Statistical Collusion by Collectives on Learning Platforms
Authors: Etienne Gauthier
Francis Bach
Michael I. Jordan
Venue: ICML 2025 oral (2025)
Keywords: Learning Algorithms
Collective Action
Data Poisoning
Primary area: social_aspects->robustness
TL;DR: We study how collectives can pool their data to strategically modify it and influence learning platforms.

Abstract: As platforms increasingly rely on learning algorithms, collectives may form and seek ways to influence these platforms to align with their own interests. This can be achieved by coordinated submission of altered data. To evaluate the potential impact of such behavior, it is essential to understand the computations that collectives must perform to impact platforms in this way. In particular, collectives need to make a priori assessments of the effect of the collective before taking action, as they may face potential risks when modifying their data. Moreover they need to develop implementable coordination algorithms based on quantities that can be inferred from observed data. We develop a framework that provides a theoretical and algorithmic treatment of these issues and present experimental results in a product evaluation domain.

Statistical Collusion by Collectives on Learning Platforms
Etienne Gauthier' Francis Bach Michael I. Jordan" 12
Abstract
adversarial behavior, the collective may be able to exert a significant influence on the algorithm. This concept of collective action has its origins in cconomic theories (Olson, 1965) and has been more recently explored in the context of machine learning (Hardt et al., 2023). It is crucial to under- stand how such collectives can influence learning algorithms to better comprehend the dynamics within the network of agents and to deploy algorithms that are reliable and aligned with the majority interests of consumers. We will focus specifically on the case of a platform that deploys a learning algorithm and interacts with a population of consumers.
As platforms increasingly rely on learning algo- rithms, collectives may form and seek ways to influence these platforms to align with their own interests. This can be achieved by coordinated submission of altered data. To evaluate the po- tential impact of such behavior, it is essential to understand the computations that collectives must perform to impact platforms in this way. In partic- ular, collectives need to make priori assessments of the effect of the collective before taking action, as they may face potential risks when modify- ing their data. Moreover they need to develop implementable coordination algorithms based on quantities that can be inferred from observed data. We develop framework that provides a theoreti- cal and algorithmic treatment of these issues and present experimental results in product evalua- tion domain.
Collective Action in Machine Learning, We draw on the work of Hardt et al. (2023), who investigate the follow- ing problem: a population of individuals (ar, y) E X x V, drawn i.i.d. from a distribution D, interacts with a plat- form. A collective of relative size a E (0, 1) forms within this population with the goal of influencing the platform. The collective's influence is quantified by success met- ric S(a), the definition of which depends on the collec- tive's 's objective. To influence the platform, members of the collective modify their data according to a common strat- egy h X xy - X' y, which maps the original features and labels of the data to modified features and labels. The platform observes mixture of distributions aD + +(1 (I-a)D, where D is the distribution of h(z) with = ~ D. The plat- form selects a classifier based on this distribution. Thus, the objective for the collective is to choose a strategy h that maximizes its success S(a). Hardt et al. (2023) propose strategies h for two distinct goals: signal planting and sig- nal erasing. They derive lower bounds on the success S(a), enabling the identification of minimum collective size a* such that S(ar) 2 S* for all 2 a*, where S* is target threshold.
1. Introduction
The dynamic interaction among agents and algorithms cre- ates a complex ecosystem where unanticipated individual and collective behavior can emerge. The study of such be- havior is crucial for understanding how to design systems that are robust, fair, and aligned with societal values.
In a network, agents often have diverse motivations and multiple incentives. When the incentives of the interacting agents do not fully align with those of the designer of the learning system, the former may wish to influence the learn- ing process. This becomes salient in the common case in which a learning system interacts with large number of agents. Such agents may collaborate, forming cartel, by pooling their data and devising a common strategy. Accord- ingly, even if the learning algorithm is robust to single-agent
Unfortunately, several of the strategies h studied by Hardt et al. (2023) are not available in practice to the collective. Furthermore, the bounds obtained on the success S(a) de- pend on key parameters that are unknown to the collective. Lastly, in practice, the collective seeks priori guarantees of success before altering its data, as modifying the data may expose members to risk. In this paper, we introduce a new framework to enable members of the collective to learn strategies h efficiently and to infer the parameters that determine their success on the platform.
Inrra, Ecole Normale Supérieure, PSL Research University, Paris DDeparmments of EECS and Statistics, University of Cal- ifornia, Berkeley. Correspondence to: Etienne Gauthier <eti- enne enne.gauthiere gauthicr@inria.fs.
Proceedings of the 42nd International Conference Machine Learning. Vancouver, Canada. PMLR 267, 2025. Copyright 2025 by the author(s).

---

Statistical Collusion by Collectives on Learning Platforms
Contributions. Our primary contribution is the introduc- tion of novel framework which empowers collectives via statistical inference. This statistical framework allows for the derivation of three key results, each tied to distinct objective that a collective may pursue to influence a plat- form: signal planting, signal erasing, and a new objective we introduce, signal unplanting.
to detect. For comprehensive discussions on data poisoning. backdoor attacks, and defense mechanisms, we refer the reader to the surveys by Tian et al. (2022), Guo et al. (2021), and Cinà et al. (2023).
Data poisoning is a critical topic in machine learning. Many empirical studies focus on backdoor attacks and the defense mechanisms for learning algorithms. However, there is rela- tively little research that analyzes the effectiveness of these attacks theoretically. Grosse et al. (2022) show that back- door patterns induce a stable representation of the target class. The classifier relies on the backdoor trigger and dis- regards other features. In the case of binary classification, Manoj & Blum (2021) demonstrate that if the model has a property called nonzero memorization capacity, then a successful backdoor attack is possible. The model's vulner- ability is assessed based on its ability to memorize out-of- distribution values. In particular, overparameterized linear models have higher memorization capacity and are more susceptible to attacks. Xian et al. (2023) also investigate the context of binary classification and propose a hypothesis regarding the distribution of poisoned data, which allows them to derive useful results on the effectiveness of an attack. Wang al. (2024) explore the effectiveness of backdoor attacks from statistical standpoint. They provide bounds on the statistical risks associated with a poisoned model, specifically analyzing how these risks manifest when the model is evaluated on both clean and backdoored data for a finite sample size. Li & Liu (2024) present a theoretical examination of backdoor attack applied to a convolutional neural network with two layers. Cinà al. (2024) con- duct an empirical study the learning curves associated with backdoor attacks. Moreover, they demonstrated that classifiers with stronger regularization are generally more resistant to poisoning attacks, although this comes with a slight decrease in accuracy on clean data.
We thoroughly explore strategies that a collective can em- ploy to achieve each of these goals and provide theoretical guarantees for the effectiveness of these strategies. The statistical inference capabilities of the collective serve two main purposes: first, to estimate the most effective strategies for influencing the platform, and second, to infer key pa- rameters that determine the collective's success. This dual approach allows the collective to predict its potential impact on the platform with high probability.
Our framework reduces to that of Hardt et al. (2023) in the infinite data regime, although we note that we improve on earlier results in this regime-ou our lower bounds are tighter than those from Hardt et al. (2023). Our main focus, how- ever, is the setting in which the signal set is finite. We obtain bounds in this setting that form staircase-like curves. This result provides new interpretation of data poisoning bounds: the success of attacks depends not just on the signal set to be poisoned as a whole but more precisely on each feature within it. Each feature has a resistance to poisoning, requiring a specific level of attack to breach it, resulting in these staircase patterns. When the steps are close enough, these curves resemble the smooth sigmoid shapes seen in data poisoning literature.
We construct a synthetic dataset to validate our theoretical findings and to examine the influence of various parameters empirically. Our empirical results highlight, among other things, that the effectiveness of the collective depends not only on its relative size compared to the total number of agents interacting with the platform but also on its absolute size. A larger collective, in absolute terms, can obtain better statistical estimates and thus more accurately infer optimal strategies. This result implies that larger platforms may be more vulnerable to collective action.
What sets the concept of collective action apart conceptually is its treatment of the collective group of individuals, each representing data point. This perspective also has eco- nomic, social, and political dimensions, as certain groups of individuals can unite and collaborate to influence decisions. Such ideas have been explored in areas of research at the intersection of machine learning and other fields (Vincent et al., 2019; Albert et al., 2020; Vincent et al., 2021; Al- bert et al., 2021; Creager & Zemel, 2021; Vincent & Hecht, 2021). See Appendix A of Hardt et al. (2023) for an in- depth analysis of the related work on collective action. In addition, Ben-Dov et al. (2024) highlight how the learning algorithm shapes the success of collective action.
2. Related Work
Our research builds upon and extends the concept of col- lective action in machine learning, a framework originally introduced by Hardt et al. (2023). Collective action relates closely to data poisoning attacks in machine learning, a subset of security attacks that disrupt model training by injecting malicious data to degrade performance or alter pre- dictions. Of particular virulence, backdoor attacks embed a hidden trigger in the data that activates malicious behavior only when the trigger appears, making them subtle and hard
An important contribution of Hardt et al. (2023) is to study data poisoning via the formalism of Bayes-optimal classi- fication, which yields a conceptual inversion of the idea of strategic classification (Hardt et al., 2016). While strategic
2

---

Statistical Collusion by Collectives on Learning Platforms
classification revolves around a firm's ability to anticipate and respond the actions of single, strategic individual, collective action shifts the focus toward scenario where individuals collectively anticipate and strategically respond to the optimizing behavior of the firm. This concept has also been explored by Zrnic et al. (2021). Unlike traditional strategic classification, which primarily considers the firm's perspective, collective action highlights the role of workers and consumers on online platforms.
i.d. The collective. Given a test set of consumers Drest ~ D, the collective's goal is to obtain guarantees with high prob- ability on their success S(n) as function of Drest. The definition of ((n) is based on the objective desired by the collective. We will consider three objectives: signal plant- ing, signal unplanting, and signal erasing. The collective modifies its data using strategy h to maximize its success.
We assume that the collective has access to the value N. This is a weak assumption because it is common in practice. For example, if the platform a polling institute seeking to understand participants' voting preferences based on their demographic data, the total number of people surveyed is usually publicly available.
3. Statistical Algorithmic Collective Action in Classification
First, will describe the new setting for deriving theo- retical bounds in collective action that are effectively com- putable by the collective. We then present our three main results, which address three different objectives for the col- lective. Two of these objectives are classic goals of collec- tive action: signal planting and signal erasing. Additionally, we introduce a new objective: signal unplanting, where the collective aims prevent an association between the sig- nal set and certain label. We will explore strategies and provide theoretical guarantees for each of these objectives.
Unless stated otherwise, the collective has access only to their own data and not to the data of consumers who are not part of the collective. The collective can pool its data to infer quantities that depend on the underlying distribution. Throughout this paper, we will use Hoeffding's 's concentra- tion inequality (Lemma D.1) for simplicity. We will denote Hoeffding error terms as follows:
Rk(k) = log( (1/5)
2k
3.1. Setting
for any 8 > O and &: No. We note that Hoeffding's inequality can be loose, for example when applied to sums of Bernoulli random variables with means close to zero. One can address this issue by using other concentration inequalities such as Bernstein; the framework we present here can readily incorporate such choices.
We consider platform that deploys learning algorithm in universe X' y. We assume that X' x y is finite. Each individual corresponds to single data point (z, E x7.
The platform trains a classifier f on a training dataset. The training dataset is composed of N consumers which are ini- tially drawn i.i.d. according to some distribution D. Among these consumers, a certain number n < N forms a collective to strategically influence the firm's s behavior. The collective shares common strategy h X y - X' V. The N base consumers and the members of the collective together form an empirical distribution of consumers P. and the corresponding dataset constitutes the training set. The collective wants to obtain guarantees on the influence they have on the platform at test time.
The platform. The firm observes an empirical distribution of consumers P. It selects a classifier f based on this dis- tribution P. Following Hardt et al. (2023), we characterize classifiers f by their suboptimality in terms of total variation distance with respect to the observed distribution P:
Definition 3.1. Let E > 0. A classifier f : X + y is e-suboptimal on a set X' C X under the distribution P there exists a distribution P with (V(P, P)) I & such that
f(x) E argmax P(r,w) yEY'
Notation. Given a distribution Q over X' V. we denote by Qx the marginal distribution over features. We will sim- ply write Q when the context allows. We denote by D the distribution of hz)2,2 2 ~ D. More generally, for dataset D. we write D := {h(2) | 2 E D} (as a multiset) for the same dataset after applying strategy ht We will also write, for E C X' x y. PP (2 E B) := #D Ex,e (aren1/z:eB [ the =>-
for all x E X". Here, (V, = sup |P(E)-PEE) ECX'x
denotes the total variation distance between Po and P.
The parameter roughly controls how much the classifier can make use of statistics that go beyond simple frequency counts. It accounts for classifiers that consider feature inter- actions and capture complex patterns in the data.
empirical probability of the event F. induced by a dataset D. We use IP denote empirical probabilities, and P for popu- lation probabilities. When the variables do not need to be explicitly stated, we may write P(E) and P(E) instead of
3.2. Signal planting
P. (z E E) and IP (= E E) respectively. D
In signal planting, we are given a transformation g : X + X and a target label y" E y. The map g induces a signal set
D
3

---

Statistical Collusion by Collectives on Learning Platforms
= (g(x)) x X3. defined by ==
The success is defined as P (f(o(t)) - y"),
is obtained through data pooling by the collective's mem- bers, and D(*) is computed by applying strategy h to the dataset D("), Details on the algorithm for computing the lower bound are provided in Appendix B, and the code is available at: https: / / tit........... wtt.ccoccaaaoaoc /eoon//atiieeE st
(m)) =-
z Denee
t. D is the test set. In other words, the where Deest ~ collective aims to enforce an association between the signal set X' and a target label y² at test time.
collusioooolsion
The interpretation of lower bound (I) is that success in- creases step by step: each feature ã in the signal set X has certain resistance to being planted. As the relative size of the collective n/N gradually increases, features 7 are cracked as their resistance breaks, in decreasing order of re- sistance. For each feature c., its resistance depends on three terms. The first one, here N ( P (ø) - (n)) represents D(m))
3.2.1. FEATURE-LABEL SIGNAL PLANTING
A natural goal for the collective is maximize its success, (nz). To ensure that its efforts are effective, the collective aims to establish theoretical lower bounds on S()), as these provide a guarantee of success. To do so, the collective can play the feature-lahel signal planting strategy defined helow. Definition 3.2 (Feature-label signal planting strategy). We define the feature-labet signal planting strategy as h (xx y) = (g))),"").
how prevalent the feature 5 is in the modified data: the more frequently E appears in the poisoned data, the greater the collective's ability to influence the associated label. The second term, here - w (A (n) + 22g(() + 2R -)), captures the counteracting influence of non-collective indi- viduals in the population, quantifying how much they might limit the collective's ' success in planting the signal. in- dicates how strongly the target label is associated with the signal set: the more frequent y² is in the signal set, the easier it is to plant the signal: if other labels are far more likely than y", planting the signal becomes more difficult. The third term, The represents the platform's 's ability to adapt to the distribution of its users. As E + T-E increases with e, it benefits the collective to have close to zero, limiting the platform's 's flexibility and resulting in a tighter bound.
We analyze the effect of this strategy on the learning plat- form. Formally, we are given three independent datasets: dataset ((n) ~ D of n consumers which are part of the collective; a dataset D(N-n) i.d. 'D of N n con- sumers which are not part of the collective; and a dataset Dtest i.dd D of Ntest consumers forming the test dataset. We recall that D(m) := {h(z) | = E D(7) (as multiset). The training set of the platform's 's classifier is the concate- nation of (( and D(N--), In other words, the platform observes the distribution:
The first term scales approximately linearly with n, by a factor of n/N, while the second term decreases by 1 1-n/N. However, the dependence is more complex than purely lin- ear. The bound involves estimation terms Rg(.), which decay at rate proportional to n 11/2 as n increases. The bound also depends on Rg(N - nt). but these terms can be negligible as long as n remains much smaller than N.
(o). 3o). N n IP
P( vo) ==
IP (Zo, (o) N Dim
+
N
DWN
The platform then chooses a classifier j based on P. We can now state the main result for signal planting:
Theorem 3.3 (Signal planting lower bound, feature-label signal planting strategy). Let 8 > O, and write ò := 5/(2 + Then, by playing the feature-label signal planting strategy against a classifier that is e-suboptimal on &, the collective achieves with probability at least 1 1-6 5 (over the draw of the consumers):
Also, the cardinality of X affects the definition of ô, and thus the estimation terms Rg. The smaller #. is, the better the collective's 's estimates will be, resulting in sharper bounds.
3.2.2. FEATURE-ONLY SIGNAL PLANTING
S(n) P
P
(z) - -2R;(n)
Note that the feature-label signal planting strategy assumes that the members of the collective can change both their features and their labels. This might not always be feasible in practice, where labels can be immutable. In this situation. natural strategy for the collective to g(z) when y = y² This strategy was explored by Hardt et al. (2023). However, it is preferable for the collective to additionally change its feature x to some To that is not in the signal set X when y * y². This ensures that not only does the feature belong to the signal set X when the label is y", but also that if feature is in the signal set X,, the associated
B D(n)
N
D(m)
N
(A())
(m)
+ (n) + +2Rg(N -n)) (1)
N
Rg(n)= - (Nesst)));
change its feature
E
where A (n)
max P (5.3/) - P (ū)
y/ Ver"""))
Dim)
Proofs and additional remarks can be found in Appendix E. Note that lower bound (1) is fully computable by the col- lective as it depends only on datasets ((a) and D(m), (())
4

---

the impact of not modifying labels the collective's 's in- fluence. In the following, we will always assume that the Statistical Collusion by Collectives on Learning Platforms
label is necessarily y² This dual condition strengthens the association between the signal set X' and the target label y"- In this case, we can directly say that the term P (g(x)),
The collective's 's goal is now to prevent an association be- tween the signal set X {x(2)) E 2} and the target label y".
D(m)
with y/ # y" that would appear in the proof of Theorem 3.5 is equal to zero, leading to a sharper bound.
3.3.1. 1. NAIVE STRATEGY
Definition 3.4 (Feature-only signal planting strategy). We define the feature-only signal planting strategy
A simple and naive strategy for the collective is to flood the platform with feature-label pairs of the form (g(z), 3/) for some fixed y' + y² Indeed, for any y' & y², we have that
{ (0(x))))) y- h(x,y) v) 11 (zo. v)
otherwise,
S(n) = P (flo(z)) # /y)) (f(g(z)) v/) =: S.
Drans
where xn E x2 is any feature that does not belong to the signal set X. Note that ag does not have to be fixed across all initial data points (xr, v).
2 IP Dross
Therefore, the collective can compute lower bounds on (n) for all y * y" using Theorem 3.3. It can then play the strategy h( y) (g(x), y) where ÿ is the label that maximizes the lower bounds on (n)(n) for y * y². Note that this is equivalent to planting signal with trans- formation and target label y. so we obtain the same guar- antees as in Theorem 3.3.
We can generalize Theorem 3.3 to the feature-only strategy: Theorem 3.5 (Signal planting lower bound, feature-only signal planting strategy). Let > O, and write δ == 6/(2 + 2#8 + # Then, by playing the feature-only signal planting strategy against a classifier that is e-suboptimal on X, the collective achieves with probability at least 1 1-6 (over the draw of the consumers):
3.3.2. ADAPTIVE STRATEGY
5(m) 2
p
P (g(x'),0') 22g((1)
D(n)())
N
The collective can also use an adaptive strategy, meaning that each member of the collective (a,, y) can change its feature-label pair to some (g(x), My(=)) where the modified label U)(w)) depends on g(æ=) and is no longer fixed. The plan for the collective is to estimate the optimal label using a subset of ne < n randomly chosen participants. Formally, we assume that D(1) is the concatenation of two indepen- dent datasets (m,) and D(==ne) drawn from D. A natural strategy for the collective is to change every pair (Ir, y) into (g(z), (g(=)) where for à E &:
N
n
m)) -n)) 0 (n) R2 (Necst)
(n)
+ +2Rg(n) + +2Rg(N
(2)
N
g(0¹)
where A (m) g(x') is defined in Theorem 3.3.
We can straightforwardly compare lower bounds (1) and (2). The only difference is that in (2), we have p (0(z)),)))))))))))))))))))))(( D(n)
instead of P (g(x"). This comparison directly measures D(c)
D2 = argmax P (σ. vZ) V'E'((")DD
(3)
collective can modify its labels.
We formalize this strategy in the following definition.
Signal planting relies on a straightforward strategy: flooding the platform with as many pairs (g(z), y²) as possible. This strategy simple and does not require the collective to per- form any statistical estimation. Statistical inference is only necessary for the collective to calculate the lower bound success, not for defining the optimal strategy h. In the next two sections, we examine two objectives that additionally require statistical estimation to infer the optimal strategy h: signal unplanting and signal crasing.
Definition 3.6 (Signal unplanting strategy). We define the signal umplanting strategy as
h(2, v) = Dg(r)),
where d is defined in Equation (3).
Intuitively, this strategy means that the collective aims to se- lect the most likely label among all labels different from y", given feature g(x)).
3.3. Signal unplanting
The setting is essentially the same as before; the only differ- ence is the success of the collective is defined as follows:
Theorem 3.7 (Signal unplanting lower bound). Let ò > O, and write 5 = 5/(2 + 6)))) Let n. < n. Then, by playing the signal unplanting strategy above against a clas- sifier that is E-suboptimal on X, the collective achieves with
5(x) = P
(f(o(z)) # v²)
Denes
5

---

Statistical Collusion by Collectives on Learning Platforms
probability at least 1 8 (over the draw of the consumers):
Now, we outline a scheme that the collective can use to compute lower bound. The basic idea is that each member (x, v) of the collective keeps its feature z but changes its label to the most likely label Vz(z)) based on the feature g(z). This approach encourages the platform to predict the same label for both æ and g(æ), hence erasing the signal. The scheme is the following: first, the collective pools its data to predict the optimal y for each I E X. Then, the collective (4) applies some strategy h based on the first step to erase the signal. Assuming the collective can compute the optimal label V for each F E X, the erasure strategy is formally defined as follows:
S(n) 2
P
p
(i) - -2)x(z)
2~ D(n)
N
D(n)
N
4 (n-ne)
+ +2Rg (n- mo)) + 2N n))
N
0 Rn(n) (NNeeet))),
1 E
E
where 4 (n-
(2, - P (en--me)
(3, 0z).
Din-ne)
3.4. Signal erasing
Definition 3.8 (Erasure strategy). We define the erasure strategy as
In the previous subsections, we examined how the collective can plant signal by using natural strategy, which consists in simply flooding the platform with feature-label pairs of
h(2,y) = (x, Fg(=)):
where y is given in Assumption for each ā E X.
the form h(,, y) (g(x;), y"), and how it can unplant sig- nal by estimating the most probable label different from y". In this section, we study another objective: signal erasing.
We can now state the main result in signal erasing:
Theorem 3.9 (Signal erasing lower bound). Let 8 > 0, and write 5 == 5/(2 + # + 2# + 2# Assume that 2 2 S n S N - 2 where 1J is given in 9²* Assumption 1. Then, with probability at least 1-8 (over the draw of the consumers), the collective can compute y for all ā E X and by playing the erasure strategy it achieves against a classifier that is e-suboptimal on X:
We consider a transformation g : X - X. The success of the collective now defined by:
((m) == P Demes
((()))))((o))
As outlined by Hardt et al. (2023), maximizing (() aligns with reducing the impact of g the learning algorithm. The term signal erasing is motivated by the example in tabular data where preserves certain features while removing others, for instance by setting some features to a fixed value. This effectively removes the impact of the erased features, provided these features are independent of the other ones.
5(n)
2
P
n
P D(n)
(x') - 22Rg(z)
D(e)
N
N n
(n)
+ +2Rg(n)= + -N (5)
N
E
> 0
- Rg(n)) - RBg (Nioss),
In this part, we will make the following mild assumptions. Assumption (A1): Bn > 0, Vi E Zy E y Vy + 3b. p( v2) > p(.. 3/) + n7
where A (n)
(I' I
(x', U Vgtzr)) D(n)
max 3/ MEMO
) D(n)
Intuitively, Assumption I implies two things. Firstly, each feature ā E X is sufficiently frequent in the base distribution. Secondly, given a feature ă E X, there exists a label yf that is consequently more probable than the other labels in the base distribution.
In signal crasing, just like in signal unplanting, the collective leverages its own data to compute the strategy h. However, the technique differs. In signal unplanting, the collective uses a fraction of its members estimate the optimal label to play. Whereas in signal erasing, the collective, provided that it is sufficiently large, utilizes all of its data to compute the most likely label given a feature G. which exists under Assumption 1.
Assumption (A2):
The transformation is idempotent:
g(((x))= = gxx)) for all x E X.
To understand Assumption 2, consider data poisoning in image classification. Assumption 2 holds in data poisoning strategies where the trigger a fixed, opaque watermark, as in the case of binary masks (Gu et al., 2019), where applying the mask twice is equivalent to applying it once. However, this is not true for strategies like pixel blending (Chen et al., 2017). In contrast, Assumption 2 naturally applies to tabular data, where the collective can apply a transformation g to map a feature to a constant value.
4. Experimental Evaluation
In our experiments, we simulate platform that collects data on vehicles, where each sample represents car. The fea- tures of each car include characteristics such as Model Type, Fuel Type, and Country of Manufacture. The labels assigned to each vehicle reflect the car's 's evaluation, categorized into four classes: Excellent, Good, Average, or Poor. Further
6

---

Statistical Collusion by Collectives on Learning Platforms
y Excellent
y" Good
yf
Average
y'
Poor
1.0
1.0
1.0
CECCCCCO
1.0
0.8
0.8
0.8
Success
9
0.6
0.6
0.6
0.6
0.4
Lower bound
0.4
0.4
0.4
0.2
S(x)
0.2
0.2
0.2
0.0
0.0
10
40
50
0
10
20
10
20
30
40
50
20
30
40
50
Relative collective size n/N (in %)
Figure 1. Signal planting with feature-lahel strategy. Comparison of the theoretical lower bound from Theorem 3.3 and the true ((n) observed at test time for different values of n and fixed value of N = 1, 000, 000. For all target labels, the lower bound indicates that approximately 10% of the total number agents interacting with the platform necessary to significantly influence reality, the success observed at test time shows that just under 5% of members is sufficient, except for the target label y²= Excellent, which is already consistently the most frequent and does not require any planting.
details on the dataset and the specific parameters used in the experiments can be found Appendix A.
1.0
0.8
We consider scenario where collective seeks to influ- ence the platform by lobbying against particular category of vehicles, specifically SUVs with specific features. The collective defines a signal set X through a transformation g fixing all feature values except Country of Manufacture. They may want to plant a signal targeting a label y" Poor. They might also aim to unplant signals, specifically working to associate elements of X with labels y * Excellent.
Success
0.6
0.4
500,000
1,000,000
0.2
2,000,000
22
26
28
30
Relative collective size n/N (in %)
Figure 2. Signal planting with feature-label strategy. Lower bound from Theorem 3.3 with y Poor for different values of with N = 500,000, N = 1, 000, 000, and = 2, 000, 000.
4.1. Signal planting
In Figure 1, we plot the lower bounds from Theorem 3.3 for various values of and compare them to the true success (m) observed at test time. We fit sigmoid functions to in- terpolate the obtained values. The lower bounds are indeed lower than the success, and the gap between the two is not excessively large. This gap could potentially be narrowed using more advanced statistical inference methods. Inter- estingly, even though in practice the label y" Excellent is already the most frequent label for every element of the sig- nal set X and does not technically need to be planted-i.ee ((2) = for all n- the collective is still not guaranteed to have influence over the signal for small values of n. This stems from statistical uncertainties, which our framework highlights, causing the collective to consistently overesti- mate the number of agents needed for given success.
4.2. Signal unplanting
We now focus on signal unplanting with a target y A Excel- lent, where the collective aims for the platform to predict label other than Excellent for samples in the signal set X.
The lower bound obtained in Theorem 3.7 depends Re. the size of the sub-collective used to determine the strat- egy h. As shown in Figure 3 (a), The involves a trade-off: small values lead to erratic strategy estimates and weaker bounds, while overly large values increase the Rş(n ne) term, also weakening the bound. good balance achieved at ne 2, 000.
Figure 3 (b) compares this adaptive strategy with = 2, 000 to naive strategies planting labels y" e (Good, Average, Poor). The adaptive strategy consistently outperforms the naive ones by providing a higher lower bound, demonstrating the benefits tailoring strategy based on the data. However, it is worth noting that the naive strategy of planting the signal with y Good performs well for this dataset. This is due to the fact that most elements in the signal set X' have Good as the second most likely label after Excellent.
Figure shows how the lower bound evolves with the total number of individuals N. When the fraction n/N / is held fixed, increasing N leads to larger collective size This, in turn, improves the collective's ability to estimate key quantities, as reflected by the decreasing error terms (n). This suggests that platforms interacting with large user bases are more exposed to collectives altering their data. While this observation is specific signal planting, it is even more relevant when optimal strategies need to be estimated, as in signal unplanting.
In Figure 3 (c), we compare the lower bound with ne = 2, 000 and the actual success S(n) achieved test time.

---

Statistical Collusion by Collectives on Learning Platforms
1.0
1.0
0.4
0.4
Zoomed-in view
10
10
16
1.0
1.0
0.8
0.8
0.8
Success
0.6
0.6
2,000
0.6
0.4
100
0,4
G
0.4
2,000
O
O
2,000
0.2
10,000
0.2
0.2
S(n)
0.0
0.0
0
10
15
20
25
30
0
10
15
20
25
30
0
10
15
20
25
30
(a)
(b)
(c)
Relative collective size n/N IN (in %)
Figure 3. Signal unplanting, (a) Comparison of lower bounds from Theorem 3.7 for different values of n4. (b) Comparison between the adaptive strategy with ne 000 and naive planting strategies targeting labels y" {Good (G), Average (A), Poor (P)). (c) Comparison the lower bound achieved by the adaptive strategy with nee = 2, 000 and the actual success S(n) observed at test time.
The lower bound suggests that the collective would need to represent around 10% the agents interacting with the platform to have significant impact, while in practice, only about 3% was sufficient.
Interestingly, in the case of discrete signal set, as used in our experiments, our lower bounds take on a stairease shape rather than a smooth sigmoid. This mirrors the shape of the curves observed in signal unplanting in Figure 3, which would also appear in Figure and Figure 2 if used finer increments of n. In contrast, the bounds from Hardt et al. (2023) do not capture this phenomenon.
4.3. Comparative analysis
5. Discussion
0.8
Success
0.6
F-L Ours
In this work, we introduced a framework where collectives aiming to influence a platform can leverage their local in- formation by pooling their data. Our approach captures the key desideratum that collectives may not only want to observe the outcomes of their actions at test time but also anticipate lower bounds on their success. Moreover, it al- lows the collective to implement practical strategies based on parameters they do not directly observe, by using sta- tistical estimation. The ability anticipate outcomes and make informed decisions based pooled data represents an ad advancement in understanding how collectives interact with and influence platforms. However, there is room for further exploration.
0.4
F-L Hardi et ul.
F-O Ours
0.2
F-O Hardt
0.0
1
0
10
20
30
40
50
60
70
80
90
100
Relative collective size a (in %)
Figure Signal planting. Comparison of signal planting lower bounds with target y = Poor using feature-label (F-L) and fcature- only (F-O) strategies. Our bounds the infinite data regime are compared to bounds from Hardt et al. (2023), when = 0.
Our Lnite--samle framework differs from that presented by Hardt et al. (2023), which focuses on population- analysis. The connection that the limit of our framework the infinite data regime boils down to that of Hardt al. (2023). Specifically, for a (0, 1). let n, N, Nest - such that n//N a. In this case, our statistical algorithmic collective action framework simplifies that of algorithmic collective action. In Figure 4, we compare the bounds we obtain under the infinite data regime with those of Hardt et al. (2023). The bounds presented in our work are tighter than those obtained by Hardt et al. (2023). We provide a proof and additional remarks in Appendix
We used Hoeffding's inequality as a proof of concept, but is worth studying improved concentration inequalities for obtaining estimates of success for collectives. It is also possible reverse the concentration inequalities derive upper bounds on success, but the challenge lies in the fact that these upper bounds are often trivial. In ongoing work, we are exploiting recent developments in concentration in- equalities due to Howard et al. (2020).
We focused on classification, but extensions other objec- tives, such regression, would be useful. We also assumed
8

---

Statistical Collusion by Collectives on Learning Platforms
that the feature space X' is finite use limited number of events in the union bounds. It would be natural to remove this assumption by using covering of X, provided it is compact, to derive more general bounds for signal planting and unplanting.
Albert, K., Delano, M., Kulynych, B., and Kumar, R. S. S. Adversarial for good? How the adversarial MI. commu- nity's s values impede socially beneficial uses of attacks. arXiv preprint arXiv:2107.103000 2021.
Ben-Dov, O., Fawkes, J., Samadi, S., and Sanyal, A. The role of learning algorithms in collective action. In Pro- ceedings of the International Conference on Machine Learning, 2024.
Finally, a key assumption collective action that indi- viduals are identically distributed. However, those who join collective are often distributed differently from the gen- eral population- e.g., collective against SUVs is likely to have fewer SUV-related data points and more data smaller vehicles. Extending the framework to account for a heterogeneous population is an important direction for future work.
Chen, X., Liu, C., Li, Lu, K., and Song. D. Targeted backdoor attacks on deep learning systems using data poisoning, arXiv preprint arXiv:1712.05520 2017.
Cinå, A. E.,, Grosse, K., Demontis, A., Vascon, S., Zellinger, W., Moser, B. A., Oprea, A., Biggio, B., Pelillo, M., and Roli, F. Wild patterns reloaded: A survey of machine learning security against training data poisoning. ACM Comput. Surv., 55(13s), 2023.
Acknowledgements
The authors would like to thank Eugène Berta, Sacha Braun, Yurong Chen, and David Holzmüller for their helpful com- ments and suggestions.
Cinå, A. E.,, Grosse, K., Vascon, S., Demontis, A., Biggio, B., Roli, F., and Pelillo, M. Backdoor learning curves: Explaining backdoor poisoning beyond influence func- tions. International Journal of Machine Learning and Cybernetics, 2024.
Funded by the European Union JERC-2022-SGG-OEEEE (01071601), Views and opinions expressed are however those of the author(s) only and do not necessarily reflect those of the European Union the European Research Council Executive Agency. Neither the European Union nor the granting authority can be held responsible for them.
Creager, E. and Zemel, R. Online algorithmic recourse by collective action. ICML Workshop on Algorithmic Recourse, 2021.
This publication is part of the Chair "Markets and Learning", supported by Air Liquide, BNP PARIBAS ASSET MAN- AGEMENT Europe, EDF, Orange and SNCF, sponsors of the Inria Foundation.
Grosse, K., Lee, T., Biggio, B., Park, Y., Backes, M., and Molloy, I. Backdoor smoothing: Demystifying backdoor attacks deep neural networks. Computers &Securtyy, 120: 14, 2022.
This work has also received support from the French govern- ment, managed by the National Research Agency, under the France 2030 program with the reference "PRIAIJRIE-PSAI" (ANR-23-IACLL0008),
Gu, T., Liu, K., Dolan-Gavitt, B., and Garg, S. Badnets: Evaluating backdooring attacks on deep neural networks. IEEE Access, 7:47230-47244, 2019.
Impact Statement
Guo, W., Tondi, B., and Barni, M. An overview back- door attacks against deep neural networks and possible defences. IEEE Open Journal of Signal Processing, 3: 261 281, 2021.
This paper provides theoretical and algorithmic founda- tion for studying collective influence, shedding light on the computations and coordination strategies necessary for such actions. By formalizing these mechanisms, we contribute to a deeper understanding of the risks and opportunities associated with collective interventions. This knowledge is essential for designing more robust, transparent, and socially aligned learning systems that account for strategic behavior and ensure fairer, more predictable outcomes in algorithmic decision-making.
Hardt, M., Megiddo, N., Papadimitriou, C., and Wootters, M. Strategic classification. In Proceedings of the Con- ference on Innovations in Theoretical Computer Science, pp. 111-122, 2016
Hardt, M., Mazumdar, E., Mendler-Dünner, C., and Zrnie, T. Algorithmic collective action in machine learning. In Proceedings of the International Conference on Machine Learning. 2023.
References
Albert, K., Penney, J., Schneier, B., and Kumar, R. S. S. Politics of adversarial machine learning. arXiv preprint a701v:2002.05648, 2020.
Howard, S. R., Ramdas, A., McAuliffe, J., and Sekhon, J. Time-umife unn-uuniorm Chernoff bounds via nonnegative super- martingales. Probability Surveys, 17:257-317, 2020.

---

Statistical Collusion by Collectives on Learning Platforms
Li, B. and Liu, W. A theoretical analysis of backdoor poi- soning attacks in convolutional neural networks. In Pro- ceedings of the International Conference on Machine Learning, 2024.
Manoj, N. S. and Blum, A. Excess capacity and backdoor poisoning. In Proceedings of the International Confer- ence on Neural Information Processing Systems, 2021.
Olson, M. The logic of collective action: Public goods and the theory of groups. Harvard University Press, 1965.
Tian, Z., Cui, L., Liang, J., and Yu, S. A comprehensive sur- vey on poisoning attacks and countermeasures machine learning. ACM Comput. Surv., 55(8), 2022.
Vincent, N. and Hecht, B. Can "conscious data contribu- tion" help users to exert "data leverage" against technol- ogy companies? Proc. ACM Hum.-Comput. Interact., 5 (CSCW1), 2021.
Vincent, N., Hecht, B., and Sen, S. "Data strikes": Evaluat- ing the effectiveness of a new form of collective action against technology companies. The World Wide Web Conference, pp. 1931-1943, 2019.
Vincent, N., Li, H., Tilly, N., Chancellor, S., and Hecht, B. Data leverage: A framework for empowering the public in its relationship with technology companies. In Pro- ceedings of the Conference on Fairness, Accountability, and Transparency. pp. 215 215-227, 2021.
Wang, G., Xian, X., Srinivasa, J., Kundu, A., Bi, X., Hong, M., and Ding, J. Demystifying poisoning backdoor at- tacks from a statistical perspective. International Con- ference on Learning Representations, 2024.
Xian, X., Wang, G., Srinivasa, J., Kundu, A., Bi, X., Hong, M., and Ding, J. Understanding backdoor attacks through the adaptability hypothesis. In Proceedings of the Inter- national Conference on Machine Learning, pp. 37952- 37976, 2023.
Zrnic, T., Mazumdar, E., Sastry, S. S., and Jordan, M. I. Who leads and who follows in strategic classification? In Proceedings of the International Conference on Neural Information Processing Systems, 2021.
10

---

Statistical Collusion by Collectives on Learning Platforms
A. Additional Details on Experiments
generate dataset of 3,000,000 instances. Each instance represents car, characterized by multiple categorical features that capture key aspects of vehicle design, performance, and manufacturing.
The features included in this synthetic dataset are as follows:
Model Type: the type of vehicle, categorized as Sedan, SUV, Coupe, Hatchback, Convertible, Wagon, Minivan, or Truck.
Fuel Type: the fuel used by the vehicle, which can be Gasoline, Diesel, Electric, or Hybrid.
Transmission Type: the type of transmission, classified as Manual, Automatic, or CVT.
Drive Type: the drive configuration of the vehicle, identified as FWD (Front-Whes) Drive), RWD (Rear- Wheel Drive), or AWD (All-Wheel Drive).
Safety Rating: the safety rating of the vehicle, rated from star to 5 stars.
Interior Material: the material used for the vehicle's interior, which can be Cloth, Leather, or Synthetic.
Infotainment System: the level of the infotainment system, ranging from Basic, Advanced, Premium, None.
Country of Manufacture: the country where the vehicle manufactured, that we will denote by C1, C2, C3, C4, and C5.
Warranty Length: the length of the vehicle's warranty, available in options of 3 years, 5 years, 7 years, 10 years.
Number of Doors: the number of doors the vehicle, which be 4, or
Number of Seats: The seating capacity of the vehicle, with options for 2, 4. 5, seats.
Air Conditioning: indicates whether the vehicle is equipped with air conditioning (Yes or No).
Navigation System: the level of the navigation system, which can be None, Basic, or Advanced.
Tire Type: the type of tires used, categorized as All-Season, Summer, or Winter.
Sunroof: indicates whether the vehicle has a sunroof (Yes or No).
Sound System: the quality of the sound system, which can be Standard, Premium, High-end, or None.
Cruise Control: indicates whether the vehicle is equipped with cruise control (Yes or No).
Bluetooth Connectivity: indicates whether the vehicle has Bluetooth connectivity (Yes or No).
Additionally, each car is assigned a Car Evaluation label based on a scoring system that considers various factors such as safety rating, fuel type, warranty length, and others. The possible evaluation outcomes are classified into four categories: Excellent, Good, Average, and Poor.
We generate separate consumer datasets, sampled without replacement from this base dataset. Unless otherwise specified, we choose N 1, 000, 000 for the training set and Nusst 100, 000 for the test set. In all the experiments, we set 5 = 0.05 and : = 0.
In our experiments, the collective attempts to influence the platform by targeting features with specific characteristics defined through the transformation g: Model Type = SUV, Fuel Type = Diesel, Transmission Type Manual, Drive Type = RWD, Safety Rating = 4 stars, Interior Material Synthetic. Infotainment System Premium, Warranty Length 10 years, Number of Doors= 5, Number of Seats 5, Air Conditioning Yes, Navigation System Advanced, Tire Type All-Season, Sunroof Yes, Sound System = Premium, Cruise Control Yes, and Bluetooth Connectivity Yes. In the dataset containing 3 million samples, the signal set X' induced by g comprises exactly 208,871 samples, which represents just under 7% of the entire training set. Table provides details on the label frequencies within the signal set.
For further details on the dataset composition, we refer to the code available at: https: / hiuhh...... wtt.//oo/aaa/eeeeeeoo /authier//
statistis 1-collo01 uuliuionn ion.

---

Statistical Collusion by Collectives on Learning Platforms
Table I. Distribution of labels for elements in X, characterized by their Country of Manufacture.
Country of Manufacture
Label
Sample Count
Excellent
18410
Good
9228
C1
Average
Poor
1471
Excellent
18504
Good
9214
C2
Average
Poor
1461
Excellent
58083
Good
29170
C3
Average
Poor
4619
Excellent
17491
Good
0
C4
Average
2946
Poor
8911
Excellent
18589
Good
9290
C5
Average
Poor
1484
Excellent
131077
Good
56902
Total
Average
2946
Poor
17946
B. Algorithms
Algorithm Signal planting lower bound Peeturr--lbbe strategy
Input: N, Niest, n N, (()) .g.v", 8 0,
2: Define X : [g(x)
X
3: Observe (n)) and compute A for every ā E X
4: Define h (z, y) H (g(z). y*)
5: Compute (m) by applying h to all samples in (()
6: Compute p (f) for every
X
((m)
7: Define 8 = 6/ + 2# + +
8: Compute R3 (n), R2(N n), and R3 (Neest)
9: Compute and return:
P (z) - 2R3(n) D(n)
N-n (A()) (n) +2R((n) + 22R -n)) - 0 - Rg(n) - Rí RN(Ne)))
D(n)
12

---

Statistical Collusion by Collectives on Learning Platforms
Algorithm 2 Signal planting lower bound feature-only strategy
1: Input: V. Nesst N, D(") 99. y. > 0, > 0
2: Define X := {g(x) 2t and select some 2o $ X
3: Observe (m) and compute (n)) for every X
(g(x).v") if y-y=yy
4: Define h: (z.
(zo. v) otherwise
5: Compute D(m) by applying h to all samples in (())
6: Compute p (T, 11") for every I E & (5mm
7: Define ō = 6/ + 2#X + 2WX#V)
8: Compute Rg (n), (2 n), and Rg (Neest)
9: Compute and return:
P ((m)()))
P (o(x').v") -2Rg(1) Dim)
(z) N-n (4 g(0)) + +2Rg(n)+2R(00 -n) - >0
Rz(n)
Rg(Neest
Algorithm 3 Signal unplanting lower bound - adaptive strategy
1: Input: N, Neett, n < N,, ne < n, D(mo), D(n-no), , > 0,5 >
2: Define X = {g(x) x E }}
3: Observe ("a) and compute D2- = argmax
P (2.1) for every ā E X
(E""(r" Dine)
4: Observe D(n-n.) and compute A (n no) for every I X
5: Define h : (z. y) + (g(z), )n(m))
6: Compute ((a) by applying h to all samples in D defined the concatenation of (mw) and n
7: Compute P (6) for every X
((-)
8: Define 8 = 6/ + 6#*)
9: Compute (n), Rz(n ne). R3(N n), and (NNet))
10: Compute and return:
P (z) - 2Rg(n)) Dim)
N-n (Amrm + 2Rz(n -n.) + 22 -n) ( - --c > -00
Rz(n)
N
N
Rew ((n)
RB(N (N
Algorithm 4 Signal erasing lower bound under Assumption and Assumption
1: Input: X, N, Noest, n < N, D(x) .g. 0,8 >0
2: Define X : {g(x)
X}
3: Observe (n) and compute vi argmax P (ž. v/) for every ē E X and ((m) for every x' E X V'EY D(n)
4: Compute Dim)
(x') for every x' EX
5: Define ò = 6/ + # + 2#X + 2#x#))
6: Compute (n), (N n), and R3 (Neest
7: Compute and return:
P o' D(m)
P (x') -R((()) D(m)
N-n N
(A(") (2gg()) + 22
- -n)) 1--
>
RR(nn) Rg(Neett
Note that Algorithm 4 yields a valid lower bound if log(1188
< n S N 2log(1/8) 4¹
where 1j is given in Assumption 1.
x
13

---

Statistical Collusion by Collectives on Learning Platforms
C. Additional Experiments
1" = Excellent
5" Good
y" = Average
y" Poor
1.0
1.0
000000000
1.0
1.0
Success
0.6
0.6
0.6
0.6
Lower bound
0.4
0.2
(())
0.2
0.2
0OCO
0.2
000O0O
0.0
0
20
40
60
80
100
0
20
40
60
80
100
0
20
40
60
80
100
0
20
40
60
80
100
Relative collective size n// (in %)
Figure Signal planting with feature-only strategy. Comparison the theoretical lower bound from Theorem 3.5 and true success (m) observed test time for different values of and fixed value of N 1, 00000000
For the feature-only signal planting strategy, we selected zo constant equal to: Model Type = Sedan, Fuel Type = Diesel, Transmission Type Automatic, Drive Type = RWD, Safery Rating = star, Interior Material = Synthetic, Infotainment System Premium, Warranty Length years, Number of Doors 5, Number of Seats 5, Air Conditioning Yes, Navigation System Advanced, Tire Type All-Season, Sunroof = No, Sound System Premium, Cruise Control No, and Bluetooth Connectivity No.
In Figure 5, we can see that both the lower bounds and the actual success rates at test time are lower compared to the feature-label strategy observed in Figure 1. This is expected since the collective has less leverage with the feature-only strategy, as it cannot modify its labels. Specifically, for planting y Average and y² = Poor, appears that only collectives representing the majority of agents interacting with the learning platform are likely have significant impact, while the lower bounds remain uninformative unless the collective represents nearly all agents.
D. Lemmas
Lemma D.1 (Hoeffding's Inequality). Let X1, X2...., , X,, be independent random variables such that 0; S X; S for all Let X Ei= Xz. Then for any > 0.
2n²t2
P X1 X
E 2 1) < exp
n 2i=1 (he a2)
Note that by applying Lemma D.1 the random variables -X; obtain that:
2n
P X
X X-E(X
-t) S exp
EE_ az)²
Lemma D.2 (Hardt et al., 2023), Lemma B.1). Suppose that P and P' are two distributions such that TV(P, P') S Take any two events Eg and Eg measurable under P and P'. If P(E2) + + then P'(E,) P'2))
E. Proofs and additional remarks
E.1. Proof of Theorem 3.3
Proof. The proof relies on applying union bound to several concentration inequalities. Here, will use Hoeffding's inequality (Lemma D.1).
First, assume that = 0 for simplicity, Let ã E X. By applying Hoeffding's inequality to the independent random
variables 1 (x)= E [o, 1] for & E (i,,, we have that
P
P (5' z) #IND
Rz(n)
(6)
#lD(()
with probability at least 3 over the draw of D()), Similarly,
P [ RnD
σ) <
P - Rz(n)) 3(((())
(7)
14

---

Statistical Collusion by Collectives on Learning Platforms
holds with probability at least 1 1 8 over the draw of D(*), For any fixed ā E X' and y' E &Myy J. the following inequalities
also hold individually with probability at least 1 - 5 over the draw of consumers:
P (x.0)~
(x = T,y - y -
P (x ( = v/) + Rg(NN n)
(8)
(a.))~D
P (x.9)D/
(I = E. y y²) v
P
(x = -.= = 3²) + R2 - n)
(9)
(z.))~
Similarly:
p
= (== -=
= y¹) -
ビ = y Rg(
(10)
(z,g))-(())
p (2,0)~D
(I= = (x=
= )))= v p
(x= y = v/ + (n)
(11)
(z,g)~(())
We also have that
P (f(glz)) - yリز grw Desss
P aND PD (f(((t)) = y²) 10--11g (Nies))
(12)
with probability at least 1 1- 8, where the probability is taken over Drest conditionally on D(n) and D(N-n), so in particular holds marginally over all consumers. Lastly, we have with probability at least 8 over the draw of D
p
n
P P3' (8'= 2)) - -Ro(n)) - N n
(A! + (N (Nn(NN))) -i)) > 0) s
(D)
D(n)
N
FND
N
(13)
P
n
P (F' =i) - -Ra(n)))
N - n
( (D) + +2Rg(N - m)) 20) + +Rz(n)
AND
N
2nD
N
where A (D)
(p P (0= = u,y = y')
PP (x= ã, w-y-y")) 5ÿ) (a.9)~
max (
(aa))~
y
Now, we use union bound with these 2 + 2# + # inequalities above, so that all the following calculations hold with probability at least 1 - 8 over the draw of consumers. First, Inequality (12) yields:
((n) 2 P (f((())) -y" (Neest)
= P (f = v²) Rg (Neest) 2nD
by definition of h. Now see that for any I E E we have that
f(ū) 3" = Vy' v", P(z,y") P(ū,z')
N W-n n
Vy' 3
P (i' - = y") +
p (x= = y²) (a.)) n)
(3 (3
N
n p (7' "-=,,ー=111 + N n n
(x "zy=11)
N (5' - B()))
N (I.))~((N-))
N- p (x= i, y y²) N (a.))~((N-))
Yy' +
P (3'= 6)
N D(i)
N --n n
P i, = =/)
N (x.))~((N-1)
n
P
(5' =
N Din)
N - n
P "'"'"("") ((.N)) B.N.-. (== (x=2,y=1
max
v/)
P (, = -") >0 0
N
(5' = =8) - (R)(R(())
N n
N (A! + +2Rg(N -ni) 00
N FnD
15

---

Statistical Collusion by Collectives on Learning Platforms
where the last implication comes from Inequality (7) and because
( B P V'E)((r)) ((.N))D(N-N) (x= u, [== 3/)
P ( N. = - 5¹)
max
2. - P (x 2x=2xy=221100 vr) + 2R -n) (a.y)/D
$ max (V")
P
(2.8)/D
( (P) 2
by Incquality (8) on X' {+* and Inequality (9) on &' { Therefore, we have that:
5(n)
PP 3ND
(T
n
P P (5'= = (-gg(()))
N N-w (D) + 2R - -n)) >0)
N (A
F'ND
(Reeetstt)
and so by applying Inequality (13) we deduce that:
((n) 2 P m~(()) - Rg((n) (NVest..
( n
(N
P = - -Rg(()))
N n (A! + 22 m)) >0)
FNDD
N
Finally, note that:
A (D)
max
P
(x= =yy)
P
(I = =, 13))
y/ vey)(r))
(H.9)~
(a.N)DD
(x 2, - =))) + (2)(n)
max y v'""'
P
(x= σ. = v') (..g)~D(a))
(x.))
A + 2Rz(n)
by Inequality (10) on X { and Inequality (11) on E V'(""". So together with Inequality (6), we conclude that:
(m)) 2 P
n
( P -2)()))
-n
N (A
(n) + +2 + +2R5(N +2Rg(N-n1))
> =0)
D(n
N ('D(()))
(n) - R2( (Nest.
The case 8 > 0 is similar, noting that for any &:
f(क) -y = Vyl # y. P(i )²) P(i,v')
Vy + ソリ P(ī v²) > P(i, v') + 1-8
by Lemma D.2
and with slight modifications to Inequality (13) incorporate the 1
If there exists a subset Xo C X such that #X < # and P P Xo) is significant, it may be preferable to condition the BnD
probability based on whether or not the feature belongs to Xo. and disregard the conditioned on being in Xg. In this case, the union bound should be applied only to 2 E Xo.
The proof of Theorem 3.5 is essentially the same as the proof of Theorem 3.3. One difference is that we can not simplify P. (f(r())) = y²) P (f())= = y²) as we did in the proof of Theorem 3.3. Therefore, the calculations must be carried IND
a~D
out directly using the term (x))
16

---

Statistical Collusion by Collectives on Learning Platforms
E.2. Proof of Theorem 3.7
Proof. The proof closely follows that of Theorem 3.3, so we will only highlight the main differences, We focus on the case where 0; the where can be handled similarly to the proof of Theorem 3.3.
Let E E A. We have:
f(0) - : P(a.V) < P(
= = =P(a,v") < (()
n p
(t' = = y
N - n
(x = G. 5*) (a.))-(N-o)
P
N (#f )''g B(n)
N
N -
( Z. -2))
p (ay
.,)
4/2)
N (sr (D
(3)
n P
(8' =)
N DDD()
N - n
p - 8z) 8z))>
(x = =o=i,y=p y²)
N
(x.9)~
(#.))~
=
and see that
A nn-
P (x 5, = v²) (x:1))~
PP (x.9))~D
(x T. y Úz) +2Rg(N n.)
by applying Hoeffding's inequality to both empirical probabilities. Note that Hoeffding's inequality for the term
PP (x
(x.g)~
y 0z) holds in probability over D(N-n) conditionally on D(m)), It should only be applied #X' times here contrary to #*) 1) times in signal planting because Ús is fixed conditionally on (mm)), Then, since the inequality holds in probability over D(N conditionally on (*w)), in particular it holds marginally over all consumers.
The conclusion similar to that of Theorem 3.3. We just need to apply the same argument as above to use Hoeffding's
inequality: IP (x I, = Ua) 2 P (xr I. y = ga) - Rg (n - no).
(#,
(x,g)>>
mn)
In fact, it is possible to obtain a slightly better bound than (4). Indeed, to bound A (D) ((n) instead of (n-) for the term
$ one can use Hoeffding's 's inequality on
IP (I = ã. = y²). We kept the inequality (4) as it is to simplify the expression (r.g)> of the bound and make the interpretation of the different terms easier.
E.3. Interpretation of the bound from Theorem 3.7
As the signal planting lower bound (1), the signal unplanting lower bound (4) also depends on three distinct terms:
P (='= 22)g(n)
D(n)
N-n ( (m- + +nRg(n no) mc)+2R 2N n)
1-6
17

---

Statistical Collusion by Collectives on Learning Platforms
The first and third terms play the same role as in signal planting. The main difference here is the second term N- No (A! (n-ne) + 2Rz(n nt) - ( n)). The term A (n-ne) represents how much more probable the target label y" is compared to other labels given feature belonging to X. If y is much more probable than the other labels, will be difficult to unplant the signal. Conversely, if y" is not the most prohable, it will be easier to unplant the signal. The collective's plan relies the choice of ne n. If ne is large, it will be more likely for the collective to select the best possible label given modified feature ö to maximize the impact of the strategy h. However, if ne is too large compared to n, the estimation error 2Rg (n - n²) may become too significant. Therefore, there is trade-off for the optimal choice of the value Ri. This trade-off depends on the specific dataset being considered.
E.4. Proof of Theorem 3.9
Proof. Assume that E = 0. The case of ε >> 0 is handled in the same way as in signal planting and signal unplanting. By Hoeffding's ss inequality, we know that the following inequalities each hold with probability at least 1 - 8 (over the draw of consumers), for some fixed ā E X and y' E {)((
P (r.y)-
(x y.y= vi)) S
P (a= u. y = vi) (2)
(14)
(x.g)~D(m)
P (x.g)>D(a)
(x= ē. v/ S
(x= ē = 3/) + Rg(n))
(15)
(x,g)a
Similarly, for some fixed x' E X' and y' E 3 (V((
P (x = x²) S D(n))
P (I x²) + (n(
(16)
P (x= = x')= s x>D
p (x x') + Rn(n)
(17)
n()
P (EN))~(NN- n))
(x ===20 x , = =/)== s
P (x = x', y = v/) + Rg(N- n)
(18)
(a.))~
P (x.1)~
(x x 1 = ))(r)) 5
p
(x (x= x' y= ) + Rg(N - n)
(19)
(2,8)
p (x x', ))(wm)) 5
P (x= و'y
(x= = )))) + (2)
(20)
(x.))D(o)
(z,y)
P (mn))D
P (x= ,' =
y= s/){ S
p
(x= ( = v²) + (g(n))
(21)
(zn))~D(n)
We also have that
p (f(g(z') = [(x))) 2 P 2 (f(o(r)) = f(x')) - (Nest)
(22)
D'eat
and
P D(m)
n
P (x x²) - -R)(-))())
N n (A + +2 - -n))
+2Rg(N-n1) >0) 5
N
LoDD
N
(23)
P x'rD
n N
P (I = =²) - R2((n)
N --n
(D)
+ +2Rg(N
(N - -)) > >0) + Rz(n)
LaND
N
where A (D)
max y
(P P (x= x' = 50)
P (a.y)~
(z x' y Vy(or))
We apply union bound to the 2 + #K#W + 2# + 2 inequalities above, so that the calculations below hold with probability at least 1- 5.
Let H. X. By Assumption we know that:
IP (x ã. y -- via (x
P (x u.y y = 3 + (a.))-
(24)
18

---

Statistical Collusion by Collectives on Learning Platforms
for all y/ + vz. So by using Inequality (14) and Inequality (15):
(I T. y = vāa + Rg(n)
P (x= R. y= v) Rg(n) + (x.y)~
(x.y)~
for all V/ # v.g Provided that 210g(1/81 we have that 17 222 > 0 and deduce that
-.= vza)
p (x 2, y y²) (a.y)~Dim)
(mm))~Dm))
for all Vy * y
Therefore, for each & X, the collective can compute v by using D(n) follows:
y = argmax P V'Ey (an))~((n)
(x = - 3/)
(25)
Then, the collective plays the erasure stategy h(r,y) (x, Vg(x))- Now see that using Inequality (18) and Inequality (19) together with Inequality (24) yields that
DiN (xc -. y = - + R3(NN - n2) (c.))~
P
(x = E. = 3/) - R2(N - nn) +
for all 5/ # 32. Provided that a S N 2 log(1/88
we have that 17 2Rs(N n1) 0 and so deduce that
nj²
(xr I. -2)
p (x E. = m/
DLN DUN n)
(..))~
for all Vy # y.. This implies that
argmax P
(x= = 8. y y/) y
(26)
y'EY' (x,)~D(N-o)
So for all E X' we have:
VG(Z') = argmax y'Ey
n
(1 ((x'). = 3/)
n N
(DN))=((N-)) (I g(x'), = v/)
N
(a.
=iff since =
maximized y "(=²) by Equation (26)
argmax p(g(2'),3/) wey
((g(2))).
Therefore
5(n) = p
(f(d') = F(o(x')))
P (f(e') = F(g(a'))) Rgg(Neest) by Inequality (22)
x'DD
P (f(z') = Vi(er) -Rg R& (Nees)).
RnD
Now let E X. A calculation similar to the one in the proof of Theorem 3.3 shows that
f(x') = Vo(o') - n
P (x x') Rz(n))
N
N (A +2 - -n)) >0. O.
N ZND
19

---

Statistical Collusion by Collectives on Learning Platforms
Here reused Inequality (18) and Inequality (19), together with Inequality (17) and the fact that Dx Dx by definition of h.
Therefore
S(n) 2 D'rD
n (0= x²) -R((n)) - n (A N
p LonD
+ ( (2Rg(N-nn)) -n)) >0)
N
- -Ry( (gyoe
and by applying Inequality (23) deduce that
S(n) 2 z'rDin) N
(N n (x = x²) -Rg(n)) N
(x
(A + 22 - -m)) 20)
LnD
N
Rn) Rg (Ntest..
We conclude with Inequality (16), Inequality (20), and Inequality (21).
The result of Theorem 3.9 depends whether the collective is large enough to compute the optimal label y for each f E X. Specifically, must exceed 2log(1/8) In Figure 6, we plot 2lg((1/8) as function of with the parameters used in 1
our experiment in Section 4 and detailed in Appendix A: #X' = 2, 388, 787, 200; # = 5; and #y = 4.
1000000
800000
2 (8)
600000
400000
200000
0.0
0.02
0.04
0.06
0.08
0.1
1
Figure 6. Plot of the minimum value of n function of for computing the erasure strategy.
For example, suppose the collective consists of n 100, 000 members. Then, if n exceeds approximately 0.03, the signal-erasing bound 5 from Theorem 3.9 holds.
E.5. Interpretation of the bound from Theorem 3.9
The signal erasing lower bound depends on three distinct terms:
P (x= ==xxx -2)3-((((1)) DwD())
(A!)) + 2Rz(1)) + NN -n))
The second term captures how optimal the label for the feature (xx) is for the feature x as well, thus reflecting the initial sensitivity of the signal, which aligns with the intuition discussed by Hardt al. (2023).
20

---

Statistical Collusion by Collectives on Learning Platforms
There are major differences between signal erasing and signal planting unplanting. First, the term
P N (nDDin) (on (
is significantly weaker in the case of signal erasing because it depends on X rather
than X,, making the probability much lower. Second, the term ò much smaller, making the estimation terms much more significant. In most cases, we can expect the obtained bound in Theorem 3.9 to be impractical because the estimation terms will be too large. The bound in Theorem 3.9 becomes useful only when have large number of data points relative the size of the universe X' x y.
We provide an analysis of the estimation terms to better understand their influence not only in signal erasing but also in signal planting and signal unplanting. We illustrate it with a basic example in Figure 7. We fix = 0.05. We consider binary classification problem: #3 = this case, the values of 8 are as follows: 6/(2 + 6# in signal planting and signal unplanting, and 8/(2 4# X 6#X)= ~ 6/(2 + 6*+) in signal erasing, assuming the reasonable hypothesis that #X' < #X. Therefore, focus the estimation terms (n) with 8 of the form 6/(2 (2 6y) where varies. For simplicity, we assume that #X and #XY are powers of two: 7 = 2 for some m 2
0.05
0.04
10
20
0.03
30
R3(n)
50
0.02
0.01
0.0
0
40000
80000
120000
160000
200000
Collective size n
Figure Plot estimation terms (n) as function various values m. where 3 -6/(2 + 2.
Given target error estimation R., the value at which (g(n) R, is approximately equal This value of n scales linearly with m.
Ing(2) 212
log 6) log(1
2n
This simple analysis highlights an interesting phenomenon: the lower bounds obtained are influenced not only by the ratio n/N (i.e., how large is relative to N) but also by the absolute size of in relation to the universe X' x V. This is crucial for obtaining estimation terms (n) that are as small as possible. The intuition that needs to be sufficiently large relative to N is already present in the work by Hardt et al. (2023). Our research sheds light on the additional requirement that
should also be large in comparison to the size of the considered universe X' x y
F. Bounds in the Infinite Data Regime
As discussed in Subsection 4.3, we can compare our results with those presented by Hardt et al. (2023) in the infinite data regime when n, N, Nust + 0o and n/N + for some (0, 1). We provide further details on this comparison here.
In the infinite data regime, the framework is the same as in algorithmic collective action: the platform observes the distribution
P(zo. yo) = o aF vo) + (1 (20. yo)
and selects a classfier f based on the distribution P: Definition F.1. Let >> 0. classifier f X y is suboptimal on set X' C X under the distribution P there exists distribution P with (V(P, PP) S e such that
f(x) E argmax P(x, v)
NEY
21

---

Statistical Collusion by Collectives on Learning Platforms
for all & E X"
With these notations, we can redefine the successes for the various objectives of the collective and derive lower bounds on these successes. Note that to obtain the bounds below, it is no longer necessary to assume that X' is finite, since this assumption is only used to apply the union bound a finite number of times when the collective performs statistical inference with its finite-sample dataset.
F.1. Signal planting
The success is defined as
S(a) = P (f(((())) - y²).
I~D x~D
The bound (1) from Theorem 3.3 under the feature-label strategy becomes:
S(a)
2 P
( -1 (1-
E
>
(27)
AND
D
1
where 4 1
max (p(8, v/) p(.. '") y'E''Vo>>
D
Similarly, the bound (2) from Theorem 3.5 under the feature-only strategy becomes:
S(a) 2 anD
afP(g(z), v") a 9(2) -
8
> 00
(28)
F.2. Signal unplanting The success is defined as
S(a) = H-D PP (f(((())))
The signal unplanting strategy relies on the choice of some parameter n. to estimate the most likely label Ua(n) * y² given some feature (xx). In the infinite data regime, we assume that ne + and Theorem 3.7 becomes:
The + co. The bound (4) from
E g aP((T) (1 a1 D
S(a) 2
P AND
0
(29)
where A (D) = ((, (( ya).
F.3. Signal erasing The success is defined as
S(a) = P (f(g(())) = f(x)) anD
The erasure strategy relies on the ability compute the optimal label Vz(2) for every feature g(z). In the infinite data regime, assume that the collective has access to Vr(z))- The bound (5) from Theorem 3.9 becomes:
S(a) 2 P
aP(x) - (1 - a) 1 -
E
> 00
(30)
AND
D
where A (D)
max y WE
P(x,v') - P(x, ((
F.4. Comparison with Prior Lower Bounds
In the original version of their work, Hardt et al. (2023) adopt the same definition e-suboptimality as in our work. However, there was an issue with their proof in the case where E > For this reason, we restrict our comparison to the bounds in the case where
22

---

Statistical Collusion by Collectives on Learning Platforms
Proposition F.2 (Bounds comparison in signal planting when 0). Assume that the collective plays the feature-label signal planting strategy against classifier that is e-suboptimal (in the sense of Definition F.I) on X. Then the collective achieves:
S(a) 2 IP BnD
aP(T) (1 -1- 0
D
a
(g(v)2) (
1
max max SER NEY
where the first inequality is simply Inequality (27) and the last term is the lower bound originally provided by Hardi et al. (2023).
Proof. For all 5 E X, we have:
aP(2) - (1 (1))
= aP( (1 a) max
(/ - 3( D v
D
=
( (1 a)
max veM/v
(B(((()) P(v*|=) (())
D
2 (p( D
(1 a)
max max
BEX y'Ey D (f//la) p( (1)))))) p()))
Therefore
P (.) (1 k (D)
> 0
2 P
aP()) (1 a)
max max ((yl( - ((v) P(#) > 0)
2 D
R~D
Se NEY DD
P(t)
P
a
max max SeX DEy D
(P(ylT) P()
D
0
P
R~D
D
E
(
RnD
1- max max
((ul) ((ul))-((u11a))
((a) >0
ECR DEy
P(T)
2 E
a
max max (P(y B(v (5)
BEX yEy D
P(t)
max max SEX VEJ ( - P()
The authors subsequently revised their proof when by modifying the suboptimality definition, which we refer as E-conditional suboptimality to provide clarity and distinguish between the two definitions:
Definition F.3. Let 0. A classifier / X y is s-conditionally suboptimal on set 2" C X' under the distribution P if there exists distribution P with TV (P Pr|x=r) < E such that
f(x) E argmax P(x,w)
NEY
for all æ E X".
Using this definition of conditional suboptimality, we could derive bounds similar to those given in (1), (2), (4), (5), (27), (28), (29), and (30), and conduct the same kind of comparisons with the bounds from Hardt et al. (2023).
23


Reviews:
[{"review_id": "j9cfWTDe3k", "reviewer": "Reviewer_6HMD", "summary": "The paper explores the statistical inference for collective action in learning platforms, in particular, the paper examines not only the classic signal planting procedure introduced by Hardt et al, but also signal unplanting as well as signal erasing, both of which require statistical inferences for defining the optimal strategy $h$. In the end, the authors develop a framework that provides a theoretical and algorithmic treatment and preform empirical studies on synthetic datasets.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "First, we would like to thank the reviewer for their time and their insightful comments. As mentioned, our main contribution is introducing a statistical inference component to the collective action framework, which is crucial in practice, as collectives often seek guarantees about the effectiveness of their strategies. We also appreciate the reviewer’s thoughtful questions and will ensure additional clarifications in the final version to enhance intuition and understanding.\n\n*It would be nice if the authors could add some intuitions behind theorem 3.7, especially how it differs from the previous theoretical guarantee (Theorem 3.3).*\n\nWe agree that a discussion here would indeed help provide the reader with more intuition, particularly in comparison to signal planting (Theorem 3.3). In signal planting, the strategy is simple: flood the platform with label $y^*$. In signal unplanting, an intuitive approach is to change the label by choosing the most probable label $\\hat{y}\\_\\tilde{x}$ after $y^∗$ for every $\\tilde{x}$, which is exactly the meaning of equation (3). However, $\\hat{y}\\_\\tilde{x}$ is unknown, so we propose estimating it using a subset of the collective of size $n_{est}​$. This results in a two-step inference method, where we first adaptively estimate the label $\\hat{y}\\_\\tilde{x}$, and then use concentration inequalities that depend on $\\hat{y}\\_\\tilde{x}$. To ensure independence and correctly apply Hoeffding’s inequality, we carefully split the datasets of size $n_{est}​$ and the rest of the collective of size $n - n_{est}$. This is why the estimation term for $\\Delta_{\\tilde{x}}$ in Theorem 3.7 is $R(n - n_{est})$, rather than $R(n)$ in Theorem 3.3. This directly quantifies the impact of not knowing the optimal label to play by the collective (contrary to signal planting where the optimal label to play is known): the counteracting term in the bound is more important since $R(n - n_{est}) > R(n)$.\n\n*1.How should I understand the inequality in section 3.3.1?* and *2. Does Theorem 3.7 still hold if we randomly choose a label other than $y^\\*$ instead of $\\hat{y}\\_\\tilde{x}$ according to equation (3)?*\n\nTo build intuition, let’s consider the following simplified case: the signal set $\\tilde{\\mathcal{X}}$ consists of a single feature, and the label frequencies associated with the training set without the collective are as follows: 100 for $y_0=:y^*$, 70 for $y_1$​, 60 for $y_2$​, and 50 for $y_3$​. In this case, the optimal strategy seems to be estimating the most probable label $\\hat{y}$ after $y_0$ (here,$\\hat{y} = y_1$​) and flooding the platform with it. However, $\\hat{y}$​ is unknown by the collective. The collective could naively flood the platform with either $y_2$​ or $y_3​$ as well. This corresponds to planting the signal with those labels, which is exactly the meaning of the inequality in Section 3.3.1. A more effective approach is to estimate $\\hat{y}​$, which we formalize in the paper.\nRegarding the suggestion of using randomness: while it is possible, we believe it is suboptimal, even compared to naive strategies, which is why we did not study it. To get convinced, assume a collective of size $n=60$. Naively flooding the platform with $y_i$ ($i \\in \\{1,2,3\\}$)​ succeeds since $y_i$​ becomes the most frequent label for $\\tilde{x}$. However, choosing a label randomly among those $\\neq y^*$ leads to expected frequencies: $y_0: 100$, $y_1: \\approx 90 < 100$, $y_2: \\approx 80 < 100$, and $y_3: \\approx 70 < 100$, resulting in an unsuccessful collective action.\n\n*3. In section 3.4 (signal erasing), it seems like the success of the proposed signal erasing procedure relies on the transformation function $g$ to be idempotent. What are some examples of idempotent vs. non-idempotent transformations? How practical is it in real life?*\n\nWe provide examples of idempotent functions $g$ in lines 311-319. This assumption is generally not restrictive, especially in tabular data or opaque watermarking.\n\n**Concerning weaknesses:** \n\n*The experimental section is a bit weaker since it's a simulated setting*\n\nWe refer to our response to Reviewer HD8o.\n\n*Another weakness is that some theoretical claims rely on particular assumptions or particular signal strategies*\n\nWe study strategies that are intuitively optimal and provide theoretical guarantees. Establishing a unifying framework for analyzing strategy optimality may be an interesting direction for future work. The guarantees we derive depend on assumptions, such as the idempotency of $g$ for signal erasing (line 1025). We do not claim that this assumption is necessary, but we have not found a way to derive guarantees without it. If helpful, we can clarify why we use this assumption, in contrast to Hardt et al. \n\nWe sincerely thank the reviewer for their valuable feedback, which helps improve the paper, and we hope we have addressed their concerns.", "claims_and_evidence": "The claims are supported by clear and convincing mathematical arguments.", "methods_and_evaluation_criteria": "The proposed method and evaluation criteria make sense for the problem.", "theoretical_claims": "I checked the soundness of the theoretical claims.", "experimental_designs_or_analyses": "I did check the experimental design and they are sound and valid.", "relation_to_broader_scientific_literature": "The key contribution of the paper is on relating statistical inference to the literature of collective action, which is missing in the previous work in the literature.", "essential_references_not_discussed": "NA", "other_strengths_and_weaknesses": "Overall, the paper is well-written and well-explained. The proposed signal planting and signal erasing methods are intuitive. The experimental section is a bit weaker since it's a simulated setting. Another weakness is that some theoretical claims rely on particular assumptions or particular signal strategies, for example, it's unclear to me whether theorem 3.7 would still hold if the signal unplanting strategy is different from equation (3), and whether Theorem 3.9 would still hold if the transformation g is not idempotent. Some discussions on how violation of these assumptions/particular strategy could change/affect the theoretical result could be helpful.", "other_comments_or_suggestions": "It would be nice if the authors could add some intuitions behind theorem 3.7, especially how it differs from the previous theoretical guarantee (Theorem 3.3).", "questions_for_authors": "1) How should I understand the inequality in section 3.3.1? \n\n2) Does Theorem 3.7 still hold if we randomly choose a label other than $y^*$ instead of $\\hat{y}_{\\tilde{x}}$ according to equation (3)?\n\n3) In section 3.4 (signal erasing), it seems like the success of the proposed signal erasing procedure relies on the transformation function g to be idempotent, namely $g(g(x)) = g(x)$. What are some examples of idempotent vs. non-idempotent transformations? How practical is it in real life?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "mDGD50sIJ8", "reviewer": "Reviewer_CB4v", "summary": "This paper addresses the problem of collective action under finite samples. There are $N$ consumers each with a datapoint $(x,y)\\sim \\mathcal{D}$ where $x\\in \\mathcal{X}$ and $y\\in \\mathcal{Y}$. Of these $N$ consumers $n$ consumers plan to collude, so that after learning from the $N-n$ clean samples and $n$ corrupted samples, the value of a metric $S$ on a test set $D_{test}$ of size $N_{test}$ is large.\n\nPrevious work (Hardt et al 2023) established lower bounds on $S$ for $n, N\\to \\infty$ with the ratio $\\alpha = \\frac{n}{N}$ being constant. In this paper, the authors try to obtain lower bounds for finite $n$ and $N$. They aim to obtain lower bounds on $S$ that can be computed by the $n$ consumers before collusion, so that they can guarantee success of collusion, i.e., large $S$. \n\n\n\nThe authors consider $3$ problems i) Signal planting, ii) Signal Unplanting and iii) Signal Erasure. Here, signal planting and erasure had been introduced by (Hardt et al 2023). In each of these problems, there is a signal set $\\tilde{\\mathcal{X}}$ defined as the range of a  map $g:\\mathcal{X} \\to \\mathcal{X}$. In signal planting, and unplanting, the goal is to add/remove a specific label $y^\\star$ for all features in the signal set $\\tilde{\\mathcal{X}}$. In the signal erasure, the goal is to learn a predictor that has same output on $g(x)$ and $x$, thereby completely eroding the impact of $g$ and thus the signal set.\n\n\nFor each of these problems, the authors have atleast one strategy defined by a specific transformation $h:\\mathcal{X}\\times \\mathcal{Y} \\to \\mathcal{X}\\times\\mathcal{Y}$, that transforms the corrupted datapoints. The main theoretical claims of the paper are that a lower bound on the empirical metric $\\hat{S}$ for these strategies can be computed efficiently from only the original data of the $n$ corrupted consumers (See Algorithms 1-4). The corresponding finite-sample lower bounds are provided in Theorems 3.3, 3.5, 3.7 and 3.9. \n\n\nFurther, the authors test their signal planting/unplanting and erasure bounds on a large synthetic dataset of cars with categorical features. They show small deviations between the empirical quantities and their bounds. Further, their methods are more accurate than (Hardt et al 2023) in predicting the change in metric.\n\n**References**\n- (Ben-Dov et al 2024) The Role of Learning Algorithms in Collective Action. ICML.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We would like to thank the reviewer for their detailed and technical review, which allows for a discussion of some of the paper’s theoretical aspects. We also appreciate their positive feedback and will now address the questions raised. \n\n*Better empirical performance than (Hardt et al 2023) in Figure 4 for large number of samples*\n\nOur bounds are not only empirically superior but also theoretically better (see Proposition F.2, for example).\n\n*Either more experiments on different datasets/settings should be done or adequate theory provided for such staircase-property before such claims could be made*\n\nFor a finite signal set, we can theoretically prove that our bounds exhibit a staircase shape, unlike Hardt et al., just by using law of total probability and conditioning on the possible values for $g(x)$. We can include a rigorous proof in the paper if it is considered helpful.\n\n*Absence of experiments on signal erasure task / dataset not real*\n\nWe refer to our response to Reviewer HD8o.\n\n*Synthetic Dataset with Label Imbalance*\n\nThe dataset is truly synthetic and we intentionally introduced this imbalance.\n\n*Reproducibility*\n\nWe fixed the random seed for our experiments (see src file).\n\n*Justification of Assumptions 1 and 2*\n\nThe parameters $\\eta$ and $\\tau$ are very different. While $\\eta$ relates to the nature of the base distribution and ensures that the most frequent label is sufficiently separated from the second most frequent one, $\\tau$ reflects how similar the probability of a label given $x$ is to its probability given $g(x)$. In other words, $\\tau$ captures the extent to which $g$ already influences the platform’s decisions, whereas $\\eta$ is a simple assumption about the base distribution, entirely independent of $g$ or any other parameters specific to the collective. Regarding Assumption 2, we refer to our response to Reviewer 6HMD.\n\n*Essential References Not Discussed*\n\nIndeed, the paper cited by the reviewer is relevant, and we will ensure it is included in the references.\n\n*Convex action*\n\nAs mentioned by the reviewer, convex risk minimization is also an important framework. We believe that gradient-based learning, as outlined by Hardt et al., is also an important framework. While the focus of our paper is only on classification, exploring these setups is an interesting direction for future work. We believe that our setting could be extended to this case even without assuming strong uniform generalization bounds: one can simply estimate gradients directly using samples from the base distribution and the gradient-neutralizing distribution. One additional difficulty is to compute a gradient-neutralizing strategy. Within our setting, the collective does not directly have access to expected gradients but rather to estimations and the collective may only be able to compute an approximate gradient-neutralizing strategy. This would yield additional error terms.\n\n*Identify staircases in Figures 1-3*\n\nThe steps in the staircase are closely spaced, and the bounds are computed only for fixed values of $n$; this is why the staircase resembles a sigmoid curve.\n\n*Bound on $\\eta$*\n\nWe do not assume that $\\eta < \\frac{1}{Card(\\tilde{\\mathcal{X}})}$. Regarding the second part of the reviewer’s remark: it is possible to redefine $\\eta$ to discard features not in $\\tilde{\\mathcal{X}}_0 \\subseteq \\tilde{\\mathcal{X}}$, where $\\tilde{\\mathcal{X}}_0$ is a subset of $\\tilde{\\mathcal{X}}$ such that $\\tilde{x} \\sim \\tilde{\\mathcal{D}}$ has a high probability of belonging to $\\tilde{\\mathcal{X}}_0$. This aligns with the reviewer’s intuition of asking whether a similar definition of $\\eta$ in expectation is possible. In this case, we can derive theoretical guarantees by conditioning the success and saying that the success is equal to the same probability conditional on the fact that the feature $g(x)$ is in $\\tilde{\\mathcal{X}}_0$ times the probability that $g(x)$ is in $\\tilde{\\mathcal{X}}_0$, plus a term that depends on the probability of $g(x)$ not being in $\\tilde{\\mathcal{X}}_0$, that we can typically discard. \n\n*Issue with the earlier proof of (Hardt et al., 2023)*\n\nThere was a mistake in algebraic manipulations leading to an erroneous bound. In the current version of Hardt et al., Definition F.3 is used, but the bounds remain suboptimal due to unnecessary inequalities.    \n\nWe sincerely thank the reviewer for the thorough review and for pointing out typos.", "claims_and_evidence": "Most claims in the submission are well supported. Here are the main ones.\n\n1. The theorems in Section 3 provide finite-sample easy to compute lower bounds allowing on the metric $S$ thus yielding Algorithms 1-4.\n\n2. Dependence of success metric not just on corruption ratio $\\frac{n}{N}$ but also the absolute value of $n$: A nice explanation of this is provided in Appendix E.5 and Figure 7 in addition to Figure 2. The authors might consider moving some parts of this section from appendix to the main paper. Note that this was the only experiment related to signal erasure.\n\n3. Experiments on signal planting/unplanting to check the tightness of the lower bounds from theorems were provided in Figures 1 and 3.\n\n\n4. Better empirical performance than (Hardt et al 2023) in Figure 4 for large number of samples, i.e., population limit. The authors claim that the metric $S$ increases in a staircase-fashion as $\\frac{n}{N}$ increases. For this example, this staircase is visible with $3-4$ stairs however, that is not enough evidence to claim existence of such a property. Either more experiments on different datasets/settings should be done or adequate theory provided for such staircase-property before such claims could be made.\n\n5. Absence of experiments on signal erasure task: The paper would have been more complete with these experiments.", "methods_and_evaluation_criteria": "- **Dataset not real** While all experiments are performed on a single large sythetic dataset with each datapoint being a car and its condition (one of $4$ conditions). The feature vector of a car correspond to its different parts, and the condition of the car is calculated as a score of these features. While the experiments on this dataset are complete (except signal erasure task), no real dataset have been used. This is a bit surprising considering several appropriate experimental setups for this problem in (Hardt et al 2023, Ben-Dov et al 2024). Note that I  don't expect the authors to run any additional experiments in the review period, but in case of acceptance, they should add atleast $1$ task on a real dataset. \n\n\n\n- **Synthetic Dataset with Label Imbalance**: The other issue with this dataset is that it appears to be synthetic, but it has qualities of a real dataset, for instance label imbalance between \"Good\" and \"Average\" labels. If this was truly a synthetic dataset, then the authors should have controlled the label imbalance so that it does not affect the results. Can the authors verify if this dataset is truly synthetic and the authors purposefully put in this imbalance or if some parts of it have been obtained from real datasets which would explain this label imbalance? Note that real datasets are generally harder than synthetic ones. This label imbalance leads to large discrepancies in the $2$ subfigures on the right in Figure 5. \n\n\n\n- **Reproducibility**: The authors didn't mention the number of random seeds, the amounnt of compute resources or any variances in their experiments. While these are not extremely important to the main result, they are important for reproducibility. I would recommend including this in the final version in case of acceptance.", "theoretical_claims": "- **Correctness** : The proofs seem correct to me. The core idea that the authors use is this, first using Hoeffding's inequality, they bound the difference between population and finite-sample terms. Then, they take an appropriate union bounds over all these concentration bounds so that they hold simultaneously. After this, all they need is to plug in the expression of the metric $S$ and use the given strategy and the concentration inequalities, until they end up with terms only dependent on datapoints on $n$ consumers.\n\n- **Justification of Assumptions 1 and 2**: From what I understand in (Hardt et al 2023), these assumptions are not explicitly used. The value $\\tau$ in (Hardt et al 2023) seems similar to $\\eta$ in Assumption 1, although it is required for every feature in $\\tilde{\\mathcal{X}}$, while $\\tau$ is defined only on expectation wrt the true distribution. I understand the authors' justification for these assumptions, but can they compare this with corresponding assumptions, or lack of it, in comparable works like (Hardt et al 2023).", "experimental_designs_or_analyses": "Please see the \"Methods and Evaluation Criteria\" section for all comments.", "relation_to_broader_scientific_literature": "This paper provides an efficient way for consumers to determine their success metric if they collude. This is a strict improvement over the known collusion results of (Hardt et al 2023). Their related works section is thorough. Their discussion section also clearly connects their work and its limitations to other related problems.", "essential_references_not_discussed": "Most essential references were discussed. A recent reference is (Ben-Dov et al 2024) which the authors might have missed. This reference uses a Distributionally Robust Optimization Approach but with infinite samples like (Hardt et al 2023).", "other_strengths_and_weaknesses": "## Other Weakness \n- **Convex action (Sections 4.1 \\& 4.2, Hardt et al 2023)**: The authors did not extend their finite-sample guarantees to the case of collusion when the goal is to minimize a convex empirical risk as described in (Hardt et al 2023). This is an extremely important application of these frameworks. Could the authors comment on whether their results could be directly applied in these cases? Would it be possible if the model classes have strong uniform generalization bounds? If applying their scheme is hard, then they can just point out the main difficulties in this setup.", "other_comments_or_suggestions": "- **Optimal value of $n_{est}$**: In signal unplanting, the authors provide experiments on there being an optimal value of $n_{est}$ in Figure 3(a). It seems like the authors can provide theoretically optimal values of $n_{est}$ as well, atleast orderwise.\n\n\n- **Typos**:\n    1. Line 173, 2nd column : \"Fo\" -> \"For\".\n    2. Line 876 : \"than\" -> \"as\".\n    3. Lines 913-914 : two \"conditionnally\" -> \"conditionally\".", "questions_for_authors": "- Line 428, 1st column : \"This mirrors the shape of curves observed in signal unplanting in Figure 3, which would also appear in Figure 1 and Figure 2\". Unfortunately, I am not able to identify any staircases in Figures 1-3 and all of them look more like noisy sigmoids.\n\n- Does the bound on $\\eta< \\frac{1}{\\\\# \\tilde{\\mathcal{X}}}$ result in additional constraints in Theorem 3.9? Also, in Lines 1105-1106, can the poor value of the bound in Theorem 3.9 be possibly improved by slightly changing the definition of $\\eta$ to a quantity in expecatation, or is it unavoidable?\n\n- What was the issue with the earlier proof of (Hardt et al 2023) for $\\epsilon>0$ (Appendix F.4)? Does Definition F.3 which is the current version of (Hardt et al 2023) address it ?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "LcN6Se2ycf", "reviewer": "Reviewer_HD8o", "summary": "The paper proposes a framework to quantify the outcome of collective actions in machine learning, performed through the coordinated submission of altered data. In particular, the proposed framework allows the derivation of lower bounds on the success of the collective's strategy. The authors advocate for strategies that will be available in practice for a collective. They also advocate for the autonomy of the collective in estimating the success of a strategy based on information available to the collective. The framework focuses on three objectives, namely *signal planting*, *signal erasing*, and *signal unplanting* (newly introduced by the authors), and proposes efficient strategies to implement them, as well as lower bounds on their success. \n\nFor the experimental aspect of the work, the authors focused on *signal planting* and *signal unplanting*. Experiments conducted on synthetic data confirm previous observations that the success of the collective depends on its relative size but also highlight the critical role of the collective's absolute size. The results show a small gap between the effective success rate and the theoretical lower bounds proposed. The authors also show that their lower bound compares favorably to Hardt et al. (2023) for signal planting.", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We would like to thank the reviewer for their detailed and constructive review, and their overall positive feedback. We also appreciate them pointing out the typos. We will update $n_{est}$ to $n_{estim}$​, add assumption $A_0$ regarding the collective's access to $N$, and include a running example if it is considered helpful. We will also make sure to include details about the relationship between features and labels in the synthetic dataset.\n\n**Concerning the synthetic dataset, which has also been mentioned by other reviewers**: our paper provides finite sample guarantees for collective action in classification, and the bounds we derive depend on several parameters. The main purpose of our experiments is to illustrate the bounds we obtained and to gain insights into the influence of the various parameters. We considered it more relevant to use a synthetic dataset to better understand the influence of these parameters. For example, we can deliberately manage the label imbalance (see our response to Reviewer CB4v) and clearly demonstrate that the adaptive strategy outperforms the naive strategies in Figure 3, even outperforming the naive strategy based on the second most frequent global label after $y^*$ (see Figure 3 and Table 1). Furthermore, for a fixed $g$, we can investigate how the composition of the training set elements within the signal set impacts the results using a synthetic dataset, but not with a real-world dataset. In ongoing work we will be working with real-world datasets, but for a first study of this methodology we felt that the priority was to understand its properties rather than simply exhibit an application which would give limited insight into whether our conceptual understanding of the parameters is on solid ground.\n\n*Experiments for configurations with $\\epsilon > 0$*\n\nYes, the lower bounds will become weaker as $\\epsilon$ increases.\n\n*Lower bound on the success of signal erasing*\n\nThe lower bounds are trivial (equal to zero) because the estimation terms are too large, as they depend on the cardinality of $\\mathcal{X}$. We briefly mentioned this in the appendix (lines 1104-1105) but we can also include it in the main text if it is considered helpful.\n\n*Experiments repeated multiple times*\n\nWe ran the experiments only once. We expect little variance, except for values very close to the steps, which do not affect the overall trend of the curves highlighted in the paper. However, we can still run additional experiments and average the results if deemed helpful.\n\nWe thank the reviewer again for their valuable feedback.", "claims_and_evidence": "The two main claims of the paper are:\n1. The ability of the proposed framework to assist in estimating the most effective strategy.\n2. The ability to provide lower bounds on success, with parameters controlled by the collective.\n\nArguments supporting both claims are well presented in the paper and backed by experimental results, except in the case of *signal erasing*, for which no experimental evaluation is provided.", "methods_and_evaluation_criteria": "The authors use Hoeffding’s inequality to derive the lower bounds and conduct experiments on synthetic data to evaluate their usefulness. They select an appropriate baseline (Hardt et al., 2023) for comparison. Overall, the methods and evaluation approach appear reasonable. The authors also discuss the possibility of employing other concentration inequalities to derive tighter bounds.", "theoretical_claims": "I reviewed Appendix E to better understand how the lower bounds are derived. However, I might not have fully understood certain aspects of the proofs presented in Appendix E.", "experimental_designs_or_analyses": "I have reviewed all the experiments. Please refer to the section \"Other Strengths and Weaknesses\" for detailed comments on the experiments.", "relation_to_broader_scientific_literature": "This paper contributes broadly to discussions on how affected parties can take a more active role in the implementation of responsible AI. It is closely related to Hardt et al. (2023) and advocates for estimating lower bounds on a strategy's success using information accessible to the collective. Thus, the proposed framework can be viewed as a step toward enhancing the autonomy of collectives.", "essential_references_not_discussed": "I think the authors provide an excellent coverage of the existing works.", "other_strengths_and_weaknesses": "I found the research question of estimating the success rate of collective action based on pooled data very interesting and original. This paper contributes meaningfully to understanding how collective action can be implemented in practice.\n\nOverall, the paper is very well written. Each objective and assumption is clearly defined, and the corresponding strategies and lower bounds on success are explicitly presented. The authors also provide intuitive explanations of the strategies and appropriately discuss the limitations associated with some key assumptions.\n\nMy main concerns relate to the experiments and their realism. The data-generation process is not clearly described; for instance, details about the relationship between features and labels are missing. Additionally, it is unclear why only a single configuration for the parameter $\\epsilon$ was chosen.", "other_comments_or_suggestions": "- Line 159. The second probability should be population probability\n- Line 174. \"Fo each feature\" -> \"For each feature\"\n- Line 403: y∗ ∈ {Good, Average, Poor} -> y∗ ∈ {Good (G), Average (A), Poor (P)}\n\n**if possible:**\n- Propose an alternative notation for $n_{est}$ as it can lead to confusion with $N_{test}$\n- Provide concrete examples illustrating each of the three objectives, similar to those given in Hardt et al. (2023) for signal planting and signal erasing (e.g., content creators). Ideally, introducing a running example early, when the objectives are first defined, would help readers better appreciate the nuances between scenarios.\n- Line 114: wrap the assumption on collective access to $N$ under Assumption definition (e.g., **Assumption ($A_0$)**)", "questions_for_authors": "- Did you conduct any experiments for configurations with $\\epsilon > 0$? If so, could you describe the general trend observed?\n- In practice, what performance did you observe for the lower bound on the success of *signal erasing*?\n- Line 590: \"Additionally, each car is assigned a Car Evaluation label based on a scoring system that considers various factors such as safety rating, fuel type, warranty length, and others\" Could you please provide more details on the scoring system used?\n- Were experiments repeated multiple times for each fixed value of $n$ (for example, in Fig. 1)?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "BCyXmAb3wr", "reviewer": "Reviewer_TeJJ", "summary": "This paper introduces a framework in which a group of users, or “collective,” can statistically coordinate modifications to their data to influence a platform’s learning algorithm. The authors define several types of objectives—“signal planting,” “signal unplanting,” and “signal erasing”—and provide theoretical guarantees on how effectively a collective can achieve these objectives. By modeling the platform as choosing an ε-suboptimal classifier, the work derives lower bounds on the collective’s success under finite-sample conditions. The paper proposes practical strategies for modifying data, shows how a collective can estimate crucial distributional parameters from its own pooled samples, and presents empirical results on a synthetic car-rating dataset. Overall, the paper contributes new algorithmic tools and tighter theoretical bounds that extend and refine earlier studies on collective action in machine learning.", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for their time and appreciate their positive feedback on our paper.", "claims_and_evidence": "Overall, the paper’s theoretical claims—namely that finite-sample data poisoning strategies can guarantee lower bounds for signal planting, unplanting, and erasing—are backed by proofs and validated with synthetic experiments. However, some broader practical claims are less firmly grounded:\n\nReal-World Applicability: The paper relies on a synthetic car-rating dataset to illustrate the theory. While it demonstrates the feasibility of the strategies in a controlled setting, it does not provide equally detailed evidence that these methods scale or remain effective in complex, real-world data environments.\n\nPlatform Defenses: Although the paper discusses how a platform chooses an ε-suboptimal classifier based on the poisoned data, it does not deeply explore realistic detection or mitigation strategies. Consequently, any claim implying that these results readily extend to platforms with active defenses remains under-supported.\n\nThese limitations do not undermine the core theoretical findings, but they do mean that some broader statements regarding practical deployment would benefit from additional evidence or real-world trials to be wholly convincing.", "methods_and_evaluation_criteria": "Yes. The paper’s methods—particularly the definitions of success in “signal planting,” “unplanting,” and “erasing”—align directly with the theoretical goals, and the synthetic car-rating dataset provides a controlled way to demonstrate how these objectives can be measured in practice. While real-world datasets might introduce more complexity, the chosen evaluation still makes sense as a proof-of-concept for the proposed finite-sample bounds and strategies.", "theoretical_claims": "The arguments appear sound, and I did not spot errors in the manipulations or the final bounds. The stepwise presentation (outlining each concentration term, then taking a union bound) is internally consistent and aligns with standard proof techniques in learning theory.", "experimental_designs_or_analyses": "I looked at how the synthetic car-rating dataset was generated and how success was measured for the different poisoning strategies (signal planting, unplanting, erasing). The experimental design aligns well with the theoretical framework—each experiment straightforwardly tests whether the derived lower bounds match observed outcomes on the synthetic data. While the dataset is simplified and may not fully capture real-world complexity, I did not see flaws in how the experiments were conducted or analyzed relative to the stated objectives.", "relation_to_broader_scientific_literature": "Compared to classic data poisoning, which often involves a single adversary, this work extends “collective action” ideas—originally from Hardt et al. (2023)—to finite-sample settings. It refines how groups of individuals coordinate data modifications (e.g., “signal planting,” “unplanting,” “erasing”) and integrates statistical estimation techniques so that the collective can learn optimal poisoning strategies from its own local data. This bridges backdoor and adversarial ML with fundamental estimation theory, yielding tighter and more broadly applicable bounds.", "essential_references_not_discussed": "NA", "other_strengths_and_weaknesses": "Na", "other_comments_or_suggestions": "Na", "questions_for_authors": "Na", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Meta-review: The authors provide a novel theoretical characterization of the effectiveness of collective action in machine learning systems. In particular, they extend on the framework of Hardt et al 2023 to account for how the collective’s actions could be accounted for, and possibly mitigated, by the firm. This leads to new concepts for the literature on collective action, such as signal unplanting and signal erasing. While the empirical validation using synthetic data was identified as a potential limitation, the reviewers praised the intuitive theoretical analysis, which sheds light on this emerging area.
Decision: Accept (oral)