Evidence Validation Under Adversarial Planting: A Game-Theoretic Framework for Distinguishing Authentic from Adversarially-Planted Forensic Evidence

We formalize forensic evidence validation as a two-player zero-sum game. Three adversary regimes (bounded/mid/high-capability) x three analyst strategies (content-only/cross-source/crypto-attestation) on N=4,500 simulated incidents. Coordinated multi-source extension reveals that under coherent adversary at k>=2, content-only beats cross-source (a coordinated lie passes the correlation check). Strategy ensemble validates with +12.8pp avg gain. Cost-equivalent budget analysis: 3x content-only beats ensemble at equal budget. Adversary-budget Pareto: content-only doctrines never break within tested range. This paper is part of the AIACW (AI-Autonomous Cyber Weapons) ResearchProgramme, Wave 2 (papers P10-P20). Wave 1 (P1-P9) was deposited atpeer-review venues 2026-Q2 (NDSS, ACM CCS, IEEE S&P, USENIX Security,Oxford J. of Cybersecurity, ACM Computing Surveys). Wave 2 establishesthe empirical interior. P19 (cross-paper integration test) and P20(methodology meta-paper) provide programme-level validation anddocumentation.