Defeasible Deontic Reasoning

Transcription

1 Defeasible Deontic Reasoning L. Thorne McCarty Computer Science Department Rutgers University New Brunswick, New Jersey Abstract. This paper combines a system of deontic logic with a system for default reasoning to analyze a notorious philosophical problem: Chisholm s Paradox. The basic approach is to write deontic rules with explicit exceptions, but we also consider the extent to which a set of implicit exceptions can be derived from the underlying deontic semantics. 1 Introduction A frequent topic of conversation among deontic logicians is Chisholm s Paradox: Suppose you are obligated to do α. If you comply with this obligation, then you are obligated to do β. However, if you fail to do α, then you are obligated to do γ which is inconsistent with β. Assume the latter, i.e., that you fail to do α. What are you now obligated to do? It is well known that Standard Deontic Logic (i.e., the modal system KD and its variants, with the necessity operator interpreted as obligation [52, 9]) cannot provide an intuitively satisfying account of such contrary-to-duty imperatives [10], and the search for a better formalism has generated a substantial body of literature [17, 13, 49, 25, 8, 26, 20]. The recent development of formal nonmonotonic logic suggests an alternative approach: Chisholm s Paradox might simply be an instance of default reasoning, in general, applied in this case to the deontic modalities. Loewer and Belzer appear to have taken this position for a number of years [26, 6]. For example, Belzer [5] analyzes both the Chisholm Paradox and the Nixon Diamond [43] within the same framework, drawing a close analogy between defeasible obligations and defeasible beliefs. More recently, Horty [18] has shown that a system of deontic logic proposed by van Fraassen [50] can be translated directly into Reiter s default logic [42]. There are problems with Horty s translation, however, as he readily admits. Unconditional obligations map nicely into normal defaults without prerequisites, but conditional obligations, which are central to the analysis of Chisholm s Paradox, are problematic. Horty suggests at the end of his paper that it may be necessary to use default rules with explicit exceptions, such as Reiter s seminormal defaults, to capture the essential features of conditional obligations. In this paper, I will pursue this suggestion in concrete detail. I will propose a combination of (i) the system of deontic logic presented in [29, 30] and (ii) the system for default reasoning presented in [34] as a formalism for the problems associated with Chisholm s Paradox. It is no coincidence that these two systems fit together quite well. Both were designed for problems encountered in the representation of legal

2 rules, and both are intended as components of a comprehensive Language for Legal Discourse [33, 45]. There is now a growing literature about the role of deontic logic in legal knowledge bases [1, 28, 2, 24], and a growing literature about the role of default rules in legal reasoning [15, 44, 41], but these two lines of inquiry have generally been kept distinct. One exception is the work of Andrew Jones, who has stressed for many years the importance of Chisholm s Paradox for the knowledge representation problems in artificial intelligence and law [19, 21]. I agree completely, and offer the present paper as a possible solution. As an illustration of my approach, I will use the following version of Chisholm s Paradox, due to Belzer [5]: Assume that you are an Icelandic official at the Reykjavik summit in 1986, with access to both Reagan and Gorbachev. President Vigdis Finnbogadottir has entrusted you with a state secret, and has given you the following instructions: You are forbidden to tell the secret to Reagan. You are forbidden to tell the secret to Gorbachev. If you tell the secret to Reagan, then you are obligated to tell the secret to Gorbachev. If you tell the secret to Gorbachev, then you are obligated to tell the secret to Reagan. Assume that a separate sanction is attached to the violation of each of these instructions, and assume various scenarios: you do nothing, you tell Reagan, you tell Gorbachev, etc. What sanctions will be imposed? Note that Belzer s example actually contains two instances of Chisholm s Paradox, each one interacting with the other. To sharpen the puzzle somewhat, we will consider two versions of the story. The first version, called the sequential Reykjavik scenario, assumes that the actions Tell Reagan and Tell Gorbachev can only occur sequentially in time. (For example, Reagan and Gorbachev might be in separate rooms, so you would have to travel back and forth to tell them something.) The second version, called the parallel Reykjavik scenario, assumes that the actions Tell Reagan and Tell Gorbachev can occur simultaneously as well. (For example, Reagan and Gorbachev might be in the same room, so you could but need not address them both at once.) It should be clear that the four deontic rules listed above are more perplexing in the second version than they are in the first. The paper is organized as follows: Section 2 reviews the system of deontic logic presented in [29, 30], and Section 3 reviews the system for default reasoning presented in [34]. The two systems are combined in Section 4 to obtain a representation of deontic defaults. Although the basic approach is to write deontic defaults with explicit exceptions, we then consider in Section 5 the extent to which it is possible to rely on a set of implicit exceptions that are based on the properties of the underlying deontic semantics. 2 Deontic Rules This section summarizes the system of deontic logic presented in [29, 30]. It also introduces some minor modifications of the system, to insure a smoother fit with later

3 sections of the paper. For example, we work explicitly with an intuitionistic logic in this presentation, whereas intuitionistic logic was only suggested as a possibility in the earlier papers. The system has three operators, P, F, O, which mean permitted, forbidden and obligatory, respectively. However, we will only consider two operators, F and O, in the present paper. Technically, the system is a dyadic deontic logic, with the deontic modalities defined on actions rather than propositions. This means that the basic syntactic form is, e.g., F φ α, in which φ is a condition and α is an action. This syntactic form is read as follows: Under the condition φ, the action α is forbidden. The action α, and optionally the condition φ, are expressions in a language defined on worlds, v, w, etc., which have a linear temporal order as a distinguished relation. We often write these actions with the temporal parameters explicitly encoded: e.g., α(, t 1 ), and with the temporal order implicitly understood, i.e., < t 1. Intuitively, this means: The action α occurs over the time interval from to t 1. There are two versions of the logic, depending on the temporal relationship between the condition and the action inside the deontic modality. In one version, the condition is restricted to the past and the action is restricted to the future. Thus, if t 1 < < t 1 is a linear order with designated as the present, the syntactic form F φ(t 1, ) α(, t 1 ) would be allowed. (This is the version treated in [29]; it is all that is required for the sequential Reykjavik scenario.) The second version allows the condition to overlap with the future, i.e., the syntactic form F φ(, t 1 ) α(, t 1 ) would also be allowed. (This is the version required for the parallel Reykjavik scenario.) The second version is more complicated than the first because of the way in which deontic conclusions are detached from the deontic conditionals once we know the true state of the world. We write these detached conclusions as follows: P α, F α, O α. Observe that the statement F α(, t 1 ) is meaningful in the second version of our logic only if we assume a known future as well as a known past. We treat the second, more complex, version here. A deontic structure, S, consists of a set of past worlds, denoted by v, a set of future worlds, denoted by w, and a set of subworlds, denoted by w. Intuitively, v and w are actual worlds, and w is a hypothetical partial world that is used to give the denotation of a possible action. We write v w for a pair of worlds that are joined together at, and likewise for v w. All worlds and subworlds are partially ordered, e.g., v 1 v 2, w 1 w 2, so that we can construct an intuitionistic semantics [23, 12] for the action language considered by itself. The most important component of a deontic structure, however, is the Grand Permitted Set, P, which tells us which subworlds, w, are permitted in any given situation. Formally, P is a set of pairs { v w, w } where v and w are joined together at. Intuitively, given a past world v and a future world w, the subworld w is a permitted course of action if and only if v w, w P. We now give the meaning of the conditional deontic operators, F and O, in terms of the Grand Permitted Set, P. Definition 2.1 The deontic structure, S, satisfies the conditional deontic rule, F φ α, if and only if, for every v and w in S that are joined together at, and for every w, v w = φ and w = α = v w, w P.

4 Definition 2.2 The deontic structure, S, satisfies the conditional deontic rule, O φ α, if and only if, for every v and w in S that are joined together at, and for every w, v w = φ and v w, w P = w = α. Intuitively, α is obligatory if and only if it is true in all permitted subworlds. These relationships are illustrated in Figures 1 and 2. v w "! P Figure 1: The action α is forbidden. P! Figure 2: The action α is obligatory. We also need to specify the meaning of the detached deontic conclusions: F α and O α. Obviously, these conclusions are only meaningful in a structure, S, relative to a pair of worlds, v and w, that are joined together at. Thus: Definition 2.3 v w = F α if and only if, for every w, w = α = v w, w P. v w = O α if and only if, for every w, v w, w P = w = α.

5 We now define truth in a structure in the usual way: A deontic conclusion, δ, is true in S if and only if v w = δ for every pair v w in S. Finally, if is a set of deontic sentences, we write = δ if and only if δ is true in every deontic structure that satisfies. In practice, we usually use this system as follows. We take to be a set of conditional deontic rules in the form: F φ α and O φ α, and we take υ(t, ) and optionally ω(, t) to be a set of ground atomic action formulae that have occurred before (and, optionally, will occur after ). We are then interested in inferences in the form: υ(t, ) ω(, t) = F α (1) υ(t, ) ω(, t) = O α (2) It is important to realize that the future world, represented by w, may not correspond at all to the subworlds, w, that are designated by the Grand Permitted Set. In other words, an agent might violate the law, performing some action α that is forbidden, or failing to perform some action α that is obligatory. It is also possible that an agent has no alternative but to violate the law, if the law itself is in conflict. Suppose we infer both F α and O α for some α, i.e., damned if you do, and damned if you don t. By Definition 2.3, this means that there is no subworld w such that v w, w P, and therefore every action, not just α, would be both forbidden and obligatory. This would not be a very satisfactory system of laws! A slight modification of this system is suggested by the following proposition: Proposition 2.1 Let S be a deontic structure with no dead ends, i.e., for every v w there exists a w such that v w, w P. Then the following sentence: F α O α is true in S for every action α. Thus the no dead ends assumption converts a deontic conflict into a logical contradiction. Recall that we are working within an intuitionistic logic, in which P is just an abbreviation for P. Thus the sentence in Proposition 2.1 says: If α is obligatory, then α is not forbidden, and If α is forbidden, then α is not obligatory. We will make use of these relationships in Section 4, when we analyze deontic defaults. The full complexity of this system only appears when we analyze the interaction between the deontic modalities and the various features of the action language, which are not discussed in the present paper. See [29, 30] for an analysis of the effects of nondeterministic choice, sequential and parallel composition, and existential and universal quantification over objects in the action language. These papers also discuss the third operator, P φ α, which is interpreted as a free choice permission. Ron van der Meyden has developed proof theories for two simplified fragments of the original logic, and shown them to be sound and complete in [47, 48]. The existence of a proof theory for the full deontic system remains an open question. Fortunately, for present purposes, we do not need to investigate the full complexity of the action language. In fact, we can focus attention more precisely on the issues of defeasible deontic reasoning if we make some very simple assumptions about actions. Specifically, let us assume that actions consist of base predicates on temporal intervals, plus defined predicates that are determined only by Horn clause definitions. (For the

6 study of an action language with these characteristics, see [35].) With this restriction, we can extend the syntax of conditional deontic rules to allow stratified negation-asfailure in the condition φ. With such an extension, of course, it is necessary to modify the definition of the inferences (1) and (2). Since we are assuming stratification, there are many candidates for a possible formalization [3, 14, 51], but an approach that meshes well with the overall intuitionistic semantics of our language is described in [36]. Accordingly, we will use conditional deontic rules with stratified negation-asfailure for certain purposes in Section 4, without further discussion. 3 Default Rules with Exceptions This section summarizes the system for default reasoning presented in [34]. The foundation of this system is a logic programming language based on intuitionistic logic, the details of which are given in [31, 32]. Our approach is attractive because it yields a very simple PROLOG interpreter for default rules, and a methodology for incrementally refining a default rulebase. The basic idea is to combine a special failure operator, denoted by, with the operator for full intuitionistic negation, denoted by, to represent various kinds of default rules. For example, the rules for an unemployed dropout [43] might initially be represented as follows: Adult(x) Dropout(x) Adult(x) (3) Employed(x) Dropout(x) Employed(x) (4) Employed(x) Adult(x) Employed(x) (5) Intuitively, for a single default rule in isolation, the operator string means: If you fail to show that it is not the case that..., which also means: If it is consistent that.... Thus rule (3) says: If you show that x is a dropout, and if it is consistent that x is an adult, then conclude that x is an adult. To specify the meaning of a set of default rules, such as (3) (5), we first rewrite them in the following disjunctive form: [Adult(x) Dropout(x)] Adult(x) (6) [ Employed(x) Dropout(x)] Employed(x) (7) [Employed(x) Adult(x)] Employed(x) (8) Let us call Adult(x) Dropout(x) the presumptive disjunct of (6), and let us call Adult(x) the blocking disjunct, and similarly for the remaining rules. Suppose we want to know if a query Employed(a) follows from rules (3) (5) and a given set of ground assertions. Roughly speaking, we say that this query is a justifiable presumption if it follows from a subset of the presumptive disjuncts in (6) (8) and if this subset of presumptive disjuncts is not blocked, that is, the disjunction of their associated blocking conditions is not entailed by the given set of ground assertions. Formally, we write a general default rule as follows: P(x) i G i (x) j D j (x), (9)

7 and we write the disjunctive version of this rule as: [ ] P(x) i G i (x) j D j (x). (10) Note that (9) and (10) would be equivalent if and were interpreted as classical implication and classical negation, respectively, but they are not equivalent intuitionistically. Using the terminology suggested above, P(x) i G i (x) is the presumptive disjunct of (10), and { D j (x)} is a set of blocking disjuncts. Now let D be a set of default rules rewritten in the disjunctive form (10). Let R be a set of monotonic rules in our logic programming language [31, 32], and let s 0 be an initial database consisting of ground atomic formulae. Definition 3.1 P(x)θ is a justifiable presumption if and only if there exists some instantiated set of presumptive disjuncts: d = {P k (x)θ k i G k,i (x)θ k }, such that 1. R d s 0 = P(x)θ, but 2. R D s 0 = k,j D k,j (x)θ k, where { D k,j (x)θ k } is the set of blocking disjuncts associated with d. We emphasize again that the entailment relation in this definition is intuitionistic, rather than classical. In [34], we describe a simple PROLOG interpreter that computes the justifiable presumptions given by Definition 3.1, and we show how this interpreter can be used to construct and incrementally refine a default rulebase. We have tested this interpreter on more than 40 standard examples from the literature. Default rules in the form (3) (5) are analogous to the normal defaults of Reiter s system [42]. Furthermore, if D j (x) = P(x) and all the G i (x) are null, then rule (9) is analogous to a normal default without prerequisites. In this case, Definition 3.1 can be simplified further: Proposition 3.1 Assume that D is a set of normal defaults without prerequisites. Then P(x)θ is a justifiable presumption if and only if there exists some instantiated set of presumptive disjuncts d = {P k (x)θ k } such that 1. R d s 0 = P(x)θ, but 2. R d s 0 =. This is essentially the formulation of default reasoning proposed by Poole [40], except that we are using intuitionistic logic rather than classical logic. However, it is well known that normal defaults often generate unintended extensions, and the same is true in our system, i.e., it is possible to generate many unintended justifiable presumptions. For example, with rules (3) (5) in D and with the atomic formula Dropout(a) in s 0, Definition 3.1 tell us that Employed(a) and Employed(a) are both justifiable presumptions. There are two ways to block this result.

8 The first approach, investigated in [34], is to add further conditions inside the operator string, giving us an analogue of Reiter s seminormal defaults. For example, rule (5) might be rewritten as: Employed(x) Adult(x) (Employed(x) Dropout(x)), (11) or, in the disjunctive version, as: [Employed(x) Adult(x)] (Employed(x) Dropout(x)). (12) Now, applying Definition 3.1 with Dropout(a) in s 0, the second disjunct in (12) is provable, and therefore Employed(a) is no longer a justifiable presumption. Alternatively, rule (5) could be rewritten as the analogue of a general nonnormal default: Employed(x) Adult(x) Dropout(x), (13) or, in the disjunctive version, as: [Employed(x) Adult(x)] Dropout(x). (14) Rule (13) differs from rule (11) in allowing contrapositive inferences to go through, but both rules are blocked by the assertion of Dropout(a) in s 0. The second way to block an unintended justifiable presumption is to add a form of stratified negation-as-failure inside the presumptive disjunct. For example, if we wanted to block the application of rule (5) when x is a Dropout, we could rewrite the disjunctive rule (8) as follows: [Employed(x) Adult(x) Dropout(x)] Employed(x). (15) In our PROLOG intepreter [34], we provide an operator \+ which implements the negation-as-failure operation that appears in (15). The semantic interpretation of such a rule is tricky, however, since these two kinds of nonmonotonic inference can potentially interact. We solve this problem in our interpreter simply by barring such interaction. Thus \+ means: not provable without using any presumptions. We use both of these approaches in the following section to encode various kinds of deontic defaults. In the case of the second approach, we also guarantee that the negation-as-failure operation is well-defined. 4 Deontic Defaults It should now be obvious how to combine the deontic rules from Section 2 with the default rules from Section 3 to obtain a representation of deontic defaults. The basic idea is to write a conditional deontic expression, e.g., F φ α, as the presumptive disjunct of a default rule, and to write an unconditional deontic expression, e.g., F β, inside the operator string. In this section, we consider two versions of this idea. First, we consider the special case of normal deontic defaults, i.e., we assume that β = α. In this case we also allow a generalization of the condition φ to include stratified negation-as-failure, as suggested at the end of Section 2. To illustrate the use of these rules, we encode the story of Reagan and Gorbachev at Reykjavik, but we also suggest that there are some problems with the encoding of the parallel Reykjavik scenario. We then consider the case of general deontic defaults, without restrictions on the blocking disjuncts, and

9 we show how to represent the parallel Reykjavik scenario using these more general rules. Finally, in Section 4.3, we consider a hybrid representation which combines some of the best features of both encodings. All of the default rules in this section have been tested by running them through the PROLOG interpreter described in [34]. 4.1 Normal Deontic Defaults Let us first consider deontic defaults in the following form: F φ 1... ψ 1... α F α, (16) O φ 1... ψ 1... α O α. (17) For simplicity, we plan to use Proposition 3.1 directly to define the concept of a justifiable deontic presumption in this case, rather than the more general Definition 3.1. But we can then simplify the representation of deontic defaults even further. Notice that the set of blocking disjuncts is not mentioned in Proposition 3.1. We can thus omit the conditions F α in (16) and O α in (17) entirely, and simply write down a set of conditional deontic rules,, which are understood to be normal defaults. These considerations lead us to the following definition: Definition 4.1 Let be a set of conditional deontic rules in the form: F φ 1... ψ 1... α, O φ 1... ψ 1... α, and let δ be a conjunction of deontic conclusions in the form F α i and O α i. We say that δ is a justifiable presumption if and only if there exists some instantiated set of deontic rules d such that 1. R d υ(t, ) ω(, t) = δ, but 2. R d υ(t, ) ω(, t) =. We allow R to be any set of monotonic rules: e.g., Horn clauses defining actions, or conditional deontic rules that are not intended to be treated as defaults. However, we do not allow predicates in the action language to be defined using expressions in the deontic language. This stratification of actions and deontic modalities guarantees that the use of negation-as-failure in Definition 4.1 is well-defined. We now show how to use these normal deontic defaults to encode the story of Reagan and Gorbachev at Reykjavik. The sequential Reykjavik scenario is easy. Let φ( ) represent the conditions attached to all the rules e.g., that you are at the summit, that you possess a secret, etc. and let R(, t 1 ) and G(, t 1 ) represent the actions Tell Reagan and Tell Gorbachev respectively. We first try a literal translation of President Finnbogadottir s instructions: F φ( ) R(, t 1 ) (18) F φ( ) G(, t 1 ) (19)

10 O R(t 1, ) φ( ) G(, t 1 ) (20) O G(t 1, ) φ( ) R(, t 1 ) (21) Note that rules (20) (21) reflect the sequentiality assumption. For example, rule (20) says: If you have told the secret to Reagan in the time interval from t 1 to, then you are obligated to tell the secret to Gorbachev in the time interval from to t 1. Now imagine that these are absolute deontic rules rather than deontic defaults, i.e., assume they are included in R rather than. Then, if R(t 1, ) happens to be true in υ(t 1, ), and if φ( ) is also true, the conditions in (19) and (20) would both be satisfied and we would have a deontic contradiction. Although there are suggestions in the literature that Chisholm s Paradox can be solved by a proper analysis of the interaction between the deontic and the temporal modalities [46, 4, 30, 37], this example suggests that default rules are necessary even in the sequential case. Accordingly, we put rules (18) (21) in and we apply Definition 4.1. But now there are too many justifiable presumptions. For example, assume again that R(t 1, ) happens to be true in υ(t 1, ). Then O G(, t 1 ) becomes a justifiable presumption by the selection of rule (20) from, which was probably the President s intention, but F G(, t 1 ) is also a justifiable presumption by the selection of rule (19). If we wished to block this latter possibility, we could modify rule (19) by adding an explicit exception to the condition φ( ). A similar argument applies to rules (18) and (21). We might thus decide to replace rules (18) and (19) with: F G(t 1, ) φ( ) R(, t 1 ) (22) F R(t 1, ) φ( ) G(, t 1 ) (23) The total set of deontic rules now corresponds to the following clarification of President Finnbogadottir s instructions: You are forbidden to tell the secret to Reagan, unless you have already told it to Gorbachev. You are forbidden to tell the secret to Gorbachev, unless you have already told it to Reagan. If you have told the secret to Reagan, then you are obligated to tell the secret to Gorbachev. If you have told the secret to Gorbachev, then you are obligated to tell the secret to Reagan. These instructions now seem quite clear, and rules (22) (23) and (20) (21) seem to be a perfectly adequate solution to the problem. There is no denying, however, that the parallel Reykjavik scenario is more complex than the sequential Reykjavik scenario. Let us try the analogous rules in the parallel case: F φ( ) G(, t 1 ) R(, t 1 ) (24) F φ( ) R(, t 1 ) G(, t 1 ) (25)

11 O φ( ) R(, t 1 ) G(, t 1 ) (26) O φ( ) G(, t 1 ) R(, t 1 ) (27) Applying these rules, if you tell the secret to Reagan without telling Gorbachev, then you have violated (24) and (26), and if you tell the secret to Gorbachev without telling Reagan, then you have violated (25) and (27), exactly as in the sequential case. But suppose you tell the secret to Reagan and Gorbachev simultaneously? Then it turns out that you have satisfied all your obligations and violated none of your prohibitions, i.e., you are subject to no sanctions at all! Surely, this was not what President Finnbogadottir intended! Let us see if it is possible to modify this result. The problem arises because rules (24) and 25) are both blocked if G(, t 1 ) and R(, t 1 ) both happen to be true in ω(, t 1 ). Thus, to stipulate that a particular action is forbidden in this situation, we would have to write down some additional deontic rules. There are two possibilities: F φ( ) R(, t 1 ) G(, t 1 ) R(, t 1 ) (28) F φ( ) R(, t 1 ) G(, t 1 ) G(, t 1 ) (29) We can choose one of these rules, or both, or neither. For simplicity, let us assume initially that (28) and (29) are absolute deontic rules rather than deontic defaults, i.e., assume they are included in R rather than. Then the four possible justifiable presumptions are: (i) We could adopt rule (28), which would block rule (27). In other words, we could stipulate that you have violated the rule that forbids you to tell the secret to Reagan, but you have complied with the rule that obligates you to tell the secret to Gorbachev. (ii) We could adopt rule (29), which would block rule (26). In other words, we could stipulate that you have violated the rule that forbids you to tell the secret to Gorbachev, but you have complied with the rule that obligates you to tell the secret to Reagan. (iii) We could adopt rules (28) and (29) together, thus blocking rules (27) and (26). (iv) We could adopt neither rule. In practice, of course, we would put rule (28) and/or rule (29) in, and modify the corresponding condition in rule (27) and/or rule (26). Definition 4.1 allows us to do this, and thus achieve any combination of justifiable presumptions we want. The question is: Does the system of deontic rules that we construct in this way make sense? Suppose we decide to treat the situation in which G(, t 1 ) and R(, t 1 ) are both true in ω(, t 1 ) as a violation of the rule that forbids you to tell the secret to Reagan, but as a compliance with your obligation to tell the secret to Gorbachev, i.e., presumption (i). (Perhaps the Icelandic government would prefer to offend the Americans and appease the Russians.) We could do this as follows: F φ( ) G(, t 1 ) R(, t 1 ) (30)

12 F φ( ) R(, t 1 ) G(, t 1 ) (31) O φ( ) R(, t 1 ) G(, t 1 ) (32) O φ( ) G(, t 1 ) R(, t 1 ) R(, t 1 ) (33) F φ( ) R(, t 1 ) G(, t 1 ) R(, t 1 ) (34) These rules correspond to the following clarification of President Finnbogadottir s original instructions: You are forbidden to tell the secret to Reagan, unless you simultaneously tell it to Gorbachev. You are forbidden to tell the secret to Gorbachev, unless you simultaneously tell it to Reagan. If you tell the secret to Reagan, then you are obligated to tell the secret to Gorbachev. If you tell the secret to Gorbachev, then you are obligated to tell the secret to Reagan, unless you simultaneously tell it to Reagan. If you tell the secret to Reagan and Gorbachev simultaneously, then you have violated a rule that forbids you to tell the secret to Reagan. But isn t there something odd about rules (33) and (34), especially in the English translation? We will return to this question in Section 5. In the meantime, we will consider an alternative approach to the representation of the parallel Reykjavik scenario. 4.2 General Deontic Defaults We now consider deontic defaults without syntactic restrictions. We are thus interested in rules in the following form: F φ α j F β j j O β j, (35) O φ α j O β j j F β j. (36) Converting (35) and (36) to disjunctions, we have: F φ α j F β j j O β j, (37) O φ α j O β j j F β j, (38) Using the terminology from Section 3, we designate F φ α and O φ α as the presumptive disjuncts of these rules, and we designate F β j and O β j as the blocking disjuncts. To simplify notation, we sometimes let D stand for either of the deontic operators F and O in these blocking disjuncts.

13 Definition 4.2 Let be a set of general deontic defaults written in the disjunctive form (37) (38), and let δ be a conjunction of deontic conclusions in the form F α i and O α i. We say that δ is a justifiable presumption if and only if there exists some instantiated set of presumptive disjuncts d = {F φ k α k } {O φ k α k } such that 1. R d υ(t, ) ω(, t) = δ, but 2. R υ(t, ) ω(, t) = k,j D β k,j, where { D β k,j } is the set of blocking disjuncts associated with d. We are thus applying the general machinery of [34] to the case of deontic defaults. In Section 4.1, we identified four possible presumptions in the problematic situation in which G(, t 1 ) and R(, t 1 ) are both true in ω(, t 1 ). Rules (30) (34) encoded presumption (i), i.e., the situation is seen as a violation of the prohibition against telling Reagan, and a compliance with the obligation to tell Gorbachev. However, we might instead construe President Finnbogadottir s instructions as ambiguous between presumption (i) and presumption (ii), i.e., the situation could also be seen as a violation of the prohibition against telling Gorbachev, and a compliance with the obligation to tell Reagan. This type of ambiguity is a familiar phenomenon in default reasoning, and it has an idiomatic representation using general deontic defaults. Let us first focus on the third and fourth instructions, which are the prime examples of contrary-to-duty imperatives [10]. We will split each of these instructions into two parts, one part stating the obligation and one part restating the prohibition. Here is the third instruction, followed by the English translation: O φ( ) R(, t 1 ) G(, t 1 ) F R(, t 1 ) (39) F φ( ) R(, t 1 ) R(, t 1 ) O G(, t 1 ) (40) If you tell the secret to Reagan, then you are obligated to tell the secret to Gorbachev, assuming it is consistent that you are forbidden to tell the secret to Reagan, and you are forbidden to tell the secret to Reagan, assuming it is consistent that you are obligated to tell the secret to Gorbachev. Here is the fourth instruction, followed by the English translation: O φ( ) G(, t 1 ) R(, t 1 ) F G(, t 1 ) (41) F φ( ) G(, t 1 ) G(, t 1 ) O R(, t 1 ) (42) If you tell the secret to Gorbachev, then you are obligated to tell the secret to Reagan, assuming it is consistent that you are forbidden to tell the secret to Gorbachev, and you are forbidden to tell the secret to Gorbachev, assuming it is consistent that you are obligated to tell the secret to Reagan. Intuitively, this representation seems to capture the ambiguity between presumption (i) and presumption (ii), as desired. Applying Definition 4.2, we now show that this ambiguity is captured formally as well. Assume that G(, t 1 ) and R(, t 1 ) are both true in ω(, t 1 ). Consider the query: F R(, t 1 ) F G(, t 1 )? (43)

14 Initially, this query succeeds using the presumptive disjuncts from rules (40) and (42). However, we must now check to see if the blocking disjunction: O G(, t 1 ) O R(, t 1 ) (44) also succeeds. The reader can easily verify that (44) is provable from (40) and (42), and thus (43) is not a justifiable presumption. Now consider the query: O G(, t 1 ) O R(, t 1 )? (45) This query also succeeds initially, using the presumptive disjuncts from rules (39) and (41). However, the blocking disjunction: F R(, t 1 ) F G(, t 1 ) (46) is provable from (39) and (41), and thus (45) is not a justifiable presumption. We have thus shown that neither presumption (iii) nor presumption (iv) from Section 4.1 is justifiable, given rules (39) (42). On the other hand, presumption (i) from Section 4.1 would be represented by the following query: F R(, t 1 ) O G(, t 1 )? (47) This query succeeds using the presumptive disjuncts in rules (40) and (39), and the blocking disjunction associated with these rules: O G(, t 1 ) F R(, t 1 ), (48) turns out not to be provable. To see this, it is sufficient to note that we can assert F R(, t 1 ) which implies O R(, t 1 ) and O G(, t 1 ) which implies F G(, t 1 ) and thereby satisfy the disjunctive versions of rules (39) (42) without satisfying (48). Thus, by Definition 4.2, (47) is a justifiable presumption. By a symmetrical argument, the following query is also a justifiable presumption: F G(, t 1 ) O R(, t 1 )? (49) We have thus shown that presumptions (i) and (ii) are both justifiable when G(, t 1 ) and R(, t 1 ) are true in ω(, t 1 ). We now return to the first two instructions in the Reykjavik scenario. To represent these instructions in a single compact rule, we note the following equivalence in our system of deontic logic: F φ α β F φ α F φ β This equivalence follows directly from Definition 2.1. Using it, we can write a rule that forbids telling the secret either to Reagan or to Gorbachev. Here is the formal encoding, followed by the English translation: F φ( ) R(, t 1 ) G(, t 1 ) F R(, t 1 ) F G(, t 1 ) (50) You are forbidden to tell the secret either to Reagan or to Gorbachev, assuming it is consistent that you are forbidden to tell the secret to Reagan and consistent that you are forbidden to tell the secret to Gorbachev.

15 This completes our encoding of the parallel Reykjavik scenario using general deontic defaults. The reader may wish to compute the justifiable presumptions that are supported by rules (39) (42) and (50) in various situations. If φ( ) is the only condition that is true in ω(, t 1 ), then F R(, t 1 ) and F G(, t 1 ) are both justifiable presumptions by rule (50). But suppose R(, t 1 ) is also true in ω(, t 1 ). Then the blocking disjunction in rule (50) is provable from the disjunctive version of rule (39). In this case, however, F R(, t 1 ) is a justifiable presumption by virtue of rule (40), and O G(, t 1 ) is a justifiable presumption by virtue of rule (39). The dual analysis obviously applies if G(, t 1 ) is true in ω(, t 1 ) but R(, t 1 ) is not. Finally, if both R(, t 1 ) and G(, t 1 ) are true in ω(, t 1 ), then the only justifiable presumptions are those generated by (39) and (40), or by (41) and (42), but not by any other combinations, as noted above. 4.3 A Hybrid Representation We now show that the techniques developed in the previous two sections can be combined into a single representation of the parallel Reykjavik scenario. We do this by mixing stratified negation-as-failure with general deontic defaults. Once again, we do not allow predicates in the action language to be defined using expressions in the deontic language, thus insuring the integrity of the stratification. The first two instructions can be encoded using normal defaults and stratified negation-as-failure, as in rules (30) (31): F φ( ) G(, t 1 ) R(, t 1 ) F R(, t 1 ) (51) F φ( ) R(, t 1 ) G(, t 1 ) F G(, t 1 ) (52) You are forbidden to tell the secret to Reagan, unless you simultaneously tell it to Gorbachev. You are forbidden to tell the secret to Gorbachev, unless you simultaneously tell it to Reagan. The third and fourth instructions can then be encoded using general defaults, as in rules (39) and (41): O φ( ) R(, t 1 ) G(, t 1 ) F R(, t 1 ) (53) O φ( ) G(, t 1 ) R(, t 1 ) F G(, t 1 ) (54) If you tell the secret to Reagan, then you are obligated to tell the secret to Gorbachev, assuming it is consistent that you are forbidden to tell the secret to Reagan. If you tell the secret to Gorbachev, then you are obligated to tell the secret to Reagan, assuming it is consistent that you are forbidden to tell the secret to Gorbachev.

16 Intuitively, rules (51) (54) provide a reasonable interpretation of President Finnbogadottir s instructions in all the nonproblematic situations. We now add special rules to handle the problematic situation in which G(, t 1 ) and R(, t 1 ) are both true in ω(, t 1 ). It turns out that these rules can be written as normal defaults: F φ( ) R(, t 1 ) G(, t 1 ) R(, t 1 ) F R(, t 1 ) (55) F φ( ) R(, t 1 ) G(, t 1 ) G(, t 1 ) F G(, t 1 ) (56) If you tell the secret to Reagan and Gorbachev simultaneously, then you are forbidden to tell the secret to Reagan, assuming this is consistent, and you are forbidden to tell the secret to Gorbachev, assuming this is consistent. The reader can verify that the justifiable presumptions generated by rules (51) (56) according to Definition 4.2 are exactly the same as the justifiable presumptions generated by rules (39) (42) and (50). One nice feature of this representation, however, is that the problematic situation is now isolated in rules (55) (56) and treated as a special case. This makes it easy to modify the justifiable presumptions. For example, we could replace the normal defaults in (55) (56) with the following absolute deontic sentence: F φ( ) R(, t 1 ) G(, t 1 ) R(, t 1 ), (57) and rules (51) (54) and (57) would then generate exactly the same justifiable presumptions as rules (30) (34). 5 Implicit Exceptions In the previous section, we have seen how to encode a rather complex version of Chisholm s Paradox using default deontic rules. But the reader may have asked: Is it necessary to write all of this down explicitly? Can t we instead identify the exceptions that are implicit in the original statement of the problem? To some extent, we can. Consider our initial analysis of the sequential Reykjavik scenario, when we decided to replace rule (19) with rule (23). It is obvious that rule (19) conflicts with rule (20) when the conditions of both rules are satisfied, and yet the condition of (20) is strictly more specific than the condition of (19). Thus, applying virtually any of the specificity principles from the literature, e.g., [39] or [27], we would conclude that rule (20) takes precedence. And this is exactly the choice we made when we added the explicit exception to rule (23). Moreover, the specificity principle can be further justified in this case by reference to the underlying deontic semantics. Notice that the Grand Permitted Set is inherently nonmonotonic. As we move from v up the partial order to v there is no reason to expect any relationship at all between the subworlds w such that v, w P and the subworlds w such that v, w P. However, the entailment relation given by (1) and (2) is inherently monotonic. The task, therefore, is to use the various nonmonotonic features in our deontic language to capture the inherently nonmonotonic structure of the Grand Permitted Set. In carrying out this task, it is natural to ask questions about the fit between our linguistic expressions and our semantic intentions.

17 R v P G Figure 3: You are forbidden to tell Gorbachev. R v P G Figure 4: You are obligated to tell Gorbachev. Consider, for example, the two justifiable presumptions that are supported by rules (19) and (20) when R(t 1, ) is true in υ(t 1, ). Each is an assumption about the structure of the Grand Permitted Set. Figure 3 shows the Grand Permitted Set if we adopt the presumption F G(, t 1 ), and Figure 4 shows the Grand Permitted Set if we adopt the presumption O G(, t 1 ). (We have joined the Grand Permitted Set directly to v in these drawings, since there is no future world w.) Suppose we wanted to eliminate this ambiguity, using the available nonmonotonic features of our language. One way to do this is to add an explicit exception to rule (19), producing rule (23) and identifying Figure 4 as the intended interpretation. If, instead, we wanted to identify Figure 3 as the intended interpretation, there is an easier way to do this: Delete rule (20) completely! Conversely, if we assume that every linguistic expression plays some role in delineating the structure of the Grand Permitted Set, then we have to conclude that Figure 4 is the more coherent intepretation of President Finnbogadottir s original instructions. Similar arguments apply to the parallel Reykjavik scenario, but the difficulties here are more subtle. Let us reconsider rules (33) and (34), where we used an explicit exception to pick out a single justifiable presumption in the situation in which G(, t 1 ) and R(, t 1 ) are both true in ω(, t 1 ). Recall the English translation: If you tell the secret to Gorbachev, then you are obligated to tell the secret to Reagan, unless you simultaneously tell it to Reagan. If you tell the secret to Reagan and Gorbachev simultaneously, then you have violated a rule that forbids you to tell the secret to Reagan. Why does this sound so odd? Figure 5 shows the justifiable presumptions that are supported by rules (31) and (33) when G(, t 1 ) is true but R(, t 1 ) is not. Figure 6 shows the justifiable presumptions that are supported by rules (32) and (34) when both G(, t 1 ) and R(, t 1 ) are true. There are no superfluous rules here, as there were in Figure 3. Instead the problem lies in the relationship between Figure 5 and Figure 6, and the corresponding relationship between rule (33) and rule (34). In Figure 5, you are obligated to tell the secret to Reagan, but have not done so, and in Figure 6, where you actually have told the secret to Reagan, it turns out that what you have

18 v w G P G R Figure 5: You tell Gorbachev but not Reagan. v w G R P R G Figure 6: You tell Gorbachev and Reagan. done is forbidden. So in what sense was this action really obligatory in rule (33) in the first place? There are two problems of coherence here. First, the Grand Permitted Set in the parallel Reykjavik scenario is very strange, allowing situations such as Figures 5 and 6 to coexist. In Figure 5, every subworld w such that v w, w P satisfies the proposition R(, t 1 ), but these w s are not contained in w. We conclude that w is not in compliance with the rules, and we assume that a modified w in which R(, t 1 ) is true would be an improvement. However, Figure 6 depicts exactly this situation, and yet it tells us that v w, w P whenever w satisfies R(, t 1 ). Thus, if we assume that the Grand Permitted Set induces some kind of ranking on the future worlds w, then the deontic structures depicted in Figures 5 and 6 clearly violate this ranking. Recall that Figure 6 represents presumption (i) from Section 4.1. Presumption (ii) is symmetrical, and creates exactly the same problems. In fact, the only choice that avoids these problems is presumption (iv) in which O G(, t 1 ) and O R(, t 1 ) are both true. But this presumption was rejected on external grounds, i.e., it

19 was not what the President intended. (We cannot allow such behavior to occur without imposing some sanctions! We cannot tolerate the gamesmanship that such an interpretation would encourage!) As soon as we reject presumption (iv), however, we must acknowledge that the Grand Permitted Set will include some anomalous elements. The second problem of coherence arises from the choice of linguistic expression in rules (30) (34). Granted that Figures 5 and 6 are anomalous, rules (33) and (34) only serve to focus our attention on the anomaly. By contrast, rules (39) (42) and (50) tend to conceal the anomaly as part of an overall structural ambiguity. In this encoding, presumption (i), which is depicted in Figure 6, arises from rules (39) (40), while the situation depicted in Figure 5 arises from rules (41) (42); for presumption (ii), these pairs of rules are simply reversed. Even better is the hybrid representation given by rules (51) (56). Here, rules (51) (54) delineate the structure of the Grand Permitted Set in the nonproblematic situations. The problematic situation is treated as a special case, as it should be. These are not logical principles, of course. They are principles of coherent discourse [16]: Gricean maxims for deontic rules. Is this the only sense in which we can identify implicit exceptions in the original statement of the Reykjavik scenario? 6 Discussion Chisholm s paradox has been a refractory problem for many years. This paper has proposed a solution that combines a system of deontic logic [29, 30] with a technique for encoding default rules with explicit exceptions [34]. The combined system is very flexible, and seems capable of representing the many complex interactions that can arise among defeasible deontic rules. The paper has also demonstrated a methodology for constructing deontic rules with explicit exceptions. We start with an overly general representation, such as President Finnbogadottir s original instructions, encoded either as absolute deontic rules or as normal deontic defaults. Since we know that the Grand Permitted Set is inherently nonmonotonic, we now modify our initial representation in various ways in an attempt to capture this nonmonotonicity. Our language provides two basic nonmonotonic devices (see Sections 4.1 and 4.2) to achieve this goal, and several nonmonotonic idioms. We are constrained somewhat by coherence constraints on the Grand Permitted Set, and by certain Gricean maxims that establish preferred relationships between our linguistic expressions and the underlying deontic semantics. But these constraints are not absolute. They can be overcome by external factors, such as the stipulation that this was not what the President intended. Most of the literature on Chisholm s Paradox [17, 13, 49, 25, 26, 20] has pursued a more ambitious goal. The aim seems to be to write down the deontic instructions as given, and then to provide an interpretation of the deontic conditional that will generate the correct inferences in every case. Usually, this deontic conditional is defined by some ranking of possible worlds, in which the worlds with the lowest ranking are the most preferred or the most ideal. In fact, Belzer s original solution to the Reykjavik problem takes exactly this form [5]. Recently, the nonmonotonic reasoning community has investigated a similar approach to the problem of epistemic defaults [11, 22, 38, 7], in which the worlds with the lowest ranking are the most normal ones, and Horty has suggested that some of this work might be applicable

20 to deontic logic:... it seems reasonable to expect that some of the general techniques for handling exceptions currently being explored within nonmonotonic reasoning might apply also to the analogous problems in deontic logic allowing us, for example, to derive the right conditional oughts from a set of background imperatives, while keeping the representation of imperatives simple. [18] w 3 G w1 w 2 G R w 4 R Figure 7: A ranking of future worlds. I doubt that this ambitious goal will ever be achieved. Let us see how a preference ranking would work in the Reykjavik problem. (This particular analysis was suggested to me by Craig Boutilier.) Figure 7 shows a ranking of the future worlds w that might be generated from President Finnbogadottir s instructions in a system of conditional logic [7]. The most preferred world is w 1, in which neither G(, t 1 ) nor R(, t 1 ) is true. The least preferred worlds are w 3 and w 4, and the double arrow between them indicates that neither one is preferred over the other. Intermediate in the ranking is w 2. Figure 7 thus informs us that it is better to tell both Reagan and Gorbachev than to tell either one alone, but it is better still to tell neither. This is a natural interpretation of the original instructions, and a reasonable guide to proper behavior in the Reykjavik scenario. However, this is not exactly the problem that we were asked to solve. Instead, we have adopted in this paper the posture of a public official a judge, say who observes the future world w, determines which detached deontic conclusions are in effect and which ones are violated, and then applies the appropriate sanctions. The ranking in Figure 7 solves this problem in the easy cases. For example, if the judge observes that neither G(, t 1 ) nor R(, t 1 ) is true, then Figure 7 tells us that this is the most preferred situation. In this case, no rules have been violated. If the judge observes that only G(, t 1 ) is true, then Figure 7 shows a more preferred situation in which R(, t 1 ) is true, and this could be interpreted as a violation of the obligation