Robust Instrumental Variables: Sharp Rates and Inference under Adversarial Contamination

Robust Instrumental Variables: Sharp Rates and Inference under Adversarial Contamination

}

Introduction

Instrumental variables methods are among the central tools of empirical economics, but the usual two-stage least squares (2SLS) estimator is built from ordinary sample averages of the IV moments. This makes 2SLS vulnerable in precisely the situations in which empirical IV designs are often used: samples with high leverage observations, heavy-tailed outcomes or instruments, or a small number of influential observations. The practical relevance of this fragility has been documented in young2022consistency, (cf. also young2019channeling) who re-analyzed 1{,}309 2SLS regressions published in the AER and other AEA journals. He found that deleting just two (out of sometimes thousands of) observations can turn 58% of 0.05 significant 2SLS results insignificant. Similarly, 57% of 0.05 insignificant results can be rendered significant by deleting just two observations or clusters. The changes can be extraordinary, with $p$-values moving from close to zero to close to one, and vice-versa.

Furthermore, the contamination or manipulation of the data may be strategic: In economics, the “data-generating process” often passes through firms, schools, hospitals, banks, governments, customs agents, or respondents whose payoff depends on what they report. Many papers have observed the prevalence of potentially data-dependent strategic manipulation. For example, angrist2017small observed how standardized test scores in Southern Italy were manipulated and that smaller class sizes increased this manipulation; angrist2019maimonides revealed enrolment manipulation near Maimonides' rule cut-offs used to determine class sizes in Israeli schools, implying that the instrument itself can be contaminated; camacho2011manipulation and miller2013risk documented strategic manipulation exactly at eligibility thresholds for welfare programs in Colombia which was particularly pronounced around local elections; duflo2013truth showed how auditors paid by firms systematically reported the firm's emissions just below the regulatory standard, although true emissions were typically higher. Further evidence for (strategically) contaminated data can be found in jacob2003rotten, fisman2004tax, dafny2005hospitals, dee2019causes, geruso2020upcoding, martinez2022much, brodeur2016star.\footnote{brodeur2016star is an example of the (well-known) fact that researchers themselves may have an incentive to misreport or manipulate their results in response to, e.g., publication incentives.}

These examples show that the manipulation is often not random, but can depend on the clean data (e.g. the true test scores, true income levels, or true amounts of pollution), which is unobservable to the researcher. In addition, the manipulated data can be perfectly plausible, perhaps to disguise the manipulation, and therefore need not be a visually obvious outlier. Therefore, it is desirable to have statistical procedures that are simultaneously i) robust to a broad range of potentially strategic contaminations of the data and ii) provably precise under the weakest possible assumptions on the amount of contamination.

In this paper we study an instrumental variable setting under adversarial contamination. Under adversarial contamination, which is formally introduced Section (ref), an adversary is allowed to inspect the clean data and change up to a fraction $\eta_n$ of the observations, with $n$ being the sample size.\footnote{As the adversary is a statistical device rather than a literal malicious actor, there need not be one adversary contaminating the data. For example, there could be multiple school principals altering grades to achieve a threshold passing rate in each of their school's.} The identity of the observations that are altered and the values that these are changed to can (but need not) depend on the clean data, which only the adversary observes.\footnote{For example, the adversary may manipulate observations so that as many test scores as possible fall above a desired threshold. To decide which scores to alter, the adversary must clearly inspect the full set of true test scores implying that this contamination rule is a function of the clean data.} The adversary then returns the contaminated data to the researcher. Any feasible statistical procedure is a function of the contaminated data. The fact that adversarial contamination allows the adversary to perform data-dependent manipulation is crucial to handle the above examples of strategic manipulation and sets it apart from the classic Huber contamination model in robust statistics. Due to this flexibility, adversarial contamination has become a popular robustness framework in machine learning and mathematical statistics, cf. e.g., lai2016agnostic, cheng2019high, diakonikolas2019robust, hopkins2020robust, LM21, minsker2021robust, bhatt2022minimax, depersin2022robust, dalalyan2022all, minasyan2023statistically, diakonikolas2023algorithmic, minsker2023efficient, oliveira2025finite.

To achieve robustness to adversarial contamination, we propose replacing the fragile sample averages in the classic 2SLS estimator by the winsorized means recently studied in Wins1 where the winsorization points are carefully chosen order statistics of the contaminated data. Thus, the resulting winsorized (W-2SLS) estimator is a simple robustification of the classic one. In a setting wherein the adversary is allowed to arbitrarily alter up to a fraction $\eta_n$ (equivalently up to a number $q_n=\eta_nn$) of the observations, we show that the W-2SLS estimator taking the contaminated data as input is suitably close to the classic 2SLS estimator taking the clean data as input, the distance depending on $\eta_n$ and the number of moments $m$ that the clean data possesses. Based on this, we show that W-2SLS

Thus, we establish consistency, $\sqrt{n}$-convergence, and standard Gaussian inference under the weakest possible conditions on the allowed fraction of contaminated observations. That is, we characterize exactly the boundary below which one can conduct inference under contamination as if one had access to the clean data, but above which this is not possible. Put differently, we show when and how one gets robustness for free.

Special care is needed in constructing a positive semi-definite consistent heteroskedasticity-robust estimator of the asymptotic covariance matrix (which is built from population moments of the clean data) based on the observed contaminated data. Specifically, one cannot directly use standard methods based on the empirical error terms and sample-average based constructions are clearly ruled out in the presence of contamination. We also provide a robustifed version of the Anderson-Rubin (AR) test that replaces sample averages by suitably winsorized averages. This winsorized AR-test is shown to be valid under no/weak identification, adversarial contamination, and heteroskedasticity if $\sqrt{n}\eta_n^{1-\frac1m}\to 0$.

Finally, we study the finite sample (fixed $n$) deviation properties of the 2SLS and W-2SLS estimators in a setting of bounded second moments and strong identification. We show that even absent contamination, the 2SLS estimator must have a uniform deviation radius that can be very large by establishing lower bounds on it. This means that any interval of half-length $t$ centered at the 2SLS estimator that contains the true parameter with probability at least $1-\delta$, must have $t=t_\delta$ growing as rapidly as $\sqrt{\delta^{-1}}$ in $\delta$ as $\delta\to 0$. This fact is driven by the poor concentration properties of sample averages already exhibited in catoni2012challenging. Our finite-sample study provides a theoretical foundation for the observation in young2022consistency that “2SLS may be prized for its asymptotic consistency, but in finite samples it often allows for very little inference.” On the other hand, we show that the uniform deviation radius of the W-2SLS grows much slower, $\sqrt{\log(\delta^{-1})}$, in $\delta$ as $\delta\to 0$ than the lower bound on that of the 2SLS estimator. Thus, intervals centered at W-2SLS containing the true parameter with probability at least $1-\delta$ can be much shorter than those based on classic 2SLS.

Related literature

Classical robust IV and GMM work develops resistant, bounded-influence, or high-resilience procedures; see krasker1985resistant, krasker1986two, krishnakumar1997robust, wagenvoort2002b, kim2007two, and zhelonkin2012robustness. ronchetti2001robust quantify local asymptotic distortions of the level and power of GMM tests, vcivzek2016generalized develops a high-breakdown generalized method of trimmed moments, and kitamura2013robustness construct an asymptotically minimax-robust and model-efficient estimator under shrinking neighborhoods of moment-restriction models. cohen2013natural is closest in terms of estimator construction: it robustifies ordinary IV using multivariate location and scatter $S$-estimates and establishes high resilience, bounded influence, consistency, and asymptotic normality. jiao2019simple studies residual-trimmed 2SLS and compares its efficiency with ordinary 2SLS.

These papers use different notions of robustness. Local-neighborhood analyses are distributional, so they do not provide guarantees uniform over contamination rules that inspect the realized clean sample before choosing the corrupted observations and their replacement values. High-breakdown analyses allow worst-case replacement when defining the breakdown point, but the cited consistency and asymptotic-normality results are established under clean sampling. None of the papers provides estimation-error or coverage guarantees in the presence of data-dependent contamination.

klooster2024outlier and klooster2024resistant construct bounded-influence AR, K, and CLR procedures. Their asymptotic distributions are established absent contamination and they study local contamination through influence functions and simulations. solvsten2020robust studies a distinct many-instrument problem, combining LIML with winsorization of structural residuals and minimizing worst-case asymptotic variance over a contaminated-normal neighborhood.

rohatgi2022robust and forneron2023occasionally are closest in allowing adversarial contamination and providing quantitative contaminated-sample guarantees. For linear IV, rohatgi2022robust obtain an estimation error bound under strong identification, covariance, hypercontractivity, eighth-moment, and conditional-noise restrictions. Their stated guarantee does not achieve a $n^{-1/2}$ rate. The implementation of their algorithm requires valid supplied identification, scale, parameter-radius, and strictly positive contamination-budget bounds. They do not cover Gaussian or studentized inference, matching lower bounds, or weak-identification-robust inference. Imposing a polynomial envelope on outlying moment contributions, forneron2023occasionally obtains finite-sample bounds and oracle-equivalent asymptotic normality for adversarially contaminated GMM, including IV, while allowing dependent observations.

Our IV focus yields a sharper characterization covering both estimation and inference. Under finite $m$-th moments, W-2SLS is a closed-form, drop-in modification of ordinary 2SLS attaining an estimation-error rate of $n^{-1/2}+\eta_n^{1-1/m}$ under adversarial contamination with unrestricted replacement values. Our matching lower bounds identify the exact contamination thresholds for uniform consistency, uniform root-$n$ consistency, and centered Gaussian inference with the same first-order law as clean-sample 2SLS. We also provide feasible heteroskedasticity-robust inference, develop a winsorized Anderson-Rubin test valid under weak identification and adversarial contamination, establish non-existence of honest confidence sets adaptive to an unknown contamination fraction, and show a finite-sample concentration advantage of W-2SLS over 2SLS even absent contamination. Thus, the paper characterizes not only how to robustify 2SLS, but the exact statistical price of sample-adaptive contamination for estimation and inference.

Adversarial contamination and winsorized 2SLS

Consider a setting with a clean real outcome $y_i$, a $K\times 1$ vector of potentially endogenous clean regressors $x_i$ and an $L\times 1$ vector of clean instruments $z_i$ for $i=1,\hdots,n$ and $L\geq K$.\footnote{All random variables are defined on a measurable space $(\Omega,\mathcal F)$. The probability measure on this space is denoted by $\mathbb{P}$, and expectations with respect to $\mathbb{P}$ are denoted by $\mathbb{E}$.} Throughout, $K$ and $L$ are fixed natural numbers and $n\to\infty$ in all asymptotic statements. We are interested in estimation and inference on $\beta\in\mathbb{R}^K$ in

Writing $V_i=(y_i,x_i', z_i')'\in\mathbb{R}^{1+K+L}$, an adversary inspects the clean sample $V=(V_1,\hdots,V_n)$ and returns a contaminated sample $\tilde{V}_i=(\tilde{y}_i,\tilde{x}_i', \tilde{z}_i')'\in\mathbb{R}^{1+K+L},\ i=1,\hdots,n$ to the researcher. We stress that the researcher only observes the contaminated sample $\tilde{V}=(\tilde{V}_1,\hdots,\tilde{V}_n)$, but not clean $V$. Thus any (feasible) statistical procedure takes the contaminated sample $\tilde{V}$ as input. The identity of the corrupted observations

as well as their values, i.e., the value of $\cbr[0]{\tilde{V}_i}_{i\in \mathcal{O}}$, can (but need not) depend on the uncontaminated $V$ and any other variables (e.g., external randomization) that the adversary but not necessarily the researcher observes.\footnote{The adversary is also allowed to contaminate the error terms $u_i$ for $i=1,\hdots,n$. However, since any statistical procedure can be a function of only the observed $\tilde{V}_i=(\tilde{y}_i,\tilde{x}_i, \tilde{z}_i)$, this is of no relevance.} In particular, $\mathcal{O}$ can be a random subset of $\cbr[0]{1,\hdots,n}$. We stress that the adversary is a device for defining a worst-case guarantee and need not represent a literal malicious actor. This adversarial contamination imposes no restrictions on how the observations are contaminated and is thus well suited to economic data, where contamination need not be random: influential observations may reflect selective reporting, strategic mismeasurement, coding choices, survey manipulation, or institutional features that affect precisely those units with high leverage. In contrast to the classical Huber model, which treats contamination as arising from a fixed mixture mechanism, adversarial contamination allows both the identities and the values of the contaminated observations to depend on the clean sample $V$.

Although no assumptions are imposed on how observations are contaminated, we restrict how many observation can be contaminated. To be precise, we assume that at most $\eta_n n$ of $V_1,\hdots,V_n$ are changed, that is

where $\eta_n \in [0, 1]$ is non-random. We stress that $\eta_n$ is a researcher-specified robustness budget, not the unknown realized fraction $|\mathcal{O}|/n$ of altered observations. Equivalently, the robustness budget may be specified as an integer $q_n$: setting $\eta_n=q_n/n$ protects against arbitrary alterations of at most $q_n$ observations.

It is tempting to require $\eta_n$ in (ref) large in order to be robust against many contaminated observations. However, Theorem (ref) below shows that confidence sets for $\beta$ with uniform coverage guarantees must have a diameter that depends on the largest fraction of contaminated observations $\eta_n$ that one wishes the confidence sets to maintain coverage guarantees under. Thus, any procedure must explicitly or implicitly take a stance on $\eta_n$ --- the usual clean-data validity guarantees for 2SLS or the Anderson-Rubin test correspond to the benchmark $\eta_n=0$.

The conditions we impose on $\eta_n$ below depend on the statistical objective: consistency of an estimator, $\sqrt{n}$-convergence, or first-order Gaussian inference with the same law as under clean sampling. Section (ref) proves that for each of these, the assumptions that we impose on $\eta_n$ are the weakest possible by providing matching lower bounds. Finally, we stress that, under the conditions of Theorem (ref), protection against any fixed number $q_n$ of contaminated observations is asymptotically free at first order, which is already relevant in light of young2022consistency.

The winsorized 2SLS estimator

The classic 2SLS estimator of $\beta$ in (ref) is (cf., e.g., Chapter 5 in wooldridge2010econometric)

where $y=(y_1,\hdots,y_n)'$, $X=(x_1,\hdots, x_n)'$, and $Z=(z_1,\hdots,z_n)'$ (grant all expressions are well-defined). Observe that $\hat{\beta}_{n,\text{2SLS}}$ has been defined as a function of the uncontaminated data $V$. Since it is based on plain sums, it is highly non-robust as these sums can be manipulated to take any value by changing just one of the summands. We now introduce the winsorized 2SLS estimator and provide conditions under which it is close to the infeasible $\hat{\beta}_{n,\text{2SLS}}$.

Our winsorized 2SLS estimator simply replaces the non-robust sample averages entering the definition of the 2SLS estimator in (ref) by quantile-winsorized means. To make this precise, for real numbers $s_1,\hdots,s_n$, denote by $s_1^*\leq \hdots\leq s_n^*$ their non-decreasing rearrangement. Let $-\infty<\alpha\leq\beta<\infty$ and define $\phi_{\alpha,\beta}:\mathbb{R}\to [\alpha,\beta]$ as

Now, for $\varepsilon_n\in(0,1/2]$, define the quantile-winsorized mean $\mu_{\varepsilon_n}:\mathbb{R}^n\to [\alpha,\beta]$ as

Thus, $\mu_{\varepsilon_n}(s_1,\hdots,s_n)$ is the ordinary arithmetic mean after replacing observations below the empirical $\varepsilon_n$-quantile by that quantile and observations above the empirical $(1-\varepsilon_n)$-quantile by that quantile. Given the contaminated sample $\tilde{V}$, let $W_{ZX}$, $W_{ZZ}$, and $W_{Zy}$ be the $L\times K$, $L\times L$ and $L\times 1$ matrices with entries

The winsorized 2SLS estimator now replaces the non-robust $Z'X/n$, $Z'Z/n$ and $Z'y/n$ entering construction of $\hat{\beta}_{n,\text{2SLS}}$ by $W_{ZX}$, $W_{ZZ}$, and $W_{Zy}$, respectively, that is:\footnote{The proof of Proposition (ref) establishes that $W_{ZZ}$ and $W_{ZX}'[W_{ZZ}]^{-1}W_{ZX}$ are invertible for $n$ sufficiently large. We set $\hat{\beta}_{n,\text{W-2SLS}}=0_K$ when either of $W_{ZZ}$ and $W_{ZX}'[W_{ZZ}]^{-1}W_{ZX}$ is not invertible.}

$\hat{\beta}_{n,\text{W-2SLS}}$ has exactly the same structure as $\hat{\beta}_{n,\text{2SLS}}$, but uses the robust winsorized $\mu_{\varepsilon_n}$ instead of sample averages and takes the contaminated $\tilde{V}$ as input instead of the clean $V$.

When allowing up to $\eta_n n$ observations to be contaminated, it is clear that even $\hat{\beta}_{n,\text{W-2SLS}}$ can perform poorly unless at least the smallest and largest $\eta_n n$ observations are winsorized in (ref). Thus, one must choose $\varepsilon_n> \eta_n$, implying in particular that $\eta_n\leq1/2$ must hold. It is also clear that winsorizing substantially more than $\eta_nn$ observations is wasteful and we shall establish that $\hat{\beta}_{n,\text{W-2SLS}}$ with

has several optimality properties. Since $\eta_n\to 0$ in all asymptotic statements, it holds that $\varepsilon_n\to 0$ implying that $\varepsilon_n\in(0,1/2]$ eventually.

Assumption (ref) imposes classic textbook assumption used to establish positive results on the clean-data 2SLS estimator, cf., e.g., wooldridge2010econometric. In Theorem (ref) and onwards, we also impose $\mathbb{E}(z_{1}u_1)=0$, but Proposition (ref) does not need it.

When is robustness for free?

We first show that the winsorized 2SLS estimator $\hat{\beta}_{n,\text{W-2SLS}}(\tilde{V})$ based on the contaminated data is close to the infeasible ordinary 2SLS estimator $\hat{\beta}_{n,\text{2SLS}}(V)$ based on the clean data. Let $||\cdot||$ denote the Euclidean norm on $\mathbb{R}^K$.

Proposition (ref) shows that the difference between $\hat{\beta}_{n,\text{W-2SLS}}$ and $\hat{\beta}_{n,\text{2SLS}}$ converges to zero in probability when $\eta_n\to 0$. Because

and

it follows that $\hat{\beta}_{n,\text{W-2SLS}}(\tilde{V})$ is consistent in the presence of a moderate amount of contamination ($\eta_n\to 0$) if and only if $\hat{\beta}_{n,\text{2SLS}}(V)$ is consistent on the clean sample. Thus, in the sense of consistency, one obtains robustness of the winsorized 2SLS estimator for free if $\eta_n\to 0$.

The following theorem also imposes $\mathbb{E}(z_{1}u_1)=0$ and shows that not only the probability limit, but also the rate of convergence of $\hat{\beta}_{n,\text{W-2SLS}}$ to $\beta$ is the same $\sqrt{n}$-rate as that of the infeasible $\hat{\beta}_{n,\text{2SLS}}$ if $\eta_n^{1-\frac1m}\lesssim n^{-1/2}$.\footnote{For non-negative real sequences $(a_n)_{n\in\mathbb{N}}$ and $(b_n)_{n\in\mathbb{N}}$, $a_n\lesssim b_n$ means that there exists a $C>0$ such that $a_n\leq Cb_n$ for $n$ suffiently large.}

Theorem (ref) shows that absent contamination, i.e. when $\eta_n=0$, $\hat{\beta}_{n,\text{W-2SLS}}$ has the same $\sqrt{n}$-convergence rate as the infeasible $\hat{\beta}_{n,\text{2SLS}}$. More importantly, this convergence rate is achieved as long as $\eta_n^{1-\frac1m} \lesssim n^{-1/2}$. Thus, below this threshold one obtains robustness for free in the rate-of-convergence sense. If $\eta_n^{1-\frac1m} \gtrsim n^{-1/2}$, then $\hat{\beta}_{n,\text{W-2SLS}}$ is still consistent at rate $\eta_n^{1-\frac1m}$ if $\eta_n\to 0$. Theorem (ref) below provides the corresponding uniform lower bound showing that no estimator can have a uniform convergence rate with a better dependence on $\eta_n$ than $\eta_n^{1-\frac1m}$. Since the usual parametric $n^{-1/2}$ rate is already unimprovable in the uncontaminated scalar location model, the rate $\eta_n^{1-\frac{1}{m}}+n^{-1/2}$ achieved by $\hat{\beta}_{n,\text{W-2SLS}}$ is minimax sharp. In particular, no estimator can be uniformly consistent if $\limsup_{n\to\infty}\eta_n>0$ and the condition $\eta_n\to 0$ in Theorem (ref) is therefore necessary for the existence of a uniformly consistent estimator.

Proposition (ref) with $m>2$ and $\sqrt{n}\eta_n^{1-\frac1m}\to 0$ also implies the asymptotic equivalence

Hence, $\sqrt{n}\del[1]{\hat{\beta}_{n,\text{W-2SLS}}-\beta}$ and $\sqrt{n}\del[1]{\hat{\beta}_{n,\text{2SLS}}-\beta}$ have the same limiting distribution whenever the 2SLS estimator based on the clean data has one.

Theorem (ref) shows when robustness is for free in the first-order asymptotic sense: If $\sqrt{n}\eta_n^{1-\frac1m}\to 0$ then $\hat{\beta}_{n,\text{W-2SLS}}$ has exactly the same asymptotic distribution as $\hat{\beta}_{n,\text{2SLS}}$ based on the clean sample. Hence the price of robustness is zero in this regime: the confidence sets have the same asymptotic size as clean 2SLS confidence sets, while W-2SLS remains consistent under an arbitrary but vanishing fraction of observations, allowing the number of such observations to grow with the sample size.

By Theorem (ref) below, the condition $\sqrt{n}\eta_n^{1-\frac1m}\to 0$ in Theorem (ref) is necessary for the $\sqrt{n}$-scaled error of any estimator to converge uniformly in distribution to a mean-zero non-degenerate normal distribution. That is, $\sqrt{n}\eta_n^{1-\frac1m}\to 0$ is the weakest possible condition on $\eta_n$ for conducting inference as if no contamination were present.

Recall that young2022consistency showed that deleting $q_n=2$ observations can overturn a large share of nominally (in)significant 2SLS results. This is exactly the regime where $\eta_n=q_n/n$ is small, yet empirically important. If $\eta_n=q/n$ for some fixed $q\in\cbr[0]{0}\cup \mathbb{N}$, then $\sqrt{n}\eta_n^{1-\frac1m}=q^{1-\frac1m}\cdot n^{-\frac12+\frac1m}\to 0$, implying that the conditions of Theorem (ref) are satisfied for all $m>2$.

Estimating $\Omega$, hypothesis testing, and confidence intervals

To conduct feasible inference based on the Gaussian approximation to the distribution of $\sqrt{n}\del[1]{\hat{\beta}_{n,\text{W-2SLS}}-\beta}$ in Theorem (ref), a consistent estimator of the covariance matrix $\Omega$ is needed. We now construct a consistent positive semi-definite estimator of $\Omega$ taking the contaminated data as input.

In the presence of contamination, it is clear that estimators based on plain sample averages are ruled out. Note also that already for the purpose of estimating the variance $\sigma^2=\mathbb{E}(u_1^2)$ of the $u_i$ absent contamination, the usual consistency argument for $n^{-1}\sum_{i=1}^n\hat{u}_i^2$ where $\hat{u}_i=y_i-x_i'\hat{\beta}_{n,\text{2SLS}}$ relies heavily on the linearity of the arithmetic mean: Specifically, using that $\hat{u}_i=u_i-x_i'(\hat{\beta}_{n,\text{2SLS}}-\beta)$ such that

implying that consistency of $n^{-1}\sum_{i=1}^n\hat{u}_i^2$ follows from the first average on the right-hand side converging to $\sigma^2$ and the two last ones to zero. However, writing $\hat{\tilde{u}}_i=\tilde{y}_{i}-\tilde{x}_i'\hat{\beta}_{n,\text{W-2SLS}}$ for the contaminated residuals based on the robust estimator $\hat{\beta}_{n,\text{W-2SLS}}$ and letting $\tilde{u}_i:=\tilde{y}_{i}-\tilde{x}_i'\beta$, the non-linearity of the winsorization function $\phi_{\alpha,\beta}$ defined in (ref) implies that the previous decomposition does not apply to $\mu_{\varepsilon_n}(\hat{\tilde{u}}_1^2,\hdots,\hat{\tilde{u}}_n^2)$, making this candidate estimator difficult to analyze. The same difficulty remains when estimating the component $\Omega_S:=\mathbb{E}(u_1^2z_1z_1')$ of the covariance matrix $\Omega=A\Omega_SA'$ instead of “just” $\sigma^2$.

Our solution is to avoid winsorizing the generated residuals $\hat{\tilde{u}}_i$. To be precise, for $b$ being a $K\times 1$ vector and $\otimes$ denoting the Kronecker product, let

Similarly, $w_i=(y_i,x_i')'$ and $h_i=z_i\otimes w_i$ such that (by the mixed product property of Kronecker products)

implying that

Thus, since $\hat{\beta}_{n,\text{W-2SLS}}$ converges to $\beta$ in probability under the conditions of Theorem (ref) and $b\mapsto \mathfrak{P}(b)$ is continuous, it suffices to exhibit a consistent and positive semidefinite estimator of $\Xi=\mathbb{E}(h_1h_1')$ based on the contaminated $\tilde{h}_i$ in order to estimate $\Omega_S$ consistently (and in a positive semi-definite fashion). It would be natural to estimate $\Xi$ entry-by-entry via $\mu_{\varepsilon_n}(\tilde h_{1,j}\tilde h_{1,k},\hdots,\tilde h_{n,j}\tilde h_{n,k})$ for each pair $1\leq j,k\leq L(K+1)$, cf. (ref). However, although consistent for $\Xi$ by Theorem 2.1 in Wins1, this estimator need not be positive semi-definite at every sample size $n$. To solve this issue, we propose the following positive semidefinite estimator of $\Xi$:

Given $s=(s_1,\hdots,s_n)\in\mathbb{R}^n$ and $\varepsilon_n\in(0,1/2]$, let $\phi_i:\mathbb{R}^n\to \mathbb{R}$ be defined as $\phi_i(s)=\phi_{s_{(\lceil \varepsilon_n n\rceil)}^*,s_{(\lfloor(1-\varepsilon_n)n\rfloor)+1}^*}(s_i)$ and let $\hat{\Xi}$ be the $L(K+1)\times L(K+1)$ matrix with entries

Note that $\hat{\Xi}$ is symmetric and positive semi-definite by virtue of being a Gram matrix. Lemma (ref) in the appendix yields the consistency of $\hat{\Xi}$ by showing that each of its entries is close to the consistent entry-by-entry estimator $\mu_{\varepsilon_n}(\tilde h_{1,j}\tilde h_{1,k},\hdots,\tilde h_{n,j}\tilde h_{n,k})$. Now define the plug-in estimators of $\Omega_S$ and $A$ as

and finally define the positive semi-definite estimator of $\Omega$

Theorem (ref) justifies conducting standard asymptotic inference based on a Gaussian approximation even in the presence of contamination when $\sqrt{n}\eta_n^{1-\frac1m}\to 0$. The limiting distribution of $\hat{\Omega}^{-1/2}\sqrt{n}\del[1]{\hat{\beta}_{n,\text{W-2SLS}}-\beta}$ is the same $\mathsf{N}_K(0,I_K)$ as that of the infeasible 2SLS estimator premultiplied by the standard estimator of $\Omega^{-1/2}$.

Optimality of the dependence on $\eta_n$

Section (ref) imposed different conditions on $\eta_n$ for different statistical objectives. We now show that these conditions are the weakest possible in a minimax sense. The condition $\eta_n\to 0$ is necessary for uniform consistency; $\sqrt{n}\eta_n^{1-1/m}=O(1)$ is the threshold for uniform $\sqrt{n}$-consistency; and $\sqrt{n}\eta_n^{1-1/m}\to 0$ is necessary for centered Gaussian inference with the same first-order law as in the uncontaminated model. We then show that honest confidence sets cannot adapt to the unknown contamination fraction; even absent contamination the diameter must depend on the largest fraction $\eta_n$ of contaminated observations that one is willing to entertain.

Specifically, consider the just identified case of $L=K=1$. For any distribution $Q$ of the uncontaminated $R_i=(y_i,x_i,z_i,u_i)$ on $\mathbb{R}^4$ and $R=(R_1,\hdots,R_n)$, let $P_Q$ be a measure on the underlying measurable space $(\Omega,\mathcal{F})$ such that $P_Q\circ R^{-1}=Q^{\otimes n}$.\footnote{This requires that the underlying probability space $(\Omega,\mathcal{F})$ is rich enough to support such $P_Q$, but is without loss of generality for the purpose of the lower bounds in Theorems (ref) and (ref) where, as usual, one can let $(\Omega,\mathcal{F},P_Q)=((\mathbb{R}^{4})^n,\mathcal{B}(\mathbb{R}^{4})^{\otimes n},Q^{\otimes n})$ and let the $R_i$ be the $i$th canonical coordinate projections (onto $\mathbb{R}^4$). This also applies to the constructions in Section (ref).} That is, the $R_i$ are i.i.d. with common distribution $Q$. Let $m\geq 2$ and denote by $\mathcal{Q}_m$ the family of distribution on $\mathbb{R}^{4}$, each element $Q$ of which satisfies for some $\beta(Q)\in[0,1]$ that

Letting $x_i=z_i=1$ with probability one is convenient since it reduces the model (ref) to a location (sub)model for the $y_i$, yet satisfies the relevant conditions of Theorem (ref)--(ref).

Finally, it suffices to consider a specific contamination scheme changing at most $\eta_n n$ of the observations. Specifically, we utilize an adversary who sets as many $y_i$ equaling $1+p_n^{-1/m}$ to one as the contamination budget allows, where $p_n=\eta_n/2$. The adversary leaves all other variables untouched, and does not use external randomization. To be precise, write $N_i(R) ={\sum_{j=1}^i\mathds{1}_{\cbr[0]{y_j=1+p_n^{-1/m}}}}$. Define the measurable (contamination) mapping $\mathsf{C}:(\mathbb{R}^4)^n\to(\mathbb{R}^3)^n$ by $\tilde{V}:=(\tilde{V}_1,\hdots,\tilde{V}_n)=\mathsf{C}(R)$, where

and $\mathsf{C}$ drops the $u_i$ since no statistical procedure can depend on these unobserved quantities. Because $\mathds{1}_{\cbr[0]{N_i(R)\leq \eta_n n}}=0$ if $N_i(R)>\eta_nn$, we note that (ref) is satisfied by construction. The specific form of the contamination $\mathsf{C}$ allows for the construction of $Q_0,Q_1\in\mathcal{Q}_m$ for which $\beta(Q_1)-\beta(Q_0)$ is of order $\eta_n^{1-\frac1m}$ in Lemma (ref) but so that the total variation distance between $Q_0^{\otimes n} \circ \mathsf{C}^{-1}$ and $Q_1^{\otimes n} \circ \mathsf{C}^{-1}$ is suitably small (Lemma (ref)).

Equation(ref) of Theorem (ref) shows that no estimator can have a better dependence on the contamination fraction $\eta_n$ uniformly over $\mathcal{Q}_m$ than the $\eta_n^{1-\frac{1}{m}}$ achieved by $\hat{\beta}_{n,\text{W-2SLS}}$ in Theorem (ref). Thus, a better dependence on $\eta_n$ must come at the price of imposing restrictions on the allowed contamination strategies that the adversary can employ. In particular, one must rule out strategies that are a function of the clean data $V_1,\hdots,V_n$ (e.g. selective reporting or survey manipulation) as exploited in the proof of Theorem (ref).

Recall that Theorem (ref) implies that $\hat{\beta}_{n,\text{W-2SLS}}$ is $\sqrt{n}$-consistent if $\limsup_{n\to\infty}\sqrt{n}\eta_n^{1-\frac1m}<\infty$, whereas (ref) of Theorem (ref) shows that no estimator can be uniformly $\sqrt{n}$-consistent over $\mathcal{Q}_m$ in case $\limsup_{n\to\infty}\sqrt{n}\eta_n^{1-\frac1m}=\infty$. Thus, $\hat{\beta}_{n,\text{W-2SLS}}$ is $\sqrt{n}$-consistent under the weakest possible condition on $\eta_n$.

Finally, (ref) of Theorem (ref) implies that the condition $\sqrt{n}\eta_n^{1-\frac1m}\to 0$ in Theorem (ref) is the weakest possible one on $\eta_n$ if one wishes to conduct standard inference based on a normal approximation as if no contamination were present. Specifically, if $\limsup_{n\to\infty}\sqrt{n}\eta_n^{1-\frac1m}>0$, then for any estimator $T_n$ there exists a subsequence along which $\sqrt{n}[T_n(\tilde{V})-\beta(Q)]$ does not converge in distribution to a normal with a mean of zero under some $Q_n\in\mathcal{Q}_m$.

Non-existence of honest adaptive confidence sets

The following theorem establishes that any confidence set that covers uniformly over $\mathcal{Q}_m$ must have a diameter --- even absent contamination --- that depends on the largest possible contamination fraction $\eta_n$ that one is willing to entertain. In this sense, any procedure must explicitly or implicitly specify the largest fraction of contaminated observations that it wishes to be robust against. The choice of $\varepsilon_n=\varepsilon_n(\eta_n)$ in (ref) makes this choice explicit for the purpose of implementing the winsorized 2SLS estimator.

Theorem (ref) shows that any confidence set $C_n$ that has uniform coverage of at least $1-\delta$ absent and present contamination must have a diameter at least of order $\eta_n^{1-\frac1m}$. Thus, even though no contamination is present, any confidence set with coverage $1-\delta$ if there had been contamination must have a diameter depending on $\eta_n$. This finding is similar in spirit to the one for constructing honest confidence intervals in a location model under Huber contamination in luo2026adaptive. Theorem (ref) does not rule out the existence of point estimators that adapt to the unknown actual contamination fraction $|\mathcal{O}|/n$.

Inference robust to contamination and weak identification

The positive results on estimation and inference in Theorems (ref)--(ref) imposed that the instruments are strong in the sense of $\text{rank}[\mathbb{E}(z_1x_1')]=K$. We now show that without any assumptions on the smallest singular value of $\mathbb{E}(z_1x_1')$, a natural winsorized version of the classic Anderson-Rubin test (cf. anderson1949estimation) is simultaneously robust to adversarial contamination and weak instruments. Consider testing whether the “structural” parameter $\beta$ in (ref) equals a candidate $\beta_0$, that is testing

Writing $g_i(b)=z_i(y_i-x_i'b)$ for $i=1,\hdots,n$ and $b$ being $K\times 1$, the classic Anderson-Rubin test based on the clean data utilises that $\beta$ satisfies $\mathbb{E} g_1(\beta)=\mathbb{E}(z_1(y_1-x_1'\beta))=\mathbb{E}(z_1u_1)=0$. If $\beta_0$ satisfies $\mathbb{E} g_1(\beta_0)=0$, the covariance matrix of $g_1(\beta_0)$ is $\Sigma(\beta_0)=\mathbb{E}[ g_1(\beta_0)g_1(\beta_0)']$. Let $\hat{\Sigma}_{\text{AR}}(\beta_0)=n^{-1}\sum_{i=1}^ng_i(\beta_0)g_i(\beta_0)'$ be its usual heteroskedasticity-robust sample-analogue and $\bar{g}_n(\beta_0)=n^{-1}\sum_{i=1}^ng_i(\beta_0)$. The resulting heteroskedasticity-robust Anderson-Rubin statistic for $\mathsf{H}_0:\beta=\beta_0$ is

Under $\mathbb{E} g_1(\beta_0)=0$ and standard regularity conditions, $\mathsf{AR}_n(\beta_0)$ converges in distribution to a $\chi^2(L)$ without imposing any assumptions on $\text{rank}[\mathbb{E}(z_1x_1')]$.

Although robust to weak instruments absent contamination, $\mathsf{AR}_n(\beta_0)$ is extremely fragile to adversarial contamination. The following winsorized AR-test robustifies $\mathsf{AR}_n(\beta_0)$ to adversarial contamination for free in the same fashion as $\hat{\beta}_{n,\text{W-2SLS}}$ robustified $\hat{\beta}_{n,\text{2SLS}}$ for free in Section (ref) by replacing the same averages involved in $\bar{g}_n(\beta_0)$ and $\hat{\Sigma}_n$ by suitably winsorized means. To be precise, let $\tilde{g}_i(b)=\tilde{z}_i(\tilde{y}_i-\tilde{x}_i'b)$ for $i=1,\hdots,n$ and let $\bar{\tilde{g}}_{n}(b)$ be the $L\times 1$ vector with entries

Furthermore, recalling the notation introduced just prior to (ref), let $\hat{\Sigma}_{\text{W-AR}}(b)$ be the $L\times L$ positive semi-definite matrix with entries

We now define the following winsorized AR-statistic, which is simultaneously robust to i) adversarial contamination, ii) weak identification, and iii) heteroskedasticity:

Because Assumption (ref) imposes the strong instrument assumption $\text{rank}[\mathbb{E}(z_1x_1')]=K$, which is precisely the condition this section removes, Theorem (ref) is stated under primitive assumptions on the moment vector $g_1(\beta_0)$ itself.

Theorem (ref) shows that the robustified Anderson-Rubin statistic $\mathsf{AR}_{n,\text{W}}(\beta_0)$ --- taking the contaminated data as input --- has the same limiting distribution as the classic heteroskedasticity-robust AR statistic $\mathsf{AR}_{n}(\beta_0)$ in (ref) taking the clean data as input. Thus, in this sense robustness can again be obtained for free also without imposing any assumptions of the strength of the instruments. We stress that Theorem (ref) establishes the asymptotic distribution of $\mathsf{AR}_{n,\text{W}}(\beta_0)$ in the presence of contamination and thus goes beyond the clean-model asymptotic result for the robust AR statistic studied in klooster2024outlier.

By Theorem (ref), for any $\delta\in(0,1)$, a confidence set with asymptotic coverage $(1-\delta)$ can be constructed by standard test inversion as

where $\mathsf{k}_{1-\delta}(L)$ denotes the $(1-\delta)$-percentile of the $\chi^2(L)$-distribution.

A uniform finite-sample concentration gap: 2SLS vs. W-2SLS

The previous sections have demonstrated through an asymptotic lens how the winsorized 2SLS estimator robustifies the classic 2SLS estimator for free against adversarial contamination. We next show for fixed $n$ that even absent contamination, amounting to $\eta_n=0$, the deviations of $\hat{\beta}_{n,\text{2SLS}}$ from the true $\beta$ can be much larger than those of $\hat{\beta}_{n,\text{W-2SLS}}$. Put differently, not only does the robustness of $\hat{\beta}_{n,\text{W-2SLS}}$ come for free, it can also concentrate stronger around $\beta$ than $\hat{\beta}_{n,\text{2SLS}}$ even when the data is clean. For the purpose of this finite-sample deviation study, we consider the just-identified case of $L=K=1$ so that $\hat{\beta}_{n,\text{2SLS}}$ in (ref) reduces to

provided the denominator is non-zero (and set $\hat{\beta}_{n,2\text{SLS}}=0$, otherwise) . If

it follows by standard arguments that

Therefore, for any $\delta\in(0,1)$ it holds that

where $\Phi(\cdot)$ is the cdf of $\mathsf{N}(0,1)$. Thus, since $\Phi^{-1}(1-\delta/2)\leq \sqrt{2\log(2/\delta)}$,

Since the “failure probability” $\delta$ only enters via $\sqrt{\log(2/\delta)}$, it is tempting to conclude on the basis of these pointwise asymptotic considerations that even for very small $\delta$, $\hat{\beta}_{n,2\text{SLS}}$ is close to $\beta$ with probability at least $1-\delta$. However, this is only true in the above pointwise sense as we shall now detail. To do so, like in Section (ref), for any distribution $Q$ of $R_i=(y_i,x_i,z_i,u_i)$ on $\mathbb{R}^4$, let $P_Q$ be a measure on the underlying measurable space $(\Omega,\mathcal{F})$ such that $P_Q\circ \del[1]{R_1,\hdots,R_n}^{-1}=Q^{\otimes n}$, cf. also Footnote (ref). For any estimator $T_n$ of $\beta$, any family of distributions $\mathcal{Q}$ on $\mathbb{R}^4$, and $\delta\in(0,1)$, define the uniform deviation radius (of $T_n$ over $\mathcal{Q}$ at failure probability $\delta$)

where, as usual, we set $\inf \emptyset=\infty$. For given $n$ and failure probability $\delta$, $\tau_n(T_n,\mathcal{Q},\delta)$ is the worst-case upper $(1-\delta)$-quantile of the absolute estimation error, or equivalently the smallest deterministic half-length $t$ of an interval $[T_n-t,T_n+t]$ containing $\beta(Q)$ with probability at least $1-\delta$ uniformly over $\mathfrak{Q}$. Clearly, a smaller $\tau_n(T_n,\mathcal{Q},\delta)$ is desirable since it implies stronger concentration of $T_n$ around $\beta(Q)$ uniformly over $\mathcal{Q}$.

We now show that the winsorized 2SLS estimator can have a much smaller uniform deviation radius than the plain 2SLS estimator. Fix $\beta\in\mathbb{R}$, $\underline{\pi}>0$, $K>0$, and denote by $\overline{\mathfrak{Q}}(\beta,\underline{\pi},K)$ those distributions $Q$ of $R_i=(y_i,x_i,z_i,u_i)$ on $\mathbb{R}^4$ satisfying

We stress that this is a setting of strong instruments since $\underline{\pi}>0$ is fixed. Furthermore, the relevant second moments are uniformly bounded by $K$. Thus, the poor concentration of the 2SLS estimator exhibited in Theorem (ref) below is not an artefact of weak instruments or diverging moments. Indeed, $\hat{\beta}_{n,\text{W-2SLS}}$ will be seen to exhibit much stronger concentration around $\beta$ uniformly over $\overline{\mathfrak{Q}}(\beta,\underline{\pi},K)$. For the purpose of the lower bounds on the uniform concentration radius of $\hat{\beta}_{n,\text{2SLS}}$ it even suffices to consider the sub-family of distributions $\mathfrak{Q}$ on $\mathbb{R}^4$, each $Q$ element of which satisfies:

Note that for $\beta=1$, $\underline{\pi}\leq 1$, and $K\geq 2$, it holds that $\mathfrak{Q}\subseteq\overline{\mathfrak{Q}}(\beta,\underline{\pi},K)$. We stress that for the definition of $\mathfrak{Q}$ the specific values of the expectations, choice of $\beta=1$, and $\pi=\mathbb{E}(z_1x_1)=1$ are for concreteness only and other choices would simply change the multiplicative constant in Theorem (ref) below.\footnote{Indeed, a more general construction is provided in Lemma (ref) in the appendix.}

The dependence of $\tau_n(\hat{\beta}_{n,\text{2SLS}},\mathfrak{Q},\delta)$ on $n$ and $\delta$ in Theorem (ref) is sharp up to universal constants since Lemma (ref) in the appendix and $\mathfrak{Q}\subseteq \overline{\mathfrak{Q}}(1,1,2)$ imply that for $n\delta\geq 16$

It follows that for $\delta=\delta_n$

We next show that replacing the empirical IV moments by confidence-calibrated winsorized means yields a fundamentally smaller uniform deviation radius. To provide a clean comparison with the results for $\hat{\beta}_{n,\text{2SLS}}$ in Theorem (ref), which fixes the failure probability $\delta$, we consider the following variation on $\varepsilon_n$ in (ref) when implementing the winsorized 2SLS estimator for a given $\delta\in(0,1)$. Set

The winsorized 2SLS estimator in (ref) then reduces to\footnote{We set $\hat{\beta}_{n,\text{W-2SLS}}^{(\delta)}=0$ on the event $\mu_{\varepsilon}\del[0]{z_1x_1,\hdots,z_nx_n}=0$, which is outside the high-probability event in Theorem (ref)} the confidence calibrated

Observe that since $\eta_n=0$ throughout this section, choosing $\delta=12n^{-\lambda}$ implies that $\hat{\beta}_{n,\text{W-2SLS}}^{(12n^{-\lambda})}$ reduces to $\hat{\beta}_{n,\text{W-2SLS}}$ in (ref) because $\varepsilon$ in (ref) equals $\varepsilon_n$ in (ref).

Since $\mathfrak{Q}\subseteq \overline{\mathfrak{Q}}(1,1,2)$ Theorems (ref) and (ref) compare $\hat{\beta}_{n,\text{2SLS}}$ and $\hat{\beta}_{n,\text{W-2SLS}}^{(\delta)}$ on the same strongly identified, bounded second moments class. Although the lower and upper bounds on the uniform deviation radii of $\hat{\beta}_{n,\text{2SLS}}$ and $\hat{\beta}_{n,\text{W-2SLS}}^{(\delta)}$ have the same $n^{-1/2}$-dependence on $n$ for fixed $\delta$, they depend very differently on $\delta$:

This contrast in the concentration properties of $\hat{\beta}_{n,\text{2SLS}}$ and ${\hat{\beta}_{n,\text{W-2SLS}}^{(\delta)}}$ is particularly striking for small failure probabilities $\delta$. Studying failure probabilities $\delta=\delta_n$ that converge to zero as $n\to\infty$ can be informative since it is reasonable to demand a lower failure probability $\delta$ as the sample size increases.

Recall that $\delta=12n^{-\lambda}$ implies that $\hat{\beta}_{n,\text{W-2SLS}}^{(12n^{-\lambda})}$ equals $\hat{\beta}_{n,\text{W-2SLS}}$ in (ref) and that the assumptions of Theorems (ref) and (ref) are eventually satisfied. Together with (ref), Corollary (ref) therefore reveals that the ratio of uniform deviation radii satisfies

as well as the existence of the following regimes:

Hence winsorized 2SLS has a vanishing uniform deviation radius at every polynomial confidence level $1-12n^{-\lambda}$, whereas ordinary 2SLS ceases to have a vanishing uniform $(1-12 n^{-\lambda})$-deviation radius at $\lambda=1$.