I believe what you are describing is known as the “selfish mining” attack. It is distinct from the usual meaning of the “block witholding” attack, although it has obvious similarities.
Selfish Mining
In theory
There seem to be many scholarly articles on the subject.
As Techopedia explains it
In essence, a selfish mining attack is achieved by withholding the broadcast of newly mined blocks to the public network. By doing so, these miners can clandestinely continue to mine the subsequent block, getting a head start and increasing their chances of adding more blocks to the chain.
…
While the concept of selfish mining was theorized as early as 2010, it was illuminated through a paper by Cornell University researchers Eyal and Sirer.
In practise
Studies have been made to detect this. For example Li, SN., Campajola, C. & Tessone, C.J. Statistical detection of selfish mining in proof-of-work blockchain systems. Sci Rep 14, 6251 (2024).
We propose a statistical test to analyse each miner’s behaviour in five popular cryptocurrencies: Bitcoin, Litecoin, Monacoin, Ethereum and Bitcoin Cash. Our method is based on the realisation that selfish mining behaviour will cause identifiable anomalies in the statistics of miner’s successive blocks discovery. Secondly, we apply heuristics-based address clustering to improve the detectability of this kind of behaviour. We find a marked presence of abnormal miners in Monacoin and Bitcoin Cash, and, to a lesser extent, in Ethereum.
Which suggests there might have been no obvious occurrences in Bitcoin in the fourteen years since this was first discussed.
