What does a total-energy budget over a forecaster's input window permit that a per-step cap forbids?

## Two bounds, two shapes Take a short-horizon forecaster whose input is a rolling window of the last `T` steps of recent market history -- posted quantities and quoted prices that the market's own participants supply. An adversary here is an enrolled participant who can write into that window by posting. The question is what bound you place on what they write, and the answer is not a single number. **A per-coordinate cap** (an L-infinity ball of radius `c`) says: no step of the window may move by more than `c`. It says nothing about how many steps move. All `T` of them may move by `c`, in the same direction. The window's mean then shifts by the whole `c`, and anything the model aggregates over the horizon shifts by roughly `c` times `T`. No single point of the series ever looks unusual, because none of them is. **A total-energy bound** (an L-2 ball of radius `r`) says: the squared changes must sum to no more than `r` squared. That allowance can be spent any way at all. Put it on one step and that step moves by the full `r` -- a spike. Spread it evenly and each step moves by about `r` divided by the square root of `T`, which for a window of a few dozen steps is a small fraction of `r`. So at the *same numeric value*, the two bounds buy very different attacks: the cap buys persistence, the energy bound buys concentration. Neither is the strict weakening of the other, and there is no ordering that makes one "a bit stricter". ## Why the shape decides whether anyone notices A concentrated change is the one a monitoring pipeline is already built for: outlier filters, range checks and plausibility rules on a single reading exist and will fire. A coherent small shift across the whole window is the one nothing fires on, because every value is individually ordinary and only their *joint* direction is not. If you bound an attacker by a per-coordinate cap because it sounds conservative, you have licensed exactly the shape your monitoring cannot see -- and quietly declared a bias across the entire window to be negligible. That is the silent permission worth naming. A change that the radius describes as tiny is not tiny at the decision. A forecast that is biased by a small amount across the whole horizon commits capacity or settles money differently, and "the perturbation was within a small radius" is not an answer to "how much did the decision move". ## The unit problem inside one window A window like this rarely carries one kind of number. Quantities in energy units and prices in currency sit in the same vector, and models usually standardize before consuming them. A single radius applied to the standardized window then means "this many standard deviations" for every coordinate -- which is a *different* real-world allowance for each, set by how wide that coordinate's historical spread happens to be. A coordinate that is normally stable receives a tight physical allowance; a coordinate that is normally volatile receives a large one. Nobody chose that ranking; it fell out of the data's variance. The same trap appears in reverse when the radius is quoted in raw units. A radius that is small for a price is enormous for a quantity, or vice versa, and one number cannot be small for both. The honest treatments are: bound each unit group separately in its own units, or express the radius per coordinate as a fraction of that coordinate's own legal range, and state the mapping either way. What you cannot do is state one standardized number and let readers assume it is uniformly modest. ## Sign, granularity and reachability One more asymmetry: real postings are sign-constrained and granular. A ball is symmetric and continuous, so part of it corresponds to values nobody can post, and some values anyone may legally post lie outside it. The ball is an approximation of the reachable set in both directions at once, which is why the bound should be stated together with the coordinates it applies to, not as a free-floating number. ## The short version Over a window, the norm decides the *shape* of the permitted change; the radius decides its size in whatever units the model consumes. Persistence and concentration are different attacks with different detection profiles and different costs at the decision, and quoting one number without saying which shape it permits tells the reader nothing about either.