Decision and Game Theory for Security

9th International Conference GameSec

2018 Seattle WA USA October 29 31
2018 Proceedings Linda Bushnell
Visit to download the full and correct content document:
https://textbookfull.com/product/decision-and-game-theory-for-security-9th-internation
al-conference-gamesec-2018-seattle-wa-usa-october-29-31-2018-proceedings-linda-
bushnell/
More products digital (pdf, epub, mobi) instant
download maybe you interests ...

Swarm Intelligence 11th International Conference ANTS

2018 Rome Italy October 29 31 2018 Proceedings Marco
Dorigo

https://textbookfull.com/product/swarm-intelligence-11th-
international-conference-ants-2018-rome-italy-
october-29-31-2018-proceedings-marco-dorigo/

Discovery Science 21st International Conference DS 2018

Limassol Cyprus October 29 31 2018 Proceedings Larisa
Soldatova

https://textbookfull.com/product/discovery-science-21st-
international-conference-ds-2018-limassol-cyprus-
october-29-31-2018-proceedings-larisa-soldatova/

Cyberspace Safety and Security 10th International

Symposium CSS 2018 Amalfi Italy October 29 31 2018
Proceedings Arcangelo Castiglione

https://textbookfull.com/product/cyberspace-safety-and-
security-10th-international-symposium-css-2018-amalfi-italy-
october-29-31-2018-proceedings-arcangelo-castiglione/

Decision and Game Theory for Security 4th International

Conference GameSec 2013 Fort Worth TX USA November 11
12 2013 Proceedings 1st Edition Emrah Akyol

https://textbookfull.com/product/decision-and-game-theory-for-
security-4th-international-conference-gamesec-2013-fort-worth-tx-
usa-november-11-12-2013-proceedings-1st-edition-emrah-akyol/
Decision and Game Theory for Security 7th International
Conference GameSec 2016 New York NY USA November 2 4
2016 Proceedings 1st Edition Quanyan Zhu

https://textbookfull.com/product/decision-and-game-theory-for-
security-7th-international-conference-gamesec-2016-new-york-ny-
usa-november-2-4-2016-proceedings-1st-edition-quanyan-zhu/

Foundations of Intelligent Systems 24th International

Symposium ISMIS 2018 Limassol Cyprus October 29 31 2018
Proceedings Michelangelo Ceci

https://textbookfull.com/product/foundations-of-intelligent-
systems-24th-international-symposium-ismis-2018-limassol-cyprus-
october-29-31-2018-proceedings-michelangelo-ceci/

Static Analysis 25th International Symposium SAS 2018

Freiburg Germany August 29 31 2018 Proceedings Andreas
Podelski

https://textbookfull.com/product/static-analysis-25th-
international-symposium-sas-2018-freiburg-germany-
august-29-31-2018-proceedings-andreas-podelski/

Computational Logistics 9th International Conference

ICCL 2018 Vietri sul Mare Italy October 1 3 2018
Proceedings Raffaele Cerulli

https://textbookfull.com/product/computational-logistics-9th-
international-conference-iccl-2018-vietri-sul-mare-italy-
october-1-3-2018-proceedings-raffaele-cerulli/

Provable Security 12th International Conference ProvSec

2018 Jeju South Korea October 25 28 2018 Proceedings
Joonsang Baek

https://textbookfull.com/product/provable-security-12th-
international-conference-provsec-2018-jeju-south-korea-
october-25-28-2018-proceedings-joonsang-baek/
 Linda Bushnell
Radha Poovendran
Tamer Başar (Eds.)
LNCS 11199

Decision and
Game Theory for Security
9th International Conference, GameSec 2018
Seattle, WA, USA, October 29–31, 2018
Proceedings

123
Lecture Notes in Computer Science 11199
Commenced Publication in 1973
Founding and Former Series Editors:
Gerhard Goos, Juris Hartmanis, and Jan van Leeuwen

Editorial Board
David Hutchison
Lancaster University, Lancaster, UK
Takeo Kanade
Carnegie Mellon University, Pittsburgh, PA, USA
Josef Kittler
University of Surrey, Guildford, UK
Jon M. Kleinberg
Cornell University, Ithaca, NY, USA
Friedemann Mattern
ETH Zurich, Zurich, Switzerland
John C. Mitchell
Stanford University, Stanford, CA, USA
Moni Naor
Weizmann Institute of Science, Rehovot, Israel
C. Pandu Rangan
Indian Institute of Technology Madras, Chennai, India
Bernhard Steffen
TU Dortmund University, Dortmund, Germany
Demetri Terzopoulos
University of California, Los Angeles, CA, USA
Doug Tygar
University of California, Berkeley, CA, USA
Gerhard Weikum
Max Planck Institute for Informatics, Saarbrücken, Germany
More information about this series at http://www.springer.com/series/7410
Linda Bushnell Radha Poovendran
•

Tamer Başar (Eds.)

Decision and
Game Theory for Security
9th International Conference, GameSec 2018
Seattle, WA, USA, October 29–31, 2018
Proceedings

123
Editors
Linda Bushnell Tamer Başar
University of Washington University of Illinois at Urbana–Champaign
Seattle, WA Urbana, IL
USA USA
Radha Poovendran
University of Washington
Seattle, WA
USA

ISSN 0302-9743 ISSN 1611-3349 (electronic)

Lecture Notes in Computer Science
ISBN 978-3-030-01553-4 ISBN 978-3-030-01554-1 (eBook)
https://doi.org/10.1007/978-3-030-01554-1

Library of Congress Control Number: 2018955975

LNCS Sublibrary: SL4 – Security and Cryptology

© Springer Nature Switzerland AG 2018

This work is subject to copyright. All rights are reserved by the Publisher, whether the whole or part of the
material is concerned, specifically the rights of translation, reprinting, reuse of illustrations, recitation,
broadcasting, reproduction on microfilms or in any other physical way, and transmission or information
storage and retrieval, electronic adaptation, computer software, or by similar or dissimilar methodology now
known or hereafter developed.
The use of general descriptive names, registered names, trademarks, service marks, etc. in this publication
does not imply, even in the absence of a specific statement, that such names are exempt from the relevant
protective laws and regulations and therefore free for general use.
The publisher, the authors and the editors are safe to assume that the advice and information in this book are
believed to be true and accurate at the date of publication. Neither the publisher nor the authors or the editors
give a warranty, express or implied, with respect to the material contained herein or for any errors or
omissions that may have been made. The publisher remains neutral with regard to jurisdictional claims in
published maps and institutional affiliations.

This Springer imprint is published by the registered company Springer Nature Switzerland AG
The registered company address is: Gewerbestrasse 11, 6330 Cham, Switzerland
 Preface

Recent advances in information and communication technologies, and the incessantly

tighter connectivity these advances have resulted in among the world’s population and
between humans and machines, pose significant security challenges that impact all
aspects of modern society. Concerted efforts are being directed toward alleviating the
underlying vulnerability, protecting heterogeneous, large-scale and dynamic systems,
and managing security risks faced by critical infrastructures, through rigorous and
practically relevant analytical methods. Decision and game theoretic framework is the
centerpiece of these efforts, involving also several neighboring disciplines and tech-
niques, such as distributed optimization, information theory and communication,
statistics, economics, dynamic control, and mechanism design, toward an ultimate goal
of building resilient, secure, and dependable networked systems, and also securing
existing ones. Advancing the research landscape requires the establishment of a forum
that brings together security researchers with different backgrounds, but with a com-
mon base of decision and game theory, to share their knowledge and exchange ideas.
Driven by this need and goal, the Conference on Decision and Game Theory for
Security (GameSec) was launched in 2010, to bring together academic, government,
and industrial researchers in an effort to identify and discuss the major technical
challenges and recent results that highlight the connections between decision and game
theory, information and communication, control, distributed optimization, economic
incentives and real-world security, reputation, trust and privacy problems. It has grown
over the years and endured the test of time, with the latest event held in Seattle being
the ninth one in the series.
Consistent with its goal from its inception, GameSec provides an international
forum for researchers from academia, industry, and government to discuss various
decision-theoretic approaches to security using the framework and tools of game
theory. It features presentations on recent results in regular contributed sessions as well
as poster sessions. It has special sessions focused on emerging topics of interest to the
security community, as well as panel discussions. It also features plenary talks by
distinguished researchers with outstanding contributions to the security field, who share
their perspectives with the participants. As mentioned earlier, this conference series
was inaugurated in 2010, with Berlin (Germany) being the first venue. It quickly
became a well-established and well-recognized annual gathering of security research-
ers, with follow-up conferences held in College Park (Maryland, USA, 2011), Buda-
pest (Hungary, 2012), Fort Worth (Texas, USA, 2013), Los Angeles (USA, 2014),
London (UK, 2015), New York (USA, 2016), and Vienna (Austria, 2017). This year’s
event was held on the campus of the University of Washington, Seattle (Washington,
USA, 2018) during October 29–31.
As in the previous years, GameSec in Seattle featured high-quality contributions
from researchers across the globe, addressing theoretical as well as practical challenges
faced by the security community, using the framework of game theory. Among the
VI Preface

topical areas covered were: use of game theory, control theory, and mechanism design
for security and privacy; decision-making for cybersecurity and security requirements
engineering; security and privacy for the Internet of Things, cyber-physical systems,
cloud computing, resilient control systems, and critical infrastructure; pricing, eco-
nomic incentives, security investments, and cyber insurance for dependable and secure
systems; risk assessment and security risk management; security and privacy of
wireless and mobile communications, including user location privacy;
socio-technological and behavioral approaches to security; deceptive technologies in
cybersecurity and privacy; empirical and experimental studies with game, control, or
optimization theory-based analysis for security and privacy; and adversarial machine
learning and crowdsourcing, and the role of artificial intelligence in system security.
The conference attracted 44 high-quality submissions, from which 28 full papers were
selected for oral presentation, and eight short papers for poster presentation, as a result
of a stringent review process that yielded at least three reviews on each submission. All
accepted papers are included in these proceedings. In addition, the conference program
featured a tutorial session on “Game Theory and Deception,” organized by Quanyan
Zhu (New York University, USA); a special session on “Adversarial AI” followed by a
panel discussion, organized by Eugene Vorobeychik (Vanderbilt University, USA);
and a panel session on “Real-World Uses of Game Theory for Security,” organized by
Milind Tambe (University of Southern California, USA). Two plenary talks were
delivered, by John Baras (University of Maryland, USA) and Joao Hespanha
(University of California, Santa Barbara, USA). We thank the special session and panel
organizers and the plenary speakers for their outstanding contributions to the program.
We thank also members of the Technical Program Committee and the Organizing
Committee (who are listed in the Proceedings) for their diligence and hard work that
contributed to the success of this year’s GameSec.
Several organizations and government agencies provided support for this year’s
GameSec. We thank the Army Research Office (ARO), the Office of Naval Research
(ONR), the National Research Foundation (NSF), Association for Computing
Machinery (ACM), Springer Lecture Notes in Computer Science (LNCS), and the
MDPI journal Games for their continuing support of the conference. ARO, ONR, NSF,
and Springer LNCS provided student travel support, and Games sponsored the two best
paper awards at the conference. Local arrangements were handled smoothly and
competently by the University of Washington Electrical and Computer Engineering
Events Team.
We hope that a broad group of constituents involved with and in security, from
theoreticians to practitioners and policy makers, benefited from this record of
state-of-the-art presentations at GameSec 2018.

October 2018 Linda Bushnell

Radha Poovendran
Tamer Başar
 Organization

Steering Committee
Tansu Alpcan University of Melbourne, Australia
John S. Baras University of Maryland, USA
Tamer Başar University of Illinois at Urbana–Champaign, USA
Anthony Ephremides University of Maryland, USA
Milind Tambe University of Southern California, USA

Organizers
General Chairs
Tamer Başar University of Illinois at Urbana–Champaign, USA
Radha Poovendran University of Washington, USA

TPC Chair
Linda Bushnell University of Washington, USA

Special Track Chair

Eugene Vorobeychik Vanderbilt University, USA

Tutorial Track Chair

Quanyan Zhu New York University, USA

Local Arrangements Chair

Lillian Ratliff University of Washington, USA

Publicity Chairs
Jun Moon UNIST, South Korea
Dario Bauso University of Sheffield, UK
Miroslav Pajic Duke University, USA

Web Chair
Andrew Clark Worcester Polytechnic Institute, USA
VIII Organization

Program Committee
Habtamu Abie Norsk Regnesentral - Norwegian Computing Center,
Norway
Saurabh Amin Massachusetts Institute of Technology, USA
Bo An Nanyang Technological University, Singapore
Battista Biggio University of Cagliari, Italy
Linda Bushnell (Chair) University of Washington, USA
Alvaro Cardenas UT Dallas, USA
Anil Kumar Chorppath TU Dresden, Germany
Andrew Clark Worcester Polytechnic Institute, USA
Mark Felegyhazi Budapest University of Technology and Economics,
Hungary
Rosario Gennaro City University of New York, USA
Rica Gonen Yahoo!, USA
Jens Grossklags Technical University of Munich, Germany
Noam Hazon Ariel University, Israel
Eduard Jorswieck TU Dresden, Germany
Charles Kamhoua US Army Research Laboratory, USA
Murat Kantarcioglu University of Texas at Dallas, USA
Alex Kantchelian University of California, Berkeley, USA
Christopher Kiekintveld University of Texas at El Paso, USA
Aron Laszka University of Houston, USA
Yee Wei Law University of South Australia, Australia
Chang Liu University of California, Berkeley, USA
Daniel Lowd University of Oregon, USA
Patrick Mcdaniel Pennsylvania State University, USA
Prasant Mohapatra University of California, Davis, USA
Shana Moothedath University of Washington, USA
Mehrdad Nojoumian Florida Atlantic University, USA
Andrew Odlyzko University of Minnesota, USA
Miroslav Pajic Duke University, USA
Manos Panaousis University of Surrey, UK
Nicolas Papernot Pennsylvania State University, USA
David Pym University College London, UK
Bhaskar University of Washington, USA
Ramasubramanian
Stefan Rass Universität Klagenfurt, Germany
Sang Sagong University of Washington, USA
Reza Shokri National University of Singapore, Singapore
Arunesh Sinha University of Michigan, USA
William Streilein Massachusetts Institute of Technology, USA
George Cardiff University, UK
Theodorakopoulos
Long Tran-Thanh University of Southampton, UK
Doug Tygar University of California, Berkeley, USA
 Organization IX

Yevgeniy Vorobeychik Vanderbilt University, USA

Neal Wagner Massachusetts Institute of Technology, USA
Haifeng Xu University of Southern California, USA
Tao Zhang New York University, USA
Zizhan Zheng Tulane University, USA
Quanyan Zhu New York University, USA
Jun Zhuang SUNY Buffalo, USA

Additional Reviewers

Barreto, Carlos Giraldo, Jairo Shan, Xiaojun

Basak, Anjon Gu, Tianbo Song, Cen
Boudko, Svetlana Gutierrez, Marcus Spring, Jonathan M.
Caulfield, Tristan Huang, Yunhan Uttecht, Karen
Celik, Berkay Matterer, Jason Veliz, Oscar
Demontis, Ambra Padilla, Edgar Wachter, Jasmin
Elfar, Mahmoud Peng, Guanze Xu, Hong
Farhang, Sadegh Qian, Yundi Zeng, Yunze
Feng, Xiaotao Roy, Abhishek
X Organization

Sponsors
 Contents

Impact of Privacy on Free Online Service Markets . . . . . . . . . . . . . . . . . . . 1

Chong Huang and Lalitha Sankar

Cyber-Warranties as a Quality Signal for Information Security Products. . . . . 22

Daniel W. Woods and Andrew C. Simpson

Game Theoretic Security Framework for Quantum Key Distribution . . . . . . . 38

Walter O. Krawec and Fei Miao

Training Set Camouflage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59

Ayon Sen, Scott Alfeld, Xuezhou Zhang, Ara Vartanian, Yuzhe Ma,
and Xiaojin Zhu

Multi-stage Dynamic Information Flow Tracking Game . . . . . . . . . . . . . . . . 80

Shana Moothedath, Dinuka Sahabandu, Andrew Clark, Sangho Lee,
Wenke Lee, and Radha Poovendran

Less is More: Culling the Training Set to Improve Robustness

of Deep Neural Networks. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102
Yongshuai Liu, Jiyu Chen, and Hao Chen

Optimal Placement of Honeypots for Network Defense . . . . . . . . . . . . . . . . 115

Mark Bilinski, Ryan Gabrys, and Justin Mauger

Perfectly Secure Message Transmission Against Rational

Timid Adversaries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127
Maiki Fujita, Kenji Yasunaga, and Takeshi Koshiba

Reinforcement Learning for Autonomous Defence

in Software-Defined Networking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145
Yi Han, Benjamin I. P. Rubinstein, Tamas Abraham, Tansu Alpcan,
Olivier De Vel, Sarah Erfani, David Hubczenko, Christopher Leckie,
and Paul Montague

Colonel Blotto Game with Coalition Formation for Sharing Resources. . . . . . 166
Joseph L. Heyman and Abhishek Gupta

Data Poisoning Attacks in Contextual Bandits . . . . . . . . . . . . . . . . . . . . . . 186

Yuzhe Ma, Kwang-Sung Jun, Lihong Li, and Xiaojin Zhu

Analysis and Computation of Adaptive Defense Strategies Against

Advanced Persistent Threats for Cyber-Physical Systems . . . . . . . . . . . . . . . 205
Linan Huang and Quanyan Zhu
XII Contents

Multi-sided Advertising Markets: Dynamic Mechanisms and Incremental

User Compensations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227
Moran Feldman, Gonen Frim, and Rica Gonen

A Game-Theoretic Analysis of the Adversarial Boyd-Kuramoto Model . . . . . 248

Antonin Demazy, Alexander Kalloniatis, and Tansu Alpcan

A Game Theoretic Analysis of the Twitter Follow-Unfollow Mechanism . . . . 265

Jundong Chen, Md Shafaeat Hossain, Matthias R. Brust,
and Naomi Johnson

Game Theoretic Analysis of a Byzantine Attacker in Vehicular Mix-Zones. . . . 277

Nick Plewtong and Bruce DeBruhl

Distributed Aggregative Games on Graphs in Adversarial Environments . . . . 296

Bahare Kiumarsi and Tamer Başar

Disappointment-Aversion in Security Games . . . . . . . . . . . . . . . . . . . . . . . 314

Jasmin Wachter, Stefan Rass, Sandra König, and Stefan Schauer

Moving Target Defense for the Placement of Intrusion Detection Systems

in the Cloud . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 326
Sailik Sengupta, Ankur Chowdhary, Dijiang Huang,
and Subbarao Kambhampati

Approximating Power Indices to Assess Cybersecurity Criticality . . . . . . . . . 346

Daniel Clouse and David Burke

A Differentially Private and Truthful Incentive Mechanism

for Traffic Offload to Public Transportation . . . . . . . . . . . . . . . . . . . . . . . . 366
Luyao Niu and Andrew Clark

Deep Learning Based Game-Theoretical Approach to Evade

Jamming Attacks. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 386
Sandamal Weerasinghe, Tansu Alpcan, Sarah M. Erfani,
Christopher Leckie, Peyam Pourbeik, and Jack Riddle

Towards Scientific Incident Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . 398

Jonathan M. Spring and David Pym

Rational Trust Modeling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 418

Mehrdad Nojoumian

Scaling-Up Stackelberg Security Games Applications

Using Approximations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 432
Arunesh Sinha, Aaron Schlenker, Donnabell Dmello, and Milind Tambe

A Learning and Masking Approach to Secure Learning . . . . . . . . . . . . . . . . 453

Linh Nguyen, Sky Wang, and Arunesh Sinha
 Contents XIII

Towards True Decentralization: A Blockchain Consensus Protocol

Based on Game Theory and Randomness. . . . . . . . . . . . . . . . . . . . . . . . . . 465
Naif Alzahrani and Nirupama Bulusu

A Game Theoretical Framework for Inter-process Adversarial

Intervention Detection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 486
Muhammed O. Sayin, Hossein Hosseini, Radha Poovendran,
and Tamer Başar

Cyber-Insurance as a Signaling Game: Self-reporting and External

Security Audits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 508
Aron Laszka, Emmanouil Panaousis, and Jens Grossklags

A Bayesian Multi-armed Bandit Approach for Identifying

Human Vulnerabilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 521
Erik Miehling, Baicen Xiao, Radha Poovendran, and Tamer Başar

Hypothesis Testing Game for Cyber Deception . . . . . . . . . . . . . . . . . . . . . . 540

Tao Zhang and Quanyan Zhu

Algorithms for Subgame Abstraction with Applications to Cyber Defense . . . 556

Anjon Basak, Marcus Gutierrez, and Christopher Kiekintveld

A Two-Stage Deception Game for Network Defense . . . . . . . . . . . . . . . . . . 569

Wei Wang and Bo Zeng

Imbalanced Collusive Security Games . . . . . . . . . . . . . . . . . . . . . . . . . . . . 583

Han-Ching Ou, Milind Tambe, Bistra Dilkina, and Phebe Vayanos

A Robust Optimization Approach to Designing Near-Optimal Strategies

for Constant-Sum Monitoring Games. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 603
Aida Rahmattalabi, Phebe Vayanos, and Milind Tambe

An Initial Study of Targeted Personality Models in the FlipIt Game . . . . . . . 623

Anjon Basak, Jakub Černý, Marcus Gutierrez, Shelby Curtis,
Charles Kamhoua, Daniel Jones, Branislav Bošanský,
and Christopher Kiekintveld

Author Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 637

 Impact of Privacy on Free Online Service
Markets

Chong Huang(B) and Lalitha Sankar

Arizona State University, Tempe, AZ 85281, USA

{chong.huang,lsankar}@asu.edu

Abstract. The emerging marketplace for online free services in which

service providers (SPs) earn revenue from using consumer data in direct
and indirect ways has led to significant privacy concerns. This begs
understanding of the following question: can the marketplace sustain
multiple SPs that offer privacy differentiated free services? This paper
studies the impact of privacy on free online service markets by augment-
ing the classical Hotelling model for market segmentation analysis. A
parametrized game-theoretic model is proposed which captures: (i) the
fact that for the free service market, consumers value service not in mon-
etized terms but by the quality of service (QoS); (ii) the differentiator of
services is not product price but the privacy risk advertised by an SP;
and (iii) consumer’s heterogeneous privacy preference for SPs. For the
two-SP problem with uniformly distributed consumer privacy preference
and linear SP profit function, the results suggest that: (i) when con-
sumers place a higher value on privacy, it leads to a larger market share
for the SP providing untargeted services and a “softened” competition
between SPs; (ii) SPs offering high privacy risk services are sustainable
only if they offer sufficiently high QoS; and (iii) SPs that are capable of
differentiating on services that do not directly use consumer data gain
larger market share. Similar results are observed when the consumer’s
privacy preference is modeled as a truncated Gaussian distribution.

Keywords: Free online services · Privacy differentiated services

Quality of service · Market segmentation

1 Introduction
There has been a steady increase in online interactions between consumers and
retailers, where the term retailer refers to entities who offer products for free (e.g.,
social media, search engines, free applications etc.). The advances in technology
have enabled retailers (henceforth referred to as service providers) to collect,
store, sell, and share customer-specific information that in turn can be used for
targeted advertising and tiered pricing tactics. In fact, many oft used online
services are free and consumers implicitly accede to tracking for customized
services. Targeted ads are a part of the emerging revenue/profit model for service
providers (SPs) offering free services. Consumers are delighted by free services
c Springer Nature Switzerland AG 2018
L. Bushnell et al. (Eds.): GameSec 2018, LNCS 11199, pp. 1–21, 2018.
https://doi.org/10.1007/978-3-030-01554-1_1
2 C. Huang and L. Sankar

until they begin encountering privacy violations on a daily/frequent basis. While

such infractions taken individually could be ignored or discounted, the totality
of data available about consumers with a variety of retailers and the resulting
privacy consequences raise serious concerns [1,2].
SPs are beginning to acknowledge that consumers are sensitive to privacy
violations. For example, Google [3] and Apple [4] recently adopted differentially
private mechanisms for collecting user data for statistical analyses. However, the
details of these mechanisms are opaque and offer even less clarity on whether
the consumer actually has a choice. In this context, it is worth understanding
if privacy differentiated services can provide such choices for consumers. In a
competitive marketplace, the aggregated weight of targeting may drive some
consumers to seek more privacy-protective alternatives. The cost to the consumer
of this action may be a lower quality of service (QoS) (e.g., poorer search engine
capabilities). However, it could eventually lead to a more open model for sharing
private information, i.e., one from implicit assent to informed consent [1].
To understand the influence of consumers’ heterogeneous privacy preference
on SPs’ behavior in a competitive market, we take a game-theoretic approach to
model the interactions between SPs and consumers. In particular, we address the
following questions: (i) Can privacy-differentiated services lead to a sustainable
marketplace? (ii) What are the equilibrium QoS-privacy risk strategies for the
SPs? (iii) How do various consumer/SP parameters, such as consumers’ privacy
preference/valuation and SPs’ profit/cost affect the equilibrium outcome?

1.1 Related Work

Targeted advertising is a common method for service providers to exploit knowl-
edge of consumers; this in turn can lead to privacy violations. Our work is
informed by the literature on targeting strategies for retailers [5–14], but rather
than optimizing retailer strategies, we are interested in identifying how privacy
differentiated services can address privacy concerns.
The problem of market segmentation is a classic and well-studied problem in
microeconomics with focus on how pricing and product differentiation can lead
to a stable and competitive marketplace. A nuanced model that captures dif-
ferentiation between two firms and consumer preferences is the Hotelling model
[15]. It has been widely used for market analysis across many fields such as
electrical vehicle market [16] and Internet market [17]. However, the free online
service market presents a new challenge wherein monetary quantification of both
‘free’ services and the data collected about consumers is not simple and straight-
forward. Equally challenging is the quantification of consumer privacy since it
requires capturing the heterogeneous expressions of privacy sensitivity that can
range from ‘don’t care’ at one extreme to ‘hyper vigilant’ at the other.
An extensive body of literature on economic models for privacy was reviewed
by Acquisti et al. [18]. Jentzsch et al. [19] propose a model to study competitions
between two SPs by taking consumer’s privacy preference (low privacy/high pri-
vacy) into account using a vertical Hotelling model. Consumers select the service
provider based on their privacy concerns and the amount of payment to the SP.
 Impact of Privacy on Free Online Service Markets 3

Lee et al. [20] study the influence of privacy protection on the segmentation of
a duopoly. In their model, firms may offer standard and personalized products
with personalized prices to three different types of privacy-sensitive consumers.
In contrast to both above-mentioned models, our model focuses on ‘free’ ser-
vices, and thus, introduces new models for quantifying QoS- and privacy-based
differentiators. Furthermore, our model generalizes the discrete set of privacy
sensitive consumers in [20] to a continuous set of privacy risks, thus allowing
analysis over an entire range of privacy expression and a more nuanced view of
how SPs should offer services to all types of consumers.

1.2 Our Contributions

We propose a novel model for the privacy differentiated market segmentation

problem in which service providers offer free services differentiated by QoS and
privacy risk. Our model captures a variety of free online services such as search
engines, social networking sites, and software apps that are free, and therefore,
use consumer data in a variety of ways for revenue generation. Each SP’s gain
from using consumer data is captured by a revenue function and its cost of
doing so is captured by a cost function. The goal of each SP is to choose a QoS
and privacy risk tuple that maximizes its profit (difference of revenue and cost).
We assume that consumers can map their heterogeneous privacy sensitivity to a
quantitative scale. The SPs use this quantitative scale to differentiate themselves.
Each consumer chooses the SP that maximizes a desired function of its privacy
risk valuation and the QoS-privacy risk tuple offered by the SP.
Our model is built upon the classical ‘spatial’ Hotelling model for market
segmentation wherein the location is now proxy for privacy risk (that both SPs
offer and consumers prefer). The QoS offered by the SP models the product
price in the Hotelling model. In contrast to the classical Hotelling model in
which there is a non-negative transportation cost irrespective of the locations of
consumer and retailer, here consumers will always benefit from SPs that offer
lower privacy risk than what they prefer. Thus, there is an asymmetry in the
transportation cost. We model the interactions between SPs and consumers as a
three-stage sequential game and compute the equilibrium QoS-privacy risk tuple
as well as consumers’ choices using backward induction. We also compute the
resulting market share and profit for specific models of cost and revenue (to SPs),
distribution of consumer heterogeneous privacy choices, as well as consumer
privacy valuation. We show that there is no equilibrium in which both SPs offer
the same privacy risk for the two-SP market with linear valuation function (cost,
revenue, consumer utility). Furthermore, we study the equilibrium behavior of
both SPs and consumers under different privacy preference models.

2 Problem Model and Game Formulation

Formally, we introduce a game-theoretic model for two SPs and infinitely many
consumers. Each SP offers the same type of free services (e.g., search engine,
4 C. Huang and L. Sankar

social network) with a quantified privacy risk guarantee ε and QoS v. Just as
Google at present advertises RAPPOR with a certain level of differential privacy
risk, in the future, it is possible that SPs will adopt one or more metrics to
quantify their privacy risks. This paper makes such an assumption of privacy risk
quantifiability. Furthermore, we assume SPs advertise their quantified privacy
risk and QoS to consumers. Thus, both ε and v are observable to consumers. The
observable privacy risk value could be the ε value in differential privacy adopted
by Google RAPPOR and the QoS could be the accuracy of search results. An
SP differentiates its service by a tuple (v, ε) that it advertises to all consumers.
A consumer’s preference of privacy differentiated service is modeled by a utility
function which depends on its privacy risk valuation and the QoS-privacy risk
tuple offered by the SP. In reality, it is natural to assume that consumers prefer
high QoS and low privacy risk. Thus, in our model, a consumer will have a higher
utility if he or she receives higher QoS or lower privacy risk. Finally, consumer
privacy heterogeneity is modeled as a distribution.

2.1 Two-SP Market Model

SP Model. We consider two rational (i.e., profit maximization entities) SPs,

denoted by SP1 and SP2 . Both SPs provide the same kind of free service; but
they differ in the QoS offered. Since we focus on free online service market, it is
very difficult to use a monetized quantity to quantify these services. Therefore,
we use QoS rather than price to quantify the consumers’ gains from using the
services. Thus, SP1 and SP2 offer QoS v1 and v2 , respectively, where in general
v1 = v2 . Furthermore, SP1 and SP2 guarantee that the privacy risk for using
their services is at most ε1 and ε2 , respectively, where ε1 , ε2 ∈ [0, ε̄]. Without
loss of generality, we assume ε2 ≥ ε1 . Under these assumptions, SP2 must offer a
higher QoS (v2 ≥ v1 ). Otherwise, its strategy will be dominated by its opponent
since SP1 will offer both higher QoS and lower privacy risk. For example, SP1
and SP2 could be Duckduckgo and Google, respectively, in the search engine
market, with the QoS given by the accuracy of search results. On the other
hand, the privacy risk can correspond to different guarantees they provide on
consumer data use; e.g., whether they will use consumer data only for statistical
purposes or target consumers with tailored ads. We model this privacy risk
guarantee as a variable taking values over a continuous range. In practice, such
guarantees may be coarse granular choices; for example, between completely
opting out of the targeting or allowing data use only for statistical purposes or
complete data use only by SP or all possible data usage and sale. We assume
that the SPs generate revenue in two ways: (i) by exploiting the private data
of consumers to offer targeted ads and other services to consumers; and (ii)
by providing interested advertisers an online platform to reach consumers. This
latter revenue is independent of private data and simply derived from the revenue
capability of the platform.
Let RP (εi ) and RNP,i denote the per consumer revenue of SPi generated
from using the private data and without using consumers’ private information,
 Impact of Privacy on Free Online Service Markets 5

respectively. The total per consumer revenue, R(εi ) is thus

R(εi ) = RP (εi ) + RNP,i , i ∈ {1, 2}. (1)

Notice that in reality, through spillovers and externalities associated with

using consumers’ private data, the revenue generating capabilities for SPs can
increase even from sources that don’t directly use consumer personal informa-
tion. However, it is very hard to capture these externalities precisely since they
are highly data and service model dependent. We start with a simple model in
which we assume that SPs will not use consumers’ private data for services that
do not require private data. Our proposed model provides an intuition on the
equilibrium strategies of SPs and market. Furthermore, it is useful to note that
even this relatively simple revenue decoupled setting is highly parameterized.
Our analysis allows us to understand the dependencies on various parameters.
Offering free services to consumers often comes with a cost to the SPs, such
as the cost of service, online platform creation, and continued operations. Fur-
thermore, we note that free online services profit from using consumer data
and therefore incur data processing related costs. Let C(vi ; εi ) denote the per
consumer cost of offering free services. We model C(vi ; εi ) as sum of two non-
negative costs: (i) CQoS (vi ) of providing services with QoS vi ; and (ii) CP (εi ) as
the processing (data analytics) cost of using data with privacy risk εi such that

C(vi ; εi ) = CQoS (vi ) + CP (εi ), i ∈ {1, 2}. (2)

We assume RP (εi ) > CP (εi ). Otherwise, SPi will not exploit consumers’ private
information since the cost exceeds revenue from using private information.

Consumer Model. We formulate the consumer-SP game based on the classical

Hotelling model. The Hotelling model maps retailers to two locations (x1 , x2 )
on a [0, 1] line such that the strategy of each retailer is to determine the best
location-price tuple that maximizes its profit. The location (see Fig. 1a) is a
proxy for a specific product differentiator. A consumer with its own product
differentiator preference (traditionally assumed to be uniformly distributed over
[0, 1]) is mapped to a location x ∈ [0, 1] on the line as shown in Fig. 1a. Such
a spatial model allows computing the market segment by identifying both the
optimal locations of the retailers and an indifferent threshold between the two
optimal retailer locations at which both retailers are equally desirable. For such a
uniform consumer preference model, the segmentation for each retailer is simply
its distance to the indifference point. Consumers choose the retailer with the
least product price and “transportation cost” (a linear function of location) for
a desired consumer valuation of the product. Note that transportation costs are
metaphorical for any non-price-based differentiation of the two retailers.
For our problem, we obtain a Hotelling model by: (i) introducing a normalized
privacy risk and mapping it to spatial location; and (ii) by viewing the QoS as the
net valuation of service by the consumer. Note that since we study a free services
market, we use QoS as a measure of consumer satisfaction. We note that in the
6 C. Huang and L. Sankar

classical Hotelling model, the consumer pays a non-negative transportation cost

for any retailer whose location is different from its own. However, our problem
departs from this model in that higher and lower privacy risks offered by SPs
relative to a consumer preferred privacy risk choice are not viewed similarly.
We assume there exists infinitely many rational consumers that are inter-
ested in the services provided by the SPs. In keeping the standard game-theoretic
definition, rational refers to consumers interested in maximizing some measure
of utility via interactions with the SPs. We use a random variable E ∈ [0, ε̄]
to denote the heterogeneous privacy preferences of consumers; such a model
assumes that the privacy preferences of consumers are independent and identi-
cally distributed, a reasonable assumption when the consumer set is very large.
Let E = ε denote the privacy risk preference of a consumer. If SPi offers a pri-
vacy risk guarantee εi higher than ε, then using its service will result in a privacy
cost to the consumer due to perceived privacy risk violation. On the other hand,
the consumer gains from choosing an SPi that offers an εi < ε as a result of
the extra privacy protection offered. Let x = FE (ε) ∈ [0, 1] be a differentiable
cumulative distribution function of ε. Thus, x can be considered as a normalized
privacy risk tolerance (i.e., restricted to [0, 1]) which indicates the proportion of
the consumers with a privacy risk preference of at most ε. Since ε can be over an
arbitrary range [0, ε̄], the normalized spatial privacy risk is given by the cumula-
tive distribution function (CDF) FE (ε). We can similarly map the privacy risks
offered by the SPs to normalized locations x1 = FE (ε1 ) and x2 = FE (ε2 ) on the
[0, 1] line as shown in Fig. 1b.
Analogous to the Hotelling model, we let ui (x) denote the utility (in units
of QoS) from SPi as perceived by a consumer with a normalized privacy pref-
erence (location) x. Our model for ui (x) contains two parts: (i) a positive QoS
vi offered by SPi ; and (ii) the gain or loss in the perceived QoS as a result of
a mismatch between consumer privacy preference and SPi ’s privacy risk offer-
ing. We introduce a gain factor t that allows mapping the privacy mismatch
t(x − xi )εi to a QoS quantity. This mismatch utility indicates that when the
SP offers a service with privacy risk lower than the consumer’s tolerance, the
consumer receives a positive utility due to extra privacy protection. However, if
the service offered has a higher privacy risk than the consumer’s tolerance, the
consumer will receive negative utility for privacy risk violation.

Fig. 1. User choice model for using different SPs

 Impact of Privacy on Free Online Service Markets 7

Consumer Utility and SP Profits. For the consumer located at x, the overall
perceived utility for choosing services provided by SP1 and SP2 are

ui (x) = vi + t(x − xi )εi , i ∈ {1, 2}. (3)

For each SPi , i ∈ {1, 2}, let (v−i , ε−i ) be its competitor’s strategy. For the rev-
enue and cost models in (1) and (2), the profit of SPi is simply the difference

πi (vi ; εi ; v−i ; ε−i ) = [R(εi ) − C(vi ; εi )]ni (vi ; εi ; v−i ; ε−i ), (4)

where ni (vi ; εi ; v−i ; ε−i ) denotes the fraction of consumers who choose SPi .

Modelling Assumption 1. We assume that the services provided by both SPs

have non-negative QoS.

Since consumers are rational, they expect to have positive utility through the
interactions with the SPs. It is reasonable to assume that SPs have no incentive
to offer services with a negative QoS (i.e., v1 ≥ 0 and v2 ≥ 0).

Modelling Assumption 2. We assume the model parameters are chosen such

that they ensure the market is completely covered by SP1 and SP2 .

Assumption 2 implies that each consumer must choose one of the SPs. Such
an assumption is implicitly built into the classical Hotelling model to ensure
competition between SPs and we continue to do so. Later we provide a sufficient
condition for sustaining the competitive market under these assumptions.

2.2 Two-SP Non-cooperative Game Formulation

We note that the SPs compete against each other through their distinct QoS
and privacy risk offerings, which in turn affects consumer choices and helps
determine the stable market segmentation. Thus, the interactions between SPs
can be formulated as a non-cooperative game in which the strategy of each
SP is a (QoS, privacy risk) tuple and that of the consumer is choosing an SP.
Furthermore, we assume that the SPs are rational and have perfect and complete
information. They play to maximize their own profits and know the exact profit
function and their competitors’ strategies.
The Game: the interactions between retailers and consumers in the Hotelling
model can be viewed as a sequential game [15]. For our model, such a sequen-
tial game involves three stages. In the first stage, the differentiator, i.e., the
normalized privacy risk εi , is advertised by SPi . This is followed by each SP
determining its QoS for the advertised risk. Finally, the consumers choose the
preferred SP based on the (vi , εi ) tuple that maximizes its utility. Our sequential
game assumes that the selection of privacy risk happens before the selection of
the QoS. This is due to the fact that SPs first advertise their privacy risks to
differentiate themselves from their competitors (e.g., Google advertises RAP-
POR while Duckduckgo advertises not using private data of the consumers) and
then adjust their QoS strategies. Since the profit function of an SP is dependent
8 C. Huang and L. Sankar

on the privacy risk and QoS of itself and its competitor, for fixed privacy risk
strategies, the best response QoS strategy of an SP is affected by the privacy
risk strategies as well as consumers’ preferences.
The game can be formally described as follows: (i) a set of players {1, 2, C},
where 1 and 2 denote SP1 and SP2 , respectively, and the set C contains infinitely
many consumers; (ii) a collection of strategy tuples (vi , εi ) ∈ Vi × Ei for SPi and
a collection of binary choices (strategies) for the consumer b ∈ B = {1, 2}; and
(iii) a profit function πi for each SPi and a utility function ui for each consumer
for choosing SPi .

3 Subgame Perfect Nash Equilibrium for Two-SP Game

In a sequential game, each stage is referred to as a subgame [21]. One often asso-
ciates a strategy profile with a sequential game. A strategy profile is a vector
whose ith entry is the strategy for all players at the ith stage of the sequen-
tial game. A non-cooperative sequential game has one well-studied solution: the
Subgame Perfect Nash Equilibrium (SPNE). A strategy profile is an SPNE if
its entries are the Nash equilibria of the subgame resulting at each stage of the
sequential game. The SPNE of a sequential game captures an equilibrium solu-
tion such that no player can make more profit by unilaterally deviating from this
strategy in every subgame. Since the two-SP game has finite number of stages
and perfect information, it can be solved by backward induction:
Stage 3, Users’ Decisions: Each consumer located at x ∈ [0, 1] can choose
the services provided by either SPs based on its valuation function in (3). The
resulting optimal strategy for the consumer is to choose the SP whose index is

arg max vi + t(x − xi )εi . (5)

i∈{1,2}

Since the consumer’s utility is a linear function of the normalized privacy risk
x and the market is completely covered by the SPs, there exists a threshold xτ
such that the consumer located at xτ is indifferent to using services provided by
SP1 or SP2 . Thus, at the indifference threshold xτ , we have

v1 − v2 + t(FE (ε2 )ε2 − FE (ε1 )ε1 )

u2 (xτ ) = u1 (xτ ) =⇒ xτ = , (6)
t(ε2 − ε1 )

where x1 and x2 have been replaced by their corresponding normalized privacy

risk values. Thus, given the SPs’ strategies (vi , εi ), i ∈ {1, 2}, the optimal strat-
egy of a consumer located at x is to use the service of SP1 if x ≤ xτ and SP2
otherwise. If v1 = v2 and ε1 = ε2 , consumers are indifferent between SP1 and
SP2 . In this case, we assume the consumers use the following tie-breaking rule:

Modelling Assumption 3. If v1 = v2 and ε1 = ε2 , consumers choose either

SPs with probability 12 .
 Impact of Privacy on Free Online Service Markets 9

Stage 2, SPs Determine QoS: For a given privacy risk guarantee εi , SPi
chooses its QoS vi to maximize its profit πi . Since a consumer’s normalized
privacy risk tolerance denotes the fraction of the population whose privacy risk
tolerance is at most ε, xτ determines the proportion of consumers who choose
SP1 , i.e., n1 . As a result, the profit functions of SP1 and SP2 can be written as

π1 (v1 ; ε1 ; v2 ; ε2 ) =[R(ε1 ) − C(v1 ; ε1 )]xτ , (7)

π2 (v1 ; ε1 ; v2 ; ε2 ) =[R(ε2 ) − C(v2 ; ε2 )](1 − xτ ). (8)

To find the SPNE in this stage, we use the best response method [21]. The
best response is a function which captures the behavior of each player while
fixing the strategies of the other players. For any v−i ∈ V−i , we define BRi (v−i )
as the best strategy of SPi such that

BRi (v−i ) = arg max πi (vi ; εi ; v−i ; ε−i ), i ∈ {1, 2}. (9)
vi

In the SPNE, each player plays the best response strategy. Thus, a Nash equilib-
rium in this stage is a profile v ∗ = (vi∗ , v−i
∗
) for which vi∗ ∈ BRi (v−i
∗
), ∀i ∈ {1, 2}.
For a given set of privacy risk guarantees {ε1 , ε2 }, the optimal QoS vi∗ of
SPi , i ∈ {1, 2} in the SPNE is

vi∗ = arg max πi (v1 ; ε1 ; v2 ; ε2 ), i ∈ {1, 2}. (10)

vi

Stage 1, SPs Determine Privacy Risk Guarantee: In the first stage, we

compute equilibrium strategies ε1 and ε2 that the two SPs should advertise for
optimal market share. Note that v1∗ , v2∗ , and xτ have been computed in stages 2
and 3 for a fixed ε1 and ε2 , this implies the equilibrium strategy ε∗1 and ε∗2 can
be obtained using the best response method.

4 Two-SP Market with Linear Cost and Revenue Models

Thus far, we have considered a general model for SPs. To obtain better intuition
and meaningful analytical solutions, we consider linear cost and revenue models
for SPs. The per consumer cost function of SPi is

C(vi ; εi ) = cvi + cλεi , i ∈ {1, 2}, (11)

where c and λ are constant scale factors in units of cost/QoS and QoS/privacy
risk, respectively. We model the per consumer revenue of each SP from offering
a privacy guaranteed service by a linear function

R(εi ) = rεi + pi , i ∈ {1, 2}, (12)

where r is the revenue per unit privacy risk for using consumers’ private data.
The parameters p1 and p2 model the fixed revenues of the SPs that are indepen-
dent of consumers’ private data.
10 C. Huang and L. Sankar

Theorem 1. There is no SPNE in which both SPs offer the same privacy risk.

Proof sketch: The detailed proof of Theorem 1 is in Appendix A; we briefly

outline the proof. First, we assume there exists an SPNE where both SPs offer
the same privacy risk ε̃. Using backward induction, we show that one of the SPs
is better off by unilaterally deviating from the equilibrium strategy ε̃; implying
that there is no SPNE in which both SPs offer the same privacy risk.
Remark: Note that the result of Theorem 1 does not exhibit the minimal differ-
entiation behavior (i.e., both firms place themselves close to each other) observed
in [15]. This is due to the fact that higher and lower privacy risks offered by SPs
relative to a consumer preferred privacy risk choice are not viewed similarly;
that is, the symmetric transportation cost no longer holds in our model, and
thus resulting an asymmetric gain due to privacy mismatch in (3).

4.1 Uniform Consumer Privacy Risk Tolerance

We assume consumers have uniformly distributed privacy risk tolerance between
0 and ε̄ [22]. The resulting normalized privacy risk of each SP is given by xi =
FE (εi ) = εε̄i , i ∈ {1, 2}. We define
r
α= − λ, C̃ = ctε̄. (13)
c
Note that α is the ratio of net profit from using consumer data for a unit of
privacy risk to the cost for providing a unit of QoS. Furthermore, C̃ is the
cost of providing non-zero utility to the consumer with a maximal mismatch of
privacy risk (relative to SP). By using backward induction, the computed SPNE
of the two-SP non-cooperative game is presented in the following theorem.
Theorem 2. There exists an SPNE given by

12ε̄cα + 15ctε̄ − 16(p2 − p1 )

ε∗2 = , (14)
24tc
(2α + t)cα6ε̄ + (α − t)9ctε̄ + (t − 2α)8p2 + (α + t)16p1
v2∗ = , (15)
24ct
3ε̄
ε∗1 = ε∗2 − , (16)
4
∗ ∗ 3ε̄ p2 − p1
v 1 = v2 − α + , (17)
4 3c
if the model parameters {c, r, λ, t, ε̄, p1 , p2 } satisfy

16(p2 − p1 )
−1 ≤ ≤ 1, (18)
9ctε̄
4α − 3t 16(p2 − p1 ) 4α − t
≤ ≤ , (19)
3 9cε̄ 3
(12(r − cλ)ε̄)2 − (15ctε̄)2 + 288ctε̄(p2 + p1 ) ≥ [16(p2 − p1 )]2 . (20)
 Impact of Privacy on Free Online Service Markets 11

At this SPNE, the market segmentation and the total profits of both SPs are

1 8(p2 − p1 ) 1 8(p2 − p1 )
x∗τ = − = − , (21)
2 9ctε̄ 2 9C̃
4c 9tε̄ 2(p2 − p1 ) 2 1 3 4(p2 − p1 ) 2
π1∗ = ( − ) = ( C̃ −  ) (22)
27tε̄ 8 c 3 4 3 C̃
4c 9tε̄ 2(p2 − p1 ) 2 1 3 4(p2 − p1 ) 2
π2∗ = ( + ) = ( C̃ +  ) , (23)
27tε̄ 8 c 3 4 3 C̃

where α and C̃ are defined in (13).

Proof sketch: The proof of Theorem 2 is provided in Appendix B. We briefly
sketch the proof details here. Our approach involves using a three-stage back-
ward induction to compute equilibrium strategies starting from the third stage;
at each stage, the equilibrium strategies are computed using those computed
from future stages. In the third stage, for a fixed pair of strategies of each SP,
the consumer makes the choice, this in turn helps determining the indifference
threshold xτ . This xτ is now used in the second stage to compute the equilib-
rium QoS (v1∗ , v2∗ ) for a fixed set of risk (ε1 , ε2 ). Finally, the first stage involves
computing the equilibrium privacy risk for these choice of v1∗ , v2∗ and xτ by solv-
ing the corresponding best response functions, thereby obtaining the solutions
in (14)–(17). The conditions in (18)–(20) result from requiring the equilibrium
strategies as well as the equilibrium market segmentation to satisfy the follow-
ing: (i) feasible threshold: 0 ≤ x∗τ ≤ 1; (ii) feasible risk: 0 ≤ ε∗1 , ε∗2 ≤ ε̄; (iii)
non-zero consumer utility: v1∗ − tx∗1 ε∗1 ≥ 0 or v2∗ − tx∗2 ε∗2 ≥ 0.
Remark: Note that the equilibrium in (14)–(17) is highly parametrized. For a
given set of parameters that satisfy conditions in (18)–(20), the sequential game
yields an SPNE. By (21), the SP with higher privacy-independent revenue owns
a larger market share, leading to a higher total profit in the SPNE (see (22)
and (23)). Note that p1 and p2 are the only differentiator of SPs in the set of
model parameters. For a fixed p2 − p1 , both π1∗ and π2∗ are decreasing functions
of C̃ when C̃ ∈ [0, 16|p29−p1 | ] and increasing afterwards. On the other hand, (18)
implies C̃ ≥ 16|p29−p1 | . Thus, both π1∗ and π2∗ are increasing functions of C̃ in
the SPNE. In the following, we highlight the effect of each one of these model
parameters on the SPNE while keeping all other parameters fixed.

1. Heterogeneity of consumer privacy preferences (ε̄): for the SPNE presented

in Theorem 2, observe that vi∗ and ε∗i , i ∈ {1, 2} are linear functions of ε̄.
Furthermore, ε∗2 = ε∗1 + 34 ε̄; this implies that at the SPNE, the SP that offers
the higher privacy risk (i.e., ε∗2 ) offers exactly 34 ε̄ higher than that of its
competitor. For all other parameters fixed, as ε̄ increases, SP2 ’s privacy risk
increases linearly. On the other hand, SP1 ’s privacy risk increases linearly
with ε̄ only if the model parameters are such that 4(r − cλ) > ct; otherwise, it
decreases linearly (see (14) and (16)). To further understand the dependency,
we consider the following two cases:
12 C. Huang and L. Sankar

– If p2 − p1 > 0, as ε̄ increases, SP2 can increase its revenue by increas-

ing its privacy risk offerings. As a result, more consumers who have low
privacy risk preferences will choose SP1 . Therefore, the market share of
SP2 decreases. However, the profits of both SPs increases as ε̄ increases.
The intuition is that both SPs can exploit consumers’ private information
from a larger range of privacy risk preferences. As a result, their revenue
from exploiting consumers’ private information also increases, which in
turn leads to an increase in both SPs’ profits.
– If p2 − p1 < 0, as ε̄ increases, SP2 increases its advertised privacy risk to
exploit more private information from consumer. Despite this, the market
share of SP2 increases with ε̄. This is because as ε̄ increases, SP2 provides
a higher utility than SP1 to some consumers who prefer SP1 before.
Furthermore, each SP’s profit increases as ε̄ increases.
2. Operation cost (c): when c increases, by (21), the SP with lower privacy-
independent revenue benefits since its market share increases. Observe from
(14) and (15) that if p2 − p1 > 0, both SPs increase their privacy risk strate-
gies in the SPNE as c increases. They do so because SPs can use consumers’
private information to increase its privacy dependent revenue, thereby offset-
ting their cost. Otherwise, they decrease their privacy risks. As a result of
these strategies, when c increases, both SPs’ profits also increase.
3. Privacy independent revenue (p1 , p2 ): as the difference in the privacy inde-
pendent revenues (p2 − p1 ) increases, both SPs offer lower privacy risks to
attract consumers. From (21)–(23) and condition (18), we see that as p2 − p1
increases, the market share and profit of SP1 decreases while SP2 ’s market
share and profit increases. This is because a larger difference in the revenue
independent of consumer’s private data gives SP2 more market power in the
competition. As a result, SP2 ’s profit increases while SP1 ’s profit decreases.
4. Consumer privacy valuation or skittishness (t): when t increases, by (14)–
2 −p1 )
(17), we have ε∗1 = 12ε̄cα−16(p
24tc − 18 ε̄ ≥ 0. Therefore, both SPs decrease
their privacy risks as t increases. Furthermore, by (21), the SP with lower
privacy-independent revenue benefits since its market share increases. For
this linear model, as t increases, both SPs decrease their privacy risks. This
results in a decrease in the cost and revenue of both SPs but cost decreases
more than revenue, thereby leading to a profit for both SPs. In other words,
a higher privacy valuation from consumers “softens” the competition.

4.2 Truncated Gaussian Consumer Privacy Risk Tolerance

In this section, we model a consumer’s privacy tolerance as a random variable E
that follows a Gaussian distribution N ( 2ε̄ , σ 2 ) with a mean of 2ε̄ and a standard
deviation of σ. Since E ∈ [0, ε̄], we restrict the Gaussian distribution to lie within
the interval [0, ε̄]. Thus, E follows a truncated Gaussian distribution with CDF
⎧ ε− ε̄
⎪ 2 ε̄
⎨ Φ( σε̄ )−Φ(−ε̄2σ ) ε ∈ [0, ε̄]
Φ( 2σ )−Φ(− 2σ )
FE (ε) = 0 ε ∈ [−∞, 0] , (24)
⎪
⎩
1 ε ∈ [ε̄, +∞]
 Impact of Privacy on Free Online Service Markets 13

where Φ(y) denotes the CDF of the standard Gaussian distribution.

In contrast to the uniform distribution case, the CDF in (24) is not amenable
to a closed form solution. Thus, we characterize the equilibrium numerically.
To find the SPNE, we first compute the SPNE QoS in the second stage as
functions of privacy risk guarantees by solving (10). Then, we use an iterated
best response method to find the optimal privacy risk guarantee of an SP by
fixing its competitor’s strategy in each iteration. When the process converges,
we have found an SPNE.

4.3 Illustration of Results

In this section, we illustrate our model and results. First, we assume consumers
have uniformly distributed privacy risk tolerance. We plot each SP’s SPNE strat-
egy, market share, and total profit with respect to consumers’ maximum privacy
risk tolerance ε̄ for different values of consumer privacy risk valuation t. Later,
we study the model in which consumers’ privacy risk tolerance follows a Gaus-
sian distribution N ( 2ε̄ , 1) truncated between 0 and ε̄. The model parameters are
given as follows:

Table 1. Numerical example model parameters

Parameter c λ r p1 p2
Value 0.5 0.75 0.7 0.4 0.8

Uniform Consumer Privacy Risk Tolerance. In this section, we vary ε̄

from 3 to 5 to study properties of SPNE. Our choice of values in Table 1 is one
set of parameters for which we can determine a meaningful range of t values.
However, there exists many such combinations of parameter values. Note that
by (18)–(20) in Theorem 2, t must belong to [0.58, 0.85] when other parameters
are given in Table 1 for sustaining the SPNE. In Fig. 2, the equilibrium strategies
of different SPs are plotted. As ε̄ increases, both SPs increase their privacy risk
offerings. Furthermore, it can be seen that as t, the valuation of privacy by
consumer, decreases, each SP increases its privacy risk to generate more profit
from using private data. Correspondingly, the SPs will have to provide higher
QoS to attract consumers. On the other hand, if t increases, both SPs reduce
their privacy risks to avoid violating consumers’ privacy.
It is worth noting that for the special case of t = 0.7, we observe that SP1
caters to smaller set of privacy sensitive consumers. The reason for this is as
follows: indeed, one generally expects SP1 to offer a larger privacy risk as ε̄
increases. However, for a large enough privacy valuation (in this case t = 0.7),
since consumers highly value privacy, the cost of offering a high QoS proportion-
ally increases for SP1 . The resulting profit is insufficient to justify the cost.
The market shares of different SPs in the SPNE are presented in Fig. 5a.
We observe that the equilibrium market share of SP2 decreases as t increases.
14 C. Huang and L. Sankar

5
3
4 SP 2 , t=0.6 SP 2 , t=0.6
SP's privacy risk

SP 1 , t=0.6 SP 1 , t=0.6

SP's QoS
3 SP 2 , t=0.65 2 SP 2 , t=0.65
SP 1 , t=0.65
SP 1 , t=0.65
SP 2 , t=0.7
SP 2 , t=0.7
2 SP 1 , t=0.7
SP 1 , t=0.7
1
1

0 0
3 3.5 4 4.5 5 3 3.5 4 4.5 5
Maximum privacy risk tolerance Maximum privacy risk tolerance

Fig. 2. SPNE strategies of SPs under uniform consumer privacy risk

The intuition is that if t increases, the consumer’s valuation of privacy mismatch

also increases. Thus, it is more difficult for SP2 to attract consumers with privacy
tolerance lower than ε2 . As a result, its market share decreases. Notice that in
Fig. 5a, as ε̄ decreases, the equilibrium market share of SP2 increases. This is
because consumers experience a lower negative utility from the mismatch when ε̄
is smaller (the utility from mismatch is t(x − xi )εi ). As a result, more consumers
will choose the SP with a higher privacy risk to enjoy a higher QoS.
In Fig. 3, we plot the total profit at the SPNE for each SP as a function of the
maximum consumer privacy risk tolerance ε̄ for different values of t. The total
profit of both SPs at SPNE increases as ε̄ increases. This is because a larger
ε̄ indicates a larger range of consumer preferences, and then, more possibilities
for the SPs to exploit private information. Thus, both SPs can benefit from
using private data of consumers that have a higher privacy risk tolerance. As t
increases, both SPs decrease their privacy risks. As a result, the cost and revenue
of both SPs decrease. However, in this case, cost supersedes revenue. Therefore,
both SPs make more profit. In other words, a higher privacy valuation from
consumers “softens” the competition.

Truncated Gaussian Consumer Privacy Risk Tolerance. We now con-

sider the case in which consumers’ privacy risk tolerance follows a truncated
Gaussian distribution with a mean of 2ε̄ and a standard deviation of 1. The
equilibrium strategies of different SPs are shown in Fig. 4. As with the uniform
distribution scenario, here too we observe that the privacy risk and the QoS
offered by each SP are linear functions of ε̄. We also notice that in this SPNE,
SP2 will always provide service with maximum privacy risk (Fig. 4a) for the set
of parameters in Table 1. This is because in contrast to the uniform distribution,
for the truncated Gaussian distribution, there are a relatively smaller number of
consumers concentrated in the tail end of [0, ε̄]. Thus, for SP1 to make a profit,
it has to offer a higher privacy risk so that it can capture a large number of
consumers in the middle of the [0, ε̄] range. This in turn forces SP2 to increase
 Impact of Privacy on Free Online Service Markets 15

Fig. 3. Profit of SPs at SPNE under uniform consumer privacy risk

its privacy risk to differentiate its QoS offering and thus have a higher profit.
Since the privacy risk preference is bounded by [0, ε̄], SP2 can only offer the
highest privacy risk in this example.

5 3.5
SP2 , t=0.6
4 3 SP2 , t=0.6
SP1 , t=0.6
SP1 , t=0.6
Privacy risk

SP2 , t=0.65 2.5

3 SP1 , t=0.65 SP2 , t=0.65
QoS

SP2 , t=0.7 2 SP1 , t=0.65

2 SP1 , t=0.7 SP2 , t=0.7
1.5 SP1 , t=0.7
1
1
0 0.5
3 3.5 4 4.5 5 3 3.5 4 4.5 5
Maximum privacy risk tolerance Maximum privacy risk tolerance

Fig. 4. SPNE strategies of SPs under truncated Gaussian consumer privacy risk

Figure 5b shows market shares of different SPs at SPNE vs. consumers’ max-
imum privacy risk tolerance for different values of t under truncated Gaussian
privacy tolerance distribution. As t decreases, the market share of SP2 at SPNE
increases, and vice versa. Also, when ε̄ decreases, the equilibrium market share of
SP2 increases. Furthermore, it can be seen that for the same ε̄, the market share
of SP2 (SP1 ) is smaller (larger) when consumers’ privacy tolerance follows the
truncated Gaussian distribution compared to uniform distribution. Our numeri-
cal analysis shows that at SPNE, SP2 is forced to provide service with maximum
privacy risk. We argue that this is due to the shape of the distribution that lim-
its the number of consumers at the two extremes thus compelling the two SPs
Another random document with
no related content on Scribd:
But they spent their leisure time together: they passed their rare
holiday hours in each other’s society in the woods which they both
loved or in the public galleries of art; and when the autumn came on
apace, and they could no longer sit at their open casements, he still
watched the gleam of her pale lamp as a pilgrim the light of a shrine,
and she, ere she went to her rest, would push ajar the closed shutter
and put her pretty fair head into the darkling night, and waft him a
gentle good-night, and then go and kneel down by her bed and pray
for him and his future before the cross which had been her dead
mother’s.
On that bright summer a hard winter followed. The poor suffered very
much; and I in the closed lattice knew scarcely which was the worse
—the icy, shivering chills of the snow-burdened air, or the close,
noxious suffocation of the stove.
I was very sickly and ill, and cared little for my life during that bitter
cold weather, when the panes of the lattice were all blocked from
week’s end to week’s end with the solid, silvery foliage of the frost.
René and Lili both suffered greatly: he could only keep warmth in his
veins by the stoves of the public libraries, and she lost her work in
the box trade after the New Year fairs, and had to eke out as best
she might the few francs she had been able to lay back in the old
brown pipkin in the closet. She had, moreover, to sell most of the
little things in her garret; her own mattress went, though she kept the
bed under her grandmother. But there were two things she would not
sell, though for both was she offered money; they were her mother’s
reliques and myself.
She would not, I am sure, have sold the picture, either. But for that
no one offered her a centime.
One day, as the last of the winter solstice was passing away, the old
woman died.
Lili wept for her sincere and tender tears, though never in my time,
nor in any other, I believe, had the poor old querulous, paralytic
sufferer rewarded her with anything except lamentation and peevish
discontent.
“Now you will come to me?” murmured her lover, when they had
returned from laying the old dead peasant in the quarter of the poor.
Lili drooped her head softly upon his breast.
“If you wish it!” she whispered, with a whisper as soft as the first low
breath of summer.
If he wished it!
A gleam of pale gold sunshine shone through the dulled panes upon
my feeble branches; a little timid fly crept out and spread its wings;
the bells of the church rang an angelus; a child laughed in the street
below; there came a smile of greenness spreading over the boughs
of leafless trees; my lover, the wind, returned from the south, fresh
from desert and ocean, with the scent of the spice groves and palm
aisles of the East in his breath, and, softly unclosing my lattice,
murmured to me: “Didst thou think I was faithless? See, I come with
the spring!”
So, though I was captive and they two were poor, yet we three were
all happy; for love and a new year of promise were with us.
I bore a little snowy blossom (sister to the one which slept lifeless on
René’s heart) that spring, whilst yet the swallows were not back from
the African gardens, and the first violets were carried in millions
through the streets—the only innocent imperialists that the world has
ever seen.
That little winter-begotten darling of mine was to be Lili’s nuptial-
flower. She took it so tenderly from me that it hardly seemed like its
death.
“My little dear rose, who blossoms for me, though I can only cage
her in clay, and only let her see the sun’s rays between the stacks of
the chimneys!” she said softly over me as she kissed me; and when
she said that, could I any more grieve for Provence?
“What do they wed upon, those two?” said the old vine to me.
And I answered him, “Hope and dreams.”
“Will those bake bread and feed babes?” said the vine, as he shook
his wrinkled tendrils despondently in the March air.
We did not ask in the attic.
Summer was nigh at hand, and we loved one another.
René had come to us—we had not gone to him. For our garret was
on the sunny, his on the dark, side of the street, and Lili feared the
gloom for me and the bird; and she could not bring herself to leave
that old red-leaved creeper who had wound himself so close about
the rainpipe and the roof, and who could not have been dislodged
without being slain.
With the Mardi Gras her trade had returned to her. René, unable to
prosecute his grand works, took many of the little boxes in his own
hands, and wrought on them with all the nameless mystical charm
and the exquisite grace of touch which belong to the man who is by
nature a great artist. The little trade could not at its best price bring
much, but it brought bread; and we were happy.
While he worked at the box lids she had leisure for her household
labors; when these were done she would draw out her mother’s old
Breton distaff, and would sit and spin. When twilight fell they would
go forth together to dream under the dewy avenues and the
glistening stars, or as often would wait within whilst he played on his
mountain flute to the people at the doorways in the street below.
“Is it better to go out and see the stars and the leaves ourselves, or
to stay indoors and make all these forget the misfortune of not
seeing them?” said Lili on one of those evenings when the warmth
and the sunset almost allured her to draw the flute from her
husband’s hands and give him his hat instead; and then she looked
down into the narrow road, at the opposite houses, at the sewing-
girls stitching by their little windows, at the pale students studying
their sickly lore with scalpel and with skeleton, at the hot, dusty little
children at play on the asphalt sidewalk, at the sorrowful, darkened
casements behind which she knew beds of sickness or of paralyzed
old age were hidden—looked at all this from behind my blossoms,
and then gave up the open air and the evening stroll that were so
dear a pastime to her, and whispered to René, “Play, or they will be
disappointed.”
And he played, instead of going to the debating-club in the room
round the corner.
“He has ceased to be a patriot,” grumbled the old vine. “It is always
so with every man when once he has loved a woman!”
Myself, I could not see that there was less patriotism in breathing the
poetry of sound into the ears of his neighbors than in rousing the
passions of hell in the breasts of his brethren.
But perhaps this was my ignorance: I believe that of late years
people have grown to hold that the only pure patriotism is, and ought
to be, evinced in the most intense and the most brutalized form of
one passion,—“Envy, eldest-born of hell.”
So these two did some good, and were happy, though more than
once it chanced to them to have to go a whole day without tasting
food of any sort.
I have said that René had genius,—a genius bold, true,
impassioned, masterful,—such a genius as colors the smallest trifles
that it touches. René could no more help putting an ideal grace into
those little sweetmeat boxes—which sold at their very highest, in the
booths of the fairs, at fifty centimes apiece—than we, the roses, can
help being fragrant and fair.
Genius has a way of casting its pearls in the dust as we scatter our
fragrance to every breeze that blows. Now and then the pearl is
caught and treasured, as now and then some solitary creature
pauses to smell the sweetness of the air in which we grow, and
thanks the God who made us.
But as ninety-nine roses bloom unthanked for one that is thus
remembered, so ninety-nine of the pearls of genius are trodden to
pieces for one that is set on high and crowned with honor.
In the twilight of a dull day a little, feeble, brown old man climbed the
staircase and entered our attic with shambling step.
We had no strangers to visit us: who visits the poor? We thought he
was an enemy: the poor always do think so, being so little used to
strangers.
René drew himself erect, and strove to hide the poverty of his
garments, standing by his easel. Lili came to me and played with my
leaves in her tender, caressing fashion.
“You painted this, M. René Claude?” asked the little brown old man.
He held in his hand one of the bonbon boxes, the prettiest of them
all, with a tambourine-girl dancing in a wreath of Provence roses.
René had copied me with loving fidelity in the flowers, and with a
sigh had murmured as he cast the box aside when finished: “That
ought to fetch at least a franc!” But he got no more than the usual
two sous for it.
The little man sat down on the chair which Lili placed for him.
“So they told me where I bought this. It was at a booth at St. Cloud.
Do you know that it is charming?”
René smiled a little sadly; Lili flushed with joy. It was the first praise
which she had ever heard given to him.
“You have a great talent,” pursued the little man.
René bowed his handsome, haggard face—his mouth quivered a
very little: for the first time Hope entered into him.
“Genius, indeed,” said the stranger; and he sauntered a little about
and looked at the canvases, and wondered and praised, and said
not very much, but said that little so well and so judiciously that it
was easy to see he was no mean judge of art, and possibly no
slender patron of it.
As Lili stood by me I saw her color come and go and her breast
heave. I too trembled in all my leaves: were recognition and the
world’s homage coming to René at last?
“And I have been so afraid always that I had injured, burdened him,
clogged his strength in that endless strife!” she murmured below her
breath. “O dear little rose! if only the world can but know his
greatness!”
Meanwhile the old man looked through the sketches and studies with
which the room was strewed. “You do not finish your things?” he said
abruptly.
René flushed darkly. “Oil pictures cost money,” he said briefly, “and—
I am very poor.”
Though a peasant’s son, he was very proud: the utterance must
have cost him much.
The stranger took snuff. “You are a man of singular genius,” he said
simply. “You only want to be known to get the prices of Meissonier.”
Meissonier!—the Rothschild of the studios, the artist whose six-inch
canvas would bring the gold value of a Raphael or a Titian!
Lili, breathing fast, and white as death with ecstasy, made the sign of
the cross on her breast; the delicate brown hand of René shook
where it leaned on his easel.
They were both silent—silent from the intensity of their hope.
“Do you know who I am?” the old man pursued with a cordial smile.
“I have not that honor,” murmured René.
The stranger, taking his snuff out of a gold box, named a name at
which the painter started. It was that of one of the greatest art
dealers in the whole of Europe,—one who at a word could make or
mar an artist’s reputation,—one whose accuracy of judgment was
considered infallible by all connoisseurs, and the passport to whose
galleries was to any unknown painting a certain passport also to the
fame of men.
“You are a man of singular genius,” repeated the great purchaser,
taking his snuff in the middle of the little bare chamber. “It is curious
—one always finds genius either in a cellar or in an attic: it never, by
any chance, is to be discovered midway on the stairs—never in the
mezzo terzo! But to the point. You have great delicacy of touch,
striking originality, a wonderful purity yet bloom in your color, and an
exquisite finish of minutiæ, without any weakness,—a combination
rare, very rare. That girl yonder, feeding white pigeons on the leads
of a roof, with an atom of blue sky, and a few vine leaves straying
over the parapet—that is perfectly conceived. Finished it must be. So
must that little study of the beggar-boy looking through the gilded
gates into the rose-gardens—it is charming, charming. Your price for
those?”
René’s colorless, worn young face colored to the brows. “Monsieur is
too good,” he muttered brokenly. “A nameless artist has no price,
except—”
“Honor,” murmured Lili as she moved forward with throbbing heart
and dim eyes. “Ah, monsieur, give him a name in Paris! We want
nothing else—nothing else!”
“Poor fools!” said the dealer to his snuff-box. I heard him—they did
not.
“Madame,” he answered aloud, “Paris herself will give him that the
first day his first canvas hangs in my galleries. Meanwhile, I must in
honesty be permitted to add something more. For each of those little
canvases, the girl on the roof and the boy at the gate, I will give you
now two thousand francs, and two thousand more when they shall
be completed. Provided—”
He paused and glanced musingly at René.
Lili had turned away, and was sobbing for very joy at this
undreamed-of deliverance.
René stood quite still, with his hands crossed on the easel and his
head bent on his chest. The room, I think, swam around him.
The old man sauntered again a little about the place, looking here
and looking there, murmuring certain artistic disquisitions technical
and scientific, leaving them time to recover from the intensity of their
emotion.
What a noble thing old age was, I thought, living only to give hope to
the young in their sorrow, and to release captive talents from the
prison of obscurity! We should leave the little room in the roof, and
dwell in some bright quarter where it was all leaves and flowers; and
René would be great, and go to dine with princes and drive a team of
belled horses, like a famous painter who had dashed once with his
splendid equipage through our narrow passage; and we should see
the sky always—as much of it as ever we chose; and Lili would have
a garden of her own, all grass and foliage and falling waters, in
which I should live in the open air all the day long, and make believe
that I was in Provence.
My dreams and my fancies were broken by the sound of the old
man’s voice taking up the thread of his discourse once more in front
of René.
“I will give you four thousand francs each for those two little
canvases,” he repeated. “It is a mere pinch of dust to what you will
make in six months’ time if—if—you hear me?—your name is
brought before the public of Paris in my galleries and under my
auspices. I suppose you have heard something of what I can do, eh?
Well, all I can do I will do for you; for you have a great talent, and
without introduction, my friend, you may as well roll up your pictures
and burn them in your stove to save charcoal. You know that?”
René indeed knew—none better. Lili turned on the old man her
sweet, frank Breton eyes, smiling their radiant gratitude through
tenderest tears.
“The saints will reward you, monsieur, in a better world than this,”
she murmured softly.
The old man took snuff a little nervously. “There is one condition I
must make,” he said with a trifling hesitation—“one only.”
“Ask of my gratitude what you will,” answered René quickly, while he
drew a deep breath of relief and freedom,—the breath of one who
casts to the ground the weight of a deadly burden.
“It is, that you will bind yourself only to paint for me.”
“Certainly!” René gave the assent with eagerness. Poor fellow! it was
a novelty so exquisite to have any one save the rats to paint for. It
had never dawned upon his thoughts that when he stretched his
hands out with such passionate desire to touch the hem of the
garment of Fortune and catch the gleam of the laurels of Fame, he
might be in truth only holding them out to fresh fetters.
“Very well,” said the old man quietly, and he sat down again and
looked full in René’s face, and unfolded his views for the artist’s
future.
He used many words, and was slow and suave in their utterance,
and paused often and long to take out his heavy gold box; but he
spoke well. Little by little his meaning gleamed out from the folds of
verbiage in which he skilfully enwrapped it.
It was this.
The little valueless drawings on the people’s sweetmeat boxes of
gilded cardboard had a grace, a color, and a beauty in them which
had caught, at a fair-booth in the village of St. Cloud, the ever-
watchful eyes of the great dealer. He had bought half a dozen of the
boxes for a couple of francs. He had said, “Here is what I want.”
Wanted for what? Briefly, to produce Petitot enamels and Fragonard
cabinets—genuine eighteenth-century work. There was a rage for it.
René would understand?
René’s dark southern eyes lost a little of their new lustre of
happiness, and grew troubled with a sort of cloud of perplexity. He
did not seem to understand.
The old man took more snuff, and used phrases clearer still.
There were great collectors—dilettanti of houses imperial and royal
and princely and noble, of all the grades of greatness—who would
give any sum for bonbonnières and tabatières of eighteenth-century
work by any one of the few famous masters of that time. A genuine,
incontestable sweetmeat box from the ateliers of the Louis XIV. or
Louis XV. period would fetch almost a fabulous sum. Then again he
paused, doubtfully.
René bowed, and his wondering glance said without words, “I know
this. But I have no eighteenth-century work to sell you: if I had,
should we starve in an attic?”
His patron coughed a little, looked at Lili, then proceeded to explain
yet further.
In René’s talent he had discerned the hues, the grace, the delicacy
yet brilliancy, the voluptuousness and the désinvolteure of the best
eighteenth-century work. René doubtless did other and higher things
which pleased himself far more than these airy trifles. Well, let him
pursue the greater line of art if he chose; but he, the old man who
spoke, could assure him that nothing would be so lucrative to him as
those bacchantes in wreaths of roses and young tambourine-players
gorge au vent dancing in a bed of violets, and beautiful marquises,
powdered and jewelled, looking over their fans, which he had
painted for those poor little two-sous boxes of the populace, and the
like of which, exquisitely finished on enamel or ivory, set in gold and
tortoise-shell rimmed with pearls and turquoises or opals and
diamonds, would deceive the finest connoisseur in Europe into
receiving them as—whatever they might be signed and dated.
If René would do one or two of these at dictation in a year, not more,
—more would be perilous,—paint and sign them and produce them
with any touches that might be commanded; never ask what became
of them when finished, nor recognize them if hereafter he might see
them in any illustrious collection—if René would bind himself to do
this, he, the old man who spoke, would buy his other paintings, place
them well in his famous galleries, and, using all his influence, would
make him in a twelvemonth’s time the most celebrated of all the
young painters of Paris.
It was a bargain? Ah, how well it was, he said, to put the best of
one’s powers into the most trifling things one did! If that poor little
two-sous box had been less lavishly and gracefully decorated, it
would never have arrested his eyes in the bonbon-booth at St.
Cloud. The old man paused to take snuff and receive an answer.
René stood motionless.
Lili had sunk into a seat, and was gazing at the tempter with wide-
open, puzzled, startled eyes. Both were silent.
“It is a bargain?” said the old man again. “Understand me, M. René
Claude. You have no risk, absolutely none, and you have the
certainty of fair fame and fine fortune in the space of a few years.
You will be a great man before you have a gray hair: that comes to
very few. I shall not trouble you for more than two dix-huitième siècle
enamels in the year—perhaps for only one. You can spend ten
months out of the twelve on your own canvases, making your own
name and your own wealth as swiftly as your ambition and
impatience can desire. Madame here,” said the acute dealer with a
pleasant smile—“Madame here can have a garden sloping on the
Seine and a glass house of choicest flowers—which I see are her
graceful weakness—ere another rose-season has time to come
round, if you choose.”
His voice lingered softly on the three last words.
The dew stood on René’s forehead, his hands clenched on the
easel.
“You wish me—to—paint—forgeries of the Petitot enamels?”
The old man smiled unmoved: “Chut, chut! Will you paint me little
bonbonnières on enamel instead of on cardboard? That is all the
question. I have said where they go, how they are set: what they are
called shall be my affair. You know nothing. The only works of yours
which you will be concerned to acknowledge will be your own canvas
pictures. What harm can it do any creature? You will gratify a
connoisseur or two innocently, and you will meanwhile be at leisure
to follow the bent of your own genius, which otherwise—”
He paused: I heard the loud throbs of René’s heart under that cruel
temptation.
Lili gazed at his tempter with the same startled terror and
bewilderment still dilating her candid eyes with a woful pain.
“Otherwise,” pursued the old man with merciless tranquillity, “you will
never see me any more, my friends. If you try to repeat any story to
my hindrance, no one will credit you. I am rich, you are poor. You
have a great talent: I shall regret to see it lost, but I shall let it die—
so.”
And he trod very gently on a little gnat that crawled near his foot, and
killed it.
A terrible agony gathered in the artist’s face.
“O God!” he cried in his torture, and his eyes went to the canvases
against the wall, and then to the face of his wife, with an unutterable,
yearning desire.
For them, for them, this sin which tempted him looked virtue.
“Do you hesitate?” said the merciless old man. “Pshaw! whom do
you hurt? You give me work as good as that which you imitate, and I
call it only by a dead man’s name: who is injured? What harm can
there be in humoring the fanaticism of fashion? Choose—I am in
haste.”
René hid his face with his hands, so that he should not behold those
dear creations of his genius which so cruelly, so innocently, assailed
him with a temptation beyond his strength.
“Choose for me—you!” he muttered in his agony to Lili.
Lili, white as death, drew closer to him.
“My René, your heart has chosen,” she murmured through her dry,
quivering lips. “You cannot buy honor by fraud.”
René lifted his head and looked straight in the eyes of the man who
held the scales of his fate, and could weigh out for his whole life’s
portion either fame and fortune, or obscurity and famine.
“Sir,” he said slowly, with a bitter, tranquil smile about his mouth, “my
garret is empty, but it is clean. May I trouble you to leave it as you
found it?”
So they were strong to the end, these two famished children of
frivolous Paris.
But when the door had closed and shut their tempter out, the
revulsion came: they wept those tears of blood which come from the
hearts’ depths of those who have seen Hope mock them with a smile
a moment, to leave them face to face with Death.
“Poor fools!” sighed the old vine from his corner in the gray, dull
twilight of the late autumn day.
Was the vine right?
The air which he had breathed for fifty years through all his dust-
choked leaves and tendrils had been the air off millions of human
lungs, corrupted in its passage through millions of human lips; and
the thoughts which he thought were those of human wisdom:
The sad day died; the night fell; the lattice was closed; the flute lay
untouched. A great misery seemed to enfold us. True, we were no
worse off than we had been when the same day dawned. But that is
the especial cruelty of every tempter always: he touches the
innocent, closed eyes of his victims with a collyrium which makes the
happy blindness of content no longer possible. If strong to resist him,
he has still his vengeance, for they are never again at peace as they
were before that fatal hour in which he showed them all that they
were not, all that they might be.
Our stove was not more chill, our garret not more empty; our
darkness not more dark amidst the gay, glad, dazzling city; our
dusky roof and looming crown that shut the sky out from us not more
gloomy and impenetrable than they had been on all those other
earlier nights when yet we had been happy. Yet how intensified
million-fold seemed cold and loneliness and poverty and darkness,
all!—for we had for the first time known what it was to think of riches,
of fame, of homage, of light, as possible, and then to lose them all
forever!
I had been resigned for love’s sake to dwell amongst the roofs,
seeing not the faces of the stars, nor feeling ever the full glory of the
sun; but now—I had dreamed of the fair freedom of garden-ways
and the endless light of summer suns on palace terraces, and I
drooped and shivered and sickened, and was twice captive and
twice exiled, and knew that I was a little nameless, worthless,
hapless thing, whose fairest chaplet of blossom no hand would ever
gather for a crown.
As with my life, so was it likewise with theirs.
They had been so poor, but they had been so happy: the poverty
remained, the joy had flown.
The winter was again very hard, very cold: they suffered greatly.
They could scarcely keep together body and soul, as your strange
phrase runs; they went without food sometimes for days and days,
and fuel they had scarcely ever.
The bird in his cage was sold; they would not keep the little golden
singing thing to starve to silence like themselves.
As for me, I nearly perished of the cold; only the love I bore to Lili
kept a little life in my leafless branches.
All that cruel winter-time they were strong still, those children of
Paris.
For they sought no alms, and in their uttermost extremity neither of
them ever whispered to the other: “Go seek the tempter; repent, be
wise. Give not up our lives for a mere phantasy of honor.”
“When the snow is on the ground, and the canvases have to burn in
the stove, then you will change your minds and come to me on your
knees,” the old wicked, foul spirit had said mocking them, as he had
opened the door of the attic and passed away creaking down the
dark stairs.
And I suppose he had reckoned on this; but if he had done so, he
had reckoned without his host, as your phrase runs: neither René
nor Lili ever went to him, either on knees or in any other wise.
When the spring came we three were still all living—at least their
hearts still beat and their lips still drew breath, as my boughs were
still green and my roots still clung to the soil. But no more to them or
to me did the coming of spring bring, as of old, the real living of life,
which is joy. And my lover the wind wooed me no more, and the
birds no more brought me the rose-whispers of my kindred in
Provence. For even the little pigeon-hole in the roof had become too
costly a home for us, and we dwelt in a den under the stones of the
streets, where no light came and scarce a breath of air ever strayed
to us.
There the uncompleted canvases, on which the painter whom Lili
loved had tried to write his title to the immortality of fame, were at
last finished—finished, for the rats ate them.
All this while we lived—the man whose genius and misery were hell
on earth; the woman whose very purity and perfectness of love were
her direst torture; and I, the little white flower born of the sun and the
dew, of fragrance and freedom, to whom every moment of this
blindness, this suffocation, this starvation, this stench of putrid odors,
this horrible roar of the street above, was a moment worse than any
pang of death.
Away there in Provence so many a fair rose-sister of mine bowed
her glad, proud, innocent head with anguish and shuddering terrors
to the sharp summons of the severing knife that cut in twain her life,
whilst I—I, on and on—was forced to keep so much of life as lies in
the capacity to suffer and to love in vain.
So much was left to them: no more.
“Let us compel Death to remember us, since even Death forgets us!”
René murmured once in his despair to her.
But Lili had pressed her famished lips to his: “Nay, dear, wait; God
will remember us even yet, I think.”
It was her faith. And of her faith she was justified at last.
There came a ghastlier season yet, a time of horror insupportable—
of ceaseless sound beside which the roar of the mere traffic of the
streets would have seemed silence—a stench beside which the
sulphur smoke and the gas fumes of a previous time would have
been as some sweet, fresh woodland air—a famine beside which the
daily hunger of the poor was remembered as the abundance of a
feast—a cold beside which the chillness of the scant fuel and empty
braziers of other winters were recalled as the warmth of summer—a
darkness only lit by the red flame of burning houses—a solitude only
broken by the companionship of woe and sickness and despair—a
suffocation only changed by a rush of air strong with the scent of
blood, of putridity, of the million living plague-stricken, of the million
dead lying unburied.
For there was war.
Of year or day or hour I knew nothing. It was always the same
blackness as of night; the same horror of sound, of scent, of cold;
the same misery; the same torture. I suppose that the sun was
quenched, that the birds were dumb, that the winds were stilled
forever—that all the world was dead; I do not know. They called it
War. I suppose that they meant—Hell!
Yet Lili lived, and I; in that dead darkness we had lost René—we saw
his face no more. Yet he could not be in his grave, I knew, for Lili,
clasping my barren branches to her breast, would murmur: “Whilst
he still lives I will live—yes, yes, yes!”
And she did live—so long, so long!—on a few draughts of water and
a few husks of grain.
I knew that it was long, for full a hundred times she muttered aloud:
“Another day? O God!—how long? how long?”
At last in the darkness a human hand was stretched to her, once,
close beside me. A foul, fierce light, the light of flame, was
somewhere on the air about us, and that moment glowed through
the horrid gloom we dwelt in in the bowels of the earth. I saw the
hand and what it held to her; it was a stranger’s, and it held the little
colorless dead rose, my sweetest blossom, that had lain ever upon
René’s heart.
She took it—she who had given it as her first love-gift. She was
mute. In the glare of the flame that quivered through the darkness I
saw her—standing quite erect and very still.
The voice of a stranger thrilled through the din from the world above.
“He fought as only patriots can,” it said softly and as through tears. “I
was beside him. He fell with Regnault in the sortie yesterday. He
could not speak; he had only strength to give me this for you. Be
comforted; he has died for Paris.”
On Lili’s face there came once more the radiance of a perfect peace,
a glory pure and endless as the glory of the sun. “Great in death!”
she murmured. “My love, my love, I come!”
I lost her in the darkness.
I heard a voice above me say that life had left her lips as the dead
rose touched them.
What more is there for me to tell?
I live, since to breathe, and to feel pain, and to desire vainly, and to
suffer always, are surest proofs of life.
I live, since that stranger’s hand, which brought my little dead
blossom as the message of farewell, had pity on me and brought me
away from that living grave. But the pity was vain; I died the only
death that had any power to hurt me when the human heart I loved
grew still forever.
The light of the full day now shines on me; the shadows are cool, the
dews are welcome; they speak around me of the coming of spring,
and in the silence of the dawns I hear from the woods without the
piping of the nesting birds; but for me the summer can never more
return—for me the sun can never again be shining—for me the
greenest garden world is barren as a desert.
For I am only a little rose, but I am in exile and France is desolate.
 COSY CORNER SERIES.

A Series of Short Original Stories, or

Reprints of Well-known Favorites,
Sketches of Travel, Essays and Poems.

The books of this series answer a long-felt need for a half-

hour’s entertaining reading, while in the railway car, during
the summer outing in the country or at the seaside, or by
the evening lamp at home. They are particularly adapted
for reading aloud, containing nothing but the best from a
literary standpoint, and are unexceptionable in every way.
They are printed from good type, illustrated with original
sketches by good artists, and neatly bound in cloth. The
size is a 16mo, not too large for the pocket.

PRICE FIFTY CENTS EACH.

BIG BROTHER. By Annie Fellows-Johnston.

CHRISTMAS AT THOMPSON HALL. By Anthony
Trollope.
STORY OF A SHORT LIFE. By Juliana Horatia Ewing.
A PROVENCE ROSE. By Louisa de la Ramé (Ouida).
RAB AND HIS FRIENDS. By Dr. John Brown.

Other volumes to follow.

Published by JOSEPH KNIGHT

COMPANY, Boston.

Any of the above works will be sent by mail,

postage prepaid, to any part of the United States,
Canada, or Mexico, on receipt of the price.