From: Hal <hfinney@shell.portal.com>
Date: Mon, 29 Aug 94 12:04:03 PDT
To: cypherpunks@toad.com
Subject: Problems with anonymous escrow 3
Message-ID: <199408291903.MAA14375@jobe.shell.portal.com>
MIME-Version: 1.0
Content-Type: text/plain


(Note - I originally wrote this and my other two postings on this
topic as one big message.  So when I refer to "above" here I really
mean my posting on "Problems with anonymous escrow 1".)

Another argument sometimes advanced in favor of trustworthy escrow
agents is the "iterated prisoner's dilemma".  This refers to Axelrod's
simulations of computer program agents which repeatedly interacted in
a simple "prisoner's dilemma" game which captures much of the essence
of the trust relationship (see his book "The Evolution of Cooperation").

His results generally have consistently shown that agents which are
never the first to "cheat" in a relationship do better than those
which try to take advantage of their counterparts.  The main
requirement for Axelrod's results to hold true is that there be a
history of interaction, so that agents recognize when they have
interacted before (and implicitly expect that they will interact
again).  It has been argued that interacting pseudonymous entities
satisfy the basic requirements for Axelrod's analysis because their
pseudonyms have continuity over time, and people can use past history
as a basis for future predictions (as in the escrow agency example).

There are some significant differences, though, between Axelrod's
scenario and the anonymous agents we are talking about.  One is the
issue of pseudonym continuity.  Although it is true that pseudonyms
can have continuity, they are not forced to, unlike in Axelrod's
experiments.  One of the main reasons why cheating is a bad idea in
Axelrod's runs is that the cheating is punished in future
interactions (generally, by being cheated on in return).  But of
course in real life situations, cheaters don't hang around to receive
their punishment.  Implicit in the escrow cheating scenario above was
that the agent vanishes.  He isn't forced to stay in business to be
cheated repeatedly by customers until they get even.  He is able to
opt out of the system.  Axelrod's programs don't have that option.

Worse, a pseudonymous cheater has other options which allow him to
continue to benefit from interactions with others while cheating.  He
can use multiple identities to, in effect, wipe the slate clean when
he has cheated.  This plays havoc with the crucial assumption in
applying Axelrod's results of a history.  With multiple pseudonyms
there is no way to know that good-guy pseudonym A is connected with
the nefarious pseudonym B.  In effect, a pseudonym can cheat and not
carry over the record of that cheating into future interactions.

(I know, as I said above, that cheating does have a cost in the form
of lost reputation.  But the costs are not applied in the form they
were in Axelrod's contest, where the results of a bad action are
carried forward more or less forever.  This is a reason why his
results are not applicable to this situation.)

Another difference between real life and Axelrod's situations is the
possibility of bankruptcy, which may result in the death of a
pseudonym.  Axelrod's tournaments were predicated on the implicit
assumption of an indefinite number of interactions.  (This is my
recollection; I'd be interested in whether experiments have been tried
with a known fixed number of interactions, and the agents knowing how
many more there were.)  It had long been recognized (pre-Axelrod) that
the prisoner's dilemma might reach a stable cooperative solution with
multiple interactions, but that this becomes unstable if the parties
know that they are reaching the end of their interaction period.  In
particular, on the last interaction, it is hard to avoid cheating
since one knows that the other player will have no opportunity to
apply punishment.  But then, if it is a foregone conclusion that the
last round will result in cheating, then it is hard to justify not
cheating on the next-to-last round, since the results of the last
round are foreordained and hence don't really provide feedback for
what is done this time.  This leads to a disastrous regress in which
one finds that the stable cooperative solution collapses into a string
of cheating interactions.

Although in real life it will not frequently happen that both parties
know that a particular interaction is the last, it may be that one
party will know.  If a business has suffered reversals and is doing
poorly, it may know that time is running out.  In that case it will be
more likely to cheat and quit while it is ahead of the game.  (This is
a variation on the argument I made above where the escrow agent
changes its policies due to bad circumstances.)  The problem is that
business is, to a certain extent, a random walk.  Most years you make
money, but sometimes there is a run of bad luck and you lose.  If you
ever get down to negative assets, you are basically out of the game.
But in a random walk like this you can show that eventually you will
visit every point on the line, which means that eventually every
business will fail.  This is no great surprise, of course, but it does
represent another way in which Axelrod's results, which presuppose an
indefinitely continued series of interactions, fail to model the
situation we are discussing.

Based on these comments, it would be interesting to consider a
variation of Axelrod's game, one modelled more on what we feel are the
properties of a system of interacting pseudonyms.  We might include
the possiblity for competing programs to "quit" by retiring old
pseudonyms and to create new ones.  We might also simulate bankruptcy
by having a rule that if the cumulative score of an agent ever became
negative, it was out of the game.  It would be interesting to see
whether these changed rules again promoted the development of "nice"
strategies or whether they tipped the balance in favor of cheating.

This might actually be a doable project for an interested programmer.
It would be interesting to see whether others agree that it could shed
light on the problem.

Hal