Title: Breaking the Gradient Barrier: Unveiling Large Language Models for Strategic Classification
Venue: NeurIPS 2025
Accepted: yes
Keywords: strategic classification

machine learning

LLMs
Abstract: Strategic classification (SC) explores how individuals or entities modify their features strategically to achieve favorable classification outcomes. However, existing SC methods, which are largely based on linear models or shallow neural networks, face significant limitations in terms of scalability and capacity when applied to real-world datasets with significantly increasing scale, especially in financial services and the internet sector. 
In this paper, we investigate how to leverage large language models to design a more scalable and efficient SC framework, especially in the case of growing individuals engaged with decision-making processes. Specifically, we introduce GLIM, a gradient-free SC method grounded in in-context learning. 
During the feed-forward process of self-attention, GLIM implicitly simulates the typical bi-level optimization process of SC, including both the feature manipulation and decision rule optimization. 
Without fine-tuning the LLMs, our proposed GLIM enjoys the advantage of cost-effective adaptation in dynamic strategic environments. Theoretically, we prove GLIM can support pre-trained LLMs to adapt to a broad range of strategic manipulations. We validate our approach through experiments with a collection of pre-trained LLMs on real-world and synthetic datasets in financial and internet domains, demonstrating that our GLIM exhibits both robustness and efficiency, and offering an effective solution for large-scale SC tasks.


Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper mainly proposed that pre-trained LLMs are able to handle strategic classification tasks in two steps by in-context learning: (i) first learning how agents modify their features (strategic manipulation); (ii) updating the weight vector to adapt to the manipulated features. The paper provided theoretical proof on how LLMs accomplish both tasks under a linear SC formulation. The paper also includes experiments on large-scale datasets and non-linear attention layers to demonstrate the effectiveness of LLMs in non-linear settings.\n\nSTRENGTHS AND WEAKNESSES:\n> Strength\n- The problem is interesting since many companies/institutions are already using LLMs in decision-making only with prompt engineering. Thus, it is useful to show theoretically the effectiveness of ICL to handle strategic behaviors.\n- The writing is relatively clear and most theoretical results make sense to me.\n- The LLMs in experiments are up-to-date.\n\n> Weakness\n- The theoretical results only apply when the SC model is linear, and the ICL update is done through one SA layer;\n- the results are not too surprising, i.e., the standard SC formulation can be regarded as a gradient update too, so it is not surprising that implicit gradient can match it. The paper seems to only prove that strategic behaviors in linear SC model can be captured by ICL of LLMs, which is expected.\n\nQUESTIONS:\n- If multiple SA layers with non-linear activations are considered, can ICL capture more complex strategic behaviors?\n- The experiments only consider the non-linear SA layers. Is it possible to consider some non-linear SC models (e.g., the agents do not best respond and the policy is non-linear)? Specifically, it would be interesting to discuss when agents manipulate their features in some complex ways, Can the LLMs learn their strategic behaviors through ICL?\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 2, "DATE": "2025-06-02"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis work proposes leveraging LLMs to tackle strategic classification (SC), with the goal of providing a more scalable alternative to existing methods for adapting automated decision making to adversarial exploitation. In particular, rather than traditional model retraining/finetuning, it proposes leveraging in-context learning to simulate the typical bi-level adversarial SC process. The authors provide some theoretical analysis on SC with in-context learning and evaluate GLIM, the resulting algorithm, on phishing, fraud detection, and other synthetic benchmarks inspired by real-world scenarios.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths.\n\n1. The authors provide concise and effective introductions to the mathematical frameworks of the SC optimization and ICL as implicit gradient descent in Section 2, deferring unnecessary mathematical details to the Appendix.\n2. The experiments are relevant to the domain. tackling different real-world problems and comparing several closed-source LLMs.\n3. The high-level connection between ICL and the SC problem is simple and intuitive.\n\nWeaknesses and areas for improvement.\n\n1. I did not find the methodology and actual algorithm to be clearly presented. There are a few \"high-level\" details in Appendix J that are far from sufficient for reproducibility. I would strongly suggest adding the exact prompts used for each stage of strategic classification for the problems and a clear algorithm block describing the control flow. I think this should be a separate new section in the main paper, explicitly describing the proposed GLIM in practice, which is currently missing.\n2. I found the theoretical analysis provided in Section 3 to be very weak, with the actual implications of propositions 1/2 not matching the claims in the introduction such as \"We theoretically establish, for the first time, how LLMs leveraging in-context learning can implicitly simulate both the strategic manipulation and decision rule optimization stages of the SC bi-level problem, without any fine-tuning.\" (lines 62-64). To me, Section 3 does not actually seem to do any novel analysis beyond the frameworks of prior work, as I think the observation that there could exist parameters, queries, and values that simulate SC with ICL should be mostly obvious. I also fail to see how this leads to some of the remarks, such as \"This establishes a constructive equivalence  between explicit strategic manipulation and attention-driven ICL behavior, thereby grounding ICL as a forward-only approximation of inner-stage optimization in SC.\" (174-176). I would really suggest rewriting and removing much of the unnecessary content in this Section, simply noting the intuitive connection between ICL and GD updates, which could allow, given specific weights and features, to simulate SC.\n3. The methodology has several immediate limitations that are not appropriately discussed. First, adding in-context samples should notably increase the already high inference costs of using LLMs, which I believe are far from \"negligible\" (Appendix L) and can be higher than finetuning the model once, in practice (since the model has to process N times the amount of input tokens). To this end, I would have liked to see an analysis of how these costs scale in practice as a function of the in-context sample (e.g., the API costs). Second, since LLMs are available to the public, users could potentially optimize their features in a way that is adversarial to the LLM parameters P, for any practical choice of context.\n4. In contrast to what was stated in Question 5 of the checklist, the provided code is partial (only 2 Python files, and some CSVs are provided, without even any kind of instructions) and far from allowing any sort of reproducibility.\n\nQUESTIONS:\nI would encourage the authors to address my concerns raised above. Currently, I believe that, without an explicit and clear algorithmic description, to ensure the methodology is clear and reproducible, this work is not yet ready for acceptance.\n\nLIMITATIONS:\nThe limitations regarding the large assumptions made in the theoretical analysis are not discussed. Moreover, the discussion of the prompting costs provided in Section L seems to me potentially misleading, as outlined in my criticism above.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 3, "CLARITY": 1, "IMPACT": 3, "ORIGINALITY": 2, "DATE": "2025-06-27"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes GLIM (Gradient-free Learning In-context Method), which applies large language models to strategic classification problems. Building on the theoretical framework that in-context learning (ICL) implements implicit gradient descent, the authors present a mathematical analysis showing how both stages of strategic classification—inner optimization and outer optimization —can be realized through ICL. The empirical evaluation attempts to validate this theory by demonstrating that ICL-induced updates converge to gradient descent solutions, while showing that GLIM achieves superior classification accuracy compared to traditional linear models and MLPs.\n\nSTRENGTHS AND WEAKNESSES:\n**Strengths**\n\n- The idea of connecting language models to strategic classification is intriguing.\n\n- The paper is well structured and clear written.\n\n**Weaknesses**\n\nTheoretical Limitations\n\n- **Oversimplified transformer architecture:** The theoretical analysis in the appendix reduces transformers to single-layer attention mechanisms, ignoring (1) the multi-layer structure and (2) MLP layers, which constitute a significant portion of the parameter budget and computational capacity.\n\n- **Linear attention assumption:** The theoretical framework in Appendix D assumes linear attention, while many tested language models employ nonlinear attention with softmax. Despite the authors' attempts to address this gap in Appendix I, the justifications remain unconvincing:\n\n  - **Softmax as Adaptive Linear Combination:**  The softmax constraint (positive weights summing to one) fundamentally prevents the construction of arbitrary gradient directions, particularly those requiring negative coefficients or scaling beyond unit norm.\n\n  - **Prompt-based Gradient Encoding:** The claim that careful prompt design can approximate gradient descent lacks theoretical foundation and does not address the fundamental nonlinearity introduced by softmax.\n\n  - **Empirical and Theoretical Support:** While cited work [11] shows transformers can implement functional gradient descent, this does not validate the specific linear constructions required for the authors' theoretical framework.\n\n- **Homogeneous label assumption:** In Equation (45), the homogeneity assumption is unlikely to hold in practice. It is unrealistic to assume that a trained classifier would label every example identically, and under such conditions, it is unclear whether a meaningful decision boundary exists. Additionally, the derivation from Equation (44) to Equation (45) implicitly requires that ⟨xᵢ, xⱼ⟩ = 1, which implies:\n\n  - The input query has exactly the same features as the context examples, which is unlikely in real-world scenarios.\n\n  - All context examples are identical, which contradicts the typical goal of using diverse context examples.\n\nConcerns of Experiments \n\n- The comparison between language models and the baseline models (linear and MLP) appears to be unfair. The language models benefit from extensive pretraining and significantly larger parameter counts, while the baselines are trained from scratch with limited capacity.\n\n- In Figures 3(b) and 6(b), the cosine similarity appears to *decrease* over iterations, which contradicts the claim that the method is effective at large scales.\n\n- The paper does not clearly explain how the in-context learning examples are updated across iterations. A concrete example illustrating how these examples evolve would improve clarity. Additionally, since some of the tested models are closed-source, it is unclear how updates are computed without access to internal parameters or states.\n\nQUESTIONS:\nPlease see weaknesses part in above section.\n\nLIMITATIONS:\nAuthors provide sufficient discussion about the limitations.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 3, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-07-03"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThey investigate how to use LLMs to design a more scalable and efficient strategic classification(SC) framework. Their model GLIM is a gradient free SC method grounded in in-context learning. \n\nStrategic classification is a bilevel optimization problem, where individuals best-respond to a deployed classifier in order to maximize their payoff. Then the classifier is updated in order to maximize its accuracy considering best-responses by the individuals. Traditional SC approaches often rely on iterative retraining or gradient updates to remain robust, which becomes computationally expensive and infeasible at scale. However, it is very costly to retrain LLMs. Hence, they  propose a novel gradient-free method that leverages in-context learning (ICL) in LLMs to perform strategic classification without updating model parameters. They show how LLMs leveraging in-context learning can implicitly simulate both the strategic manipulation and decision rule optimization stages of the SC bi-level problem, without any fine-tuning.\n\n\nThey show it theoretically, how their gradient-fee in-context learning model (GLIM) simulates this bi-level optimization process, including both the feature manipulation and decision rule optimization. That being said, unlike traditional SC approaches that often rely on iterative retraining, or gradient updates to remain robust, their method is retraining free and hence more efficient.\n\nSTRENGTHS AND WEAKNESSES:\nOne of your main contributions is a theoretical justification for how LLMs equipped with ICL can simulate the strategic manipulation of agents. However, that does not seem too surprising or novel to me. The proof uses two arguments first, the forward propagation in LLMs—particularly through linear self-attention layers—can be interpreted as performing implicit gradient descent (GD) (this is known from prior work). Second,  solving optimum manipulation in strategic manipulation may be viewed as a gradient-descent step (this was known before too). Putting this two arguments shows that ICL can simulate the strategic manipulation of agents. This seems like a straightforward argument to me.\n\nSimilarly, I am not too surprised by line 200 and Prop 2, your second main contribution. Since we already know that the forward\npropagation in LLMs can be interpreted as performing implicit gradient descent (GD). Taking a gradient step is exactly what we do in the outer optimization step of SC.\n\nPlease correct me if I am wrong or missing something here.\n\nQUESTIONS:\nWhat does GLIM stand for? Gradient-free Learning In-context Model?\n\nLine 117, A is not defined.\n\nIn Prop 1,2, showing the existence of such PVK matrices does not imply that your model would learn the same matrices. You would need to argue that your learning procedure would converge to desirable PVK matrices.\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 3, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-07-07"}