# Model Checking Quantitative Hyperproperties

## TL;DR

This paper introduces a new model checking algorithm for quantitative hyperproperties expressed in HyperLTL, significantly improving efficiency by using model-counting techniques, and demonstrates its practical viability on systems with information flow constraints.

## Contribution

It presents a novel model checking algorithm based on model-counting for quantitative hyperproperties in HyperLTL, reducing complexity and enabling practical analysis.

## Key findings

- New algorithm reduces model checking complexity exponentially or doubly exponentially.
- Prototype implementation successfully analyzes systems with quantitative information flow.
- Counting approach is feasible for systems like passcode checkers.

## Abstract

Hyperproperties are properties of sets of computation traces. In this paper, we study quantitative hyperproperties, which we define as hyperproperties that express a bound on the number of traces that may appear in a certain relation. For example, quantitative non-interference limits the amount of information about certain secret inputs that is leaked through the observable outputs of a system. Quantitative non-interference thus bounds the number of traces that have the same observable input but different observable output. We study quantitative hyperproperties in the setting of HyperLTL, a temporal logic for hyperproperties. We show that, while quantitative hyperproperties can be expressed in HyperLTL, the running time of the HyperLTL model checking algorithm is, depending on the type of property, exponential or even doubly exponential in the quantitative bound. We improve this complexity with a new model checking algorithm based on model-counting. The new algorithm needs only logarithmic space in the bound and therefore improves, depending on the property, exponentially or even doubly exponentially over the model checking algorithm of HyperLTL. In the worst case, the new algorithm needs polynomial space in the size of the system. Our Max#Sat-based prototype implementation demonstrates, however, that the counting approach is viable on systems with nontrivial quantitative information flow requirements such as a passcode checker.