%20-%20https://sketch.com%20--%3e%3ctitle%3e3ECBBF50-FD08-412A-943D-2CFC5E025A16%3c/title%3e%3cdesc%3eCreated%20with%20sketchtool.%3c/desc%3e%3cg%20id='Stylesheet'%20stroke='none'%20stroke-width='1'%20fill='none'%20fill-rule='evenodd'%3e%3cg%20transform='translate(-926.000000,%20-668.000000)'%20id='BUTTONS'%3e%3cg%20transform='translate(100.000000,%20597.000000)'%3e%3cg%20id='BTN-/-RIGHTS'%20transform='translate(816.000000,%2065.000000)'%3e%3cg%20id='ICON-/-Rights'%20transform='translate(10.000000,%206.000000)'%3e%3cpath%20d='M13.5752841,0%20L1.34943182,0%20C0.59375,0%200,0.586666667%200,1.33333333%20L0,22.6666667%20C0,23.4133333%200.620738636,24%201.34943182,24%20L17.6505682,24%20C18.40625,24%2019,23.3866667%2019,22.6666667%20L19,5.36%20L13.5752841,0%20Z%20M13.5752841,1.89333333%20L17.0838068,5.36%20L13.5752841,5.36%20L13.5752841,1.89333333%20Z%20M1.34943182,22.6666667%20L1.34943182,1.33333333%20L12.1988636,1.33333333%20L12.1988636,5.36%20C12.1988636,6.10666667%2012.7926136,6.69333333%2013.5482955,6.69333333%20L17.6235795,6.69333333%20L17.6505682,22.6666667%20L1.34943182,22.6666667%20Z'%20id='Shape'%20fill='%23595959'%20fill-rule='nonzero'%3e%3c/path%3e%3ccircle%20id='Oval'%20stroke='%23595959'%20stroke-width='1.5'%20fill='%23595959'%20cx='9.5'%20cy='13.5355339'%20r='5.5'%3e%3c/circle%3e%3cpolyline%20id='Path-2'%20stroke='%23FFFFFF'%20stroke-width='1.5'%20transform='translate(9.500000,%2013.035534)%20rotate(45.000000)%20translate(-9.500000,%20-13.035534)%20'%20points='8%2016.0355339%2011%2016.0355339%2011%2010.0355339'%3e%3c/polyline%3e%3c/g%3e%3c/g%3e%3c/g%3e%3c/g%3e%3c/g%3e%3c/svg%3e)
In many settings, strategic adversaries—be they political parties, lobbies, armies, or firms—have to decide how to allocate limited resources across multiple fronts. The more an actor devotes to one front, the more likely it is to prevail on that front. However, an actor's overall payoff depends on how well it does on all of the fronts. For example, political parties may compete for electoral support by offering transfers, bribes, or pork to voters or districts which in turn support the party offering the highest payment (Groseclose and Snyder 1996; Laslier and Picard 2002; Myerson 1993; Snyder 1989). Competing firms have to decide how to allocate limited R&D budgets among various projects. Or opposing armed forces have to decide how much to devote to each battlefield where the probability of winning on that battlefield depends on the relative forces committed to that front (Luce and Raiffa 1957; Shubik 1982; Shubik and Weber 1981).
Such allocation problems have long been studied in the context of Colonel Blotto games and, more recently, as all-pay auctions. In these static games, the two adversaries make their allocation decisions simultaneously or secretly. Thus neither player can condition its own allocation on the other player's allocation.1
Early work on Blotto games includes Borel 1921, Tukey 1949, and Blackett 1958. More recent contributions are Golman and Page 2006 and Roberson 2006. See Kvasov 2006 on all-pay auctions.
However, some allocation problems are sequential. One side has to allocate its resources first and the other gets to respond to that allocation. For example, two vote-buyers (e.g., lobbies) with opposing policy preferences make sequential bids for legislators' votes in Groseclose and Snyder's (1996) and Morgan and Vardy's (2007) studies of vote-buying and super-majorities. More generally, defenders often have to decide how to allocate some or all of their resources, and an attacker then chooses where to strike after observing (perhaps imperfectly) what the defender has done. Frequently, one or both adversaries will also have private information about the effectiveness of their spending on different fronts. In particular, defenders are likely to have private information about the relative vulnerabilities of the things they are trying to protect.
For instance, the United States undertook a massive effort to secure its critical infrastructure and key assets following the attacks of September 11, 2001, with the federal government alone now spending about $20 billion dollars a year on infrastructure protection.2
See Moteff 2006 for an overview of these programs.
Private information about vulnerabilities creates a dilemma for the defender. On the one hand, the defender might be tempted to invest the resources needed to harden a very vulnerable site and thereby reduce the expected losses should that site be attacked. On the other hand, the defender's efforts to protect a site might signal to an attacker that the site is relatively more vulnerable and thereby make an attack on that site more likely.
This paper models this dilemma as a signaling game in which a defender has to decide how to divide its resources between two sites. An attacker sees this allocation and then decides which site to strike. The more the defender spends on a site, the lower its expected losses if that site is hit. Because the defender has private information about the vulnerability of one of the sites, it must also be concerned about what the attacker will infer about the sites' relative vulnerability from the defender's allocation.
An equilibrium of this game is fully separating if each level of vulnerability leads the defender to make a different allocation. Because each observable allocation is associated with a unique underlying level of vulnerability in this kind of equilibrium, the attacker can infer the level of vulnerability from the defender's allocation and then strike the site that offers the highest expected payoff. In a sense, vulnerability concerns swamp secrecy concerns in a separating equilibrium in that the defender reveals the level of vulnerability in order to allocate the resources needed to deal with that level of vulnerability optimally.
In a pooling equilibrium, by contrast, the defender divides its resources between the two sites in the same way, regardless of what it knows about their relative vulnerability. The attacker now cannot infer anything about the sites' relative vulnerability when it sees this allocation. Secrecy concerns in this type of equilibrium swamp vulnerability concerns in that the defender's optimal strategy is to reveal nothing about the level vulnerability.
In a semiseparating equilibrium, the defender's allocation varies to some degree with the level of vulnerability. The attacker is able to infer something about the relative vulnerability of the two sites but cannot infer the exact level of relative vulnerability (as it does in a separating equilibrium). In a semiseparating equilibrium, neither vulnerability nor secrecy concerns dominate the other. The defender reveals some information about the level of vulnerability in order to partially address the vulnerability issue, but the defender does not reveal the exact level of vulnerability.
The following analysis shows that secrecy concerns generally swamp vulnerability concerns when more vulnerable sites are harder to protect on the margin. The defender pools on the allocation that is optimal with respect to an “average” vulnerability. This allocation spends less on high-vulnerability sites and more on low-vulnerability sites than the defender would spend on them if signaling were of no concern. Nevertheless, uncertainty makes the defender better off regardless of the actual level of vulnerability. As the average level of vulnerability of a site increases, the defender devotes more to protecting that site.
The next section specifies the model and summarizes the equilibria when the level of vulnerability is common knowledge. The subsequent section characterizes the equilibria when the defender has private information about the relative vulnerability of the two sites, and more vulnerable sites are also harder to protect on the margin. A final section discusses the opposite case when more vulnerable sites are easier to protect on the margin. This section shows by example that separating equilibria sometimes exist in these circumstances and explains why separation is sensitive to the effect that the level of vulnerability has on the marginal benefits of spending more.
THE COMPLETE INFORMATION MODEL AND EQUILIBRIA
A simplified version of Powell's (2007b) resource-allocation game provides a point of departure. As illustrated in Figure 1, the defender begins the game by deciding how to divide R resources between the two sites it is trying to protect. That is, the defender chooses an
where r and R−r are the resources allocated to sites 1 and 2, respectively. After observing r, the attacker decides which site to strike.
The Signaling Game
Spending more on a site reduces the chances of a successful attack but with declining effect. Formally, let δ2(r) be the probability that an attack on site 2 succeeds if the defender spends r. Then
and
. The probability that an attack on site 1 succeeds depends both on the resources allocated to that site and on the inherent vulnerability v of the site. Let δ1(r, v) denote this probability, where ∂δ1/∂r<0 and ∂2δ1/∂r2>0. The more vulnerable site 1 (the larger v), the more resources the defender has to devote to that site to reduce the probability of a successful attack to a given level: ∂δ1/∂v>0.
The defender suffers a loss of one if site 1 is destroyed and a loss of A>0 if site 2 is destroyed. Thus, the defender's expected loss if it allocates r to site 1 and the attacker hits that site with probability α is L(r, α)=αδ1(r, v)+(1−α)Aδ2(R−r). As for the attacker's payoff, the game is assumed to be zero sum, so the defender's losses are the attacker's gains. The attacker receives one if it successfully strikes site 1 and A if it destroys site 2. If the defender allocates r to site 1 and the attacker strikes this site with probability α, the attacker's expected payoff is L(r, α). In the complete-information model, v along with all of the other parameters of the model are common knowledge.
As will be seen, whether secrecy or vulnerability concerns dominate the defender's allocation strategy depends on the way that higher levels of vulnerability affect the marginal return to allocating additional resources to that site. The analysis begins with the assumption that more vulnerable sites are weakly harder to protect on the margin. That is, the more vulnerable a site (larger v), the less effect additional spending has on reducing that sites' vulnerability. (The implications of the opposite assumption will be examined below.) Formally:
Assumption 1
(More vulnerable sites are harder to defend on the margin): ∂2δ1/δvδr≥0. 3
This is suggestive of the standard, single-crossing assumption in signaling games, which ensures that different types' indifference curves only cross once. But the suggestion is misleading. Each of v's indifference curves generally crosses
's at least twice regardless of the sign of ∂2δ1/δvδr.
To trace some of the implications of this assumption, suppose that the defender were concerned about the risk of an accident rather than a deliberate attack. If the probabilities of an accident at sites 1 and 2 are a1 and a2 with a1 independent of the level of vulnerability of the site, then the defender's expected loss to allocating r to site 1 is a1δ1(r, v)+a2Aδ2(R−r). The optimal allocation r*(v) satisfies the first-order condition by equating the marginal gains to additional spending at each site; that is, r*(v) satisfies
.
If more vulnerable sites are harder to protect on the margin, the marginal returns to investing in site 1 decrease as v increases. As a result, the defender shifts resources away from site 1 and to site 2 where the marginal returns are higher:
is decreasing in v. If more vulnerable sites are easier to protect on the margin (∂2δ1/δvδr<0), the return to defending site 1 rises with v and the defender spends more. That is, r*(v) increases in v. 4
Differentiating the first-order condition yields dr*/dv=−a1(∂2δ1/
. So the sign of dr*/dv is the opposite of the sign of ∂2δ1/∂r∂v.
The defender's equilibrium allocation in the complete-information game is unique. Let
be the allocation that equalizes the attacker's payoffs to striking sites 1 and 2 when the level of vulnerability is v; that is,
uniquely satisfies δ1(r, v)=Aδ2(R−r).5
The expected payoff δ1(r, v) is strictly decreasing in r, and Aδ2(R−r) is strictly increasing. So a unique r solves δ1(r, v)=Aδ2(R−r) for any value of v.
is the allocation that minimizes the maximum payoff the attacker can obtain after observing r. Formally,
solves
, Aδ2(R−r)}, and is what the defender does in any subgame perfect equilibrium.
Minmaxing the Attacker
To establish that the only equilibrium allocation is
, observe that the defender can profitably deviate from any
. Assume, first, that
. Then the defender is spending too little on site 1 in that the attacker's payoff to striking that site is greater than that of striking site 2: δ1(r, v)>Aδ2(R−r). The attacker therefore hits site 1, which leaves the defender with an expected loss of δ1(r, v) whenever
. Hence, the defender can profitably deviate to any r′ between r and
because δ1(r, v)>δ1(r′, v) for all
as the defender's expected loss is decreasing in r.
Conversely, the defender is spending too much on site 1 when
and, as a result, makes site 2 the more attractive target. That is, Aδ2(R−r)>δ1(r, v) when
. The attacker consequently strikes site 2 whenever
, leaving the defender with an expected loss of Aδ2(R−r). Now the defender can profitably deviate from r to any r′ between and
and r.
Thus, the only possible equilibrium allocation is
, and it is easy to verify that the following are equilibria of the complete information game: the defender allocates
to site 1; the attacker hits site 1 if
; site 2 if
; and strikes site 1 with any probability
if
. More formally,
Proposition 1
Subgame perfect equilibria of the complete-information game exist, and the defender's allocation is the same in all of them. This allocation,
, minmaxes the attacker; that is,
is the unique solution to
.6
Powell (2007a) proves this result. He also shows the defender's minmaxing the attacker remains the unique equilibrium allocation even if the game is non-zero sum and regardless of whether the attacker can observe the defender's allocation before deciding which site to attack.
A direct implication of Proposition 1 is that the more vulnerable site 1 is; that is, the larger v, the more the defender allocates to it. Figure 3 illustrates the point. If v′>v, then
. Formally, implicit differentiation of
yields
. Hence,
The Minmaxing Allocation Is Increasing in v
Corollary 1
The more vulnerable site 1, the more the defender allocates to that site when there is complete information about vulnerability
.
Corollary 1 highlights the difference between protecting against strategic threats and protecting against accidents. As noted earlier, the optimal allocation against a stochastic, nonstrategic threat equates the marginal benefits of additional spending at each of the two sites. This implies that the optimal level of spending r*(v) is increasing in v if ∂2δ1/∂v∂r>0 and decreasing if ∂2δ1/∂v∂r>0. By contrast, the optimal allocation against a strategic threat
is always increasing in v. The reason why is that the defender equates levels when defending against a strategic threat by making the attacker indifferent between striking sites 1 and 2, whereas the defender equates margins when defending against stochastic, nonstrategic threats.
PRIVATE INFORMATION ABOUT VULNERABILITY
To formalize the tradeoff between hardening a very vulnerable site and calling attention to the vulnerability of that site, suppose the defender knows the vulnerability v of site 1 but the attacker does not. Uncertain of the exact level of vulnerability, the attacker believes that v is distributed over
according to the cumulative distribution G which has a strictly positive density over
. G is common knowledge.7
In the present analysis, the defender has private information about the sites' relative vulnerability, but the actors' preferences are common knowledge. Bier, Oliveros, and Samuelson (2005) and Powell (2007b) consider the allocation problem when the defender is unsure of the attacker's payoffs. Analyzing situations in which a defender has private information about vulnerability and is unsure of the attacker's payoffs is open issue for future research.
Assume further that if the defender invests everything in site 1, the attacker prefers to strike site 2 regardless of the value of v. Formally,
. Similarly, the attacker prefers hitting site 1 if the defender allocates all of its resources to site 2:
. These restrictions ensure that the defender faces a real allocation decision and that the equilibrium is not simply to allocate everything to one site in the knowledge that the attacker will strike that site.
The defender and attacker are playing a signaling game in which the defender's allocation may reveal information to the attacker about the relative vulnerability of the two sites. Suppose, for example, that the defender knows that site 1 is very vulnerable (v is high). On the one hand, the high level of vulnerability of site 1 inclines the defender to spend more on that site in order to reduce the expected loss if that site is attacked. On the other hand, spending more on site 1 may signal that that site is quite vulnerable and thereby make an attack on it more likely. The equilibria of the signaling game formalize the resolution of this tradeoff.
To simplify matters, the model assumes that the attacker can perfectly observe the defender's allocation r. A more realistic assumption would be that the attacker imperfectly observes r. If, for example, the defender allocates r to site 1, the attacker might observe or detect signs s that lead it to believe that the allocation is r=s+ε, where ε is an “observation error” distributed according to some mean-zero probability distribution F. Although more realistic, such a model would be much harder to analyze.
If, at the extreme, the attacker is unable to observe r or anything correlated with it, signaling is clearly no longer a concern. The game is now static, and the restrictions above ensuring that the defender faces a meaningful allocation problem imply that the attacker must mix in equilibrium, that is, attack site 1 with a probability α* strictly between zero and one.8
To see that the attacker must randomize between hitting sites 1 and 2, suppose the attacker strikes site 1 for sure, α*=1. Then v 's best reply is to allocate everything to that site. This leaves the atacker with an expected payoff of
. But this is less than the payoff to going after site 2:
where the second inequality follows from the assumption that
. This contradiction ensures α*<1, and a similar argument shows α*>0.
.9
Convexity ensures that v's best response is unique. To pin down the equilibrium value of α*, note that the attacker must be indifferent between hitting sites 1 and 2 because it is mixing. Hence,
. Implicit differentiation of the first-order condition defining ρ* yields ∂ρ*/∂α*>0. Consequently, the integral on the left of the previous equality is decreasing in α*, and the integral on the right is increasing. The equilibrium value of α* is the unique value at which equality holds. Powell (2006) explicitly solves for α* in the separable case in which ∂2δ1/∂r∂v=0.
The remainder of this section characterizes the equilibria of the signaling game and shows that secrecy concerns generally swamp vulnerability concerns. The defender pools on a single allocation. This allocation is optimal with respect to an “average” vulnerability. But it devotes less to high-vulnerability sites and more to low-vulnerability sites than the defender would spend on them if signaling were of no concern.
Formally, a pure strategy for the defender specifies the defender's allocation as a function of its private information about the vulnerability:
.10
Only strategy profiles and equilibria in which the defender plays a pure strategy are considered.
. As for what the attacker believes about the vulnerability of site 1 after seeing a given allocation to that site, let M be the set of probability distributions over
and let μ(v | r)∈M for all
denote the attacker's beliefs about v after observing allocation r. Then, a perfect Bayesian equilibrium (PBE) is a strategy profile (ρ, α) and system of beliefs μ, such that (i) the defender can never profitably deviate from ρ(v) given the attacker's strategy α(r); (ii) α(r) maximizes the attacker's payoff against r given μ(v | r); and (iii) μ(v | r) is derived from G and r via Bayes' rule.11
\label{support copy(3)}Defining PBE's with a continuum of types also raises an additional technical issue. Consider, for example, a separating equilibrium in which each v makes a distinct allocation. With a continuum of types, the prior probability of any one type is zero, so Bayes' rule places no restriction on the attacker's beliefs following any allocation. Bayes' rule does not require the attacker to believe it is facing the one type who was to make this allocation in equilibrium. To finesse this issue, assume that if the nonempty set of types allocating r′ to site 1 has zero measure, then the support of the attacker's beliefs following r′ must be contained in the closure of {v:ρ(v)=r′}. See Ramey 1996 for a definition of a sequential or perfect Bayesian equilibrium with a continuum of types.
Two lemmas help characterize the equilibria. Recall that
equalizes the attacker's payoff to striking the two sites if the level of vulnerability is v. That is,
satisfies
. Because the game is zero sum, this allocation also equalizes the defender's expected losses to an attack on sites 1 and 2. Lemma 1 ensures that v's equilibrium loss is no more than
, which v can guarantee itself by devoting
to site 1.
Lemma 1
Let the allocation
be defined by
. Then type v's loss in any PBE is no more than its loss to allocating
to site 1 which is
.
Proof
Trivially, v can always allocate
to site 1, which brings an expected loss of
. Hence, v's equilibrium loss can be no greater than
.
Lemma 2 shows that if v′ separates; that is, no other v′′ allocates ρ(v′), then v′ must be spending
on site 1 and, as a result, suffers a loss of
. As Proposition 1 shows,
is also what the defender would allocate to site 1 if there were no uncertainty about the level of vulnerability. Lemma 2 thus demonstrates that if the defender foregoes all of the benefits of secrecy by acting in a way that fully discloses the vulnerability of site 1, then the defender allocates its resources optimally with respect to the vulnerability issue. That is, the defender allocates its resources exactly as it would have had site 1's vulnerability been common knowledge at the outset.
Lemma 2
Let {ρ(v), α(r), μ} be any PBE in which v′ separates; that is, v′ alone offers ρ(v′). Then ρ(v′)=
.
Proof
Arguing by contradiction, suppose v′ allocates
. Because v′ separates, the attacker infers it is facing v′ after observing r′. Given this inference and r′, the attacker strictly prefers attacking site 2. That is,
implies
. Hence, the attacker strikes site 2, leaving v′ with an expected loss of Aδ2(R−r′). But, as Lemma 1 shows, v′ can always obtain an expected loss of
by playing
, and
implies that this loss is less than Aδ2(R−r′). This contradiction ensures that v′ never separates with an allocation greater than
. A similar argument shows that if
, then the attacker hits site 1 after observing r′ and v′ could once more profitably deviate to
. Thus v′ must offer
if it separates.
Propositions 2 and 3 show that secrecy concerns swamp vulnerability concerns in that the defender generally pools in equilibrium. All v allocate r* to site 1 where r* uniquely satisfies ∫δ1(r*, v)dG=Aδ2(R−v*). In effect, the defender plays as if it were common knowledge that the level vulnerability was the “average”
.
Because the defender pools on the same allocation regardless of the actual level of v, the attacker cannot infer anything about v after observing the defender's allocation of
. But not revealing anything about v comes at a cost. The defender is not allocating its resources to deal with the vulnerability issue in the optimal way. As Proposition 1 shows, v would allocate
were the level of vulnerability common knowledge and signaling not an issue. Signaling concerns therefore lead the defender to reduce its spending on high-vulnerability sites (v>v*) from
to
. Conversely, signaling concerns lead the defender to spend more on low-vulnerability sites than it otherwise would (i.e.,
if v<v*).
To gain some intuition for the forces undermining separation, suppose an interval of types between v′ and v′′ did separate, that is, v∈(v′, v″) separate. Lemma 1 implies that each v allocates
to site 1. Assume further that the attacker strikes site 1 with probability
after observing allocation
for some
.
This probability cannot be too small if higher vulnerability types (
) are to be deterred from mimicking
by allocating
to site 1. If, that is,
is too small, then higher vulnerability types will want to “buy” the much lower probability of attack
on the more vulnerable site 1 in return for the cost of allocating somewhat less to that site, that is,
rather than
. Conversely, the probability that the attacker strikes site 1 cannot be too high if lower vulnerability types (
) are to be deterred from deviating to
. If
is too high, then lower vulnerability types will want to buy the correspondingly lower probability of attack on the relatively more vulnerable site 2. Hence, higher values of
discourage higher vulnerability types from deviating but encourage lower vulnerability types to deviate and vice-versa. As show formally below, a unique
deters types arbitrarily close to
from deviating to
.
If this value of
also deters types farther away from
from wanting to deviate to
, separation may be possible. But when more vulnerable sites are harder to defend on the margin, types farther away from
will want to deviate and separation breaks down. This leaves:
Proposition 2
No open interval of types (v′, v′′) separate and hence no separating equilibria exist.
Proof
See the Appendix.
Now define a strategy to be simple if whenever v′ and v′′ allocate the same amount to site 1, all types between v′ and v′′ also allocate that amount to site 1.
Definition 1
An allocation strategy ρ(v) is simple if ρ(v)=ρ(v′) for all v∈(v′, v′′) whenever ρ(v′)=ρ(v′′).
Simplicity is weaker than monotonicity. The strategy ρ(v) is monotonic if ρ is either weakly increasing or decreasing in v. A monotonic strategy is therefore simple, but a simple strategy may not be monotonic. For example, ρ(v)=r for
, ρ(v)=r−ε for v∈(v′, v′′), and
for
is simple but not monotonic.
A semiseparating equilibrium using a simple strategy is a set of cut points
, a set of allocations such that all types between adjacent cut points pool on the same allocation and no type outside this interval allocates that amount to site 1, and there are at least two distinct allocations. Proposition 3 shows that no such equilibria exist.12
It appears that there are no semiseparating equilibria even if the defender does not use a simple strategy, but I\ have only been able to show this in three cases. Each of these cases implies that the difference between v's loss to playing r′ and r with r′>r is single peaked in v (or flat if ∂2δ1/∂r∂v=0). That is, there is a
such that
for
\ and
for
. This means that the gains from playing r′ rather than r increase in the distance between v and
, and this ensures that even partial separation breaks down. The three cases are (i) ∂2δ1/∂r∂v=0, (ii) ∂2δ1/∂v2≤0 and
, and (iii)
when r′>r.
Proposition 3
If the defender uses a simple strategy, there are no semiseparating equilibria. \end{proposition
Proof
See the Appendix.
Security concerns therefore swamp vulnerability concerns in that the defender must pool on a common allocation. Moreover, all pooling equilibria have the same equilibrium path. To see why, observe that pooling implies that the attacker uses a mixed strategy, that is, strikes site 1 with a probability strictly between zero and one. To establish this, suppose the defender pools on
.13
The proof of Proposition 4 shows that the defender's equilibrium allocation always lies in this range.
(i.e., if
), then Lemma 1 guarantees that any v such that
can profitably deviate by allocating the larger amount
to site 1. Formally, the allocation
brings
. But
implies
where, recall, these are losses so lower is better. Hence, v can profitably deviate to
, and this contradiction implies
.
If the attacker is sure to hit site 2 after seeing
(
), any v for which
can profitably deviate by allocating less to site 1, namely,
rather than
, and consequently more to site 2. That is,
implies
. This second contradiction along with the first ensures that the attacker mixes after observing
:
.
Because the attacker mixes, it must be indifferent between going after site 1 and going after site 2. Pooling also means that the attacker's posterior beliefs are unchanged from its prior beliefs. These facts imply
. A unique
satisfies this condition as the expression on the right is increasing in
and the expression on the left is decreasing.14
Existence is assured because
and
.
.
As for the equilibrium probability of attack, pooling on r* means that the v close to v* must not be able to profitably deviate from
to
. A single α(r*) does this and is given by
, where
and, clearly, 0<Φ(v)<1.
All of this leaves:
Proposition 4
Pooling perfect Bayesian equilibria exist and all of them share the same equilibrium path. All v pool on\
and the attacker strikes site 1 with probability Φ(v*) where v* uniquely satisfies
.
Proof
See the Appendix.
Comparative statics follow immediately. Loosely, as the average vulnerability of site 1 increases, the defender allocates weakly more to that site which in turn is weakly more likely to be attacked. More precisely, suppose that the prior distribution over v is H rather than G, where H first-order stochastically dominates G.15
The distribution H first-order stochastically dominates G if for any nondecreasing function u, ∫u(v)dH≥∫u(v)dG. In the specific case in which u(v)=v, ∫vdH≥∫vdG which shows that the average value of v under H is at least as large as under G. See Mas-Colell, Winston, and Green 1995, 195 on stochastic dominance.
Corollary 2
Suppose the defender pools on rh when when v is distributed according to H and r* when v is distributed according to G where H first-order stochastically dominates G. Then rh≥r* and α(rh)≥α(r*).
Proof
Because δ1(r, v) is increasing in v, first-order stochastic dominance implies that ∫δ1(r*, v)dH≥∫δ1(r*, v)dG. And, r* satisfies ∫δ1(r*, v)dG=Aδ2(R−r*). So, ∫δ1(r*, v)dH≥Aδ2(R−r*). The left side is decreasing in r and the right side is increasing. So the unique r, namely, rh, at which ∫δ1(r, v)dH=Aδ2(R−r) must be greater than r* if the previous inequality is strict and rh=r* if it holds with equality.
To demonstrate that α(rh)≥α(r*), let
. Then v+≥v* and it suffices to show that Φ(v) is increasing, since α(rh)=Φ(v+) and α(r*)=Φ(v*). Inspection of the expression for Φ(v) shows that it is increasing if
is decreasing. To show that this expression is decreasing, implicitly differentiate
to obtain:
Thus,
. Now differentiate
.
The expression on the right is clearly negative, since ∂2δ1/∂r∂v≥0. Hence,
.
Propositions 1 and 4 combine to show that uncertainty makes the defender better off. The former shows that v allocates
to site 1 and suffers an expected loss of
when there is no uncertainty about v. When there is uncertainty, v allocates
to this site, and it is easy to show that this allocation results in an expected loss strictly less than
as long as v≠v*.
Corollary 3
Uncertainty about v makes the defender better off: For all v≠v*, v's loss to allocating
to site 1 is strictly less than
which is what v would obtain if there were no uncertainty.
Proof
Proposition 1 shows that v allocates
to site 1, and this results in an expected loss of
when there is complete information. In the asymmetric information game, v allocates
and does strictly better at this allocation if
where
by Proposition 4.
Define Δ(v|v*) to be the difference between v's loss to playing
and
:
. Then, Δ(v*|v*)=0 and it suffices to show that ∂Δ(v|v*)/∂v>0 for v>v* and ∂Δ(v|v*)/∂v<0 for v<v*. Suppose v>v*. Differentiation gives
The proof of Corollary 2 shows that Φ(v) is increasing. That v>v* and ∂2δ1/∂r∂v≥0 guarantees that the factor in brackets is nonnegative. Hence, the expression in the last line is positive and ∂Δ(v|v*)/∂v>0 for v>v*. An analogous argument shows that ∂Δ(v|v*)/∂v<0 for v<v*.
WHEN MORE VULNERABLE SITES ARE EASIER TO PROTECT ON THE MARGIN
Propositions 2, 3, and 4 show that if more vulnerable sites are harder to protect on the margin, secrecy concerns generally swamp vulnerability concerns. This section shows by example that separating equilibria sometimes exist if more vulnerable sites are easier to protect on the margin. The discussion also explains why this result depends on the sign of the ∂2δ1/∂r∂v.
As Lemma 2 shows, v must offer
in a separating equilibrium. Moreover, no
can profitably deviate from
to
, and, as noted above, two conditions must be satisfied to ensure that no type can profitably deviate in this way. The first is that the “local” incentive compatibility constraints must hold. That is, types arbitrarily close to
must be deterred from deviating. Second, the “global” incentive compatibility constraints must also be satisfied; that is, types far away from
must be deterred. Deterring those close by pins down a unique probability of attacking. Whether this probability also deters types far away from
from wanting to deviate to
is related to the sign of ∂2δ1/∂r∂v.
Suppose more formally that all v∈(v′, v′′) separate with
for all types in this interval. If
, then the fact that w′′ cannot profitably deviate from
to
means:
where the second line follows from the first because
. Taking the limit as w′′ goes to
gives:
A similar argument for
shows that
must be less than or equal to the expression on the right of the previous inequality. Hence,
. Differentiating
implicitly to obtain
(see the proof of Corollary 2 for this expression) and then substituting this back into the expression for
yields
. Thus, deterring w close to
from wanting to deviate from
to
pins down a unique
.
Now consider w's payoff to deviating if w is farther away from
. Type w prefers deviating from
to
if
. (Recall that the defender's payoffs are losses so lower is better.) Since
, all w>
prefer to deviate if
for all w>
. Indeed, the gains from deviation grow as
does.
As shown in the proof of Corollary 3,
The function Φ(w) is strictly increasing, so the second term is positive. The assumption ∂2δ1/∂r∂v≥0 also ensures that the first term is nonnegative and consequently that ∂Δ/∂w>0 for
.
Similarly, if ∂Δ/∂w<0 for all w<
, these w prefer to deviate with the gains from doing so growing as w moves away from
. And, the expression for ∂Δ/∂w shows that it is negative for w<
if ∂2δ1/∂r∂v≥0.
Hence ∂2δ1/∂r∂v≥0 is sufficient to ensure that separation breaks down because satisfying the local incentive compatibility constraints means violating the global incentive compatibility constraints. If, alternatively, ∂2δ1/∂r∂v<0, then the sign of ∂Δ/∂w may be reversed in which case the gains from deviation decrease as the distance between w and
increases. Separation in these circumstances will be possible.
An example establishes that a separating equilibrium sometimes exists if ∂2δ1/∂r∂v<0.16
I am grateful to Scott Ashworth for very helpful comments leading to this example.
Now consider the assessment {ρ(v), α(r), μ(v|r)} where the attacker's strategy is α(r)=1 if
;
if
; and α(r)=0 if
. The defender's separating strategy ρ(v) is the allocation at which δ′(r−v)=δ′(R−r) which implies
. The attacker's beliefs put probability one on
if
, probability one on v=2r−R for
; and probability one on
for
.
The attacker is indifferent between attacking sites 1 and 2 following any equilibrium offer r given its beliefs. Hence
is a best reply. The attacker's beliefs are also consistent with Bayes' Law (and the support restriction in footnote 11). And by construction, ρ(r) solves the first-order condition
. Convexity assures that this allocation minimizes the defender's loss. It is also clear that v cannot profitably deviate to any
. Hence {ρ(v), α(r), μ} is a separating equilibrium.
CONCLUSION
Many allocation problems are sequential. Defenders, for example, generally have to commit some or all of their resources before an attacker decides where to strike. Adversaries are also often likely to have private information about the effectiveness of their allocations. In a sequential setting, this private information creates a dilemma.
In particular, a defender must be concerned that allocating more to a highly vulnerable site in order to reduce the expected losses should that site be attacked may also signal to the attacker that the site is more vulnerable and thereby increase the probability of an attack on that site.
Secrecy concerns turn out to swamp vulnerability concerns when more vulnerable sites are also harder to protect on the margin. The defender pools on a common allocation to avoid signaling anything to the attacker. This allocation is optimal against the average level of vulnerability but devotes too little to that site if it is very vulnerable and too much to that site if it is not very vulnerable. Even so, uncertainty makes the defender better off. When more vulnerable sites are easier to protect on the margin, vulnerability concerns may swamp secrecy concerns and separating equilibria sometimes exist.
APPENDIX
This section proves Propositions 2, 3, and 4. The argument begins with Lemma 1A, which demonstrates that if higher vulnerability types allocate more to site 1, then the equilibrium probability of an attack must be weakly decreasing in the vulnerability.
Lemma 1A
Let {ρ(v), α(r), μ} be a PBE of the signaling game. If v<v′ and ρ(v)≤ρ(v′), then α(ρ(v))≥α(ρ(v′)).
Proof
Suppose v<v′, r≡ρ(v)≤ρ(v′)≡r′, α≡α(ρ(v)), and α′≡α(ρ(v′)). Incentive compatibility requires:
Subtracting the first inequality from the second yields
The factor in brackets on the left is positive because δ1 is increasing in v, and the factor in brackets on the right is weakly negative because ∂2δ1/∂v∂r≥0. Hence, α′−α≤0.
Proposition 2
No nonempty open interval of types separate.
Proof
Arguing by contradiction, assume there is a PBE {ρ(v), α(r), μ} and an open interval
such that all
separate. Lemma 2 implies
for all
, and it suffices to show that that some
can profitably deviate from
.
Let z′>z and
. That z′ cannot profitably mimic z means:
where the second line follows from the first because
. Rewriting this expression and taking the limit as z′ goes to z gives:
Differentiating
implicitly to obtain
and substituting this expression into the previous inequality gives
. (See the proof of Corollary 2 for the expression for
) A similar argument for z′<z yields
and hence that
.
A contradiction follows immediately. The defender's offers
are increasing in z, so Lemma 1A implies
must be weakly decreasing in z. But differentiation shows that Φ(z) is increasing (see the proof of Corollary 2).
A PBE is semiseparating if at least two types allocate the same amount to a site and there are at least two distinct allocations. Proposition 3 shows that there are no semiseparating PBEs using simple strategies.
Proposition 3
The signaling game has no semiseparating PBEs in simple strategies.
Proof
Suppose that {ρ(v), α(r), μ(v|r)} is a PBE and that ρ is simple. Hence, two types, v′ and v′′ with v′<v′′, pool on an allocation, say
. Arguing by contradiction, Proposition 2 ensures that this equilibrium is not fully separating. It therefore suffices to show that all
pool on
and consequently that there is complete pooling.
Let
and
, where
. Because ρ is simple,
for all
. Now define
, which implies
. It follows that
.
Suppose that
. Then
. The inequality implies that the attacker strictly prefers going after site 2. Hence,
and w's payoff is
. But w can always obtain
by playing
. Moreover,
for all
. This means Aδ2(R−
, so all
strictly prefer to deviate from
. This contradiction ensures
.
Now assume
. Hence
. The attacker therefore strikes site 1 after observing
:
. As a result,
obtains an equilibrium payoff of
. That
implies
for all
. But all
can also play
which yields a loss of
. This loss is strictly less than
and consequently a profitable deviation. This contradiction means
and leaves
.
That
implies
. To establish this, let
and
. That w′′ cannot profitably deviate from
to
yields:
where the second line follows from the first because
. Letting
gives
. A similar argument for
shows that
and consequently
. Furthermore, the attacker must be mixing over sites 1 and 2 because
.
The defender cannot pool on any other allocation. Suppose that it did; that is, there exists an r* and two types z′≠z′′, such that ρ(z′)=ρ(z′′)=r*. Define
and
, where
. Also define z*=
. Repeating the argument above establishes that
and α(ρ(z*))=Φ(z*). Assume without loss of generality that
. Then
, so Lemma 1A ensures
. But this is a contradiction, since Φ(w) is increasing in w as shown in the proof of Corollary 2. This contradiction establishes that the defender cannot pool on any
.
An immediate consequence is that
and
. Suppose
. As just shown,
cannot pool and therefore must separate. But this contradicts Proposition 2 and leaves
. A similar argument yields
.
Finally, suppose
. Then
must separate and therefore allocate
. Further,
implies that the attacker's posterior
is just its prior G. This and the fact that the attacker mixes leaves
. But v* uniquely satisfies
. Hence,
. A contradiction results if
strictly prefers
to
.
Type
does prefer
to
if Δ(v|v*)>0, where recall Δ(v|v*) is the loss to playing
less the loss to playing
:
. As shown in the proof of Corollary 3,\ Δ(v*|v*)=0, ∂Δ(v|v*)>0 for v>v*, and ∂Δ(v|v*)<0 for v<v* if ∂2δ1(r, v)/∂r∂v≥0. Thus,
prefers to deviate, and this contradiction leaves
. The analogous argument demonstrates that
. Hence all v pool on
.
It remains to be shown that pooling equilibria actually exist and that the equilibrium paths in all pooling equilibria are identical.
Proposition 4
Pooling perfect Bayesian equilibria exist, and all of them share the same equilibrium path. All v pool on\
and the attacker strikes site 1 with probability
.
Proof
Suppose the defender pools on
. Then
. If
, the attacker must weakly prefer attacking site 1 to striking site 2. Moreover,
gives v an equilibrium payoff of
. But no v such that
would play
as it could profitably deviate to
since
. Hence,
for all v which means
. This, however, leads to the contradiction as the attacker strictly prefers hitting site 2:
This contradiction leaves
. An analogous argument shows
.
Because the attacker mixes in response to
, it must be indifferent to attacking either site. This means
. Recall further that this condition pins down a unique
and the corresponding
. That
also implies
.
Let
. Then
must equal Φ(v*) in order to deter the v in a neighborhood of v* from deviating to
. Hence, the defender must allocate
to site 1 and the attacker must strike this site with probability Φ(v*) in any pooling PBE.
All that remains to be shown is that a PBE\ actually exists. Define the strategy α(r)=1 if
;
if
; and α(r)=0 if
. As for the attacker's beliefs,
is the prior G. As for any
, μ(v|r) puts probability one on
for any
, probability one on
if
, and probability one on
if
. Then,
is a PBE.
To see that this is so, observe first that α(r) is a best response given μ(v|r). The attacker strictly prefers going after site 1 regardless of its beliefs if
. So α(r)=1 is the unique best reply to
. Similarly, the attacker strictly prefers hitting site 2 if
, and α again has the attacker playing its unique best response to r when
. If
, then the attacker is indifferent between attacking site 1 and attacking site 2. Hence any α(r) is a best response, and in particular
is.
The beliefs μ(v|r) are also clearly consistent with Bayes' law. If all v pool on
, then the only restriction that Bayes' law imposes is that the attacker's posterior beliefs following
are its prior beliefs G which μ(v|r) satisfies.
Therefore the assessment
will be a PBE if
is a best response to α(r). The argument takes two steps. The first demonstrates that no v can profitably deviate from
to
. Recall from the proof of Corollary 3 that the difference between v's payoff to
and
is
and satisfies Δ(v*|v*)=0, ∂Δ(v|v*)/∂v≥0 if v>v*, and ∂Δ(v|v*)/∂v≤0 if v<v*. Hence, no v≠v* prefers to deviate from
to
.
It follows that no v can profitably deviate from
to any other
. Type v 's loss to
is
. Then v has no profitable deviation from
if Π(v′|v)−Π(v*|v)≥0 for all
. As will be seen,
minimizes Π(v′|v); that is, Π(v′|v)≥Π(v|v) for all
. Hence Π(v′|v)−Π(v*|v)≥ Π(v|v)−Π(v*|v) which means that it suffices to show Π(v|v)−Π(v*|v)≥0. But
. So
and, as shown above, Δ(v|v*)≥0.
To see that
minimizes Π(v′|v) differentiate Π(v′|v):
But,
. Using this to simplify the second term gives
Clearly, ∂Π(v′|v)/∂v′=0 at v=v′. If v>v′, the factors in brackets are positive as are Φ′, Φ, and
. Hence, ∂Π(v′|v)/∂v>0 if v>v′. Conversely, ∂Π(v′|v)/∂v<0 if v<v′. Thus, v minimizes its loss by deviating to
which is not a profitable deviation from
.
As for deviating to
, v's loss is δ1(r, v) which is greater than
and so not a profitable deviation from
. And, deviating to
is clearly not profitable. Hence, PBEs exist.
I thank Scott Ashworth, Bruce Bueno de Mesquita, Ernesto Dal Bó, Santiago Oliveros, and Jacob Shapiro for helpful comments, criticisms and discussion.
Comments
No Comments have been published for this article.