Probabilistic Hyperproperties with Nondeterminism

Finite-Word Hyperlanguages

“…Our framework is based on an underlying standard automata model for formal languages, augmented with quantified word variables that are assigned words from a set of words in the hyperlanguage. This formalism is in line with logics for hyperproperties (e.g., HyperLTL [13] and HyperPCTL [2,1]). These logics express the behavior of infinite trace systems.…”

“…• For α = ∀x.α , define S v (α, r) if S v[x →w] (α , r) for every w ∈ S . 1 Since all variables are under the scope of α, membership is independent of v, and so if S (α, r), we denote S ∈ L(r). The hyperlanguage of r is L(r) = {S | S ∈ L(r)}.…”

“…Then T has three leaves, labeled 1 • 1, 2 • 1, and 3 • 1. The labeling c(T ) assigns the nodes of T values in [1,3] as described in Figure 2. The three transitions in A from q 1 , q 2 , q 3 are then translated to the transition from s = (((q 1 , 1 • 1), (q 2 , 2 • 1), (q 3 , 3 • 1)), c(T )) labeled (a, b, c), which means that the transition associates label 1 with a, label 2 with b, and label 3 with c, matching the transitions from q 1 ,q 2 , and q 3 , when they are associated with the leaves as in s.…”

Deciding Hyperproperties Combined with Functional Specifications

“…All hardness results for ∀ * ∃ * fragments, except in the NEXP cases, already hold for ∀∃ * . The restriction to temporal safety makes the satisfiability of HyperLTL drop from Σ 1 1 to coRE, which we show by an effective reduction to satisfiability of first-order logic. While still undecidable, this enables the use of common first-order techniques such as resolution, tableaux, and related methods [36].…”

“…The hyperproperty itself is often relatively simple (like the noninterference property above) and only gets difficult to satisfy given a specification of the functional behavior of the system. 1 The following example highlights this interplay between functional property and hyperproperty.…”