Relational Reasoning via Probabilistic Coupling
Probabilistic coupling is a powerful tool for analyzing pairs of probabilistic processes. Roughly, coupling two processes requires finding an appropriate witness process that models both processes in the same probability space. Couplings are powerful tools proving properties about the relation between two processes, include reasoning about convergence of distributions and stochastic dominance—a probabilistic version of a monotonicity property.
While the mathematical definition of coupling looks rather complex and cumbersome to manipulate, we show that the relational program logic pRHL—the logic underlying the EasyCrypt cryptographic proof assistant—already internalizes a generalization of probabilistic coupling. With this insight, constructing couplings is no harder than constructing logical proofs. We demonstrate how to express and verify classic examples of couplings in pRHL, and we mechanically verify several couplings in EasyCrypt.
- 1.Barthe, G., Grégoire, B., Zanella-Béguelin, S.: Formal certification of code-based cryptographic proofs. In: ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages (POPL), Savannah, Georgia, pp. 90–101, New York (2009)Google Scholar
- 2.Barthe, G., Crespo, J.M., Kunz, C.: Relational verification using product programs. In: International Symposium on Formal Methods (FM), Limerick, Ireland, pp. 200–214 (2011a)Google Scholar
- 5.Benton, N.: Simple relational correctness proofs for static analyses and program transformations. In: ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages (POPL), Venice, Italy, pp. 14–25 (2004)Google Scholar
- 6.Deng, Y., Du, W.: Logical, metric, and algorithmic characterisations of probabilistic bisimulation. Technical report CMU-CS-11-110, Carnegie Mellon University, March 2011Google Scholar
- 10.Villani, C.: Optimal Transport: Old and New. Springer Science, Heidelberg (2008)Google Scholar