Privacy-Preserving Dialogues Between Agents: A Contract-Based Incentive Mechanism for Distributed Meeting Scheduling

Meeting scheduling (MS) is a practical task in everyday life that involves independent agents with different calendars and preferences. In this paper, we consider the distributed MS problem where the host exchanges private information with each attendee separately. Since each agent aims to protect its own privacy and attend the meeting at a time slot that it prefers, it is necessary to design a distributed scheduling mechanism where the privacy leakage can be minimized and as many agents are satisfied with the outcome as possible. To achieve this, we propose an intelligent two-layer mechanism based on contract theory where the host motivates each agent to reveal its true preferences by providing different rewards without knowing the costs of each agent to attend the meeting. We first model the privacy leakage by measuring the difference between the revealed information of an agent’s calendar and other agents’ prior beliefs. An optimal control problem is then formulated such that the reward function and privacy leakage level can be jointly designed for each agent. Through theoretical analysis, we show that our proposed mechanism guarantees the incentive compatibility with respect to all agents. Compared to the state of the art, empirical evaluations show that our proposed mechanism achieves lower privacy leakage and higher social welfare within a small number of rounds.

1. 1.

   An agent’s availability at each time slot reflects its preference over the time slots, which can be categorised as multiple types, such as ‘free’, ‘OK with it’, and ‘busy’.

2. 2.

   It is worth noting that contract theory is different from the contract network protocol. The latter is a type of negotiation-based mechanism for task assignment.

3. 3.

   This can be extended to more types, but we use three to keep the example simple.

4. 4.

   Here we assume that every agent cares about its privacy to the same degree, which also makes sense in reality.

5. 5.

   We do not compare with other works here since each of them has a different metric of incentive costs, which is not compatible to ours.

Authors and Affiliations

1. Department of Computing, Imperial College London, London, UK

   Boya Di & Nicholas R. Jennings

Corresponding author

Correspondence to Boya Di .

Editors and Affiliations

1. Aristotle University of Thessaloniki, Thessaloniki, Greece

   Nick Bassiliades

2. Technical University of Crete, Chania, Greece

   Georgios Chalkiadakis

3. IIIA-CSIC, Bellaterra, Spain

   Dave de Jonge

A Appendix: Proof of Proposition 1

According to (11c), for any (\(d, \hat{d}\)), the following inequalities hold:

When \(f_O\left( d\right) = f_O(\hat{d})\), adding (20a) and (20b) yields

The sufficient conditions to satisfy (21) are that both \(R_F\left( d \right) \) and \(N_p\left( d\right) \) are non-increasing functions. Similarly, by fixing \(f_F\left( d\right) = f_F(\hat{d})\), we can learn that \(R_O\left( d \right) \) is also a non-increasing one, which verifies (15a) and (15b) .

Given d, (20a) implies that the function \(y(\hat{d}) = f_F\left( d\right) \left( R_F(\hat{d}) -\alpha N_p (\hat{d})\right. \left. L(F)\right) \) \(+ f_O\left( d\right) \left( R_O(\hat{d}) - \alpha N_p(\hat{d})L(O)\right) \) reaches its maximum at \(\hat{d} = d\). We have

Since it holds for all \(f_F(d), f_O(d) > 0\), we have (15c).

B Appendix: Proof of Proposition 2

The first and second conditions stated in Definition 1 are guaranteed by constraints (11) and (13) . We now look into whether the third condition holds.

An attendee i may claim to be busy at an OK time slot t so as to mislead the host to schedule the meeting at time slot \(t'\) in which it is free. In this case, the desired probability that attendee i wishes others to believe is \(p_{0 \rightarrow i}^d\left( t\right) = 0\). Note that slot \(t'\) is a time slot that has not been proposed yet. We consider one case that slot \(t'\) is a time slot that has not been proposed yet. The expected utility of responder i when lying and telling the truth are separately given by

where \(p^{lie}\) and \(p^{tr}\) are the probability that the meeting can not be successfully scheduled in two cases, respectively. \(p_b\) is the host’s prior belief of the free probability of the attendee. In (23a), \(\alpha \left( p_b -1\right) \) represents the privacy leakage reporting to be free at time slot \(t'\), and \(\alpha \left( 2p_O - p_b\right) \) represents the protected privacy information by lying. In (23b), \(\alpha \left( p_b -p_O\right) \) is the privacy leakage at time slot t, and \(\theta \left( 1 - p_b\right) \) is the protected privacy information of slot \(t'\).

Since \(p_O \le 0.5\) and \(p^{lie} > p^{tr}\), we have \(E\left[ U_i^{tru}\right] > E\left[ U_i^{lie} \right] \). Therefore, the attendee has no motivation to lie, which verifies the third condition.

Reprints and permissions

© 2020 Springer Nature Switzerland AG

Policies and ethics