Sophisticated Attacks on Decoy Ballots: The Devil's Menu and the Market for Lemons

12/14/2017 ∙ by Hans Gersbach, et al. ∙ 0

Decoy ballots do not count in election outcomes, but otherwise they are indistinguishable from real ballots. By means of a game-theoretical model, we show that decoy ballots may not provide effective protection against a malevolent adversary trying to buy real ballots. If the citizenry is divided into subgroups (or districts), the adversary can construct a so-called "Devil's Menu" consisting of several prices. In equilibrium, the adversary can buy the real ballots of any strict subset of districts at a price corresponding to the willingness to sell on the part of the citizens holding such ballots. By contrast, decoy voters are trapped into selling their ballots at a low, or even negligible, price. Blowing up the adversary's budget by introducing decoy ballots may thus turn out to be futile. The Devil's Menu can also be applied to the well-known "Lemons Problem".



There are no comments yet.


page 1

page 2

page 3

page 4

This week in AI

Get the week's most popular data science and artificial intelligence research sent straight to your inbox every Saturday.

1 Introduction

In the past few years electronic voting has become popular in many countries.111See, retrieved on 18 September, 2017. The possibility that voting can be carried out electronically opens up myriad new options for representative and direct democracies alike, as the marginal cost of voting will be typically lower than for normal elections. One possibility is to randomly select a subgroup of citizens from the entire population and have each of them vote on a single issue. Such a voting scheme is called random sample voting (Chaum, 2016). Assuming that the chosen subpopulation (or sample voting group) can be trusted to represent the entire citizenry, random sample voting may improve decision-making by yielding the same decision as standard voting, albeit at a less costly voter-participation level.222In addition, several issues could be considered at once by having different subpopulations vote separately on each of them. This way, citizens may acquire more information only about the issue on which they have a say, and decisions may be better informed.

Electronic voting procedures of this type entail risks. For instance, a malevolent third party—which we will henceforth call adversary—may be interested in buying some citizens’ right to vote in a particular instance of random sample voting.333Vote-buying is also a problem in standard elections, and one which has already been studied in the literature (see e.g. Dekel et al., 2008; Finan and Schechter, 2012). To prevent this from happening, Chaum (2016) has proposed the following mechanism: not only the members of the sample voting group receive a ballot, but so do all other citizens. The difference is that only the ballots of the members of the sample voting group are real, i.e., only they will be counted. The remaining ballots act as a decoy—and hence they are called decoy ballots. Crucially, whether a ballot is real or a decoy is a citizen’s private information, so the adversary cannot distinguish real from decoy ballots.444One could conceive of a ballot as a password in the electronic voting system, where a decoy ballot is simply an invalid password. Voting systems based on decoy ballots revolve around the idea that selling them to an adversary is valuable for society—and can thus constitute a social norm—, since doing so may prevent adversaries from buying a large amount of real ballots and then manipulating the voting outcome.555Parallels can be drawn between decoy ballots preventing vote buying and the idea of producing fake drugs and selling them in the drug market to destroy this market. Parkes et al. (2017) have recently shown that, under some assumptions, decoy ballots do indeed discourage attempts by an adversary with a limited budget to try and buy (real) ballots.666For other types of attack on electronic voting, see Basin et al. (2017).

In this paper we show that when the whole population with a right to vote is divided into several subgroups or districts, the adversary can employ an efficient procedure based on a particular price-offering scheme. With such a procedure, the adversary will be able to purchase all real ballots of a predetermined number of districts that is lower than the total number of districts, each at a price equal to the willingness to sell on the part of the citizens holding such ballots. Decoy ballots will also have to be bought by the adversary, yet at a lower, possibly even negligible, price.

The procedure we suggest is called Devil’s Menu and is presented in two forms: a weak form and a strong form. In both variants, the adversary will offer citizens two slots, called slot 1 and slot 2. Citizens will choose one of them at most—they are not obliged to participate. Each slot in its turn is associated with two prices, and the final price that each citizen is offered in exchange for his ballot (real or decoy) will depend on the slot chosen and on the final status of the district to which he belongs. In other words, the adversary offers each citizen a four-price scheme. The final status of a district will be selected if the ratio of slot- applicants to citizens holding real ballots is among the set of the smallest ratios for all districts, with ties being broken by fair randomization. Additionally, prices associated with slot  will be higher in selected districts than in non-selected districts. For the procedure to work, it is crucial that, once the corresponding districts have been selected, all citizens who have applied for either slot can decide whether they want to sell their vote at the prevailing price or not. By contrast, the adversary must be committed to buying the ballots at the prices announced.

A Devil’s Menu places citizens holding a decoy ballot in the following dilemma: Applying for slot  is more attractive, as long as their district is selected. However, by doing so, these citizens incur the risk that their district will in fact no longer be selected. For non-selected districts, prices are very low in both slots, albeit marginally higher in slot  than in slot 

, so voters holding a decoy ballot will choose the latter. In equilibrium, there is a positive probability that their district will be selected, so the price they expect to be offered in exchange for their ballot is higher than the sure payoff associated with slot 

in a non-selected district. Citizens holding decoy ballots will nonetheless be paid lower prices for their ballots than voters holding a real ballot.

We prove four specific results. First, by setting the four prices appropriately, the adversary will induce a unique equilibrium of the underlying game, in which citizens with a real ballot apply for slot  and citizens with a decoy ballot apply for slot . This is the weak form of the Devil’s Menu. It guarantees that the price decoy voters will receive in this (unique) equilibrium will be significantly lower than the price at which the real voters will be willing to sell, though it will not be negligible. Second, running the Devil’s Menu sequentially and targeting all real votes of only one district each time reduces the budget required by the adversary by lowering the price eventually paid for decoy ballots. Third, this latter price can in fact be set arbitrarily low, thereby eliminating almost all superfluous expenditures. The adversary’s budget can then be used almost entirely for real ballots, so blowing up the adversary’s budget with decoy ballots may prove futile. This is the strong form of the Devil’s Menu. There are two variants of the Devil’s Menu that ensure this desirable circumstance: on the one hand, the price associated with slot  in non-selected districts can be made arbitrarily low—up to the point where only three different prices are in fact offered—, though this opens up the possibility that additional equilibria may exist; on the other, a more sophisticated six-price Devil’s Menu may be used, which again ensures uniqueness of the equilibrium targeted. This latter variant requires that the adversary can offer two different prices to applicants of slot  that belong to selected districts, based on the districts’ interim status. Fourth and last, if the adversary has strong commitment power, she can achieve this same outcome even if the citizenry is not divided into subgroups (i.e., there is only one district).

The remainder of the paper is organized as follows: In Section 2 we present our model. In Section 3 we introduce the Devil’s Menu with four prices and show its weak form. In Section 4 we analyze alternative forms of the Devil’s Menu, including two variants of its strong form. Section 5 discusses extensions to the model and applications of the Devil’s Menu to the well-known “Lemons Problem.” Section 6 concludes.

2 The Model

There is a finite set of risk-neutral citizens denoted by . Each citizen may be of one of two types: if , he has a real ballot; if , he has a decoy ballot. The former citizens are henceforth called real voters, the latter decoy voters. We assume that is partitioned into subgroups or districts , with and denoting the number of ballots of each type within , for all . Natural partitions of the citizenry may be based on states, cities, and villages. We assume that while is common knowledge, the type of each individual citizen is private information. For any set , it will be convenient throughout to let denote its cardinality. Accordingly, and , for all . We consider that and let and .

For simplicity, we assume that any real voter will value his ballot at , while any decoy voter will value his ballot at .777This assumption is discussed in Section 5.3. Both assumptions are common knowledge. Besides the citizens, there is an adversary, henceforth denoted by . For the sake of clarity, throughout the paper we will use “she” to refer to the adversary and “he” to refer to any voter. The goal of the adversary is to buy all real ballots of exactly districts at minimal cost, with .888If decoy ballots were applied in voting procedures with a structure similar to that of the US presidential elections, the adversary might only be interested in buying real ballots of swing states. We proceed on the assumption that identities of districts are not relevant for the adversary, so the different procedures we suggest would have to be adapted if that were not the case. A first attempt based on a brute-force attack would be to try and buy all ballots at a price , for some arbitrarily small. Doing so is feasible if ’s budget, which we denote by , is large enough. It is sufficient to assume that


and that this is common knowledge. The right-hand side in the above inequality is the amount the adversary would have to spend if she bought all ballots from an arbitrary selection of districts. To do so, she would offer to pay to all citizens in these districts in exchange for their ballots. Because the price offered to the citizens would be higher than their ballot valuation, regardless of the type of ballot they hold, they would all accept the transaction. Yet it is clear that this brute-force attack is very inefficient, since the adversary has to buy all ballots, real and decoy, at the same high price, namely . In the next section, we show that the adversary can achieve the same goal of buying all real ballots of districts at a much lower cost if she employs what we call a Devil’s Menu.

3 The Devil’s Menu

First, we describe the mechanism that guarantees that the adversary will be able to buy all real ballots in districts, each at price , without having to pay this same amount to all decoy voters in these districts. For its successful operation, the adversary must be committed to its rules—i.e. she cannot change its functioning at any point in time—, and this property must be common knowledge among the citizens, who will then simply envision the mechanism as the execution of an algorithm. As a tie-breaking rule, we assume that the individual citizen will not offer his ballot to the adversary if he is indifferent between his valuation of the ballot and the price offered by the adversary. The mechanism works as follows:

  1. Adversary offers two slots to all citizens: slot one (denoted by ) and slot two (denoted by ). Depending on the ratio of slot- applicants to real voters across districts, the adversary will select districts, as formulated in Step 3. Moreover, offers the following prices for ballots:

    slot slot
    district selected
    district not selected
    Table 1: The Devil’s Menu with four prices—depending on the slot applied for (column) and the final status of the voter’s district (row).

    In this four-price scheme, is assumed to be arbitrarily small, while satisfies .

  2. Each citizen either applies for one of the two slots or abstains. For each , we let be the number of citizens from who apply for slot , and we set .

  3. Assume w.l.o.g that and let . Then define the following three sets of districts:

    Accordingly, we have and . All districts in are selected by . From the set , districts are chosen by fair randomization so that their final status is also selected. That is, a district in has a probability of being selected by the mechanism—and then belonging to is its interim status. The final status of the remaining districts is non-selected.

  4. Once all districts are assigned their final status—and hence the price offered to each applicant has been determined—, these citizens decide whether to sell their vote or not at the prevailing price. The adversary is obliged to accept the transaction at the request of the citizens.

The Devil’s Menu is a four-price scheme in which individuals sequentially commit first, to a subset of prices within a slot, and, second, to the possibility of selling their vote once the price has been determined for the slot they have applied for. These final prices depend on the choices by all the citizens. In turn, the adversary commits to the correct execution of the mechanism. It will be useful to display the (expected) payoff matrices of voters. Since a decoy voter will always sell his vote in Step 4, his expected payoff is given in Table 2.

Table 2: Expected payoff of a decoy voter in the Devil’s Menu with four prices—depending on the slot applied for (column) and the final status of the voter’s district (column).

Real voters will, of course, not sell their vote if their district is not chosen, nor will they sell their vote if they have applied for slot . Their expected payoff is then given in Table 3.

Table 3: Expected payoff of a real voter in the Devil’s Menu with four prices—depending on the slot applied for (column) and the final status of the voter’s district (column).

3.1 The weak form of the Devil’s Menu

With the four-price Devil’s Menu in place, and taking into account the optimal choices of Step 4 discussed above, we can define a simultaneous-move game, which we denote by . The player set is , and for each citizen , his strategy set is . The payoff matrices are given by Tables 2 and 3, with the selection of districts determined in accordance with Step 3 of the Devil’s Menu. The following observations follow immediately: First, for each citizen, it is a weakly dominated strategy to abstain and not to apply for either of the slots. We shall assume that no player will play a weakly dominated strategy, i.e. all citizens will accept to participate in the Devil’s Menu. Second, for a real voter, applying for weakly dominates applying for . After these assumptions, we obtain our first main result.999If , the result of Theorem 1 is still valid. Nevertheless, it does not yield any budget savings for the adversary with respect to the brute-force attack.

Theorem 1.

[Weak form of the Devil’s Menu] Suppose . Then the strategy profile , in which all decoy voters apply for slot  and all real voters apply for slot , is the only Nash equilibrium of game .


Let be a strategy profile that constitutes a Nash equilibrium of . Because all citizens with a real ballot will apply for , we can assume w.l.o.g. that, after breaking ties, we have

We next observe that in any equilibrium, set is empty and thus is equal to . Indeed, assume that . Then, in any of the districts that belong to such that , any decoy voter for which will have an incentive to deviate and apply for slot . This deviation strictly improves expected utility. The reason is as follows: As a consequence of the deviation, either district becomes a selected district, and the expected utility is strictly larger than (since ), or district still belongs to , in which case the deviation increases the payment to citizen by .

Since in any Nash equilibrium, we can assume that . We prove next that cannot be a Nash equilibrium if . This property can be derived as follows: Suppose that . Then, in each district belonging to , there is at least one decoy voter who has applied for slot  in . Consider one of these districts, say . The probability that will be selected by fair randomization is equal to . Now let be any decoy voter for which and who belongs to . Then, ’s expected payoff is equal to . By contrast, if deviates from his strategy in and applies for , set will consist of districts, and set will consist of districts. In this latter case, district is selected with probability , and the payoff to decoy voter is equal to . The latter payoff is strictly higher than , since

Accordingly, it must be that . To sum up, we have shown that in any Nash equilibrium of game , we have and . This completes the proof. ∎

The rationale for the functioning of the Devil’s Menu with four prices as described in Theorem 1 is clear. By offering different prices—whose realizations depend on the behavior of the citizenry, both at the district and the aggregate level—, decoy voters are trapped. These citizens would like to be in slot  and simultaneously ensure that their district is selected by the adversary. Applying for , however, reduces the chances of their district being selected. As a consequence, the Devil’s Menu generates downward pressure on , which results in only real voters applying for slot  in all districts. In particular, only real voters of the selected districts are paid the high price , with decoy voters in these same districts obtaining  instead. In turn, decoy voters in non-selected districts obtain . Real voters in non-selected districts will not sell their ballots. All in all, the budget that the adversary pays in equilibrium will never be higher than the following bound:


Of course, the adversary will choose the lowest possible value of  to minimize her costs, so she will set  equal to .

3.2 Critical and non-critical assumptions

In the following, we discuss some critical and less critical assumptions of the Devil’s Menu. First, observe that the budget bound  is not only sufficient to buy the real ballots from districts on the equilibrium path, it would also be sufficient to match expenditures if individual decoy voters deviated from the unique equilibrium. Indeed, Theorem 1 and the construction of the Devil’s Menu imply the following result:

Corollary 1.

The budget bound is equal to, or higher than, the expenditures faced by the adversary when one decoy voter deviates and applies for slot .

This corollary follows directly from the observation that a deviation by one decoy voter will turn his district into a non-selected district with probability 1. Accordingly, this voter cannot cause a budget problem for the adversary, nor can he sabotage the functioning of the Devil’s Menu with four prices. We further note that to guarantee that the procedure can be run—and that the equilibrium described in Theorem 1 is unique—, it suffices for the adversary’s budget to satisfy Inequality (1) and for this to be common knowledge.

Second, in real voting settings, it is reasonable to expect the number of real voters in any given district to be fixed—and easy to guess for the adversary—, since otherwise the aggregate preferences of the society may not be well represented by the citizens receiving the real ballots. As already discussed, the Devil’s Menu proceeds on the assumption that the adversary knows the number of real ballots and the number of citizens in any district. This premise is further discussed in Section 5.2.

Third, another assumption of our model is that citizens make their applications simultaneously. However, this is not crucial for our results. Indeed, at any point in time where some citizens have already applied for slots as prescribed by Theorem 1, the best response of any remaining citizen is to apply for a slot in the same way. That is, the unique equilibrium outcome of Theorem 1 also arises as the unique equilibrium of any dynamic version of game . Whether dynamic or not, computing the optimal strategy is an easy task for any voter, so the requirements to behave rationally are neither demanding nor unrealistic.

Finally, we note that implementation of any of the above mechanisms can be effected using so-called Smart Contracts.101010We refer to Wood (2014). See also, retrieved on 16 November, 2017. These contracts are computer protocols intended to facilitate, verify, and enforce the exchange between individuals. The Devil’s Menu can be coded in any programming language and run on the blockchain. Payments may be carried out in any of the crypto-currencies implementing Smart Contracts. Since the main property of Smart Contracts is that they are self-executing and self-enforcing, the adversary will be committed to the protocol and the payments. This, in turn, justifies the assumptions we made for Theorem 1 about citizen behavior. Citizens can join the contract at any time before timeout by sending their votes in the form of passwords. Smart Contracts also provide security and partial anonymity, which are paramount in our voting set-up.

4 Buying Decoy Ballots Cheaper

In the preceding section we have shown that the adversary can buy all real ballots of districts, but she cannot avoid paying the price to all decoy voters in those districts. In this section we outline three ways in which this price can be lowered.

4.1 Sequential vote buying

First, the adversary may proceed sequentially and buy only the real ballots of one district at a particular point in time. Specifically, suppose that there are  points in time and the adversary commits to buy the real ballots of only one district at each date. We obtain the following result:

Proposition 1.

Suppose . If the adversary uses the Devil’s Menu with four prices sequentially and buys the real ballots of one district at each date, the strategy profile in which all decoy voters apply for slot  and all real voters apply for slot  is the only subgame perfect equilibrium.


Proposition 1 can be proved by backward induction. At the last date, there are districts, of which only one will be selected by the adversary. The corresponding critical value for such that is the only Nash equilibrium at the last date is thus

At all preceding dates, we have a smaller critical value for , which ensures that will prescribe only those actions at this stage that are compatible with equilibrium behavior, anticipating that will also determine the actions chosen at any future date. The reason is that there are more districts from which one is selected. This completes the proof. ∎

4.2 A strong form of the Devil’s Menu: four prices

There are at least two alternative versions of the Devil’s Menu that require only negligible payments for decoy ballots. Both alternatives—which are manifestations of the so-called Strong Form of the Devil’s Menu—enable the adversary to use nearly her entire budget for real ballots, thereby rendering the prevention of vote buying via decoy ballots completely ineffective. The first alternative follows the same mechanism as the Devil’s Menu outlined in Section 3, but the price setting is slightly different. Specifically, the price scheme is as follows:

slot slot
district selected
district not selected
Table 4: The Strong form of the Devil’s Menu—depending on the slot applied for (column) and the final status of the voter’s district (row).

Note that by setting Table 4 follows from Table 1 and that, moreover, only three different prices are actually offered. The corresponding simultaneous-move game is denoted by . We obtain the following result:

Proposition 2.

The strategy profile , in which all decoy voters apply for slot  and all real voters apply for slot , is a Nash equilibrium of game .


Under this modified Devil’s Menu with four prices, applying for weakly dominates applying for in the case of real voters. If citizens behave in accordance with , the payoff of a decoy voter is , with every district having the same chance of being selected. A deviation by a decoy voter switching from to would then cause the deselection of his district. In such a case, citizen would end up with a payoff of . This means that such a deviation is not profitable, which completes the proof. ∎

Proposition 2 has important consequences. Since can be chosen arbitrarily small, the budget of the adversary can be used almost entirely for buying real ballots in the equilibrium described in Proposition 2. Total expenditures are then bounded by

One possible drawback of this strong form of the Devil’s Menu is that game  may have other equilibria in which some decoy voters also apply for slot . To eliminate these other equilibria, one has to introduce further refinements in the price offering. This constitutes the second part of the strong form of the Devil’s Menu.

4.3 A strong form of the Devil’s Menu: Six prices

An alternative way of reducing the cost of buying decoy ballots almost entirely is to enlarge the menu of prices. The price scheme of the second strong form of the Devil’s Menu is as follows:

slot slot
district in set (selected)
district in set is selected
district is not selected
Table 5: The Strong form of the Devil’s Menu with six prices—depending on the slot applied for (column) and the interim and final status of the voter’s district (row).

In this six-price setting procedure, is assumed to be arbitrarily small. It will also suffice to choose such that . In addition, note that in Table 5 only five different prices are actually offered. The corresponding simultaneous-move game is denoted by . We obtain the following result:

Theorem 2.

[A strong form of the Devil’s Menu] Suppose . Then the strategy profile , in which all decoy voters apply for slot  and all real voters apply for slot , is the only Nash equilibrium of game .


As in the proof of Theorem 1, abstaining is weakly dominated for all citizens, while applying for slot  is weakly dominated for all real voters. We also observe that must hold again in any equilibrium . Indeed, if , there must exist decoy voters in districts in who applied for slot . However, these voters can strictly improve their payoff by applying for slot . The reason is as follows: Let be a decoy voter such that and . If deviated and applied instead for , either district would become a selected district and the expected utility strictly larger than (since ), or district would still belong to , in which case the deviation would increase the payment to citizen (since ). Hence, we obtain that , and it follows that .

Next we show that cannot occur in equilibrium either. Suppose that for . Then, in each district that belongs to , there must be at least one decoy voter such that . Consider one of these districts, say , and a decoy voter in who has applied for slot . The probability that will be selected by fair randomization is equal to . Then ’s expected payoff is equal to . By contrast, if deviates from his strategy in and applies for , set will consist of districts and set will consist of districts. In this latter case, district will be chosen with probability , and the payoff to decoy voter will be equal to . We claim that the latter payoff is strictly larger than if is sufficiently small, so is better off if he applies for slot . Indeed, using and , and taking arbitrarily low, we have

Finally, is an equilibrium if no decoy voter wants to apply for slot . In the unique equilibrium featuring , the expected payoff for such a voter is . Applying for slot  would result in , since the district to which this citizen belongs would no longer be selected. Hence, the deviation is not profitable, which completes the proof. ∎

The Devil’s Menu with six prices efficiently eliminates almost all expenditures on decoy ballots and again generates more power for buying real ballots. Indeed, by taking , total expenditures are now bounded by

It is however important to point out that this second strong form of the Devil’s Menu rests decisively on the assumption that the adversary can credibly offer two different prices for selected districts, at least for slot . The two prices discriminate among districts based on their interim status. On the one hand, the district may belong to —and hence its interim status is immediately selected. On the other hand, the district may belong to and be selected only after it has been chosen by fair randomization.111111It may happen that set contains one district only, in which case such district will be selected with certainty. Citizens of this district are thus offered prices than citizens of all other selected districts. This property can be built into the algorithms executed by Smart Contracts, but it may be less accepted by citizens.

5 Extensions and Applications

In this section we do three things. First, we analyze the role of the adversary’s commitment power. Second, we investigate some extensions of the baseline framework set out in Section 3. Third, we discuss applications of the Devil’s Menu to the standard “Lemons Problem.”

5.1 A simple Devil’s Menu with strong commitment

For all the Devil’s Menu variants we have analyzed in the previous sections, it was essential that the adversary could commit to the use of the protocol underlying the procedure. Stronger assumptions on the commitment power of the adversary would open up other forms of the Devil’s Menu. A very simple procedure would be sufficient if the adversary could commit to not buying any ballot if the number of applicants across slots did not satisfy a certain criterion. This can be illustrated for a situation in which there are no districts or, equivalently, any information regarding them is disregarded by the adversary. Recall that denotes the total number of real voters. Now, suppose that the adversary wants to buy real ballots, with . For that purpose, she considers the following procedure:

  1. Two slots, and , are announced.

  2. Each citizen applies for one of the two slots.

  3. With citizens being able to decide whether to sell their vote or not at the prevailing price and the adversary being obliged to accept the transaction at the request of the citizens, payoffs are realized according to the following rule:

    • If more than citizens apply for slot , then all of them are offered in exchange for their ballot. In turn, all citizens who applied for slot  are offered , also in exchange for their ballot.

    • If voters at most applied for slot , then of them are chosen randomly. They then receive in exchange for their ballot. In turn, all citizens who applied for slot  are offered , also in exchange for their ballot.

It is easy to see that in the simultaneous-move game induced by the mechanism described above, the strategy profile where all the real citizens apply for the slot  and all the decoy voters apply for the slot  is the only Nash equilibrium, provided that real voters do not play weakly dominated strategies. Moreover, the expenditures used to buy decoy ballots are negligible. Note that the assumption on the commitment power of the adversary is crucial for the functioning of the procedure, as citizens must believe that if the adversary ends up with zero ballots, she will not renege on her promise not to try and buy some.

One important drawback of this mechanism is that, unlike the Devil’s Menu with four or more prices—see e.g. Corollary 1—, any single decoy voter has the power to easily sabotage the mechanism by applying for slot . In such cases, repeating the mechanism will not help. The reason is the following: If there is a chance that the mechanism will be repeated, incentives will be created for any decoy voter to deviate in the first round and apply for slot .

5.2 Noise

To counteract the power of the adversary when using the Devil’s Menu, an election designer might want to introduce noise. One possibility would be random choice of the number of real voters across districts.121212We emphasize that the functioning of the Devil’s Menu is not affected if there is uncertainty about the number of decoy ballots, provided that no citizen can hold more than one ballot. On other occasions, the adversary might simply not know the precise number of real voters in each district, particularly if there is no natural partition of the entire population into small subgroups upon which the procedure can be built. For instance, there may be only one district. In either of these situations, the Devil’s Menu could still be applied, based on the expected number of real voters in each district. In doing so, however, some decoy voters may be paid the higher price . This would result in overspending by the adversary.

5.3 General valuation distribution

In our analysis thus far, we have assumed that all real voters had a common valuation for their ballots. In a real environment, however, voter valuations will be distributed within some range. In this case, one possibility of buying all the real ballots of districts would be to have denote the maximum possible voter valuation and then run the Devil’s Menu accordingly. This approach could nonetheless be very inefficient, since some real voters may be offered prices that are well above their willingness to sell. Alternatively, the adversary could have denote a price threshold ensuring that a large majority of the population will have their valuations below it with very high probability. If the adversary ran the Devil’s Menu with this parameter, real voters with valuations below would participate and those above would abstain. Given sufficiently accurate information on the distribution, the Devil’s Menu might still be reasonably efficient.

Another feature of our analysis that was missing in the previous sections is that in both elections or referenda ballots are to be cast in favor of some alternative. This implies that a ballot is not a standard consumption good. In particular, voters may obtain the same utility regardless of who is eventually casting their ballot, as long as it is done in favor of their preferred alternative. Accordingly, if the adversary herself had some preference regarding the alternatives at hand—and hence would not simply act as a reseller of ballots—and this preference was common knowledge, the real voters who had the same preference as the adversary could be considered decoy voters. The reason is that they would anticipate that the adversary would use their vote as they intended, so their willingness to sell would drop from to .131313With only two alternatives, can be interpreted as the differential utility citizens with different preferences than the adversary would obtain from casting a vote against their own preferred alternative. As discussed above, if the adversary learned the number of real voters who share her preferences, she could still run the Devil’s Menu very efficiently by taking into account the fact that these citizens are behaving as decoy voters.

5.4 The Devil’s Menu and the “Lemons Problem”

The Devil’s Menu offers further applications in connection with the so-called “Lemons Problem.”141414The classical “Lemons Problem” is outlined in Akerlof (1970). We refer to Riley (2001) for an early survey of possible solutions to lemon problems and to Kim (2012) for partial solutions using specific market organizations. For mechanism design approaches that could be used, see Börgers (2015). We outline one of them. Suppose that an agent—the buyer—wants to buy one used car of high quality, and that she can buy it from several individuals—the sellers—each of whom have a used car. The buyer knows the number of good-quality and bad-quality cars among the sellers, yet she does not know which particular sellers have them. In this situation, the buyer could run the Devil’s Menu in Section 5.1, offer two slots— and —to all sellers, and then select one seller from those who have applied for slot by fair randomization, from which the buyer would get the car at the prevailing price. This strategy for an adversary could be particularly appealing in the Internet, in which case the purchase of the car could be set up similarly as in online auctions.

6 Conclusion

We have shown that electronic voting systems based on decoy ballots may be vulnerable to sophisticated attacks, particularly when the population with a right to vote is divided into subgroups and the adversary exhibits some degree of commitment power. In such cases, the adversary may significantly reduce her expenditures on decoy ballots and thus use her budget mainly to buy real ballots. This would hence render decoy ballots an ineffective tool for fighting vote buying by trying to blow up the adversary’s budget.

While we have limited ourselves to a simple scenario, in our analysis we have also touched upon some more general scenarios, the comprehensive understanding of which merits analysis in each particular case. Examples are the existence of imperfect information about the number of real ballots and applications of the Devil’s Menu to the “Lemons Problem.” Numerous further scenarios also lie ahead of us. We refer to three of them. First, citizens may have more than one ballot or, similarly, they could collude and adopt a unified strategy. Second, there could be two adversaries trying to buy votes, possibly with conflicting interests. Third, as a further application to the “Lemons Problem”, the Devil’s Menu could be tailored to situations where an agent—the adversary—wants to buy a valuable secret from a group of individuals, say, a firm or a bureaucratic unit, knowing that only one of the individuals has it. Examples could be a password or the identity of the person who has important knowledge. All these instances are left to future research.


  • Akerlof (1970) Akerlof, G. A. (1970). The Market for “Lemons”: Quality Uncertainty and the Market Mechanism. Quarterly Journal of Economics, 84(3):488–500.
  • Basin et al. (2017) Basin, D., Gersbach, H., Mamageishvili, A., Schmid, L., and Tejada, O. (2017). Election Security and Economics: It’s All about Eve. In Proceedings of the Second International Joint Conference on E-Vote-ID, Bregenz, Austria, pages 1–20.
  • Börgers (2015) Börgers, T. (2015). An Introduction to the Theory of Mechanism Design. Oxford University Press, New York, NY.
  • Chaum (2016) Chaum, D. (2016). Random Sample Voting. Mimeo.
  • Dekel et al. (2008) Dekel, E., Jackson, M. O., and Wolinsky, A. (2008). Vote Buying: General Elections. Journal of Political Economy, 116(2):351–380.
  • Finan and Schechter (2012) Finan, F. and Schechter, L. (2012). Vote-Buying and Reciprocity. Econometrica, 80(2):863–881.
  • Kim (2012) Kim, K. (2012). Endogenous Market Segmentation for Lemons. RAND Journal of Economics, 43(3):562–576.
  • Parkes et al. (2017) Parkes, D. C., Tylkin, P., and Xia, L. (2017). Thwarting Vote Buying Through Decoy Ballots. In Proceedings of the 16th Conference on Autonomous Agents and MultiAgent Systems, AAMAS 2017, São Paulo, Brazil, pages 1679–1681.
  • Riley (2001) Riley, J. G. (2001). Silver Signals: Twenty-five Years of Screening and Signaling. Journal of Economic Literature, 39(2):432–478.
  • Wood (2014) Wood, G. (2014). Ethereum: A secure decentralized generalised transaction ledger. Mimeo.