A Qualitative Comparison of the Suitability of Four Theorem Provers for Basic Auction Theory

Novel auction schemes are constantly being designed. Their design has significant consequences for the allocation of goods and the revenues generated. But how to tell whether a new design has the desired properties, such as efficiency, i.e. allocating goods to those bidders who value them most? We say: by formal, machine-checked proofs. We investigated the suitability of the Isabelle, Theorema, Mizar, and Hets/CASL/ TPTP theorem provers for reproducing a key result of auction theory: Vickrey’s 1961 theorem on the properties of second-price auctions. Based on our formalisation experience, taking an auction designer’s perspective, we give recommendations on what system to use for formalising auctions, and outline further steps towards a complete auction theory toolbox. 1 Motivation: Why Formalise Auction Theory? Auctions are a widely used mechanism for allocating goods and services7, perhaps second in importance only to markets. They are used to allocate electromagnetic spectrum, airplane landing slots, oil fields, bankrupt firms, works of art, eBay items, and to establish exchange rates, treasury bill yields, and stock exchange opening prices. Novel auction schemes are constantly being designed, aiming to maximise the auctioneer’s revenue, foster competition in subsequent markets, and to efficiently allocate resources. Auction design can have significant consequences. Klemperer attributed the low revenues gained in some government auctions of the 3G radio spectrum in ? This work has been supported by EPSRC grant EP/J007498/1. We would like to thank Peter Cramton and Elizabeth Baldwin for sharing their auction designer’s point, and Christian Maeder for his recent improvements to Hets. 7 For the US, the National Auctioneers Association reported $268.5 billion for 2008 [2]. 2000 (€20 per capita vs. €600 in other countries) to bad design [18]. Design practice outstrips theory, especially for complex modern auctions such as combinatorial ones, which accept bids on subsets of items (e.g. collections of spectrum). Designing a revenue-maximising auction is NP-complete [6] even with a single bidder. Important auctions often run ‘in the wild’ with few formal results [19]. We aim at convincing auction designers that investing into formalisation pays off with machine-checked proofs and a deeper understanding of the theory. To this end, we want to provide them with a toolbox of basic auction theory formalisations, on top of which they can formalise and verify their own auction designs – which typically combine standard building blocks, e.g. an ascending auction converting to a sealed-bid auction when the number of remaining bidders equals the number of items available. Given the ubiquity of specialist support across a range of service sectors, we conjecture that auction designers might be supported by formalisation experts, creating a niche for specially trained experts at the interface of the core mechanised reasoning community and auction designers. Our ForMaRE project (formal mathematical reasoning in economics [22]) seeks to increase confidence in economics’ theoretical results, to aid in discovering new results, and to foster interest in formal methods within economics. To formal methods, we seek to contribute new challenge problems and user experience feedback from new audiences. Auctions are representative of practically relevant fields of economics that have hardly been formalised so far.8 Economics has been formalised before [15], particularly social choice theory (cf. §5 and [10]) and game theory (cf. [37] and our own work [16]). However, none of these formalisations involved economists. Formalising (mathematical) theories and applying mechanised reasoning tools remain novel to economics.9 §2 establishes requirements for the Auction Theory Toolbox (ATT); §3 explains our approach to building it. §4 is our main contribution: a qualitative comparison of how well four different theorem provers satisfy our requirements. §5 reviews related work, and §6 concludes and provides an outlook. 2 Requirements for an Auction Theory Toolbox Conversations with auction designers established ATT requirements as follows: D1 Formalise ready-to-use basic auction concepts, including their definitions and essential properties. D2 Allow for extension and application to custom-designed auctions without requiring expert knowledge of the underlying mechanised reasoning system. From a computer scientist’s technical perspective, these translate to: 8 Even code verification is typically not considered, although Leese, who worked on the UK’s spectrum auctions, has called for auction software to be added to the Verified Software Repository at http://vsr.sourceforge.net [47]. 9 There is a field ‘computational economics’; however, it is mainly concerned with the numerical computation of solutions or simulations (cf., e.g., [13]). C1 Identify the right language to formalise auction theory. This language should (a) be sufficiently expressive for concisely capturing complex concepts, while supporting efficient proofs for the majority of problems, (b) be learnable for economists used to mathematical textbook notation, and (c) provide libraries of the mathematical foundations underlying auctions. C2 Identify a mechanised reasoning system (a) that assists with cost-effective development of formalisations, (b) that facilitates reuse of formalisations already existing in the toolbox, (c) that creates comprehensible output to help users understand, e.g., why a proof attempt failed, or what knowledge was used in proving a goal, and (d) whose community is supportive towards users with little specific technical and theoretical background. Note the conflicts of interest: a single language might not meet requirement C1a, and if it did, it might not be supported by a user-friendly system. 3 Approach to Building the Auction Theory Toolbox To avoid a chicken-and-egg problem, we identify relevant domain problems in parallel to identifying languages and systems suitable for formalisation. 3.1 The Domain Problem: Vickrey’s Theorem and Beyond We started with Vickrey’s 1961 theorem on the properties of second-price auctions of a single, indivisible good, whose bidders’ private values are not publicly known. Each participant submits a sealed bid; one of the highest bidders wins, and pays the highest remaining bid; the losers pay nothing. Vickrey proved that ‘truth-telling’ – submitting a bid equal to one’s actual valuation of the good – was a weakly dominant strategy, i.e. that no bidder can do strictly better by bidding above or below its valuation whatever the other bidders do. Thus, the auction is also efficient, allocating the item to the bidder with the highest valuation. Bidders only have to know their own valuations; in particular they need no information about others’ valuations or the distributions these are drawn from. As variants of Vickrey auctions are widely used (e.g. by eBay, Google and Yahoo! [45]), this formalisation will enable us to prove properties of contemporary auctions as well. The underlying theory is straightforward to understand even for non-economists and can be formalised with reasonable effort. Finally, formalising Vickrey provides a good introduction for domain experts to mechanised reasoning technology by serving as a small, self-contained showcase of a widely known result, helping to build trust in this new technology. Maskin collected 13 theorems, including Vickrey’s, in a review [24] of an influential auction theory textbook [25]. This sets the roadmap for building the ATT – a collaborative effort, to which we welcome community contributions [23]. 3.2 Paper Elaboration to Prepare the Machine Formalisation To prepare the machine formalisation, we refined the original paper source, aware that current mechanised reasoning systems typically require much more explicit statements than commonly found on paper: automated provers must find proofs without running out of search space, whereas proof checkers require proofs at a certain level of detail, which in turn requires detailed statements. Maskin states Vickrey’s theorem in two sentences and proves it in another six sentences [24, Proposition 1].10 Our elaboration uses eight definitions specific to the domain problem plus an auxiliary one about maximum components of vectors, as follows: N = {1, . . . , n} is a set of participants, often indexed by i. An allocation is a vector x ∈ {0, 1} where xi = 1 denotes participant i’s award of the indivisible good to be auctioned (i.e. ‘i wins’), and xj = 0 otherwise. An outcome (x, p) specifies an allocation and a vector of payments, p ∈ R, made by each participant i. Participant i’s payoff is ui ≡ vixi − pi, where vi ∈ R+ is i’s valuation of the good. A strategy profile is a vector b ∈ R, where bi ≥ 0 is called i’s bid.11 For an n-vector y = (y1, . . . , yn) ∈ R, let y ≡ maxj∈N yj and y−i ≡ maxj∈N\{i} yj . Definition 1 (Second-Price Auction). Given M ≡ { i ∈ N : bi = b } , a secondprice auction is an outcome (x, p) satisfying: 1. ∀j ∈ N\M, xj = pj = 0; and 2. for one12 i ∈M , xi = 1 and pi = b−i, while, ∀j ∈M\ {i} , xj = pj = 0. Definition 2 (Efficiency). An efficient auction maximises ∑ i∈N vixi for a given v, i.e., for a single good, xi = 1⇒ vi = v. Definition 3 (Weakly Dominant Strategy). Given some auction, a strategy profile b supports an equilibrium in weakly dominant strategies if, for each i ∈ N and any b̂ ∈ R with b̂i 6= bi, ui ( b̂1, . . . , b̂i−1, bi, b̂i+1, . . . , b̂n ) ≥ ui (