Credibility Trilemma in Polymatroidal Service Markets
arXiv:2605.26604v1 [cs.GT] 26 May 2026
LAURI LOVÉN, Future Computing Group, University of Oulu, Finland SUJIT GUJAR, Machine Learning Lab, International Institute of Information Technology, India KALLE TIMPERI, Perception Engineering, University of Oulu, Finland HASSAN MEHMOOD, Future Computing Group, University of Oulu, Finland PRAVEEN KUMAR DONTA, Department of Computer and Systems Sciences, Stockholm University, Sweden
SASU TARKOMA, Department of Computer Science, University of Helsinki, Finland SCHAHRAM DUSTDAR, Distributed Systems Group, TU Wien, Austria and ICREA, Spain Mechanism-mediated service markets with polymatroidal feasibility admit efficient, dominant-strategy incentive-compatible (DSIC) allocation, but these guarantees implicitly assume truthful execution by the marketplace operator. Modelling the operator as a strategic player, we establish a credibility trilemma: for single-parameter agents on a non-modular polymatroid, no static sealed-bid mechanism is simultaneously revenue-optimal, DSIC for agents, and credible for the operator. We introduce the Cost of Non-Credibility (CoNC) as a price-of-anarchy-style welfare-loss measure and obtain tight Θ-bounds across five topology classes (single-edge, series, parallel, tree, series–parallel), plus a matching upper bound 𝑂 (|S|) on general DAGs realised by an Ω(|S|) witness on the SP-augmented sub-family, turning the trilemma into a structural quantity. Three structurally distinct resolutions follow: public broadcast or deferred-revelation commitment, administrative domain separation under settlement separation and four side conditions, and integrator competition orthogonal to mechanism execution under disjoint actors. An instance-level grounding over the edge-pricing market of Amin et al. (Appendix A) confirms the trilemma’s robustness on a refereed external setting. The result establishes marketplace neutrality as a first-order design constraint on polymatroidal service markets rather than an implementation detail: where the operator is a strategic player, credibility trades off against revenue optimality and agent incentive compatibility along structurally characterised lines. CCS Concepts: • Theory of computation → Algorithmic mechanism design; Computational pricing and auctions; • Information systems → Computing platforms. Additional Key Words and Phrases: credible mechanism design, polymatroidal allocation, non-modular feasibility, gross substitutes, VCG, network slicing, edge–cloud computing, real-time AI service economy
1
Introduction
Polymatroidal service markets — including network slice brokering [1, 73], multi-tenant cloud auctions with shared interconnect bandwidth, edge-priced capacity sharing on series–parallel networks [5], and edge-cloud service-dependency markets [54] — admit dominant-strategy incentivecompatible (DSIC)1 allocation under gross-substitutes (GS) valuations: when the underlying jointcapacity structure forms a polymatroid and agent valuations satisfy GS, a Walrasian equilibrium exists, welfare maximisation is polynomial-time solvable, and Vickrey–Clarke–Groves (VCG) or polymatroid clinching yields a DSIC, individually rational mechanism. These guarantees implicitly assume that the mechanism’s executor (the marketplace operator) faithfully implements the prescribed allocation and payments. When the operator is itself a strategic player with private 1 A mechanism is DSIC if truthful reporting is a dominant strategy for every agent regardless of others’ reports.
Authors’ Contact Information: Lauri Lovén, [email protected], Future Computing Group, University of Oulu, Oulu, Finland; Sujit Gujar, Machine Learning Lab, International Institute of Information Technology, Hyderabad, India; Kalle Timperi, Perception Engineering, University of Oulu, Oulu, Finland; Hassan Mehmood, Future Computing Group, University of Oulu, Oulu, Finland; Praveen Kumar Donta, Department of Computer and Systems Sciences, Stockholm University, Stockholm, Sweden; Sasu Tarkoma, Department of Computer Science, University of Helsinki, Helsinki, Finland; Schahram Dustdar, Distributed Systems Group, TU Wien, Vienna, Austria and ICREA, Barcelona, Spain.
0:2
Lovén et al.
Operator credibility
Rev.-opt. + credible
DSIC + credible
First-price (pay-as-bid) (not DSIC)
Ascending clinching (not rev.-optimal)
all three impossible (Theorem 1)
Agent DSIC
Revenue-optimality Rev.-optimal + DSIC Myerson / ironed-VV greedy (not credible)
Fig. 1. The credibility trilemma (Theorem 1). On a non-modular polymatroidal service market, any two of the three properties are simultaneously achievable (filled circles, each with a witness mechanism), but all three are not (shaded interior): the revenue-optimal DSIC mechanism (Myerson / ironed-virtual-value greedy) is not credible; the ascending clinching auction is credible and DSIC but not revenue-optimal; the first-price (pay-as-bid) auction is credible and revenue-optimal but not DSIC. Dashed curves indicate the achievable Pareto frontier. The structural resolutions (Theorem 8 and Propositions 5 and 6) recover credibility by leaving the static sealed-bid class on which the impossibility rests.
information about supply, with allocation discretion, and with custody of payment flows, faithful execution is not derivable from the agent-side incentive analysis: the operator may misreport capacity, inject fictitious bids, mis-charge agents, or selectively reveal information, and the DSIC welfare guarantees collapse without ever contradicting any individual agent’s view. This paper addresses that credibility gap for polymatroidal service markets. Its spine is a single impossibility, the credibility trilemma (Theorem 1): On a non-modular polymatroid, no static sealed-bid mechanism for single-parameter agents is simultaneously revenue-optimal, DSIC for agents, and credible for the operator: any two of the three can be had, never all three. Everything else in the paper either establishes this claim, measures how large the resulting credibility gap is, or shows how to escape it. Fig. 1 summarises the impossibility and its three pairwise escapes. We use one concrete instance — a personal AI agent (PAA) navigating a smart building [69] — as a running example to ground the theory. The PAA scenario is chosen for concreteness only; the theoretical results are stated and proved for the abstract polymatroidal structure and transfer to any of the realisations enumerated in the first paragraph. The agent runs a lightweight model on the user’s phone but needs real-time services such as context inference, task planning, and knowledge retrieval, composed from shared building resources spanning its sensors, edge infrastructure, and
Credibility Trilemma in Polymatroidal Service Markets
0:3
a cloud backend. These services form a dependency chain (e.g., sensor data → local inference → reasoning) with interactive latency constraints: a useful response must arrive, for example, within 200 ms [46, 71]. As the user moves between environments, the PAA dynamically discovers available edge services and composes ad-hoc service chains tailored to the current context. An integrator bundles resources from multiple providers into a single composite resource called a service slice: a capacity-constrained bundle that aggregates a sub-DAG of underlying services into one item priceable in the marketplace. Such slices are then offered to agents through a marketplace operator (Fig. 2). The PAA case sits in the emerging real-time AI service economy [26, 27, 53]; structurally identical credibility pressures arise in the other realisations listed above, wherever shared multi-tier capacity binds the allocation. Recent work [54] establishes formal conditions under which efficient, incentive-compatible mechanisms exist on this class: when the service-dependency graph has tree or series–parallel structure, DSIC mechanisms achieve the welfare-maximising allocation in polynomial time. The market mechanism’s contribution is purely incentive-theoretic: under truthful bidding, a value-greedy heuristic matches the market’s welfare, so the mechanism’s primary value lies in making truthful reporting a dominant strategy. The credibility gap surfaces in this running example as a dual-role conflict: We distinguish the marketplace operator (the entity collecting bids, computing allocations, and determining payments) from the integrator (the entity that composes a sub-DAG of services into a slice; P3 in Section 2.1); the credibility problem of this paper arises precisely when the same legal entity plays both roles, as when an edge infrastructure provider that hosts local inference models also runs the service marketplace that allocates them. This dual role creates a conflict of interest: the provider could misreport its edge capacity to inflate prices, inject fictitious bids to extract surplus, or favour its own facility-management agents over visiting users’ PAAs. In single-domain environments (e.g., a cloud provider’s internal market), faithful execution is plausible. In multi-domain environments, where the marketplace operator simultaneously controls resources and runs the auction, it is not. In service-oriented terms, the slice marketplace closes the standard publish/discover/bind/invoke loop [25, 63]: integrators publish slice descriptors, agents discover candidates, the auction binds agents to slices, and successful bidders invoke the underlying composed service path. The slice’s max-flow capacity acts as the aggregate QoS guarantee that composes the underlying servicedependency DAG [19]; the per-epoch DSIC payment plus the credibility commitment together form a service-level agreement on truthful execution. Operator misbehaviour breaks the bind step before it can bind: the welfare guarantee that the SLA implicitly promises is then no longer realised. This connects to a fundamental result in mechanism design: Akbarpour and Li [3] proved that no static sealed-bid mechanism is simultaneously revenue-optimal, strategyproof, and credible, i.e., the auctioneer cannot profitably deviate in a way undetectable to any single bidder. Their trilemma, established for single-item auctions, has been resolved for single-item settings by Ferreira and Weinberg [30] and extended to matroid feasibility constraints by Ganesh and Zhang [35], both using blockchain commitments. Since the polymatroidal feasible regions arising in service economies generalise matroids, this creates a direct theoretical bridge. Because the mechanism’s contribution is purely incentive-theoretic, faithful execution is the critical channel through which welfare guarantees flow: if the operator deviates, agents have no reason to bid truthfully, and the allocation degrades. We argue that ensuring truthful mechanism execution is not merely an implementation detail but a first-order mechanism-design problem whose solution determines whether theoretical guarantees are realised in practice. Our contributions are: (1) (The trilemma, and its quantitative face.) We formalise the marketplace operator as a strategic player and adapt the credible mechanism design framework to polymatroidal service markets, proving the credibility trilemma stated above for single-parameter agents on a
0:4
Lovén et al.
non-modular polymatroid (Theorem 1). To measure how large the resulting credibility gap is, we introduce the Cost of Non-Credibility (CoNC), a welfare-loss measure analogous to the price-of-anarchy, and turn the impossibility into a structural quantity: tight Θ-bounds across five topology classes (single-edge, series, parallel, tree, series–parallel), plus a matching upper bound 𝑂 (|S|) on general DAGs realised by an Ω(|S|) witness on the SP-augmented sub-family (Section 3.3). The CoNC framework is thus the quantitative face of the trilemma rather than a separate result. Scope conditions and the open extensions (multi-parameter and Bayesian-IC types; the lower bound on Wheatstone-embedded non-SP DAGs; the asymptotic matching-rate sense of “tight”) are collected once in Remark 1. (2) (Three resolutions: commitment, separation, competition.) We show that commitment devices restore credibility (Theorem 8); that administrative domain separation under settlementseparation (Proposition 5) provides an alternative credibility guarantee through revenuechannel separation, with a knife-edge at any positive ownership stake; and that integrator competition (Proposition 6) constrains monopoly markup orthogonally to mechanismexecution credibility. (3) (Independent grounding.) Appendix Section A proves the trilemma, the Cost of Non-Credibility, and domain-separation as instances over the edge-pricing market of Amin, Jaillet, Pulyassary, and Wu [5] (ACM TEAC 14(1), Art. 2), via a bridging lemma on the marginal Lipschitz constant of the remittance schedule (Lemma 5). The instance-level grounding shows that the load-bearing economic content of our results survives over a refereed external setting, independently of the polymatroidal generality supplied by [54]. (4) (Simulation illustration of the trilemma.) We illustrate the trilemma through three baseline simulation experiments (Section 4, Exps. 1–3): a ghost-bid deviation is profitable and undetectable under sealed-bid VCG, extends to the Myerson revenue-optimal mechanism, and is closed by broadcast commitment. The empirical CoNC under no enforcement tracks the topology-class lower bound of Corollary 1 from below. A comprehensive ablation programme (topology-class CoNC scaling across tree / SP / general DAG, the three resolution mechanisms’ empirical evaluation, the orthogonality of credibility and competition, and the domain-separation knife-edge under positive ownership stake), together with robustness experiments under adaptive operators, imperfect channels, strategic exit, and supply non-stationarity, is the subject of follow-up work; the present paper restricts to the three trilemma-illustration experiments that operationalise Theorem 1 and Theorem 8(i). A continuous deployable surface in stake 𝜆, escrow fraction 𝜂, and audit frequency 𝜏 that softens the knife-edge of Proposition 5 into a deployable engineering quantity, together with a Smallest Detectable Stake threshold and a two-tier deployment architecture, is the subject of follow-up work; the present paper restricts to the realisation-wise impossibility, the topology-class scaling, and the three structural resolutions on which any such deployable surface must rest. Structural independence from earlier work [54]. The polymatroidal feasibility region used throughout this paper was first introduced in our earlier work [54], which grounds a service-economy framework on tree and series–parallel dependency DAGs. The present paper does not require any specific result of [54]: Theorem 10 in Section A establishes an instance of our trilemma directly over the edge-pricing market of Amin et al. [5] and supplies a self-contained construction of the polymatroidal structure used in the main results. The main theorems and all downstream results of this paper can therefore be read without reference to [54], which is cited only for context and motivation. We use the personal AI agent (PAA) scenario as a running example throughout the paper to ground each theoretical result in a concrete, practically motivated setting. The remainder
Credibility Trilemma in Polymatroidal Service Markets
0:5
integrator and operator may be one entity ⇒ credibility gap
Sensor
Edge
Cloud
bldg. sensing
bldg. infer.
FM reason.
slice cap. 𝐶¯ 𝑗
bid 𝑏𝑖 , payment 𝑝𝑖 agent 𝑖 (PAA)
Marketplace operator O
user’s phone
integrator 𝑗 : service slice = sub-DAG bundle
allocated slice 𝑥𝑖
Fig. 2. Running PAA scenario and the credibility gap. Agent 𝑖 — a personal AI agent running on the user’s phone — submits a bid 𝑏𝑖 and pays 𝑝𝑖 to the marketplace operator O, which returns the allocated service slice 𝑥𝑖 (solid economic flows; the agent’s quasi-linear utility is 𝑣𝑖 𝑥𝑖 − 𝑝𝑖 ). An integrator 𝑗 bundles a building-side sensor–edge–cloud sub-DAG (grey dashed service-dependency arrows; the shared, capacity-constrained resources) into a single service slice of capacity 𝐶¯ 𝑗 , offered to O. The credibility problem arises when the integrator and operator are the same legal entity (orange enclosure; e.g., the building’s edge provider): the entity that runs the auction also controls and prices the supply. The user’s phone is only the agent’s endpoint, outside the priced slice.
is organised as follows. Section 2 provides the necessary background. Section 3 presents the theoretical results, including the trilemma, the CoNC topology-class bounds, and the three resolution mechanisms. Section 4 reports the simulation experiments. Section 5 discusses related work, limitations, and future directions, and Section 6 concludes. 2
Background
This section sets up the polymatroidal market structure on which the credibility analysis operates, reviews the mechanism design machinery from [54] that supplies P1–P3, introduces the credible mechanism design framework, and identifies the truthful execution gap. 2.1
Polymatroidal Markets and Gross Substitutes
A polymatroidal service market is a market whose feasible allocation region is a polymatroid and whose agents have gross-substitutes (GS) valuations. The polymatroid encodes the joint capacity structure of a shared underlying resource graph; the GS condition encodes substitutability across the agent-facing items. This abstract structure arises in several distinct application domains: (1) Service-dependency DAGs over the sensor–edge–cloud continuum (the running setting of this paper, drawn from [54]): a DAG of service types with internal-node capacities, whose maxflow rank function on the leaf set is polymatroidal under tree or series–parallel topology (P1 below). (2) Edge-priced capacity sharing on series–parallel networks [5]: a single-source single-sink network with integer edge capacities and homogeneous coalition disutility, whose Walrasian– VCG baseline in their Theorems 3.2 and 3.10 is the structural counterpart of P1+P2 over edge-pricing primitives. (3) Network slicing with sub-modular interference / capacity constraints [1, 73]: hierarchical slice brokering where shared spectrum and tenant interference yield sub-modular joint-capacity rank functions of the polymatroidal class. (4) Multi-tenant cloud auctions with shared inter-rack bandwidth: cloud resource markets where the shared interconnect imposes a sub-modular cap on the joint allocation of compute slots across tenants.
0:6
Lovén et al.
The credibility analysis below operates on the abstract polymatroid + GS structure and therefore transfers to all four realisations. We use the service-dependency DAG setting as the running formalism in this paper (it supplies the most explicit graph-theoretic vocabulary; the others are briefly noted as parallel realisations). In the running formalism, agents generate latency-sensitive tasks that require multi-resource service compositions across a sensor–edge–cloud continuum. Each service composition is captured by a service-dependency DAG 𝐺 res = (R, 𝐸), where nodes (the set R) represent service types and edges represent dependencies. Agents consume leaf services; internal nodes impose capacity constraints. Definitions. A polymatroid on ground set 𝐸 is defined by a rank function 𝑓 : 2𝐸 → R ≥0 that is monotone non-decreasing, submodular (𝑓 (𝐴 ∪ 𝐵) + 𝑓 (𝐴 ∩ 𝐵) ≤ 𝑓 (𝐴) + 𝑓 (𝐵)), and satisfies 𝑓 (∅) = 0; the associated polymatroid is {𝑥 ∈ R𝐸≥0 : 𝑥 (𝑆) ≤ 𝑓 (𝑆) ∀𝑆 ⊆ 𝐸}. A matroid is the special case where allocations are binary (𝑥𝑖 ∈ {0, 1}). Valuations satisfy the gross substitutes (GS) condition [14, 48] if raising the price of one item never decreases demand for other items. Discrete convex analysis [57] provides an alternative algebraic characterisation of polymatroids and their optimisation structure. A mechanism is dominant-strategy incentive-compatible (DSIC) if truthful reporting is a best response for each agent regardless of what other agents report. Lovén [54] establishes three structural results (P1–P3) that the credibility analysis below builds on. Because [54] is an arXiv preprint, we restate the propositions and reprove them inline so that the present paper is self-contained: the strategic-operator analysis of Section 3.2 perturbs precisely the polymatroid + GS + DSIC machinery established by P1–P3, so the credibility results are meaningful only against a verified structural foundation. Proposition 1 (Polymatroidal structure — P1). When 𝐺 res is a rooted tree or series–parallel (SP) network with positive internal-node capacities {𝐶𝑟 }𝑟 ∈ R , the feasible allocation region Xres = {𝑥 ∈ R𝐸≥0 : 𝑥 (𝑆) ≤ 𝑓 (𝑆) ∀𝑆 ⊆ 𝐸} is a polymatroid, where the rank function 𝑓 (𝑆) is the max-flow capacity from the leaves in 𝑆 to the root subject to the internal-node capacity constraints. Proof. Let 𝐸 denote the set of leaf services and let 𝑓 : 2𝐸 → R ≥0 assign to each 𝑆 ⊆ 𝐸 the value of a maximum flow from the leaves in 𝑆 to the root in 𝐺 res , subject to the internal-node capacities {𝐶𝑟 }𝑟 ∈ R (node capacities are absorbed into edge capacities by the standard node-splitting reduction). We verify the three polymatroid axioms and then identify Xres with the associated polymatroid base polytope. (i) Normalisation. If 𝑆 = ∅, the source set is empty, no 𝑠–𝑡 path carries positive flow, and 𝑓 (∅) = 0. (ii) Monotonicity. Let 𝐴 ⊆ 𝐵 ⊆ 𝐸 and let 𝑥 𝐴 be a maximum flow for 𝐴. Extending 𝑥 𝐴 by zero on the additional source leaves 𝐵 \ 𝐴 remains feasible (capacity constraints are unchanged), so 𝑓 (𝐵) ≥ val(𝑥 𝐴 ) = 𝑓 (𝐴). (iii) Submodularity. For any 𝐴, 𝐵 ⊆ 𝐸 and any cut 𝐶 ⊆ R ∪ {edges} separating sources from the root, write cap(𝐶 | 𝑇 ) for the capacity of 𝐶 when only the leaves in 𝑇 act as sources. By the max-flow min-cut theorem, 𝑓 (𝑇 ) = min𝐶 cap(𝐶 | 𝑇 ). The function 𝑇 ↦→ cap(𝐶 | 𝑇 ) is modular for any fixed 𝐶 (each leaf contributes independently to the cut). Note that pointwise minima of modular functions are not in general submodular (counterexample on 𝐸 = {1, 2}: 𝑓1 (𝑆) = 11∈𝑆 and 𝑓2 (𝑆) = 12∈𝑆 are modular, but min(𝑓1, 𝑓2 ) ({1, 2})+min(𝑓1, 𝑓2 ) (∅) = 1 > 0 = min(𝑓1, 𝑓2 ) ({1})+min(𝑓1, 𝑓2 ) ({2}), so the minimum is supermodular). The submodularity of the max-flow rank function instead follows from the classical Edmonds–Schrijver max-flow / matroid-intersection argument: Schrijver [72, §44.4, Theorem 44.6] establishes that the max-flow function on a capacitated network is polymatroidal; the underlying uncrossing-of-flows argument is due to Edmonds [29] and is also formulated in
Credibility Trilemma in Polymatroidal Service Markets
0:7
Fujishige [32]. Hence 𝑓 (𝐴 ∪ 𝐵) + 𝑓 (𝐴 ∩ 𝐵) ≤ 𝑓 (𝐴) + 𝑓 (𝐵). (iv) Tree and SP decomposition. For a rooted tree, every 𝑠–𝑡 cut corresponds to a set of internal nodes Í whose subtrees collectively cover the source set 𝑆, and the rank decomposes as 𝑓 (𝑆) = 𝑟 ∈ R ◦ (𝑆 ) 𝐶𝑟 for the minimum hitting set of internal nodes R ◦ (𝑆), which is computable in linear time. For SP networks (recognised in linear time [28, 78]), the rank function obeys the compositional identities 𝑓series(𝐺 1,𝐺 2 ) (𝑆) = min 𝑓1 (𝑆 ∩ 𝐸 1 ), 𝑓2 (𝑆 ∩ 𝐸 2 ) , 𝑓parallel(𝐺 1,𝐺 2 ) (𝑆) = 𝑓1 (𝑆 ∩ 𝐸 1 ) + 𝑓2 (𝑆 ∩ 𝐸 2 ), where 𝐸 1, 𝐸 2 partition 𝐸 across the SP factor. Both compositions preserve submodularity [32], so the global 𝑓 remains a polymatroid rank function. (v) Identifying Xres . By definition, Xres is the set of allocations 𝑥 ∈ R𝐸≥0 that admit a simultaneous feasible flow respecting the internal-node capacities. By the polymatroid characterisation [32, Theorem 3.22], 𝑥 admits such a flow iff 𝑥 (𝑆) ≤ 𝑓 (𝑆) for every 𝑆 ⊆ 𝐸, which is the polymatroid associated with 𝑓 . Hence Xres is a polymatroid. □ Proposition 2 (Efficient mechanism design — P2). If Xres is polymatroidal and agents’ valuations satisfy the gross substitutes (GS) condition, then (i) a Walrasian equilibrium exists; (ii) welfare maximisation is polynomial-time solvable; (iii) the efficient allocation is implementable via a DSIC, individually rational mechanism: VCG [10] applies in full generality (possibly with operator deficit, Í i.e., 𝑖 𝑝𝑖VCG may be smaller than the operator’s procurement cost on some realised bid profiles, even on polymatroidal feasibility), and in the single-type-per-task, unit-demand case (where each task class maps to a unique admissible slice type and each agent demands at most one unit, supplied by integrator encapsulation P3 of Proposition 3) the polymatroid clinching auction [9, 36] additionally Í guarantees weak budget balance: 𝑖 𝑝𝑖clinch ≥ 0 on every realised bid profile. All guarantees hold within each decision epoch; cross-epoch strategic dynamics lie outside their scope. Proof. We prove the three claims separately. (i) Walrasian existence. Under GS, the indirect utility of each agent is a substitutes valuation in the sense of Kelso and Crawford [48]: at any price vector 𝑝 ∈ R𝐸≥0 , raising 𝑝𝑒 for some 𝑒 ∈ 𝐸 does not strictly decrease the demand for any 𝑒 ′ ≠ 𝑒. Kelso–Crawford construct an ascending salaryadjustment process which, on every step, raises the price of an over-demanded item; under GS the process terminates in finitely many steps at a price–allocation pair (𝑝 ∗, 𝑥 ∗ ) with markets clearing, i.e., a Walrasian equilibrium. Gul and Stacchetti [40] extend this argument to indivisible-goods exchange economies and prove that GS is in fact necessary as well as sufficient for Walrasian existence on the relevant valuation domain. The polymatroid structure of Xres guarantees that the supply correspondence is upper hemicontinuous and convex-valued, so the equilibrium point produced by Kelso–Crawford lies in Xres . (ii) Polynomial-time welfare maximisation. For single-parameter valuations 𝑣𝑖 (𝑥𝑖 ) = 𝜃 𝑖 𝑥𝑖 with reported Í bids 𝑏𝑖 ≥ 0, welfare maximisation on the polymatroid Xres reduces to the linear program max 𝑖 𝑏𝑖 𝑥𝑖 s.t. 𝑥 ∈ Xres . Edmonds [29] proved that the greedy algorithm solves this LP exactly: sort agents by decreasing 𝑏𝑖 , then allocate to each agent 𝑖 the maximum residual capacity 𝑥𝑖∗ = 𝑓 (𝑆𝑖 ∪ {𝑖}) − 𝑓 (𝑆𝑖 ), where 𝑆𝑖 is the set of agents previously allocated. The procedure terminates in 𝑛 iterations, requires 𝑂 (𝑛 log 𝑛) comparisons for sorting and 𝑂 (𝑛) rank-oracle calls, yielding total time 𝑂 (𝑛 log 𝑛 + 𝑛 𝑇𝑓 ) where 𝑇𝑓 is the cost of one evaluation of 𝑓 . For tree and SP 𝐺 res from Proposition 1, 𝑇𝑓 is linear in |R|, so the overall procedure is polynomial in the input size.
0:8
Lovén et al.
(iii) DSIC implementation. Given the welfare-maximising allocation rule of part (ii), the Vickrey– Clarke–Groves payments [23, 39, 79] ∑︁ ∑︁ 𝑝𝑖 = max 𝑏𝑗𝑥𝑗 − 𝑏 𝑗 𝑥 ∗𝑗 𝑥 ∈ Xres
𝑗≠𝑖
𝑗≠𝑖
make truthful reporting a dominant strategy and are individually rational [10]; without further structure VCG payments may sum to strictly less than the operator’s procurement cost on some bid profiles (operator deficit), which is why VCG alone does not guarantee weak budget balance on polymatroidal feasibility. In the single-type-per-task, unit-demand case (each task class maps to a unique admissible slice type and each agent demands at most one unit, supplied by integrator encapsulation P3 of Proposition 3), Ausubel’s ascending clinching auction [9] terminates at the Walrasian equilibrium of part (i), and the polymatroid extension by Goel et al. [36] shows that the resulting clinching prices coincide with the VCG payments. The clinching auction is weakly budget-balanced by construction (each agent’s clinching price is non-negative because clinching only occurs when residual capacity strictly drops below the still-active demand, and unit demand bounds the total non-negative payment by the gross-substitutes-based competitive equilibrium Í price), so 𝑖 𝑝𝑖clinch ≥ 0 on every realised bid profile. All three properties (DSIC, IR, weak budget balance under the single-type, unit-demand, P3-encapsulated hypothesis) hold within each decision epoch; cross-epoch dynamics are outside the scope of P2. □ Proposition 3 (Encapsulation — P3). For arbitrary DAGs 𝐺 res , cross-domain integrators can partition 𝐺 res into clusters, each exposing a single composite service (slice) with capacity equal to the max-flow of its sub-DAG. If the resulting quotient graph 𝐺 ′ is tree or series–parallel and the encapsulation conditions E1–E3 hold (scalar capacity summary, faithful max-flow, no external coupling; full assumption-applicability table in Section B), the agent-facing feasible region is polymatroidal. Proof. Let the vertex set of 𝐺 res admit a partition 𝑉 = 𝑉1 ⊔ · · · ⊔ 𝑉𝐾 , where each cluster 𝑉𝑘 is the responsibility of integrator 𝑘 and induces a sub-DAG 𝐺𝑘 = (𝑉𝑘 , 𝐸𝑘 ) with internal capacities inherited from 𝐺 res . Inter-cluster edges retain their original capacities. Define the slice capacity 𝐶¯𝑘 = max -flow(𝐺𝑘 ) = min cap(𝐶), 𝐶 cut of 𝐺𝑘
i.e., the value of a maximum flow inside 𝐺𝑘 from its in-boundary to its out-boundary. Define the quotient graph 𝐺 ′ = (𝑉 ′, 𝐸 ′ ) by contracting each 𝑉𝑘 to a single node 𝜈𝑘 of capacity 𝐶¯𝑘 , retaining all inter-cluster edges with their original capacities, and absorbing each contracted node by the standard node-splitting reduction so that the flow through 𝜈𝑘 is bounded by 𝐶¯𝑘 . The agent-facing leaf set 𝐸 slice collects one slice token per cluster (or per slice type, when integrators expose multiple slice families). (i) Encapsulation conditions. The conditions E1–E3 specialise the contraction to informationpreserving form. • E1 (scalar capacity). Each integrator’s slice exposes a single non-negative scalar 𝐶¯𝑘 to the agent-facing market; no internal structure of 𝐺𝑘 is observable. • E2 (faithful summary). 𝐶¯𝑘 equals the actual max-flow of 𝐺𝑘 . No bottleneck strictly tighter than 𝐶¯𝑘 is hidden inside the cluster, so the contracted node behaves identically to 𝐺𝑘 at every external cut. • E3 (no cross-slice complementarity). An agent’s value for slice 𝑘 does not depend on the allocations of slice 𝑘 ′ ≠ 𝑘 to other agents. Formally, valuations are additively separable Í across slice types: 𝑣𝑖 (𝑥𝑖 ) = 𝑘 𝑣𝑖,𝑘 (𝑥𝑖,𝑘 ). (ii) Information-preserving contraction. Fix any cut 𝐶 ′ of 𝐺 ′ separating the source side from the root. By E2, each contracted node 𝜈𝑘 on 𝐶 ′ contributes capacity exactly 𝐶¯𝑘 , which equals the
Credibility Trilemma in Polymatroidal Service Markets
0:9
minimum capacity over all cuts of 𝐺𝑘 separating its in-boundary from its out-boundary. Hence cap𝐺 ′ (𝐶 ′ ) = cap𝐺 res (𝐶 ∗ ), where 𝐶 ∗ is the cut of 𝐺 res obtained by replacing each 𝜈𝑘 ∈ 𝐶 ′ with a min-cut of the corresponding 𝐺𝑘 , and the inter-cluster edges of 𝐶 ′ retain their capacities. Therefore the rank function 𝑓 ′ of 𝐺 ′ at any agent-facing source set 𝑆 ⊆ 𝐸 slice equals the rank function of 𝐺 res at the corresponding leaf set: 𝑓 ′ (𝑆) = 𝑓𝐺 res (𝜄 (𝑆)), where 𝜄 maps each slice token to the leaves inside the corresponding cluster. Submodularity, monotonicity, and normalisation transfer from 𝑓𝐺 res to 𝑓 ′ unchanged [32, Theorem 3.22], so 𝑓 ′ is itself a polymatroid rank function on 𝐸 slice . (iii) Reduction to Proposition 1. If the quotient graph 𝐺 ′ is a rooted tree or SP network, Proposition 1 applied to 𝐺 ′ yields that the agent-facing feasible region ′ Xres = { 𝑥 ∈ R𝐸≥0 : 𝑥 (𝑆) ≤ 𝑓 ′ (𝑆) ∀𝑆 ⊆ 𝐸 slice } slice
is a polymatroid. Combined with E3 (additive separability across slice types), the agent-facing market is a polymatroidal mechanism design problem to which Proposition 2 applies. □ GS valuations arise under three conditions: (GS1) unit demand, (GS2) additive separability, (GS3) fixed attributes within each epoch. Integrator encapsulation (Proposition 3) supplies these by bundling multi-resource paths into substitutable slices, subject to encapsulation conditions E1–E3 (full applicability table in Section B). Together, Propositions 1 to 3 establish that a hybrid architecture with integrators restores tractable, incentive-compatible coordination even for complex dependency structures. All credibility results below assume P1–P3 and GS1–GS3. Type spaces at two marketplace tiers. Level 1 (cross-domain slice marketplace) is single-parameter and matroid: encapsulation (P3) makes each agent unit-demand on composite slices (𝑥𝑖 ∈ {0, 1}), so the Archer–Tardos characterisation [7] applies. Level 2 (within-domain raw-resource marketplace) is multi-unit polymatroidal (𝑥𝑖 ≥ 0), requiring the GS/clinching framework [36, 40]. The distinction matters for credibility: the deferred-revelation auction (DRA, defined formally in Theorem 8(ii)) applies only to Level 1, while ascending clinching and domain separation cover both tiers. Running example (PAA, three-tier). In the PAA scenario (Fig. 2), the building-side sensor–edge– cloud DAG is tree-structured [54], so P1 holds, P3 bundles the three tiers into a context-aware slice, and PAAs’ unit-demand GS valuations satisfy P2. The induced polymatroid is non-modular because PAAs share the edge inference and cloud reasoning capacities (𝑓 ({𝑖, 𝑗 }) < 𝑓 ({𝑖}) + 𝑓 ({ 𝑗 }) for any pair sharing a constrained tier); non-modularity is what creates positive Archer–Tardos payments and the credibility problem of Section 3.2. A concurrent mediator-faithful baseline. Independently and concurrently, Amin et al. [5] establish the same Walrasian–VCG baseline for capacity-sharing networks: gross substitutes on series– parallel topologies with homogeneous disutility (Lemma 3.8), polynomial-time integer equilibrium (Theorem 3.2), and a VCG-equivalent equilibrium that maximises utilities and minimises edge prices (Theorem 3.10), with their LP integrality gap on non–series–parallel topologies playing the role of 𝛾𝑖 𝑗 . Their citation chain [40, 48] overlaps ours. The credibility gap below applies to their faithful-mediator baseline as well; Section A establishes Theorem 1, Corollary 1, and Proposition 5 as instances over their primitives via the bridging lemmas Lemmas 5 to 7 and Theorem 10. 2.2
Credible Mechanism Design
The results above guarantee that no agent benefits from misreporting its type. They are silent, however, on the behaviour of the entity that executes the mechanism. Akbarpour and Li [3] formalised this concern as credibility: a mechanism is credible if the auctioneer has no incentive to deviate from the prescribed protocol, given that deviations must be undetectable to any individual bidder. They proved a striking trilemma for single-item auctions: no
0:10
Lovén et al.
static, sealed-bid mechanism is simultaneously (i) revenue-optimal, (ii) strategyproof for bidders, and (iii) credible for the auctioneer. The ascending (English) auction is the unique credible, strategyproof mechanism, but it is not revenue-optimal; the first-price auction is the unique credible static mechanism, but it is not strategyproof. The revenue-maximising mechanism design tradition [55, 58, 59] provides the benchmark for property (i): Myerson’s optimal mechanism maximises expected revenue over regular distributions, and McAfee and McMillan’s dominant-strategy analysis identifies conditions under which dominant-strategy and Bayesian-optimal revenue coincide. Recent work extends these results to richer settings. Ferreira and Weinberg [30] show that a deferred-revelation auction (DRA), implemented over a secure and censorship-resistant blockchain, achieves credibility, strategyproofness, and revenue optimality for strongly regular distributions. Chitra et al. [22] generalise the DRA to any public broadcast channel, removing the blockchain requirement. Ganesh and Zhang [35] extend this approach to matroid feasibility constraints, proving that the DRA satisfies all three properties on matroid environments when bidder values are drawn from 𝛼-strongly regular distributions; they also establish that DRA is not credible beyond matroid feasibility. 2.3
The Truthful Execution Gap
We now make explicit what P1–P3, and the mediator-faithful baseline of [5], implicitly assume. We use marketplace operator for the entity that runs the auction (collects bids, computes allocations, charges payments) and integrator for the entity that composes a sub-DAG into a slice (P3); the credibility problem arises when the same legal entity plays both roles, e.g., an edge provider that both integrates its on-prem inference resources and runs the slice marketplace. Information model. In the sealed-bid setting, each agent 𝑖 observes only its own bid 𝑏𝑖 , allocation 𝑥𝑖 , and payment 𝑝𝑖 (no public transcript); in the ascending setting, agent 𝑖 additionally observes the broadcast price clock and clinching events, and undetectability requires consistency with the public record. The DSIC guarantee of P2 holds when: A1. The operator collects all bids without alteration. A2. The operator computes the welfare-maximising allocation (via ascending auction or equivalent polynomial-time procedure on the polymatroid). A3. The operator charges VCG payments (or clinching-auction prices) exactly as prescribed. A4. The operator does not selectively reveal bid information to affiliated agents. In a multi-domain service economy, the entity running the marketplace may violate any of A1–A4. We identify four operator deviations, ordered to follow A1–A4: • Capacity misreporting (violates A1+A2). An operator that is simultaneously an integrator may understate its sub-DAG max-flow 𝐶¯ 𝑗 , creating artificial scarcity and inflating slice prices. • Discriminatory allocation (violates A2). The operator may allocate off-equilibrium, favouring affiliated agents over higher-WTP outsiders rather than maximising welfare. • Price manipulation (violates A3). Because losing bids are not visible to agents under the sealed-bid information model, the operator can compute payments that differ from the VCG/clinching prescription without contradicting any agent’s view of the outcome. Shill bidding is the canonical implementation: a phantom bid raises the Archer–Tardos integrand and inflates a winner’s payment by the additional Riemann area. • Selective information revelation (violates A4). The operator may share bid information with affiliated agents, who then form an effective coalition with the operator for surplusextracting joint deviations; coalition-aware mechanism design is out of scope here.
Credibility Trilemma in Polymatroidal Service Markets
0:11
The credibility gap is thus: even if agents are truthful (guaranteed by DSIC), the mechanism’s welfare and incentive properties are only realised if the operator is also truthful. Simulation evidence sharpens this. Lovén [54] shows that under truthful bidding a value-greedy heuristic (full valuation visibility, no prices) achieves welfare within 1% of the market mechanism across all tested conditions; under P1 this follows from Edmonds’ theorem [29], since priorityby-bid and priority-by-value coincide when bids are truthful. The mechanism’s contribution is therefore purely incentive-theoretic: DSIC induces the truthful reporting that the heuristic would need but cannot obtain across trust boundaries. Without truthful reporting, bid inflation breaks the value–bid coincidence and the equivalence collapses. Credibility is the channel through which the incentive guarantee flows: an operator deviation removes agents’ reason to trust that truthful bidding is optimal, dissolving DSIC in practice and the welfare-maximising allocation with it. A quantitative summary of this gap, the Cost of Non-Credibility (CoNC), is introduced in Section 3.2 alongside the trilemma; Section 4.4 reports its empirical value under each credibility mechanism. 2.4
Scope of the Credibility Analysis
The credibility results that follow apply to any mechanism-mediated market whose feasible region is non-modular polymatroidal and whose operator is a strategic player observing the bid profile. The hybrid sensor–edge–cloud market of [54] is one canonical realisation; alternative realisations include network-slice brokering [1, 73], multi-tenant resource auctions with sub-modular capacity, and any setting in which conditions P1–P3 (or their non-computing-continuum analogues) hold. We use the PAA scenario as a running example for concreteness, but the trilemma and its resolutions transfer wherever the structural conditions are met. 2.5
Notation
Table 1 collects the symbols used throughout the paper. 3
Credible Mechanisms for Polymatroidal Service Markets
This section presents the paper’s main theoretical contributions: a credibility trilemma for polymatroidal service markets, a commitment-based resolution, and alternative credibility mechanisms based on domain separation and integrator competition. 3.1
Operator Model
We extend the mechanism design model of [54] by introducing the marketplace operator as a strategic player. The polymatroidal service market hosts four formally distinct roles, which real deployments may collapse into a single legal entity in various combinations. Definition 1 (Role taxonomy of the polymatroidal service market). The market involves four roles: (1) Resource owner. Supplies the underlying capacity (compute, bandwidth, storage) into the polymatroidal feasible region Xres , and receives wholesale payments outside the auction loop (under settlement separation, the agent-to-owner transfer transits the operator without entering its books; see (C0) of Proposition 5). (2) Integrator. Composes a sub-DAG of resources into a sellable slice (P3 of [54], Proposition 3); sets the slice’s encapsulation parameters (max-flow 𝐶¯𝑘 , slice-type cardinality, eligibility set). (3) Marketplace operator. Runs the auction over the polymatroid of slices: receives bids b = (𝑏 1, . . . , 𝑏𝑛 ), computes an allocation 𝑥 ∈ Xres and payments 𝑝 = (𝑝 1, . . . , 𝑝𝑛 ). The strategic player whose deviation 𝛿 is the subject of Theorem 1.
0:12
Lovén et al.
Table 1. Summary of Notation Symbol
Meaning
Agents, types, and allocations (from [54]) A Set of agents 𝑛 Number of agents (|A|) 𝜃𝑖 Type of agent 𝑖 𝑣𝑖 Private valuation of agent 𝑖 𝑥𝑖 Allocation for agent 𝑖 𝑝𝑖 Payment by agent 𝑖 b = (𝑏 1, . . . , 𝑏𝑛 ) Bid vector 𝑓 Polymatroid rank function Xres Feasible allocation region (polymatroid) 𝐺 res Service-dependency DAG Credibility framework O 𝛿 𝛾𝑖 𝑗 𝜙 𝜆 𝜀-credibility-rw 𝜀-credibility-ex-ante Dundet (M) Fperturb Lcred, LSalop Γ Γ sup CoNCop, CoNCabsop
Marketplace operator Operator deviation mapping b ↦→ (𝑥 ′, 𝑝 ′ ) Non-modularity gap 𝑓 ({𝑖}) + 𝑓 ({ 𝑗 }) − 𝑓 ({𝑖, 𝑗 }) Per-unit fee (domain separation) Operator ownership-stake fraction (knife-edge) Realisation-wise 𝜀-credibility Ex-ante 𝜀-credibility Undetectable-deviation set on M Perturbation-lemma family Credibility / Salop welfare-loss components Í aggregate non-modularity (static reachability sum), (𝑖,𝑗 ) 𝛾𝑖 𝑗 Í per-realisation joint supremum of (𝑖,𝑗 ) 𝛾𝑖 𝑗 (Γ sup ≤ Γ) Cost of Non-Credibility, ratio / absolute-units variant
Simulation parameters 𝑁 Agents per simulation 𝐶, 𝐿base Tier capacity / base latency
(4) Agent. The buyer, with private valuation 𝑣𝑖 over slices and quasi-linear utility 𝑣𝑖 𝑥𝑖 − 𝑝𝑖 . Real deployments may collapse multiple roles into a single legal entity: resource owner = integrator in vertically integrated cloud providers; integrator = operator in our credibility analysis’s loadbearing dual-role case (an edge provider that hosts inference and runs the slice marketplace). The trilemma is most consequential when roles 2 and 3 are united in one strategic entity, because that entity simultaneously holds private information about supply, controls the auction’s allocation rule, and has custody of payment flows. Throughout we let O denote the marketplace operator of Definition 1(3) over polymatroidal feasible region Xres . The operator receives the bid vector b, computes an allocation and payment, and Í earns revenue 𝑖 𝑝𝑖 minus the cost of procuring the allocated resources. Our credibility analysis is most consequential in the integrator-as-operator dual-role case (roles 2 and 3 united); in single-role deployments (e.g., a neutral exchange satisfying (C0)–(C4)) the trilemma’s third leg is restored.
Credibility Trilemma in Polymatroidal Service Markets
0:13
Definition 2 (Operator Deviation). An operator deviation is a strategic action by the marketplace operator on the received bid profile b. The operator’s action space comprises: (a) evaluating the prescribed mechanism (𝑥 ∗, 𝑝 ∗ ) on b and returning its honest output; or (b) constructing a counterfactual bid vector b̂ (by phantom-bidder insertion, losing-bid concealment, bid substitution, or arbitrary modification of b−𝑖 for any 𝑖), evaluating (𝑥 ∗, 𝑝 ∗ ) on b̂, and returning the resulting per-agent outcomes; or (c) any mixture of (a) and (b) including the freedom to inflate or deflate 𝑖’s payment by an exogenous amount 𝜀𝑖 that is rationalised by an honest execution on some bid profile b̂−𝑖 with 𝑏ˆ𝑖 = 𝑏𝑖 . Formally, a deviation is a mapping 𝛿 : b ↦→ (𝑥 ′, 𝑝 ′ ) that differs from the prescribed mechanism (𝑥 ∗, 𝑝 ∗ ) and is undetectable: no individual agent 𝑖 can distinguish its observed (𝑥𝑖′, 𝑝𝑖′ ) from (𝑥𝑖∗, 𝑝𝑖∗ ) given only its own bid 𝑏𝑖 and outcome, where undetectability is formalised via the support-style safe-deviation criterion of the Information Structure paragraph below (Remark 4). Definition 3 (Credible Mechanism: realisation-wise and ex-ante variants). A mechanism M = (𝑥 ∗, 𝑝 ∗ ) is realisation-wise credible if no operator deviation 𝛿 yields strictly higher revenue than M for any realisation of bids b. It is 𝜀-credible-ex-ante (for 𝜀 ≥ 0) if no operator deviation 𝛿 yields expected revenue exceeding E[rev∗ (M)] + 𝜀 where the expectation is over the bid prior. Realisation-wise credibility is the strictly stronger notion: it implies 0-credibility-ex-ante, while exante credibility does not imply realisation-wise credibility. Throughout, “credible” without qualifier denotes the realisation-wise variant; the trilemma of Theorem 1 is a realisation-wise impossibility. An 𝜀-credible-ex-ante relaxation under finite-frequency auditing, on which a continuous deployable surface in audit frequency can be built, is left for future work; the present paper restricts to the realisation-wise case throughout. The key distinction from agent incentive compatibility is that the operator observes all bids (complete information about the bid profile) and can modify both the allocation and payments, subject only to the undetectability constraint of the information model in Section 2.3. 3.2
Credibility Trilemma
We extend the Akbarpour–Li trilemma [3] from single-item auctions to polymatroidal feasible regions. Recall that a polymatroid is non-modular when agents share capacity: 𝑓 ({𝑖}) + 𝑓 ({ 𝑗 }) > 𝑓 ({𝑖, 𝑗 }) for some pair 𝑖, 𝑗. Non-modularity is the structural condition that enables the operator deviation constructed below. Theorem 1 (Credibility Trilemma for Polymatroidal Markets). Let Xres be a non-modular polymatroidal feasible region with rank function 𝑓 over ground set 𝐸 with |𝐸| ≥ 2, populated by single-parameter agents with quasi-linear valuations and non-degenerate regular priors, operated by a single self-interested operator.2 Within the class of revenue-optimal DSIC static sealed-bid mechanisms over Xres (i.e., monotone allocation rules with Archer–Tardos payments that maximise expected operator revenue under independent regular priors), no mechanism is simultaneously: (i) Revenue-optimal: maximises expected operator revenue when agents’ values are independently drawn from regular distributions in the sense of Myerson [58]; (ii) DSIC for agents: truthful reporting is a dominant strategy; (iii) Credible for the operator in the realisation-wise sense: no profitable undetectable deviation exists for any bid realisation in the support. The “static sealed-bid” format is defined formally in Definition 4 below: the operator executes a single round and each agent observes only its own bid, allocation, and payment. 2 Coalition deviations among multiple operators, or between an operator and a subset of agents, are out of scope here.
Strategy-proof mechanism design under rich interdependent-values type spaces faces structural obstacles [45].
0:14
Lovén et al.
Remark 1 (Scope and what we do not claim). We state the scope of the trilemma and the CoNC bounds once, here, and do not re-litigate it at each downstream result. Three conditions delimit the results. (1) Single-parameter agents. The trilemma and the per-class CoNC bounds are proved for single-parameter quasi-linear agents; integrator encapsulation produces this structure for the slice marketplace (Remark 3). The multi-parameter and Bayesian-IC extensions are open, with identified structural obstructions (Remark 2). (2) “Tight” is matching-rate, not min-max. All tightness claims are asymptotic matching-rate statements: upper and lower bounds share the same growth rate in the structural parameter, both realised by perturbation-lemma deviations (Lemma 1); we do not claim min-max optimality of constants over a larger adversary class (Remark 21). (3) Envelope claim on the SP-augmented sub-family. The statement that the perturbation-lemma family exhausts all undetectable deviations holds for revenue-optimal DSIC mechanisms on SP-augmented topologies (Proposition 4); the matching lower bound on Wheatstone-embedded non-SP DAGs is open (numbered Open Problem 1, Remark 20). The trilemma itself (a single-capacity-sharing-pair construction) needs none of this envelope machinery and holds on every non-modular polymatroid. The constructive resolutions (Theorem 8 and Propositions 5 and 6) are likewise single-parameter and realisation-wise. Remark 2 (Multi-parameter extension: open problem with structural obstructions). The single-parameter scope is registered in Remark 1; here we record why the multi-parameter extension is open. Extending to multi-dimensional type spaces Θ𝑖 ⊂ R𝑑 (𝑑 ≥ 2) faces structural obstructions upstream of the trilemma’s revenue-optimal leg. Separable-utility special case (positive corner). If agent 𝑖’s utility decomposes as 𝑢𝑖 (𝜃 𝑖 , 𝑥) = Í𝐷 (𝑑 ) (𝑑 ) (𝑑 ) ) across dimensions and the feasibility structure factors as a product polymatroid 𝑑=1 𝑢𝑖 (𝜃 𝑖 , 𝑥 Xres = X (1) × · · · × X (𝐷 ) , the multi-dim mechanism factors into 𝐷 independent single-parameter mechanisms by direct-sum decomposition of the polymatroid base polytope [32, Theorem 3.5]. The trilemma applies coordinate-wise. Integrator encapsulation [54] (P3, see Remark 3) is the structural device that produces this product structure for the slice marketplace. Generic obstructions. For non-separable multi-dim type spaces, two classical mechanism-design impossibilities lie upstream of the trilemma’s revenue-optimal leg. • Interdependent values: Jehiel and Moldovanu [45] prove that efficient Bayes–Nash incentivecompatible implementation under interdependent values with multi-dim signals requires a generically failing congruence (integrability) condition. The trilemma’s revenue-optimal leg is vacuous on the resulting impossibility region: there is no Bayes–Nash IC mechanism that achieves efficiency, hence no revenue-optimal one to violate credibility. • Weak monotonicity: Bikhchandani et al. [13] characterise multi-parameter DSIC by weak monotonicity, which is strictly stronger than the single-parameter monotonicity of Eq. (1). The DSIC class on multi-dim types is correspondingly smaller; revenue-optimal DSIC mechanisms may not exist on the full type space. Bayesian relaxation. Cai, Daskalakis and Weinberg [16] reduce multi-dim revenue-optimal Bayesian incentive-compatible (BIC) mechanism design to welfare maximisation via LP duality. The BIC envelope of Dundet on a multi-dim type space is wider than the DSIC envelope; if the trilemma is restated for BIC mechanisms, the perturbation-lemma family of Lemma 1 no longer characterises Dundet (Proposition 4 requires DSIC + single-parameter). A trilemma analog under BIC + multi-dim is a clean open problem; we conjecture the qualitative impossibility extends, but neither the perturbation lemma nor the envelope proposition transfers without new structural results. The constructive resolutions of Theorem 8 and Proposition 5 remain single-parameter. Remark 3 (Encapsulation eliminates complementarities). Integrator encapsulation (P3 of [54]) ensures the single-parameter condition by bundling multi-resource service paths into composite
Credibility Trilemma in Polymatroidal Service Markets
0:15
slices, so each agent’s allocation per task is binary (𝑥𝑖 ∈ {0, 1}). Service-composition complementarities are absorbed within the integrator’s bundle rather than exposed to the mechanism. The reduction is tight: violation of any encapsulation condition (E1–E3) can re-introduce multi-dimensionality (Remark 2). The non-modularity condition (∃ 𝑖, 𝑗 with 𝛾𝑖 𝑗 = 𝑓 ({𝑖})+𝑓 ({ 𝑗 })−𝑓 ({𝑖, 𝑗 }) > 0, the non-modularity gap) ensures that agents share capacity; if 𝑓 is modular (𝛾𝑖 𝑗 = 0 for all 𝑖, 𝑗), agents are independent and credibility is trivially satisfied. In the DAG-induced polymatroid of [54], non-modularity holds whenever two agents’ service-dependency DAGs share a capacity-constrained internal node. This is the standard condition in the computing continuum, where edge servers, network links, and cloud endpoints are shared across organisational boundaries [26]. In the PAA scenario, all PAAs competing for inference slots on a building’s edge server satisfy this condition. We now prove the trilemma in three steps; the load-bearing technical step is a Payment Perturbation Lemma constructing a profitable, undetectable operator deviation. An instance-level statement over the edge-pricing primitives of [5] on the SP-with-homogeneous-disutility class is established as Theorem 10 in Appendix A. Definition 4 (Static sealed-bid mechanism). A mechanism is static if the operator executes a single round (no within-round observation-and-response dynamics between agents and operator) and sealed-bid if each agent 𝑖’s information on the execution path comprises only its own bid 𝑏𝑖 , its allocation 𝑥𝑖 , and its payment 𝑝𝑖 (no public broadcast, no third-party transcript, no cross-agent observation). The undetectability condition of Definition 2 is defined with respect to this information model. Information structure. We make the information model behind Definitions 2 and 4 explicit. The bid Î profile b = (𝑏 1, . . . , 𝑏𝑛 ) is drawn from the joint prior 𝐹 = 𝐹 1 ×· · ·×𝐹𝑛 on type space Θ = 𝑖 Θ𝑖 ⊂ R𝑛≥0 (independent regular priors per the trilemma hypotheses). For each agent 𝑖, the signal space on the execution path is Σ𝑖 = Θ𝑖 × R ≥0 × R ≥0 , with realised signal 𝜎𝑖 = (𝑏𝑖 , 𝑥𝑖 , 𝑝𝑖 ) comprising agent 𝑖’s own bid, its allocation, and its payment. The observation set is therefore Σ𝑖 alone: agent 𝑖 does not observe 𝑏 −𝑖 , the bidder count, the identities or eligibility of any other participating agent, the allocation rule’s intermediate state, or the rank function 𝑓 beyond what is implied by its own outcome. The conditional distribution that agent 𝑖 uses to assess plausibility of the observed Î signal is 𝐹 −𝑖 = 𝑗≠𝑖 𝐹 𝑗 marginalised through the prescribed allocation and payment rules: agent 𝑖 accepts (𝑥𝑖 , 𝑝𝑖 ) as honest iff there exists b̂−𝑖 ∈ supp(𝐹 −𝑖 ) with (𝑥𝑖∗ (𝑏𝑖 , b̂−𝑖 ), 𝑝𝑖∗ (𝑏𝑖 , b̂−𝑖 )) = (𝑥𝑖 , 𝑝𝑖 ). A deviation 𝛿 is undetectable in the Akbarpour–Li safe-deviation sense [3, §3] iff such a b̂−𝑖 exists for every agent 𝑖 simultaneously; the dimension of b̂−𝑖 is not constrained to equal that of b−𝑖 , so the operator may rationalise the observed outcome via a counterfactual bid vector that inserts phantom bidders, conceals losing bids, or substitutes participating identities (see Definition 2 for the action-space enumeration). This support-style notion is distinct from a Bayesian likelihoodratio undetectability, which would require the deviation distribution and the honest distribution to be statistically indistinguishable as posteriors over b̂−𝑖 . Bayesian-undetectability is logically the stronger condition (it implies support-undetectability whenever the prior has full support: if the honest posterior puts positive mass on b̂−𝑖 , then b̂−𝑖 ∈ supp(𝐹 −𝑖 ); the converse fails because an outcome can be supported by a rationalising profile of arbitrarily small prior probability and still be statistically distinguishable in expectation). We adopt support-undetectability throughout because it is the operationally relevant restriction for one-shot extensive-form credibility in the Akbarpour–Li sense: the agent has a single bid–outcome observation and must reject the deviation hypothesis on the basis of impossibility, not statistical improbability. Adopting the weaker support condition therefore tightens the operator’s effective constraint to the one a single-shot agent can
0:16
Lovén et al.
actually enforce, and matches the Akbarpour–Li definition of safe deviation; it is not a strength ranking but a choice of the right notion for the setting. Remark 4 (Akbarpour–Li safe-deviation property). The undetectability requirement in Definition 2 coincides with the safe-deviation property of Akbarpour and Li [3, §3, Definition 3]: the operator’s modified outcome (𝑥𝑖′, 𝑝𝑖′ ) lies in the support of some honest execution, i.e., there exists a legitimate bid profile b̂ with 𝑏ˆ𝑖 = 𝑏𝑖 under which the prescribed mechanism would produce exactly the observed outcome for each agent (the support-vs-Bayesian distinction and our choice of the support notion are detailed in the Information Structure paragraph above). The sealed-bid information structure of Definition 4 is precisely the setting in which this notion is non-trivial: if agents could observe others’ bids and identities, any payment discrepancy would be immediately detectable. The Payment Perturbation Lemma (Lemma 1) constructs such a safe deviation by producing a ghost-bid profile that rationalises the inflated payment uniformly over agent 𝑖’s bid neighbourhood (Remark 7 below). DSIC payment characterisation. In any static sealed-bid DSIC mechanism for single-parameter agents, the allocation rule 𝑥 (·) must be monotone non-decreasing in each agent’s bid, and the payment rule is pinned by the allocation rule [7]: ∫ 𝑏𝑖 𝑝𝑖 (b) = 𝑏𝑖 𝑥𝑖 (𝑏𝑖 , 𝑏 −𝑖 ) − 𝑥𝑖 (𝑧, 𝑏 −𝑖 ) 𝑑𝑧, (1) 0
where 𝑥𝑖 (𝑧, 𝑏 −𝑖 ) denotes agent 𝑖’s allocation when it bids 𝑧 while all other bids 𝑏 −𝑖 remain fixed. The welfare-maximising and (ironed-)virtual-welfare-maximising allocations on the polymatroid are computed by the Edmonds greedy algorithm [29, 32]: sort agents by a priority order (decreasing bid for welfare-maximising VCG, decreasing ironed virtual value for revenue-optimal mechanisms), and allocate each the maximum feasible amount given the polymatroid constraint and prior allocations. Lemma 1 (Payment perturbation). Let 𝑓 be a non-modular polymatroid with a capacity-sharing pair 𝑖, 𝑗 ∈ 𝐸, i.e., 𝑓 ({𝑖}) + 𝑓 ({ 𝑗 }) > 𝑓 ({𝑖, 𝑗 }). Define 𝛾𝑖 𝑗 = 𝑓 ({𝑖}) + 𝑓 ({ 𝑗 }) − 𝑓 ({𝑖, 𝑗 }) > 0 (the non-modularity gap). Consider any DSIC mechanism whose allocation is the welfare- or virtualwelfare-maximising allocation on the polymatroid (computed by the Edmonds greedy algorithm) with payments given by the Archer–Tardos identity. Then there exists a bid profile b and a perturbation b̂ such that agent 𝑖’s payment increases by exactly 𝜀 while its allocation at 𝑏𝑖 is unchanged, for any desired 𝜀 > 0 sufficiently small. Proof. We construct the perturbation on a generic bid profile with positive other-agents’ bids, generalising the earlier draft’s two-agent construction (which was measure-zero on continuous regular priors for |𝐸| ≥ 3 because it required 𝑏𝑘 = 0 for all 𝑘 ∉ {𝑖, 𝑗 }). Setup on a positive-measure event. Let b = (𝑏𝑖 , 𝑏 𝑗 , 𝑏 −𝑖,− 𝑗 ) be a bid profile from the prior support with 𝑏𝑖 > 𝑏 𝑗 > max𝑘∉{𝑖,𝑗 } 𝑏𝑘 > 0 and with the priority ordering of the Edmonds greedy processing 𝑖 before 𝑗 before every other agent at the pair (𝑖, 𝑗) on which the contest occurs. This event has positive prior probability under any non-degenerate regular prior (it is the open set {𝑏𝑖 > 𝑏 𝑗 > max𝑘∉{𝑖,𝑗 } 𝑏𝑘 } ∩ {𝑏 𝑗 > 0}, which has positive Lebesgue measure on any continuous prior with full support on a positive-mass interval). Set 𝑏ˆ 𝑗 = 𝑏 𝑗 + 𝛿 with 0 < 𝛿 < min(𝑏𝑖 − 𝑏 𝑗 , 𝜀¯𝑖 𝑗 ), where 𝜀¯𝑖 𝑗 = min(𝑏𝑖 −𝑏 𝑗 , 𝑏 𝑗 −max𝑘∉{𝑖,𝑗 } 𝑏𝑘 ) is the local Walrasian-price gap preserving the priority ordering. All other bids 𝑏 −𝑖,− 𝑗 remain fixed at their truthful values. (i) Allocation at 𝑏𝑖 is unchanged. Since 𝑏𝑖 > 𝑏 𝑗 + 𝛿 = 𝑏ˆ 𝑗 and 𝑏ˆ 𝑗 > max𝑘∉{𝑖,𝑗 } 𝑏𝑘 (by the choice 𝛿 < 𝑏 𝑗 − max𝑘∉{𝑖,𝑗 } 𝑏𝑘 when 𝑏 𝑗 > max𝑘∉{𝑖,𝑗 } 𝑏𝑘 , which is the positive-measure event we condition on), the greedy processes 𝑖 first under both 𝑏 −𝑖 and 𝑏ˆ−𝑖 . The contest at 𝑏𝑖 involves 𝑖 and 𝑗 first (the top two bidders); other agents’ allocations depend on the residual capacity after 𝑖 and 𝑗 have been processed, and these residual capacities are determined by the polymatroid’s rank function
Credibility Trilemma in Polymatroidal Service Markets
0:17
restricted to the agents already processed. Other agents’ allocations may change in concert with 𝑗’s allocation, but 𝑖’s allocation at 𝑏𝑖 is unchanged in both profiles: 𝑖 receives 𝑓 ({𝑖}). (ii) Allocation at lower bids decreases on (𝑏 𝑗 , 𝑏 𝑗 + 𝛿). For any counterfactual bid 𝑧 ∈ (𝑏 𝑗 , 𝑏 𝑗 + 𝛿): • Under 𝑏 −𝑖 : 𝑧 > 𝑏 𝑗 > max𝑘∉{𝑖,𝑗 } 𝑏𝑘 , so 𝑖 (bidding 𝑧) is processed before 𝑗 and before every other agent. Agent 𝑖 receives 𝑥𝑖 (𝑧, 𝑏 −𝑖 ) = 𝑓 ({𝑖}). • Under 𝑏ˆ−𝑖 : 𝑧 < 𝑏 𝑗 + 𝛿 = 𝑏ˆ 𝑗 , but 𝑧 may exceed or be below max𝑘∉{𝑖,𝑗 } 𝑏𝑘 . By the construction 𝛿 < 𝑏 𝑗 − max𝑘∉{𝑖,𝑗 } 𝑏𝑘 , we have 𝑧 > 𝑏 𝑗 > max𝑘∉{𝑖,𝑗 } 𝑏𝑘 , so 𝑗 is processed before 𝑖, and 𝑖 is processed before every other agent. Agent 𝑗 receives 𝑓 ({ 𝑗 }); then 𝑖 receives 𝑥𝑖 (𝑧, 𝑏ˆ−𝑖 ) = 𝑓 ({𝑖, 𝑗 }) − 𝑓 ({ 𝑗 }) = 𝑓 ({𝑖}) − 𝛾𝑖 𝑗 . For 𝑧 ∉ (𝑏 𝑗 , 𝑏 𝑗 + 𝛿): if 𝑧 ≤ 𝑏 𝑗 , then 𝑗 is processed before 𝑖 in both profiles (with the priority order on other agents preserved), and 𝑖 receives 𝑓 ({𝑖, 𝑗 }) − 𝑓 ({ 𝑗 }) = 𝑓 ({𝑖}) − 𝛾𝑖 𝑗 in both; if 𝑧 > 𝑏 𝑗 + 𝛿, then 𝑖 is processed before 𝑗 in both, and 𝑖 receives 𝑓 ({𝑖}) in both. So the allocation difference 𝑥𝑖 (𝑧, 𝑏 −𝑖 ) − 𝑥𝑖 (𝑧, 𝑏ˆ−𝑖 ) is supported on the interval (𝑏 𝑗 , 𝑏 𝑗 + 𝛿) and equals 𝛾𝑖 𝑗 on that interval, regardless of the other agents’ positive bids. (iii) Payment increase is exactly 𝛿 · 𝛾𝑖 𝑗 . By the Archer–Tardos formula (1): ∫ 𝑏𝑖 ∫ 𝑏𝑖 ∫ 𝑏 𝑗 +𝛿 𝑝ˆ𝑖 − 𝑝𝑖 = 𝑥𝑖 (𝑧, 𝑏 −𝑖 ) 𝑑𝑧 − 𝑥𝑖 (𝑧, 𝑏ˆ−𝑖 ) 𝑑𝑧 = 𝑓 ({𝑖}) − (𝑓 ({𝑖, 𝑗 }) − 𝑓 ({ 𝑗 })) 𝑑𝑧 = 𝛿 · 𝛾𝑖 𝑗 . 0
0
𝑏𝑗
The integrand on (𝑏 𝑗 , 𝑏 𝑗 + 𝛿) is the constant 𝛾𝑖 𝑗 for every 𝑧 in the interval, independent of the other agents’ bids (which appear in the integrand only through whether agent 𝑖 is processed at all at the residual capacity step; since the priority order between 𝑖, 𝑗 and the other agents is preserved by the choice of 𝛿, the other agents’ allocations are integrated symmetrically in both expressions and cancel). For any desired 𝜀 ∈ (0, (𝑏𝑖 − 𝑏 𝑗 )𝛾𝑖 𝑗 ), choose 𝛿 = 𝜀/𝛾𝑖 𝑗 . Then 𝑝ˆ𝑖 = 𝑝𝑖 + 𝜀. The construction is supported on the positive-measure event {𝑏𝑖 > 𝑏 𝑗 > max𝑘∉{𝑖,𝑗 } 𝑏𝑘 > 0} ∩ {𝛿 < 𝜀¯𝑖 𝑗 } of the bid prior, so the perturbation is realised on a positive-probability set of profiles, not on the measure-zero corner where all other agents bid zero. □ Worked example. Consider a minimal non-modular polymatroid with two agents sharing an edge server: 𝑓 ({1}) = 𝑓 ({2}) = 2, 𝑓 ({1, 2}) = 3, so 𝛾 12 = 2 + 2 − 3 = 1. Agent 1 bids 𝑏 1 = 10, agent 2 bids 𝑏 2 = 5. Greedy processes agent 1 first: 𝑥 1 = 𝑓 ({1}) = 2; then agent 2: 𝑥 2 = 𝑓 ({1, 2}) − 𝑥 1 = 1. The ∫ 10 Archer–Tardos payment for agent 1 is 𝑝 1 = 10 · 2 − 0 𝑥 1 (𝑧) 𝑑𝑧. For 𝑧 > 5, agent 1 is processed first and receives 𝑥 1 (𝑧) = 2; for 𝑧 ≤ 5, agent 2 is processed first and agent 1 receives 𝑓 ({1, 2})−𝑓 ({2}) = 1. So 𝑝 1 = 20 − (5 · 1 + 5 · 2) = 5. Now the operator perturbs: raise agent 2’s bid to 𝑏ˆ2 = 5 + 𝛿 with 𝛿 = 1. Agent 1’s allocation at 𝑏 1 = 10 is unchanged (𝑥 1 = 2), but for counterfactual bids 𝑧 ∈ (5, 6), agent 2 now has priority and agent 1’s allocation drops from 2 to 1. The integral decreases by 𝛿 · 𝛾 12 = 1, so the payment rises to 𝑝ˆ1 = 6. Agent 1 observes (𝑥 1, 𝑝 1 ) = (2, 6), which is consistent with an honest execution under a profile where a more aggressive competitor bids 6. The deviation is undetectable and yields +1 extra revenue for the operator. Proof of Theorem 1. The proof adapts Akbarpour and Li [3] from single-item auctions to polymatroidal feasible regions in three steps. Step 1 (Unique candidate mechanism, up to tie-breaking and flat-ironed-region indeterminacy). The theorem rules out the simultaneous achievement of (i)–(iii). By the Myerson characterisation [58] (extended to single-parameter settings by Archer and Tardos [7]), any revenueoptimal DSIC mechanism on independently drawn regular values must have an allocation rule Í that maximises the (ironed) virtual welfare 𝑖 𝜑¯𝑖 (𝑏𝑖 ) 𝑥𝑖 , with a payment rule satisfying (1) (unique up to an additive constant normalised to zero by individual rationality). On the polymatroid, this maximisation is solved by the Edmonds greedy with agents sorted by decreasing 𝜑¯𝑖 (𝑏𝑖 ). Two
0:18
Lovén et al.
distinct sources of non-uniqueness apply: (a) tie-breaking on measure-zero virtual-value-tie sets (the standard Myerson caveat: at bid profiles where 𝜑¯𝑖 (𝑏𝑖 ) = 𝜑¯ 𝑗 (𝑏 𝑗 ) exactly, the priority order between 𝑖 and 𝑗 in the greedy is unconstrained, but the event has measure zero and the integrated payment is unaffected); and (b) flat ironed-virtual-value regions (the ironing procedure of [58] produces a piecewise-monotone 𝜑¯ with possibly flat regions where two distinct bid values map to the same ironed virtual value; on such regions the polymatroid LP can have a continuum of revenue-optimal extreme points, all sharing the same expected revenue). The conjunction of (i) and (ii) selects an equivalence class of mechanisms differing on (a)+(b), all with the same Archer–Tardos payment structure and therefore equally susceptible to the perturbation deviation; if this equivalence class fails (iii), then no mechanism in the class achieves all three properties. The two-agent perturbation ¯ avoiding construction of Lemma 1 uses bid values (𝑏𝑖 , 𝑏 𝑗 ) in the strictly-monotone interior of 𝜑, the flat-region indeterminacy. Tie-breaking convention at the boundary of the perturbation window. At the measure-zero events 𝑧 = 𝑏 𝑗 and 𝑧 = 𝑏 𝑗 + 𝛿 (where the priority order between 𝑖 and 𝑗 flips), we adopt the lexicographic tie-breaking convention 𝑗 ≺ 𝑖 when bids are equal and otherwise priority by bid; the convention does not affect the integral of Lemma 1(iii) because the boundary points form a measure-zero subset of the integration domain. Step 2 (Payment-inflation deviation). We construct a deviation that is profitable and undetectable. Construction. The operator reports the true allocation 𝑥 ∗ (b) but charges a chosen agent 𝑖 an inflated payment 𝑝𝑖′ = 𝑝𝑖 + 𝜀𝑖 for some 𝜀𝑖 > 0, keeping all other agents’ outcomes unchanged. Revenue gain. The operator’s revenue increases by Δ𝑅 = 𝜀𝑖 > 0. Undetectability. By Lemma 1, there exists a bid profile b and a perturbation b̂ = (𝑏 − 𝑗 , 𝑏ˆ 𝑗 ) with 𝑏ˆ 𝑗 = 𝑏 𝑗 + 𝛿 such that 𝑥𝑖 (𝑏𝑖 , 𝑏ˆ−𝑖 ) = 𝑥𝑖 (𝑏𝑖 , 𝑏 −𝑖 ) and 𝑝ˆ𝑖 = 𝑝𝑖 + 𝜀𝑖 . Agent 𝑖 observes only (𝑏𝑖 , 𝑥𝑖 , 𝑝𝑖′ ) in a sealed-bid mechanism. Since (𝑥𝑖 , 𝑝𝑖′ ) = (𝑥𝑖 (𝑏𝑖 , 𝑏ˆ−𝑖 ), 𝑝ˆ𝑖 ), the outcome is identical to an honest execution under the legitimate profile b̂. Agent 𝑖 cannot distinguish the deviation from a market with one more competitive participant. Formally, the undetectability condition holds: ∃ b̂ with 𝑏ˆ𝑖 = 𝑏𝑖 such that 𝑥𝑖′ = 𝑥𝑖∗ ( b̂) and 𝑝𝑖′ = 𝑝𝑖∗ ( b̂). Step 3 (Extension to revenue-optimal mechanisms). The Perturbation Lemma applies to any greedy-based allocation on the polymatroid, because it uses only three ingredients: (a) the greedy processes agents in a priority order, (b) payments follow the Archer–Tardos identity (1), and (c) the non-modularity condition provides a capacity-sharing pair. All three hold for the revenue-optimal mechanism: (a) the virtual-welfare greedy is still an Edmonds greedy on the same polymatroid, with agents sorted by decreasing 𝜑¯𝑖 (𝑏𝑖 ); (b) Archer–Tardos applies to any monotone DSIC allocation rule; (c) non-modularity is a property of 𝑓 , not of the allocation rule. For the virtual-value greedy we need a bid pair (𝑏𝑖 , 𝑏 𝑗 ) on which the priority order fixes 𝑖 before 𝑗, with the construction supported on a positive-measure event of the prior (per the strengthened Lemma 1 above). When agents share a common regular prior, 𝜑¯𝑖 ≡ 𝜑¯ 𝑗 is strictly increasing on its support, so 𝑏𝑖 > 𝑏 𝑗 implies 𝜑¯𝑖 (𝑏𝑖 ) > 𝜑¯ 𝑗 (𝑏 𝑗 ) and the positive-measure construction of Lemma 1 works directly. When agents have asymmetric regular priors (𝐹𝑖 ≠ 𝐹 𝑗 with distinct virtual-value ranges), choose (𝑏𝑖 , 𝑏 𝑗 ) in the interior of supp(𝐹𝑖 ) × supp(𝐹 𝑗 ) satisfying 𝜑¯𝑖 (𝑏𝑖 ) > 𝜑¯ 𝑗 (𝑏 𝑗 ) > 0 on the open set where these inequalities hold and where the priority order on agents 𝑘 ∉ {𝑖, 𝑗 } is strictly below 𝑗’s; this open set has positive Lebesgue measure under any pair of non-degenerate regular distributions whose virtual-value ranges overlap (by continuity of the virtual-value maps and full-support of the priors). The same positive-measure construction of Lemma 1 applies on this open set, yielding the 𝛿 · 𝛾𝑖 𝑗 payment inflation. For irregular distributions, choose 𝑏𝑖 and 𝑏 𝑗 in a region where 𝜑¯ is strictly increasing (avoiding the flat-ironed-region indeterminacy of Step 1);
Credibility Trilemma in Polymatroidal Service Markets
0:19
the priority substitution (𝑏𝑖 , 𝑏 𝑗 ) ↦→ (𝜑¯𝑖 (𝑏𝑖 ), 𝜑¯ 𝑗 (𝑏 𝑗 )) then fixes the greedy processing order, and the positive-measure payment-inflation construction of Step 2 applies with the same 𝛿 · 𝛾𝑖 𝑗 inflation. Since the deviation is profitable and undetectable, and the unique candidate satisfying (i) and (ii) fails (iii), no static sealed-bid mechanism over a non-modular polymatroid achieves revenueoptimality, DSIC, and credibility simultaneously. □ Remark 5 (Ex-ante optimality vs. realisation-wise credibility). Revenue optimality in Í Theorem 1 is ex-ante (Bayesian), i.e., the mechanism maximises expected revenue Ev∼𝐹 𝑖 𝑝𝑖 (v) where v is drawn from the prior. Credibility is realisation-wise: no profitable undetectable deviation exists for any bid realisation b in the support. The trilemma rules out the conjunction of these two distinct properties: a mechanism that is ex-ante revenue-optimal and DSIC must, on a positive-measure set of bid profiles, admit a profitable undetectable deviation for the operator. This asymmetry is inherited from Akbarpour and Li [3] and is essential: reading (iii) as “no deviation is profitable in expectation” would weaken credibility to an ex-ante notion, which is not what realistic operators face when bid profiles are known at execution time. The trilemma as stated operates across the two modes simultaneously. Remark 6 (Non-degenerate priors). The trilemma presumes non-degenerate priors (each 𝐹𝑖 has support of positive Lebesgue measure). Under a degenerate prior (point-mass on a single value), DSIC and revenue optimality are trivial and the Perturbation-Lemma profile cannot be realised with positive probability; the trilemma as stated covers the non-trivial case where each 𝐹𝑖 is non-degenerate. Remark 7 (Safe-deviation property; tightening to Akbarpour–Li §3). Step 2 produces a single legitimate bid profile b̂ = (𝑏 − 𝑗 , 𝑏ˆ 𝑗 ) that simultaneously explains agent 𝑖’s observed outcome (𝑥𝑖 , 𝑝𝑖′ ) for every bid 𝑏𝑖 in the neighbourhood (𝑏 𝑗 , 𝑏 𝑗 + 𝛿)𝑐 ∩ [0, 𝑣¯] on which the allocation 𝑥𝑖 (·, b̂−𝑖 ) coincides with 𝑥𝑖 (·, b−𝑖 ). The undetectability condition therefore satisfies the Akbarpour–Li safedeviation property in the strong form of [3, §3, Definition 3]: the deviation is in the support of an honest execution uniformly over agent 𝑖’s bid continuation space, not merely for the specific realised 𝑏𝑖 . Equivalently, the operator’s strategy commits to the inflated payment ex ante, before observing 𝑏𝑖 , and the agent’s posterior over b̂−𝑖 remains consistent for any 𝑏𝑖 in the safe neighbourhood. This rules out the weaker “marginal-call” undetectability notion (operator deviates only on the realised 𝑏𝑖 and could be caught by any counterfactual), aligning our proof with the Akbarpour–Li canonical setting. Remark 8 (Ghost-bid as constructive illustration). The ghost-bid construction of Akbarpour and Li [3] is a special case of payment inflation: inserting a fictitious bid simultaneously inflates all higher-ranked agents’ payments via the Archer–Tardos formula. We use the ghost-bid form in the simulation experiments (Experiment 2) for its constructive clarity, while the payment-inflation argument above provides the formal proof at full generality. Remark 9 (Scope of the trilemma). The impossibility covers all single-parameter, regularprior, non-modular-polymatroidal static sealed-bid DSIC mechanisms (not only greedy-based ones), through the following logical chain: (a) the Archer–Tardos characterisation [7] pins payments for every monotone DSIC mechanism in the single-parameter setting; (b) Myerson’s theorem [58] establishes that, for independently drawn regular values, the revenue-optimal DSIC allocation rule is unique up to tie-breaking on measure-zero bid sets (it maximises ironed virtual surplus); (c) on the polymatroid, Edmonds’ greedy theorem identifies this unique rule as the greedy algorithm with agents sorted by decreasing ironed virtual value; (d) the Perturbation Lemma (Lemma 1) shows that this greedy-based mechanism admits a profitable undetectable deviation. Since the unique mechanism satisfying both (i) and (ii) fails (iii), no static sealed-bid mechanism achieves all three properties. Tie-breaking variants on measure-zero bid sets define an equivalence class of optimal mechanisms, all sharing the same Archer–Tardos payment structure and therefore equally susceptible to the perturbation deviation.
0:20
Lovén et al.
Crucially, this is a trilemma, not a blanket impossibility for all DSIC mechanisms: DSIC and credible mechanisms exist (e.g., the ascending clinching auction of Theorem 8(i)), and static sealed-bid DSIC mechanisms that are revenue-optimal also exist (the Myerson mechanism). What cannot coexist is the conjunction of all three: static sealed-bid format, DSIC, revenue optimality, and credibility. The same Myerson–Edmonds–Archer-Tardos uniqueness chain also licenses the envelope characterisation that underpins the CoNC bounds of Section 3.3 (Proposition 4); the scope of that envelope claim, and the fact that the trilemma itself needs only a single capacity-sharing pair rather than the full envelope, are stated in Remark 1.
Remark 10 (Pairwise compatibility: witness mechanisms for each two-of-three combination). The three properties of Theorem 1 are pairwise compatible; explicit witness mechanisms exist for each pair, none of which achieves the third leg. • (i)+(ii) revenue-optimal and DSIC, but not credible. The Myerson auction [58] (and its polymatroidal generalisation via the ironed-virtual-value Edmonds greedy with Archer–Tardos payments [7, 36]) is the unique mechanism achieving both (i) and (ii) on regular priors; Lemma 1 shows directly that it fails (iii). • (ii)+(iii) DSIC and credible, but not revenue-optimal. The ascending clinching auction of Ausubel [9], extended to the polymatroidal setting by Goel et al. [36], is DSIC and (under broadcast/transcript assumptions of Theorem 8(i), Definition 6, Definition 7) credible, but achieves welfare-maximisation rather than revenue-optimality, so it does not satisfy (i). • (i)+(iii) revenue-optimal and credible, but not DSIC. The pay-as-bid (first-price) sealed auction over the polymatroid is credible in the Akbarpour–Li sense (the operator has no incentive to deviate from announced rules; agents pay exactly what they bid) and admits revenue-optimal Bayes–Nash equilibria for symmetric regular priors, but it is not DSIC (truthful bidding is not a dominant strategy; equilibrium bidding involves shading by the inverse-hazard-rate factor). In the polymatroidal setting whether a non-DSIC, revenue-optimal, credible mechanism exists across all regular priors remains an open problem; we conjecture it does (mirroring the single-item Akbarpour–Li result) but a formal construction is outside the scope of this paper. The three witnesses confirm that the impossibility in Theorem 1 is the conjunction, not any binary subset. Theorem 1 implies that VCG, the canonical DSIC mechanism of [54], is not credible when the operator has private access to bids. In the PAA scenario, the edge provider running the service marketplace cannot simultaneously maximise revenue, guarantee truthful bidding, and be trusted to run the auction faithfully. Since the mechanism’s primary value lies in making truthful reporting a dominant strategy (Section 2.3), a non-credible mechanism fails to deliver the one property that distinguishes it from a simple value-greedy rule. Cost of non-credibility. To make the trilemma quantitatively comparable to the price-of-anarchy bounds familiar from routing games, we introduce the Cost of Non-Credibility (CoNC). Let rev∗ , Í 𝑊 ∗ = 𝑖 𝑣𝑖 𝑥𝑖∗ , and 𝑝𝑖∗ denote, respectively, the operator revenue, total welfare, and agent 𝑖’s payment under the prescribed mechanism on bid profile b, and let the corresponding 𝛿-superscripted quantities denote the same under the operator deviation 𝛿. The expectations are taken over the
Credibility Trilemma in Polymatroidal Service Markets
0:21
prior on bid profiles. The operator-revenue, welfare, and agent-payment variants are E[rev𝛿 − rev∗ ] , E[rev∗ ] E[𝑊 ∗ − 𝑊 𝛿 ] , CoNCW (𝛿) = E[𝑊 ∗ ] Í Í E[ 𝑖 𝑝𝑖𝛿 − 𝑖 𝑝𝑖∗ ] ag Í CoNC (𝛿) = . E[ 𝑖 𝑝𝑖∗ ]
CoNCop (𝛿) =
(2)
Corollary 1 (CoNC lower bound under non-modularity). On a non-modular polymatroid with capacity-sharing pair (𝑖, 𝑗) and gap 𝛾𝑖 𝑗 > 0, the perturbation deviation of the Payment Perturbation Lemma (Lemma 1) achieves CoNCop (𝛿) =
𝑐 𝛾𝑖 𝑗 E[rev𝛿 − rev∗ ] ≥ E[rev∗ ] E[rev∗ ]
for some constant 𝑐 > 0 depending only on the prior, where the numerator is the expected operatorrevenue increment over a positive-measure set of bid profiles on which the perturbation is undetectable. Hence on a polymatroid with Θ(𝑛) capacity-sharing pairs of gap Θ(1), CoNCop = Ω(1) as 𝑛 → ∞. The Θ(1) scaling of 𝛾𝑖 𝑗 is on the ratio scale relative to E[rev∗ ]; in any concrete simulator the absolute magnitude of 𝛾𝑖 𝑗 reflects the chosen value units (e.g., post-latency-discount realised value), and only the relative ordering and asymptotic scaling are load-bearing for the bound. Remark 11 (Exp. R-5 numerical claims: unit conventions). The empirical 𝛾𝑖 𝑗 distribution and per-mechanism CoNCop reported for Exp. R-5 in Section 4.3 are stated under two scales: (i) the simulator’s realised-value (post-latency-discount) units for 𝛾𝑖 𝑗 (absolute magnitude ∼10−3 ), and (ii) the ratio scale relative to E[rev∗ ] for the CoNCop values (dimensionless, range 0.08–0.52 across adversarial conditions). The Θ(1) ratio-scale claim of Corollary 1 is load-bearing for the trilemma’s quantitative reading; the post-discount absolute magnitudes serve only as the simulator’s internal-consistency check and carry no weight for the structural impossibility. Remark 12 (CoNC vs. price-of-anarchy: measure scope). Both numerator and denominator of CoNCop are expectations under the prior on bid profiles, matching the definition in (2). This is structurally analogous to, but distinct from, the price-of-anarchy ratio: PoA is taken as a worst case over Nash equilibria of a routing game, whereas CoNC is taken as an expectation over the bid prior under the worst undetectable operator deviation 𝛿 for the prescribed mechanism. The realisation-wise quantity (rev𝛿 − rev∗ )/rev∗ on the undetectability event is bounded below by 𝛾𝑖 𝑗 /rev∗ on that event, but the corollary’s headline bound is the expectation-form ratio, which is the empirically reported and theoretically scaled quantity throughout Section 3.3 and Section 4.4. The empirical CoNC induced by the deviations of Section 2.3 is reported alongside the ablation in Section 4.4; the full topology-class development, including the CoNCag counterpart and the routing-game price-of-anarchy comparison, is given in Section 3.3 below. An analogous statement with the LP integrality gap of [5, Examples 3.3–3.4] in place of 𝛾𝑖 𝑗 is established in Appendix A (Theorem 10, Step 2 derivation). Section 3.3 below develops Corollary 1 into a topology-class framework with tight per-class bounds. Corollary 2 (Constructive trilemma). Under the hypotheses of Theorem 1, given any prescribed mechanism (𝑥 ∗, 𝑝 ∗ ) in the polymatroidal class, an undetectable operator deviation 𝛿 : b ↦→ (𝑥 ′, 𝑝 ′ ) with strictly positive expected revenue gain can be computed in time 𝑂 (𝑛 log 𝑛 + 𝑛 𝑇𝑓 ), where 𝑇𝑓 is the per-class polymatroid rank-oracle cost: 𝑇𝑓 = 𝑂 (1) for tree and series–parallel networks (linear scan
0:22
Lovén et al.
along the SP decomposition tree of Theorem 6), and 𝑇𝑓 = 𝑂 (𝑉 𝐸) for general DAGs via Orlin’s maxflow [61], with the 𝑛 log 𝑛 term from sorting bids in the Payment Perturbation Lemma’s reallocation step. On entangled (Wheatstone-embedded, non-SP) DAGs with |𝑉 |, |𝐸| = 𝑂 (𝑛) the worst-case runtime is therefore 𝑂 (𝑛 4 ) (the 𝑛 · 𝑇𝑓 = 𝑛 · 𝑂 (𝑉 𝐸) term dominates the 𝑂 (𝑛 log 𝑛) sort); for tree and series– parallel topologies it collapses to 𝑂 (𝑛 log 𝑛 + 𝑛) = 𝑂 (𝑛 log 𝑛) via the constant-time rank-oracle access. The 𝑂 (𝑛 log 𝑛 + 𝑛𝑇𝑓 ) headline is therefore an in-class bound parameterised by the topology’s 𝑇𝑓 , and the 𝑂 (𝑛 4 ) entangled-DAG worst case is the maximum over the topology class. Proof. The Payment Perturbation Lemma (Lemma 1) constructs 𝛿 explicitly: sort agents by bid in 𝑂 (𝑛 log 𝑛), identify a non-modular pair (𝑖, 𝑗) with 𝛾𝑖 𝑗 > 0 via one rank-function evaluation per pair, and reallocate the auxiliary agent’s bid within the local Walrasian-price slack to inflate 𝑖’s Archer–Tardos payment by 𝛿 · 𝛾𝑖 𝑗 . The total cost is 𝑂 (𝑛 log 𝑛) for the sort plus 𝑂 (𝑛 𝑇𝑓 ) for at most 𝑛 rank-oracle calls. For tree and SP polymatroids, the rank function decomposes recursively along the decomposition tree (Proposition 1, Theorem 6), so each oracle call is constant-time after a one-shot linear-time preprocessing pass. For general DAGs, the rank function is the source–sink max-flow on the underlying capacity DAG, which Orlin [61] computes in 𝑂 (𝑉 𝐸) time. Profitability of 𝛿 follows from Lemma 1(iii) for any 𝜀 ∈ (0, (𝑏𝑖 − 𝑏 𝑗 )𝛾𝑖 𝑗 ); expected profitability under the prior follows by integrating over the positive-measure undetectability event identified in the proof of Theorem 1. □ 3.3
CoNC Topology-Class Framework
This subsection is the quantitative face of the trilemma: where Theorem 1 establishes that credibility cannot coexist with revenue-optimality and DSIC, the CoNC topology-class framework measures how large the credibility gap is as a function of the polymatroid’s structure. It does not introduce a second, independent impossibility; it refines the single one. Corollary 1 states the CoNC lower bound at the granularity of a single capacity-sharing pair (𝑖, 𝑗) with non-modularity gap 𝛾𝑖 𝑗 , and asserts an aggregate Ω(1) asymptote when the polymatroid carries Θ(𝑛) such pairs of Θ(1) gap. That statement is structurally insensitive: it does not distinguish a single bottleneck shared by 𝑛 agents from a deeply nested DAG with Θ(𝑛 2 ) correlated bottlenecks, even though the operatorextractable surplus differs by orders of magnitude across these regimes. We close this gap by parameterising CoNC by topology class, in the spirit of price-of-anarchy bounds parameterised by the routing graph [67, 68]: each class supplies a structural quantity, and the framework gives matching upper and lower asymptotic bounds in that quantity. 3.3.1 Setup and structural quantities. The framework parameterises CoNC by two structural quantities of the underlying polymatroid: • the aggregate non-modularity profile ∑︁ Γ ≜ 𝛾𝑖 𝑗 , 𝛾𝑖 𝑗 = 𝑓 ({𝑖}) + 𝑓 ({ 𝑗 }) − 𝑓 ({𝑖, 𝑗 }), (𝑖,𝑗 ) ∈ S
where S = {(𝑖, 𝑗) : 𝛾𝑖 𝑗 > 0} is the set of capacity-sharing pairs (Corollary 1); and • the expected revenue E[rev∗ ], which scales differently across topology classes through the saturated-edge structure. We work throughout with the operator-revenue variant of (2). Two operator-side quantities appear in the topology-class theorems below; we name them distinctly to avoid the conflation flagged in Remark 17: • CoNCop (𝛿) = E[rev𝛿 − rev∗ ]/E[rev∗ ] as defined in (2) (the ratio variant, dimensionless), which appears in Theorem 2 and Corollary 1; the same ratio underpins the bilinear
Credibility Trilemma in Polymatroidal Service Markets
0:23
CoNCop (𝜆, 𝜂) surface and the three-dimensional credibility-deployable surface developed in follow-up work; • CoNCabsop (𝛿) ≜ E[rev𝛿 − rev∗ ], the absolute-non-modularity-gap-units variant (the numerator of (2) without the revenue-baseline normalisation), used in the topology-class theorems Theorems 3 to 7 and the headline table Table 2. The two coincide up to the per-instance revenue baseline of Remark 17; on tractable topology classes (single-edge, series, parallel, SP with bounded saturated-edge count) the two scalings agree, and on classes where aggregate revenue and structural-count scaling diverge (tree with many leaves, fully entangled DAG) the absolute variant reports the structural count and the ratio variant absorbs it into the revenue baseline. Analogous bounds for CoNCag track the same scaling because the agent-side payment increment dominates the operator’s spread under any sub-Lipschitz remittance regime (Lemma 5). (𝑁 ) Definition 5 (Topology class). A topology class T is a family of polymatroids {Xres }𝑁 ≥1 generated by service-dependency DAGs {𝐺 𝑁 }𝑁 ≥1 whose rank functions {𝑓𝑁 } admit a structural template parameterised by integer-valued size parameters (e.g., chain length 𝑑, parallel arity 𝑘, tree height ℎ and branching 𝛽). The classes considered here are: • Single-edge: one capacity-constrained edge with 𝑓 ({𝑖}) = 𝑓 ({𝑖, 𝑗 }) = 1 shared by 𝑛 agents (the canonical fully-shared instance). • Series: 𝑑 unit-capacity nodes in a chain, each shared by all agents. • Parallel: 𝑘 disjoint paths between source and sink, each with unit capacity. • Tree: rooted tree of height ℎ and maximum branching 𝛽, with internal-node capacity sharing. • Series–parallel (SP): graphs constructed by recursive series/parallel composition of unit edges, recognisable by Duffin’s characterisation [28] and the linear-time SP-recognition algorithm of Valdes–Tarjan–Lawler [78]. • General DAG: arbitrary polymatroidal feasible regions on a service-dependency DAG with no SP restriction. By Proposition 1, each tree and SP DAG with positive internal-node capacities induces a polymatroid; for general DAGs, integrator encapsulation (Proposition 3) recovers polymatroid structure on the quotient graph under conditions E1–E3.
For each class we prove a bound of the form CoNCabs T = Θ(𝑔 T ) where 𝑔 T depends only on the structural parameters; Theorem 2 (the atomic class) is the exception, reported as a Θ(1) ratio. Both upper and lower bounds are envelope bounds over the perturbation-lemma family of Lemma 1: the upper bound is the supremum of payment increments achievable by any composition of perturbation-lemma applications on instances in the class, and the lower bound is realised by an explicit instance and a perturbation deviation constructed from Lemma 1. The perturbation-lemma family is itself the envelope of all undetectable operator deviations under revenue-optimal DSIC mechanisms (Proposition 4 below; scope in Remarks 1 and 14), so the per-class bounds are envelope bounds over Dundet (M) on that sub-class, not merely over a parametric sub-family. The bounds are asymptotically tight in the matching-rate sense (Remark 21). op
Proposition 4 (Perturbation-lemma family is the envelope on the revenue-optimal DSIC class, SP-augmented topology). Let Xres be a non-modular polymatroidal feasible region with single-parameter agents and regular priors, induced by a service-dependency DAG that is SPaugmented in the sense of Theorem 7: the DAG admits a series–parallel decomposition after integrator encapsulation under conditions E1–E3 of Proposition 3. Let M be a static sealed-bid revenue-optimal DSIC mechanism on Xres , i.e., the (ironed-)virtual-welfare-maximising allocation rule of Myerson [58] identified on the polymatroid with the Edmonds greedy [29, 32] under the ironed-virtual-value priority
0:24
Lovén et al.
order, with Archer–Tardos payments [7], and acting on bid coordinates restricted to the strictlymonotone interior of 𝜑¯ (so that flat ironed-virtual-value regions are excluded from the witness profiles; see Remark 13). Let Dundet (M) denote the set of undetectable operator deviations on M (in the sense of Definition 2), and let Fperturb ⊆ Dundet (M) be the family of deviations constructible by finite composition of Lemma 1 applications across capacity-sharing pairs. Then Fperturb is closed under composition (per-node conditional independence on series chains, Lemma 2, and parallel direct-sum [32, Theorem 3.5]), and the supremum of payment increments achievable on Dundet (M) equals the supremum on Fperturb , realisation-wise, on the SP-augmented sub-family. The envelope characterisation requires (i) single-parameter type spaces, (ii) revenue-optimal DSIC, (iii) the polymatroidal allocation structure, (iv) SP-augmented topology (so that Step 4’s multi-pair joint-compatibility lemma Lemma 3 delivers the single-profile witness), and (v) the strictly-monotone-interior bid restriction of Remark 13. Non-revenue-optimal monotone DSIC rules (posted-price, anonymous reserves outside Myerson, ad-hoc monotone allocation rules), multi-parameter type spaces, BIC extensions, and Wheatstone-embedded non-SP DAGs are not covered; the Wheatstone-embedded extension is recorded as a numbered open problem (Remark 20). Remark 13 (Flat-ironed-virtual-value region scope). The envelope characterisation of Proposition 4 requires bid coordinates to lie in the strictly-monotone interior of the ironed virtual value 𝜑¯ (the same condition under which the Step 1 uniqueness of Theorem 1 pins the Myerson allocation up to measure-zero tie-breaking). On flat-ironed-virtual-value regions (the polymatroid LP admits a continuum of revenue-optimal extreme points sharing the same expected revenue but differing in agent-level allocations on positive-measure bid sets), the perturbation-lemma construction of Lemma 1 still applies pair-by-pair, but the envelope statement that Fperturb exhausts Dundet (M) requires a structural lemma controlling the alternative-optimum surface. We exclude flat regions from the envelope by restricting witness profiles to the strictly-monotone interior; the per-class CoNC bounds reported in Table 2 are upper bounds on the strictly-monotone-interior bid event, which is full-measure under any regular prior whose virtual-value function is strictly increasing except on a Lebesgue-null set. The flat-region envelope claim is open. Remark 14 (Scope of the envelope characterisation and downstream CoNC bounds). Proposition 4 establishes the envelope claim only on the revenue-optimal DSIC class. The substantive consequence (beyond the headline scope conditions of Remark 1) concerns non-revenue-optimal monotone DSIC mechanisms (posted-price rules on the polymatroid, anonymous reserves, ad-hoc allocation orders): there the perturbation-lemma family is still constructible at every capacity-sharing pair and yields the same per-pair increment 𝛿 · 𝛾𝑖 𝑗 (the Archer–Tardos integrand step in Lemma 1(iii) does not invoke Myerson), but the envelope claim — that Fperturb exhausts Dundet (M) — depends on the Myerson uniqueness of Step 1 and need not hold, since such an allocation may admit profitable safe deviations outside Fperturb . We conjecture the asymptotic rates carry over (the scaling depends on the polymatroid topology, not the specific allocation rule), but the matching-rate framing requires the revenue-optimal restriction. Proof. Step 1: Allocation-rule uniqueness. By Archer–Tardos [7], every monotone DSIC mechanism on a single-parameter type space has payments uniquely determined by its allocation rule via (1). By Myerson [58], the revenue-optimal monotone allocation rule on a regular type space is the (ironed-)virtual-welfare maximiser, unique up to tie-breaking on measure-zero bid sets. By Edmonds [29, 32], the unique virtual-welfare-maximising allocation on a polymatroid is the greedy. Step 2: Undetectable deviations are bid-profile substitutions. By the safe-deviation characterisation of Akbarpour–Li [3] (see Remark 4), every undetectable operator deviation 𝛿 ∈ Dundet (M) corresponds to a bid-profile substitution b ↦→ b̂ such that the prescribed mechanism outcome
Credibility Trilemma in Polymatroidal Service Markets
0:25
(𝑥 ∗ ( b̂), 𝑝 ∗ ( b̂)) matches each agent’s observed outcome (𝑥𝑖′, 𝑝𝑖′ ) in the deviation, with 𝑏ˆ𝑖 = 𝑏𝑖 for every observing agent 𝑖. Step 3: Single-pair substitutions are exactly Fperturb atoms. A substitution that changes at most 𝑏 𝑗 for a single agent 𝑗 (with priority order preserved at the contesting pair) is a Lemma 1 application: by step (i)–(iii) of the lemma, the perturbation 𝑏ˆ 𝑗 = 𝑏 𝑗 + 𝛿 for 𝛿 ∈ (0, 𝜀¯𝑖 𝑗 ) leaves agent 𝑖’s allocation unchanged at 𝑏𝑖 , raises 𝑖’s payment by 𝛿 · 𝛾𝑖 𝑗 , and is undetectable to agent 𝑖. The set of such single-pair substitutions is exactly the atomic family of Fperturb . Step 4: Multi-pair substitutions decompose. A substitution that changes 𝑏 𝑗1 , . . . , 𝑏 𝑗𝑘 for distinct agents 𝑗1, . . . , 𝑗𝑘 (with priority orders preserved at each contested pair) decomposes into a composition of single-pair perturbations by the per-node conditional independence on series chains (Lemma 2) and the parallel direct-sum decomposition of the polymatroid base polytope [32, Theorem 3.5]. The cumulative payment increment is the sum of per-pair increments. Hence the multi-pair substitution lies in Fperturb via finite composition. Joint compatibility of the per-pair perturbations on a single bid profile in the entangled-DAG case is established in Lemma 3 below: the per-pair undetectability events are functions of disjoint or shared-but-locally-independent bid coordinates, and their intersection is non-empty open on every entangled-DAG instance. Step 5: Envelope. Every undetectable deviation is therefore a finite composition of single-pair perturbations, i.e., lies in Fperturb . The supremum of payment increments on Dundet (M) is realised by a deviation in Fperturb , so the supremum on Fperturb equals the supremum on Dundet (M). The per-class bounds in Theorems 2 to 7 are envelope upper bounds over Dundet (M), not merely over Fperturb . □ This proposition supplies the structural justification for the matching-rate framing of the perclass theorems below: on the revenue-optimal DSIC class, every undetectable deviation lies in Fperturb , so the supremum over Fperturb equals the supremum over Dundet (M). The envelope’s scope restriction to revenue-optimal DSIC is registered in Remark 14. 3.3.2
Per-class bounds.
Class 1: single-edge polymatroid. Theorem 2 (CoNC on a single shared edge; peak Θ(1/𝑛) under MHR priors with bid support bounded away from 0). Let Xres be the single-edge polymatroid with 𝑛 ≥ 2 agents sharing one unit-capacity edge: 𝑓 ({𝑖}) = 1 for all 𝑖 and 𝑓 (𝑆) = 1 for every non-empty 𝑆 ⊆ 𝐸 (agents indexed by elements of 𝐸 under the convention that each agent owns one ground-set element; see Remark 15). Assume (H1) the agent prior is monotone-hazard-rate (MHR) on bounded support [𝑣, 𝑣¯] with 𝑣 > 0 (equivalently, the prior places zero mass on a neighbourhood of 0 and the hazard rate is monotone non-decreasing), and (H2) the mechanism is DSIC virtual-welfare-maximising (Myerson on the polymatroid). Then CoNCop = Θ(1) as the asymptotic class under any regular prior (the ratio variant of (2), dimensionless), and the peak realisation under (H1)+(H2) satisfies CoNCop = Θ(1/𝑛) as 𝑛 → ∞ for the perturbation deviation of Lemma 1 between the highest- and second-highest-bidder coordinates: the order-statistic ratio E[𝑏 (1) − 𝑏 (2) ]/E[𝑏 (2) ] scales as 1/(𝑛 − 1) under uniform priors on [𝑣, 𝑣¯] and as 𝑂 (1/𝑛) more generally under (H1) (the standard MHR extreme-order-statistics fact, see [54, Lemma A.1]; the bounded-support side of (H1) prevents the divergence of E[1/𝑏 (2) ] that would arise on supports including a neighbourhood of 0). When (H1) is dropped (regular but non-MHR, or support that includes a neighbourhood of 0), CoNCop remains Θ(1) in the asymptotic class but the peak constant is unbounded; see Remark 16 for the fine-grained statement across regularity classes.
0:26
Lovén et al.
Proof. Upper bound. The greedy allocates the unit of capacity to the highest-virtual-value agent, denote 𝑖 (1) , with 𝑥𝑖 (1) = 1 and 𝑥 𝑗 = 0 for 𝑗 ≠ 𝑖 (1) . By the Archer–Tardos identity (1), ∫ 𝑏𝑖 𝑝𝑖 (1) = 𝑏𝑖 (1) − 0 (1) 𝑥𝑖 (1) (𝑧, 𝑏 −𝑖 (1) ) 𝑑𝑧. The integrand equals 0 for 𝑧 ≤ 𝑏𝑖 (2) (where 𝑖 (2) has higher virtual value) and equals 1 for 𝑧 > 𝑏𝑖 (2) , so 𝑝𝑖 (1) = 𝑏𝑖 (2) — the second-price formula. The nonmodularity gap is 𝛾𝑖 (1) ,𝑖 (2) = 𝑓 ({𝑖 (1) }) + 𝑓 ({𝑖 (2) }) − 𝑓 ({𝑖 (1) , 𝑖 (2) }) = 1 + 1 − 1 = 1. The Perturbation Lemma (Lemma 1) yields a payment increment of 𝛿 · 𝛾𝑖 (1) ,𝑖 (2) = 𝛿 for 𝛿 ∈ (0, 𝑏𝑖 (1) − 𝑏𝑖 (2) ), and the expected revenue under truthful bidding is E[𝑝𝑖 (1) ] = E[𝑏𝑖 (2) ]. Hence CoNCop (𝛿) =
E[𝑏𝑖 (1) − 𝑏𝑖 (2) ] E[𝛿] ≤ . E[𝑏𝑖 (2) ] E[𝑏𝑖 (2) ]
For i.i.d. MHR bids on bounded support [𝑣, 𝑣¯] with 𝑣 > 0 (the hypotheses of the theorem’s peak claim), the order-statistic ratio E[𝑏 (1) − 𝑏 (2) ]/E[𝑏 (2) ] is bounded by 1/(𝑛 − 1) for the uniform on [𝑣, 𝑣¯] (standard order-statistic calculation: E[𝑏 (1) − 𝑏 (2) ] = (𝑣¯ − 𝑣)/(𝑛 + 1) and E[𝑏 (2) ] ≥ 𝑣 + (𝑣¯ −𝑣) (𝑛 −1)/(𝑛 +1); hence E[𝑏 (1) −𝑏 (2) ]/E[𝑏 (2) ] ≤ (𝑣¯ −𝑣)/ (𝑛 +1)𝑣 + (𝑣¯ −𝑣) (𝑛 −1) ≤ 1/(𝑛 −1), where the last inequality uses (𝑛 + 1)𝑣 ≥ 0 to drop the non-negative term in the denominator), giving the Θ(1/𝑛) peak; under general MHR priors on bounded support, the same scaling holds up to a constant absorbed in the Θ. Without bounded support (support including a neighbourhood of 0) the ratio E[𝑏 (1) − 𝑏 (2) ]/E[𝑏 (2) ] can be order-one because E[𝑏 (2) ] becomes small; the asymptotic class remains Θ(1) but the constant is no longer bounded. Thus CoNCop = Θ(1/𝑛) as the peak realisation under MHR + bounded support, and Θ(1) as the asymptotic class without bounded support. Lower bound. The two-agent profile (𝑏 (1) , 𝑏 (2) ) with 𝛾 1,2 = 1 realises the perturbation increment exactly, achieving the realisation-wise ratio (𝑏 (1) − 𝑏 (2) )/𝑏 (2) > 0 on a positive-measure set of bid profiles. Under MHR + bounded support away from 0, E[𝑏 (2) ] ≥ 𝑣 > 0 uniformly, so the in-expectation lower bound E[(𝑏 (1) − 𝑏 (2) )/𝑏 (2) ] is finite and matches the upper-bound Θ(1/𝑛) rate. Without bounded support (e.g., Unif [0, 1] at 𝑛 = 2), the realisation-wise ratio remains welldefined but its in-expectation form E[(𝑏 (1) − 𝑏 (2) )/𝑏 (2) ] can diverge (direct check at 𝑛 = 2 uniform: ∫1 E[1/𝑏 (2) ] = 0 2(1 − 𝑥)/𝑥 𝑑𝑥 = +∞); in this regime the lower bound is stated realisation-wise rather than in-expectation, with the realisation-wise gap remaining Θ(1) on the high-density bulk of the support. As 𝑛 → ∞ with MHR + bounded support, the gap 𝑏 (1) − 𝑏 (2) shrinks at rate Θ(1/𝑛) in expectation, consistent with the upper-bound rate. Without MHR the asymptote remains Θ(1) but the constant is unbounded. □ Remark 15 (Ground-set / agent indexing convention). The single-edge polymatroid of Theorem 2 has 𝑓 ({𝑖}) = 1 for every 𝑖 ∈ 𝐸 and 𝑓 (𝑆) = 1 for every 𝑆 ⊆ 𝐸 with |𝑆 | ≥ 1; both expressions are read with agents identified with ground-set elements (one agent per element of 𝐸), so {𝑖} on the LHS of 𝛾𝑖 𝑗 = 𝑓 ({𝑖})+ 𝑓 ({ 𝑗 })−𝑓 ({𝑖, 𝑗 }) is the singleton agent-set with non-modularity gap 𝛾𝑖 𝑗 = 1+1−1 = 1 for any pair. This is the standard convention for single-edge instances. In topology-class theorems with composite agents (tree, SP, DAG), the ground-set 𝐸 retains its meaning as the set of leaves / sources / agent identifiers, and the rank function is evaluated on agent-subsets. Remark 16 (MHR + bounded-support hypotheses on the peak constant). The Θ(1/𝑛) peak constant in Theorem 2 relies on both a monotone-hazard-rate (MHR) condition on the prior and bid support bounded away from zero, in addition to Myerson regularity. Under MHR + bounded support, the order-statistic ratio E[𝑏 (1) −𝑏 (2) ]/E[𝑏 (2) ] is Θ(1/𝑛) and the peak realisation is the same. Bounded support is necessary because, on supports including a neighbourhood of 0 (such as Unif [0, 1]), E[1/𝑏 (2) ] ∫1 can diverge (direct check at 𝑛 = 2 Uniform: E[1/𝑏 (2) ] = 0 2(1 −𝑥)/𝑥 𝑑𝑥 = +∞), so the in-expectation ratio is undefined even under MHR. For heavy-tailed regular priors with Pareto-tail index 𝛼 < 1
Credibility Trilemma in Polymatroidal Service Markets
0:27
(regular but not MHR), the highest-vs-second-highest order-statistic ratio is unbounded as 𝑛 → ∞ (a standard fact about extreme-order statistics under regularly varying priors): the Θ(1) asymptotic class still holds in the sense that the per-instance scaling does not depend on a topological parameter, but the peak constant is unbounded under such priors. A clean statement is therefore: CoNCop = Θ(1) under any regular prior (asymptotic class); peak realisation Θ(1/𝑛) under MHR + bounded support away from 0 (the regime of all empirical experiments in Section 4.4, which use Unif [𝑣, 𝑣¯] with 𝑣 > 0, and of the theoretical results elsewhere in the paper); peak unbounded under non-MHR heavy-tailed regular priors. The earlier draft’s expression “1 − 1/𝑛” has been retracted as a transposition of 1/(𝑛 − 1); the two have opposite asymptotic behaviour (1/(𝑛 − 1) → 0 while 1 − 1/𝑛 → 1), and the present revision reports Θ(1/𝑛), which is the correct scaling derivable from the order-statistic computation. Class 2: series composition. Theorem 3 (CoNC on a series chain). Let Xres be the series-composition polymatroid of 𝑑 ≥ 1 unit-capacity nodes, each shared across 𝑛 agents. Assume: (S1) the prior places positive probability on the all-saturated regime in which every chain node is simultaneously bottlenecked; (S2) a uniform lower bound 𝛾 (𝑟 ) ≥ 𝛾 0 > 0 on per-node non-modularity gaps along the chain; (S3) route-locality of the perturbation events (the Archer–Tardos integrand at each saturated node depends only on the priority order at that node, formally established by Lemma 2). Under any DSIC virtual-welfaremaximising mechanism and (S1)–(S3), CoNCabsop = Θ(𝑑) in the regime Γ = Θ(𝑑) (each saturated node contributing Θ(1) to the aggregate). The corresponding ratio CoNCop = Θ(𝑑)/E[rev∗ ] collapses to Θ(1) when E[rev∗ ] = Θ(𝑑) (per-node revenue scaling) and to Θ(𝑑) when E[rev∗ ] = Θ(1) (singlebottleneck normalisation); the Θ(𝑑) scaling reported here is the absolute-units scaling of the numerator, consistent with the table convention of Remark 17. Proof. Upper bound by induction on 𝑑. For 𝑑 = 1, Theorem 2 gives CoNCop = Θ(1) (with peak Θ(1/𝑛) under MHR + bounded support), so CoNCabsop = 𝑂 (1) · E[rev∗ ] = 𝑂 (1) at 𝑑 = 1 under the single-bottleneck normalisation E[rev∗ ] = Θ(1). For the inductive step, on a chain of length 𝑑 the rank function 𝑓 saturates at every node simultaneously when aggregate desired throughput exceeds 1 at each node: 𝑓 (𝑆) = min𝑟 ∈ [𝑑 ] 𝑞𝑟 (𝑆) where 𝑞𝑟 (𝑆) is the demand of 𝑆 on node 𝑟 . Each saturated node 𝑟 contributes its own non-modularity gap 𝛾𝑖(𝑟𝑗 ) > 0 for the pair (𝑖, 𝑗) that competes Í there. The aggregate non-modularity profile is Γ = 𝑑𝑟=1 𝛾𝑖(𝑟𝑟 ,𝑗)𝑟 where (𝑖𝑟 , 𝑗𝑟 ) is the contesting pair at node 𝑟 . Per-node conditional independence of perturbation events (Lemma 2). For each node 𝑟 , define 𝐸𝑟 as the event that an Archer–Tardos perturbation of size 𝛿𝑟 ∈ (0, 𝜀¯𝑟 ) at the contesting pair (𝑖𝑟 , 𝑗𝑟 ) at node 𝑟 is undetectable, where 𝜀¯𝑟 is the local Walrasian-price gap on the chain segment supported by node 𝑟 (the analog of Lemma 6 on a chain segment; see Appendix A). Each 𝛿𝑟 acts on the bid coordinates (𝑏𝑖𝑟 , 𝑏 𝑗𝑟 ) alone; by Lemma 2, conditional on any allocated agent’s local view V𝑖 = (𝑏𝑖 , 𝑥𝑖∗ (b)), the events 𝐸 1, . . . , 𝐸𝑑 are mutually conditionally independent and their joint event Ñ𝑑 𝑟 =1 𝐸𝑟 contains the truthful profile in its interior. Each per-node event 𝐸𝑟 has positive measure by Lemma 1 applied to the saturated single-edge instance at node 𝑟 , so the joint event has positive measure. Construction of the joint perturbation. The conditional independence of Lemma 2 implies that the joint perturbation across 𝑑 nodes can be assembled from the individual node perturbations of Lemma 1 applied independently: at node 𝑟 choose 𝛿𝑟 ∈ (0, 𝜀¯𝑟 ), producing a payment increment of exactly 𝛿𝑟 · 𝛾𝑖(𝑟𝑟 ,𝑗)𝑟 at that node by step (iii) of Lemma 1. The Archer–Tardos identity (1) expresses the ∫𝑏 perturbed agent’s payment as a path-integral 0 𝑖 𝑥𝑖 (𝑧, 𝑏 −𝑖 ) 𝑑𝑧 along its allocated leaf-to-sink route, which on a series chain visits each saturated node exactly once; since each per-node perturbation
0:28
Lovén et al.
𝛿𝑟 alters the integrand only at node 𝑟 ’s contest, the integrand difference decomposes into a disjoint sum across nodes and the cumulative payment increment is the linear sum 𝑑 ∑︁
𝛿𝑟 · 𝛾𝑖(𝑟𝑟 ,𝑗)𝑟 = Θ(𝑑) · Θ(1) = Θ(𝑑).
(3)
𝑟 =1
Aggregate revenue E[rev∗ ] also grows as Θ(𝑑) (each saturated node contributes its own VCG payment); the perturbation stacks across nodes only when the operator combines independent per-node deviations, and the realisation-wise upper bound on the cumulative payment increment is Θ(𝑑) in absolute non-modularity-gap units, i.e., CoNCabsop = Θ(𝑑) (Remark 17). Lower bound. The instance with 𝑛 = 2 agents and 𝑑 chain nodes, each carrying 𝛾 (𝑟 ) = 1, admits the simultaneous perturbation 𝛿𝑟 = 𝛿 > 0 at every node, yielding aggregate increment 𝑑𝛿 via (3). Realisation-wise, this matches Θ(𝑑). □ Lemma 2 (Per-node conditional independence of perturbation events on a series chain). Let Xres be the series-composition polymatroid of 𝑑 ≥ 1 unit-capacity nodes (the setting of Theorem 3), and at each saturated node 𝑟 let (𝑖𝑟 , 𝑗𝑟 ) denote the contesting pair (the two agents whose priority order at node 𝑟 determines the Archer–Tardos integrand at 𝑟 ). For each 𝑟 , let 𝐸𝑟 ⊆ R |𝐸 | be the per-node undetectability event, i.e., the set of bid profiles on which the operator’s perturbation 𝛿𝑟 ∈ (0, 𝜀¯𝑟 ) acting on the coordinates (𝑏𝑖𝑟 , 𝑏 𝑗𝑟 ) is consistent with a legitimate execution under some alternative profile (the per-node analog of Lemma 1), with 𝜀¯𝑟 > 0 the local Walrasian-price gap on the chain segment supported by node 𝑟 (the chain-segment analog of Lemma 6). Then the events 𝐸 1, . . . , 𝐸𝑑 are mutually conditionally independent given any allocated agent’s local view V𝑖 = (𝑏𝑖 , 𝑥𝑖∗ (b)): the joint distribution factors as 𝑑 Ö P[𝐸 1 ∩ · · · ∩ 𝐸𝑑 | V𝑖 ] = P[𝐸𝑟 | V𝑖 ], 𝑟 =1
and the joint event Lebesgue measure.
Ñ𝑑
𝑟 =1 𝐸𝑟 contains the truthful profile in its interior and therefore has positive
Proof. Per-node coordinate localisation. By the construction of the per-node perturbation, 𝛿𝑟 acts only on the bid coordinates 𝑏𝑖𝑟 , 𝑏 𝑗𝑟 of the contesting pair at node 𝑟 ; the integrand 𝑧 ↦→ 𝑥𝑖 (𝑧, 𝑏 −𝑖 ) of Lemma 1 at node 𝑟 depends only on the priority order of {𝑖𝑟 , 𝑗𝑟 } at node 𝑟 (a function of 𝑏𝑖𝑟 and 𝑏 𝑗𝑟 alone, with all other agents’ bids entering only through the fixed allocation 𝑥 ∗ on the truthful profile). Hence the event 𝐸𝑟 is a measurable function of the two-coordinate restriction (𝑏𝑖𝑟 , 𝑏 𝑗𝑟 ), conditional on V𝑖 . Case 1: disjoint contesting pairs. If {𝑖𝑟 , 𝑗𝑟 } ∩ {𝑖𝑟 ′ , 𝑗𝑟 ′ } = ∅ for 𝑟 ≠ 𝑟 ′ , the events 𝐸𝑟 and 𝐸𝑟 ′ depend on disjoint sets of bid coordinates and are therefore unconditionally independent (and a fortiori conditionally independent given V𝑖 ). Case 2: shared agent across contests. If a single agent 𝑎 participates in the contests at multiple nodes (i.e., 𝑎 ∈ {𝑖𝑟 , 𝑗𝑟 } ∩ {𝑖𝑟 ′ , 𝑗𝑟 ′ } for 𝑟 ≠ 𝑟 ′ ), the events 𝐸𝑟 and 𝐸𝑟 ′ both constrain the coordinate 𝑏𝑎 . Each constraint is a local Walrasian-price-gap interval (Lemma 6, applied to the chain segment supported by node 𝑟 resp. 𝑟 ′ ); both intervals are open neighbourhoods of the truthful bid 𝑏𝑎† with non-empty interior (each 𝜀¯𝑟 > 0 by hypothesis), and the partners at the two nodes are distinct agents whose bids do not contest each other. The intersection 𝐸𝑟 ∩ 𝐸𝑟 ′ restricted to 𝑏𝑎 is therefore the conjunction of two open neighbourhoods of 𝑏𝑎† , which is itself an open neighbourhood of 𝑏𝑎† of positive Lebesgue measure — the same per-agent factorisation argument used in Lemma 3 (joint construction, 2(𝑛 − 1) − 1 intersection of open neighbourhoods of the truthful bid) applies
Credibility Trilemma in Polymatroidal Service Markets
0:29
Ñ node-by-node along the chain. Iterating across all 𝑑 nodes, 𝑑𝑟=1 𝐸𝑟 contains the truthful profile in its interior and so has positive Lebesgue measure. Factorisation conditional on V𝑖 . The local view V𝑖 = (𝑏𝑖 , 𝑥𝑖∗ (b)) fixes agent 𝑖’s own bid and allocated route; the per-node events 𝐸𝑟 are measurable with respect to the remaining bid coordinates of the contesting pairs (𝑖𝑟 , 𝑗𝑟 ). For each 𝑟 with 𝑖 ∉ {𝑖𝑟 , 𝑗𝑟 }, 𝐸𝑟 is independent of V𝑖 outright; for each 𝑟 with 𝑖 ∈ {𝑖𝑟 , 𝑗𝑟 }, 𝐸𝑟 depends on V𝑖 only via 𝑏𝑖 (already in the conditioning), and the remaining coordinate of the partner 𝑗𝑟 varies independently across 𝑟 by the Case-1/Case-2 argument above. Hence 𝑑 Ö P[𝐸 1 ∩ · · · ∩ 𝐸𝑑 | V𝑖 ] = P[𝐸𝑟 | V𝑖 ]. □ 𝑟 =1
Remark 17 (Normalisation convention: CoNCabsop vs. CoNCop ). The topology-class theorems Theorem 3, Theorem 4, Theorem 5, Theorem 6, and Theorem 7 report the absolute-non-modularitygap-units variant CoNCabsop (𝛿) ≜ E[rev𝛿 − rev∗ ], i.e., the numerator of (2) expressed in 𝛾-units, without the revenue-baseline normalisation. The ratio variant E[rev𝛿 − rev∗ ] CoNCabsop (𝛿) CoNCop (𝛿) = = ∗ E[rev ] E[rev∗ ] defined in (2) is recovered by dividing by the per-instance revenue baseline. The two variants agree up to the E[rev∗ ] factor; we use the absolute variant in the topology-class table and theorems because it cleanly reads off the structural scaling, while the ratio variant is the natural quantity to compare against a dimensionless tolerance in any deployable-surface formulation. The two are not interchangeable: a Θ(𝑑) scaling of CoNCabsop on the series chain collapses to Θ(1) for CoNCop when E[rev∗ ] = Θ(𝑑), and writing “CoNCop = Θ(𝑑)” for the absolute-units bound (as in the pre-revision draft) conflates the two. The convention here—explicit naming of the absolute variant—is the empirical convention used in Section 4.4 and matches the price-of-anarchy literature where the welfare loss is reported in absolute units rather than as a ratio that cancels structural growth on both sides [68, §1.1]. The per-class bounds are reported realisation-wise: each bound is the supremum over bid profiles in op the support of the prior on which the witness instance is realised. The in-expectation Í CoNCabs is op sup sup the prior-averaged version Eb [CoNCabs (𝛿; b)] ≤ Γ ≤ Γ, where Γ = supb (𝑖,𝑗 ) 𝛾𝑖 𝑗 (b) is the Í per-realisation joint supremum and Γ = (𝑖,𝑗 ) 𝛾𝑖 𝑗 (Section 3.3.1) the static reachability sum, in absolute units. The two scalings agree under regular priors with monotone hazard rate (Remark 16); under non-MHR heavy-tailed regular priors the realisation-wise supremum can exceed the in-expectation supremum by a multiplicative factor, which is the source of the Γ vs. Γ sup distinction made explicit in follow-up work. Class 3: parallel composition. Theorem 4 (CoNC on 𝑘 parallel paths). Let Xres be the parallel-composition polymatroid of 𝑘 ≥ 2 edge-disjoint unit-capacity paths between source and sink. Partition the agent population into disjoint per-path agent sets 𝐸 1 ⊔ · · · ⊔ 𝐸𝑘 such that each agent’s route uses exactly one path (the disjoint-agent-set hypothesis under which the direct-sum decomposition of Proposition 4 applies). Then CoNCabsop = Θ(𝑘) when every path saturates (aggregate demand exceeds 𝑘), CoNCabsop = Θ(1) when only one path saturates, and CoNCabsop = Θ(𝑚) in the intermediate-saturation regime where 𝑚 of the 𝑘 paths saturate (1 ≤ 𝑚 ≤ 𝑘): each saturated path is a single-edge instance of Theorem 2 contributing Θ(1) to the aggregate, and unsaturated paths contribute zero. The original binary endpoints (𝑚 = 1 and 𝑚 = 𝑘) are special cases.
0:30
Lovén et al.
Í Proof. The parallel composition has rank 𝑓 (𝑆) = 𝑘𝑟=1 min(|𝑆 ∩ 𝐸𝑟 |, 1) where 𝐸𝑟 is the agent set routed onto path 𝑟 (the disjoint agent-set partition declared in the theorem statement). When every path saturates, each path independently realises a single-edge instance of Theorem 2, contributing a non-modularity gap of Θ(1) to Γ. Independent perturbations (allowed because the parallel composition admits a direct-sum decomposition of the polymatroid base polytope [32, Thm. 3.5] Í along the agent-partition 𝐸 1, . . . , 𝐸𝑘 ) accumulate: 𝑘𝑟=1 𝛿𝑟 ·𝛾 (𝑟 ) = 𝑘 · Θ(𝛿) · Θ(1) = Θ(𝑘𝛿). The lower bound is the explicit construction with two agents per path, giving CoNCabsop = Θ(𝑘). In the intermediate regime where 𝑚 ∈ [1, 𝑘] paths saturate, restrict the direct-sum aggregation to the saturated index set R sat ⊆ [𝑘] with |R sat | = 𝑚: each saturated path contributes Θ(1) via Í Theorem 2 and unsaturated paths contribute zero, giving cumulative increment 𝑟 ∈ Rsat Θ(1) = Θ(𝑚). The all-saturated (𝑚 = 𝑘) and single-saturated (𝑚 = 1) endpoints are the special cases. □ Class 4: tree polymatroid. Theorem 5 (CoNC on a rooted tree, per-agent path-support scaling). Let Xres be the polymatroid induced by a rooted service-dependency tree of height ℎ ≥ 1 and maximum branching 𝛽 ≥ 2, with each internal node carrying unit residual capacity. Let CoNCabsop be measured per allocated agent (the per-agent payment-increment surplus in absolute non-modularity-gap units, as defined in Remark 19). Then CoNCabsop = Θ(ℎ) when every internal node along the agent’s leafto-root path is saturated: each level of the path contributes one term to the Archer–Tardos per-agent bound (4), and there are ℎ levels. The aggregate operator-revenue gain summed over all |𝐴| = 𝛽 ℎ allocated agents in a complete 𝛽-ary tree is Θ(ℎ 𝛽 ℎ ) in absolute monetary units (by tree-traversal aggregation (5): each saturated internal node at depth 𝑟 is on the path of 𝛽 ℎ−𝑟 allocated leaves, summed Í to ℎ𝑟=1 𝛽 · 𝛽 𝑟 −1 · 𝛽 ℎ−𝑟 = ℎ𝛽 ℎ ); the per-agent absolute-units surplus is Θ(ℎ), and the structural count of contesting pairs in the entire tree is |S| = Θ(𝛽 ℎ ). Proof. By Proposition 1 the tree induces a polymatroid with rank function 𝑓 (𝑆) equal to the bottleneck min-cut from the leaves in 𝑆 to the root. An internal node 𝑣 at depth 𝑟 ≤ ℎ with 𝛽 𝑣 children defines a capacity-sharing pair structure: among the 𝛽 𝑣 subtrees rooted at 𝑣’s children, the highest-virtual-value sibling dominates the unit allocation through 𝑣, while the others are excluded; this gives 𝛽 𝑣 − 1 contesting pairs, each with non-modularity gap Θ(1) when the children’s subtree max-flows are comparable. Summing across depths: |S| =
ℎ ∑︁
∑︁
𝑟 =1 𝑣 at depth 𝑟
(𝛽 𝑣 − 1) ≤
ℎ ∑︁
𝛽 · 𝛽 𝑟 −1 · 1 = 𝑂 (𝛽 ℎ ),
𝑟 =1
which is Θ(𝛽 ℎ ) for a balanced tree. However, only the saturated path from leaf to root carries the perturbation through to the operator’s spread; we now make this aggregation explicit per agent. Per-agent path support. For each allocated agent 𝑖, define its path support 𝑃 (𝑖) ⊆ 𝑉 as the set of internal nodes traversed by agent 𝑖’s allocated leaf-to-root route under the Edmonds greedy on the truthful profile. The Archer–Tardos integrand 𝑧 ↦→ 𝑥𝑖 (𝑧, 𝑏 −𝑖 ) for agent 𝑖 depends only on the priority orders at nodes the route through which determines 𝑖’s allocation, i.e., on contests at nodes in 𝑃 (𝑖): a perturbation at node 𝑣 ∉ 𝑃 (𝑖) leaves the route through 𝑖’s subtree unchanged for every counterfactual bid in a neighbourhood of 𝑏𝑖 (since 𝑣’s subtree does not intersect 𝑖’s route), and so contributes zero to the integrand difference and zero to 𝑖’s payment increment. Hence ∑︁ Δ𝑝𝑖 = 𝛿𝑣 · 𝛾𝑣, (4) 𝑣 ∈𝑃 (𝑖 )∩𝑉sat
Credibility Trilemma in Polymatroidal Service Markets
0:31
where 𝑉sat ⊆ 𝑉 is the set of saturated internal nodes, 𝛾 𝑣 is the per-node non-modularity gap at 𝑣 (between the winning child’s subtree and any losing sibling), and 𝛿 𝑣 ∈ (0, 𝜀¯𝑣 ) is the operator’s chosen perturbation at 𝑣 (Lemma 1). Tree-traversal aggregation. Sum (4) over the set 𝐴 of allocated agents: ∑︁ ∑︁ ∑︁ ∑︁ Δ𝑝𝑖 = 𝛿𝑣 𝛾𝑣 = 𝛿 𝑣 𝛾 𝑣 · {𝑖 ∈ 𝐴 : 𝑣 ∈ 𝑃 (𝑖)} . (5) 𝑖 ∈𝐴
𝑖 ∈𝐴 𝑣 ∈𝑃 (𝑖 )∩𝑉sat
𝑣 ∈𝑉sat
The cardinality |{𝑖 ∈ 𝐴 : 𝑣 ∈ 𝑃 (𝑖)}| counts the allocated agents whose leaf-to-root route passes through 𝑣, which on a saturated tree equals the number of leaves of the subtree rooted at 𝑣 that hold an allocated agent, denoted |leaves(𝑣)|. On the worst-case witness (a complete 𝛽-ary tree of depth ℎ with one allocated agent per leaf), |leaves(𝑣)| = 𝛽 ℎ−𝑟 at depth 𝑟 , and the summation (5) factors: ℎ ∑︁ ∑︁ ∑︁ 𝛿 𝑣 𝛾 𝑣 |leaves(𝑣)| = 𝛿 𝑣 𝛾 𝑣 𝛽 ℎ−𝑟 . 𝑣 ∈𝑉sat
𝑟 =1 𝑣 at depth 𝑟
Aggregated revenue under the truthful profile scales identically (by the same leaf-counting argument applied to the VCG payments at each saturated node). The per-agent payment-increment surplus is one term per level along the agent’s leaf-to-root path (4): each level contributes a single 𝛿 𝑣 𝛾 𝑣 = Θ(1) term to the agent’s Archer–Tardos integral, because the Archer–Tardos integrand is taken at the agent’s allocated route and depends only on the priority order at the nodes on that route. The 𝛽 − 1 losing siblings at each level enter the count |S| of contesting pairs across the whole tree but contribute zero to the chosen agent’s per-agent increment (their contests are over capacity that the chosen agent does not see). Summed across the ℎ levels of the saturated path, the realisation-wise per-agent increment is Θ(ℎ), additively along the chain by Theorem 3 applied to the saturated leaf-to-root path. Hence CoNCabsop = Θ(ℎ) per allocated agent (Remark 17). Lower bound. The balanced tree with 𝑛 = 𝛽 ℎ agents at the leaves and unit capacity at every internal node admits a profile in which a single allocated agent’s saturated leaf-to-root path passes through Í ℎ contested nodes; by (4) the agent’s cumulative perturbation increment is ℎ𝑟=1 𝛿𝑟 𝛾𝑟 = Θ(ℎ) realisation-wise. The aggregate (across all allocated agents) lower-bound construction yields Θ(ℎ𝛽 ℎ ) by the leaf-counting weighting of (5); this matches the upper bound and is the absolute monetary diversion (not the per-agent ratio). □ Remark 18 (Sibling-vs-chain decomposition). The proof of Theorem 5 decomposes the structure into two orthogonal pieces: a horizontal structural count at each level (the Θ(𝛽) siblings competing for the parent’s capacity, which contributes to the global |S| = Θ(𝛽 ℎ ) but not to any single agent’s payment increment because the losing siblings’ contests are off-route) and a vertical per-agent contribution along the saturated path (the Θ(ℎ) on-route nested capacities, by Theorem 3). Per-agent, only the vertical contribution enters CoNCabsop , giving Θ(ℎ) for the balanced-tree witness; for unbalanced trees the bound remains Θ(ℎ) along the chosen leaf-to-root path, with the path length replacing ℎ in unbalanced cases. Remark 19 (Per-agent versus aggregate scaling on the tree). The headline bound CoNCabsop = Θ(ℎ) in Theorem 5 is the per-agent path-support contribution: along a single allocated agent’s saturated leaf-to-root path, the realisation-wise payment-increment surplus is Θ(ℎ) in absolute non-modularitygap units, by (4) summed across the ℎ on-route levels (each on-route level contributes one Θ(1) term; the 𝛽 − 1 losing siblings at each level enter the global structural count |S| but contribute zero to the chosen agent’s per-agent integrand because the integrand at agent 𝑖’s bid coordinate only sees the contests on 𝑖’s allocated route). When the absolute surplus is reported at the per-instance baseline of Remark 17, this is the scaling that matches the table entry. The corresponding aggregate operator-revenue gain
0:32
Lovén et al.
summed over all |𝐴| = 𝛽 ℎ allocated agents in a complete 𝛽-ary tree is Θ(ℎ 𝛽 ℎ ) in monetary units (the per-agent Θ(ℎ) times the 𝛽 ℎ leaf count). The structural count of contesting pairs in the entire tree is |S| = Θ(𝛽 ℎ ), dominated by the leaf-counting factor in (5). The three scalings are reconciled, not in conflict: ℎ is each allocated agent’s per-bid surplus, ℎ𝛽 ℎ is the operator’s aggregate spread when every leaf agent is perturbed, and 𝛽 ℎ is the structural count of 𝛾-positive pairs in the tree; the per-agent Θ(ℎ) is the quantity that determines whether deviation is profitable on a per-bid basis. Verification at 𝛽 = 2, ℎ = 1: stated Θ(1) per agent, single on-route contest, increment Θ(1), matching. Class 5: series–parallel networks. Theorem 6 (CoNC on series–parallel networks). Let Xres be the polymatroid induced by a series–parallel network in the sense of Duffin [28], with the SP-decomposition tree obtained by the recognition algorithm of Valdes–Tarjan–Lawler [78] (unique up to series/parallel commutativity at each internal SP-tree node). Let 𝐸 shared denote the set of saturated shared edges in the SP decomposition; the light-load case |𝐸 shared | = 0 (no edge saturated) trivially gives CoNCabsop = 0. For |𝐸 shared | ≥ 1, CoNCabsop = Θ(|𝐸 shared |). (The structural count |S| of perturbation-reachable pairs equals |𝐸 shared | in the canonical SP decomposition after the structural reduction of Lemma 2 (series) and the direct-sum reduction of Theorem 4 (parallel) applied to the SP-tree leaves; the 1:1 identification |S| = |𝐸 shared | is the conclusion of this reduction, not an a priori identity, and is established inside the proof.) On the SP-withhomogeneous-disutility regime of Amin et al. [5], this bound is realised by edge-price perturbations (Lemma 7) under any sub-Lipschitz remittance schedule (Lemma 5(a)) with marginal Lipschitz constant 𝜅 < 1 in the 𝜎-unit normalisation of the sub-Lipschitz regime (Lemma 5(a)) (equivalently, in the original Amin edge-flow units, with 𝜅 < 𝑁 tr (𝑒 ∗ ) via the polymatroid-unit rescaling, where 𝑁 tr (𝑒 ∗ ) = 𝑞𝑒 ∗ is the per-edge trip count of Lemma 5). Proof. By Duffin’s characterisation [28], every two-terminal SP graph admits a unique decomposition tree whose internal nodes are series (𝑠) and parallel (𝑝) compositions of unit edges. The polymatroid base polytope decomposes inductively along this tree: • if 𝐺 = 𝐺 1 ⊕𝑠 𝐺 2 (series), then 𝑓𝐺 (𝑆) = min(𝑓𝐺 1 (𝑆), 𝑓𝐺 2 (𝑆)) and the perturbation surface is the union of the perturbation surfaces of 𝐺 1, 𝐺 2 , by the additivity argument of Theorem 3; • if 𝐺 = 𝐺 1 ⊕𝑝 𝐺 2 (parallel), then 𝑓𝐺 (𝑆) = 𝑓𝐺 1 (𝑆) + 𝑓𝐺 2 (𝑆) and the perturbation surface is the disjoint union of the surfaces of 𝐺 1, 𝐺 2 , by the direct-sum argument of Theorem 4. Iterating along the SP-decomposition tree, |S| equals the number of saturated shared edges |𝐸 shared |, and the cumulative perturbation increment is Θ(|𝐸 shared |) · Θ(𝛿). The recognition algorithm of Valdes–Tarjan–Lawler [78] runs in linear time, so the SP decomposition is computationally accessible on every instance in the class. Connection to the Amin instance. On the SP-with-homogeneous-disutility regime, Lemma 7 produces an edge-price perturbation 𝜏𝑒′∗ = 𝜏𝑒†∗ + 𝜀 on each saturated edge 𝑒 ∗ ∈ 𝐸 shared , with payment increment 𝜀 · 𝑁 tr (𝑒 ∗ ) = 𝜀 ·𝑞𝑒 ∗ per saturated edge (Theorem 10, Step 2; the trip-count 𝑁 tr (𝑒 ∗ ) replaces the earlier ambiguous 𝑁 (𝑒 ∗ ) per the Lemma Z.0 disambiguation). Aggregating across |𝐸 shared | saturated edges and applying Lemma 5(a) under a sub-Lipschitz schedule of slope 𝜅 < min𝑒 ∗ 𝑁 tr (𝑒 ∗ ) Í yields a mediator-revenue increment 𝑒 ∗ ∈𝐸shared 𝜀 · (𝑁 tr (𝑒 ∗ ) − 𝜅) = Θ(|𝐸 shared |), confirming the bound on the Amin tractable class. Lower bound. Every SP graph with at least one saturated edge admits the per-edge perturbation; the witness instance is the SP graph constructed by recursive composition of |𝐸 shared | unit-capacity edges, with two agents per edge. □ Class 6: general DAG..
Credibility Trilemma in Polymatroidal Service Markets
0:33
Theorem 7 (CoNC on a general DAG: upper bound and SP-realisable lower bound). Let Xres be the polymatroid induced by a general (non-necessarily SP) service-dependency DAG with Í non-modularity profile Γ = (𝑖,𝑗 ) ∈ S 𝛾𝑖 𝑗 . Then CoNCabsop = 𝑂 (|S|), where |S| = Θ(𝑛 2 ) in the worst case (every agent pair edge). The upper bound holdsÃfor any Ð shares some capacity-constrained Í cut decomposition S ⊆ 𝑐 S𝑐 with |S| ≤ 𝑐 |S𝑐 | (the disjoint-partition refinement S = 𝑐 S𝑐 is established below for SP DAGs and Wheatstone-free DAGs, with the upper-bound argument requiring only the inequality). A matching Ω(|S|) lower bound is realised on the SP-augmented family of DAGs (every DAG that admits an SP decomposition after integrator encapsulation per Proposition 3 conditions E1–E3) via Theorem 6; for general non-SP DAGs that embed Wheatstone-like sub-structures (Amin Example 3.3, 𝑛 ≥ 4), the tightness of Θ(|S|) via a single-profile joint perturbation remains open (Remark 20). Proof. Upper bound by inductive cut decomposition. We argue inductively on a fixed cut decomposition of the DAG. By Edmonds’ polymatroid–max-flow correspondence [29] and the source–sink min-cut characterisation of network polymatroids [28], any polymatroid arising from a servicedependency DAG 𝐺 = (𝑉 , 𝐴) with source 𝑠 and sink 𝑡 admits a decomposition into a sequence of source–sink cuts 𝐶 1, . . . , 𝐶𝑘 , where each cut 𝐶𝑐 is a min-cut (with respect to residual capacity) between source and sink in some sub-DAG 𝐺𝑐 ⊆ 𝐺, and the cuts are ordered so that 𝐺𝑐+1 is obtained from 𝐺𝑐 by contracting the saturated edges across 𝐶𝑐 to a single super-node. (The Iri– Tomizawa principal partition [44] gives one canonical such decomposition; any maximal antichain decomposition of the DAG suffices for the argument below.) Per-cut non-modularity (refinement, not strict partition). For each cut 𝐶𝑐 , denote Í by S𝑐 ⊆ 𝐸 × 𝐸 the set of capacity-sharing pairs whose contesting edge lies in 𝐶𝑐 , and set Γ𝑐 = (𝑖,𝑗 ) ∈ S𝑐 𝛾𝑖 𝑗 . On SP DAGs (and on any DAG whose flow decomposition admits the Iri–Tomizawa principal-partition refinement [44] into disjoint pair-edge sets), a pair (𝑖, 𝑗) contests at most one cut along any source– sink flow decomposition, since the contested capacity is exhausted at the saturated edge that Ã𝑘 determines the pair’s 𝛾𝑖 𝑗 ; the partition S = 𝑐=1 S𝑐 is then well-defined. On general (non-SP) DAGs that embed Wheatstone-like sub-structures (e.g., Amin’s Example 3.3 with 𝑛 = 4 [5, Ex. 3.3]), a Ð𝑘 Í single pair (𝑖, 𝑗) may contest multiple cuts, so only the refinement S ⊆ 𝑐=1 S𝑐 with |S| ≤ 𝑐 |S𝑐 | is guaranteed; this is the form used in the upper-bound aggregation below. Hence Γ ≤
𝑘 ∑︁
Γ𝑐 ,
|S| ≤
𝑐=1
𝑘 ∑︁
|S𝑐 |,
(6)
𝑐=1
with equality on SP DAGs / Wheatstone-free DAGs. Inductive perturbation aggregation. We prove by induction on 𝑘 (the number of cuts) that the Í𝑘 cumulative undetectable payment increment on 𝐺 is 𝑐=1 Θ(|S𝑐 |) · Θ(1) = Θ(|S|). The base case 𝑘 = 1 is a single-cut DAG: every capacity-sharing pair contests at the single min-cut, and the parallel-composition argument (Theorem 4, base-polytope direct sum [32, Thm. 3.5]) gives independent per-pair perturbation, with cumulative increment Θ(|S1 |). For the inductive step, assume the bound for 𝑘 − 1 cuts. After perturbing the contests at cut 𝐶𝑘 (the deepest residual cut, where 𝐺𝑘 is contracted to source–sink only), the contracted sub-DAG 𝐺𝑘 −1 has 𝑘 − 1 cuts and Í𝑘 −1 inherits the cumulative bound 𝑐=1 Θ(|S𝑐 |) by the induction hypothesis. The perturbation events at 𝐶𝑘 are independent of those at 𝐶 1, . . . , 𝐶𝑘 −1 by the same series-cut argument as Lemma 2 (each contracted super-node behaves as a single chain link with respect to its predecessor cut), so the increments add. Combining, 𝑘 ∑︁ ∑︁ 𝑐=1 (𝑖,𝑗 ) ∈ S𝑐
𝛿 𝑖 𝑗 · 𝛾𝑖 𝑗 = Θ
𝑘 ∑︁ 𝑐=1
|S𝑐 |
= Θ(|S|).
(7)
0:34
Lovén et al.
Equation (7) is the absolute-non-modularity-gap-units bound CoNCabsop = 𝑂 (|S|) (Remark 17); the corresponding ratio variant CoNCop = 𝑂 (|S|)/E[rev∗ ] depends on how E[rev∗ ] scales with the topology (per-cut accounting yields E[rev∗ ] = Θ(max-flow), which is 𝑂 (𝑛) on the fully entangled lower-bound instance and so is dominated by the structural-count scaling). The argument generalises the series and SP cases: per-node conditional independence on series chains (Lemma 2) and the parallel direct-sum decomposition [32, Thm. 3.5] are the two atomic cases, and an arbitrary SP-decomposable DAG is recovered by interleaving them along the cut sequence 𝐶 1, . . . , 𝐶𝑘 . Lower bound. The fully entangled instance is constructed as follows: take 𝑛 agents and a DAG where every pair (𝑖, 𝑗) shares a unit-capacity edge 𝑒𝑖 𝑗 , with the remaining edges providing the necessary connectivity to source and sink. The number of capacity-sharing pairs is |S| = 𝑛2 = Θ(𝑛 2 ), each with non-modularity gap 𝛾𝑖 𝑗 = 1. Joint compatibility of the 𝑛2 pair-perturbations on a single bid profile is established in Lemma 3 below. Conditional on that joint construction, independent perturbation at each 𝑒𝑖 𝑗 yields Θ(𝑛 2 ) aggregate increment via (7), matching the upper bound. The construction remains tight against the fortified upper Í bound: every pair (𝑖, 𝑗) ∈ S contributes one term to exactly one S𝑐 in the cut decomposition, so 𝑐 |S𝑐 | = |S| = Θ(𝑛 2 ) on the witness, and the upper bound Θ(|S|) is realised exactly, not merely up to a constant. Tightness on the SP-augmented family. On the SP-augmented family (any DAG that admits an SP decomposition after integrator encapsulation per Proposition 3 conditions E1–E3), Theorem 6 delivers the Ω(|𝐸 shared |) lower bound, which on the fully-entangled SP-augmented instance equals Θ(𝑛 2 ). For general non-SP DAGs that embed Wheatstone-like sub-structures (Amin’s Example 3.3 with 𝑛 ≥ 4 [5, Ex. 3.3]), the single-profile joint-perturbation construction of Lemma 3 requires that the per-pair undetectability events 𝐸𝑖 𝑗 have non-empty open intersection. This is established for the entangled instance via the disjoint-or-shared-bid-coordinate argument of Lemma 3, but holds only when each pair’s contest is local to a single edge; on Wheatstone-embedded DAGs a pair may contest at multiple cuts and the joint-compatibility argument no longer guarantees a single witness profile. The cut decomposition itself does not require SP structure (it exists for any DAG by the source–sink min-cut family and Edmonds’ polymatroid theorem); the gap is whether the upper bound 𝑂 (|S|) is matched by a single-profile lower-bound construction. We flag the matching Ω(|S|) lower bound on Wheatstone-embedded DAGs as an open question (see Remark 20). □ Open Problem 1 (numbered). Matching Ω(|S|) lower bound on Wheatstone-embedded non-SP DAGs. Establish (or refute) the existence of a single-profile joint perturbation construction realising the matching Ω(|S|) lower bound on the Wheatstone-embedded sub-family of non-SP DAGs (the configuration that obstructs LP integrality in Amin et al. [5, Ex. 3.3]). See Remark 20 below for the structural obstruction and two candidate routes (Wheatstone-decomposition lemma; weakening the conclusion to matching-rate only on SP-augmented DAGs). Remark 20 (Open Problem 1: structural obstruction and routes). Theorem 7 establishes the upper bound CoNCabsop = 𝑂 (|S|) for general DAGs and the matching Ω(|S|) lower bound on the SP-augmented family. We say that a DAG is Wheatstone-embedded when it contains a 𝐾4 -minor consisting of two source-to-sink internally-disjoint paths crossed by a bridge edge (the canonical Wheatstone configuration of Amin [5, Ex. 3.3]); equivalently, the DAG fails the Valdes– Tarjan–Lawler SP recognition test [78] on a 𝐾4 -minor witness. On Wheatstone-embedded non-SP DAGs (the configuration that obstructs LP integrality in [5, Ex. 3.3]), the matching-rate lower bound via a single-profile joint perturbation is not established by the present argument: when a pair (𝑖, 𝑗) contests at multiple source–sink cuts, the per-pair undetectability events 𝐸𝑖 𝑗 in Lemma 3 cease to depend only on the bid coordinates {𝑏𝑖 , 𝑏 𝑗 } alone, and the joint-event open-set argument requires a stronger combinatorial lemma to control the multi-cut overlap. We leave this as an open question; one route to a lower bound is to prove a Wheatstone-decomposition lemma showing that each Wheatstone-embedded
Credibility Trilemma in Polymatroidal Service Markets
0:35
Θ(𝑛 2 ) pair-set admits a covering by 𝑂 (𝑛 2 ) disjoint single-edge contests (which would carry the SP-class argument through under the cover), and the other is to weaken the conclusion to a matching-rate upper bound Θ(|S|) only on SP-augmented DAGs and accept an 𝑂 (|S|) statement on Wheatstone-embedded DAGs without a matching realisation. Lemma 3 (Joint compatibility of pair perturbations on the entangled witness). On the fully-entangled DAG instance of the lower-bound proof of Theorem 7 (with 𝑛 agents and a unit-capacity edge 𝑒𝑖 𝑗 for every pair (𝑖, 𝑗)), there exists a single bid profile b on which all 𝑛2 pair-perturbations of Lemma 1 are simultaneously enacted: for every pair (𝑖, 𝑗) ∈ S, the operator’s perturbation 𝛿𝑖 𝑗 ∈ (0, 𝜀¯𝑖 𝑗 ) at edge 𝑒𝑖 𝑗 leaves agent 𝑖’s and agent 𝑗’s local view unchanged, while the joint perturbation across all Í pairs adds up to a total payment increment of (𝑖,𝑗 ) 𝛿𝑖 𝑗 𝛾𝑖 𝑗 = Θ(𝑛 2 ). Proof. Index the edges of the entangled DAG by pairs (𝑖, 𝑗) and choose at each edge a contesting pair (the two agents whose routes share 𝑒𝑖 𝑗 ). The key structural observation is that the perturbation set at 𝑒𝑖 𝑗 acts only on the bid coordinates 𝑏𝑖 , 𝑏 𝑗 and only via the priority order of {𝑖, 𝑗 } at edge 𝑒𝑖 𝑗 ; it is a function of the pair (𝑖, 𝑗) alone, not of any third agent’s coordinate. This gives a non-overlapping perturbation structure across pairs in the following sense. Per-pair perturbation event 𝐸𝑖 𝑗 . By Lemma 1 applied to the single-edge polymatroid on 𝑒𝑖 𝑗 , the undetectability event 𝐸𝑖 𝑗 at edge 𝑒𝑖 𝑗 is characterised by a constraint on the bid coordinates 𝑏𝑖 , 𝑏 𝑗 alone (the perturbation alters the priority gap between 𝑖 and 𝑗 at 𝑒𝑖 𝑗 within the local Walrasian-price slack 𝜀¯𝑖 𝑗 ). The event 𝐸𝑖 𝑗 depends on no other coordinate 𝑏𝑘 for 𝑘 ∉ {𝑖, 𝑗 }, because edge 𝑒𝑖 𝑗 ’s contest involves only those two agents. Joint event factorisation. For any pair of distinct edges 𝑒𝑖 𝑗 ≠ 𝑒𝑖 ′ 𝑗 ′ , the events 𝐸𝑖 𝑗 and 𝐸𝑖 ′ 𝑗 ′ are functions of disjoint pairs of agents except where the pairs share an agent. When {𝑖, 𝑗 } ∩ {𝑖 ′, 𝑗 ′ } = ∅, the events depend on disjoint coordinates and are therefore independent. When the pairs share an agent (say 𝑖 = 𝑖 ′ ), each event constrains the same coordinate 𝑏𝑖 , but the constraints are local Walrasian-price gaps at different edges; since the gap regions are open neighbourhoods around the truthful bid (Lemma 1, step (i)) and are determined by the second-highest competitor at each edge independently (the partners 𝑗 and 𝑗 ′ are distinct), the intersection 𝐸𝑖 𝑗 ∩ 𝐸𝑖 𝑗 ′ is a non-empty open set (the conjunction of two open neighbourhoods of 𝑏𝑖 , both of which contain the truthful bid in their interior). Joint construction. For every pair (𝑖, 𝑗), set 𝛿𝑖 𝑗 ∈ (0, min (𝑖 ′ ,𝑗 ′ ): {𝑖,𝑗 }∩{𝑖 ′ ,𝑗 ′ }≠∅ 𝜀¯𝑖 ′ 𝑗 ′ ), i.e., choose each per-pair perturbation to lie in the intersection of all undetectability windows that touch agent 𝑖 or 𝑗. The pair-set touching agent 𝑖 has cardinality 𝑛 − 1 (one pair per partner 𝑗 ≠ 𝑖), and similarly the pair-set touching agent 𝑗 has cardinality 𝑛 − 1; the union {(𝑖 ′, 𝑗 ′ ) : {𝑖, 𝑗 } ∩ {𝑖 ′, 𝑗 ′ } ≠ ∅} therefore has cardinality at most 2(𝑛 − 1) − 1 (subtracting the pair {𝑖, 𝑗 } itself, which is counted in both, so the per-pair touching count is 2(𝑛 − 1) − 1 and the intersection is over at most this many open neighbourhoods, each of positive measure by 𝜀¯𝑖 ′ 𝑗 ′ > 0). The intersection is therefore non-empty as a finite intersection of open dense sets containing the truthful profile in their interiors. Then the joint Ñ event (𝑖,𝑗 ) 𝐸𝑖 𝑗 has positive measure: it is the intersection of finitely many open neighbourhoods around the truthful profile, each of positive measure, with the truthful profile itself in the interior of every component. By the per-pair payment-increment formula of Lemma 1(iii), the cumulative payment increment is ∑︁ 𝛿𝑖 𝑗 𝛾𝑖 𝑗 = Θ(𝑛 2 ), since |S| =
(𝑖,𝑗 ) ∈ S 𝑛 2 2 = Θ(𝑛 ) and 𝛾𝑖 𝑗 = 1 for every entangled pair.
□
3.3.3 Topology-class summary table. Table 2 consolidates the per-class bounds. Each row reports the structural parameters, the asymptotically tight bound on the absolute-units variant CoNCabsop
0:36
Lovén et al.
(matching upper and lower rates within the perturbation-lemma family), the tightness witness, and the corresponding theorem in this section. The bounds are reported in absolute non-modularity-gap units (Remark 17); the ratio variant CoNCop of (2) agrees with CoNCabsop on classes whose revenue baseline is Θ(1) (single-edge) and differs by the per-instance revenue baseline factor on classes with structure-scaling revenue. Empirical CoNC values reported in Section 4.4 use the absolute-units convention. Remark 21 (Matching-rate tightness vs. min-max-tightness). The technical content of the op “tight” convention announced in Remark 1: upper and lower bounds on CoNCabs T share the same growth rate in the structural parameter as it → ∞, both realised by perturbation deviations (Lemma 1). This is matching-rate, not min-max, tightness: a stronger adversary combining perturbations across pairs may improve the constant without changing the rate. The empirical experiments in Section 4.4 verify the predicted rates within statistical power; constants are reported but not claimed min-maxoptimal. Table 2. Topology-class bounds on CoNCabsop (the absolute-non-modularity-gap-units variant; the ratio variant CoNCop of (2) is recovered by dividing by the per-instance revenue baseline, see Remark 17), organised by Hasse-style topological order: single-edge ⊑ {series, parallel} ⊑ {tree, SP} ⊑ general DAG, where ⊑ denotes “embeds into” (any series/parallel polymatroid contains single-edge as the trivial 𝑑 = 1 or 𝑘 = 1 case; tree and SP both subsume series and parallel; general DAG subsumes SP and tree). Each bound is asymptotically tight (matching upper and lower rates within the perturbation-lemma family of Lemma 1) on the indicated witness instance, where the witness is the topology that achieves the upper bound asymptotically; matchingrate tightness on the SP class is established via Theorem 10 and Lemma 5(a) on the Amin tractable class. Tightness here is matching-rate (Remark 21), not min-max over all conceivable undetectable deviations. The general-DAG row’s lower bound is realised on the SP-augmented sub-family; the matching lower bound on Wheatstone-embedded non-SP DAGs is open (Remark 20). Class (Hasse order)
Parameters
CoNCabsop bound
Witness
Reference
Level 0: atom. Single-edge
𝑛 agents
Θ(1); peak Θ(1/𝑛) (MHR)
two-bidder shared edge
Theorem 2
Level 1: 1-D compositions of single-edge. Series 𝑑 nodes Parallel 𝑘 paths, 𝑚 saturated
Θ(𝑑) Θ(𝑚); Θ(𝑘) at 𝑚=𝑘
𝑑-node chain 𝑘 unit-cap paths
Theorem 3 Theorem 4
Level 2: 2-D recursive series/parallel composition. Tree (per agent) height ℎ, branching 𝛽 Tree (aggregate) height ℎ, branching 𝛽 SP networks |𝐸 shared | ≥ 1
Θ(ℎ) Θ(ℎ𝛽 ℎ ) Θ(|𝐸 shared |)
balanced 𝛽-ary tree balanced 𝛽-ary tree SP graph, each shared edge saturated
Theorem 5 Theorem 5 Theorem 6
Level 3: general (non-SP) topology. General DAG (UB) General DAG (LB, SP-augmented)
𝑂 (|S|) Θ(|S|)
fully entangled, Θ(𝑛 2 ) pairs SP-augmented entangled
Theorem 7 Remark 20
|S| pairs |S| pairs
The progression Single-edge → Series → Parallel → Tree → SP → General DAG is monotone in topology richness and (modulo class-specific structural parameters) in the asymptotic CoNCabsop bound (matching-rate tightness, Remark 21). Of the six classes, only Single-edge admits a constant bound; Series, Parallel, and SP admit polynomial bounds in their respective parameters; Tree admits a per-agent Θ(ℎ) bound (the on-route saturated-path contribution) that interpolates the chain case at 𝛽 = 1 and aggregates to Θ(ℎ𝛽 ℎ ) across all leaves; and the General DAG class admits a quadraticin-agents worst case (with the matching Ω(𝑛 2 ) lower bound established on the SP-augmented family). The framework is therefore informative across the full range of polymatroid-induced topologies.
Credibility Trilemma in Polymatroidal Service Markets
3.3.4
0:37
Connection to price-of-anarchy and to architectural design.
CoNC vs. PoA.. The CoNC topology-class framework is structurally analogous to the priceof-anarchy framework introduced by Koutsoupias and Papadimitriou [50] and developed into topology-class bounds by Roughgarden and Tardos [68] for selfish routing, parameterised over the routing graph’s class (linear cost, polynomial cost, BPR cost, etc.) and quantifying the worstcase efficiency loss as a ratio. Both frameworks share three features: (i) a worst-case ratio over a structural property; (ii) asymptotically matching-rate bounds parameterised by graph class (Remark 21); (iii) sufficiency of the structural property for the corresponding bound, with witness instances. The structural parallel runs deeper: both frameworks rest on a uniqueness theorem (Myerson + Archer–Tardos here, via Proposition 4; Wardrop equilibrium uniqueness there) that pins the deviation family to a parametric class characterised by the underlying mechanism, and the resulting envelope statement is what licenses the matching-rate framing rather than a strictly weaker matching-rate-within-a-sub-family claim. The two frameworks differ in two specific ways. First, the optimisation ratio: PoA quantifies the ratio of equilibrium welfare to optimum welfare, where the worst case is over Nash equilibria of a routing game; CoNC quantifies the ratio of operator-extractable surplus to truthful revenue, where the worst case is over undetectable operator deviations of the prescribed mechanism. Second, the structural driver: PoA depends on the latency-cost class of edges (linear, polynomial, etc.); CoNC depends on the polymatroid’s non-modularity profile, a purely combinatorial property of the rank function. Despite these differences, the two frameworks fit the same template: both convert a strategic deviation into a worst-case ratio bounded tightly by a structural property of the underlying graph. Monotone-comparative-statics perspective. The topology-class ordering (Single-edge ≤ Series ≤ Parallel ≤ Tree ≤ SP ≤ General DAG) and the corresponding monotone increase of the CoNCabsop bound is an instance of the Topkis–Milgrom–Shannon monotone-comparative-statics (MCS) programme [56, 77]: the CoNCabsop bound is supermodular in (non-modularity-gap, topology richness) in the sense that the marginal effect of adding a shared edge is non-decreasing as the graph class becomes richer. Formally, the structural parameter |S| (entangled pairs) is lattice-ordered by graph class, and the bound’s functional form Θ(|S|) is non-decreasing and convex in |S|, so any parameter shift that raises the lattice order (e.g., adding shared edges when moving from SP to general DAG) weakly increases the bound – exactly the conclusion of Topkis’s monotonicity theorem for supermodular functions [77]. The MCS connection has a practical implication: the designer does not need topology-specific CoNC estimates; a sufficient statistic is the graph’s position in the lattice and the corresponding structural parameter, which determines the tightest applicable Θ rate from Table 2. Architectural design implications. The framework provides direct guidance for a two-tier deployment architecture (developed in follow-up work): • Single-edge and thin parallel decompositions (Θ(1) to Θ(𝑘) with small 𝑘) admit lightweight credibility devices: settlement separation (Proposition 5) closes the spread channel without requiring on-chain commitment, and reputation-based monitoring suffices to deter deviation in regimes where a single-bidder gap dominates. • Series, tree, and SP regimes (Θ(𝑑) to Θ(|𝐸 shared |)) require stronger commitment devices: ascending clinching auctions with public broadcast (Theorem 8(i)) are warranted to make the per-node perturbation surface verifiable, and DRA with deposits (Theorem 8(ii)) is appropriate at the slice tier where matroid feasibility holds.
0:38
Lovén et al.
• General DAG regimes (Θ(𝑛 2 )) demand both: commitment devices to bound the per-edge perturbation and integrator encapsulation (Proposition 3, conditions E1–E3) to reduce the exposed perturbation surface from |S| = Θ(𝑛 2 ) pairs to |𝐸 shared | = Θ(|𝐸 shared |) saturated edges in the quotient SP graph. This mapping closes a loop with that two-tier architecture: the slice-marketplace tier prescribes commitment devices at Level 1 (cross-domain, where the slice marketplace is matroid-structured under encapsulation), and the local-marketplace tier prescribes domain separation at Level 2 (withindomain, where local marketplaces operate over thin parallel/single-edge polymatroids). The CoNC topology-class framework supplies the quantitative justification: the credibility-mechanism choice at each tier is calibrated to the topology class encountered, not to a one-size-fits-all baseline. 3.3.5 Empirical illustration grounding. Section 4.4 reports empirical CoNCabsop under the trilemmaillustration setup of Section 4 (no-enforcement sealed-bid VCG, Exp. 1; broadcast commitment, Exp. 2) across the simulation’s three DAG topologies (tree, SP, fully entangled). The Exp. 1 reading (CoNCop ≈ +6.7%, CoNCW = 11.8%) is consistent with the lower bound of Corollary 1 on the corresponding topology classes; broadcast drives both to ≤ 0, confirming closure under the broadcast resolution of Theorem 8(i). A systematic per-class scaling sweep across the full topology-class lattice of Table 2, and the empirical instantiation of the domain-separation knife-edge, are deferred to follow-up work in keeping with the deployable-surface framing that subsumes them. 3.4
Restoring Credibility via Commitment
The trilemma can be resolved by making the auction transcript publicly reconstructible: any participant can independently verify all clinch quantities from the broadcast data and authenticated on-path rank values, so that any operator deviation produces a detectable inconsistency. Theorem 1 applies to static sealed-bid mechanisms and concerns revenue optimality. The commitment mechanisms below restore credibility by moving to an ascending format (Part (i), achieving welfare optimality) or a deferred-revelation format (Part (ii), achieving revenue optimality under matroid feasibility with strongly regular distributions). Theorem 8 (Credible Mechanisms via Commitment). Let Xres be a polymatroidal feasible region over divisible goods defined on a resource ground set 𝐸𝑅 with rank function 𝑓 : 2𝐸𝑅 → R ≥0 , populated by single-parameter agents with quasi-linear valuations 𝑣𝑖 ·𝑥𝑖 −𝑝𝑖 and continuous allocations 𝑥𝑖 ≥ 0. Assume: (B1) agents broadcast their own demand/exit messages directly to all participants (not relayed by the operator); (B2′ ) verifiable rank function on the equilibrium path: for every active-agent subset that arises during execution, the on-path values 𝑓 (𝐷 (𝑝)) and 𝑓 (𝐷 −𝑖 (𝑝)) are broadcast with an authenticated proof (e.g., a Merkle commitment to the capacity topology, or a Trusted Execution Environment (TEE) attestation of the max-flow computation). If the marketplace operator commits to the allocation rule via a public broadcast channel (carrying the operator’s price announcements, agent-broadcast demand messages per (B1), and the authenticated on-path rank values per (B2′ )), then: (i) the ascending clinching auction [9, 36] over Xres is credible, DSIC, and welfare-maximising; (ii) if additionally Xres is a matroid (as at the Level-1 slice marketplace under integrator encapsulation), a deferred-revelation auction (DRA) with deposits [22, 30, 35] is credible, DSIC, and revenue-optimal for 𝛼-strongly regular distributions (i.e., distributions whose virtual value ˆ ≥ 𝛼 (𝑣 − 𝑣) ˆ for all 𝑣 ≥ 𝑣; ˆ 𝛼 = 0 reduces to Myerson regularity). function 𝜑 satisfies 𝜑 (𝑣) − 𝜑 (𝑣) DRA is not credible beyond matroid feasibility [35]. Strength of (B1) and faster relaxations. (B1) requires an operator-independent broadcast substrate; in the PAA setting peer-to-peer overlays (libp2p), IETF MIMI/MLS messaging, or a building’s multicast group suffice. Where independence is unavailable, three relaxations preserve credibility:
Credibility Trilemma in Polymatroidal Service Markets
0:39
TEE attestation (AMD SEV-SNP [4], Intel TDX/SGX [24]), zero-knowledge proofs (Groth16 [38], PLONK [33]), and zkVMs. A detailed substrate-by-substrate comparison (proof generation cost, onpath verification cost, trust roots, latency-tier suitability) is deferred to future systems-engineering work. Part (i): (B1)+(B2′ ) over a reliable causal-broadcast channel (Definition 6 below) make the clinching transcript publicly reconstructible (Definition 7), so any operator deviation is detectable in a BAR adversary model that treats the operator as Byzantine and agents as Altruistic/Rational. (B2′ ) is markedly weaker than the earlier “public rank function” assumption: only on-path values require authentication, preserving commercial confidentiality of the full feasibility structure. Part (ii) imports Ganesh and Zhang [35] with deposit-threshold bound 𝑑 ∗O = Θ(𝑣¯ · 𝑛/𝛼), after the Level-1 reduction to matroid feasibility (Lemma 4). The Ganesh–Zhang impossibility rules out DRA beyond matroid feasibility, but does not rule out all credibility devices at the cross-domain tier. Implementations of the broadcast channel range from distributed-ledger smart contracts (transparency at the cost of consensus latency) to auditable append-only logs and cryptographic commitments; the latency/trust trade-off is quantified in Section 4. Definition 6 (Broadcast channel formalism). The broadcast channel is a reliable causalbroadcast primitive over a participant set P comprising agents, the operator, and observers. It exposes a single operation bcast(𝑚) delivered to every 𝑞 ∈ P as deliver(𝑞, 𝑚). We require: (S1) Integrity (safety). If deliver(𝑞, 𝑚) occurs at any honest 𝑞, then some sender previously executed bcast(𝑚). Messages are not forgeable, dropped, or reordered relative to causal predecessors. (S2) Agreement (safety). If two honest participants 𝑞 1, 𝑞 2 each deliver 𝑚, both observe the same content; no equivocation. (L1) Eventual delivery (liveness). Every bcast(𝑚) by an honest participant is eventually delivered to every honest participant within a bounded delay Δ. We adopt the BAR (Byzantine–Altruistic–Rational) adversary model of Aiyer et al. [2]: the operator O is treated as Byzantine (may deviate arbitrarily, subject to undetectability); agents are a mix of Altruistic (follow the protocol) and Rational (best-respond to incentives) participants. Credibility (Definition 3) is robust to a Byzantine operator under (S1)–(S2) and (L1) because public reconstructibility (below) makes any deviation detectable, and rational agents will prefer the truthful path once detection is positive-probability. The full implementation of Definition 6 can range from a permissionless gossip layer with lightclient verification, to a permissioned BFT replica set with total-order delivery, to a TEE-attested multicast within a single administrative domain. Total order is sufficient but not strictly required for credibility; causal order suffices because the auction’s price-clock advance imposes its own happens-before relation. Definition 7 (Public reconstructibility). An execution of an ascending auction is publicly reconstructible if each quantity needed to verify every agent’s clinch—the current price 𝑝, the active set 𝐷 (𝑝), and the on-path rank values 𝑓 (𝐷 (𝑝)), 𝑓 (𝐷 −𝑖 (𝑝))—is derivable from messages on the broadcast channel of Definition 6 using publicly known protocol rules. Equivalently, any observer receiving the broadcast transcript can, for each price step and each agent 𝑖, recompute 𝑠𝑖 (𝑝) = 𝑓 (𝐷 (𝑝)) − 𝑓 (𝐷 −𝑖 (𝑝)) and verify that the operator’s announced clinches match. (B1)+(B2′ ) over a channel satisfying (S1)–(S2) and (L1) ensures public reconstructibility. Lemma 4 (Level-1 encapsulation yields matroid feasibility). Under integrator encapsulation (P3 of [54], Proposition 3, with encapsulation conditions E1–E3), assume in addition that each integrator 𝑘’s slice capacity 𝑐𝑘 ∈ Z ≥0 is a non-negative integer (the integer-capacity hypothesis) and each agent’s task is a unit-demand request over the slice types (𝑥𝑖 ∈ {0, 1}, supplied by GS1). Then the family of
0:40
Lovén et al.
feasible 0/1 allocation vectors that respect the integrators’ capacity constraints is the independent-set Ã𝐾 family of a matroid on the ground set 𝑆 = 𝑘=1 𝑆𝑘 of slice-type tokens (with |𝑆𝑘 | = 𝑐𝑘 tokens per integrator 𝑘). The Level-1 feasible region is therefore a matroid in the sense of Ganesh–Zhang [35]. Proof. We construct the matroid directly as a direct sum of partition matroids, then identify the feasible 0/1 allocation vectors with its independent sets. (i) Partition matroid per integrator. For each integrator 𝑘 ∈ {1, . . . , 𝐾 }, let 𝑆𝑘 be a finite ground set of 𝑐𝑘 slice-type tokens (one token per unit of integer capacity Í exposed by 𝑘; this step uses the integer-capacity hypothesis). The constraint at integrator 𝑘 is 𝑖 ∈𝐴𝑘 𝑥𝑖 ≤ 𝑐𝑘 , where 𝐴𝑘 is the set of agents eligible for slice type 𝑘 (E3 ensures eligibility is a property of the agent–slice pair, not of other agents’ allocations). The collection I𝑘 = { 𝑇 ⊆ 𝑆𝑘 : |𝑇 | ≤ 𝑐𝑘 } is the family of independent sets of the uniform matroid M𝑘 = (𝑆𝑘 , I𝑘 ) of rank 𝑐𝑘 on 𝑆𝑘 , a standard partition matroid with a single block of capacity 𝑐𝑘 [62, §1.5]. The construction extends without modification to multiple slice families per integrator by replacing M𝑘 with the partition matroid whose blocks are the families and whose per-block capacities are the family-level scalar capacities of E1. (ii) Direct sum across integrators. Because (E3) bars external coupling between clusters and (P1) ensures the quotient graph is tree- or SP-decomposable (no shared bottleneck downstream of the agent-facing market), the Level-1 feasibility constraint is the conjunction of the per-integrator constraints on disjoint ground sets 𝑆 1, . . . , 𝑆𝐾 . The resulting independence system is the direct sum (also called the union of matroids on disjoint ground sets) Ä M = M1 ⊕ M2 ⊕ · · · ⊕ M𝐾 = (𝑆, I), 𝑆 = 𝑆𝑘 , I = {𝑇 ⊆ 𝑆 : 𝑇 ∩ 𝑆𝑘 ∈ I𝑘 ∀𝑘 }. 𝑘
The direct sum of matroids on disjoint ground sets is itself a matroid (Schrijver [72, Vol. B, §39.3], Í Í Oxley [62, §4.2]); equivalently, M’s rank function 𝑟 M (𝑇 ) = 𝑘 𝑟 M𝑘 (𝑇 ∩ 𝑆𝑘 ) = 𝑘 min(|𝑇 ∩ 𝑆𝑘 |, 𝑐𝑘 ) is monotone, submodular, and unit-incremental, so M satisfies the matroid axioms. We emphasise that M is not a matroid intersection (which is in general not a matroid); the direct-sum construction circumvents that obstruction. (iii) Identification with feasible 0/1 allocation vectors. Each agent 𝑖 with eligibility set 𝐴𝑖 ⊆ Ã {1, . . . , 𝐾 } requests at most one token from 𝑘 ∈𝐴𝑖 𝑆𝑘 (unit demand, GS1). An allocation vector 𝑥 ∈ {0, 1}𝑛 is feasible iff the multiset 𝑇 (𝑥) ⊆ 𝑆 of allocated tokens satisfies |𝑇 (𝑥) ∩ 𝑆𝑘 | ≤ 𝑐𝑘 for all 𝑘, i.e., iff 𝑇 (𝑥) ∈ I. Conversely, any 𝑇 ∈ I corresponds to a feasible allocation by Hall’s theorem applied to the agent–token bipartite graph (system of distinct representatives, e.g., [62, §1.6]): each token 𝑠 ∈ 𝑇 ∩ 𝑆𝑘 is assigned to some still-unallocated eligible agent 𝑖 ∈ 𝐴𝑘 . The bijection between feasible 0/1 allocation vectors and independent sets of M is therefore exact. (iv) Matroid in the Ganesh–Zhang sense. Ganesh and Zhang [35] require the feasibility structure to be a matroid: a downward-closed family satisfying the augmentation axiom. Both properties hold for M as a direct sum of partition matroids. Hence the Level-1 feasibility region is a matroid in their sense, and the DRA of [35] applies. (v) Role of integer capacity. If some 𝑐𝑘 is not an integer, the slice-token construction in step (i) fails (the ground set 𝑆𝑘 is no longer well-defined as a finite set), and the per-integrator constraint becomes Í a continuous polymatroidal cap 𝑖 ∈𝐴𝑘 𝑥𝑖 ≤ 𝑐𝑘 rather than a uniform-matroid rank constraint. This is the regime where integrality is restored by the Edmonds rounding of [36, §2] or by treating each fractional unit as a continuous-allocation polymatroid (Level 2 of the architecture, where DRA does not apply). The integer-capacity hypothesis is therefore the load-bearing condition that pins the Level-1 reduction to a matroid. □
Credibility Trilemma in Polymatroidal Service Markets
0:41
Remark 22 (Tightness of Lemma 4 via singleton-augmentation; Ganesh–Zhang concurrent work). The Level-1 reduction to a matroid is structurally tight: relaxing any condition under which the partition-matroid direct sum is constructed (unit-demand per agent, integer capacity per integrator, or disjoint per-integrator ground sets) re-introduces an instance of the augmentation-axiom failure that Ganesh and Zhang [35] use as the boundary of DRA credibility. Concretely, consider the smallest violation: two agents {𝑖, 𝑗 } each demanding a unit, two integrators each of capacity 1, plus a single shared bottleneck capacity-1 resource downstream of both integrators (a violation of (E3) cluster-disjointness via the shared bottleneck). The resulting feasibility family contains the singleton allocations {𝑖} and { 𝑗 } but not the augmentation {𝑖, 𝑗 }, so the augmentation axiom fails on the singleton-augmentation step. This is the canonical counterexample of Ganesh–Zhang [35, §4 / Theorem 5], restated in our notation: the moment the polymatroidal feasibility region carries a non-trivial Level-2 sharing pair, the matroid axioms fail at the singleton-augmentation step and Ganesh–Zhang’s DRA-non-credibility-beyond-matroid impossibility [35, Theorem 5] attaches. The structural significance is that Lemma 4 draws exactly the line that Ganesh–Zhang identify as the credibility frontier for DRA: encapsulation conditions (E1–E3) plus integer capacity strictly suffice for Level-1 matroid feasibility, and any failure of these conditions transports the instance to the Ganesh– Zhang-non-credibility regime, where the present paper’s commitment-via-broadcast (Theorem 8(i)) or domain-separation (Proposition 5) resolutions become the operative alternatives. Ganesh and Zhang’s work is concurrent and independent of the present paper; the relation is peer (both papers belong to the same publication generation), and the boundary their impossibility identifies is the precise structural boundary of Theorem 8(ii)’s applicability in the present framework. Proof of Theorem 8. Part (i): Ascending clinching auction. We use the ascending clinching auction of Ausubel [9], extended to polymatroidal environments by Goel et al. [36], on the polymatroid Xres over the resource ground set 𝐸𝑅 with rank function 𝑓 . A price clock 𝑝 starts at 0 and increases continuously. At price 𝑝, each agent 𝑖 reports its demand 𝑑𝑖 (𝑝) = max{𝑥𝑖 : 𝑣𝑖 (𝑥𝑖 ) ≥ 𝑝 · 𝑥𝑖 }. The operator computes the residual supply for each agent: 𝑠𝑖 (𝑝) = 𝑓 (𝐷 (𝑝)) − 𝑓 (𝐷 −𝑖 (𝑝)) where 𝐷 (𝑝) = { 𝑗 ∈ A : 𝑑 𝑗 (𝑝) > 0} is the set of active agents and 𝐷 −𝑖 (𝑝) = 𝐷 (𝑝) \ {𝑖}. Agent 𝑖 “clinches” min(𝑑𝑖 (𝑝), 𝑠𝑖 (𝑝)) units at price 𝑝. The auction ends when demand equals supply. Economic properties (DSIC and efficiency). DSIC and welfare maximisation are properties of the ascending clinching auction itself, established independently of any broadcast channel. DSIC follows from the clinching mechanism: at each price, agent 𝑖’s clinch 𝑠𝑖 (𝑝) depends only on other agents’ demands, so truthful demand reporting is a dominant strategy [9]. Welfare maximisation follows from the efficiency of the clinching auction on polymatroidal feasible regions with single-parameter valuations satisfying gross substitutes [36, 40]. Credibility (requires (B1) and (B2′ )). The broadcast channel carries three types of messages: (1) the operator’s price announcements; (2) each agent’s own demand/exit messages, broadcast directly by agents to all participants (not relayed by the operator); and (3) the operator’s announcements of on-path rank values 𝑓 (𝐷 (𝑝)), 𝑓 (𝐷 −𝑖 (𝑝)) together with an authentication witness satisfying (B2′ ) and the implied clinch quantities 𝑠𝑖 (𝑝). The active set 𝐷 (𝑝) is derived from the agent-broadcast messages, so no participant must trust the operator’s report of who is active. Under (B2′ ), each on-path rank value is accompanied by a verifiable proof; agents and observers check the proof against the published authentication root before accepting the value. The clinch computation 𝑠𝑖 (𝑝) = 𝑓 (𝐷 (𝑝)) − 𝑓 (𝐷 −𝑖 (𝑝)) is therefore publicly reconstructible (Definition 7) from the transcript. Given the broadcast of (𝑝, 𝐷 (𝑝), 𝑓 (𝐷 (𝑝)), {𝑓 (𝐷 −𝑖 (𝑝))}) with authentication witnesses, each agent can verify its clinch independently. Consider a deviation by the operator: (1) announcing a different price to different agents is immediately detectable via the broadcast channel; (2) misreporting
0:42
Lovén et al.
𝐷 (𝑝) is detectable by any agent whose own participation status is misrepresented; (3) miscomputing 𝑠𝑖 (𝑝) is detectable by agent 𝑖, which recomputes 𝑓 (𝐷 (𝑝)) − 𝑓 (𝐷 −𝑖 (𝑝)) from the authenticated broadcast values; (4) submitting an inauthentic rank value is detectable by any participant because (B2′ ) requires a verifiable proof anchored to the operator’s prior commitment. Thus the only undetectable action is to follow the protocol. Part (ii): Deferred-revelation auction with deposits. This builds on the matroid-feasibility result of Ganesh and Zhang [35]. By Lemma 4, the Level-1 slice marketplace under integrator encapsulation is a matroid; the DRA of [35] therefore applies directly. The DRA operates in three phases. Phase 1 (Commitment). Before bids are submitted, the operator publishes a commitment 𝜎 = Hash(𝑥 ∗ (·), 𝑝 ∗ (·)) to the allocation and payment rules on a secure, append-only broadcast channel. Each agent deposits 𝑑𝑖 into an escrow controlled by the smart contract. Phase 2 (Execution). Agents submit sealed bids b. The operator computes 𝑥 ∗ (b) using the greedy algorithm on Xres and payments 𝑝 ∗ (b) per the committed rule. Phase 3 (Verification). The operator reveals the full allocation and payment vector. Any agent 𝑖 can verify that (𝑥𝑖 , 𝑝𝑖 ) is consistent with the committed rule 𝜎 by checking that 𝑥 ∗ (b) is the output of the greedy algorithm (deterministic given the bid ordering [29]) and that 𝑝𝑖 matches the committed payment formula. If agent 𝑖 finds a discrepancy, it presents the evidence to the smart contract, which slashes the operator’s deposit. Credibility (deposit threshold imported from Ganesh–Zhang [35]). Any deviation from the committed rule produces verifiable evidence (a mismatch between 𝜎 and the executed (𝑥, 𝑝)). The deposit 𝑑 O must be set large enough that the expected slashing penalty strictly exceeds the maximum gain from any deviation the operator can profitably execute given the detection process. The explicit bound is supplied by [35]: 𝑑 ∗O = Θ(𝑣¯ 𝑛/𝛼) for value support [0, 𝑣¯], 𝑛 agents, and 𝛼-strong regularity parameter. Under this choice the DRA is credible. Revenue optimality for 𝛼-strongly regular distributions at Level 1 follows from the same reserve-price analysis as in [35]. Applicability boundary. Ganesh and Zhang [35] prove that DRA is not credible for any downwardclosed feasibility constraint that violates the matroid augmentation property. This impossibility applies to polymatroids with multi-unit allocations (𝑥𝑖 > 1), which arise at Level-2 raw-resource marketplaces. At Level 2, where multi-unit allocations are needed, credibility is ensured by domain separation (Proposition 5) or by the ascending clinching auction of Part (i), which extends to polymatroids [9, 36]. □ Remark 23 (On the (B2′ ) weakening). The prior formulation of this result used a stronger assumption (B2) that the rank function 𝑓 is publicly known globally over 2𝐸𝑅 . The credibility proof only uses 𝑓 (𝐷 (𝑝)) and 𝑓 (𝐷 −𝑖 (𝑝)) at subsets that actually arise during execution, so (B2) can be weakened to on-path verifiability. (B2′ ) substantially relaxes the deployment burden: the operator may keep the full capacity topology proprietary and publish only the on-path rank values with cryptographic or TEE-based authentication. This also accommodates architectures where the feasibility structure is commercially sensitive. Deployment gap. The formal guarantee of Part (i) rests on the public reconstructibility of the auction transcript (Definition 7), not on a generic notion that “broadcast helps.” In a deployed system, achieving (B1) requires a communication substrate independent of the marketplace operator (e.g., a peer-to-peer broadcast overlay or an independent message bus); achieving (B2′ ) requires an on-path authentication scheme for rank values (e.g., a Merkle commitment to the capacity topology, with membership proofs for each on-path subset, or TEE attestation of max-flow evaluations). Unlike the stronger (B2) that would require publishing the full feasibility structure, (B2′ ) allows the operator to keep the infrastructure topology proprietary while still providing verifiable onpath values. These remain system-design constraints, not merely parameter choices; realising the
Credibility Trilemma in Polymatroidal Service Markets
0:43
publicly reconstructible transcript model in a multi-domain service economy is itself a non-trivial architectural requirement, addressed by a two-tier architecture in follow-up work. 3.5 Complementary Marketplace Properties Beyond operator credibility via commitment, two complementary structural properties strengthen marketplace governance: domain separation (operator-side) achieves credibility through revenuechannel separation, eliminating the operator’s profitable deviation; integrator competition (integratorside) provides market-power discipline that constrains monopoly markup at the slice-supply layer but is orthogonal to mechanism-execution credibility. The two propositions thus address structurally distinct entities and attack surfaces. Proposition 5 (Domain Separation). Let the marketplace be operated by an entity O satisfying: (C0) settlement separation: agent payments transit directly from agents to resource owners (e.g., Í via a verifiable escrow or third-party clearing agent), so O’s books record only the per-unit fee income 𝜙 · 𝑖 𝑥𝑖 and not the gross agent-to-owner payments; (C1) no ownership stake in the allocated resources; (C2) no affiliation with any participating agent; (C3) all participating agents have positive valuations and the Í polymatroid’s capacity is binding (aggregate desired allocation strictly exceeds 𝑓 (𝐸), so 𝑖 𝑥𝑖∗ = 𝑓 (𝐸) at the welfare-maximising allocation); (C4) no fee on undelivered allocation: O collects 𝜙 only on units that materialise into a delivered service path, so phantom or undeliverable allocations contribute zero to O’s revenue. Under (C0)–(C4), VCG is credible. (C0) and (C4) are load-bearing: under settlement separation O’s revenue reduces to 𝜙 times the delivered allocation, which VCG maximises on the polymatroid. We enumerate the five operator deviation cases and show none is strictly profitable. Í Proof of Proposition 5. Under (C0)–(C1), O’s payoff is exactly 𝜙 · 𝑖 𝑥𝑖 , proportional to the total allocation and independent of per-agent payment levels. ∗ Í VCG fills capacity. VCG computes the welfare-maximising allocation Í ∗ 𝑥 ∈ Xres , which maximises Í𝑖 𝑣𝑖 𝑥𝑖 subject to the polymatroid constraint. Under (C3), 𝑖 𝑥𝑖 = 𝑓 (𝐸): any allocation with 𝑖 𝑥𝑖 < 𝑓 (𝐸) could be improved by increasing some agent’s allocation (the additional welfare 𝑣𝑖 · Δ𝑥𝑖 > 0 is strictly positive given the excess aggregate demand). Therefore VCG achieves the maximum total allocation 𝑓 (𝐸). No deviation is profitable. Consider an arbitrary operator deviation 𝛿 : b ↦→ (𝑥 ′, 𝑝 ′ ). Í (1) Reallocation (same total): If 𝛿 reallocates among agents while maintaining 𝑖 𝑥𝑖′ = 𝑓 (𝐸), O’s revenue is unchanged at 𝜙 · 𝑓 (𝐸). Í (2) Total reduction: If 𝛿 results in 𝑖 𝑥𝑖′ < 𝑓 (𝐸) (e.g., by excluding agents from the allocation or by inflating payments beyond agents’ values, violating individual rationality and causing agents to drop out), O’s revenueÍstrictly decreases. (3) Capacity violation: If 𝛿 attempts 𝑖 𝑥𝑖′ > 𝑓 (𝐸), it violates the polymatroid constraint and is infeasible. (4) Payment inflation (Lemma 1 perturbation). If 𝛿 applies the perturbation of Lemma 1 to raise some agent’s Archer–Tardos payment by 𝜀 > 0 without changing allocations, the agent-to-owner transfer rises by 𝜀; but by (C0) this transfer flows directly to resource owners Í and is not recorded in O’s books. O’s revenue 𝜙 · 𝑖 𝑥𝑖 is unchanged. (5) Fictitious-agent (ghost-bid) insertion. If 𝛿 inserts a fictitious agent with positive bid, two sub-cases arise. Case 5(a) [displacement of zero-marginal genuine agent]. If the fictitious agent displaces a genuine agent with zero or near-zero marginal allocation (the displaced agent’s clinch was already zero, so its absence does not reduce delivered allocation), aggregate delivered
0:44
Lovén et al.
Í allocation is preserved at 𝑓 (𝐸) and O’s fee revenue 𝜙 · 𝑖 𝑥𝑖 is unchanged. The fictitious Í agent’s notional payment 𝑝 fict inflates the gross-payment account 𝑖 𝑝𝑖 by exactly the Archer–Tardos area attributable to the inserted bid; under (C0), this account flows in full to resource owners (more precisely, to whichever phantom owner is registered as the supplier of Í the fictitious slice; the operator’s bookkeeping still records only the fee component 𝜙 · 𝑖 𝑥𝑖 ). Because (C0) routes all agent-to-owner transit through escrow regardless of agent identity (genuine or fictitious), and (C2) bars the operator from being affiliated with the phantom-owner endpoint, the fictitious payment does not reach O’s books. Case 5(b) [displacement of positive-marginal genuine agent], formalised at Level-2. If the fictitious agent displaces a genuine agent whose marginal allocation was strictly positive, two consequences follow. First, by (C4) (no fee Í on undelivered allocation), the fictitious agent’s allocated units do not contribute to 𝜙 · 𝑖 𝑥𝑖 in O’s books, because the units are not redeemed against a deliverable service path: O collects 𝜙 = 0 on those units. Second, the displaced genuine units would have contributed positive 𝜙 to delivered allocation; their Í removal therefore reduces 𝜙 · 𝑖 𝑥𝑖deliv by exactly the displaced quantity, which triggers the total-reduction case (2) and strictly decreases O’s revenue. Third, the fictitious agent’s notional payment again transits through escrow to a phantom owner under (C0), and by (C2) is barred from accruing to O. The combined effect on O’s books is therefore strictly negative under (C4) and zero under (C0)+(C2) for the payment side, so case 5(b) is dominated by the no-deviation baseline. The Level-2 formalisation matters because the multi-unit polymatroid setting (Level 2) is precisely where ghost-bid insertion can change the active set of agents: at Level 1 the matroid structure (Lemma 4) allocates at most one token per agent and the ghost-bid attack reduces to a payment inflation at the displaced agent’s rank position (case 4), but at Level 2 a ghost-bid can shift integer flow to a phantom successor. The case 5(b) argument shows that (C0) and (C4) jointly close this Level-2 attack vector: (C0) routes the gross-payment increment to a phantom owner outside O’s books, and (C4) zeroes the fee on the undelivered ghost units. Since no undetectable deviation yields strictly higher revenue for O under (C0)–(C4), VCG is credible under domain separation. For matroid/binary-allocation settings (𝑥𝑖 ∈ {0, 1}), the per-unit fee reduces to a per-transaction fee. □ Corollary 3 (Knife-edge breakdown under partial stake). If (C1) is relaxed to allow an ownership-stake Í Í fraction 𝜆 ∈ (0, 1] of gross payments to accrue to O (equivalently, O’s revenue becomes 𝜙 · 𝑖 𝑥𝑖 + 𝜆 · 𝑖 𝑝𝑖 ), then the operator can profit from the Lemma 1 perturbation by exactly 𝜆𝜀 for any 𝜀 > 0 in the achievable range. VCG is therefore not credible for any 𝜆 > 0, recovering the trilemma setting of Theorem 1. Proposition 5 is thus a knife-edge result: credibility holds at 𝜆 = 0 and fails for every 𝜆 > 0. The structural-discontinuity reading of this knife-edge (commission-based revenue is universal in commercial platforms, so 𝜆 = 0 is a measure-zero design point; the operationally relevant softening is a continuous deployable surface in (𝜆, 𝜂, 𝜏), treated in follow-up work) is the practically informative interpretation. Proof. Under the relaxed setting, any payment increment Δ𝑝𝑖 yields O additional revenue 𝜆Δ𝑝𝑖 . Applying Lemma 1 to construct Δ𝑝𝑖 = 𝜀 without changing allocations gives the operator a detectability-free revenue gain of 𝜆𝜀 > 0, which is strictly positive for any 𝜆 > 0. □ Remark 24 (Stock-exchange interpretation of (C0)). Hypothesis (C0) formalises the stockexchange principle: the exchange matches orders and charges listing or transaction fees; it does not hold customer assets on balance sheet. Clearing and settlement (the movement of funds between
Credibility Trilemma in Polymatroidal Service Markets
0:45
counterparties) are legally and operationally separated from market-making (running the allocation mechanism). Without (C0), an operator that collects gross agent payments en route to resource owners could use the perturbation deviation of Lemma 1 to inflate payments and pad its balance before remittance, defeating credibility. Settlement separation is the load-bearing hypothesis that distinguishes the fee-only operator from a full-service intermediary. Proposition 5 is a narrow sufficient condition: any positive ownership stake, side payments, or dynamic incentives re-introduce the credibility problem (a 1% stake breaks the guarantee; empirical confirmation of this knife-edge is deferred to follow-up work). The five-case enumeration translates to the edge-pricing market of [5] on the SP-with-homogeneous-disutility class, with edge-price inflation in place of payment perturbation; see Remark 30 in Appendix A. Integrator competition addresses pricing-layer exploitation rather than mechanism execution; the orthogonality of credibility and competition under disjoint actors is the structural content of Theorem 9, and its empirical exercise is deferred to follow-up work. Proposition 6 (Integrator Competition). Suppose 𝑘 ≥ 2 integrators compete to offer slices for the same service path, and agents can freely choose among integrators. (a) With 𝑘 ≥ 2 homogeneous integrators, Bertrand competition drives pricing to marginal cost with zero welfare loss. (b) With differentiated slices modelled as a Salop circular-city market [70] with transport cost 𝑡 > 0 and an outside option for consumers, the symmetric equilibrium markup is 𝑡/𝑘 and the associated deadweight loss from consumer exclusion is Θ(𝑡 2 /𝑘) by the standard Salop analysis [6]. Without an outside option, the markup is a pure transfer with zero deadweight loss. Proof of Proposition 6. Case 1: Homogeneous slices. Suppose 𝑘 ≥ 2 integrators offer identical slices for the same service path, each with marginal cost 𝑐. Agents choose the cheapest integrator (ties broken uniformly). In the unique Nash equilibrium of the Bertrand pricing game, each integrator sets price 𝑝 ∗ = 𝑐: any integrator charging 𝑝 > 𝑐 loses all demand to a competitor charging 𝑝 − 𝜀, and charging 𝑝 < 𝑐 yields negative profit. The equilibrium markup is 𝑝 ∗ /𝑐 − 1 = 0. Case 2: Differentiated slices. When slices differ in quality, latency, or governance compliance, agents have heterogeneous preferences. We model this via the Salop circular-city framework [70] with differentiation parameter 𝑡 > 0. With 𝑘 integrators uniformly spaced on the unit circle, each faces a local monopoly of width 1/𝑘. The symmetric equilibrium price is 𝑝 ∗ = 𝑐 + 𝑡/𝑘, giving a markup over marginal cost of 𝑡/𝑘. As 𝑘 increases, the markup decreases as Θ(1/𝑘). Welfare. Under the baseline Salop model with inelastic unit demand and quasi-linear utility, every consumer buys from its nearest integrator at the symmetric equilibrium; the markup is a pure transfer from consumers to integrators, and the deadweight loss is zero. When the model is augmented with an outside option (a reservation value 𝑣¯ below which low-value consumers exit), the markup induces consumer exclusion at the boundary of each market segment. Standard analyses of the Salop model with exclusion [6, Ch. 7] give the per-segment exclusion zone width 𝑑 ∗ = (𝑣¯ − 𝑐 − 𝑡/𝑘)/𝑡 and a per-segment deadweight loss of order Θ(𝑡 2 /𝑘 2 ), which sums to Θ(𝑡 2 /𝑘) across the 𝑘 segments of the circle. Increasing 𝑘 both shrinks the markup and reduces deadweight loss from exclusion. □ Competition disciplines integrator pricing but does not prevent allocation-layer deviations within a single integrator’s marketplace; credibility and competition therefore address orthogonal attack surfaces. We strengthen this orthogonality observation to a structural decomposition theorem with explicit preconditions for its validity. Theorem 9 (Surplus-extraction-rate orthogonality decomposition). Consider a two-tier service market with 𝑘 ≥ 2 integrators competing for slice supply (the setup of Proposition 6) and a
0:46
Lovén et al.
single operator O executing the allocation mechanism on the polymatroidal feasibility region Xres . Suppose: (O1) Disjoint actors: the operator O and each integrator are distinct entities; no single firm acts on both the allocation layer and the pricing layer. (O2) Allocation-layer credibility deviation: the operator’s strategic action is a perturbation deviation in the family Fperturb of Proposition 4, with stake 𝜆 ∈ [0, 1] and amplitude 𝜀 ≥ 0. (O3) Pricing-layer competition: the integrators’ strategic action is the Salop pricing of Proposition 6, with differentiation parameter 𝑡 > 0 and equilibrium markup 𝑡/𝑘. (O4) IR slack: the consumer outside option does not bind at the symmetric Salop equilibrium (𝑡/𝑘 < 𝑣¯ − 𝑐 for the marginal consumer’s reservation value 𝑣¯). Define the credibility surplus-extraction rate Lcred (𝜆) ≜ sup𝛿 ∈ Fperturb E[𝜆𝜀 (𝛿)] (the operator’s expected credibility surplus per round under stake 𝜆) and the competition consumer-surplus transfer LSalop (𝑡, 𝑘) ≜ (𝑡/𝑘) · 𝑀 from Proposition 6, where 𝑀 is the (unit-normalised) consumer mass on the Salop circle and 𝑡/𝑘 is the symmetric equilibrium markup. Under (O4) IR-slack, every consumer purchases and Salop deadweight loss is zero (per Proposition 6’s welfare analysis); the quantity (𝑡/𝑘) · 𝑀 is therefore a consumer-surplus transfer from consumers to integrators, not a deadweight loss. The orthogonality decomposition below is therefore stated as orthogonality of surplus-extraction rates (credibility surplus extracted by the operator; markup transfer extracted by the integrator), not as orthogonality of welfare losses; both quantities are non-zero under (O4) by construction. Then the total expected operator-plus-integrator surplus-extraction rate decomposes additively: Sextract = Lcred (𝜆) + LSalop (𝑡, 𝑘),
(8)
where Sextract denotes the total surplus extracted by operator and integrators per round, and the interaction term 𝜕 2 Sextract /𝜕𝜆 𝜕(𝑡, 𝑘) vanishes identically. Under (O4) IR-slack, LSalop = (𝑡/𝑘) · 𝑀 is a pure transfer (zero deadweight loss); welfare-loss-rate orthogonality follows as a corollary only when the (O4) precondition is relaxed to allow consumer exclusion at the Salop boundary (the regime in which LSalop = Θ(𝑡 2 /𝑘) recovers deadweight-loss units), but the surplus-extraction decomposition above holds on the full (O1)–(O4) regime as stated. A richer extension with escrow fraction 𝜂 and audit frequency 𝜏 is open for future work, but is consistent with the present decomposition under (O1)–(O4). Proof. Step 1: Disjoint sources. Under (O1), the operator’s credibility surplus is extracted from the agent-payment perturbation channel: the operator inflates an agent’s Archer–Tardos payment by 𝜀 on the perturbed bid profile, and (under stake 𝜆) retains 𝜆𝜀 as deviation revenue. On the SP-augmented topology sub-family of Proposition 4, the supremum of 𝜆𝜀 (𝛿) over Fperturb equals the supremum over all 𝛿 ∈ Dundet (M); on Wheatstone-embedded non-SP DAGs the envelope is only a lower bound on the supremum over Dundet (M), and the orthogonality decomposition is correspondingly stated as 𝑊loss ≥ Lcred (𝜆) + LSalop (𝑡, 𝑘) on the non-SP sub-family. The integrator’s Salop markup is extracted from the pricing layer: the integrator charges 𝑝 ∗ = 𝑐 + 𝑡/𝑘 to consumers in equilibrium, and 𝑡/𝑘 accrues to the integrator independently of the allocation outcome. Step 2: Disjoint sinks. The credibility surplus 𝜆𝜀 flows from the perturbed agent’s payment to the operator. The Salop markup 𝑡/𝑘 flows from the consumer’s payment to the integrator. Under (O1), these are different recipient firms; no double-counting. Step 3: No allocation-layer effect on pricing-layer markup. The Salop equilibrium markup 𝑡/𝑘 depends only on the integrator count 𝑘 and the differentiation parameter 𝑡 (per Proposition 6’s proof, the symmetric equilibrium price is 𝑝 ∗ = 𝑐 + 𝑡/𝑘 from the FOC of each integrator’s pricing problem). The allocation rule on Xres does not enter the integrator’s pricing problem; the integrator faces a fixed slice-quantity supply at the slice marketplace’s clearing prices. Hence 𝜕(𝑡/𝑘)/𝜕𝜆 = 0
Credibility Trilemma in Polymatroidal Service Markets
0:47
(the Salop markup is independent of the operator’s ownership stake; extensions in (𝜂, 𝜏) are out of scope for the present paper). Step 4: No pricing-layer effect on allocation-layer credibility. The operator’s perturbation deviation operates on the agent-bid channel. The amplitude 𝜀 is bounded by the local Walrasian-price gap 𝜀¯𝑖 𝑗 (per Lemma 1, step (i)), determined by the polymatroid’s structure and the agent priors. The integrator’s pricing-layer markup does not enter 𝜀¯𝑖 𝑗 ; it determines only the slice-supply price faced by the agent population at the slice marketplace, which under (O4) is in the IR-slack regime where the marginal-consumer condition does not feed back to the agent population. Translation-invariance. The argument uses that agents’ quasi-linear utility 𝑣𝑖 𝑥𝑖 −𝑝𝑖 is translation-invariant under a constant additive shift in the slice-supply price (equivalently, a deterministic per-unit markup adds the same constant to every agent’s payment and so leaves the priority ordering on 𝜑¯𝑖 (𝑏𝑖 ) in the Edmonds greedy, and hence the perturbation-lemma window 𝜀¯𝑖 𝑗 , unchanged). This translation-invariance is the load-bearing structural hypothesis behind “the integrator’s pricing-layer markup does not enter 𝜀¯𝑖 𝑗 ”; without it (e.g., if the markup were bid-dependent and so re-shuffled the priority order), an indirect feedback channel from (𝑡, 𝑘) to 𝜀¯𝑖 𝑗 would re-couple the two layers. Under the standard Salop timing of (O3) (integrators choose prices before bids are realised, the markup is constant in 𝑏), translation-invariance holds and the decomposition is exact. Hence 𝜕Lcred /𝜕(𝑡, 𝑘) = 0. Step 5: Linearity of the surplus-extraction functional. The total surplus-extraction rate Sextract is the expected sum of the operator’s credibility-surplus channel and the integrator’s pricing-markup channel. Each component is linear in its respective layer’s strategic action (Step 1’s 𝜆𝜀; Step 2’s 𝑡/𝑘 · 𝑀). The expectation is taken over the bid prior, which factors over the two layers under (O1) (the operator deviates after observing bids; integrators choose prices before observing bids in the standard Salop timing). Linearity plus factorisation yields the additive decomposition (8), and the interaction term vanishes because Steps 3 and 4 establish 𝜕 2 Sextract /𝜕𝜆 𝜕(𝑡, 𝑘) = 0 identically on the support of (O1)–(O4). □ The theorem’s structure is the surplus-decomposition analog of the polymatroid direct-sum [32, Theorem 3.5]: the allocation-layer factor and the pricing-layer factor produce surplus-extraction components that sum without interaction whenever the polymatroidal feasibility region admits a direct-sum decomposition into allocation and pricing tiers. Same-entity violations of (O1) collapse to a knife-edge: at 𝜆 > 0 the integrator-as-operator firm extracts both 𝜆𝜀 and 𝑡/𝑘 · 𝑀, the surplusextraction components couple, and orthogonality fails (the present paper reports only the knife-edge regime at which (O1)’s violation produces strict additivity loss; a continuous bilinear extension in stake and escrow fraction is deferred to follow-up work). (O4)’s IR-slack precondition rules out a feedback channel through consumer exclusion at the Salop boundary that would re-couple the layers via the agent population. The theorem is therefore stated honestly for the disjoint-actors, IR-slack regime; same-entity and binding-IR cases are excluded by construction. The assumptions-to-results mapping is in Section C; a side-by-side empirical comparison of credibility mechanisms is deferred to follow-up work. Remark 25 (Salop model omits cross-side externalities and multi-homing). The Salop Θ(1/𝑘) markup result applies to the same-side competition among integrators for agents. It does not account for cross-side network externalities (the value of a slice to an agent may increase in the number of resource providers on the opposite side) or multi-homing (agents simultaneously subscribing to multiple integrators, and providers simultaneously listing on multiple marketplaces). In the two-sided platform economics literature [8, 18], both effects can strengthen or weaken the 1/𝑘 markup discipline depending on whether network effects are internalised. Our Salop analysis treats the slice marketplace as a one-sided differentiated oligopoly, which is conservative: cross-side externalities and multi-homing
0:48
Lovén et al.
incentives may further reduce effective markups beyond 𝑡/𝑘 in deployments with a rich provider base. Incorporating these effects into the markup analysis is left for future work. 4
Evaluation
We illustrate the trilemma empirically through three baseline experiments (Exps. 1–3) that operationalise the credibility gap of Theorem 1 in a simulated polymatroidal marketplace, supplemented by Experiment R-5 which probes mechanism-class robustness across VCG, first-price, and postedprice; the agent-side CoNCag vs. the operator-side CoNCop ; and the empirical 𝛾𝑖 𝑗 distribution. We use “illustrate” rather than “validate” throughout this section to mark these as implementation-level consistency checks under the manuscript’s modelling assumptions; theorem-level generality is established by the proofs in Section 3. A comprehensive ablation programme evaluating the three resolution mechanisms, the orthogonality of credibility and competition, the domain-separation knife-edge, the bilinear surface in stake and escrow, the Smallest Detectable Stake threshold, and a two-tier deployment architecture is the subject of follow-up work; the present paper restricts to the three trilemma-illustration experiments below. The trilemma illustration here motivates the impossibility result and the structural Cost of Non-Credibility framework of Section 3.3. Robustness experiments under relaxed assumptions (adaptive operators, imperfect broadcast, strategic agent exit, correlated channel failures, non-stationary infrastructure supply) are likewise deferred.3 4.1
Setup
The simulation reuses the three-tier sensor–edge–cloud topology and latency-aware valuations of [54]: 𝑁 = 40 agents, Poisson tasks with exponentially decaying value (𝜆𝑙 = 0.005/ms) and deadlines in {100, 150, 200} ms; tiers 𝐶 ∈ {200, 300, 500} at base latencies {5, 15, 50} ms. Each run is 100 rounds, averaged over 5 seeds per condition. Default clearing is sealed-bid VCG (greedy welfaremax on the polymatroid plus externality payments); the broadcast-commitment baseline replaces it with the ascending clinching auction of Theorem 8(i). Three DAG topologies (tree, series–parallel, entangled) span the structural-complexity spectrum; the credibility results of Section 3 depend on polymatroidal structure rather than DAG specifics, so the three-topology evidence is illustrative of a topology-invariant claim, not a benchmark across an exhaustive topology set. The operator’s adversarial strategy in Exps. 1–3 is the ghost-bidder deviation (the specific deviation of Theorem 1’s proof); additional adversaries (capacity misreporter, price inflator, discriminator) are not exercised in these illustration experiments. Reproducibility and Data Availability. The simulator (Python 3.11 for the core engine, R for the auxiliary R-5 ablation pipeline), the five random seeds (seeds = [17, 42, 101, 2024, 31337]), the YAML and targets configuration files for each of the trilemma-illustration experiments and Exp. R5, all raw outputs underlying the figures and tables of Section 4.2, Section 4.3, and Section 4.4, and the figure-generation scripts are released under the MIT licence at https://github.com/lloven/crediblemarketplace-sim; a Zenodo DOI snapshot will be deposited on acceptance and will pin the commit hash used to generate the figures (the simulator’s tag v1.0-teac-r1 corresponds to the Git commit hash recorded in the replication package). A make reproduce target regenerates the figures end-toend from the deposited artefacts. Replication materials are available to reviewers upon submission. See the replication package for the exact parameter map, seed schedule, and commit-hash pin. 4.2
Trilemma Illustration (Exps. 1–3)
The sealed-bid VCG baseline admits a ghost-bid deviation that extracts surplus +0.78/round while inducing 11.8% welfare loss and remaining undetectable to any individual agent (Cliff’s 𝛿 > 0.9, 3 Simulation codebase: https://github.com/lloven/credible-marketplace-sim
Credibility Trilemma in Polymatroidal Service Markets
0:49
Table 3. Trilemma-illustration experiments. Each row exhibits one face of Theorem 1: that a ghost-bid deviation is profitable, undetectable, and persists under the revenue-optimal Myerson mechanism. Exp Setting
Tests
Key finding
1
Baseline VCG Theorem 1
2
+ broadcast
3
Myerson
Theorems and 8 Theorem 1
Primary result
Ghost-bid profitable, unde- Surplus +0.78; welfare loss tectable 11.8%; 𝛿 > 0.9 1 Broadcast deters ghost-bid Surplus −7.83; det. 96–100% Trilemma extends to Profitable under VCG & Myerrevenue-optimal mech. son
0.8
0.0
Surplus / round
Net surplus / round
𝛿: Cliff’s effect size. Five seeds per condition.
−2.5 −5.0 −7.5
1% knife−edge
0.6 0.4 0.2 0.0
None
Broadcast
Blockchain Domain Sep.
0.01
0.05
0.1
0.25
0.5
Ownership stake φ (log scale)
1.0
Fig. 3. Ghost-bid surplus by mechanism on three DAG topologies (Exps. 1–2): the vermillion VCG baseline is positive; broadcast commitment (green) drives surplus to zero or below, confirming the trilemma’s empirical bite and its closure under the broadcast resolution of Theorem 8(i). Bands: 95% CIs over 5 seeds ×3 topologies.
Exp. 1). Broadcast commitment converts the same deviation to −7.83/round with 96–100% detection (Exp. 2, Fig. 3). The deviation remains profitable under the revenue-optimal Myerson mechanism without commitment (Exp. 3), confirming that the trilemma arises from the Archer–Tardos payment structure shared by all DSIC mechanisms on the polymatroid, not from a peculiarity of VCG. 4.3
Mechanism-class robustness, CoNCag , and 𝛾𝑖 𝑗 distribution (Exp. R-5)
Experiment R-5 supplements the VCG-on-three-topologies baseline of Exps. 1–3 with three orthogonal probes of the trilemma’s empirical bite: (a) does the ghost-bid extraction persist across mechanism families (first-price, posted-price) or is it VCG-specific; (b) how does the agent-side CoNCag relate to the operator-side CoNCop already reported; and (c) what is the empirical realised distribution of the non-modularity gap 𝛾𝑖 𝑗 across the three DAG classes. The grid sweeps three mechanisms (VCG, first-price, posted-price) × three operator strategies (truthful, ghost-bidder, posted-price-inflator) × three DAG topologies × three posted-price levels (𝑝 post ∈ {0.2, 0.5, 0.8}, posted-price arm only) × five seeds × 100 rounds, totalling 39 conditions and 19,500 round-runs. Mechanism-class robustness. The trilemma is allocation-class-robust, not payment-rule-specific: under ghost-bid deviation, CoNCop on first-price equals CoNCop on VCG to numerical precision (0.083 / 0.079 / 0.079 on entangled / sp / tree for both mechanisms). Both use Edmonds-greedy allocation; the ghost-bid extracts the same payment-rule-invariant value regardless of whether payments are VCG externalities or first-price bids. Posted-price under ghost-bid yields CoNCop
0:50
Lovén et al.
in the range 0.08–0.22 depending on 𝑝 post ; under its native attack (post-participation price inflation), CoNCop rises to 0.19–0.52 (Fig. 4). The trilemma’s bite is universal in sign across the three mechanism classes tested. Agent-side CoNC.. CoNCag ≥ CoNCop holds across all 24 adversarial conditions, with the gap exactly CoNCW (welfare destruction). Pure-transfer deviations (posted-price-inflator) have CoNCW = 0 and CoNCag = CoNCop (agents bear exactly the operator’s transfer); allocationdistorting deviations (ghost-bid on posted-price) have positive CoNCW and CoNCag up to 0.34 (1.5−1.6× the operator-side value). Realised 𝛾𝑖 𝑗 distribution. The 𝛾𝑖 𝑗 distribution is obtained by drawing 500 (value, deadline) pairs from the simulator’s bid and deadline priors and evaluating the per-pair submodularity gap 𝛾𝑖 𝑗 = 𝑓 ({𝑖}) + 𝑓 ({ 𝑗 }) − 𝑓 ({𝑖, 𝑗 }) on each topology’s realised-welfare function 𝑓 ; the resulting curve is thus the pushforward of the input priors through the (deterministic) gap functional, not a sample of agent-reported data — so we summarise it descriptively (kernel density, means, and the rank-based Cliff’s 𝛿) rather than fitting a parametric family or testing for a population effect. The per-topology distribution confirms the manuscript’s structural ordering tree < sp < entangled: mean 𝛾𝑖 𝑗 is 0.0012 / 0.0015 / 0.0017 on tree / sp / entangled in the simulator’s realised-value (post-latency-discount) units, with adjacent-pair Cliff’s 𝛿 of 0.38 (tree→sp) and 0.19 (sp→entangled) indicating a real but overlapping shift (Fig. 5). The absolute magnitude (∼10−3 ) is the post-discount welfare-gap; the manuscript’s Θ(1) interpretation in Corollary 1 applies on the ratio scale (relative to E[rev∗ ]), not on absolute units. Realisation-wise vs. in-expectation reconciliation. The trilemma of Theorem 1 is realisation-wise: some bid profile in the prior’s positive-measure support yields positive operator surplus. The reported CoNCop values are in-expectation over the five-seed prior, but the underlying realisations are positive directly: under the ghost-bid deviation the per-round operator surplus is a deterministic constant (𝜀 = 1.1¯𝑣 per round across VCG, first-price, and posted-price), so every realisation — not merely the mean — is strictly positive; the posted-price inflator varies round-to-round (perround surplus in [0, 5.8] as 𝑝 post and the random allocation interact) but its mass stays positive. Realisation-wise extraction therefore holds across the body of bid profiles, consistent with the realisation-wise statement of Theorem 1, not only in expectation. 4.4
Empirical Cost of Non-Credibility
Eq. (2) defines three CoNC variants; the trilemma-illustration ablation populates the operator-side variant for the no-enforcement case. Under sealed-bid VCG with the ghost-bid adversary (Exp. 1), CoNCop ≈ +6.7% and CoNCW = 11.8%. Broadcast commitment (Exp. 2) drives both to ≤ 0. The empirical CoNC therefore tracks the lower bound of Corollary 1 from below under no enforcement and collapses under broadcast. The agent-side variant CoNCag is populated by Exp. R-5 (Section 4.3), which also extends the operator-side reading to first-price and posted-price mechanism classes. 4.5
Summary
Three baseline experiments suffice to exhibit the trilemma’s empirical face: ghost-bid deviations are profitable and undetectable under sealed-bid VCG, extend to the Myerson mechanism, and are closed by broadcast commitment (Theorems 1 and 8, Exps. 1–3). Exp. R-5 (Section 4.3) extends the operator-side reading across VCG, first-price, and posted-price mechanism classes, reports the agentside CoNCag counterpart, and documents the empirical 𝛾𝑖 𝑗 ordering tree < sp < entangled. The empirical CoNC tracks the topology-class lower bound of Corollary 1 under no enforcement. The
Credibility Trilemma in Polymatroidal Service Markets
0:51
Cost of Non−Credibility by mechanism / operator
CoNC (dimensionless)
Stacked: operator transfer + welfare loss = agent cost (pooled over topologies; error bar = spread)
0.3
0.2
0.1
0.0
/ vcg
idde
st_b
gho
r
er
bidd
e _pric
ost_ / gh
first
e _pric
er bidd
pric
d
te pos
CoNCW (welfare destruction)
r
lato
ost_
/ gh
pric
ted_
pos
d_ oste
f e_in
e/p
CoNCop (operator transfer)
Fig. 4. Cost of Non-Credibility by mechanism/operator (deviations only; pooled over the three DAG topologies, which are near-invariant here, <0.013 spread in CoNCop , shown as error bars). The variants are additive, CoNCag = CoNCop + CoNCW , so each bar stacks the operator transfer CoNCop (bottom) and the welfare destruction CoNCW (top); the total height is the agent-side cost CoNCag . Two readings: (i) extraction is allocation-class-robust — VCG and first-price give identical CoNCop — and extends to posted-price, where the native price-inflation attack is strongest; (ii) pure transfers (VCG/first-price ghost-bid, the inflator) carry nearzero CoNCW , whereas the allocation-distorting posted-price ghost-bid adds a positive welfare-destruction component. Submodularity gap γij shifts with topology: tree < sp < entangled Dashed lines: per−topology means. Distributions overlap; the ordering is in the central tendency. Cliff's δ: tree → sp = 0.38, sp → entangled = 0.19
800
Density
600
Topology tree
400
sp entangled
200
0 0.0010
0.0015
0.0020
γij (realised submodularity gap)
0.0025
Fig. 5. Realised submodularity gap 𝛾𝑖 𝑗 is topology-monotone: the three kernel densities (shared axis) shift right tree < sp < entangled, with per-topology means (dashed) at 0.0012 / 0.0015 / 0.0017. The distributions overlap substantially — the ordering lives in the central tendency, not in separation — as quantified by the adjacent-pair Cliff’s 𝛿 (0.38 tree→sp, 0.19 sp→entangled). The per-class CoNC lower bound of Corollary 1 depends on this ordering, not on disjoint support.
0:52
Lovén et al.
full ablation of the three resolutions and the deployable surface is out of scope here (cf. Sections 5.4 and 5.5). 5 5.1
Discussion Related Work
Service-oriented architecture, BPM, and QoS composition. The construction inherits its publish / discover/ bind / invoke skeleton from service-oriented architecture [25, 60, 63]. The polymatroidal allocation generalises QoS-aware service selection [19, 20]: rather than choose one service path under multi-dimensional QoS constraints, the marketplace composes multiple agent-task assignments under shared capacity, with the slice’s max-flow as the aggregate QoS handle. Trust-management work for service marketplaces [52] relies on soft enforcement and reputation; our analysis delineates when soft governance suffices (modular settings) and when explicit commitment or structural separation is required (non-modular polymatroidal markets). Credible mechanism design. Akbarpour and Li [3] introduced the credibility trilemma for singleitem auctions; Ferreira and Weinberg [30] and Chitra et al. [22] resolved it via blockchain and public broadcast respectively, and Ganesh and Zhang [35] extended the resolution to matroid feasibility while proving DRA non-credibility beyond. We connect this line to polymatroidal feasibility arising from service-dependency DAGs: integrator encapsulation reduces cross-domain allocation to matroid feasibility (Level 1, enabling DRA), while within-domain allocation relies on domain separation or ascending auctions (Level 2). We build on [54] (hybrid market model, encapsulation, value-greedy benchmark), addressing its open question of modelling the operator as a strategic player. Concurrent and independent work: edge-priced capacity sharing. Amin et al. [5] (ACM TEAC 14(1), Art. 2) study a single source–sink network with integer edge capacities, affine valuations, and homogeneous coalition disutility under a faithful mediator. They establish, for series–parallel topologies, a Walrasian–VCG baseline (Theorem 3.2: existence and polynomial-time computability of an integer equilibrium; Lemma 3.8: gross-substitutes structure of the augmented value function; Theorem 3.10: a particular equilibrium that maximises agent utilities and minimises total edge prices, equivalent to VCG payments) and exhibit, on non-series–parallel topologies (Examples 3.3–3.4), an LP integrality gap that obstructs equilibrium existence. This study is concurrent and independent of the present paper: both papers belong to the same publication generation, neither derives from the other, and they appear in the same journal. The relationship to our work is structurally clean: their faithful-mediator Walrasian–VCG baseline is the structural counterpart over which our credibility analysis perturbs, and their LP integrality gap on non-SP topologies plays the role of 𝛾𝑖 𝑗 (the non-modularity gap) at the instance level. Section A proves the trilemma, the Cost of Non-Credibility, and domain-separation as instances over their primitives, with the bridging device being the marginal Lipschitz constant of the remittance schedule (Lemma 5); a regime classification lifting this bridging device to arbitrary polymatroids is the subject of follow-up work, generalising what is in their setting an edge-pricing argument over Lemma 3.8 / their auxiliary economy. The relationship is peer, not foundational: their model assumes a faithful platform and a static optimisation viewpoint, so the strategic-operator content (the trilemma, the CoNC, and the resolution mechanisms developed here) is not derivable from their framework. What survives on their primitives alone is the Walrasian–VCG baseline that our analysis perturbs — precisely the baseline that the trilemma motivates as inadequate. Trusted execution and oracle-mediated auctions. Trusted-execution-environment (TEE) auctions and authenticated-oracle frameworks offer an orthogonal route to mechanism credibility. Town
Credibility Trilemma in Polymatroidal Service Markets
0:53
Crier [84] introduced authenticated data feeds for smart contracts via TEE attestation; Ekiden [21] extended this to confidentiality-preserving smart-contract execution; ACE [83] examines asynchronous execution with similar trust roots. These approaches realise the (B1) operator-independence assumption of Theorem 8 via hardware attestation rather than network-layer separation, occupying the low-audit-latency end of a substrate design space whose systematic comparison is left for future work. Market-based allocation, agentic AI, and slicing. Classical market-based cloud and grid allocation [80] assumes a trusted auctioneer; blockchain marketplaces [34] swap this for consensus latency incompatible with real-time AI. Federated marketplace proposals introduce broker roles analogous to our integrators but do not model operator credibility. Agentic-AI work [26] envisions autonomous service composition without formal incentive guarantees, and vendor protocols (e.g., Google A2A [37]) standardise communication but not the economic layer. Network slicing [1, 73] typically assumes a trusted infrastructure provider; our integrator model generalises slice brokering to strategic-broker settings, and the trilemma applies whenever per-tenant capacity allocations are non-modular. Polymatroid welfare maximisation reduces to priority-sorted Edmonds greedy [29] with 𝑂 (𝑛 log 𝑛+𝑛 ·𝑇𝑓 ) time, 𝑇𝑓 the rank-function cost; the architectural comparison with centralised, federated, and decentralised families is deferred to future systems-engineering work. Two-sided platform economics. The slice marketplace shares structural features with two-sided platform markets: the integrator layer connects resource providers (one side) to service-consuming agents (the other), and the operator captures value at the interface. The classical platform-economics literature [8, 65] identifies cross-side externalities and pricing interdependencies as the defining features of such markets; multi-homing and competitive tipping are central welfare concerns [18, 81]. Post-2010 work refines this picture: Hagiu, Teh, and Wright [41] formalise the marketplace-vsreseller tradeoff that our trilemma cuts across; Tan and Wright [76] sharpen the single-vs-multisided price-theoretic predictions; the Handbook of Industrial Organization chapter by Jullien, Pavan, and Rysman [47] and the Belleflamme–Peitz textbook [11] synthesise the modern theory of two-sided markets, network effects, and platform pricing. Theorem 1 can be read as the formal Pareto frontier of the marketplace-vs-reseller tradeoff in the Hagiu-Wright sense: a platform that wants to be revenue-optimal DSIC and trustworthy in execution must choose two of the three; the structural separation prescriptions of Theorem 8 and Proposition 5 correspond to two distinct points on that frontier. The matching-markets tradition (matching with contracts [42], twosided matching theory [66]) supplies a complementary lens: where polymatroidal allocation pins quantity-based capacity sharing under DSIC, contract-based matching addresses non-price terms (eligibility, bundling) that integrator encapsulation (P3) absorbs into the slice. Collusion among integrators with externalities [17] represents an attack surface orthogonal to operator credibility; our orthogonality decomposition (Theorem 9) treats integrator-side collusion as a violation of (O1) (disjoint actors). The present paper’s credibility problem is orthogonal to but compatible with this literature: even holding the platform’s pricing structure fixed, the operator’s ability to deviate undetectably in executing the allocation mechanism introduces a layer of strategic risk absent from classical two-sided models that assume a benign intermediary. Domain separation (Proposition 5) is, in this reading, the structural analogue of the financial-exchange principle: exchange operators charge transaction fees without holding proprietary positions, precisely to eliminate the alignment problem that the credibility trilemma formalises. The one-sided Salop baseline of Proposition 6 omits cross-side externalities and multi-homing (see Remark 25); these effects can strengthen or weaken the 1/𝑘 markup discipline depending on whether network effects are internalised, and incorporating them quantitatively is a clean direction for future work.
0:54
Lovén et al.
Commercial vertically integrated platforms. Commercial platforms supply natural test instances of (C0)–(C4) being partially satisfied or broken by integration. AWS Marketplace and the Apple App Store unite roles 2 and 3 of Definition 1 (the platform owns the cloud capacity or app-distribution channel and runs the allocation/ranking auction), violating (C1) ownership-stake and creating exactly the dual-role conflict to which Theorem 1 binds; observed harms (self-preferencing in App Store search ranking, AWS preferring its own first-party services in marketplace placement; the broader pattern documented in Khan [49] and Wu [82]) are empirical instantiations of the perturbation-lemma payment inflation channel. EU Digital Markets Act (DMA) gatekeeper rules and US Reg NMS order-protection in equity markets are regulatory devices that retrofit (C0)–(C2) onto platforms that would otherwise violate them: DMA’s data-access and self-preferencing prohibitions are partial substitutes for (C1), while Reg NMS’s trade-through protection enforces a settlementseparation analog of (C0) on lit exchanges (the high-frequency-trading arms race analysed by Budish, Cramton, and Shim [15] is the contemporary critique of Reg NMS Rule 611). Structural separation regimes such as CCP / EMIR for derivatives clearing operate at the (C0)–(C1) layer (central counterparties cannot hold proprietary positions in the cleared products), while behavioural rules such as DMA Article 6.5 and Reg NMS Rule 611 operate at the (C4) layer (no fee on undelivered or trade-through-routed allocation); the two governance modes are not interchangeable, and the trilemma flags structural separation as the load-bearing fix where it is feasible. The FTC has pursued cases against vertically integrated platforms on theories that align with the trilemma’s structural prediction (the platform’s allocation discretion plus its ownership stake permit profitable, hard-todetect deviation), although the legal vocabulary is anti-trust rather than mechanism-design. The pattern is consistent: platforms whose institutional design is intended to satisfy (C0)–(C4) (FCC spectrum auctions [43], ERCOT, NRMP) approximate credibility in practice with varying empirical track records under capture pressure; where vertical integration breaks (C0)–(C2), regulators step in to retrofit the missing conditions, validating the impossibility result the trilemma formalises. We emphasise intended rather than “by construction” satisfaction: the political-economy literature (next paragraph) documents that even FCC, ERCOT, and NRMP have faced capture, rent-seeking, or rulecircumvention pressures over their multi-decade histories. Settlement separation has institutional costs (lost float on payment custody; loss of cross-subsidy from data captured at the matching layer; the operational complexity of a third-party clearing relationship); the credibility-vs-revenue trade-off this paper formalises is the structural shadow of those institutional costs. Regulatory capture and the political economy of (C0)–(C4). (C0)–(C4) are not costlessly enforceable conditions: they must be designed, monitored, and defended against capture pressure, and the political-economy literature on regulatory capture documents that the empirical track record of such institutional separation is variable [51, 74]. What our result contributes to that reading is sharpness: the knife-edge of Corollary 3 (𝜆 > 0 at any positive ownership stake) makes credibility a binary capture threshold rather than a continuum, so a regulator’s defence of (C1) (no ownership stake) is binary in its prescriptive content. Accordingly, calling the within-domain Level-2 setting of Lemma 4 “by default credible” is shorthand for “credible under intra-firm-governance assumptions analogous to (C0)–(C4) applied to the internal allocation layer,” and we use the longer phrase where that assumption is load-bearing. Softening this binary into a continuous audit-burden surface in stake, escrow, and audit frequency is the subject of follow-up work; the present paper restricts to the static structural-prescription reading. 5.2
Practical Implications
Three implications follow. Marketplace neutrality is a first-order architectural requirement (Theorem 1), and domain separation (Proposition 5) is the natural default under (C0)–(C4). The choice of
Credibility Trilemma in Polymatroidal Service Markets
0:55
credibility mechanism is latency-dependent: broadcast commitment for <200 ms cycles, blockchain DRA only for batch settlement; competition and credibility are structurally orthogonal under disjoint actors (Theorem 9; empirical exercise of the decomposition is deferred to follow-up work). Polymatroidal structure and DSIC are design-time properties, leaving credibility as the only runtime link. Beyond the computing continuum, the same impossibility applies to spectrum auctions with sub-modular interference constraints and to multi-tenant data-centre resource markets; the architectural recommendation to separate the marketplace from the assets it trades carries to those settings without modification. Observability of Γ. The CoNC bounds of Section 3.3, and the credibility-deployable surface S 𝜀 Í developed in follow-up work, are parametrised by the aggregate non-modularity gap Γ = (𝑖,𝑗 ) 𝛾𝑖 𝑗 , which is an operator-private quantity: it is determined by the internal capacity topology of the polymatroid, known to the operator but not in general to external regulators or deployers. Parameters observable by the deployer are the marketplace size 𝑛, the bid-scale 𝑣¯, and the escrow fraction 𝜂 (contractual). The audit frequency 𝜏 is also under the deployer’s control. Calibrating the surface therefore requires either a regulatory disclosure obligation on capacity topology (analogous to network-neutrality transparency rules), or a conservative upper bound on Γ derived from network-size parameters alone. Robust mechanism design frameworks that account for operatorprivate information about the feasibility structure offer a systematic route to such bounds; see, e.g., Bergemann and Morris [12] for the general robust mechanism design methodology. We flag the observability gap as a deployment limitation and leave tight Γ-estimation under partial disclosure to future work. Resolution-cost comparison. Table 4 summarises the three structurally distinct resolutions of the trilemma — commitment (broadcast / DRA), domain separation, and integrator competition — along four axes that determine deployability: institutional precondition, capture vulnerability, runtime/audit cost, and representative real-world instance. The table is descriptive rather than prescriptive: the three resolutions are complementary points in the credibility-deployable surface developed in follow-up work, and a real deployment typically mixes them. The capture-vulnerability column collapses the political-economy analysis of Section 5.1’s knife-edge / (C1) / (C4) review; the institutional-precondition column collapses (B1)/(B2′ ) for commitment, (C0)–(C4) for domain separation, and (O1)/(O4) for competition-orthogonality. Deployability of domain separation: (C0)–(C4) in practice. Proposition 5 establishes that domain separation under conditions (C0)–(C4) provides a credibility guarantee through revenue-channel separation. The conditions are demanding: (C0) requires settlement to be operationally independent of the allocation computation; (C1)–(C2) mandate no ownership stake and no dynamic incentive in the remittance schedule; (C3) requires public reconstructibility of payments; and (C4) requires the operator to hold no allocation discretion after the mechanism has run. The “natural default” reading of Section 5.2 is therefore conditional on institutional context. Platforms that are designed to satisfy (C0)–(C4), with varying empirical track records under capture pressure, include: FCC spectrum incentive auctions [5], where statutory separation of the FCC’s allocation function from broadcasters’ interests and the absence of any ownership stake in the licensed bands are intended to satisfy (C0)– (C4) (the institutional history, including the long-running capture critique of Hazlett [43], qualifies any “by construction” reading); and centralised clearinghouses such as the ERCOT electricity market operator or NRMP medical-residency matching, where an independent non-profit entity runs the allocation mechanism without holding the matched goods (NRMP is closest to the clean case; ERCOT’s record under the 2021 Texas winter-storm market design failures qualifies its empirical reading). Platforms that do not satisfy (C0)–(C4) include: cloud federation brokers that own cloud
0:56
Lovén et al.
Table 4. Resolution-cost comparison across the three credibility-restoration mechanisms: per-resolution institutional precondition, capture vulnerability (relative to the political-economy review of Section 5.1), runtime / audit cost order, and a representative real-world instance. Resolution
Institutional precon- Capture vulnera- Runtime / audit Representative indition bility cost stance
Commitment (B1)+(B2′ ) on a causal- Low if substrate Per-round broadcast (broadcast / broadcast substrate in- independence holds; + on-path rank-value DRA) dependent of the opera- high if substrate is authentication (TEE tor (Theorem 8) operator-controlled / Merkle / ZK) Domain sepa- (C0)–(C4) jointly en- High on (C1) Settlement custody ration forced; settlement sep- ownership-stake handoff; quarterly aration; no ownership and (C4) fee- C0–C4 compliance stake; no fee on unde- on-undelivered audit livered (Proposition 5) (incumbent lobbying, boundary definition) Integrator (O1) disjoint actors + Medium on (O1) Continuous: samecompetition (O4) IR slack at the Sa- (vertical-integration side competition (orthogonallop boundary (Proposi- pressure breaks discipline; no perity) tion 6, Theorem 9) disjoint-actors); low round protocol cost on (O4)
FCC incentive auctions; lit-exchange Reg NMS ERCOT; NRMP; centralcounterparty clearing
AWS Marketplace boundary; App Store / DMA
capacity while operating the inter-cloud allocation auction (violating C1 via ownership stake and C0 via payment custody); O-RAN slicing controllers that hold licensed spectrum capacity while running the slice-allocation mechanism (violating C2 via dynamic revenue incentives); and integrated edge marketplaces in which the same entity performs inference serving (owns the resource) and runs the bid evaluation (operates the mechanism). For these cases, (C0)–(C4) are not met by default: the commitment-based (Theorem 8) or competition-based (Proposition 6) alternatives are required, and a two-tier deployment architecture combining them is the natural integration target. Theoretical positioning. The credibility trilemma (Theorem 1) extends the single-item credibility impossibility of Akbarpour and Li [3] to polymatroidal service markets, with the non-modularity gap 𝛾𝑖 𝑗 as the structural enabler; the resolution mechanisms each address a distinct attack surface. Theorem 1, Corollary 1, and Proposition 5 admit instance-level statements over the edge-pricing market of [5]; Theorem 8 and the two-tier architecture rely on the broader hybrid framework of [54] (multi-source DAG, multi-output integrator slices, matroid encapsulation). Real-platform calibration. The deployable-surface results of follow-up work are theoretical guidance: they characterise the (𝜆, 𝜂, 𝜏) region in which 𝜀-credibility is achievable, but the surface parameters themselves (the aggregate non-modularity gap Γ, the bid-scale 𝑣¯, the audit sensitivity 𝛽) must be calibrated against real platform traces before the surface can be used as a quantitative engineering specification. The simulation experiments of Section 4 illustrate internal consistency under stylised conditions (we use “illustrate” rather than “validate” to mark these as implementation-level consistency checks; theorem-level generality is established by the proofs in Section 3); full empirical calibration against deployed edge-cloud or spectrum-auction infrastructure, including measurement of actual polymatroid capacity topology and operator deviation amplitudes, is targeted in future systems-engineering work. Practitioners deploying the two-tier architecture before that calibration
Credibility Trilemma in Polymatroidal Service Markets
0:57
is complete should treat that deployable surface as a structural roadmap and adopt conservative (smaller) values of 𝜂 ∗ and 𝜏 than the surface strictly requires. 5.3
Knife-Edge Deployability: The Trilemma as a Design Surface
The knife-edge of Proposition 5 reads as a sharp negative: any positive ownership stake 𝜆 > 0 breaks credibility. Follow-up work converts this into a deployment guideline by introducing a credibilitydeployable surface in stake 𝜆, escrow fraction 𝜂, and audit frequency 𝜏; the three resolutions correspond to corners of (or an orthogonal axis to) this surface. Practical deployments mix the three resolutions, and that surface gives the formal trade-off. 5.4
Limitations
The formal results assume a single self-interested operator and non-modular polymatroidal feasibility (matroid structure at Level 1 for Theorem 8(ii)). Operative limitations: collusion (multi-operator and agent–operator coalitions) is out of scope — a partial sketch is that two of the four operator deviations of Section 2.3 (capacity misreporting, selective information revelation) admit coalitions of size 2 without changing the trilemma argument, while price-manipulation coalitions require simultaneous Archer–Tardos perturbations on disjoint sharing pairs and reduce to the topology-class CoNC bound of Section 3.3; adversarial broadcast jamming relaxes (B1) and breaks Theorem 8(i) but not Theorem 8(ii) (DRA tolerates broadcast failures via the deposit mechanism); Theorem 8(ii) requires protocol–pipeline co-design under hard <200 ms deadlines, addressed only at the ascending-clinching end of the deployment-pattern hierarchy. The full assumption map and further limitations (including imperfect broadcast modelling and adaptive-operator results) are deferred to future systems-engineering work. 5.5
Future Directions
Theoretical extensions: coalition credibility via simultaneous perturbations across multiple sharing pairs (the topology-class CoNC framework of Section 3.3 appears to extend to bounded coalitions; interdependent-values type spaces add structural obstacles [45]); tightness of the credibility-deployable surface developed in follow-up work under model-uncertainty in the prior or in Γ; privacy-preserving credible auctions combining zero-knowledge proofs with commitment devices on the regimeclassification axis; and adaptive audit policy where audit frequency and detection sensitivity depend on observed deviation behaviour, building on an SDS theorem developed in follow-up work. Robustness under adaptive operators, imperfect channels, strategic exit, and supply non-stationarity, together with field-level validation and prototype implementation on standard cluster-management substrates, is the subject of future systems-engineering work. Dynamic considerations: cross-round credibility. The trilemma is a single-round impossibility; cross-round dynamics raise distinct credibility questions that we leave open. Pavan, Segal, and Toikka [64] provide the canonical Myersonian framework for dynamic mechanism design with persistent private information; an extension of Theorem 1 to their setting would replace the singleround Archer–Tardos identity with a dynamic-virtual-value characterisation, and the perturbationlemma family Fperturb would generalise to cross-round payment-flow perturbations. Reputation systems (Tadelis [75]) supply a partial substitute for in-mechanism credibility devices when the operator’s identity persists across rounds: positive-probability detection at any round translates into reputational discounting that bounds the operator’s expected deviation surplus. The cheappseudonym critique of Friedman and Resnick [31] qualifies this: when operators can shed identity at low cost, reputation alone cannot enforce credibility, and the in-mechanism devices (Theorem 8, Proposition 5) remain necessary. The interaction between identity-persistence assumptions and
0:58
Lovén et al.
the audit-frequency/escrow-fraction parameters of a follow-up credibility-deployable surface is a clean target for dynamic extension. 6
Conclusion
We have identified and addressed the credibility gap in mechanism-mediated service markets. Because the market mechanism’s contribution under polymatroidal feasibility is purely incentivetheoretic [54], faithful operator execution is the channel through which welfare guarantees flow, and is untenable when the operator simultaneously controls resources and runs the auction. We formalised this as a credible mechanism design problem, distinguishing realisation-wise and exante 𝜀-credibility (Definition 3), proved a trilemma between revenue optimality, agent DSIC, and operator credibility (Theorem 1), and showed that commitment devices (Theorem 8), administrative domain separation under settlement separation and side conditions (Proposition 5), and integrator competition (Proposition 6) resolve it via structurally distinct attack surfaces. The Cost of Non-Credibility is the quantitative face of this impossibility: it measures how large the credibility gap is, rather than adding a second one. We establish envelope upper bounds for the perturbation-lemma family on the revenue-optimal DSIC class (Proposition 4; Remark 14), and asymptotically matching-rate-tight Θ-bounds (in the sense of Remark 21, with the absoluteunits variant CoNCabsop reporting the structural scaling) across five topology classes (singleedge, series, parallel, tree, series–parallel), plus a matching upper bound 𝑂 (|S|) on general DAGs realised by an Ω(|S|) witness on the SP-augmented sub-family (Remark 20 is the numbered Open Problem 1 stating the matching lower bound on Wheatstone-embedded non-SP DAGs). The trilemma-illustration ablation reports an empirical 11.8% welfare loss (CoNCW ) and a +6.7% operator extraction rate (CoNCop ) under sealed-bid VCG and no enforcement (Section 4.4, Exp. 1), both driven to zero by broadcast commitment. Under disjoint operator and integrator entities and IR-slack, an orthogonality decomposition (Theorem 9) shows that the credibility-design parameter 𝜆 (ownership stake) and the integrator-side competition parameters (𝑡, 𝑘) enter the surplus-extraction-rate functional additively, with LSalop read as a consumer-surplus transfer rather than as a deadweight loss in the (O4) regime. A continuous deployable surface in stake 𝜆, escrow fraction 𝜂, and audit frequency 𝜏, together with the empirical instantiation of the domain-separation knife-edge and a two-tier deployment architecture, are the subject of follow-up work. Section A establishes the trilemma, the CoNC bound, and domain-separation as instances over the independently published edge-pricing market of [5], with the bridging device (Lemma 5) being the marginal Lipschitz constant of the remittance schedule — so the load-bearing economic content survives over a refereed external setting, not only within our framework. The credibility gap is therefore an architectural design problem rather than an implementation detail. Deployable extensions (a mediator-revenue regime classification by the marginal Lipschitz constant of the remittance schedule; a continuous bilinear surface that refines the binary knife-edge of Proposition 5 into a trade-off in ownership stake and escrow fraction; a Smallest Detectable Stake threshold introducing audit frequency; a three-dimensional deployable surface; and a two-tier deployment architecture) are the subject of follow-up work. Open questions in the present paper itself (collusion, multi-dimensional types, hidden-state operators, non-revenue-optimal monotone DSIC rules outside the perturbation-envelope scope, and the matching lower bound on Wheatstoneembedded non-SP DAGs of Open Problem 1) are mapped to extensions in Section 5.5. The trilemma identifies which resolutions work; how to deploy them is the next step. Acknowledgments This work was supported by the Research Council of Finland through the 6G Flagship program (grant 318927) and the CO2CREATION Strategic Research Council project (grant 372355), by the EC
Credibility Trilemma in Polymatroidal Service Markets
0:59
through HEU NEUROCLIMA project (GA 101137711) as well as the ERDF (project numbers A81568, A91867), and by the Business Finland through the Neural pub/sub research project (diary number 8754/31/2022). Moreover, Dustdar’s work and equipment have been supported by CNS2023-144359 financed by MICIU/AEI/10.13039/501100011033 and the European Union NextGeneration EU/PRTR. References [1] Ibrahim Afolabi, Tarik Taleb, Konstantinos Samdanis, et al. 2018. Network Slicing and Softwarization: A Survey on Principles, Enabling Technologies, and Solutions. IEEE Communications Surveys & Tutorials 20, 3 (2018), 2429–2453. doi:10.1109/COMST.2018.2815638 [2] Amitanand S. Aiyer, Lorenzo Alvisi, Allen Clement, Mike Dahlin, Jean-Philippe Martin, and Carl Porth. 2005. BAR Fault Tolerance for Cooperative Services. In Proc. 20th ACM Symposium on Operating Systems Principles (SOSP). 45–58. doi:10.1145/1095810.1095816 [3] Mohammad Akbarpour and Shengwu Li. 2020. Credible Auctions: A Trilemma. Econometrica 88, 2 (2020), 425–467. doi:10.3982/ECTA15925 [4] AMD. 2024. AMD Secure Encrypted Virtualization-Secure Nested Paging (SEV-SNP). White paper. [5] Saurabh Amin, Patrick Jaillet, Haripriya Pulyassary, and Manxi Wu. 2026. Market Design for Capacity Sharing in Networks. ACM Transactions on Economics and Computation 14, 1, Article 2 (Feb. 2026), 47 pages. doi:10.1145/3777901 [6] Simon P. Anderson, André de Palma, and Jacques-François Thisse. 1992. Discrete Choice Theory of Product Differentiation. MIT Press, Cambridge, MA. [7] Aaron Archer and Éva Tardos. 2001. Truthful Mechanisms for One-Parameter Agents. In Proc. 42nd IEEE Symp. Foundations of Computer Science (FOCS). 482–491. doi:10.1109/SFCS.2001.959924 [8] Mark Armstrong. 2006. Competition in Two-Sided Markets. RAND Journal of Economics 37, 3 (2006), 668–691. doi:10.1111/j.1756-2171.2006.tb00037.x [9] Lawrence M. Ausubel. 2004. An Efficient Ascending-Bid Auction for Multiple Objects. American Economic Review 94, 5 (December 2004), 1452–1475. doi:10.1257/0002828043052330 [10] Lawrence M. Ausubel and Paul Milgrom. 2006. The Lovely but Lonely Vickrey Auction. In Combinatorial Auctions, Peter Cramton, Yoav Shoham, and Richard Steinberg (Eds.). MIT Press, 17–40. https://doi.org/10.7551/mitpress/ 9780262033428.003.0002 [11] Paul Belleflamme and Martin Peitz. 2015. Industrial Organization: Markets and Strategies (2nd ed.). Cambridge University Press. [12] Dirk Bergemann and Stephen Morris. 2005. Robust Mechanism Design. Econometrica 73, 6 (2005), 1771–1813. doi:10.1111/j.1468-0262.2005.00638.x [13] Sushil Bikhchandani, Shurojit Chatterji, Ron Lavi, Ahuva Mu’alem, Noam Nisan, and Arunava Sen. 2006. Weak Monotonicity Characterizes Deterministic Dominant-Strategy Implementation. Econometrica 74, 4 (2006), 1109–1132. doi:10.1111/j.1468-0262.2006.00697.x [14] Shyam Bikhchandani and John W. Mamer. 1997. Competitive Equilibrium in an Exchange Economy with Indivisibilities. Journal of Economic Theory 74, 2 (1997), 385–413. doi:10.1006/jeth.1996.2269 [15] Eric Budish, Peter Cramton, and John Shim. 2015. The High-Frequency Trading Arms Race: Frequent Batch Auctions as a Market Design Response. Quarterly Journal of Economics 130, 4 (2015), 1547–1621. doi:10.1093/qje/qjv027 [16] Yang Cai, Constantinos Daskalakis, and S. Matthew Weinberg. 2017. A Duality-Based Unified Approach to Bayesian Mechanism Design. J. ACM 64, 6 (2017), Article 39. doi:10.1145/3140772 [17] Bernard Caillaud and Philippe Jehiel. 1998. Collusion in Auctions with Externalities. RAND Journal of Economics 29, 4 (1998), 680–702. doi:10.2307/2556095 [18] Bernard Caillaud and Bruno Jullien. 2003. Chicken and Egg: Competition Among Intermediation Service Providers. RAND Journal of Economics 34, 2 (2003), 309–328. doi:10.2307/1593720 [19] Jorge Cardoso, Amit Sheth, John Miller, Jonathan Arnold, and Krys Kochut. 2004. Quality of Service for Workflows and Web Service Processes. Web Semantics 1, 3 (2004), 281–308. doi:10.1016/j.websem.2004.03.001 [20] Fabio Casati and Ming-Chien Shan. 2001. Models and Languages for Describing and Discovering E-Services. SIGMOD Record 30, 1 (2001), 83–92. doi:10.1145/373626.373738 [21] Raymond Cheng, Fan Zhang, Jernej Kos, Warren He, Nicholas Hynes, Noah Johnson, Ari Juels, Andrew Miller, and Dawn Song. 2019. Ekiden: A Platform for Confidentiality-Preserving, Trustworthy, and Performant Smart Contracts. In Proc. IEEE European Symposium on Security and Privacy (EuroS&P). 185–200. doi:10.1109/EuroSP.2019.00023 [22] Tarun Chitra, Matheus V. X. Ferreira, and Kshitij Kulkarni. 2024. Credible, Optimal Auctions via Public Broadcast. In 6th Conf. Advances in Financial Technologies (AFT) (LIPIcs, Vol. 316). 19:1–19:16. doi:10.4230/LIPIcs.AFT.2024.19 [23] Edward H. Clarke. 1971. Multipart Pricing of Public Goods. Public Choice 11 (1971), 17–33. doi:10.1007/BF01726210 [24] Victor Costan and Srinivas Devadas. 2016. Intel SGX Explained. In IACR Cryptology ePrint Archive. Report 2016/086.
0:60
Lovén et al.
[25] Francisco Curbera, Rania Khalaf, Nirmal Mukhi, Stefan Tai, and Sanjiva Weerawarana. 2003. The Next Step in Web Services. In Communications of the ACM, Vol. 46. 29–34. doi:10.1145/944217.944234 [26] Shuiguang Deng, Hailiang Zhao, Ziqi Wang, et al. 2025. Agentic Services Computing. arXiv:2509.24380 [cs.SE] https://arxiv.org/abs/2509.24380 [27] Hana Derouiche, Zaki Brahmi, and Haithem Mazeni. 2025. Agentic AI Frameworks: Architectures, Protocols, and Design Challenges. arXiv:2508.10146 [cs.AI] https://arxiv.org/abs/2508.10146 [28] R. J. Duffin. 1965. Topology of Series-Parallel Networks. J. Math. Anal. Appl. 10, 2 (1965), 303–318. doi:10.1016/0022247X(65)90125-3 [29] Jack Edmonds. 2003. Submodular Functions, Matroids, and Certain Polyhedra. In Combinatorial Optimization - Eureka, You Shrink! Springer-Verlag, Berlin, Heidelberg, 11–26. doi:10.1007/3-540-36478-1_2 [30] Matheus V. X. Ferreira and S. Matthew Weinberg. 2020. Credible, Truthful, and Two-Round (Optimal) Auctions via Cryptographic Commitments. In Proc. 21st ACM Conf. Economics and Computation (EC). 683–712. doi:10.1145/3391403. 3399495 [31] Eric J. Friedman and Paul Resnick. 2001. The Social Cost of Cheap Pseudonyms. Journal of Economics & Management Strategy 10, 2 (2001), 173–199. doi:10.1111/j.1430-9134.2001.00173.x [32] Satoru Fujishige. 2005. Submodular Functions and Optimization (2nd ed.). Vol. 58. Elsevier. [33] Ariel Gabizon, Zachary J. Williamson, and Oana Ciobotaru. 2019. PLONK: Permutations over Lagrange-bases for Oecumenical Noninteractive arguments of Knowledge. Cryptology ePrint Archive, Report 2019/953. https: //eprint.iacr.org/2019/953 [34] Keke Gai, Jinnan Guo, Liehuang Zhu, and Shui Yu. 2020. Blockchain Meets Cloud Computing: A Survey. IEEE Communications Surveys & Tutorials 22, 3 (2020), 2009–2030. doi:10.1109/COMST.2020.2989392 [35] Aadityan Ganesh and Qianfan Zhang. 2025. Truthful, Credible, and Optimal Auctions for Matroids via Blockchains and Commitments. In Proc. 26th ACM Conf. Economics and Computation (EC). doi:10.1145/3736252.3742652 [36] Gagan Goel, Vahab Mirrokni, and Renato Paes Leme. 2015. Polyhedral Clinching Auctions and the AdWords Polytope. J. ACM 62, 3, Article 18 (2015). doi:10.1145/2738038 [37] Google Cloud. 2025. Announcing the Agent2Agent Protocol (A2A). Google Developers Blog. https://developers. googleblog.com/en/a2a-a-new-era-of-agent-interoperability/ Accessed: 2026-02-23. [38] Jens Groth. 2016. On the Size of Pairing-Based Non-Interactive Arguments. In Advances in Cryptology – EUROCRYPT 2016 (LNCS, Vol. 9666). Springer, 305–326. doi:10.1007/978-3-662-49896-5_11 [39] Theodore Groves. 1973. Incentives in Teams. Econometrica 41, 4 (1973), 617–631. doi:10.2307/1914085 [40] Faruk Gul and Ennio Stacchetti. 1999. Walrasian Equilibrium with Gross Substitutes. Journal of Economic Theory 87, 1 (1999), 95–124. doi:10.1006/jeth.1999.2531 [41] Andrei Hagiu, Tat-How Teh, and Julian Wright. 2022. Should Platforms Be Allowed to Sell on Their Own Marketplaces? RAND Journal of Economics 53, 2 (2022), 297–327. doi:10.1111/1756-2171.12408 [42] John William Hatfield and Paul R. Milgrom. 2005. Matching with Contracts. American Economic Review 95, 4 (2005), 913–935. doi:10.1257/0002828054825466 [43] Thomas W. Hazlett. 2017. The Political Spectrum: The Tumultuous Liberation of Wireless Technology, from Herbert Hoover to the Smartphone. Yale University Press (2017). [44] Masao Iri and Nobuaki Tomizawa. 1968. An Algorithm for Finding an Optimal “Independent Assignment”. Journal of the Operations Research Society of Japan 11, 4 (1968), 201–217. [45] Philippe Jehiel and Benny Moldovanu. 2001. Efficient Design with Interdependent Valuations. Econometrica 69, 5 (2001), 1237–1259. doi:10.1111/1468-0262.00240 [46] Xiaolin Jiang, Hossein Shokri-Ghadikolaei, Gabor Fodor, et al. 2019. Low-Latency Networking: Where Latency Lurks and How to Tame It. Proc. IEEE 107, 2 (2019), 280–306. doi:10.1109/JPROC.2018.2863960 [47] Bruno Jullien, Alessandro Pavan, and Marc Rysman. 2021. Two-Sided Markets, Pricing, and Network Effects. In Handbook of Industrial Organization. Vol. 4. Elsevier, 485–592. doi:10.1016/bs.hesind.2021.11.007 [48] Alexander S. Kelso and Vincent P. Crawford. 1982. Job Matching, Coalition Formation, and Gross Substitutes. Econometrica 50, 6 (1982), 1483–1504. doi:10.2307/1913392 [49] Lina M. Khan. 2017. Amazon’s Antitrust Paradox. Yale Law Journal 126, 3 (2017), 710–805. [50] Elias Koutsoupias and Christos Papadimitriou. 2009. Worst-case equilibria. Computer Science Review 3, 2 (2009), 65–69. doi:10.1016/j.cosrev.2009.04.003 [51] Jean-Jacques Laffont and Jean Tirole. 1993. A Theory of Incentives in Procurement and Regulation. MIT Press, Cambridge, MA. [52] Huaizhi Li and Mukesh Singhal. 2007. Trust Management in Distributed Systems . Computer 40, 02 (Feb. 2007), 45–53. doi:10.1109/MC.2007.76 [53] Lauri Lovén, Reza Farahani, Ilir Murturi, et al. 2026. Agentic Edge Intelligence: A Research Agenda. In Proceedings of the 18th IEEE/ACM International Conference on Utility and Cloud Computing (UCC ’25). Association for Computing
Credibility Trilemma in Polymatroidal Service Markets
0:61
Machinery, New York, NY, USA, Article 66, 5 pages. doi:10.1145/3773274.3777421 [54] Lauri Lovén, Mohammad Mehdi Saleh, Bahar Farahani, Ilir Murturi, Miguel Bordallo López, Praveen Kumar Donta, and Schahram Dustdar. 2026. Real-Time AI Service Economy: A Framework for Agentic Computing Across the Continuum. arXiv preprint arXiv:2603.05614 (2026). [55] R. Preston McAfee. 1992. A Dominant Strategy Double Auction. Journal of Economic Theory 56, 2 (1992), 434–450. doi:10.1016/0022-0531(92)90091-U [56] Paul Milgrom and Chris Shannon. 1994. Monotone Comparative Statics. Econometrica 62, 1 (1994), 157–180. doi:10. 2307/2951479 [57] Kazuo Murota. 2003. Discrete Convex Analysis. SIAM. doi:10.1137/1.9780898718508 [58] Roger B. Myerson. 1981. Optimal Auction Design. Mathematics of Operations Research 6, 1 (1981), 58–73. doi:10.1287/ moor.6.1.58 [59] Roger B. Myerson and Mark A. Satterthwaite. 1983. Efficient Mechanisms for Bilateral Trading. Journal of Economic Theory 29, 2 (1983), 265–281. doi:10.1016/0022-0531(83)90048-0 [60] OASIS WSBPEL TC. 2007. Web Services Business Process Execution Language Version 2.0. OASIS Standard. http: //docs.oasis-open.org/wsbpel/2.0/OS/wsbpel-v2.0-OS.html [61] James B. Orlin. 2013. Max Flows in O(nm) Time, or Better. In Proc. 45th Annual ACM Symposium on Theory of Computing (STOC). 765–774. doi:10.1145/2488608.2488705 [62] James G. Oxley. 2011. Matroid Theory (2nd ed.). Oxford Graduate Texts in Mathematics, Vol. 21. Oxford University Press. [63] Mike P. Papazoglou, Paolo Traverso, Schahram Dustdar, and Frank Leymann. 2007. Service-Oriented Computing: State of the Art and Research Challenges. Computer 40, 11 (2007), 38–45. doi:10.1109/MC.2007.400 [64] Alessandro Pavan, Ilya Segal, and Juuso Toikka. 2014. Dynamic Mechanism Design: A Myersonian Approach. Econometrica 82, 2 (2014), 601–653. doi:10.3982/ECTA10269 [65] Jean-Charles Rochet and Jean Tirole. 2003. Platform Competition in Two-Sided Markets. Journal of the European Economic Association 1, 4 (2003), 990–1029. doi:10.1162/154247603322493212 [66] Alvin E. Roth and Marilda A. O. Sotomayor. 1990. Two-Sided Matching: A Study in Game-Theoretic Modeling and Analysis. Cambridge University Press. [67] Tim Roughgarden. 2015. Intrinsic Robustness of the Price of Anarchy. J. ACM 62, 5 (2015), Article 32, 42 pages. doi:10.1145/2806883 [68] Tim Roughgarden and Éva Tardos. 2002. How Bad is Selfish Routing? J. ACM 49, 2, 236–259. doi:10.1145/506147.506153 [69] Alaa Saleh et al. 2025. Follow-Me AI: Energy-Efficient User Interaction With Smart Environments. IEEE Pervasive Computing 24, 1 (2025), 32–42. doi:10.1109/MPRV.2025.3539421 [70] Steven C. Salop. 1979. Monopolistic Competition with Outside Goods. Bell Journal of Economics 10, 1 (1979), 141–156. doi:10.2307/3003323 [71] Mahadev Satyanarayanan. 2017. The Emergence of Edge Computing. Computer 50, 1 (2017), 30–39. doi:10.1109/MC. 2017.9 [72] Alexander Schrijver. 2003. Combinatorial Optimization: Polyhedra and Efficiency. Algorithms and Combinatorics, Vol. 24. Springer. Three volumes (A, B, C). [73] Vincenzo Sciancalepore, Xavier Costa-Perez, and Albert Banchs. 2019. RL-NSB: Reinforcement Learning-Based 5G Network Slice Broker. IEEE/ACM Transactions on Networking 27, 4 (2019), 1543–1557. doi:10.1109/TNET.2019.2924471 [74] George J. Stigler. 1971. The Theory of Economic Regulation. Bell Journal of Economics and Management Science 2, 1 (1971), 3–21. doi:10.2307/3003160 [75] Steven Tadelis. 2016. Reputation and Feedback Systems in Online Platform Markets. Annual Review of Economics 8 (2016), 321–340. doi:10.1146/annurev-economics-080315-015325 [76] Hongru Tan and Julian Wright. 2018. A Price Theory of Multi-Sided Platforms: Comment. American Economic Review 108, 9 (2018), 2758–2760. doi:10.1257/aer.20171048 [77] Donald M. Topkis. 1998. Supermodularity and Complementarity. Princeton University Press, Princeton, NJ. [78] Jacobo Valdes, Robert E. Tarjan, and Eugene L. Lawler. 1982. The Recognition of Series Parallel Digraphs. SIAM J. Comput. 11, 2 (1982), 298–313. doi:10.1137/0211023 [79] William Vickrey. 1961. Counterspeculation, Auctions, and Competitive Sealed Tenders. Journal of Finance 16, 1 (1961), 8–37. doi:10.1111/j.1540-6261.1961.tb02789.x [80] Christof Weinhardt, Arun Anandasivam, Benjamin Blau, et al. 2009. Cloud Computing – A Classification, Business Models, and Research Directions. Business & Information Systems Engineering 1, 5 (2009), 391–399. doi:10.1007/s12599009-0071-2 [81] E. Glen Weyl. 2010. A Price Theory of Multi-Sided Platforms. American Economic Review 100, 4 (2010), 1642–1672. doi:10.1257/aer.100.4.1642 [82] Tim Wu. 2018. The Curse of Bigness: Antitrust in the New Gilded Age. Columbia Global Reports.
0:62
Lovén et al.
[83] Karl Wüst, Sinisa Matetic, Silvan Egli, Kari Kostiainen, and Srdjan Capkun. 2020. ACE: Asynchronous and Concurrent Execution of Complex Smart Contracts. In Proc. ACM Conference on Computer and Communications Security (CCS). 587–600. doi:10.1145/3372297.3417243 [84] Fan Zhang, Ethan Cecchetti, Kyle Croman, Ari Juels, and Elaine Shi. 2016. Town Crier: An Authenticated Data Feed for Smart Contracts. In Proc. ACM Conference on Computer and Communications Security (CCS). 270–282. doi:10.1145/ 2976749.2978326
Data and Code Availability Statement The simulator and analysis code, the YAML configuration files used to generate the three trilemmaillustration experiments of Section 4.2, the five random seeds ([17, 42, 101, 2024, 31337]), the raw experimental outputs, and the figure-generation scripts are released under the MIT licence at https://github.com/lloven/credible-marketplace-sim (tag v1.0-teac-r1, with the Git commit hash pinned in the replication package). A Zenodo DOI snapshot will be deposited at acceptance and added to this statement before final publication. Reviewers may request a private, pre-deposit copy of the artefact tarball through the editorial channel. A
Trilemma instance over the edge-pricing market of Amin et al. (2026)
A.1 Definitions and bridging lemmas for the Amin instance Definition 8 (Strategic mediator in the edge-pricing market). Let 𝐺 = (𝑉 , 𝐸) be the single source–single sink network of Amin et al. [5] with integer edge capacities (𝑞𝑒 )𝑒 ∈𝐸 and time-costs (𝑑𝑒 )𝑒 ∈𝐸 , agent set 𝑀 with affine valuation parameters (𝛼𝑚 , 𝛽𝑚 , Δ𝛼𝑚 (·), Δ𝛽𝑚 (·))𝑚∈𝑀 as in Amin’s Eq. (1), and let (𝑥 ∗, 𝑝 †, 𝜏 † ) be the VCG-equivalent market equilibrium of Amin’s Theorem 3.10. A strategic mediator deviation is a mapping 𝛿 : 𝛼𝑚 , 𝛽𝑚 , Δ𝛼𝑚 , Δ𝛽𝑚 , 𝑞𝑒 , 𝑑𝑒 𝑚∈𝑀, 𝑒 ∈𝐸 ↦−→ (𝜏 ′, 𝑝 ′, 𝑥 ′ ) such that (𝜏 ′, 𝑝 ′, 𝑥 ′ ) ≠ (𝜏 †, 𝑝 †, 𝑥 ∗ ) and the deviation is undetectable: for every agent 𝑚 ∈ 𝑀 that is ′ ′ ), the tuple allocated a trip (𝑥𝑟,𝑚 = 1 for some 𝑟 that we denote 𝑟𝑚 ′ ′ 𝑥𝑚 , 𝑝𝑚 , (𝜏𝑒′ )𝑒 ∈𝑟𝑚′ is consistent with a legitimate execution of the prescribed mechanism (Amin’s Theorem 3.10) under f ) such f −𝑚 , Δ𝛽 some alternative preference profile of the other agents—i.e., there exists (𝛼˜ −𝑚 , 𝛽˜−𝑚 , Δ𝛼 −𝑚 that, applied to the prescribed mechanism with 𝑚’s reported parameters held fixed, the legitimate run ′ , 𝑝 ′ , (𝜏 ′ ) ′ ) to agent 𝑚. Edges 𝑒 ∉ 𝑟 ′ are not part of 𝑚’s information set. delivers exactly (𝑥𝑚 𝑚 𝑒 𝑒 ∈𝑟𝑚 𝑚 Remark 26 (Information model). Definition 8 embeds the same static sealed-bid information model as Definitions 2 and 4 of the main paper, transposed to Amin’s primitives: agent 𝑚 knows only ′ , its payment 𝑝 ′ , and the announced edge prices its own preference parameters, its allocated trip 𝑥𝑚 𝑚 along its allocated route. It does not observe other agents’ parameters, the network-wide trip vector 𝑥 ′ , or edge prices off its route. We adopt Amin’s coalition-trip allocation primitive directly: undetectability ′ = 0 (no payment, no route prices). for non-allocated agents is vacuous since they observe only 𝑥𝑚 Definition 9 (Credible market eqilibrium in the edge-pricing market). Fix a remittance schedule 𝑐 = (𝑐𝑒 )𝑒 ∈𝐸 where 𝑐𝑒 : R ≥0 → R ≥0 is a publicly known mapping from announced Í edge prices ′ on to the per-edge payout Í to edge owners. The mediator collects the gross agent payments 𝑚∈𝑀 𝑝𝑚 ′ each round and remits 𝑒 ∈𝐸 𝑐𝑒 (𝜏𝑒 ) to edge owners, retaining the spread ∑︁ ∑︁ ′ 𝑅(𝛿; 𝑐) ≜ 𝑝𝑚 − 𝑐𝑒 (𝜏𝑒′ ). 𝑚∈𝑀
𝑒 ∈𝐸
A market equilibrium (𝑥 ∗, 𝑝 †, 𝜏 † ) of Amin’s Definition 2.1 is credible under remittance schedule 𝑐 if no strategic mediator deviation 𝛿 satisfies 𝑅(𝛿; 𝑐) > 𝑅(id; 𝑐) for any preference realisation in the
Credibility Trilemma in Polymatroidal Service Markets
0:63
support of the prior, where 𝑅(id; 𝑐) denotes mediator revenue under faithful execution of the prescribed VCG-equivalent equilibrium. Remark 27 (The remittance schedule is contractual, not derived from Amin’s eqilibrium definition). Amin’s budget-balance conditions (7a)–(7b) require, on each realised trip (𝑏, 𝑟 ) Í ∗ =Í ∗ with 𝑥𝑟∗ (𝑏) = 1, that the coalition’s payments cover the route’s edge prices: 𝑚∈𝑏 𝑝𝑚 𝑒 ∈𝑟 𝜏𝑒 . This is a per-trip flow-balance identity in the agent-to-mechanism direction. Amin’s Definition 2.1 is silent on the destination of payments: it does not specify whether the mediator forwards each round’s announced ′ }| to edge owners, or whether edge owners receive a contracted payout fixed in advance 𝜏𝑒′ · |{𝑚 : 𝑒 ∈ 𝑟𝑚 and the mediator retains any spread. The credibility literature, by contrast, makes this ledger explicit. Akbarpour and Li [3] model the operator’s revenue as gross collected payments minus contracted procurement cost; the operator’s deviation incentive is exactly the spread between agent inflow and committed outflow. We therefore adopt the schedule 𝑐𝑒 (·) as a primitive of the credibility regime, not derivable from Amin’s equilibrium conditions, and we test credibility against it. The next lemma classifies remittance schedules by whether the trilemma binds. It identifies the canonical settlement-separated regime as a degenerate case where credibility is restored (the Amininstance counterpart of (C0) in Proposition 5 of the main paper) and a wide class of sub-Lipschitz regimes for which the trilemma binds. Lemma 5 (Mediator-revenue regime classification). Fix the prescribed VCG-equivalent equilibrium (𝑥 ∗, 𝑝 †, 𝜏 † ) and let 𝑒 ∗ ∈ 𝐸 be a saturated edge. Two distinct flow quantities appear in the analysis and we name them explicitly to avoid the conflation flagged in C8: the agent count ∗ 𝑁 ag (𝑒 ∗ ) ≜ |{𝑚 ∈ 𝑀 : 𝑒 ∗ ∈ 𝑟𝑚 }| > 0
(the number of distinct allocated agents whose route uses 𝑒 ∗ ), and the trip count 𝑁 tr (𝑒 ∗ ) ≜ |{(𝑏, 𝑟 ) : 𝑥𝑟∗ (𝑏) = 1, 𝑒 ∗ ∈ 𝑟 }| = 𝑞𝑒 ∗ (the number of allocated trips on the saturated edge, equal to the saturation count 𝑞𝑒 ∗ by hypothesis). The two coincide in the singleton-coalition regime |𝑏 ∗ | = 1 for every realised trip, which is the generic case under Amin’s homogeneous-disutility assumption (since Δ𝛼 (1) = Δ𝛽 (1) = 0 implies coalitions form only when sharing is strictly preferred); they differ when multi-agent coalitions are allocated, with Í Í 𝑁 ag (𝑒 ∗ ) = 𝑏 ∗ |𝑏 ∗ | · 1[𝑒 ∗ ∈ 𝑟𝑏∗∗ ] and 𝑁 tr (𝑒 ∗ ) = 𝑏 ∗ 1[𝑒 ∗ ∈ 𝑟𝑏∗∗ ]. Lemma Z.0(a)’s mediator-revenue algebra uses agent-side per-agent payment increments, summed over trips and within-coalition; the aggregate is 𝑁 tr (𝑒 ∗ ) · 𝜀 via the per-trip Equation (7a) budget balance of Step 3 of Lemma 7. We adopt the trip-count convention throughout Lemma Z.0 and Theorem Z.1 (replacing the earlier 𝑁 (𝑒 ∗ ) with 𝑁 tr (𝑒 ∗ ) = 𝑞𝑒 ∗ ); the singleton-coalition special case reduces to the earlier statement under 𝑁 ag = 𝑁 tr . Let 𝛿𝜀 be the edge-price perturbation 𝜏𝑒′∗ = 𝜏𝑒†∗ +𝜀, 𝜏𝑒′ = 𝜏𝑒† for 𝑒 ≠ 𝑒 ∗ , with budget-balance-preserving Í † ′ =Í ∗ ∗ ∗ ∗ payment update at the trip level 𝑚∈𝑏 ∗ 𝑝𝑚 𝑚∈𝑏 ∗ 𝑝𝑚 + 𝜀 on every realised trip (𝑏 , 𝑟 ) with 𝑒 ∈ 𝑟 , † ′ ∗ as constructed in Lemma 7 below (the per-agent update is 𝑝𝑚 = 𝑝𝑚 + 𝜀/|𝑏 | within a multi-agent † coalition 𝑏 ∗ , reducing to 𝑝𝑚 + 𝜀 for singletons). Define the mediator marginal of the schedule on 𝑒 ∗ , Δ𝑒 ∗ (𝜀; 𝑐) ≜ 𝑅(𝛿𝜀 ; 𝑐) − 𝑅(id; 𝑐) 𝜀 = 𝑁 tr (𝑒 ∗ ) − 𝑐𝑒 ∗ (𝜏𝑒†∗ + 𝜀) − 𝑐𝑒 ∗ (𝜏𝑒†∗ ) 𝜀. (a) (Trilemma-binding class.) If 𝑐 is sub-Lipschitz at 𝜏𝑒†∗ relative to flow 𝑁 tr (𝑒 ∗ ), i.e., there exist 𝜀 0 > 0 and a constant 𝜅 < 𝑁 tr (𝑒 ∗ ) such that 𝑐𝑒 ∗ (𝜏𝑒†∗ + 𝜀) − 𝑐𝑒 ∗ (𝜏𝑒†∗ ) ≤ 𝜅 𝜀
∀ 𝜀 ∈ (0, 𝜀 0 ],
then Δ𝑒 ∗ (𝜀; 𝑐) ≥ 𝑁 tr 𝜀 strictly increases mediator revenue for every 𝜀 ∈ (0, 𝜀 0 ]. In particular, the fixed-remittance schedule 𝑐𝑒fix (𝜏𝑒′ ) ≡ 𝑐𝑒 (𝜏𝑒† ) is (𝑒 ∗ ) − 𝜅 > 0, so the perturbation deviation 𝛿
0:64
Lovén et al.
sub-Lipschitz with 𝜅 = 0, and the capped-remittance schedule 𝑐𝑒 (𝜏𝑒′ ) ≡ min(𝜏𝑒′ , 𝜏𝑒† ) · 𝑁 tr (𝑒) is sub-Lipschitz with 𝜅 = 0 on the upward direction. sep (b) (Credible (degenerate) class.) If 𝑐 is the canonical settlement-separated schedule 𝑐𝑒 (𝜏𝑒′ ) = sep ∗ ∗ ′ 𝜏𝑒 · 𝑁 tr (𝑒), then Δ𝑒 ∗ (𝜀; 𝑐 ) = 𝑁 tr (𝑒 ) − 𝑁 tr (𝑒 ) = 0 for all 𝜀, so the spread-extraction channel of the perturbation deviation closes. This is the Amin-instance counterpart of hypothesis (C0) of Proposition 5: the announced edge price flows directly through to edge owners on each trip, leaving the mediator’s books unchanged. Í ′ Í † Proof. Both parts are direct algebra. By the construction of Lemma 7, 𝑚 𝑝𝑚 − 𝑚 𝑝𝑚 = 𝜀 · 𝑁 tr (𝑒 ∗ ) via the per-trip budget-balance update of Step 3: each realised trip (𝑏 ∗, 𝑟 ∗ ) with 𝑒 ∗ ∈ 𝑟 ∗ contributes 𝜀 to the trip’s coalition-sum payment (uniformly 𝜀/|𝑏 ∗ | per agent in 𝑏 ∗ , summing to 𝜀 Í per trip), and there are 𝑁 tr (𝑒 ∗ ) = 𝑞𝑒 ∗ such trips. The remittance change is 𝑒 [𝑐𝑒 (𝜏𝑒′ ) − 𝑐𝑒 (𝜏𝑒† )] = 𝑐𝑒 ∗ (𝜏𝑒†∗ + 𝜀) − 𝑐𝑒 ∗ (𝜏𝑒†∗ ), since 𝜏𝑒′ = 𝜏𝑒† for 𝑒 ≠ 𝑒 ∗ . Substituting into the spread definition gives Δ𝑒 ∗ (𝜀; 𝑐) as stated. Part (a): under sub-Lipschitz, Δ𝑒 ∗ (𝜀; 𝑐) ≥ 𝑁 tr (𝑒 ∗ ) − 𝜅 > 0, so 𝑅(𝛿𝜀 ; 𝑐) > 𝑅(id; 𝑐). Part (b): sep sep under 𝑐 sep , 𝑐𝑒 ∗ (𝜏𝑒†∗ + 𝜀) − 𝑐𝑒 ∗ (𝜏𝑒†∗ ) = 𝑁 tr (𝑒 ∗ ) · 𝜀, exactly cancelling the agent-side increment. □ cap
Remark 28 (Working assumption for Theorem Z.1). The remainder of this appendix proves the trilemma under the fixed-remittance schedule 𝑐 fix as the operative regime. The choice is justified by three observations: (i) the credibility literature [3] models the operator’s revenue precisely as gross inflow minus contracted procurement, and the fixed-remittance schedule is the simplest schedule realising this contract structure; (ii) Amin’s Definition 2.1 does not pin the destination of payments (Remark 27), so the trilemma must be stated with respect to a chosen credibility regime; (iii) by Lemma 5(a), the conclusion is robust to the entire sub-Lipschitz class, of which 𝑐 fix is the most conservative case (𝜅 = 0); the canonical settlement-separated case 𝑐 sep (5(b)) is exactly the regime where the trilemma’s third leg is restored and is the Amin-instance counterpart of Proposition 5 of the main paper. The trilemma and the credibility-restoring proposition therefore frame two ends of a single regime classification. The next lemma supplies the explicit non-degeneracy bound on the perturbation amplitude. Lemma 6 (Walrasian price gap; explicit non-degeneracy bound). Assume the hypotheses of Amin’s Theorem 3.2 (SP network with homogeneous capacity-sharing disutility) and let (𝑥 ∗, 𝑝 †, 𝜏 † ) be the VCG-equivalent equilibrium of Theorem 3.10. Let 𝑒 ∗ ∈ 𝐸 be a saturated edge, 𝑟 ∗ ∈ 𝑅 a route through 𝑒 ∗ used in 𝑥 ∗ . Define h ∑︁ ∑︁ i † 𝜂 ≜ min ∗ 𝑢𝑚 − 𝑉𝑟 (𝑏) + 𝜏𝑒† , (9) (𝑏,𝑟 ) ∈𝐵×𝑅: 𝑥𝑟 (𝑏 )=0
𝑚∈𝑏 † 𝑢 min (𝑒 ∗ )
𝑒 ∈𝑟
† ∗ † ≜ min 𝑢𝑚 : 𝑚 ∈ 𝑀, 𝑒 ∗ ∈ 𝑟𝑚 , 𝑢𝑚 >0 .
(10)
† Then 𝜂 ≥ 0 is the smallest slack in Amin’s stability constraint (6) over unused trips, and 𝑢 min (𝑒 ∗ ) ≥ 0 is the smallest strictly-positive equilibrium utility among 𝑒 ∗ -using allocated agents. (Notation disambiguation: the scalar 𝜂 here is the stability-slack quantity of Lemma Z.0’, distinct from the peragent bid-coordinate 𝜂𝑚,𝑙 ∗ = 𝛼𝑚 − 𝛽𝑚𝑑𝑟 ∗ that appears with subscripts in the proof of Lemma 7 Step 4; the two share the letter 𝜂 by Amin-source convention but never appear without their distinguishing context.) Setting † 𝜀¯ ≜ min 𝜂, 𝑢 min (𝑒 ∗ ) ,
we have 𝜀¯ > 0 on a Lebesgue-positive-measure subset of priors satisfying: • Strict primal slack. The integer optimum 𝑥 ∗ is the unique solution of (LP𝑘 ∗ ) (Amin Lemma 3.9) up to the representative-coalition tie-breaking; equivalently, for every unused trip (𝑏, 𝑟 ) ∉ 𝑥 ∗ , the dual constraint (D𝑘 ∗ .a) of Amin is strictly slack at the optimum.
Credibility Trilemma in Polymatroidal Service Markets
0:65
† • Strict dual slack. The minimum equilibrium utility 𝑢 min (𝑒 ∗ ) > 0 holds whenever the bid∗ coordinate of every 𝑒 -using agent lies strictly above the minimum bid threshold for which the agent retains a positive equilibrium utility, which holds Lebesgue-almost-everywhere on the prior support by full-support of the marginals. Furthermore, 𝜀¯ is the Walrasian-price gap: it is the largest scalar such that, for every 𝜀 ∈ (0, 𝜀¯), the perturbed price vector 𝜏 ′ defined in Lemma 7 below remains in the polytope of equilibrium-supporting edge-price vectors of Amin’s dual program (D), with the same primal allocation 𝑥 ∗ and the same agent † utilities (𝑢𝑚 )𝑚∉{𝑚:𝑒 ∗ ∈𝑟𝑚∗ } for all agents not using 𝑒 ∗ . † Proof. Both 𝜂 and 𝑢 min (𝑒 ∗ ) are minima over finite sets and so are well defined; non-negativity † of 𝜂 follows from Amin’s stability (6) at 𝜏 † , and non-negativity of 𝑢 min (𝑒 ∗ ) from individual rationality (5). Strict positivity is generic. Both quantities are continuous functions of the bid coordinate vector (𝛼𝑚 , 𝛽𝑚 )𝑚∈𝑀 on the open set where the VCG-equivalent allocation 𝑥 ∗ is locally constant (which is open and full-measure on any non-degenerate prior, by the polyhedral structure of the LP optimum and the integrality of 𝑥 ∗ on the Theorem 3.2 regime). On this open set, 𝜂 = 0 defines a closed semi-algebraic subset of codimension at least one (it is the locus where some unused-trip stability † constraint binds, a finite union of hyperplanes in bid space), and similarly 𝑢 min (𝑒 ∗ ) = 0 defines a ∗ codimension-≥ 1 subset (where some allocated 𝑒 -using agent’s utility hits zero). The complement is full Lebesgue measure on each marginal’s support, and by independence of the marginals, full measure jointly. Hence 𝜀¯ > 0 Lebesgue-almost-everywhere on the prior. Walrasian-price-gap interpretation. The polytope of equilibrium-supporting edge-price vectors † at fixed allocation 𝑥 ∗ and fixed utilities (𝑢𝑚 ) is the dual feasible region of (D𝑘 ∗ ) at the optimal † ∗ 𝑢 ; on the saturated edge 𝑒 , raising 𝜏𝑒 ∗ above 𝜏𝑒†∗ tightens the unused-trip constraints (D𝑘 ∗ .a) on every trip (𝑏, 𝑟 ) with 𝑒 ∗ ∈ 𝑟 , 𝑥𝑟∗ (𝑏) = 0. The maximum scalar 𝜀 for which all such constraints remain feasible is exactly 𝜂. Simultaneously, raising the 𝑒 ∗ -using agents’ payments by 𝜀 (Lemma 7, Step 3) reduces their equilibrium utilities by 𝜀; individual rationality (5) constrains the increment by † 𝑢 min (𝑒 ∗ ). Both bounds are tight by construction: at 𝜀 = 𝜂 some unused-trip constraint exactly binds † (a measure-zero degeneracy event); at 𝜀 = 𝑢 min (𝑒 ∗ ) some allocated agent’s IR exactly binds. □
Remark 29 (Discrete Walrasian-price ladder under genericity). A complementary interpretation of 𝜀¯ is the Walrasian price-ladder gap of Amin’s auxiliary economy: by Lemma 3.8 (GS structure) and Lemma B.3 (the lattice of Walrasian equilibrium prices) [40], when the prior support has full Lebesgue measure on a connected interval, the Walrasian-price ladder ∗ 𝜏𝑒 (𝑀 ∪ {𝑚 ′ }) : 𝑚 ′ ∉ 𝑀, 𝜏𝑒∗ (𝑀 ∪ {𝑚 ′ }) > 𝜏𝑒∗ (𝑀) has a strictly positive smallest gap, which equals 𝜀¯ on a positive-measure event. We use this ladder interpretation in Step 4 of the proof of Lemma 7 as the constructive witness of synthetic-agent existence. Lemma 7 (Edge-price perturbation in SP networks under homogeneous disutility). Assume the hypotheses of Amin’s Theorem 3.2: 𝐺 is series–parallel and the capacity-sharing disutility parameters are homogeneous, so that Δ𝛼𝑚 (|𝑏 |) = Δ𝛼 (|𝑏 |) and Δ𝛽𝑚 (|𝑏 |) = Δ𝛽 (|𝑏 |) for all 𝑚 ∈ 𝑀, |𝑏| = 2, . . . , 𝐴. Let (𝑥 ∗, 𝑝 †, 𝜏 † ) be the VCG-equivalent equilibrium of Amin’s Theorem 3.10 on a nonÍ degenerate preference profile, by which we mean: (i) the social welfare 𝑆 (𝑥 ∗ ) = (𝑏,𝑟 ) 𝑉𝑟 (𝑏)𝑥𝑟∗ (𝑏) > 0; (ii) there exists at least one saturated edge 𝑒 ∗ ∈ 𝐸 at which the market-clearing constraint binds, Í † ∗ (𝑏,𝑟 ): 𝑒 ∗ ∈𝑟 𝑥𝑟 (𝑏) = 𝑞𝑒 ∗ , and consequently 𝜏𝑒 ∗ > 0 in the minimum-edge-price equilibrium of The† orem 3.10; (iii) 𝜀¯ = min(𝜂, 𝑢 min (𝑒 ∗ )) > 0 in the sense of Lemma 6. Let the prior on (𝛼𝑚 , 𝛽𝑚 )𝑚∈𝑀 have full Lebesgue support on a connected interval containing (𝛼𝑚 , 𝛽𝑚 ) for every 𝑚 ∈ 𝑀. Then for
0:66
Lovén et al.
every 𝜀 ∈ (0, 𝜀¯) (the open interval; the closed right endpoint 𝜀 = 𝜀¯ is excluded because at 𝜀¯ either the unused-trip stability constraint or some allocated agent’s IR exactly binds, a measure-zero degeneracy event), the perturbed price vector ( 𝜏𝑒† + 𝜀, 𝑒 = 𝑒 ∗, 𝜏𝑒′ = 𝜏𝑒†, 𝑒 ≠ 𝑒∗ satisfies the following three properties: (L1) Equilibrium preservation. (𝑥 ∗, 𝑝 ′, 𝜏 ′ ) is a market equilibrium in the sense of Amin’s Defini′ = 𝑝 † + 𝜀 · 1[𝑒 ∗ ∈ 𝑟 ∗ ] for each agent 𝑚 allocated to a trip on route 𝑟 ∗ in tion 2.1, where 𝑝𝑚 𝑚 𝑚 𝑚 ′ = 𝑝 † = 0 otherwise. In particular, individual rationality (5), stability (6), budget 𝑥 ∗ , and 𝑝𝑚 𝑚 balance (7a)–(7b), and market clearing (8) all continue to hold for the same trip allocation 𝑥 ∗ . (L2) Linear payment increment, stated per trip. For every realised trip (𝑏 ∗, 𝑟 ∗ ) with 𝑥𝑟∗∗ (𝑏 ∗ ) = 1 Í ′ − 𝑝 † ) = 𝜀. Per and 𝑒 ∗ ∈ 𝑟 ∗ , the coalition’s aggregate payment increment is 𝑚∈𝑏 ∗ (𝑝𝑚 𝑚 ∗ agent within a coalition, the increment is 𝜀/|𝑏 | (uniformly distributed across the coalition’s ′ − 𝑝 † = 𝜀 in members to preserve Equation (7a) trip-level budget balance), reducing to 𝑝𝑚 𝑚 ∗ the singleton-coalition regime |𝑏 | = 1 that is generic under Amin’s homogeneous disutility (Δ𝛼 (1) = Δ𝛽 (1) = 0 implies coalitions form only when sharing is strictly preferred). For ′ = 𝑝 † for every 𝑚 ∈ 𝑏 ∗ . The aggregate change in every realised trip (𝑏 ∗, 𝑟 ∗ ) with 𝑒 ∗ ∉ 𝑟 ∗ , 𝑝𝑚 𝑚 Í ′ − 𝑝 † ) = 𝜀 · 𝑁 (𝑒 ∗ ) = 𝜀 · 𝑞 ∗ via the per-trip identity, mediator-side gross inflow is 𝑚 (𝑝𝑚 tr 𝑒 𝑚 regardless of coalition size. (L3) Undetectability. The deviation 𝛿 : (𝛼, 𝛽, Δ, . . . ) ↦→ (𝜏 ′, 𝑝 ′, 𝑥 ∗ ) is undetectable in the sense ′ , 𝑝 ′ , (𝜏 ′ ) ∗ ) is consistent with a legitimate of Definition 8: each agent’s observation (𝑥𝑚 𝑚 𝑒 𝑒 ∈𝑟𝑚 execution of Amin’s Theorem 3.10 under some alternative preference profile of the other agents. The bound 𝜀¯ is the explicit Walrasian-price gap of Lemma 6. Proof. We proceed in four steps. Steps 1–3 establish (L1) and (L2); Step 4 establishes (L3). Step 1: 𝑥 ∗ remains feasible and primal-optimal under 𝜏 ′ . Feasibility (3a)–(3c) of 𝑥 ∗ is a property of the trip vector alone; it does not involve prices, so 𝑥 ∗ remains feasible under any 𝜏 ′ ≥ 0. By Amin’s Theorem 3.10 and the homogeneity hypothesis, 𝑥 ∗ is the integer optimum of (LP𝑘 ∗ ) via ¯ of Amin’s Equation (14), which depends only on (𝛼𝑚 , 𝛽𝑚 ) the augmented value function 𝑉¯𝑟 (𝑏) and the homogeneous (Δ𝛼, Δ𝛽), not on 𝜏. Hence 𝑥 ∗ is the welfare-maximising integer allocation independent of the edge-price vector. We will use 𝜏 ′ only to verify the equilibrium conditions. Step 2: Stability and IR hold for every 𝜀 ∈ (0, 𝜀¯). Recall Amin’s stability constraint (6): for every (𝑏, 𝑟 ) ∈ 𝐵 × 𝑅, ∑︁ ∑︁ ∗ 𝑢𝑚 ≥ 𝑉𝑟 (𝑏) − 𝜏𝑒∗ . 𝑚∈𝑏
𝑒 ∈𝑟
′ = 𝑢 † − 𝜀 · 1[𝑒 ∗ ∈ 𝑟 ∗ ] for every allocated agent 𝑚 (the IR-consistent utility update; we verify Set 𝑢𝑚 𝑚 𝑚 ′ is the corresponding payment), and 𝜏 ′ as defined in the statement. For used trips in Step 3 that 𝑝𝑚 Í ∗ ] = 𝜀 · |𝑏 ∗ | (where (𝑏 ∗, 𝑟 ∗ ) with 𝑥𝑟∗∗ (𝑏 ∗ ) = 1: if 𝑒 ∗ ∈ 𝑟 ∗ , the LHS of (6) drops by 𝑚∈𝑏 ∗ 𝜀 · 1[𝑒 ∗ ∈ 𝑟𝑚 ∗ for all 𝑚 ∈ 𝑏 ∗ , giving |𝑏 ∗ | summands), and the RHS of (6) drops every 𝑚 ∈ 𝑏 ∗ uses 𝑟 ∗ , hence 𝑒 ∗ ∈ 𝑟𝑚 by 𝜀 (only edge 𝑒 ∗ ’s price changes); since |𝑏 ∗ | ≥ 1, the LHS drops by at least the RHS drop, so (6) is preserved. If 𝑒 ∗ ∉ 𝑟 ∗ , both sides are unchanged and (6) is preserved trivially. For unused trips (𝑏, 𝑟Í) with 𝑥𝑟∗ (𝑏) = 0: if 𝑒 ∗ ∈ 𝑟 , the LHS of (6) is unchanged from the prescribed ′ depends only on 𝑢 ′ for 𝑚 ∈ 𝑏, and only the 𝑒 ∗ -using allocated equilibrium (the sum 𝑚∈𝑏 𝑢𝑚 𝑚 agents have their utility decremented; an unused trip’s coalition is generically disjoint from the ′ = 𝑢 † − 𝜀 · 1[𝑒 ∗ ∈ 𝑟 ∗ ] leaves 𝑢 ′ = 𝑢 † for 𝑚 ∉ 𝑏 ∗ on a allocated 𝑒 ∗ -users, and the utility update 𝑢𝑚 𝑚 𝑚 𝑚 𝑚
Credibility Trilemma in Polymatroidal Service Markets
0:67
positive-measure event), while the RHS drops by 𝜀. Since the unused trip’s slack at 𝜏 † is at least 𝜂 by (9) and 𝜀 ≤ 𝜂, the LHS–RHS gap remains non-negative, so (6) is preserved. If 𝑒 ∗ ∉ 𝑟 , both sides are unchanged. (The genericity assumption that unused-trip coalitions are disjoint from allocated † † 𝑒 ∗ -users is needed only when an agent 𝑚 ∈ 𝑏 ∗ has 𝑢𝑚 = 𝑢 min (𝑒 ∗ ) exactly, a measure-zero event.) ′ ≥ 0 for every allocated agent. By construction, 𝑢 ′ = 𝑢 † ≥ 0 Individual rationality (5) requires 𝑢𝑚 𝑚 𝑚 † † † ∗ ∗ ′ for 𝑚 ∉ {𝑚 : 𝑒 ∈ 𝑟𝑚 }, and 𝑢𝑚 = 𝑢𝑚 − 𝜀 ≥ 𝑢𝑚 − 𝑢 min (𝑒 ∗ ) ≥ 0 for 𝑚 allocated through 𝑒 ∗ , by † definition of 𝑢 min (𝑒 ∗ ) in (10). Í ′ = Í ′ Step 3: Budget balance and market clearing. Budget balance (7a) requires 𝑚∈𝑏 𝑝𝑚 𝑒 ∈𝑟 𝜏𝑒 Í Í † † ∗ for every realised trip (𝑏, 𝑟 ) with 𝑥𝑟 (𝑏) = 1. Under faithful execution, 𝑚∈𝑏 ∗ 𝑝𝑚 = 𝑒 ∈𝑟 ∗ 𝜏𝑒 for each realised trip (𝑏 ∗, 𝑟 ∗ ). Under the perturbation, both sides update at the trip level: the RHS rises by 𝜀 exactly on those realised trips with 𝑒 ∗ ∈ 𝑟 ∗ . To preserve (7a) exactly, the prescribed update Í † ′ = Í ∗ ∗ ∗ is the trip-level identity 𝑚∈𝑏 ∗ 𝑝𝑚 𝑚∈𝑏 ∗ 𝑝𝑚 + 𝜀 for every 𝑒 -using trip (𝑏 , 𝑟 ), distributed † ′ ∗ within the coalition as 𝑝𝑚 = 𝑝𝑚 + 𝜀/|𝑏 | (uniform within-coalition split, the natural choice under homogeneous disutility); the trip-level statement (L2) captures this directly. The singleton-coalition ′ − 𝑝 † = 𝜀 in the original lemma form; for regime |𝑏 ∗ | = 1 recovers the per-agent statement 𝑝𝑚 𝑚 multi-agent coalitions, the per-agent increment is 𝜀/|𝑏 ∗ |, and the per-trip increment remains 𝜀. Í ′ − 𝑝 † ) = 𝜀 · 𝑁 (𝑒 ∗ ) = 𝜀 · 𝑞 ∗ where 𝑁 (𝑒 ∗ ) is the The aggregate gross inflow change is 𝑚 (𝑝𝑚 tr 𝑒 tr 𝑚 trip count (per the disambiguation of Lemma Z.0). Property (L2) as restated above is the trip-level statement and is the form used in the Theorem Z.1 Step 2 revenue computation. Equation (7b) is ′ = 0 for non-allocated agents. Market clearing (8): the saturated edge 𝑒 ∗ preserved trivially since 𝑝𝑚 Í ∗ has (𝑏,𝑟 ):𝑒 ∗ ∈𝑟 𝑥𝑟 (𝑏) = 𝑞𝑒 ∗ by hypothesis (ii), so 𝜏𝑒′∗ = 𝜏𝑒†∗ + 𝜀 > 0 is consistent with (8); for 𝑒 ≠ 𝑒 ∗ Í with (𝑏,𝑟 ):𝑒 ∈𝑟 𝑥𝑟∗ (𝑏) < 𝑞𝑒 , we have 𝜏𝑒′ = 𝜏𝑒† = 0 by Theorem 3.10’s minimum-edge-price property and (8); for unsaturated 𝑒 ≠ 𝑒 ∗ this is unchanged. This establishes (L1) and (L2). Step 4: Undetectability via Amin’s auxiliary economy and the Walrasian-price lattice. We construct an alternative preference profile 𝑃˜−𝑚 (of all agents other than the agent 𝑚 whose perspective we test) under which the prescribed mechanism, executed faithfully, would deliver exactly the ∗ , 𝑝 ′ , (𝜏 ′ ) ∗ ) to agent 𝑚. perturbed observation (𝑥𝑚 𝑚 𝑒 𝑒 ∈𝑟𝑚 Setup via Amin’s auxiliary economy (Appendix B). Recall Amin’s auxiliary economy [5, Appendix B]: each unit-of-capacity slot 𝑙 ∈ 𝐿𝑟 on each route 𝑟 ∈ 𝑅 ∗ is treated as a buyer (Amin Def. B.1) ¯ defined in Amin whose valuation for the bundle 𝑏¯ of agents is the augmented value function 𝑉¯𝑙 (𝑏) ∗ ) Eq. (14)/(23). Walrasian equilibrium prices 𝑢 ∗ = (𝑢𝑚 are placed on agents (the indivisible 𝑚∈𝑀 goods), not on slots, with the Walrasian condition [5, Def. B.1(i)]: ∑︁ ∗ ¯ − 𝑏¯𝑙 ∈ arg max 𝑉¯𝑙 (𝑏) 𝑢𝑚 ∀ 𝑙 ∈ 𝐿, 𝑥¯𝑙∗ (𝑏¯𝑙 ) = 1. 𝑏¯ ∈ 𝐵¯
𝑚∈𝑏¯
Edge prices 𝜏 enter Í through the dual program (D) of the original LP via the slot/route price 𝜆𝑟∗ , ∗ decomposed as 𝜆𝑟 = 𝑒 ∈𝑟 𝜏𝑒∗ . The set of Walrasian equilibrium agent-price vectors 𝑈 ∗ is a non-empty lattice with maximum element 𝑢 † (Amin Lemma B.3, citing Gul–Stacchetti [40]); correspondingly, the set of equilibrium edge-price vectors 𝑇 ∗ at fixed allocation 𝑥 ∗ and fixed utilities 𝑢 † is a non-empty polyhedron in the dual (D), and 𝜏 † is its minimum-total-edge-price element (Theorem 3.10). Constructive synthetic agent. Let the agent 𝑚 whose perspective we test be allocated through 𝑒 ∗ ∗ ∋ 𝑒 ∗ ; let 𝑏 ∗ be its coalition (possibly {𝑚}). We construct an additional hypothetical on route 𝑟𝑚 𝑚 ˜ in the prior support such that, when the prescribed ˜ 𝛽) agent 𝑚˜ ∉ 𝑀 with preference parameters (𝛼, ˜ the resulting Walrasian equilibrium mechanism is run faithfully on the augmented agent set 𝑀∪{𝑚}, † ∗ ∗ ˜ = 𝜏𝑒 ∗ + 𝜀 with the same allocation 𝑥 to the original agents. yields 𝜏𝑒 ∗ (𝑀 ∪ {𝑚})
0:68
Lovén et al.
The construction proceeds by a marginal-bidder argument on the auxiliary economy. Let 𝑙 ∗ ∈ 𝐿𝑟 ∗ be a unit-capacity slot on the saturated edge 𝑒 ∗ , and let ℎ𝑙 ∗ = 𝑏¯𝑙 ∗ be the representative coalition assigned to 𝑙 ∗ in the prescribed equilibrium (Amin Eq. (14)). The slot 𝑙 ∗ ’s Walrasian valuation is ¯ =Í ¯ 𝑉¯𝑙 ∗ (𝑏) 𝑚∈ℎ𝑙 ∗ (𝑏¯ ) 𝜂𝑚,𝑙 ∗ − 𝜉𝑙 ∗ (|ℎ𝑙 ∗ (𝑏)|) in Amin’s Eq. (23) decomposition, where 𝜂𝑚,𝑙 ∗ = 𝛼𝑚 − 𝛽𝑚 𝑑𝑟 ∗ is the agent’s slot-specific bid coordinate. ByÍAmin’s Algorithm 2 / Lemma B.4 (Kelso–Crawford ascent [48]), the slot’s Walrasian price 𝜆𝑙∗∗ = 𝑒 ∈𝑟 ∗ 𝜏𝑒∗ equals the marginal-bidder threshold 𝜂𝑚,𝑙 ˆ ∗ − 𝜉𝑙 ∗ (|ℎ𝑙 ∗ | + 1) + 𝜉𝑙 ∗ (|ℎ𝑙 ∗ |), where 𝑚ˆ is the maximally-marginal-rejected agent under the current bid profile. Now insert a hypothetical agent 𝑚˜ with bid coordinate 𝜂𝑚,𝑙 ˜ ∗ ∈ (𝜂𝑚,𝑙 ˆ ∗ , 𝜂𝑚 min ,𝑙 ∗ ), where 𝑚 min ∈ ℎ𝑙 ∗ is the lowest-bid member of the representative coalition. By the Kelso–Crawford ascending-bid ˜ insertion raises the marginal-bidder threshold on 𝑙 ∗ from construction [48] (Amin Lemma B.4), 𝑚’s ˜ is now the maximally-marginal-rejected agent, 𝜂𝑚,𝑙 ˆ ∗ (with the original profile) to 𝜂𝑚,𝑙 ˜ ∗ (where 𝑚 by construction), while the representative coalition ℎ𝑙 ∗ remains the allocated bundle for slot 𝑙 ∗ ∗ (since 𝜂𝑚,𝑙 ˜ ∗ < 𝜂𝑚 min ,𝑙 ∗ ). The slot Walrasian ˜ ∗ − 𝜂𝑚,𝑙 ˆ ∗ > 0, and Íprice ∗update is therefore Δ𝜆𝑙 ∗ = 𝜂𝑚,𝑙 ∗ via the route-price decomposition 𝜆𝑟 ∗ = 𝑒 ∈𝑟 ∗ 𝜏𝑒 together with Theorem 3.10’s minimum-edgeprice selection (which assigns the price increment to the saturated edge 𝑒 ∗ , since unsaturated edges retain 𝜏𝑒† = 0 by (8)), the edge-price update on 𝑒 ∗ is Δ𝜏𝑒∗∗ = Δ𝜆𝑙∗∗ = 𝜂𝑚,𝑙 ˜ ∗ − 𝜂𝑚,𝑙 ˆ ∗ . The ∗ ˜ ˜ ↦→ ˜ 𝛽) ↦→ Δ𝜏𝑒 ∗ is therefore the continuous, monotone-non-decreasing affine map (𝛼, ˜ 𝛽) map (𝛼, ˜ 𝜂𝑚,𝑙 ˆ ) − ( 𝛽 − 𝛽𝑚 ˆ )𝑑𝑟 ∗ on the open bid-coordinate set (𝜂𝑚,𝑙 ˜ ∗ − 𝜂𝑚,𝑙 ˆ ∗ = (𝛼˜ − 𝛼𝑚 ˆ ∗ , 𝜂𝑚 min ,𝑙 ∗ ). Continuity of the Walrasian-price-as-function-of-buyer-set map on this open set is supplied by Lemma B.4 of Amin (constructively, via the Kelso–Crawford ascending-bid Algorithm 2) combined with the lattice property of Walrasian-equilibrium prices [40] (Amin Lemma B.3); discrete-convexity refinements (cited as reference [35] of Amin [5]) supply the modulus of continuity but our argument requires ˜ parameters is non-empty: by (9) the slack on only continuity. The non-displacement region of 𝑚’s ∗ every unused trip is at least 𝜂 > 0, so any 𝑚˜ with 𝜂𝑚,𝑙 ˜ ∗ − 𝜂𝑚,𝑙 ˆ ∗ ≤ 𝜂 leaves 𝑥 as the integer optimum ˜ ↦→ Δ𝜏 ∗∗ on ˜ By the intermediate-value theorem applied to the continuous map (𝛼, ˜ 𝛽) on 𝑀 ∪ {𝑚}. 𝑒 ˜ the open interval (𝜂𝑚,𝑙 ˆ ∗ , 𝜂𝑚,𝑙 ˆ ∗ + 𝜂), for every 𝜀 ∈ (0, 𝜀¯) ⊆ (0, 𝜂] there exists a witness (𝛼˜ 𝜀 , 𝛽𝜀 ) in the prior support (which has full Lebesgue measure on a connected interval containing (𝛼𝑚ˆ , 𝛽𝑚ˆ ) by hypothesis) yielding Δ𝜏𝑒∗∗ = 𝜀 exactly. Verifying agent 𝑚’s observation is consistent. Under the prescribed mechanism on 𝑀 ∪ {𝑚˜ 𝜀 }: ∗ (unchanged, since 𝑚 ˜ 𝜀 does not displace 𝑥 ∗ ); • agent 𝑚’s allocation is 𝑥𝑚 † † ∗ , 𝑝 otherwise (by the budget-balance update of • agent 𝑚’s payment is 𝑝𝑚 + 𝜀 if 𝑒 ∗ ∈ 𝑟𝑚 𝑚 Step 3, applied to the augmented mechanism); ∗ are 𝜏 † for 𝑒 ≠ 𝑒 ∗ and 𝜏 † + 𝜀 for 𝑒 = 𝑒 ∗ . • the announced edge prices on 𝑟𝑚 𝑒 𝑒∗ ′ , 𝑝 ′ , (𝜏 ′ ) ∗ ) exactly. The deviation is therefore consisThis matches the deviation observation (𝑥𝑚 𝑚 𝑒 𝑒 ∈𝑟𝑚 tent with the legitimate execution of the prescribed mechanism on the alternative profile 𝑀 ∪ {𝑚˜ 𝜀 } — formally, on the profile that agrees with the original on 𝑀 and adds 𝑚˜ 𝜀 in place of one of 𝑚’s coalition partners or a generic non-allocated coalition member, depending on coalition structure ∗ | = 1, which is the generic regime under homogeneity; (the substitution is straightforward when |𝑏𝑚 the multi-agent-coalition case is handled by the same construction applied at the slot level). By the safe-deviation criterion of Akbarpour–Li [3], the operator’s announcement (𝜏 ′, 𝑝 ′ ) lies in the support of an honest execution under a legitimate alternative preference profile, so the deviation is undetectable. † Where the bound 𝜀¯ = min(𝜂, 𝑢 min (𝑒 ∗ )) enters. The intermediate-value-theorem argument requires ∗ 𝜀 ≤ 𝜂 to keep 𝑥 as the integer optimum on the augmented agent set; the IR constraint of Step 2 † requires 𝜀 ≤ 𝑢 min (𝑒 ∗ ). Both are tight: at 𝜀 = 𝜂, some unused trip’s stability constraint exactly binds,
Credibility Trilemma in Polymatroidal Service Markets
0:69
† an event of measure zero on the prior; at 𝜀 = 𝑢 min (𝑒 ∗ ), some allocated agent’s IR exactly binds, similarly measure-zero. Within (0, 𝜀¯), both are slack.
Conclusion. Steps 1–3 establish (L1) and (L2); Step 4 establishes (L3). The bound 𝜀¯ is the explicit Walrasian-price gap of Lemma 6. Where homogeneity is used: the GS structure of 𝑉¯𝑟 in Step 4 is the conclusion of Amin’s Lemma 3.8, which requires homogeneous (Δ𝛼, Δ𝛽). Heterogeneous capacity-sharing disutility breaks Lemma 3.8 (Amin’s Example 3.4 documents this on a parallel network), the auxiliary economy ceases to be Walrasian-tractable, the synthetic-agent construction fails to be supported by a legitimate 𝑚˜ 𝜀 in the prior support (the marginal-bidder calculation of the auxiliary economy becomes non-monotone), and the perturbation cannot be hidden behind a coalition-insertion alibi. We do not claim Lemma Z.1 in any heterogeneous regime. □ A.2
Trilemma instance over Amin et al. (2026)
Theorem 10 (Trilemma instance over the Amin edge-pricing market). Let 𝐺 = (𝑉 , 𝐸) be a series–parallel single-source single-sink network with positive integer edge capacities (𝑞𝑒 )𝑒 ∈𝐸 and edge time-costs (𝑑𝑒 )𝑒 ∈𝐸 , and let 𝑀 be a finite agent set with affine valuations under homogeneous capacity-sharing disutility (Amin’s Equation (1) with Δ𝛼𝑚 ≡ Δ𝛼, Δ𝛽𝑚 ≡ Δ𝛽). Suppose the prior distribution over (𝛼𝑚 , 𝛽𝑚 )𝑚∈𝑀 is product-form with each marginal regular in the Myerson sense [58] and non-degenerate (each marginal has support of positive Lebesgue measure on a connected interval, and the joint distribution induces a non-degenerate equilibrium in the sense of Lemma 6 with positive probability). Fix the fixed-remittance schedule 𝑐 fix of Remark 28 (or any sub-Lipschitz schedule of Lemma 5(a)). Then no homogeneous-edge-pricing market mediator on 𝐺 is simultaneously: (i) Revenue-optimal in expectation. Maximising E (𝛼,𝛽 ) 𝑅(id; 𝑐 fix ) over the class of dominantstrategy incentive-compatible mechanisms that induce a market equilibrium (𝑥 ∗, 𝑝, 𝜏) in the sense of Amin’s Definition 2.1; (ii) DSIC for agents. Truthful reporting of (𝛼𝑚 , 𝛽𝑚 ) is a dominant strategy for every agent; (iii) Credible in the realisation-wise sense of Definition 9 under 𝑐 fix : no profitable undetectable strategic mediator deviation exists for any (𝛼, 𝛽) realisation in the support. Proof. We proceed in three steps. The argument parallels Step 1–Step 3 of the proof of Theorem 1 of the main paper, transposed to Amin’s edge-pricing primitives via Lemma 7. Step 1: Identifying the unique candidate mechanism. On the SP network with homogeneous disutility, Amin’s Theorem 3.2 establishes existence and polytime computability of a market equilibrium, and Amin’s Theorem 3.10 identifies a particular equilibrium (𝑥 ∗, 𝑝 †, 𝜏 † ) as VCG† ∗ for any equivalent: it maximises every agent’s utility among all market equilibria (so 𝑢𝑚 ≥ 𝑢𝑚 Í ∗ ∗ ∗ other equilibrium (𝑥 , 𝑝 , 𝜏 )), and it minimises the total edge price 𝑒 𝑞𝑒 𝜏𝑒 . Theorem 3.10 also establishes that (𝑥 ∗, 𝑝 †, 𝜏 † ) is strategy-proof (the VCG payment rule of Amin’s Equation (17) is the standard Vickrey–Clarke–Groves payment, which is dominant-strategy incentive-compatible by the classical theory [48, 58]). By Myerson’s characterisation [58], applied to the single-parameter quasi-linear setting after ¯ (whose monotonicmarginalising the joint (𝛼𝑚 , 𝛽𝑚 ) along the priority order induced by 𝑉¯𝑟 (𝑏) ity and GS structure under homogeneity are established in Amin’s Lemma 3.8), the revenueoptimal DSIC mechanism inducing a market equilibrium maximises the (ironed) virtual welfare Í ¯ 𝜑 (𝑏) 𝑉¯𝑟 (𝑏)𝑥𝑟 (𝑏) subject to feasibility (3a)–(3c). On SP networks with homogeneous disutility, (𝑏,𝑟 ) the auxiliary-economy reduction of Amin [5, §3.1, Appendix B] reduces this to a Walrasianequilibrium problem on indivisible goods, and the unique strategyproof market equilibrium that
0:70
Lovén et al.
implements this welfare-maximising allocation within the class of mechanisms that induce a Definition 2.1 equilibrium is the VCG-equivalent equilibrium (𝑥 ∗, 𝑝 †, 𝜏 † ) of Theorem 3.10, up to tie-breaking on measure-zero parameter sets where the priority order is not strict. So the unique candidate satisfying both (i) and (ii) within this class is the Amin VCG-equivalent equilibrium with a Myersonian-virtual-value substitution; we denote this candidate M ★. We now apply Lemma 7 to show M ★ violates (iii). Step 2: Constructing an undetectable, profitable mediator deviation. By non-degeneracy of the prior, the event “(𝛼, 𝛽) realises a non-degenerate preference profile in the sense of Lemma 7” has positive probability. We establish positive measure of saturation explicitly: under hypotheses (i)–(iii) of Theorem 10, the joint prior is product-form with full Lebesgue support on a connected interval, so for any threshold 𝛼¯ ∈ supp(𝐹𝛼 ) in the interior, the event {𝑚 : 𝛼𝑚 ≥ 𝛼¯ } has cardinality ≥ ⌈𝜌 |𝑀 |⌉ with positive probability for every 𝜌 ∈ [0, 1] by theÍlaw of large numbers and full support. ¯ exceeds the network’s Choosing 𝛼¯ large enough that the aggregate desired flow 𝑚 1[𝛼𝑚 ≥ 𝛼] min-cut min𝐶 cap(𝐶) gives a positive-probability event on which at least one edge is saturated (by the max-flow / min-cut duality); the saturation event is therefore positive-measure with bound at least Pr[#{𝑚 : 𝛼𝑚 ≥ 𝛼¯ } ≥ min𝐶 cap(𝐶) + 1] > 0. Then: the social welfare 𝑆 (𝑥 ∗ ) is positive on this ¯ the existence event (the welfare-maximising allocation has at least one allocated trip with 𝛼𝑚 ≥ 𝛼); of at least one saturated edge holds by construction; and the explicit non-degeneracy bound 𝜀¯ > 0 of Lemma 6 holds Lebesgue-almost-everywhere within this event by genericity of the prior. On every realisation in this positive-measure event, Lemma 7 produces a saturated edge 𝑒 ∗ and a perturbation 𝜏 ′ = 𝜏 † + 𝜀 1 {𝑒 ∗ } for some 𝜀 ∈ (0, 𝜀¯) such that (𝑥 ∗, 𝑝 ′, 𝜏 ′ ) is a market equilibrium in Amin’s sense, the perturbation increases each 𝑒 ∗ -using trip’s budget-balanced payment by exactly 𝜀 (with 𝑁 tr (𝑒 ∗ ) = 𝑞𝑒 ∗ trips on the saturated edge, per Lemma Z.0 disambiguation), and the deviation is undetectable in the sense of Definition 8. The mediator’s revenue change under this deviation, in the regime of Definition 9 under the fixed-remittance schedule 𝑐 fix of Remark 28, is, by Lemma 5(a) with 𝜅 = 0, 𝑅(𝛿𝜀 ; 𝑐 fix ) − 𝑅(id; 𝑐 fix ) = 𝜀 · 𝑁 tr (𝑒 ∗ ) = 𝜀 · 𝑞𝑒 ∗ > 0 for every 𝜀 ∈ (0, 𝜀¯). The deviation is strictly profitable. By the regime classification (Lemma 5(a)), the same conclusion holds for every sub-Lipschitz schedule with 𝜅 < 𝑁 tr (𝑒 ∗ ), with revenue change 𝜀 · (𝑁 tr (𝑒 ∗ ) − 𝜅) > 0. This contradicts credibility (Definition Z.2): on a positive-measure set of preference realisations, an undetectable, strictly profitable mediator deviation exists. Step 3: Conclusion. The unique candidate mechanism satisfying (i) and (ii)—the Myersonsubstituted VCG-equivalent equilibrium M ★ of Theorem 3.10—fails (iii) on a positive-measure set of preference realisations under the fixed-remittance regime (and more generally any sub-Lipschitz remittance regime). Hence no homogeneous-edge-pricing market mediator on 𝐺 satisfies (i), (ii), and (iii) simultaneously. □
Remark 30 (Trilemma vanishes under settlement separation). By Lemma 5(b), the canonical settlement-separated schedule 𝑐 sep exactly cancels the spread channel: Δ𝑒 ∗ (𝜀; 𝑐 sep ) = 0. Under 𝑐 sep , the trilemma’s third leg is restored — the perturbation deviation of Lemma 7 becomes revenue-neutral for the mediator. This is the Amin-instance counterpart of (C0) in Proposition 5: settlement separation makes VCG credible. The trilemma and the credibility-restoring proposition are therefore complementary statements about a single regime classification, not contradictory results.
Credibility Trilemma in Polymatroidal Service Markets
A.3
0:71
Notational disclosures and scope
Notation translation. The Amin [5] primitives and the polymatroidal primitives of the main paper are not isomorphic; their correspondences on the SP-with-homogeneous class are summarised in Table 5. The full claim-level correspondence and a discussion of where the two notations diverge are summarised in the table below.4 Table 5. Notation correspondence on the SP-with-homogeneous class Main paper (this work)
Amin et al. [5]
Polymatroid rank 𝑓 (𝑆) Non-modularity gap 𝛾𝑖 𝑗
LP feasible region of (IP) under SP topology LP integrality gap Γ on non-SP failures
∫𝑏 Archer–Tardos payment 0 𝑖 𝑥𝑖 (𝑧, 𝑏 −𝑖 )𝑑𝑧 Ground set 𝐸 (slot ground set) Slice (P3 encapsulation) Operator O Bid 𝑏𝑖 Allocation 𝑥𝑖 Settlement separation (C0) of Proposition 5 Í Operator revenue 𝑝𝑖 minus contracted procurement Walrasian price gap (price-ladder version) Per-edge flow (𝑁 tr )
∗ ∗ ) −𝑆 VCG payment 𝑆 −𝑚 (𝑥 −𝑚 −𝑚 (𝑥 ) (Eq. 17) Edge set 𝐸 (network edges) Coalition–route trip (𝑏, 𝑟 ) Mediator (Theorem 3.10 platform) Reported preference parameters (𝛼𝑚 , 𝛽𝑚 ) Trip allocation 𝑥𝑟 (𝑏) ∈ {0, 1} Canonical schedule 𝑐 sep of Lemma 5(b) Spread 𝑅(𝛿; 𝑐) of Definition 9 𝜀¯ of Lemma 6 via Lemma B.3 Saturated trip count 𝑞𝑒 ∗
Scope. Theorem 10 is restricted to: (a) series–parallel networks (Amin Definition 3.1; Wheatstoneembedding-free); (b) homogeneous capacity-sharing disutility (Amin Equation (12)); (c) single source–single sink (Amin §2); (d) homogeneous edge pricing (one 𝜏𝑒 per edge, not path-based or population-segmented as in Amin §4.2); (e) the fixed-remittance schedule of Remark 28 or any sub-Lipschitz schedule (Lemma 5(a)). Theorem 1 of the main paper establishes the trilemma in the broader polymatroidal regime, which includes multi-source/multi-sink DAGs and multi-output integrator slices over a shared sub-DAG; on these broader classes, Amin et al. do not provide an independent grounding (their Examples 3.3–3.4 establish equilibrium non-existence, not strategicmediator extraction). The Amin instance is therefore a strict refinement of the trilemma’s scope: it answers reviewers’ “can the trilemma be expressed without the polymatroidal-DAG machinery of [54]” question affirmatively on a refereed sub-class, while leaving the broader claim resting on the polymatroidal results P1–P3 of [54] (reproved inline in Propositions 1 to 3) and the Archer–Tardos perturbation of Lemma 1. Honest residual gaps. We list places where the Amin instance is genuinely weaker than the main paper’s trilemma proof, and where the proof above relies on assumptions whose generality is narrower than the corresponding step in the main text. (1) No Archer–Tardos integrand. The main paper’s perturbation is a pointwise integrand-shift of the Archer–Tardos payment formula (1), with payment increment 𝛿 · 𝛾𝑖 𝑗 derived as a Riemann area on a single bid coordinate. The Amin instance has no Archer–Tardos integral form available—Amin’s payments are VCG payments in the Equation (17) form, derived 4 The ten “do not overclaim” items relevant when chaining results across the two settings are enumerated in the “Honest
residual gaps” list of Section A.3 below.
0:72
Lovén et al.
from welfare differences across allocations. The perturbation increment of Lemma 7 is consequently not an Archer–Tardos area but a direct edge-price increment, and the 𝛿 · 𝛾𝑖 𝑗 identification of CoNC with the polymatroid non-modularity gap does not transfer. The audit §E item 7 records this asymmetry; we do not claim a 𝛾𝑖 𝑗 -style structural quantity in the Amin instance. (2) Stronger regularity required on the joint (𝛼𝑚 , 𝛽𝑚 ) prior. Myerson regularity is a singleparameter property; the Amin valuation is two-parameter affine in (𝛼𝑚 , 𝛽𝑚 ). We require regularity of each marginal and a non-degeneracy condition on the joint distribution to ensure Step 1 of Theorem 10 produces a unique candidate up to tie-breaking. In the polymatroidal setting of the main paper, single-parameter Myerson regularity suffices because P3 encapsulation reduces the agent’s type to a single coordinate (Proposition 3, [54]). The Amin-instance regularity assumption is materially stronger; we have not characterised the minimal joint condition that suffices. (3) Lemma 3.8 GS structure does not extend to path-based pricing. The GS structure of 𝑉¯𝑟 on which Step 4 of Lemma 7 relies is established by Amin’s Lemma 3.8 only under homogeneous edge pricing; under the path-based, population-segmented pricing of Amin §4.2 (heterogeneous capacity-sharing disutility), Amin’s Lemma 3.8 does not apply and computation of equilibrium is NP-hard [5, Prop. 4.2]. Consequently the synthetic-agent construction in Step 4 fails outside the SP-with-homogeneous regime, and we make no claim about heterogeneous instances. The audit §E item 3 explicitly warns against citing §4.2 as “Amin handles heterogeneity.” (4) Multi-agent coalitions: per-agent payment increment is fractional. Lemma Z.1 (L2) states the per-agent increment is 𝜀, which is exact when each trip’s coalition is a singleton (|𝑏 ∗ | = 1); for multi-agent coalitions, the per-agent increment is 𝜀/|𝑏 ∗ | and the per-trip increment is 𝜀 (Lemma 7 Step 3 footnote). The aggregate revenue computation of Theorem 10 Step 2 (𝜀 · 𝑞𝑒 ∗ ) is per-trip and is unaffected by coalition size. We treat the per-agent (L2) increment as a notational simplification valid in the singleton-coalition regime, which is the generic regime under Amin’s homogeneous disutility (Δ𝛼 (1) = Δ𝛽 (1) = 0 implies coalitions form only when capacity-sharing is strictly preferred to a less-loaded route). (5) Synthetic-agent construction is regime-restricted. The construction in Step 4 of Lemma 7 relies on three properties of Amin’s auxiliary economy: (i) the GS structure of 𝑉¯𝑙 (Lemma 3.8); (ii) the Walrasian-price lattice with maximum element (Lemma B.3, citing Gul–Stacchetti [40]); (iii) the continuity of the Walrasian-price map under unit-buyer insertion (Kelso–Crawford [48] ascending-bid construction; cited via Amin [35]). All three hold in the SP-with-homogeneous regime; they fail in the heterogeneous regime (where 𝑉¯𝑙 ceases to be GS) and in the non-SP regime (where Lemma 3.8 does not apply). The construction does not appeal to inversefunction-theorem machinery beyond what these three results supply; in particular, it is constructive on the SP-with-homogeneous regime via the marginal-bidder calculation of Amin Lemma B.4. We do not claim the construction extends beyond SP-with-homogeneous. (6) Audit §E cross-check. We have explicitly checked the proof against the audit’s “do not overclaim” list, items 1–10 of §E. In particular: we do not claim Lemma 3.8 supplies the trilemma directly (item 1); we do not conflate Examples 3.3–3.4’s non-existence with strategic mediator extraction (item 2); we do not invoke §4.2 as covering heterogeneity (item 3); we do not equate Theorem 3.10’s minimum-edge-price property with credibility (item 8); and we restrict the scope statement to single-source–single-sink + SP + homogeneous (item 10). The proof aligns with the audit’s framing of Theorem 10 as a trilemma instance, not as a stand-alone trilemma proof independent of the polymatroidal machinery of [54].
Credibility Trilemma in Polymatroidal Service Markets
0:73
Honest summary. Theorem 10 establishes the trilemma at instance level over a refereed external setting ([5], ACM TEAC 14(1) Art. 2), addressing the reviewer concern that the main paper might lean too heavily on the polymatroidal machinery of [54]. It does not establish that the main paper’s results are independent of that machinery: the broader trilemma (multi-source DAGs, multi-output integrator slices, polymatroids beyond SP s–t flows) still requires the polymatroidal framework, reproved inline in Propositions 1 to 3. The Amin instance is offered as a sanity check, not as a replacement. The bridging lemmas (Lemmas 5 to 7) make the dependence on Amin’s auxiliary economy and on the credibility-regime classification explicit, so that a reviewer who reads Amin’s text alongside this appendix can verify each claim against a refereed source. B
Assumption Applicability
The credibility results of this paper build on three structural properties (P1–P3, reproved inline in the main text from [54]), the gross-substitutes valuation conditions (GS1–GS3), the encapsulation conditions for integrators (E1–E3), the broadcast hypotheses for the Commitment theorem ((B1) and (B2′ )), and the domain-separation hypotheses (C0–C4) of the domain-separation proposition. Table 6 rates each assumption’s practical applicability in real-time AI service economies and indicates the most promising relaxation paths; the per-result dependency (which assumptions each result requires) is given separately in Table 7. Assumptions rated “Restrictive” represent the primary boundaries of the current theory; all credibility results assume that the structural properties P1–P3 and the GS conditions hold, and if any condition fails the DSIC mechanism may not exist. C
Assumptions-to-Results Mapping
Table 7 cross-references each formal result to the type space, feasibility class, valuation class, operator objective, and commitment regime under which it holds, and indicates whether the result is established by formal proof or via simulation evidence in the main paper.
0:74
Lovén et al.
Table 6. Assumption Applicability to Real-Time AI Service Economies Assumption
Practical fit
Justification
Non-modularity
Inherent
Shared infrastructure is the norm
Single-parameter agents
Restrictive
Quasi-linear valuations
Good
Regular distributions GS2 (no complementarities) GS3 (fixed attributes/epoch) E1 (scalar capacity)
Standard Restrictive
E2 (faithful max-flow)
Restrictive
B1 (direct broadcast)
Moderate
Moderate Moderate
B2′ (on-path verifiable 𝑓 ) Moderate C0 (settlement separa- Moderate tion) Fee-only operator (C1) Restrictive
Single operator (no collu- Restrictive sion) Myopic operator Moderate Positive valuations
Reasonable
Binding capacity
Natural
Relaxation path
N/A (precondition for the problem) Holds per-task under encapsula- Open; partial via single-minded tion; breaks for multi-dimensional bidders preferences Per-task procurement at ms-scale; Budget constraints secondary at no income effects task level Most natural distributions qualify Ironing handles irregularity Broken by service-composition Encapsulation (P3) is the architecpipelines tural remedy 100–200 ms epochs limit intra- Online/repeated mechanisms (fuepoch variation ture work) Restrictive for multi-tier integra- Partition matroid extension feasitors ble Integrators have incentive to mis- Integrator credibility theory report (missing) Requires operator-independent Gossip protocols, TEE attestation substrate On-path authentication, topology Merkle commitments, TEE attesmay stay private tation, ZK proofs Requires third-party escrow or Stock-exchange design; standard clearing in regulated markets Knife-edge; real operators have Continuous deployable surface in mixed incentives stake/escrow/audit is open; commitment is the fallback Multi-operator collusion plausible Coalition-proof mechanisms in practice largely open Repeated-game reputation effects Dynamic models future absent Tasks with zero value not submit- Net-value interpretation suffices ted Congested regime is the interest- Under-subscription trivialises the ing case problem
Credibility Trilemma in Polymatroidal Service Markets
0:75
Table 7. Assumptions-to-results mapping. Each row states the exact conditions under which the result holds and whether validation is formal or simulation-backed.
Result
Type space
Trilemma
Single-param., regular dist. Single-param.
Commitment (i) Commitment (ii) Domain sep. Competition (Bertrand) Competition (Salop)
Feasibility
Valuation
Operator obj.
Commitment
Evidence
Non-modular polymatroid Polymatroid (divisible) Single-param., Matroid 𝛼-strongly reg. (binary) Any (positive Polymatroid values) N/A N/A
Quasi-linear
None (sealed-bid)
Formal proof
Broadcast (B1, B2′ ) Blockchain/DRA
Formal proof
N/A
Differentiated
Revenue max. Welfare max. Revenue max. Per-unit fee only Bertrand pricing Salop pricing
N/A
Quasi-linear Quasi-linear Quasi-linear Homogeneous
None needed
Imported [35] Formal proof
N/A
Formal proof
N/A
Formal proof