Abstract extensionality: on the properties of incomplete abstract interpretations

Abstract

In this paper we generalise the notion of extensional (functional) equivalence of programs to abstract equivalences induced by abstract interpretations . The standard notion of extensional equivalence is recovered as the special case, induced by the concrete interpretation. Some properties of the extensional equivalence, such as the one spelled out in Rice’s theorem, lift to the abstract equivalences in suitably generalised forms. On the other hand, the generalised framework gives rise to interesting and important new properties, and allows refined, non-extensional analyses. In particular, since programs turn out to be extensionally equivalent if and only if they are equivalent just for the concrete interpretation, it follows that any non-trivial abstract interpretation uncovers some intensional aspect of programs. This striking result is also effective, in the sense that it allows constructing, for any non-trivial abstraction, a pair of programs that are extensionally equivalent, but have different abstract semantics. The construction is based on the fact that abstract interpretations are always sound, but that they can be made incomplete through suitable code transformations. To construct these transformations, we introduce a novel technique for building incompleteness cliques of extensionally equivalent yet abstractly distinguishable programs: They are built together with abstract interpretations that produce false alarms. While programs are forced into incompleteness cliques using both control-flow and data-flow transformations, the main result follows from limitations of data-flow transformations with respect to control-flow ones. A further consequence is that the class of incomplete programs for a non-trivial abstraction is Turing complete. The obtained results also shed a new light on the relation between the techniques of code obfuscation and the precision in program analysis.

Partial (In)Completeness in abstract interpretation: limiting the imprecision in program analysis

“…2 Richer languages manipulating an unbound number of variables, e.g., by recursion, can be considered at the price of complicating the model and replacing variable finiteness with abstract domains defined as functions from natural numbers 𝑛 ∈ N to Galois connections on a concrete domain with 𝑛 variables (e.g., see [Bruni et al 2020;Venet 1996]…”

“…Giacobazzi et al [2015] proved that C(𝐴) is infinite by a straightforward padding argument, since skip ∈ C(𝐴) for any 𝐴 and sequential composition of complete commands is still complete. Moreover C(𝐴) is non-extensional because there always exist programs 𝑃 and 𝑄 such that: 𝑃 is complete for 𝐴, 𝑃 = 𝑄 , and 𝑄 is not complete for 𝐴 (e.g., see [Bruni et al 2020;Giacobazzi 2008;Laviron and Logozzo 2009] for examples of program transformations designed to alter the abstract semantics, either by improving precision as in program analysis by hints, or by worsening precision as in code obfuscation).…”

“…Moreover, for all non-trivial abstractions in A (℘ re (S)), its completeness class is strictly contained in Prog [Giacobazzi et al 2015]. More has been recently proved along this direction: a completeness class is an index set of partial recursive function if and only if the abstraction is trivial [Bruni et al 2020].…”

“…Completeness is a well known notion in static program analysis by abstract interpretation and the classes of complete programs for a given abstraction have been recently studied [Bruni et al 2020[Bruni et al , 2021Giacobazzi et al 2015]. In [Giacobazzi et al 2015] the authors introduce the notion of completeness class as the set of all programs that are complete with regard to a given abstract domain, together with a sound stratified deductive system for proving the completeness of program analysis over an abstract domain.…”

“…We follow an orthogonal approach and, rather than proving whether a program 𝑃 is 𝜀-partial complete respect to an abstract quasi-metric space of stores 𝑨 and a set of stores 𝑆, we formalize a sound proof system that is able to overstimate a bound of imprecision generated by the abstract interpreter when analyzing 𝑃 with input 𝑆 over 𝑨. Bruni et al [Bruni et al 2020] introduced the concept of completeness cliques as the set of equivalent programs that are complete with regard to an abstract domain. In particular, they prove that there exists a total recursive function that transforms any complete program into a semantically equivalent but incomplete one for a given abstraction.…”