= Cryptographic distinguishing advantage
{title2=$\operatorname{Adv}$}
\b[Cryptographic distinguishing advantage] measures how differently a specified test behaves on two distributions or experiments. For a binary-output distinguisher $D$ and distributions $X,Y$, one common definition is
$$
\Delta_D(X,Y)=\left|\Pr[D(X)=1]-\Pr[D(Y)=1]\right|.
$$
A <cryptographic security game> must state its convention and the allowed computation and observations. <Provable security> uses such quantitative bounds together with the resources required by a <security reduction>.<Practice-Oriented Provable-Security by Mihir Bellare>[§§2.2 and 3.2, reductions and concrete security]{ref}
An original two-world example explains a common normalization difference. Let $X$ be a bit equal to one with probability $3/4$, and $Y$ a bit equal to one with probability $1/4$. The test $D(x)=x$ has $\Delta_D=1/2$. If a challenger selects the world with equal prior probability and the observer guesses X on output one and Y on output zero, its success probability is $3/4$. Its advantage above random guessing is $1/4$, half the probability-gap convention.
In general, orienting the decision rule toward the larger probability gives
$$
\Pr[\text{correct world guess}]=\frac{1+\Delta_D}{2}.
$$
Thus a statement of advantage $0.02$ can mean either a probability gap of $0.02$ or a success probability $0.52$, depending on the convention. The numerical security claim is incomplete until that choice is specified.
If every event test is allowed, the largest probability gap is <total variation distance>. Restricting the distinguisher to an efficient algorithm yields a computational notion: distributions can differ substantially statistically while being difficult for a resource-bounded observer to distinguish. <Computational indistinguishability> describes the asymptotic version indexed by a <cryptographic security parameter>.
For any fixed $D$, adding and subtracting its intermediate acceptance probability gives
$$
\Delta_D(X_0,X_2)\leq\Delta_D(X_0,X_1)+\Delta_D(X_1,X_2).
$$
For example, bounds $0.003$ and $0.004$ on two successive changes give an overall bound $0.007$. This simple triangle inequality explains how a sequence of controlled experiment changes can support a security argument. The distributions, permitted observers and resource costs must remain the ones justified at each step.
Back to article page
