Efficiently Checking Actual Causality with SAT Solving

TL;DR

This paper introduces a novel SAT-based algorithmic approach for efficiently checking causality in acyclic models with binary variables, demonstrating scalability to large models with thousands of variables.

Contribution

It presents two SAT encodings and empirical evidence that causality can be inferred efficiently in large, complex models, addressing computational challenges in causality reasoning.

Findings

Causality can be checked in less than 5 seconds for models with over 4000 variables.

Two SAT encodings are proposed and empirically evaluated.

The approach scales well to large, complex models.

Abstract

Recent formal approaches towards causality have made the concept ready for incorporation into the technical world. However, causality reasoning is computationally hard; and no general algorithmic approach exists that efficiently infers the causes for effects. Thus, checking causality in the context of complex, multi-agent, and distributed socio-technical systems is a significant challenge. Therefore, we conceptualize an intelligent and novel algorithmic approach towards checking causality in acyclic causal models with binary variables, utilizing the optimization power in the solvers of the Boolean Satisfiability Problem (SAT). We present two SAT encodings, and an empirical evaluation of their efficiency and scalability. We show that causality is computed efficiently in less than 5 seconds for models that consist of more than 4000 variables.

Tables

Table 1. Table 1: F 𝐹 F , G 𝐺 G assignments

	$BS$	$SH$	$BH$	$ST$	$BT$
$M$	1	1	0	1	1
$F$	0	0	0	0	1
$G$ ${\overrightarrow{a}}_1$	0	0	0	0	0
$G$ ${\overrightarrow{a}}_2$	0	0	0	0	1

Table 2. Table 2: Evaluated causal models

Causal Model	Endogenous Vars.
Abstract Models: $A{M}_1$ , $A{M}_2$	8 , 3
Steal Master Key: 3 suspects ($SM{K}_3$), 8 suspects ($SM{K}_8$)	36, 91
Leakage in Sub-sea Production System (LSP) [5]	41
Binary Trees of different heights (BT)	15 - 4095
Abstract Model 1 Combined with Binary Tree (ABT)	4103

Table 3. Table 3: Discussed scenarios as part of the analysis

ID

$\overrightarrow{X}=\overrightarrow{x}$

$\phi$

AC1

AC2

AC3

$\left|\text{Minimal }\overrightarrow{W}\right|$

BRUTE

SAT

SAT${}^{\text{MINIMAL}}$

SAT${}_{\text{COMBINED}}$

$SM{K}_3$

3

$F{S}_{U_1}=1\wedge F{N}_{U_1}=1\wedge A_{U_1}=1$

$SMK=1$

✓

✓

✓

4 \forloop[2]number0¡ 8& \DTLgetvalue\dtllastloadeddb732ms \DTLgetvalue\dtllastloadeddb743MB

22

$F{S}_{U_3}=1$

✓

✗

✓

– \forloop[2]number0¡ 8& \DTLgetvalue\dtllastloadeddb892ms \DTLgetvalue\dtllastloadeddb903MB

24

$F{S}_{U_3}=1\wedge F{N}_{U_3}=1\wedge A_{U_3}=1$

✓

✓

✓

0 \forloop[2]number0¡ 8& \DTLgetvalue\dtllastloadeddb972ms \DTLgetvalue\dtllastloadeddb983MB

26

$F{S}_{U_3}=1\wedge F{N}_{U_3}=1$ $\wedge A_{U_3}=1\wedge A{D}_{U_3}=1$

✓

✓

✗

0 \forloop[2]number0¡ 8& \DTLgetvalue\dtllastloadeddb1052ms \DTLgetvalue\dtllastloadeddb1063MB

29

$A_{U_3}=1\wedge A{D}_{U_3}=1$

$SD=1$

✓

✓

✗

0 \forloop[2]number0¡ 8& \DTLgetvalue\dtllastloadeddb1132ms \DTLgetvalue\dtllastloadeddb1143MB

LSP

3

$X_1=1\wedge X_2=1$

$X_{41}=1$

✓

✓

✗

0 \forloop[2]number0¡ 8& \DTLgetvalue\dtllastloadeddb1372ms \DTLgetvalue\dtllastloadeddb1383MB

56

$X_1=1\wedge X_2=1$

✓

✗

✓

– \forloop[2]number0¡ 8& \DTLgetvalue\dtllastloadeddb1452ms \DTLgetvalue\dtllastloadeddb1463MB

57

$X_1=1\wedge X_3=1$

✓

✓

✓

0 \forloop[2]number0¡ 8& \DTLgetvalue\dtllastloadeddb1532ms \DTLgetvalue\dtllastloadeddb1543MB

BT height = 12

34

$n_{4093}=1\wedge n_{4094}=1$

$n_{\text{root}}=1$

✓

✗

✓

– \forloop[2]number0¡ 8& \DTLgetvalue\dtllastloadeddb2092ms \DTLgetvalue\dtllastloadeddb2103MB

35

$n_{4091}=1\wedge n_{4092}=1$ $\wedge n_{4093}=1\wedge n_{4094}=1$

✓

✗

✓

– \forloop[2]number0¡ 8& \DTLgetvalue\dtllastloadeddb2172ms \DTLgetvalue\dtllastloadeddb2183MB

ABT

1

$n_{4094}=1$

$I=1$

✓

✓

✓

4 \forloop[2]number0¡ 8& \DTLgetvalue\dtllastloadeddb2332ms \DTLgetvalue\dtllastloadeddb2343MB

4

$n_{4093}=1\wedge n_{4094}=1$

✓

✓

✓

4 \forloop[2]number0¡ 8& \DTLgetvalue\dtllastloadeddb2412ms \DTLgetvalue\dtllastloadeddb2423MB

5

$n_{4092}=0\wedge n_{4093}=1\wedge n_{4094}=1$

✓

✓

✗

5 \forloop[2]number0¡ 8& \DTLgetvalue\dtllastloadeddb2492ms \DTLgetvalue\dtllastloadeddb2503MB

Equations

$$\begin{gathered} F=\stackrel{\neg \phi }{\overbrace{\neg BS}}\wedge \stackrel{\vec{u}}{\overbrace{S{T}_{exo}\wedge B{T}_{exo}}}\wedge (\stackrel{\text{equation of BS}}{\overbrace{(BS\leftrightarrow SH\vee BH)}}\vee \stackrel{\text{orig. BS}}{\overbrace{BS}})\wedge ({\underbrace{(SH\leftrightarrow ST)}}^{\text{equation of SH}}\vee {\underbrace{SH}}^{\text{orig. SH}}) \\ \wedge (\underset{\text{equation of BH}}{\underbrace{(BH\leftrightarrow BT\wedge \neg SH)}}\vee \underset{\text{orig. BH}}{\underbrace{\neg BH}})\wedge \underset{\text{equation of ST}}{\underbrace{\neg ST}}\wedge (\underset{\text{equation of BT}}{\underbrace{(BT\leftrightarrow B{T}_{exo})}}\vee \underset{\text{orig. BT}}{\underbrace{BT}}) \end{gathered}$$

$$\begin{gathered} G=\stackrel{\neg \phi }{\overbrace{\neg BS}}\wedge \stackrel{\vec{u}}{\overbrace{S{T}_{exo}\wedge B{T}_{exo}}}\wedge (\stackrel{\text{equation of BS}}{\overbrace{(BS\leftrightarrow SH\vee BH)}}\vee \stackrel{\text{orig. BS}}{\overbrace{BS}})\wedge (\stackrel{\text{equation of SH}}{\overbrace{(SH\leftrightarrow ST)}}\vee \stackrel{\text{orig. SH}}{\overbrace{SH}}) \\ \wedge (\underset{\text{equation of BH}}{\underbrace{(BH\leftrightarrow BT\wedge \neg SH)}}\vee \underset{\text{orig. BH}}{\underbrace{\neg BH}})\wedge (\underset{\text{orig. ST}}{\underbrace{ST}}\vee \underset{\text{negated orig. ST}}{\underbrace{\neg ST}})\wedge (\underset{\text{orig. BT}}{\underbrace{BT}}\vee \underset{\text{negated orig. BT}}{\underbrace{\neg BT}}) \end{gathered}$$

$$(M,\overrightarrow{u})\models ({\overrightarrow{X}}_{(n)}={\overrightarrow{x}}_{(n)})\wedge (M,\overrightarrow{u})\models \phi .$$

$$\exists\overrightarrow{W},\overrightarrow{w},\overrightarrow{x}_{(n)}^{\prime}\bullet(M,\overrightarrow{u})\models(\overrightarrow{W}=\overrightarrow{w})\implies(M,\overrightarrow{u})\models\\ \bigl{[}\overrightarrow{X}_{(n-1)}\leftarrow\overrightarrow{x}_{(n-1)}^{\prime},X_{n}\leftarrow x_{n},\overrightarrow{W}\leftarrow\overrightarrow{w}\bigr{]}\neg\varphi.$$

$$(M,\overrightarrow{u})\models ({\overrightarrow{X}}_{(n-1)}={\overrightarrow{x}}_{(n-1)})\wedge (M,\overrightarrow{u})\models \phi$$

$$\exists\overrightarrow{W}^{*},\overrightarrow{w}^{*},\overrightarrow{x}_{(n-1)}^{\prime*}\bullet(M,\overrightarrow{u})\models(\overrightarrow{W}^{*}=\overrightarrow{w}^{*})\\ \implies(M,\overrightarrow{u})\models\bigl{[}\overrightarrow{X}_{(n-1)}\leftarrow\overrightarrow{x}_{(n-1)}^{\prime*},\overrightarrow{W}^{*}\leftarrow\overrightarrow{w}^{*}\bigr{]}\neg\varphi$$

$$E_{1}\mathrel{\mathop{\mathchar 58\relax}}=\bigl{(}\Psi\wedge\overrightarrow{X}_{(n-1)}=\overrightarrow{x}_{(n-1)}\wedge X_{n}=x_{n}\bigr{)}\wedge\varphi.$$

$$E_{2}\mathrel{\mathop{\mathchar 58\relax}}=\bigl{(}\Psi\wedge\overrightarrow{X}_{(n-1)}=\overrightarrow{x}_{(n-1)}\bigr{)}\wedge\varphi.$$

$$E_{3}\mathrel{\mathop{\mathchar 58\relax}}=\bigl{(}\Psi^{\prime}\wedge\overrightarrow{X}_{(n-1)}=\overrightarrow{x}_{(n-1)}^{\prime}\wedge X_{n}=x_{n}\wedge\overrightarrow{W}=\overrightarrow{w}\bigr{)}\implies\neg\varphi.$$

$$E_{4}\mathrel{\mathop{\mathchar 58\relax}}=\bigl{(}\Psi^{\prime\prime}\wedge\overrightarrow{X}_{(n-1)}=\overrightarrow{x}_{(n-1)}^{\prime}\wedge\overrightarrow{W}=\overrightarrow{w}\bigr{)}\implies\neg\varphi.$$

$$(\Psi^{\prime\prime}\implies\Psi^{\prime})\implies\bigl{(}(E_{1}\wedge E2)\implies(E_{3}\wedge E_{4})\bigr{)}$$

Full text

\NewEnviron

reptheorem[1]

,

and

1 Introduction

1.1 Accountability

The tremendous power of modern information technology, and cyber-physical, systems is rooted, among other things, in the possibility to easily compose them using software. The ease of composition is due to the virtual nature of software: if a system provides an application programming interface, then other systems can in principle directly interact with that system. As we will argue, it is inherently impractical to specify all “legal,” or “safe,” or “secure” interactions with a system. In turn, this means that the possibility of illegal, unsafe or insecure interactions cannot be excluded at design time. As a consequence, we cannot ensure the “adequate” functioning of such open systems; hence need to be prepared for failures of the system; and therefore need accountability mechanisms that help us identify the root cause, or responsibility, for such a failure. The technical contribution of this article is an efficient procedure for checking a specific kind of causality.

Traditionally, safety and also security analysis of critical systems start by determining the system’s boundary. We will concentrate on the technical boundary here. Any accessible software interface, or API, then is part of that boundary. In practice, these interface descriptions are syntactic in nature. Among other things, this means that they abstract from restrictions on the usage of the API. For instance, a collection of data may need to be initialized before it is used, which is a requirement that is not part of the syntactic interface but may require additional specification in the form of sequencing requirements.

This example generalizes: Many restrictions on the potential usage of an API are left implicit, or come as comments in the best case. The academic community has therefore suggested, for a long time, to provide more detailed interface descriptions. A typical example for such interfaces are contracts [26] that require the specification of preconditions and postconditions for the usage of a specific piece of functionality.

In practice, today’s software interfaces continue to be mostly syntactic, in spite of decades of research and impressive results on richer notions of interfaces that also incorporate (more detailed descriptions of) the behavior of a component. We prefer not to speculate about the lack of adoption of these ideas in practice. Instead, we would like to remind that any interface description provides a behavior abstraction—and in this sense, the syntactic interface, or API, provides such a coarse abstraction as well: data elements of a certain type are mapped to data elements of another type.

Arguably, this is the coarsest abstraction of behavior that still is useful in practice. At the other end of the spectrum of levels of abstraction, one may argue that the finest possible abstraction is that of the code itself. However, we do share the perspective that code itself provides an abstraction of behavior in that in most programming languages it does not explicitly talk about time or resource utilization. In this sense, code is not the finest possible abstraction of behavior. Be that as it may, the above shows that there is a huge spectrum of possible levels of abstraction for describing the behavior, or an interface, of a system. It is important to remember that none of these levels as such is “better” than another level: this depends on the purpose of the abstraction, as is the case for any kind of model [32].

All this does not necessarily constitute novel insights. There is a consequence, however, that we feel has been underestimated in the past and that is the basis for the work presented here: Regardless of the level of abstraction of an interface that we choose, there must, by definition, always be parts of the behavior that are left unspecified. And this, in turn, means that the boundary of a software-intensive system usually is not, should not, and most importantly: cannot be specified without leaving open several degrees of freedom in terms of how to “legally” use the system. It hence cannot be excluded that a system $S_{1}$ is used by another system $S_{2}$ in a way that the developer of $S_{1}$ has never envisaged and which violates implicit assumptions that were made when developing $S_{1}$, possibly leading to a runtime failure of $S_{1}$ and, by consequence, also of $S_{2}$.111We believe that this construction helps us understand what the notion of an “open system” means: At face value, a software-intensive system $S$ cannot be “open” because there is a well-specified (syntactic) interface for the behavior of $S$. However, if this interface description is too coarse and cannot or does not specify restrictions on how to use $S$, some usage of $S$ may violate implicit assumptions made while developing $S$. In this sense, every software-intensive system is then “open” if it may be used in a way that violates implicit assumptions.

One consequence is that software-rooted failures for composed, or open, systems cannot be excluded by design. Because these systems are becoming ever more complex, we consider it hence mandatory to provide mechanisms for understanding the root causes of a failure, both for eliminating the underlying (technical) problem and for assigning blame.

We call a system accountable that can help answer questions regarding the root cause of some (usually undesired) event (other notions of accountability are studied and formalized elsewhere [18]). Accountability of a system requires at least two properties: The system must provide evidence, usually in the form of logs, that helps understand the reasons of the undesired event. Moreover, there must be some mechanism that can reason about causality.

Different forms of causality are useful in our context. Just to mention two of them, Granger causality identifies causality with a reduction of error when it comes to predicting one time series on the grounds of another [10]; and model-based diagnosis computes candidate sets of potentially faulty components that can explain the failure of a system [30]. In this article, we focus on one technical aspect of inferring one specific kind of causality, namely Halpern-Pearl-style actual causality for counter-factual arguments: Given a failure of a system (an effect) and a potential cause, we efficiently compute if, by counterfactual argument, the potential cause is an actual cause.

1.2 Causality

Causality is a fundamental construct of human perception. Although our ability to link effects to causes may seem natural, defining what precisely constitutes a cause has baffled scholars for centuries. Early work on defining causality goes back to Hume in the eighteenth century [15]. Hume’s definition hinted at the idea of counter-factual relations to infer the causes of effects. Informally, we argue, counter to the fact, that $A$ is a cause of $B$ if $B$ does not occur if $A$ no longer occurs. As Lewis noted with examples, this relation is not sufficient to deal with interdependent, multi-factorial, and complex causes [23]. Thus, the search for a comprehensive general definition of causality continues. Recently, in computer science, there have been some successful and influential efforts, by Halpern and Pearl, at formalizing the idea of counter-factual reasoning and addressing the problematic examples in philosophy literature [12].

The work by Halpern and Pearl covers two notions of causality, namely actual (token) causality and type (general) causality. Type causality is a forward-looking link that forecasts the effects of causes. It is useful for predictions in different domains like medicine [19], and machine learning applications [29]. In this paper, we focus on actual causality that is a rather retrospective linking of effects to causes. We are chiefly interested in the Halpern-Pearl (HP) definition of actual causality [11]. Causality is useful in law [27], security [20], software and system verification [3, 22], databases [24], and accountability [9, 17].

In essence, HP provides a formal definition of when we can call one or more events a cause of another event in a way that captures the human intuition. There have been three versions of HP: the original (2001), updated (2005), and modified (2015) versions, the latter of which we are using. The fundamental contribution of HP is that it opens the door for embedding the ability to reason about causality into socio-technical systems that are increasingly taking control of our daily lives. Among other use cases, since actual causality can be used to answer causal queries in the postmortem of unwanted behavior, it is a vital ingredient to enable accountability. Utilizing HP in technical systems makes it possible to empower them with all the other social concepts that should also be embedded into the technical world, such as responsibility [6], blame, intention, and moral responsibility [13].

Causality checking, using any version of HP, is hard. For example, under the modified definition, determining causality is in general $D^{P}_{1}$-complete, and $NP$-complete for singleton causes [11]. The computational complexity led to a domain-specific (e.g., database queries, counter-examples of model checking), adapted (e.g., use lineage of queries, use Kripke structure of programs), or restricted (e.g., monotone queries, singleton causes, single-equation models) utilization of HP (details in Section.2). Conversely, brute-force approaches work with small models (less than 30 variables [14]) only. Therefore, to the best of our knowledge, there exists no comprehensive, efficient, and scalable framework for modeling and benchmarking causality checking for binary models (i.e., models with binary variables only). Consequently, no existing algorithm allows applying HP on more complex examples than the simple cases in the literature.

In this paper, we argue that an efficient approach for checking causality opens the door for new use cases that leverage the concept in modern socio-technical systems. We conceptualize a novel approach towards checking causality in acyclic binary models based on the Boolean satisfiability problem (SAT). We intelligently encode the core of HP as a SAT query that allows us to reuse the optimization power built into SAT solvers. As a consequence of the rapid development of SAT solvers ($1000X+$ each decade), they offer a promising tactic for any solution in formal methods and program analysis [28]. Leveraging this power in causality establishes a robust framework for efficiently reasoning about actual causality. Moreover, since the transformation of SAT to other logic programming paradigms like answer set programming (ASP) is almost straightforward, this paper establishes the ground to tackle more causality issues (e.g., causality inference) using combinatorial solving approaches. Therefore, this paper makes the following contributions:

• –

An approach to check causality over binary models. It includes two SAT-encodings that reflect HP, and two variants for optimization,

• –

A Java library 222available at: https://github.com/amjadKhalifah/HP2SAT1.0/ that includes the implementation of our approach. It is easily extensible with new optimizations and algorithms.

• –

An empirical evaluation that uses different examples to show the efficiency and scalability of our approach.

2 Related Work

To the best of our knowledge, no previous work has tackled the technical implementation of the (modified) version of HP yet. Conversely, the first two versions were used in different applications. Although they use different versions, we still consider them related. These applications used the definition as a refinement of other technologies. For example, in [24, 25, 4, 31], a simplified HP (the updated version) was used to refine provenance information and explain database conjunctive query results. Theses approaches, heavily depend on the correspondence between causes and domain-specific concepts like lineage, database repairs, and denial constraints. As a simplification, the authors used a single-equation causal model based on the lineage of the query in [24, 25], and no-equation model in [4, 31]. The approaches also eliminate HP’s treatment of preemption. Similar simplification has been made for Boolean circuits in [7].

In the context of model verification, a concept that enhances a counterexample returned by a model checker with a causal explanation based on a simplified version of the updated HP was proposed in [3]. Their domain-specific simplification comes from the fact that no dependencies between variables, and hence no equations, were required. Moreover, they used the definition of singleton causes. Similarly, in [2, 21], the authors implemented different flavors of causality checking (based on the updated HP) using Bounded Model Checking to debug models of safety-critical systems. They employed SAT solving indirectly in the course of model checking. The authors stated that this approach is better in large models regarding performance than their previous work.

The common ground between all these approaches and our approach is the usage of binary models. However, they were published before the modified HP version. Hence, they used the older versions. In contrast to our approach, the previous works adapted the definition for a domain specific purpose. This was reflected in restrictions on the equations of the binary model (single-equation, independent variables), the cause (singleton), or dependency on other concepts (Kripke structures, lineage formula, counter-examples). On the contrary, we propose algorithms to compute causality on binary models, without adaptations.

Similar to our aim, [14] evaluated search-based strategies for determining causality according to the original HP definition. Hopkins proposed ways to explore and prune the search space, for computing $\vec{W},\vec{Z}$ that were required for that version, and considered properties of the causal model that makes it more efficient for computation. The results presented are of models that consist of less than 30 variables; in contrast, we show SAT-based strategies that compute causality for models of thousands of variables.

Lastly, to prove the complexity classes, Halpern [11] used the relation between the conditions and the SAT problem. However, the concrete encoding in SAT with a size that is linear of the number of variables is still missing.

3 Halpern-Pearl Definition

In this section, we introduce the latest HP. All versions of HP use variables to describe the world. Structural equations define how these variables influence each other. The variables are split into exogenous and endogenous variables. The values of the former, called a context $\vec{u}$, are assumed to be governed by factors that are not part of the modeled world. Consequently, exogenous variables cannot be part of a cause. The values of the endogenous variables, in contrast, are determined by the mentioned equations. Formally, we describe a causal model in Definition 1. Similar to Halpern, we limit ourselves to acyclic causal models, in which we can compute a unique solution for the equations given a context $\vec{u}$.

Definition 1

Causal Model is a tuple $M=(U,V,R,F)$, where

• –

$U$, ${V}$ are sets of exogenous variables and endogenous variables respectively,

• –

$R$* associates with $Y\in U\cup V$ a set $R(Y)$ of values,*

• –

$F$* associates with $X\in V$ $F_{X}\mathrel{\mathop{\mathchar 58\relax}}(\times_{U\in U}{R}(U))\times(\times_{Y\in{V}\backslash\{X\}}{R}(Y))\to{R}(X)$*

Here, we define the necessary notations. A primitive event is a formula of the form $X=x$, for $X\in{V}$ and $x\in{R}(X)$. A sequence of variables $X_{1},...,X_{n}$ is abbreviated as $\vec{X}$. Analogously, $X_{1}=x_{1},...,X_{n}=x_{n}$ is abbreviated as $\vec{X}=\vec{x}$. Variable Y can be set to value y by writing $Y\leftarrow y$ (analogously $\vec{Y}\leftarrow\vec{y}$ for vectors). $\varphi$ is a Boolean combination of primitive events. $(M,\vec{u})\models X=x$ if the variable $X$ has value $x$ in the unique solution to the equations in $M$ in context $\vec{u}$. Intervention on a model is expressed, either by setting the values of $\vec{X}$ to $\vec{x}$, written as $[X_{1}\leftarrow x_{1},..,X_{k}\leftarrow x_{k}]$, or by fixing the values of $\vec{X}$ in the model, written as $M_{\vec{X}\leftarrow\vec{x}}$, which effectively replaces the equations for $\vec{X}$ by a constant equation $X_{i}=x_{i}$. So, $(M,\vec{u})\models[\vec{Y}\leftarrow\vec{y}]\varphi$ is identical to $(M_{\vec{Y}\leftarrow\vec{y}},\vec{u})\models\varphi$ [11]. Lastly, we use $\mapsto$ to express value substitution, e.g., $[\overrightarrow{V}\mapsto\vec{v}^{\prime}]F_{X_{j}}$ refers to the evaluation of equation $F_{X_{j}}$ given that the values of other variables are set to $\vec{v}^{\prime}$.

Definition 2

**Actual Cause [11]

$\vec{X}=\vec{x}$ is an actual cause of $\varphi$ in $(M,\vec{u})$ if the following three conditions hold:

AC1. $(M,\vec{u})\models(\vec{X}=\vec{x})$ and $(M,\vec{u})\models\varphi$

AC2. There is a set $\vec{W}$ of variables in ${V}$ and a setting $\vec{x}^{\prime}$ of the variables in $\vec{X}$ such that if $(M,\vec{u})\models\vec{W}=\vec{w}$, then $(M,\vec{u})\models[\vec{X}\leftarrow\vec{x}^{\prime},\vec{W}\leftarrow\vec{w}]\neg\varphi$.

AC3. $\overrightarrow{X}$ is minimal: no subset of $\vec{X}$ satisfies AC1 and AC2.**

The HP definition is presented in Definition 2. AC1 checks that the cause and the effect occurred in the real world, i.e., in $M$ given context $\vec{u}$. AC3 is a minimality check to deal with irrelevant variables. AC2 is the core; it matches the counter-factual definition of causality. It holds if there exists a setting $\vec{x}^{\prime}$ of the variables in $\vec{X}$ different from the original setting $\vec{x}$ (which led to $\varphi$ holding true) and another set of variables $\vec{W}$ that we use to fix variables at their original value, such that $\varphi$ does not occur. Inferring $\vec{W}$ is one source of the complexity of the definition. The role of $\vec{W}$ becomes clearer when we consider the examples in [11]. Briefly, it captures the notion of preemption which describes the case when one possible cause rules out the other based on, e.g., temporal factors.

Halpern [11] shows that determining causality is in general $D^{P}_{1}$-complete. The family of complexity classes $D^{P}_{k}$ was introduced, in [1], to investigate the complexity of the original and updated definitions. AC1 can be checked in polynomial time, while AC2 is $NP$-complete, and AC3 is co-$NP$-complete. To prove this complexity, Halpern [11] showed that AC2 could be reduced to SAT, and AC3 to UNSAT. However, the concrete encoding was not specified.

Example We consider a famous example from the literature: the rock-throwing example [23], described as follows: Suzy and Billy both throw a rock at a bottle which shatters if one of them hits it. We know that Suzy’s rock hits the bottle slightly earlier than Billy’s and both are accurate throwers. Halpern models this story using the following endogenous variables: $ST,$ $BT$ for “Suzy/Billy throws”, with values 0 (the person does not throw) and 1 (s/he does), similarly, $SH,BH$ for “Suzy/Billy hits”, and $BS$ for “bottle shatters”. The equations are:

• $BS$ is 1 iff one of $SH$ and $BH$ is 1, i.e., $BS=SH\lor BH$

• $SH$ is 1 iff $ST$ is 1, i.e., $SH=ST$

• $BH=1$ iff $BT=1$ and $SH=0$, i.e., $BH=BT\land\neg SH$

• $ST$, $BT$ are set by exogenous variables, i.e., $ST=ST_{exo};BT=BT_{exo}$

Assuming a context $\vec{u}$ that sets $ST$ = 1 and $BT$ = 1, the original evaluation of the model is: $BS$=1 $SH$=1 $BH$=0 $ST$=1 $BT$=1. Let us assume we want to find out whether $ST$ = 1 is a cause of $BS$ = 1. Obviously, AC1 is fulfilled. As a candidate cause, we set $ST$ = 0. A first attempt with $\vec{W}=\emptyset$ shows that AC2 does not hold. However, if we arbitrary take $\vec{W}=\{BH\}$, i.e., we replace the equation of $BH$ with $BH$ = 0, then AC2 holds because $BS$ = 0, and AC3 automatically holds since the cause is a singleton. Thus, $ST=1$ is a cause of $BS=1$.

4 Approach

In this section, we propose our algorithmic approaches towards the HP definition. To answer a causal question efficiently, we need to find an intelligent way to search for a $\vec{W}$ such that AC2 is fulfilled as well as to check whether AC3 holds. Therefore, we propose an approach that uses SAT-solving. We show how to encode AC2 into a formula whose (un)satisfiability and thus the (un)fulfillment of AC2 is determined by a SAT-solver. Similarly, we show how to generate a formula whose satisfying assignments obtained with a solver indicate if AC3 holds.

4.1 Checking AC2

For AC2, such a formula $F$ has to incorporate (1) $\neg\varphi$, (2) a context $\vec{u}$, (3) a setting, $\vec{x}^{\prime}$ for candidate cause, $\vec{X}$, and (4) all possible variations of $\vec{W}$, while still (5) keeping the semantics of the underlying model $M$. In the following, we describe the concept and, then, the algorithm that generates such a formula $F$. Since we check actual causality in hindsight, we have a situation where $\vec{u}$ and $\vec{v}$ are determined, and we have a candidate cause $\vec{X}\subseteq\vec{V}$. Thus, the first two requirements are straightforward. First, the effect $\varphi$ should not hold anymore, hence, $\neg\varphi$ holds. Second, the context $\vec{u}$ should be set to its values in the original assignment (the values $\vec{u}$ of $\vec{U}$).

Since we are treating binary models only, the setting $\vec{x}^{\prime}$ (from AC2) can be tailored down to negating the original value of each cause variable. This is a result of Lemma 2, which utilizes the fact that we are considering binary variables to exclude other possible settings and define precisely the setting $\vec{x}^{\prime}$. The proof of the Lemma is given in Appendix A. Thus, to address the third requirement, according to Lemma 2, for $\neg\varphi$ to hold, all the variables of the candidate cause $\vec{X}$ are negated.

Lemma 2

In a binary model, if $\vec{X}=\vec{x}$ is a cause of $\varphi$, according to Definition 2, then every $\vec{x}^{\prime}$ in the definition of AC2 always satisfies $\forall i.x_{i}^{\prime}=\neg x_{i}$.

To ensure that the semantics of the model are reflected in $F$ (requirement 5), we use the logical equivalence operator ($\leftrightarrow$) to express the equations. Particularly, to represent the endogenous variable $V_{i}$ and its dependency on other variables, we use this clause $V_{i}\leftrightarrow F_{V_{i}}$. This way, we create a (sub-)formula that evaluates to true if both sides are equivalent in their evaluation. If we do so for all other variables (that are not affected by criteria 1-3), we ensure that $F$ is only satisfiable for assignments that respect the semantics of the model.

Finally, we need to find a possibility to account for $\vec{W}$ (requirement 4) without having to iterate over the power-set of all variables. In $F$, we accomplish this by adding a disjunction with the positive or negative literal of each variable $V_{i}$ to the previously described equivalence-formula, depending on whether the actual evaluation of $V_{i}$ was $1$ or [math], respectively. Then, we can interpret $((V_{i}\leftrightarrow F_{V_{i}})\lor(\neg)V_{i})$ as “$V_{i}$ either follows the semantics of $M$ or takes on its original value represented as a positive or negative literal”. By doing so for all endogenous variables, we allow for all possible variations of $\vec{W}$. It is worth noting that we exclude those variables that are in $\vec{X}$ from obtaining their original value, as we are already changed their setting to $\neg\vec{x}$ and thus keeping a potential cause at its original value is not reasonable. Obviously, it might not make sense to always add the original value for all variables. We leave this as a candidate optimization for a future work.

AC2 Algorithm

We formalize the above in Algorithm 1. The evaluation, in the input, is a list of all the variables in $M$ and their values under $\vec{u}$. The rest is self-explanatory. We slightly change the definition of $\varphi$ from a combination of primitive events to a combination of literals. For instance, instead of writing $\varphi=(X_{1}=1\land X_{2}=0\lor X_{3}=1)$, we would use $\varphi=(X_{1}\land\neg X_{2}\lor X_{3})$. In other words, we replace each primitive $(X=x)\in\varphi$ with $X$ if $x=1$ or $\neg X$ if $x=0$ in the original assignment, such that we use $\varphi$ in a formula. The same logic is achieved using the function $f({Y}={y})$ in line 5 of the algorithm.

Before we construct formula $F$, we check if $\vec{X}=\vec{x}$ given $\vec{W}=\emptyset$ (line 3) fulfills AC2. Hence, in this case, we do not need to look for a $\vec{W}$. Otherwise, we construct $F$ (line 5) that is a conjunction of $\neg\varphi$ and the exogenous variables of $M$ as literals depending on $\vec{u}$. Note that $\varphi$ does not necessarily consist of a single variable only; it can be any Boolean formula. For example, if $\varphi=(BS=1\land BH=0)$ in the notation as defined by [11], we would represent it in $F$ as $(BS\land\neg BH)$. This consideration is handled by Algorithm 1 without further modification. In addition, we represent each endogenous variable, $V_{i}\not\in\vec{X}$ with a disjunction between its equivalence formula $V_{i}\leftrightarrow F_{V_{i}}$ and its literal representation. To conclude the formula construction, we add the negation of the candidate cause $\vec{X}=\vec{x}$, a consequence of Lemma 2.

If $F$, represented in a conjunctive normal form, is satisfiable, we obtain the satisfying assignment (line 7) and compute $\vec{W}$ (line 8) as the set of those variables whose valuations were not changed in order to ensure $\neg\varphi$ that is finally returned. If $F$ is unsatisfiable, not satisfiable is returned.

Minimality of $\vec{W}$

In Algorithm 1, we considered $\vec{W}$ to consist of all the variables whose original evaluation and satisfying assignments are equal. This is an over-approximation of the $\vec{W}$ set because, possibly, there are variables that are not affected by changing the values of the cause, and are yet not required to be fixed in $\vec{W}$. Despite this consideration, a non-minimal $\vec{W}$ is still valid according to HP. However, to compute the degree of responsibility [6], a minimal $\vec{W}$ is required. Therefore, we briefly discuss a modification that yields a minimal $\vec{W}$.

We need to modify two parts of Algorithm 1. First, we cannot just consider one satisfying assignment for $F$. Rather, we need to analyze all the assignments. Determining all the assignments is called an All-SAT problem. Second, we have to further analyze each assignment of $\vec{W}$ to check if we can find a subset such that $F$, and thus AC2, still holds. Specifically, we check if each element in $\vec{W}$ is equal to its original value because it was explicitly set so, or because it simply evaluated according to its equation. In the latter case, it is not a required part of $\vec{W}$. Precisely, in Algorithm 1, everything stays the same until the computation of $F$. After that, we check whether $F$ is satisfiable, but now we compute all the satisfying assignments. Subsequently, for each satisfying assignment, we compute $\vec{W_{i}}$ as explained. Then, we return the smallest $\vec{W_{i}}$, at the cost of iterating over all satisfying assignments of the variables in $V$.

4.2 Checking AC3

Our approach for checking AC3 using SAT is very similar to the one for AC2. We construct another SAT formula, $G$. The difference between $G$ and $F$ is in how the parts of the cause are represented. In $G$, we allow each of them to take on its original value or its negation (e.g., $A\lor\neg A$). Clearly, we could replace that disjunction with true or $1$. However, we explicitly do not perform this simplification such that a satisfying assignment for $G$ still contains all variables of the causal model, $M$.

In general, the idea is as follows. If we find a satisfying assignment for $G$ such that at least one conjunct of the cause $\vec{X}=\vec{x}$ takes on a value that equals the one computed from its corresponding equation, then, we know that this particular conjunct is not required to be part of the cause and there exists a subset of $\vec{X}$ that fulfills AC2 as well. The same applies if the conjunct is equal to its original value in the satisfying assignment; this would mean that it is part of a $\vec{W}$ such that $\neg\varphi$ holds. When collecting all those conjuncts, we can construct a new cause $\vec{X}^{\prime}=\vec{x}^{\prime}$ by subtracting them from the original cause and then checking whether or not it fulfills AC1. If it does, AC3 is violated because we identified a subset $\vec{X}^{\prime}$ of $\vec{X}$ for which both AC1 and AC2 hold.

AC3 Algorithm

We formalize our approach in Algorithm 2. The input and the function $f(V_{i}=v_{i})$ remain the same as for Algorithm 1; the latter is omitted. In case $\vec{X}=\vec{x}$ is a singleton cause or $\varphi$ did not occur, AC3 is then fulfilled automatically (line 3). Otherwise, line 4 shows how formula $G$ is constructed. This construction is only different from the construction of $F$ in Algorithm 1 in how to treat variables $\in\vec{X}$. They are added as a disjunction of their positive and negative literals. Once $G$ is constructed, we check its satisfiability, if it is not satisfiable we return true, i.e., AC3 is fulfilled. For example, this can be the case if the candidate cause $\vec{X}$ did not satisfy AC2. Otherwise, we check all its satisfying assignments. We need to do this, as $G$ might also be satisfiable for the original $\vec{X}=\vec{x}$ so that we cannot say for sure that any satisfying assignment found, proves that there exists a subset of the cause. Instead, we need to obtain all of them. Obviously, this is problematic and could decrease the performance if $G$ is satisfiable for a large number of assignments. Therefore, we plan to address this in future work.

However, for now, we compute one assignment and check the count of the conjuncts in the cause that have different values in $\vec{v^{\prime}}$ than their original, and that their formula does not evaluate to this assignment (line 6). If the count is less than the size of the cause, then AC3 is violated. Otherwise we check another assignment.

Combining AC2 and AC3

While developing Algorithm 1 and Algorithm 2, we discovered that combining both is an option for optimizing our approach. In particular, we can exploit the relationship between the satisfying assignment(s) for the formulas $F$ and $G$, i.e., $\vec{a}_{F}\in A_{G}$. This holds, as we allow the variables $\vec{X}$ of a cause to be both $1$ or [math] in $G$ so that we can show that the satisfying assignment, $\vec{a}_{F}$ for $F$ in Algorithm 1 is an element of the satisfying assignments $A_{G}$, for $G$. Then, instead of computing both $F$ and $G$, we could just compute $G$, then filter those satisfying assignments that $F$ would have yielded and use them for checking AC2 while we use all satisfying assignments of $G$ to check AC3.

4.3 Example

Recall the example from Section.3. Since the context $\vec{u}$ sets $ST=1$ and $BT=1$, the original evaluation of the model is shown in the first row of Table.1. We want to find out whether $ST=1$ is a cause of $BS=1$. Algorithm.1 generates the following $F$, that is satisfiable for one assignment (Table.1 second row): $BS=0$, $SH=0$, $BH=0$, $ST=0$, $BT=1$. All the variables, except $BH$ and $BT$, change their evaluation. Thus, we conclude that $ST=1$ fulfills AC2 with $\vec{W}=\{BH,BT\}$. Notice that even though this $\vec{W}$ is not minimal, it is still valid. That said, we still can calculate a minimal $\vec{W}$.

[TABLE]

To illustrate checking AC3, we ask a different question: are $ST=1$ and $BT=1$ a cause of $BS=1$? Note that AC2 is fulfilled with $W=\emptyset$, for this cause. Obviously, if both do not throw, the bottle does not shatter. Using Algorithm 2, we obtain the following $G$ formula.

[TABLE]

As Table.1 shows, $G$ is satisfiable with two assignments $\vec{a}_{1}$ and $\vec{a}_{2}$. For $\vec{a}_{1}$, we can see that both $ST$ and $BT$ have values different from their original evaluation, and that both do not evaluate according to their equations. Thus, we cannot show that AC3 is violated, yet. For $\vec{a}_{2}$, $BT=1$, so it is equal to the evaluation of its equation. Consequently, $BT$ is not a required part of $\vec{X}$, because $\neg\varphi=\neg BS$ still holds although we did not set $BT=0$. So, AC3 is not fulfilled because AC1 and AC2 hold for a subset of the cause.

5 Evaluation

In this section, we provide details on the implementation of our algorithms, and evaluate their efficiency.

5.1 Technical implementation

Our implementation is a Java library. As such, it can easily be integrated into other systems. It supports both the creation of binary causal models as well as solving causality problems. For the modeling part and the implementation of our SAT-based approach, we take advantage of the library LogicNG 333https://github.com/logic-ng/LogicNG . It provides methods for creating and modifying boolean formulas and allows to analyze those using different SAT solvers. We use the implementation of MiniSAT solver [8] within LogicNG. For the sake of this evaluation, we will compare the execution time and memory allocation for the following four strategies: BRUTE_FORCE -a standard brute-force implementation of HP, SAT -SAT-based approach (Algorithm1, 2), SAT_MINIMAL -the minimal $\vec{W}$ extension, and SAT_COMBINED -optimization of the SAT-based approach by combining AC2 and AC3. All our measurements were performed on Ubuntu 16.04 LTS machine equipped with an Intel® Core™ i7-3740QM CPU and 8 GB RAM. For each benchmark, we specified 100 warmup and 100 measurement iterations.

5.2 Methodology and Evaluated Models

In summary, we experimented with 12 different models. On the one hand, we took the binary models from [11]. There were 5 of them in total, namely, Rock-Throwing, Forest Fire, Prisoners, Assassin, and Railroad. Since these examples are rather small ($\leq$ 5 variables) and easy to understand, they mainly serve for sanity checks of our approach. On the other hand, we used examples that do not stem from the literature on causality. One is a security example obtained from an industrial partner. It describes the causal factors that lead to stealing a security master key by an insider. We refer to it as SMK. We used two variants of that example, one with 3 suspects, and the other with 8 suspects. We also used one example from the safety domain that describes a leakage in a sub-sea production system; we refer to it as LSP. Last, we artificially generated models of binary trees with different heights, denoted as $BT_{depth}$, and combined them with other random models (non-tree graphs), denoted as ABT. For a thorough description of each model, please refer to this report [16]. Table 2 shows the list of the bigger models, along with the number of endogenous variables. In total, we analyzed 278 scenarios, however, for space limits, we focus on a subset of the scenarios.

\DTLloaddbtex\rockthrowingselected

data/brute_vs_sat.dbtex

5.3 Discussion and Results

In this section, we discuss some representative cases from our experiments. Table 3 shows the details of these cases. The first two columns show the scenario identifier, namely, the name of the model and the ID of the scenario that differs in the details of the causal query, i.e., $\vec{X}$ and $\varphi$. The latter are shown in the third and fourth columns. Then, the results of the three conditions are displayed in columns AC1-AC3. The size of the minimal W set is displayed in the next column. Finally, for each algorithm, the execution time and memory allocation are shown. We write N/A in cases where the computation was not completed in 5 minutes or consumed too much memory. As a general remark, it does not matter which algorithm is applied if AC2 holds for an empty $\vec{W}$ and AC3 holds automatically, i.e., $\vec{X}$ is a singleton.

As expected, the Brute-Force approach (BF) works only for smaller models (<5 variables), or in situations where only a few iterations are required. Such as scenarios LSP-3, and SMK-29. Specifically, we see these situations when AC2 holds with a small or empty $\vec{W}$, and AC3 does not hold. That is, the number of iterations BF performs is small because the sets, $\vec{W}_{i}$ are ordered by size. Such examples did not exhibit the major problem of BF, i.e., the generation of all possible sets, $\vec{W}_{i}$ whose number increases exponentially, and the iterations BF might, therefore, perform to check minimality in AC3.

For larger models ( >30 variables), BF did not return an answer in 5 minutes, especially when AC2 does not hold. This is seen by the several N/A entries in Table 3. For example, in the SMK, the set of all possible $\vec{W}_{i}$ has a size of up to $2^{35}$. In the worst case, this number of iterations is required for finding out that AC2 does not hold. It is possible that this number of iterations multiplied by the number of subsets of the cause needs to be executed again to check AC3. This causes BF to be extremely slow and to consume a lot of memory. The SAT by contrast, always stays below 1.5 ms and allocates less than 1.5 MB during the execution for all scenarios of the SMK. Even if larger models were considered, SAT handles them efficiently, e.g., BT 34 - 35, where the underlying causal model contains 4095 variables, executed in $\leq 7s$. However, the latter scenarios are special because AC2 does not hold. In ABT 1, 4 and 5, we can see that even if AC2 does hold and $\vec{W}$ is not empty, SAT takes only $8s$.

While obtaining a minimal $\vec{W}$ using our approach showed a rather small impact relative to the SAT approach in most of the scenarios, it showed a significant increase in some scenarios. This impact was highly dependent on the nature and semantics of the underlying causal model. That is, we can only observe a major impact if the number of satisfying assignments or the size of a non-minimal $\vec{W}$ is large as this will significantly extend the analysis. For instance, in SMK-3, the execution time increased by about $22\%$. Nonetheless, there are scenarios in which we observed a significant increase, such as the ABT-4 scenario. Here, the non-minimal $\vec{W}$ contains more than 4000 elements, leading to an increase of more than 200% in the execution time required to determine a minimal $\vec{W}$.

Finally, combining the algorithms for AC2 and AC3 is only beneficial if AC2 and AC3 need to be explicitly analyzed (AC2 does not hold for an empty W, and the cause is not a singleton). We have many such scenarios in our examples. In evaluating them, we found out that there is a positive impact in using this optimization, but it is rather small on the average. Larger differences can be seen, for instance, in ABT-5 where the SAT-based approach executes for $7906ms$ while the current optimization takes $3803ms$.

The main finding of our experiments is that actual causality can be computed efficiently with our SAT-based approach. Within binary models of 4000 variables, we were able to obtain a correct answer for any query in less than $4$ seconds, using a memory of 1 GB.

6 Conclusions and Future Work

It is difficult to devise automated assistance for causality reasoning in modern socio-technical systems. Causality checking, according to the formal definitions, is computationally hard. Therefore, efficient approaches that scale to the complexity of such systems are required. In the course of this, we proposed an intelligent way to utilize SAT solvers to check actual causality in binary models in a large scale that we believe to be particularly relevant for accountability purposes. We empirically showed that it can efficiently compute actual causality in large binary models. Even with only 30 variables, determining causality in a brute force manner is incomputable, whereas our SAT-based approach returned a result for such cases in 1 ms. In addition, causal models consisting of more than 4000 endogenous variables were still handled within seconds using the proposed approach.

For future work, we will consider other logic programming paradigms such as integer linear programming and answer set programming to develop our approach from checking to possibly inferring causality. Moreover, a thorough characterization of causal model classes that affect the efficiency of the proposed approach is a useful follow-up to this work. We plan to extend our benchmark with models of different patterns, and different cardinalities of causes.

Appendix A Appendix: Lemma Proof

Lemma 3

In a binary model, if $\vec{X}=\vec{x}$ is a cause of $\varphi$, according to HP [11] definition, then every $\vec{x}^{\prime}$ in the definition of AC2 always satisfies $\forall i\bullet x_{i}^{\prime}=\neg x_{i}$.

Proof 1

We use the following notation: $\overrightarrow{X}_{(n)}$ stands for a vector of length $n$, $X_{1},\ldots,X_{n}$; and $\overrightarrow{X}_{(n)}=\overrightarrow{x}_{(n)}$ stands for $X_{1}=x_{1},\ldots,X_{n}=x_{n}$. Let $\overrightarrow{X}_{(n)}=\overrightarrow{x}_{(n)}$ be a cause for $\varphi$ in some model $M$.

AC1 yields

[TABLE] 2. 2.

Assume that the lemma does not hold. Then there is some index $k$ such that $x_{k}^{\prime}=x_{k}$ and AC2 holds. Because we are free to choose the ordering of the variables, let us set $k=n$ wlog. We may then rewrite AC2 as follows:

[TABLE] 3. 3.

We will show that equations 1 and 2 give rise to a smaller cause, namely $\overrightarrow{X}_{(n-1)}=\overrightarrow{x}_{(n-1)}$, contradicting the minimality requirement AC3. We need to show that the smaller cause $\overrightarrow{X}_{(n-1)}=\overrightarrow{x}_{(n-1)}$ satisfy AC1 and AC2, as stated by equations 3 and 4 below. This violates the minimality requirement of AC3 for $\overrightarrow{X}_{(n)}=\overrightarrow{x}_{(n)}$.

[TABLE]

states AC1 for a candidate “smaller” cause $\overrightarrow{X}_{(n-1)}$. Similarly,

[TABLE]

formulates AC2 for this candidate smaller cause $\overrightarrow{X}_{(n-1)}$. 4. 4.

Let $\Psi$ denote the structural equations that define $M$. Let $\Psi^{\prime}$ be $\Psi$ without the equations that define the variables $\overrightarrow{X}_{(n)}$ and $\overrightarrow{W}$; and let $\Psi^{\prime\prime}$ be $\Psi$ without the equations that define the variables $\overrightarrow{X}_{(n-1)}$ and $\overrightarrow{W}$. Clearly, $\Psi^{\prime\prime}\implies\Psi^{\prime}$.

We can turn equation 1 into a propositional formula, namely

[TABLE]

Similarly, equation 3 is reformulated as

[TABLE]

Because equation 2 holds, we fix some $\overrightarrow{W},\overrightarrow{w},\overrightarrow{x}_{(n)}^{\prime}$ that make it true and rewrite this equation as

[TABLE]

Finally, in equation 4, we use exactly these values to also fix $\overrightarrow{W}^{*}=\overrightarrow{W}$, $\overrightarrow{w}^{*}=\overrightarrow{w}$, and $\overrightarrow{x}_{(n-1)}^{\prime*}=\overrightarrow{x}_{(n-1)}^{\prime}$, and reformulate this equation as

[TABLE]

It is then a matter of equivalence transformations to show that

[TABLE]

is a tautology, which proves the lemma.