Sini Ruohomaa
email: sini.ruohomaa@cs.helsinki.fi

Puneet Kaur

Lea Kutvonen

From Subjective Reputation to Verifiable Experiences -Augmenting Peer-Control Mechanisms for Open Service Ecosystems

des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

In inter-enterprise collaborations, services from different organizations and domains join together to fulfil a mutual goal. In the open service ecosystem, the services are autonomous, and there is no centralized control of the collaboration process. Each service must independently determine which other services it should collaborate with; a trust decision is made to determine this willingness to rely on another service. The Pilarcos inter-enterprise collaboration management infrastructure [START_REF] Kutvonen | Service-oriented middleware for managing inter-enterprise collaborations[END_REF][START_REF] Kutvonen | Interoperability middleware for federated business services in web-Pilarcos[END_REF] contains a trust management system to automate these decisions in routine cases [START_REF] Ruohomaa | Trust and distrust in adaptive inter-enterprise collaboration management[END_REF]; selected difficult or high-stake decisions are forwarded to a human user based on policy-defined rules [START_REF] Kaur | User interface for trust decision making in inter-enterprise collaborations[END_REF].

A central element of the trust decisions is an estimation of the risk of collaborating with the given actor. The estimate is based on gathered experiences on the actor's past behaviour, which consists of both first-hand experiences from earlier collaborations with it, and shared experiences from third parties received through a reputation system.

A reputation system has two tasks. First, from the enterprise perspective, it provides information to support trust decisions for each individual service; this helps the participants in the reputation system to find new partners and to steer clear of misbehaving services in order to limit their risk.

Second, from the ecosystem perspective, it introduces a form of peer control where misbehaviour towards other actors or the ecosystem infrastructure is punished through reputation loss. Sociological research indicates that direct first-order punishment for misbehaviour is not enough by itself to ensure that the ecosystem can scale up in size: it must be complemented with a second-order punishment to discourage unfair first-order punishments [START_REF] Fehr | The nature of human altruism[END_REF]. In other words, spreading false experiences must have a negative reputation impact on the source.

To contrast these requirements to current solutions, systems sharing reputation information are occasionally also considered as subjective recommender systems on other users; with such an approach, the aim is to promote commonly liked services rather than implement robust peer-based control. For a recommendation system, experiences are accepted as subjective reports on the fulfilment of expectations. As different expectations can lead to different reports even on identical behaviour, these reports do not objectively describe actual outcomes in the sense that reports on breaches of contract do. While they can still support individual decision-making as indicators of popularity, the subjectivity of the criteria in use makes recommender systems unsuitable for social control. Solutions have been proposed to promote similar understanding of the recommendation values [START_REF] Hasan | Elimination of subjectivity from trust recommendation[END_REF][START_REF] Dondio | A translation mechanism for recommendations[END_REF]; however, shared semantics do not yet change the fact that the actors involved are stating their opinions, which cannot be used as a basis of judging whether a statement is unfair. As an extreme example, two honest actors may judge a musician's performance completely differently based on their tastes, due to a lack of objective measurement scale for what is "good music". To get around this ambiguity, we propose to monitor for and report objectively defined events: explicit breaches of collaboration contracts.

The core problems of unverifiability and subjectivity of experiences in current approaches hinder the use of reputation information in inter-enterprise collaborations, particularly for automated decision-making. Falsely accused actors must be able to rebut reports to clear their name, while honest reporters should be protected from retaliatory action, and the reciprocity of feedback [START_REF] Resnick | Trust among strangers in internet transactions: Empirical analysis of eBay's reputation system[END_REF] limited.

We advance a reputation system based on objective, verifiable experiences. It is designed to support automated trust decisions on inter-enterprise collaborations, and implements peer control in the service ecosystem by supporting second-order punishment: a successful rebuttal of a false experience causes reputation loss for the dishonest information source. This is achieved by introducing a nonrepudiable audit trail to collaborations, and defining reputation impacts of misbehaviour in collaboration contracts. Similarly, negative reputation impacts for misreporting are defined in a reputation network contract. The solution extends the existing Pilarcos collaboration management infrastructure [START_REF] Kutvonen | Service-oriented middleware for managing inter-enterprise collaborations[END_REF][START_REF] Ruohomaa | Trust and distrust in adaptive inter-enterprise collaboration management[END_REF].

The rest of the paper is structured as follows: Section 2 presents the Pilarcos ecosystem we build on, and related work. Section 3 maps evidence to reputation impacts through collaboration contracts to achieve objectivity, and specifies the process of creating new reputation information in which unverifiable experiences can be rebutted and removed from the system. Section 4 discusses the impact of the solution and compares it to the state of the art.

Background and related work

In the first subsection, we summarize the existing Pilarcos open service ecosystem, in which we utilize reputation for trust management. The second subsection presents related work on the topic of objective and verifiable experiences.

Reputation-based trust management in Pilarcos

The Pilarcos collaboration management infrastructure provides support for partner discovery, interoperability management, contract negotiations, runtime monitoring, including contract breach detection and recovery, as well as local trust decisions evaluating the actors' willingness to collaborate with their potential partners [START_REF] Kutvonen | Service-oriented middleware for managing inter-enterprise collaborations[END_REF][START_REF] Ruohomaa | Trust and distrust in adaptive inter-enterprise collaboration management[END_REF]. The Pilarcos service ecosystem is collaboratively governed, rather than centrally controlled, to ensure its long-term viability and scalability [START_REF] Ruokolainen | Solving service ecosystem governance[END_REF].

We propose to strengthen the implemented reputation-based trust management system in Pilarcos [START_REF] Ruohomaa | Trust and distrust in adaptive inter-enterprise collaboration management[END_REF] by providing it with a flow of objective and verifiable reputation information. The trust management system is modular, and can take advantage of different kinds of reputation systems as its information sources. It splits experience information into four dimensions: monetary, reputation, control and satisfaction. This allows risk evaluations to differentiate between e.g. misbehaviour that directly causes monetary loss, deterioration of own reputation caused by a partner spreading fraudulent reports afterwards, weakening of peer control due to an actor's misbehaviour as a recommender, and failures to satisfy the demands set in contracts, which may or may not have direct monetary consequences, respectively [START_REF] Ruohomaa | Trust and distrust in adaptive inter-enterprise collaboration management[END_REF].

Collaboration contracts, or eContracts, are based on business network models that specify the structure and business processes of the collaboration, and relevant trust decision points [START_REF] Kutvonen | Interoperability middleware for federated business services in web-Pilarcos[END_REF][START_REF] Ruohomaa | Trust and distrust in adaptive inter-enterprise collaboration management[END_REF]. These models are modular, reusable and public, and they are produced by domain experts in response to the needs of the ecosystem. During contract negotiations, open options in the models, such as particular quality of service requirements or the price of the service, can be further refined to form an agreement between the participants [START_REF] Kutvonen | From trading to eCommunity management: Responding to social and contractual challenges[END_REF].

The trust management process can be divided into two parts: the trust decisions, and the evolution process of the reputation information. Both are governed by their own policies. A trust decision is triggered at specific points of the collaboration process, as further resources are committed and an up-to-date risk evaluation is needed. To evaluate the risk of proceeding with the collaboration, we predict the outcome it would have on different assets based on previous experiences, which are stored as reputation information; the details of the format are described in earlier work [START_REF] Ruohomaa | Trust and distrust in adaptive inter-enterprise collaboration management[END_REF]. In this paper, we focus on the evolution of reputation information through sharing experiences in a reputation system.

Related work to support objective and verifiable experiences

We distinguish three approaches for collecting experiences in a way that members in the service ecosystem can agree on their content: centrally orchestrated, fully distributed and a protocol-based approach utilizing third-party witnesses.

TrustCoM [START_REF] Wilson | Trustcom framework V2, Deliverable D29, D35, D36[END_REF] represents the centrally orchestrated approach. In TrustCoM, performance monitors both internal and external to the actors collect information pertinent to fulfilling the Service Level Agreement (SLA), such as response times. The monitors send these raw observations to an SLA Evaluator, which is a third party trusted to pass a neutral judgement on the transacting parties. This result is, in turn, reported to a trusted third party reputation system, or used as a basis of removing a partner from the collaboration. The approach follows a tradition set by centralized workflow execution, such as implemented by CrossWork [START_REF]Dynamic Business Process Formation for Instant Virtual Enterprises[END_REF]. It involves a trusted infrastructure service or a hub member of the ecosystem running a distributed business process by using the other participants as components. This central operator can judge the performance of the other actors, and decide on sanctions directly. The main difference in operational environments is that in Pilarcos, control and monitoring are distributed among the autonomous and not fully trusted participants. As a result, there are no actors that are able to observe all collaborations in the ecosystem.

In the fully distributed approach (e.g. TrustGuard [START_REF] Srivatsa | TrustGuard: countering vulnerabilities in reputation management for decentralized overlay networks[END_REF]), the transacting parties exchange nonrepudiable, i.e. cryptographically signed, receipts that act as evidence of their actions later. The main challenge in this approach is in the asymmetry of receipts: the party responsible for signing the last receipt can refuse to finish the protocol, which leaves a hole in the audit trail of evidence [START_REF] Micali | Simple and fast optimistic protocols for fair electronic exchange[END_REF]. In TrustGuard, receipts document the intention to collaborate, which means that the service is not provided before the protocol has been completed. This scheme protects against submitting experiences of transactions that were never really started, but cannot stop unfair reports from being made after the transaction.

In the protocol-based approach (e.g. Li, Martin and Zhang [START_REF] Li | Design of a multiagent-based e-marketplace to secure service trading on the Internet[END_REF]), a third party witness is included in transactions, observing them and implementing a fair, "atomic" exchange [START_REF] Micali | Simple and fast optimistic protocols for fair electronic exchange[END_REF]. The proposal of Li et al. aims to secure an electronic marketplace, which can host a simple form of inter-enterprise collaboration where goods are exchanged in brief, fixed transactions. It involves an arbitrator, who acts as a witness and judge of a collaboration, and punishes misbehaviour through withdrawals on a monetary deposit that all participants have made beforehand in a trusted bank. In addition, the arbitrator can report experiences to a reputation system. When the arbitrator is not needed to resolve a disagreement, a central broker service reports a default positive experience once a specified time has passed since it matched the two actors [START_REF] Li | Design of a multiagent-based e-marketplace to secure service trading on the Internet[END_REF].

Li et al. implement a centralized punishment system on top of the fair receipt exchange protocol, which is where they differ from Pilarcos. Our aim in this paper is to distribute punishment as peer-based control, while taking advantage of the third party witness approach to provide a stream of verifiable evidence on the outcomes of transactions in the collaborations.

To distinguish between a passive witness and the active arbitrator passing judgement, we denote the former as notaries: a notary's task is to verify with its own signature whether a protocol was followed according to the specification it has been given by the transacting partners. The notary must be trusted by the given partners to remain impartial on that exchange to eliminate asymmetry, and their agreement on a given notary must be nonrepudiable once the transaction begins. On the other hand, a specific notary does not necessarily need to be trusted by anyone else in the collaboration or the entire ecosystem, as each independent exchange can be observed by a different notary. This limits the power that any specific notary service can gain over the actors in the marketplace.

As a related branch, certification-based trust also relies on cryptographical verifiability, but should not be confused with the proposed approach of signed receipts. Certification-based trust is used in e.g. NICE [START_REF] Lee | Cooperative peer groups in NICE[END_REF]. Instead of being experience-based, the system relies on signed expressions of "I, Alice, trust Bob", and trust decisions are based on policies on whether a provided set of trust declarations, or certificates, are sufficient to make the decision-maker also trust the considered target. Other examples of certification-based trust used for access control include WS-TRUST [START_REF]OASIS Web Service Secure Exchange TC: WS-Trust 1.3 OASIS Standard[END_REF] and KeyNote [START_REF] Blaze | KeyNote: Trust management for public-key infrastructures (position paper)[END_REF]. Misinformation is a relatively minor issue for these systems, as the group of accepted information sources is small, closed and managed offline: certificates document networks of pre-formed trust relationships between the sources rather than guiding their evolution.

In summary, related work shows that signed, nonrepudiable receipts provide a promising basis for the verifiability of experiences in open service ecosystems. We have found that third party witnesses, notaries, are needed to guarantee the fair exchange of receipts on the transaction, and that the concept has already been applied within electronic markets.

In the following section, we apply the solution to provide a basis for objective and verifiable reputation information in the open service ecosystem by first providing a mapping between the receipt evidence and the corresponding experience stored in a reputation system through contracts, then specifying a process for creation of new reputation information that allows experiences not backed by appropriate evidence to be rebutted and removed from the reputation system.

Sharing and rebuttal of new experiences

In order to make reputation information objective, it must be defined so that it has a measurable truth value, rather than as a subjective opinion. In this section, we define the basis for objective experiences, and specify the process for submitting them into the reputation system as well as for rebuting false experiences.

For inter-enterprise collaborations, objective experience sharing is made feasible by electronic contracts governing the collaborations: if the contract was followed, experiences should be positive; if it was violated, they should be negative. From the perspective of a single service, the impact of a specific outcome may vary from minor to major gain or loss [START_REF] Ruohomaa | Trust and distrust in adaptive inter-enterprise collaboration management[END_REF], but in order to make the shared experience objective, the impact in the shared experience must be standardized through the contract as well. A natural source for this information is the business network model referenced by the contract. The business network model is a formal model for the collaboration and defines e.g. the communication protocols and compensation processes involved [START_REF] Kutvonen | Service-oriented middleware for managing inter-enterprise collaborations[END_REF].

Determining the reputation effect of different outcomes becomes a part of the modelling process done by the domain expert, which makes the mapping reusable over multiple collaboration instances using the same model. The modelled values can be further fine-tuned in the contract negotiations, in case the same model can be used for collaborations dealing with very different stakes.

The collaboration contract, then, should specify a mapping of outcomes to experiences, for example that the event "goods received" should translate to an experience with major positive effect on the monetary and satisfaction assets, and no effect on the control and reputation assets [START_REF] Ruohomaa | Trust and distrust in adaptive inter-enterprise collaboration management[END_REF]. In this example, the party receiving the goods (A) will submit this experience on the party who sent them (B). In order to support verifiability, it also produces a signed, nonrepudiable receipt of the outcome of the step. The example communication protocol and the following experience submission process are depicted in Figure 1. The receipts, depicted in Figure 2, remain private unless they are used to rebut an experience, and they are stored by both collaborators. The source actor (A) is the provider of the receipt. The target actor (B) is the actor for whom the receipt is generated. The notary witnesses the transaction step when the protocol in the collaboration model so defines. In the optimistic fair exchange protocol [START_REF] Micali | Simple and fast optimistic protocols for fair electronic exchange[END_REF], collaborators can choose to only involve the notary if one party fails to respond on time. This requires that the relevant exchange can be repeated with the notary listening in as needed, but it should significantly reduce the communication overhead: the threat of notary involvement removes the attractiveness of receipt omissions almost as effectively as the observation itself [START_REF] Micali | Simple and fast optimistic protocols for fair electronic exchange[END_REF].

-Source actor id, target actor id -Notary id -Business network model id, eContract id, task id -Task counter, receipt protocol step -Outcome of step (e.g. "goods received") -Signature of witness (source or notary) Fig. 2. The contents of a receipt.

The model and task information together provide a reference for determining the reputation impact represented by the receipt, and a unique identifier for the receipt (and corresponding experience) in case the same task is repeated multiple times. Each task can be expected to produce several receipts on relevant steps, most notably its start and end, and this is captured by the step identifier. The outcome of the step is the identifier of the given outcome as defined in the contract. The eventual signature of the witness depends on whether the exchange was notarized or not.

The notary only sends out receipts, and does not store them; it does not participate in the reputation system process afterwards.

Experience reports, depicted in Figure 3, are submitted to the reputation system by the source about the target, corresponding to the relevant receipts. The identifiers of the actors are as above. Although the main relevance of the notary is in the receipt phase, it is provided in the experience report in order to support credibility analysis: not all of the reputation system participants are required to consider all available notaries trustworthy. When identifying the transaction, the protocol step mentioned in the receipt is omitted here -the single task produces one experience per actor (possibly on both participants in the transaction), but there are multiple receipts that can be used as evidence on a single experience depending on how the transaction progressed. The signature of the source ensures that the experience report cannot be faked: this is required, as submitting a false report that is successfully rebutted has a reputation impact.

-Source actor id, target actor id -Notary id, if applicable -Business network model id, eContract id, task id, task counter -Signature of the source -Timestamp (time of submission) Fig. 3. The contents of an experience report.

The timestamp here is set by the reputation system when it receives the report for dissemination. It is used to limit the time frame in which rebuttals must be made. Once the time has passed, the source and target are free to dispose of the receipts connected with the experience. In addition, the experi-ence can then be incorporated into a permanent storage, e.g. transformed into counter increments or similar compound formats that are no longer individually processable.

A rebuttal, depicted in Figure 4, is typically made by the target of the experience to clear its name, as the source has produced the experience to submit. In the case of whitewashing, i.e. undeserved positive experiences, a third party can decide to rebut the experience as well.

-Source id, target id, rebutter id -Business network model id, eContract id, task id, task counter -Type of rebuttal: 1) Target rebuttal of false (negative) experience, 2) target noting a failure to report (positive) experience, or 3) target or third party rebuttal to (negative or positive) experience on a nonexistent transaction -Evidence in form of signed receipts, as applicable -Signature of the rebutter -Timestamp (time of rebuttal) Fig. 4. The contents of a rebuttal.

The source and target id refer to their equivalents in the experience, while the rebutter id is either the target's or belongs to a third party whistleblower. The second line identifies the experience being rebutted. The type of rebuttal specifies which kind of response is expected:

For the first type, the target rebutting a (typically negative) experience, the rebutter (i.e. target) must provide any available reciepts proving it has followed the transaction according to contract. If the target's case is sufficient, the source suffers a reputation loss and the experience is removed. If its evidence does not fulfil the requirements of the rebuttal type and protocol, the rebuttal is ineffective. The verification of the evidence can be done centrally by the reputation system; in case the reputation system cannot be sufficiently trusted to follow this protocol fairly, the rebuttals and supporting evidence can be distributed to all the nodes to perform the rebuttal process locally. This choice ties to how information dissemination is organized in the reputation system in general, and is not forced either way by the model of how rebuttals work.

With the second type of rebuttal, the target notifies that the source should have reported a (typically positive) experience on it, but has not. The target, again, must provide the evidence to support its claim. This type forms a special case in defining the appropriate time for the rebuttal: the source should submit the experience without delay after it has provided the target with sufficient evidence, yet we cannot trust a timestamp in the receipt, as it can be set arbitrarily by the source. Instead, the fact that the target is able to present the evidence in the first place indicates that the experience should either be in the system or arriving simultaneously with the rebuttal. If this is not the case and the evidence from the receipts is sufficient, the source suffers negative reputation.

The third type of rebuttal demands a rebuttal response containing proof of the original experience. The target may rebut an experience, typically negative, of a transaction that never happened, or a third-party whistleblower may rebut it, suspecting an undeserved, typically positive experience. In both cases, the burden of proving that the transaction exists and ended as indicated by the experience lies with the source, and if it fails, it suffers a negative reputation impact. The relevant evidence consists of receipts signed by the target or a notary; receipts signed by the source alone are no more credible than the original signed experience report. In the case of the third party rebuttal, it is worth noting that the evidence may itself be a product of collusion between the source and target, in which case the rebuttal may have been appropriate but is still ineffective. The contents of the rebuttal response are depicted in Figure 5.

-Source id, target id, rebutter id -Business network model id, eContract id, task id, task counter -Evidence in form of signed receipts The rebuttal response can go unsigned, as the signatures of the receipts define its validity. It only needs to be identified as a continuation of the rebuttal before it, and provide the valid evidence. Its arrival time can be compared to the timestamp on the rebuttal, but it has no particular need for a timestamp itself: either it arrives on time to be accepted into the reputation system or it does not. A failure to respond adequately means the original rebuttal is accepted, while a successful response cancels out the rebuttal and the experience remains valid.

The impact of objective and verifiable experiences

We have defined an objective basis for experiences through associating them with contracts. This gives shared experiences the semantic clarity required to use them in automated decision-making. To ensure the verifiability of experiences, we enforce the fairness of the receipt exchange protocols through the use of notaries. Together, objectivity and verifiability provide a basis for using reputation information to implement social control in the open service ecosystems.

Obreiter discusses different types of nonrepudiable evidence and problems related to them [START_REF] Obreiter | A case for evidence-aware distributed reputation systems overcoming the limitations of plausibility considerations[END_REF]. Two issues in particular must be solved to ensure the acceptability of reputation systems for inter-enterprise collaborations:

-Actors have very limited incentive to provide any evidence of their own misbehaviour, while they may have an incentive to provide unfairly negative reports of their competitors to gain a competitive advantage. -Two colluding actors can provide an unlimited amount of positive feedback on each other by faking transactions.

We first show how our proposal addresses the first issue by providing the participants appropriate incentives to ensure fair reporting of misbehaviour, and then focus on addressing the second issue through limiting the negative effects of ballot stuffing to other members of the ecosystem. In the third subsection, we compare our work to the state of the art to delineate our contribution.

Ensuring fair reporting on existing transactions

The protocol design for experience reporting and rebuttal aims to reduce the need for rebuttals, limit the incentive for false reporting and omissions by making inaccuracies easier to detect by interested parties, and to balance between giving incentive for third party whistleblowers to rebut likely inaccurate reports, but not to flood the system.

To limit fraudulent positive reports that do not result from collusion, we have chosen the source of a relevant receipt to be the one to submit the related experience to the reputation system. Positive experiences are assumed to be the norm. The target of an experience has motivation to ensure that any deserved positive experiences are reported, possibly also to produce false positive experiences and omit negative experiences. The source, in turn, has motivation to punish the target with honest negative experiences, possibly to report false negatives as well, and omit positive experiences, particularly if the target is a competitor. The target has an interest to report an omission of a positive experience or to clear its name after a false negative experience, and it will know to do this if the reputation system fails to send an expected kind of notification of a reported experience after a transaction. On the other hand, the production of positive experiences about nonexistent transactions with the claimed source requires the source to be around to react to them on time, or a third party whistleblower to take interest; our design sets the source as the reporter to eliminate this issue.

The three types of rebuttals have different motivations and effects. Our goal is to punish false experience reports. To achieve objectivity in this, the exact reputation effects of spreading misinformation are defined in a reputation network contract that must be signed before joining the reputation network. This contract specifies other relevant factors, such as the exact timeframes for rebuttals and their responses, as well. To make the punishment system effective, the rebutters must have an incentive to submit correct rebuttals, and to not submit ungrounded rebuttals.

Actors have a reputation-based incentive to rebut unfairly negative experiences towards themselves. In all cases, the correct or missing experience can be added into the reputation system as a result of a successful rebuttal, in addition to the incorrect experience being removed or marked as invalid. This new experience can be signed by the target, or the centralized reputation system that verifies the evidence, if the latter is available. The target rebutter, in other words, typically gains positive experience as a result, which creates an incentive for it to rebut an experience correctly. Unsuccessful target rebutters can be punished with a negative reputation effect, as they are in a good position to estimate whether they or the source have the evidence to back or counter a rebuttal.

Punishing or awarding third party whistleblowers for their rebuttals is more complicated, however, as their rebuttals at best rely on a guess on whether the experience was a result of a collusion or an attempt to get lucky. The number of third-party rebuttals processed from any actor at a given timeframe can be limited to control the load. A minor reward for a competing service provider is that the artificially inflated reputation of its competitor is reduced, increasing its own reputation in relation to it. A greater incentive can be created by providing a reputation reward for a successful third-party rebuttal, although this in turn must be combined with limitations on the frequency of such rebuttals in order to not create an incentive to flood the reputation system with random rebuttals. In addition, the reputation gains of third-party rebutters should not be as high as the reputation loss of the other actor, as this would create a market for moving reputation from the source to the rebutter. Finally, actors with very bad reputation cannot be reasonably incentivized to behave through threats of further reputation loss, and should therefore be eventually shut out of submitting new information or third-party rebuttals to the reputation system.

Even when a third-party rebuttal is ineffective in the objective sense, disseminating the rebuttal attempt allows reputation system participants trusting the whistleblower more than the source and target together to adjust their local credibility analysis accordingly. These kinds of side effects are an argument for distributing information about the rebuttals to the entire reputation system even if a centralized system could perform the analysis itself.

Addressing collusion to generate positive experiences

As collaborations in the open service ecosystem are impossible to externally observe by third parties unless the collaborating parties allow it, it is possible for two participants to collude to produce positive experiences on each other. To do this, they exchange nonrepudiable receipts according to a protocol, without actually committing concrete resources. They can include an honest notary to observe the exchange and gain further credibility, assuming that the business process does not require costly third-party services to be invoked. Limiting the attractiveness of collusion is a difficult problem. The victim of conducting fake business may also be unobvious: how can positive feedback be harmful?

Let us assume that in a competitive environment, having a higher number of positive experience reports stored on an actor directly influences their probability of being chosen into a collaboration. This, in turn, provides additional opportunities in gaining further positive reputation. The assumption implies that a relative loss of reputation in comparison to one's competitors translates to a monetary loss that is slowly growing over time. Punishment for unfairly causing reputation loss to a victim is intuitively important. When we also consider that within this assumption, a relative gain in reputation in comparison to one's competitors is similar to causing all of them reputation loss, the problem with ballot stuffing in reputation systems becomes acute.

Li et al. propose to solve the issue by assigning a cost to all transactions, which would increase the cost of collusion [START_REF] Li | Design of a multiagent-based e-marketplace to secure service trading on the Internet[END_REF]. For the operational environment of Pilarcos, however, there is no clear single operator who could collect equal transaction-based fees from all members of the ecosystem, and allowing actors to choose the target of their payments would leave an opening for a more complex collusion that includes a dishonest operator service.

We must therefore resolve this issue within the domain of distributed peer control, and propose to do so by partially breaking the above assumption: positive experiences should not directly improve the probability of being chosen, but positive experiences that are locally found credible would have this effect. Negative experiences should generally have more weight in a decision than positive experiences, and they, in turn, must be backed by evidence.

By valuing local and possibly trusted partners' experiences above random shared experiences, the ecosystem members can limit the gains from collusion between isolated actors; we discuss a selection of different approaches to estimating the credibility of reputation information in earlier work [START_REF] Ruohomaa | Reputation management survey[END_REF][START_REF] Yao | Addressing common vulnerabilities of reputation systems for electronic commerce[END_REF]. Local credibility analysis based on e.g. social relations with the information source [START_REF] Gal-Oz | A robust and knot-aware trust-based reputation model[END_REF] or the relationship with local experiences [START_REF] Teacy | TRAVOS: Trust and reputation in the context of inaccurate reputation sources[END_REF] is subjective and therefore should only be used to select trustworthy and relevant information sources. It cannot form a basis for second-order punishment, as the reason for a disagreement between two experience sources can be caused by honestly reported discriminatory behaviour.

Comparison to the state of the art

To demarcate our contribution to the state of the art, we compare our solution within Pilarcos to the protocol-based solution proposed by Li et al. [START_REF] Li | Design of a multiagent-based e-marketplace to secure service trading on the Internet[END_REF] on five dimensions: application area, type of third party witness, target of observation, punishment method and implementation requirements. A summary of the comparison is provided in Table 1.

In application area, the proposals differ on two levels. Pilarcos operates in a governed open service ecosystem, where transactions are complex and may be long-lived, and varying communication protocols are defined through collaboration contracts. In the proposal of Li et al., the electronic marketplace supports exchanges of goods in simple transactions, and the same protocol suffices for all actors. A more complex environment also means that our view of misbehaviour must be broader, and as a result Li et al.'s theorem on removing actors' incentive to misbehave [START_REF] Li | Design of a multiagent-based e-marketplace to secure service trading on the Internet[END_REF] does not generalize meaningfully into open service ecosystems.

Third party observation is implemented in Pilarcos through a notary who acts as a passive witness: it signs receipts, but does not act on them. In contrast, Li et al. have an active arbitrator who is also responsible for judging the outcome and punishing misbehaviour, which gives it more power. Despite this difference, the same impacts [START_REF] Li | Design of a multiagent-based e-marketplace to secure service trading on the Internet[END_REF] and basic limitations of third party protocollevel monitoring apply to both solutions: only protocol-level misbehaviour can be detected through protocol-level monitoring, which means that e.g. compensation processes must be made visible on that level to have a reputation impact.

The target of observation in both proposals is the accurate completion of protocols; in Pilarcos they follow contract-defined business processes, while for Li et al. there is a fixed protocol for purchasing arbitrable and replicatable goods [START_REF] Li | Design of a multiagent-based e-marketplace to secure service trading on the Internet[END_REF]. We therefore consider our solution to be a generalization of their work. Li et al. define arbitrability and replicatability, i.e. that the communication protocol can be repeated for the third-party witness, as requirements for arbitration be effective [START_REF] Li | Design of a multiagent-based e-marketplace to secure service trading on the Internet[END_REF]. We expect that reasonable arbitrability can be reached through business process design for open service ecosystems as well; in some situations, additional third party mediators must be involved to control risks in the collaboration. For particularly trusted partners, these controls can be relaxed.

The punishment methods of the systems differ in focus and approach. The reputation-based punishment we propose in this paper is distributed and based on peer control. In addition to reputation-based punishment, Pilarcos contracts contain compensation clauses for misbehaviour, like any business agreements. Li et al. take a centralized point of view both in the arbitrator-based monetary punishment and optionally the broker selecting providers based on their reputation, which is also determined centrally. The approaches seem to be more complementary than contradictory; for example deposits can be applied in highrisk situations to ensure that contractual compensation can be enforced, and reputation-based service selection can be distributed to the actors themselves. We aim for a distributed solution to ensure the viability of the marketplace: as reputation information is worth money, granting a single central actor monopoly over all ecosystem members' reputation is equivalent to creating a new central bank in the ecosystem; this kind of power is disruptive and requires strong control mechanisms to balance for it.

The implementation requirements of the two solutions are different in nature. In the proposal of Li et al., the availability of the trusted arbitrator as well as deposit bank and broker is required, and the service fees must be configured globally to minimize incentives to misbehave while maintaining an incentive to use the system. In addition, all actors are required to make bank-controlled deposits which are held as collateral. The trusted third parties form a single point of failure to the marketplace, which Li et al. aim to distribute more in future work [START_REF] Li | Design of a multiagent-based e-marketplace to secure service trading on the Internet[END_REF].

For Pilarcos, we require the existence of trusted notaries, and push the requirement for designing appropriate arbitrable protocols to specialist business network model designers. In addition, we demand that users of the proposed reputation system, where shared experience information is stored, agree to the reputation network contract. Other costs and impacts of the encompassing Pilarcos system and its trust management system have been discussed in earlier work [START_REF] Ruohomaa | Trust and distrust in adaptive inter-enterprise collaboration management[END_REF]; we draw additional benefits from the infrastructure for the goal at hand. In contrast to the proposal by Li et al., we estimate that centrally collected global service fees for all transactions are unrealistic in the open service ecosystem, which means that they cannot be generally applied to solve the ballot stuffing problem. Instead, we propose the use of local credibility estimation to reduce the gains from such collusion. This credibility analysis can take into consideration the cost of faking the transaction as well, for example if there is an equivalent of service fees designed into the specific business process.

For implementation cost, the increased messaging for applying third party witnesses to problem situations is not a major cost when optimistic fair exchange protocols are used [START_REF] Micali | Simple and fast optimistic protocols for fair electronic exchange[END_REF]. The runtime overhead of either system is dominated by cryptographic signing, and we estimate it is not remarkable, considering that the systems involved are capable of running full-blown business protocols.

In summary, our proposed solution is designed for a complex environment; we find that some of the impact of third party witnesses discussed by Li et al. hold for Pilarcos and give implications for collaboration protocol design, while other assumptions made in their game-theoretic analysis [START_REF] Li | Design of a multiagent-based e-marketplace to secure service trading on the Internet[END_REF] cannot hold due to differences in collaboration types. Some aspects of the bank-based punishment proposed by Li et al. are best compared to contractual compensation in the Pilarcos context, and a system for contractually-agreed, deposit-based punishment could well coexist with reputation-based punishment for misbehaviour. Our proposal is distributed and reduces the amount of trust that must be placed on the third party witness or other involved actors.

Conclusion

We advance a reputation system for inter-enterprise collaborations that is based on objective, verifiable reputation: shared experiences denote whether the collaboration contract was followed or not. To standardize the semantics of experiences in order to make them shareable, we define the reputation effects of different kinds of collaborations in the collaboration contracts. To ensure that false experiences are caught and their submitters punished, an audit trail of the collaboration is produced by signed, nonrepudiable receipts. These receipts can be used to verify whether an experience report is truthful. Objectivity and verifiability go hand in hand: alone, the impact of either remains limited.

The major benefit from this combined approach is the implementation of a two-level sanctioning system, punishing both malicious behaviour and unfair punishments. In the absence of a strong centralized control mechanism, this is necessary to ensure that the service ecosystem does not deteriorate from rampant misbehaviour. In other words, we implement a distributed form of social control in the open service ecosystem.

Trust issues are not entirely solvable by technology alone; in our approach, as well, the final recourse involves lawsuits for contract breaches, and similar infrastructure for ensuring that notaries, i.e. trusted third parties, have an incentive to fulfil their duties. In contrast to the default assumption that trusted third parties are universally trusted, we have strongly limited the amount of trust necessary to place on the proposed notary services.

Objective and verifiable experiences make it possible to punish the spreading of misinformation in the reputation system; due to factors such as collusion to produce positive experiences with little invested effort, they do not remove the need to analyse reputation information locally. Local credibility analysis of all incoming experiences remains a central technical recourse against misinformation: it is not necessary nor prudent to accept all experiences as equal, be they subjective or objective.

Fig. 1 .

 1 Fig. 1. An example collaboration protocol and submission of an experience report.

Fig. 5 .

 5 Fig. 5. The contents of a rebuttal response.

Table 1 .

 1 Comparison of Pilarcos to the proposal of Li et al.


Audun Josang
email: josang@mn.uio.no

Tanja Ažderska

Stephen Marsh
email: steve.marsh@crc.gc.ca

Audun Jøsang

Tanja Azderska

Trust Transitivity and Conditional Belief Reasoning

Keywords: Trust, Transitivity, Deduction, Abduction, Bayesian, Conditional

des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Trust transitivity based on recommendations is a concept that can have different meanings. It can, for example, mean that, if Alice trusts Bob, and Bob trusts Claire, then by transitivity, Alice will also trust Claire. This is expressed in Eq. [START_REF] Ding | Weaving the Web of Belief into the Semantic Web[END_REF].

Indirect( Alice -→ Claire) := Direct( Alice -→ Bob -→ Claire) (1)
Alice is here the originator relying party, Bob is the recommender (i.e., the advisor), and Claire is the trust target that Alice indirectly trusts as a result of this process. This transitive process assumes that Bob recommends Claire to Alice, i.e., there must be some communication from Bob to Alice about Claire's trustworthiness. This kind of reasoning can also be observed among animals. For example, when bees signal to each other where to find pollen, the other bees can derive trust in a specific pollen harvesting area; when animals give warnings about danger, it can be interpreted as a recommendation about distrust, as in the case of a presence of potential predator. Trust is a phenomenon that emerges naturally among living species equipped with advanced cognitive faculties. When assuming that software agents can be equipped with capabilities to reason about trust and risk, and to make decisions based on that, one can talk about artificial trust, as described by rapidly growing growing literature [START_REF] Ding | Weaving the Web of Belief into the Semantic Web[END_REF][START_REF] Fullam | The Agent Reputation and Trust (ART) Testbed Architecture[END_REF][START_REF] Jøsang | A Survey of Trust and Reputation Systems for Online Service Provision[END_REF][START_REF] Marsh | Formalising Trust as a Computational Concept[END_REF].

It is also common, at least among humans, that the relying party receives recommendations about the same target entity from multiple recommenders whose recommendations express different and possibly conflicting trust. The relying party then needs to fuse the different trust recommendations and form a single trust opinion about the target entity. These are principles of analytical reasoning that people handle more or less unconsciously in everyday life. In the computational trust literature many formal models have been proposed for the same purpose, such as in [START_REF] Jøsang | Trust Network Analysis with Subjective Logic[END_REF][START_REF] Jøsang | Exploring Different Types of Trust Propagation[END_REF]. A distinction can be made between interpreting trust as a belief about the reliability of the target, and as a decision to depend on the target [START_REF] Jøsang | Analysing the Relationship Between Risk and Trust[END_REF]. In this paper, trust is interpreted in the former sense, i.e. as a belief about reliability of a target.

A fundamental problem about modelling trust transitivity is that there is no benchmark for comparison and validation in nature, since practical trust transitivity seems to be idiosyncratic for humans and animals, with no true analog among non-living forms (and in the physical world for that matter). The efficacy of long chains of transitive trust in these circumstances is debatable, but nonetheless chains of trust can be observed in human trust. Human subjective trust is in reality a state that results from the cognitive and affective predispositions of an entity to perceive and respond to external stimuli, and to combine them with the internal states and stimuli. However, it is the actual nature of trust that represents the relying party's subjective estimate of the reliability of the target entity for a purpose on which the relying party's welfare depends.

In contrast, when analysing the reliability of physical systems, there are mathematical models that can be easily validated through observation. For example, the correct operation of a serial system depends on the correct operation of each component, which translates into a conjunctive model where the system reliability can be predicted as the product of the reliabilities of each component in the series. The correct operation of a parallel system depends on the correct operation of at least one of its components, which translates into a disjunctive model where the system reliability can be predicted as the copoduct of the reliabilities of each component.

Let p(x i ) express the reliability of component x i , then the respective reliabilities of a serial system Ser and a parallel system Par are expressed as:

Serial system reliability: p(Ser) = p(x i ) , i.e. product of reliabilities Parallel system reliability: p(Par) = p(x i ) , i.e. coproduct of reliabilities [START_REF] Fullam | The Agent Reputation and Trust (ART) Testbed Architecture[END_REF] Addressing and computing trust based on chained recommendations, and on recommendations from multiple parties in parallel can not be modelled in the same manner as in Eq.( 2), although some proposed trust models in the literature do precisely that. The product rule gives a very good estimate of serial system reliability, but is a very poor model for trust transitivity. To illustrate why this is so, assume a transitive trust path of n nodes where each node trusts the next with value p. The product rule dictates a derived trust T = p n which converges relatively quickly towards zero whenever p < 1, meaning that a trust value that is derived from a relatively long transitive trust path will be close to zero. Interpreting zero trust as distrust, as some models do, would clearly be wrong because there is no reason to think that an entity which is known only indirectly through a long transitive path should be distrusted for that reason. Interpreting zero trust as 'no information', as other models do, would be more intuitive in this case. Methods of computing trust transitivity that have been proposed for subjective logic [START_REF] Jøsang | Exploring Different Types of Trust Propagation[END_REF] are analoguous to the latter interpretation, and we show that these methods are special cases of the conditional trust model for analysing trust transitivity proposed in this paper.

The contribution of this paper is to propose a new computational model for trust transitivity based on conditional belief reasoning using the formalism of subjective logic. The idea is to model trust transitivity in similar manner as analysing competing hypotheses. Such models are applied, e.g., in the area of intelligence analysis [START_REF] Pope | Analsysis of Competing Hypotheses using Subjective Logic[END_REF]. Modelling trust transitivity as a simple evidence analysis problem removes the mysticism of trust transitivity, i.e. it does not assume that trust transitivity exists as a separate natural process by itself. Our model assumes that trust transitivity implies weighing the obtained evidence in order to draw conclusions about the trust target. In this way, the principle of trust propagation becomes general and flexible, and thus applicable to the online communities of people, organisations and software agents. The higher purpose, however, is providing decision support based on collaborative interpretation of evidence by the community members. Consequently, this leads to enhancing the ability of online communities to support the emergent properties that result from transitive trust-relations among their members.

Subjective Logic Basics

General Opinions

A subjective opinion expresses belief about one or multiple propositions from a state space of mutually exclusive states called a "frame of discernment" or "frame" for short. Let X be a frame of cardinality k. Belief mass is distributed over the reduced powerset of the frame denoted as R(X). More precisely, the reduced powerset is defined as:

R(X) = 2 X \ {X, ∅} = {x i | i = 1 . . . k, x i ⊂ X} , (3)
which means that all proper subsets of X are elements of R(X), but X itself is not in R(X). The emptyset ∅ is also not considered to be a proper element of R(X).

An opinion is a composite function that consists of a belief vector ⃗ b, an uncertainty parameter u and base rate vector ⃗ a. An opinion can also have as attributes the belief source/owner. Assigning belief mass to an element in the frame (i.e. to a singleton or a subset) is interpreted as positive belief that the proposition(s) represented by that element is/are true, and as negative belief in their complements. The belief vector can be additive (i.e. sum = 1) or sub-additive (i.e. sum < 1).

Uncertainty is expressed by not assigning the totality of belief mass, where the level of uncertainty is equal to the amount of unassigned belief. Uncertainty is here interpreted as the perceived imprecision of probability estimates. In case of total uncertainty, i.e. when u = 1, then the probability estimates of elements in the frame are equal to their base rate probabilities. The sub-additivity of the belief vector and the complement property of the uncertainty are expressed by Eq.( 4) and Eq.( 5) below:

Belief sub-additivity:

xi∈R(X) ⃗ b X (x i ) ≤ 1 , ⃗ b X (x i ) ∈ [0, 1] (4)
Belief and uncertainty additivity:

u X + xi∈R(X) ⃗ b X (x i ) = 1 , ⃗ b X (x i ), u X ∈ [0, 1] . (5)
An element x i ∈ R(X) is a focal element when its belief mass is non-zero, i.e. when ⃗ b X (x i ) > 0. The frame X can not be a focal element, even when u X > 0. The base rate vector, denoted as ⃗ a(x i ), expresses the base rates of elements x i ∈ X, and is formally defined below.

Definition 1 (Base Rate Function). Let X be a frame of cardinality k, and let ⃗ a X be the function from X to [0, 1] k satisfying:

⃗ a X (∅) = 0, ⃗ a X (x i ) ∈ [0, 1] and k i=1 ⃗ a X (x i ) = 1 . (6)
Then ⃗ a X is a base rate distribution over X.

An opinion is normally denoted as ω A X = ( ⃗ b, u, ⃗ a) where A is the opinion owner, and X is the target frame to which the opinion applies [START_REF] Jøsang | A Logic for Uncertain Probabilities[END_REF].

Definition 2. General Opinion

Assume X to be a frame where R(X) denotes its reduced powerset. Let ⃗ b X be a belief vector over the elements of R(X), let u X be the complementary uncertainty mass, and let ⃗ a be a base rate vector over the frame X, all seen from the viewpoint of the opinion owner A. The composite function ω A X = ( ⃗ b X , u X ,⃗ a X ) is then A's opinion over X.

The belief vector ⃗ b X has (2 k -2) parameters, whereas the base rate vector ⃗ a X only has k parameters. The uncertainty parameter u X is a simple scalar. A general opinion thus contains (2 k + k -1) parameters. However, given Eq.( 5) and Eq.( 6), general opinions only have (2 k + k -3) degrees of freedom. The probability projection of hyper opinions is the vector ⃗ E X from R(X) to [0, 1] κ expressed as:

⃗ E X (x i ) = xj ∈R(X) ⃗ a X (x i /x j ) ⃗ b X (x j ) + ⃗ a X (x i ) u X , ∀ x i ∈ R(X) . (7)
Table 1 lists the different classes of opinions [START_REF] Jøsang | Multi-Agent Preference Combination using Subjective Logic[END_REF], of which hyper opinions represent the general case. Equivalent probabilistic representations of opinions, e.g. as Beta pdf (probability density function) or a Dirichlet pdf, offer an alternative interpretation of subjective opinions in terms of traditional statistics. Specific opinion types can be visualised as a point inside a barycentric coordinate systems in the form of a regular simplex. In particular, Fig. 1.a visualises a binomial opinion as a point inside an equal sided triangle, and Fig. 1.b visualises a trinomial opinion as a point inside a tetrahedron. Hyper opinions or multinomial opinions larger than trinomial can not be visualised in the same way, and are in general challenging to visualise. In the triangle on the left hand side, the belief, disbelief and uncertainty axes run from one edge to the opposite vertex indicated by b x , d x and u x . The base rate a x of a binomial opinion are shown on the base line, and the probability expectation value E x is determined by projecting the opinion point to the base line parallel to the base rate director. In the tetrahedron on the right hand side the belief, and uncertainty-axes run from one triangular plane to the opposite vertex indicated by the labels b xi and by u X . A vacuous opinion is when the opinion point is at the top of the simplex (u = 1), and a dogmatic opinion is when the opinion point is on the base line or plane (u = 1). The base rate vector ⃗ a X of the trinomial opinion is shown as a point on the base plane, and the probability expectation vector ⃗ E X is determined by projecting the opinion point onto the triangular base, parallel to the base rate director.

Binomial opinion Multinomial opinion General (Hyper) opinion Binary frame n-ary frame n-ary frame

Focal element x ∈ X Focal elements x ∈ X Focal elements x ∈ R(X) Uncertain (u > 0) UB
A special notation is used for representing binomial opinions over binary frames. A general n-ary frame X can be considered binary when seen as a binary partitioning consisting of one of its proper subsets x and the complement x. Definition 3 (Binomial Opinion). Let X = {x, x} be either a binary frame or a binary partitioning of an n-ary frame. A binomial opinion about the truth of state x is the ordered quadruple ω x = (b, d, u, a) where: b, belief: belief mass in support of x being true, d, disbelief: belief mass in support of x (i.e. NOT x), u, uncertainty: uncommitted belief, uncertainty of probability expectation of x, a, base rate: prior probability of x.

We require b + d + u = 1 and b, d, u, a ∈ [0, 1] as a special case of Eq.( 5). The probability expectation value is computed with Eq.( 8) as a special case of Eq.( 7).

E x = b + au . (8)
In case the point of a binomial opinion is located at the left or right base vertex in the triangle, i.e. with d = 1 or b = 1 and u = 0, the opinion is equivalent to boolean TRUE or FALSE, in which case subjective logic becomes equivalent with binary logic.

Previous Transitivity Operators of Subjective Logic

Several different trust transitivity operators for subjective logic have been proposed in the literature [START_REF] Jøsang | Exploring Different Types of Trust Propagation[END_REF]. These are briefly described below.

Let A and B be two agents where A's trust in B's recommendations is expressed as

ω A B = {b A B , d A B , u A B , a A B },
A:B C = b A B b B C b A:B C = E(ω A B )b B C b A:B C = b A B b B C + d A B d B C d A:B C = b A B d B C d A:B C = E(ω A B )d B C d A:B C = b A B d B C + d A B b B C u A:B C = d A B + u A B + b A B u B C u A:B C = 1 -E(ω A B )(b B C + d B C ) u A:B C = u A B + (b A B + d A B )u B C a A:B C = a B C a A:B C = a B C a A:B C = a B C E(ω A B ) = b A B + a A B u A B Table 2.
Trust transitivity operators of subjective logic proposed in the literature [START_REF] Jøsang | Exploring Different Types of Trust Propagation[END_REF] Uncertainty favouring transitivity means that A is uncertain about the trustworthiness of C not only to the extend that A is uncertain about the recommending agent B, but also to the extent that A distrusts B. Base rate sensitive transitivity means that that A's trust in C is a function of the expectation value of A's trust in the recommender B, which in turn is a function of the base rate. Opposite belief favouring transitivity means that "the enemy of my enemy is my friend", i.e. that when A distrusts the recommending agent B, then A thinks that B consistently recommends the opposite of his real opinion, so that when C actually is trustworthy then B recommends distrust and vice versa.

While these three interpretations of trust transitivity provide relatively intuitive results in specific situations, none of them are suitable as a model for trust transitivity in general. The next section describes a general approach to modelling trust transitivity, where the three interpretations of Table 2 are special cases.

Conditional Belief Reasoning

Conditional reasoning with subjective logic is defined for binomial [START_REF] Jøsang | Conditional deduction under uncertainty[END_REF] and multinomial [START_REF] Jøsang | Conditional Reasoning with Subjective Logic[END_REF] opinions, and can also be extended to general opinions. For binomial deduction and abduction the following notation is used: ω y|x : conditional opinion on y given that x is TRUE ω y|x : conditional opinion on y given that x is FALSE ω x : opinion on the antecedent state x ω y∥x : deduced opinion on the consequent state y ω y∥x : hypothetically deduced opinion on y given vacuous ω x

The image space of the deduced opinion ω y∥x is a sub-triangle with base vertices defined by the two conditionals ω y|x and ω y|x , and the top vertex defined by the consequent opinion ω y∥x of the vacuous antecedent ω x. This mapping determines the position of the consequent opinion ω y∥x within the child sub-triangle, as illustrated in Fig. 2.

Uncertainty Uncertainty

Disbelief Belief

Opinion on parent frame X

Disbelief Belief

Opinions on child frame Y It can be noticed that when ω y|x = ω y|x , the child sub-triangle is reduced to a point, so that necessarily ω y∥x = ω y|x = ω y|x = ω y∥x in this case. This means that there is no relevance relationship between antecedent and consequent.

In general, the child sub-triangle is not regular (equal-sided) as in the example of Fig. 2. By setting base rates of x and y different from 0.5, and by defining conditionals with different uncertainty, the child image sub-triangle will be skewed (irregular), and it is even possible that the uncertainty of ω y∥x is less that that of ω x|y or ω x|y .

For multinomial opinions, let X = {x i |i = 1 . . . k} be the parent frame and Y = {y j |j = 1 . . . l} be the child frame. The general notation for conditionals is: ω Y |X : set of conditional opinions on Y given that a specific state in X is TRUE ω Y |X : set of conditional opinions on Y given that a specific state in X is FALSE ω X : opinion on the antecedent (parent) frame X ω Y ∥X : deduced opinion on the consequent (child) frame Y ω Y ∥ X : hypothetically deduced opinion on Y given vacuous ω X Assume the antecedent opinion ω X where |X| = k, and k conditional opinions ω Y |xi . There is thus one conditional opinion for each element x i , where a conditional opinion ω Y |xi expresses the subjective opinion on Y , given that x i is TRUE. The subscript notation indicates not only the child frame Y it applies to, but also the element x i in the parent frame it is conditioned on. The notation ω Y |X expresses the set of k = |X| different opinions conditioned on each x i ∈ X respectively.

Generalisation from the binomial case of Fig. 2 to the multinomial case results in a parent regular simplex which is mapped to a sub-simplex inside the child simplex, defined by the set of conditional ω Y ∥X . The ternary case is illustrated in Fig. 3. The sub-simplex formed by the conditional projection of the parent simplex into the child simplex is shown as the shaded tetrahedron on the right hand side in Fig. 3. The position of the derived opinion ω Y ∥X is geometrically determined by the point inside the sub-simplex that linearly corresponds to the opinion ω X in the parent simplex.

b y 1 y 2 u Y b x 1 b x 2 b y 3 u X 1 |x Y 2 |x Y 3 |x Y X Y || X Y|| X Opinion on parent frame X Opinions on child frame Y X b x 3
In general, a sub-simplex will not be regular as in the example of Fig. 3, and can be skewed in all possible ways. The dimensionality of the sub-simplex is equal to the smallest cardinality of X and Y . Visualising a simplex larger than ternary (tetrahedron) is difficult. Subjective logic conditional deduction is expressed as in Eq. [START_REF] Jøsang | Exploring Different Types of Trust Propagation[END_REF].

ω Y ∥X = ω X ω Y |X (9)
where is the general conditional deduction operator for subjective opinions. Reasoning in the opposite direction is called derivative reasoning, or abduction. Let ω X|Y = {ω X|yj |j = 1 . . . l} be a set of l = |Y | different multinomial opinions conditioned on each y j ∈ Y respectively. Conditional abduction is expressed as:

ω Y ∥X = ω X ω X|Y ( 10
)
where is the general conditional abduction operator. Detailed expressions for evaluating Eq.( 9) and Eq.( 10) are provided in [START_REF] Jøsang | Conditional Reasoning with Subjective Logic[END_REF][START_REF] Jøsang | Conditional deduction under uncertainty[END_REF][START_REF] Pope | Analsysis of Competing Hypotheses using Subjective Logic[END_REF].

Conditional Reasoning about Trust Transitivity

The basic idea of conditional trust transitivity is to express trust in the target entity in terms of conditional opinions. Assume the recommendation frame X = {x, x} interpreted as x: "Positive" and x: "Negative". Trust in the recommender can then be expressed as the conditional propositions y|x: "Target is trusted in case of positive recommendation" and y|x: "Target is trusted in case of negative recommendation", where the conditional opinions ω y|x and ω y|x are the actual trust values. Note that ω y|x typically contains disbelief, meaning that the target is distrusted in case of negative recommendation. As an example, trust in the recommender B can be expressed as the conditional opinions ω y|x = (0.9, 0.0, 0.1, a) and ω y|x = (0.0, 0.9, 0.1, a), illustrated in Fig. 4. In case of absolute trust the child sub-triangle is equal to the child triangle itself. The consequence of this is that the recommendation opinion in the parent triangle on the left hand side will be mapped to the same position in the child triangle on the right hand side. In other words, the relying party will believe whatever the recommender says.

Parent frame X

Strong distrust in the recommender can be specified by placing the conditional trust opinions at, or close to, the uncertainty vertex, e.g. as ω y|x = (0.3, 0.0, 0.7, a) and ω y|x = (0.0, 0.3, 0.7, a). The result is a small sub-triangle, or a point in case of total distrust, at the top of the child triangle, as illustrated in Fig. 5.

Parent frame X

Child frame Y The examples of Fig. 4 and Fig. 5 are specific instances of conditional trust transitivity that is equivalent to both the uncertainty favouring and the base rate sensitive transitivity operators of Table 2. Conditional trust transitivity is equivalent to the uncertainty favouring and the baserate sensitive transitivity operators whenever 1) the child subtriangle is equal-sided, 2) the positive conditional ω y|x is the rightmost conditional, and 3) the uncertainty of the sub-triangle is maximised. The latter requirement means that the child sub-triangle must be positioned as high as possible inside the child triangle, as in Fig. 4 and Fig. 5. In case of the uncertainty favouring transitivity operator the base of the sub-triangle equals b A B . In case of the baserate sensitive transitivity operator, the base of the sub-triangle equals E(ω A B ). The opposite belief favouring trust transitivity operator can be modelled by allowing the negative conditional ω y|x to be the rightmost trust opinion, e.g. expressed as ω y|x = (0.2, 0.8, 0.0, a) (positive conditional trust opinion) and ω y|x = (0.8 , 0.2 , 0.0, a) (negative conditional trust opinion). The resulting sub-triangle is then flipped around, as illustrated with the check-pattern of Fig. 6. However, the negative conditional is not necessarily the rightmost trust opinion, it can also be the leftmost trust opinion, as in the case of Fig. 4. However, the situation where "the enemy of my enemy is my friend" and "the friend of my enemy is also my enemy" must be expressed with the negative conditional as the rightmost trust opinion, as in Fig. 6 below.

In case of opposite belief favouring trust transitivity it can be seen that the derived trust opinion inside the child sub-triangle is the opposite of the recommendation in the parent triangle. The opposite belief favouring operator is similar to the uncertainty favouring operator in the sense that it does not consider the base rate of ω A B ; the difference is that the sub-triangle produces minimal uncertainty, i.e. that it is located at the base of the child triangle. The criteria for the equivalence between the transitivity operators of Table .2 and conditional trust transitivity are expressed in Table [START_REF] Jøsang | A Logic for Uncertain Probabilities[END_REF] .

Criteria for equivalence between conditional trust transitivity and ω

A:B C Uncertainty favouring ω A:B C Base rate sensitive ω A:B C Opposite belief favouring ω A:B C b y|x -b y|x = b A B b y|x -b y|x = E(ω A B ) |b y|x -b y|x | = |b A B -d A B | b y|x = d y|x b y|x = d y|x b y|x = b A B d y|x = b y|x d y|x = b y|x b y|x = d A B u y|x = u y|x = 1 -b y|x -d y|x u y|x = u y|x = 1 -b y|x -d y|x u y|x = u y|x = 0 Table 3.
Equivalence criteria between transitivity operators [START_REF] Jøsang | Exploring Different Types of Trust Propagation[END_REF] and conditional trust transitivity

With the conditional transitivity model it is possible to specify any form of trust transitivity. As an example, assume a recommender whom the relying party finds unreliable in the sense that positive recommendations can only be relied upon by 50%, expressed as ω y|x = (0.5, 0.5, 0, a), and where negative recommendations are taken at face value, in order to be on the safe side, as expressed by ω y|x = (0, 1, 0, a). The resulting child sub-triangle is then the triangle illustrated on Fig. 7.

The conditional trust transitivity model of Fig. 7 is different from those specified in Table 2. In fact, conditional belief reasoning allows the specification of arbitrary trust transitivity models to suit any specific situation.

Table 3 demonstrates the formal side of the advantage of generalisation of conditional belief reasoning over the rest of the models in the current literature we stated at the beginning. Moreover, the provided example further clarifies the generalisation over the existing transitivity operators in Subjective Logic, showing the applicability of the approach in the context of trust modelling. It is meaningful, however, to separate between the honesty and the ability to do something in the sense that an honest person will do their best to deliver a service, and the quality of the service then only depends on ability. A dishonest person who is able to deliver a quality service might on purpose deliver a low quality service.

In the previous examples it was implicitly assumed that trust in the recommender reflected the relying party's trust in honesty and ability simultaneously, except perhaps in case of the opposite belief favouring operator. When the relying party is able to assess honesty and ability of the recommender separately, it is possible to build a model which can express explicitly when a recommender does not provide their honest opinion. Trust in the presence of this assumption can be modelled as two separate conditional relationships, first between the recommendation and the recommender's internal trust opinion, and then between the recommender's internal trust opinion and the target trusted entity. The formal expression for trust transitivity from Eq.(1) can then be extended as in Eq. [START_REF] Koehler | The Base Rate Fallacy Reconsidered: Descriptive, Normative and Methodological Challenges[END_REF] Alice → Claire := Alice → Bob's recomm. → Bob's opinion → Claire [START_REF] Koehler | The Base Rate Fallacy Reconsidered: Descriptive, Normative and Methodological Challenges[END_REF] Assume, for example, that the recommender Bob is a financial advisor and that Alice asks him about an investment product called C. Bob's recommendations are represented as a ternary frame X consisting of x 1 : "Says C is good ", x 2 : "Says C is bad" and x 3 : "Says don't know". Let further Bob's genuine opinion be represented as the binary frame Y consisting of y: "Bob judges C to be good" and y: "Bob judges C to be bad". Alice makes the following assumptions about the advisor Bob: If the advice is x 1 (Says C is good) it is probably a product that he gets a commission on, but he does not necessarily judge it to be good, so for Alice it is uncertain what he really thinks is good, formally expressed as ω y|x1 = (0, 0, 1, a). If the advice is x 2 (Says C is bad) the Bob probably judges it to be a bad product, formally expressed as ω y|x2 = (0, 1, 0, a). If the advice is x 3 (Says don't know) then it is possible that he genuinely is uncertain about the quality, but it is also possible that he judges it to be good but because he does not get a commission he does not want to recommend it, but at the same time does not want to be caught lying about a product which objectively is good; hence, he does not want to give a recommendation against it either, leaving him the option of x 3 (Says don't know). It is therefore possible that Bob is either uncertain, or that he judges the product to be good i.c.o. x 3 (Says don't know), formally expressed as ω y|x3 = (0.5, 0.0, 0.5, a).

Assume in addition that Alice does not have full trust in Bob's ability to objectively assess investment products. Let the possible qualities of the investment product C be represented as the binary frame Z = {z, z} expressed as z: "Good product" and z: "Bad product". Then, Alice's doubt in Bob's ability can be expressed as ω z|y = (0.5, 0.0, 0.5, a) and ω z|y = (0.0, 0.5, 0.5, a). The conditional connection between Bob's recommendations and Alice's derived trust in the investment product Claire is visualised in Fig. 8. The visual analysis of Fig. 8 can be done mathematically using the methods for conditional reasoning described in [START_REF] Jøsang | Conditional deduction under uncertainty[END_REF][START_REF] Jøsang | Conditional Reasoning with Subjective Logic[END_REF] 6 Determining Conditionals So far we have not discussed methods for determining the actual trust conditionals, and for this purpose it is important to be aware of the base rate fallacy [START_REF] Koehler | The Base Rate Fallacy Reconsidered: Descriptive, Normative and Methodological Challenges[END_REF]. As implicitly assumed in the analysis of Sec.5, the relying party A could simply express its subjective trust in B as opinions on the following conditional hypotheses:

b x 1 b x 2 u X ) rec ( C B X
These are called derivative conditionals because they are expressed in anti-causal form, meaning that the act of saying that C has good or bad quality does not cause C to have good or bad quality. In reality, the opposite is the case, i.e. the fact that C has good or bad quality causes B to get an opinion on C's quality and to express recommendations about it, which thereby can be expressed as causal conditionals. The important point is whether B's opinion correctly reflects C's quality. The values of ω A C|(B:C) and ω A C|(B:C) thus rely on B's capability to correctly detect C's quality, which must be expressed as opinions on the corresponding causal conditionals:

Trust in B is naturally expressed in terms of the causal conditionals of Eq.( 13), because they express the reliability of B as a sensor for detecting C's quality. B's assessments can of course be wrong sometimes, which represent cases of false positive or false negative. When interpreting "C has quality" as the positive case, then Eq.( 13) express the TPR (True Positive Rate) and FPR (False Positive Rate). However, the opposite conditionals are needed (i.e. those of Eq.( 12)) for assessing C's quality.

The conditionals of Eq.( 12) are influenced by the base rate of quality in the population of C. A problem can arise when the derivative conditionals, such as Eq.( 12), have been determined in a population with a specific base rate, using the same conditionals in a population with a different base rate, producing untruthful conclusions. As an example, consider a medical test for a specific disease, where the test gives mostly true positive and true negative results in a population where the disease is common. When the same test gives a positive result for a person in a population where the disease is extremely rare, then it is most likely a false positive result. Ignoring this fact is called the base rate fallacy in medicine. In the context of trust systems, a well-known problem is the one of exaggerated positive evaluations in systems like Amazon and eBay [START_REF] Resnick | The Value of Reputation on eBay: A Controlled Experiment[END_REF][START_REF] Mackiewicz | Reviewer Motivations, Bias, and Credibility in Online Reviews[END_REF], also known as positive bias. Failing to foresee the potential of base rate fallacy may lead to the conclusion that the system performs well just because of the low amount of false positives.

The base rate fallacy can be avoided by first determining the causal conditionals of Eq.( 13), e.g. on a statistical or subjective basis, and subsequently inverting them into the form of Eq.( 12) which takes into account the base rate of quality in target C's population. This is called derivative reasoning because of its nature, and can be done with the abduction operator of subjective logic, expressed in Eq. [START_REF] Jøsang | Multi-Agent Preference Combination using Subjective Logic[END_REF].

Discussion and Conclusion

Most of the current approaches that represent opinions of trust/distrust as a binary value of 1/0, without assigning any other attributes, dismiss all the shades of belief that exist between trust and distrust and capture only the two extremes of the state of trust met in the human perception and reasoning. Other approaches do account for the possibility to represent trust in a multi-valued manner, but assign maximum certainty to each of the values. Conditional belief reasoning, on the other hand, offers a framework for exploiting all the shades of trust-opinions that can be subject to the human perception and reasoning. By joining belief mass, uncertainty, and base rates into a single trust opinion, the model completely satisfies both the statistical and the subjective properties of trust inference and propagation that exist in the real world. It is reasonable to assume that, since trust in artificial systems is to an extent different, although derived from and modelled on, human subjective trust, the rules of transitivity can be more properly defined. Thus, when analysing trust transitivity through conditional belief reasoning, not only the frequentist nature of probability is captured (i.e., the count of positive and negative outcomes), but the ascribed subjectivity of trust also accounts for the impact of an entity's opinion on the outcome of a transaction.

The practical implications of employing conditional belief reasoning to address trust transitivity are much deeper than just providing the formal apparatus to reason about trust relationships in an intuitive way. One advantage of this approach is that the model easily accounts for situations where trust is not transitive, as well as situations where trust us transitive. Another advantage is that it successfully disentangles the notions of trust and reputation, in addition to acknowledging them as community values:

it recognizes the influence of the subjective opinions of a single entity on the trust relationships established among community members -in this case, of a single recommender -on the perception of the relying entity about the target entity; it also implements the idea that the reputation, as a more general opinion about an entity's trustworthiness, results from the established trust relationships among all the community members. the introduction of conditionals in addition to the existing transitivity operators allows to capture the intuitive causality between trust and reputation that exists in the human reasoning, but is not always followed by rational decisions: e.g. "You are said to reputable, therefore i trust you", but also "You are said to be reputable, therefore i do not trust you";

Due to the formal framework for aggregating conflicting and non-independent opinions offered by subjective logic, a third advantage of the model is its power to reduce the complexity that arises from conflict resolution of differing (competing ) trust-opinions. Moreover, by employing conditionals to infer an entity's trustworthiness based on presented evidence, the model accounts for the expectations of the relying party in the light of available evidence.

Although tacitly implied, it is worth pointing out the advantage of interoperability of conditional belief reasoning with subjective logic with the rest of the formal apparatus of statistics and probability theory used for modelling situations based on observed and statistical evidence. This makes conditional belief reasoning easily employable for the purpose of replacing, enhancing and adding functionality, or correcting some of the inefficiencies in the current models.

The main disadvantage of the model in its current state is that, although it accounts for the subjectivity of perceptions, the reasoning/inference phase still assigns a great deal of rationality on the side of the decision-maker. Despite of the fact that uncertainty is taken into consideration, its value results from a sound calculative model, rather than being an ad-hoc representation of the unpredictable nature of the transaction outcome. Further work will examine the potential for incorporating different aspects of this unpredictability, including via context, into the reasoning process, where changes in context (including, for instance, location or mobility) may change the subjective opinions of recommenders. This is interesting because, all other things being equal, changes in context may affect the final values even for the same recommenders.

⋆

  6th IFIPTM International Conference on Trust Management (IFIPTM 2012), Surat, May 2012.

Fig. 1 .

 1 Fig. 1. Visualisation of opinions in barycentric coordinate systems

  and let C be an agent where B's trust in C is recommended to A with the opinion ω B C = {b B C , d B C , u B C , a B C }. Let ω A:B C = {b A:B C , d A:B C , u A:B C , a A:B C } be A's derived trust in C as a result of the recommendation from B. Table 2 shows the derived opinion ω A:B C in case of uncertainty favouring transitivity, base rate sensitive transitivity, and opposite belief favouring transitivity. Uncertainty favouring ω A:B C Base rate sensitive ω A:B C Opposite belief favouring ω A:B C b

Fig. 2 .

 2 Fig. 2. Mapping from parent triangle to child subtriangle

Fig. 3 .

 3 Fig. 3. Projection from parent opinion tetrahedron to child opinion sub-tetrahedron.

Fig. 4 .

 4 Fig. 4. Trusted recommender, derived transitive trust equals recommended trust.

Fig. 5 .

 5 Fig. 5. Distrusted recommender, derived transitive conditional trust equals uncertainty.

Fig. 6 .

 6 Fig.6. Distrusted recommender, with the assumption that "the friend of my enemy is my enemy".

Fig. 7 .

 7 Fig. 7. Unreliable recommender, where positive recommendations are half trusted, and negative recommendations are fully trusted.

Fig. 8 .

 8 Fig. 8. Bayesian network for analysing recommendations from financial advisor.

  :C) : "In case B says C has good quality, then C has good quality" ω A C|(B:C) : "In case B says C has bad quality, then C has good quality"

  C)|C : "In case C has good quality, then B will say C has good quality" ω A (B:C)|C : "In case C has bad quality, then B will say C has good quality"

Table 1 .

 1 Opinion classes with equivalent probabilistic representations

		opinion	UM opinion	UH opinion
	Probabilistic repr.: Dogmatic (u = 0)	Beta pdf on x DB opinion	Dirichlet pdf over X DM opinion	Dirichlet pdf over R(X) DH opinion
	Probabilistic repr.:	Probability of x	Proba. distr. over X	Proba. distr. over R(X)