As the gap between objective and subjective fairness resides on the need for reasoning and justification, explanations (Čyras et al., 2019; Rosenfeld and Richardson, 2019; Sovrano and Vitali, 2021) artlessly lend themselves as desirable tools to address this issue. This is the focus of much of prior literature concerning explanations to human users. However, also a concern is about explanations between artificial agents themselves, or from a human to an artificial agent. Thus, in a fairness-aware decentralised system with disputed resources, agents with explainable capabilities can expound the reasons for deserving resources in a dialogue that is informed by their respective observations and grounded to a mutually agreed-upon definition of what is and is not fair, or a fairness culture.

Since the concerns for fairness also gravitate around the integration of humans and agents together via reasoning, we lean on architectures for explainable human-agent deconfliction (Raymond et al., 2020). Ideally, participants in a multi-agent system should engage in dialogues (Jakobovits and Vermeir, 1999; Modgil and Luck, 2009) and provide explanations for claiming specific resources. One approach for this problem is computational argumentation, a model for reasoning which represents information as arguments and supports defeasible reasoning capabilities—as well as providing convincing explanations to all agents involved (Dung, 1995; Amgoud and Prade, 2009; Fan and Toni, 2015).

However, not every scenario or application allows for unrestricted exchange of information between agents (Dwork and Roth, 2014). Sensitivity and confidentiality aggravate the poignancy of privacy concerns, rendering the subjective perception of fairness issue, at best, non-trivial when privacy is concerned. We defend subjective fairness as a perennial dimension of the fairness argument whenever a system has non-global knowledge or privacy is concerned.

Whilst the dimensions of privacy, subjective fairness, and objective fairness are desirable in all systems, the simultaneous maximisation of all those aspects is often irreconcilable. If the agents lack full information, there cannot be any guarantee of an objectively fair outcome. Additionally, if there are privacy considerations, subjective fairness cannot be guaranteed as the agent requesting a resource does not receive justification for denial. Therefore, with privacy, neither objective nor subjective fairness is achieved.

This perspective can be observed in society. We illustrate this point as a situation where two passengers are disputing a priority seat in public transport. Even if both individuals are truthful and subscribe to the same culture of fairness (e.g., both agree that a pregnant person should have priority over someone who just feels tired), they must still share information regarding their own personal condition (and therefore, their reasons to justify their belief) to determine who should sit down. How much is each person willing to divulge in order to obtain that resource? Assuming that these individuals have a finite and reasonably realistic threshold on how much privacy they are willing to abdicate for a seat, certain situations will inevitably engender the dilemma of either: 1) forfeiting the dispute and conceding the resource to observe their privacy limit, or 2) exceeding their reservations in privacy and revealing more information than they should in order to remain in contention.

With adamantine restraints on privacy, contenders will always concede and end the debate if presenting a superior reason would exceed their limits of divulged information. Note that this does not mean that the conceding party agrees with the outcome. After all, if a debate was lost exclusively due to the inviolability of privacy, then the loser must still hold an argument that they would have used to trump their opponent, had it not been precluded by privacy limits. Objectively, the fair decision can only be guaranteed if all relevant information is made available by all parties for a transparent and reasonable judgment. In the subjective perception of the bested agent, they still believe they have a superior reason at that point in time, and are left with no choice but to civilly agree to disagree.

Studies of privacy in multi-agent systems have gained recent popularity (Such et al., 2014; Prorok and Kumar, 2017; Torreno et al., 2017). More closely (Gao et al., 2016), also propose the use of argumentation in privacy-constrained environments, although applied to distributed constraint satisfaction problems. Their approach, however, treats privacy in an absolute way, while in our notion is softer, with information having costs, and we consider varying degrees of privacy restrictions.

Contemporaneously, the burgeoning research on fairness in multi-agent systems focuses on objective global fairness, assuming complete knowledge about all agents (Bin-Obaid and Trafalis, 2018). Some works break the global assumption by applying fairness definitions to a neighborhood rather than an entire population (Emelianov et al., 2019) or by assuming that fairness solely depends on an individual (Nguyen and Rothe, 2016). The former studies objective fairness of a neighborhood, assuming full information of a subset of the population subset, whilst the latter assumes agents have no information outside of their own to make judgments about fairness. These works do not address fairness under partial observability, wherein agents have partial information on a subset of the population, which we call subjective local fairness.

To study privacy and subjective fairness in distributed multi-agent environments, we look to previous work in explainable human-agent deconfliction. The architecture proposed in (Raymond et al., 2020) introduces a model for explainable conflict resolution in multi-agent norm-aware environments by converting rules into arguments in a culture (see Section 2.1). Disputes between agents are solved by a dialogue game, and the arguments uttered in the history of the exchange compose an explanation for the decision agreed upon by the agents.

Notwithstanding its abstract nature, this architecture relies on two important assumptions: 1) that agents have complete information about themselves and other agents; and 2) that dialogues extend indefinitely until an agent is cornered out of arguments—thus being convinced to concede. In most real-life applications, however, those assumptions occur rather infrequently. Fully decentralised agents often rely on local observations and communication to compose partial representations of the world state, and indefinite dialogues are both practically and computationally restrictive. We build on the state of the art by extending this architecture to support gradual disclosure of information and privacy restrictions.

This paper stages the ensuing contributions:

• We present an architecture for multi-agent privacy-aware conflict resolution using cultures and dialogue games.

The structure of this paper follows as: Section 2 introduces prior background from literature used in our study. In Section 3, we introduce an argumentation-based architecture for decentralised conflict resolution under privacy-restricted communication. We provide an abstract formalism of the dimensions of fairness in conflict resolution in Section 4. Then, we use the contributions of those two sections in Sections 5, 6 to perform empirical experiments on abstract conflicts and on an applied multi-agent collision avoidance scenario, respectively. Our results show that using better argumentative strategies suggests Pareto improvements for the fairness-privacy trade-off.

The concept of culture (Raymond et al., 2020) reflects a collective agreement of norms and priorities in a multi-agent system, checked dynamically by means of verifier functions. Abstract Argumentation Frameworks (Dung, 1995) are used to underpin the mechanics of cultures and conflict resolution dialogues.

Definition 2.1

(Argumentation Framework). An argumentation framework is a digraph A F = ( A , R ) , where A is a set of arguments (vertices) and R ⊆ A × A is a set of attack relations between arguments (arcs). We say attacks(a, b) holds iff ( a , b ) ∈ R . Stating attacks(a, b) is intuitively equivalent to defining that an argument b is defeated by argument a. Likewise, a set S ⊆ A of arguments attacks another set of arguments T (or T is attacked by S) if any argument in S attacks an argument in T. An argument a ∈ A is acceptable with respect to a set S of arguments iff for each argument b ∈ A that attacks a there is a c ∈ S that attacks b. In that case, c is said to defend a. A set S of arguments is conflict-free iff for all a, b ∈ S, ( a , b ) ∉ R , and admissible iff it is conflict-free and all its arguments are acceptable with respect to S.

The notion of extensions (Doutre and Mengin, 2001) presents itself as semantics of acceptance for sets of arguments.

Definition 2.2

(Preferred Extension). Let A F = ( A , R ) be an argumentation framework and S ⊆ A be a set of arguments. We say S is a preferred extension of AF iff: S is conflict-free, defends all arguments in S, and is a maximal element among all admissible sets, with respect to set-theoretical inclusion. If an argument a ∈ A is present in all preferred extensions of AF, we say a is sceptically accepted in the preferred extensions.

These definitions create the foundation for conflict resolution through dialectical interaction. Let A be the set of all existing agents in a multi-agent environment. When pairwise conflicts occur between agents q _i , q _j ∈ A, the two agents serve as players in a dialectical game, or dialogue, to resolve the conflict, and they take up the roles of proponent (pr) or opponent (op), where q _i ∈ {pr, op}, and q _j ∈ {pr, op}\ q _i , without loss of generality. These dialogues are sequential in nature, where players utter arguments and attempt to defeat the previously-used argument by their adversary. When a player can no longer choose a valid argument, they lose the game and concede the contended resource to the winner. Jakobovits and Vermeir (1999) delineate a formalism for dialectical games, and we adapt some of their definitions below for single-argument dialogues.

Definition 2.3

(Dialogue). Let a player w ∈ {pr, op} and an argument a ∈ A . The adversary of pr is denoted p r ̄ = o p , and o p ̄ = p r . A move is a pair (w, a). For a move m = (w, a), we use player(m) to denote w and arg(m) to denote a. A move is considered legal iff it does not attack itself and is not already attacked by a previously-uttered argument. We say a dialogue D is any countable sequence m ₀, m ₁, …, m _n of moves that satisfies:

(1) player ( m i + 1 ) = player ̄ ( m i ) , i.e., the players take turns.

The dialogue D is said to be about the position arg(m ₀). If there is no dialogue D′ = m ₀, m ₁, …, m _n , …, m _n′ that extends the D, then we say that player(m _n ) is the winner of D.

In such frameworks, arguments and attacks are static by nature and assumed true. Informally, the surviving sets of arguments under certain semantics (extensions) represent coherent conclusions given a fixed argumentation framework. This inflexibility is a strong limitation for dynamic interactive systems, where agents can have varied states and contexts, causing arguments to lose validity depending on the circumstances. Cultures for conflict resolution (Raymond et al., 2020) embody rules and norms as high-level, dynamic arguments that are shared and agreed upon between all agents in a system, and act as a template for generating argumentation frameworks dynamically to model the complexities that arise in multi-agent systems. During inference, arguments are dynamically verified for correctness given the required information from both agents, such as their current states, and the context of a specific dispute, e.g., the state of the environment.

Definition 2.4

(Culture). Let any two players pr, op be the proponent and opponent in a dialogue game. We say a motion is any argument a ∈ A that may be used by proponent pr to request a contended resource from opponent op. Let K ⊆ A be the set of all motions in A . Let R be the set of attacks between arguments in A . We say a multi-agent system has a culture C = ( A , R , K ) iff | K | > 0 and if all agents in A share a common culture C.

Definition 2.5

(Argument Verification). Let a ∈ A and w ∈ {pr, op} be an argument and a player, respectively. We denote a as demonstrable by agent-player w iff checking the correctness of that argument admits a finite and computable decision procedure. Let ζ denote the set of all possible contexts in the environment. ∀ a ∈ A , a admits a predicate function v a : w , z → { T r u e , F a l s e } , where w represents the player and z ∈ ζ is a context. We say v _a is the verifier function of argument a. Motions are hypothetical and their verifier functions always return T r u e . An argument a is demonstrably true by player w iff v a ( w , z ) = T r u e .

As shown in Example 3.1, when no information is available and arguments are comparative, agents can only raise hypotheses. Those serve as media for sharing information between agents, by enforcing that every agent shares their corresponding piece of information when eliciting a hypothesis, in order to avoid infinite exchanges arising from cycles of empty suppositions.

Once an agent raises a hypothesis and shares their pertaining information regarding an argument, the adversary should have enough information to effectively verify the argument into a fact, since it has full knowledge of its own description and was given the other agent’s partial description. This can be done without necessarily sharing further information.

Additionally, the relations between arguments need to be woven in such a way as to guarantee that hypotheses and facts only defeat the arguments pertaining to the adversary. In Example 3.1, if the same agent wants (and is able) to utter both arguments a and b, the attack (b, a) in the culture should not yield an actual attack in an instantiation if both arguments are articulated by the same agent. After all, having a trumping condition would be yet another reason in favor of—not against—the agent’s claim. Hence, assuring that attacks only occur between adversaries renders a bipartition in the culture and its arguments. The conjunction of those elements culminates in an alteroceptive culture.

Definition 3.1

(Alteroceptive Culture). Let C = ( A , R , K ) be a culture . We define the expansion function κ, that maps an argument a ∈ A to a set of new arguments (not in A ). For every a ∈ A \ K , κ ( a ) = { a H p r , a H o p , a F p r , a F o p } four new arguments that represent, respectively:

• a H p r : hypothesis (H) of a where proponent pr wins,

For motions in γ ∈ K , κ ( γ ) = { γ H p r , γ H o p } , since motions do not admit verification. We define the expanded set of arguments (in an alteroceptive culture) A x = ⋃ a ∈ A κ ( a ) . The expanded set of attacks R x is constructed from R and A , and satisfies the following rules (see Figure 1). For each element of κ(a), where a , b ∈ A and ( a , b ) ∈ R . For all w ∈ {pr, op}:

(1) ( a H w , a H w ̄ ) ∈ R x if a ∉ K , i.e., non-motion hypotheses mutually attack each other;

We say C x ( C ) = ( A x , R x ) is an alteroceptive expansion of C.

The separation between hypotheses and facts is important to introduce a mechanism for gradual disclosure of information.

Example 3.2

(Example 3.1). Given the original culture seen in Example 3.1, we can generate an extended set of arguments A x = ⋃ { κ ( γ ) , κ ( a ) , κ ( b ) } and the corresponding R x as described in Definition 3.1. Suppose, then, that Cadence raises the motion γ H Cad ≡ “I think I should have this seat,” to which Belle promptly replies with a H Belle ≡ “I may be older than you, I am 60 years old.” Figure 1 illustrates the expanded argument set in question. Note that Belle had to break privacy and reveal to Cadence “I am 60 years old” in order to use this argument. Cadence can now verify argument a F Cad (the fact argument that Cadence is older than Belle). If this argument is verified as True (i.e., Cadence is older than Belle), then Cadence has two options for rebuttal, depending on what information they intend to share:

(1) Use a F Cad , reveal their age and refute Belle’s claim of being older;

The example above shows that, for her next move, Cadence can choose to either reveal her age or health condition to progress the debate. This decision is affected by which aspect of its description an agent would like to keep private. Laying out arguments within this structure still allows for the same dialogue game rules as before, but without the original assumption of complete information. A dialogue under this framework would carry out normally and extend indefinitely as agents exchange moves until one of the agents loses by running out of arguments. Information can, therefore, still be communicated unreservedly. In the interest of quantifying relinquished privacy, we associate arguments to privacy costs.

Every argument in an alteroceptive culture corresponds to a concession of privacy through communication of one’s partial description. Fortunately, those changes preserve the structure of an argumentation framework, which makes alteroceptive cultures compatible with prior mechanics of dialogue, as well as extensions. Analogously to how humans are comfortable with sharing some types of personal information but not others, some features in agents’ descriptions might be considered more sensitive, and thus having a higher privacy cost to reveal. ¹ We combine the rules of dialogue (Definition 2.3) and the notion of privacy cost to provide an instantiation for our architecture.

Definition 3.2

(Privacy Cost and Budget). Let A x be the extended set of arguments of an alteroceptive culture. We say τ : A x → Z + is a privacy cost function. Let A be the set of all agents. We define β : A → Z + as the privacy budget function of an agent.

Definition 3.3

(Privacy-Aware Dialogue). Let w ∈ {pr, op} be any two players and D = m ₀, m ₁, …, m _n be a dialogue. Let moves ( w , n ) = ⋃ m i ∈ D ∈ D { m i ∣ player ( m i ) = w  and  i ≤ n } denote all the moves of a player w up to round n. We say a dialogue D is privacy-aware iff, in addition to the criteria in Definition 2.3, it also satisfies, for all n:

(6) β(player(m _i+1)) ≥∑τ(arg(m)), where m ∈ moves(player(m _i+1), i),

i.e., the player cannot cumulatively spend more than its privacy budget.

Our definition imposes a hard limit privacy: during a dialogue, agents cannot use an argument that would aggregately exceed their pre-defined privacy budgets. With finite privacy budgets, the assumption of dialogues extending indefinitely until reaching a unanimous conclusion no longer holds. Disputes end with an agent losing in one of two different ways. Either: 1) the agent runs out of arguments and is convinced out of the dialogue, or 2) the agent still has valid hypotheses and/or verified-facts that could attack the last move, but cannot afford to use them and is forced to concede. In the former case, both agents agree on the correct outcome as the losing agent did not have any valid reasons to challenge the winner. In the latter case, however, the agent concedes and interrupts the dialogue before having all arguments successfully refuted—as it prefers to preserve their privacy. The agents tolerate the result but do not agree with it: they agree to disagree.

Notably, the choice of arguments can have a decisive impact on the dialogue game. If we consider scenario (2) above to be less desirable than (1) for both agents, both agents must maximize the effectiveness of their moves so that dialogues end on the basis of argumentation instead of privacy budgets. Yet, optimal strategies are not readily available, as partial observability qualifies our privacy-aware dialogue game as a game of incomplete information. ²

With that in place, we next introduce our foundational terminology and abstract definitions governing the problem of subjective fairness in privacy-restricted decentralised conflict resolution.

We postulate that agents possess idiosyncratic features with varied values across a population, and that the set of all features that describe an agent is, by reason, called a description. In Example 3.1 above, Belle and Cadence have the features “age” and “health status.” Each feature takes a value, and the set of all feature values forms the description of each agent. Assume a distributed multi-agent setting where agents have perfect knowledge about their own features but none-to-partial knowledge about other agents’ descriptions. We first define the (full) description of an agent as an n-tuple of features.

Definition 4.1

(Description). For the rest of this section, we consider a fixed set A of existing agents in an environment and an underlying set F of all possible values of a feature. The set of features is I = {1, …, n}. We define F = F n as the set of feature descriptions, that is, the set of n-tuples, each entry representing the value of a feature. The description function d : A → F is a function that maps each agent to its full description in terms of features.

Since we are considering privacy-sensitive applications, we attribute a privacy cost to each feature, which is then aggregated to produce a cost for the full description. For brevity, all further mentions of cost shall refer exclusively to privacy cost. The constant u n k n o w n represents an undisclosed value of a feature.

Definition 4.2

(Privacy Cost). The set of private features is F p = F ∪ { u n k n o w n } . A partial description is an element of the set F p ∈ F p n , that is, an n-tuple where each entry, f p i , corresponds to either a feature value or to u n k n o w n . Each feature i ∈ I has an associated cost, k _i . A cost function is defined as τ : F p × I → Z + , such that τ ( f p i , i ) = 0 if f p i = { u n k n o w n } , and τ ( f p i , i ) = k i ∈ Z + , otherwise. Let x = ( x 1 , … , x n ) ∈ F p . The description cost function T : F p → Z + is given by T ( x ) = ∑ i ∈ I τ ( x i , i ) . For ease of notation, the feature index i is implied and we use the notation τ(x _i ) interchangeably without loss of generality.

We can now consider how agents interact: we denote every one-to-one interaction a conflict resolution dispute, or dispute, for brevity. Agents will act with antagonistic intent: one of them pushes for a change in the status quo, and is thus called proponent, while the other is called opponent. In such pairwise disputes between agents, we need a mechanism for defining what determines an objectively fair outcome of a contest, given two descriptions of agents. Following the idea behind cultures, we assume there is a shared definition of fairness across agents. ⁴ An objectively fair outcome disregards privacy, since it is the outcome which should be achieved under complete information.

As opposed to this perfect outcome, we also consider what an agent involved in a dispute considers a fair outcome. This we define as the subjectively fair outcome, according to one of the agents in the dispute, which is dependent on the information available to it. Any agent always has full information of oneself, but may only have partial information about the other party.

Definition 4.3

(Fair Outcomes). We define the set of roles in any dispute to be R = {pr, op}, two constant symbols denoting respectively “proponent” and “opponent,” for the rest of the section. An objectively fair outcome function ω : F × F → R receives the descriptions of the proponent and opponent agents, respectively, and decides which should win a dispute by returning the role of the winning agent in the dispute. The subjectively fair outcome function ω p : R × F × F p → R receives as input whether the agent under consideration (the subject) is the proponent or opponent, the description of the agent, and the private description of the adversary, and outputs the role of the agent which deserves to win the dispute.

The choice of information disclosure to the adversary is determined by a disclosed information function α, which takes an agent (who is deciding which information to disclose), as well as the adversary, and produces a partial description F p of the agent that fits under a specific privacy budget g ∈ Z + .

Definition 4.4

(Disclosed Information). We say α : A × A × Z + → F p is a disclosed information function if and only if, for any agents a, b ∈ A and privacy budget g ∈ Z + , α satisfies T ( α ( a , b , g ) ) ≤ g .

Once both agents made their decisions on how to generate their partial descriptions, the dispute resolution function returns the winner of a dispute with partial information on both sides.

Definition 4.5

(Dispute Resolution). A dispute resolution function ϕ : F p × F p → R decides whether the proponent or the opponent wins the contest given their partial feature descriptions, respectively, by returning the role of winning agent in the dispute.

The difference between functions ω, ω _p , and ϕ goes as follows: the first, ω, returns the objectively fair outcome if all information is public and mutually known between both agents (complete). The function ω _p represents the perspective of the subject upon receiving disclosed information from the adversary, after all, an agent always knows its full description but has partial information about other agents (depending on what is disclosed). Lastly, ϕ represents the final outcome given both agents’ partial descriptions, after the dispute is resolved in some way.

While those definitions cover the essential concepts for pairwise (i.e., local) interactions, we still lack a relation of such pairwise interactions to a global state of the system. We assume the existence of a set S of possible (global) states in which the system can be, with regards to the population of agents and a global notion of fairness. From an initial state, a set of local interactions transition the system into a final state. This is said to be the transition of the system.

Definition 4.6

(System Transition Function). Let A be the set of agents, α be a disclosed information function, ϕ the dispute resolution function, g a privacy budget, and S ₀ ∈ S a state (referred as the initial state). A system transition function σ is a function such that σ(A, α, ϕ, g, S ₀) ∈ S, and we call σ(A, α, ϕ, g, S ₀) = S _F the final state.

We have introduced two aspects of fairness: perspective and scope. Perspective differentiates objective from subjective fairness, while scope differentiates global from local fairness. We formalize divergences in conflict resolution outcomes through the notion of a fairness loss.

The outcomes of privacy-restricted fairness disputes may disagree with our previously-defined notions of fair outcomes. We introduce fairness loss functions as a means for comparing these.

The first definition for loss evaluates whether the dispute resolution outcome matches the objectively fair one, for a given privacy budget.

Definition 4.7

(Objective Local Fairness Loss). The objective local fairness loss function l O L : A × A × Z + → { 0,1 } is defined as l O L a , b , g = 0 , if  ϕ α a , b , g , α b , a , g = ω d a , d b 1 , otherwise where a, b ∈ A are agents, with a the proponent and b the opponent, and g ∈ Z + denotes a privacy budget.

Our second definition formalizes whether the dispute resolution outcome is the same as the subjectively fair outcome for the agent playing the role r in the dispute.

Definition 4.8

(Subjective Local Fairness Loss). The subjective local fairness loss function l S L : A × A × R × Z + → { 0,1 } is defined as l S L a , b , r , g = 0 , if  ϕ α a , b , g , α b , a , g = ω p r , d a , α b , a , g 1 , otherwise where a, b ∈ A , r ∈ R, and g ∈ Z + denotes a privacy budget.

Finally, for objective and subjective global fairness, we characterize its requirements, but leave it to be specified application-wise. We present an applied experiment of objective and subjective global fairness in Section 6.

Definition 4.9

(Global Fairness Loss). The objective global fairness loss function Ω : S → R + , maps a state of a system to an unfairness value according to an objective notion of fairness. Analogously, a subjective global fairness loss function Ω p : S → R + maps the same state to an unfairness value that stems from the subjective perception of the population. A higher value in either means that the state is less desirable, that is, less fair.

We now introduce definitions pertaining to “orderly” cases of the previous definitions. Intuitively, a dispute resolution function is one such that when all information is available, an objective local fair outcome is achieved. When that is the case, we call it publicly sound, formally as follows:

Definition 4.10

A dispute resolution function ϕ is publicly sound iff for all f a , f b ∈ F , ϕ(f _a , f _b ) = ω(f _a , f _b ).

We also define an agent being reasonable when, given perfect information about the other agent, a always considers the objectively fair outcome a subjectively fair outcome, in any contest with another agent b. Being reasonable thus implies that the only deterrent towards an objectively fair outcome is partial information, as a reasonable agent will always agree with the objectively fair outcome when given enough information.

Definition 4.11

An agent a ∈ A is reasonable iff for any other agent b ∈ A, and any role r ∈ R, ω _p (r, d(a), d(b)) = ω(d(a), d(b)).

Global outcomes can now connect with local outcomes by stipulating that, whenever complete information is available and the dispute resolution function is publicly sound, then the objective global fairness loss is 0. This corresponds to system transitions in which, whenever all disputes are resolved with objectively fair outcomes, then the final state is always objectively globally fair.

Definition 4.12

Let α be a disclosed information function, ϕ be a publicly sound dispute resolution function, and g ∈ Z + be such that, for every pair of agents a, b ∈ A, ϕ(α(a, b, g), α(b, a, g)) = ω(d(a), d(b)). A system transition function σ is publicly unbiased iff for any state S ₀ ∈ S, we have that Ω(σ(A, α, ϕ, g, S ₀)) = Ω _p (σ(A, α, ϕ, g, S ₀)) = 0.

Finally, we can state a result, thus proving that:

Theorem 4.1

If ϕ is a publicly sound dispute resolution function, every agent in A is reasonable, g ∈ Z + is such that for all a ∈ A, α(a, g) = d(a), and σ is publicly unbiased, then, for all a, b ∈ A and state S ₀ ∈ S, l _OL (a, b, g) = l _SL (a, b, g) = Ω(σ(A, α, ϕ, g, S ₀)) = Ω _p (σ(A, α, ϕ, g, S ₀)) = 0.

Proof: Considering Definition 4.7, we know that for a privacy budget g high enough such that α(a, g) = d(a) and α(b, g) = d(b), we achieve a global loss of 0. We can then replace the private descriptions α(a, g) and α(b, g) with their public equivalents d(a) and d(b) respectively, obtaining ϕ(d(a), d(b)) = ω(d(a), d(b)). Since ϕ is publicly sound, this holds.

A similar reasoning applies to l _SL in Definition 4.8. Suppose a g high enough such that α(a, g) = d(a) and α(b, g) = d(b), for every a, b ∈ A . Applying this to l _SL , for any o ∈ {a, b}, the value is 0 if ϕ(d(a), d(b)) = ω _p (o, d(a), d(b)). This holds, since a and b are reasonable agents.

Finally, for Ω, it is a direct consequence of Definition 4.12. Due to the constraint on g, α(a, b, g) = d(a), and similarly for b. Thus ϕ(α(a, b, g), α(b, a, g)) = ω(d(a), d(b)) is satisfied since ϕ is publicly sound.

With the extant formalisms providing a frame of reference and context, we introduce a problem statement that predicates the motivation and guides our resulting contributions in this paper.

Let A = {q ₁ , q ₂ , …, q _|A| } be a finite set of |A| agents. Every agent q ∈ A possesses an m-tuple d(q) = (i ₁ , i ₂ , …, i _m ) for all i ∈ I, where |I| = m, representing that agent’s feature description, i.e., its internal traits and characteristics. The value function μ : A × I → Z + returns the numerical value of a feature i ∈ I for an agent q ∈ A.

Let C = { A , R , K } be a culture, where A = { γ , a 1 , a 2 , … , a m } is composed of m + 1 arguments (with a single motion γ ∈ K ). Let index ( a j ) = j , a j ∈ A denote the index of an argument. We generate R randomly, satisfying the conditions: 1) the underlying A F = ( A , R ) has exactly one connected component; 2) for every ( a , b ) ∈ R , index(a) > index(b).

Non-motion arguments in C will represent a feature comparison between two agents. We consider the alteroceptive expansion of C, C x = ( A x , R x ) (Definition 3.1). Every verified-fact argument a F q j ∈ A x is associated to a verifier function v a ( q j , q k ) = T r u e if μ(q _j , index(a)) > μ(q _k , index(a)); otherwise F a l s e , for q _j , q _k ∈ A. All hypotheses are trivially associated to verifier functions that always return True.

Informally, this means that every feature i ∈ I is represented in a dialogue between two agents by the respective hypotheses and verified-facts regarding which agent has a superior value in feature i. This abstractly represents any potential feature in a system.

To empirically study the impact of privacy on local and global fairness using different argumentation strategies, we define two evaluation metrics. First, we consider the aggregated subjective local unfairness as the summation of the subjective local fairness loss l _SL over all pairs of distinct agents. In our case, this is modeled by dialogues that end due to a lack of privacy budgets from one of the agents, as noted by dispute result (2) in Section 3.

To measure objective local fairness loss, we calculate a ground truth of all pairwise interactions of agents. This ground truth is defined as an |A|×|A| matrix GT , with entries being elements of R = {pr, op}. The entries of GT are the objectively fair outcome of the dispute in which agents a _j and a _k assume the roles of pr and op, respectively, that is: GT _j,k = ω(d(q _j ), d(q _k )).

Our instantiation of the objectively fair outcome function ω is defined the following procedure:

(1) Given the complete descriptions d(pr) and d(op), run all verifier functions for all arguments and remove all verified-fact arguments that return False.

The resulting ground truth can also be represented as a digraph G _GT = (A, E), where for every two distinct agents q _j , q _k ∈ A, we say an arc (q _j , q _k ) ∈ E iff GT _j,k = pr and GT _k,j = op. We generalise this definition for any strategy α and denote the digraph G _α as a precedence graph of agents.

Objective global fairness loss compares the ground truth precedence graph, G _GT , to the precedence graph resulting from a strategy, G _{RE (g,α)}. To compare these two precedence graphs, we use the DAG dissimilarity metric seen in (Malmi et al., 2015), defined below.

Let G ₁ = (A, E ₁ ) and G ₂ = (A, E ₂ ) be two precedence graphs. Let e denote an arc (q _j , q _k ). Let c ₁ denote the number of occurrences where e ∈ E ₁ and its reverse (q _k , q _j ) ∈ E ₂ , c ₂ as the number of occurrences where e exists in either E ₁ or E ₂ but not the other, and c ₃ as the number of occurrences where neither E ₁ or E ₂ contain e . The DAG dissimilarity between two graphs G ₁ = (A, E ₁ ) and G ₂ = (A, E ₂ ) is K(G ₁ , G ₂ , y ₁ , y ₂ ) = c ₁ + c ₂ y ₁ + c ₃ y ₂ , where 0 ≤ y ₂ < y ₁ ≤ 1 are constants. We choose y ₁ = 2/3 and y ₂ = 1/3, via integration. ⁶

Let D be the set of all possible privacy-aware dialogues. Let D = m ₀ , …, m _n be a privacy-aware dialogue, with m _n = (w, a) the last movement used. We define η : D → 2 A x as the function that returns the set of all arguments r ∈ A x such that r attacks a and m n + 1 = ( w ̄ , r ) can be used as the next move in the dialogue, that is, m ₀ , …, m _n , m _n+1 is also a privacy-aware dialogue. We enumerate 4 strategies for choosing a rebuttal argument r ∈ η(D).

(1) Random: r is sampled randomly with equal probability for all r ∈ η(D).

Let α ∈ S be a strategy, where S = r a n d o m , min _ c o s t , o f f e n s i v e , d e f e n s i v e .

A result is defined as an |A|×|A| matrix R E : Z + × S → R | A | × | A | , where R = {pr, op}. Every item RE _j,k = ϕ(α(q _j , q _k , g), α(q _k , q _j , g)), for RE _j,k represents the dispute resolution outcome of a dispute between agents q _j and q _k , assuming the roles of pr and op, respectively. We instantiate ϕ by carrying out a dialogue between q _j and q _k until a winner is found, returning pr or op accordingly. Analogously to the ground truth model, we can generate a precedence graph G _{RE (g,α)} = (A, E), where for every two distinct agents q _j , q _k ∈ A, we say an arc (q _j , q _k ) ∈ E iff RE _j,k = pr and RE _k,j = op.

Each experiment consists of a set of |A| = 50 agents with fixed feature values initialised randomly. For each experiment, we create a random acyclic culture C = ( A , R , K ) with | A | = 50 , | R | ≃ 400 , and K = { γ } . We generate an alteroceptive expansion C _x of C where the privacy cost τ(a _x ) for all a x ∈ A x is randomly initialised as 1 ≤ τ(a _x ) ≤ 20. Using privacy-aware dialogue games as dispute resolution mechanisms, we generate a precedence graph G _{RE (g,α)} for each strategy α ∈ S .

We repeat each experiment for integer value privacy budgets 0 ≤ g < 60. We aggregate measures of global and local fairness over 1,900 trials, ⁷ where each trial randomly initializes all agents’ feature descriptions and the culture.

The plots in Figure 2 show the average subjective local fairness loss (Figure 2A) and the average objective global fairness loss (Figure 2B) for all four strategies over a range of privacy budget values. All strategies converge to zero subjective local fairness loss given high enough privacy budgets. However, at a given privacy budget value, the defensive strategy dominates the other strategies. Similarly, the defensive strategy is dominant with respect to objective global fairness. In addition to achieving a lower objective global fairness loss at a given privacy budget value, the convergence value of the defensive strategy is lower than that of the other strategies.

We run approximately 10 million dialogues between 95,000 different agents, using the same 1,900 random cultures from the previous experiment. However, this time we observe how much privacy cost was used by each strategy to finish the dialogues. Agents were free to extend their dialogues for as long as required. Figure 3 shows an empirical cumulative distribution function of the proportion of dialogues with cost z, where z ≥ z′, s.t. l _SL (q _i , q _j , r, z′) = 1, for any {q _i , q _j } ⊂ A , α ∈ S , and any r ∈ {pr, op} (i.e., dialogues that need a privacy budget higher than z to not be cut short by it). This illustrates the effect of different strategies in minimizing privacy cost, even in unrestricted dialogues. Results are consistent with the findings in Section 5.4.

Our environment ⁸ consists of a 20 km long × 2 km wide two-dimensional water surface, without any obstacles. In every trial, 16 agents are instantiated in a ‘head-on parade’ scenario, as follows:

• 8 out of the 16 agents start from the west, and 8 others start from the east.

Speedboats are simulated with a physics model adapted from Monster (2003) and Linkovich (2016), where elements such as water resistance, drag, and mass are taken into consideration when calculating frames. We simulate and control each boat at 20 Hz refresh rate. Each trial spans around 10–20 min of simulation at 20 Hz for 16 agents, and we collect around 400,000 telemetry data points per trial, including velocity, lateral acceleration, yaw rate, and lateral jerk. We run 900 trials and generate over 40 GB of trajectory and telemetry data for our analyses.

The properties of the vehicle are coarsely modelled after the real-life high performance passenger boat Hawk 38 (Sunseeker, 2019), with capacity for seven seated passengers, dual 400 hp motors, and top speed of 30 m/s (approx. 60 knots). It is assumed that vehicles will drive at maximum speed whenever possible.

Akin to Section 5.1, each agent is bestowed with properties extracted from a culture, initialised according to a given distribution. Table 1 illustrates the culture designed for the experiment. To preserve a certain degree of realism, the initialisation of each agent is still random, but respecting certain reasonable restrictions (e.g., civilians cannot have high military ranks or engage in combat, spies are always civilian or corporate, etc.).

In our simulation, agents have no prior knowledge of other agents’ descriptions. Properties with τ = 0 can be communicated instantaneously. It is assumed that agents act lawfully and will not lie, but they are nonetheless self-interested and will fight for the right of way in every conflict that arises. In our scenario, we establish that more sensitive information requires further time to obtain clearance before communicating to another agent. Therefore, in this experiment, privacy costs are associated with time (and consequently, distance). We model their avoidance mechanism using a modified artificial potential field algorithm (Warren, 1990).

Let q _i , q _j ∈ A be any two agents, and d i s t : A × A × Z → Z + be a function that determines the euclidean distance between two agents at a specific time t. We define two constants r _max = 1,000 and r _crit = 100 as the maximum effect and the critical minimum radii of a potential field. In our method, when dist(q _i , q _j , t) > r _max and dist(q _i , q _j , t + 1) ≤ r _max (i.e., the agents just got within the maximum effect radius for the first time), q _i and q _j will initiate a dialogue game ϕ(q _i , q _j , g) to decide who has right of way, where g is the maximum privacy budget for each agent.

Definition 6.1

(Activation Radius). Starting from the centre of each agent, we divide the space between r _max and r _crit into 2g concentric and uniformly-expanding rings. Let T ( q ) be the description cost of an agent, that is, how much of its privacy budget was spent to reveal information. Without loss of generality, suppose q _i ∈ {q _i , q _j } is the winner of the dialogue game and z = T ( q i ) + T ( q j ) , z ≤ 2 g is the total combined privacy cost for that dialogue, considering both agents. The activation radius r act = r max − z 2 g r max − r crit is the distance where the potential field (with full radius r _max ) will be enabled for the first time for the losing agent, and will remain in effect until the end of the simulation.

In plain language, agents will start the dialogue as soon as they cross the r _max = 1,000 boundary, and their cumulative privacy cost z (e.g. the time the dialogue takes) will determine how early or how late they ultimately decide which agent should have right of way (see Figure 5). Higher values of z will lead to late, aggressive evasive manoeuvres. In case dist(q _i , q _j ) < r _crit , the winner is also forced to divert to avoid a collision. In an ideal scenario, most agents will complete their dialogues in full with very low privacy costs and execute early, smooth manoeuvres to stay clear of other agents. Conversely, if dialogues are wasteful or activation radii are closer to r _crit than r _max , then one of the following may happen in the local scope, for any q _i , q _j ∈ A and r ∈ {pr, op}:

• the evader makes a very late and aggressive evasion turn (low privacy efficiency: high T ( α ( q i , q j , g ) ) );

As per our previous abstract experiment, we demonstrated that different strategies for choosing arguments (explanations) during the dialogue game leads to varied levels of performance with regards to privacy efficiency, subjective fairness, and objective fairness. We will perform simulations using the same strategies seen in Section 5.3 in the sections below.

Since this experiment involves a real simulation of a multi-agent system, its magnitude is significantly smaller in terms of number of dialogues and agents. We repeat the experiment in Section 5.5, this time with only one culture. We observe the privacy costs of 48,000 dialogues between the previous set of 1,600 randomly-initialised agents for each strategy without any restrictions in privacy.

Figure 6 shows the effect of different strategies in minimizing privacy cost for unrestricted dialogues in the Boat Culture. Two phenomena can be observed: the greedy strategy for minimizing cost (min_cost) turns out to be the worse at that. This is due to the fact that, as privacy costs are not randomly determined this time, privacy costs are correlated with argument relevance/power, making stronger arguments more expensive. Additionally, both offensive and defensive exhibit similar performance. In a similar nature, in this culture, stronger arguments simultaneously attack many others, whilst being relatively unattacked.

A more applied perspective on the same matter is to observe the status of vehicles across their trajectories. In our simulation, most disturbances and evasions take place when both sides of the parade meet in the middle. These conflicts generate peaks in lateral acceleration and other measurements. When those conflicts are resolved, agents usually follow trouble-free paths to their destinations. We are interested in quantifying a general notion of “ride comfort” (supposing an acceptable limit of “comfort” for a powerboat at maximum speed) and minimizing the “ride roughness” for the fictitious average passenger on board. We discard the initial acceleration and final braking data points, as we are only interested in changes in acceleration caused by other agents.

To do so, we integrate the area under each of those metrics per agent, and compute the mean of each agent’s integrals per trial. We run 100 trials per strategy with a combined privacy budget value of 2g = 60 and aggregate these values. We associate higher values of lateral acceleration and jerk represent as strong components in a passenger’s experience of discomfort (Nguyen et al., 2019).

The first row in Figure 8 shows the distribution of lateral acceleration, yaw rate, and lateral jerk measurements over 1,600 simulations (16 agents x 100 trials) per strategy. We observe significantly lower values from offensive and defensive in all metrics. The random strategy also exhibited significantly lower values of lateral jerk compared to min_cost.

After observing the impact of privacy on the quality of the ride, we now measure agents’ perspectives in a global scope. Instead of counting local instances of objective and subjective unfairness, we generate entire trajectories that cater to specific requirements. From this point, we will apply the following nomenclature:

• Nominal trajectory ( J N ) : this is the actual trajectory executed by the agent in a regular trial. Agents perform their dialogues normally and give way in case of defeat (as shown in Figure 5), according to the current strategy mutually adopted by all agents.

These trajectories are advantageously intuitive and serve as an example of application-based representations of policies under different perspectives. An illustration of these trajectories can be seen in Figure 7. If agents have efficient strategies for selecting relevant information/explanations, their Nominal trajectories will converge to the objectively correct answer more frequently (and more quickly), thus becoming increasingly similar to the Objective hypothesis. Likewise, if strategies are efficient, subjective unfairness will be reduced as agents will be able to get to the end of their dialogues—and thus the decisions made in the Nominal trajectory and its corresponding Subjective hypothesis will agree.

Let J 1 , J 2 denote any 2 trajectories. We calculate dissimilarity measures across comparable trajectories using the discrete Fréchet distance ⁹ F r e c ( J 1 , J 2 ) . We repeated the tests with two other methods (Partial Curve Mapping and Dynamic Time Warp) and achieved similar results. We chose the aforementioned metric for its intuitive value and simplicity, and will omit the other results as they are redundant. For every strategy, we will compare 3 pairs of trajectories:

• Objective Unfairness ( Ω = F r e c ( J N , J O h ) ). This represents the level of agreement between the Nominal trajectory and the hypothetical Objective trajectory in a perfect scenario. This mostly captures how objectively correct the decisions were. In Figure 8, it is possible to observe that offensive and defensive exhibit much more agreement with the correct trajectory than the other two strategies.

The results in the bottom row of Figure 8 show aggregated results for objective and subjective unfairness, as well as the subjectivity gap for each strategy. We perform pairwise comparisons to evaluate how different fare against each other in terms of higher ride comfort (lower dynamics) and lower unfairness values. Higher values in the first row indicate that, when using that strategy, agents experienced higher motion dynamics associated with discomfort. Likewise, higher values in the second row demonstrate a higher disagreement between the pairs of trajectories when agents use that strategy. We observe that min_cost exhibits the worst performance in all metrics against all other strategies. In second-to-last, random is bested by the other 2 strategies. More remarkably, the winning strategies offensive and defensive exhibit mostly equivalent behavior, and both are able to practically eradicate occurrences of subjective unfairness within that given privacy budget.

In the random experiment, Figure 2 shows that defensive yields lower losses both locally and globally, especially for realistic privacy budgets that do not overly limit the length of dialogue while meaningfully constraining the amount of shared information. When unrestricting dialogues, defensive was also able to close dialogues with lower privacy costs. As expected, our results suggest that choosing better strategies imply Pareto dominance.

When the privacy budget is near zero, all strategies perform similarly poorly. Little dialogue can occur, so agents lack the information to make objectively good decisions and to provide meaningful justifications. With high privacy budgets, strategies perform similarly well. Predictably, all strategies converge to zero subjective local fairness because dialogues can extend indefinitely. The distinct non-zero convergence values of the objective global fairness loss is due primarily to the ground truth used in these experiments.

Our ground truth corresponds to the sceptical acceptance of the proponent’s motion. The motion is only validated if all attacking arguments are defeated. Having at least one reason to defeat the motion is sufficient to preserve the status quo. ¹⁰ If both agents win in some unattacked arguments and lose in others, the outcome will always lean towards the opponent, even when they swap roles.

We observed similar results in the applied multi-agent experiment. Although the distinction between defensive and offensive was not as clear as in with randomised cultures, both still exhibited superior results and reinforced the argument towards the importance of selecting information by relevance. The formalism proposed in Section 4 allows for representing a range of different problems, endowing decentralised systems with considerations of subjectivity that can be modeled for non-human agents.

By comparing trajectories under different perspectives, one could be tempted to see the Objective hypothesis through the lens of a more “traditional” aspect of trajectories, namely, by how much shorter and quicker they are, or by observing the system behavior with metrics such as makespan or flowtime. In our case, better trajectories are not necessarily “optimal” in the traditional sense. They do not attempt to be shorter or quicker, but instead consider ride comfort metrics and ultimately select for better agreement between what actually happens, what actually should have happened, and what the agents believe should have happened.

The environment with 16 agents avoiding each other through combinations of artificial potential fields in continuous space with simulated physics is dense and complicated, and can lead to edge cases where agents’ decisions can cascade and propagate to multiple others (especially if radii are large). Notwithstanding all the potential for results being confounded by this property of the system, we still managed to demonstrate statistically significant results for superior global performance with better strategies. We expect even clearer results in discrete applications, topological representations (Bhattacharya et al., 2012), or in environments with planning in mind, such as Conflict-Based Search methods (Sharon et al., 2015).

For real applications, the properties and structure of the chosen alteroceptive culture play an important role in indicating which strategy will perform better towards the aimed Pareto dominance within the fairness-privacy trade-off. Perhaps with the exception of degenerate cases of cultures, our heuristics should provide a good guide for considering the choice of arguments for building explanations in fairness-aware conflict resolution disputes, especially if one cannot assess the relevance of the content of the arguments (what it actually means), but has access to its structure (the ruleset that originated the culture, and the relationships between rules).