JUBILEE: Secure Debt Relief and Forgiveness

by   David Cerezo Sánchez, et al.
Calctopia Limited

JUBILEE is a securely computed mechanism for debt relief and forgiveness in a frictionless manner without involving trusted third parties, leading to more harmonious debt settlements by incentivising the parties to truthfully reveal their private information. JUBILEE improves over all previous methods: - individually rational, incentive-compatible, truthful/strategy-proof, ex-post efficient, optimal mechanism for debt relief and forgiveness with private information - by the novel introduction of secure computation techniques to debt relief, the "blessing of the debtor" is hereby granted for the first time: debt settlements with higher expected profits and a higher probability of success than without using secure computation A simple and practical implementation is included for "The Secure Spreadsheet". Another implementation is realised using Raziel smart contracts on a blockchain with Pravuil consensus.



There are no comments yet.


page 1

page 2

page 3

page 4


Raziel: Private and Verifiable Smart Contracts on Blockchains

Raziel combines secure multi-party computation and proof-carrying code t...

encointer – An Ecological, Egalitarian and Private Cryptocurrency and Self-Sovereign Identity System

encointer proposes a new blockchain based cryptocurrency with an ecologi...

SilentDelivery: Practical Timed-delivery of Private Information using Smart Contracts

This paper proposes SilentDelivery, a secure, scalable and cost-efficien...

Building Executable Secure Design Models for Smart Contracts with Formal Methods

Smart contracts are appealing because they are self-executing business a...

Truthful and Faithful Monetary Policy for a Stablecoin Conducted by a Decentralised, Encrypted Artificial Intelligence

The Holy Grail of a decentralised stablecoin is achieved on rigorous mat...

Relax the Non-Collusion Assumption for Multi-Server PIR

For distributed protocols involving many servers, assuming that they do ...

DE-RSTC: A rational secure two-party computation protocol based on direction entropy

Rational secure multi-party computation (RSMC) means two or more rationa...
This week in AI

Get the week's most popular data science and artificial intelligence research sent straight to your inbox every Saturday.

1 Introduction

As it is written in the Torah, the Jubilee is the remission year at the end of seven cycles of seven years when slaves and prisoners are freed, properties are returned to their original owners and debts are forgiven 222Deuteronomy 15:1–6, Leviticus 25:8–13, Isaiah 61:1-2 to prevent profiting from the poor 333Exodus 22:25. The first Jubilee was celebrated in AM 2553, starting the count 14 years after entering Eretz Yisrael 444Rambam in Mishneh Torah, Sabbatical Year and the Jubilee 10:2, as it was previously commandeth 555Leviticus 25:2: Jubilees were announced with a shofar 666Ibn Ezra on Leviticus 25:9; Rashi on Leviticus 25:10, an instrument made from a ram’s horn (i.e., a yobhel or yoveil, from which the term Jubilee is derived 777Ramban on Leviticus 25:10) and they provided a regulated and periodical “clean state” for debt forgiveness.

By setting debt forgiveness on a fixed and periodical calendar, the Jubilee resolved the age-old social problem of debt relief: modernly, governments enforce an intricate system of debt collectors, courts and legal procedures. In these cases, third parties are involved to handle conflicts of interests between distrusting parties:

  • debtors request too much debt forgiveness

  • creditors grant debt settlements as small as possible, trying to take as many assets as possible from debtors: in some instances, the true amount of debt relief needed is less than the expected revenue from the debtor to fulfil their debt obligations, but the stated debt recovery values from creditors exceed said expected revenue and/or continuation value of the debtor, making it financially impossible for the debtor to compensate the creditors. As a result, future projects from debtors will not be undertaken, even if socially desirable, sacrificed to satisfy the overstated demands from creditors.

For the first time, by combining mechanism design and secure computation we manage to reconcile the demands of debtors and creditors in to create a new debt relief mechanism in which the best course of action is the truthful revelation of their private information: removing most of the conflict from the situation, third parties are no longer needed and frictionless debt settlements can be reached.

1.1 Contributions

In summary, we make the following contributions:

  • an individually rational, incentive-compatible, truthful/strategy-proof, ex-post efficient, optimal mechanism for debt relief and forgiveness with private information is introduced

  • further, an implementation using secure computation is presented

In a nutshell, we contribute a new methodology for debt relief and forgiveness in a frictionless and strifeless way without resorting to third parties (i.e., courts, debt collectors), revamping an age-old problem with modern cryptographic techniques such that truthful revelation of private information is the best strategy for all parties involved.

In section 2, we discuss related literature and prior work. In section 3, we first introduce our model, then proceed to describe a direct mechanism for debt settlements, and finally describe the optimal mechanism. In section 4, we describe our implementations of the optimal mechanism and then we conclude in section 5.

The reader interested in the most practical applications may skip to section 4,

2 Related Literature

The literature on the combination of secure computation and mechanism design is surprisingly scarce: it mostly focuses on the problems of secure computation with rational actors [ADGH06, IML05, HT04, GK06, OPRV08], and the combination of secure computation with the incentive-compatible Vickrey auction or its generalisation as the Vickrey–Clarke–Groves mechanism [EL03, NPS99, BS05]. Truthfulness is absolutely necessary for secure computation to gain acceptance in the real world: although any truthful mechanism can be securely computed [Xia11], the converse does not hold. Thus, further research is needed to devise securely computed mechanisms that encourage participants to report their information truthfully.

2.1 Prior Work in Cryptography

Previous literature considered the use of secure computation technologies for credit origination and rating [BP20, DDN15, AKL12, HFT21, FAZ05], but not for debt relief.

This paper also shows that the moral character of cryptographic work [Rog15] goes way beyond preventing “mass surveillance”, as it’s currently customary in the field of cryptography.

2.2 Prior Work in Game Theory

Some seminal papers [O’N81, AM85] started the game-theoretic study of bankruptcy problems in the Talmud: see [HV01, Tho13] for surveys of the extensive literature that followed, including alternative derivations of the Mishnah of the Talmud rule 888Rabbi Nathan in Babylonian Talmud, Kethuboth 93a; Yerushalmi Talmud, Kethuboth 10,4 using cooperative bargaining [DV93] and the strategic Nash cooperative solution [MTY20]. Note that the Talmud rule is so influential that it was adopted as law (halakha) in other contexts 999Rambam in Mishneh Torah, Malveh veLoveh, Chapter 20, Section 4 and it became a source of great discussion101010Rabbi Seadia Gaon in Responsa Sha’arei Zedeq part 4, gate 4; Rabbi Hai Gaon as quoted by Rabbi Isaac Alfasi on Kethuboth 93a; Rabbi Bezalel Ashkenazi in Shitah Mekubetzet on Kethuboth 93a; Piniles H.M. in Darka Shel Torah, p. 64; Rabbi Yehoshua Leib Diskin in Torat Ha’Ohel, vol. 1 page 2b as Talmud scholars were trying to unravel and interpret it.

This paper fundamentally departs from this line of work found in the game-theoretic literature:

  1. it focuses on debt relief via debt settlements, it’s not restricted to equitable partitions between creditors

  2. creditors are allowed to have private information (i.e., all information is not public)

  3. it uses cryptography as a primary tool to achieve its goals

  4. it performs better than the Talmud rule in neutralising creditor’s conflict of interests

The ultimate reason for this innovation is “mi-p’nei tikkun ha-olam” (i.e., for the bettering of the world, and for repairing the world, as modernly interpreted): as participation is individually rational for creditors (see next condition 3.3), it is economically rational to participate even with the institution of the prozbul 111111Gittin 4:3; Mishnah Sheviit 10, a legal subterfuge to circumvent the commandeth forgiveness of loans even after the Shmitah and the Yovel.

3 Model and Design

This paper is primarily concerned with a setting of distrusting parties, a debtor entity and multiple creditors, holding asymmetric information used as input in a process to settle non-marketable debt (i.e., creditors are assumed not to trade between themselves). The debtor entity is an intentional generalisation in order to abstract away the more specific cases of a private party, a corporation or an indebted sovereign state: note that each of these specific cases may need further refinements to this general model. The results of this section are themselves based on these works: [Mye81].

3.1 Model Setup

A highly indebted entity with total outstanding debt and no cash in hand needs funds from external sources for an investment of (i.e., for debt service and to finance another project) that will generate future cash flows given by the Discounted Cash Flow of the current Asset continuation value plus the Investment value, : if the entity files for bankruptcy, the opportunity of the investment in the other project will be lost. It is assumed that the entity is prohibited by existing covenants from issuing new higher priority debt senior to the existing outstanding debt: in other words, the entity can only undertake the investment if it settles the outstanding debt after successful negotiations with risk-neutral creditors to fully or partially write down the principal of the debt since creditors would be the main beneficiaries of the investment , thus avoiding bankruptcy and ensuring the continuation of the debtor entity.

To ease exposition, we assume that the risk-free interest rate is zero and that each creditor has an identical share of the total outstanding debt, , each with equal priority. The willingness to cancel some of the debt depends on two factors:

  1. The estimated percentage of debt cancellation from other creditors.

  2. The expected recovery value for each creditor in case of bankruptcy if the entity does not receive any investments and/or debt cancellation, and we assume that represents the expected recovery value if the creditor owned claims to his proportional part of the total entire value of the entity.

The creditor type is private information and everyone holds identical expectations about the possible value of

, captured by the random variable

with distribution , density , and . With each creditor acting as Bayesian decision-maker [Har67]

, creditor types are identically and independently distributed, its list denoted by the vector

and the set of all possible types of creditors arise from their different preferences, given by

Remark 1.

We assume that each creditor are the only private knowledge, that is, the vector .

We further assume that , , , and are common knowledge. There would be no uncertainty about how much debt forgiveness should be granted if the vector was publicly known.

Additionally, we define

Creditor may also know the expected recovery by other creditors (i.e., using secure computation), in that case, the revised expected recovery value in bankruptcy would be given by the following liquidation value

with non-decreasing revised estimation function defining how the creditor would revise his estimate if he knew the estimate of creditor , and satisfying


implying that would still be the expected recovery value of because

As it is evident, the expected recovery value of cannot exceed the full value of the debt,

In this paper we use the following definition of efficiency:

Definition 2.

(Ex-post efficiency). We consider a debt relief process by debt settlement to be ex-post efficient if and only if the entity remains solvent after the new investment is undertaken with probability one when

and if the investment is undertaken with probability zero, the entity goes bankrupt. Debt settlement can only be efficient if there is a surplus in the difference between the value of an entity in solvency and the value of the entity in bankruptcy,

Finally, note that the problem of debt settlement is a problem of asymmetric information: if the debtor entity knew the true value of for every creditor, it would be individually rational to propose a settlement arrangement giving each creditor his expected recovery value if and only if the settlement arrangement is ex-post efficient (i.e., continuation would be Pareto-efficient) and all creditors would accept. Thus, asymmetric information is a key feature of debt settlements and is assumed to be private information: hence the use of secure computation, to enable the privacy-preserving computation of said private information between the distrusting parties.

3.2 A Direct Mechanism for Debt Settlement

In this sub-section, we obtain an ex-post efficient revelation mechanism to settle the outstanding debt, by making use of the Revelation Principle:

Definition 3.

(Revelation Principle [Mye81]). Every equilibrium outcome of any arbitrary mechanism can be implemented as an outcome in a truth-telling equilibrium of an incentive-compatible direct revelation mechanism.

For each creditor, it’s the best response to report his true type in a truth-telling Bayesian equilibrium point of the revelation game, thus creditors and the debtor entity would follow the instructions of the following protocol:

Functionality 1. Each creditor privately reports their private information to a trusted party, at the same time. 2. Using the private reports, a trusted party calculates and instructs: the debtor entity to invest with probability , or go bankrupt with probability . In case of continuing solvent, the entity must make payments to the creditors as defined by the vector

each creditor must forgive an amount of debt equal to if the debtor is not declared bankrupt. Figure 3.1: Ideal functionality

The vector of reported types is defined by

the recommended vector of transfer payments be denoted by , and the recommended probability of continuing solvent and receiving investment.

Let denote the mechanism implemented by the trusted party in the ideal model or a Secure Multi-Party Computation program in the real model, then is the payment to creditor , and is the investment probability when creditor reports and all the creditors announce their true types. Note that for the mechanism to be truthful equilibrium, it must be individually rational for all players to participate and an equilibrium for each creditor to report their true .

The expected utility from a mechanism to creditor such that it’s an equilibrium to report their true type for every other creditor, is given by

rewritten as

using the definition of and the properties of the revised estimation function 3.1. The change in expected utility is given by


because in case of no debt settlement, creditors get their expected recovery value and the entity goes bankrupt; but in case of staying solvent, creditors receive payments but they lose the liquidation value. This change in expected utility must be positive for all creditors

(IR) (3.3)

for them to participate in the mechanism since debt relief can only be granted willfully outside of bankruptcy, defining the individually rational (IR) participation constraint: in other words, no party is forced to participate in the mechanism, and each creditor is granted veto power over the debt settlement via their joint control of the probability thus effectively imposing negative externalities on each other (note that extensions to this model introducing majority voting rules are also possible).

On the other hand, the expected utility of the debtor entity from the mechanism in a truth-telling equilibrium is


also subject to a positive Ex-Ante Budget Balance (EXABB) participation constraint

(EXABB) (3.5)

An additional incentive-compatibility constraint (IC) for the mechanism must be satisfied for truthful reporting to be an equilibrium, which in conjunction with the individually rational (IR) participation constraint 3.3 define the mechanism as a feasible mechanism:

(IC) (3.6)

To obtain incentive-compatibility [Mye81], it’s a first necessary and sufficient condition that

must be decreasing in for all . In other words, the higher the expected recovery value of a creditor the smaller the probability that the entity will remain solvent as expected by that same creditor. The other second necessary and sufficient condition derived from [Mye81] is that ,


granting, for the highest type , the expected change in utility to each creditor plus a positive mark-up: the new rightmost term of the right-hand side is an economic incentive given to creditors of type by the mechanism to induce them to reveal that they are the creditors more inclined to grant debt forgiveness (i.e., an “informational rent”). To derive the equation 3.7, we start denoting by as the maximum utility of creditor from the mechanism : then, by the envelope theorem[Sam47, Mil04, MS02],

Therefore, by reintegration we obtain the previous equation 3.7

Now let’s look at the incentive-compatible mechanism most favourable to the debtor, that is, when : then, the amount the debtor will pay is the expected recovery value plus an additional economic incentive derived from 3.7,


To derive equation 3.8, we start from 3.2 and 3.7,

By taking expectations over all possible values of , we obtain


Integrating by parts the term in brackets, we arrive at

Thus, equation 3.9 can be rewritten as the desired equation 3.8

By substituting the previous relation on the debtor’s expected utility 3.4, it becomes

Theorem 4.

A mechanism is incentive-compatible according to constraint 3.6 (IC) and satisfies the creditor’s participation constraint 3.3 (IR) and the debtor’s participation constraint 3.5 (EXABB) if and only if the debtor’s expected utility is strictly positive,


Note that by the debtor’s participation constraint 3.5 (EXABB),

and that 3.10 is derived from the debtor’s expected utility 3.4, then it trivially follows that 3.11 must also be positive. ∎

Definition 5.

(Blessing of the debtor). The willingness of creditors to grant debt forgiveness is higher when using secure computation for their private information. This paradoxical situation is the opposite of the “winner’s curse” from auction theory [BBM19]: given that an agreement on debt forgiveness among creditors must be unanimous 3.3 , then debt forgiveness could only happen if all creditors are willing to grant forgiveness because their expected recovery value from bankruptcy is low, thus the willingness of each creditor gets reinforced from the private information obtained from other creditors.

Theorem 6.

The expected profits of the debtor are higher when there are differences in private information, and not just differences in preferences, for any incentive-compatible .


A creditor is more willing to grant debt forgiveness when there are differences in private information (i.e., the blessing of the debtor 5) because the expected recovery value conditional on a successful settlement is smaller than the unconditional expected recovery value, given that all creditors consider that debt settlements will only prosper when other debtholders expect a low recovery value. This allows the debtor entity to extract more debt forgiveness from creditors under private information.

Debtor’s expected profits are given by 3.8 if the investment rule is incentive-compatible. When there are only differences in preferences, the revision functions are for all values of and , thus we only need to show that

with . By the definition of , the inequality can be rewritten as

Since is increasing and by definition for all and , there exists an such that as , and we can write

Due to incentive-compatibility we know that is decreasing, hence


But then

A recent impossibility result [JM00] further limits mechanisms’ ability to implement efficient allocations when creditors’ private values aren’t private information (i.e., with secure computation as used here).

Theorem 7.

(Jehiel-Moldovanu Impossibility Theorem [JM00, Mil04]). Let be a mechanism where the liquidation value depends on the valuations of other creditors but without private information, and suppose that the function depends non-trivially on . Then, no mechanism exists that implements at any Bayes-Nash equilibrium.

Corollary 8.

The use of secure computation techniques enables debt settlements with higher expected profits, thus attaining the “blessing of the debtor” 5 with efficient allocations for creditors.


Follows from previous Theorem 6, since secure computation enables computation on private information between multiple distrusting parties. Additionally, efficient allocations for creditors are only possible with private information by Theorem 7. ∎

Additionally Theorem 6 implies that condition 3.11 of Theorem 4 will be satisfied with higher probability when there are differences in private information, making debt settlements more efficient.

3.3 An Optimal Revelation Mechanism

We start choosing the investment rule to maximise the debtor’s expected utility given by 3.10,

In other words, the entity will remain solvent if the continuation value is higher than the sum of the expected recovery values in bankruptcy, plus the terms : this investment rule and the condition that would set debtor’s expected profits. But we also need an explicit solution for , thus the investment rule is rewritten as



We make the following assumption so is strictly increasing.

Assumption 1.

is strictly increasing (i.e., monotonically non-decreasing) for all and all .

This assumption is satisfied by any uniform distribution on the interval

, the Pareto, exponential, and positive normal distributions.

Thus, there exists a unique value of denoted by for each vector that solves

The pivotal type that creditor can report without forcing bankruptcy according to investment rule is large when low types are being reported by the other creditors: it measures the magnitude of the opportunities for holding out. It’s defined by

Theorem 9.

The payment to creditor is calculated according to

in the optimal mechanism.


The investment rule can be rewritten by the definition of as

Thus, the change in utility to creditor from the optimal mechanism by constraint 3.6 is


From the previous equation 3.13 and the change in the expected utility from the non-optimal mechanism 3.2,


Finally, we arrive to the solution to equation 3.15,

since when , and when . ∎

In the optimal mechanism 9, a payment is received by creditor which is independent of the reported type, but it will depend on the types declared by other creditors as explained in the following:

  • the function is decreasing in each component of .

  • the function is increasing in each component of : if other creditors report high expected recovery values, then creditor would increase his own expected recovery value.

If the holding out from dominates the revision of expectations from , then transfers are decreasing in each component of when using the optimal mechanism.

4 Practical Implementation

To ease exposition, we consider the simplest case: consider an example with creditors and their private expected recovery value from bankruptcy be uniformly distributed on .

Assume that the revision function 3.1 is defined by

such that when the constant creditors give more weight to the estimate of other creditors, and vice versa.

The optimal continuation value is given by



the payment to creditor 1 is


and the payment to creditor 2 is


Finally, the amount of debt forgiveness by each creditor is given by .

4.1 Implementation on “The Secure Spreadsheet”

Figure 4.1: Screenshots from “The Secure Spreadsheet”. Top is creditor #1, bottom is creditor #2.

The previously derived closed-form formulae for the probability of the debtor to receive debt relief and continue being solvent 4.1, the payment to creditor #1 4.2 and to creditor #2 4.3 can be securely computed very easily on “The Secure Spreadsheet” (USPTO Patent 10,423,806[Cer14]), available online for download [Cer21b]: first precognised in the article “The G-d Protocols” [Sza97] from 1997, “The Secure Spreadsheet” is the first and only user program for general-purpose secure computation. For maximum performance at an affordable cost, the preferred secure computation protocol used by the “The Secure Spreadsheet” is the dual-execution protocol[MF06]:

Theorem 10.

(Dual-Execution protocol[HKE12]). If the garbled circuit construction is secure against semi-honest adversaries and the hash function M is modelled as a random oracle, then the Dual-Execution protocol securely computes implementing the ideal functionality 3.1 if for every non-uniform probabilistic polynomial-time adversary in the real model, there exists a non-uniform probabilistic polynomial-time adversary in the ideal model such that

As pictured above on the captured screenshots 4.1, the public values for the debt , the continuation value and the weight to the estimate to the other creditors must be the same on both spreadsheets for creditors 1 and 2. On the top spreadsheet for creditor 1, the only private that is taken into account is the one inputted by creditor 1 (et vice versa for the bottom spreadsheet for creditor 2). The final values computed using secure computation appear on the right-hand side of the captured screenshots, under the column “SECCOMP”.

4.2 Implementation on a blockchain

The previous implementation on spreadsheets 4.1 is also realised on a blockchain using Raziel [Cer17] smart contracts and Pravuil [Cer21a] consensus: identical secure computations as the ones carried out on “The Secure Spreadsheet” are executed among creditors and debtors interfacing the blockchain with a mobile app.

Figure 4.2: Two secure computation groups forgiving debts on a blockchain

Note the special suitability of Pravuil [Cer21a] consensus integrating real-world identity on this blockchain: debt management requires real-world identities, otherwise Sybil attacks could create unlimited fake debts. Due to this reason, this is the only valid blockchain consensus protocol [Cer21a] for the purpose of debt management.

5 Conclusion

The present paper has tackled and successfully solved the problem of debt relief and forgiveness by securely computing optimal debt settlements. The mathematical proofs hereby provided demonstrate that participation in the proposed mechanism is within the economically rational interests of all the involved parties by truthfully providing their private information, thus removing the need for third parties. Additionally, the provided implementations demonstrate the practicality of the securely computed mechanism.