ConceptioArchivearXiv CS
arXiv CSopen access

The Price of Ignorance: Information-Free Quotation for Data Retention in Machine Unlearning

Unknown · 2026 · arxiv_cs
arXiv CS · Papers · License: Open Access · 2026
Open Source ↗Direct PDF ↓
machine learning, deep learning, neural networks

1

The Price of Ignorance: Information-Free Quotation for Data Retention in Machine Unlearning

arXiv:2604.11511v1 [cs.GT] 13 Apr 2026

Bin Han, Senior Member, IEEE, Di Feng, Zexin Fang, Student Member, IEEE, Jie Wang, Member, IEEE, and Hans D. Schotten Member, IEEE

Abstract—When users exercise data deletion rights under the General Data Protection Regulation (GDPR) and similar regulations, mobile network operators face a tradeoff: excessive machine unlearning degrades model accuracy and incurs retraining costs, yet existing pricing mechanisms for data retention require the server to know every user’s private privacy and accuracy preferences, which is infeasible under the very regulations that motivate unlearning. We ask: what is the welfare cost of operating without this private information? We design an information-free ascending quotation mechanism where the server broadcasts progressively higher prices and users self-select their data supply, requiring no knowledge of users’ parameters. Under complete information, the protocol admits a unique subgame-perfect Nash equilibrium characterized by single-period selling. We formalize the Price of Ignorance—the welfare gap between optimal personalized pricing (which knows everything) and our information-free quotation (which knows nothing)—and prove a three-regime efficiency ordering. Numerical evaluation across seven mechanisms and 5000 Monte Carlo runs shows that this price is near zero: the information-free mechanism achieves ⩾ 99% of the welfare of its information-intensive benchmarks, while providing noise-robust guarantees and comparable fairness. Index Terms—Data privacy, data redemption, machine unlearning, data pricing, price of ignorance, LLM

I. I NTRODUCTION Large language model (LLM) and generative artificial intelligence (GenAI) are increasingly deployed in next-generation mobile networks for intelligent network management and operations [1]. Mobile network operators (MNOs) deploy LLMs for predictive maintenance, automated troubleshooting, traffic forecasting, and personalized service delivery. These applications require training on extensive user data–including cell handover records, packet inspection logs, geographic mobility B. Han, Z. Fang, and H. D. Schotten are with RPTU University Kaiserslautern-Landau, Germany. D. Feng is with Dongbei University of Finance and Economics, China. J. Wang is with Tongji University, China. H. D. Schotten is with the German Research Center for Artificial Intelligence (DFKI), Germany. B. Han ([email protected]) and D. Feng ([email protected]) are the corresponding authors. Part of this work has been accepted for publication at IEEE ICC 2026 Workshops. AI disclosure: In accordance with the IEEE policy on the use of AI, the authors disclose that Anthropic’s Claude was employed in a strictly assistive capacity during the preparation of this manuscript—limited to language polishing of author-drafted text, auxiliary verification of the mathematical derivations prepared by the authors, and minor refactoring and debugging assistance of author-designed simulation code. All research ideas, the system model, the analytical framework, the theorems and their proofs, the algorithm design, the experimental methodology, and the interpretation of results were conceived, developed, and verified by the human authors, who take full and sole responsibility for the content and correctness of the paper.

traces, and application usage patterns–to achieve acceptable accuracy. However, data collection raises privacy concerns: the data may contain sensitive information, and trained models may leak or misuse it against users’ will. In network operations, this tension is especially acute because user data fed into LLM training directly influences quality of service (QoS) for the entire user base, coupling individual privacy with collective network performance. Being aware of these privacy concerns, data regulations have been established in various countries and regions, represented by the General Data Protection Regulation (GDPR) in the European Union [2], the California Consumer Privacy Act (CCPA) in California [3], and the Personal Information Protection Law (PIPL) in China [4]. Such regulations generally require the service providers to obtain the users’ consent before collecting their data, and to provide the users with the right to delete their data afterwards. To enable the removal of user data from LLM training pipelines–both from stored datasets and deployed models– MNOs must implement machine unlearning [5]. Despite technical feasibility, excessive unlearning creates dual challenges for network operators: (1) computational overhead in retraining resource- intensive LLMs, and (2) degraded predictive accuracy that cascades into worse traffic management, increased latency, and higher outage rates [6]. A rigid unlearning policy thus harms both MNO operational efficiency and user experience, motivating market-based alternatives. This calls for a data redemption framework that balances unlearning cost against privacy protection. A natural approach is data monetization: the LLM service provider offers users compensation to retain their data rather than redeem it. Users then choose freely between privacy and compensation based on their own preferences, while the provider benefits from reduced unlearning cost and better model accuracy. The central challenge is to determine the price of data. While data pricing has been studied in the context of data marketplaces [7], existing works focus on active data trading for model training and largely ignore the redemption and unlearning scenario. This gap makes existing pricing models inapplicable to the data redemption context. For example, works such as [8] ignore users’ privacy loss when they sell data, while others such as [9], though accounting for privacy, do not capture the computational cost of unlearning. Cui and Cheung [6] first addressed pricing in data redemption, proposing an incentive mechanism for machine unlearning. Their model accounts for the server’s unlearning

2

cost (computation and accuracy degradation) and the users’ privacy utility. A two-stage optimization is formulated: the server first determines an optimal unit price for user data, then each user decides how much data to sell. The work in [6] has two limitations. First, the server’s optimal pricing relies on distributional assumptions about users’ privacy parameters that may not hold in practice. Second, the two-stage mechanism returns a single uniform price for all users and data batches; given heterogeneous privacy concerns and non-linear privacy utility, this can lead to suboptimal outcomes. Both limitations share a common root: the server must know or estimate users’ private parameters to set optimal prices. This raises a natural question: what is the welfare cost of operating without any such knowledge? We call this the Price of Ignorance. To answer it, we propose an iterative price discovery mechanism based on ascending quotations. The server (MNO) progressively raises the unit price for data retention, and users independently determine their supply at each quoted price—no user profiling, no parameter estimation. This enables flexible pricing that accommodates the non-linear cost and utility functions of both sides. Our key contributions are: 1) We extend the user payoff model of [10] with accuracyaware users who incur disutility from model accuracy degradation, and a generalized privacy function parameterized by elasticity ki . 2) We prove that under the ascending-price quotation, concentrating all sales in a single period is a strictly dominant strategy for each user (Theorem 1), and the resulting sequential game admits a unique subgame-perfect Nash equilibrium (SPNE) under complete information, characterized by backward induction (Theorem 2). 3) We formalize the Price of Ignorance—the welfare gap between the information-intensive Optimal Personalized Pricing (OPP) and our information-free IncompleteInformation Quotation (IIQ)—and establish the ordering OPP ⩾ Complete-Information Quotation (CIQ) ⩾ IIQ, where the CIQ–IIQ gap depends on the oversupplyhandling strategy (Proposition 2). 4) We show that IIQ is robust to parameter estimation noise: unlike OPP, which requires the server to know every user’s (λi , ki , θi ), IIQ provides noise-independent welfare guarantees. 5) Numerical evaluation across seven mechanisms and 5000 Monte Carlo runs shows that the Price of Ignorance is near zero: IIQ achieves ⩾ 99% of OPP welfare, with comparable fairness across all mechanisms. The paper is organized as follows. Section II reviews related work. Section III presents the system model. Sections IV–V analyze user incentives and propose the quotation mechanism. Section VI extends the model to accuracy-aware users and derives the SPNE. Section VII compares the efficiency of three regimes. Section VIII provides numerical evaluation. Section IX discusses practical implications. Section X concludes.

II. R ELATED W ORK A. Machine Unlearning Machine unlearning removes a data contributor’s influence from a trained model without full retraining. The concept was first formalized by Cao and Yang [11], who proposed converting learning algorithms into summation forms to enable efficient data removal. Bourtoule et al. [12] introduced the SISA framework, which partitions training data into shards to limit the retraining scope upon deletion requests. Subsequent works addressed unlearning in specific settings: Ginart et al. [13] for k-means clustering, Brophy and Lowd [14] for random forests, Neel et al. [15] for gradient-based models via descentto-delete, and Nguyen et al. [16] for Markov chain Monte Carlo based approaches. Gupta et al. [17] proposed adaptive unlearning with formal guarantees. Golatkar et al. [18] introduced selective forgetting in deep networks using Fisher information, and Sekhari et al. [19] established theoretical bounds separating unlearning from differential privacy. Recent surveys [5], [20] cover the breadth of unlearning techniques. Unlearning in LLMs poses particular challenges, since the scale of models and training data makes full retraining prohibitively expensive [21]. Liu et al. [22] extended unlearning to federated settings. On the adversarial side, Marchant et al. [23] demonstrated poisoning attacks that increase unlearning cost, while Thudi et al. [24] argued that auditable algorithmic definitions are necessary for meaningful unlearning guarantees. Yet the economic side of unlearning— how data deletion rights affect the value proposition for data holders and model operators—remains largely open.

B. Data Pricing and Valuation Data pricing in data marketplaces has received considerable attention [7], [25]: Fernandez et al. [26] developed data trading platforms, and Acemoglu et al. [27] analyzed pricing inefficiencies. Foundational approaches include querybased pricing [28], where buyers pay per query, and Shapleyvalue-based data valuation [29]–[31], which distributes the value of a trained model among data contributors. Agarwal et al. [32] designed marketplace mechanisms with arbitragefree pricing guarantees. Another line of work treats data as labor [33], arguing that users should be compensated for their data contributions—a view that aligns with our redemption pricing framework. However, existing data pricing works address forward data trading—sellers supply data for model training. The reverse scenario of data redemption, where data owners reclaim already-contributed data from deployed models, inverts the standard marketplace roles: the service provider holds the good (retained data) and the user exercises a deletion right. Cong et al. [34] studied pricing in ML pipelines but did not consider unlearning costs. Our work addresses this gap with pricing mechanisms for data redemption, where the server’s cost function captures both accuracy degradation and retraining overhead.

3

C. Incentive Mechanism Design Mechanism design for data-related decisions has been applied in federated learning and crowdsourcing. Kang et al. [35] proposed a joint optimization approach for reliable federated learning with reputation-based incentives. Zhan et al. [36] designed learning-based incentive mechanisms for heterogeneous federated learning participants. Le et al. [37] addressed incentives in wireless cellular networks. For privacy-aware settings, Jin et al. [38] designed mechanisms for data crowdsourcing under differential privacy [39] constraints, and Ghosh and Roth [40] studied selling privacy at market. Acquisti et al. [41] surveyed the economics of privacy, and Acquisti and Grossklags [42] showed that individuals’ privacy decisions are bounded-rational, motivating mechanism designs that do not rely on users’ strategic sophistication—a perspective that directly supports our IIQ mechanism. Most closely related to our work is the line of research by Cui and Cheung [6], [10], who introduced the data redemption pricing problem and proposed a bilevel optimization framework. Their model captures both server cost (accuracy degradation and retraining time) and user privacy utility. However, their mechanism requires the server to know or estimate every user’s privacy parameter λi to compute optimal personalized prices. Our work relaxes this requirement by proposing an information-free quotation mechanism where the server sets a uniform ascending price and users self-select, requiring no user profiling. A distinctive feature of our setting is that it involves divisible goods—users choose continuous supply quantities rather than binary sell/keep decisions—and the server’s demand is price-elastic through the accuracy loss function.

non-negative. Defining the total data amount for each user i I P as di , and their sum d = di , according to [6]: i=1

A(x) = A1 aA2 x − A3 , ( 0 if x = 0, T (x) = T0 (d − x) if x ∈ (0, d].

(1) (2)

From the server’s perspective it is more convenient to focus on the amount of data to keep, i.e. to buy from the users, rather than the amount of data to redeem. So we define that yi = di − xi and y = d − x, and rewrite the cost function as C(y) = αA(y) + βT (y), A2 (d−y)

A(y) = A1 e ( T0 y T (y) = 0

(3)

− A3 ,

(4)

if y ∈ [0, d), if y = d.

(5)

B. User Privacy Model Following [6] we consider that for each user i ∈ I the utility of privacy is captured by Ui (xi ) = λi ln(xi + 1),

(6)

where λi is its privacy parameter. Similarly, focusing on the amount of data to keep on the server, we rewrite it As Ui (yi ) = λi ln(di − yi + 1),

(7)

which is concave and monotonically decreasing w.r.t. yi . IV. I NCENTIVE A NALYSES

III. S YSTEM M ODEL We model the interaction between an MNO deploying LLMs for network optimization and its user base. The MNO (henceforth “server”) operates an LLM trained on aggregated user data to perform tasks such as: • Traffic prediction: Forecasting bandwidth demand for proactive resource allocation; • Anomaly detection: Identifying network faults or security threats; • Service personalization: Recommending optimal connectivity plans. Each user i ∈ I has contributed data di (measured in normalized units, e.g., number of mobility records or session logs). Under GDPR Article 17, users may request data deletion, triggering machine unlearning obligations. The following cost and utility models capture the economic tradeoffs. A. Server Cost Model Considering the cost model in [6] that C(x) = αA(x) + I P βT (x), where x = xi , xi is the amount of data redemption i=1

for user i ∈ I, A(x) is the accuracy degradation of the model caused by unlearning, and T (x) the computing time for executing the unlearning task. Note that α, A, β, T are all

A. Server’s Incentive to Purchase Data The server has an incentive to keep as much data as to minimize the cost of unlearning. We denote this target amount of data to keep as ymax . Note that C(y) has one and only one jump discontinuity at y = d, for simplification of discussion we first focus on the continuous interval y ∈ [0, d), and leave the case of y = d for later discussion in Sec. V-E. Thus, C(y) is in general a convex function over y ∈ [0, d), while its monoticity, depending on the specific parameter settings, may have three diffferent cases, as shown in Fig. 1: 1): monotonically increasing, 2): monotonically decreasing, or 3): non-monotone. In the first case, trivially, the server will not keep any data and ymax = 0. In the second case, the server tend to keep all data and ymax → d− . In the third case, ymax can be obtained by looking for the zero derivative: dC(y) = (−αA1 A2 ln a)aA2 (d−ymax ) + βT0 = 0, (8) dy ymax   1 αA1 A2 ln a ⇒ ymax = d + loga . (9) A2 βT0 Now assume that the server has already managed to keep y < ymax amount of data, and offers to buy more data from

4

1.75 1.50 C(y)/C(0)

so there is a minimal price for user i to sell any amount of data in addition to the already-sold yi :

Case 1 Case 2 Case 3 Minimums

1.25

lim Bmin,i (yi , δi ) =

δi →0

λi , di − y i + 1

(16)

and a minimal price for user i to sell all the remaining data:

1.00

λi ln(di −yi +1). (17) di − yi

0.75

Ball,i (yi ) = Bmin,i (yi , di −yi ) =

0.50

Moreover, given that user i has already sold yi in priori, there is a maximal amount of data qi it is willing to sell to the server at price p, which we call i’s supply:

0.0

0.2

0.4

y/d

0.6

0.8

1.0

qi (yi , B) = arg max [pδ + ∆Ui (yi , δ)] . δ∈[0,di −yi ]

Fig. 1: Different cases of the server’s cost function.

  = arg max pδ + λi ln 1 − users at a price B per unit amount of data. The server’s demand η will be a function of the condition (y, B), which is: η(y, B) = arg max [C(y) − C(y + δ) − Bδ]

(10)

δ∈[0,ymax −y]

h

= arg max

i

αA1 eA2 (d−y) (1 − e−A2 δ) ) − (βT0 + B)δ .

δ∈[0,ymax −y]

Especially, noticing that C(y) is always monotonic over the interval y ∈ [0, ymax ), there is a unique maximum price Ball (y) to support a “buy all” strategy: C(ymax ) − C(y) ymax − y  (11) αA1 eA2 d e−A2 ymax − e−A2 y + βT0 . = ymax − y With y data already bought from the users, given any price B ⩽ Ball (y), the server will buy as much data from the users as possible, until it reaches the maximum amount ymax of data to keep. Note that in case of y-increasing cost C (Case 1 in Fig. 1), Ball ⩽ 0 and ymax = 0. Ball (y) =

B. User’s Incentive to Sell Data Given the price B offered by the server, each user i can decide how much data it will sell to the server, based on how much data yi it has already sold previously. The change of privacy utility of selling δi more data is ∆Ui (yi , δi ) = Ui (yi + δi ) − Ui (yi )   δi =λi ln 1 − , di − y i + 1

(12)

so the minimum price to convince user i to sell δi more data must compensate this utility loss: −∆Ui (yi , δi ) Bmin,i (yi , δi ) = δi   λi δi = ln 1 + . δi di − yi + 1 − δi

(13)

(18)

 .

V. Q UOTATION -BASED P RICE D ISCOVERY M ECHANISM A. Quotation-Based Price Discovery Protocol To balance the server’s cost of unlearning and the users’ privacy utility, we propose an iterative price discovery mechanism through sequential quotations. The protocol operates as follows: 1) At the beginning of each round t, the server updates its price B t for buying unit data from the users. We focus in this study on the ascending quotation format, where the data price is increasing w.r.t. time, i.e., for all t < τ , B t < B τ . It also estimates its demand for data η t = η(y t , B t ), which is unknown to the users. If the demand drops to zero, the quotation is terminated. Otherwise, the price is quoted to all users. 2) Each user then independently decides how much data it can supply at this price. 3) The server purchases the data from all users who are willing to sell at the quoted price. If the total supply exceeds its demand, it will only purchase its demanded amount of data. Otherwise, it will buy all data supplied. 4) If the server has collected the target amount of data ymax , the quotation is terminated. Otherwise, t ← t + 1, and go back to step 1) for the next round. For the sake of low communication overhead and privacy protection, our approach is to let the users make decisions independently from each other. Thus, each user i is considered blind in the sense that at each period t, i only knows the current data price B t , its own privacy parameter λi , its own data amount di , and its own history of data selling (yiτ )τ <t . As we are considering an ascending quotation, the price quoted by the server along the time assembles an ascending series (B τ )1⩽τ <∞ . B. Users’ Selling Strategy

It is trivial that for all yi ∈ [0, di ) and δi ⩾ 0: ∂ Bmin,i (yi , δi ) > 0, ∂yi ∂ Bmin,i (yi , δi ) > 0, ∂δi

δ∈[0,di −yi ]

δ di − yi + 1

(14) (15)

Noticing the t-monotonically increasing price B t , when a user has incentive to sell data in round t, it has also the alternative option of keeping the data to sell it at higher price in a future round. Herewith we discuss the optimal selling strategy of users in such multi-round quotation.

5

Suppose the quotation is now at the beginning of round t. Each user i’s current remaining data that can be sold is xti ⩾ 0. Given the information that i knows, i forms a belief µti ∈ [0, 1], which represents a subjective probability that the quotation is terminated after round t. Thus, µti is a function about server’s remaining demand η t at t, and the supply qjt of all users j ∈ I. Moreover, at t, since i only knows its own history (yiτ )τ <t , and that yjτ is non-decreasing about τ for all j ∈ I, µti is increasing with i’s own sold data yit , and the collection (µτi )1⩽τ <∞ is (point-wisely) decreasing with τ , for any (yiτ )1⩽τ <∞ . Let ti be the first period that i decides to sell, where according to the data price B ti , the optimal amount of selling for i is automatically given by (18). Denote this amount of data be qiti = qi (0, B ti ) > 0. If qiti = di , it is straightfoward. Otherwise, supposing qiti < di , by the section of ti we have µtii (qiti ) · V (qiti , B ti ) ⩾ [1 − µtii (0)] · V (qiti +1 , B ti +1 ), (19) where V (y, B) is i’s benefit by selling the amount of data y with price B, according to his utility. Thus, Eq. (19) implies that the expected payoff of selling at ti is higher than the expected payoff of keeping data at ti . In other words, as long as the users are blind about the server’s demand and other users’ trade record, they always perform the greedy strategy in selling data. Furthermore, rearranging Eq. (19), we have µtii (qiti ) V (qiti +1 , B ti +1 ) ⩾ . [1 − µtii (0)] V (qiti , B ti )

(20)

With the aforementioned monotonicity of µi , we also have µtii (qiti ) µtii +1 (qiti +1 ) ⩾ . [1 − µtii (0)] [1 − µtii +1 (0)]

(21)

(22)

(24)

where Fi0 is a cumulative distribution function on [B 0 , ∞). After observing that the quotation is still active at round t (equivalently, B T > B t ), user i updates via Bayes’ rule: Fi0 (b) − Fi0 (B t ) , b > Bt. 1 − Fi0 (B t ) (25) This is simply the left-truncation of the prior at B t . The belief µti introduced above—the subjective probability that the quotation terminates after round t—is now given by Fit (b) = Pr(B T ⩽ b | B T > B t ) =

fi0 (B t ) · ∆B + o(∆B), 1 − Fi0 (B t ) (26) where fi0 is the density of the prior. For small ∆B, this is approximately the hazard rate of the prior distribution evaluated at B t1 : µti ≈ hi (B t ) · ∆B,

Thus, we can obtain that µtii +1 (qiti +1 ) V (qiti +2 , B ti +2 ) ⩾ . [1 − µtii +1 (0)] V (qiti +1 , B ti +1 )

B T ∼ Fi0 ,

µti = Pr(B T ⩽ B t+1 | B T > B t ) =

By the definitions of q and V , i’s marginal benefit is decreasing, and hence V (qiti +1 , B ti +1 ) V (qiti +2 , B ti +2 ) ⩾ . ti V (qi , B ti ) V (qiti +1 , B ti +1 )

1) Why Termination Price, Not Demand: Recall that at round t, user i observes only the current price B t and whether the quotation is still active. Since the ascending price schedule is deterministic, knowing B t is equivalent to knowing t. The only informative signal is the continuation event: the fact that the server has not yet terminated the quotation. A user cannot directly estimate the server’s remaining demand η t , as this depends on the server’s private cost function C(·), the aggregate supply from all other users, and the total data endowment d—none of which is observable. However, the user can form beliefs about the termination price B T — the price at which the server’s demand is fully satisfied and the quotation ends—because: • At each round t where the quotation remains active, the user learns that B T > B t , i.e., the termination price exceeds the current price. • When the quotation terminates at some round T , the user observes B T = B 0 + T · ∆B exactly. Thus, B T is a scalar quantity on which the user receives a sequence of increasingly informative signals, making Bayesian estimation both feasible and natural. 2) Intra-Event Learning: At the start of a redemption event, user i holds a prior belief over the termination price:

(23)

Eq. (23) implies, if i starts to sell data at ti , it will also choose to sell data in all future rounds, until having all its data sold.

C. Bayesian Belief Model The greedy selling strategy above relies on the belief µti — the subjective probability that the quotation terminates after round t. We now formalize how a rational user forms and updates this belief through Bayesian learning.

hi (b) ≜

fi0 (b) . 1 − Fi0 (b)

(27)

Remark 1 (Monotonicity and Hazard Rate). The monotonicity of µti assumed above (decreasing over time for fixed selling history) corresponds to the prior Fi0 having a decreasing hazard rate (DHR). This holds for many common distributions, including Pareto, log-normal (in certain parameter ranges), and mixture distributions. Economically, DHR means that conditional on the quotation surviving to round t, the probability of termination in the next round decreases—reflecting the 1 The hazard rate h (b) is the reciprocal of the term 1−F (b) that appears i f (b)

in Myerson’s virtual value ϕ(b) = b − 1/h(b) from optimal mechanism design [43]. While structurally related, the two quantities play different roles: Myerson’s virtual value is used by a mechanism designer to screen buyer types, whereas here the hazard rate drives the user’s own selling-timing decision under subjective beliefs about the termination price.

6

intuition that a quotation that has lasted long is likely to last longer. 3) Reinterpretation of Greedy Strategy: The selling condition (19) can be reinterpreted through the Bayesian lens:   hi (B ti )·V (qiti , B ti ) ⩾ V (qiti +1 , B ti +1 )· 1 − hi (B ti ) · ∆B , (28) making the hazard rate hi (B ti ) the key determinant of selling timing. Under DHR priors, the hazard rate decreases in B t , so the greedy strategy (once-start-never-stop) from Eq. (23) remains optimal. Under increasing hazard rate priors, users may marginally benefit from waiting, but the effect vanishes as O(∆B) for small price increments. 4) Inter-Event Learning: When the server runs multiple redemption events over time (e.g., after model updates or new data collection cycles), users can refine their prior Fi0 from past observations. Assumptions: We require two conditions for cross-event learning to be meaningful: (a) Stationary server type: The server’s cost structure (A(·), T (·), α, β) is approximately stable across events. This is reasonable when the server’s model architecture and retraining infrastructure do not change drastically. (b) Approximate population stability: The user pool and its aggregate characteristics (distribution of λi , θi , di ) do not shift dramatically between events. Under (a) and (b), similar cost structure and user pool produce similar optimal data retention ymax and hence similar termination prices B T across events. Learning mechanism: Suppose user i has participated in n past redemption events, observing realized termination prices B T1 , B T2 , . . . , B Tn . The user forms the prior for event n + 1 by fitting Fi0 to this sample. For instance, under a parametric model B T ∼ Gamma(α0 , β0 ), standard conjugate Bayesian updating yields closed-form posteriors. Data accumulation dynamics: Between redemption events, each user i continues to generate new data that is incorporated into the server’s model through normal operation. Let gin denote the amount of new data generated by user i during the interval between events n and n+1. Then the data endowment at event n + 1 is dn+1 = yin + gin , (29) i where yin is the data retained by the server from event n (which remains in the model), and gin is the newly accumulated data. Data that was unlearned in event n (i.e., dni − yin ) has been removed from the model and does not reappear unless the user re-consents. This creates a dynamic linkage between events: a user who sells more data in event n (higher yin ) enters event n + 1 with a larger data endowment, and hence potentially higher privacy stakes. Combined with the refined prior Fi0 from the learning mechanism above, the user’s selling threshold evolves across events—capturing both informational learning (about B T ) and strategic positioning (through data accumulation). Remark 2 (Event Frequency and Strategic Patience). The frequency of redemption events does not directly inform the

user about the termination price B T within any given event. A server running quarterly events may reach the same B T as one running annually. However, event frequency affects the user’s strategic patience through two channels. First, frequent events reduce the temporal discounting of future selling revenue: the user can participate in a nearby future event rather than waiting a long time, lowering the opportunity cost of not selling now. Second, since each user’s within-event supply (18) depends on the data endowment di , and this endowment evolves across events via (29), more frequent events mean smaller per-interval data accumulation gin , leading to a different supply profile at each subsequent event. Both effects influence supply behavior but are distinct from the belief about B T . D. Handling the Oversupply Due to the wide-sense B-monotonicity of η (decreasing) and qi (increasing) for all i ∈ I, when the quoted price B t I P is sufficiently high, it may occur the case of η t < qit , i.e. i=1

the total supply from users exceeds the server’s demand. In this case, the server shall allocate its demand η to the different selling users. While neither the unit price B t nor the demand η t is influenced by the allocation, the server’s purchase is independent therefrom, either. However, since the different users are of different characteristics (yi , λi ), the total payoff of users will be depending on the specific allocation of purchase. To perform an optimal allocation that maximizes the users’ payoff, the server needs full knowledge about the privacy parameter λi of each selling user i, which is assumed unavailable in our system model. Therefore, here we propose four privacyknowledge-free strategies to handle such oversupply issue: 1) Major sellers first: The server will purchase data from users in a greedy manner and descending order upon their current supply qit , until the demand is satisfied. 2) Minor sellers first: The server will purchase data from users in a greedy manner and ascending order upon their current supply qit , until the demand is satisfied. 3) Proportional: The server will purchase data from all users, allocating its demand η t to every single selling user proportionally to their current supply qit . 4) Random order: The server will purchase data from users in a greedy manner and random order. Remark that the oversupply will certainly trigger the satisfaction of server’s optimal amount of data to keep ymax , so it will only occur once, i.e., in the last round of the quotation. E. Handling the Discontinuity in Cost It must be recalled that the server’s cost function C(y) has a jump discontinuity at y = d, which is so far not considered in the above analyses. When ymax < d, due to this jump discontinuity, the actual server’s cost of unlearning all user data of amount d is C(d) = αA(d), which can be significantly lower than C(ymax ). Thus, after achieving y t = ymax , the server may still have an incentive to see if it worth buying all the remaining data from the users. Nevertheless, since the server does not have

7

full knowledge about every user’s privacy parameter, it cannot simply estimate the optimal price to offer. It is neither rational to simply continue purchasing more data at prices higher than the marginal cost of unlearning. To address this issue, we propose a post-quotation procedure, where after buying ymax amount of data, the server will still keep announcing new prices to the users like if the quotation continues, but not purchasing. Instead, it observes if all users are willing to sell all remaining data at the new price. Only if so, the server will purchase all remaining data at the last quoted price, and terminates the post-quotation step. Otherwise, no purchase will be made even if the supply is non-zero, and the server simply updates the price. This procedure continues until the price B t is raised so high that the cost to buy all remaining data exceeds the unlearning cost saved therewith, i.e. when B t · (d − ymax ) > C (ymax ) − C(d). F. Algorithm Implementation Summarizing the above discussions, we propose an iterative quotation-based price discovery protocol in Algorithm 1. Especially, for practical implementation in real use scenarios, we consider discrete user data sets with unit size of ∆d, so that all trades of user data can only be executed by amount of integer times of ∆d. Algorithm 1: Iterative Price Discovery Protocol 1 Input: a, A1 , A2 , A3 , T0 , α, β, B 0 , ∆B, [d1 , d2 , . . . , dI ], ∆d, 2 Initialize: y 0 ← 0, t ← 0, ymax w.r.t. Eq. (9), η 0 w.r.t. Eq. (10) 3 while η t > 0 do // Quotation phase 4 Updateqit for all  i ∈ I w.r.t. Eq. (18) t t 5 qi ← qi /∆d ∗ ∆d I P 6 if qit < η t then i=1

yit+1 ← yit + qit for all i ∈ I

7 8 else 9 Update yit+1 for all i ∈ I upon the oversupply-handling strategy 10 end 11 B t+1 ← B t + ∆B  12 η t+1 ← η y t+1 , B t+1 13 t←t+1 14 end   // Post-quotation 15 while B t · d − y t ⩽ C y t − C(d) do phase t 16 Update qi for all i ∈ I w.r.t. Eq. (18) I P 17 if qit = d − y then i=1

18 yit+1 ← di for all i ∈ I 19 end 20 B t+1 ← B t + ∆B 21 t←t+1 22 end

VI. E XTENSION TO ACCURACY-AWARE U SERS In Sections IV–V, users’ decisions are driven solely by privacy concerns, and each user acts independently without regard to other users’ decisions. In practice, however, users also benefit from the server’s model accuracy—for instance, an MNO’s LLM provides better traffic predictions and service quality when trained on more data. In this section, we extend the model following [10] so that each user also accounts for the impact of aggregate data redemption on model accuracy. We first analyze this extended model under complete information (where users can observe all preceding transactions) to

establish a theoretical benchmark. Subsequently, in Sec. VII, we compare this benchmark with the practical incompleteinformation quotation mechanism of Sec. V, as well as with the optimal personalized pricing of [10]. A. Extended User Model We generalize the user privacy function following [10]. For each user i ∈ I, the privacy utility of redeeming xi = di − yi amount of data is  1−ki   λi (xi + 1) , if ki ∈ [0, 1), 1 − ki (30) Pi (xi ) =  λ ln(x + 1), if k = 1, i i i where λi ⩾ 0 is user i’s privacy parameter and ki ∈ [0, 1] is the privacy elasticity parameter. The model in Sec. III corresponds to the special case ki = 1 for all i ∈ I. Each user i is also characterized by an accuracy parameter θi ⩾ 0 that captures i’s sensitivity to model accuracy degradation; a larger θi means a stronger preference for maintaining model quality. Given a unit price B offered by the server, user i’s payoff from selling yi amount of data to the server is P  I Wi (yi , y−i , B) = Pi (di −yi )+B ·yi −θi A j=1 (dj − yj ) , (31) where Pi (di − yi ) is the privacy utility from the redeemed portion, B · yi is the compensation received for data retention, and θi A(·) captures the disutility from accuracy degradation caused by the aggregate data redemption across all users. Remark 3. Setting θi = 0 and ki = 1 for all i ∈ I recovers the privacy-only model analyzed in Sections IV–V. Remark 4. The payoff structure in (31) is equivalent to [10, Eq. (7)]. The critical modeling difference is that in [10], the server sets personalized prices bi for each user based on knowledge of (λi , ki , θi ), whereas in our framework, the server broadcasts a uniform price B without access to any user’s private parameters. Note that when θi > 0, user i’s payoff depends on the aggregate redemption of all users through the accuracy term θi A(·). This creates a strategic interdependence among users that does not exist in the privacy-only model. We analyze this interdependence under complete information in the remainder of this section. B. Complete-Information Benchmark To establish a theoretical benchmark, we first consider the setting where users have complete information: each user can observe all preceding transactions and anticipate subsequent users’ responses. This allows us to characterize the gametheoretic equilibrium under ascending quotation prices. The welfare comparison between this complete-information quotation (CIQ) and the practical incomplete-information quotation (IIQ) is not straightforward—it depends on the oversupplyhandling strategy and the accuracy externality structure, as we formally analyze in Sec. VII.

8

Consider the quotation protocol of Sec. V applied to accuracy-aware users. Following Algorithm 1, the server quotes an ascending price sequence B t = B 0 + t · ∆B,

t = 0, 1, 2, . . . ,

(32)

where B 0 ⩾ 0 is the initial price and ∆B > 0 is the price increment. This schedule is deterministic and known to all participants. At each period Ptt, each user i decides the amount yit ⩾ 0 to sell, subject to τ =1 yiτ ⩽ di . Suppose the quotationPterminates at period T . Denoting i’s T total data sold as ȳi ≜ t=1 yit and the system-wide total as PI ȳ ≜ i=1 ȳi , user i’s realized payoff is Wi = Pi (di − ȳi ) +

T X

yit · B t − θi A(d − ȳ) .

(33)

t=1

C. Single-Period Selling Property The ascending price structure induces a strong structural property on users’ optimal strategies. Theorem 1 (Single-Period Selling). Under an ascending price schedule (B t )t⩾1 , for any fixed strategy profile y−i of all other users, it is a strictly dominant strategy for each user i to sell data in at most one period. That is, there exists ti ∈ {1, 2, . . . , T } ∪ {∞} such that yit = 0 for all t ̸= ti . Proof. Fix user i and any strategy profile P of the other users, which determinesPthe aggregate ȳ−i = j̸=i ȳj . User i’s total data sold, ȳi = t yit , uniquely determines both the privacy utility Pi (di − ȳi ) and the accuracy disutility θi A(d− ȳi − ȳ−i ). Hence, the payoff (33) decomposes as Wi = Pi (di − ȳi ) − θi A(d − ȳi − ȳ−i ) + | {z } ≜ Φi (ȳi ) (timing-independent)

T X

yit · B t .

t=1

|

{z

}

(timing-dependent)

(34) Now suppose, towards a contradiction, that i sells positive amounts in two distinct periods t < τ , i.e., yit > 0 and yiτ > 0. Since B t < B τ , yit · B t + yiτ · B τ < (yit + yiτ ) · B τ .

(35)

Shifting all sales from period t to period τ strictly increases the timing-dependent component while leaving Φi (ȳi ) unchanged (since ȳi is preserved). Hence, selling across multiple periods is strictly dominated. Remark 5. The quotation protocol here is the same ascendingprice mechanism as in Sec. V; the difference lies in the information structure. In the incomplete-information setting of Sec. V, myopic users sell incrementally across rounds once they start (greedy strategy, cf. Eq. (23)). Under the completeinformation setting analyzed here, a stronger result holds: the ascending price structure implies that any temporal splitting of sales is strictly dominated, so each user concentrates all sales in a single period.

D. Sequential Game and Equilibrium By Theorem 1, each active user i’s strategy in the completeinformation game reduces to a pair (ti , ȳi ): the period in which to sell and the total amount. Since the price schedule (32) is deterministic, choosing a selling period ti is equivalent to choosing a selling price B ti = B 0 + ti · ∆B. The period ti at which each user sells is endogenous—it is determined by the equilibrium, not imposed a priori. Without loss of generality, we exclude inactive users (who never sell) and reorder the remaining I active users so that t1 ⩽ t2 ⩽ · · · ⩽ tI . Under this ordering, the game becomes a finite sequential game of perfect information: user 1 sells first at the lowest price, user 2 at the next price, and so on, with each user observing all preceding transactions before making their decision. Remark 6 (Simultaneous Sellers). If multiple users sell at the same period (i.e., ti = tj for some i ̸= j), they face the same price and form a simultaneous subgame within that round. In the practical mechanism, this is precisely the scenario handled by the oversupply strategies of Sec. V-D: when aggregate supply exceeds demand, the server allocates according to one of the four proposed strategies. For the theoretical benchmark, we note that under continuous parameter distributions, exact ties in selling periods occur with probability zero. We therefore proceed under generic distinctness of selling periods, with the understanding that any ties are resolved by the existing oversupply mechanism. Theorem 2 (Existence and Uniqueness of SPNE). The sequential game among accuracy-aware users under complete information and an ascending price schedule admits a unique pure-strategy SPNE. Proof. Existence. The game is a finite extensive-form game of perfect information. Each user’s action space [0, di ] is compact, and the payoff functions (33) are continuous. By [44], a pure-strategy SPNE (in the sense of [45]) exists. Uniqueness. We proceed by backward induction. At each decision node, we show that the deciding user’s payoff is strictly concave in their own action, guaranteeing a unique best response. Consider user I (the last P to sell). Given the aggregate predecessor supply sI−1 = i<I ȳi , user I’s payoff is VI (ȳI ; sI−1 ) = PI (dI − ȳI ) − θI A(d − ȳI − sI−1 ) + ȳI · B tI . (36) The second derivative with respect to ȳI is ∂ 2 VI = PI′′ (dI − ȳI ) − θI A′′ (d − ȳI − sI−1 ). ∂ ȳI2

(37)

Since PI is concave (PI′′ ⩽ 0) and A is convex (A′′ ⩾ 0) with 2 θI ⩾ 0, we have ∂∂ ȳV2I ⩽ 0. Strict concavity holds whenever I PI′′ (dI − ȳI ) < 0 (which is the case for the privacy functions in (30) for all ki ∈ [0, 1] and ȳI < dI ) or θI > 0 and A′′ > 0 (which holds for the exponential accuracy model (1)). Thus, VI is strictly concave in ȳI over [0, dI ], implying a unique maximizer ȳI∗ (sI−1 ). By substituting ȳI∗ (sI−1 ) into user (I − 1)’s problem, the same argument applies: user (I − 1)’s payoff, with user I’s

9

response embedded, remains strictly concave in ȳI−1 , yielding ∗ a unique best response ȳI−1 (sI−2 ). Proceeding inductively to user 1, each step yields a unique best response. Since the backward induction is single-valued at every node, the resulting SPNE is unique.

E. Backward Induction Characterization The unique SPNE of Theorem 2 is characterized constructively as follows. Step P I (Last user): Given aggregate predecessor supply I−1 sI−1 ≜ i=1 ȳi , user I’s optimal supply is ȳI∗ (sI−1 ) = arg max VI (ȳI ; sI−1 ),

(38)

ȳI ∈[0,dI ]

which can be obtained from the first-order condition (FOC) −PI′ (dI − ȳI ) + θI A′ (d − ȳI − sI−1 ) + B tI = 0,

(39)

subject to the constraint ȳI ∈ [0, dI ]. For the log-privacy case (kI = 1) and exponential accuracy model, the FOC (39) specializes to λI + θI A1 A2 ln(a) · aA2 (d−ȳI −sI−1 ) = B tI , (40) dI − ȳI + 1 where the left-hand side is strictly decreasing in ȳI , confirming uniqueness. i (General user, i = I−1, I−2, . . . , 1): Given si−1 = PStep i−1 ∗ ∗ j=1 ȳj and the uniquely determined responses ȳi+1 , . . . , ȳI of all subsequent users (which depend on si−1 and ȳi through the backward induction), user i solves ȳi∗ (si−1 ) = arg max Pi (di − ȳi ) + ȳi · B ti ȳi ∈[0,di ]

 − θi A d − si−1 − ȳi − Ri (si−1 , ȳi ) ,

(41)

PI ∗ where Ri (si−1 , ȳi ) ≜ j=i+1 ȳj is the aggregate response of all users after i, recursively determined by the backward induction. The SPNE outcome is the profile (ȳ1∗ , ȳ2∗ , . . . , ȳI∗ ) obtained by evaluating the chain s∗0 = 0, ȳ1∗ = ȳ1∗ (s∗0 ), s∗1 = ȳ1∗ , ȳ2∗ = ȳ2∗ (s∗1 ), and so on. Corollary 1 (Reduction of Server’s Problem). For the linear price schedule (32),Pthe unique SPNE induces a unique total I data supply ȳ ∗ = i=1 ȳi∗ that depends on the parameters (B 0 , ∆B). Since each user sells at exactly one period, the server’s cost minimization over the price schedule reduces to choosing (B 0 , ∆B): min

B 0 ⩾0, ∆B>0

" I X i=1

B

t∗ i

· ȳi∗ (B 0 , ∆B) + C

I X

!# ȳi∗

, (42)

i=1

where t∗i = t∗i (B 0 , ∆B) is the endogenous selling period of ∗ user i in the SPNE and B ti = B 0 + t∗i · ∆B.

F. Information-Free Implementation A key practical advantage of the quotation mechanism is that it does not require the server to solve Problem (42) or know user parameters. Proposition 1 (Information-Free Implementation). The quotation-based price discovery mechanism (Algorithm 1) implements a data retention outcome without requiring the server to know any user’s private parameters (λi , ki , θi ). At each round, the server only needs to: 1) broadcast the current uniformP price B t , and 2) observe the aggregate supply i yit . Each user independently determines their supply based on locally known parameters and the quoted price. In the practical quotation mechanism, users do not observe other users’ individual trades and cannot perform backward induction. The complete-information SPNE of Theorem 2 therefore serves as a theoretical benchmark: it represents the best outcome achievable under the ascending quotation format if users had full strategic foresight. The actual outcome under incomplete information—where users follow myopic bestresponse strategies as in Sec. V—may differ, and we quantify this gap in Sec. VII. VII. E FFICIENCY A NALYSIS We now formalize the Price of Ignorance: the welfare cost of operating the quotation mechanism without private user information. We compare three regimes, ranging from the theoretical optimum to the practical mechanism: 1) Optimal Personalized Pricing (OPP): The server knows all user parameters and sets personalized prices bi for each user, as in [10]. This is the social-welfare– maximizing benchmark under complete information. 2) Complete-Information Quotation (CIQ): The server runs the ascending quotation protocol, and users play the SPNE of Theorem 2 with full strategic foresight. Prices are uniform but ascending. 3) Incomplete-Information Quotation (IIQ): The practical mechanism of Sec. V, extended to accuracy-aware users. Users follow myopic best-response strategies without observing others’ trades. Let ξOPP , ξCIQ , and ξIIQ denote the social welfare achieved under each regime. The first ordering is immediate: ξOPP ⩾ ξCIQ ,

(43)

since personalized pricing can always replicate a uniform price (by setting bi = B for all i). The comparison between CIQ and IIQ, however, is more nuanced and depends on the oversupply-handling strategy, as we analyze below. A. Price of Uniformity The gap ξOPP − ξCIQ quantifies the cost of using uniform prices instead of personalized ones. This gap arises because the ascending quotation offers a single price at each round, whereas OPP can tailor prices to individual user characteristics.

10

i.i.d.

B. Price of Ignorance The welfare gap between CIQ and IIQ arises from differences in both the selling structure (single-period vs. incremental) and the strategic treatment of the accuracy externality. Myopic users in IIQ ignore the accuracy externality and may offer to sell more data than under the strategic play of CIQ. However, the server’s demand η is determined by its own cost function and is independent of users’ strategies. The server purchases data only up to its demand, so the total amount of data actually retained—and hence the aggregate accuracy term A(d − ȳ)—is the same across CIQ and IIQ for a given price path. The welfare difference between CIQ and IIQ therefore reduces to a misallocation effect: in CIQ, strategic users self-select efficiently into selling, whereas in IIQ, myopic oversupply in the final round is resolved by the oversupplyhandling strategy (Sec. V-D). Specifically: • The aggregate data retained by the server, ȳ, and the server’s cost are identical.P • The accuracy disutility i θi A(d − ȳ) is identical (it depends only on total ȳ). • The difference lies in which users are partially cut in the oversupply round, affecting: (a) the distribution of compensation across users, and (b) the distribution of privacy utilities. Since transfers (compensation) cancel out in social welfare, the net welfare effect depends solely on how the oversupplyhandling strategy allocates the cut among users, which determines the aggregate privacy utility. This yields the following result. Proposition 2 (Oversupply-Dependent Welfare Ordering). Under accuracy-aware users, the welfare comparison between CIQ and IIQ depends on the oversupply-handling strategy: i Xh ξCIQ − ξIIQ = Pi (di − ȳiCIQ ) − Pi (di − ȳiIIQ ) , (44) i∈I

where ελi , εθi ∼ N (0, σ 2 ) are independent multiplicative noise terms, and σ ⩾ 0 controls the estimation quality. We use multiplicative noise because (i) it preserves the non-negativity of λi and θi (for small σ), and (ii) it is scale-invariant, reflecting that estimation difficulty is proportional to parameter magnitude. The elasticity parameter ki ∈ [0, 1] is assumed known, as it characterizes a structural property of the privacy function that can be estimated from aggregate behavior. Given noisy estimates (λ̂i , ki , θ̂i ), the server solves OPP’s bilevel optimization [10, Problem (11)] and obtains suboptimal personalized prices b̂(σ). Users then respond to b̂(σ) using their true parameters, reaching a Nash equilibrium x∗ (b̂(σ)) that generally differs from the optimal Nash equilibrium under perfect information. The resulting social welfare is " # X ∗ ∗ ∗ ξOPP (σ) = Eε (Pi (xi ) − θi A(x )) − C(x ) , (46) i∈I

where the expectation is over the noise realization and x∗ = x∗ (b̂(σ)). Since IIQ does not use any parameter estimates, its welfare ξIIQ is independent of σ. We therefore have lim ξOPP (σ) → ξrandom , (47) where ξrandom denotes the welfare under essentially random pricing. Since ξOPP (σ) is continuous and decreasing in σ, there exists a crossover point σ ∗ such that ξOPP (0) = ξOPP ⩾ ξIIQ ,

ξIIQ > ξOPP (σ)

σ→∞

for all σ > σ ∗ .

(48)

That is, when the server’s parameter estimation error exceeds σ ∗ , the information-free quotation mechanism outperforms the nominally optimal personalized pricing. We evaluate σ ∗ numerically in Sec. VIII. VIII. N UMERICAL E VALUATION

where ȳiCIQ and ȳiIIQ denote user i’s data sold under the respective regimes. The per-user allocations ȳiIIQ are determined by oversupply-handling strategy of Sec. V-D, subject to P the P CIQ IIQ ȳ = ȳ . i i i i Remark 7. This result implies that the choice of oversupplyhandling strategy has welfare consequences beyond the privacy-only model. We evaluate this numerically in Sec. VIII, comparing all four strategies under accuracy-aware users to identify which minimizes the CIQ–IIQ gap.

A. Simulation Setup We evaluate the proposed mechanism through numerical simulations. The default parameter settings are shown in Table I, following the specifications of [6]. For the accuracyaware model, we additionally set θi ∼ U(0, 5) and ki = 1 (logarithmic privacy) unless stated otherwise. Welfare comparison, robustness, and fairness experiments are averaged over N = 5000 Monte Carlo runs, and sensitivity over N = 500 per configuration point, all with independent user population draws. The random seed is fixed at 42 for reproducibility.

C. Robustness Advantage IIQ has a further advantage over OPP: robustness to information errors. The OPP mechanism of [10] requires the server to know each user’s private parameters (λi , ki , θi ) to solve the bilevel optimization [10, Problem (11)]. In practice, these parameters must be estimated, introducing errors. We model the server’s estimation error as follows. The server observes noisy estimates λ̂i = λi (1 + ελi ),

θ̂i = θi (1 + εθi ),

(45)

B. Oversupply Handling Strategies To compare the performance of the four oversupplyhandling strategies proposed in Sec. V-D, we carried out Monte Carlo tests. For each run, we measured the server’s payoff: T X ξs = C T − C(0) − Bt, (49) t=0

11

Parameter

Value

Remark

System

I di , ∀i ∈ I λi , ∀i ∈ I θi , ∀i ∈ I ki , ∀i ∈ I ∆d B0 ∆B N

10 6000 ∼ U (0.5, 30) ∼ U (0, 5) 1.0 1 0.001 0.001 500–5000

Number of users Data amount per user Privacy valuation Accuracy sensitivity Privacy elasticity Unit data amount Initial price Price step Monte Carlo runs

Cost

TABLE I: Simulation Setup

[a, A1 , A2 , A3 ] T0 [α, β]

[e, 0.1, 3.33×10−5 , 0] 2.85 × 10−4 [1500,1]

Accuracy parameters Time factor Weight factors

where T is the index of round when the procedure terminates, the users’ total payoff " T # I X X  t−1 t−1 t T ξu = B (yi − yi ) + Ui yi − Ui (0) , (50) i=1

3) Boundary baselines: • Do-not-redeem (DNR): No redemption; the server keeps all data for free. • GDPR: All informed users redeem all data; the server bears full unlearning cost. • FULL: The server retains all data but compensates each user for the full privacy loss Pi (di ) − Pi (0). Following [6], the informed ratio ρ ∈ [0, 1] denotes the fraction of users aware of their redemption rights; uninformed users are treated under DNR regardless of the mechanism used. D. Privacy-Only Welfare Comparison We first evaluate the privacy-only model (θi = 0, ki = 1), which recovers the setting of [6]. Fig. 2 shows the social welfare of all seven mechanisms as the informed ratio ρ varies from 0% to 100%.

Record · ID 10361 · SHA-256 9fd1d7e4b1b54afe
Conceptio Open Knowledge Archive — every document is proof-bundled with source, license, and retrieval metadata.