Title: The Active and Noise-Tolerant Strategic Perceptron
Venue: NeurIPS 2025
Accepted: no
Keywords: active learning

strategic classification

perceptron algorithm
Abstract: Strategic classification is an emerging area of modern machine learning research that models scenarios where input features are provided by individuals who might manipulate them to receive better outcomes, e.g., in hiring, admissions, and loan decisions. Prior work has focused on supervised settings, where human experts label all training examples.

However, labeling all training data can be costly, as it requires expert intervention. In this work, we initiate the study of active learning for strategic classification, where the learning algorithm takes a much more active role compared to the classic fully supervised setting in order to learn with much fewer label requests.

Our main result provides an algorithm for actively learning linear separators in the strategic setting while preserving the exponential improvement in label complexity over passive learning previously achieved in the simpler non-strategic case. Specifically, we show that for data uniformly distributed over the unit sphere, a modified version of the Active Perceptron algorithm [Dasgupta et al. 2005, Yan and Zhang 2017], can achieve excess error $\epsilon$ after requesting only $ \tilde{O}\left(d \ln \frac{1}{\epsilon}\right)$
labels and making an additive $\tilde{O}\left(d \ln \frac{1}{\epsilon}\right)$ mistakes compared to the best classifier, when the $\tilde{\Omega}(\epsilon)$ fraction of the inputs are flipped. These algorithms are computationally efficient with number of label queries substantially better than prior work in strategic Perceptron [Ahmadi et al. 2021] under distributional assumptions.


Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper considers a strategic classification variant for active learning: at each time $t$, the learner picks one example $x_t$ to classify and ask for its label. The example $x_t$ observed by the learner is actually manipulated by an adversary from  $z_t$ where the goal of the adversary is to make the learner output a positive label while keeping the cost of manipulating low. Specifically, it assumes the adversary wants to maximize a utility function of $\\text{PredictedLabel}(x_t) - cost(z_t, x_t)$. On the other hand, the label returned by the oracle is based on the original example $z_t$. The goal of the learner is to learn a classifier good for the original distribution of $z_t$ while making as few mistakes during the process as possible in the presence of the adversary.\n\nIn this paper, it considers a specific setting: it considers learning a homogeneous linear classifier, and assumes that that the data distribution for $z_t$ is uniform over the unit ball, the oracle follows a bounded noise model. For the adversary, it assumes $cost(z_t, x_t) = c || x_t - z_t||$.\n\nIts algorithm is based on a perceptron-based algorithm by [Yan and Zhang, 2017], where the key insight is that due to the specific utility function of the adversary, negative examples are not manipulated, and because the distribution is assumed to be uniform, we can learn a good classifier with just these \"half\" examples. It proves that the label complexity of the proposed algorithm is almost the same as the classical one without strategic classification.\n\nSTRENGTHS AND WEAKNESSES:\nQuality: This paper is technically sound. I did not check proofs in the Appendix, but the authors provided a clear explanation of their main technique, which looks good to me and should be reasonable to achieve the claimed theoretical results.\n\nClarity: This paper is mostly clear and easy to follow. One minor suggestion is that the setting would be clearer if the authors could clearly (re)state in each iteration, which example the learner selects, what the learner observes, what the example is actually is in the hindsight, what the adversary knows and does, and according what the oracle returns a label.\n\nSignificance: This paper considers an interesting question and provides a solid algorithm with theoretical guarantees for it. One weakness is that it looks like the result is very specific to the assumption of the utility function and data distribution, and it would be helpful if the authors could explain if these assumptions are necessary or common in the literature, and if the results can be generalized to other utility functions or data distributions.\n\nOriginality: The main algorithm is based on an earlier work of [Yan and Zhang, 2017], but it looks nontrivial to adapt and apply it to solve the problem studied in this paper.\n\nQUESTIONS:\nSee \"Strengths And Weaknesses\".\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-06-23"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper studies a strategic classification variant (meaning data points, aka users, can manipulate their features to get a positive label) of the active perceptron. The authors study the realizable and nonrealizable case (with bounded noise) under strong assumptions (uniform distribution over the sphere, noise is not too severe). They essentially recover the query complexity of the active perceptron of Yan and Zhan [2017] while dealing with the more involved strategic classification setting [Ahmadi et al. 2021]. The latter being non-active requires significantly more labels.\n\nSTRENGTHS AND WEAKNESSES:\nThis paper addresses a timely and important combination of strategic classification and active learning. As far as I am aware this is the first paper tackling both problems simultaneously.\n\nThere are multiple bigger weaknesses:\n\n1. This submissions seems to be a rather small step on top of Yan and Zhang (2017). In particular, inspecting the appendix we see that the most lemmas leading to the main result are either small adaptations from either Yan and Zhang or Ahmadi et al (2021). The main result itself is proven by reducing the strategic classification case to the standard non-strategic case (which is not really clear from the main paper). The main ingredient to handle the strategic case seems to be very close to the Ahmadi et al (2021) strategy. So it is rather unclear what the main contribution of this paper here is.\n\n2. The writing and structure is not great. The main theorem is presented at page 6, the main algorithm only at page 8. The whole paper mixes the authors' contributions and discussion of previous work, making it hard to judge its contribution. Moreover, the main paper even makes it seem that the contributions are more limited than they are. In the main paper it seems like they require an initial halfspace which is already quite close to the best halfspace. However in the not referenced Appendix C they discuss a simple strategy by Yan and Zhang (2017) to alleviate this issue. The authors have a full more page left in the main paper (they only have 8 pages), where they could have added such details.\n\n3. The assumptions are really strong: uniform distirbution on the sphere, an assumed noise level which depends on all relevant parameters, and the initial good halfspace (which however is resolved in the Appendix C as mentioned above). While all these assumptions come from Yan and Zhang (2017), one could argue (or might hope/expect) that during these 8 years more sophisticated strategies/analysis have been developed for broader families of distributions. I am not sure it is sufficient to just repeat the limitations from previous papers.\n\nSmaller comments:\n* the cost$(\\cdot,\\cdot)$ and the whole utility value$(x)-$cost make this paper seem more general then it is. Consider putting the actually used weighted Euclidean distance and the three cases of the utily (basically like in Lemma 3/its proof).\n\nQUESTIONS:\nYou briefly mention margin-based active learning but the relationship is not fully clear. Can the standard margin-based analysis of the perceptron or the corresponding active variants be used here as well? In some sense is the region, where the users will flip from negative to positive, strongly corresponding to the margin (perhaps a one-sided version of it) in standard learning of halfspaces.\n\nThe assumption on $\\eta$ in the theorem (while being the same as by Yan and Zhang) is not nice at all with $eta$ depending on all relevant parameters in the paper (including $\\delta$ and $d$). Can you rephrase the theorem in a way that this condition only relates $\\eta$ and $\\epsilon$? This would be much more natural. Either a specific $\\epsilon$ is achievable or the noise is simply too high (see e.g., Hanneke and Yang 2015, Theorem 8). \n\nIt is claimed that the uniform on the surface case is easy for the strategic case. Please add a more detailed discussion/proof.\n\nLIMITATIONS:\nThe authors do not really discuss the limitations of say the strong assumptions of the uniform distribution on the sphere. This is however not too uncommon in active learning. They do discuss the limitation of assuming a good initial guessed halfspace in Appendix C with a simple solution. For some reason this is absolutely not clear from the main text and not referenced there.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 3, "CLARITY": 1, "IMPACT": 2, "ORIGINALITY": 1, "DATE": "2025-06-30"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nIn the present work, the authors study active learning in strategic-classification settings, where agents can manipulate their features (inputs at inference) to be classified positively. Building on Yan & Zhang (2017) and Ahmadi et al. (2021), the authors adapt the Active Perceptron algorithm: \n\n1- to raise the decision threshold from $0$ to $1/c$ (where $c$ is the per-unit manipulation cost);\n\n2- query labels only for points currently classified as negative and lying in a narrow “band” around the hyperplane;\n\n3- normalise queried points and update with a Perceptron-style rule.\n\n\nFor data drawn uniformly from the $d$-dimensional unit ball (not just the sphere) they assert (without proof) that, under a bounded-noise condition, the modified algorithm achieves excess error $\\epsilon$ with $\\mathcal{O}(d\\log \\frac{1}{\\epsilon})$ queries, incourring in the same amount of mistakes.\n\nSTRENGTHS AND WEAKNESSES:\n**Strengths**\n- Clear high-level motivation for reducing label complexity in costly domains.\n- Opens an under-explored combination of active learning and strategic manipulation, claiming exponential label savings in strategic classification.\n\n**Weaknesses**\n- No proof sketch of the main theorem is supplied in the main; in the appendix, the proof is shown to be derivative of Yan and Zhang (2017).\n- Not clear why Lemma 3 is presented as a Lemma, since it is a restatement of the prediction rule and the action of the strategic agents.\n- Theoretical setup assumes agents know and use the same $1/c$ threshold that the learner uses; it is not fully clear why these thresholds would coincide and why the learner would know this threshold. \n- Uniform-ball vs uniform-sphere generalisation is presented as a strong point of this work, but its impact is not discussed convincingly. In high dimensions, for example, the difference is negligible. \n- The length constraint was not an issue in this work, since page 9 was not utilized (and Section 2 is often redundant). However, no empirical sanity checks are offered, even though the algorithm’s robustness to violated assumptions is unknown.\n- Little evidence is presented on the fact that the insights provided by this work transfer to realistic pipelines.\n- Heavy reliance on Yan and Zhang (2017) for analysis structure and on Ahmadi et al. (2021) for the strategic threshold; the degree of novelty of this work seems limited.\n\nQUESTIONS:\n1- Practical motivation: Can you name a concrete application where the hypotheses required for this study are close enough to realistic assumptions? For example, settings where the $1/c$ threshold employed by the agents is known by the learner, or where the isotropic feature assumption is close to true?\n\n2- Noise condition: How does the bound on the admissible noise rate compare numerically with the passive-learning lower bound of Ahmadi et al.?\n\n3- What does the notation $\\Theta$ indicatem in Theorem 2?\n\n4- Role of $c$: Could the algorithm be run with a mismatched $c$?\n\n5- Uniform-ball assumption: Given the presence of many other simplifying assumptions, why is relaxing the sphere normalization important?\n\n6- Can the authors provide any empirical validation of the effectiveness of their approach, especially when some of their hypotheses might be violated?\n\nLIMITATIONS:\nNo empirical evidence: even a small-scale simulation could demonstrate behaviour when assumptions are violated (e.g., non-isotropic data, heterogeneous costs).\n\nNovelty gap: The algorithm is closely related to two prior works, and the technical details are mostly inherited straightforwardly.", "TITLE": "Official Review", "RECOMMENDATION": 3, "REVIEWER_CONFIDENCE": 3, "CLARITY": 2, "IMPACT": 1, "ORIGINALITY": 2, "DATE": "2025-06-30"}