Trace abstraction modulo probability

Abstract

We propose trace abstraction modulo probability, a proof technique for verifying high-probability accuracy guarantees of probabilistic programs. Our proofs overapproximate the set of program traces using failure automata, nite-state automata that upper bound the probability of failing to satisfy a target speci cation.We automate proof construction by reducing probabilistic reasoning to logical reasoning: we use program synthesis methods to select axioms for sampling instructions, and then apply Craig interpolation to prove that traces fail the target speci cation with only a small probability. Our method handles programs with unknown inputs, parameterized distributions, in nite state spaces, and parameterized speci cations. We evaluate our technique on a range of randomized algorithms drawn from the di erential privacy literature and beyond. To our knowledge, our approach is the rst to automatically establish accuracy properties of these algorithms.common weaknesses: they are mostly restricted to closed programs with xed inputs and nite state spaces, and support for properties with symbolic parameters remains limited.In this paper, we start from established automated veri cation techniques for non-probabilistic programs and extend them to the probabilistic se ing. Our logic-based approach yields several bene ts. By reasoning symbolically instead of numerically, we can (i) directly establish properties for all inputs rather than requiring xed inputs, (ii) handle programs that sample from distributions with unknown parameters, possibly over in nite ranges, and (iii) prove parametric accuracy properties, making it possible to automatically establish tradeo s between accuracy and failure probabilities, and capture the dependence on other input parameters.

Deciding accuracy of differential privacy schemes

“…In contrast, our language allows for arbitrary loops and we provide a decision procedure for accuracy. Trace Abstraction Modulo Probability (TAMP) in Smith et al [2019], is an automated proof technique for accuracy of probabilistic programs. TAMP generalizes the trace abstraction technique of Heizmann et al [2009] to the probabilistic setting.…”

“…In some cases, the definition of accuracy is similar to the one used in the context of randomized algorithm design [Motwani and Raghavan 1995], where we require that the output of the differentially private algorithm be close to the true output (say within distance γ ) with high probability (say at least 1 − β). Such a notion of accuracy is similar to computing error bounds, and there has been work on formally verifying such a definition of accuracy on some examples [Barthe et al 2016b;Smith et al 2019;Vesga et al 2019]. Unfortunately, prior work on formal verification of accuracy suffers from two shortcomings:…”

A Programming Language for Data Privacy with Accuracy Estimations

“…In order to make these estimates as precise as possible, DPella uses taint analysis to track the use of noise to identify which variables are statistically independent. This information is used by DPella to soundly replace, when needed, the union bound with the Cherno bound, something that to the best of our knowl-edge other program logics or program analyses also focusing on accuracy, such as [8] and [54], do not consider. We envision DPella's accuracy estimations to be used in scenarios which align with those considered by tools like GUPT, PSI, and Apex.…”

“…We leave exploring this direction for future works. More recently, Smith et al [54] propose an automated approach for computing accuracy bounds of probabilistic imperative programs. This work shares some similarities with our.…”

Synthesizing differentially private programs

“…Most proofs are constructed by hand, and as such are tailored to the algorithm of interest. While there exist program logics for reasoning about accuracy [Barthe et al 2016], automations of said logics (i) are so slow as to dwarf the cost of synthesis (see ğ6), and (ii) themselves reduce to synthesis [Smith et al 2019]. Considering accuracy in addition to privacy therefore poses a significant challenge to program synthesis, which necessitates our use of the weak notion of deterministic satisfaction (ğ3) to ensure programs have some utility to an end user.…”