Refinement Types Research Articles

Refinement Type Refutations

Refinement types combine SMT decidable constraints with a compositional, syntax-directed type system to provide a convenient way to statically and automatically check properties of programs. However, when type checking fails, programmers must use cryptic error messages that, at best, point out the code location where a subtyping constraint failed to determine the root cause of the failure. In this paper, we introduce refinement type refutations, a new approach to explaining why refinement type checking fails, which mirrors the compositional way in which refinement type checking is carried out. First, we show how to systematically transform standard bidirectional type checking rules to obtain refutations. Second, we extend the approach to account for global constraint-based refinement inference via the notion of a must-instantiation: a set of concrete inhabitants of the types of subterms that suffice to demonstrate why typing fails. Third, we implement our method in HayStack—an extension to LiqidHaskell which automatically finds type-refutations when refinement type checking fails, and helps users understand refutations via an interactive user-interface. Finally, we present an empirical evaluation of HayStack using the regression benchmark-set of LiqidHaskell, and the benchmark set of G2, a previous method that searches for (non-compositional) counterexample traces by symbolically executing Haskell source. We show that HayStack can find refutations for 99.7% of benchmarks, including those with complex typing constructs (e.g., abstract and bounded refinements, and reflection), and does so, an order of magnitude faster than G2.

Making Formulog Fast: An Argument for Unconventional Datalog Evaluation

With its combination of Datalog, SMT solving, and functional programming, the language Formulog provides an appealing mix of features for implementing SMT-based static analyses (e.g., refinement type checking, symbolic execution) in a natural, declarative way. At the same time, the performance of its custom Datalog solver can be an impediment to using Formulog beyond prototyping—a common problem for Datalog variants that aspire to solve large problem instances. In this work we speed up Formulog evaluation, with some surprising results: while 2.2× speedups can be obtained by using the conventional techniques for high-performance Datalog (e.g., compilation, specialized data structures), the big wins come by abandoning the central assumption in modern performant Datalog engines, semi-naive Datalog evaluation. In the place of semi-naive evaluation, we develop eager evaluation, a concurrent Datalog evaluation algorithm that explores the logical inference space via a depth-first traversal order. In practice, eager evaluation leads to an advantageous distribution of Formulog’s SMT workload to external SMT solvers and improved SMT solving times: our eager evaluation extensions to the Formulog interpreter and Soufflé’s code generator achieve mean 5.2× and 7.6× speedups, respectively, over the optimized code generated by off-the-shelf Soufflé on SMT-heavy Formulog benchmarks. All in all, using compilation and eager evaluation (as appropriate), Formulog implementations of refinement type checking, bottom-up pointer analysis, and symbolic execution achieve speedups on 20 out of 23 benchmarks over previously published, hand-tuned analyses written in F ♯ , Java, and C++, providing strong evidence that Formulog can be the basis of a realistic platform for SMT-based static analysis. Moreover, our experience adds nuance to the conventional wisdom that traditional semi-naive evaluation is the one-size-fits-all best Datalog evaluation algorithm for static analysis workloads.

Synchronous Programming with Refinement Types

Cyber-Physical Systems (CPS) consist of software interacting with the physical world, such as robots, vehicles, and industrial processes. CPS are frequently responsible for the safety of lives, property, or the environment, and so software correctness must be determined with a high degree of certainty. To that end, simply testing a CPS is insufficient, as its interactions with the physical world may be difficult to predict, and unsafe conditions may not be immediately obvious. Formal verification can provide stronger safety guarantees but relies on the accuracy of the verified system in representing the real system. Bringing together verification and implementation can be challenging, as languages that are typically used to implement CPS are not easy to formally verify, and languages that lend themselves well to verification often abstract away low-level implementation details. Translation between verification and implementation languages is possible, but requires additional assurances in the translation process and increases software complexity; having both in a single language is desirable. This paper presents a formalization of MARVeLus, a CPS language which combines verification and implementation. We develop a metatheory for its synchronous refinement type system and demonstrate verified synchronous programs executing on real systems.

Automated Verification of Higher-Order Probabilistic Programs via a Dependent Refinement Type System

Verification of higher-order probabilistic programs is a challenging problem. We present a verification method that supports several quantitative properties of higher-order probabilistic programs. Usually, extending verification methods to handle the quantitative aspects of probabilistic programs often entails extensive modifications to existing tools, reducing compatibility with advanced techniques developed for qualitative verification. In contrast, our approach necessitates only small amounts of modification, facilitating the reuse of existing techniques and implementations. On the theoretical side, we propose a dependent refinement type system for a generalised higher-order fixed point logic (HFL). Combined with continuation-passing style encodings of properties into HFL, our dependent refinement type system enables reasoning about several quantitative properties, including weakest pre-expectations, expected costs, moments of cost, and conditional weakest pre-expectations for higher-order probabilistic programs with continuous distributions and conditioning. The soundness of our approach is proved in a general setting using a framework of categorical semantics so that we don’t have to repeat similar proofs for each individual problem. On the empirical side, we implement a type checker for our dependent refinement type system that reduces the problem of type checking to constraint solving. We introduce admissible predicate variables and integrable predicate variables to constrained Horn clauses (CHC) so that we can soundly reason about the least fixed points and samplings from probability distributions. Our implementation demonstrates that existing CHC solvers developed for non-probabilistic programs can be extended to a solver for the extended CHC with only small efforts. We also demonstrate the ability of our type checker to verify various concrete examples.

Towards a Dynabook for verified VM construction

We present Smalltalk-25, a scientific Programm of research towards the synthesis of Smalltalk VMs by formal methods. We approach this through a Dynabook-style implementation of Hilbert’s “manipulating proofs as mathematical objects”. We begin by implementing an automated-reasoning engine based on refinement types. Having that foundation laid, we build a program logics for a simple “model” language; a framework for reasoning about a real intermediate language by translating into the model language; an ahead-of-time bootstrapper; and a framework for debugging thus-constructed VMs.Our Programm is an ongoing research effort; this paper provides a report of its current status. Every part of our system is implemented in Smalltalk and available from GitHub under the MIT license.

Anomaly constraints for heterotic strings and supergravity in six dimensions

The landscape of six-dimensional supergravities is dramatically constrained by the cancellation of gauge and gravitational anomalies, but the full extent of its implications has not been uncovered. We explore the cancellation of global anomalies of the Dai-Freed type in this setting with abelian and simply laced gauge groups, finding novel constraints. In particular, we exclude arbitrarily large abelian charges in an infinite family of theories for certain types of quadratic refinements, including a specific one defined in the literature. We also show that the Gepner orientifold with no tensor multiplets is anomaly-free for a different choice, as well as a number of heterotic models with and without spacetime supersymmetry in six dimensions. The latter analysis extends previous results in ten dimensions to some lower-dimensional settings in the heterotic landscape.

A Survey of Dataset Refinement for Problems in Computer Vision Datasets

Large-scale datasets have played a crucial role in the advancement of computer vision. However, they often suffer from problems such as class imbalance, noisy labels, dataset bias, or high resource costs, which can inhibit model performance and reduce trustworthiness. With the advocacy of data-centric research, various data-centric solutions have been proposed to solve the dataset problems mentioned above. They improve the quality of datasets by re-organizing them, which we call dataset refinement. In this survey, we provide a comprehensive and structured overview of recent advances in dataset refinement for problematic computer vision datasets. 1 Firstly, we summarize and analyze the various problems encountered in large-scale computer vision datasets. Then, we classify the dataset refinement algorithms into three categories based on the refinement process: data sampling, data subset selection, and active learning. In addition, we organize these dataset refinement methods according to the addressed data problems and provide a systematic comparative description. We point out that these three types of dataset refinement have distinct advantages and disadvantages for dataset problems, which informs the choice of the data-centric method appropriate to a particular research objective. Finally, we summarize the current literature and propose potential future research topics.

Grid Convergence Properties of Wall-Modeled Large Eddy Simulations in the Asymptotic Regime

Abstract This study explores the grid convergence properties of wall-modeled large eddy simulation (WMLES) solutions as the large eddy simulation (LES) grid approaches the direct numerical simulation (DNS) grid. This aspect of WMLES is fundamental but has not been previously investigated or documented. We investigate two types of grid refinements: one where the LES/wall-model matching location is fixed at an off-wall grid point, and another where the matching location is fixed at a specific distance from the wall. In both cases, we refine the LES grid simultaneously in all three Cartesian directions, with grid resolution ranging from typical LES resolution to typical DNS resolution. Our focus is on examining the mean flow and turbulent kinetic energy (TKE) as the grid refines. While the turbulence statistics consistently converge toward the DNS solution, we observe nonmonotonic convergence in the mean flow statistics. We show that improving the grid resolution does not necessarily enhance the accuracy of the mean flow predictions. Specifically, we identify a negative log layer mismatch when the LES/wall-model matching location lies below the logarithmic layer, regardless of grid resolution and matching location. Finally, we demonstrate that the nonmonotonic convergence of the mean flow can lead to misleading conclusions from grid convergence studies of WMLES.

Mechanizing Refinement Types

Practical checkers based on refinement types use the combination of implicit semantic subtyping and parametric polymorphism to simplify the specification and automate the verification of sophisticated properties of programs. However, a formal metatheoretic accounting of the soundness of refinement type systems using this combination has proved elusive. We present λ RF , a core refinement calculus that combines semantic subtyping and parametric polymorphism. We develop a metatheory for this calculus and prove soundness of the type system. Finally, we give two mechanizations of our metatheory. First, we introduce data propositions , a novel feature that enables encoding derivation trees for inductively defined judgments as refined data types, and use them to show that LiquidHaskell’s refinement types can be used for mechanization. Second, we mechanize our results in Coq, which comes with stronger soundness guarantees than LiquidHaskell, thereby laying the foundations for mechanizing the metatheory of LiquidHaskell.

Answer Refinement Modification: Refinement Type System for Algebraic Effects and Handlers

Algebraic effects and handlers are a mechanism to structure programs with computational effects in a modular way. They are recently gaining popularity and being adopted in practical languages, such as OCaml. Meanwhile, there has been substantial progress in program verification via refinement type systems . While a variety of refinement type systems have been proposed, thus far there has not been a satisfactory refinement type system for algebraic effects and handlers. In this paper, we fill the void by proposing a novel refinement type system for languages with algebraic effects and handlers. The expressivity and usefulness of algebraic effects and handlers come from their ability to manipulate delimited continuations , but delimited continuations also complicate programs’ control flow and make their verification harder. To address the complexity, we introduce a novel concept that we call answer refinement modification (ARM for short), which allows the refinement type system to precisely track what effects occur and in what order when a program is executed, and reflect such information as modifications to the refinements in the types of delimited continuations. We formalize our type system that supports ARM (as well as answer type modification, or ATM) and prove its soundness. Additionally, as a proof of concept, we have extended the refinement type system to a subset of OCaml 5 which comes with a built-in support for effect handlers, implemented a type checking and inference algorithm for the extension, and evaluated it on a number of benchmark programs that use algebraic effects and handlers. The evaluation demonstrates that ARM is conceptually simple and practically useful. Finally, a natural alternative to directly reasoning about a program with delimited continuations is to apply a continuation passing style (CPS) transformation that transforms the program to a pure program without delimited continuations. We investigate this alternative in the paper, and show that the approach is indeed possible by proposing a novel CPS transformation for algebraic effects and handlers that enjoys bidirectional (refinement-)type-preservation. We show that there are pros and cons with this approach, namely, while one can use an existing refinement type checking and inference algorithm that can only (directly) handle pure programs, there are issues such as needing type annotations in source programs and making the inferred types less informative to a user.

Securing Verified IO Programs Against Unverified Code in F*

We introduce SCIO*, a formally secure compilation framework for statically verified programs performing input-output (IO). The source language is an F* subset in which a verified program interacts with its IO-performing context via a higher-order interface that includes refinement types as well as pre- and post-conditions about past IO events. The target language is a smaller F* subset in which the compiled program is linked with an adversarial context that has an interface without refinement types, pre-conditions, or concrete post-conditions. To bridge this interface gap and make compilation and linking secure we propose a formally verified combination of higher-order contracts and reference monitoring for recording and controlling IO operations. Compilation uses contracts to convert the logical assumptions the program makes about the context into dynamic checks on each context-program boundary crossing. These boundary checks can depend on information about past IO events stored in the state of the monitor. But these checks cannot stop the adversarial target context before it performs dangerous IO operations. Therefore linking in SCIO* additionally forces the context to perform all IO actions via a secure IO library, which uses reference monitoring to dynamically enforce an access control policy before each IO operation. We prove in F* that SCIO* soundly enforces a global trace property for the compiled verified program linked with the untrusted context. Moreover, we prove in F* that SCIO* satisfies by construction Robust Relational Hyperproperty Preservation, a very strong secure compilation criterion. Finally, we illustrate SCIO* at work on a simple web server example.

Focusing on Refinement Typing

We present a logically principled foundation for systematizing, in a way that works with any computational effect and evaluation order, SMT constraint generation seen in refinement type systems for functional programming languages. By carefully combining a focalized variant of call-by-push-value, bidirectional typing, and our novel technique of value-determined indexes, our system generates solvable SMT constraints without existential (unification) variables. We design a polarized subtyping relation allowing us to prove our logically focused typing algorithm is sound, complete, and decidable. We prove type soundness of our declarative system with respect to an elementary domain-theoretic denotational semantics. Type soundness implies, relatively simply, the total correctness and logical consistency of our system. The relative ease with which we obtain both algorithmic and semantic results ultimately stems from the proof-theoretic technique of focalization.

On the Practicality and Soundness of Refinement Types

On the Practicality and Soundness of Refinement Types

Explicit Refinement Types

We present λ ert , a type theory supporting refinement types with <em>explicit proofs</em>. Instead of solving refinement constraints with an SMT solver like DML and Liquid Haskell, our system requires and permits programmers to embed proofs of properties within the program text, letting us support a rich logic of properties including quantifiers and induction. We show that the type system is sound by showing that every refined program erases to a simply-typed program, and by means of a denotational semantics, we show that every erased program has all of the properties demanded by its refined type. All of our proofs are formalised in Lean 4.

Flux: Liquid Types for Rust

We introduce Flux, which shows how logical refinements can work hand in glove with Rust's ownership mechanisms to yield ergonomic type-based verification of low-level pointer manipulating programs. First, we design a novel refined type system for Rust that indexes mutable locations, with pure (immutable) values that can appear in refinements, and then exploits Rust's ownership mechanisms to abstract sub-structural reasoning about locations within Rust's polymorphic type constructors, while supporting strong updates. We formalize the crucial dependency upon Rust's strong aliasing guarantees by exploiting the Stacked Borrows aliasing model to prove that "well-borrowed evaluations of well-typed programs do not get stuck". Second, we implement our type system in Flux, a plug-in to the Rust compiler that exploits the factoring of complex invariants into types and refinements to efficiently synthesize loop annotations-including complex quantified invariants describing the contents of containers-via liquid inference. Third, we evaluate Flux with a benchmark suite of vector manipulating programs and parts of a previously verified secure sandboxing library to demonstrate the advantages of refinement types over program logics as implemented in the state-of-the-art Prusti verifier. While Prusti's more expressive program logic can, in general, verify deep functional correctness specifications, for the lightweight but ubiquitous and important verification use-cases covered by our benchmarks, liquid typing makes verification ergonomic by slashing specification lines by a factor of two, verification time by an order of magnitude, and annotation overhead from up to 24% of code size (average 14%), to nothing at all.

CN: Verifying Systems C Code with Separation-Logic Refinement Types

Despite significant progress in the verification of hypervisors, operating systems, and compilers, and in verification tooling, there exists a wide gap between the approaches used in verification projects and conventional development of systems software. We see two main challenges in bringing these closer together: verification handling the complexity of code and semantics of conventional systems software, and verification usability. We describe an experiment in verification tool design aimed at addressing some aspects of both: we design and implement CN, a separation-logic refinement type system for C systems software, aimed at predictable proof automation, based on a realistic semantics of ISO C. CN reduces refinement typing to decidable propositional logic reasoning, uses first-class resources to support pointer aliasing and pointer arithmetic, features resource inference for iterated separating conjunction, and uses a novel syntactic restriction of ghost variables in specifications to guarantee their successful inference. We implement CN and formalise key aspects of the type system, including a soundness proof of type checking. To demonstrate the usability of CN we use it to verify a substantial component of Google's pKVM hypervisor for Android.

Type-directed synthesis of visualizations from natural language queries

We propose a new technique based on program synthesis for automatically generating visualizations from natural language queries. Our method parses the natural language query into a refinement type specification using the intents-and-slots paradigm and leverages type-directed synthesis to generate a set of visualization programs that are most likely to meet the user's intent. Our refinement type system captures useful hints present in the natural language query and allows the synthesis algorithm to reject visualizations that violate well-established design guidelines for the input data set. We have implemented our ideas in a tool called Graphy and evaluated it on NLVCorpus, which consists of 3 popular datasets and over 700 real-world natural language queries. Our experiments show that Graphy significantly outperforms state-of-the-art natural language based visualization tools, including transformer and rule-based ones.

Solo: a lightweight static analysis for differential privacy

Existing approaches for statically enforcing differential privacy in higher order languages use either linear or relational refinement types. A barrier to adoption for these approaches is the lack of support for expressing these “fancy types” in mainstream programming languages. For example, no mainstream language supports relational refinement types, and although Rust and modern versions of Haskell both employ some linear typing techniques, they are inadequate for embedding enforcement of differential privacy, which requires “full” linear types. We propose a new type system that enforces differential privacy, avoids the use of linear and relational refinement types, and can be easily embedded in richly typed programming languages like Haskell. We demonstrate such an embedding in Haskell, demonstrate its expressiveness on case studies, and prove soundness of our type-based enforcement of differential privacy.

High-degree discontinuous finite element discrete quadrature sets for the Boltzmann transport equation

This paper proposes a family of high-degree discontinuous finite element (DFEM) quadrature sets designed to improve accuracy of integrals over local angular domain in the discrete ordinates method. The angular domain is divided into three types of spherical meshes by inscribing the octahedron, icosahedron and cube, respectively. High-degree discontinuous finite element basis functions are generated over different spherical meshes to resolve associated quadrature weights, producing high-degree DFEM quadrature sets. The performance and accuracy of the DFEM quadrature family was tested in the integration of spherical harmonics functions and some transport problems. Results demonstrate that kth-degree DFEM quadrature sets with any quadrature order can exactly integrate up to all kth-degree spherical harmonics functions in the direction cosines over local angular domain. Results also suggest that the performance of high-degree DFEM quadrature sets is comparable or better than that of traditional quadrature sets for transport problems with unsmooth or nearly discontinuous angular flux solutions. Locally-refined DFEM quadrature sets can obtain the same accuracy with less expense compared with uniform quadrature sets. DFEM quadrature sets with different degrees can offer two types of local refinement by increasing the quadrature order and changing the degree of discontinuous finite element basis functions, which can be further expected for use in an angular adaptive algorithm.

Different phosphoric triamide [HN]3-nP(O)[N]n (n = 1, 2) skeletons lead to identical non-covalent interactions assemblies: X-ray crystallography investigation, Hirshfeld surface analysis and molecular docking study against SARS-CoV-2

In this work, we describe the crystal structures of two new phosphoramides containing the same [(3-Cl)C6H4NH]P(O) = Y segment (Y[N(CH3)CH2C6H5]2 (1) and Y[NC4H8O]2 (2)) and an improved model of [C6H11(CH3)N]P(O)[NHC(CH3)3]2 (compound 3). The structures are experimentally investigated by single crystal X-ray diffraction using two types of refinements with spherical (S) and aspherical (AS) [Hirshfeld atomic refinements (HARs)] form factors, FT-IR and 1H, 13C, 31P NMR spectroscopy. A biological molecular docking investigation gives hints to suggest an appropriate inhibitory activity against MPro of SARS-COV-2 (6M03 and 6LU7) especially for 1 with a binding energy around −6 (6M03)/−7 (6LU7) kcal/mol. In the present work, the docking simulations are carried out for the first time for three series of ligand (L)-protein (P) complexes: L (with S form)-P (6M03), L (with AS form)-P (6M03) and L (AS)-P (6M03-N, with hydrogen atoms at their theoretical neutron values), where the binding energies are approximately proved to be 0.8 kcal/mol lower for simulations with 6M03-N than those for 6M03. Moreover, the structural study illustrates that the hydrogen bond patterns of all three structures consist of one-dimensional zigzag chains formed by classical NH…O hydrogen bond interactions. Further stabilization is provided by weak interactions such as CH…Cl (for 1 and 2), Cl…π (for 1 and 2) and CH…O (for 2 and 3). Furthermore, the intermolecular interactions are analyzed by three-dimensional (3D) Hirshfeld surfaces, 2D fingerprint plots and enrichment ratios. The favored contacts identified by Hirshfeld surface analysis are H…O/O…H interactions covering the NH…O hydrogen bonds for all three structures. For 1 and 2, Cl…C/C…Cl contacts covering Cl…π interactions are recognized as the most enriched contacts.