Refuge markets done right

Refuge markets done right

Why

To summarize briefly, idea futures markets have a problem we call "existential risk", that if the world ends, bets can't be paid off, so bets on armageddon cases tell us nothing.

Like, if I were to bet you $1,000,000 to your $1 that the world won't end, how would I pay if I lose? So it'd be just you giving me a dollar, which says nothing about the likelihood the world will end.

This is a particular problem for decision markets. If a blind spot blocks them from seeing armageddon, what they falsely see in its place might look like the best way to go.

Refuge markets try to sell some chance of post-catastrophe survival in order to measure the likelihood that a catastrophe will happen, to see past that blind spot.

Prior ideas

Twice Robin Hanson has blogged about refuge markets. The first time around, he said that people would buy into a sort of lottery, and if catastrophe struck, they'd survive in a sort of bomb shelter. Some things he got right:

• Tickets would be selected well before catastrophe struck. The ticket holders would live at the shelter for some predetermined time period.
• There'd be different types of refuges appropriate to different types of catastrophe.

In the comments, and skipping over the majority that just don't see the point, some of us told him why it wouldn't work:

• Season variation, fads, etc would swamp the real signal.
• There was no way to guarantee that shelter guardians would follow the rules. They might save themselves and their families. Even if maybe they wouldn't, the perception that they might could alter the price a great deal. The real signal would be swamped by fluctuations of that perception.

So the second time around, Robin proposed that refuges be paired with downscale resorts. Some ticket-holders would go to the refuges, some to the resorts - they're supposed to be the same but of course they wouldn't be. When disaster struck, the refuge would be sealed.

His second approach solves nothing and just exacerbates the problems of the first approach. I give him due credit for trying to solve an important problem, and he does have a glimmer of a real idea, but he has not remotely got it right. I have diagnosed and fixed his broken ideas before, so here goes again.

How to measure likelihood

One important principle in measuring is to remove common modes beforehand. Measure the thing you're really trying to measure and make the rest cancel out.

Have two types of ticket holders, which we will treat identically until catastrophe:

Real ticket holders

as above.

Decoys

Other refuge dwellers who are ejected when catastrophe is declared. Possibly moved to one of the downscale resorts Robin imagines.

The real ticket holders presumably pay a premium to have exactly the same experience as the decoy ticket holders plus a very good likelihood of surviving a catastrophe. That price difference essentially measures the likelihood of catastrophe.¹

Yes, the ejection of decoy ticket holder is a bit cruel, but compared to losing a major city it's minor. And the shelter would have only enough provisions for real ticket holder. It has to be so: if it weren't, we'd increase the size of real ticket holder beforehand.

Rest assured that I don't daydream about tossing strangers out the door into "Day After" scenarios. It's a case of thinking the unthinkable and not blinking at the results. Just to forewarn you, the rest of this post contains more "unthinkable" thinking. Proceed at your own risk.

Keeping the measurement clean (and thinking the unthinkable)

Other than likelihood of survival, we don't want there to be any perceptible distinctions between real ticket holder and decoy ticket holder. Here are some threats and how we might address them:

Stolen tickets

Presumably when living at close quarters with armageddon approaching, decoy ticket holders would be tempted to simply steal a life-giving ticket from some unwary real ticket holder. We don't want a decoy ticket to reflect a chance to steal a real ticket.

So it can't be a physical ticket². It would have to be identity-based. Perhaps biometric.

Social effects

Ticket-holding might be a status item, or a fad gift, or other social signal. Holding a real ticket holder might even mean more status among the ticket holders than holding a decoy ticket. We don't want the ebb and flow of those social things to affect our measurement.

So tickets should be cryptographically blinded. I said that they'd be identity-based, but the two aren't incompatible. That can be implemented something like this: In a database, for each ticket holder there is a digital certificate that connects his identity to either a real ticket or a decoy ticket. And that certificate can only be read with a certain key, and that key is only made available when catastrophe is declared.

This wouldn't prevent real ticket holders from bragging. After all, they know they've got a real ticket even if the refuge guardians haven't checked. When they paid, they presumably got something that proved they had a real ticket and not a decoy ticket, and they might be tempted to reveal it.

My answer: Flood the situation. Make it possible, even easy, for decoy ticket holders to pretend to be real ticket holders. Create fake "proof" of real ticket holder status for everybody - such that it won't hold up under cryptographic check but passes casual inspection. If the physical token is just a printout, offer decoy ticket holders fake real ticket printouts.

Guardians unwilling to eject

What if refuge guardians refuse to eject decoy ticket holders, perhaps on moral grounds or because they like particular individuals? This is largely an issue of physical circumstance, so let's change the physical circumstance. Let's blind the guardians to which fate they're dealing out.

Build several smaller shelters, or just compartmentalize a single shelter. When catastrophe is declared, move both real ticket holders and decoy ticket holders. Each real ticket holder is taken to another shelter, and each decoy ticket holder is taken elsewhere, perhaps to one of the resorts that Robin imagines.

So now checking tickets just reveals "to be sent to destination Codename A" or "destination Codename B". The individual goes with a driver or escort who has sealed instructions. Which sealed instructions he gets corresponds to A or B.

Ticket holders resist being ejected

What if decoy ticket holders try to stay by force?

Again it's an issue of physical circumstance. It almost seems as if the refuge guardians would have to treat decoy ticket holders as prisoners to be forcibly moved. But that would mean treating real ticket holders as prisoners too. Some people might feel that a real ticket holder was hardly worth it under those circumstances, or that being a decoy ticket holder was a particularly horrible fate. I can't persuade myself that this would not distort the measurement.

Fortunately that's not the only possible approach. We could try to make the ticket holders unware of which fate they are receiving. That's much harder, since they obviously know which type of ticket they bought. But it might be doable. Approaches:

• Create incentives to buy either type of ticket for another individual, while telling all recipients that they got a real ticket. It's a different measurement than the one we've been talking about but seems just as revealing.
• Probabilistically save some decoy ticket holders, with a predetermined probability. Let everyone know that this will happen, but not who is to be saved. Of course this affects the relative price of decoy tickets to real tickets, but we'd just multiply to get the original answer. This also lets us measure the effect of probability on the price.

We'd also want to remove any cues that one group or another "must all be decoy ticket holders" or "real ticket holders" as deduced from the presence of particular individuals. So we'd want individuals to be directed one by one, not as a group.

Incentive for guardians to follow the rules

For this to work, would-be buyers of real tickets have to be sure that refuge guardians have to actually do this as planned. But what incentive do guardians have to follow yesterday's rules on doomsday?

Dry runs

Of course there should be dry runs. Any number of aspects of it need to be frequently rehearsed in ways that make it as similar to the real thing as possible. We might even consider sometimes cutting off communication to the outside and falsely declaring catastrophe.

Loved ones

As mentioned above, one threat was that in the face of catastrophe, shelter guardians would of course rescue their own loved ones, ejecting the ticket-holding strangers.

We can turn that incentive into an advantage. Let each guardian's loved ones stay at a different refuge (up to some number). When catastrophe strikes, let the loved ones be moved as well. Normally, the loved ones are moved to another shelter just like real ticket holders. But if a guardian failed his duties, his loved ones are ejected and other people, presumably some of the decoy ticket holders, are saved instead. Don't be too shocked; I told you beforehand that this was thinking the unthinkable.

So now we have two operations of moving people between refuges. I'll call this one the "loved ones move" and the other the "ticket-holder move".

Schedule the ticket-holder move first. After it's done, check that everybody has got to the place they were supposed to go and the rules were followed. If not, assign responsibility. Then do the loved ones move.

The assignment of responsibility needs to require very little judgement and to be heavily cross-checked.

Who watches the watchers?

Other watchers, of course. Part of the protocol should be that guardians, by prearrangement, check on other guardians' correct performance, including their correct performance of checks on other guardians.

But then what are their refuge guardians' incentives to do the last loved ones' move by the rules? Maybe, impelled by a sense of camaraderie, they would save their fellow guardians loved ones regardless of their performance, instead of saving decoy ticket holders who are not beloved by their fellow guardians.

More generally, what incentive does the last-to-check guardian have to follow the rules? And if he needn't, the next-to-last-to-check guardian's performance is not assured, and so forth.

The performance guarantee is stronger with the chain of guardians. None but the last-to-check can be confident that everyone after them will let them off the hook.

But let's not entirely depend on that. Instead, let's keep it uncertain where the sequence ends. Let no guardian know for certain that nobody will check after they act. That means pre-arranging checks and keeping them secret, and having penalties for breaking the secrecy prematurely. Also, it means doing each loved ones' move at a random time and keeping it secret from the other refuges, so that no loved-one-mover may be confident that they are the last to act.

Hardware

Computers are not swayed by the prospect of armageddon, so when trying to ensure that certain rules will be followed on doomsday, it's natural to use them heavily.

But I can imagine catastrophes where computers don't work, perhaps if the disaster includes EMPs. Fortunately, this does not entirely prevent us from using cryptographic signatures and blinding and so forth. There are fallbacks such as doing the algorithm with pencil and paper or on a mechanical calculating machine. We'd need to make sure these fallbacks were available.

Afterword

Again I want to point out that this post is about predicting (and this maybe preventing) catastrophes, and as such needed to "think the unthinkable". Rest assured that none of this nasty business warms my heart.

Footnotes:

¹ Nitpick: It also measures the will to survive.

² But presumably we'd give some sort of physical token, even if it's just a printout.