Canonical Representations of k-Safety Hyperproperties

Bernd Finkbeiner, Lennart Haas, Hazem TorfahSaarland University

This paper

Representinghyperproperties such as noninterference, observational determinism etc.

canonically as automata

Foundation for automata-based analysis techniques such as monitoring,

and for constructive techniques such as learning.

{T ✓ Traces | 8t, t0 2 T. t =i t0 ) t =o t0}

<latexit sha1_base64="4rMrCXKxpoJ8iw75GEaLEYNQI6w=">AAADJXichVHLahRBFD3p+EjG1xiXbooEUVCGnmzUhRDiAzdClBkTmA5DdU9NTzH9sqomIQ7zLy79DX/AlQi6celW9y48XekIGiTVVN97z7331H3EVaatC8MvS8HyufMXLq6sti5dvnL1Wvv62mtbzkyi+kmZlWYvllZlulB9p12m9iqjZB5najeePq79uwfKWF0WPXdUqf1cpoUe60Q6QsP2IJqLnojsLLbKqTciyqWbaDfvGZkou6CtRyIal0ZmmXD3hLstIl2IXicSTjwaag+80unESWPKQw+WHly0hu2NsBP6I04r3UbZ2FqP7r4DsFO2vyLCCCUSzJBDoYCjnkHC8hugixAVsX3MiRlq2vsVFmgxd8YoxQhJdMp/SmvQoAXtmtP67ISvZLyGmQK3eJ95xpjR9auKuqX8xfvWY+l/X5h75rrCI8qYjKue8QVxhwkjzsrMm8iTWs7OrLtyGOOB70azvsojdZ/JH54n9BhiU+8ReOojU3LE3j7gBArKPiuop3zCIHzHI0rppfIsRcMoyWco6+mzHq65++9STyv9zc7DTvcl172N47OCm1jHHS71PrbwHDssI8EHfMcP/AzeBx+DT8Hn49Bgqcm5gb9O8O03zleyQw==</latexit><latexit sha1_base64="zpg5vPX5V+b/dw5pJSZy5mhIbnQ=">AAADJXichVFLixNBEK4dX7vxFfXopdlFFJQw8aIehOALL8IqibuQWULPpDNp0jM9dndWYsi/8Ef4N/wDnkRYLx696t2D39TOCrrI9tBTVV9VfV2PtDLahzg+WItOnT5z9tz6Ruv8hYuXLrevXH3t7dxlapBZY91uKr0yulSDoINRu5VTskiN2klnj2v/zr5yXtuyHxaV2itkXuqJzmQANGoPk6Xoi8TPU6+CeiOSQoapDsu+k5nyK9h6LJKJddIYEe6IcFMkuhT9TiKCeDjSDLzS+TRI5+xbBi2Dq9aovRV3Yj7iuNJtlK3eZnL7/UFvsW3bXymhMVnKaE4FKSopQDckyeMbUpdiqoDt0RKYg6bZr2hFLeTOEaUQIYHO8M9hDRu0hF1zes7O8IrBdcgUdAP3GTOmiK5fVdA95C/cd4zl/31hycx1hQvIFIwbzPgCeKApIk7KLJrIo1pOzqy7CjSh+9yNRn0VI3Wf2R+eJ/A4YDP2CHrKkTk4Urb3MYEScoAK6ikfMQjueAwpWSpmKRtGCT4HWU8f9WDN3X+XelwZ3O086HRfYt2P6PCs03XapFtY6j3q0XPaRhkZfaTv9IN+Rh+iT9Hn6MthaLTW5Fyjv0707TcupbPJ</latexit><latexit sha1_base64="zpg5vPX5V+b/dw5pJSZy5mhIbnQ=">AAADJXichVFLixNBEK4dX7vxFfXopdlFFJQw8aIehOALL8IqibuQWULPpDNp0jM9dndWYsi/8Ef4N/wDnkRYLx696t2D39TOCrrI9tBTVV9VfV2PtDLahzg+WItOnT5z9tz6Ruv8hYuXLrevXH3t7dxlapBZY91uKr0yulSDoINRu5VTskiN2klnj2v/zr5yXtuyHxaV2itkXuqJzmQANGoPk6Xoi8TPU6+CeiOSQoapDsu+k5nyK9h6LJKJddIYEe6IcFMkuhT9TiKCeDjSDLzS+TRI5+xbBi2Dq9aovRV3Yj7iuNJtlK3eZnL7/UFvsW3bXymhMVnKaE4FKSopQDckyeMbUpdiqoDt0RKYg6bZr2hFLeTOEaUQIYHO8M9hDRu0hF1zes7O8IrBdcgUdAP3GTOmiK5fVdA95C/cd4zl/31hycx1hQvIFIwbzPgCeKApIk7KLJrIo1pOzqy7CjSh+9yNRn0VI3Wf2R+eJ/A4YDP2CHrKkTk4Urb3MYEScoAK6ikfMQjueAwpWSpmKRtGCT4HWU8f9WDN3X+XelwZ3O086HRfYt2P6PCs03XapFtY6j3q0XPaRhkZfaTv9IN+Rh+iT9Hn6MthaLTW5Fyjv0707TcupbPJ</latexit><latexit sha1_base64="rNtFzNWJeSHVc8OvY3qyNf4Qs4Y=">AAACunichVJLS8NAEJ7GV1ur1rOXYBE8lcSLehN8IIJQwdhCLbJJt3FpXmy2xVr8A179dfpbPPjtmgpapBs2M/vNzDePXT+LRK4c571kLS2vrK6VK9X1WnVjc6teu8vTkQy4F6RRKjs+y3kkEu4poSLeySRnsR/xtj881fb2mMtcpMmtmmS8F7MwEQMRMAWo9VBvOE3HLHtecQulQcVK6x90T31KKaARxcQpIQU9IkY5vi655FAGrEdTYBKaMHZOL1RF7AheHB4M6BD/EKdugSY4a87cRAfIEmFLRNq0h31hGH1466wceg75if1ssPDfDFPDrCucQPpgrBjGa+CKHuGxKDIuPGe1LI7UXSka0JHpRqC+zCC6z+CH5wwWCWxoLDadG88QHL45jzGBBNJDBXrKMwbbdNyHZEZyw5IUjAx8ElJPH/Xglt2/dzqveAfN46Z741CZdmiX9nGXh3RCl9RC9gA5XunNurIya/z9GKxS8Sq26deynr4A86+MNw==</latexit><latexit sha1_base64="ABmmjfuEQ2uY3Gvje/X+/CJUtV4=">AAADGnichVLNbhMxEJ5u+WlDgdArF6sVKgcUbbgAByQkCuKCVKqEVspWkXfjbKx414vttCpR3ofX6Av0hJDgBbjSew98O2yRoKrqlXdmvpn5ZsZ2WhntQxx/X4qWb9y8dXtltXVn7e69++0Hax+9nblM9TNrrNtPpVdGl6ofdDBqv3JKFqlRe+n0de3fO1TOa1v2wnGlDgqZl3qsMxkADduDZC56IvGz1KugPomkkGGiw7znZKb8ArYeiWRsnTRGhCcibIlEl6LXSUQQL4eagV2dT4J0zh4xaBlctIbtzbgT8xKXlW6jbFKzdmz7ByU0IksZzaggRSUF6IYkeXwD6lJMFbADmgNz0DT7FS2ohdwZohQiJNAp/jmsQYOWsGtOz9kZqhhsh0xBj7DfMmOK6Lqqgu4hz7E/M5ZfWWHOzHWHx5ApGFeZ8T3wQBNEXJdZNJEXvVyfWU8VaEzPeRqN/ipG6jmzvzzb8DhgU/YIesOROThStg9xAiVkHx3Up3zBIHjiEaRkqZilbBgl+BxkffroB9fc/f9SLyv9p50Xne6HmFboIW3QY9zlM3pF72gH1TM6oZ/0i86iL9Fp9PXPe4iWmoexTv+s6NtvzvmvLQ==</latexit><latexit sha1_base64="ABmmjfuEQ2uY3Gvje/X+/CJUtV4=">AAADGnichVLNbhMxEJ5u+WlDgdArF6sVKgcUbbgAByQkCuKCVKqEVspWkXfjbKx414vttCpR3ofX6Av0hJDgBbjSew98O2yRoKrqlXdmvpn5ZsZ2WhntQxx/X4qWb9y8dXtltXVn7e69++0Hax+9nblM9TNrrNtPpVdGl6ofdDBqv3JKFqlRe+n0de3fO1TOa1v2wnGlDgqZl3qsMxkADduDZC56IvGz1KugPomkkGGiw7znZKb8ArYeiWRsnTRGhCcibIlEl6LXSUQQL4eagV2dT4J0zh4xaBlctIbtzbgT8xKXlW6jbFKzdmz7ByU0IksZzaggRSUF6IYkeXwD6lJMFbADmgNz0DT7FS2ohdwZohQiJNAp/jmsQYOWsGtOz9kZqhhsh0xBj7DfMmOK6Lqqgu4hz7E/M5ZfWWHOzHWHx5ApGFeZ8T3wQBNEXJdZNJEXvVyfWU8VaEzPeRqN/ipG6jmzvzzb8DhgU/YIesOROThStg9xAiVkHx3Up3zBIHjiEaRkqZilbBgl+BxkffroB9fc/f9SLyv9p50Xne6HmFboIW3QY9zlM3pF72gH1TM6oZ/0i86iL9Fp9PXPe4iWmoexTv+s6NtvzvmvLQ==</latexit><latexit sha1_base64="44QmUDT8Z0e0NZs1wUsGPUmMIBE=">AAADJXichVFLb9NAEJ6aR9vwCuXIZUWE4IAipxfggFRRQFyQCkraSnEVrZ2Ns8ra6+5uikqU/8Pf4A9wQkhw4cgV7hz4PHWRoEJdaz0z38x8O4+0MtqHOP6yEl24eOny6tp668rVa9dvtG9u7Ho7d5kaZNZYt59Kr4wu1SDoYNR+5ZQsUqP20tl27d87Us5rW/bDcaUOCpmXeqIzGQCN2sNkIfoi8fPUq6AORVLIMNVh0XcyU34JW49FMrFOGiPCAxHuiUSXot9NRBBPRpqBNzqfBumcfcugZXDZGrU7cTfmI84qvUbpUHN2bPsrJTQmSxnNqSBFJQXohiR5fEPqUUwVsANaAHPQNPsVLamF3DmiFCIk0Bn+Oaxhg5awa07P2RleMbgOmYLu4r5gxhTR9asKuof8hfuOsfy/LyyYua7wGDIF4zozvgIeaIqI8zKLJvK0lvMz664CTegRd6NRX8VI3Wf2h+cZPA7YjD2CnnNkDo6U7SNMoIQcoIJ6yqcMgjseQ0qWilnKhlGCz0HW00c9WHPv36WeVQab3cfd3uu4s/W02fca3aY7dB9LfUhb9JJ2UEZGH+g7/aCf0fvoY/Qp+nwSGq00ObforxN9+w1iYLC6</latexit><latexit sha1_base64="44QmUDT8Z0e0NZs1wUsGPUmMIBE=">AAADJXichVFLb9NAEJ6aR9vwCuXIZUWE4IAipxfggFRRQFyQCkraSnEVrZ2Ns8ra6+5uikqU/8Pf4A9wQkhw4cgV7hz4PHWRoEJdaz0z38x8O4+0MtqHOP6yEl24eOny6tp668rVa9dvtG9u7Ho7d5kaZNZYt59Kr4wu1SDoYNR+5ZQsUqP20tl27d87Us5rW/bDcaUOCpmXeqIzGQCN2sNkIfoi8fPUq6AORVLIMNVh0XcyU34JW49FMrFOGiPCAxHuiUSXot9NRBBPRpqBNzqfBumcfcugZXDZGrU7cTfmI84qvUbpUHN2bPsrJTQmSxnNqSBFJQXohiR5fEPqUUwVsANaAHPQNPsVLamF3DmiFCIk0Bn+Oaxhg5awa07P2RleMbgOmYLu4r5gxhTR9asKuof8hfuOsfy/LyyYua7wGDIF4zozvgIeaIqI8zKLJvK0lvMz664CTegRd6NRX8VI3Wf2h+cZPA7YjD2CnnNkDo6U7SNMoIQcoIJ6yqcMgjseQ0qWilnKhlGCz0HW00c9WHPv36WeVQab3cfd3uu4s/W02fca3aY7dB9LfUhb9JJ2UEZGH+g7/aCf0fvoY/Qp+nwSGq00ObforxN9+w1iYLC6</latexit><latexit sha1_base64="zpg5vPX5V+b/dw5pJSZy5mhIbnQ=">AAADJXichVFLixNBEK4dX7vxFfXopdlFFJQw8aIehOALL8IqibuQWULPpDNp0jM9dndWYsi/8Ef4N/wDnkRYLx696t2D39TOCrrI9tBTVV9VfV2PtDLahzg+WItOnT5z9tz6Ruv8hYuXLrevXH3t7dxlapBZY91uKr0yulSDoINRu5VTskiN2klnj2v/zr5yXtuyHxaV2itkXuqJzmQANGoPk6Xoi8TPU6+CeiOSQoapDsu+k5nyK9h6LJKJddIYEe6IcFMkuhT9TiKCeDjSDLzS+TRI5+xbBi2Dq9aovRV3Yj7iuNJtlK3eZnL7/UFvsW3bXymhMVnKaE4FKSopQDckyeMbUpdiqoDt0RKYg6bZr2hFLeTOEaUQIYHO8M9hDRu0hF1zes7O8IrBdcgUdAP3GTOmiK5fVdA95C/cd4zl/31hycx1hQvIFIwbzPgCeKApIk7KLJrIo1pOzqy7CjSh+9yNRn0VI3Wf2R+eJ/A4YDP2CHrKkTk4Urb3MYEScoAK6ikfMQjueAwpWSpmKRtGCT4HWU8f9WDN3X+XelwZ3O086HRfYt2P6PCs03XapFtY6j3q0XPaRhkZfaTv9IN+Rh+iT9Hn6MthaLTW5Fyjv0707TcupbPJ</latexit><latexit sha1_base64="zpg5vPX5V+b/dw5pJSZy5mhIbnQ=">AAADJXichVFLixNBEK4dX7vxFfXopdlFFJQw8aIehOALL8IqibuQWULPpDNp0jM9dndWYsi/8Ef4N/wDnkRYLx696t2D39TOCrrI9tBTVV9VfV2PtDLahzg+WItOnT5z9tz6Ruv8hYuXLrevXH3t7dxlapBZY91uKr0yulSDoINRu5VTskiN2klnj2v/zr5yXtuyHxaV2itkXuqJzmQANGoPk6Xoi8TPU6+CeiOSQoapDsu+k5nyK9h6LJKJddIYEe6IcFMkuhT9TiKCeDjSDLzS+TRI5+xbBi2Dq9aovRV3Yj7iuNJtlK3eZnL7/UFvsW3bXymhMVnKaE4FKSopQDckyeMbUpdiqoDt0RKYg6bZr2hFLeTOEaUQIYHO8M9hDRu0hF1zes7O8IrBdcgUdAP3GTOmiK5fVdA95C/cd4zl/31hycx1hQvIFIwbzPgCeKApIk7KLJrIo1pOzqy7CjSh+9yNRn0VI3Wf2R+eJ/A4YDP2CHrKkTk4Urb3MYEScoAK6ikfMQjueAwpWSpmKRtGCT4HWU8f9WDN3X+XelwZ3O086HRfYt2P6PCs03XapFtY6j3q0XPaRhkZfaTv9IN+Rh+iT9Hn6MthaLTW5Fyjv0707TcupbPJ</latexit><latexit sha1_base64="zpg5vPX5V+b/dw5pJSZy5mhIbnQ=">AAADJXichVFLixNBEK4dX7vxFfXopdlFFJQw8aIehOALL8IqibuQWULPpDNp0jM9dndWYsi/8Ef4N/wDnkRYLx696t2D39TOCrrI9tBTVV9VfV2PtDLahzg+WItOnT5z9tz6Ruv8hYuXLrevXH3t7dxlapBZY91uKr0yulSDoINRu5VTskiN2klnj2v/zr5yXtuyHxaV2itkXuqJzmQANGoPk6Xoi8TPU6+CeiOSQoapDsu+k5nyK9h6LJKJddIYEe6IcFMkuhT9TiKCeDjSDLzS+TRI5+xbBi2Dq9aovRV3Yj7iuNJtlK3eZnL7/UFvsW3bXymhMVnKaE4FKSopQDckyeMbUpdiqoDt0RKYg6bZr2hFLeTOEaUQIYHO8M9hDRu0hF1zes7O8IrBdcgUdAP3GTOmiK5fVdA95C/cd4zl/31hycx1hQvIFIwbzPgCeKApIk7KLJrIo1pOzqy7CjSh+9yNRn0VI3Wf2R+eJ/A4YDP2CHrKkTk4Urb3MYEScoAK6ikfMQjueAwpWSpmKRtGCT4HWU8f9WDN3X+XelwZ3O086HRfYt2P6PCs03XapFtY6j3q0XPaRhkZfaTv9IN+Rh+iT9Hn6MthaLTW5Fyjv0707TcupbPJ</latexit><latexit sha1_base64="zpg5vPX5V+b/dw5pJSZy5mhIbnQ=">AAADJXichVFLixNBEK4dX7vxFfXopdlFFJQw8aIehOALL8IqibuQWULPpDNp0jM9dndWYsi/8Ef4N/wDnkRYLx696t2D39TOCrrI9tBTVV9VfV2PtDLahzg+WItOnT5z9tz6Ruv8hYuXLrevXH3t7dxlapBZY91uKr0yulSDoINRu5VTskiN2klnj2v/zr5yXtuyHxaV2itkXuqJzmQANGoPk6Xoi8TPU6+CeiOSQoapDsu+k5nyK9h6LJKJddIYEe6IcFMkuhT9TiKCeDjSDLzS+TRI5+xbBi2Dq9aovRV3Yj7iuNJtlK3eZnL7/UFvsW3bXymhMVnKaE4FKSopQDckyeMbUpdiqoDt0RKYg6bZr2hFLeTOEaUQIYHO8M9hDRu0hF1zes7O8IrBdcgUdAP3GTOmiK5fVdA95C/cd4zl/31hycx1hQvIFIwbzPgCeKApIk7KLJrIo1pOzqy7CjSh+9yNRn0VI3Wf2R+eJ/A4YDP2CHrKkTk4Urb3MYEScoAK6ikfMQjueAwpWSpmKRtGCT4HWU8f9WDN3X+XelwZ3O086HRfYt2P6PCs03XapFtY6j3q0XPaRhkZfaTv9IN+Rh+iT9Hn6MthaLTW5Fyjv0707TcupbPJ</latexit><latexit sha1_base64="44QmUDT8Z0e0NZs1wUsGPUmMIBE=">AAADJXichVFLb9NAEJ6aR9vwCuXIZUWE4IAipxfggFRRQFyQCkraSnEVrZ2Ns8ra6+5uikqU/8Pf4A9wQkhw4cgV7hz4PHWRoEJdaz0z38x8O4+0MtqHOP6yEl24eOny6tp668rVa9dvtG9u7Ho7d5kaZNZYt59Kr4wu1SDoYNR+5ZQsUqP20tl27d87Us5rW/bDcaUOCpmXeqIzGQCN2sNkIfoi8fPUq6AORVLIMNVh0XcyU34JW49FMrFOGiPCAxHuiUSXot9NRBBPRpqBNzqfBumcfcugZXDZGrU7cTfmI84qvUbpUHN2bPsrJTQmSxnNqSBFJQXohiR5fEPqUUwVsANaAHPQNPsVLamF3DmiFCIk0Bn+Oaxhg5awa07P2RleMbgOmYLu4r5gxhTR9asKuof8hfuOsfy/LyyYua7wGDIF4zozvgIeaIqI8zKLJvK0lvMz664CTegRd6NRX8VI3Wf2h+cZPA7YjD2CnnNkDo6U7SNMoIQcoIJ6yqcMgjseQ0qWilnKhlGCz0HW00c9WHPv36WeVQab3cfd3uu4s/W02fca3aY7dB9LfUhb9JJ2UEZGH+g7/aCf0fvoY/Qp+nwSGq00ObforxN9+w1iYLC6</latexit>

Logic

HyperLTL= LTL + trace quantifiers

8⇡,⇡0. (o⇡ $ o⇡0) W-Until (i⇡ 6$ i⇡0)

8⇡,⇡0. (o⇡ $ o⇡0) W-Until (i⇡ 6$ i⇡0)

Hyperproperties

Automata

q1 q2i1↔i2⋀ o1↔o2

*i1↔i2 ⋀ o1↔o2

Sets

Hyperproperty= a set of sets of traces

[Clarkson & Schneider ’10]

{T ✓ ⌃! | 8t, t0 2 T. t =i t0 ) t =o t0}

<latexit sha1_base64="pDyQgIHg1oCAlHlgNaQKnph58Uo=">AAADI3ichVHLbtQwFD0Nr3Z4DbBkY7VCIIFGGTbAAqniJTZIBWZoUV1GTsaTWpPEwfEUlVH/hRW/wQ+wQmxAYskWfoAFJ26KBBWqI+den3vu8b2+SZWb2sfxl4Xo2PETJ08tLnVOnzl77nz3wsUXtZ25VA9Tm1u3kaha56bUQ298rjcqp1WR5Ho9md5v4us72tXGlgO/W+mtQmWlmZhUeUKj7ks5FwMh61lSa69fC/ncZIV6JW2hMyVkYcZCTqxTeS78DeGvCmlKMehJ4cXdkQnAM5Nte+WcfRNAG8C9zqi7EvfisMRhp986K6vL8vo7AGu2+xUSY1ikmKGARglPP4dCzW8TfcSoiG1hTszRMyGusYcOc2dkaTIU0Sn/GU+bLVry3GjWITvlLTm3Y6bAFe5HQTEhu7lV069pf3G/DVj23xvmQbmpcJc2oeJSUHxC3GObjKMyi5Z5UMvRmU1XHhPcDt0Y1lcFpOkz/aPzgBFHbBoiAg8DM6NGEs47fIGSdsgKmlc+UBCh4zGtClYHlbJVVNRztM3rsx6Ouf/vUA87w5u9O73+U477HvbXIi5jGdc41FtYxWOssYwUH/AdP/Azeh99jD5Fn/ep0UKbcwl/rejbb1DKsQI=</latexit><latexit sha1_base64="tr/DE/kdBeDskPKLNWUamvZDp5Q=">AAADI3ichVHNbhMxEJ4uf234C3DkYrVCIIGiTS/QQ6WIP3FBKpDQorpE3o2zteJdL16nKER9C56B1+AFOCEuReLIFV6AA99Ot0hQoXrlnfE333ye8SSlNVWI44OF6NTpM2fPLS61zl+4eOly+8rVl5Wb+lQPUmed30pUpa0p9CCYYPVW6bXKE6s3k8mDOr65p31lXNEPs1Lv5CorzNikKgAatl/JuegLWU2TSgf9RsgXJsvVa+lynSkhczMScuy8slaEOyLcFNIUot+RIoj1oWHgucl2g/LevWXQMbjfGrZX4k7MSxx3uo2z0luWt98f9GYbrv2VJI3IUUpTyklTQQG+JUUVvm3qUkwlsB2aA/PwDMc17VMLuVOwNBgK6AT/DKftBi1wrjUrzk5xi8X2yBR0A/sxKyZg17dq+BXsL+x3jGX/vWHOynWFM9gEikus+BR4oF0wTsrMG+ZRLSdn1l0FGtM97sagvpKRus/0j85DRDywCUcEPWJmBo2Ez3t4gQJ2gArqVz5SENzxCFax1axSNIoKeh62fn3UgzF3/x3qcWew2lnrdJ9h3PfpcC3SdVqmWxjqXerRE9pAGSl9pO/0g35GH6JP0efoyyE1WmhyrtFfK/r2G7EJsog=</latexit><latexit sha1_base64="tr/DE/kdBeDskPKLNWUamvZDp5Q=">AAADI3ichVHNbhMxEJ4uf234C3DkYrVCIIGiTS/QQ6WIP3FBKpDQorpE3o2zteJdL16nKER9C56B1+AFOCEuReLIFV6AA99Ot0hQoXrlnfE333ye8SSlNVWI44OF6NTpM2fPLS61zl+4eOly+8rVl5Wb+lQPUmed30pUpa0p9CCYYPVW6bXKE6s3k8mDOr65p31lXNEPs1Lv5CorzNikKgAatl/JuegLWU2TSgf9RsgXJsvVa+lynSkhczMScuy8slaEOyLcFNIUot+RIoj1oWHgucl2g/LevWXQMbjfGrZX4k7MSxx3uo2z0luWt98f9GYbrv2VJI3IUUpTyklTQQG+JUUVvm3qUkwlsB2aA/PwDMc17VMLuVOwNBgK6AT/DKftBi1wrjUrzk5xi8X2yBR0A/sxKyZg17dq+BXsL+x3jGX/vWHOynWFM9gEikus+BR4oF0wTsrMG+ZRLSdn1l0FGtM97sagvpKRus/0j85DRDywCUcEPWJmBo2Ez3t4gQJ2gArqVz5SENzxCFax1axSNIoKeh62fn3UgzF3/x3qcWew2lnrdJ9h3PfpcC3SdVqmWxjqXerRE9pAGSl9pO/0g35GH6JP0efoyyE1WmhyrtFfK/r2G7EJsog=</latexit><latexit sha1_base64="AbUJav80SWoLsP6T1IopHfJTk3U=">AAADI3ichVFNbxMxEJ0uX234CnDkYhEhOKBowwU4VKr4EhekAgktqkvk3ThbK9711naKStS/w9/gD3BCXEDiyBX+AAfeDlskqFC98s74zZvnGU9WWxNimn5eSk6cPHX6zPJK5+y58xcudi9dfhnc3Od6lDvr/Gamgram0qNootWbtdeqzKzeyGYPmvjGnvbBuGoY92u9XaqiMlOTqwho3H0lF2IoZJhnQUe9K+QLU5TqtXSlLpSQpZkIOXVeWSviLRFvCGkqMexLEcXq2DDw3BQ7UXnv3jDoGDzojLu9tJ/yEkedQev0qF3rrvuFJE3IUU5zKklTRRG+JUUB3xYNKKUa2DYtgHl4huOaDqiD3DlYGgwFdIZ/gdNWi1Y4N5qBs3PcYrE9MgVdx37MihnYza0afoD9if2WseK/NyxYualwHzaD4gorPgUeaQeM4zLLlnlYy/GZTVeRpnSXuzGor2ak6TP/o/MQEQ9sxhFBj5hZQCPj8x5eoIIdoYLmlQ8VBHc8gVVsNatUraKCnodtXh/1YMyDf4d61Bnd7t/rD56lvbX77byX6Spdo5sY6h1aoye0jjJyek/f6Dv9SN4lH5KPyaff1GSpzblCf63k6y/kxK95</latexit>

Monitoring

...

...

i T T T T F T T

o T T T T T F T

i T T T T F T F

o T T F F T T T

Automata provide an operational semantics for monitoring

MonitorAutomata

q1 q2i1↔i2⋀ o1↔o2

*i1↔i2 ⋀ o1↔o2

Learning

StudentDoes not know hyperproperty

Asks queries to teacherLearns automaton from answers

Automata provide a canonical representation for learning

TeacherKnows hyperproperty

Answers queriesCan be human or automated

(e.g., HyperLTL tool)

Does the trace set T satisfythe hyperproperty?

No!

Bad prefixes

...

...

...

...

i F F T F T F T

o T F F T T T T

i T F T T F T T

o T F F T T F T

i T T T T F T T

o T T T T T F T

i T T T T F T F

o T T F F T T T

Bad prefixes

A hyperproperty H is safety if every trace set that violates H has a bad prefix.

A hyperproperty H is k-safety if every trace set that violates H has a bad prefix of size k.

i T T T T F T T

o T T T T T F T

i T T T T F T F

o T T F F T T T

A bad prefix of a hyperproperty H is a finite set of finite traces

such that every extension to a set of infinite traces violates H.

Representing sets of traces

i T T T T F T T

o T T T T T F T

i T T T T F T F

o T T F F T T T{ }

τ1

τ2

i T T T T F T T

o T T T T T F T

i T T T T F T F

o T T F F T T Ti1 T T T

o1 T T T

i2 T T T

o2 T T F

Representing hyperproperties

i1 T T T

o1 T T T

i2 T T T

o2 T T F

unzip

i T T T T F T T

o T T T T T F T

i T T T T F T F

o T T F F T T T

A bad-prefix automaton of a k-safety hyperproperty His an automaton A over finite words of k‘-tuplessuch that, for every set of traces T,

T violates H iff L(A) contains a word 𝛔 s.t. unzip(𝛔) is a prefix of T

q1 q2i1↔i2 ⋀ o1 ⋀ ¬o2

*i1↔i2 ⋀ o1↔o2

zip

Horizontal tightness

i T T T T F T T

o T T T T T F T

i T T T T F T F

o T T F F T T T

i1 T T T

o1 T T T

i2 T T T

o2 T T F

i1 T T T T

o1 T T T T

i2 T T T T

o2 T T F F

...

...

Vertical tightness

i F F T F T F T

o T F F T T T T

i T F T T F T T

o T F F T T F T

i T T T T F T T

o T T T T T F T

i T T T T F T F

o T T F F T T T

i1 T T T

o1 T T T

i2 T T T

o2 T T F

i1 T T T

o1 T T T

i2 T T T

o2 T T F

i3 F F T

o3 T F F

...

...

...

...

Tight automata

i F F T F T F T

o T F F T T T T

i T F T T F T T

o T F F T T F T

i T T T T F T T

o T T T T T F T

i T T T T F T F

o T T F F T T T

A k-bad-prefix automaton is tightiff it acceptssome representationof each bad prefix of size ≦ k

...

...

...

...

Permutation completeness

i T T T T F T T

o T T T T T F T

i T T T T F T F

o T T F F T T T

...

...

i1 T T T

o1 T T T

i2 T T T

o2 T T F

τ1

τ2

i T T T T F T T

o T T T T T F T

i T T T T F T F

o T T F F T T T

i1 T T T

o1 T T F

i2 T T T

o2 T T T

τ2

τ1

Permutation completeness

i T T T T F T T

o T T T T T F T

i T T T T F T F

o T T F F T T T

...

...

τ1

τ2

i T T T T F T T

o T T T T T F T

i T T T T F T F

o T T F F T T T

...

...

τ2

τ1

A k-bad-prefix automaton is permutation-completeiff it accepts every representationfor each bad prefix it accepts.

A k-bad-prefix automaton is tightiff it accepts some representationfor each bad prefix of size ≦ k

Theorem: A minimal deterministic tight permutation-completek-bad-prefix automaton is a canonical representationfor (regular) k-safety hyperproperties.

Direct automata constructions

ConstrucDon: For a k-safety hyperproperty S, we can constructa determinisDc, Dght, and permutaDon-complete bad-prefix automaton of size

§ polynomial in |A| and doubly exponenDal in k ⋅ log(k) if S is given as a determinisDc bad-prefix automaton A

§ exponenDal in |A| and doubly exponenDal in k ⋅ log(k) if S is given as a nondeterminisDc bad-prefix automaton A

Learning regular languages: L*

Teacher answers two types of queries:

§ Membership queriesIs the word 𝛔 in the language?

Yes/No§ Equivalence queries:

Does the automaton A recognize the language? Yes/No: counterexample

Queries

Answers

[Angluin 1987]

Learning hyperproperties: L* Hyper

Teacher answers two types of queries:

§ Membership queriesDoes the trace set T satisfy the hyperproperty?

Yes/No§ Equivalence queries:

Is the automaton A a bad-prefix automaton for the hyperproperty?Yes/No: counterexample

Queries

Answers

Separating sequences E ⊆ 𝚺*

Observation tables

𝟄 ¬a𝟄 0 1

¬a 1 1a 0 0

a ⋅ ¬a 0 0

¬a ⋅ a 1 1¬a ⋅ ¬a 1 1

a ⋅ a 0 0a ⋅ ¬a ⋅ a 0 0

a ⋅ ¬a ⋅ ¬a 0 0

Accessingsequences

S ⊆ 𝚺*

S⋅𝚺

[Angluin 1987]

Observation table stores results ofmembership queries

accessing seq ⋅ separating seq

E.g. ¬a ⋅ ¬a is in the language

States

Observation tables

𝟄 ¬a𝟄 0 1

¬a 1 1a 0 0

a ⋅ ¬a 0 0

¬a ⋅ a 1 1¬a ⋅ ¬a 1 1

a ⋅ a 0 0a ⋅ ¬a ⋅ a 0 0

a ⋅ ¬a ⋅ ¬a 0 0

Accessingsequences

S ⊆ 𝚺*

S⋅𝚺01

00

11¬a

a

*

*

[Angluin 1987]

Separabng sequences E ⊆ 𝚺*

States

Observation tables

𝟄 ¬a𝟄 0 1

¬a 1 1a 0 0

a ⋅ ¬a 0 0

¬a ⋅ a 1 1¬a ⋅ ¬a 1 1

a ⋅ a 0 0a ⋅ ¬a ⋅ a 0 0

a ⋅ ¬a ⋅ ¬a 0 0

Accessingsequences

S ⊆ 𝚺*

S⋅𝚺

States

Consistency check:For all t,t‘ ∊ S, e ∊ 𝚺 .

state(t)=state(t‘) ⇒state(t⋅e)=state(t‘⋅e) ?

Closedness check:For all t ∊ S, e ∊ 𝚺 ,there is a t‘ ∊ S .

state(t⋅e)=state(t‘) ?

A closed and consistentobservation table defines a deterministic automaton.

[Angluin 1987]

Separabng sequences E ⊆ 𝚺*

Learning regular languages: L*

Is table closedand consistent?

Build conjectureautomaton

Equivalencequery

Initialtable

yes

No: membership queries

done

yes

no: add counterexample to table

[Angluin 1987]

add counterexampleto table

Learning hyperproperties: L* Hyper

Is table closedand consistent?

Build conjectureautomaton

Equivalencequery

Initialtable

yes

No: membership queries

done

yes

Permutation-complete?

yes

No: add counterexampleto table

Arity ofcounterexample

≦ k ?

Extend table toarity of

counterexample

no

no

Yes: add counterexampleto table

Example

01

00

11¬a

a

*

*

8⇡,⇡0. a⇡ ^ Globally (a⇡ $ a⇡0)

Equivalence query: Counterexample of arity 2, {a ⋅ ¬a, a ⋅ a}

𝟄 ¬a𝟄 0 1

¬a 1 1a 0 0

a ⋅ ¬a 0 0

¬a ⋅ a 1 1¬a ⋅ ¬a 1 1

a ⋅ a 0 0a ⋅ ¬a ⋅ a 0 0

a ⋅ ¬a ⋅ ¬a 0 0

Table for arity 1:

Extending the arity

𝟄 ¬a𝟄 0 1

¬a 1 1a 0 0

a ⋅ ¬a 0 0

¬a ⋅ a 1 1¬a ⋅ ¬a 1 1

a ⋅ a 0 0a ⋅ ¬a ⋅ a 0 0

a ⋅ ¬a ⋅ ¬a 0 0

Repeat last tuple elementto turn 1-tuple into 2-tuple

Table for arity 1: Table for arity 2:

S ⊆ (𝚺1)*

E ⊆ (𝚺1)*

E ⊆ (𝚺2)*

S⋅𝚺1

cv

Extending the arity

𝟄 ¬a𝟄 0 1

¬a 1 1a 0 0

a ⋅ ¬a 0 0

¬a ⋅ a 1 1¬a ⋅ ¬a 1 1

a ⋅ a 0 0a ⋅ ¬a ⋅ a 0 0

a ⋅ ¬a ⋅ ¬a 0 0

cv𝟄

(¬a,¬a)𝟄 ⋅ (a,a)

(a,a) ⋅ (¬a,¬a)

(¬a,¬a) ⋅ (a,a)(¬a,¬a) ⋅ (¬a,¬a)

(a,a) ⋅ (a,a)(a,a) ⋅ (¬a,¬a) ⋅ (a,a)

(a,a) ⋅ (¬a,¬a) ⋅ (¬a,¬a)

S ⊆ (𝚺1)*

S⋅𝚺1

Table for arity 1:

S‘ ⊆ (𝚺2)*

S‘⋅𝚺2

𝟄 (¬a, ¬a)

E ⊆ (𝚺1)*

E ⊆ (𝚺2)*

Table for arity 2:

Repeat last tuple elementto turn 1-tuple into 2-tuple

Extending the arity

𝟄 ¬a𝟄 0 1

¬a 1 1a 0 0

a ⋅ ¬a 0 0

¬a ⋅ a 1 1¬a ⋅ ¬a 1 1

a ⋅ a 0 0a ⋅ ¬a ⋅ a 0 0

a ⋅ ¬a ⋅ ¬a 0 0

Table for arity 1:

𝟄(¬a,¬a)𝟄 ⋅ (a,a)

(a,a) ⋅ (¬a,¬a)

(¬a,¬a) ⋅ (a,a)(¬a,¬a) ⋅ (¬a,¬a)

(a,a) ⋅ (a,a)(a,a) ⋅ (¬a,¬a) ⋅ (a,a)

(a,a) ⋅ (¬a,¬a) ⋅ (¬a,¬a)

𝟄 (¬a, ¬a)

Table for arity 2:

Closed and consistent observation table with added counterexample

𝟄 (¬a,¬a)

𝟄 0 1

(¬a,¬a) 1 1

(a,a) 0 0

(a,a) ⋅ (¬a,¬a) 0 0

(a,¬a) 1 1

(¬a,a) 1 1

(¬a,¬a) ⋅ (*) 1 1

(a,a) ⋅ (a,a) 0 0

(a,a) ⋅ (¬a,¬a) ⋅ (a,a) 0 0

(a,a) ⋅ (¬a,¬a) ⋅ (¬a,a) 1 1

(a,a) ⋅ (¬a,¬a) ⋅ (a,¬a) 1 1

(a,a) ⋅ (¬a,¬a) ⋅ (¬a,¬a) 0 0

(a,a) ⋅ (¬a,a) ⋅ (*) 1 1

01

00

11¬(a,a)

(a,a)*

(a,a) ∨ (¬a,¬a)

(¬a,a) ∨ (a,¬a)

8⇡,⇡0. a⇡ ^ Globally (a⇡ $ a⇡0)

Complexity

Theorem: L* Hyper learns a minimal, deterministic, and permutation-complete automaton Afor a k-safety hyperproperty in

§ polynomial time in |A|

§ polynomial time in the length of the longest counterexample, and

§ exponential time in k

Application: Learning Automata for HyperLTL

Membership queries for a set T of traces of length n anda hyperproperty given as a universal safety HyperLTL formula 𝞅 with k quantifierscan be answered in

§ polynomial time in n and

§ polynomial space in |𝞅| and k ⋅ log(|T|)

Equivalence queries for a deterministic automaton A anda hyperproperty given as a universal safety HyperLTL formula 𝞅 with k quantifierscan be solved in

§ polynomial time in |A|,

§ exponential time in |𝞅|, and

§ exponential space in k.

§ Automata provide a canonical representation for k-safety hyperproperties

§ Direct constructions for tight permutation-complete automata

§ L* Hyper learns minimal deterministic automata in polynomial time in the size of the automaton

§ Learning is an output-sensitive approach

§ Challenge: Beyond k-safety

Conclusions

Queries

Answers