Predictable Systems Can Fail
In a previous post I looked at Spotify’s payout model, which was open to exploitation in part because the rules were so predictable. The only uncertainty a bot farm faces there is whether it will be detected.
Formula 1 shows the same thing more cleanly. Since 2014 the FIA has required every car to carry a standardised fuel flow meter, with flow capped at 100 kg/h, on the reasoning that fuel flow scales roughly with engine power. The meter samples at a fixed, known rate of 2200 Hz. In 2019 Ferrari was suspected of exploiting that predictability through aliasing. If you pulse the fuel delivery at the right frequency and every sample lands in a trough of the actual flow, while the peaks, which run above 100 kg/h, fall in the gaps the meter never sees. The time-averaged flow reads as compliant.
The FIA never confirmed the exploit publicly and changed the rules anyway. The fix was to inject uncertainty. The pump trick worked because 2200 Hz was public, so a team could design against the specification and push fuel into the gaps. Hiding the sample rate is not enough on its own, since a team can work it out by watching how often samples arrive. So the FIA encrypted the data. Encryption can be defeated, so they also randomised the sample timing, leaving teams with no phase to lock onto and no frequency to tune their pumps against.
Randomisation as a design tool
Randomisation can be a useful ally even when it introduces uncertainty over outcomes.
Take an organisation run as a democracy, where choices are settled by majority vote. Most of the activity happens outside the election itself: side payments, bribes, coalitions, promises to back someone else’s policy in exchange for support. Everyone looks for a way to rig the vote in their favour.
One way to break this is to randomise. Draw a subset of the voting population, make them a sub-electorate, and count only their votes. A lobbyist cannot check whether a voter voted as instructed, and they cannot check whether that voter was in the subset whose votes were counted. Any voter can claim they complied but were not selected, whatever they actually did. Lobbying becomes a poor investment. There is a longer tradition behind this in the work on sortition and lottocracy.
If you extend the logic further you end up in an interesting spot where only one person is drawn and decides for everyone.
Random serial dictatorship
The dictatorial protocol extends to a multi-unit setting. Suppose there are 100 items and 100 people with private preferences over them.
A simple protocol does most of the work. Draw a person uniformly at random and let them take their favourite item. Draw another and let them take their favourite from what is left. Continue until everyone has something. This is random serial dictatorship. It is strategy-proof, since no one gains by lying about their preferences. Every realisation is Pareto efficient, since no group could trade to make everyone better off. And equals are treated equally, since two agents with identical preferences face identical lotteries.
The strategy-proofness is easy to see. When your turn comes you face whatever set of items remains, and that set was determined entirely by the people who picked before you. Your report cannot change it. All your report controls is which item you walk away with, so there is no reason to name anything other than your true favourite. You would only be choosing a worse item from the same menu.
Truth-telling is dominant in each realisation, which is why randomising over orderings preserves it.
The design lesson
The instinct when designing a mechanism is to engineer the uncertainty out of it. But a fully optimised, fully deterministic system is one your adversary can take apart and exploit. Randomisation takes away a stable specification to attack.
Ansible Architecture designs incentive systems and interaction protocols for platforms and marketplaces.
