Bounded-Loss Private Prediction Markets

In a prediction market, a platform maintains a prediction (usually a probability distribution or an expectation) of a future random variable such as an election outcome. Participants’ trades of financial securities tied to this event are translated into updates to the prediction. Prediction markets, designed to aggregate information from participants, have gained a substantial following in the machine learning literature. One reason is the overlap in goals (predicting future outcomes) as well as techniques (convex analysis, Bregman divergences), even at a deep level: the form of market updates in standard automated market makers have been shown to mimic standard online learning or optimization algorithms in many settings Frongillo et al. (2012); Abernethy et al. (2013, 2014a); Frongillo and Reid (2015). Beyond this research-level bridge, recent papers have suggested prediction market mechanisms as a way of crowdsourcing data or algorithms for machine learning, usually by providing incentives for participants to repeatedly update a centralized hypothesis or prediction Abernethy and Frongillo (2011); Waggoner et al. (2015).

One recently-proposed mechanism to purchase data or hypotheses from participants is that of Waggoner, et al. Waggoner et al. (2015), in which participants submit updates to a centralized market maker, either by directly altering the hypothesis, or in the form of submitted data; both are interpreted as buying or selling shares in a market, paying off according to a set of holdout data that is revealed after the close of the market. The authors then show how to preserve differential privacy for participants, meaning that the content of any individual update is protected, as well as natural accuracy and incentive guarantees.

One important drawback of Waggoner, et al. Waggoner et al. (2015), however, is the lack of a bounded worst-case loss guarantee: as the number of participants grows, the possible financial liability of the mechanism grows without bound. In fact, their mechanism cannot achieve a bounded worst-case loss without giving up privacy guarantees. Subsequently, Cummings, et al. Cummings et al. (2016) show that all differentially-private prediction markets of the form proposed in Waggoner et al. (2015) must suffer from unbounded financial loss in the worst case. Intuitively, one could interpret this negative result as saying that the randomness of the mechanism, which must be introduced to preserve privacy, also creates arbitrage opportunities for participants: by betting against the noise, they collectively expect to make an unbounded profit from the market maker. Nevertheless, Cummings, et al. leave open the possibility that mechanisms outside the mold of Waggoner, et al. could achieve both privacy and a bounded worst-case loss.

In this paper, we give such a mechanism: the first private prediction market framework with a bounded worst-case loss. When applied to the crowdsourcing problems stated above, this now allows the mechanism designer to maintain a fixed budget. Our construction and proof proceeds in two steps.

We first show that by adding a small transaction fee to the mechanism of Waggoner et al. (2015), one can eliminate financial loss due to arbitrage while maintaining the other desirable properties of the market. The key idea is that a carefully-chosen transaction fee can make each trader subsidize (in expectation) any arbitrage that may result from the noise preserving her privacy. Unless prices already match her beliefs quite closely, however, she still expects to make a profit by paying the fee and participating. We view this as a positive result both conceptually—it shows that arbitrage opportunities are not an insurmountable obstacle to private markets—and technically—the designer budget grows very slowly, only $O((\log T)^{2})$, with the number of participants $T$.

Nonetheless, this first mechanism is still not completely satisfactory, as the budget is superconstant in $T$, and $T$ must be known in advance. This difficulty arises not from arbitrage, but (apparently) a deeper constraint imposed by privacy that forces the market to be large relative to the participants. Our second and main result overcomes this final hurdle. We construct a sequence of adaptively-growing markets that are syntactically similar to the “doubling trick” in online learning. The key idea is that, in the market from our first result, only about $(\log T)^{2}$ of the $T$ participants can be informational traders; after this point, additional participants do not cost the designer any more budget, yet their transaction fees can raise significant funds. So if the end of a stage is reached, the market activity has actually generated a surplus which subsidizes the initial portion of the next stage of the market.

In a cost-function based prediction market, there is an observable future outcome $Z$ taking values in a set $\mathcal{Z}$. The goal is to predict the expectation of a random variable $\phi:\mathcal{Z}\to\mathbb{R}^{d}$. We assume $\phi$ is a bounded random variable, as otherwise prediction markets with bounded financial loss are not possible. Participants will buy from the market contracts, each parameterized by a vector $r\in\mathbb{R}^{d}$. The contract represents a promise for the market to pay the owner $r\cdot\phi(Z)$ when $Z$ is observed. Adopting standard financial terminology, in our model there are $d$ securities $j=1,\dots,d$, and the owner of a share in security $j$ will receive a payoff of $\phi(Z)_{j}$, that is, the $j$th component of the random variable. Thus a contract $r\in\mathbb{R}^{d}$ contains $r_{j}$ shares of security $j$ and pays off $\sum_{j=1}^{d}r_{j}\phi(Z)_{j}=r\cdot\phi(Z)$. Note that $r_{j}<0$, or “short selling” security $j$, is allowed.

The market maintains a market state $q^{t}\in\mathbb{R}^{d}$ at time $t=0,\dots,T$, with $q^{0}=0$. Each trader $t=1,\dots,T$ arrives sequentially and purchases a contract $dq^{t}\in\mathbb{R}^{d}$, and the market state is updated to $q^{t}=q^{t-1}+dq^{t}$. In other words, $q^{t}=\sum_{s=1}^{t}dq^{s}$, the sum of all contracts purchased up to time $t$. The price paid by each participant is determined by a convex cost function $C:\mathbb{R}^{d}\to\mathbb{R}$. Intuitively, $C$ maps $q^{t}$ to the total price paid by all agents so far, $C(q^{t})$. Thus, participant $t$ making trade $dq^{t}$ when the current state is $q^{t-1}$ pays $C(q^{t-1}+dq^{t})-C(q^{t-1})$. Notice that the instantaneous prices $p^{t}=\nabla C(q^{t})$ represent the current price per unit of infinitesimal purchases, with the $j$th coordinate representing the current price per share of the $j$th security.

The prices $\nabla C(q)$ are interpreted as predictions of $\operatorname*{\mathbb{E}}\phi(Z)$, as an agent who believes the $j$th coordinate is too low will purchase shares in it, raising its price, and so on. This can be formalized through a learning lens: It is known (Abernethy et al., 2013) that agents in such a market maximize expected profit by minimizing an expected Bregman divergence between $\phi(Z)$ and $\nabla C(q)$; of course, it is known that $\nabla C(q)=\operatorname*{\mathbb{E}}\phi(Z)$ minimizes risk for any divergence-based loss Savage (1971); Banerjee et al. (2005); Abernethy and Frongillo (2012). (The Bregman divergence is that corresponding to $C^{*}$, the convex conjugate of $C$.)

Price Sensitivity.  The price sensitivity of a cost function $C$ is a measure of how quickly prices respond to trades, similar to “liquidity” discussed in Abernethy et al. (2013, 2014b) and earlier works. Formally, the price sensitivity $\lambda$ of $C$ is the supremum of the operator norm of the Hessian of $C$, with respect to the $\ell_{1}$ norm.¹¹1For convenience we will assume $C$ is twice differentiable, though this is not necessary. In other words, if $c=\|q-q^{\prime}\|_{1}$ shares are purchased, then the change in prices $\|\nabla C(q)-\nabla C(q^{\prime})\|_{1}$ is at most $\lambda c$.

Price sensitivity is directly related to the worst-case loss guarantee of the market, as follows. Those familiar with market scoring rules may recall that with scoring rule $S$, the loss can be bounded by (a constant times) the largest possible score. Hence, scaling $S$ by a factor $\frac{1}{\lambda}$ immediately scales the loss bound by $\frac{1}{\lambda}$ as well. Recall that $S$ is defined by a convex function $G$, the convex conjugate of $C$. Scaling $S$ by $\frac{1}{\lambda}$ is equivalent to scaling $G$ by $\frac{1}{\lambda}$. By standard results in convex analysis, this is equivalent to transforming $C$ into $C_{\lambda}(q)=\frac{1}{\lambda}C\left(\lambda q\right)$, an operation known as the perspective transform. This in turn scales the price sensitivity by $\lambda$ by the properties of the Hessian.

Price sensitivity is also related to the total number of trades required to change the prices in a market. If we assume each trade consists of at most one share in each security, then $\frac{1}{\lambda}$ trades are necessary to shift the predictions to an arbitrary point from an arbitrary point.

Convention: normalized, scaled $C$.  In the remainder of the paper, we will suppose that we start with some convex cost function $C_{1}$ whose price sensitivity equals $1$ and worst-case loss bounded by some constant $B_{1}$. Then, to obtain price sensitivity $\lambda$, we use the cost function $C(\cdot)=\frac{1}{\lambda}C_{1}(\lambda\cdot)$. As discussed above, $C$ has price sensitivity at most $\lambda$ and a worst-case loss bound of $B=B_{1}/\lambda$. (This assumption is without loss of generality, as any cost function that guarantees a bounded worst-case loss can be scaled such that its price sensitivity is $1$.)

The private market of Waggoner et al. (2015) causes unbounded loss for the market maker in two ways. The first is from traders betting against the random noise introduced to protect privacy. This is a key idea leveraged by Cummings et al. (2016) to show negative results for private markets. In this section, we show that a transaction fee can be chosen to exactly balance the expected profit from this type of arbitrage.²²2Intuitively, it is enough for the fee to cover arbitrage amounts in expectation, because a trader must pay the fee to trade before the random noise is drawn and any arbitrage opportunity is revealed. We will show that this fee is still small enough to allow for very accurate prices.³³3For instance, if the current price of a security is $0.49$ and a trader believes the true price should be $0.50$, she will purchase a share if the fee is $c<0.01$. (For privacy, we limit each trade to a fixed size, say, one share.) This transaction fee restores the worst-case loss guarantee to the inverse of the price sensitivity, just as in a non-private market. The second way the market causes unbounded loss is to require price sensitivity to shrink as a function of $T$; this is addressed in the next section.

We show that with this carefully-chosen fee, the market still achieves precision, incentive, and privacy guarantees, but now with a worst-case market maker loss of $O((\log T)^{2})$, much improved over the naïve $O(T)$ bound. This is viewed as a positive result because the worst-case loss is growing quite slowly in the total number of participants, and moreover matches the fundamental “informational” worst-case loss one expects with price sensitivity $\lambda^{*}$.

In this section, we achieve our original goal by constructing an adaptively-growing prediction market in which each stage, if completed, subsidizes the initial portion of the next.

The market design is the following, with each $T^{(k)}$ to be chosen later. We run the transaction-fee private market above with $T=T^{(1)}$, transaction fee $\alpha$, and price sensitivity $\lambda^{(1)}=\lambda^{*}(T^{(1)},\alpha/2,\gamma/2)$ from eq. (1). When (and if) $T^{(1)}$ participants have arrived, we create a new market whose initial state is such that its prices match the final (noisy) prices of the previous one. We set $T^{(2)}$ and price sensitivity $\lambda^{(2)}=\lambda^{*}(T^{(2)},\alpha/4,\gamma/4)$ for the new market. We repeat, halving $\alpha$ and $\gamma$ at each stage and increasing $T$ in a manner to be specified shortly, until no more participants arrive.

Proof idea.  We set $T^{(1)}=\Theta\bigl{(}\frac{B_{1}d\ln(B_{1}d/\gamma\alpha\epsilon)^{2}}{\alpha^{2}~\epsilon}\bigr{)}$, and $T^{(k)}=4T^{(k-1)}$ thereafter. The key will be the following observation. The total “informational” profit available to the traders (by correcting the initial market prices) is bounded by $O(1/\lambda)$, so if each trader expects to profit more than the transaction fee $c$, then only $O(1/\lambda c)$ traders can all arrive and simultaneously profit. Indeed, if all $T$ participants arrive, then the total profit from transaction fees is $\Theta(T)$ while the worst-case loss from the market is $O\left((\log T)^{2}\right)$.

We can leverage this observation to achieve a bounded worst-case loss with an “adaptive-liquidity” approach, similar in spirit to Abernethy et al. (2014b) but more technically similar to the doubling trick in online learning. Begin by setting $\lambda^{(1)}$ on the order of $1/(\log T^{(1)})^{2}=\Theta(1)$, and run a private market for $T^{(1)}$ participants. If fewer than $T^{(1)}$ participants show up, the worst-case loss is order $1/\lambda^{(1)}$, a constant. If all $T^{(1)}$ participants arrive, then (for the right choice of constants) the market has actually turned a profit $\Omega(T^{(1)})$ from the transaction fees. Now set up a private market for $T^{(2)}=4T^{(1)}$ traders with $\lambda^{(2)}$ on the order of $1/(\log T^{(2)})^{2}$. If fewer than $T^{(2)}$ participants arrive, the worst-case loss is order $1/\lambda^{(2)}$. However, we will have chosen $T^{(2)}$ such that this loss is smaller than the $\Omega(T^{(1)})$ profit from the previous market. Hence, the total worst-case loss remains bounded by a constant.

If all $T^{(2)}$ participants arrive, then again this market has turned a profit, which can be used to completely offset the worst-case loss of the next market, and so on. Some complications arise, as to achieve $(\alpha,\gamma)$-precision, we must set $\alpha^{(1)},\gamma^{(1)},\alpha^{(2)},\gamma^{(2)},\dots$ as a convergent series summing to $\alpha$ and $\gamma$; and we must show that all of these scalings are possible in such a way that the transaction fees cover the cost of the next iteration. (An interesting direction for future work would be to replace the iterative approach here with the continuous liquidity adaptation of Abernethy et al. (2014b).)

More specifically, we prove that the loss in any round $k$ that is not completed (not all participants arrive) is at most $\frac{\alpha}{16}T^{(k)}$; moreover, the profit in any round $k$ that is completed is at least $\frac{\alpha}{2}T^{(k)}$. Of course, only one round is not completed: the final round $k$. If $k=1$, then the financial loss is bounded by $\frac{1}{\lambda^{(1)}}$, a constant depending only on $\alpha,\gamma,\epsilon$. Otherwise, the total loss is the sum of the losses across rounds, but the mechanism makes a profit in every round but $k$. Moreover, the loss in round $k$ is at most $\frac{\alpha}{2}T^{(k)}=\frac{\alpha}{8}T^{(k-1)}$, which is at most half of the profit in round $k-1$. So if $k\geq 2$, the mechanism actually turns a net profit.

While this result may seem paradoxical, note that the basic phenomenon appears in a classical (non-private) prediction market with a transaction fee, although to our knowledge this observation has not yet appeared in the literature. Specifically, a classical prediction market with budget bound $B_{1}$, trades of size $1$, and a small transaction fee $\alpha$, will still have an $\alpha$-incentive to participate, and the worst case loss will still be $\Theta(B_{1})$; this loss, however, can be extracted by as few as $\Theta(1)$ participants. Any additional participants must be in a sense disagreeing about the correct prices; their transaction fees go toward market maker profit, but they do not contribute further to worst-case loss.

While preserving privacy in prediction markets is well-motivated in the classical prediction market setting, it is arguably even more important in a setting where machine-learning hypotheses are learned from private personal data. Waggoner et al. Waggoner et al. (2015) develop mechanisms for such a setting based on prediction markets, and further show how to preserve differential privacy of the participants. Yet their mechanisms are not practical in the sense that the financial loss of the mechanism could grow without bound. In this section, we sketch how our bounded-financial-loss market can also be extended to this setting. This yields a mechanism for purchasing data for machine learning that satisfies $\epsilon$-differential privacy, $\alpha$-precision and incentive to participate, and bounded designer budget.

To develop a mechanism which could be said to “purchase data” from participants, Waggoner et al. Waggoner et al. (2015) extend the classical setting in two ways. The first is to make the market conditional, where we let $\mathcal{Z}=\mathcal{X}\times\mathcal{Y}$, and have independent markets $C_{x}:\mathbb{R}^{d}\to\mathbb{R}$ for each $x$. Trades in each market take the form $q_{x}\in\mathbb{R}^{d}$, which pay out $q_{x}\cdot\phi(y)$ upon outcome $(x^{\prime},y)$ if $x=x^{\prime}$, and zero if $x\neq x^{\prime}$. Importantly, upon outcome $(x,y)$, only the costs associated to trades in the $C_{x}$ market are tallied.

The second is to change the bidding language using a kernel, a positive semidefinite function $k:\mathcal{Z}\times\mathcal{Z}\to\mathbb{R}$. Here we think of contracts as functions $f:\mathcal{Z}\to\mathbb{R}$ in the reproducing kernel Hilbert space (RKHS) $\mathcal{F}$ given by $k$, with basis $\{f_{z}(\cdot)=k(z,\cdot)~:~z\in\mathcal{Z}\}$. For example, we recover the conditional market setting with independent markets with the kernel $k((x,y),(x^{\prime},y^{\prime}))=\mathbf{1}\{x=x^{\prime}\}\phi(y)\cdot\phi(y^{\prime})$. The RKHS structure is natural here because a basis contract $f_{z}$ pays off at each $z^{\prime}$ according to the “covariance” structure of the kernel, i.e. the payoff of contract $f_{z}$ when $z^{\prime}$ occurs equals $f_{z}(z^{\prime})=k(z,z^{\prime})$. For example, when $\mathcal{Y}=\{-1,1\}$ one recovers radial basis classification using $k((x,y),(x^{\prime},y^{\prime}))=yy^{\prime}e^{-(x-x^{\prime})^{2}}$.

These two modifications to classical prediction markets, given as Mechanism 2 in Waggoner et al. (2015), have clear advantages as a mechanism to “buy data”. One may imagine that each agent, arriving at time $t\in\{1,\dots,T\}$, holds a data point $(x^{t},y^{t})\in\mathcal{Z}=\mathcal{X}\times\mathcal{Y}$. A natural purchase for this agent would be a basis contract $f_{(x^{t},y^{t})}$, as this corresponds to a payoff that is highest when the test data point actually equals $(x^{t},y^{t})$ and decreases with distance as measured by the kernel structure.

The importance of privacy now becomes even more apparent, as the data point $(x^{t},y^{t})$ could be information sensitive to trader $t$. Fortunately, we can extend our main results to this setting. To demonstrate the idea, we give a sketch of the result and proof below.

We close by noting the similarity between the kernel adaptive market mechanism and traditional learning algorithms, as alluded to in the introduction. As observed by Abernethy, et al. Abernethy et al. (2013), the market price update rule for classical prediction markets resembles Follow-the-Regularized-Leader (FTRL); specifically, the price update at time $t$ is given by $p^{t}=\nabla C(q^{t})=\operatorname*{\text{argmax}}_{w\in\Delta(\mathcal{Y})}\langle w,\sum_{s\leq t}dq^{s}\rangle-R(w)$, where $dq^{s}$ is the trade at time $s$, and $R=C^{*}$ is the convex conjugate of $C$.

In our RKHS setting, we can see the same relationship. For concreteness, let $C_{x}(q)=\tfrac{1}{\lambda}C(\lambda q)$ for all $x\in\mathcal{X}$, and let $R:\Delta(\mathcal{Y})\to\mathbb{R}$ be the conjugate of $C$. Suppose further that each agent $t$ purchases a basis contract $df^{t}=f_{x^{t},y^{t}}$, where we take a classification kernel $k^{\prime}((x,y),(x^{\prime},y^{\prime}))=k(x,x^{\prime})\mathbf{1}\{y=y^{\prime}\}$. Letting $dq^{t}(x)=df^{t}(x,\cdot)\in\mathbb{R}^{\mathcal{Y}}$, the market price at time $t$ is given by,

where $\mathbf{1}_{y}$ is an indicator vector. Thus, the market price update follows a natural kernel-weighted FTRL algorithm, where the learning rate $\lambda$ is the price sensitivity of the market.

Motivated by the problem of purchasing data, we gave the first bounded-budget prediction market mechanism that achieves privacy, incentive alignment, and precision (low impact of privacy-preserving noise the predictions). To achieve bounded budget, we first introduced and analyzed a transaction fee, achieving a slowly-growing $O((\log T)^{2})$ budget bound, thus eliminating the arbitrage opportunities underlying previous impossibility results. Then, observing that this budget still grows in the number of participants $T$, we further extended these ideas to design an adaptively-growing market, which does achieve bounded budget along with privacy, incentive, and precision guarantees.

We see several exciting directions for future work. An extension of Theorem 4 where $\mathcal{Y}$ need not be finite should be possible via a suitable generalization of Claim 2. Another important direction is to establish privacy for parameterized settings as introduced by Waggoner, et al. Waggoner et al. (2015), where instead of kernels, market participants update the (finite-dimensional) parameters directly as in linear regression. Finally, we would like a deeper understanding of the learning–market connection in nonparametric kernel settings, which could lead to practical improvements for design and deployment.