Algorithmic mechanisms for reliable crowdsourcing computation under collusion.

We consider a computing system where a master processor assigns a task for execution to worker processors that may collude. We model the workers' decision of whether to comply (compute the task) or not (return a bogus result to save the computation cost) as a game among workers. That is, we assume that workers are rational in a game-theoretic sense. We identify analytically the parameter conditions for a unique Nash Equilibrium where the master obtains the correct result. We also evaluate experimentally mixed equilibria aiming to attain better reliability-profit trade-offs. For a wide range of parameter values that may be used in practice, our simulations show that, in fact, both master and workers are better off using a pure equilibrium where no worker cheats, even under collusion, and even for colluding behaviors that involve deviating from the game.

Introduction

Motivation and prior work

The need for high-performance computing, the partial availability of resources in personal computers (such as CPU and GPU), and the wide access to the Internet, have led to the development of Internet-based computing. Internet-based computing is mostly embraced by the scientific community in the form of volunteer computing. That is, a system where participants contribute their idle computing resources to solve scientific problems. Among the most popular volunteering projects is SETI@home [1] running on the BOINC [2] platform. Computing platforms where users contribute for profit also exist, for example, Amazon’s Mechanical Turk [3]. Unfortunately, although the potential of such systems is great, the use of Internet-based computing is constrained by the untrustworthy nature of the platform’s components [2, 4].

In Internet-based Master-Worker task computing systems a master process sends tasks, across the Internet, to worker processes. Workers are expected to execute and report back the result. However, these workers are not trustworthy, hence, they might report incorrect results [2, 5, 6]. Prior work has considered different approaches in tackling this shortcoming. A “classical” Distributed Computing approach is to model malfunctioning (hardware or software errors) or cheating (intentional wrongdoing) as malice. That is, it is assumed the presence of some workers that wish to hamper the computation returning always an incorrect result. On the other hand, non-malicious workers are modeled as altruism. That is, it is assumed the presence of other workers who always return the correct result. Under this classical model, malice-tolerant protocols have been considered [7-9] where the master takes the result returned by the majority of workers. A Game-theoretic approach to deal with untrustworthiness is to assume that workers are rational [4, 10, 11]. That is, based on the strategy that best serves its self-interest, a worker decides whether to compute and return the correct result or return a bogus result. Under this game-theoretic model, incentive-based algorithmic mechanisms have been devised [12-14]. These mechanisms employ reward/punishment schemes to “enforce” rational workers to act correctly. More recent works [15, 16] have combined these two approaches and devised mechanisms assuming the co-existence of altruistic, malicious and rational workers. For a discussion on the connection between Game Theory and (distributed) computing we refer the reader to the book by Nisan et al. [17] and the survey by Abraham et al. [18].

With respect to collusion, in [19, 20] workers are assumed to have a predefined behavior (they are always faulty or always correct). In both papers, the goal is to identify colluders statistically, which requires multiple rounds of worker computation. Rather than focusing on colluder detection, in the present paper, we design mechanisms that yield the correct task computation, despite collusions. Furthermore, in our work each worker computes a task at most once. The benefit of one-round per task mechanisms is partially supported by the work of Kondo et al. [21]. In such work it was demonstrated experimentally that, in master-worker computations, tasks may take much more than one day of CPU time to complete.

In a work directly related to the present paper [14], master-worker computations with rational colluding workers are also studied. In their model, the master can audit the results returned by rational workers with a tunable probability. Bounds on the audit probability that guarantee that workers have incentives to be honest are shown. The study is carried out for three scenarios: redundant allocation of tasks with and without collusion, and single-worker allocation. They conclude that, for their model, single-worker allocation is a cost-effective mechanism, specially in presence of collusion. The form of collusion considered is close to ours: within the same group, either all processors cheat or are honest. However, our analysis and simulations provide a much deeper understanding of the impact of collusions on the master-worker problem. Furthermore, our work considers a richer payoff model and probabilistic cheating, yielding interesting tradeoffs between the utility of the master and the probability of obtaining an incorrect result.

To the best of our knowledge, with the exception of the works discussed above, workers have been always assumed to interact only with the master. That is, no explicit worker collusion that models interaction among workers is considered. (In some works, it is assumed that cheating workers would return the same incorrect answer, without them interacting with each other. This is an implicit and weak form of collusion assumed as a worst case for a voting-based mechanism, as workers returning different incorrect answers would less likely reach a majority.) However, one cannot exclude the possibility of collusion, for example, as in Sybil attacks [22]. In this paper, we study the impact of collusion and the tradeoffs involved in Internet-based Master-Worker task computing, under the assumption that workers are rational in a game-theoretic sense.

Other related work in the area of cloud service and cloud computing includes [23, 24]. Although the overall setting and methodologies considered are different from ours, their objective is similar to ours: increase the trustworthiness of the system.

Contributions

Our main contributions are as follows:

1. We model the Master-Worker Internet-based task computation as a game among rational workers under collusion (cf. Section 2). Each worker chooses whether to be honest (i.e., compute and return the correct task result) or a cheater (i.e., fabricate a bogus result and return it to the master) based on which of the two strategies increases its utility (benefit). In addition, we consider worker collusion: collections of workers form groups. Within each group, workers decide on a common strategy that would provide greater expected benefit. Neither the master nor other workers outside of a colluding group are aware of the collusion. The model is enhanced with a collection of realistic payoff parameters to quantify the benefit of the master and the workers. These parameters can either be fixed because they are system parameters or be chosen by the master.

2. Under this model, we design algorithmic mechanisms that provide the necessary incentives for the workers to truthfully compute and report the correct result, despite collusion. The objective of the design is twofold: maximize the probability of obtaining the correct result (reliability) and maximize the master utility (maximizing profit or minimizing cost if profit is not possible). In short, the mechanism works as follows (cf. Section 4): The master assigns the task to n workers. Each worker i cheats with probability and the master verifies the answers with some probability p (verification comes at a cost–see Section 2). If the master verifies, it rewards the honest workers and penalizes the cheaters. If the master does not verify, it accepts the answer returned by the majority of workers and rewards these workers only. However, it does not penalize the workers in the minority, given that the majority may be actually cheating. Workers may collude in which case the workers belonging to the same group decide homogeneously: either all cheat or all are honest (for more details on collusion see Section 2).

3. The workers’ decision of whether to cheat or not is modeled as a game. As typical in algorithmic mechanism design [10, 25], the master induces a Nash Equilibrium (NE) [26]. When this NE is followed by the workers, the outcome has the desired properties (reliability and utility). We analyze the game and identify the conditions under which unique NE is achieved (cf Section 3). The reason for uniqueness is to force all workers to the same strategy (this is similar to strong implementation in Mechanism Design [27]). Each unique NE results in a different benefit for the master and a different probability of accepting an incorrect result. Thus, the master can choose the game conditions for the unique NE that best fits its goals.

4. To demonstrate the practicality of the analysis, we design mechanisms for two specific realistic scenarios. These scenarios reflect, in their fundamental elements, (a) a system of volunteer computing (e.g., SETI), and (b) a company that buys computing cycles from participant computers and sells them to its customers in the form of a task-computation service (e.g., Amazon’s Mechanical Turk). The analysis provided for these scenarios comprises implicitly a mechanism to decide how to carry out the computation. Our analysis reveals interesting tradeoffs between reliability and utility (see Section 4). A general conclusion drawn from the analysis with respect to worker collusion is that, in order to guarantee a unique equilibrium for any parameter values, all groups, colluding or singletons, must decide whether to cheat or not deterministically.

5. We carry out extensive simulations of our mechanisms for the contractor scenario in an attempt to better understand the impact of worker collusion (cf Section 5). Specifically our simulations are designed to investigate whether considering mixed equilibria yields better tradeoffs for the master and/or the workers, and whether the workers would benefit more if they did not follow the NE induced by the master (i.e., deviate from the game). For a wide range of parameter values (that may be used in practice), our simulations show that all parties, the master and the workers, are better-off using a pure equilibrium where no worker cheats, even under collusion, and even for colluding behaviors that involve deviating from the game.

Model and Definitions

Framework

Setting: We consider a distributed system consisting of a master processor that assigns a computational task to a set of workers to compute and return the result. The tasks considered in this work are assumed to have a unique solution. Although such limitation reduces the scope of application of the mechanisms presented [28], there are plenty of computations where the correct solution is unique, e.g., any mathematical function.

Master verification and worker rationality: It is assumed that the master has the possibility of verifying whether the value returned by a worker is the correct result of the task. It is also assumed that verifying an answer is computationally easier than computing the task [29] (e.g., numerical computations), but the correct result of the computation is not obtained if the verification fails (e.g., when all workers cheat). (Alternatively, one might assume that the master verifies by simply performing the task and checking the answers of the workers. Our analysis can easily be modified to accommodate this different model.) As in [12-14], workers are assumed to be rational and seek to maximize their benefit, i.e., they are not destructively malicious. We note that this assumption can conceptually be justified by the work of Shneidman and Parkes [11] where they reason on the connection of rational players (of Algorithmic Mechanism Design) and workers in realistic P2P systems. Furthermore, we do not consider unintentional errors produced by hardware or software problems. As already mentioned, the master verifies with probability p , and the each worker i cheats with probability .

Collusion: We consider a form of collusion that covers realistic types such as Sybil attacks [22]). Within any given colluding group workers act homogeneously, i.e., either all choose to cheat, or all choose to be honest. The decision is perhaps randomized tossing a unique coin. In the case that a colluding group chooses to be honest, then only one of the workers computes the task (saving computing cost). In the case that that a colluding group chooses to cheat, then they simply agree on a bogus result. In either case they return the agreed result to the master. In addition, we assume that all “cheating groups” return the same incorrect answer if there is more than one. Both assumptions, homogeneous behavior within groups and unique incorrect answer, are adversarial. Since the master accepts the majority, this colluding strategy maximizes the chances of cheating the master. Being this the worst case (see also [9]), it subsumes models where cheaters do not necessarily return the same answer. We assume that, if a worker does not compute the task, the probability of guessing the correct answer is negligible. We also assume that the overall number of colluders is not a majority. The assumption comes naturally from the fact that the set of workers is a choice of the master, who can select arbitrarily from a large population making the likelihood of choosing many related workers low, specially for a one-shot computation. With respect to the master, we assume that it is not aware of which workers are colluding, although it is aware that collusion may occur.

Game definition

We now define formally a game “played” by the workers in a game theoretic sense. We summarize the notation in Table 1 for easy reference. We assume that the master hires an odd number of workers n ≥ 3 to be able to apply a voting strategy and to avoid ties. In order to model collusion among workers, we view the set of workers as a set of non-empty subsets W = {W 1, …, W ℓ} such that and W ∩ W = ∅ for all i ≠ j, 1 ≤ i, j ≤ ℓ. We refer to each of these subsets as a group of workers or a group for short. We also refer to groups as players. Workers acting individually are modeled as a group of size one. It is assumed that the size of each group is known only to the members of the group. Other than that, we assume that workers have complete information on the algorithm and the parameters involved.

Table 1

Game notation.

W = {W 1, …, W ℓ}	set of worker groups
S_i={C,C¯}	set of pure strategies (cheat/not-cheat) available to group W i
s	strategy profile (a mapping from players to pure strategies)
s i	strategy used by group W i in the strategy profile s
s −i	strategy used by each player but W i in the strategy profile s
ws(i)	payoff of group W i for the strategy profile s
σ	mixed strategy profile (a mapping from players to prob. distrib. over pure strategies)
σ i	probability distribution over pure strategies used by group W i in σ
σ −i	probability distribution over pure strategies used by each player but W i in σ
ps_i(i)	probability that group W i uses strategy s i
supp(σ i)	set of strategies of group W i with probability > 0 (called support) in σ
U i(s i, σ −i)	expected utility of group W i with mixed strategy profile σ

For succinctness, we express a strategy profile as a collection of individual strategy choices together with collective strategy choices. For instance, s = C, R −, F −, T − stands for a strategy profile s where group W chooses strategy C (to cheat), a set R − of groups (where group W is not included) randomize their strategy choice with probability p ∈ (0, 1), a set F − of groups deterministically choose strategy C, and a set T − of groups deterministically choose strategy (to be honest). We require that, for each group W , . Whenever all groups use the same probability, we drop the superindex (i) for clarity. Also, whenever the strategy is clear from context, we refer to the expected utility of group W as U .

Equilibrium definition

We define now the conditions for the equilibrium. In the context of collusion, the probability distributions are not independent among members of a group. Furthermore, the formulation of equilibrium conditions among individual workers would violate the very definition of equilibrium since the choice of a worker does change the choices of other workers. Instead, equilibrium conditions are formulated among groups. Of course, the computation of an equilibrium might not be possible since the size of the groups is unknown. But, finding appropriate conditions so that the unique equilibrium is the same independently of that size, the problem may be solved. As we will see in the analysis, knowing some bound (e.g. the trivial one) on the size of the smallest and/or largest group is enough. Moreover, as we will see in simulations, deviating from this expected behavior is against workers’ interest in practice. It is important to notice that although the majority is evaluated in terms of number of single answers, this fact has no impact on correctness of the equilibrium formulation.

We recall [30] that, for any finite game, a mixed strategy profile σ* is a mixed-strategy Nash equilibrium (MSNE) if, and only if, for each player π, Where is the probability distribution over pure strategies used by π in σ*, is the probability distribution over pure strategies used by each player but π in σ*, is the set of strategies of π with probability > 0 (called support) in σ*, and is the expected utility of π in σ*.

In words, given a MSNE with mixed-strategy profile σ*, for each player π, the expected utility, assuming that all other players do not change their choice, is the same for each pure strategy that the player can choose with positive probability in σ*, and it is not less than the expected utility of any pure strategy with probability zero of being chosen in σ*. A fully MSNE is an equilibrium with mixed strategy profile σ where, for each player π, supp(σ ) = S , where S is the whole set of pure strategies available to π.

Payoffs definition

We detail in Table 2 the workers’ payoffs. We also include master payoffs to evaluate its utility. All the parameters in this table are non-negative.

Table 2

Master’s and Workers’ Payoffs.

WP C	worker’s punishment for being caught cheating
WC T	group’s cost for computing the task
WB A	worker’s benefit from master’s acceptance
MP W	master’s punishment for accepting a wrong answer
MC A	master’s cost for accepting the worker’s answer
MC V	master’s cost for verifying worker’s answers
MB R	master’s benefit from accepting the right answer

Notice that we split the reward to a worker into WB and MC , to model the fact that the cost of the master might be different than the benefit of a worker. In fact, in some models they may be completely unrelated. Among the parameters involved, we assume that the master has the freedom of choosing the cheater penalty WP and the worker’s reward WB . By tuning these parameters and choosing n, the master achieves the desired trade-off between reliability and utility. Recall that the master does not know the composition of groups (if there is any). Hence, benefits and punishments are applied individually to each worker, except for the cost for computing the task WC which is shared among all workers in the same group. Sharing the cost of computing while being paid/punished individually may provide incentive to collude, but it models the real-world situation where collusion is secret.

Equilibria Analysis

From Eqs. (1) and (2), we obtain conditions on payoffs and probabilities to attain a unique NE. A similar analysis was presented in [13] for various games and reward models, but for a model without collusion. The analysis presented here can be also applied to those models and games where collusion may appear. We consider a game where the master assigns a computing task to n workers that “play” (in a game-theoretic sense) among them. Intuitively, it is to the workers’ advantage to be in the majority in case the master does not verify and the majority is rewarded. Given that workers know the existence of the other workers, including collusions in the analysis is in order.

For clarity, we partition the set of groups as {F, T, R}, where F ∪ T ∪ R = W. F is the set of groups that choose to cheat as a pure strategy, that is, . T is the set of groups that choose not to cheat as a pure strategy, that is, . R is the set of groups that randomize their choice, that is, . Let F − = F \ {W }, T − = T \ {W }, and R − = R \ {W }. Let Γ− be the set of partitions in two subsets (R , R ) of R −, i.e., Γ− = {(R , R )∣R ∩ R = ∅ ∧ R ∪ R = R −}. Let be the expected payoff of group W for the strategy profile s, taking the expectation over the choice of the master of verifying or not. Then, for each group W ∈ W and for each strategy profile s − = R −, F −, T −, we have that , where s′ is the strategy profile F − ∪ R , T − ∪ R , s = C; and that , where s″ is the strategy profile .

In order to find conditions for a desired equilibrium, we study what we call the utility differential of a worker, i.e. the difference on the expected utility of a worker if its group chooses to cheat with respect to the case when the group chooses to be honest. That is, .

For clarity, define N = ∑ ∣S∣ and N = ∑ ∣S∣, i.e. the number of cheaters and honest workers respectively except for those in group W . We also define what we call the payoff differential as the difference on the expected payoff of a worker, the expectation taken over the choice of the master, if its group chooses to cheat with respect to the case when the group chooses to be honest. Furthermore, we denote the payoff differential depending on whether the size of the group has an impact on what is the majority outcome. More precisely, for each partition (R , R ) ∈ Γ, let , when N − N > ∣W ∣, , when N − N > ∣W ∣, and , when ∣N − N ∣ < ∣W ∣.

Given that the payoff depends only on the outcome majority, replacing this notation in the utility differential, we have that ΔU (s) is

Restating Eqs. (1) or (2) in terms of Eq. (3), the equilibrium conditions are, for each group that does not choose a pure strategy, the differential utility must be zero (∀i ∈ R, ΔU (s) = 0); for each group that chooses to cheat as a pure strategy, the differential utility must not be negative (∀i ∈ F, ΔU (s) ≥ 0); and for each group that chooses to be honest as a pure strategy, the differential utility must not be positive (∀i ∈ T, ΔU (s) ≤ 0).

The following lemma, which is crucially used in the rest of our analysis, shows that, if there is a given total order among the payoff differentials defined, in order to attain a unique equilibrium all groups must decide deterministically. The proof is based on an algebraic argument.

Lemma 1. Given a game as defined, if for every group W ∈ W, then there is no unique equilibrium where R ≠ ∅ (i.e, all groups decide deterministically).

Proof. For the sake of contradiction, assume there is a unique equilibrium σ for which R ≠ ∅ and for every group W ∈ W. Then, for every group W ∈ R, ΔU (s) = 0 must be solvable. If , for all W ∈ R, there would be also an equilibrium where all groups in R choose to cheat and σ would not be unique, which is a contradiction. Consider now the case where there exists some W ∈ R such that . Then, it must hold that ∣R∣ > 1, otherwise ΔU = 0 is false for W . Given that ∣R∣ > 1, the probabilities given by the summations in Equation (3) for W are all strictly bigger than zero. Therefore, given that ΔU = 0 must be solvable, at least one of and must hold, which is also a contradiction with the assumption that .

Replacing appropriately the payoffs detailed in Table 2, we obtain for any group W ∈ W

In the equations above, it holds that for all W ∈ W. Then, by Lemma 1, there is no unique equilibrium where R ≠ ∅. Regarding equilibria where R = ∅, unless the task assigned has a binary output (i.e. the answer can be negated), a unique equilibrium where all groups choose to cheat is not useful to the master. Then, we set up p so that , and for all W ∈ W so that ΔU ≥ 0 has no solution and no group can choose to cheat as a pure strategy. Thus, the only equilibrium is for all the groups to choose to be honest, which solves ΔU ≤ 0. Therefore, , ∀W ∈ W and, hence, the probability that the master accepts a wrong answer is P = 0.

To make we need p > (∣W ∣WB + WC )/(∣W ∣(WP + 2WB )), for all W ∈ W. Then, the expected utilities are U = MB − p MC − nMC and U = ∣W ∣WB − WC , for each W ∈ W. In order to maximize the master utility we would like to design games where p is small. Therefore, we look for a lower bound on p . It can be seen using calculus that the largest lower bound is given by the group of minimum size. Although at a first glance this fact seems counterintuitive, it is not surprising due to the following two reasons. On one hand, colluders are likely to be in the majority, but the unique equilibrium occurs when all workers are honest. On the other hand, the extra benefit that workers obtain by colluding is not against the master interest since it is just a saving in computation costs.

Algorithmic Mechanisms

In this section two realistic scenarios in which the master-worker model considered could be naturally applicable are proposed. For these scenarios, we determine appropriate parameters to be used by the master to obtain the correct answer and maximize its benefit.

The basic protocol (mechanism) used by the master is as follows: Given the payoff parameters (these can either be fixed by the system or be chosen by the master), the master sends to the workers the task to be computed and informs the probability of verification p . For computational reasons, the master also provides a certificate to the workers. This certificate includes the strategy that the workers must play to achieve the unique NE, together with the appropriate data to demonstrate this fact. (The certificate is included only for cases where resource limitations preclude the worker from computing the unique equilibrium, but it is not related to distributions over public signals as in a correlated equilibrium, since workers do not randomize their choice according to this certificate.)

After receiving the replies from all workers, and independently of the distribution of the answers, the master processor chooses to verify the answers with probability p . If the answers were not verified it accepts the result of the majority, and it rewards only those workers, whereas if the answers were verified it rewards the correct workers and penalizes the cheaters. The protocol is detailed in Table 3.

Table 3

Master algorithm.

1:	Procedure
2:	send (task, p V, certificate) to all workers
3:	upon receiving all answers do
4:	verify the answers with probability p V
5:	if the answers were not verified then
6:	accept the majority
7:	end if
8:	reward/penalize accordingly
9:	end upon
10:	end procedure

The master, given the payoff parameters, can determine the other parameters, including the value of p , to force the workers into a unique NE, that would yield the correct task result while maximizing the master’s benefit. Examples of specific parameters such that the master can achieve this are analyzed next.

SETI-like scenario

The first scenario considered is a volunteer computing system such as SETI@home, where users accept to donate part of their processors idle time to collaborate in the computation of large tasks. In this case, we assume that workers incur in no cost to perform the task, but they obtain a benefit by being recognized as having performed it (possibly in the form of prestige, e.g, by being included on SETI’s top contributors list). In this context, we assume that WB > WC = 0. The master incurs in a (possibly small) cost MC when rewarding a worker (e.g., by advertising its participation in the project). As assumed in the general model, in this model the master may verify the values returned by the workers, at a cost MC > 0. We also assume that the master obtains a benefit MB > MC if it accepts the correct result of the task, and suffers a cost MP > MC if it accepts an incorrect value.

Under these constraints, replacing in the equations of Section 3, we obtain a unique equilibrium at p = 0, that can be enforced making p > WB /(WP + 2WB ), attaining P = 0, U = MB − p MC − nMC , and U = ∣W ∣WB . Given that in this scenario p does not depend on n, it is better for the master to allocate the task to minimum number of workers (n = 3), maximizing its utility. We highlight this observation in the following theorem.

Theorem 2. For any set of payoff parameters that can be characterized as the SETI scenario, in order to obtain the correct answer (with probability 1) while maximizing master’s utility, it is enough to assign the task to only three workers, and verify with probability p > WB /(WP + 2WB ).

Contractor scenario

The second scenario considered is a company that buys computational power from Internet users and sells it to computation-hungry costumers. In this case the company pays the workers an amount WB = MC for using their computing capabilities, and charges the consumers another amount MB > MC for the provided service. Since the workers are not volunteers in this scenario, we assume that computing a task is not free for them (WC > 0), and they must have incentives to participate (U > 0, ∀W ∈ W). The worker payment then must be at least the cost of computing (WB ≥ WC ). As in the previous scenario, we assume that the master verifies and has a cost for accepting a wrong value, such that MP > MC > 0.

Under these constraints, replacing in the equations of Section 3, we obtain a unique equilibrium at p = 0, that can be enforced making p > (∣W ∣WB + WC )/(∣W ∣(WP + 2WB )), ∀W ∈ W. Because the latter is decreasing on ∣W ∣, it is enough (a larger lower bound on min∣W ∣ could be used if available) to make p > (WB + WC )/(WP + 2WB ), attaining P = 0, U = MB − p MC − nMC , and U = ∣W ∣WB − WC .

In this scenario, in addition to choosing the number of workers n, we assume that the master can also choose the reward WB and the punishment WP . We focus in the analysis on making only one of these parameters variable at a time. More combinations will be considered in simulations.

The utility of the master U = MB − p MC − nMC increases as n and p decrease. Hence, if the number of workers is a choice, using the minimum number of workers (n = 3) and the minimum p to achieve correctness maximizes the utility. We highlight this observation in the following theorem.

Theorem 3. For any given set of payoff parameters, such that it can be characterized as the contractor scenario, if the master gets to choose the number of workers, in order to obtain the correct answer (with probability 1) while maximizing the utility of the master, it is enough to verify with probability p = (WB + WC )/(WP + 2WB ) + ϵ, for arbitrarily small ϵ > 0, assign the task to only three workers.

Consider the master utility U = MB − p MC − nMC . That is, U = MB − (((WB + WC )/(WP + 2WB )) + ϵ) MC − nMC . It can be seen that the master utility increases with WP . However, a large WP may discourage workers to join the computation. On the other hand, a large WP may alleviate the impact of a large cost of verification MC . A trade-off between these factors must be taken into account in practice. Nevertheless, this is independent of achieving the equilibrium, as long as the appropriate p is used. We highlight these observations in the following theorem.

Theorem 4. For any given sets of workers and payoff parameters, except for WP that is chosen by the master. If the set of payoffs is such that MC = WB > WC and it can be characterized as the contractor scenario, in order to obtain the correct answer (with probability 1) while maximizing the utility of the master, it is enough to set WP as large as possible, verify with probability p = (WB + WC )/(WP + 2WB ) + ϵ, for arbitrarily small ϵ > 0.

Using calculus, it can be seen that, if WP > 2WC (resp. 2WC > WP ), U is decreasing (resp. increasing) on WB . And if on the other hand WP = 2WC , U is constant with respect to WB . For the parameter combinations that make the master utility not constant, because WB is limited as WC ≤ WB < MB , we have that if WP > 2WC (resp. 2WC > WP ), the utility is maximized when WB = WC (resp. WB = MB − ϵ, for ϵ > 0). Again, this is independent of achieving the equilibrium, as long as the appropriate p is used. We highlight these observations in the following theorem.

Theorem 5. For any given sets of workers and payoff parameters, except for WB = MC that is chosen by the master. If the set of payoffs can be characterized as the contractor scenario, in order to obtain the correct answer (with probability 1) while maximizing the utility of the master, it is enough to set WB = WC if WP > 2WC or WB = MB − ϵ 1 otherwise, for arbitrarily small ϵ 1 > 0, verify with probability p = (WB + WC )/(WP + 2WB ) + ϵ 2, for arbitrarily small ϵ 2 > 0.

Simulations

Simulations design

As shown in Section 3, in order to guarantee a unique equilibrium for any parameter values, all groups must decide whether to cheat or not deterministically (Lemma 1). The reason is algebraic. (Refer to Eq. 3.) If the payoff differentials are all positive (resp. negative) the worker-utility differential ΔU (s) is positive (resp. negative) and all workers cheat (resp. are honest) deterministically. But if not all three differentials have the same sign, there could be many values of p that make ΔU (s) = 0. That is, there could be multiple mixed equilibria. Since , to avoid having the same sign in all three differentials, it is enough to make and for each group W ∈ W. That is, from Eqs. 4 and 6, obtain a p that satisfies (WC − ∣W ∣WB )/(∣W ∣WP ) < p < (∣W ∣WB + WC )/(∣W ∣(WP + 2WB )). And given that ∣W ∣ ≥ 1 and p ≥ 0, we get Then, plugging the payoff differentials from Eqs. 4 to 6 in Eq. 3, up to n − 1 roots may result from making ΔU = 0.

Aiming for a mixed equilibrium is promising because it might yield a cost reduction for the master on verifications. However, these multiple equilibria cannot be computed without the knowledge of all group sizes, because the computation of the probability of each payoff differential takes into account that each group tosses only one coin (see Eq. 3). Given that only the members of a colluding group know their group size, the computation is not feasible. In fact, although the master is aware of the possible presence of colluders, and the mechanism must take measures against this deviated behavior, the expected worker behavior is not to collude. Hence, the master only has to compute the equilibria for a platform without collusion, and provide these results to workers. That is, fix a p restricted to Eq. (7) for ∣W ∣ = 1, and compute the equilibria as the roots of the following polynomial. Where Then, the colluding groups may use these equilibria, but still take advantage of collusion in the voting outcome, and by sharing the cost of computing when they are honest. We call this the .

Knowing that they will act together, each colluding group could still ignore the master-provided equilibria and decide their own game strategy taking into account their group size. The members of a group do not know the size of other groups, or even their existence. Hence, they can assume nothing but that no worker outside the group colludes. Using this information, the colluding group could compute Nash equilibria, but they cannot enforce the use of such equilibria to other workers. So, they are left only with the choice of using the master-provided equilibria, or drop the aim of achieving equilibrium at all. For instance, a group of colluders may just decide whether to cheat or not deterministically to maximize their expected utility, under the assumption that all other workers are compliant. We call this the . This scenario can be seen as further deviation (with respect to compliant but voting together) from the expected behavior. The utility differential ΔU (s) (Eq. 3) for a group W would be the following. Where , and are as defined in Eqs. 4 to 6, and p corresponds to the equilibria computed by the master (more on how to choose, if many values for p are possible, later). Recall that . Then, a colluding group decides to cheat (resp. be honest) if this utility differential is positive (resp. negative).

Finally, it would be interesting to study the impact of having each colluding group choosing an arbitrary p at random from (0, 1). We call this the .

We carry out simulations for all three behaviors defined, setting up p so that the game may have multiple mixed equilibria. For the sake of contrast, we also carry out simulations setting up p as in the analysis to have a unique pure equilibrium in p = 0. The parameter combinations used are shown in Table 4. We set MB = MP = MC = 100, MC = WB , and WC = 0.1. For each triplet n ∈ {3, 9, 27}, WB ∈ [0.1, 2], WP ∈ [0, 20], we compute values of p that yield mixed and pure equilibria. Then, we proceed as follows.

Table 4

Simulation parameters.

behavior	pC colluder	pC non-colluder	pV
pure	0	0	>nWB_A+WC_Tn(2WB_A+WP_C)
compliant	unif. at random from roots of ΔU i(s) = 0 in (0, 1)	unif. at random from roots of ΔU i(s) = 0 in (0, 1)	<WB_A+WC_T2WB_A+WP_C
disobedient	{0, 1}	unif. at random from roots of ΔU i(s) = 0 in (0, 1)	<WB_A+WC_T2WB_A+WP_C
random	unif. at random from (0, 1)	unif. at random from roots of ΔU i(s) = 0 in (0, 1)	<WB_A+WC_T2WB_A+WP_C

MB = MP = MC = 100, MC = WB . n ∈ {3, 9, 27}, WB ∈ [0.1, 2], WP ∈ [0, 20], WC = 0.1. ⌈n/2⌉ groups of size 1 and ⌊n/2⌋ of size chosen uniformly at random from [1, ⌊n/2⌋].

Compliant behavior

We compute the payoff differentials and the roots of the worker-utility differential polynomial. We ignore the roots that are not real numbers in (0, 1). Each of the remaining roots provides a value for p that makes the worker-utility differential zero. That is, it is a mixed equilibrium. We then define the group sizes. Given that in practice it is not expected to have a majority of colluders, we fix ⌈n/2⌉ workers to be non-colluders, and we choose the remaining group sizes at random in [1, ⌊n/2⌋]. Armed with the set of possible p values, call it P, each group W chooses a p ∈ P uniformly at random. Then, (i) we simulate the computation tossing a biased coin for each group according to the p value chosen and for the master according to p , and (ii) we compute the expected utility of each worker and the expected utility of the master according to the outcome. Table 5 summarizes these computations.

Table 5

Expected utilities.

verified	∣F∣	master	cheater	honest
yes	= n	−MP W − MC V + nWP C	−WP C	−
yes	< n	MB R − MC V − (n − ∣F∣)MC A + ∣F∣WP C	−WP C	WB A − WC T/∣W i∣
no	> n/2	−MP W − ∣F∣MC A	WB A	−WC T/∣W i∣
no	< n/2	MB R − (n − ∣F∣)MC A	0	WB A − WC T/∣W i∣

Disobedient behavior

For this scenario we proceed in similar fashion for the non-colluding workers. Additionally, for each group, we choose a p at random from P, and we compute the payoff differentials and the utility differential. The rest of the procedure is the same, except that each colluding group decides deterministically to cheat (resp. be honest) if its utility differential is positive (resp. negative).

Random behavior

As before but now each colluding group chooses p uniformly at random from (0, 1).

Finally, for the pure equilibrium, we simulate the computation tossing a biased coin only for the master according to p , given that the workers follow the equilibrium and are honest deterministically. Then, we compute the expected utility of each worker and the expected utility of the master according to the outcome (detailed in Table 5).

Note that we have developed our own simulation platform that integrates Matlab and C++ code to compute roots, simulate coin tossing, and compute utilities for the different behaviors and parameter combinations.

Discussion and conclusions

Our simulations show that, for the combinations of parameters studied and assuming that the colluders are not a majority, collusion does not help the workers. That is, it is in the best interest of the master and also the workers, even if they collude, to follow the pure equilibrium p = 0. In what follows, we support this observation analyzing plots of the results obtained for n = 9. Each dot in these plots represents one execution for one parameter-combination. For many parameter combinations, multiple executions have been carried out obtaining similar results. Similar plots were obtained for n = 3 and 27 (included in Supporting Information). Other values of n were also simulated obtaining similar results.

Fig. 1 shows the expected utility of the master for all three mixed-equilibria behaviors and the pure equilibrium. Comparing all four cases, we observe that enforcing a pure equilibrium is the best for the master expected utility, even though it has to reward all workers because they never cheat (cf. Fig. 2). The master verifies more frequently for the pure equilibrium (cf. Fig. 3), but still not so frequently to impact in the expected utility (refer to Fig. 1), and on the other hand it is always correct (see Fig. 4). Having a platform where the master is always correct and its expected utility is maximized, the natural question is how good is the situation for workers. It can be seen in Fig. 5 and 6 that the expected utility of workers is also higher if the pure equilibrium is used. And this is the case for the non-colluders (Fig. 5) as well as for the colluders (Fig. 6). Finally, we also observed that the probability of verifying p and the p computed by the master are both significantly smaller if the ratio penalty/payoff is large as one might expect (see Fig. 7).

Fig 1

Expected utility of the master for all three mixed-equilibria behaviors and the pure equilibrium and for different parameter combinations when 9 workers participate.

It can be seen that enforcing a pure equilibrium is the best for the master utility for most of the parameter combinations.

Fig 2

Number of cheaters for all three mixed-equilibria behaviors and the pure equilibrium and for different parameter combinations when 9 workers participate.

As expected, enforcing the pure equilibrium (p = 0) workers are honest for all parameter combinations.

Fig 3

Outcome of master’s decision (verify or not) for all three mixed-equilibria behaviors and the pure equilibrium and for different parameter combinations when 9 workers participate.

Given the low probability of verification needed, the master did not verify for most of the parameter combinations in all four cases.

Fig 4

Outcome of the computation (correct or incorrect result) for all three mixed-equilibria behaviors and the pure equilibrium and for different parameter combinations when 9 workers participate.

It can be seen that aiming for a pure equilibrium (p = 0) is the only option to guarantee correctness for any parameter combination.

Fig 5

Expected utility of non-colluder workers for all three mixed-equilibria behaviors and the pure equilibrium and for different parameter combinations, when 9 workers participate.

It can be seen that aiming for a pure equilibrium is the best for the non-colluder utility for most of the parameter combinations.

Fig 6

Expected utility of colluder workers for all three mixed-equilibria behaviors and the pure equilibrium and for different parameter combinations when 9 workers participate.

It can be seen that aiming for a pure equilibrium is the best for the colluder utility for most of the parameter combinations.

Fig 7

Probability of verification of the master for pure equilibrium and mixed equilibria, and probability of cheating of a compliant non-colluder worker, for different parameter combinations when 9 workers participate.

For the master, it can be seen that, for most of the parameter combinations, the probability of verifying is very low.

Simulation plots for 3 workers.

The same observations for the case of 9 workers in Figs. 1 to 7 apply to this case.

(EPS)

Click here for additional data file.

Simulation plots for 27 workers.

The same observations for the case of 9 workers in Figs. 1 to 7 apply to this case.

(EPS)

Click here for additional data file.