Probabilistic Assertions

Transcription

1 Expressing and Verifying Probabilistic Assertions Adrian Sampson Pavel Panchekha Todd Mytkowicz Kathryn S. McKinley Dan Grossman Luis Ceze University of Washington Microsoft Research University of Washington PLDI 2014

2 Probabilistic assertions express correctness properties in modern software. Our verifier checks them efficiently and accurately.

3 assert file!= NULL test verify check

4 assert efile!= NULL e must hold on every execution

5 Approximate Computing this approximate image is close to its precise version k-means clustering is likely to converge even on unreliable hardware assert e e Obfuscation for Data Privacy obfuscated data is still useful in aggregate Mobile and Sensing sensor error does not render the app s conclusions useless

6 Approximate Computing this approximate image is close to its precise version k-means clustering is likely to converge even on unreliable hardware assert e Traditional assertions are insufficient e for programs with probabilistic behavior. Obfuscation for Data Privacy obfuscated data is still useful in aggregate Mobile and Sensing sensor error does not render the app s conclusions useless

7 Assertions are insufficient for private-data obfuscation true_avg = average(salaries)! private_avg =! average(obfuscate(salaries))! assert true_avg - private_avg! <= 10,000

8 Assertions are insufficient for private-data obfuscation true_avg = average(salaries)! private_avg =! average( obfuscate(salaries))! assert true_avg - private_avg! <= 10,000 probability distribution

9 Assertion assert e

10 Probabilistic assertion p assert e, p, c

11 Probabilistic assertion p assert e, p, c e must hold with probability p at confidence c

12 Probabilistic assertion p assert e, p, c test? verify? check?

13 How to verify a probabilistic assertion probabilistic program float obfuscated(float n) {! return n + gaussian(0.0, );! }! float average_salary(float* salaries) {! total = 0.0;! for (int i = 0; i < COUNT; ++i)! total += obfuscated(salaries[i]);! avg = total / len(salaries);! p_avg =...; passert e, p, c }?

14 How to verify a probabilistic assertion naively probabilistic program float obfuscated(float n) {! return n + gaussian(0.0, );! }! float average_salary(float* salaries) {! total = 0.0;! for (int i = 0; i < COUNT; ++i)! total += obfuscated(salaries[i]);! avg = total / len(salaries);! p_avg =...; passert e, p, c? }

15 How to verify a probabilistic assertion with statistical reasoning queries & inference passert for statistical models for probabilistic software Church Infer.NET [Sankaranarayanan+ PLDI 2013] [Hur+ PLDI 2014]?

16 How to verify a probabilistic assertion efficiently and accurately distribution extraction via symbolic execution statistical verification optimizations float obfuscated(float n) {! return n + gaussian(0.0, );! }! float average_salary(float* salaries) {! total = 0.0;! for (int i = 0; i < COUNT; ++i)! total += obfuscated(salaries[i]);! avg = total / len(salaries);! p_avg =...; passert e, p, c } Bayesian network IR

17 How to verify a probabilistic assertion efficiently and accurately distribution extraction via symbolic execution statistical verification optimizations float obfuscated(float n) {! return n + gaussian(0.0, );! }! float average_salary(float* salaries) {! total = 0.0;! for (int i = 0; i < COUNT; ++i)! total += obfuscated(salaries[i]);! avg = total / len(salaries);! p_avg =...; passert e, p, c } Bayesian network IR implementation for LLVM & Clang

18 How to verify a probabilistic assertion efficiently and accurately distribution extraction via symbolic execution statistical verification optimizations float obfuscated(float n) {! return n + gaussian(0.0, );! }! float average_salary(float* salaries) {! total = 0.0;! for (int i = 0; i < COUNT; ++i)! total += obfuscated(salaries[i]);! avg = total / len(salaries);! p_avg =...; passert e, p, c } Bayesian network IR implementation for LLVM & Clang

19 Distribution extraction: random draws are symbolic symbolic heap a 4.2 b = a + gaussian(0.0, 1.0) a 4.2 b G0,1

20 Concrete vs. symbolic semantics program + input nondeterministic concrete execution outputs

21 Concrete vs. symbolic semantics program + input nondeterministic concrete execution outputs program + input deterministic symbolic execution nondeterministic sampling outputs

22 a 4.2 b G 0,1 input: a = 4.2! b = gaussian(0.0, 1.0)

23 a 4.2 b G 0,1 input: a = 4.2! b = gaussian(0.0, 1.0)! c = a + b c +

24 a 4.2 b G 0,1 input: a = 4.2! b = gaussian(0.0, 1.0)! c = a + b! d = c + b c + d +

25 input: a = 4.2! b = gaussian(0.0, 1.0)! c = a + b! d = c + b d + c + a 4.2 b G 0,1

26 input: a = 4.2! b = gaussian(0.0, 1.0)! c = a + b! d = c + b! if b > 0.5! e = 2.0! else! e = 4.0 d + if c + > a 4.2 G 0,1 0.5 b e? then 2.0 else 4.0

27 input: a = 4.2! b = gaussian(0.0, 1.0)! c = a + b! d = c + b! if b > 0.5! e = 2.0! else! e = 4.0! passert e <= 3.0,! 0.9, 0.9 d e? c + > if then else a 4.2 G 0, b 4.0

28 input: a = 4.2! b = gaussian(0.0, 1.0)! c = a + b! d = c + b! if b > 0.5! e = 2.0! else! e = 4.0! passert e <= 3.0,! 0.9, ? if then + > 4.2 G 0, else 4.0

29 input: a = unif(2.0, 4.2! 9.0) b = gaussian(0.0, 1.0)! c = a + b! d = c + b! if b > 0.5! e = 2.0! else! e = 4.0! passert e <= 3.0,! 0.9, ? if + > then else 4.2 G 0,

30 concrete input salary = $24,000 input distribution salary = uniform( ) testing static analysis

31 More in the paper Arrays & pointers Loops External code Probabilistic path pruning

32 Distribution extraction produces an expression dag Bayesian network > G 0,1

33 Distribution extraction produces an expression dag Bayesian network 4.2 G 0, >

34 Distribution extraction produces an expression dag Bayesian network nodes: random variables 4.2 G 0,1 edges: dependence + directed & acyclic random draws only at leaves > sample in a single pass

35 distribution extraction via symbolic execution statistical verification optimizations float obfuscated(float n) {! return n + gaussian(0.0, );! }! float average_salary(float* salaries) {! total = 0.0;! for (int i = 0; i < COUNT; ++i)! total += obfuscated(salaries[i]);! avg = total / len(salaries);! p_avg =...; passert e, p, c } Bayesian network IR implementation for LLVM & Clang

36 statistical property passert verifier optimization

37 Bayesian-network IR enables new optimizations G Gʹ Gʹʹ + X G(µ X, Y G(µ Y, Z = X + Y 2 X) 2 Y ) ) Z G(µ X + µ Y, 2 X + 2 Y )

38 Bayesian-network IR enables new optimizations c U Uʹ X U(a, b) Y = cx ) Y U(ca, cb)

39 Bayesian-network IR enables new optimizations U c B X U(a, b) Y X apple c a apple c apple b c ) Y B b a a

40 Central Limit Theorem collapses large sums D D D D D D D G + X 1,X 2,...,X n D Y = X i X i ) Y G(nµ D,n 2 D)

41 distribution extraction via symbolic execution statistical verification optimizations float obfuscated(float n) {! return n + gaussian(0.0, );! }! float average_salary(float* salaries) {! total = 0.0;! for (int i = 0; i < COUNT; ++i)! total += obfuscated(salaries[i]);! avg = total / len(salaries);! p_avg =...; passert e, p, c } Bayesian network IR implementation for LLVM & Clang

42 Verification via direct evaluation D D D D D D D + c B

43 Verification via hypothesis testing D3 G 0,1 +, p, c p μ D 2 c >

44 distribution extraction via symbolic execution statistical verification optimizations float obfuscated(float n) {! return n + gaussian(0.0, );! }! float average_salary(float* salaries) {! total = 0.0;! for (int i = 0; i < COUNT; ++i)! total += obfuscated(salaries[i]);! avg = total / len(salaries);! p_avg =...; passert e, p, c } Bayesian network IR implementation for LLVM & Clang

45 Probabilistic assertions for C and C++.c LLVM IR LLVM IR Native Code strawman stress-tester

46 Probabilistic programs used in the evaluation sensing gpswalk salary privacy salary-abs kmeans approximate computing sobel hotspot inversek2j

47 Running time vs. stress testing analyze sample time relative to baseline B B B B B B B B gpswalk salary salary-abs kmeans sobel hotspot inversek h.mean baseline

48 Running time vs. stress testing analyze sample time relative to baseline B N B N B N B N B N B N B N B N gpswalk salary salary-abs kmeans sobel hotspot inversek h.mean baseline no statistical optimizations

49 Running time vs. stress testing analyze sample time relative to baseline gpswalk salary salary-abs kmeans sobel hotspot inversek h.mean B N O B N O B N O B N O B N O B N O B N O B N O optimized 24 faster than baseline verifier on average Mostly analysis time

50 Probabilistic assertions express correctness properties in modern software. Our verifier checks them efficiently and accurately.