Social Choice Methods for Database Aggregation

TL;DR

This paper explores how to aggregate multiple databases from different sources using social choice theory, ensuring integrity constraints are maintained and query answers are consistent after aggregation.

Contribution

It introduces classes of aggregators that preserve integrity constraints and characterizes query languages for consistent answers in aggregated databases.

Findings

Identifies aggregators respecting integrity constraints in combined databases.

Characterizes query languages with consistent answers post-aggregation.

Provides a foundation for applying social choice techniques to database knowledge representation.

Abstract

Knowledge can be represented compactly in multiple ways, from a set of propositional formulas, to a Kripke model, to a database. In this paper we study the aggregation of information coming from multiple sources, each source submitting a database modelled as a first-order relational structure. In the presence of integrity constraints, we identify classes of aggregators that respect them in the aggregated database, provided these are satisfied in all individual databases. We also characterise languages for first-order queries on which the answer to a query on the aggregated database coincides with the aggregation of the answers to the query obtained on each individual database. This contribution is meant to be a first step on the application of techniques from social choice theory to knowledge representation in databases.

Equations

$$\phi$$

$$\forall \vec{x},\vec{y}\left(P(\vec{x})\wedge P(\vec{y})\wedge \underset{\_}{\bigwedge }i\le k(x_{\_}i=y_{\_}i)\to \underset{\_}{\bigwedge }k<i\le q(x_{\_}i=y_{\_}i)\right)$$

$$\forall x_{\_}1,\dots ,x_{\_}q(P(x_{\_}1,\dots ,x_{\_}q)\to P_{\_}v(x_{\_}k))$$

$$\forall \vec{x}\left(P_{\_}1(\vec{x})\to \exists \vec{y}\left(P_{\_}2(\vec{y})\wedge \underset{\_}{\bigwedge }{j=1}^k(x_{\_}{q}_{\_}1-k+j=y_{\_}j)\right)\right)$$

$$F(\vec{D})=\underset{\_}{\mathrm{argmin}}D\in \mathcal{D}-\text{instances}\sum _{\_}i\in \mathcal{N}\sum _{\_}P\in \mathcal{D}(|D_{\_}i(P)\setminus D(P)|+|D(P)\setminus D_{\_}i(P)|)$$

$$F(\vec{D})$$

$$F(\vec{D})(P)$$

$$\phi$$

$$Ave(ans(D_{\_}1,\phi ),\dots ,ans(D_{\_}n,\phi ))$$

Full text

1 Introduction

Aggregating information coming from multiple sources is a long-standing problem in both knowledge representation and multi-agent systems (see, e.g., [25]). Depending on the chosen representation for the incoming pieces of knowledge or information, a number of competing approaches has seen the light in these literatures. Belief merging [32, 30, 29] studies the problem of aggregating propositional formulas coming from different agents into a set of models, subject to integrity constraints. Judgment and binary aggregation [17, 15, 23] asks individual agents to report yes/no opinions on a set of logically-related binary issues – the agenda – in order to take a collective decision. Social welfare functions, the cornerstone problem in social choice theory (see, e.g., [4]), can also be viewed as mechanisms to merge conflicting information, namely the individual preferences of voters expressed in the form of linear orders over a set of alternatives. Other examples include graph aggregation [19], multi-agent argumentation [9, 10, 12], ontology merging [38], and clustering aggregation [21].

In this work we take a general perspective and represent individual knowledge coming from multiple sources as a profile of databases, modelled as finite relational structures [2, 35]. Our motivation lies inbetween two possibly conflicting views on the problem of information fusion. On the one hand, the study of information merging (typically knowledge or beliefs) in knowledge representation has focused on the design of rules that guarantee the consistency of the outcome, with the main driving principles inspired from the literature on belief revision111Albeit we acknowledge the work of [16, 36], which aggregate individual beliefs, modelled as plausibility orders, in an ”Arrovian” fashion.. On the other hand, social choice theory has focused on agent-based properties, such as fairness and representativity of an aggregation procedure, paying attention as well on possible strategic behaviour by either the agents involved in the process or an external influencing source. While there already have been several attempts at showing how specific merging or aggregation frameworks could be simulated or subsumed by one another (see, e.g., [22, 13, 24, 20]), a more general perspective allows us to find a compromise between the two views described above.

Our Contribution. Our starting point is a set of finite relational structures on the same signature, coming from a group of agents or sources. Then, our research problem is how to obtain a collective database summarising the information received. Virtually all of the settings mentioned above (beliefs, graphs, preferences, judgments, …) can be represented as databases, showing the generality of our approach. We propose a number of rules for database aggregation, some inspired by existing ones from the literature on computational social choice and belief merging, as well as a new one adapted from representations of incomplete information in databases [33]. We privilege computationally friendly aggregators, for which the time to determine the collective outcome is polynomial in the individual input received.

We first evaluate these rules axiomatically, using notions imported from the literature on social choice, to provide a first classification of the agent-based properties satisfied by our proposed rules. Then, when integrity constraints are present, we study how to guarantee that a given aggregator “lifts” the integrity constraint from the individual to the collective level, i.e., the aggregated databases satisfy the same constraints as the individual ones. Specifically, we investigate which rules lift classical integrity constraints from database theory, such as functional dependencies, referential integrity and value constraints. Finally, since databases are typically queried using formulas in first-order logic, a natural question to ask in a multi-agent setting is whether the aggregation of the individual answers to a query coincides with the answer to the same query on the aggregated database. We provide a partial answer to this important problem, by identifying sufficient conditions on the first-order query language.

Related Work. While we are not aware of any application of methods from social choice theory to database aggregation, possibly the closest approach to ours is the work of Baral et al. [5, 6] and Konieczny [28]. In [5] the authors formalize the notion of combining knowledge bases, which are represented as normal Horn-logic programs. These investigations were further pursued in [6], which considers the problem of merging information represented in the form of first-order theories, taking a syntactic rather than a semantic approach (as we do here), and focusing on finding maximally consistent sets of the union of the individual theories received. In doing so, however, the authors privilege the knowledge representation approach, and have no control on the set of agents supporting a given maximally consistent set rather than another. In [28], the author applies techniques from belief merging to the equivalent problem of aggregating knowledge bases of first-order formulas, proposing a number of rules analysed axiomatically. Both contributions stem from a long tradition on combining inconsistent theories, especially in the domain of paraconsistent logics [8, 39]. However, all these approaches focus on merging syntactic representations (e.g., logic programs, first-order theories), while here we operate on semantical instances, i.e., databases. We also mention the work of Lin and Mendelzon [34], proposing an AGM-style approach to merge first-order theories under constraints, reminescent of the distance-based rules that we will consider in Section 3.

Mildly related to the present work is the literature on database repairs. Here the focus is on principles of minimal change, which is the aspiration to keep the recovered data as faithful as possible to the original (inconsistent) database [3]. Our perspective is different, as we analyse aggregation rather then repairing. Nonetheless, we also consider distance-based procedure.

More recently, connections between social choice theory and database querying have been explored in [27], which enriches the tasks currently supported in computational social choice by means of relational databases, thus allowing for sophisticated queries about voting rules, candidates, and voters. Here our aim is symmetric, as we rather apply methods and techniques from computational social choice to database theory.

An overview of the results presented hereafter can be found in [7], which introduces the question of database aggregation and defines some aggregation procedures. Here we extend [7] by considering in detail the problems pertaining to collective rationality through lifting of integrity constraints in Section 5, as well as aggregation and query answering in Section 6.

Structure of the Paper. In Section 2 we present basic notions on databases and integrity constraints. In Sections 3 and 4 we introduce several database aggregation procedures, and we analyse them by proposing a number of axiomatic properties. Sections 5 and  6 contains our main results on the lifting of integrity constraints and aggregated query answering. Section 7 concludes the paper.

2 Preliminaries on Databases

In this section we introduce basic notions on databases that we will use in the rest of the paper. In particular, we adopt a relational perspective [2] and present databases as finite relational structures over database schemas. Hereafter we assume a countable domain $\mathcal{U}$ of elements $u,u^{\prime},\ldots$, for the interpretation of relation symbols.

Definition 1** (Database Schema and Instance).**

*We call a (relational) database schema $\mathcal{D}$ a finite set $\{P_{\_}1/q_{\_}1,\dots,P_{\_}m/q_{\_}m\}$ of relation symbols $P$ with arity $q\in\mathbb{N}$.

Given database schema $\mathcal{D}$ and domain $\mathcal{U}$, a $\mathcal{D}$-instance over $\mathcal{U}$ is a mapping $D$ associating each relation symbol $P\in\mathcal{D}$ with a finite $q$-ary relation over $\mathcal{U}$, i.e., $D(P)\underset{{\tiny f\!in}}{\subset}\mathcal{U}^{q}$.*

By Definition 1 a database instance is a finite (relational) model of a database schema. The active domain $\textit{adom}(D)$ of an instance $D$ is the set of all individuals in $\mathcal{U}$ occurring in some tuple $\vec{u}$ of some predicate interpretation $D(P)$, that is, $\textit{adom}(D)=\bigcup_{\_}{P\in\mathcal{D}}\{u\in\mathcal{U}\mid u=u_{\_}i\text{ for some }\vec{u}\in D(P)\}$. Observe that, since $\mathcal{D}$ contains a finite number of relation symbols and each $D(P)$ is finite, so is $\textit{adom}(D)$. We denote the set of all instances over $\mathcal{D}$ and $\mathcal{U}$ as $\mathcal{D}(\mathcal{U})$. Clearly, the formal framework for databases we adopt is quite simple, but still it is powerful enough to cover practical cases of interest [35]. Here we do not discuss the pros and cons of the relational approach to database theory and refer to the literature for further details [2].

Example 2.1**.**

*To illustrate the notions introduced above, consider a database schema $\mathcal{D}_{\_}F$ for a faculty $F$, registering data on students and staff in two ternary relations $\mathit{Students}/3$ and $\mathit{Staff}/3$, that register IDs, names, and departments of students and staff respectively. A database instance $D_{\_}F$ of $\mathcal{D}_{\_}F$ can be given, for example, as follows:

[TABLE]

[TABLE]

To specify the properties of databases, we make use of first-order logic with equality and no function symbols. Let $V$ be a countable set of individual variables, which are the only terms in the language for the time being.

Definition 2.2** (FO-formulas over $\mathcal{D}$).**

Given a database schema $\mathcal{D}$, the formulas $\varphi$ of the first-order language $\mathcal{L}_{\_}{\mathcal{D}}$ are defined by the following BNF:

[TABLE]

where $P\in\mathcal{D}$, $x_{\_}1,\ldots,x_{\_}{q}$ is a $q$-tuple of variables and $x,x^{\prime}$ are variables.

We assume “$=$” to be a special binary predicate with fixed obvious interpretation. By Def. 2.2, $\mathcal{L}_{\_}\mathcal{D}$ is a first-order language with equality over the relational vocabulary $\mathcal{D}$ and with no function symbols. In the following we use the standard abbreviations $\exists$, $\wedge$, $\vee$, and $\neq$. Also, free and bound variables are defined as standard. For a formula $\varphi\in\mathcal{L}_{\_}{\mathcal{D}}$, we write $\varphi(x_{\_}1,\ldots,x_{\_}\ell)$, or simply $\varphi(\vec{x})$, to list in arbitrary order all free variables $x_{\_}1,\ldots,x_{\_}\ell$ of $\varphi$. A sentence is a formula with no free variables. Notice that the only terms in our language $\mathcal{L}_{\_}{\mathcal{D}}$ are individual variables. We can add constants for individuals with some minor technical changes to the definitions and results in the paper. However, these do not impact on the theoretical contribution and we prefer to keep notation lighter.

To interpret FO-formulas on database instances, we introduce assignments as functions $\sigma:V\mapsto\mathcal{U}$. Given an assignment $\sigma$, we denote by $\sigma^{x}_{\_}u$ the assignment such that (i) $\sigma^{x}_{\_}u(x)=u$; and (ii) $\sigma^{x}_{\_}u(x^{\prime})=\sigma(x^{\prime})$, for every variable $x^{\prime}\in V$ different from $x$. We can now define the semantics of $\mathcal{L}_{\_}\mathcal{D}$.

Definition 2.3** (Satisfaction).**

Given a $\mathcal{D}$-instance $D$, an assignment $\sigma$, and an FO-formula $\varphi\in\mathcal{L}_{\_}{\mathcal{D}}$, we inductively define whether $D$ satisfies $\varphi$ under $\sigma$, or $(D,\sigma)\models\varphi$, as follows:

[TABLE]

A formula $\varphi$ is true in $D$, written $D\models\varphi$, iff $(D,\sigma)\models\varphi$, for all assignments $\sigma$.

Observe that in Def. 2.3 we adopt an active-domain semantics, that is, quantified variables range only over the active domain of $D$. This is standard in database theory [2], where $\textit{adom}(D)$ is assumed to be the “universe of discourse”.

Integrity Constraints. It is well-known that several properties and constraints on databases can be expressed as FO-sentences. Here we consider some of them for illustrative purposes.

A functional dependency is an expression of type $\ell_{\_}1,\ldots,\ell_{\_}k\mapsto\ell_{\_}{k+1},\ldots,\ell_{\_}{q}$. A database instance $D$ satisfies a functional dependency $\ell_{\_}1,\ldots,\ell_{\_}k\mapsto\ell_{\_}{k+1},\ldots,\ell_{\_}{q}$ for predicate symbol $P$ with arity $q$ iff for every $q$-tuples $\vec{u}$, $\vec{u}^{\prime}$ in $D(P)$, whenever $u_{\_}i=u^{\prime}_{\_}i$ for all $i\leq k$, then we also have $u_{\_}i=u^{\prime}_{\_}i$ for all $k<i\leq q$. If $k=1$, we say that it is a key dependency. Clearly, any database instance $D$ satisfies a functional dependency $\ell_{\_}1,\ldots,\ell_{\_}k\mapsto\ell_{\_}{k+1},\ldots,\ell_{\_}{q}$ iff it satifies the following FO-sentence:

[TABLE]

A value constraint is an expression of type $n_{\_}k\in P_{\_}v$, where $D(P_{\_}v)$ contains a list of admissible values. A database instance $D$ satisfies a value constraint $n_{\_}k\in P_{\_}v$ for predicate symbol $P$ with arity $q\geq k$ iff for every $q$-tuple $\vec{u}$ in $D(P)$, $u_{\_}k\in D(P_{\_}v)$.Also for value constraints, it is easy to check that an instance $D$ satisfies constraint $n_{\_}k\in P_{\_}v$ for symbol $P$ iff it satisfies the following:

[TABLE]

A referential constraint enforces the foreign key of a predicate $P_{\_}1$ to be the primary key of predicate $P_{\_}2$. A database instance satisfies a referential constraint on the last $k$ attributes, denoted as $(P_{\_}1\to P_{\_}2,k)$, if for every $q_{\_}{1}$-tuple $\vec{u}\in D(P_{\_}1)$, there exists a $q_{\_}{2}$-tuple $\vec{u}^{\prime}\in D(P_{\_}2)$ such that for all $1\leq j\leq k$ we have that $u_{\_}{q_{\_}1-k+j}=u_{\_}j^{\prime}$. A referential constraint can also be translated as an FO-sentence:

[TABLE]

Example 2.4**.**

Clearly, in the database instance in Example 2.1 there is a key dependency between IDs and the other attributes in relations $\mathit{Students}$ and $\mathit{Staff}$, as it is to be expected from any well-defined notion of ID. On the other hand, in relation $\mathit{Staff}$ the department is not a key, as two different tuples have “Mechanical Engineering” as value for this attribute.

3 Aggregators

The main research question we investigate in this paper concerns how to define an aggregated database instance from the instances of $\mathcal{N}=\{1,\dots,n\}$ agents. This question is typical in social choice theory, where judgements, preferences, etc., are aggregated according to some notion of rationality that will be introduced in Section 5.

For the rest of the paper we fix a database schema $\mathcal{D}$ over a common domain $\mathcal{U}$, and consider a *profile * $\vec{D}=(D_{\_}1,\dots,D_{\_}n)$ of $n$ instances over $\mathcal{D}$ and $\mathcal{U}$. Then, we define what is an aggregation procedure on such instances.

Definition 3.5** (Aggregation Procedure).**

Given database schema $\mathcal{D}$ and domain $\mathcal{U}$, an aggregation procedure $F:\mathcal{D}(\mathcal{U})^{n}\to\mathcal{D}(\mathcal{U})$ is a function assigning to each tuple $\vec{D}$ of instances for $n$ agents an aggregated instance $F(\vec{D})\in\mathcal{D}(\mathcal{U})$.

Let $\mathcal{F}$ be the class of all aggregation procedures.

We use $N_{\_}{\vec{u}}^{\vec{D}(P)}::=\{i\in\mathcal{N}\mid\vec{u}\in D_{\_}i(P)\}$ to denote the set of agents accepting tuple $\vec{u}$ for symbol $P$, under profile $\vec{D}$. Note that considering a unique domain $\mathcal{U}$ is not really a limitation of the proposed approach: instances $D_{\_}1,\ldots,D_{\_}n$, each on a possibly different domain $\mathcal{U}_{\_}i$, for $i\leq n$, can all be seen as instances on the union $\bigcup_{\_}{i\in\mathcal{N}}\mathcal{U}_{\_}i$ of all domains.

Hereafter we illustrate and discuss some examples of aggregation procedures. We begin with the class of quota rules, inspired by their homonyms in judgment aggregation [14]. This class includes the classical majority rule, as well the union and the intersection rules which are well-known in modal epistemic logic, corresponding to distributed knowledge and “everybody knows that” [26].

Union Rule (or nomination): for every $P\in\mathcal{D}$, $F(\vec{D})(P)=\bigcup_{\_}{i\leq n}D_{\_}i(P)$. Intuitively, every agent is seen as having partial but correct information about the state of the world. Union can be considered a good aggregator if databases represent the agents’ knowledge bases (certain information).

Intersection Rule (or unanimity): for every $P\in\mathcal{D}$, $F(\vec{D})(P)=\bigcap_{\_}{i\leq n}D_{\_}i(P)$. Here every agent is supposed to have a partial and possibly incorrect vision of the state of the world.

Quota Rules: a quota rule is an aggregation rule $F$ defined via functions $q_{\_}P:\mathcal{U}^{q}\to\{0,1,\ldots,n+1\}$, associating each symbol $P$ and $q$-uple with a quota, by stipulating that $\vec{u}\in F(\vec{D})(P)$ iff $|\{i\mid\vec{u}\in D_{\_}i(P)\}|\geq q_{\_}P(\vec{u})$. $F$ is called uniform whenever $q$ is a constant function for all tuples and symbols. Intuitively, if a tuple $\vec{u}$ appears in at least $q_{\_}P(\vec{u})$ of the initial databases, then it is accepted for symbol $P$.

The (strict) majority rule is a (uniform) quota rule for $q=\lceil(n+1)/2\rceil$; while union and intersection are quota rule for $q=1$ and $q=n$ respectively. We call the uniform quota rules for $q=0$ and $q=n+1$ trivial rules.

The literature on belief merging has proposed and studied extensively procedures based on distances [28, 30, 29], and some of these rules have also been proposed in judgment aggregation [37]. We mention below one of the archetypal rules in this class, which makes use of the symmetric distance.

Distance-Based Rule:

[TABLE]

Intuitively, the symmetric distance minimizes the “distance” between the aggregated database $F(\vec{D})$ and each $D_{\_}i$, defined as the number of tuples in $D_{\_}i$ but not in $F(\vec{D})$, plus the number of tuples in $F(\vec{D})$ but not in $D_{\_}i$, calculated across all $i\in\mathcal{N}$.

Computing the result of distance-based rules is typically a hard computational problem: for instance, the above version on arbitrary propositional constraints is a $\Theta_{\_}2^{p}$-complete problem [31]. Tractable versions can however be obtained by restricting the minimisation to the databases obtained in the input profiles, a viable solution when the set of individual agents in the input is sufficiently large. These rules are known in the literature on judgment aggregation as most representative voter rules [18], and we state here the simplest one.

Average Voter Rule:

[TABLE]

Observe the the two rules above might output a set of equally preferred extensions for a relation symbol $P$. i.e., they are non-resolute rules. We also consider a slight variant of the average voter rule.

Relation-wise Average Voter Rule:

[TABLE]

Notice that, according to (1), the average is computed for each $P\in\mathcal{D}$ independently. In particular, $F(\vec{D})$ does not correspond to any of $D_{\_}1,\ldots,D_{\_}n$ in general.

We now state a class of rules which are typically considered non-desirable in the literature on social choice theory, since they leave a somewhat large set of agents out of the aggregation.

Dictatorship of Agent $i^{*}\in\mathcal{N}$: we have that $F(\vec{D})=D_{\_}{i^{*}}$, i.e., the dictator $i^{*}$ completely determines the aggregated database.

Oligarchy of Coalition $C^{*}\subseteq\mathcal{N}$: for every $P\in\mathcal{D}$, $F(\vec{D})(P)=\bigcap_{\_}{i\in C^{*}}D_{\_}{i}(P)$. Oligarchy reduces to dictatorship for singletons, and to intersection for $C^{*}=\mathcal{N}$.

To conclude, we present a novel definition of aggregation procedure inspired by the literature on incomplete information in databases [33].

Merge with Incomplete Information: for every $P\in\mathcal{D}$, $\vec{u}\in F(\vec{D})(P)$ iff (i) for some $\vec{u}_{\_}1\in D_{\_}{1}(P)$, …, $\vec{u}_{\_}n\in D_{\_}{n}(P)$, for every $k\leq q$, either $u_{\_}{1,k}=\ldots=u_{\_}{n,k}$ and $u_{\_}k=u_{\_}{1,k}$, or $u_{\_}{j,k}\neq u_{\_}{j^{\prime\prime},k}$ for some $j,j^{\prime\prime}\leq n$, and $u_{\_}j=\bot$, where $\bot$ is a new symbol; (ii) for every $\vec{u}^{\prime}\in F(\vec{D})(P)$ and $k\leq q$, $u_{\_}k=\bot$ implies $u^{\prime}_{\_}k=\bot$ or for some $k\leq q$, $u_{\_}k\neq u^{\prime}_{\_}k$.

That is, by (i) whenever elements $u_{\_}1,\ldots,u_{\_}k$ appear at the same positions in some tuples in the profile, then they will appear at those positions in $F(\vec{D})$. On the other hand, if different elements appear, then we insert symbol $\bot$ as a placeholder. By (ii) we discard tuples with “strictly less” information. Notice that merge with incomplete information does not conform entirely with Def. 3.5, as the outcome $F(\vec{D})$ is a database instance on $\mathcal{D}(\mathcal{U}\cup\{\bot\})$, rather than $\mathcal{D}(\mathcal{U})$. Nonetheless all relevant notions on databases and aggregators can be extended seamlessly in what follows.

Example 3.6**.**

Suppose that the database instance $D_{\_}F$ in Example 2.1 is owned by the HR department of the faculty. On the other hand, the registrar and the head office own the following instances $D^{\prime}_{\_}F$ and $D^{\prime\prime}_{\_}F$ respectively, due to differences in updating mechanisms and possibly errors:

[TABLE]

To provide a unique vision of instances $D_{\_}F$, $D^{\prime}_{\_}F$, and $D^{\prime\prime}_{\_}F$ we can in principle choose any of the aggregation procedures introduced above. For instance, the intersection, union and majority aggregated profiles can be given as follows:

[TABLE]

*Clearly, some aggregation procedure do not preserve all integrity constraints, e.g., unions do not preserve key dependencies. Furthermore, aggregation by the average voter rule would output $D_{\_}F$, and by merge with incomplete information would produce the following instance:

[TABLE]

In particular, in this last instance symbol $\bot$ intuitively signals that we are uncertain about the name of staff with ID 02, as well as about the ID and name of staff in the History department.

Note that further aggregation procedures are possible in principle. We choose to focus on those above as they are inspired by well-studied procedures from the literature and, with the exception of the distance-based rule, they are tractable computationally.

4 The Axiomatic Method

Aggregation procedures are best characterised by means of axioms. In particular, we consider the following properties, where relation symbols $P,P^{\prime}\in\mathcal{D}$, profiles $\vec{D},\vec{D}^{\prime}\in\mathcal{D}(\mathcal{U})^{n}$, tuples $\vec{u}$, $\vec{u}^{\prime}\in\mathcal{U}^{+}$ are all universally quantified. We leave the treatment of the merge with incomplete information rule for the end of the section.

Unanimity ($U$): $F(\vec{D})(P)\supseteq\bigcap_{\_}{i\in\mathcal{N}}D_{\_}i(P)$.

By unanimity a tuple accepted by all agents also appears in the aggregated database (for the relevant relation symbol). With the exception of the distance-based rule and trivial quota rules with any of the $q_{\_}P=n+1$, the remaining aggregators from Section 3 all satisfy unanimity.

Groundedness ($G$): $F(\vec{D})(P)\subseteq\bigcup_{\_}{i\in\mathcal{N}}D_{\_}i(P)$.

By groundedness any tuple appearing in the aggregated database must be accepted by some agent. All aggregators in Section 3, with the exception of the distance-based rule and the trivial quota rule with any of the $q_{\_}P=0$, satisfy this property.

Anonymity ($A$): for every permutation $\pi:\mathcal{N}\to\mathcal{N}$, we have $F(D_{\_}1,\ldots,D_{\_}n)=F(D_{\_}{\pi(1)},\ldots,D_{\_}{\pi(n)})$.

By anonymity the identity of agents is irrelevant for the aggregation procedure. This is the case for all aggregators in Section 3 but dictatorship and oligarchy.

Independence ($I$): if $N_{\_}{\vec{u}}^{\vec{D}(P)}=N_{\_}{\vec{u}}^{\vec{D}^{\prime}(P)}$ then $\vec{u}\in F(\vec{D})(P)$ iff $\vec{u}\in F(\vec{D}^{\prime})(P)$.

Intuitively, if the same agents accept (resp. reject) a tuple in two different profiles, then the tuple is accepted (resp. rejected) in both aggregated instances. The axiom of independence is a widespread requirement from social choice theory, and is arguably the main cause of most impossibility theorems, such as Arrow’s seminal result [4]. From a computational perspective, independent rules are typically easier to compute than non-independent ones. Quota rules satisfy independence, as well as dictatorships and oligarchies.

Positive Neutrality ($N^{+}$): if $N_{\_}{\vec{u}}^{\vec{D}(P)}=N_{\_}{\vec{u}^{\prime}}^{\vec{D}(P)}$ then $\vec{u}\in F(\vec{D})(P)$ iff $\vec{u}^{\prime}\in F(\vec{D})(P)$.

Negative Neutrality ($N^{-}$): if $N_{\_}{\vec{u}}^{\vec{D}(P)}=\mathcal{N}\setminus N_{\_}{\vec{u}^{\prime}}^{\vec{D}(P)}$ then $\vec{u}\in F(\vec{D})(P)$ iff $\vec{u}^{\prime}\not\in F(\vec{D})(P)$.

Observe that both versions of neutrality differ from independence as here we consider two different tuples in the same profile, while independence deals with the same tuple in two different profiles. Again, with the exception of the distance-based rule all aggregators introduced in Section 3 satisfy positive neutrality. Most quota rules including union and intersection do not satisfy negative neutrality (see Lemma 4.9 below), dictatorships and oligarchies satisfy the latter axiom.

Permutation-Neutrality ($N^{P}$): Let $\rho:\mathcal{U}\to\mathcal{U}$ be a permutation over the domain $\mathcal{U}$, and $\rho(\vec{D})$ its straightforward lifting to a profile $\vec{D}$, then $F(\rho(\vec{D}))=\rho(F(\vec{D}))$.

All aggregators introduced in Section 3 satisfy permutation-neutrality. We conclude with the following axiom, that formalises the fact that an aggregator keeps on accepting a given tuple if the support for that tuple increases.

Monotonicity ($M$): if $\vec{u}\in F(\vec{D})(P)$ and for every $i\in\mathcal{N}$, either $D_{\_}i(P)=D^{\prime}_{\_}i(P)$ or $D_{\_}i(P)\cup\{\vec{u}\}\subseteq D^{\prime}_{\_}i(P)$, then $\vec{u}\in F(D^{\prime})(P)$.

Combinations of the axioms above can be used to characterise some of the rules that we defined in Section 3. Some of these results, such as the following, lift to databases known results in judgement (propositional) aggregation.

Lemma 4.7**.**

An aggregation procedure satisfies $A$, $I$, and $M$ iff it is a quota rule.

Proof 4.8** (Proof sketch).**

The right-to-left implication follows from the fact that quota rules satisfy independence $I$, anonymity $A$, and monotonicity $M$, as we remarked above. For the left-to-right implication, observe that, to accept a given tuple $\vec{u}$ in $F(\vec{D})(P)$, an independent aggregation procedure will only look at the set of agents $i\in\mathcal{N}$ such that $\vec{u}\in D_{\_}i(P)$. If the procedure is also anonymous, then acceptance is based only on the number of individuals admitting the tuple. Finally, by monotonicity, there is a minimal number of agents required to trigger collective acceptance. That number is the quota associated with the tuple and the symbol at hand.

If we add neutrality, then we obtain the class of uniform quota rules. If we furthermore impose unanimity and groundedness, we exclude the trivial quota rules.

Lemma 4.9**.**

If the number of individuals is odd and $|\mathcal{D}|\geq 2$, an aggregation procedure $F$ satisfies $A$, $N^{-}$, $N^{+}$, $I$ and $M$ on the full domain $\mathcal{D}(\mathcal{U})^{n}$ if and only if it is the majority rule.

Proof 4.10**.**

By positive neutrality the quota must be the same for all tuples and all relation symbols. By negative neutrality the two sets $N_{\_}{\vec{u}}^{\vec{D}(P)}$ and $\mathcal{N}\setminus N_{\_}{\vec{u}}^{\vec{D}(P)}$ must be treated symmetrically. Hence, the only possibility is to have a uniform quota of $(n+1)/2$.

The corresponding versions of these results have been proved to hold in judgment and graph aggregation [14, 19]. We now show the following equivalence between majority and the distance-based rule in the absence of integrity constrains:

Lemma 4.11**.**

In absence of constraints, and for an odd number of agents, the distance-based rule coincides with the majority rule.

Proof 4.12**.**

With a slight abuse of notation, if $A\subseteq\mathcal{U}^{m}$ let $A(\vec{u})$ be its characteristic function. Recall the definition of the distance-based rule. Since the minimisation is not constrained, and all structures are finite, the definition is equivalent to the following:

[TABLE]

Therefore, for each $P\in\mathcal{D}$ and for each $\vec{u}$, if for a majority of the individuals in $\mathcal{N}$ we have that $\vec{u}\in D_{\_}i(P)$, then $\vec{u}\in D(P)$ minimises the overall distance, and symmetrically for the case in which a majority of individuals are such that $\vec{u}\not\in D_{\_}i(P)$.

It is easy to see that the above lemma does not hold in presence of arbitrary integrity constraints (see Example 5.16). We conclude this section with a result on merge with incomplete information. Note that the axioms need to be slightly adapted to account for the addition of a symbol in the output of the aggregator.

Lemma 4.13**.**

Merge with incomplete information satisfies $U$, $A$, $I$, and $N^{+}$, but not $N^{-}$, nor $M$. In particular, by Lemma 4.7 it is not a quota rule.

Proof 4.14**.**

The proof that merge satisfies unanimity $U$ is immediate, similarly for anonymity $A$. As regards independence $I$, if $N_{\_}{\vec{u}}^{\vec{D}(P)}=N_{\_}{\vec{u}}^{\vec{D}^{\prime}(P)}=\mathcal{N}$ then $\vec{u}\in F(\vec{D})(P)$ and $\vec{u}\in F(\vec{D}^{\prime})(P)$ by unanimity. On the other hand, if $N_{\_}{\vec{u}}^{\vec{D}(P)}=N_{\_}{\vec{u}}^{\vec{D}^{\prime}(P)}\neq\mathcal{N}$ then $\vec{u}\notin F(\vec{D})(P)$ and $\vec{u}\notin F(\vec{D}^{\prime})(P)$. For positive neutrality the reasoning is similar: if $N_{\_}{\vec{u}}^{\vec{D}(P)}=N_{\_}{\vec{u}^{\prime}}^{\vec{D}(P)}=\mathcal{N}$ then $\vec{u}\in F(\vec{D})(P)$ and $\vec{u}^{\prime}\in F(\vec{D})(P)$; whereas if $N_{\_}{\vec{u}}^{\vec{D}(P)}=N_{\_}{\vec{u}^{\prime}}^{\vec{D}(P)}\neq\mathcal{N}$ then $\vec{u}\notin F(\vec{D})(P)$ and $\vec{u}^{\prime}\notin F(\vec{D})(P)$. Finally, it is not difficult to find counterexamples for both negative neutrality $N^{-}$ and monotonicity $M$. For instance, as regards $N^{-}$ consider Example 3.6 and tuples $(02,Audrey,Mech.~{}Eng.)$ and $(02,Aubrey,Mech.~{}Eng.)$ in relation $\mathit{Staff}$.

5 Collective Rationality

In this section we analyse further the properties of the aggregation procedures introduced in Section 3. First, we present a notion of collective rationality that aims to capture the appropriateness of a given aggregator $F$ w.r.t. some constraint $\varphi$ on the input instances $D_{\_}1,\ldots,D_{\_}n$. Hereafter let $\varphi$ be a sentence in the first-order language $\mathcal{L}_{\_}{\mathcal{D}}$ associated with $\mathcal{D}$, interpreted as an integrity constraint that is satisfied by all $D_{\_}1,\ldots,D_{\_}n$.

Definition 5.15** (Collective Rationality).**

A constraint $\varphi$ is lifted by an aggregation procedure $F$ if whenever $D_{\_}i\models\varphi$ for all $i\in\mathcal{N}$, then also $F(\vec{D})\models\varphi$. An aggregation procedure $F:\mathcal{D}(\mathcal{U})^{n}\to\mathcal{D}(\mathcal{U})$ is collectively rational (CR) with respect to $\varphi$ iff $F$ lifts $\varphi$.

Intuitively, an aggregator is CR w.r.t. constraint $\varphi$ iff it lifts, or preserves, $\varphi$. Consider the following:

Example 5.16**.**

By Example 3.6 unions are not collective rational w.r.t. dependency constraints. We also provide a further example of first-order collective (ir)rationality with the majority rule. Consider agents 1 and 2 with database schema $\mathcal{D}=\{P/1,Q/2\}$. Two database instances are given as $D_{\_}1=\{P(a),Q(a,b)\}$ and $D_{\_}2=\{P(a),Q(a,c)\}$. Clearly, both instances satisfy integrity constraint $\varphi=\forall x(P(x)\to\exists yQ(x,y))$. However, their aggregate $D=F(D_{\_}1,D_{\_}2)=\{P(a)\}$, obtained by the majority rule, does not satisfy $\varphi$. These small examples, which can be considered a paradox in the sense of [23], shows that not every constraint in the language $\mathcal{L}_{\_}{\mathcal{D}}$ is collective rational w.r.t. unions and majority, thus obtaining a first, simple negative result.

We now focusing on integrity constraints that are proper to databases, as defined in Section 2, presenting sufficient (and possibly necessary) conditions for aggregators to lift them. We begin with functional dependencies.

Proposition 5.17**.**

A quota rule lifts a functional constraint iff for all relation symbols $P$ occurring in the functional constraint we have that $q_{\_}P>\frac{n}{2}$, where $n$ is the number of agents.

Proof 5.18**.**

By assumption, every instance $D_{\_}i$ satisfies the constraint. That is for every tuple $(u_{\_}1,\dots,u_{\_}k)$, either there is a unique $(u_{\_}{k+1},\dots,\allowbreak u_{\_}q)$ such that $(u_{\_}1,\dots,u_{\_}q)=\vec{u}\in D_{\_}i(P)$, or there is none. Suppose now that the constraint is falsified by the collective outcome. That is, there are $\vec{u}\neq\vec{u}^{\prime}$ such that both $\vec{u}\in F(\vec{D})(P)$ and $\vec{u}^{\prime}\in F(\vec{D})(P)$, and $\vec{u}$ and $\vec{u}^{\prime}$ coincide on the first $k$ coordinates. By definition of quota rules, this means that at least $q_{\_}P$ voters are such that $\vec{u}\in D_{\_}i(P)$, and at least $q_{\_}P$ possibly different voters had $\vec{u}^{\prime}\in D_{\_}i(P)$. Since each individual can have either $\vec{u}$ or $\vec{u}^{\prime}$ in $D_{\_}i(P)$, by the pigeonhole principle this is possible if and only if the quota $q_{\_}P\leq\frac{n}{2}$.

As immediate applications of Prop. 5.17, the intersection rule clearly lifts any functional dependency, while the union lifts none, as previously illustrated.

Proposition 5.19**.**

An aggregation procedure $F$ lifts a value constraint if $F$ is grounded.

Proof 5.20**.**

Let $n_{\_}k\in D(P_{\_}v)$ be a value constraint, where for all $i,j\in\mathcal{N}$, we have that $D_{\_}i(P_{\_}v)=D_{\_}j(P_{\_}v)$. A grounded aggregation procedure is such that $F(\vec{D})(P)\subseteq\bigcup_{\_}{i\in\mathcal{N}}D_{\_}i(P)$. Hence, for all $\vec{u}\in F(\vec{D})(P)$, there exists an $i\in\mathcal{N}$ such that $\vec{u}\in D_{\_}i(P)$. Since all individual databases satisfy the value constraint, we have that $u_{\_}k\in D_{\_}i(P_{\_}v)$, and therefore $u_{\_}k\in F(\vec{D})(P_{\_}v)\subseteq\bigcup_{\_}{i\in\mathcal{N}}D_{\_}i(P_{\_}v)$, showing that also $F(\vec{D})(P)$ satisfies the value constraint.

The converse of the Prop. 5.19 is not true in general, since a non-grounded aggregator could be easily devised while still satisfying a given value constraint. Finally, we consider referential constraints.

Proposition 5.21**.**

A quota rule lifts a referential constraint $(P_{\_}1\to P_{\_}2,k)$ iff $q_{\_}{P_{\_}2}=1$.

Proof 5.22**.**

Let $\vec{u}\in F(\vec{D})(P_{\_}1)$. Since all the individual databases satisfy the integrity constraint, we know that for every $i\in\mathcal{N}$ there exists a $\vec{u}_{\_}i\in D_{\_}i(P_{\_}2)$ such that its first $k$ coordinates coincides with the last $k$ coordinates of $P_{\_}1$. Since all $\vec{u}_{\_}i$ are possibly different, they may be supported by one single individual each. Therefore, the referential constraint is lifted if and only if the quota relative to $P_{\_}2$ is sufficiently small, i.e., $q_{\_}{P_{\_}2}=1$.

As an immediate application of Prop. 5.21, intersection and union rules are included in the results above, since they are quota rules. As for the distance-based rule or the average voter rule, we only remark that they lift all integrity constraint by their definition, provided that the minimisation is restricted to consistent databases.

For simpler integrity constraints, notably conjunctions of literals, we show a simple correspondence theorem in the spirit of [23], albeit adapted to the first-order language under consideration. First, we introduce a set $Con\subseteq\mathcal{U}$ of constants in the first-order language, interpreted as themselves in each $D_{\_}i$, that is, $\sigma(c)=c$ for every $c\in Con$. Then, let $\text{\it lit}^{+}\subseteq\mathcal{L}_{\_}{\mathcal{D}}$ be some language containing only positive literals of form $P(c_{\_}1,\ldots,c_{\_}q)$, let $\text{\it lit}^{-}\subseteq\mathcal{L}_{\_}{\mathcal{D}}$ be the set containing only negative literals $\neg P(c_{\_}1,\ldots,c_{\_}q)$, and $\text{\it lit}=lit^{+}\cup lit^{-}$. We can prove the following:

Theorem 5.23**.**

If an aggregator $F$ satisfies $U$ and $G$, then it is collectively rational w.r.t. lit. If $Con=\mathcal{U}$, then every aggregator that is collectively rational w.r.t. lit is also unanimous and grounded.

Proof 5.24**.**

Suppose that aggregator $F$ satisfies $U$ and $G$. Then, we show that it is collectively rational w.r.t. lit. In particular, if all instances $D_{\_}1,\ldots,D_{\_}n$ satisfy formulas $P(c_{\_}1,\ldots,c_{\_}q)$ in $lit^{+}$, then $\vec{c}\in D_{\_}i(P)$ for every $i\in\mathcal{N}$. By unanimity we have that $\bigcap_{\_}{i\in\mathcal{N}}D_{\_}i(P)\subseteq F(\vec{D})(P)$, and therefore $\vec{c}\in F(\vec{D})(P)$. Hence, $F$ is collectively rational on $\text{\it lit}^{+}$. A similar reasoning holds for $\text{\it lit}^{-}$ by using groundedness, and therefore for the whole lit.

As for the converse, suppose that $Con=\mathcal{U}$ and $F$ is collectively rational wrt to lit. Then, choose a profile $D_{\_}1,\ldots,D_{\_}n$ with $\vec{u}\in\bigcap_{\_}{i\in\mathcal{N}}D_{\_}i(P)$, that is, for every $i\in\mathcal{N}$, $D_{\_}i\models P(u_{\_}1,\ldots,u_{\_}q)$. Since we assumed that $Con=\mathcal{U}$, all formulas $P(u_{\_}1,\ldots,u_{\_}q)$ are in $lit^{+}$. Further, $F$ is CR on $D_{\_}1,\ldots,D_{\_}n$ and therefore $F(\vec{D})\models P(u_{\_}1,\ldots,u_{\_}q)$, that is, $\vec{u}\in F(\vec{D})(P)$, which means that $F$ is unanimous. Similarly, and under the same assumption, any $F$ that is collectively rational w.r.t. $\text{\it lit}^{-}$ is grounded.

Note that, differently from the propositional case [23, Theorem 10], here we need both axioms of unanimity and groundedness to preserve both positive and negative literals, while for propositional languages unanimity suffices.

Given the results above, a natural question is to identify the class of aggregators that can lift any integrity constraint, no matter its form. Let us first define the following class:

Definition 5.25** (Generalised dictatorship).**

An aggregation procedure $F:\mathcal{D}(\mathcal{U})^{n}\to\mathcal{D}(\mathcal{U})$ is a generalised dictatorship if there exists a map $g:\mathcal{D}(\mathcal{U})^{n}\to\mathcal{N}$ such that for every $\vec{D}\in\mathcal{D}(\mathcal{U})^{n}$, $F(\vec{D})=D_{\_}{g(\vec{D})}$. Let $GDIC$ be the class of generalised dictatorships.

Generalised dictatorships include classical dictatorships, but also more interesting procedures such as the average voter rule from Section 3, or any other rule which selects the individual input that best summarises a given profile. Clearly, since each single instance satisfies the given set of constraints, a generalised dictatorship is collectively rational with respect to the full first-order language.

Theorem 5.26**.**

$GDIC\subset CR[\mathcal{L}_{\_}{\mathcal{D}}]$**

Observe that while for binary aggregation the theorem above is an equality [23, Theorem 16], this is not the case for database aggregation. This is due to the fact that the first-order language specifies a given database instance only up to isomorphism. The proof of this fact is rather immediate: consider a dictatorship of the first agent, modified by permuting all the elements in $\mathcal{U}$. That is, $F(\vec{D})=\rho(D_{\_}1)$ where $\rho:\mathcal{U}\to\mathcal{U}$ is any permutation different from the identity. Clearly, $D_{\_}1\neq\rho(D_{\_}1)$ but all constraints that were satisfied by $D_{\_}1$ are also satisfied by $\rho(D_{\_}1)$. Hence, this aggregator is collectively rational with respect to the full first-order language $\mathcal{L}_{\_}{\mathcal{D}}$, but is not a generalised dictatorship.

6 Aggregation and Query Answering

In this section we analyse one of the most common operations performed on databases, i.e., query answering, in the light of (rational) aggregation. Observe that any open formula $\varphi(x_{\_}1,\dots,x_{\_}\ell)$, with free variables $x_{\_}1,\dots,x_{\_}\ell$, can be thought of as a query [2]. Evaluating $\varphi(x_{\_}1,\dots,x_{\_}\ell)$ on a database instance $D$ returns the set $ans(D,\varphi)$ of tuples $\vec{u}=(u_{\_}1,\dots,u_{\_}\ell)$ such that the assignment $\sigma$, with $\sigma(x_{\_}i)=u_{\_}i$ for $i\leq\ell$, satisfies $\varphi$, that is, $(D,\sigma)\models\varphi$. Hereafter, with an abuse of notation, we often write simply $(D,\vec{u})\models\varphi$. Given the importance of query answering in database theory, the following question is of obvious interest.

Question 6.27**.**

What is the relation between the answer $ans(F(\vec{D}),\varphi)$ to query $\varphi$ on the aggregated database $F(\vec{D})$, and answers $ans(D_{\_}1,\varphi),\allowbreak\ldots,ans(D_{\_}n,\varphi)$ to the same query on each instance $D_{\_}1,\ldots,D_{\_}n$?

Clearly, given a query $\varphi$, every aggregator $F$ on database instances induces an aggregation procedure $F^{*}$ on the query answers, as illustrated by the following diagram:

D_{\_}1,\ldots,D_{\_}n$$F(\vec{D})$$ans(D_{\_}1,\varphi),\ldots,ans(D_{\_}n,\varphi)$$ans(F(\vec{D}),\varphi)$$F$$\varphi$$\varphi$$F^{*}

Hereafter we consider some examples to illustrate this question.

Example 6.28**.**

If we assume intersection as the aggregation procedure, it is easy to check that in general the answer to a query in the aggregated database is not the intersection of the answers for each single instance. To see this, let $D_{\_}1(P)=\{(a,b)\}$ and $D_{\_}2(P)=\{(a,d)\}$ and consider query $\varphi=\exists yP(x,y)$. Clearly, $ans(D_{\_}1\cap D_{\_}2,\varphi)$ is empty, while $ans(D_{\_}1,\varphi)\cap ans(D_{\_}2,\varphi)=\{a\}$. Hence, in general $\bigcap_{\_}{i\in\mathcal{N}}ans(D_{\_}i,\varphi)\not\subseteq ans(\bigcap_{\_}{i\in\mathcal{N}}D_{\_}i,\varphi)$. The converse can also be the case. Consider instances $D_{\_}1$, $D_{\_}2$ such that $D_{\_}1(P)=\{(a,a),(a,b)\}$, $D_{\_}1(R)=\{c\}$, and $D_{\_}2(P)=\{(a,a),(a,b)\}$, $D_{\_}2(R)=\{d\}$, with query $\varphi=\forall yP(x,y)$. The intersection $ans(D_{\_}1,\varphi)\cap ans(D_{\_}2,\varphi)$ of answers is empty. However the answer w.r.t. the intersection of databases is $ans(D_{\_}1\cap D_{\_}2,\varphi)=\{a\}$, since the active domain of the intersection only includes elements $a$ and $b$. As a result, in general $ans(\bigcap_{\_}{i\in\mathcal{N}}D_{\_}i,\varphi)\not\subseteq\bigcap_{\_}{i\in\mathcal{N}}ans(D_{\_}i,\varphi)$.

A similar argument shows that the union of answers is in general different from the answer on the union of instances.

These examples shows that it is extremely difficult to find aggregators such that the diagram above commutes for any first-order query $\varphi\in\mathcal{L}_{\_}{\mathcal{D}}$. Hence, they naturally raise the question of syntactic restrictions on queries such that the aggregation procedure $F^{*}=\varphi\circ F\circ\varphi^{-1}$ on answers can be expressed explicitly in terms of $F$ (e.g., the intersection of answers is the answer to the query on the intersection)222Hereafter, with an abuse of notation, we write $\varphi$ also to mean the corresponding query evaluation for formula $\varphi$.:

Question 6.29**.**

Given aggregation procedures $F$ and $F^{*}$, is there a restriction on the query language for $\varphi$ such that the diagram above commutes?

This problem is related to the following, more general question.

Question 6.30**.**

Given an aggregation procedure $F$ and a query language $\mathcal{L}$, what is the aggregation procedure $F^{*}$? Can $F^{*}$ be represented “explicitly”, for instance as one of the aggregation procedure introduced in Sec. 3?

For instance, it is immediate that if $F$ and $F^{*}$ are both dictatorships for the same agent $i^{*}\in\mathcal{N}$, then the whole first-order language $\mathcal{L}$ is preserved, that is, the result of querying and then aggregating by $F^{*}$ is the same as aggregating by $F$ and then querying.

The results in this section provide a first, partial answer to Question 6.29. Hereafter, with an abuse of notation, we consider functor $F^{*}$ as an aggregator on databases. Indeed, all $ans(D_{\_}i,\varphi)$ can be seen as a finite relational structures, to which we can apply the aggregators in Sec. 3, as well as the axioms in Sec. 4.

Let us first introduce the positive existential and universal fragments $\mathcal{L}^{+}_{\_}{\exists}$ and $\mathcal{L}^{+}_{\_}{\forall}$ of first-order logic, defined respectively as follows:

[TABLE]

Our first lemma shows a positive result related to Example 6.28, when union is considered instead of intersection.

Lemma 6.31** (Existential Fragment).**

The language $\mathcal{L}^{+}_{\_}{\exists}$ is preserved by unions, that is, for $F$ and $F^{*}$ equal to set-theoretical union, the diagram commutes for the query language $\mathcal{L}^{+}_{\_}{\exists}$.

Proof 6.32**.**

The proof is by induction on the structure of query $\varphi$. For atomic $\varphi=P(x_{\_}1,\ldots,x_{\_}q)$, we have that $\vec{u}\in ans(\bigcup_{\_}{i\in\mathcal{N}}D_{\_}i,\varphi)$ iff $(\bigcup_{\_}{i\in\mathcal{N}}D_{\_}i,\vec{u})\models\varphi$, iff for some $i\in\mathcal{N}$, $(D_{\_}i,\vec{u})\models\varphi$, iff $\vec{u}\in ans(D_{\_}i,\varphi)$ for some $i\in\mathcal{N}$, iff $\vec{u}\in\bigcup_{\_}{i\in\mathcal{N}}ans(D_{\_}i,\varphi)$.

For $\varphi=\psi\lor\psi^{\prime}$, $\vec{u}\in ans(\bigcup_{\_}{i\in\mathcal{N}}D_{\_}i,\varphi)$ iff $(\bigcup_{\_}{i\in\mathcal{N}}D_{\_}i,\vec{u})\models\varphi$, iff $(\bigcup_{\_}{i\in\mathcal{N}}D_{\_}i,\vec{u}_{\_}1)\models\psi$ or $(\bigcup_{\_}{i\in\mathcal{N}}D_{\_}i,\vec{u}_{\_}2)\models\psi^{\prime}$, iff for some $i,j\in\mathcal{N}$, $(D_{\_}i,\vec{u}_{\_}1)\models\psi$ or $(D_{\_}j,\vec{u}_{\_}2)\models\psi^{\prime}$ by induction hypothesis, where $\vec{u}_{\_}1$ and $\vec{u}_{\_}2$ are suitable subsequences of $\vec{u}$. In particular, we have both $(D_{\_}i,\vec{u})\models\psi\lor\psi^{\prime}$ and $(D_{\_}j,\vec{u})\models\psi\lor\psi^{\prime}$, that is, $\vec{u}\in\bigcup_{\_}{i\in\mathcal{N}}ans(D_{\_}i,\varphi)$. On the other hand, $\vec{u}\in\bigcup_{\_}{i\in\mathcal{N}}ans(D_{\_}i,\varphi)$ iff $\vec{u}\in ans(D_{\_}i,\varphi)$ for some $i\in\mathcal{N}$, iff $(D_{\_}i,\vec{u}_{\_}1)\models\psi$ or $(D_{\_}i,\vec{u}_{\_}2)\models\psi^{\prime}$. In both cases, by induction hypothesis $(\bigcup_{\_}{i\in\mathcal{N}}D_{\_}i,\vec{u})\models\varphi$, that is, $\vec{u}\in ans(\bigcup_{\_}{i\in\mathcal{N}}D_{\_}i,\varphi)$.

For $\varphi=\exists x\psi$, $\vec{u}\in ans(\bigcup_{\_}{i\in\mathcal{N}}D_{\_}i,\varphi)$ iff $(\bigcup_{\_}{i\in\mathcal{N}}D_{\_}i,\vec{u})\models\varphi$, iff for some $v\in adom(\bigcup_{\_}{i\in\mathcal{N}}D_{\_}i)$, $(\bigcup_{\_}{i\in\mathcal{N}}D_{\_}i,\allowbreak\vec{u}\cdot v)\models\psi$, and therefore for some $i,j\in\mathcal{N}$, $v\in adom(D_{\_}j)$ and $(D_{\_}i,\vec{u}\cdot v)\models\psi$. Note that if $(D_{\_}i,\vec{u}\cdot v)\models\psi$, then $v\in adom(D_{\_}i)$ as well, as $\varphi$ belongs to the positive (existential) fragment of first-order logic. Hence, for some $i\in\mathcal{N}$, $v\in adom(D_{\_}i)$ and $(D_{\_}i,\vec{u}\cdot v)\models\psi$, that is, $\vec{u}\in ans(D_{\_}i,\varphi)$ for some $i\in\mathcal{N}$. On the other hand, $\vec{u}\in\bigcup_{\_}{i\in\mathcal{N}}ans(D_{\_}i,\varphi)$ iff $\vec{u}\in ans(D_{\_}i,\varphi)$ for some $i\in\mathcal{N}$, iff $v\in adom(D_{\_}i)$ and $(D_{\_}i,\vec{u}\cdot v)\models\psi$, that is, $v\in adom(\bigcup_{\_}{i\in\mathcal{N}}D_{\_}i)$ and $(\bigcup_{\_}{i\in\mathcal{N}}D_{\_}i,\vec{u}\cdot v)\models\psi$ by induction hypothesis. Hence, $\vec{u}\in ans(\bigcup_{\_}{i\in\mathcal{N}}D_{\_}i,\varphi)$.

By Lemma 6.31 queries in $\mathcal{L}^{+}_{\_}{\exists}$ are preserved whenever both $F$ and $F^{*}$ are unions. The interest of such a result is that, in order to get an answer to query $\varphi\in\mathcal{L}^{+}_{\_}{\exists}$ in the aggregated databases $F(\vec{D})$, we might run the query on each instance $D$ separately, and then aggregate the results, whichever is more efficient depending on the size of query $\varphi$ and instances $D_{\_}1,\ldots,D_{\_}n$.

Further, we may wonder whether a result symmetric to Lemma 6.31 holds for intersections and the positive universal fragment $\mathcal{L}^{+}_{\_}{\forall}$ of first-order logic. Unfortunately, in Example 6.28 we provided a formula $\varphi=\forall yP(x,y)$ in $\mathcal{L}^{+}_{\_}{\forall}$ and instances $D_{\_}1$, $D_{\_}2$ such that $ans(D_{\_}1\cap D_{\_}2,\varphi)\not\subseteq ans(D_{\_}1,\varphi)\cap ans(D_{\_}2,\varphi)$. Hence, for $F$ and $F^{*}$ equal to set-theoretical intersection, the diagram above does not commute for the query language $\mathcal{L}^{+}_{\_}{\forall}$.

Nonetheless, we are able to prove a weaker but still significant result related to Question 6.30. Specifically, the next lemma shows that if in the diagram above $F$ is unanimous and the query language is $\mathcal{L}^{+}_{\_}{\forall}$, then $F^{*}$ is unanimous, in the sense that $\bigcap_{\_}{i\in\mathcal{N}}ans(D_{\_}i,\varphi)\subseteq ans(\bigcap_{\_}{i\in\mathcal{N}}D_{\_}i),\varphi)$.

Lemma 6.33**.**

Let aggregator $F$ be unanimous and let $\mathcal{L}^{+}_{\_}{\forall}$ be the query language. Then, the induced aggregator $F^{*}$ is also unanimous.

Proof 6.34**.**

We prove that $\bigcap_{\_}{i\in\mathcal{N}}ans(D_{\_}i,\varphi)\subseteq ans(F(\vec{D}),\varphi)$. So, if $\vec{u}\in\bigcap_{\_}{i\in\mathcal{N}}ans(D_{\_}i,\varphi)$ then for every agent $i\in\mathcal{N}$, $(D_{\_}i,\vec{u})\models\varphi$. We now prove by induction on $\varphi\in\mathcal{L}^{+}_{\_}{\forall}$ that if for every $i\in\mathcal{N}$, $(D_{\_}i,\vec{u})\models\varphi$, then $(F(\vec{D}),\vec{u})\models\varphi$, that is $\vec{u}\in ans(F(\vec{D}),\varphi)$.

As to the base case for $\varphi=P(x_{\_}1,\ldots,x_{\_}q)$ atomic, $(D_{\_}i,\vec{u})\models\varphi$ iff $\vec{u}\in D_{\_}i(P)$ for every $i\in\mathcal{N}$. In particular, $\vec{u}\in F(\vec{D})(P)$ as well by unanimity, and therefore $(F(\vec{D}),\vec{u})\models P(x_{\_}1,\ldots,x_{\_}q)$. The case for identity is immediate.

*As to the inductive case for $\varphi=\psi\land\psi^{\prime}$, suppose that for every $i\in\mathcal{N}$, $(D_{\_}i,\vec{u})\models\varphi$, that is, $(D_{\_}i,\vec{u}_{\_}1)\models\psi$ and $(D_{\_}i,\vec{u}_{\_}2)\models\psi$ for suitable $\vec{u}_{\_}1$ and $\vec{u}_{\_}2$ subsequences of $\vec{u}$. By induction hypothesis we obtain that $(F(\vec{D}),\vec{u}_{\_}1)\models\psi$ and $(F(\vec{D}),\vec{u}_{\_}2)\models\psi^{\prime}$, i.e., $(F(\vec{D}),\vec{u})\models\varphi$. Finally, if $(D_{\_}i,\vec{u})\models\forall x\psi$ for every $i\in\mathcal{N}$, then for all $v\in\textit{adom}(D_{\_}i)$, $(D_{\_}i,\vec{u}\cdot v)\models\psi$. In particular, for all $v\in\textit{adom}(F(\vec{D}))$, $(D_{\_}i,\vec{u}\cdot v)\models\psi$ for every $i\in\mathcal{N}$, and by induction hypothesis, for all $v\in\textit{adom}(F(\vec{D}))$, $(F(\vec{D}),\vec{u}\cdot v)\models\psi$, i.e., $(F(\vec{D}),\vec{u})\models\forall x\psi$. *

Note that set-theoretical intersection is unanimous.

A result symmetric to Lemma 6.33 holds for language $\mathcal{L}^{+}_{\_}{\exists}$ and unions:

Lemma 6.35**.**

Let aggregator $F$ be grounded and let $\mathcal{L}^{+}_{\_}{\exists}$ be the query language. Then, the induced aggregator $F^{*}$ is also grounded.

Proof 6.36**.**

We prove that $ans(F(\vec{D}),\varphi)\subseteq\bigcup_{\_}{i\in\mathcal{N}}ans(D_{\_}i,\varphi)$. So, if $\vec{u}\in ans(F(\vec{D}),\varphi)$ then $(F(\vec{D}),\vec{u})\models\varphi$. We now prove by induction on $\varphi\in\mathcal{L}^{+}_{\_}{\exists}$ that if $(F(\vec{D}),\vec{u})\models\varphi$, then for some $i\in\mathcal{N}$, $(D_{\_}i,\vec{u})\models\varphi$, and therefore $\vec{u}\in\bigcup_{\_}{i\in\mathcal{N}}ans(D_{\_}i,\varphi)$.

As to the base case for $\varphi=P(x_{\_}1,\ldots,x_{\_}q)$ atomic, $(F(\vec{D}),\vec{u})\models\varphi$ iff $\vec{u}\in F(\vec{D})(P)$, iff $\vec{u}\in D_{\_}i(P)$ for some agents $i\in\mathcal{N}$ by groundedness. In particular, $(D_{\_}i,\vec{u})\models\varphi$ as well. The case for identity is immediate.

*As to the inductive case for $\varphi=\psi\lor\psi^{\prime}$, suppose that $(F(\vec{D}),\vec{u})\models\varphi$, i.e., $(F(\vec{D}),\vec{u}_{\_}1)\models\psi$ or $(F(\vec{D}),\vec{u}_{\_}2)\models\psi^{\prime}$ for suitable $\vec{u}_{\_}1$ and $\vec{u}_{\_}2$ subsequences of $\vec{u}$. In the former case, by induction hypothesis we have that for some $i\in\mathcal{N}$, $(D_{\_}i,\vec{u}_{\_}1)\models\psi$, and therefore $(D_{\_}i,\vec{u})\models\varphi$. The case for $(F(\vec{D}),\vec{u}_{\_}2)\models\psi^{\prime}$ is symmetric. Finally, if $(F(\vec{D}),\vec{u})\models\exists x\psi$, then for some $v\in\textit{adom}(F(\vec{D}))$, $(F(\vec{D}),\vec{u}\cdot v)\models\psi$. In particular, by induction hypothesis, $(D_{\_}i,\vec{u}\cdot v)\models\psi$ for some $i\in\mathcal{N}$. Since $\psi$ is a positive formula, $v\in\textit{adom}(D_{\_}i)$, and therefore, $(D_{\_}i,\vec{u}\cdot v)\models\varphi$. *

Note that Lemma 6.33 and 6.35 apply to all quota rules, including union and intersection, though the query language is rather limited.

We now move towards more practical query answering and consider the language $\mathcal{L}_{\_}{CQ}$ of (unions of) conjuctive queries, which is a popular query language in the theory of databases thanks to its NP-complete query answering problem [11]. Formulas in $\mathcal{L}_{\_}{CQ}$ are defined according to the following BNF:

[TABLE]

We now show that the result of conjunctive queries is preserved by merge with incomplete information.

Lemma 6.37**.**

Let aggregator $F$ be merge with incomplete information and let $\mathcal{L}_{\_}{CQ}$ be the query language. Then, the induced aggregator $F^{*}$ is also the merge rule.

Proof 6.38**.**

We show $F^{*}(ans(D_{\_}1,\varphi),\ldots,ans(D_{\_}n,\varphi))=\allowbreak ans(F(\vec{D}),\varphi)$, where both $F$ and $F^{*}$ are the merge rule, by induction on $\varphi\in\mathcal{L}_{\_}{CQ}$. As to the base case for $\varphi=P_{\_}1(x_{\_}1,\ldots,x_{\_}{q_{\_}1})\land\ldots\land P_{\_}m(x_{\_}1,\ldots,x_{\_}{q_{\_}m})$, $(F(\vec{D}),\vec{u})\models\varphi$ iff $\vec{u}_{\_}1\in F(\vec{D})(P_{\_}1)$, …, $\vec{u}_{\_}m\in F(\vec{D})(P_{\_}m)$, where each $\vec{u}_{\_}i$ is a suitable subsequences of $\vec{u}$. This is the case iff for every $j\leq n$, $\vec{u}^{\prime}_{\_}{j,1}\in D_{\_}j(P_{\_}1)$, …, $\vec{u}^{\prime}_{\_}{j,m}\in D_{\_}j(P_{\_}m)$, where each $\vec{u}^{\prime}_{\_}{j,i}$ differs from $\vec{u}_{\_}{i}$ as the latter might contain $\bot$ in designated positions. Again, the above is the case iff for every $j\leq n$, $(D_{\_}j,\vec{u}^{\prime}_{\_}j)\models\varphi$, that is, $\vec{u}\in F^{*}(\{\vec{u}^{\prime}_{\_}{1}\},\ldots,\{\vec{u}^{\prime}_{\_}{n}\})$, where $F^{*}$ is the merge rule. For $\varphi=\psi\lor\psi^{\prime}$, $(F(\vec{D}),\vec{u})\models\varphi$ iff $(F(\vec{D}),\vec{u}_{\_}1)\models\psi$ or $(F(\vec{D}),\vec{u}_{\_}2)\models\psi^{\prime}$, where $\vec{u}_{\_}1$ and $\vec{u}_{\_}2$ are suitable subsequences of $\vec{u}$. By induction hypothesis, this is the case iff $\vec{u}_{\_}1\in F^{*}(ans(D_{\_}1,\psi),\ldots,ans(D_{\_}n,\psi))$ or $\vec{u}_{\_}2\in F^{*}(ans(D_{\_}1,\psi^{\prime}),\ldots,ans(D_{\_}n,\psi^{\prime}))$, that is, iff $\vec{u}\in F^{*}(ans(D_{\_}1,\varphi),\allowbreak\ldots,ans(D_{\_}n,\varphi))$. Finally, for $\varphi=\exists x\psi$, $\vec{u}\in ans(F(\vec{D}),\varphi)$ iff for some $v\in adom(F(\vec{D}))$, $(F(\vec{D}),\vec{u}\cdot v)\models\psi$, iff $\vec{u}\cdot v\in F^{*}(ans(D_{\_}1,\psi),\ldots,\allowbreak ans(D_{\_}n,\psi))$ by induction hypothesis. By definition of $F^{*}$, for every $j\leq n$, $(D_{\_}j,\vec{u}^{\prime}\cdot v^{\prime})\models\psi$, where $\vec{u}^{\prime}\cdot v^{\prime}$ differs from $\vec{u}\cdot v$ as the latter might contain $\bot$ in designated positions. The above is the case iff for every $j\leq n$, $(D_{\_}j,\vec{u}^{\prime})\models\varphi$, iff $\vec{u}\in F^{*}(ans(D_{\_}1,\varphi),\ldots,ans(D_{\_}n,\varphi))$, where $F^{*}$ is the merge rule.

By Lemma 6.37 we can query the individual instances and then merge the corresponding answers instead of querying the merged database.

By using the relation-wise average voter rule, we are able to prove the following preservation result. Hereafter, the average $Ave$ of answers $ans(D_{\_}1,\varphi),\ldots,ans(D_{\_}n,\varphi)$ is computed as follows:

[TABLE]

Note that the relation-wise average voter rule can be defined as the union of the averages of the individual relations associated to each $P\in\mathcal{D}$.

Lemma 6.39**.**

*Let aggregator $F$ be the average rule and let first-order logic $\mathcal{L}$ be the query language. Then, $F^{*}(ans(D_{\_}1,\varphi),\ldots,ans(D_{\_}n,\varphi))=ans(F(\vec{D}),\varphi)$ is a subset of $Ave(ans(D_{\_}1,\varphi),\ldots,\allowbreak ans(D_{\_}n,\varphi))$. *

Proof 6.40**.**

*If $\vec{u}\in F^{*}(ans(D_{\_}1,\varphi),\ldots,ans(D_{\_}n,\varphi))=ans(F(\vec{D}),\varphi)$ then $(F(\vec{D}),\vec{u})\models\varphi$. Now we prove on induction of the structure of $\varphi$ that if $(F(\vec{D}),\vec{u})\models\varphi$ then $\vec{u}$ belongs to the average of $ans(D_{\_}1,\varphi),\ldots,\allowbreak ans(D_{\_}n,\varphi)$. For $\varphi=P(x_{\_}1,\ldots,x_{\_}{q})$, if $(F(\vec{D}),\vec{u})\models\varphi$ then $\vec{u}\in F(\vec{D})(P)$, and therefore $\vec{u}$ belongs to the average of $ans(D_{\_}1,\varphi),\ldots,ans(D_{\_}n,\varphi)$, as $F(\vec{D})$ minimises the distance for all $P\in\mathcal{D}$. For $\varphi=\psi\star\psi^{\prime}$, where $\star$ is a Boolean operator, $(F(\vec{D}),\vec{u})\models\varphi$ iff $(F(\vec{D}),\vec{u}_{\_}1)\models\psi\ \hat{\star}\ (F(\vec{D}),\vec{u}_{\_}2)\models\psi^{\prime}$, where $\hat{\star}$ is the interpretation of $\star$ and $\vec{u}_{\_}1$, $\vec{u}_{\_}2$ are suitable subsequences of $\vec{u}$. By induction hypothesis, then $\vec{u}_{\_}1$ and $\vec{u}_{\_}2$ minimise the distances in the answers to queries $\psi$ and $\psi^{\prime}$ respectively, then $\vec{u}$ does so for $\varphi$, and therefore $\vec{u}$ belongs to the average of $ans(D_{\_}1,\varphi),\ldots,ans(D_{\_}n,\varphi)$. Finally, universal (resp. existential) quantification is dealt with by considering it as a finite conjunction (resp. disjunction). *

To conclude this section we discuss the results obtain so far, which can be seen as a first contribution on the relationship between database aggragation and query answering. In particular, Lemma 6.31 can be seen as a (partial) answer to Question 6.29. Similarly, Lemma 6.33 and 6.35 are related to Question 6.30. However, all the applicability of these results is restricted by the limited expressivity of the query languages. On the other hand, Lemma 6.37 and 6.39 show that merge with incomplete information and the average voter rule preserve (union of) conjuctive queries and the whole of first-order logic respectively. Results along these lines may find application in efficient query answering: it might be that in selected cases, rather than querying the aggregated database $F(\vec{D})$, it is more efficient to query the individual instances $D_{\_}1,\ldots,D_{\_}n$ and then aggregate the answers. Then, it is crucial to know which answers are preserved by the different aggregation procedures. The results provided in this section aimed to be a first, preliminary step in this direction.

7 Conclusions and Related Work

In this paper we have proposed a framework for the aggregation of conflicting information coming from multiple sources in the form of finite relational databases. We proposed a number of aggregators inspired by the literature on social choice theory, and adapted a number of axiomatic properties. We then focused on two natural questions which arise when dealing with the aggregation of databases. First, in Section 5 we studied what kind of integrity constraints are lifted by some of the rules we proposed, i.e., what constraints are true in the aggregated database supposing that all individual input satisfies the same constraints. Second, in Section 6 we investigated first-order query answering in the aggregated databases, characterising some languages for which the aggregation of the answers in the individual databases correspond to the answer to the query on the aggregated database.

Our initial results shed light on the possible use of choice-theoretic techniques in database merging and integration, and opens multiple interesting directions for future research. In particular, the connections to the literature on aggregation and merging can be investigated further. Firstly, Section 5 showcased results for which database aggregation behaves similarly to binary aggregation with integrity constraints (see [23]), but pointed at some crucial differences. In particular, there are natural classes of integrity constraints used in databases for which the equivalent in propositional logic, the language of choice for binary aggregation, would be tedious and lenghty. We were able to provide initial results on their preservation through aggregation. Secondly, the recent work of [19] is also strongly related to our contribution. Since graphs are a specific type of relational structures, our work directly generalise their graph aggregation framework to relations of arbitrary arity. However, the specificity of their setting allows them to obtain very powerful impossibility results, which are yet to be explored in the area of database aggregation. Thirdly, to the best of our knowledge the problem of aggregated query answering is new in the literature on aggregation, albeit a similar problem has been studied in the aggregation of argumentation graphs [12]. Also this direction deserves further investigation.

Acknowledgements. F. Belardinelli acknowledges the support of the ANR JCJC Project SVeDaS (ANR-16-CE40-0021), and U. Grandi the support of the ANR JCJC project SCONE (ANR 18-CE23-0009-01).