Justifications for Common Knowledge

Transcription

1 - Justifications for Common Knowledge Samuel Buceli Roman Kuznets Tomas Studer Institut für Informatik und angewandte Matematik, Universität Bern Neubrückstrasse 10, CH-3012 Bern (Switzerland) {buceli, kuznets, ABSTRACT. Justification logics are epistemic logics tat explicitly include justifications for te agents knowledge. We develop a multi-agent justification logic wit evidence terms for individual agents as well as for common knowledge. We define a Kripke-style semantics tat is similar to Fitting s semantics for te Logic of Proofs LP. We sow te soundness, completeness, and finite model property of our multi-agent justification logic wit respect to tis Kripke-style semantics. We demonstrate tat our logic is a conservative extension of Yavorskaya s minimal bimodal explicit evidence logic, wic is a two-agent version of LP. We discuss te relationsip of our logic to te multi-agent modal logic S4 wit common knowledge. Finally, we give a brief analysis of te coordinated attack problem in te newly developed language of our logic. KEYWORDS: justification logic, epistemic modal logic, multi-agent systems, common knowledge. DOI: /JANCL c 2011 Lavoisier, Paris 1. Introduction Justification logics are epistemic logics tat explicitly include justifications for te agents knowledge (Artemov, 2008). Te first logic of tis kind, te Logic of Proofs LP, was developed by Artemov to provide te modal logic S4 wit provability semantics (Artemov, 1995; Artemov, 2001). Te language of justification logics as also been used to create a new approac to te logical omniscience problem (Artemov et al., 2009) and to study self-referential proofs (Kuznets, 2010). Instead of statements A is known, denoted A, justification logics reason about justifications for knowledge by using te construct [t]a to formalize statements t is a justification for A, were, dependent on te application, te evidence term t can be viewed as an informal justification or a formal matematical proof. Evidence terms are built by means of operations tat correspond to te axioms of S4, as is illustrated in Fig. 1. Journal of Applied Non-Classical Logics. Volume - No. -/2011, pagespages undefined

2 2 JANCL -/2011. Logical Aspects of Multi-Agent Systems S4 axioms LP axioms (A B) ( A B) [t](a B) ([s]a [t s]b) (application) A A [t]a A (reflexivity) A A [t]a [!t][t]a (inspection) [t]a [s]a [t + s]a (sum) Figure 1. Axioms of S4 and LP Artemov as sown tat te Logic of Proofs LP is an explicit 1 counterpart of te modal logic S4 in te following formal sense: eac teorem of LP becomes a teorem of S4 if all te terms are replaced wit te modality ; and, vice versa, eac teorem of S4 can be transformed into a teorem of LP if te occurrences of modality are replaced wit suitable evidence terms (Artemov, 2001). Te latter process is called realization, and te statement of correspondence is called a realization teorem. Note tat te operation + introduced by te sum axiom in Fig. 1 does not ave a modal analog, but it is an essential part of te proof of te realization teorem in (Artemov, 2001). Explicit counterparts for many normal modal logics between K and S5 ave been developed (see a recent survey in (Artemov, 2008) and a uniform proof of realization teorems for all single-agent justification logics in (Brünnler et al., 2010)). Te notion of common knowledge is essential in te area of multi-agent systems, were coordination among agents is a central issue. For a toroug introduction to epistemic logics in general and to common knowledge in particular, one can refer to te standard textbooks (Fagin et al., 1995; Meyer et al., 1995). Informally, common knowledge of A is defined as te infinitary conjunction everybody knows A and everybody knows tat everybody knows A and so on. Tis is equivalent to saying tat common knowledge of A is te greatest fixed point of λx.(everybody knows A and everybody knows X). (1) An explicit counterpart of McCarty s any fool knows common knowledge modality (McCarty et al., 1978), were common knowledge of A is defined as an arbitrary fixed point of (1), is presented in (Artemov, 2006). Te relationsip between te traditional common knowledge from (Fagin et al., 1995; Meyer et al., 1995) and McCarty s version is studied in (Antonakos, 2007). In tis paper, we develop a multi-agent justification logic wit evidence terms for individual agents as well as for common knowledge, wit te intention to provide an explicit counterpart of te -agent modal logic of traditional common knowledge S4 C. For te sake of compactness and readability, we will not treat groups of agents. 1. For oter meanings of explicit see Sect. 8.

3 Justifications for Common Knowledge 3 Multi-agent justification logics wit evidence terms for eac agent are considered in (Yavorskaya (Sidon), 2008; Renne, 2009a; Artemov, 2010), but common knowledge is not present in any of tem. Renne s system combines features of modal and dynamic epistemic logics (Renne, 2009a) and ence cannot be directly compared to our system. Artemov s interest lies mostly in exploring a case of two agents wit unequal epistemic powers: e.g., Artemov s Observer as sufficient evidence to reproduce te Object Agent s tinking, but not vice versa (Artemov, 2010). Yavorskaya studies various operations of evidence transfer between agents (Yavorskaya (Sidon), 2008). Yavorskaya s minimal 2 two-agent justification logic LP 2, wic is an explicit counterpart of S4 2, is te closest to our system. We will sow tat in te case of two agents our system is a conservative extension of LP 2. An epistemic semantics for LP, F-models, was created by Fitting by augmenting Kripke models wit an evidence function tat specifies wic formulae are evidenced by a term at a given world (Fitting, 2005). Independently, Mkrtycev proved a stronger completeness result for LP wit respect to singleton F-models (Mkrtycev, 1997), now known as M-models, were te role of te accessibility relation is completely taken over by te evidence function. Te semantics of F-models as been adapted to te wole family of single-agent justification logics (for details, see (Artemov, 2008)). Artemov extends F-models to te language wit bot evidence terms for McCarty s common knowledge modality and ordinary modalities for te individual agents (Artemov, 2006), creating te most general type of epistemic models, sometimes called AF-models, were common evidence terms are given teir own accessibility relation, wic does not directly depend on te accessibility relations for individual modalities. Te absence of ordinary modalities in Yavorskaya s two-agent justification systems provides for a stronger completeness result wit respect to M-models (Yavorskaya (Sidon), 2008). Te paper is organized as follows. In Sect. 2, we introduce a language and give an axiomatization of a family of multi-agent justification logics wit common knowledge. In Sect. 3, we prove teir basic properties including te internalization property, wic is caracteristic of all justification logics. In Sect. 4, we develop an epistemic semantics and prove soundness and completeness wit respect to tis semantics as well as wit respect to singleton models, tereby demonstrating te finite model property. In Sect. 5, we sow tat for te two-agent case, our logic is a conservative extension of Yavorskaya s minimal two-agent justification logic. In Sect. 6, we demonstrate ow our logic is related to te modal logic of traditional common knowledge and discuss te problem of realization. In Sect. 7, we provide an analysis of te coordinated attack problem in our logic. Finally, in Sect. 8, we discuss ow te newly introduced terms affect te agents, including teir ability to communicate information in various communication modes. 2. Minimality ere is understood in te sense of te minimal transfer of evidence.

4 4 JANCL -/2011. Logical Aspects of Multi-Agent Systems 2. Syntax To create an explicit counterpart of te modal logic of common knowledge S4 C, we use its axiomatization via te induction axiom from (Meyer et al., 1995) rater tan via te induction rule to facilitate proving te internalization property for te resulting justification logic. We supply eac agent wit its own copy of terms from te Logic of Proofs, wile terms for common and mutual knowledge employ additional operations. Te fact tat eac agent as its own set of operations makes our framework more flexible. For instance, agents may be tougt of as representing different aritmetical proof systems tat use different encodings (cf. (Yavorskaya (Sidon), 2008)). As motivated in (Buceli et al., 2010b), a proof of CA can be viewed as an infinite list of proofs of te conjuncts E m A from te representation of common knowledge troug an infinite conjunction. To generate a finite representation of tis infinite list, we use an explicit counterpart of te induction axiom A [t] C (A [s] E A) [ind(t, s)] C A wit a binary operation ind(, ). To facilitate access to te elements of te list, explicit counterparts of te co-closure axiom provide evidence terms tat can be seen as splitting te infinite list into its ead and tail, [t] C A [ccl 1 (t)] E A, [t] C A [ccl 2 (t)] E [t] C A, by means of two unary co-closure operations ccl 1 ( ) and ccl 2 ( ). Evidence terms for mutual knowledge are viewed as tuples of te individual agents evidence terms. Te standard tupling operation and unary projections are employed as means of translation between te individual agents and mutual knowledge evidence. Note tat, strictly speaking, evidence terms for mutual knowledge are not necessary because tey could be defined, just like te modality for mutual knowledge can be defined in te modal case. However, te resulting system would be very cumbersome in notation and usage. Wile only two of te tree operations on LP terms (see Fig. 1) are adopted for common knowledge evidence and none is adopted for mutual knowledge evidence, it will be sown in Sect. 3 tat tree out of te four remaining operations are definable, wit a notable exception of inspection for mutual knowledge, as is to be expected. Wile te usage of te application operation for common knowledge evidence terms is justifiable on te grounds of te corresponding modal (K) axiom for common knowledge, te necessity of te sum operation for common knowledge evidence terms is less clear and can only be sown once te realization teorem is proved (see Sect. 6 for details). We consider a system of agents. Trougout te paper, i always denotes an element of {1,...,}, always denotes an element of {1,...,, C}, and always denotes an element of {1,...,, E, C}.

5 Justifications for Common Knowledge 5 Let Cons := {c 1, c 2,... } and Var := {x 1, x 2,... } be countable sets of proof constants and proof variables respectively for eac. Te sets Tm 1,..., Tm, Tm E, and Tm C of evidence terms for individual agents and for mutual and common knowledge respectively are inductively defined as follows: 1. Cons Tm and Var Tm ; 2.! i t Tm i for any t Tm i ; 3. t + s Tm and t s Tm for any t, s Tm ; 4. t 1,..., t Tm E for any t 1 Tm 1,...,t Tm ; 5. π i t Tm i for any t Tm E ; 6. ccl 1 (t) Tm E and ccl 2 (t) Tm E for any t Tm C ; 7. ind(t, s) Tm C for any t Tm C and any s Tm E. Tm := Tm 1 Tm Tm E Tm C denotes te set of all evidence terms. Te indices of te operations!, +, and will most often be omitted if tey can be inferred from te context. A term is called ground if no proof variables occur in it. Let Prop := {P 1, P 2,... } be a countable set of propositional variables. Formulae are denoted by A, B, C,... and are defined by te grammar A ::= P j A (A A) (A A) (A A) [t] A, were t Tm and P j Prop. Te set of all formulae is denoted by Fm LP C. We adopt te following convention: wenever a formula [t] A is used, it is assumed to be well-formed: i.e., it is implicitly assumed tat term t Tm. Tis enables us to omit te explicit typification of terms. Axioms of LP C : 1. all propositional tautologies 2. [t] (A B) ([s] A [t s] B) (application) 3. [t] A [s] A [t + s] A (sum) 4. [t] i A A (reflexivity) 5. [t] i A [!t] i [t] i A (inspection) 6. [t 1 ] 1 A [t ] A [ t 1,...,t ] E A (tupling) 7. [t] E A [π i t] i A (projection) 8. [t] C A [ccl 1 (t)] E A, [t] C A [ccl 2 (t)] E [t] C A (co-closure) 9. A [t] C (A [s] E A) [ind(t, s)] C A (induction)

6 6 JANCL -/2011. Logical Aspects of Multi-Agent Systems A constant specification CS is any subset { } CS [c] A : c Cons and A is an axiom of LP C {1,...,,E,C}. A constant specification CS is called C-axiomatically appropriate if, for eac axiom A, tere is a proof constant c Cons C suc tat [c] C A CS. A constant specification CS is called omogeneous, if CS {[c] A : c Cons and A is an axiom} for some fixed : i.e., if for all [c] A CS te constants c are of te same type. For a constant specification CS, te deductive system LP C (CS) is te Hilbert system given by te axioms of LP C above and by te rules modus ponens and axiom necessitation: A A B B, [c] A, were [c] A CS. By LP C we denote te system LPC (CS) wit { } CS = [c] C A : c Cons C and A is an axiom of LP C. (2) For an arbitrary CS, we write CS A to state tat A is derivable from a set of formulae in LP C (CS) and omit CS wen working wit te constant specification from (2) by writing A. We also omit wen = and write CS A or A, in wic case A is called a teorem of LP C (CS) or of LPC respectively. We use, A to mean {A}. 3. Basic properties In tis section, we sow tat our logic possesses te standard properties expected of any justification logic. In addition, we sow tat te operations on terms introduced in te previous section are sufficient to express te operations of sum and application for mutual knowledge evidence and te operation of inspection for common knowledge evidence. Tis is te reason wy + E, E, and! C are not primitive connectives in te language. It sould be noted tat no inspection operation for mutual evidence terms can be defined, wic follows from Lemma 28 in Sect. 6 and te fact tat EA EEA is not a valid modal formula. LEMMA 1. For any constant specification CS and any formulae A and B: 1. CS [t] E A A for all t Tm E ; (E-reflexivity) 2. for any t, s Tm E, tere is a term t E s Tm E suc tat CS [t] E (A B) ([s] E A [t E s] E B); 3. for any t, s Tm E, tere is a term t + E s Tm E suc tat CS [t] E A [s] E A [t + E s] E A; (E-application) (E-sum)

7 Justifications for Common Knowledge 7 4. for any t Tm C and any i {1,...,}, tere is a term i t Tm i suc tat CS [t] C A [ i t] i A; (i-conversion) 5. CS [t] C A A for all t Tm C. (C-reflexivity) PROOF. 1. Immediate by te projection and reflexivity axioms. 2. Set t E s := π 1 t 1 π 1 s,...,π t π s. 3. Set t + E s := π 1 t + 1 π 1 s,...,π t + π s. 4. Set i t := π i ccl 1 (t). 5. Immediate by 4. and te reflexivity axiom. Unlike Lemma 1, Lemma 2 requires tat a constant specification CS be C-axiomatically appropriate. LEMMA 2. Let CS be C-axiomatically appropriate and A be a formula. 1. For any t Tm C, tere is a term! C t Tm C suc tat CS [t] C A [! C t] C [t] C A. (C-inspection) 2. For any t Tm C, tere is a term t Tm C suc tat CS [t] C A [ t] C [ccl 1 (t)] E A. PROOF. (C-sift) 1. Set! C t := ind(c, ccl 2 (t)), were [c] C ([t] C A [ccl 2 (t)] E [t] C A) CS. 2. Set t := c C (! C t), were [c ] C ([t] C A [ccl 1 (t)] E A) CS. Te existence of constants c and c is guaranteed by te C-appropriateness of CS. Te following two lemmas are standard in justification logics. Teir proofs can be taken almost word for word from (Artemov, 2001) and are, terefore, omitted ere. LEMMA 3 (DEDUCTION THEOREM). Let CS be a constant specification and {A, B} Fm LP C. Ten, A CS B if and only if CS A B. LEMMA 4 (SUBSTITUTION). For any constant specification CS, any propositional variable P, any {A, B} Fm LP C, any x Var, and any t Tm, if CS A, ten (x/t, P/B) CS(x/t,P/B) A(x/t, P/B), were A(x/t, P/B) denotes te formula obtained by simultaneously replacing all occurrences of x in A wit t and all occurrences of P in A wit B and (x/t, P/B) and CS(x/t, P/B) are defined accordingly.

8 8 JANCL -/2011. Logical Aspects of Multi-Agent Systems Te following lemma states tat our logic can internalize its own proofs, wic is an important property of justification logics. LEMMA 5 (C-LIFTING). Let CS be a omogeneous C-axiomatically appropriate constant specification. For any formulae A, B 1,...,B n, C 1,...,C m and any terms s 1,..., s n Tm C, if [s 1 ] C B 1,..., [s n ] C B n, C 1,..., C m CS A, ten for eac tere is a term t (x C 1,..., xc n, y 1,...,y m) Tm suc tat [s 1 ] C B 1,...,[s n ] C B n, [y 1 ] C 1,...,[y m ] C m CS [t (s 1,..., s n, y 1,..., y m )] A for fres variables x 1,...,x n Var C and y 1,..., y m Var. PROOF. We proceed by induction on te derivation of A. If A is an axiom, tere is a constant c Cons C suc tat [c] C A CS because CS is C-axiomatically appropriate. Ten take t C := c, t i := i c, t E := ccl 1 (c) and use axiom necessitation, axiom necessitation and i-conversion, or axiom necessitation and te co-closure axiom respectively. For A = [s j ] C B j, 1 j n, take t C :=! C x j, t i := i! C x j, t E := ccl 2 (x j ) for a fres variable x j Var C and, after x j is replaced wit s j, use C-inspection, C-inspection and i-conversion, or te co-closure axiom respectively. For A = C j, 1 j m, take t := y j for a fres variable y j Var. For A derived by modus ponens from D A and D, by induction ypotesis tere are terms r, s Tm suc tat [r ] (D A) and [s ] D are derivable. Take t := r s and use -application, wic is an axiom for = i and for = C or follows from Lemma 1 for = E. For A = [c] C E CS derived by axiom necessitation, take t C :=! C c, t i := i! C c, t E := ccl 2 (c) and use C-inspection, C-inspection and i-conversion, or te co-closure axiom respectively. No oter instances of te axiom necessitation rule are possible. Indeed, CS must contain formulae of te type [c] C E because of C-axiomatic appropriateness. Te omogeneity of CS ten means tat formulae neiter of type [c] i E nor of type [c] E E can occur in CS. COROLLARY 6 (CONSTRUCTIVE NECESSITATION). Let CS be a omogeneous C-axiomatically appropriate constant specification. For any formula A, if CS A, ten for eac tere is a ground term t Tm suc tat CS [t] A.

9 Justifications for Common Knowledge 9 Te following two lemmas sow tat our system LP C can internalize versions of te induction rule used in various axiomatizations of S4 C (see (Buceli et al., 2010b) for a discussion of several axiomatizations of tis kind). LEMMA 7 (INTERNALIZED INDUCTION RULE 1). Let CS be a omogeneous C-axiomatically appropriate constant specification. For any term s Tm E and any formula A, if CS A [s] E A, tere is t Tm C suc tat CS A [ind(t, s)] C A. PROOF. By constructive necessitation, CS [t] C (A [s] E A) for some t Tm C. It remains to use te induction axiom and propositional reasoning. LEMMA 8 (INTERNALIZED INDUCTION RULE 2). Let CS be a omogeneous C-axiomatically appropriate constant specification. For any formulae A and B and any term s Tm E, if we ave CS B [s] E (A B), ten tere exists t Tm C and c Cons C suc tat CS B [c ind(t, s)] C A, were [c] C (A B A) CS. PROOF. Assume CS B [s] E (A B). (3) From tis we immediately get CS A B [s] E (A B). Tus, by Lemma 7, tere is a t Tm C wit CS A B [ind(t, s)] C (A B). (4) Since CS is C-axiomatically appropriate, tere is a constant c Cons C suc tat Making use of C-application, we find by (4) and (5) tat CS [c] C (A B A). (5) CS A B [c ind(t, s)] C A. (6) From (3) we get by E-reflexivity tat CS B A B. Tis, togeter wit (6), finally yields CS B [c ind(t, s)] C A. 4. Soundness and completeness DEFINITION 9. An (epistemic) model meeting a constant specification CS is a structure M = (W, R, E, ν), were (W, R, ν) is a Kripke model for S4 wit a set of possible worlds W, wit a function R: {1,...,} P(W W) tat assigns a reflexive and transitive accessibility relation on W to eac agent i {1,..., }, and wit a trut valuation ν : Prop P(W). We always write R i instead of R(i) and define te accessibility relations for mutual and common knowledge in te standard way: R E := R 1 R and R C := n=1 (R E) n. ) An evidence function E : W Tm P (Fm LP determines te formulae evi- C denced by a term at a world. We define E := E (W Tm ). Note tat wenever A E (w, t), it follows tat t Tm. Te evidence function E must satisfy te following closure conditions: for any worlds w, v W,

10 10 JANCL -/2011. Logical Aspects of Multi-Agent Systems 1. E (w, t) E (v, t) wenever (w, v) R ; (monotonicity) 2. if [c] A CS, ten A E (w, c); (constant specification) 3. if (A B) E (w, t) and A E (w, s), ten B E (w, t s); (application) 4. E (w, s) E (w, t) E (w, s + t); (sum) 5. if A E i (w, t), ten [t] i A E i (w,!t); (inspection) 6. if A E i (w, t i ) for all 1 i, ten A E E (w, t 1,..., t ); (tupling) 7. if A E E (w, t), ten A E i (w, π i t); (projection) 8. if A E C (w, t), ten A E E (w, ccl 1 (t)) and [t] C A E E (w, ccl 2 (t)); (co-closure) 9. if A E E (w, s) and (A [s] E A) E C (w, t), ten A E C (w, ind(t, s)). (induction) Wen te model is clear from te context, we will directly refer to R 1,...,R, R E, R C, E 1,..., E, E E, E C, W, and ν. DEFINITION 10. A ternary relation M, w A for formula A being satisfied at a world w W in a model M = (W, R, E, ν) is defined by induction on te structure of te formula A: 1. M, w P n if and only if w ν(p n ); 2. beaves classically wit respect to te propositional connectives; 3. M, w [t] A if and only if 1) A E (w, t) and 2) M, v A for all v W wit (w, v) R. We write M A if M, w A for all w W. We write M, w for Fm LP C if M, w A for all A. We write CS A and say tat formula A is valid wit respect to CS if M A for all epistemic models M meeting CS. LEMMA 11 (SOUNDNESS). All teorems are valid: CS A implies CS A. PROOF. Let M = (W, R, E, ν) be a model meeting CS and let w W. We sow soundness by induction on te derivation of A. Te cases for propositional tautologies, for te application, sum, reflexivity, and inspection axioms, and for te modus ponens rule are te same as for te single-agent case in (Fitting, 2005) and are, terefore, omitted. We sow te remaining five cases: (tupling) Assume M, w [t i ] i A for all 1 i. Ten for all 1 i, we ave 1) M, v A wenever (w, v) R i and 2) A E i (w, t i ). By te tupling closure condition, it follows from 2) tat A E E (w, t 1,...,t ). Since R E = i=1 R i by definition, it follows from 1) tat M, v A wenever (w, v) R E. Hence, M, w [ t 1,...,t ] E A.

11 Justifications for Common Knowledge 11 (projection) Assume M, w [t] E A. Ten 1) M, v A wenever (w, v) R E and 2) A E E (w, t). By te projection closure condition, it follows from 2) tat A E i (w, π i t). In addition, since R E = i=1 R i, it follows from 1) tat M, v A wenever (w, v) R i. Tus, M, w [π i t] i A. (co-closure) Assume M, w [t] C A. Ten 1) M, v A wenever (w, v) R C and 2) A E C (w, t). It follows from 1) tat M, v A wenever (w, v ) R E since R E R C ; also, due to te monotonicity closure condition, M, v [t] C A since R E R C R C. By te co-closure closure condition, it follows from 2) tat A E E (w, ccl 1 (t)) and [t] C A E E (w, ccl 2 (t)). Hence, M, w [ccl 1 (t)] E A and M, w [ccl 2 (t)] E [t] C A. (induction) Assume M, w A and M, w [t] C (A [s] E A). From te second assumption and te reflexivity of R C, we get M, w A [s] E A; tus, M, w [s] E A by te first assumption. So A E E (w, s) and, by te second assumption, A [s] E A E C (w, t). By te induction closure condition, we ave A E C (w, ind(t, s)). To sow tat M, v A wenever (w, v) R C, we prove tat M, v A wenever (w, v) (R E ) n by induction on te positive integer n. Te base case n = 1 immediately follows from M, w [s] E A. Induction step. If (w, v) (R E ) n+1, tere must exist v W suc tat (w, v ) (R E ) n and (v, v) R E. By induction ypotesis, M, v A. Since M, w [t] C (A [s] E A), we get M, v A [s] E A. Tus, M, v [s] E A, wic yields M, v A. Finally, we conclude tat M, w [ind(t, s)] C A. (axiom necessitation) Let [c] A CS. Since A must be an axiom, M, w A for all w W, as sown above. Since M is a model meeting CS, we also ave A E (w, c) for all w W by te constant specification closure condition. Tus, M, w [c] A for all w W. DEFINITION 12. Let CS be a constant specification. A set Φ of formulae is called CS-consistent if Φ CS φ for some formula φ. A set Φ is called maximal CS-consistent if it is CS-consistent and as no CS-consistent proper extensions. Wenever safe, we do not mention te constant specification and only talk about consistent and maximal consistent sets. It can be easily sown tat maximal consistent sets contain all axioms of LP C and are closed under modus ponens. DEFINITION 13. For a set Φ of formulae, we define Φ/ := {A : tere is a t Tm suc tat [t] A Φ}. DEFINITION 14. Let CS be a constant specification. Te canonical (epistemic) model M = (W, R, E, ν) meeting CS is defined as follows:

12 12 JANCL -/2011. Logical Aspects of Multi-Agent Systems 1. W := {w Fm LP C : w is a maximal CS-consistent set}; 2. R i := {(w, v) W W : w/i v}; 3. E (w, t) := {A Fm LP C : [t] A w}; 4. ν(p n ) := {w W : P n w}. LEMMA 15. Let CS be a constant specification. Te canonical epistemic model meeting CS is an epistemic model meeting CS. PROOF. Te proof of te reflexivity and transitivity of eac R i, as well as te argument for te constant specification, application, sum, and inspection closure conditions, is te same as in te single-agent case (see (Fitting, 2005)). We sow te remaining five closure conditions: (tupling) Assume A E i (w, t i ) for all 1 i. By definition of E i, we ave [t i ] i A w for all 1 i. Terefore, by te tupling axiom and maximal consistency, [ t 1,..., t ] E A w. Tus, A E E (w, t 1,..., t ). (projection) Assume A E E (w, t). By definition of E E, we ave [t] E A w. Terefore, by te projection axiom and maximal consistency, [π i t] i A w. Tus, A E i (w, π i t). (co-closure) Assume A E C (w, t). By definition of E C, we ave [t] C A w. Terefore, by te co-closure axioms and maximal consistency, [ccl 1 (t)] E A w and [ccl 2 (t)] E [t] C A w. Tus, A E E (w, ccl 1 (t)) and [t] C A E E (w, ccl 2 (t)). (induction) Assume A E E (w, s) and (A [s] E A) E C (w, t). By definition of E E and E C, we ave [s] E A w and [t] C (A [s] E A) w. From CS [s] E A A (Lemma 1.1) and te induction axiom, it follows by maximal consistency tat A w and [ind(t, s)] C A w. Terefore, A E C (w, ind(t, s)). (monotonicity) We sow only te case of = C since te oter cases are te same as in (Fitting, 2005). It is sufficient to prove by induction on te positive integer n tat if [t] C A w and (w, v) (R E ) n, ten [t] C A v. (7) Base case n = 1. Assume (w, v) R E : i.e., w/i v for some i. As [t] C A w, [π i ccl 2 (t)] i [t] C A w by maximal consistency, and ence [t] C A w/i v. Te argument for te induction step is similar. Now assume (w, v) R C = n=1 (R E) n and A E C (w, t). By definition of E C, we ave [t] C A w. As sown above, [t] C A v. Tus, A E C (v, t). REMARK 16. Let R C denote te binary relation on W defined by (w, v) R C if and only if w/c v. An argument similar to te one just used for monotonicity sows tat R C R C. However, for > 1 te converse does not old for any omogeneous C-axiomatically

13 Justifications for Common Knowledge 13 appropriate constant specification CS, wic we demonstrate by adapting an example from (Meyer et al., 1995). For a fixed propositional variable P, let Φ := {[s n ] E... [s 1 ] E P : n 1, s 1,..., s n Tm E } { [t] C P : t Tm C }. Tis set is CS-consistent for any P Prop. To prove tis, let Φ Φ be finite and let m denote te largest nonnegative integer suc tat [s m ] E...[s 1 ] E P Φ for some s 1,..., s m Tm E (in particular, m = 0 if no suc terms exist). Define te model N := ( N, R N, E N, ν N) by R N i := {(n, n + 1) N 2 : n mod = i} {(n, n) : n N}; E N (n, s) := Fm LP C for all n N and all terms s Tm; ν N (P j ) := {1, 2,..., m + 1} for all P j Prop. Clearly, N meets any constant specification; in particular, it meets te given CS. For > 1, it can also be easily verified tat N, 1 Φ ; terefore, Φ is CS-consistent. Since Φ is CS-consistent, tere exists a maximal CS-consistent set w Φ. Let us sow tat te set Ψ := { P } (w/c) is also CS-consistent. Indeed, if it were not te case, tere would exist formulae [t 1 ] C B 1,...,[t n ] C B n w suc tat CS B 1 (B 2 (B n P)...). Ten, by Corollary 6, tere would exist a term s Tm C suc tat CS [s] C (B 1 (B 2 (B n P)...)). But tis would imply [(... (s t 1 ) t n 1 ) t n ] C P w a contradiction wit te consistency of w. Since Ψ is also CS-consistent, tere exists a maximal CS-consistent set v Ψ. Clearly, w/c v: i.e., (w, v) R C. But (w, v) / R C because tis would imply P v, wic would contradict te consistency of v. It follows tat R C R C. Similarly, we can define R E by (w, v) R E if and only if w/e v. However, R E = R E for any C-axiomatically appropriate constant specification CS. Indeed, it is easy to sow tat R E R E. For te converse direction, assume (w, v) / R E, ten (w, v) / R i for any 1 i. So tere are formulae A 1,..., A suc tat [t i ] i A i w for some t i Tm i, but A i / v. Now let [c i ] C (A i A 1 A ) CS for constants c 1,...,c. Ten [ i c i t i ] i (A 1 A ) w for all 1 i, so [ 1 c 1 t 1,..., c t ] E (A 1 A ) w. However, A i / v for any 1 i ; terefore, by te maximal consistency of v, A 1 A / v eiter. Hence, w/e v, so (w, v) / R E. LEMMA 17 (TRUTH LEMMA). Let CS be a constant specification and M be te canonical epistemic model meeting CS. For all formulae A and all worlds w W, A w if and only if M, w A.

14 14 JANCL -/2011. Logical Aspects of Multi-Agent Systems PROOF. Te proof is by induction on te structure of A. Te cases for propositional variables and propositional connectives are immediate by definition of and by te maximal consistency of w. We ceck te remaining cases: Case A is [t] i B. Assume A w. Ten B w/i and B E i (w, t). Consider any v suc tat (w, v) R i. Since w/i v, it follows tat B v, and tus, by induction ypotesis, M, v B. It immediately follows tat M, w A. For te converse, assume M, w [t] i B. By definition of, we get B E i (w, t), from wic [t] i B w immediately follows by definition of E i. Case A is [t] E B. Assume A w and consider any v suc tat (w, v) R E. Ten (w, v) R i for some 1 i : i.e., w/i v. By definition of E E, we ave B E E (w, t). By te maximal consistency of w, it follows tat [π i t] i B w, and tus B w/i v. Since by induction ypotesis, M, v B, we can conclude tat M, w A. Te argument for te converse repeats te one from te previous case. Case A is [t] C B. Assume A w and consider any v suc tat (w, v) R C : i.e., (w, v) (R E ) n for some n 1. As in te previous cases, B E C (w, t) by definition of E C. It follows from (7) in te proof of Lemma 15 tat A v, and tus, by C-reflexivity and maximal consistency, also B v. Hence, by induction ypotesis, M, v B. Now M, w A immediately follows. Te argument for te converse repeats te one from te previous cases. Note tat, unlike te converse directions in te proof above, te corresponding proofs in te modal case are far from trivial and require additional work (see e.g. (Meyer et al., 1995)). Te last case, in particular, usually requires more sopisticated metods tat would guarantee te finiteness of te model. Tis simplification of proofs in justification logics is yet anoter benefit of using terms instead of modalities. THEOREM 18 (COMPLETENESS). LP C (CS) is sound and complete wit respect to te class of epistemic models meeting CS: i.e., for all formulae A Fm LP C, CS A if and only if CS A. PROOF. Soundness was already sown in Lemma 11. For completeness, let M be te canonical model meeting CS and assume CS A. Ten { A} is CS-consistent and ence is contained in some maximal CS-consistent set w W. So, by Lemma 17, M, w A, and ence, by Lemma 15, CS A. In te case of LP, te finite model property can be demonstrated by restricting te class of epistemic models to te so-called M-models, introduced by Mkrtycev in (Mkrtycev, 1997). We will now adapt M-models to our logic and prove te finite model property for it. DEFINITION 19. An M-model is a singleton epistemic model.

15 Justifications for Common Knowledge 15 THEOREM 20 (COMPLETENESS WITH RESPECT TO M-MODELS). LP C (CS) is also sound and complete wit respect to te class of M-models meeting CS. PROOF. Soundness follows immediately from Lemma 11. Now assume CS A, ten { A} is CS-consistent, and ence M, w 0 A for some world w 0 W in te canonical epistemic model M = (W, R, E, ν) meeting CS. Let M = (W, R, E, ν ) be te restriction of M to {w 0 }: i.e., W := {w 0 }, R i := {(w 0, w 0 )} for all i, E := E (W Tm), and ν (P n ) := ν(p n ) W. Since M is clearly an M-model meeting CS, it only remains to demonstrate tat M, w 0 B if and only if M, w 0 B for all formulae B. We proceed by induction on te structure of B. Te cases were eiter B is a propositional variable or its primary connective is propositional are trivial. Terefore, we only sow te case of B = [t] C. First, observe tat M, w 0 [t] C if and only if C E (w 0, t). (8) Indeed, by Lemma 17, M, w 0 [t] C if and only if [t] C w 0, wic, by definition of te canonical epistemic model, is equivalent to C E (w 0, t) = E (w 0, t). If M, w 0 [t] C, ten M, w 0 C since R is reflexive. By induction ypotesis, M, w 0 C. By (8) we ave C E (w 0, t), and tus M, w 0 [t] C. If M, w 0 [t] C, ten by (8) we ave C / E (w 0, t), so M, w 0 [t] C. COROLLARY 21 (FINITE MODEL PROPERTY). LP C (CS) enjoys te finite model property wit respect to epistemic models. REMARK 22. Note tat, in te case of LP C (CS), te finite model property does not imply tat common knowledge can be deduced from sufficiently many approximants, unlike in te modal case. Tis is an immediate consequence of te set Φ := {[s n ] E... [s 1 ] E P : n 1, s 1,..., s n Tm E } { [t] C P : t Tm C } being consistent, as sown in Remark 16. In modal logic, a set analogous to Φ can only be satisfied in infinite models, wereas in our case, due to te evidence function completely taking over te role of te accessibility relations, tere is a singleton M- model tat satisfies Φ. 5. Conservativity We extend te two-agent version LP 2 of te Logic of Proofs (Yavorskaya (Sidon), 2008) to an arbitrary in te natural way and rename it in accordance wit our naming sceme: DEFINITION 23. Te language of LP is obtained from tat of LP C by restricting te set of operations to i, + i, and! i and by dropping all terms from Tm E and Tm C.

16 16 JANCL -/2011. Logical Aspects of Multi-Agent Systems Te axioms are restricted to application, sum, reflexivity, and inspection for eac i. Te definition of constant specification is canged accordingly. We sow tat LP C is conservative over LP by adapting te tecnique from (Fitting, 2008), for wic evidence terms are essential. DEFINITION 24. Te mapping : Fm LP C Fm LP is defined as follows: 1. P n := P n for propositional variables P n Prop; 2. commutes wit propositional connectives; { 3. ([t] A) A if t contains a subterm s Tm E Tm C, := [t] A oterwise. THEOREM 25. Let CS be a constant specification for LP C. For an arbitrary formula A Fm LP, were CS := {[c] i E if LP C (CS) A, ten LP (CS ) A, : [c] i E CS}. PROOF. Since A = A for any A Fm LP, it suffices to demonstrate tat for any formula D Fm LP C, if LP C (CS) D, ten LP (CS ) D, wic can be done by induction on te derivation of D. Case wen D is a propositional tautology. Ten so is D. Case wen D = [t] i B B is an instance of te reflexivity axiom. Ten D is eiter te propositional tautology B B or [t] i B B, an instance of te reflexivity axiom of LP. Case wen D = [t] i B [!t] i [t] i B is an instance of te inspection axiom. Ten D is eiter te propositional tautology B B or [t] i B [!t] i [t] i B, an instance of te inspection axiom of LP. Case wen D = [t] (B C) ([s] B [t s] C) is an instance of te application axiom. We distinguis te following possibilities: 1. Bot t and s contain a subterm from Tm E Tm C. In tis subcase, D as te form (B C ) (B C ), wic is a propositional tautology and, tus, an axiom of LP. 2. Neiter t nor s contains a subterm from Tm E Tm C. Ten D is an instance of te application axiom of LP. 3. Term t contains a subterm from Tm E Tm C wile s does not. Ten D as te form (B C ) ([s] i B C ), wic can be derived in LP (CS ) from te reflexivity axiom [s] i B B by propositional reasoning. In tis subcase, translation does not map an axiom of LP C to an axiom of LP.

17 Justifications for Common Knowledge Term s contains a subterm from Tm E Tm C wile t does not. Ten D is [t] i (B C ) (B C ), an instance of te reflexivity axiom of LP. Case wen D = [t] B [s] B [t + s] B is an instance of te sum axiom. We distinguis te following possibilities: 1. Bot t and s contain a subterm from Tm E Tm C. In tis subcase, D as te form B B B, wic is a propositional tautology and, tus, an axiom of LP. 2. Neiter t nor s contains a subterm from Tm E Tm C. Ten D is an instance of te sum axiom of LP. 3. Term t contains a subterm from Tm E Tm C wile s does not. Ten D as te form B [s] i B B, wic can be derived in LP (CS ) from te reflexivity axiom [s] i B B by propositional reasoning. Tis is anoter subcase wen translation does not map an axiom of LP C to an axiom of LP. 4. Term s contains a subterm from Tm E Tm C wile t does not. Ten D as te form [t] i B B B, wic can be derived in LP (CS ) from te reflexivity axiom [t] i B B by propositional reasoning. Tis is anoter subcase wen translation does not map an axiom of LP C to an axiom of LP. Case wen D = [t 1 ] 1 B [t ] B [ t 1,..., t ] E B is an instance of te tupling axiom. We distinguis te following possibilities: 1. At least one of te t i s contains a subterm from Tm E Tm C. Ten D as te form C 1 C B wit at least one C i = B and is, terefore, a propositional tautology. 2. None of te t i s contains a subterm from Tm E Tm C. Ten D as te form [t 1 ] 1 B [t ] B B, wic can be derived in LP (CS ) from te reflexivity axiom. Tis is anoter subcase wen translation does not map an axiom of LP C to an axiom of LP. Case wen D is an instance of te projection axiom [t] E B [π i t] i B or of te coclosure axiom: i.e., [t] C B [ccl 1 (t)] E B or [t] C B [ccl 2 (t)] E [t] C B. Ten D is te propositional tautology B B. Case wen D = B [t] C (B [s] E B) [ind(t, s)] C B is an instance of te induction axiom. Ten D is te propositional tautology B (B B ) B. Case wen D is derived by modus ponens is trivial. Case wen D is [c] B CS. Ten D is eiter B or [c] i B. In te former case, B is derivable in LP (CS ), as sown above, because B is an axiom of LP C ; in te latter case, [c] i B CS. REMARK 26. Note tat CS need not, in general, be a constant specification for LP because, as noted above, for an axiom D of LP C, its image D is not al-

18 18 JANCL -/2011. Logical Aspects of Multi-Agent Systems ways an axiom of LP. To ensure tat CS is a proper constant specification, all formulae of te forms (A B) ([s] i A B), A [s] i A A, [t 1 ] 1 A [t ] A A, [t] i A A A ave to be made axioms of LP. Anoter option is to use Fitting s concept of embedding one justification logic into anoter, wic involves replacing constants in D wit more complicated terms in D (see (Fitting, 2008) for details). 6. Forgetful projection and a word on realization Most justification logics are introduced as explicit counterparts to particular modal logics in te strict sense described in Sect. 1. Altoug te realization teorem for LP C remains an open problem, in tis section we prove tat eac teorem of our logic LP C states a valid modal fact if all te terms are replaced wit te corresponding modalities, wic is one direction of te realization teorem. We also discuss approaces to te more difficult opposite direction. In te modal language of common knowledge, modal formulae are defined by te grammar A ::= P j A (A A) (A A) (A A) i A EA CA, were P j Prop. Te set of all modal formulae is denoted by Fm S4 C. Te Hilbert system S4 C (Meyer et al., 1995) is given by te modal axioms of S4 for individual agents, by te necessitation rule for 1,...,, and C, by modus ponens, and by te axioms C(A B) (CA CB), CA A, EA 1 A A, A C(A EA) CA, CA E(A CA). DEFINITION 27 (FORGETFUL PROJECTION). Te mapping : Fm LP C Fm S4 C is defined as follows: 1. P j := P j for propositional variables P j Prop; 2. commutes wit propositional connectives; 3. ([t] i A) := i A ; 4. ([t] E A) := EA ; 5. ([t] C A) := CA.

19 Justifications for Common Knowledge 19 LEMMA 28. Let CS be a constant specification. For any formula A Fm LP C, if LP C (CS) A, ten S4C A. PROOF. Te proof is by an easy induction on te derivation of A. DEFINITION 29 (REALIZATION). A realization is a mapping r: Fm S4 C Fm LP C suc tat (r(a)) = A. We usually write A r instead of r(a). We can tink of a realization as a function tat replaces occurrences of modal operators (including E and C) wit evidence terms of te corresponding type. Te problem of realization for a given omogeneous C-axiomatically appropriate constant specification CS can be formulated as follows: Is tere a realization r suc tat LP C (CS) Ar for any teorem A of S4 C? A positive answer to tis question would constitute te more difficult direction of te realization teorem, wic is often demonstrated by means of induction on a cut-free sequent proof of te modal formula. Te cut-free systems for S4 C presented in (Alberucci et al., 2005) and (Brünnler et al., 2009) are based on an infinitary ω-rule of te form E m A, Γ for all m 1 CA, Γ (ω). However, realizing suc a rule presents a serious callenge because it requires acieving uniformity among te realizations of te approximants E m A. Finitizing tis ω-rule via te finite model property, Jäger et al. obtain a finitary cut-free system (Jäger et al., 2007). Unfortunately, te somewat unusual structural properties of te resulting system (see discussion in (Jäger et al., 2007)) make it ard to use it for realization. Te non-constructive, semantic realization metod from (Fitting, 2005) cannot be applied directly because of te non-standard beavior of te canonical model (see Remark 16). Peraps te infinitary system presented in (Buceli et al., 2010b), wic is finitely brancing but admits infinite brances, can elp in proving te realization teorem for LP C. For now tis remains work in progress. 7. Coordinated attack To illustrate our logic, we will now analyze te coordinated attack problem along te lines of (Fagin et al., 1995), were additional references can be found. Let us briefly recall tis classical problem. Suppose two divisions of an army, located in different places, are about to attack teir enemy. Tey ave some means of communication, but tese may be unreliable, and te only way to secure a victory is to attack

20 20 JANCL -/2011. Logical Aspects of Multi-Agent Systems simultaneously. How sould generals G and H wo command te two divisions coordinate teir attacks? Of course, general G could send a message m G 1 wit te time of attack to general H. Let us use te proposition del to denote te fact tat te message wit te time of attack as been delivered. If te generals trust te autenticity of te message, say because of a signature, te message itself can be taken as evidence tat it as been delivered. So general H, upon receiving te message, knows te time of attack: i.e., [ ] m G 1 H del. However, since communication is unreliable, G considers it possible tat is message as not been delivered. But if general H sends an acknowledgment m H 2, e in turn cannot be sure weter te acknowledgment as reaced G, wic prompts yet anoter acknowledgment m G 3 by general G, and so on. In fact, common knowledge of del is a necessary condition for te attack. Indeed, it is reasonable to assume it to be common knowledge between te generals tat tey sould only attack simultaneously or not attack at all, i.e., tat tey attack only if bot know tat tey attack: [t] C (att [s] E att) for some terms s and t. Tus, by te induction axiom, we get att [ind(t, s)] C att. Anoter reasonable assumption is tat it is common knowledge tat neiter general attacks unless te message wit te time of attack as been delivered: [r] C (att del) for some term r. Using te application axiom, we obtain att [r ind(t, s)] C del. We now sow tat common knowledge of del cannot be acieved and tat consequently no attack will take place, no matter ow many messages and acknowledgments m G 1, m H 2, m G 3,... are sent by te generals, even if all te messages are successfully delivered. In te classical modeling witout evidence, te reason is tat te sender of te last message always considers te possibility tat is last message, say m H 2k, as not been delivered. To give a flavor of te argument carried out in detail in (Fagin et al., 1995), we provide a countermodel were m H 2 is te last message, it as been delivered, but H is unsure of tat: i.e., [ m G 1 ] H del, [ ] [ [ ] [ ] m H 2 G m G 1 ]H del, but [s] H m H 2 G m G 1 H del for all terms s. Consider any model M were W := {0, 1, 2, 3}, ν(del) := {0, 1, 2}, R G is te reflexive closure of {(1, 2)}, R H is te reflexive closure of {(0, ( 1), (2, ) 3)}. Te only requirements on te evidence function E are to satisfy del E H 0, m G [ ( ) [ ] [ 1 ] and m G 1 ]H del E G 0, m H 2. Watever EC is, we ave M, 0 [s] H m H 2 G m G 1 H del and M, 0 [t] C del for any s and t because M, 3 del. Let us investigate a different scenario. In our models wit evidence terms, tere is an alternative possibility for te lack of knowledge: insufficient evidence. For example, G may receive te acknowledgment m H 2 but may not consider it to be evidence for [ ] m G 1 H del because te signature of H is missing. We now demonstrate tat common knowledge of te time of attack cannot emerge, basing te argument solely on te lack of common knowledge evidence, in contrast to te classical approac. Consider te M-model M = (W, R, E, ν) obtained as follows: W := {w}, R i := {(w, ( w)}, ) ν(del) := {w}, and E is te minimal evidence function suc tat del E H w, m G 1

21 Justifications for Common Knowledge 21 and [ ] ( ) m G 1 H del E G w, m H 2. In tis model, M, w [t]c del for any evidence term t because del / E C (w, t) for any t. To prove te latter statement, it is sufficient to note tat for any term t, by Lemma 28, [ m G ] 1 H del [ m H ] [ ] 2 G m G 1 H del [t] C del (9) because S4 C H del G H del C del, wic is easy to demonstrate. Let M can be te canonical epistemic model meeting te empty constant specification and E can be its evidence function. Since te negation of te formula from (9) ( must be ) satisfiable, [ ] for eac t tere ( is a world ) w t from M can suc tat del EH can wt, m G 1 and m G 1 H del EG can wt, m H 2, but by te Trut Lemma 17, del / EC can(w t, t). Since E can ({w t } Tm) satisfies all te closure conditions, te minimality of E implies tat E C (w, s) EC can(w t, s) for any term s. In particular, del / E C (w, t) for any term t. 8. Discussion In tis paper, we ave provided a system of evidence terms for describing common knowledge, wic can be used instead of modal logic representation. One benefit of tis new representation is tat several proofs tat are quite ard in te modal case, e.g., tose of completeness and conservativity, are made easier in our logic. Tere are oter merits to tis system as well. In te single-agent case, as is pointed out in (Artemov, 2008), an explicit codification of knowledge by evidence (in Artemov s case, of te individual knowledge of te agent) enables knowledge to be analyzed and recorded. Recording and subsequent retrieving of evidence can be viewed as a form of single-agent communication, wit wic any matematician is familiar. A proof of a teorem, if not recorded immediately, may require as muc effort to be restored later as finding it required originally. Tis role of evidence terms in knowledge transfer is reminiscent of wat is called explicit knowledge in Knowledge Management 3 and is contrasted wit tacit knowledge. As described in (Nonaka, 1991), Explicit knowledge is formal and systematic. For tis reason, it can be easily communicated and sared, in product specifications or a scientific formula or a computer program. In tis sense, evidence terms in te singleagent case serve as a kind of explicit knowledge. Indeed, if an agent can find a proof e/se wrote down a year ago, it will restore is/er knowledge of te statement of te teorem. Te situation wit common knowledge evidence is more complicated. An evidence of common knowledge of some fact A, even wen transmitted to all agents and 3. Te term explicit knowledge sounds so natural tat it as been used in different areas wit completely different meanings. For instance, in epistemic logic, explicit knowledge is a type of knowledge tat is not logically omniscient, as opposed to implicit knowledge (Fagin et al., 1995).

22 22 JANCL -/2011. Logical Aspects of Multi-Agent Systems received by tem 4, does not generally create common knowledge of A for te same reasons tat were discussed in te previous section. In fact, tere exist general results about te impossibility of acieving common knowledge via certain modes of communication, e.g., in asyncronous systems (Fagin et al., 1995). Clearly, an introduction of evidence terms cannot and sould not cange tis general penomenon. However, tere exist modes of communication tat ensure tat a transmission of a common knowledge evidence term to all te agents in te group does create common knowledge among te agents. A prime example of suc a mode is, of course, public announcements, a well-known metod of creating common knowledge. Tus, one of te benefits of our system of terms is a finite encoding of common knowledge, wic is largely infinitary in nature. Tis finite encoding enables to transmit evidence, wic, under certain modes of communication, creates common knowledge among te agents. Of course, common knowledge can also be created by a public announcement of te fact itself rater tan of evidence in support of te fact. Tere is an important difference, owever. Wen, in is seminal 1989 work (Plaza, 2007), Plaza analyzed one of te standard stories used to explain te concept of common knowledge, te Muddy Cildren Puzzle, in order to explain ow common knowledge is created by a public announcement, e ad to assume tat te announcements are trutful and te agents are trustful. Indeed, an announced fact cannot become common knowledge, or any kind of knowledge, if te fact is false. And clearly, if te agents do not trust te announcement, teir knowledge would only cange provided tey can verify te announced facts. Verifiability of announcements is exactly wat we acieve by introducing evidence terms into te language. An agent wo receives a justification for A needs neiter to assume tat A is true nor to trust te speaker because te agent can simply verify te received information. A similar idea of supplying messages wit justifications can be used to describe a distributed system tat autorizes te disbursement of sensitive data, suc as medical records, wile maintaining a specified privacy policy (Blass et al., 2011). Interestingly, like in our analysis of te coordinated attack, te autors also propose to use te sender s signature as evidence for te information about is/er intentions or policies. Verifiability of evidence turns out to be sufficient for creating common knowledge. Indeed, Yavorskaya considered ] a situation were agents can verify eac oter s evidence: [t] i A [! j i t j [t] i A for i j (Yavorskaya (Sidon), 2008). Te! j i -operation implicitly presumes communication since i s evidence t as to be someow available to agent j. It is not ard to sow tat an addition of tis operation to our logic leads to a situation were any individual knowledge also automatically creates common knowledge of te same fact: for any term t Tm i, tere is a term s(x) Tm C suc tat [t] i A [s(t)] C A. However, te mode of communication necessary for te 4. Unreliable communication does not prevent knowledge from being explicit. Tus, in te context of explicit vs. tacit knowledge, we only discuss te usefulness of evidence terms tat ave been received by te agent(s).