arX

iv:1

303.

0356

v2 [

cs.G

T] 5

Mar

2013

Audit Games

Jeremiah Blocki, Nicolas Christin, Anupam Datta, Ariel D. Procaccia, Arunesh SinhaCarnegie Mellon University, Pittsburgh, USA

{jblocki@cs, nicolasc@, danupam@, arielpro@cs, aruneshs@}.cmu.edu

AbstractEffective enforcement of laws and policies requiresexpending resources to prevent and detect offend-ers, as well as appropriate punishment schemesto deter violators. In particular, enforcement ofprivacy laws and policies in modern organiza-tions that hold large volumes of personal infor-mation (e.g., hospitals, banks, and Web servicesproviders) relies heavily on internal audit mecha-nisms. We study economic considerations in thedesign of these mechanisms, focusing in particu-lar on effective resource allocation and appropriatepunishment schemes. We present an audit gamemodel that is a natural generalization of a stan-dard security game model for resource allocationwith an additional punishment parameter. Com-puting the Stackelberg equilibrium for this gameis challenging because it involves solving an opti-mization problem with non-convex quadratic con-straints. We present an additive FPTAS that effi-ciently computes a solution that is arbitrarily closeto the optimal solution.

1 IntroductionIn a seminal paper, Gary Becker [1968] presented a com-pelling economic treatment of crime and punishment. Hedemonstrated that effective law enforcement involves optimalresource allocation to prevent and detect violations, coupledwith appropriate punishments for offenders. He described

This work was partially supported by the U.S. Army ResearchOffice contract Perpetually Available and Secure Information Sys-tems (DAAD19-02-1-0389) to Carnegie Mellon CyLab, the NSFScience and Technology Center TRUST, the NSF CyberTrust grantPrivacy, Compliance and Information Risk in Complex Organiza-tional Processes, the AFOSR MURI Collaborative Policies and As-sured Information Sharing,, HHS Grant no. HHS 90TR0003/01 andNSF CCF-1215883. Jeremiah Blocki was also partially supportedby a NSF Graduate Fellowship. Arunesh Sinha was also partiallysupported by the CMU CIT Bertucci Fellowship. The views andconclusions contained in this document are those of the authors andshould not be interpreted as representing the official policies, eitherexpressed or implied, of any sponsoring institution, the U.S. govern-ment or any other entity.

how to optimize resource allocation by balancing the societalcost of crime and the cost incurred by prevention, detectionand punishment schemes. While Becker focused on crimeand punishment in society, similar economic considerationsguide enforcement of a wide range of policies. In this paper,we study effective enforcement mechanisms for this broaderset of policies. Our study differs from Beckers in two sig-nificant waysour model accounts for strategic interactionbetween the enforcer (or defender) and the adversary; andwe design efficient algorithms for computing the optimal re-source allocation for prevention or detection measures as wellas punishments. At the same time, our model is significantlyless nuanced than Beckers, thus enabling the algorithmic de-velopment and raising interesting questions for further work.

A motivating application for our work is auditing, whichtypically involves detection and punishment of policy viola-tors. In particular, enforcement of privacy laws and policies inmodern organizations that hold large volumes of personal in-formation (e.g., hospitals, banks, and Web services providerslike Google and Facebook) relies heavily on internal auditmechanisms. Audits are also common in the financial sector(e.g., to identify fraudulent transactions), in internal revenueservices (e.g., to detect tax evasion), and in traditional lawenforcement (e.g., to catch speed limit violators).

The audit process is an interaction between two agents: adefender (auditor) and an adversary (auditee). As an example,consider a hospital (defender) auditing its employee (adver-sary) to detect privacy violations committed by the employeewhen accessing personal health records of patients. Whileprivacy violations are costly for the hospital as they result inreputation loss and require expensive measures (such as pri-vacy breach notifications), audit inspections also cost money(e.g., the cost of the human auditor involved in the investiga-tion). Moreover, the number and type of privacy violationsdepend on the actions of the rational auditeeemployeescommit violations that benefit them.

1.1 Our ModelWe model the audit process as a game between a defender(e.g, a hospital) and an adversary (e.g., an employee). Thedefender audits a given set of targets (e.g., health record ac-cesses) and the adversary chooses a target to attack. The de-fenders action space in the audit game includes two com-ponents. First, the allocation of its inspection resources to

targets; this component also exists in a standard model of se-curity games [Tambe, 2011]. Second, we introduce a con-tinuous punishment rate parameter that the defender employsto deter the adversary from committing violations. However,punishments are not free and the defender incurs a cost forchoosing a high punishment level. For instance, a negativework environment in a hospital with high fines for violationscan lead to a loss of productivity (see [Becker, 1968] for asimilar account of the cost of punishment). The adversarysutility includes the benefit from committing violations andthe loss from being punished if caught by the defender. Ourmodel is parametric in the utility functions. Thus, dependingon the application, we can instantiate the model to either al-locate resources for detecting violations or preventing them.This generality implies that our model can be used to studyall the applications previously described in the security gamesliterature [Tambe, 2011].

To analyze the audit game, we use the Stackelberg equilib-rium solution concept [von Stackelberg, 1934] in which thedefender commits to a strategy, and the adversary plays anoptimal response to that strategy. This concept captures situa-tions in which the adversary learns the defenders audit strat-egy through surveillance or the defender publishes its auditalgorithm. In addition to yielding a better payoff for the de-fender than any Nash equilibrium, the Stackelberg equilib-rium makes the choice for the adversary simple, which leadsto a more predictable outcome of the game. Furthermore, thisequilibrium concept respects the computer security principleof avoiding security through obscurity audit mechanismslike cryptographic algorithms should provide security despitebeing publicly known.

1.2 Our ResultsOur approach to computing the Stackelberg equilibrium isbased on the multiple LPs technique of Conitzer and Sand-holm [2006]. However, due to the effect of the punishmentrate on the adversarys utility, the optimization problem inaudit games has quadratic and non-convex constraints. Thenon-convexity does not allow us to use any convex optimiza-tion methods, and in general polynomial time solutions fora broad class of non-convex optimization problems are notknown [Neumaier, 2004].

However, we demonstrate that we can efficiently obtainan additive approximation to our problem. Specifically,we present an additive fully polynomial time approximationscheme (FPTAS) to solve the audit game optimization prob-lem. Our algorithm provides a K-bit precise output in timepolynomial in K . Also, if the solution is rational, our al-gorithm provides an exact solution in polynomial time. Ingeneral, the exact solution may be irrational and may not berepresentable in a finite amount of time.

1.3 Related WorkOur audit game model is closely related to secu-rity games [Tambe, 2011]. There are many papers(see, e.g., [Korzhyk et al., 2010; Pita et al., 2011;Pita et al., 2008]) on security games, and as our modeladds the additional continuous punishment parameter, all thevariations presented in these papers can be studied in the

context of audit games (see Section 4). However, the auditgame solution is technically more challenging as it involvesnon-convex constraints.

An extensive body of work on auditing focuses onanalyzing logs for detecting and explaining violationsusing techniques based on logic [Vaughan et al., 2008;Garg et al., 2011] and machine learning [Zheng et al., 2006;Bodik et al., 2010]. In contrast, very few papers study eco-nomic considerations in auditing strategic adversaries. Ourwork is inspired in part by the model proposed in one suchpaper [Blocki et al., 2012], which also takes the point of viewof commitment and Stackelberg equilibria to study auditing.However, the emphasis in that work is on developing a de-tailed model and using it to predict observed audit practicesin industry and the effect of public policy interventions on au-diting practices. They do not present efficient algorithms forcomputing the optimal audit strategy. In contrast, we workwith a more general and simpler model and present an effi-cient algorithm for computing an approximately optimal au-dit strategy. Furthermore, since our model is related to thesecurity game model, it opens up the possibility to leverageexisting algorithms for that model and apply the results to theinteresting applications explored with security games.

Zhao and Johnson [2008] model a specific audit strategybreak the glass-where agents are permitted to violate anaccess control policy at their discretion (e.g., in an emergencysituation in a hospital), but these actions are audited. Theymanually analyze specific utility functions and obtain closed-form solutions for the audit strategy that results in a Stackel-berg equilibrium. In contrast, our results apply to any utilityfunction and we present an efficient algorithm for computingthe audit strategy.

2 The Audit Game ModelThe audit game features two players: the defender (D), andthe adversary (A). The defender wants to audit n targetst1, . . . , tn, but has limited resources which allow for auditingonly one of the n targets. Thus, a pure action of the defenderis to choose which target to audit. A randomized strategy isa vector of probabilities p1, . . . , pn of each target being au-dited. The adversary attacks one target such that given thedefenders strategy the adversarys choice of violation is thebest response.

Let the utility of the defender be UaD(ti) when auditedtarget ti was found to be attacked, and UuD(ti) when unau-dited target ti was found to be attacked. The attacks (vi-olation) on unaudited targets are discovered by an externalsource (e.g. government, investigative journalists,...). Sim-ilarly, define the utility of the attacker as UaA(ti) when theattacked target ti is audited, and UuA(ti) when attacked tar-get ti is not audited, excluding any punishment imposed bythe defender. Attacks discovered externally are costly for thedefender, thus, UaD(ti) > UuD(ti). Similarly, attacks not dis-covered by internal audits are more beneficial to the attacker,and UuA(ti) > UaA(ti).

The model presented so far is identical to security gameswith singleton and homogeneous schedules, and a single re-source [Korzhyk et al., 2010]. The additional component in

audit games is punishment. The defender chooses a punish-ment rate x [0, 1] such that if auditing detects an attack,the attacker is fined an amount x. However, punishment is notfreethe defender incurs a cost for punishing, e.g., for creat-ing a fearful environment. For ease of exposition, we modelthis cost as a linear function ax, where a > 0; however, ourresults directly extend to any cost function polynomial in x.Assuming x [0, 1] is also without loss of generality as util-ities can be scaled to be comparable to x. We do assume thepunishment rate is fixed and deterministic; this is only naturalas it must correspond to a consistent policy.

We can now define the full utility functions. Given proba-bilities p1, . . . , pn of each target being audited, the utility ofthe defender when target t is attacked is

pUaD(t) + (1 p)UuD(t) ax.

The defender pays a fixed cost ax regardless of the outcome.In the same scenario, the utility of the attacker when target tis attacked is

p(UaA(t) x) + (1 p)UuA(t).

The attacker suffers the punishment x only when attacking anaudited target.Equilibrium. The Stackelberg equilibrium solution involvesa commitment by the defender to a strategy (with a possi-bly randomized allocation of the resource), followed by thebest response of the adversary. The mathematical problem in-volves solving multiple optimization problems, one each forthe case when attacking t is in fact the best response of theadversary. Thus, assuming t is the best response of the ad-versary, the th optimization problem P in audit games ismaxpi,x

pUaD(t) + (1 p)UuD(t) ax ,

subject to i 6= . pi(UaA(ti) x) + (1 pi)UuA(ti) p(UaA(t) x) + (1 p)U

uA(t) ,

i. 0 pi 1 ,i pi = 1 ,

0 x 1 .

The first constraint verifies that attacking t is indeed a bestresponse. The auditor then solves the n problems P1, . . . , Pn(which correspond to the cases where the best response ist1, . . . , tn, respectively), and chooses the best solution amongall these solutions to obtain the final strategy to be used for au-diting. This is a generalization of the multiple LPs approachof Conitzer and Sandholm [2006].Inputs. The inputs to the above problem are specified in Kbit precision. Thus, the total length of all inputs is O(nK).Also, the model can be made more flexible by including adummy target for which all associated costs are zero (includ-ing punishment); such a target models the possibility that theadversary does not attack any target (no violation). Our resultstays the same with such a dummy target, but, an additionaledge case needs to be handledwe discuss this case in a re-mark at the end of Section 3.2.

3 Computing an Audit StrategyBecause the indices of the set of targets can be arbitrarilypermuted, without loss of generality we focus on one opti-mization problem Pn ( = n) from the multiple optimization

problems presented in Section 2. The problem has quadraticand non-convex constraints. The non-convexity can be read-ily checked by writing the constraints in matrix form, with asymmetric matrix for the quadratic terms; this quadratic-termmatrix is indefinite.

However, for a fixed x, the induced problem is a linearprogramming problem. It is therefore tempting to attempt abinary search over values of x. This nave approach does notwork, because the solution may not be single-peaked in thevalues of x, and hence choosing the right starting point forthe binary search is a difficult problem. Another nave ap-proach is to discretize the interval [0, 1] into steps of , solvethe resultant LP for the 1/ many discrete values of x, andthen choose the best solution. As an LP can be solved in poly-nomial time, the running time of this approach is polynomialin 1/, but the approximation factor is at least a (due tothe ax in the objective). Since a can be as large as 2K , get-ting an -approximation requires to be 2K, which makesthe running time exponential in K . Thus, this scheme cannotyield an FPTAS.

3.1 High-Level OverviewFortunately, the problem Pn has another property that allowsfor efficient methods. Let us rewrite Pn in a more compactform. Let D,i = UaD(ti) UuD(ti), i = UuA(ti) UaA(ti)and i,j = UuA(ti)UuA(tj). D,i andi are always positive,and Pn reduces to:

maxpi,x

pnD,n + UuD(tn) ax ,

subject to i 6= n. pi(xi) + pn(x+n) + i,n 0 ,i. 0 pi 1 ,

i pi = 1 ,0 x 1 .

The main observation that allows for polynomial timeapproximation is that, at the optimal solution point, thequadratic constraints can be partitioned into a) those that aretight, and b) those in which the probability variables pi arezero (Lemma 1). Each quadratic constraint corresponding topi can be characterized by the curve pn(x+n) + i,n = 0.The quadratic constraints are thus parallel hyperbolic curveson the (pn, x) plane; see Figure 1 for an illustration. Theoptimal values pon, xo partition the constraints (equivalently,the curves): the constraints lying below the optimal value aretight, and in the constraints above the optimal value the prob-ability variable pi is zero (Lemma 2). The partitioning allowsa linear number of iterations in the search for the solution,with each iteration assuming that the optimal solution lies be-tween adjacent curves and then solving the sub-problem withequality quadratic constraints.

Next, we reduce the problem with equality quadratic con-straints to a problem with two variables, exploiting the na-ture of the constraints themselves, along with the fact that theobjective has only two variables. The two-variable problemcan be further reduced to a single-variable objective using anequality constraint, and elementary calculus then reduces theproblem to finding the roots of a polynomial. Finally, we useknown results to find approximate values of irrational roots.

n x

pn

1

1

= 1 = 2 = 3

= 1

(pon, xo)

Figure 1: The quadratic constraints are partitioned into thosebelow (pon, xo) that are tight (dashed curves), and those above(pon, x

o) where pi = 0 (dotted curves).

3.2 Algorithm and Main ResultThe main result of our paper is the following theorem:Theorem 1. Problem Pn can be approximated to an addi-tive in time O(n5K + n4 log(1 )) using the splitting circlemethod [Schonhage, 1982] for approximating roots.Remark The technique of Lenstra et al. [1982] can be usedto exactly compute rational roots. Employing it in conjunc-tion with the splitting circle method yields a time boundO(max{n13K3, n5K + n4 log(1/)}). Also, this techniquefinds an exact optimal solution if the solution is rational.

Before presenting our algorithm we state two results aboutthe optimization problem Pn that motivate the algorithm andare also used in the correctness analysis. The proof of the firstlemma is omitted due to lack of space.Lemma 1. Let pon, xo be the optimal solution. Assume xo >0 and pon < 1. Then, at pon, xo, for all i 6= n, either pi = 0or pon(x

o +n) + i,n = pi(xo +i), i.e., the ith quadratic

constraint is tight.Lemma 2. Assume xo > 0 and pon < 1. Let pon(xo +n) + = 0. If for some i, i,n < then pi = 0. If for some i,i,n > then pon(xo+n)+ i,n = pi(xo+i). If for somei, i,n = then pi = 0 and pon(xo+n)+i,n = pi(xo+i).

Proof. The quadratic constraint for pi is pon(xo+n)+i,n pi(x

o + i). By Lemma 1, either pi = 0 or the constraintis tight. If pon(xo + n) + i,n < 0, then, since pi 0 andxo+i 0, the constraint cannot be tight. Hence, pi = 0. Ifpon(x

o+n) + i,n > 0, then, pi 6= 0 or else with pi = 0 theconstraint is not satisfied. Hence the constraint is tight. Thelast case with pon(xo +n) + i,n = 0 is trivial.

From Lemma 2, if pon, xo lies in the region between theadjacent hyperbolas given by pon(xo + n) + i,n = 0 andpon(x

o +n) + j,n = 0 (and 0 < xo 1 and 0 pon < 1),then i,n 0 and pi 0 and for the kth quadratic constraintwith k,n < i,n, pk = 0 and for the jth quadratic constraintwith j,n > i,n, pj 6= 0 and the constraint is tight.

These insights lead to Algorithm 1. After handling the caseof x = 0 and pn = 1 separately, the algorithm sorts the s to

get (1),n, . . . , (n1),n in ascending order. Then, it iteratesover the sorted s until a non-negative is reached, assumingthe corresponding pis to be zero and the other quadratic con-straints to be equalities, and using the subroutine EQ OPTto solve the induced sub-problem. For ease of exposition weassume s to be distinct, but the extension to repeated s isquite natural and does not require any new results. The sub-problem for the ith iteration is given by the problem Qn,i:

maxx,p(1),...,p(i),pn

pnD,n ax ,

subject to pn(x+n) + (i),n 0 ,if i 2 then pn(x+n) + (i1),n < 0 ,j i. pn(x +n) + (j),n = p(j)(x+j) ,j > i. 0 < p(j) 1 ,0 p(i) 1 ,n1

k=i p(k) = 1 pn ,0 pn < 1 ,0 < x 1 .

The best (maximum) solution from all the sub-problems (in-cluding x = 0 and pn = 1) is chosen as the final answer.

Lemma 3. Assuming EQ OPT produces an -additive ap-proximate objective value, Algorithm 1 finds an -additive ap-proximate objective of optimization problem Pn.

The proof is omitted due to space constraints.

Algorithm 1: APX SOLVE(, Pn)l prec(, n,K), where prec is defined after Lemma 7Sort s in ascending order to get (1),n, . . . , (n1),n,with corresponding variables p(1), . . . , p(n1) andquadratic constraints C(1), . . . , C(n1)Solve the LP problem for the two cases when x = 0 andpn = 1 respectively. Let the solution beS0, p0(1), . . . , p

0(n1), p

0n, x

0 andS1, p1(1), . . . , p

1(n1), p

1n , x

1 respectively.for i 1 to n 1 do

if (i),n 0 ((i),n > 0 (i1),n < 0) thenp(j) 0 for j < i.Set constraints C(i), . . . , C(n1) to be equalities.Si, pi(1), . . . , p

i(n1), p

in, x

i EQ OPT(i, l)

elseSi

f argmaxi{S1, S0, S1, . . . , Si, . . . , Sn1}

pf1 , . . . , pfn1 Unsort p

f(1), . . . , p

f(n1)

return pf1 , . . . , pfn, xf

EQ OPT solves a two-variable problem Rn,i instead ofQn,i. The problem Rn,i is defined as follows:maxx,pn pnD,n ax ,subject topn(x +n) + (i),n 0 ,if i 2 then pn(x+n) + (i1),n < 0 ,pn

(1 +

j:ijn1

x+nx+(j)

)= 1

j:ijn1

(j),nx+(j)

,

0 pn < 1 ,0 < x 1 .

The following result justifies solving Rn,i instead of Qn,i.Lemma 4. Qn,i and Rn,i are equivalent for all i.Proof. Since the objectives of both problems are identical,we prove that the feasible regions for the variables in the ob-jective (pn, x) are identical. Assume pn, x, p(i), . . . , p(n1)is feasible in Qn,i. The first two constraints are the samein Qn,i and Rn,i. Divide each equality quadratic constraintcorresponding to non-zero p(j) by x + (j). Add all suchconstraints to get:

j:1jip(j)+pn

j:1ji

x+nx+(j)

+

j:1ji

(j),n

x+(j)= 0

Then, since

k:1ki p(k) = 1 pn we get

pn

1 +

j:ijn1

x+nx+(j)

= 1

j:ijn1

(j),n

x+(j).

The last two constraints are the same in Qn,i and Rn,i.Next, assume pn, x is feasible in Rn,i. Choose

p(j) = pn

(x+nx+(j)

)+

(j),nx+(j)

.

Since pn(x +n) + (i),n 0, we have p(i) 0, and sincepn(x+n) + (j),n > 0 for j > i (s are distinct) we havep(j) > 0. Also,

n1j=i

p(j) = pn

j:ijn1

x+nx+(j)

+

j:ijn1

(j),n

x+(j),

which by the third constraint of Rn,i is 1 pn. This impliesp(j) 1. Thus, pn, x, p(i), . . . , p(n1) is feasible in Qn,i.

The equality constraint in Rn,i, which forms a curve Ki,allows substituting pn with a function Fi(x) of the formf(x)/g(x). Then, the steps in EQ OPT involve taking thederivative of the objective f(x)/g(x) and finding those rootsof the derivative that ensure that x and pn satisfy all the con-straints. The points with zero derivative are however localmaxima only. To find the global maxima, other values of x ofinterest are where the curve Ki intersects the closed bound-ary of the region defined by the constraints. Only the closedboundaries are of interest, as maxima (rather suprema) at-tained on open boundaries are limit points that are not con-tained in the constraint region. However, such points are cov-ered in the other optimization problems, as shown below.

Algorithm 2: EQ OPT(i, l)

Define Fi(x) =1j:1ji1

j,nx+j

1+

j:1ji1x+nx+j

Definefeas(x) =

{true (x, Fi(x)) is feasible for Rn,ifalse otherwise

Find polynomials f, g such that f(x)g(x) = Fi(x)D,n axh(x) g(x)f (x) f(x)g(x){r1, . . . , rs} ROOTS(h(x), l)

{rs+1, . . . , rt} ROOTS(Fi(x) +(i),nx+n

, l)

{rt+1, . . . , ru} ROOTS(Fi(x), l)ru+1 1for k 1 to u+ 1 do

if feas(rk) thenOk

f(rk)g(rk)

elseif feas(rk 2l) then

Ok f(rk2l)g(rk2l) ; rk rk 2

l

elseif feas(rk + 2l) then

Ok f(rk+2

l)g(rk+2l)

; rk rk + 2l

elseOk

b argmaxk{O1, . . . , Ok, . . . , Ou+1}p(j) 0 for j < i

p(j) pn(rb +n) + (j),n

rb +(j)for j {i, . . . , n 1}

return Ob, p(1), . . . , p(n1), pn, rb

The limit point on the open boundary pn(x + n) +(i1),n < 0 is given by the roots of Fi(x) +

(i1),nx+n

. Thispoint is the same as the point considered on the closed bound-ary pn(x +n) + (i1),n 0 in problem Rn,i1 given byroots of Fi1(x) +

(i1),nx+n

, since Fi1(x) = Fi(x) whenpn(x+n)+(i1),n = 0. Also, the other cases when x = 0and pn = 1 are covered by the LP solved at the beginning ofAlgorithm 1.

The closed boundary in Rn,i are obtained from the con-straint pn(x + n) + (i),n 0, 0 pn and x 1. Thevalue x of the intersection of pn(x + n) + (i),n = 0 andKi is given by the roots of Fi(x) +

(i),nx+n

= 0. The valuex of the intersection of pn = 0 and Ki is given by roots ofFi(x) = 0. The value x of the intersection of x = 1 and Kiis simply x = 1. Additionally, as checked in EQ OPT, allthese intersection points must lie with the constraint regionsdefined in Qn,i.

The optimal x is then the value among all the points of in-terest stated above that yields the maximum value for f(x)g(x) .Algorithm 2 describes EQ OPT, which employs a root find-ing subroutine ROOTS. Algorithm 2 also takes care of ap-

proximate results returned by the ROOTS. As a result of the2l approximation in the value of x, the computed x and pncan lie outside the constraint region when the actual x and pnare very near the boundary of the region. Thus, we check forcontainment in the constraint region for points x 2l andaccept the point if the check passes.

Remark (dummy target): As discussed in Section 2, weallow for a dummy target with all costs zero. Let this target bet0. For n not representing 0, there is an extra quadratic con-straint given by p0(x00)+pn(x+n)+0,n 0, but,as x0 and 0 are 0 the constraint is just pn(x+n)+ 0,n 0. When n represents 0, then the ith quadratic constraint ispi(x i) + i,0 0, and the objective is independent ofpn as D,n = 0. We first claim that p0 = 0 at any optimalsolution. The proof is provided in Lemma 9 in Appendix.Thus, Lemma 1 and 2 continue to hold for i = 1 to n 1with the additional restriction that pon(xo +n) + 0,n 0.

Thus, when n does not represent 0, Algorithm 1 runs withthe the additional check (i),n < 0,n in the if condition insidethe loop. Algorithm 2 stays the same, except the additionalconstraint that p0 = 0. The other lemmas and the final resultsstay the same. When n represents 0, then x needs to be thesmallest possible, and the problem can be solved analytically.

3.3 AnalysisBefore analyzing the algorithms approximation guaranteewe need a few results that we state below.Lemma 5. The maximum bit precision of any coefficient ofthe polynomials given as input to ROOTS is 2n(K + 1.5) +log(n).

Proof. The maximum bit precision will be obtained ing(x)f (x) f(x)g(x). Consider the worst case when i = 1.Then, f(x) is of degree n and g(x) of degree n 1. There-fore, the bit precision of f(x) and g(x) is upper bounded bynK + log(

(nn/2

)), where nK comes from multiplying n K-

bit numbers and log((

nn/2

)) arises from the maximum number

of terms summed in forming any coefficient. Thus, using thefact that

(nn/2

) (2e)n/2 the upper bound is approximately

n(K+1.5). We conclude that the bit precision of g(x)f (x)f(x)g(x) is upper bounded by 2n(K + 1.5) + log(n).

We can now use Cauchys result on bounds on root of poly-nomials to obtain a lower bound for x. Cauchys bound statesthat given a polynomial anxn + . . .+ a0, any root x satisfies

|x| > 1/ (1 + max{|an|/|a0|, . . . , |a1|/|a0|}) .

Using Lemma 5 it can be concluded that any root returned byROOTS satisfies x > 24n(K+1.5)2 log(n)1.

Let B = 24n(K+1.5)2 log(n)1. The following lemma(whose proof is omitted due to lack of space) bounds the ad-ditive approximation error.Lemma 6. Assume x is known with an additive accuracy of, and < B/2. Then the error in the computed F (x) is at

most , where = Y+Y 2+4X2 and

X = min{ j:ijn1,

j,n0

2j,n(B +j)2

}

Y = min{ j:ijn1,nj0

2(n j)

(B +j)2

}

Moreover, is of order O(n2(8n(K+1.5)+4 log(n)+K).We are finally ready to establish the approximation guar-

antee of our algorithm.Lemma 7. Algorithm 1 solves problem Pn with additive ap-proximation term if

l > max{1+log(D,n+ a

), 4n(K+1.5)+2 log(n)+3}.

Also, as log(D,n+a ) = O(nK + log(1 )), l is of order

O(nK + log(1 )).

Proof. The computed value of x can be at most 2 2l farfrom the actual value. The additional factor of 2 arises due tothe boundary check in EQ OPT. Then using Lemma 6, themaximum total additive approximation is 2 2lD,n +2 2la. For this to be less than , l > 1 + log(D,n+a ).The other term in the max above arises from the condition < B/2 (this represents 2 2l) in Lemma 6.

Observe that the upper bound on is only in terms of nand K . Thus, we can express l as a function of , n and Kl = prec(, n,K).

We still need to analyze the running time of the algorithm.First, we briefly discuss the known algorithms that we useand their corresponding running-time guarantees. Linear pro-gramming can be done in polynomial time using Karmakarsalgorithm [Karmarkar, 1984] with a time bound of O(n3.5L),where L is the length of all inputs.

The splitting circle scheme to find roots of a polynomialcombines many varied techniques. The core of the algo-rithm yields linear polynomials Li = aix + bi (a, b can becomplex) such that the norm of the difference of the actualpolynomial P and the product

i Li is less than 2s, i.e.,

|P

i Li| < 2s

. The norm considered is the sum ofabsolute values of the coefficient. The running time of thealgorithm is O(n3 logn+n2s) in a pointer based Turing ma-chine. By choosing s = (nl) and choosing the real part ofthose complex roots that have imaginary value less than 2l,it is possible to obtain approximations to the real roots of thepolynomial with l bit precision in time O(n3 logn + n3l).The above method may yield real values that lie near com-plex roots. However, such values will be eliminated in takingthe maximum of the objective over all real roots, if they donot lie near a real root.

LLL [Lenstra et al., 1982] is a method for finding a shortbasis of a given lattice. This is used to design polyno-mial time algorithms for factoring polynomials with ratio-nal coefficients into irreducible polynomials over rationals.

The complexity of this well-known algorithm is O((n12 +n9(log |f |)3), when the polynomial is specified as in the fieldof integers and |f | is the Euclidean norm of coefficients. Forrational coefficients specified in k bits, converting to integersyields log |f | 12 logn + k. LLL can be used before thesplitting circle method to find all rational roots and then theirrational ones can be approximated. With these properties,we can state the following lemma.Lemma 8. The running time of Algorithm 1 with input ap-proximation parameter and inputs of K bit precision isbounded by O(n5K+n4 log(1 )) . Using LLL yields the run-ning time O(max{n13K3, n5K + n4 log(1 )})

Proof. The length of all inputs is O(nK), where K is thebit precision of each constant. The linear programs can becomputed in time O(n4.5K). The loop in Algorithm 1 runsless than n times and calls EQ OPT. In EQ OPT, the com-putation happens in calls to ROOTS and evaluation of thepolynomial for each root found. ROOTS is called three timeswith a polynomial of degree less than 2n and coefficient bitprecision less than 2n(K + 1.5) + log(n). Thus, the totalnumber of roots found is less than 6n and the precision ofroots is l bits. By Horners method [Horner, 1819], polyno-mial evaluation can be done in the following simple man-ner: given a polynomial anxn + . . . + a0 to be evaluatedat x0 computing the following values yields the answer asb0, bn = an, bn1 = an1 + bnx0, . . . , b0 = a0 + b1x0.From Lemma 7 we get l 2n(K + 1.5) + log(n), thus, biis approximately (n+ 1 i)l bits, and each computation in-volves multiplying two numbers with less than (n + 1 i)lbits each. We assume a pointer-based machine, thus multi-plication is linear in number of bits. Hence the total timerequired for polynomial evaluation is O(n2l). The total timespent in all polynomial evaluation is O(n3l). The splittingcircle method takes time O(n3 logn+ n3l). Using Lemma 7we get O(n4K+n3 log(1 )) as the running time of EQ OPT.Thus, the total time is O(n5K + n4 log(1 )).

When using LLL, the time in ROOTS in dominated byLLL. The time for LLL is given by O(n12 + n9(logn +nK)3), which is O(n12K3). Thus, the overall the time isbounded by O(max{n13K3, n4l), which using Lemma 7 isO(max{n13K3, n5K + n4 log(1 )}).

4 DiscussionWe have introduced a novel model of audit games thatwe believe to be compelling and realistic. Modulo thepunishment parameter our setting reduces to the simplestmodel of security games. However, the security gameframework is in general much more expressive. Themodel [Kiekintveld et al., 2009] includes a defender that con-trols multiple security resources, where each resource can beassigned to one of several schedules, which are subsets of tar-gets. For example, a security camera pointed in a specificdirection monitors all targets in its field of view. As auditgames are also applicable in the context of prevention, thenotion of schedules is also relevant for audit games. Other ex-tensions of security games are relevant to both prevention and

detection scenarios, including an adversary that attacks multi-ple targets [Korzhyk et al., 2011], and a defender with a bud-get [Bhattacharya et al., 2011]. Each such extension raisesdifficult algorithmic questions.

Ultimately, we view our work as a first step toward a com-putationally feasible model of audit games. We envision avigorous interaction between AI researchers and security andprivacy researchers, which can quickly lead to deployed ap-plications, especially given the encouraging precedent set bythe deployment of security games algorithms [Tambe, 2011].

References[Becker, 1968] Gary S. Becker. Crime and punishment: An

economic approach. Journal of Political Economy, 76:169,1968.

[Bhattacharya et al., 2011] Sayan Bhattacharya, VincentConitzer, and Kamesh Munagala. Approximation al-gorithm for security games with costly resources. InProceedings of the 7th international conference on In-ternet and Network Economics, WINE11, pages 1324,Berlin, Heidelberg, 2011. Springer-Verlag.

[Blocki et al., 2012] Jeremiah Blocki, Nicolas Christin,Anupam Datta, and Arunesh Sinha. Audit mechanismsfor provable risk management and accountable data gover-nance. In GameSec, 2012.

[Bodik et al., 2010] Peter Bodik, Moises Goldszmidt, Ar-mando Fox, Dawn B. Woodard, and Hans Andersen. Fin-gerprinting the datacenter: automated classification of per-formance crises. In Proceedings of the 5th European con-ference on Computer systems, EuroSys 10, 2010.

[Conitzer and Sandholm, 2006] Vincent Conitzer and Tuo-mas Sandholm. Computing the optimal strategy to committo. In ACM Conference on Electronic Commerce, 2006.

[Garg et al., 2011] Deepak Garg, Limin Jia, and AnupamDatta. Policy auditing over incomplete logs: theory, im-plementation and applications. In ACM Conference onComputer and Communications Security, 2011.

[Horner, 1819] W. G. Horner. A new method of solving nu-merical equations of all orders, by continuous approxima-tion. Philosophical Transactions of the Royal Society ofLondon, 109:308335, 1819.

[Karmarkar, 1984] Narendra Karmarkar. A new polynomial-time algorithm for linear programming. In STOC, 1984.

[Kiekintveld et al., 2009] Christopher Kiekintveld, ManishJain, Jason Tsai, James Pita, Fernando Ordonez, andMilind Tambe. Computing optimal randomized resourceallocations for massive security games. In Proceed-ings of The 8th International Conference on AutonomousAgents and Multiagent Systems - Volume 1, AAMAS 09,pages 689696. International Foundation for AutonomousAgents and Multiagent Systems, 2009.

[Korzhyk et al., 2010] Dmytro Korzhyk, Vincent Conitzer,and Ronald Parr. Complexity of computing optimal stack-elberg strategies in security resource allocation games. InAAAI, 2010.

[Korzhyk et al., 2011] Dmytro Korzhyk, Vincent Conitzer,and Ronald Parr. Security games with multiple attackerresources. In IJCAI, pages 273279, 2011.

[Lenstra et al., 1982] A.K. Lenstra, H.W.jun. Lenstra, andLaszlo Lovasz. Factoring polynomials with rational co-efficients. Math. Ann., 261:515534, 1982.

[Neumaier, 2004] Arnold Neumaier. Complete search incontinuous global optimization and constraint satisfaction.Acta Numerica, 13:271369, 2004.

[Pita et al., 2008] James Pita, Manish Jain, FernandoOrdonez, Christopher Portway, Milind Tambe, CraigWestern, Praveen Paruchuri, and Sarit Kraus. Armorsecurity for los angeles international airport. In AAAI,pages 18841885, 2008.

[Pita et al., 2011] James Pita, Milind Tambe, ChristopherKiekintveld, Shane Cullen, and Erin Steigerwald. Guards- innovative application of game theory for national airportsecurity. In IJCAI, pages 27102715, 2011.

[Schonhage, 1982] A. Schonhage. The fundamental theoremof algebra in terms of computational complexity. Techni-cal report, University of Tubingen, 1982.

[Tambe, 2011] Milind Tambe. Security and Game Theory:Algorithms, Deployed Systems, Lessons Learned. Cam-bridge University Press, 2011.

[Vaughan et al., 2008] Jeffrey A. Vaughan, Limin Jia, KarlMazurak, and Steve Zdancewic. Evidence-based audit. InCSF, pages 177191, 2008.

[von Stackelberg, 1934] H. von Stackelberg. Marktform undGleichgewicht. - Wien & Berlin: Springer 1934. VI, 138 S.8. J. Springer, 1934.

[Zhao and Johnson, 2008] Xia Zhao and Eric Johnson. In-formation governance: Flexibility and control through es-calation and incentives. In WEIS, 2008.

[Zheng et al., 2006] Alice X. Zheng, Ben Liblit, and MayurNaik. Statistical debugging: simultaneous identification ofmultiple bugs. In In ICML 06: Proceedings of the 23rd in-ternational conference on Machine learning, pages 11051112, 2006.

A Missing proofsProof of Lemma 1. We prove the contrapositive. Assumethere exists a i such that pi 6= 0 and the ith quadratic con-straint is not tight. Thus, there exists an > 0 such that

pi(xo i) + p

on(x

o +n) + i,n + = 0 .

We show that it is possible to increase to pon by a small amountsuch that all constraints are satisfied, which leads to a higherobjective value, proving that pon, xo is not optimal. Remem-ber that all s are 0, and x > 0.

We do two cases: (1) assume l 6= n. pon(xo+n)+l,n 6=0. Then, first, note that pon can be increased by i or less andand pi can be decreased by i to still satisfy the constraint, aslong as

i(xo +i) + i(x

o +n) .

It is always possible to choose such i > 0, i > 0. Second,note that for those js for which pj = 0 we get pon(xo+n)+j,n 0, and by assumption pon(xo +n) + j,n 6= 0, thus,pon(x

o +n) + j,n < 0. Let j be such that (po + j)(xo +)+ j, = 0, i.e., pon can be increased by j or less and thejth constraint will still be satisfied. Third, for those ks forwhich pk 6= 0, pon can be increased by k or less, which mustbe accompanied with k = x

o+xo+i

k increase in pk in orderto satisfy the kth quadratic constraint.

Choose feasible ks (which fixes the choice of k also)such that i

k

k > 0. Then choose an increase in pi:

i < i such that

n = i

k

k > 0 and n < min{i,minpj=0

j , minpk 6=0

k}

Increase pon by n, pks by k and decrease pi by i so thatthe constraint

i pi = 1 is still satisfied. Also, observe that

choosing an increase in pon that is less than any k, any j , isatisfies the quadratic constraints corresponding to pks, pjsand pi respectively. Then, as n > 0 we have shown that poncannot be optimal.

Next, for the case (2) if pon(xo +n) + l,n = 0 for somel then pl = 0, , l,n < 0 and the objective becomes

pnn l,npn

n .

Thus, increasing pn increases the objective. Note that choos-ing a lower than xo feasible value for x, results in an higherthan pon value for pn. Also, the kth constraint can be writtenas pk(xk)+k,nl,n 0. We show that it is possibleto choose a feasible x lower than xo. If for some j, pj = 0,then x can be decreased without violating the correspondingconstraint. Let pts be the probabilities that are non-zero andlet the number of such pts be T . By assumption there is ani 6= l such that pi > 0 and

pi(xo i) + i,n l,n + = 0 .

For i, it is possible to decrease pi by i such that i(xo +i) /2, hence the constraint remains satisfied and is stillnon-tight.

Increase each pt by i/T so that the constraint

i pi = 1

is satisfied. Increasing pt makes the tth constraint becomesnon-tight for sure. Then, all constraints with probabilitiesgreater than 0 are non-tight. For each such constraint it ispossible to decrease x (note xo > 0) without violating theconstraint.Thus, we obtain a lower feasible x than xo, hencea higher pn than pon. Thus, pon, xo is not optimal.

Proof of Lemma 3. If pon(xo +n) + i,n 0 and pon(xo +n) + j,n < 0, where j,n < i,n and k. j,n < k,n we have

A X

B + Y>

A

B(1 (

X

A+Y

B)) > pn(1 (

X

+ Y ))

And, as pn < 1 we have F (x) > pn (X + Y ). Thus,F (x) > pn min{,

X + Y }. The minimum is less that

the positive root of 2 Y X = 0, that is Y+Y 2+4X2 .

B Dummy TargetLemma 9. If a dummy target t0 is present for the optimiza-tion problem described in Section 2, then p0 = 0 at optimalpoint pon, xo, where xo > 0.

Proof. We prove a contradiction. Let p0 > 0 at optimal point.If the problem under consideration is when n represents 0, theobjective is not dependent on pn and thus, then we want tochoose x as small as possible to get the maximum objectivevalue. The quadratic inequalities are pi(xo i) + i,0 0. Subtracting from p0 and adding /n to all the other pi,satisfies the

i pi = 1 constraint. But, adding /n to all

the other pi, allows reducing xo by a small amount and yet,satisfying each quadratic constraint. But, then we obtain ahigher objective value, hence xo is not optimal.

Next, if the problem under consideration is when n doesnot represents 0, then an extra constraint is pon(xo + n) +0,n 0. Subtracting from p0 and adding /(n 1) to allthe other pi (except pon), satisfies the

i pi = 1 constraint.

Also, each constraint pi(xoi)+ pon(xo+n)+ i,n 0 becomes non-tight (may have been already non-tight) as aresult of increasing pi. Thus, now xo can be decreased (notexo > 0). Hence, the objective increases, thus pon, xo is notoptimal.

1 Introduction1.1 Our Model1.2 Our Results1.3 Related Work

2 The Audit Game Model3 Computing an Audit Strategy3.1 High-Level Overview3.2 Algorithm and Main Result3.3 Analysis

4 DiscussionA Missing proofsB Dummy Target