Two Mischievous Dynamic Consequence Relations

Two mischievous dynamic consequence relations

A. Cordón–Franco*, H. van Ditmarsch†, D. Fernández–Duque†, E. Gómez–Caminero†, A. Nepomuceno–Fernández†

*Department of Computer Sciences and AI Universidad de Sevilla †Department of Philosophy and Logic Universidad de Sevilla

Abstract In [10] van Benthem proposes a dynamic consequence relation de- Dyn PAL ﬁned as ψ1, . . . , ψn |= ϕ iﬀ |= [ψ1]...[ψn]ϕ, where the latter denotes consequence in public announcement logic, a dynamic epistemic logic. In this paper we investigate the structural properties of two dynamic consequence relations extending van Benthem’s proposal, local lDyn gDyn dynamic consequence |=Γ and global dynamic consequence |=Γ . They are extensions of |=Dyn because they also take a third parameter into account in the consequence relation, namely a background Γ—a set of formulas known, or commonly known, by the agents. The dynamic consequence relations promise a perspective on reasoning about protocols in multi-agent systems.

1 Introduction and preliminaries

In dynamic semantics or update semantics, dynamic consequence relations are an obligatory phenomenon and are well-studied [12, 9, 3, 5]. Sometime in the late 1980s, dynamic epistemic logic parted ways with dynamic semantics and put all the dynamics in dynamic modal operators instead. These modal operators are interpreted employing a standard Kripke semantics. This has

1 nothing dynamic, except the order in which dynamic modal operators are interpreted. In [10], van Benthem proposes a way back from dynamic epistemic logic to dynamic consequence. It is the obvious way, and it comes with the same defects—or advantages! whatever one prefers to call it—as consequence in dynamic semantics. Van Benthem proposes to define a dynamic Dyn PAL consequence relation ψ1, . . . , ψn |= ϕ iff |= [ψ1]...[ψn]ϕ, where the latter denotes consequence in public announcement logic, a dynamic epistemic logic. In public announcement logic, [ψ]ϕ stands for ‘after (truthful public) announcement of ϕ, ϕ (is true)’, e.g., after public announcement of factual information p the agent knows that p, formalized by [p]Kp. Seen as consequence, we can observe that p ∧ ¬Kp 6|=Dyn p ∧ ¬Kp, because if I inform you that (p is true and you do not know that p), you know p as a result. We propose two dynamic consequence relations extending van Benthem’s lDyn proposal, local dynamic consequence |=Γ and global dynamic consequence gDyn Dyn |=Γ . They are extensions of |= because they also take a third parameter into account in the consequence relation, namely a background Γ—a set of formulas known, or commonly known, by an agent or by the agents. The reason to propose such extensions is that the study of the consequences of sequences of announcements is often in the context of a given system satisfying a number of initial properties. Now there is nothing per séthat prevents such properties being make known to all agents by yet another sequence of dynamic phenomena—initializing the system, one might say, from some sort of perspective of common ignorance; but in fact such initial configurations are often a given, and also in such initial configurations agents have different perspectives: such different perspectives cannot have been the consequence of mere announcements, but need more complex dynamics. A more elegant starting point therefore seems the assumption of that third parameter. This assumption also matches the general observation on multi-S5 systems that the structure of the model is commonly known to all agents, and that for some such systems this structure can be captured by a set of commonly known formulas: a background theory. In the local variant of dynamic consequence we view this background from the actual state (common knowledge formulas are also allowed), whereas in the global variant of dynamic consequence we view the background from the model perspective (entailing common knowledge of background formulas). A similar global/local consequence distinction holds for standard modal logic [4]. We then investigate the structural properties of local and global consequence. Like van Benthem’s dynamic consequence Dyn, the structural rules

2 permutation, contraction, reﬂexivity, cut and monotonicity fail for both lDyn and gDyn. Hence, it is natural to ask ourselves if lDyn or gDyn satisfy any variant of the above structural rules. The answer is somewhat disappointing for local consequence and less so for global consequence. We report on how both consequence relations behave with respect to a number of variants of these structural rules.

1.1 Dynamic epistemic logic Dynamic epistemic logics [11] combine modal operators for knowledge or belief, typically for a set of agents, with dynamic modal operators for change of knowledge or belief. Public announcement logic [6, 1] is one such dynamic epistemic logic, namely where the dynamics consists of public truthful announcements (unlike, e.g., private announcements to subgroups). We present the version of the logic with common knowledge operators. The language LPAL of public announcement logic [6] over a set of agents A and a set of primitive propositions P is deﬁned as follows, where a ∈ A, G ⊆ A, and p ∈ P :

ϕ ::= p | ¬ϕ | ϕ ∧ ϕ | Kaϕ | CGϕ | [ϕ]ϕ Other propositional connectives and the constants > (‘true’) and ⊥ (‘false’) are defined by the usual abbreviations (and similarly we could define other modal connectives by abbreviation—but we don’t need them here). For arbitrary formulas we write ϕ, ψ, ... Formula Kaϕ stands for ‘agent a knows ϕ’, CGϕ for ‘the agents in group G commonly know ϕ’ and [ϕ]ψ for ‘after public announcement of ϕ, ψ’. For CAϕ we write Cϕ (public knowledge of ϕ). Sets of formulas are represented by Γ, Γ0,... or ∆,... and sequences of formulas by Σ (for Sequence). A Kripke structure or epistemic model over A and P is a tuple M = (S, {∼a}a∈A,V ) where S is a set or domain of states, for each agent a ∈ A, ∼a ⊆ S × S is an epistemic accessibility or indistinguishability relation that is assumed to be an equivalence relation, and valuation V : P → PS assigns primitive propositions to the set of states in which they are true. For ‘state s is in the domain of model M’ we write s ∈ M.A pointed Kripke structure is a pair (M, s) where s ∈ M. To interpret common knowledge we further need the reflexive transitive closure of the union of the accessibility relations S ∗ of the agents involved, namely ∼G ::= ( a∈G) . This is also an equivalence relation. We write KiΓ for {Kiϕ | ϕ ∈ Γ} and similarly for CGΓ.

3 The interpretation of the crucial constructs in a pointed Kripke structure is defined as follows—in this definition, the symbol |= is more properly a forcing and not a logical consequence symbol, but the convention in epistemic logic is to allow this overload of notation. M, s |= p iff p ∈ V (p) M, s |= ϕ ∧ ψ iff M, s |= ϕ and M, s |= ψ

M, s |= Kiϕ iﬀ for every t such that s ∼i t, M, t |= ϕ

M, s |= CGϕ iff for every t such that s ∼G t, M, t |= ϕ M, s |= ¬ϕ iff M, s 6|= ϕ M, s |= [ϕ]ψ iff M, s |= ϕ implies that M|ϕ, s |= ψ

0 0 0 0 0 0 0 where M|ϕ = (S , {∼a},V ) such that S = {s ∈ S : M, s |= ϕ}; ∼a = 0 0 0 0 ∼a ∩(S × S ); V (p) = V (p) ∩ S . We write M, s |= Γ for (for all ϕ ∈ Γ, M, s |= ϕ). We further define that ‘ϕ is valid on M’ as ‘for all s ∈ M, M, s |= ϕ’, and ‘ϕ is valid’ as ‘for all M, ϕ is valid on M’. (Recall that all these models M are for the given parameters agents A and propositional variables P .) Logical consequence |=PAL is defined as: Γ |=PAL ϕ iff for all models M and states s ∈ M, if M, s |= ψ for all ψ ∈ Γ, then M, s |= ϕ.

1.2 Structural properties of consequence relations Assume a logical language L.A consequence relation is a binary relation |= between a set or sequence Σ of formulas in L, the premises, and a formula in L, the conclusion. We take the somewhat stricter view of sequences. An example is the just introduced |=PAL—where the premises constitute a set, not a sequence. Consequence relations may satisfy certain structural rules, the standard rules are: • ϕ |= ϕ reﬂexivity

• Σ, ϕ, ϕ |= ψ implies Σ, ϕ |= ψ contraction

• Σ, ϕ, ϕ0, Σ0 |= ψ implies Σ, ϕ0, ϕ, Σ0 |= ψ permutation

• Σ |= ψ and Σ0, ψ, Σ00 |= ϕ imply Σ0, Σ, Σ00 |= ϕ cut

• Σ |= ψ implies Σ, ϕ |= ψ monotonicity

4 For relational studies of logical consequence, see [8, 2]. For an overview of various logics satisfying fewer or diﬀerent structural rules, see e.g. [7]. The somewhat modiﬁed structural rules considered by van Benthem in [10] for the dynamic consequence relation he introduces there are as follows.

• Σ |= ψ and Σ, ψ, Σ0 |= ϕ imply Σ, Σ0 |= ϕ left cut

• Σ |= ψ implies ϕ, Σ |= ψ left monotonicity

• Σ |= ψ and Σ, Σ0 |= ϕ imply Σ, ψ, Σ0 |= ϕ cautious monotonicity

We are now suﬃciently prepared to present van Benthem’s dynamic consequence relation and subsequently our two extensions.

2 Local and global dynamic consequence

Using the standard Kripke semantics of public announcement logic one can define various dynamic consequence relations where the premises stand for consecutive announcements, and the conclusion stands for a postcondition of these announcements. As before, given are a set of agents A and a set of atoms P defining the language of public announcement logic LPAL. Let Σ = ψ1, . . . , ψn be a finite sequence of LPAL formulas, and ϕ ∈ LPAL. We write [Σ]ϕ for [ψ1] ... [ψn]ϕ, and we write M|Σ for (... (M|ϕ1)| ... )|ϕn.

Deﬁnition 1 (Dynamic consequence [10]) Σ |=Dyn ϕ iﬀ |=PAL [Σ]ϕ.

For Σ |=Dyn ϕ we say that ϕ is a dynamic consequence of Σ, or Σ dynamically entails ϕ. In other words, Σ dynamically entails ϕ iﬀ for every model M and state s ∈ M, it holds that M, s |= [ψ1]...[ψn]ϕ; where the latter means that on condition that ψ is true in M, s, and ψ2 is true in M|ψ1, s, and so on, M|Σ, s |= ϕ.1 A main result in [10] is that Dyn satisﬁes the structural rules of left monotonicity, left cut, and cautious monotonicity, that were introduced in the previous section; and that these three rules even represent that consequence relation (where ‘represent’ is interpreted in a technical sense

5 lifting the discussion to abstract transition models, see [10, pp.193-194] for details).

We now introduce two novel dynamic consequence relations. Let Γ be a set of LPAL formulas, called the background of the consequence relation.

Deﬁnition 2 (Local dynamic consequence) lDyn PAL Σ |=Γ ϕ iﬀ Γ |= [Σ]ϕ.

In other words, given background Γ, ϕ is a (local) dynamic consequence of Σ iﬀ for all models M and states s ∈ M, M, s |= Γ implies M, s |= [Σ]ϕ.

Deﬁnition 3 (Global dynamic consequence) gDyn Σ |=Γ ϕ iﬀ for all M, M |= Γ implies M |= [Σ]ϕ.

Just as for Dyn, we say that Σ dynamically entails (from a local or global point of view, respectively) ϕ relative to background Γ, or modulo Γ; or that ϕ is a (local or global) dynamic consequence of Σ modulo Γ. We simply write Dyn for the dynamic consequence relation |=Dyn and similarly for lDyn and gDyn. Dynamic consequence Dyn is the special case for Γ = ∅ of lDyn and also the special case for Γ = ∅ of gDyn. There, gDyn and lDyn coincide, otherwise, they do not, as we will now see.

2.1 Relation between local and global dynamic consequence If ϕ is a local dynamic consequence of Σ, then it is also a global dynamic consequence of Σ. But the converse does not hold.

Proposition 4 Let Σ be a ﬁnite sequence of formulas, Γ a set of formulas and ϕ a formula, all in LPAL. Then,

6 Proof:

2. Consider Γ = {p}, Σ = > and ϕ = Kap. Then:

lDyn • > 6|={p} Kap, and gDyn • > |={p} Kap. For another example, if Γ contains a satisﬁable formula that cannot be gDyn lDyn a model validity, then |=Γ is trivial whereas |=Γ is not. E.g. let Γ = {p ∧ ¬Kap}. Then,

4. We have to show that

for all M: M |= Γ implies M |= [Σ]ϕ

is equivalent to

for all M, s: M, s |= CΓ implies M, s |= [Σ]ϕ.

from left to right Let M and s ∈ M be given; then M, s |= CΓ ⇒ deﬁnition of C, we assume connected models M M |= Γ ⇒ proof assumption, left M |= [Σ]ϕ ⇒ deﬁnition of model validity M, s |= [Σ]ϕ

7 from right to left This follows from the first item and the third item of the proposition. gDyn gDyn The property of gDyn that Σ |=Γ ϕ iff Σ |=Γ Cϕ will be used in the sequel to show that, unlike lDyn, consequence relation gDyn is not that mischievous and at least satisfies some weaker variants of monotonicity and cut.

lDyn lDyn Proposition 5 Σ |=Γ ϕ does not imply Σ |=Γ Cϕ

Proof: A counterexample is when Γ = {p}, Σ = ¬Kap, and ϕ = p.

In that sense, Dyn and gDyn are really diﬀerent, as it is trivial that Σ |=Dyn ϕ implies Σ |=lDyn Cϕ. We conclude that all three of Dyn, lDyn, and gDyn have their peculiarities.

2.2 The failure of classical structural rules The so-called classical structural rules reﬂexivity, contraction, permutation, monotonicity, and cut all fail for both lDyn and gDyn. In [10] is shown that they fail for the dynamic consequence relation Dyn, which is the borderline case for Γ = ∅ of lDyn and gDyn. It is instructive to show some counterexamples. Let Γ = ∅.

• Reﬂexivity fails. As it is known the formula

[p ∧ ¬Kap]¬p ∧ ¬Kap

is valid, so Dyn p ∧ ¬Kap 6|= p ∧ ¬Kap

• Contraction fails. We again make use of the Moore-sentence to show that.

Dyn – p∧¬Kap, p∧¬Kap |= ⊥, because p∧¬Kap cannot be truthfully announced more than once. Dyn – p ∧ ¬Kap 6|= ⊥. • Permutation fails.

8 Dyn – p, ¬Kap |= ⊥, because after announcing p, this is known, so ¬Kap cannot be truthfully announced after that. Dyn – ¬Kap, p 6|= ⊥, because after announcing your ignorance of a fact, this fact remains ignorant; so it can then be very well announced truthfully.

• Monotonicity fails. A counterexample is as follows.

Dyn ¬Kap |= ¬Kap, however, Dyn ¬Kap, p 6|= ¬Kap, since 6|= [¬Kap][p]¬Kap.

0 • Cut fails. Take (see the deﬁnition of cut) Σ = ¬p, ψ = Ka¬p,Σ = 00 ¬Ka¬p, and Σ = ∅. Then it holds that

Dyn – ¬p |= Ka¬p, and Dyn – ¬Ka¬p, Ka¬p |= ⊥; but Dyn – ¬Ka¬p, ¬p 6|= ⊥.

In view of the failure of classical structural rules, it is natural to ask ourselves if lDyn or gDyn satisfy any variant of these rules. The prime can- didates are the modiﬁed structural rules left monotonicity, left cut, and cautious monotonicity, that are satisﬁed by Dyn. But we can also consider rules lDyn for changing the background parameter Γ of our consequence relations |=Γ lDyn and |=Γ , or consider special background formulas. This is addressed in the remainder of this paper.

2.3 Structural rules for global dynamic consequence Theorem 6 Local dynamic consequence lDyn does not satisfy left monotonicity, left cut, and cautious monotonicity.

Proof: We present the corresponding counterexamples.

• Left monotonicity fails. Consider Γ = {¬Kap}, Σ = >, ψ = p and ϕ = ¬Kap. Then, we have:

9 lDyn – > |=Γ ¬Kap; lDyn – p, > 6|=Γ ¬Kap.

0 • Left cut fails. Put Γ = {p}, Σ = ¬Kap, ψ = p,Σ = ¬Kap, ϕ = ⊥. Then, we have:

Dyn – ¬Kap |=Γ p; Dyn – ¬Kap, p, ¬Kap |=Γ ⊥; Dyn – ¬Kap, ¬Kap 6|=Γ ⊥.

• Cautious monotonicity fails. Put Γ = {p ∧ ¬Kap}, Σ = ¬Kap, ψ = p, 0 Σ = Kap, ϕ = ⊥. Then, we have:

Dyn – ¬Kap |=Γ p; Dyn – ¬Kap, Kap |=Γ ⊥; Dyn – ¬Kap, p, Kap 6|=Γ ⊥.

lDyn We recall Proposition 5 stating that Σ |=Γ ϕ does not necessarily imply lDyn that Σ |=Γ Cϕ. This explains why cautious monotonicity and left cut fail for lDyn. In [10], Dyn satisfies that Σ |=Dyn ϕ implies Σ |=Dyn Cϕ. This is then used to prove that Dyn satisfies cautious monotonicity and left cut. In Proposition 4 we showed that gDyn also satisfies the corresponding property. Will our expectation be fulfilled and will cautious monotonicity and left cut also hold for gDyn? Yes. But not more than that.

Lemma 7 If M |= [Σ]ϕ, then for all χ, M |= [Σ][ϕ]χ ↔ [Σ]χ

Proof: The assumption M |= [Σ]ϕ entails that ϕ is a model validity on M|Σ. Therefore, announcing it in that model has no informative eﬀect: it is the trivial model restriction.

Theorem 8 Global dynamic consequence gDyn satisﬁes cautious monotonicity and left cut but not left monotonicity.

Proof:

• Left cut holds. It is suﬃces to observe that on assumption of M |= [Σ]ϕ, from M |= [Σ][ϕ][Σ0]ψ also follows M |= [Σ][Σ0]ψ (Lemma 7 is an equivalence).

• Left monotonicity fails. Consider Γ = {¬Kap}, Σ = >, ψ = p and ϕ = ¬Kap. Then, we have:

gDyn – > |=Γ ¬Kap, and gDyn – p, > 6|=Γ ¬Kap.

2.4 Structural rules for the background So far we have studied structural rules involving Σ and ϕ, where Γ is held as a ﬁxed parameter. But we can also consider structural rules where the background is a variable. Write ∆ |=PAL Γ for: ∆ |=PAL γ for all γ ∈ Γ.

Proposition 9 Let Γ and ∆ be sets of LPAL formulas. Then,

lDyn lDyn PAL • |=Γ ⊆ |=∆ if and only if ∆ |= Γ

gDyn gDyn PAL • |=Γ ⊆ |=∆ if and only if ∆ |= Γ

Proof: This is elementary.

A formula ϕ is preserved under submodels if for all M 0 ⊆ M such that M 0 0 contains s, M, s |= ϕ implies M , s |= ϕ. A formula ϕ ∈ LPAL is boolean if it does not contain modal operators.

Proposition 10 Assume that Γ |=PAL ϕ. Then:

gDyn 1. Σ |=Γ ϕ may not hold; gDyn 2. Σ |=Γ ϕ whenever the formulas in Γ are preserved under submodels;

11 gDyn 3. Σ |=Γ ϕ whenever the formulas in Γ are boolean; lDyn 4. Σ |=Γ ϕ may not hold; lDyn 5. Σ |=Γ ϕ whenever the formulas in Γ are preserved under submodels; lDyn 6. Σ |=Γ ϕ whenever the formulas in Γ are boolean. Proof: We show the ﬁrst three. We observe that the local perspective in lDyn does not make a diﬀerence in the proof.

1. Let Γ = {¬K p}, and Σ = p. We have that p 6|=gDyn ¬K p, since, a {¬Kap} a when M |= ¬Kap, then as long as there is a p-state in M, we still get M 6|= [p]¬Kap. 2. If formulas are preserved under submodels, then the successive an- gDyn nouncements of Σ preserve the truth of all ψ ∈ Γ, i.e., Σ |=Γ ψ; and therefore also the PAL-consequence ϕ follows.

3. If formulas of Σ are boolean, then they do not change their truth value by successive updates. So again, any of their PAL-consequences remains the case.

Proposition 11 Consider the structural rule

gDyn gDyn • Σ |=Γ ϕ implies Σ |=Γ∪∆ ϕ background monotonicity Background monotonicity holds for gDyn.

Finally, we consider some structural rules that involve variation in the premises and the background simultaneously.

Proposition 12 The following structural rules all hold for gDyn:

gDyn 0 gDyn • Σ |=Γ ϕ and ψ |= ψ imply Σ |=(Γ{ψ})∪{ψ0} ϕ background cut

Proof:

• Background cut holds. Assume the antecedent. By deﬁnition, for all models M, M |= Γ implies M |= [Σ]ϕ. Since ψ0 |=PAL ψ, if M |= (Γ−{ψ})∪{ψ0}, then M |= Γ∪{ψ0} and, by background monotonicity, M |= [Σ]ϕ.

• Background as announcement holds. This is trivial, since for every model M such that M |= Σ, M = M|Σ. Clearly, we have only brushed the surface here, with these few propositions relating PAL-consequence and lDyn or gDyn consequence.

3 Conclusions and future work

From the two consequence relations, the global variant deserves to be further investigated but the local variant probably not. Obviously, the ‘background’ that is true in a point of the model need not really be a background: it may not be valid on the model. This causes the problems with finding structural rules for that consequence relation. Fortunately, the global dynamic consequence relation satisfies some structural properties, although not as many as we think we would like. We will continue to try characterizing the global consequence relation. We have some compactness results for the version with countable sets of premises. We intend to show representation theorems similar to that in [10]. We would like to investigate security protocols with given initial settings with consequence relations. We consider to combine abductive techniques with dynamic consequence. The typical case involving abduction is where we try to achieve completion relative to some desirable goal formula and an initial model configuration (background), where only announcements, or

13 other dynamics, relative to a certain protocol are allowed, but where we don’t yet know which announcements will achieve the goal.

Acknowledgements

In an early stage where ideas for dynamic consequence floated around, Hans van Ditmarsch acknowledges various discussions with R. Ramanujam and S.P. Suresh at NIAS Wassenaar in 2007 and at IMSC in Chennai in 2008. Without that start, he would not have considered to pick this topic up again later, with his Seville collaborators. Although the final form took a very different turn, he still hopes to involve Ram and Suresh in some future con- tinuation, involving generalization to safe consequence relations. We further thank Johan van Benthem for his input, encouraging us to pursue local and global consequence. We thank the participants of the LPIS seminar in Seville for their input: Ignacio Hernández,Laura Leonides, Cristina Bares, Fernando Soler, and Joost Joosten.

References

[1] A. Baltag and L.S. Moss. Logics for epistemic programs. Synthese, 139:165–224, 2004. Knowledge, Rationality & Action 1–60. [2] J. Etchemendy. The Concept of Logical Consequence. Harvard Univer- sity Press, 1990. [3] W. Groeneveld. Logical investigations into dynamic semantics. PhD thesis, University of Amsterdam, 1995. ILLC Dissertation Series DS- 1995-18. [4] M. Kracht. Tools and techniques in modal logic. North Holland, Ams- terdam, 1999. [5] M. Kracht. Dynamic semantics. In F. Hamm and T.E. Zimmermann, editors, Semantics, pages 217–241, Hamburg, 2002. Buske Verlag. [6] J.A. Plaza. Logics of public communications. In M.L. Emrich, M.S. Pfeifer, M. Hadzikadic, and Z.W. Ras, editors, Proceedings of the 4th In- ternational Symposium on Methodologies for Intelligent Systems: Poster Session Program, pages 201–216. Oak Ridge National Laboratory, 1989.

14 [7] G. Restall. An Introduction to Substructural Logics. Routledge, 2000.

[8] A. Tarski. On the concept of logical consequence. Oxford University Press, 1936. Reprinted in A. Tarski, Logic, Semantics, Metamathemat- ics, 2nd ed.

[9] J. van Benthem. Exploring logical dynamics. CSLI Publications, 1996.

[10] J. van Benthem. Logical dynamics meets logical pluralism? Australasian Journal of Logic, 6:182–209, 2008.

[11] H. van Ditmarsch, W. van der Hoek, and B.P. Kooi. Dynamic Epistemic Logic, volume 337 of Synthese Library. Springer, 2007.

[12] F. Veltman. Defaults in update semantics. Journal of Philosophical Logic, 25:221–261, 1996.