Sabotage-Proof Mechanism Design