Supermartingales for Reachability in in Probabilistic Programs - - PowerPoint PPT Presentation
Ranking and Repulsing Supermartingales for Reachability in in Probabilistic Programs Toru Takisaka 1 , Yuichiro Oyabu 2,3 , Natsuki Urabe 1 , Ichiro Hasuo 2,3 National Institute of Informatics, Japan 1 The Graduate University for Advanced
Toru Takisaka1, Yuichiro Oyabu2,3, Natsuki Urabe1, Ichiro Hasuo2,3
National Institute of Informatics, Japan1 The Graduate University for Advanced Studies (SOKENDAI), Japan2 University of Tokyo, Japan3
Formalize the extension procedure from metamathematical viewpoint Discrete → Hybrid Qualitative → Quantitative Formal method for software Specification, verification, Synthesis…
Formal method for CPS
collaborate Machine learning Optimization Control theory Category theory, logic, …
for CPS development
assurance
future integrated development
https://group-mmm.org/eratommsd/
Formalize the extension procedure from metamathematical viewpoint Discrete → Hybrid Qualitative → Quantitative Formal method for software Specification, verification, Synthesis…
Formal method for CPS
collaborate Machine learning Optimization Control theory Category theory, logic, …
for CPS development
assurance
future integrated development
https://group-mmm.org/eratommsd/
Soundness / completeness
KT theorem
Input: probabilistic program
Input: probabilistic program
branching
assignment
Input: probabilistic program
branching
assignment
What is the probability that the program terminates?
(under angelic/demonic scheduler) Problem
We admit continuous variables ⇒ Generally one can’t compute probability efficiently
Input: probabilistic program
⇒ Reachability analysis by supermartingale
branching
assignment
What is the probability that the program terminates?
(under angelic/demonic scheduler) Problem
We admit continuous variables ⇒ Generally one can’t compute probability efficiently
Soundness / completeness
KT theorem
(Agrawal+, POPL’18)
Probabilistic modification of real-world benchmarks
(in Alias+, SAS’10)
A.s. termination is
certified in 20/28 examples
(Steinhardt-Tedrake, IJRR’12)
>99% safety is guaranteed
(Pr(failure) <1%)
The log-base-10 of the failure probability System: pendulum + noise
𝜄
Failure ⇔ 𝜄 > 𝜌/6 at time 𝑢 ≤ 1hour
(Steinhardt-Tedrake, IJRR’12; Chatterjee+, POPL’17 etc.)
Soundness / completeness
KT theorem
𝑚4 𝑚3 𝑚2 𝑚1 𝑦 > 0 ∗ ∗ 𝑢 ≔ 𝑢 + 3 𝑦 ≔ 𝑦 − 1 𝑦 ≤ 0 𝑚5 Start
finite ℝV 𝑢 ≔ 𝑢 + 1 𝑞 ≔ Bernoulli(0.9) 𝑦 ≔ 𝑦 − 𝑞
(Agrawal+, POPL’18 etc.)
𝑚4 𝑚3 𝑚2 𝑚1 𝑦 > 0 ∗ ∗ 𝑢 ≔ 𝑢 + 3 𝑦 ≔ 𝑦 − 1 𝑦 ≤ 0 𝑚5 Start
finite ℝV 𝑢 ≔ 𝑢 + 1 𝑞 ≔ Bernoulli(0.9) 𝑦 ≔ 𝑦 − 𝑞
(Agrawal+, POPL’18 etc.)
𝑚4 𝑚3 𝑚2 𝑚1 𝑦 > 0 ∗ ∗ 𝑢 ≔ 𝑢 + 3 𝑦 ≔ 𝑦 − 1 𝑦 ≤ 0 𝑚5 Start
finite ℝV 𝑢 ≔ 𝑢 + 1 𝑞 ≔ Bernoulli(0.9) 𝑦 ≔ 𝑦 − 𝑞
(Agrawal+, POPL’18 etc.)
𝑚4 𝑚3 𝑚2 𝑚1 𝑦 > 0 ∗ ∗ 𝑢 ≔ 𝑢 + 3 𝑦 ≔ 𝑦 − 1 𝑦 ≤ 0 𝑚5 Start
finite ℝV 𝑢 ≔ 𝑢 + 1 𝑞 ≔ Bernoulli(0.9) 𝑦 ≔ 𝑦 − 𝑞
(Agrawal+, POPL’18 etc.)
𝑚4 𝑚3 𝑚2 𝑚1 𝑦 > 0 ∗ ∗ 𝑢 ≔ 𝑢 + 3 𝑦 ≔ 𝑦 − 1 𝑦 ≤ 0 𝑚5 Start
finite ℝV 0.4 0.6 𝑢 ≔ 𝑢 + 1 𝑞 ≔ Bernoulli(0.9) 𝑦 ≔ 𝑦 − 𝑞
(Agrawal+, POPL’18 etc.)
𝑚4 𝑚3 𝑚2 𝑚1 𝑦 > 0 ∗ ∗ 𝑢 ≔ 𝑢 + 3 𝑦 ≔ 𝑦 − 1 𝑦 ≤ 0 𝑚5 Start
finite ℝV 0.4 0.6 𝑫 = (terminating states) = 𝒎𝟔 × 𝒚, 𝒖, 𝒒 | 𝒖 ≤ 𝟑𝟏
⇒Pr(the system eventually visits the region 𝐷)?
Problem 𝑢 ≔ 𝑢 + 1 𝑞 ≔ Bernoulli(0.9) 𝑦 ≔ 𝑦 − 𝑞
(Agrawal+, POPL’18 etc.)
𝑚4 𝑚3 𝑚2 𝑚1 𝑦 > 0 ∗ ∗ 𝑢 ≔ 𝑢 + 3 𝑦 ≔ 𝑦 − 1 𝑦 ≤ 0 𝑚5 Start
finite ℝV 0.4 0.6 𝑫 = (terminating states) = 𝒎𝟔 × 𝒚, 𝒖, 𝒒 | 𝒖 ≤ 𝟑𝟏
⇒Pr(the system eventually visits the region 𝐷)?
Problem 𝑢 ≔ 𝑢 + 1 𝑞 ≔ Bernoulli(0.9) 𝑦 ≔ 𝑦 − 𝑞 …under angelic/demonic scheduler
(Agrawal+, POPL’18 etc.)
𝑚2 𝑚1 𝑚3 ∗ ∗ 𝑦 ≔ Bernoulli(0.9) 𝑚4 f = 1 f = 𝑦 f = 𝑦 − 1 f = −3 𝔽 the value of 𝑔 at the next state = 0.9 ∀𝑚 𝑚2 → 𝑚 … (angelic) ∃𝑚 𝑚2 → 𝑚 …(demonic)
that is “non-increasing” through transitions
4 3 1 2 3
4 3 1 2 3
> > > > > >
ℕ-valued
4 3 1 2 3
> > > > > >
ℕ-valued
4 3 1 2 3 2 1
> > > > > >
ℕ-valued
1 2 1 2 1
2 1 2 1 2 1
2 1 2 1 2 1 𝔽 the value of 𝑔 at the next state decreases at least 1
[0, +∞)- valued
2 1 2 1 2 1 𝔽 the value of 𝑔 at the next state decreases at least 1
[0, +∞)- valued
Safe region Unsafe region
𝑦init
Safe region Unsafe region
𝑔 < 0
𝑦init
𝑔 ≥ 0
Safe region Unsafe region
𝑔 ≥ 0
𝑦init
𝑔 < 0
𝑔 ≥ 0
Safe region Unsafe region
𝑔 ≥ 0
𝑦init
𝑔 < 0
𝑔 ≥ 0
Safe region Unsafe region
𝑔 ≥ 0
𝑦init
𝑔 < 0
Safe region Unsafe region
𝑦init
Safe region Unsafe region
𝑦init
𝑔 ≤ 𝜀 [0,1]- valued
𝑔 = 1
Safe region Unsafe region
𝑔 = 1
𝑦init
[0,1]- valued
𝑔 ≤ 𝜀
𝑔 = 1
Safe region Unsafe region
𝑔 = 1
𝑦init
[0,1]- valued 𝑔 ≤ 𝜀
𝑔 = 1
Safe region Unsafe region
𝑔 = 1
𝑦init
[0,1]- valued 𝑔 ≤ 𝜀
Soundness / completeness
KT theorem
…under angelic/demonic scheduler
𝑔 is a RankSM ⇒ 𝔽steps ≤ 𝑔 Soundness: Completeness: 𝔽steps is a RankSM
Ranking supermartingale
(𝑔 𝑡 < ∞ ⇒ ℙreach(𝑡) = 1)
Soundness: Completeness:
Nonnegative repulsing supermartingale
𝑔 is a RepSM ⇒ ℙreach ≤ 𝑔 ℙreach is a RepSM
Approximation method Certificate for Soundness Completeness Additive ranking Supermartingale
(Chakarov-Sankaranarayanan, CAV’13 etc.)
Yes (with nondet. / continuous variable) Yes (with nondet. / discrete variable) Nonnegative repulsing supermartingale
(Steinhardt+, IJRR’12 etc.)
Yes (NO nondet. / continuous variable)*
(Urabe+, LICS‘17)
Yes (NO nondet. / continuous variable)
supermartingale
(Chatterjee+, POPL’17)
Yes (with nondet. / continuous var. / linearity assumpt.)
ℙreach ≥ ? ℙreach ≤ ? ℙreach ≤ ?
(ℙreach= 1)
*In [Steinhardt+] continuous-time dynamics is also considered Soundness for c-supermartingale is shown, which is a relaxation of supermartingale
Soundness/completeness of martingale techniques for
PPs with continuous variables and nondeterminism Characterization of martingale techniques via
Knaster-Tarski fixed point theorem Implementation and experiments
Soundness/completeness of martingale techniques for
PPs with continuous variables and nondeterminism Characterization of martingale techniques via
Knaster-Tarski fixed point theorem Implementation and experiments
Approximation method Certificate for Soundness Completeness Additive ranking Supermartingale
(Chakarov-Sankaranarayanan, CAV’13 etc.)
Yes (with nondet. / continuous variable) Yes (with nondet. / discrete variable) Nonnegative repulsing supermartingale
(Steinhardt+, IJRR’12 etc.)
Yes (NO nondet. / continuous variable)*
(Urabe+, LICS‘17)
Yes (NO nondet. / continuous variable)
supermartingale
(Chatterjee+, POPL’17)
Yes (with nondet. / continuous var. / linearity assumpt.)
ℙreach ≥ ? ℙreach ≤ ? ℙreach ≤ ?
(ℙreach= 1)
*In [Steinhardt+] continuous-time dynamics is also considered Soundness for c-supermartingale is shown, which is a relaxation of supermartingale
Approximation method Certificate for Soundness Completeness Additive ranking Supermartingale
(Chakarov-Sankaranarayanan, CAV’13 etc.)
Yes (with nondet. / continuous variable) Yes (with nondet. / discrete variable) Nonnegative repulsing supermartingale
(Steinhardt+, IJRR’12 etc.)
Yes (NO nondet. / continuous variable)
(Urabe+, LICS‘17)
Yes (NO nondet. / continuous variable)
supermartingale
(Chatterjee+, POPL’17)
Yes (with nondet. / continuous var. / linearity assumpt.)
continuous variable)* Yes (with nondet. /
No Yes (with nondet. /
𝔽steps < ∞ ℙreach ≥ ? ℙreach ≤ ? ℙreach ≤ ?
(ℙreach= 1)
*In [Steinhardt+] continuous-time dynamics is also considered Soundness for c-supermartingale is shown, which is a relaxation of supermartingale
Approximation method Certificate for Soundness Completeness Additive ranking Supermartingale
(Chakarov-Sankaranarayanan, CAV’13 etc.)
Yes (with nondet. / continuous variable) Yes (with nondet. / discrete variable) Nonnegative repulsing supermartingale
(Steinhardt+, IJRR’12 etc.)
Yes (NO nondet. / continuous variable)
(Urabe+, LICS‘17)
Yes (NO nondet. / continuous variable)
supermartingale
(Chatterjee+, POPL’17)
Yes (with nondet. / continuous var. / linearity assumpt.)
continuous variable) Yes (with nondet. /
No Yes (with nondet. /
𝔽steps < ∞ ℙreach ≥ ? ℙreach ≤ ? ℙreach ≤ ?
(ℙreach= 1)
*In [Steinhardt+] continuous-time dynamics is also considered Soundness for c-supermartingale is shown, which is a relaxation of supermartingale
ℱ … the set of all (measurable) functions 𝑔: 𝑀 × ℝ𝑊 → 0, ∞ ⊑ … 𝑔 ⊑ ⇔ ∀𝑡. 𝑔 𝑡 ≤ (𝑡)
Our theorem
ℱ … the set of all (measurable) functions 𝑔: 𝑀 × ℝ𝑊 → 0, ∞ ⊑ … 𝑔 ⊑ ⇔ ∀𝑡. 𝑔 𝑡 ≤ (𝑡)
Soundness 𝑔 is a RankSM 𝔽steps ⊑ 𝑔 Our theorem
ℱ … the set of all (measurable) functions 𝑔: 𝑀 × ℝ𝑊 → 0, ∞ ⊑ … 𝑔 ⊑ ⇔ ∀𝑡. 𝑔 𝑡 ≤ (𝑡)
Soundness 𝑔 is a RankSM 𝔽steps ⊑ 𝑔 ⇔ ⇔ Our theorem
ℱ … the set of all (measurable) functions 𝑔: 𝑀 × ℝ𝑊 → 0, ∞ ⊑ … 𝑔 ⊑ ⇔ ∀𝑡. 𝑔 𝑡 ≤ (𝑡)
Soundness 𝑔 is a RankSM 𝔽steps ⊑ 𝑔 ⇔ Knaster-Tarski theorem ⇔ Our theorem
ℱ … the set of all (measurable) functions 𝑔: 𝑀 × ℝ𝑊 → 0, ∞ ⊑ … 𝑔 ⊑ ⇔ ∀𝑡. 𝑔 𝑡 ≤ (𝑡)
Soundness 𝑔 is a RankSM 𝔽steps ⊑ 𝑔 Φ𝔽steps ⊑ 𝔽steps Completeness ⇔ Knaster-Tarski theorem ⇔ Our theorem
ℱ … the set of all (measurable) functions 𝑔: 𝑀 × ℝ𝑊 → 0,1 ⊑ … 𝑔 ⊑ ⇔ ∀𝑡. 𝑔 𝑡 ≤ (𝑡)
Soundness 𝑔 is a RepSM ℙreach ⊑ 𝑔 Ψℙreach ⊑ ℙreach Completeness ⇔ Knaster-Tarski theorem ⇔ Our theorem
Soundness/completeness of martingale techniques for
PPs with continuous variables and nondeterminism Characterization of martingale techniques via
Knaster-Tarski fixed point theorem Implementation and experiments
states, solve:
control flow graph initial state 𝑦𝑗𝑜𝑗𝑢 set of terminal states
states, solve:
control flow graph initial state 𝑦𝑗𝑜𝑗𝑢 set of terminal states
Can be reduced to LP/SDP problem
(e.g. Chakarov-Sankaranarayanan, CAV’13; Chatterjee+, CAV’16)
control flow graph initial state 𝑦𝑗𝑜𝑗𝑢 set of terminal states
Can be reduced to LP problem
(e.g. Chakarov-Sankaranarayanan, CAV’13)
𝛿-scaled submartingale Nonnegative repulsing submartingale
Observed comparative advantage of nonnegative RepSM over 𝜁-decreasing RepSM
Approximation method Certificate for Soundness Completeness Additive ranking Supermartingale
(Chakarov-Sankaranarayanan, CAV’13 etc.)
Yes (with nondet. / continuous variable) Yes (with nondet. / discrete variable) Nonnegative repulsing supermartingale
(Steinhardt+, IJRR’12 etc.)
Yes (NO nondet. / continuous variable)
(Urabe+, LICS‘17)
Yes (NO nondet. / continuous variable)
supermartingale
(Chatterjee+, POPL’17)
Yes (with nondet. / continuous var. / linearity assumpt.)
continuous variable)* Yes (with nondet. /
No Yes (with nondet. /
𝔽steps < ∞ ℙreach ≥ ? ℙreach ≤ ? ℙreach ≤ ?
(ℙreach= 1)
*In [Steinhardt+] continuous-time dynamics is also considered Soundness for c-supermartingale is shown, which is a relaxation of supermartingale