How Hard Is It To Manipulate
Voting?
Edith Elkind, Princeton
Helger Lipmaa, HUT
Manipulation: Example
• 99 voters, 3 candidates (Liberal, Ultra-liberal,
Royalist).
– 49 voters prefer L to U to R.
– 48 voters prefer U to L to R.
– 2 voters (Edith and Helger) prefer R to U to L.
• Aggregation rule: Plurality
– each voter casts a vote for one candidate.
– the candidate with the largest number of votes
wins.
– draws are resolved by a coin toss.
What Will Edith and Helger Do?
L: 49 votes
U: 48 votes
R>U>L
If I vote for R, L will get
elected, so I’d rather vote for
U
If Edith and Helger cooperate,
they can guarantee that U is elected
Why Manipulation Is Bad
• Aggregation rules are designed with
certain social welfare criteria in mind.
• Misrepresentation of preferences results in
a suboptimal choice w.r.t. these criteria.
• Also, election results do not reflect true
distribution of preferences in the society:
– maybe, in fact, 20% of the U.S. population
prefer Nader to Gore to Bush?
What If We Change Aggregation
Rule?
• Single Transferable Vote:
2nd round
1st round
L>U>R
U>L>R
R>U>L
49 votes
48 votes
2 votes
L>U
49 votes
U>L
50 votes
U wins
• This time, Edith and Helger are better off voting
honestly, but this will not always be the case…
• Other popular voting schemes (Borda,
Copeland) suffer from the same problem
Formal Setup
• n voters, m candidates.
• Preference of a voter i is a permutation pi
of {1, …, m} (best to worst).
• Aggregation rule S: (p1, …,pn) → cj.
• A voter i can manipulate S if there is
– a preference vector p = (p1,…,pi, …,pn)
– a permutation pi’ s.t.
S(p1,…,pi’, …,pn) >i S(p).
Theorem (Gibbard-Satterthwaite, 1971):
every non-dictatorial aggregation rule
with ≥3 candidates is manipulable.
How Do We Get Around The
Impossibility Result?
• We cannot make manipulation impossible…
• But we can try to make it hard!
• Some aggregation rules (e.g., STV) are NPhard to manipulate (Bartholdi, Orlin 1991)
– these rules may not reflect the welfare goals
(why is there so many voting rules out there?)
– does NP-hardness suffice?
– want security against coalitions, not just a single
voter.
Adding a Preround (ConitzerSandholm)
P
r
e
r
o
u
n
d
Alice
Bob
Carl
Diana
Ernest
Frank
Do most voters prefer Alice to
Bob?
Alice
Diana
Ernest
Original protocol
• Retains some of the intuitive properties of the original protocol.
• Is hard to manipulate for many classical protocols:
• First pair candidates, then elicit votes: NP-hard
• First elicit votes, then randomly pair candidates: #P-hard
• Interleave pairing and vote elicitation: PSPACE-hard
Issues With Preround Scheduling
• Can we trust the election officials to
randomly pair the candidates?
• Can we achieve average-case hardness?
E.g., can we make manipulation as hard
as inverting one-way functions?
• What if manipulating voters can collude?
Our Protocol: Preround With a Twist
Idea: use votes themselves to select
preround schedule.
Alice
Bob
….
Bob
Carl
….
01101…
XOR
11101…
11100…
Alice
↕
Frank
Bob
↕
Ernest
OWF
Carl
Alice
….
10111…
00100…
Carl
↕
Diana
Preround schedule
Key Properties
• No trusted source of randomness is needed.
• Manipulating this protocol is as hard as inverting
the underlying one-way function
– even for a large coalition of conspiring would-be
manipulators
• Proof proceeds by constructing a vector of honest
voters’ preferences s.t. there is a unique preround
schedule that makes manipulators’ protégé a
winner
– still a worst-case construction…
Average-Case Hardness?
• Can we make manipulation hard for an
overwhelming fraction of honest voters
preferences?
• (Partial) negative result: there is a vector
of preferences such that:
– If everyone votes honestly, under any
preround schedule candidate P wins
– There is a manipulation by a single voter that
under any preround schedule results in a
draw between P and another candidate
Open Problems
• Average-case hardness seems hard to
achieve using a preround. Other
approaches?
• What is the maximum fraction of
manipulators we can tolerate?
– we can prove security against 1/6 of all
voters. Is it optimal?
• Our results are for specific protocols. More
general proofs?