Statistical Collusion by Collectives on Learning Platforms

Etienne Gauthier; Francis Bach; Michael I. Jordan

REVIEW 2 major objections 5 minor 24 references

Statistical Collusion by Collectives on Learning Platforms

T0 review · 2 major / 5 minor · reviewed 2026-08-08 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A collective can certify, from its own pooled data alone, how much it can bend a platform's classifier to its will.

desk verdict A genuinely useful finite-sample framework for collective action, but the ε>0 theorems hinge on a false lemma and need a 2ε fix or a restriction to ε=0. read the letter →

arxiv 2502.04879 v3 pith:E3CXH56U submitted 2025-02-07 stat.ML cs.LG

Etienne Gauthier , Francis Bach , Michael I. Jordan This is my paper · ORCID

classification stat.MLcs.LG MSC 68Q3262H30

keywords statisticalcollusioncollectiveactiondatapoisoningsignalplantingunplantingerasingfinite-sampleguaranteestotalvariationsuboptimality

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Coordinated groups of users—collectives—can deliberately alter their own data to steer a platform's learning algorithm, but to act safely they need to know in advance whether the attempt will work. This paper shows that a collective can compute, using only the data it has pooled, high-probability lower bounds on its test-time success for three objectives: planting a predicted label on a signal set, unplanting that label, and erasing a feature transformation's effect. The bounds are explicit functions of the collective's relative size $n/N$, the empirical frequencies of modified features, label gaps, concentration terms, and the platform's suboptimality $\varepsilon$; they hold with probability at least $1-\delta$. Because each feature in the signal set must be individually 'cracked', the bounds increase in staircase-shaped steps rather than smooth sigmoids, a pattern that population-level bounds miss. The framework also reveals that absolute collective size matters: for a fixed fraction $n/N$, a larger platform gives the collective better estimates, making large platforms more exposed.

What carries the argument

The load-bearing object is the $\varepsilon$-suboptimal classifier under total-variation distance (Definition 3.1): a classifier $\hat{f}$ for which there exists a distribution $\tilde{P}$ with $TV(\hat{P},\tilde{P})\le\varepsilon$ such that $\hat{f}(x)\in\arg\max_y \tilde{P}(x,y)$ on the relevant feature set. This assumption turns the platform into a frequency-counting rule within a TV ball, so features whose empirical label margins exceed $\varepsilon/(1-\varepsilon)$ are decided in the collective's favor. The proof machinery is a finite union bound over Hoeffding concentration inequalities for the collective's empirical frequencies, the non-collective population's label gaps, and the test set; finiteness of $\mathcal{X}\times\mathcal{Y}$ keeps the union bound finite. Each feature $\tilde{x}$ of the signal set carries its own resistance threshold, so the lower bound rises one feature at a time as $n/N$ grows, producing staircase curves. The paper also supplies algorithms that compute each bound from $\widetilde{D}(n)$ and the public quantity $N$.

What would settle it

Train a classifier on a dataset in which a collective floods one feature cell with a target label; estimate the smallest $\varepsilon$ for which Definition 3.1 holds, compute the Theorem 3.3 bound from the collective's data, and compare with observed test-time success over many draws. A single configuration with an $\varepsilon$-suboptimal classifier whose empirical success falls below the computed bound would refute the theorem.

Watch

Extended reading notes

Core claim

The paper's central claim is Theorem 3.3 (with analogues in Theorems 3.5, 3.7, and 3.9): when the platform's classifier is $\varepsilon$-suboptimal in total-variation distance on the signal set $\widetilde{\mathcal{X}}$, a collective playing the feature-label signal-planting strategy achieves, with probability at least $1-\delta$ over the random draw of all consumers, a test-time success lower-bounded by a quantity computed entirely from the collective's own modified dataset $\widetilde{D}(n)$. The bound is the probability, over features drawn from $\widetilde{D}(n)$, that $\frac{n}{N}(\hat{P}_{\widetilde{D}(n)}(\tilde{x})-2R_{\tilde{\delta}}(n)) - \frac{N-n}{N}(\Delta^{(n)}_{\tilde{x}} + 2R_{\tilde{\delta}}(n) + 2R_{\tilde{\delta}}(N-n)) - \frac{\varepsilon}{1-\varepsilon} > 0$, minus concentration terms $R_{\tilde{\delta}}(n)+R_{\tilde{\delta}}(N_{\mathrm{test}})$. In words, a feature $\tilde{x}$ contributes to the guaranteed success only once the collective's planted mass at $\tilde{x}$ exceeds the non-collective population's countervailing label gap plus a platform-flexibility penalty $\varepsilon/(1-\varepsilon)$. The same pattern, with different definitions of the label-gap term $\Delta$, governs feature-only planting, adaptive unplanting, and erasure; in the infinite-data limit the bounds specialize to population-level bounds that the authors report are tighter than the previously known ones.

Load-bearing premise

Every theorem's force depends on the platform classifier being $\varepsilon$-suboptimal in total-variation distance (Definition 3.1): there must exist a distribution within TV distance $\varepsilon$ of the empirical training distribution under which the classifier is a per-feature argmax rule, and classifiers trained with regularization, kernels, or neural networks need not satisfy this condition.

Editorial extensions

If this is right

A collective can decide before acting whether its data modification will reach a target success level, and can compute the minimum collective size needed, using only its own pooled sample and the public total population $N$.
Guaranteed success rises feature by feature: each feature in the signal set is 'cracked' when the collective's planted mass overcomes that feature's label gap, so a collective can rank signal features by resistance and concentrate its effort on the weakest ones.
For a fixed relative size $n/N$, increasing the platform's total population $N$ shrinks the estimation-error terms $R_{\tilde{\delta}}(\cdot)$, so larger platforms are more exposed to coordinated data modification than smaller ones.
In the infinite-data limit the finite-sample bounds reduce to population-level bounds, and the paper reports these bounds are tighter than previously known population-level bounds while preserving the staircase structure that smooth bounds lose.
For adaptive unplanting and erasure, which require estimating the best label from pooled data, the size of the estimation subset $n_e$ creates an explicit trade-off between strategy accuracy and estimation error, and the bounds make that trade-off visible.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Editorial inference: because the same bound is computable from the collective's own data, a platform can run the calculation symmetrically to audit which feature cells are cheapest to poison and concentrate its monitoring or data-quality defenses there.
Editorial inference: if the TV-suboptimality assumption fails, the numerical bound need not hold, but the staircase structure plausibly persists for other smooth classifier families; re-deriving per-feature thresholds under conditional-TV suboptimality or other metrics would be a direct testable extension.
Editorial inference: the paper assumes collective members are drawn i.i.d. from the general population, but real collectives are usually self-selected; allowing the collective's base distribution to differ from the population's and measuring how that shifts each feature's resistance threshold is a natural next step.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Here's the short version: the paper's core idea is genuinely new — it turns Hardt et al.'s population-level collective-action bounds into finite-sample lower bounds that a collective can compute from its own data before acting, and it adds a signal-unplanting objective plus a staircase interpretation over discrete signal sets. The ε=0 argument is coherent, the sample split in adaptive unplanting avoids circularity, and the infinite-data comparison shows their ε=0 bound is tighter than Hardt's. The synthetic experiments come with code.

The problem is the ε>0 generalization. Lemma D.2, cited as Hardt et al.'s Lemma B.1, claims that TV(p,p')≤ε together with a margin of ε/(1−ε) preserves an argmax. That is false. The counterexample: disjoint E1,E2 with p(E1)=0.6, p(E2)=0.4, p'(E1)=p'(E2)=0.5, ε=0.1. TV is 0.1, the margin 0.2 exceeds 0.111, yet the ordering flips to a tie. The correct threshold is 2ε. Since the proofs of Theorems 3.3, 3.5, 3.7, and 3.9 all route through this lemma, their ε>0 versions are unsupported. The paper even notes in F.4 that Hardt et al. had an ε>0 proof issue, then misses its own. The experiments set ε=0, so the staircase observations stand, but the advertised ε>0 input does not.

This is a load-bearing flaw, but it is repairable. Either replace ε/(1−ε) with 2ε and adjust the concentration steps, or restrict the theorems to ε=0 or to conditional suboptimality (F.3). The empirical lower bounds, the algorithms, and the unplanting idea survive. Separately, the ε-suboptimality assumption is a strong one for real platforms, and the erasing bound is admittedly loose in most settings; the authors are up front about the latter.

I'd send this to peer review with a major-revision ask. The ε=0 core is solid, and the finite-sample planning perspective is worth pushing through. I'd also bring it to our reading group — it's a clean example of how a single concentration lemma can sink a general claim.

Referee Report

2 major / 5 minor

Summary. This paper studies coordinated data modification by a collective of consumers interacting with a learning platform. The authors introduce a finite-sample version of algorithmic collective action in which the collective, having access only to its own pooled data and the total population size N, can compute lower bounds on the success of three strategies: signal planting, the new objective of signal unplanting, and signal erasing. The bounds are stated for classifiers that are ε-suboptimal in total variation relative to the empirical training distribution. The paper provides proofs via concentration inequalities and union bounds, algorithms implementing the bounds, experiments on a synthetic car-evaluation dataset that exhibit staircase-shaped curves, and an infinite-data comparison with Hardt et al. (2023).

Significance. The framework is a useful and original step: it makes poisoning lower bounds pre-action computable from the collective's data, introduces a new objective (signal unplanting), and gives a clean sample-splitting construction (D(ne) for strategy choice, D(n−ne) for gap estimation) that avoids circularity. The staircase interpretation—each feature has its own 'resistance' that breaks as n/N grows—is insightful and is supported by the ε=0 experiments. The code and synthetic data are provided, which strengthens reproducibility. If the positive-ε results are repaired, the paper would be a solid contribution to the theory of data poisoning; as it stands, the core theoretical claims for ε>0 are not supported.

major comments (2)

[Appendix D, Lemma D.2; Appendix E.1; Theorems 3.3, 3.5, 3.7, 3.9] Lemma D.2 is false as stated. For disjoint events E1,E2 with P(E1)=0.6, P(E2)=0.4, P'(E1)=P'(E2)=0.5, and ε=0.1, we have TV(P,P')=0.1≤ε and P(E1)>P(E2)+ε/(1−ε) (0.6>0.511...), yet P'(E1)>P'(E2) is false. The correct implication from TV(P,P')≤ε is P'(E1)−P'(E2) ≥ P(E1)−P(E2)−2ε, so the required margin is 2ε, not ε/(1−ε). This lemma is the sole bridge for the ε>0 case in the proof of Theorem 3.3 ('∀y′≠y∗, Phat(˜x,y∗) > Phat(˜x,y′) + ε/(1−ε) ⇒ P~(˜x,y∗) > P~(˜x,y′)'), and Theorems 3.5, 3.7, and 3.9 all state bounds containing the term ε/(1−ε). Consequently the displayed bounds (1), (2), (4), and (5) and Algorithms 1–4 (which accept ε>0 as an input) are unproven for positive ε. The paper itself, in Appendix F.4, acknowledges that Hardt et al. (2023) had an issue with their ε>0 proof; the same issue appears here. The theorems must be corrected either by replacing ε/(1−ε) with the larger threshold 2ε (and reworking the subsequent concentration steps), or by restricting the statements to ε=0, or by explicitly adopting a different suboptimality notion such as Definition F.3 and proving the claimed threshold under it.
[Definition 3.1 and §3.1 (The platform)] The premise that the platform's classifier is ε-suboptimal in total variation is a strong, non-verifiable assumption. Many classifiers used in practice—e.g., regularized empirical risk minimizers, kernel methods, or neural networks—need not be Bayes-optimal for any distribution within a small TV ball around the empirical distribution, so the frequency-based lower bounds would not apply to them. The paper's interpretation that ε 'roughly controls how much the classifier can make use of statistics that go beyond simple frequency counts' is not substantiated. The experiments all set ε=0, so they do not provide support for the positive-ε regime. The authors should either characterize a concrete class of algorithms that satisfy Definition 3.1 with small ε, or explicitly present the results as applying only to classifiers that are approximate frequency-based argmax rules.

minor comments (5)

[§3.2.1, after Theorem 3.3] The sentence 'Note that lower bound (1) is fully computable by the collective as it depends only on datasets D(n) and ˜D(n)' is imprecise because the bound also depends on ε, which is an input and not estimated from data; it should say 'given a value of ε' or explain how ε is obtained.
[§3.2.2, after Theorem 3.5] The sentence 'In the following, we will always assume that the collective can modify its labels' seems to disregard the feature-only strategy, yet Section 4.3 and Figure 4 compare both strategies; please clarify the scope.
[Appendix B, Algorithm 4] The comment 'Note that Algorithm 4 yields a valid lower bound if 2 log(1/˜δ)/η² ≤ n ≤ N − 2 log(1/˜δ)/η²' is a condition, not a remark; it would be clearer to state this requirement in Theorem 3.9 itself or in the algorithm's input specification.
[Figure 3 and Appendix C] The 'Zoomed-in view' label in Figure 3 is unclear; it should indicate which panel (a), (b), or (c) is being magnified. Also, in Appendix C the sentence 'In Figure 5, we can see...' appears before the figure is referenced in the main text; consider moving or renumbering.
[Appendix F.4] The main text in §4.3 says 'Our bounds in the infinite data regime are compared to bounds from Hardt et al. (2023)' with 'when ε=0' only in the figure caption; the body text should explicitly state that the comparison is restricted to ε=0 because the ε>0 versions are not yet proven.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the lower bounds are derived from concentration inequalities and a genuine sample split, not from fitting or self-referential definitions.

full rationale

The derivation chain is self-contained. Theorems 3.3, 3.5, 3.7, and 3.9 each prove a high-probability lower bound by (i) writing a sufficient condition for the desired classifier behavior in terms of empirical frequencies, (ii) bounding the probability of that condition via Hoeffding's inequality and a union bound, and (iii) replacing population terms by computable empirical terms with concentration slack. The signal-unplanting bound (Theorem 3.7) is particularly clean in this respect: the strategy h is selected on D(ne), while the label-gap term Delta^(n-ne) is estimated on the disjoint sample D(n-ne), so the bound does not reduce to the selection criterion by construction. No fitted parameter is renamed as a prediction; the lower bound is a function of the collective's own data and the assumed suboptimality level epsilon. The only citation with overlapping authorship (Zrnic et al. 2021, co-authored by Jordan) is a related-work mention and is not load-bearing. The proof's epsilon>0 extension relies on Lemma D.2 imported from Hardt et al. (2023); whether that lemma is correct is a mathematical-correctness concern, not a circularity, since the bound does not assume the conclusion it is trying to establish.

Assumptions & free parameters 1 free parameters · 6 assumptions · 0 invented entities

The framework adds no new physical entities. Its statistical claims rest on a finite universe, i.i.d. sampling, an epsilon-suboptimality model of the platform, and a margin assumption for erasing. The only hand-chosen experimental quantity is n_e. The most fragile input is Lemma D.2 and the epsilon-to-margin conversion.

free parameters (1)

n_e (estimation split for adaptive signal unplanting) = 2,000
Chosen manually from the lower-bound trade-off in Section 4.2. It is not fitted to test success, but it is a hand-set experimental hyperparameter that the theorem treats as fixed.

assumptions (6)

domain assumption The universe X times Y is finite.
Introduced in Section 3.1. Finiteness is needed so union bounds are applied over finitely many events.
domain assumption Consumers in D(n), D(N-n), and D_test are i.i.d. from a common distribution D.
Stated in Section 3.1. All concentration arguments treat these datasets as independent samples from the same base distribution.
domain assumption The platform's classifier is epsilon-suboptimal in the total-variation sense of Definition 3.1, and the argmax margin rule from Lemma D.2 holds.
Used in every theorem to convert empirical frequency gaps into classifier predictions. The lemma is quoted from Hardt et al. with no proof, and the epsilon/(1-epsilon) threshold is questionable.
domain assumption Assumption A1: for every signal feature, some label is eta more probable than all others.
Needed in Theorem 3.9 so the collective can identify the optimal label y* from its own data.
domain assumption Assumption A2: transformation g is idempotent.
Needed for signal erasing so that the planted label for g(x) also covers x through g(g(x)) equals g(x).
standard math Hoeffding's inequality and the union bound are valid as applied.
Used throughout the proofs. The adaptive-strategy concentration claims deserve a conditional-on-D(n_e) check, but the feature-frequency terms do not depend on the estimated labels.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Statistical Collusion by Collectives on Learning Platforms." pith.science (2026). https://pith.science/paper/E3CXH56U

@misc{pith2026250204879,
  author       = {Pith},
  title        = {Pith review of: Statistical Collusion by Collectives on Learning Platforms},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/E3CXH56U}},
  note         = {Machine review of arXiv:2502.04879}
}

read the original abstract

As platforms increasingly rely on learning algorithms, collectives may form and seek ways to influence these platforms to align with their own interests. This can be achieved by coordinated submission of altered data. To evaluate the potential impact of such behavior, it is essential to understand the computations that collectives must perform to impact platforms in this way. In particular, collectives need to make a priori assessments of the effect of the collective before taking action, as they may face potential risks when modifying their data. Moreover they need to develop implementable coordination algorithms based on quantities that can be inferred from observed data. We develop a framework that provides a theoretical and algorithmic treatment of these issues and present experimental results in a product evaluation domain.

Figures

Figures reproduced from arXiv: 2502.04879 by the authors.

**Figure 1.** Signal planting with feature-label strategy. Comparison of the theoretical lower bound from Theorem 3.3 and the true success Sˆ(n) observed at test time for different values of n and a fixed value of N = 1, 000, 000. For all target labels, the lower bound indicates that approximately 10% of the total number of agents interacting with the platform is necessary to significantly influence it. In reality, the success ob… view at source ↗

**Figure 2.** shows how the lower bound evolves with the total number of individuals N. When the fraction n/N is held fixed, increasing N leads to a larger collective size n. This, in turn, improves the collective’s ability to estimate key quantities, as reflected by the decreasing error terms Rδ˜(n). This suggests that platforms interacting with large user bases are more exposed to collectives altering their data. While this obs… view at source ↗

**Figure 3.** Signal unplanting. (a) Comparison of lower bounds from Theorem 3.7 for different values of ne. (b) Comparison between the adaptive strategy with ne = 2, 000 and naive planting strategies targeting labels y ∗ ∈ {Good (G), Average (A), Poor (P)}. (c) Comparison of the lower bound achieved by the adaptive strategy with ne = 2, 000 and the actual success Sˆ(n) observed at test time. The lower bound suggests that the col… view at source ↗

Figures from the paper (4 more)

**Figure 4.** Figure 4: Signal planting. Comparison of signal planting lower bounds with target y ∗ = Poor using feature-label (F-L) and featureonly (F-O) strategies. Our bounds in the infinite data regime are compared to bounds from Hardt et al. (2023), when ε = 0. Our finite-sample framewo…

**Figure 5.** Figure 5: Signal planting with feature-only strategy. Comparison of the theoretical lower bound from Theorem 3.5 and the true success Sˆ(n) observed at test time for different values of n and a fixed value of N = 1, 000, 000. For the feature-only signal planting strategy, we sel…

**Figure 6.** Figure 6: Plot of the minimum value of n as a function of η for computing the erasure strategy. For example, suppose the collective consists of n = 100, 000 members. Then, if η exceeds approximately 0.03, the signal-erasing bound 5 from Theorem 3.9 holds. E.5. Interpretation of …

**Figure 7.** Figure 7: Plot of estimation terms Rδ˜(n) as a function of n for various values of m, where ˜δ = δ/(2 + 6 × 2 m). Given a target error estimation R∗, the value n at which Rδ˜(n) ≤ R∗ is approximately equal to n ≈ log(2) 2R2 ∗ m+ log(6)+log(1/δ) 2R2 ∗ . This value of n scales lin…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

24 extracted references · 21 canonical work pages

[1]

write newline

" write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION format.date year duplicate empty "emp...
[2]

Albert, K., Penney, J., Schneier, B., and Kumar, R. S. S. Politics of adversarial machine learning. arXiv preprint arXiv:2002.05648, 2020

arXiv 2002
[3]

Albert, K., Delano, M., Kulynych, B., and Kumar, R. S. S. Adversarial for good? H ow the adversarial ML community's values impede socially beneficial uses of attacks. arXiv preprint arXiv:2107.10302, 2021

work page Pith review arXiv 2021
[4]

The role of learning algorithms in collective action

Ben-Dov, O., Fawkes, J., Samadi, S., and Sanyal, A. The role of learning algorithms in collective action. In Proceedings of the International Conference on Machine Learning, 2024

work page 2024
[5]

Targeted backdoor attacks on deep learning systems using data poisoning

Chen, X., Liu, C., Li, B., Lu, K., and Song, D. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv:1712.05526, 2017

arXiv 2017
[6]

E., Grosse, K., Demontis, A., Vascon, S., Zellinger, W., Moser, B

Cin\` a , A. E., Grosse, K., Demontis, A., Vascon, S., Zellinger, W., Moser, B. A., Oprea, A., Biggio, B., Pelillo, M., and Roli, F. Wild patterns reloaded: A survey of machine learning security against training data poisoning. ACM Comput. Surv., 55 0 (13s), 2023

work page 2023
[7]

E., Grosse, K., Vascon, S., Demontis, A., Biggio, B., Roli, F., and Pelillo, M

Cin \`a , A. E., Grosse, K., Vascon, S., Demontis, A., Biggio, B., Roli, F., and Pelillo, M. Backdoor learning curves: Explaining backdoor poisoning beyond influence functions. International Journal of Machine Learning and Cybernetics, 2024

work page 2024
[8]

and Zemel, R

Creager, E. and Zemel, R. Online algorithmic recourse by collective action. ICML Workshop on Algorithmic Recourse, 2021

work page 2021

Show all 24 references

[9]

Backdoor smoothing: Demystifying backdoor attacks on deep neural networks

Grosse, K., Lee, T., Biggio, B., Park, Y., Backes, M., and Molloy, I. Backdoor smoothing: Demystifying backdoor attacks on deep neural networks. Computers & Security, 120: 0 102814, 2022

2022
[10]

Badnets: Evaluating backdooring attacks on deep neural networks

Gu, T., Liu, K., Dolan-Gavitt, B., and Garg, S. Badnets: Evaluating backdooring attacks on deep neural networks. IEEE Access, 7: 0 47230--47244, 2019

2019
[11]

An overview of backdoor attacks against deep neural networks and possible defences

Guo, W., Tondi, B., and Barni, M. An overview of backdoor attacks against deep neural networks and possible defences. IEEE Open Journal of Signal Processing, 3: 0 261--287, 2021

2021
[12]

Strategic classification

Hardt, M., Megiddo, N., Papadimitriou, C., and Wootters, M. Strategic classification. In Proceedings of the Conference on Innovations in Theoretical Computer Science, pp.\ 111–122, 2016

2016
[13]

Algorithmic collective action in machine learning

Hardt, M., Mazumdar, E., Mendler-D\" u nner, C., and Zrnic, T. Algorithmic collective action in machine learning. In Proceedings of the International Conference on Machine Learning, 2023

2023
[14]

R., Ramdas, A., McAuliffe, J., and Sekhon, J

Howard, S. R., Ramdas, A., McAuliffe, J., and Sekhon, J. Time-uniform C hernoff bounds via nonnegative supermartingales. Probability Surveys, 17: 0 257--317, 2020

2020
[15]

and Liu, W

Li, B. and Liu, W. A theoretical analysis of backdoor poisoning attacks in convolutional neural networks. In Proceedings of the International Conference on Machine Learning, 2024

2024
[16]

Manoj, N. S. and Blum, A. Excess capacity and backdoor poisoning. In Proceedings of the International Conference on Neural Information Processing Systems, 2021

2021
[17]

The logic of collective action: Public goods and the theory of groups

Olson, M. The logic of collective action: Public goods and the theory of groups. Harvard University Press, 1965

1965
[18]

A comprehensive survey on poisoning attacks and countermeasures in machine learning

Tian, Z., Cui, L., Liang, J., and Yu, S. A comprehensive survey on poisoning attacks and countermeasures in machine learning. ACM Comput. Surv., 55 0 (8), 2022

2022
[19]

help users to exert ``data leverage

Vincent, N. and Hecht, B. Can ``conscious data contribution" help users to exert ``data leverage" against technology companies? Proc. ACM Hum.-Comput. Interact., 5 0 (CSCW1), 2021

2021
[20]

`` D ata strikes”: Evaluating the effectiveness of a new form of collective action against technology companies

Vincent, N., Hecht, B., and Sen, S. `` D ata strikes”: Evaluating the effectiveness of a new form of collective action against technology companies. In The World Wide Web Conference, pp.\ 1931–1943, 2019

1931
[21]

Data leverage: A framework for empowering the public in its relationship with technology companies

Vincent, N., Li, H., Tilly, N., Chancellor, S., and Hecht, B. Data leverage: A framework for empowering the public in its relationship with technology companies. In Proceedings of the Conference on Fairness, Accountability, and Transparency, pp.\ 215–227, 2021

2021
[22]

Demystifying poisoning backdoor attacks from a statistical perspective

Wang, G., Xian, X., Srinivasa, J., Kundu, A., Bi, X., Hong, M., and Ding, J. Demystifying poisoning backdoor attacks from a statistical perspective. In International Conference on Learning Representations, 2024

2024
[23]

Understanding backdoor attacks through the adaptability hypothesis

Xian, X., Wang, G., Srinivasa, J., Kundu, A., Bi, X., Hong, M., and Ding, J. Understanding backdoor attacks through the adaptability hypothesis. In Proceedings of the International Conference on Machine Learning, pp.\ 37952--37976, 2023

2023
[24]

S., and Jordan, M

Zrnic, T., Mazumdar, E., Sastry, S. S., and Jordan, M. I. Who leads and who follows in strategic classification? In Proceedings of the International Conference on Neural Information Processing Systems, 2021

2021

Pith tools

Reviewed August 8, 2026 · model on record in the stance chip above.

[1] [1]

write newline

" write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION format.date year duplicate empty "emp...

[2] [2]

Albert, K., Penney, J., Schneier, B., and Kumar, R. S. S. Politics of adversarial machine learning. arXiv preprint arXiv:2002.05648, 2020

arXiv 2002

[3] [3]

Albert, K., Delano, M., Kulynych, B., and Kumar, R. S. S. Adversarial for good? H ow the adversarial ML community's values impede socially beneficial uses of attacks. arXiv preprint arXiv:2107.10302, 2021

work page Pith review arXiv 2021

[4] [4]

The role of learning algorithms in collective action

Ben-Dov, O., Fawkes, J., Samadi, S., and Sanyal, A. The role of learning algorithms in collective action. In Proceedings of the International Conference on Machine Learning, 2024

work page 2024

[5] [5]

Targeted backdoor attacks on deep learning systems using data poisoning

Chen, X., Liu, C., Li, B., Lu, K., and Song, D. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv:1712.05526, 2017

arXiv 2017

[6] [6]

E., Grosse, K., Demontis, A., Vascon, S., Zellinger, W., Moser, B

Cin\` a , A. E., Grosse, K., Demontis, A., Vascon, S., Zellinger, W., Moser, B. A., Oprea, A., Biggio, B., Pelillo, M., and Roli, F. Wild patterns reloaded: A survey of machine learning security against training data poisoning. ACM Comput. Surv., 55 0 (13s), 2023

work page 2023

[7] [7]

E., Grosse, K., Vascon, S., Demontis, A., Biggio, B., Roli, F., and Pelillo, M

Cin \`a , A. E., Grosse, K., Vascon, S., Demontis, A., Biggio, B., Roli, F., and Pelillo, M. Backdoor learning curves: Explaining backdoor poisoning beyond influence functions. International Journal of Machine Learning and Cybernetics, 2024

work page 2024

[8] [8]

and Zemel, R

Creager, E. and Zemel, R. Online algorithmic recourse by collective action. ICML Workshop on Algorithmic Recourse, 2021

work page 2021