Invariant Generation Research Articles

Exploiting the Sparseness of Control-Flow and Call Graphs for Efficient and On-Demand Algebraic Program Analysis

Algebraic Program Analysis (APA) is a ubiquitous framework that has been employed as a unifying model for various problems in data-flow analysis, termination analysis, invariant generation, predicate abstraction and a wide variety of other standard static analysis tasks. APA models program summaries as elements of a regular algebra . Suppose that a summary in A is assigned to every transition of the program and that we aim to compute the effect of running the program starting at line s and ending at line t . APA first computes a regular expression capturing all program paths of interest. In case of intraprocedural analysis, models all paths from s to t , whereas in the interprocedural case it models all interprocedurally-valid paths, i.e. ‍paths that go back to the right caller function when a callee returns. This regular expression is then interpreted over the algebra to obtain the desired result. Suppose the program has n lines of code and each evaluation of an operation in the regular algebra takes O ( k ) time. It is well-known that a single APA query, or a set of queries with the same starting point s , can be answered in O ( n · α( n ) · k ), where α is the inverse Ackermann function. In this work, we consider an on-demand setting for APA: the program is given in the input and can be preprocessed. The analysis has to then answer a large number of on-line queries, each providing a pair ( s , t ) of program lines which are the start and end point of the query, respectively. The goal is to avoid the significant cost of running a fresh APA instance for each query. Our main contribution is a series of algorithms that, after a lightweight preprocessing of O ( n · lg n · k ), answer each query in O ( k ) time. In other words, our preprocessing has almost the same asymptotic complexity as a single APA query, except for a sub-logarithmic factor, and then every future query is answered instantly, i.e. ‍by a constant number of operations in the algebra. We achieve this remarkable speedup by relying on certain structural sparsity properties of control-flow and call graphs (CFGs and CGs). Specifically, we exploit the fact that control-flow graphs of real-world programs have a tree-like structure and bounded treewidth and nesting depth and that their call graphs have small treedepth in comparison to the size of the program. Finally, we provide experimental results demonstrating the effectiveness and efficiency of our approach and showing that it beats the runtime of classical APA by several orders of magnitude.

Semi-Blind watermarking using convolutional attention-based turtle shell matrix for tamper detection and recovery of medical images

“Telemedicine or e-medicine” refers to an electronic communication system that shares medical information from one location to another through the transmission channel. The increase in multimedia data sharing/transmission across the communication channel has raised to an uncontrollable stage. Thus, the transmission of medical reports across the network has increased higher, which has a chance of tampering either intentional or unintentional attacks. In the case of deliberate attacks, tamper detection and localization are the highly required criteria to verify the originality. In such cases, medical image authentication, security, and integrity verification are also essential criteria in telemedicine applications to verify whether the report belongs to the right person or not. To achieve these criteria and to satisfy these requirements Digital watermarking techniques are highly suggested. Much research has been carried out to address this issue, but some drawbacks and limitations still need to be addressed. The objective is to accomplish a Tamper detection, localization, and recovery (TDLR) system with minimal source information at the receiver end with a better payload or embedding capacity. This paper presents a novel Conventional Attention network (CoAtNet) based invariant watermark generation. A two-level embedding is proposed to enhance watermark security, where image tamper localization and recovery information is generated. The primary level of embedding is carried out by the Turtle Shell Data Hiding Algorithm (TSDH), and the secondary level of embedding is carried out by the DWT-SVD transform. The result shows that the proposed model achieves high imperceptibility and tamper detection accuracy of 60.24 and 99.51% respectively. Furthermore, the suggested system performed well in evaluations of tamper detection and image restoration for various malicious attacks against state-of-the-art systems.

KeyEncoder: A secure and usable EEG-based cryptographic key generation mechanism

Nowadays, a rapid, easy, and convenient access to our private information is essential to carry out both personal and professional activities. In most cases, this information is sensitive and can be stolen due to its importance and the lack of security protocols. In this study we propose a time–invariant cryptographic key generation mechanism based on electroencephalogram (EEG) signals. We employed Discrete Wavelet Transform and autoencoders to extract the biometric features from the EEG signals. Using these features, we construct a scheme to generate secure seeds that can be used as inputs for secure hash functions and obtain cryptographic keys. The mechanism proposed preserves the privacy of the user, as the cryptographic key is generated for each new EEG signal received, avoiding the need of storing the key, previous EEG signals or any other information. Results show that the proposed mechanism is secure against random attacks, as a 0% of False Acceptance Rate is reported, while generating seeds with an entropy of 0.968 in less than 500 ms.

Mitigating Adversarial Attacks on Data-Driven Invariant Checkers for Cyber-Physical Systems

The use of <i>invariants</i> in developing security mechanisms has become an attractive research area because of their potential to both prevent attacks and detect attacks in Cyber-Physical Systems&#x00A0;(CPS). In general, an invariant is a property that is expressed using design parameters along with Boolean operators and which always holds in normal operation of a system, in particular, a CPS. Invariants can be derived by analysing operational data of various design parameters in a running CPS, or by analysing the system&#x0027;s requirements/design documents, with both of the approaches demonstrating significant potential to detect and prevent cyber-attacks on a CPS. While data-driven invariant generation can be fully automated, design-driven invariant generation has a substantial manual intervention. In this paper, we aim to highlight the shortcomings in data-driven invariants by demonstrating a set of adversarial attacks on such invariants. We propose a solution strategy to detect such attacks by complementing them with design-driven invariants. We perform all our experiments on a real water treatment testbed. We shall demonstrate that our approach can significantly reduce false positives and achieve high accuracy in attack detection on CPSs.

Erratum to “The Congruence Subgroup Property Does Not Imply Invariable Generation”

Erratum to “The Congruence Subgroup Property Does Not Imply Invariable Generation”

When Less Is More: Consequence-Finding in a Weak Theory of Arithmetic

This paper presents a theory of non-linear integer/real arithmetic and algorithms for reasoning about this theory. The theory can be conceived of as an extension of linear integer/real arithmetic with a weakly-axiomatized multiplication symbol, which retains many of the desirable algorithmic properties of linear arithmetic. In particular, we show that the conjunctive fragment of the theory can be effectively manipulated (analogously to the usual operations on convex polyhedra, the conjunctive fragment of linear arithmetic). As a result, we can solve the following consequence-finding problem: given a ground formula F , find the strongest conjunctive formula that is entailed by F . As an application of consequence-finding, we give a loop invariant generation algorithm that is monotone with respect to the theory and (in a sense) complete. Experiments show that the invariants generated from the consequences are effective for proving safety properties of programs that require non-linear reasoning.

On invariable generation of alternating groups by elements of prime and prime power order

We verify that every alternating group of degree at most one quadrillion is invariably generated by an element of prime order together with an element of prime power order.

On the probability of generating invariably a finite simple group

Let G be a finite simple group. In this paper we consider the existence of small subsets A of G with the property that, if y∈G is chosen uniformly at random, then with high probability y invariably generates G together with some element of A. We prove various results in this direction, both positive and negative. As a corollary, we prove that two randomly chosen elements of a finite simple group of Lie type of bounded rank invariably generate with probability bounded away from zero. Our method is based on the positive solution of the Boston–Shalev conjecture by Fulman and Guralnick, as well as on certain connections between the properties of invariable generation of a group of Lie type and the structure of its Weyl group.

Invariable generation does not pass to finite index subgroups

Using small cancellation methods, we show that invariable generation does not pass to finite index subgroups, answering questions of Wiegold (1977) and Kantor–Lubotzky–Shalev (2015). We further show that a finitely generated group that is invariably generated is not necessarily finitely invariably generated, answering a question of Cox (2021). The same results were also obtained independently by Minasyan (2021).

Scalable linear invariant generation with Farkas’ lemma

Invariant generation is a classical problem to automatically generate invariants to aid the formal analysis of programs. In this work, we consider the problem of generating tight linear-invariants over affine programs (i.e., programs with affine guards and updates) without a prescribed goal property. In the literature, the only known sound and complete characterization to solve this problem is via Farkas’ Lemma (FL), and has been implemented through either quantifier elimination or reasonable heuristics. Although FL-based approaches can generate highly accurate linear invariants from the completeness of FL, the main bottleneck to applying these approaches is the scalability issue caused by either non-linear constraints or combinatorial explosion. We base our approach on the only practical FL-based approach [Sankaranarayanan ‍ et al. , SAS 2004] that applies FL with reasonable heuristics, and develop two novel and independent improvements to leverage the scalability. The first improvement is the novel idea to generate invariants at one program location in a single invariant-generation process, so that the invariants for each location are generated separately rather than together in a single computation. This idea naturally leads to a parallel processing that divides the invariant-generation task for all program locations by assigning the locations separately to multiple processors. Moreover, the idea enables us to develop detailed technical improvements to further reduce the combinatorial explosion in the original work [Sankaranarayanan ‍ et al. , SAS 2004]. The second improvement is a segmented subsumption testing in the CNF-to-DNF expansion that allows discovering more local subsumptions in advance. We formally prove that our approach has the same accuracy as the original work and thus does not incur accuracy loss on the generated invariants. Moreover, experimental results on representative benchmarks involving non-trivial linear invariants demonstrate that our approach improves the runtime of the original work by several orders of magnitude, even in the non-parallel scenario that sums up the execution time for all program locations. Hence, our approach constitutes the first significant improvement in FL-based approaches for linear invariant generation after almost two decades.

Full-program induction: verifying array programs sans loop invariants

Arrays are commonly used in a variety of software to store and process data in loops. Automatically proving safety properties of such programs that manipulate arrays is challenging. We present a novel verification technique, called full-program induction, for proving (a sub-class of) quantified as well as quantifier-free properties of programs manipulating arrays of parametric size N. Instead of inducting over individual loops, our technique inducts over the entire program (possibly containing multiple loops) directly via the program parameter N. The technique performs non-trivial transformations of the given program and pre-conditions during the inductive step. The transformations assist in effectively reducing the assertion checking problem by transforming a program with multiple loops to a program which has fewer and simpler loops or is loop free. Significantly, full-program induction does not require generation or use of loop-specific invariants. To assess the efficacy of our technique, we have developed a prototype tool called Vajra. We demonstrate the performance of Vajra vis-a-vis several state-of-the-art tools on a large set of array manipulating benchmarks from the international software verification competition (SV-COMP) and on several programs inspired by algebraic functions that perform polynomial computations.

Formal verification of TLS 1.2 by automatically generating proof scores

Our previous work has proposed an approach and a tool supporting it, called Invariant Proof Score Generator (IPSG), that can automatically generate formal proofs, called proof scores, for formal verification of invariant properties. In this work, we present some improvements of the tool that are helpful when conducting formal verification in practice. We demonstrate the practicability of the tool with the TLS 1.2 Handshake Protocol, which is one of the most important cryptographic protocols in use today, securing numerous internet communications. We formally verify that the protocol enjoys two properties including the secrecy property and the authentication property by employing IPSG to infer proof scores. TLS is much more complex than academic protocols, and hence, through the case study, the practicability of the tool is confirmed. Moreover, the correctness of the generated proof scores is once more verified with the use of two extensions of CafeInMaude - a CafeOBJ interpreter implemented in Maude, ensuring that there is not any subtle error in the proof scores generated by our tool. In addition to the case studies reported in our previous work as well as the TLS case study presented in this paper, we also report experimental results of the tool with several other protocols.

Online routing for smart electricity network under hybrid uncertainty

In this study, an online routing problem for the optimal power flow (OPF) of smart grids subject to forecasting errors and cyber-attacks on data integrity is investigated. Energy data packages and flow-dispatch commands are transmitted over a communication network and corrupted by adversaries. In particular, we consider false data injection attacks that maliciously tamper with the data presented to grid operators. We develop an OPF model considering piecewise invariable load and power generation, which can be evaluated using a linear program. We extend the problem to an online setting, where data are sequentially observed, and adaptive strategies are required to optimize a metric, called the regret function, over time. We then incorporate the state-of-the-art adaptive change-point detection approach to develop an online routing algorithm that retains a sublinear regret in both the time horizon and number of change points. The applicability and effectiveness of the proposed algorithm were verified by numerical experiments on real-world smart grids.

Anomalous U(1) gauge bosons and string physics at the forward physics facility

We show that experiments at the Forward Physics Facility, planned to operate near the ATLAS interaction point during the LHC high-luminosity era, will be able to probe predictions of Little String Theory by searching for anomalous U(1) gauge bosons living in the bulk. The interaction of the abelian broken gauge symmetry with the Standard Model is generated at the one-loop level through kinetic mixing with the photon. Gauge invariant generation of mass for the U(1) gauge boson proceeds via the Higgs mechanism in spontaneous symmetry breaking, or else through anomaly-cancellation appealing to Stückelberg-mass terms. We demonstrate that FASER2 will be able to probe string scales over roughly two orders of magnitude: 105≲Ms/TeV≲107.

Invariable generation and the Houghton groups

The Houghton groups H1,H2,… are a family of infinite groups. In 1977 Wiegold showed that H3 was invariably generated (IG) but H1⩽H3 was not. A natural question is then whether the groups H2,H3,… are all IG. Wiegold also ends by saying that, in the examples he had found of an IG group with a subgroup that is not IG, the subgroup was never of finite index. Another natural question is then whether there is a subgroup of finite index in H3 that is not IG. In this note we prove, for each n∈{2,3,…}, that Hn and all of its finite index subgroups are IG.The independent work of Minasyan and Goffer-Lazarovich in June 2020 frames this note quite nicely: they showed that an IG group can have a finite index subgroup that is not IG.

Geometric deviation modeling for single surface tolerancing using Laplace-Beltrami Operator

ISO standards on geometrical product specifications and verification (GPS) categorize the geometrical features partitioned from shapes based on their kinematic invariance classes. As a key issue to achieve predictable and interchangeable shape, geometrical tolerancing defines the tolerance zone within which the partitioned features shall be contained for dimensional and geometrical accuracy. However, most of the current research activities consider the geometrical features as orientation and position deviations of substitute ideal surfaces and neglect form errors within the developed models. In order to enhance the tolerance analysis and simulation, the concept of Skin Model Shapes (SMS) is therefore proposed to represent surface deviations in accordance with random nature of geometric deviations. In this paper, a new approach based on spectral analysis is proposed for SMS generation on mechanical parts. The Eigen-system of Laplace-Beltrami Operator (LBO) enables shape analysis with an unambiguous mathematical language due to its invariance of the position and orientation. The SMS generation process is completed with LBO by developing a modeling methodology for geometric deviation representation and generation on single surfaces in the design process. The obtained spatial frequency LBO decomposition on the single surface of invariant class is used to represent the statistical characteristics of the deviations and further used to reproduce deviations with similar distributions. A comparison is presented in the paper to illustrate the difference between a conventional Discrete Cosine Transform (DCT) based method and the proposed LBO-based method. Another case study is investigated to explain the implementation of the proposed method on different types of single surfaces of invariant class generation based on SMS.

Moment-based analysis of Bayesian network properties

We use algebraic reasoning to translate Bayesian network (BN) properties into linear recurrence equations over statistical moments of BN variables. We show that this translation can always be done for various BNs, such as discrete, Gaussian, conditional linear Gaussian, and dynamic BNs. An important part of our work comes with representing BNs as while loops in probabilistic programs with polynomial assignments over random variables and parametrised distributions. We prove that closed-form summaries of probabilistic loops precisely characterize higher-order moments of BN variables. As such, we automatically solve several BN-related problems, including exact inference, sensitivity analysis, filtering, and computing the expected number of rejecting samples in sampling-based procedures. We evaluate our work on a number of BN benchmarks, using automated invariant generation within Prob-solvable loop analysis.This paper is an extended version of the “Analysis of Bayesian Networks via Prob-Solvable Loops” manuscript published at ICTAC 2020[1].

Learning prototypes for multiple instance learning

Multiple instance learning (MIL) is a weakly supervised learning method that works on the labeled bag of instances data. A prototypical network is a popular embedding approach in MIL. They overcome the common problems that other MIL approaches may have to deal with including dimensionality, loss of instance-level information, and complexity. They demonstrate competitive performance in classification. This work proposes a simple model that provides a permutation invariant prototype generator from a given MIL data set. We aim to find out prototypes in the feature space to map the collection of instances (i.e. bags) to a distance feature space and simultaneously learn a linear classifier for MIL. Another advantage of prototypical networks is that they are commonly used in the machine learning domain to facilitate interpretability. Our experiments on classical MIL benchmark data sets demonstrate that the proposed framework is an accurate and efficient classifier compared to the existing approaches.

Invariable generation of finite classical groups

A subset of a group invariably generates the group if it generates even when we replace the elements by any of their conjugates. In a 2016 paper, Pemantle, Peres and Rivin show that the probability that four randomly selected elements invariably generate Sn is bounded away from zero by an absolute constant for all n. Subsequently, Eberhard, Ford and Green have shown that the probability that three randomly selected elements invariably generate Sn tends to zero as n→∞. In this paper, we prove an analogous result for the finite classical groups. More precisely, let Gr(q) be a finite classical group of rank r over Fq. We show that for q large enough, the probability that four randomly selected elements invariably generate Gr(q) is bounded away from zero by an absolute constant for all r, and for three elements the probability tends to zero as q→∞ and r→∞. We use the fact that most elements in Gr(q) are separable and the well-known correspondence between classes of maximal tori containing separable elements in classical groups and conjugacy classes in their Weyl groups.

A note on invariable generation of nonsolvable permutation groups

We prove a result on the asymptotic proportion of randomly chosen pairs \((\sigma ,\tau )\) of permutations in the symmetric group \(S_n\) which “invariably” generate a nonsolvable subgroup, i.e., whose cycle structures cannot possibly both occur in the same solvable subgroup of \(S_n\). As an application, we obtain that for a large degree “random” integer polynomial f, reduction modulo two different primes can be expected to suffice to prove the nonsolvability of \(\text {Gal}(f/{\mathbb {Q}})\).