Hyper model checking for high-level relational models

2025-12-12

AI Summary

Existing formal methods lack high-level verification support for hyperproperties during early system design stages; although Alloy excels at relational modeling, it natively lacks hyperproperty verification capabilities. Method: We propose HyperPardinus—the first framework integrating hyperproperty verification into Alloy—by extending the Pardinus temporal logic backend to unify relational modeling, quantified template encoding, and SAT/SMT solving, while conservatively incorporating底层 detectors (e.g., MCHyper, HyperQube). Contribution/Results: Its core innovation is a novel model-finding algorithm enabling verification of complex hyperproperties with alternating quantifiers, coupled with abstraction-level counterexample visualization. Experiments demonstrate that HyperPardinus efficiently generates human-understandable high-level (counter)examples in canonical security and concurrency scenarios, significantly enhancing the feasibility and practicality of hyperproperty verification at the design stage.

Technology Category

Knowledge Representation and Reasoning: Diagnosis and Abductive ReasoningConstraint Satisfaction and Optimization: Satisfiability Modulo TheoriesReasoning under Uncertainty: Other Foundations of Reasoning under Uncertainty

Application Category

Graph Algorithms and Modeling for the Web: Algorithms and analysis for heterogeneous, signed, attributed, multi-relational, temporal, higher-order, and annotated Web-related graphsSystems and Infrastructure for Web, Mobile and WoT: Experiences and lessons learnt from Web-based algorithms and system deploymentsWeb Mining and Content Analysis: Models for Web evolution

Abstract

Many properties related to security or concurrency must be encoded as so-called hyperproperties, temporal properties that allow reasoning about multiple traces of a system. However, despite recent advances on model checking hyperproperties, there is still a lack of higher-level specification languages that can effectively support software engineering practitioners in verifying properties of this class at early stages of system design. Alloy is a lightweight formal method with a high-level specification language that is supported by automated analysis procedures, making it particularly well-suited for the verification of design models at early development stages. It does not natively support, however, the verification of hyperproperties. This work proposes HyperPardinus, a new model finding procedure that extends Pardinus -- the temporal logic backend of the Alloy language -- to automatically verify hyperproperties over relational models by relying on existing low-level model checkers for hyperproperties. It then conservatively extends Alloy to support the specification and automatic verification of hyperproperties over design models, as well as the visualization of (counter-)examples at a higher-level of abstraction. Evaluation shows that our approach enables modeling and finding (counter-)examples for complex hyperproperties with alternating quantifiers, making it feasible to address relevant scenarios from the state of the art.

Problem

• Extends Alloy to verify hyperproperties in early design
• Enables automated checking of security and concurrency hyperproperties
• Supports specification and visualization of hyperproperty counterexamples

Innovation

• Extends Alloy's Pardinus backend for hyperproperty verification
• Relies on existing low-level hyperproperty model checkers
• Enables specification, verification, and visualization of hyperproperties