Proof Rules Research Articles

SAT solving for variants of first-order subsumption

AbstractAutomated reasoners, such as SAT/SMT solvers and first-order provers, are becoming the backbones of rigorous systems engineering, being used for example in applications of system verification, program synthesis, and cybersecurity. Automation in these domains crucially depends on the efficiency of the underlying reasoners towards finding proofs and/or counterexamples of the task to be enforced. In order to gain efficiency, automated reasoners use dedicated proof rules to keep proof search tractable. To this end, (variants of) subsumption is one of the most important proof rules used by automated reasoners, ranging from SAT solvers to first-order theorem provers and beyond. It is common that millions of subsumption checks are performed during proof search, necessitating efficient implementations. However, in contrast to propositional subsumption as used by SAT solvers and implemented using sophisticated polynomial algorithms, first-order subsumption in first-order theorem provers involves NP-complete search queries, turning the efficient use of first-order subsumption into a huge practical burden. In this paper we argue that the integration of a dedicated SAT solver opens up new venues for efficient implementations of first-order subsumption and related rules. We show that, by using a flexible learning approach to choose between various SAT encodings of subsumption variants, we greatly improve the scalability of first-order theorem proving. Our experimental results demonstrate that, by using a tailored SAT solver within first-order reasoning, we gain a large speedup in solving state-of-the-art benchmarks.

Hypra: A Deductive Program Verifier for Hyper Hoare Logic

Hyperproperties relate multiple executions of a program and are useful to express common correctness properties (such as determinism) and security properties (such as non-interference). While there are a number of powerful program logics for the deductive verification of hyperproperties, their automation falls behind. Most existing deductive verification tools are limited to safety properties, but cannot reason about the existence of executions, for instance, to prove the violation of a safety property. Others support more flexible hyperproperties such as generalized non-interference, but have limitations in terms of the programs and proof structures they support. In this paper, we present the first deductive verification technique for arbitrary hyperproperties over multiple executions of the same program. Our technique automates the generation of verification conditions for Hyper Hoare Logic. Our key insight is that arbitrary hyperproperties and the corresponding proof rules can be encoded into a standard intermediate verification language by representing sets of states of the input program explicitly in the states of the intermediate program. Verification is then automated using an existing SMT-based verifier for the intermediate language. We implement our technique in a tool called Hypra and demonstrate that it can reliably verify complex hyperproperties.

Verifying Programs with Logic and Extended Proof Rules: Deep Embedding vs. Shallow Embedding

Verifying Programs with Logic and Extended Proof Rules: Deep Embedding vs. Shallow Embedding

Perfect proofs at first order

Abstract In this note we extend a remarkable result of Brauer (2024, Journal of Logic and Computation) concerning propositional Classical Core Logic. We show that it holds also at first order. This affords a soundness and completeness result for Classical Core Logic. The $\mathbb{C}^{+}$-provable sequents are exactly those that are uniform substitution instances of perfectly valid sequents, i.e. sequents that are valid and that need every one of their sentences in order to be so. Brauer (2020, Review of Symbolic Logic, 13, 436–457) showed that the notion of perfect validity itself is unaxiomatizable. In the Appendix we use his method to show that our notion of relevant validity in Tennant (2024, Philosophia Mathematica) is likewise unaxiomatizable. It would appear that the taking of substitution instances is an essential ingredient in the construction of a semantical relation of consequence that will be axiomatizable—and indeed, by the rules of proof for Classical Core Logic.

Transitioning to proof via writing scripts on the rules of a new discourse

Coming from the commognitive standpoint, we consider proof-based mathematics as a distinct discourse, the transition to which requires special rules for endorsement and rejection of mathematical statements. In this study, we investigate newcomers’ learning of these rules when being taught them explicitly. Our data come from academically motivated high-school students who took a special course in undergraduate mathematics. The course teacher dedicated three academic hours to introducing and explaining selected rules of proof to support students’ shift to the new discourse. The homework assignment consisted of typical proof-requiring problems and a scriptwriting task, asking students to compose a dialogue between fictional characters about a proof-related mistake of their choice. We analyzed the differences and similarities between the rules discussed in the classroom and those that students addressed and implemented in their proofs. The analysis showed that while students’ solutions to proof-requiring problems required rule implementation, fictitious dialogues opened the space for rule formulation and substantiation. In many cases, the students discussed the rules presented in the classroom, extending, elaborating, and specifying the teacher’s formulations. Furthermore, while the students’ proofs were mainly consistent with the teacher’s expectations, some of their rule formulations were more radical and overgeneralized than expected. These findings suggest that newcomers’ communication about the rules of proof may lag behind their capability to implement those rules to prove mathematical statements.

Verifying a Sequent Calculus Prover for First-Order Logic with Functions in Isabelle/HOL

We describe the design, implementation and verification of an automated theorem prover for first-order logic with functions. The proof search procedure is based on sequent calculus and we formally verify its soundness and completeness in Isabelle/HOL using an existing abstract framework for coinductive proof trees. Our analytic completeness proof covers both open and closed formulas. Since our deterministic prover considers only the subset of terms relevant to proving a given sequent, we do the same when building a countermodel from a failed proof. Finally, we formally connect our prover with the proof system and semantics of the existing SeCaV system. In particular, the prover can generate human-readable SeCaV proofs which are also machine-verifiable proof certificates. The abstract framework we rely on requires us to fix a stream of proof rules in advance, independently of the formula we are trying to prove. We discuss the efficiency implications of this and the difficulties in mitigating them.

A Calculus for the Specification, Design, and Verification of Distributed Concurrent Systems

A calculus for the specification and verification of distributed concurrent interactive real time systems is introduced. Systems are specified by their interface behavior formalized by interface predicates and interface assertions. System designs in terms of architectures of distributed networks of interactive systems are constructed by concurrent composition of subsystems. The specification of system designs is calculated from the specifications of their subsystems. Verification is done by proof rules which are based on the concepts of causality and realizability justified by the operational model in terms of generalized Moore machines, Moore machines not restricted to finite state spaces. The calculus supports interface specification and reasoning both about untimed as well as timed distributed concurrent systems. This includes the design of cyber-physical systems. Real-time is used, in particular, to specify time sensitive behavior and to prove properties related to causality and realizability, properties which hold for all Moore machines. On this basis, a calculus is worked out and illustrated by small examples. The calculus is shown to be sound and relatively complete.

Proof and proving: legislative technique of criminal procedure laws of the Republic of Moldova and the Russian Federation

Proof and proving lies at the heart of criminal procedure regulation, significantly impacting the quality of law enforcement. In the post-Soviet states that once shared a unified legal system during the USSR dissolution, original criminal procedural laws emerged, exhibiting intriguting examples of evidence and proof rules’ layout. The purpose of the study is to discern the distinct design characteristics of evidence and prove institutions in the criminal procedure laws of the Republic of Moldova and the Russian Federation. The study’s methodological framework rests upon the general scientific principles of cognition such as objectivity, comprehensiveness, pluralism, and historicism. It employs historical, formal-logical and comparative methods, as well as document analysis. By comparing the normative models of evidence and proof institutions in Moldovan and Russian criminal procedure laws, a shared approach to the concept of evidence as a fusion of form and content becomes apparent. Distinct features of the Moldovan criminal procedure law include the systemic and structured arrangement of evidence rules, the formal adoption of the concept of a means of proof, and precise use of terminology. Conversely, the Russian criminal procedure law disperses evidence rules actoss general and specialized sections, leading to regulatory duplications and terminologicals inaccuracies. The historical roots of the evidence and proof institution layout trace back to November 20, 1864, Charter of Criminal Procedure. The Charter’s systematization of norms reflected the nuances of the pre-revolutionary Russian process. Despite the subsequent stage structuring evolution during the Soviet era and procedural form differentiation, the Soviet legislator retained the pre-revolutionary rules’ systematization on evidence. Presently, the current criminal procedure law maintains much of the previous regulatory content, highlighting essential areas for enhancement in evidence and proof institution design to allign more closely with the process’ stage structure and procedural form differentiation, thus mitigating potential abuse of rights. Addressing these design shortcomings is crucial. Rectifing Russian legistation following the comparative study allows drawing insights from Moldova’s legislative experience.

Reflexive Event-B: Semantics and Correctness the EB4EB Framework

The Event-B method enables correct by construction modeling of systems. It relies on set theory and first-order logic, to describe a series of refined system models expressed as a set of events modifying state variables. Invariants and theorems are introduced to express system properties submitted to the proof system associated with Event-B. While Event-B has proven its efficiency for the proof of this type of property, it does not offer powerful means allowing the explicit description of properties other than safety and specific forms of reachability. Checking other properties such as deadlock-freeness, liveness, or event scheduling requires ad hoc modeling techniques and external tools such as model checkers or other proof systems. This article presents <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">EB4EB</i> , a new modeling framework offering the capability to introduce formally defined Event-B extensions, in particular new proof obligations corresponding to new properties. It is based on metamodeling techniques. It includes a theory (a metatheory) modeling Event-B and offers means for explicit manipulation of Event-B features and an extension mechanism to explicitly formalize and prove other properties. This reflexive framework relies on a trace-based semantics of Event-B and introduces a set of Event-B theories defining data types, operators, well-defined conditions, theorems, and proof rules to define Event-B constructs and their semantics. Deep and shallow instantiation mechanisms are set up to instantiate the obtained metatheory. The EB4EB framework and its instantiation mechanisms are developed in Event-B using the Rodin platform ensuring correctness and internal consistency of the defined theories. Lamport's clock example, instantiating EB4EB in both shallow and deep mechanisms, is used to evaluate the proposed approach.

Proof of facts in administrative law in France: many ad hoc and ex post rules of evidence, but for how long?

In France, general legislative rules of proof of facts between the administrations and the citizens are rare. Nevertheless, there are real obligations for public administrations to base their decisions on factual evidence, and for citizens to provide evidence they hold. The inquisitorial litigation procedure is the main asset of French administrative law because it relieves citizens who take a case to the administrative courts and who do not have all the evidence, some of which is often held by the administrations. Freedom of assessment of evidence is also an important principle which facilitates the administration of evidence for the parties and the judges. However, the disinterest of the legislator with regard to proof in the relations between administrations and citizens can no longer persist in the face of the probative issues raised by digitization and especially big data and artificial intelligence.

Categorical Proof-theoretic Semantics

AbstractIn proof-theoretic semantics, model-theoretic validity is replaced by proof-theoretic validity. Validity of formulae is defined inductively from a base giving the validity of atoms using inductive clauses derived from proof-theoretic rules. A key aim is to show completeness of the proof rules without any requirement for formal models. Establishing this for propositional intuitionistic logic raises some technical and conceptual issues. We relate Sandqvist’s (complete) base-extension semantics of intuitionistic propositional logic to categorical proof theory in presheaves, reconstructing categorically the soundness and completeness arguments, thereby demonstrating the naturality of Sandqvist’s constructions. This naturality includes Sandqvist’s treatment of disjunction that is based on its second-order or elimination-rule presentation. These constructions embody not just validity, but certain forms of objects of justifications. This analysis is taken a step further by showing that from the perspective of validity, Sandqvist’s semantics can also be viewed as the natural disjunction in a category of sheaves.

Hopping Proofs of Expectation-Based Properties: Applications to Skiplists and Security Proofs

We propose, implement, and evaluate a hopping proof approach for proving expectation-based properties of probabilistic programs. Our approach combines EHL, a syntax-directed proof system for reducing proof goals of a program to proof goals of simpler programs, with a "hopping" proof rule for reducing proof goals of an original program to proof goal of a different program which is suitably related (by means of pRHL, a relational program logic for probabilistic program) to the original program. We prove that EHL is sound for a core language with procedure calls and adversarial computations, and complete for the adversary-free fragment of the language. We also provide an implementation of EHL into EasyCrypt, a proof assistant tailored for reasoning about relational properties of probabilistic programs. We provide a tight integration of EHL with other program logics supported by EasyCrypt, and in particular probabilistic Relational Hoare Logic (pRHL). Using this tight integration, we give mechanized proofs of expected complexity of in-place implementations of randomized quickselect and skip lists. We also sketch applications of our approach to cryptographic proofs and discuss the broader impact of EHL in the EasyCrypt proof assistant.

Advanced Query Functionalities in Natural Logic Knowledge Bases

Natural logics are formal logics characterized by expressions that bear a resemblance to simplified natural language sentences. The inherent readability of natural logics renders them suitable also for large knowledge bases. Within the realm of natural logics, the rules of logical proof are applicable directly to the sentences constructed using this framework. This direct application ensures explainability of query inferences. In the paper we describe a specific natural logic named NaturaLog, suited for ontology-structured knowledge bases. We outline how NaturaLog can be effectively implemented into a database system to facilitate deductive querying. The primary focus of this paper lies in exploring various query functionalities and elucidating methods to achieve these capabilities, also when dealing with large-scale knowledge bases.

The Concept of Class Invariant in Object-oriented Programming

Class invariants—consistency constraints preserved by every operation on objects of a given type—are fundamental to building, understanding, and verifying object-oriented programs. For verification, however, they raise difficulties, which have not yet received a generally accepted solution. The present work introduces a proof rule meant to address these issues and allow verification tools to benefit from invariants. It clarifies the notion of invariant and identifies the three associated problems: callbacks, furtive access, and reference leak. As an example, the 2016 Ethereum DAO bug, in which $50 million was stolen, resulted from a callback invalidating an invariant. The discussion starts with a simplified model of computation and an associated proof rule, demonstrating its soundness. It then removes one by one the three simplifying assumptions, each removal raising one of the three issues and leading to a corresponding adaptation to the proof rule. The final version of the rule can tackle tricky examples, including “challenge problems” listed in the literature.

A General Schema for Bilateral Proof Rules

A General Schema for Bilateral Proof Rules

Positive Almost-Sure Termination: Complexity and Proof Rules

We study the recursion-theoretic complexity of Positive Almost-Sure Termination ( PAST ) in an imperative programming language with rational variables, bounded nondeterministic choice, and discrete probabilistic choice. A program terminates positive almost-surely if, for every scheduler, the program terminates almost-surely and the expected runtime to termination is finite. We show that PAST for our language is complete for the (lightface) co-analytic sets (Π 1 1 -complete). This is in contrast to the related notions of Almost-Sure Termination ( AST ) and Bounded Termination ( BAST ), both of which are arithmetical (Π 2 0 - and Σ 2 0 -complete respectively). Our upper bound implies an effective procedure to reduce reasoning about probabilistic termination to non-probabilistic fair termination in a model with bounded nondeterminism, and to simple program termination in models with unbounded nondeterminism. Our lower bound shows the opposite: for every program with unbounded nondeterministic choice, there is an effectively computable probabilistic program with bounded choice such that the original program is terminating if, and only if, the transformed program is PAST . We show that every program has an effectively computable normal form, in which each probabilistic choice either continues or terminates execution immediately, each with probability 1/2. For normal form programs, we provide a sound and complete proof rule for PAST . Our proof rule uses transfinite ordinals. We show that reasoning about PAST requires transfinite ordinals up to ω 1 CK ; thus, existing techniques for probabilistic termination based on ranking supermartingales that map program states to reals do not suffice to reason about PAST .

On Lexicographic Proof Rules for Probabilistic Termination

We consider the almost-sure (a.s.) termination problem for probabilistic programs, which are a stochastic extension of classical imperative programs. Lexicographic ranking functions provide a sound and practical approach for termination of non-probabilistic programs, and their extension to probabilistic programs is achieved via lexicographic ranking supermartingales (LexRSMs). However, LexRSMs introduced in the previous work have a limitation that impedes their automation: all of their components have to be non-negative in all reachable states. This might result in a LexRSM not existing even for simple terminating programs. Our contributions are twofold. First, we introduce a generalization of LexRSMs that allows for some components to be negative. This standard feature of non-probabilistic termination proofs was hitherto not known to be sound in the probabilistic setting, as the soundness proof requires a careful analysis of the underlying stochastic process. Second, we present polynomial-time algorithms using our generalized LexRSMs for proving a.s. termination in broad classes of linear-arithmetic programs.

Fixpoint Theory -- Upside Down

Knaster-Tarski's theorem, characterising the greatest fixpoint of a monotone function over a complete lattice as the largest post-fixpoint, naturally leads to the so-called coinduction proof principle for showing that some element is below the greatest fixpoint (e.g., for providing bisimilarity witnesses). The dual principle, used for showing that an element is above the least fixpoint, is related to inductive invariants. In this paper we provide proof rules which are similar in spirit but for showing that an element is above the greatest fixpoint or, dually, below the least fixpoint. The theory is developed for non-expansive monotone functions on suitable lattices of the form $\mathbb{M}^Y$, where $Y$ is a finite set and $\mathbb{M}$ an MV-algebra, and it is based on the construction of (finitary) approximations of the original functions. We show that our theory applies to a wide range of examples, including termination probabilities, metric transition systems, behavioural distances for probabilistic automata and bisimilarity. Moreover it allows us to determine original algorithms for solving simple stochastic games.

On the logical rules of enterprise data validation --Observations based on one hundred and fifty adjudication documents

Enterprises are essential participants in the data market. Properly defining the ownership of enterprise data can stimulate better the vitality of data and the enthusiasm of enterprise subjects. At present, the classification and grading of enterprise data are in a wide range of views, and it is difficult to unify the standard of confirmation of rights, so it is necessary to seek a proper rule of proof of ownership. Based on the observation of judicial practice, data rights should be confirmed in two steps: the first step is whether there are conditions for the confirmation of ownership, i.e., the necessity of data rights, including three specific aspects: the data has a particular scale and value; there is a data processing relationship between the user and the enterprise; and the purpose, scope, and way of using the data are legal. The second step is the specific steps to be taken to establish the right: in turn, five specific criteria are identified: whether the enterprise’s access to data is authorized, whether the data is desensitized, whether it is costly or intellectually demanding, whether the data can be recovered, and the type of data product.

A First-order Logic with Frames

We propose a novel logic, Frame Logic (FL), that extends first-order logic and recursive definitions with a construct Sp (·) that captures the implicit supports of formulas—the precise subset of the universe upon which their meaning depends. Using such supports, we formulate proof rules that facilitate frame reasoning elegantly when the underlying model undergoes change. We show that the logic is expressive by capturing several data-structures and also exhibit a translation from a precise fragment of separation logic to frame logic. Finally, we design a program logic based on frame logic for reasoning with programs that dynamically update heaps that facilitates local specifications and frame reasoning. This program logic consists of both localized proof rules as well as rules that derive the weakest tightest preconditions in frame logic.