Nondeterminism and probability: A tour of probabilistic programming, from abstraction to the refinement paradox.

Transcription

1 Nondeterminism and probability: A tour of probabilistic programming, from abstraction to the refinement paradox. Annabelle McIver, Macquarie University, Sydney

2 Quick summary A short history of probabilistic programming; How to build the semantics you want in four easy stages; A cute application; The refinement paradox, and how probability can help shed light.

3 A brief History of Computing

4 A brief History of Computing From working-out the theory... to working, in theory.

5 What we want. Computations Probability Nondeterminism (Refinement; abstraction) Program algebra; Behavioural model; Program logic; Proof techniques; Compositionality; Tools. But what does this all mean? How do these things interact?

6 In particular what does it mean for refinement of probability: intuitively you might think that probability should increase up the refinement order... Good 1/3 Bad Good 1/2 Bad

7 In particular what does it mean for refinement of probability: intuitively you might think that probability should increase up the refinement order... Good 1/3 Bad Good 1/2 Bad 1/3 1/2 We re going to look for inspiration from a general mathematical construction called powerdomains.

8 ... but now if we reinstantiate Good and Bad, shouldn t we also have this? Good Bad Good Bad 2/3 1/2 2/3 1/2 We re going to look for inspiration from a general mathematical construction called powerdomains to guide the principles underlying refinement.

9 Powerdomains (Originally) a general technique by which a semantic model can be augmented to include nondeterminism in such a way that the underlying computational structure of the original model is maintained. Functions, S S Relations, S PS

10 Powerdomains When we want to distinguish nontermination from other behaviour, we introduce a special bottom state How do we order the programs so that is worse than everything, and reducing the range of behaviours corresponds to more refined.?

11 Powerdomains: the Smyth order A S B iff ( b B( a A a b)) A S B iff ( A) (B A)? (

12 Powerdomains: the Smyth order A ˆ= {s S ( a A a s} S becomes an order (rather than a pre-order) on up-closed sets. On up-closed sets, refinement is simply reverse subset inclusion. S

13 Probabilistic powerdomains Given a structure (D, ), we can construct a powerdomain (Eval.D, ) where objects are evaluations over D, and the order is defined to make appropriate distinctions. Evaluations are real-valued functions which are defined over the open sets of a (fixed) topology; under certain conditions they can be extended to probability distributions. Computational domains can be reformulated in terms of the Scott Topology: a set is Scott open if it is up-closed and inaccessible (any limit of a chain inside the set can only happen if the chain intersects the set).

14 Probabilistic powerdomains: Evaluations { O Eval.S ˆ= OS [0, 1] Monotone; additive d d iff ( O OS d.o d.o) d d iff ( s S d.{s} d.{s}) Probability can increase up the refinement order!

15 Probabilistic powerdomains: Semantics Given a structure (D, ), we can construct a powerdomain (Eval.D, ) where objects are evaluations over D, and the order is defined to make appropriate distinctions. Programs Probabilistic choice Sequence S Eval.S (P p Q).s ˆ= p P.s + (1 p) Q.s P ; Q ˆ= P Q Q : Eval.S Eval.S Q.d ˆ= s:s (d.s) Q.s

16 p P ' P P;Q = ˆ P(S Q PS, &S ) (a 1/2 b) ' (a 1/2 b) P = ˆ a 1/2 R) (P powerdomains: R = P (Q (1 p)q p Q) qb)) pq P ; Q = ˆ P Q Defining (Eval.(S PS ), & ) (a Probabilistic ' (a (b ' (a b)) Distribution (P p Q).s S1 pq 1/2 1/2 1/2 = ˆ p P.s + (1 p) Q.s Q : Eval.S (Eval.(S (a ' a) 1/4 ((b '! b)eval.s (a ' PS b) ), &S ) Distribution, arithmeti 1/3 ' Pa Q(b Q : Eval.S! Eval.S.d = ˆ (d.s) Q.s (a ' b) a " a= s:s 1/4 1/3 (P Q) ' R = (P ' R) (Q ' R) Q.d = ˆ P p; s:s Q (d.s) Q.s = ˆ P Q P = 'p (a 1/2 b) ˆP a= b 1/2 1/2 P b)sequence ˆ a 1/2 (P p Q) ' R = (P ' R) p (Q ' R) (S &)1/2 b)) ' (a 1/2 b)) 1/2 (b S',(a Distribution (S S, &) 1/3 ' a) 1/4 ' q b) (a 'P b) Distribution, Q :(Q Eval.S Eval.S arithmetic (Pp((b Q) R R) (1 p)q 1/3 =! pq 1 pq(1 p)q R) P = ˆ(P(P p P.s + (1 p) Q.s Q) R = P (Q ) p (bq).s (a (Eval.S, p q pq Q.d = ˆ (d.s) Q.s a " a=a ˆ& )p P.s + (1 p) Q.s 1 pq /4 1/3 s:s (S' pb) Q).s PS,= (S PS, & ) S S ' P P = ˆ a 1/2 b P ' P (P p Q).s = ˆ p P.s (1 p) Q.s + 2/3 P ; Q = ˆ P Q b) ' (a b) P = ˆ a 1/2 b (S PEval.S, & ) ;Q = ˆ P Q P 1/2 (a P 1/2 (Eval.(S PS ), & ) b) ' (a PS b) ), &S ) P = ˆ a 1/2 S 1/2 (Eval.(S 1/2 ' (a ' (b(a'1/2(a b)) b)) Distribution 1/2 (b (a 1/2 ' (ab)) Distributi 1/2 b)) 1/2 1/2 (Eval.S, ) : Eval.S P ;(a Q! = ˆEval.S P Q 1/4 ((b ' Q ' Q a) b) ' b) Distribution, arithmetic 1/3 P P = P (P Q) ' R = (P ' R) (Q ' R) (a :'Eval.S a) 1/4! ((b ' b) (a ' b) Distribution, arithme Eval.S p p p 1/3! Q.d = ˆ (d.s) Q.s s:s P p Q) ' R = (P ' R) (b (a ' b) a "a " a =a a p (Q ' R) 1/4 1/3 a 1/4 b) = Q.d (b = ˆ 1/3 (as:s' (d.s) Q.s :PEval.S Eval.S Eval.S! ˆP a= b (S Q(P, & ) (S S, &) Q) R = P (Q (1 p)q R) P = P ˆ1/2 a 1/2 P p q pq 1 pq P Q.d (P= ˆ ' Q)s:S (d.s) Q.s ' P =P (P ' R) & ' (Q p R) p P (S S, &) (P p Q) q R = P pq (Q (1 p)q R) P ' P (S PS,1 pq &S ) P P = P S &) =P P p (a 'p (ap(s b) ) ˆ a 1/ ' P & P1/2 =Pb) (Eval.S ',, ) R) = (P p Q) ' (P p PR)= 1/2 (Eval.S p,(q = (S (a (a 1/2 Sb)) Distribu 1/2 (b ' (a 1/2 b)) 'PS, & ) (Eval.(S PS ), & b) ' (a P = ˆDistribution, a 1/2 b arithm ' b) S )' b) 1/2 b) = (a ' a) ((b (a 1/4 1/3 (Q p R) &P P ; Q p P ;(S R (S PS, &,S&)P ) = b)) a(b ' b)) Distribution a " a (b(a (a ' PEval.S b)

17 Now we have all the ingredients for instant probabilistic semantics. It s marvelous! You just add water.

18 First try: You will need a flat domain, the Smyth Powerdomain, and the probabilistic powerdomain. First add nondeterminism to Next add nondeterminism to get Finally add probability to get (S S, ) (S PS, S ) (Eval.(S PS ), S )

19 First try: What do we get? Probabilistic arithmetic (P p Q) q R = P pq (Q (1 p)q 1 pq R) Universal probabilistic distributivity... (P p Q) R = (P R) p (Q R)... which implies this... P P = (a 1/2 b) (a 1/2 b) P ˆ= a 1/2 b = (a (a 1/2 b)) 1/2 (b (a 1/2 b)) Distribution = (a a) 1/4 ((b b) 1/3 (a b) Distribution, arithmetic = a 1/4 (b 1/3 (a b) a a = a P P ˆ= a 1/2 b!!

20 Probability versus nondeterminism (y := 0 y := 1); (x := 0 1/2 x := 1) What s the chance that the demon can guess the value of x?

21 Probability versus nondeterminism (y := 0 y := 1); (x := 0 1/2 x := 1) Prob distributes over nondet = (y := 0 y := 1); x := 0 1/2 (y := 0 y := 1); x := 1 In this model, we can reproduce the demon s choice within each probabilistic branch...

22 ... effectively making the demon able to see into the future. Whoops!

23 Next try: You will need a flat domain, the Smyth Powerdomain, the probabilistic powerdomain, and compactness and convexity. First add probability to get (Eval.S, ) Next add nondeterminism to get (S PEval.S, P ) We need some extra closure conditions: (a) up-closed - for termination (b) Convex closed - P p P = P (c) Compact - so that iteration can be approximated by finite computations. As before, refinement is reverse subset inclusion

24 Relational-style semantics for a small sequential language identity [skip].s ˆ= {s} assignment [x := a].s ˆ= {s[x a]} composition [P ; P ].s ˆ= { s : S d.s f.s d [P ].s; f [P ]} where f S S and in general f r means f.s r.s for all s. choice [if B then P else P ].s ˆ= if B.s then [P ].s else [P ].s probability [P p P ].s ˆ= {d p d d [P ].s; d [P ].s} nondeterminism [P P ].s ˆ= [P ].s [P ].s, where in general D is the up-, convex- and Cauchy closure of D. iteration do G P od ˆ= (µx if G then [P ]; X else [skip]).

25 Some nice laws... P P = P (P Q) p (P R) P P (Q p R) P P P P p P = P P p (Q R) = (P p Q) (P p R) P ; (Q p R) P P ; Q p P ; R (Q p R); P = (Q; P p R; P ) This nondeterminism can see what happened after a coin flip, but not before.

26 Probability versus nondeterminism (y := 0 y := 1); (x := 0 1/2 x := 1) What s the chance that the demon can guess the value of x?

27 Probability versus nondeterminism (y := 0 y := 1); (x := 0 1/2 x := 1) Nondet distributes over pro = (y := 0); (x := 0 1/2 x := 1) (y := 1); (x := 0 1/2 x := 1) What s the chance that the demon can guess the value of x? Answer is 1/2.

28 Geometrical interpretation. Prog 0 ˆ= (s:= A 0.5 s:= B) s:= C Prog 1 ˆ= (s:= A s:= C) 0.5 (s:= B s:= C)

29 Geometrical interpretation. Plotted on the same diagram, we can see immediately the relationship between the two programs. Prog 0 ˆ= (s:= A 0.5 s:= B) s:= C Prog 1 ˆ= (s:= A s:= C) 0.5 (s:= B s:= C)

30 Logic and properties Properties are now quantitative ES ˆ= S [0, 1] wp.p.e.s ˆ= ( d P.s e e = ( s : S e.s e.s) Greatest guaranteed expected value of e with respect to the results of P from initial state s. d e) d EvalS, e ES, d e ˆ= s:s d.s e.s

31 Transformer semantics for a small sequential language dentity wp.skip.expt ˆ= expt ssignment wp.(x := E).expt ˆ= expt[x := E] omposition wp.(p ; P ).expt ˆ= wp.p.(wp.p.expt) hoice wp.(if B then P else P fi).expt ˆ= [B] wp.p.expt + [ B] wp.p.expt robability wp.(p p P ).expt ˆ= p wp.p.expt + (1 p) wp.p.expt ondeterminism wp.(p P ).expt ˆ= wp.p.expt min wp.p.expt teration wp.(do B r od).e ˆ= (µx [B] wp.r.x + [ B] e).

32 Geometrical interpretation: Expectations are hyperplanes. wp.prog 1.(2[s = A] + [s = C]) = 1/2 wp.prog 0.(2[s = A] + [s = C]) = 1

33 Logic and properties: the monotonic transformers TS ˆ= ES ES (S PEval.S, wp rp TS wp rp = id rp wp = id, if t.(e p e ) t.e p t.e t.(ke) = kt.e Sublinear t.(e k) t.e k

34 Why so complicated: can t we just have a whole logic based on probabilities, rather than random variables? It s a question of compositionality: Prog 0 ˆ= (s:= A 0.5 s:= B) s:= C Prog 1 ˆ= (s:= A s:= C) 0.5 (s:= B s:= C) Allowed final value(s) of s A B C A, B B, C C, A Maximim possible probability 1/2 1/ Minimim possible probability /2 1/2

35 A quantitative logic based on probabilities is not compositional. Consider the following context : Prog 0 ; Prog 1 ; if s=c then (s:= A 0.5 s:= B) fi if s=c then (s:= A 0.5 s:= B) fi What s the probability that the state is A finally?

36 As we have seen, the two programs can be distinguished in the transformer semantics (by a random variable encoded as an expectation). wp.prog 1.(2[s = A] + [s = C]) = 1/2 wp.prog 0.(2[s = A] + [s = C]) = 1 The transformer semantics, based on full random variables, is compositional.

37 A nice proof rule, proved using the transformer semantics: A loop: do G body od An invariant: [G] I wp.body.i Termination condition: T ˆ= wp.(do G body od).1 A rule: I T I wp.(do G body od).i

38 The jumping bean : specification. [n = N] wp.jump.[n N] The bean must move... 1/2 6/10 1/2 3/10 1/3 1/2 1/2 1/10 [n = N] wp.jump.[n K n N+K] (K is a fixed constant.) The bean can t move too much... 2/3 n wp.jump.n The expected move is at least 0.

39 The jumping bean. 1/2 6/10 1/2 3/10 1/3 1/2 1/2 2/3 1/10 Bean ˆ= wp.(do (n N) jump od) 1 = wp.bean.[n > N] The bean continues to jump, until it exceeds N. The conditions on its behaviour guarantee that it will eventually exceed any bound. Exercise: use the properties of the transformers to prove this. (Should be about 10 lines of proof.)

40 Probability versus nondeterminism: (x := 0 x := 1); (y := 0 1/2 y := 1) = (x := 0 x := 1); (y := 0) 1/2 (x := 0 x := 1); y := 1) The demon can predict the future. (y := 0 1/2 y := 1); (x := 0 x := 1) = y := 0; (x := 0 x := 1) 1/2 y := 1; (x := 0 x := 1) The demon can access the past.

41 Probability versus nondeterminism: Smyth powerdomain, for nondeterminism; then the probabilistic powerdomain on top of that. The demon can predict the future. Probabilistic powerdomain to make EvalS, then the Smyth powerdomain to make, with a special definition of ; S PEval.S, The demon can access the past.

42 Suppose we wanted to prevent the demon from accessing the past, i.e. (y := 0 1/2 y := 1); (x := 0 x := 1) = (y := 0 1/2 y := 1); x := 0 (y := 0 1/2 y := 1); x := 1 How would we build a semantic domain justifying this algebraic property?

43 Suppose we wanted to prevent the demon from accessing the past, i.e. Use the probabilistic powerdomain to build Eval.S Eval.S, and then the Smyth powerdomain to build Eval.S PEval.S How would we build a semantic domain justifying this algebraic property?

44 With this model, we lose some refinements: A B if G then A else B In fact, if we did not ban this refinement and we still had the equality we started with, then we would also have to accept this refinement! (x, y := 0, 0) 1/2 (x, y := 1, 1) x, y := 0, 0

45 An algebraic thought experiment (y := 0 1/2 y := 1); (x := 0 x := 1); if (x = y) then (x, y := 1, 1) else (x, y := 0, 0) (y := 0 1/2 y := 1); (if (y = 0) then x := 0) else x := 1; if (x = y) then Z else W = (y := 0; x := 0 1/2 y := 1; x := 0) if (x = y) then Z else W = Z = x, y := 0, 0

46 (y := 0 1/2 y := 1); (x := 0 x := 1); if (x = y) then Z else W = ((y := 0 1/2 y := 1); x := 0) (y := 0 1/2 y := 1); x := 1; if (x = y) then Z else W ((y := 0 1/2 y := 1); x := 0); if (x = y) then Z else W ((y := 0 1/2 y := 1); x := 1); if (x = y) then Z else W (Z 1/2 W ) (Z 1/2 W ) = (x, y := 0, 0) 1/2 (x, y := 1, 1) (x, y := 0, 0) 1/2 (x, y := 1, 1) x, y := 0, 0

47 The refinement paradox Properties of the logic/algebra in the context where hidden state is an issue are hard to get right, even when there are no probabilities. It turns out to be a really hard problem to find a formalisation which behaves properly for refinement h High security variables (are private ) l Low security variables (are public ) Obviously we want to make sure that going up the refinement order preserves our security properties.

48 The refinement paradox h : {0,..., H} Choose some value for h, but keep it hidden. h : {0,..., H} h := 0 Refinement doesn t preserve the security of the choice?

49 Even refinement of low security variables is a problem. l := 0 l := 1 if (h = 0) then l := 0 else h := 1 And distribution through nondeterminism implies (P Q); R P ; R Q; R := 1); ( := 0 := 1) (h := 0 h := 1); (l := 0 l := 1) = h := 0; (l := 0 l := 1) h := 1; (l := 0 l := 1) h := 0; l := 0 h := 1; l := 1

50 Resolving the paradox Building a model with hidden probabilities, based on the ideas of the final example domain provides the right insights to build a model and logic for refinement and knowledge: The Shadow Knows: Refinement of Ignorance in Sequential Programs, CC Morgan, to appear, Science of Computer Programming

51 bibliography.html