Rejection-proof mechanisms for multi-agent kidney exchange

Kidney exchange programs (KEPs) increase kidney transplantation by facilitating the exchange of incompatible donors. Increasing the scale of KEPs leads to more opportunities for transplants. Collaboration between transplant organizations (agents) is thus desirable. As agents are primarily interested in providing transplants for their own patients, collaboration requires balancing individual and common objectives. In this paper, we consider ex-post strategic behavior, where agents can modify a proposed set of kidney exchanges. We introduce the class of rejection-proof mechanisms, which propose a set of exchanges such that agents have no incentive to reject them. We provide an exact mechanism and establish that the underlying optimization problem is Σ P 2 -hard; we also describe computationally less demanding heuristic mechanisms. We show rejection-proofness can be achieved at a limited cost for typical instances. Furthermore, our experiments show that the proposed rejection-proof mechanisms also remove incentives for strategic behavior in the ex-ante setting, where agents withhold information.


Introduction
For patients suffering from end-stage renal disease, a kidney transplant from a living donor is the preferred treatment option.A donor must be medically compatible with the recipient, which means some recipients cannot receive a transplant, even though they have a donor willing to undergo a transplant for them.We refer to such a combination of recipient and donor as an (incompatible) pair.Kidney exchange programs (KEPs), introduced by Rapaport (1986) and popularized by Roth et al. (2004Roth et al. ( , 2005)), aim to match the recipients from a pair with compatible donors from other pairs.Donors in a pair only donate if their paired recipient receives a transplant in return, leading to cycles of transplants.Kidney exchange programs may also include so-called non-directed donors (NDDs).Non-directed donors are not associated with any recipient and are willing to donate to any recipient in the program, leading to donation chains.In a KEP, exchanges are based on a compatibility graph that reflects the medical compatibilities between donors and recipients, and a solution in a KEP typically consists of a disjoint set of cycles (of length at most ) and chains (of length at most ).Fig. 1 illustrates an example of a compatibility graph and a corresponding solution.Kidney exchange programs are widely used and are still expanding.We refer to Biró et al. (2019) for a recent overview of the practice in Europe.
Solutions in kidney exchange programs generally improve with an increase in the number of potentially successful donors, i.e., the size of the pool.For example, Agarwal et al. (2020) show that in the US, fragmentation of kidney exchanges over separate hospital, regional and national programs leads to a yearly loss of hundreds of transplants compared to a more centralized kidney exchange program, see also Melcher et al. (2013).The presence of an arc (, ) signifies compatibility of the donor of  and the recipient of .The bold arcs represent a feasible KEP solution, which features a cycle between pairs 3 and 5 and a chain from NDD 1 to pair 2 and on to pair 4.

Fig. 2.
The social optimum of this 2-agent kidney exchange instance is given by the cycle (, 1, 2), which provides 3 transplants.However, the red agent prefers the cycle (, ), as both transplants in this cycle are for red recipients.
Fig. 3.The social optimum (left) consists of two 3-cycles (, 1, 2) and (, 3, 4).If this is the proposed solution, the red agent has the incentive to reject the cycle (, 3, 4) and internally match (, ), resulting in the solution on the right, thereby increasing the number of transplants for the red agent.
Within Europe, several countries have started international cooperations known as multi-agent kidney exchange programs (m-KEP) to increase pool size (Böhmig et al., 2017;Valentín et al., 2019).
While multi-agent kidney exchanges aim to increase the total number of transplants, the competing goals of countries or individual transplant centers (whom we will refer to as agents) raise issues.Indeed, single agents are primarily interested in transplanting their patients, rather than achieving the overall social optimum, e.g., the maximum number of transplants over all agents.For example, we may consider the example in Fig. 2 taken from Ashlagi and Roth (2014), in which the red agent prefers the solution that follows from deviating from cooperation, over the solution that is a social optimum.We also note agent objectives can differ from simple transplant maximization, possibly leading to further misalignment of objectives (see Biró et al. (2019) for an overview of kidney exchange objectives in Europe).Furthermore, different agents might face different legislative constraints.Indeed, the maximum allowed length of a cycle might differ between countries.For example, in the Austrian-Czech collaboration, Austria allows only short (simultaneous) cycles, whereas the Czech Republic allows for larger and non-simultaneous cycles as well, see, e.g., Mincu et al. (2021).
Thus, when designing mechanisms for m-KEPs, we must consider the strategic behavior of agents that is aimed at increasing transplants for their own patients.Typically, m-KEP is modeled as a private information game, where agents first decide on their withholding strategy, a term coined by Ashlagi and Roth (2014).A withholding strategy is a decision, to be made by an agent, on which of their pairs and NDDs to report to, and which to withhold from, the collaboration.This collaboration can be regarded as an independent decision-making entity, whose goal is to propose a kidney exchange solution that is optimal with respect to some predefined (hierarchy) of objectives, using the pairs and NDDs revealed to it.We will refer to the set of pairs and non-directed donors revealed to the collaboration as the common pool.Finally, each agent can then also select transplants for its unmatched pairs, which can either be pairs that were hidden from the collaboration, or pairs that were revealed to the collaboration yet not part of the collaboration's proposed transplant plan (Ashlagi and Roth, 2014).We refer to this setting as the ex-ante setting, as each agent makes their decision before the solution is proposed by the collaboration.
In this paper, we introduce the ex-post setting.Here the collaboration first proposes a solution, and then agents can use so-called rejection strategies to decide whether to reject (part of) this proposed solution.This entails withdrawing pairs and NDDs from cycles and chains from the proposed solution.In addition, the agents can identify new internal cycles and chains with pairs or NDDs that were either withdrawn or unmatched in the proposed solution.An example is given in Fig. 3.
The ex-post setting differs from the more traditional ex-ante setting in two aspects.First, in the ex-post setting, we assume that the collaboration has full information on the individual agents' pools and the corresponding compatibilities.Secondly, in the expost setting agents can evaluate the solution determined by the collaboration, withdraw pairs from proposed exchanges, and use alternative internal exchanges.
To support the first assumption, we note that, in practice, a collaboration between hospitals often implies the disclosure of information about each other's patients.We also point out that in the ex-ante setting it is a computational challenge for an individual agent to determine an optimal withholding strategy, even when given full information.Indeed, Smeulders et al. (2022) show that identifying an optimal withholding strategy is already Σ P 2 -hard in such a setting.Uncertainty about the pools of other agents and the strategic interaction further complicate the problem.These difficulties form an incentive for agents to provide full information.Of course, an agent may still resort to heuristic strategies.Ashlagi and Roth (2014) identify a heuristic strategy that involves an agent withholding a subset of its pairs for internal exchanges.Although such a strategy can lead to transplants for more of the agents' patients for some specific m-KEP mechanisms, we will show empirically, using both established and state-of-the-art instance generators, that this is typically not the case for the mechanisms proposed in this paper.
The second assumption is justified by the setting of organ transplantation.Ethical and legal considerations make binding agreements to execute proposed transplant plans impossible, as donors and recipients can never be forced or pressured to undergo transplantation.Agents thus have the option of rejecting proposed solutions.This possibility for agents to reject exchanges also diminishes the risk of agents of contributing all their pairs to the collaboration, thus providing more support for the first assumption as well.
All this motivates a concept that we study in this contribution: solutions that are rejection-proof (see Section 2 for formal definitions).The goal of this paper is to study mechanisms that lead to solutions such that no agent has the incentive to withdraw a pair or NDD from the proposed solution.

Structure of the paper
The paper unfolds as follows.We briefly survey related literature in Subsection 1.2.Next, in Section 2, we introduce the necessary notation as well as the definitions of withholding strategies relevant in an ex-ante setting, and rejection strategies relevant in an expost setting.This allows us to introduce the rejection-proofness property.We also link rejection-proof solutions to Nash equilibria in a related kidney exchange game.In Section 3 we further motivate our choice to study the ex-post setting by experimentally comparing withholding strategies and rejection strategies.We find that rejection strategies lead to better solutions for individual agents who employ such strategies than withholding strategies.Thus, an ex-post setting may offer more potential for finding good solutions than an ex-ante setting.Sections 4 and 5 introduce our specific rejection-proof mechanisms.The first mechanism, Maximum Rejectionproof KEP (MAXRP-KEP), always finds, among the set of rejection-proof solutions, one for which social welfare value is maximized.
Notice, however, that the problem of finding such a solution is shown to be Σ P 2 -hard, and the mechanism thus needs to solve a computationally challenging optimization problem.
The second mechanism, Maximum Internal Transplants (MAXINT), is inspired by current practice and is easy to compute.However, the solution it finds, while rejection-proof, may not be a social optimum.The final mechanism, the Reject-and-Rebuild (RR) mechanism, mimics the process where each agent employs rejection strategies until stability is reached.Whenever stability is attained, the mechanism considers if additional exchanges can be selected involving currently unmatched pairs and NDDs, and adds these to the current solution.Each of these three mechanisms returns a rejection-proof solution which is also a maximal feasible kidney exchange solution, i.e., there exists no alternative kidney exchange solution with a strict superset of exchanges.In Section 6, we describe the outcomes of all mechanisms.Firstly, we study the impact of each of the three mechanisms on the social welfare value of the returned solutions.Furthermore, we consider computation times for the exact mechanism, for different choices of exchange weights.We finish the paper with a discussion in Section 7.

Related literature
This paper is part of a growing literature on multi-agent kidney exchange programs.Starting with Sönmez and Ünver (2013) and Ashlagi and Roth (2014), the main focus has been on withholding strategies and mechanisms to incentivize agents to reveal their complete pools.In multi-period settings, a number of credit mechanisms have been proposed.Hajaj et al. (2015) proposes awarding credits based on the differences between the expected and reported numbers of pairs by an agent, this mechanism is strategy-proof assuming the expected number of pairs known.Agarwal et al. (2020) presents a system where expected marginal transplants per pair, based on blood type and PRA, are used to assign credits.Klimentova et al. (2020) propose two methods of assigning credits, the first based on the maximum number of transplants achievable for a patient, the second based on the marginal benefit an agent adds to overall transplants by joining the collaboration.Finally, Biró et al. (2020) proposes a mechanism based on Shapley values.In single-period settings, and limiting the maximum cycle length to 2, Ashlagi et al. (2015) present a strategy-proof randomized mechanism.For the same cycle length limits, Carvalho et al. (2017) and Carvalho and Lodi (2023) study a non-cooperative game where agents' strategies consist of selecting internal exchanges, and shared exchanges on remaining pairs are determined by an independent agent.They show social welfare Nash equilibria for these games can be efficiently computed.Finally, in Carvalho et al. (2022), a game is presented where agents' strategies consist of internal and shared exchanges.Exchanges proceed to transplant if all involved agents have this exchange in their strategy.
Settings of strategic interactions between the agents and the collaboration are typically modeled by a Stackelberg game, i.e., a type of sequential game in which a leader selects an initial strategy, after which a follower selects an optimal response strategy (von Stackelberg, 1952).The computational complexity of determining an optimal strategy is typically different for the leader and the follower.While the follower needs to solve an optimization problem parameterized by the leader's strategy, the leader also needs to anticipate the follower's optimal response to their decision.In particular, this means that the leader faces a bilevel optimization problem.
Clearly, bilevel optimization problems are intimately related to the ex-post setting in m-KEPs where the collaboration (the leader) first generates a solution after which the agents (the followers) act.In fact, our mechanism MAXRP-KEP falls into this paradigm.Therefore, we now compactly discuss some of the existing literature in this field; for surveys, we refer to Kleinert et al. (2021) and Beck et al. (2023).
When solving a bilevel optimization problem, its computational complexity becomes relevant.An important notion when solving multi-level optimization problems is the polynomial hierarchy (Stockmeyer, 1976).The polynomial hierarchy is a chain of complexity classes Σ P 0 ⊆ Σ P 1 ⊆ …, generalizing the notion of the classes P and NP.In particular, we have that Σ P 0 = P and Σ P 1 = NP.As a rule of thumb, whenever the decision version of follower's best-response problem is contained in Σ P −1 , the decision version of the problem faced by the leader is in Σ P  ( ≥ 1).In this paper, we will specifically consider the complexity class Σ P 2 .
In recent years, research has focused on bilevel optimization problems and their connections to Σ P 2 .In particular, there exists a natural connection between problems in the class NP and their Σ P 2 counterparts.Such a Σ P 2 counterpart can often be characterized by a bipartition of decision variables into sets  and  , with a question of the form "does there exist  ∈  such that for all  ∈  ,  (, ) is true", where  (, ) is a proposition that can be evaluated in polynomial time, see e.g.Woeginger ( 2021).
An important subclass of such problems is the class of adversarial problems.In an adversarial problem, the leader acts as an adversary, meaning that they aim at blocking the follower from attaining their (lower-level) objective as much as possible.Johannes (2011) proved that adversarial problems are Σ P 2 -hard, provided the non-adversarial counterpart is NP-hard and satisfies some other weak conditions.In this paper, although the problems we consider are not necessarily adversarial, the leader may aim at disincentivizing the follower from performing strategic behavior.Very often, bilevel optimization problems can be formulated as (mixed-)integer bilevel linear programming (MIBLP) (Jeroslow, 1985).As mixed-integer linear programming (MILP) is NP-hard in general, MIBLPs cannot be reformulated as a compact mixedinteger linear program unless NP = Σ P 2 (Lodi et al., 2014).When attempting to solve an MIBLP, an intuitive starting point is to first consider a relaxation of the problem, and next to iteratively solve the associated relaxed problem and cut away infeasible solutions (a strategy similar to strategies used for solving MILPs).A natural relaxation of bilevel optimization problems is the high-point relaxation (HPR), which is obtained by relaxing optimality of the lower-level solution to lower-level feasibility (Bialas and Karwan, 1984;Moore and Bard, 1990).One can further consider the linear relaxation of this high-point relaxation.As the high-point relaxation is typically a mixed-integer linear program, one can further consider the linear relaxation of HPR.Many HPR-based methods are inspired by conventional MILP techniques, such as branch-and-cut.One of the first branch-and-cut methods for MIBLP was proposed by DeNegre and Ralphs (2009), who use Chvátal-Gomory-like no-good cuts to separate a single bilevel infeasible point from the inducible region.Tahernejad et al. (2020) generalize this approach in the case of binary linking variables by introducing cuts separating all solutions for which the set of linking variables have some fixed value.
Another useful approach is to reformulate the bilevel problem as a single-level problem by means of a value function reformulation.In most settings, the value function relates to a highly nonconvex problem.Lozano and Smith (2017) propose a sampling-based reformulation based on the value-function using big-M constraints to guarantee bilevel feasibility of its solutions.Furthermore, Bolusani and Ralphs (2022) consider the connections of value functions and duality, and introduce a solution method based on approximating the value function with dual bounding functions.

Preliminaries and notation
The basic model for kidney exchange programs considers a directed graph  = ( , ) called the compatibility graph.Each vertex  ∈  corresponds to either an incompatible pair or a non-directed donor.We represent the set of pairs by   , and the set of nondirected donors by   , where  =   ∪   .Each arc (, ) ∈  indicates that the donor of  ∈  and the patient of  ∈   are medically compatible.
In multi-agent kidney exchange programs, hospitals and/or transplant centers (agents) are responsible for a set of pairs and NDDs.
To model this setting, the vertex set  is partitioned into subsets   =    ∪    for each agent  ∈ , where  denotes the set of agents.We have  = ⋃ ∈   and   ∩   = ∅ for ,  ∈ ,  ≠ .We call an arc (, ) ∈  internal (to agent  ∈ ) if {, } ⊆   , and shared if there exists no agent to whom (, ) is internal.This allows us to classify the arc set as  = ( ⋃ ∈   ) ∪  0 , where for each  ∈ , we denote by   the set of all arcs internal to , and by  0 the set of all shared arcs.Notice that this setting generalizes the basic model.Let  denote the set of cycles in  that can be used for cyclic exchanges (typically such cycles have a length bounded by an integer  ≥ 2).We use  () and () to denote the set of vertices and arcs respectively of cycle  ∈ .For each agent  ∈ , the set   ⊆  consists of the cycles  ∈  for which all arcs are internal to , i.e., the set of cycles  ∈  such that () ⊆   .We refer to   as the set of internal cycles of .The set of shared cycles is denoted by  0 =  ⧵ ( ⋃ ∈   ).The (social) value of cycle  ∈  is given by   ∈ ℝ ≥0 , and the value that  has to a certain agent  ∈  is denoted by    ∈ ℝ ≥0 .Note that the social welfare value of a cycle need not be strictly additive in the agent values, i.e., it need not be the case that   = ∑ ∈    .For instance, participating agents may have agreed that the collaboration should strive for transplant maximization, while privately wishing to prioritize certain transplants.Nevertheless, the social welfare value   of cycle  typically corresponds to the number of patients receiving a transplant according to cycle , whereas the value    corresponds to the number of patients in cycle  that belong to the pool   of agent  ∈ .We refer to these social and agent values as unit valuations, as each transplant is considered to be equally valued.
Similar to the notation for cycles, we denote the set of all feasible chains by  = ⋃ ∈   , where   refers to the set of all feasible internal chains of agent  (typically all acyclic paths of length at most  on   = [  ] = (  ,   ) originating from a vertex  ∈    ).The value of a chain  ∈  is denoted by   ∈ ℝ ≥0 , and the value of a chain  to agent  by    ∈ ℝ ≥0 .Typically, but not necessarily, these values correspond to the number of patients from the pool   receiving a transplant according to chain .Note that we do not include shared chains.Since an NDD can initiate a chain of many transplants, and the donor of the final pair in a chain often becomes an NDD themselves, we consider that an agent never wants to risk chains ending with a pair of another agent.This also excludes intermediate pairs of other agents, as chains could fail when only partly executed for a variety of reasons.Going forward, we make no more distinction between cycles and chains, thus the inclusion of shared chains is possible in our approach.
In order to keep notation concise, we define the set of exchanges as  =  ∪  in case distinguishing between cycles and chains is unnecessary.Similarly, for each agent  ∈ , we define   =   ∪   as the set of internal exchanges of , and  0 =  0 as the set of shared exchanges.For each vertex  ∈  , we denote by () the set of exchanges involving , with similar notions () and () for the sets of cycles and chains respectively.Finally, whenever we consider an exchange  ∈  , we adopt all other notions defined above for this exchange depending on whether it is a cycle or a chain.
The set of feasible (kidney exchange) solutions are captured by the following set By definition, for each  ∈  , the elements of  are pairwise vertex-disjoint exchanges, i.e., the elements of  form a packing of cycles and chains on .The challenge in multi-agent kidney exchange problems is to design a method used by the collaboration to select a kidney exchange solution on the common pool that provides a satisfactory trade-off between the individual agents' objectives and social welfare maximization.In other words, the main question is: how to design a mechanism that arrives at a satisfactory solution for all parties involved?
We define mechanisms for multi-agent kidney exchange as follows: Definition 1.A (multi-agent) kidney exchange mechanism is a function  mapping an instance  = (, ) of a multi-agent kidney exchange problem to a feasible kidney exchange solution  =  () ∈  .
In Subsections 2.1 and 2.2 we consider two ways in which agents are allowed to impact such a mechanism, namely in an ex-ante and ex-post fashion respectively.

The ex-ante setting: withholding strategies
In the ex-ante setting agents can choose not to reveal their pairs and NDDs to the collaboration.This gives rise to the class of withholding strategies, which can be described as follows.
1.Each agent  ∈  identifies a subset   ⊆   of its pairs and NDDs to contribute to the collaboration.Throughout the rest of the paper, we will refer to this as agent  selecting the withholding strategy   =   ⧵   .We denote by  ′ = [ ⋃ ∈   ] the subgraph of  induced by the set of contributed pairs and NDDs.Let  ′ = ( ′ , ) where  ′ denotes the exchanges that are feasible on  ′ .2. A mechanism  computes a solution  =  ( ′ ).We denote by   () ⊆   the set of pairs and NDDs contributed by agent  ∈  that remain unmatched with respect to . 3.Each agent  ∈  selects a solution   ∈  on the subgraph of   induced by   ∪   (), i.e.,   ∈ arg max The final kidney exchange solution is given by For each agent  ∈ , the value is given by   ( X).In this game, it is theoretically hard for an agent to maximize their value in the final solution.Indeed, Smeulders et al. (2022) show that the problem of finding an exact withholding strategy for agent  ∈  is Σ P 2 -hard if  is a mechanism maximizing social welfare value on the contributed pool.This is the case even when the withholding D. Blom, B. Smeulders and F. Spieksma strategies   ⊆   for each other agent  ∈  ⧵ {} are fixed and known to agent .In practice, even the vertex set   of another agent  is not known to an agent, further complicating the problem.
Due to the complexity of computing exact withholding strategies, we consider an intuitive withholding strategy proposed in Ashlagi and Roth (2014), which we call the greedy withholding strategy.
Definition 2 (Greedy withholding strategy).An agent  ∈  applies a greedy withholding strategy when the agent computes an internal exchange solution   that is maximum with respect to    , and decides to reveal   ∖  to the collaboration, where   is the set of pairs and NDDs involved in exchanges of solution   .
It was shown empirically by Ashlagi and Roth (2014) that, under a mechanism that maximizes total transplants, an agent can on average increase the number of transplants for their own patients by employing this strategy at the expense of the social optimum.

The ex-post setting: rejection strategies
In this paper we consider a setting where agents can perform strategic behavior in an ex-post fashion, i.e., after the mechanism  has proposed a kidney exchange solution.Specifically, we consider the following setting.
1. Given an m-KEP instance  = (, ), the mechanism  proposes the solution  =  (). 2. Simultaneously, each agent  ∈  selects a rejection strategy, i.e., a solution   that can be obtained from the proposed solution  using the following two operations: (O1) for each exchange  ∈  such that  () ∩   ≠ ∅, agent  can choose to remove  from , i.e., to reject exchange .
(O2) for each exchange  ∈   ⧵ , agent  can choose to add  to .
For each agent  ∈ , we define the set of feasible rejection strategies as 3. The final kidney exchange solution is given by Here, the first term consists of the set of internal exchanges selected by each agent individually, whereas the second term consists of the set of shared exchanges that are not rejected by any agent.
From now on, with a slight abuse of notation, a rejection strategy can be represented by both a kidney exchange solution   ∈   () and its corresponding encoding   = (   ) ∈ .We say that agent  ∈  accepts the solution  proposed by the mechanism if  selects the rejection strategy   = .Generally speaking, we say agent  rejects solution  whenever  selects a rejection strategy   ≠ .The goal of agent  ∈  is to select a rejection strategy   ∈   () such that the resulting solution  after Step 3 is of maximum value   ( ) to .However, this optimization problem for agent  is subject to strategic interaction with other agents, as  is determined by the rejection strategies   ′ of all agents  ′ ∈ .In particular, a shared exchange  ∈  ∩  0 is only contained in  if all of the agents with at least one pair involved in  include it in their solution.
Due to these interactions based on the rejection of shared exchanges, we can characterize the decision on rejection strategies for each agent  as a noncooperative game called the rejection game.

Definition 3 (Rejection game).
Suppose the collaboration has proposed a feasible kidney exchange solution  ∈  .Then, the rejection game (with respect to ) is the game with the set of agents  = {1, … }, the strategy sets   () for each agent  ∈ , and the utilities defined as for each agent  ∈  and each strategy profile Here, the utilities coincide with the (agent) values of the solution obtained in Step 3 provided the agents select the rejection strategies   for  ∈ .In essence, the rejection game with respect to  is equivalent to the kidney exchange game described in Carvalho et al. (2022), with the only exception that the choice of shared exchanges is limited to  ∩  0 .Let us denote by  − = ( 1 , … ,  −1 ,  +1 , … ,   ) a strategy profile played by all agents except agent .
Definition 4 (Best-response rejection strategy).Let  ∈  be the feasible kidney exchange solution proposed by the collaboration.For some  ∈ , let  − be the strategy profile played by all agents except .
In all further experiments in this work, we consider a Nash equilibrium as the outcome for this game, i.e. the solution is a strategy   for each agent, such that the best-response rejection strategy for each agent is this same strategy   .We obtain one such Nash equilibrium by repeated applications of best-response.Initially, we consider the strategy  for each agent and compute the bestresponses for every agent simultaneously.If the strategy of at least one agent changes, we recompute the best-responses.We repeat this process until a Nash equilibrium is reached.Note that since each change in the best-response strategies removes at least one shared exchange, so this process will eventually converge to an equilibrium.In this work, we will consider mechanisms that, given an m-KEP instance  = (, ), output a feasible kidney exchange solution  ∈  such that accepting  is a best-response strategy assuming all other agents will also accept , i.e., the strategy profile (, … , ) is a pure Nash equilibrium in the rejection game with respect to .This gives rise to the definition of rejection-proofness.

Definition 5 (Rejection-proofness).
A mechanism  is called rejection-proof if for any m-KEP instance  = (, ), and any agent  ∈ , the rejection strategy  ∈   () is a best-response strategy with respect to the strategy profile corresponding to accepting  for all agents  ′ ∈  ⧵ {}: In this formulation, a rejection strategy   ∈   () is encoded by a vector   of binary variables    for each exchange  ∈  such that    = 1 if and only if  ∈   .The operations (O1) and (O2) do not allow an agent  to reject exchanges that do not involve any of its pairs or NDDs; this is enforced by Constraints (3c), whereas the remaining exchanges could be rejected as modeled by Constraints (3d).Furthermore, the agent is free to select any internal exchange  ∈   , provided that the final solution is vertexdisjoint as is ensured by Constraints (3b).
As accepting the proposed solution is a feasible rejection strategy for each agent  ∈ , i.e.,  ∈   (), we have that RKEP(, ) ≥   ().Now, if RKEP(, ) =   (), accepting the proposed solution  is an optimal rejection strategy.If all agents accept the solution , the value of the final solution for  is   ().Notice that we will also refer to a solution  satisfying RKEP(, ) =   () for each agent  ∈  as rejection-proof.
On the other hand, whenever, for some agent  ∈ , RKEP(, ) >   (), then there exists a rejection strategy   ∈   () ⧵ {} with which agent  can increase its value assuming all other agents accept .

Comparing withholding and rejection strategies
Having laid out the ex-ante and the ex-post setting in Section 2, it is a natural question to wonder how strategic behavior affects the outcomes in a particular setting, or more concretely, which strategies lead to better solutions for the individual agents.This section is devoted to answering that question by running some computational experiments.The outcomes will serve as further motivation for analyzing the ex-post setting and the corresponding rejection-proof mechanisms.These experiments are conducted in order to pinpoint the benefits that agents can achieve as a result of strategic behavior, and the impact that this strategic behavior has on the overall performance of the multi-agent KEP.This will show that incentives for strategic behavior are present in realistic settings and that the resulting overall loss is large enough to motivate the development of mechanisms preventing strategic behavior.
Since the outcomes of strategic behavior will strongly depend on the graph structure, we consider kidney exchange instances generated through two different sets of characteristic distributions for donor-recipient pairs.Considering multiple distributions lowers bias resulting from any particular graph structure.One set is generated using the traditional Saidman et al. (2006) distributions, which were also used in Ashlagi and Roth (2014).The second set is based on recent work, which aims to more closely resemble instances of D. Blom, B. Smeulders and F. Spieksma the British kidney exchange program, as described by Delorme et al. (2022); we use their SplitPRA-BandXMatch-PRA0 distributions. 1e consider the same instance sizes as Ashlagi and Roth (2014).Specifically, we consider a select number of combinations with || ∈ {2, 4, 6, 8, 10, 12, 14, 16} and the number of pairs per pool |  | ∈ {10, 15, 30, 50, 80} such that in each combination, there are at most 180 pairs in total (notice that we do not consider non-directed donors in these experiments).See Table 1 for a list of all considered combinations.For each such combination, a set of 50 instances is generated.
As we generate these instances using both distributions, there is a total of 2 × 18 × 50 = 1800 instances.Following Ashlagi and Roth (2014), we assume that each agent  ∈  values each transplant equally, i.e.,    = |   ∩  ()| for each exchange  ∈  , and that the cycle lengths are bounded by  = 3.
To establish the gains or losses of strategic behavior, we follow the experimental set-up of Ashlagi and Roth (2014), and consider the following scenarios, where "the strategy" refers to either a greedy withholding strategy, or a best-response rejection strategy.
1.All agents are truthful (i.e., each agent contributes its complete pool to the collaboration, and accepts any solution proposed by the collaboration respectively).2. A single agent employs the strategy, all others are truthful.3.All agents employ the strategy.
In all cases, the collaboration uses a mechanism to maximize the number of transplants for the common pool.To establish the gain or loss an agent achieves by employing a strategy, we compare the number of transplants for this agent between scenarios 1 and 2. In Table 1, this comparison is shown in the columns "Withhold Agent" and "Reject Agent" respectively.A positive number shows the percentage-wise increase in transplants, whereas a negative number indicates that the agent loses transplants by employing the strategy.We also compare scenarios 1 and 3 to evaluate the total loss in transplants if all agents employ the same type of strategy.The outcome of this comparison is shown in the columns "Withhold Total" and "Reject Total".Each number or percentage in these tables represents an average over the 50 instances of the respective instance set.The names of the instance sets are of the form  × , where  is the number of agents in the m-KEP, and  is the number of pairs in each agent's pool.As a basis, we compute for each instance a kidney exchange solution with a maximum number of transplants, i.e., a socially optimal solution.The corresponding average values are reported in the column called "#Transplants".
From the columns "Withhold Agent" and "Reject Agent", we find that both withholding and rejection strategies provide comparable benefits whenever agents control small pools (with at most 15 pairs per pool); however, agents controlling larger pools benefit significantly more from rejection strategies than from greedy withholding.This effect is even more pronounced in the instances from Saidman et al. (2006).Furthermore, even though in almost all cases the average gain of greedy withholding is positive, nearly every instance set contains instances where withholding led to transplant losses (only the instances sets 8 × 10 and 14 × 10 based on the pool distributions from Delorme et al. (2022) did not).By contrast, rejection strategies are risk-free to the agent, as an agent only plays a rejection strategy if they can strictly improve their outcome.The reason for this is that rejection strategies are a form of ex-post manipulation, meaning that agents have an information benefit compared to when they need to select a withholding strategy ex-ante.Finally, from the columns "Withhold Total" and "Reject Total", it is clear that the negative effect on the total number of transplants is much larger in the case where all agents use greedy withholding compared to when all agents use a rejection strategy.The combined result of higher average benefits and reduced risk motivates studying rejection strategies, and the corresponding expost setting, in more depth.We do note it could be of interest to validate these results in different settings, e.g., by including NDDs, cases where agents have different sizes within the same instance, etc.Furthermore, Kidney Exchange problems often allow many optimal solutions, and biases due to the solver, representation of the data, etc. could impact these results.

An exact rejection-proof mechanism
In this section, we will formulate an exact rejection-proof mechanism, i.e., a mechanism that outputs a rejection-proof solution maximizing social welfare value.For that purpose, we first provide a description of the underlying optimization problem OPT-RP-KEP as follows:

𝑋 ∈ arg max
The natural decision variant of OPT-RP-KEP, which uses an additional input parameter  and asks whether there exists a rejectionproof kidney exchange solution  with () ≥ , will be referred to as DEC-RP-KEP.We now define the Maximum Rejection-Proof KEP mechanism, or simply MAXRP-KEP, and also propose an algorithm for solving the resulting bilevel optimization problem.

Table
Impact of strategic behavior in both the ex-ante setting (withholding) and the ex-post setting (rejection).The total number of transplants in an optimal kidney exchange solution, i.e., whenever each agent would truthfully contribute all of their pairs, is compared with percentage gains/losses on individual and social welfare whenever strategic behavior would be employed, for instances generated using the distributions proposed by Delorme et al. (2022) and Saidman et al. (2006)  The MAXRP-KEP mechanism is the mechanism  that, for any m-KEP instance  = (, ), selects a feasible kidney exchange solution  =  () ∈  optimal to OPT-RP-KEP.This solution , encoded by  = (  ) ∈ , can be found by solving the following integer bilevel program: Observe that (4) is indeed an integer bilevel program.The right-hand side of Constraints (4c) is given by the optimal values of the lower-level problems of finding the best rejection strategy   ∈   () to solution , for each agent  ∈ .In other words, this bilevel optimization problem implicitly considers lower-level variables   encoding the selected rejection strategies   ∈   () for each  ∈  respectively.If we omit Constraints (4c), we have a standard weighted kidney exchange problem.Constraints (4c) are added to impose rejection-proofness of the solution.Intuitively, a kidney exchange solution  can only be rejection-proof if its value   () to agent  is at least the value of any optimal rejection strategy   ∈   ().We show that for cases in which standard kidney exchange problems are NP-hard, the problem of finding maximum cardinality rejection-proof kidney exchange solutions is complete in the complexity class Σ P 2 .We refer to Woeginger (2021) for a more elaborate background on the polynomial hierarchy.
Theorem 1. DEC-RP-KEP is Σ P 2 -complete for any fixed maximum cycle length  ≥ 3 (even in the case of || = 2, transplants being valued equally and no non-directed donors).
The proof of this theorem can be found in Appendix A. Informally, this proof is based on a polynomial reduction from the Σ P 2complete problem ADVERSARIAL (2,2)-SAT (Johannes, 2011).In this problem, we are given a boolean CNF expression  consisting of a set of clauses , based on two sets of variables  and  .The question is whether there exists a truth setting for  such that there exists no truth setting for  such that  is satisfied.In our reduction, we construct a compatibility graph corresponding to an m-KEP with 2 agents.
Given the NP-hardness of the basic kidney exchange problem, which appears in the lower level problem, the complexity of the bilevel problem is perhaps not surprising.It does raise the question of the complexity of the special cases in which the standard kidney exchange problem is solvable in polynomial time.This is the case for  = 2, and here the problem of finding an optimal rejection-proof solution follows from results on a related game, studied in Carvalho and Lodi (2023).They show one can find a socially optimal Nash equilibrium in polynomial time, for any number of agents.Since the exchanges in this Nash equilibrium also form a rejection-proof solution, this gives a polynomial time method for finding an optimal rejection-proof solution.The case for  = ∞ is, to the best of our knowledge, still open.
In the remainder of this section, we discuss strategies to solve Problem (4), based on the connection between rejection strategies and vertex subsets.In Section 4.1, we propose a single-level reformulation of the problem with exponentially many constraints.Next, Section 4.2 discusses an iterative constraint generation procedure.

A single-level reformulation
In this section, we identify a set of constraints that can replace Constraints (4c) in Problem ( 4), thus reducing it to a single-level optimization problem, albeit being exponential in the size of the input.First, for each agent  ∈  and each subset   ⊆   , we define as the maximum value of a feasible kidney exchange solution to  on the subgraph induced by   .Note that calculating (  ) requires solving a standard weighted kidney exchange problem, which is an NP-hard problem in general.We now claim the following: As   ∈   (), we have that   () <   (  ) ≤ RKEP(, ).Here, the first inequality follows from the assumption that constraint (6) is violated with respect to   , as this means that   ( ⧵   ) <   (  ⧵ ).The second inequality follows from the fact that   , which encodes the solution   , is feasible to RKEP(, ).Hence, it follows that  is not rejection-proof.
(⇐) Suppose the solution  = (  ) ∈ is not rejection-proof.Then there exists an agent  ∈  and a solution   = ( (7) We now construct the set   as follows: Thus, the set   is the set of vertices that are part of an exchange in   , and not part of an exchange in .(11) From combining ( 10) and ( 11), we can conclude that ( 6) is violated for the set   .□ Remark 1.Notice that the subset rejection constraint corresponding to agent  ∈  and subset   =   imposes individual rationality for , i.e., the proposed solution should have a higher total value to agent  than any internal solution on   .In particular, the leftmost solution in Fig. 3 satisfies individual rationality for all agents, but violates rejection-proofness (due to the subset rejection constraint for   = {, }).
We can now replace Constraints (4c) with Constraints ( 6), reducing the problem to a single-level integer program.We refer to Constraints (6) as the subset rejection constraints (SRC).We denote by  the index set of the subset rejection constraints, i.e., Violation of the subset rejection constraint for some  ∈ ,   ⊂   means that agent  has the incentive to select the rejection strategy obtained from rejecting all exchanges intersecting this subset and replacing it with a kidney exchange solution on [  ] of maximum value to .
We now obtain the following formulation: Observe that, given the weight vector , the quantity (  ) is a constant number for each agent  ∈  and subset   ⊆   .
Hence, this is indeed a single-level reformulation of the problem.This comes at the cost of introducing an exponential number of constraints (12c) due to the number of subsets   ⊆   for each agent  ∈ .However, as finding a rejection-proof solution involving the largest number of pairs and NDDs is Σ P 2 -hard due to Theorem 1, we cannot hope to find a compact formulation unless the polynomial hierarchy collapses.

Solving MAXRP-KEP
In this section, we discuss our solution approach for MAXRP-KEP.Problem (12) has an exponential number of constraints due to | | being exponential in the number of vertices.In our solution method, we initially consider a relaxation in which the subset rejection constraints (12c) are restricted to some small subset  ′ ⊂  .
Iteratively, we solve this relaxation and apply a separation method to identify for each agent  ∈  whether there exists a subset   ⊆   such that the subset rejection constraint with respect to (,   ) ∈  ⧵  ′ is violated.This iterative algorithm terminates when there do not exist any more violated constraints.
Observe that, viewing formulation (12) through the lens of bilevel optimization, we can consider the lower level variables (  for each  ∈ ) to be included implicitly in this single-level reformulation.In order to see this, for any feasible kidney exchange (leader) solution x, note that the lower-level solution ŷ defined by ŷ  = x for all  ∈  is feasible to the lower-level problem RKEP( x, ).
Next, we will discuss how to separate violated subset rejection constraints and tiebreaking approaches for the relaxed master problem in more detail.

Separating the subset rejection constraints
Consider a solution  that is not rejection-proof.In the proof of Theorem 2, we show that if there exists an agent  ∈  and solution   feasible to RKEP(, ) with   (  ) >   (), then at least one inequality from the class of subset rejection constraints (6) must be violated.In other words, then there is an agent  and a subset for which an inequality from ( 6) is violated.The right-hand side of the violated subset rejection constraint can be computed as follows.
(  ) = ∑ ∈∶ ()⊆        . ( In other words, the separation problem can be decoupled into a separation problem for each agent  ∈ , which is just the problem RKEP(, ).For each  ∈ , we can deduce from its optimal solution   ∈   () a violated subset rejection constraint if  is incentivized to reject .

Tiebreaking in MAXRP-KEP
It has been observed that kidney exchange problems usually have many optimal solutions (Farnadi et al., 2021).This carries over to MAXRP-KEP, in particular when the number of rejection constraints | ′ | is still small, as the problem is then almost similar to a regular kidney exchange problem.Selecting a solution among distinct optima is a delicate matter, as some solutions may be rejection-proof while others are not.It is desirable to identify an optimal rejection-proof solution if one exists, as we can then restrict the number of iterations of the (relatively costly) procedure of separating violated subset rejection constraints and resolving of the resulting, strengthened,  MAXRP-KEP (;  ′ ).The following lemma gives us insight into how to compare solutions in terms of rejection-proofness.
If  is rejection-proof, then X is rejection-proof.
Proof.We argue by contradiction, suppose that X is not rejection-proof.Then, given encoding x for X, for some agent  ∈  there exists a solution Ỹ  ∈   ( X) optimal to RKEP( x, ) such that   ( Ỹ  ) >   ( X).Note that any solution feasible to RKEP( x, ) is also feasible to RKEP(, ), i.e.,   ( X) ⊆   (), because of Condition (a).Finally,   ( Ỹ  ) >   ( X) ≥   () means the agent has incentive to reject  as well, meaning that  is also not rejection-proof.□ This lemma shows that the number of shared exchanges in a solution and agent value are two factors influencing whether or not a solution is rejection-proof.Indeed, when the number of shared exchanges in a solution  is small, this implies that the number of feasible rejection strategies, i.e. the number of feasible solutions of RKEP(, ), is more restricted compared to when there are many shared exchanges.This feasible region is also more restricted if the value   () for solution  to agent  is larger, which is consistent with Constraints (4c).
We use this knowledge to propose as a tiebreaker the internal preference objective By counting only the agent value of internal exchanges, it immediately takes into account both conditions of Lemma 1.Clearly, this tiebreaker prioritizes solutions with large agent values, whereas solutions with many shared exchanges are disadvantaged.In fact, we can show that given two solutions as in Lemma 1, mechanisms deploying the tiebreaking rule (14) will always (weakly) prioritize X over .
Lemma 2. Consider two solutions,  and X, such that X ∩  0 ⊆  ∩  0 and   ( X) ≥   () for all agents  ∈ .Then, we have  1 ( X) ≥  1 (), i.e., the tiebreak value of X is at least as high as the tiebreak value of .
Proof.Let X ∩  0 ⊆  ∩  0 .Then, using the definitions of   ( X) and   (), we get Now, it follows from ( 14) and ( 15) that  1 ( X) ≥  1 ().□ The tiebreaker is implemented as follows.Let  be an upper bound to the agent value of internal exchanges in any solution ( ≥ max ∈ ∑ ∈ ∑ ∈       ).We then replace the objective (4a) of MAXRP-KEP, by This objective takes into account both the social welfare value of all transplants ( ∑ ∈     ) and the agent value of internal exchanges ( ∑ ∈       ).Due to the heavy weighting of social welfare value, the agent value will only function as a tiebreaker between solutions with equal social welfare value.
To summarize, we can characterize the steps performed by the MAXRP-KEP mechanism with the pseudocode described in Algorithm 1.

Heuristic mechanisms
In Section 4, we have discussed a mechanism for identifying optimal solutions that are rejection-proof by solving a bilevel optimization problem.In this section, we consider two heuristic mechanisms for finding rejection-proof kidney exchange solutions.On the one hand, these mechanisms have reduced computational complexity.On the other hand, they do not guarantee that the found solutions are indeed optimal.In Section 5.1, we describe a heuristic mechanism called Maximum Weight Internal KEP, which proposes solutions that maximize the sum of the agents' values for internal exchanges.This ensures that there are no incentives for the agents to deviate from accepting the proposed solution.In Section 5.2, we propose a mechanism that first identifies a rejection-proof solution that results from the best responses to a proposed solution.In the second step, local improvements preserving rejection-proofness are made.

Maximum weight internal matching
We now describe our first heuristic mechanism, which we call the Maximum Weight Internal KEP mechanism, shortened to the MAXINT mechanism or simply MAXINT.This mechanism proposes a solution where the social transplant value is maximized, under the restriction that the agent value of internal exchanges is maximum.

Definition 7. Maximum Weight Internal Transplants (MAXINT)
For any m-KEP instance  = (, ), the MAXINT mechanism selects a feasible kidney exchange solution  ∈  encoded by  = (  ) ∈ optimal to the following integer linear program (MAXINT-KEP): Constraints (17b) again impose that  should induce a set of pairwise vertex-disjoint exchanges.Moreover, Constraints (17c) ensure that   = {  ∈   |   = 1 } forms a maximum (agent) value internal kidney exchange solution for each agent  ∈ .
Notice that the feasible region of Problem ( 17) is equivalent to the set of kidney exchange solutions that can be obtained if each agent selects a greedy withholding strategy.As MAXINT aims to maximize the social welfare value of the kidney exchange solution, it can be regarded as the kidney exchange solution for which all agents coordinate their greedy withholding strategies in order to maximize social welfare.We note that there are existing transnational collaborations where greedily withholding within countries is the official policy (Valentín et al., 2019).While simple, the MAXINT mechanism guarantees at least equal social welfare compared to this policy, and can improve it.
Theorem 3. The MAXINT mechanism is rejection-proof.
Proof.Let  ∈  be a kidney exchange solution proposed by MAXINT, encoded by binary variables (  ) ∈ , and let  ∈  be an arbitrary agent.Then For any optimal solution   to RKEP(, ), encoding solution   ∈   (), we have As  ∩   is a maximum value internal solution on   , we have ∑ . (18) Next, notice that a shared exchange  ∈  0 can only be contained in   if it was in the proposed solution  in the first place, hence It follows from adding ( 18) and ( 19) that   () ≥ RKEP(, ), showing that MAXINT is rejection-proof.□ We illustrate the workings of this mechanism in Section 5.3.

Reject-and-Rebuild
We now consider a second heuristic mechanism for rejection-proof kidney exchange solutions, which we call the REJECT-AND-REBUILD (RR) mechanism.Informally, the mechanism computes a solution by initially considering a socially optimal solution and mimicking best-response strategies of agents to this solution (REJECT).This process iterates until rejection-proofness is reached.At this point, the mechanism adds local improvements preserving rejection-proofness (REBUILD).Formally, the mechanism takes an instance  = (, ) and outputs a rejection-proof kidney exchange solution  =  () ∈  after performing the following steps: 1.An arbitrary kidney exchange solution X ∈  of maximum social welfare value is computed.This solution X is encoded by x = (  ) ∈ .2. (REJECT) For each agent  ∈ , solve the rejection problem RKEP( x, ) with optimal rejection strategy   ∈   ( X).If X is rejection-proof, i.e.,   = X for all  ∈ , go to Step 3. Otherwise, let X = ⋃ ∈ (  ∩   ) be the set of internal exchanges obtained from the rejection strategies   of all agents  ∈ .Furthermore, let X0 = ⋂ ∈ (  ∩  0 ) be the set of non-rejected shared exchanges of X.We set X = X ∪ X0 and repeat Step 2. 3. (REBUILD) For each agent  ∈ , let   ( X) ⊆   be the set of pairs and NDDs of  that are unmatched in X, i.e., Let now  ′ ∈  be some kidney exchange solution on [ ⋃ ∈   ( X)] maximizing social welfare value.Output  = X ∪  ′ .
We now show that the RR mechanism indeed terminates and outputs rejection-proof mechanisms.
Theorem 4. The REJECT-AND-REBUILD mechanism is rejection-proof.
Proof.Let X ∈  be a kidney exchange solution proposed by the RR mechanism in Step 1, encoded by ( x ) ∈ .To show that the mechanism terminates, we need to argue that the iterative approach in Step 2 gives us a rejection-proof solution after a finite number of iterations.Observe that whenever an agent  rejects the solution using a nontrivial rejection strategy   ∈   ( X) ⧵ { X} , the number of pairs involved in an internal exchange strictly increases by at least one.Hence, for any m-KEP with finite agent pools, this means that the number of iterations is also finite.Furthermore, once the number of pairs involved in an internal exchange is maximum, the corresponding solution X will be rejection-proof, and we go to Step 3. As a solution does not lose the rejectionproofness property after adding exchanges to it, the final solution is also rejection-proof, hence the Reject-and-Rebuild mechanism is rejection-proof.□

Illustration of MAXINT and REJECT-AND-REBUILD
We give an illustration of the two mechanisms MAXINT and REJECT-AND-REBUILD using two different instances.First, consider the instance depicted in Fig. 4.
We provide the MAXRP-KEP solution for this instance in Fig. 5a; this solution features six transplants, is a social optimum and is rejection-proof as neither the blue nor the red agent has an incentive to reject this solution.The solution obtained from the MAXINT mechanism is depicted in Fig. 5b; notice that it is also rejection-proof.The solution obtained from the REJECT-AND-REBUILD mechanism is depicted in Fig. 5c, and found in two steps.Given the first solution (which is a social optimum), the blue agent rejects one cycle (the rightmost 3-cycle) in favor of the blue (internal) 2-cycle.The resulting solution is both rejection-proof and maximal, hence no shared exchanges are added in the REBUILD step.Let us now consider MAXINT and REJECT-AND-REBUILD, when applied to the instance depicted in Fig. 6.MAXINT gives the solution depicted in Fig. 6a, consisting of five transplants.When considering the REJECT-AND-REBUILD mechanism in Fig. 6b, notice that the red agent has two optimal rejection strategies, given by rejecting all existing cycles and adding either of the two 3-cycles internal to the red agent.As the red agent selects an arbitrary optimal rejection strategy, it can be the case that they pick this strategy in an unfortunate fashion, leading to a strictly worse solution compared to the MAXINT solution in terms of social welfare value.Furthermore, this instance also shows that the REBUILD step is not redundant.If the red agent would select the topmost 3-cycle as their rejection strategy, the 2-cycle (on the bottom) would become completely unmatched, meaning it could be added to the solution (obtaining the same solution as MAXINT).We finally point out that these two instances show that REJECT-AND-REBUILD does not dominate MAXINT and vice versa.
In the next section, we conduct experiments to compare the optimal (MAXRP-KEP) and the two heuristic mechanisms (MAXINT and RR) against each other in terms of computational complexity and solution quality, tested on instances obtained from two state-of-the-art instance generators for general kidney exchange programs.

Computational results
In this section, we describe our computational experiments dedicated to comparing the mechanisms proposed in Sections 4 and 5. First, in Section 6.1 we look at the mechanism outcomes in two ways.We compare the quality of solutions of the instance sets against the maximum value of (unrestricted) kidney exchange solutions, i.e., the maximum value of kidney exchange solutions for which rejection-proofness is not necessarily satisfied.Furthermore, we repeat our experiments from Section 3, testing whether

Table 2
Comparison of the solution quality (average over 50 instances per instance set) of the rejection-proof mechanisms (MAXRP-KEP / MAXINT / RR) with the setting in which all agents perform greedy withholding (Withhold Total) or rejection strategies (Reject Total).The numbers in the columns show the average percentage loss in the total number of transplants realized in comparison with the maximum value kidney exchange solution, for instances generated using the distributions proposed by Delorme et al. (2022) and Saidman et al. (2006)  individual agents can benefit from employing a greedy withholding strategy.This time, we assume the collaboration uses one of the rejection-proof mechanisms, rather than computing a socially optimal solution.Second, in Section 6.2 we discuss the performance of the MAXRP-KEP mechanism in terms of computation times, showing that despite the computation complexity the problem of computing optimal rejection-proof solutions is tractable for many types of instances.

Quality of rejection-proof solutions
We compare the quality of the solutions obtained from the exact mechanism (MAXRP-KEP) and the two heuristic mechanisms (MAXINT and REJECT-AND-REBUILD (RR)) against the solution value of basic kidney exchange solutions without additional restrictions.To this end, we consider the same instances generated for the discussion in Section 3. Our goal is to compare the maximum number of transplants that can be attained under the three different rejection-proof regimes.
Table 2 shows that MAXRP-KEP achieves rejection-proofness at a small cost on average.For all instance sets, the loss in the number of transplants to the social optimum is at most 1%, which is significantly smaller than the losses that can occur if agents employ withholding (Withhold Total) or rejection strategies (Reject Total).Through the rebuild step, Reject-and-Rebuild also strictly improves over agents employing rejection strategies, but only slightly.The MAXINT mechanism comes at a higher cost, with losses up to 15% of total transplants and consistently higher than losses from agents using rejection strategies.However, it still improves upon the situation where agents use greedy withholding strategies without coordination.

Table 3
Average percentage gain in the number of transplants achieved by a single agent selecting a greedy withholding strategy compared to the setting where this agent is truthful, assuming all other agents are truthful, whenever any of the three mechanisms MAXRP-KEP, MAXINT or RR is employed.Results are shown for instances generated using the distributions proposed by Delorme et al. (2022) and Saidman et al. (2006)  Analogous to the experiments in Section 3, we also investigate the gains an agent can achieve by using the greedy withholding strategy.Specifically, we consider the difference in transplants for an agent between being truthful and using the greedy withholding strategy, assuming all other agents are truthful.In contrast to Section 3, we now consider the case where the collaboration uses one of the rejection-proof mechanisms.
Table 3 shows the average in-or decrease in transplants for an agent  for all three mechanisms.Here, we consider the case in which  would unilaterally decide not to report its entire pool (like all other agents), but instead to select some greedy withholding strategy before the rejection-proof mechanism is employed.For most instance sets, greedy withholding leads to a loss of transplants for the agent on average.This is in contrast to the situation where a solution on the common pool is selected of maximum value (where agents gained by using greedy withholding, as shown in Table 1).These losses are generally small (1 or 2%) and small gains are possible, in particular for the Delorme instances with smaller pool sizes.However, for larger pool sizes, agents may lose up to 8% of transplants by using greedy withholding.These results show that while the rejection-proof mechanisms only provide guaranteed protection against agents employing rejection strategies, in practice they may also disincentivize (greedy) withholding strategies.

Computation times of the MaxRP-KEP mechanism
In this section we further investigate computational aspects of the MaxRP-KEP mechanism.We have previously established the theoretical complexity of the underlying optimization problem, now we consider computational experiments relating to the bilevel optimization problem central to the mechanism.In order to compare computation times for different distributions of agent pool sizes,

Table 4
Comparison of computational results of MAXRP-KEP for all instance sets.All results were obtained using no initial constraints, weighted tiebreaking, and maximum violation constraints added.Instances solved is the number of instances solved to optimality in less than 3 hours (10 800s), out of 30.The reported numbers on computation times, constraints added and the number of iterations are averages over all instances solved to optimality within the given time limit.we consider a new set of multi-agent kidney exchange instances which include NDDs.Typically, the existence of NDDs increases the computational challenge in kidney exchange problems, which is our reason for adding these.As before, we consider instances generated using Saidman and Delorme distributions (with the BXM-PRA-0 configuration).This configuration uses a classification of PRA values based on score bins ("bands") in order to determine whether or not donors and recipients are compatible.Furthermore, additional considerations are made to establish compatibilities for patients with PRA score 0. Each instance contains either 96 pairs and 4 non-directed donors, or 192 pairs and 8 non-directed donors, divided at random among the agents.The division over agents differs, with either 1 large and 2 medium size agents ("1l2m": 50% + 2 × 25%), 1 large and 5 small ("1l5s": 50% + 5 × 10%), and 2 or 4 equal-sized agents ("2equal" and "4equal", respectively).For each instance set of 30 instances, we set the social welfare value equal to the number of transplants.In all instances, agents only value transplants to their own patients.In the "Score" instances, the agent valuation for each transplant is drawn independently at random from a uniform distribution between 0 and 99, e.g., to indicate recipient priorities or quality of matches.These experiments were run using CPLEX 12.10, using 4 threads on a 2.8GHz Intel Xeon Platinum 8260 Processor.The computation times for the MAXRP-KEP mechanism can be seen in Table 4.Although the basic characteristics of these instances such as the proportion of pairs vs. NDDs are fixed, we note massive differences in computation time required for the different instance sets.The differences were most pronounced when we compare the distributions used for instance generation (Saidman vs. Delorme instances), with the Saidman instances considerably more difficult.Another factor that significantly impacted mechanism tractability is the set of preferences of individual agents, more concretely the valuations that agents had for transplants.Instances where agents follow unit valuations for each transplant were significantly easier to solve.Finally, less pronounced differences exist depending on the distribution of agent pool sizes, where harder-to-solve instances were typically among the set of instances with larger pool sizes per agent.
• Saidman vs. Delorme: It is clear that there exist huge differences based on the instance generation procedure used.All instance sets generated using the Delorme distributions with pool size 100 are solved completely, with average computation times exceeding one second for only one instance set.Instances of the same size generated using the Saidman distributions on the other hand are much more difficult, with some instances not solved optimally within the time limit.For the solved instances, the average time to optimality is also much longer, up 12 minutes for one instance set.The larger Delorme instances were most difficult, but are double the size of the Saidman instances.As was shown in Delorme et al. (2022), instances generated using their distributions are significantly sparser than those generated using the Saidman configuration, i.e., the compatibility graphs in Delorme instances consistently have significantly fewer arcs than the Saidman instances.For denser compatibility graphs the computational cost of solving the integer programs increases as there exist more potential exchanges that could be performed.Furthermore, denser graphs increase the set of possible rejection strategies.This gives the agents more freedom and they are thus more likely to reject proposed solutions.This is also reflected in the number of iterations required to find the optimal rejection-proof solution.• Unit vs. Score: Instances in which the agents have non-unit valuations (denoted by "Score" in the instance set name) for transplants are much more difficult.This is most apparent for the Saidman and larger Delorme instances, where almost all instances with unit valuations are solved within the time limit.For the non-unit values, instances in each set were unsolved, and average times for solved instances are considerably larger.
The reason for the additional difficulty is reflected in the number of iterations and the number of constraints.In the case of unit values, the overall value and agent values of a given solution are closely aligned.For non-unit values, however, solutions with many low-value transplants are often rejected by the agents, adding more constraints to the master problem.This leads to more, and more costly, iterations as the additional constraints add difficulty to the master problem.
• Distribution over agents: We focus on the difficult Saidman Score and larger Delorme instances, and those instances with larger agents are more difficult to solve.The instance set with the suffix "4equal", has the most solved instances, and while the average time per instance is the second highest.For all other instances, the largest agent has half of the total pool, and we see that more instances are solved, for the instances where the remaining pairs are divided over more agents.Since larger agents have more opportunities to identify profitable rejections, the increased difficulty is as expected.This is also reflected in the number of iterations required and constraints added.In instance sets with larger agents, more constraints were needed to identify rejection-proof solutions.
The instance sets in this study cannot capture the variety of possibilities that could be encountered in real life, and the feasibility of using MAXRP-KEP in practice will depend on the specific properties of the application.This said we believe the above results are positive.Using our algorithms, MAXRP-KEP is solvable on large Delorme instances with unit valuations, most medium-size instances for the dense Saidman instances, and trivial for the medium-size Delorme instances.The strong results on Delorme instances are particularly encouraging, as they more strongly resemble real-life kidney exchange pools.The increased complexity of increased agent pool sizes might become a serious concern, especially in cooperations between large countries.Still, pools with around 50 pairs are manageable, a size which is currently only exceeded by three European Kidney Exchanges in practice (UK, Spain, and The Netherlands (Biró et al., 2019)).

Tiebreaker
We now discuss the tiebreaker and its effect on the computation time for the challenging SaidmanScore instances.Its effect depends on instance characteristics.Fig. 7 shows the number of instances solved optimally at each point in time and gives the clearest comparison.For the instances with one large and 2 medium or 5 small agents, the tiebreaker generally speeds up computation for easier instances, but the gap disappears for harder instances.For both instance sets, not using the tiebreaker allows for one more instance to be solved within the time limit.For the 2equal and 4equal instance sets, little difference can be seen.We do note that using the tiebreaker strongly reduces the number of iterations required to identify optimal solutions, as can be seen in Table 5.As before, this is offset by the increased difficulty of solving the master problem, now due to the harder objective function, leading to similar overall results.

Discussion
In this paper, we address the issue of cooperation in kidney exchange from a new angle.Previous work focused on incentivizing agents to contribute all of their patients and donors to a common pool.The underlying assumption of this work is that agents will strategically choose to reveal or withhold their pairs from cooperation, to maximize the value of transplants to their patients (withholding strategies).One of our contributions is to recognize a second option for agents, the rejection strategies.In Section 3, we show that such strategies provide better outcomes for the agent than existing withholding strategies with reasonable computational and information requirements.Furthermore, we show that such rejection strategies can cause an overall loss of transplants.As a result, we propose that rejection-proofness is a valuable property for cooperation mechanisms.We note that some of our computational observations are potentially influenced by solver bias, as mentioned in Section 3. Investigating whether this is actually the case, and to what extent this can be corrected is an area for future research.
We provide three different rejection-proof mechanisms, MAXRP-KEP, MAXINT, and RR.Our main mechanism, MAXRP-KEP, guarantees rejection-proofness at a very small cost in terms of number of transplants.This performance does require solving a complex bilevel problem which comes at a computational cost; however, we show this is manageable for instance sets of reasonable size.Further research into algorithms for this problem may be necessary to allow for cooperation with multiple agents with large pool sizes.One potential avenue is to make use of existing approaches to scale up the basic kidney exchange problem, such as branchand-price approaches (Riascos-Álvarez et al., 2020;Omer et al., 2022), if they are adjusted for the subset rejection constraints.The second mechanism, MAXINT, is simple to implement, easy to understand, and close to the policy of existing international cooperations.However, it performs worst in terms of transplants lost for realistic instances.The REJECT-AND-REBUILD mechanism provides a modest improvement over agents using rejection strategies.
Common to all mechanisms is that besides their designed outcome of nullifying, for individual agents, the benefit of using rejection strategies, these mechanisms also eliminate expected benefits provided by greedy withholding strategies.We do note that they are not strategy-proof, as evidenced by the existence of instances where the greedy withholding strategy does provide a benefit.
As a final remark about the benefits of our mechanisms, we note that they provide a natural way of reconciling differences in transplant valuation in cooperations.These mechanisms make use of agent values (   ) and social welfare values (  ).Through the constraints ensuring rejection-proofness, agents are assured that their private valuations will be taken into account.This allows agents in a cooperation to set their priorities.
Looking forward, we believe that combinations of rejection-proof and credit mechanisms are interesting to study.Current credit mechanisms do not handle failure or rejection of proposed transplants (see, e.g., Hajaj et al. (2015); Klimentova et al. (2020); Benedek et al. (2022)).By removing incentives to reject, this issue is ameliorated.Rejection-proof mechanisms provide guarantees that agents will not lose out by cooperating, but can still allow for an unequal division of the benefits of cooperation.Furthermore, in our experiments, rejection-proof mechanisms still allow situations where greedy withholding strategies are profitable.Depending on the graph structure, there may be situations where they are consistently profitable.Credit mechanisms can reduce these issues in multi-period settings.By combining rejection-proof and credit mechanisms, the risk of strategic behavior can be further reduced.

Declaration of competing interest
We have no conflicts of interests to disclose.the assumed minimality of   .Hence, also the blue agent has no incentive to reject the constructed solution , which is therefore a rejection-proof kidney exchange solution covering at least  = 9|| + 9| | + 5|| + 3 vertices.Therefore,  is a valid certificate showing that ℎ() is a yes-instance to DEC-RP-KEP.
⇐) Let us consider a feasible solution  to DEC-RP-KEP for the transformed instance that covers at least 9|| + 9| | + 5|| + 3 vertices.Without loss of generality, we can suppose that in , all gadgets are packed consistent with some truth settings   and   (observe that for each variable gadget, switching from a clause satisfaction cycle to its unique intersecting 3-cycle within the variable gadget preserves rejection-proofness). Remark that there must exist a clause  ∈  for which the -gadget is packed with  , , since any rejection-proof kidney exchange solution would otherwise cover at most 9|| + 9| | + 2|| + 3|| = 9|| + 9| | + 5|| vertices.If  would now be a no-instance to ADVERSARIAL (2,2)-SAT, then  max (  ) = || for any truth setting   ∶  → {True, False}.Hence, for each   there must exist some truth setting   satisfying all clauses.However, this truth setting would imply a profitable rejection strategy   ∈   () for the blue agent.This rejection strategy   is obtained from  by switching to packings consistent with   () for each  ∈  and adding exactly || disjoint clause satisfaction cycles.As   contains at least one more clause satisfaction cycle compared to , we have that   (  ) ≥   () + 1, contradicting rejection-proofness of .We can conclude from this that the truth setting   is a valid certificate for  = (,  , ) being a yes-instance to ADVERSARIAL (2,2)-SAT.□ Remark that there exist compact encodings of ,  ′ , i.e. polynomial in the number of vertices and arcs of the graph , such as arcbased formulations of kidney exchange programs.Furthermore, it can be checked in polynomial time whether such encodings indeed imply feasible cycle-chain packings.This also holds for checking if  ′ ∈   () and checking the value   ( ′ ).Therefore, given a rejection-proof solution  and some alternative vector  ′ , we can check in polynomial time that  ′ does not prove a violation of rejection-proofness of , hence the language DEC-RP-KEP is in Σ P 2 .□

Fig. 1 .
Fig. 1.Circles represent recipient-donor pairs, while squares represent non-directed donors.The presence of an arc (, ) signifies compatibility of the donor of  and the recipient of .The bold arcs represent a feasible KEP solution, which features a cycle between pairs 3 and 5 and a chain from NDD 1 to pair 2 and on to pair 4.

Fig. 4 .
Fig. 4. Example of an m-KEP instance with two agents.

Fig. 7 .
Fig. 7. Comparison of the computation times of MAXRP-KEP for different distributions of agent pool sizes, depending on the use of the tiebreaker.
This condition is required, as donors can donate at most one kidney and each paired or non-directed donor can thus be involved in at most one exchange.We encode each solution  ∈  with a vector  = (  ) ∈ ∈ {0, 1}  such that   = 1 if and only if  ∈ .The social welfare value of a solution  is denoted by () = ∑ ∈     , i.e., the sum of social welfare values of the exchanges of .Similarly, we denote the value of solution  to agent  ∈  by   () = respectively.
Finally, note that by construction of   , if for an exchange  ∈   it holds that  () ∩   ≠ ∅, then actually  () ⊆   .These exchanges thus describe a feasible kidney exchange solution on [  ].We now have By construction of the set   , we have that    ≤   if  () ∩   = ∅.Thus, we have: ∑ respectively. respectively.

Table 5
Comparison of SaidmanScore instances based on whether or not tiebreaks are used.Results are obtained using no initial constraints.Instances solved is the number of instances solved to optimality within 10800 seconds (out of 30).Reported computation times, master times, and numbers of iterations are averages restricted to the instances solved to optimality within the time limit.