Title: Strategic Classification under Unknown Personalized Manipulation
Venue: NeurIPS 2023
Accepted: yes
Keywords: strategic classification

mistake bound in online learning

PAC learning
Abstract: We study the fundamental mistake bound and sample complexity in the strategic classification, where agents can strategically manipulate their feature vector up to an extent in order to be predicted as positive. For example, given a classifier determining college admission, student candidates may try to take easier classes to improve their GPA, retake SAT and change schools in an effort to fool the classifier. *Ball manipulations* are a widely studied class of manipulations in the literature, where agents can modify their feature vector within a bounded radius ball. Unlike most prior work, our work consider manipulations to be *personalized*, meaning that agents can have different levels of manipulation abilities (e.g., varying radii for ball manipulations), and *unknown* to the learner.

We formalize the learning problem in an interaction model where the learner first deploys a classifier and the agent manipulates the feature vector within their manipulation set to game the deployed classifier. We investigate various scenarios in terms of the information available to the learner during the interaction, such as observing the original feature vector before or after deployment, observing the manipulated feature vector, or not seeing either the original or the manipulated feature vector. We begin by providing online mistake bounds and PAC sample complexity in these scenarios for ball manipulations. We also explore non-ball manipulations and show that, even in the simplest scenario where both the original and the manipulated feature vectors are revealed, the mistake bounds and sample complexity are lower bounded by $\Omega(|\mathcal H|)$ when the target function belongs to a known class $\mathcal H$.

Strategic Classification under Unknown Personalized Manipulation

Abstract

We study the fundamental mistake bound and sample complexity in the strategic classification, where agents can strategically manipulate their feature vector up to an extent in order to be predicted as positive. For example, given a classifier determining college admission, student candidates may try to take easier classes to improve their GPA, retake SAT and change schools in an effort to fool the classifier. Ball manipulations are a widely studied class of manipulations in the literature, where agents can modify their feature vector within a bounded radius ball. Unlike most prior work, our work considers manipulations to be personalized , meaning that agents can have different levels of manipulation abilities (e.g., varying radii for ball manipulations), and unknown to the learner.

We formalize the learning problem in an interaction model where the learner first deploys a classifier and the agent manipulates the feature vector within their manipulation set to game the deployed classifier. We investigate various scenarios in terms of the information available to the learner during the interaction, such as observing the original feature vector before or after deployment, observing the manipulated feature vector, or not seeing either the original or the manipulated feature vector. We begin by providing online mistake bounds and PAC sample complexity in these scenarios for ball manipulations. We also explore non-ball manipulations and show that, even in the simplest scenario where both the original and the manipulated feature vectors are revealed, the mistake bounds and sample complexity are lower bounded by Ω( |H| ) when the target function belongs to a known class H .

1 Introduction

Strategic classification addresses the problem of learning a classifier robust to manipulation and gaming by self-interested agents (Hardt et al., 2016). For example, given a classifier determining loan approval based on credit scores, applicants could open or close credit cards and bank accounts to increase their credit scores. In the case of a college admission classifier, students may try to take easier classes to improve their GPA, retake the SAT or change schools in an effort to be admitted. In both cases, such manipulations do not change their true qualifications. Recently, a collection of papers has studied strategic classification in both the online setting where examples are chosen by an adversary in a sequential manner (Dong et al., 2018; Chen et al., 2020; Ahmadi et al., 2021, 2023), and the

distributional setting where the examples are drawn from an underlying data distribution (Hardt et al., 2016; Zhang and Conitzer, 2021; Sundaram et al., 2021; Lechner and Urner, 2022). Most existing works assume that manipulation ability is uniform across all agents or is known to the learner. However, in reality, this may not always be the case. For instance, low-income students may have a lower ability to manipulate the system compared to their wealthier peers due to factors such as the high costs of retaking the SAT or enrolling in additional classes, as well as facing more barriers to accessing information about college (Milli et al., 2019) and it is impossible for the learner to know the highest achievable GPA or the maximum number of times a student may retake the SAT due to external factors such as socio-economic background and personal circumstances.

We characterize the manipulation of an agent by a set of alternative feature vectors that she can modify her original feature vector to, which we refer to as the manipulation set . Ball manipulations are a widely studied class of manipulations in the literature, where agents can modify their feature vector within a bounded radius ball. For example, Dong et al. (2018); Chen et al. (2020); Sundaram et al. (2021) studied ball manipulations with distance function being some norm and Zhang and Conitzer (2021); Lechner and Urner (2022); Ahmadi et al. (2023) studied a manipulation graph setting, which can be viewed as ball manipulation w.r.t. the graph distance on a predefined known graph.

In the online learning setting, the strategic agents come sequentially and try to game the current classifier. Following previous work, we model the learning process as a repeated Stackelberg game over T time steps. In round t , the learner proposes a classifier f t and then the agent, with a manipulation set (unknown to the learner), manipulates her feature in an effort to receive positive prediction from f t . There are several settings based on what and when the information is revealed about the original feature vector and the manipulated feature vector in the game. The simplest setting for the learner is observing the original feature vector before choosing f t and the manipulated vector after. In a slightly harder setting, the learner observes both the original and manipulated vectors after selecting f t . An even harder setting involves observing only the manipulated feature vector after selecting f t . The hardest and least informative scenario occurs when neither the original nor the manipulated feature vectors are observed.

In the distributional setting, the agents are sampled from an underlying data distribution. Previous work assumes that the learner has full knowledge of the original feature vector and the manipulation set, and then views learning as a one-shot game and solves it by computing the Stackelberg equilibria of it. However, when manipulations are personalized and unknown, we cannot compute an equilibrium and study learning as a one-shot game. In this work, we extend the iterative online interaction model from the online setting to the distributional setting, where the sequence of agents is sampled i.i.d. from the data distribution. After repeated learning for T (which is equal to the sample size) rounds, the learner has to output a strategy-robust predictor for future use.

In both online and distributional settings, examples are viewed through the lens of the current predictor and the learner does not have the ability to inquire about the strategies the previous examples would have adopted under a different predictor.

Related work Our work is primarily related to strategic classification in online and distributional settings. Strategic classification was first studied in a distributional model by Hardt et al. (2016) and subsequently by Dong et al. (2018) in an online model. Hardt et al. (2016) assumed that agents manipulate by best response with respect to a uniform cost function known to the learner. Building on the framework of (Hardt et al., 2016), Lechner and Urner (2022); Sundaram et al. (2021); Zhang and Conitzer (2021); Hu et al. (2019); Milli et al. (2019) studied the distributional learning problem, and all of them assumed that the manipulations are predefined and known to the learner, either by a cost function or a predefined manipulation graph. For online learning, Dong et al. (2018) considered a similar manipulation setting as in this work, where manipulations are personalized and unknown. However, they studied linear classification with ball manipulations in the online setting and focused on finding appropriate conditions of the cost function to achieve sub-linear Stackelberg regret. Chen et al. (2020) also studied Stackelberg regret in linear classification with uniform ball manipulations. Ahmadi et al. (2021) studied the mistake bound under uniform (possbily unknown) ball manipulations, and Ahmadi et al. (2023) studied regret under a pre-defined and known manipulation. The most relevant work is a recent concurrent study by Lechner et al. (2023), which also explores strategic classification involving unknown personalized manipulations but with a different loss function. In their work, a predictor incurs a loss of 0 if and only if the agent refrains from manipulation and the predictor correctly predicts at the unmanipulated feature vector. In our work, the predictor's loss is 0

if it correctly predicts at the manipulated feature, even when the agent manipulates. As a result, their loss function serves as an upper bound of our loss function.

There has been a lot of research on various other issues and models in strategic classification. Beyond sample complexity, Hu et al. (2019); Milli et al. (2019) focused on other social objectives, such as social burden and fairness. Recent works also explored different models of agent behavior, including proactive agents Zrnic et al. (2021), non-myopic agents (Haghtalab et al., 2022) and noisy agents (Jagadeesan et al., 2021). Ahmadi et al. (2023) considers two agent models of randomized learners: a randomized algorithm model where the agents respond to the realization, and a fractional classifier model where agents respond to the expectation, and our model corresponds to the randomized algorithm model. Additionally, there is also a line of research on agents interested in improving their qualifications instead of gaming (Kleinberg and Raghavan, 2020; Haghtalab et al., 2020; Ahmadi et al., 2022). Strategic interactions in the regression setting have also been studied (e.g., Bechavod et al. (2021)).

Beyond strategic classification, there is a more general research area of learning using data from strategic sources, such as a single data generation player who manipulates the data distribution (Brückner and Scheffer, 2011; Dalvi et al., 2004). Adversarial perturbations can be viewed as another type of strategic source (Montasser et al., 2019).

2 Model

Strategic classification Throughout this work, we consider the binary classification task. Let X denote the feature vector space, Y = { +1 , -1 } denote the label space, and H ⊆ Y X denote the hypothesis class. In the strategic setting, instead of an example being a pair ( x, y ) , an example, or agent , is a triple ( x, u, y ) where x ∈ X is the original feature vector, y ∈ Y is the label, and u ⊆ X is the manipulation set, which is a set of feature vectors that the agent can modify their original feature vector x to. In particular, given a hypothesis h ∈ Y X , the agent will try to manipulate her feature vector x to another feature vector x ′ within u in order to receive a positive prediction from h . The manipulation set u is unknown to the learner. In this work, we will be considering several settings based on what the information is revealed to the learner, including both the original/manipulated feature vectors, the manipulated feature vector only, or neither, and when the information is revealed.

̸

More formally, for agent ( x, u, y ) , given a predictor h , if h ( x ) = -1 and her manipulation set overlaps the positive region by h , i.e., u ∩ X h, + = ∅ with X h, + := { x ∈ X| h ( x ) = +1 } , the agent will manipulate x to ∆( x, h, u ) ∈ u ∩X h, + 1 to receive positive prediction by h . Otherwise, the agent will do nothing and maintain her feature vector at x , i.e., ∆( x, h, u ) = x . We call ∆( x, h, u ) the manipulated feature vector of agent ( x, u, y ) under predictor h .

A general and fundamental type of manipulations is ball manipulations , where agents can manipulate their feature within a ball of personalized radius. More specifically, given a metric d over X , the manipulation set is a ball B ( x ; r ) = { x ′ | d ( x, x ′ ) ≤ r } centered at x with radius r for some r ∈ R ≥ 0 . Note that we allow different agents to have different manipulation power and the radius can vary over agents. Let Q denote the set of allowed pairs ( x, u ) , which we refer to as the feature-manipulation set space. For ball manipulations, we have Q = { ( x, B ( x ; r )) | x ∈ X , r ∈ R ≥ 0 } for some known metric d over X . In the context of ball manipulations, we use ( x, r, y ) to represent ( x, B ( x ; r ) , y ) and ∆( x, h, r ) to represent ∆( x, h, B ( x ; r )) for notation simplicity.

̸

For any hypothesis h , let the strategic loss ℓ str ( h, ( x, u, y )) of h be defined as the loss at the manipulated feature, i.e., ℓ str ( h, ( x, u, y )) := 1 ( h (∆( x, h, u )) = y ) . According to our definition of ∆( · ) , we can write down the strategic loss explicitly as

̸

For any randomized predictor p (a distribution over hypotheses), the strategic behavior depends on the realization of the predictor and the strategic loss of p is ℓ str ( p, ( x, u, y )) := E h ∼ p [ ℓ str ( h, ( x, u, y ))] .

̸

Online learning We consider the task of sequential classification where the learner aims to classify a sequence of agents ( x 1 , u 1 , y 1 ) , ( x 2 , u 2 , y 2 ) , . . . , ( x T , u T , y T ) ∈ Q × Y that arrives in an online manner. At each round, the learner feeds a predictor to the environment and then observes his prediction ̂ y t , the true label y t and possibly along with some additional information about the original/manipulated feature vectors. We say the learner makes a mistake at round t if ̂ y t = y t and the learner's goal is to minimize the number of mistakes on the sequence. The interaction protocol (which repeats for t = 1 , . . . , T ) is described in the following.

Protocol 1 Learner-Agent Interaction at round t

1: The environment picks an agent ( x t , u t , y t ) and reveals some context C ( x t ) . In the online setting, the agent is chosen adversarially, while in the distributional setting, the agent is sampled i.i.d.

2: The learner A observes C ( x t ) and picks a hypothesis f t ∈ Y X .

3: The learner A observes the true label y t , the prediction ̂ y t = f t (∆ t ) , and some feedback F ( x t , ∆ t ) , where ∆ t = ∆( x t , f t , u t ) is the manipulated feature vector.

The context function C ( · ) and feedback function F ( · ) reveals information about the original feature vector x t and the manipulated feature vector ∆ t . C ( · ) reveals the information before the learner picks f t while F ( · ) does after. We study several different settings based on what and when information is revealed.

The simplest setting for the learner is observing the original feature vector x t before choosing f t and the manipulated vector ∆ t after. Consider a teacher giving students a writing assignment or take-home exam. The teacher might have a good knowledge of the students' abilities (which correspond to the original feature vector x t ) based on their performance in class, but the grade has to be based on how well they do the assignment. The students might manipulate by using the help of ChatGPT / Google / WolframAlpha / their parents, etc. The teacher wants to create an assignment that will work well even in the presence of these manipulation tools. In addition, If we think of each example as representing a subpopulation (e.g., an organization is thinking of offering loans to a certain group), then there might be known statistics about that population, even though the individual classification (loan) decisions have to be made based on responses to the classifier. This setting corresponds to C ( x t ) = x t and F ( x t , ∆ t ) = ∆ t . We denote a setting by their values of C, F and thus, we denote this setting by ( x, ∆) .

In a slightly harder setting, the learner observes both the original and manipulated vectors after selecting f t and thus, f t cannot depend on the original feature vector in this case. For example, if a high-school student takes the SAT test multiple times, most colleges promise to only consider the highest one (or even to "superscore" the test by considering the highest score separately in each section) but they do require the student to submit all of them. Then C ( x t ) = ⊥ and F ( x t , ∆ t ) = ( x t , ∆ t ) , where ⊥ is a token for 'no information', and this setting is denoted by ( ⊥ , ( x, ∆)) .

An even harder setting involves observing only the manipulated feature vector after selecting f t (which can only be revealed after f t since ∆ t depends on f t ). Then C ( x t ) = ⊥ and F ( x t , ∆ t ) = ∆ t and this setting is denoted by ( ⊥ , ∆) .

The hardest and least informative scenario occurs when neither the original nor the manipulated feature vectors are observed. Then C ( x t ) = ⊥ and F ( x t , ∆ t ) = ⊥ and it is denoted by ( ⊥ , ⊥ ) .

Throughout this work, we focus on the realizable setting, where there exists a perfect classifier in H that never makes any mistake at the sequence of strategic agents. More specifically, there exists a hypothesis h ∗ ∈ H such that for any t ∈ [ T ] , we have y t = h ∗ (∆( x t , h ∗ , u t )) 2 . Then we define the mistake bound as follows.

Definition 1. For any choice of ( C, F ) , let A be an online learning algorithm under Protocol 1 in the setting of ( C, F ) . Given any realizable sequence S = (( x 1 , u 1 , h ∗ (∆( x 1 , h ∗ , u 1 ))) , . . . , ( x T , u T , h ∗ (∆( x T , h ∗ , u T ))) ∈ ( Q × Y ) T , where T is any integer and h ∗ ∈ H , let M A ( S ) be the number of mistakes A makes on the sequence S . The mistake bound of ( H , Q ) , denoted MB C,F , is the smallest number B ∈ N such that there exists an algorithm A such that M A ( S ) ≤ B over all realizable sequences S of the above form.

According the rank of difficulty of the four settings with different choices of ( C, F ) , the mistake bounds are ranked in the order of MB x, ∆ ≤ MB ⊥ , ( x, ∆) ≤ MB ⊥ , ∆ ≤ MB ⊥ , ⊥ .

PAC learning In the distributional setting, the agents are sampled from an underlying distribution D over Q × Y . The learner's goal is to find a hypothesis h with low population loss L str D ( h ) := E ( x,u,y ) ∼D [ ℓ str ( h, ( x, u, y ))] . One may think of running empirical risk minimizer (ERM) over samples drawn from the underlying data distribution, i.e., returning arg min h ∈H 1 m ∑ m i =1 ℓ str ( h, ( x i , u i , y i )) , where ( x 1 , u 1 , y 1 ) , . . . , ( x m , u m , y m ) are i.i.d. sampled from D . However, ERM is unimplementable because the manipulation sets u i 's are never revealed to the algorithm, and only the partial feedback in response to the implemented classifier is provided. In particular, in this work we consider using the same interaction protocol as in the online setting, i.e., Protocol 1, with agents ( x t , u t , y t ) i.i.d. sampled from the data distribution D . After T rounds of interaction (i.e., T i.i.d. agents), the learner has to output a predictor f out for future use.

Again, we focus on the realizable setting, where the sequence of sampled agents (with manipulation) can be perfectly classified by a target function in H . Alternatively, there exists a classifier with zero population loss, i.e., there exists a hypothesis h ∗ ∈ H such that L str D ( h ∗ ) = 0 . Then we formalize the notion of PAC sample complexity under strategic behavior as follows.

Definition 2. For any choice of ( C, F ) , let A be a learning algorithm that interacts with agents using Protocol 1 in the setting of ( C, F ) and outputs a predictor f out in the end. For any ε, δ ∈ (0 , 1) , the sample complexity of realizable ( ε, δ ) -PAC learning of ( H , Q ) , denoted SC C,F ( ε, δ ) , is defined as the smallest m ∈ N for which there exists a learning algorithm A in the above form such that for any distribution D over Q×Y where there exists a predictor h ∗ ∈ H with zero loss, L str D ( h ) = 0 , with probability at least 1 -δ over ( x 1 , u 1 , y 1 ) , . . . , ( x m , u m , y m ) i.i.d. ∼ D , L str D ( f out ) ≤ ε .

Similar to mistake bounds, the sample complexities are ranked in the same order SC x, ∆ ≤ SC ⊥ , ( x, ∆) ≤ SC ⊥ , ∆ ≤ SC ⊥ , ⊥ according to the rank of difficulty of the four settings.

3 Overview of Results

In classic (non-strategic) online learning, the Halving algorithm achieves a mistake bound of log( |H| ) by employing the majority vote and eliminating inconsistent hypotheses at each round. In classic PAC learning, the sample complexity of O ( log( |H| ) ε ) is achievable via ERM. Both mistake bound and sample complexity exhibit logarithmic dependency on |H| . This logarithmic dependency on |H| (when there is no further structural assumptions) is tight in both settings, i.e., there exist examples of H with mistake bound of Ω(log( |H| )) and with sample complexity of Ω( log( |H| ) ε ) . In the setting where manipulation is known beforehand and only ∆ t is observed, Ahmadi et al. (2023) proved a lower bound of Ω( |H| ) for the mistake bound. Since in the strategic setting we can achieve a linear dependency on |H| by trying each hypothesis in H one by one and discarding it once it makes a mistake, the question arises:

Can we achieve a logarithmic dependency on |H| in strategic classification?

In this work, we show that the dependency on |H| varies across different settings and that in some settings mistake bound and PAC sample complexity can exhibit different dependencies on |H| . We start by presenting our results for ball manipulations in the four settings.

Setting of ( x, ∆) (observing x t before choosing f t and observing ∆ t after) : For online learning, we propose an variant of the Halving algorithm, called Strategic Halving (Algorithm 1), which can eliminate half of the remaining hypotheses when making a mistake. The algorithm depends on observing x t before choosing the predictor f t . Then by applying the standard technique of converting mistake bound to PAC bound, we are able to achieve sample complexity of O ( log( |H| ) loglog( |H| ) ε ) .

Setting of ( ⊥ , ( x, ∆)) (observing both x t and ∆ t after selecting f t ) : We prove that, there exists an example of ( H , Q ) s.t. the mistake bound is lower bounded by Ω( |H| ) . This implies that no algorithm can perform significantly better than sequentially trying each hypothesis, which would make at most |H| mistakes before finding the correct hypothesis. However, unlike the construction of mistake lower bounds in classic online learning, where all mistakes can be forced to occur in the initial rounds, we demonstrate that we require Θ( |H| 2 ) rounds to ensure that all mistakes occur. In

the PAC setting, we first show that, any learning algorithm with proper output f out , i.e., f out ∈ H , needs a sample size of Ω( |H| ε ) . We can achieve a sample complexity of O ( log 2 ( |H| ) ε ) by executing Algorithm 2, which is a randomized algorithm with improper output.

Setting of ( ⊥ , ∆) (observing only ∆ t after selecting f t ) : The mistake bound of Ω( |H| ) also holds in this setting, as it is known to be harder than the previous setting. For the PAC learning, we show that any conservative algorithm, which only depends on the information from the mistake rounds, requires Ω( |H| ε ) samples. The optimal sample complexity is left as an open problem.

Setting of ( ⊥ , ⊥ ) (observing neither x t nor ∆ t ) : Similarly, the mistake bound of Ω( |H| ) still holds. For the PAC learning, we show that the sample complexity is Ω( |H| ε ) by reducing the problem to a stochastic linear bandit problem.

Then we move on to non-ball manipulations. However, we show that even in the simplest setting of observing x t before choosing f t and observing ∆ t after, there is an example of ( H , Q ) such that the sample complexity is ˜ Ω( |H| ε ) . This implies that in all four settings of different revealed information, we will have sample complexity of ˜ Ω( |H| ε ) and mistake bound of ˜ Ω( |H| ) . We summarize our results in Table 1.

a A factor of loglog( |H| ) is neglected.

Table 1: The summary of results. ˜ O and ˜ Ω ignore logarithmic factors on |H| and 1 ε . The superscripts prop stands for proper learning algorithms and csv stands for conservative learning algorithms. All lower bounds in the non-strategic setting also apply to the strategic setting, implying that MB C,F ≥ Ω(log( |H| )) and SC C,F ≥ Ω( log( |H| ) ε ) for all settings of ( C, F ) . In all four settings, a mistake bound of O ( |H| ) can be achieved by simply trying each hypothesis in H while the sample complexity can be achieved as ˜ O ( |H| ε ) by converting the mistake bound of O ( |H| ) to a PAC bound using standard techniques.

4 Ball manipulations

In ball manipulations, when B ( x ; r ) ∩ X h, + has multiple elements, the agent will always break ties by selecting the one closest to x , i.e., ∆( x, h, r ) = arg min x ′ ∈B ( x ; r ) ∩X h, + d ( x, x ′ ) . In round t , the learner deploys predictor f t , and once he knows x t and ̂ y t , he can calculate ∆ t himself without needing knowledge of r t by

Thus, for ball manipulations, knowing x t is equivalent to knowing both x t and ∆ t .

4.1 Setting ( x, ∆) : Observing x t Before Choosing f t

Online learning We propose a new algorithm with mistake bound of log( |H| ) in setting ( x, ∆) . To achieve a logarithmic mistake bound, we must construct a predictor f t such that if it makes a mistake, we can reduce a constant fraction of the remaining hypotheses. The primary challenge is that we do not have access to the full information, and predictions of other hypotheses are hidden. To extract the information of predictions of other hypotheses, we take advantage of ball manipulations, which

induces an ordering over all hypotheses. Specifically, for any hypothesis h and feature vector x , we define the distance between x and h by the distance between x and the positive region by h , X h, + , i.e.,

At each round t , given x t , the learner calculates the distance d ( x t , h ) for all h in the version space (meaning hypotheses consistent with history) and selects a hypothesis f t such that d ( x t , f t ) is the median among all distances d ( x t , h ) for h in the version space. We can show that by selecting f t in this way, the learner can eliminate half of the version space if f t makes a mistake. We refer to this algorithm as Strategic Halving, and provide a detailed description of it in Algorithm 1.

Theorem 1. For any feature-ball manipulation set space Q and hypothesis class H , Strategic Halving achieves mistake bound MB x, ∆ ≤ log( |H| ) .

Algorithm 1 Strategic Halving

1: Initialize the version space VS = H .

2: for t = 1 , . . . , T do

3: pick an f t ∈ VS such that d ( x t , f t ) is the median of { d ( x t , h ) | h ∈ VS } .

̸

5: else if ̂ y t = y t and y t = -then VS ← VS \ { h ∈ VS | d ( x t , h ) ≤ d ( x t , f t ) } .

4: if ̂ y t = y t and y t = + then VS ← VS \ { h ∈ VS | d ( x t , h ) ≥ d ( x t , f t ) } ;

6: end for

To prove Theorem 1, we only need to show that each mistake reduces the version space by half. Supposing that f t misclassifies a true positive example ( x t , r t , +1) by negative, then we know that d ( x t , f t ) > r t while the target hypothesis h ∗ must satisfy that d ( x t , h ∗ ) ≤ r t . Hence any h with d ( x t , h ) ≥ d ( x t , f t ) cannot be h ∗ and should be eliminated. Since d ( x t , f t ) is the median of { d ( x t , h ) | h ∈ VS } , we can elimate half of the version space. It is similar when f t misclassifies a true negative. The detailed proof is deferred to Appendix B.

PAC learning We can convert Strategic Halving to a PAC learner by the standard technique of converting a mistake bound to a PAC bound (Gallant, 1986). Specifically, the learner runs Strategic Halving until it produces a hypothesis f t that survives for 1 ε log( log( |H| ) δ ) rounds and outputs this f t . Then we have Theorem 2, and the proof is included in Appendix C.

Theorem 2. For any feature-ball manipulation set space Q and hypothesis class H , we can achieve SC x, ∆ ( ε, δ ) = O ( log( |H| ) ε log( log( |H| ) δ )) by combining Strategic Halving and the standard technique of converting a mistake bound to a PAC bound.

4.2 Setting ( ⊥ , ( x, ∆)) : Observing x t After Choosing f t

When x t is not revealed before the learner choosing f t , the algorithm of Strategic Halving does not work anymore. We demonstrate that it is impossible to reduce constant fraction of version space when making a mistake, and prove that the mistake bound is lower bounded by Ω( |H| ) by constructing a negative example of ( H , Q ) . However, we can still achieve sample complexity with poly-logarithmic dependency on |H| in the distributional setting.

4.2.1 Results in the Online Learning Model

To offer readers an intuitive understanding of the distinctions between the strategic setting and standard online learning, we commence by presenting an example in which no deterministic learners, including the Halving algorithm, can make fewer than |H| 1 mistakes.

̸

Example 1. Consider a star shape metric space ( X , d ) , where X = { 0 , 1 , . . . , n } , d ( i, j ) = 2 and d (0 , i ) = 1 for all i, j ∈ [ n ] with i = j . The hypothesis class is composed of singletons over [ n ] , i.e., H = { 2 1 { i } -1 | i ∈ [ n ] } . When the learner is deterministic, the environment can pick an agent ( x t , r t , y t ) dependent on f t . If f t is all-negative, then the environment picks ( x t , r t , y t ) = (0 , 1 , +1) , and then the learner makes a mistake but no hypothesis can be eliminated. If f t predicts 0 by positive, the environment will pick ( x t , r t , y t ) = (0 , 0 , -1) , and then the learner makes a mistake but no hypothesis can be eliminated. If f t predicts some i ∈ [ n ] by positive, the environment will pick ( x t , r t , y t ) = ( i, 0 , -1) , and then the learner makes a mistake with only one hypothesis 2 1 { i } -1 eliminated. Therefore, the learner will make n -1 mistakes.

̸

In this work, we allow the learner to be randomized. When an ( x t , r t , y t ) is generated by the environment, the learner can randomly pick an f t , and the environment does not know the realization of f t but knows the distribution where f t comes from. It turns out that randomization does not help much. We prove that there exists an example in which any (possibly randomized) learner will incur Ω( |H| ) mistakes.

Theorem 3. There exists a feature-ball manipulation set space Q and hypothesis class H s.t. the mistake bound MB ⊥ , ( x, ∆) ≥ |H|1 . For any (randomized) algorithm A and any T ∈ N , there exists a realizable sequence of ( x t , r t , y t ) 1: T such that with probability at least 1 -δ (over randomness of A ), A makes at least min( T 5 |H| log( |H| /δ ) , |H| 1) mistakes.

Essentially, we design an adversarial environment such that the learner has a probability of 1 |H| of making a mistake at each round before identifying the target function h ∗ . The learner only gains information about the target function when a mistake is made. The detailed proof is deferred to Appendix D. Theorem 3 establishes a lower bound on the mistake bound, which is |H| 1 . However, achieving this bound requires a sufficiently large number of rounds, specifically T = ˜ Ω( |H| 2 ) . This raises the question of whether there exists a learning algorithm that can make o ( T ) mistakes for any T ≤ |H| 2 . In Example 1, we observed that the adversary can force any deterministic learner to make |H| 1 mistakes in |H| 1 rounds. Consequently, no deterministic algorithm can achieve o ( T ) mistakes.

To address this, we propose a randomized algorithm that closely resembles Algorithm 1, with a modification in the selection of f t . Instead of using line 3, we choose f t randomly from VS since we lack prior knowledge of x t . This algorithm can be viewed as a variation of the well-known multiplicative weights method, applied exclusively during mistake rounds. For improved clarity, we present this algorithm as Algorithm 3 in Appendix E due to space limitations.

Theorem 4. For any T ∈ N , Algorithm 3 will make at most min( √ 4 log( |H| ) T, |H| 1) mistakes in expectation in T rounds.

Note that the T -dependent upper bound in Theorem 4 matches the lower bound in Theorem 3 up to a logarithmic factor when T = |H| 2 . This implies that approximately |H| 2 rounds are needed to achieve |H| 1 mistakes, which is a tight bound up to a logarithmic factor. Proof of Theorem 4 is included in Appendix E.

4.2.2 Results in the PAC Learning Model

In the PAC setting, the goal of the learner is to output a predictor f out after the repeated interactions. A common class of learning algorithms, which outputs a hypothesis f out ∈ H , is called proper. Proper learning algorithms are a common starting point when designing algorithms for new learning problems due to their natural appeal and ability to achieve good performance, such as ERM in classic PAC learning. However, in the current setting, we show that proper learning algorithms do not work well and require a sample size linear in |H| . The formal theorem is stated as follows and the proof is deferred to Appendix F.

Theorem 5. There exists a feature-ball manipulation set space Q and hypothesis class H s.t. SC prop ⊥ , ∆ ( ε, 7 8 ) = Ω( |H| ε ) , where SC prop ⊥ , ∆ ( ε, δ ) is the ( ε, δ ) -PAC sample complexity achievable by proper algorithms.

Theorem 5 implies that any algorithm capable of achieving sample complexity sub-linear in |H| must be improper. As a result, we are inspired to devise an improper learning algorithm. Before presenting the algorithm, we introduce some notations. For two hypotheses h 1 , h 2 , let h 1 ∨ h 2 denote the union of them, i.e., ( h 1 ∨ h 2 )( x ) = +1 iff. h 1 ( x ) = +1 or h 2 ( x ) = +1 . Similarly, we can define the union of more than two hypotheses. Then for any union of k hypotheses, f = ∨ k i =1 h i , the positive region of f is the union of positive regions of the k hypotheses and thus, we have d ( x, f ) = min i ∈ [ k ] d ( x, h i ) . Therefore, we can decrease the distance between f and any feature vector x by increasing k . Based on this, we devise a new randomized algorithm with improper output, described in Algorithm 2.

Theorem 6. For any feature-ball manipulation set space Q and hypothesis class H , we can achieve SC ⊥ , ( x, ∆) ( ε, δ ) = O ( log 2 ( |H| )+log(1 /δ ) ε log( 1 δ )) by combining Algorithm 2 with a standard confidence boosting technique. Note that the algorithm is improper.

Algorithm 2

1: Initialize the version space VS 0 = H .

2: for t = 1 , . . . , T do

3: randomly pick k t ∼ Unif( { 1 , 2 , 2 2 , . . . , 2 ⌊ log 2 ( n t ) -1 ⌋ } ) where n t = | VS t -1 | ;

4: sample k t hypotheses h 1 , . . . , h k t independently and uniformly at random from VS t -1 ;

5: let f t = ∨ k t i =1 h i .

̸

̸

6: if ̂ y t = y t and y t = + then VS t = VS t -1 \ { h ∈ VS t -1 | d ( x t , h ) ≥ d ( x t , f t ) } ;

8: else VS t = VS t -1 .

7: else if ̂ y t = y t and y t = -then VS t = VS t -1 \ { h ∈ VS t -1 | d ( x t , h ) ≤ d ( x t , f t ) } ;

9: end for

10: randomly pick τ from [ T ] and randomly sample h 1 , h 2 from VS τ -1 with replacement.

11: output h 1 ∨ h 2

Now we outline the high-level ideas behind Algorithm 2. In correct rounds where f t makes no mistake, the predictions of all hypotheses are either correct or unknown, and thus, it is hard to determine how to make updates. In mistake rounds, we can always update the version space similar to what was done in Strategic Halving. To achieve a poly-logarithmic dependency on |H| , we aim to reduce a significant number of misclassifying hypotheses in mistake rounds. The maximum number we can hope to reduce is a constant fraction of the misclassifying hypotheses. We achieve this by randomly sampling a f t (lines 3-5) s.t. f t makes a mistake, and d ( x t , f t ) is greater (smaller) than the median of d ( x t , h ) for all misclassifying hypotheses h for true negative (positive) examples. However, due to the asymmetric nature of manipulation, which aims to be predicted as positive, the rate of decreasing misclassifications over true positives is slower than over true negatives. To compensate for this asymmetry, we output a f out = h 1 ∨ h 2 with two selected hypotheses h 1 , h 2 (lines 10-11) instead of a single one to increase the chance of positive prediction.

We prove that Algorithm 2 can achieve small strategic loss in expectation as described in Lemma 1. Then we can achieve the sample complexity in Theorem 6 by boosting Algorithm 2 to a strong learner. This is accomplished by running Algorithm 2 multiple times until we obtain a good predictor. The proofs of Lemma 1 and Theorem 6 are deferred to Appendix G.

Lemma 1. Let S = ( x t , r t , y t ) T t =1 ∼ D T denote the i.i.d. sampled agents in T rounds and let A ( S ) denote the output of Algorithm 2 interacting with S . For any feature-ball manipulation set space Q and hypothesis class H , when T ≥ 320 log 2 ( |H| ) ε , we have E A ,S [ L str ( A ( S ))] ≤ ε .

4.3 Settings ( ⊥ , ∆) and ( ⊥ , ⊥ )

Online learning As mentioned in Section 2, both the settings of ( ⊥ , ∆) and ( ⊥ , ⊥ ) are harder than the setting of ( ⊥ , ( x, ∆)) , all lower bounds in the setting of ( ⊥ , ( x, ∆)) also hold in the former two settings. Therefore, by Theorem 3, we have MB ⊥ , ⊥ ≥ MB ⊥ , ∆ ≥ MB ⊥ , ( x, ∆) = |H| 1 .

̸

PAC learning In the setting of ( ⊥ , ∆) , Algorithm 2 is not applicable anymore since the learner lacks observation of x t , making it impossible to replicate the version space update steps in lines 6-7. It is worth noting that both PAC learning algorithms we have discussed so far fall under a general category called conservative algorithms, depend only on information from the mistake rounds. Specifically, an algorithm is said to be conservative if for any t , the predictor f t only depends on the history of mistake rounds up to t , i.e., τ < t with ̂ y τ = y τ , and the output f out only depends on the history of mistake rounds, i.e., ( f t , ̂ y t , y t , ∆ t ) t : ̂ y t = y t . Any algorithm that goes beyond this category would need to utilize the information in correct rounds. As mentioned earlier, in correct rounds, the predictions of all hypotheses are either correct or unknown, which makes it challenging to determine how to make updates. For conservative algorithms, we present a lower bound on the sample complexity in the following theorem, which is ˜ Ω( |H| ε ) , and its proof is included in Appendix H. The optimal sample complexity in the setting ( ⊥ , ∆) is left as an open problem.

̸

Theorem 7. There exists a feature-ball manipulation set space Q and hypothesis class H s.t. SC csv ⊥ , ∆ ( ε, 7 8 ) = ˜ Ω( |H| ε ) , where SC csv ⊥ , ∆ ( ε, δ ) is ( ε, δ ) -PAC the sample complexity achievable by conservative algorithms.

In the setting of ( ⊥ , ⊥ ) , our problem reduces to a best arm identification problem in stochastic bandits. We prove a lower bound on the sample complexity of ˜ Ω( |H| ε ) in Theorem 8 by reduction to stochastic linear bandits and applying the tools from information theory. The proof is deferred to Appendix I.

Theorem 8. There exists a feature-ball manipulation set space Q and hypothesis class H s.t. SC ⊥ , ⊥ ( ε, 7 8 ) = ˜ Ω( |H| ε ) .

5 Non-ball Manipulations

In this section, we move on to non-ball manipulations. In ball manipulations, for any feature vector x , we have an ordering of hypotheses according to their distances to x , which helps to infer the predictions of some hypotheses without implementing them. However, in non-ball manipulations, we don't have such structure anymore. Therefore, even in the simplest setting of observing x t before f t and ∆ t , we have the PAC sample complexity lower bounded by ˜ Ω( |H| ε ) .

Theorem 9. There exists a feature-manipulation set space Q and hypothesis class H s.t. SC x, ∆ ( ε, 7 8 ) = ˜ Ω( |H| ε ) .

The proof is deferred to Appendix J. It is worth noting that in the construction of the proof, we let all agents to have their original feature vector x t = 0 such that x t does not provide any information. Since ( x, ∆) is the simplest setting and any mistake bound can be converted to a PAC bound via standard techniques (see Section A.2 for more details), we have the following corollary.

Corollary 1. There exists a feature-manipulation set space Q and hypothesis class H s.t. for all choices of ( C, F ) , SC C,F ( ε, 7 8 ) = ˜ Ω( |H| ε ) and MB C,F = ˜ Ω( |H| ) .

6 Discussion and Open Problems

In this work, we investigate the mistake bound and sample complexity of strategic classification across multiple settings. Unlike prior work, we assume that the manipulation is personalized and unknown to the learner, which makes the strategic classification problem more challenging. In the case of ball manipulations, when the original feature vector x t is revealed prior to choosing f t , the problem exhibits a similar level of difficulty as the non-strategic setting (see Table 1 for details). However, when the original feature vector x t is not revealed beforehand, the problem becomes significantly more challenging. Specifically, any learner will experience a mistake bound that scales linearly with |H| , and any proper learner will face sample complexity that also scales linearly with |H| . In the case of non-ball manipulations, the situation worsens. Even in the simplest setting, where the original feature is observed before choosing f t and the manipulated feature is observed afterward, any learner will encounter a linear mistake bound and sample complexity.

Besides the question of optimal sample complexity in the setting of ( ⊥ , ∆) as mentioned in Sec 4.3, there are some other fundamental open questions.

Combinatorial measure Throughout this work, our main focus is on analyzing the dependency on the size of the hypothesis class |H| without assuming any specific structure of H . Just as VC dimension provides tight characterization for PAC learnability and Littlestone dimension characterizes online learnability, we are curious if there exists a combinatorial measure that captures the essence of strategic classification in this context. In the proofs of the most lower bounds in this work, we consider hypothesis class to be singletons, in which both the VC dimension and Littlestone dimension are 1 . Therefore, they cannot be candidates to characterize learnability in the strategic setting.

Agnostic setting We primarily concentrate on the realizable setting in this work. However, investigating the sample complexity and regret bounds in the agnostic setting would be an interesting avenue for future research.

References

Ahmadi, S., Beyhaghi, H., Blum, A., and Naggita, K. (2021). The strategic perceptron. In Proceedings of the 22nd ACM Conference on Economics and Computation , pages 6-25.

Ahmadi, S., Beyhaghi, H., Blum, A., and Naggita, K. (2022). On classification of strategic agents who can both game and improve. arXiv preprint arXiv:2203.00124 .

Ahmadi, S., Blum, A., and Yang, K. (2023). Fundamental bounds on online strategic classification. arXiv preprint arXiv:2302.12355 .

Bechavod, Y., Ligett, K., Wu, S., and Ziani, J. (2021). Gaming helps! learning from strategic interactions in natural dynamics. In International Conference on Artificial Intelligence and Statistics , pages 1234-1242. PMLR.

Brückner, M. and Scheffer, T. (2011). Stackelberg games for adversarial prediction problems. In Proceedings of the 17th ACM SIGKDD international conference on Knowledge discovery and data mining , pages 547-555.

Chen, Y., Liu, Y., and Podimata, C. (2020). Learning strategy-aware linear classifiers. Advances in Neural Information Processing Systems , 33:15265-15276.

Dalvi, N., Domingos, P., Sanghai, S., and Verma, D. (2004). Adversarial classification. In Proceedings of the tenth ACM SIGKDD international conference on Knowledge discovery and data mining , pages 99-108.

Dong, J., Roth, A., Schutzman, Z., Waggoner, B., and Wu, Z. S. (2018). Strategic classification from revealed preferences. In Proceedings of the 2018 ACM Conference on Economics and Computation , pages 55-70.

Gallant, S. I. (1986). Optimal linear discriminants. Eighth International Conference on Pattern Recognition , pages 849-852.

Haghtalab, N., Immorlica, N., Lucier, B., and Wang, J. Z. (2020). Maximizing welfare with incentiveaware evaluation mechanisms. arXiv preprint arXiv:2011.01956 .

Haghtalab, N., Lykouris, T., Nietert, S., and Wei, A. (2022). Learning in stackelberg games with non-myopic agents. In Proceedings of the 23rd ACM Conference on Economics and Computation , pages 917-918.

Hardt, M., Megiddo, N., Papadimitriou, C., and Wootters, M. (2016). Strategic classification. In Proceedings of the 2016 ACM conference on innovations in theoretical computer science , pages 111-122.

Hu, L., Immorlica, N., and Vaughan, J. W. (2019). The disparate effects of strategic manipulation. In Proceedings of the Conference on Fairness, Accountability, and Transparency , pages 259-268.

Jagadeesan, M., Mendler-Dünner, C., and Hardt, M. (2021). Alternative microfoundations for strategic classification. In International Conference on Machine Learning , pages 4687-4697. PMLR.

Kleinberg, J. and Raghavan, M. (2020). How do classifiers induce agents to invest effort strategically? ACM Transactions on Economics and Computation (TEAC) , 8(4):1-23.

Lechner, T. and Urner, R. (2022). Learning losses for strategic classification. In Proceedings of the AAAI Conference on Artificial Intelligence , volume 36, pages 7337-7344.

Lechner, T., Urner, R., and Ben-David, S. (2023). Strategic classification with unknown user manipulations.

Milli, S., Miller, J., Dragan, A. D., and Hardt, M. (2019). The social cost of strategic classification. In Proceedings of the Conference on Fairness, Accountability, and Transparency , pages 230-239.

Montasser, O., Hanneke, S., and Srebro, N. (2019). Vc classes are adversarially robustly learnable, but only improperly. In Conference on Learning Theory , pages 2512-2530. PMLR.

Rajaraman, N., Han, Y., Jiao, J., and Ramchandran, K. (2023). Beyond ucb: Statistical complexity and optimal algorithms for non-linear ridge bandits. arXiv preprint arXiv:2302.06025 .

Sundaram, R., Vullikanti, A., Xu, H., and Yao, F. (2021). Pac-learning for strategic classification. In International Conference on Machine Learning , pages 9978-9988. PMLR.

Zhang, H. and Conitzer, V. (2021). Incentive-aware pac learning. In Proceedings of the AAAI Conference on Artificial Intelligence , volume 35, pages 5797-5804.

Zrnic, T., Mazumdar, E., Sastry, S., and Jordan, M. (2021). Who leads and who follows in strategic classification? Advances in Neural Information Processing Systems , 34:15257-15269.

A Technical Lemmas

A.1 Boosting expected guarantee to high probability guarantee

Consider any (possibly randomized) PAC learning algorithm A in strategic setting, which can output a predictor A ( S ) after T steps of interaction with i.i.d. agents S ∼ D T s.t. E [ L str ( A ( S ))] ≤ ε , where the expectation is taken over both the randomness of S and the randomness of algorithm. One standard way in classic PAC learning of boosting the expected loss guarantee to high probability loss guarantee is: running A on new data S and verifying the loss of A ( S ) on a validation data set; if the validation loss is low, outputting the current A ( S ) , and repeating this process otherwise.

We will adopt this method to boost the confidence as well. The only difference in our strategic setting is that we can not re-use validation data set as we are only allowed to interact with the data through the interaction protocol. Our boosting scheme is described in the following.

For round r = 1 , . . . , R,

-Run A for T steps of interactions to obtain a predictor h r .

-Apply h r for the following m 0 rounds to obtain the empirical strategic loss on m 0 , denoted as ̂ l r = 1 m 0 ∑ t r + m 0 t = t r +1 ℓ str ( h r , ( x t , r t , y t )) , where t r +1 is the starting time of these m 0 rounds.

-Break and output h r if ̂ l r ≤ 4 ε .

If for all r ∈ [ R ] , ̂ l r > 4 ε , output an arbitrary hypothesis.

Lemma2. Given an algorithm A , which can output a predictor A ( S ) after T steps of interaction with i.i.d. agents S ∼ D T s.t. the expected loss satisfies E [ L str ( A ( S ))] ≤ ε . Let h A denote the output of the above boosting scheme given algorithm A as input. By setting R = log 2 δ and m 0 = 3 log(4 R/δ ) 2 ε , we have L str ( h A ) ≤ 8 ε with probability 1 -δ . The total sample size is R ( T + m 0 ) = O (log( 1 δ )( T + log(1 /δ ) ε )) .

Proof. For all r = 1 , . . . , R , we have E [ L str ( h r )] ≤ ε . By Markov's inequality, we have

For any fixed h r , if L str ( h r ) ≥ 8 ε , we will have ̂ l r ≤ 4 ε with probability ≤ e -m 0 ε ; if L str ( h r ) ≤ 2 ε , we will have ̂ l r ≤ 4 ε with probability ≥ 1 -e -2 m 0 ε/ 3 by Chernoff bound.

Let E denote the event of { ∃ r ∈ [ R ] , L str ( h r ) ≤ 2 ε } and F denote the event of { ̂ l r > 4 ε for all r ∈ [ R ] }. When F does not hold, our boosting will output h r for some r ∈ [ R ] .

by setting R = log 2 δ and m 0 = 3 log(4 R/δ ) 2 ε .

A.2 Converting mistake bound to PAC bound

In any setting of ( C, F ) , if there is an algorithm A that can achieve the mistake bound of B , then we can convert A to a conservative algorithm by not updating at correct rounds. The new algorithm can still achieve mistake bound of B as A still sees a legal sequence of examples. Given any conservative online algorithm, we can convert it to a PAC learning algorithm using the standard longest survivor technique (Gallant, 1986).

Lemma 3. In any setting of ( C, F ) , given any conservative algorithm A with mistake bound B , let algorithm A ′ run A and output the first f t which survives over 1 ε log( B δ ) examples. A ′ can achieve sample complexity of O ( B ε log( B δ )) .

Proof of Lemma 3. When the sample size m ≥ B ε log( B δ ) , the algorithm A will produce at most B different hypotheses and there must exist one surviving for 1 ε log( B δ ) rounds since A is a conservative algorithm with at most B mistakes. Let h 1 , . . . , h B denote these hypotheses and let t 1 , . . . , t B denote the time step they are produced. Then we have

By union bound, we have

We are done.

A.3 Smooth the distribution

Lemma 4. For any two data distribution D 1 and D 2 , let D 3 = (1 -p ) D 1 + p D 2 be the mixture of them. For any setting of ( C, F ) and any algorithm, let P D be the dynamics of ( C ( x 1 ) , f 1 , y 1 , ̂ y 1 , F ( x 1 , ∆ 1 ) , . . . , C ( x T ) , f T , y T , ̂ y T , F ( x T , ∆ T )) under the data distribution D . Then for any event A , we have | P D 3 ( A ) -P D 1 ( A ) | ≤ 2 pT .

Proof. Let B denote the event of all ( x t , u t , y t ) T t =1 being sampled from D 1 . Then P D 3 ( ¬ B ) ≤ pT . Then

By re-arranging terms, we have

B Proof of Theorem 1

Proof. When a mistake occurs, there are two cases.

If f t misclassifies a true positive example ( x t , r t , +1) by negative, we know that d ( x t , f t ) > r t while the target hypothesis h ∗ must satisfy that d ( x t , h ∗ ) ≤ r t . Then any h ∈ VS with d ( x t , h ) ≥ d ( x t , f t ) cannot be h ∗ and are eliminated. Since d ( x t , f t ) is the median of { d ( x t , h ) | h ∈ VS } , we can eliminate half of the version space.

If f t misclassifies a true negative example ( x t , r t , -1) by positive, we know that d ( x t , f t ) ≤ r t while the target hypothesis h ∗ must satisfy that d ( x t , h ∗ ) > r t . Then any h ∈ VS with d ( x t , h ) ≤ d ( x t , f t ) cannot be h ∗ and are eliminated. Since d ( x t , f t ) is the median of { d ( x t , h ) | h ∈ VS } , we can eliminate half of the version space.

Each mistake reduces the version space by half and thus, the algorithm of Strategic Halving suffers at most log 2 ( |H| ) mistakes.

C Proof of Theorem 2

Proof. In online learning setting, an algorithm is conservative if it updates it's current predictor only when making a mistake. It is straightforward to check that Strategic Halving is conservative. Combined with the technique of converting mistake bound to PAC bound in Lemma 3, we prove Theorem 2.

D Proof of Theorem 3

Proof. Consider the feature space X = { 0 , e 1 , . . . , e n , 0 . 9 e 1 , . . . , 0 . 9 e n } , where e i 's are standard basis vectors in R n and metric d ( x, x ′ ) = ∥ x -x ′ ∥ 2 for all x, x ′ ∈ X . Let the hypothesis class be a set of singletons over { e i | i ∈ [ n ] } , i.e., H = { 2 1 { e i } -1 | i ∈ [ n ] } . We divide all possible hypotheses (not necessarily in H ) into three categories:

The hypothesis 2 1 ∅ -1 , which predicts all negative.

For each x ∈ { 0 , 0 . 9 e 1 , . . . , 0 . 9 e n } , let F x, + denote the class of hypotheses h predicting x as positive.

For each i ∈ [ n ] , let F i denote the class of hypotheses h satisfying h ( x ) = -1 for all x ∈ { 0 , 0 . 9 e 1 , . . . , 0 . 9 e n } and h ( e i ) = +1 . And let F ∗ = ∪ i ∈ [ n ] F i denote the union of them.

Note that all hypotheses over X fall into one of the three categories.

Now we consider a set of adversaries E 1 , . . . , E n , such that the target function in the adversarial environment E i is 2 1 { e i } -1 . We allow the learners to be randomized and thus, at round t , the learner draws an f t from a distribution D ( f t ) over hypotheses. The adversary, who only knows the distribution D ( f t ) but not the realization f t , picks an agent ( x t , r t , y t ) in the following way.

Case 1: If there exists x ∈ { 0 , 0 . 9 e 1 , . . . , 0 . 9 e n } such that Pr f t ∼ D ( f t ) ( f t ∈ F x, + ) ≥ c for some c > 0 , then for all j ∈ [ n ] , the adversary E j picks ( x t , r t , y t ) = ( x, 0 , -1) . Let B t 1 ,x denote the event of f t ∈ F x, + .

-In this case, the learner will make a mistake with probability c . Since for all h ∈ H , h (∆( x, h, 0)) = h ( x ) = -1 , they are all consistent with ( x, 0 , -1) .

Case 2: If Pr f t ∼ D ( f t ) ( f t = 2 1 ∅ -1) ≥ c , then for all j ∈ [ n ] , the adversary E j picks ( x t , r t , y t ) = ( 0 , 1 , +1) . Let B t 2 denote the event of f t = 2 1 ∅ -1 .

-In this case, with probability c , the learner will sample a f t = 2 1 ∅ -1 and misclassify ( 0 , 1 , +1) . Since for all h ∈ H , h (∆( 0 , h, 1)) = +1 , they are all consistent with ( 0 , 1 , +1) .

̸

Case 3: If the above two cases do not hold, let i t = arg max i ∈ [ n ] Pr( f t ( e i ) = 1 | f t ∈ F ∗ ) , x t = 0 . 9 e i t . For radius and label, different adversaries set them differently. Adversary E i t will set ( r t , y t ) = (0 , -1) while other E j for j = i t will set ( r t , y t ) = (0 . 1 , -1) . Since Cases 1 and 2 do not hold, we have Pr f t ∼ D ( f t ) ( f t ∈ F ∗ ) ≥ 1 -( n +2) c . Let B t 3 denote the event of f t ∈ F ∗ and B t 3 ,i denote the event of f t ∈ F i .

̸

(a) With probability Pr( B t 3 ,i t ) ≥ 1 n Pr( B t 3 ) ≥ 1 -( n +2) c n , the learner samples a f t ∈ F i t , and thus misclassifies (0 . 9 e i t , 0 . 1 , -1) in E j for j = i t but correctly classifies (0 . 9 e i t , 0 , -1) . In this case, the learner observes the same feedback in all E j for j = i t and identifies the target function 2 1 { e i t } -1 in E i t .

̸

(b) If the learner samples a f t with f t ( e i t ) = f t (0 . 9 e i t ) = -1 , then the learner observes x t = 0 . 9 e i t , y t = -1 and ̂ y t = -1 in all E j for j ∈ [ n ] . Therefore the learner cannot distinguish between adversaries in this case.

(c) If the learner samples a f t with f t (0 . 9 e i t ) = +1 , then the learner observes x t = 0 . 9 e i t , y t = -1 and ̂ y t = +1 in all E j for j ∈ [ n ] . Again, since the feedback are identical in all E j and the learner cannot distinguish between adversaries in this case.

For any learning algorithm A , his predictions are identical in all of adversarial environments { E j | j ∈ [ n ] } before he makes a mistake in Case 3(a) in one environment E i t . His predictions in the following rounds are identical in all of adversarial environments { E j | j ∈ [ n ] } \ { E i t } before he makes another mistake in Case 3(a). Suppose that we run A in all adversarial environment of { E j | j ∈ [ n ] } simultaneously. Note that once we make a mistake, the mistake must occur simultaneously in at least n -1 environments. Specifically, if we make a mistake in Case 1, 2 or 3(c), such a mistake simultaneously occur in all n environments. If we make a mistake in Case 3(a), such a mistake simultaneously occur in all n environments except E i t . Since we will make a mistake with probability at least min( c, 1 -( n +2) c n ) at each round, there exists one environment in { E j | j ∈ [ n ] } in which A will make n -1 mistakes.

Now we lower bound the number of mistakes dependent on T . Let t 1 , t 2 , . . . denote the time steps in which we makes a mistake. Let t 0 = 0 for convenience. Now we prove that

by setting c = 1 2( n +2) . Then by letting k = 2( n +2)ln( n/δ ) , we have

Therefore, we have proved that for any T , with probability at least 1 -δ , we will make at least min( T 2( n +2)ln( n/δ )+1 , n -1) mistakes.

E Proof of Theorem 4

Algorithm 3 MWMR(Multiplicative Weights on Mistake Rounds)

1: Initialize the version space VS = H .

2: for t=1,. . . ,T do

3: Pick one hypotheses f t from VS uniformly at random.

̸

4: if y t = y t and y t = + then

̂ 5: VS ← VS \ { h ∈ VS | d ( x t , h ) ≥ d ( x t , f t ) } .

̸

6: else if y t = y t and y t = -then

̂ 7: VS ← VS \ { h ∈ VS | d ( x t , h ) ≤ d ( x t , f t ) } .

8: end if

9: end for

Proof. First, when the algorithm makes a mistake at round t , he can at least eliminate f t . Therefore, the total number of mistakes will be upper bounded by |H| 1 .

Let p t denote the fraction of hypotheses misclassifying x t . We say a hypothesis h is inconsistent with ( x t , f t , y t , ̂ y t ) iff ( d ( x t , h ) ≥ d ( x t , f t ) ∧ ̂ y t = -∧ y t = +) or ( d ( x t , h ) ≤ d ( x t , f t ) ∧ ̂ y t = + ∧ y t = -) . Then we define the following events.

For any T ,

E t denotes the event that MWMR makes a mistake at round t . We have Pr( E t ) = p t .

B t denotes the event that at least p t 2 fraction of hypotheses are inconsistent with ( x t , f t , y t , ̂ y t ) . We have Pr( B t | E t ) ≥ 1 2 .

Let n = |H| denote the cardinality of hypothesis class and n t denote the number of hypotheses in VS after round t . Then we have

By taking logarithm of both sides, we have

where the last inequality adopts ln(1 -x ) ≤ -x for x ∈ [0 , 1) . Then by taking expectation of both sides, we have

Since Pr( E t ) = p t and Pr( B t | E t ) ≥ 1 2 , then we have

Then we have the expected number of mistakes E [ M MWMR ( T )] as

where the first inequality applies Cauchy-Schwarz inequality.

F Proof of Theorem 5

Proof. Construction of Q , H and a set of realizable distributions

̸

Let feature space X = { 0 , e 1 , . . . , e n } ∪ X 0 , where X 0 = { σ (0 , 1 ,...,n -1) z | σ ∈ S n } with z = √ 1 2 + ... +( n -1) 2 α for some small α = 0 . 1 . Here S n is the set of all permutations over n elements. So X 0 is the set of points whose coordinates are a permutation of { 0 , 1 /z, . . . , ( n -1) /z } and all points in X 0 have the ℓ 2 norm equal to α . Define a metric d by letting d ( x 1 , x 2 ) = ∥ x 1 -x 2 ∥ 2 for all x 1 , x 2 ∈ X . Then for any x ∈ X 0 and i ∈ [ n ] , d ( x, e i ) = ∥ x -e i ∥ 2 = √ ( x i -1) 2 + ∑ j = i x 2 j = √ 1 + ∑ n j =1 x 2 j -2 x i = √ 1 + α 2 -2 x i . Note that we consider space ( X , d ) rather than ( R n , ∥·∥ 2 ) .

Let the hypothesis class be a set of singletons over { e i | i ∈ [ n ] } , i.e., H = { 2 1 { e i } -1 | i ∈ [ n ] } .

̸

Wenowdefine a collection of distributions {D i | i ∈ [ n ] } in which D i is realized by 2 1 { e i } -1 . For any i ∈ [ n ] , D i puts probability mass 1 -3 nε on ( 0 , 0 , -1) . For the remaining 3 nε probability mass, D i picks x uniformly at random from X 0 and label it as positive. If x i = 0 , set radius r ( x ) = r u := √ 1 + α 2 ; otherwise, set radius r ( x ) = r l := √ 1 + α 2 -2 · 1 z ) . Hence, X 0 are all labeled as positive. For j = i , h j = 2 1 { e j } -1 labels { x ∈ X 0 | x j = 0 } negative since r ( x ) = r l and d ( x, h j ) = r u > r ( x ) . Therefore, L str ( h j ) = 1 n · 3 nε = 3 ε . To output f out ∈ H , we must identify the true target function.

Information gain from different choices of f t Let h ∗ = 2 1 { e i ∗ } -1 denote the target function. Since ( 0 , 0 , -1) is realized by all hypotheses, we can only gain information about the target function when x t ∈ X 0 . For any x t ∈ X 0 , if d ( x t , f t ) ≤ r l or d ( x t , f t ) > r u , we cannot learn anything about the target function. In particular, if d ( x t , f t ) ≤ r l , the learner will observe x t ∼ Unif( X 0 ) , y t = +1 , ̂ y t = +1 in all {D i | i ∈ [ n ] } . If d ( x t , f t ) > r u , the learner will observe x t ∼ Unif( X 0 ) , y t = +1 , ̂ y t = -1 in all {D i | i ∈ [ n ] } . Therefore, we cannot obtain any information about the target function.

Now for any x t ∈ X 0 , with the i t -th coordinate being 0 , we enumerate the distance between x and x ′ for all x ′ ∈ X .

For all x ′ ∈ X 0 , d ( x, x ′ ) ≤ ∥ x ∥ + ∥ x ′ ∥ ≤ 2 α < r l ;

̸

For all j = i t , d ( x, e j ) = √ 1 + α 2 -2 x j ≤ r l ;

d ( x, e i t ) = r u ;

d ( x, 0 ) = α < r l .

Only f t = 2 1 { e i t } -1 satisfies that r l < d ( x t , f t ) ≤ r u and thus, we can only obtain information when f t = 2 1 { e i t } -1 . And the only information we learn is whether i t = i ∗ because if i t = i ∗ , no matter which i ∗ is, our observation is identical. If i t = i ∗ , we can eliminate 2 1 { e i t } -1 .

̸

̸

Sample size analysis For any algorithm A , his predictions are identical in all environments {D i | i ∈ [ n ] } before a round t in which f t = 2 1 { e i t } -1 . Then either he learns i t in D i t or he eliminates 2 1 { e i t } -1 and continues to perform the same in the other environments {D i | i = i t } . Suppose that we run A in all stochastic environments {D i | i ∈ [ n ] } simultaneously. When we identify i t in environment D i t , we terminate A in D i t . Consider a good algorithm A which can identify i in D i with probability 7 8 after T rounds of interaction for each i ∈ [ n ] , that is,

̸

̸

Let n T denote the number of environments that have been terminated by the end of round T . Let B t denote the event of x t being in X 0 and C t denote the event of f t = 2 1 { e i t } -1 . Then we have Pr( B t ) = 3 nε and Pr( C t | B t ) = 1 n , and thus Pr( B t ∧ C t ) = 3 nε · 1 n . Since at each round, we can eliminate one environment only when B t ∧ C t is true, then we have

Therefore, by setting T = ⌊ n 2 ⌋ -1 6 ε and Markov's inequality, we have

When there are ⌈ n 2 ⌉ +1 environments remaining, the algorithm has to pick one i out , which fails in at least ⌈ n 2 ⌉ of the environments. Then we have

̸

which conflicts with Eq (4). Therefore, for any algorithm A , to achieve Eq (3), it requires T ≥ ⌊ n 2 ⌋ -1 6 ε .

Therefore, we have

̸

G Proof of Theorem 6

Given Lemma 1, we can upper bound the expected strategic loss, then we can boost the confidence of the algorithm through the scheme in Section A.1. Theorem 6 follows by combining Lemma 1 and Lemma 2. Now we only need to prove Lemma 1.

Proof of Lemma 1. For any set of hypotheses H , for every z = ( x, r, y ) , we define

So κ p ( H,z ) is the number of hypotheses mislabeling z for positive z 's and 0 for negative z 's. Similarly, we define κ n as follows,

So κ n ( H,z ) is the number of hypotheses mislabeling z for negative z 's and 0 for positive z 's.

In the following, we divide the proof into two parts. First, recall that in Algorithm 2, the output is constructed by randomly sampling two hypotheses with replacement and taking the union of them. We represent the loss of such a random predictor using κ p ( H,z ) and κ n ( H,z ) defined above. Then we show that whenever the algorithm makes a mistake, with some probability, we can reduce κ p (VS t -1 ,z t ) 2 or κ n (VS t -1 ,z t ) 2 hypotheses and utilize this to provide a guarantee on the loss of the final output.

Upper bounds on the strategic loss For any hypothesis h , let fpr( h ) and fnr( h ) denote the false positive rate and false negative rate of h respectively. Let p + denote the probability of drawing a positive sample from D , i.e., Pr ( x,r,y ) ∼D ( y = +) and p -denote the probability of drawing a negative sample from D . Let D + and D -denote the data distribution conditional on that the label is positive and that the label is negative respectively. Given any set of hypotheses H , we define a random predictor R 2( H ) = h 1 ∨ h 2 with h 1 , h 2 randomly picked from H with replacement. For a true positive z , R 2( H ) will misclassify it with probability κ p ( H,z ) 2 | H | 2 . Then we can find that the false negative rate of R 2( H ) is

.

Similarly, for a true negative z , R 2( H ) will misclassify it with probability 1 -(1 -κ n ( H,z ) | H | ) 2 ≤ 2 κ n ( H,z ) | H | . Then the false positive rate of R 2( H ) is

Hence the loss of R 2( H ) is

where the last equality holds since κ p ( H,z ) = 0 for true negatives and κ n ( H,z ) = 0 for true positives.

Loss analysis In each round, the data z t = ( x t , r t , y t ) is sampled from D . When the label y t is positive, if the drawn f t satisfying that 1) f t (∆( x t , f t , r t )) = -and 2) d ( x t , f t ) ≤ median ( { d ( x t , h ) | h ∈ VS t -1 , h (∆( x t , h, r t )) = -} ) , then we are able to remove κ p (VS t -1 ,z t ) 2 hypotheses from the version

space. Let E p,t denote the event of f t satisfying the conditions 1) and 2). With probability 1 ⌊ log 2 ( n t ) ⌋ , we sample k t = 1 . Then we sample an f t ∼ Unif(VS t -1 ) . With probability κ p (VS t -1 ,z t ) 2 n t , the sampled f t satisfies the two conditions. So we have

The case of y t being negative is similar to the positive case. Let E n,t denote the event of f t satisfying that 1) f t (∆( x t , f t , r t )) = + and 2) d ( x t , f t ) ≥ median ( { d ( x t , h ) | h ∈ VS t -1 , h (∆( x t , h, r t )) = + } ) . If κ n (VS t -1 , z t ) ≥ n t 2 , then with probability 1 ⌊ log 2 ( n t ) ⌋ , we sample k t = 1 . Then with probability greater than 1 4 we will sample an f t satisfying that 1) f t (∆( x t , f t , r t )) = + and 2) d ( x t , f t ) ≥ median ( { d ( x t , h ) | h ∈ VS t -1 , h (∆( x t , h, r t )) = + } ) . If κ n (VS t -1 , z t ) < n t 2 , then with probability 1 ⌊ log 2 ( n t ) ⌋ , we sampled a k t satisfying

Then we randomly sample k t hypotheses and the expected number of sampled hypotheses which mislabel z t is k t · κ n (VS t -1 ,z t ) n t ∈ ( 1 4 , 1 2 ] . Let g t (given the above fixed k t ) denote the number of sampled hypotheses which mislabel x t and we have E [ g t ] ∈ ( 1 4 , 1 2 ] . When g t > 0 , f t will misclassify z t by positive. We have

and by Markov's inequality, we have

Thus Pr( g t ∈ { 1 , 2 } ) ≥ 0 . 05 . Conditional on g t is either 1 or 2 , with probability ≥ 1 4 , all of these g t hypotheses h ′ satisfies d ( x t , h ′ ) ≥ median ( { d ( x t , h ) | h ∈ VS t -1 , h (∆( x t , h, r t )) = + } ) , which implies that d ( x t , f t ) ≥ median ( { d ( x t , h ) | h ∈ VS t -1 , h (∆( x t , h, r t )) = + } ) . Therefore, we have

Let v t denote the fraction of hypotheses we eliminated at round t , i.e., v t = 1 -n t +1 n t . Then we have

Since n t +1 = n t (1 -v t ) , we have

Combined with Eq (8), we have

By taking logarithm of both sides, we have

where we use ln(1 -x ) ≤ -x for x ∈ [0 , 1) in the last inequality. By re-arranging terms, we have

By taking expectation w.r.t. the randomness of f 1: T and dataset S = z 1: T on both sides, we have

Since the t -th term does not depend on f t +1: T , z t +1: T and VS t -1 is determined by z 1: t -1 and f 1: t -1 , the t -th term becomes

where Eq (9) holds due to that VS t -1 is determined by f 1: t -1 , z 1: t -1 and does not depend on f t and Eq (10) holds since Pr f t ( E p,t | f 1: t -1 , z 1: t ) = Pr f t ( E p,t | VS t -1 , z t ) ≥ 1 log 2 ( n t ) κ p (VS t -1 ,z t ) 2 n t by Eq (6) and Pr f t ( E n,t | f 1: t -1 , z 1: t ) = Pr f t ( E n,t | VS t -1 , z t ) ≥ 1 80 log 2 ( n t ) by Eq (7). Thus, we have

Since z t ∼ D and z t is independent of z 1: t -1 and f 1: t -1 , thus, we have the t -th term on the LHS being

where the last inequality adopts Eq (5). By summing them up and re-arranging terms, we have

For the output of Algorithm 2, which randomly picks τ from [ T ] , randomly samples h 1 , h 2 from VS τ -1 with replacement and outputs h 1 ∨ h 2 , the expected loss is

when T ≥ 320 log 2 ( n ) ln( n ) ε .

Post proof discussion of Lemma 1

Upon first inspection, readers might perceive a resemblance between the proof of the loss analysis section and the standard proof of converting regret bound to error bound.This standard proof converts a regret guarantee on f 1: T to an error guarantee of 1 T ∑ T t =1 f t . However, in this proof, the predictor employed in each round is f t , while the output is an average over R 2(VS t -1 ) for all t ∈ [ T ] . Our algorithm does not provide a regret guarantee on f 1: T .

Please note that our analysis exhibits asymmetry regarding losses on true positives and true negatives. Specifically, the probability of identifying and reducing half of the misclassifying hypotheses on true positives, denoted as Pr( E p,t | z t , VS t -1 ) (Eq (6)), is lower than the corresponding probability for true negatives, Pr( E n,t | z t , VS t -1 ) (Eq (7)). This discrepancy arises due to the different levels of difficulty in detecting misclassifying hypotheses. For example, if there is exactly one hypothesis h misclassifying a true positive z t = ( x t , r t , y t ) , it is very hard to detect this h . We must select an f t satisfying that d ( x t , f t ) > d ( x t , h ′ ) for all h ′ ∈ H \ { h } (hence f t will make a mistake), and that d ( x t , f t ) ≤ d ( x t , h ) (so that we will know h misclassifies z t ). Algorithm 2 controls the distance d ( x t , f t ) through k t , which is the number of hypotheses in the union. In this case, we can only detect h when k t = 1 and f t = h , which occurs with probability 1 n t log( n t ) .

However, if there is exactly one hypothesis h misclassifying a true negative z t = ( x t , r t , y t ) , we have that d ( x t , h ) = min h ′ ∈H d ( x t , h ′ ) . Then by setting f t = ∨ h ∈H h , which will makes a mistake and tells us h is a misclassifying hypothesis. Our algorithm will pick such an f t with probability 1 log( n t ) .

H Proof of Theorem 7

Proof. We will prove Theorem 7 by constructing an instance of Q and H and showing that for any conservative learning algorithm, there exists a realizable data distribution s.t. achieving ε loss requires at least ˜ Ω( |H| ε ) samples.

Construction of Q , H and a set of realizable distributions

Let the input metric space ( X , d ) be constructed in the following way. Consider the feature space X = { e 1 , . . . , e n } ∪ X 0 , where X 0 = { σ (0 , 1 ,...,n -1) z | σ ∈ S n } with z = √ 1 2 + ... +( n -1) 2 α for some small α = 0 . 1 . Here S n is the set of all permutations over n elements. So X 0 is the set of points whose coordinates are a permutation of { 0 , 1 /z, . . . , ( n -1) /z } and all points in X 0 have the ℓ 2 norm equal to α . We define the metric d by restricting ℓ 2 distance to X , i.e., d ( x 1 , x 2 ) = ∥ x 1 -x 2 ∥ 2 for all x 1 , x 2 ∈ X . Then we have that for any x ∈ X 0 and i ∈ [ n ] , the distance between x and e i is

̸

which is greater than √ 1 + α 2 -2 α > 0 . 8 > 2 α . For any two points x, x ′ ∈ X 0 , d ( x, x ′ ) ≤ 2 α by triangle inequality.

Let the hypothesis class be a set of singletons over { e i | i ∈ [ n ] } , i.e., H = { 2 1 { e i } -1 | i ∈ [ n ] } .

Wenowdefine a collection of distributions {D i | i ∈ [ n ] } in which D i is realized by 2 1 { e i } -1 . For any i ∈ [ n ] , we define D i in the following way. Let the marginal distribution D X over X be uniform over X 0 . For any x , the label y is + with probability 1 -6 ε and -with probability 6 ε , i.e., D ( y | x ) = Rad(1 -6 ε ) . Note that the marginal distribution D X×Y = Unif( X 0 ) × Rad(1 -6 ε ) is identical for any distribution in {D i | i ∈ [ n ] } and does not depend on i .

If the label is positive y = + , then let the radius r = 2 . If the label is negative y = -, then let r = √ 1 + α 2 -2( x i + 1 z ) , which guarantees that x can be manipulated to e j iff d ( x, e j ) < d ( x, e i ) for all j ∈ [ n ] . Since x i ≤ α and 1 z ≤ α , we have √ 1 + α 2 -2( x i + 1 z ) ≥ √ 1 -4 α > 2 α . Therefore, for both positive and negative examples, we have radius r strictly greater than 2 α in both cases.

Randomization and improperness of the output f out do not help Note that algorithms are allowed to output a randomized f out and to output f out / ∈ H . We will show that randomization and improperness of f out don't make the problem easier. That is, supposing that the data distribution is D i ∗ for some i ∗ ∈ [ n ] , finding a (possibly randomized and improper) f out is not easier than identifying i ∗ . Since our feature space X is finite, we can enumerate all hypotheses not equal to 2 1 { e i ∗ } -1 and calculate their strategic population loss as follows.

2 1 ∅ -1 predicts all negative and thus L str (2 1 ∅ -1) = 1 -6 ε ;

̸

For any a ⊂ X s.t. a ∩ X 0 = ∅ , 2 1 a -1 will predict any point drawn from D i ∗ as positive (since all points have radius greater than 2 α and the distance between any two points in X 0 is smaller than 2 α ) and thus L str (2 1 a -1) = 6 ε ;

̸

For any a ⊂ { e 1 , . . . , e n } satisfying that ∃ i = i ∗ , e i ∈ a , we have L str (2 1 a -1) ≥ 3 ε . This is due to that when y = -, x is chosen from Unif( X 0 ) and the probability of d ( x, e i ) < d ( x, e i ∗ ) is 1 2 . When d ( x, e i ) < d ( x, e i ∗ ) , 2 1 a -1 will predict x as positive.

̸

Under distribution D i ∗ , if we are able to find a (possibly randomized) f out with strategic loss of L str ( f out ) ≤ ε , then we have L str ( f out ) = E h ∼ f out [ L str ( h )] ≥ Pr h ∼ f out ( h = 2 1 { e i ∗ } -1) · 3 ε . Thus, Pr h ∼ f out ( h = 2 1 { e i ∗ } -1) ≥ 2 3 . Hence, if we are able to find a (possibly randomized) f out with ε error, then we are able to identify i ∗ by checking which realization of f out has probability greater than 2 3 . In the following, we will focus on the sample complexity to identify i ∗ . Let i out denote the algorithm's answer to question 'what is i ∗ ?'.

Conservative algorithms When running a conservative algorithm, the rule of choosing f t at round t and choosing the final output f out does not depend on the correct rounds, i.e. { τ ∈ [ T ] | ̂ y τ = y τ } . Let's define

̸

where ⊥ is just a symbol representing 'no information'. Then for any conservative algorithm, the selected predictor f t is determined by ( f τ , ̂ y τ , y τ , ∆ ′ τ ) for τ < t and the final output f out is determined by ( f t , ̂ y t , y t , ∆ ′ t ) T t =1 . From now on, we consider ∆ ′ t as the feedback in the learning process of a conservative algorithm since it make no difference from running the same algorithm with feedback ∆ t .

Smooth the data distribution For technical reasons (appearing later in the analysis), we don't want to analyze distribution {D i | i ∈ [ n ] } directly as the probability of ∆ t = e i is 0 when f t ( e i ) = +1 under distribution D i . Instead, we consider the mixture of D i and another distribution D ′′ i , which is identical to D i except that r ( x ) = d ( x, e i ) when y = -. More specifically, let D ′ i = (1 -p ) D i + p D ′′ i with some extremely small p , where D ′′ i 's marginal distribution over X × Y is still Unif( X 0 ) × Rad(1 -6 ε ) ; the radius is r = 2 when y = + , ; and the radius is r = d ( x, e i ) when y = -. For any data distribution D , let P D be the dynamics of ( f 1 , y 1 , ̂ y 1 , ∆ ′ 1 , . . . , f T , y T , ̂ y T , ∆ ′ T ) under D . According to Lemma 4, by setting p = ε 16 n 2 , when T ≤ n ε , with high probability we never sample from D ′′ i and have that for any i, j ∈ [ n ]

From now on, we only consider distribution D ′ i instead of D i . The readers might have the question that why not using D ′ i for construction directly. This is because D ′ i does not satisfy realizability and no hypothesis has zero loss under D ′ i .

Information gain from different choices of f t In each round of interaction, the learner picks a predictor f t , which can be out of H . Here we enumerate all choices of f t .

f t ( · ) = 2 1 ∅ -1 predicts all points in X by negative. No matter what i ∗ is, we will observe (∆ t = x t , y t ) ∼ Unif( X 0 ) × Rad(1 -6 ε ) and ̂ y t = -. They are identically distributed for all i ∗ ∈ [ n ] , and thus, ∆ ′ t is also identically distributed. We cannot tell any information of i ∗ from this round.

̸

f t = 2 1 a t -1 for some a t ⊂ X s.t. a ∩ X 0 = ∅ . Then ∆ t = ∆( x t , f t , r t ) = ∆( x t , f t , 2 α ) since r t > 2 α and d ( x t , f t ) ≤ 2 α , ̂ y t = + , y t ∼ Rad(1 -6 ε ) . None of these depends on i ∗ and again, the distribution of ( ̂ y t , y t , ∆ ′ t ) is identical for all i ∗ and we cannot tell any information of i ∗ from this round.

f t = 2 1 a t -1 for some non-empty a t ⊂ { e 1 , . . . , e n } . For rounds with y t = + , we have ̂ y t = + and ∆ t = ∆( x t , f t , 2) , which still not depend on i ∗ . Thus we cannot learn any information about i ∗ . But we can learn when y t = -. For rounds with y t = -, if ∆ t ∈ a t , then we could observe ̂ y t = + and ∆ ′ t = ∆ t , which at least tells that 2 1 { ∆ t } -1 is not the target function (with high probability); if ∆ t / ∈ a t , then ̂ y t = -and we observe ∆ ′ t = ⊥ .

Therefore, we only need to focus on the rounds with f t = 2 1 a t -1 for some non-empty a t ⊂ { e 1 , . . . , e n } and y t = -. It is worth noting that drawing an example x from X 0 uniformly, it is equivalent to uniformly drawing a permutation of H such that the distances between x and h over all h ∈ H are permuted according to it. Then ∆ t = e j iff e j ∈ a t , d ( x, e j ) ≤ d ( x, e i ∗ ) and d ( x, e j ) ≤ d ( x, e l ) for all e l ∈ a t . Let k t = | a t | denote the cardinality of a t . In such rounds, under distribution D ′ i ∗ , the distribution of ∆ ′ t are described as follows.

The case of e i ∗ ∈ a t : For all j ∈ a t \ { i ∗ } , with probability 1 k t , d ( x t , e j ) = min e l ∈ a t d ( x t , e l ) and thus, ∆ ′ t = ∆ t = e j and ̂ y t = + (mistake round). With probability 1 k t , we have d ( x t , e i ∗ ) = min e l ∈ a t d ( x t , e l ) . If the example is drawn from D i ∗ , we have ∆ t = x t and y t = -(correct round), thus ∆ ′ t = ⊥ . If the example is drawn from D ′′ i ∗ , we have we have ∆ ′ t = ∆ t = e i ∗ and y t = + (mistake round). Therefore, according to the definition of ∆ ′ t (Eq (11)), we have

̸

We denote this distribution by P ∈ ( a t , i ∗ ) .

The case of e i ∗ / ∈ a t : For all j ∈ a t , with probability 1 k t +1 , then d ( x t , e j ) = min e l ∈ a t ∪{ e i ∗ } d ( x t , e l ) and thus, ∆ t = e j and ̂ y t = + (mistake round). With probability 1 k t +1 , we have d ( x, e i ∗ ) < min e l ∈ a t d ( x t , e l ) and thus, ∆ t = x t , ̂ y t = -(correct round), and ∆ ′ t = ⊥ . Therefore, the distribution of ∆ ′ t is

We denote this distribution by P / ∈ ( a t ) .

To measure the information obtained from ∆ ′ t , we will utilize the KL divergence of the distribution of ∆ ′ t under the data distribution D i ∗ from that under a benchmark distribution. Let D = 1 n ∑ i ∈ n D ′ i denote the average distribution. The process of sampling from D is equivalent to sampling i ∗ uniformly at random from [ n ] first and drawing a sample from D i ∗ . Then under D , for any e j ∈ a t , we have

and

Thus, the distribution of ∆ ′ t under D is

We denote this distribution by P ( a t ) . Next we will compute the KL divergences of P ∈ ( a t , i ∗ ) and P / ∈ ( a t ) from P ( a t ) . We will use the inequality log(1+ x ) ≤ x for x ≥ 0 in the following calculation. For any i ∗ s.t. e i ∗ ∈ a t , we have

and

Lower bound of the information We utilize the information theoretical framework of proving lower bounds for linear bandits (Theorem 11 by Rajaraman et al. (2023)) here. For notation simplicity, for all i ∈ [ n ] , let P i denote the dynamics of ( f 1 , ∆ ′ 1 , y 1 , ̂ y 1 , . . . , f T , ∆ ′ T , y T , ̂ y T ) under D ′ i and P denote the dynamics under D . Let B t denote the event of { f t = 2 1 a t -1 for some non-empty a t ⊂ { e 1 , . . . , e n }} . As discussed before, for any a t , conditional on ¬ B t or y t = +1 , (∆ ′ t , y t , ̂ y t ) are identical in all {D ′ i | i ∈ [ n ] } , and therefore, also identical in D . We can only obtain information at rounds when B t ∧ ( y t = -1) occurs. In such rounds, we know that f t is fully determined by history (possibly with external randomness , which does not depend on data distribution), y t = -1 and ̂ y t is fully determined by ∆ ′ t ( ̂ y t = +1 iff. ∆ ′ t ∈ a t ).

Therefore, conditional the history H t -1 = ( f 1 , ∆ ′ 1 , y 1 , ̂ y 1 , . . . , f t -1 , ∆ ′ t -1 , y t -1 , ̂ y t -1 ) before time t , we have

where the last equality holds due to that y t ∼ Rad(1 -6 ε ) and does not depend on B t .

Then we have

Combining with Eq (16), we have that there exists a universal constant c such that T ≥ cn ε (log( n/ε )+1) .

I Proof of Theorem 8

Proof. We will prove Theorem 8 by constructing an instance of Q and H and then reduce it to a linear stochastic bandit problem.

Construction of Q , H and a set of realizable distributions

Consider the input metric space in the shape of a star, where X = { 0 , 1 , . . . , n } and the distance function of d (0 , i ) = 1 and d ( i, j ) = 2 for all i = j ∈ [ n ] .

̸

Let the hypothesis class be a set of singletons over [ n ] , i.e., H = { 2 1 { i } -1 | i ∈ [ n ] } .

̸

For any algorithm that can successfully identify i under the data distribution D i with probability 3 4 for all i ∈ [ n ] , then P D i ( i out = i ) ≥ 3 4 and P D j ( i out = i ) ≤ 1 4 for all j = i . Recall that D i and D ′ i are very close when the mixture parameter p is small. Combining with Eq (12), we have

Then we have the total variation distance between P i and P j

̸

We define a collection of distributions {D i | i ∈ [ n ] } in which D i is realized by 2 1 { i } -1 . The data distribution D i put 1 -3( n -1) ε on (0 , 1 , +) and 3 ε on ( i, 1 , -) for all i = i ∗ . Hence, note that all distributions in {D i | i ∈ [ n ] } share the same distribution support { (0 , 1 , +) } ∪ { ( i, 1 , -) | i ∈ [ n ] } , but have different weights.

̸

̸

Randomization and improperness of the output f out do not help. Note that algorithms are allowed to output a randomized f out and to output f out / ∈ H . We will show that randomization and improperness of f out don't make the problem easier. Supposing that the data distribution is D i ∗ for some i ∗ ∈ [ n ] , finding a (possibly randomized and improper) f out is not easier than identifying i ∗ . Since our feature space X is finite, we can enumerate all hypotheses not equal to 2 1 { i ∗ } -1 and calculate their strategic population loss as follows. The hypothesis 2 1 ∅ -1 will predict all by negative and thus L str (2 1 ∅ -1) = 1 -3( n -1) ε . For any hypothesis predicting 0 by positive, it will predict all points in the distribution support by positive and thus incurs strategic loss 3( n -1) ε . For any hypothesis predicting 0 by negative and some i = i ∗ by positive, then it will misclassify ( i, 1 , -) and incur strategic loss 3 ε . Therefore, for any hypothesis h = 2 1 { i ∗ } -1 , we have L str D i ∗ ( h ) ≥ 3 ε .

Similar to the proof of Theorem 7, under distribution D i ∗ , if we are able to find a (possibly randomized) f out with strategic loss L str ( f out ) ≤ ε . Then Pr h ∼ f out ( h = 2 1 { i ∗ } -1) ≥ 2 3 . We can identify i ∗ by checking which realization of f out has probability greater than 2 3 . In the following, we will focus on the sample complexity to identify the target function 2 1 { i ∗ } -1 or simply i ∗ . Let i out denote the algorithm's answer to question of 'what is i ∗ ?'.

Smooth the data distribution For technical reasons (appearing later in the analysis), we don't want to analyze distribution {D i | i ∈ [ n ] } directly as the probability of ( i, 1 , -) is 0 under distribution D i . Instead, for each i ∈ [ n ] , let D ′ i = (1 -p ) D i + p D ′′ i be the mixture of D i and D ′′ i for some small p , where D ′′ i = (1 -3( n -1) ε ) 1 { (0 , 1 , +) } +3( n -1) ε 1 { ( i, 1 , -) } . Specifically,

̸

For any data distribution D , let P D be the dynamics of ( f 1 , y 1 , ̂ y 1 , . . . , f T , y T , ̂ y T ) under D . According to Lemma 4, by setting p = ε 16 n 2 , when T ≤ n ε , we have that for any i, j ∈ [ n ]

From now on, we only consider distribution D ′ i instead of D i . The readers might have the question that why not using D ′ i for construction directly. This is because no hypothesis has zero loss under D ′ i , and thus D ′ i does not satisfy realizability requirement.

Information gain from different choices of f t Note that in each round, the learner picks a f t and then only observes ̂ y t and y t . Here we enumerate choices of f t as follows.

f t = 2 1 ∅ -1 predicts all points in X by negative. No matter what i ∗ is, we observe ̂ y t = -and y t = 2 1 ( x t = 0) -1 . Hence ( ̂ y t , y t ) are identically distributed for all i ∗ ∈ [ n ] , and thus, we cannot learn anything about i ∗ from this round.

f t predicts 0 by positive. Then no matter what i ∗ is, we have ̂ y t = + and y t = 1 ( x t = 0) . Thus again, we cannot learn anything about i ∗ .

̸

f t = 2 1 a t -1 for some non-empty a t ⊂ [ n ] . For rounds with x t = 0 , we have ̂ y t = y t = + no matter what i ∗ is and thus, we cannot learn anything about i ∗ . For rounds with y t = -, i.e., x t = 0 , we will observe ̂ y t = f t (∆( x t , f t , 1)) = 1 ( x t ∈ a t ) .

̸

Hence, we can only extract information with the third type of f t at rounds with x t = 0 .

̸

Reduction to stochastic linear bandits In rounds with f t = 2 1 a t -1 for some non-empty a t ⊂ [ n ] and x t = 0 , our problem is identical to a stochastic linear bandit problem. Let us state our problem as Problem 1 and a linear bandit problem as Problem 2. Let A = { 0 , 1 } n \ { 0 } .

̸

Problem 1. The environment picks an i ∗ ∈ [ n ] . At each round t , the environment picks x t ∈ { e i | i ∈ [ n ] } with P ( i ) = 1 -p n -1 for i = i ∗ and P ( i ∗ ) = p and the learner picks an a t ∈ A (where we use a n -bit string to represent a t and a t,i = 1 means that a t predicts i by positive). Then the learner observes ̂ y t = 1 ( a ⊺ t x t > 0) (where we use 0 to represent nagative label).

Problem 2. The environment picks a linear parameter w ∗ ∈ { w i | i ∈ [ n ] } with w i = 1 -p n -1 1 -( 1 -p n -1 -p ) e i . The arm set is A . For each arm a ∈ A , the reward is i.i.d. from the following distribution:

If the linear parameter w ∗ = w i ∗ , the optimal arm is e i ∗ .

Claim 1. For any δ > 0 , for any algorithm A that identify i ∗ correctly with probability 1 -δ within T rounds for any i ∗ ∈ [ n ] in Problem 1, we can construct another algorithm A ′ can also identify the optimal arm in any environment with probability 1 -δ within T rounds in Problem 2.

This claim follows directly from the problem descriptions. Given any algorithm A for Problem 1, we can construct another algorithm A ′ which simulates A . At round t , if A selects predictor a t , then A ′ picks arm the same as a t . Then A ′ observes a reward r w i ∗ ( a t ) , which is -1 w.p. w i ∗ ⊺ a t and feed -r w i ∗ ( a t ) to A . Since ̂ y t in Problem 1 is 1 w.p. ∑ n i =1 a t,i P ( i ) = w i ∗ ⊺ a t , it is distributed identically as -r w i ∗ ( a t ) . Since A will be able to identify i ∗ w.p. 1 -δ in T rounds, A ′ just need to output e i ∗ as the optimal arm.

Then any lower bound on T for Problem 2 also lower bounds Problem 1. Hence, we adopt the information theoretical framework of proving lower bounds for linear bandits (Theorem 11 by Rajaraman et al. (2023)) to prove a lower bound for our problem. In fact, we also apply this framework to prove the lower bounds in other settings of this work, including Theorem 7 and Theorem 9.

Lower bound of the information For notation simplicity, for all i ∈ [ n ] , let P i denote the dynamics of ( f 1 , y 1 , ̂ y 1 , . . . , f T , y T , ̂ y T ) under D ′ i and and P denote the dynamics under D = 1 n D ′ i . Let B t denote the event of { f t = 2 1 a t -1 for some non-empty a t ⊂ [ n ] } . As discussed before, for any a t , conditional on ¬ B t or y t = +1 , ( x t , y t , ̂ y t ) are identical in all {D ′ i | i ∈ [ n ] } , and therefore, also identical in D . We can only obtain information at rounds when B t ∧ y t = -1 occurs. In such rounds, f t is fully determined by history (possibly with external randomness , which does not depend on data distribution), y t = -1 and ̂ y t = -r w ( a t ) with r w ( a t ) sampled from the distribution defined in Eq (18).

̸

For any algorithm that can successfully identify i under the data distribution D i with probability 3 4 for all i ∈ [ n ] , then P D i ( i out = i ) ≥ 3 4 and P D j ( i out = i ) ≤ 1 4 for all j = i . Recall that D i and D ′ i are very close when the mixture parameter p is small. Combining with Eq (17), we have

Let w = 1 n 1 . Let kl( q, q ′ ) denote the KL divergence from Ber( q ) to Ber( q ′ ) . Let H t -1 = ( f 1 , y 1 , ̂ y 1 , . . . , f t -1 , y t -1 , ̂ y t -1 ) denote the history up to time t -1 . Then we have

If k t = 1 , then

and

where the ineq holds due to kl( q, q ′ ) ≤ ( q -q ′ ) 2 q ′ (1 -q ′ ) . If k t = n -1 , it is symmetric to the case of k t = 1 . We have

and

If 1 < k t < n -1 , then

where inequality (a) holds due to that k t -1 n -1 + n -k t n -1 p ≤ k t n and kl( q, q ′ ) is monotonically decreasing in q ′ when q ′ ≤ q and inequality (b) adopts kl( q, q ′ ) ≤ ( q -q ′ ) 2 q ′ (1 -q ′ ) , and

where the first inequality hold due to that k t (1 -p ) n -1 ≥ k t n , and kl( q, q ′ ) is monotonically increasing in q ′ when q ′ ≥ q and the second inequality adopts kl( q, q ′ ) ≤ ( q -q ′ ) 2 q ′ (1 -q ′ ) . Therefore, we have

Combining with Eq (19), we have that there exists a universal constant c such that T ≥ cn ε (log( n/ε )+1) .

J Proof of Theorem 9

Proof. We will prove Theorem 9 by constructing an instance of Q and H and showing that for any learning algorithm, there exists a realizable data distribution s.t. achieving ε loss requires at least ˜ Ω( |H| ε ) samples.

Construction of Q , H and a set of realizable distributions

Let feature vector space X = { 0 , 1 , . . . , n } and let the space of feature-manipulation set pairs Q = { (0 , { 0 } ∪ s ) | s ⊂ [ n ] } . That is to say, every agent has the same original feature vector x = 0 but has different manipulation ability according to s .

Let the hypothesis class be a set of singletons over [ n ] , i.e., H = { 2 1 { i } -1 | i ∈ [ n ] } .

We now define a collection of distributions {D i | i ∈ [ n ] } in which D i is realized by 2 1 { i } -1 . For any i ∈ [ n ] , let D i put probability mass 1 -6 ε on (0 , X , +1) and 6 ε uniformly over { (0 , { 0 } ∪ s σ,i , -1) | σ ∈ S n } , where S n is the set of all permutations over n elements and s σ,i := { j | σ -1 ( j ) < σ -1 ( i ) } is the set of elements appearing before i in the permutation ( σ (1) , . . . , σ ( n )) . In other words, with probability 1 -6 ε , we will sample (0 , X , +1) and with ε , we will randomly draw a permutation σ ∼ Unif( S n ) and return (0 , { 0 } ∪ s σ,i , -1) . The data distribution D i is realized by 2 1 { i } -1 since for negative examples (0 , { 0 } ∪ s σ,i , -1) , we have i / ∈ s and for positive examples (0 , X , +1) , we have i ∈ X .

Randomization and improperness of the output f out do not help Note that algorithms are allowed to output a randomized f out and to output f out / ∈ H . We will show that randomization and improperness of f out don't make the problem easier. That is, supposing that the data distribution is D i ∗ for some i ∗ ∈ [ n ] , finding a (possibly randomized and improper) f out is not easier than identifying i ∗ . Since our feature space X is finite, we can enumerate all hypotheses not equal to 2 1 { i ∗ } -1 and calculate their strategic population loss as follows.

2 1 ∅ -1 predicts all points in X by negative and thus L str (2 1 ∅ -1) = 1 -6 ε ;

For any a ⊂ X s.t. 0 ∈ a , 2 1 a -1 will predict 0 as positive and thus will predict any point drawn from D i ∗ as positive. Hence L str (2 1 a -1) = 6 ε ;

̸

For any a ⊂ [ n ] s.t. ∃ i = i ∗ , i ∈ a , we have L str (2 1 a -1) ≥ 3 ε . This is due to that when y = -1 , the probability of drawing a permutation σ with σ -1 ( i ) < σ -1 ( i ∗ ) is 1 2 . In this case, we have i ∈ s σ,i ∗ and the prediction of 2 1 a -1 is +1 .

̸

Under distribution D i ∗ , if we are able to find a (possibly randomized) f out with strategic loss L str ( f out ) ≤ ε , then we have L str ( f out ) = E h ∼ f out [ L str ( h )] ≥ Pr h ∼ f out ( h = 2 1 { i ∗ } -1) · 3 ε . Thus, Pr h ∼ f out ( h = 2 1 { i ∗ } -1) ≥ 2 3 and then, we can identify i ∗ by checking which realization of f out has probability greater than 2 3 . In the following, we will focus on the sample complexity to identify the target function 2 1 { i ∗ } -1 or simply i ∗ . Let i out denote the algorithm's answer to question of 'what is i ∗ ?'.

Smoothing the data distribution For technical reasons (appearing later in the analysis), we don't want to analyze distribution {D i | i ∈ [ n ] } directly as the probability of ∆ t = i ∗ is 0 when f t ( i ∗ ) = +1 . Instead, we consider the mixture of D i and another distribution D ′′ i to make the probability of ∆ t = i ∗ be a small positive number. More specifically, let D ′ i = (1 -p ) D i + p D ′′ i , where D ′′ i is defined by drawing (0 , X , +1) with probability 1 -6 ε and (0 , { 0 , i } , -1) with probability 6 ε . When p is extremely small, we will never sample from D ′′ i when time horizon T is not too large and therefore, the algorithm behaves the same under D ′ i and D i . For any data distribution D , let P D be the dynamics of ( x 1 , f 1 , ∆ 1 , y 1 , ̂ y 1 , . . . , x T , f T , ∆ T , y T , ̂ y T ) under D . According to Lemma 4, by setting p = ε 16 n 2 , when T ≤ n ε , we have that for any i, j ∈ [ n ]

From now on, we only consider distribution D ′ i instead of D i . The readers might have the question that why not using D ′ i for construction directly. This is because no hypothesis has zero loss under D ′ i , and thus D ′ i does not satisfy realizability requirement.

Information gain from different choices of f t In each round of interaction, the learner picks a predictor f t , which can be out of H . Suppose that the target function is 2 1 { i ∗ } -1 . Here we enumerate all choices of f t and discuss how much we can learn from each choice.

f t = 2 1 ∅ -1 predicts all points in X by negative. No matter what i ∗ is, we will observe ∆ t = x t = 0 , y t ∼ Rad(1 -6 ε ) , ̂ y t = -1 . They are identically distributed for any i ∗ ∈ [ n ] and thus we cannot tell any information of i ∗ from this round.

f t = 2 1 a t -1 for some a t ⊂ X s.t. 0 ∈ a t . Then no matter what i ∗ is, we will observe ∆ t = x t = 0 , y t ∼ Rad(1 -6 ε ) , ̂ y t = +1 . Again, we cannot tell any information of i ∗ from this round.

̸

f t = 2 1 a t -1 for some some non-empty a t ⊂ [ n ] . For rounds with y t = +1 , we have x t = 0 , ̂ y t = +1 and ∆ t = ∆(0 , f t , X ) ∼ Unif( a t ) , which still do not depend on i ∗ . For rounds with y t = -1 , if the drawn example (0 , { 0 } ∪ s, -1) satisfies that s ∩ a t = ∅ , the we would observe ∆ t ∈ a t and ̂ y t = +1 . At least we could tell that 1 { ∆ t } is not the target function. Otherwise, we would observe ∆ t = x t = 0 and ̂ y t = -1 .

Therefore, we can only gain some information about i ∗ at rounds in which f t = 2 1 a t -1 for some non-empty a t ⊂ [ n ] and y t = -1 . In such rounds, under distribution D ′ i ∗ , the distribution of ∆ t is described as follows. Let k t = | a t | denote the cardinality of a t . Recall that agent (0 , { 0 } ∪ s, -1) breaks ties randomly when choosing ∆ t if there are multiple elements in a t ∩ s . Here are two cases: i ∗ ∈ a t and i ∗ / ∈ a t .

̸

The case of i ∗ ∈ a t : With probability p , we are sampling from D ′′ i ∗ and then ∆ t = i ∗ . With probability 1 -p , we are sampling from D i ∗ . Conditional on this, with probability 1 k t , we sample an agent (0 , { 0 } ∪ s σ,i ∗ , -1) with the permutation σ satisfying that σ -1 ( i ∗ ) < σ -1 ( j ) for all j ∈ a t \ { i ∗ } and thus, ∆ t = 0 . With probability 1 -1 k t , there exists j ∈ a t \ { i ∗ } s.t. σ -1 ( j ) < σ -1 ( i ∗ ) and ∆ t = 0 . Since all j ∈ a t \ { i ∗ } are symmetric, we have Pr(∆ t = j ) = (1 -p )(1 -1 k t ) · 1 k t -1 = 1 -p k t . Hence, the distribution of ∆ t is

̸

We denote this distribution by P ∈ ( a t , i ∗ ) .

The case of i ∗ / ∈ a t : With probability p , we are sampling from D ′′ i ∗ , we have ∆ t = x t = 0 . With probability 1 -p , we are sampling from D i ∗ . Conditional on this, with probability of 1 k t +1 , σ -1 ( i ∗ ) < σ -1 ( j ) for all j ∈ a t and thus, ∆ t = x t = 0 . With probability 1 -1 k t +1 there exists j ∈ a t s.t. σ -1 ( j ) < σ -1 ( i ∗ ) and ∆ t ∈ a t . Since all j ∈ a t are symmetric, we have Pr(∆ t = j ) = (1 -p )(1 -1 k t +1 ) · 1 k t = 1 -p k t +1 . Hence the distribution of ∆ t is

We denote this distribution by P / ∈ ( a t ) .

To measure the information obtained from ∆ t , we will use the KL divergence of the distribution of ∆ t under the data distribution D ′ i ∗ from that under a benchmark data distribution. We use the average distribution over {D ′ i | i ∈ [ n ] } , which is denoted by D = 1 n ∑ i ∈ n D ′ i . The sampling process is equivalent to drawing i ∗ ∼ Unif([ n ]) first and then sampling from D ′ i ∗ . Under D , for any j ∈ a t , we have

and

Thus, the distribution of ∆ t under D is

We denote this distribution by P ( a t ) . Next we will compute the KL divergence of P / ∈ ( a t ) and P ∈ ( a t ) from P ( a t ) . Since p = ε 16 n 2 ≤ 1 16 n 2 , we have ( nk t -1)(1 -p ) nk t ( k t +1) + p n ≤ 1 -p k t +1 and ( n +1)(1 -p ) n ( k t +1) + ( n -k t ) p n ≤ 1 k t + p . We will also use log(1 + x ) ≤ x for x ≥ 0 in the following calculation. For any i ∗ ∈ a t , we have

For P / ∈ ( a t ) , we have

Lower bound of the information Now we adopt the similar framework used in the proofs of Theorem 7 and 8. For notation simplicity, for all i ∈ [ n ] , let P i denote the dynamics of ( x 1 , f 1 , ∆ 1 , y 1 , ̂ y 1 , . . . , x T , f T , ∆ T , y T , ̂ y T ) under D ′ i and and P denote the dynamics under D . Let B t denote the event of { f t = 2 1 a t -1 for some non-empty a t ⊂ [ n ] } . As discussed before, for any a t , conditional on ¬ B t or y t = +1 , ( x t , ∆ t , y t , ̂ y t ) are identical in all {D ′ i | i ∈ [ n ] } , and therefore, also identical in D . We can only obtain information at rounds when B t ∧ ( y t = -1) occurs.

Then we have

Combining with Eq (25), we have that there exists a universal constant c such that T ≥ cn ε (log( n/ε )+1) .

̸

In such rounds, we know that x t is always 0 , f t is fully determined by history (possibly with external randomness , which does not depend on data distribution), y t = -1 and ̂ y t is fully determined by ∆ t ( ̂ y t = +1 iff. ∆ t = 0 ).

Therefore, conditional the history H t -1 = ( x 1 , f 1 , ∆ 1 , y 1 , ̂ y 1 , . . . , x t -1 , f t -1 , ∆ t -1 , y t -1 , ̂ y t -1 ) before time t , we have

where the last equality holds due to that y t ∼ Rad(1 -6 ε ) and does not depend on B t .

̸

For any algorithm that can successfully identify i under the data distribution D i with probability 3 4 for all i ∈ [ n ] , then P D i ( i out = i ) ≥ 3 4 and P D j ( i out = i ) ≤ 1 4 for all j = i . Recall that D i and D ′ i are very close when the mixture parameter p is small. Combining with Eq (21), we have

Then we have the total variation distance between P i and P j

Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\n- This paper studies strategic classification with unknown and personalized manipulation in an online/distributional setting, i.e. different agents can manipulate their features to a different degree, and the learner does not know the extent to which agents can manipulate their features. \n- The paper assumes realizability, i.e. the existence of a correct classifier in the hypothesis class, that remains correct under strategic manipulation. Both bounds on PAC sample complexity and mistake bounds are provided for a variety of assumptions about the possible manipulations (metric ball vs nonball) and the feedback provided to the learner (original features observed before deploying classifier or not; original/manipulate/no features observed along the true label after classification).  \n**While I remain unsure about the realistic applicability of the most interesting results, the rebuttal and others' reviews have not uncovered any new crucial weaknesses, so I am keeping my score.**\n\nSTRENGTHS:\n- The paper is well written, and good intuition is provided for some of the technical theorems. \n- The setting of varying and unknown manipulations strength in strategic classification is relevant. \n- Both lower bounds and upper bounds based on concrete algorithms are provided\n\nWEAKNESSES:\n- The motivation for the easier cases is not entirely clear. For example, in which setting is it realistic for the learner to see the *original* features of the next agent before choosing which hypothesis to deploy?\n    - This is particularly relevant, as the more interesting results that seem clearly distinct from the previous literatur are on these easier cases. \n- Minor comments:\n  - The Formatting of table 1 could be improved. In particular, some tildes are intersecting the table lines. Additionally, the third row with multiple results for slightly different settings could be further split up to avoid confusion. \n  - If I understand correctly, it is possible for the strategic setting to be realizable for a class of hypotheses, while the non-strategic setting is not. Highlighting this might make some of the proofs (like for theorem 9) easier to parse. \n  - I guess the tie-breaking procedure is slightly underspecified when there are multiple points at the decision boundary with the same distance from x?\n\nQUESTIONS:\n- Do you expect (versions of) the proposed algorithms to still work if different players use different metrics rather than just differently sized balls for the same metric?\n\nLIMITATIONS:\n- The main limitations that are not discussed in the weaknesses were highlighted and discussed by the authors in the discussion/open problems section.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 3, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-06-16"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper studies strategic classification in the setting where agents generally have different power of manipulation, which is unknown to the classifier.  The authors consider both the online model and the PAC model, and investigate 4 increasingly difficult settings in which the classifier observes different information about each agent.  They show nontrivial regret / sample complexity upper and lower bounds for all these settings.\n\nSTRENGTHS:\nThe paper explores a meaningful and challenging new direction in strategic classification.  The models and settings are natural and rich, and the results are fairly comprehensive (and in some cases surprising).  Technically, there seem to be several interesting ideas behind the bounds.\n\nWEAKNESSES:\nI'd be more excited to see results for infinite hypothesis classes and agonostic settings (both of which the authors discuss as future directions).\n\nQUESTIONS:\n(also including detailed comments here)\n\nFootnote 1, \"agents break ties randomly\": do you really mean \"arbitrarily\"?\n\nLine 112, remark on randomized classifiers: the alternative model where agents don't observe the internal randomness of the classifier makes sense too.  Any reason for choosing this particular model?\n\nOverview of results: while these results are certainly nice and important, I wonder if anything can be said in the case where $|\\mathcal{H}| = \\infty$.  Can you comment on this (e.g., conjectures, difficulties)?  (Later I see you mention this as a future direction, which sounds fair since the paper already has quite a number of results.)\n\nLine 240: why is \"GALLANT\" all capitalized?\n\nGeneral technical question: how crucial is the metric space assumption?  In other words, what if the triangle inequality doesn't hold?  I guess at least some of your positive results still hold?\n\nLIMITATIONS:\nn/a", "TITLE": "Official Review", "RECOMMENDATION": 7, "REVIEWER_CONFIDENCE": 3, "SOUNDNESS_CORRECTNESS": 4, "DATE": "2023-07-04"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper studies strategic classification where a sequence of agents, given information about decision rule, may manipulate their features strategically to receive favorable decisions. The goal of the learner is to find a hypothesis that minimizes the number of mistakes through sequential interaction with agents. In addition to conventional strategic classification where agents manipulate their features within a bounded radius ball, this paper also considers personalized manipulation where agents can only manipulate the features belonging to a manipulation set that is unknown to the learner. For both scenarios, it provides the mistake bounds and PAC sample complexity under several settings: 1) when original features are revealed to the learner before choosing the hypothesis and manipulated features after, 2) when both original and manipulated features are revealed after choosing the hypothesis, 3) when only manipulated features are revealed after choosing hypothesis, 4) neither original nor manipulated features are revealed.\n\nSTRENGTHS:\n1. Establishing mistake bounds and sample complexity is an important topic in strategic classification, this can be challenging especially when agent features before/after manipulation are unknown to the learner.\n\n2. The paper considered many settings comprehensively, from a simpler setting when both original and manipulated features are revealed to the learner, to a more complex setting when neither is known to the learner.\n\n3. Section 3 (Overview of the results) is very helpful\n\nWEAKNESSES:\n1. The presentation and some statements can be misleading and confusing. \n\nThe authors emphasized in the abstract/introduction that one prime difference between the present paper and the prior works is that this paper considers personalized manipulation with non-ball manipulations. However, the majority of the paper still focuses on conventional settings with ball manipulations. It can be misleading as I expect more results on non-ball manipulations after reading the abstract. \n\n2. The paper needs more literature review and discuss the differences with prior works to show the novelty. \n\nThe paper introduced the existing works on regret bound in strategic learning very briefly, e.g., (Ahmadi et al., 2021), (Ahmadi et al., 2021). It seems they also considered mistake bound under uniform, unknown manipulations. Moreover, there are many other works studying PAC learning for strategic classification and conducting sample complexity analysis, e.g., [1,2,3]. I think a large body of related works is missing and authors should elaborate more on these works and discuss differences with the present paper. \n\n[1] Sundaram, R., Vullikanti, A., Xu, H., & Yao, F. (2021, July). Pac-learning for strategic classification. In International Conference on Machine Learning (pp. 9978-9988). PMLR.\n[2] Zhang, H., & Conitzer, V. (2021, May). Incentive-aware PAC learning. In Proceedings of the AAAI Conference on Artificial Intelligence (Vol. 35, No. 6, pp. 5797-5804).  \n[3] Lechner, T., & Urner, R. (2022, June). Learning losses for strategic classification. In Proceedings of the AAAI Conference on Artificial Intelligence (Vol. 36, No. 7, pp. 7337-7344).\n\nQUESTIONS:\nIt is not clear to me how the present model captures the personalized manipulations (i.e., different manipulation abilities across agents). Based on my understanding, the authors assume there exists a pre-defined manipulation set $u$ that constrains agents' ability to manipulate. Agents choose to manipulate only if such a manipulation set overlaps the positive region of the predictor, and they would break ties randomly. By personalization, do you mean the manipulation set differs across agents? It seems that the manipulation set $u$ is the same and fixed over time. Should not this manipulation set depends on the predictor? Why break ties randomly? It is very hard for me to interpret this model. It would be helpful if authors can link the model to a real example.\n\nLIMITATIONS:\nThe authors discussed the limitations, but the potential negative societal impact is not discussed.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 2, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-06"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper explores a setting of strategic classification - where agents respond to deployed predictive policies by potentially manipulating their feature vector so as to achieve positive predictions. The authors explore this setting while allowing agent manipulations to be personalized (no assumptions regarding same manipulation budget across agents, etc.), and also do not assume that the learner knows the manipulation power of the agent ahead of time. The authors assume realizability - that the incoming agents and their labels are consistent with some \"true\" underlying concept h* in the concept class. They consider different variants of an online classification problem - based on whether the original/manipulated feature vector of the agent is revealed, and when are they revealed - before/after the learner selects its predictor. In these four settings, the authors give upper and lower bounds for mistakes (in a potentially adversarial setting), as well as sample complexity for PAC learning (In a stochastic data generation setting).\n\nSTRENGTHS:\nThe paper offers a \"complete story\" in the context of an interesting sub-problem in strategic manipulation (where the true label cannot change) in realizable, online settings. I liked the framework the authors present to capture the feasible manipulation region for each agent, which abstracts away the cost function/budget in an elegant manner. I also like that the authors operate under the fact that the learner does not know how agents would manipulate. The division to revealing the original/manipulated features before/after the classification also makes a lot of sense and is a nice way of thinking about manipulation settings (where the true label is unaffected by such changes). In terms of results/techniques - the idea of leveraging the ball structure of feasible manipulation area to order concepts by distances and allow for bisecting the version space is pretty neat. The results for the setting where both the original and manipulated features are revealed after the predictor is picked are even more interesting (especially the algorithm and sample complexity for improper learning).\n\nThe paper is overall very well-written, and seems sound (although I have just looked, and not carefully read the appendix).\n\nWEAKNESSES:\nI find the realizability assumption rather strong, in the following sense - as it is written in line 139, realizability in this paper is defined with respect to the manipulated features, i.e. there exists a concept h* which is the one giving the \"true\" labels for all of the manipulated features. But this, in turn, depends on the manipulations, which are personalized. This degree of circularity makes it a bit hard to think of how can we pick H ahead of time such that h* is present, without potentially having H to be of very large complexity, or otherwise restricting the personalized nature of the manipulations to some degree. But maybe this is inevitable for such general model of manipulation.\n\nI think it is implicitly assumed that given agent x, the personalized manipulation is fixed (there can't be another agent with the same features, and different manipulation profile). If so, maybe it is worth noting in the main text.\n\nAcross the main text, the authors claim that prior work in strategic classification has not entailed personalized manipulation power for agents (e.g. line 375). This is inaccurate - see e.g. Bechavod et al. 2021.\n\nQUESTIONS:\nI found it a bit difficult to follow example 1 in the main text. For example, if H is singletons over [n], how can f_t be all-negative? Also, could you clarify the definition of the metric - is it that distances from 0 to other nodes are 1, and all other distances are 2? Regardless, could you provide a more detailed explanation of the dynamics presented in this example?\n\nLIMITATIONS:\nThe authors properly discuss limitations in the main text.", "TITLE": "Official Review", "RECOMMENDATION": 7, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 4, "DATE": "2023-07-15"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper studies an online learning problem where the learner interacts with a strategic agent in the following way: the learner chooses a hypothesis from a hypothesis class; the agent, after observing the chosen hypothesis, can manipulate its feature vector to be within some ball of unknown and personalized radius to obtain a positive prediction. The paper considers various settings (adversarial online and distributional online) and various feedback models (what feedback does the learner observe before and after its decision). The paper provides mistake bounds (upper and lower) (for the adversarial online setting) and sample complexity bounds (for the distributional online setting) for all feedback models.\n\nSTRENGTHS:\n* The paper is well-written - it is clear and easy to follow. It also includes proof sketches and intuitions behind the results and proofs.\n\n* The paper studies an interesting online learning model and does a comprehensive job of modelling various types of feedback.\n\n* Algorithms 1 and 2 build on classic ideas but are cleverly modified for the problem being studied. \n\n* Theorem 7 about conservative algorithms is very interesting.\n\nWEAKNESSES:\n* This paper studies the setting of a finite hypothesis class and in the realizable setting. Extensions to a general hypothesis class (with an appropriate combinatorial measure) and the agnostic case would really enhance the value of the paper. (Note - the authors point out these avenues for future work in the conclusion.)\n\nQUESTIONS:\n* Is the definition of \"conservative algorithms\" (in section 4.3) a well-known concept? It certainly makes a lot of sense. I am wondering whether that formalism already exists or not. If not, do you have thoughts on how this could be used elsewhere in online learning for lower bounds?\n\nLIMITATIONS:\nLimitations: adequately addressed.\nNegative societal impact: this is theoretical paper and I don't see any direct negative impacts arising from this work.", "TITLE": "Official Review", "RECOMMENDATION": 7, "REVIEWER_CONFIDENCE": 3, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-26"}