Explaining Hyperproperty Violations

Abstract

Hyperproperties relate multiple computation traces to each other. Model checkers for hyperproperties thus return, in case a system model violates the specification, a set of traces as a counterexample. Fixing the erroneous relations between traces in the system that led to the counterexample is a difficult manual effort that highly benefits from additional explanations. In this paper, we present an explanation method for counterexamples to hyperproperties described in the specification logic HyperLTL. We extend Halpern and Pearl’s definition of actual causality to sets of traces witnessing the violation of a HyperLTL formula, which allows us to identify the events that caused the violation. We report on the implementation of our method and show that it significantly improves on previous approaches for analyzing counterexamples returned by HyperLTL model checkers.

Counterfactuals Modulo Temporal Logics

“…When reasoning about causation, we are most often interested in some notion of minimality to characterize the minimal changes necessary to avoid a given effect [26,25,30,15,16]. From a counterfactual point of view, minimality formulates an additional condition on the antecedent ϕ such that the property defines the largest set possible.…”

“…Based on counterfactual conditionals, Lewis introduced a definition of causality in order to capture Hume's informal account that "we may define a cause to be an object followed by another, where, if the first object had not been, the second never had existed" [31]. Lewis only draws causal relationships between two events, which are rather informally defined objects, but which in previous literature on traces are commonly interpreted to mean the value of an atomic proposition at a certain position [5,35,15]. Lewis definition stipulates that an event c is the cause for an event e if the following condition holds: (c → e) ∧ (¬c → ¬e).…”

“…Since the foundational work by Lewis [38] on the formal semantics of counterfactual conditionals, many applications for counterfactuals [28,5,34,46,3,15] and some theoretical results on the decidability of the original theory [37] and related notions [20,2] have been discovered. Still, certain domains have proven elusive for a long time, for instance, theories involving higher-order reasoning and an infinite number of variables.…”

“…We argue that for both operators, the naive extensions to non-total similarity relations do not match the intended semantics of the counterfactual statements they are supposed to formalize, and propose fixed semantics for non-total similarity relations. Another common requirement for causes is a notion of minimality [26,25,30,16,15], such that negating the cause describes the minimal changes necessary to avoid the effect. This notion is not covered by Lewis' original theory.…”

“…While to our knowledge there has been no previous work extending Lewis' logic of counterfactuals to temporal reasoning, there are works that have proposed some notion of temporal causality in, e.g., Markov Decision Processes [47] and reactive systems [16]. Several previous works have made a connection between causality and hyperproperties [1,18,16,15].…”