Algorithmic Collective Action: Strategies & Impact

• Algorithmic Collective Action is a coordinated effort by groups to modify training data and influence algorithmic outcomes in systems like classifiers and recommender systems.
• It applies across diverse domains including gig platforms, fairness interventions, and political coordination, often achieving significant effects with minimal individual inputs.
• Success in ACA hinges on collective size, coordination precision, signal uniqueness, and adaptive learning dynamics, balancing risks with measurable performance gains.

Algorithmic Collective Action (ACA) denotes coordinated efforts through which groups attempt to influence algorithmic systems rather than accepting those systems as fixed background conditions. In the machine-learning literature, the canonical mechanism is collective modification of training data so that a learned model acquires, erases, or weakens an association preferred by the group; related work broadens the term to include online recourse, recommender manipulation through authentic user-controlled inputs, worker and fan coordination around platform metrics, bottom-up interventions by AI workers, and AI-assisted political coordination through verified human accounts (Hardt et al., 2023, Reis, 21 Nov 2025, Kunst et al., 13 Feb 2026). A recurring premise is that many contemporary systems are too data-intensive for one person acting alone to matter, so the relevant unit of agency becomes the collective rather than the individual (Karan et al., 30 Apr 2025).

1. Definitions, boundaries, and conceptual scope

A narrow but influential definition treats ACA as the coordinated effort of platform participants to influence outcomes by strategically reporting or modifying the part of the training data they control (Hardt et al., 2023). On this view, the collective pools the data of participating individuals and executes an algorithmic strategy by instructing participants how to modify their own data to achieve a collective goal. The central object is not a protest external to the system, but a distributional intervention internal to the system’s learning process.

Subsequent work generalizes the term in two directions. First, it expands the target: ACA can be directed at classifiers, recommender systems, rankings, or online-updated models, and it can aim at promotion, demotion, fairness improvement, recourse, or invariance (Baumann et al., 2024, Creager et al., 2023, Ben-Dov et al., 21 Aug 2025). Second, it expands the social locus of action: the relevant actors can be fans, gig workers, minority subgroups, AI workers inside firms, or verified citizens participating in AI-assisted political campaigns (Xiao et al., 2024, Sigg et al., 2024, Reis, 21 Nov 2025, Kunst et al., 13 Feb 2026).

Several papers emphasize what ACA is not. It is not merely individual strategic behavior, because “the large amount of data these systems use means that individuals cannot impact system behavior by acting alone” (Karan et al., 30 Apr 2025). It is not reducible to ordinary algorithmic recourse against a fixed classifier, because online settings permit groups to steer future parameter updates rather than only their own present-time inputs (Creager et al., 2023). It is also not synonymous with bot activity: in the political-communication literature, “cyborg propaganda” is defined as “the synchronized and semi-automated dissemination of algorithmically generated articulations of narratives via a large number of verified human accounts,” summarized by the phrase “identity is authentic; articulation is synthetic” (Kunst et al., 13 Feb 2026).

This breadth has produced a family resemblance rather than a single exhaustive definition. What remains stable is the idea of coordinated intervention in algorithmically mediated environments, usually by exploiting control over data, interfaces, or organizational routines that a platform or institution treats as ordinary input.

2. Foundational formalization in machine learning

The foundational theoretical model represents the platform’s training distribution as a mixture of a base distribution and a collective-induced distribution:

$$\mathcal D = \alpha \mathcal D^* + (1-\alpha)\mathcal D_0,$$

where $\alpha$ is the collective’s fractional size, $\mathcal D_0$ is the base distribution, and $\mathcal D^*$ is induced by a collective strategy $h:\mathcal Z\to\mathcal Z$ (Hardt et al., 2023). The canonical success criterion for signal planting is

$S(\alpha)=\Pr_{x\sim \mathcal D_0}\{f(g(x))=y^*\},$

with $g(x)$ the planted transformation and $y^*$ the target label (Hardt et al., 2023).

Within this framework, the original theory studies three settings: nonparametric optimal learning, parametric risk minimization, and gradient-based optimization (Hardt et al., 2023). In the nonparametric setting, a feature-label planting strategy

$h(x,y)=(g(x),y^*)$

yields a lower bound

$$S(\alpha)\ge 1-\frac{1-\alpha}{\alpha}\cdot \Delta\cdot \xi-\frac{\epsilon}{1-\epsilon},$$

where $\alpha$0 is signal uniqueness, $\alpha$1 is the suboptimality gap, and $\alpha$2 is classifier sub-optimality (Hardt et al., 2023). The corresponding notion of critical mass is the smallest $\alpha$3 for which a target success level is achievable. The same paper also analyzes feature-only planting, erasing a signal, convex steering of parametric risk minimizers, and gradient-control strategies that geometrically drive gradient descent toward a target parameter, including in nonconvex settings (Hardt et al., 2023).

Empirical validation in that work uses a skill-classification task on nearly 30,000 freelancer resumes and more than 2,000 model training runs of a DistilBERT-like model. The reported result is that near-perfect control is achieved at below 0.5% of the dataset—fewer than 125 manipulated resumes—under feature-plus-label manipulation, whereas feature-only manipulation is weaker but still reliable at around 10% of the instances of the target class (Hardt et al., 2023).

Later work adds a finite-sample statistical layer. “Statistical Collusion by Collectives on Learning Platforms” formalizes a priori risk assessment, implementable coordination algorithms, and computable lower bounds based on quantities inferred from the collective’s own pooled data and Hoeffding concentration terms such as

$\alpha$4

(Gauthier et al., 7 Feb 2025). That framework treats signal planting, signal unplanting, and signal erasing as distinct computational tasks and emphasizes that collectives may need ex ante guarantees because altering submitted data can expose participants to risk (Gauthier et al., 7 Feb 2025).

3. Learning dynamics, online recourse, and deployment-time intervention

A major extension of the original static picture is Online Algorithmic Recourse (OAR), where the model is updated online and the relevant action is not limited to the query subject’s own features (Creager et al., 2023). The formal object is a bilevel problem:

$\alpha$5

subject to

$\alpha$6

with per-subject perturbation constraints $\alpha$7 (Creager et al., 2023). The key distinction is that the training-set people are not the same as the decision subject, so a group of data subjects can coordinate perturbations to influence the retrained model in favor of a separate query subject. In experiments with a nearest-centroid classifier on UCI Iris and MNIST embedded in a learned 10-dimensional VAE latent space, collective recourse consistently outperforms individual recourse across all tested $\alpha$8 budgets (Creager et al., 2023).

Another line of work shows that the success of ACA is highly dependent on the learning algorithm itself. Under distributionally robust optimization, the relevant quantity becomes effective collective size $\alpha$9, reflecting algorithmic reweighting of the collective’s examples (Ben-Dov et al., 2024). The paper reports that JTT and LfF amplify small collectives relative to ERM, while iterative DRO methods such as CVaR-DRO are highly sensitive to validation-set composition. Under SGD, simplicity bias creates strategic opportunities: collectives can benefit by planting signals in features that the learner tends to ignore, or alternatively in simpler features when optimization remains suboptimal (Ben-Dov et al., 2024).

Privacy-preserving learning changes this picture again. Under DPSGD, per-example gradient clipping and Gaussian noise blunt collective steering; empirically, stronger privacy implies that a larger $\mathcal D_0$0 is required to reach the same influence level, so the critical mass for successful ACA rises as privacy becomes stronger (Solanki et al., 9 May 2025). At the same time, that work reports that ACA does not worsen DP’s protection against membership inference and can, in some settings, move LiRA performance closer to random chance (Solanki et al., 9 May 2025).

ACA has also been moved out of the training loop entirely. Test-Time Collective Action (TTCA) gives a collective with black-box API access a way to extract a proxy model, optimize per-class universal perturbations on the proxy, and apply them locally at submission time, without requiring retraining by the platform (Bhange et al., 26 May 2026). On CIFAR-10, CIFAR-100, and FairFace, the method improves worst-group accuracy, equal-opportunity gap, and disparate impact; modestly sized collectives are reported to close most of the subgroup accuracy gap, and pooled queries are cheaper than each subgroup member attacking alone (Bhange et al., 26 May 2026).

A related dynamic perspective comes from evolutionary game theory. “Collective dynamics of strategic classification” models users and institutions as co-evolving populations under replicator dynamics, arguing that one-shot Stackelberg views are insufficient once user adaptation and institutional retraining feed back on one another (Couto et al., 12 Aug 2025). In that model, better gaming detection can move the system to $\mathcal D_0$1, while algorithmic recourse may induce cycling dynamics; faster institutional retraining can enlarge the basin of attraction of an undesirable moderate-but-vulnerable equilibrium (Couto et al., 12 Aug 2025).

4. Multiple collectives, interference, and coordination noise

Early ACA work largely assumed one collective acting against a system. More recent work studies settings in which two or more collectives act simultaneously, often with distinct objectives, strategies, or memberships (Karan et al., 30 Apr 2025, Battiloro et al., 26 Aug 2025). The empirical two-collective framework is organized around the number of collectives and objectives, collective construction and properties, action availability, access to the model, affected party, and measurements (Karan et al., 30 Apr 2025). In language-model classifiers and recommender systems, the central finding is that collective-to-collective interactions can be severe: a collective that succeeds in isolation may lose as much as 75% of its efficacy when a second collective acts simultaneously (Karan et al., 30 Apr 2025).

The first theoretical framework for ACA with multiple collectives in classification introduces per-collective mass $\mathcal D_0$2, alignment mass

$\mathcal D_0$3

signal uniqueness, and cross-collective overlap terms (Battiloro et al., 26 Aug 2025). Its main message is that success is governed not only by a collective’s own size, but by the interaction of collective mass, signal uniqueness, and target alignment. In that model, aligned collectives help one another through $\mathcal D_0$4, whereas misaligned collectives impose a competition penalty through overlap in planted features and conflicting target labels (Battiloro et al., 26 Aug 2025).

A further step is the finite-sample statistical multi-collective framework, which makes lower bounds computable with only partial knowledge of other collectives’ sizes and strategies (Battiloro et al., 7 May 2026). This work treats multi-collective ACA as a problem of inter-collective interference, goal alignment, and strategy overlap, and illustrates the framework with smart-city climate adaptation simulations (Battiloro et al., 7 May 2026).

Internal coordination is itself a limiting resource. “Sync or Sink” shows that multiple collectives and miscoordination within a collective can both be represented as mixtures of multiple data-generating distributions (Karan et al., 21 Oct 2025). In the resume-classification experiments of that paper, sufficiently high levels of noise can reduce the success of collective action, with one feature-label setting dropping from 100% to just under 60%. The reported trade-off is explicit: a collective that is twice as big but has four times more noise can fare worse than a smaller, more coordinated group (Karan et al., 21 Oct 2025).

These results jointly shift ACA away from a simple “power in numbers” narrative. Size remains important, but efficacy depends on alignment, overlap, homogeneity, tokenizer or representation collisions, and the practical ability to synchronize behavior across participants (Karan et al., 30 Apr 2025, Karan et al., 21 Oct 2025).

5. Domains, applications, and organizational forms

The empirical literature now spans a wide range of algorithmically mediated environments.

Domain	Mechanism	Reported result
Recommender systems	Playlist reordering via InClust and DirLoF	Less than 0.01% of training data can yield up to 40× more test time recommendations (Baumann et al., 2024)
Fan communities	Core fans build collective understanding, tutorials, and rhetoric	Large-scale actions involving millions of fans across platforms (Xiao et al., 2024)
Gig platforms	Threshold-based order declines in #DeclineNow	Average worker gain is always positive (Sigg et al., 2024)
Fairness intervention	Minority subgroup relabels its own data	Unfairness can be substantially reduced with small error increase (Ben-Dov et al., 21 Aug 2025)
AI workplaces	Participatory Design-informed worker intervention	ACA is both a mobilization process and a design problem (Reis, 21 Nov 2025)
Political communication	AI-assisted coordination of verified human accounts	“Identity is authentic; articulation is synthetic” (Kunst et al., 13 Feb 2026)

In recommender systems, ACA has been demonstrated in transformer-based automatic playlist continuation. Fans who strategically reorder playlists they control can promote an underrepresented song through “authentic signal planting,” and the paper reports that recommendations of other songs are largely preserved while the newly gained recommendations are distributed across various artists (Baumann et al., 2024). In a related but sociologically distinct setting, a two-year ethnography of online fan activities documents how 43 core fans and their corresponding general fan groups build a collective folk understanding of algorithms, package tactics into usable tutorials, and mobilize general fans through rational persuasion and “Guilt-Tripping Fans” (Xiao et al., 2024). The study explicitly extends Shaw et al.’s five stages of computer-supported collective action to opaque platform algorithms and describes the organizing principle as “enable the foolish to learn, motivate the lazy to act” (Xiao et al., 2024).

On gig platforms, ACA can exploit the work-allocation rule itself. The combinatorial model of DoorDash’s #DeclineNow campaign treats participants as drivers who decline orders below a threshold so that the platform reoffers the same order at slightly higher pay (Sigg et al., 2024). The paper proves that the average worker gain of the strategy is always positive, while the benefit of participation is positive only for small degrees of labor oversupply; it therefore recommends organizing in shifts to reduce oversupply and improve participant incentives (Sigg et al., 2024).

ACA has also been proposed as a user-side fairness intervention. In “Fairness for the People, by the People,” a minority collective strategically relabels only its own data to reduce equalized odds without changing the firm’s training pipeline (Ben-Dov et al., 21 Aug 2025). The paper proposes three model-agnostic approximation methods—rank by probability, rank by label, and rank by distance—and reports that a subgroup of the minority can substantially reduce unfairness with a small impact on overall prediction error, though minority-only collectives cannot in general guarantee perfect fairness (Ben-Dov et al., 21 Aug 2025).

A different organizational form appears inside AI-producing firms. “AI Workers, Geopolitics, and Algorithmic Collective Action” treats AI researchers and engineers as actors of geopolitics and argues that ACA should include worker-centered, Participatory Design-informed efforts to create the conditions for resistance, reflection, and bottom-up intervention from within AI organizations (Reis, 21 Nov 2025). This use differs from user-side data manipulation but preserves the core emphasis on coordinated agency in algorithmically structured institutions.

6. Governance, controversy, and normative fault lines

ACA sits at the intersection of contestability, governance, and abuse. One fault line concerns whether it should be understood as a corrective mechanism or as a manipulative one. Some papers explicitly frame coordinated data modification as a grassroots accountability tool or as a user-side fairness intervention when provider-side remediation is unavailable, delayed, or unlikely to be adopted (Ben-Dov et al., 21 Aug 2025, Bhange et al., 26 May 2026). Others emphasize that the same infrastructure can be used maliciously or can industrialize influence at scale (Ben-Dov et al., 21 Aug 2025, Kunst et al., 13 Feb 2026).

A second fault line concerns authorship and agency. In the cyborg-propaganda literature, the central paradox is whether algorithmic coordination “unionizes” influence or reduces participants to “cognitive proxies” (Kunst et al., 13 Feb 2026). The audience sees many authentic citizens posting through verified accounts, yet the articulation may be centrally generated, strategically timed, and continuously optimized in a closed-loop learning system. This architecture exploits a “human-in-the-loop loophole” because a verified human ultimately clicks “post,” even when the surrounding workflow is heavily automated (Kunst et al., 13 Feb 2026).

A third fault line concerns governance instruments. Simple bot detection is inadequate in settings where verified humans disseminate AI-generated or centrally orchestrated content. Proposed responses include network-level forensics, coordination indices, detection of unnatural onset times and deviations from the logistic growth curve typical of natural viral spread, supply-chain forensics using passive DNS, audit studies of volunteer recruitment interfaces, and experiments on labeling or inoculation interventions (Kunst et al., 13 Feb 2026). The same paper treats proof-of-authorship standards such as behavioral biometrics or watermarking as brittle and surveillance-prone, and instead argues that regulating coordination hubs, app stores, and disclosure infrastructures may be more promising (Kunst et al., 13 Feb 2026).

In machine-learning settings, governance debates also involve transparency and privacy. Multi-collective work argues that meaningful participation requires more transparency in the underlying models and in the behaviors different groups may adopt toward those systems (Karan et al., 30 Apr 2025). Privacy-preserving training, meanwhile, protects individual records but raises the threshold for effective collective steering, creating a trade-off between privacy and collective power (Solanki et al., 9 May 2025). Worker-centered work adds a final institutional claim: governance is necessary, but not sufficient, because states may be structurally incentivized to rely on rather than constrain powerful AI firms; accordingly, bottom-up interventions must complement formal regulation (Reis, 21 Nov 2025).

Across these debates, a common misconception is that ACA is either ordinary grassroots activity or ordinary adversarial ML. The literature instead presents a more complex object: coordinated behavior that may be authentic yet strategic, corrective yet manipulative, decentralized in appearance yet centralized in articulation, and technically inseparable from the learning rules, ranking logics, and platform update mechanisms it targets (Creager et al., 2023, Kunst et al., 13 Feb 2026).