When the Partner Is Unnecessary—and When Three Attackers Matter

For colluding adversaries in ML pipelines, capability is not just a description of how powerful an attacker is. It changes the shape of the dependency graph. This chapter asks when a stronger first adversary makes a partner more useful, when a stronger second adversary makes that partner unnecessary, and how pairwise relationships expand into longer or adaptive chains. The practical value is a conditional threat model: a proposed collusion path should identify an unmet prerequisite, not merely assume that more access means more collaboration.

The distinction follows from the evidence already examined. A first attacker may produce a better shadow model, a more representative auxiliary dataset, or a changed model condition. But a second attacker may already possess the same resource through direct access, data overlap, or architectural knowledge. In that case, the first attacker has not created a meaningful edge. The attack may still be severe, but it is not dependent on collusion.

Stronger attackers change different sides of the edge

The SoK describes each adversary through several characteristics: role, objective, capability, optimization strategy, model knowledge, interaction with the target, and data knowledge. These dimensions answer different questions. Role identifies where the adversary sits in the pipeline. Objective identifies what they want to violate or learn. Capability identifies what they can control. Optimization identifies whether they can adapt their actions to feedback. Model and data knowledge identify what they already know, while interaction describes how much contact they can have with the target.

Strengthening the first adversary can make collusion more useful when it improves the outcome that the second adversary needs. More control over training data can make poisoning more effective at changing a tail or a behavioral distinction. More model knowledge can improve a test-time attacker’s ability to produce transferable observations. More interaction can produce a richer dataset or a better estimate of the target’s behavior. More relevant data knowledge can make an inferred or reconstructed artifact more accurate.

The word “can” is essential. A stronger characteristic matters only if it changes the particular factor on which the downstream edge depends. Additional queries may help produce a better shadow model, but they may not help a downstream attack whose limiting factor is distribution mismatch. Greater control over one part of training may not change a subgroup signal. Stronger optimization may increase an attack’s direct success without producing an artifact that another attack can reuse. Collusion potential is therefore tied to the outcome, not to a general rating of attacker strength.

Strengthening the second adversary has a different effect. It can make the downstream attack more effective directly, but it can also satisfy the downstream prerequisite without help from the first attacker. A second adversary with white-box access already knows the target’s architecture and parameters. They may not need model extraction to obtain a functionally similar shadow. A second adversary with full overlap with the training data may not need a partner to supply member-like records. A second adversary that already knows the training distribution may not need distribution inference to choose suitable auxiliary data.

This produces an apparent paradox: a more capable second adversary can increase the success of the downstream attack while reducing the need for collusion. Those are different quantities. Attack effectiveness asks how well the second adversary can achieve their objective.