Parameterised Ratio Synthesis

Together, Theorem 1 and Theorem 2 show that Algorithm 1is a sound decision procedure for the λ-synthesis problem.

We now show that the output of λ-SYNTHESIS reflects theminimum ratio for which the Fault Tolerance problem wouldreturn false w.r.t the concrete system and specification givenas input. We prove this by means of two steps.

We now give some preliminary definitions that we will usein our procedure. For a global state g we use λ(g) to denotethe ratio of agents that have exhibited a fault to total agents,i.e.

We now describe the Lambda procedure. The proposi-tional cases are trivial: we can simply label each state whichsatisfies or does not satisfy the atomic proposition with theratio of faulty agents at that state. For the conjunction case,notice we need both φ1 and φ2 to hold so the minimum neces-sary ratio of faults is the largest of the ratios for each of thesetwo to hold. The disjunction case is similar.

This sub-procedure works similarly to the labelling algo-rithm for model checking CTL [Clarke et al., 1999]. Thealgorithm recursively labels the states of a system with thesubformulas of the specification under question that they sat-isfy. Differently from the CTL labelling algorithm, Lambdalabels states with both said subformulas and the minimum ra-tio of faulty agents to total agents that is sufficient for thespecification to be satisfied at the state. Thus, Lambda op-erates on sets of pairs of states and ratios instead of sets ofstates. Note that since Lambda takes as input the negationof an ACTLK\X formula, the procedure is defined for theexistential fragment ECTLK\X of CTLK\X.

Ourprocedure, shown in Algorithm 1, passes the system of nfaulty agents and the negation of our specification to a sub-procedure Lambda, shown in Algorithm 2.

Symbolic Synthesis of Fault-Tolerance Ratiosin Parameterised Multi-Agent Systems

Redrafting and revising Once you’ve decided where changes are needed, make the big changes first, as these are likely to have knock-on effects on the rest. Depending on what your text needs, this step might involve: Making changes to your overall argument. Reordering the text. Cutting parts of the text. Adding new text. You can go back and forth between writing, redrafting and revising several times until you have a final draft that you’re happy with.

line 2

Theorem

Sketch

The proof is similar to that of Theorem 3.4

diction

Theorem

(⇒)

Definition 3.1 (COIS). A collective open interpreted system (COIS)is an OIS O = ⟨A, E, V⟩ where the transition function of A satisfiesthe conditiont(l, a, X ∪ {a}, aE ) = t(l, a, X , aE )for all values of l, a, X and aE .

sketch

O, д |= ∀v1, ...,vn : ψ iff O, д |= ψ [v1 7 → a1] . . . [vn 7 →an ] for all pairwise disjointchoices of a1, . . . , an ∈ N.O, д |= (alv, i) iff ∃j : id(д.j) = iO, д |= (p, i) iff O, д |= (alv, i) and p ∈ V(si (д));O, д |= ¬(p, i) iff O, д ̸ |= (p, i);

EVALUATION

We introduce asemantics, based on interpreted systems, to capture the openness ofthe system and show how an indexed variant of temporal-epistemiclogic can be used to express specifications on them

Figure 3: The architecture of

he estimation of the difficulty of a problem p at splittingdepth d that we consider is defined byscore(p, d) = stability ratio(p) − stability ratio(P )d 1m,where P is the original verification problem and m is thesplitting parameter.

Algorithm

Algorithm

Lemmas 3 and 1

Dependency analyser. Given the above, we now put for-ward a procedure using the identification of dependencies toreduce the configuration space.

Dependency Analysis

Lemma 1 gives a procedure for identifying intra-layer de-pendencies by computing the right hand side of each of theabove clauses for every pair of unstable nodes in a layer.Dependencies between layers require a different treatment.

The procedure runs in time O(k · s2),where k is the number of layers and s is the layers’ maximalsize.

We now proceed to derive a procedure for computing anetwork’s dependency relations. To ease the presentation,we express dependency relations as unions of four disjointsets Df = ⋃z,z′ ∈{,⊥} Dz,z′f , where each Dz,z′f comprisesdependencies pertaining to the ReLU states z and z′, i.e.,Dz,z′f  {(ni,q , nj ,r ) | st(ni,q ) = z =⇒ st(nj ,r ) = z ′}

Example 1.

procedure D EPENDENCY ANALYSIS (milp, h)

The construction of the abstract model and its verificationagainst all formulae took approximately 5 seconds on anIntel Core i7 machine clocked at 3.4 GHz, with 7.7 GiBcache, running 64-bit Fedora 20, kernel 3.16.6. MCMAS-OFPand the ISPL-OFP file encoding the scenario are availableat [21].

Figure 1: ISPL-OFP snippet.

From the small neighbourhood assumption wehave that ˆP (γ, o) = P (g, o) ± , for each opinion o.Therefore,#(g′, o)n ≈ [%false (γ). ˆP (γ, o)] + %true (γ, o)for each opinion o.

(2) Pick n  α such that SA(n) admits every initial den-sity of opinions that is represented by the set of abstractinitial states. Define R as above. Then the proof proceedsalong the same lines with the proof in (1).

Lemma 3.11. Given an agent template A and an ACTLKformula φ, the following hold:1. for all n  α, ˆSA(1) simulates SA(n);2. there is n  α such that SA(n) simulates ˆSA(1).

Lemma 3.10. Assume that ˆSA(1) simulates SA(n) andSA(n) simulates ˆSA(1). Then, ˆSA(1) |=ab φ iff SA(n) |= φ,for any ACTLK formula φ.Proof. (⇒) Lemma 3.8. (⇐) Lemma 3.9.

Lemma 3.9. Assume that SA(n) simulates ˆSA(1). Then,SA(n) |= φ implies ˆSA(1) |=ab φ, for any ACTLK formulaφ.

A simulation relation between the abstract model and aconcrete system is defined similarly to Definition 3.7, butby swapping the LHS with the RHS in each of the clauses.

Let φ = CΓψ and assume γ |=ab φ

φ ∈ AP : from simulation requirement2;

by induction on φ.

Assume a simulation relation R betweenSA(n) and ˆSA(1).

Lemma 3.8. Assume that ˆSA(1) simulates SA(n). Then,ˆSA(1) |=ab φ implies SA(n) |= φ, for any ACTLK formulaφ.

By means of the former result, thesatisfaction of an ACTLK formula on the abstract modelentails the satisfaction of the formula on every concrete sys-tem. Conversely, by means of both results, the falsificationof an ACTLK formula on the abstract model implies the ex-istence of a concrete system that falsifies the formula

The abstract satisfaction relation |=ab is defined for groupknowledge as ( ˆSA, γ) |=ab EΓφ iff for all γ′ with γ ∼ ˆEΓ γ′,we have that ( ˆSA, γ′) |=ab φ; for common knowledge it isdefined as ( ˆSA, γ) |=ab CΓφ iff for all γ′ with γ ∼ ˆCΓ γ′,

We now establish a correspondence between the concretesystems and the abstract model

An abstract state is a set of pairs of weights and templatelocal states in R × L; it represents every concrete state inwhich the ratio of agents in each local state to all the agentsapproximates the weight associated with the state. Notethat every local state that does not appear in an abstractstate is assumed to be associated with a weight equal to 0.

To solve the PMCP we introduce the notion of weightedabstraction.

parameterised modelchecking problem [5, 10, 15

g.i

Weighted abstraction

Since swarms are typically made ofvery large numbers of agents each interacting with very fewneighbours, all systems of interest satisfy the small neigh-bourhood property.

n  α to denote this

Definition 3.2 (PMCP for small neighbourhoods).The PMCP for OFSs with small neighbourhoods of size αconcerns establishing whether the following holds:SA(n) |= φi for every n  α.

By “much greater” we mean that for anygiven global state g and opinion o, we have that( #false (g,o)#false (g))α=( #false (g,o)−α#false (g)−α)α± , for some small constant .

Given an agent template A defined on a neighbourhoodsize α ∈ N, we say that an OFS SA(n) satisfies the smallneighbourhood property if at each time step the number ofagents not in latent state is much greater than the neigh-bourhood size.

We begin by formulating the small neighbourhood prop-erty.

Definition 3.1 (PMCP). Given an agent template Aand an ACTLK formula φ, the parameterised model check-ing problem (PMCP) is the decision problem of determiningwhether the following holds:SA(n) |= φ for every n ≥ α.

Definition 2.2 (Concrete Agent).

ntuitively, different behaviours are asso-ciated with different opinions. For instance, as we exemplifyin Section 4, the latent value can be used to keep trackof the time an agent is engaged in the protocol before itgoes into latent state; this period of time is proportionalto its currently held opinion. For a local state l, we writeopinion(l), value(l), and latent(l) to denote the opinion, thelatent value, and the latent status, respectively, encoded in l.We assume that whenever latent(l) = false and t(l, o) = l′,then opinion(l′) = o; i.e, at each time step, an agent switchesto the majority opinion in its neighbourhood if not in latentstate.

Note that a local state is built from an observable com-ponent representing an opinion, and a non-observable com-ponent associated with a latent value and the latent status

Definition 2.1 (Agent Template). An agent templateis a tuple A = (O, h, α, t), where:• O is a nonempty and finite set of opinions;• h : O → N is a mapping from the set of opinionsinto the set natural numbers, where h(o) represents thequality of opinion o. O and h define a setL = {(o, v, l) : o ∈ O, 0 ≤ v ≤ max(h(o) : o ∈ O),l ∈ {false, true}}of local states, where each triple (o, v, l) encodes anopinion o, a latent value v, and whether or not thetemplate is into latent state (l = true, and l = false,respectively);• α ∈ N is the size of the neighbourhood for the templateat any given time step;• t : L × O → L is a transition function that returns thenext local state given the current local state and themajority opinion held by neighbouring agents.

n its simplest form, a majority-rule protocol is describedas follows [18]. At each time step a team of three randomlypicked agents is formed. Each agent can be in one of twostates; each state is associated with one of two opinions. Themembers of a team adopt the opinion held by the majorityof the members in team. This process is repeated until con-sensus is reached on one of the two opinions. Studies haveshown that a collective agreement is eventually establishedon the opinion with the highest initial density [18].

arameterised model checking has previously been appliedfor the analysis of generic swarm systems of an arbitrarynumber of components [16]. In this paper we extend themethodology put forward in [16] to model consensus proto-cols following the majority rule

A key issue with opinion formation protocols is to investi-gate their convergence. In this paper we put forward a for-mal methodology that can be applied to analyse consensusprotocols that follow the majority rule.

Theorem 3.12. Given an agent template A and an ACTLKformula φ, the following hold:1. ˆSA(1) |= φ implies ∀n  α. SA(n) |= φ.2. ˆSA(1) 6 |= φ implies ∃n  α. SA(n) 6 |= φ.

OPINION FORMATION SEMANTICS

We investigate the formal verification of consensus proto-cols in swarm systems composed of arbitrary many agents

Formal Verification of Opinion Formation in Swarms

he experimental resultsobtained show 145% performance gains over thepresent state-of-the-art in complete verification.

We evaluatethe method on all of the ReLU-based fully con-nected networks from the first competition for neu-ral network verification.

This results individing the original verification problem into aset of sub-problems whose MILP formulations re-quire fewer integrality constraints.

The method implements branchingon the ReLU states on the basis of a notion ofdependency between the nodes.

We introduce an efficient method for the com-plete verification of ReLU-based feed-forward neu-ral networks

1a

Figure 1: A ReLU FFNN. A dashed arrow from x(i)j to x(q)r withlabel ss′ indicates that the s′ state of node n(q)r depends on the sstate of node n(i)j .

Figure 2: The dependency graph of the network from Figure 1. An edge from vertex (n, s) to vertex (n′, s′) represents that the s′ state ofnode n′ depends on the s state of node n. The rectangles highlight the active and inactive dependency trees of node n(1 )2 .

Proof. The proof is by straightforward induction on thebranching depth.

Conclusions

Evaluation

Dependency-based Branching

Background

Theorem 1 (Soundness and completeness). Given a verifi-cation problem (f , X , Y), the procedure VERIFY((f , X , Y))from Algorithm 1 returns yes iff ∀x ∈ X : f (x) ∈ Y

Algorithm 1 The verification procedure.

Video PreTraining (VPT): Learning to Act byWatching Unlabeled Online Videos

While we commit to GPs for theexploration analysis, for safety any suitable, well-calibrated model is applicable.Assumption 2 (well-calibrated model). Let μn(·) and Σn(·) denote the posterior mean and covari-ance matrix functions of the statistical model of the dynamics (1) conditioned on n noisy measurements.With σn(·) = trace(Σ1/2n (·)), there exists a βn > 0 such that with probability at least (1 − δ) it holdsfor all n ≥ 0, x ∈ X , and u ∈ U that ‖f (x, u) − μn(x, u)‖1 ≤ βnσn(x, u)

σn(·) = trace(Σ1/2n (·))

His concern is with the rest: the “me, too” drugs that provide no benefit and those that are actively harmful.

steganography

Strategy: train a reporter which isn’t useful for figuring out what the human will believe

PROST: Probabilistic Planning Based on UCT

to our best knowledge, MDPswith hard constraints have yet been studied

MG′

TE

UXa

Moreover, specializing to reinforcement learning, the one-step Bellman optimality condition for optimizing this objec-tive in expectation is:vπ∗ [M,G′ , ̄a,π]= maxa0∑s1,r1p (s1 | z0, s0, do(A0 = a0))p (r1 | z1 ̄a, s1, do(A0 = a0)) p (z1 ̄a | z0, s0)·[r0 + γvπ∗ [M,G′ , ̄a,π](r1, z1 ̄a)], (6)where γ is the discount rate.

timestep

average score

update frequencies of the candidatepolicies in the Corridor environments.

number of queries

Algorithm 1

Πc ← initialize candidate policies

r ← mean estimate of the reward model; ̄π∗ ← RL( ̄r)

ˆy

H

CONCLUSION

That is to say, the exogenous variable that is the user’s preferencesetc., at time 𝑥, is represented as 𝜃𝑇𝑥

i) ‘static’ machine learning approaches [2, 6, 9, 16, 18];

The agent heavily exploits user tampering even thoughwe were able to generate similar cumulative rewardswith our crude ‘baseline’ policy.

If the recommendation to both Alice and Bob at the next time-step– say, 𝐴𝑥 – is an article about federal politics, it is intuitively untruethat the distribution over possible states at 𝑆𝑥+1 is the same; Aliceis surely more likely to observably engage with this content.

User Tampering in Reinforcement Learning RecommenderSystems

Chart

The Thrill Is Gone