Sync or Sink: Bounds on Algorithmic Collective Action with Noise and Multiple Groups

We thank the reviewer for their deep engagement with the work. The feedback has made the paper stronger and we will swiftly incorporate improvements to the typesetting, including figure size, line numbers, figure references etc. We will start by addressing some of the high level concerns, combining where appropriate, and then address specific concerns.

The concept of the label noise experiments is unclear. If the goal is to create a correlation between a signal $g$ and a target label $y^*$, then it is unclear why $y^*$ would be noisy. If the members of the collective misunderstood the the goal itself, it is unlikely they would have joined the collective in the first place. It would help if the authors justified where label noise arises, or find more justified settings, especially since the key experimental results (Fig. 3A) depend on it.

As mentioned above, the motivation for label noise is unclear. What is the rationale for introducing label noise?

[Q1, W3] We see why the rationale for the noise label experiments can be confusing. In terms of ecological justification, the stated goal of a collective can be more vague that the specific implementation - for example, a group that’s dedicated to supporting an artist, may actually have many specific songs, etc that they could choose from and there can be coordination gaps from picking the correct song, or members of the group erroneously thinking that doing the same changes for all songs would be beneficial, which may or may not be the case. Being aligned at a high level ‘goal’ may not directly translate to being coordinated on the specific action.

Another justification would be more malicious actors, who want to thwart the collective, by joining the group to learn the 'signal’ and apply that to other labels. As the reviewer also alludes to, it can also be used to help make the connection between the noise views of the system vs the multiple collectives, where that distinction is a bit more concrete. The noise on the label also is a term that comes out of the bounds we proved which is different from prior bounds, so we believe including them is justified.

While the generalized success bound is important to formalize, its derivation is very similar to the single collective analysis and does not yield surprising insight or fundamental understanding.

[W1] We agree that the derivation is very similar to the single collective analysis, the key contribution is formalizing this notion of overlap between, not just the baseline distribution and the single collective’s distribution, but across multiple distributional sources. We believe formalizing this is merited.

The experimental settings are limited. The paper reuses the same setup from prior work without exploring new scenarios that may be more fitting for a multi-collective setting. For example, the instruction "Place character 'A' every 20 words" is simple and unlikely to be misunderstood. More ambiguous or realistic problems would be more appropriate to test the theory.

[W2] In terms of choice of experiment, we choose to limit them to more well documented cases to have a more direct comparison to both [HMMDZ23, KVKS25], which provide bounds [HMMDZ23] or examined multiple collectives, which can be explored in the bounds we provide. While more complex systems can introduce more ambiguity, even “simple" instructions, when scaled to the level of online communities, can have coordination challenges.. [XZF+25] discusses some of the challenges that organizers face and inherent issues in collective coordination.

In the experiment with the random characters subset, why were these specific characters chosen? Is the choice of characters meaningful, or only the size of the subset? Did you investigate how varying the subset size affects the success?

[Q2] The specific initial characters came from prior work [KVKS25], and then we expanded to a small subset by considering other characters that did not appear in the dataset (which was also a criteria shown in prior work). [HMMDZ23] in their paper mention mostly that the individual characters were relatively unimportant so we mostly looked at randomized within a small subset vs large (aka size). To show a more smooth change, we will add experiments that vary the size of the set more gradually.

What exactly is randomized in each experiment run? Are the collectives randomized per run? The standard deviations in the figures are quite large. Is there an intuitive explanation for this variability? What are the causes for the variability?

[Q3, Q4] For randomization, the collective members are randomized each round, this can lead to some of the higher variability/standard deviations found in the figures.

In section 7.1, you mention an example where two collectives with different and that still hinder each other's success. This is counterintuitive. What is the context and how do the collectives interfere each other? You explain that it is because of character modifications that look sufficiently “close”. What does "close" mean in this context and how does it lead to interference?

[Q5] In 7.1 we refer to [KVKS25] Figure 3d. When looking at the specific characters chosen in that setup with the specific tokenizer (DistilBERT), the embedding of a resume with character 1 modification and character 2 modification end up being nearly identical. which can lead to interference. We will add those specific details in the paper.

This paper models the population and noise sources as distributions. I'm not sure if that's the best modeling choice. Would a finite-sample approach, such as in [1] be more suitable to discuss miscommunication?

[Q6] Other modeling choices, such as finite sampling methods could be an interesting view. [1], however, primarily focuses on how a collective estimates its effectiveness over timestamps.. There, the sequential aspect is key. This is a slightly different, yet complementary, setup than the one we’re considering. Our focus on distributions was to help characterize a ‘final state’ outcome across multiple distinct distributions. We can add some of the more specific possible modeling choices within the paper to highlight some of the similarities and differences between them.

We thank the reviewer for their comments. We have swiftly addressed all the drafting errors. We will add the reviewers' concerns below and address them inline.

I found the formal model and the presentation quite confusing. While I get the intuition that the authors are trying to capture, it is not clear to me why it is captured by the formal model.First, the strategy being a mapping Z\to Z is a non-obvious choice.

With regards to the clarity of the formalization, we took the initial setup from [HMMDZ23], and aimed to be faithful to the prior work. However, we recognize this setup can be confusing and we will sketch out how we plan to clarify the differences and improve the initial setup, which we will add to the main body of the paper.

We have $\mathcal{X}$ as the input features, $\mathcal{Y}$ as the label, and $\mathcal{Z} = (\mathcal{X}, \mathcal{Y})$ - i.e just the feature, label tuple. A strategy, in short, maps the a tuple $z=(x, y) \in \mathcal{Z}$ where $x \in \mathcal{X}$, and $y \in \mathcal{Y})$ to a new tuple $z’ = (x’, y’) \in \mathcal{Z}$

The most noticeable part of the strategy is how feature $x \in \mathcal{X}$ will change, and hence we call this out as the “signal” operationalized by function $g$. In the feature-label strategy, therefore, the members of the collective implement strategy $h_1(x, y) = (g_1(x), y^*)$ by using signal function $g_1$ has the function that modifies the feature input $x$. For the feature-only strategy the members of the collectives would only implement strategy $h_2(x, y) = (g_2(x), y)$ where $g_2$ is the signal function modifying input feature $x$.

Ultimately this is meant to capture the difference between feature-label strategies and feature-only strategy and more broadly, formalize a strategy as a combination of signal planting + potential feature changing.

More importantly, I do not understand the point of a signal and how it is different from a strategy. Given the motivating example, I expected the manipulator's goal to get the classifier to output a specific label on a certain subset of inputs, but this seems different? The definition of success is then in terms of the signal, not in terms of the strategy. What is the role of strategy then?

In addition to what’s discussed above, (namely a strategy may operate on the feature + label while the signal refers to the operations on just the feature), the distinction between the strategy and the signal can also be helpful to separate out the difference between training and inference. A collective implements an entire strategy at training time (which may or may not involve control and changing of labels), so that at inference time, anyone with the same ``signal” will get a specific outcome from the ML model. We will clarify this in the paper.

The paper provides some lower bounds on success rates; these are complicated expressions, so I am not sure how useful they are. Also, the paper does not say if they are tight. Also, the paper does not explicitly analyze the difference between these bounds and the bounds for the coordinated case from prior work.

We discuss the high level takeaways from these bounds in terms of what terms/relationships are important, deferring the details of the proof to the appendix so as to not detract from the main conceptual takeaways. We discuss the differences between prior work and our work, in lines 151-154. We can also expand upon the Figure 1 with an explicit $r = 0$, which would be the perfectly coordinated case.

In particular, it [the author's formalization] presumes that the strategy is anonymous, i.e., all manipulators act in the same way given the same inputs. This is not without loss of generality, but probably appropriate for the settings studied in this work. Still, worth a comment.

We acknowledge that there is an assumption that the collective attempts to act in the same way given the same input; this is similar to approaches taken in prior work. However, we do note our work, which,while primarily framed in terms of noise, can also be applied to when members of a collective are not implementing the same exact strategy, ie, we could consider one large collective as being any number of collectives implementing their individual strategies towards the same goal, including differing distributions. While this is not quite the full analysis, this work helps to bridge that gap.

Some other clarifications are below:

Display formula below 138: what is \mathcal X^?*

That should be just $\mathcal{X_i}$. Apologies!

The explanation of what r is is confusing

We can simplify $r$ is just $\frac{\alpha_1}{\alpha}$ in most contexts here. For example,, if a collective size \alpha = 0.01\ and $20$% of the group is experiencing noise, then $\alpha_1 = 0.2$, $\alpha_2 = 0.8$ and $r = 0.2$ or $20$%

How do you implement "arbitrary location"?

We sample a number of times to insert a character from a uniform distribution U(0, K), and after choosing a number of insertions. After picking the number of times we need to insert a character, we look at all possible locations to place a new character (aka look at the number of spaces between words available in a given piece of text) and sample without replacement from there. Importantly, this type of manipulation is meant to be very generic (i.e., this type of insertion could be applied to many kinds of classification inputs).

Why are the ranges so different for the two experiments?

In [HMMDZ23] the effectiveness range of a feature-label strategy vs feature-only strategy is quite substantial - this is because controlling both the feature and a label gives a lot more control for the collective, and hence, easier for a small group to manipulate. We can add that the choice of the range was drawn from these results in [HMMDZ23] and reflect the inherent differences between the two of them.

We thank the reviewer for their engagement with the paper. We will restate the reviewers' concerns (grouped where appropriate) and respond inline.

The review's primary concern is the paper's positioning. The reviewer is not entirely certain that the work, as presented, falls within the scope of the machine learning field. The link could be made much stronger.

Could the authors please provide some concrete examples of "algorithmic collective action" within the context of machine learning?

Algorithmic Collective Action is an emerging field within machine learning, where the goal is to understand the susceptibility of machine learning models to this type of coordinated behavior. It has important connections to work on strategic classification and data poisoning. Indeed much of the prior work looks at how a small set of strategically behaving points can undermine classification accuracy or lift in recommender system context. Understanding how, when, and why these data distributions occur is an essential for trustworthy machine learning.

Algorithmic Collective Action has appeared in machine learning venues, including in ICML [HMMDZ23, BDFSS24] and NeurIPS [BMD24]. The presence of an Algorithmic Collective Action workshop at this year’s NeurIPS also speaks to its place within the Machine Learning community. Our work is a direct follow up to these important lines of machine learning work and has carved out an important and growing subfield.

Collective action has been growing and its impacts will only grow with time. [SHMD24] has documented many cases that have both been studied by academics as well as noted in media. It has been documented in the case of AI art, writing among others. Ignoring why and how these changes affect ML systems would be a disservice to the community. These types of strategic behaviors are only expected to grow, and more broadly, recognizing that data itself is, across many domains, generated by strategic actors is important to consider in how it can affect downstream systems.

Could the authors elaborate further on the implications of your main results for machine learning?

As mentioned in our introduction/prior works section, previous research has shown that a small, perfectly coordinated group, both via experiments and proven bounds, can effectively influence these ML systems [HMMDZ23]. Other work has shown empirically, however, that when two or more collectives are acting in a system, there can be conflicting outcomes [KVKS25]. We sought to address a gap to understand how sensitive is collective action to multiple distributional sources: this can either come from a lack of perfect coordination or it can come from a 2nd independent group acting on a system. We provide new bounds in the case of multiple distributions and we conduct experiments to show how noise can degrade the efficacy of collective action; prior work has only focused on the perfectly coordinated case. As mentioned previously, understanding how competing groups affect the underlying data distributions of ML models is poised to become a much larger technical and practical challenge.

What does "Sync or Sink" in the title refer to? Could the authors clarify its meaning?

“Sync or Sink” refers to how perilous this type of collective action may be. Traditional collective action generally requires a high degree of coordination (i.e for everyone to be in “sync” with each other), otherwise the whole project can easily fail (or “sink”). We appreciate the feedback that this was not obvious and will certainly seek to clarify this!

We thank the reviewer for their feedback and excitement in this area of multiple distributions and multiple collectives. We will first address the weaknesses and then address the specific questions.

[W1] If the distribution caused by group behavior or noise is difficult to clearly divide in practice, it may make the distribution difficult to separate

We agree that in practice, depending on the source of the multiple distributions, it can be difficult to clearly separate out. In the case of noise related distributional differences in particular, this can be difficult to separate out in practice. Our goal with this bound is to concertize the specific factors driving decreased efficacy across multiple distributions more broadly (i.e due to either noise or multiple collectives). Multiple distributions coming from multiple distinct groups with their own objectives would be easier to divide than noise related ones. We will clarify within the paper that our bound handles both the situation of noise or multiple collectives, and in practice it may be difficult to separate out the noisy distribution from the non-noisy distribution.

[W2] In addition, it mainly focuses on text classification tasks, the data scale and type are relatively simple, and the experiment is only conducted on a multi-label classification set.

Our focus on this setting is to directly make an apples to apples comparison with [HMMDZ23, KVKS25]. Because both of these works look at this classification setting, one with the single collective bound in mind [HMMDZ23] and one with the multiple collectives setting [KVKS25], our aim was to offer the most compelling comparison to prior work. As in prior work, we expect results on this task to provide some degree of generalized insights (i.e., findings should generally hold across many domains), though agree that future experimental work should seek to explore additional distributions and tasks.

[W3] In addition, only benign noise is considered If it is completely interfering noise, it may have an impact on the model.

Our experiments were primarily inspired by potential ways that collective action might degrade due to coordination challenges. However, our bounds describe the relationship between any two distributions and hence, hence they do allow for analysis in that scenario. Direct interference of a collective’s work is an important problem, but here the focus is on how even a well intentioned group can fail even when everyone is aligned on the same goal.

[W4] Finally, the differences in the sensitivity of different learning algorithms to noise are not considered.

We primarily focus on expanding the general case [HMMDZ23], though specialization to specific learning algorithms is important in practice. Future work can expand upon these bounds to different learning algorithms.

For the questions:

[Q1] Have the authors considered using more detailed explanations or vivid demonstrations of the problem being solved in the main part of the paper?

We noted several instances of this type of collective action being done in the real world within the introduction. We cut some of the details for space, but we can further expand on some of the academic case studies [SHMD24] as well as media reported instances. for example in art and writing in the introduction.

[Q2] In the experiment, the target categories only involved high and low frequencies, and did not cover the characteristics of medium frequencies or more detailed categories. Does this paper need this consideration?

We focused on high/low frequencies just to show the potential range of behaviors, more medium frequencies would lie somewhere in between. We can add those figures in for completeness.