[freehaven-cvs] adding alessandro"s changes and others

[arma@seul.org (Roger Dingledine)]

Update of /home/freehaven/cvsroot/doc/fc03
In directory moria.seul.org:/home/arma/work/freehaven/doc/fc03

Modified Files:
	econymics.tex 
Log Message:
adding alessandro's changes and others


Index: econymics.tex
===================================================================
RCS file: /home/freehaven/cvsroot/doc/fc03/econymics.tex,v
retrieving revision 1.34
retrieving revision 1.35
diff -u -d -r1.34 -r1.35
--- econymics.tex	17 Sep 2002 01:40:50 -0000	1.34
+++ econymics.tex	17 Sep 2002 02:20:31 -0000	1.35
@@ -684,7 +684,7 @@
 protocol and topology (cascade-based or synchronous networks will provide
 larger anonymity sets than asynchronous networks where traffic is divided
 among the nodes).} Nevertheless, this framework can be mapped into the
-model analyzed \cite{palfrey-rosenthal-89} where two players decide
+model analyzed in \cite{palfrey-rosenthal-89} where two players decide
 simultaneously whether to contribute to a public good.
 
 In our model, when for example $v_{i} \gg v_{j}$ and $v_{i}$ is large,
@@ -708,71 +708,79 @@
 \subsubsection{Strategic Agents: Multi-player Case.}
 
 Each player now considers the strategic decisions of a vast number of
-other players. Traditionally, cooperative solutions with a finite horizon
-are not
-sustainable because, by backward induction, each agent will have an
-incentive to deviate when the actions of other agents are not observable. As
-compared to the analysis above with only two agents, now a defection of one
+other players. Fudenberg and Levine \cite{fudenberg88} propose
+a model where each player plays a large set of identical players, each of which is
+``infinitesimal'', i.e. its actions cannot affect the payoff of the first
+player. We define the payoff of each player as
+the average of his payoffs against the distribution of strategies played by
+the continuum of the other players. In other words, for each type, we will
+have: $u_{i}=\sum_{n_{s}}u_{i}\left( s_{i},s_{-i}\right) $ where the
+notation represents the comparison between one specific agent $i$ and all the
+others. Cooperative solutions with a finite horizon are often not
+sustainable when the actions of other agents are not observable because,
+by backward induction, each agent will have an incentive to deviate. As
+compared to the analysis above with only two agents, now a defection
+of one 
 agent might affect only infinitesimally the payoff of the other agents, so
-the agents might tend not to use the trigger strategy. But then, more agents
-will tend to deviate and the cooperative equilibrium might collapse.%
-\footnote{%
-``Defection'' would be, for example, acting only as a user and refusing to
-be a node: the agents start realizing that there is enough anonymity in the
-system and they do not need to be a node any longer. But if too many agents
+the agents might tend not to punish the defector. But then, more agents
+will tend to deviate and the cooperative equilibrium might collapse.
+``Defection'', in fact, could be acting only as a user and refusing to
+be a node when the agent starts realizing that there is enough anonymity in the
+system and she no longer needs to be a node. But if too many agents
 act this way, the system might break down for lack of nodes, after which
-everybody would have to resort to non anonymous channels. A trigger strategy
-would punish an agent by making the system unavailable. Of course a high
-sensitivity user will also suffer itself because of this strategy [[extend
-on this]]} We can consider this to be a public good with free-riding type of
-problem \cite{cornes-sandler-86}. Under which conditions will this not
-happen?
+everybody would have to resort to non anonymous channels.
 
-One of the interesting economic aspects of this scenario is that the highly
-sensitive agents actually \emph{want} some level of free-riding, to
-provide noise. On the other
+We can consider this to be a ``public good with free-riding'' type
+of problem \cite{cornes-sandler-86}. 
+The highly sensitive agents actually
+\emph{want} some level of free-riding, to provide noise. On the other
 side, they do not want too much free-riding --- for example from highly
 sensitive type pretending to be agents with low sensitivity --- if it
-involves high traffic costs. This latter point however must be
-clarified: highly anonymity sensitive types, at parity of traffic, prefer to
-be nodes (because anonymity and reliability will increase) and prefer to
-work in systems with fewer nodes (otherwise traffic gets too dispersed and
-the anonymity sets get too small). So, if $-v_{i}-c_{n}$ is particularly
-high, i.e. if the cost of not having anonymity is very high for the most
-sensitive agents, then the latter might decide to act as nodes regardless of
-what the others do. %{extend}
-Also, if there are enough agents with lower $v_{i}$, again a ``high'' type
+involves high traffic costs.
+
+So, under which conditions will a system with many players not implode?
+
+First, a trigger strategy might be agreed upon among the many agents,
+so that the deviation of one single player might be met by the reaction
+of all the others (as described in \cite{fudenberg88}).  Of course the
+only punishment available here is making the system unavailable, which
+has a cost for all agents. In addition, coordination costs might be
+prohibitive. This is not a viable strategy.
+
+Second, we must remember that highly sensitive agents, at parity of traffic,
+prefer to be nodes (because anonymity and reliability will increase) and
+prefer to work in systems with fewer nodes (else traffic gets too
+dispersed and the anonymity sets get too small). So, if $-v_{i}-c_{n}$ is
+particularly high, i.e. if the cost of not having anonymity is very high for
+the most sensitive agents, then the latter will decide to act as nodes
+regardless of what the others do. Also, if there are enough agents with
+lower $v_{i}$, again a ``high'' type
 might have an interest in acting alone if its costs of not having anonymity
 would be too high compared to the costs of handling the traffic of the less
-sensitive types. %{extend}
-In addition, certain nodes with higher sensitivity might indeed prefer to
-incur all the costs and be the only nodes in the system.
+sensitive types. 
 
-In fact, when the valuations are continously distributed this is likely to
-create equilibria where the agents with the highest evaluations $v_{i}$
-become nodes, and the others, starting with the ``marginal'' type,
-provide traffic. This problem can be mapped to the solution in \cite
-{bergstrom-blume--varian-86}. At that point an equilibrium level of
-free-riding might be reached. This condition can be also compared to \cite
+In fact, when the valuations are continously distributed this
+\emph{might} generate equilibria where the agents with the highest
+evaluations $v_{i}$ become nodes, and the others, starting with the
+``marginal'' type (the agent indifferent between the
+benefits she would get from acting as node and the added costs of doing
+so) provide traffic.\footnote{Writing down specific equilibria, again,
+will first involve choosing appropriate anonymity metrics, which
+might be system-dependent.} This problem can be mapped to the solutions in
+\cite {bergstrom-blume--varian-86} or \cite{mackiemason-varian-95}. At
+that point an equilibrium level of free-riding might be reached. This
+condition can be also compared to \cite
 {grossman-stiglitz-80}, where the paradox of informationally efficient
 markets is described.\footnote{%
-The equilibrium in \cite{grossman-stiglitz-80} relies on the
-``marginal'' agent who is indifferent between getting more information
-about the market and not getting it. We are grateful to Hal Varian for
-highlighting this for us.}
+The equilibrium in \cite{grossman-stiglitz-80} relies on the ``marginal''
+agent who is indifferent between getting more information about the market
+and not getting it. We are grateful to Hal Varian for highlighting this for
+us.}
 
 The problems start if we consider now a different situation. Rather than
 having a continuous distribution of evaluations $v_{i}$, we consider two
 types of agents: the agent with a high valuation, $v_{H}$, and the agent
-with a low valuations, $v_{L}$. Fudenberg and Levine \cite{fudenberg88} have
-a model where each player plays a set of identical players, each of which is
-``infinitesimal'', i.e. its actions cannot affect the payoff of the first
-player. The approach in this case is to define the payoff of each player as
-the average of his payoffs against the distribution of strategies played by
-the continuum of the other players. In other words, for each type, we will
-have: $u_{H}=\sum_{n_{s}}u_{H}\left( s_{H},s_{-H}\right) $ where the
-notation represents the comparison between one specific $H$ type and all the
-others. We can assume that the $v_{L}$ agents will simply participate
+with a low valuations, $v_{L}$. We can assume that the $v_{L}$ agents will simply participate
 sending traffic if the system is cheap enough for them to use,\footnote{%
 We will go back to this assumption when we will discuss the bootstraping of
 the system and the incentives of people with low sensitivity to anonymity.}
@@ -782,18 +790,18 @@
 high-types. 
 
 Here the marginal argument discussed above will not work, and coordination
-might be costly especially when nodes do not trust each other. In this
-scenario where the mix-net system is self-sustaining and free and the agents
+might be costly. In this scenario where the system is self-sustaining and free and the agents
 are of high and low types, the actions of the agents must be visible and the
-agents themselves must agree on reacting together to respond to any
-deviation of a marginal player, thus re-establishing the trigger strategy of
-the 2-agents case. %{extend}
-In realistic scenarios, however, this will involve very high
+agents themselves must agree to react together to any
+deviation of a marginal player. In realistic scenarios, however, this will involve very high
 transaction/coordination costs, and will require an extreme (and possibly
-unlikely) level of rationality on the side of the agents. One option to help
-reduce coordination costs is to maintain the distributed trust structure but
-centralize other elements of the system. We consider some other mechanisms
-that can make mix-net systems economically viable in the next section.
+unlikely) level of rationality for the agents. This equilibrium will also
+tend to collapse when the benefits from being a node are not very high
+compared to the costs. Paradoxically, it also breaks down when an
+agent trusts another so much that she prefers to delegate away the task
+of being a node. The above considerations however also hint to other
+possible solutions to reduce coordination costs. We now consider some
+other mechanisms that can make these systems economically viable.
 
 \section{Alternate incentive mechanisms}
 
@@ -806,12 +814,13 @@
 \begin{enumerate}
 \item  \emph{Usage fee}. If participants pay to use the system,
 the ``public good with free-riding'' problem turns
-into a ``clubs'' scenario. Agents can choose a pricing
-mechanism related to how much they expect to use the system or how sensitive
-they are. (The revelation principle \cite{fudenberg-tirole-91} indicates
-that the agent can concentrate on mechanisms where all the agents
-truthfully reveal their sensitivities.)
-% (which involves mechanism design and revelation mechanism%
+into a ``clubs'' scenario. The pricing mechanism must be related to
+how much the participants expect to use the system or how sensitive
+they are. Sensitive agents might support the others by offering them
+limited services for free, because they need their traffic as noise.
+%(The revelation principle \cite{fudenberg-tirole-91} indicates
+%that the agent can concentrate on mechanisms where all the agents truthfully
+%reveal their sensitivities.) 
 %\footnote{%
 %A ``mechanism'' is a game where agents send messages and a certain
 %allocation that depends on the realized messages (for a textbook
@@ -833,10 +842,14 @@
 
 \item  \emph{``Special'' agents}. Such agents have a utility function
 which considers the social value of having an anonymous system, or are
-otherwise paid or supported to provide such service. The risks here are
-congestion and non-optimal use of the resources
-\cite{mackiemason-varian-95}.
-%FIXME why? how?
+otherwise paid or supported to provide such service. %The support might
+%also come in form of reputation, as discussed below, or in financial
+%form.
+If these agents are paid, the mechanism becomes similar to the hybrid
+solution discussed above, except anonymity-sensitive agents,
+rather than act as nodes, pass the money to a central authority. The
+central authority redistributes the funding among trusted entities
+acting as nodes.
 
 \item  \emph{Public rankings and reputation}. A higher reputation
 not only attracts more cover traffic but is also a reward in itself.
@@ -993,7 +1006,9 @@
 gaining critical mass in an anonymity system: in hindsight, perhaps
 Zero-Knowledge Systems would have gotten farther had it placed initial
 emphasis on usability
-rather than security. Note that here again reliability becomes an issue,
+rather than security.
+
+Note that here again reliability becomes an issue,
 since we must consider both the benefits from sending a message \textit{and }%
 keeping it anonymous. If the benefits of sending the message are not that
 high in first instance, then the agents will have low sensitivity agent will
@@ -1094,12 +1109,13 @@
 
 \section{Conclusions}
 
-We have described a basic model for characterizing and analyzing the
-various incentives for participants to act as senders and nodes in
-strong anonymity infrastructures. Our model does not solve the problem of
-building a more successful system --- but it does provide some guidelines
-for how to think about solving that problem. Much research remains for
-a more realistic model, but we can already draw some conclusions:
+We have described the foundations for an economic approach to the study
+of strong anonymity infrastructures. We focused on the incentives for
+participants to act as senders and nodes. Our model does not solve the
+problem of building a more successful system --- but it does provide
+some guidelines for how to think about solving that problem. Much
+research remains for a more realistic model, but we can already draw
+some conclusions:
 
 \begin{itemize}
 \item Systems must attract cover traffic (many low-sensitivity users)

***********************************************************************
To unsubscribe, send an e-mail to majordomo@seul.org with
unsubscribe freehaven-cvs       in the body. http://freehaven.net/