  We consider the question of Gaussian mean testing, a fundamental task in
high-dimensional distribution testing and signal processing, subject to
adversarial corruptions of the samples. We focus on the relative power of
different adversaries, and show that, in contrast to the common wisdom in
robust statistics, there exists a strict separation between adaptive
adversaries (strong contamination) and oblivious ones (weak contamination) for
this task. Specifically, we resolve both the information-theoretic and
computational landscapes for robust mean testing. In the exponential-time
setting, we establish the tight sample complexity of testing $\mathcal{N}(0,I)$
against $\mathcal{N}(\alpha v, I)$, where $\|v\|_2 = 1$, with an
$\varepsilon$-fraction of adversarial corruptions, to be \[
  \tilde{\Theta}\!\left(\max\left(\frac{\sqrt{d}}{\alpha^2},
\frac{d\varepsilon^3}{\alpha^4},\min\left(\frac{d^{2/3}\varepsilon^{2/3}}{\alpha^{8/3}},
\frac{d \varepsilon}{\alpha^2}\right)\right) \right) \,, \] while the
complexity against adaptive adversaries is \[
  \tilde{\Theta}\!\left(\max\left(\frac{\sqrt{d}}{\alpha^2},
\frac{d\varepsilon^2}{\alpha^4} \right)\right) \,, \] which is strictly worse
for a large range of vanishing $\varepsilon,\alpha$. To the best of our
knowledge, ours is the first separation in sample complexity between the strong
and weak contamination models.
  In the polynomial-time setting, we close a gap in the literature by providing
a polynomial-time algorithm against adaptive adversaries achieving the above
sample complexity $\tilde{\Theta}(\max({\sqrt{d}}/{\alpha^2},
{d\varepsilon^2}/{\alpha^4} ))$, and a low-degree lower bound (which
complements an existing reduction from planted clique) suggesting that all
efficient algorithms require this many samples, even in the oblivious-adversary
setting.
