Information Design for Multiple Interdependent Defenders: Work Less, Pay Off More

Abstract

This paper studies the problem of information design in a general security game setting in which multiple self-interested defenders attempt to provide protection simultaneously for the same set of important targets against an unknown attacker. A principal, who can be one of the defenders, has access to certain private information (i.e., attacker type), whereas other defenders do not. We investigate the question of how that principal, with additional private information, can influence the decisions of the defenders by partially and strategically revealing her information. In particular, we develop a polynomial time ellipsoid algorithm to compute an optimal private signaling scheme. Our key finding is that the separation oracle in the ellipsoid approach can be carefully reduced to bipartite matching. Furthermore, we introduce a compact representation of any ex ante persuasive signaling schemes by exploiting intrinsic security resource allocation structures, enabling us to compute an optimal scheme significantly faster. Our experiment results show that by strategically revealing private information, the principal can significantly enhance the protection effectiveness for the targets.

1. Introduction

In many real-world security domains, there are often multiple self-interested security teams who conduct patrols over the same set of important targets without coordinating with each other [1]. Among others, an important motivating domain of this paper is wildlife conservation: while patrol teams from various NGOs or provinces patrol within the same conservation area to protect wildlife from poaching, different NGOs or provinces typically have different types of targeted species and tend to operate separately (for instance, the Snow Leopard Foundation in Pakistan cares about leopards, whereas the Pakistan Bird Conservation Network primarily focuses on watching and protecting endangered birds [2]). Similarly, there are multiple different countries that simultaneously plan their own anti-crime actions against illegal fishing in international waters [3].

The study of multi-defender security games has attracted much recent attention. Unfortunately, most findings so far are relatively negative. Specifically, [4] showed that the lack of coordination among defenders may significantly lessen the overall protection effectiveness, leading to unbounded price of anarchy. In addition, [5] recently showed that finding a Nash Stackelberg equilibrium among the defenders, taking into account the strategic response of the attacker, is computationally NP-hard. Given these negative results, this paper asks the following question:

How can one obtain defense effectiveness and computation efficiency in multi-defender security games?

To answer the above question, we exploit the use of information as a “knob” to coordinate strategic agents’ decisions. Specifically, we study how a principal with privileged private information (e.g., more accurate information about how much profit an attacker has from poaching) can influence the decisions of all defenders by strategically revealing her information, a task also known as information design or persuasion [6]. Concretely, we study information design in a Bayesian security game setting with multiple self-interested defenders. These defenders attempt to protect important targets against an unknown attacker. The attacker type is unknown to the defenders. Nevertheless, all defenders share a common knowledge of a prior distribution over the attacker types. In this setting, there is a principal who has additional information about the attacker type and wants to communicate with both the defenders and the attacker through a persuasion signaling mechanism in order to influence all of their decisions towards the principal’s goal.1 In wildlife protection, for example, the principal may be the national park office, whereas different defenders correspond to different NGOs with their own focused species to protect. Since many poachers (or the attacker) are local villagers, park rangers can have access to private information through local informants about whom (i.e., which attacker type) is conducting poaching [9].

In summary, our results show that information design not only significantly improves protection effectiveness but also leads to efficient computation. Concretely, assuming the principal can communicate with defenders privately (also known as private signaling [10]), we develop an ellipsoid-based algorithm in which the separation oracle component can be decomposed into a polynomial number of sub-problems, and each sub-problem reduces to a bipartite matching problem. We remark that this by no means is an easy task, neither conceptually nor technically, since the outcomes of private signaling form the set of Bayes correlated equilibria [11], and computing an optimal correlated equilibrium is a fundamental and well-known intractable problem [12]. Our proof is technical and crucially explores the special structure of security games. In addition, we also investigate the ex ante private signaling scheme (a relaxation of private signaling in which the defenders and attacker decide whether to follow the principal’s signals or not before any signal is realized [13]). In this scenario, we develop a novel compact representation for the principal’s signaling schemes by compactly characterizing jointly feasible marginals. This finding enables us to significantly reduce the signaling scheme computation.

Finally, we present extensive experimental results evaluating our proposed algorithms in various game settings. We evaluate two different principal objectives: (i) maximizing the defenders’ social welfare; and (ii) maximizing her own utility. Our results show that through signaling schemes, the principal can significantly increase the social welfare of the defenders while substantially reducing the attacker’s utility.

Comparison with Previous Works

Defense and Attack Models for Security: There is extensive literature studying defense and attack models for security. Our discussion here cannot do justice to this large body of literature; we thus refer interested readers to an excellent survey paper [14], which classifies previously studied models according to three dimensions: system structure (eight types), defense measures (six types), and attack tactics and circumstances (seven types). Under their language, our work falls within the multiple elements system structure, protection defense measure, and attack against single element attack tactics. Prior to the writing of the survey article, not much previous work fell into this particular category. The most relevant publications for us are [15,16], which provide a systematic equilibrium analysis for the strategic game between a multi-resource defender and a single-element attacker. However, these works differ from ours in two key aspects: (1) their study is analytical, whereas our work is computational and tries to find the optimal defense strategy; (2) they consider simultaneous-move games, whereas our game is sequential and falls into the Stackelberg game framework. Specifically, we adopt the widely used class of games termed Stackelberg Security games, which capture strategic interactions between defenders and attackers in security domains [17]. This research advance comes slightly after the survey article [14], but has nevertheless led to a significant impact with deployed real-world applications, e.g., for airport security [18], ferry protection [19], and wildlife conservation [20].

Within the security game literature, most-relevant to our work is the recent study of multiple-defender security games. Several of them consider defenders to have identical interests [1,21] or to have their own disjointed sets of targets [4,22,23,24,25]. The game model in [5] is the most-related to ours. This previous work investigates the existence and computation of a Nash Stackelberg equilibrium among the defenders. To our knowledge, our work is the first to study information design in multi-defender security games. In contrast to previous negative results, our findings are much more encouraging. Our positive results even extend to more realistic game models with defender patrolling costs, which cannot be handled by the existing work.

Strategic Information Disclosure for Security: Information design, also known as signaling, has attracted much interest in various domains, such as public safety [7,8], wildlife conservation [26], traffic routing [13,27], and auctions [28,29]. Most-related to us is [30], which studies signaling in Bayesian Stackelberg games. All previous work assumes a single defender, whereas our paper tackles the complex multiple-defender setup. This requires us to work with exponentially large representations of signaling schemes and necessitates novel algorithmic techniques with compact representations.

Other Learning-based Solutions: Recent research in multi-agent reinforcement learning (MARL) has studied factors that influence agents’ behavior in a shared environment. For example, [31] studies how to convey private information through actions in cooperative environments. Ref. [32] uses monetary reward (which they call ’causal inference reward’) to influence opponents’ actions. Unlike the tools studied in previous multi-agent reinforcement learning literature, our model takes advantage of information asymmetry between the principal and various stakeholders (including both defending agencies and the attacker) to influence their actions. Therefore, both our setup and approach are different from these previous learning-based methods.

2. Preliminary

We consider a general security game setting in which there are multiple self-interested defenders $\mathbf{D}=\{1,\dots ,|\mathbf{D}\left|\right\}$ who have to protect important targets $\mathbf{T}=\{1,\dots ,|\mathbf{T}\left|\right\}$ from an attacker. Each defender can protect at most one target.2 The defenders do not know the attacker’s type, but they share common prior knowledge about the distribution over possible attacker types: ${\left\{q\left(\lambda \right)\right\}}_{\lambda \in \Lambda }$ with $\Lambda =\{1,\dots ,|\Lambda \left|\right\}$, where $q\left(\lambda \right)$ is the probability that the attacker has type $\lambda$. If a defender d decides to go to a target t, he has a patrolling cost of $C^d\left(t\right)<0$. If the attacker $\lambda$ successfully attacks a target t, he receives a reward $R^{\lambda }\left(t\right)\ge 0$, while each defender d receives a penalty $P^d\left(t\right)\le 0$. Conversely, if any of the defenders catches the attacker $\lambda$ at t, the attacker receives a penalty $P^{\lambda }\left(t\right)<0$, while each defender d obtains a reward $R^d\left(t\right)>0$. Notably, one defender suffices to fully protect a target, whereas multiple defenders on the same target are not any more effective. This leads to interdependence among defenders and is the major source of inefficiency without coordination [4].

3. Optimal Private Signaling

We first study the design of private signaling schemes that help the principal to coordinate the defenders. The principal leverages her private information about the attacker type to influence the decisions of all players (including the attacker) by strategically revealing her information. We adopt the standard assumption of information design [33] and assume that the principal commits to a signaling scheme $\omega$ and $\omega$ that is publicly known to all players. At a high level, a private signaling scheme generates a random variable called signal profile $\mathbf{s}$, which is correlated with $\lambda$, where $s\left(d\right)$ is the private signal sent to the defender d, and $s\left(a\right)$ is the signal sent to the attacker. Each defender d, once receiving a certain private signal $s_0$, updates his belief on the attacker type using Bayes rule as follows:

$$\begin{array}{cc}\hfill & P(\lambda \mid s_0)=\frac{q\left(\lambda \right){\sum }_{\mathbf{s}:s\left(d\right)=s_0}\omega (\mathbf{s}\mid \lambda )}{{\sum }_{{\lambda }^{\prime }}q\left({\lambda }^{\prime }\right){\sum }_{\mathbf{s}:s\left(d\right)=s_0}\omega (\mathbf{s}\mid {\lambda }^{\prime })}\hfill \end{array}$$

where $\omega (\mathbf{s}\mid \lambda )$ is the probability the signal profile $\mathbf{s}$ is generated given the attacker type is $\lambda$.

Any private signaling scheme induces a Bayesian game among players. According to [11], all the Bayes–Nash equilibria that can possibly arise for any private signaling scheme form the set of Bayes correlated equilibria (BCEs). Similar to the standard correlated equilibria, the signals of a private signaling scheme in a BCE can also be interpreted as obedient action recommendations. Therefore, a private signal profile can be represented as $\mathbf{s}=\left(\right\{s\left(d\right)\},s(a\left)\right)$, where $s\left(d\right)\in \mathbf{T}$ is the suggested protection target for defender $d\in \mathbf{D}$, and $s\left(a\right)\in \mathbf{T}$ is the “suggested” target3 for the attacker to attack. With slight abuse of notations, we use $s(-a)$ to represent the profile of signals sent to all the defenders, respectively, and $s(-a,-d)$ is the profile of signals sent to other defenders except defender d.

Example 1.

To illustrate the idea, let us consider a simple example motivated realistically by wildlife conservation. Suppose there are three main regions $A,B,C$ with important species, and there are two defending/patrolling agencies $d_1,d_2$. Defender $d_1$ (e.g., the Snow Leopard Foundation in Pakistan) only cares about species 1 (e.g., leopard), whereas defender $d_2$ only cares about species 2. Species 1 is distributed across only regions $A,B$, with more in A—specifically, defender $d_1$ suffers cost 9 (which is the poacher’s gain) in region A but suffers cost 4 in region B for failing to protect them. species 2 is distributed mainly in targets $B,C$ but with more at C—specifically, defender $d_2$ suffers cost 4 at target B but cost 9 at target C. The defenders’ utility for successfully protecting any target is normalized to 0 for ease of analysis. There are three possible types of poachers: those interested in poaching species 1, those interested in 2, and those interested in both. The two defending agencies share a common prior that a random poacher has type $\left(1\right)$ or $\left(2\right)$ each with probability $3/7$ but has type $\left(12\right)$ with probability $1/7$ (i.e., fewer poachers are interested in both species).

We stand at the perspective of the national park office, which looks to optimize the protection of both species 1 and 2. We assume that the national park office can observe the exact type of the poacher,4 and would like to strategically reveal this information to the two defending agencies in order to optimize the overall protection of the two species. For simplicity, suppose the national park does not have patrolling resources (though the illustrated idea would apply in that instance as well).

A natural first thought one may have is that the national park should be transparent and fully reveal the poacher type to both defenders. Unfortunately, this turns out not to be a good policy. If the poacher is type $\left(12\right)$, then it is easy to verify that it is a unique Nash equilibrium for defender $d_1$ to patrol A with probability $3/4$ and B otherwise, and $d_2$ to patrol C with probability $3/4$ and B otherwise. This leads to overall protection probability $1-(1-\frac{1}{4})(1-\frac{1}{4})=7/16$ at target B and $3/4$ at $A,C$. The rational poacher type $\left(12\right)$ will attack the more profitable target B, leading to cost $(4+4)\times (1-7/16)=4.5$ to the national park. If the poacher has type $\left(1\right)$ (or $\left(2\right)$), then only defender $d_1$ (or $d_2$) will conduct patrolling at target $A,B$. Simple calculation shows that the optimal $d_1$ strategy is to protect A with probability $9/13$, leading to defender cost $36/13$. This, in total, leads to expected defender cost $\frac{1}{7}\times (36/13)+2\times \frac{3}{7}\times \left(4.5\right)=\frac{29.77}{7}$.

It turns out that revealing different information privately to the two defenders leads to much higher utility. Specifically, consider the policy that reveals to defender $d_1$ whether the poacher is instead in species 2 (i.e., having type $\left(2\right)$ or $\left(12\right)$) or not (i.e., having type $\left(1\right)$). In the first situations, $d_1$ knows that the poacher is definitely interested in species 2 but is unsure whether he is interested in 1—simple posterior updates shows that there is $1/4$ probability that the poacher is interested in species 1 as well. So $d_1$ will nevertheless conduct patrolling just in case poacher is interested in species 1. Calculation shows that defender $d_1$’s equilibrium strategy will patrol target A with probability $p_1=0.65$ and B with $0.35$. In the second situation, $d_1$ knows for sure that the poacher is interested in species 1, and his equilibrium strategy will now put probability $p_2=0.776$ on target A. Due to symmetry, defender $d_2$ has a symmetric strategy. Overall, it can be calculated that the defender will suffer cost $9\times (1-p_2)=2.016$ whenever the poacher is interested in only one species and cost $p_1^2\times (4+4)=3.38$ when the poacher is interested in both. This overall leads to total defender cost $\frac{1}{7}\times \left(3.38\right)+2\times \frac{3}{7}\times \left(2.016\right)=\frac{15.476}{7}$. This reduces the cost $\frac{29.77}{7}$ under the transparent policy almost by half. Intuitively, this is because the private signaling policy carefully obfuscates the poacher type so that $d_2$ is incentivized to protect target B even when the poacher is not interested in species 2. This allows $d_1$ to focus more on the protection of A.

3.1. An Exponential-Size LP Formulation

Like a typical formulation of optimal correlated equilibrium, optimal private signaling can also be formulated as an exponentially large linear program (LP). Specifically, the principal attempts to find an optimal signaling scheme $\Omega =\left\{\omega \right(\mathbf{s}\mid \lambda \left)\right\}$ to optimize her objective, which can be either her own utility (if she is a defender) or the social welfare of the defenders. We abstractly represent the principal’s objective function with respect to a signal $\mathbf{s}$ as $U\left(\mathbf{s}\right)$. The optimal private signaling can be formulated as the following LP:

$$\begin{array}{cc}\hfill & max{\sum }_{\lambda }q\left(\lambda \right){\sum }_{\mathbf{s}}\omega (\mathbf{s}\mid \lambda )U\left(\mathbf{s}\right)\mathrm{s}.\mathrm{t}.\hfill \\ \hfill & (\mathrm{Attacker}\mathrm{obedience})\forall \lambda ,t,t^{\prime }:\hfill \end{array}$$

(1)

$$\begin{array}{cc}\hfill & \sum _{\mathbf{s}:t=s\left(a\right)}\omega (\mathbf{s}\mid \lambda )U^{\lambda }\left(\mathbf{s}\right)\ge \sum _{\mathbf{s}:t=s\left(a\right)}\omega (\mathbf{s}\mid \lambda )U^{\lambda }(s(-a),t^{\prime })\hfill \\ \hfill & (\mathrm{Defender}\mathrm{obedience})\forall d,t,t^{\prime }:\hfill \end{array}$$

(2)

$$\begin{array}{cc}\hfill & {\sum }_{\lambda }q\left(\lambda \right){\sum }_{\mathbf{s}:s\left(d\right)=t}\omega (\mathbf{s}\mid \lambda )U^d\left(\mathbf{s}\right)\hfill \\ \hfill & \ge {\sum }_{\lambda }q\left(\lambda \right){\sum }_{\mathbf{s}:s\left(d\right)=t}\omega (\mathbf{s}\mid \lambda )U^d(s(-a,-d),t^{\prime },s\left(a\right))\hfill \end{array}$$

(3)

$$\begin{array}{cc}\hfill & {\sum }_{\mathbf{s}}\omega (\mathbf{s}\mid \lambda )=1,\omega (\mathbf{s}\mid \lambda )\ge 0,\forall \mathbf{s},\lambda \hfill \end{array}$$

(4)

where (2) and (3) are obedience constraints that guarantee the attacker of any type and all defenders will follow the principal’s recommendation. The utilities of each defender d and each attacker type $\lambda$ are determined as follows:

$$\begin{array}{cc}\hfill & U^d\left(\mathbf{s}\right)=C^d\left(s\left(d\right)\right)+P^d\left(s\left(a\right)\right),\mathrm{if}\forall d^{\prime }:s\left(a\right)\ne s\left(d^{\prime }\right)\hfill \\ \hfill & U^d\left(\mathbf{s}\right)=C^d\left(s\left(d\right)\right)+R^d\left(s\left(a\right)\right),\mathrm{if}\exists d^{\prime }:s\left(a\right)=s\left(d^{\prime }\right)\hfill \\ \hfill & U^{\lambda }\left(\mathbf{s}\right)=R^{\lambda }\left(s\left(a\right)\right),\mathrm{if}\forall d^{\prime }:s\left(a\right)\ne s\left(d^{\prime }\right)\hfill \\ \hfill & U^{\lambda }\left(\mathbf{s}\right)=P^{\lambda }\left(s\left(a\right)\right),\mathrm{if}\nexists d^{\prime }:s\left(a\right)=s\left(d^{\prime }\right)\hfill \end{array}$$

Problems (1)–(4) have an exponential number of variables $\left\{\omega \right(\mathbf{s}\mid \lambda \left)\right\}$ due to exponentially many possible defender allocations. This is also the common challenge in computing optimal correlated equilibria for succinctly represented games with many players (defenders in our case). Indeed, an optimal correlated equilibrium has been proven to be NP-hard in many succinct games [12]. Perhaps surprisingly, next, we show that LPs (1)–(4) can be solved in polynomial time in our case.

3.2. A Polynomial-Time Algorithm

We prove the following main positive result.

Theorem 1.

The optimal private signaling scheme can be computed in polynomial time.

The rest of this section is devoted to the proof of Theorem 1. We elaborate the proof for the principal objective of maximizing the defender social welfare, i.e., $U\left(\mathbf{s}\right)={\sum }_d{U}^d\left(\mathbf{s}\right)$. The proof is similar when the principal is one of the defenders. Our proof is divided into three major steps and crucially exploits the structure of security games.

Step 1: Restricting to simplified pure strategy space. One challenge of designing the signaling scheme is when multiple defenders are recommended a same target, which significantly complicates computation of marginal target protection. Therefore, our first step is to simplify the pure strategy space to include only those in which all defenders cover different targets. To do so, we create $\mathbf{D}$ dummy targets for which rewards, penalties, and costs are zero for both the defenders and the attacker.5 When the players choose one of these dummy targets, it means they choose to do nothing. As a result, we have $(\mathbf{T}+\mathbf{D})$ targets in total, including these dummy targets. The creation of these dummy targets does not influence the actual outcome of any signaling scheme but introduces a nice characteristic of the optimal signaling scheme (Lemma 1). This characteristic of at most one defender at each target allows us to provide more efficient algorithms to find an optimal signaling scheme.

Lemma 1.

There is an optimal signaling scheme such that for any signal profile $\mathbf{s}$ with a positive probability (i.e., $\omega (\mathbf{s}\mid \lambda )>0$), then $s\left(d\right)\ne s\left(d^{\prime }\right)$ for all $d\ne d^{\prime }$.

Proof. 

Let us assume that in a signaling scheme there is a signal for which multiple defenders are sent to the same target t. We revise this signal by only suggesting the defender d with the lowest cost $C^d\left(t\right)$ to t and other defenders are sent to dummy targets instead. First of all, the expected cost is reduced, while the coverage probability at each non-dummy target remains the same. As a result, the principal’s objective does not change. Second, the attacker’s obedience constraints do not change. Third, the LHS of the defender’s obedience constraints increases, while the RHS is the same. This means no obedience constraint is violated. □

Step 2: Working in the dual space. Since LP (1)–(4) has exponentially many variables, we first reduce it to the following dual linear program (1)–(4) via the standard linear duality theory [17], which turns out to be more tractable to work with:

$$\begin{array}{cc}\hfill & min{\sum }_{\lambda }\gamma \left(\lambda \right)\mathrm{s}.\mathrm{t}.\hfill \end{array}$$

(5)

$$\begin{array}{cc}\hfill & \gamma \left(\lambda \right)+{\sum }_{t^{\prime }}\left[U^{\lambda }(s(-a),t^{\prime })-U^{\lambda }\left(\mathbf{s}\right)\right]{\alpha }^{\lambda }(s\left(a\right),t^{\prime })\hfill \\ \hfill & +q\left(\lambda \right){\sum }_{d,t^{\prime }}\left[U^d(s(-a,-d),t^{\prime },s\left(a\right))-U^d\left(\mathbf{s}\right)\right]{\beta }^d(s\left(d\right),t^{\prime })\hfill \\ \hfill & \ge q\left(\lambda \right)U\left(\mathbf{s}\right),\forall (\mathbf{s},\lambda )\hfill \end{array}$$

(6)

$$\begin{array}{cc}\hfill & {\alpha }^{\lambda }(t,t^{\prime }),{\beta }^d(t,t^{\prime })\ge 0,\forall \lambda ,d,t,t^{\prime }.\hfill \end{array}$$

(7)

where each constraint in (6) corresponds to the primal variable $\omega (\mathbf{s}\mid \lambda )$. The dual variables ${\alpha }^{\lambda }(t,t^{\prime })$ correspond to attacker obedience constraints (2). The dual variables ${\beta }^d(t,t^{\prime })$ correspond to defender obedience constraints (3). Finally, the variables $\gamma \left(\lambda \right)$ correspond to constraints (4).

Problems (5)–(7) have an exponential number of constraints. We employ the ellipsoid method [35] by designing a polynomial–time separation oracle. In this oracle, given a value of $({\alpha }^{\lambda }(t,t^{\prime }),{\beta }^d(t,t^{\prime }),\gamma \left(\lambda \right))$, it either establishes that this value is feasible for the problem or, if not, it outputs a hyper-plane separating this value from the feasible region. In the following, we focus on a particular type of oracle: those generating violated constraints. The oracle solves the following optimization problems; each corresponds to a fixed $\lambda$ and $s\left(a\right)$ (to be some target $t_0$),

$$\begin{array}{cc}\hfill & \underset{\mathbf{s}:s\left(a\right)=t_0}{min}{\sum }_{t^{\prime }}\left[U^{\lambda }(s(-a),t^{\prime })-U^{\lambda }\left(\mathbf{s}\right)\right]{\alpha }^{\lambda }(t_0,t^{\prime })\hfill \\ \hfill & +q\left(\lambda \right){\sum }_{d,t^{\prime }}\left[U^d(s(-a,-d),t^{\prime },t_0)-U^d\left(\mathbf{s}\right)\right]{\beta }^d(s\left(d\right),t^{\prime })\hfill \\ \hfill & -q\left(\lambda \right)U\left(\mathbf{s}\right)\hfill \end{array}$$

(8)

If the optimal objective of this problem is strictly less than $-\gamma \left(\lambda \right)$ for any $(\lambda ,t_0)$, it means we found a violated constraint corresponding to $({\mathbf{s}}^{*},\lambda )$, where ${\mathbf{s}}^{*}$ is an optimal solution of (8). We iterate over every $(\lambda ,t_0)$ to find all violated constraints and add them to the current constraint set.

Step 3: Establishing an efficient separation oracle. We now solve (8) for any given $(\lambda ,t_0)$. We further divide this problem into two sub-problems; each can be solved via bipartite matching (which is polynomial time). More specifically, we divide the signal set $\{\mathbf{s}:s\left(a\right)=t_0\}$ into two different subsets, as elaborated in the following.

Case 1 of Step 3: Attacked target is not covered. The first subset consists of all signals such that $t_0\notin s(-a)$; that is, none of the defenders are assigned to $t_0$. In this case, the attacker will receive a reward $R^{\lambda }\left(t_0\right)$ for attacking $t_0$, while every defender d receives a penalty $P^d\left(t_0\right)$. Thus, each of the following elements in (8) is straightforward to compute:

$$\begin{array}{cc}\hfill & U^{\lambda }(s(-a),t^{\prime })-U^{\lambda }\left(\mathbf{s}\right)=\left\{\begin{array}{cc}{P}^{\lambda }\left(t^{\prime }\right)-R^{\lambda }\left(t_0\right)\hfill & \mathrm{if}{t}^{\prime }\in s(-a)\hfill \\ R^{\lambda }\left(t^{\prime }\right)-R^{\lambda }\left(t_0\right)\hfill & \mathrm{if}{t}^{\prime }\notin s(-a)\hfill \end{array}\right.\hfill \\ \hfill & U^d(s(-a,-d),t^{\prime },t_0)-U^d\left(\mathbf{s}\right)\hfill \\ \hfill & =\left\{\begin{array}{cc}{C}^d\left(t^{\prime }\right)-C^d\left(s\left(d\right)\right)\hfill & \mathrm{if}{t}^{\prime }\ne t_0\hfill \\ R^d\left(t_0\right)+C^d\left(t_0\right)-P^d\left(t_0\right)-C^d\left(s\left(d\right)\right)\hfill & \mathrm{if}{t}^{\prime }=t_0\hfill \end{array}\right.\hfill \\ \hfill & U\left(\mathbf{s}\right)={\sum }_d{P}^d\left(t_0\right)+C^d\left(s\left(d\right)\right)\hfill \end{array}$$

Given the above computation, we observe that the second and third components (in the second and third lines) of the objective (8), which only depends on the defender utilities, consists of multiple terms—each term depends only on the allocation of each individual defender $(d,s(d\left)\right)$. On the other hand, the first component (in the first line) of the objective, which depends on the attacker’s utility, has terms which depend on targets not in the defender allocation. Therefore, in order to create a corresponding bipartite matching problem, we introduce $\left|\mathbf{T}\right|$ new dummy defenders and the following weights between $\left|\mathbf{T}\right|+\left|\mathbf{D}\right|$ defenders and $\left|\mathbf{T}\right|+\left|\mathbf{D}\right|$ targets:

$$\begin{array}{cc}\hfill & \eta (d,t)=q\left(\lambda \right){\sum }_{t^{\prime }\ne t_0}\left[C^d\left(t^{\prime }\right)-C^d\left(t\right)\right]{\beta }^d(t,t^{\prime })\hfill \\ \hfill & +q\left(\lambda \right){\sum }_{t^{\prime }=t_0}\left[R^d\left(t_0\right)+C^d\left(t_0\right)-P^d\left(t_0\right)-C^d\left(t\right))\right]{\beta }^d(t,t^{\prime })\hfill \\ \hfill & +[P^{\lambda }\left(t\right)-R^{\lambda }\left(t_0\right)]{\alpha }^{\lambda }(t_0,t)-q\left(\lambda \right)C^d\left(t\right),\forall t\ne t_0,d\le \left|\mathbf{D}\right|\hfill \\ \hfill & \eta (d,t_0)=+\infty ,\forall d\le \left|\mathbf{D}\right|\hfill \\ \hfill & \eta (d,t)=[R^{\lambda }\left(t\right)-R^{\lambda }\left(t_0\right)]{\alpha }^{\lambda }(t_0,t),\forall t,\mathrm{dummy}d>\left|\mathbf{D}\right|\hfill \end{array}$$

Weights associated with these dummy defenders correspond to the terms in (8), which depends on targets not in the actual defender allocation. The weight $\eta (d,t_0)=+\infty$ is to ensure that no actual defender in $\mathbf{D}$ will be assigned to $t_0$.

We now present Lemma 2 (which can be proved via a couple of algebraic computation steps), showing that Problem (8) becomes a Minimum Bipartite Matching between $\left|\mathbf{T}\right|+\left|\mathbf{D}\right|$ defenders and $\left|\mathbf{T}\right|+\left|\mathbf{D}\right|$ targets.

Lemma 2.

The problem (8) can now be reduced to the following bipartite matching problem using $\eta (d,t)$:

$$\begin{array}{cc}\hfill & \underset{\mathbf{m}}{min}{\sum }_d\eta (d,m\left(d\right))\hfill \end{array}$$

after removing the constant term $-q\left(\lambda \right){\sum }_{d\in \mathbf{D}}{P}^d\left(t_0\right)$ in (8). Here, $m\left(d\right)$ is a target matched to the defender d.

Case 2 of Step 3: Attacked target is covered. On the other hand, the second subset consists of all signals such that $t_0$ is assigned to one of the defender. In this case, we further divide this sub-problem into multiple smaller problems by fixing the defender who covers $t_0$, denoted by $d_0$. Similar to Sub-problem P1, we introduce the following weights: $\forall t$

$$\begin{array}{cc}\hfill & \eta (d,t)=q\left(\lambda \right){\sum }_{t^{\prime }}[C^d\left(t^{\prime }\right)-C^d\left(t\right)]{\beta }^d(t,t^{\prime })\hfill \\ \hfill & +[P^{\lambda }\left(t\right)-P^{\lambda }\left(t_0\right)]{\alpha }^{\lambda }(t_0,t)-q\left(\lambda \right)C^d\left(t\right),\forall t,\forall d\in \mathbf{D}\backslash \left\{d_0\right\}\hfill \\ \hfill & \eta (d,t)=[R^{\lambda }\left(t\right)-P^{\lambda }\left(t_0\right)]{\alpha }^{\lambda }(t_0,t),\forall t,\mathrm{dummy}d>\left|\mathbf{D}\right|\hfill \end{array}$$

Lemma 3.

The problem (8) can now be reduced to the following bipartite matching problem using $\eta (d,t)$:

$$\begin{array}{c}\hfill \underset{\mathbf{m}}{min}{\sum }_{d\ne d_0}\eta (d,m\left(d\right))\end{array}$$

after removing the constant terms ${\sum }_{t^{\prime }\ne t_0}[P^{d_0}\left(t_0\right)+C^{d_0}\left(t^{\prime }\right)-R^{d_0}\left(t_0\right)-C^{d_0}\left(t_0\right)]{\beta }^{d_0}(t_0,t^{\prime })-q\left(\lambda \right){\sum }_d{R}^d\left(t_0\right)$. In addition, $(d_0,t_0)$ is removed from our matching setting.

We now have the problem of a Minimum Bipartite Matching between $\left|\mathbf{T}\right|+\left|\mathbf{D}\right|-1$ defenders to $\left|\mathbf{T}\right|+\left|\mathbf{D}\right|-1$ targets, which can be solved in polynomial time.

4. Optimal Ex Ante Private Signaling

This section relaxes the private signaling requirement and assumes that players make decision on whether to follow signals or not before any signal is sent. Such ex ante private signaling has been studied recently in routing [13] and abstract games [36]. However, both works used the ellipsoid algorithm to compute the optimal scheme. While the ellipsoid algorithm is theoretically efficient, as we will show in our experiments, is it practically quite slow. In our case, we could have also just employed a similar technique. However, we take one step further and present a novel idea of using a compact representation of the signaling schemes such that the “reduced” signaling space becomes polynomial size for the number of targets. This important result helps to significantly scale up the problem computation.

4.1. An Exponential-Size LP Formulation

Overall, the problem of finding an optimal ex ante private signaling scheme can be formulated as the following LP, which has an exponential number of variables $\left\{\omega \right(\mathbf{s}\mid \lambda \left)\right\}$:

$$\begin{array}{cc}\hfill & max{\sum }_{\lambda }q\left(\lambda \right){\sum }_{\mathbf{s}}\omega (s\mid \lambda )U\left(\mathbf{s}\right)\mathrm{s}.\mathrm{t}.\hfill \\ \hfill & (\mathrm{Attacker}\mathrm{obedience})\forall \lambda ,t^{\prime }:\hfill \end{array}$$

(9)

$$\begin{array}{cc}\hfill & {\sum }_s\omega (\mathbf{s}\mid \lambda )U^{\lambda }\left(\mathbf{s}\right)\ge {\sum }_{\mathbf{s}}\omega (\mathbf{s}\mid \lambda )U^{\lambda }(s(-a),t^{\prime })\hfill \end{array}$$

(10)

$$\begin{array}{cc}\hfill & (\mathrm{Defender}\mathrm{obedience})\forall d,t^{\prime }:\hfill \end{array}$$

$$\begin{array}{cc}\hfill & {\sum }_{\lambda }q\left(\lambda \right){\sum }_{\mathbf{s}}\omega (\mathbf{s}\mid \lambda )U^d\left(\mathbf{s}\right)\hfill \\ \hfill & \ge {\sum }_{\lambda }q\left(\lambda \right){\sum }_{\mathbf{s}}\omega (\mathbf{s}\mid \lambda )U^d(s(-d),t^{\prime },s\left(a\right))\hfill \end{array}$$

(11)

$$\begin{array}{cc}\hfill & {\sum }_{\mathbf{s}}\omega (\mathbf{s}\mid \lambda )=1,\forall \lambda ,\omega (\mathbf{s}\mid \lambda )\ge 0,\forall \mathbf{s},\lambda \hfill \end{array}$$

(12)

Similar to private signaling, we show that the optimal ex ante signaling scheme can be computed in polynomial time (Theorem 2) by developing an ellipsoid algorithm.

Theorem 2.

The optimal private ex ante signaling scheme can be computed in polynomial time.

4.2. Compact Signaling Representation

As we mentioned previously, while the ellipsoid algorithm is theoretically efficient, it runs slowly in practice. Therefore, we further show that in this scenario, we can provide a compact representation of signaling schemes such that the signaling space is polynomial for the number of targets. This immediately leads to a polynomial time algorithm for optimal ex ante private signaling by directly solving the polynomial-size linear program. Given any signaling scheme $\omega$, we introduce the new variable $\omega (a\to t,d\to t^{\prime }\mid \lambda )$, which is the marginal probability that the attacker is sent to target t and the defender d is sent to target $t^{\prime }$ given that the attacker type is $\lambda$. In addition, we introduce $\omega (a\to t\mid \lambda )$, which is the probability the attacker is sent to t. Reformulating (9)–(11) based on these new variables is straightforward. For example, the objective (9) is reformulated as the following:

$$\begin{array}{cc}\hfill & {\sum }_{\lambda }q\left(\lambda \right){\sum }_{t,d}\omega (a\to t,d\to t\mid \lambda )R^d\left(t\right)+{\sum }_{\lambda }q\left(\lambda \right){\sum }_t[\omega (a\to t\mid \lambda )\hfill \\ \hfill & -{\sum }_d\omega (a\to t,d\to t\mid \lambda )]\left[{\sum }_d{P}^d\left(t\right)\right]+{\sum }_{\lambda }q\left(\lambda \right){\sum }_{t^{\prime },d}\left[{\sum }_t\omega (a\to t,d\to t^{\prime }\mid \lambda )\right]C^d\left(t^{\prime }\right)\hfill \end{array}$$

The crux of this section is the following theorem. It fully characterize the conditions under which the compact representation corresponds to a feasible ex ante signaling scheme.

Theorem 3.

The following conditions are necessary and sufficient conditions to generate a feasible ex ante signaling scheme from a compact representation $(\omega (a\to t\mid \lambda ),\omega (a\to t,d\to t^{\prime }\mid \lambda ))$:

$$\begin{array}{cc}\hfill & {\sum }_t\omega (a\to t\mid \lambda )=1,\forall \lambda \hfill \end{array}$$

(13)

$$\begin{array}{cc}\hfill & {\sum }_{t^{\prime }}\omega (a\to t,d\to t^{\prime }\mid \lambda )=\omega (a\to t\mid \lambda ),\forall \lambda ,d\hfill \end{array}$$

(14)

$$\begin{array}{cc}\hfill & {\sum }_d\omega (a\to t,d\to t^{\prime }\mid \lambda )\le \omega (a\to t\mid \lambda ),\forall \lambda ,t^{\prime }\hfill \end{array}$$

(15)

$$\begin{array}{cc}\hfill & \omega (a\to t\mid \lambda )\ge 0,\omega (a\to t,d\to t^{\prime }\mid \lambda )\ge 0,\forall \lambda ,t,d,t^{\prime }\hfill \end{array}$$

(16)

Proof. 

It is obvious that these conditions are necessary. Let us consider $\left\{\omega \right(a\to t\mid \lambda \left)\right\}$ and $\omega (a\to t,d\to t^{\prime }\mid \lambda )$ satisfying these conditions. We will show that these correspond to a feasible signaling scheme. First, we have:

$$\begin{array}{cc}\hfill & \omega (d\to t^{\prime }\mid a\to t,\lambda )=\frac{\omega (a\to t,d\to t^{\prime }\mid \lambda )}{\omega (a\to t\mid \lambda )}\hfill \end{array}$$

which is the probability of assigning defender d to target $t^{\prime }$ given the attacker is of type $\lambda$ and is assigned to target t. By fixing $\lambda$ and $a\to t_0$, we use $\omega (d\to t^{\prime })$ as an abbreviation of $\omega (d\to t^{\prime }\mid a\to t_0,\lambda )$ when the context is clear. We will prove that any $\left\{\omega \right(d\to t\left)\right\}$ satisfying the following conditions correspond to a feasible signaling scheme:

$$\begin{array}{cc}\hfill & {\sum }_t\omega (d\to t)=1,\forall d\hfill \\ \hfill & {\sum }_d\omega (d\to t)\le 1,\forall t\hfill \end{array}$$

In order to do so, we introduce the following general lemma:

Lemma 4.

For any a coverage vector $\left\{\omega \right(d,t\left)\right\}$ such that:

$$\begin{array}{cc}\hfill & {\sum }_t\omega (d,t)=r\hfill \end{array}$$

(17)

$$\begin{array}{cc}\hfill & {\sum }_d\omega (d,t)\le r,\hfill \end{array}$$

(18)

given $0\le r\le 1$, there is an assignment of defenders to targets, denoted by $(d_1,t_1),\dots (d_{\left|\mathbf{D}\right|},t_{\left|\mathbf{D}\right|})$, such that:6

• $\omega (d_i,t_i)>0$ for all $i\in \{1,\dots ,|\mathbf{D}\left|\right\}$
• Every maximally covered target t, i.e., ${\sum }_d\omega (d,t)=r$, is assigned to a defender; that is, $t\in \{t_1,\dots ,t_{\left|\mathbf{D}\right|}\}$.

Proof. 

Let $\mathbf{D}\left(t\right)=\{d:\omega (d,t)>0\}$ be the support defender set of target t. Similarly, we also denote by $\mathbf{T}\left(d\right)=\{t:\omega (d,t)>0\}$ the support target set of defender d. We divide the set of targets into two groups: (i) the group of all maximally covered targets ${\mathbf{T}}^{\mathrm{high}}=\{t:{\sum }_d\omega (d,t)\}=r$; and (ii) the group of other targets ${\mathbf{T}}^{\mathrm{low}}=\{t:{\sum }_d\omega (d,t)<r\}$. Without loss of generality, we represent ${\mathbf{T}}^{\mathrm{high}}=\{t_1,\dots ,t_H\}$ and ${\mathbf{T}}^{\mathrm{low}}=\{t_{H+1},\dots ,t_{\left|\mathbf{T}\right|+\left|\mathbf{D}\right|}\}$, where $\left\{t_i\right\}$ is a permutation of targets $\{1,\dots ,|\mathbf{T}|+|\mathbf{D}\left|\right\}$.

Step 1: Inclusion of high-coverage target group ${\mathbf{T}}^{\mathrm{high}}$. We first prove that there is a partial allocation from defenders to targets in ${\mathbf{T}}^{\mathrm{high}}$, denoted by $(d_1,\dots ,d_H)$, such that $d_i\in \mathbf{D}\left(t\right)$ for all $t_i\in {\mathbf{T}}^{\mathrm{high}}$, and they are pair-wise different, i.e., $d_i\ne d_j$ for all $t_i\ne t_j\in {\mathbf{T}}^{\mathrm{high}}$. We use induction with respect to t.

As a baseline, $t=1$, the above statement holds true. Let us assume this statement is true for some $t<|{\mathbf{T}}^{\mathrm{high}}|$. We will prove that it is also true for $t+1$. Let us denote by $(d_1,1),\dots ,(d_t,t)$ the current sequence of defender-to-target assignments. At target $t+1$, if there is $d\in \mathbf{D}(t+1)$ such that $d\ne d_j$ for all $j\le t$, then we obtain a new satisfactory partial assignment $\{(d_1,1),\dots ,(d_t,t),(d,t+1)\}$.

Conversely, if $\mathbf{D}(t+1)\subseteq \{d_1,\dots ,d_t\}$, without loss of generality, we assume $\mathbf{D}(t+1)=\{d_1,d_2,\dots ,d_{t^{\prime }}\}$ for some $t^{\prime }\le t$. We obtain:

Observation 1.

There exists a target $t_0\le t$ and a defender $d_0\notin \{d_1,\dots ,d_t\}$ such that $\omega (d_0\to t_0)>0$.

Indeed, if there is no such $(d_0,t_0)$, it means all targets $\{1,\dots ,t+1\}$ can only be assigned to one of the defenders in $\{d_1,\dots ,d_t\}$. As a result, we will have:

$$\begin{array}{cc}\hfill r\times (t+1)=\sum _{j^{\prime }=1}^{t+1}\sum _{d\in \mathbf{D}\left(j^{\prime }\right)}\omega (d,j^{\prime })& \le \sum _{j^{\prime }=1}^t\sum _{j^{″}\in \mathbf{T}\left(d_{j^{\prime }}\right)}\omega (d_{j^{\prime }},j^{″})\hfill \\ \hfill =r\times t& \left(\mathrm{contradiction}\right)\hfill \end{array}$$

(19)

Now, if that target $t_0\le t^{\prime }$, then we obtain a new partial assignment $\{\dots ,(d_0,t_0),\dots ,$$(d_{t_0},t+1)\}$ by assigning $d_0$ to target $t_0$ and reallocating $d_{t_0}$ to $t+1$ while keeping other assignments the same. On the other hand, if $t^{\prime }<t_0\le t$, it means $\mathbf{D}\left(j\right)\subseteq \{d_1,\dots ,d_t\}$ for all $j\le t^{\prime }$. Without loss of generality, let us assume that target $t_0=t^{\prime }+1$. We observe that there must exist a target $t_{00}\in \{1,\dots ,t\}\backslash \{t^{\prime }+1\}$ and a defender $d_{00}\notin \{d_1,\dots ,d_t\}\backslash \left\{d_{t^{\prime }+1}\right\}$ such that $\omega (d_{00}\to t_{00})>0$. Indeed, if there is no such $(d_{00},t_{00})$, it means all targets $\{1,\dots ,t+1\}\backslash \{t^{\prime }+1\}$ can be only assigned to one of the defenders in $\{d_1,\dots ,d_t\}\backslash \left\{d_{t^{\prime }+1}\right\}$. As a result, we have:

$$\begin{array}{cc}\hfill r\times t& =\sum _{j^{\prime }=1,j^{\prime }\ne t^{\prime }+1}^{t+1}\sum _{d\in {\mathbf{D}}_{j^{\prime }}}\omega (d,j^{\prime })\hfill \\ \hfill & \le \sum _{j^{\prime }=1,j^{\prime }\ne t^{\prime }+1}^t\sum _{j^{″}\in \mathbf{T}\left(d_{j^{\prime }}\right)}\omega (d_{j^{\prime }},j^{″})\hfill \\ \hfill & =r\times (t-1)\left(\mathrm{contradiction}\right)\hfill \end{array}$$

Now, if that target $t_{00}\le t^{\prime }$ and $d_{00}=d_{t^{\prime }+1}$, then we can do the swap $(d_{t^{\prime }+1},t_{00}),(d_{t_{00}},t+1),(d_0,t^{\prime }+1)$ while keeping other assignments the same. If that target $t_{00}\le t^{\prime }$ and $d_{00}\ne d_{t^{\prime }+1}$, then we can do a different swap $(d_{t_{00}},t+1),(d_{00},t_{00})$. Finally, if $t_{00}>t^{\prime }+1$, without loss of generality, we assume $t_{00}=t^{\prime }+2$. We repeat the above analysis process until at some point we either find a feasible assignment or reach the following situation:

• $\exists d_0\notin \{d_1,\dots ,d_t\}$ s.t $\omega (d_0\to t^{\prime }+1)>0$
• $\exists d_{00}\notin \{d_1,\dots ,d_t\}\backslash \left\{d_{t^{\prime }+1}\right\}$ s.t. $\omega (d_{00}\to t^{\prime }+2)>0$
• …
• $\exists d_{\mathrm{final}}\notin \{d_1,\dots ,d_{t^{\prime }}\}$ and $\exists t_{\mathrm{final}}\in \{1,\dots ,t^{\prime }\}$ such that $\omega (d_{\mathrm{final}}\to t_{\mathrm{final}})>0$ where $\mathrm{final}={\left[0\right]}^{t-t^{\prime }}$.

In this situation, we first swap $(d_{t_{\mathrm{final}}},t+1),(d_{\mathrm{final}},t_{\mathrm{final}})$. There are two cases. If $d_{\mathrm{final}}\notin \{d_1,\dots ,d_t\}$, then we found a solution. If $d_{\mathrm{final}}$ is equal to some $d_{t^{\prime }+j}$ for some $j\le t-t^{\prime }$, we then reassign $(d_{{\left[0\right]}^{t^{\prime }+j}},t^{\prime }+j)$. At this step, there are two cases again. That is, either $d_{{\left[0\right]}^{t^{\prime }+j}}\notin \{d_1,\dots ,d_t\}$, or $d_{{\left[0\right]}^{t^{\prime }+j}}$ is one of $\{d_{t^{\prime }+1},\dots ,d_{t^{\prime }+j-1}\}$. The former case means we found a solution, while the latter case indicates we have to do the reassignment again for a target in $\{t^{\prime }+1,\dots ,t^{\prime }+j-1\}$. Observe that every time we have to do a reassignment, the index of the target for the reassignment is decreased. In the end, it will reach target $t^{\prime }+1$, for which we can reassign $d_0\notin \{d_1,\dots ,d_t\}$ and obtain a feasible solution.

Step 2: Extension to include target group ${\mathbf{T}}^{\mathrm{low}}$. We are going to prove that there is an assignment from defenders $\mathbf{D}$ to $\left|\mathbf{D}\right|$ targets that includes all targets in ${\mathbf{T}}^{\mathrm{high}}$. We apply induction with respect to the defender d. Note that we cannot apply induction with respect to the targets t since we include target group ${\mathbf{T}}^{low}$ in this analysis, and as a result, the equality on the LHS of (19) no longer holds.

As a baseline, we start with the feasible assignment of the group ${\mathbf{T}}^{\mathrm{high}}$. Then at each induction step, we perform a defender–target swapping process that is similar to the case of the high-coverage target group ${\mathbf{T}}^{\mathrm{high}}$. The tricky part is that for any swapping, we do not get rid of any targets that have been assigned so far (besides changing the defender assigned to them). This means that in the final assignment of the induction process, denoted by $(1,t_1),\dots ,\left(\right|\mathbf{D}|,t_{\left|\mathbf{D}\right|})$, all targets in ${\mathbf{T}}^{\mathrm{high}}$ are still included. The details of this induction process are in the Appendix A. □

Based on the result of Lemma 4, we allocate the following non-zero probability to the assignment with $r=1$:

$$\begin{array}{cc}\hfill & p=min\{\underset{d}{min}\left\{\omega (d,t_d)\right\},r-\underset{t\notin \{t_1,\dots ,t_{\mathbf{D}}\}}{max}{\sum }_d\omega (d,t)\}\hfill \end{array}$$

Given this assignment, we update $w(d,t_d)=w(d,t_d)-p$ for all d. The resulting coverage vector $\left\{\omega \right(d,t\left)\right\}$ still satisfies the conditions (17) and (18) with the remaining $r=r-p<1$. We keep doing this probability allocation until we obtain a feasible signaling scheme (i.e., r reaches 0). □

5. Experiments

In our experiments, we aim to evaluate both the solution quality and runtime performance of our algorithms in various game settings. All the LPs in our algorithms are solved with the CPLEX solver (version 20.1). We run our algorithms on a machine with an Intel i7-8550U CPU and 15.5 GB memory. The rewards and penalties of players are generated uniformly at random between [0, 20] and [−20, 0], respectively. All data points are averaged over 40 random games, and the error bars represents the standard error.

We compare our private and ex ante signaling schemes with: (i) a baseline method in which each defender optimizes his utility separately by solving a Bayesian Stackelberg equilibrium between that defender and the attacker without considering the strategies of the other defenders; and (ii) the Nash Stackelberg equilibrium (NSE) among the defenders. We use the method provided in [5] to approximate an NSE. We evaluate our signaling schemes in two scenarios corresponding to two different objectives of the principal: (i) maximizing the social welfare of the defenders (Figure 1, Figure 2 and Figure 3); and (ii) maximizing her own defense utility (i.e., the principal is one of the self-interested defenders) (Figure 4). Next, we highlight our important results. Additional results can be found in the Appendix B.

In Figure 1 and Figure 2, the x-axis is either the defender’s cost range (the defense cost of each defender is randomly generated within this range), the number of targets, the number of defenders, or the number of attacker types. The y-axis is either the defender social welfare (Figure 1) or the average utility of the attacker (Figure 1). Note that in these figures, we do not consider the Nash Stackelberg equilibrium (NSE) among the defenders. This is because the method provided in [5] to approximate an NSE is only applicable for the no-patrolling-cost setting. Figure 1 shows that signaling schemes ($\mathtt{Private}$ and $\mathtt{ExAnte}$) help to significantly increase the defender social welfare compared to the $\mathtt{Baseline}$ case. In addition, the defender social welfare in $\mathtt{ExAnte}$ is substantially higher than in the $\mathtt{Private}$ case. This result makes sense, since the persuasion constraints in $\mathtt{ExAnte}$ are less restricted. In addition, the social welfare is roughly a decreasing linear function of the cost range and the number of targets, while it increases linearly for the number of defenders. This is because the social welfare is a decreasing function of the defenders’ coverage probability at each target, and the higher the number of defenders is, the more coverage there is at each target. Conversely, we see an opposite trend in the attacker graphs (Figure 2).

Furthermore, we include the NSE in our experiments with no defense cost. Figure 3 shows that despite $\mathtt{NashStackelberg}$ resulting in higher social welfare for the defenders compared to $\mathtt{Baseline}$, in which each defender ignores the presence of other defenders, the social welfare in $\mathtt{NashStackelberg}$ is still significantly lower than that in $\mathtt{Private}$ and $\mathtt{ExAnte}$. The results in Figure 1, Figure 2 and Figure 3 clearly show that coordinating the defenders through the principal’s signaling schemes helps to significantly enhance the protection effectiveness on the targets.

In Figure 4, we examine the situation in which the principal attempts to maximize her own utility (given she is one of the self-interested defenders). We again observe that the attacker suffers a significant loss in utility compared to $\mathtt{Baseline}$ (Figure 4a, $\mathtt{Private}$ and $\mathtt{ExAnte}$ versus $\mathtt{Baseline}$). Conversely, the principal can get a significant benefit by strategically revealing her private information through the signaling mechanisms (Figure 4b).

Figure 5 shows the logarithm runtime of our algorithms compared to $\mathtt{Baseline}$ and $\mathtt{NSE}$. We observe that our algorithms ($\mathtt{Private}$ and $\mathtt{ExAnte}$) are suitable for medium games. In Figure 5a, it takes $\mathtt{Private}$ and $\mathtt{ExAnte}$ approximately 23 min and 40 s, respectively, to solve 20-target games. Furthermore, our compact representation method ($\mathtt{ExAnteCompact}$) helps solve the signaling scheme significantly faster. It only takes $\mathtt{ExAnteCompact}$ approximately 2.7 s to solve 20-target games.

Finally, we examine the performance in the ex ante case with a large number of targets or attacker types in Figure 6. Our algorithms can easily scale to about 160 targets, which is a large improvement compared to previous works [37,38]. We remark that it is typically impossible to test running time for such complicated security games for more than 200 targets on a single machine (most real-world applications such as conservation area protection or border protection have fewer than 200 targets as well). For a large number of attacker types, our experiments show that the running time dependence of our algorithm with respect to the number of attacker types is linear, which is extremely efficient.

6. Summary

In this paper, we study information design in a Bayesian security game setting with multiple interdependent defenders. Our results (both theoretically and empirically) show that information design not only significantly improves protection effectiveness but also leads to efficient computation. In particular, in computing an optimal private signaling scheme, we develop an ellipsoid-based algorithm in which the separation oracle component can be decomposed into a polynomial number of sub-problems, and each sub-problem reduces to a bipartite matching problem. This is a non-trivial task, since the outcomes of private signaling form the set of Bayes correlated equilibria, and computing an optimal correlated equilibrium is a fundamental and well-known intractable problem. Our proof is technical and crucially explores the special structure of security games. Furthermore, we investigate the ex ante private signaling scheme. In this scenario, we develop a novel compact representation for the signaling schemes by compactly characterizing jointly feasible marginals. This finding enables us to significantly reduce the signaling scheme computation compared to the ellipsoid approach (which is efficient in theory but slow in practice).