Proving uniformity and independence by self-composition and coupling

TL;DR

This paper introduces a novel approach using the program logic pRHL and couplings to formally verify uniformity and independence properties in probabilistic programs, extending the application of coupling techniques.

Contribution

It demonstrates that probabilistic couplings can be effectively used for verifying non-relational properties like uniformity and independence in probabilistic programs.

Findings

Formal verification of uniformity using pRHL

Formal verification of independence using pRHL

Successful implementation in EasyCrypt proof assistant

Abstract

Proof by coupling is a classical proof technique for establishing probabilistic properties of two probabilistic processes, like stochastic dominance and rapid mixing of Markov chains. More recently, couplings have been investigated as a useful abstraction for formal reasoning about relational properties of probabilistic programs, in particular for modeling reduction-based cryptographic proofs and for verifying differential privacy. In this paper, we demonstrate that probabilistic couplings can be used for verifying non-relational probabilistic properties. Specifically, we show that the program logic pRHL---whose proofs are formal versions of proofs by coupling---can be used for formalizing uniformity and probabilistic independence. We formally verify our main examples using the EasyCrypt proof assistant.

Tables

sync’ed	anti-sync’ed

case (i)	case (ii)

Equations

$$\forall a_1,a_2\in A.{\mathsf{Pr}}_{[[s{]]}_m}\left[x=a_1\right]={\mathsf{Pr}}_{[[s{]]}_m}\left[x=a_2\right].$$

$$\forall a_1,a_2\in A.\models s\sim s\text{leavevmode}:\text{leavevmode}\varphi ⟹\text{leavevmode}x⟨1⟩=a_1⟺x⟨2⟩=a_2$$

$$\forall a\in A,b\in B.\models s\sim s_1;s_2\text{leavevmode}:\text{leavevmode}\varphi ⟹\text{leavevmode}(x⟨1⟩=a\wedge y⟨1⟩=b)⟺(x_1⟨2⟩=a\wedge y_2⟨2⟩=b)$$

$$s$$

$${\mathbb{E}}_{x\sim \mu }[M(x)]:x\mapsto \sum _a\mu (a)\cdot M(a)(x).$$

$$\begin{array}[]{c}\begin{aligned} \llbracket\mathbf{skip}\rrbracket_{m}&={{\delta}_{m}}&\llbracket\mathbf{abort}\rrbracket_{m}&={{\mathbb{0}}}\\ \llbracket x\stackrel{{\scriptstyle}}{{\raisebox{-0.43057pt}[0.86108pt]{$\leftarrow$}}}e\rrbracket_{m}&={{\delta}_{m[x:=\llbracket e\rrbracket_{m}]}}&\llbracket x\stackrel{{\scriptstyle\raisebox{-0.45206pt}[0.75346pt]{\tiny$\mathdollar$}}}{{\raisebox{-0.86108pt}[0.86108pt]{$\leftarrow$}}}g\rrbracket_{m}&=\mathbb{E}_{{v}\sim{\llbracket g\rrbracket{m}}}[{{{\delta}_{m[x:=v]}}}]\end{aligned}\\[15.00002pt] \begin{aligned} \llbracket s_{1};s_{2}\rrbracket_{m}&=\mathbb{E}_{{\xi}\sim{\llbracket s_{1}\rrbracket_{m}}}[{\llbracket s_{2}\rrbracket_{\xi}}]\\ \llbracket\mathbf{if}\>e\>\mathbf{then}\>s_{1}\>\mathbf{else}\>s_{2}\rrbracket_{m}&=\text{if $\llbracket e\rrbracket_{m}$ then $\llbracket s_{1}\rrbracket_{m}$ else $\llbracket s_{2}\rrbracket_{m}$}\\ \llbracket\mathbf{while}\>b\>\mathbf{do}\>s\rrbracket_{m}&=\lim_{n\to\infty}\ \llbracket{(\mathbf{if}\ {b}\ \mathbf{then}\ {s})}^{[n]};\mathbf{if}\ {b}\ \mathbf{then}\ {\mathbf{abort}}\rrbracket_{m}\end{aligned}\end{array}$$

$${\mathsf{Pr}}_{[[s^{⟨n⟩}{]]}_{m^{⟨n⟩}}}\left[{\wedge }_{1\le ı\le n}{E}_{ı}^{ı}\right]=\prod _{1\le ı\le n}{\mathsf{Pr}}_{[[s{]]}_m}\left[E_{ı}\right]$$

$$\frac{\text{vbox}\models s_1\sim s_2\text{leavevmode}:\text{leavevmode}Phys.\text{leavevmode}Rev.\text{leavevmode}\mathrm{E}⟹\text{leavevmode}\Psi {Phys.\text{leavevmode}Rev.\text{leavevmode}\mathrm{E}}^{\prime }⟹Phys.\text{leavevmode}Rev.\text{leavevmode}\mathrm{E}\Psi ⟹{\Psi }^{\prime }\text{vbox}{Phys.\text{leavevmode}Rev.\text{leavevmode}\mathrm{E}}^{\prime }⟹Phys.\text{leavevmode}Rev.\text{leavevmode}\mathrm{E}\Psi ⟹{\Psi }^{\prime }\text{vbox}}{\text{vbox}\text{vbox}\models s_1\sim s_2\text{leavevmode}:\text{leavevmode}{Phys.\text{leavevmode}Rev.\text{leavevmode}\mathrm{E}}^{\prime }⟹\text{leavevmode}{\Psi }^{\prime }}$$

$$\frac{\text{vbox}\text{leavevmode}\text{vbox}}{\text{vbox}\text{vbox}Phys.\text{leavevmode}Rev.\text{leavevmode}\mathrm{E}⊢\mathbf{while}e\mathbf{do}s\equiv \mathbf{while}e\wedge e^{\prime }\mathbf{do}s;\mathbf{while}e\mathbf{do}s}$$

$${\mathsf{Pr}}_{\mu }\left[\underset{1\le i\le n}{\bigwedge }{x}_i=a_i\right]=\prod _{1\le i\le n}\frac{1}{|A_i|}$$

$$\models s\sim s\text{leavevmode}:\text{leavevmode}\mathsf{EqMem}⟹\text{leavevmode}\left(\underset{1\le i\le n}{\bigwedge }{x}_i⟨1⟩=a_i\right)⟺\left(\underset{1\le i\le n}{\bigwedge }{x}_i⟨2⟩=a_i^{\prime }\right).$$

$$\{\begin{array}{rlr}f(m)& =m[x_i\leftarrow a_i^{\prime }{]}_{1\le i\le n}& \text{if ∀i.m[xi]=ai}\\ f(m)& =m[x_i\leftarrow a_i{]}_{1\le i\le n}& \text{if ∀i.m[xi]=ai′}\\ f(m)& =m& \text{otherwise.}\end{array}$$

$$\psi \stackrel{△}{=}\left({\bigwedge }_{1\le i\le n}{x}_i⟨1⟩=a_i\right)⟺\left({\bigwedge }_{1\le i\le n}{x}_i⟨2⟩=a_i^{\prime }\right).$$

$${\pi }_1(\eta )(m_1)$$

$${\pi }_2(\eta )(m_2)$$

$$=[[s{]]}_m(f(m_2))=[[s{]]}_m(m_2),$$

$${\mathsf{Pr}}_{[[s{]]}_m}\left[{\bigwedge }_{1\le i\le n}{x}_i=a_i\right]={\mathsf{Pr}}_{[[s{]]}_m}\left[{\bigwedge }_{1\le i\le n}{x}_i=a_i^{\prime }\right],$$

$$\boxed{\begin{array}[]{l}x\leftarrow 0;\\ y\leftarrow 0;\\ \mathbf{while}\>x=y\>\mathbf{do}\\ \quad x\stackrel{{\scriptstyle\raisebox{-0.45206pt}[0.75346pt]{\tiny$\mathdollar$}}}{{\raisebox{-0.86108pt}[0.86108pt]{$\leftarrow$}}}{\mathbf{Bern}(p)};\\ \quad y\stackrel{{\scriptstyle\raisebox{-0.45206pt}[0.75346pt]{\tiny$\mathdollar$}}}{{\raisebox{-0.86108pt}[0.86108pt]{$\leftarrow$}}}{\mathbf{Bern}(p)};\\ \end{array}}$$

$$\models s\sim s\text{leavevmode}:\text{leavevmode}\top ⟹\text{leavevmode}x⟨1⟩⟺\neg x⟨2⟩$$

$$x⟨2⟩=\text{if }x⟨1⟩=y⟨1⟩\text{ then }y⟨2⟩\text{ else }\neg x⟨1⟩$$

$$\vDash{(x\stackrel{{\scriptstyle\raisebox{-0.45206pt}[0.75346pt]{\tiny$\mathdollar$}}}{{\raisebox{-0.86108pt}[0.86108pt]{$\leftarrow$}}}\mathbf{Bern}(p);\quad y\stackrel{{\scriptstyle\raisebox{-0.45206pt}[0.75346pt]{\tiny$\mathdollar$}}}{{\raisebox{-0.86108pt}[0.86108pt]{$\leftarrow$}}}\mathbf{Bern}(p))}\sim{(y\stackrel{{\scriptstyle\raisebox{-0.45206pt}[0.75346pt]{\tiny$\mathdollar$}}}{{\raisebox{-0.86108pt}[0.86108pt]{$\leftarrow$}}}\mathbf{Bern}(p);\quad x\stackrel{{\scriptstyle\raisebox{-0.45206pt}[0.75346pt]{\tiny$\mathdollar$}}}{{\raisebox{-0.86108pt}[0.86108pt]{$\leftarrow$}}}\mathbf{Bern}(p))}\leavevmode\nobreak\ :\leavevmode\nobreak\ {\phi^{\prime}}\Longrightarrow\leavevmode\nobreak\ {\phi}$$

$$\forall v_1,v_2,v_2=(\text{if v1=v2 then v1 else ¬v1})$$

$$\forall a,b\in \mathbb{Z}/n\mathbb{Z},\models s\sim s\text{leavevmode}:\text{leavevmode}\top ⟹\text{leavevmode}ret⟨1⟩=(a,a+1)⟺ret⟨2⟩=(b,b+1).$$

$$\begin{array}[]{l}\mathbf{while}\>(|v|<n\land a,a+1\notin[f,l])\>\mathbf{do}\>s^{\prime};\\ \mathbf{while}\>(|v|<n\land\neg(a,a+1\in[f,l]))\>\mathbf{do}\>s^{\prime};\\ \mathbf{while}\>(|v|<n)\>\mathbf{do}\>s^{\prime}\end{array}$$

$$\Phi \wedge P(a)⟨1⟩\wedge P(b)⟨2⟩$$

$$(a,a+1\in [f,l])⟨1⟩\wedge (b,b+1\in [f,l])⟨2⟩\wedge (l⟨1⟩=a⟺l⟨2⟩=b)$$

$$\bigwedge \left\{\begin{array}{c}\Phi \wedge (a\in [f,l])⟨1⟩\wedge (b\in [f,l])⟨2⟩\\ c⟨1⟩-a=c⟨2⟩-b\\ l⟨1⟩=a⟺l⟨2⟩=b\end{array}\right\}$$

$$\forall n_A,n_B.n_A>n_B⟹{\mathsf{Pr}}_{[[s{]]}_m}\left[\underset{1\le i\le n}{\bigwedge }{l}_i\ne 0\text{leavevmode}|\text{leavevmode}{x}_A=n_A\wedge x_B=n_B\right]=\frac{n_A-n_B}{n_A+n_B}.$$

$$\boxed{\begin{array}[]{l}r\leftarrow 0;x_{A}\leftarrow 0;x_{B}\leftarrow 0;l\leftarrow\epsilon;\\ \mathbf{while}\>|l|\leq n\>\mathbf{do}\\ \quad r\stackrel{{\scriptstyle\raisebox{-0.45206pt}[0.75346pt]{\tiny$\mathdollar$}}}{{\raisebox{-0.86108pt}[0.86108pt]{$\leftarrow$}}}\{A,B\};\\ \quad\mathbf{if}\ {r=A}\ \mathbf{then}\ {};\\ \quad\quad x_{A}\leftarrow x_{A}+1;\\ \quad\mathbf{else}\\ \quad\quad{x_{B}\leftarrow x_{B}+1};\\ \quad l\leftarrow l::(x_{A}-x_{B})\end{array}}$$

$$\xi \stackrel{△}{=}(l_1\cdot l_n>0\wedge \varphi \wedge \psi )⟨1⟩⟺(l_1\cdot l_n<0\wedge \varphi \wedge \psi )⟨2⟩.$$

$${\mathsf{Pr}}_{[[s{]]}_m}\left[\varphi \mid \psi \right]$$

Full text

0.1 Introduction

Uniformity and probabilistic independence are two of the most useful and commonly encountered properties when analyzing randomized computations. Uniform distributions are a central building block of randomized algorithms. Arguably the simplest non-trivial distribution—the coin flip—is a uniform distribution over two values. Given access to uniform samples, there are known transformations for converting the samples to simulate more complex distributions, like Gaussian or Laplacian distributions. Conversely, turning samples from various non-uniform distributions into uniform samples is an active area of research.

Probabilistic independence is no less useful. The probability of a conjunction of independent events can be decomposed as a product of probabilities of individual events, each which can then be analyzed in isolation. Independent random variables are also needed to apply more sophisticated mathematical tools, like concentration inequalities.

Given these and other applications, it is not surprising that researchers have investigated different methods of reasoning about uniformity and independence. For instance, Pearl and Paz [18] develop an axiomatic theory based on graphoids for modeling conditional independence in probability theory. However, proving uniformity and independence by program verification remains a challenging task. Most verification techniques for probabilistic programs do not treat these properties as first-class assertions, and rely on reasoning principles that are cumbersome to use. Often, the only way to prove uniformity or independence is to prove exact values for the probability of specific events.

For example, consider a formal system for proving properties of the form $\mathsf{Pr}_{\llbracket s\rrbracket_{m}}\left[E\right]=p$, which capture the fact that the event $E$ has probability $p$ in the distribution obtained by executing the randomized program $s$ on some initial memory $m$ (many existing systems use this idea, e.g. [15, 17, 19, 13, 20, 9]). Suppose that we want to prove that a program variable $x$ of some finite type $A$ is uniformly distributed in the output distribution $\llbracket s\rrbracket_{m}$. The only way to show this property is to analyze the probability of each output: for every $a\in A$, prove that $\mathsf{Pr}_{\llbracket s\rrbracket_{m}}\left[x=a\right]=\frac{1}{|A|}$.

For independence, the situation is similar. Assume that we want to prove that the two program variables $x$ and $y$ of respective types $A$ and $B$ are (probabilistically) independent in the output distribution $\llbracket s\rrbracket_{m}$. This can be done by exhibiting functions $f,g,h$ such that for every $a\in A$ and $b\in B$, we have: $\mathsf{Pr}_{\llbracket s\rrbracket_{m}}\left[x=a\right]=f(a)$, $\mathsf{Pr}_{\llbracket s\rrbracket_{m}}\left[y=b\right]=g(b)$, $\mathsf{Pr}_{\llbracket s\rrbracket_{m}}\left[x=a\land y=b\right]=h(a,b)$. Then, independence between $x$ and $y$ holds by proving that $h(a,b)=f(a)\cdot g(b)$ for every $a\in A$ and $b\in B$.

While these approaches work in theory, they can be laborious in practice. It may be awkward to express the probability of $x=a$, and the functions $f$, $g$ and $h$ may be difficult to produce. The main contribution of this paper is an alternative method based on probabilistic couplings for proving uniformity and independence. Probabilistic couplings are a classical method for proving sophisticated probabilistic properties (e.g., stochastic dominance, rapid mixing of Markov chains, and more [21, 16, 22]). More recently, couplings have been used to reason about relational properties of probabilistic programs, notably differential privacy [5, 6]. Here we show that uniformity and independence properties can also be verified using coupling, despite being non-relational properties. As a consequence, our verification method inherits the many advantages of reasoning by couplings: compositional reasoning, and no need to reason directly about probabilistic events. Concretely, we show how uniformity and independence can be captured in the relational program logic pRHL [1].

In summary, our main contributions are novel methods to prove uniformity and independence properties of probabilistic programs. We prove the soundness of the methods and demonstrate their usefulness on a class of case studies.

Detailed Contributions

Uniformity.

Suppose we have a program $s$ with a program variable $x$ ranging over a finite set $A$, and we want to show that $x$ is distributed uniformly over $A$ after executing $s$. Rather than computing the probability of $\mathsf{Pr}_{\llbracket s\rrbracket_{m}}\left[x=a\right]$ for each $a\in A$, it suffices to show that the probabilities of any two outputs are equal:

[TABLE]

Now, we can view uniformity as a relational property: if we consider two runs of $s$, then the probability of $x$ being $a_{1}$ in the first run should be equal to the probability of $x$ being $a_{2}$ in the second run. In pRHL, this property is described by the following judgment:

[TABLE]

where the assertion $\phi$ asserts that the initial states are equal.

Independence.

Proving probabilistic independence is more involved. We show how to prove independence in two different ways. Assume that we want to prove that the program variables $x$ and $y$ of respective finite types $A$ and $B$ are independent. First, if the distribution of $\langle x,y\rangle$ is uniformly distributed over $A\times B$, then $x$ and $y$ are independent (and are themselves uniformly distributed). Indeed, assume that for all $a\in A$ and $b\in B$ we have $\mathsf{Pr}_{\llbracket s\rrbracket_{m}}\left[x=a\land y=b\right]=\frac{1}{|A|\cdot|B|}$. Then we have $\mathsf{Pr}_{\llbracket s\rrbracket_{m}}\left[x=a\right]=\sum_{b\in B}\mathsf{Pr}_{\llbracket s\rrbracket_{m}}\left[x=a\land y=b\right]=\frac{1}{|A|}$. A similar argument applies to the probability that $y=b$, from which independence follows. Thus, our first method of proving independence is by reduction to proving uniformity.

This approach is simple to use, but it only applies to proving independence of uniform random variables. A more expressive, but also slightly more complicated approach is to express probabilistic independence as a property of a modified version of the program, without any requirement on uniformity. More specifically, independence of $x$ and $y$ can be derived from the equality between the probabilities of $x=a\land y=b$ and $x_{1}=a\land y_{2}=b$, where in the first case the probability is taken over the output of the original program $s$, and in the second case the probability is taken over the output of the program $s_{1};s_{2}$, where $s_{1}$ and $s_{2}$ are renamings of $s$ (we call $s_{1};s_{2}$ a self-composition of $s$ [2, 12]). The reason is not hard to see. Since the composed programs operate on disjoint memory, the final combined output distribution models two independent runs of the original program $s$. So, the probability $\mathsf{Pr}_{\llbracket s_{1};s_{2}\rrbracket_{m_{1}\uplus m_{2}}}\left[x_{1}=a\land y_{2}=b\right]$—where $m_{1}\uplus m_{2}$ is the disjoint union of two copies of $m$—is equal to the product of $\mathsf{Pr}_{\llbracket s_{1}\rrbracket_{m_{1}}}\left[x_{1}=a\right]$ and $\mathsf{Pr}_{\llbracket s_{2}\rrbracket_{m_{2}}}\left[y_{2}=b\right]$. Since $s_{1}$ and $s_{2}$ are just renamed versions of the original program $s$, these probabilities are in turn equal to $\mathsf{Pr}_{\llbracket s\rrbracket_{m}}\left[x=a\right]$ and $\mathsf{Pr}_{\llbracket s\rrbracket_{m}}\left[y=b\right]$ in the original program.

Our encoding casts independence as a relational property between a program $s$ and its self-composition $s_{1};s_{2}$, a property which can be directly expressed in pRHL:

[TABLE]

where the precondition $\phi$ captures the initial conditions. We show that our approach extends to independence and conditional independence of sets of program variables.

Outline

Section 0.2 and Section 0.3 provide the relevant mathematical background and introduce the setting of our work. Section 0.4, Section 0.5 and Section 0.6 respectively address the case of uniformity, independence, and conditional independence. In each case we demonstrate our method using classic examples of randomized algorithms. We conclude the paper with a discussion of alternative techniques for verifying these properties.

0.2 Mathematical Background

For the sake of simplicity, we restrict ourselves to discrete (countable) sub-distributions.

Definition 1**.**

A sub-distribution over a set $A$ is defined by a mass function $\mu:A\to\mathbb{R}^{+}$, which gives the probability of the unitary events $a\in A$. This mass function must be s.t. $\sum_{a\in A}\mu(a)$ is well-defined and its weight satisfies $|\mu|\mathrel{\stackrel{{\scriptstyle\scriptscriptstyle\triangle}}{{=}}}\sum_{a\in A}\mu(a)\leq 1$. In particular, the support of the sub-distribution $\mathsf{supp}(\mu)\mathrel{\stackrel{{\scriptstyle\scriptscriptstyle\triangle}}{{=}}}\{a\in A\mid\mu(a)\neq 0\}$ is discrete. When $|\mu|$ is equal to $1$, we call $\mu$ a distribution. We let $\mathbb{D}(A)$ denote the set of sub-distributions over $A$. An event over $A$ is a predicate over $A$. The probability of an event $E$ in a sub-distribution $\mu$, written $\mathsf{Pr}_{x\sim\mu}\left[E\right]$, is defined as $\sum_{\{x\in A\mid E(x)\}}\mu(x)$.

When working with sub-distributions over tuples, the probabilistic versions of the usual projections on tuples are called marginals. For distributions over pairs, we define the first and second marginals $\pi_{1}(\mu)$ and $\pi_{2}(\mu)$ of a distribution $\mu$ over $A\times B$ by $\pi_{1}(\mu)(a)\mathrel{\stackrel{{\scriptstyle\scriptscriptstyle\triangle}}{{=}}}\sum_{b\in B}\mu(a,b)$ and $\pi_{2}(\mu)(b)\mathrel{\stackrel{{\scriptstyle\scriptscriptstyle\triangle}}{{=}}}\sum_{a\in A}\mu(a,b)$. We are now ready to formally define coupling.

Definition 2**.**

Let $A_{1}$ and $A_{2}$ be two sets, and let $\Psi\subseteq A_{1}\times A_{2}$. A $\Psi$-coupling for two sub-distributions $\mu_{1},\mu_{2}$ resp. over $A_{1}$ and $A_{2}$ is a sub-distribution $\mu\in\mathbb{D}(A_{1}\times A_{2})$ such that $\pi_{1}(\mu)=\mu_{1}$ and $\pi_{2}(\mu)=\mu_{2}$ and $\mathsf{supp}(\mu)\subseteq\Psi$. We write ${}\blacktriangleleft_{\Psi}\langle{\mu_{1}}\mathrel{\&}{\mu_{2}}\rangle$ to denote the existence of a $\Psi$-coupling.

In addition to the general definition, we shall also consider a special case of coupling: specifically, we say that $(\mu_{1},\mu_{2})$ are $f$-coupled if $f:A_{1}\rightarrow A_{2}$ is a bijection such that $\mu_{1}(x)=\mu_{2}(f(x))$ for every $x\in A_{1}$. In this case, we write ${f}\blacktriangleleft\langle{\mu_{1}}\mathrel{\&}{\mu_{2}}\rangle$.

Previous works establish a number of basic facts about couplings, see e.g. Barthe et al. [1, 5], In particular, one useful consequence of couplings is that they can show that one event has smaller probability than another.

Lemma 3** (Fundamental lemma of coupling).**

Let $E_{1}$ and $E_{2}$ be predicates over $A_{1}$ and $A_{2}$, and let $\Psi\mathrel{\stackrel{{\scriptstyle\scriptscriptstyle\triangle}}{{=}}}\{(x_{1},x_{2})\mid(x_{1}\in E_{1})\Rightarrow(x_{2}\in E_{2})\}$. If ${}\blacktriangleleft_{\Psi}\langle{\mu_{1}}\mathrel{\&}{\mu_{2}}\rangle$, then $\mathsf{Pr}_{x_{1}\sim\mu_{1}}\left[E_{1}\right]\leq\mathsf{Pr}_{x_{2}\sim\mu_{2}}\left[E_{2}\right]$.

One can immediately derive a variant of the lemma where $\iff$ and $=$ are used in place of $\Rightarrow$ and $\leq$ respectively. The following lemma provides a converse to the fundamental lemma of coupling in the special case where we are interested in proving the equality of two distributions.

Lemma 4**.**

For every $\mu_{1},\mu_{2}\in\mathbb{D}(A)$, the following are equivalent:

• •

$\mu_{1}=\mu_{2}$;

• •

for every $a\in A$, $\mathsf{Pr}_{x\sim\mu_{1}}\left[x=a\right]=\mathsf{Pr}_{x\sim\mu_{2}}\left[x=a\right]$;

• •

for every $a\in A$, ${}\blacktriangleleft_{\Psi_{a}}\langle{\mu_{1}}\mathrel{\&}{\mu_{2}}\rangle$ where $\Psi_{a}\mathrel{\stackrel{{\scriptstyle\scriptscriptstyle\triangle}}{{=}}}\{(x_{1},x_{2})\mid x_{1}=a\iff x_{2}=a\}$;

• •

${}\blacktriangleleft_{\Psi_{A}}\langle{\mu_{1}}\mathrel{\&}{\mu_{2}}\rangle$* where $\Psi_{A}\mathrel{\stackrel{{\scriptstyle\scriptscriptstyle\triangle}}{{=}}}\{(x_{1},x_{2})\mid x_{1}=x_{2}\}$.*

We note that the third item (existence of liftings for pointwise equality) is often easier to establish than the last item (existence of lifting for equality), since one can choose the coupling for each possible value of $a$, rather than showing a single coupling for all values of $a$.

0.3 Setting

We will work with a simple probabilistic imperative language. Probabilistic assignments are of the form x\stackrel{{\scriptstyle\raisebox{-0.45206pt}[0.75346pt]{\tiny\mathdollar}}}{{\raisebox{-0.86108pt}[0.86108pt]{\leftarrow}}}g, which assigns a value sampled according to the distribution $g$ to the program variable $x$. The syntax of statements is defined by the grammar:

[TABLE]

where $x$, $e$ and $g$ respectively range over (typed) variables in $\mathcal{X}$, expressions in $\mathcal{E}$ and distributions in $\mathcal{D}$. To ensure that the set of states is countable, we require that there are finitely many variables $\mathcal{X}$. As usual $\mathcal{E}$ is defined inductively from $\mathcal{X}$ and a set $\mathcal{F}$ of simply typed function symbols. In this paper, distributions used for sampling are either uniform distributions over a finite type $A$, or the Bernoulli distribution with parameter $p$, which we denote by $\mathbf{Bern}(p)$. We assume that expressions and statements are typed in the usual way.

We assume we are given a set-theoretical interpretation for every type and operator of the language. We define a state as a type-preserving mapping from variables to values, and we let $\mathbf{State}$ denote the set of states. The set of states is equipped with the usual functions for reading and writing a value; we use $m(x)$ to denote the value of $x$ in $m$, and $m[x:=v]$ to denote state update, in this case the state obtained from $m$ by updating the value of $x$ with $v$.

One can equip $\mathbb{D}(\mathbf{State})$ with a monadic structure, using the Dirac distributions ${{\delta}_{x}}$ for the unit and distribution expectation $\mathbb{E}_{{x}\sim{\mu}}[{M(x)}]$ for the bind, where

[TABLE]

The semantics of expressions and distribution expressions is parametrized by a state $m$, and is defined in the usual way where we require all distribution expressions to be interpreted as proper distributions (sub-distributions with weight $1$).

Definition 5** (Semantics of statements).**

• •

The semantics $\llbracket s\rrbracket_{m}$ of a statement $s$ w.r.t. to some initial state $m$ is a sub-distribution over states, and is defined by the clauses of Fig. 1.

• •

The (lifted) semantics $\llbracket s\rrbracket_{\mu}$ of a statement $s$ w.r.t. to some initial sub-distribution $\mu$ over states is a sub-distribution over states, and is defined as $\llbracket s\rrbracket_{\mu}\triangleq\mathbb{E}_{{m}\sim{\mu}}[{\llbracket s\rrbracket_{m}}]$ $\mu\in\mathbb{D}(\mathbf{State})$.

A basic and highly important property of probabilistic programs is termination. We say that a program $s$ is lossless if for every initial memory $m$, $|\llbracket s\rrbracket_{m}|=1$. By now, there are many sophisticated techniques for proving losslessness even for languages that allow both probabilistic sampling and non-determinism (including recent advances by Ferrer Fioriti and Hermanns [14], Chatterjee et al. [10, 11]). These techniques are capable of showing losslessness for all of our examples (in some cases with a high degree of automation), so throughout the paper, we assume that all programs are lossless. This assumption is used in the rules of pRHL and the characterizations of uniformity and independence.

0.3.1 Self-Composition of Programs

For every program $s$ and $n\in\mathbb{N}$, we let ${s^{\langle n\rangle}}$ denote the $n$-fold self-composition of $s$, i.e.  ${s^{\langle n\rangle}}\mathrel{\stackrel{{\scriptstyle\scriptscriptstyle\triangle}}{{=}}}s_{1};\ldots,s_{n}$, where each $s_{\imath}$ is a copy of $s$ where all variables are tagged with a superscript $\imath$. In order to state the main property of self-composition, we define the self-composition of a state; given a state $m$, we define its $n$-fold self-composition ${m^{\langle n\rangle}}$ as the state from ${\mathcal{X}^{\langle n\rangle}}$ to values, where ${\mathcal{X}^{\langle n\rangle}}\mathrel{\stackrel{{\scriptstyle\scriptscriptstyle\triangle}}{{=}}}\{x^{\imath}\mid x\in\mathcal{X},1\leq\imath\leq n\}$ such that for every $x$ and $\imath$, ${m^{\langle n\rangle}}(x^{\imath})\mathrel{\stackrel{{\scriptstyle\scriptscriptstyle\triangle}}{{=}}}m(x)$. Given a state $m$ from ${\mathcal{X}^{\langle n\rangle}}$, we denote by $m_{\imath}$ the $\imath$-th projection of $m$.

Proposition 6**.**

For every program $s$ and state $m$, we have

[TABLE]

where the event $E^{\imath}$ is defined by $E^{\imath}({m^{\prime\langle n\rangle}})\mathrel{\stackrel{{\scriptstyle\scriptscriptstyle\triangle}}{{=}}}E(\pi_{\imath}(m^{\prime}))$ for every $\imath$ and $\pi_{\imath}$ is the projection from a self-composed state to its $\imath$-th component.

0.3.2 Probabilistic Relational Hoare Logic

Probabilistic Relational Hoare Logic (pRHL) is a program logic for reasoning about relational properties of probabilistic programs. Its judgments are of the form $\vDash{s_{1}}\sim{s_{2}}\leavevmode\nobreak\ :\leavevmode\nobreak\ {\phi}\Longrightarrow\leavevmode\nobreak\ {\psi}$, where $s_{1}$ and $s_{2}$ are commands and the pre-condition $\phi$ and the post-condition $\psi$ are relational assertions, i.e.  first-order formulae built over generalized expressions. The latter are similar to expressions, except that each variable is tagged with $\langle 1\rangle$ or $\langle 2\rangle$ to indicate the execution that it belongs to; we call the two executions left and right. Generalized expressions are interpreted w.r.t. a pair $(m_{1},m_{2})$ of states, where the interpretation of the tagged variables $x\langle 1\rangle$ and $x\langle 2\rangle$ are $m_{1}(x)$ and $m_{2}(x)$ respectively. We write $(m_{1},m_{2})\vDash\phi$ to denote that the interpretation of the assertion $\phi$ w.r.t. $(m_{1},m_{2})$ is valid.

Definition 7**.**

A judgment $\vDash{s_{1}}\sim{s_{2}}\leavevmode\nobreak\ :\leavevmode\nobreak\ {\phi}\Longrightarrow\leavevmode\nobreak\ {\psi}$ is valid iff for every states $m_{1}$ and $m_{2}$, $(m_{1},m_{2})\vDash\phi$ implies ${}\blacktriangleleft_{\{(m^{\prime}_{1},m^{\prime}_{2})\mid(m^{\prime}_{1},m^{\prime}_{2})\vDash\psi\}}\langle{\llbracket s_{1}\rrbracket_{m_{1}}}\mathrel{\&}{\llbracket s_{2}\rrbracket_{m_{2}}}\rangle$.

Fig. 2 presents the main rules of the logic; see Barthe et al. [1, 7] for the full system. The logic includes two-sided rules, which operate on both programs, and one-sided rules, which operate on a single program (left or right).

The [Conseq] rule is the rule of consequence, and reflects that validity is preserved by weakening the post-condition and strengthening the pre-condition. The [Case] rule allows proving a judgment by case analysis; specifically, the validity of a judgment with pre-condition ${\rm Phys.\leavevmode\nobreak\ Rev.\leavevmode\nobreak\ E}$ can be established from the validity of two judgments, one where the pre-condition is strengthened with $\Xi$ and the other where the pre-condition is strengthened with $\neg\Xi$.

The [Struct] rule allows replacing programs by provably equivalent programs. The rules for proving program equivalence are given in Fig. 3, and manipulate judgments of the form ${\rm Phys.\leavevmode\nobreak\ Rev.\leavevmode\nobreak\ E}\vdash c\equiv c^{\prime}$, where ${\rm Phys.\leavevmode\nobreak\ Rev.\leavevmode\nobreak\ E}$ is a relational assertion. The first rule ([While-Split]) splits a single loop into two loops (the first running while $e^{\prime}$ is true, and the second running for the remaining iterations); this transformation is useful for selecting different couplings in different program iterations. The second rule ([Swap]) reorders two instructions, as long as they modify disjoint variables. This allows us to couple sampling instructions that may come from two different parts of the two programs.

Moving on to the two-sided rules, the [Seq] rule for sequential composition simply reflects the compositional property of couplings. The [Assg] rule is standard. The [Rand] rule informally takes a coupling between the two distributions used for sampling in the left and right programs, and requires that every element in the support of the coupling validates the post-condition. The rule is parametrized by a bijective function $f$ from the domain of the first distribution to the domain of the second distribution. This bijection gives us the freedom to specify the relation between the two samples when we couple them. The [Cond] rule states that two synchronized $\mathbf{if}$ statements can related if their respective branches are also related. The [While] rule is the standard while rule adapted to pRHL. Note that we require the guard of the two commands to be equal—so in particular the two loops must make the same number of iterations—and ${\rm Phys.\leavevmode\nobreak\ Rev.\leavevmode\nobreak\ E}$ plays the role of the while loop invariant as usual.

The one-sided rules Assg-L, Rand-L, Cond-L and While-L are similar two their two-sided variant, but only operate on the left program. The full system includes mirrored versions of each one-sided rule, for reasoning about the right program.

Throughout the paper, we often assert that the left and the right copies of a state are equal. This is captured by the relational assertion $\mathsf{EqMem}\mathrel{\stackrel{{\scriptstyle\scriptscriptstyle\triangle}}{{=}}}\bigwedge_{x\in\mathcal{X}}x\langle 1\rangle=x\langle 2\rangle$. We also often assert cross-equality on $n$-fold composition of states $\mathsf{EqMem}^{\langle{p}\rangle,\langle{q}\rangle}\mathrel{\stackrel{{\scriptstyle\scriptscriptstyle\triangle}}{{=}}}\bigwedge_{x\in\mathcal{X},1\leq\imath\leq p,1\leq\jmath\leq q}x^{\imath}\langle 1\rangle=x^{\jmath}\langle 2\rangle$.

0.4 Uniformity

Reasoning about probabilistic programs often requires establishing that a set of program variables (each ranging over a finite type) is uniformly distributed:

Definition 8**.**

A set $X=\{x_{1},\ldots,x_{n}\}$ of program variables of finite types $A_{1},\ldots,A_{n}$ is uniformly distributed in a distribution $\mu\in\mathbb{D}(\mathbf{State})$ iff for every $(a_{1},\ldots,a_{n})\in A_{1}\times\ldots\times A_{n}$:

[TABLE]

Note that the definition of uniformity (and as we will see in later sections, the definition of independence) naturally extends to sets of expressions, and so do our characterizations.

0.4.1 Characterization

The following proposition characterizes uniformity in terms of couplings.

Proposition 9** (Uniformity by coupling).**

Let $X=\{x_{1},\ldots,x_{n}\}$ be a set of variables of respective finite types $A_{1},\ldots,A_{n}$. For every program $s$, the following are equivalent:

for every state $m$, $X$ is uniformly distributed in $\llbracket s\rrbracket_{m}$; 2. 2.

for every two tuples $(a_{1},\ldots,a_{n}),(a^{\prime}_{1},\ldots,a^{\prime}_{n})\in A_{1}\times\cdots\times A_{n}$, we have

[TABLE]

Proof.

[$1.\Rightarrow 2.$]

Let $m$ be a memory and assume that $X$ is uniformly distributed in $\llbracket s\rrbracket_{m}$. Let $(a_{1},\ldots,a_{n}),(a^{\prime}_{1},\ldots,a^{\prime}_{n})\in A_{1}\times\cdots\times A_{n}$. We denote by $f:\mathbf{State}\to\mathbf{State}$ the bijection defined by

[TABLE]

Let $\eta\in\mathbb{D}(\mathbf{State}\times\mathbf{State})$ be the distribution defined by $\eta(m_{1},m_{2})=\llbracket s\rrbracket_{m}(m_{1})$ if $m_{2}=f(m_{1})$, and $\eta(m_{1},m_{2})=0$ otherwise. We prove that $\eta$ is a $\Psi$-coupling for $\llbracket s\rrbracket_{m}$, where

[TABLE]

Regarding the marginals, we have:

[TABLE]

the last equality being a consequence of $X$ being uniformly distributed in $\llbracket s\rrbracket_{m}$. Moreover, for $(m_{1},m_{2})\in\mathsf{supp}(\eta)$, we have $m_{2}=f(m_{1})$. Thus, $m_{1}[x_{i}]=a_{i}$ iff $m_{2}[x_{i}]=a^{\prime}_{i}$, and $m_{1},m_{2}\models\Psi$.

[$2.\Rightarrow 1.$]

Let $(a_{1},\ldots,a_{n}),(a^{\prime}_{1},\ldots,a^{\prime}_{n})\in A_{1}\times\cdots\times A_{n}$ and assume that $\vDash{s}\sim{s}\leavevmode\nobreak\ :\leavevmode\nobreak\ {\mathsf{EqMem}}\Longrightarrow\leavevmode\nobreak\ {\Psi}$, where $\Psi$ is defined as in the previous case. Since $m,m\models\mathsf{EqMem}$, by Lemma 3 we have:

[TABLE]

showing that $X$ is uniform in $\llbracket s\rrbracket_{m}$. ∎

By expressing uniformity as a coupling property, we can use pRHL to prove uniformity. To demonstrate the technique, we consider classical examples from the theory of randomized algorithms.

0.4.2 Simulating a Fair Coin

This example considers a process for simulating a fair coin using a biased coin. The idea is simple: 1) toss the coin twice; 2) if the two outcomes differ, return the value of the first coin; 3) if the two outcomes match, repeat from step 1. The algorithm does not require the bias of the coin to be known, as long as it is some constant bias and there is positive probability of returning [math] and $1$. This process can be modelled by the program $s$ from Fig. 4, where $0<p<1$ is a real parameter modeling the probability of the biased coin to return 0 (tail). Our goal is to establish the trivial judgment $\{\mathop{\top}\}\;s\;\{\mathop{\top}\}$ and the following pRHL judgment:

[TABLE]

By the fundamental lemma of coupling, this implies that $\mathsf{Pr}_{\llbracket s\rrbracket_{m}}\left[x=1\right]=\mathsf{Pr}_{\llbracket s\rrbracket_{m}}\left[x=0\right]$, and hence that $x$ is uniformly distributed upon termination. The proof proceeds by establishing the following invariant:

[TABLE]

Validity of the invariant entails that the desired postcondition holds when the program exits, as the invariant and the negation of the loop guard both hold. The invariant holds when entering the loop, so we only need to prove that it is preserved by the loop body. The proof proceeds as follows: first, we swap the two random assignments on the right, leading to the judgment:

[TABLE]

where $\phi$ denotes the loop invariant and $\phi^{\prime}$ denotes its strengthening by the loop guard—we do not need the precondition, since the values are freshly sampled in the body. Next, we apply the [Rand] rule twice, with the identity bijection. The required pre-condition

[TABLE]

is clearly true.

0.4.3 Cyclic Random Walk

Consider a random walk over a cyclic path composed of $n$ nodes labeled $0,1,\ldots,n-1$: starting from position [math], at each step, we flip a fair coin over $\{-1,1\}$ and update the position accordingly to the result of the coin flip. To take into account that we are on a cyclic structure, all arithmetical operations are in the cyclic ring \mathbb{Z}/\raisebox{-2.15277pt}{{n}\mathbb{Z}}—i.e. are performed modulo $n$. At each iteration, when moving between two contiguous positions over the circle, we consider that the random walk visited the arc between the two nodes. We want to show that the last visited arc is uniformly distributed. Fig. 5 (left) gives a graphical representation of the random walk, where $c$ is the random walk position and the dashed arc is the last visited arc when c moved from [math] to $1$.

This process can be seen as a simple version of an algorithm that samples a uniformly random spanning tree on a graph—when the graph is a cycle, a spanning tree visits all but one of the edges. While Broder [8] analyzes the general problem, we can verify uniformity for the cyclic random walk with couplings.

The proof proceeds as follows. We imagine executing two random walks, from the same initial position. The goal is to couple the walks so that $(a,a+1)$ is the last arc in the first walk if and only if $(b,b+1)$ is the last arc in the second walk. If we can show this property for all $a,b$, then this coupling argument shows that any two arcs have the same probability of being the last arc, hence the last arc must be uniformly distributed.

To describe the coupling informally, we first execute asynchronously the two random walks until they eventually synchronize respectively on the arcs $(a,a+1)$ and $(b,b+1)$. At that point, we are in one of the following cases: either the random walks synchronize on the same side of the arcs $(a,a+1)$ and $(b,b+1)$, or they synchronize on opposite sides. (These cases are depicted on the left diagrams above, where the arc we want to synchronize on is dashed.) From that point, we execute the two processes resp. in lock-step (if they synchronized on the same side) or anti-lock-step (if they did not).

At some point, both processes will visit the other side of the arcs $(a,a+1)$ and $(b,b+1)$, and since they execute in (anti)-lock-step, these events will occur synchronously. At that point, either the processes finished their walk and they resp. return the arcs $(a,a+1)$ and $(b,b+1)$ as their result (case (i) of the right diagram above), or they have other nodes to visit and so they will not resp. return the arcs $(a,a+1)$ and $(b,b+1)$ (case (ii) of the same diagram).

We now detail the formal proof. Consider the program of Fig. 5, where all arithmetical operations are done modulo $n$. This algorithm instruments the random walk with two points $f$ and $l$ representing the range $[f,l]$ (using clockwise ordering) of all the points that have been visited by the walk. When all nodes of the cycle have been visited (i.e. when $l+1=f$), the arc between $l$ and $l+1$ is the only arc that has not been visited by the walk. Let $s$ be the program of Fig. 5 and $s^{\prime}$ the loop body of the single loop of $s$. We want to show that the final arc $ret$—the only arc that has not been marked—is uniformly distributed among all arcs. This follows by the judgment:

[TABLE]

First, we make use of the loop splitting equivalence rule ([While-Split]) to transform the main loop into three pieces. In the left program:

[TABLE]

where $[f,l]$ represent the range $f,f+1,\ldots,l$. We use a similar transformation on the right program, with $b$ in place of $a$. To carry out the proof, we first use the one-sided loop rules ([While-L] and the corresponding version [While-R]) on the first loops of the left and right programs. This part of the proof correspond to the walks synchronization as described above. By a straightforward loop invariant, we can show that

[TABLE]

holds after the first loops, where $P(x)\mathrel{\stackrel{{\scriptstyle\scriptscriptstyle\triangle}}{{=}}}(x\in[f,l]\oplus(x+1)\in[f,l])$ and $\Phi\mathrel{\stackrel{{\scriptstyle\scriptscriptstyle\triangle}}{{=}}}\forall i\in\{1,2\}.\,(c\in[f,l])\langle i\rangle$ indicates that the current positions ($c\langle 1\rangle,c\langle 2\rangle$) are contained in the range of visited arcs. Next, we show that after the two second loops the following relational invariant is satisfied:

[TABLE]

After the second loop, there are two cases for the third loop. If $l\langle 1\rangle=a$, we have $l\langle 2\rangle=b$, $f\langle 1\rangle=a+1$ (since $a+1$ is visited in $\langle 1\rangle$) and $f\langle 2\rangle=b+1$. In this case, which corresponds to the case (i) of the last diagram, the third loops both exit immediately and the random walks resp. return the arcs $(a,a+1)$ and $(b,b+1)$. Otherwise, we have $l\langle 1\rangle\neq a$ and $l\langle 2\rangle\neq b$, and we can show, using the rules [While-L] and [While-R], that $l\langle 1\rangle$ (resp. $l\langle 2\rangle$) will never be set to $a$ (resp. b). In this case, which corresponds to the case (ii) of the last diagram, we can show that the walks resp. return arcs distinct from $(a,a+1)$ and $(b,b+1)$.

We now focus on the second loops, relating them with the two-sided variant of the [While] rule. The particular coupling we choose will depend on the current positions in the two sides at the start of the second loops. If $a\in[f,l]\langle 1\rangle$ and $b\in[f,l]\langle 2\rangle$ then we have $l\langle 1\rangle=a$ and $l\langle 2\rangle=b$ (since $a+1\notin[f,l]\langle 1\rangle$) and we couple the walks to make identical moves. In that case, the key part of the loop invariant is:

[TABLE]

The first line enforces some structural invariant and the second line enforces that both walks make identical moves relative to $a$ and $b$. The main difficulty is to show that both loops are synchronized. Note that there are two reasons the loop may exit. If $l$ has been incremented, then the increment will be done on both side. Otherwise, if $f$ has been decremented to $a+1$, then we have $c\langle 1\rangle=f\langle 1\rangle=a+2$, so $c\langle 1\rangle-a=c\langle 2\rangle-b=2$ and $c\langle 2\rangle=b+2$ and the right loop will also decrement $f$ to $b+1$. The case $a+1\in[f,l]\langle 1\rangle$ and $b+1\in[f,l]\langle 2\rangle$ is very similar, by reversing the roles of $f$ and $l$. The remaining two cases, $a+1\in[f,l]\langle 1\rangle$ and $b\in[f,l]\langle 2\rangle$ or $a\in[f,l]\langle 1\rangle$ and $b+1\in[f,l]\langle 2\rangle$ is similar except that we force the walks to be execute in anti-lock-step. Using the rule [Case], we put together these four cases and we conclude by application of the rule for sequence.

0.4.4 Ballot Theorem

So far, we have shown how couplings can be used to prove that a set of program variables is uniformly distributed. Couplings can also be used for showing that two events have the same probability, such as in the following example.

Example 10** (Ballot Theorem).**

Assume that voters must choose between two candidates $A$ and $B$. The outcome of the vote is $n_{A}$ votes for $A$ and $n_{B}$ votes for $B$, with $n_{A}>n_{B}$. Assuming that the order in which the votes are cast is uniformly random, the probability that $A$ is always strictly ahead in partial counts is $\nicefrac{{(n_{A}-n_{B})}}{{(n_{A}+n_{B})}}$.

The process can be formalized by the program from Fig. 6. Here we use the list $l$ to store intermediate results. Using $l_{i}$ to denote the $i$-th element of the list $l$, the Ballot Theorem is captured by the statement:

[TABLE]

There exist many proofs of the Ballot Theorem; we formalize a proof that is sometimes called Andre’s reflection principle. The crux of the method is a coupling proof of the following fact: “bad” sequences starting with a vote to the loser are equi-probable with “bad” sequences starting with a vote to the winner, where a sequence of votes is “bad” if there is a tie at some point in the partial counts. Let $\phi\mathrel{\stackrel{{\scriptstyle\scriptscriptstyle\triangle}}{{=}}}(\bigvee_{1\leq i\leq n}l_{i}=0)$ and $\psi\mathrel{\stackrel{{\scriptstyle\scriptscriptstyle\triangle}}{{=}}}x_{A}=n_{A}\land x_{B}=n_{B}$. The above facts are captured by the pRHL judgment (universally quantified over $n_{A}$ and $n_{B}$ such that $n_{A}>n_{B}$): $\vDash{s}\sim{s}\leavevmode\nobreak\ :\leavevmode\nobreak\ {\top}\Longrightarrow\leavevmode\nobreak\ {\xi}$ where

[TABLE]

It follows from the properties of coupling that for every $n_{A}$ and $n_{B}$ such that $n_{A}>n_{B}$, $\mathsf{Pr}_{\llbracket s\rrbracket_{m}}\left[l_{1}\cdot l_{n}>0\land\phi\land l_{n}=k\right]=\mathsf{Pr}_{\llbracket s\rrbracket_{m}}\left[l_{1}\cdot l_{n}<0\land\phi\land l_{n}=k\right]$. In terms of conditional probabilities, we have $\mathsf{Pr}_{\llbracket s\rrbracket_{m}}\left[l_{1}\cdot l_{n}>0\land\phi\mid\psi\right]=\mathsf{Pr}_{\llbracket s\rrbracket_{m}}\left[l_{1}\cdot l_{n}<0\land\phi\mid\psi\right]$. Now observe that any sequence that starts with a vote to $B$ (i.e. the loser) is necessarily bad. Therefore, $\mathsf{Pr}_{\llbracket s\rrbracket_{m}}\left[l_{1}\cdot l_{n}<0\land\phi\mid\psi\right]=\mathsf{Pr}_{\llbracket s\rrbracket_{m}}\left[l_{1}\cdot l_{n}<0\mid\psi\right]$. By the above and elementary properties of conditional independence:

[TABLE]

Note that the probability in the right-hand side of the last equation represents the probability that the first vote goes to the loser, conditional on $\psi$. This turns out to be exactly $\frac{n_{B}}{n_{A}+n_{B}}$, so we conclude that $\mathsf{Pr}_{\llbracket s\rrbracket_{m}}\left[\phi\mid\psi\right]=2\cdot\frac{n_{B}}{n_{A}+n_{B}}$ or equivalently $\mathsf{Pr}_{\llbracket s\rrbracket_{m}}\left[\neg\phi\mid\psi\right]=\frac{n_{A}-n_{B}}{n_{A}+n_{B}}$ as desired.

We now turn to the proof of the pRHL judgments. By symmetry it suffices to consider the first judgment. Using the rule of consequence and the elimination rule for universal quantification, it suffices to prove for every $i$:

[TABLE]

We couple the samplings of $x$ using the negation function until $|l|=i$, and then with the identity bijection. This establishes the following loop invariant, from which we can conclude:

[TABLE]

0.5 Independence

We now turn to characterizing probabilistic independence using couplings. We focus on probabilistic independence of program variables, a common task when reasoning about randomized computations. In our setting, the textbook definition of probabilistic independence can be cast as follows:

Definition 11**.**

A set $X=\{x_{1},\ldots,x_{n}\}$ of program variables of types $A_{1},\ldots,A_{n}$ is probabilistically independent in a distribution $\mu\in\mathbb{D}(\mathbf{State})$ iff for every $(a_{1},\ldots,a_{n})\in A_{1}\times\ldots\times A_{n}$:

[TABLE]

0.5.1 Characterization

Our first characterization of independence is based on the observation that uniformity entails independence.

Fact 12** (Independence from uniformity).**

From every state $m$, if $X$ is uniformly distributed in $\llbracket s\rrbracket_{m}$ then $X$ is independent in $\llbracket s\rrbracket_{m}$.

This observation enables proving independence by coupling, in the special case where variables are uniform and independent. For the general case, we will use an alternative characterization based on self-composition.

Proposition 13** (Independence by coupling).**

The following are equivalent:

for every state $m$, $X$ is independent in $\llbracket s\rrbracket_{m}$; 2. 2.

the following judgment, between a single copy of the program on the one hand and a $n$-fold copy on the other hand, is derivable for every $(a_{1},\ldots,a_{n})\in A_{1}\times\ldots\times A_{n}$:

[TABLE]

Proof.

The validity of the universally quantified pRHL judgment is equivalent to the following statement: for every $a_{1},\ldots,a_{n}$ and $n$-fold copy ${m^{\langle n\rangle}}$ of some initial state $m$,

[TABLE]

The last equality comes from the property of $n$-fold self-composition (6). ∎

0.5.2 Pairwise Independence of Bits

Our first example is a well-known algorithm for generating $2^{n}$ pairwise independent bits. The algorithm first samples $n$ independent bits $b_{1}\ldots b_{n}$, and then defines for every subset $X\subseteq\{1,\ldots,n\}$ the bit $z_{X}=\bigoplus_{i\in X}b_{i}$.

We can prove pairwise independence of the computed bits, i.e.  for every $X\neq Y$, $z_{X}$ and $z_{Y}$ are independent. Since there are $2^{n}$ subsets of $\{1,\ldots,n\}$, this gives us $2^{n}$ pairwise independent bits constructed from $n$ independent bits. The algorithm is encoded by the program $s$ in Fig. 7, where $\mathsf{bits}$ maps $\{0,\ldots,2^{n}-1\}$ to a subset in $\mathcal{P}(\{1,\ldots,n\})$ of positions that are $1$ in the binary representation, and $\mathbf{for}\>i\>=a\>\mathbf{to}\>b\>\mathbf{do}\>s$ is usual syntactic sugar for $\mathbf{while}$ loop with an incrementing counter $i$.

By our characterization based on self-composition, pairwise independence of $z_{j}$ and $z_{j^{\prime}}$ for every $j\neq j^{\prime}$ is equivalent to the (universally quantified) pRHL judgment

[TABLE]

Since $j\neq j^{\prime}$, the two sets $\mathsf{bits}(j)$ and $\mathsf{bits}(j^{\prime})$ must differ in at least one element. Let $k_{0}$ be the smallest element in which they differ. Without loss of generality, we can assume that $k_{0}\notin\mathsf{bits}(j)$ and $k_{0}\in\mathsf{bits}(j^{\prime})$. The crux of the proof is to establish the following judgment:

[TABLE]

where $z=\bigoplus_{k\in\mathsf{bits}(j)}b_{k}$, $z^{\prime}=\bigoplus_{k\in\mathsf{bits}(j^{\prime})}b_{k}$ and $z^{\prime\prime}=\bigoplus_{k\in\mathsf{bits}(j^{\prime})}b^{\prime}_{k}$ and

[TABLE]

This is proved by coupling the variables of the two programs in an appropriate way. We couple the random samplings as follows:

• •

for every $k\neq k_{0}$, we couple $b_{k}\langle 1\rangle$ and $b_{k}\langle 2\rangle$ using the identity sampling;

• •

we use the Rnd-R rule for $b^{\prime}_{k}\langle 2\rangle$ for every $k\neq k_{0}$;

• •

we couple $b_{k_{0}}\langle 1\rangle$ and $b^{\prime}_{k_{0}}\langle 2\rangle$ with the bijection which ensures

[TABLE]

Putting everything together, the final proof obligation follows from the algebraic properties of $\oplus$.

0.5.3 $k$-wise Independence

The previous example can be generalized to achieve $k$-wise independence for general $k$. Suppose we wish to generate $n$ random variables that are $k$-wise independent. We will work in $\mathbb{Z}/p\mathbb{Z}$, the field of integers modulo a prime $p$, such that $k\leq p$. Let $a_{0},\dots,a_{k-1}$ be drawn uniformly at random from $\mathbb{Z}/p\mathbb{Z}$ and define the family of random variables for every $m\in\{1,\dotsc,n\}$:

[TABLE]

where we take $0^{0}=1$ by convention. The corresponding code is given in Fig. 8. Then, we can show that any collection of $k$ distinct variables $\{x_{i}\}_{i}$ is independent.

For simplicity, we will show that the first $k$ elements $x_{0},\dots,x_{k-1}$ are uniform, and hence independent. Let v_{0},\ldots,v_{k-1}\in\mathbb{Z}/\raisebox{-2.15277pt}{{n}\mathbb{Z}} be arbitrary elements of the field. Then the probability that $(x_{0},\ldots,x_{k-1})=(v_{0},\ldots,v_{k-1})$ is equal to $p^{-k}$. Indeed, the equations

[TABLE]

define a system of linear equations with variables $a_{0},\dots,a_{k-1}$. By basic linear algebra the system of equations has a unique solution for the variables $a_{0},\dots,a_{k-1}$,111Let the Vandermonde matrix $V(1,\dotsc,k-1)=\left(i^{j-1}\right)_{i,j}$ be

$V(1,\dotsc,k-1)\cdot(a_{0},\dotsc,a_{k-1})^{T}=(v_{0},\dotsc,v_{k-1})^{T}.$

The system of equations has a unique solution if and only if the matrix $V(1,\dotsc,k-1)$ is invertible in the space of matrices over \mathbb{Z}/\raisebox{-2.15277pt}{{n}\mathbb{Z}}, which happens if and only if its determinant is non-zero mod $n$. Expanding,

$\textrm{det}(V(1,\dotsc,k-1))=\prod_{i\neq j}(i-j)=\prod_{i=2}^{k-1}i!$

Note that $p$ does not divide the determinant by Gauss’ lemma, since $n$ can’t divide any of the terms $i!$ for any $i<n$. Therefore, the system of equations has a unique solution. which we denote $(v_{0}^{*},\ldots,v_{k-1}^{*})$. Now consider the pRHL judgment that establishes uniformity:

[TABLE]

By applying (relational) weakest precondition on the deterministic fragments of the program, the judgment is reduced to

[TABLE]

We then repeatedly apply the rule for random sampling, with the permutation on $\mathbb{Z}/p\mathbb{Z}$ that exchanges $(v_{i}^{*},w_{i}^{*})$.

0.6 Conditional Independence

Finally, we consider how to show conditional independence. Recall that the conditional probability $\mathsf{Pr}_{x\sim\mu}\left[A\mid B\right]$ is defined when $\mathsf{Pr}_{x\sim\mu}\left[B\right]\neq 0$ and satisfies $\mathsf{Pr}_{x\sim\mu}\left[A\mid B\right]\mathrel{\stackrel{{\scriptstyle\scriptscriptstyle\triangle}}{{=}}}\frac{\mathsf{Pr}_{x\sim\mu}\left[A\land B\right]}{\mathsf{Pr}_{x\sim\mu}\left[B\right]}$.

Definition 14**.**

Let $X=\{x_{1},\ldots,x_{n}\}$ be a set of program variables of types $A_{1},\ldots,A_{n}$ and let $E$ be an event. We say that $X$ is independent conditioned on $E$ in a distribution $\mu\in\mathbb{D}(\mathbf{State})$ iff for every $(a_{1},\ldots,a_{n})\in A_{1}\times\ldots\times A_{n}$:

[TABLE]

(For this definition to make sense, we are implicitly assuming that $\mathsf{Pr}_{\mu}\left[E\right]\neq 0$.)

The following lemma unfolds the definition of conditional independence and is useful for the characterization of the next section.

Lemma 15**.**

A set of variables $X$ is independent conditioned on an event $E$ in $\mu$ iff for every $a_{1}\in A_{1}$, …, $a_{n}\in A_{n}$:

[TABLE]

0.6.1 Characterization

The characterization of independence based on self-composition can be extended as follows.

Proposition 16** (Conditional independence by coupling).**

The following are equivalent:

for every state $m$, $X$ is independent conditioned on $E$ in $\llbracket s\rrbracket_{m}$; 2. 2.

$\vDash{{s^{\langle n\rangle}}}\sim{{s^{\langle n\rangle}}}\leavevmode\nobreak\ :\leavevmode\nobreak\ {\mathsf{EqMem}^{\langle{n}\rangle,\langle{n}\rangle}}\Longrightarrow\leavevmode\nobreak\ {\left(\phi_{1}\land\mathbb{E}\langle 1\rangle\right)\iff\left(\phi_{2}\land\mathbb{E}\langle 2\rangle\right)}$* where $\mathbb{E}\mathrel{\stackrel{{\scriptstyle\scriptscriptstyle\triangle}}{{=}}}\bigwedge_{1\leq i\leq n}E^{i}$, $\phi_{1}\mathrel{\stackrel{{\scriptstyle\scriptscriptstyle\triangle}}{{=}}}\bigwedge_{1\leq i\leq n}(x_{i}^{1}\langle 1\rangle=a_{i})$ and $\phi_{2}\mathrel{\stackrel{{\scriptstyle\scriptscriptstyle\triangle}}{{=}}}\bigwedge_{1\leq i\leq n}(x^{i}_{i}\langle 2\rangle=a_{i})$.*

Proof.

The proof is similar to the case of independence (13). ∎

0.6.2 Example: Conditional Independence

We consider a simple example often used to illustrate Bayesian networks models. Let $x$, $y$, $z$, $w$ and $w^{\prime}$ be random variables, where $x$, $y$ and $z$ are sampled from distributions $\mu$, $\mu^{\prime}$ and $\mu^{\prime\prime}$ respectively, and $w$ and $w^{\prime}$ are defined by their respective assignments. Both $w$ and $w^{\prime}$ depend on $y$, along with independent sources of randomness, respectively $x$ and $z$. While $w$ and $w^{\prime}$ are not independent—they share dependence on $y$—if we condition on a particular value of $y$, then $w$ and $w^{\prime}$ are independent.

The code of the corresponding program $s$ is given in Fig. 9. We want to show that $w$ and $w^{\prime}$ are independent conditioned on $y=c$ for every $c$. Using our characterization based on self-composition, it amounts to proving the following (universally quantified) pRHL judgment:

[TABLE]

where $\left\{\begin{aligned} \phi&\mathrel{\stackrel{{\scriptstyle\scriptscriptstyle\triangle}}{{=}}}w^{1}=a\land{w^{\prime}}^{1}=b\land y^{1}=c\land y^{2}=c\\ \psi&\mathrel{\stackrel{{\scriptstyle\scriptscriptstyle\triangle}}{{=}}}w^{1}=a\land{w^{\prime}}^{2}=b\land y^{1}=c\land y^{2}=c.\end{aligned}\right.$

The proof proceeds by moving the samplings of $z^{1}$ and $z^{2}$ in both programs to the front of the program, and then swapping samplings in the left program (we can use the rule [Swap] to reorder the instructions, as the sampling instructions for $z^{1}$ and $z^{2}$ operate on different variables). Then, we couple $z^{1}\langle 1\rangle$ to be equal to $z^{2}\langle 2\rangle$, and $z^{2}\langle 1\rangle$ to be equal to $z^{1}\langle 2\rangle$. We apply the identity coupling to all other random samplings.

0.7 Formalization

EasyCrypt [3, 4] is an interactive proof assistant that supports reasoning about (relational) properties of probabilistic programs, using the pRHL logic. We have applied EasyCrypt to the main examples of this paper. For uniformity, it suffices to establish the required pRHL judgment; in contrast, independence via self-composition requires to build the self-composed program, which we have done manually. The main challenges for the verification are:

Restructuring the code of the program to make the rules of the logic applicable; this is done by applying the equivalent of the [Struct] rules. 2. 2.

Discovering and establishing the correct proof invariants. The current version of EasyCrypt requires that invariants are produced by the users. 3. 3.

Building an appropriate coupling, primarily through applying the rule for random samplings with carefully chosen bijections.

Our examples are formalized in about 1,000 lines of proof script in EasyCrypt.222Proofs are available at the following link: https://gitlab.com/easycrypt/indep The most complex example, and the one where the three challenges are most pronounced, is the random walk over a cycle. This example is formalized in about 500 lines of EasyCrypt code, out of which the statement, including the definition of the program, takes about 50 lines. The remaining 90% of the formalization covers the notions used in the proof and the proof itself.

0.8 Conclusion

We have proposed a new method based on probabilistic couplings for formally verifying uniformity and independence properties of probabilistic programs. Our method complements the existing range of techniques for probabilistic reasoning, and has many potential applications in program verification, security, and privacy.

0.9 Acknowledgments

We thank the anonymous reviewers for their detailed comments. This work was partially supported by NSF grants TC-1065060 and TWC-1513694, by the European Union’s H2020 Programme under grant agreement number ICT-644209, and a grant from the Simons Foundation ($\#360368$ to Justin Hsu).