Information Flow Management in Cryptoeconomics: Antiprevelation in Kleros

Transcript

okay so thanks for coming everyone so my name is william george uh i'm a mathematician and i do research for claros so claros if you're not familiar is a blockchain based dispute resolution platform uh and today i'm gonna be talking about information and the flow of information in crypto economic design and particularly motivated for my research at claro so i hope to hit on some more general themes uh so the first sort of point i want to make uh is that information is like fundamental in the in mechanism design and the structure of of creating a game um so as a way to illustrate this uh there are variants of chess uh where you don't see the pieces of your opponent uh maybe you see them if you can attack them or something there

are a couple different variants like this uh and um like on some level like this is the same game as normal chess like you can make all the same moves you know maybe you have like an arbiter the principle of making an illegal move like the set of all games is exactly the same uh but the fact that you can't see like the information is different fundamentally changes the game like all the strategies are different like what is good play is totally different uh and moreover um what you do impacts the flow of information in the game like you take a piece and you've revealed something about your position like your opponent has learned something um so like if you're you know when as mechanism designers you want to keep in mind when you're trying to like

create like an incentive you know kind of structure to like create equilibria that are good you want to you obviously want to keep this in mind uh and game theorists of course have studied information and perfect information games and program information games common knowledge uh but for us as sort of crypto economic mechanism designers uh an important lesson uh is is how hard this is to control in a decentralized system uh in like a classical world uh you could have some omniscient third party that you trust have all the information and then like people sit in front of their computer and they see different versions of the website from the trusted third party that gives them the information they need and it varies one person to another uh and the information third party can sort of control how much what information people see in blockchain world not so much uh

so like famously um in public blockchains uh it is quite difficult to hide um like transaction histories in in the biggest public blockchains uh the transaction network is sort of public by default uh and people can do transaction analysis to the anatomize people uh so information is sort of leaking information that maybe the mechanism diner wouldn't want to be available is flowing around and sort of a flip side of this is like yeah maybe you have more information than you want floating around but you also can't count on the information to be there uh so there's the data availability problem uh which is a fundamental problem in crypto economic

design as well uh where like sometimes this data can go missing uh so famously um like a good example of this is if you're like a light client that's verifying the consensus protocol for for like ethereum uh and you're going along and you're just checking block headers and then at some point you want to check the contents of a block and you just you can't find the block and it might be because the miner never published the contents of that block and because you were only a light client you just didn't notice or it might just be because it just went missing uh and um so you can't like you can both have information that's like too available and not available enough uh so i'm going to sort of talk about things we've thought about in terms of claros the research we've done on colors

that will hopefully be have touch on some general themes so if you're not familiar claros is as i said a dispute resolution platform uh so like classically what does this look like well imagine alice is a small business owner and she's hired bob to like as a freelancer to build her website and she's not happy with bob's work well you know he puts the payment for bob into an escrow uh and if she's happy with bob's work she gets the website she's like this is great she clicks a button and that releases the money from the oscar when it comes to pop if she's unhappy with bob's work uh then she clicks some other button that says raise a dispute uh and some randomly selected pool of clairo's jurors will judge this dispute and they'll look at the website and

like look at the contract between alice and bob and they'll come to some kind of decision they'll vote and the contract will execute and either give the money back to alice or to bob accordingly uh and this works on a system like a principle called a shelling point this is an idea created by thomas shelling a nobel prize-winning economist uh that in the absence of communication the absence of communication people tend to drift towards sort of focal points or ideas that seem natural common or special or relevant to them so the like classic example of this may be adapted to paris is that if you wanted to meet somebody uh tomorrow you don't know when you don't know where you just know it's in paris like what

would you do well maybe you'd go stand under the eiffel tower at noon why why the eiffel tower well it's kind of a distinguished place people just kind of grab it towards sort of that as like it's you know a place to be you know it stands out uh why noon well it's a distinguished time and then the idea in claros uh is that if you look at the case and you like make your judgment about who's right uh and you're not you know you're not communicating with the other jurors and you think okay i think alice is right in this dispute uh and i think because i think alice is right the other jurors are more likely to think alice is right than not so i imagine the other jurors will probably vote for alice so i'll vote for alex too because i'm incentivized to try to be quite like

coherent with sort of the broad population of jurors and you all vote for alice uh and alice wins uh and um so and so this is live we've had hundreds of disputes uh on a wide variety of cases uh and and important i don't want to delve too deeply into the like the details of claros but an important aspect of this for for the purposes of this talk is we have an appeal mechanism uh so people can appeal they can like in some circumstances they can say i'm happy with this ruling uh and then you go to a bigger pool of jurors uh and you're incentivized to be coherent to like sort of largely agree with what the p the last appeal around says so not your own round but the like people in the future

uh in an ultimate appeal round okay uh so i made the point that the sh this shelling principle seems an absence communication so what happens if somebody just like sort of like shouts out i'm voting for bob you know and they publish their vote and they like they tell everybody they're voting for bob in advance you know even the bob isn't isn't the right answer isn't the honest decision uh what you want to avoid what you wanted to like design the system to be resistant to uh is for the other jurors to look at that and be like well i think else is the right choice but you know he's voting for bob that's one more vote for bob and like you know like maybe that sort of moves his selling point where like maybe now bob is a distinguished choice because somebody's like shouted out that he's

voting for him uh and then like heard behavior happens and everybody goes about that this is this is what you want to avoid uh and um so you know like we want to structure the flow of information uh and a common solution to like problems like this encrypt in blockchain mechanism design uh is what's called commit and reveal where instead of publishing your vote you'll say okay i'm going to like take a random value i'm going to take my vote i'm going to hash them together and publish that hash on the blockchain and then later when it comes time to like a later period like a reveal period everybody's committed i will release my random value or lose my vote the smart contract can check that they hash the same thing uh and uh my vote my votes are counted so

this way nobody sees the votes until everybody's sort of committed to their vote uh so there are a couple of problems with this both technical and sort of cryptographic and also game theoretic that i'll hit on uh and uh so the first one is this like practical so this is kind of like a mild problem but still on like a user interface user experience problem it's something to keep in mind that like with community you have to like you have this two-step process you have to commit and you also have to reveal uh so you know you've committed your vote and like maybe when the reveal period comes you're like computer's off you're on an airplane whatever uh and it comes down to reveal and you're just you're just not there and you get slashed because you didn't review the vote because nobody like you know nobody could ever figure

out what your vote was you're just committed to this like hash value and only you you know your vote and the centralized system you know some omniscient party could just keep all the votes and then reveal them at the appropriate time but that's not possible in a decentralized system uh so that that's unfortunate for these people you know it's not the end of the world because you know like people are responsible for revealing the vote but it's not great um so one way to like leave user experience on this kind of thing uh is to have your device store your vote and then reveal it automatically at a some future time uh so you know nobody knows your vote for you but my phone is an extension of myself uh so like as long as my phone is on maybe it will review my vote for me uh if it's still

not ideal because your phone can be off you know whatever uh so that's like a practical problem something to keep in mind uh one way potentially to like deal with this this practical problem is use something called threshold encryption uh so here the idea is that when i make my vote and i take my random value i will encrypt them under a an encryption key a public encryption key which corresponds to a private key which is sort of like broken into pieces using a secret sharing scheme um and then um maybe the other jurors maybe some third parties have pieces of the key and like no one can see all like assemble the whole key unless they have some kind of threshold and then two out of three signature signatures or whatever uh two uh two out of three key pieces uh um but like once the reveal period

comes everybody like publishes the key pieces as well as the pieces of the vote potentially uh and then the key can be assembled and you can find out how everybody voted uh so this is based on a paper of peterson uh in the early 90s who shows how to set up a system like this without a trusted third party and conveniently this is something that's being developed by another blockchain project called the shutter network uh where they mostly view this as like a way to deal with front-running and like mvv issues uh if you're in like a d5 platform and i have a transaction i want to make and somebody front runs me instead maybe i'll commit to my transaction i'll commit to my like place in an order book or whatever uh and then later my i will reveal it's the same problem but basically in d5

uh and uh but by having a sort of a system like this they have like some decentralized network of key keepers my reveal attraction can can reveal itself um so that like no one can front run me because like they haven't committed you know in time uh so that's one way to handle this sort of problem of votes automatically revealing but this isn't enough uh like just because you have a commit reveal system is like easy to use uh you haven't totally solved the whole problem uh because people also have to be incentivized to not reveal their vote uh so beyond like you know even if you commit and reveal like the dude can still shout out that he's voting for bob you know he can still tell everybody what his vote is going to be and there's not a penalty for that arguably he's incentivized to do it

because people might be influenced to vote like him uh so how do you like you you have like this sort of two-dimensional set of issues that you want to deal with to have a good commitment reveal to have commitment feel that like works well you both want to have technical and cryptographic solutions to make it easy to use and like viable to keep the vote secret uh you know similarly like for tx analysis you know you can have your zk proofs and your links and consumers and mixers here we have our commitment reveal as well as our threshold encryption or whatever but we also want to incentivize people to actually use these things you know for tx analysis you know if your tx if your transactions are like non-profit by default that's like bad game theory and here you know if you don't have like a good

solution for pre-revelation attacks like you know people might still be incentivized to publish their words uh so the main defensiveness in claros is something we call the lone voice of reason jackpot uh so the incentive structure of claros is structured again so that your synthetics because with the ultimate appeal around and you know so these are jurors that might be selected in the future you know you don't even know who they are yet uh so like until you can't communicate with them you know the shelling point idea you can't communicate you know trying to communicate with the other jurors like these people you know nobody knows them so you're trying to you know be coherent with some people in the future uh and uh you know you think you see the dude in the middle votes for bob is like well i think the appeal's going to

vote for alice uh and um you you know you vote for alice and if the appeal does work travis here you're rewarded uh and in fact you're rewarded more based on how the the payouts work uh the fact that that dude in the middle voted for bob means that you will get some part of his like lost deposit for for having voted incorrectly so you're that much more incentivized to double down on the right answer and we can do some statistical tests so first of all like uh in claros uh because of these these issues around pre-revelation uh we've implemented this so that commit reveal is implemented in the contract but it is like a parameter by court so calories cases are divided into courts uh in some courts this is turned on in most it's not uh because we rely on this loan voice of reason

jackpot so in many cases in most cases you can see the votes coming in on block explorers like claros board which was a community created block explorer uh ultimately this would have all been available on easter scott anyway so uh shout out to cokey who developed this community block explorer which makes you know equal access to these votes that someone could have gone from etherscan but also gives like lots of great statistics uh which i will use uh here as i sort of analyze what people are how people are behaving and people are responding to these incentives so you can imagine that if people just voted in random or a random order like they don't look at the votes at all and they just vote in a random order like what happens so if you have like a two to one case where there are two votes for a and one

vote for b like you could have a b a b a b a a and if the votes are really independent of like what's already visible on claro's board these should be equally likely which means there's a one in three chance uh that there'll be one vote for b even after there's a majority of votes for a uh and uh you can look over all cases uh in some like appeal cases where there are more votes you have a like more complicated combinatorial argument we're like okay i have six votes two of them for b one person never voted uh and then i can like figure out the probability that the votes were in a random order uh you know everything's in people are voting independently whatever uh that like one of the probably there'd be two votes for b after the majority for a

one vote for b at the majority of a or zero votes would be up from the majority i can get a probability distribution per case and i can put that all together and i can get a probability distribution for like the number of sort of late incoherent votes at least incoherent with respect to a given appeal round over all cases uh and we've done this and uh for cases 300 to the present so 300 was rough about a year ago uh and it's when claro's board was published there were block explorers before already that used for fireworks cases but this i feel this is like a good representation of sort of modern juror behavior uh and you can see that like the number of per the the number of expected uh late and coherent votes like this is a little larger than the number of

like actual votes but it's not like it's not a huge difference it's not quite statistic so we can't quite statistically significantly even say this in this test that uh people are even you know looking at the votes although they probably are at least some degree it's like a bayesian prior there's probably some degree of looking at the votes uh but like this lone voice of reason at least seems to be like largely incentivizing people to to not overly hurt um and um we can break this down into like sort of sub cases uh where you're like okay like people are incentivized to think about what the appeal is going to do if they expect there to be an appeal maybe they're like like an edge case where they don't expect people to bother

to appeal uh and then you can sort of break this down like how do people behave when they're we don't know when they expect an appeal but we know when there actually is an appeal which should be correlated so we can break this down based on when there is a there's a future appeal when there isn't uh and indeed uh when there is a future appeal uh people as a sort of percentage have more of these late incoherent votes than when there isn't uh although like neither of these has super statistically significant results uh but like already this sort of like information like it gives a sense that this lone voice of reason is a good but imperfect uh defense against superior elevation attacks so what could you do additionally uh to prevent these disincentivized

people from pre-revealing uh well one idea is based on a blog posted by vitalik several years ago even pre-claros on what he called anti-pre-revelation games so here the idea is that you can bet on what other people are going to vote in a shell and game-based system uh you know like and the way it's rigged if you have um if you think that like 80 of people are going to vote for alice and you think this this other person doesn't vote for bob with 90 of the time you have like an edge over the over like the generic voting for alice uh so you gain a small amount and if you like you know like you gain and your expected value is how likely someone is to do something compared to the average uh so if you bet on people randomly everything averages out to zero

although you can still sort of grief people by betting on them by creating like variants uh you know like on any given case they might win or lose but it should average out in the long run uh a similar idea that we're probably going to implement uh in the next version of the claros court uh is uh like an anti-pre-revelation court so this maybe improves a bit these like variants by grab griefing like people and voting like betting on people randomly it's also more native in clarus because we already have a court rather than having to design this extra layer game like in vitalik system uh where if um you somebody pre reveals you can like sue them and you can be like this person pre-revealed

uh and part of their deposit will be subject to being slashed and given to you uh if some claros court rules that they misbehaved by by in particular by revealing uh and why do we need such a complicated system to determine why people pre-reveal well like people people can pre-reveal in like a lot of different ways like you can imagine like a simple system where if just like people's salt is published then you slash them but i don't have to publish my salt my random value in order to pre-reveal maybe i have a zk proof that says i own assault that says i vote a certain way or maybe ask them elaborate smart contract that says okay if i don't vote for alice i'm going to like be i'm going to slash myself or maybe i can do both or maybe have something even weirder uh

and ultimately like it's hard for a smart contract to look at like this diversity of attacks uh and uh slash people appropriately what you need is subjective human being judgment to be able to look at that and be like okay you came up with an elaborate attack but ultimately you're pre-revealing and like this kind of subjective judgment is exactly what claros is capable of doing uh so that gives sort of a sense of what we're going to how we view this problem how what we're going to do in the future uh so just to summarize um like information is fundamental the mechanism and it's particularly challenging in crypto economics because we don't have trusted third parties to just flow manage information flow uh and then for claro specifically

uh you want to avoid hard behavior you want to have disincentivized pre-revolution and incentivize keeping votes hidden and this involves like a sort of mix of practical cryptographic and and game theoretical issues uh that require as diversified a response um so yeah so like i'm hoping i can willing to open up the florida questions if we have time [Applause] well congratulations for the talk

william and when can we see some of this implemented into the close protocol uh soon uh so we've finished the sort of like research for the next version of the cross court the version two of the cart uh and we're like writing the specs now and like coding should begin imminently uh so hopefully you know in months later this year yeah i'm actually the one usually uh giving the microphone i was just curious on uh just in the same way that paris makes it really good to meet at the at the eiffel tower this does sort of have an effect on precedent because there's not a reveal but nonetheless people would have a sense of what the precedent is and which we'll have the

i just was curious on your thoughts will have the effect of like maintaining and actually accelerating that precedent but is not really effective at changing precedent and moving in a different direction if that's a more justice oriented outcome so just curious on your thought and how you might use these models to sort of overcome that justice issue yeah so that's that's another element of the information that's flowing around at the president from previous rulings uh so a priori unless you have some like fairly complicated system where like rulings stay hidden which even that's hard to enforce because parties can always just reveal them uh like that is also information that's flowing around uh so you know people like sometimes ask us in fact there was a question in a talk earlier today like is claro's you know it's a justice protocol like how do you feel about

common law versus civil law like what what is like what is the role of precedent in your system and my view is that precedent has sort of an inevitable role in the shelling game system that people will look at the previous cases and they're trying to be coherent with how the current jurors are going to decide uh so like ultimately they're going to gain you know insights from previous cases and they're going to be influenced by those uh and if you feel the previous cases are you know just like in a common law system uh and if you feel that like the previous cases were doing poorly like the jurors are given like sets of policies to read depends on the arbitable app that's like asking for the ruling you know alice and bob's freelancer dispute the house about that contract uh that the jurors see

and like consider when they're when they're making the ruling uh other applications you know we have curated lists that are plugged into clarus have some kind of policy for like what things should be on the list uh and if the presidents are protruding producing bad rulings then like the sort of natural thing to do is similar to what you do in common law legal systems when the judges are creating bad precedent-based rulings is you legislate you amend the policy uh and you know you change sort of the what jurors are supposed to think about thanks uh would there be a special pool for um i mean a special court for the uh people who are um saying this guy has revealed some stuff yeah so we anticipate having a special

court uh for like sort of general juror miss behavior uh which includes being able to like cases where people are accused of prevailing uh whether they'll be judged for having you know violated their policy on not pre-revealing their vote uh when when they commit and reveal their vote uh this could also potentially be used for others like to selection for other sort of jurors behavior when they violate sort of the policies of what it means to be juror uh like there's like evidence that they like clued uh they could also you know like that could also be in the policies but yeah there'll be a new court for this um how do you do will you avoid like a majority of uh bad people being pulled off this court and like uh saying no my friend didn't

uh pray with this information yeah well i mean the cases are always appealable so i mean like you know you can appeal more to larger and larger pools of jurors eventually you appeal out of that court to the general court uh and that kind of attack would only really be successful if it was able to command like you know a 51 percent attack system a majority of the system that was willing to make this sort of incorrect ruling just like any other 51 attack on clause if you say for who you vote like that's a crime i know in other places but it's just a comment you know because i guess for a reason

similar to this right yeah um and like here you know once you have the sort of anti-revelation card you know it's a crime when this incident can be slashed uh limited to the fact that like it's you know your vote has to say hidden is during the the commit period uh like because jurors are given incentives it's like rewarded penalized based on how they devote ultimately after the case if you can see the like if you see the flow of money going to people based on their their rewards then you can't keep it hidden indefinitely uh but you can at least keep it hidden as long as you need to prevent influencing other people's votes [Applause]

thanks very cool i was just curious