Original: S TRATEGIC C LASSIFICATION ON G RAPHS
Revised: S TRATEGIC C LASSIFICATION WITH G RAPH N EURAL N ETWORKS

Original: A BSTRACT
Revised: A BSTRACT

Original: Strategic classification studies learning in settings where users can modify their features to obtain favorable predictions.
Revised: Strategic classification studies learning in settings where users can modify their features to obtain favorable predictions.

Original: Most current works focus on simple classifiers that trigger independent user responses.
Revised: Most current works focus on simple classifiers that trigger independent user responses.

Original: Here we examine the implications of learning with more elaborate models that break the independence assumption.
Revised: Here we examine the implications of learning with more elaborate models that break the independence assumption.

Original: Motivated by the idea that applications of strategic classification are often social in nature, we focus on graph neural networks , which make use of social relations between users to improve predictions.
Revised: Motivated by the idea that applications of strategic classification are often social in nature, we focus on graph neural networks , which make use of social relations between users to improve predictions.

Original: Using a graph for learning introduces inter-user dependencies in prediction; our key point is that strategic users can exploit these to promote their own goals.
Revised: Using a graph for learning introduces inter-user dependencies in prediction; our key point is that strategic users can exploit these to promote their own goals.

Original: As we show through analysis and simulation, this can work either against the system—or for it.
Revised: As we show through analysis and simulation, this can work either against the system—or for it.

Original: Based on this, we propose a differentiable framework for strategically-robust learning of graph-based classifiers.
Revised: Based on this, we propose a differentiable framework for strategically-robust learning of graph-based classifiers.

Original: Experiments on several real networked datasets demonstrate the utility of our approach.
Revised: Experiments on several real networked datasets demonstrate the utility of our approach.

Original:  I NTRODUCTION
Revised:  I NTRODUCTION

Original: Machine learning is increasingly being used to inform decisions about humans.
Revised: Machine learning is increasingly being used to inform decisions about humans.

Original: But when users of a system stand to gain from certain predictive outcomes, they may be prone to “game” the system by strategically modifying their features (at some cost).
Revised: But when users of a system stand to gain from certain predictive outcomes, they may be prone to “game” the system by strategically modifying their features (at some cost).

Original: The literature on strategic classification (Brückner & Scheffer, 2011; Hardt et al., 2016) studies learning in this setting, with emphasis on how to learn classifiers that are robust to strategic user behavior.
Revised: The literature on strategic classification (Brückner & Scheffer, 2011; Hardt et al., 2016) studies learning in this setting, with emphasis on how to learn classifiers that are robust to strategic user behavior.

Original: The idea that users may respond to a decision rule applies broadly and across many domains, from hiring, admissions, and scholarships to loan approval, insurance, welfare benefits, and medical eligibility (McCrary, 2008; Almond et al., 2010; Camacho & Conover, 2011; Lee & Lemieux, 2010).
Revised: The idea that users may respond to a decision rule applies broadly and across many domains, from hiring, admissions, and scholarships to loan approval, insurance, welfare benefits, and medical eligibility (McCrary, 2008; Almond et al., 2010; Camacho & Conover, 2011; Lee & Lemieux, 2010).

Original: This, along with its clean formulation as a learning problem, have made strategic classification the target of much recent interest (Sundaram et al., 2021; Zhang & Conitzer, 2021; Levanon & Rosenfeld, 2021; Ghalme et al., 2021; Jagadeesan et al., 2021; Zrnic et al., 2021; Estornell et al., 2021; Lechner & Urner, 2021; Harris et al., 2021;
Revised: This, along with its clean formulation as a learning problem, have made strategic classification the target of much recent interest (Sundaram et al., 2021; Zhang & Conitzer, 2021; Levanon & Rosenfeld, 2021; Ghalme et al., 2021; Jagadeesan et al., 2021; Zrnic et al., 2021; Estornell et al., 2021; Lechner & Urner, 2021; Harris et al., 2021;

Original: Levanon & Rosenfeld, 2022; Liu et al., 2022; Ahmadi et al., 2022; Barsotti et al., 2022a).
Revised: Levanon & Rosenfeld, 2022; Liu et al., 2022; Ahmadi et al., 2022; Barsotti et al., 2022a).

Original: But despite these advances, most works in strategic classification remain to follow the original problem formulation in assuming independence across users responses.
Revised: But despite these advances, most works in strategic classification remain to follow the original problem formulation in assuming independence across users responses.

Original: From a technical perspective, this assumption greatly simplifies the learning task, as it allows the classifier to consider each user’s response in isolation: user behavior is modeled via a response mapping ∆ h ( x ) determining how users modify their features x in response to the classifier h , and learning aims to find an h for which y ≈ h (∆ h ( x )) .
Revised: From a technical perspective, this assumption greatly simplifies the learning task, as it allows the classifier to consider each user’s response in isolation: user behavior is modeled via a response mapping ∆ h ( x ) determining how users modify their features x in response to the classifier h , and learning aims to find an h for which y ≈ h (∆ h ( x )) .

Original: Intuitively, a user will modify her features if this ‘moves’ her across the decision boundary, as long as this is worthwhile (i.e., gains from prediction exceed modification costs).
Revised: Intuitively, a user will modify her features if this ‘moves’ her across the decision boundary, as long as this is worthwhile (i.e., gains from prediction exceed modification costs).

Original: Knowing ∆ h allows the system to anticipate user responses and learn an h that is robust.
Revised: Knowing ∆ h allows the system to anticipate user responses and learn an h that is robust.

Original: For a wide range of settings, learning under independent user responses has been shown to be theoretically possible (Hardt et al., 2016; Zhang & Conitzer, 2021; Sundaram et al., 2021) and practically feasible (Levanon & Rosenfeld, 2021; 2022).
Revised: For a wide range of settings, learning under independent user responses has been shown to be theoretically possible (Hardt et al., 2016; Zhang & Conitzer, 2021; Sundaram et al., 2021) and practically feasible (Levanon & Rosenfeld, 2021; 2022).

Original: Unfortunately, once this assumption of independence is removed—results no longer hold.
Revised: Unfortunately, once this assumption of independence is removed—results no longer hold.

Original: One reason is that current approaches can safely assume independence because the decision rules they consider induce independence: when predictions inform decisions for each user independently, users have no incentive to account for the behavior of others.
Revised: One reason is that current approaches can safely assume independence because the decision rules they consider induce independence: when predictions inform decisions for each user independently, users have no incentive to account for the behavior of others.

Original: This limits the scope of predictive models to include only simple functions of single inputs.
Revised: This limits the scope of predictive models to include only simple functions of single inputs.

Original: In this paper, we aim to extend the literature on strategic classification to support richer learning paradigms that enable inter-dependent user responses, with particular focus on the domain of Graph
Revised: In this paper, we aim to extend the literature on strategic classification to support richer learning paradigms that enable inter-dependent user responses, with particular focus on the domain of Graph

Original: Neural Networks (GNNs) (Monti et al., 2017; Wang et al., 2019; Bronstein et al., 2017; Hamilton et al., 2017).
Revised: Neural Networks (GNNs) (Monti et al., 2017; Wang et al., 2019; Bronstein et al., 2017; Hamilton et al., 2017).

Original: Generally, user responses can become dependent through the classifier if predictions for one user rely also on information regarding other users, i.e., if h ( x i ) is also a function of other x j .
Revised: Generally, user responses can become dependent through the classifier if predictions for one user rely also on information regarding other users, i.e., if h ( x i ) is also a function of other x j .

Original: In this way, the affects of a user modifying her features via x j (cid:55)→ ∆ h ( x j ) can propagate to other users and affect their decisions (since h ( x i ) now relies on ∆ h ( x j ) rather than x j ).
Revised: In this way, the affects of a user modifying her features via x j (cid:55)→ ∆ h ( x j ) can propagate to other users and affect their decisions (since h ( x i ) now relies on ∆ h ( x j ) rather than x j ).

Original: For GNNS, this expresses through their relience on the graph.
Revised: For GNNS, this expresses through their relience on the graph.

Original: GNNs take as input a weighted graph whose nodes correspond to featurized examples, and whose edges indicate relations that are believed to be useful for prediction (e.g., if j → i indicates that y i =
Revised: GNNs take as input a weighted graph whose nodes correspond to featurized examples, and whose edges indicate relations that are believed to be useful for prediction (e.g., if j → i indicates that y i =

Original: y j is likely).
Revised: y j is likely).

Original: In our case, nodes represent users, and edges represent social links.
Revised: In our case, nodes represent users, and edges represent social links.

Original: The conventional approach is to first embed nodes in a way that depends on their neighbors’ features, ϕ i = ϕ
Revised: The conventional approach is to first embed nodes in a way that depends on their neighbors’ features, ϕ i = ϕ

Original: ( x i ; x nei( i ) ) , and then perform classification (typically linear) in embedded space, ˆ y i
Revised: ( x i ; x nei( i ) ) , and then perform classification (typically linear) in embedded space, ˆ y i

Original: =
Revised: =

Original: sign( w ⊤ ϕ i ) .
Revised: sign( w ⊤ ϕ i ) .

Original: Notice ˆ
Revised: Notice ˆ

Original: y
Revised: y

Original: i depends on x i , but also on all other x j ∈ x nei( i ) ; hence, in deciding how to respond, user i must also account for the strategic responses of her neighbors j ∈ nei( i ) .
Revised: i depends on x i , but also on all other x j ∈ x nei( i ) ; hence, in deciding how to respond, user i must also account for the strategic responses of her neighbors j ∈ nei( i ) .

Original: We aim to establish the affects of such dependencies on learning.
Revised: We aim to establish the affects of such dependencies on learning.

Original: As a concrete example, consider Lenddo 1 , a company that provides credit scoring services to lending institutions.
Revised: As a concrete example, consider Lenddo 1 , a company that provides credit scoring services to lending institutions.

Original: Lenddo specializes in consumer-focused microlending for emerging economies, where many applicants lack credible financial records.
Revised: Lenddo specializes in consumer-focused microlending for emerging economies, where many applicants lack credible financial records.

Original: To circumvent the need to rely on historical records,
Revised: To circumvent the need to rely on historical records,

Original: Lenddo uses applicants’ social connections, which are easier to obtain, as a factor in their scoring system.
Revised: Lenddo uses applicants’ social connections, which are easier to obtain, as a factor in their scoring system.

Original: 2 As an algorithmic approach for this task, GNNs are an adequate choice (Gao et al., 2021).
Revised: 2 As an algorithmic approach for this task, GNNs are an adequate choice (Gao et al., 2021).

Original: Once loan decisions become dependent on social relations, the incentives for acting strategically change (Wei et al., 2016).
Revised: Once loan decisions become dependent on social relations, the incentives for acting strategically change (Wei et al., 2016).

Original: To see how, consider that a user who lies far to the negative side of the decision boundary (and so independently cannot cross) may benefit from the graph if her neighbors “pull” her embedding towards the decision boundary and close enough for her to cross.
Revised: To see how, consider that a user who lies far to the negative side of the decision boundary (and so independently cannot cross) may benefit from the graph if her neighbors “pull” her embedding towards the decision boundary and close enough for her to cross.

Original: Conversely, the graph can also suppress strategic behavior, since neighbors can “hold back” nodes and prevent them from crossing.
Revised: Conversely, the graph can also suppress strategic behavior, since neighbors can “hold back” nodes and prevent them from crossing.

Original: Whether this is helpful to the system or not depends on the true label of the node.
Revised: Whether this is helpful to the system or not depends on the true label of the node.

Original: This presents a tradeoff:
Revised: This presents a tradeoff:

Original: In general, graphs are useful if they are informative of labels in a way that complements features; the many success stories of GNNs suggest that this is often the case (Zhou et al., 2020).
Revised: In general, graphs are useful if they are informative of labels in a way that complements features; the many success stories of GNNs suggest that this is often the case (Zhou et al., 2020).

Original: But even if this holds sans strategic behavior—once introduced, graphs inadvertently create dependencies through user representations, which strategic users can exploit.
Revised: But even if this holds sans strategic behavior—once introduced, graphs inadvertently create dependencies through user representations, which strategic users can exploit.

Original: Graphs therefore hold the potential to benefit the system, but also its users.
Revised: Graphs therefore hold the potential to benefit the system, but also its users.

Original: Here we study the natural question: who does the graph help more?
Revised: Here we study the natural question: who does the graph help more?

Original: Through analysis and experimentation, we show that learning in a way that neglects to account for strategic behavior not only jeopardizes performance, but becomes worse as reliance on the graph increases.
Revised: Through analysis and experimentation, we show that learning in a way that neglects to account for strategic behavior not only jeopardizes performance, but becomes worse as reliance on the graph increases.

Original: In this sense, the graph becomes a vulnerability which users can utilize for their needs, turning it from an asset to the system—to a potential threat.
Revised: In this sense, the graph becomes a vulnerability which users can utilize for their needs, turning it from an asset to the system—to a potential threat.

Original: As a solution, we propose a practical approach to learning GNNs in strategic environments.
Revised: As a solution, we propose a practical approach to learning GNNs in strategic environments.

Original: We show that for a key neural architecture (SGC; Wu et al.
Revised: We show that for a key neural architecture (SGC; Wu et al.

Original: and certain cost functions, graph-dependent user responses can be expressed as a ‘projection-like’ operator.
Revised: and certain cost functions, graph-dependent user responses can be expressed as a ‘projection-like’ operator.

Original: This operator admits a simple and differentiable closed form; with additional smoothing, this allows us to implement responses as a neural layer, and learn robust predictors h using gradient methods.
Revised: This operator admits a simple and differentiable closed form; with additional smoothing, this allows us to implement responses as a neural layer, and learn robust predictors h using gradient methods.

Original: Experiments on synthetic and real data (with simulated responses) demonstrate that our approach not only effectively accounts for strategic behavior, but in some cases, can harness the efforts of self-interested users to promote the system’s goals.
Revised: Experiments on synthetic and real data (with simulated responses) demonstrate that our approach not only effectively accounts for strategic behavior, but in some cases, can harness the efforts of self-interested users to promote the system’s goals.

Original: Our code is publicly available at: http://github.com/StrategicGNNs/Code.
Revised: Our code is publicly available at: http://github.com/StrategicGNNs/Code.

Original: 1. R ELATED WORK
Revised: 1. R ELATED WORK

Original: Strategic classification.
Revised: Strategic classification.

Original: Since its introduction in Hardt et al.
Revised: Since its introduction in Hardt et al.

Original: (and based on earlier formulations in Brückner & Scheffer (2009); Brückner et al.
Revised: (and based on earlier formulations in Brückner & Scheffer (2009); Brückner et al.

Original: ; Großhans et al.
Revised: ; Großhans et al.

Original: , the literature on strategic classification has been growing at a rapid pace.
Revised: , the literature on strategic classification has been growing at a rapid pace.

Original: Various aspects of learning have been studied, including: generalization behavior (Zhang & Conitzer, 2021; Sundaram et al., 2021;
Revised: Various aspects of learning have been studied, including: generalization behavior (Zhang & Conitzer, 2021; Sundaram et al., 2021;

Original: Ghalme et al., 2021), algorithmic hardness (Hardt et al., 2016), practical optimization methods (Levanon &
Revised: Ghalme et al., 2021), algorithmic hardness (Hardt et al., 2016), practical optimization methods (Levanon &

Original: Rosenfeld, 2021; 2022), and societal implications (Milli et al., 2019; Hu et al., 2019; Chen et al., 2020; Levanon & Rosenfeld, 2021).
Revised: Rosenfeld, 2021; 2022), and societal implications (Milli et al., 2019; Hu et al., 2019; Chen et al., 2020; Levanon & Rosenfeld, 2021).

Original: Some efforts have been made to extend beyond the conventional user models, e.g., by adding noise (Jagadeesan et al., 2021), relying on partial information (Ghalme et al., 2021; Bechavod et al., 2022), or considering broader user interests (Levanon & Rosenfeld, 2022); but these, as do the vast majority of other works, focus on linear classifiers and independent user responses.
Revised: Some efforts have been made to extend beyond the conventional user models, e.g., by adding noise (Jagadeesan et al., 2021), relying on partial information (Ghalme et al., 2021; Bechavod et al., 2022), or considering broader user interests (Levanon & Rosenfeld, 2022); but these, as do the vast majority of other works, focus on linear classifiers and independent user responses.

Original: 3 We study richer predictive model classes that lead to correlated user behavior.
Revised: 3 We study richer predictive model classes that lead to correlated user behavior.

Original: Graph Neural Networks (GNNs).
Revised: Graph Neural Networks (GNNs).

Original: The use of graphs in learning has a long and rich history, and remains a highly active area of research (Wu et al., 2020).
Revised: The use of graphs in learning has a long and rich history, and remains a highly active area of research (Wu et al., 2020).

Original: Here we cover a small subset of relevant work.
Revised: Here we cover a small subset of relevant work.

Original: The key idea underlying most methods is to iteratively propagate and aggregate information from neighboring nodes.
Revised: The key idea underlying most methods is to iteratively propagate and aggregate information from neighboring nodes.

Original: Modern approaches implement variations of this idea as differentiable neural architectures (Gori et al., 2005; Scarselli et al., 2008; Kipf & Welling, 2017; Gilmer et al., 2017).
Revised: Modern approaches implement variations of this idea as differentiable neural architectures (Gori et al., 2005; Scarselli et al., 2008; Kipf & Welling, 2017; Gilmer et al., 2017).

Original: This allows to express more elaborate forms of propagation (Li et al., 2018;
Revised: This allows to express more elaborate forms of propagation (Li et al., 2018;

Original: Alon & Yahav, 2021) and aggregation (Wu et al., 2019; Xu et al., 2019; Li et al., 2016), including attention-based mechanisms (Veliˇckovi´c et al., 2018; Brody et al., 2022).
Revised: Alon & Yahav, 2021) and aggregation (Wu et al., 2019; Xu et al., 2019; Li et al., 2016), including attention-based mechanisms (Veliˇckovi´c et al., 2018; Brody et al., 2022).

Original: Nonetheless, a key result by Wu et al.
Revised: Nonetheless, a key result by Wu et al.

Original: (2019) shows that, both theoretically and empirically, linear GNNs are also quite expressive.
Revised: (2019) shows that, both theoretically and empirically, linear GNNs are also quite expressive.

Original: Robustness of GNNs.
Revised: Robustness of GNNs.

Original: As most other fields in deep learning, GNNs have been the target of recent inquiry as to their sensitivity to adversarial attacks.
Revised: As most other fields in deep learning, GNNs have been the target of recent inquiry as to their sensitivity to adversarial attacks.

Original: Common attacks include perturbing nodes, either in sets (Zügner et al., 2018; Zang et al., 2021) or individually (Finkelshtein et al., 2020).
Revised: Common attacks include perturbing nodes, either in sets (Zügner et al., 2018; Zang et al., 2021) or individually (Finkelshtein et al., 2020).

Original: Attacks can be applied before training (Zügner & Günnemann, 2019; Bojchevski & Günnemann, 2019; Li et al., 2021; Zhang & Zitnik, 2020) or at test-time (Szegedy et al., 2014; Goodfellow et al., 2015); our work corresponds to the latter.
Revised: Attacks can be applied before training (Zügner & Günnemann, 2019; Bojchevski & Günnemann, 2019; Li et al., 2021; Zhang & Zitnik, 2020) or at test-time (Szegedy et al., 2014; Goodfellow et al., 2015); our work corresponds to the latter.

Original: While there are connections between adversarial and strategic behavior (Sundaram et al., 2021), the key difference is that strategic behavior is not a zero-sum game; in some cases, incentives can even align (Levanon & Rosenfeld, 2022).
Revised: While there are connections between adversarial and strategic behavior (Sundaram et al., 2021), the key difference is that strategic behavior is not a zero-sum game; in some cases, incentives can even align (Levanon & Rosenfeld, 2022).

Original: Thus, system-user relations become more nuanced, and provide a degree of freedom in learning that does not exist in adversarial settings.
Revised: Thus, system-user relations become more nuanced, and provide a degree of freedom in learning that does not exist in adversarial settings.

Original:  L EARNING SETUP
Revised:  L EARNING SETUP

Original: Our setting includes n users, represented as nodes in a directed graph G =
Revised: Our setting includes n users, represented as nodes in a directed graph G =

Original: ( V, E ) with non-negative edge weights W = { w ij } ( i,j ) ∈ E , w ij ≥ 0 .
Revised: ( V, E ) with non-negative edge weights W = { w ij } ( i,j ) ∈ E , w ij ≥ 0 .

Original: Each user i is also described by a feature vector x i ∈ R ℓ and a binary label y i ∈ {± 1 } .
Revised: Each user i is also described by a feature vector x i ∈ R ℓ and a binary label y i ∈ {± 1 } .

Original: We use x − i = { x j } j ̸ =
Revised: We use x − i = { x j } j ̸ =

Original: i to denote the set of features of all nodes other than i .
Revised: i to denote the set of features of all nodes other than i .

Original: Using the graph, our goal is to learn a classifier h that correctly predicts user labels.
Revised: Using the graph, our goal is to learn a classifier h that correctly predicts user labels.

Original: The challenge in our strategic setting is that inputs at test-time can be strategically modified by users, in response to h and in a way that depends on the graph and on other users (we describe this shortly).
Revised: The challenge in our strategic setting is that inputs at test-time can be strategically modified by users, in response to h and in a way that depends on the graph and on other users (we describe this shortly).

Original: Denoting by x hi the (possibly modified) strategic response of i to h , our learning objective is:
Revised: Denoting by x hi the (possibly modified) strategic response of i to h , our learning objective is:

Original: [Equation]
Revised: [Equation]

Original: where H is the model class and L is a loss function (i.e., log-loss).
Revised: where H is the model class and L is a loss function (i.e., log-loss).

Original: Note that both predictions ˆ y i and modified features x hi can depend on G and on on x h − i (possibly indirectly through h ).
Revised: Note that both predictions ˆ y i and modified features x hi can depend on G and on on x h − i (possibly indirectly through h ).

Original: We focus on the inductive graph learning setting, in which training is done on G , but testing is done on a different graph, G ′ (often G, G ′ are two disjoint components of a larger graph).
Revised: We focus on the inductive graph learning setting, in which training is done on G , but testing is done on a different graph, G ′ (often G, G ′ are two disjoint components of a larger graph).

Original: Our goal is therefore to learn a classifier that generalizes to other graphs in a way that is robust to strategic user behavior.
Revised: Our goal is therefore to learn a classifier that generalizes to other graphs in a way that is robust to strategic user behavior.

Original: Graph-based learning.
Revised: Graph-based learning.

Original: We consider linear graph-based classifiers—these are linear classifiers that operate on linear, graph-dependent node embeddings, defined as:
Revised: We consider linear graph-based classifiers—these are linear classifiers that operate on linear, graph-dependent node embeddings, defined as:

Original: [Equation]
Revised: [Equation]

Original: where ϕ i = ϕ
Revised: where ϕ i = ϕ

Original: ( x i ; x − i ) is node i ’s embedding, 4 θ ∈ R ℓ and b ∈ R are learned parameters, and (cid:101) w ij ≥ 0 are pairwise weights that depend on G and W .
Revised: ( x i ; x − i ) is node i ’s embedding, 4 θ ∈ R ℓ and b ∈ R are learned parameters, and (cid:101) w ij ≥ 0 are pairwise weights that depend on G and W .

Original: We refer to users j with (cid:101) w ji ̸ = 0 as the embedding neighbors of i .
Revised: We refer to users j with (cid:101) w ji ̸ = 0 as the embedding neighbors of i .

Original: A simple choice of weights is (cid:101) w ji = w ji for ( j, i ) ∈ E (and 0 otherwise), but different methods propose different ways to construct (cid:101) w ; here we adopt the weight scheme of Wu et al.
Revised: A simple choice of weights is (cid:101) w ji = w ji for ( j, i ) ∈ E (and 0 otherwise), but different methods propose different ways to construct (cid:101) w ; here we adopt the weight scheme of Wu et al.

Original: We assume the weights (cid:101) w are predetermined, and aim to learn θ and b in Eq.
Revised: We assume the weights (cid:101) w are predetermined, and aim to learn θ and b in Eq.

Original: Our focus on linear GNNs stems from several factors.
Revised: Our focus on linear GNNs stems from several factors.

Original: From the perspective of strategic classification, linear decision rules ensure that strategic responses are computationally tractable (see Eq.
Revised: From the perspective of strategic classification, linear decision rules ensure that strategic responses are computationally tractable (see Eq.

Original: This is conventionally required, and most works remain in the linear regime.
Revised: This is conventionally required, and most works remain in the linear regime.

Original: From the perspective of GNNs,
Revised: From the perspective of GNNs,

Original: [Figure]
Revised: [Figure]

Original: linear architectures have been shown to match state-of-the-art performance on multiple tasks (Wu et al., 2019), implying sufficiently manifest the fundamental role of graphs.
Revised: linear architectures have been shown to match state-of-the-art performance on multiple tasks (Wu et al., 2019), implying sufficiently manifest the fundamental role of graphs.

Original: Thus, linear GNNs serve as a minimal necessary step for bridging standard strategic classification and graph-based learning, in a way that captures the fundamental structure of the learning task in both domains.
Revised: Thus, linear GNNs serve as a minimal necessary step for bridging standard strategic classification and graph-based learning, in a way that captures the fundamental structure of the learning task in both domains.

Original: Nonetheless, as we show in Sec. 4, even for linear GNNs—user responses can cause learning to be highly non-linear.
Revised: Nonetheless, as we show in Sec. 4, even for linear GNNs—user responses can cause learning to be highly non-linear.

Original: Strategic inputs.
Revised: Strategic inputs.

Original: For the strategic aspects of our setting, we build on the popular formulation of
Revised: For the strategic aspects of our setting, we build on the popular formulation of

Original: Hardt et al.
Revised: Hardt et al.

Original: Users seek to be classified positively (i.e., have ˆ y i = 1 ), and to achieve this, are willing to modify their features (at some cost).
Revised: Users seek to be classified positively (i.e., have ˆ y i = 1 ), and to achieve this, are willing to modify their features (at some cost).

Original: Once the system has learned and published h , a test-time user i can modify her features x i (cid:55)→ x ′ i in response to h .
Revised: Once the system has learned and published h , a test-time user i can modify her features x i (cid:55)→ x ′ i in response to h .

Original: Modification costs are defined by a cost function c ( x, x ′ )
Revised: Modification costs are defined by a cost function c ( x, x ′ )

Original: (known to all); here we focus mainly on 2-norm costs c ( x, x ′ ) =
Revised: (known to all); here we focus mainly on 2-norm costs c ( x, x ′ ) =

Original: ∥ x − x ′ ∥(Levanon & Rosenfeld, 2022; Chen et al., 2020), but also discuss other costs (Brückner et al., 2012;
Revised: ∥ x − x ′ ∥(Levanon & Rosenfeld, 2022; Chen et al., 2020), but also discuss other costs (Brückner et al., 2012;

Original: Levanon & Rosenfeld, 2021; Bechavod et al., 2022).
Revised: Levanon & Rosenfeld, 2021; Bechavod et al., 2022).

Original: User i modifies her features (or “moves”) if this improves her prediction (i.e., if h ( x i ) = − 1 but h ( x ′ i ) = 1 ) and is cost-effective (i.e., prediction gains exceed modification costs); for linear classifiers, this means crossing the decision boundary.
Revised: User i modifies her features (or “moves”) if this improves her prediction (i.e., if h ( x i ) = − 1 but h ( x ′ i ) = 1 ) and is cost-effective (i.e., prediction gains exceed modification costs); for linear classifiers, this means crossing the decision boundary.

Original: Note that since y ∈ {± 1 } , gains are at most h ( x ′ )
Revised: Note that since y ∈ {± 1 } , gains are at most h ( x ′ )

Original: − h ( x ) = 2 .
Revised: − h ( x ) = 2 .

Original: Users therefore do not move to any x ′ whose cost c ( x, x ′ ) exceeds a ‘budget’ of 2 , and the maximal moving distance is d = 2 .
Revised: Users therefore do not move to any x ′ whose cost c ( x, x ′ ) exceeds a ‘budget’ of 2 , and the maximal moving distance is d = 2 .

Original: Distribution shift.
Revised: Distribution shift.

Original: One interpretation of strategic classification is that user responses cause distribution shift , since in aggregate, p ( x ′ )
Revised: One interpretation of strategic classification is that user responses cause distribution shift , since in aggregate, p ( x ′ )

Original: ̸
Revised: ̸

Original: = p ( x ) .
Revised: = p ( x ) .

Original: Crucially, how the distribution changes depends on h , which implies that the system has some control over the test distribution p ( x ′ ) , indirectly through user how users respond—a special case of model-induced distribution shift (Miller et al., 2021;
Revised: Crucially, how the distribution changes depends on h , which implies that the system has some control over the test distribution p ( x ′ ) , indirectly through user how users respond—a special case of model-induced distribution shift (Miller et al., 2021;

Original: Maheshwari et al., 2022).
Revised: Maheshwari et al., 2022).

Original: The unique aspect of our setting is that user responses are linked through their mutual dependence on the graph.
Revised: The unique aspect of our setting is that user responses are linked through their mutual dependence on the graph.

Original: We next describe our model of user responses in detail.
Revised: We next describe our model of user responses in detail.

Original:  S TRATEGIC USER BEHAVIOR : MODEL AND ANALYSIS
Revised:  S TRATEGIC USER BEHAVIOR : MODEL AND ANALYSIS

Original: Eq.
Revised: Eq.

Original: (2) states that h classifies i according to her embedding ϕ i , which in turn is a weighted sum of her features and those of her neighbors.
Revised: (2) states that h classifies i according to her embedding ϕ i , which in turn is a weighted sum of her features and those of her neighbors.

Original: To gain intuition as to the effects of the graph on user behavior, it will be convenient to assume weights (cid:101) w are normalized 5 so that we can write:
Revised: To gain intuition as to the effects of the graph on user behavior, it will be convenient to assume weights (cid:101) w are normalized 5 so that we can write:

Original: [Equation]
Revised: [Equation]

Original: I.e., ϕ i can be viewed as an interpolation between x i and some point ¯ x i ∈ R ℓ representing all other nodes, where the precise point along the line depends on a parameter α i that represents the influence of the graph (in a graph-free setting, α i = 0 ).
Revised: I.e., ϕ i can be viewed as an interpolation between x i and some point ¯ x i ∈ R ℓ representing all other nodes, where the precise point along the line depends on a parameter α i that represents the influence of the graph (in a graph-free setting, α i = 0 ).

Original: This reveals the dual effect a graph has on users:
Revised: This reveals the dual effect a graph has on users:

Original: On the one hand, the graph limits the ability of user i to influence her own embedding, since any effort invested in modifying x i affects ϕ
Revised: On the one hand, the graph limits the ability of user i to influence her own embedding, since any effort invested in modifying x i affects ϕ

Original: i by at most 1 − α i .
Revised: i by at most 1 − α i .

Original: But the flip side of this is that an α i -portion of ϕ
Revised: But the flip side of this is that an α i -portion of ϕ

Original: i is fully determined by other users (as expressed in ¯ x i ); if they move, i ’s embedding also ‘moves’ for free.
Revised: i is fully determined by other users (as expressed in ¯ x i ); if they move, i ’s embedding also ‘moves’ for free.

Original: A user’s ‘effective’ movement radius is r i =
Revised: A user’s ‘effective’ movement radius is r i =

Original: d (1 − α i ) .
Revised: d (1 − α i ) .

Original: Fig.
Revised: Fig.

Original: 1 (F) shows this for varying α i .
Revised: 1 (F) shows this for varying α i .

Original: 3. S TRATEGIC RESPONSES
Revised: 3. S TRATEGIC RESPONSES

Original: Given that h relies on the graph for predictions—how should a user modify her features x i to obtain ˆ y i = 1 ?
Revised: Given that h relies on the graph for predictions—how should a user modify her features x i to obtain ˆ y i = 1 ?

Original: In vanilla strategic classification (where h operates on each x i independently), users are modeled as rational agents that respond to the classifier by maximizing their utility, i.e., play x ′ i = argmax x ′ h ( x ′ )
Revised: In vanilla strategic classification (where h operates on each x i independently), users are modeled as rational agents that respond to the classifier by maximizing their utility, i.e., play x ′ i = argmax x ′ h ( x ′ )

Original: − c ( x i , x ′ ) , which is a best-response that results in immediate equilibrium (users have no incentive to move, and the system has no incentive to change h ).
Revised: − c ( x i , x ′ ) , which is a best-response that results in immediate equilibrium (users have no incentive to move, and the system has no incentive to change h ).

Original: In our graph-based setting, however, the dependence of ˆ y i on all other users via h ( x i ; x − i ) makes this notion of bestresponse ill-defined, since the optimal x ′ i can depend on others’ strategic responses,
Revised: In our graph-based setting, however, the dependence of ˆ y i on all other users via h ( x i ; x − i ) makes this notion of bestresponse ill-defined, since the optimal x ′ i can depend on others’ strategic responses,

Original: x ′− i , which are unknown to user i at the time of decision (and may very well rely on x ′ i itself).
Revised: x ′− i , which are unknown to user i at the time of decision (and may very well rely on x ′ i itself).

Original: As a feasible alternative, here we generalize the standard model by assuming that users play myopic best-response over a sequence of multiple update rounds.
Revised: As a feasible alternative, here we generalize the standard model by assuming that users play myopic best-response over a sequence of multiple update rounds.

Original: As we will see, this has direct connections to key ideas underlying graph neural networks.
Revised: As we will see, this has direct connections to key ideas underlying graph neural networks.

Original: Denote the features of node i at round t by x ( t ) i , and set x (0) i = x i .
Revised: Denote the features of node i at round t by x ( t ) i , and set x (0) i = x i .

Original: A myopic best response means that at round t , each user i chooses x ( t ) i to maximize her utility at time t according to the state of the game at time t − 1 , i.e., assuming all other users play { x ( t − 1)
Revised: A myopic best response means that at round t , each user i chooses x ( t ) i to maximize her utility at time t according to the state of the game at time t − 1 , i.e., assuming all other users play { x ( t − 1)

Original: j } j ̸
Revised: j } j ̸

Original: = i , with costs accumulating over rounds.
Revised: = i , with costs accumulating over rounds.

Original: This defines a myopic response mapping :
Revised: This defines a myopic response mapping :

Original: [Equation]
Revised: [Equation]

Original: (4) where at round t updates are made (concurrently) via x ( t +1) i =
Revised: (4) where at round t updates are made (concurrently) via x ( t +1) i =

Original: ∆ h ( x ( t ) i ; x ( t ) − i , κ ( t ) i ) with accumulating costs κ ( t ) i = κ ( t − 1) i + c
Revised: ∆ h ( x ( t ) i ; x ( t ) − i , κ ( t ) i ) with accumulating costs κ ( t ) i = κ ( t − 1) i + c

Original: ( x ( t − 1)
Revised: ( x ( t − 1)

Original: i , x ( t ) i ) , κ (0) i
Revised: i , x ( t ) i ) , κ (0) i

Original: = 0 .
Revised: = 0 .

Original: Predictions for round t are ˆ y ( t ) i
Revised: Predictions for round t are ˆ y ( t ) i

Original: = h ( x ( t ) i ; x ( t ) i − i ) .
Revised: = h ( x ( t ) i ; x ( t ) i − i ) .

Original: Eq.
Revised: Eq.

Original: (4) naturally extends the standard best-response mapping (which is recovered when α i =
Revised: (4) naturally extends the standard best-response mapping (which is recovered when α i =

Original: 0 ∀ i , and converges after one round).
Revised: 0 ∀ i , and converges after one round).

Original: By adding a temporal dimension, the actions of users propagate over the graph and in time to affect others.
Revised: By adding a temporal dimension, the actions of users propagate over the graph and in time to affect others.

Original: Nonetheless, even within a single round, graph-induced dependencies can result in non-trivial behavior; some examples for ℓ = 1 are given in Fig.
Revised: Nonetheless, even within a single round, graph-induced dependencies can result in non-trivial behavior; some examples for ℓ = 1 are given in Fig.

Original: 1 (A-D).
Revised: 1 (A-D).

Original: 3. A NALYSIS
Revised: 3. A NALYSIS

Original: We now give several results demonstrating basic properties of our response model and consequent dynamics, which shed light on how the graph differentially affects the system and its users.
Revised: We now give several results demonstrating basic properties of our response model and consequent dynamics, which shed light on how the graph differentially affects the system and its users.

Original: Convergence.
Revised: Convergence.

Original: Although users are free to move at will, movement adheres to a certain useful pattern.
Revised: Although users are free to move at will, movement adheres to a certain useful pattern.

Original: Proposition 1.
Revised: Proposition 1.

Original: For any h , if users move via Eq.
Revised: For any h , if users move via Eq.

Original: (4) , then for all i ∈ [ n ] , x ( t ) i ̸
Revised: (4) , then for all i ∈ [ n ] , x ( t ) i ̸

Original: = x ( t − 1) i at most once.
Revised: = x ( t − 1) i at most once.

Original: Proof.
Revised: Proof.

Original: User i will move only when: (i) she is currently classified negatively, h ( x i ; x i − )
Revised: User i will move only when: (i) she is currently classified negatively, h ( x i ; x i − )

Original: = − 1 , and (ii) there is some x ′ for which utility can improve, i.e., h ( x ′ ; x
Revised: = − 1 , and (ii) there is some x ′ for which utility can improve, i.e., h ( x ′ ; x

Original: i − ) − c ( x i , x ′ ) > − 1 , which in our case occurs if h ( x ′ ; x i − ) = 1 and c ( x i , x ′ ) <
Revised: i − ) − c ( x i , x ′ ) > − 1 , which in our case occurs if h ( x ′ ; x i − ) = 1 and c ( x i , x ′ ) <

Original: 2 (since h maps to [ − 1 , 1] ).
Revised: 2 (since h maps to [ − 1 , 1] ).

Original: 7 Eq.
Revised: 7 Eq.

Original: (4) ensures that the modified x ′ i will be such that ϕ ( x ′ i ; x − i ) lies exactly on the decision boundary of h ; hence, x ′ i must be closer to the decision boundary (in Euclidian distance) than x i .
Revised: (4) ensures that the modified x ′ i will be such that ϕ ( x ′ i ; x − i ) lies exactly on the decision boundary of h ; hence, x ′ i must be closer to the decision boundary (in Euclidian distance) than x i .

Original: This means that any future moves of an (incoming) neighbor j can only push i further away from the decision boundary; hence, the prediction for i remains positive, and she has no future incentive to move again.
Revised: This means that any future moves of an (incoming) neighbor j can only push i further away from the decision boundary; hence, the prediction for i remains positive, and she has no future incentive to move again.

Original: Hence, all users move at most once.
Revised: Hence, all users move at most once.

Original: The proof reveals a certain monotonicity principle: users always (weakly) benefit from any strategic movement of others.
Revised: The proof reveals a certain monotonicity principle: users always (weakly) benefit from any strategic movement of others.

Original: Convergence follows as an immediate result.
Revised: Convergence follows as an immediate result.

Original: Corollary 1.
Revised: Corollary 1.

Original: Myopic-best response dynamics converge for any h (and after at most n rounds).
Revised: Myopic-best response dynamics converge for any h (and after at most n rounds).

Original: We will henceforth use x hi to denote the features of user i at convergence (w.r.t. h ), denoted T max .
Revised: We will henceforth use x hi to denote the features of user i at convergence (w.r.t. h ), denoted T max .

Original: Hitchhiking.
Revised: Hitchhiking.

Original: When i moves, the embeddings of (outgoing) neighbors j who currently have ˆ y j
Revised: When i moves, the embeddings of (outgoing) neighbors j who currently have ˆ y j

Original: = −also move closer to the decision boundary; thus, users who were initially too far to cross may be able to do so at later rounds.
Revised: = −also move closer to the decision boundary; thus, users who were initially too far to cross may be able to do so at later rounds.

Original: In this sense, the dependencies across users introduced by the graph-dependent embeddings align user incentives, and promote an implicit form of cooperation.
Revised: In this sense, the dependencies across users introduced by the graph-dependent embeddings align user incentives, and promote an implicit form of cooperation.

Original: Interestingly, users can also obtain positive predictions without moving.
Revised: Interestingly, users can also obtain positive predictions without moving.

Original: We refer to such users as ‘hitchhikers’.
Revised: We refer to such users as ‘hitchhikers’.

Original: Proposition 2.
Revised: Proposition 2.

Original: There exist cases where ˆ y ( t ) i = − 

Revised: There exist cases where ˆ y ( t ) i = −

Original: and i doesn’t move, but ˆ
Revised: and i doesn’t move, but ˆ

Original: [Equation]
Revised: [Equation]

Original: A simple example can be found in Figure 1 (E).
Revised: A simple example can be found in Figure 1 (E).

Original: Hitchhiking demonstrates how relying on the graph for classification can promote strategic behavior—even under a single response round.
Revised: Hitchhiking demonstrates how relying on the graph for classification can promote strategic behavior—even under a single response round.

Original: Cascading behavior.
Revised: Cascading behavior.

Original: Hitchhiking shows how the movement of one user can flip the label of another, but the effects of this process are constrained to a single round.
Revised: Hitchhiking shows how the movement of one user can flip the label of another, but the effects of this process are constrained to a single round.

Original: When considering multiple rounds, a single node can trigger a ‘domino effect’ of moves that span the entire sequence.
Revised: When considering multiple rounds, a single node can trigger a ‘domino effect’ of moves that span the entire sequence.

Original: Proposition 3.
Revised: Proposition 3.

Original: For any n , there exists a graph where a single move triggers n additional rounds.
Revised: For any n , there exists a graph where a single move triggers n additional rounds.

Original: Proposition 4.
Revised: Proposition 4.

Original: For any n and k ≤ n , there exists a graph where n − k users move at round k .
Revised: For any n and k ≤ n , there exists a graph where n − k users move at round k .

Original: Proofs are constructive and modular, and rely on graphs that are predictively useful (Appendix A.2).
Revised: Proofs are constructive and modular, and rely on graphs that are predictively useful (Appendix A.2).

Original: Note also that graph diameter is not a mediating factor (Appendix E.3).
Revised: Note also that graph diameter is not a mediating factor (Appendix E.3).

Original: Both results show that, through monotonicity, users also (weakly) benefit from additional rounds.
Revised: Both results show that, through monotonicity, users also (weakly) benefit from additional rounds.

Original: This has concrete implications.
Revised: This has concrete implications.

Original: Corollary 2.
Revised: Corollary 2.

Original: In the worst case, the number of rounds until convergence is Ω( n ) .
Revised: In the worst case, the number of rounds until convergence is Ω( n ) .

Original: Corollary 3.
Revised: Corollary 3.

Original: In the worst case, Ω( n ) users move after Ω( n ) rounds.
Revised: In the worst case, Ω( n ) users move after Ω( n ) rounds.

Original: Thus, to exactly account for user behavior, the system must correctly anticipate the strategic responses of users many rounds into the future, since a bulk of predictions may flip in the last round.
Revised: Thus, to exactly account for user behavior, the system must correctly anticipate the strategic responses of users many rounds into the future, since a bulk of predictions may flip in the last round.

Original: Fortunately, these results also suggests that in some cases, blocking one node from crossing can prevent a cascade of flips; thus, it may be worthwhile to ‘sacrifice’ certain predictions for collateral gains.
Revised: Fortunately, these results also suggests that in some cases, blocking one node from crossing can prevent a cascade of flips; thus, it may be worthwhile to ‘sacrifice’ certain predictions for collateral gains.

Original: This presents an interesting tradeoff in learning, encoded in the learning objective we present next, and which we motivate with our final result on the potential impact of strategic behavior:
Revised: This presents an interesting tradeoff in learning, encoded in the learning objective we present next, and which we motivate with our final result on the potential impact of strategic behavior:

Original: Proposition 5.
Revised: Proposition 5.

Original: The gap in accuracy between (i) the optimal non-strategic classifier on non-strategic data, and (ii) the optimal strategic classifier on strategic data, can be as large as 30% (see Apx.
Revised: The gap in accuracy between (i) the optimal non-strategic classifier on non-strategic data, and (ii) the optimal strategic classifier on strategic data, can be as large as 30% (see Apx.

Original: E.1).
Revised: E.1).

Original:  L EARNING AND OPTIMIZATION
Revised:  L EARNING AND OPTIMIZATION

Original: We are now ready to describe our learning approach.
Revised: We are now ready to describe our learning approach.

Original: Our learning objective can be restated as:
Revised: Our learning objective can be restated as:

Original: [Equation]
Revised: [Equation]

Original: for H
Revised: for H

Original: = { h θ,b } as in Eq.
Revised: = { h θ,b } as in Eq.

Original: The difficulty in optimizing Eq.
Revised: The difficulty in optimizing Eq.

Original: (5) is that x h depend on h through the iterative process, which relies on ∆ h .
Revised: (5) is that x h depend on h through the iterative process, which relies on ∆ h .

Original: At test time, x h can be computed exactly by simulating the dynamics.
Revised: At test time, x h can be computed exactly by simulating the dynamics.

Original: However, at train time, we would like to allow for gradients of θ, b to propagate through x h .
Revised: However, at train time, we would like to allow for gradients of θ, b to propagate through x h .

Original: For this, we propose an efficient differential proxy of x h , implemented as a stack of layers, each corresponding to one response round.
Revised: For this, we propose an efficient differential proxy of x h , implemented as a stack of layers, each corresponding to one response round.

Original: The number of layers is a hyperparameter, T .
Revised: The number of layers is a hyperparameter, T .

Original: Single round.
Revised: Single round.

Original: We begin with examining a single iteration of the dynamics, i.e., T = 1 .
Revised: We begin with examining a single iteration of the dynamics, i.e., T = 1 .

Original: Note that since a user moves only if the cost is at most 2, Eq.
Revised: Note that since a user moves only if the cost is at most 2, Eq.

Original: (4) can be rewritten as:
Revised: (4) can be rewritten as:

Original: [Equation]
Revised: [Equation]

Original: where x ′ i =
Revised: where x ′ i =

Original: proj h
Revised: proj h

Original: ( x i ; x − i ) is the point to which x i must move in order for ϕ ( x i ; x − i ) to be projected onto h .
Revised: ( x i ; x − i ) is the point to which x i must move in order for ϕ ( x i ; x − i ) to be projected onto h .

Original: This projection-like operator (on x i ) can be shown to have a closed-form solution:
Revised: This projection-like operator (on x i ) can be shown to have a closed-form solution:

Original: [Equation] [Equation]
Revised: [Equation] [Equation]

Original: See Appendix B.1 for a derivation using KKT conditions.
Revised: See Appendix B.1 for a derivation using KKT conditions.

Original: Eq.
Revised: Eq.

Original: (7) is differentiable in θ and b ; to make the entire response mapping differentiable, we replace the ‘hard if’ in Eq.
Revised: (7) is differentiable in θ and b ; to make the entire response mapping differentiable, we replace the ‘hard if’ in Eq.

Original: (6) with a ‘soft if’, which we now describe.
Revised: (6) with a ‘soft if’, which we now describe.

Original: First, to account only for negatively-classified points, we ensure that only points in the negative halfspace are projected via a ‘positive-only’ projection:
Revised: First, to account only for negatively-classified points, we ensure that only points in the negative halfspace are projected via a ‘positive-only’ projection:

Original: [Equation]
Revised: [Equation]

Original: [Figure]
Revised: [Figure]

Original: Then, we replace the c ≤ 2 constraint with a smoothed sigmoid that interpolates between x i and the projection, as a function of the cost of the projection and thresholded at 2.
Revised: Then, we replace the c ≤ 2 constraint with a smoothed sigmoid that interpolates between x i and the projection, as a function of the cost of the projection and thresholded at 2.

Original: This gives our differentiable approximation of the response mapping:
Revised: This gives our differentiable approximation of the response mapping:

Original: [Equation]
Revised: [Equation]

Original: x
Revised: x

Original: [Equation]
Revised: [Equation]

Original: (9) where σ is a sigmoid and τ is a temperature hyperparameter ( τ → 0 recovers Eq.
Revised: (9) where σ is a sigmoid and τ is a temperature hyperparameter ( τ → 0 recovers Eq.

Original: (6)) and for T = 1 , κ = 0 .
Revised: (6)) and for T = 1 , κ = 0 .

Original: In practice we add a small additive tolerance term for numerical stability (See Appendix B.3).
Revised: In practice we add a small additive tolerance term for numerical stability (See Appendix B.3).

Original: Multiple rounds.
Revised: Multiple rounds.

Original: Next, we consider the computation of (approximate) modified features after T >rounds, denoted ˜ x
Revised: Next, we consider the computation of (approximate) modified features after T >rounds, denoted ˜ x

Original: ( T ) , in a differentiable manner.
Revised: ( T ) , in a differentiable manner.

Original: Our approach is to apply ˜∆ iteratively as:
Revised: Our approach is to apply ˜∆ iteratively as:

Original: [Equation]
Revised: [Equation]

Original: Considering ˜∆ as a layer in a neural network, approximating T rounds can be done by stacking.
Revised: Considering ˜∆ as a layer in a neural network, approximating T rounds can be done by stacking.

Original: In Eq.
Revised: In Eq.

Original: (10), κ ( t ) i is set to accumulate costs of approximate responses, κ ( t ) i = κ
Revised: (10), κ ( t ) i is set to accumulate costs of approximate responses, κ ( t ) i = κ

Original: [Equation]
Revised: [Equation]

Original: i
Revised: i

Original: [Equation]
Revised: [Equation]

Original: One observation is that for 2-norm costs, κ ( t ) i
Revised: One observation is that for 2-norm costs, κ ( t ) i

Original: =
Revised: =

Original: c (˜ x (0) i , ˜ x ( t ) i ) (by the triangle inequality; since all points move along a line, equality holds).
Revised: c (˜ x (0) i , ˜ x ( t ) i ) (by the triangle inequality; since all points move along a line, equality holds).

Original: We can therefore simplify Eq.
Revised: We can therefore simplify Eq.

Original: (9) and replace c ( x ( t − 1) i , x ′ i ) − κ ( t − 1)
Revised: (9) and replace c ( x ( t − 1) i , x ′ i ) − κ ( t − 1)

Original: i with c ( x (0) i , x ′ i ) .
Revised: i with c ( x (0) i , x ′ i ) .

Original: For other costs, this gives a lower bound (see Appendix B.1).
Revised: For other costs, this gives a lower bound (see Appendix B.1).

Original:  E XPERIMENTS 5. S YNTHETIC DATA
Revised:  E XPERIMENTS 5. S YNTHETIC DATA

Original: We begin our empirical evaluation by demonstrating different aspects of learning in our setting using a simple but illustrative synthetic example.
Revised: We begin our empirical evaluation by demonstrating different aspects of learning in our setting using a simple but illustrative synthetic example.

Original: Additional results and insights on movement trends, the effects of movement on accuracy, and the importance of looking ahead, can be found in Appendix D.1.
Revised: Additional results and insights on movement trends, the effects of movement on accuracy, and the importance of looking ahead, can be found in Appendix D.1.

Original: For our experimental setup, we set ℓ = 1 and sample features x i ∈ R for each class from a corresponding Gaussian N ( y, 1) (classes are balanced).
Revised: For our experimental setup, we set ℓ = 1 and sample features x i ∈ R for each class from a corresponding Gaussian N ( y, 1) (classes are balanced).

Original: For each node, we uniformly sampleneighbors from the same class and 3 from the other, and use uniform weights.
Revised: For each node, we uniformly sampleneighbors from the same class and 3 from the other, and use uniform weights.

Original: This creates a task where both features and the graph are informative about labels, but only partially, and in a complementary manner (i.e., noise is uncorrelated; for i with y i
Revised: This creates a task where both features and the graph are informative about labels, but only partially, and in a complementary manner (i.e., noise is uncorrelated; for i with y i

Original: = 1 , if x i < 0 , it is still more likely that most neighbors have x j > 0 , and vice versa).
Revised: = 1 , if x i < 0 , it is still more likely that most neighbors have x j > 0 , and vice versa).

Original: As it is a-priori unclear how to optimally combine these sources, we study the effects of relying on the graph to various degrees by varying a global α , i.e., setting (cid:101) w ii =
Revised: As it is a-priori unclear how to optimally combine these sources, we study the effects of relying on the graph to various degrees by varying a global α , i.e., setting (cid:101) w ii =

Original: (1 − α ) and (cid:101) w ij = α/ deg i for all i and all j ̸
Revised: (1 − α ) and (cid:101) w ij = α/ deg i for all i and all j ̸

Original: = i .
Revised: = i .

Original: We examine both strategic and non-strategic settings, the latter serving as a benchmark.
Revised: We examine both strategic and non-strategic settings, the latter serving as a benchmark.

Original: Since ℓ = 1 , H = { h b } is simply the class of thresholds, hence we can scan all thresholds b and report learning outcomes for all models h b ∈ H .
Revised: Since ℓ = 1 , H = { h b } is simply the class of thresholds, hence we can scan all thresholds b and report learning outcomes for all models h b ∈ H .

Original: For non-strategic data, the optimal h ∗ has b ∗ ≈ 0 ; for strategic data, the optimal h ∗ can be found using line search.
Revised: For non-strategic data, the optimal h ∗ has b ∗ ≈ 0 ; for strategic data, the optimal h ∗ can be found using line search.

Original: Testing is done on disjoint but similarly sampled held-out features and graph.
Revised: Testing is done on disjoint but similarly sampled held-out features and graph.

Original: The effects of strategic behavior.
Revised: The effects of strategic behavior.

Original: Figure 2 (left) presents the accuracy of the learned ˆ h for varying α and in different settings.
Revised: Figure 2 (left) presents the accuracy of the learned ˆ h for varying α and in different settings.

Original: In a non-strategic setting (dashed gray), increasing α helps, but if reliance on the graph becomes exaggerated, performance deteriorates ( α ≈ 0 .
Revised: In a non-strategic setting (dashed gray), increasing α helps, but if reliance on the graph becomes exaggerated, performance deteriorates ( α ≈ 0 .

Original: 7 is optimal).
Revised: 7 is optimal).

Original: Allowing users to respond strategically reverses this result: for α = 0 (i.e., no graph), responses lower accuracy by
Revised: Allowing users to respond strategically reverses this result: for α = 0 (i.e., no graph), responses lower accuracy by

Original: [Table]
Revised: [Table]

Original: ≈ 0 .
Revised: ≈ 0 .

Original: 26 points; but as α is increased, the gap grows , this becoming more pronounced as test-time response rounds progress (blue lines).
Revised: 26 points; but as α is increased, the gap grows , this becoming more pronounced as test-time response rounds progress (blue lines).

Original: Interestingly, performance under strategic behavior is worst around the previously-optimal α ≈ 0 .
Revised: Interestingly, performance under strategic behavior is worst around the previously-optimal α ≈ 0 .

Original: This shows how learning in a strategic environment—but neglecting to account for strategic behavior—can be detrimental.
Revised: This shows how learning in a strategic environment—but neglecting to account for strategic behavior—can be detrimental.

Original: By accounting for user behavior, our approach (orange line) not only recovers performance, but slightly improves upon the non-strategic setting (this can occur when positive points are properly incentivized; see Appendix D.1).
Revised: By accounting for user behavior, our approach (orange line) not only recovers performance, but slightly improves upon the non-strategic setting (this can occur when positive points are properly incentivized; see Appendix D.1).

Original: Sensitivity analysis.
Revised: Sensitivity analysis.

Original: Figure 2 (right) plots the accuracy of all threshold models h b for increasing values of α .
Revised: Figure 2 (right) plots the accuracy of all threshold models h b for increasing values of α .

Original: For each α , performance exhibits a ‘bell-curve’ shape, with its peak at the optimal h ∗ .
Revised: For each α , performance exhibits a ‘bell-curve’ shape, with its peak at the optimal h ∗ .

Original: As α increases, bell-curves change in two ways.
Revised: As α increases, bell-curves change in two ways.

Original: First, their centers shift , decreasing from positive values towards zero (which is optimal for non-strategic data); since using the graph limits users’ effective radius of movement, the optimal decision boundary can be less ‘stringent’.
Revised: First, their centers shift , decreasing from positive values towards zero (which is optimal for non-strategic data); since using the graph limits users’ effective radius of movement, the optimal decision boundary can be less ‘stringent’.

Original: Second, and interestingly, bell-curves become narrower .
Revised: Second, and interestingly, bell-curves become narrower .

Original: We interpret this as a measure of tolerance : the wider the curve, the lower the loss in accuracy when the learned ˆ h is close to (but does not equal) h ∗ .
Revised: We interpret this as a measure of tolerance : the wider the curve, the lower the loss in accuracy when the learned ˆ h is close to (but does not equal) h ∗ .

Original: The figure shows for a subset of α -s ‘tolerance bands’:
Revised: The figure shows for a subset of α -s ‘tolerance bands’:

Original: intervals around b ∗ that include thresholds b for which the accuracy of h b is at least 90% , 95% , and 97 .
Revised: intervals around b ∗ that include thresholds b for which the accuracy of h b is at least 90% , 95% , and 97 .

Original: 5% of the optimum (horizontal lines).
Revised: 5% of the optimum (horizontal lines).

Original: Results indicate that larger α -s provide less tolerance.
Revised: Results indicate that larger α -s provide less tolerance.

Original: If variation in ˆ h can be attributed to the number of examples, this can be interpreted as hinting that larger α -s may entail larger sample complexity.
Revised: If variation in ˆ h can be attributed to the number of examples, this can be interpreted as hinting that larger α -s may entail larger sample complexity.

Original: Number of layers ( T ).
Revised: Number of layers ( T ).

Original: Figure 2 (right) also shows for each bell-curve the accuracy achieved by learned models ˆ h of increasing depths, T = 1 , . .
Revised: Figure 2 (right) also shows for each bell-curve the accuracy achieved by learned models ˆ h of increasing depths, T = 1 , . .

Original: , 4 (colored dots).
Revised: , 4 (colored dots).

Original: For α = 0 (no graph), there are no inter-user dependencies, and dynamics converge after one round.
Revised: For α = 0 (no graph), there are no inter-user dependencies, and dynamics converge after one round.

Original: Hence, T = 1 suffices and is optimal, and additional layers are redundant.
Revised: Hence, T = 1 suffices and is optimal, and additional layers are redundant.

Original: However, as α increases, more users move in later rounds, and learning with insufficiently large T results in deteriorated performance.
Revised: However, as α increases, more users move in later rounds, and learning with insufficiently large T results in deteriorated performance.

Original: This becomes especially distinct for large α : e.g., for α = 0 .
Revised: This becomes especially distinct for large α : e.g., for α = 0 .

Original: 9 , performance drops by ∼ 11% when using
Revised: 9 , performance drops by ∼ 11% when using

Original: T = 1 instead of the optimal T = 4 .
Revised: T = 1 instead of the optimal T = 4 .

Original: Interestingly, lower T always result in lower, more ‘lenient’ thresholds; as a result, performance deteriorates, and more quickly for larger, more sensitive α .
Revised: Interestingly, lower T always result in lower, more ‘lenient’ thresholds; as a result, performance deteriorates, and more quickly for larger, more sensitive α .

Original: Thus, the relations between α and T suggest that greater reliance on the graph requires more depth.
Revised: Thus, the relations between α and T suggest that greater reliance on the graph requires more depth.

Original: 5. E XPERIMENTS ON REAL DATA
Revised: 5. E XPERIMENTS ON REAL DATA

Original: Data.
Revised: Data.

Original: We use three benchmark datasets used extensively in the GNN literature: Cora, CiteSeer, and
Revised: We use three benchmark datasets used extensively in the GNN literature: Cora, CiteSeer, and

Original: PubMed (Sen et al., 2008; Kipf & Welling, 2017), and adapt them to our setting.
Revised: PubMed (Sen et al., 2008; Kipf & Welling, 2017), and adapt them to our setting.

Original: We use the standard (transductive) train-test split of Sen et al.
Revised: We use the standard (transductive) train-test split of Sen et al.

Original: (2008); the data is made inductive by removing all test-set nodes that can be influenced by train-set nodes (Hamilton et al., 2017).
Revised: (2008); the data is made inductive by removing all test-set nodes that can be influenced by train-set nodes (Hamilton et al., 2017).

Original: All three datasets describe citation networks, with papers as nodes and citations as edges.
Revised: All three datasets describe citation networks, with papers as nodes and citations as edges.

Original: Although these are directed relations by nature, the available data include only undirected edges; hence, we direct edges towards lowerdegree nodes, so that movement of higher-degree nodes is more influential.
Revised: Although these are directed relations by nature, the available data include only undirected edges; hence, we direct edges towards lowerdegree nodes, so that movement of higher-degree nodes is more influential.

Original: As our setup requires binary labels, we follow standard practice and merge classes, aiming for balanced binary classes that sustain strategic movement.
Revised: As our setup requires binary labels, we follow standard practice and merge classes, aiming for balanced binary classes that sustain strategic movement.

Original: Appendix C includes further details.
Revised: Appendix C includes further details.

Original: see Appendix D.2 for additional results on strategic improvement, extending neighborhood size, and node centrality and influence.
Revised: see Appendix D.2 for additional results on strategic improvement, extending neighborhood size, and node centrality and influence.

Original: Methods.
Revised: Methods.

Original: We compare our robust learning approach to a naïve approach that does not account for strategic behavior (i.e., falsely assumes that users do not move).
Revised: We compare our robust learning approach to a naïve approach that does not account for strategic behavior (i.e., falsely assumes that users do not move).

Original: As a benchmark we report the performance of the naïve model on non-strategic data (for which it is appropriate).
Revised: As a benchmark we report the performance of the naïve model on non-strategic data (for which it is appropriate).

Original: All methods are based on the SGC architecture (Wu et al., 2019) as it is expressive enough to effectively utilize the graph, but simple enough to permit rational user responses (Eq.
Revised: All methods are based on the SGC architecture (Wu et al., 2019) as it is expressive enough to effectively utilize the graph, but simple enough to permit rational user responses (Eq.

Original: (4); see also notes Sec. 1.1).
Revised: (4); see also notes Sec. 1.1).

Original: We use the standard weights (cid:102) W =
Revised: We use the standard weights (cid:102) W =

Original: D − 12 AD − 12 where A is the adjacency matrix and D is the diagonal degree matrix.
Revised: D − 12 AD − 12 where A is the adjacency matrix and D is the diagonal degree matrix.

Original: Optimization and setup.
Revised: Optimization and setup.

Original: We train using Adam and set hyperparameters according to Wu et al.
Revised: We train using Adam and set hyperparameters according to Wu et al.

Original: (2019) (learning rate= 0 . 2 , weight decay= 1 . 3 · 10 − 5 ).
Revised: (2019) (learning rate= 0 . 2 , weight decay= 1 . 3 · 10 − 5 ).

Original: Training is stopped after 20 epochs (this usually suffices
Revised: Training is stopped after 20 epochs (this usually suffices

Original: [Figure]
Revised: [Figure]

Original: for convergence).
Revised: for convergence).

Original: Hyperparameters were determined based only on the train set: τ = 0 .
Revised: Hyperparameters were determined based only on the train set: τ = 0 .

Original: 05 , chosen to be the smallest value which retained stable training, and T = 3 , as training typically saturates then (we also explore varying depths).
Revised: 05 , chosen to be the smallest value which retained stable training, and T = 3 , as training typically saturates then (we also explore varying depths).

Original: We use β -scaled 2-norm costs, c β ( x, x ′ )
Revised: We use β -scaled 2-norm costs, c β ( x, x ′ )

Original: =
Revised: =

Original: β ∥ x − x ′ ∥ 2 , β ∈ R + , which induce a maximal moving distance of d β = 2 /β .
Revised: β ∥ x − x ′ ∥ 2 , β ∈ R + , which induce a maximal moving distance of d β = 2 /β .

Original: We observed that values around d = 0 .permit almost arbitrary movement; we therefore experiment in the range d ∈ [0 , 0 . 5] , but focus primarily on the mid-point d = 0 .
Revised: We observed that values around d = 0 .permit almost arbitrary movement; we therefore experiment in the range d ∈ [0 , 0 . 5] , but focus primarily on the mid-point d = 0 .

Original: 25 (note d = 0 implies no movement).
Revised: 25 (note d = 0 implies no movement).

Original: Mean and standard errors are reported over five random initializations.
Revised: Mean and standard errors are reported over five random initializations.

Original: Appendix C includes further details.
Revised: Appendix C includes further details.

Original: Results.
Revised: Results.

Original: Table 1 presents detailed results for d = 0 .
Revised: Table 1 presents detailed results for d = 0 .

Original: 25 and T = 3 .
Revised: 25 and T = 3 .

Original: As can be seen, the naive approach is highly vulnerable to strategic behavior.
Revised: As can be seen, the naive approach is highly vulnerable to strategic behavior.

Original: In contrast, by anticipating how users collectively respond, our robust approach is able to recover most of the drop in accuracy (i.e., from ‘benchmark’ to ‘naïve’;
Revised: In contrast, by anticipating how users collectively respond, our robust approach is able to recover most of the drop in accuracy (i.e., from ‘benchmark’ to ‘naïve’;

Original: Cora: 35%, CiteSeer: 16%, PubMed: 72%).
Revised: Cora: 35%, CiteSeer: 16%, PubMed: 72%).

Original: Note this is achieved with a T much smaller than necessary for response dynamics to converge ( T max : Cora=7, CiteSeer=7, PubMed=11).
Revised: Note this is achieved with a T much smaller than necessary for response dynamics to converge ( T max : Cora=7, CiteSeer=7, PubMed=11).

Original: Fig.
Revised: Fig.

Original: 3 (top) shows results for varying max distances d ∈ [0 , 0 . 5] and fixing T = 3 (note d =entails no movement).
Revised: 3 (top) shows results for varying max distances d ∈ [0 , 0 . 5] and fixing T = 3 (note d =entails no movement).

Original: For Cora and CiteSeer, larger max distances—the result of lower modification costs—hurt performance; nonetheless, our robust approach maintains a fairly stable recovery rate over all values of d .
Revised: For Cora and CiteSeer, larger max distances—the result of lower modification costs—hurt performance; nonetheless, our robust approach maintains a fairly stable recovery rate over all values of d .

Original: For PubMed, our approach retains ≈ 92% of the optimum , showing resilience to reduced costs.
Revised: For PubMed, our approach retains ≈ 92% of the optimum , showing resilience to reduced costs.

Original: Interestingly, for CiteSeer, in the range d ∈ [0 . 05 , 0 . 15] , our approach improves over the baseline, suggesting it utilizes strategic movements for improved accuracy (as in Sec. 5.1).
Revised: Interestingly, for CiteSeer, in the range d ∈ [0 . 05 , 0 . 15] , our approach improves over the baseline, suggesting it utilizes strategic movements for improved accuracy (as in Sec. 5.1).

Original: Fig.
Revised: Fig.

Original: 3 (bottom) shows results for varying depths T ∈ { 0 , . .
Revised: 3 (bottom) shows results for varying depths T ∈ { 0 , . .

Original: For all datasets, results improve as T increases, but saturate quickly at T ≈ 3 ; this suggests a form of robustness of our approach to overshooting in choosing T (which due to smoothing can cause larger deviations from the true dynamics).
Revised: For all datasets, results improve as T increases, but saturate quickly at T ≈ 3 ; this suggests a form of robustness of our approach to overshooting in choosing T (which due to smoothing can cause larger deviations from the true dynamics).

Original: Using T = 1 recovers between 65% − 91% (across datasets) of the optimal accuracy.
Revised: Using T = 1 recovers between 65% − 91% (across datasets) of the optimal accuracy.

Original: This shows that while considering only one round of user responses (in which there are no dependencies) is helpful, it is much more effective to consider multiple, dependent rounds—even if only a few.
Revised: This shows that while considering only one round of user responses (in which there are no dependencies) is helpful, it is much more effective to consider multiple, dependent rounds—even if only a few.

Original:  D ISCUSSION
Revised:  D ISCUSSION

Original: In this paper we study strategic classification under graph neural networks.
Revised: In this paper we study strategic classification under graph neural networks.

Original: Relying on a graph for prediction introduces dependencies in user responses, which can result in complex correlated behavior.
Revised: Relying on a graph for prediction introduces dependencies in user responses, which can result in complex correlated behavior.

Original: The incentives of the system and its users are not aligned, but also not discordant; our proposed learning approach utilizes this degree of freedom to learn strategically-robust classifiers.
Revised: The incentives of the system and its users are not aligned, but also not discordant; our proposed learning approach utilizes this degree of freedom to learn strategically-robust classifiers.

Original: Strategic classification assumes rational user behavior; this necessitates classifiers that are simple enough to permit tractable best-responses.
Revised: Strategic classification assumes rational user behavior; this necessitates classifiers that are simple enough to permit tractable best-responses.

Original: A natural future direction is to consider more elaborate predictive architectures coupled with appropriate boundedly-rational user models, in hopes of shedding further light on questions regarding the benefits and risks of transparency and model explainability.
Revised: A natural future direction is to consider more elaborate predictive architectures coupled with appropriate boundedly-rational user models, in hopes of shedding further light on questions regarding the benefits and risks of transparency and model explainability.

Original: E THICS AND SOCIETAL IMPLICATIONS
Revised: E THICS AND SOCIETAL IMPLICATIONS

Original: In our current era, machine learning is routinely used to make predictions about humans.
Revised: In our current era, machine learning is routinely used to make predictions about humans.

Original: These, in turn, are often used to inform—or even determine—consequential decisions.
Revised: These, in turn, are often used to inform—or even determine—consequential decisions.

Original: That humans can (and do) respond to decision rules is a factual reality, and is a topic of continual interest in fields such as economics (e.g., Nielsen et al., 2010) and policy-making (e.g., Camacho & Conover, 2013); the novelty of strategic classification is that it studies decision rules that are a product of learned predictive models.
Revised: That humans can (and do) respond to decision rules is a factual reality, and is a topic of continual interest in fields such as economics (e.g., Nielsen et al., 2010) and policy-making (e.g., Camacho & Conover, 2013); the novelty of strategic classification is that it studies decision rules that are a product of learned predictive models.

Original: Strategic classification not only acknowledges this reality, but also proposes tools for learning in ways that account for it.
Revised: Strategic classification not only acknowledges this reality, but also proposes tools for learning in ways that account for it.

Original: But in modeling and anticipating how users respond, and by adjusting learning to accommodate for their effects—learning also serves to ‘steer’ its population of users, perhaps inadvertently, towards certain outcomes (Hardt et al., 2022).
Revised: But in modeling and anticipating how users respond, and by adjusting learning to accommodate for their effects—learning also serves to ‘steer’ its population of users, perhaps inadvertently, towards certain outcomes (Hardt et al., 2022).

Original: GNNs are no exception to this reality.
Revised: GNNs are no exception to this reality.

Original: In the domain of graph-based learning, the role of predictive models is expressed in how they associate social connections with decision outcomes for individuals;
Revised: In the domain of graph-based learning, the role of predictive models is expressed in how they associate social connections with decision outcomes for individuals;

Original: Clearly, the choice of whether to make use of social data for decisions can be highly sensitive, and doing so necessitates much forethought and care.
Revised: Clearly, the choice of whether to make use of social data for decisions can be highly sensitive, and doing so necessitates much forethought and care.

Original: But the question of whether to use social data to enhance prediction is not a binary in nature, i.e., there is no simple ‘right’ or ‘wrong’.
Revised: But the question of whether to use social data to enhance prediction is not a binary in nature, i.e., there is no simple ‘right’ or ‘wrong’.

Original: Consider our example of the credit scoring company, Lenddo.
Revised: Consider our example of the credit scoring company, Lenddo.

Original: On the one hand, Lenddo has been criticized that it may be discriminating applicants based on who they chose to socialize with (or, rather, who chooses to socialize with them).
Revised: On the one hand, Lenddo has been criticized that it may be discriminating applicants based on who they chose to socialize with (or, rather, who chooses to socialize with them).

Original: But on the other hand, Lenddo, who focuses primarily on developing countries, has been acclaimed for providing financial assistance to a large community of deserving applicants who, due to conservative norms in typically credit scoring rules, would otherwise be denied a consequential loan.
Revised: But on the other hand, Lenddo, who focuses primarily on developing countries, has been acclaimed for providing financial assistance to a large community of deserving applicants who, due to conservative norms in typically credit scoring rules, would otherwise be denied a consequential loan.

Original: Such considerations apply broadly.
Revised: Such considerations apply broadly.

Original: In other focal domains in strategic classification, such as loans, university admissions, and job hiring, the use of social data for informing decisions can be highly controversial, on both ethical and legal grounds.
Revised: In other focal domains in strategic classification, such as loans, university admissions, and job hiring, the use of social data for informing decisions can be highly controversial, on both ethical and legal grounds.

Original: Regulation is necessary, but as in similar areas, often lags far behind the technology itself.
Revised: Regulation is necessary, but as in similar areas, often lags far behind the technology itself.

Original: This highlights the need for transparency and accountability in how, when, and to what purpose, social data is used (Ghalme et al., 2021;
Revised: This highlights the need for transparency and accountability in how, when, and to what purpose, social data is used (Ghalme et al., 2021;

Original: Jagadeesan et al., 2021;
Revised: Jagadeesan et al., 2021;

Original: Bechavod et al., 2022; Barsotti et al., 2022b).
Revised: Bechavod et al., 2022; Barsotti et al., 2022b).

Original: A CKNOWLEDGEMENTS
Revised: A CKNOWLEDGEMENTS

Original: This research was supported by the Israel Science Foundation (grant No. 278/22)
Revised: This research was supported by the Israel Science Foundation (grant No. 278/22)

Original: A A NALYSIS A. H ITCHHIKING
Revised: A A NALYSIS A. H ITCHHIKING

Original: Here we provide a concrete example of hitchhiking, following Fig.
Revised: Here we provide a concrete example of hitchhiking, following Fig.

Original: 1 (E).
Revised: 1 (E).

Original: The example includes three nodes, i, j, k , positioned at:
Revised: The example includes three nodes, i, j, k , positioned at:

Original: [Equation]
Revised: [Equation]

Original: and connected via edges k → j, and j → i .
Revised: and connected via edges k → j, and j → i .

Original: Edge weights (cid:101) w ji = 0 .
Revised: Edge weights (cid:101) w ji = 0 .

Original: 6 and (cid:101) w ii = 0 .
Revised: 6 and (cid:101) w ii = 0 .

Original: 4 ; (cid:101) w kj = 1 / 3 and (cid:101) w jj = 2 / 3 ; and (cid:101) w kk = 1 .
Revised: 4 ; (cid:101) w kj = 1 / 3 and (cid:101) w jj = 2 / 3 ; and (cid:101) w kk = 1 .

Original: The example considers a threshold classifier h b with b = 0 , and unit-scale costs (i.e., β = 1 ) inducing a maximal moving distance of d = 2 .
Revised: The example considers a threshold classifier h b with b = 0 , and unit-scale costs (i.e., β = 1 ) inducing a maximal moving distance of d = 2 .

Original: We show that i cannot invest effort to cross and obtain ˆ y i = 1 ; but once j moves (to obtain ˆ y j = 1 ), this results in i also being classified positively ( without moving).
Revised: We show that i cannot invest effort to cross and obtain ˆ y i = 1 ; but once j moves (to obtain ˆ y j = 1 ), this results in i also being classified positively ( without moving).

Original: Initially (at round t = 0 ), node embeddings are:
Revised: Initially (at round t = 0 ), node embeddings are:

Original: [Equation]
Revised: [Equation]

Original: and all points are classified negatively, ˆ y k
Revised: and all points are classified negatively, ˆ y k

Original: = ˆ
Revised: = ˆ

Original: y i
Revised: y i

Original: =
Revised: =

Original: ˆ y j
Revised: ˆ y j

Original: = − 1 .
Revised: = − 1 .

Original: Notice that i cannot cross the decision boundary even if she moves the maximal cost-feasible distance of d = 2 : ϕ
Revised: Notice that i cannot cross the decision boundary even if she moves the maximal cost-feasible distance of d = 2 : ϕ

Original: [Equation]
Revised: [Equation]

Original: i
Revised: i

Original: [Equation]
Revised: [Equation]

Original: Hence, i doesn’t move, so x (1) i
Revised: Hence, i doesn’t move, so x (1) i

Original: = x (0) i .
Revised: = x (0) i .

Original: Similarly, k cannot cross, so x (1) k
Revised: Similarly, k cannot cross, so x (1) k

Original: = x (0) k .
Revised: = x (0) k .

Original: However, j can cross by moving to 1 .
Revised: However, j can cross by moving to 1 .

Original: 5 (at cost 2) in order to get ˆ y j = 1 :
Revised: 5 (at cost 2) in order to get ˆ y j = 1 :

Original: [Equation]
Revised: [Equation]

Original: ⇒
Revised: ⇒

Original: [Equation]
Revised: [Equation]

Original: 1) j
Revised: 1) j

Original: [Equation] [Equation]
Revised: [Equation] [Equation]

Original: After j moves, i is classified positively (and so does not need to move):
Revised: After j moves, i is classified positively (and so does not need to move):

Original: [Equation]
Revised: [Equation]

Original: C ASCADING BEHAVIOR
Revised: C ASCADING BEHAVIOR

Original: We give a constructive example (for any n ) which will be used to prove Propositions 3 and 4.
Revised: We give a constructive example (for any n ) which will be used to prove Propositions 3 and 4.

Original: The construction is modular, meaning that we build a small ‘cyclic’ structure of size 3, such that for any given n , we simply replicate this structure roughly n/ 3 times, and include two additional ‘start’ and ‘finish’ nodes.
Revised: The construction is modular, meaning that we build a small ‘cyclic’ structure of size 3, such that for any given n , we simply replicate this structure roughly n/ 3 times, and include two additional ‘start’ and ‘finish’ nodes.

Original: Our example assumes a threshold classifier h b with b = 0 , and scale costs c β with β = 1 .
Revised: Our example assumes a threshold classifier h b with b = 0 , and scale costs c β with β = 1 .

Original: 5 inducing a maximum moving distance of d β = 3 .
Revised: 5 inducing a maximum moving distance of d β = 3 .

Original: Let n .
Revised: Let n .

Original: We construct a graph of size n + 2 as follows.
Revised: We construct a graph of size n + 2 as follows.

Original: Nodes are indexed 0 , . . .
Revised: Nodes are indexed 0 , . . .

Original: , n + 1 .
Revised: , n + 1 .

Original: The graph has bi-directional edges between each pair of consecutive nodes, namely ( i, i + 1) and ( i + 1 , i ) for all i = 0 , . . . , n , except for the last node, which has only an outgoing edge ( n + 1 , n ) , but no incoming edge.
Revised: The graph has bi-directional edges between each pair of consecutive nodes, namely ( i, i + 1) and ( i + 1 , i ) for all i = 0 , . . . , n , except for the last node, which has only an outgoing edge ( n + 1 , n ) , but no incoming edge.

Original: We set uniform normalized edge weights, i.e., w ij = 1 / 3 and w ii = 1 / 3 for all 1 ≤ i, j ≤ n , and w 0 , 

Revised: We set uniform normalized edge weights, i.e., w ij = 1 / 3 and w ii = 1 / 3 for all 1 ≤ i, j ≤ n , and w 0 ,

Original: = w 0 , 1 = 1 / 2 and w n +1 ,n +1 = w n +1 ,n = 1 / 2 .
Revised: = w 0 , 1 = 1 / 2 and w n +1 ,n +1 = w n +1 ,n = 1 / 2 .

Original: The initial features of each node are defined as:
Revised: The initial features of each node are defined as:

Original: [Equation]
Revised: [Equation]

Original: Figure 4 (A) illustrates this for n = 3 .
Revised: Figure 4 (A) illustrates this for n = 3 .

Original: Note that while the graph creates a ‘chain’ structure, the positioning of node features is cyclic (starting from n = 1 ): 2 , − 4 , − 4 , 2 , − 4 , − 4 , 2 , . . .
Revised: Note that while the graph creates a ‘chain’ structure, the positioning of node features is cyclic (starting from n = 1 ): 2 , − 4 , − 4 , 2 , − 4 , − 4 , 2 , . . .

Original: etc.
Revised: etc.

Original: We begin with a lemma showing that in our construction, each node i = 1 , . . .
Revised: We begin with a lemma showing that in our construction, each node i = 1 , . . .

Original: , n moves precisely at round t
Revised: , n moves precisely at round t

Original: = i .
Revised: = i .

Original: Lemma 1.
Revised: Lemma 1.

Original: At every round 1 ≤ t ≤ n :
Revised: At every round 1 ≤ t ≤ n :

Original: (1) node i =
Revised: (1) node i =

Original: t moves, with x ( t ) i = 

Revised: t moves, with x ( t ) i =

Original: if k mod 3 = 1 , and x ( t ) i = − 1 otherwise (2) all nodes j > t do not move, i.e., x ( t )
Revised: if k mod 3 = 1 , and x ( t ) i = − 1 otherwise (2) all nodes j > t do not move, i.e., x ( t )

Original: j = x ( t − 1)
Revised: j = x ( t − 1)

Original: j
Revised: j

Original: [Figure]
Revised: [Figure]

Original: − − 1 2 0 − …
Revised: − − 1 2 0 − …

Original: [Figure]
Revised: [Figure]

Original: Note that (1) (together with Prop. 1) implies that for any round t , all nodes i < t (which have already moved at the earlier round t ′ =
Revised: Note that (1) (together with Prop. 1) implies that for any round t , all nodes i < t (which have already moved at the earlier round t ′ =

Original: i ) do not move again.
Revised: i ) do not move again.

Original: Additionally, (2) implies that all j > t remain in their initial position, i.e., x ( t )
Revised: Additionally, (2) implies that all j > t remain in their initial position, i.e., x ( t )

Original: j = x (0) j .
Revised: j = x (0) j .

Original: Finally, notice that the starting node x 0 has ϕ 0 = 0 .
Revised: Finally, notice that the starting node x 0 has ϕ 0 = 0 .

Original: 5 , meaning
Revised: 5 , meaning

Original: that ˆ y (0)0 = 1 , and so does not move at any round.
Revised: that ˆ y (0)0 = 1 , and so does not move at any round.

Original: Proof.
Revised: Proof.

Original: We begin with the case for n = 3 .
Revised: We begin with the case for n = 3 .

Original: • Round 1: Node i = 1 can cross by moving the maximal distance of 3:
Revised: • Round 1: Node i = 1 can cross by moving the maximal distance of 3:

Original: [Equation]
Revised: [Equation]

Original: However, nodes 2,3 cannot cross even if they move the maximal feasible distance:
Revised: However, nodes 2,3 cannot cross even if they move the maximal feasible distance:

Original: [Equation]
Revised: [Equation]

Original: • Round 2: Node i = 2 can cross by moving the maximal distance of 3:
Revised: • Round 2: Node i = 2 can cross by moving the maximal distance of 3:

Original: [Equation]
Revised: [Equation]

Original: However, node 3 cannot cross even if it moves the maximal feasible distance:
Revised: However, node 3 cannot cross even if it moves the maximal feasible distance:

Original: [Equation]
Revised: [Equation]

Original: • Round 3: Node i = 3 can cross by moving the maximal distance of 3:
Revised: • Round 3: Node i = 3 can cross by moving the maximal distance of 3:

Original: [Equation] [Equation]
Revised: [Equation] [Equation]

Original: Fig.
Revised: Fig.

Original: 4 (A) illustrates this procedure for n = 3 .
Revised: 4 (A) illustrates this procedure for n = 3 .

Original: Next, consider n > 3 .
Revised: Next, consider n > 3 .

Original: Due to the cyclical nature of feature positioning and the chain structure of our graph, we can consider what happens when we sequentially add nodes to the graph.
Revised: Due to the cyclical nature of feature positioning and the chain structure of our graph, we can consider what happens when we sequentially add nodes to the graph.

Original: By induction, we can show that:
Revised: By induction, we can show that:

Original: • n mod 3 = 1 : Consider round t = n .
Revised: • n mod 3 = 1 : Consider round t = n .

Original: Node n has x ( t − 1) n = 2 , and two neighbors: n − 1 , who after moving at the previous round has x ( t − 1) n − 1 = − 1 ; and n + 1 , who has a fixed x ( t − 1) n +1 = − 4 .
Revised: Node n has x ( t − 1) n = 2 , and two neighbors: n − 1 , who after moving at the previous round has x ( t − 1) n − 1 = − 1 ; and n + 1 , who has a fixed x ( t − 1) n +1 = − 4 .

Original: Thus, it is in the same configuration as node i = 1 , and so its movement follows Eq.
Revised: Thus, it is in the same configuration as node i = 1 , and so its movement follows Eq.

Original: • n mod 3 = 2 : Consider round t = n .
Revised: • n mod 3 = 2 : Consider round t = n .

Original: Node n has x ( t − 1) n = − 4 , and two neighbors: n − 1 , who after moving at the previous round has x ( t − 1) n − 1 = 5 ; and n + 1 , who has a fixed x ( t − 1) n +1 = − 4 .
Revised: Node n has x ( t − 1) n = − 4 , and two neighbors: n − 1 , who after moving at the previous round has x ( t − 1) n − 1 = 5 ; and n + 1 , who has a fixed x ( t − 1) n +1 = − 4 .

Original: Thus, it is in the same configuration as node i = 2 , and so its movement follows Eq.
Revised: Thus, it is in the same configuration as node i = 2 , and so its movement follows Eq.

Original: • n mod 3 = 0 : Consider round t = n .
Revised: • n mod 3 = 0 : Consider round t = n .

Original: Node n has x ( t − 1) n = − 4 , and two neighbors: n − 1 , who after moving at the previous round has x ( t − 1) n − 1 = − 1 ; and n + 1 , who has a fixed x ( t − 1) n +

Revised: Node n has x ( t − 1) n = − 4 , and two neighbors: n − 1 , who after moving at the previous round has x ( t − 1) n − 1 = − 1 ; and n + 1 , who has a fixed x ( t − 1) n +

Original: = 2 .
Revised: = 2 .

Original: Thus, it is in the same configuration as node i = 2 , and so its movement follows Eq.
Revised: Thus, it is in the same configuration as node i = 2 , and so its movement follows Eq.

Original: Fig.
Revised: Fig.

Original: 4 (B) illustrates this idea for n > 3 .
Revised: 4 (B) illustrates this idea for n > 3 .

Original: We now proceed to prove the propositions.
Revised: We now proceed to prove the propositions.

Original: Proposition 3: The proposition follows immediately from Lemma 1; the only detail that remains to be shown is that node n + 1 does not move at all.
Revised: Proposition 3: The proposition follows immediately from Lemma 1; the only detail that remains to be shown is that node n + 1 does not move at all.

Original: To see this, note that since it does not have any incoming edges, its embedding depends only on its own features, x n +1 .
Revised: To see this, note that since it does not have any incoming edges, its embedding depends only on its own features, x n +1 .

Original: If n + 1 mod 3 = 1 , we have x n +

Revised: If n + 1 mod 3 = 1 , we have x n +

Original: = 2 , and so ˆ y n +1 = 1 without movement.
Revised: = 2 , and so ˆ y n +1 = 1 without movement.

Original: Otherwise, x n +1 = − 4 , meaning that it is too far to cross.
Revised: Otherwise, x n +1 = − 4 , meaning that it is too far to cross.

Original: Proposition 4: Fix n and k ≤ n .
Revised: Proposition 4: Fix n and k ≤ n .

Original: Consider the same construction presented above for a graph of size k + 

Revised: Consider the same construction presented above for a graph of size k +

Original: Then, add n − k nodes identical nodes: for each k < j ≤ n , add an edge k → j , and set x j = x k − 6 .
Revised: Then, add n − k nodes identical nodes: for each k < j ≤ n , add an edge k → j , and set x j = x k − 6 .

Original: We claim that all such nodes will move exactly at round k .
Revised: We claim that all such nodes will move exactly at round k .

Original: Consider some node k < j ≤ n .
Revised: Consider some node k < j ≤ n .

Original: Since x k moves only at round k (following Lemma 1), j does not move in any of the first t ≤ k rounds:
Revised: Since x k moves only at round k (following Lemma 1), j does not move in any of the first t ≤ k rounds:

Original: [Equation]
Revised: [Equation]

Original: At the end of round t = k , node k has a value of x (0) k + 3 .
Revised: At the end of round t = k , node k has a value of x (0) k + 3 .

Original: This enables j to cross by moving the maximal distance of 3:
Revised: This enables j to cross by moving the maximal distance of 3:

Original: [Equation]
Revised: [Equation]

Original: As this applies to all such j , we get that n − k nodes move at round k , which concludes our proof.
Revised: As this applies to all such j , we get that n − k nodes move at round k , which concludes our proof.

Original: Note the graph is such that, for b = 0 , without strategic behavior the graph is useful for prediction (increases accuracy from 66% to 100%), so that a learner that is unaware of (or does not account for) strategic behavior is incentivized to utilize the graph.
Revised: Note the graph is such that, for b = 0 , without strategic behavior the graph is useful for prediction (increases accuracy from 66% to 100%), so that a learner that is unaware of (or does not account for) strategic behavior is incentivized to utilize the graph.

Original: However, once strategic behavior is introduced, naïvely using the graph causes performance to drop to 0%.
Revised: However, once strategic behavior is introduced, naïvely using the graph causes performance to drop to 0%.

Original: B O PTIMIZATION B. P ROJECTION
Revised: B O PTIMIZATION B. P ROJECTION

Original: We prove for 2-norm-squared costs.
Revised: We prove for 2-norm-squared costs.

Original: Correctness holds for 2-norm-costs since the argmin is the same (squared over positives is monotone).
Revised: Correctness holds for 2-norm-costs since the argmin is the same (squared over positives is monotone).

Original: Calculation of x i ’s best response requires solving the following equation:
Revised: Calculation of x i ’s best response requires solving the following equation:

Original: [Equation]
Revised: [Equation]

Original: To solve for x ′ , we apply the Lagrange method.
Revised: To solve for x ′ , we apply the Lagrange method.

Original: Define the Lagrangian as follows:
Revised: Define the Lagrangian as follows:

Original: [Equation]
Revised: [Equation]

Original: Next, to find the minimum of L , derive with respect to x ′ i , and compare to 0:
Revised: Next, to find the minimum of L , derive with respect to x ′ i , and compare to 0:

Original: [Equation]
Revised: [Equation]

Original: Plugging x ′ i into the constraint gives:
Revised: Plugging x ′ i into the constraint gives:

Original: [Equation]
Revised: [Equation]

Original: Finally
Revised: Finally

Original: [Equation]
Revised: [Equation]

Original: plugging λ into the expression for x ′ i obtains:
Revised: plugging λ into the expression for x ′ i obtains:

Original: [Equation]
Revised: [Equation]

Original: B. G ENERALIZED COSTS
Revised: B. G ENERALIZED COSTS

Original: Here we provide a formula for computing projections in closed form for generalized quadratic costs:
Revised: Here we provide a formula for computing projections in closed form for generalized quadratic costs:

Original: [Equation]
Revised: [Equation]

Original: for positive-definite A .
Revised: for positive-definite A .

Original: As before, the same formula holds for generalized 2-norm costs (since the argmin is the same).
Revised: As before, the same formula holds for generalized 2-norm costs (since the argmin is the same).

Original: Begin with:
Revised: Begin with:

Original: [Equation]
Revised: [Equation]

Original: As before
Revised: As before

Original: [Equation]
Revised: [Equation]

Original: apply the Lagrangian method:
Revised: apply the Lagrangian method:

Original: [Equation]
Revised: [Equation]

Original: Derivation w.r.t.
Revised: Derivation w.r.t.

Original: to x ′ i :
Revised: to x ′ i :

Original: [Equation]
Revised: [Equation]

Original: ii
Revised: ii

Original: Since the matrix ( A ⊤ + A ) is PD, we can invert to get:
Revised: Since the matrix ( A ⊤ + A ) is PD, we can invert to get:

Original: [Equation]
Revised: [Equation]

Original: Plugging x ′ i in the constrain:
Revised: Plugging x ′ i in the constrain:

Original: [Equation]
Revised: [Equation]

Original: Since ( A ⊤ + A ) − 1 is also PD, we get θ ⊤ ( A ⊤ + A ) − 1 θ > 0 , and hence:
Revised: Since ( A ⊤ + A ) − 1 is also PD, we get θ ⊤ ( A ⊤ + A ) − 1 θ > 0 , and hence:

Original: [Equation]
Revised: [Equation]

Original: Finally, pluging in λ :
Revised: Finally, pluging in λ :

Original: [Equation]
Revised: [Equation]

Original: Setting A
Revised: Setting A

Original: = I recovers Eq.
Revised: = I recovers Eq.

Original: [Table]
Revised: [Table]

Original: B. I MPROVING NUMERICAL STABILITY BY ADDING A TOLERANCE TERM
Revised: B. I MPROVING NUMERICAL STABILITY BY ADDING A TOLERANCE TERM

Original: Theoretically, strategic responses move points precisely on the decision boundary.
Revised: Theoretically, strategic responses move points precisely on the decision boundary.

Original: For numerical stability in classifying (e.g., at test time), we add a small tolerance term, tol , that ensures that points are projected to lie strictly within the positive halfspace.
Revised: For numerical stability in classifying (e.g., at test time), we add a small tolerance term, tol , that ensures that points are projected to lie strictly within the positive halfspace.

Original: Tolerance is added as follows:
Revised: Tolerance is added as follows:

Original: [Equation]
Revised: [Equation]

Original: This necessitates the following adjustment to Eq.
Revised: This necessitates the following adjustment to Eq.

Original: [Equation]
Revised: [Equation]

Original: However, blindly applying the above to Eq.
Revised: However, blindly applying the above to Eq.

Original: (8) via:
Revised: (8) via:

Original: [Equation]
Revised: [Equation]

Original: is erroneous, since any user whose score is lower than tol will move—although in principal she shouldn’t.
Revised: is erroneous, since any user whose score is lower than tol will move—although in principal she shouldn’t.

Original: To correct for this, we adjust Eq.
Revised: To correct for this, we adjust Eq.

Original: (8) by adding a mask that ensures that only points in the negative halfspace are projected:
Revised: (8) by adding a mask that ensures that only points in the negative halfspace are projected:

Original: [Equation]
Revised: [Equation]

Original: − 1 { θ ⊤ ϕ ( x i ; x − i )
Revised: − 1 { θ ⊤ ϕ ( x i ; x − i )

Original: +
Revised: +

Original: b < 0 } · (cid:18) θ ⊤ ϕ
Revised: b < 0 } · (cid:18) θ ⊤ ϕ

Original: ( x i ; x − i )
Revised: ( x i ; x − i )

Original: + b − tol
Revised: + b − tol

Original: ∥ θ ∥ 22 (cid:101) w ii θ (cid:19) (23)
Revised: ∥ θ ∥ 22 (cid:101) w ii θ (cid:19) (23)

Original: C A DDITIONAL EXPERIMENTAL DETAILS
Revised: C A DDITIONAL EXPERIMENTAL DETAILS

Original: Data.
Revised: Data.

Original: We experiment with three citation network datasets: Cora, CiteSeer, and Pubmed Sen et al.
Revised: We experiment with three citation network datasets: Cora, CiteSeer, and Pubmed Sen et al.

Original: Table 2 provides summary statistics of the datasets, as well as experimental details.
Revised: Table 2 provides summary statistics of the datasets, as well as experimental details.

Original: Splits.
Revised: Splits.

Original: All three datasets include a standard train-validation-test split, which we adopt for our use.
Revised: All three datasets include a standard train-validation-test split, which we adopt for our use.

Original: For our purposes, we use make no distinction between ‘train’ and ‘validation’, and use both sets for training purposes.
Revised: For our purposes, we use make no distinction between ‘train’ and ‘validation’, and use both sets for training purposes.

Original: To ensure the data is appropriate for the inductive setting, we remove from the test set all nodes which can be influenced by train-set nodes—this ranges from 6%-43% of the test set, depending on dataset (and possibly setting; see Sec. D.2.1).
Revised: To ensure the data is appropriate for the inductive setting, we remove from the test set all nodes which can be influenced by train-set nodes—this ranges from 6%-43% of the test set, depending on dataset (and possibly setting; see Sec. D.2.1).

Original: In Table 2, the number of train samples is denoted n train , and the number of inductive test samples is denoted n ∗ test (all original transductive test sets include 1,000 samples).
Revised: In Table 2, the number of train samples is denoted n train , and the number of inductive test samples is denoted n ∗ test (all original transductive test sets include 1,000 samples).

Original: Binarization.
Revised: Binarization.

Original: To make the data binary (original labels are multiclass), we enumerated over possible partitions of classes into ‘negative’ and ‘positive’, and chose the most balanced partition.
Revised: To make the data binary (original labels are multiclass), we enumerated over possible partitions of classes into ‘negative’ and ‘positive’, and chose the most balanced partition.

Original: Experimenting with other but similarly-balanced partitions resulted in similar performance (albeit at times less distinct strategic movement).
Revised: Experimenting with other but similarly-balanced partitions resulted in similar performance (albeit at times less distinct strategic movement).

Original: The exception to this was PubMed (having only three classes), for which the most balanced partition was neither ‘balanced’ nor stable, and so here we opted for the more stable alternative.
Revised: The exception to this was PubMed (having only three classes), for which the most balanced partition was neither ‘balanced’ nor stable, and so here we opted for the more stable alternative.

Original: Reported partitions and corresponding negative-positive ratios (for train and for test) are given in Table 2.
Revised: Reported partitions and corresponding negative-positive ratios (for train and for test) are given in Table 2.

Original: Strategic responses.
Revised: Strategic responses.

Original: At test time, strategic user responses are computed by simulating the response dynamics in Sec.
Revised: At test time, strategic user responses are computed by simulating the response dynamics in Sec.

Original: 3.1 until convergence.
Revised: 3.1 until convergence.

Original: 1.0 1.5 2.0 threshold (b) 0.
Revised: 1.0 1.5 2.0 threshold (b) 0.

Original: % c h a n g e y
Revised: % c h a n g e y

Original: T =
Revised: T =

Original: T = positivenegative 0.
Revised: T = positivenegative 0.

Original: 2.0 threshold (b) 0.
Revised: 2.0 threshold (b) 0.

Original: a cc u r a c y 0.
Revised: a cc u r a c y 0.

Original: % c h a n g e c l a ss i f i c a t i o n
Revised: % c h a n g e c l a ss i f i c a t i o n

Original: T = 13+ negpos 1.
Revised: T = 13+ negpos 1.

Original: a cc u r a c y
Revised: a cc u r a c y

Original: T =
Revised: T =

Original: T = 1.
Revised: T = 1.

Original: 1.5 threshold (b) 0.
Revised: 1.5 threshold (b) 0.

Original: a cc u r a c y
Revised: a cc u r a c y

Original: T =
Revised: T =

Original: T =
Revised: T =

Original: D A DDITIONAL EXPERIMENTAL RESULTS D. E XPERIMENTS ON SYNTHETIC DATA
Revised: D A DDITIONAL EXPERIMENTAL RESULTS D. E XPERIMENTS ON SYNTHETIC DATA

Original: In this section we explore further in depth the relation between user movement and classification performance, using our synthetic setup in Sec.
Revised: In this section we explore further in depth the relation between user movement and classification performance, using our synthetic setup in Sec.

Original: 5.1 (all examples discussed herein use α = 0 . 7 ).
Revised: 5.1 (all examples discussed herein use α = 0 . 7 ).

Original: From a predictive point of view, graphs are generally helpful if same-class nodes are well-connected.
Revised: From a predictive point of view, graphs are generally helpful if same-class nodes are well-connected.

Original: This is indeed the case in our construction (as can be seen by the performance of the benchmark method with non-extreme α > 0 values).
Revised: This is indeed the case in our construction (as can be seen by the performance of the benchmark method with non-extreme α > 0 values).

Original: From a strategic perspective, however, connectivity increases cooperation, since neighboring nodes can positively influence each other over time.
Revised: From a strategic perspective, however, connectivity increases cooperation, since neighboring nodes can positively influence each other over time.

Original: In our construction, cooperation occurs mostly within classes, i.e., negative points that move encourage other negative points to move, and similarly for positive points.
Revised: In our construction, cooperation occurs mostly within classes, i.e., negative points that move encourage other negative points to move, and similarly for positive points.

Original: Movement trends.
Revised: Movement trends.

Original: Fig.
Revised: Fig.

Original: 5 (left) shows how different threshold classifiers h b induce different degrees of movements.
Revised: 5 (left) shows how different threshold classifiers h b induce different degrees of movements.

Original: The plot shows the relative number of points (in percentage points) whose predictions changed as a result of strategic behavior, per class (red: y = − 1 , green:
Revised: The plot shows the relative number of points (in percentage points) whose predictions changed as a result of strategic behavior, per class (red: y = − 1 , green:

Original: y = 1 ) and over time: after one round ( T = 1 , dashed lines), and at convergence ( T = ∞ , solid lines).
Revised: y = 1 ) and over time: after one round ( T = 1 , dashed lines), and at convergence ( T = ∞ , solid lines).

Original: As can be seen, there is a general trend: when b is small, mostly negative points move, but as b increases, positive points move instead.
Revised: As can be seen, there is a general trend: when b is small, mostly negative points move, but as b increases, positive points move instead.

Original: The interesting point to observe is the gap between the first round ( T = 1 ) and final round ( T = ∞ ).
Revised: The interesting point to observe is the gap between the first round ( T = 1 ) and final round ( T = ∞ ).

Original: For negative points, movement at T = 1 peaks at b 1 ≈ − 0 .
Revised: For negative points, movement at T = 1 peaks at b 1 ≈ − 0 .

Original: 25 , but triggers relatively little consequent moves.
Revised: 25 , but triggers relatively little consequent moves.

Original: In contrast, the peak for T = ∞ occurs at a larger b ∞ ≈ 0 .
Revised: In contrast, the peak for T = ∞ occurs at a larger b ∞ ≈ 0 .

Original: For this threshold, though less points move in the first round, these trigger significantly more additional moves at later rounds—a result of the connectivity structure within the negative cluster of nodes (blue arrows).
Revised: For this threshold, though less points move in the first round, these trigger significantly more additional moves at later rounds—a result of the connectivity structure within the negative cluster of nodes (blue arrows).

Original: A similar effect takes place for positive nodes.
Revised: A similar effect takes place for positive nodes.

Original: The importance of looking ahead.
Revised: The importance of looking ahead.

Original: Fig.
Revised: Fig.

Original: 5 (center) plots for a range of thresholds
Revised: 5 (center) plots for a range of thresholds

Original: b the accuracy of h b at convergence ( T = ∞ ; orange line), and after one round ( T = 1 ; gray line).
Revised: b the accuracy of h b at convergence ( T = ∞ ; orange line), and after one round ( T = 1 ; gray line).

Original: The role of the latter is to illustrate the outcomes as ‘perceived’ by a myopic predictive model that considers only one round (e.g., includes only one response layer ˜∆ ); the differences between the two lines demonstrate the gap between perception (based on which training chooses a classifier ˆ h ) and reality (in which the classifier ˆ h is evaluated).
Revised: The role of the latter is to illustrate the outcomes as ‘perceived’ by a myopic predictive model that considers only one round (e.g., includes only one response layer ˜∆ ); the differences between the two lines demonstrate the gap between perception (based on which training chooses a classifier ˆ h ) and reality (in which the classifier ˆ h is evaluated).

Original: As can be seen, the mypoic approach leads to an under-estimation of the optimal b ∗ ; at b 1 ≈ 0 . 5 , performance for T = 1 is optimal, but is severely worse under the true
Revised: As can be seen, the mypoic approach leads to an under-estimation of the optimal b ∗ ; at b 1 ≈ 0 . 5 , performance for T = 1 is optimal, but is severely worse under the true

Original: T = ∞ , for which optimal performance is at b ∞ ≈ 1 . 15 .
Revised: T = ∞ , for which optimal performance is at b ∞ ≈ 1 . 15 .

Original: The figure also gives insight as to why this happens.
Revised: The figure also gives insight as to why this happens.

Original: For both b 1 and b ∞ , the figure shows (in bars) the relative number of points from each class who obtain ˆ y = 1 as a result of strategic moves.
Revised: For both b 1 and b ∞ , the figure shows (in bars) the relative number of points from each class who obtain ˆ y = 1 as a result of strategic moves.

Original: Bars are stacked, showing the relative number of points that moved per round T (darker = earlier rounds; lightest = convergence).
Revised: Bars are stacked, showing the relative number of points that moved per round T (darker = earlier rounds; lightest = convergence).

Original: As can be seen, at b 1 , the myopic models believes that many positive points, but only few negative points, will cross.
Revised: As can be seen, at b 1 , the myopic models believes that many positive points, but only few negative points, will cross.

Original: However, in reality, at convergence, the number of positive points that crossed is only slightly higher than that of negative points.
Revised: However, in reality, at convergence, the number of positive points that crossed is only slightly higher than that of negative points.

Original: Hence, the reason for the(erroneous) optimism of the myopic model is that it did not correctly account for the magnitude of
Revised: Hence, the reason for the(erroneous) optimism of the myopic model is that it did not correctly account for the magnitude of

Original: [Figure]
Revised: [Figure]

Original: correlated moves expressed
Revised: correlated moves expressed

Original: How movement affects accuracy.
Revised: How movement affects accuracy.

Original: An important observation about the relation between movement and accuracy is that for any classifier h , any negative point that moves hurts accuracy (since y =
Revised: An important observation about the relation between movement and accuracy is that for any classifier h , any negative point that moves hurts accuracy (since y =

Original: −but predictions become ˆ y = 1 ), whereas any positive point that moves helps accuracy (since y =and predictions are now ˆ y = 1 ).
Revised: −but predictions become ˆ y = 1 ), whereas any positive point that moves helps accuracy (since y =and predictions are now ˆ y = 1 ).

Original: Fig.
Revised: Fig.

Original: 5 (right) shows how these movements combine to affect accuracy.
Revised: 5 (right) shows how these movements combine to affect accuracy.

Original: The figure compares accuracy before strategic behavior ( T = 0 ; dashed line) to after one response round ( T = 1 ; solid line, top plot) and to convergence ( T = ∞ ; solid line, lower plot).
Revised: The figure compares accuracy before strategic behavior ( T = 0 ; dashed line) to after one response round ( T = 1 ; solid line, top plot) and to convergence ( T = ∞ ; solid line, lower plot).

Original: As can be seen, for any b , the difference between pre-strategic and post-strategic accuracy amounts to exactly the degradation due to negative points (red arrows) plus the improvement of positive points (green arrows).
Revised: As can be seen, for any b , the difference between pre-strategic and post-strategic accuracy amounts to exactly the degradation due to negative points (red arrows) plus the improvement of positive points (green arrows).

Original: Note, however, the difference between T = 1 and T = ∞ , as they relate to the benchmark model ( T = 0 , i.e., no strategic behavior).
Revised: Note, however, the difference between T = 1 and T = ∞ , as they relate to the benchmark model ( T = 0 , i.e., no strategic behavior).

Original: For T = 1 (top), across the range of b , positive and negative moves roughly balance out.
Revised: For T = 1 (top), across the range of b , positive and negative moves roughly balance out.

Original: A result of this is that curves for T = 0 and T
Revised: A result of this is that curves for T = 0 and T

Original: = 1 are very much similar, and share similar peaks in terms of accuracy (both have ≈ 0 . 89 ).
Revised: = 1 are very much similar, and share similar peaks in terms of accuracy (both have ≈ 0 . 89 ).

Original: One interpretation of this is that if points were permitted to move only one round, the optimal classifier can completely recover the benchmark accuracy by ensuring that the number of positive points the moves overcomes the number of negative points.
Revised: One interpretation of this is that if points were permitted to move only one round, the optimal classifier can completely recover the benchmark accuracy by ensuring that the number of positive points the moves overcomes the number of negative points.

Original: However, for T = ∞ (bottom), there is a skew in favor of positive points (green arrows).
Revised: However, for T = ∞ (bottom), there is a skew in favor of positive points (green arrows).

Original: The result of this is that for the optimal b , additional rounds allow positive points to move in a way that obtains slightly higher accuracy (0.91) compared to the benchmark (0.89).
Revised: The result of this is that for the optimal b , additional rounds allow positive points to move in a way that obtains slightly higher accuracy (0.91) compared to the benchmark (0.89).

Original: This is one possible mechanism underlying our results on synthetic data in Sec. 5.1, and later for our results on real data in Sec. 5.2.
Revised: This is one possible mechanism underlying our results on synthetic data in Sec. 5.1, and later for our results on real data in Sec. 5.2.

Original: D. E XPERIMENTS ON REAL DATA D.2. E XTENDING NEIGHBORHOOD SIZE
Revised: D. E XPERIMENTS ON REAL DATA D.2. E XTENDING NEIGHBORHOOD SIZE

Original: One hyperparameter of SGC is the number ‘propagation’ layers, K , which effectively determines the graph distance at which nodes can influence others (i.e., the ‘neighborhood radius’).
Revised: One hyperparameter of SGC is the number ‘propagation’ layers, K , which effectively determines the graph distance at which nodes can influence others (i.e., the ‘neighborhood radius’).

Original: Given K , the embedding weights are defined as (cid:102) W = D − 

Revised: Given K , the embedding weights are defined as (cid:102) W = D −

Original: A K D − 12 where A is the adjacency matrix and D is the diagonal degree matrix.
Revised: A K D − 12 where A is the adjacency matrix and D is the diagonal degree matrix.

Original: For K = 0 , the graph is unused, which results in a standar linear classifier over node features.
Revised: For K = 0 , the graph is unused, which results in a standar linear classifier over node features.

Original: Our results in the main body of the paper use K = 1 .
Revised: Our results in the main body of the paper use K = 1 .

Original: Fig.
Revised: Fig.

Original: 6 shows results for an increasing K (we set T = 3 , d = 0 .
Revised: 6 shows results for an increasing K (we set T = 3 , d = 0 .

Original: 25 as in our main results).
Revised: 25 as in our main results).

Original: Results are mixed: for PubMed, higher K seems to lead to less drop in accuracy for naïve and less recovery for our approach; for Cora and CiteSeer, results are unstable.
Revised: Results are mixed: for PubMed, higher K seems to lead to less drop in accuracy for naïve and less recovery for our approach; for Cora and CiteSeer, results are unstable.

Original: Note however that this may likely be a product of our inductive setup: since varying K also changes the effective test set (since to preserve inductiveness, larger K often necessitates removing more nodes), test sets vary across conditions and decrease in size, making it difficult to directly compare result across different K .
Revised: Note however that this may likely be a product of our inductive setup: since varying K also changes the effective test set (since to preserve inductiveness, larger K often necessitates removing more nodes), test sets vary across conditions and decrease in size, making it difficult to directly compare result across different K .

Original: D.2. S TRATEGIC IMPROVEMENT
Revised: D.2. S TRATEGIC IMPROVEMENT

Original: Our main results in Sec.
Revised: Our main results in Sec.

Original: 5.2 show that for CiteSeer, our strategically-aware approach outperforms the non-strategic benchmark (similarly to our synthetic experiments).
Revised: 5.2 show that for CiteSeer, our strategically-aware approach outperforms the non-strategic benchmark (similarly to our synthetic experiments).

Original: Here we show that these results are robust.
Revised: Here we show that these results are robust.

Original: Fig.
Revised: Fig.

Original: 7 provides higher-resolution results on CiteSeer for max distances d ∈ [0 , 0 . 22] in hops of 0 .
Revised: 7 provides higher-resolution results on CiteSeer for max distances d ∈ [0 , 0 . 22] in hops of 0 .

Original: All other aspects the setup match the original experiment.
Revised: All other aspects the setup match the original experiment.

Original: As can be seen, our approach slightly but consistently improves upon the benchmark until d ≈ 0 . 17 .
Revised: As can be seen, our approach slightly but consistently improves upon the benchmark until d ≈ 0 . 17 .

Original: [Figure]
Revised: [Figure]

Original: D. N ODE CENTRALITY AND INFLUENCE
Revised: D. N ODE CENTRALITY AND INFLUENCE

Original: In this experiment we set to explore the role played by central nodes in the graph in propagating the influence of strategic behavior.
Revised: In this experiment we set to explore the role played by central nodes in the graph in propagating the influence of strategic behavior.

Original: Since the embedding of a node i is partly determined by its in-neighbors, broadly we would expect that nodes have high out-degree would be highly influential: as ‘anchors’ that prevent others from moving if they themselves do not, and as ‘carriers’ which either push neighbors over the boundary—or at least promote the closer to it—if they do move.
Revised: Since the embedding of a node i is partly determined by its in-neighbors, broadly we would expect that nodes have high out-degree would be highly influential: as ‘anchors’ that prevent others from moving if they themselves do not, and as ‘carriers’ which either push neighbors over the boundary—or at least promote the closer to it—if they do move.

Original: Experimental setup.
Revised: Experimental setup.

Original: To study the role of such nodes, we preform the following experiment.
Revised: To study the role of such nodes, we preform the following experiment.

Original: First, we order the nodes by decreasing out-degree, so that the potentially more influential nodes appear first in the ranking.
Revised: First, we order the nodes by decreasing out-degree, so that the potentially more influential nodes appear first in the ranking.

Original: Then, for each q ∈ { 0 , 10 , 20 , ..., 100 } , we disconnect nodes in the q th percentile, i.e., remove all edges emanating from the top- q % ranked nodes.
Revised: Then, for each q ∈ { 0 , 10 , 20 , ..., 100 } , we disconnect nodes in the q th percentile, i.e., remove all edges emanating from the top- q % ranked nodes.

Original: For each such condition, we examine learning and its outcomes, and compare performance to a control condition in which nodes are ordered randomly.
Revised: For each such condition, we examine learning and its outcomes, and compare performance to a control condition in which nodes are ordered randomly.

Original: The difference in performance and other learning outcomes provides us with a measure of the importance of high-degree nodes.
Revised: The difference in performance and other learning outcomes provides us with a measure of the importance of high-degree nodes.

Original: Results.
Revised: Results.

Original: Figure 8 shows results for all methods (naïve, robust (ours), and the non-strategic benchmark) and across all three datasets (Cora, CiteSeer, and Pubmed).
Revised: Figure 8 shows results for all methods (naïve, robust (ours), and the non-strategic benchmark) and across all three datasets (Cora, CiteSeer, and Pubmed).

Original: In all conditions, we vary on the x-axis the portion of nodes that remain connected, where at zero (left end) we get an empty graph, and at 100 (right end)
Revised: In all conditions, we vary on the x-axis the portion of nodes that remain connected, where at zero (left end) we get an empty graph, and at 100 (right end)

Original: we get the original graph.
Revised: we get the original graph.

Original: Note that the y-axis varies in scale across plots.
Revised: Note that the y-axis varies in scale across plots.

Original: First, consider Cora.
Revised: First, consider Cora.

Original: In terms of accuracy (upper plots), results show that on the benchmark (evaluated in a non-strategic environment, in which users do not move), the general trend is that more edges help improve performance.
Revised: In terms of accuracy (upper plots), results show that on the benchmark (evaluated in a non-strategic environment, in which users do not move), the general trend is that more edges help improve performance.

Original: However, the gain in performance is much more pronounced for highdegree nodes.
Revised: However, the gain in performance is much more pronounced for highdegree nodes.

Original: Interestingly, for the naïve method (which operates on strategically modified data, but does not anticipate updates), the trend is reversed: user utilize edges in a way that is detrimental to performance—and more so when high-degree nodes remain, making them a vulnerability.
Revised: Interestingly, for the naïve method (which operates on strategically modified data, but does not anticipate updates), the trend is reversed: user utilize edges in a way that is detrimental to performance—and more so when high-degree nodes remain, making them a vulnerability.

Original: Our robust approach is also sensitive to the addition of edges, but to a much lesser degree (the drop is performance is minor); moreover, which nodes are disconnected appears to make little difference, which we take to mean that our approach can counter the dominant role of central nodes.
Revised: Our robust approach is also sensitive to the addition of edges, but to a much lesser degree (the drop is performance is minor); moreover, which nodes are disconnected appears to make little difference, which we take to mean that our approach can counter the dominant role of central nodes.

Original: The lower plots, which describe the portion of users that moves and the portion of users that crossed, provides some explanation as to how this is achieved.
Revised: The lower plots, which describe the portion of users that moves and the portion of users that crossed, provides some explanation as to how this is achieved.

Original: For the naïve approach, nearly half of all user move—and all users that move, also cross.
Revised: For the naïve approach, nearly half of all user move—and all users that move, also cross.

Original: This occurs faster (in terms of the portion of nodes removed) in the degree condition.
Revised: This occurs faster (in terms of the portion of nodes removed) in the degree condition.

Original: In our robust approach, note that the number of nodes that move is halved, and of those, not all cross, which demonstrates how are learning objective, which anticiaptes strategic behavior, can act to prevent it.
Revised: In our robust approach, note that the number of nodes that move is halved, and of those, not all cross, which demonstrates how are learning objective, which anticiaptes strategic behavior, can act to prevent it.

Original: For CiteSeer and PubMed, the general trend in accuracy is reversed for the non-strategic benchmark, and for the naïve approach, begins with a gap, which closes at some point (sooner in CiteSeer).
Revised: For CiteSeer and PubMed, the general trend in accuracy is reversed for the non-strategic benchmark, and for the naïve approach, begins with a gap, which closes at some point (sooner in CiteSeer).

Original: Despite these differences, the qualitative behavior of our robust classifier is similar to Cora, and achieves fairly stable accuracy (with a mild negative slope) in both conditions and for both datasets.
Revised: Despite these differences, the qualitative behavior of our robust classifier is similar to Cora, and achieves fairly stable accuracy (with a mild negative slope) in both conditions and for both datasets.

Original: As in citeseer, movement and crossing behavior is similar, in that for the naïve approach a considerable portion of users move and cross (with a gap between conditions in PubMed); and in that our robust approach greatly reduces the number of users that move, and even more so the number users that cross.
Revised: As in citeseer, movement and crossing behavior is similar, in that for the naïve approach a considerable portion of users move and cross (with a gap between conditions in PubMed); and in that our robust approach greatly reduces the number of users that move, and even more so the number users that cross.

Original: E A DDITIONAL ANALYTIC RESULTS E. P ERFORMANCE GAPS : ROBUST LEARNING VS . THE NON - STRATEGIC BENCHMARK
Revised: E A DDITIONAL ANALYTIC RESULTS E. P ERFORMANCE GAPS : ROBUST LEARNING VS . THE NON - STRATEGIC BENCHMARK

Original: When learning a robust classifier on strategic data, intuitively we may hope that its performance approaches that of the optimal classifier on non-strategic data, which we may think of as a target upper bound.
Revised: When learning a robust classifier on strategic data, intuitively we may hope that its performance approaches that of the optimal classifier on non-strategic data, which we may think of as a target upper bound.

Original: A natural question to then ask is - can we always reach this upper bound and close the performance gap?
Revised: A natural question to then ask is - can we always reach this upper bound and close the performance gap?

Original: Here we answer this question in the negative, by showing a simple example where the optimal classifier on non-strategic data achieves perfect accuracy, but the optimal classifier on strategic data achieves only 0.66 accuracy.
Revised: Here we answer this question in the negative, by showing a simple example where the optimal classifier on non-strategic data achieves perfect accuracy, but the optimal classifier on strategic data achieves only 0.66 accuracy.

Original: We then show that by introducing a mild change—namely slightly shifting the features of one node—the performance gap closes entirely.
Revised: We then show that by introducing a mild change—namely slightly shifting the features of one node—the performance gap closes entirely.

Original: This, combined with our result from the previous Sec.
Revised: This, combined with our result from the previous Sec.

Original: D.2.2 showing that the gap can also be negative , highlights how the gap in performance greatly depends on the structure of the input (i.e., the graph, features, and labels), and in a way which can be highly sensitive even to minor changes.
Revised: D.2.2 showing that the gap can also be negative , highlights how the gap in performance greatly depends on the structure of the input (i.e., the graph, features, and labels), and in a way which can be highly sensitive even to minor changes.

Original: E.1. L ARGE GAP
Revised: E.1. L ARGE GAP

Original: Our first example in which the best obtainable gap is 0.33 is shown in Figure 9 (Left) .
Revised: Our first example in which the best obtainable gap is 0.33 is shown in Figure 9 (Left) .

Original: The example has three nodes described by one-dimensional features x 1 = 1 . 2 , x 2 = − 1 , x 3 = − 1 and with labels y 1 = 1 , y 2 = − 1 , y 3 = − 1 .
Revised: The example has three nodes described by one-dimensional features x 1 = 1 . 2 , x 2 = − 1 , x 3 = − 1 and with labels y 1 = 1 , y 2 = − 1 , y 3 = − 1 .

Original: We use the standard cost function so that maximal distance to move is d β = 2 , and use uniform edge weights.
Revised: We use the standard cost function so that maximal distance to move is d β = 2 , and use uniform edge weights.

Original: Since x ∈ R , classifiers are simply threshold functions on the real line, defined by a threshold parameter b ∈ R .
Revised: Since x ∈ R , classifiers are simply threshold functions on the real line, defined by a threshold parameter b ∈ R .

Original: First, we demonstrate that for non-strategic data, there exists a ‘benchmark’ classifier that achieves perfect accuracy.
Revised: First, we demonstrate that for non-strategic data, there exists a ‘benchmark’ classifier that achieves perfect accuracy.

Original: Let b = 0 .
Revised: Let b = 0 .

Original: Node embeddings are:
Revised: Node embeddings are:

Original: [Equation]
Revised: [Equation]

Original: This give predictions ˆ y 1 =
Revised: This give predictions ˆ y 1 =

Original: +1 =
Revised: +1 =

Original: y 1 , ˆ y 2 = − 1 =
Revised: y 1 , ˆ y 2 = − 1 =

Original: y 2 , ˆ y 3 = − 1 = y 3 , which are all correct.
Revised: y 2 , ˆ y 3 = − 1 = y 3 , which are all correct.

Original: Next.
Revised: Next.

Original: we prove that there is no robust classifier capable of achieving perfect accuracy on strategic data.
Revised: we prove that there is no robust classifier capable of achieving perfect accuracy on strategic data.

Original: Suppose by contradiction that such a classifier exists, denoted b .
Revised: Suppose by contradiction that such a classifier exists, denoted b .

Original: For x 2 to move in the first round, the following conditions must hold:
Revised: For x 2 to move in the first round, the following conditions must hold:

Original: [Equation]
Revised: [Equation]

Original: Since x 2 moves at most distance 2, it moves in the first round only if − 1 3 < b ≤ 1 3 .
Revised: Since x 2 moves at most distance 2, it moves in the first round only if − 1 3 < b ≤ 1 3 .

Original: However, if it does move - it ends up getting an incorrect prediction.
Revised: However, if it does move - it ends up getting an incorrect prediction.

Original: In addition, in this case x 3 can also get a positive prediction (either in the first round or in the next round, depending on whether b > 0 ), in which case the accuracy is 13 .
Revised: In addition, in this case x 3 can also get a positive prediction (either in the first round or in the next round, depending on whether b > 0 ), in which case the accuracy is 13 .

Original: Thus, we get that 13 < b (note that for b < − 13 x 2 is classified as positive which is wrong).
Revised: Thus, we get that 13 < b (note that for b < − 13 x 2 is classified as positive which is wrong).

Original: Next, we look at the behavior of x 1 in the first round.
Revised: Next, we look at the behavior of x 1 in the first round.

Original: Conditions for movement are:
Revised: Conditions for movement are:

Original: [Equation]
Revised: [Equation]

Original: Here x 1 gets negative classification if b > 0 .
Revised: Here x 1 gets negative classification if b > 0 .

Original: If b > 1 , then x 1 does not move, since the distance required is larger than 2.
Revised: If b > 1 , then x 1 does not move, since the distance required is larger than 2.

Original: Thus, x 1 does move (beyond the classifier) and gets the correct prediction only if 0 < b ≤ 1 .
Revised: Thus, x 1 does move (beyond the classifier) and gets the correct prediction only if 0 < b ≤ 1 .

Original: However, considering now the second round of movement for x 2 (which only occurs if b > 13 since for 0 < b ≤ 13 x 2 moves at the first round), we get the conditions:
Revised: However, considering now the second round of movement for x 2 (which only occurs if b > 13 since for 0 < b ≤ 13 x 2 moves at the first round), we get the conditions:

Original: [Equation]
Revised: [Equation]

Original: [Figure]
Revised: [Figure]

Original: This means that for all 0 < b ≤ 1 , x 2 moves and gets an incorrect prediction.
Revised: This means that for all 0 < b ≤ 1 , x 2 moves and gets an incorrect prediction.

Original: This occurs either for x 1 or for x 2 .
Revised: This occurs either for x 1 or for x 2 .

Original: Consequently, there is no b that achieves an accuracy of 1, which contradicts the assumption.
Revised: Consequently, there is no b that achieves an accuracy of 1, which contradicts the assumption.

Original: The optimal accuracy of any robust classifier for this example is 23 , which is achieved by any b > 1 .
Revised: The optimal accuracy of any robust classifier for this example is 23 , which is achieved by any b > 1 .

Original: In this case, none of the nodes move, and x 1 is classified negatively, whereas its true label is positive.
Revised: In this case, none of the nodes move, and x 1 is classified negatively, whereas its true label is positive.

Original: E.1. N O GAP
Revised: E.1. N O GAP

Original: We now give a nearly identical example, shown in Figure 9 (Right) , in which the gap becomes zero.
Revised: We now give a nearly identical example, shown in Figure 9 (Right) , in which the gap becomes zero.

Original: We use the same example as before, but set x 1 = 1 (instead of x 1 = 1 . 2 ).
Revised: We use the same example as before, but set x 1 = 1 (instead of x 1 = 1 . 2 ).

Original: We begin by showing that there does exist a classifier which achieves perfect accuracy on non-strategic data.
Revised: We begin by showing that there does exist a classifier which achieves perfect accuracy on non-strategic data.

Original: Let b = 0 , then embeddings are now:
Revised: Let b = 0 , then embeddings are now:

Original: [Equation]
Revised: [Equation]

Original: (note that since all nodes are connected in the graph, changing x 1 requires us to recompute all embeddings).
Revised: (note that since all nodes are connected in the graph, changing x 1 requires us to recompute all embeddings).

Original: Predictions now become:
Revised: Predictions now become:

Original: [Equation]
Revised: [Equation]

Original: which are all correct.
Revised: which are all correct.

Original: Next, we show that there also exists a classifier which achieves perfect accuracy no strategic data.
Revised: Next, we show that there also exists a classifier which achieves perfect accuracy no strategic data.

Original: Let b = 1 . 1 .
Revised: Let b = 1 . 1 .

Original: In the first round, x 1 moves, and flips its predicted label:
Revised: In the first round, x 1 moves, and flips its predicted label:

Original: [Equation]
Revised: [Equation]

Original: Here, even if the other nodes move to the fullest extent, they do not have sufficient influence to revert this prediction:
Revised: Here, even if the other nodes move to the fullest extent, they do not have sufficient influence to revert this prediction:

Original: [Equation]
Revised: [Equation]

Original: Thus, we get
Revised: Thus, we get

Original: [Equation]
Revised: [Equation]

Original: which are also all correct.
Revised: which are also all correct.

Original: E. S TRATEGIC BEHAVIOR OF CLIQUES
Revised: E. S TRATEGIC BEHAVIOR OF CLIQUES

Original: Here we give a result that considers graph structure.
Revised: Here we give a result that considers graph structure.

Original: In particular, we consider cliques, and show that for uniform weights, either all nodes move together—or none do.
Revised: In particular, we consider cliques, and show that for uniform weights, either all nodes move together—or none do.

Original: Proposition 6.
Revised: Proposition 6.

Original: Consider n nodes which are all fully connected, i.e., form a clique, and assume uniform edge weights.
Revised: Consider n nodes which are all fully connected, i.e., form a clique, and assume uniform edge weights.

Original: Then for any dimension d , any assignment of features x 1 , . .
Revised: Then for any dimension d , any assignment of features x 1 , . .

Original: , x n ∈ R d , and for any classifier h , either (i) all n nodes move in the first round, or (ii) none of the nodes move at all.
Revised: , x n ∈ R d , and for any classifier h , either (i) all n nodes move in the first round, or (ii) none of the nodes move at all.

Original: Proof.
Revised: Proof.

Original: Consider the case in which at least one node i moves in the first round.
Revised: Consider the case in which at least one node i moves in the first round.

Original: Denote by z the change in x i made in order to cross the classifier, i.e., z = x (1) i − x (0) i .
Revised: Denote by z the change in x i made in order to cross the classifier, i.e., z = x (1) i − x (0) i .

Original: Note that in order for x i to move, the following conditions must be satisfied:
Revised: Note that in order for x i to move, the following conditions must be satisfied:

Original: [Equation]
Revised: [Equation]

Original: We now show that every other node t , if it moves a distance of z , then it can also cross the classifier in the first round:
Revised: We now show that every other node t , if it moves a distance of z , then it can also cross the classifier in the first round:

Original: [Equation]
Revised: [Equation]

Original: Hence, we get that ϕ
Revised: Hence, we get that ϕ

Original: ( x (1) i ; x (0) − i )
Revised: ( x (1) i ; x (0) − i )

Original: = ϕ
Revised: = ϕ

Original: ( x
Revised: ( x

Original: [Equation]
Revised: [Equation]

Original: ) t ; x (0) − t ) , and thus θ T ϕ
Revised: ) t ; x (0) − t ) , and thus θ T ϕ

Original: ( x (1) t , x (0) − t )
Revised: ( x (1) t , x (0) − t )

Original: + b = 0 , which indicates that x t can also cross the classifier in the first round.
Revised: + b = 0 , which indicates that x t can also cross the classifier in the first round.

Original: E. G RAPH DIAMETER AND THE SPREAD OF INFORMATION
Revised: E. G RAPH DIAMETER AND THE SPREAD OF INFORMATION

Original: Since nodes that move can influence outcomes for their neighbors, intuitively we might expect that the diameter of the graph would be an upper bound on the reach of such influence.
Revised: Since nodes that move can influence outcomes for their neighbors, intuitively we might expect that the diameter of the graph would be an upper bound on the reach of such influence.

Original: Here we give a negative result which shows that influence can far exceed the diameter.
Revised: Here we give a negative result which shows that influence can far exceed the diameter.

Original: Proposition 7.
Revised: Proposition 7.

Original: Let G be a graph with diameter d , then the number of update rounds is not bounded by d + c , for any constant c .
Revised: Let G be a graph with diameter d , then the number of update rounds is not bounded by d + c , for any constant c .

Original: Proof.
Revised: Proof.

Original: We prove by giving an example in which the number of rounds until convergence, T , is roughly twice the diameter.
Revised: We prove by giving an example in which the number of rounds until convergence, T , is roughly twice the diameter.

Original: We use the same example as in Sec.
Revised: We use the same example as in Sec.

Original: A.2, but with the following small changes: (i) we add edge from x n to x n +1 ; (ii) we add a new node, x n +2 = − 8 , and connect it with bidirectional edges to x 0 and x n +1 ; and (iii) we set the weight of every edge to be 13 .
Revised: A.2, but with the following small changes: (i) we add edge from x n to x n +1 ; (ii) we add a new node, x n +2 = − 8 , and connect it with bidirectional edges to x 0 and x n +1 ; and (iii) we set the weight of every edge to be 13 .

Original: We denote by G the original graph from Sec.
Revised: We denote by G the original graph from Sec.

Original: A.2, and by G ′ the graph with the above changes applied.
Revised: A.2, and by G ′ the graph with the above changes applied.

Original: By construction, G ′ is a circular graph with n + 3 nodes; hence, its diameter is ⌊ n +32 ⌋ .
Revised: By construction, G ′ is a circular graph with n + 3 nodes; hence, its diameter is ⌊ n +32 ⌋ .

Original: We claim that the changes made to G ′ do not affect the behavior of nodes, i.e., in both G and G ′ , in each round t , the same nodes move and in the same manner.
Revised: We claim that the changes made to G ′ do not affect the behavior of nodes, i.e., in both G and G ′ , in each round t , the same nodes move and in the same manner.

Original: Note that our construction in Sec.
Revised: Note that our construction in Sec.

Original: A. contains ‘modules’ of size 3 that are connected sequentially, together with start and end nodes, to
Revised: A. contains ‘modules’ of size 3 that are connected sequentially, together with start and end nodes, to

Original: [Figure]
Revised: [Figure]

Original: form a graph of size n + 2 .
Revised: form a graph of size n + 2 .

Original: To show that the node we add in this construction does not cause the final nodes to move, it suffices to consider whether x n +1 can cross—we will show that it cannot, which implies that x n +2 and x 0 will not cross either.
Revised: To show that the node we add in this construction does not cause the final nodes to move, it suffices to consider whether x n +1 can cross—we will show that it cannot, which implies that x n +2 and x 0 will not cross either.

Original: In the first round, we saw that in G , x 1 moves, but for all 2 ≤ i ≤ n , x i does not move.
Revised: In the first round, we saw that in G , x 1 moves, but for all 2 ≤ i ≤ n , x i does not move.

Original: Since there is no change in the features of these nodes or the edge weights, this behavior also occurs in G ′ .
Revised: Since there is no change in the features of these nodes or the edge weights, this behavior also occurs in G ′ .

Original: Note xdoes not move at the first round:
Revised: Note xdoes not move at the first round:

Original: [Equation]
Revised: [Equation]

Original: Next, we show that x n +2 does not move in the first round either.
Revised: Next, we show that x n +2 does not move in the first round either.

Original: [Equation]
Revised: [Equation]

Original: Next, we show that x n +1 does not move:
Revised: Next, we show that x n +1 does not move:

Original: [Equation]
Revised: [Equation]

Original: In the second round, a node can potentially move only if one of its neighbours moved in the first round.
Revised: In the second round, a node can potentially move only if one of its neighbours moved in the first round.

Original: As in G , x 2 moves in G ′ as well.
Revised: As in G , x 2 moves in G ′ as well.

Original: We now show that x 0 does not move:
Revised: We now show that x 0 does not move:

Original: [Equation]
Revised: [Equation]

Original: For each round t , let 3 ≤ t ≤ n correspond to the node x t which moves in G ′ as it moves in G .
Revised: For each round t , let 3 ≤ t ≤ n correspond to the node x t which moves in G ′ as it moves in G .

Original: We now show that in round n + 1 there is no movement.
Revised: We now show that in round n + 1 there is no movement.

Original: In round n , x n is the only one that moves.
Revised: In round n , x n is the only one that moves.

Original: Thus, the only nodes that might move are its neighbors, x n − 1 and x n +1 .
Revised: Thus, the only nodes that might move are its neighbors, x n − 1 and x n +1 .

Original: Since x n − 1 has already moved at round n − 1 , it will not move again (Prop. 1).
Revised: Since x n − 1 has already moved at round n − 1 , it will not move again (Prop. 1).

Original: This leaves x n +1 , which we now show does not move either:
Revised: This leaves x n +1 , which we now show does not move either:

Original: [Equation]
Revised: [Equation]

Original: This concludes that while the diameter of the graph is ⌊ n +32 ⌋ , the number of rounds in n .
Revised: This concludes that while the diameter of the graph is ⌊ n +32 ⌋ , the number of rounds in n .