Formally Verified Samplers From Probabilistic Programs With Loops and Conditioning

Abstract

We present Zar: a formally verified compiler pipeline from discrete probabilistic programs with unbounded loops in the conditional probabilistic guarded command language (cpGCL) to proved-correct executable samplers in the random bit model. We exploit the key idea that all discrete probability distributions can be reduced to unbiased coin-flipping schemes. The compiler pipeline first translates a cpGCL program into choice-fix trees, an intermediate representation suitable for reduction of biased probabilistic choices. Choice-fix trees are then translated to coinductive interaction trees for execution within the random bit model. The correctness of the composed translations establishes the sampling equidistribution theorem: compiled samplers are correct wrt. the conditional weakest pre-expectation semantics of cpGCL source programs. Zar is implemented and fully verified in the Coq proof assistant. We extract verified samplers to OCaml and Python and empirically validate them on a number of illustrative examples.

Inductive Reasoning for Coinductive Types

“…A cotree 𝑡 : T * 𝐴 can be interpreted as a sampling procedure over sample space 𝐴 in the random bit model, where it is provided a stream of uniformly distributed random bits from which to generate samples. Indeed, that is the approach taken in the Zar [6] system, in which probabilistic programs with unbounded loops and conditioning are compiled to cotree representations of samplers over their posterior distributions.…”

“…The Zar system [6] does not extract cotrees directly for execution. Rather, it compiles probabilistic programs to interaction trees [42] (itrees) for sampling execution in OCaml and relates them to equivalent cotree constructions from which correctness guarantees (e.g., Theorem 6.18) obtained via AlgCo are transported.…”

“…Coinduction provides a natural means for programming with and verifying properties of infinitary structures such as conats (natural numbers extended with a "point at infinity"), streams (infinite lists) [14], and potentially nonterminating decision processes (e.g., samplers for discrete distributions compiled from probabilistic programs [6]). However, coinductive reasoning has a tendency to betray intuition, and proof assistants like Coq and Agda are designed with a noticeable bias toward induction, which can exacerbate the inherently unintuitive nature of coinduction.…”