Mukund Sundararajan

Universally utility-maximizing privacy mechanisms

A mechanism for releasing information about a statistical database with sensitive data must resolve a trade-off between utility and privacy. Publishing fully accurate information maximizes utility while minimizing privacy, while publishing random noise accomplishes the opposite. Privacy can be rigorously quantified using the framework of differential privacy, which requires that a mechanisms output distribution is nearly the same whether or not a given database row is included or excluded. The goal of this paper is strong and general utility guarantees, subject to differential privacy. We pursue mechanisms that guarantee near-optimal utility to every potential user, independent of its side information (modeled as a prior distribution over query results) and preferences (modeled via a loss function). Our main result is: for each fixed count query and differential privacy level, there is a geometric mechanism M* -- a discrete variant of the simple and well-studied Laplace mechanism -- that is simultaneously expected loss-minimizing for every possible user, subject to the differential privacy constraint. This is an extremely strong utility guarantee: every potential user u, no matter what its side information and preferences, derives as much utility from M* as from interacting with a differentially private mechanism Mu that is optimally tailored to u. More precisely, for every user u there is an optimal mechanism Mu for it that factors into a user-independent part (the geometric mechanism M*) followed by user-specific post-processing that can be delegated to the user itself. The first part of our proof of this result characterizes the optimal differentially private mechanism for a fixed but arbitrary user in terms of a certain basic feasible solution to a linear program with constraints that encode differential privacy. The second part shows that all of the relevant vertices of this polytope (ranging over all possible users) are derivable from the geometric mechanism via suitable remappings of its range.

A modular correctness proof of IEEE 802.11i and TLS

The IEEE 802.11i wireless networking protocol provides mutual authentication between a network access point and user devices prior to user connectivity. The protocol consists of several parts, including an 802.1X authentication phase using TLS over EAP, the 4-Way Handshake to establish a fresh session key, and an optional Group Key Handshake for group communications. Motivated by previous vulnerabilities in related wireless protocols and changes in 802.11i to provide better security, we carry out a formal proof of correctness using a Protocol Composition Logic previously used for other protocols. The proof is modular, comprising a separate proof for each protocol section and providing insight into the networking environment in which each section can be reliably used. Further, the proof holds for a variety of failure recovery strategies and other implementation and configuration options. Since SSL/TLS is widely used apart from 802.11i, the security proof for SSL/TLS has independent interest.

On characterizations of truthful mechanisms for combinatorial auctions and scheduling

We characterize truthful mechanisms in two multi-parameter domains. The first characterization shows that every mechanism for combinatorial auctions with two subadditive bidders that always allocates all items is an affine maximizer. The second result shows that every truthful machine scheduling mechanism for 2 unrelated machines that yields a finite approximation of the minimum makespan, must be task independent. That is, the mechanism must determine the allocation of each job separately. The characterizations improve our understanding of these multi-parameter settings and have new implications regarding the approximability of central problems in algorithmic mechanism design.

Beyond moulin mechanisms

The only known general technique for designing truthful, approximatelybudget-balanced cost-sharing mechanisms is due to Moulin. While Moulin mechanisms have been successfully designed for a widerange of applications, recent negative results show that for manyfundamental cost-sharing problems, Moulin mechanisms inevitably sufferfrom poor budget-balance, poor economic efficiency, or both. We propose acyclic mechanisms, a new framework for designingtruthful, approximately budget-balanced cost-sharing mechanisms. Acyclic mechanisms strictly generalize Moulin mechanisms andoffer three important advantages. First, it is easier to design acyclic mechanisms than Moulinmechanisms: many classical primal-dual algorithms naturallyinduce a non-Moulin acyclic mechanism with good performanceguarantees. Second, for several important classes of cost-sharing problems, acyclicmechanisms have exponentially better budget-balance and economicefficiency than Moulin mechanisms.Finally, while Moulin mechanisms have found application primarily in binary demand games, we extend acyclic mechanisms to general demand games, a multi-parameter setting in which each bidder can be allocated one of several levels of service.

New trade-offs in cost-sharing mechanisms

A cost-sharing mechanism is a protocol that collects bids from a set of players, selects a subset of the players to receive a service (incurring a subset-dependent cost), and determines a price to charge each of these players. Three standard requirements for cost-sharing mechanisms are incentive compatibility, which states that players are motivated to bid their true valuation for the service; budget-balance, meaning that the prices charged should recover the cost incurred; and efficiency, which states that the cost incurred and the valuations of the players served should be traded off in an optimal way. These three goals have been known to be mutually incompatible for thirty years. As a result, nearly all work on cost-sharing mechanisms in the economics and theoretical computer science literatures has focused on achieving two of these goals while completely ignoring the third.We show that incentive-compatibility, budget-balance, and approximate efficiency are simultaneously achievable for a wide range of cost functions, where efficiency is measured using the social cost---the sum of the incurred service cost and the excluded valuations. In particular, we prove such guarantees for well-known mechanisms for all submodular cost functions and for the Steiner tree cost function. We also prove a generic, quantifiable trade-off between the objectives of efficiency and budget-balance in groupstrategyproof cost-sharing mechanisms.

Computing optimal bundles for sponsored search

A context in sponsored search is additional information about a query, such as the users age, gender or location, that can change an advertisements relevance or an advertisers value for that query. Given a set of contexts, advertiser welfare is maximized if the search engine runs a separate auction for each context; however, due to lack of competition within contexts, this can lead to a significant loss in revenue. In general, neither separate auctions nor pure bundling need maximize revenue. With this motivation, we study the algorithmic question of computing the revenue-maximizing partition of a set of items under a secondprice mechanism and additive valuations for bundles. We show that the problem is strongly NP-hard, and present an algorithm that yields a 1/2- approximation of the revenue from the optimal partition. The algorithm simultaneously yields a 1/2-approximation of the optimal welfare, thus ensuring that the gain in revenue is not at the cost of welfare. Finally we show that our algorithm can be applied to the sponsored search setting with multiple slots, to obtain a constant factor approximation of the revenue from the optimal partition.

Beyond Moulin mechanisms

The only known general technique for designing truthful and approximately budget-balanced cost-sharing mechanisms with good efficiency or computational complexity properties is due to Moulin [1999. Incremental cost sharing: Characterization by coalition strategy-proofness. Soc. Choice Welfare 16 (2), 279-320]. For many fundamental cost-sharing applications, however, Moulin mechanisms provably suffer from poor budget-balance, poor economic efficiency, or both. We propose acyclic mechanisms, a new framework for designing truthful and approximately budget-balanced cost-sharing mechanisms. Acyclic mechanisms strictly generalize Moulin mechanisms and offer three important advantages. First, it is easier to design acyclic mechanisms than Moulin mechanisms: many classical primal-dual algorithms naturally induce a non-Moulin acyclic mechanism with good performance guarantees. Second, for important classes of cost-sharing problems, acyclic mechanisms have exponentially better budget-balance and economic efficiency than Moulin mechanisms. Finally, while Moulin mechanisms have found application primarily in binary demand games, we extend acyclic mechanisms to general demand games, a multi-parameter setting in which each bidder can be allocated one of several levels of service.

Quantifying inefficiency in cost-sharing mechanisms

In a cost-sharing problem, several participants with unknown preferences vie to receive some good or service, and each possible outcome has a known cost. A cost-sharing mechanism is a protocol that decides which participants are allocated a good and at what prices. Three desirable properties of a cost-sharing mechanism are: incentive-compatibility, meaning that participants are motivated to bid their true private value for receiving the good; budget-balance, meaning that the mechanism recovers its incurred cost with the prices charged; and economic efficiency, meaning that the cost incurred and the value to the participants are traded off in an optimal way. These three goals have been known to be mutually incompatible for thirty years. Nearly all the work on cost-sharing mechanism design by the economics and computer science communities has focused on achieving two of these goals while completely ignoring the third. We introduce novel measures for quantifying efficiency loss in cost-sharing mechanisms and prove simultaneous approximate budget-balance and approximate efficiency guarantees for mechanisms for a wide range of cost-sharing problems, including all submodular and Steiner tree problems. Our key technical tool is an exact characterization of worst-case efficiency loss in Moulin mechanisms, the dominant paradigm in cost-sharing mechanism design.

Mean field equilibria of dynamic auctions with learning

Auctions are observed as a market mechanism in a wide range of economic transactions involving repeated interactions among the market participants: sponsored search markets run by Google and Yahoo!, online marketplaces such as eBay and Amazon, crowdsourcing, etc. In many of these markets, the participants typically have incomplete information; for example, the participants may not know the quality of the good being auctioned or their value for the good. In such settings, repeated interactions among the participants give rise to extremely complex bidder behavior due to the presence of learning among the participants.

A learning-based approach to reactive security

Despite the conventional wisdom that proactive security is superior to reactive security, we show that reactive security can be competitive with proactive security as long as the reactive defender learns from past attacks instead of myopically overreacting to the last attack. Our game-theoretic model follows common practice in the security literature by making worst case assumptions about the attacker: we grant the attacker complete knowledge of the defenders strategy and do not require the attacker to act rationally. In this model, we bound the competitive ratio between a reactive defense algorithm (which is inspired by online learning theory) and the best fixed proactive defense. Additionally, we show that, unlike proactive defenses, this reactive strategy is robust to a lack of information about the attackers incentives and knowledge.