Abstract Interpretation with Higher-Dimensional Ellipsoids and Conic Extrapolation

Transcription

1 Abstract Interpretation with Higher-Dimensional Ellipsoids and Conic Extrapolation or potatoes & ice cream cones Mendes Oulamara, Arnaud Venet Computer Aided Verification, 2015 July 22, 2015 ÉCOLE NORMALE SUPÉRIEURE This material is based upon work supported by the NSF, Grant No / 20

2 Loop Analysis with Ellipsoidal Cones Case Study Ellipsoids are Useful Ellipsoidal Cones Use of Semidefinite Programming Prototyping 2 / 20

3 Case Study Inputs Command Input Buffer 1 Program Push Buffer 2 Switch Output Buffer 3 3 / 20

4 Case Study Inputs Command Input Buffer 1 Program Push Buffer 2 Switch Output Buffer 3 Can be abstracted as 1: x 0 R n 2: (A i, b i) 1 i k 3: where b i R n, A i M n(r) 4: for y from 0 to do 5: i rand(1, n) 6: x A ix + b i 3 / 20

5 Case Study x 1 x x 1 x 1 1 Example with two counters, we have either : x 2 x x 2 x 2 4 / 20

6 Case Study x 1 x x 1 x 1 1 Example with two counters, we have either : x 2 x x 2 x 2 4 / 20

7 Case Study x 1 x x 1 x 1 1 Example with two counters, we have either : x 2 x x 2 x 2 4 / 20

8 Case Study x 1 x x 1 x 1 1 Example with two counters, we have either : x 2 x x 2 x 2 4 / 20

9 Case Study A 3D view of the iterations, with x1 and x2 as x and y coordinates and the z coordinate representing the loop counter / 20

10 Case Study We could use the polyhedra abstract domain to approximate this set / 20

11 Case Study We could use the polyhedra abstract domain to approximate this set. But their manipulation has an exponential complexity in the number of numerical variables / 20

12 Ellipsoids are Useful There is a widely used object in science to approximate clouds of points: Ellipsoids. 7 / 20

13 Ellipsoids are Useful There is a widely used object in science to approximate clouds of points: Ellipsoids. They have a polynomial (quadratic) representation and the operations we will apply to them are polynomial (union, test of inclusion... ). 7 / 20

14 Ellipsoids are Useful Recall the mathematical definition of an n-dimensional ellipsoid: 8 / 20

15 Ellipsoids are Useful Recall the mathematical definition of an n-dimensional ellipsoid: Let Q be a symmetric n n matrix ( which ) is definite positive (that is, all its 1 0 eigenvalues are positive). E.g / 20

16 Ellipsoids are Useful Recall the mathematical definition of an n-dimensional ellipsoid: Let Q be a symmetric n n matrix ( which ) is definite positive (that is, all its 1 0 eigenvalues are positive). E.g. 0 2 We ( define ) the quadratic form associated to Q by F : x x T Qx. E.g. x F : ( x y ) ( ) ( ) 1 0 x = x 2 + 2y 2 y 0 2 y 8 / 20

17 Ellipsoids are Useful Recall the mathematical definition of an n-dimensional ellipsoid: Let Q be a symmetric n n matrix ( which ) is definite positive (that is, all its 1 0 eigenvalues are positive). E.g. 0 2 We ( define ) the quadratic form associated to Q by F : x x T Qx. E.g. x F : ( x y ) ( ) ( ) 1 0 x = x 2 + 2y 2 y 0 2 y The associated ellipsoid is given by the set {x R n with F (x) 1}. 8 / 20

18 Ellipsoidal Cones The Ellipsoidal Cones Abstract Domain overapproximates the domain of the numerical variables (the x i s in the example) by an ellipsoid whose radius grows linearly in the loop counters / 20

19 Ellipsoidal Cones The formal definition of such a cone is: Con((q, c), (β i, δ i, λ i, b i) 1 i k ) = {(x, y) R n R k i 1, k, y i λ i i 1, k, (b i (y i = λ i)) k k q(x c (y i λ i)δ i) ( β i(y i λ i) + 1) 2 } i=1 i=1 10 / 20

20 Ellipsoidal Cones The formal definition of such a cone is: Con((q, c), (β i, δ i, λ i, b i) 1 i k ) = {(x, y) R n R k i 1, k, y i λ i i 1, k, (b i (y i = λ i)) k k q(x c (y i λ i)δ i) ( β i(y i λ i) + 1) 2 } i=1 i=1 On these cones we define: A test of inclusion Affine transformations Counter increments Addition and removal of counters A widening operator Variable packing 10 / 20

21 Loop Analysis with Ellipsoidal Cones Use of Semidefinite Programming What is SDP? A Standard Example: How to Join Ellipsoids Prototyping 11 / 20

22 What is SDP? Semidefinite Programming (SDP) is a bit like Linear Programming but with quadratic form. 12 / 20

23 What is SDP? Semidefinite Programming (SDP) is a bit like Linear Programming but with quadratic form. Definition (Linear Matrix Inequality (LMI)) A Linear Matrix Inequality (in this context) is an equation of the type: α 1A 1 + α 2A α pa p 0 where the α i s are reals, the A i s are symmetric matrices and A 0 means A is semidefinite positive. 12 / 20

24 What is SDP? Semidefinite Programming (SDP) is a bit like Linear Programming but with quadratic form. Definition (Linear Matrix Inequality (LMI)) A Linear Matrix Inequality (in this context) is an equation of the type: α 1A 1 + α 2A α pa p 0 where the α i s are reals, the A i s are symmetric matrices and A 0 means A is semidefinite positive. ( ) ( ) x , max y 0 x 0 2 y Definition (SDP Problem) An SDP problem is a system of LMI s to verify, and a variable to maximize. Their approximate resolution has a polynomial complexity. 12 / 20

25 A Standard Example: How to Join Ellipsoids We will study the question of joining two ellipsoids: It is simpler than operations on ellipsoidal cones but it contains all the core ideas of how they work and ellipsoidal operations are the cornerstone of their definition. 13 / 20

26 A Standard Example: How to Join Ellipsoids The first step is to express the inclusion of two ellipsoid as an LMI: 14 / 20

27 A Standard Example: How to Join Ellipsoids The first step is to express the inclusion of two ellipsoid as an LMI: Theorem Ell(Q, c) Ell(Q, c ) min {β s.t. λ 0 and βe n+1 + λf (Q, c) F (Q, c )} 0 λ,β R ( ) Q Qc 0 0 Here, F (Q, c) = c T Q c T and E n+1 =. Qc / 20

28 A Standard Example: How to Join Ellipsoids Computing a candidate result: The SDP program looks like: System of LMI s to say Ell(Q 1, c 1) Ell(Q, c )... System of LMI s to say Ell(Q p, c p) Ell(Q, c ) System of LMI s to minimize the volume of Ell(Q, c ) Many equations (Linear Matrix Inequalities) SDP solver Candidate result 15 / 20

29 A Standard Example: How to Join Ellipsoids The SDP solver provides us with a floating-point candidate result Ell(Q, c ). There can be approximation errors. We know have to check that the result is sound, that is, the Ell(Q i, c i) s are actually subsets of Ell(Q, c ). 16 / 20

30 A Standard Example: How to Join Ellipsoids Checking the soundness: By the previous theorem, we have inclusion if and only if: min λ,β R {β s.t. λ 0 and βe n+1 + λf (Q, c) F (Q, c )} 0 17 / 20

31 A Standard Example: How to Join Ellipsoids Checking the soundness: By the previous theorem, we have inclusion if and only if: min λ,β R {β s.t. λ 0 and βe n+1 + λf (Q, c) F (Q, c )} 0 LMI with different matrices SDP solver Check that the LMI is really verified with interval arithmetic and Cholesky decomposition Check Inflate (unlike polyhedra), increase precision, etc. No Yes Yay! 17 / 20

32 Loop Analysis with Ellipsoidal Cones Use of Semidefinite Programming Prototyping 18 / 20

33 Prototyping A prototype with most operations has been coded in Python using Picos and CVXOPT for SDP programming Numpy for floating-point math computations mpmath for interval arithmetic and Cholesky decomposition Some benchmarks were run to compare with abstract interpretation with polyhedra (using the Apron library). 1: x 0 R n 1: x 0 R n 2: (A 2: for y from 0 to do i, b i) 1 i k 3: where b 3: pick i 1, n i R n, A i M n(r) 4: for y from 0 to do 4: pick ɛ { 1, 1} 5: i rand(1, n) 5: x i x i + ɛ 6: x A ix + b i n Ell. cones 3s 7s 19s 49s 1m56s 4m16s 8m 12m Polyhedra <0.1s <0.1s 0.3s 2.5s 54s 47m >1h >1h Benchmark Ell. Cones 1s 2s 2s 2s 1.8s 1.2s 1.3s Polyhedra 3.2s 16.6s 18s 24s >1h >1h 2m35s 19 / 20

34 Conclusion We proposed an Abstract Interpretation framework to analyze loops when the radius evolves (sub-)linearly in the loop counters, that uses semidefinite programming to both compute the result and check its soundness, but does not rely on the correctness of the solver to ensure that the floating-point result is a mathematically valid result, via overapproximations and interval arithmetic. Thank you! Questions? 20 / 20