Swap Equilibria under Link and Vertex Destruction

We initiate the study of the \emph{destruction model} (\aka \emph{adversary model}) introduced by Kliemann (2010), using the stability concept of \emph{swap equilibrium} introduced by Alon et. al (2010). The destruction model is a network formation game incorporating the robustness of a network under a more or less targeted attack. In addition to bringing in the swap equilibrium (SE) concept, we extend the model from an attack on the edges of the network to an attack on its vertices. Vertex destruction can generally cause more harm and tends to be more difficult to analyze. We prove structural results and linear upper bounds or super-linear lower bounds on the social cost of SE under different attack scenarios. The most complex case is when the vertex to be destroyed is chosen uniformly at random from the set of those vertices where each causes a maximum number of player pairs to be separated (called a max-sep vertex). We prove a lower bound on the social cost of $\Omega(n^{3/2})$ for this case and initiate an understanding of the structural properties of SE in this scenario. Namely, we prove that there is no SE that is a tree and has only one max-sep vertex. We conjecture that this result can be generalized, in particular we conjecture that there is no SE that is a tree. On the other hand, we prove that if the vertex to be destroyed is chosen uniformly at random from the set of \emph{all} vertices, then each SE is a tree (unless it is two-connected). Our conjecture would imply that moving from the uniform probability measure to a measure concentrated on the max-sep vertices, means moving from no SE having a cycle (unless two-connected) to each SE having a cycle. This would ask for a more detailed study of this transition in future work.


Introduction
Game theoretic models for the study of the decentralized formation of networks gained remarkable attention during the past two decades. In most of those models, the vertices of a graph correspond to players, and each player's choice of action can have an influence on the structure of the graph. Models differ regarding the different actions available to the players and regarding the criteria under which the quality of the graphs is evaluated. For the latter, most models have focused on centrality-type criteria, for example, players aim to minimize the sum of distances over all other players. Recently, robustness aspects have been addressed in the form of the destruction model (a.k.a. adversary model) [11,12,13,14]. In this model, players anticipate the destruction of exactly one edge in the graph, and the cost function for each player v gives the expected number of other players that v will no longer be able to reach after the destruction. Social cost is the sum over all players' costs, which is equal to the expected number of separated vertex pairs, that is, the expected number of all ordered pairs pv, wq such that there is no path anymore between v and w after destruction took place. The model allows many variations since the edge to destroy is determined randomly according to a probability measure that may even depend on the graph (this dependence is known to the players). 1 In this work, we use the stability concept of swap equilibrium (SE) [1] for the destruction model. Moreover, we extend the model to the destruction of exactly one vertex instead of an edge. We will henceforth speak of edge destruction model and vertex destruction model in order to distinguish the two.

Previous and Related Work
Network formation games date back to the 1990ies, see Jackson and Wolinsky [10] for an early publication. In Computer Science, network formation games have gained attention since the work by Fabrikant et al. [7] in 2003. The destruction model was introduced by Kliemann in 2010 [11] and subsequently studied in a series of publications [12,13,14]. The focus was on the price of anarchy for Nash equilibrium (NE) and pairwise stability (PS). Earlier works on robustness in network formation include [2,5,9,10,18]. None of those earlier models allows a structure-dependent destruction probability as in the destruction model; for a detailed discussion we refer to [12,Sec. 4].
The stability concepts of NE and PS require an edge cost parameter α P R ą0 . Computationally deciding whether a graph constitutes an NE is hindered by an exponential search space, and can indeed be NP-hard [7]. This has raised concerns about the applicability of the model, since we should not expect players to solve an NP-hard problem. Therefore, many variations have been introduced in order to make the model more tractable. Usually, the idea is to limit the choices of the players, for example, to single-edge deviations [10,15]. An even more drastic approach was suggested by Alon et al. in 2010 [1]. They removed the α parameter and considered only edge swaps: as graph is a swap equilibrium if no player can improve her cost by removing an incident edge and then creating a new incident edge -this action is called an edge swap. It is also allowed to simply remove an incident edge without creating a new one, which can make sense if edges can be harmful, e. g., if cost incorporates the risk of contagion. A variation, introduced by Mihalák and Schlegel in 2012 [17], are edge ownerships: each edge is owned by exactly one of its endpoints and may only be swapped (or removed) by its owner. The resulting stability concept is called asymmetric swap equilibrium (ASE). We do not consider edge ownerships or ASE in this work, but this extension is most certainly interesting for future work.
The following three recent publications address robustness in a network formation framework similar to ours: • Meirom et al. [16] consider a cost function that uses a linear combination of the lengths of two short disjoint paths. The idea is that players build a graph where for each shortest path, there is a backup path of reasonable length.
• Goyal et al. [8] consider a model where each player, in addition to building edges, can choose to immunize herself in exchange for a fee. Then an adversary selects a connected component of non-immunized vertices to destroy; an alternative description is that the adversary picks a vertex and then the destruction spreads from there while immunized vertices act as firewalls. A player's utility is the expected size of her connected component after the destruction took place, which is 0 if the player itself is destroyed. This utility is almost exactly the positive version of our cost: if Cpvq is the expected number of cut-off vertices, then n´Cpvq is the expected size of v's component after the attack. (We differ in that if the player itself is attacked, we say that it is cut-off from n´1 vertices, so its components size is 1, not 0.) However, the kind of destruction is very different from ours. Although it can be formulated as an attack on a vertex, the contagious properties of the attack move the focus to different connectivity properties of the attacked vertex in comparison to our model. For example, if a leaf (that is, a vertex of degree 1) is attacked in our model, the overall damage is relatively small, namely we have 2pn´1q separated vertex pairs. In their model however, if the neighbor of the leaf is not immunized, the destruction will spread and the overall damage can be much higher.
For earlier work on network formation with contagious risk, see [3].
• Chauhan et al. [4] extended the edge destruction model by incorporating distances: cost for player v is the expected sum of distances to all other players after edge destruction.

Our Contribution
We prove quantitative and structural results for two types of destroyers under the stability concept of swap equilibrium (SE): the uniform destroyer picks an edge or vertex uniformly at random, while the extreme destroyer picks an edge or vertex uniformly at random from the set of edges or vertices, respectively, where the destruction of each causes a maximum number of vertex pairs to be separated. An edge or vertex that does the latter is called a max-sep edge or max-sep vertex, respectively. For edge destruction, we also consider some variations, most notably a destroyer that chooses an edge from the set of bridges uniformly at random. For vertex destruction, we also consider the case that the probability for destruction of a vertex v is proportional to its degree degpvq, which we call the degree-proportional destroyer.
We prove that for uniform and extreme edge destruction and uniform bridge destruction, an SE is bridgeless or has a star-like structure. A consequence of this is that in terms of social cost, those SE are very efficient, namely social cost of any of those SE is Opnq. For uniform vertex destruction, we prove that if an SE is not two-connected, then it is a tree. This again implies an Opnq bound on the social cost.
For the degree-proportional vertex destroyer, the situation is very different. Social cost of an SE can be as high as Ωpn 2 q, which is the highest order possible in this model. This lower bound is attained on a simple graph, namely a star.
For extreme vertex destruction, we also give a super-linear lower bound on the social cost of SE, namely Ωpn 3{2 q. The construction is still roughly star-like, but more complicated: we need a clique of certain size at the center to which paths up to a certain length are attached.
Finally, we prove a structural result for extreme vertex destruction: if n ě 8, there is no tree SE with only one max-sep vertex. This means that in a tree SE (with n ě 8), the destroyer will always have at least two vertices to choose from.

Ongoing Work and Open Problems
We have extensive experimental evidence and also indications on the theory side that our structural result for the extreme vertex destroyer (that there is no SE tree with one max-sep vertex for n ě 8) can be extended in two ways. We conjecture for n " Ωp1q: (i) There is no SE graph under extreme vertex destruction with only one max-sep vertex.
(This extends our result for trees to general graphs.) (ii) There is no SE graph under extreme vertex destruction that is a tree. (This extends our non-existence result for trees with one max-sep vertex to trees in general.) We expect to prove at least one of those two conjectures in the near future.
Recall that we prove that unless the graph is two-connected, an SE cannot contain cycles for the uniform vertex destroyer. On the other hand, for the extreme vertex destroyer, our conjecture (ii) would imply that an SE is only possible if we have at least one cycle. It would then be interesting to find a family pD ε q εPr0,1s of vertex destroyers such that D 0 is the uniform destroyer and D 1 is the extreme destroyer, and the others are something suitable in between. When moving ε from 0 to 1, the probability measure should concentrate more and more on the max-sep vertices. It would then be interesting to find out at which values of ε the situation switches from no non-two-connected SE having a cycle to each SE having a cycle. Our conjecture (ii) would imply that it must switch an odd number of times.
Another interesting direction is the extension to edge ownerships and the asymmetric swap equilibrium. Closing the gap between our lower Ωpn 3{2 q bound and the trivial Opn 2 q upper bound for social cost of extreme vertex destruction is also an open task.

Model and Notation
Fix the number of players n P N ě3 . All our graphs are finite, simple, and undirected. The undirected edge {v, w} between vertices v and w is denoted vw or wv. Denote G n the set of all graphs on the vertex set V n :" rns :" {1, . . . , n}. We use the term player and vertex synonymously for graphs in G n . A swap for a graph G P G n is a triple of players pa, b, cq such that ab P EpGq and ac R EpGq. Denote SpGq Ď V 3 n the set of all swaps of G. Denote G`pa, b, cq the graph that is obtained from G by removing ab and inserting ac; we say that player a swaps her edge ab for the new edge ac. A cost function C G for G P G n assigns to each player rel G pe, vq :" |{w P V n ; @P P Rpv, wq : e P EpP q}| , that is, the number of vertices for which in order to reach them from v, we necessarily have to traverse edge e. When e is removed from the graph, then there will be exactly rel G pe, vq vertices that v will no longer be able to reach; we also say that those vertices are cut-off from v or that v is cut-off from them. An edge destroyer D is a map that associates with each G P G n a probability measure D G on EpGq, that is, D G peq P r0, 1s for each e, and ePEpGq D G peq " 1. Given D, we define the cost for player v in G as that is, the expected number of vertices that v will be cut-off from after one edge is removed randomly according to the measure D G . If G is disconnected, cost is defined to be 8.
The separation seppeq of an edge e P EpGq is the number of ordered player pairs pv, wq such that the removal of e will destroy all v-w paths in G. If e is a non-bridge, then clearly seppeq " 0. Otherwise, G´e has exactly two components, say K 1 , K 2 Ď V n , and we call νpvq :" min {|K 1 |, |K 2 |} the minimal-component size of e. Then seppeq " 2νpeqpn´νpeqq. It is easy to see that SCpGq " ePEpGq seppeq D G peq.
Vertex Destruction. For the vertex destruction model, the destroyer D associates each G P G n with a probability measure on the vertices of G, that is, D G pvq P r0, 1s for each v P V n , and vPVn D G pvq " 1. We define the destruction of a vertex not as its removal from the graph, but as the removal of all its incident edges. This is reflected by the following definition of relevance and cost. The relevance of u P V n for v P V n is rel G pu, vq :" |{w P V n ; @P P Rpv, wq : u P V pP q}| .
Note that since v is in every v-w path, we have rel G pv, vq " n´1, which is exactly the number of vertices that will be cut-off from v if all edges incident with v are removed. Given a vertex destroyer D, we define the cost for player v in G as Again, a disconnected graph induces infinite cost for each player.
The separation seppuq of a vertex u P V n is the number of ordered player pairs pv, wq such that the removal of u will destroy all v-w paths in G. It is again easy to see that SCpGq " When the graph G is clear from context, we omit the G subscripts or arguments. When a graph G 1 is defined, we write C 1 , rel 1 , SC 1 etc. instead of C G 1 , rel G 1 , SCpG 1 q, etc., respectively. The same goes for G 2 .
For any connected graph G " pV, Eq, we call I Ď V an island if it is inclusion-maximal under the condition that the induced subgraph GrIs is bridge-free (it does not matter whether we mean bridges of G or bridges of GrIs). The bridge tree G of G is obtained by collapsing each island I of G to a single vertex I and inserting an edge between I and J if and only if an edge runs in G between a vertex of I and a vertex of J. Obviously, IJ Þ Ñ I J is a bijection between the set of bridges of G and the set of bridges of G, and we will often identify those two sets. We refer to [12] for a more formal treatment of the bridge tree.
We will also use the better-known block-cutvertex tree, see, e. g., the book by Diestel [6] for a definition.

Uniform Edge and Uniform Bridge Destruction
Denote BpGq Ď EpGq the set of all the bridges of G P G n and S B pGq :" {pa, b, cq P SpGq ; ab P BpGq^G`s is connected} the set of bridge swaps (the case that G`s is disconnected is not interesting since such a swap can never bring an improvement). Clearly, ac P BpG`sq for each pa, b, cq P S B pGq.
An edge destroyer D is called the uniform edge destroyer if D G peq " 1 |EpGq| for each e P EpGq and each G P G n . It is called the uniform bridge destroyer if D G peq " 1 |BpGq| for each e P BpGq and D G peq " 0 for each e P EpGqzBpGq, for each G P G n . (If BpGq " H, the graph is 2-edgeconnected and we can take any probability measure for D G since cost for each player is 0 in any case.) In order to point out what are some of the essential properties of those destroyers, we look at more general destroyers first. Consider the following condition on a destroyer: This means that if after a bridge swap an edge maintains its separation, then it also maintains its probability. This clearly includes the uniform edge destroyer and the uniformly bridge destroyer. The next proposition shows that (2) is equivalent to the following simpler condition: This means that each edge carries its fixed probability that -in case of a bridge -sticks to it even when it is swapped for another edge. Proof. It is clear that (3) implies (2). So let D be a destroyer with property (2). Let G P G n and s " pa, b, cq P S B pGq. Since ν G pabq " ν G`s pacq, we have sep G pabq " sep G`s pacq, hence D G pabq " D G`s pacq. Now, consider the special case first that pa, b, cq is a path in the bridge tree. Then the only separation that changes due to s is that of bc. Since separations of all other edges are maintained, they also maintain their probabilities. Since all the probabilities add up to 1, the edge bc also maintains its probability. In the general case, we have a path gives the graph G`s, and in each step the edges maintain their probability.
The following proof uses the basic idea from [1, Thm. 1].
5 Lemma. Let D be a destroyer with property (3). Then the bridge tree of an SE with respect to D has diameter at most 2.
Proof. Let G be an SE and for contradiction assume that pa, b, c, dq is a path in its bridge tree. Denote n a , n b , n c , n d the numbers of vertices in the subtrees rooted at a, b, c and d, respectively, hence n " n a`nb`nc`nd . Consider the swap s " pa, b, cq. By (2), we have D G pabq " D G`s pacq, and also all other edges maintain their probabilities. We have rel G pab, aq " rel G`s pac, aq and for all the other edges, from the view of a, the only relevance that changes is that of bc, namely from n c`nd to n b . Since G is an SE, this means n c`nd ď n b . Likewise we consider the swap pd, c, bq and obtain n a`nb ď n c . Together this implies n a ď 0, which is impossible.
6 Theorem. Let G be an SE for the uniform edge destroyer. Then G is bridgeless or a star, hence SCpGq ď 2pn´1q " Opnq.
Proof. If G is bridgeless, then SCpGq " 0. So assume that G contains a bridge. We want to show that G is a tree, so for contradiction assume that G is not a tree. Let I be an island containing a cycle and let bc be a bridge with b P I. Then there is a cycle C in I that traverses b. Choose a so that ab P EpCq. Then the swap pa, b, cq puts the bridge bc on a cycle and makes it part of the island, so its relevance for a drops from a positive value to 0. No new bridges are introduced, and the relevances of all other edges remain the same for player a. Hence this is an improving swap, a contradiction to SE.
Since we know that G is a tree, G coincides with its bridge tree. By Lemma 5, diampGq ď 2.
Since n ě 3, we conclude that G is a star. It follows SCpGq " 2pn´1q.
7 Theorem. Let G be an SE for the uniform bridge destroyer. Then G is bridgeless or G is a star where each of the outer islands has exactly one vertex. 2 Hence SCpGq ď 2pn´1q " Opnq.
Proof. If G is bridgeless, then SCpGq " 0. So assume that G contains a bridge. By Lemma 5, G is a star. Let I be an island that is not the center of the star (i. e., it is an outer island) and that contains more than one vertex. Then I contains a cycle. By a swap as in the proof of Theorem 6, the one bridge e between the center of the star and I can be put on a cycle. For the players in I, this is a strict improvement since for them, e had the strictly highest relevance of all bridges in G. The statement on the social cost follows since only one vertex can be separated from the rest of the graph by the removal of a bridge.
We call the edges in E max pGq the max-sep edges. Recall seppeq " 2νpeqpn´νpeqq and note that x Þ Ñ xpn´xq is strictly increasing on r0, n{2s, hence νpeq " νpe 1 q for all e, e 1 P E max pGq. Moreover if νpeq " νpe 1 q for some e P E max pGq and e 1 P EpGq, then e 1 P E max pGq. In other words: exactly all the edges with maximum νpeq are max-sep.
An edge destroyer D is called the extreme edge destroyer if D G peq " 1 |EmaxpGq| for each e P E max pGq and D G peq " 0 for each e P EpGqzE max pGq.
8 Theorem. Let G be an SE under the extreme edge destroyer. Then G is bridgeless or G is a star where each of the outer islands has exactly one vertex. Hence SCpGq ď 2pn´1q " Opnq.
Proof. The expression for the social cost follows from the structural statement. Assume for contradiction that G contains bridges and is not of the stated form.
Case 1: E max " {e 1 , . . . , e k } with k ě 2. By [12,Prop. 9.1], the max-sep edges form a star in the bridge tree. For each i P rks denote K i Ď V n the (unique) minimal component of G´e i , and denote K 0 the island at the center of the star formed by E max . Then V n " ⊍ k i"0 K i and |K i | " |K j | for all i, j P rks. By assumption, |K i | ě 2 for each i. The edge e 1 has its separation reduced since its minimal-component size reduces. The new edge av cannot become max-sep since νpavq " 1 while νpe 2 q ě 2. It follows that E 1 max " {e 2 , . . . , e k }. We have rel 1 pe i , aq " relpe i , aq ă relpe 1 , aq for all i ě 2. Hence C 1 paq ă Cpaq, a contradiction to SE.

Case 1.2:
There is a cycle C in K 1 . Let ab P EpCq and v P K 0 . By essentially the same arguments as in Case 1.1, we show that player a improves by the swap pa, b, vq.
Case 2: E max " {e 1 }. This case is more difficult since after reducing the separation of e 1 , we have no other max-sep edges that could act as a reference. Denote K 1 a component of G´e 1 with minimum size (if both components of G´e 1 have the same size, then pick one arbitrarily) and denote K 0 the island containing the endpoint of e 1 that is not in K 1 .

Case 2.1:
There is a leaf a P K 1 . Denote b the neighbor of a and let v P K 0 . Define G 1 :" G`pa, b, vq. We have ν 1 pe 1 q " νpe 1 q´1, so sep 1 pe 1 q has the next lower possible value below seppe 1 q. Hence E 1 max " {e 1 , e 2 , . . . , e k } for zero or more additional edges e 2 , . . . , e k . Since they all have the same minimum-component size, they cannot be in GrK 1 s, hence they form a star with K 0 as the center (this is the only way that they can form a star in the bridge tree). If av R E 1 max , then C 1 paq " νpe 1 q´1 ă n´νpe 1 q " Cpaq, hence the swap is an improvement. If av P E 1 max , then νpe 1 q´1 " ν 1 pavq " 1, so |K 1 | " 2 and n ě 4. Moreover, k ě 2. It follows C 1 paq " 1 k pn´1`pk´1qpνpe 1 q´1qq " n´2 k`1 . On the other hand Cpaq " n´2. If n ě 5 or k ě 3, this implies an improvement. The remaining case of n " 4 and k " 2 is impossible since for such n, the graph G 1 is a star and thus k " 3.

Case 2.2:
There is a cycle C in K 1 . We consider a swap like the one in Case 1.2. It is not difficult to see that rel 1 pe, aq ă relpe 1 , aq for each e P E 1 max , hence the swap is an improvement.

Uniform and Degree-Proportional Vertex Destruction
A vertex destroyer D is called the uniform vertex destroyer if D G puq " 1 n for each u P V n and each G P G n .
For any connected graph G " pV, Eq, denote BpGq the set of its blocks and ApGq Ď V the set of its cutvertices (also known as articulation points). Denote G the block-cutvertex tree of G, that is, V p Gq " BpGqŸApGq and each edge in G runs between a block and a cutvertex, namely Bv P Ep Gq if B P BpGq and v P B X ApGq. We have |B| ě 2 for each B P BpGq. If |B| ě 3, then GrBs is two-connected; we also say that B is two-connected in G. Recall also that in a two-connected graph, for each vertex v we can find a cycle that visits v.
The following remark is proved by standard arguments, which are included here for completeness.
9 Remark. Let G " pV, Eq be any two-connected graph.
(i) Let x, y, v P V be three distinct vertices. Then there exist paths P " pv, . . . , xq and Q " pv, . . . , yq with V pP q X V pQq " {v}.
(ii) Let W Ď V with |W | ě 2 and v P V zW . Then there are x, y P W with x ‰ y and paths P " pv, . . . , xq and Q " pv, . . . , yq with V pP q X V pQq " {v} and V pP q X W " {x} and V pQq X W " {y}.
Proof. (i) Add a new vertex z to the graph and connect it with x and with y. The resulting graph is again two-connected. Using the global version of Menger's theorem (see, e. g., [6, Thm. 3.3.6]) we find two independent (that is, internally vertex-disjoint) v-z paths. Taking subpaths yields the result.
Let x be the first vertex on P 1 that is also in W . Define P :" pv, . . . , xq as a subpath of P 1 . Likewise, let y be the first vertex on Q 1 that is also in W and define Q :" pv, . . . , yq as a subpath of Q 1 . By (10) we get x ‰ y, and the other properties follow from the choice of x and y.
11 Definition. Let G " pV, Eq be any graph and pB 1 , b 1 , . . . , B k , b k , B k`1 q, k ě 1, be a path in its block-cutvertex tree G. Assume |B 1 | ě 3 and let C " pb 1 , a, . . . , b 1 q be a cycle in B 1 . Let c P B k`1 z{b k }. Then we call the swap pa, b 1 , cq a cycle extension with respect to pB 1 , B k`1 q; note that B 2 , . . . , B k and b 1 , . . . , b k are uniquely determined by the pair pB 1 , B k`1 q since G is a tree.
The name "cycle extension" is chosen since the cycle C is extended into a larger cycle, thereby merging the blocks that are traversed by the new cycle. The merging property is proved in the next proposition.
12 Proposition. With notation as in Definition 11, denote G 1 :" G`pa, b 1 , cq. Then in G 1 , all the blocks B 1 , . . . , B k`1 are merged into one block and the remaining blocks are maintained; in particular, no new cutvertices emerge in G 1 and the separation values of maintained cutvertices do not increase.
Proof. The only non-obvious part is that B 1 :" B 1 Y . . . Y B k`1 is two-connected in G 1 , which we will prove now. Denote C " pb 1 , a, a 1 , . . . , a t , b 1 q for some t. There is a cycle of the form C 1 " pb 1 , . . . , b k , . . . , c, a, a 1 , . . . , a t , u 1 q that starts in B 1 , runs through B 2 , . . . , B k`1 and finally re-enters B 1 .
Let i P rk`1s with |B i | ě 3 and v P B i zV pC 1 q. Claim: in G 1 , there are paths P " pv, . . . , xq and Q " pv, . . . , yq with x, y P V pC 1 q and x ‰ y such that V pP q X V pQq " {v} and V pP q X V pC 1 q " {x} and V pQq X V pC 1 q " {y}.
Proof of Claim: Denote W :" V pC 1 q X B i , then |W | ě 2. By Remark 9(ii) applied with W as defined here the claim is clear for i ě 2, since such B i is two-connected in G 1 (and in G). Hence we consider i " 1. The difficulty is that B 1 may not be two-connected in G 1 since we removed the edge a 1 u 1 . However, none of the paths P or Q guaranteed to exist by Remark 9(ii) in G can use a 1 u 1 since then that path would have more than one vertex in common with W . This concludes the proof of the claim.
We show that in G 1 , there are two independent v-w paths.
• If v, w P B i for some i ď k, then either B i is two-connected and the statement is clear, or |B i | " 2 in which case v, w P V pC 1 q and the independent paths are given through C 1 .
• Let v P B i and w P B j for i ‰ j. If v or w is located on C 1 , then nothing has to be done for that vertex; otherwise we connect it with C 1 via the paths guaranteed by the claim. It is easy to see that this gives two independent v-w paths.
• Let v, w P B 1 . In G, we find two independent v-w paths P and Q in B 1 . At most one of them, say P , uses ab 1 . Instead of using that edge we can, starting at b 1 , run along C 1 until we reach a. That b 1 -a path runs outside of B 1 (except for a and b 1 ) and thus will not interfere with P or Q. 13 Theorem. An SE for the uniform vertex destroyer is two-connected (that is, it has only one block) or it does not contain any cycle and thus is a tree.
Proof. Let an SE graph G P G n be given and assume it contains more than one block. We only need to prove that no block has a cycle, or, equivalently, that each block consists of only two vertices. Suppose for contradiction that B 1 is a block with |B 1 | ě 3 and let B 2 be another block. Let pa, b, cq be a cycle extension with respect to pB 1 , B 2 q and G 1 :" G`pa, b, cq. By Proposition 12, it follows that rel 1 pb, aq ă relpb, aq since in G 1 , removal of b cannot cut a off the one or more vertices in B 2 z{b 1 } anymore. (Recall that a block always contains at least two vertices.) All other relevances for a are maintained or also reduced. Therefore, we have an improvement in the cost of player a, contradicting stability of G.
14 Corollary. Let G P G n be an SE for the uniform vertex destroyer. Then G is either twoconnected or a star, hence SCpGq " 2pn´1q " Opnq or SCpGq " 3n´5`2 n " Opnq.
Proof. Let G be non-two-connected. Then by Theorem 13, G is a tree. By applying the same argument as in proof of Lemma 5, we obtain that the diameter of G is at most 2, i. e., G is a star. The social cost of star is easily computed to be 1 n pn´1qp3n´4q`2pn´1q " 3n´5`2 n .
for each u P V n and each G P G n .
15 Proposition. The star is an SE for the degree-proportional vertex destroyer, and its social cost is 1 2 pn 2`n q´1 " Ωpn 2 q. Proof. Let S P G n be a star. First we prove that S is an SE. Clearly, by just removing an edge (without creating a new one), no player can improve. It is also clear that the only possibility for swapping is from one leaf to another leaf. Let a, c P V be leafs and b the center of the star. Denote S 1 :" S`pa, b, cq. Then we have: After swapping: Hence, C S paq " C S 1 paq. Therefore, the star is an SE. Its social cost is: 16 Corollary. The social cost of SE for the degree-proportional vertex destroyer can be as high as Ωpn 2 q, which is the worst possible order in the destruction model.

Extreme Vertex Destruction
This model is defined similar to the extreme edge destruction model. Denote V max the set of max-sep vertices and n max :" |V max |. The extreme vertex destroyer picks the vertex to destroy uniformly at random from V max . We start with a first step toward understanding the worst-case order of social cost of an SE in this model, by giving an SE example with super-linear lower bound, namely Ωpn 3{2 q. It is unknown at this time whether there is a matching upper bound.
17 Theorem. Let t ě 4 and 0 ď k ď 4t´5 " Θptq. Let G " pV, Eq be the graph consisting of a clique C on t vertices and to each vertex of C there is a path of length k attached (so n :" |V | " tpk`1q). Then G is an SE with SCpGq " Ωpn 3{2 q.
We prove the SE property. Just removing an edge (without building a new one) is clearly not an option for the players on the paths. For a player of the clique C, also nothing changes when removing an edge since due to t ě 4, the set C remains two-connected.
For u P C denote V u the k vertices on the path attached to u (note that u R V u ). In the following, whenever we consider a swap, by G 1 we refer to the graph we obtain from G by applying the swap.
We start with the different swaps available to a player a P C. We have relpu, aq " k`1 for each u P V max z{a}, hence Cpaq " pn´1q`pt´1qpk`1q t .
(i) Consider a swap pa, b, cq with b P C X N paq and c P V u for u P Cz{a}, that is, player a swaps an edge from the clique to some path but not the one connected to a itself. Since t ě 4, the set C remains two-connected. Separation of u and of some vertices in V u is reduced. All other separations are maintained. It follows: Hence the swap is no improvement for player a.
(ii) Consider a swap pa, b, cq with b P C X N paq and c P V a , that is, player a swaps an edge from the clique to its own path. Again, since t ě 4, the set C remains two-connected.
The separation values on some vertices in V a decrease, but that does not change the set of max-sep vertices nor their relevance for a. Hence player a's cost is maintained.
(iii) Consider a swap pa, b, cq with b P V a ; then in order to keep the graph connected, we have c P V a . That is, player a swaps the first edge on its path to some vertex on that path. We only have to exclude that c becomes max-sep; if we achieve that, then we know that a's cost is maintained. Let 2 ď l ď k´1 be the distance between a and c. Then by (1): ðñ n´k ą lpk`1´lq ðù n´k ą pk`1q 2 4 ðñ tpk`1q ą pk`1q 2 4`k ðñ t ą k`1 4`1´1 k`1 ðù 4t´5 ě k The latter is true by the restriction on k in the statement of the theorem. In this computation, we used again that the function x Þ Ñ xpk`1´xq is increasing on r0, pk`1q{2s.
We continue with the swaps available to a player a P V u for some u P C.
(iv) Consider a swap pa, b, cq with distpu, aq ă distpu, bq. Then c P V u with distpu, bq ă distpu, cq, since otherwise the graph would become disconnected. From a computation like in (iii), it follows that this swap cannot make c max-sep. Hence the cost of player a does not change.
(v) Consider a swap pa, b, cq with distpu, aq ą distpu, bq. If c P V u , then again a's cost will not change. If c P C, then c will become the only max-sep vertex in the new graph, clearly increasing a's cost.
Now let c P V w for some w ‰ u, that is, some vertices migrate from u's path to w's path. Separation of w and separation of the vertices v P V w with distpw, vq ď distpw, cq will increase. All other separations are reduced or maintained, so we have V 1 max Ď V w Y {w}. In the best case, k vertices migrate to w's path, only w becomes max-sep, and rel 1 pw, aq " n´2k. In this case: pt´1qpk`1q`pn´kq t´p n´2kq " pt´1qpk`1q`ptpk`1q´kq´tptpk`1q´2kq t " pk`1qp2t´t 2´1 q`p2t´1qk t ď pk`1qp2´tq`2k ď´2pk`1q`2k ă 0 Hence the swap is no improvement for player a.
18 Remark. The graph in Theorem 17 is no SE if k ě 4t´4 " 4pt´1q, that is, if k is larger than the upper bound in the theorem.
Proof. Let a P C and b her neighbor in V a . Let c P C be at distance l from a, to be specified later. Denote G 1 :" G`pa, b, cq. If c becomes max-sep in G 1 , then player a's cost will decrease since rel 1 pc, aq " k, whereas the relevance of a max-sep vertex in G for a is k`1 or n´1. By the computation in Theorem 17(iii), we see that c becomes max-sep if n´k ď lpk`1´lq. We have: n´k ď lpk`1´lq ðñ t ď lpk`1´lq k`1`1´1 k`1 ðù t ď lpk`1´lq k`1`4 5 For odd k ě 4pt´1q and l :" k`1 2 , we have: In the remainder of this work, we provide more insight into the structure of tree SE graphs for the extreme vertex destroyer.
19 Theorem. There is no SE tree with n max " 1, provided that n ě 8.
Proof. Let T " pV, Eq be an SE tree with n max " 1 and u P V max . It is clear that u is a cutvertex, otherwise G is two-connected and thus n max " n. Denote K 1 , . . . , K k , with k ě 2, the components of T´u ordered by non-decreasing sizes |K 1 | ď |K 2 | ď . . . ď |K k |. For convenience, denote n i :" |K i | for each i.
Let v P K 1 and uv P E and w P K 2 with degpwq " 1. We consider T 1 :" T`pv, u, wq, that is, we detach K 1 from u and re-attach it to a leaf of K 2 .