| paper | d4-conf-ijcai-2023-0394 |
| authors | — |
| venue | ? |
| filed under | unclassified |
| judged by | gpt-6-luna / xhigh (triple__luna__xhigh__c6r1) |
| judge confidence | high |
| authors would recognise it | unclear |
The paper proposes an attack algorithm and evaluates it experimentally, but it has no numbered theorem, lemma, corollary, or proposition asserting a computational result that can serve as an anchor. The cohort-based mass-attack model is a statable research idea, but it is unanchored and therefore cannot meet the required test for a green mirror.
fails bit a — no named computational result to mirror
No named computational result is mirrored. The proposed mass-attack model would adapt the attack objective and instance-selection and labeling choices; it leaves the aggregation-equivalence theorems and the finite-dataset experiments without a continuous result.
The paper has no qualifying named computational anchor. Theorem 1 and Corollary 1, and Theorems 2 and 3, establish that the unified aggregation representation recovers Dawid–Skene, ZenCrowd, majority voting, and weighted majority voting. They do not establish a complexity result or formulate the attack optimization. Section 3’s bilevel objective is numbered as an equation, and the introduction says the problem is “generally considered as NP-hard,” but the paper gives no numbered theorem or reduction for that claim. Algorithm 1 and the experiments do not supply a complexity or optimality guarantee. So I cannot honestly attach a prover-ready continuous question to a qualifying anchor or assign one of the paper’s results to a class in the trichotomy.
There is a plausible unanchored mirror: strategic poisoning by a large workforce on a repetitive crowdsourcing platform. Let a worker type specify the attributes relevant to this problem, such as its labeling reliability, task eligibility, price, and budget; let \(\mu_\theta\) be the fraction of workers of type \(\theta\). In a regime with many workers but few platform-defined types, let \(x_{\theta i\ell}\) be the mass of malicious type-\(\theta\) workers assigned to label task \(i\) with label \(\ell\). Subject to type capacities and a per-capita attack budget, the attacker minimizes the paper’s loss: increase disagreement between pre- and post-attack aggregated labels while keeping attack labels close to the pre-attack estimates. The aggregator acts on the normal and malicious label masses, and a solution is a feasible mass assignment minimizing that loss. This continuizes the worker population while preserving the paper’s choices of task and label.
The weak point is substantial: the paper’s experiments use only 76–176 normal workers and at most 1–5 malicious workers, so the high-multiplicity regime comes from a plausible alternative setting, not its evaluation. Also, the type-level model must preserve the worker information used by aggregation, and the bilevel optimization remains nonconvex. This is a credible mirror candidate, but it is not anchored by a named computational result in this paper.
The strongest case against a paper-derived mirror is that there is no named computational result to mirror. Theorem 1, Corollary 1, and Theorems 2–3 show that the unified representation recovers existing aggregation models. Equation 8 defines an attack objective; the paper’s unsupported statement that the problem is “generally considered as NP-hard” supplies no reduction or theorem. Algorithm 1 and the experiments provide no complexity or optimality guarantee. On the programme’s stated criteria, the paper fails the anchor screen.
The strongest version of the proposed mirror would model a large annotation platform with a few recurring task classes and worker types defined by reliability, task eligibility, cost, and budget. Let both ordinary and malicious workforces scale, and optimize type-level mass assigned to each task and label. That is a plausible continuous question, but it is not an exact continuization of the paper’s attack model. The paper uses each worker’s task assignments and realized labels, and aggregation models such as Dawid–Skene estimate worker reliability from those observations. An exact type would therefore need to preserve workers’ relevant assignment and label histories, which could make the support grow with the workforce. Grouping workers only by latent reliability instead replaces those histories with a stochastic model; expected label masses need not preserve the per-instance aggregation decisions or the paper’s disguise objective. Keeping the paper’s small, fixed attacker coalition also makes its mass vanish as the ordinary workforce grows.
That leaves a useful distinction: the paper does not provide an established computational result with a continuous mirror, while a scaled, cohort-based poisoning model could still be a worthwhile new research question. I cannot honestly defend the universal claim that no scenario could produce a worthwhile mirror. The negative case is strong as a reason to reject this paper as an anchored continuization candidate, and weak as a claim that every plausible continuous reformulation is unworthy.
The adversarial triple: the proponent anchors on up to three named results; the opponent sees that case and must defeat every anchor; the judge decides which case convinced it. These are the pipeline’s own outputs, generated by tools/triple_run.py — no human edited them. The paper’s own text is not reproduced here beyond the quoted statement above.