Anonymity-Proof Voting Rules

Transcription

1 Anonymity-Proo Voting Rules Vincent Conitzer Department o Computer Science & Department o Economics Duke University Durham, NC 27708, USA conitzer@cs.duke.edu ABSTRACT In open, anonymous environments such as the Internet, mechanism design must be extended to take new types o manipulation into account especially, the possibility that an agent participates in the mechanism multiple times. General social choice or voting settings lie at the heart o mechanism design and provide a natural starting point. A (randomized, anonymous) voting rule maps any multiset o total orders o (aka. votes over) a ixed set o alternatives to a probability distribution over these alternatives. A voting rule is neutral i it treats all alternatives symmetrically. It satisies participation i no voter ever beneits rom not casting her vote. It is alse-name-proo i no voter ever beneits rom casting additional (potentially dierent) votes. It is anonymity-proo i it satisies participation and it is alse-name-proo. We show that the class o anonymity-proo neutral voting rules consists exactly o the rules o the ollowing orm. With some probability k [0, 1], the rule chooses an alternative uniormly at random. With probability 1 k, the rule irst draws a pair o alternatives uniormly at random. I every vote preers the same alternative between the two (and there is at least one vote), then the rule chooses that alternative. Otherwise, the rule lips a air coin to decide between the two alternatives. This characterization has several implications that are not true or strategy-prooness. For example, i there are at least 3 alternatives, then even i everyone preers the same alternative, we cannot choose this alternative with probability 1 (unlike in the case o strategy-prooness, where the random-dictator rule will achieve this). As another example, even i there are only 2 alternatives, we must lip a coin to decide between them unless there is complete consensus (unlike in the case o strategy-prooness or even group strategy-prooness, where we can simply run the majority rule). On the positive side, the result implies that all anonymity-proo rules are computationally easy to run. We also show how the characterization changes i group strategyprooness is added as a requirement. Categories and Subject Descriptors J.4 [Computer Applications]: Social and Behavioral Sciences Economics; I.2.11 [Distributed Artiicial Intelligence]: Multiagent Systems General Terms Algorithms, Economics, Theory Keywords False-name-prooness, mechanism design, social choice, elections and rating on the Internet 1. INTRODUCTION In many settings, a decision must be made on the basis o the preerences o multiple parties (typically reerred to as agents in economics). Common examples include auctions and exchanges (where we must decide on an allocation o resources, as well as payments to be made or received by the agents) and elections (where we must decide on, say, one or more political representatives), but there are many other applications. A (direct-revelation) mechanism takes each agent s reported preerences as input, and produces a decision as output. An important issue is that sel-interested agents will lie about their preerences i they perceive it to be to their advantage to do so. Mechanism design (sometimes viewed as a subield o game theory) studies how to design mechanisms that produce good outcomes in spite o this. A key concept in mechanism design is that o strategy-prooness: a mechanism is strategy-proo i no agent can ever beneit rom lying about her preerences. Strategy-prooness is roughly synonymous with truthulness and incentive compatibility. 1 In mechanism design, attention is usually restricted to incentive compatible direct-revelation mechanisms. This is justiied by a result known as the revelation principle [8, 10, 14, 15], which states (roughly) that, given that agents will misreport their preerences i they perceive this to be to their beneit, anything that can be achieved by some mechanism can also be achieved by an incentive compatible direct-revelation mechanism. 2 In recent years, there has been an explosion o interest in mech- 1 To be more precise, strategy-prooness as the term is used here corresponds to dominant-strategies incentive compatibility. There are weaker notions o incentive compatibility, such as Bayes-Nash incentive compatibility, where in expectation over the other agents preerences an agent is best o reporting her true preerences. 2 To predict what will happen under a mechanism that is not incentive compatible, some solution concept rom game theory must be used, and the version o incentive compatibility in the revelation principle depends on the choice o solution concept.

2 anism design in both the artiicial intelligence and the theoretical computer science communities. This interest is driven in part by necessity, as computer scientists encounter more settings in which multiple sel-interested agents must interact; and in part by opportunity, as there are many issues in mechanism design that are undamentally computational in nature. While much o this work has ocused on computational aspects o running or designing mechanisms, it is increasingly common or computer scientists to develop new characterizations o easible mechanisms (e.g. [21, 12, 3, 13]); while such work is not in and o itsel computational in nature, it can be o great help in identiying computationally tractable mechanisms. In mechanism design, the spaces o possible outcomes and preerences oten display a great deal o structure, which acilitates the designer s job. For example, in auctions and exchanges, it is generally assumed that agents can make and receive payments, that their utility is linear in this payment, and that the eect o the payment on utility is independent o the rest o the outcome. This enables, or example, Vickrey-Clarke-Groves mechanisms [19, 5, 11], which always choose the eicient allocation. However, such structure is not always available: or example, in an election, payments can typically not be made. I we do not assume any structure on the agents preerences, then agents can rank the possible outcomes (aka. alternatives) in any possible way. These general settings, in which each agent ranks all the alternatives, and the mechanism chooses an alternative based on these rankings, are commonly reerred to as voting settings. The rankings are the votes, and the mechanism is usually called a voting rule. The revelation principle applies to voting settings just as it does to any other mechanism design setting, so we should ask which rules are strategy-proo. Gibbard [9] provides a complete characterization o strategy-proo voting rules that are allowed to use randomization. (This characterization generalizes the better-known, earlier Gibbard-Satterthwaite theorem [8, 18].) He shows that any strategy-proo rule is a randomization over unilateral rules, in which only one vote aects the outcome, and duple rules, in which only two alternatives have a chance o winning. (Because the overall rule is a randomization over such rules, it can still be the case that every voter aects the probability with which an alternative is chosen, and that every alternative has a positive probability o winning. Hence, Gibbard s characterization is not universally seen as a negative result [1].) He also provides some additional conditions on these rules to obtain an exact characterization o the strategy-proo voting rules. However, especially rom the perspective o a computer scientist, strategy-prooness is oten not suicient. In open, anonymous environments such as the Internet, an agent can manipulate the mechanism in other ways. For one, i an agent does not participate in the mechanism, then the party running the mechanism (aka. the center) is not even aware o her existence. Perhaps more signiicantly, an agent can open multiple accounts and participate in the mechanism multiple times under dierent identiiers and the center cannot know which identiiers correspond to the same agent. This led to the concept o alse-name-prooness [23, 24]. A mechanism is alse-name-proo i an agent can never beneit rom using multiple identiiers. Various positive and negative results on alsename-prooness have been obtained or combinatorial auctions and similar settings (e.g. [23, 21, 24, 22, 17]), but to our knowledge this concept has not yet been studied in voting settings. In this paper, we deine a (possibly randomized) voting rule to be anonymity-proo i it is alse-name-proo, and it never hurts an agent to cast her (true) vote. Under the same model as Gibbard [9], we obtain a complete characterization o the anonymity-proo neutral voting rules. (A voting rule is neutral i it treats all alternatives symmetrically.) The proo is rom irst principles and (arguably) o reasonable length. The resulting class o voting rules is very limited (hence the result is mostly negative), but it does allow a modicum o responsiveness to the votes in cases where there is complete agreement among the voters on some pairs o alternatives. For example, in the special case where there are only two alternatives, the characterization tells us that i all votes preer the same alternative, we can choose that alternative; but otherwise, we have to lip a air coin to decide between them. This is in stark contrast to the case where we require only strategy-prooness: simply choosing the alternative that is preerred by more voters (the majority rule) is strategy-proo. 1.1 Additional motivation Our primary reason or studying alse-name-prooness in general social choice (voting) settings is that these settings lie at the heart o mechanism design, and hence provide the most natural starting point or a thorough study o the concept o alse-name-prooness. Nevertheless, perhaps surprisingly, anonymous voting is in act a very real and growing phenomenon on the Internet. It may seem that anonymous elections are unlikely to result in outcomes that relect society s preerences well (and, in act, this paper can be seen as a commentary on just how unlikely this is). However, it appears that in practice, oten, the party organizing the election has more interest in publicity than in a properly chosen outcome; moreover, the convenience o anonymous Internet voting appeals to the voters as well. A very recent example o this phenomenon is the New 7 Wonders o the World election, a global election that was organized by businessman Bernard Weber to elect contemporary alternatives to the ancient wonders. Anyone could vote, either by phone or over the Internet; or the latter, an address was required. One could also buy additional votes (o course, using another address was a much cheaper alternative). UNESCO iercely distanced itsel rom the project, concluding [16]: There is no comparison between Mr. Weber s mediatised campaign and the scientiic and educational work resulting rom the inscription o sites on UNESCO s World Heritage List. The list o the 7 New Wonders o the World will be the result o a private undertaking, relecting only the opinions o those with access to the Internet and not the entire world. This initiative cannot, in any signiicant and sustainable manner, contribute to the preservation o sites elected by this public. Indeed, the election proceeded in a bizarre ashion. In Brazil, companies aggressively sponsored votes or Rio de Janeiro s Christ the Redeemer statue, so that Brazilians received text messages on their cell phones saying Press 4916 and vote or Christ. It s ree! Jordan, with a population o 7 million, managed to cast over 14 million votes or their archeological site Petra. Both sites were elected as new wonders on 7/7/2007. In spite o these and other issues, the election seems to have attained some legitimacy in the public s mind due to star-studded events and signiicant, serious press coverage. Even the organizers acknowledged that they had no idea that this would take o the way it did. But that s the power o the Internet [7]. The website reports that there were more than 100 million votes. Weber has begun a similar campaign to decide

3 the seven natural wonders o the world. For better or worse, mechanisms such as these are going to eature increasingly prominently in our economy and social inrastructure. Hence, the theory o mechanism design must be extended so that it can provide guiding principles to maximize the eiciency and trustworthiness o such mechanisms. The sooner this happens, the ewer bad mechanisms will take hold. Our results also apply to Internet rating systems in which anonymous reviewers rate products, sellers, etc. Here, the set o alternatives is the set o possible (inal, aggregate) ratings. It should be noted that in this context, it makes sense or agents preerences to be restricted: or example, it makes little sense or an agent to preer high low medium or a product s inal rating. Speciically, single-peaked preerences [4] are a natural restriction in this domain; we will discuss such preerences in the conclusion. 2. DEFINITIONS Let X, X = m, be the set o alternatives over which the voters are voting. A voter s preerences are given by a total order over the alternatives, together with a vector o utilities u = (u 1,..., u m) where u i is the voter s utility or the alternative that she ranks ith. (It is required that u i > u i+1 or all 1 i m.) Each voter seeks to maximize her expected utility. As in Gibbard [9], voters only report a total order (ranking) o the alternatives (not their utilities); a reported ranking is called a vote. Again as in Gibbard [9], we do not allow or indierences (real or reported) between alternatives. We will use the notation v = a 1... a m or a vote. We will sometimes also use subsets in the order notation: or example, i B = {b 1, b 2, b 3}, then a 1 b 1 b 2 b 3 a 2 and a 1 b 3 b 1 b 2 a 2 are both o the orm a 1 B a 2 (but, or instance, a 1 b 3 b 2 a 2 b 1 is not o this orm). A voting rule takes a multiset 3 o votes V as input, and chooses the winning alternative based on these votes (possibly using randomization). Let P (V, a) denote the probability with which chooses a given votes V ; the unction P deines the rule. A voting rule is neutral i it treats all alternatives symmetrically that is, i π is a permutation o the alternatives, then P (π(v ), π(a)) = P (V, a) (where π(v ) is the multiset that results rom replacing each alternative a by π(a) in each vote in V ). In act, the ollowing weaker deinition o neutrality will also suice or our purposes: i a subset B o the alternatives is symmetric in V (that is, or any permutation π or which π(a) = a or all a X B, π(v ) = V ), then P (V, b 1) = P (V, b 2) or all b 1, b 2 B. We are only interested in neutral voting rules. 4 DEFINITION 1. A voting rule is alse-name-proo i or any multiset o votes V, or any v V, v = a 1... a m, or any decreasing u = (u 1,..., u m), and or any multiset o votes V, we have P m j=1 P (V, a j)u j P m j=1 P (V V, a j)u j. That is, the voter corresponding to v cannot increase her expected utility by additionally casting votes V. 3 This is implicitly assuming that every vote is treated equally; anything else would seem unreasonable in open, anonymous environments. Rules that treat every vote equally are commonly called anonymous; this is not to be conused with the deinition o anonymity-prooness. 4 Sometimes rules that are not neutral are o interest, or example i one alternative is the incumbent and should be treated specially; but in most settings, only neutral rules are o interest. It should be noted that under this deinition, a voter who uses alse names is assumed to cast at least one vote representing her true preerences. This only weakens the requirement. All o the rules in the characterization result o this paper are also alse-name-proo in the stronger sense where none o the votes cast by the alsename voter are required to represent her true preerences. Hence, the characterization remains the same i this stronger requirement is used. DEFINITION 2. A voting rule satisies participation i or any multiset o votes V, or any v V, v = a 1... a m, or any decreasing u = (u 1,..., u m), we have P m j=1 P (V, a j)u j P m j=1 P (V {v }, a j)u j. That is, the voter corresponding to v cannot increase her expected utility by not casting her vote. DEFINITION 3. A voting rule is anonymity-proo i it is alsename-proo and it satisies participation. Anonymity-prooness does not directly mention strategy-prooness. Thus, it may appear that even i a rule is anonymity-proo, it is possible that a voter can beneit rom misreporting her preerences. However, all o the rules in the characterization result o this paper are also strategy-proo (this is implied by the act that they satisy the stronger version o alse-name-prooness). Hence, the characterization remains the same i strategy-prooness is added as a requirement. 3. THE CHARACTERIZATION OF ANONYMITY-PROOF RULES In this section, we prove the main result. Showing that all the rules in the proposed class are anonymity-proo is not diicult; most o the proo consists o showing that all rules that are anonymityproo are in the class. We prove the latter part using a sequence o six lemmas. Assuming the rule is anonymity-proo, these lemmas demonstrate how to transorm any multiset o votes to a particular multiset o only two votes, without aecting one given alternative s probability o winning; and they demonstrate that that alternative s probability o winning in those two votes is as the theorem states. The irst lemma is a undamental building block o the proo. It states that i we add a vote that agrees with an existing vote on the top k and bottom l k alternatives, then the probability o winning or each o those alternatives does not change. LEMMA 1. Consider a multiset o votes V, and suppose that or some v V, v is o the orm a 1... a k B a k+1... a l. Let v (not necessarily in V ) be another vote o the orm a 1... a k B a k+1... a l (that is, it is identical to v except or the internal ordering o B). Then, i is anonymityproo, or any 1 i l, P (V, a i) = P (V {v }, a i). PROOF. First, let us suppose that or some 1 i k, P (V, a i) P (V {v }, a i). Without loss o generality, suppose that or any 1 j < i, P (V, a j) = P (V {v }, a j). Consider the utility vector u = (1 ɛ, 1 2ɛ,..., 1 iɛ, (m i)ɛ, (m i 1)ɛ,..., ɛ). First, let us suppose that P (V, a i) < P (V {v }, a i). Then, i the true preerences are given by V, the voter casting v has utility vector u, and ɛ is suiciently small, then the voter casting v has an incentive to cast v as well. This is because (as ɛ 0) she

4 eectively seeks to maximize the probability o one o a 1,..., a i winning, and casting v as well does not aect the probabilities o a 1,..., a i 1 winning and increases that o a i. On the other hand, suppose that P (V, a i) > P (V {v }, a i). Then, i the true preerences are given by V {v }, the voter casting v has utility vector u, and ɛ is suiciently small, then the voter casting v has an incentive to not participate. This is because (as ɛ 0) she eectively seeks to maximize the probability o one o a 1,..., a i winning, and not participating does not aect the probabilities o a 1,..., a i 1 winning and increases that o a i. Hence, or any 1 i k, P (V, a i) = P (V {v }, a i). The case where P (V, a i) P (V {v }, a i) or some k + 1 i l can be shown to contradict either alse-name-prooness or participation by a symmetric argument (where, supposing without loss o generality that P (V, a j) = P (V {v }, a j) or all i < j l, the voter casting v or v eectively tries to minimize the probability o one o the last l i + 1 alternatives winning). We obtain the ollowing corollary, which states that it does not matter i the same vote is cast more than once. (This corollary is usually not powerul enough to use instead o the more general Lemma 1, but it provides some insight. In particular, or any ixed number o alternatives, this leaves only a inite number o multisets o votes to consider.) COROLLARY 1. For an anonymity-proo rule, given that a vote is cast at least once, it does not matter how oten it is cast. PROOF. This ollows rom setting B = in Lemma 1. The next ew lemmas (2, 3, and 4) demonstrate how to transorm any multiset o votes into a multiset o only two votes, without aecting one given alternative a s probability o winning (assuming that the rule is anonymity-proo). Lemma 1 allows us to prove the ollowing lemma, which states that reordering the alternatives ater a given alternative a in a vote, as well as reordering those beore a, does not aect a s probability o winning, unless we move alternatives past a. LEMMA 2. Consider a multiset o votes V, and suppose that or some v V, v is o the orm B a C. Let v (not necessarily in V ) be another vote o the orm B a C (that is, it is identical to v except or the internal ordering o B and C). Then, i is anonymity-proo, P (V, a) = P ((V {v}) {v }, a). That is, we can permute the alternatives on either side o a in a vote without aecting a s probability o winning. PROOF. Suppose irst that we permute only C, that is, that a is ordered the same way in both v and v. Then, we can apply Lemma 1 (letting a correspond to a k in that lemma) to obtain P (V, a) = P (V {v }, a), and similarly P ((V {v}) {v }, a) = P (V {v }, a), hence P (V, a) = P ((V {v}) {v }, a). The case where we permute only B can be proven symmetrically. But then, in the general case where both B and C are permuted, we can transorm v into v in two steps, as ollows. Let v be the vote o the orm B a C that agrees with v on B but with v on C. By the above, we have P (V, a) = P ((V {v}) {v }, a) = P ((V {v}) {v }, a). The next lemma shows that we can move an alternative b past a given alternative a in a vote, without aecting a s probability o winning, i the other votes disagree on the relative ranking o a and b. LEMMA 3. Consider a multiset o votes V, and suppose that or some v V, a is ranked beore b. Additionally, suppose there is another vote v V that ranks a beore b, and a third vote v V that ranks b beore a. Let v be a vote (not necessarily in V ) that is obtained rom v by improving b s position, placing it somewhere ahead o a (while not changing the order in any other way). Then, i is anonymity-proo, P (V, a) = P ((V {v}) {v }, a). That is, we can move b to the other side o a in a vote without aecting a s probability o winning, i there are other votes that rank a beore b and b beore a. PROOF. Let us irst assume that a and b are adjacent in v and v. That is, a is ranked directly beore b in v, and v is obtained rom v simply by swapping a and b. By Lemma 1 (letting {a, b} correspond to B in that lemma), or any alternative c / {a, b}, P (V, c) = P (V {v }, c), and also P ((V {v}) {v }, c) = P (V {v }, c). Now, i we suppose that P (V, a) < P (V {v }, a), then, i the true preerences are given by V, the voter corresponding to v would be better o casting v as well (since it will only aect the probabilities o a and b being elected, and v preers a). Conversely, i P (V, a) > P (V {v }, a), then the voter corresponding to v would be better o casting v as well. Hence, since is alse-name-proo, P (V, a) = P (V {v }, a). It similarly ollows that P ((V {v}) {v }, a) = P (V {v }, a) (since v and v are still present in (V {v}) {v }). Hence, P (V, a) = P ((V {v}) {v }, a). Now let us return to the general case where a and b are not necessarily adjacent in v and v. Let v be the result o improving b s position in v to just ater a, and let v be the result o swapping a and b in v. Using Lemma 2, P (V, a) = P ((V {v}) {v }, a); using the above argument, P ((V {v}) {v }, a) = P ((V {v}) {v }, a); and using Lemma 2 again, P ((V {v}) {v }, a) = P ((V {v}) {v }, a). In the next lemma, we use the previous lemmas to reduce a set o votes to a particular pair o votes, without aecting a s probability o winning. LEMMA 4. Given a nonempty multiset o votes V and a distinguished alternative a, let B be the set o alternatives that are ranked beore a by every vote in V, let C be the set o alternatives that are ranked beore a by some votes in V and ater a by others, and let D be the set o alternatives that are ranked ater a by every vote in V. Let v (not necessarily in V ) be a vote o the orm B a C D, and let v (not necessarily in V ) be a vote o the orm B C a D. Then, i is anonymity-proo, P (V, a) = P ({v, v }, a). PROOF. By Corollary 1 we can add copies o votes without aecting any winning probabilities, hence we can assume without loss o generality that there are at least 3 votes in V. First, we use Lemmas 2 and 3 to change an arbitrary one o V s votes (let us call this vote v ) into v, without changing the probability o a winning, as ollows. By Lemma 2, we only need to get this vote

5 in the orm B C a D. v must already be o the orm B C 1 {a} D C 2 (or some partition C = C 1 C 2), hence we only need to move each element c C 2 ahead o a. We can use Lemma 3 to do so, unless v is the only vote in which a is ranked ahead o c. I this is the case, because there are at least 3 votes, we can use Lemma 3 to irst move c ater a in one o the other votes, ater which we can move c ahead o a in the vote (that was originally) v. Now that v is one o our votes, we change every other vote into v using Lemmas 2 and 3, as ollows. Again, by Lemma 2, we only need to get such a vote into the orm B a C D, and the vote must already be o the orm B C 1 {a} D C 2. We can use Lemma 3 to move every c C 1 ater a, because v ranks c ahead o a, and at least one other vote ranks a ahead o c. At this point, we have one vote v and multiple votes v. But by Corollary 1 we can remove the duplicates o v, obtaining {v, v } without having changed a s probability o winning. It should be noted that Lemma 4 does not cover the case where V = ; in this case, neutrality demands that an alternative be chosen uniormly at random. The next lemma characterizes the behavior o an anonymity-proo voting rule when only a single vote is cast. LEMMA 5. Let v = a 1... a m. Let be anonymity-proo and neutral, and let p i = P ({v}, a i). Then, or some constant 0 k 1, p i = k /m+(1 k )(m i) 2/(m(m 1)). That is, with probability k the rule chooses an alternative at random, and with probability 1 k it draws a pair o alternatives at random and chooses the preerred one. PROOF. For an arbitrary 1 i m 2, consider the votes v = a 1... a i 1 a i+1 a i a i+2 a i+3... a m and v = a 1... a i 1 a i a i+2 a i+1 a i+3... a m. Note that v, v, and v are all o the orm a 1... a i 1 {a i, a i+1, a i+2} a i+3... a m. Thus, by Lemma 1, letting V = {v, v, v }, or any 1 j i 1 or any i + 3 j m, P (V, a j) = p j. It ollows that P (V, a i)+p (V, a i+1)+p (V, a i+2) = p i +p i+1 +p i+2. Moreover, since v can be obtained rom v by swapping a i+1 and a i+2, by Lemma 1, P (V, a i) = P ({v, v }, a i). Again by Lemma 1, or any 1 j i 1 or any i + 2 j m, P ({v, v }, a j) = p j. It ollows that P ({v, v }, a i) + P ({v, v }, a i+1) = p i + p i+1 ; moreover, by neutrality, P ({v, v }, a i) = P ({v, v }, a i+1) = (p i +p i+1 )/2. Hence P (V, a i) = (p i +p i+1 )/2. It can symmetrically be shown (using the vote set {v, v }) that P (V, a i+2) = (p i+1 +p i+2 )/2. It ollows that P (V, a i+1) = p i +p i+1 +p i+2 (p i + p i+1 )/2 (p i+1 + p i+2 )/2 = (p i + p i+2 )/2. However, we can obtain another expression or P (V, a i+1) as ollows. By Lemma 1, we can add votes a 1... a i 1 a i+1 a i+2 a i a i+3... a m and a 1... a i 1 a i+2 a i a i+1 a i+3... a m without aecting the probability o a i+1 winning. We can also add the vote a 1... a i 1 a i+2 a i+1 a i a i+3... a m, by adding a copy o v using Corollary 1 and then moving a i+2 up two places (which does not aect the probability o a i+1 winning, by Lemma 3). But in the resulting vote set, a i, a i+1, and a i+2 are symmetric, and because by Lemma 1 all the other alternatives still have the same probability, it ollows that P (V, a i+1) = (p i + p i+1 + p i+2 )/3. Subtracting the latter expression or P (V, a i+1) rom the ormer we obtain 0 = (p i +p i+2 )/6 p i+1 /3, or equivalently p i+2 p i+1 p i+1 = p i. It ollows that p i is a linear unction o i. P m i=1 pi = 1, so the average value o p i must be 1/m. Moreover, the p i must be nonincreasing in i (otherwise, i v is the only vote, that voter would preer to not participate and obtain the uniorm distribution over alternatives). The most sharply decreasing unction would set p i = (m i) 2/(m(m 1)) so that p m = 0 and p 1 = 2/m. Hence, any correct unction or p i must be a weighted average o this unction and the constant unction that gives probability 1/m to each alternative. The inal lemma characterizes the probability o a winning in the special pair o votes rom Lemma 4, using Lemma 5. LEMMA 6. Let v be a vote o the orm B a C D, and let v be a vote o the orm B C a D. Then, i is anonymityproo and neutral, P ({v, v }, a) = k /m + (1 k )(2 D + C )/(m(m 1)), where k is deined as in Lemma 5. That is, the probability that a wins is the same as under the ollowing rule or selecting the winner: with probability k the rule chooses an alternative at random; with probability 1 k it draws a pair o alternatives at random, and i every vote preers the same alternative between the two, it chooses that alternative, otherwise it lips a air coin to decide between the two alternatives. PROOF. Using Lemma 2, we can assume without loss o generality that v is o the orm B a C D, that v is o the orm B C a D, and moreover that the internal orderings o B and D are the same in both votes. By Lemmas 1 and 5, this implies that the alternative ranked ith in B wins with probability p i, and the alternative ranked ith in D wins with probability p B + C +1+i. Now, suppose that P ({v, v }, a) < k /m + (1 k )(2 D + C )/(m(m 1)). Let us consider the utility vector u = (1 ɛ, 1 2ɛ,..., 1 ( B +1)ɛ, ( C + D )ɛ, ( C + D 1)ɛ,..., ɛ). Then, i the true preerences are given by {v, v }, the voter casting v has utility vector u, and ɛ is suiciently small, then the voter casting v has an incentive to cast a number o additional votes o the orm B {a} C D (with B and D in the same order as in v), in such a way that all alternatives in {a} C are symmetric in the resulting vote set. This is because (as ɛ 0) she eectively seeks to maximize the probability o one o B {a} winning; by Lemma 1, her additional votes will not aect the winning probabilities o the alternatives in B and D; and by neutrality, the resulting probability o a winning will be (1/( C + 1)) P B + C +1 i= B +1 p i = (1/( C + 1)) P B + C +1 i= B +1 k /m + (1 k )(m i) 2/(m(m 1)) = k /m+(1 k )(m B 1+m B C 1)/2 2/(m(m 1)) = k /m + (1 k )(2m 2 B C 2)/(m(m 1)) = k /m + (1 k )(2 D + C )/(m(m 1)). Hence, alse-nameprooness implies P ({v, v }, a) k /m + (1 k )(2 D + C )/(m(m 1)). By a symmetric argument, in which the voter corresponding to v eectively tries to minimize the probability o one o {a} D winning, it can be shown that P ({v, v }, a) k /m + (1 k )(2 D + C )/(m(m 1)). Using the last three lemmas, the main result is now easy to prove. It states that any anonymity-proo neutral rule is either the rule that chooses an alternative at random, or the rule that draws two alternatives at random and runs the unanimity rule on these two alternatives, or a convex combination o these two rules.

6 THEOREM 1. The class o voting rules that are anonymityproo and neutral consists exactly o the ollowing rules. With some probability k [0, 1], the rule chooses an alternative uniormly at random. With probability 1 k it draws a pair o alternatives uniormly at random; I every vote preers the same alternative between the two (and there is at least one vote), then it chooses that alternative. Otherwise, it lips a air coin to decide between the two alternatives. (All these rules are also alse-name-proo in a stronger sense where the voter need not cast any vote with her true preerences, and this also implies that they are all strategy-proo.) PROOF. Let us irst show that these rules indeed have the desired properties. They are clearly neutral. Conditional on a single random alternative being chosen, voters have no incentive to use alse names or to not participate. Conditional on a random pair a, b o alternatives being drawn, there are our possibilities or a voter (who, without loss o generality, preers a): 1. There are no other votes. In this case, the voter has a strict incentive to participate so that a is chosen, and no incentive to use alse names. 2. All other votes preer a. In this case, the voter has no incentive to use alse names or not participate, since a will be chosen in any case. 3. All other votes preer b. In this case, the voter has a strict incentive to participate so that at least a coin is lipped, and no incentive to use alse names. 4. There are other votes that preer a and other votes that preer b. In this case, the voter has no incentive to use alse names or not participate, since a coin will be lipped in any case. We now show that there are no other rules with the desired properties. Let be anonymity-proo and neutral. Lemma 5 deines k or this rule. Now, or an arbitrary multiset o votes V and an arbitrary alternative a, Lemma 4 shows how to convert V to a particular set o two votes {v, v }, in a way that preserves a s probability o winning, and also preserves a s relationship to any other alternative b in the ollowing sense: I all votes preer a to b in V, the same is true in {v, v }. I all votes preer b to a in V, the same is true in {v, v }. I some but not all votes preer a to b in V, the same is true in {v, v }. Finally, Lemma 6 shows that or this set o two votes {v, v }, alternative a s probability o winning is as in the claim o this theorem. Because o the preservation properties o the conversion, this must also be true or the original set o votes V. 4. DISCUSSION In this section, we study some corollaries o the main result, and make some comparisons to rules that are only strategy-proo. The characterization makes it clear that the optimal anonymityproo rule (in any reasonable sense o the word optimal ) is the one corresponding to k = 0, since this rule maximizes the probability that we can at least choose the better o two alternatives (i all votes agree). Even this rule is limited in the extent to which it can respond to the votes: COROLLARY 2. Under an anonymity-proo rule, the probability o any given alternative a winning is at most 2/m (or any multiset o votes). This probability is attained i and only i k = 0 and all votes rank a irst. This is in sharp contrast to the class o strategy-proo rules. For example, it is strategy-proo to draw one o the votes at random and choose its most-preerred alternative (oten reerred to as the random-dictator rule). Under this rule, i an alternative ranks irst in all votes, it will be chosen with probability 1. Also, within the class o strategy-proo rules, there is no rule that is clearly optimal. For example, it is also strategy-proo to draw a pair o alternatives at random, and choose the one that is preerred by more voters. Unlike the random-dictator rule, i there is an alternative that ranks irst in all votes, this rule does not necessarily choose it; on the other hand, unlike the random-dictator rule, this rule does not run the risk o choosing an alternative that is ranked last by almost every vote (but irst by a ew). Another sharp contrast between strategy-proo rules such as the above two and any anonymity-proo rule is the ollowing. For the winning alternative not to be chosen uniormly at random, anonymityproo rules require complete agreement on at least one pair o alternatives: COROLLARY 3. I V and a are such that or any b a, there is a vote in V that preers a to b, as well as one that preers b to a, then or any anonymity-proo voting rule, P (V, a) = 1/m. PROOF. I a pair o alternatives including a is drawn, a coin toss will result. Thereore P (V, a) = k /m+(1 k )(2/m)(1/2) = 1/m. Our inal corollary is computational in nature: COROLLARY 4. For any anonymity-proo voting rule, it is easy to compute P (V, a) or any inputs V and a. PROOF. I m 1 is the number o alternatives that are always ranked ater a, and m 2 is the number o alternatives that are sometimes ranked beore a, and sometimes ranked ater a, then P (V, a) = k /m + (1 k )(2m 1 + m 2)/(m(m 1)). It is not immediately clear i a similar result holds or strategy-proo rules. For one, it is not immediately clear i there is a natural concise representation or such rules. (In contrast, per Theorem 1, an anonymity-proo neutral voting rule can be represented by a single number k [0, 1].)

7 5. EXTENSION: GROUP STRATEGY-PROOFNESS A stronger notion than strategy-prooness is group strategy-prooness. A mechanism is group strategy-proo i there is never a coalition o agents that can jointly misreport their preerences so that they are all better o. An analogous result to Gibbard s characterization o strategy-proo voting rules has been given or group strategyprooness [2]. Neither o group strategy-prooness and anonymity-prooness implies the other. For example, with two alternatives, the majority rule is group strategy-proo. On the other hand, as it turns out, not all o the rules in Theorem 1 are group strategy-proo. The ollowing theorem shows how the characterization in this paper changes i group strategy-prooness is added as a requirement. THEOREM 2. The class o voting rules that are anonymityproo, group strategy-proo, and neutral consists exactly o the ollowing rules. For two alternatives, the rules that satisy the conditions are the same as in Theorem 1. For three or more alternatives, only the rule that chooses an alternative uniormly at random satisies the conditions. PROOF. For two alternatives, under any o the rules rom Theorem 1, to increase the probability o one alternative winning, it is necessary to get some o the voters that preer the other alternative to change their votes but o course they have no incentive to do so. Hence these rules are strategy-proo. For three or more alternatives, all we need to show is that i k < 1, then the rule is not group strategy-proo. (The k = 1 rule is group strategy-proo because it completely ignores the votes.) For three alternatives, consider the ollowing proile o preerences: voter one preers a b c, with utilities 3, 1, 0, respectively; voter two preers c b a, also with utilities 3, 1, 0, respectively. I both voters vote truthully, then there is no agreement on any pair o alternatives, so that the winner will be chosen uniormly at random, and each voter obtains an expected utility o 4/3. However, i the voters cast the votes a c b and c a b instead, then the probability that b wins is k /3, whereas the probability or each o a and c is k /3 + (1 k )/2. This results in an expected utility o 1(k /3) + 3(k /3 + (1 k )/2) = 3/2 k /6 or each voter, which is strictly more than 4/3 when k < 1. Hence the rule is not group strategy-proo. This example is easily extended to more than three alternatives (or example, by placing the additional alternatives at the bottom o each voter s preerences). 6. FUTURE RESEARCH Although Theorem 1 completely characterizes anonymity-proo neutral voting rules, much remains to be done in uture research. The most natural next direction to take is to consider settings where the space o possible preerences is restricted. It is well-known that such restrictions can introduce very satisactory strategy-proo rules. For example, in many settings there is a natural order on the alternatives (e.g. in political elections, we can order candidates by how ar to the let o the political spectrum they are). In such a setting, a voter s preerences are said to be single-peaked i she always preers alternatives that are closer to her most-preerred alternative to alternatives that are urther away (when these alternatives are on the same side o the most-preerred alternative) [4]. It is wellknown that when preerences are single-peaked, choosing the most preerred alternative o the median voter (the voter that, i we sort the voters by their most preerred alternatives, ends up in the middle) is strategy-proo, and (i the number o voters is odd) this alternative will be preerred to any other alternative by more than hal o the voters (i.e. it is the Condorcet winner). Single-peakedness can only be o limited help or anonymity-prooness: or example, when there are only two alternatives, single-peakedness does not restrict preerences at all, so we cannot do anything more than in the general case. However, there may be other restrictions that are more ruitul. Speciic application settings can also allow or more positive results, as has already been shown to be the case or combinatorial auctions. (In a sense, such settings correspond to a very special way o restricting preerences.) Finally, i no good anonymity-proo mechanisms turn out to exist or a setting that we are interested in, then we need to consider other options. One natural solution is to veriy agents identities, that is, to check whether multiple preerence reports came rom the same agent. It is generally not necessary to veriy the identities o all agents; rather, it suices to veriy those o a select ew based on the submitted preerence reports [6]. Another option is to suppose that each additional identiier used comes at a small cost to the manipulating agent. Much more positive results can be obtained in that setting [20]. In either case, the results in this paper provide a natural starting point or analysis. A inal approach is to try to stop the problem at the source and make it impossible or impractical or an agent to sign up or more than one account, but it seems diicult to do so without compromising the anonymity o the Internet. Acknowledgements I would like to thank Hervé Moulin or a helpul discussion, as well as audiences at two Dagstuhl workshops, INFORMS, Microsot Research, and Duke, where parts o this paper were presented. 7. REFERENCES [1] Salvador Barbera. Majority and positional voting in a probabilistic ramework. The Review o Economic Studies, 46(2): , [2] Salvador Barbera. A note on group strategy-proo decision schemes. Econometrica, 47: , [3] Sushil Bikhchandani, Shurojit Chatterji, Ron Lavi, Ahuva Mu alem, Noam Nisan, and Arunava Sen. Weak monotonicity characterizes deterministic dominant strategy implementation. Econometrica, 74(4): , [4] Duncan Black. On the rationale o group decision-making. Journal o Political Economy, 56(1):23 34, [5] Ed H. Clarke. Multipart pricing o public goods. Public Choice, 11:17 33, [6] Vincent Conitzer. Limited veriication o identities to induce alse-name-prooness. In Theoretical Aspects o Rationality and Knowledge (TARK), pages , Brussels, Belgium, [7] Elizabeth Dwoskin. Vote or Christ. Newsweek, July [8] Allan Gibbard. Manipulation o voting schemes: a general result. Econometrica, 41: , [9] Allan Gibbard. Manipulation o schemes that mix voting with chance. Econometrica, 45: , [10] Jerry Green and Jean-Jacques Laont. Characterization o

8 satisactory mechanisms or the revelation o preerences or public goods. Econometrica, 45: , [11] Theodore Groves. Incentives in teams. Econometrica, 41: , [12] Ron Lavi, Ahuva Mu alem, and Noam Nisan. Towards a characterization o truthul combinatorial auctions. In Proceedings o the Annual Symposium on Foundations o Computer Science (FOCS), pages , [13] Aranyak Mehta, Tim Roughgarden, and Mukund Sundararajan. Beyond Moulin mechanisms. In Proceedings o the ACM Conerence on Electronic Commerce (EC), San Diego, CA, USA, [14] Roger Myerson. Incentive compatibility and the bargaining problem. Econometrica, 41(1), [15] Roger Myerson. Optimal auction design. Mathematics o Operations Research, 6:58 73, [16] United Nations Educational Scientiic & Cultural Organization. UNESCO conirms that it is not involved in the New 7 wonders o the world campaign, URL_ID=38482&URL_DO=DO_TOPIC&URL_SECTION=201.html. [17] Baharak Rastegari, Anne Condon, and Kevin Leyton-Brown. Revenue monotonicity in combinatorial auctions. In Proceedings o the National Conerence on Artiicial Intelligence (AAAI), Vancouver, BC, Canada, [18] Mark Satterthwaite. Strategy-prooness and Arrow s conditions: Existence and correspondence theorems or voting procedures and social welare unctions. Journal o Economic Theory, 10: , [19] William Vickrey. Counterspeculation, auctions, and competitive sealed tenders. Journal o Finance, 16:8 37, [20] Liad Wagman and Vincent Conitzer. Optimal alse-name-proo voting rules with costly voting, Drat. [21] Makoto Yokoo. The characterization o strategy/alse-name proo combinatorial auction protocols: Price-oriented, rationing-ree protocol. In Proceedings o the Eighteenth International Joint Conerence on Artiicial Intelligence (IJCAI), pages , Acapulco, Mexico, [22] Makoto Yokoo, Toshihiro Matsutani, and Atsushi Iwasaki. False-name-proo combinatorial auction protocol: Groves mechanism with submodular approximation. In International Conerence on Autonomous Agents and Multi-Agent Systems (AAMAS), pages , Hakodate, Japan, [23] Makoto Yokoo, Yuko Sakurai, and Shigeo Matsubara. Robust combinatorial auction protocol against alse-name bids. Artiicial Intelligence, 130(2): , [24] Makoto Yokoo, Yuko Sakurai, and Shigeo Matsubara. The eect o alse-name bids in combinatorial auctions: New raud in Internet auctions. Games and Economic Behavior, 46(1): , 2004.