risk measure $\mathcal{R}$ is equivalent to one we would made relying on its dual $[0, 1]$-homogeneous risk measure $\mathcal{P}$. The value $1 - \alpha$ can be called an acceptable risk, since the system is considered safe if the dual risk measure is lesser or equal to this acceptable risk. Note that the technical assumption of the left-continuity of the risk measure with respect to $\alpha$ is not so restrictive. Indeed, the quantile is left-continuous in $\alpha$ and the superquantile is continuous in $\alpha$ (this follows from Equation (2)). The margin respects these properties as well, from the moment where parameter $\lambda$ becomes an increasing and left-continuous function $\alpha \mapsto \lambda(\alpha)$ from $[0, 1]$ to $\mathbb{R}^+$, and where the margin is now indexed by $\alpha$ so that $\text{mgn}_{\alpha}(Y) := \mathbb{E}(Y) + \lambda(\alpha)\sigma(Y)$.

Finally, once this continuity property is verified, it is possible to express any Y-homogeneous risk measure in terms of its dual $[0, 1]$-homogeneous risk measure.

**Proposition 14** (Y-homogeneous risk measure from its dual risk measure). Let $\mathcal{R} = (\mathcal{R}_{\alpha})_{0<\alpha<1}$ be a family of Y-homogeneous risk measures defined on a subspace V and increasing with respect to $\alpha$. We assume that for all $Y \in V$ the function $\alpha \mapsto \mathcal{R}_{\alpha}(Y)$ is left-continuous. Let $(\mathcal{P}_s)_{s \in \mathbb{R}}$ be the dual risk measure of $\mathcal{R}$. Then for all $Y \in V$ and all $0 < \alpha < 1$, we have $\mathcal{R}_{\alpha}(Y) = \inf \{s \in \mathbb{R} : 1 - \alpha \ge \mathcal{P}_s(Y)\}$.

*Proof.* The proof can be found in Appendix D.3. □

According to Proposition 14, if we have a family of $[0, 1]$-homogeneous risk measures $(\tilde{\mathcal{P}}_s)_{s \in \mathbb{R}}$ defined on a subspace V, and which is decreasing with respects to $s$, we can therefore construct the family $(\tilde{\mathcal{R}}_{\alpha})_{0<\alpha<1}$ of Y-homogeneous risk measures defined for all $Y \in V$ and all $0 < \alpha < 1$ by $\tilde{\mathcal{R}}_{\alpha}(Y) = \inf \{s \in \mathbb{R} : 1 - \alpha \ge \tilde{\mathcal{P}}_s(Y)\}$. If, for any $Y \in V$, $s \mapsto \tilde{\mathcal{P}}_s$ is right-continuous, then equivalence (6) is verified between $\tilde{\mathcal{P}}$ and $\tilde{\mathcal{R}}$ (the proof uses exactly the same idea as the proof of equivalence (6)). As a consequence, using Remark 21, we conclude that $\tilde{\mathcal{P}}$ is indeed the dual risk measure of $\tilde{\mathcal{R}}$.

**Remark 21** (Unicity of the dual risk measure). If $(\tilde{\mathcal{P}}_s)_{s \in \mathbb{R}}$ is a family of $[0, 1]$-homogeneous risk measures such that (6) holds, then $\tilde{\mathcal{P}}$ is the dual risk measure of $\mathcal{R}$. Indeed, for any $Y \in V$ and any $s \in \mathbb{R}$, we have $\sup \{\alpha \in (0, 1) : \mathcal{R}_{\alpha}(Y) \le s\} \le 1 - \tilde{\mathcal{P}}_s(Y) \le \inf \{\alpha \in (0, 1) : \mathcal{R}_{\alpha}(Y) > s\}$, and the result follows since $\mathcal{R}$ is increasing so that the two bounds in the inequality are equal (with the convention that $\inf \emptyset = 1$ and $\sup \emptyset = 0$).

In Subsection 2.1 we have listed several desirable properties for a risk measure. Those properties where linked to random variable Y. Now we have introduced an other parameter for a risk measure, which can be either a level of conservatism $\alpha \in (0, 1)$ for Y-homogeneous risk measures, or a threshold $s \in \mathbb{R}$ for $[0, 1]$-homogeneous risk measures, we can also look at the potential properties of the risk measures with respect to this parameter. For instance, we already mention the monotony of $\alpha \mapsto \mathcal{R}_{\alpha}$, which is a desirable property, as the greater the threshold and the more the number of acceptable configurations increases.
**Proposition 15.** Let $Y \in V$ be a random variable. If $\alpha \mapsto \mathcal{R}_\alpha(Y)$ is left-continuous, then $s \mapsto \mathcal{P}_s(Y)$ is decreasing and right-continuous.

*Proof.* The proof of the monotony can be found in Appendix D.2. As for the right-continuity, it uses the same idea as the proof of the left-continuity of the quantile $\alpha \mapsto q_\alpha(Y)$. □

We can then cite another desirable property for families of risk measures regarding their limits.

**Definition 14 (Existence and identifiability of limits).** We consider the following properties: for all $Y \in V$ (with $V \subset L^1(\Omega)$ for the first limit),

$$ \lim_{\alpha \to 0} \mathcal{R}_\alpha(Y) = \mathbb{E}(Y) \quad \text{and} \quad \lim_{\alpha \to 1} \mathcal{R}_\alpha(Y) = \sup(Y). \qquad (7) $$

Definition 14 means that the less conservative risk measure of the considered family is the expectation, $\mathbb{E}(Y)$, and that the most conservative one is the worst-case $\sup(Y)$ (which can be infinite). The superquantile possesses these two properties, and the quantile only possesses the second. The margin, as introduced in the upcoming Subsection 3.2 with $\lambda(0) = 0$, respects the first but not necessarily the second property.

## 3.2 Duality examples

### 3.2.1 Quantile and failure probability.

The dual risk measure of the quantile is the failure probability. This comes from Remark 21 and the fact that $q_\alpha(Y) \le s \iff \alpha \le F_Y(s)$. Note that the convention on the failure probability with a strict inequality is needed to obtain this result. Indeed, with this convention, we have $p_s(Y) = 1 - F_Y(s)$.

This duality is illustrated in Figure 4: it is equivalent to compute the failure probability $p_s(Y)$ and then compare it to $1 - \alpha$ (following the green pass in Figure 4), and to compute the quantile $q_\alpha(Y)$ and then to compare it to threshold $s$ (following the red pass in Figure 4).

<figure><img src="image_4.png" /><figcaption>Figure 4: Illustration of the duality between the quantile and the failure probability.</figcaption></figure>

### 3.2.2 Superquantile and buffered failure probability.

The dual risk measure of the superquantile is the buffered failure probability as both Definitions 11 and 13 coincide in this case. This is illustrated in Figure 5, meaning the two following processes are equivalent:

* find $\gamma$ such that $\bar{q}_\gamma(Y) = s$, compute the buffered failure probability $\bar{p}_s(Y) = 1 - \gamma$ and then compare it to $1 - \alpha$ (following the green pass in Figure 5);

* compute the superquantile $\bar{q}_\alpha(Y)$, then compare it the threshold $s$ (following the red pass in Figure 5).
<figure><img src="image_5.png" /><figcaption>Figure 5: Illustration of the duality between the superquantile and the buffered failure probability.</figcaption></figure>

### 3.2.3 Margin and its dual

Let $\lambda: [0, 1) \to \mathbb{R}^+$ be a strictly increasing and left-continuous function. For $0 < \alpha < 1$ and $Y \in L^2(\Omega)$, the family of margins $(\text{mgn}_\alpha(Y))_{0<\alpha<1}$ can be defined so that for all $0 < \alpha < 1$, $\text{mgn}_\alpha(Y) := \mathbb{E}(Y) + \lambda(\alpha)\sigma(Y)$. The choice of the function $\lambda$ depends on the importance of the standard-deviation in the margin definition. Level $\alpha$ plays the role of a level of conservatism: the greater $\alpha$, the more conservative is the margin. Then, it is straightforward to verify that the dual risk measure of the margin is the risk measure $\mathcal{P}^{\text{mgn}} = (\mathcal{P}_s^{\text{mgn}})_{s \in \mathbb{R}}$ defined for all $s \in \mathbb{R}$ and all $Y \in L^2(\Omega)$ by:

$$ \mathcal{P}_s^{\text{mgn}}(Y) = \begin{cases} 1 & \text{if } s < \mathbb{E}(Y) + \sigma(Y) \inf \lambda, \\ 1 - \lambda^{-1} \left( \frac{s - \mathbb{E}(Y)}{\sigma(Y)} \right) & \text{if } \mathbb{E}(Y) + \sigma(Y) \inf \lambda \le s < \mathbb{E}(Y) + \sigma(Y) \sup \lambda, \\ 0 & \text{if } \mathbb{E}(Y) + \sigma(Y) \sup \lambda \le s, \end{cases} \quad (8) $$

where $\lambda^{-1}$ is the inverse function of $\lambda$, and $\inf \lambda$ and $\sup \lambda$ are respectively the infimum and supremum of the function $\lambda$ on $[0, 1)$. We propose to call *margin-dual* this dual risk measure of the margin.

For instance, we can consider the function $\lambda: \alpha \mapsto -\ln(1-\alpha)$. This particular case allows the margin to take values in $[\mathbb{E}(Y), +\infty[$, as illustrated in Figure 6a. Therefore, for any $(\alpha, s) \in (0, 1) \times \mathbb{R}$ and any $Y \in L^2(\Omega)$, we have:

$$ \text{mgn}_\alpha(Y) = \mathbb{E}(Y) - \ln(1 - \alpha)\sigma(Y) \text{ and } \mathcal{P}_s^{\text{mgn}}(Y) = \begin{cases} 1 & \text{if } s < \mathbb{E}(Y), \\ \exp\left(-\frac{s-\mathbb{E}(Y)}{\sigma(Y)}\right) & \text{if } \mathbb{E}(Y) \le s. \end{cases} \quad (9) $$

<figure><img src="image_6.png" /><figcaption>(a) Margin with respect to level $\alpha$.</figcaption></figure>

<figure><img src="image_7.png" /><figcaption>(b) Margin-dual with respect to threshold $s$.</figcaption></figure>

<caption>Figure 6: Margin and its dual risk measure for the case (9) ($\lambda: \alpha \mapsto -\ln(1-\alpha)$).</caption>
If $\lambda$ is continuous and if $Y \in L^2(\Omega)$ is such that $\sigma(Y) > 0$, then $s \mapsto \mathcal{P}_s^{\text{mgn}}(Y)$ is continuous as well. If $\sigma(Y) = 0$ then $s \mapsto \mathcal{P}_s^{\text{mgn}}(Y)$ is not continuous since for all $s \in \mathbb{R}$, we have $\mathcal{P}_s^{\text{mgn}}(Y) = \mathbb{1}_{\{s < \mathbb{E}(Y)\}}$.

We can then look at the relevant properties from Definition 2 for the margin-dual. We just consider the continuity, the subadditivity and the convexity as all the other properties are already discussed in Section 3.1. To begin, it can be seen that the margin-dual is neither subadditive nor convex in general (some partial counter-examples can be found in Appendix A.4). For the continuity, if we assume that $\lambda$ is continuous, if $(Y_n)_{n \in \mathbb{N}} \in L^2(\Omega)^{\mathbb{N}}$ is a sequence of random variables that converges to some $Y \in L^2(\Omega)$ for the $L^2$ convergence, and if $Y$ is not almost surely constant, then for any $s \in \mathbb{R}$, the margin-dual $(\mathcal{P}_s^{\text{mgn}}(Y_n))_{n \in \mathbb{N}}(s)$ converges to $\mathcal{P}_s^{\text{mgn}}(Y)$. If $Y = c$ a.s. then for any $s \neq c$, the margin-dual $(\mathcal{P}_s^{\text{mgn}}(Y_n))_{n \in \mathbb{N}}(s)$ converges to $\mathcal{P}_s^{\text{mgn}}(Y)$. A proof can be found in Appendix B.6.

**Remark 22.** For the three considered $[0, 1]$-homogeneous risk measures (failure probability, buffered failure probability and margin-dual), we notice that the continuity with respect to $Y$ in some $Y_*$ is directly linked to the continuity of $s \mapsto \mathcal{P}_s(Y_*)$. Indeed, if $(\mathcal{P}_s)_{s \in \mathbb{R}}$ is the family of risk measures associated with the failure probability (respectively, with the margin-dual), and if $(Y_n)_{n \in \mathbb{N}}$ is a sequence of random variables that converges to $Y_*$ in $L^2(\Omega)$ (respectively in distribution), then, for any $s_* \in \mathbb{R}$, if $s \mapsto \mathcal{P}_s(Y_*)$ is continuous in $s_*$, then $(\mathcal{P}_s(Y_n))_{n \in \mathbb{N}}$ converges to $\mathcal{P}_s(Y_*)$. However, this result is false if we do not assume that $s \mapsto \mathcal{P}_s(Y_*)$ is continuous in $s_*$. For the buffered failure probability, this result may hold, but it is not proven yet.

In the same manner as for the margin, the margin-dual can be estimated from $(Y_1, ..., Y_n)$ using estimators of the expectation and of the standard-deviation of $Y$, as defined below.

**Definition 15** (Margin-dual estimator). Let $\lambda: [0, 1) \to \mathbb{R}_+$ be a strictly increasing function. We consider the following estimator of the margin-dual:

$$ \widehat{\mathcal{P}}_{s,n}^{\text{mgn}} := \begin{cases} 1 & \text{if } s < \bar{Y}_n + \sigma_n \inf \lambda, \\ 1 - \lambda^{-1} \left( \frac{s-\bar{Y}_n}{\sigma_n} \right) & \text{if } \bar{Y}_n + \sigma_n \inf \lambda \le s < \bar{Y}_n + \sigma_n \sup \lambda, \\ 0 & \text{if } \bar{Y}_n + \sigma_n \sup \lambda \le s, \end{cases} $$

where $\bar{Y}_n$ and $\sigma_n$ are respectively the estimators of the expectation and the standard-deviation introduced in Definition 4.

For instance, if $\lambda: \alpha \mapsto -\ln(1-\alpha)$, then the estimator is $\widehat{\mathcal{P}}_{s,n}^{\text{mgn}} = \exp\left(-\frac{s-\bar{Y}_n}{\sigma_n}\right)$ if $s \ge \bar{Y}_n$ and 1 otherwise.

**Proposition 16** (Consistency and asymptotic normality of the margin-dual estimator). Let us assume that $\lambda$ is defined by $\lambda(\alpha) = -\ln(1-\alpha)$.

(i) If $Y \in L^2(\Omega)$, then the margin-dual estimator is strongly consistent.

(ii) Assume that $Y \in L^4(\Omega)$. If $s > \mathbb{E}(Y)$, then the margin-dual estimator is asymptotically normal: $(\sqrt{n}(\widehat{\mathcal{P}}_{s,n}^{\text{mgn}} - \mathcal{P}_s^{\text{mgn}}))_{n \in \mathbb{N}}$ converges in distribution to $\mathcal{N}(0, \sigma_{\widehat{\mathcal{P}}_{s,n}^{\text{mgn}}}^2)$, where $\sigma_{\widehat{\mathcal{P}}_{s,n}^{\text{mgn}}}^2 := \nabla h(\mathbb{E}(Y), \mathbb{E}(Y^2))^{\top} \Sigma \nabla h(\mathbb{E}(Y), \mathbb{E}(Y^2))$. In this, function $h$ is defined by

$$ h(m_1, m_2) = \exp\left(-\frac{s-m_1}{\sqrt{m_2-m_1^2}}\right) \quad \text{and} \quad \Sigma := \begin{bmatrix} \mathbb{E}(Y) & \text{Cov}(Y, Y^2) \\ \text{Cov}(Y, Y^2) & \mathbb{E}(Y^2) \end{bmatrix}. $$

*Proof.* As with the margin, the proof of Proposition 16 relies on the c.l.t. and on the delta-method. A proof can be found in Appendix C.4. □

Using the definition of $\lambda$ proposed in Equation (9), we thus see that the margin-dual estimator is strongly consistent and asymptotically normal (under some conditions on the statistical moments of $Y$). The restriction to the case (9) is not an obstacle to the extension of the result, and other choices for function $\lambda$ could lead to the same type of asymptotic results, provided that $\lambda$ is continuous and that $s \mapsto \mathcal{P}_s^{\text{mgn}}(Y)$ is continuous as well. As with the margin, the asymptotic variance of the margin-dual can be explicitly computed in terms of the moments $\mathbb{E}(Y^i)$ for $i \in \{1, 2, 3, 4\}$. Indeed, $\nabla h(\mathbb{E}(Y), \mathbb{E}(Y^2)) = \left(\frac{1}{\sigma(Y)}\left(1 - \mathbb{E}(Y)\frac{s-\mathbb{E}(Y)}{\sigma(Y)^2}\right)\exp\left(-\frac{s-\mathbb{E}(Y)}{\sigma(Y)}\right), \frac{s-\mathbb{E}(Y)}{2\sigma(Y)^3}\exp\left(-\frac{s-\mathbb{E}(Y)}{\sigma(Y)}\right)\right)^{\top}$. As a consequence, this asymptotic variance can be easily estimated.
## 3.3 Dual properties

Some of the properties of Definition 2 are not relevant for [0, 1]-homogeneous risk measures. The dual construction of a [0, 1]-homogeneous risk measure from a Y-homogeneous risk measure invites us to propose dual properties for those defined in Definition 2. The dual property of a property (Prop) is a property (PropDual) such that for all family of risk measures ($R_\alpha(Y))_{0<\alpha<1}$ defined on a subspace V and increasing with respect to $\alpha$, we have:

$$ \{\forall \alpha \in (0,1), Y \mapsto R_\alpha(Y) \text{ respects } (Prop)\} \iff \{(P_s)_{s \in \mathbb{R}} \text{ respects } (PropDual)\}, \quad (10) $$

where $P$ is the dual risk measure of $R$. This means that a risk measure respects a property if and only if its dual risk measure respects the dual property.

**Proposition 17** (Dual properties of some properties from Definition 2). Let $(R_\alpha(Y))_{0<\alpha<1}$ be a family of risk measures defined on a subspace V and increasing with respect to $\alpha$. We denote by $P$ its dual risk measure. We have the following dual properties:

1. (Dual of monotony). For all $s \in \mathbb{R}$ and $(Y_1, Y_2) \in V^2$ such that $Y_1 \le Y_2$ a.s., then $P_s(Y_1) \le P_s(Y_2)$.

3. (Dual of positive homogeneity). For all $Y \in V$, $s \in \mathbb{R}$ and $\lambda > 0$, we have $P_{\lambda s}(\lambda Y) = P_s(Y)$.

4. (Dual of translation invariance). For all $Y \in V$, $s \in \mathbb{R}$ and $c \in \mathbb{R}$, we have $P_{s+c}(Y+c) = P_s(Y)$.

5. (Dual of constant equivalence). If $Y \in V$ and $c \in \mathbb{R}$ are such that $Y = c$ a.s., then for all $s \in \mathbb{R}$, we have $P_s(Y) = 1_{\{s<c\}}$.

6. (Dual of risk aversion). For all $Y$ that is not constant almost surely, then for any $s \le E(Y)$, we have $P_s(Y) = 1$.

*Proof.* The proof can be found in Appendix D.4. □

It is worth commenting on these new dual properties. To begin, we see that the dual of the monotony is the monotony itself: if a risk measure is monotonic then its dual risk measure is monotonic as well. This is illustrated by the quantile and the superquantile. The dual properties of the positive homogeneity, the translation invariance, the constant equivalence and the risk aversion have already been pointed out in [Mafusalov and Uryasev, 2018] (section 3.2) for the case of the buffered failure probability. The interpretation of these properties is the same as the one made in Subsection 2.1, since they are equivalent to the properties from Definition 2.

The dual properties of the continuity, the subadditivity, the convexity and the closedness are less clear to formulate. Moreover, those properties are relevant to consider even for risk measures that are homogeneous to a probability. Hence, we will not propose a formalism of the dual of these four properties.

Finally, the dual of the properties for the limits that are introduced in Definition 14 can be written in the following form (see Appendix D.4 for the proof):

* the dual of $\lim_{\alpha \to 0} R_\alpha(Y) = E(Y)$ is: for all $s \in \mathbb{R}$, if $s < E(Y)$, then $P_s(Y) = 1$, and if $s > E(Y)$, then $P_s(Y) < 1$,

* The dual of $\lim_{\alpha \to 1} R_\alpha(Y) = \sup(Y)$ is: for all $s \in \mathbb{R}$, if $s > \sup(Y)$, then $P_s = 0$, and if $s < \sup(Y)$, then $P_s(Y) > 0$.

## 3.4 Synthesis

The main message of this section is that it is important to clearly distinguish between Y-homogeneous risk measures and [0, 1]-homogeneous risk measures. Those two categories can not be associated with the same mathematical properties. Even if monotony, continuity, subadditivity, convexity and closedness are relevant properties for both categories, it is clear that positive homogeneity, translation invariance, constant equivalence and risk aversion are not relevant for [0, 1]-homogeneous risk measures.
For such risk measures, the dual properties detailed in Subsection 3.3 should be used instead. Table 3 summarizes which properties are respected by the considered [0, 1]-risk measures (when relevant, it is the dual properties that are presented rather than the initial properties).

Finally, all of these properties can be represented graphically in Figure 7, which helps us to visually compare the introduced risk measures with respect to these properties.

<table><caption>Table 3: Properties of [0, 1]-homogeneous risk measures ("u.c." means under condition and "cv." means convergence). Properties that are not relevant for such risk measures are replaced by their dual formulations detailed in Proposition 17.</caption><thead><tr><th></th><th>Margin-dual-probability</th><th>Failure probability</th><th>Buffered failure probability</th></tr></thead><tbody><tr><td>Subspace considered</td><td>L<sup>2</sup>(Ω)</td><td>E</td><td>L<sup>1</sup>(Ω)</td></tr><tr><td>Monotony</td><td>no</td><td>yes</td><td>yes</td></tr><tr><td>Continuity</td><td>u.c. for cv. ||·||<sub>L<sup>2</sup></sub></td><td>u.c. for cv. in distribution</td><td>u.c. for cv. ||·||<sub>L<sup>1</sup></sub></td></tr><tr><td>Dual of the positive homogeneity</td><td>yes</td><td>yes</td><td>yes</td></tr><tr><td>Dual of the translation invariance</td><td>yes</td><td>yes</td><td>yes</td></tr><tr><td>Dual of the constant equivalence</td><td>yes</td><td>yes</td><td>yes</td></tr><tr><td>Dual of the risk aversion</td><td>yes</td><td>no</td><td>yes</td></tr><tr><td>Subadditivity</td><td>no</td><td>no</td><td>no</td></tr><tr><td>Convexity</td><td>no</td><td>no</td><td>no</td></tr><tr><td>Strong consistency</td><td>yes</td><td>yes</td><td>u.c.</td></tr><tr><td>Condition for asymptotic normality</td><td>Y ∈ L<sup>4</sup>(Ω) and s > E(Y)</td><td>None</td><td>Y ∈ L<sup>2</sup>(Ω), E(Y) &lt; s &lt; sup(Y) and q<sub>1-<span style="text-decoration: overline">p</span><sub>s</sub>(Y)</sub> = q<sub>1-<span style="text-decoration: overline">p</span><sub>s</sub>(Y)</sub><sup>+</sup></td></tr><tr><td>Asymptotic variance</td><td>∇h<sup>&top;</sup>Σ∇h</td><td>p<sub>s</sub>(1 - p<sub>s</sub>)</td><td>Var( [1 - <div style="display: inline-block; vertical-align: middle; text-align: center;"><div style="border-bottom: 1px solid black; padding: 0 0.2em;">Y - s</div><div style="padding: 0 0.2em;">q<sub>1-<span style="text-decoration: overline">p</span><sub>s</sub></sub> - s</div></div>)</td></tr></tbody></table>

The second important message of this section is that two dual risk measures lead to the same conclusions when used in a decision-making context. In both cases, the *analyst* or the *decision-maker* has to choose a threshold $s \in \mathbb{R}$ that should not be reached, a level of conservatism $0 < \alpha < 1$ (or an acceptable risk $1 - \alpha$), and a $Y$-homogeneous risk measure $\mathcal{R}_\alpha(Y)$ (or its dual [0, 1]-homogeneous risk measure $\mathcal{P}_s(Y)$). With these notations, the system can then be labeled as safe (in the sense that the risk of an incident is sufficiently small) if $\mathcal{R}_\alpha(Y) \le s$, or equivalently if $\mathcal{P}_s(Y) \le 1 - \alpha$. In particular, this means that it is equivalent to work with the quantile or the failure probability, with the superquantile or the buffered failure probability, and with the margin or the margin-dual. Thus, for decision-making purposes, the analyst should not choose between all the risk measures, but only between $Y$-homogeneous risk measures, or between [0, 1]-homogeneous risk measures.

# 4 Practical statistical decision-making criterion

## 4.1 Limitations of the theoretical formalism in decision-making

Let us assume that $Y \in V$ is a scalar random variable that is assumed to be representative of the state of an industrial system under study, and that the risk associated with this system can be analyzed through the choice of a threshold $s \in \mathbb{R}$, an acceptable risk $1 - \alpha \in (0, 1)$, and the dual families of risk measures $(\mathcal{R}_\alpha)_{0<\alpha<1}$ and $(\mathcal{P}_s)_{s \in \mathbb{R}}$ so that $\alpha \mapsto \mathcal{R}_\alpha(Z)$ is left-continuous for any $Z \in V$.

Given these notations, an important point to note from the above discussions is that the decision criteria presented at the end of Section 3 are defined in terms of *true* risk measures. We can therefore refer to them as *theoretical* criteria and write them in the following form.

**Criterion 1 (Theoretical).** The system is safe if $\mathcal{R}_\alpha(Y) \le s \iff \mathcal{P}_s(Y) \le 1 - \alpha$.

In practice, such decision criteria are of little use because the true values of the risk measures are unfortunately not directly accessible when the available information is limited to a finite set $(Y_1, \dots, Y_n)$. In this case, the only quantities that can be manipulated to make a decision will be the estimators of these risk measures, which will require a reformulation of these decision criteria.
<figure><img src="image_8.png" /><figcaption>Figure 7: Graphical representation of the properties that are respected by the risk measures considered. A corner is reached by the color associated to a risk measure if and only if the corresponding property holds. The gray nodes labeled "distrib", "$L^1$" and "$L^2$" correspond to the different types of convergence that arise and the gray node labeled "quasi-convexity" corresponds to the quasi-convexity. The term homogeneity regroups the positive homogeneity, the translation invariance and the constant equivalence.</figcaption></figure>

## 4.2 From decision criteria on risk measures to decision criteria on risk measures estimators

Driven by the limitations of decision criteria defined on true risk measures, this section aims at extending the theoretical decision-criterion 1 to make it more appropriate for decision making when the maximal information is a finite set of $n$ i.i.d. copies of $Y$. In this section, $Y$ denotes the random variable studied, whereas $Z \in V$ denotes an arbitrary random variable ($Z$ may be a free variable for instance).

For any $Z \in V$, we note $(Z_n)_{n \in \mathbb{N}}$ such i.i.d. samples where each element of the sample has the same law as $Z$. For any $n \in \mathbb{N}$, we then denote by $\hat{\mathcal{R}}_{\alpha,n}(Z)$ (respectively $\hat{\mathcal{P}}_{s,n}(Z)$) an estimator of $\mathcal{R}_{\alpha}(Z)$ (respectively $\mathcal{P}_s(Z)$) using the sample $(Z_1, ..., Z_n)$. We assume that for any $Z \in V$, the estimators of $\mathcal{R}_{\alpha}(Z)$ and $\mathcal{P}_s(Z)$ satisfy the following property:

$$ \alpha \mapsto \hat{\mathcal{R}}_{\alpha,n}(Z) \text{ is almost surely increasing and } s \mapsto \hat{\mathcal{P}}_{s,n}(Z) \text{ is almost surely decreasing.} \quad (11) $$

At last, we write $V_{\text{unsafe}} := \{Z \in V : \mathcal{R}_{\alpha}(Z) > s\}$ the set of unsafe random variable with respect to Criterion 1.

Let us remind that $(Y_1, ..., Y_n)$ is the maximum information available for decision-making. A first naive practical decision criterion would be to check if $\hat{\mathcal{R}}_{\alpha,n}(Y) \le s$. But this criterion is clearly insufficient. Indeed, if $\mathcal{R}_{\alpha}(Y)$ is greater than $s$ but close to this threshold, $Y \in V_{\text{unsafe}}$ (it should be labeled as unsafe). However, for values of $n$ that are not too large, it is entirely reasonable to assume that this system can be labeled as safe with a probability that is closer to $1/2$ as $\mathcal{R}_{\alpha}(Y)$ approaches $s$, as illustrated in Figure 8a. It is quite conceivable that such a behavior of the decision criterion would be difficult to accept for any safety authority. To avoid this kind of situation, the risk measure estimator can be penalized, as is done in the following criterion.

**Criterion 2 (Safety factor-based).** The system is considered safe for the security factor $\eta > 0$ if $\hat{\mathcal{R}}_{\alpha,n}(Y) + \eta \le s$.
The addition of the security factor η allows to avoid, to a certain extent, the unwanted behaviour described above. This is illustrated in Figure 8b. The choice of η is crucial: a too small η would not avoid the unwanted behaviour described above, whereas a too big η would be likely to label safe systems as unsafe. The question of choosing this value for η will be at the heart of the discussions held in the Section 4.3.

<figure><img src="image_9.png" /><figcaption>(a) Illustration of the naive criterion. The blue curve represents the PDF of $\hat{R}_{\alpha,n}(Y)$. Even if $Y \in V_{\text{unsafe}}$, there is a high probability that is it labeled as safe.</figcaption></figure>

<figure><img src="image_10.png" /><figcaption>(b) Illustration of Criterion 2. The blue curve represents the PDF of $\hat{R}_{\alpha,n}(Y) + \eta$, and the dotted blue line the value of $R_{\alpha}(Y) + \eta$. The addition of the security factor η allows to reduce the probability that the system is labeled as safe.</figcaption></figure>

<caption>Figure 8: Illustration of a naive practical decision criterion and of Criterion 2 for an unsafe system. The threshold s (plain black line) and the real risk measure $R_{\alpha}(Y)$ (dashed blue line) are represented. The distribution of the estimator $\hat{R}_{\alpha,n}(Y)$ is assumed to be Gaussian and centered in $R_{\alpha}(Y)$. The area filled in red represents the probability that the system is labeled as safe with the criterion considered.</caption>

Similarly, the naive practical decision $\hat{P}_{s,n}(Y) \le 1 - \alpha$ is insufficient, and the following penalized decision criterion can be introduced, with the same motivation as for Criterion 2.

**Criterion 3 (Safety factor-based).** The system is considered safe for the security factor $\delta \in (0, 1 - \alpha)$ if $\hat{P}_{s,n}(Y) + \delta \le 1 - \alpha$.

In Section 3, a duality framework on risk measure has been detailed. It is nevertheless interesting to note that this duality does not imply that the two penalized criteria 2 and 3 are equivalent. In fact, the safety factors η and δ play different roles: the first modifies the threshold, while the second modifies the acceptable risk, and linking these two factors is anything but obvious. Nevertheless, if we assume (this should be examined on a case-by-case basis by further specifying the risk measures considered) that the duality framework is still valid for the estimators, in the sense that for any $Z \in V$, if estimators $\hat{R}_{\alpha',n}(Z)$ and $\hat{P}_{s',n}(Z)$ are computed with the same sample ($Z_1, ..., Z_n$), we still have almost surely:

$$ \forall (\alpha', s') \in (0, 1) \times \mathbb{R}, \quad \hat{R}_{\alpha',n}(Z) \le s' \iff \hat{P}_{s',n}(Z) \le 1 - \alpha', \quad (12) $$

we obtain the following two equivalences almost surely:

$$ \hat{R}_{\alpha,n}(Y) \le s - \eta \iff \hat{P}_{s-\eta,n}(Y) \le 1 - \alpha, \quad \hat{R}_{\alpha+\delta,n}(Y) \le s \iff \hat{P}_{s,n}(Y) + \delta \le 1 - \alpha. \quad (13) $$

This assumption of duality of estimators then implies that decision criteria 2 and 3 are equivalent, respectively, to the decision criteria 4 and 5 defined below.

**Criterion 4 (Safety factor-based).** The system is considered safe for the security factor $\eta > 0$ if $\hat{P}_{s-\eta,n}(Y) \le 1 - \alpha$.

**Criterion 5 (Safety factor-based).** The system is considered safe for the security factor $\delta \in (0, 1 - \alpha)$ if $\hat{R}_{\alpha+\delta,n}(Y) \le s$.

The remaining questions are therefore: (i) How to choose the value of η and δ? (ii) Is one of these two criteria (2 or 3) better than the other? The following subsection proposes a formalism to answer to the first question. Subsection 4.4 then shows, in the case of the quantile and failure probability as risk measures, that one criterion may be much more appropriate than another for practical decision making.
## 4.3 Generic framework for practical decision-making

We would like to guarantee that the probability of labeling as safe a system that is not is always below some $\beta \in (0, 1)$. Hence, $1 - \beta$ could be called a *confidence level*. This has already been studied in [Perrin et al., 2024] for Criterion 3 for the case of the failure probability and in an asymptotic framework. Here, we aim at developing this approach in a non-asymptotic framework.

Using the convention that $\inf \emptyset = +\infty$, we therefore define $\eta_*(\alpha, s, \beta, n) \in [0, +\infty]$ by:

$$ \eta_*(\alpha, s, \beta, n) := \inf \left\{ \eta > 0 : \sup_{Z \in V_{\text{unsafe}}} \mathbb{P}(\hat{\mathcal{R}}_{\alpha,n}(Z) + \eta \le s) < \beta \right\}, \quad (14) $$

and $\delta_*(\alpha, s, \beta, n) \in [0, 1 - \alpha]$ by:

$$ \delta_*(\alpha, s, \beta, n) := \inf \left\{ \delta > 0 : \sup_{Z \in V_{\text{unsafe}}} \mathbb{P}(\hat{\mathcal{P}}_{s,n}(Z) + \delta \le 1 - \alpha) < \beta \right\}. \quad (15) $$

According to this formalism, rather than specifying a value for the safety factor, which can be very difficult to do in practice, we propose to focus on the introduction of a confidence level, and by solving problems 14 or 15, the associated safety factors $\eta_*(\alpha, s, \beta, n)$ and $\delta_*(\alpha, s, \beta, n)$ are deduced. This leads to the two following *confidence level-based* criteria.

**Criterion 6 (confidence level-based).** The system is considered safe at a confidence level $1 - \beta$ if $\mathcal{R}_{s,n}(Y) + \eta_*(\alpha, s, \beta, n) < s$.

**Criterion 7 (confidence level-based).** The system is considered safe at the confidence level $1 - \beta$ if $\hat{\mathcal{P}}_{s,n}(Y) + \delta_*(\alpha, s, \beta, n) < 1 - \alpha$.

**Remark 23.** Note that there is a strict inequality in Criteria 6 and 7, whereas the inequality is large in Criteria 2 and 3. This difference stems from the fact that imposing a large inequality in Criteria 2 and 3 allows the equivalence from Equation 13 to hold, when the strict inequality in Criteria 6 and 7 enables to obtain the result of Theorem 1.

**Theorem 1.** If $Y \in V_{\text{unsafe}}$, then $\mathbb{P}(\hat{\mathcal{R}}_{\alpha,n}(Y) + \eta_*(\alpha, s, \beta, n) < s) \le \beta$ and $\mathbb{P}(\hat{\mathcal{P}}_{s,n} + \delta_*(\alpha, s, \beta, n) < 1 - \alpha) \le \beta$.

*Proof.* The proof of Theorem 1 can be found in Appendix E.1. □

In other words, the probability that Criterion 8 (respectively Criterion 6) labels the system as safe when it should not (because $Y$ is in $V_{\text{unsafe}}$), is bounded by $\beta$ from above. In other words, both criterion 6 and 7 give the desired safety guarantee, and the result is a *priori* non-asymptotic as the safety factor depends on $n$, and should thus hold even for small sample sizes. However, it is also possible that we obtain $\eta_*(\alpha, s, \beta, n) = +\infty$ (or respectively $\delta_*(\alpha, s, \beta, n) = 1 - \alpha$). In such cases, due to conservatism and risk aversion, Criterion 6 (respectively Criterion 7) would label any $Z \in V$ as unsafe, and the decision criterion would become useless. This behaviour can happen for instance when the sample size $n$ is too low compared to $1/\alpha$, or when the confidence level $1 - \beta$ is too high. But this behaviour may also happen for arbitrarily huge sample size, as we will see in Subsection 4.4.

As a summary of the proposed approach for decision-making in a context of reliability, we propose the two following algorithms, which are respectively associated with Criterion 6 and 7.

**Algorithm 1 (Decision-making approach with Criterion 6 or 7).**

(i) Choose a threshold $s$, an acceptable risk $1 - \alpha$, a confidence level $1 - \beta$ and a sample size $n$.

(ii) Compute $\eta_*(\alpha, s, \beta, n)$ (or $\delta_*(\alpha, s, \beta, n)$).

(iii) If $\eta_*(\alpha, s, \beta, n) < +\infty$ (or if $\delta_*(\alpha, s, \beta, n) < 1 - \alpha$):

* Draw an i.i.d. sample $(Y_1, ..., Y_n)$ of the same law as $Y$.

* Compute $\hat{\mathcal{R}}_{\alpha,n}(Y)$ (or $\hat{\mathcal{P}}_{s,n}(Y)$) using the sample $(Y_1, ..., Y_n)$.

* Use Criterion 6 (or 7).
Else the system cannot be considered as safe with sufficient confidence.

In Algorithm 1, the difficulty we have not focused on much so far concerns step (ii) and the computation of $\eta_*(\alpha, s, \beta, n)$ or $\delta_*(\alpha, s, \beta, n)$. The possibility that those quantities are degenerated has already been discussed above. But even when $\eta_*(\alpha, s, \beta, n) < +\infty$, or respectively $\delta_*(\alpha, s, \beta, n) < 1-\alpha$, these quantities may not be calculable. In this case, obtaining upper bounds of those quantities may be sufficient. Indeed, if we have an upper bound $\bar{\eta} > \eta_*(\alpha, s, \beta, n)$, then the statistical guarantee is still verified (the same applies for an upper bound of $\bar{\delta} \in (\delta_*(\alpha, s, \beta, n), 1-\alpha)$). By using an upper bound instead $\eta_*(\alpha, s, \beta, n)$ or $\delta_*(\alpha, s, \beta, n)$, we increase the conservatism of decision-making, and more safe systems are likely to be labeled as unsafe.

In exactly the same way as we did for the case based on safety factors, insofar as the risk measure estimators verify the duality property defined by Equation (12), we can introduce the following two new decision criteria.

**Criterion 8 (confidence level-based).** The system is considered safe at a confidence level $1-\beta$ if there exists $\eta > \eta_*(\alpha, s, \beta, n)$ such that $\hat{P}_{s-\eta,n}(Y) \le 1-\alpha$.

**Criterion 9 (confidence level-based).** The system is considered safe at a confidence level $1-\beta$ if there exists $\delta \in (\delta_*(\alpha, s, \beta, n), 1-\alpha)$ such that $\hat{R}_{\alpha+\delta,n}(Y) \le s$.

Using Equation (12), one can prove that those two criteria are respectively equivalent to Criteria 6 and 7. This is stated and proved in Appendix E.1. Hence, the analyst can use the one he prefers, without any change in the conclusion and the statistical guarantee.

To summarize this subsection, two different criteria for decision making have been expressed: Criteria 6 and 7. Both of them provide a non-asymptotic guarantee, as stated in Theorem 1, and can be expressed equivalently with a dual criterion (Criteria 8 and 9). However, those criteria may be degenerate, or no easily applicable in practice due to the non-trivial calculation of $\eta_*(\alpha, s, \beta, n) < +\infty$ and $\delta_*(\alpha, s, \beta, n) < 1-\alpha$. The next subsection details the application of those criteria when the risk measures considered are the quantile and the failure probability.

## 4.4 Application on quantile and failure probability

The purpose of this section is to apply the generic framework defined in Section 4.3 to the case where the Y-homogeneous risk measure considered is the quantile. In this case, it is reminded that the dual $[0, 1]$-homogeneous risk measure is the failure probability.

If we focus on the empirical estimators of these two risk measures, which are defined respectively in Definitions 6 and 10, we first see that the monotony assumptions defined by Equation (11) and the duality equivalence defined by Equation (12) are verified by these estimators, as shown in Lemma 1.

**Lemma 1.** For any $Z \in E$, any $\alpha' \in (0, 1)$ and any $s' \in \mathbb{R}$, we have almost surely

$$ \hat{q}_{\alpha',n}(Z) \le s' \iff \hat{p}_{s',n}(Z) \le 1-\alpha', $$

provided that $\hat{q}_{\alpha',n}(Z)$ and $\hat{p}_{s',n}(Z)$ are computed using the same sample $(Z_1, \dots, Z_n)$.

*Proof.* We have almost surely $\hat{q}_{\alpha',n}(Z) \le s'$ if and only if the cardinality of $\{1 \le i \le n : Z_i \le s'\}$ is greater or equal to $[\alpha'n]$, i.e. $n-n\hat{p}_{s',n}(Z) \ge [\alpha'n]$. Since $n-n\hat{p}_{s',n}(Z)$ is an integer, this is equivalent to $n-n\hat{p}_{s',n}(Z) \ge \alpha'n$, i.e. $\hat{p}_{s',n}(Z) \le 1-\alpha'$. $\square$

This means that the formalism from Subsection 4.3 can be applied in the case of the couple quantile/failure probability when using these two estimators. In particular, since the probability distribution of $\hat{p}_{s,n}(Z)$ is explicit for any $Z \in V$ in the sense that $n\hat{p}_{s,n}(Z) \sim \mathcal{B}(n, p_s(Z))$, where $\mathcal{B}$ is the binomial distribution, we can show (see Appendix E.2 for the details) that

$$ \delta_*(\alpha, s, \beta, n) = 1 - \alpha - \frac{1}{n}q_{\beta}(\mathcal{B}(n, 1-\alpha)), \qquad (16) $$

where $q_{\beta}(\mathcal{B}(n, 1-\alpha))$ denotes the quantile of level $\beta$ of a binomial distribution of parameters $(n, 1-\alpha)$. As a consequence, Criterion 7 can be reformulated in that case as follows.
**Criterion 10.** The system is considered safe at a confidence level $1 - \beta$ if

$$ \hat{p}_{s,n}(Y) < \frac{1}{n} q_{\beta}(\mathcal{B}(n, 1 - \alpha)). $$

Using Criterion 10, the probability that a system represented by Y is labeled as safe can thus be explicitly expressed, as shown in Proposition 18.

**Proposition 18.** The probability that the system represented by Y is labeled as safe is

$$ \mathbb{P}\left(\hat{p}_{s,n}(Y) < \frac{1}{n} q_{\beta}(\mathcal{B}(n, 1 - \alpha))\right) = F_{\mathcal{B}(n,p_s(Y))}(q_{\beta}(\mathcal{B}(n, 1 - \alpha)) - 1), $$

where $F_{\mathcal{B}(n,p_s(Y))}$ is the CDF of a binomial distribution of parameters $(n, p_s(Y))$.

*Proof.* Almost surely, $\hat{p}_{s,n}(Y) < \frac{1}{n} q_{\beta}(\mathcal{B}(n, 1 - \alpha))$ is equivalent to $n\hat{p}_{s,n}(Y) < q_{\beta}(\mathcal{B}(n, 1 - \alpha))$. Since both terms in the latter are integers, this is equivalent to $n\hat{p}_{s,n}(Y) \le q_{\beta}(\mathcal{B}(n, 1 - \alpha)) - 1$. The result follows, since $n\hat{p}_{s,n}(Y) \sim \mathcal{B}(n, p_s(Y))$. □

Because of Theorem 1 (but also of Proposition 18 that uses the same ideas and applies them directly to this particular risk measure), if $Y \in V_{\text{unsafe}}$, then the probability that Criterion 10 labels (incorrectly) the system as safe is bounded by $\beta$, which was the desired property of the decision criterion. This is illustrated in Figure 9, which plots this probability of labeling the system as safe with respect to the true failure probability $p_s(Y)$: when $p_s(Y)$ is above the acceptable risk $1 - \alpha$, the probability that Y is labeled as safe is bounded by $\beta$. We can see from this figure that the larger $n$ is, the closer we get to an ideal decision criterion, i.e., one labeling a safe system as safe with probability 1 and an unsafe system as safe with probability 0. This figure also illustrates that Criterion 10 leads by construction to the labeling of a potentially non-negligible number of safe systems as unsafe, especially when $n$ is small and when $p_s(Y)$ is lower to $1 - \alpha$ but close to this acceptable risk.

<figure><img src="image_11.png" /><figcaption>Figure 9: Representation of the probability that the system is labeled as safe according to Criterion 10, with respect to its failure probability $p_s(Y)$. The probability is computed for $\beta = 0.1$, $\alpha = 0.95$ and several values of the sample size $n$. When $p_s(Y) > 1 - \alpha$, the probability that the system is labeled as safe is indeed below $\beta$, as stated in Theorem 1.</figcaption></figure>
Figures 10, 11 and 12 then represent the variation of the upper bound $\frac{1}{n}q_\beta(B(n, 1-\alpha))$ from Criterion 10, which is called security bound in the following to distinguish it from the quantity $\delta_*(\alpha, s, \beta, n)$ that was called security factor, with respect to the three parameters $1-\alpha$, $\beta$ and $n$. In all these figures, it is reminded that only random variables whose failure probability estimators are below this security bound are labeled as safe. This threshold can be compared to the $1-\alpha$ threshold, which defines the acceptable risk relative to the true (but inaccessible in practice) value of the probability of failure. When $\beta < 50\%$, i.e., when the priority is to minimize the number of unsafe systems that could be labeled as safe, this security bound is expected to be less than $1-\alpha$, and the distance between this bound and $1-\alpha$ is supposed to characterize the analyst's risk aversion.

Several observations can be made from these curves. Focusing on Figure 10, we first see that the security bound is piece-wise constant with respect to $1-\alpha$, with amplitude jumps of $1/n$, and globally tends to follow the first bisector linked to acceptable risk $1-\alpha$, being further away from this line when the value of $\beta$ is small. On the contrary, the higher the value of $n$, the closer this security bound approaches this first bisector, reflecting, as expected, a reduced need to take a margin as the amount of available information increases.

The curves shown in Figure 11 are consistent with these observations, in the sense that the security bound is again piecewise constant, but this time with respect to $\beta$, still with jumps of $1/n$. Furthermore, the security bound increases with $\beta$, which was again to be expected, since increasing $\beta$ means accepting that the system will be misclassified as safe more often when it should not. For $\alpha = 0.99$ and $n = 100$, we also see that this security bound is always equal to zero, which seems to indicate that either $\beta$, $n$ or $1-\alpha$ is too small in order to make an informed decision. We will return to this case in Remark 24.

At last, Figure 12 represents this security bound with respect to sample size $n$. If we limit ourselves to observing the general trends of these curves, we see that the security bound does indeed increase with $n$, while also being greater as $\beta$ increases: the more information there is, the more detailed our decisions can be. Nevertheless, and this is particularly true in case $\alpha = 0.99$, it turns out that this evolution of the security bound is not strictly increasing, in the sense that slight local oscillations are visible for this evolution. This non-monotony is not intuitive, but can be interpreted, and it will be explained in more detail in Remark 25.

<figure><img src="image_12.png" /><figcaption>Figure 10: Security bound from Criterion 10 with respect to the acceptable risk $1-\alpha$. Each figure corresponds to a different sample size, and in each figure, several values of $\beta$ are represented. The gray line corresponds to the value of $1-\alpha$, which is the theoretical acceptable risk.</figcaption></figure>

**Remark 24.** In Subsection 4.3, we mentioned the possibility of Criterion 7 to label all systems as unsafe. This is the case for Criterion 10, when $q_\beta(B(n, 1-\alpha)) = 0$, which is equivalent to $F_{B(n,1-\alpha)}(0) \ge \beta$, i.e. $n \le \frac{\ln \beta}{\ln \alpha}$. As a consequence, Criterion 10 is non-degenerated if and only
<figure><img src="image_13.png" /><figcaption>Figure 11: Security bound from Criterion 10 with respect to $\beta$. Each figure corresponds to a different value of $\alpha$, and in each figure, several sample sizes are represented. The gray line corresponds to the value of $1 - \alpha$, which is the theoretical acceptable risk.</figcaption></figure>

<figure><img src="image_14.png" /><figcaption>Figure 12: Security bound from Criterion 10 with respect to the sample size. Each figure corresponds to a different value of $\alpha$, and in each figure, several values of $\beta$ are represented. The gray line corresponds to the value of $1 - \alpha$, which is the theoretical acceptable risk.</figcaption></figure>
if $n > \frac{\ln \beta}{\ln \alpha}$, which allows us to introduce a first lower bound for n for a non-trivial decision-making. This is visible in Figure 10 for n = 100 and n = 1000: if $1 - \alpha$ is too small, the security bound from Criterion 10 is equal to 0, meaning that the criterion is degenerated. In the same manner, in Figure 12 for $\alpha = 0.99$: for too small sample sizes, the security bound is equal to 0.

**Remark 25.** Even though it may seem surprising, the security bound $\frac{1}{n}q_{\beta}(\mathcal{B}(n, 1 - \alpha))$ is actually not increasing in the sample size n, as illustrated in Figure 12. Indeed, this behavior arises from the discrete nature of the binomial distribution: $n \mapsto q_{\beta}(\mathcal{B}(n, 1 - \alpha))$ is an increasing piece-wise constant function, while $n \mapsto \frac{1}{n}$ is decreasing. This leads to an unexpected situation: there are a countable number of values of n that are more interesting than others for specific values of $\beta$ and $1 - \alpha$, because they allow the value of the security bound to be maximized locally, thereby allowing a greater number of safe systems to be labeled as safe, while ensuring the same error rate (controlled by $\beta$) for incorrectly labeling the system as safe.

**Remark 26 (Connection with Wilks' quantile).** As explained in Section 4.2, it is possible to propose a dual decision criterion to Criterion 9, which would no longer focus on the failure probability estimator but on the quantile estimator. This criterion is written (see Appendix E.2 for the details) in the following form:

**Criterion 11.** Under the convention that $Y_{(n+1,n)} = +\infty$ (where $Y_{(n+1,n)}$ would be the n + 1 largest value of a sample of size n), the system is considered safe at the confidence level $1 - \beta$ if $Y_{(k_{*}(\alpha,s,\beta,n),n)} \le s$, where

$$k_{*}(\alpha, s, \beta, n) := n - q_{\beta}(\mathcal{B}(n, 1 - \alpha)) + 1.$$

When Y has a density, the estimator $Y_{(k_{*}(\alpha,s,\beta,n),n)}$ from Criterion 11 corresponds exactly to what is commonly referred to as Wilks' quantile [Wilks, 1941] (more details are again provided in Appendix E.2). This is not a surprise because the Wilks' quantile framework was introduced to provide an estimator of the quantile that voluntary overestimates (on average) the true quantile $q_{\alpha}(Y)$ to better control the risk of having an estimator smaller than this quantile. In that case, Criterion 11 thus amounts at computing a Wilks' quantile and comparing it to the threshold s.

In Section 4.2, we showed that the Criteria 10 and 11 are equivalent. However, we clearly stated that these two criteria were not equivalent to Criterion 6, which proposes adding the safety factor not at the acceptable risk level $1 - \alpha$, but rather at the threshold level s. Although interesting at first glance, this last criterion proves unsuitable in the case of the failure probability/quantile pair of risk measures. Indeed, it appears that this criterion is almost always degenerated in the sense that $\eta_{*}(\alpha, s, \beta, n) = +\infty$ in many cases when $0 < \beta < \frac{1}{2}$. For ease of reading, we have placed this entire discussion, which again may not be intuitive at first glance, in Appendix E.2.

To summarize this section, when applied to the quantile and the failure probability, Criterion 7 appears to be fully operational, and it is reformulated in a way that is easy to use in this case in Criterion 10. Moreover, when Y admits a PDF, it is interesting to notice that this criterion is equivalent to a criterion based on a Wilks' quantile. On the contrary, Criterion 6 does not seem appropriate for this choice of risk measures. Note however that it is possible that this advantage of one criterion over the other may no longer be true for other pairs of risk measures.

## 4.5 Towards an application to other risk measures

One of the two decision-making frameworks from Subsection 4.3 has been successfully applied to the quantile and failure probability. It would then be interesting to see to what extent this formalism can be applied to other risk measures already introduced, such as for the pairs superquantile/buffered failure probability and margin/margin-dual. Indeed, these two pairs of risk measures have estimators that are monotonic in $\alpha$ according to the definition given in Equation (11), and that are dual to each other as shown in Lemmas 2 and 3.

**Lemma 2.** For any $Z \in E$, any $\alpha' \in (0, 1)$ and any $s' \in \mathbb{R}$, we have almost surely

$$\hat{q}_{\alpha',n}(Z) \le s' \iff \hat{p}_{s',n}(Z) \le 1 - \alpha',$$

provided that $\hat{q}_{\alpha',n}(Z)$ and $\hat{p}_{s',n}(Z)$ are computed using the same sample $(Z_1, ..., Z_n)$.
*Proof.* The result follows from the duality equivalence (6) and from Remarks 12 and 20, which state that the estimators of the superquantile and of the buffered failure probability correspond almost surely to one particular superquantile and one particular buffered failure probability for a same discrete random variable. □

**Lemma 3.** For any $Z \in E$, any $\alpha' \in (0, 1)$ and any $s' \in \mathbb{R}$, we have almost surely

$$ \widehat{\text{mgn}}_{\alpha',n}(Z) \leq s' \iff \hat{P}_{s',n}(Z) \leq 1 - \alpha', $$

provided that $\widehat{\text{mgn}}_{\alpha',n}(Z)$ and $\hat{P}_{s',n}(Z)$ are computed using the same sample $(Z_1, ..., Z_n)$.

*Proof.* The same arguments as the ones for the proof of Lemma 2 also work here. □

However, the explicit computation of $\eta_*(\alpha, s, \beta, n)$ or $\delta_*(\alpha, s, \beta, n)$ is not easy in these two cases because, unlike in the case of the quantile, the probability distributions of the estimators of the superquantile and the margin are not explicit in a non-asymptotic framework. Besides, in favorable cases where a Gaussian asymptotic behavior result is available, these distributions rely on parameters that are difficult to manipulate in order to extract reasonable bounds for $\eta_*(\alpha, s, \beta, n)$ or $\delta_*(\alpha, s, \beta, n)$. Therefore, the construction of such approximations or bounds for $\eta_*(\alpha, s, \beta, n)$ and $\delta_*(\alpha, s, \beta, n)$ is left as a work perspective for this work.

# 5 Numerical experiments

In Section 2, several estimators were presented, alongside with their asymptotic properties, and in Subsection 4.4, a practical decision-making framework was introduced. The purpose of this section is to illustrate the extent to which these estimators and the associated decision-making process can be used in practice, on analytical examples first, then on a realistic flood model.

## 5.1 Presentation of the test cases

Four different test cases are presented in this section. Three of them are academic cases, and are proposed to illustrate the asymptotic properties of the estimators. The numerical experiments are shown in Subsection 5.2. The last test case is a flood model, and it is used to illustrate the decision- framework from Subsection 4.4. The associated numerical results are provided in Subsection 5.3.

The three first academic cases are chosen to illustrate different aspects of the behaviour of the estimators of the introduced risk measures.

(i) Case 1 (Gaussian case). For this first example, $Y \sim \mathcal{N}(0, 1)$. This simple case aims at studying the behaviour of the estimators when random variable $Y$ has a very smooth PDF, and when $Y \in L^q(\Omega)$ for any $q \in [1, +\infty)$.

(ii) Case 2 (Pareto case). For the second example, $Y$ follows a Pareto distribution $\mathcal{P}(a, k)$ with parameters $a$ and $k$, so that its PDF is defined by $f_Y(y) = k \frac{a}{y^{k+1}} \mathbb{1}_{y \geq a}$. This distribution is called an heavy-tailed distribution, because the PDF does not decrease enough to have $Y \in L^q(\Omega)$ for any $q$. More precisely, if $Y \sim \mathcal{P}(a, k)$, where $k \in \mathbb{N}^*$, then $\mathbb{E}(|Y|^k) = +\infty$. This test case illustrates the behaviour of the estimators in this heavy-tailed situation.

(iii) Case 3 (Switch case). The third case is a counter-example test case. It aims at emphasizing a situation where some of the estimators are not asymptotically normal. It relies on a switch on - switch off distribution, defined by $Y = a$ with probability $1-p$ and $Y \sim \mathcal{U}([-1, 1])$ with probability $p$, where $a \leq -1$ and $0 < p < 1$. Its distribution is illustrated in Figure 17.

Table 4 summarizes the parameters chosen for the different test cases, as well as the exact values of the risk measures considered. The parameters for the switch test case (iii) have been chosen so that the assumption for the asymptotic normality of Proposition 3, 7 and Corollary 1 are not verified.

The last test case is the flood model provided in the OpenTURNS package [Baudin et al., 2017]. This model represents a river and a dyke protecting industrial facilities. Eight random outputs are considered, including for instance flow rate, river width, river length, altitude of river bank and height
<figure><img src="image_15.png" /><figcaption>(a) Illustration of the distribution for Case 3. The blue line between -1 and 1 represents the uniform behaviour, with a weight $p$. The vertical blue line in $a$ represents the discrete behaviour, with weight $1-p$.</figcaption></figure>

<figure><img src="image_16.png" /><figcaption>(b) CDF of the switch test case.</figcaption></figure>

<table><caption>Figure 13: Illustration of the distribution of $Y$ for the third test case (iii).</caption><thead><tr><th>Test cases</th><th>Parameters</th><th>α</th><th>s</th><th>Margin</th><th>Quantile</th><th>Superquantile</th><th>Margin-dual</th><th>Failure probability</th><th>Buffered failure probability</th></tr></thead><tbody><tr><td>(i) Normal</td><td>Standard</td><td>0.95</td><td>2</td><td>3.00</td><td>1.64</td><td>2.06</td><td>0.135</td><td>0.0228</td><td>0.0580</td></tr><tr><td>(ii) Pareto</td><td>a = 1; k = 3</td><td>0.99</td><td>4</td><td>5.49</td><td>4.46</td><td>6.96</td><td>0.0558</td><td>0.0156</td><td>0.0527</td></tr><tr><td>(iii) Switch</td><td>a = -2; p = 0.05</td><td>0.95</td><td>0</td><td>-0.538</td><td>-2</td><td>0</td><td>0.0153</td><td>0.025</td><td>0.05</td></tr></tbody></table>

<caption>Table 4: Table of the parameters used in the academic test cases, and of the theoretical values of the risk measures considered. The latter are calculated analytically. See Appendix F for more precise results.</caption>

of the dyke. All those variables are modeled as random variables to account for uncertainties. The aim of the study is to assess the risk of the occurrence of a flood, that is when the altitude of the water $Z_c$ becomes greater than the altitude of the dyke $Z_d$, i.e. $Z_c - Z_d \ge 0$. The flood model is illustrated in Figure 14.

<figure><img src="image_17.png" /><figcaption>(a) River bank, without the dyke.</figcaption></figure>

<figure><img src="image_18.png" /><figcaption>(b) Section of the river and river bank, with the dyke.</figcaption></figure>

<caption>Figure 14: Illustration of the flood model from OpenTURNS (source: [OpenTURNS, 2024]).</caption>

More precisely, the study aims at deciding if a high dyke or a low dyke should be installed. Using the framework from Subsection 4.4, we consider $Y = Z_c - Z_d$ with a threshold $s = 0$. Indeed, the situation $Y > s$ correspond to a flood, and this is what should be avoided. As a consequence, we want to guarantee that $p_f(Y) := p_0(Y) < 1 - \alpha$ where $1 - \alpha$ is the acceptable risk chosen. This is equivalent to $q_\alpha(Y) < 0$. The confidence level $1 - \beta$ and the sample size $n$ have to be chosen as well, knowing that there might be budget restriction on the sample size $n$, and that the condition $n > \frac{\ln \beta}{\ln \alpha}$ from Remark 24 should be respected to have a non-degenerated decision criterion.

This flood model is tested with two sets of parameters for $(\alpha, s, \beta, n)$, as summarized in Table 5. Parameter $1 - \alpha$ corresponds to the acceptable probability of flood, whereas $1 - \beta$ is the confidence level from Theorem 1. Parameter $n$ is the sample size used in the study. The first set of parameters, called *lax parameter set*, corresponds to a situation where the acceptable risk is not too low and the sample size is not high either. The second set of parameters, called *conservative parameter set*, corresponds to a situation with much more restrictive parameters, and a higher sample size. Moreover, for each set
of parameters, two scenarios are studied: a first where the height of the dyke is low and a second where the height of the dyke is high. The study aims at deciding if a high dyke is necessary to guarantee the safety according to the set of parameters chosen. Since this flood model is a toy test case, we already know the exact failure probability $p_f(Y) = P(Y > 0)$ [OpenTURNS, 2024]. This failure probability is provided in Table 6.

<table><caption>Table 5: Table of parameters used in the flood model test case for the application of the practical decision-making framework.</caption><thead><tr><th>Parameter set</th><th>α</th><th>β</th><th>n</th><th>s</th></tr></thead><tbody><tr><td>Lax</td><td>0.95</td><td>0.001</td><td>200</td><td>0</td></tr><tr><td>Conservative</td><td>1 - 5.10<sup>-4</sup></td><td>10<sup>-5</sup></td><td>3.10<sup>4</sup></td><td>0</td></tr></tbody></table>

<table><caption>Table 6: Flood probability depending on the scenario.</caption><thead><tr><th>Scenario</th><th>Flood probability p<sub>f</sub>(Y)</th></tr></thead><tbody><tr><td>Dyke is low</td><td>7.3 × 10<sup>-4</sup></td></tr><tr><td>Dyke is high</td><td>7.6 × 10<sup>-5</sup></td></tr></tbody></table>

## 5.2 Behaviour of the estimators

We present here the results of the estimation of the risk measures considered in the article, using the estimators already defined in Definitions 4, 6, 8, 15, 10 and 12 (note that for the margin, we always use the case from Equation (9)). Figures 15, 16 and 17 are histograms that have been constructed using 500 repetitions of the estimation for each sample size. For instance, for the quantile of the normal distribution, we simulate $n \times 500$ samples of a normal distribution, and we use the $n$ first samples to compute a first estimation of the quantile, and the $n$ following samples to compute a second estimation of the quantile, and so on until we have 500 independent realizations of the quantile estimator. The scripts developed for these simulations are available in the repository RiskMeasure<fnref n="1" />.

In Figure 15, when $Y$ is Gaussian, all six risk measures are well estimated. Moreover, even with a small sample size $n = 100$, the normal asymptotic behaviour seems to be reached, except for the failure probability where the behaviour is highly discrete. These graphs also show the conservative nature of the superquantile and buffered failure probability compared to the quantile and the failure probability. It is remarkable that the variance of the superquantile estimator is approximately equal to the variance of the quantile estimator, and that the variance of the buffered failure probability estimator is not much higher than the one of the failure probability estimator. This advocates for adopting these advanced risk measures which capture finer information about the risk presented by the distribution tail.

Figure 16, where $Y$ follows a Pareto distribution, gives other conclusions. Indeed, in this case, $Y \notin L^3(\Omega)$ and the asymptotic normality of the margin and the margin-dual estimators (Propositions 2 and 16) does not hold. In Figure 16b, the spreading of the margin-dual estimator does not decrease as quickly as for the two other estimators. Moreover, the margin and margin-dual estimators may give outputs much higher than the value to be estimated. In this case, the asymptotic behaviour for the quantile, superquantile, failure probability and buffered failure probability estimator does not seem to be reached for $n = 100$, but only from $n = 1000$. Here, the variance of the superquantile estimator, respectively the buffered failure probability estimator, is greater than the one of the quantile estimator, respectively the failure probability estimator. This is expected as well, since both superquantile and buffered failure probability need some regularity ($Y \in L^1(\Omega)$) to be defined.

Figure 17, where $Y$ has a *switch on - switch off* distribution, seeks to highlight the fact that the asymptotic behaviour of the proposed estimators is not necessarily Gaussian. This is what we observe, with the exception of the margin, the margin-dual and the failure probability estimators, whose dispersions appear to approach Gaussian distributions from $n = 1000$. Indeed, in this case,

<footnote n="1">¹https://github.com/MarieTemple-Boyer/RiskMeasure</footnote>
<figure><img src="image_19.png" /><figcaption>(a) (Y-homogeneous risk measures). The first line (in blue) corresponds to the margin, the second (in green) to the quantile and the third (in orange) to the superquantile.</figcaption></figure>

<figure><img src="image_20.png" /><figcaption>(b) ([0, 1]-homogeneous risk measures). The first line (in blue) corresponds to the margin-dual, the second (in green) to the failure probability and the third (in orange) to the buffered failure probability.</figcaption></figure>

Figure 15: (Normal distribution (i)). Histograms of the estimation of several risk measures in the case (ii) where Y follows a normal distribution. Each column corresponds to different sample sizes *n*. In each histogram, the theoretical value of the risk measure considered is represented by a vertical dotted line. When the estimator is asymptotically normal, the asymptotic PDF is drawn as well in solid line.
<figure><img src="image_21.png" /><figcaption>(a) (Y-homogeneous risk measures). The first line (in blue) corresponds to the margin, the second (in green) to the quantile and the third (in orange) to the superquantile.</figcaption></figure>

<figure><img src="image_22.png" /><figcaption>(b) ([0, 1]-homogeneous risk measures). The first line (in blue) corresponds to the margin-dual, the second (in green) to the failure probability and the third (in orange) to the buffered failure probability.</figcaption></figure>

Figure 16: (Pareto distribution (ii)). Histograms of the estimation of several risk measures in the case (i) where Y follows a Pareto distribution. Each column corresponds to different sample sizes *n*. In each histogram, the theoretical value of the risk measure considered is represented by a vertical dotted line. When the estimator is asymptotically normal, the asymptotic PDF is drawn as well in solid line.
<figure><img src="image_23.png" /><figcaption>(a) (Y-homogeneous risk measures). The first line (in blue) corresponds to the margin, the second (in green) to the quantile and the third (in orange) to the superquantile.</figcaption></figure>

<figure><img src="image_24.png" /><figcaption>(b) ([0, 1]-homogeneous risk measures). The first line (in blue) corresponds to the margin-dual, the second (in green) to the failure probability and the third (in orange) to the buffered failure probability.</figcaption></figure>

Figure 17: (Switch distribution (iii)). Histograms of the estimation of several risk measures in the switch case (iii). TEach columns correspond to different sample sizes *n*. In each histogram, the theoretical value of the risk measure considered is represented by a vertical dotted line. When the estimator is asymptotically normal, the asymptotic PDF is drawn as well in solid line.
the asymptotic results on the quantile, superquantile and buffered probability estimators from Propositions 3, 7 and 1 do not hold. In this case, the estimation of the quantile is cumbersome: the distribution of its estimator is bimodal, and the distance between the gap does not shrink. This was expected: according to Remark 6, the quantile estimator gets closer to the set of quantiles $[q_\alpha(Y), q_\alpha^+(Y)] = [-2, -1]$, but there is no guarantee that it converges to quantile $q_\alpha(Y)$. The case of the superquantile is interesting as well: according to Remark 14, in this case, the superquantile estimator is not asymptotically normal. This is visible in Figure 16a. Likewise, there is no guarantee that the buffered failure probability estimator is asymptotically normal. Yet, even if the superquantile and buffered failure probability estimators are not asymptotically normal, they do have an asymptotic behaviour with a variance that decreases in $1/n$, as stated in Propositions 7 and 12. This is visible in Figure 17.

There are several conclusions following this study on academic test cases:

(i) The superquantile estimator, as well as the buffered failure probability estimator, are quite effective: their asymptotic variance is not much higher respectively than the one of the quantile and the failure probability. The lack of asymptotic normality does not seem to be a huge issue, since the asymptotic variance is still decreasing in $1/n$.

(ii) For heavy tailed distribution, the estimation of the margin and the margin dual is tedious, as expected.

(iii) The estimation of the quantile may meet some issues, as it may not be consistent. However, in this case, the estimator is getting closer to the set of quantiles $[q_\alpha(Y), q_\alpha^+(Y)]$, which may be sufficient in many applications.

## 5.3 Application to the decision-making framework

In this subsection, we note $p_f(Y) := p_0(Y) = \mathbb{P}(Y > 0)$ and $\hat{p}_n(Y) := \hat{p}_{0,n}(Y)$.

### 5.3.1 Case with the lax set of parameters

In this section, the set of parameters $(\alpha, s, \beta, n) = (0.95, 0, 0.001, 200)$ corresponds to the first line of Table 5. It does indeed respect the condition from Remark 24, because $n = 200 > \frac{\ln \beta}{\ln \alpha} \approx 134.7$. The security bound $\frac{1}{n}q_\beta(B(n, 1-\alpha))$ from Criterion 10 can be computed, and we obtain $\frac{1}{n}q_\beta(B(n, 1-\alpha)) = 0.01$. Alternatively, the integer from Criterion 11 can be computed, and we obtain $k_*(\alpha, s, \beta, n) = 199$.

For each situation (dyke is low and dyke is high), we have a budget of $n = 200$ simulations. We compute each time one estimation of the failure probability. The result of the two simulations are provided in Table 7.

<table><caption>Table 7: Summary of the results of the study. The system is safe according to Criterion 10, or equivalently Criterion 11 if the estimated failure probability is strictly less than the security bound, i.e., $\hat{p}_n(Y) < 0.01$, or equivalently if $Y_{(k_*(\alpha,s,\beta,n))} = Y_{(999)} \le 0$.</caption><thead><tr><th>Scenario</th><th>Acceptable risk<br>1 - α</th><th>Security bound</th><th>p̂<sub>n</sub>(Y)</th><th>Y<sub>(k<sub>*</sub>(α,s,β,n),n)</sub></th><th>Criterion 10 (or<br>equivalently 11)</th></tr></thead><tbody><tr><td>Dyke is low</td><td>0.05</td><td>0.01</td><td>0</td><td>-2.58</td><td>yes</td></tr><tr><td>Dyke is high</td><td>0.05</td><td>0.01</td><td>0</td><td>-6.73</td><td>yes</td></tr></tbody></table>

According to Criterion 10, or equivalently 11, the river is safe in both scenarios (low and high dyke). As a consequence, this study concludes that a low dyke is enough to guarantee the probability of a flood is lower or equal to $1 - \alpha = 0.05$, with a confidence level equal to $1 - \beta = 0.999$.

In addition, according to Proposition 18, we can compute the probability that the system is labeled as safe with respect to the real flood probability $p_f(Y)$. This is illustrated in Figure 18. The first comment is that the confidence level $1 - \beta$ from Theorem 1 is indeed respected. However, if $p_f(Y)$ was lower than $1 - \alpha$, but with a value close to $1 - \alpha$, there would be a high probability that the system is labeled as unsafe.
<figure><img src="image_25.png" /><figcaption>Figure 18: Probability that the system is labeled as safe, according to the set of lax parameters, with respect to the real flood probability $p_f(Y)$.</figcaption></figure>

In order to give a deeper insight in the decision-making framework, we allow us to reiterate the process 10⁵ times. The decision-maker is not able to do such a study in practice, because his simulation budget has already been reached when estimating the failure probability in each scenario. The results of this complementary study are given in Table 8.

<table><caption>Table 8: Table of the ratio and probability of safe labelling. The number in the second column corresponds to the number of occurrences of the system being labeled as safe over the total number of iterations. The numbers in the third column corresponds to the probability of labeling as safe the system, and can be computing using Proposition 18, because the true flood probability is known is this toy case.</caption><thead><tr><td>Scenario</td><td>Empirical ratio of safe labelling</td><td>Probability of labeling as safe</td></tr></thead><tbody><tr><td>Dyke is low</td><td>0.99003</td><td>0.99036</td></tr><tr><td>Dyke is high</td><td>0.99989</td><td>0.99986</td></tr></tbody></table>

Whether the dyke is low or high, the system is safe according to the acceptable risk $1 - \alpha = 0.05$. The probability of labeling the system as safe is very close to 1, and is greater when the dyke is high than when the dyke is low. Yet, this probability is not equal to 1. Indeed, when iterating on the criterion, it may happen that the system is labeled as unsafe, as shown in Table 8, where the ratio of safe labelling is not equal to 1.

### 5.3.2 Case with the conservative set of parameters

In this second case, the set of parameters $(1 - \alpha, s, \beta, n) = (5 \times 10^{-4}, 0, 10^{-5}, 3 \times 10^{4})$ corresponds to the second line of Table 5. It also respects the condition from Remark 24, because $n > \frac{\ln \beta}{\ln \alpha} \approx 23020.1$. The security bound $\frac{1}{n}q_{\beta}(\mathcal{B}(n, 1 - \alpha))$ from Criterion 10 can be computed, and we obtain $\frac{1}{n}q_{\beta}(\mathcal{B}(n, 1 - \alpha)) = 6.67 \times 10^{-5}$. Alternatively, the integer from Criterion 11 can be computed, and we obtain $k_{*}(\alpha, s, \beta, n) = 29999$.

For each situation (dyke is low and dyke is high), we have a budget of $5.10^4$ simulations. We compute each time one estimation of the failure probability. The results of the two simulations are provided in Table 9.

According to Criterion 10 (or equivalently 11), the river may present a danger, even with a high dyke. It means that the criterion and the realisation of the sample can not guarantee that the flood probability is lower or equal than $1 - \alpha = 5.10^{-4}$ with a confidence level $1 - \beta = 1 - 10^{-5}$. It does not necessary mean that the probability is above $1 - \alpha$. Indeed, this is what we observe in practice, because we obtain twice the same decision for two different scenarios, while reality would encourage us to opt for
<table><caption>Table 9: Summary of the results of the study. The system is safe according to Criterion 10, or equivalently Criterion 11 if the estimated failure probability is strictly lower than the security bound, i.e., $p̂_n(Y) < 1.4 \times 10^{-4}$, or equivalently if $Y_{(k*(α,s,β,n))} = Y_{(29996)} \le 0$.</caption><thead><tr><th>Scenario</th><th>Acceptable risk<br>1 − α</th><th>Security bound</th><th>p̂<sub>n</sub>(Y)</th><th>Y<sub>(k*(α,s,β,n),n)</sub></th><th>Criterion 10 (or<br>equivalently 11)</th></tr></thead><tbody><tr><td>Dyke is low</td><td>5.10<sup>−4</sup></td><td>6.67 × 10<sup>−5</sup></td><td>5.67 × 10<sup>−4</sup></td><td>7.06</td><td>no</td></tr><tr><td>Dyke is high</td><td>5.10<sup>−4</sup></td><td>6.67 × 10<sup>−5</sup></td><td>2.10<sup>−4</sup></td><td>17.6</td><td>no</td></tr></tbody></table>

two different decisions. Indeed, when the dyke is low, the failure probability is equal to $7.3 \times 10^{-4}$ and therefore bigger than $1 - \alpha$, while when the dyke is high, the failure probability is equal to $7.6 \times 10^{-5}$, which is this time less than $1 - \alpha$. However, the available budget is here too low to ensure with a high degree of confidence ($\beta$ is chosen very small) that the risk of flooding is below the acceptable risk.

According to Proposition 18, we can compute the probability that the system is labeled with respect to the real flood probability $p_f(Y)$. This is illustrated in Figure 19. The first comment is that the confidence level $1 - \beta$ from Theorem 1 is indeed respected. In line with the former comment, we verify that if $p_f(Y)$ is between $10^{-4}$ and $1 - \alpha$, there is a high probability that the system is labeled as unsafe. However, if $p_f(Y)$ is lower than $10^{-4}$, the probability that the system is indeed labeled as safe increases quickly.

<figure><img src="image_26.png" /><figcaption>Figure 19: Probability that the system is labeled as safe, according to the set of conservative parameters, with respect to the real flood probability $p_f(Y)$.</figcaption></figure>

<table><caption>Table 10: Table of the ratio and probability of safe labelling. The number in the second column corresponds to the number of occurrences of the system being labeled as safe over the total number of iterations. The number in the third column corresponds to the probability of labeling as safe the system, and can be computed using Proposition 18, because the true flood probability is known in this toy case. Here, for the scenario where the dyke is low, over the $10^5$ repetitions, the system has never been labeled as safe. This was expected, since the real probability of labeling as safe is far lower than $10^{-5}$.</caption><thead><tr><th>Scenario</th><th>Empirical ratio of safe labelling</th><th>Probability of labeling as safe</th></tr></thead><tbody><tr><td>Dyke is low</td><td>0</td><td>7.01 × 10<sup>−9</sup></td></tr><tr><td>Dyke is high</td><td>0.333</td><td>0.335</td></tr></tbody></table>

Similarly as previously, in order to give a deeper insight in the decision-making framework, we allow us to reiterate the process $10^5$ times. The results of this complementary study are given in Table 8. This case is different from the previous one. The scenario with a high dyke is safe according to the acceptable risk $1 - \alpha$, but the one with a low dyke is not. When the dyke is low, the probability of labelling the system as safe is very low, with an order of magnitude of $10^{-8}$, and is a fortiori below
$\beta = 10^{-5}$. In this complementary study, no iteration of the process labeled the system as safe, as shown in Table 9. The case where the dyke is high is different. Indeed, in this case, the system is safe according to the acceptable risk $1 - \alpha$. Yet, the realisation of the decision-making criterion from Table 9 labeled the system as unsafe. Indeed, as shown in Table 10, the probability that the system with a high dyke is labeled as safe is only close to 1/3. A larger computing budget, i.e., a higher value of $n$, is needed here to increase the chance of (correctly) labeling the system as safe.

## 5.4 Synthesis

The estimation of the margin and the margin-dual is, as expected, not easy when dealing with heavy-tailed distribution. For their parts, the estimations of the quantile, superquantile, failure probability and buffered failure probability converge relatively quickly toward the values they seek to estimate, even when dealing with a heavy-tailed distribution. However, the quantile estimator may meet some issues in specific cases, where its distribution is bimodal for instance.

The practical decision-making framework from Subsection 4.4 is then successfully applied to a flood model toy case, for two different sets of parameters $(\alpha, s, \beta, n)$. Given such a set of parameter, the application of the method is straightforward, and the analyst can assess the performance of the decision-making criterion, by plotting the probability that a system is labeled as safe, with respect to the real failure probability (e.g. Figures 18 and 19). The choice of a set of parameters $(\alpha, s, \beta, n)$ has not been discussed here. Yet, in line with Remark 25, for fixed values of $s$, $\alpha$, and $\beta$, we could have searched for values of $n$ that can be considered locally optimal, i.e., allowing us to locally maximize the value of the security bound. This is left as a perspective for future works.

# 6 Discussion and conclusion

## 6.1 Discussion

The article proposes several keys to choose a risk measure for engineering reliability. The duality notion developed in Section 3 allows to restraint this choice to the Y-homogeneous risk measures, or respectively the [0, 1]-homogeneous risk measures. The lack of subadditivity of the margin is a severe issue, as it can mislead the decision-maker. Moreover, the margin is not well estimated when dealing with heavy-tailed distribution.

The quantile lacks the risk-aversion, the subadditivity and the convexity. As already discussed in Subsection 2.4, the lack of subadditivity is not problematic from an interpretation point of view. The lack of convexity may be an issue if the analyst is interested in optimisation problems. A non negligible advantage of the quantile, and the failure probability, is that the decision-making framework developed in Section 4 is fully operational, and gives non asymptotically statistical guarantees. However, it is just developed for the crude Monte Carlo estimator of the failure probability. The failure probability, in the context of highly reliable systems, is hopefully very low, and its estimation is hence a so called *rare event* estimation problem. In this rare event framework, the crude Monte Carlo algorithm may not be efficient enough, and other algorithms (e.g. importance sampling or importance splitting [Morio and Balesdent, 2015, Rubino and Tuffin, 2007]) would be preferably used.

The superquantile respects all the desired properties from Definition 2, and can hence be considered as an ideal candidate to replace the quantile. Moreover, it provides very fine information on the tail of the distribution. Besides, its numerical estimation is almost as efficient as the one of the quantile, and it is a more stable estimator, in the sense that the situation in Figure 17a where the quantile estimator is bimodal can not happen for the superquantile. However, the decision-making framework developed in 4 is not easily implemented with this risk measure.

## 6.2 Conclusion and perspectives

In this work, a categorisation between Y-homogeneous risk measures and [0, 1]-homogeneous risk measures has been introduced, alongside with a duality between the two categories. The properties of three Y-homogeneous risk measures (margin, quantile and superquantile) and of their dual [0, 1]-homogeneous risk measures (margin-dual, failure probability and buffered failure probability) are discussed in an almost exhaustive way, by using already existing results and giving proofs and
counter-examples. The properties of the standard statistical estimators of these six risk measures are illustrated using three academic test cases.

Moreover, a general decision-making framework using risk measures has been developed. For now, this decision-making is operational when the risk measures considered are the quantile and the failure probability. Assuming that the random variable of interest admits a PDF, this decision-making framework is equivalent to a Wilks' quantile estimation. Then, this decision-making framework has been applied to a flood model toy case. The simplicity of use of this framework and its non-asymptotic statistical guarantee were hence illustrated on a concrete case. The extension of this framework to more efficient failure probability or quantile estimators, especially in a rare event framework, is worthy of interest. Furthermore, the choice of parameters $(\alpha, s, \beta, n)$ may also be dictated by some mathematical properties, and additional studies could help to improve the proposed framework. At last, the application of this framework to the superquantile and the buffered failure probability could open up interesting prospects for more regular use of these risk measures in engineering. Those three perspectives are left for future works.
# A Counter-examples of properties for some risk measures

## A.1 Margin

The margin is not monotonic. We give the following counter-examples.

(i) The first counter-example only works for $\lambda > 1$. It is illustrated in Figure 20. We consider $-Y_1 \sim \mathcal{E}(\mu)$ and $Y_2 \sim \mathcal{E}(1)$ for some $0 < \mu < \frac{\lambda-1}{\lambda+1}$ (where $\mathcal{E}(\mu)$ designates the exponential law of parameter $\mu$, with the convention that its expectation is $\frac{1}{\mu}$). Then we have $Y_1 \le Y_2$ a.s. but $\text{mgn}(Y_1; \lambda) = \frac{1}{\mu}(\lambda-1) > 1 + \lambda = \text{mgn}(Y_2; \lambda)$.

(ii) The second counter-example uses discrete random variables, but works for any $\lambda > 0$. Let $p$ be such that $0 < p < \frac{\lambda^2}{1+\lambda^2}$. Then we consider $-Y_1 \in \mathcal{B}(p)$ and $Y_2 = 0$ a.s.. Then $Y_1 \le Y_2$ a.s. Yet $\text{mgn}(Y_2; \lambda) = 0 < -p + \lambda\sqrt{p(1-p)} = \text{mgn}(Y_1; \lambda)$.

(iii) The last example is based only on random variables with PDF and works for any $\lambda > 0$. We consider still $p$ such that $0 < p < \frac{\lambda^2}{1+\lambda^2}$ and $\delta > 0$. Let $Y_1$ be a random variable that follows $\mathcal{U}([-1, -1+\delta])$ with probability $p$ and $\mathcal{U}([-\delta, 0])$ with probability $1-p$, and $Y_2 \sim \mathcal{U}([0, \delta])$. Then $Y_1 \le Y_2$ a.s.. Yet $\text{mgn}(Y_1; \lambda) \xrightarrow{\delta \to 0} -p + \lambda\sqrt{p(1-p)}$ and $\text{mgn}(Y_2; \lambda) \xrightarrow{\delta \to 0} 0$. Therefore, the margin is not monotonic, otherwise we would have $\text{mgn}(Y_1; \lambda) \le \text{mgn}(Y_2; \lambda)$ for all $\delta > 0$, and hence with the limit we would have $-p + \lambda\sqrt{p(1-p)} \le 0$, which is a contradiction.

<figure><img src="image_27.png" /><figcaption>Figure 20: Illustration of the counter-example (i) of the lack of monotony of the margin for $\lambda = 2$. The curve in green (respectively blue) is the PDF of $Y_1$ (respectively $Y_2$).</figcaption></figure>

## A.2 Quantile

The quantile is not risk averse. We give the following counter-examples.

(i) The first counter-example works for any $0 < \alpha < 1$. Let $Y$ be a random variable uniform on $[-2, 0]$ with probability $\alpha$ and uniform on $[a-1, a+1]$ with probability $1-\alpha$, where $a > 10$. Then $q_{\alpha}(Y) = 0$ and $\mathbb{E}(Y) = (1-\alpha)a - \alpha > 0 = q_{\alpha}(Y)$ for $a > \frac{\alpha}{1-\alpha}$. An illustration of this counter-example is given in Figure 21.

(ii) The second counter-example works also for any $0 < \alpha < 1$. Let $\delta$ be such that $0 < \delta < 1 - \alpha$ and $Y$ follows $\mathcal{U}([0, \delta])$ with probability $\alpha$ and $\mathcal{U}([\delta, 1])$ with probability $1 - \alpha$. Then $\mathbb{E}(Y) = \frac{1}{2}(1 - \alpha + \delta) > \delta = q_{\alpha}(Y)$.

(iii) The third counter-example works only for $0 < \alpha < 1 - e^{-1} \approx 0.63$. Let $Y \sim \mathcal{E}(1)$. Then $\mathbb{E}(Y) = 1 > -\ln(1-\alpha) = q_{\alpha}(Y)$.

The quantile is not subadditive either. In [Rockafellar and Royset, 2015], a counter-example for the case $\alpha = 0.9$ is given. Here, we adapt it to construct a counter-example for any $\alpha \in (0, 1)$.

(i) Let $Y_1$ and $Y_2$ be two independent random variables with PDF $f(y) = \alpha \mathbb{1}_{[-1,0]}(y) + \frac{1-\alpha}{2} \mathbb{1}_{[0,2]}(y)$. Then $q_{\alpha}(Y_1) = q_{\alpha}(Y_2) = 0$. Besides, after a few calculations, we find that $F_{Y_1+Y_2}(0) = \alpha \frac{1+\alpha}{2} < \alpha$. Since the CDF of $Y_1 + Y_2$ is strictly increasing on $[-2, 4]$, by composing by the inverse function, we have $0 < q_{\alpha}(Y_1 + Y_2)$.
<figure><img src="image_28.png" /><figcaption>Figure 21: Illustration of the counter-example (i) of the lack of risk-aversion of the quantile. The CDF $F_Y$ is represented in blue. The red filled area represent the probability that $Y$ is in the corresponding interval, the probability being written in red. The quantile and expectation are visible in green.</figcaption></figure>

## A.3 Buffered failure probability

The buffered failure probability is not subadditive. We give a counter-example for a positive threshold $s > 0$.

(i) Let $a > 0$ be such that $a < s < 2a$ and $Y_1$ and $Y_2$ be independent and uniformly distributed on $[0, a]$. Then $\bar{p}_s(Y_1) = \bar{p}_s(Y_2) = 0$ but $\bar{p}_s(Y_1 + Y_2) > 0$.

## A.4 Margin-dual

The margin-dual is not subadditive in general. We give a counter-example for $s > 0$.

(i) Let $s > 0$ and $Y_1 = Y_2 = s$ a.s., then $P_s^{mgn}(Y_1 + Y_2) = 1 > 0 = P_s^{mgn}(Y_1) + P_s^{mgn}(Y_2)$.

The margin-dual is not convex either. We present a counter-example for the particular case (9).

(i) For $s \in \mathbb{R}$, let us consider two constants $\mu_1 = s - 1$ and $\mu_2 > s + 1$. Let $(Y_1, Y_2) \in L^2(\Omega)$ be two random variables such that their expectations are respectively $\mu_1$ and $\mu_2$. Then $\frac{1}{2}P_s^{mgn}(Y_1) + \frac{1}{2}P_s^{mgn}(Y_2) = \frac{1}{2}\exp\left(-\frac{s-\mu_1}{\sigma(Y_1)}\right) + \frac{1}{2} < 1 = P_s^{mgn}(\frac{1}{2}Y_1 + \frac{1}{2}Y_2)$.

# B Complementary results on the continuity of risk measures

This part offers complementary results on the continuity of the risk measures considered. Table 11 gives a summary of the results of this appendix. This table is constructed using the continuity results from Section 2, results and counter-examples from this appendix, and using the links between the different types of convergence (cf. Figure 22). The strongest continuity is the continuity of the convergence in distribution.

<table><caption>Table 11: Continuity properties of different risk measures depending on the type of convergence considered. The properties are shown above and deduced using the standard relation between the different types of convergence. "u.c." means "under condition".</caption><thead><tr><th></th><th>Expectation</th><th>Margin</th><th>Worst-case</th><th>Quantile</th><th>Superquantile</th><th>Margin-dual</th><th>Failure probability</th><th>Buffered failure probability</th></tr></thead><tbody><tr><td>Distribution</td><td>no</td><td>no</td><td>no</td><td>u.c.</td><td>no</td><td>no</td><td>u.c.</td><td>no</td></tr><tr><td>Probability</td><td>no</td><td>no</td><td>no</td><td>u.c.</td><td>no</td><td>no</td><td>u.c.</td><td>no</td></tr><tr><td>Almost sure</td><td>no</td><td>no</td><td>no</td><td>u.c.</td><td>no</td><td>no</td><td>u.c.</td><td>no</td></tr><tr><td>L<sup>1</sup></td><td>yes</td><td>no</td><td>no</td><td>u.c.</td><td>yes</td><td>no</td><td>u.c.</td><td>u.c.</td></tr><tr><td>L<sup>2</sup></td><td>yes</td><td>yes</td><td>no</td><td>u.c.</td><td>yes</td><td>u.c.</td><td>u.c.</td><td>u.c.</td></tr><tr><td>L<sup>∞</sup></td><td>yes</td><td>yes</td><td>yes</td><td>u.c.</td><td>yes</td><td>u.c.</td><td>u.c.</td><td>u.c.</td></tr></tbody></table>
<figure><img src="image_29.png" /><figcaption>Figure 22: Relation between the different types of convergence. Note that the implication are reverse when dealing with a continuity. For example, the convergence $L^1$ implies the convergence in probability, as a consequence the continuity in probability implies the continuity for the $L^1$ convergence.</figcaption></figure>

## B.1 Expectation and margin

The expectation is not continuous for the convergence in probability and the margin is not continuous for the $L^q$ convergence with $1 \le q < 2$. Moreover, neither the margin nor the expectation are continuous for the a.s. convergence. Indeed, the following counter-examples are given in [Candelpergher, 2013] or [Wikipedia, 2024].

(i) Let $Y_n$ be a random variable equal to 0 with probability $1 - \frac{1}{n}$ and $n$ with probability $\frac{1}{n}$. Then $(Y_n)_{n \in \mathbb{N}}$ converges to 0 in probability but $\mathbb{E}(Y_n) = 1$ does not converge to $\mathbb{E}(0) = 0$.

(ii) Let $X_n$ be a random variable equal to 0 with probability $1 - \frac{1}{n^2}$ and to $n$ with probability $\frac{1}{n^2}$. Then for $1 \le q < 2$, we have that $(X_n)_{n \in \mathbb{N}}$ converges to 0 in $L^q$ since $\mathbb{E}(|X_n|^q) = \frac{1}{n^{2-q}} \xrightarrow{n \to +\infty} 0$. But $\text{mgn}(X_n) = \frac{1}{n} + \lambda\sqrt{1 - \frac{1}{n^2}}$ does not converge to $\text{mgn}(0) = 0$.

(iii) Let $Z_n = 1_{\{0 \le (1-nU)<1\}} n(1-nU)$ where $U$ is uniformly distributed on $[0, 1]$. Then $(Z_n)_{n \in \mathbb{N}}$ converges a.s. to 0 but $\text{mgn}(Z_n) \ge \mathbb{E}(Z_n) = \frac{1}{2}$ does not converge to $\text{mgn}(0) = 0$.

## B.2 Worst-case and quantile

The worst-case is not continuous for any of the standard type of convergence, except the $L^\infty$ convergence. Indeed, it is neither continuous for the a.s. convergence nor the $L^q$ one for any $q \in [1, +\infty)$.

(i) Let consider $Z_n = 1_{\{U>0\}} 1_{\{n(1-nU)\ge0\}} n(1-nU)$ where $U$ is uniformly distributed on $[0, 1]$. Then $(Z_n)_{n \in \mathbb{N}}$ converges a.s. to 0 but $\sup(Z_n) = n$ does not converge to $\sup(0) = 0$.

(ii) Let $Y_n$ be a random variable equal to 0 with probability $1 - \frac{1}{n^{p+1}}$ and $n$ with probability $\frac{1}{n^{p+1}}$ for $p \ge 1$. Then $\mathbb{E}(|Y_n|^p) = \frac{1}{n^p}$ converges to 0 as $n$ goes to infinity. Hence, $(Y_n)_{n \in \mathbb{N}}$ converges to 0 in $L^p$ but $\sup(Y_n) = n$ does not converge to $\sup(0) = 0$.

Rigorously speaking, the quantile $Y \mapsto q_\alpha(Y)$ is not continuous for the a.s. convergence nor the $L^q$ one for $1 \le q < +\infty$.

(i) Let $Y = 1_{\{U>\alpha\}} - 1_{\{U<\alpha\}}$ and $Y_n = 1_{\{U>\alpha+\frac{1}{n}\}} - 1_{\{U<\alpha-\frac{1}{n}\}}$ where $U$ is uniformly distributed on $[0, 1]$. Hence, $Y$ equals $-1$ with probability $\alpha$ and $1$ with probability $1-\alpha$ and $Y_n = -1$ with probability $\alpha - \frac{1}{n}$, $0$ with probability $\frac{2}{n}$ and $1$ with probability $1-\alpha - \frac{1}{n}$. Then $(Y_n)_{n \in \mathbb{N}}$ converges a.s. and in $L^q$ to $Y$ but $q_\alpha(Y_n) = 0$ and $q_\alpha(Y) = -1$.

However, we have the following result:

**Proposition 19.** Let $(Y_n)_{n \in \mathbb{N}} \in E^n$ be a sequence of random variables that converges in distribution to $Y \in E$ and let $0 < \alpha < 1$. Then $\forall \varepsilon > 0$, $\exists N \in \mathbb{N}: \forall n \ge N$, $q_\alpha(Y_n) \in [q_\alpha^-(Y) - \varepsilon, q_\alpha^+(Y) + \varepsilon]$ where $q_\alpha^-(Y) = \inf\{y \in \mathbb{R}: F_Y(y) \ge \alpha\}$ and $q_\alpha^+(Y) = \sup\{y \in \mathbb{R}: F_Y(y) \le \alpha\}$.

*Proof.* We know that for any point of continuity $y$ of the CDF $F_Y$, we have $(F_{Y_n}(y))_{n \in \mathbb{N}}$ that converges to $F_Y(y)$ [Candelpergher, 2013]. Moreover, the discontinuities of $F_Y$ are countable (infinite or not), since it is an increasing function. Let $\varepsilon > 0$. Hence, there exists $y < q_\alpha^-(Y)$ such that $y$ is $\varepsilon$-close to $q_\alpha(Y)$ (i.e., $|y - q_\alpha^+(Y)| \le \varepsilon$) and $F_Y$ is continuous in $y$. Hence $(F_{Y_n}(y))_{n \in \mathbb{N}}$ converges to $F_Y(y) < \alpha$. Hence, there exists $N_1 \in \mathbb{N}$ such that, for any $n \ge N_1$, we have $F_{Y_n}(y) < \alpha$. Hence for any $n \ge N_1$, we have $q_\alpha(Y_n) \ge y \ge q_\alpha^-(Y) - \varepsilon$. A similar reasoning gives the existence of $N_2$ such that for any $n \ge N_2$, we have $q_\alpha(Y_n) \le q_\alpha^+(Y) + \varepsilon$. Hence, $N = \max(N_1, N_2)$ suits, which ends the proof. $\square$
For a given interval $I$, we may want to cite a result such as "the quantile is continuous on the subset of the random variable with a PDF that is strictly positive on $I$". This is true, but since the set of the random variable with a PDF that is strictly positive on $I$ is not a vector subspace, such a result is not usable in practice. Indeed, if $U$ is uniform on $\{-1, 1\}$ and $Y_1$ follows a normal distribution and $Y_2 = UY_1$, then as $Y_2$ follows also a normal distribution, both $Y_1$ and $Y_2$ are in such a subset but $Y_1 + Y_2$ is not (it does not even admit a PDF).

## B.3 Superquantile

The superquantile is continuous for the $L^1$ norm, which is proved below.

*Proof of Proposition 5.* Let us consider $\phi_n : c \mapsto c + \frac{1}{1-\alpha}\mathbb{E}([Y_n - c]_+) \text{ and } \phi : c \mapsto c + \frac{1}{1-\alpha}\mathbb{E}([Y - c]_+)$. For any $c \in \mathbb{R}$, since $y \mapsto [y - c]_+$ is 1-Lipschitz, we have $|\phi_n(c) - \phi(c)| \le \frac{1}{1-\alpha}\mathbb{E}(|Y_n - Y|) \xrightarrow{n \to +\infty} 0$. Hence the sequence of functions $(\phi_n)_{n \in \mathbb{N}}$ converges pointwise to $\phi$. Let us consider the compact convex set $K = [q_{\alpha}^{-}(Y) - 1, q_{\alpha}^{+}(Y) + 1]$. According to Proposition 19, there exists $N \in \mathbb{N}$ such that $\forall n \ge N$, $q_{\alpha}(Y_n) \in K$. Hence, since $\min_{\mathbb{R}} \phi_n = \phi_n(q_{\alpha}(Y_n))$, for $n \ge N$, we have $\min_{\mathbb{R}} \phi_n = \min_K \phi_n$. Likewise, $\min_{\mathbb{R}} \phi = \min_K \phi$. Moreover, according to Theorem 1.2 of [Komuro, 1989], we have $(\inf_K \phi_n)_{n \in \mathbb{N}}$ that converges to $\inf_K \phi$ as $n$ goes to infinity. This concludes the proof since $\bar{q}_{\alpha}(Y_n) = \min_{\mathbb{R}} \phi_n$ and $\bar{q}_{\alpha}(Y) = \min_{\mathbb{R}} \phi$. $\square$

The superquantile is not continuous for the a.s. convergence.

(i) Let $Z_n = \mathbb{1}_{\{0 \le (1-nU) < 1\}} n(1-nU)$ where $U \sim \mathcal{U}([0,1])$. Then $(Z_n)_{n \in \mathbb{N}}$ converges a.s. to 0. Also, for $n > \frac{1}{1-\alpha}$ since $F_Y(0) = 1 - \frac{1}{n}$ and $F_Y(-\varepsilon) = 0$ for any $\varepsilon > 0$, we have $q_{\alpha}(Z_n) = 0$, hence $\bar{q}_{\alpha}(Z_n) = q_{\alpha}(Z_n) + \frac{1}{1-\alpha}\mathbb{E}([Z_n - q_{\alpha}(Z_n)]_+) = \mathbb{E}(Z_n) = \frac{1}{2}$ which does not converge to $\bar{q}_{\alpha}(0) = 0$.

## B.4 Failure probability

Strictly speaking, the failure probability is not continuous, even for the norm $L^\infty$.

(i) Let us consider $Y_n = s + \frac{1}{n}U$ where $U$ is uniformly distributed in $[0,1]$ and $s \in \mathbb{R}$. Then $(Y_n)_{n \in \mathbb{N}}$ converges to $s$ in $L^\infty$ but $p_s(Y_n) = 1$ does not converge to $p_s(s) = 0$.

## B.5 Buffered failure probability

The buffered failure probability is not continuous in general.

(i) Let us consider $0 < p < 1$ and define $Y = \mathbb{1}_{\{U \ge 1-p\}}$ and $Y_n = (1 + \frac{1}{n}) \mathbb{1}_{\{U \ge 1-p\}}$ where $U \sim \mathcal{U}([0,1])$. Then $(Y_n)_{n \in \mathbb{N}}$ converges to $Y$ uniformly (i.e., for the $L^\infty$ norm). Since $\sup(Y) = 1$, we have $\bar{p}_1(Y) = 0$. Moreover, we have $\sup(Y_n) = 1 + \frac{1}{n} > 1$ and $\mathbb{E}(Y_n) = p(1 + \frac{1}{n}) < 1$ for $n > \frac{p}{1-p}$. Hence, for $n > \frac{p}{1-p}$, we have $\bar{p}_1(Y_n) = \min_{c \ge 0} \mathbb{E}([c(Y_n - 1) + 1]_+) = p(1 + \frac{1}{n}) \xrightarrow{n \to +\infty} p \ne 0 = \bar{p}_1(Y)$.

Nonetheless, we have a partial result of continuity stated in Proposition 11.

*Proof of Proposition 11.* (i) If $s > \sup(Y)$, then since $(\sup(Y_n))_{n \in \mathbb{N}}$ converges to $\sup(Y)$, there exists $N \in \mathbb{N}$ such that for all $n \ge N$ we have $\sup(Y_n) < s$. Hence $\bar{p}_s(Y_n) = 0 \xrightarrow{n \to +\infty} 0 = \bar{p}_s(Y)$.

(ii) If $s < \mathbb{E}(Y)$ then since $(\mathbb{E}(Y_n))_{n \in \mathbb{N}}$ converges to $\mathbb{E}(Y)$, we conclude similarly that there exists $N \in \mathbb{N}$ such that for all $n \ge N$ we have $\mathbb{E}(Y_n) > s$, hence $\bar{p}_s(Y_n) = 1 \xrightarrow{n \to +\infty} 1 = \bar{p}_s(Y)$.

(iii) If $\mathbb{E}(Y) < s < \sup(Y)$. Then there exists a unique $0 < \alpha < 1$ such that $\bar{q}_{\alpha}(Y) = s$. We consider $\phi_n : c \mapsto \mathbb{E}([c(Y_n - s) + 1]_+)$ and $\phi : c \mapsto \mathbb{E}([c(Y_n - s) + 1]_+)$. Then $\bar{p}_s(Y) = \min_{\mathbb{R}_+} \phi$. In addition, since $\mathbb{E}(Y) < s < \sup(Y)$ there exists $N \in \mathbb{N}$ such that for all $n \ge N$ we have $\mathbb{E}(Y_n) < s < \sup(Y_n)$ and hence $\bar{p}_s(Y_n) = \min_{\mathbb{R}_+} \phi_n$. Besides, according to Equation (2.7) in [Mafusalov et al., 2018] we know that the minimum of $\phi_n$ is attained for $c = \frac{1}{s-q_{\alpha}^{-}(Y_n)}$ and that the minimum of $\phi$ is attained for any $c \in [\frac{1}{s-q_{\alpha}^{-}(Y)}, \frac{1}{s-q_{\alpha}^{+}(Y)}]$. Moreover, we have $q_{\alpha}^{-}(Y) \le q_{\alpha}^{+}(Y) < \bar{q}_{\alpha}(Y) = s$ (otherwise, we would have $q_{\alpha}^{+}(Y) = \bar{q}_{\alpha}(Y)$ leading to $Y \le q_{\alpha}^{+}(Y)$ a.s. and hence $\sup(Y) \le q_{\alpha}^{+}(Y) = \bar{q}_{\alpha}(Y) = s$ which is not the case considered). Let $\varepsilon = \frac{s-q_{\alpha}^{+}(Y)}{2} > 0$. According to Proposition 19, there exists $N' \in \mathbb{N}$
such that for all $n \ge N'$ we have $q_\alpha(Y_n) \in [q_\alpha^-(Y) - \varepsilon, q_\alpha^+(Y) + \varepsilon]$. Hence, for all $n \ge N'$, we have $\frac{1}{1-q_\alpha(Y_n)} \in K$ where $K = \left[\frac{1}{s-q_\alpha^-(Y)+\varepsilon}, \frac{1}{s-q_\alpha^+(Y)-\varepsilon}\right]$ is a compact convex set. Hence for $n \ge N'$, we have $\min_{\mathbb{R}_+} \phi_n = \min_K \phi_n$ and $\min_{\mathbb{R}_+} \phi = \min_K \phi$. Since each $\phi_n$ is convex, according to Theorem 1.2 of [Komuro, 1989] we have $(\inf_K \phi_n)_{n \in \mathbb{N}}$ that converges to $\inf_K \phi$. This concludes the proof since for $n \ge \max(N, N')$, we have $\min_K \phi_n = \bar{p}_s(Y_n)$ and $\min_K \phi = \bar{p}_s(Y)$. $\square$

## B.6 Margin-dual

The margin-dual is not continuous in general, even for the $L^\infty$ convergence.

(i) Let $s \in \mathbb{R}$ and $Y_n = s + \frac{1}{n}$ a.s.. Then $(Y_n)_{n \in \mathbb{N}}$ converges to $s$ in $L^\infty$ but $P_s(Y_n) = 1$ does not converge to $P_s(Y) = 0$.

We have nonetheless to following result.

**Proposition 20.** Let $\lambda : [0, 1) \mapsto \mathbb{R}$ be a continuous and strictly increasing function. Let $s$ be a constant in $\mathbb{R}$ and $(Y_n)_{n \in \mathbb{N}} \in L^2(\Omega)^{\mathbb{N}}$ be a sequence of random variables that converges to $Y \in L^2(\Omega)$ for the $L^2$ convergence. If $Y$ is not constant a.s. or if $Y = c \in \mathbb{R}$ a.s. with $c \neq s$, then $(P_s(Y_n))_{n \in \mathbb{N}}$ converges to $P_s(Y)$.

*Proof.* Let first treats the case where $Y$ is not constant a.s. If $s < \mathbb{E}(Y) + \sigma(Y)\inf\lambda$ then there exists $N \in \mathbb{N}$ such that for all $n \ge N$, we have $s < \mathbb{E}(Y_n) + \sigma(Y_n)\inf\lambda$. Hence for $n \ge N$, we have $P_s(Y_n) = 1$ that converges to $P_s(Y) = 1$. The cases $\mathbb{E}(Y) + \sigma(Y)\inf\lambda < s < \mathbb{E}(Y) + \sigma(Y)\sup\lambda$ and $\mathbb{E}(Y) + \sigma(Y)\sup\lambda < s$, with the remark that $\lambda^{-1}$ is continuous. If $s = \mathbb{E}(Y) + \sigma(Y)\inf\lambda$, then $P_s(Y) = 1$. For $n \in \mathbb{N}$, we have that $P_s(Y_n) = 1$ or $1 - \lambda^{-1}\left(-\frac{s-\mathbb{E}(Y_n)}{\sigma(Y_n)}\right)$ that converges to 1 since $\lambda^{-1}$ is continuous and $\lambda^{-1}(\inf\lambda) = 0$. The case $s = \mathbb{E}(Y) + \sigma(Y)\sup\lambda$ is treated similarly. In the case $Y = c$ a.s., then $P_s(Y) = 1_{\{s<c\}}$. This case is treated similarly as well, depending on whether $s < \mathbb{E}(Y)$ or $s > \mathbb{E}(Y)$. $\square$

# C Proofs of convergence of the estimators

## C.1 Expectation and margin estimators

We prove here the consistency and asymptotic normality of the expectation and margin estimators.

*Proof of Proposition 1.* (i) The strong consistency is a direct consequence of the strong law of large numbers (s.l.l.n.), and it is immediate that the estimator is unbiased.

(ii) Using the bias-variance decomposition, we have $\|\bar{Y}_n - Y\|_{L^2} = (\mathbb{E}(\bar{Y}_n) - \mathbb{E}(Y))^2 + \text{Var}(\bar{Y}_n) = \frac{1}{n}\text{Var}(Y)$ that converges to 0.

(iii) This is a direct consequence of the c.l.t. $\square$

*Proof of Proposition 2.* (i) We have respectively $\bar{Y}_n$ and $s_n = \frac{1}{n}\sum_{i=1}^n Y_i^2 - (\frac{1}{n}\sum_{i=1}^n Y_i)$ that converge as. to $\mathbb{E}(Y)$ and $\mathbb{E}(Y^2) - \mathbb{E}(Y)^2 = \text{Var}(Y)$ according to the s.l.l.n. The strong consistency follows.

(ii) According to the c.l.t., we have $\left(\frac{1}{\sqrt{n}}\left(\frac{1}{n}\sum_{i=1}^n\left(Y_i - m\right)\right)\right)_{n \in \mathbb{N}}$ that converges to $\mathcal{N}(0, \Sigma)$ in distribution, where $m = \frac{\mathbb{E}(Y)}{\mathbb{E}(Y^2)}$. Then, according to the delta-method, since $h$ is differentiable in $m$, we have $\left(\frac{1}{\sqrt{n}}\left(h\left(\frac{1}{n}\sum_{i=1}^n\left(Y_i^2\right)\right) - h(m)\right)\right)_{n \in \mathbb{N}}$ that converges in distribution to $\mathcal{N}(0, \nabla h(m)\Sigma\nabla h(m)^\top)$. This concludes the proof, since $h(m) = \text{mgn}(Y; \lambda)$ and $h\left(\frac{1}{n}\sum_{i=1}^n\left(Y_i^2\right)\right) = \widehat{\text{mgn}}_n$. $\square$
## C.2 Quantile and worst-case estimators

The following Lemma and Proposition aim to prove the consistency of the wort-case and quantile estimator, and the asymptotic normality for the latter. The proofs are inspired by [Delmas, 2009].

**Lemma 4.** Let $(Z_n)_{n \in \mathbb{N}}$ be a sequence of random variable and $-\infty < l_- \le l_+ \le +\infty$. Assume that for any $x \in \mathbb{R}$, we have $\mathbb{P}(Z_n \le x \text{ from a certain rank}) = 0$ if $x < l_-$ and $1$ if $x > l_+$. Then a.s., we have $\liminf_{n \to +\infty} Z_n \ge l_-$ and $\limsup_{n \to +\infty} Z_n \le l_+$.

*Proof.* Let $x > l_+$, then a.s. we have $Z_n \le x$ from a certain rank. Hence, a.s., $\limsup_{n \to +\infty} Z_n \le x$. By making $x$ tends toward $l_+$, we have a.s. $\limsup_{n \to +\infty} Z_n \le l_+$. Let $x < l_-$, then a.s. we have $\forall N \in \mathbb{N}, \exists n \ge N : Z_n > x$. Hence, a.s., $\liminf_{n \to +\infty} Z_n \ge x$. By making $x$ tends toward $l_-$, we have a.s. $\liminf_{n \to +\infty} Z_n \ge l_-$. $\square$

**Proposition 21.** Let $0 < \alpha \le 1$. We note $\hat{q}_{\alpha,n}$ the estimator of the quantile or the worst-case introduced in Definition 6. Then a.s., we have $\liminf_{n \to +\infty} \hat{q}_{\alpha,n} \ge q_{\alpha}$ and $\limsup_{n \to +\infty} \hat{q}_{\alpha,n} \le q_{\alpha}^+$.

*Proof.* For $y \in \mathbb{R}$ we note $S_n(y) = \sum_{i=1}^n \mathbb{1}_{\{Y_i \le y\}}$. Using the law of large numbers, we have a.s. $\lim_{n \to +\infty} \frac{S_n(y)}{|n\alpha|} = \frac{F_Y(y)}{\alpha}$. If $y < q_\alpha$ then $\frac{F_Y(y)}{\alpha} < 1$. Therefore, $\mathbb{P}\left(\frac{S_n(y)}{|n\alpha|} \ge 1 \text{ from a certain rank}\right) = 0$. If $y > q_\alpha^+$ then $\frac{F_Y(y)}{\alpha} > 1$. Therefore, $\mathbb{P}\left(\frac{S_n(y)}{|n\alpha|} \ge 1 \text{ from a certain rank}\right) = 1$. Using the fact that $\{\hat{q}_{\alpha,n} \le y \text{ from a certain rank}\} = \left\{\frac{S_n(y)}{|n\alpha|} \ge 1 \text{ from a certain rank}\right\}$ and Lemma 4, we can conclude the proof. $\square$

**Corollary 2** (Consistency of the quantile estimator). Let $0 < \alpha < 1$. Assume that the cardinality of $F^{-1}(\{\alpha\})$ is at most one. Then, the quantile estimator introduced in Definition 6 is strongly consistent.

*Proof.* This follows from Proposition 21 since if the cardinality of $F^{-1}(\{\alpha\})$ is at most one, then $q_\alpha = q_\alpha^+$.
$\square$

**Corollary 3** (Consistency of the wort-case estimator). The worst-case estimator introduced in Definition 6 is consistent for the a.s. convergence.

*Proof.* We remind that $q_1 = \sup(Y)$. For the sake of clarity, we denote by $(Y_{(1,n)} \le \dots \le Y_{(n,n)})$ the order statistics of the sample $(Y_1, \dots, Y_n)$. We have a.s. $\liminf_{n \to +\infty} Y_{(n,n)} \le \limsup_{n \to +\infty} Y_{(n,n)} \le \sup(Y) \le \liminf_{n \to +\infty} Y_{(n,n)}$ where the last inequality comes from Proposition 21. Hence, $(Y_{(n,n)})_{n \in \mathbb{N}}$ converges a.s. to $\sup(Y)$. $\square$

## C.3 Failure probability estimator

We prove here the consistency and asymptotic normality of the failure probability estimator.

*Proof of Proposition 9.* Since $\mathbb{P}(s) = \mathbb{E}(\mathbb{1}_{\{Y>s\}})$, the estimation of the failure probability is just the estimation of an expectation. Moreover, for any $n \in \mathbb{N}$, $\mathbb{1}_{\{Y_n>s\}}$ is a Bernoulli distribution of variance $p_s(1-p_s)$, where $p_s := p_s(Y)$ denotes the failure probability, and $(\mathbb{1}_{Y_n})_{n \in \mathbb{N}}$ are independent random variables.

(i) Using the bias-variance decomposition, the mean square error is $\|\hat{p}_{s,n} - p_s\|_{L^2} = (p_s - \mathbb{E}(\hat{p}_{s,n}))^2 + \text{Var}(\hat{p}_{s,n}) = 0 + \frac{1}{\sqrt{n}}\sqrt{p_s(1-p_s)}$ that converges indeed to 0.

(ii) This is a direct consequence of the s.l.l.n (see [Feller, 1991], p.203).

(iii) This is a direct consequence of the c.l.t. $\square$
## C.4 Margin-dual estimator

We provide here a proof of the consistency and asymptotic normality of the margin-dual estimator. The idea is the same as in the proof of the consistency and asymptotic normality of the margin estimator (Proposition 2).

*Proof of Proposition 16.* (i) We have respectively $\bar{Y}_n$ and $s_n = \frac{1}{n} \sum_{i=1}^n Y_i^2 - (\frac{1}{n} \sum_{i=1}^n Y_i)$ that converge a.s. to $\mathbb{E}(Y)$ and $\mathbb{E}(Y^2) - \mathbb{E}(Y)^2 = \text{Var}(Y)$ according to the s.l.l.n.

* If $s < \mathbb{E}(Y)$, then since $(\bar{Y}_n)_{n \in \mathbb{N}}$ converges a.s. to $\mathbb{E}(Y)$, then a.s. there exists $N \in \mathbb{N}$ such that for all $n \ge N$ we have $s < \bar{Y}_n$. Hence, for $n \ge N$, we have $\hat{\mathcal{P}}_{s,n}^{\text{mgn}} = 1 = \mathcal{P}^{\text{mgn}}$, which gives the strong consistency in this case.

* If $s > \mathbb{E}(Y)$, likewise a.s. there exists $N \in \mathbb{N}$ such that for all $n \ge N$ we have $\bar{Y}_n < s$. Hence, for $n \ge N$, we have $\hat{\mathcal{P}}_{s,n}^{\text{mgn}} = \exp\left(-\frac{s-\bar{Y}_n}{s_n}\right)$, and it converges to $\exp\left(\frac{s-\mathbb{E}(Y)}{\sigma(Y)}\right) = \mathcal{P}_s^{\text{mgn}}(Y)$ as $n$ goes to $+\infty$.

* If $s = \mathbb{E}(Y)$, then $\mathcal{P}_s^{\text{mgn}}(Y) = 1$. For any $n \in \mathbb{N}$ the margin-dual estimator is either equal to 1, either equal to $\exp\left(-\frac{s-\bar{Y}_n}{s_n}\right)$, depending on the sign of $s - \bar{Y}_n$. Since both expressions converge a.s. to 1, this concludes the proof of the strong consistency.

(ii) According to the c.l.t., we have $\left(\frac{1}{\sqrt{n}}\left(\frac{1}{n}\sum_{i=1}^n\left(Y_i\right) - m\right)\right)_{n \in \mathbb{N}}$ that converges to $\mathcal{N}(0, \Sigma)$ in distribution, where $m = \frac{\mathbb{E}(Y)}{\mathbb{E}(Y^2)}$. Then, according to the delta-method, since $h$ is differentiable in $m$, we have $\left(\frac{1}{\sqrt{n}}\left(h\left(\frac{1}{n}\sum_{i=1}^n\left(Y_i\right)\right) - h(m)\right)\right)_{n \in \mathbb{N}}$ that converges in distribution to $\mathcal{N}(0, \nabla h(m) \Sigma \nabla h(m)^\top)$. This concludes the proof, since $h(m) = \text{mgn}(Y; \lambda)$ and a.s. there exists $N \in \mathbb{N}$ such that for any $n \ge N$, we have $h\left(\frac{1}{n}\sum_{i=1}^n\left(Y_i\right)\right) = \hat{\text{mgn}}_n$. $\square$

# D Proofs of duality results

This part deals with the proofs of the duality results of Subsection 3. These are mainly proofs dealing with generalized inverse.

## D.1 Equivalence for decision-making

The first two lemmas prove equivalence in Equation (6).

**Lemma 5.** Let $(\mathcal{R}_\alpha)_{0<\alpha<1}$ be a family of risk measures increasing in $\alpha$. Then for all $Y \in V$ and all $(\alpha, s) \in (0, 1) \times \mathbb{R}$, we have $\mathcal{R}_\alpha(Y) \le s \implies \mathcal{P}_s(Y) \le 1 - \alpha$ where $\mathcal{P}$ is the dual risk measure of the risk measure $\mathcal{R}$.

*Proof.* Let $Y \in V$ and $(\alpha, s) \in (0, 1) \times \mathbb{R}$ such that $\mathcal{R}_\alpha(Y) \le s$. Then $\alpha \in \{\beta \in (0, 1) : \mathcal{R}_\beta(Y) \le s\}$, hence by definition $\alpha \le \mathcal{R}_Y^{-1}(s)$ i.e., $1 - \alpha \ge \mathcal{P}_s(Y)$, which concludes the proof. $\square$

**Lemma 6.** Let $(\mathcal{R}_\alpha)_{0<\alpha<1}$ be a family of risk measures increasing and left-continuous in $\alpha$. Then for all $Y \in V$ and all $(\alpha, s) \in (0, 1) \times \mathbb{R}$, we have $\mathcal{P}_s(Y) \le 1 - \alpha(Y) \implies \mathcal{R}_\alpha(Y) \le s$, where $\mathcal{P}$ is the dual risk measure of the risk measure $\mathcal{R}$.

*Proof.* Let $Y \in V$ and $(\alpha, s) \in (0, 1) \times \mathbb{R}$ such that $\mathcal{P}_s(Y) \le 1 - \alpha$. Then $\alpha \le \mathcal{R}_Y^{-1}(s)$. Since $\alpha \mapsto \mathcal{R}_\alpha(Y)$ is increasing, we have $\mathcal{R}_\alpha(Y) \le \mathcal{R}_{\mathcal{R}_Y^{-1}(s)}$. Since $\alpha \mapsto \mathcal{R}_\alpha(Y)$ is left-continuous, we have $\mathcal{R}_{\mathcal{R}_Y^{-1}(s)}(Y) \le s$. Indeed, by definition, there exists an approximate sequence $(\alpha_n)_{n \in \mathbb{N}} \in \{\beta \in (0, 1) : \mathcal{R}_\beta(Y) \le s\}^\mathbb{N}$ that converges and is lesser or equal to $\mathcal{R}_Y^{-1}(s)$. Hence $\mathcal{R}_{\alpha_n}(Y) \le s$ and, by left-continuity, the first term converges to $\mathcal{R}_{\mathcal{R}_Y^{-1}(s)}(Y)$. This concludes the proof. $\square$
## D.2 Regularity of the dual risk measure

The following proposition deals with the regularity of the dual risk measure of a risk measure. The lemmas are used to prove Proposition 22.

**Lemma 7.** Let $(\mathcal{R}_\alpha)_{0<\alpha<1}$ be a family of risk measures defined on a subspace and increasing with respect to $\alpha$. Then for all $Y \in V$, the function $s \mapsto \mathcal{R}_Y^{-1}(s)$, where $\mathcal{R}_Y^{-1}$ is defined in definition 13, is increasing.

*Proof.* For any $s \in \mathbb{R}$ and $Y \in V$, we note $E_s = \{\alpha \in (0,1) : \mathcal{R}_\alpha(Y) \le s\}$. Let $s_1 \le s_2$, then $E_{s_1} \subset E_{s_2}$ and hence $\sup E_{s_1} \le \sup E_{s_2}$. $\square$

**Lemma 8.** Let $(\mathcal{R}_\alpha)_{0<\alpha<1}$ be a family of risk measures defined on a subspace and increasing with respect to $\alpha$. Then, for all $s_* \in \mathbb{R}$, we have $\inf_{s>s_*} \mathcal{R}_Y^{-1}(s) = \mathcal{R}_Y^{-1}(s_*)$.

*Proof.* Using the monotony from Lemma 7, we have that $\inf_{s>s_*} \mathcal{R}_Y^{-1}(s) \ge \mathcal{R}_Y^{-1}(s_*)$. Let $(s_n)_{n \in \mathbb{N}}$ be a decreasing sequence that converges to $s_*$. Then using the monotony, we have that $(\mathcal{R}_Y^{-1}(s_n))_{n \in \mathbb{N}}$ is a decreasing sequence bounded below by $\mathcal{R}_Y^{-1}(s_*)$, hence it converges to some limit $\alpha_* \ge \mathcal{R}_Y^{-1}(s_*)$. Let assume that $\alpha_* > \mathcal{R}_Y^{-1}(s_*)$. By definition, $\forall s \in \mathbb{R}, \forall \varepsilon > 0$, $\mathcal{R}_{\mathcal{R}_Y^{-1}(s)-\varepsilon}(Y) \le s < \mathcal{R}_{\mathcal{R}_Y^{-1}(s)+\varepsilon}(Y)$. Let consider $\varepsilon = \frac{1}{2}(\alpha_* - \mathcal{R}_Y^{-1}(s_*)) > 0$. Then for any $n \in \mathbb{N}$, we have $\mathcal{R}_Y^{-1}(s_*) + \varepsilon \le \mathcal{R}_Y^{-1}(s_n) - \varepsilon$. Therefore, $s < \mathcal{R}_{\mathcal{R}_Y^{-1}(s_*)+\varepsilon}(Y) \le \mathcal{R}_{\mathcal{R}_Y^{-1}(s_n)-\varepsilon}(Y) \le s$, which is a contradiction. Hence, $(\mathcal{R}^{-1}(s_n))_{n \in \mathbb{N}}$ converges to $\mathcal{R}_Y^{-1}(s_*)$. Thus, $\inf_{s>s_*} \mathcal{R}_Y^{-1}(s) \le \mathcal{R}_Y^{-1}(s_*)$. $\square$

**Proposition 22.** Let $(\mathcal{R}_\alpha)_{0<\alpha<1}$ be a family of risk measures defined on a subspace and increasing with respect to $\alpha$. Let $(P_s)_{s \in \mathbb{R}}$ be its dual risk measure. Then for all $Y \in V$, the function $s \mapsto P_s(Y)$ is increasing and right-continuous.

*Proof.* We will prove the results on $\mathcal{R}_Y^{-1}$ and the results on $\mathcal{P}$ will follow since $\mathcal{P}(Y) = 1 - \mathcal{R}_Y^{-1}(\cdot)$. For any $s \in \mathbb{R}$, we note $E_s = \{\alpha \in (0,1) : \mathcal{R}_\alpha(Y) \le s\}$. The monotony is straightforward using Lemma 7. Let us prove the right-continuity. Let $s_* \in \mathbb{R}$ and $\varepsilon > 0$. Using Lemma 8, we have $\inf_{s>s_*} \mathcal{R}_Y^{-1}(s) = \mathcal{R}_Y^{-1}(s_*)$. Hence, there exists $s_0 > s_*$ such that $\mathcal{R}_Y^{-1}(s_*) \le \mathcal{R}_Y^{-1}(s_0) \le \mathcal{R}_Y^{-1}(s_*) + \varepsilon$. Thus, for all $s \in [s_*, s_0]$, we have $|\mathcal{R}_Y^{-1}(s) - \mathcal{R}_Y^{-1}(s_*)| \le \varepsilon$. $\square$

## D.3 Risk measure from its dual risk measure

This paragraph deals with the proof of Proposition 14.

**Lemma 9.** Let $(\mathcal{R}_\alpha)_{0<\alpha<1}$ be a family of risk measures defined on a subspace and increasing with respect to $\alpha$. We assume that for all $Y \in V$ the function $\alpha \mapsto \mathcal{R}_\alpha(Y)$ is left-continuous. Then for all $Y \in V$ and all $s \in \mathbb{R}$, we have $\mathcal{R}_{\mathcal{R}_Y^{-1}(s)}(Y) \le s$.

*Proof.* Let $s \in \mathbb{R}$ and $Y \in V$. By definition of $\mathcal{R}_Y^{-1}(s)$, there exists $(\alpha_n)_{n \in \mathbb{N}} \in (0,1)^N$ that converges to $\mathcal{R}_Y^{-1}(s)$ and such that $\forall n \in \mathbb{N}, \mathcal{R}_{\alpha_n}(Y) \le s$. Then for any $n \in \mathbb{N}$, we have $\alpha_n \le \mathcal{R}_Y^{-1}(s)$. Since, $\alpha \mapsto \mathcal{R}_\alpha(Y)$ is left-continuous, we have $(\mathcal{R}_{\alpha_n}(Y))_{n \in \mathbb{N}}$ that converges to $\mathcal{R}_{\mathcal{R}_Y^{-1}(s)}(Y)$. We can conclude by going to the limit in inequality $\mathcal{R}_{\alpha_n}(Y) \le s$. $\square$

*Proof of Proposition 14.* Let $Y \in V$ and $0 < \alpha < 1$. We note $E_\alpha = \{s \in \mathbb{R} : 1 - \alpha \ge P_s(Y)\}$. First, $\mathcal{R}_\alpha(Y)$ is a lower bound of $E_\alpha$. Indeed, let $s \in E_\alpha$. Then $1 - \alpha \ge P_s(Y) = 1 - \mathcal{R}_Y^{-1}(s)$, and hence $\alpha \le \mathcal{R}_Y^{-1}(s)$. Thus, using the fact that $\beta \mapsto \mathcal{R}_\beta(Y)$ is increasing and Lemma 9, we have $\mathcal{R}_\alpha(Y) \le \mathcal{R}_{\mathcal{R}_Y^{-1}(s)}(Y) \le s$. Last, $\mathcal{R}_\alpha \in E_\alpha$. Indeed, $P_{\mathcal{R}_\alpha(Y)}(Y) = 1 - \sup\{\beta \in \mathbb{R} : \mathcal{R}_\beta(Y) \le \mathcal{R}_\alpha(Y)\} \le 1 - \alpha$. $\square$

## D.4 Dual properties

In Subsection 3.3, the notion of "dual property" is defined. This paragraph aims at proving the mathematical statement of the dual properties.