When In Doubt, Abstain: The Impact of Abstention on Strategic Classification

AI summary

Overview

Research area: Strategic classification and game theory in machine learning, with a focus on cybersecurity-adjacent decision systems.

Technical level: Advanced. The paper relies on Stackelberg game formulations, measure-theoretic notation, piecewise analytical solutions, and equilibrium analysis. It is written for readers comfortable with the strategic classification literature.

Scope: The paper studies what happens when a classifier is allowed to abstain from deciding, in a setting where agents can strategically manipulate their observable features, using a one-dimensional threshold-classifier case study plus simulations.

What This Paper Is About

Machine learning classifiers are often used to make decisions (approve a loan, flag malware, filter spam), but the people or programs being judged can sometimes change how they appear in order to get a favorable outcome. Separately, classifiers can "abstain" — decline to decide when they are not confident — which is known to improve accuracy in non-strategic settings. This paper is the first to ask what happens when you combine the two: how do strategic agents respond when a classifier can abstain, and how should the principal (the decision maker) choose when to abstain in anticipation of that response.

Key Contributions

1. First study of abstention inside strategic classification. The authors formulate the interaction as a Stackelberg game where the principal first commits to both a classifier f and an abstention function r, and agents then manipulate their observable features to maximize utility. They state this is the first study to consider abstention in a strategic classification context.

2. A guarantee that abstention never hurts. Theorem 3.1 proves that for any fixed classifier, any data distribution, and any abstention cost c, the minimum expected loss with an optimal abstention function is less than or equal to the expected loss with no abstention — and this holds even with strategic agents present.

3. A structural characterization of the optimal abstention function. Theorem 3.2 shows that an equally optimal constrained abstention function always exists that coincides with the non-strategic optimal rule r* on all points where f(x̂) = 0. Theorem 3.3 shows that, if the classifier is "informative," the optimal constrained abstention function does not abstain less than r* (r̄* ≯ r*), meaning principals facing manipulation should abstain more, not less.

4. A fully solved one-dimensional case study with an abstention-deterrence effect. For a linear classifier on X = [-2, 2] with x ~ Unif[-2, 2] and y = sign(x), the authors derive closed-form expressions for the agent's best response, the principal's optimal abstention threshold T̄*, the minimum loss, and the expected manipulation by unqualified agents — and show abstention can act as a deterrent to manipulation.

Main Findings

• Abstention is never harmful (Theorem 3.1). Choosing r(x̂) = 1 everywhere (never abstain) reproduces the no-abstention loss exactly, and the optimal abstention rule minimizes over all valid rules, so L(f, r̄*) ≤ L_no_abstention(f) for any f, any D, and any c.

• Only positively classified points distinguish the strategic and non-strategic solutions (Theorem 3.2). On points where f(x̂) = 0, the constrained optimum can always be taken to equal the standard unconstrained rule r*, which abstains when the classifier's conditional loss L_f(x) = E_y[l(f(x), y) | x] exceeds c.

• Principals facing strategic agents abstain more (Theorem 3.3). Given an informative classifier (where p(y=1|x) ≥ p(y=1|z) if and only if f(x) ≥ f(z)), the optimal constrained abstention function does not abstain less than the unconstrained one.

• An optimal threshold can be non-unique. When the abstention cost c = 0.5 and 0 < K ≤ 4, the optimal threshold T̄* is the entire interval [K/2, min(K,2)], and the loss is independent of T within that range.

• Abstention beats no abstention numerically in the case study. Proposition 3 gives L_no_abstention = K/4 for K ≤ 2 and 1/2 for K > 2, while Proposition 2 gives the abstention-enabled loss — never greater, matching Theorem 3.1.

• Abstention often reduces manipulation by unqualified agents, but not always. For high γ (low K, 0 < K ≤ 2), abstention consistently lowers expected manipulation by unqualified agents regardless of c. For intermediate γ (2 < K ≤ 4), it can either reduce or increase manipulation. For very low γ (K > 4), abstention can produce equal or increased manipulation depending on the chosen threshold. In other words, the proportion of manipulative agents may fall while the average amount of manipulation rises.

• The optimal threshold rises to guard against gaming. Simulations confirm T̄* is consistently higher than the unconstrained T*, matching Theorem 3.3. As γ increases, T̄* decreases and converges toward T* as manipulation becomes prohibitively costly.

• Abstention reduces strategic harm for a middle band of parameters. Harm reduction ΔH is near zero when γ is very small (manipulation is effectively free), becomes strongly negative as γ increases, and converges back toward zero when manipulation becomes prohibitive. ΔH increases with abstention cost c and with noise σ.

Methodology in Plain English

The paper builds a two-stage game. First, the principal commits to two things: a classifier that produces a predicted label, and an abstention rule that decides whether to accept that prediction or decline to decide. Then agents respond by choosing a modified version of their observable features — they cannot change their true features or true label — balancing the reward of a positive accepted decision against the cost of manipulating.

The agent's manipulation cost is modeled as a squared distance between the true and manipulated feature, scaled by a factor γ; the principal pays a penalty c whenever it abstains. The principal's goal is to minimize expected loss given that agents always best-respond.

After proving general theorems, the authors narrow to a tractable one-dimensional setting: features on [-2, 2] drawn uniformly, label equal to the sign of the feature, and a linear scoring function. They restrict attention to threshold abstention, where the principal abstains when the absolute score is below a threshold T, and solve for the optimal T.

They then run simulations: for each threshold T from 0.01 to 2.0 in steps of 0.01, they draw 100,000 features from Unif[-2, 2], assign labels via y = 1_{x + ε > 0} with ε ~ N(0, σ), apply the agent best response, and average the pointwise loss. Default parameters are γ = 0.4444, c = 0.3, and σ = 0.5. They also define a "harm" metric comparing strategic versus non-strategic loss, and measure how much optimal abstention reduces that harm.

Why This Matters

Impact on research. The paper opens a new axis in strategic classification. Prior work focused on incentive design or randomized policies; this work shows abstention is an additional lever with a formal guarantee (loss never increases) and a structural characterization, plus the non-obvious finding that abstention can deter manipulation rather than merely improve accuracy.

Real-world applications named in the paper:

• Malware detection and intrusion detection systems — adversaries obfuscate or modify code signatures to evade classifiers; abstaining routes uncertain cases to manual investigation.
• Spam filtering — spammers continually rewrite email content to evade mailbox filters.
• Exam cheating — a person cheats on an exam they need to pass rather than genuinely improving.
• Hiring and resume screening — a job seeker lies on a resume to pass algorithmic filtering.

Industry relevance. Any deployed decision system where the judged party can adjust its appearance at a cost — fraud detection, content moderation, credit and lending, security operations — faces the trade-off this paper formalizes. The result that abstention makes manipulation costlier for less qualified agents, when manipulation costs are sufficiently but not prohibitively high, gives practitioners a principled argument for adding an abstain-and-escalate option rather than being forced into a binary accept/reject decision.

Future Directions

• Extension beyond one dimension. The authors explicitly leave multi-dimensional settings, such as linear classifiers with Gaussian feature distributions, for future work.
• Agents who can change their true features. The model forbids honest effort to improve a true feature or true label — an assumption studied elsewhere in the literature but not here.
• Choosing the classifier jointly with the abstention rule. This paper derives the optimal abstention function only for a fixed, potentially suboptimal classifier f; optimizing both together remains open.
• Characterizing when abstention genuinely deters manipulation. The comparison of expected manipulation shows abstention can increase the average amount of manipulation in intermediate and low γ regimes, so identifying the parameter regions where deterrence actually holds — and how to set the threshold when it does not — is an open design question.

Target Audience

Researchers in strategic classification, algorithmic fairness, and mechanism design; graduate students and practitioners with a game-theory background working on adversarial machine learning; and security or risk engineers who deploy classifiers in adversarial environments and are weighing whether to add a reject-and-escalate option to their decision pipeline.

Authors’ abstract

Algorithmic decision making is increasingly prevalent, but often vulnerable to strategic manipulation by agents seeking a favorable outcome. Prior research has shown that classifier abstention (allowing a classifier to decline making a decision due to insufficient confidence) can significantly increase classifier accuracy. This paper studies abstention within a strategic classification context, exploring how its introduction impacts strategic agents' responses and how principals should optimally leverage it. We model this interaction as a Stackelberg game where a principal, acting as the classifier, first announces its decision policy, and then strategic agents, acting as followers, manipulate their features to receive a desired outcome. Here, we focus on binary classifiers where agents manipulate observable features rather than their true features, and show that optimal abstention ensures that the principal's utility (or loss) is no worse than in a non-abstention setting, even in the presence of strategic agents. We also show that beyond improving accuracy, abstention can also serve as a deterrent to manipulation, making it costlier for agents, especially those less qualified, to manipulate to achieve a positive outcome when manipulation costs are significant enough to affect agent behavior. These results highlight abstention as a valuable tool for reducing the negative effects of strategic behavior in algorithmic decision making systems.