Models for Probabilistic Programs with an Adversary

Models for Probabilistic Programs with an Adversary Robert Rand, Steve Zdancewic University of Pennsylvania Probabilistic Programming Semantics 2016

Interactive Proofs 2/47

Graph Non-Isomorphism A 4 B E 3 5 C D 1 2 3/47

Graph Non-Isomorphism A 4 B E 3 5 C D 1 2 α γ δ ɛ β 3/47

Arthur Merlin Games 4/47

Why Should We Care? Mixing probability and nondeterminism is powerful. Private vs. public coins matter. 5/47

Let s Start with a Deterministic Semantics... skip / σ σ σ(a) = n x := a / σ σ[x n] c 1 / σ σ c 2 / σ σ c 1 ; c 2 / σ σ σ(b) = T c 1 / σ σ if b then c 1 else c 2 / σ σ 6/47

For Point Distributions Θ ::= [σ] Θ p Θ skip / [σ] [σ] [σ](a) = n x := a / [σ] [σ[x n]] c 1 / [σ] Θ c 2 / Θ Θ c 1 ; c 2 / [σ] Θ σ(b) = T c 1 / [σ] Θ if b then c 1 else c 2 / [σ] Θ 7/47

Toss in Some Probability Θ ::= [σ] Θ p Θ c 1 / [σ] Θ 1 c 2 / [σ] Θ 2 (c 1 p c 2 ) / [σ] Θ 1 p Θ 2 8/47

Toss in Some Probability Θ ::= [σ] Θ p Θ c 1 / [σ] Θ 1 c 2 / [σ] Θ 2 (c 1 p c 2 ) / [σ] Θ 1 p Θ 2 [σ] (x := 0 1 3 x := 1) 1/3 σ[x 0] σ[x 1] 8/47

And Lift! c / Θ 1 Θ 1 c / Θ 2 Θ 2 c / Θ 1 p Θ 2 Θ 1 p Θ 2 9/47

And Lift! c / Θ 1 Θ 1 c / Θ 2 Θ 2 c / Θ 1 p Θ 2 Θ 1 p Θ 2 1/3 y := 5 1/3 σ 1 σ 2 σ 1 [y 5] σ 2 [y 5] 9/47

The Toss Command 1/3 c 1 1 5 c 2 1/5 1/2 c 1 σ 1 c 2 σ 1 1/5 1/5 c 1 σ 2 c 2 σ 2 c 1 σ 3 c 2 σ 3 10/47

The Skip Command 1/3 1/3 σ 1 1/2 σ 1 1/2 skip σ 2 σ 3 σ 2 σ 3 skip skip 11/47

More Direct 1/3 1/3 σ 1 1/2 skip σ 1 1/2 σ 2 σ 3 σ 2 σ 3 12/47

Direct Semantics skip / Θ Θ σ(a) = n x := a / Θ Θ[σ i (x) n] c 1 / Θ Θ c 2 / Θ Θ c 1 ; c 2 / Θ Θ Pr b (Θ 1 ) = 1 c 1 / Θ 1 Θ 1 c 2 / Θ 0 Θ 0 Pr b (Θ 0 ) = 0 if b then c 1 else c 2 / Θ 1 p Θ 0 Θ 1 p Θ 0 c 1 / Θ Θ 1 c 2 / Θ Θ 2 (c 1 p c 2 ) / Θ Θ 1 p Θ 2 13/47

Direct Toss 1/5 c 1 1 5 c 2 c 1 1/3 c 2 1/3 σ 1 1/2 σ 1 1/2 σ 2 σ 3 σ 2 σ 3 14/47

The Distinction Recursive c 1 / [σ] Θ 1 c 2 / [σ] Θ 2 (c 1 c 2 ) / [σ] Θ 1 (c 1 c 2 ) / [σ] Θ 2 vs. c 1 / Θ Θ 1 c 2 / Θ Θ 2 (c 1 c 2 ) / Θ Θ 1 (c 1 c 2 ) / Θ Θ 2 Direct 15/47

Let s Play a Game! 16/47

Let s Play a Game! P:= 1 3 ( 1 2 ) O:= 17/47

Let s Play a Game! c 1 P:= 1 3 ( 1 2 ) c 2 O:= 17/47

Direct Play c 1 : P:= 1 3 ( 1 2 ) 18/47

Direct Play c 1 : P:= 1 3 ( 1 2 ) 1/3 1/2 18/47

Direct Play c 2 : O:= c 2 1/3 1/2 18/47

Direct Play c 2 : O:= 1/3 1/2 18/47

Direct Play c 2 : O:= 1/3 L 1/2 T W 18/47

Recursive Play c 1 : P:= 1 3 ( 1 2 ) 19/47

Recursive Play c 1 : P:= 1 3 ( 1 2 ) 1/3 1/2 19/47

Recursive Play c 2 : O:= c 2 1/3 1/2 19/47

Recursive Play c 2 : O:= 1/3 c 2 1/2 c 2 c 2 19/47

Recursive Play c 2 : O:= 1/3 1/2 19/47

Recursive Play c 2 : O:= 1/3 L 1/2 L L 19/47

Knowledge The two levels of operational semantics reflect whether the adversary knows the outcome of coin flips. 20/47

Levels of Knowledge 1. Adversary is blind to probabilistic outcomes. Single choice in ((c 1 c 2 ) (c 1 c 2 )) Distinct choices in ((c1 c 2 ) (c 1 c 2 )) (Direct) 2. Adversary can see current program state 3. Adversary recalls program history (Recursive) 4. Adversary can foresee all outcomes. Single coin flip in ((c 1 c 2 ) (c 1 c 2 )) Distinct coin flips in ((c 1 c 2 ) (c 1 c 2 )) 21/47

So... What can we verify? 22/47

Verification: Direct {P} c 1 {Q} {P} (c 1 {P} c 2 {Q} c 2 ) {Q} 23/47

Verification: Recursive {True} b := T {Pr(b) = 1} {True} b := F {Pr(b) = 0} {True} (b := T b := F) {Pr(b) = 1 Pr(b) = 0} 24/47

Verification: Recursive 1/2 b = b = {True} b := T {Pr(b) = 1} {True} b := F {Pr(b) = 0} {True} (b := T b := F) {Pr(b) = 1 Pr(b) = 0} 24/47

Verification: Recursive 1/2 b = T b = F {True} b := T {Pr(b) = 1} {True} b := F {Pr(b) = 0} {True} (b := T b := F) {Pr(b) = 1 Pr(b) = 0} 24/47

Verification: Recursive 1/2 b = T b = F {True} b := T {Pr(b) = 1} {True} b := F {Pr(b) = 0} {True} (b := T b := F) {Pr(b) = 1 Pr(b) = 0} Q cannot include disjunctions 24/47

Verification: Recursive {Pr(b) = 1 2 } skip {Pr(b) = 1 2 } {Pr(b) = 1 2 } b := b {Pr(b) = 1 2 } {Pr(b) = 1 2 } (skip b := b) {Pr(b) = 1 2 } 25/47

Verification: Recursive 1/2 b = T b = F {Pr(b) = 1 2 } skip {Pr(b) = 1 2 } {Pr(b) = 1 2 } b := b {Pr(b) = 1 2 } {Pr(b) = 1 2 } (skip b := b) {Pr(b) = 1 2 } 25/47

Verification: Recursive 1/2 b = F b = F {Pr(b) = 1 2 } skip {Pr(b) = 1 2 } {Pr(b) = 1 2 } b := b {Pr(b) = 1 2 } {Pr(b) = 1 2 } (skip b := b) {Pr(b) = 1 2 } 25/47

Verification: Recursive 1/2 b = F b = F {Pr(b) = 1 2 } skip {Pr(b) = 1 2 } {Pr(b) = 1 2 } b := b {Pr(b) = 1 2 } {Pr(b) = 1 2 } (skip b := b) {Pr(b) = 1 2 } P cannot include probabilities in (0, 1) 25/47

Verification: Recursive {P} c 1 {Q} non-probabilistic P non-disjunctive Q {P} (c 1 c 2 ) {Q} {P} c 2 {Q} 26/47

Compositionality (c 1 c 2 ); (c 3 c 4 ) 27/47

Compositionality {P} (c 1 c 2 ); (c 3 c 4 ) {R} 27/47

Compositionality {P} (c 1 c 2 ) {Q} (c 3 c 4 ) {R} 27/47

Compositionality non-probabilistic P non-disjunctive Q {P} (c 1 c 2 ) {Q} (c 3 c 4 ) {R} 27/47

Compositionality non-probabilistic P non-disjunctive Q non-probabilistic Q non-disjunctive R {P} (c 1 c 2 ) {Q} (c 3 c 4 ) {R} 27/47

Applications Are private coins applicable? 28/47

Game Theory Theorem (Minimax Theorem) For every two-person, zero-sum game with finitely many strategies, there exists a value V and a mixed strategy for each player, such that 1. Given player 2 s strategy, the best payoff possible for player 1 is V, and 2. Given player 1 s strategy, the best payoff possible for player 2 is V. 29/47

Game Theory game program with nondeterminism 30/47

Game Theory game program with nondeterminism zero sum returns a single value 30/47

Game Theory game program with nondeterminism zero sum returns a single value finitely many strategies no unbounded loops 30/47

Game Theory game program with nondeterminism zero sum returns a single value finitely many strategies no unbounded loops mixed strategy choice of p, q, r annotating the s 30/47

Game Theory Theorem (Minimax Theorem Restated) Any finite program combining probability and nondeterminism with a single output value has a dual program with the probabilistic and nondeterministic choices inverted, that returns the same value in the worst case. 31/47

Game Theory Questions Can we use this to find and prove Nash Equilibria in games? Does this yield useful generalizations of Nash Equilibrium? Can we discover useful compositionality results from this formulation? 32/47

More Open Questions How does a semantics using infinite bit streams compare to our distribution semantics? Can we enumerate the possible interactions between probability and nondeterminism via algebraic equivalences? Can we extend KAT to probabilistic-nondeterministic programs? Can we translate between Direct and Recursive Semantics? 33/47

Thank You Questions? 34/47

Thank You Questions? Answers? 34/47

Thank You Questions? Answers? Rebuttals? 34/47