Paper deep dive
When Is Delegated Play Truthful? Within-Range Regret and the Trilemma of Aligned Delegation
Taksch Dube
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 93%
Last extracted: 7/17/2026, 2:06:25 AM
Summary
The paper investigates the conditions under which principals should truthfully report their preferences to automated proxies (e.g., autobidders, LLM agents). It introduces 'within-range regret' as the key metric determining the incentive to misreport. The authors prove that truthful reporting is optimal if and only if the proxy is loyal (i.e., within-range regret is zero). They further establish a trilemma showing that guardrails on proxies cannot simultaneously be binding, truthful, and capability-preserving. The paper demonstrates that computing within-range regret is #P-hard but estimable from samples, and empirical tests on production LLMs reveal that honest reporting often leaves surplus unclaimed, incentivizing report inflation or jailbreaking.
Entities (6)
Relation Signals (5)
Theorem 4.1 → establishes → Truth-to-proxy Identity
confidence 97% · One identity answers it (Theorem 4.1): the most a principal gains by misreporting to its proxy equals the proxy's within-range regret.
Within-range regret → governs → Manipulation Gain
confidence 95% · The most a principal can gain by misreporting equals the regret of the proxy's honest-report action against those the principal could have steered it to take.
Proxy Loyalty → determines → Optimality of Truthful Reporting
confidence 94% · Honest self-description is optimal exactly when the proxy already plays the best action it can reach, that is, when it is loyal.
Guardrail → cannotbesimultaneously → Binding, Truthful, Capability-Preserving
confidence 93% · No guardrail can be at once binding, truthful, and capability-preserving; any two preclude the third.
Within-range regret → is → #P-hard
confidence 91% · Because within-range regret is #P-hard to compute exactly, we estimate it from samples and maintain it as a model is updated.
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Advertisers delegate bidding to autobidders; users delegate tasks to language-model agents. A person describes what they want to an automated proxy that acts in a mechanism on their behalf. This is the revelation principle in production, and it forces a question classical theory assumes away: when is it optimal to describe yourself honestly to your own proxy? We show the answer turns on one quantity, the proxy's within-range regret. The most a principal can gain by misreporting equals the regret of the proxy's honest-report action against those the principal could have steered it to take. Honest self-description is optimal exactly when the proxy already plays the best action it can reach, that is, when it is loyal (Theorem 1). The identity unifies auction-specific autobidding results and pins down when the faithful-communication assumption behind language-model elicitation proxies (Huang et al.) holds. The identity constrains guardrails placed on proxies, from bid caps to a model's alignment layer. No guardrail can be at once binding (it displaces the truthful action from the proxy's best reachable outcome), truthful (honest reporting stays optimal), and capability-preserving (that outcome stays reachable through some report); any two preclude the third (Theorem 2). A safety constraint that alters what a model does while leaving its best output reachable makes honest description of intent suboptimal, so a sharper report can gain. This is the incentive behind prompt-engineering and jailbreaking. Because within-range regret is #P-hard to compute exactly, we estimate it from samples and maintain it as a model is updated, at a cost set by how far the model drifts, not how often it changes. Running it on production language models from five providers under an alignment-style cap, we find honest reporting leaves surplus unclaimed on every model, recovered by inflating the report.
Tags
Links
- Source: https://arxiv.org/abs/2607.14357v1
- Canonical: https://arxiv.org/abs/2607.14357v1
Trouble viewing inline? Open PDF directly →
Full Text
94,759 characters extracted from source content.
Expand or collapse full text
11institutetext: Kent State University, Kent, OH, USA When Is Delegated Play Truthful? Within-Range Regret and the Trilemma of Aligned Delegation Taksch Dube Abstract Advertisers delegate bidding to autobidders; users delegate tasks to language-model agents. In each case a person describes what they want to an automated proxy. The proxy then acts in a mechanism on their behalf. This is the revelation principle run in production, and it forces a question the classical theory assumes away: when is it optimal to describe yourself honestly to your own proxy? We show the answer turns on a single quantity, the proxy’s within-range regret. The most a principal can gain by misreporting equals the regret of the proxy’s honest-report action, measured against the actions the principal could have steered it to take. Honest self-description is optimal exactly when the proxy already plays the best action it can reach, that is, when it is loyal to the principal (Theorem 4.1). The identity unifies a line of auction-specific results on autobidding incentives, and it identifies when the faithful-communication assumption behind language-model elicitation proxies (Huang et al.) is optimal for the user: exactly when the proxy is loyal. The identity has a sharp consequence for the guardrails placed on proxies, from bid caps to the alignment layer of a language model. No guardrail can be at once binding (it displaces the truthful action from the proxy’s best reachable outcome), truthful (honest reporting stays optimal), and capability-preserving (that best outcome stays reachable through some report); any two preclude the third (Theorem 5.1). A safety constraint that alters what a model does while leaving its best output reachable makes honest description of intent suboptimal, so a better-aimed report can gain. This is the incentive behind prompt-engineering and jailbreaking, though whether the exploiting report is easy to find is a separate question. Because within-range regret is #P-hard to compute exactly, we estimate it from samples and maintain it as a model is updated, at a cost set by how far the model drifts rather than how often it changes. Running that estimate on production language models from five providers under an alignment-style cap we impose, we find honest reporting leaves surplus unclaimed on every model, recovered by inflating the report. 1 Introduction The revelation principle is the workhorse of mechanism design: whatever a strategic mechanism achieves in equilibrium, a direct mechanism achieves by asking each participant to report its private type, under the promise that honest reporting is optimal [37, 51, 20, 52]. The promise is constructive: given a mechanism and an equilibrium, one collects types, computes each agent’s equilibrium message, and applies the original rule. But the construction quietly consumes four things a designer rarely has: the equilibrium itself, PPAD-complete to compute [21, 15, 57]; knowledge of the prior and payoffs it depends on; a trusted party to run the composition; and a channel that carries a full type [54]. For four decades the principle has been a reduction without an implementation. Delegation now supplies all four, in production. An autobidder or a language-model agent is the executor that learns the equilibrium the designer cannot compute [1, 26]; it carries the prior no one wrote down, fit to its environment from data; the platform that runs the mechanism is the trusted party; and the principal’s report is the channel, a few honest sentences in place of a full contingent plan. We call the resulting object the delegation stack: a principal describes its type to a proxy πi:Θi→Mi _i _i→ M_i that maps the report to a message, and principals face the wrapped direct mechanism g∘πg π. Delegation also adds one ingredient the classical construction never had: a proxy whose objective may not be the principal’s. The premise that honest reporting is optimal is therefore no longer automatic, and becomes a question about a deployed system: when is it optimal to describe yourself honestly to your own proxy? Huang et al. [42], building language-model elicitation proxies, adopt the truthful-reporting setting as their starting point and do not model the principal’s incentive to misreport to its proxy. We analyze it. One identity answers it (Theorem 4.1): the most a principal gains by misreporting to its proxy equals the proxy’s regret over the actions it can reach, its within-range regret, which vanishes exactly when the proxy is loyal over that range and grows with its misalignment. This keeps two honesties distinct and binds them. The principal’s truthful reporting to its proxy, the question we ask, is optimal exactly when the proxy is loyal over the range it can reach, that is, when it serves the principal rather than the platform. The identity’s consequence is a limit on the guardrails placed on proxies, from bid caps to a language model’s alignment layer (Theorem 5.1; Fig. 1). And because within-range regret is #P-hard to compute exactly but estimable from samples, incentive compatibility becomes a property a platform measures rather than proves once.111Code and data reproducing every figure are provided as a reproducibility archive (Section 7). For a language model, a binding safety layer that leaves the best output reachable rewards prompt-engineering. Contributions. One quantity runs through the paper; each result sharpens the last or puts it to work. (i) A principal’s gain from misreporting to its proxy equals the proxy’s within-range regret WiW_i (Theorem 4.1), so honest reporting is optimal exactly when the proxy is loyal over the range it can reach. This unifies the first- and second-price autobidding incentive-compatibility results as one sign change in WiW_i (Example 1). (i) Since WiW_i alone governs misreporting, every guardrail faces a trilemma (Theorem 5.1): none is binding, truthful, and capability-preserving at once. Its placement decides whether truthfulness is guaranteed and its allowed set whether capability survives (Proposition 3), and a conservation law bounds the loss (Proposition 2). (i) Computing WiW_i exactly is #P-hard (Proposition 6), but the identity turns certifying a wrapped mechanism into estimating WiW_i from samples of the proxy, an estimate that stays valid as the proxy drifts (Proposition 7). (iv) We run that sampling estimator on production language models from five providers: under an alignment-style cap we impose, sampling each proxy’s play recovers Wi>0W_i>0 with report inflation above one on every model, so the certification of (i) runs on deployed models and reproduces the incentive (i)–(i) predict. gθ1 _1π1 _1θ2 _2π2 _2θ3 _3π3 _3outcomeprincipalsproxiesmechanism (a) the delegation stack capability-preservingbindingtruthful1231output-clipping2non-binding3capability-losingnone (b) a guardrail is at most two of three Figure 1: (a) The delegation stack: each principal reports its type to a proxy, which messages the mechanism g, so principals face the wrapped mechanism g∘πg π. (b) A guardrail composed onto a proxy cannot be binding, truthful, and capability-preserving at once (Theorem 5.1); which pair a design keeps depends on its placement and its allowed set D (Proposition 3). Constraint-aware decoding stays truthful; an output-clip that leaves the optimum reachable (a⋆∈Da ∈ D) keeps capability but not truthfulness (the jailbreak corner, Wi>0W_i>0); a constraint that removes it (a⋆∉Da ∉ D) can keep truthfulness, as the hard cap does, but not capability; a non-binding guardrail leaves the honest action already optimal. Section 2 places the results in the autobidding, delegation, and incentive-estimation literatures; the rest sets up the delegation stack and within-range regret (Section 3), bounds and then exactly characterizes the gain from misreporting (Section 4), turns that into the trilemma (Section 5), makes incentive compatibility a measured, maintainable quantity (Section 6), measures within-range regret on production language models (Section 7), and discusses scope and open problems (Section 8). One assumption holds throughout: the platform commits to running the published g∘πg π, the standard commitment of mechanism design. We ask nothing else of a proxy beyond being a fixed map; where we need it to play well for its principal, we say so. We do not assume the proxy is loyal. A platform-operated proxy may answer to the platform, so our results describe the principal’s incentive against whatever proxy it faces; certifying loyalty remains open. The formal results are theorems about a Bayesian game with proxies; reading a guardrail as an alignment layer is an interpretation, one we support by measuring within-range regret on deployed models. 2 Related Work Delegation, learning agents, and autobidding. The revelation principle and its failure regimes are well charted, including limited commitment, reporting costs, and sequential rationality [10, 28, 43, 17, 59]; we work where it is valid and supply its inputs by delegation, a device with a long pedigree: strategic commitment [33], communication-equilibrium mediators [35, 53], program equilibrium [60], and proxy bidding [8, 7]. Closest are Kolumbus and Nisan’s user-of-learning-agents models [47, 46]: a principal delegating to a no-regret agent can gain by misreporting to it, and their first-versus-second-price reversal is, by Theorem 4.1, the within-range-regret identity made auction-specific; we give the closed-form gain at a fixed proxy. The designer-side mirror, a mechanism facing a no-regret agent rather than a principal steering its own, is charted separately [11, 27, 12]; our object is the principal’s incentive to its proxy, not the designer’s leverage over it. What is new is not a theorem about manipulation gain but the separation the identity makes visible, between how well a proxy plays the world (RiR_i) and how well its input parameterization is aimed (WiW_i), together with the trilemma and certification that separation supports; the identity itself generalizes and renames their reversal, and we claim no more for it. The autobidding literature is the deployed special case [1, 26, 25, 24, 49]: whether an advertiser gains by misreporting its constraints to its own autobidder is autobidding incentive compatibility, which fails for both first- and second-price rules [3] and makes single-round incentive compatibility the wrong concept once advertisers only set proxy objectives [48]; such a failure is exactly Wi>0W_i>0 in one format, which Theorem 4.1 locates. Language-model agents and certification from data. Machine agents increasingly transact in markets, as Parkes and Wellman [55] anticipated: language models act as auction participants [58], bidders in token auctions [31], agents in matching markets [41], and elicitation proxies that take communication to be faithful by construction [42], which their model does not analyze. On certification, deciding equilibrium is intractable [21, 15, 57], so within-range regret is estimated: approximate incentive compatibility is learnable from samples [9] and has been verified for auction networks and estimated from production logs [19, 23, 56]. We certify the within-range quantity specifically, maintain it under drift, and calibrate against the known underestimation of deep-learning regret estimators [62]. Impossibility trilemmas and constrained agents. Our trilemma joins a family of mechanism-design impossibilities in which three pairwise-attainable properties cannot hold together. The nearest is the credible-auction trilemma of Akbarpour and Li [2], where no optimal auction is at once credible, strategy-proof, and static; theirs is about an operator who might deviate undetectably, ours about what a range restriction does to a delegated proxy’s reachable optimum. The two-way form of our binding-versus-capability tension is already visible elsewhere: a binding safety constraint forfeits capability in fine-tuning [14], strategy-proofness costs a bounded multiple of policy value in RLHF [45], and robustness to gaming costs accuracy in strategic classification [39]; the trilemma adds the truthfulness axis they omit. 3 Preliminaries Environment. There are n agents. Agent i has a type θi∈Θi _i∈ _i, the private information only it knows, such as its value for an item or what it actually wants. The type profile is drawn from a common prior F on Θ=∏iΘi = _i _i. An outcome x∈Xx∈ X gives agent i utility ui(x,θi)∈[0,H]u_i(x, _i)∈[0,H] (private values). Type and message sets are finite for exposition; the arguments extend to continuum types and actions wherever the maxima invoked are attained. Mechanisms and regret. A mechanism is Γ=(M,g) =(M,g) with message sets MiM_i, the actions an agent can put into the mechanism such as a bid, and an outcome rule g:M→Xg:M→ X that maps the messages to an outcome. A strategy is si:Θi→Mis_i: _i→ M_i, a rule for turning a type into a message. Interim utility under profile s is Ui(s∣θi)=θ−i∼F(⋅∣θi)[ui(g(si(θi),s−i(θ−i)),θi)],U_i(s _i)\;=\;E_ _-i F(· _i)\! [u_i (g(s_i( _i),s_-i( _-i)), _i ) ], and Ui(m,s−i∣θi)U_i(m,s_-i _i) denotes the same expectation with the fixed message m in place of si(θi)s_i( _i). The interim regret of s for agent i is Ri(s)=maxθi∈Θi[maxm∈MiUi(m,s−i∣θi)−Ui(s∣θi)].R_i(s)\;=\; _ _i∈ _i [ _m∈ M_iU_i(m,s_-i _i)\;-\;U_i(s _i) ]. The profile s is an interim ε -Bayes-Nash equilibrium (ε -BNE) if maxiRi(s)≤ε _iR_i(s)≤ . A mechanism with Mi=ΘiM_i= _i is direct; it is interim ε -incentive compatible (ε -IC) if the truthful profile is an interim ε -BNE of it [22, 52], the additive-ε form being the standard approximate relaxation. The delegation stack. A proxy for agent i is a map πi:Θi→Mi _i: _i→ M_i from input reports to messages, and π=(π1,…,πn)π=( _1,…, _n) is the proxy profile. The wrapped mechanism is the direct mechanism Γπ=(Θ,g∘π),(g∘π)(t)=g(π1(t1),…,πn(tn)). ^π\;=\; ( ,\;g π ), (g π)(t)=g ( _1(t_1),…, _n(t_n) ). The Bayesian game induced by Γπ ^π among the principals is the input game: each principal knows θi _i and chooses a report tit_i. The reachable set of proxy i is Reachi=πi(Θi)⊆MiReach_i= _i( _i) M_i. The report language is the type space itself, so ReachiReach_i is exactly the set of messages a type-report can steer. A richer or coarser language would change ReachiReach_i, and with it the within-range regret of Section 4. Proxies are deterministic maps; randomized proxies replace messages with distributions and every statement holds in expectation. How π is produced is irrelevant to Section 4 and becomes the subject of Section 6. Commitment. As stated in the introduction, the platform commits to running the published g∘πg π and each proxy is a fixed map. The one place that additionally needs a proxy to play well for its principal is the inheritance statement of Section 4.1, where we name the assumption. 4 Within-Range Regret and the Truth-to-Proxy Identity A principal’s only lever is the report it gives its proxy. We first bound what that lever is worth: the wrapped mechanism inherits incentive compatibility from the proxy’s equilibrium quality. We then characterize that gain exactly as the proxy’s within-range regret, reducing strategic self-description to a geometric property of the proxy’s range. Each result is stated here and proved in full in Appendix 0.B. 4.1 Inheritance Proposition 1(Inheritance) If the proxy profile π is an interim ε -BNE of Γ , then the wrapped mechanism Γπ ^π is interim ε -IC, and under truthful reports its outcome coincides with the play of π in Γ at every type profile. The classical revelation principle is the ε=0 =0 case. Wrapping is conservative: it never enlarges the strategic surface (Reachi⊆MiReach_i M_i) and adds no instrument absent from the base mechanism, in particular no Crémer–McLean surplus extraction [18]. How small can ε be? Not zero in general: an exact equilibrium (ε=0 =0), or even an inverse-polynomial approximation, is PPAD-hard to compute [21, 15, 57], already under complete information. The slack is a property of the problem, so the guarantee must be measured rather than assumed. This is what makes the certification of Section 6 necessary. Where an ε -equilibrium is efficiently computable, in zero-sum and potential games [13] or no-regret-learnable auctions [46], the designer knows ε outright. Otherwise the profile comes from outside, an autobidder [1] or a fine-tuned model [42], and its ε is learned by sampling. 4.2 Coarsening and the Identity Recall the input game from Section 3: the game the principals play when each chooses a report to hand its proxy. Each principal can drive its proxy only to actions in ReachiReach_i, so delegation restricts the base game to the strategies whose range lies in ReachiReach_i. This restriction of the strategy space is what we call coarsening. The next lemma identifies the input game with the coarsened base game exactly. Lemma 1(The input game is the coarsened base game) Fix π. For each i, the map τi↦πi∘τi _i _i _i takes report strategies τi:Θi→Θi _i: _i→ _i of the input game onto exactly the base-game strategies with range in ReachiReach_i, and it preserves interim utilities. Consequently the equilibria of the input game correspond to the equilibria of Γ with strategy sets restricted to ReachiReach_i-valued maps. Delegation is strategy-space coarsening. The manipulation identity and the guardrail corollary that follow are both corollaries of where the coarsened set sits relative to best responses. Definition 1(Within-range regret and manipulation gain) For a true type θi _i, define Wi(θi;π) W_i( _i;π) =maxm∈ReachiUi(m,π−i∣θi)−Ui(πi(θi),π−i∣θi), = _m _iU_i(m, _-i _i)\;-\;U_i ( _i( _i), _-i _i ), Gi(θi;π) G_i( _i;π) =maxti∈ΘiUi(πi(ti),π−i∣θi)−Ui(πi(θi),π−i∣θi). = _t_i∈ _iU_i ( _i(t_i), _-i _i )\;-\;U_i ( _i( _i), _-i _i ). The first is the proxy’s within-range regret at θi _i; the second is the principal’s manipulation gain, the most it can gain by misreporting its own type to the proxy. The proxy is range-optimal at θi _i if Wi(θi;π)=0W_i( _i;π)=0. Theorem 4.1(Truth-to-proxy) For every i and θi _i: (i) Gi(θi;π)=Wi(θi;π)G_i( _i;π)=W_i( _i;π); (i) Gi(θi;π)≤Ri(π)G_i( _i;π)≤ R_i(π); (i) truthful reporting is interim optimal at θi _i if and only if πi _i is range-optimal at θi _i, and Γπ ^π is exactly IC if and only if π is range-optimal at every type of every agent. The theorem separates two quality metrics that deployment conflates: the unrestricted regret RiR_i, how well the proxy plays against the world, and the within-range regret WiW_i, how well its input parameterization is aimed. Here Wi≤RiW_i≤ R_i, and WiW_i alone governs the temptation to lie. A constant proxy has Wi=0W_i=0 but is useless, so the design problem is Wi=0W_i=0 with small RiR_i. The autobidding incentive-compatibility results (Section 2) are instances of the identity: the truthful rule makes the honest report range-optimal and the others do not. Figure 2 draws the geometry, and Example 1 works out the canonical pair. action aaUi(a)U_i(a)honesta⋆a aM⋆a _MM (all messages)ReachiReach_i (what the proxy can reach)WiW_iRiR_i Figure 2: Within-range regret is what governs misreporting. The proxy reaches only Reachi⊆MiReach_i M_i, so a principal’s gain from misreporting equals the gap WiW_i to the best reachable action, not the unrestricted regret RiR_i to the global optimum aM⋆a _M (Theorem 4.1). The geometry takes a closed form in the canonical auction case, recovering the autobidding results as a sign change in within-range regret. Example 1(The first-price/second-price reversal is a sign change in WiW_i) An advertiser of value v delegates to a value-faithful autobidder, the proxy π(t)=tπ(t)=t that bids the reported value, against a competing bid c∼Fc F. Every bid is reachable, Reach=[0,H]Reach=[0,H], so Theorem 4.1 reads the incentive to misreport off the interim payoff in each format. Under a second-price rule the payoff of bid b is ∫0b(v−c)F(c) _0^b(v-c)\,dF(c), maximized at b=vb=v: the honest report is range-optimal, Wi(v)=0W_i(v)=0, and autobidding IC holds. Under a first-price rule the payoff is (v−b)F(b)(v-b)\,F(b), maximized at the bid b⋆<vb <v solving (v−b⋆)f(b⋆)=F(b⋆)(v-b )f(b )=F(b ); the honest bid v earns (v−v)F(v)=0(v-v)F(v)=0, so Wi(v)=(v−b⋆)F(b⋆)> 0,W_i(v)\;=\;(v-b )\,F(b )\;>\;0, and the advertiser strictly gains by reporting b⋆b in place of v. Honest self-description is optimal exactly in the format whose optimal bid is the honestly reported one. For this value-bidding proxy that format is the second-price auction; for the regret-minimizing agents of Kolumbus and Nisan [47, 46] it is the first-price auction. The sign of WiW_i follows the proxy, not the format. The autobidding incentive-compatibility failures of [3] are instances of the same identity. The within-range restriction is not vacuous: across 60,00060,000 random Bayesian games WiW_i falls strictly below RiR_i in 58%58\% of instances (mean Ri=1.64R_i=1.64 against Wi=1.17W_i=1.17), so a delegation analysis must track WiW_i, not the unrestricted regret a naive bound would use. This computation uses the llm-market-sim library [30]; the full distribution is Figure 5 in Appendix 0.A, and the language-model study is Section 7. 4.3 Guardrails and the Input Channel A guardrail is a constraint composed onto the proxy that can only narrow its reach: πi′=c∘πiπ _i=c _i for some c:Mi→Mic:M_i→ M_i with c(Reachi)⊆Reachic(Reach_i) _i (a bid cap, a prudence rule, a filtered action set, a policy-constrained decoder), applied to agent i with the other proxies held fixed, so within-range regret is measured against the opponents π−i _-i. The condition c(Reachi)⊆Reachic(Reach_i) _i says a guardrail removes reachable actions rather than synthesizing new ones. It holds exactly for the interval reach of a bid-scaling proxy, and up to discretization for the sampled report grid of Section 7. Every guardrail in this paper meets it. Corollary 1(Guardrails) If under the guardrailed profile π′π the constrained action πi′(θi)π _i( _i) is not optimal within the constrained range Reachi′Reach _i at θi _i, then Gi(θi;π′)=Wi(θi;π′)>0G_i( _i;π )=W_i( _i;π )>0: the guardrail makes truthful self-description strictly suboptimal. The corollary is Theorem 4.1 pointed at a design practice. A prudence rule caps bids at forty percent of the reported value, where the best response is half the true value, so the principal inflates its report by 1.25×1.25× to restore the intended bid. The guardrail changed no feasible outcome, only the semantics of the input channel. The prediction is falsifiable: inflation concentrates on the principals for whom the constraint binds. 5 The Trilemma of Aligned Delegation Corollary 1 says a guardrail that displaces the optimal reachable action breaks truth-to-proxy. This is not an incidental side effect but a structural limit, and it answers, at the level of the proxy, the question in the title: a guardrail that does real work cannot also keep self-description honest without forfeiting the principal’s best outcome. Fix a type θi _i and let a⋆=argmaxm∈ReachiUi(m,π−i∣θi)a = _m _iU_i(m, _-i _i) be the honest-optimal reachable action, assumed unique. A guardrail c with constrained range Reachi′=c(Reachi)⊆ReachiReach _i=c(Reach_i) _i has three properties of interest at θi _i: Binding: c(πi(θi))≠a⋆c( _i( _i))≠ a , so the guardrailed truthful action differs from the honest optimum. Truthful: Wi(θi;π′)=0W_i( _i;π )=0, so honest reporting is optimal within Reachi′Reach _i. Capability-preserving: a⋆∈Reachi′a _i, so the honest-optimal action remains reachable through some report. Here binding is a property of the composite c∘πic _i, not of c alone: a do-nothing guardrail on a proxy that already plays below a⋆a still counts as binding, since the test is whether the honest action sits at the optimum, not whether c moved it. Theorem 5.1(Aligned delegation is a trilemma) At any type with a unique honest-optimal reachable action, no guardrail is simultaneously binding, truthful, and capability-preserving. Any two of the three preclude the third. The impossibility is qualitative and assumes a unique optimum. It has a quantitative form that drops uniqueness, covers randomized proxies, and turns the three-way conflict into a rate. Equip each MiM_i with a metric did_i, and call the optimum (ε,δ)( ,δ)-sharp at θi _i if every reachable action at distance at least ε from a⋆a loses at least δ: Ui(m,π−i∣θi)≤U⋆−δU_i(m, _-i _i)≤ U -δ whenever m∈Reachim _i and di(m,a⋆)≥εd_i(m,a )≥ , where U⋆=maxm∈ReachiUi(m,π−i∣θi)U = _m _iU_i(m, _-i _i). Proposition 2(Conservation of the binding loss) Suppose the optimum is (ε,δ)( ,δ)-sharp at θi _i, and let a guardrail be range-restricting (Reachi′⊆ReachiReach _i _i) and ε -binding, meaning di(c(πi(θi)),a⋆)≥εd_i(c( _i( _i)),a )≥ . Write its capability loss κ=U⋆−maxm∈Reachi′Ui(m,π−i∣θi)≥0κ=U - _m _iU_i(m, _-i _i)≥ 0, zero exactly when the best reachable value is retained. Then the capability loss and the within-range regret obey a conservation law, κ+Wi(θi;π′)≥δ;κ\;+\;W_i( _i;π )\;≥\;δ; in particular a capability-preserving guardrail (κ=0κ=0) has Wi≥δW_i≥δ. Binding by ε therefore imposes a loss budget δ that no design can avoid, only allocate: it is paid in capability (κ), in truthfulness (WiW_i), or split between them. The placements of Proposition 3 are the extreme allocations. Constraint-aware decoding spends the budget entirely on capability (Wi=0W_i=0, κ≥δκ≥δ). A capability-preserving output-clip spends it entirely on truthfulness (κ=0κ=0, Wi≥δW_i≥δ); a capability-removing one, such as a hard cap, can spend it on capability instead (Wi=0W_i=0, κ≥δκ≥δ). The design chooses the currency, not the total. Sharpness sets the budget: a μ-strongly-concave interim utility on a convex message set is (ε,μ2ε2)( , μ2 ^2)-sharp, so δ grows as μ2ε2 μ2 ^2. Because the condition is stated around the optimal value, it applies to randomized proxies without change, with the binding distance read on the honest action almost surely. For a language-model proxy the guardrail is the alignment layer and ReachiReach_i is what the prompt can elicit. Theorem 5.1 then reads: an alignment layer that changes the output while keeping the genuinely best output promptable makes honest description of intent suboptimal, the incentive to prompt-engineer or jailbreak [61, 63]. Placement and the allowed set decide the corner. Which of the three a design surrenders splits along two axes: its placement decides whether truthfulness is guaranteed, and its allowed set whether capability survives. Call a proxy loyal if its output maximizes the principal’s own interim utility over the messages it can produce. Lemma 2(Loyalty) Suppose that for some action class Ci⊆MiC_i M_i the proxy selects an interim-optimal action within CiC_i at each reported type, πi(ti)∈argmaxm∈CiUi(m,π−i∣ti)(so πi(ti)∈Ci). _i(t_i)∈ _m∈ C_iU_i(m, _-i t_i) (so _i(t_i)∈ C_i). Then Wi(θi;π)=0W_i( _i;π)=0 at every type of agent i, so truthful reporting is interim optimal for agent i. The argument uses no structure of g: for any mechanism whose interim utilities UiU_i make the proxy loyal in this sense, truthfulness follows, and if every proxy is loyal the wrapped mechanism is incentive-compatible. Within-range regret thus measures not the strength of a constraint but the proxy’s misalignment: it is positive only when the proxy optimizes something other than the principal’s utility over its reachable set. A guardrail can keep the proxy loyal or break that loyalty, depending on where it acts. Proposition 3(Placement) Fix θi _i with a unique honest-optimal reachable action a⋆a and a constraint with allowed set D⊆ReachiD _i. If the constraint is non-binding, a loyal proxy’s honest output stays at a⋆a , at once truthful and capability-preserving. A binding constraint cannot be both (Theorem 5.1), and its placement fixes which it keeps. Constraint-aware decoding replaces the proxy by one that re-optimizes within the allowed set, πi′(ti)∈argmaxm∈DUi(m,π−i∣ti)π _i(t_i)∈ _m∈ DU_i(m, _-i t_i); by Lemma 2 with Ci=DC_i=D its honest output is optimal within D, so it stays truthful, forfeiting capability exactly when a⋆∉Da ∉ D. Output-clipping instead composes a map onto the proxy output, πi′=c∘πiπ _i=c _i with c(Reachi)=Dc(Reach_i)=D (the guardrail of Theorem 5.1), applied after the proxy has optimized. When it is capability-preserving (a⋆∈Da ∈ D) a binding clip displaces the honest output from the unique constrained optimum a⋆a and so forfeits truthfulness; when a⋆∉Da ∉ D it may instead stay truthful, as the hard cap of Section 7 does by clipping the honest output onto the constrained frontier, spending its budget on capability. Either way the binding, truthful, capability-preserving corner stays out of reach, which re-proves Theorem 5.1. When the optimum stays reachable (a⋆∈Da ∈ D), the same constraint occupies different corners according to where it is placed. For a language-model proxy the distinction is operational. A safety constraint built into decoding, where the model selects the best allowed output, keeps honest prompting optimal while putting some outputs out of reach. A filter applied to the model’s chosen output keeps every output reachable through a rephrased prompt, and so rewards prompt-engineering. Constraint-aware decoding and output filtering are not interchangeable. From the individual to the equilibrium. Corollary 1, the trilemma, and Proposition 3 hold the other proxies at their honest messages; they are single-agent statements. What a capability-preserving guardrail does to the equilibrium splits on whether the mechanism couples the agents, and a structural fact ties the question to loyalty. If the proxy is loyal at every type, its honest output already maximizes over its reach, so ai⋆(θi)=πi(θi)a _i( _i)= _i( _i) at every type and ai⋆(θi)θi\a _i( _i)\_ _i exhausts ReachiReach_i. Capability-preservation then forces Reachi′=ReachiReach _i=Reach_i, so c maps the finite reachable set onto itself. A surjection of a finite set that is deflationary (c(m)≤mc(m)≤ m, as every cap and prudence rule on the ordered bid space is) preserves the total of its arguments and is therefore the identity, so c fixes every reachable action and nothing binds (idempotence yields the same conclusion on unordered messages). A binding, range-restricting, capability-preserving guardrail that is deflationary (or, on unordered messages, idempotent) therefore exists only on a non-loyal proxy, and the equilibrium effects below are effects of that misalignment. Proposition 4(Dominant-strategy neutrality) Suppose each agent has a unique weakly-dominant reachable action ai⋆(θi)a _i( _i): it maximizes Ui(⋅,m−i∣θi)U_i(·\,,m_-i _i) over ReachiReach_i for every reachable opponent profile m−im_-i. If a range-restricting guardrail is capability-preserving (ai⋆(θi)∈Reachi′a _i( _i) _i at every type), then (ai⋆(θi))i(a _i( _i))_i is a weakly-dominant-strategy equilibrium of both the guarded and the unguarded input game, unique in the unguarded game and, in the guarded game, still weakly dominant though the smaller reach Reach−i′Reach _-i may admit ties, and the two induce the same allocation, payments, revenue, and welfare; only the report realizing ai⋆a _i changes, inflating for a monotone cap. Second-price and VCG composed with a value-faithful proxy are of this form. Proposition 5(A capability-preserving guardrail can destroy welfare) Without dominance, capability-preservation does not lift to the equilibrium: there is a symmetric two-agent mechanism, a type-faithful proxy, and a range-restricting guardrail capability-preserving at every type, yet an equilibrium of the unguarded input game has no equal-outcome counterpart in the guarded game and strictly higher social welfare than every guarded equilibrium. The witness is a stag hunt on reachable messages ,\ stag, hare\ with u(,)=4u( stag, stag)=4, u(,)=0u( stag, hare)=0, u(,⋅)=3u( hare,·)=3, and a type-faithful proxy. Against the honest opponent the best reply is hare at every type, so ai⋆=a _i= hare, and capability-preservation protects hare, not stag. Since c(πi(θi))==ai⋆c( _i( _i))= hare=a _i at every type, the guardrail is even non-binding in the single-agent sense of Section 5: welfare destruction needs no binding at all, only the deletion of an off-equilibrium message. The efficient equilibrium (,)( stag, stag), welfare 88, rests on stag, a best reply only to stag and never to the honest opponent. A guardrail mapping ↦ stag hare is capability-preserving yet deletes the message that equilibrium needs, leaving the guarded game to play only (,)( hare, hare), welfare 66. This is the strategic complementarity the single-agent analysis cannot see: capability-preservation protects each agent’s best reply to honest opponents, while a coordination equilibrium rests on best replies to each other. A capability-preserving guardrail is outcome-neutral where the mechanism is already dominant-strategy, and can destroy efficient equilibria where it is not. Measured on language-model proxies. Section 7 runs this corner on production language models from five providers: sampling each proxy’s play under an alignment-style cap, the estimator of Section 6, recovers the predicted Wi>0W_i>0 with report inflation on every model, and a placement ablation separates the two corners of Proposition 3. 6 Certification The inheritance proposition (Proposition 1) and the hardness floor of Section 4.1 jointly imply that a wrapped mechanism’s incentive guarantee is an empirical quantity: inherited, approximate, and tied to the specific proxy profile that produced it. We give the guarantee a carrier. The three results of this section are proved in Appendix 0.B. Definition 2(IC certificate) An IC certificate for a wrapped mechanism is a tuple (Γ,h(π),ε^,δ,N)( ,h(π), 2.0mu -2.0mu,δ,N) asserting: with confidence 1−δ1-δ over N independent type-profile samples from F, the estimated maximum manipulation gain satisfies maxi,θiGi(θi;π)≤ε _i, _iG_i( _i;π)≤ 2.0mu -2.0mu, where h(π)h(π) is a version hash of the proxy profile. The certificate is statistical because the quantity it bounds is not exactly computable at feasible cost, even when the proxy profile is given in full. Proposition 6(Exact certification is intractable) Even with the proxy profile given explicitly, the certified quantity is not polynomial-time computable in the worst case: (i) deciding whether a succinctly represented wrapped mechanism g∘πg π is exactly dominant-strategy IC is coNPcoNP-hard, and (i) computing the interim manipulation gain Gi(θi;π)G_i( _i;π) is #P\#P-hard. Hence no polynomial-time exact certifier exists unless P=NPP=NP (resp. FP=#PFP=\#P). The barrier parallels the counting hardness of Bayesian interim quantities [38, 16], so the certificate estimates rather than computes. The hardness is in the succinct description: with types and messages given as explicit tables, the manipulation gain is a polynomial-size sum and the check is polynomial. The barrier bites only when the type space is exponential in the input, as it is for a prompt-driven language model (the reductions in Appendix 0.B make this precise). Approximate incentive compatibility is learnable from sampled types [9], and the guarantee transfers directly. The interim gain Gi(θi;π)G_i( _i;π) is an expectation under F(⋅∣θi)F(· _i), so reading it off unconditioned profile samples assumes a product prior or conditional-sampling access; under a correlated prior one draws the opponents’ types conditional on θi _i. Let d=Pdim(ℱ)d=Pdim(F) be the pseudo-dimension of the class ℱF of interim manipulation-gain functions induced by the proxy profile and the mechanism, with utilities in [0,H][0,H]. By Balcan et al. [9], with probability 1−δ1-δ over N independent type-profile samples the empirical maximum manipulation gain estimates the true maxi,θiGi(θi;π) _i, _iG_i( _i;π) to within an additive O(HdNlnNd+H1Nlnnδ),O\! (H dN\, Nd\;+\;H 1N\, nδ ), uniformly over the n agents; equivalently, N=O~(H2(d+ln(n/δ))/ε2)N= O (H^2(d+ (n/δ))/ ^2 ) samples suffice for an ε -accurate certificate. For the bid-scaling proxies of the autobidding model the proxy is a single parameter, the multiplier α. Since α↦Gi(θi;πα)α G_i( _i; _α) is unimodal at each θi _i (piecewise monotone with O(1)O(1) pieces, a V around the loyal multiplier where Gi=0G_i=0), each level set α:Gi≥r\α:G_i≥ r\ is a union of O(1)O(1) intervals and the induced family has d=O(1)d=O(1). Then N=O~(H2/ε2)N= O(H^2/ ^2) samples suffice, the bidder count entering only through the ln(n/δ) (n/δ) confidence term. Our contribution is the versioning and drift apparatus below, not the estimation itself. One caveat needs a calibrated lower bound. Deep-learning regret estimators underestimate true regret [62], and the underestimation lives in the per-sample search, which no concentration bound repairs. The remedy is two-layer, each layer one-sided. First, score each sampled profile with a method that does not undershoot the per-profile gain: an exact mixed-integer encoding for piecewise-linear proxies [19], or a multi-start search seeded to escape poor local optima [62]. Second, lift the scores to a one-sided population bound with a finite-sample guarantee: the uniform bound above [9], a distribution-free conformal upper quantile [5], or an empirical-Bernstein bound that tightens when the regret variance is small [50]. Both layers overstate rather than understate, so the reported ε 2.0mu -2.0mu can only exceed the true gain. An incentive-compatibility pass then stays sound under an underestimating regret model. The certificate names a version because the guarantee dies with the version. Lemma 3(Drift) Equip each MjM_j with a metric djd_j and suppose interim utilities are L-Lipschitz in the message profile: for all i, θi _i, and message profiles m,m′m,m , |ui(g(m),θi)−ui(g(m′),θi)|≤L∑jdj(mj,mj′)\;|u_i(g(m), _i)-u_i(g(m ), _i)|≤ L _jd_j(m_j,m _j). If a proxy update replaces π by π′π with maxjsuptdj(πj(t),πj′(t))≤Δ _j _td_j( _j(t),π _j(t))≤ , then for every i and θi _i, Gi(θi;π′)≤Gi(θi;π)+2LnΔ.G_i( _i;π )\;≤\;G_i( _i;π)+2Ln . Proposition 7(Online re-certification under a drift budget) Consider a stream of proxy versions π1,π2,…π^1,π^2,… with per-update action drift Δt _t (as in Lemma 3) and total drift budget BT=∑t<TΔtB_T= _t<T _t. Fix a slack s>0s>0, advertise the bound ε^+lasts 2.0mu -2.0mu_last+s between certificates (the last estimate plus the slack), and re-estimate from N fresh samples whenever 2Ln2Ln times the drift accumulated since the last certificate would exceed s. Then, with K=⌈2LnBT/s⌉+1K= 2Ln\,B_T/s +1 and probability 1−Kδ1-Kδ: (i) at every epoch the advertised bound ε^+lasts 2.0mu -2.0mu_last+s upper-bounds the true maximum manipulation gain, so the deployed mechanism is never uncertified; and (i) at most K certificates are issued. Verification cost thus scales with the drift budget BTB_T, not the number of updates: a stream of small updates (BT=o(T)B_T=o(T)) incurs vanishing amortized cost. In the autobidding instance the drift constant is explicit too: a multiplier change Δα α moves each bid by at most Δαv¯ α\, v when values are bounded by v¯ v, so re-certification triggers once the total multiplier drift exceeds s/(2Lv¯n)s/(2L vn). Online measurement of IC has been studied for a single fixed auction [32]. Budgeted re-certification of a versioned mechanism has no classical counterpart, since exact equilibria do not version. A provider’s silent model update is an uncertified mechanism change. 7 Empirical study The identity predicts that a binding, capability-preserving guardrail leaves Wi>0W_i>0, so honest reporting is suboptimal and the principal inflates its report to recover the intended action. We test this on production language models used as autobidding proxies. All runs use the llm-market-sim library [30] and its delegation harness, which sweeps a proxy, analytic or language-model, through a grid of reports and returns the within-range regret and the report inflation; the code and data reproducing every figure and table are archived together [29]. The scenario is stylized and the cap is one we impose, not read from any model’s safety training, so the study illustrates the mechanism the identity predicts rather than measuring a deployed alignment layer. Setup. Each proxy bids for one client in a first-price auction against a single competitor whose bid is uniform on [0,300][0,300]. The client’s value v ranges over 100,150,200,250,300\100,150,200,250,300\, and interim utility is u(b,v)=(v−b)min(b/300,1)u(b,v)=(v-b) (b/300,1), so the unconstrained optimum is b⋆(v)=v/2b (v)=v/2. An alignment-style soft cap compresses the proxy’s bid, c(b)=bc(b)=b for b≤40b≤ 40 and c(b)=40+0.4(b−40)c(b)=40+0.4\,(b-40) above, leaving the optimum reachable through a higher report, up to the models’ own bid ceiling. The model is instructed only to maximize the client’s expected surplus222The system prompt reads, in part: “Bid to maximize the client’s expected surplus, the value minus the price paid weighted by the chance of winning.” and is not shown the cap; it is applied to the bid the model returns. For each model we sweep the reported value over 2525 evenly spaced reports (50,75,…,65050,75,…,650), query the model once per report, parse its bid (the first number in the reply, clamped to [0,300][0,300]; an unparseable reply scores as a zero bid, though none occurred, 0 of 625625 calls), and estimate WiW_i as the gap between the best reachable payoff on the grid and the honest-report (t=vt=v) payoff. Figure 4 sketches this report-to-bid mapping at v=200v=200. Decoding is at temperature 0 for the standard chat models; the reasoning models (GPT-5 series, o-series) do not accept a temperature and run at their fixed default. Each report is a single draw; the nonzero-temperature reasoning models nonetheless returned the rational bid at all twenty-five reports, and re-querying five of them at five reports five times each returned identical bids every time (zero spread), so these decoders are effectively deterministic here and the single draw is representative. Every request’s decode parameters and both prompts are recorded in the reproducibility archive. Formally the type space is this report grid with the prior concentrated on the five values, so every swept report is a valid type-report. The grid is wide enough that the first-price argmax is interior at every value, and at v=300v=300 it is the report (600600) at which the bid reaches its ceiling of 300300, so the frontier there is set by the models’ own bid ceiling rather than the grid boundary. The incentive appears on every model (Figure 3). Measured on 25 production language models across five providers under the alignment-style soft cap, the binding, capability-preserving corner gives Wi>0W_i>0 with report inflation above one on every model, and the cap binds at every value on all but one (Gemini 2.5 Flash-Lite, loose enough that honest reporting is already optimal at v=100v=100). The disloyalty is the composite’s, not the base model’s: instructed to maximize client surplus, the capable models play the rational bid, and the cap applied to it displaces the optimum, so the wrapped proxy c∘πc π has Wi>0W_i>0 on every model. Seventeen produce the rational bid capped at the competitor’s support maximum, effective bid min(⌊t/2⌉,300) ( t/2 ,300) (⌊⋅⌉ · rounds to the nearest integer), at all twenty-five reports, and so share Wi=5.79W_i=5.79 and inflation 1.76×1.76× exactly. Bidding above 300300 is dominated in first price; the models emit 300300 directly at the high reports, and the parser clamps the rare overshoot to the same ceiling, so at v=300v=300 the frontier is c(300)=144c(300)=144 rather than the c(325)=154c(325)=154 that untruncated play would reach. That shared value is the within-range regret of this bid function under the cap, a check on the harness; the untruncated t/2t/2 would give 5.825.82. The unrestricted regret of the same play is Ri=5.82R_i=5.82, so WiW_i nearly saturates RiR_i. The report channel can inflate to approach the unconstrained optimum, and only the cap keeps it short. Within-range regret ranges from 2.22.2 to 5.85.8; the smaller models (GPT-4o mini, Claude Haiku 4.5, Gemini 2.5 Flash-Lite) show lower WiW_i because they bid imprecisely, over- or under-shooting v/2v/2, not because honest reporting is nearer optimal for them. GPT-4o sits just below the cluster at 5.775.77, its bid at v=250v=250 a shade off the rational v/2v/2. The identical rows span distinct models and providers, so they reflect the same rational strategy rather than coincidence. Every call records its decode parameters, system and user prompts, and raw response, so each number is reproducible. GPT-5.55.79GPT-5.45.79GPT-5.15.79GPT-55.79GPT-5 mini5.79GPT-4.15.79GPT-4o5.77GPT-4o mini4.55o35.79o4-mini5.79Claude Opus 4.85.38Claude Opus 4.15.45Claude Sonnet 55.79Claude Sonnet 4.65.57Claude Haiku 4.53.76Claude Fable 55.79Gemini 3.5 Flash5.79Gemini 2.5 Pro5.79Gemini 2.5 Flash5.79Gemini 2.5 Flash-Lite2.24DeepSeek-V4 Pro5.79DeepSeek-V4 Flash5.79Grok 4.35.79Grok 4.20 reasoning5.79Grok 4.20 non-reasoning5.500123456within-range regret WiW_iRi=5.82R_i=5.82the unrestricted-regret ceilingOpenAIAnthropicGoogleDeepSeekxAI Figure 3: Within-range regret WiW_i for 25 production language models across five providers, each an autobidding proxy under the alignment-style soft cap (mean over true values v∈100,…,300v∈\100,…,300\; exact values labeled). Honest reporting is suboptimal on every model: the capable ones bid the rational v/2v/2 and cluster at Wi=5.79W_i=5.79, just under the analytic optimal-play regret Ri=5.82R_i=5.82 (dashed; a mean over v, where the RiR_i of Section 3 is a supremum over types, and a ceiling for rational play, not for arbitrary proxies, GPT-4o’s menu-arm Wi=9.39W_i=9.39 already exceeding it), while the smaller models bid less precisely and sit lower. Report inflation, discussed in the text, runs from 1.2×1.2× to 1.8×1.8×; per-model WiW_i and inflation are in Appendix Table 3. vvt⋆t 6464v/2v/2report ttbid the mechanism sees Figure 4: The mechanism behind Figure 3, at true value v=200v=200: the guardrailed bid the mechanism sees against the reported value t is the soft cap applied to the rational bid t/2t/2. The honest report t=vt=v yields a bid below the optimum v/2v/2, and an inflated report t⋆t recovers it. The incentive persists across environments (Table 1). The soft cap is one environment; the incentive it induces is not specific to it. On a representative model per provider we re-run the sweep under a narrower competitor distribution and under a second-price payment rule, where honest bidding is optimal absent the cap. That second rule is the decisive test: it removes every misreporting incentive except the guardrail’s own, and the cap still forces report inflation on every model. In both the cap still binds and report inflation persists, with within-range regret positive on every model: mean inflation 1.55×1.55× under the narrower competitor range and 1.54×1.54× under second-price, against 1.74×1.74× for these five models in the headline first-price setup. Within-range regret is reported in payoff units, which scale with the environment, so inflation is the comparable measure across rows; it barely moves. The drop under the narrower range is the same truncation seen in the headline sweep: bids cap at the support maximum 200200, so for v∈250,300v∈\250,300\ the frontier is c(200)=104c(200)=104 and less report inflation reaches it. In that decisive case, with payoff u(b,v)=min(b/300,1)(v−b/2)u(b,v)= (b/300,1)\,(v-b/2) for b≤300b≤ 300, all five models bid value-faithfully (b=min(t,300)b= (t,300)), so for v≥150v≥ 150 the reachable frontier is the capped top bid c(300)=144c(300)=144, while at v=100v=100 it is c(200)=104c(200)=104, the reachable bid nearest the value. The within-range regret is measured to the per-value frontier, mean 5.445.44. The regret to the uncapped optimum b=vb=v is 18.418.4. WiW_i correctly excludes it because that bid is not reachable through any report. Table 1: Robustness of the report-inflation incentive across environments, mean over one representative model per provider (GPT-4o, Claude Sonnet 5, Gemini 2.5 Flash, DeepSeek-V4 Flash, Grok 4.3). The incentive persists in every environment; inflation, the scale-free measure, is nearly unchanged. “Wi>0W_i>0” is the fraction of values at which honest reporting is suboptimal, the failure of Truthfulness, not merely where the cap compresses the bid, which happens at every value. It is distinct from Binding in Section 5 (displacement of the honest action from the unguarded optimum a⋆a ): the second-price arm at v=300v=300 reaches the capped frontier (Wi=0W_i=0) yet leaves a⋆=300a =300 displaced, so that value is capability-losing, not non-binding. Environment mean WiW_i mean inflation Wi>0W_i>0 First-price, competitor ∼U[0,300] U[0,300] (headline) 5.795.79 1.74×1.74× 100%100\% First-price, competitor ∼U[0,200] U[0,200] 6.176.17 1.55×1.55× 100%100\% Second-price, competitor ∼U[0,300] U[0,300] 5.445.44 1.54×1.54× 80%80\% Placement decides the corner (Table 2). Proposition 3 predicts that the same cap lands in a different corner by placement: output-clipping, the cap applied to the proxy’s chosen bid, leaves Wi>0W_i>0, while constraint-aware decoding, the proxy selecting the best allowed bid, restores Wi=0W_i=0. We run both on the same models. Output-clipping is the headline sweep; for the constraint-aware arm we present each model the menu t/4,t/2,3t/4,t\t/4,t/2,3t/4,t\ of allowed bids built from the reported value t, which at the honest report t=vt=v offers the interim optimum v/2v/2 (items rounded to integers), and ask which maximizes client surplus, exactly Proposition 3’s "selects the best allowed output"; the reply is snapped to the nearest menu item and an unparseable reply to the lowest (none needed the fallback), and WiW_i is the shortfall of the honest-report choice from the best allowed bid, which upper-bounds the within-range regret and equals it here, since v/2v/2 is recovered by a report. This carries no cap arithmetic to misread, unlike telling the model a formula. The two arms differ in allowed set as well as placement, the cap’s compressed range against the four-point menu; v/2v/2 lies in both at every value below 300300, so the comparison isolates placement, and at v=300v=300 the clip frontier c(300)=144c(300)=144 leaves a 0.120.12 shortfall (0.16%0.16\%), Proposition 2’s interior rather than a pure corner. Constraint-aware placement drops within-range regret to zero on four of the five models, which select v/2v/2 at the honest report, against Wi≈5.79W_i≈ 5.79 under output-clipping, and the mean falls from 5.795.79 to 1.881.88. GPT-4o is the exception: it over-selects, choosing 3v/43v/4 rather than the optimal v/2v/2, so Wi=u(v/2,v)−u(3v/4,v)=9.39W_i=u(v/2,v)-u(3v/4,v)=9.39 (menu integers rounded half-to-even); the report that recovers its optimum is a deflation (t⋆≈2v/3t ≈ 2v/3, where its 3t/43t/4 choice lands on v/2v/2), the opposite sign to the clipping arm’s inflation, and placement alone does not rescue a proxy that misoptimizes. With the optimum reachable in both arms, where the constraint sits decides whether truthfulness survives. Randomizing the menu order rules out option-position bias: across shuffled orders the four loyal models select v/2v/2 in all 1515 trials, and GPT-4o still over-selects 3v/43v/4 in 1414 of 1515, its lone v/2v/2 pick at v=300v=300 (Wi=8.14W_i=8.14 against the ascending 9.399.39), so neither the restored truthfulness nor GPT-4o’s anomaly is an artifact of where the optimum sits in the list. Table 2: Placement ablation (Proposition 3): within-range regret under output-clipping (the cap applied to the model’s bid) and constraint-aware decoding (the model selects the best allowed bid), for the same five models. Placement sets the corner: constraint-aware restores Wi=0W_i=0 on four of five; GPT-4o over-selects even from the allowed menu. Model output-clipping WiW_i constraint-aware WiW_i GPT-4o 5.775.77 9.399.39 Claude Sonnet 5 5.795.79 0.000.00 Gemini 2.5 Flash 5.795.79 0.000.00 DeepSeek-V4 Flash 5.795.79 0.000.00 Grok 4.3 5.795.79 0.000.00 mean 5.795.79 1.881.88 Disclosing the cap reaches the corner only when the arithmetic does. Constraint-aware decoding can also be prompted directly: a third arm discloses the cap formula and asks the model to bid accounting for it, reaching the truthful corner by re-optimization rather than menu selection. On the same five models the result splits on arithmetic. Gemini 2.5 Flash and Claude Sonnet 5 invert the cap and collapse to Wi=0.00W_i=0.00 and 0.090.09 (inflation 1.00×1.00× and 1.25×1.25×), reaching the corner through the prompt alone; the other three mis-invert and overcorrect past their output-clipping value, to Wi=14.1W_i=14.1 (DeepSeek-V4 Flash), 9.509.50 (GPT-4o), and 8.988.98 (Grok 4.3). The menu of Table 2 removes this arithmetic, which is why it restores Wi=0W_i=0 on four models rather than roughly two: it rescues DeepSeek-V4 Flash and Grok 4.3, which can rank the allowed bids but not invert the cap. Naming the constraint and trusting the model to re-optimize reaches the corner only when the model computes the inverse; offering the allowed set reaches it whenever the model can rank. An intermediate arm, disclosing the cap’s existence but not its formula, would separate awareness of the constraint from the ability to invert it; we leave it to future work. The third corner: a hard cap forfeits capability, not truthfulness. The soft cap keeps the optimum reachable, bar the 0.16%0.16\% ceiling shortfall at v=300v=300, and so occupies the capability-preserving corner. A hard cap c(b)=min(b,40)c(b)= (b,40) that removes the optimum from reach occupies the opposite one. Re-scoring the same collected bids under the hard cap, all 25 models have Wi=0W_i=0: honest reporting already reaches the capped frontier, so nothing is gained by inflating. The mean capability loss is 16.216.2 payoff units, the surplus the cap destroys by putting v/2v/2 out of reach. Truthful and capability-losing, the hard cap is the capability-removing output-clip of Proposition 2, spending its whole loss budget on capability rather than truthfulness. All three corners of Figure 1(b) now appear empirically. Three further checks are in Appendix 0.A: the Ri−WiR_i-W_i gap across 60,00060,000 random games (Fig. 5), the analytic soft-cap inflation profile (Fig. 6), and the sampling certificate’s convergence and re-certification under drift (Fig. 7). 8 Discussion What we found. Delegation leaves a principal one lever, the report it hands its proxy. A single quantity decides whether that lever keeps it honest: the proxy’s within-range regret. Honest self-description is optimal exactly when the proxy already plays the best action it can reach (Theorem 4.1), the incentive deployed elicitation proxies [42] leave unmodeled. The identity subsumes the autobidding incentive-compatibility results and turns guardrails into mechanism-relevant objects: none binds, stays truthful, and preserves capability at once (Theorem 5.1). Which one a design forfeits depends on its placement and its allowed set (Proposition 3). Honest self-description thus stops being an assumption and becomes a property a platform measures: #P-hard to compute, but estimable from samples and maintainable as the proxy drifts. Run on production language models from five providers under an alignment-style cap we impose, that estimate recovers the predicted incentive on every model (Figure 3). Loyalty and what to reveal. Every deployment takes the proxy to act for its principal; none certifies that it does. The results need less, holding against whatever proxy a principal faces. A disloyal proxy does not break them. It becomes the object they describe, and within-range regret measures exactly its misalignment (Lemma 2). Certifying which objective a proxy optimizes is the framework’s most consequential open problem, and it governs a second design choice, the report language. That language fixes Reachi=πi(Θi)Reach_i= _i( _i), so a principal should reveal exactly enough that its optimum is reachable (a⋆∈Reachia _i) and no more. Reach beyond the optimum only enlarges the surface a guardrail can bind, and against a proxy one cannot certify loyal, it converts into within-range regret. The worth of a loyalty certificate is exactly the reach it makes safe to share. Choosing how much to reveal is the classical delegation-set problem [40, 4, 6, 44] from the principal’s side, an instance of the aligned delegation of Frankel [36] with within-range regret playing the role of the agent’s bias. The wrap also inherits the principle’s classical limits, limited commitment [10, 28] and collusion among proxies [34]. Open problems. Measured manipulation: measure WiW_i from a model’s own refusal behavior rather than an imposed cap, the constraint-aware and output-clipping contrast of Proposition 3 now shown only under a cap we impose. Equilibrium and welfare: by Lemma 1 an input-game equilibrium corresponds to one of the coarsened base game. Whether the inflated profile in which every principal has Wi>0W_i>0 is itself an equilibrium, and its revenue and welfare against the honest benchmark, remain open. Beyond auctions: instantiate the identity in matching and bargaining, the real test of its generality. Certified loyalty: certify that a proxy serves its principal rather than the platform, the assumption every deployment makes and none checks. Once loyalty and manipulation are both certifiable, the trilemma becomes a navigable constraint, and the design of proxy ecosystems, who certifies whom and at what price, becomes mechanism design in its own right. References [1] Aggarwal, G., Badanidiyuru, A., Mehta, A.: Autobidding with constraints. In: Proceedings of the 15th Conference on Web and Internet Economics (WINE). p. 17–30 (2019) [2] Akbarpour, M., Li, S.: Credible auctions: A trilemma. Econometrica 88(2), 425–467 (2020) [3] Alimohammadi, Y., Mehta, A., Perlroth, A.: Incentive compatibility in the auto-bidding world. In: Proceedings of the 2023 ACM Conference on Economics and Computation (EC) (2023), arXiv:2301.13414 [4] Alonso, R., Matouschek, N.: Optimal delegation. The Review of Economic Studies 75(1), 259–293 (2008) [5] Angelopoulos, A.N., Bates, S.: A gentle introduction to conformal prediction and distribution-free uncertainty quantification (2021), arXiv:2107.07511 [6] Armstrong, M., Vickers, J.: A model of delegated project choice. Econometrica 78(1), 213–244 (2010) [7] Ashlagi, I., Monderer, D., Tennenholtz, M.: Mediators in position auctions. Games and Economic Behavior 67(1), 2–21 (2009) [8] Ausubel, L.M., Milgrom, P.R.: Ascending auctions with package bidding. Frontiers of Theoretical Economics 1(1) (2002) [9] Balcan, M.F., Sandholm, T., Vitercik, E.: Estimating approximate incentive compatibility. In: Proceedings of the 2019 ACM Conference on Economics and Computation (EC). p. 867 (2019), full version: arXiv:1902.09413 [10] Bester, H., Strausz, R.: Contracting with imperfect commitment and the revelation principle: The single agent case. Econometrica 69(4), 1077–1098 (2001) [11] Braverman, M., Mao, J., Schneider, J., Weinberg, S.M.: Selling to a no-regret buyer. In: Proceedings of the 2018 ACM Conference on Economics and Computation (EC). p. 523–538 (2018) [12] Camara, M.K., Hartline, J.D., Johnsen, A.: Mechanisms for a no-regret agent: Beyond the common prior. In: IEEE 61st Annual Symposium on Foundations of Computer Science (FOCS). p. 259–270 (2020) [13] Cesa-Bianchi, N., Lugosi, G.: Prediction, Learning, and Games. Cambridge University Press (2006) [14] Chen, P.Y., Shen, H., Das, P., Chen, T.: Fundamental safety-capability trade-offs in fine-tuning large language models. PNAS Nexus 5(4), pgag097 (2026). https://doi.org/10.1093/pnasnexus/pgag097 [15] Chen, X., Deng, X., Teng, S.H.: Settling the complexity of computing two-player nash equilibria. Journal of the ACM 56(3), 14:1–14:57 (2009) [16] Conitzer, V., Sandholm, T.: Complexity of mechanism design. In: Proceedings of the 18th Conference on Uncertainty in Artificial Intelligence (UAI). p. 103–110 (2002), arXiv:cs/0205075 [17] Conitzer, V., Sandholm, T.: Computational criticisms of the revelation principle. In: Proceedings of the 5th ACM Conference on Electronic Commerce (EC). p. 262–263 (2004) [18] Crémer, J., McLean, R.P.: Full extraction of the surplus in bayesian and dominant strategy auctions. Econometrica 56(6), 1247–1257 (1988) [19] Curry, M., Chiang, P.Y., Goldstein, T., Dickerson, J.: Certifying strategyproof auction networks. In: Advances in Neural Information Processing Systems 33 (NeurIPS) (2020), arXiv:2006.08742 [20] Dasgupta, P., Hammond, P., Maskin, E.: The implementation of social choice rules: Some general results on incentive compatibility. The Review of Economic Studies 46(2), 185–216 (1979) [21] Daskalakis, C., Goldberg, P.W., Papadimitriou, C.H.: The complexity of computing a nash equilibrium. SIAM Journal on Computing 39(1), 195–259 (2009) [22] d’Aspremont, C., Gérard-Varet, L.A.: Incentives and incomplete information. Journal of Public Economics 11(1), 25–45 (1979) [23] Deng, Y., Lahaie, S., Mirrokni, V., Zuo, S.: A data-driven metric of incentive compatibility. In: Proceedings of the Web Conference 2020 (W). p. 1796–1806 (2020) [24] Deng, Y., Mao, J., Mirrokni, V., Teng, Y., Zuo, S.: Non-uniform bid-scaling and equilibria for different auctions: An empirical study. In: Proceedings of the ACM Web Conference 2024 (W) (2024), arXiv:2311.10679 [25] Deng, Y., Mao, J., Mirrokni, V., Zhang, H., Zuo, S.: Efficiency of the first-price auction in the autobidding world (2022), arXiv:2208.10650 [26] Deng, Y., Mao, J., Mirrokni, V., Zuo, S.: Towards efficient auctions in an auto-bidding world. In: Proceedings of the Web Conference 2021 (W). p. 3965–3973 (2021) [27] Deng, Y., Schneider, J., Sivan, B.: Strategizing against no-regret learners. In: Advances in Neural Information Processing Systems 32 (NeurIPS) (2019) [28] Doval, L., Skreta, V.: Mechanism design with limited commitment. Econometrica 90(4), 1463–1500 (2022) [29] Dube, T.: Delegated-play experiments: Code and data. Zenodo, https://doi.org/10.5281/zenodo.21380456 (2026) [30] Dube, T.: A research library for simulating markets populated by LLM and zero-intelligence agents. https://github.com/takschdube/llm-market-sim (2026), version 0.2.0 [31] Dütting, P., Mirrokni, V., Paes Leme, R., Xu, H., Zuo, S.: Mechanism design for large language models. In: Proceedings of the ACM Web Conference 2024 (W). p. 144–155 (2024), arXiv:2310.10826 [32] Feng, Z., Schrijvers, O., Sodomka, E.: Online learning for measuring incentive compatibility in ad auctions (2019), arXiv:1901.06808 [33] Fershtman, C., Judd, K.L.: Equilibrium incentives in oligopoly. American Economic Review 77(5), 927–940 (1987) [34] Fish, S., Gonczarowski, Y.A., Shorrer, R.I.: Algorithmic collusion by large language models (2024), arXiv:2404.00806 [35] Forges, F.: An approach to communication equilibria. Econometrica 54(6), 1375–1385 (1986) [36] Frankel, A.: Aligned delegation. American Economic Review 104(1), 66–83 (2014) [37] Gibbard, A.: Manipulation of voting schemes: A general result. Econometrica 41(4), 587–601 (1973) [38] Gopalan, P., Nisan, N., Roughgarden, T.: Public projects, Boolean functions, and the borders of Border’s theorem. In: Proceedings of the 2015 ACM Conference on Economics and Computation (EC) (2015), arXiv:1504.07687 [39] Hardt, M., Megiddo, N., Papadimitriou, C., Wootters, M.: Strategic classification. In: Proceedings of the 2016 ACM Conference on Innovations in Theoretical Computer Science (ITCS). p. 111–122 (2016), arXiv:1506.06980 [40] Holmström, B.: On the theory of delegation. In: Boyer, M., Kihlstrom, R.E. (eds.) Bayesian Models in Economic Theory, p. 115–141. North-Holland (1984) [41] Hoshino, Y., Kitadai, A., Nishino, N.: Do matching mechanisms work with LLM agents? (2026), arXiv:2606.03030 [42] Huang, D., Marmolejo-Cossío, F., Lock, E., Parkes, D.C.: Accelerated preference elicitation with LLM-based proxies. In: Proceedings of the 21st Conference on Web and Internet Economics (WINE) (2025), arXiv:2501.14625 [43] Kephart, A., Conitzer, V.: The revelation principle for mechanism design with reporting costs. In: Proceedings of the 2016 ACM Conference on Economics and Computation (EC). p. 85–102 (2016) [44] Kleinberg, J., Kleinberg, R.: Delegated search approximates efficient search. In: Proceedings of the 2018 ACM Conference on Economics and Computation (EC). p. 287–302 (2018) [45] Kleine Büning, T., Gan, J., Mandal, D., Kwiatkowska, M.: Strategyproof reinforcement learning from human feedback (2025), arXiv:2503.09561 [46] Kolumbus, Y., Nisan, N.: Auctions between regret-minimizing agents. In: Proceedings of the ACM Web Conference 2022 (W). p. 100–111 (2022), arXiv:2110.11855 [47] Kolumbus, Y., Nisan, N.: How and why to manipulate your own agent: On the incentives of users of learning agents. In: Advances in Neural Information Processing Systems 35 (NeurIPS) (2022), arXiv:2112.07640 [48] Li, J., Tang, P.: Vulnerabilities of single-round incentive compatibility in auto-bidding: Theory and evidence from ROI-constrained online advertising markets. In: Proceedings of the 33rd International Joint Conference on Artificial Intelligence (IJCAI). p. 2886–2894 (2024), arXiv:2210.06107 [49] Liaw, C., Zhu, W.: Risk-averse and optimistic advertiser incentive compatibility in auto-bidding (2025), arXiv:2508.16823 [50] Maurer, A., Pontil, M.: Empirical Bernstein bounds and sample variance penalization. In: Proceedings of the 22nd Conference on Learning Theory (COLT) (2009) [51] Myerson, R.B.: Incentive compatibility and the bargaining problem. Econometrica 47(1), 61–73 (1979) [52] Myerson, R.B.: Optimal auction design. Mathematics of Operations Research 6(1), 58–73 (1981) [53] Myerson, R.B.: Multistage games with communication. Econometrica 54(2), 323–358 (1986) [54] Nisan, N., Segal, I.: The communication requirements of efficient allocations and supporting prices. Journal of Economic Theory 129(1), 192–224 (2006) [55] Parkes, D.C., Wellman, M.P.: Economic reasoning and artificial intelligence. Science 349(6245), 267–272 (2015) [56] Pieroth, F.R., Sandholm, T.: Verifying approximate equilibrium in auctions (2024), arXiv:2408.11445 [57] Rubinstein, A.: Settling the complexity of computing approximate two-player nash equilibria. In: Proceedings of the 57th IEEE Symposium on Foundations of Computer Science (FOCS). p. 258–265 (2016) [58] Shah, A., Zhu, K., Jiang, Y., Wang, J.G., Dayi, A.K., Horton, J.J., Parkes, D.C.: Learning from synthetic labs: Language models as auction participants (2025), arXiv:2507.09083 [59] Sugaya, T., Wolitzky, A.: The revelation principle in multistage games. Review of Economic Studies 88(3), 1503–1540 (2021) [60] Tennenholtz, M.: Program equilibrium. Games and Economic Behavior 49(2), 363–373 (2004) [61] Wei, A., Haghtalab, N., Steinhardt, J.: Jailbroken: How does LLM safety training fail? In: Advances in Neural Information Processing Systems 36 (NeurIPS) (2023) [62] You, S., Zhuang, Z., Wang, K., Wang, Z.: Bridging the gap between estimated and true regret towards reliable regret estimation in deep learning based mechanism design (2026), arXiv:2601.13489 [63] Zou, A., Wang, Z., Carlini, N., Nasr, M., Kolter, J.Z., Fredrikson, M.: Universal and transferable adversarial attacks on aligned language models. arXiv preprint arXiv:2307.15043 (2023) Appendix 0.A Additional empirical detail This appendix collects the supporting figures for the empirical study of Section 7: the within-range gap across random games, the analytic soft-cap profile, and the sampling certificate’s behaviour. All runs use the llm-market-sim library [30] and its delegation harness, archived with the reproduction code [29]. Figure 3 plots the per-model within-range regret; the exact values and the report inflation are collected in Table 3. The language-model sweep ran between 11 and 14 July 2026; each call’s model identifier, a provider alias for most models and a dated snapshot for others, and its UTC timestamp are recorded in the raw log, so a provider’s silent update to any alias is, in the terms of Definition 2, an uncertified change to h(π)h(π). Table 3: Per-model within-range regret WiW_i and report inflation for the 25 models of Figure 3 (mean over true values v∈100,…,300v∈\100,…,300\). Model Provider WiW_i Inflation GPT-5.5 OpenAI 5.795.79 1.76×1.76× GPT-5.4 OpenAI 5.795.79 1.76×1.76× GPT-5.1 OpenAI 5.795.79 1.76×1.76× GPT-5 OpenAI 5.795.79 1.76×1.76× GPT-5 mini OpenAI 5.795.79 1.76×1.76× GPT-4.1 OpenAI 5.795.79 1.76×1.76× GPT-4o OpenAI 5.775.77 1.67×1.67× GPT-4o mini OpenAI 4.554.55 1.22×1.22× o3 OpenAI 5.795.79 1.76×1.76× o4-mini OpenAI 5.795.79 1.76×1.76× Claude Opus 4.8 Anthropic 5.385.38 1.51×1.51× Claude Opus 4.1 Anthropic 5.455.45 1.54×1.54× Claude Sonnet 5 Anthropic 5.795.79 1.76×1.76× Claude Sonnet 4.6 Anthropic 5.575.57 1.44×1.44× Claude Haiku 4.5 Anthropic 3.763.76 1.35×1.35× Claude Fable 5 Anthropic 5.795.79 1.76×1.76× Gemini 3.5 Flash Google 5.795.79 1.76×1.76× Gemini 2.5 Pro Google 5.795.79 1.76×1.76× Gemini 2.5 Flash Google 5.795.79 1.76×1.76× Gemini 2.5 Flash-Lite Google 2.242.24 1.38×1.38× DeepSeek-V4 Pro DeepSeek 5.795.79 1.76×1.76× DeepSeek-V4 Flash DeepSeek 5.795.79 1.76×1.76× Grok 4.3 xAI 5.795.79 1.76×1.76× Grok 4.20 (reasoning) xAI 5.795.79 1.76×1.76× Grok 4.20 (non-reasoning) xAI 5.505.50 1.73×1.73× Within-range regret is genuinely smaller than unrestricted regret (Fig. 5). Across 60,00060,000 random finite Bayesian games with random proxy ranges, WiW_i is strictly below RiR_i in 58%58\% of instances, with Wi=0W_i=0 outright in 20%20\% (the reachable set already contains the honest optimum), mean Ri=1.64R_i=1.64 against mean Wi=1.17W_i=1.17. The identity Gi=WiG_i=W_i and the bound Gi≤RiG_i≤ R_i hold with no violations, computed through independent code paths. 00.50.5111.51.5222.52.5333.53.54401010k2020k3030kRi−WiR_i-W_icount (a) the Ri−WiR_i-W_i gap 0224402244unrestricted regret RiR_iwithin-range regret WiW_i (b) WiW_i against RiR_i Figure 5: (a) The Ri−WiR_i-W_i gap across 60,00060,000 random games and (b) WiW_i against RiR_i with the W=RW=R diagonal. The proxy’s range removes real regret in most games, so WiW_i, not RiR_i, governs misreporting. Guardrails inflate reports exactly where they bind (Fig. 6). A soft cap on a bid-scaling proxy leaves within-range regret and report inflation at zero until the cap binds (v>2γv>2γ), then both turn on, the field prediction of Corollary 1. Of 6060 principals, the 4444 for whom the cap binds all inflate and all have Wi>0W_i>0. 2γ2 1122111.51.522true value vvreport inflation t⋆/vt /v (a) report inflation 2γ2 112200.10.10.20.2true value vvwithin-range regret W (b) within-range regret Figure 6: (a) Report inflation and (b) within-range regret against the true value v for the soft-cap proxy, both flat until the cap binds at v=2γv=2γ (dashed) and rising past it; within-range regret grows as W=0.09(v−2γ)2W=0.09\,(v-2γ)^2 in this example, the quadratic being the (ε,μ2ε2)( , μ2 ^2)-sharpness of Proposition 2 with binding distance ε∝v−2γ v-2γ. The measured sweep traces the same profile on the models themselves. Pooling the seventeen models that share the rational bid, within-range regret and report inflation both rise with v (Table 4), the empirical counterpart of the analytic curves above: the regret is quadratic in v−2γv-2γ (with 2γ=802γ=80) to the displayed precision through v=250v=250 (the grid discretizes the continuum values 0.117,1.467,…0.117,1.467,…), the top point shaved by 0.120.12 where the bid ceiling caps the frontier at c(300)=144c(300)=144 (14.4014.40 against the quadratic’s 14.5214.52), and the inflation concentrates where the cap binds hardest, as Corollary 1 predicts. Table 4: Per-value within-range regret and report inflation for the headline cluster, the seventeen models that share the rational bid, the empirical counterpart of the analytic profile in Figure 6. Both rise with the true value v. true value v 100100 150150 200200 250250 300300 within-range regret WiW_i 0.120.12 1.471.47 4.324.32 8.678.67 14.4014.40 report inflation 1.25×1.25× 1.67×1.67× 1.88×1.88× 2.00×2.00× 2.00×2.00× The certificate tracks the true gain and re-certifies under drift (Fig. 7). The sampling certificate’s estimate of the maximum manipulation gain decays toward the truth at the 1/N1/ N rate, and under a stream of proxy updates the number of re-certifications stays under the Proposition 7 bound and grows linearly in the total drift budget BTB_T, not the number of updates. 242^4252^5262^6272^7282^8292^92102^102112^1110−210^-210−1.510^-1.5samples N|g^−g|| g-g|1/N1/ Nestimate error (a) certificate error 02244668810101212141416161818202005050100100150150200200drift budget BTB_Tre-certificationsProp. 7 boundre-certifications (b) re-certification count Figure 7: (a) The sampling certificate’s error against N, decaying at the 1/N1/ N rate. (b) The re-certification count against the drift budget BTB_T, staying under the Proposition 7 bound and scaling with BTB_T, not the number of updates. Appendix 0.B Deferred proofs Each result of Sections 4.1–6 is stated in the body and proved here, followed by the supporting and technical results. Proposition 1 (inheritance). There are two claims: that Γπ ^π is interim ε -IC, and that truthful reporting reproduces the play of π. Fix an agent i, its true type θi _i, and an arbitrary report ti∈Θit_i∈ _i, and hold the opponents to truthful reporting, so they send the messages π−i _-i. The report is consumed only by the proxy, which converts tit_i into the message πi(ti)∈Mi _i(t_i)∈ M_i; the mechanism then sees πi(ti) _i(t_i) against π−i _-i. Reporting tit_i yields interim utility Ui(πi(ti),π−i∣θi)U_i( _i(t_i), _-i _i) and reporting truthfully yields Ui(πi(θi),π−i∣θi)U_i( _i( _i), _-i _i), abbreviated Ui(π∣θi)U_i(π _i), and the gain is bounded in three steps: Ui(πi(ti),π−i∣θi)−Ui(π∣θi)≤maxm∈MiUi(m,π−i∣θi)−Ui(π∣θi)≤Ri(π)≤ε.U_i( _i(t_i), _-i _i)-U_i(π _i)\;≤\; _m∈ M_iU_i(m, _-i _i)-U_i(π _i)\;≤\;R_i(π)\;≤\; . The first inequality holds because πi(ti) _i(t_i) is one message in MiM_i; the middle quantity is the interim regret at θi _i, at most Ri(π)R_i(π); the last is the ε -BNE hypothesis maxiRi(π)≤ε _iR_i(π)≤ . As i,θi,tii, _i,t_i were arbitrary, Γπ ^π is interim ε -IC. For the second claim, under truthful reporting each agent j sends πj(θj) _j( _j), so the outcome is (g∘π)(θ)(g π)(θ), exactly the play of π in Γ at θ. ∎ Lemma 1 (the input game is the coarsened base game). Fix π and an agent i. A report strategy τi:Θi→Θi _i: _i→ _i composed with the proxy gives the base-game strategy πi∘τi:Θi→Mi _i _i: _i→ M_i, whose range lies in ReachiReach_i since each πi(τi(θi))∈πi(Θi)=Reachi _i( _i( _i))∈ _i( _i)=Reach_i. Onto: for any base strategy sis_i with si(Θi)⊆Reachis_i( _i) _i and each θi _i, the preimage πi−1(si(θi)) _i^-1(s_i( _i)) is nonempty; choosing τi(θi) _i( _i) in it gives πi∘τi=si _i _i=s_i. Utility preservation: at a report profile τ the wrapped mechanism plays g((πj(τj(θj)))j)g (( _j( _j( _j)))_j ), so Uiinput(τ∣θi)=Ui((πj∘τj)j∣θi)U_i^input(τ _i)=U_i (( _j _j)_j _i ), which depends on τi _i only through πi∘τi _i _i. Hence τ is an interim (ε -)equilibrium of the input game iff the composed profile is one of Γ among the ReachReach-valued strategies. ∎ Corollary 1 (guardrails). The guardrailed proxy πi′=c∘πiπ _i=c _i is itself a proxy, with reachable set Reachi′=c(Reachi)Reach _i=c(Reach_i), so Theorem 4.1 applies verbatim. By hypothesis πi′(θi)π _i( _i) does not maximize Ui(⋅,π−i∣θi)U_i(·\,, _-i _i) over Reachi′Reach _i, so Wi(θi;π′)>0W_i( _i;π )>0, and by Theorem 4.1(i) Gi(θi;π′)=Wi(θi;π′)>0G_i( _i;π )=W_i( _i;π )>0. ∎ Theorem 4.1 (truth-to-proxy). All three claims rest on one observation: as the report tit_i ranges over Θi _i, the message πi(ti) _i(t_i) ranges over exactly πi(Θi)=Reachi _i( _i)=Reach_i and nothing else, so choosing a report is choosing a reachable action. (i) Maximizing utility over reports equals maximizing over ReachiReach_i, maxti∈ΘiUi(πi(ti),π−i∣θi)=maxm∈ReachiUi(m,π−i∣θi) _t_i∈ _iU_i( _i(t_i), _-i _i)= _m _iU_i(m, _-i _i); subtracting the honest payoff Ui(πi(θi),π−i∣θi)U_i( _i( _i), _-i _i) turns the two sides into Gi(θi;π)G_i( _i;π) and Wi(θi;π)W_i( _i;π), so Gi=WiG_i=W_i. (i) Since Reachi⊆MiReach_i M_i, the maximum over ReachiReach_i is at most that over MiM_i; subtracting the honest payoff, Wi(θi;π)≤maxm∈MiUi(m,π−i∣θi)−Ui(πi(θi),π−i∣θi)≤Ri(π)W_i( _i;π)≤ _m∈ M_iU_i(m, _-i _i)-U_i( _i( _i), _-i _i)≤ R_i(π), the last step because Ri(π)R_i(π) maximizes this term over types; with (i), Gi≤Ri(π)G_i≤ R_i(π). (i) Honest reporting is interim optimal iff Gi(θi;π)=0G_i( _i;π)=0, iff Wi(θi;π)=0W_i( _i;π)=0 by (i), which is range-optimality at θi _i; hence Γπ ^π is exactly IC iff π is range-optimal at every type of every agent. ∎ Theorem 5.1 (the trilemma). Assume two of the three properties, truthfulness and capability-preservation, and derive the failure of the third; so suppose c is both truthful and capability-preserving at θi _i. Capability-preservation gives a⋆∈Reachi′a _i. Because Reachi′⊆ReachiReach _i _i, because a⋆a already maximizes Ui(⋅,π−i∣θi)U_i(·\,, _-i _i) over the larger set ReachiReach_i, and because a⋆∈Reachi′a _i, the action a⋆a maximizes the same utility over the smaller set as well, so maxm∈Reachi′Ui(m,π−i∣θi)=Ui(a⋆,π−i∣θi) _m _iU_i(m, _-i _i)=U_i(a , _-i _i). Truthfulness, Wi(θi;π′)=0W_i( _i;π )=0, says the guardrailed honest action c(πi(θi))c( _i( _i)) attains this constrained maximum, hence earns the same utility as a⋆a ; since a⋆a is the unique maximizer over Reachi⊇Reachi′Reach_i _i, the two coincide, c(πi(θi))=a⋆c( _i( _i))=a , the negation of binding. Truthfulness and capability-preservation therefore force non-binding, and any two of the three preclude the third. ∎ Proposition 2 (conservation of the binding loss). The within-range regret is Wi(θi;π′)=maxm∈Reachi′Ui(m,π−i∣θi)−Ui(c(πi(θi)),π−i∣θi)W_i( _i;π )= _m _iU_i(m, _-i _i)-U_i(c( _i( _i)), _-i _i), so the two losses telescope: κ+Wi(θi;π′)=U⋆−Ui(c(πi(θi)),π−i∣θi)κ+W_i( _i;π )=U -U_i(c( _i( _i)), _-i _i). The guardrailed honest action lies in Reachi′⊆ReachiReach _i _i and, by ε -binding, at distance at least ε from a⋆a , so sharpness caps its value at U⋆−δU -δ. Hence κ+Wi≥δκ+W_i≥δ. ∎ Lemma 2 (loyalty). At the true type θi _i, loyalty makes the honest action πi(θi) _i( _i) a maximizer of Ui(⋅,π−i∣θi)U_i(·\,, _-i _i) over CiC_i, so honest reporting attains maxm∈CiUi(m,π−i∣θi) _m∈ C_iU_i(m, _-i _i). The proxy produces only actions in CiC_i, so Reachi⊆CiReach_i C_i and the within-range maximum over ReachiReach_i cannot exceed this value. The gap defining Wi(θi;π)W_i( _i;π) is therefore at most zero, and since WiW_i is never negative it is exactly zero. The mechanism g entered nowhere, so the conclusion holds for any g under whose interim utilities the proxy is loyal in this sense. If every proxy is loyal over such a class, this gives Wj=0W_j=0 for all j, and Γπ ^π is incentive-compatible by Theorem 4.1(i). ∎ Proposition 3 (placement). Let U′=maxm∈Reachi′Ui(m,π−i∣θi)U = _m _iU_i(m, _-i _i) be the constrained maximum; the guardrail is truthful iff its honest output attains U′U (Wi=0W_i=0) and capability-preserving iff a⋆∈Reachi′a _i, in which case a⋆a is the unique maximizer over Reachi′⊆ReachiReach _i _i and U′=Ui(a⋆,π−i∣θi)U =U_i(a , _-i _i). A non-binding guardrail has c(πi(θi))=a⋆∈Reachi′c( _i( _i))=a _i, so it is capability-preserving, and its honest output attains U′U , so Wi=0W_i=0: truthful. If the proxy re-optimizes over its constrained feasible set, its honest output maximizes over that set and hence over Reachi′Reach _i (Lemma 2), so Wi=0W_i=0. If the output is instead clipped away from the reachable maximizer, its honest output does not attain U′U , so Wi>0W_i>0; a clip is a fixed post-map, re-optimizing nothing, and in the output-clipping corner a⋆∈Reachi′a _i is the unique maximizer it misses. Capability is preserved exactly when a⋆a survives the constraint. Finally, a truthful and capability-preserving guardrail has its honest output maximize over Reachi′Reach _i while a⋆∈Reachi′a _i is the unique maximizer, so the honest output equals a⋆a : unchanged, hence non-binding. No binding guardrail is both, which is Theorem 5.1. ∎ Proposition 4 (dominant-strategy neutrality). Fix i and θi _i. By hypothesis ai⋆(θi)a _i( _i) maximizes Ui(⋅,m−i∣θi)U_i(·\,,m_-i _i) over ReachiReach_i for every m−i∈Reach−im_-i _-i, and ai⋆(θi)∈Reachi′⊆Reachia _i( _i) _i _i; since a maximum over the larger set is attained inside the subset, ai⋆(θi)a _i( _i) also maximizes over Reachi′Reach _i against every m−i∈Reach−i′⊆Reach−im_-i _-i _-i, so it is weakly dominant in the guarded game as well. Both games therefore have (ai⋆(θi))i(a _i( _i))_i as a weakly-dominant-strategy equilibrium, unique in the unguarded game because ai⋆a _i is; in the guarded game dominance is only required against Reach−i′Reach _-i, so ties may appear and uniqueness need not survive. Capability-preservation supplies reports ti,ti′t_i,t _i with πi(ti)=πi′(ti′)=ai⋆(θi) _i(t_i)=π _i(t _i)=a _i( _i), so both equilibria send the identical message profile to g at every type profile and induce the same allocation, payments, revenue, and welfare; the realizing reports differ, and for a monotone compressive cap the guarded report is the larger. ∎ Proposition 5 (a capability-preserving guardrail can destroy welfare). Take the stag hunt of the body with two types per agent, a uniform prior, and a type-faithful proxy πi _i whose two type-images are hare and stag, so Reachi=,Reach_i=\ hare, stag\; payoffs are type-independent. Against the honest opponent, an equal mix of hare and stag, the reply hare earns 33 and stag earns 22, so ai⋆(θi)=a _i( _i)= hare at both types. The guardrail c with c()=c()=c( stag)=c( hare)= hare is range-restricting, Reachi′=Reach _i=\ hare\, and capability-preserving, ai⋆=∈Reachi′a _i= hare _i. The report profile in which each agent sends the type reaching stag is an interim equilibrium of the unguarded input game, since stag is a best reply to stag (4>34>3); its outcome (,)( stag, stag) has welfare 88. The guarded game reaches only hare, so its sole outcome is (,)( hare, hare), welfare 66, and no guarded equilibrium reproduces (,)( stag, stag). Restoring a third preserved message (Reachi=,,Reach_i=\ hare, alt, stag\ with c deleting only stag) leaves Reachi′Reach _i non-degenerate without changing the argument. ∎ Proposition 6 (exact certification is intractable). Both reductions represent g and the proxies as polynomial-size circuits, so g∘πg π evaluates in polynomial time and the hardness lies in counting and quantifying over types, not in the representation. (i) Reduce from Sat. Given a formula ϕφ over x1,…,xn−1x_1,…,x_n-1, let agents 2,…,n2,…,n have binary types t−1∈0,1n−1t_-1∈\0,1\^n-1 (a truth assignment), agent 11 have true type θ0θ^0 and alternative report θ1θ^1, outcomes 0,1\0,1\ with u1(1,θ0)=1>u1(0,θ0)=0u_1(1,θ^0)=1>u_1(0,θ^0)=0, each proxy the identity, and g(t1,t−1)=ϕ(t−1)g(t_1,t_-1)=φ(t_-1) if t1=θ1t_1=θ^1 and 0 otherwise. All remaining utilities are constant, agent 11’s at θ1θ^1 and every agent j≥2j≥ 2’s at all types, so truthful reporting is trivially dominant for them and the only agent-type that can violate IC is agent 11 at θ0θ^0. There, truthful reporting yields 0 and θ1θ^1 yields ϕ(t−1)φ(t_-1), so agent 11 has a profitable misreport iff ϕφ is satisfiable; thus g∘πg π is exactly dominant-strategy IC iff ϕφ is unsatisfiable. Membership in coNP holds because a violating tuple is checked by two circuit evaluations. (i) With opponents’ types uniform on 0,1n−1\0,1\^n-1, the interim utility of θ1θ^1 at θ0θ^0 is t−1[ϕ(t−1)]=#t−1:ϕ(t−1)=1/2n−1E_t_-1[φ(t_-1)]=\#\t_-1:φ(t_-1)=1\/2^n-1, so G1(θ0;π)=#ϕ/2n−1G_1(θ^0;π)=\#φ/2^n-1; computing G1G_1 counts satisfying assignments, and #\#Sat is #\#P-complete. ∎ Lemma 3 (drift). Fix i,θi, _i and a report tit_i. The term Ui(πi(ti),π−i∣θi)U_i( _i(t_i), _-i _i) is the expectation over θ−i _-i of uiu_i at the message profile (πi(ti),π−i(θ−i))( _i(t_i), _-i( _-i)); under the update each of its n coordinates moves by at most Δ , so by the L-Lipschitz hypothesis (applied at each θ−i _-i and averaged) the term shifts by at most LnΔLn . The gain Gi(θi;⋅)G_i( _i;·) is a maximum of such terms minus one such term; a maximum of functions each moving by ≤LnΔ≤ Ln moves by ≤LnΔ≤ Ln , so by the triangle inequality |Gi(θi;π′)−Gi(θi;π)|≤2LnΔ|G_i( _i;π )-G_i( _i;π)|≤ 2Ln . ∎ Proposition 7 (online re-certification under a drift budget). Let last(t)last(t) be the epoch of the most recent fresh certificate, with bound ε^last 2.0mu -2.0mu_last valid (probability 1−δ1-δ) at issuance. Telescoping Lemma 3 along πlast(t)→⋯→πtπ^last(t)→·s→π^t gives maxi,θiGi(θi;πt)≤ε^+last2Ln∑r=last(t)t−1Δr=ε^+lastAt _i, _iG_i( _i;π^t)≤ 2.0mu -2.0mu_last+2Ln _r=last(t)^t-1 _r= 2.0mu -2.0mu_last+A_t, with AtA_t the drift accumulator (reset at each issuance). The policy re-estimates before AtA_t exceeds s, so the live bound ε^+lasts 2.0mu -2.0mu_last+s dominates the true gain at every epoch, giving (i). For (i), each re-certification after the first consumes s of the total accumulator mass 2Ln∑t<TΔt=2LnBT2Ln _t<T _t=2Ln\,B_T, giving at most ⌈2LnBT/s⌉ 2Ln\,B_T/s triggers plus the initial one; a union bound over the K=⌈2LnBT/s⌉+1K= 2Ln\,B_T/s +1 certificates gives confidence 1−Kδ1-Kδ. ∎