Differentially Private and Strategy-Proof Spectrum Auction with Approximate Revenue Maximization

Transcription

1 Differentiay Private and Strategy-Proof Spectrum Auction with Approximate Revenue Maximization Ruihao Zhu and Kang G. Shin Department of Eectrica Engineering and Computer Science The University of Michigan, Ann Arbor, MI , U.S.A. Abstract The rapid growth of wireess mobie users and appications has ed to high demand of spectrum. Auction is a powerfu too to improve the utiization of spectrum resource, and many auction mechanisms have been proposed thus far. However, none of them has considered both the privacy of bidders and the revenue gain of the auctioneer together. In this paper, we study the design of privacy-preserving auction mechanisms: we first propose a differentiay private auction mechanism which can achieve strategy-proofness and a near optima expected revenue based on the concept of virtua vauation. Assuming the knowedge of the bidders vauation distributions, the near optima differentiay private and strategy-proof auction mechanism uses the generaized Vickrey-Carke-Groves auction payment scheme to achieve high revenue with a high probabiity. To tacke its high computationa compexity, we aso propose an approximate differentiay PrivAte, Strategy-proof, and poynomiay tractabe Spectrum PASS auction mechanism that can achieve a suboptima revenue. PASS uses a monotone aocation agorithm and the critica payment scheme to achieve strategy-proofness. We aso evauate PASS extensivey via simuation, showing that it can generate more revenue than existing mechanisms in the spectrum auction market. I. INTRODUCTION Radio spectrum becomes a scarce resource due to the rapid increase in wireess service demand. Conventionay, radio spectrum is aocated in a centraized and static way, but such a poicy eaves a arge portion of radio spectrum unused in some geographic areas, whie making the ide spectrum inaccessibe to new wireess appication providers that do not have icensed spectrum bands. Consequenty, dynamic spectrum aocation DSA is introduced to sove or aeviate the probem of spectrum shortage. Auction is a widey accepted way to tacke the probem of spectrum re-aocation. The Federa Communications Commission FCC has adopted it over two decades ago 1. In recent years, numerous sma-scae spectrum auctions have been hed, and many spectrum auction mechanisms have aso been proposed 36, 37. There exist three major difficuties in this new spectrum reaocation. The first difficuty comes from the spatia reusabiity of each radio spectrum channe. The spatia reusabiity of a channe can aow two bidders to use the same spectrum simutaneousy as ong as they are geographicay far enough from each other out of the interference range. The second is the seer s incentive, which is widey studied for spectrum auction mechanism design 1, 17. If the seer does not have enough incentive, he wi not reease his ide channes. The ast is strategy-proofness that comprises truthfuness and individua rationaity. Intuitivey, truthfuness means that no bidder can get a higher payoff by bidding a vaue other than his true vauation for the goods; whie individua rationaity means that each bidder gets non-negative utiity when bidding truthfuy. In the radio spectrum auction, the bidders are rationa, and may manipuate the auction by misreporting to gain benefits. This misreporting, however, may ower the seer s revenue as we as the other bidders incentive. Recenty, protection of the bid-privacy in spectrum auction has aso become an important issue 14, 38. In most existing studies, a strategy-proof spectrum auction mechanism requires each bidder to report his true vauation, but once the true vauation of a bidder is reported in pubic, the other bidders can infer the true type of that bidder merey based on the outcome of the auction. In a spectrum auction, a channe is icensed to the bidders for a certain period of time, and a of the bidders shoud compete again for the usage of the same channe at the end of this period. This makes the inference of a bidder s true type even easier. Moreover, the true type is an important commercia secret for bidders because it can refect the potentia vaue of the wireess service carried by the spectrum. When the above four difficuties are taken into account, the probem of designing a privacy-preserving and strategy-proof spectrum auction mechanism for revenue maximization can be very chaenging. Previousy, cryptography was the main too for designing privacy-preserving mechanisms 15, 24, but it often incurs high computation and communication overheads, and the performance of the resuting mechanisms may suffer greaty. The recenty proposed exponentia mechanism, which incorporates techniques from differentia privacy 23 and mechanism design, provides us a preiminary hep to sove the probem. Intuitivey, differentia privacy means that a singe change in the input data set ony has imited impact on the output. Therefore, hardy can one make an accurate inference on bidders bids based on the winners when the exponentia mechanism is appied as a arge deviation of a singe bid does not infuence the set of winners much, thereby protecting the bid privacy. In order to achieve good performance in terms of revenue maximization, however, the exponentia mecha-

2 nism often requires an enumeration of a possibe auction outcomes 16, but it is we-known that even computing the optima soution for spectrum aocation is NP-compete 6 in muti-hop wireess networks. Besides, exponentia mechanisms are often impemented in an approximate truthfu manner 23, 38. Therefore, it is necessary to design proper differentiay private mechanisms that can achieve strategyproofness and approximate revenue maximization. In this paper, we study the probem of designing a differentiay private and strategy-proof auction mechanism for spectrum reaocation. For simpicity of presentation, we consider the case of bidding for a singe channe. Each bidder is interested in purchasing a short-term icense for this channe in a fixed geographica area. The bidders do not want other bidders and externa agents to know their bidding information. Assuming that the seer has a priori knowedge of the bidders vauation distributions, we first design a differentiay private and strategy-proof auction mechanism which achieves near optima expected revenue. This mechanism is based on the exponentia mechanism 16. The near optima privacy-preserving mechanism can be viewed as a generaization of the Vickrey- Carke-Groves VCG mechanism. Here we adopt the concept of virtua vauation, which is the surpus of the true vauation and a function of vauation distribution, instead of the bidders origina vaue. This is a widey-used method for the design of conventiona mechanisms 13, 18. It can be shown that maximizing expected revenue is equivaent to maximizing virtua socia wefare. The near optima privacy-preserving mechanism assigns a probabiity of being chosen for each possibe outcome to enforce differentia privacy. Nevertheess, this approach is NP-Hard. In order to tacke the probem of high computationa compexity, we propose PASS, which is an approximate differentiay PrivAte, Strategy-proof, and poynomiay tractabe Spectrum auction mechanism. PASS uses the technique of graph partitioning and the concept of virtua channe to address the spatia reusabiity of the channe, and a monotone agorithm which combines the features of exponentia mechanism and greedy heuristic to aocate the channe. The monotone aocation agorithm, together with the payment rue proposed in 2, guarantees truthfuness. We aso impement PASS, and evauate its performance extensivey. This paper makes the foowing main contributions. To the best of our knowedge, this is the first to design differentiay private, approximate revenue maximization and strategy-proof mechanism for spectrum auction. We mode the probem of spectrum reaocation as a seaed-bid auction, and design a near optima privacypreserving mechanism. This mechanism is proven to be privacy-preserving, strategy-proof, and achieve a near optima expected revenue. By adopting the graph-partitioning technique 1, we introduce the concept of virtua channe, and propose a differentiay private and strategy-proof spectrum auction mechanism with approximate revenue maximization, to reduce the computationa compexity of the exponentia mechanism. PASS is proven to be a privacy-preserving and strategy-proof auction mechanism, and can achieve a sub-optima revenue. The computationa compexity of PASS is On 2, where n is the number of bidders. This ow computationa compexity makes PASS attractive for short-ease-term and arge-scae spectrum auctions. We impement PASS, and extensivey evauate its performance. Our evauation resuts show that PASS achieves differentia privacy and a higher revenue than existing approaches. The remainder of this paper is organized as foows. In Section II, we briefy review the reated work in the areas of incentive mechanism design, differentiay private mechanisms, and privacy-preserving spectrum auction. Section III presents the mode and reviews some reated soution concepts, whie Section IV detais the design of a near optima privacypreserving mechanism, and proves its properties. In Section V, we detai the design of PASS and anayze its properties. Section VI presents our evauation resuts for PASS. Finay, we concude the paper with Section VII. II. RELATED WORK Numerous efforts have been made to design incentive mechanisms 2, 25, 33. Nisan 26 studied the genera combinatoria auction, whie Godberg et a. 11 studied how to auction mutipe digita copies. The authors of 19 showed how to construct a mechanism with an approximation agorithm under certain cases via inear programming. The authors of 8 investigated the power of samping in designing a combinatoria auction mechanism. Dobzinski and Nisan 7 proposed a new method for computing the ower bound for a combinatoria auction mechanism with sub-moduar vauations. McSherry and Tawar 23 first incorporated the techniques of differentia privacy into mechanism design and proposed the first differentiay private auction mechanisms. They used a differentiay private pricing approach, and it coud ony be appied to very simpe settings. The agorithmic mechanism design community then focused on how to design truthfu and computationay efficient, differentiay private auction mechanisms. Leung and Lui 21 studied differentiay private and approximatey truthfu mechanisms in Bayesian setting. Nissim et a. 28 modeed privacy oss with dis-utiity functions, and studied truthfu mechanisms and their appicabiity to eectronic poing and digita goods pricing. Chen et a. 3 aso proposed a mode to measure the privacy oss, and studied truthfu mechanisms and their appicabiity to faciity aocation and socia choice. Nissim et a. 29 studied how to convert approximatey truthfu mechanisms into truthfu ones with some privacy oss. In 3, 16, 35, differentiay private and truthfu mechanisms were studied. To the best of our knowedge, there ony exists a few privacy preserving spectrum auction mechanisms. Huang et a. 15 proposed the first strategy-proof and privacy-preserving spectrum auction mechanism. Pan et a. 32 aso studied the probem of designing privacy-preserving spectrum auction

3 mechanism to prevent maicious behaviors of the auctioneer. However, neither of them makes a performance guarantee in terms of socia wefare or revenue. The authors of 14 proposed the first privacy-preserving spectrum auction mechanism with a performance guarantee in socia wefare. Nevertheess, a of the above auction mechanism used cryptographic toos, and thus induce high computation and communication overheads. Zhu et a. 38 proposed the first differentiay private spectrum auction mechanism for revenue maximization, but their mechanism achieves ony approximate truthfuness. III. PROBLEM FORMULATION We now present the auction mode and some reated soution concepts. A. Mode We mode the probem of privacy-preserving spectrum aocation as a seaed-bid auction. There is a seer, who is the primary user. He has a singe ide channe, 1 and wants to subease his ide channe to n secondary users e.g., wireess service providers, who do not have icense from the government to use radio spectrum. The secondary users are the bidders, and want to buy the icense of the ide channe from the seer to provide services to their customers. In the auction, the seer is trustworthy, and can act as the auctioneer. The seer has a singe channe C for sae, which has the interference range d. Let N = {1,2,...,n} be the set of bidders. Each bidder i N has a vauation v i for C, which is private information that we want to protect. The vauation can be cacuated as the revenue to be gained by providing wireess services using C. Whie the exact vauation v i is private information, we assume that the distribution of v i, denoted by F i, is known to the seer, but the bidders do not have information about each other s vauation distribution 17. Let f i v = df i v/dv be the corresponding density function. Such information is based on the past transactions. This is known as the Bayesian setting for spectrum auction 1. In the auction, the bidders determine their own bids. Let b = {b 1,b 2,...,b n } denote the bid profie which is based on the bid types; Bidders submit seaed bids to the auctioneer simutaneousy. We assume that each bidder s vauation and bid are within a given scope v min,v max. We use a graph G = N, E, caed confict graph, to describe the geographica information, where each node represents a bidder. Any pair of bidders who are separated by a geographica distance smaer than the interference range of C are said to have confict, and are connected via an edge in G. Any pair of bidders who are connected cannot win the channe simutaneousy. Given the bid vector b and the confict graph G, the auctioneer determines the outcome of the auction, denoted by b = {x 1,x 2,...,x n }, where x i is an indicator s.t., { 1, the channe is aocated to i; x i = 1, otherwise. 1 This is for the simpicity of interpretation, the soution for mutipe channes can be easiy generated from our soution. The auctioneer aso cacuates the payment profie, p = {p 1, p 2,..., p n }, where p i is bidder i s payment. The auctioneer s revenue, R EV, can be computed as the sum of the bidders payments: R EV = n p i. Bidder i s utiity u i is defined as the difference between his vauation times the corresponding indicator and his payment: u i = v i x i p i. We assume that the bidders are rationa and each bidder s goa is to maximize his own utiity. B. Soution Concepts Here we review some important and usefu concepts in mechanism design and differentia privacy. Definition 1 Dominant Strategy 31. Strategy a i is a payer i s dominant strategy if for any a i a i and any strategy profie of the other payers a i, u i a i, a i u i a i, a i. The concept of truthfuness is based on that of dominant strategy. Intuitivey, truthfuness means that reveaing truthfu information is the dominant strategy for every payer 22 Definition 2 Truthfu Mechanism 17. An auction is truthfu if and ony if any bidder i s expected utiity of bidding its true vauation v i is at east its expected utiity of bidding any other vaue b i, u i v i,b i u i b i, b i. 2 An immediate theorem which reates monotone agorithm and truthfu auction mechanism design 2 is Theorem 1. A mechanism is truthfu in expectation if and ony if, for any agent i and any fixed choice of bids by the other agents b i, 1 x i b is monotone nondecreasing in b i. 2 p i b = b i y i b b i y izdz, where y i z is the probabiity that bidder i is seected when his bid is z. Let s review concepts reated to differentia privacy. Informay, differentia privacy means that the outcome of two neary identica input data sets different for a singe input shoud aso be neary identica. Formay, Definition 3 Differentia Privacy 9. A randomized computation M has differentia privacy if for any two input sets A and B with a singe input difference, and for any set of outcomes R RANGEM, PrMA R exp PrMB R. One important property of differentia privacy is composabiity: Coroary 1 Composabiity 23. The sequentia appication of randomized computation M i, each giving i differentia privacy, yieds i i differentia privacy There is aso a reaxation of the definition of differentia privacy:

4 Definition 4 Approximate Differentia Privacy 9. A randomized computation M has, δ differentia privacy if for any two input sets A and B with a singe data difference, and for any set of outcomes R RANGEM, PrMA R exp PrMB R + δ. Incorporating differentia privacy, one powerfu too in mechanism design is the exponentia mechanism 16, 23. Mapping the input data set A and an outcome r in the outcome space R to a certain score function qa,r, the exponentia mechanism qa satisfies: Pr qa = r expqa,r. This exponentia mechanism guarantees a 2 differentia privacy, where is an upper-bound of difference of two data sets. An immediate theorem can aso be derived as 12: Theorem 2. When used to seect an output r R, the exponentia mechanism qa yieds 2 differentia privacy. Let R OPT denote the subset of R achieving qa,r = max r qa,r, then the exponentia mechanism ensures that Pr qa, qa < max qa,r n R / R OPT t r exp t. 3 The goa of our auction mechanism design is to achieve strategy-proofness, privacy preservation and revenue maximization. The probem of revenue maximization can be formuated as the foowing binary programming: Objective: Subject to: Maximize R EV = n p i x i x i + x j 1, i, j E; 4 x i {,1}, i N, 5 but this is known to be computationay intractabe 34, nor is it privacy-preserving. Therefore, we need to seek an approximation approach. IV. NEAR OPTIMAL PRIVACY-PRESERVING MECHANISM We now present a near optima privacy preserving mechanism. This mechanism is based on the exponentia mechanism proposed in 16, which is a strategy-proof mechanism that maximizes the auctioneer s expected free socia wefare see 16 for the meaning of free socia wefare. We first adopt the concept of virtua vauation 27, which is essentia for revenue maximization. We appy the exponentia mechanism on the virtua vauations, which guarantees the maximum expected free revenue whie enforcing strategy-proofness and differentia privacy. A. Virtua Vauation and Virtua Surpus We first adopt the concept of virtua vauation and virtua surpus from 27: Definition 5. The virtua vauation of agent i with vauation v i is: φ i v i = v i 1 F iv i. 6 f i v i A company concept is the virtua bid, which is cacuated by pugging in the bid into Eq. 6. The virtua bid profie of the bidders is denoted by φ b = {φ 1 b 1,φ 2 b 2...,φ n b n }. Definition 6. Given vauations, v i, and the corresponding virtua vauations, φ i v i, the virtua surpus of aocation is: n φ i v i x i. 7 We further assume that the distributions of the bidders satisfy the monotone hazard rate i.e., f i v/1 F i v is monotone non-decreasing, so that the virtua vauations are monotone non-decreasing. This is a sufficient condition for a strategy-proof mechanism 27. We aso assume that for each bidder i, his virtua vauations are bounded by φ i v min,φ i v max, and the difference between φ i v max and φ i v min is denoted by. An immediate theorem is that any truthfu mechanism has an expected revenue equa to its expected virtua surpus: Theorem 3. The expected profit of any truthfu mechanism is equa to its expected virtua surpus: ER EV = E n φ i v i x i. 8 Due to space imitation, we omit the proof here, but the proof of this theorem can be found in 27. B. Design Detais With the hep of virtua vauations and virtua surpus, the probem of designing privacy-preserving and near optima maximization spectrum auction can be soved with the exponentia mechanism. Foowing the guiding principe of 16, the mechanism assigns each outcome a probabiity, which is proportiona to the exponentia of its revenue, and then seects an outcome accordingy. The mechanism aso charges each bidder a VCG-ike payment to enforce strategy-proofness. The detaied auction works as foows. 1 For each bidder i, cacuate the virtua bid φ i b i = b i 1 F ib i. 9 f i b i 2 Seect an outcome satisfies Eqs. 4and 5 with probabiity Pr exp 2 φ i b i x i. 1 i

5 3 The payment for a winner bidder i is p i = φ 1 i p i, where p i = E φ k b k x k EXP R φ i b i, φ i b i 2 EXP S R φ i b i, φ i b i + 2 n exp 2 φ k b k x k, 11 where b i = {b 1,...,b i 1,b i+1,...,b n } 12 φ i = {φ 1 b 1,...,φ i 1 b i 1,φ i+1 b i+1,...,φ n b n } 13 is the virtua bid profie of a bidders other than i, EXP R is the assigned probabiity distribution over the virtua bid profie of a bidders in Step 2, and S is the Shannon entropy 5. C. Anaysis of the Near Optima Privacy-Preserving Mechanism Here we anayze the properties of the near optima privacypreserving mechanism. We first show that our design can achieve near optima expected revenue; we then show that together with our VCG-ike payment design, the mechanism achieves strategy-proofness; we finay show that the mechanism achieves differentia privacy. 1 Near Optima Expected Revenue By Theorem 3, we show that the expected revenue of the mechanism is equivaent to the expected virtua surpus. Therefore, we anayze the expected virtua surpus. One important concept that can hep us is the free energy in the iterature of physics and chemistry 3. Simiary, we first define the free virtua surpus F V S n F V SF = E φ k b k x k + 2 F k=1 SF, 14 where F is a distribution over. We prove the foowing theorem, which states that when the distribution F in Eq. 14 is chosen as in Step 2 of the near optima mechanism, the free virtua surpus is maximized over the input bid profie of the bidders Theorem 4. Given bid vector b, F V S is maximized when and the maximum vaue is 2 n F = EXP R φ b, exp where EXP R φ i b i, φ i b i. 2 φ b,, 15 Proof. First, the free virtua surpus can be written as n F V SF = E φ k b k x k + 2 F k=1 SF = Pr φ b, 2 F Pr F n Pr F 16 Then, we focus on the first term of RHS Pr φ b, = 2 F Pr F 2 φ b, = 2 Pr n exp F 2 φ b, = 2 Pr n exp 2 φ b, F exp 2 φ b, + 2 n exp F 2 φ b, = 2 Pr n F Pr EXP R + 2 n exp F 2 φ b, 17 Combining Eqs. 16 and 17, the free virtua surpus becomes F V S = 2 Pr Pr n EXP R F Pr F + 2 n exp 2 φ b, 18 By basic properties of the KL-divergence, the term Pr 2 Pr n EXP R F Pr 19 F is maximized when F = EXP R, and the second term is independent of F. Therefore, the emma hods, and the maximum free virtua surpus with given bid profie is F V S max = 2 n exp 2 φ b,, 2 where EXP R φ b. Now that the free virtua surpus is equa to the expected revenue pus a term, the mechanism achieves a near optima expected revenue. 2 Strategy-proofness With the above theorem, we are now ready to prove that the near optima privacy-preserving mechanism achieves truthfuness. Reca that in the VCG auction 4, each winning bidder is charged the externaity he exerts on the rest of the bidders e.g., the payment of a winner i is the difference between the optima socia wefare of the bidders other than i and the optima socia wefare of a the bidders minus i s bid; otherwise, the bidder is charged.

6 We start by proving that the near optima privacy-preserving mechanism achieves truthfuness. Lemma 1. The proposed mechanism achieves truthfuness. Proof. We prove that reporting the true vauation is the dominant strategy of each bidder. For a bidder i, if he reports any bid ˆb i v i, we denote the corresponding outcome and utiity by ˆ and û i, respectivey. The difference between the utiity of truthfuy report and misreport is u i û i =φ 1 i φi v i x i p i φ 1 i φi ˆb i ˆx i ˆp i. 21 Since φ i is monotone non-decreasing, we ony need to compare the two terms φ i v i x i p i and φ iˆb i ˆx i ˆp i where φ i v i x i p i φ i ˆb i ˆx i ˆp i = E φ i v i x i + φ k b k x k EXP R φ i v i, φ i b i + 2 EXP S R φ i v i, φ i b i 2 n exp r 2 φ k b k x k E φ i v i ˆx i + φ k b k ˆx k EXP R φ i ˆb i, φ i b i 2 EXP S R φ i ˆb i, φ i b i + 2 n exp r 2 φ k b k ˆx k = E φ i v i x i + φ k b k x k EXP R φ i v i, φ i b i + 2 EXP S R φ i v i, φ i b i E φ i v i ˆx i + φ k b k ˆx k EXP R φ i ˆb i, φ i b i 2 EXP S R φ i ˆb i, φ i b i =H EXP R φ i v i, φ i b i H EXP R φ i ˆb i, φ i b i, 22 H F = E F φ i v i ˆx i + φ k b k ˆx k 2 SF. 23 Note that H F is the free virtua surpus function with an input bid vector b = {b 1,...,b i 1,v i 1,b i+1,...,b n }. According to theorem 4, HF achieves the maximum when F = EXP R φ i b i, φ i b i. Therefore, we have φ i v i x i p i φ i ˆb i ˆx i ˆp i, and thus u i û i. The near optima privacy-preserving mechanism is truthfu. We then show that the near optima privacy-preserving mechanism achieves individua rationaity. Lemma 2. The proposed mechanism achieves individua rationaity. Proof. For an arbitrary bidder i, we prove that he can aways get non-negative utiity when bidding truthfuy. When bidding truthfuy, bidder i s utiity is u i = v i x i p i = φ 1 φv i x i φ 1 p i. 24 Since φ is a monotone non-decreasing function by assumption, φ 1 is aso a monoton non-decreasing function. Therefore, in order to prove that u i when i bids truthfuy, it is sufficient to prove thatφv i x i p i. Note that φv i x i p i = E φ i v i x i + φ k b k x k EXP R φ i v i, φ i b i + 2 EXP S R φ i v i, φ i b i 2 n exp r 2 φ k b k x k = 2 n exp φ i v i x i + r 2 φ k b k x k 2 n exp r 2 φ k b k x k. 25 The second ast step is due to Theorem 4. Therefore, we prove that the mechanism is individua rationa. 3 Differentia Privacy We finay state that the near optima privacy-preserving mechanism can preserve the bidders vauation privacy. Theorem 5. The near optima privacy-preserving mechanism preserves -differentia privacy for bidders vauation privacy. This theorem is a coroary of Theorem 2. V. PASS: A DIFFERENTIALLY PRIVATE AND STRATEGY-PROOF SPECTRUM AUCTION MECHANISM The near optima auction mechanism introduced in the previous section can protect the bidders bid privacy as we as generate a near optima expected revenue. Nevertheess, its computationa compexity is prohibitivey high, thus making it unsuitabe for arge-scae spectrum markets. Therefore, by adopting the graph partitioning technique 1, and introducing the concept of virtua channe, we propose PASS, which is a poynomiay tractabe, differentiay private, and strategyproof spectrum auction mechanism. PASS achieves good performance in terms of approximate revenue maximization.

7 A. Design Rationae PASS integrates the exponentia mechanism with the greedy heuristic for a singe-minded combinatoria auction mechanism 2 into spectrum auction to achieve both approximate revenue maximization and differentia privacy. Basicay, PASS chooses the winning bidders iterativey. In each iteration, each remaining bidder is assigned a probabiity of being chosen, and PASS chooses one of them as a winning bidder. The main idea of PASS is to first appy the technique of graph partitioning, and create a set of virtua channes that capture the confict among the bidders for each bidder, thus transorming the spectrum auction into a singe-minded combinatoria auction ike scenario. Finay, PASS computes the probabiity of being chosen for each bidder based on a specific norm, and chooses the set of winning bidders iterativey, and determines the payment for each bidder. B. Design Detais Foowing the guideines in Section V-A, we describe PASS in detai. PASS performs the auction in four steps. It first partitions the confict graph into uniform hexagons, thus dividing the bidders into groups. Afterwards, PASS creates virtua channes for bidders according to their geographica ocations and the confict graph. PASS then computes the probabiity of being chosen for each bidder, and chooses winning bidders randomy based on the assigned probabiity iterativey. Finay, PASS determines the payment for each bidder. Phase 1: Graph Partition PASS first partitions the geographica area 1. Since the interference range of C is d, PASS divides the entire area into sma hexagons with side-ength equa to haf of the interference range of C i.e., the side-ength is d/2. Suppose there are a tota of m hexagons, and correspondingy, m bidder groups, denoted by A = {a 1,a 2,...,a m }. Each bidder i beongs to exacty one hexagon a j i.e., m j=1 a j = N. An iustrative exampe of the partition with m = 24 is shown Fig. 1. Fig. 1. An iustrative exampe of partition. The partition satisfies that the maximum distance within a singe hexagon is ess than or equa to d i.e., the diametrica ength so that a the bidders in a singe hexagon are mutuay confict i.e., the confict graph over a singe hexagon is a compete graph. Fact 1. Any pair of bidders from the same hexagon are conficting bidders, and can not be aocated to the channe simutaneousy. The graph partition technique is the basis of virtua channe, and the intuition behind this partition is that in the singeminded combinatoria auction, the approximation ratio is equa to k 2, where k is the maximum size of the bundes of a the bidders; whie in PASS, the maximum size of the bundes is determined by the number of virtua channes each bidder is interested in. By partitioning the geographica area, the number of virtua channes each bidder is interested in is cut down. Phase 2: Virtua Channe Assignment With the partitioned graph, PASS introduces virtua channe to capture the interference among the bidders. Specificay, a virtua channe vc j,k j and k can be the same is assigned to bidder i if he satisfies one of the foowing two conditions: 1 i ocates in a j, and he is in confict with at east one bidder i in a k i.e., i and i cannot be granted the channe simutaneousy. 2 i ocates in a k, and he is in confict with at east one bidder i in a j i.e., i and i cannot be granted the channe simutaneousy. For convenience, et r = {r 1,r 2,...,r n } denote the set of virtua channes assigned to each bidder, where r i is the bunde of virtua channes assigned to bidder i. In other words, i is interested in the bunde of virtua channes r i. The forma process of assigning virtua channes to each bidder is described in Agorithm 1, where DISTANCEi,i is the geographica distance of bidders i and i. The assignment of virtua channes guarantees that the intersection of the sets of virtua channes assigned to a pair of confict bidders is nonempty. Lemma 3. For any pair of bidders i and j, if i and j are in confict i.e., i. j E, then r i r j / Agorithm 1 Virtua Channe Assignment Input: A confict G = {N,E}. A Partitioned Groups A. Output: A vector of bundes of virtua channes each bidder is interested in r. 1: r /. 2: for a a j A,a k A do 3: for a i a j,i i a k do 4: if DISTANCEi,i d then 5: r i r i {vc j,k },r i r i {vc j,k }. 6: end if 7: end for 8: end for 9: return r. Phase 3: Winner Determination Based on the partitioned graph and each bidder s interested virtua channe. PASS first cacuates each bidder s virtua bid, and then assigns each bidder i a probabiity of being chosen with respect to a specific norm, which is the bidder s virtua bid over the square root of the size of the set of virtua channes

8 he is interested in, i.e., φ i b i ri. 26 PASS then chooses the winning bidders iterativey, and maintains a set of remaining bidders, denoted by R. Initiay, R = N. In each iteration, for a the bidders i R, the probabiity of being chosen is proportiona to the exponentia of the norm defined in Eq. 26 times a constant; otherwise, the probabiity is, i.e., exp PrW W {i} φ i b i if i R, ri 27, otherwise. where = /e ne/δ and W is the set of winning bidders. PASS then normaizes the vaues and chooses a winning bidder accordingy, i.e., exp φ i b i / r i if i R, PrW W {i} = j R exp φ j b j / r j, otherwise. 28 Suppose bidder i is chosen as a winner. Then, PASS removes i from R. If bidder j R is in confict with i i.e., r i r j /, then j is aso removed from R. PASS repeats this unti there is no bidder eft in R. Seection of the winner is described formay in Agorithm 2. PASS takes On 2 time to assign virtua channes. For the winner determination, PASS takes On time to assign the probabiity of being chosen to each remaining bidder in an iteration. Since there are at most n iterations, PASS takes On 2 to determine the winners. Therefore, the tota computationa compexity of PASS is On 2. Phase 4: Payment Scheme PASS s winner determination agorithm is monotonic see the next subsection for a proof. According to Theorem 1, the payment for a bidder i is p i b = b i y i b bi y i zdz, 29 where y i z is generaized to be the probabiity that bidder i wins the channe when his bid is z. C. Anaysis of PASS The properties of PASS are anayzed in this subsection. 1 Revenue We first anayze the revenue guarantee of PASS. One of our key steps is to provide an upper-bound for the size of the virtua channes bunde assigned to each bidder. Lemma 4. The size of the virtua channes bunde assigned to each bidder is ess than or equa to 12: r i 12 i N. 3 Proof. Consider the hexagon a 1 in Fig. 2 as an exampe. Due to its topoogica symmetry, we divide a 1 into 12 Agorithm 2 Differentiay Private and Strategy-Proof Spectrum Auction Mechanism Input: A confict graph G = {N,E}, a virtua bid vector φ b, and a vector of virtua channe requests r Output: A set of winners W. 1: W /, / ene/δ,r N. 2: whie R / do 3: for a i R do 4: PrW W {i} = exp φ i b i / r i j R exp φ j b j / r j. 5: end for 6: Seect i according to the computed probabiity distribution. 7: if i is seected then 8: R R \ {i}. 9: for a j R do 1: if r j r i / then 11: R R \ { j}. 12: end if 13: end for 14: end if 15: end whie 16: return W. identica right trianges. We take one of them and denote it by T as shown in the shaded area in a 1. After some simpe cacuation, we can concude that a the bidders in confict with any of the bidders in T ie in the 12 coored hexagons, and no bidder from other hexagon wi be in confict with bidders in T. An arbitrary bidder i must be in one of the right trianges, and hence r i 12. Fig. 2. Bounding r i. We are now ready to prove the revenue guarantee of PASS: Theorem 6. With the probabiity of at east 1 1/n O1, PASS can generate a set of winners with a revenue of at east R EV /12 Onn. Here R EV is the optima revenue. Proof. Let OP T denote the set of bidders with the optima revenue. For an arbitrary auction outcome, we renumber the

9 winning bidders according to the order they are seected assuming a tota of winners, i.e., W = {w 1,w 2,...,w }. For each w W, et OPT w denote the set of bidders satisfy that j OPT w : 1 j OPT. 2 r w r j /. 3 r k r j = / k {w 1,w 2,...,w i 1 }. OPT w is the set of eements in OPT that does not enter W because of w. By taking t = Onn in Theorem 2, we have φ w b w rw φ jb j r j Onn j OPT w. with a probabiity of at east 1 1/n O1. This impies that φ j b j φ wb w r j rw φ j b j + Onn j OPT w. 31 with a probabiity of at east 1 1/n O1. Summing over a j OPT w, and appy the union bound, we have φ w b w rw + Onn r j. 32 with a probabiity of at east 1 1/n O1. By using Cauchy-Schwarz inequaity, we have: r j OPT w r j. 33 Note that every r j for j OPT w intersects with r w, and a the r j s for j OPT w are disjoint since this is an aocation, we have OPT w r w. Aso, by Lemma 4, we have r j r w Pugging into Eq. 32, we have φ w b w φ j b j j OPT rw w + Onn r j j OPT w φ w b w OPT rw + Onn w r j φ w b w rw 12 rw + Onn =12φ w b w + Onn 12φ w b w + Onn. 35 with a probabiity of at east 1 1/n O1. Summing over a w W, we have R EV φ j b j + φ j b j w W j W OPT 12 φ w b w + Onn. 36 w W with a probabiity of at east 1 1/n O1. Thus, the theorem foows. 2 Strategy-proofness Here we prove that PASS achieves strategy-proofness. According to Theorem 1, what we need to prove is that the aocation rue of PASS is monotone i.e., for each bidder i, the probabiity that he is seected as a winner is monotonicay non-decreasing with his bid. Lemma 5. For each bidder i, the probabiity that he is seected as a winner is monotonicay non-decreasing with his bid b i. Proof. Note that the entire geographica area is divided into m hexagons, each of which can have at most one winning bidder. Therefore, W m. For an arbitrary sequence of winner seection {w 1,w 2,...,w } W of ength, that does not contain i, we prove that, if b i grows arger, the probabiity that this sequence is seected becomes smaer. According to the design of PASS, the probabiity that {w 1,w 2,...,w } is the sequence of winning bidders can be computed as = k=1 k=1 exp φ w k b wk rwk j N \{w1,...,w k 1 } exp exp j N \{w1,...,w k 1,i} exp φ jb j r j φ w k b wk rwk φ jb j r j, + exp φ ib i ri which is monotonicay decreasing with b i. Thus, the aocation rue of PASS is monotonicay nondecreasing. By the above Lemmas and Theorem 1, we can concude that PASS achieves strategy-proofness. Theorem 7. PASS achieves strategy-proofness. 3 Differentia Privacy We finay prove that PASS can preserve the bidders vauation privacy. Theorem 8. For any δ 1/2, PASS preserves e 1 ne/δ, δ differentia privacy for bidders virtua bids. Proof. Let φ and φ be two input virtua bid vectors that differ in a singe bidder k s virtua bid, and et b and b be the two corresponding bid vectors, respectivey. We show that PASS achieves bid privacy preservation, even reveaing the order in which the bidders are chosen, for an arbitrary sequence of winners seection W = W = {w 1,w 2,...,w } of arbitrary ength for φ and φ, respectivey. We consider the reative probabiity of PASS resuts for given virtua bids inputs φ and φ : PrW = {w 1,w 2,...,w } PrW = {w 1,w 2,...,w }

10 = = exp φ w i b w i / r wi j N \{πi } exp φ j b j / r j j N \{πi } exp φ j b j /, 37 r j where π i = {w 1,w 2,...,w i }. If φ k b k > φ k b k, the first product is ess than exp : exp φ k b k φ k b k / r k exp φ k b k φ k b k exp, 38 and the second product is ess than 1. If φ k b k < φ k b k, the first product is ess than 1. Therefore, we have PrW = {w 1,w 2,...,w } PrW = {w 1,w 2,...,w } j N \{πi } exp φ j b j / r j j N \{πi } exp φ j b j / r j j N \{πi } exp = α j / r j exp φ j b j / r j j N \{πi } exp φ j b j / r j = where α j = E j exp α j / r j E j N \{πi }exp α j 39 φ j b j φ jb j. Note that for a β 1, we have e β 1 + e 1 β. Therefore, for a 1, we have exp φ wi b wi / r wi / j N \{πi } exp φ j b j / r j exp φ w i b w i / A. Methodoogy r wi / j N \{πi } exp φ j b j / r j exp φ wi b wi / r wi E j N \{πi }exp α j E j N \{πi } 1 + e 1 α j exp e 1 E j N \{πi } α j. If E j N \{π i } α j neδ 1, we have PrW = {w 1,w 2,...,w } PrW = {w 1,w 2,...,w } exp e 1 neδ 1. 4 By Lemma B.2 in 12, we have Pr E j N \{π i } α j > neδ 1 δ. Thus, the theorem foows. VI. NUMERICAL RESULTS We have impemented PASS in a simuator and extensivey evauated its performance. Our evauation resuts show that PASS can not ony generate a reativey high revenue, but aso achieves good differentia privacy. To evauate the performance of PASS in terms of revenue maximization, we compare PASS with DEAR, which is a differentiay private and approximatey truthfu mechanism for spectrum auction proposed in 38 and a truthfu spectrum auction mechanism denoted as TSAWAP proposed in 1. The number of bidders is varied from 1 to 15 with a step of 1, and the bidders are randomy depoyed in a square area of 1m 1m. Each bidder has an interference range of 425m 38. We assume that each bidder s bid foows a uniform distribution over,1. We vary the number of channes from 5 to 15 with a step of 5. We set the privacy constant to.1 and.5, and δ to A the resuts are averaged over 1 runs. We use two metrics to evauate PASS s performance revenue and privacy. Revenue refers to the sum of charges to the bidders. A mechanism guarantees good privacy if the probabiity distribution over an arbitrary outcome has as sma a change as possibe when any bidder uniateray reports a different bid. Foowing the definition of differentia privacy, we definite the the notion of Privacy Leakage note that this is different from the one proposed in 38 to quantitativey measure the privacy guarantee of PASS: Definition 7 Privacy Leakage. Given a mechanism M, et φ and φ be virtua bid vectors for bidding profies b and b, which ony differ in a singe entry, respectivey. Let O be the outcome space The privacy eakage between the two bidding profies is the maximum of absoute differences between the ogarithmic probabiities of any outcome, i.e., max nπ o nπ o, 41 o O where π and π is the probabiity distribution over the outcome space with respect to φ and φ, respectivey. B. Revenue We first evauate PASS s performances in terms of revenue. Fig. 3a shows the comparison of PASS with DEAR and TSAWAP, when the number of channes is 5. From these resuts, PASS is shown to outperform DEAR and TSWAP in neary a the cases in terms of revenue. The ony exception is when the number of bidders is 5 for both =.1 and =.5, DEAR can generate sighty more revenue than PASS. This is because PASS reies on the existence of critica neighbors to generate revenue. When the number of bidders grows, PASS can find critica neighbors with higher bids. Fig. 3b compares PASS with DEAR and TSAWAP, when the number of channes is 1. From these resuts, PASS is outperforms DEAR and TSWAP in neary a of the cases in terms of revenue. The ony exception is when the number of bidders is ess than 1 for both =.1 and =.5, DEAR can generate more revenues than PASS. This is because when 2 The range of each bidder s vauation/bid, budget, and the vaue of, and δ can be chosen differenty from those used here. However, the resuts of using different setups are simiar to those shown in this paper. Therefore, we ony show the resuts for the above setup.

11 Revenue PASS.5 PASS.1 2 DEAR.5 1 DEAR.1 TSAWAP Number of bidders a 5 channes Revenue PASS.5 PASS.1 DEAR.5 2 DEAR.1 TSAWAP Number of bidders b 1 channes Revenue PASS.5 PASS.1 5 DEAR.5 DEAR.1 TSAWAP Number of bidders c 15 channes Fig. 3. Revenue generated by PASS.15 PASS.1 PASS PASS.1 PASS PASS.1 PASS.5 Privacy eakage.1.5 Privacy eakage Privacy eakage Number of bidders Number of bidders Number of bidders a 5 channes b 1 channes c 15 channes Fig. 4. Privacy performance the number of channes increases, PASS cannot find enough critica neighbors to generate revenue. When the number of bidders grows, PASS can find critica neighbors more easiy. Fig. 3c shows the comparison resuts of PASS with DEAR and TSAWAP, when the number of channes is 15. From these resuts, PASS is shown to outperform DEAR and TSWAP in most of the cases in terms of revenue. The ony exception are when the number of bidders is ess than 1 for =.5, and when the number of bidders is than 15 for =.1, DEAR can generate more revenue than PASS. This is aso because PASS reies on the existence of critica neighbors to generate revenue. When the number of channes is arge, PASS cannot find enough critica neighbors. A of the above figures shows that PASS outperforms TSAWAP because TSAWAP can ony use critica neighbors in the same hexagon to generate revenue whie PASS can use critica neighbors in other hexagons to generate revenue. This eads to critica neighbors with higher bids. In summary, PASS is shown to be suitabe for argescae secondary spectrum markets, especiay when spectrum channes are scarce. C. Privacy Next, PASS is evauated in terms of privacy. Fig. 4a shows the privacy eakage of PASS when =.1 and =.5 under this setting, PASS is supposed to achieve e 1/1e,.25 and e 1/2e,.25 differentia privacy, respectivey. The number of channes is 5. The resuts show that PASS s privacy eakage is aways ess than.4 when =.1, and it is aways ess than.15 when =.5. The resuts aso show that when the number of bidders increases, the privacy eakage of PASS decreases. This is because with more bidders, the probabiity of each outcome becomes smaer. Besides, we can see that the privacy performance of PASS is far better than e 1/1e,.25 and e 1/1e,.25 differentia privacy when =.1 and.5, respectivey. Therefore, it is neary impossibe for any agent to earn the bid information of the bidders when PASS is impemented. Figs. 4b and 4c show the privacy eakage of PASS, when the number of channes are 1 and 15, respectivey. The resuts show that the privacy eakage foows the same pattern as the case of 5 channes. We can aso see that PASS reduces privacy eakage when the number of channes grows. This is because when the number of channes grows, the number of winning bidders as we as the outcome grows arger, and thus the privacy is preserved better. These resuts show that PASS achieves good differentia privacy. VII. CONCLUSIONS In this paper, we have presented the first differentiay private and strategy-proof spectrum auction mechanism with approximate revenue maximization. Assuming that the seer has a priori knowedge of the bidders vauation distributions, we have first presented a differentiay private and strategyproof auction mechanism which achieves a near optima expected revenue. In order to tacke the probem of high computationa compexity, we have then presented PASS, which is an approximate differentiay private, strategy-proof, and poynomiay tractabe auction mechanism. We have theoreticay anayzed both mechanisms properties in strategyproofness, revenue, and privacy. We have aso impemented PASS, and evauated its performance extensivey. PASS is shown to be abe to generate reativey high revenue, whie protecting the bid-privacy. REFERENCES 1 M. A-Ayyoub and H. Gupta, Truthfu spectrum auctions with approximate revenue, in INFOCOM, A. Archer and E. Tardos, Truthfu mechanisms for one-parameter agents, in FOCS, 21.

12 3 Y. Chen, S. Chong, I. A. Kash, T. Moran, and S. Vadhan, Truthfu mechanisms for agents that vaue privac, in EC, E. Carke, Mutipart pricing of pubic goods, in Pubic Choice, T. Cover and J. Thomas, Eements of Information Theory. John Wiey & Sons, Inc., D. C. Cox and D. O. Reudink, Dynamic channe assignment in high capacity mobie communication system, Be System Technica Journa, vo. 5, no. 6, pp , S. Dobzinski and N. Nisan, Limitations of vcg-based mechanisms, in STOC, S. Dobzinski, N. Nisan, and M. Schapira, Truthfu randomized mechanisms for combinatoria auctions, in STOC, C. Dwork, F. McSherry, K. Nissim, and A. Smith, Caibrating noise to sensitivity in private data anaysis, in TCC, Federa Communications Commission FCC Spectrum Auction, home. 11 A. V. Godberg, J. D. Hartine, and A. Wright, Competitive auctions and digita goods, in SODA, A. Gupta, K. Ligett, F. McSherry, A. Roth, and K. Tawar, Differentiay private combinatoria optimization, in SODA, J. Hartine and B. Lucier, Bayesian agorithmic mechanism design, in STOC, H. Huang, X.-Y. Li, Y. e Sun, H. Xu, and L. Huang, Pps: Privacypreserving strategyproof socia-efficient spectrum auction mechanisms, in Q. Huang, Y. Tao, and F. Wu, SPRING: A strategy-proof and privacy preserving spectrum auction mechanism, in INFOCOM, Z. Huang and S. Kannan, Exponentia mechanism for socia wefare: private, truthfu, and neary optima, in FOCS, J. Jia, Q. Zhang, Q. Zhang, and M. Liu, Revenue generation for truthfu spectrum auction in dynamic spectrum access, in MobiHoc, G. Kosmopouou and S. Wiiams, The robustness of the independent private vaue mode in bayesian mechanism design, in Economic theory, R. Lavi and C. Swamy, Truthfu and near optima mechanism design via inear programming, in FOCS, D. Lehmann, L. I. O Caaghan, and Y. Shoham, Truth reveation in approximatey efficient combinatoria auctions, in EC, S. Leung and E. Lui, Bayesian mechanism design with efficiency, privacy, and approximate truthfuness, in WINE, A. Mas-Coe, M. D. Whinston, and J. R. Green, Microeconomic Theory. Oxford Press, F. McSherry and K. Tawar, Mechanism design via differentia privacy, in FOCS, M. Naor, B. Pinkas, and R. Sumner, Privacy preserving auctions and mechanism design, in EC, N. Nisan and A. Ronen, Agorithmic mechanism design, in STOC, N. Nisan, Bidding and aocation in combinatoria auctions, in EC, N. Nisan, T. Roughgarden, E. Tardos, and V. V. Vazirani, Agorithmic Game Theory. Cambridge University Press, K. Nissim, C. Orandi, and R. Smorodinsky, Privacy-aware mechanism design, in EC, K. Nissim, R. Smorodinsky, and M. Tennenhotz, Approximatey optima mechanism design via differentia privacy, in ITCS, A. L. Ny, Introduction to generaized gibbs measures, in Ensaios Matematicos, M. J. Osborne and A. Rubenstein, A Course in Game Theory. MIT Press, M. Pan, J. Sun, and Y. Fang, Purging the back-room deaing: Secure spectrum auction everaging paiier cryptosystem, in JSAC, C. H. Papadimitriou, Agorithms, games, and the internet, in STOC, D. Wedein, An agorithm for arge scae 1 integer programming with appication to airine crew scheduing, Annas of Operations Research, vo. 57, no. 1, pp , D. Xiao, Is privacy compatibe with truthfuness? in ITCS, X. Zhou, S. Gandhi, S. Suri, and H. Zheng, ebay in the sky: Strategyproof wireess spectrum auctions, in MobiCom, X. Zhou and H. Zheng, Trust: A genera framework for truthfu doube spectrum auctions, in INFOCOM, R. Zhu, Z. Li, F. Wu, K. G. Shin, and G. Chen, Differentiay private spectrum auction with approximate revenue maximization, in MobiHoc, 214.