{"title": "Algorithms for Interdependent Security Games", "book": "Advances in Neural Information Processing Systems", "page_first": 561, "page_last": 568, "abstract": "", "full_text": "Algorithms for Interdependent Security Games\n\nMichael Kearns\nLuis E. Ortiz\n\nDepartment of Computer and Information Science\n\nUniversity of Pennsylvania\n\n1 Introduction\n\nInspired by events ranging from 9/11 to the collapse of the accounting \ufb01rm Arthur Ander-\nsen, economists Kunreuther and Heal [5] recently introduced an interesting game-theoretic\nmodel for problems of interdependent security (IDS), in which a large number of players\nmust make individual investment decisions related to security \u2014 whether physical, \ufb01nan-\ncial, medical, or some other type \u2014 but in which the ultimate safety of each participant\nmay depend in a complex way on the actions of the entire population. A simple example is\nthe choice of whether to install a \ufb01re sprinkler system in an individual condominium in a\nlarge building. While such a system might greatly reduce the chances of the owner\u2019s prop-\nerty being destroyed by a \ufb01re originating within their own unit, it might do little or nothing\nto reduce the chances of damage caused by \ufb01res originating in other units (since sprinklers\ncan usually only douse small \ufb01res early). If \u201cenough\u201d other unit owners have not made the\ninvestment in sprinklers, it may be not cost-effective for any individual to do so.\n\nKunreuther and Heal [5] observe that a great variety of natural problems share this basic in-\nterdependent structure, including investment decisions in airline baggage security (in which\ninvestments in new screening procedures may reduce the risk of directly checking suspi-\ncious cargo, but nearly all airlines accept transferred bags with no additional screening 1);\nrisk management in corporations (in which individual business units have an incentive to\navoid high-risk or illegal activities only if enough other units are similarly well-behaved);\nvaccination against infectious disease (where the fraction of the population choosing vac-\ncination determines the need for or effectiveness of vaccination); certain problems in com-\nputer network security; and many others. All these problems share the following important\nproperties:\n\n(cid:15) There is a \u201cbad event\u201d (condominium \ufb01re, airline explosion, corporate bankruptcy,\ninfection, etc.) to be avoided, and the opportunity to reduce the risk of it via some\nkind of investment.\n\n(cid:15) The cost-effectiveness of the security investment for the individual is a function\n\nof the investment decisions made by the others in the population.\n\nThe original work by Kunreuther and Heal [5] proposed a parametric game-theoretic model\nfor such problems, but left the interesting question of computing the equilibria of model\nlargely untouched. In this paper we examine such computational issues.\n\n1El Al airlines is the exception to this.\n\n\f2 De\ufb01nitions\n\nIn an IDS game, each player i must decide whether or not to invest in some abstract security\nmechanism or procedure that can reduce their risk of experiencing some abstract bad event.\nThe cost of the investment to i is Ci, while the cost of experiencing the bad event is \u0004i;\nthe interesting case is when \u0004i >> Ci. Thus, player i has two choices for his action ai:\nai = 1 means the player makes the investment, while ai = 0 means he does not. It turns\nout that the important parameter is the ratio of the two costs, so we de\ufb01ne Ri = Ci=\u0004i.\nFor each player i, there is a parameter \u0004i, which is the probability that player i will expe-\nrience the bad event due to internal contamination if ai = 0 \u2014 for example, this is the\nprobability of the condominium owner\u2019s unit burning down due to a \ufb01re originating in his\nown unit. We can also think of \u0004i as a measure of the direct risk to player i \u2014 as we shall\nsee, it is that portion of his risk under his direct control.\nTo model sources of indirect risk, for each pair of players i; j; i 6= j, let \u0005ji be the proba-\nbility that player i experiences the bad event as a result of a transfer from player j \u2014 for\nexample, this is the probability that the condominium of player i burns down due to a \ufb01re\noriginating in the unit of player j. Note the implicit constraint that \u0004i \u0007 \bj6=i \u0005ji < 1.\nAn IDS game is thus given by the parameters \u0004i, \u0005ji, \u0004i, Ci for each player i, and the\nexpected cost to player i under the model is de\ufb01ned to be\n\n\u0005i\u0004~a\u0005 =a iCi \u0007 \u00041 ai\u0005\u0004i\u0004i \u0007 \u00041 \u00041 ai\u0005\u0004i\u0005\n\n2\n41 \n\n\u0002\n\nY\n\nj=1;j6=i\n\n\u00041 \u00041 aj\u0005\u0005ji\u0005\n\n3\n5 \u0004i (1)\n\nLet us take a moment to parse and motivate this de\ufb01nition, which is the sum of three terms.\nThe \ufb01rst term represents the amount invested in security by player i, and is either 0 (if\nai = 0) or Ci (if ai = 1). The second term is the expected cost to i due to internal or direct\nrisk of the bad event, and is either \u0004i\u0004i (which is the expected cost of internally generated\nbad events in the case ai = 0), or is 0 (in the case of investment, ai = 1). Thus, there is a\nnatural tension between the \ufb01rst two terms: players can either invest in security, which costs\nmoney but reduces risk, or gamble by not investing. Note that here we have assumed that\nsecurity investment perfectly eradicates direct risk (but not indirect risk); generalizations\nare obviously possible, but have no qualitative effect on the model.\n\nIt is the third term of Equation (1) that expresses the interdependent nature of the problem.\nThis term encodes the assumption that there are \u0002 sources of risk to player i \u2014 his own\ninternal risk, and a speci\ufb01c transfer risk from each of the other \u0002 1 players \u2014 and that\nall these sources are statistically independent. The prefactor \u00041 \u00041 ai\u0005\u0004i\u0005 is simply the\nprobability that player i does not experience the bad event due to direct risk. The bracketed\nexpression is the probability that player i experiences a bad event due to transferred risk:\neach factor \u00041 \u00041 aj\u0005\u0005ji\u0005 in the product is the probability that a bad event does not\nbefall player i due to player j (and the product expresses the assumption that all of these\npossible transfer events are independent). Thus 1 minus this product is the probability of\ntransferred contamination, and of course the product of the various risk probabilities is also\nmultiplied by the cost \u0004i of the bad event.\nThe model parameters and Equation (1) de\ufb01ne a compact representation for a multiplayer\ngame in which each player\u2019s goal is to minimize their cost. Our interest is in the ef\ufb01cient\ncomputation of Nash equilibria (NE) of such games 2.\n\n2See (for example) [4] for de\ufb01nitions of Nash and approximate Nash equilibria.\n\n\f3 Algorithms\n\nWe begin with the observation that it is in fact computationally straightforward to \ufb01nd a\nsingle pure NE of any IDS game. To see this, it is easily veri\ufb01ed that if there are any con-\nditions under which player i prefers investing (ai = 1) to not investing (ai = 0) according\nto the expected costs given by Equation (1), then it is certainly the case that i will prefer to\ninvest when all the other \u0002 1 players are doing so. Similarly, the most favorable condi-\ntions for not investing occur when no other players are investing. Thus, to \ufb01nd a pure NE,\nwe can \ufb01rst check whether either all players investing, or no players investing, forms a NE.\nIf so, we are \ufb01nished. If neither of these extremes are a NE, then there are some players for\nwhom investing or not investing is a dominant strategy (a best response independent of the\nbehavior of others). If we then \u201cclamp\u201d such players to their dominant strategies, we obtain\na new IDS game with fewer players (only those without dominant strategies in the original\ngame), and can again see if this modi\ufb01ed game has any players with dominant strategies.\nAt each stage of this iterative process we maintain the invariant that clamped players are\nplaying a best response to any possible setting of the unclamped players.\n\nTheorem 1 A pure NE for any \u0002-player IDS game can be computed in time \u0007\u0004\u00022\u0005.\n\nIn a sense, the argument above demonstrates the fact that in most \u201cinteresting\u201d IDS games\n(those in which each player is a true participant, and can have their behavior swayed by\nthat of the overall population), there are two trivial pure NE (all invest and none invest).\nHowever, we are also interested in \ufb01nding NE in which some players are choosing to invest\nand others not to (even though no player has a dominant strategy). A primary motivation\nfor \ufb01nding such NE is the appearance of such behavior in \u201creal world\u201d IDS settings, where\nindividual parties do truly seem to make differing security investment choices (such as with\nsprinkler systems in large apartment buildings). Conceptually, the most straightforward\nway to discover such NE would be to compute all NE of the IDS game. As we shall\neventually see, for computational ef\ufb01ciency such a demand requires restrictions on the\nparameters of the game, one natural example of which we now investigate.\n\n3.1 Uniform Transfer IDS Games\n\nA uniform transfer IDS game is one in which the transfer risks emanating from a given\nplayer are independent of the transfer destination. Thus, for any player j, we have that\nfor all i 6= j, \u0005ji = \u00c6j for some value \u00c6j. Note that the risk level \u00c6j presented to the\npopulation by different players j may still vary with j \u2014 but each player spreads their risk\nindiscriminately across the rest of the population. An example would be the assumption\nthat each airline transferred bags with equal probability to all other airlines.\n\nIn this section, we describe two different approaches for computing NE in uniform trans-\nfer IDS games. The \ufb01rst approach views a uniform transfer IDS game as a special type\nof summarization game, a class recently investigated by Kearns and Mansour [4]. In an\n\u0002-player summarization game, the payoff of each player i is a function of the actions ~ai\nof all the other players, but only through the value of a global and common real-valued\nsummarization function S\u0004~a\u0005. The main result of [4] gives an algorithm for computing\napproximate NE of summarization games, in which the quality of the approximation de-\npends on the in\ufb02uence of the summarization function S. A well-known notion in discrete\nfunctional analysis, the in\ufb02uence of S is the maximum change in S that any input (player)\ncan unilaterally cause. (See [4] for detailed de\ufb01nitions.)\n\nIt can be shown (details omitted) that any uniform transfer IDS game is in fact a summa-\n\n\frization game under the choice\n\nS\u0004~a\u0005 =\n\n\u0002\n\nY\n\nj=1\n\n\u00041 \u00041 aj\u0005\u00c6j\u0005\n\n(2)\n\nand that the in\ufb02uence of this function is bounded by the largest \u00c6j. We note that in many\nnatural uniform transfer IDS settings, we expect this in\ufb02uence to diminish like 1=\u0002 with\nthe number of players \u0002. (This would be the case if the risk transfer comes about through\nphysical objects like airline baggage, where each transfer event can have only a single\ndestination.) Combined with the results of [4], the above discussion can be shown to yield\nthe following result.\n\nTheorem 2 There is an algorithm that takes as input any uniform transfer IDS game, and\nany (cid:15) > 0, and computes an \u0007\u0004(cid:15) \u0007 (cid:28) (cid:26)\u0005-NE, where (cid:26) = \u0001axjf\u00041 \u0004j\u0005=\u00041 \u00c6j\u0005g and\n(cid:28) = \u0001axjf\u00c6jg. The running time of the algorithm is polynomial in \u0002, 1=(cid:15), and (cid:26).\n\nWe note that in typical IDS settings we expect both the \u0004j and \u00c6j to be small (the bad event\nis relatively rare, regardless of its source), in which case (cid:26) may be viewed as a constant.\nFurthermore, it can be veri\ufb01ed that this algorithm will in fact be able to compute approxi-\nmate NE in which some players choose to invest and others not to, even in the absence of\nany dominant strategies.\n\nWhile viewing uniform transfer IDS games as bounded in\ufb02uence summarization games\nrelates them to a standard class and yields a natural approximation algorithm, an improved\napproach is possible. We now present an algorithm (Algorithm UniformTransferIDSNash\nin Figure 3.1) that ef\ufb01ciently computes all NE for uniform transfer IDS games. The algo-\nrithm (indeed, even the representation of certain NE) requires the ability to compute \u0001th\nroots.\nWe may assume without loss of generality that for all players i, \u00c6i > 0, and \u0004i > 0.\nFor a joint mixed strategy vector ~x 2 [0; 1]\u0002, denote the set of (fully) investing players as\n\u0001 (cid:17) fi : xi = 1g; the set of (fully) non-investing players as \u0006 (cid:17) fi : xi = 0g; and the set\nof partially investing players as \b (cid:17) fi : 0< x i < 1g:\nThe correctness of algorithm UniformTransferIDSNash follows immediately from two\nlemmas that we now state without proof due to space considerations. The \ufb01rst lemma is a\ngeneralization of Proposition 2 of [2], and essentially establishes that the values Ri=\u0004i and\n\u00041\u00c6i\u0005Ri=\u0004i determine a two-level ordering of the players\u2019 willingness to invest. This dou-\nble ordering generates the outer and inner loops of algorithm UniformTransferIDSNash.\nNote that a player with small Ri=\u0004i has a combination of relatively low cost of investing\ncompared to the loss of a bad event (recall Ri = Ci=\u0004i), and relatively high direct risk \u0004i,\nand thus intuitively should be more willing to invest than players with large Ri=\u0004i. The\nlemma makes this intuition precise.\n\nLemma 3 (Ordering Lemma) Let ~x be a NE for a uniform transfer IDS game G =\n\u0004\u0002; ~R; ~\u0004; ~\u00c6\u0005. Then for any i 2 \u0001 (an investing player), any j 2 \u0006 (a partially investing\nplayer), and any k 2 \b (a non-investing player), the following conditions hold:\n\nRi=\u0004i < Rj=\u0004j\nRi=\u0004i (cid:20) \u00041 \u00c6k\u0005 Rk=\u0004k < Rk=\u0004k\n\n\u00041 \u00c6j\u0005 Rj=\u0004j < \u00041 \u00c6k\u0005 Rk=\u0004k\n\nThe second lemma establishes that if a NE contains some partially investing players, the\nvalues for their mixed strategies is in fact uniquely determined. The equations for these\nmixed strategies is exploited in the subroutine TestNash.\n\n\fAlgorithm UniformTransferIDSNash\nInput: An \u0002-player uniform transfer IDS game G with direct risk parameters ~\u0004, transfer risk\nparameters ~\u00c6, and cost parameters ~R, where Ri = Ci=\u0004i.\nOutput: A set S of all exact connected sets of NE for G.\n\n1. Initialize a partition of the players into three sets \u0001; \u0006; \b (the investing, not investing,\nand partially investing players, respectively) and test if everybody investing is a NE:\n\u0001 f1; : : : ; \u0002g; \u0006 ;; \b ;; S TestNash\u0004G; \u0001; \u0006; \b; S\u0005\n\n2. Let \u0004i1; i2; :::; i\u0002\u0005 be an ordering of the \u0002 players satisfying Ri1 =\u0004i1 (cid:21) : : : (cid:21)\n\nRi\u0002 =\u0004i\u0002. Call this the outer ordering.\n\n3. for k = 1; : : : ; \u0002\n\n(a) Move the next player in the outer ordering from the investing to the partially-\n\ninvesting sets: \b \b S fikg; \u0001 \u0001 fikg\n\n(b) Let \u0004j1; :::; jk\u0005 be an ordering of the players in \b satisfying \u00041\u00c6j1 \u0005 Rj1 =\u0004j1 (cid:21)\n\n: : : (cid:21) \u00041 \u00c6jk \u0005 Rjk =\u0004jk . Call this the inner ordering.\n\n(c) Consider a strategy with no not-investing players: \u0006 ;; S \n\nTestNash\u0004G; \u0001; \u0006; \b; S\u0005\n\n(d) for \u0001 = 1; : : : ; k\n\ni. Move the next player in the inner ordering from the partially-investing to\nnon-investing sets, and test if there is a NE consistent with the partition:\n\u0006 \u0006 S fj\u0001g; \b \b fj\u0001g; S TestNash\u0004G; \u0001; \u0006; \b; S\u0005\n\nSubroutine TestNash\nInputs: An \u0002-player uniform transfer IDS game G; a partition of the players \u0001; \u0006; \b (as above);\nS, the current discovered set of connected sets of NE for G\nOutput: S with possibly one additional connected set of NE of G consistent with \u0001; \u0006, and \b\n(assuming unit-time computation of \u0001-roots of rational numbers)\n\n2.\n\n1. Set pure strategies for not-investing and investing players, respectively: 8k 2\n\n\u0006; xk 0, 8i 2 \u0001; xi 1.\nif j\b j = 1 (Lemma 4, part (a) applies)\n(a) Let \b = fjg, U as in Equation 3 and U 0 = U T \u00040; 1\u0005\n(b) if Rj = \u0004j \tk2\u0006 \u00041 \u00c6k\u0005 (i.e., player j is indifferent) and U 0 6= ;, then return\n\nS S ff~y : yj 2 U 0; ~yj = ~xjgg\n\n3. else (Lemma 4, part (b) applies)\n\n(a) Compute mixed strategies 8j 2 \b; xj as in Equation 4\n(b) if 9j 2 \b; xj (cid:20) 0 or xj (cid:21) 1, return S\n(c) if ~x is a NE for G then return S S ff~xgg\n\n4. return S\n\nFigure 1: Algorithm UniformTransferIDSNash\n\nIf \u0001 = [; \t] is an interval of < with endpoints and \t, and a; b 2 < then we de\ufb01ne\na\u0001 \u0007 b (cid:17) [a \u0007 b; a\t \u0007 b].\n\nLemma 4 (Partial Investment Lemma) Let ~x 2 [0; 1]\u0002 be a mixed strategy for a uniform\ntransfer IDS game G = \u0004\u0002; ~R; ~\u0004; ~\u00c6\u0005, and let \b be the set of partially investing players in ~x.\nThen (a) if j\b j = 1, then letting \b = fjg, V = [\u0001axi2\u0001 Ri=\u0004i; \u0001i\u0002k2\u0006 \u00041 \u00c6k\u0005 Rk=\u0004k] ;\nand\n\n(3)\nit holds that ~x is a NE if and only if Rj = \u0004j \tk2\u0006 1 \u00c6k (i.e., player j is indifferent) and\nplayer j mixed strategy satis\ufb01es xj 2 U ; else, (b) if j\b j > 1, and ~x is a NE, then for all\n\nU = \u0004\u0004\u0004j =Rj\u0005 V \u00041 \u00c6j\u0005\u0005 = \u00c6j\n\n\fj 2 \b ,\n\nxj = \u0004\u0004\u0004j=Rj\u0005E \u00041 \u00c6j\u0005\u0005 = \u00c6j\n\n(4)\n\nwhere E = (cid:16)\tj2\b \u0004Rj =\u0004j\u0005 . \tk2\u0006 \u00041 \u00c6k\u0005(cid:17)1=\u0004j\b j1\u0005\n\n:\n\nThe next theorem summarizes our second algorithmic result on uniform transfer IDS\ngames. The omitted proof follows from Lemmas 3 and 4.\n\nTheorem 5 Algorithm UniformTransferIDSNash computes all exact (connected sets of)\nNE for uniform transfer IDS games in time polynomial in the size of the model.\n\nWe note that it follows immediately from the description and correctness of the algorithm\nthat any \u0002-player uniform transfer IDS game has at most \u0002\u0004\u0002 \u0007 3\u0005=2 \u0007 1 connected sets\nof NE. In addition, each connected set of NE in a uniform transfer IDS game is either\na singleton or a simple interval where \u0002 1 of the players play pure strategies and the\nremaining player has a simple interval in [0; 1] of probability values from which to choose\nits strategy. At most \u0002 of the connected sets of NE in a uniform transfer IDS game are\nsimple intervals.\n\n3.2 Hardness of General IDS Games\n\nIn light of the results of the preceding section, it is of course natural to consider the com-\nputational dif\ufb01culty of unrestricted IDS. We now show that even a slight generalization of\nuniform transfer IDS games, in which we allow the \u00c6j to assume two \ufb01xed values instead\nof one, leads to the intractabilty of computing at least some of the NE.\n\nA graphical uniform transfer IDS game, so named because it can be viewed as a marriage\nbetween uniform transfer IDS games and the graphical games introduced in [3], is an IDS\ngame with the restriction that for all players j, \u0005ji 2 f0; \u00c6jg, for some \u00c6j > 0. Let\n\u0006 \u0004j\u0005 (cid:17) fi : \u0005ji > 0g be the set of players that can be directly affected by player j\u2019s\nbehavior. In other words, the transfer risk parameter \u0005ji of player j with respect to player i\nis either zero, in which case the player j has no direct effect on player i\u2019s behavior; or it is\nconstant, in which case, the public safety eji = \u00041 \u00041 xj\u0005\u00c6j\u0005 of player j with respect\nto player i 2 \u0006 \u0004j\u0005 is the same as for any other player in \u0006 \u0004j\u0005.\nThe pure Nash extension problem for an \u0002-player game with binary actions takes as input\na description of the game and a partial assignment ~a 2 f0; 1; \u0003g\u0002. The output may be any\ncomplete assignment (joint action) ~b 2 f0; 1g\u0002 that agrees with ~a on all its 0 and 1 settings,\nand is a (pure) NE for the game; or \u201cnone\u201d if no such NE exists. Clearly the problem of\ncomputing all the NE is at least as dif\ufb01cult as the pure Nash extension problem.\n\nTheorem 6 The pure Nash extension problem for graphical uniform transfer IDS games is\nNP-complete, even if j\u0006 \u0004j\u0005j (cid:20)3 for all j, and \u00c6j is some \ufb01xed value \u00c6 for all j.\n\nThe reduction (omitted) is from Monotone One-in-Three SAT [1].\n\n4 Experimental Study: Airline Baggage Security\n\nAs an empirical demonstration of IDS games, we constructed and conducted experiments\non an IDS game for airline security that is based on real industry data. We have access\nto a data set consisting of 35,362 records of actual civilian commercial \ufb02ight reservations,\nboth domestic and international, made on August 26, 2002. Since these records contain\ncomplete \ufb02ight itineraries, they include passenger transfers between the 122 represented\ncommercial air carriers. As described below, we used this data set to construct an IDS\n\n\fgame in which the players are the 122 carriers, the \u201cbad event\u201d corresponds to a bomb\nexploding in a bag being transported in a carrier\u2019s airplane, and the transfer event is the\nphysical transfer of a bag from one carrier to another.\nFor each carrier pair \u0004i; j\u0005, the transfer parameter \u0005ji was set to be proportional to the\ncount of transfers from carrier j to carrier i in the data set. We are thus using the rate of\npassenger transfers as a proxy for the rate of baggage transfers. The resulting parameters\n(details omitted) are, as expected, quite asymmetric, as there are highly structured pat-\nterns of transfers resulting from differing geographic coverages, alliances between carriers,\netc. The model is thus far from being a uniform transfer IDS game, and thus algorithm\nUniformTransferIDSNash cannot be applied; we instead used a simple gradient learning\napproach.\nThe data set provides no guidance on reasonable values for the Ri and \u0004i, which quantify\nrelative costs of a hypothetical new screening procedure and the direct risks of checking\ncontaminated luggage, respectively; presumably Ri depends on the speci\ufb01c economics of\nthe carrier, and \u0004i on some notion of the risk presented by the carrier\u2019s clientele, which\nmight depend on the geographic area served. Thus, for illustrative purposes, an arbitrary\nvalue of \u0004i = 0:01 was chosen for all i 3, and a common value for Ri of 0.009 (so an\nexplosion is roughly 110 times more costly to a carrier than full investment in security).\nSince the asymmetries of the \u0005ji preclude the use of algorithm UniformTransferIDSNash,\nwe instead used a learning approach in which each player begins with a random initial\ninvestment strategy xi 2 [0; 1], and adjusts its degree of investment up or down based on\nthe gradient dynamics xi xi (cid:17)\u0001i, where \u0001i is determined by computing the derivative\nof Equation (1) and (cid:17) = 0:05 was used in the experiments to be discussed.\n\n49\n\n42\n\n35\n\n28\n\n21\n\n14\n\n7\n\n48\n\n41\n\n34\n\n27\n\n20\n\n13\n\n47\n\n40\n\n33\n\n26\n\n19\n\n12\n\n6\n\n5\n\n46\n\n39\n\n32\n\n25\n\n18\n\n11\n\n4\n\n(a)\n\n45\n\n38\n\n31\n\n24\n\n17\n\n10\n\n3\n\n44\n\n37\n\n30\n\n23\n\n16\n\n9\n\n2\n\n43\n\n36\n\n29\n\n22\n\n15\n\n8\n\n1\n\n49\n\n42\n\n35\n\n28\n\n21\n\n14\n\n7\n\n48\n\n41\n\n34\n\n27\n\n20\n\n13\n\n6\n\n47\n\n40\n\n33\n\n26\n\n19\n\n12\n\n5\n\n45\n\n38\n\n31\n\n24\n\n17\n\n10\n\n3\n\n44\n\n37\n\n30\n\n23\n\n16\n\n9\n\n2\n\n43\n\n36\n\n29\n\n22\n\n15\n\n8\n\n1\n\n46\n\n39\n\n32\n\n25\n\n18\n\n11\n\n4\n\n(b)\n\nFigure 2: (a) Simulation of the evolution of security investment strategies for the 49 busiest carrier\nusing gradient dynamics under the IDS model. Above each plot is an index indicating the rank of the\ncarrier in terms of overall volume in the data set. Each plot shows the investment level xi (initialized\nrandomly in [0; 1]) for carrier i over 500 simulation steps. (b) Tipping phenomena. Simulation of\nthe evolution of security investment strategies for the 49 busiest carriers, but with the three largest\ncarriers (indices 1, 2 and 3) in the data set clamped (subsidized) at full investment. The plots are\nordered as in (a), and again show 500 simulation steps under gradient dynamics.\n\nFigure 2(a) shows the evolution, over 500 steps of simulation time, of the investment level\nxi for the 49 busiest carriers 4. We have ordered the 49 plots with the least busy carrier\n3This is (hopefully) an unrealistically large value for the real world; however, it is the relationship\n\nbetween the parameters and not their absolute magnitudes that is important in the model.\n\n4According to the total volume of \ufb02ights per carrier in the data set.\n\n\f(index 49) plotted in the upper left corner, and the busiest (index 1) in the lower right\ncorner. The horizontal axes measure the 500 time steps, while the vertical axes go from 0\nto 1. The axes are unlabeled for legibility.\n\nThe most striking feature of the \ufb01gure is the change in the evolution of the investment\nstrategy as we move from less busy to more busy carriers. Broadly speaking, there is a large\npopulation of lower-volume carriers (indices 49 down to 34) that quickly converge to full\ninvestment (xi = 1) regardless of initial conditions. The smallest carriers, not shown (ranks\n122 down to 50), also all rapidly converge to full investment. There is then a set of medium-\nvolume carriers whose limiting strategy is approached more slowly, and may eventually\nconverge to either full or no investment (roughly indices 33 down to 14). Finally, the largest\ncarriers (indices 13 and lower) again converge quickly, but to no investment (xi = 0),\nbecause they have a high probability of having bags transferred from other carriers (even if\nthey protect themselves against dangerous bags being loaded directly on their planes).\n\nNote also that the dynamics can yield complex, nonlinear behavior that includes reversals of\nstrategy. The simulation eventually converges (within 2000 steps) to a (Nash) equilibrium\nin which some carriers are at full investment, and the rest at no investment. This property\nis extremely robust across initial conditions and model parameters,\n\nThe above simulation model enables one to examine how subsidizing several airlines to en-\ncourage it to invest in security can encourage others to do the same. This type of \u201ctipping\u201d\nbehavior [6] can be the basis for developing strategies for inducing adoption of security\nmeasures short of formal regulations or requirements. Figure2(b) shows the result of an\nidentical simulation to the one discussed above, except the three largest carriers (indices 1,\n2 and 3) are now \u201cclamped\u201d or forced to be at full investment during the entire simulation.\nIndependent of initial conditions, the remaining population now invariably converges to full\ninvestment. Thus the model suggests that these three carriers form (one of perhaps many\ndifferent) tipping sets \u2014 carriers whose decision to invest (due to subsidization or other\nexogenous forces) will create the economic incentive for a large population of otherwise\nskeptical carriers to follow. The dynamics also reveal a cascading effect \u2014 for example,\ncarrier 5 moves towards full investment (after having settled comfortably at no investment)\nonly after a number of larger and smaller carriers have done so.\nAcknowledgements: We give warm thanks to Howard Kunreuther, Geoffrey Heal and\nKilian Weinberger for many helpful discussions.\nReferences\n[1] Michael Garey and David Johnson. Computers and Intractability: A Guide to the\n\nTheory of NP-completeness. Freeman, 1979.\n\n[2] Geoffrey Heal and Howard Kunreuther. You only die once: Managing discrete inter-\ndependent risks. 2003. Working paper, Columbia Business School and Wharton Risk\nManagement and Decision Processes Center.\n\n[3] M. Kearns, M. Littman, and S. Singh. Graphical models for game theory.\n\nIn Pro-\nceedings of the Conference on Uncertainty in Arti\ufb01cial Intelligence, pages 253\u2013260,\n2001.\n\n[4] M. Kearns and Y. Mansour. Ef\ufb01cient Nash computation in summarization games with\nbounded in\ufb02uence. In Proceedings of the Conference on Uncertainty in Arti\ufb01cial In-\ntelligence, 2002.\n\n[5] Howard Kunreuther and Geoffrey Heal. Interdependent security. Journal of Risk and\n\nUncertainty (Special Issue on Terrorist Risks), 2003. In press.\n\n[6] Thomas Schelling. Micromotives and Macrobehavior. Norton, 1978.\n\n\f", "award": [], "sourceid": 2495, "authors": [{"given_name": "Michael", "family_name": "Kearns", "institution": null}, {"given_name": "Luis", "family_name": "Ortiz", "institution": null}]}