1. Games with Secure Equilibria Krishnendu Chatterjee (Berkeley) Thomas A. Henzinger (EPFL) Marcin Jurdzinski (Warwick)

2. Classification of 2-Player Games Zero-sum games: complementary payoffs. Non-zero-sum games: arbitrary payoffs. 1,-10,0 2,-2-1,1 3,11,0 4,23,2

3. Classical Notion of Rationality Nash equilibrium: none of the players gains by deviation. 3,11,0 4,23,2 (row, column)

4. Classical Notion of Rationality Nash equilibrium: none of the players gains by deviation. 3,11,0 4,23,2 (row, column)

5. New Notion of Rationality Nash equilibrium: none of the players gains by deviation. Secure equilibrium: none hurts the opponent by deviation. 3,11,0 4,23,2 (row, column)

6. Secure Equilibria Natural notion of rationality for component systems: –First, a component tries to meet its spec. –Second, a component may obstruct the other components. For  -regular specs, there is always unique maximal secure equilibrium.

7. Games on Graphs Modeling component interaction: –Vertices = states –Players = components –Moves = transitions Applications: –Synthesis (control) of sequential systems –Verification of adversarial specs –Receptiveness –Compatibility –Early error detection –(Bi)simulation checking –Model checking –Game semantics –etc.

8. Starvation Freedom (mutual exclusion protocols, cache coherence protocols) In a multi-process system, can a process that wishes P to proceed always eventually proceed no matter what the other processes do? Example: Verification 8   (a ) hhPii } b) 8  (a ) 8} b) X 8  (a ! 9} b) X

9. Starvation Freedom (mutual exclusion protocols, cache coherence protocols) In a multi-process system, can a process P that wishes to proceed always eventually proceed no matter what the other processes do provided they meet their specs ? Example: Verification 8   (a ) hhPii } b) X 8  (a ) 8} b) X 8  (a ! 9} b) X

10. Games on Graphs Turn-based (perfect-information) games: –Game graph G=((V,E), (V 1,V 2 )). –E µ V £ V: serial edge relation. –(V 1,V 2 ): partition of the vertex set V. The game is played by moving token along edges of the graph: –V 1 : player-1 moves the token. –V 2 : player-2 moves the token.

11. Example: A Game Graph s0s0 s1s1 s2s2 s3s3

12. Plays and Strategies Play (outcome) of a game: –Infinite path (s 0,s 1,…) of states s i 2 V such that (s i,s i+1 ) 2 E for all i ¸ 0. –  : set of all plays. Player-1 strategy: – Given prefix of play ending in V 1, specifies how to extend the play. –  : V * ¢ V 1 ! V such that (s,  (x¢s)) 2 E for all x 2 V * and s 2 V 1. – Symmetric definition for player-2 strategies . Given two strategies ,  and a start state s, there is a unique play  ,  (s).

13. Example s0s0 s1s1 s2s2 s3s3 Example of a play: s 0 s 1 s 2  Strategies that yield this play: - Player-1: s 0 ! s 1 - Player-2: s 1 ! s 2

14. Memoryless Strategies Independent of the history of the play:  : V 1 ! V  : V 2 ! V Yield simple controllers. Existence puts games into NP.

15. Objectives and Payoffs What the players are playing for: –Player-1 objective: play in set  1 µ V . –Player-2 objective: play in set  2 µ V . –General objectives: Borel sets in the Cantor topology. –Finite-state objectives:  -regular sets (level 2.5 Borel sets). From objectives to payoffs: –If  ,  (s) 2  i, then player i gets payoff 1 else payoff 0. –The payoff profile for a strategy profile ( ,  ) at a state s is (v 1 ,  (s), v 2 ,  (s)).

16. Classification of Games Zero-sum games: –Complementary objectives:  2 = :  1. –Possible payoff profiles (1,0) and (0,1). Non-zero-sum games: –Arbitrary objectives  1,  2. –Possible payoff profiles (1,1), (1,0), (0,1), and (0,0).

17. Zero-Sum Games on Graphs Winning: - Winning-1 states s: (9  ) (8  )  ,  (s) 2  1. - Winning-2 states s: (9  ) (8  )  ,  (s) 2  2. Determinacy: –Every state is winning-1 or winning-2. –Borel determinacy [Martin 75]. –Memoryless determinacy for parity games [Emerson/Jutla 91]. (1,0)(0,1)

18. Non-Zero-Sum Games on Graphs Nash equilibrium ( ,  ) at state s: (8  ’) v 1 ,  (s) ¸ v 1  ’,  (s) (8  ’) v 2 ,  (s) ¸ v 2 ,  ’ (s)

19. Example: Reachability Game s0s0 s1s1 s2s2 s3s3 R1R1 R2R2 Objective for player i is to visit R i.

20. Example s0s0 s1s1 s2s2 s3s3 Nash equilibria: (s 0 ! s 1, s 1 ! s 2 ): (1,0) R1R1 R2R2

21. Example s0s0 s1s1 s2s2 s3s3 Nash equilibria: (s 0 ! s 1, s 1 ! s 2 ): (1,0) (s 0 ! s 3, s 1 ! s 0 ): (0,1) (s 0 ! s 1, s 1 ! s 0 ): (0,0) R1R1 R2R2

22. Example s0s0 s1s1 s2s2 s3s3 Nash equilibria: (s 0 ! s 1, s 1 ! s 2 ): (1,0) (s 0 ! s 3, s 1 ! s 0 ): (0,1) R1R1 R2R2

23. Synthesis: - Zero-sum game controller versus plant. - Control against all plant behaviors. Verification: - Non-zero-sum specs for components. - Components may behave adversarially, but without threatening their own specs.  Regular Objectives

24. Drawbacks of Nash equilibrium: - Does not capture adversarial behavior. - Not unique. A new notion of equilibrium: - Takes into account both non-zero-sum payoffs and adversarial behavior. - Captures the essence of component-based systems. - Unique for Borel objectives. - Computable for  -regular objectives. Non-Zero-Sum Verification Games

25. Secure Equilibria Secure strategy profile ( ,  ) at state s: (8  ’) ( v 1 ,  ’ (s) < v 1 ,  (s) ) v 2 ,  ’ (s) < v 2 ,  (s) ) (8  ’) ( v 2  ’,  (s) < v 2 ,  (s) ) v 1  ’,  (s) < v 1 ,  (s) ) A secure profile ( ,  ) is a contract: if the player-1 deviates to lower player-2’s payoff, her own payoff decreases as well, and vice versa. Secure equilibrium: secure strategy profile that is also a Nash equilibrium.

26. Secure Equilibria 3,31,3 2,23,1 2,10,0 1,20,0 (row, column)

27. Example s0s0 s1s1 s2s2 s3s3 R1R1 R2R2 Nash equilibria: (s 0 ! s 1, s 1 ! s 2 ): (1,0) (s 0 ! s 3, s 1 ! s 0 ): (0,1) (s 0 ! s 1, s 1 ! s 0 ): (0,0) not secure

28. Example s0s0 s1s1 s2s2 s3s3 R1R1 R2R2 Nash equilibria: (s 0 ! s 1, s 1 ! s 2 ): (1,0) (s 0 ! s 3, s 1 ! s 0 ): (0,1) (s 0 ! s 1, s 1 ! s 0 ): (0,0) not secure

29. Example s0s0 s1s1 s2s2 s3s3 Nash equilibria: (s 0 ! s 1, s 1 ! s 2 ): (1,0) (s 0 ! s 3, s 1 ! s 0 ): (0,1) (s 0 ! s 1, s 1 ! s 0 ): (0,0) R1R1 R2R2 not secure secure

30. Lexicographic Payoff Profile Ordering Player-1 preference º 1 : –(v 1,v 2 ) Â 1 (v’ 1,v’ 2 ) iff v 1 > v’ 1 or ( v 1 = v’ 1 and v 2 < v’ 2 ). –(v 1,v 2 ) º 1 (v’ 1,v’ 2 ) iff (v 1,v 2 ) Â 1 (v’ 1,v’ 2 ) or (v 1,v 2 ) = (v’ 1,v’ 2 ). Player-2 preference º 2 symmetric. Captures payoff maximization with external adversarial choice. Provides notion of maximality: –Player-1: (1,0) º 1 (1,1) º 1 (0,0) º 1 (0,1) –Player-2: (0,1) º 2 (1,1) º 2 (0,0) º 2 (1,0)

31. Alternative Characterization A secure equilibrium is an equilibrium with respect to the º 1 and º 2 payoff profile orderings: A strategy profile ( ,  ) is a secure equilibrium at s iff ( 8  ’) (v 1 ,  (s), v 2 ,  (s)) º 1 (v 1  ’,  (s), v 2  ’,  (s)) (8  ’) (v 1 ,  (s), v 2 ,’ (s)) º 2 (v 1 ,  ’ (s), v 2 ,  ’ (s))

32. Example: Buechi Game s4s4 s0s0 s2s2 s1s1 s3s3 B1B1 B2B2 Objective for player i is to visit B i infinitely often.

33. Example s4s4 s0s0 s2s2 s1s1 s3s3 B1B1 B2B2 Nash equilibria: (s 0 ! s 4, s 1 ! s 4 ): (0,0) secure

34. Example s4s4 s0s0 s2s2 s1s1 s3s3 B1B1 B2B2 Nash equilibria: (s 0 ! s 4, s 1 ! s 4 ): (0,0) (s 0 ! s 1, s 1 ! s 0 ): (1,0) secure

35. Example s4s4 s0s0 s2s2 s1s1 s3s3 B1B1 B2B2 Nash equilibria: (s 0 ! s 4, s 1 ! s 4 ): (0,0) (s 0 ! s 1, s 1 ! s 0 ): (1,0) secure not secure

36. Example s4s4 s0s0 s2s2 s1s1 s3s3 B1B1 B2B2 Nash equilibria: (s 0 ! s 4, s 1 ! s 4 ): (0,0) (s 0 ! s 1, s 1 ! s 0 ): (1,0) (s 0 ! s 2, s 3 ! s 1 ): (1,1) secure not secure

37. Example s4s4 s0s0 s2s2 s1s1 s3s3 B1B1 B2B2 Nash equilibria: (s 0 ! s 4, s 1 ! s 4 ): (0,0) (s 0 ! s 1, s 1 ! s 0 ): (1,0) (s 0 ! s 2, s 3 ! s 1 ): (1,1) secure not secure

38. Example s4s4 s0s0 s2s2 s1s1 s3s3 B1B1 B2B2 Nash equilibria: (s 0 ! s 4, s 1 ! s 4 ): (0,0) (s 0 ! s 1, s 1 ! s 0 ): (1,0) (s 0 ! s 2, s 3 ! s 1 ): (1,1) secure not secure secure

39. Example s4s4 s0s0 s2s2 s1s1 s3s3 B1B1 B2B2 Secure equilibrium ( ,  ) with payoff (1,1) at s 0 :  : if s 1 ! s 0, then s 2 else s 4.  : if s 3 ! s 1, then s 0 else s 4. Pair of “retaliating” strategies. Require memory.

40. Theorem: At every state s of a graph game with Borel objectives, there is a unique secure equilibrium profile that is maximal with respect to both º 1 and º 2. Maximal Secure Equilibria This is the rational behavior of both players at s if they wish to 1. satisfy their own objectives and, then, 2. sabotage the opponent’s objective.

41. Strongly Winning and Retaliating Strategies Winning strategies: –Player-1 wins for the objective  1. –Player-2 wins for  2. Strongly winning strategies: –Player-1 wins for the objective  1 Æ :  2. –Player-2 wins for  2 Æ :  1. Retaliating strategies: –Player-1 wins for the objective  2 )  1. –Player-2 wins for  1 )  2.

42. Winning Sets W 1 : set of states s.t. player-1 has a winning strategy. W 2 : set of states s.t. player-2 has a winning strategy. W 10 : set of states s.t. player-1 has a strongly winning strategy. W 01 : set of states s.t. player-2 has a strongly winning strategy. W 11 : set of states s s.t. there is a pair ( ,  ) of retaliating strategies with  ,  (s) ²  1 Æ  2. W 00 : set of states s s.t. each player has a retaliating strategy and for every pair ( ,  ) of retaliating strategies,  ,  (s) ² :  1 Æ :  2.

43. State Space Partition

44. W 10 hh1ii (  1 Æ :  2 ) hh2ii ( :  1 Ç  2 )

45. State Space Partition W 10 hh1ii (  1 Æ :  2 ) hh2ii ( :  1 Ç  2 ) W 01 hh2ii (  2 Æ :  1 ) hh1ii ( :  2 Ç  1 )

46. State Space Partition W 10 hh1ii (  1 Æ :  2 ) hh2ii ( :  1 Ç  2 ) W 01 hh2ii (  2 Æ :  1 ) hh1ii ( :  2 Ç  1 ) Retaliating strategies There is no player-2 retaliating strategy in W 10, and no player-1 retaliating strategy in W 01.

47. Retaliating Strategy Pairs Every player-1 retaliating strategy  ensures for every player-2 strategy  that  2 )  1. Hence every pair ( ,  ) of retaliating strategies ensures (:  1 Ç :  2 ) ) (:  1 Æ :  2 ). W 11 and W 00 are the regions of the state space where both players have retaliating strategies: –W 11 contains the states where some pair ( ,  ) of retaliating strategies ensures  1 Æ  2. –W 00 contains the states where all pairs ( ,  ) of retaliating strategies lead to :  1 Æ :  2.

48. State Space Partition W 10 hh1ii (  1 Æ :  2 ) W 01 hh2ii (  2 Æ :  1 ) W 11 W 00

49. Uniqueness of Maximal Secure Equilibria W 11 : (1,1) is a secure equilibrium, and hence maximal W 10 : (1,0) is the only secure equilibrium W 01 : (0,1) is the only secure equilibrium W 00 : (0,0) is the only possible secure equilibrium W 11 is the set of states where both players can collaborate to win, yet each player keeps an “insurance policy.”

50. Generalization of Determinacy W 10 W 01 W 11 W 00 W1W1 W2W2 Zero-sum games:  2 = :  1 Non-zero-sum games:  1,  2

51. Computing the Partition For  -regular  1 and  2. Computing –W 10 = hh1ii (  1 Æ :  2 ) –W 01 = hh2ii (  2 Æ :  1 ) involves solving games with conjunctive (Streett) objectives. These are generally not memoryless. We need to compute W 11 µ hh1,2ii (  1 Æ  2 ) = 9 (  1 Æ  2 ).

52. s0s0 s1s1 B1B1 B2B2 W 1,0 even though hh1,2ii (  1 Æ  2 )

53. Computing the Partition W 10 hh1ii (  1 Æ :  2 ) hh2ii (  1 )  2 ) W 01 hh2ii (  2 Æ :  1 ) hh1ii (  2 )  1 )

54. Computing the Partition W 10 hh1ii (  1 Æ :  2 ) hh2ii (  1 )  2 ) W 01 hh2ii (  2 Æ :  1 ) hh1ii (  2 )  1 ) hh1ii  1 U1U1

55. Computing the Partition W 10 hh1ii (  1 Æ :  2 ) hh2ii (  1 )  2 ) W 01 hh2ii (  2 Æ :  1 ) hh1ii (  2 )  1 ) hh1ii  1 hh2ii  2 U1U1 U2U2

56. Computing the Partition W 10 hh1ii (  1 Æ :  2 ) hh2ii (  1 )  2 ) W 01 hh2ii (  2 Æ :  1 ) hh1ii (  2 )  1 ) hh1ii  1 hh2ii  2 Threat strategies  T,  T hh2ii :  1 hh1ii :  2 U1U1 U2U2

57. Computing the Partition W 10 hh1ii (  1 Æ :  2 ) hh2ii (  1 )  2 ) W 01 hh2ii (  2 Æ :  1 ) hh1ii (  2 )  1 ) hh1ii  1 hh2ii  2 Threat strategies  T,  T hh2ii :  1 hh1ii :  2 hh1,2ii (  1 Æ  2 ) Cooperation strategies  C,  C U1U1 U2U2

58. Computing W 11 The pair (  C +  T,  C +  T ) is a pair of winning retaliating strategies: –Player-1 follows  C until reaching U 1 [ U 2 (then switch to known retaliating pair) or until player-2 deviates from  C (then switch to  T ). –Player-2 behaves symmetrically. From states s where there are no cooperative strategies, for all retaliation strategies ( ,  ) we have  ,  (s) ² :  1 Æ :  2. Hence W 11 = hh1,2ii(  1 Æ  2 ) in the subgame without W 10 [ W 01.

59. Computing the Partition W 10 hh1ii (  1 Æ :  2 ) W 01 hh2ii (  2 Æ :  1 ) hh1ii  1 hh2ii  2 hh1,2ii (  1 Æ  2 ) U1U1 U2U2 W00W00

60.  1,  2 LTL: 2EXPTIME [Pnueli/Rosner].  1,  2 parity: coNP [Emerson/Jutla]. Computing the Partition

61. P 1 2 W 1 (  1 ) P 2 2 W 2 (  2 )  1 Æ  2 )  P 1 ||P 2 ²  Application: Compositional Verification

62. P 1 2 W 1 (  1 ) P 2 2 W 2 (  2 )  1 Æ  2 )  P 1 ||P 2 ²  Application: Compositional Verification P 1 2 (W 10 [ W 11 ) (  1 ) P 2 2 (W 01 [ W 11 ) (  2 )  1 Æ  2 )  P 1 ||P 2 ²  W 1 ½ W 10 [ W 11 W 2 ½ W 01 [ W 11 An assume/guarantee rule.

63. Summary Rational behavior in non-zero-sum graph games: –not as restrictive as zero-sum games. –capture the essence of multi-component systems. –unique equilibria. –computable for  -regular objectives. Reference: LICS 2004.