Partial Verification as a Substitute for Money

Recent work shows that we can use partial verification instead of money to implement truthful mechanisms. In this paper we develop tools to answer the following question. Given an allocation rule that can be made truthful with payments, what is the minimal verification needed to make it truthful without them? Our techniques leverage the geometric relationship between the type space and the set of possible allocations.



There are no comments yet.


page 1

page 2

page 3

page 4


Double Retrieval and Ranking for Accurate Question Answering

Recent work has shown that an answer verification step introduced in Tra...

Probabilistic Verification for Obviously Strategyproof Mechanisms

Obviously strategyproof (OSP) mechanisms maintain the incentive compatib...

A Framework for Proof-carrying Logical Transformations

In various provers and deductive verification tools, logical transformat...

A Parallel Tempering Approach for Efficient Exploration of the Verification Tradespace in Engineered Systems

Verification is a critical process in the development of engineered syst...

Automated Mechanism Design for Classification with Partial Verification

We study the problem of automated mechanism design with partial verifica...

Prolog for Verification, Analysis and Transformation Tools

This article examines the use of the Prolog language for writing verific...

Optimal Allocation of Water and Sanitation Facilities To Prevent Communicable Diarrheal Diseases in Senegal Under Partial Interference

For several decades, Senegal has faced inadequate water, sanitation, and...
This week in AI

Get the week's most popular data science and artificial intelligence research sent straight to your inbox every Saturday.


Mechanism design studies how to realize desirable outcomes to optimization problems in settings with self-interested agents. The most common tool to achieve desirable outcomes is the use of payments, and there is a large literature focusing on the following question. Given an allocation rule, which specifies the outcome that should be selected given the types of the agents, do there exist payments to turn it into an incentive compatible mechanism (to implement it) [Guesnerie and Laffont1984, Saks and Yu2005, Ashlagi et al.2010, Frongillo and Kash2014]?

Recent work has identified partial verification as a useful alternative to money to implement incentive compatible mechanisms. The idea is that the mechanism designer can detect some possible agent misreports, either by preventing them outright, or by penalizing the agent (e.g., by excluding her from the market). The power of partial verification is that the mechanism designer need not provide agents with incentives for a subset of the possible types they can report if verification of these types is in place. An example of such a partial verification is agents not being able to report a higher valuation for any assignment than is true. They are free, however, to report a lower value.

This specific type of verification has been adopted by Fotakis, Krysta and Ventre (fotakis2014). They consider the case in which a government is auctioning business licenses for cities under its administration, and companies want to get a license for some subset of cities to sell their stock of goods to the market. The verification assumption is that the government, that acts as auctioneer, can verify if the winner actually has sufficient goods in stock and thus prevent overbidding. In a particularly suggestive result, they showed that this verification suffices to implement all allocation rules that are implementable with money in single-minded combinatorial auctions. (In fact they show that a weaker verification, where the agent cannot overbid only on the bundle received, suffices.) Interestingly, this verification no longer suffices for agents who are -minded, . Other work in the literature (see Related Work) has focused on specific scenarios like facility location and combinatorial auctions, and identifies the sets of verification assumptions that guarantee incentive compatibility of mechanisms.

Our work takes a different approach, in that we build tools to understand the power of verification independent of a specific scenario. In particular, we answer the following question: given an allocation rule that can be made truthful with payments, what is the minimal verification needed to make it truthful without them? Essentially, similar to [Ferraioli, Serafino, and Ventre2016], we aim to inform the designer of the resources needed for verification. In contrast to this work, which focuses on facility location, we propose a geometric characterization of the verification needed to use any implementable-with-payment allocation rule in a scenario without transfers, while guaranteeing strategyproofness.

We introduce the concept of the harmless set of types as those which do not need to be verified for a given set of single-agent allocation rules. Our basic building block is a characterization of the structure of harmless sets for allocation rules which only assign two possible allocations and are implementable with payments. We then show how this can be extended to characterize harmless sets for more general sets of single-agent implementable-with-payments allocation rules. Our focus on sets of rules derives from the observation that multiagent allocation rules are, from the perspective of a single agent, just a set of allocation rules parameterized by the types of the other agents.

Our characterization highlights a split in the nature of harmless sets of types for deterministic and randomized mechanisms. Deterministic and universally truthful mechanisms both have large harmless sets of types, while in contrast the harmless set for truthful-in-expectation mechanisms is quite restricted. Our results are constructive and provide geometric insights for these findings.

The central contribution of our approach is its generality: our analysis could in principle be applied to any mechanism or class of mechanisms. Moreover, while our results are often stated for two allocations and single-agent settings, they also apply directly to more than two allocations and multi-agent settings, by standard arguments. We also examine two extensions: allocation-dependent verification, a weaker form of verification that can expand the harmless set of types, and reverse verification, where the reported type of the agent is considered when computing the types that needs to be verified. We conclude with examples showing how our approach can be used in three application domains and how our results replicate and extend existing results in the literature.

Related Work

Several works in both the economics and computer science literatures focus on the design of incentive compatible mechanisms with verification [Green and Laffont1986, Fotakis, Krysta, and Ventre2015, Fotakis and Zampetakis2015, Penna and Ventre2009, Ventre2014] to overcome the Gibbard-Satterthwaite impossibility result [Gibbard1973, Satterthwaite1975] for mechanisms without money.

In particular, given a mechanism, these works aim to reduce the types agents can report to the ones that do not bring benefit to them. This is done by either assuming that the reportable type space varies depending on the true type of the agents and that this is known to the mechanism [Green and Laffont1986] or that the mechanism can verify part of the type space and penalize agents that misreport in that space [Fotakis, Krysta, and Ventre2014, Ferraioli, Serafino, and Ventre2016]. In particular, given a mechanism, these works aim to reduce the types agents can report to the ones that do not bring benefit to them. This is done by either assuming that the reportable type space varies depending on the true type of the agents or that the mechanism can verify part of the type space and penalize agents that misreport in that space.

The power of verification in the design of mechanisms without money has been studied in a number of applications including scheduling of unrelated machines [Koutsoupias2014], combinatorial auctions [Krysta and Ventre2015], and assignment and allocation problems [Dughmi and Ghosh2010, Guo and Conitzer2010]. A particular focus has been on the design of mechanisms with verification yielding good approximate solutions to the problem of facility location on a line [Procaccia and Tennenholtz2009, Serafino and Ventre2016, Serafino and Ventre2014, Ferraioli, Serafino, and Ventre2016]. Among the work that study the power of verification, several focused on the case in which the mechanism is without money. The design of mechanism without money has been studied for different applications: from scheduling of unrelated machine [Koutsoupias2014] and combinatorial auctions [Krysta and Ventre2015] to assignment and allocation problems [Dughmi and Ghosh2010, Guo and Conitzer2010]. Often, the focus has been on the design of approximated mechanisms with the aim to face situations in which optimal solutions do not exist. In particular, the most considered problem is the one of facilities location on a line [Procaccia and Tennenholtz2009, Serafino and Ventre2016, Serafino and Ventre2014, Ferraioli, Serafino, and Ventre2016]. Much of this literature has focused on identifying verifications which seem natural for a particular application and suffice to design useful mechanisms  [Koutsoupias2014, Serafino and Ventre2016, Fotakis, Krysta, and Ventre2014], in contrast to the present work which fixes a set of allocation rules and asks what verification would be minimally necessary to render the mechanisms truthful. Most similarly to our own work, Ferraioli et al. (diodato2016) have considered the question the minimum set of assumptions needed in the facility location setting.


In this section, we focus on mechanism design with a single agent. Let denote the set of assignments, one of which the agent will receive, . Let denote the set of allocations, where an allocation

is a probability distribution over assignments. Formally,

. One can think of assignments as a set of mutually exclusive outcomes, and allocations as distributions over these outcomes, which for example will be point distributions when we consider deterministic mechanisms.

We use to denote the type of the agent, i.e., her private information, where is the agent’s value for the assignment . The set of possible agent types is denoted . A single-agent direct revelation mechanism is denoted , where is the allocation rule and is the payment rule. Under this mechanism, the utility of an agent with type who reports type is .

We now introduce several terms and definitions which we will use throughout the paper. Additionally, we summarize in Table 1 the notation used in the paper which will be introduced in the following sections.

Incentive Compatibility.  A mechanism is incentive compatible (i.e., truthful) if the agent is incentivized to communicate to the mechanism her true type. Since agents are rational, to guarantee incentive compatibility, the mechanism must guarantee that each agent is better off when she reports her true type than when she misreports, i.e., for all .

Implementable-with-Payments Allocation Rule.  An allocation rule is implementable-with-payments if there exists a payment rule such that the mechanism is incentive compatible.

Deterministic Mechanism.  A mechanism is deterministic if each allocation selects one assignment with probability and all the other outcomes with probability , i.e., and . In this sense, all mechanisms, including deterministic mechanisms, are randomized.

Universally Truthful Mechanism.  We say an incentive compatible randomized mechanism is univerally truthful if it is a distribution over incentive compatible deterministic mechanisms. That is, there is a set of deterministic incentive compatible mechanisms known as the support of and a probability distribution such that .

Truthful in Expectation Mechanism.  If a randomized mechanism is incentive compatible, we say that it is truthful in expectation. (The expected value is implicit in the dot product in the definition of .)

Truthful with Verification Mechanism.  Let be the set of pairs that the designer can verify and denote with a mechanism with verification. is truthful if for all pairs of types either or . Intuitively, either an agent with type prefers not to report or the mechanism designer can detect or prevent such a report.

Basics of Partial Verification

In this section, we develop our basic tools for reasoning about what types do not need to be verified. In particular, given a type , if the agent can never benefit by reporting some other type , then from the perspective of the mechanism designer it is unnecessary to be able to verify , i.e., verify that is not the agent’s true type. We call such types harmless111 To simplify the characterization, we focus on harmless types instead of types that must be verified. Given a type and allocation rule , a pair is in if . For brevity, we say that the set of types which must be verified is . That is, the mechanism will be truthful as long as the mechanism designer can verify that the agent does not have true type when she reported , for all .

Definition 1.

Given a type and allocation rule , the harmless set of types is the set composed by the types such that .

We can also talk about the harmless set of types for multiple allocation rules. This allows us to take our results about the single agent setting and apply them to settings with multiple agents. We can turn the multiagent allocation rule into a single agent allocation rule by “plugging in” the types of the other agents. However, in doing so we end up with different allocation rules depending on the types of those other agents. Thus, capturing a multiagent allocation rule in a single agent setting requires a whole set of allocation rules (see the Multi-Agent Mechanisms section).

As an added benefit, this generality allows us to talk about not just single mechanisms, but whole families of mechanisms. Later, we exploit this flexibility to draw a sharp contrast between the harmless set for all universally truthful mechanisms and the harmless set for all truthful in expectation mechanisms.

Definition 2.

Let be a set of allocation rules. Then the harmless set of types is the set composed by the types such that for every .

It is immediate from this definition that the harmless set of types of a set of allocation rules is the intersection of their individual harmless sets. This is because our definition imposes a strong requirement for a type to be harmless: it identifies a type as harmless only if it is harmless for every allocation rule in the set. That is, there is no scenario under which the agent can benefit from reporting a harmless type. This strong definition is in the same spirit as the definition of incentive compatibility; we only want to declare a type harmless if the mechanism designer never has to worry about that type being reported.

Observation 1.

The harmless set of types corresponds to the intersection of the harmless set of types of every allocation rule , i.e., .

Using , we can express the minimal verification needed to guarantee that a implementable-with-payments allocation rule is also truthful without them. In particular, this minimal verification corresponds to the set where if and only if .

Notation Definition
Allocation rule
Set of allocation rules

Harmless set of types given true

type and allocation rule

Harmless set of types given true

type and set of allocation rules

Separating allocation rule
Set of separating allocation rules
Set of

Allocation hyperplane over

Indifference hyperplane
Set of parallel to
Critical allocation rule
Critical allocation hyperplane
Set of critical allocation rules
Set of critical allocation hyperplanes
Table 1: Notation used throughout the paper.

Harmless sets with two allocations (Informally)

We now introduce our main tools for understanding the harmless sets of implementable-with-payments allocation rules. At first, we characterize the harmless sets of implementable-with-payments allocation rules which have exactly two allocations in their range, and then show that there is a sense in which this captures everything we need to know about the harmless set of types even when there are more than two allocations. Before giving a formal treatment of this setting, we walk through it more informally.

With only two allocations, incentive compatible mechanisms have a simple, well-known form. By the taxation principle, any incentive compatible mechanism consists of assigning a price to each allocation and letting the agent choose which allocation it prefers to pay for [Guesnerie and Laffont1984]. Thus, if we call the two allocations and and assign them prices and , an agent with type can be assigned by an incentive compatible mechanism only if (and similarly for ). Rewriting, it is easy to see that the types that are indifferent and could be assigned either allocation are those who satisfy . That is, these types all lie on a hyperplane. Further, the two half spaces on either side of this hyperplane correspond to the sets of types that prefer each allocation at the given prices, i.e., if is in the interior of one halfspace and is in the interior of the other then and .

Since such a hyperplane is uniquely identified by a relative price , every implementable-with-payments allocation rule can be associated with the hyperplane for some real number . Note however, that there will in general be many allocation rules associated with a single hyperplane because types on the hyperplane are indifferent between the allocations whose prices difference is and so can be assigned to either allocation by an implementable-with-payments allocation rule.

Now consider a particular such and a type . There are five possible cases for .

Case 1: and . An agent with type is already receiving her preferred outcome, so the agent cannot gain by reporting another type. Thus .

Case 2: and . An agent with type can benefit by reporting any type such that , so }. By the above analysis, contains all types on the side of the hyperplane associated with where types prefer at relative price implied by . It may also contain some types on the hyperplane, if happens to assign them .

Case 3: . This case is degenerate and the agent with type is totally indifferent between the two allocations, so regardless of the chosen.

Cases 4 and 5: symmetric to Cases 1 and 2.

So what does look like where is the set of all such ? By Observation 1, we need to take the intersection of the harmless sets. In the degenerate case 3, this yields . Otherwise, all that matters is the for which case 2 applies. That is we care about the which correspond to hyperplanes with such that . The intersection of the harmless sets of all these hyperplanes is the set of which are “below” all of them. This is entirely determined by the “lowest” such hyperplane, the one where . Consider the following example.

Example 1.

Consider the case of a deterministic incentive compatible mechanism with two possible assignments, and , and two allocations, and , such that and , i.e., allocation assigns to the agent with probability , while allocation assigns with probability . Furthermore, assume that the agent’s type is with . This setting is illustrated in Figure 1 (a), where and .

The hyperplane of types for which is the 45 degree line from the origin, and which we refer to as the indifference hyperplane. Note that it corresponds to taking , and that changing just translates this line while keeping it at 45 degrees. The translations of this line for which , i.e., , are the lines that in the figure would be above ; the lowest of these is the one which passes through , which we refer to as the critical allocation hyperplane. The harmless set is the set of types below this critical allocation hyperplane. It corresponds to the types that prefer relative to more strongly that . That is, those where .

Formal treatment of two allocations

We define the concepts introduced in the previous section and formally prove how to identify the harmless set of types of implementable-with-payments allocation rules. We start by defining a separating allocation rule i.e., an allocation rule that can be associated with a hyperplane that divides the space in two half spaces such that all the types in one half space receive the same allocation, and a set of such allocations.

Definition 3.

An allocation rule is separating if
and there exists a hyperplane which separates the type space in two open half-spaces such that the closure of their union is and if then while if then . (For brevity, when the allocation pair is clear from context we suppress it and simply write .)222Note that any implementable-with-payment allocation rule is also a separating allocation rule.

Definition 4.

Let denote the set of separating allocation rules . Then let .

Given a separating allocation rule, we are interested in the hyperplane it induces, in the following sense.

Definition 5.

The allocation hyperplane over allocation set is the hyperplane that separates the two half-spaces identified by the separating allocation rule . In the remaining of the paper, we will say that is induced by the allocation rule .

Of course, selecting two allocations and a hyperplane is not sufficient for an allocation rule to be implementable-with-payments. By the taxation principle, the hyperplane must consist of all the types which are indifferent between the two allocations at a particular price. Further, the remaining types must receive the “correct” allocation. That is, those which would be willing to pay more than the price to get one allocation instead of the other are the ones that receive it. Such hyperplanes are exactly those parallel to the hyperplane of types indifferent between the two allocations. We capture these requirements in the following definitions.

Definition 6.

Given , the indifference hyperplane is the hyperplane composed of types where the agent is indifferent between allocation and allocation , i.e. all the points where .

Definition 7.

Let be the set of allocation hyperplanes parallel to indifference hyperplane .

The following observation formally summarizes the preceding discussion by showing that the hyperplanes in the set are only the ones that are induced by an implementable-with-payments allocation rules given the allocations , and thus that the implementable-with-payments allocation rules are separating allocation rules.

Observation 2.

A hyperplane is in if and only if it is induced by an implementable-with-payments allocation rule .


First, note that if and the payment is equal to zero, then the agent has no incentive to misreport her type, i.e., the mechanism is incentive compatible. Second, we know that, from the taxation principle, an allocation rule is truthfully implementable-with-payments in dominant strategies if the agent is charged the same payment every time she receives a given assignment. Equivalently, 333By the previous sentence, we know that there exists a constant (equal to the payment difference) such that if then the agent receives and vice versa. This equation exactly corresponds to a translation of the indifference hyperplane by . the allocation hyperplane of an implementable-with-payments allocation rule is parallel to the related indifference hyperplane . ∎

While there are many allocation hyperplanes in , the harmless set is entirely determined by one of them, the one identified as the ”lowest” in the previous section, which we term the critical allocation hyperplane.

Definition 8.

The critical allocation hyperplane is parallel to the indifference hyperplane and the agent’s type belongs to it (i.e., ). We call a rule that induces a critical allocation rule.

Note that there exist an infinite number of critical allocation rules that induce a critical allocation hyperplane. In the remaining of the paper, the critical allocation rule we consider is the following: if and , then but . I.e., gets its less preferred allocation, while all the other types on the critical allocation hyperplane get the more preferred allocation. This implies that , .

Lemma 1.

, i.e., the harmless set of types of the set of rules is equal to the harmless set of types of allocation rule that induces the critical allocation hyperplane .


First notice that, since the allocation hyperplanes in are parallel, the critical allocation hyperplane divides the allocation hyperplanes in in two sets, depending on which side of it they lie. For those on the same side as the indifference hyperplane, the agent is already getting its preferred type so . For those on the opposite side, the agent would rather report a type yielding her preferred allocation, so corresponds to the open half-space containing the indifference hyperplane. The intersection of all these sets is exactly

The previous lemma implies that, given and a set of allocations , the critical allocation hyperplane divides the space into two half-spaces, and that if , then the open half-space containing the indifference hyperplane corresponds to the harmless set of types of , otherwise, if , then .

Definition 9.

Let be the set of critical allocation rules given all pairs .

Definition 10.

Let denote the set of critical allocation hyperplanes.

From Observation 1 and Lemma 1, follows Corollary 1, which says that to identify the harmless set it suffices to identify the critical allocation hyperplanes.

Corollary 1.


Figure 1(a) shows an example of a critical allocation hyperplane, indifference hyperplane, and harmless set of types for a set of implementable-with-payments allocation rules for the case with two allocations.

This example also provides a clear geometric explanation for the phenomenon observed in previous work that “symmetric” verifications (which tend to take the form of a constraint that misreports must be local to the true type) do not tend to help while “asymmetric” ones do [Fotakis and Zampetakis2015]. Because is on the critical allocation hyperplane, there are arbitrarily close misreports which can lead to a benefit for some allocation rules, so restricting misreports to be close to the true type does not help. In contrast, an asymmetric verification which rules out the entire half space above the critical allocation hyperplane is very useful.

More Than Two Allocations

Now that we understand how to identify harmless sets of types of implementable-with-payments allocation rules with two allocations, we can extend our analysis to cases with more than two allocations. The key observation is that if a type is not harmless then there exists an allocation rule and choice of and such that while but . Since only these two allocations are relevant, we can actually find an implementable-with-payments allocation rule for which is not harmless that only allocates and , thus reducing to the case we have already analyzed. To identify the harmless set when there are more than two allocations, we thus intersect the harmless sets resulting from each pair of allocations.

Theorem 1.

Let be the set of implementable-with-payments allocation rules. .


Because , . For the other direction, let be given such that . By Definition 1, if and only if there exists an allocation rule such that . By the taxation principle, we can represent by a list of allocations and the price for each allocation. Construct from by eliminating all allocations except and from this list. Then is implementable-with-payments (those from the list), , , and . Thus . By Corollary 1, . ∎

Verification and Randomization

In this section, we examine the implications of allowing randomization for implementing mechanisms using partial verification. We show that there is a significant harmless set shared by all deterministic mechanisms. Since universally truthful mechanisms are just distributions over deterministic mechanisms, this turns out to be true for them as well. However, the harmless set shared by all truthful in expectation mechanisms is quite limited.

Deterministic mechanisms

We now study how to identify the harmless set of types for all truthful deterministic mechanisms. The result naturally follows from Theorem 1. In particular, the harmless set is the intersection of the harmless sets of all deterministic mechanisms with two allocations, which in turn corresponds to the intersections of the harmless sets generated by the relevant critical allocation hyperplanes.

Theorem 2.

Let be the set of deterministic implementable-with-payments allocation rules using allocations in . Then, corresponds to the intersection of the half-spaces generated by all containing the origin.


First note that since the mechanisms here considered are deterministic there exists one allocation for each possible assignment, i.e., . For every pair of allocations the harmless set of types can be computed as shown in Example 1, i.e., where corresponds to the open half-spaces generated by that contains the origin. Thus, due to Corollary 1, to compute , we need to consider only the allocation rules where is the set of the critical allocation hyperplanes, one for each . Given this, Observation 1, and Theorem 1, we can conclude that . ∎




Figure 1: Harmless sets for individual pairs of allocations for types with and their intersection (right graph).

We provide an example, shown in Figure 1, to illustrate how to compute the harmless set of types for deterministic mechanisms with more than two allocations.

Example 2.

Consider a case with three assignments, one of which is null with no value. Thus, we have assignments and allocations . Without loss of generality, assume that , , and . Consequently, . The harmless sets for these allocation rules are shown in Figures 1 (b), (c), and (a) respectively. Since , given by their intersection, is shown in Figure 1(d).

This example also illustrates a key point about implementing the verifications found by our method: despite the infinite type space and infinite set of allocation rules, we can express the properties we need to verify in terms of a finite number of halfspace constraints, which gives reason to believe they may be verifiable in practical situations.

Universally truthful mechanisms

As previously discussed, the harmless set for all universally truthful mechanisms is the same as for all deterministic mechanisms. We observe that every universally truthful mechanism can be represented as a distribution over truthful deterministic mechanisms, and every deterministic mechanism is a universally truthful mechanism that chooses the specific deterministic mechanism with probability 1.

Theorem 3.

The harmless set of types of all single agent universally truthful mechanisms is equal to the harmless set of types of all single agent truthful deterministic mechanism.


By definition, in order to guarantee that a mechanism is universally truthful, we need to guarantee that every deterministic mechanism is incentive compatible. This implies that the harmless set of a universally truthful mechanism is equal to the intersection of the harmless set of all the deterministic mechanisms in its support.

Now note that every deterministic mechanism is a universally truthful mechanism that randomizes over with probability equal to . Thus, in order to compute the harmless set of types of all mechanism , we need to compute the intersection of the harmless sets of types of all the deterministic mechanisms. ∎

A useful lemma

Before turning to our characterization for truthful in expectation mechanisms, we prove a more general lemma that considers cases with various sets of allocations. It is applicable, for example, when modeling restrictions such as the existence of a null allocation for which agents are known to have value 0 (common in auction settings).

The lemma works in the case where the set of possible allocations is rich enough that differences between possible allocations form a linear space. In particular, we cannot have a finite set of allocations, as we do in the deterministic setting. The lemma states that in this rich setting, we can characterize the harmless set of types as those which can be expressed as a scaling down of the true type, plus some vector which is perpendicular to the space of allocation differences.

The intuition for the lemma is given in Figure 2. The first few plots illustrate why, when the vector space of allocation differences is the entire space, the harmless set of types are only those which are scaled-down versions of the true type: for all others we can find a critical allocation hyperplane for which they are on the wrong side. Specifically, it is always possible to identify a hyperplane that contains for which the origin belongs to one half space and the type belongs to the other half space, i.e., is not harmless, unless belongs to the segment that connects the origin to .

When this vector space becomes smaller, however, we add “unenforceable” directions in the type space, as types that differ only by a vector perpendicular to all allocation differences cannot be separated by a critical allocation hyperplane. These unenforceable directions in turn expand the set of harmless types. As an example, consider the a setting with two assignments and an agent who is indifferent between them. Rather than the harmless set being just types between the origin and , it is actually the entire space because the agent is indifferent among all possible allocations. More generally, this phenomenon occurs any time an agent’s value for two assignments is tied, even if there are others over which she has a strict preference.

Lemma 2.

Let be a set of allocations and let type be given. Define to be the pairs of allocations that is not indifferent between, and to be the set of scaled differences between such pairs of allocations. If is a linear subspace, then , where . That is, the harmless types are those which are “smaller than” , modulo directions not captured by . (Proof in Appendix).


First, we show sufficiency. Let for , and let for . Without loss of generality, let prefer to , so that . Now suppose for contradiction that is some allocation rule such that but , and consider the allocation hyperplane between the cell and cell for . By Observation 2, is normal to this boundary, oriented toward the cell. For to be in the cell and in the cell, we must therefore have . But , and thus . Now note that by assumption and , and by definition , so in fact , which is a contradiction. Thus every such is harmless.

For necessity, first suppose for . By definition of , we have some for which ; without loss of generality we take . Now consider the allocation rule if and otherwise. (One can check that is implementable-with-payments, as the cell boundary between and is perpendicular to by construction, and correctly oriented.444While this construction may appear to leverage tie breaking in , it would hold just as well defining if and otherwise. Similarly, the remaining arguments in the proof need not depend on how allocation rules break ties.) Now we have by construction, and , implying that is not harmless.

Now project and onto by writing and for , . From the above two cases, we may assume that for any . Thus, we may further project onto , writing for a nonzero orthogonal direction : , , and . Finally, take for some sufficiently small (to be determined).

As is a vector space, , so we may write for some and some pair of allocations for which is not indifferent. Indeed, we have , so prefers to . Now let be the allocation function defined by if and otherwise. Clearly , so to show that is not harmless, it suffices to show . This follows from a simple calculation: for sufficiently small . ∎

Truthful in expectation mechanisms




Figure 2: Harmless sets for randomized allocation rules. The dotted line depicts the scaled versions of , .

Our results for deterministic and universally truthful mechanisms are relatively positive, in that there is a significant harmless set of types which do not require verification. For truthful in expectation mechanisms however, our results are much more negative. Essentially, the only types in the harmless set are those which are a scaling or translation by adding the same constant to the value of each assignment of the original type, except in the special case where the agent is indifferent among two or more assignments, which adds additional dimensions to the harmless set. For brevity, we state the theorem for the case where no such indifferences exist.

Theorem 4.

Let be such that for all and and . The harmless set of types of all single agent truthful in expectation mechanisms is .


Theorem 4 is merely a special case of Lemma 2 with difference set . Consider the possible allocation differences in the setting of Theorem 4. We can write this set as , which is all scaled differences of distributons over outcomes. But this set is simply the affine hull of the probability simplex, , shifted so that it passes through the origin, which is precisely the vector subspace above. Applying Lemma 2 immediately gives the result, as here . Finally, note that adding indifferences reduces the dimension of and correspondingly increases the dimension of , and thus the harmless set of types. ∎

The proof follows from a Lemma 2 that encompasses the case with indifferences as well as more general scenarios. A direct intuition is shown in Figure 2. Parts (b) and (c) show that we can find pairs of allocations where the critical allocation hyperplane is arbitrarily close to the line between and the origin. So, by considering the intersection of the harmless types of all the possible pair of allocations, the resulting harmless types must all be along this line. Part (a) shows that types along the line from

going away from the origin are not harmless. When these figures are combined in the full three dimensional type space, we gain an extra degree of freedom as we can add a constant to the value for each allocation without changing the incentives, resulting in the harmless set illustrated in part (d).

Multi-Agent Mechanisms

As further motivation for our characterizations of the implementability of all deterministic single-agent mechanisms in Theorem 2, in this section, we discuss how to identify an agent’s harmless set of types in multi-agent scenarios by leveraging on the results presented in the previous sections. Essentially, this boils down to a three step process:

  1. Choose a truthful multi-agent mechanism .

  2. Derive a set of corresponding single-agent allocation rules which are implementable with payments.

  3. Characterize for each single agent.

To illustrate this process, consider a scenario with unit-demand agents and two items, and . Given this, the set of possible assignments for each agent is . Assume that the mechanism is the incentive compatible Vickrey-Clarke-Groves (VCG) auction [Vickrey1961, Clarke1971, Groves1973] that allocates items to agents such that the social welfare is maximised and charges each agent her externality. Thus, the allocation and the payment of each agent depends on the types reported by the other agents. The next step is to derive the corresponding single-agent allocation rules . In the case of VCG, every single-agent implementable-with-payments allocation rule is characterized by prices and for item and , respectively, which correspond to the agent’s externality. then assigns the agent the item (or nothing) she prefers at those prices. One of the characterized by prices and is shown in Figure 3(a) where it is possible to observe that if the agent’s type is in the red area no item is allocated to the agent, if it is in the blue area then she gets item , and if it is in the green area she gets item . Without restrictions on the types of the other agents, every non-negative pair of prices and is possible, and thus this defines the set of single-agent allocation rules . Because every pair of prices is possible, we can immediately apply Theorem 2 for the final step to characterize the harmless set.555Strictly speaking VCG is a family of mechanisms determined by tie-breaking rules, our results apply to identify the set of types that is simultaneously harmless for all tie-breaking rules.




Figure 3: (a) Example of allocation rule of single-agent mechanisms induced by a multi-agent mechanism where no item is allocated to the agent whose type is in the red area, if it is in the blue area then she gets item , and if it is in the green area she gets item . (b, c, d) Examples of how the Harmless set of types changes for different values of reserve prices and set by the mechanism.
Corollary 2.

Let denote the set of implementable-with-payments deterministic allocation rules and let denote the set of single-agent allocation rules derived from VCG. Then .

This three step process can be applied to any truthful multi-agent mechanism. In general, step 2 is an application of the taxation principle, and step 3 follows the logic of the proof of Theorem 2. Some cases, such as affine maximizers with finite agent weights and zero allocation weights [Roberts1979], yield the same result as VCG, but others are more complex. For example, in the same setting as before but with additional reserve prices and , not every set of prices is possible, because and serve as lower bounds. Thus, the harmless set of types depends also on the specific value of and as shown in Figure 3 (b,c,d).

Allocation-dependent verification

We have largely assumed that the set of verifiable types depends only on the true type. Some authors assume, however, that the set of verifiable types also depends on the allocation received. For example, in the combinatorial auction setting studied by Fotakis, Krysta and Ventre fotakis2014, they assume that the mechanism designer can only determine ex post whether the agent over-reported her value for the assignment she received.

Our techniques still provide insight in this more refined setting. Figure 4 (a) shows both the harmless set (red) and the additional types not verified by their verification (blue) for the allocation rule that always assigns the agent her preferred assignment. They are able to verify fewer types and still implement the allocation rule because, for this particular allocation rule the agent does not benefit while the harmless set satisfies the stronger condition that there is no rule under which they would benefit. In fact our framework shows an even weaker verification would suffice, as any type below the horizontal line is harmless (see Figure 1 (c)).

Reverse approach

Our tools can be used also to answer the following question: given a reported type and a class of mechanisms, what types need to be verified? In this case, the verification aims to check if a type is the true type of the agent. Thus, from the perspective of the mechanism designer it is unnecessary to verify whether is the agent’s true type, if an agent with true type cannot benefit by reporting . We call the types that need to be verified harmful.

Definition 11.

Given a reported type and an allocation rule , the harmful set of types is the set composed by the types such that .

Now, we show how to straightforwardly adapt our formulation to harmful sets of types. Let’s consider a particular such over two allocations with and a type . There are four possible cases for .

Case 1: and . An agent with any true type such that and can benefit by reporting . Thus, such types are the ones in the set and corresponds to all and only the types that belong to both the same half space as w.r.t. the indifferent hyperplane and the opposite half space as w.r.t. the allocation hyperplane.

Case 2: and . No agent can strictly benefit from reporting such a type because either the agent prefers , and thus would be made worse off by doing so, or the agent prefers and so must already have . Thus .

Case 3: and . As in Case 1.

Case 4: and . As in Case 2.

We now move to consider a set of allocation rules . Interestingly, we can answer two slightly different versions of the previous question. One is to identify the set of types that are harmful for all the allocation rules in , or the set of types that are harmful for least one allocation rule in . Thus, the set is equal to the intersection of , while is equal to the union of . These sets are shown in Figure 4 (b) for Example 2. In this case, the set corresponds to the types that belong to the red area, while includes also the types in the blue areas.

These two formulations can be thought of as upper and lower bounding the verification needed respectively. The formulation captures what needs to be verified using ordinary verification, which defines verifications solely in terms of pairs. More refined versions of verification, such as allocation-dependent verification, can potentially verify fewer types by conditioning the verification on the specific allocation rule. Thus, captures a stronger notion of the types for whom reporting is strictly better in every scenario. Such a lower bound could be used, for example, to argue that there is no practical verification in a particular scenario even if we include refined notions of verification.

As mentioned before, we have chosen to present our primary approach as identifying the harmless set of types given a set of agents, allocation rules, and agents’ true types because it leads to appealing geometrical characterization. The reverse approach is more natural for direct application by a mechanism designer because it is directly phrased in terms of what to do for a given report. In particular, the steps the designer has to follow to use verification as a substitute for money are the following. First, the designer decides which family of implementable-with-payments allocation rules to use and collects the agents’ reported types. Then he verifies that each agent’s true type is not in the set of types and, if necessary, penalizes the agents by, e.g., excluding them in the allocation. Finally, he applies the chosen allocation rule. The downside of the reverse approach is that the geometric characterization is more complex. In the end however, the two are equivalent as all that matters is identifying the set of pairs for which verification is needed.




Figure 4: (a) Example of the harmless set of types for a particular allocation when the verification is allocation-dependent. (b) Set of types (red area) and set of types (red and blue areas) for Example 2 (illustrated in Figure 1). (c) Single item auctions: Set of harmful types (red area) for the case in which ; set of harmful types (red and blue areas).

Application examples

We conclude with three additional applications. First we show an example of allocation dependent verification and reverse approach applied to second price auctions. For -minded combinatorial auctions, we show that can recover previous results about when a particular verification is or is not sufficient and that we can extend them by characterizing a verification that would be sufficient for the case where it is not. For -facility location, we show how our framework allows us to recover a sufficient verification for a particular class of mechanisms and extend it to a much larger class.

Second price auctions

Consider the single item auction problem and the second price auction mechanism whose allocation rule, denoted by , assigns the single item to the agent with the highest submitted bid