One Minute Madness PLMW 2014 Alexander Bakst Data Structure Verification via Refinement Types function append(x1, x2) { if (x1 != null){ var n = x1.next; x1.next = append(n, x2); return x1; } else { return x2; } } Alexander Bakst University of California, San Diego Andrew Bedford

Benjamin Greenman Conditional Inheritance

class List extends Eq> given T extends Eq

0Ben Greenman, Cornell University 1/1 Cole Schlesinger tomorrow at 3:15pm come see CAROLYN ANDERSON present NetKAT an algebraic presentation of network packet processing and verifcation Cyrus Omar Type-Oriented Foundations for Safely Extensible Programming Systems

Cyrus Omar, CMU

client compatibility G+R R G,#P,#Q,#R features

G G (syntax, type system, implementation G+P G+Q C+A P Q strategy, editor service)

(a) Separate Languages (b) Extensible Language language library Denis Bogdanas K

I I I K

I

I

I

I I

I Diego Gomez Ajhuacho Elias Castegren

Elizabeth Davis Modeling Steganography with Linear Epistemic Logic Elizabeth Davis Advisor: Frank Pfenning

Bit ops + normalization

Innocuous cover Embedded steganographic message message Epistemic logic : reason about information gained from extracting encoded message

Linear logic : reason about consumption and generation of resources in changing state

Linear Epistemic logic : reason about actions based on changing information state (DeYoung & Pfenning, 2009)

– K says A : linear affirmation

– K has A : linear knowledge

– K knows A : persistent knowledge

Eric Mullen

Eric Seidel Refinement'Types'with'LiquidHaskell'

data$Text$=$Text$ $${$arr$::$Array $$,$off$::${v:Nat$|$v$$$$$$$<=$alen$arr} $$,$len$::${v:Nat$|$v$+$off$<=$alen$arr}$ $$}$

type$Nat$=${v:Int$|$v$>=$0}

measure$alen$::$Array$A>$Nat

Eric'Seidel';;'UC'San'Diego' Erick Lavoie Erick Lavoie, PhD @ McGill University

Why? Allow scientists and engineers to run MATLAB code in the browser, fast!

static dynamic (JIT) How? MATLAB JSON AST JavaScript McLab new MATLAB VM in JS

•Find the fastest JS subset for num. computation Impact? •Design techniques for dynamic compilation to JS •Characterize the performance behaviour of complex VMs •Understand optimization across multiple VM layers Ethel Bardsley • Verify kernels • Atomics make this harder • Refined abstraction Evgeny Roubinchtein (Re)Implementing MetaOCaml: a multi-stage programming system

Multi-stage programming?

I A generalization of RE.compile() I A(typed)eval() I A partial evaluation you can repeat again (and again, and again. . . ) Is this stu↵new?

I Native compiler has been done for OCaml 3 I compiler has been done for OCaml 4 I (As far as I know) native compiler hasn’t yet been done for OCaml 4 Me Evgeny Roubinchtein, University of British Columbia, advised by Ron Garcia Ezgi Cicek Bound

A Type System for Incremental Computational Complexity Ezgi Cicek, MPI-SWS

Tuesday, January 21, 14 Fabian Muehlboeck Fabian Muehlboeck Gradual Typing for OO languages

List SnocS(IEnumerable startS, T endS) { var elemsS = startS.ToList(); elemsS.Add(endS); return elemsS; }

dynamic SnocD(dynamic startD, dynamic endS) { var elemsD = startD.ToList(); elemsD.Add(endD); return elemsD; } Felipe Banados Gradual'Type,and,Effect'Systems' Felipe'Bañados'–'University'of'Chile' Filip Niksic FILIP NIKSIC MPI-SWS

void thread() { // Non-critical section

synchronized(lock) { // Critical section } }

1 Hannah Gommerstadt Vulnerability Distribution on the Android (~10,000 analyzed applications)

Cryptographic 4% Issues 8% CRLF Injection

10% Information 44% Leakage Time and State 28% Cross Side Scripting (XSS) Heather Miller Language and compiler support for distributed programming for Scala Generally, type-systems Concretely, distributable functions efficient & extensible serialization concurrent/dataflow abstractions

Heather Miller heather.miller@epfl.ch James Wilcox

Jason Gross Some of my time

The rest of my time

Cartoon from xkcd, adapted by Alan Huang

Compiler ∀�, list � ≤ list[� + 1]

Efficient Math program

Image from “The Three Projections of Doctor Futamura” on A Neighborhood of Infinity Jonathan Frankle

Laure Thompson Using Epistemic Temporal Logic for Dynamic Security Policies Security: An observing agent learns no more than the combination of their previous knowledge and the knowledge allowed by the current policy Knowledge: Is formed from the agent’s trace of past remembered observations Policy: The set of initial values an agent may learn Connection: Knowledge ≡ set of initial states that the agent knows to be possible This possibilistic view corresponds to epistemic logic: L� := In some possible world an agent knows �

Luke Maurer I Common CBV and CBN ⇡-calculus encodings are closely related to CPS. Term (x. xx)(y. y) CBV ⇡ ⌫k (⌫f (k f !f (x, h). x x, h ) k(v). h i| h i | ⌫k (⌫g (k g !g(y, h). h y ) k(w). v w, k )) h i| h i | h 0i CBV CPS k. k((x, h). x(x, h)) v.

(k. k((y, h). hy))(w. v(w, k0)) I Have ⇡-calculus encoding for call-by-need:

CBNd ⇡ ⌫k (⌫f (k f !f (x, h). ⌫k0 (x k0 k0(v). v x, h )) k(v). h i| h i| h i | ⌫x (v x, k x(k0). ⌫k (⌫g (k g !g(y, h). y h ) h 0i| h i| h i | k(w). (!x(k). k w k w )))) h i| 0h i I We introduce a corresponding CPS transform:

CBNd CPS k. k((x, h). x(1v. v(x, h))) 1v.

⌫x. x :=1 (1k0. (k. k((y, h). yh))(1w. x := k. kw in k0w))

in v(x, k0)

Luke Maurer [email protected] CPS, ⇡, and Call-By-Need Mario Alvarez Mario Alvarez (Princeton) – Senior thesis

● VST (Appel et al, Princeton)

● MirrorShard (G. Malecha, Harvard) – Reflective solver for separation-logic entailments – Can solve entailments we currently can't automatically

● Goal: improve automation in VST – Make system easier/practical for more applications, ultimately – Learn about integrating external solvers with VST (eventually, maybe SMT or others)

Matt Le Deterministic Parallel Programming

Nondeterminism makes parallel programming dicult

Purely functional parallel languages are inherently deterministic

Unfortunately, mutable state can improve eciency

Add restricted forms of mutable state Extend to preserve determinism. Formalize semantics of the language with these new features and prove determinism.

1 http://www.cs.rit.edu/~mtf/manticore/index.html Matt Le (RIT) PLMW14 January 21, 2014 1 / 1 Matthew Loring PLMW 2014

Security-Typed Programming Languages

Goal: Develop languages that help programmers reason about the security of their programs Jif extends Java with direct support from the type system for programming with the Decentralized Label Model Every type is annotated with labels specifying integrity and confidentiality policies

Matthew Loring Cornell University Matthew Milano Network Verification Matthew Milano Cornell University

Goal: Verify formal properties of network configurations automatically Idea: Encode NetKAT semantics using an SMT solver, and f ::= switch | inport ... ! automatically answer queries v ::= 0 | 1 | 2 | ... ! a,b,c ::= true! about path properties | false! | f = v! | a1 and a2! | a1 or a2 ! Challenge: Obvious direct | not a! p,q,r ::= filter a! encodings generate infinite | f := v! | p1 | p2! models, which aren’t handled | p1 ; p2! | p* ! well by current solvers | dup Mike Izbicki http://github.com/mikeizbicki/hlearn k-fold cross-validation Features k-fold cross-validation

- purely functional (Haskell) standard cv -veryfast run time -parametersatthetypelevel monoid cv - design based on abstract algebra 100 200 300 400 500 600 700 800 900 1000 number of folds

algebraic structure what we get “for free” monoid online algorithms monoid parallel algorithms monoid fast cross-validation abelian group subtract data points abelian group more fast cross-validation R-module data points weighted by the ring R functor (simple) transfer learning via fast data pre-processing monad (complex) transfer learning via fast pre-processing Mike Shah Java$Cri(cal$Sec(ons$

[email protected]$ Mohsen Lesani Nathalie Oostvogels Type Systems

for JavaScript for distributed web applications web applications

Nathalie Oostvogels - Vrije Universiteit Brussel (Belgium) Nicholas Braga Target'Tes)ng:! Automated!test!case!discovery!technique!using!inferred!models! Nicholas!Braga !!!!!Yuriy!Brun! University!of!Massachuse;s!Amherst! Nicholas Vanderweit Leveraging Symbolic Execution to Violate Object Invariants

Backwards-symbolic p ¬p Library execution Synthesis

Unsafe class

Nicholas Vanderweit University of Colorado Boulder Pavel Panchekha

Peng Wang Compositional Compilation

! (Horizontally) Can link with other modules

! (Vertically) Can compose compiler passes

! (Higher-order) Coder pointers

! Mechanized proof

Peng (Perry) Wang MIT Phil Nguyen • Contracts enforce invariants dynamically delay error discovery introduce overheads are hard to verify due to expressiveness • Verification uses abstract reduction semantics scales to many language features

1 Philip Johnson-Freyd Extending the Classical Sequent Calculus Syntax Semantics Commands: c ::= v e È || Í µ–.c E = c E/– V µ˜x.c = c V /x Terms: v ::= µ–.c x case[call(x,–).c] pair(v, v) È || Í { }È|| Í { } | | | Co-Terms: e ::= µ˜x.c – call(v, e) case[pair(x, y).c] case[call(x,–).c] call(v, e) = v µ˜x. µ–.c e Simple Types | | | È || Í È || È || ÍÍ Plus rule for pairs (and what ever other types we add), ÷,...V and E determine evaluation order , x : A x : A – : A – : A, „ | | „ c :(, x : A – : B, ) v1 : A v2 : B c :( – : A, ) c :(, x : A ) „ „ | „ „ „ case[call(x,–).c]:A B pair(v1, v2):A B µ–.c : A µ˜x.c : A „ æ | „ ¢ | „ | | „ v : A e : B c :(, x : A, y : B ) v : A e : A „ | | „ „ „ | | „ call(v, e):A B case[pair(x, y).c]:A B v e :( ) | æ „ | ¢ „ È || Í „

Problem with Polymorphism “Natural” second order quantification rules = not type safe when implicit

µ–. ((⁄x.x), (⁄f .µ (f ,⁄ ()) – )) – case[(f , g). f “bam” µ˜ g (⁄x.x + 1) — ] È È . È . || Í || Í|| È || · . È || · ÍÍ Í ML value restriction doesn’t dualize well

Philip Johnson-Freyd High Level? Low Level? Functional? OOP? Shayak Sen We can prove protocols secure. … And why that may not good enough

Proofs of Crypto Protocols are hard. PL Techniques have helped produce formal proofs of protocols Spi-Calculus, ProVerif, PCL, CryptoVerif, F7

 But how secure is your secure crypto protocol?  Of course someone could break it in a hundred years.  Could they break it in a month?  How often?

 Want to formally prove exact probabilistic bounds on protocols.  Metatheory requires a probabilistic language with precise cost semantics  Concurrency and adversarial scheduling to reason about multiple sessions  The challenge is e-cient bounds

Shayak Sen Work in progress: with Anupam Datta, Joe Halpern, John Mitchell and Arnab Roy Carnegie Mellon University Shuying Liang Pruning, Pushdown- Exception Flow Analysis

University of Utah Shuying Liang

Tuesday, January 21, 14 Theron Rabe Eesk

Theron Rabe: [email protected] Thomas Wood THOMAS WOOD 1ST YEAR PHD STUDENT,IMPERIAL COLLEGE LONDON

I Verifying Secure ECMAScript programs I SES: allows functions across sandbox boundaries I Do we unintentionally leak data or functionality? I Program logic for security properties

I Testing JS interpreters I JS test suite: Notoriously incomplete I JSCert: Executable formal semantics for JavaScript I Can we automatically do better? William J. Bowman Security Preserving Compilation William J. Bowman Northeastern University

If E1 Is related to E2

Compile Compile

Then T1 Is related to T2 Ye Fang Computer-aided mechanism design Come%to%poster%session%% Ye Fang, Swarat Chuaduri, Moshi Vardi @ Rice Univerisy if%you%are%interested!% Example: Second price mechanism ->Vickrey auction

Generalized second price mechanism -> Google online ads auction …

precondition on inputs a_i= real bid; M(list of bids)= real value; winner = ?; utility_function(outcome) = price = ?; if(a_i is winner) return (winner, price) SAT ut_i = value – price; SMT solver else ut_i =0; UNSAT postcondition on output No Yi Li Symbolic Optimization with SMT Solvers! Yi Li – University of Toronto • SMT solvers are used everywhere • Extending SMT solvers to do optimiza"on%

% Optimizing m ϕ! ϕ! SMT Solver m ϕ! ϕ, f ! SMT Solver %%%%%%%% max f(m)! • Applications in PL: – Numerical invariant generation – Program synthesis, counterexample generation – – Many others … • Check out our poster and paper at POPL Yuki Ishii Type%Debugging

• Embedded%Type% Debugger%[Tsushima,% ‘12]% nd – The%2 %argument%of%this%applica;on% interac;ve% %has%wrong%type. – OCaml% – “argument”?% • Analyze%the%error%logs% “applica;on”?% of%novice%students% – “this”%…%which?% • How%can%we%design% – why%“wrong”?% “noviceGfriendly”%error% – higherGorder%func;on…% messages%or%languages?%