Fundamental Bounds on Online Strategic Classification

TL;DR

This paper investigates the fundamental limits of online strategic classification, revealing how strategic manipulation affects mistake bounds and proposing algorithms with near-optimal performance in various models.

Contribution

It establishes lower bounds on mistake and regret in strategic settings and introduces randomized algorithms that achieve sublinear regret, highlighting differences between models.

Findings

Deterministic algorithms cannot achieve mistake bounds o(Δ) in strategic settings.

Proposed algorithms attain mistake bounds of O(Δ log|H|).

Randomized models show that the order of agent response impacts regret bounds.

Abstract

We study the problem of online binary classification where strategic agents can manipulate their observable features in predefined ways, modeled by a manipulation graph, in order to receive a positive classification. We show this setting differs in fundamental ways from non-strategic online classification. For instance, whereas in the non-strategic case, a mistake bound of $\ln|H|$ is achievable via the halving algorithm when the target function belongs to a known class $H$, we show that no deterministic algorithm can achieve a mistake bound $o(\Delta)$ in the strategic setting, where $\Delta$ is the maximum degree of the manipulation graph (even when $|H|=O(\Delta)$). We obtain an algorithm achieving mistake bound $O(\Delta\ln|H|)$. We also extend this to the agnostic setting and obtain an algorithm with a $\Delta$ multiplicative regret, and we show no deterministic algorithm can achieve $o(\Delta)$ multiplicative regret. Next, we study two randomized models based on whether the random choices are made before or after agents respond, and show they exhibit fundamental differences. In the first model, at each round the learner deterministically chooses a probability distribution over classifiers inducing expected values on each vertex (probabilities of being classified as positive), which the strategic agents respond to. We show that any learner in this model has to suffer linear regret. On the other hand, in the second model, while the adversary who selects the next agent must respond to the learner's probability distribution over classifiers, the agent then responds to the actual hypothesis classifier drawn from this distribution. Surprisingly, we show this model is more advantageous to the learner, and we design randomized algorithms that achieve sublinear regret bounds against both oblivious and adaptive adversaries.

Tables

Table 1. Table 1: This table summarizes the main results of this paper for the model of deterministic classifiers, fractional classifiers, and randomized algorithms respectively. We use Δ Δ \Delta to denote the maximum degree of the manipulation graph, and Δ ~ ~ Δ \tilde{\Delta} to denote the maximum degree of the expanded manipulation graph, which is constructed from a weighted graph by connecting all pairs of nodes ( u , v ) ∈ 𝒳 2 𝑢 𝑣 superscript 𝒳 2 (u,v)\in\mathcal{X}^{2} where 𝖢𝗈𝗌𝗍 ​ ( u , v ) ≤ 1 𝖢𝗈𝗌𝗍 𝑢 𝑣 1 \mathsf{Cost}(u,v)\leq 1 . Although the table is presented in terms of undirected graphs, we remark that all the upper and lower can be extended to the setting of directed graphs, with the degrees to be replaced by the corresponding out-degrees, see Section   A.3 for an example in the setting of deterministic classifiers. 𝖮𝖯𝖳 𝖮𝖯𝖳 \mathsf{OPT} stands for the optimal number of mistakes achieved by the best hypothesis in class ℋ ℋ \mathcal{H} .

Type of Randomness	Manipulation Graph	Upper Bound	Lower Bound
Deterministic	Unweighted	Realizable $O\left(\Delta \ln \left|\mathscr{H}\right|\right)$ LABEL:alg:halving (Theorem 4.3) Agnostic $O\left(\Delta \cdot \mathrm{𝖮𝖯𝖳}+\Delta \ln \left|\mathscr{H}\right|\right)$ LABEL:alg:biased-weighted-maj-vote (Theorem 4.5)	Realizable $\Delta -1$ Theorem 4.6 Agnostic $\Delta \cdot \mathrm{𝖮𝖯𝖳}$ Theorem 4.6
Fractional Classifiers (random choice after agents respond)	Free-edges	$O\left(\Delta \cdot \mathrm{𝖮𝖯𝖳}+\Delta \ln \left|\mathscr{H}\right|\right)$ LABEL:alg:biased-weighted-maj-vote (Theorem 4.5)	$\frac{\Delta }{2}\cdot \mathrm{𝖮𝖯𝖳}$ Theorem 5.1
	Weighted	$O\left(\tilde{\Delta }\cdot \mathrm{𝖮𝖯𝖳}+\tilde{\Delta }\ln \left|\mathscr{H}\right|\right)$ Proposition 5.5	$\frac{\Delta }{4}\cdot \mathrm{𝖮𝖯𝖳}\left(\frac{\tilde{\Delta }}{4}\cdot \mathrm{𝖮𝖯𝖳}\right)$ Theorem 5.2
Randomized Algorithms (random choice before agents respond)	Unweighted	Oblivious $O\left(T^{\frac{2}{3}}{\ln }^{\frac{1}{3}}\left|\mathscr{H}\right|\right)$ LABEL:alg:reduction-MAB-FIB (Theorem 6.1) Adaptive $\tilde{O}\left(T^{\frac{3}{4}}{\ln }^{\frac{1}{4}}\left|\mathscr{H}\right|\right)$ LABEL:alg:reduction-adaptive (Theorem A.5) $\tilde{O}\left(\sqrt{T\left|\mathscr{H}\right|\ln \left|\mathscr{H}\right|}\right)$ Vanilla EXP3 Algorithm	Open

Equations

$$\displaystyle v_{t}\in\mathsf{BR}_{h_{t}}(u_{t})\triangleq\arg\max_{v\in\mathcal{X}}\Big{[}\mathsf{Value}(h_{t}(v))-\mathsf{Cost}(u_{t},v)\Big{]}.$$

$$\mathsf{Regret}(T)\triangleq \sum _{t=1}^T\ell (h_t,{\mathsf{BR}}_{h_t}(u_t),y_t)-\underset{h^{\star }\in \mathcal{H}}{\min }\sum _{t=1}^T\ell (h^{\star },{\mathsf{BR}}_{h^{\star }}(u_t),y_t).$$

$$\mathsf{OPT}\triangleq \underset{h^{\star }\in \mathcal{H}}{\min }\sum _{t=1}^T\ell (h^{\star },{\mathsf{BR}}_{h^{\star }}(u_t),y_t).$$

$$\ell (h,{\mathsf{BR}}_h(u),y)=\{\begin{array}{ll}1& y=+1\text{, }\forall v\in N[u]:h(v)=-1;\\ 1& y=-1\text{, }\exists v\in N[u]:h(v)=+1;\\ 0& \text{otherwise}.\end{array}$$

$$\mathsf{Mistake}(T)\triangleq \sum _{t=1}^T\ell (h_t,{\mathsf{BR}}_{h_t}(u_t),y_t).$$

$${\left(1-\frac{1}{\Delta +2}\right)}^M|\mathcal{H}|\ge 1\Rightarrow M\le (\Delta +2)\ln |\mathcal{H}|.$$

$$\displaystyle v_{t}\in\mathsf{BR}_{h_{t}}(u_{t})\triangleq\arg\max_{v\in\mathcal{X}}\Big{[}P_{h_{t}}(v)-\mathsf{Cost}(u_{t},v)\Big{]}.$$

$$\text{E}\left[\ell (h_t,v_t,y_t)\right]=\mathrm{Pr}\left[y_t\ne h_t(v_t)\right]=\{\begin{array}{ll}{P}_{h_t}(v_t),& \text{if }{y}_t=-1;\\ 1-P_{h_t}(v_t),& \text{if }{y}_t=+1.\end{array}$$

$$\text{E}[\mathsf{Mistake}(T)]=\text{E}\left[\sum _{t=1}^T\ell (h_t,{\mathsf{BR}}_{h_t}(u_t),y_t)\right]\ge T/2.$$

$$\text{E}[\mathsf{Mistake}(T)]\ge \frac{T}{2}=\frac{\Delta }{2}\cdot \frac{T}{\Delta }\ge \frac{\Delta }{2}\cdot \mathsf{OPT}.$$

$$\text{E}[\ell (h_t,{\mathsf{BR}}_{h_t}(u_t),y_t)]=1-P_{h_t}(v_t)\ge 1-p>1-w>\frac{1}{4}.$$

$$\text{E}[\mathsf{Mistake}(T)]=\text{E}\left[\sum _{t=1}^T\ell (h_t,{\mathsf{BR}}_{h_t}(u_t),y_t)\right]\ge \frac{T}{4}\ge \frac{\Delta }{4}\cdot \mathsf{OPT}.$$

$$\mathsf{Mistake}(T)\le e(\Delta +2)(\ln |\mathcal{H}|+\mathsf{OPT}).$$

$$\text{E}\left[\mathsf{Regret}(T)\right]\triangleq \text{E}\left[\sum _{t=1}^T\ell (h_t,{\mathsf{BR}}_{h_t}(u_t),y_t)\right]-\underset{h^{\star }\in \mathcal{H}}{\min }\left[\sum _{t=1}^T\ell (h^{\star },{\mathsf{BR}}_{h^{\star }}(u_t),y_t)\right].$$

$$p_{t+1}(h)\propto p_t(h)\cdot \exp \left(-\eta \cdot \frac{\ell (h_t,{\mathsf{BR}}_{h_t}(u_t),y_t)\cdot 1\left\{h=h_t\right\}}{p_t(h)}\right),\forall h\in \mathcal{H}.$$

$${\text{E}}_{{\tau }_j\sim B_j}[{\hat{\ell }}_j(h)]={\text{E}}_{{\tau }_j\sim B_j}[{\ell }_{{\tau }_j}(h)]=\overline{{\ell }_j}(h).$$

$${\text{E}}_{h\sim p_j}\left[{\bar{\ell }}_j(h)\right]={\text{E}}_{{\tau }_j}{\text{E}}_{h\sim p_j}\left[{\hat{\ell }}_j(h)\right].$$

$$\text{E}\left[\sum _{t\in B_j}{\ell }_t(h_t)\right]=$$

$$\le$$

$$=$$

$$\text{E}\left[\sum _{t=1}^T{\ell }_t(h_t)\right]=$$

$$\displaystyle{\sum_{j=1}^{K}\E_{h\sim p_{j}}\left[\hat{\ell}_{j}(h)\right]}-{\min_{h^{\star}\in\mathcal{H}}\sum_{j=1}^{K}\hat{\ell}_{j}(h^{\star})}\leq\mathcal{O}\Big{(}\sqrt{K\ln|\mathcal{H}|}\Big{)}.$$

$${\text{E}}_{{\tau }_1,\cdots ,{\tau }_K}\left[\sum _{j=1}^K{\text{E}}_{h\sim p_j}\left[{\hat{\ell }}_j(h)\right]\right]\le$$

$$\le$$

$$=$$

$$\text{E}\left[\sum _{t=1}^T{\ell }_t(h_t)\right]\le$$

$$=$$

$${\gamma }^{\mathsf{OPT}}\le W_T\le |\mathcal{H}|{\left(1-\frac{\gamma }{\Delta +2}\right)}^M$$

$$\displaystyle\Rightarrow\$$

$$1+\Delta \cdot \ln (|{\mathcal{H}}^{\prime }|)\le 1+\Delta \cdot \min \{\ln |\mathcal{H}|,\ln (2^{n-\delta -1})=1+\Delta \cdot \min \{\ln |\mathcal{H}|,n-\delta -1\}$$

$$\min \{n-\delta ,1+\Delta \cdot \min \{\ln |\mathcal{H}|,n-\delta -1\}\}$$

$$\text{E}\left[\widehat{{\ell }_t}(h)-{\ell }_t(h)|{\mathcal{F}}_{t-1}\right]=$$

$$\text{E}\left[\sum _{t=1}^T{\ell }_t(h_t)\right]=$$

Full text

Next, we study two randomized models based on whether the random choices are made before or after agents respond, and show they exhibit fundamental differences. In the first, fractional model, at each round the learner deterministically chooses a probability distribution over classifiers inducing expected values on each vertex (probabilities of being classified as positive), which the strategic agents respond to. We show that any learner in this model has to suffer linear regret. On the other hand, in the second randomized algorithms model, while the adversary who selects the next agent must respond to the learner’s probability distribution over classifiers, the agent then responds to the actual hypothesis classifier drawn from this distribution. Surprisingly, we show this model is more advantageous to the learner, and we design randomized algorithms that achieve sublinear regret bounds against both oblivious and adaptive adversaries.

1 Introduction

Strategic classification concerns the problem of learning classifiers that are robust to gaming by self-interested agents Brückner and Scheffer (2011); Hardt et al. (2016). An example is deciding who should be qualified for getting a loan and who should be rejected. Since applicants would like to be approved for getting a loan, they may spend efforts on activities that do not truly change their underlying loan-worthiness but may cause the classifier to label them as positive. An example of such efforts is holding multiple credit cards. Such gaming behaviors have nothing to do with their true qualification but could increase their credit score and therefore their chance of getting a loan. Strategic classification is particularly challenging in the online setting where data points arrive in an online manner. In this scenario, the way that examples manipulate depends on the current classifier. Therefore, the examples’ behavior changes over time and it may be different from examples with similar features observed in the previous rounds. Additionally, there is no useful source of unmanipulated data since there is no assumption that the unmanipulated data is coming from an underlying distribution.

Strategic agents are modeled as having bounded manipulation power, and a goal of receiving a positive classification. The set of plausible manipulations has been characterized in two different ways in the literature. The first model considers a geometric setting where each example is a point in the space that can move in a ball of bounded radius (e.g.,  Dong et al. (2018); Chen et al. (2020); Haghtalab et al. (2020); Ahmadi et al. (2021); Ghalme et al. (2021)). Another model is an abstraction of feasible manipulations using a manipulation graph that first was introduced by Zhang and Conitzer (2021). We follow the second model and formulate possible manipulations using a graph. Each possible feature vector is modeled as a node in this graph, and an edge from $\mathbf{x}\rightarrow\mathbf{x^{\prime}}$ in the manipulation graph implies that an agent with feature vector $\mathbf{x}$ may modify their features to $\mathbf{x^{\prime}}$ if it helps them to receive a positive classification. We consider the problem of online strategic classification given an underlying manipulation graph. Our goal is to minimize the Stackelberg regret which is the difference between the learner’s cumulative loss and the cumulative loss of the best-fixed hypothesis against the same sequence of agents, but best-responding to this fixed hypothesis.

In this paper, we consider three models with different levels of randomization. First, we consider the scenario where the learner can pick deterministic classifiers. A well-known deterministic algorithm in the context of online learning is the halving algorithm, which classically makes at most $O(\ln|\mathcal{H}|)$ mistakes when the target function belongs to class $\mathcal{H}$. First, we show that when agents are strategic, the halving algorithm fails completely and may end up making mistakes at every round even in this realizable case. Moreover, we show that no deterministic algorithm can achieve a mistake bound $o(\Delta)$ in the strategic setting, where $\Delta$ is the maximum degree of the manipulation graph, even when $|\mathcal{H}|=O(\Delta)$. We complement this result with a general algorithm achieving mistake bound $O(\Delta\ln|\mathcal{H}|)$ in the strategic setting. We further extend this algorithm to achieve $O(\Delta)$ multiplicative regret bounds in the non-realizable (agnostic) strategic setting, giving matching lower bounds as well.

Our next model is a fractional model where at each round the learner chooses a probability distribution over classifiers, inducing expected values on each vertex (the probability of each vertex being classified as positive), which the strategic agents respond to. The agents’ goal is to maximize their utility by reaching a state that maximizes their chance of getting classified as positive minus their modification cost. For this model, we show regret upper and lower bounds similar to the deterministic case.

In the last model, the learner again picks a probability distribution over classifiers, but now, while the adversary who selects the next agent must respond to this probability distribution, the agent responds to the actual classifier drawn from this distribution. That is, in this model, the random draw occurs after the adversary’s selection of the agent but before the agent responds, whereas in the fractional model the random draw occurs after the agent responds. Surprisingly, we show this model is not only more transparent to the agents, but also more advantageous to the learner than the fractional model. We argue that transparency can make the learner and agents cooperate against the adversary in a way that would be more beneficial to both parties, which is an interesting phenomenon that differentiates the strategic setting from the nonstrategic one. In this model, we design randomized algorithms that achieve sublinear regret bounds against both oblivious and adaptive adversaries. We give a detailed overview of our results in Section 3.

1.1 Related Work

Our work builds upon a growing line of research, initiated by Dalvi et al. (2004); Dekel et al. (2008); Brückner and Scheffer (2011), that studies learning from data provided by strategic agents. Hardt et al. (2016) differentiated the field of strategic classification from the more general area of learning under adversarial perturbations; they introduced the problem of strategic classification and modeled it as a sequential game between a jury that deploys a classifier and an agent that best responds to the classifier by modifying their features at a cost.

Following the framework of Hardt et al. (2016), recent works have focused on both the offline setting where examples come from underlying distributions (Zhang and Conitzer, 2021; Sundaram et al., 2021; Lechner and Urner, 2022; Perdomo et al., 2020) and the online settings where examples are chosen by an adversary in a sequential manner (Dong et al., 2018; Chen et al., 2020; Ahmadi et al., 2021). Milli et al. (2019); Hu et al. (2019) extend the setting considered by Hardt et al. (2016) to the case that heterogeneous sub-populations of strategic agents have different manipulation costs and studied other objectives such as social burden and fairness. A number of other works focus on incentivizing agents to take improvement actions that increase their true qualification as opposed to gaming actions (Kleinberg and Raghavan, 2020; Alon et al., 2020; Haghtalab et al., 2020; Ahmadi et al., 2022; Bechavod et al., 2022). The works by Shavit et al. (2020); Perdomo et al. (2020); Bechavod et al. (2021) study causal relationships between observable features and outcomes in strategic classification. Levanon and Rosenfeld (2021) provide a practical learning framework for strategic classification. Recent works relax the assumption that strategic agents best respond to the classifiers and consider alternative assumptions such as noisy response (Jagadeesan et al., 2021), learning agents (Zrnic et al., 2021), and non-myopic agents (Haghtalab et al., 2022).

Our work is most closely related to that of Zhang and Conitzer (2021); Lechner and Urner (2022), which captures the set of plausible manipulations using an underlying manipulation graph, where each edge $\mathbf{x}\rightarrow\mathbf{x^{\prime}}$ represents a plausible manipulation from features $\mathbf{x}$ to $\mathbf{x}^{\prime}$. This formulation is in contrast to a geometric model where agents’ features are vectors in a $d$-dimensional space, with manipulation cost captured by some distance metric. As a result, agents in the geometric setting move in a ball of bounded radius (Dong et al., 2018; Chen et al., 2020; Haghtalab et al., 2020; Ahmadi et al., 2021; Ghalme et al., 2021; Sundaram et al., 2021). However, the work of Zhang and Conitzer (2021); Lechner and Urner (2022) focuses on the offline PAC learning setting. Our work can be considered as generalizations of their model to the online learning setting.

Our work is also connected to the line of work that studies randomness and transparency in strategic classification. In terms of classification accuracy in the offline setting, Braverman and Garg (2020) shows that in a one-dimensional feature space, both committed randomness (probabilistic classifiers) and noisy features under deterministic classifiers can improve accuracy, and the optimal randomized classifier has a structure where agents are better off not manipulating. On the other hand, Ghalme et al. (2021) gives sufficient conditions under which transparency is the recommended policy for improving predictive accuracy. Our paper combines the insights of both papers in the online setting, where we show that randomness is necessary against the adversary that selects agents, but transparency is more advantageous when it comes to the strategic agents themselves (see Section 6.4 for more discussions). In addition to accuracy, there are also studies about the societal implications of randomization and transparency in the presence of multiple subpopulations, such as information discrepancy (Bechavod et al., 2022) and fairness (Immorlica et al., 2019; Kannan et al., 2019; Frankel and Kartik, 2022; Braverman and Garg, 2020).

2 Model

2.1 Strategic Classification

Let $\mathcal{X}$ denote the space of agents’ features, and $\mathcal{Y}=\{+1,-1\}$ denote the space of labels. We consider the task of sequential classification where the learner aims to classify a sequence of agents $\{u_{t},y_{t}\}_{t=1}^{T}$ that arrive in an online fashion. Here, we assume $u_{t}\in\mathcal{X}$ is the true feature set of agent $t$ and $y_{t}\in\mathcal{Y}$ is the true label. We call agents with $y_{t}=+1$ true positives, and the ones with $y_{t}=-1$ true negatives. Importantly, we make minimum assumptions on the sequence of agents, and our results apply to the case of adversarially chosen sequences. A hypothesis $h:\mathcal{X}\rightarrow\mathcal{Y}$ (also called a classifier or an expert) is a function that assigns labels to the agents $u\in\mathcal{X}$. Given a hypotheses class $\mathcal{H}:\mathcal{X}\to\mathcal{Y}$, our goal is to bound the total number of mistakes made by the learner, compared to the best classifier $h^{\star}\in\mathcal{H}$ in hindsight.

To model the gaming behavior in real-life classification tasks, we work with the setting of strategic classification, in which agents have the ability to modify their features at a given cost and reach a new observable state. Formally, strategic classification can be described as a repeated Stackelberg game between the learner (leader) and the agents (followers). At each step $t\in[T]$, the learner first publicly commits to a classifier $h_{t}$. Then, the $t$-th agent $(u_{t},y_{t})$ arrives and responds to $h_{t}$ by modifying their features from $u_{t}$ to $v_{t}$. As a result of manipulation, only $v_{t}$ (instead of $u_{t}$) is observable to the learner.

We assume that $v_{t}$ is chosen as a best-response ($\mathsf{BR}$) to the announced rule $h_{t}$, such that the agent’s utility is maximized:

[TABLE]

Here, $\mathsf{Value}(h_{t}(v))$ indicates the value of outcome $h_{t}(v)$, which is a binary function that takes the value of $1$ when $h_{t}(v)=+1$, and [math] when $h_{t}(v)=-1$. In Section 5, we consider the generalization of agents best responding to a probability distribution over classifiers, where $\mathsf{Value}(h_{t}(v))$ becomes the induced expectation on node $v$, i.e., the probability of $v$ getting classified as positive by $h_{t}$. Equivalently, we refer to $h_{t}$ as a fractional classifier and the induced probabilities as fractions. $\mathsf{Cost}(u_{t},v)$ is a known, non-negative cost function that captures the cost of modifying features from $u_{t}$ to $v$. It is natural to assume $\mathsf{Cost}(u,u)=0$ for all $u\in\mathcal{X}$. We use $v_{t}\in\mathsf{BR}_{h_{t}}(u_{t})$ to show the best-response of agent $u_{t}$ at time-step $t$. Ties are broken by always preferring features with higher $\mathsf{Value}(h_{t}(\cdot))$, and preferring to stay put, i.e. $u_{t}=v_{t}$, if $u_{t}$ is among the set of best-responses that achieves the highest value.

Learner’s Objective: The learner’s loss is defined as the misclassification error on the observable state: $\ell(h_{t},v_{t},y_{t})=\mathbf{1}\!\left\{y_{t}\neq h_{t}(v_{t})\right\}$. Since $v_{t}\in\mathsf{BR}_{h_{t}}(u_{t})$ and has the highest value of $h_{t}(\cdot)$ according to the tie breaking rule, we also abuse the notation and write \ell(h_{t},\mathsf{BR}_{h_{t}}(u_{t}),y_{t})=\mathbf{1}\!\left\{y_{t}\neq\Big{.}\max\left\{h_{t}(v):\ {v\in\mathsf{BR}_{h_{t}}(u_{t})}\right\}\right\}. The learner’s goal is to minimize the Stackelberg regret with respect to the best hypothesis $h^{\star}\in\mathcal{H}$ in hindsight, had the agents best responded to $h^{\star}$:

[TABLE]

For notational convenience, we use $\mathsf{OPT}$ to denote the optimal loss achieved by the best hypothesis:

[TABLE]

When $\mathsf{OPT}=0$, we call the sequence of agents realizable, meaning that there exists a perfect classifier that never makes a mistake had agents best responded to it. Otherwise when $\mathsf{OPT}>0$, we call it unrealizable or agnostic.

2.2 Manipluation Graph

We use graph $G(\mathcal{X},\mathcal{E})$ to characterize the set of plausible manipulations. In graph $G$, each node in $\mathcal{X}$ corresponds to a state (i.e., features), and each edge $e=(u,v)\in\mathcal{E}$ captures a plausible manipulation from $u$ to $v$. The cost function $\mathsf{Cost}(u,v)$ is defined as the sum of costs on the shortest path from $u$ to $v$, or $+\infty$ if such a path does not exist. We present our results for the case of undirected manipulation graphs and show how they can be extended to the case of directed graphs (Section A.3).

To model the cost of each edge, we consider weighted graphs in which each edge $e\in\mathcal{E}$ is associated with a nonnegative weight $w(e)\in[0,1]$. As a special case of the weighted graphs, we also consider unweighted graphs, in which each edge takes unit cost, i.e., $w(e)=1$. We remark that in unweighted graphs, agents will move for at most one hop because manipulating the features can increase the value of classification outcomes by at most $1$. To be specific, let $N[u]$ denote the closed neighborhood of state $u\in\mathcal{X}$, then agent $u$ respond to classifier $h$ as follows: if $h(u)$ is negative and there exists a neighbor $v\in N[u]$ with positive $h(v)$, then $u$ will move to $v$; otherwise, $u$ does not move. As a result, the loss function in unweighted graphs can be equivalently expressed as

[TABLE]

When fractional classifiers are used, we also consider the free-edge manipulation model. In this model, we restrict the agent to only moving one hop, where the cost of moving is zero. Specifically, each pair of nodes $(u,v)\in\mathcal{X}^{2}$ has zero manipulation cost if $(u,v)\in\mathcal{E}$, otherwise the cost is infinity. When agents best respond to classifier $h$ under this cost function, they will move to a one-hop neighbor of their initial state that has the highest probability of getting classified as positive.

3 Overview of Results

Our work considers three types of randomness: deterministic, fractional classifiers, and randomized algorithms. In the deterministic model, the learner is constrained to using deterministic algorithms to output a sequence of deterministic classifiers. In the fractional classifiers model, the learner is allowed to output a probability distribution over classifiers at every round, inducing fractions on every node that represent their probability of being classified as positive. The agents best respond to these fractions before the random labels are realized. In the last randomized algorithms model, the learner outputs a probability distribution over classifiers as in the fractional model, and the adversary may pick $u_{t}$ based on these probabilities, but now the agents respond to the true realized classifier in selecting $v_{t}$. We summarize our main results in Table 1.

Deterministic Classifiers: In the case of deterministic classifiers, we model strategic manipulations by unweighted graphs that have unit cost on all edges. We first consider the realizable setting where the perfect classifier lies in a finite hypothesis class $\mathcal{H}$, and show fundamental differences between the non-strategic and strategic settings. In the non-strategic setting, the deterministic algorithm $\mathsf{Halving}$ achieves $O(\ln|\mathcal{H}|)$ mistake bound. However, in the strategic setting, we show in Example 4.2 that the same algorithm can suffer from an infinite number of mistakes.

In Section 4, we analyze the strategic setting and provide upper and lower bounds of the mistake bound, both characterized by the maximum degree of vertices in the manipulation graph, which we denote with $\Delta$. On the lower bound side, we show in Theorem 4.6 that no deterministic algorithm is able to achieve $o(\Delta)$ mistake bound, and this barrier exists even when $|\mathcal{H}|=O(\Delta)$. On the upper bound side, we propose LABEL:alg:halving that achieves mistake bound $O(\Delta\ln|\mathcal{H}|)$ by incorporating the graph structure into the vanilla $\mathsf{Halving}$ algorithm.

We then move to the agnostic strategic setting and propose LABEL:alg:biased-weighted-maj-vote which achieves a mistake bound of $O(\Delta\cdot\mathsf{OPT}+\Delta\ln|\mathcal{H}|)$, where $\mathsf{OPT}$ denotes the minimum number of mistakes made by the best classifier in $\mathcal{H}$. This bound is $\Delta$-multiplicative of the bound achieved by the weighted majority vote algorithm in the non-strategic setting. We complement this result with a lower bound showing that no deterministic algorithm can achieve $o(\Delta\cdot\mathsf{OPT})$ mistake bound. In order to overcome the $\Delta$-multiplicative barrier, we study the use of randomization in the next two models.

Fractional Classifiers: In this setting, we consider two models of cost function: the free-edges cost model, where traveling one edge is cost-free but the second edge costs infinity, and the weighted graph model, where agents can travel multiple edges and pay for the sum of costs of edges. In the free-edges model, we show that no learner can overcome the mistake lower bound $\frac{\Delta}{2}\cdot\mathsf{OPT}$, and provide an upper bound of $O(\Delta\cdot\mathsf{OPT}+\Delta\ln|\mathcal{H}|)$ based on LABEL:alg:biased-weighted-maj-vote. In the weighted graph model, we show a mistake lower bound of $\frac{{\Delta}}{4}\cdot\mathsf{OPT}$, and an upper bound of $O(\tilde{\Delta}\cdot\mathsf{OPT}+\tilde{\Delta}\ln|\mathcal{H}|)$, which is obtained by running LABEL:alg:biased-weighted-maj-vote on the expanded manipulation graph $\tilde{G}$ that is constructed by connecting all pairs of nodes $(u,v)\in\mathcal{X}^{2}$ where $\mathsf{Cost}(u,v)\leq 1$, and $\tilde{\Delta}$ denotes the maximum degree of $\tilde{G}$. In particular, our construction for the lower bound satisfies $\tilde{\Delta}=\Delta$, so this result also implies that no learner is able to surpass the $\frac{\tilde{\Delta}}{4}$-multiplicative regret.

Our results in this setting indicate that using fractional classifiers cannot help the learner to achieve $o(\Delta\cdot\mathsf{OPT})$ regret. To resolve this issue, we move on to the randomized algorithms model where the learner realizes the random choices in transparency to the agents.

Randomized Algorithms: In this setting, the learner uses randomized algorithms that produce probability distribution over deterministic classifiers at each round. The key difference from the fractional classifiers setting is, although the adversary still chooses agent $(u_{t},y_{t})$ based on the distribution, the agent will best respond to the classifier to be used after it is sampled from the distribution. Surprisingly, we show that revealing the random choices to the agents can make the interaction more fruitful for both the agents and the learner, as the learner is now able to achieve vanishing regret without the multiplicative dependency on $\Delta$ or $\tilde{\Delta}$. This demonstrates an interesting difference between strategic and non-strategic settings from the learner’s perspective: whereas delaying the realization of random bits is helpful in non-strategic settings, it is more helpful to realize the random choices before agents respond in the strategic setting. We refer the readers to Section 6.4 for more discussions about this difference.

As for algorithms and upper bounds in this setting, we first show that the vanilla EXP3 algorithm on expert set $\mathcal{H}$ gives us a regret upper bound of $O\left(\sqrt{T|\mathcal{H}|\ln|\mathcal{H}|}\right)$. To improve the dependency on $|\mathcal{H}|$, we design two algorithms that simultaneously observe the loss of all experts by using an all-positive classifier at random time steps to stop the manipulations. In particular, LABEL:alg:reduction-MAB-FIB achieves regret upper bound of $O\left(T^{\frac{2}{3}}\ln^{\frac{1}{3}}|\mathcal{H}|\right)$ against oblivious adversaries; and LABEL:alg:reduction-adaptive achieves regret bound of $\widetilde{O}\left(T^{\frac{3}{4}}\ln^{\frac{1}{4}}|\mathcal{H}|\right)$ against general adaptive adversaries. We also extend this algorithmic idea to the linear classification setting where original examples are inseparable and obtain an upper bound in terms of the hinge loss of the original data points, resolving an open problem proposed in Ahmadi et al. (2021). Although, our mistake bound has an extra $O(\sqrt{T})$ additive term compared to their bound for the case that original data points are separable.

Two Populations: We propose an extension to our model in which agents are divided into two populations with heterogeneous manipulation power: group $A$ agents face a cost of 0.5 on each edge, whereas group $B$ agents face a cost of 1. We assume that group membership is a protected feature, and is observable only after the classifier is published. In Section A.6, we present an algorithm with a $\min\left\{\Delta+1+\frac{1}{\beta},\ \Delta^{2}+2\right\}$-multiplicative regret, where $\beta$ is the probability that agents are assigned to group $B$.

4 Deterministic Classifiers

4.1 Realizable Case

In the realizable case, we assume that there exists a perfect expert $h^{\star}\in\mathcal{H}$ with zero mistakes, i.e., $\mathsf{OPT}=0$. This implies that for all time steps $t\in[T]$, we have $\ell(h^{\star},\mathsf{BR}_{h^{\star}}(u_{t}),y_{t})=0$. In this case, our goal of bounding the Stackelberg regret coincides with the mistake bound:

[TABLE]

For notational convenience, let $S^{\star}$ denote the set of nodes in $\mathcal{X}$ with positive labels under $h^{\star}$, namely $S^{\star}\triangleq\left\{u\in\mathcal{X}:\ h^{\star}(u)=+1\right\}$. Then realizability implies that $S^{\star}$ must satisfy two properties: (1) all the true positives can reach $S^{\star}$ within no more than one hop; (2) No true negatives can reach $S^{\star}$ in one hop. We formalize these two properties in Proposition 4.1.

Proposition 4.1**.**

In the realizable case, there exists a subset of nodes $S^{\star}\subseteq\mathcal{X}$ such that $S^{\star}$ is a dominating set for all the true positives $u_{t}$, i.e. $\mathsf{dist}(u_{t},S^{\star})\leq 1$. Additionally, none of the true negatives $u_{t}$ are dominated by $S^{\star}$, i.e. $\mathsf{dist}(u_{t},S^{\star})>1$, where $\mathsf{dist}(u,S^{\star})$ represents the minimum distance from node $u$ to the set $S^{\star}$.

4.1.1 The failure of vanilla Halving

In the problem of nonstrategic online classification with expert advice, the well-known $\mathsf{Halving}$ algorithm achieves a mistake bound of $\mathsf{Mistake}(T)=\mathcal{O}(\ln{|\mathcal{H}|})$. In each iteration, $\mathsf{Halving}$ uses the majority vote of remaining experts to make predictions on the next instance, which ends up reducing the number of remaining experts by at least half on each mistake. Since there are $|\mathcal{H}|$ experts at the beginning and at least one expert at the end, the total number of mistakes is bounded by $\mathcal{O}(\ln{|\mathcal{H}|})$. However, in the following example, we show that when agents are strategic, the vanilla $\mathsf{Halving}$ algorithm may suffer from an infinite number of mistakes, as do two extensions of vanilla $\mathsf{Halving}$ that consider the best response function before taking majority votes. Moreover, our construction indicates that these algorithms fail even when the sequence of agents is chosen by an oblivious adversary.

Example 4.2**.**

Consider the following manipulation graph $G(\mathcal{X},\mathcal{E})$ and hypothesis class $\mathcal{H}$: $G(\mathcal{X},\mathcal{E})$ is a star that includes a central node $x_{0}$, and $\Delta$ leaves $x_{1},\cdots,x_{\Delta}$. Hypothesis class $\mathcal{H}=\{h^{1},\cdots,h^{\Delta}\}$, where each $h^{i}\in\mathcal{H}$ assigns positive to $x_{i}$, and negative to all other nodes in $\mathcal{X}$ (see Figure 1). The perfect expert is $h^{\star}=h^{j}\in\mathcal{H}$ for some $j\in[\Delta]$ unknown to the learner.

Now consider two algorithms: the vanilla $\mathsf{Halving}$ algorithm and the variant that performs an expansion of positive region on top of $\mathsf{Halving}$.

Vanilla $\mathsf{Halving}$.

Consider the following sequence of agents: at every time $t$, the same agent with initial position $u_{t}=x_{0}$ and label $y_{t}=+1$ arrives. We claim that the $\mathsf{Halving}$ algorithm makes mistakes on each agent regardless of the total number of rounds executed. First, note that this sequence is realizable with respect to class $\mathcal{H}$: for all $h^{i}\in\mathcal{H}$, we have $\mathsf{BR}_{h^{i}}(x_{0})=x^{i}$ and $h^{i}(x_{i})=+1$, so each $h^{i}$ classifies $(x_{0},+1)$ correctly in isolation. Therefore, any expert in $\mathcal{H}$ achieves zero mistakes on this sequence of agents.

Now consider the vanilla $\mathsf{Halving}$ algorithm. Initially, for each node $x\in\mathcal{X}$, there is at most one expert in $\mathcal{H}$ that labels it as positive. Therefore, the majority vote classifier of $\mathcal{H}$ labels every node as negative. In response to this all-negative majority vote classifier, the first agent $(x_{0},+1)$ stays put and gets classified as negative mistakenly. However, we know that each classifier $h^{i}$ predicts correctly on $(x_{0},+1)$. As a result, none of the experts get discarded. Therefore, a mistake is made by the learner, but no progress is made in terms of shrinking the set $\mathcal{H}$. The same agent appears at every round, resulting in the $\mathsf{Halving}$ algorithm making mistakes in each round. 2. 2.

A strategic variant of $\mathsf{Halving}$.

Now consider a different voting rule for taking the majority-vote classifier based on the best-response function: Let $\overline{h}(u)=h(\mathsf{BR}_{h}(u))$ for all $h\in\mathcal{H}$ and $u\in\mathcal{X}$, and suppose that the learner runs $\mathsf{Halving}$ on the hypotheses class $\overline{\mathcal{H}}=\{\overline{h^{1}},\cdots,\overline{h^{\Delta}}\}$. Specifically, for each $h^{i}\in\mathcal{H}$, $\overline{h^{i}}(x_{0})=h^{i}(\mathsf{BR}_{h^{i}}(x_{0}))=h^{i}(x_{i})=+1$, therefore the majority-vote classifier predicts positive on $x_{0}$. On the other hand, the majority vote classifier predicts negative on all the leaves. Now, suppose the adversary secretly chooses $j\in[\Delta]$ and constructs a sequence in which $h^{j}$ is realizable as follows: at each time step $t$, selects an example with true label $y_{t}=-1$ and initial position $u_{t}=x_{i}\in\mathcal{X}\setminus\{x_{0},x_{j}\}$. Note that all classifiers in ${\mathcal{H}}$ except ${h^{i}}$ will classify $(u_{t},y_{t})$ correctly. However, the majority vote classifier will make a mistake because $u_{t}$ can manipulate to $x_{0}$ and get classified as positive. Once the mistake is made, had the true location $u_{t}=x_{i}$ been observable, the learner could have shrunk the size of $\mathcal{H}$ by discarding $h^{i}$. However, $u_{t}$ is hidden from the learner, so the learner would not know which classifier is making a mistake. Therefore, it cannot make progress by excluding at least one expert from $\mathcal{H}$ in each round. 3. 3.

Another strategic variant of $\mathsf{Halving}$.

The positive region of $h^{\text{maj}}$ in the previous variation can be reached by all the nodes in the graph, which makes gaming too easy for the agents. Now, suppose the learner’s goal is to shrink the positive region of $h^{\text{maj}}$ and get a new classifier $h$, such that the positive region of $h$ can only be reached by the true positives under $h^{\text{maj}}$, but none of the true negatives.

We use the same example as above to show the failure of this algorithm because such $h$ does not exist. Recall that the positive region of $h^{\text{maj}}$ contains only the central node $x_{0}$. Suppose such an $h$ exists, then $x_{0}$ cannot belong to the positive region of $h$, because it can be reached by all leaf nodes $x_{i}$, which are true negatives under $h^{\text{maj}}$. In addition, no leaf nodes should be included in the positive region of $h$ either. This implies that the positive region of $h$ is empty, which contradicts with the assumption that true positive node $x_{0}$ can reach it. For this reason, the learner is unable to find an $h$ satisfying this property.

Example 4.2 indicates that taking majority votes fails in the strategic setting. One crucial point is that the leaves do not meet the threshold for majority, and therefore they are always negative under the majority vote classifier (whether we consider the best response function or not) and thus indistinguishable, weakening the learner’s leverage to identify the optimal expert. In fact, in this example, the only evidence for removing an expert is a false positive agent at the corresponding leaf node, so the learner should classify the leaves as positive in order to make progress. Therefore, one needs to lower the threshold for majority votes to increase the likelihood of false positives and make more room for improvement.

In the next section, we propose an algorithm based on the idea of biased majority vote in favor of positive predictions, which provably achieves finite mistake bounds against any adversarial sequence of strategic agents. We show that compared to the nonstrategic setting, the extra number of mistakes made by the learner is closely characterized by the maximum degree of the manipulation graph.

4.1.2 Upper Bound: Biased Majority-Vote Algorithm

In this section, we propose a biased version of the majority vote algorithm for the realizable strategic setting. The algorithm proceeds in rounds as follows: At each round $t$, a new agent arrives and gets observed as $v_{t}$. From the remaining set of experts, if at least $1/(\Delta+2)$ fraction of them classify $v_{t}$ as positive, then the algorithm predicts positive. If the algorithm made a mistake, all the experts that predicted positive get removed from $\mathcal{H}$. If less than $1/(\Delta+2)$ fraction of the experts classify $v_{t}$ as positive, the algorithm predicts negative. If the prediction was wrong, then each expert that labeled all the vertices in the neighborhood of $v_{t}$, i.e. $N[v_{t}]$, as negative gets removed from $\mathcal{H}$. We present this algorithm in LABEL:alg:halving and analyze its mistake bound in Theorem 4.3.

Theorem 4.3**.**

If there exists at least one perfect expert under manipulation, LABEL:alg:halving makes at most $(\Delta+2)\ln{|\mathcal{H}|}$ mistakes.

Proof.

We show whenever a mistake is made, at least $1/(\Delta+2)$ fraction of the remaining experts get excluded from $\mathcal{H}$, but the realizable classifier $h^{\star}$ is never excluded.

First, consider the case of making mistake on a true negative, i.e. $y_{t}=-1$. In this case, at least $|\mathcal{H}|/(\Delta+2)$ of the experts are predicting positive on $v_{t}$, and all of them are excluded from $\mathcal{H}$. On the other hand, according to Proposition 4.1, all neighbors of $u_{t}$ are labeled as negative by $h^{\star}$. Since $v_{t}\in N[u_{t}]$, this implies that $h^{\star}$ must have labeled $v_{t}$ as negative, so $h^{\star}$ will not be excluded.

Next, consider the case of making a mistake on a true positive, i.e. $y_{t}=+1$. Since the algorithm is predicting negative on $v_{t}$, the agent has not moved from a different location to $v_{t}$ to get classified as negative. Hence, it must be the case that $v_{t}=u_{t}$. Since the agent did not move, none of the vertices in its neighborhood has been labeled positive by the algorithm, which means each of the vertices in $N[v_{t}]$ is labeled positive by less than $|\mathcal{H}|/(\Delta+2)$ of the experts. Since there are at most $(\Delta+1)$ vertices in $N[v_{t}]$, at least $|\mathcal{H}|(1-(\Delta+1)/(\Delta+2))=|\mathcal{H}|/(\Delta+2)$ experts are predicting negative on all vertices in $N[v_{t}]$, all of which will be excluded. On the other hand, by Proposition 4.1 again, $u_{t}=v_{t}$ is dominated by the positive region of $h^{\star}$, so at least one vertex in $N[u_{t}]$ is labeled positive by $h^{\star}$, which implies that $h^{\star}$ will not be excluded from $\mathcal{H}$.

In either case, when a mistake is made, at least $1/(\Delta+2)$ fraction of the remaining experts get excluded, but the perfect expert never gets excluded. Therefore, the total number of mistakes $M=\mathsf{Mistake}(T)$ can be bounded as follows:

[TABLE]

∎

Improving the Upper Bound

In Section A.2, we propose a pre-processing step (LABEL:alg:improvement-halving) that improves the mistake bound of LABEL:alg:halving when the underlying manipulation graph is dense, i.e., the minimum degree of all the vertices is large. We achieve the following upper bound:

Theorem 4.4** (Improving the number of mistakes).**

LABEL:alg:improvement-halving* makes at most $\min\{n-\delta,1+\Delta\cdot\min\{\ln|\mathcal{H}|,n-\delta-1\}\}$ mistakes, where $n=|\mathcal{X}|$ and $\delta$ is the minimum degree of $G(\mathcal{X},\mathcal{E})$.*

We leave it open to get a general instance-dependent upper bound that potentially depends on other characteristics of the manipulation graph besides the maximum/minimum degree.

4.2 Unrealizable Case

In the unrealizable (agnostic) case, we remove the assumption that there exists a perfect classifier under manipulation. Our goal is to design an adaptive algorithm that does not make too many mistakes compared to $\mathsf{OPT}$ (which is the minimum number of mistakes achieved by any classifier in $\mathcal{H}$), without a priori knowledge of the value of $\mathsf{OPT}$ or the optimal classifier that achieves this value. Before presenting our algorithm, we first observe that for any classifier $h$ with positive region $S_{h}$, $h$ makes a mistake on a true positive agent $u$ if and only if $u$ cannot reach $S_{h}$, and $h$ makes a mistake on a true negative agent $u$ if and only if $u$ can reach $S_{h}$.

4.2.1 Upper Bound: Biased Weighted Majority-Vote Algorithm

Next, we propose an algorithm for the unrealizable setting. The algorithm is adapted from the weighted majority vote algorithm, which maintains a weight for each hypothesis in $\mathcal{H}$ that are initially set to be 1. Similar to LABEL:alg:halving, at each round $t$, a new example arrives and gets observed as $v_{t}$. Let $W_{+}^{t}$ and $W_{-}^{t}$ denote the sum of weights of experts that predict $v_{t}$ as positive and negative respectively. Let $W_{t}=W_{+}^{t}+W_{-}^{t}$. If $W_{+}^{t}\geq W_{t}/(\Delta+2)$, the algorithm predicts positive, otherwise it predicts negative. If the algorithm makes a mistake on a true negative, then we decrease the weights of all experts that predicted $v_{t}$ as positive by a factor of $\gamma$. If the algorithm makes a mistake on a true positive, then we decrease the weights of all experts that labeled all the vertices in $N[v_{t}]$ as negative by a factor of $\gamma$. We formally present this algorithm in LABEL:alg:biased-weighted-maj-vote and its mistake bound guarantee in Theorem 4.5.

Theorem 4.5**.**

LABEL:alg:biased-weighted-maj-vote* makes at most $e(\Delta+2)(\ln|\mathcal{H}|+\mathsf{OPT})$ mistakes against any adversary.*

4.3 Lower Bound

In this section, we show lower bounds on the number of mistakes made by any deterministic learner against an adaptive adversary in both realizable and agnostic settings. We present the lower bounds in Theorem 4.6.

Theorem 4.6**.**

There exists a manipulation graph $G(\mathcal{X},\mathcal{E})$, a hypothesis class $\mathcal{H}:\mathcal{X}\to\mathcal{Y}$, and an adaptive adversary, such that any deterministic learning algorithm has to make at least $\Delta-1$ mistakes in the realizable setting and $\Delta\cdot\mathsf{OPT}$ mistakes in the agnostic setting, where $\mathsf{OPT}$ captures the minimum number of mistakes made by any classifier in the hypothesis class $\mathcal{H}$.

Proof.

Here, we use the same manipulation graph $G$ and expert class $\mathcal{H}$ as shown in Example 4.2. The manipulation graph $G(\mathcal{X},\mathcal{E})$ is a star that includes a central node $x_{0}$, and $\Delta$ leaves $x_{1},\cdots,x_{\Delta}$. Hypothesis set $\mathcal{H}=\{h^{1},\cdots,h^{\Delta}\}$, where each $h^{i}\in\mathcal{H}$, assigns $+1$ to $x_{i}$, and $-1$ to all other nodes in $G$ (Figure 1).

In the agnostic setting, we construct an adaptive adversary that always can pick a bad example $(u_{t},y_{t})$ on observing $h_{t}$, such that $h_{t}$ fails to classify this example correctly (i.e., $\ell(h_{t},\mathsf{BR}_{h_{t}}(u_{t}),y_{t})=1$), but this example can be successfully classified by all but one expert. The detailed construction is as follows:

If $h_{t}(x_{0})=+1$, then the adversary picks $(u_{t}=x_{j},y_{t}=-1)$ for an arbitrary $j\in[\Delta]$. Since $u_{t}$ can move to $x_{0}$ and get classified as positive by $h_{t}$, we have $\ell(h_{t},\mathsf{BR}_{h_{t}}(u_{t}),y_{t})=1$. On the other hand, all experts except for $h^{j}$ classify this example correctly. 2. 2.

If $h_{t}(x)=-1$ for all nodes $x\in\mathcal{X}$, then the adversary picks $(u_{t}=x_{0},y_{t}=+1)$. In this case, $\ell(h_{t},\mathsf{BR}_{h_{t}}(u_{t}),y_{t})=1$. However, $\forall h^{i}\in\mathcal{H}$, we have $\mathsf{BR}_{h^{i}}(u_{t})=x_{0}$, so this example can receive a positive classification and therefore $\ell(h^{i},\mathsf{BR}_{h^{i}}(u_{t}),y_{t})=0$. 3. 3.

If $h_{t}(x_{0})=-1$ and there exists $j\in[\Delta]$ such that $h_{t}(x_{j})=+1$, then the adversary picks $(u_{t}=x_{j},y_{t}=-1)$. In this case, $h_{t}$ will classify this example as a false positive. On the other hand, all experts except for $h^{j}$ will correctly classify it as negative.

Following the above construction, the learner is forced to make a mistake at all rounds; however, in each round, at most one of the experts makes a mistake, implying that sum of the number of mistakes made by all experts is at most $T$. Since the number of experts is $\Delta$, by the pigeon-hole principle there exists an expert that makes at most $T/\Delta$ mistakes. Therefore, $\mathsf{OPT}\leq T/\Delta$, implying a mistake lower bound of $\Delta\cdot\mathsf{OPT}$.

In the realizable setting, we use the same construction but only focus on the first $\Delta-1$ time steps, such that the learner is forced to make $\Delta-1$ mistakes, but there exists at least one expert that has not made a mistake so far, suppose $h^{i}$ is one of such experts. After the first $\Delta-1$ steps, the adversary keeps showing the same agent $(x_{i},+1)$ to the learner, such that expert $h^{i}$ is still realizable. ∎

We remark that Theorem 4.6 implies no deterministic algorithm is able to make $o(\Delta)$ mistakes in the realizable setting and $o(\Delta)$ multiplicative regret in the agnostic setting. Moreover, the construction shows that any deterministic algorithm is forced to err at every round in the worst-case agnostic setting, resulting in an $\Omega(T)$ regret as long as $\Delta\geq 2$.

5 Fractional Classifiers

5.1 Model

In this section, we consider the randomized model where the learner uses a deterministic algorithm to output a probability distribution over classifiers at each round. After the learner commits to a distribution, an agent $(u_{t},y_{t})$ (which is chosen by an adversary) best responds to this distribution by selecting $v_{t}$ that maximizes the expected utility. In particular, let $P_{h_{t}}(v)\in[0,1]$ denote the induced probability of $h_{t}$ classifying node $v$ as positive, then the agent’s best response function can be written as:

[TABLE]

As a result of manipulation, the observable feature $v_{t}\in\mathsf{BR}_{h_{t}}(u_{t})$ is revealed to the learner, and the learner suffers an expected loss of

[TABLE]

From Equations 5 and 6, we can see that the set of induced probabilities $P_{h_{t}}(u)$ for each $u\in\mathcal{X}$ serves as a sufficient statistics for both the learner and the agent. Therefore, instead of committing to a distribution and having the agents calculate the set of induced probabilities, the learner can directly commit to a fractional classifier $h_{t}$ that explicitly specifies the probabilities $P_{h_{t}}(u)\in[0,1]$ for each $u\in\mathcal{X}$. Then, after the agent best responds to these fractions and reaches $v_{t}$, random label $h_{t}(v_{t})$ is realized according to the proposed probability $P_{h_{t}}(v_{t})$.

We remark that deterministic classifiers are special cases of the fractional classifiers where $P_{h}(u)\in\{0,1\}$. Since the experts in $\mathcal{H}$ are all deterministic, the benchmark $\mathsf{OPT}$, which is the minimum number of mistakes achieved by the best expert in hindsight, is still a deterministic value.

In this setting, we consider two cost functions: the weighted-graph cost function, where the manipulation cost from $u$ to $v$ is defined as the total weight on the shortest path from $u$ to $v$; and the free-edges model, where the first hop is free and the second hop costs infinity. Recall that agents break ties by preferring features with higher expected values, so the agents in the free-edges cost model will move to a neighbor $v_{t}\in N[u_{t}]$ with the highest probability of getting classified as positive.

In the Section 5.2, we show that the type of randomness is of limited help because they can only reduce the $\Delta$-multiplicative regret by constants. This is evidenced by our lower bounds in Theorems 5.1 and 5.2, which states that any algorithm using this type of randomness needs to suffer $\frac{\Delta}{2}$-multiplicative regret in the free-edges model and $\frac{{\Delta}}{4}$-multiplicative regret in the weighted-graph model. We also complement this result by providing nearly-matching upper bounds in Section 5.3.

5.2 Lower Bound

Theorem 5.1**.**

In the model of “free edges” cost functions, for any sequence of fractional classifiers chosen by a deterministic algorithm, there exists an adaptive adversary such that the learner must make at least $\frac{\Delta}{2}\cdot\mathsf{OPT}$ mistakes in expectation.

Proof.

Consider a manipulation graph $G(\mathcal{X},\mathcal{E})$ that is a star with a central node $x_{0}$, and $\Delta$ leaves $x_{1},\cdots,x_{\Delta}$. Hypothesis set $\mathcal{H}=\{h^{1},\cdots,h^{\Delta}\}$, where each $h^{i}\in\mathcal{H}$ assigns positive to $x_{i}$ and negative to all other nodes in $G$, as shown in Figure 1. We construct an adversary that picks $(u_{t},y_{t})$ upon receiving the fractional classifier $h_{t}$ at each round, such that $h_{t}$ makes a mistake with probability at least 0.5 whereas all but one expert predicts correctly. Our detailed construction is as follows:

If $P_{h_{t}}(x_{0})\geq 0.5$, then the adversary picks $(u_{t}=x_{j},y_{t}=-1)$ for an arbitrary $j\in[\Delta]$. Since $x_{0}\in N[u_{t}]$ and $v_{t}$ is the node in $N[u_{t}]$ that achieves the largest success probability, we have $\E[\ell(h_{t},\mathsf{BR}_{h_{t}}(u_{t}),y_{t})]=P_{h_{t}}(v_{t})\geq P_{h_{t}}(x_{0})\geq 0.5$. On the other hand, only $h^{j}\in\mathcal{H}$ makes a mistake on $(x_{j},-1)$, and all other experts classify it correctly. 2. 2.

If $P_{h_{t}}(x_{0})<0.5$ but there exists $j\in[\Delta]$ such that $P_{h_{t}}(x_{j})\geq 0.5$, then the adversary picks $(u_{t}=x_{j},y_{t}=-1)$. Since the closed neighborhood of $x_{j}$ only contains $\{x_{j},x_{0}\}$, we have $v_{t}=u_{t}$ and $\E[\ell(h_{t},v_{t},y_{t})]\geq 0.5$. In addition, all experts but $h^{j}$ classify this example correctly. 3. 3.

If neither of the above two conditions holds, i.e., $P_{h_{t}}(v)<0.5$ for all nodes $v\in\mathcal{X}$, then the adversary picks $(u_{t}=x_{0},y_{t}=+1)$. In this case, no matter how the agent chooses $v_{t}$, the probability $P_{h_{t}}(v_{t})$ cannot exceed 0.5. As a result, the learner suffers an expected loss of $\E[\ell(h_{t},\mathsf{BR}_{h_{t}}(u_{t}),y_{t})]=1-P_{h_{t}}(v_{t})\geq 0.5$. On the other hand, all experts classify this example correctly because $x_{0}$ can move to the corresponding leaf node and get classified as positive.

As a result, the learner has an expected loss of at least $0.5$ on each round, which implies

[TABLE]

However, in each round, at most one expert makes a mistake. Following the same arguments as Theorem 4.6, we conclude that $\mathsf{OPT}\leq\frac{T}{\Delta}$. Putting all together, the expected number of mistakes made by the learner is at least

[TABLE]

∎

Theorem 5.2**.**

In weighted graphs, for any sequence of fractional classifiers chosen by a deterministic algorithm, there exists an adaptive adversary such that the learner must make at least $\frac{{\Delta}}{4}\cdot\mathsf{OPT}$ mistakes in expectation.

Proof.

Again, we consider the same graph structure as in Theorem 5.1, where $G(\mathcal{X},\mathcal{E})$ is a star with central node $x_{0}$ and leaf nodes $x_{1},\cdots,x_{\Delta}$. Assume each edge $e\in\mathcal{E}$ has the same weight $w(e)=w$, where $w\triangleq 0.5+\epsilon$ for an infinitesimal constant $\epsilon$. Note that in this graph, no agent has the incentive to travel more than one edge, because it would cost them more than $1$.

We work with the hypothesis set $\mathcal{H}=\{h^{1},\cdots,h^{\Delta}\}$, assuming each $h^{i}\in\mathcal{H}$ assigns positive to $x_{i}$ and negative to all other nodes in $\mathcal{X}$. We construct an adversary that picks $(u_{t},y_{t})$ upon receiving the fractional classifier $h_{t}$ as follows, such that $h_{t}$ makes a mistake with probability at least $\frac{1}{4}$, whereas all but one expert predicts correctly. Our detailed construction is as follows:

Let $p=\max_{x\in\mathcal{X}}P_{h_{t}}(x)$ denote the maximum fraction on any node. If $p<w$, then the adversary can simply pick $(u_{t}=x_{0},y_{t}=+1)$, such that the learner suffers from an expected loss of

[TABLE]

As for the experts, all of them classify this agent correctly. Therefore, it suffices to consider the case of $p\geq w$ for the rest of the proof. We consider two cases depending on where $p$ is achieved:

If $p$ is achieved at a leaf node $x_{i}$ (i.e., $P_{h_{t}}(x_{i})=p$) for some $j\in[\Delta]$, then the adversary chooses $(u_{t}=x_{i},y_{t}=-1)$. We claim that $u_{t}=v_{t}=x_{i}$, since the agent is already placed at the node with the highest fraction, so they do not need to pay a nonnegative cost to reach a node with an even smaller fraction. As a result, we have $\E[\ell(h_{t},\mathsf{BR}_{h_{t}}(u_{t}),y_{t})]=P_{h_{t}}(x_{i})=p\geq w>\frac{1}{4}$. On the other hand, all but expert $h^{i}$ classify this agent correctly. 2. 2.

If $p$ is achieved at the central node $x_{0}$, i.e., $P_{h_{t}}(x_{0})=p$, then every leaf node have fractions no more than $p$. We first assume at least one leaf node $x_{i}$ ($i\in[\Delta]$) satisfies $P_{h_{t}}(x_{i})<p-w$. In this case, the adversary chooses $(u_{t}=x_{i},y_{t}=-1)$. Since $P_{h_{t}}(x_{0})-\mathsf{Cost}(u_{t},x_{0})=p-w>P_{h_{t}}(u_{t})-\mathsf{Cost}(u_{t},u_{t})$, the agent will select $v_{t}=x_{0}$ as the best response, and achieve a success probability of $P_{h_{t}}(x_{0})=p$. Therefore, the learner has expected loss $\E[\ell(h_{t},\mathsf{BR}_{h_{t}}(u_{t}),y_{t})]=p\geq w>\frac{1}{4}$. On the other hand, all but expert $x^{i}$ labels this agent correctly. 3. 3.

Now we consider the last case where $p$ is achieved at the central node $x_{0}$ and all the leaf nodes have fractions at least $p-w$. In this case, no agent has the incentive to move regardless of their initial positions. The adversary can select the next agent as follows: if $1-p\geq p-w$, then choose $(u_{t}=x_{0},y_{t}=+1)$ and make the learner err with probability $1-P_{h_{t}}(x_{0})=1-p$; otherwise, choose $(u_{t}=x_{i},y_{t}=-1)$ for an arbitrary $i\in[\Delta]$ and make the learner err with probability $P_{h_{t}}(x_{i})\geq p-w$. In either case, the learner has to suffer from an expected loss of $\E[\ell(h_{t},\mathsf{BR}_{h_{t}}(u_{t}),y_{t})]\geq\max\{1-p,p-w\}\geq\frac{1-w}{2}=\frac{1}{4}-\frac{\epsilon}{2}$. As for the experts, at most one of them is making a mistake.

Putting together all the possible cases and let $\epsilon\to 0$, the learner is forced to make mistakes with probability at least $\frac{1}{4}$ on each round, i.e., $\sum_{t=1}^{T}\E[\ell_{t}(h_{t},\mathsf{BR}_{h_{t}}(u_{t}),y_{t})]\geq T/4$. However, in each round, at most one of the experts makes a mistake, implying that $\mathsf{OPT}\leq\frac{T}{\Delta}$ as proved in Theorem 4.6. As a result, the total loss made by the learner is bounded as

[TABLE]

The proof is thus complete. ∎

Remark 5.3**.**

In a related work, Braverman and Garg (2020) showed that introducing randomization in their classification rule can increase the learner’s classification accuracy, and the optimal randomized classifier has the structure that agents are better off not manipulating. In case (3) of the proof of Theorem 5.2, we show that even when learners choose such an “optimal” classifier under which agents have no incentive to manipulate, the adversary is still able to impose a high misclassification error. This example shows the limitations of fractional classifiers.

5.3 Upper Bound

In this section, we show how to use the idea of LABEL:alg:biased-weighted-maj-vote to obtain upper bounds in the randomized classifiers model.

Proposition 5.4**.**

In the free-edges model, LABEL:alg:biased-weighted-maj-vote achieves a mistake bound of

[TABLE]

Proof.

To prove this proposition, it suffices to show that if the learner uses deterministic classifiers as a special case of fractional classifiers, then the free-edges cost model and unweighted graph cost model result in the same best response functions. In fact, in both models, agents manipulate their features if and only if their original nodes are labeled as negative and there exists a neighbor that is labeled as positive. Therefore, the two cost models yield the same best response behaviors to deterministic classifiers. As a result, LABEL:alg:biased-weighted-maj-vote suffers from the mistake bound of $e(\Delta+2)(\ln|\mathcal{H}|+\mathsf{OPT})$. ∎

Now we consider weighted manipulation graphs. In this setting, we can run LABEL:alg:biased-weighted-maj-vote on the expanded manipulation graph $\tilde{G}$ that is an unweighted graph constructed from $G$ by connecting all pairs $u,v$ of vertices in $G$ such that $\mathsf{Cost}(u,v)\leq 1$. As a result, we obtain mistake bound in terms of $\tilde{\Delta}$ instead of $\Delta$, where $\tilde{\Delta}$ is the maximum degree of $\tilde{G}$.

Proposition 5.5**.**

Given a weighted manipulation graph $G$, running LABEL:alg:biased-weighted-maj-vote on the expanded graph $\tilde{G}$ achieves a mistake bound of $\mathsf{Mistake}(T)\leq e(\tilde{\Delta}+2)(\ln|\mathcal{H}|+\mathsf{OPT})$, where $\tilde{\Delta}$ is the maximum degree of $\tilde{G}$.

Proof.

After constructing $\tilde{G}$, we can see that under any deterministic classifier, a manipulation from $u$ to $v$ happens in the weighted graph $G$ if and only if the same manipulation happens in the unweighted graph $\tilde{G}$. Therefore, by running LABEL:alg:biased-weighted-maj-vote on $\tilde{G}$, we obtain a mistake bound in the original manipulation graph $G$ of $e(\tilde{\Delta}+2)(\ln|\mathcal{H}|+\mathsf{OPT})$, where $\tilde{\Delta}$ is the maximum degree of $\tilde{G}$. ∎

6 Randomized Algorithms

In this section, we propose another model of randomization. Unlike the fractional classifiers model discussed in Section 5, we show that this randomized model induces a different type of manipulation behavior, for which success probabilities (fractions) are no longer sufficient to characterize. In this model, the interaction between the classifier, adversary, and agents proceeds as follows: At each round $t$, the learner commits to a probability distribution $\mathcal{D}_{t}$ over a set of deterministic classifiers $\{h:\mathcal{X}\to\mathcal{Y}\}$; and promises to use $h_{t}\sim\mathcal{D}_{t}$. Based on this mixed strategy $\mathcal{D}_{t}$ (and before the random classifier $h_{t}$ gets realized), the adversary specifies the next agent to be $(u_{t},y_{t})$. Then comes the most important step that differentiates this model from the fractional classifiers setting: the learner samples $h_{t}\sim\mathcal{D}_{t}$ and releases it to the agent, who then best responds to the true $h_{t}$ by modifying its features from $u_{t}$ to $v_{t}$. The learner aims to minimize the (pseudo) regret with respect to class $\mathcal{H}$:

[TABLE]

We show that, surprisingly, releasing the random choices to the agents can help the learner to surpass the $\Omega(\Delta\cdot\mathsf{OPT})$ lower bound. In this model, we propose three algorithms that achieve $o(T)$ regret, which does not depend on $\mathsf{OPT}$ or $\Delta$.

6.1 Between bandit and full-information feedback

Before presenting our algorithms, we first investigate the feedback information available to the learner at the end of each round. After the agents respond, the learner observes not only the loss of the realized expert ($\ell(h_{t},\mathsf{BR}_{h_{t}}(u_{t}),y_{t})$), but also the best response state $v_{t}=\mathsf{BR}_{h_{t}}(u_{t})$ and the true label $y_{t}$. However, because the original state $u_{t}$ is hidden, the losses of other experts $\ell(h^{\prime},\mathsf{BR}_{h^{\prime}}(u_{t}),y_{t})$ for $h^{\prime}\neq h_{t}$ are not fully observable. For this reason, the feedback structure is potentially richer than bandit feedback, which only contains $\ell(h_{t},\mathsf{BR}_{h_{t}}(u_{t}),y_{t})$ for the realized expert $h_{t}$; but sparser than full-information feedback, which contains $\ell(h^{\prime},\mathsf{BR}_{h^{\prime}}(u_{t}),y_{t})$ for all $h^{\prime}\in\mathcal{H}$.

Nevertheless, we remark that the learner is capable of going beyond the bandit feedback using the additional information $(v_{t},y_{t})$. For instance, if $h^{\prime}$ fully agrees with the realized $h_{t}$ on the entire 2-hop neighborhood of $v_{t}$, then $\ell(h^{\prime},\mathsf{BR}_{h^{\prime}}(u_{t}),y_{t})=\ell(h_{t},\mathsf{BR}_{h_{t}}(u_{t}),y_{t})$. Another scenario is when the agent ends up reporting truthfully ($u_{t}=v_{t}$), so the learner can explicitly calculate the best response $\mathsf{BR}_{h^{\prime}}(u_{t})$ and the loss $\ell(h^{\prime},\mathsf{BR}_{h^{\prime}}(u_{t}),y_{t})$ for all $h^{\prime}\in\mathcal{H}$.

In Section 6.2, we consider a learning algorithm that discards additional information and only uses bandit feedback, which achieves $\mathcal{O}\left(\sqrt{T|\mathcal{H}|\ln|\mathcal{H}|}\right)$ regret. To remove the polynomial dependency on $|\mathcal{H}|$, we propose a generic algorithmic idea that uses an all-positive classifier at random time steps to encourage the truthful reporting of agents. In this way, the learner can obtain full-information feedback on these time steps, which accelerates the learning process. In Section 6.3, we use this idea to achieve $\mathcal{O}\left(T^{\frac{2}{3}}\ln^{\frac{1}{3}}|\mathcal{H}|\right)$ regret against any oblivious adversary. In Section A.4, we extend this idea to the general case of adaptive adversaries and obtain a bound of $\widetilde{\mathcal{O}}\left(T^{\frac{3}{4}}\ln^{\frac{1}{4}}|\mathcal{H}|\right)$. We also show that this framework could be useful in other strategic settings as well. For example, in Section A.5, we apply it to the setting of strategic online linear classification and obtain a mistake bound in terms of the hinge loss of the original examples when the original data points are not linearly separable.

6.2 Algorithm based on bandit feedback

As a warmup, we show the learner can use the vanilla EXP3 algorithm (Auer et al., 2002), which is a standard multi-armed bandit algorithm, to obtain sublinear regret. This algorithm works by maintaining a distribution over $\mathcal{H}$ from which classifier $h_{t}$ is sampled, where the weights of each expert are updated according to

[TABLE]

It is known that running EXP3 with learning rate $\eta=\sqrt{\frac{2\ln|\mathcal{H}|}{|\mathcal{H}|T}}$ will achieve a regret bound of $O(\sqrt{T|\mathcal{H}|\ln|\mathcal{H}|})$, see Auer et al. (2002) for a proof.

6.3 Algorithm based on full-information acceleration

In this section, we provide an algorithm with $\mathcal{O}\left(T^{\frac{2}{3}}\log^{\frac{1}{3}}n\right)$ regret against oblivious adversaries. An oblivious adversary is one who chooses the sequence of agents $\{(u_{t},y_{t})\}_{t=1}^{T}$ before the interaction starts, irrespective of the learner’s decisions during the game. Our algorithm (LABEL:alg:reduction-MAB-FIB) uses a reduction from the partial-information model to the full-information model, which is similar in spirit to Awerbuch and Kleinberg (2004) and Blum and Mansour (2007, Chapter 4.6). The main idea is to divide the timeline $1,\cdots,T$ into $K$ consecutive blocks $B_{1},\cdots,B_{K}$, where $B_{j}=\{(j-1)(T/K)+1,\cdots,j(T/K)\}$, and simulate a full-information online learning algorithm (Hedge) with each block representing a single step. Within each block $B_{j}$, our algorithm uses the same distribution over the experts, except that it will also pick one time-step $\tau_{j}\sim B_{j}$ uniformly at random, and assigns an all-positive classifier to $\tau_{j}$. The intention for this time step $\tau_{j}$ is to prevent the agent from manipulations and simultaneously obtain the loss of every expert. This observed loss then serves as an unbiased loss estimate for the average loss over the same block. In the remainder of this section, we formally present this algorithm in LABEL:alg:reduction-MAB-FIB and provide its regret guarantee in Theorem 6.1.

Theorem 6.1**.**

LABEL:alg:reduction-MAB-FIB* with parameter $K=T^{\frac{2}{3}}\ln^{\frac{1}{3}}|\mathcal{H}|$ achieves a regret bound of $\mathcal{O}\left(T^{\frac{2}{3}}\log^{\frac{1}{3}}|\mathcal{H}|\right)$ against any oblivious adversary.*

Proof.

For notational convenience, we denote the average loss over block $B_{j}$ as $\bar{\ell}_{j}(h)=\frac{\sum_{t\in B_{j}}\ell_{t}(h)}{|B_{j}|}$, where for each expert $h\in\mathcal{H}$, $\ell_{t}(h)=\ell(h,\mathsf{BR}_{h}(u_{t}),y_{t})$. We first claim that for all $h$, $\hat{\ell}_{j}(h)=\ell(h,\mathsf{BR}_{h}(v_{\tau_{j}}),y_{\tau_{j}})$222Note that here $v_{\tau_{j}}$ is the best-response to $h_{\tau_{j}}$ and $\mathsf{BR}_{h}(v_{\tau_{j}})$ is the best-response to $h$ when the agent is at location $v_{\tau_{j}}$ (which we will show is the same as $u_{\tau_{j}}$). is an unbiased estimator of the average loss $\bar{\ell}_{j}(h)$, i.e., $\E_{\tau_{j}\sim B_{j}}[\hat{\ell}_{j}(h)]=\bar{\ell}_{j}(h)$. This is because the algorithm predicts positive on every state at time $\tau_{j}$, so the agent reports truthfully ($u_{\tau_{j}}=v_{\tau_{j}}$), thus $\hat{\ell}_{j}(h)=\ell(h,\mathsf{BR}_{h}(u_{\tau_{j}}),y_{\tau_{j}})=\ell_{\tau_{j}}(h)$ can be observed for any expert $h$. Since $\tau_{j}$ is sampled from $B_{j}$ uniformly at random, we have

[TABLE]

Since the choice of $\tau_{j}$ is sampled independently after the distribution $p_{j}$ is chosen, the above claim implies that for any block $B_{j}$ and any $p_{j}$:

[TABLE]

Therefore, inside each block $B_{j}$ and conditioning on the history before block $B_{j}$, the total loss of LABEL:alg:reduction-MAB-FIB can be bounded as follows:

[TABLE]

where the inequality (9) is because $\mathbf{1}\!\left\{\tilde{y}_{\tau_{j}}\neq y_{\tau_{j}}\right\}\leq 1$ and the loss $\ell_{t}$ is always nonnegative, and (10) is because of the claim in (8). Summing over $K$ blocks and taking the expectation over $\tau_{1},\cdots,\tau_{K}$, we obtain an upper bound of the expected total loss of LABEL:alg:reduction-MAB-FIB:

[TABLE]

From the regret guarantee of Hedge, we have that over the loss sequence $\hat{\ell}_{1},\cdots,\hat{\ell}_{K}$, there is

[TABLE]

Therefore, taking the expectation over $\tau_{1},\cdots,\tau_{K}$, we obtain

[TABLE]

In the above equations, (13) is due to Jensen’s inequality and (14) is from the unbiasedness property established in Equation 8. Finally, putting Equations 11 and 14 together, and using the definition of the average loss $\bar{\ell}_{j}$, we conclude that

[TABLE]

Set $K=T^{\frac{2}{3}}\ln^{\frac{1}{3}}|\mathcal{H}|$, this gives the final regret bound of $\mathcal{O}\left(T^{2/3}\ln^{1/3}|\mathcal{H}|\right)$. ∎

6.4 Discussion on transparency

In the sections above, we have shown that making random choices fully transparent to strategic agents can provably help the learner to achieve sublinear regret. This is in contrast to the fractional model, where we have lower bound examples showing that keeping random choices fully opaque to the agents leads to linear regret. The contrasting results in these two models reveal a fundamental difference between strategic and non-strategic (adversarial) settings: unlike the adversarial setting where learners benefit more from hiding the randomness, in the strategic setting, the learner benefits more from being transparent. At a high level, this is because the relationship between the learner and strategic agents is not completely opposing: instead, the utility of the learner and agents can align to a certain degree.

To be more specific, in our online strategic classification setting, there are three effective players in the game: the learner who selects the classification rule, the adversary who chooses the initial features of agents, and the strategic agents who best respond to the classification rule. From the learner’s perspective, the only malicious player is the adversary, whereas the agent has a known, controllable best response rule. In the fractional classifiers model, both the adversary and the agents face the same amount of information (which is the set of fractions). Although the opacity can prevent the adversary from selecting worst-case agents that force the learner to err with probability $1$ (as in the lower bound examples of 4.6), it also reduces the learner’s control of the strategic behavior of agents. As a result, the potentially rich structure of randomness collapses to the set of deterministic fractional values, resulting in the fact that the learner is still forced to make mistakes with a constant probability.

On the contrary, in the randomized algorithms model, the learner can increase her own leverage of controlling the agents’ best response behavior, and simultaneously reduces the adversary’s ability of using the strategic nature of agents to hide information from the learner. Both are achieved by giving the agents more information (i.e., the realized classifiers). In other words, the learner benefits from “colluding” with the agents and competing against the malicious adversary in unity. This idea is demonstrated by LABEL:alg:reduction-MAB-FIB and LABEL:alg:reduction-adaptive, where the learner occasionally uses an all-positive classifier to encourage the truthful reporting of agents, thus making the adversary unable to benefit from hiding the true features from the learner.

7 Conclusion and Open Problems

In this paper, we studied the problem of online strategic classification under manipulation graphs. We showed fundamental differences between strategic and non-strategic settings in both deterministic and randomized models. In the deterministic model, we show that in contrast to the nonstrategic setting where $O(\ln|\mathcal{H}|)$ bound is achievable by the simple $\mathsf{Halving}$ algorithm, in the strategic setting, mistake/regret bounds are closely characterized by the maximum degree $\Delta$ even when $|\mathcal{H}|=O(\Delta)$. In the randomized model, we show that unlike the nonstrategic setting where withholding random bits can benefit the learner, in the strategic setting, hiding the random choices has to suffer $\Omega(\Delta)$-multiplicative regret, whereas revealing the random choices to the strategic agents can provably bypass this barrier. We also design generic deterministic algorithms that achieve $O(\Delta)$-multiplicative regret and randomized algorithms that achieve $o(T)$ regret against both oblivious and adaptive adversaries.

Our work suggests several open problems. The first is to design a deterministic algorithm in the realizable setting that achieves a mistake bound in terms of generic characteristics of the manipulation graph other than the maximum degree. Recall that our upper bound of $O(\Delta\ln|\mathcal{H}|)$ and lower bound of $\Omega(\Delta)$ are not matching, so it would be interesting to tighten either the upper or lower bound in this setting. The second open question is to incorporate the graph structure into randomized algorithms and achieve a $o(T)$ regret bound that depends on the characterizations of the graph, such as the maximum degree.

Acknowledgements

This work was supported in part by the National Science Foundation under grant CCF-2212968 and grant CCF-2145898, by the Simons Foundation under the Simons Collaboration on the Theory of Algorithmic Fairness, by the Defense Advanced Research Projects Agency under cooperative agreement HR00112020003, by a C3.AI Digital Transformation Institute grant, and a Berkeley AI Research (BAIR) Commons award. The views expressed in this work do not necessarily reflect the position or the policy of the Government and no official endorsement should be inferred. Approved for public release; distribution is unlimited.

Appendix A Supplementary Materials

A.1 Proof of Theorem 4.5

Theorem 4.5 (Restated)**.* LABEL:alg:biased-weighted-maj-vote makes at most $e(\Delta+2)(\ln|\mathcal{H}|+\mathsf{OPT})$ mistakes against any adversary.

---

Proof.

To begin with, we show that if a mistake is made in round $t$, then the weights get updated such that W_{t+1}\leq W_{t}\big{(}1-\gamma/(\Delta+2)\big{)}. Moreover, the algorithm penalizes an expert only if it made a mistake. In other words, the algorithm never over-penalizes experts who do not make a mistake.

First, suppose a mistake is made on a true negative. In this case, $v_{t}$ is labeled as positive by $h_{t}$, so the total weight of experts predicting positive on $v_{t}$ is at least $W_{t}/(\Delta+2)$, and each of their weights is decreased by a factor of $\gamma$. As a result, we have W_{t+1}\leq W_{t}\big{(}1-\gamma/(\Delta+2)\big{)}. Moreover, for each classifier $h$ that gets penalized, we have $h(v_{t})=+1$, so $v_{t}$ belongs to the positive region $S_{h}$, which implies that the initial node $u_{t}\in N[v_{t}]$ is able to reach the positive region $S_{h}$. Therefore, our previous observation indicates that $u_{t}$ would have ended up being predicted as positive had it best responded to $h$, so $h$ had also made a mistake.

Next, consider the case of making a mistake on a true positive. Similar to the proof of 4.5, we argue that the agent has not moved from a different location to $v_{t}$ to get classified as negative, so $v_{t}=u_{t}$. Since the agent did not move, none of the vertices in $N[v_{t}]$ was labeled positive by the algorithm, implying that for each $x\in N[v_{t}]$, weights of experts labeling x as positive is less than $W_{t}/(\Delta+2)$. Therefore, taking the union of all $x\in N[v_{t}]$, we conclude that the total weight of experts predicting negative on all $x\in N[v_{t}]$ is at least W_{t}\Big{(}1-(\Delta+1)/(\Delta+2)\Big{)}=W_{t}/(\Delta+2). All these experts are making a mistake as $v_{t}=u_{t}$ cannot reach the positive region of any of these experts, so they all end up classifying agent $u_{t}$ as negative. As a result, the algorithm cuts their weight by a factor of $\gamma$, resulting in $W_{t+1}\leq W_{t}-(\gamma W_{t})/(\Delta+2)$.

Let $M=\mathsf{Mistake}(T)$ denote the number of mistakes made by the algorithm. Since the initial weights are all set to 1, we have $W_{0}=|\mathcal{H}|$. Together with the property that $W_{t+1}\leq W_{t}\left(1-\frac{\gamma}{\Delta+2}\right)$ on each mistake, we have $W_{T}\leq|\mathcal{H}|\left(1-\frac{\gamma}{\Delta+2}\right)^{M}$.

Now we show that $W_{T}\geq\gamma^{\mathsf{OPT}}$. We have proved that whenever the algorithm decreases the weight of an expert, they must have made a mistake. However, it can be the case that an expert makes a mistake, but the algorithm does not detect that. In other words, the algorithm may under-penalize an expert, but it would never over-penalize. Let $h^{\star}\in\mathcal{H}$ denote the best expert that achieves the minimum number of mistakes $\mathsf{OPT}$. Suppose the algorithm detects $q$ of the rounds where $h^{\star}$ makes a mistake, then we have $q\leq\mathsf{OPT}$. Therefore, after $T$ rounds, $W_{T}\geq w_{T}(h^{\star})=\gamma^{q}\geq\gamma^{\mathsf{OPT}}$, since $0\leq\gamma\leq 1$. Finally, we have:

[TABLE]

By setting $\gamma=1/e$, we bound the total number of mistakes as $M\leq e(\Delta+2)(\ln{|\mathcal{H}|}+\mathsf{OPT})$. ∎

A.2 Improving the Upper Bound

In this section, we propose a pre-processing step to improve the mistake bound of LABEL:alg:halving in some cases, depending on the structure of the underlying manipulation graph. We leave it open to get a general mistake bound that depends on other characteristics of the manipulation graph besides the maximum degree. Consider the case where the manipulation graph $G(\mathcal{X},\mathcal{E})$ is a complete graph, and the hypothesis class $\mathcal{H}$ includes all possible labelings of $\mathcal{X}$, i.e. $|\mathcal{H}|=2^{|\mathcal{X}|}$. However, Proposition A.1 shows that all the examples $(u_{t},y_{t})$ arriving over time get labeled the same: either all positive or all negative. Therefore, the size of the effective hypothesis class is $2$.

Proposition A.1**.**

If the manipulation graph $G(\mathcal{X},\mathcal{E})$ is a complete undirected graph, then all the examples arriving over time are labeled the same, i.e. all positive or all negative.

Proof.

Consider a hypothesis $h$ that labels at least one node $v\in\mathcal{X}$ as positive. Then any example $u_{t}$ arriving at time-step $t$ can reach $v$ and get classified as positive. Hence, $h$ classifies all the examples as positive. On the other hand, if $h$ labels all the nodes $v\in\mathcal{X}$ as negative, then it would classify all the examples arriving over time as negative. ∎

LABEL:alg:halving has a mistake bound of $\mathcal{O}(\Delta\ln|\mathcal{H}|)$ in the realizable case. However, when the manipulation graph is complete, we can get a mistake bound of $1$ as follows: initially starting with an all-positive classifier, if a mistake happens, switch to an all-negative classifier. The case of complete graphs shows that depending on the underlying manipulation graph, there can be a large gap between the upper bound given by LABEL:alg:halving and the best achievable bound.  LABEL:alg:improvement-halving is a pre-processing step to improve this gap.

LABEL:alg:improvement-halving initially starts with an all-positive classifier. When the first mistake happens on a node $v_{t}$, it means that $v_{t}$ and all its neighbors need to be classified as negative. Hence, we exclude all the hypothesis $h\in\mathcal{H}$ that classify any node $v\in N[v_{t}]$ as positive from $\mathcal{H}$. After filtering $\mathcal{H}$, we run LABEL:alg:halving on the new set $\mathcal{H}^{\prime}$. We now restate the guarantee of LABEL:alg:improvement-halving that we presented in Theorem 4.4, and show its proof.

Theorem 4.4 (Restated)**.* LABEL:alg:improvement-halving makes at most $\min\{n-\delta,1+\Delta\cdot\min\{\ln|\mathcal{H}|,n-\delta-1\}\}$ mistakes, where $n=|\mathcal{X}|$ and $\delta$ is the minimum degree of $G(\mathcal{X},\mathcal{E})$.

---

Proof.

After the first mistake happens on $v_{t}$, LABEL:alg:improvement-halving only keeps the hypotheses that label all the nodes in $N[v_{t}]$ as negative. Since \big{|}N[v_{t}]\big{|}\geq\delta+1, the number of such hypotheses is at most $2^{n-(\delta+1)}$. Therefore, the filtered-out hypothesis set $\mathcal{H^{\prime}}$ satisfies $|\mathcal{H}^{\prime}|\leq\min\{|\mathcal{H}|,2^{n-\delta-1}\}$. Therefore, the number of mistakes that LABEL:alg:halving makes on the filtered hypothesis set is at most:

[TABLE]

Suppose that $n-\delta<1+\Delta\cdot\min\{\ln|\mathcal{H}|,n-\delta-1\}$. After the first mistake happens on $v_{t}$ and the labels of $N[v_{t}]$ get flipped, for the remaining graph $G\setminus N[v_{t}]$, the labels can get flipped one by one whenever a mistake is observed. Therefore, the total number of mistakes is at most:

[TABLE]

∎

Remark A.2**.**

When the manipulation graph is dense, the mistake bound in Theorem 4.4 can greatly outperform that given in Theorem 4.3. For instance, in complete graphs where both the minimum degree and the maximum degree are $n-1$, Theorem 4.4 guarantees that LABEL:alg:improvement-halving makes at most one mistake, whereas LABEL:alg:halving could end up making $n$ mistakes in total, one on each vertex.

A.3 Extension of the Deterministic Model to Directed Manipulation Graphs

Suppose that the manipulation graph $G(\mathcal{X},\mathcal{E})$ is a directed graph. We show how to modify LABEL:alg:halving and LABEL:alg:biased-weighted-maj-vote to work in the case of directed manipulation graphs and get a regret bound that depends on $\Delta_{\text{out}}$ instead of $\Delta$, where $\Delta_{\text{out}}$ is the maximum out-degree of all the nodes $v\in\mathcal{X}$.

Proposition A.3**.**

In the realizable case, LABEL:alg:halving can be modified to make at most $(\Delta_{\text{out}}+2)\ln|\mathcal{H}|$ mistakes.

Proof.

First, we need to change the threshold of the majority vote for classifying a node as positive from $1/(\Delta+2)$ to $1/(\Delta_{\text{out}}+2)$. Now, if a mistake on a true negative happens, then $1/(\Delta_{\text{out}}+2)$ of the remaining hypotheses gets discarded, which are the set of experts that predict the observable node as positive. On the other hand, if a mistake on a true positive happens, it means that the agent was classified as negative and did not move. Therefore, all the nodes in the reachable out-neighborhood were classified as negative by the algorithm. The number of reachable nodes from the starting node is at most $\Delta_{\text{out}}+1$, and for each of them. less than $(1/(\Delta_{\text{out}}+2))|\mathcal{H}|$ experts classified them as positive. Therefore, a total of |\mathcal{H}|\Big{(}1-(\Delta_{\text{out}}+1)/(\Delta_{\text{out}}+2)\Big{)}=(1/(\Delta_{\text{out}}+2))|\mathcal{H}| remaining hypotheses are classifying the entire reachable set as negative, and they are all making a mistake. As a result, whenever a mistake happens, $1/(\Delta_{\text{out}}+2)$ fraction of the hypotheses can get discarded. This results in a mistake bound of $(\Delta+2)\ln{|\mathcal{H}|}$. ∎

Similarly, we can show that LABEL:alg:biased-weighted-maj-vote can be modified to get a mistake bound that depends on $\Delta_{\text{out}}$ instead of $\Delta$, as shown in the following proposition.

Proposition A.4**.**

In the unrealizable case, LABEL:alg:biased-weighted-maj-vote can be modified to make at most $e(\Delta_{\text{out}}+2)(\ln|\mathcal{H}|+\mathsf{OPT})$ mistakes.

A.4 Regret bound of $\widetilde{\mathcal{O}}\left(T^{\frac{3}{4}}\ln^{\frac{1}{4}}|\mathcal{H}|\right)$ against an adaptive adversary

In this section, we present an algorithm (LABEL:alg:reduction-adaptive) based on the idea of full-information acceleration, and prove a regret bound of $\widetilde{\mathcal{O}}\left(T^{\frac{3}{4}}\ln^{\frac{1}{4}}|\mathcal{H}|\right)$ against general adaptive adversaries in Theorem A.5. The proof of this theorem requires a more careful analysis of the difference between the estimated loss sequence and the actual loss sequence using martingale difference sequences, which borrows similar ideas from McMahan and Blum [2004].

Theorem A.5**.**

LABEL:alg:reduction-adaptive* achieves a regret of $\widetilde{\mathcal{O}}\left(T^{\frac{3}{4}}\ln^{\frac{1}{4}}|\mathcal{H}|\right)$ against any adaptive adversary.*

Proof.

Similar to the proof of Theorem 6.1, we first show that at every round $t$ and for all experts $h\in\mathcal{H}$, $\hat{\ell}_{t}(h)$ is an unbiased estimate of $\ell_{t}(h)$, where $\ell_{t}(h)=\ell(h,\mathsf{BR}_{h}(u_{t}),y_{t})$ is the true loss of $h$. Since we are dealing with adaptive adversaries, we show that for every $h\in\mathcal{H}$, $\left(\hat{\ell}_{t}(h)-\ell_{t}(h)\right)_{t=1}^{T}$ is a Martingale Difference Sequence: let $\mathcal{F}_{t}$ denote the $\sigma$-algebra generated by the randomness up to time $t$, then

[TABLE]

Here, the first equality is because $\hat{\ell}_{t}\neq 0$ only when $h_{t}=h^{+}$ is an all-positive classifier, which happens with probability $\gamma$. The second equality is because the agent would not move under $h^{+}$, resulting in $u_{t}=v_{t}$. Moreover, from the definition of $\hat{\ell}_{t}$, the term $\hat{\ell}_{t}(h)-\ell_{t}(h)$ is bounded in absolute value by $\frac{1}{\gamma}$. Now we calculate the expected cumulative loss of LABEL:alg:reduction-adaptive.

[TABLE]

In the above equations, Equation 16 is from the tower property of conditional expectations, Equation 17 is because $\mathbf{1}\!\left\{y_{t}\neq 1\right\}\leq 1$ and $1-\gamma\leq 1$, where we also use the tower property to remove the conditional expectations. Finally, Equation 18 is because we add and subtract the second term.

Now, for the third term in (18), note that $p_{t}^{\prime}$ is defined on $\mathcal{F}_{t-1}$, so $\left(\E_{h\sim p_{t}^{\prime}}\left[\ell_{t}(h)-\hat{\ell}_{t}(h)\right]\right)_{t=1}^{T}$ is also a martingale difference sequence with respect to the filtration $\left(\mathcal{F}_{t}\right)_{t=1}^{T}$. Again, from the tower property, this term is always zero:

[TABLE]

Since $p_{1}^{\prime},\cdots,p_{T}^{\prime}$ are exactly the same as the strategies generated by running Hedge on the estimated loss sequence $\hat{\ell}_{1},\cdots,\hat{\ell}_{T}$, and the magnitude of the losses are all bounded by $\frac{1}{\gamma}$, we have the following regret guarantee from Freund and Schapire [1997]:

[TABLE]

Putting Equations 18, 19 and 20 together gives us the bound on expected loss:

[TABLE]

We define

[TABLE]

then the above inequality (21) implies

[TABLE]

Now, the last step is to bound the expected difference between $\widehat{\mathsf{OPT}}$ and the true optimal $\mathsf{OPT}=\min_{h^{\star}\in\mathcal{H}}\ell_{t}(h^{\star})$. We have:

[TABLE]

Since $\left(\hat{\ell}_{t}(h)-\ell_{t}(h)\right)_{t=1}^{T}$ is a martingale difference sequence for any fixed $h$, we use Azuma-Hoeffding inequality together with the union bound to obtain

[TABLE]

Setting $\delta=\frac{1}{T|\mathcal{H}|}$ gives us

[TABLE]

Finally, by putting Equations 22 and 23 together, and setting $\gamma=T^{-\frac{1}{4}}\ln^{\frac{1}{4}}(T|\mathcal{H}|)$, we derive the desired regret bound:

[TABLE]

∎

A.5 Strategic online linear classification

In this section, we propose an algorithm for the problem of online linear classification in the presence of strategic behavior. In this setting, each original example $\mathbf{z}_{t}$ can move for an $\ell_{2}$ distance of at most $\alpha$ and reach a new observable state $\mathbf{x}_{t}$; and the examples would move for a minimum distance that results in a positive classification. Ahmadi et al. [2021] propose an algorithm for the case that original examples are linearly separable; in the case of inseparable examples, they get a mistake bound in terms of the hinge loss of manipulated examples, and leave it as an open problem to obtain a mistake bound in terms of the hinge-loss of original examples.

In this section, we propose an algorithm for the inseparable case that obtains a bound in terms of the hinge-loss of original examples. However, our mistake bound has an additional $\mathcal{O}(\sqrt{T})$ additive term compared to the bound obtained by Ahmadi et al. [2021] in the separable case. The idea behind this algorithm is to use an all-positive classifier at random time steps to observe the un-manipulated examples. Using the un-manipulated examples, the standard Perceptron algorithm suffices to deal with inseparable data. For simplicity, we present the algorithm for oblivious adversaries and remark that a similar bound could be obtained for the case of adaptive adversaries using similar techniques as in Section A.4.

Theorem A.6**.**

Let $S=\{(\mathbf{z}_{t},y_{t})\}_{t=1}^{T}$ be the set of original data points, where $\max_{t}|\mathbf{z}_{t}|\leq R$. For any $\mathbf{w}^{\star}$, LABEL:alg:reduction-MAB-FIB-hinge-loss with parameter $K=\sqrt{T}R\|\mathbf{w}^{\star}\|$ satisfies

[TABLE]

where the hinge loss is defined as

[TABLE]

Proof.

We use $\ell_{t}(h)=\mathbf{1}\!\left\{y_{t}\neq h(\mathsf{BR}_{h}(\mathbf{z}_{t})\right\}$ to denote the loss of classifier $h$ had agent $(\mathbf{z}_{t},y_{t})$ best responded to $h$.

In each block $B_{j}$, we have $\ell(h_{\tau_{j}})=\mathbf{1}\!\left\{y_{\tau_{j}}\neq+1\right\}\leq 1$ on the all-positive step $\tau_{j}$. On the other steps $t\neq\tau_{j}$, since $h^{j}$ is obtained by shifting the boundary $\mathbf{w}_{j}$ by $\alpha$, an agent $(\mathbf{x}_{t})$ can reach the positive region of $h^{j}$ if and only if its original features $(\mathbf{z}_{t})$ have a nonnegative dot product with $\mathbf{w}_{j}$. Thus we have

[TABLE]

As a result, we can bound the number of mistakes as follows:

[TABLE]

where the last step is because $\tau_{j}$ is sampled uniformly at random from $B_{j}$.

Note that $w_{1},\cdots,w_{K}$ is obtained from running the standard Perceptron algorithm on examples $S_{\tau}\triangleq\{(\mathbf{x}_{\tau_{1}},y_{\tau_{1}}),\cdots,(\mathbf{x}_{\tau_{K}},y_{\tau_{K}})\}$. Since at each $\tau_{j}$, the learner uses an all-positive classifier to stop the agents from moving, we have $\mathbf{x}_{\tau_{j}}=\mathbf{z}_{\tau_{j}}$, and $S_{\tau}=\{(\mathbf{z}_{\tau_{1}},y_{\tau_{1}}),\cdots,(\mathbf{z}_{\tau_{K}},y_{\tau_{K}})\}$. From Block [1962], we have

[TABLE]

Taking the expectation over $\tau_{1},\cdots,\tau_{K}$, we have the following mistake bound on the standard perceptron algorithm:

[TABLE]

In the above inequalities, Equation 26 follows from the fact that $\tau_{j}$ is distributed uniformly at random in block $B_{j}$, and Equation 27 is because every block has size $|B_{j}|=\frac{T}{K}$.

Now we plug Equation 28 back into (25) and obtain

[TABLE]

Finally, letting $K=\sqrt{T}R\|\mathbf{w}^{\star}\|$ yields the desired bound. ∎

A.6 Two populations

In this section, we study extensions of the unit-edge cost function in our baseline model. We assume there are two populations with different manipulation costs: agents of group $A$ face a cost of $0.5$ on each edge, whereas agents of group $B$ face a cost of $1$. As a result, in response to deterministic classifiers, agents from group $A$ move within their two-hop distance neighborhood, whereas agents from group $B$ only move inside their one-hop distance neighborhood.

We suppose each agent has fixed probabilities of belonging to each group, regardless of the initial position and the label chosen by the adversary. In other words, at every round $t$, after the adversary picks the next agent $(u_{t},y_{t})$, we assume nature independently assigns this agent to group $c_{t}=B$ with probability $\beta$ and $c_{t}=A$ with probability $\alpha=1-\beta$. The agent’s best response to classifier $h_{t}$ is a function of $u_{t}$ and $c_{t}$:

[TABLE]

As a result of manipulation, the learner suffers loss $\ell(h_{t},v_{t},y_{t})=\ell(h_{t},\mathsf{BR}_{h_{t}}(u_{t},c_{t}),y_{t})$ and observes $(v_{t},y_{t})$ together with group membership $c_{t}$. The learner’s goal is to bound the expected number of mistakes in terms of the optimal number of mistakes in expectation, where the expectations are taken over the random group assignments and the possible randomness in the learning algorithm and the adversary’s choices.

[TABLE]

We propose LABEL:alg:two-populations that is based on the idea of biased weighted majority vote (LABEL:alg:biased-weighted-maj-vote), with a group-independent threshold for the biased majority votes, and a group-dependent way of penalizing experts. We state the mistake bound guarantee in Theorem A.7.

Theorem A.7**.**

In the setting of two populations and population $B$ has probability $\beta$, LABEL:alg:two-populations achieves an expected mistake bound of the following:

[TABLE]

Remark A.8**.**

In Theorem A.7, when all agents can make two hops (i.e., $\beta=0$), the mistake bound reduces to the guarantee provided Theorem 4.5 with $\Delta^{2}$ as the maximum degree. In this case, LABEL:alg:two-populations is equivalent with LABEL:alg:biased-weighted-maj-vote running on the expanded neighborhood graph $\widetilde{G}$ in which every two nodes of distance at most two are connected by an edge. Here, $\Delta^{2}$ is an upper bound on the maximum degree of $\widetilde{G}$.In contrast, when all agents can only make one hop (i.e., $\beta=1$), the problem reduces to the baseline model, and Theorem A.7’s guarantee becomes the same as that of Theorem 4.5 with the same set of parameters. For values of $\beta$ between 0 and 1, the mistake bound smoothly interpolates the guarantees of the two extreme cases.

Proof of Theorem A.7.

We show that whenever a mistake is made, we can reduce the total weight of experts ($W_{t}$) by a constant fraction in expectation.

First, consider the case of a false positive. Since $h_{t}(v_{t})=+1$, the total weight of experts that predict positive on $v_{t}$ is at least $\theta W_{t}$ ; and the weight of each of them gets reduced by a factor of $\lambda$. Let $\mathcal{F}_{t}$ be the $\sigma$-algebra generated by the random variables up to time $t$, then we have

[TABLE]

Next, consider the case of a false negative. Since $h_{t}(v_{t})=-1$, we know that the agent did not move, i.e., $v_{t}=u_{t}$. The algorithm updates as follows: if $c_{t}=B$, it reduces the weight of experts who predict negative on all the nodes in the one-hop neighborhood of $v_{t}$, i.e., $N[v_{t}]$. if $c_{t}=A$, then it reduces the weight of experts who predict negative on all the nodes in the two-hop neighborhood of $v_{t}$, i.e., $N^{2}[v_{t}]$. We claim that:

[TABLE]

To see this, we can use the Bayes law to calculate the conditional probability of group assignments: for $X\in\{A,B\}$, we have

[TABLE]

Since the group membership $c_{t}$ is independently realized after the adversary chooses $(u_{t},y_{t})$, we have

[TABLE]

where the last step is because agents of population $A$ have more manipulation power, so under every possible classifier, group $A$ is able to get classified as positive whenever group $B$ is; therefore, group $A$ agents are less likely to become false negative. We have thus established the claim.

Now we turn to the total weight that is reduced in this scenario. If $c_{t}=A$, then there are at most $(\Delta^{2}+1)$ nodes in the two-hop neighborhood, in which all of them are predicted negative. Therefore, the total weight of experts who predict negative on all of them is at least $W_{t}(1-\theta(\Delta^{2}+1))_{+}$. On the other hand, if $c_{t}=B$, then the total weight of experts who predict negative on the one-hop neighborhood is at least $W_{t}(1-\theta(\Delta+1))_{+}$. Putting the two cases together and conditioning on the false negative, the total weight that can be reduced is at least

[TABLE]

where the first term in (31) is due to the claim we just established, and the second term follows from $(1-(\Delta+1)\theta)_{+}\geq(1-(\Delta^{2}+1)\theta)_{+}$ together with $\Pr(c_{t}=B\ |\ \text{false negative},\mathcal{F}_{t-1})+\Pr(c_{t}=A\ |\ \text{false negative},\mathcal{F}_{t-1})=1$. From Equation 31, we obtain

[TABLE]

Finally, we optimize the threshold $\theta$ to equalize the decrease in the case of false positive (Equation 29) and false negative (Equation 32). As a result, the optimal $\theta$ is obtained by solving the following equation:

[TABLE]

Since $f,f_{1}$, and $f_{2}$ are all linear functions where $f_{1},f_{2}$ have a negative slope and $f$ has a positive slope, the intersection between $f$ and $\max\{f_{1},f_{2}\}$ coincides with the maximum value between the intersection of $\{f,f_{1}\}$ and the intersection of $\{f,f_{2}\}$. Moreover, $\theta=0$ is not a valid solution because the other two intersections have strictly positive values. Thus we obtain

[TABLE]

Correspondingly, on each mistake, the optimal amount of decrease in the total weight is

[TABLE]

By Jensen’s inequality, we further obtain that if a mistake is made at time $t$, then

[TABLE]

The last step is to telescope Equation 33 over all mistakes. Note that the algorithm only penalizes the experts that make mistakes, so the same argument as Theorem 4.5 implies that $W_{T}\geq\gamma^{\mathsf{OPT}}$. Thus we have

[TABLE]

Rearranging the above inequality, setting $\lambda=1/e$ and using $\ln(1-x)\leq-x$ gives us an expected mistake bound of

[TABLE]

This completes the proof. ∎