SlowGuess/NeurIPS_2023_OCR huggingface dataset:
In this work, we investigate the mistake bound and sample complexity of strategic classification across multiple settings. Unlike prior work, we assume that the manipulation is personalized and unknown to the learner, which makes the strategic classification problem more challenging. In the case of ball manipulations, when the original feature vector  $x_{t}$  is revealed prior to choosing  $f_{t}$ , the problem exhibits a similar level of difficulty as the non-strategic setting (see Table 1 for details). However, when the original feature vector  $x_{t}$  is not revealed beforehand, the problem becomes significantly more challenging. Specifically, any learner will experience a mistake bound that scales linearly with  $|\mathcal{H}|$ , and any proper learner will face sample complexity that also scales linearly with  $|\mathcal{H}|$ . In the case of non-ball manipulations, the situation worsens. Even in the simplest setting, where the original feature is observed before choosing  $f_{t}$  and the manipulated feature is observed afterward, any learner will encounter a linear mistake bound and sample complexity.
Besides the question of optimal sample complexity in the setting of  $(\perp, \Delta)$  as mentioned in Sec 4.3, there are some other fundamental open questions.
**Combinatorial measure** Throughout this work, our main focus is on analyzing the dependency on the size of the hypothesis class  $|\mathcal{H}|$  without assuming any specific structure of  $\mathcal{H}$ . Just as VC dimension provides tight characterization for PAC learnability and Littlestone dimension characterizes online learnability, we are curious if there exists a combinatorial measure that captures the essence of strategic classification in this context. In the proofs of the most lower bounds in this work, we consider hypothesis class to be singletons, in which both the VC dimension and Littlestone dimension are 1. Therefore, they cannot be candidates to characterize learnability in the strategic setting.
Agnostic setting We primarily concentrate on the realizable setting in this work. However, investigating the sample complexity and regret bounds in the agnostic setting would be an interesting avenue for future research.
This work was supported in part by the National Science Foundation under grant CCF-2212968, by the Simons Foundation under the Simons Collaboration on the Theory of Algorithmic Fairness, by the
Defense Advanced Research Projects Agency under cooperative agreement HR00112020003. The views expressed in this work do not necessarily reflect the position or the policy of the Government and no official endorsement should be inferred. Approved for public release; distribution is unlimited.
Ahmadi, S., Beyhaghi, H., Blum, A., and Naggita, K. (2021). The strategic perceptron. In Proceedings of the 22nd ACM Conference on Economics and Computation, pages 6-25.
Ahmadi, S., Beyhaghi, H., Blum, A., and Naggita, K. (2022). On classification of strategic agents who can both game and improve. arXiv preprint arXiv:2203.00124.
Ahmadi, S., Blum, A., and Yang, K. (2023). Fundamental bounds on online strategic classification. arXiv preprint arXiv:2302.12355.
Bechavod, Y., Ligett, K., Wu, S., and Ziani, J. (2021). Gaming helps! learning from strategic interactions in natural dynamics. In International Conference on Artificial Intelligence and Statistics, pages 1234-1242. PMLR.
Brückner, M. and Scheffer, T. (2011). Stackelberg games for adversarial prediction problems. In Proceedings of the 17th ACM SIGKDD international conference on Knowledge discovery and data mining, pages 547-555.
Chen, Y., Liu, Y., and Podimata, C. (2020). Learning strategy-aware linear classifiers. Advances in Neural Information Processing Systems, 33:15265-15276.
Dalvi, N., Domingos, P., Sanghai, S., and Verma, D. (2004). Adversarial classification. In Proceedings of the tenth ACM SIGKDD international conference on Knowledge discovery and data mining, pages 99-108.
Dong, J., Roth, A., Schutzman, Z., Waggoner, B., and Wu, Z. S. (2018). Strategic classification from revealed preferences. In Proceedings of the 2018 ACM Conference on Economics and Computation, pages 55-70.
Gallant, S. I. (1986). Optimal linear discriminants. *Eighth International Conference on Pattern Recognition*, pages 849-852.
Haghtalab, N., Immorlica, N., Lucier, B., and Wang, J. Z. (2020). Maximizing welfare with incentive-aware evaluation mechanisms. arXiv preprint arXiv:2011.01956.
Haghtalab, N., Lykouris, T., Nietert, S., and Wei, A. (2022). Learning in stackelberg games with non-myopic agents. In Proceedings of the 23rd ACM Conference on Economics and Computation, pages 917-918.
Hardt, M., Megiddo, N., Papadimitriou, C., and Wootters, M. (2016). Strategic classification. In Proceedings of the 2016 ACM conference on innovations in theoretical computer science, pages 111-122.
Hu, L., Immorlica, N., and Vaughan, J. W. (2019). The disparate effects of strategic manipulation. In Proceedings of the Conference on Fairness, Accountability, and Transparency, pages 259-268.
Jagadeesan, M., Mendler-Dünner, C., and Hardt, M. (2021). Alternative microfoundations for strategic classification. In International Conference on Machine Learning, pages 4687-4697. PMLR.
Kleinberg, J. and Raghavan, M. (2020). How do classifiers induce agents to invest effort strategically? ACM Transactions on Economics and Computation (TEAC), 8(4):1-23.
Lechner, T. and Urner, R. (2022). Learning losses for strategic classification. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 36, pages 7337-7344.
Lechner, T., Urner, R., and Ben-David, S. (2023). Strategic classification with unknown user manipulations.
Milli, S., Miller, J., Dragan, A. D., and Hardt, M. (2019). The social cost of strategic classification. In Proceedings of the Conference on Fairness, Accountability, and Transparency, pages 230-239.
Montasser, O., Hanneke, S., and Srebro, N. (2019). Vc classes are adversarially robustly learnable, but only improperly. In Conference on Learning Theory, pages 2512-2530. PMLR.
Rajaraman, N., Han, Y., Jiao, J., and Ramchandran, K. (2023). Beyond ucb: Statistical complexity and optimal algorithms for non-linear ridge bandits. arXiv preprint arXiv:2302.06025.
Sundaram, R., Vullikanti, A., Xu, H., and Yao, F. (2021). Pac-learning for strategic classification. In International Conference on Machine Learning, pages 9978-9988. PMLR.
Zhang, H. and Conitzer, V. (2021). Incentive-aware pac learning. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 35, pages 5797-5804.
Zrnic, T., Mazumdar, E., Sastry, S., and Jordan, M. (2021). Who leads and who follows in strategic classification? Advances in Neural Information Processing Systems, 34:15257-15269.
A.1 Boosting expected guarantee to high probability guarantee
Consider any (possibly randomized) PAC learning algorithm  $\mathcal{A}$  in strategic setting, which can output a predictor  $\mathcal{A}(S)$  after  $T$  steps of interaction with i.i.d. agents  $S\sim \mathcal{D}^T$  s.t.  $\mathbb{E}\left[\mathcal{L}^{\mathrm{str}}(\mathcal{A}(S))\right]\leq \varepsilon$  where the expectation is taken over both the randomness of  $S$  and the randomness of algorithm. One standard way in classic PAC learning of boosting the expected loss guarantee to high probability loss guarantee is: running  $\mathcal{A}$  on new data  $S$  and verifying the loss of  $\mathcal{A}(S)$  on a validation data set; if the validation loss is low, outputting the current  $\mathcal{A}(S)$ , and repeating this process otherwise.
We will adopt this method to boost the confidence as well. The only difference in our strategic setting is that we can not re-use validation data set as we are only allowed to interact with the data through the interaction protocol. Our boosting scheme is described in the following.
- For round  $r = 1, \dots, R$ ,
- Run  $\mathcal{A}$  for  $T$  steps of interactions to obtain a predictor  $h_r$ .
- Apply  $h_r$  for the following  $m_0$  rounds to obtain the empirical strategic loss on  $m_0$ , denoted as  $\widehat{l}_r = \frac{1}{m_0} \sum_{t=t_r+1}^{t_r+m_0} \ell^{\mathrm{str}}(h_r, (x_t, r_t, y_t))$ , where  $t_r + 1$  is the starting time of these  $m_0$  rounds.
- Break and output  $h_r$  if  $\widehat{l}_r \leq 4\varepsilon$ .
- If for all  $r \in [R]$ ,  $\widehat{l}_r > 4\varepsilon$ , output an arbitrary hypothesis.
Lemma 2. Given an algorithm  $\mathcal{A}$ , which can output a predictor  $\mathcal{A}(S)$  after  $T$  steps of interaction with i.i.d. agents  $S \sim \mathcal{D}^T$  s.t. the expected loss satisfies  $\mathbb{E}\left[\mathcal{L}^{str}(\mathcal{A}(S))\right] \leq \varepsilon$ . Let  $h_{\mathcal{A}}$  denote the output of the above boosting scheme given algorithm  $\mathcal{A}$  as input. By setting  $R = \log \frac{2}{\delta}$  and  $m_0 = \frac{3\log(4R / \delta)}{2\varepsilon}$ , we have  $\mathcal{L}^{str}(h_{\mathcal{A}}) \leq 8\varepsilon$  with probability  $1 - \delta$ . The total sample size is  $R(T + m_0) = O(\log (\frac{1}{\delta})(T + \frac{\log(1 / \delta)}{\varepsilon}))$ .
Proof. For all  $r = 1, \ldots, R$ , we have  $\mathbb{E}\left[\mathcal{L}^{\mathrm{str}}(h_r)\right] \leq \varepsilon$ . By Markov's inequality, we have
$$
\Pr \left(\mathcal {L} ^ {\operatorname {s t r}} \left(h _ {r}\right) > 2 \varepsilon\right) \leq \frac {1}{2}.
$$
For any fixed  $h_r$ , if  $\mathcal{L}^{\mathrm{str}}(h_r) \geq 8\varepsilon$ , we will have  $\widehat{l}_r \leq 4\varepsilon$  with probability  $\leq e^{-m_0\varepsilon}$ ; if  $\mathcal{L}^{\mathrm{str}}(h_r) \leq 2\varepsilon$ , we will have  $\widehat{l}_r \leq 4\varepsilon$  with probability  $\geq 1 - e^{-2m_0\varepsilon /3}$  by Chernoff bound.
Let  $E$  denote the event of  $\{\exists r\in [R],\mathcal{L}^{\mathrm{str}}(h_r)\leq 2\varepsilon \}$  and  $F$  denote the event of  $\{\widehat{l}_r > 4\varepsilon$  for all  $r\in [R]\}$ . When  $F$  does not hold, our boosting will output  $h_r$  for some  $r\in [R]$ .
$$
\begin{array}{l} \Pr (\mathcal {L} ^ {\mathrm {s t r}} (h _ {\mathcal {A}}) > 8 \varepsilon) \\ \leq \Pr (E, \neg F) \Pr (\mathcal {L} ^ {\mathrm {s t r}} (h _ {\mathcal {A}}) > 8 \varepsilon | E, \neg F) + \Pr (E, F) + \Pr (\neg E) \\ \leq \sum_ {r = 1} ^ {R} \Pr (h _ {\mathcal {A}} = h _ {r}, \mathcal {L} ^ {\operatorname {s t r}} (h _ {r}) > 8 \varepsilon | E, \neg F) + \Pr (E, F) + \Pr (\neg E) \\ \leq R e ^ {- m _ {0} \varepsilon} + e ^ {- 2 m _ {0} \varepsilon / 3} + \frac {1}{2 R} \\ \leq \delta , \\ \end{array}
$$
by setting  $R = \log \frac{2}{\delta}$  and  $m_0 = \frac{3\log(4R / \delta)}{2\varepsilon}$ .
A.2 Converting mistake bound to PAC bound
In any setting of  $(C,F)$ , if there is an algorithm  $\mathcal{A}$  that can achieve the mistake bound of  $B$ , then we can convert  $\mathcal{A}$  to a conservative algorithm by not updating at correct rounds. The new algorithm can still achieve mistake bound of  $B$  as  $\mathcal{A}$  still sees a legal sequence of examples. Given any conservative online algorithm, we can convert it to a PAC learning algorithm using the standard longest survivor technique (Gallant, 1986).
Lemma 3. In any setting of  $(C,F)$ , given any conservative algorithm  $\mathcal{A}$  with mistake bound  $B$ , let algorithm  $\mathcal{A}'$  run  $\mathcal{A}$  and output the first  $f_{t}$  which survives over  $\frac{1}{\varepsilon} \log \left( \frac{B}{\delta} \right)$  examples.  $\mathcal{A}'$  can achieve sample complexity of  $\mathcal{O} \left( \frac{B}{\varepsilon} \log \left( \frac{B}{\delta} \right) \right)$ .
Proof of Lemma 3. When the sample size  $m \geq \frac{B}{\varepsilon} \log \left(\frac{B}{\delta}\right)$ , the algorithm  $\mathcal{A}$  will produce at most  $B$  different hypotheses and there must exist one surviving for  $\frac{1}{\varepsilon} \log \left(\frac{B}{\delta}\right)$  rounds since  $\mathcal{A}$  is a conservative algorithm with at most  $B$  mistakes. Let  $h_1, \ldots, h_B$  denote these hypotheses and let  $t_1, \ldots, t_B$  denote the time step they are produced. Then we have
$$
\begin{array}{l} \Pr \left(f _ {\text {o u t}} = h _ {i} \text {a n d} \mathcal {L} ^ {\text {s t r}} \left(h _ {i}\right) > \varepsilon\right) = \mathbb {E} \left[ \Pr \left(f _ {\text {o u t}} = h _ {i} \text {a n d} \mathcal {L} ^ {\text {s t r}} \left(h _ {i}\right) > \varepsilon \mid t _ {i}, z _ {1: t _ {i} - 1}\right) \right] \\ <   \mathbb {E} \left[ (1 - \varepsilon) ^ {\frac {1}{\varepsilon} \log (\frac {B}{\delta})} \right] = \frac {\delta}{B}. \\ \end{array}
$$
By union bound, we have
$$
\Pr \left(\mathcal {L} ^ {\operatorname {s t r}} \left(f _ {\text {o u t}}\right) > \varepsilon\right) \leq \sum_ {i = 1} ^ {B} \Pr_ {z _ {1: T}} \left(f _ {\text {o u t}} = h _ {i} \text {a n d} \mathcal {L} ^ {\operatorname {s t r}} \left(h _ {i}\right) > \varepsilon\right) <   \delta .
$$
A.3 Smooth the distribution
Lemma 4. For any two data distribution  $\mathcal{D}_1$  and  $\mathcal{D}_2$ , let  $\mathcal{D}_3 = (1 - p)\mathcal{D}_1 + p\mathcal{D}_2$  be the mixture of them. For any setting of  $(C,F)$  and any algorithm, let  $\mathbf{P}_{\mathcal{D}}$  be the dynamics of  $(C(x_1),f_1,y_1,\widehat{y}_1,F(x_1,\Delta_1),\ldots ,C(x_T),f_T,y_T,\widehat{y}_T,F(x_T,\Delta_T))$  under the data distribution  $\mathcal{D}$ . Then for any event  $A$ , we have  $|\mathbf{P}_{\mathcal{D}_3}(A) - \mathbf{P}_{\mathcal{D}_1}(A)| \leq 2pT$ .
Proof. Let  $B$  denote the event of all  $(x_{t},u_{t},y_{t})_{t = 1}^{T}$  being sampled from  $\mathcal{D}_1$ . Then  $\mathbf{P}_{\mathcal{D}_3}(\neg B)\leq pT$ . Then
$$
\begin{array}{l} \mathbf {P} _ {\mathcal {D} _ {3}} (A) = \mathbf {P} _ {\mathcal {D} _ {3}} (A | B) \mathbf {P} _ {\mathcal {D} _ {3}} (B) + \mathbf {P} _ {\mathcal {D} _ {3}} (A | \neg B) \mathbf {P} _ {\mathcal {D} _ {3}} (\neg B) \\ = \mathbf {P} _ {\mathcal {D} _ {1}} (A) \mathbf {P} _ {\mathcal {D} _ {3}} (B) + \mathbf {P} _ {\mathcal {D} _ {3}} (A | \neg B) \mathbf {P} _ {\mathcal {D} _ {3}} (\neg B) \\ = \mathbf {P} _ {\mathcal {D} _ {1}} (A) (1 - \mathbf {P} _ {\mathcal {D} _ {3}} (\neg B)) + \mathbf {P} _ {\mathcal {D} _ {3}} (A | \neg B) \mathbf {P} _ {\mathcal {D} _ {3}} (\neg B). \\ \end{array}
$$
By re-arranging terms, we have
$$
\left| \mathbf {P} _ {\mathcal {D} _ {1}} (A) - \mathbf {P} _ {\mathcal {D} _ {3}} (A) \right| = \left| \mathbf {P} _ {\mathcal {D} _ {1}} (A) \mathbf {P} _ {\mathcal {D} _ {3}} (\neg B) - \mathbf {P} _ {\mathcal {D} _ {3}} (A | \neg B) \mathbf {P} _ {\mathcal {D} _ {3}} (\neg B) \right| \leq 2 p T.
$$
Proof. When a mistake occurs, there are two cases.
- If  $f_t$  misclassifies a true positive example  $(x_t, r_t, +1)$  by negative, we know that  $d(x_t, f_t) > r_t$  while the target hypothesis  $h^*$  must satisfy that  $d(x_t, h^*) \leq r_t$ . Then any  $h \in \mathrm{VS}$  with  $d(x_t, h) \geq d(x_t, f_t)$  cannot be  $h^*$  and are eliminated. Since  $d(x_t, f_t)$  is the median of  $\{d(x_t, h) | h \in \mathrm{VS}\}$ , we can eliminate half of the version space.
- If  $f_{t}$  misclassifies a true negative example  $(x_{t}, r_{t}, -1)$  by positive, we know that  $d(x_{t}, f_{t}) \leq r_{t}$  while the target hypothesis  $h^{*}$  must satisfy that  $d(x_{t}, h^{*}) > r_{t}$ . Then any  $h \in \mathrm{VS}$  with  $d(x_{t}, h) \leq d(x_{t}, f_{t})$  cannot be  $h^{*}$  and are eliminated. Since  $d(x_{t}, f_{t})$  is the median of  $\{d(x_{t}, h) | h \in \mathrm{VS}\}$ , we can eliminate half of the version space.
Each mistake reduces the version space by half and thus, the algorithm of Strategic Halving suffers at most  $\log_2(|\mathcal{H}|)$  mistakes.
Proof. In online learning setting, an algorithm is conservative if it updates its current predictor only when making a mistake. It is straightforward to check that Strategic Halving is conservative. Combined with the technique of converting mistake bound to PAC bound in Lemma 3, we prove Theorem 2.
Proof. Consider the feature space  $\mathcal{X} = \{\mathbf{0},\mathbf{e}_1,\dots ,\mathbf{e}_n,0.9\mathbf{e}_1,\dots ,0.9\mathbf{e}_n\}$ , where  $\mathbf{e}_i$ 's are standard basis vectors in  $\mathbb{R}^n$  and metric  $d(x,x^{\prime}) = \| x - x^{\prime}\|_{2}$  for all  $x,x^{\prime}\in \mathcal{X}$ . Let the hypothesis class be a set of singletons over  $\{\mathbf{e}_i|i\in [n]\}$ , i.e.,  $\mathcal{H} = \{2\mathbb{1}_{\{\mathbf{e}_i\}} - 1|i\in [n]\}$ . We divide all possible hypotheses (not necessarily in  $\mathcal{H}$ ) into three categories:
- The hypothesis  $21_{\emptyset} - 1$ , which predicts all negative.
- For each  $x \in \{0, 0.9\mathbf{e}_1, \dots, 0.9\mathbf{e}_n\}$ , let  $F_{x, + }$  denote the class of hypotheses  $h$  predicting  $x$  as positive.
- For each  $i \in [n]$ , let  $F_i$  denote the class of hypotheses  $h$  satisfying  $h(x) = -1$  for all  $x \in \{\mathbf{0}, 0.9\mathbf{e}_1, \ldots, 0.9\mathbf{e}_n\}$  and  $h(\mathbf{e}_i) = +1$ . And let  $F_* = \cup_{i \in [n]} F_i$  denote the union of them.
Note that all hypotheses over  $\mathcal{X}$  fall into one of the three categories.
Now we consider a set of adversaries  $E_1, \ldots, E_n$ , such that the target function in the adversarial environment  $E_i$  is  $2\mathbb{1}_{\{\mathbf{e}_i\}} - 1$ . We allow the learners to be randomized and thus, at round  $t$ , the learner draws an  $f_t$  from a distribution  $D(f_t)$  over hypotheses. The adversary, who only knows the distribution  $D(f_t)$  but not the realization  $f_t$ , picks an agent  $(x_t, r_t, y_t)$  in the following way.
- Case 1: If there exists  $x \in \{0, 0.9\mathbf{e}_1, \ldots, 0.9\mathbf{e}_n\}$  such that  $\operatorname*{Pr}_{f_t \sim D(f_t)}(f_t \in F_{x, +}) \geq c$  for some  $c > 0$ , then for all  $j \in [n]$ , the adversary  $E_j$  picks  $(x_t, r_t, y_t) = (x, 0, -1)$ . Let  $B_{1,x}^t$  denote the event of  $f_t \in F_{x, +}$ .
- In this case, the learner will make a mistake with probability  $c$ . Since for all  $h \in \mathcal{H}$ ,  $h(\Delta(x, h, 0)) = h(x) = -1$ , they are all consistent with  $(x, 0, -1)$ .
- Case 2: If  $\operatorname{Pr}_{f_t \sim D(f_t)}(f_t = 2\mathbb{1}_{\emptyset} - 1) \geq c$ , then for all  $j \in [n]$ , the adversary  $E_j$  picks  $(x_t, r_t, y_t) = (0, 1, +1)$ . Let  $B_2^t$  denote the event of  $f_t = 2\mathbb{1}_{\emptyset} - 1$ .
- In this case, with probability  $c$ , the learner will sample a  $f_{t} = 21_{\emptyset} - 1$  and misclassify  $(\mathbf{0},1, + 1)$ . Since for all  $h\in \mathcal{H}$ ,  $h(\Delta (\mathbf{0},h,1)) = +1$ , they are all consistent with  $(\mathbf{0},1, + 1)$ .
- Case 3: If the above two cases do not hold, let  $i_t = \arg \max_{i \in [n]} \operatorname{Pr}(f_t(\mathbf{e}_i) = 1 | f_t \in F_*)$ ,  $x_t = 0.9\mathbf{e}_{i_t}$ . For radius and label, different adversaries set them differently. Adversary  $E_{i_t}$  will set  $(r_t, y_t) = (0, -1)$  while other  $E_j$  for  $j \neq i_t$  will set  $(r_t, y_t) = (0.1, -1)$ . Since Cases 1 and 2 do not hold, we have  $\operatorname{Pr}_{f_t \sim D(f_t)}(f_t \in F_*) \geq 1 - (n + 2)c$ . Let  $B_3^t$  denote the event of  $f_t \in F_*$  and  $B_{3,i}^t$  denote the event of  $f_t \in F_i$ .
(a) With probability  $\operatorname{Pr}(B_{3,i_t}^t) \geq \frac{1}{n}\operatorname{Pr}(B_3^t) \geq \frac{1 - (n + 2)c}{n}$ , the learner samples a  $f_t \in F_{i_t}$ , and thus misclassifies  $(0.9\mathbf{e}_{i_t}, 0.1, -1)$  in  $E_j$  for  $j \neq i_t$  but correctly classifies  $(0.9\mathbf{e}_{i_t}, 0, -1)$ . In this case, the learner observes the same feedback in all  $E_j$  for  $j \neq i_t$  and identifies the target function  $21_{\{\mathbf{e}_{i_t}\}} - 1$  in  $E_{i_t}$ .
(b) If the learner samples a  $f_{t}$  with  $f_{t}(\mathbf{e}_{i_{t}}) = f_{t}(0.9\mathbf{e}_{i_{t}}) = -1$ , then the learner observes  $x_{t} = 0.9\mathbf{e}_{i_{t}}, y_{t} = -1$  and  $\widehat{y}_t = -1$  in all  $E_{j}$  for  $j\in [n]$ . Therefore the learner cannot distinguish between adversaries in this case.
(c) If the learner samples a  $f_{t}$  with  $f_{t}(0.9\mathbf{e}_{i_{t}}) = +1$ , then the learner observes  $x_{t} = 0.9\mathbf{e}_{i_{t}}$ ,  $y_{t} = -1$  and  $\widehat{y_t} = +1$  in all  $E_{j}$  for  $j\in [n]$ . Again, since the feedback are identical in all  $E_{j}$  and the learner cannot distinguish between adversaries in this case.
For any learning algorithm  $\mathcal{A}$ , his predictions are identical in all of adversarial environments  $\{E_j|j\in [n]\}$  before he makes a mistake in Case 3(a) in one environment  $E_{i_t}$ . His predictions in the following rounds are identical in all of adversarial environments  $\{E_j|j\in [n]\} \setminus \{E_{i_t}\}$  before he makes another mistake in Case 3(a). Suppose that we run  $\mathcal{A}$  in all adversarial environments of  $\{E_j|j\in [n]\}$  simultaneously. Note that once we make a mistake, the mistake must occur simultaneously in at least  $n - 1$  environments. Specifically, if we make a mistake in Case 1, 2 or 3(c), such a mistake simultaneously occur in all  $n$  environments. If we make a mistake in Case 3(a), such a mistake simultaneously occur in all  $n$  environments except  $E_{i_t}$ . Since we will make a mistake with probability at least  $\min (c,\frac{1 - (n + 2)c}{n})$  at each round, there exists one environment in  $\{E_j|j\in [n]\}$  in which  $\mathcal{A}$  will make  $n - 1$  mistakes.
Now we lower bound the number of mistakes dependent on  $T$ . Let  $t_1, t_2, \ldots$  denote the time steps in which we make a mistake. Let  $t_0 = 0$  for convenience. Now we prove that
$$
\begin{array}{l} \Pr \left(t _ {i} > t _ {i - 1} + k \mid t _ {i - 1}\right) = \prod_ {\tau = t _ {i - 1} + 1} ^ {t _ {i - 1} + k} \Pr (\text {w e d o n ' t m a k e a m i t s k a t e i n r o u n d} \tau) \\ \leq \prod_ {\tau = t _ {i - 1} + 1} ^ {t _ {i - 1} + k} (\mathbb {1} (\text {C a s e 3 a t r o u n d} \tau) (1 - \frac {1 - (n + 2) c}{n}) + \mathbb {1} (\text {C a s e 1 o r 2 a t r o u n d} \tau) (1 - c)) \\ \leq (1 - \min (\frac {1 - (n + 2) c}{n}, c)) ^ {k} \leq (1 - \frac {1}{2 (n + 2)}) ^ {k}, \\ \end{array}
$$
by setting  $c = \frac{1}{2(n + 2)}$ . Then by letting  $k = 2(n + 2)\ln (n / \delta)$ , we have
$$
\Pr \left(t _ {i} > t _ {i - 1} + k \mid t _ {i - 1}\right) \leq \delta / n.
$$
For any  $T$
$$
\begin{array}{l} \Pr (\# \text {o f m i t a k e s} <   \min  (\frac {T}{k + 1}, n - 1)) \\ = \leq \Pr (\exists i \in [ n - 1 ], t _ {i} - t _ {i - 1} > k) \\ \leq \sum_ {i = 1} ^ {n - 1} \Pr (t _ {i} - t _ {i - 1} > k) \leq \delta . \\ \end{array}
$$
Therefore, we have proved that for any  $T$ , with probability at least  $1 - \delta$ , we will make at least  $\min \left(\frac{T}{2(n + 2)\ln(n / \delta) + 1}, n - 1\right)$  mistakes.
E Proof of Theorem 4
Algorithm 3 MWMR (Multiplicative Weights on Mistake Rounds)
1: Initialize the version space  $\mathrm{VS} = \mathcal{H}$    
2: for  $t = 1,\dots ,T$  do   
3: Pick one hypotheses  $f_{t}$  from VS uniformly at random.   
4: if  $\widehat{y}_t\neq y_t$  and  $y_{t} = +$  then   
5: VS  $\leftarrow$  VS  $\{h\in \mathrm{VS}|d(x_t,h)\geq d(x_t,f_t)\}$    
6: else if  $\widehat{y}_t\neq y_t$  and  $y_{t} = -$  then   
7: VS  $\leftarrow$  VS  $\{h\in \mathrm{VS}|d(x_t,h)\leq d(x_t,f_t)\}$    
8: end if   
9: end for
Proof. First, when the algorithm makes a mistake at round  $t$ , he can at least eliminate  $f_{t}$ . Therefore, the total number of mistakes will be upper bounded by  $|\mathcal{H}| - 1$ .
Let  $p_t$  denote the fraction of hypotheses misclassifying  $x_t$ . We say a hypothesis  $h$  is inconsistent with  $(x_t, f_t, y_t, \widehat{y}_t)$  iff  $(d(x_t, h) \geq d(x_t, f_t) \wedge \widehat{y}_t = -\wedge y_t = +)$  or  $(d(x_t, h) \leq d(x_t, f_t) \wedge \widehat{y}_t = + \wedge y_t = -)$ . Then we define the following events.
-  $E_{t}$  denotes the event that MWMR makes a mistake at round  $t$ . We have  $\operatorname{Pr}(E_t) = p_t$ .
-  $B_{t}$  denotes the event that at least  $\frac{p_t}{2}$  fraction of hypotheses are inconsistent with  $(x_{t},f_{t},y_{t},\widehat{y}_{t})$ . We have  $\operatorname*{Pr}(B_t|E_t)\geq \frac{1}{2}$ .
Let  $n = |\mathcal{H}|$  denote the cardinality of hypothesis class and  $n_t$  denote the number of hypotheses in VS after round  $t$ . Then we have
$$
1 \leq n _ {T} = n \cdot \prod_ {t = 1} ^ {T} (1 - \mathbb {1} (E _ {t}) \mathbb {1} (B _ {t}) \frac {p _ {t}}{2}).
$$