# Short, Disclose, and Distort††thanks: We appreciate helpful comments from
Janja Brendel, Eti Einhorn, Ilan Guttman, Peicong (Keri) Hu, Xue Jia, Jing Li,
Suil Pae, Evgeny Petrov, Chao Tang, Tsahi Versano, Wenfeng Wang, Zheng Wang,
Forester Wong, Joanna Wu, Wuyang Zhao, and workshop participants at the AES
Asia-Pacific Webinar, Chinese University of Hong Kong, and Tel Aviv
University. The work described in this paper was partially supported by a
grant from the Research Grants Council of the Hong Kong Special Administrative
Region, China [Project No. CityU 21600421].

Pingyang Gao
Jinzhi Lu  University of Hong Kong. Email<EMAIL_ADDRESS>City University of Hong
Kong. Email<EMAIL_ADDRESS>
###### Abstract

We investigate the voluntary disclosure decision of activist speculators under
uncertainty about information endowment (Dye 1985). In our model, a speculator
first uncovers initial evidence about the target firm and then seeks
additional information to help interpret the initial evidence. The speculator
takes a position in the firm’s stock, then voluntarily discloses some or all
of their findings, and finally closes their position after the disclosure. We
present three main findings. First, the speculator will always disclose the
initial evidence, even though the market is uncertain about whether the
speculator possesses such evidence. Second, the speculator’s disclosure
strategy of the additional information increases stock price volatility: they
disclose extreme news and withhold moderate news. Third, this distortion in
disclosure enables the speculator to engage in market manipulation, whereby
they take a short (long) position despite having good (bad) news.

Keywords: activist speculators, short and distort, voluntary disclosure,
complex information, market manipulation
JEL Classifications: D82, D83, G14, M41

##  1 Introduction

Many investors, both short sellers and long investors, share their research
and analysis on crowdsourced financial information platforms like Yahoo!
Finance and Seeking Alpha or social media like Twitter and Reddit. In
particular, activist short sellers disseminating their research results
publicly have received more attention. On the one hand, such disclosure could
contribute valuable information to the market (e.g., Ljungqvist and Qian 2016,
Dyer and Kim 2021, and Farrell et al. 2022). On the other hand, investors can
disclose their information to the market opportunistically. For example, both
SEC and DOJ are reportedly investigating activist speculators and promulgating
new regulations (Michelle 2022 and Porzecanski and Schoenberg 2022) on the
grounds that activist speculators can engage in “short and distort” tactics
where they spread misleading or false information to drive down the stock
prices and destroy successful companies (Mitts 2020 and Durston 2021).

We examine the disclosure and trading decisions of investors with a focus on
activist short-sellers and their potential market manipulation via disclosure.
We augment Dye (1985) with two new features: (i) investors can select their
position before disclosure; and (ii) investors possess multiple pieces of
information about target firms. In our model, a speculator receives two pieces
of information stochastically, the initial evidence and the additional
evidence about the value relevance of the initial evidence. To fix the idea,
suppose that a speculator has identified a red flag in a target firm: an
unusually high level of inventory. This could be negative news if the excess
inventory results from accounting frauds such as channel stuffing, but it
would be positive if the overstocking is part of the firm anticipating higher
demand in the near future. The speculator may uncover additional evidence that
helps better interpret the value implications of the initial information.
Hence, the speculators’ two signals are complements, as in Cheynel and Levine
(2020).111While we use a high level inventory as a motivating example, many
accounting numbers share the similar property that their implication is
clarified by additional information. For example, the red flag could be
accounting numbers that indicate a high level of accruals, and the additional
evidence could be further information about whether the high accruals is due
to non-discretionary accruals, or managers communicating good news via
discretionary accruals, or managers engaging in earnings management (Jones
1991). As another example, investing in R&D can be interpreted as either good
or bad, depending on subsequent news. The speculator first takes a position in
the firm’s stock, then voluntarily discloses some or all of their findings,
and finally closes their position after the disclosure.

Our first finding establishes that the speculator informed about the initial
evidence always discloses it despite the market’s uncertainty about whether he
possesses such evidence. This result contrasts with prior work such as Dye
(1985). In Dye (1985), the manager with long exposure to the stock price
withholds his news if its revelation lowers the stock price. In our model, the
speculator can trade in both directions before disclosing and thus profit from
price movements in either direction. In other words, the speculator’s
objective is to maximize price volatility through his disclosure. In contrast,
if the speculator withholds the initial evidence, the price will remain
unchanged, and his profit will be zero. Therefore, the speculator will never
remain silent.

Our second result shows that the speculator discloses the additional evidence
if and only if it induces a sufficiently large price volatility: he discloses
extreme news and withhold moderate news. In the previous example, suppose the
high inventory without additional information is bad news on average. Thus the
disclosure of the initial signal alone generates negative price impact. If the
additional evidence strongly indicates that the high inventory results from an
accounting fraud (very bad news), its disclosure reinforces the initial
negative price impact. But if the additional evidence shows convincingly that
the high inventory is driven by the expected future demand (very good news),
then its disclosure reverses the initial negative price impact and leads to
sufficiently positive price impact. In both cases, the disclosure of the
additional evidence increases price volatility compared with the disclosure of
the initial signal alone. However, when the additional evidence is moderate,
its disclosure only offsets the initial negative price impact, resulting in
marginal change in price volatility. Therefore, the speculator will withhold
the additional evidence.

Our third result shows that the withholding of the additional evidence gives
rise to manipulative short-selling, which is defined as the speculator taking
a short position even though his information would have increased the stock
price had it been publicly disclosed (i.e., the speculator trades against his
own information). Specifically, when the disclosure of additional evidence
results in positive price impact but small in magnitude, the speculator
withholds it, issues a report with only the initial evidence, and takes a
short position to profit from a higher price volatility. Such manipulative
short-selling is consistent with the notion of ”short and distort”.

We then conduct comparative statics to explore the model’s empirical
predictions and show how the endogenous nature of the speculator’s disclosure
interacts with those predictions. We focus on two parameters, the speculator’s
competence modeled as the probability the speculator receives the additional
information, and the firm’s information environment modeled as the probability
that the firm’s fundamental is revealed by sources other than the speculator.
We show that a more competent speculator is less likely to withhold
information and engage in manipulative short selling, but the price reaction
to his publication of a simple report (the initial signal alone without the
additional evidence) is weaker after controlling for the report’s content. The
last prediction, which may disagree with one’s intuition that market response
to a report increases in the speculator’s competence, is driven by the
speculator’s endogenous disclosure. Since a more competent speculator is more
likely to discover additional evidence, the market, upon observing a simple
report from such a speculator, ascribes a larger probability that he has
withheld the additional evidence and responds with a lower price reaction.

When the firm’s information environment improves, the price reaction to the
speculator’s simple report is larger. Moreover, the speculator discloses more
good news but withholds more bad news, and is less likely to engage in
manipulative short-selling. Information from other sources defeats the
speculator’s strategic withholding and results in loss to his short position.
Therefore, the firm’s information environment plays a disciplinary role on the
market manipulation. As the speculator discloses more good news, the average
withheld news becomes worse. As a result, the non-disclosure induces a larger
negative price reaction, encouraging the speculator to withhold more bad news.

Our paper contributes to the literature in several ways. First, we contribute
to the vast literature on voluntary disclosure.222See, for example, Verrecchia
(1983), Dye (1985), Jung and Kwon (1988), and Shin (1994). Readers are
referred to a number of excellent reviews of this vast literature, including
Verrecchia (2001), Dye (2001), Beyer et al. (2010), Stocken (2013) and
Bertomeu and Cheynel (2015). We extend Dye (1985) by incorporating two salient
features: speculators’ multi-dimensional information and their flexible choice
of initial position. These departures from Dye (1985) drive our main results,
namely that the speculator always discloses the initial evidence and that the
disclosure of additional information is not monotonic in the underlying news.
The most relevant paper to ours is Cheynel and Levine (2020), which introduces
an information mosaic to model multi-dimensional information where the
fundamental is the multiplication of two components. We have borrowed their
information structure to study a different problem. In our model, the
speculator has information about both components and decides how to disclose
them. Also related is the studies where the manager’s reporting objective
(exposure to the stock price) is uncertain but exogenous (Einhorn 2007 and
Fischer and Verrecchia 2000). In contrast, the speculator endogenously chooses
his exposure in our model. A similar non-monotonicity result also occurs in
Beyer and Guttman (2012), who introduce voluntary disclosure into the model of
Myers and Majluf (1984). In their model, the manager’s costly signaling via
over-investment drives the endogenous cost of disclosure, and this cost is
highest for intermediate types. As a result, the types in the middle
strategically withhold their information.

There is a sizeable literature on disclosure with multiple private signals
(e.g., Dye and Finn (2007), Arya et al. (2010) and Ebert et al. (2017)). Our
study is related to Pae (2005) and Beyer and Dye (2023). Both studies show
that managers may engage in selective and misleading disclosure. In their
models, the manager maximizes price, and therefore, withholds signals with low
realizations. By contrast, our study considers the speculator’s flexible
choice of initial position and finds very different results regarding the
speculator’s disclosure strategy: the unraveling of the initial evidence and
the withholding (disclosure) of moderate (extreme) additional evidence.333The
feature of multiple signals also manifests in those dynamic settings when the
sender receives multiple signals over time (e.g., Einhorn and Ziv 2008,
Bertomeu and Magee 2011, Guttman et al. 2014, Bertomeu et al. 2020, Bertomeu
et al. 2022). And yet another variant takes the form that the additional
signal is about the precision of the initial signal (e.g., Hughes and Pae
2004, Bagnoli and Watts 2007) or comes from other sources (e.g., Einhorn 2005
and Einhorn 2018).

Our paper contributes to our understanding of investors’ disclosure and how
their information is impounded into stock prices. Prior literature has focused
on the channel through which investors’ information indirectly impacts stock
prices via their trading activities (e.g., Kyle 1985, Glosten and Milgrom
1985, Goldstein and Guembel 2008, and Gao et al. 2020). In contrast, our model
focuses on the disclosure channel. We show that market manipulation becomes
feasible with the help of selective disclosure, even though everyone is
rational and no one is systematically fooled. Our results are useful to help
guide the growing empirical literature on investors’ disclosure (see
Ljungqvist and Qian 2016, Zhao 2020, Paugam et al. 2020, Brendel and Ryans
2021, Dyer and Kim 2021, and Farrell et al. 2022). We discuss the empirical
implications in detail in Section 4.

Finally, we contribute to the literature on market manipulation through
information disclosure (e.g., Benabou and Laroque 1992, Van Bommel 2003,
Marinovic et al. 2013, and Schmidt 2020). Most existing models in this
literature assume that speculators’ disclosures are unverifiable, leading to
multiple equilibria, including a babbling equilibrium with no communication.
The speculator’s credibility is typically modeled by assuming an honest type
who always tells the truth (Benabou and Laroque 1992) or by using mechanisms
such as varying trading horizons (Schmidt 2020). In contrast, our model adopts
the verifiable disclosure approach, resulting in a unique equilibrium and
providing a straightforward way to model activist speculators’
credibility.444The verifiable disclosure approach captures important features
of investors’ research reports. First, the reports are often detailed,
providing thorough evidence and logical arguments to explain the rationale for
their recommendations or positions. Second, investors’ reports are often
scrutinized in reality, as seen with activist short-sellers’ reports, which
are challenged by target firms and their important stakeholders (Brendel and
Ryans 2021), and with articles on Seeking Alpha, which undergo thorough
editorial review before publication (Farrell et al. 2022) and are monitored by
regulators (Dyer and Kim 2021). As a result, we believe that it could be
costly for speculators to engage in groundless talks. Future research could
examine investors’ disclosure from the perspective of costly misreporting.

The rest of the paper is organized as follows. We present the model in Section
2, analyze the equilibrium in Section 3 and develop the empirical implications
in Section 4. Section 5 concludes.

##  2 Model

Our model augments Dye (1985) with trading. A speculator first receives two
signals about the target firm. The speculator trades in the firm’s stock,
makes disclosure decisions, and closes the position afterwards.

Information Structure: A firm’s value $\theta$ has two components:

$\theta=rx.$ (1)

$r$ is a continuous variable on $\mathbb{R^{+}}$, with density function $f(.)$
and mean $r_{0}$. $x$ is a continuous variable on $\mathbb{R}$, with density
function $g(.)$ and mean $\mu_{0}$. We assume $\mu_{0}>0$ without loss of
generality.

A speculator acquires private information about both $r$ and $x$. He learns
$r$ with probability $\alpha$ and, conditional on learning $r$, he further
learns about $x$ with probability $\beta$. We interpret $r$ as the initial
information and $x$ as additional evidence that helps interpret the initial
evidence. For instance, $r$ could represent a high level of inventory, while
$x$ could represent information about whether the high inventory is due to
accounting frauds (such as channel stuffing) or results from the anticipated
increase in future customer demands.

Trading: The speculator trades twice, establishing a position before the
disclosure and closing it after the disclosure. The size of his order $\rho$
is constrained to be $\rho\in[-1,1]$, where $\rho<0$ stands for a short
position, $\rho>0$ stands for a long position, and $0$ stands for no trade.

The speculator’s disclosure: Between the two rounds of trading, the speculator
makes his disclosure decision in the manner of Dye (1985) and Jung and Kwon
(1988). The uninformed type cannot disclose anything or prove that he is
uninformed. The informed type either makes a truthful disclosure or claims
ignorance to be pooled with the uninformed. We say the speculator’s report is
simple if he only discloses $r$ and is elaborate if he discloses both $r$ and
$x$.

Disclosure of $\theta$ by other information sources: After the speculator’s
disclosure, we assume that $\theta$ is revealed with probability $q$. This
feature is motivated by the idea that other market participants, including
media, analysts, other speculators, and the target firm itself, may also
disclose relevant information that confronts any omission or withholding of
information in the speculator’s disclosure.555For example, Brendel and Ryans
(2021) documents that 31% of the target firms in their sample issue responses
to activist short sellers’ reports, and 6% of them start a lawsuit. Thus, we
can view $q$ as a proxy for the firm’s information environment.

The time line of the model is as follows:

  * •

At date 1, the speculator receives two private signals and establishes an
initial position $\rho$ at price $P_{1}=E[\theta]=r_{0}\mu_{0}$.

  * •

At date 2, the speculator makes the disclosure decisions. After the
speculator’s disclosure, the firm value $\theta$ is revealed with probability
$q$.

  * •

At date 3, the speculator closes her initial position at the updated stock
price $P_{2}$.

We define market manipulation as situations where the speculator trades in a
direction inconsistent with his information. If both $r$ and $x$ have to be
disclosed after initial trading, then the informed speculator takes a short
position when he has bad news (i.e., $rx<r_{0}\mu_{0}$) and a long position
when he has good news (i.e., $rx>r_{0}\mu_{0}$). Against this benchmark, we
formally define market manipulation.

######  Definition 1 (Manipulative Short-selling and Buying)

The (informed) speculator engages in manipulative short-selling if he takes a
short position when $rx>r_{0}\mu_{0}$. Similarly, he engages in manipulative
buying if he takes a long position when $rx<r_{0}\mu_{0}$.

##  3 Equilibrium

###  3.1 Preliminary analysis

The (informed) speculator has two private signals, which complicates the
analysis and the exposition. Thus, we simplify the analysis by first pinning
down the disclosure of the first signal, the initial evidence $r$.

###### Proposition 1

The speculator always discloses the initial evidence $r$, regardless of its
realization.

Proposition 1 shows that the speculator always discloses the initial evidence
even though the market is uncertain about whether he has received it or not.
This unraveling result is different from the partial disclosure result found
in Dye (1985) and Jung and Kwon (1988) because the speculator in our setting
can trade in both directions before the disclosure. The sender (manager) in
Dye (1985) has long exposure to the stock price and benefits only from
positive price movement. When the news is negative and its disclosure would
move the stock price downward, the manager has incentives to hide such
information. In contrast, the trading flexibility of the sender (speculator)
in our model enables him to profit from any price movement, regardless of its
direction. He can make a profit by taking a short (long) position if his
report decreases (increases) the price. Thus, the speculator tries to move
price as much as possible, regardless of the direction. Anticipating this
incentive, if the speculator does not disclose any report, the market infers
that the speculator must be uninformed about $r$, and as a result, the price
does not move. Thus, the speculator always disclosing $r$ is an equilibrium.
The proof of the equilibrium’s uniqueness requires that we determine the
market’s belief upon the off-equilibrium disclosure of $r$. In the appendix,
we apply neologism-proofness as in Bertomeu and Cianciaruso (2018) to
accomplish the task. Readers can also refer to Lemma 2 in the appendix for the
unraveling result in the case of a single signal.

Moreover, when the speculator discloses $r$ and withholds $x$, the potential
revelation of the firm’s value by other information sources will dilute his
profit. However, this does not prevent the speculator from disclosing $r$, as
withholding it would result in zero profit. If the speculator expects to incur
negative profit from withholding $x$, he can always switch to full disclosure
of both $r$ and $x$ and take positions accordingly, thereby guaranteeing
positive profit.

###  3.2 Main results

Having established that the speculator will always disclose $r$, we turn to
the disclosure of the additional signal $x$ and the trading decision $\rho$.
From now on, we refer to the disclosure of $x$ whenever we discuss disclosure.
Both the disclosure and trading decisions depend on whether the realization of
$r$ exceeds the prior $r_{0}$ or not. Given our primary interest in
understanding the disclosure by activist short sellers, we focus on the case
of $r<r_{0}$ when the initial signal is negative news average across all
realization of $x$. We call such an initial signal “red flag”. The other case
of $r\geq r_{0}$ shares symmetric intuition except that the trade sign flips
as the initial signal is now positive news on average.

Recall that due to flexible choice in initial position, the speculator can
make a profit as long as his disclosure moves the stock price away from the
prior ($r_{0}\mu_{0}$). In other words, the speculator tries to increase price
volatility through his disclosure. Use $\mu_{ND}$ to denote the market’s
posterior expectation about the additional information $x$ upon observing only
the initial signal $r$. Thus, the price volatility of a simple and an
elaborate report, which we denote by $\pi_{q}(x)$ and $\pi(x)$, are given
by:666Note that at date 3, the firm value is revealed by other information
sources with probability $q$. Thus, when withholding $x$ (i.e., issuing a
simple report), the speculator expects the date 3 price to be
$qrx+(1-q)r\mu_{ND}$.

$\displaystyle\pi_{q}(x)=|qrx+(1-q)r\mu_{ND}-r_{0}\mu_{0}|,$ (2)
$\displaystyle\pi(x)=|rx-r_{0}\mu_{0}|.$ (3)

The next lemma characterizes the speculator’s objective when making the
disclosure decision.

###### Lemma 1

The speculator withholds $x$ if and only if $\pi_{q}(x)\geq\pi(x)$.

Lemma 1 shows that when determining the speculator’s disclosure strategy, we
can put aside the speculator’s trading decisions and focus on price
volatility. Given that $\mu_{ND}$ is a constant in equilibrium, it is
straightforward that $\pi_{q}(x)\geq\pi(x)$ if and only if the firm value
(i.e., $rx$) is sufficiently close to its prior. This implies that fixing the
initial evidence $r$, the speculator withholds $x$ if and only if it is in the
middle. In the appendix, we show that the equilibrium exists and is uniquely
determined by two disclosure thresholds $\bar{x}$ and $\underline{x}$. Thus,
we have our main result below.

###### Proposition 2

When $r<r_{0}$, the speculator’s unique equilibrium disclosure and trading
decisions are characterized by three regions:

  1. 1.

For $x\in(-\infty,\underline{x})$, the speculator takes a short position and
discloses $x$.

  2. 2.

For $x\in[\underline{x},\bar{x}]$, the speculator takes a short position and
withholds $x$.

  3. 3.

For $x\in(\bar{x},+\infty)$, the speculator takes a long position and
discloses $x$.

  4. 4.

Manipulative short-selling arises when $x\in[\frac{r_{0}\mu_{0}}{r},\bar{x}]$
(i.e., region C in Figure 2).

Figure 1: The equilibrium when $q=0$ Figure 2: The equilibrium when
$q\in(0,1)$

Proposition 2 is illustrated in Figures 1 and 2 for the case $q=0$ and
$q\in(0,1)$. The speculator issues an elaborate report in region A and region
D when the additional evidence is significant. He takes a short position in
region A and a long position in Region D. In contrast, when the additional
evidence is weak (i.e., in regions B and C), the speculator hides it and takes
a short position nonetheless. Note that a red flag alone (i.e., $r<r_{0}$)
indicates bad news. Thus, the speculator has incentive to withhold $x$ when
the disclosure of it induces little price volatility. In other words, in
regions B and C, the speculator pretends to be uninformed about the additional
evidence, to profit from the higher price volatility induced by a simple
report which contains only the red flag.

When only the initial evidence is disclosed, the market rationally believes
that the speculator either failed to uncover any additional evidence or chose
not to disclose it. In the former case, the belief about the second component
of the firm value $x$ is not changed, but the first component of the firm
value has been confirmed to be lower than the prior due to $r<r_{0}$. Overall,
the firm value is revised downward from $r_{0}\mu_{0}$ (i.e., the prior) to
$r\mu_{0}$. In the latter case, the nature of the news depends on the
equilibrium disclosure strategy about $x$, but the news cannot be too
favorable, as otherwise the speculator would have disclosed it after taking a
long position. Therefore, despite the possibility of strategic withholding of
$x$, the market should still react negatively to reports containing only the
red flag. This intuition is confirmed in Part 2 of Proposition 2, where we
show the speculator takes a short position whenever he withholds $x$.

Using our running example, Proposition 2 could be illustrated as follows. The
speculator discovers that the target firm has an unusually high level of
inventory, a red flag. If he further discovers that it results from an
accounting fraud, he takes a short position and then issues an elaborate
report with both the initial and additional information. If he concludes that
the high inventory is prepared for anticipated higher future sales, he takes a
long position and issues an elaborate report explaining both the high level
inventory and its positive value implications.777This result is supported by
anecdotal evidence. For example, in Muddy Waters Research’s report on Bollore,
the famous short-seller firstly points out a red flag on Bollore, a
“horrifically complex corporate structure”. However, in the same report, the
short-seller provided detailed evidence and reasons for why the opacity of
Bollore is actually the reason to long the company. In these two cases,
disclosing the red flag together with the additional evidence induces a higher
price volatility than disclosing a red flag alone. However, if the
speculator’s additional evidence is inconclusive about the value implication
of the high inventory level, its disclosure only offsets the initial negative
price impact, resulting in small price volatility. Thus, the speculator still
takes a short position but issues a simple report pointing out the unusually
high inventory level without disclosing the additional evidence.

Finally, Part 4 of Proposition 2 shows that manipulative short-selling arises
in a sub-region of the withholding region. At point $O$ in Figure 2, the
negative price impact of the red flag is perfectly offset by the disclosure of
additional evidence. Moving from point $O$ towards the left, the additional
evidence indicates bad news and thus the speculator’s trading is consistent
with his information in region B. Moving from point $O$ towards the right, the
additional evidence indicates good news. However, the speculator reports the
red flag, hides the additional evidence, and takes a short position in region
C, consistent with the notion of “short and distort”.888Proposition 2A in the
appendix characterizes the equilibrium for the case where $r>r_{0}$. In this
scenario, the speculator’s disclosure strategy is identical to the case where
$r<r_{0}$, except that the speculator takes a long position when withholding
$x$. Consequently, the insights are symmetrical to the case where $r<r_{0}$.

##  4 Empirical Implications

Having established the equilibrium in Proposition 1 and Proposition 2, we
derive empirical predictions of the model by conducting comparative statics
analysis. We again focus on the case $r<r_{0}$ as it is our primary interest.
Thus, empirical studies testing predictions in this section should condition
on reports with red flags. Our predictions focus on the following dependent
variables.

First, recall that we define the speculator’s report to be simple if he only
discloses $r$ and to be elaborate if he discloses both $r$ and $x$.
Empirically, speculators’ reports are more continuous. The elaborateness of
the reports could be proxied by the length or the number of points. It is
clear from Figure 2 that the frequency of simple reports is represented by the
joint size of region B and C.

Second, a related variable is the extremity of report. A report is more
extreme in our model if the additional evidence $x$ is further away from its
prior mean. The speculator discloses the news in two tails and withholds in
the middle. As a result, the disclosed news are more extreme than the withheld
news. The implication is that as the elaborate reports become more frequent,
they become less extreme as well.

Third, note that stock prices endogenously react to the speculator’s
disclosure in equilibrium. Conditional on observing only $r$ (a simple
report), market reaction is captured by the decline in price from date 1 to
date 3: $P_{1}-P_{2}=r_{0}\mu_{0}-r\mu_{ND}$, where $\mu_{ND}$ is the market’s
posterior expectation of the additional information $x$ in equilibrium. Note
that $r_{0}\mu_{0}-r\mu_{ND}$ also captures the price volatility following a
simple report. We have demonstrated in Proposition 2 that
$\mu_{ND}=\underline{x}$. Therefore, the comparative statics of market
reaction and price volatility are exactly the opposite to that of the lower
disclosure threshold.

Fourth, our model also generates predictions about manipulative short selling.
Manipulative short-selling is not directly observable in general, and we leave
it to empirical research to find the proper proxy.999For an indirect proxy of
manipulative short-selling, one may look for cases where the stock price
declines upon a short-selling report, followed by a reversal in the long run.
As we have discussed earlier in Proposition 2, manipulative short-selling is
captured by region C in Figure 2.

We start with the predictions on report’s elaborateness.

###### Proposition 3

When the initial signal is unfavorable (i.e., $r<r_{0}$):

  1. 1.

The elaborateness of reports increases in the speculator’s competence. That
is, $\frac{\partial\bar{x}}{\partial\beta}>0$ and
$\frac{\partial\underline{x}}{\partial\beta}<0$.

  2. 2.

The frequency of negative (positive) elaborate reports decreases (increases)
in the firm’s information environment. That is,
$\frac{\partial\bar{x}}{\partial q}<0$ and
$\frac{\partial\underline{x}}{\partial q}<0$.

Part 1 of Proposition 3 carries over to our setting the insight from the prior
literature that the sender’s disclosure is increasing in his information
endowment (e.g., Jung and Kwon 1988). As the speculator’s competence $\beta$
increases, the disclosure of news in both tails increases, causing the non-
disclosure region (the joint size of B and C) to shrink, which maps into an
increase in report’s elaborateness. To put it intuitively, the market will be
more skeptical about a simple report issued by a more successful hedge fund
(e.g., funds with better track records), as it is more likely such a fund has
chosen to conceal additional evidence, rather than having failed to discover
it. Thus, more successful hedge funds are more likely to provide elaborate
reports.

Part 2 of Proposition 3 provides predictions on the frequency of elaborate
report. The frequency of elaborate negative reports is captured by the size of
region A, which decreases in $q$. The frequency of elaborate positive reports
is captured by the size of region D, which increases in $q$. To understand
these results, first note that when $q$ increases, a speculator’s omission of
good news is more likely confronted by other sources. This explains why
$\frac{\partial\bar{x}}{\partial q}<0$. The disclosure of $\theta$ by other
information sources holds the speculator accountable and promotes honesty.

On the other hand, the second part of the result (i.e.,
$\frac{\partial\underline{x}}{\partial q}<0$) may be less intuitive. The
increase in $q$ indirectly affects the speculator’s behavior through the
pricing of non-disclosure firms, compelling the speculator to withhold more
bad news. In other words, firms with better information environments (i.e.,
more public disclosure) tend to have fewer elaborate short-seller reports. The
intuition is as follows: as $q$ increases, we know from the first part that
the speculator would increase the disclosure of good news. As a result, the
average withheld news becomes worse, and non-disclosure induces a larger
negative price reaction. Therefore, the profit from shorting plus withholding
increases. Recall that for the bad news on the margin (at $\underline{x}$),
the speculator is indifferent between shorting plus withholding and shorting
plus disclosure. As the profit from the former increases, the speculator tilts
more towards it and thus would strictly prefer to withhold $\underline{x}$
now.

Part 2 of Proposition 3 can also be illustrated by comparing Figure 1 with
Figure 2. When $q$ increases from $0$ to a positive number, it is clear that
both thresholds shift to the left. Since the frequency of negative (positive)
elaborate reports decreases (increases) in the firm’s information environment,
the overall effect of the firm’s information environment on the elaborateness
of reports is ambiguous.

The next Corollary provides predictions on report’s extremity, market
reaction, and manipulative short-selling.

###### Corollary 1

When the initial signal is unfavorable (i.e., $r<r_{0}$):

  1. 1.

The extremity of elaborate reports decreases in the speculator’s competence.
The extremity of negative (positive) reports increases (decreases) in the
firm’s information environment.

  2. 2.

Holding constant the initial evidence, the stock price reaction to a simple
report (or equivalently, price volatility following a simple report) decreases
in the speculator’s competence and increases in the firm’s information
environment.

  3. 3.

The frequency of manipulative short-selling (as captured by the size of region
C in Figure 2) decreases in the speculator’s competence and the firm’s
information environment.

Since elaborate report becomes less extreme when they become more frequent,
Part 1 of Corollary 1 follows directly from Proposition 3. For instance, as
the size of region A becomes larger, there are more elaborate negative
reports. However, as the size of region A increases and more elaborate
negative reports are disclosed, the disclosed value of $x$ becomes closer to
point $O$ and thus less extreme. If we map these comparative statics to the
real world and consider elaborate reports by hedge funds, those that are more
successful should, on average, issue less aggressive reports. In addition,
firms with better information environments tend to have more aggressive
negative reports and less aggressive positive reports.

Part 2 of Corollary 1 is perhaps surprising since one might expect that market
reaction would increase with competence. However, this intuition may not be
true after considering the speculator’s endogenous disclosure strategy. More
successful hedge funds are more able to produce elaborate reports, which makes
their simple reports more suspicious, and thus, the market reaction deceases
with competence. Part 2 of Corollary 1 also links the market’s reaction with
the firm’s information environment. This relationship would be ambiguous
without solving for the speculator’s endogenous disclosure strategy.

To understand Part 3 of Corollary 1, first recall from Proposition 3 that as
$\beta$ increases, the non-disclosure region shrinks. As a result, the scope
for manipulation is restricted ($\frac{\partial\bar{x}}{\partial\beta}<0$).
The other endpoint of region $C$, $O=\frac{r_{0}\mu_{0}}{r}$, remains
unaffected by $\beta$. Therefore, the probability of manipulative short-
selling decreases as $\beta$ increases.

Second, when $q$ increases, the speculator’s omission of $x$ is more likely
revealed by other sources. For example, if the speculator takes a short
position, reports the red flag, and withholds the additional information that
the red flag is actually good news, he faces the risk that the good news will
later be revealed by other sources, resulting in negative profits from the
short position. As a result, the probability of manipulative short-selling
decreases with the likelihood of information revelation by other
sources.101010Proposition 3A in the appendix derives the empirical predictions
for the case $r>r_{0}$. We skip the discussion as the intuitions are similar
to Proposition 3 and Corollary 1.

##  5 Conclusions

We study the disclosure and trading behavior of a speculator who receives
multiple pieces of information. In equilibrium, the speculator always
discloses the initial evidence. However, the speculator may withhold the
additional evidence to increase price volatility. This strategic concealment
of information enables the activist short-sellers to engage in market
manipulation, consistent with the concerns of “short and distort”.

Our model suggests that misleading disclosure can arise when speculators
selectively withhold multi-dimensional information. The legality of this
practice is more defensible than spreading unfounded rumors or disseminating
fabricated reports. Therefore, we believe that this practice is more
widespread than the ones involving misinformation and needs more regulatory
attention.111111However, directly identifying such practices can be
challenging. This is because it is difficult to differentiate between a
speculator withholding additional evidence and a speculator simply being
uninformed about the additional evidence. Our model suggests that any short
selling report that contains only red flags could be the result of partial
misleading disclosure. One example is Citron’s Research’s campaign on Qihoo
360. In 2011, short-seller Citron Research published a short selling report on
the Chinese internet company Qihoo 360. Citron’s report pointed out several
red flags for Qihoo 360’s user number. However, Qihoo’s response clarifies
that Citron’s analysis on their user number is incomplete and misleading.
While the model’s insights primarily apply to speculators with direct trading
incentives, such as hedge funds, they also apply to those with incentives to
indirectly generate trading volume. For instance, considering that sell-side
analysts are compensated based on the trading volume generated by their
reports (e.g., Jackson 2005 and Karmaziene 2023), our results suggest that
they too may have incentives to engage in misleading disclosure.

One cost that speculators face when issuing misleading reports is the
potential disclosure by other sources, including firms, analysts, media
outlets, and other speculators. Proposition 3 show that an increased
likelihood of disclosure by other sources may have the side effect of
discouraging speculators from publishing reports with richer content. This
insight can be helpful to regulators who are considering imposing direct costs
on market manipulation, such as conducting investigations on activist short-
sellers.

Our study has the following limitations. First, we assume the speculator has a
short horizon and closes his position after disclosure. If the speculator has
longer horizon and can trade multiple times, he may engage in dynamic
disclosure management. For instance, the speculator can first disclose the
high inventory alone, buy at depressed prices, and then resell after
disclosing the high inventory is actually good news. We examine this
possibility in the online appendix.

Second, our analysis focuses solely on the price impact of the speculator’s
disclosure and does not model the price impact of the speculator’s trading.
Incorporating the speculator’s multi-dimensional information into a trading
game, such as Kyle (1985) and Glosten and Milgrom (1985), would render our
model intractable. Therefore, we present our analysis, specifically the
unraveling result in Proposition 1, as a benchmark. An interesting avenue for
future research is to examine whether and how the speculator’s disclosure
incentives will be affected by the price impact of trading.

Third, we assume the disclosure by other information sources is exogenous and
do not model their strategic incentives. For example, when responding to
activist short-sellers, target firms may not voluntarily issue additional
information that worsens the market’s belief. Due to the multi-dimensional
signal structure, the joint strategic disclosure decisions by speculators and
target firms are too complex to solve in our model. Future research may
examine this question by considering a setting where the speculator’s signal
has a single dimension.

Finally, we do not investigate how investors’ disclosure affects firms’
behavior. For example, whereas activist short-selling may deter firms from
engaging in earnings management, it may also disrupt firms’ normal
communication using discretionary accruals, because discretionary accruals can
be identified as red flags for earnings management. How does investors’
disclosure affect the overall amount of information reflected in stock prices?
Can the benefits of activist short-selling be outweighed by the costs? We
leave these questions to future research.

## Appendix

### Proof of Proposition 1

#### Step 0: Unraveling in the single signal case

Before we prove Proposition 1, we prove a preliminary unraveling result in the
case of a single signal. The proof of this result can help readers better
understand the logic behind the proof of Proposition 1.

Consider a simplified version of the baseline model where $r=1$ is common
knowledge, so that $\theta=x$. At date 1, the speculator learns $x$ with
probability $\beta$ and establishes an initial position at price
$P_{1}=E[x]=\mu_{0}$. At date 2, the speculator makes the disclosure decision
about $x$. At date 3, the speculator closes her initial position at the
updated stock price $P_{2}$.

###### Lemma 2

The speculator always discloses $x$, regardless of its realization.

##### Proof:

We prove Lemma 2 by contradiction. Suppose there exists a non-zero measure set
$W$ such that the speculator withholds $x$ when $x\in W$. We use $U$ to denote
the event in which the speculator is uninformed about $x$. We use $ND\equiv
W\cup U$ to denote the event of non-disclosure. The date 3 price conditional
on non-disclosure, which we denote by $\mu_{ND}$, is therefore

$\displaystyle\mu_{ND}$ $\displaystyle=\Pr(W|ND)E[x|W]+\Pr(U|ND)E[x|U]$
$\displaystyle=\Pr(W|ND)E[x|W]+(1-\Pr(W|ND))\mu_{0}.$

Recall that the speculator maximizes price volatility when making the
disclosure decision. When the speculator withholds $x$, the price volatility
is $v_{ND}\equiv|\mu_{ND}-\mu_{0}|$. Since $\mu_{ND}$ is a weighted average of
$E[x|W]$ and $\mu_{0}$, we have $|E[x|W]-\mu_{0}|>v_{ND}$. Furthermore,
because $W$ has non-zero measure, there exists a type $x_{l}\in W$ such that
$|x_{l}-\mu_{0}|>|E[x|W]-\mu_{0}|>v_{ND}$. However, this inequality suggests
that the speculator can induce a higher price volatility by disclosing
$x_{l}$, which contradicts $x_{l}\in W$. $\square$

#### Step 1: Preparations

We now proceed to the proof of Proposition 1. We first introduce some
notations. We use $T$ to denote the set of all possible types:
$T=\\{(r,x),(r,\varnothing),(\varnothing,\varnothing)|r\in\mathbb{R^{+}},x\in\mathbb{R}\\}$,
where $(r,\varnothing)$ means the speculator is informed about $r$ and
uninformed about $x$, and $(\varnothing,\varnothing)$ means the speculator is
uninformed about both $r$ and $x$. We use $d$ to denote the speculator’s
disclosure strategy, which maps the speculator’s type $t\in T$ to a reported
message $m\in T$. The informed types can imitate the uninformed types but not
vice-versa. Therefore, the possible strategies are:
$d(\varnothing,\varnothing)=(\varnothing,\varnothing)$,
$d(r,\varnothing)\in\\{(r,\varnothing),(\varnothing,\varnothing)\\}$, and
$d(r,x)\in\\{(r,x),(r,\varnothing),(\varnothing,\varnothing)\\}$.121212When
the speculator withhold $r$, he must also withhold $x$ because the disclosure
of $x$ reveals that the speculator is informed about $r$.

The equilibrium concept we use is Grossman–Perry–Farrell equilibrium (GPFE)
defined in Bertomeu and Cianciaruso (2018), which is a refinement of perfect
Bayesian equilibrium (PBE). A strategy profile $\zeta$ is a PBE if: (i) The
speculator’s disclosure and trading strategy maximizes his expected profit,
given the market’s pricing function $P_{2}(.)$; (ii) For any message $m\in
d(T)$, the market’s pricing function satisfies: $P_{2}(m)=E[\theta|t\in
d^{-1}(m)]$.

PBE does not put restrictions on off-equilibrium beliefs. In our game, the
message $(r,\varnothing)$ can be off-equilibrium, which requires us to apply
equilibrium refinement techniques to pin-down the market’s belief. Definition
2 adapts the definition of self-signaling set from Bertomeu and Cianciaruso
(2018) to our context.

###### Definition 2

A non-empty set $\chi$ of types is self-signaling relative to $\zeta$ if there
exists an off-equilibrium message $m^{*}$ such that: (i) Conditional on
receiving $m^{*}$, the market believes that the speculator’s type is in $\chi$
(i.e., $P_{2}(m^{*})=E[\theta|t\in\chi]$). (ii) Types in $\chi$ strictly
benefit from sending $m^{*}$. (iii) Types not in $\chi$ do not benefit from
sending $m^{*}$.

The idea of Definition 2 is that an equilibrium is not sensible if some types
can send a “convincing” off-equilibrium message: The types sending the message
become strictly better-off if the market holds the correct belief that the
message come from these types. We say $\zeta$ is a GPFE if it is a PBE and
there is no self-signaling set.

We use $\theta_{ND}$ to denote the market’s posterior expectation of $\theta$
conditional on non-disclosure (i.e., when there is no disclosure by the
speculator and also $\theta$ is not revealed by other sources). We assume
$\theta_{ND}<r_{0}\mu_{0}$ without loss of generality.131313The proof for the
case $\theta_{ND}\geq r_{0}\mu_{0}$ is completely symmetrical. We use $W_{r}$
to denote the set of withheld values of $r$:
$W_{r}=\\{r|d(r,x)=(\varnothing,\varnothing)\text{ for some $x$},\text{ or
}d(r,\varnothing)=(\varnothing,\varnothing)\\}$. We further decompose $W_{r}$
into two mutually exclusive subsets, based on whether
$d(r,\varnothing)=(\varnothing,\varnothing)$:
$W_{a}=\\{r|d(r,\varnothing)=(r,\varnothing),\text{ and
}d(r,x)=(\varnothing,\varnothing)\text{ for some $x$}\\}$;
$W_{b}=\\{r|d(r,\varnothing)=(\varnothing,\varnothing)\\}$.141414Note that
$W_{a}\cup W_{b}=W_{r}$ and $W_{a}\cap W_{b}=\varnothing$.

We next establish a lemma that pins down the speculator’s disclosure strategy
when he is informed about both $r$ and $x$.

###### Lemma 3

If the speculator is informed about both $r$ and $x$ and
$d(r,x)=(\varnothing,\varnothing)$, the speculator takes a short position.

##### Proof:

We proof Lemma 3 by contradiction. Suppose there exists a type $(r,x)$, who
chooses $d(r,x)=(\varnothing,\varnothing)$ and takes a long position. This
type expects the date 3 price to be:

$\displaystyle
E[P_{2}|t=(r,x),m=(\varnothing,\varnothing)]=(1-q)\theta_{ND}+qrx.$ (4)

Since the speculator takes a long position, the expected date 3 price should
be higher than the prior:
$E[P_{2}|t=(r,x),m=(\varnothing,\varnothing)]=(1-q)\theta_{ND}+qrx\geq
P_{1}=r_{0}\mu_{0}$. Because $\theta_{ND}<r_{0}\mu_{0}$, we have
$rx>r_{0}\mu_{0}>\theta_{ND}$. However, if the speculator discloses both $r$
and $x$, the date 3 price will be $rx$, which is strictly higher than
$E[P_{2}|t=(r,x),m=(\varnothing,\varnothing)]$. We reach a contradiction
because the speculator can induce a higher price volatility (i.e., increase
his profit) by disclosing both $r$ and $x$. Therefore, the speculator must
take a short position. $\square$

Having finished the preparations, we prove Proposition 1 by contradiction.
Suppose a non-zero measure of types withhold $r$ in equilibrium (i.e., $W_{r}$
has non-zero measure). We will proceed in several steps. In Step 2, we will
reach a contradiction and prove Proposition 1 under the assumption that
$W_{b}$ is empty. In Step 3, we establish some facts about the speculator’s
disclosure strategy when $r\in W_{b}$. In Step 4, we use Bayes’ rule to
calculate $\theta_{ND}$ and derive conditions for the equilibrium disclosure
thresholds. In Step 5, we apply Definition 2 and show that $W_{b}$ is empty if
the equilibrium survives the self-signaling test, thus completing the proof.

#### Step 2: Reach a contradiction assuming $W_{b}$ is empty

Step 2 is similar to Step 0: We will show that some withholding types can make
a higher profit by disclosing both $r$ and $x$.

Use $A(r)$ to denote the set of $x$ in which the speculator withholds both $r$
and $x$ when $r\in W_{a}$. If $W_{b}=\varnothing$, we can calculate
$\theta_{ND}$ using Bayes’ rule:

$\displaystyle\theta_{ND}=\frac{\alpha\beta\int_{r\in
W_{a}}f(r)(\int_{\\{x|x\in A(r)\\}}g(x)dx)dr}{P}E[\theta|r\in W_{a},x\in
A(r)]+\frac{1-\alpha}{P}\mu_{0}r_{0},$

where $P=1-\alpha+\alpha\beta\int_{r\in W_{a}}f(r)(\int_{\\{x|x\in
A(r)\\}}g(x)dx)dr$, which is the total probability that there is no disclosure
by the speculator. Because $\theta_{ND}<r_{0}\mu_{0}$, we know $E[\theta|r\in
W_{a},x\in A(r)]<\theta_{ND}<r_{0}\mu_{0}$. If $W_{a}$ has non-zero measure,
there exists a type $(r_{s},x_{s})$ such that $r_{s}\in W_{a}$, $x_{s}\in
A(r_{s})$, and $r_{s}x_{s}<E[\theta|r\in W_{a},x\in A(r)]$. However, if this
type deviates and disclose both $r_{s}$ and $x_{s}$, the expected date 3 price
is
$E[P_{2}|t=(r_{s},x_{s}),m=(r_{s},x_{s})]=r_{s}x_{s}<(1-q)r_{s}x_{s}+q\theta_{ND}=E[P_{2}|t=(r_{s},x_{s}),m=(\varnothing,\varnothing)]$,
which implies price volatility (i.e., the profit from the short position) will
become strictly larger. Thus, $W_{a}$ must have zero-measure, and our initial
premise that $W_{r}$ has non-zero measure must be false, which implies the
speculator will always disclose $r$.

From this point forward, we will complete the proof by showing that $W_{b}$ is
empty.

#### Step 3: The disclosure strategy when $r\in W_{b}$

The definition of $W_{b}$ does not pin-down the disclosure strategy of types
who are informed about both $r$ and $x$ when $r\in W_{b}$. The following lemma
rules out the possibility $d(r,x)=(r,\varnothing)$ when $r\in W_{b}$.

###### Lemma 4

$d(r,x)\neq(r,\varnothing)$ when $r\in W_{b}$.

The proof of Lemma 4 is essentially the same as Step 0: Because
$d(r,\varnothing)=(\varnothing,\varnothing)$ when $r\in W_{b}$, the market is
certain that the speculator is informed about $x$ upon observing
$m=(r,\varnothing)$ with $r\in W_{b}$. This implies that
$d(r,x)\neq(r,\varnothing)$ when $r\in W_{b}$, as otherwise some types can
induce a higher price volatility (i.e., make a higher profit) by disclosing
both $r$ and $x$. For details of the proof, please see Section 1 of the online
appendix.

Lemma 4 implies that if the speculator is informed about both $r$ and $x$ and
if $r\in W_{b}$, the disclosure strategy only has two possibilities:
$d(r,x)\in\\{(r,x),(\varnothing,\varnothing)\\}$ (i.e., the message
$(r,\varnothing)$ is off-equilibrium when $r\in W_{b}$). We have established
in Lemma 3 that when $d(r,x)=(\varnothing,\varnothing)$, the speculator must
take a short position. Using $\pi_{q}(r,x)$ to denote his profit (price
volatility) in this case, we have
$\pi_{q}(r,x)=P_{1}-E[P_{2}|t=(r,x),m=(\varnothing,\varnothing)]=r_{0}\mu_{0}-((1-q)\theta_{ND}+qrx)$.
When $d(r,x)=(r,x)$, the speculator takes a short position when
$rx<r_{0}\mu_{0}$ and a long position when $rx>r_{0}\mu_{0}$. Thus, his profit
(price volatility) is $\pi(r,x)=|rx-r_{0}\mu_{0}|$. The speculator compares
$\pi(r,x)$ with $\pi_{q}(r,x)$ to determine his optimal strategy. It is
straightforward that $\pi(r,x)\leq\pi_{q}(r,x)$ if and only if
$rx\in[\theta_{ND},\frac{2r_{0}\mu_{0}-(1-q)\theta_{ND}}{1+q}]\equiv[\underline{\theta},\bar{\theta}]$,
which is an non-empty interval because $\theta_{ND}<r_{0}\mu_{0}$. Thus, when
the speculator is informed about both $r$ and $x$ and $r\in W_{b}$, he
withholds both when $rx\in[\underline{\theta},\bar{\theta}]$, and discloses
both when $rx\notin[\underline{\theta},\bar{\theta}]$. The disclosure
thresholds are determined by the following two equations:

$\displaystyle(1+q)\bar{\theta}+(1-q)\underline{\theta}=2r_{0}\mu_{0},$ (5)
$\displaystyle\underline{\theta}=\theta_{ND}.$ (6)

#### Step 4: Calculating $\theta_{ND}$

Define

$\displaystyle P$ $\displaystyle\equiv 1-\alpha+\alpha(1-\beta)\int_{r\in
W_{b}}f(r)dr+\alpha\beta\int_{r\in
W_{b}}f(r)(\int_{\\{x|rx\in[\underline{\theta},\bar{\theta}]\\}}g(x)dx)dr$
$\displaystyle+\alpha\beta\int_{r\in W_{a}}f(r)(\int_{\\{x|x\in
A(r)\\}}g(x)dx)dr,$

which is the total probability that there is no disclosure by the speculator.

We can calculate $\theta_{ND}$ using Bayes’ rule:

$\displaystyle\theta_{ND}$ $\displaystyle=\frac{\alpha\beta\int_{r\in
W_{a}}rf(r)(\int_{\\{x|x\in A(r)\\}}xg(x)dx)dr}{P}$
$\displaystyle+\frac{\alpha\beta\int_{r\in
W_{b}}rf(r)(\int_{\\{x|rx\in[\underline{\theta},\bar{\theta}]\\}}xg(x)dx)dr}{P}$
$\displaystyle+\frac{\alpha(1-\beta)\mu_{0}\int_{r\in W_{b}}rf(r)dr}{P}$
$\displaystyle+\frac{1-\alpha}{P}\mu_{0}r_{0},$ (7)

We further decompose $W_{b}$ into two subsets, based on whether $r$ is bigger
or smaller than the prior mean:
$W_{B}=\\{r|d(r,\varnothing)=(\varnothing,\varnothing),r\geq r_{0}\\}$ and
$W_{S}=\\{r|d(r,\varnothing)=(\varnothing,\varnothing),0<r<r_{0}\\}$. The
subscripts “B” and “S” represent big and small, respectively. Note that when
$W_{b}$ is non-empty, (6) has to hold. Plugging (6) into (7) and using a
similar technique as in Jung and Kwon (1988) to simplify (i.e., integration by
parts) leads to

$\displaystyle\int_{r\in
W_{B}}rf(r)(\beta\int_{\frac{\underline{\theta}}{r}}^{\frac{\bar{\theta}}{r}}(G(x)-G(\frac{\bar{\theta}}{r}))dx-(1-\beta)(\mu_{0}-\frac{\underline{\theta}}{r}))dr$
$\displaystyle+$ $\displaystyle\int_{r\in
W_{S}}rf(r)(\beta\int_{\frac{\underline{\theta}}{r}}^{\frac{\bar{\theta}}{r}}(G(x)-G(\frac{\bar{\theta}}{r}))dx-(1-\beta)(\mu_{0}-\frac{\underline{\theta}}{r}))dr$
$\displaystyle+$ $\displaystyle\beta(\underline{\theta}\int_{r\in
W_{a}}f(r)(\int_{\\{x|x\in A(r)\\}}g(x)dx)dr-\int_{r\in
W_{a}}rf(r)(\int_{\\{x|x\in A(r)\\}}xg(x)dx)dr)$ $\displaystyle-$
$\displaystyle\frac{1-\alpha}{\alpha}(r_{0}\mu_{0}-\underline{\theta})$
$\displaystyle=$ $\displaystyle 0.$ (8)

We use $\zeta$ to denote the strategy profile characterized by the disclosure
thresholds $\underline{\theta}$ and $\bar{\theta}$ that satisfy (5), (6), and
(8).

#### Step 5: Equilibrium refinement

Finally, we demonstrate that if $\zeta$ passes the self-signaling test in
Definition 2, then (8) cannot hold as all 4 terms on the left-hand-side of (8)
are negative. This, in turn, implies that $W_{b}=\varnothing$, since (8) must
hold if $W_{b}\neq\varnothing$. The construction of self-signaling set
involves applying the equilibrium properties in Proposition 2 and 2A. The
details of this step can be found at Section 1 of the online appendix.

### Proof of Proposition 2

As established in Lemma 1, the speculator withholds $x$ if and only if
$\pi_{q}(x)\geq\pi(x)$ ($\pi_{q}(x)$ and $\pi(x)$ are defined in equations (2)
and (3)). The simplification of this inequality requires us to determine the
relation between $r\mu_{ND}$ and $r_{0}\mu_{0}$. It can be easily shown that
when $r\mu_{ND}\geq r_{0}\mu_{0}$, the equilibrium conditions have no
solution, implying that no equilibrium exists in this case.151515The proof of
this claim is at Section 2 of the online appendix. When
$r\mu_{ND}<r_{0}\mu_{0}$, it is straightforward that $\pi_{q}(x)\geq\pi(x)$ if
and only if $x\in[\underline{x},\bar{x}]$, where the thresholds are determined
by:

$\displaystyle\underline{x}=\mu_{ND},$ (9)
$\displaystyle\bar{x}=\frac{2r_{0}\mu_{0}-(1-q)r\mu_{ND}}{(1+q)r}.$ (10)

The last piece to pin down the equilibrium is to use Bayes’ rule to calculate
$\mu_{ND}$ in equilibrium:

$\mu_{ND}=\frac{1-\beta}{1-\beta+\beta\int_{\underline{x}}^{\bar{x}}g(x)dx}\mu_{0}+\frac{\beta\int_{\underline{x}}^{\bar{x}}g(x)dx}{1-\beta+\beta\int_{\underline{x}}^{\bar{x}}g(x)dx}E[x|x\in[\underline{x},\bar{x}]].$
(11)

We can rewrite (9), (10), and (11) as

$\displaystyle\beta\int_{\underline{x}}^{\bar{x}}(G(x)-G(\bar{x}))dx-(1-\beta)(\mu_{0}-\underline{x})=0,$
(12) $\displaystyle(1+q)\bar{x}+(1-q)\underline{x}=\frac{2r_{0}\mu_{0}}{r},$
(13)

where (12) follows from (9) and (11) by using a similar technique as in Jung
and Kwon (1988) (i.e., integration by parts), and (13) follows from (9) and
(10).

(12) and (13) can be transformed to a single condition on $\underline{x}$:

$\displaystyle
Q(\underline{x})\equiv\beta\int_{\underline{x}}^{\frac{2r_{0}\mu_{0}}{(1+q)r}-\frac{1-q}{1+q}\underline{x}}(G(x)-G(\frac{2r_{0}\mu_{0}}{(1+q)r}-\frac{1-q}{1+q}\underline{x}))dx-(1-\beta)(\mu_{0}-\underline{x})=0.$
(14)

Since
$Q^{\prime}(\underline{x})=\beta(G(\bar{x})-G(\underline{x}))+\beta\int_{\underline{x}}^{\bar{x}}\frac{1-q}{1+q}g(\bar{x})dx+(1-\beta)>0$,
$Q(.)$ is an increasing function of $\underline{x}$. Furthermore,
$Q(\frac{r_{0}\mu_{0}}{r})=-(1-\beta)(\mu_{0}-\frac{r_{0}\mu_{0}}{r})>0$ and
$Q(\mu_{0})<0$. Thus, there exists a unique
$\underline{x}\in(\mu_{0},\frac{r_{0}\mu_{0}}{r})$ that solves (14), which
confirms that the equilibrium exists and is unique.

Finally, according to equations (2) and (3), $\pi_{q}(x)=0$ when
$x=\frac{r_{0}\mu_{0}-(1-q)r\mu_{ND}}{qr}$, and $\pi(x)=0$ when
$x=\frac{r_{0}\mu_{0}}{r}$. Since $r\mu_{ND}<r_{0}\mu_{0}$ in equilibrium, we
have $\frac{r_{0}\mu_{0}-(1-q)r\mu_{ND}}{qr}>\frac{r_{0}\mu_{0}}{r}$, which
implies that the two intersections of $\pi_{q}(x)$ and $\pi(x)$ are located at
the downward sloping part of $\pi_{q}(x)$, as shown in Figure 2. In other
words, when $x\in[\underline{x},\bar{x}]$, we have
$(1-q)r\mu_{ND}+qrx<r_{0}\mu_{0}$ so that the expected date 3 price is lower
than the date 1 price. Therefore, the speculator must take a short position in
regions B and C.

### The equilibrium when $r>r_{0}$

###### Proposition 2A

When $r>r_{0}$, the speculator’s equilibrium disclosure and trading decisions
are characterized by three regions:

  1. 1.

For $x\in(-\infty,\underline{x})$, the speculator takes a short position and
discloses $x$.

  2. 2.

For $x\in[\underline{x},\bar{x}]$, the speculator takes a long position and
withholds $x$.

  3. 3.

For $x\in(\bar{x},+\infty)$, the speculator takes a long position and
discloses $x$.

  4. 4.

Manipulative buying arises for $x\in[\underline{x},\frac{r_{0}\mu_{0}}{r}]$.

##### Proof:

Following a similar procedure as the proof of Proposition 2, we can show that
no equilibrium exists in the case $r\mu_{ND}\leq r_{0}\mu_{0}$. When,
$r\mu_{ND}>r_{0}\mu_{0}$, $\pi_{q}(x)\geq\pi(x)$ if and only if
$x\in[\underline{x},\bar{x}]$, where the thresholds are determined by:

$\displaystyle\bar{x}=\mu_{ND},$ (15)
$\displaystyle\underline{x}=\frac{2r_{0}\mu_{0}-(1-q)r\mu_{ND}}{(1+q)r}.$ (16)

In addition, by Bayes’ rule,

$\mu_{ND}=\frac{1-\beta}{1-\beta+\beta\int_{\underline{x}}^{\bar{x}}g(x)dx}\mu_{0}+\frac{\beta\int_{\underline{x}}^{\bar{x}}g(x)dx}{1-\beta+\beta\int_{\underline{x}}^{\bar{x}}g(x)dx}E[x|x\in[\underline{x},\bar{x}]].$
(17)

(15)-(17) simplify to:

$\displaystyle\beta\int_{\underline{x}}^{\bar{x}}(G(x)-G(\underline{x}))dx-(1-\beta)(\mu_{0}-\bar{x})=0,$
(18) $\displaystyle(1-q)\bar{x}+(1+q)\underline{x}=\frac{2r_{0}\mu_{0}}{r},$
(19)

Combining (18) and (19) leads to

$\displaystyle
R(\bar{x})\equiv\beta\int_{\frac{2r_{0}\mu_{0}}{(1+q)r}-\frac{1-q}{1+q}\bar{x}}^{\bar{x}}(G(x)-G(\frac{2r_{0}\mu_{0}}{(1+q)r}-\frac{1-q}{1+q}\bar{x}))dx-(1-\beta)(\mu_{0}-\bar{x})=0.$
(20)

$R(.)$ is an increasing function of $\bar{x}$ as
$R^{\prime}(\bar{x})=\beta(G(\bar{x})-G(\underline{x}))+\beta\int_{\underline{x}}^{\bar{x}}\frac{1-q}{1+q}g(\underline{x})dx+(1-\beta)>0$.
Furthermore, $R(\frac{r_{0}\mu_{0}}{r})<0$ and $R(\mu_{0})>0$. Thus, there
exists a unique $\bar{x}\in(\frac{r_{0}\mu_{0}}{r},\mu_{0})$ that solves (20),
which confirms that the equilibrium exists and is unique. Finally, the proof
for speculator taking a long position when withholding $x$ is symmetrical to
Proposition 2 and is therefore omitted. $\square$

### Proof of Proposition 3

Let
$K(\underline{x},\bar{x},\beta)\equiv\beta\int_{\underline{x}}^{\bar{x}}(G(x)-G(\bar{x}))dx-(1-\beta)(\mu_{0}-\underline{x})=0$.
Differentiating (12) and (13) with respect to $\beta$ and applying the
Implicit Function Theorem, we have

$\displaystyle\frac{\partial\bar{x}}{\partial\beta}=\frac{-K_{\beta}}{K_{\bar{x}}-\frac{1+q}{1-q}K_{\underline{x}}},$
$\displaystyle\frac{\partial\underline{x}}{\partial\beta}=\frac{-K_{\beta}}{K_{\underline{x}}-\frac{1-q}{1+q}K_{\bar{x}}}.$

Since $K_{\underline{x}}>0$, $K_{\bar{x}}<0$, and $K_{\beta}<0$, we have
$\frac{\partial\bar{x}}{\partial\beta}<0$ and
$\frac{\partial\underline{x}}{\partial\beta}>0$.

Differentiating (12) and (13) with respect to $q$ and applying the Implicit
Function Theorem, we have

$\displaystyle\frac{\partial\bar{x}}{\partial
q}=\frac{\underline{x}-\bar{x}}{1+q-(1-q)\frac{K_{\bar{x}}}{K_{\underline{x}}}},$
$\displaystyle\frac{\partial\underline{x}}{\partial
q}=\frac{\underline{x}-\bar{x}}{1-q-(1+q)\frac{K_{\underline{x}}}{K_{\bar{x}}}}.$

Since $K_{\underline{x}}>0$ and $K_{\bar{x}}<0$, we have
$\frac{\partial\bar{x}}{\partial q}<0$ and
$\frac{\partial\underline{x}}{\partial q}<0$.

### Empirical implications for the case $r>r_{0}$

###### Proposition 3A

When the initial signal is favorable (i.e., $r>r_{0}$):

  1. 1.

The elaborateness of reports increases in the speculator’s competence. That
is, $\frac{\partial\bar{x}}{\partial\beta}>0$ and
$\frac{\partial\underline{x}}{\partial\beta}<0$.

  2. 2.

The frequency of positive (negative) elaborate reports decreases (increases)
in the firm’s information environment. That is,
$\frac{\partial\bar{x}}{\partial q}>0$ and
$\frac{\partial\underline{x}}{\partial q}>0$.

  3. 3.

The extremity of elaborate reports decreases in the speculator’s competence.
The extremity of positive (negative) reports increases (decreases) in the
firm’s information environment.

  4. 4.

Holding constant the initial evidence, the stock price reaction to a simple
report decreases in the speculator’s competence and increases in the firm’s
information environment.

  5. 5.

The frequency of manipulative buying decreases in the speculator’s competence
and the firm’s information environment.

##### Proof:

Let
$J(\underline{x},\bar{x},\beta)\equiv\beta\int_{\underline{x}}^{\bar{x}}(G(x)-G(\underline{x}))dx-(1-\beta)(\mu_{0}-\bar{x})$.
Differentiating (18) and (19) with respect to $\beta$ and applying the
Implicit Function Theorem, we have

$\displaystyle\frac{\partial\bar{x}}{\partial\beta}=\frac{-J_{\beta}}{J_{\bar{x}}-\frac{1-q}{1+q}J_{\underline{x}}},$
$\displaystyle\frac{\partial\underline{x}}{\partial\beta}=\frac{-J_{\beta}}{J_{\underline{x}}-\frac{1+q}{1-q}J_{\bar{x}}}.$

Since $J_{\underline{x}}<0$, $J_{\bar{x}}>0$, and $J_{\beta}>0$, we have
$\frac{\partial\bar{x}}{\partial\beta}<0$ and
$\frac{\partial\underline{x}}{\partial\beta}>0$.

Differentiating (18) and (19) with respect to $q$ and applying the Implicit
Function Theorem, we have

$\displaystyle\frac{\partial\bar{x}}{\partial
q}=\frac{\bar{x}-\underline{x}}{1-q-(1+q)\frac{J_{\bar{x}}}{J_{\underline{x}}}},$
$\displaystyle\frac{\partial\underline{x}}{\partial
q}=\frac{\bar{x}-\underline{x}}{1+q-(1-q)\frac{J_{\underline{x}}}{J_{\bar{x}}}}.$

Since $J_{\underline{x}}<0$, $J_{\bar{x}}>0$, we have
$\frac{\partial\bar{x}}{\partial q}>0$ and
$\frac{\partial\underline{x}}{\partial q}>0$. $\square$

## References

  * Arya et al. (2010) Arya, Anil, Hans Frimor, and Brian Mittendorf (2010), “Discretionary disclosure of proprietary information in a multisegment firm.” _Management Science_ , 56, 645–658.
  * Bagnoli and Watts (2007) Bagnoli, Mark and Susan G Watts (2007), “Financial reporting and supplemental voluntary disclosures.” _Journal of Accounting Research_ , 45, 885–913.
  * Benabou and Laroque (1992) Benabou, Roland and Guy Laroque (1992), “Using privileged information to manipulate markets: Insiders, gurus, and credibility.” _The Quarterly Journal of Economics_ , 107, 921–958.
  * Bertomeu and Cheynel (2015) Bertomeu, Jeremy and Edwidge. Cheynel (2015), “Disclosure and the cost of capital.” _The Routledge Companion to Financial Accounting Theory_ , 366–395.
  * Bertomeu and Cianciaruso (2018) Bertomeu, Jeremy and Davide Cianciaruso (2018), “Verifiable disclosure.” _Economic Theory_ , 65, 1011–1044.
  * Bertomeu et al. (2020) Bertomeu, Jeremy, Paul Ma, and Iván Marinovic (2020), “How often do managers withhold information?” _The Accounting Review_ , 95, 73–102.
  * Bertomeu and Magee (2011) Bertomeu, Jeremy and Robert P Magee (2011), “From low-quality reporting to financial crises: Politics of disclosure regulation along the economic cycle.” _Journal of Accounting and Economics_ , 52, 209–227.
  * Bertomeu et al. (2022) Bertomeu, Jeremy, Iván Marinovic, Stephen J Terry, and Felipe Varas (2022), “The dynamics of concealment.” _Journal of Financial Economics_ , 143, 227–246.
  * Beyer et al. (2010) Beyer, Anne, Daniel A Cohen, Thomas Z Lys, and Beverly R Walther (2010), “The financial reporting environment: Review of the recent literature.” _Journal of Accounting and Economics_ , 50, 296–343.
  * Beyer and Dye (2023) Beyer, Anne and Ronald A Dye (2023), “On the disclosure of half-truths and the duty to update.” _Management Science_ , 69, 4283–4311.
  * Beyer and Guttman (2012) Beyer, Anne and Ilan Guttman (2012), “Voluntary disclosure, manipulation, and real effects.” _Journal of Accounting Research_ , 50, 1141–1177.
  * Brendel and Ryans (2021) Brendel, Janja and James Ryans (2021), “Responding to activist short sellers: allegations, firm responses, and outcomes.” _Journal of Accounting Research_ , 59, 487–528.
  * Cheynel and Levine (2020) Cheynel, Edwige and Carolyn B Levine (2020), “Public disclosures and information asymmetry: A theory of the mosaic.” _The Accounting Review_ , 95, 79–99.
  * Durston (2021) Durston, Gregory (2021), “Muddying the waters: when does short selling become market manipulation?” _Journal of Financial Crime_.
  * Dye (1985) Dye, Ronald A (1985), “Disclosure of nonproprietary information.” _Journal of Accounting Research_ , 23.
  * Dye (2001) Dye, Ronald A (2001), “An evaluation of ”Essays on disclosure” and the disclosure literature in accounting.” _Journal of Accounting and Economics_ , 32, 181–235.
  * Dye and Finn (2007) Dye, Ronald A and Mark Finn (2007), “Equilibrium voluntary disclosures when firms possess random multi-dimensional private information.” In _Essays in Accounting Theory in Honour of Joel S. Demski_ , 53–72, Springer.
  * Dyer and Kim (2021) Dyer, Travis and Eunjee Kim (2021), “Anonymous equity research.” _Journal of Accounting Research_ , 59, 575–611.
  * Ebert et al. (2017) Ebert, Michael, Dirk Simons, and Jack D Stecher (2017), “Discretionary aggregation.” _The accounting review_ , 92, 73–91.
  * Einhorn (2007) Einhorn, E. (2007), “Voluntary disclosure under uncertainty about the reporting objective.” _Journal of Accounting and Economics_ , 43, 245–274.
  * Einhorn (2005) Einhorn, Eti (2005), “The nature of the interaction between mandatory and voluntary disclosures.” _Journal of Accounting Research_ , 43, 593–621.
  * Einhorn (2018) Einhorn, Eti (2018), “Competing information sources.” _The Accounting Review_ , 93, 151–176.
  * Einhorn and Ziv (2008) Einhorn, Eti and Amir Ziv (2008), “Intertemporal dynamics of corporate voluntary disclosures.” _Journal of Accounting Research_ , 46, 567–589.
  * Farrell et al. (2022) Farrell, Michael, T Clifton Green, Russell Jame, and Stanimir Markov (2022), “The democratization of investment research and the informativeness of retail investor trading.” _Journal of Financial Economics_ , 145, 616–641.
  * Fischer and Verrecchia (2000) Fischer, Paul E and Robert E Verrecchia (2000), “Reporting bias.” _The Accounting Review_ , 75, 229–245.
  * Gao et al. (2020) Gao, Pingyang, Xu Jiang, and Jinzhi Lu (2020), “Manipulation, panic runs, and the short selling ban.” _Available at SSRN 3540328_.
  * Glosten and Milgrom (1985) Glosten, L.R. and P.R. Milgrom (1985), “Bid, ask and transaction prices in a specialist market with heterogeneously informed traders.” _Journal of Financial Economics_ , 14, 71–100.
  * Goldstein and Guembel (2008) Goldstein, Itay and Alexander Guembel (2008), “Manipulation and the allocational role of prices.” _The Review of Economic Studies_ , 75, 133–164.
  * Guttman et al. (2014) Guttman, Ilan, Ilan Kremer, and Andrzej Skrzypacz (2014), “Not only what but also when: A theory of dynamic voluntary disclosure.” _American Economic Review_ , 104, 2400–2420.
  * Hughes and Pae (2004) Hughes, John S and Suil Pae (2004), “Voluntary disclosure of precision information.” _Journal of Accounting and Economics_ , 37, 261–289.
  * Jackson (2005) Jackson, Andrew R (2005), “Trade generation, reputation, and sell-side analysts.” _The journal of finance_ , 60, 673–717.
  * Jones (1991) Jones, Jennifer J (1991), “Earnings management during import relief investigations.” _Journal of accounting research_ , 29, 193–228.
  * Jung and Kwon (1988) Jung, Woon-Oh and Young K Kwon (1988), “Disclosure when the market is unsure of information endowment of managers.” _Journal of Accounting Research_ , 146–153.
  * Karmaziene (2023) Karmaziene, Egle (2023), “The greater the volume, the greater the analyst.” _Finance Research Letters_ , 51, 103377.
  * Kyle (1985) Kyle, A.S. (1985), “Continuous auctions and insider trading.” _Econometrica_ , 53, 1315–1335.
  * Ljungqvist and Qian (2016) Ljungqvist, Alexander and Wenlan Qian (2016), “How constraining are limits to arbitrage?” _The Review of Financial Studies_ , 29, 1975–2028.
  * Marinovic et al. (2013) Marinovic, Iván, Marco Ottaviani, and Peter Sorensen (2013), “Forecasters’ objectives and strategies.” In _Handbook of economic forecasting_ , volume 2, 690–720, Elsevier.
  * Michelle (2022) Michelle, Celarier (2022), “Are activist short sellers misunderstood?” _The New York Times_.
  * Mitts (2020) Mitts, Joshua (2020), “Short and distort.” _The Journal of Legal Studies_ , 49, 287–334.
  * Myers and Majluf (1984) Myers, Stewart C and Nicholas S Majluf (1984), “Corporate financing and investment decisions when firms have information that investors do not have.” _Journal of Financial Economics_ , 13, 187–221.
  * Pae (2005) Pae, Suil (2005), “Selective disclosures in the presence of uncertainty about information endowment.” _Journal of Accounting and Economics_ , 39, 383–409.
  * Paugam et al. (2020) Paugam, Luc, Hervé Stolowy, and Yves Gendron (2020), “Deploying narrative economics to understand financial market dynamics: An analysis of activist short sellers’ rhetoric.” _Contemporary Accounting Research_.
  * Porzecanski and Schoenberg (2022) Porzecanski, Katia and Tom Schoenberg (2022), “Vast doj probe looks at almost 30 short-selling firms and allies.” _Bloomberg_.
  * Schmidt (2020) Schmidt, Daniel (2020), “Stock market rumors and credibility.” _The Review of Financial Studies_ , 33, 3804–3853.
  * Shin (1994) Shin, Hyun Song (1994), “News management and the value of firms.” _The RAND Journal of Economics_ , 58–71.
  * Stocken (2013) Stocken, P. (2013), “Strategic accounting disclosure.” _Foundations and Trends® in Accounting_ , 7, 197–291, URL http://dx.doi.org/10.1561/1400000027.
  * Van Bommel (2003) Van Bommel, Jos (2003), “Rumors.” _The journal of Finance_ , 58, 1499–1520.
  * Verrecchia (2001) Verrecchia, R.E. (2001), “Essays on disclosure.” _Journal of Accounting and Economics_ , 32, 97–180.
  * Verrecchia (1983) Verrecchia, Robert E (1983), “Discretionary disclosure.” _Journal of accounting and economics_ , 5, 179–194.
  * Zhao (2020) Zhao, Wuyang (2020), “Activist short-selling and corporate opacity.” _Available at SSRN 2852041_.


# Cost Aware Untargeted Poisoning Attack against Graph Neural Networks1112023
IEEE. Personal use of this material is permitted. Permission from IEEE must be
obtained for all other uses, in any current or future media, including
reprinting/republishing this material for advertising or promotional purposes,
creating new collective works, for resale or redistribution to servers or
lists, or reuse of any copyrighted component of this work in other works.

###### Abstract

Graph Neural Networks (GNNs) have become widely used in the field of graph
mining. However, these networks are vulnerable to structural perturbations.
While many research efforts have focused on analyzing vulnerability through
poisoning attacks, we have identified an inefficiency in current attack
losses. These losses steer the attack strategy towards modifying edges
targeting misclassified nodes or resilient nodes, resulting in a waste of
structural adversarial perturbation. To address this issue, we propose a novel
attack loss framework called the Cost Aware Poisoning Attack (CA-attack) to
improve the allocation of the attack budget by dynamically considering the
classification margins of nodes. Specifically, it prioritizes nodes with
smaller positive margins while postponing nodes with negative margins. Our
experiments demonstrate that the proposed CA-attack significantly enhances
existing attack strategies.

Index Terms—  Poisoning attack, graph neural networks, node classification.

##  1 Introduction

Graph Neural Networks (GNNs) [1, 2, 3] have emerged as an effective machine
learning approach for structured data, generalizing neural networks to manage
graph-structured information. They have shown potential in various
applications such as social network analysis [4], anomaly detection [5, 6, 7],
and natural language processing [8], excelling in tasks like node
classification and link prediction. However, current research [9, 10]
indicated that they are susceptible to poisoning attacks, where the attack
easily manipulates the graph structure (i.e., adding/deleting edges) before
the training of the GNN models, and leads to incorrect predictions. Such
vulnerabilities not only compromise the model’s reliability but also present
opportunities for malicious attacks.

To analyze the vulnerabilities of GNNs, several studies have investigated
potential poisoning attacks on GNNs, such as Minmax [11], Metattack [12], and
certify robustness inspired attack framework [13]. These attacks leverage
gradient-based techniques to approximate the complex bi-level optimization
problem associated with poisoning attacks. Nonetheless, there is still
potential for enhancing the current methodologies regarding the allocation of
the limited perturbation budget.

We have noted Metattack with current loss functions such as negative log
likelihood loss and CW loss [14] has budget waste problem that some budgets do
not contribute to decrease the classification accuracy. For example, when
employing the commonly used negative log likelihood loss as the attack
objective, a node that has already been successfully misclassified tends to
attract higher meta-gradients, resulting in a further allocation of the attack
budget to that specific node. Wang et al. [13] have proposed a novel attack
loss framework called the Certify Robustness Inspired Framework (CR-framework)
to enhance the attack performance. This method assigns larger meta-gradients
to nodes with smaller certify robustness sizes [13], as these nodes are more
vulnerable to attacks. It accomplishes this by reweighting the loss of each
node according to its certify robustness size. While this approach optimizes
the budget allocation for existing attack losses and further decreases the
accuracy of victim models, it grapples with computational inefficiencies
during the assessment of certified robustness sizes.

To address the limitations above, we introduce a Cost Aware Poisoning Attack
Loss Framework (CA-attack) to improve the allocation of attack budget to
maximize the impact of the attack. Specifically, we dynamically reweight the
nodes according to their classification margins in the attack loss. This means
that the weights of the nodes are adjusted during the optimization process of
the attack objective. Through extensive testing on benchmark datasets, the CA-
attack consistently surpasses previous attack methods in terms of
effectiveness. Our research makes the following contributions:

  * •

To address the inefficiencies of budget allocation, we propose the CA-attack,
a budget-efficient attack loss framework.

  * •

Through rigorous empirical assessments on three datasets, we demonstrate that
CA-attack improves existing methods, highlighting its potential as a plug-and-
play solution for various graph poisoning attacks.

##  2 Preliminaries

#### GNNs

We define an undirected graph as $G=\left(V,E\right)$, where
$V=\\{v_{1},v_{2},\cdots,v_{N}\\}$ represents the node set, and $e_{ij}\in E$
is edge connecting the nodes $v_{i}$ and $v_{j}$. Node attributes are
represented by $X\in\mathbb{R}^{N\times d}$, where $d$ is the dimension of the
attribute. Additionally, the graph structure can be represented by an
adjacency matrix $A\in\\{0,1\\}^{N\times N}$, with $A_{ij}=1$ if an edge
exists between two nodes, otherwise $0$. Given a subset of labeled nodes
$V_{L}\subset V$ where each node $v\in V_{L}$ has a label
$y_{v}\in\mathcal{C}=\\{c_{1},c_{2},\cdots,c_{k}\\}$, GNNs aim to learn a
function $f_{\theta}$ to predict the remaining unlabeled nodes
$V_{U}=V\setminus V_{L}$ into classes of $\mathcal{C}$. We use
$f_{\theta}(G)_{v}$ to denote the prediction of the model $f_{\theta}$ for
node $v$. Its parameters $\theta$ are optimized by minimizing a loss
$\mathcal{L}_{train}$ over the labeled nodes, typically using losses like
negative log-likelihood loss or CW loss.

#### Attacks against GNNs

Based on the classification task, the general form of node-level graph
adversarial attacks can be defined as a bi-level optimization process where
the attacker optimizes the allocation of the attack budget to maliciously
modify the graph, while the model is optimized using this poisoned graph:

$\displaystyle\begin{aligned}
\min\mathcal{L}_{atk}\left(f_{\theta^{*}}\left(\widehat{G}\right)\right)=\sum_{v\in
V}{\ell_{atk}\left(f_{\theta^{*}}\left(\widehat{G}\right)_{v},y_{v}\right)}\\\
s.t.,\theta^{*}=\underset{\theta}{arg\min}\mathcal{L}_{train}\left(f_{\theta}\left(\widehat{G}\right)\right),\end{aligned}$
(1)

where $\ell_{atk}$ is the attack loss and usually chosen as
$\ell_{atk}=-\mathcal{L}_{train}$. $\widehat{G}$ is the graph modified from
original $G$ by the adversarial attack. $y_{v}$ denotes the labels of node
$v$.

Given a budget $\Delta$, the attacker aims to ensure that perturbations are
unnoticeable by maintaining the $l_{0}$ norm difference between the original
and perturbed graph: $\left\|A-A^{\prime}\right\|_{0}\leq\Delta$. To avoid
detection, the attacker also refrains from making significant changes to the
graph’s degree distribution or introducing isolated nodes, as suggested in
[15].

A conventional poisoning attack process can be divided into three steps. The
first step is to retrain a surrogate model $f_{\theta^{*}}\left(G\right)$
using a linearized graph convolutional network (GCN) which is expressed as:

$\displaystyle f_{\theta}\left(G\right)=soft\max\left(\hat{A}^{2}XW\right),$
(2)

where $\hat{A}=D^{-1/2}\left(A+I\right)D^{-1/2}$ is the normalized adjacent
matrix, $X$ are the node features, $D$ is the diagonal matrix of the node
degrees, and $\theta=\left\\{W\right\\}$ are the set of learnable parameters.
In the second step, the attacker uses pseudo-labels $y_{v}$ generated by the
surrogate model $f_{\theta^{*}}\left(G\right)$ to construct the attack loss of
the node $v$ as
$\ell\left(f_{\theta^{*}}\left(\widehat{G}\right)_{v},y_{v}\right)$ under the
gray-box attack scenario. In the third step, the attack loss of each node is
backpropagated to produce a partial gradient matrix:

$\displaystyle
g_{v}=\nabla_{A}\ell\left(f_{\theta^{*}}\left(\widehat{G}\right)_{v},y_{v}\right),$
(3)

The overall gradient information passed to the attack strategy is the average
of all the partial gradient matrices. Thereafter, the attacker selects the
edges to be perturbed (adding/deleting) based on the saliency of their
gradients.

##  3 Cost-Aware Attack

In this section, we demonstrate our proposed CA-attack attack loss framework
that aims to improve the approximation of this challenging bi-level
optimization problem (1) by redesigning the $\mathcal{L}_{atk}$. Specifically,
we incorporate the classification margin of nodes as dynamic weights for the
attack loss.

###  3.1 Limitations of Previous Attacks

Since poisoning attack aims to minimize the attack loss (i.e., maximize
training loss) by modifying an edge with the largest gradient at each
iteration, the node connected to this edge will be attacked with higher
priority according to Equation (3). Figure 1 illustrates the priority of a
node in a clean graph to be attacked based on the $l_{2}$ norm of partial
gradient matric for each node in Metattack using different attack loss
functions. We can observe that the negative log-likelihood loss and the CR
framework result in significant gradients for nodes with negative margins.
Additionally, the negative log-likelihood loss produces significant gradients
for nodes with large margins. In contrast, our CA framework generates
significant gradients on nodes with small positive margins. In Section 4, we
will demonstrate that the CA attack loss outperforms previous attack losses.

$\mathcal{L}_{CE}$
$\left\|\bm{g_{v}}\vphantom{\rule{1.0pt}{1.0pt}}\right\|_{2}$

$\mathcal{L}_{CR}$

$\mathcal{L}_{CA}$

Fig. 1: Scatterplot of the nodes’ margins with $l_{2}$ norm of their partial
gradient matrices of cora dataset. The terms $\mathcal{L}_{CE}$,
$\mathcal{L}_{CR}$ [13], and $\mathcal{L}_{CA}$ respectively represent the
negative log likelihood loss, the CR framework, and the CA framework.

###  3.2 Cost Aware Loss

The classification margin of a node $v$ is commonly defined as:

$\displaystyle\varphi(v)=z_{c^{*}}-\max_{c\neq c^{*}}z_{c},$ (4)

where $z$ represents the vector of logits produced by the model towards node
$v$, and $c^{*}$ refers to the true label of the node $v$. If a node has a
negative margin, it indicates misclassification. Intuitively, a larger margin
suggests that a node is more resilient to attacks, whereas a smaller but
positive margin suggests a higher potential for a successful attack.

With this intuition in mind, we propose the introduction of a cost-aware loss
(CA-loss) that takes into account the margins of nodes. By doing so, our aim
is to assign higher priority to nodes with smaller but positive margins.

While a simplistic strategy is to rank the nodes based on margins and perturb
them sequentially, this approach is computationally demanding and potentially
suboptimal due to the complex interplay of nodes and edges in predictions.
Instead, we refine the attack loss $\ell_{atk}$ by incorporating node margins
to weight the nodes dynamically. The resulting CA-loss is defined as follows:

$\displaystyle\begin{aligned}
\mathcal{L}_{CA}\left(f_{\theta^{*}},\widehat{G}\right)=\sum_{v\in
V_{U}}{w\left(v\right)\cdot\ell\left(f_{\theta^{*}}\left(\widehat{G}\right)_{v},y_{v}\right)},\end{aligned}$
(5)

where $w\left(v\right)$ is the weight of the node $v$. When all nodes are
assigned equal weight, our CA-loss reduces to the conventional loss. To
introduce the weight $w(v)$, which captures the inverse relationship between
the node’s margin $\varphi(v)$ and the weight, we utilize the exponential
function. The weight $w(v)$ is defined as follows:

$\displaystyle\begin{aligned} w(v)=\alpha\times
e^{-\beta\times\varphi(v)^{2}},\end{aligned}$ (6)

where $\alpha$ and $\beta$ are tunable hyper-parameters. The weight $w(v)$
exponentially decreases as the node’s margin $\varphi(v)$ increases. Figure 2
is a visualization of $w(v)$. This property ensures that the majority of
perturbed edges are utilized to disrupt nodes with smaller margins during the
attack process.

Fig. 2: Weights of nodes in Cora dataset with different margins.

##  4 Experiments

In this section, We present the experimental results by answering the
following questions:

  * •

$RQ1$:Can our CA attack loss framework enhance the efficacy of current
poisoning attacks?

  * •

$RQ2$:Can our CA attack loss framework serve as a universal framework for
conventional poisoning attack losses?

  * •

$RQ3$:Is our framework more computationally efficient compared to baselines?

Table 1: Dataset statistics.Following [1], we only consider the largest connected component (LCC). Dataset | Nodes | Edges | Classes | Features
---|---|---|---|---
Cora | 2,485 | 5,069 | 7 | 1,433
Citeseer | 2,110 | 3,668 | 6 | 3,703
Polblogs | 1,222 | 16,714 | 2 | $/$
Table 2: Hyperparameters of CA. Dataset | $\alpha 1$ | $\alpha 2$ | $\beta 1$ | $\beta 2$
---|---|---|---|---
Cora | 4.5 | 1.0 | 1.0 | 1.0
Citeseer | 4.5 | 1.0 | 1.0 | 1.0
Polblogs | 1.0 | 1.0 | 0.5 | 0.1
Table 3: Experimental results of attacks for GCNs. The best results from each experiment are bold. Dataset | Cora | Citeseer | Polblogs
---|---|---|---
Pert Rate(%) | 5% | 10% | 5% | 10% | 5% | 10%
Clean | 84.61$\pm$0.28 | 73.95$\pm$0.28 | 95.34$\pm$0.19
DICE | 82.79$\pm$0.17 | 81.92$\pm$0.22 | 72.32$\pm$0.24 | 71.59$\pm$0.28 | 86.54$\pm$0.42 | 80.71$\pm$0.29
CE-MetaSelf | 76.56$\pm$0.27 | 66.96$\pm$0.55 | 71.49$\pm$0.39 | 66.20$\pm$0.30 | 77.22$\pm$0.34 | 69.73$\pm$0.44
CR-CE-MetaSelf | 75.79$\pm$0.34 | 68.50$\pm$0.29 | 65.28$\pm$0.43 | 56.93$\pm$0.33 | 78.68$\pm$0.32 | 70.43$\pm$0.85
CA-CE-MetaSelf | 66.98$\pm$0.56 | 56.30$\pm$0.42 | 62.58$\pm$0.28 | 53.22$\pm$0.30 | 76.58 $\pm$0.46 | 69.43$\pm$0.22
CW-MetaSelf | 72.75$\pm$0.50 | 61.85$\pm$1.18 | 64.37$\pm$1.07 | 52.17$\pm$0.25 | 83.71$\pm$0.66 | 79.45$\pm$0.47
CR-CW-MetaSelf | 71.40$\pm$0.61 | 60.84$\pm$0.45 | 64.76$\pm$0.88 | 54.98$\pm$1.29 | 83.09$\pm$0.92 | 79.87$\pm$1.02
CA-CW-MetaSelf | 69.69$\pm$0.64 | 58.50$\pm$0.73 | 60.79$\pm$0.51 | 53.28$\pm$0.62 | 83.24$\pm$0.45 | 76.99$\pm$0.46
Table 4: Comparison of computational efficiency. Methods | Cora | Citeseer | Polblogs
---|---|---|---
DICE | 0.04s | 0.01s | 0.06s
CE-MetaSelf | 107.46s | 97.90s | 114.07s
CW-MetaSelf | 158.39s | 129.12s | 236.52s
CR-CE-MetaSelf | 84533.67s | 53089.36s | 42780.71s
CR-CW-MetaSelf | 87566.54s | 56345.78s | 53390.56s
CA-CW-MetaSelf | 153.58s | 122.74s | 200.68s
CA-CE-MetaSelf | 104.39s | 107.88s | 112.37s

###  4.1 Set Up

#### Datasets and GNN models.

We evaluate our attacks on three benchmark graph datasets, i.e., Cora [16],
Citeseer [17] and Polblogs [18]. Table 1 shows the basic statistics of these
datasets. The datasets are partitioned into 10% labeled nodes and 90%
unlabeled nodes. The true labels of the unlabeled nodes are hidden from both
the attacker and the surrogate, serving only as a benchmark for assessing the
effectiveness of the adversarial attacks. We employ the Graph Convolutional
Network (GCN) [2] as our target GNN model.

#### Baseline Attacks.

We choose DICE [19]222https://github.com/DSE-MSU/DeepRobust, MetaSelf
[12]333https://github.com/DSE-MSU/DeepRobust and Certify robustness(CR)
inspired attack framework [13] as the base attack methods. Details of
baselines are discussed in Section 1. For clarity in presentation, we denote
the variant of MetaSelf utilizing the negative log likelihood loss as CE-
MetaSelf. When employing the CW loss [14], it is referred to as CW-MetaSelf.
When integrating the CR-inspired attack framework with MetaSelf using the
negative log likelihood loss, we term it CR-CE-MetaSelf. Similarly, its
adaptation with the CW loss is named CR-CW-MetaSelf.

#### Implementation Details

All attacks are implemented in PyTorch and run on a Linux server with $16$
core $1.0$ GHz CPU, $24$ GB RAM, and $10$ Nvidia-RTX $3090$Ti GPUs. Each
experiment is repeated for ten times under different initial random seeds, and
the uncertainties are presented by $95\%$ confidence intervals around the mean
in our tables. We separately set the perturbation budget $\Delta$ as $5\%$ and
$10\%$ of the total number of edges in a graph. The specific parameters
associated with our cost aware loss were selected by grid search to achieve
optimal attack performance and details are in Table 2. For $\varphi(v)>0$, we
use $\alpha 1$ and $\beta 1$. Conversely, for $\varphi(v)<0$, we employ
$\alpha 2$ and $\beta 2$. For the baseline CR inspired attack framework, we
adopted the parameter settings as outlined in their original paper and
computed the certify robustness size at every $20th$ iteration during the
generation of the poisoned graph.

###  4.2 Results and Analysis

#### Performance Comparison($RQ1$)

Table 3 presents a comparison of our attack performance against other
established methods. We can observe that our CA attack loss framework combined
with negative log likelihood loss can enhance the CE-MetaSelf performance in
all datasets. For instance, when attacking GCN with a 5% perturbation ratio,
our CA-CE-MetaSelf demonstrates a gain of 9.58% and 9.74% over CE-MetaSelf on
Cora and Citeseer, respectively. Moreover, CA-CE-Metaself has a relative
improvement of 12.20% and 3.71% compared to CR-CE-MetaSelf, with a
perturbation ratio of 10% on Cora and Citeseer, respectively. These findings
indicate that our CA attack loss framework enhances poisoning attack
performance more effectively within the same budget constraints.

#### Universality Analysis($RQ2$)

Table 3 highlights the effectiveness of our weight assignment strategy when
applied to the CW loss, underscoring the versatility of our approach. For
example, when considering a 5% perturbation ratio, our proposed CA-CW-MetaSelf
approach exhibits a relative gain of 3.58% and 3.06% over the CW-MetaSelf
method for the Citeseer and Cora datasets, respectively. Additionaly, CW-CE-
MetaSelf has a gain of 1.71% and 3.97% over the CR-CW-MetaSelf for the Cora
and Citeseer datasets, respectively. Since we use the same parameters with
negative log likelihood loss for CW loss to reduce the time for parameter
adjustments, it may not be optimal for the CW loss which could result in
suboptimal results compared to the baselines. The results of our attack can be
improved with more detailed parameter tuning for the CW loss within the CA
attack loss framework.

#### Computational Efficiency($RQ3$)

We compared the computational efficiency of our method with the baselines,
shown in Table 4. DICE has the highest computational efficiency since it
depends on randomness without gradient derivation. The computational
efficiency of CR-CE-MetaSelf and CR-CW-MetaSelf are the lowest because they
need much time to compute certify robustness size for every node. CA-CE-
MetaSelf and CA-CW-MetaSelf have similar computational efficiency with CE-
MetaSelf and CW-MetaSelf. Therefore, the computational efficiency of CA attack
loss framework is satisfactory while the performance is competitive.

##  5 Conclusion

We investigate graph poisoning attacks on graph neural networks and present an
innovative Cost Aware Poisoning Attack Loss Framework(CA-attack) utilizing the
concept of classification margin. Our research begins by examining the budget
inefficiencies present in previous attack methods. Subsequently, we develop a
cost-aware loss framework that assigns dynamic weights to victim nodes based
on their margins. Through evaluations conducted on various datasets, we
demonstrate that our attack loss can considerably decrease the budget waste
and improve the performance of existing attacks.

Note:The copyright of this paper is reserved by 2023 IEEE.

## References

  * [1] Wei Jin, Yao Ma, Xiaorui Liu, Xianfeng Tang, Suhang Wang, and Jiliang Tang,  “Graph structure learning for robust graph neural networks,”  in Proceedings of the 26th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, 2020.
  * [2] Thomas N. Kipf and Max Welling,  “Semi-supervised classification with graph convolutional networks,”  in International Conference on Learning Representations, 2017.
  * [3] Petar Veličković, Guillem Cucurull, Arantxa Casanova, Adriana Romero, Pietro Liò, and Yoshua Bengio,  “Graph attention networks,”  in Proceedings of the 5th International Conference on Learning Representations, 2018.
  * [4] Wenqi Fan, Yao Ma, Qing Li, Yuan He, Eric Zhao, Jiliang Tang, and Dawei Yin,  “Graph neural networks for social recommendation,”  in The World Wide Web Conference, 2019.
  * [5] Anshika Chaudhary, Himangi Mittal, and Anuja Arora,  “Anomaly detection using graph neural networks,”  in International Conference on Machine Learning, Big Data, Cloud and Parallel Computing, 2019.
  * [6] Jianheng Tang, Jiajin Li, Ziqi Gao, and Jia Li,  “Rethinking graph neural networks for anomaly detection,”  in Proceedings of the 39th International Conference on Machine Learning, 2022.
  * [7] Jingcan Duan, Siwei Wang, Pei Zhang, En Zhu, Jingtao Hu, Hu Jin, Yue Liu, and Zhibin Dong,  “Graph anomaly detection via multi-scale contrastive learning networks with augmented view,”  Proceedings of the AAAI Conference on Artificial Intelligence, 2023\.
  * [8] Lingfei Wu, Yu Chen, Kai Shen, Xiaojie Guo, Hanning Gao, Shucheng Li, Jian Pei, and Bo Long,  “Graph neural networks for natural language processing: A survey,”  Foundations and Trends in Machine Learning, vol. 16, 2023.
  * [9] Hanjun Dai, Hui Li, Tian Tian, Xin Huang, Lin Wang, Jun Zhu, and Le Song,  “Adversarial attack on graph structured data,”  in Proceedings of the 35th International Conference on Machine Learning, 2018.
  * [10] Binghui Wang and Neil Zhenqiang Gong,  “Attacking graph-based classification via manipulating the graph structure,”  in Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, 2019.
  * [11] Hongge Chen, Sijia Liu, Pin-Yu Chen, Tsui-Wei Weng, Mingyi Hong, and Xue Lin,  “Topology attack and defense for graph neural networks: An optimization perspective,”  08 2019, pp. 3961–3967.
  * [12] Daniel Zügner and Stephan Günnemann,  “Adversarial attacks on graph neural networks via meta learning,”  in Proceedings of the 6th International Conference on Learning Representations, 2019.
  * [13] Binghui Wang, Meng Pang, and Yun Dong,  “Turning strengths into weaknesses: A certified robustness inspired attack framework against graph neural networks,”  Proceedings of the 22th IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2023.
  * [14] Nicholas Carlini and David Wagner,  “Towards evaluating the robustness of neural networks,”  in ieee symposium on security and privacy (sp), 2017.
  * [15] Daniel Zügner, Amir Akbarnejad, and Stephan Günnemann,  “Adversarial attacks on neural networks for graph data,”  in ACM Special Interest Group on Knowledge Discovery and Data Mining, 2018.
  * [16] Andrew McCallum, Kamal Nigam, Jason D. M. Rennie, and Kristie Seymore,  “Automating the construction of internet portals with machine learning,”  Information Retrieval, 2000.
  * [17] Prithviraj Sen, Galileo Namata, Mustafa Bilgic, Lise Getoor, Brian Galligher, and Tina Eliassi-Rad,  “Collective classification in network data,”  AI Magazine, vol. 29, no. 3, 2008.
  * [18] Lada Adamic,  “The political blogosphere and the 2004 u.s. election: Divided they blog,”  Proceedings of the 3rd International Workshop on Link Discovery, 2005.
  * [19] Marcin Waniek, Tomasz Michalak, Talal Rahwan, and Michael Wooldridge,  “Hiding individuals and communities in a social network,”  Nature Human Behaviour, 2018.