Searcharxiv⌕ Search

arXiv subjects

Bart Jacobs

Publications and source records attributed to Bart Jacobs.

At least 37 records · Page 2Linked to original sources

Completeness Thresholds for Memory Safety of Array Traversing Programs

We report on intermediate results of -- to the best of our knowledge -- the first study of completeness thresholds for (partially) bounded memory safety proofs. Specifically, we consider heap-manipulating programs that iterate over arrays without allocating or freeing memory. In this setting, we present the first notion of completeness thresholds for program verification which reduce unbounded memory safety proofs to (partially) bounded ones. Moreover, we demonstrate that we can characterise completeness thresholds for simple classes of array traversing programs. Finally, we suggest avenues of research to scale this technique theoretically, i.e., to larger classes of programs (heap manipulation, tree-like data structures), and practically by highlighting automation opportunities.

cs.LO↗

Sufficient Statistics and Split Idempotents in Discrete Probability Theory

A sufficient statistic is a deterministic function that captures an essential property of a probabilistic function (channel, kernel). Being a sufficient statistic can be expressed nicely in terms of string diagrams, as Tobias Fritz showed recently, in adjoint form. This reformulation highlights the role of split idempotents, in the Fisher-Neyman factorisation theorem. Examples of a sufficient statistic occur in the literature, but mostly in continuous probability. This paper demonstrates that there are also several fundamental examples of a sufficient statistic in discrete probability. They emerge after some combinatorial groundwork that reveals the relevant dagger split idempotents and shows that a sufficient statistic is a deterministic dagger epi.

cs.LO↗

Verification of C++ Programs with VeriFast

VeriFast is a prototype tool based on separation logic for modular verification of C and Java programs. We are in the process of adding support for C++. In this report, we describe the features of C++ for which we added support so far, as well as the proof obligations we generate for these features. At this point, VeriFast has basic support for most object-oriented programming features of C++: member functions, member function and operator overloading, implicit and explicit conversions, constructors and initializer lists, destructors, reference types, allocation and deallocation on the stack or on the heap (using new and delete), inheritance (including multiple inheritance but not virtual base classes), and virtual member functions and overriding. To support specification of inheritance hierarchies, we added support for instance predicates, which can be introduced in a base class and overridden in derived classes. The main missing feature at this point is support for C++ templates, which we plan to work on next.

cs.LO↗

Modular termination verification with a higher-order concurrent separation logic (Intermediate report)

We report on intermediate results of our research on reasoning about liveness properties in addition to deep correctness properties for an imperative, concurrent programming language with a higher-order store. At present, we focus on one particular liveness property, namely termination. By guaranteeing termination we can strengthen statements of partial correctness to total correctness. This is achieved by the classic approach of turning termination into a safety property. In particular we extend the programming language under consideration with call permissions, which have been shown to enable modular reasoning about termination. Atomic blocks are added to increase the expressiveness of our call-permission-based approach. Our work builds on top of Iris -- a foundational, machine-checked, higher-order concurrent separation logic framework -- without modifying it. With these additions we are able to modularly reason about the termination of concurrent, but non-blocking algorithms. Our additions to the programming language under consideration preserve Iris' ability to reason about helping and prophecies. As an example, we apply the current system to an existing case study for a lock-free concurrent stack with helping that has been proven in Iris. Finally, we sketch the next steps to scale our approach to blocking concurrency.

cs.LO↗

Modular Formal Verification of Rust Programs with Unsafe Blocks

Rust is a modern systems programming language whose type system guarantees memory safety. For the sake of expressivity and performance it allows programmers to relax typing rules temporarily, using unsafe code blocks. However, in unsafe blocks, the burden of making sure that the code does not end up having undefined behaviour is on the programmer. Even most expert programmers make mistakes and a memory safety bug in an unsafe block renders all the type system guarantees void. To address this problem we are trying to verify soundness of Rust unsafe code applying our Modular Symbolic Execution algorithm. This text outlines our approach and the progress that has been made so far.

cs.LO↗

Urns & Tubes

Urn models play an important role to express various basic ideas in probability theory. Here we extend this urn model with tubes. An urn contains coloured balls, which can be drawn with probabilities proportional to the numbers of balls of each colour. For each colour a tube is assumed. These tubes have different sizes (lengths). The idea is that after drawing a ball from the urn it is dropped in the urn of the corresponding colour. We consider two associated probability distributions. The first-full distribution on colours gives for each colour the probability that the corresponding tube is full first, before any of the other tubes. The negative distribution on natural numbers captures for a number k the probability that all tubes are full for the first time after k draws. This paper uses multisets to systematically describe these first-full and negative distributions in the urns & tubes setting, in fully multivariate form, for all three standard drawing modes (multinomial, hypergeometric, and Polya).

math.PR↗

Multinomial and Hypergeometric Distributions in Markov Categories

Markov categories, having tensors with copying and discarding, provide a setting for categorical probability. This paper uses finite colimits and what we call uniform states in such Markov categories to define a (fixed size) multiset functor, with basic operations for sums and zips of multisets, and a graded monad structure. Multisets can be used to represent both urns filled with coloured balls and also draws of multiple balls from such urns. The main contribution of this paper is the abstract definition of multinomial and hypergeometric distributions on multisets, as draws. It is shown that these operations interact appropriately with various operations on multisets.

cs.LO↗

Learning from What's Right and Learning from What's Wrong

The concept of updating (or conditioning or revising) a probability distribution is fundamental in (machine) learning and in predictive coding theory. The two main approaches for doing so are called Pearl's rule and Jeffrey's rule. Here we make, for the first time, mathematically precise what distinguishes them: Pearl's rule increases validity (expected value) and Jeffrey's rule decreases (Kullback-Leibler) divergence. This forms an instance of a more general distinction between learning from what's right and learning from what's wrong. The difference between these two approaches is illustrated in a mock cognitive scenario.

cs.LO↗

Certifying C program correctness with respect to CompCert with VeriFast

VeriFast is a powerful tool for verification of various correctness properties of C programs using symbolic execution. However, VeriFast itself has not been verified. We present a proof-of-concept extension which generates a correctness certificate for each successful verification run individually. This certificate takes the form of a Coq script containing two proofs which, when successfully checked by Coq, together remove the need for trusting in the correctness of VeriFast itself. The first proves a lemma expressing the correctness of the program with respect to a big step operational semantics developed by ourselves, intended to reflect VeriFast's interpretation of C. We have formalized this semantics in Coq as cbsem. This lemma is proven by symbolic execution in Coq, which in turn is implemented by transforming the exported AST of the program into a Coq proposition representing the symbolic execution performed by VeriFast itself. The second proves the correctness of the same C program with respect to CompCert's Clight big step semantics. This proof simply applies our proof of the soundness of cbsem with respect to CompCert Clight to the first proof.

cs.LO↗

Relating Apartness and Bisimulation

A bisimulation for a coalgebra of a functor on the category of sets can be described via a coalgebra in the category of relations, of a lifted functor. A final coalgebra then gives rise to the coinduction principle, which states that two bisimilar elements are equal. For polynomial functors, this leads to well-known descriptions. In the present paper we look at the dual notion of "apartness". Intuitively, two elements are apart if there is a positive way to distinguish them. Phrased differently: two elements are apart if and only if they are not bisimilar. Since apartness is an inductive notion, described by a least fixed point, we can give a proof system, to derive that two elements are apart. This proof system has derivation rules and two elements are apart if and only if there is a finite derivation (using the rules) of this fact. We study apartness versus bisimulation in two separate ways. First, for weak forms of bisimulation on labelled transition systems, where silent (tau) steps are included, we define an apartness notion that corresponds to weak bisimulation and another apartness that corresponds to branching bisimulation. The rules for apartness can be used to show that two states of a labelled transition system are not branching bismilar. To support the apartness view on labelled transition systems, we cast a number of well-known properties of branching bisimulation in terms of branching apartness and prove them. Next, we also study the more general categorical situation and show that indeed, apartness is the dual of bisimilarity in a precise categorical sense: apartness is an initial algebra and gives rise to an induction principle. In this analogy, we include the powerset functor, which gives a semantics to non-deterministic choice in process-theory.

cs.LO↗

Ghost Signals: Verifying Termination of Busy-Waiting (Extended Version)

Programs for multiprocessor machines commonly perform busy waiting for synchronization. We propose the first separation logic for modularly verifying termination of such programs under fair scheduling. Our logic requires the proof author to associate a ghost signal with each busy-waiting loop and allows such loops to iterate while their corresponding signal $s$ is not set. The proof author further has to define a well-founded order on signals and to prove that if the looping thread holds an obligation to set a signal $s^\prime$, then $s^\prime$ is ordered above $s$. By using conventional shared state invariants to associate the state of ghost signals with the state of data structures, programs busy-waiting for arbitrary conditions over arbitrary data structures can be verified.

cs.LO↗

From Multisets over Distributions to Distributions over Multisets

A well-known challenge in the semantics of programming languages is how to combine non-determinism and probability. At a technical level, the problem arises from the fact that there is a no distributive law between the powerset monad and the distribution monad - as noticed some twenty years ago by Plotkin. More recently, it has become clear that there is a distributive law of the multiset monad over the distribution monad. This article elaborates the details of this distributivity and shows that there is a rich underlying theory relating multisets and probability distributions. It is shown that the new distributive law, called parallel multinomial law, can be defined in (at least) four equivalent ways. It involves putting multinomial distributions in parallel and commutes with hypergeometric distributions. Further, it is shown that this distributive law commutes with a new form of zipping for multisets. Abstractly, this can be described in terms of monoidal structure for a fixed-size multiset functor, when lifted to the Kleisli category of the distribution monad. Concretely, an application of the theory to sampling semantics is included.

cs.LO↗

A Separation Logic to Verify Termination of Busy-Waiting for Abrupt Program Exit

Programs for multiprocessor machines commonly perform busy-waiting for synchronisation. In this paper, we make a first step towards proving termination of such programs. We approximate (i) arbitrary waitable events by abrupt program termination and (ii) busy-waiting for events by busy-waiting to be abruptly terminated. We propose a separation logic for modularly verifying termination (under fair scheduling) of programs where some threads eventually abruptly terminate the program, and other threads busy-wait for this to happen.

cs.LO↗

De Finetti's construction as a categorical limit

This paper reformulates a classical result in probability theory from the 1930s in modern categorical terms: de Finetti's representation theorem is redescribed as limit statement for a chain of finite spaces in the Kleisli category of the Giry monad. This new limit is used to identify among exchangeable coalgebras the final one.

math.CT↗

A Separation Logic to Verify Termination of Busy-Waiting for Abrupt Program Exit: Technical Report

Programs for multiprocessor machines commonly perform busy-waiting for synchronisation. In this paper, we make a first step towards proving termination of such programs. We approximate (i) arbitrary waitable events by abrupt program termination and (ii) busy-waiting for events by busy-waiting to be abruptly terminated. We propose a separation logic for modularly verifying termination (under fair scheduling) of programs where some threads eventually abruptly terminate the program, and other threads busy-wait for this to happen.

cs.LO↗

Steps and Traces

In the theory of coalgebras, trace semantics can be defined in various distinct ways, including through algebraic logics, the Kleisli category of a monad or its Eilenberg-Moore category. This paper elaborates two new unifying ideas: 1) coalgebraic trace semantics is naturally presented in terms of corecursive algebras, and 2) all three approaches arise as instances of the same abstract setting. Our perspective puts the different approaches under a common roof, and allows to derive conditions under which some of them coincide.

cs.LO↗

Distances between States and between Predicates

This paper gives a systematic account of various metrics on probability distributions (states) and on predicates. These metrics are described in a uniform manner using the validity relation between states and predicates. The standard adjunction between convex sets (of states) and effect modules (of predicates) is restricted to convex complete metric spaces and directed complete effect modules. This adjunction is used in two state-and-effect triangles, for classical (discrete) probability and for quantum probability.

cs.LO↗

Causal Inference by String Diagram Surgery

Extracting causal relationships from observed correlations is a growing area in probabilistic reasoning, originating with the seminal work of Pearl and others from the early 1990s. This paper develops a new, categorically oriented view based on a clear distinction between syntax (string diagrams) and semantics (stochastic matrices), connected via interpretations as structure-preserving functors. A key notion in the identification of causal effects is that of an intervention, whereby a variable is forcefully set to a particular value independent of any prior propensities. We represent the effect of such an intervention as an endofunctor which performs `string diagram surgery' within the syntactic category of string diagrams. This diagram surgery in turn yields a new, interventional distribution via the interpretation functor. While in general there is no way to compute interventional distributions purely from observed data, we show that this is possible in certain special cases using a calculational tool called comb disintegration. We demonstrate the use of this technique on a well-known toy example, where we predict the causal effect of smoking on cancer in the presence of a confounding common cause. After developing this specific example, we show this technique provides simple sufficient conditions for computing interventions which apply to a wide variety of situations considered in the causal inference literature.

cs.LO↗