Title: Online Strategic Classification With Noise and Partial Feedback
Venue: NeurIPS 2025
Accepted: yes
Keywords: strategic classification

online optimization

learning halfspaces with noise
Abstract: In this paper, we study an online strategic classification problem, where a principal aims to learn an accurate binary linear classifier from sequentially arriving agents. For each agent, the principal announces a classifier. The agent can strategically exercise costly manipulations on his features to be classified as the favorable positive class. The principal is unaware of the true feature-label distribution, but observes all reported features and only labels of positively classified agents. We assume that the true feature-label distribution is given by a halfspace model subject to arbitrary feature-dependent bounded noise (i.e., Massart Noise). This problem faces the combined challenges of agents' strategic feature manipulations, partial label observations, and label noises. We tackle these challenges by a novel learning algorithm. We show that the proposed algorithm yields classifiers that converge to the clairvoyant optimal one and attains a  regret rate of $ O(\sqrt{T})$ up to poly-logarithmic and constant factors over $T$ cycles.


Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper considers the strategic classification model with following extension: candidates arrive online and the principal only observes the manipulated features and the label only if the candidate was classified positively. Candidate features originate from an unknown distribution and are not exactly separable by a linear hyperplane - rather, the labels can be noisy wrt to the plane (Massert noise that is correlated with features). Like other works in the online strategic setting [Chen, 2020], they assume agents can manipulate within some radius. The key departure from existing online model is the observability of the labels conditioned on acceptance.\n\nThe key technical contribution of the work is providing an online algorithm that achieves $\\sqrt{T}$ regret with respect to the offline optimal, which can be informally characterized as shifting the optimal non-strategic classifier by the width of the manipulation radius. The algorithm composed of three parts: an initialization phase where the principal positively classifies both sides of the plane (on every other step) to collect data. A refinement stage that explores a boundary near the initialization phase - both of these can incur large regret and thus runs for log(T) time. Lastly, the large part of the algo runs where the enhancement is over batches and proxy features are used to approximate the gradient (in lieu of costly exploration).\n\nSTRENGTHS AND WEAKNESSES:\nWith strategic classification paper, I find the model to be crucial and I find the model here to be fairly reasonable and well justified. Indeed in many settings only positive labels are observed for their true label. While this is the main difference from existing works, I don't think it's a negative as it does lead to a meaningful/challenging problem. I also found the paper to be focused in answering the crucial question of sub-linear regret. Overall, I think it's a good paper.\n\nMy main criticism would be in the exposition of the paper - especially in the theory section. For example, in the initialization part of the algorithm, it is not clear what the significance of the acute angle perspective is. Some diagrams or high-level description of the main ideas would help for the first and second components of the algorithm.\n\nQUESTIONS:\n- Do you have any thoughts on the setting where each agent's manipulation radius $\\gamma$ is different? So one can either think of this as being an unknown (perhaps too hard) or belonging to some range. I know prior literature also makes this assumption -- so not a major criticism -- but I am curious about it since afaik the clairvoyant classifier in this setting can no longer be easily characterized.\n\n- Could you explain why in the refinement stage, why we need to consider strategic manipulation and form a linear optimization problem. My understanding is that we set a threshold b and agents within b margin (according to true features) of the current classifier are positively classified. Can this not be achieved by shifting the boundary by \\gamma?\n\nLIMITATIONS:\nI don't see any negative social impact of this work.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 3, "CLARITY": 2, "IMPACT": 3, "ORIGINALITY": 2, "DATE": "2025-06-30"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper studies online binary linear classification when agents strategically manipulate their features to achieve positive prediction at quadratic cost, and the learner only sees labels of positively classified agents. The authors assume that the true feature-label relationship is a halfspace model subject to arbitrary but bounded (Massart) noise. Additionally, the distribution of features is assumed to satisfy regularity conditions for 1-dimensional and 2-dimensional projections, including lower and upper density bounds and a sub-exponential tail bound for the inner product of features with any unit vector. This assumption appears in prior works on learning halfspaces with noise.\n\nThe proposed algorithm consists of three phases: initialization, refinement, and batched enhancement, utilizing proxy features and pairwise contrastive inference. A regret bound of $\\tilde O(\\sqrt T​)$ is provided. Numerical experiments support these theoretical findings.\n\nSTRENGTHS AND WEAKNESSES:\n*Strengths*\n\n- The problem addressed, online strategic classification with partial feedback, is interesting.\n- The inclusion of Massart noise makes a great addition, and demonstrates the generality of the algorithm.\n- The way the paper handles the challenges of strategic feature manipulation, partial feedback, and label noise is a central contribution. The specific techniques used, constructing proxy features and using pairwise contrastive inference, are novel aspects of their proposed algorithm.  In particular, for gradient estimation without true features, gradient estimates over bands around the boundary are needed. Yet, agents in those bands misreport, so the authors (i) construct proxy feature points from the reports and (ii) use pairwise contrastive inference with two shifted classifiers to unbias these estimates.\n- The paper is well-written.\n\n*Weaknesses* \n- Usually, in online strategic classification, adversarial settings are considered, whereas this paper makes some distributional assumptions. That said, this setting is also interesting.\n- Only quadratic cost is considered.\n\n*Comments*\n- The paper mentions [Ahmadi et al., 2023, 2024], but it does not mention a closely related work by Cohen et al. 2024 [1], which is chronologically \"in between\", nor a more recent, subsequent relevant work by Shao et al. 2025 [2].\n- The paper provides overviews and discussions of the Initialization, Refinement, and Batched Enhancement algorithms. However, I suggest that the authors provide even more discussion about them, particularly given the complexity of the methods. \n\n\n[1] Lee Cohen, Yishay Mansour, Shay Moran, and Han Shao. Learnability gaps of strategic classification. COLT 2024.\n\n[2] Han Shao, Shuo Xie, Kunhe Yang. Should Decision-Makers Reveal Classifiers in Online Strategic Classification? ICML 2025.\n\nQUESTIONS:\n1. Do you have any intuition for how your algorithm or regret bounds might change under other noise settings?\n2. Do you have an idea on how to extend the partial feedback setting to more complex classes, e.g., finite VC classes (even without noise)?\n3. Are there any guarantees if the budget parameter $\\gamma$ is unknown or must be estimated online?\n4. Any guarantees on more general cost functions (e.g., linear, or other convex costs)?\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 3, "CLARITY": 4, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-06-30"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper explores binary classification in a strategic online setting, where a classifier must immediately label incoming agents. Crucially, it receives noisy feedback only for positively classified agents (\"apple tasting\"). The feature-label relationship uses a linear half-space model with bounded noise, and the classifier aims to minimize regret against the best fixed omniscient classifier.\n\nFollowing prior work, the authors first show that for half-spaces, agents' best responses can be characterized, proving that an omniscient classifier yields identical outputs whether features are true or manipulated.\n\nThey then propose a three-component algorithm. First, an \"exploration\" subroutine uses contrasting classifiers to find an initial normal vector close to the optimal one. Second, a \"localization\" subroutine refines this vector by focusing on informative data near the classifier's boundary, where true features are observable due to no manipulation incentives. Despite new complications from strategic reporting, they solve an online linear optimization problem using techniques akin to learning with label noise, achieving only logarithmic regret in this phase.\n\nThe third and most novel component tackles strategic manipulation in this refined localization. As manipulable classifiers lead to high regret from misreporting, they introduce a modified classifier that sets a higher bar for positive classification. To address the unobservability of true features in key regions, they develop proxy features to mimic true ones for gradient construction, and pairwise contrastive inference. The latter uses two successive classifiers to statistically infer information about unobservable true data in critical localized regions, and which in turn enables estimation of gradients.\n\nSTRENGTHS AND WEAKNESSES:\nThis paper tackles a tougher version of online strategic classification, to accommodate partial, noisy feedback. A key and novel strength of the paper is the development of pairwise contrastive inference to address strategic reporting from the agents. In particular, by employing two slightly different classifiers in succession and contrasting the observed data from each, they cleverly infer statistical information about the true, unobservable features in critical regions. Moreover, the integration of proxy features, designed to mimic true features from reported ones, further strengthens their approach by allowing the construction of effective proxy gradients. In general, I appreciated the technical novelty the authors developed in this paper.\n\nEven the “localization” procedure, which has already been developed for the non-strategic counterpart of the problem, is here devised in a clever way. Namely, it handles strategic interaction via an instantiation of Online Mirror Descent and suffers only logarithmic regret.\n\nThe exposition is clear and, despite its technical depth, the treatment maintains conceptual clarity at all points of the main body. The authors explicitly explain what the algorithm subroutines are needed for, and where each piece of the analysis comes into play.\n\nOverall, the contributions and presentation are strong, novel and well-conveyed. The authors design a single algorithm that simultaneously handles strategic feature reports and partial, noisy feedback, suffering $\\sqrt{T}$ regret, essentially providing conclusive answers for the analyzed setting.\n\nThere is a typo in line 168: inccurs —> incurs.\n\nQUESTIONS:\nIf I understand correctly, our results hold for a sequence of myopic buyers. I am wondering whether you had some thoughts regarding a repeated game where a single agent aims to maximize the sum of positively classified points (over cycles). I guess that this can be modeled as a Stackelberg game and that it is also a consideration for the model without noise and with two-sided feedback.\n\nLIMITATIONS:\nYes", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "CLARITY": 4, "IMPACT": 4, "ORIGINALITY": 4, "DATE": "2025-07-02"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThey study online strategic classification(SC) with massart noise and a partial feedback model (only receive feedback when the example is labeled as positive). In online strategic classification, in each round the principal deploys a classifier and then an agent in round $t$ arrives. The agent with feature set $x$ best-responds to the deployed classifier in order to maximize their utility, that is the classification that they receive in their manipulated state $x'$ minus the cost of manipulation, i.e., movement from $x$ to $x'$. Usually in SC, the true label is revealed after the principal announces their classification based on the deployed classifier; however, here they assume partial feedback, that is the true label is only revealed if the agent is classified as positive. For example, if a student is admitted in the college, after that the principal would see if her decision was good or not (the student was actually a positive  example (good student) or not.)\n\n Massart noise is when the actual label of the points are flipped with some feature-dependent probability $\\eta(x)$, where all values $\\eta(x)$ are bounded (at most $\\eta\\leq 1/2$). Some of the previous work in SC assumes the clean examples( before manipulation) are linearly separable, the Massart noise relaxes this assumption and considers the scenario where most of the points are linearly separable.\n\nThey show sublinear regret in the setting of online SC+Massart Noise+partial feedback. Their techniques are mostly a generalization of Zheng et al.2020 to a strategic setting. There are three steps in their algorithm: initialization, refinement, and batch contrastive inference step. In each step, they find a linear classifier $w$ that gets closer to the opt classifier $w^*$. (lines 206-217 do a great job of summarizing these steps.)\n\nI think the main difference with Zheng et al is in the last step of batched enhancement, where they solve a sequence of adaptively constructed online linear optimization problems to refine the reported classifier $w$. Here, they need to estimate the gradients $g_{k,i}$ (you need to define what $g_{k,i}$ is, I didn't find its definition.) However, these gradients depend on the true features, but all agents in the localized regions D_{k,i} misreport their features. So, here they need to use proxy features and estimate the true location of the agents by projecting the reported feature set to the upper or lower boundary of $D_{k,i}$. They would argue that using these proxy features, the gradients will be well-constructed and hence they would converge to the optimal $w^*$ after bounded number of iterations.[This proxy feature construction is a trick also used in earlier work in online SC.]\n\nSTRENGTHS AND WEAKNESSES:\nI appreciate the write-up and technical details of the paper. In my opinion, this is mostly a combination of the techniques from Zheng et al 2020 on learning half-spaces under label noise and the techniques from Ahmadi et al. on online learning with strategic input, where they use proxy features to update their linear classifiers. They employ a similar idea to adapt the algorithm by Zheng et al. to a SC setting. I have explained this in detail in the summary. Please correct me if I am wrong.\n\nQUESTIONS:\nLine 168, why do you need the multiplicative factor of 2?\n\nI don’t understand lines 218-220. What is the relationship between batches, indices and t?\n\nTrying to understand lines 232-245, in the first paragraph, it says that you are considering the band above the classifier where the points have no incentive to move. Then in the second paragraph, it says there are challenges due to the strategic nature of the points. Could you please clarify? It seems a bit contradictory.\n\n\nIn line 6 in Alg 2, perhaps you can add an explanation on how you construct w_0?\n\nLIMITATIONS:\nyes, no potential negative societal impact", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 2, "DATE": "2025-07-06"}