On the Fundamental Limits of Security Detection: A Theory of Distinguishability Collapse

Behavioral detection asks whether a given detector can tell malicious from legitimate activity. We argue the prior question is whether the observable channel contains a separation for any detector to exploit, and recast detection as the geometry of the attack class relative to the legitimate distribution — the presupposition of which the anomaly-detection model of Denning [1987] is an early and influential instance. For a detection problem (S, PL, F) — an observable space, a legitimate distribution, and a class of functionally valid, physically realizable attack distributions — informational detectability is governed by two distances: the pairwise separation Δpair = d(PL, F) and the robust separation Δrob = d(PL, conv TV(F)), with Δrob ≤ Δpair. Their gap is the security reading of a classical minimax phenomenon: individual separability need not survive adversarial mixing [Huber and Strassen 1973; Le Cam 1973]. The first distance decides whether the class retains a uniformly positive per-attack separation; the second, via least-favorable mixtures and under standard minimax regularity, decides whether any single detector holds a uniform margin against the composite class — and the collapse branch of both is unconditional at the informational level, holding against unbounded computation. A class can thus collapse robustly while every pure attack stays individually detectable — a convex collapse. On a content-only channel we then separate four claims that a single “the semantic layer collapses” conflates: an unconditional identical-observation invariance; an unconditional dual-use false-positive floor; a conditional semantic indistinguishability that holds only given entry into the effect region; and global distributional collapse, which the interpretive type of an effect does not by itself force. No improvement on the detector side changes the regime; only enriching the observable, constraining the attack class, or redesigning the protocol that generates both can. Generative AI enters not as a hypothesis of the theorems but as a mechanism that can expand the operationally reachable attack set, with empirical evidence consistent with the collapse branch being entered in a widening range of the digital ecosystem — a per-domain, falsifiable claim rather than a theorem. We claim no absolute permanence, no exact complexity threshold, and no global semantic impossibility from a single ambiguous observable.