It would be like receiving `{ads: []}`. How do you distinguish between the case of having no ads to show, and someone tampering with the data?

Is it ever reasonable to assume you have a properly decoded empty array because a user tampered with it, instead of that being what the server gave back to you?

If you have to choose between (a) the app shutting down or (b) the user not seeing ads bc the ad array is empty, you are probably going to pick B.