Journal of Artificial Intelligence Research 45 (2012) 481–514 Submitted 06/12; published 11/12 Complexity of Judgment Aggregation Ulle Endriss ulle.endriss@uva.nl Umberto Grandi umberto.uni@gmail.com Daniele Porello danieleporello@gmail.com Institute for Logic, Language and Computation University of Amsterdam Postbus 94242, 1090 GE Amsterdam The Netherlands Abstract We analyse the computational complexity of three problems in judgment aggregation: (1) computing a collective judgment from a profile of individual judgments (the winner determination problem); (2) deciding whether a given agent can influence the outcome of a judgment aggregation procedure in her favour by reporting insincere judgments (the strategic manipulation problem); and (3) deciding whether a given judgment aggregation scenario is guaranteed to result in a logically consistent outcome, independently from what the judgments supplied by the individuals are (the problem of the safety of the agenda). We provide results both for specific aggregation procedures (the quota rules, the premisebased procedure, and a distance-based procedure) and for classes of aggregation procedures characterised in terms of fundamental axioms. 1. Introduction Judgment aggregation (JA) is a branch of social choice theory that studies the properties of procedures for amalgamating several agents' individual judgments regarding the truth or falsity of a set of inter-related propositions into a collective judgment reflecting the views of that group of agents as a whole (List & Pettit, 2002; List & Puppe, 2009). A by now classic example is due to Kornhauser and Sager (1993): Suppose three judges have to decide on a legal case involving a possible breach of contract. Two relevant propositions are that there really has been a binding contract rather than just an informal promise (proposition p) and that the defendant broke her promise (proposition q). The defendant should be pronounced guilty if the conjunction of these two propositions is found to be true (p ∧ q). Our judges take the following views on the matter: p q p ∧ q Judge 1 Yes Yes Yes Judge 2 Yes No No Judge 3 No Yes No Majority Yes Yes No Note that the position of each individual judge is logically consistent. However, if we aggregate this information using the majority rule (i.e., if we accept a proposition if and only if a strict majority of the judges do), then we arrive at a collective judgment set that is inconsistent. This paradoxical outcome, variations of which are known as the doctrinal c©2012 AI Access Foundation. All rights reserved. Endriss, Grandi, & Porello paradox (Kornhauser & Sager, 1993) or the discursive dilemma (Pettit, 2001), has inspired an important and fast growing literature on JA, starting with the seminal contribution of List and Pettit (2002), who showed that in fact no aggregation procedure satisfying certain axioms encoding natural desiderata can avoid this kind of paradox. The literature on JA has largely developed in outlets associated with Philosophy, Economic Theory, Political Science, and Logic, but recently JA has also come to be recognised as being relevant to AI, particularly to the design and analysis of multiagent systems. The reasons are clear: in a multiagent system, different autonomous software agents may have different "opinions" on the same issues (maybe due to a difference in access to the relevant information, or due to different reasoning capabilities), and some joint course of action needs to be extracted from these diverse views. Indeed, in AI, the related problem of belief merging has been studied for some time (see, e.g., Konieczny & Pino Pérez, 2002; MaynardZhang & Lehmann, 2003; Chopra, Ghose, & Meyer, 2006; Everaere, Konieczny, & Marquis, 2007), and there are interesting parallels between that literature and JA (Pigozzi, 2006). JA has also been found to be relevant to the analysis of abstract argumentation frameworks widely studied in AI (Caminada & Pigozzi, 2011; Rahwan & Tohmé, 2010). Given the relevance of JA to AI, it is important to understand its computational aspects. However, to date, these have only received relatively little attention in the literature. This can of course be explained by the origins of the field in Law, Economics, and Philosophy. In other domains of social choice, particularly voting and fair division, on the other hand, the recent focus on computational aspects has been very successful and has given rise to the field of computational social choice (Chevaleyre, Endriss, Lang, & Maudet, 2007; Brandt, Conitzer, & Endriss, 2012). To help bridge this gap, in this paper we shall analyse the computational complexity of three important problems that arise in JA: • Winner determination. The winner determination problem is the problem of computing the result of applying a given aggregation procedure to a given profile of individual judgment sets. It is of immediate practical relevance to all applications of JA. We obtain both positive and negative results: for two types of aggregation procedures, namely the quota rules and the premise-based procedure, the winner determination problem is easily seen to be polynomial, while for a certain distance-based procedure we obtain an interesting intractability result, establishing completeness for parallel access to NP that mirrors corresponding results in voting theory for the Dodgson rule (Hemaspaandra, Hemaspaandra, & Rothe, 1997), the Young rule (Rothe, Spakowski, & Vogel, 2003) and the Kemeny rule (Hemaspaandra, Spakowski, & Vogel, 2005). • Strategic manipulation. An agent may try to influence the result of aggregation in her favour by reporting a set of judgments that is different from her truthfully held beliefs. The manipulation problem asks, for a given aggregation procedure, a given profile of judgment sets, and a given agent, whether that agent has the opportunity to manipulate successfully in this situation. For one natural way of defining preferences on top of the JA framework (namely in terms of the Hamming distance) and for aggregation procedures that are independent and monotonic, it is well-known that agents will never have an incentive to manipulate (Dietrich & List, 2007c). In other cases, it is interesting to explore how hard it is to solve the manipulation problem, as 482 Complexity of Judgment Aggregation high complexity might signal a certain level of immunity against manipulation. In the context of voting, this kind of question has lead to a series of interesting and important results (Bartholdi, Tovey, & Trick, 1989; Faliszewski & Procaccia, 2010), even if we have to be careful not to over-interpret theoretical intractability results as necessarily providing protection in practice (Walsh, 2011). For one widely used procedure (with an easy winner determination problem), namely the premise-based procedure, we are able to show NP-completeness for the manipulation problem. • Safety of the agenda. The paradox presented above shows that for some aggregation procedures it is possible to obtain a collective judgment set that is logically inconsistent, even though each of the judgment sets supplied by the individuals is consistent. An important parameter determining the possibility of such a paradox is the agenda, the set of propositions on which to pass judgment. For a given aggregation procedure, the problem of the safety of the agenda asks whether a given agenda is safe in the sense that no profile of individual judgment sets that are consistent can ever result in a collective judgment set that is inconsistent. For various classes of aggregation procedures, defined in terms of classical axioms, we prove safety theorems that fully characterise agendas that are safe in this sense and we relate our results to known possibility theorems from the JA literature (List & Puppe, 2009). We then study the complexity of deciding whether a given agenda meets the safety conditions identified and we find that this is typically a highly intractable problem located at the second level of the polynomial hierarchy. These results build on and extend our earlier work on the complexity of judgment aggregation (Endriss, Grandi, & Porello, 2010a, 2010b). The remainder of this paper is organised as follows. In Section 2 we introduce the formal framework of JA, including several concrete aggregation procedures and the most important axioms used to define desiderata for such procedures. Section 2 also includes proofs of some simple representation results that characterise aggregation procedures that satisfy certain combinations of these axioms. Section 3 is devoted to the study of the complexity of the winner determination problem and Section 4 does the same for the manipulation problem. In Section 5 we then introduce the problem of the safety of the agenda, prove several agenda characterisation theorems establishing necessary and sufficient conditions for safety, and finally study the complexity of deciding whether those conditions are satisfied. Section 6 reviews related work on computational aspects of JA and Section 7 concludes with a discussion of possible avenues for future work. Throughout this paper, we shall assume familiarity with the basics of complexity theory up to the notion of NP-completeness. Helpful introductions include the textbooks by Papadimitriou (1994) and Arora and Barak (2009). 2. The Formal Framework of Judgment Aggregation In this section we provide a succinct exposition of the formal framework of JA (List & Puppe, 2009), which originally was laid down by List and Pettit (2002) and since then has been further refined by a number of authors, notably Dietrich (2007). We also define three concrete (families of) aggregation procedures and we discuss the most important axiomatic 483 Endriss, Grandi, & Porello properties from the literature. Finally, we prove a number of representation results, which have the status of folk theorems in the JA literature and often play a crucial role in the proofs of more complex results, but which have rarely been stated explicitly. 2.1 Notation and Terminology Let L be a set of propositional formulas built from a finite set of propositional variables using the usual connectives ¬, ∧, ∨, →, ↔, and the constants ⊤ ("true") and ⊥ ("false"). For every formula α, define ∼α to be the complement of α, i.e., ∼α = ¬α if α is not negated, and ∼α = β if α = ¬β for some formula β. We say that a set Φ is closed under complementation if it is the case that ∼α ∈ Φ whenever α ∈ Φ. Definition 1. An agenda is a finite nonempty set Φ ⊆ L that does not contain any doubly-negated formulas and that is closed under complementation. That is, in a slight departure from the common definition in the literature (List & Puppe, 2009), we allow for tautologies and contradictions in the agenda. The reason is that we want to study the computational complexity of JA, and recognising a tautology or a contradiction is itself a computationally intractable problem. We write Φ+ for the set of non-negated formulas in Φ, i.e., Φ = Φ+ ∪ {¬φ | φ ∈ Φ+}. Definition 2. A judgment set J for the agenda Φ is a subset J ⊆ Φ. We call a judgment set J complete if α ∈ J or ∼α ∈ J for all α ∈ Φ; we call it complementfree1 if for all α ∈ Φ it is not the case that both α and its complement are in J ; and we call it consistent if there exists an assignment that makes all formulas in J true. Let J (Φ) denote the set of all complete and consistent subsets of Φ. We shall occasionally interpret a judgment set J as a (characteristic) function J : Φ → {0, 1} with J(φ) = 1 if φ ∈ J and J(φ) = 0 if φ 6∈ J . The Hamming distance H(J, J ′) between two (complete and complement-free) judgment sets J and J ′ is the number of positive formulas on which they differ: H(J, J ′) = ∑ φ∈Φ+ |J(φ)− J ′(φ)| Given a set N = {1, . . . , n} of n > 1 individuals (or agents), we write J = (J1, . . . , Jn) ∈ J (Φ)n for a generic profile of judgment sets, one for each individual.2 For ease of exposition, we shall assume that n is odd (i.e., n > 3). We write NJφ = {i ∈ N | φ ∈ Ji} for the set of individuals accepting the formula φ under profile J . Definition 3. A (resolute) judgment aggregation procedure for the agenda Φ and the set of individuals N with n = |N | is a function F : J (Φ)n → 2Φ. 1. This property is called weak consistency by Dietrich (2007), and consistency by List and Pettit (2002). Our choice of terminology is intended to emphasise the fact that it is a purely syntactic notion, not involving any model-theoretic concept, a distinction we believe is worth stressing. 2. In previous work we have used the more general notation J (Φ)N (i.e., the set of functions from N to J (Φ)) for the set of admissible profiles (Endriss et al., 2010a). This is useful when N might be infinite or when we do not necessarily want to associate the set of individuals with a set of natural numbers, but we do not require this level of generality here. 484 Complexity of Judgment Aggregation That is, an aggregation procedure maps any profile of individual (complete and consistent) judgment sets to a single collective judgment set (an element of the powerset of Φ). We shall occasionally refer to the assumption of all individual judgment sets being complete and consistent as individual rationality. Note that the collective judgment set need not be complete and consistent (that is, "collective rationality" need not hold). The kind of procedure defined above is called resolute, because it will return a single judgment set for any profile. Later, we shall also discuss irresolute JA procedures, which may return a nonempty set of judgment sets (that are tied for "winning"). Finally, note that, since F is defined on the set of all profiles of consistent and complete judgment sets, we are implicitly making a universal-domain assumption, which is sometimes stated as a separate property (List & Pettit, 2002). 2.2 Axiomatic Properties In Definition 3 we did not put any constraints on the collective judgment set, the outcome of the aggregation process. This is the role of the following definition: Definition 4. A judgment aggregation procedure F , defined on an agenda Φ, is said to be: (i) complete if F (J) is complete for every J ∈ J (Φ)n; (ii) complement-free if F (J) is complement-free for every J ∈ J (Φ)n; (iii) consistent if F (J) is consistent for every J ∈ J (Φ)n. We now present several axioms to provide a normative framework in which to state what the desirable properties of an acceptable aggregation procedure should be. Note that not every procedure has to satisfy every axiom. Rather, axioms model desiderata that some procedures satisfy and others do not. The first axiom is a very basic requirement, restricting possible aggregators F in terms of fundamental properties of the outcomes they produce. Weak Rationality (WR): F is complete and complement-free.3 This condition differs from what has been called "collective rationality" in the literature on JA (List & Puppe, 2009), as we do not require the collective judgment set to be consistent. The first reason not to include consistency in our most basic notion of rationality is that the requirements of (WR) are purely syntactic notions that can easily be checked automatically, which is not the case for consistency. The second reason is that consistency is not intrinsic to the aggregation function, but rather depends on the properties of the agenda. This point will be made more precise in Section 5, where we will study the consistency of a class of aggregators depending on the agenda. The following are the most important axioms discussed in the literature on JA (List & Pettit, 2002; Dietrich, 2007; List & Puppe, 2009; Nehring & Puppe, 2010): Unanimity (U): If φ ∈ Ji for all agents i ∈ N , then φ ∈ F (J). 3. In our previous work (Endriss et al., 2010a), we used a definition of weak rationality that in addition to completeness and complement-freeness also included the (very weak) technical requirement that no contradictory formula should be universally accepted under all profiles. As a consequence, some of our results later on are stated slightly differently. 485 Endriss, Grandi, & Porello Anonymity (A): For any profile J in J (Φ)n and any permutation σ : N → N , we have F (J1, . . . , Jn) = F (Jσ(1), . . . , Jσ(n)). Neutrality (N): For any two formulas φ, ψ in the agenda Φ and any profile J in J (Φ)n, if for all agents i ∈ N we have that φ ∈ Ji ⇔ ψ ∈ Ji, then φ ∈ F (J) ⇔ ψ ∈ F (J). Independence (I): For any formula φ in the agenda Φ and any two profiles J , J ′ in J (Φ)n, if φ ∈ Ji ⇔ φ ∈ J ′ i for all agents i ∈ N , then φ ∈ F (J) ⇔ φ ∈ F (J ′). Systematicity (S): For any two formulas φ, ψ in the agenda Φ and any two profiles J , J ′ in J (Φ)n, if φ ∈ Ji ⇔ ψ ∈ J ′ i for all agents i ∈ N , then φ ∈ F (J) ⇔ ψ ∈ F (J ′). Unanimity expresses the idea that if all individuals accept a given judgment, then so should the collective.4 Anonymity states that aggregation should be symmetric with respect to individuals, i.e., all individuals should be treated the same. Neutrality is a symmetry requirement for propositions: if the same subgroup accepts two propositions, then either both or neither should be collectively accepted. Independence says that if a proposition is accepted by the same subgroup under two otherwise distinct profiles, then that proposition should be accepted either under both or under neither profile. Systematicity is satisfied if and only if both neutrality and independence are. While all of these axioms are intuitively appealing, they are stronger than they may seem at first, and several impossibility theorems, establishing inconsistencies between certain combinations of axioms with other desiderata, have been proved in the literature. The original impossibility theorem of List and Pettit (2002), for instance, shows that (under certain assumptions regarding the agenda) there can be no complete and consistent aggregation procedure satisfying (A) and (S). A further important property is monotonicity. We introduce two different axioms for monotonicity. The first is the one commonly used in the literature (Dietrich & List, 2007a; List & Puppe, 2009). It implicitly relies on the independence axiom. The second, introduced in our previous work (Endriss et al., 2010a), is designed to be applied to neutral procedures. For systematic procedures the two formulations are equivalent. I-Monotonicity (MI): For any formula φ in the agenda Φ and any two profiles J , J ′ in J (Φ)n, if φ ∈ Ji ⇒ φ ∈ J ′i for all agents i ∈ N , and for some s ∈ N we have that φ 6∈ Js and φ ∈ J ′ s, then φ ∈ F (J) ⇒ φ ∈ F (J ′). N-Monotonicity (MN): For any two formulas φ, ψ in the agenda Φ and any profile J in J (Φ)n, if φ ∈ Ji ⇒ ψ ∈ Ji for all agents i ∈ N and φ 6∈ Js and ψ ∈ Js for some s ∈ N , then φ ∈ F (J) ⇒ ψ ∈ F (J). That is, (MI) expresses that if φ is collectively accepted (in J) and receives additional support (in J ′, from agent s), then it should continue to be collectively accepted. Axiom (MN) says that if φ is collectively accepted and ψ is accepted by a strict superset of the individuals accepting φ, then ψ should also be collectively accepted. Axioms can be used to define different classes of aggregation procedures: Given an agenda Φ and a list of desirable properties AX provided in the form of axioms, we define FΦ[AX] to be the set of all procedures F : J (Φ) n → 2Φ that satisfy the axioms in AX. 4. This notion of unanimity is stronger than another common formulation only requiring J = (J, . . . , J) to imply F (J) = J (List & Puppe, 2009), but the two are equivalent under the assumption of (I). 486 Complexity of Judgment Aggregation 2.3 Judgment Aggregation Procedures Next, we define three concrete types of aggregation procedures. 2.3.1 Uniform Quota Rules and the Majority Rule An aggregation procedure F for n = |N | individuals is a quota rule if for every formula φ there exists a quota qφ ∈ {0, . . . , n+1} such that φ ∈ F (J) if and only if |N J φ | > qφ. The class of quota rules has been studied in depth by Dietrich and List (2007a). In this paper, we are interested in a particular class of quota rules: Definition 5. Given some m ∈ {0, . . . , n+1} and an agenda Φ, the uniform quota rule with quota m is the aggregation procedure Fm with φ ∈ Fm(J) ⇔ |N J φ | > m. An aggregation procedure satisfies (A), (I), (MI), and (N) if and only if it is a uniform quota rule; this fact follows immediately from a result by Dietrich and List (2007a), who use a slightly more narrow definition of quota rule. Provided m 6= n+ 1, the uniform quota rule Fm also satisfies (U). A quota rule of special interest is the majority rule. The majority rule is the uniform quota rule withm = n+12 ; it accepts a formula whenever there are more individuals accepting it than there are rejecting it (recall that we did assume n to be odd). Clearly, the majority rule is the only uniform quota rule that satisfies (WR). 2.3.2 The Premise-Based Procedure As we have seen in the introduction, the majority rule may fail to produce a consistent outcome. Two basic aggregation procedures that can be set up in a way so as to avoid this problem have been discussed in the JA literature from the very beginning, namely the premise-based and the conclusion-based procedure (Kornhauser & Sager, 1993; Dietrich & Mongin, 2010). The basic idea is to divide the agenda into premises and conclusions. Under the premise-based procedure, we apply the majority rule to the premises and then infer which conclusions to accept given the collective judgments regarding the premises;5 under the conclusion-based procedure we directly ask the agents for their judgments on the conclusions and leave the premises unspecified in the collective judgment set. That is, the conclusion-based procedure does not result in complete outcomes (indeed, strictly speaking, it does not conform to Definition 3), and we shall not consider it here. The premise-based procedure, on the other hand, can be set up in a way that guarantees consistent and complete outcomes, which provides a usable procedure of some practical interest. For many JA problems, it may be natural to divide the agenda into premises and conclusions. Let Φ = Φp ⊎ Φc be an agenda divided into a set of premises Φp and a set of conclusions Φc, each of which is closed under complementation. 5. This is what is commonly understood by "premise-based procedure". Dietrich and Mongin (2010), who call this rule premise-based majority voting, have also investigated a more general class of premise-based procedures in which the procedure used to decide upon the premises need not be the majority rule. 487 Endriss, Grandi, & Porello Definition 6. The premise-based procedure PBP for Φp and Φc is the function mapping each profile J = (J1, . . . , Jn) ∈ J (Φ) n to the following judgment set: PBP(J) = ∆ ∪ {φ ∈ Φc | ∆ |= φ}, where ∆ = {φ ∈ Φp | |NJφ | > n+ 1 2 } That is, ∆ is the set of premises accepted by a (strict) majority; and the PBP will return this set ∆ together with those conclusions φ that logically follow from ∆ (∆ |= φ). If we want to ensure that the PBP always returns judgment sets that are consistent and complete, then we have to impose certain restrictions: • If we want to guarantee consistency, then we have to impose restrictions on the premises. It is well-known that the majority rule is guaranteed to be consistent if and only if the agenda Φ satisfies the so-called median property, i.e., if every inconsistent subset of Φ has itself an inconsistent subset of size 6 2 (Nehring & Puppe, 2007; List & Puppe, 2009).6 This result immediately transfers to the PBP: it is consistent if and only if the set of premises satisfies the median property. • If we want to guarantee completeness, then we have to impose restrictions on the conclusions: for any assignment of truth values to the premises, the truth value of each conclusion has to be fully determined. We shall see in Section 5 that deciding whether a set of formulas satisfies the median property is highly intractable. That is, in its most general form, deciding whether the PBP is a consistent aggregation procedure for a given agenda is a complex problem. For a meaningful analysis, we therefore make two additional assumptions. First, we assume that the agenda Φ is closed under propositional variables: p ∈ Φ for any propositional variable p occurring within any of the formulas in Φ. Second, we equate the set of premises with the set of literals. Clearly, the above-mentioned conditions for consistency and completeness are satisfied under these assumptions. So, to summarise, the instance of the PBP we shall work with in this paper is defined as follows: Under the assumption that the agenda is closed under propositional variables, the PBP accepts a literal l if and only if more individuals accept l than do accept ∼l; and the PBP accepts a compound formula if and only if it is entailed by the accepted literals. For consistent and complete input profiles, and assuming that n is odd, this leads to a resolute JA procedure that is consistent and complete. On the downside, the PBP violates most of the standard axioms typically considered, such as (N) and (I). It even violates (U): p q r p ∨ q ∨ r Agent 1 Yes No No Yes Agent 2 No Yes No Yes Agent 3 No No Yes Yes PBP No No No No In this example, all three agents unanimously accept p∨ q∨ r, but when we aggregate using the PBP, then we end up rejecting p∨ q ∨ r, because each of the three premises is rejected. 6. We shall discuss this result in detail in Section 5. 488 Complexity of Judgment Aggregation 2.3.3 The Distance-Based Procedure The basic idea of a distance-based approach to aggregation is to select an outcome that, in some sense, minimises the distance to the input profile. This idea has been used extensively in both preference aggregation (Kemeny, 1959) and belief merging (Konieczny & Pino Pérez, 2002). The first example of a JA procedure based on a notion of distance was introduced by Pigozzi (2006), albeit under the restrictive assumption that the agenda is closed under propositional variables and that each compound formula will either be unanimously accepted or unanimously rejected by all agents. Most importantly, in Pigozzi's approach the syntactic information contained in the agenda was discarded by moving the aggregation from the level of formulas to the level of models. A syntactic variant of this procedure has later been defined by Miller and Osherson (2009), which these authors call the Prototype-Hamming rule. This is the distance-based procedure we shall define and analyse here. It is an irresolute procedure, returning a (nonempty) set of collective judgment sets. Definition 7. Given an agenda Φ, the distance-based procedure DBP is the function mapping each profile J = (J1, . . . , Jn) ∈ J (Φ) n to the following set of judgment sets: DBP(J) = argmin J∈J (Φ) ∑ i∈N H(J, Ji) A collective judgment set under the DBP minimises the amount of disagreement with the individual judgment sets (i.e., it minimises the sum of the Hamming distances with all individual judgment sets). Note that in cases where the majority rule leads to a consistent outcome, the outcome of the DBP coincides with that of the majority rule (making it a resolute procedure over these profiles). We can combine the DBP with a tie-breaking rule to obtain a resolute procedure. The DBP is complete and consistent by design: only judgment sets in J (Φ) are considered candidates when searching for a solution. However, it violates most of the standard axiomatic properties when those are adapted to the case of irresolute JA procedures (Lang, Pigozzi, Slavkovik, & van der Torre, 2011). In particular, the DBP is not independent; indeed, it is based on the very idea that correlations between propositions should be exploited rather than neglected. 2.4 Representation Results We now prove a number of representation results that characterise the aggregation procedures that satisfy certain combinations of axioms. All of the results in this section are known results, but-despite being very useful-they have rarely been stated explicitly in the literature. Observe that an aggregation procedure F satisfies (I) if and only if there exists a family of sets of winning coalitions Wφ ⊆ 2 N , one for each formula φ ∈ Φ, such that φ ∈ F (J) ⇔ NJφ ∈ Wφ. Imposing additional axioms, on top of (I), forces some additional structure onto the family of winning coalitions: • F satisfies (I) and (U) if and only if the grand coalition belongs to every set of winning coalitions: N ∈ Wφ. 489 Endriss, Grandi, & Porello • F satisfies (I) and (N), i.e., it satisfies (S), if and only if there exists a single set of winning coalitions W ⊆ 2N such that φ ∈ F (J) ⇔ NJφ ∈ W. • F satisfies (I) and (A) if and only if collective acceptance of a formula only depends on the number of individuals accepting it: C ∈ Wφ and |C| = |C ′| imply C ′ ∈ Wφ. One consequence of the latter two insights is that, if F satisfies (A) and (S), then |NJφ | = |N J ′ ψ | implies φ ∈ F (J) ⇔ ψ ∈ F (J ′). This is a well-known fact; List and Pettit (2002), for instance, use it in the proof of their impossibility theorem (for the special case of J = J ′). Note that a (somewhat surprising) consequence of this fact is that, in case n is even, there exists no aggregation procedure that satisfies (A), (S), as well as (WR). To see this, it suffices to consider a (single) profile J where exactly n2 agents accept φ and n 2 agents accept ¬φ. Then |NJφ | = |N J ¬φ|, i.e., either both φ and ¬φ must be in F (J), contradicting complement-freeness, or neither φ nor ¬φ must be in F (J), this time contradicting completeness. We emphasise that this basic impossibility result does not involve any notion of logical consistency. On the other hand, when n is odd (which we shall continue to assume), then these axioms characterise a relevant class of aggregation procedures: Proposition 1. F ∈ FΦ[WR,A, S] if and only if there exists a function h : {0, . . . , n} → {0, 1} satisfying h(i) = 1− h(n− i) for all i ∈ N such that φ ∈ F (J) ⇔ h(|NJφ |) = 1. Proof. We have already seen that when F satisfies (S) and (A), then |NJφ | = |N J ′ ψ | implies φ ∈ F (φ) ⇔ ψ ∈ F (J ′). The latter is equivalent to the existence of a function h : {0, . . . , n} → {0, 1} with φ ∈ F (J) ⇔ h(|NJφ |) = 1. The additional requirement of h(i) = 1−h(n− i) then is a consequence of (WR). The other direction is immediate: as acceptance of a formula under F only depends on the number of agents accepting it, F must be anonymous, neutral and independent; the condition h(i) = 1−h(n− i) furthermore ensures completeness and complement-freeness. Dropping either neutrality or independence, we obtain the following representation results: Proposition 2. F ∈ FΦ[WR,A, I] if and only if there exists a function hφ : {0, . . . , n} → {0, 1} for every formula φ ∈ Φ satisfying hφ(i) = 1 − h∼φ(n − i) for all i ∈ N such that φ ∈ F (J) ⇔ hφ(|N J φ |) = 1. Proof. As is clear from our characterisation of procedures satisfying (I) and (A) in terms of winning coalitions given above, for such a procedure we can always decide whether φ should be collectively accepted by only looking at the cardinality of the coalition accepting φ. The rest of the proof proceeds just as for Proposition 1. Proposition 3. F ∈ FΦ[WR,A,N] if and only if there exists a function hJ : {0, . . . , n} → {0, 1} for every profile J ∈ J (Φ)n satisfying hJ (i) = 1− hJ (n− i) for all i ∈ N such that φ ∈ F (J) ⇔ hJ (|N J φ |) = 1. Proof. When we drop (I), then winning coalitions are not anymore associated with formulas, but depend on the profile J we are in. (N) merely ensures that those winning coalitions do not also depend on the formula in question. (WR) again forces the symmetry requirement hJ (i) = 1− hJ (n− i). The opposite direction is once again immediate. 490 Complexity of Judgment Aggregation For each of the three representation results above, if we add (U) to the list of axioms, then this corresponds to requiring h(n) = 1 for each of the characteristic functions h. Finally, recall that we have seen in Section 2.3.1, that F ∈ FΦ[A, S,M I] if and only if F is a uniform quota rule and that F ∈ FΦ[WR,A, S,M I] if and only if F is the majority rule. That is, the representation results stated above all concern natural weakenings of the combination of axioms characterising the majority rule. In particular, we chose never to drop the anonymity axiom, because we find it very appealing and uncontroversial for JA. We also consider unanimity and weak rationality very fundamental (although we make exceptions for the class of quota rules). The independence and neutrality axioms, on the other hand, are much more debatable, which is why we have considered the various options of either including and not including them (although we always keep at least one of them, to maintain a minimal amount of structure). That is, the classes of aggregation procedures covered by the representation results above are all very natural to focus on. 3. Winner Determination In this section we define the problem of winner determination of a given JA procedure as a decision problem, and we study the computational complexity of this problem for each of the procedures presented in Section 2.3. 3.1 Problem Definition The problem of winner determination in voting theory is that of computing the election winner given a profile of preferences supplied by the voters. The corresponding decision problem asks, given a preference profile and a candidate, whether the given candidate is the winner of the election. In JA, we want to compute F (J) for a given profile J . For a resolute aggregation procedure F , we can formulate a corresponding decision problem by asking, for a given formula, whether it belongs to F (J): WinDet(F ) Instance: Agenda Φ, profile J ∈ J (Φ)n, formula φ ∈ Φ. Question: Is φ an element of F (J)? By solving WinDet once for each formula in the agenda, we can compute the collective judgment set from an input profile. Note that asking instead whether a given judgment set J⋆ is equal to F (J) does not lead to an appropriate formulation of the winner determination problem, because to actually compute the winner we would then have to solve our decision problem an exponential number of times (once for each possible J⋆). For the case of irresolute JA procedures F we can adapt the winner determination problem in the following way: WinDet⋆(F ) Instance: Agenda Φ, profile J ∈ J (Φ)n, subset L ⊆ Φ. Question: Is there a J⋆ ⊆ Φ with L ⊆ J⋆ such that J⋆ ∈ F (J)? To see that this is an appropriate formulation of a decision problem corresponding to the task of computing some winning set, note that we can compute a winner using a polynomial 491 Endriss, Grandi, & Porello number of queries to WinDet⋆ as follows. First, ask whether there exists a winning set including an arbitrarily chosen first formula of the agenda φ1, i.e., L = {φ1}. In case the answer is positive, consider a second formula φ2 and query WinDet ⋆ with L = {φ1, φ2}. Use subset L = {∼φ1, φ2} in case of a negative answer. Continue this process until all formulas in the agenda have been covered.7 3.2 Winner Determination for Quota Rules and the Premise-Based Procedure It is immediately clear that winner determination is a polynomial problem for any quota rule, including the majority rule. Fact 4. WinDet(Fm) is in P for any uniform quota rule Fm. Winner determination is also tractable for the premise-based procedure: Proposition 5. WinDet(PBP) is in P. Proof. Counting the number of agents accepting each of the premises and checking for each premise whether the positive or the negative instance has the majority is easy. This determines the collective judgment set as far as the premises are concerned. Deciding whether a given conclusion should be accepted by the collective now amounts to a model checking problem (is the conclusion φ true in the model induced by the accepted premises/literals?), which can also be done in polynomial time. 3.3 Winner Determination for the Distance-Based Procedure We now want to analyse the complexity of the winner determination problem for the distance-based procedure. As the DBP is irresolute, we study the decision problem WinDet⋆. As we shall see, WinDet⋆(DBP) is Θp2-complete, thus showing that this rule is very hard to compute. The class Θp2 (also known as ∆ p 2(O(logn)), P NP[log] or PNP|| ) is the class of problems that can be solved in polynomial time asking a logarithmic number of queries to an NP oracle or, equivalently, that can be solved in polynomial time asking a polynomial number of such queries in parallel (Wagner, 1987; Hemachandra, 1989). To obtain our result, we first have to devise an NP oracle that will then be used in the proof of Θp2-membership. We shall use the following problem: WinDet⋆K(DBP) Instance: Agenda Φ, profile J ∈ J (Φ)n, subset L ⊆ Φ, K ∈ N. Question: Is there a J⋆ ∈ J (Φ) with L ⊆ J⋆ such that ∑ i∈N H(J ⋆, Ji) 6 K? That is, we ask whether there exists a judgment set J⋆ with a Hamming distance to the profile of at mostK that accepts all the formulas in L. In other words, rather than aiming at computing a winning judgment set, this problem merely allows us to compute a judgment set 7. In line with recent work by Hemaspaandra, Hemaspaandra, and Menton (2012), we can therefore argue that our formulation of the winner determination problem is the correct decision problem associated with the search problem of actually computing a winning judgment set. 492 Complexity of Judgment Aggregation of a certain minimal quality (where quality is measured in terms of the Hamming distance). We now show that this problem lies in NP.8 Lemma 6. WinDet⋆K(DBP) is in NP. Proof. We show that WinDet⋆K(DBP) can be modelled as an integer program (without objective function). This proves membership in NP (Papadimitriou, 1981). Suppose we want to answer an instance ofWinDet⋆K(DBP). The number of subformulas of propositions occurring in the agenda Φ is linear in the size (not cardinality) of Φ. We introduce a binary decision variable for each of these subformulas: xi ∈ {0, 1} for the ith subformula. We first write constraints that ensure that the chosen outcome will correspond to a consistent judgment set (i.e., that J⋆ ∈ J (Φ)). Note that we can rewrite any formula in terms of negation, conjunction, and bi-implication without resulting in a superpolynomial (or even superlinear) increase in size. So we only need to show how to encode the constraints for these connectives. The following table indicates how to write these constraints: φ2 = ¬φ1 x2 = 1− x1 φ3 = φ1 ∧ φ2 x3 6 x1 and x3 6 x2 and x1 + x2 6 x3 + 1 φ3 = φ1 ↔ φ2 x1 + x2 6 x3 + 1 and x1 + x3 6 x2 + 1 and x2 + x3 6 x1 + 1 and 1 6 x1 + x2 + x3 Before we continue, consider the following way of rewriting the sum of distances featuring in the definition of WinDet⋆K(DBP): ∑ i∈N H(J⋆, Ji) = n ∑ i=1 ∑ φ∈Φ+ |J⋆(φ)− Ji(φ)| = 1 2 * ∑ φ∈Φ n ∑ i=1 |J⋆(φ)− Ji(φ)| = 1 2 * ∑ φ∈Φ |n * J⋆(φ)− n ∑ i=1 Ji(φ)| We will need to bound this sum from above. Now suppose that variables xi with indices i ∈ {1, . . . ,m} with m = |Φ| are those that correspond to the propositions that are elements of Φ. Let ai = |N J φi | be the number of individuals that accept the ith proposition in Φ (under J). To compute a winner under the DBP, we need to find a consistent judgment set J⋆ (characterised by variables x1, . . . , xm) that minimises the sum |n * x1 − a1| + * * * + |n * xm − am|. We do this by introducing an additional set of integer variables yi > 0 for i = 1, . . . ,m. We can ensure that yi = |n * xi − ai| by adding the following constraints: 9 (∀i 6 m) n * xi − ai 6 yi (∀i 6 m) ai − n * xi 6 yi 8. Our proof not only establishes membership in NP, but also suggests how to implement a solver for this difficult problem. As pointed out by one anonymous reviewer, it is also possible to prove NP-membership more directly, using a certificate that consists of both J⋆ and a satisfying assignment for J⋆. 9. To be precise, these constraints only ensure |n *xi − ai| 6 yi. However, our next constraint will force the yi to be minimal. 493 Endriss, Grandi, & Porello Now the sum 12 * ∑m i=1 yi corresponds to the Hamming distance between the winning set and the profile. To ensure it does not exceed K, we can add the following constraint: 1 2 * m ∑ i=1 yi 6 K Finally, we need to ensure that all the formulas in the set L ⊆ Φ get accepted. We do this by adding one last set of constraints: (for all i such that φi ∈ L) xi = 1 Now, by construction, the integer program we have presented is feasible if and only if the instance of WinDet⋆K(DBP) we have started out with should be answered in the positive. This completes the proof. To obtain an upper bound for the winner determination problem for the DBP, we can now use a standard construction. This first involves identifying the "best" value for K, and then deciding WinDet⋆K(DBP) for that value of K. The latter can be done with a logarithmic number of queries to the problem the complexity of which we have analysed in Lemma 6. Together, this yields the desired upper bound: Lemma 7. WinDet⋆(DBP) is in Θp2. Proof. The problem WinDet⋆(DBP) asks whether there exists a winning judgment set that accepts all formulas in a given subset L ⊆ Φ. Since the Hamming distance between a judgment set and a profile is bounded from above by a polynomial figure, we can solve this problem by performing a binary search over K using a logarithmic number of queries to WinDet⋆K(DBP). More precisely, since ∑ i∈N H(J ⋆, Ji)) 6 K ⋆ = |Φ|2 * |N |, a figure that is polynomial in the size of the problem description, we can ask a first query to WinDet⋆K(DBP) with K = K ⋆ 2 and an empty subset of designated formulas. In case of a positive answer, we can continue the search with a new K = K ⋆ 4 , otherwise we move to the higher half of the interval querying WinDet⋆K(DBP) with K = 3 4 *K ⋆. This process ends after a logarithmic number of steps, providing the exact Hamming distance Kw of a winning candidate from the profile J under consideration. It is now sufficient to run the problem WinDet⋆K(DBP) with K = Kw and subset L as in the original instance of WinDet⋆(DBP) we wanted to solve. In case the answer is positive, since there cannot be a winning judgment set with Hamming distance strictly less than Kw, one of the winning judgment sets contains all formulas in L. On the other hand, in case of a negative answer all judgment sets containing L have Hamming distance bigger than Kw, and thus cannot belong to the winning set. Next, we show that the upper bound established by Lemma 7 is tight. We exploit the similarity of the DBP to the Kemeny rule in preference aggregation to build on a known Θp2-hardness result by Hemaspaandra et al. (2005). Lemma 8. WinDet⋆(DBP) is Θp2-hard. 494 Complexity of Judgment Aggregation Proof. We build a reduction from the problem Kemeny Winner, as defined in the work of Hemaspaandra et al. (2005).10 An instance of this problem consists of a set of candidates C, a profile of linear preference orders P = (P1, . . . , Pn) over C, and a designated candidate c ∈ C. Define the Kemeny score of c as the following expression: KemenyScore(c,P ) = min{ ∑n i=1 dist(Pi, Q) | Q is a linear order with top(Q) = c} Here, dist(Pi, Q) is the Hamming distance between two linear orders (defined as the number of ordered pairs of candidates on which they disagree) and top(Q) is the most preferred candidate under preference order Q. Kemeny Winner asks whether the Kemeny score of c is less than or equal to the Kemeny score of all other candidates d ∈ C. We now build an instance of WinDet⋆(DBP) to decide this problem. Define an agenda ΦC in the following way. First, add propositional variables pab for all ordered pairs of distinct candidates a, b in C; these variables can encode a linear order over C as a binary relation (where pab stands for a ≻ b). Now we can describe the properties of a linear order by means of formulas of the form pab ∧ pbc → pac and pab ↔ ¬pba. We include all of these formulas, for all a, b, c ∈ C, in ΦC . In fact, we include m 2 + 1 syntactic variants (where m = |C|) for each of them.11 The figure m2 + 1 is chosen to be higher than the maximal Hamming distance between any two linear orders (which is m2). Given a preference profile P , we can build a judgment profile JP by encoding each order Pi over C in a judgment set J P i over ΦC . For example, if agent 1's preference order is a ≻ b ≻ c, then JP1 will include the set {pab,¬pba, pbc,¬pcb, pac,¬pca}. In addition, each JPi will include all of the syntactic copies of all of the formulas encoding linear orders. Observe that we have dist(Pi, Pj) = H(J P i , J P j ) by construction. It is therefore sufficient to ask a query to WinDet⋆(DBP) using ΦC as the agenda, J P as the profile, and L = {pcd | d ∈ C, c 6= d} as the set of propositions to accept for sure, to obtain an answer to the initial Kemeny Winner instance with designated candidate c. If the winning ranking features c as the top candidates (i.e., formulas pcd are accepted for all other candidates d), then its Kemeny score will be lower than or equal to that of all other candidates, providing a positive answer to the original problem. A key insight here is to notice that judgment sets encoding relations that are not linear orders will not be considered in the minimisation process, since every disagreement on one of the formulas encoding linear orders will cause a much greater loss in the Hamming distance than what can be gained by modifying the variables encoding the individual candidate rankings. Putting Lemma 7 and 8 together yields a complete characterisation of the complexity of winner determination under distance-based aggregation: Theorem 9. WinDet⋆(DBP) is Θp2-complete. Theorem 9 shows that the DBP is highly intractable. However, by adapting efficient heuristics developed for the Kemeny rule (which, as seen in the proof of Lemma 8, is closely related to the DBP) it may be possible to obtain an implementation of the DBP that achieves an acceptable performance in practice (Conitzer, Davenport, & Kalagnanam, 2006). 10. Hemaspaandra et al. (2005) work with preferences that are weak orders, but point out that their results remain valid when linear orders are used instead. To simplify presentation, we work with linear orders. 11. For instance, for the formula φ we might use the syntactic variants φ, φ ∧ ⊤, φ ∧ ⊤ ∧ ⊤, and so forth. 495 Endriss, Grandi, & Porello 4. Strategic Manipulation In the context of voting, an agent is said to be able to manipulate a voting rule when there exists a situation in which voting in a manner that does not truthfully reflect her preferences will result in an outcome that she prefers to the outcome that would be realised if she were to vote truthfully (Gaertner, 2006). What would constitute an appropriate definition of manipulation in the context of JA is not immediately clear, because in JA there is no notion of preference. However, by fixing a suitable notion of "closeness" on judgment sets, it is possible to build a preference ordering starting from an individual's initial judgment set. This is the approach followed by Dietrich and List (2007c) for JA and by Everaere et al. (2007) in the related setting of belief merging. It builds on the assumption that an agent's individual judgment set is also her most preferred outcome and amongst any two outcomes she will prefer the one that is "closer" to that most preferred outcome. We will measure "closeness" using the Hamming distance and we will call an aggregation procedure F manipulable if it permits a situation where an agent can change the outcome to get closer to her truthful judgment by reporting untruthfully. Our main interest will be the computational complexity of deciding whether a given agent can successfully manipulate under a given profile. In this context, a result showing that manipulation is computationally intractable would count as a positive result. Specifically, we will study this problem for the premise-based procedure. We will not do so for the family of quota rules, because (as we shall see) it is impossible to manipulate a quota rule in the aforementioned sense. We will also not study the manipulation problem for the distance-based procedure, because (as we have seen) even the much more basic winner determination problem already is intractable for this procedure. 4.1 Problem Definition We first need to define a preference ordering over judgment sets for each agent i ∈ N . In principle, there are any number of ways of doing this, but one reasonable approach is to assume that agent i's judgment set Ji is also her most preferred outcome and that her preferences over other outcomes depend on how close they are to Ji (Dietrich & List, 2007c). We shall measure closeness using the Hamming distance, but other distances could also be used to this end (Duddy & Piggins, 2012). So we will say that agent i prefers J to J ′ if and only if H(Ji, J) < H(Ji, J ′). Below we employ standard game-theoretical notation and denote by (J−i, J ′ i) the profile that is like J , except that the judgment set of agent i has been replaced by J ′i . Definition 8. F is manipulable at profile J ∈ J (Φ)n by agent i ∈ N , if there exists an alternative judgment set J ′i ∈ J (Φ) such that H(Ji, F (J−i, J ′ i)) < H(Ji, F (J)). That is, by reporting J ′i rather than her truthful judgment set Ji, agent i can achieve the outcome F (J−i, J ′ i) and that outcome is closer (in terms of the Hamming distance) to her truthful (and most preferred) set Ji than the outcome F (J) that would get realised if she were to truthfully report Ji. A procedure that is not manipulable at any profile by any agent is called strategy-proof. Dietrich and List (2007c) have shown that a JA procedure is strategy-proof if and only if it satisfies (I) and (MI). Indeed, this follows immediately from our definitions: independence 496 Complexity of Judgment Aggregation means that the would-be manipulator can consider one proposition at a time; monotonicity then means that it is always in her best interest to drive up the support for formulas in her judgment set and to reduce the support for those not in her judgment set, i.e., it is in her best interest to report her judgment set truthfully.12 For aggregation procedures for which strategy-proofness cannot be guaranteed, we want to study the algorithmic problem of computing a manipulating judgment set. To this end, we formulate manipulation as a decision problem for an aggregation procedure F : Manip(F ) Instance: Agenda Φ, profile J ∈ J (Φ)n, agent i ∈ N . Question: Is there a J ′i ∈ J (Φ) such that H(Ji, F (J−i, J ′ i)) < H(Ji, F (J))? Note that we are asking whether an agent can manipulate successfully, rather than how. That is, this problem does not immediately correspond to the practical (and potentially harder) problem of computing an actual strategy for the manipulator. However, since the interest here is in obtaining intractability results (to provide protection against manipulation), we can safely concentrate on this formulation, which provides a lower bound for the corresponding search problem. As we have seen, the uniform quota rules (including the majority rule) are all independent and monotonic, which means that they are also strategy-proof (so the algorithmic problem of deciding Manip does not arise for these procedures). Of course, this comes at the price of not always producing outcomes that are consistent. 4.2 Strategic Manipulation under the Premise-Based Procedure We now prove that manipulating the premise-based procedure is intractable, thus showing the existence of the kind of a "jump" in computational complexity between winner determination and manipulation that is desirable in this context. Theorem 10. Manip(PBP) is NP-complete. Proof. We first establish NP-membership. An untruthful judgment set J ′i yielding a preferred outcome can serve as a certificate. Checking the validity of such a certificate means checking that (a) J ′i is actually a complete and consistent judgment set and that (b) the outcome produced by J ′i is better than the outcome produced by the truthful set Ji. As for (a), checking completeness is easy. Consistency can also be decided in polynomial time: for every propositional variable p in the agenda, J ′i must include either p or ¬p; this admits only a single possible model; all that remains to be done is checking that all compound formulas in J ′i are satisfied by that model. 13 As for (b), we need to compute the outcomes for Ji and J ′ i (by Proposition 5, this is polynomial), compute their Hamming distances from Ji, and compare those two distances. Next, we prove NP-hardness by reducing Sat to Manip(PBP). Suppose we are given a propositional formula φ and want to check whether it is satisfiable. We will build a 12. Note that this does not contradict the Gibbard-Satterthwaite Theorem in voting theory (Gaertner, 2006). That theorem involves a universal-domain assumption, while the manner in which we are using the Hamming distance to induce preferences from judgment sets amounts to a domain restriction. 13. That is, at this point we crucially rely on our assumption that the PBP is only defined for agendas that are closed under propositional variables. 497 Endriss, Grandi, & Porello judgment profile for three agents such that the third agent can manipulate the aggregation if and only if φ is satisfiable. Let p1, . . . , pm be the propositional variables occurring in φ, and let q1, q2 be two additional propositional variables. Define an agenda Φ that contains all atoms p1, . . . , pm, q1, q2 and their negation, as well as m + 2 syntactic variants of the formula q1 ∨ (φ ∧ q2), as well as the complements of all of these formulas. For instance, if ψ = q1 ∨ (φ ∧ q2), we might use the syntactic variants ψ, ψ ∧ ⊤, ψ ∧ ⊤ ∧ ⊤, and so forth. Now consider the profile J below (with the rightmost column having a "weight" of m+2): p1 p2 * * * pm q1 q2 q1 ∨ (φ ∧ q2) J1 1 1 * * * 1 0 0 ? J2 0 0 * * * 0 0 1 ? J3 1 1 * * * 1 1 0 1 F (J) 1 1 * * * 1 0 0 0 The judgments of agents 1 and 2 regarding q1 ∨ (φ∧ q2) are irrelevant for our argument, so they are indicated as "?" in the table (but note that they can be determined in polynomial time; in particular, J1(q1 ∨ (φ ∧ q2)) = 0 for any φ). If agent 3 reports her judgment set truthfully (as shown in the table), then the Hamming distance between J3 and the collective judgment set will be 1+ (m+2) = m+3. Note that agent 3 is decisive about all propositional variables (i.e., premises) except for q1 (which will certainly get rejected). Now: • If φ is satisfiable, then agent 3 can report judgments regarding p1, . . . , pm that correspond to a satisfying assignment for φ. If she furthermore accepts q2, then all m+ 2 copies of q1 ∨ (φ ∧ q2) will get accepted in the collective judgment set. Thus, the Hamming distance from J3 to this new outcome will be at most m + 2, i.e., agent 3 will have manipulated successfully. • If φ is not satisfiable, then there is no way to get any of the m+2 copies of q1∨(φ∧q2) accepted (and q1 will get rejected in any case). Thus, agent 3 has no means of improving over the Hamming distance of m + 3 she can guarantee for herself by reporting truthfully. Hence, φ is satisfiable if and only if agent 3 can manipulate successfully, and our reduction from Sat to Manip(PBP) is complete. Thus, manipulating the PBP is significantly harder than using it, at least in terms of worstcase complexity (and under the assumption that P 6= NP). 5. Safety of the Agenda In this section, we introduce the concept of safety of the agenda: An agenda Φ is safe for a given aggregation procedure F , if the collective judgment set returned by F will be consistent for any (consistent) input profile. Of course, this question is only relevant for aggregation procedures that are not always consistent to begin with, which is why we do not consider the PBP and the DBP in this section. In fact, our main interest will be in the safety of the agenda for entire classes of aggregation procedures, characterised by a set 498 Complexity of Judgment Aggregation of axioms AX: Φ is safe for a class FΦ[AX] of aggregation procedures if it is safe for every procedure F ∈ FΦ[AX]. After defining the problem and relating it to so-called agenda characterisation results (or possibility theorems, as we shall call them) studied in the JA literature, we characterise safe agendas for a number of natural combinations of axioms and we establish the computational complexity of checking the safety of an agenda for these cases. 5.1 Problem Definition When performing an aggregation of judgments, we would like to avoid paradoxical outcomes, i.e., we would like to ensure that the collective judgment set will be consistent. Whether or not this will indeed be the case depends on several factors: the aggregation procedure, the agenda, and the individual judgment sets. We cannot control what choices the individuals will make. We might not even know what aggregation procedure exactly they are going to use; we might only know about some of its properties, i.e., we might only know that it belongs to a certain class of procedures. Can we nevertheless guarantee that the collective judgment set will be consistent? We formalise this question as follows: Definition 9. An agenda Φ is safe with respect to a class of aggregation procedures F , if every procedure in F is consistent when applied to profiles of judgment sets over Φ. The example for a paradox presented in the introduction demonstrates the unsafety of the agenda {p,¬p, q,¬q, p∧ q,¬(p∧ q)} with respect to the majority rule. The agenda {p,¬p}, on the other hand, is immediately seen to be safe with respect to the full class of all weakly rational aggregation procedures. The question of whether an agenda is safe is closely related to the rich literature on socalled agenda characterisation results (see, e.g., Nehring & Puppe, 2007; Dokow & Holzman, 2010; Dietrich & List, 2007b; List & Puppe, 2009). These authors have asked the following kind of question: for a given agenda and a given list of axiomatic requirements (always including the requirement of consistency), is it possible to find an aggregation procedure that meets those requirements on that agenda? We may rephrase this question as follows: given an agenda Φ and a list of axioms AX (now excluding consistency), is it possible to find a procedure in FΦ[AX] that is consistent? To distinguish results of this kind from our safety theorems below (which are also agenda characterisations of a kind), we shall refer to them as possibility theorems. To summarise: while a possibility theorem shows that there is some consistent procedure in FΦ[AX], a safety theorem shows that all procedures in FΦ[AX] are consistent. Note that in case a "class" of aggregation procedures consists of just a single aggregation procedure (e.g., FΦ[WR,A, S,M I] consists only of the majority rule), possibility and safety results coincide. Possibility theorems are important from the point of view of the mechanism designer: given certain axioms that I would like to see satisfied, is it still possible to design an aggregation procedure meeting them once I know certain characteristics of the kind of agenda on which the procedure should be used? That is, this is a question we are likely to ask in an "off-line" situation and only once. Safety theorems, on the other hand, are more likely to play a role in an "on-line" situation and they arguably are of particular interest 499 Endriss, Grandi, & Porello for applications. The reason is that actual users are more likely to want an assurance that aggregation will be consistent (provided certain axioms are satisfied and the agenda has certain properties) rather than to learn that there exists a consistent form of aggregation (satisfying certain axioms). For instance, suppose we want to give certain guarantees for the quality of operations of a multiagent system, but without full knowledge of the precise specification of every individual agent and without full knowledge of all the interaction protocols they are going to employ. We might nevertheless have sufficient information for a safety theorem to apply, in which case we can check, for a given agenda, whether consistency can be guaranteed. That is, deciding whether safety holds is a question we might have to answer again and again, for many different agendas. This is why the computational complexity of this problem is a relevant question. 5.2 Agenda Properties As we shall see, if an agenda satisfies certain structural properties, then that might be a sufficient condition to ensure safety with respect to certain aggregation rules. It turns out that the types of agenda properties that are of help here are similar to those that feature in known possibility theorems. Specifically, we shall make use of the so-called median property, introduced by Nehring and Puppe (2007).14 Definition 10. We say that an agenda Φ satisfies the median property (MP), if every inconsistent subset of Φ has itself an inconsistent subset of size at most 2. In other words, Φ satisfies the MP if it has no minimally inconsistent subset (mi-subset) with more than 2 elements. Note that in case Φ is known not to include any tautologies (and thus no contradictions), this definition simplifies to requiring that any mi-subset must be exactly of size 2. We can generalise the median property as follows: Definition 11. Let k > 2. An agenda Φ satisfies the k-median property (kMP), if every inconsistent subset of Φ has itself an inconsistent subset of size at most k. That is, the MP and the 2MP are the same property. Agendas satisfying the MP are already quite simple, but the restriction can be made tighter by requiring all inconsistent subsets to have a particular form. In the sequel, we call an inconsistent set ∆ nontrivially inconsistent if it does not contain any single formula that is a contradiction. Definition 12. An agenda Φ satisfies the simplified median property (SMP), if every nontrivially inconsistent subset of Φ has a subset of the form {φ, ψ} with φ being logically equivalent to ¬ψ. A further simplification yields: Definition 13. An agenda Φ satisfies the syntactic simplified median property (SSMP), if every nontrivially inconsistent subset of Φ has a subset of the form {φ,¬φ}. 14. The name median property derives from the work of Nehring and Puppe (2007), who analyse social choice functions for a class of vector spaces called median spaces. 500 Complexity of Judgment Aggregation Agendas satisfying the SSMP are composed of uncorrelated formulas, i.e., they are essentially equivalent to agendas composed of atoms alone. The SMP is less restrictive, allowing for logically equivalent but syntactically different formulas. Observe that every agenda that satisfies the SMP also satisfies the MP. The converse is not true: Φ = {p,¬p, p∧ q,¬(p∧ q)} satisfies the MP, but not the SMP. Similarly, every agenda that satisfies the SSMP also satisfies the SMP. Again, the converse is not true: Φ = {p,¬p, p ∧ p,¬(p ∧ p)} satisfies the SMP, but not the SSMP. 5.3 Safety Theorems: Linking Agenda Properties and Axioms We now prove several characterisation results for the safe aggregation of judgments, concentrating on classes of procedures defined by weakening the axiomatisation of the majority rule. We begin with a safety theorem for the majority rule itself. In fact, this result is familiar from the literature (Nehring & Puppe, 2007), although it is presented there in a different form. Despite the fact that it is a known result, we still provide a proof, which arguably is simpler than translating the result of Nehring and Puppe into our setting. Theorem 11. An agenda Φ is safe for the majority rule if and only if Φ satisfies the MP. Proof. Let F be the majority rule. (⇐) First, suppose Φ satisfies the MP. We need to show that F (J) is consistent for any J ∈ J (Φ)n. For the sake of contradiction, suppose it is not, and let ∆ be a mi-subset of F (J). As F (J) ⊆ Φ, ∆ can have at most 2 elements. Clearly, it cannot be the case that F (J) includes a contradiction φ⊥, as that would mean that a majority of the agents would have accepted φ⊥. Hence, ∆ must be a set of exactly two formulas, say, φ and ψ. This means that φ must have been accepted by n+12 or more agents and ψ must have been accepted by n+12 or more agents. Hence, by the pigeon hole principle, at least one agent must have accepted both of them, thereby contradicting individual rationality. (⇒) For the other direction, suppose Φ does not satisfy the MP, i.e., Φ has a mi-subset ∆ of size k > 3. We need to show that there exists a profile J such that F (J) is inconsistent. Let φ and ψ be two distinct formulas in ∆. Now consider a profile J with the following properties (recall that we assume that n > 3): (1) the first n−12 agents accept all formulas in ∆ except for φ; (2) the last n−12 agents accept all formulas in ∆ except for ψ; and (3) the "middlemost" agent n+12 accepts φ and ψ and no other formula in ∆. That is, no individual agent accepts all of the formulas in ∆, i.e., we really can build an individually rational profile with these properties (note that any consistent subset of ∆ can always be extended to a complete and consistent judgment set in Φ). However, under this profile each of the formulas in ∆ has a majority and we get ∆ ⊆ F (J), i.e., F (J) is inconsistent. The reason that in this case we were able to rely on a known result is the aforementioned fact that for classes of aggregation procedures consisting of just a single procedure, safety and possibility results coincide. Unfortunately, for larger classes of procedures, this approach of exploiting known possibility results cannot be used. We first establish two sufficient conditions for the safety of the agenda, for two different (fairly large) classes of aggregation procedures: Lemma 12. If an agenda Φ satisfies the SSMP, then Φ is safe for FΦ[WR,U]. 501 Endriss, Grandi, & Porello Proof. Consider an aggregation procedure that satisfies (WR) and (U). Let Φ be an agenda that satisfies the SSMP. Hence, the only way to obtain an inconsistent outcome would be to either accept an inconsistent formula or to accept a formula φ and its syntactic complement ¬φ. The latter possibility is excluded by (WR). So, for the sake of excluding also the former possibility, suppose the inconsistent formula φ⊥ has been collectively accepted. By individual rationality, ∼φ⊥ will get accepted by all agents. Hence, by (U), ∼φ⊥ will be collectively accepted, and thus φ⊥ will be collectively rejected by (WR). Lemma 13. If an agenda Φ satisfies the SMP, then Φ is safe for FΦ[WR,U,N]. Proof. Let F be an aggregation procedure that satisfies (WR), (U) and (N), and let Φ be an agenda that satisfies the SMP. For the sake of contradiction, suppose there exists a profile J ∈ J (Φ)n such that F (J) is inconsistent. We distinguish two cases: (1) There exists a set {φ, ψ} ⊆ F (J) with φ being logically equivalent to ∼ψ. But given that all individual judgment sets are assumed to be complete and consistent, φ being logically equivalent to ∼ψ means that every agent who accepts φ will also accept ∼ψ, and vice versa, i.e., NJφ = N J ∼ψ. Together with (N) this entails φ ∈ F (J) ⇔ ∼ψ ∈ F (J). We already know that φ ∈ F (J); thus, we also get ∼ψ ∈ F (J). But as we also have ψ ∈ F (J), we have obtained a contradiction to (WR). (2) There exists an inconsistent formula φ⊥ ∈ F (J). By the same argument as used in the proof of Lemma 12, this contradicts our assumption of F satisfying (U) and (WR). That is, we obtain a contradiction in all possible cases. Next, we prove two results concerning necessary conditions for the safety of the agenda (now we aim for relatively narrowly defined classes of aggregation procedures): Lemma 14. If an agenda Φ is safe for FΦ[WR,A,U, S], then Φ satisfies the SMP. Proof. Let Φ be an agenda that violates the SMP. We need to provide an example for an aggregation procedure F that satisfies (WR), (A), (U) and (S) that will produce an inconsistent outcome for at least one input profile. We distinguish two cases: (1) Suppose Φ violates the SMP by virtue of having a mi-subset of size greater than 2. In this case Φ also violates the MP. Then Theorem 11 shows that Φ is not safe for the majority rule. As the majority rule satisfies (WR), (A), (U) and (S), we are done. (2) The only other possibility is for Φ to have a mi-subset consisting of two formulas that are not logical complements, i.e., there exists a set of the form {φ, ψ} ⊆ Φ with φ |= ∼ψ but ∼ψ 6|= φ.15 Consider then the following weakly rational, anonymous, unanimous and systematic aggregation procedure Fh for 3 individuals, defined using the notation of Proposition 1: h(0) = h(2) = 0 and h(1) = h(3) = 1. That is, Fh accepts a proposition only if it is accepted by an odd number of individuals.16 Consider the following profile, restricted to φ and ψ and their complements: J1 = {∼φ,∼ψ}, 15. For example, φ might be p ∧ q and ψ might be ¬p. 16. This parity rule has also been used by Dokow and Holzman (2010) to provide a witness for one of their possibility results. 502 Complexity of Judgment Aggregation J2 = {φ,∼ψ}, J3 = {∼φ, ψ}. Note that each of these sets is consistent. However, the profile (opportunely extended to a profile on the whole agenda) will generate an inconsistent outcome, since both φ and ψ are accepted by exactly one individual. Hence, in all cases Φ fails to be safe for at least one procedure in FΦ[WR,A,U, S]. Lemma 15. If an agenda Φ is safe for FΦ[WR,A,U, I], then Φ satisfies the SSMP. Proof. Let Φ be an agenda that violates the SSMP. If it also violates the SMP, then Lemma 14 applies and we are done. Otherwise, there must be two formulas φ and ψ in Φ such that |= φ↔ ∼ψ but φ 6= ∼ψ, i.e., they are logical but not syntactic complements. Let F be the procedure that accepts φ (and rejects ∼φ) if at least one agent accepts φ, that accepts ψ (and rejects ∼ψ) if at least one agent accepts ψ, and that behaves like the majority rule with respect to all other propositions. F satisfies (WR), (A), (U) and (I), but Φ is not safe for F , because in case one agent accepts φ and another ψ, the collective judgment set will include both φ and ψ. We are now ready to state and prove our safety theorems: Theorem 16. An agenda Φ is safe for FΦ[WR,A,U, S] if and only if Φ satisfies the SMP. Proof. One direction is given by Lemma 14. The other follows from Lemma 13 together with the observation that FΦ[WR,U,N] ⊃ FΦ[WR,A,U, S]. This characterisation of safe agendas remains intact when we widen the class of aggregation procedures under consideration from systematic to neutral procedures: Theorem 17. An agenda Φ is safe for FΦ[WR,A,U,N] if and only if Φ satisfies the SMP. Proof. One direction follows from Lemma 14 together with the fact that FΦ[WR,A,U, S] ⊂ FΦ[WR,A,U,N]; the other from Lemma 13 and FΦ[WR,U,N] ⊃ FΦ[WR,A,U,N]. Indeed, while Theorems 16 and 17 state safety results for particularly natural classes of aggregation procedures, by the same argument we can easily see that for any class F with FΦ[WR,A,U, S] ⊆ F ⊆ FΦ[WR,U,N] it is the case that Φ is safe for F if and only if Φ satisfies the SMP. If we drop neutrality from FΦ[WR,A,U, S] rather than independence, then we obtain an even more restrictive characterisation of safe agendas: Theorem 18. An agenda Φ is safe for FΦ[WR,A,U, I] if and only if Φ satisfies the SSMP. Proof. One direction is given by Lemma 15; the other follows from Lemma 12 together with FΦ[WR,U] ⊃ FΦ[WR,A,U, I]. Again, we can generalise the above result to say that, for any class F with FΦ[WR,A,U, I] ⊆ F ⊆ FΦ[WR,U], it is the case that Φ is safe for F if and only if Φ satisfies the SSMP. Finally, for uniform quota rules a characterisation result of the kind we seek is available in the literature (albeit under a different name), at least for rules with certain bounds imposed on the quota (Dietrich & List, 2007a). We state this interesting result as follows (recall that n is the number of individuals): 503 Endriss, Grandi, & Porello Theorem 19. Let k > 2. An agenda Φ is safe for the class of uniform quota rules Fm satisfying the constraint m > n− n k if and only if Φ satisfies the kMP. Theorem 19 is a reformulation of Corollary 2(a) in the work of Dietrich and List (2007a) and we shall not prove it here. Let us conclude this presentation of safety theorems with a remark on the role of the axiom (U) in our results above. Recall that we have not made any assumption about the agenda not including any contradictory formulas (or their complements, i.e., tautologies). If we do make this assumption (which is very common in the JA literature and certainly not unreasonable), then we can remove all mentionings of (U) in the safety results above. Indeed, we only ever used (U) in our proofs to avoid situations where a contradiction gets unanimously rejected yet collectively accepted. If we do not wish to make any assumption regarding the absence of contradictory formulas from the agenda, then we can still remove all mentionings of (U) from our safety results above, provided we replace all mentionings of the SMP with the property of both satisfying the SMP and not including any contradictory formulas (and accordingly for results involving the SSMP). 5.4 Membership Results for Agenda Properties Now that we have identified conditions under which we can guarantee the safety of a given agenda, we want to know how difficult it is to decide whether those conditions are satisfied. As we shall see, this problem is Πp2-complete for each of the classes of aggregation procedures we have considered. Πp2 (also known as coNP NP or "coNP with an NP oracle") is a complexity class located at the second level of the polynomial hierarchy (Meyer & Stockmeyer, 1972; Stockmeyer, 1976; Arora & Barak, 2009). This is the class of decision problems for which a certificate for a negative answer can be verified in polynomial time by a machine that has access to an oracle for answering queries to Sat (or any other NP-complete problem). To prove a problem Πp2-complete, we have to prove both membership in Π p 2 and Π p 2-hardness. We begin by proving membership in Πp2. To do so, we need to provide an algorithm that, when provided with a certificate intended to establish a negative answer, can verify the correctness of that certificate in polynomial time, if we assume that the algorithm has access to a Sat oracle. In the sequel, we shall write MP both for the median property itself and for the problem of deciding whether a given agenda Φ satisfies the median property, and similarly for the SMP, SSMP and kMP. Lemma 20. MP, SMP, SSMP, and kMP are all in Πp2. Proof. We shall present the proof for kMP, which is intuitively the most difficult of the four problems. The proofs for the other three problems are very similar. We need to give an algorithm that decides the correctness of a certificate for the violation of the kMP in polynomial time, assuming it has access to a Sat oracle. For a given agenda Φ (withm = |Φ|), such a certificate is a set ∆ ⊆ Φ that (a) needs to be inconsistent and that (b) must not have any inconsistent subsets of size 6 k. Inconsistency of ∆ can be checked with a single query to the Sat oracle. If m′ = |∆|, then there are ∑k i=1 ( m′ i ) nonempty subsets of ∆ of size 6 k, which is polynomial inm′ (and thus also inm).17 Hence, the second condition can be checked by a further polynomial number of queries to the oracle. 17. This figure is not polynomial in k, but this does not affect the argument, as k is a constant. 504 Complexity of Judgment Aggregation 5.5 Hardness Results for Agenda Properties Next, we want to show that MP, SMP, SSMP and kMP are all Πp2-hard. This can be done by giving a polynomial-time reduction from a problem that is already known to be Πp2-hard to the problem under investigation. For this purpose, we will make use of quantified boolean formulas (QBFs). While QSat, the satisfiability problem18 for general QBFs, is PSPACEcomplete, by imposing suitable syntactic restrictions we can generate complete problems for any level of the polynomial hierarchy. Consider a QBF of the following form: ∀x1 * * *xr∃y1 * * * ys.φ(x1, . . . , xr, y1, . . . , ys) Here φ is an arbitrary propositional formula and {x1, . . . , xr} ∪ {y1, . . . , ys} is the set of all propositional variables occurring in φ (that is, the above could be any QBF for which any existential quantifiers occur inside the scope of all universal quantifiers). The problem of checking whether a formula of this form is satisfiable (i.e., true), which we shall denote ∀∃Sat, is known to be Πp2-complete (Arora & Barak, 2009). Below, we shall abbreviate formulas of the above type by writing ∀x∃y.φ(x,y). The basic intuition for why MP and related problems are Πp2-hard is that they share some basic structure with ∀∃Sat, asking a question of the form "for all subsets of Φ that are inconsistent, does there exist a subset with a certain property?" Indeed, embedding, say, MP into ∀∃Sat is relatively straightforward. However, here we require the opposite: we need to show that even though ∀∃Sat may appear to be more general than MP and our other agenda problems, it actually can be reduced to each of these problems. We first prove a technical lemma. Let ∀∃Sat2 be the problem of checking whether a QBF of the following form is true, given that we already know that (i) φ is not a tautology, (ii) φ is not a contradiction, and (iii) φ is not logically equivalent to a literal: ∀x∃y.φ(x,y) ∧ ∀x∃y.¬φ(x,y) Lemma 21. ∀∃Sat2 is Πp2-hard. Proof. By reduction from ∀∃Sat: Given any QBF of the form ∀x∃y.φ(x,y), we show that checking its satisfiability is equivalent to running ∀∃Sat2 on (φ ∨ a) ∧ b with a being universally and b being existentially quantified, for two new propositional variables a and b not occurring in φ, i.e., to checking the satisfiability of the formula ∀x∀a∃y∃b.[(φ(x,y) ∨ a) ∧ b] ∧ ∀x∀a∃y∃b.¬[(φ(x,y) ∨ a) ∧ b]. First, note that (φ∨ a)∧ b cannot be a tautology, a contradiction, or equivalent to a literal; so the side constraints specified in the definition of ∀∃Sat2 are satisfied. Also note that the first conjunct above is true exactly when the original formula ∀x∃y.φ(x,y) is true. This is because b can always be set to true, and the original formula has to be true whenever a is set to false (a falls under the scope of a universal quantifier). Therefore, a positive answer to the ∀∃Sat2 instance above entails a positive answer to the original ∀∃Sat instance. The other direction is immediate, because the second of the above conjuncts is always satisfiable (by making b false). 18. We shall speak of "satisfiability problems" for QBFs, even though strictly speaking for QBFs there is no distinction between satisfiability, truth and validity, as every QBF is a closed formula. 505 Endriss, Grandi, & Porello We are now able to prove Πp2-hardness for the SSMP: Lemma 22. SSMP is Πp2-hard. Proof. We shall give a polynomial-time reduction from ∀∃Sat2 to SSMP; the claim then follows from Lemma 21. Take any instance of ∀∃Sat2, i.e., the question whether ∀x∃y.φ(x,y) ∧ ∀x∃y.¬φ(x,y) is true for some φ with 6|= φ, φ 6|= ⊥, and 6|= φ ↔ l for literals l. Suppose x = 〈x1, . . . , xr〉, and define an agenda as follows: 19 Φ = {x1,¬x1, x2,¬x2, . . . , xr,¬xr, (φ ∧ ⊤),¬(φ ∧ ⊤)} We now prove that Φ violates the SSMP if and only if the answer to our ∀∃Sat2-question is NO. To see this, consider the following facts. First, suppose Φ violates the SSMP. Under what circumstances will this be the case? As φ is neither a tautology nor a contradiction, any inconsistent subset of Φ must be nontrivially inconsistent. Furthermore, by construction of Φ (consisting largely of literals), any inconsistent subset of Φ not including a pair of syntactic complements must include either (φ ∧⊤) or ¬(φ ∧⊤), as well as a (complementfree) subset of {x1,¬x1, . . . , xr,¬xr}. That is, the only way of violating the SSMP is to find a subset of literals from {x1,¬x1, . . . , xr,¬xr} to make true that forces either (φ ∧ ⊤) or ¬(φ∧⊤) to be false. But this is precisely the situation in which our instance of ∀∃Sat2 requires a negative answer. For the other direction, suppose the answer to our ∀∃Sat2-question is NO. This means that we are able to find an assignment ρ for the variables in x that makes either φ or ¬φ unsatisfiable. W.l.o.g., suppose we are in the latter situation. Construct a subset of Φ, containing ¬(φ∧⊤), that includes the literal xi if it is set to true by the assignment ρ, and ¬xi otherwise. This is an inconsistent subset of Φ, and since φ is neither a tautology nor a contradiction, this falsifies the SSMP. Proving hardness for the SMP works similarly: Lemma 23. SMP is Πp2-hard. Proof. The construction used is the same as for the proof of Lemma 22. The only additional insight required is the observation that for the special kind of agenda constructed in that proof, the SMP and the SSMP coincide: By excluding formulas φ that are equivalent to literals, we ensure that the agenda Φ constructed in the previous proof does not contain any pairs of logically equivalent formulas. For the MP we give a proof using a reduction from the SSMP: Lemma 24. MP is Πp2-hard. Proof. We will show how to reduce the problem of deciding SSMP to an instance of MP. Let Φ be an agenda on which we want to test the SSMP and let Φ+ = {φ1, . . . , φm} be the set of non-negated formulas in Φ. Now build the set Ψ+ in the following way: copy all formulas in Φ+ m times, every time renaming the variables occurring in φi, obtaining the 19. Using (φ ∧ ⊤) rather than φ ensures that the agenda Φ does not include doubly-negated formulas. 506 Complexity of Judgment Aggregation formulas φji for 1 6 i, j 6 m. For every i substitute φ i i by φ i i∨p i, where pi is a new variable not occurring in any of the φji . Finally, add p 1, . . . , pm to Ψ+. We obtain the following set: Ψ+ = {p1, φ11 ∨ p 1, . . . , φ1m, p2, φ21, φ 2 2 ∨ p 2, . . . , φ2m, ... pm, φm1 , . . . , φ m m ∨ p m} Define Ψ = Ψ+ ∪ {¬ψ | ψ ∈ Ψ+}. We will now show that Φ satisfies the SSMP if and only if Ψ satisfies the MP. One direction is immediate. Suppose Φ does not satisfy the SSMP. Then Φ must have a mi-subset ∆ of size k > 2.20 Let ∆ = {φi1 , . . . , φik}. Then there exists a subset of Ψ, namely ∆′ = {¬pi1 , φi1i1 ∨ p i1 , φi1i2 , . . . , φ i1 ik }, that is a mi-set of size k + 1 > 3, thereby falsifying the MP. For the opposite direction, suppose that Ψ does not satisfy the MP. That is, Ψ has a mi-subset ∆ of size > 3. By construction of Ψ, we know that such a subset must only contain formulas with the same superscript or their complements (all other formulas having different variables). If this subset does not contain any pi or ¬pi, then we can find a copy of it in Φ, which then violates the SSMP, in which case we are done. Clearly, ∆ cannot include both pi and ¬pi, as that would contradict |∆| > 3. So we are left with those cases where ∆ includes either pi or ¬pi for some i. Then, by minimality, also φii ∨ p i or its negation must be included. We can now reason by cases: (1) if both pi and φii ∨ p i are in ∆, then by dropping the disjunction we will still get an inconsistent subset, against the assumption of minimality; (2) both ¬pi and ¬(φii ∨ p i) cannot be in ∆ for the same reason; (3) finally, pi together with the negation of φii ∨ p i is already inconsistent. Therefore, we can conclude that ∆ must be of the form {¬pi, φii∨p i}∪∆i, where ∆i is a set of (one or more) formulas in Ψ with the same superscript i. It is now easy to see that the set we obtain when we remove the superscript from {φii} ∪∆ i is a mi-subset of Φ that falsifies the SSMP. In particular, ¬φii 6∈ ∆ i, because ¬φii 6∈ Ψ by construction, i.e., the mi-subset of Φ we obtain does not consist of two formulas that are logical complements. Finally, we establish hardness for the kMP: Lemma 25. kMP is Πp2-hard for every k > 2. Proof. For k = 2, the claim has been established by Lemma 24. Now observe that we can use exactly the same construction as in the proof of Lemma 24 to reduce any instance of kMP for some k > 2 to an instance of the corresponding (k+1)MP. Hence, by a simple inductive argument, kMP must be Πp2-hard for any finite k > 2. 5.6 Complexity of the Safety of the Agenda We have shown that deciding whether a given agenda Φ satisfies the MP, the SMP, the SSMP, or the kMP is both in Πp2 and Π p 2-hard. Furthermore, in Section 5.3 we have linked these properties to the safety of Φ for various combinations of axioms. As an immediate corollary to all of these results, we obtain our theorem concerning the complexity of deciding the safety of an agenda: 20. The fact that ∆ cannot contain two formulas that are logical complements is not relevant for our proof. 507 Endriss, Grandi, & Porello Theorem 26. Deciding the problem of the safety of an agenda is Πp2-complete for any of the following classes of aggregation procedures: (i) FΦ[WR,A, S,M I], consisting only of the majority rule; (ii) FΦ[WR,A,U, S], the systematic procedures; (iii) FΦ[WR,A,U,N], the neutral procedures; (iv) FΦ[WR,A,U, I], the independent procedures; (v) any class of uniform quota rules Fm with m > n− n k for some k > 2. Proof. Concerning Πp2-hardness, (i) is a direct consequence of Theorem 11 and Lemma 24. In the same way, (ii) is derived from Theorem 16 and Lemma 23, (iii) from Theorem 17 and Lemma 23, and (iv) from Theorem 18 and Lemma 22. Finally, (v) follows from Theorem 19 together with Lemma 25. Membership in Πp2 follows from Lemma 20 in all five cases. That is, not only is it the case that the safety of the agenda can only be guaranteed for structurally simple agendas, but deciding whether a given agenda meets those structural constraints is highly intractable. This is a negative result in the sense that it concerns a problem that we would like to be able to solve efficiently. We should stress that this does not render the problem hopeless. Work on QBF solvers has seen a lot of progress in recent years (see, e.g., Narizzano, Pulina, & Tacchella, 2006), and such tools could be deployed to check whether an agenda satisfies a given type of median property.21 In any event, understanding how a naturally arising question in JA relates to a difficult but well-studied algorithmic problem such as ∀∃Sat is interesting and worthwhile in its own right. 6. Related Work: Computational Perspectives on Judgment Aggregation Starting with the work of List and Pettit (2002), most research in JA has focussed either on the philosophical implications of the fact that aggregation may result in an inconsistent outcome or on the derivation of impossibility and characterisation results. The extensive literature in this field has recently been reviewed by List and Puppe (2009). Some work has also explored the links between JA and preference aggregation (Dietrich & List, 2007b; Grossi, 2009; Porello, 2010; Grandi & Endriss, 2011) and several recent contributions have furthermore focussed on the definition and analysis of specific aggregation procedures (Dietrich & List, 2007a; Dietrich & Mongin, 2010; Miller & Osherson, 2009; Lang et al., 2011). Here we shall instead concentrate on contributions to JA that either have a computational slant or that are otherwise relevant to AI. Besides our own previous work on the subject of the present paper (Endriss et al., 2010a, 2010b), there have been a small number of contributions in computational social choice taking a computational perspective on JA (Nehama, 2010; Slavkovik & Jamroga, 2011; Baumeister, Erdélyi, & Rothe, 2011; Baumeister, Erdélyi, Erdélyi, & Rothe, 2012): The first example is the work of Nehama (2010), who proposes a framework for approximate JA in which the goal of finding an aggregation procedure that will never return an inconsistent 21. As pointed out by one anonymous reviewer, Answer Set Programming may also be a useful framework in which to reason about safety problems. The DLV System, for instance, provides a flexible tool for deciding arbitrary problems located at the second level of the polynomial hierarchy (Leone, Pfeifer, Faber, Eiter, Gottlob, Perri, & Scarcello, 2006). 508 Complexity of Judgment Aggregation judgment set is replaced by the goal of finding a procedure under which returning an inconsistent set is highly unlikely. The (negative) result obtained for this framework is that this does however not extend the range of available procedures in a significant way. Second, Slavkovik and Jamroga (2011) extend the standard JA framework with weights (to model differences in influence between individuals) and provide an upper bound on the complexity of the winner determination problem for a family of distance-based aggregation procedures. Third, Baumeister et al. (2011) provide the first study of the computational complexity of the bribery problem in JA, asking whether it is possible to obtain a desired outcome if up to k individual agents can be bribed so as to change their judgment set. Finally, Baumeister et al. (2012) discuss the complexity of various forms of controlling judgment aggregation processes, e.g., influencing the outcome by adding or removing judges. The clearest example for work that explores the integration of ideas from JA with ideas coming from a field traditionally studied in AI is the recent work on connections between JA and abstract argumentation frameworks (Rahwan & Tohmé, 2010; Caminada & Pigozzi, 2011): A problem commonly studied in abstract argumentation is how to decide which ones out of a set of arguments that mutually attack each other to accept, which to reject, and on which to remain undecided. Rahwan and Tohmé (2010) study a variant of this problem where a group of agents have to decide which status to award to which argument, a problem that naturally lends itself to be viewed through the lens of JA. In related work, Caminada and Pigozzi (2011) have proposed an approach to JA that involves a translation into an abstract argumentation framework, which makes the tools and techniques of abstract argumentation available to the aggregation of judgments. A field of research within AI that is closely related to JA is belief merging (see, e.g., Konieczny & Pino Pérez, 2002; Maynard-Zhang & Lehmann, 2003; Chopra et al., 2006; Everaere et al., 2007). The work of Konieczny and Pino Pérez (2002), in particular, has inspired the distance-based procedure for JA we have used in this paper. JA and belief merging as modelled by Konieczny and Pino Pérez share interesting features, but ultimately study different problems. While in JA individuals are assumed to submit consistent judgment sets, in belief merging this constraint is enforced only on the outcome. This reflects the view that consistency in belief merging (modelled in terms of an integrity constraint) is a feasibility requirement, while in JA it amounts to a rationality assumption. 7. Conclusions and Future Work We have studied the computational complexity of three problems in JA: computing the winning judgment set for a given aggregation procedure, deciding whether manipulation would be beneficial for a given agent under a given aggregation procedure and for a given profile, and deciding on the safety of the agenda for a given class of aggregation procedures. We have also proven several safety theorems that link safety to simple structural properties of the agenda and that provide an interesting counterpart to known possibility theorems. Our results show that, while the winner determination problem is easy for all quota rules and the premise-based procedure, it is intractable for the otherwise attractive distance-based procedure. Regarding strategic manipulation, we have seen that manipulation is NP-hard for the premise-based procedure, which is a positive result. We have also seen that for quota rules the question of manipulation complexity does not arise, at least not for the 509 Endriss, Grandi, & Porello model of preferences used here. For the distance-based procedure, we have not investigated the complexity of the manipulation problem, because already the winner determination problem was found to be intractable. In our work on the safety of the agenda, we have derived characterisation results for a wide range of procedures, defined in terms of commonly used axioms. We have seen that safety can only be guaranteed for relatively simple agendas and we have also seen that deciding whether these simplicity conditions are met is highly intractable. While work on the computational aspects of JA has so far been limited to a small number of interesting but scattered contributions, we strongly believe that JA should be taken up as an important research topic in both AI and computational social choice. One important direction to pursue concerns practical algorithms for the problems studied in this paper (as well as for related problems naturally arising in JA). We have already mentioned that existing work on algorithms for the winner determination problem for the Kemeny rule in preference aggregation (Conitzer et al., 2006) may provide a starting point for a working implementation of the distance-based procedure and that work on QBF solvers in automated reasoning (Narizzano et al., 2006) or work on Answer Set Programming (Leone et al., 2006) could prove helpful in tackling the challenges identified by our complexity results regarding the safety of the agenda. Alongside the development of practical algorithms, improving our understanding of the algorithmic aspects of JA by studying it in the framework of parameterised complexity would also be of great interest. In the context of voting, this approach has lead to a number of insightful results (Betzler, 2010). Indeed, for JA, initial steps in this direction have already been taken by Baumeister et al. (2011). Studying the winner determination problem, both in complexity-theoretic and in practical terms, for the other distance-based procedures proposed by Miller and Osherson (2009) and Lang et al. (2011) also constitutes a very worthwhile direction for future work. Recall that we have analysed manipulation for one particular way of defining preferences, namely in terms of the Hamming distance to an agent's true set of judgments. Thus, it would be interesting to investigate to what extent changing the definition of manipulation (by altering the notion of induced preference) affects our complexity result. Indeed, other notions of induced preference (and thus manipulation) are conceivable. For instance, a would-be manipulator might only be interested in the status of specific propositions (e.g., the "conclusions") or she might use a different notion of distance, e.g., one of those recently proposed by Duddy and Piggins (2012). Above we have justified our decision not to study the complexity of the manipulation problem for the distance-based procedure with the fact that already the much more basic winner determination problem is Θp2-complete. An important question that we believe requires discussion in the research community is whether this is indeed a valid argument. In the context of voting, the initial idea of Bartholdi et al. (1989) had been that, say, an NP-hardness result for the manipulation problem for a particular voting rule might suggest that this rule is immune against manipulation in practice. Recent work very strongly suggests that this is not the case (Faliszewski & Procaccia, 2010), and that for the kind of NP-hard problems encountered in this context algorithms that perform well in practice are relatively easy to design (Walsh, 2011). The question now arises whether the same will still be true for hardness results with respect to higher complexity classes. For instance, it 510 Complexity of Judgment Aggregation is conceivable that it will be possible to design algorithms that can efficiently solve most "typical" instances of the winner determination problem for the distance-based procedure, while it might turn out to be much more difficult to design a similarly successful algorithm for the corresponding manipulation problem. That is, the question arises whether hardnessof-manipulation studies need to be restricted to problems for which winner determination is polynomial, or whether any "jump" in complexity is desirable in principle and might provide some level of protection in practice. Regarding the safety of the agenda, we have given results for the most natural combinations of axioms that correspond to a weakening of the majority rule, but a similar study could also be conducted for other combinations of axioms. Indeed, it would be interesting to explore how robust our Πp2-completeness results are. That is, an open question that suggests itself is whether there exists an interesting and relevant class of aggregation procedures for which the safety problem falls into a different complexity class. Generally speaking, we believe that much more work on exploring the obvious potential of JA for AI and multiagent systems is needed. This should lead to both practical advances and the definition of interesting new theoretical problems. Some steps in this direction have recently been taken by Slavkovik (2012), concerning the modelling of collective decision making in multiagent systems, and by Caminada and Pigozzi (2011) and Rahwan and Tohmé (2010), concerning applications of JA to abstract argumentation. Acknowledgments This paper builds on our earlier work on the complexity of judgment aggregation presented at AAMAS-2010 (Endriss et al., 2010a) and COMSOC-2010 (Endriss et al., 2010b). We would like to thank the reviewers and members of the audiences of these meetings, three reviewers for the Journal of Artificial Intelligence Research, and the attendees of workshop and seminar talks we have given on this topic at Amsterdam, Barcelona, Chongqing, Luxembourg, Moscow, New Delhi, Padova, Paris, Pisa, and Tilburg for the many helpful suggestions received. References Arora, S., & Barak, B. (2009). Computational Complexity: A Modern Approach. Cambridge University Press. Bartholdi, J. J., Tovey, C. A., & Trick, M. A. (1989). The computational difficulty of manipulating an election. Social Choice and Welfare, 6 (3), 227–241. Baumeister, D., Erdélyi, G., Erdélyi, O. J., & Rothe, J. (2012). Control in judgment aggregation. In Proceedings of the 6th Starting AI Researchers' Symposium (STAIRS-2012). IOS Press. Baumeister, D., Erdélyi, G., & Rothe, J. (2011). How hard is it to bribe the judges? A study of the complexity of bribery in judgment aggregation. In Proceedings of the 2nd International Conference on Algorithmic Decision Theory (ADT-2011). SpringerVerlag. 511 Endriss, Grandi, & Porello Betzler, N. (2010). A Multivariate Complexity Analysis of Voting Problems. Ph.D. thesis, University of Jena. Brandt, F., Conitzer, V., & Endriss, U. (2012). Computational social choice. In Weiss, G. (Ed.), Multiagent Systems. MIT Press. In press. Caminada, M., & Pigozzi, G. (2011). On judgment aggregation in abstract argumentation. Autonomous Agents and Multi-Agent Systems, 22 (1), 64–102. Chevaleyre, Y., Endriss, U., Lang, J., & Maudet, N. (2007). A short introduction to computational social choice. In Proceedings of the 33rd Conference on Current Trends in Theory and Practice of Computer Science (SOFSEM-2007). Springer-Verlag. Chopra, S., Ghose, A., & Meyer, T. (2006). Social choice theory, belief merging, and strategy-proofness. Information Fusion, 7 (1), 61–79. Conitzer, V., Davenport, A. J., & Kalagnanam, J. (2006). Improved bounds for computing Kemeny rankings. In Proceedings of the 21st National Conference on Artificial Intelligence (AAAI-2006). Dietrich, F. (2007). A generalised model of judgment aggregation. Social Choice and Welfare, 28 (4), 529–565. Dietrich, F., & List, C. (2007a). Judgment aggregation by quota rules: Majority voting generalized. Journal of Theoretical Politics, 19 (4), 391–424. Dietrich, F., & List, C. (2007b). Arrow's theorem in judgment aggregation. Social Choice and Welfare, 29 (1), 19–33. Dietrich, F., & List, C. (2007c). Strategy-proof judgment aggregation. Economics and Philosophy, 23 (3), 269–300. Dietrich, F., & Mongin, P. (2010). The premiss-based approach to judgment aggregation. Journal of Economic Theory, 145, 562–582. Dokow, E., & Holzman, R. (2010). Aggregation of binary evaluations. Journal of Economic Theory, 145 (2), 495–511. Duddy, C., & Piggins, A. (2012). A measure of distance between judgment sets. Social Choice and Welfare, 39 (4), 855–867. Endriss, U., Grandi, U., & Porello, D. (2010a). Complexity of judgment aggregation: Safety of the agenda. In Proceedings of the 9th International Conference on Autonomous Agents and Multiagent Systems (AAMAS-2010). Endriss, U., Grandi, U., & Porello, D. (2010b). Complexity of winner determination and strategic manipulation in judgment aggregation. In Proceedings of the 3rd International Workshop on Computational Social Choice (COMSOC-2010). Everaere, P., Konieczny, S., & Marquis, P. (2007). The strategy-proofness landscape of merging. Journal of Artificial Intelligence Research (JAIR), 28 (1), 49–105. Faliszewski, P., & Procaccia, A. D. (2010). AI's war on manipulation: Are we winning?. AI Magazine, 31 (4), 53–64. Gaertner, W. (2006). A Primer in Social Choice Theory. LSE Perspectives in Economic Analysis. Oxford University Press. 512 Complexity of Judgment Aggregation Grandi, U., & Endriss, U. (2011). Binary aggregation with integrity constraints. In Proceedings of the 22nd International Joint Conference on Artificial Intelligence (IJCAI2011). Grossi, D. (2009). Unifying preference and judgment aggregation.. In Proceedings of the 8th International Conference on Autonomous Agents and Multiagent Systems (AAMAS2009). Hemachandra, L. A. (1989). The strong exponential hierarchy collapses. Journal of Computer and System Sciences, 39 (3), 299–322. Hemaspaandra, E., Hemaspaandra, L. A., & Rothe, J. (1997). Exact analysis of Dodgson elections: Lewis Carroll's 1876 system is complete for parallel access to NP. Journal of the ACM, 44 (6), 806–825. Hemaspaandra, E., Hemaspaandra, L. A., & Menton, C. (2012). Search versus decision for election manipulation problems. Tech. rep. URCS-TR-2012-971, University of Rochester, Computer Science Department. Hemaspaandra, E., Spakowski, H., & Vogel, J. (2005). The complexity of Kemeny elections. Theoretical Computer Science, 349 (3), 382–391. Kemeny, J. (1959). Mathematics without numbers. Daedalus, 88 (4), 577–591. Konieczny, S., & Pino Pérez, R. (2002). Merging information under constraints: A logical framework. Journal of Logic and Computation, 12 (5), 773–808. Kornhauser, L. A., & Sager, L. G. (1993). The one and the many: Adjudication in collegial courts. California Law Review, 81 (1), 1–59. Lang, J., Pigozzi, G., Slavkovik, M., & van der Torre, L. (2011). Judgment aggregation rules based on minimization. In Proceedings of the 13th Conference on Theoretical Aspects of Rationality and Knowledge (TARK-XIII). Leone, N., Pfeifer, G., Faber, W., Eiter, T., Gottlob, G., Perri, S., & Scarcello, F. (2006). The DLV system for knowledge representation and reasoning. ACM Transactions on Computational Logic, 7 (3), 499–562. List, C., & Pettit, P. (2002). Aggregating sets of judgments: An impossibility result. Economics and Philosophy, 18 (1), 89–110. List, C., & Puppe, C. (2009). Judgment aggregation: A survey. In Handbook of Rational and Social Choice. Oxford University Press. Maynard-Zhang, P., & Lehmann, D. J. (2003). Representing and aggregating conflicting beliefs. Journal of Artificial Intelligence Research (JAIR), 19, 155–203. Meyer, A. R., & Stockmeyer, L. J. (1972). The equivalence problem for regular expressions with squaring requires exponential space. In Proceedings of the 13th Annual Symposium on Switching and Automata Theory (SWAT/FOCS-1972). IEEE Computer Society. Miller, M., & Osherson, D. (2009). Methods for distance-based judgment aggregation. Social Choice and Welfare, 32 (4), 575–601. 513 Endriss, Grandi, & Porello Narizzano, M., Pulina, L., & Tacchella, A. (2006). The QBFEVAL web portal. In Proceedings of the 10th European Conference on Logics in Artificial Intelligence (JELIA2006). Springer-Verlag. Nehama, I. (2010). Approximate judgment aggregation. In Proceedings of the 3rd International Workshop on Computational Social Choice (COMSOC-2010). Nehring, K., & Puppe, C. (2007). The structure of strategy-proof social choice. Part I: General characterization and possibility results on median spaces. Journal of Economic Theory, 135 (1), 269–305. Nehring, K., & Puppe, C. (2010). Abstract Arrowian aggregation. Journal of Economic Theory, 145 (2), 467–494. Papadimitriou, C. H. (1981). On the complexity of integer programming. Journal of the ACM, 28 (4), 765–768. Papadimitriou, C. H. (1994). Computational Complexity. Addison Wesley. Pettit, P. (2001). Deliberative democracy and the discursive dilemma. Philosophical Issues, 11 (1), 268–299. Pigozzi, G. (2006). Belief merging and the discursive dilemma. Synthese, 152 (2), 285–298. Porello, D. (2010). Ranking judgments in Arrow's setting. Synthese, 173 (2), 199–210. Rahwan, I., & Tohmé, F. (2010). Collective argument evaluation as judgement aggregation. In Proceedings of the 9th International Conference on Autonomous Agents and Multiagent Systems (AAMAS-2010). Rothe, J., Spakowski, H., & Vogel, J. (2003). Exact complexity of the winner problem for Young elections. Theoretical Computer Science, 63 (4), 375–386. Slavkovik, M. (2012). Judgment Aggregation for Multiagent Systems. Ph.D. thesis, University of Luxembourg. Slavkovik, M., & Jamroga, W. (2011). Distance-based judgment aggregation of three-valued judgments with weights. In Proceedings of the IJCAI-2011 Workshop on Social Choice and Artificial Intelligence. Stockmeyer, L. J. (1976). The polynomial-time hierarchy. Theoretical Computer Science, 3 (1), 1–22. Wagner, K. W. (1987). More complicated questions about maxima and minima, and some closures of NP. Theoretical Computer Science, 51 (1–2), 53–80. Walsh, T. (2011). Where are the hard manipulation problems?. Journal of Artificial Intelligence Research (JAIR), 42, 1–29.