Our method draws on concepts from several different fields. We begin by briefly surveying the semantics of stochastic differential equations, a language for formally specifying dynamic behaviors, Girsanov's theorem on change of measures, and results on consistency and concentration of Bayesian posteriors.
Stochastic differential equation models
A stochastic differential equation (SDE) 2627 is a differential equation in which some of the terms evolve according to Brownian Motion 28. A typical SDE is of the following form:
d
X
=
b
(
t
,
X
t
)
d
t
+
v
(
t
,
X
t
)
d
W
t
where X is a system variable, b is a Riemann integrable function, v is an Itō integrable function, and W is Brownian Motion. The Brownian Motion W is a continuous-time stochastic process satisfying the following three conditions:
1. W0 = 0
2. Wt is continuous (almost surely).
3. Wt has independent normally distributed increments:
• Wt - Ws and Wt' - Ws' are independent if 0 ≤ s <t <s' <t'.
•
W
t
-
W
s
~
N
(
0
,
t
-
s
)
, where N
(
0
,
t
-
s
)
denotes the normal distribution with mean 0 and variance t - s. Note that the symbol ~ is used to indicate "is distributed as".
Consider the time between 0 and t as divided into m discrete steps 0, t1, t2 ... tm = t. The solution to a stochastic differential equation is the limit of the following discrete difference equation, as m goes to infinity:
X
t
k
+
1
-
X
t
k
=
b
(
t
k
,
X
t
k
)
(
t
k
+
1
-
t
k
)
+
v
(
t
k
,
X
t
k
)
(
W
t
k
+
1
-
W
t
k
)
In what follows, ![]()
will refer to a system of stochastic differential equations. We note that a system of stochastic differential equations comes equipped with an inherent probability space and a natural probability measure μ. Our algorithm repeatedly and randomly perturbs the probability measure of the Brownian motion in the model ![]()
which, in turn, changes the underlying measure in an effort to expose rare behaviors. These changes can be characterized using Girsanov's Theorem.
Girsanov's theorem for perturbing stochastic differential equation models
Given a process {θt | 0 ≤ t ≤ T} satisfying the Novikov condition 29, such as an SDE, the following exponential martingale Zt defines the change from measure P to new measure
P
^
:
Z
t
=
e
x
p
(
-
∫
0
t
θ
u
d
W
u
-
∫
0
t
θ
u
2
d
u
/
2
)
Here, Zt is the Radon-Nikodym derivative of
P
^
with respect to P for t <T. The Brownian motion
Ŵ
t
under
P
^
is given by:
Ŵ
t
=
W
t
+
∫
0
t
θ
u
d
u
. The non-stochastic component of the stochastic differential equation is not affected by change of measures. Thus, a change of measure for SDEs is a stochastic process (unlike importance sampling for explicit probability distributions).
Specifying dynamic behaviors
Next, we define a formalism for encoding high-level behavioral specification that our algorithm will test against ![]()
.
Definition 1 (Adapted Finitely Monitorable). Let σ be a finite-length trace from the stochastic differential equation ![]()
. A specification ϕ is said to be adapted finitely monitorable (AFM) if it is possible to decide whether σ satisfies ϕ, denoted ϕ ⊨ ϕ.
Certain AFM specifications can be expressed as formulas in Bounded Linear Temporal Logic (BLTL) 303132. Informally, BLTL formulas can capture the ordering of events.
Definition 2 (Probabilistic Adapted Finitely Monitorable). A specification ϕ is said to be probabilistic adapted finitely monitorable (PAFM) if it is possible to (deterministically or probabilistically) decide whether ![]()
satisfies ϕ with probability at least θ, denoted M
⊨
P
≥
θ
(
ϕ
)
.
Some common examples of PAFM specifications include Probabilistic Bounded Linear Temporal Logic (PBLTL) (e.g., see 19) and Continuous Specification Logic. Note that temporal logic is only one means for constructing specifications; other formalisms can also be used, like Statecharts 3334.
Semantics of bounded linear temporal logic (BLTL)
We define the semantics of BLTL with respect to the paths of ![]()
. Let σ = (s0, Δ0), (s1, Δ1),... be a sampled execution of the model along states s0, s1,... with durations Δ0, Δ1, .. . ∈ ℝ. We denote the path starting at state i by σi (in particular, σ0 denotes the original execution σ). The value of the state variable x in σ at the state i is denoted by V (σ, i, x). The semantics of BLTL is defined as follows:
1. σk ⊨ x ~ v if and only if V(σ, k, x) ~ v, where v ∈ ℝ and ~ ∈ {>, <, =}.
2. σk ⊨ ϕ1 ∨ϕ2 if and only if σk ⊨ ϕ1 or σk ⊨ ϕ2.
3. σk ⊨ ϕ1 ∧ ϕ2 if and only if σk ⊨ ϕ1 and σk ⊨ ϕ2;
4. σk ⊨ ¬ϕ1 if and only if σk ⊨ ϕ1 does not hold.
5. σk ⊨ ϕ1Utϕ2 if and only if there exists i ∈ ℕ such that: (a) 0 ≤ Σ0 ≤ l <iΔk+l≤ t; (b) σk+i⊨ ϕ2; and (c) for each 0 ≤ j < i, σk+j⊨ ϕ1;
Statistical model validation
Our algorithm performs statistical model checking using Bayesian sequential hypothesis testing 23 on non-i.i.d. samples. The statistical model checking problem is to decide whether a model ![]()
satisfies a probabilistic adapted finitely monitorable formula ϕ with probability at least θ. That is, whether M
⊨
P
≥
θ
(
ϕ
)
where θ ∈ (0, 1).
Sequential hypothesis testing
Let ρ be the (unknown but fixed) probability of the model satisfying ϕ. We can now re-state the statistical model checking problem as deciding between the two composite hypotheses: H0 : ρ ≽ θ and H1 : ρ < θ. Here, the null hypothesis H0 indicates that ![]()
satisfies the AFM formula ϕ with probability at least θ, while the alternate hypothesis H1 denotes that ![]()
satisfies the AFM formula ϕ with probability less than θ.
Definition 3 (Type I and II errors). A Type I error is an error where the hypothesis test asserts that the null hypothesis H0 is false, when in fact H0 is true. Conversely, a Type II error is an error where the hypothesis test asserts that the null hypothesis H0 is true, when in fact H0 is false.
The basic idea behind any statistical model checking algorithm based on sequential hypothesis testing is to iteratively sample traces from the stochastic process. Each trace is then evaluated with a trace verifier 32, which determines whether the trace satisfies the specification i.e. σi ⊨ ϕ. This is always feasible because the specifications used are adapted and finitely monitorable. Two accumulators keep track of the total number of traces sampled, and the number of satisfying traces, respectively. The procedure continues until there is enough information to reject either H0 or H1.
Bayesian sequential hypothesis testing
Recall that for any finite trace σi of the system and an Adapted Finitely Monitorable (AFM) formula ϕ, we can decide whether σi satisfies ϕ. Therefore, we can define a random variable Xi denoting the outcome of σi ⊨ ϕ. Thus, Xi is a Bernoulli random variable with probability mass function
f
(
x
i
|
ρ
)
=
ρ
x
i
(
1
-
ρ
)
1
-
x
i
, where xi = 1 if and only if σi ⊨q ϕ, otherwise xi = 0.
Bayesian statistics requires that prior probability distributions be specified for the unknown quantity, which is ρ in our case. Thus we will model the unknown quantity as a random variable u with prior density g(u). The prior probability distribution is usually based on our previous experiences and beliefs about the system. Non-informative or objective prior probability distribution 35 can be used when nothing is known about the probability of the system satisfying the AFM formula.
Suppose we have a sequence of independent random variables X1,..., Xn defined as above, and let d = (x1,..., xn) denote a sample of those variables.
Definition 4. The Bayes factor ![]()
of sample d and hypotheses H0 and H1 is B
=
P
(
d
|
H
0
)
P
(
d
|
H
1
)
.
The Bayes factor may be used as a measure of relative confidence in H0 vs. H1, as proposed by Jeffreys 36. The Bayes factor is the ratio of two likelihoods:
B
=
∫
θ
1
f
(
x
1
|
u
)
⋯
f
(
x
n
|
u
)
⋅
g
(
u
)
d
u
∫
0
θ
f
(
x
1
|
u
)
⋯
f
(
x
n
|
u
)
⋅
g
(
u
)
d
u
.
We note that the Bayes factor depends on both the data d and on the prior g, so it may be considered a measure of confidence in H0 vs. H1 provided by the data x1,..., xn, and "weighted" by the prior g.
Non-i.i.d. Bayesian sequential hypothesis testing
Traditional methods for hypothesis testing, including those outlined in the previous two subsection*s, assume that the samples are drawn i.i.d.. In this section* we show that non-i.i.d. samples can also be used, provided that certain conditions hold. In particular, if one can bound the change in measure associated with the non-identical sampling, one can can also bound the Type I and Type II errors under a change of measure. Our algorithm bounds the change of measure, and thus the error.
We begin by reviewing some fundamental concepts from Bayesian statistics including KL divergence, KL support, affinity, and δ-separation, and then restate an important result on the concentration of Bayesian posteriors 3537.
Definition 5 (Kullback-Leibler (KL) Divergence). Given a parameterized family of probability distributions {fθ}, the Kullback-Leibler (KL) divergence K(θ0, θ) between the distributions corresponding to two parameters θ and θ0 is: K
(
θ
0
,
θ
)
=
E
θ
0
[
f
θ
/
f
θ
0
]
. Note that
E
θ
0
is the expectation computed under the probability measure
f
θ
0
.
Definition 6 (KL Neighborhood). Given a parameterized family of probability distributions {fθ}, the KL neighborhood Kε (θ0) of a parameter value θ0 is given by the set {θ : K (θ0, θ) < ε}.
Definition 7 (KL Support). A point θ0 is said to be in the KL support of a prior Π if and only if for all ε >0, Π (Kε (θ0)) >0.
Definition 8 (Affinity). The affinity Aff(f, g) between any two densities is defined as A
f
f
(
f
,
g
)
=
∫
f
g
d
μ
.
Definition 9 (Strong δ-Separation). Let A ⊂ [0, 1] and δ >0. The set A and the point θ0 are said to be strongly δ-separated if and only if for any proper probability distribution v on A, A
f
f
(
f
θ
0
,
∫
A
f
θ
(
x
1
)
v
(
d
θ
)
)
<
δ
.
Given these definitions, it can be shown that the Bayesian posterior concentrates exponentially under certain technical conditions 3537.
Bounding errors under a change of measure
Next, we develop the machinery needed to compute bounds on the Type-I/Type-II errors for a testing strategy based on non-i.i.d. samples.
A stochastic differential equation model ![]()
is naturally associated with a probability measure μ. Our non-i.i.d. sampling strategy can be thought of as the assignment of a set of probability measures μ1, μ2,... to ![]()
. Each unique sample σi is associated with an implied probability measure μi and is generated from ![]()
under μi in an i.i.d. manner. Our proofs require that all the implied probability measures are equivalent. That is, an event is possible (resp. impossible) under a probability measure if and only if it is possible (resp. impossible) under the original probability measure μ.
We use the following result regarding change of measures. Suppose a given behavior, say ϕ, holds on the original model with an (unknown) probability ρ.
P
(
ρ
<
θ
0
|
X
i
)
=
∫
0
θ
0
p
μ
(
X
i
|
u
)
g
(
u
)
d
u
∫
0
1
p
μ
(
X
i
|
u
)
g
(
u
)
d
u
Here, Xi is a Bernoulli random variable denoting the event that ith sample satisfies the given behavior ϕ. Note that the Xi s must be independent of one another. Now, we can rewrite the above expression as:
P
(
ρ
<
θ
0
|
X
i
)
=
∫
0
θ
0
p
μ
(
X
i
|
u
)
p
μ
i
(
X
i
|
u
)
p
μ
i
(
X
i
|
u
)
g
(
u
)
d
u
∫
0
1
p
μ
(
X
i
|
u
)
p
μ
i
(
X
i
|
u
)
p
μ
i
(
X
i
|
u
)
g
(
u
)
d
u
Note that the term
p
μ
i
(
X
i
|
u
)
denotes the probability of observing the event Xi under the modified probability measure μi if the unknown probability ρ were u. In order to ensure the independence assumption, the new probability measures μi are chosen independently of one another. The ratio
p
μ
i
(
X
i
|
u
)
p
μ
(
X
i
|
u
)
is the implied Radon-Nikodym derivative for the change of measure between two equivalent probability measures. Suppose, the testing strategy has made n observations X1, X2,... Xn. Then,
P
(
ρ
<
θ
0
|
X
)
=
∫
0
θ
0
∏
i
=
1
n
p
μ
(
X
i
|
u
)
p
μ
i
(
X
i
|
u
)
p
μ
i
(
X
i
|
u
)
g
(
u
)
d
u
∫
0
1
∏
i
=
1
n
p
μ
(
X
i
|
u
)
p
μ
i
(
X
i
|
u
)
p
μ
i
(
X
i
|
u
)
g
(
u
)
d
u
A sampling algorithm can compute
p
μ
i
(
X
i
|
u
)
by drawing independent samples from a stochastic differential equation model under the new "modified" probability measure. We note that it is not easy to compute the change of measure
p
μ
i
(
X
i
|
u
)
p
μ
(
X
i
|
u
)
algebraically or numerically. However, our algorithm does not need to compute this quantity explicitly. It simply establishes bounds on it.
Consider the following expression that is computable without knowing the implied Radon-Nikodym derivative or change of measure explicitly.
Q
(
ρ
<
θ
0
|
X
i
)
=
∫
0
θ
0
p
μ
i
(
X
i
|
u
)
g
(
u
)
d
u
∫
0
1
p
μ
i
(
X
i
|
u
)
g
(
u
)
d
u
Now, we can rewrite the above expression as:
Q
(
ρ
<
θ
0
|
X
i
)
=
∫
0
θ
0
p
μ
i
(
X
i
|
u
)
p
μ
(
X
i
|
u
)
p
μ
(
X
i
|
u
)
g
(
u
)
d
u
∫
0
1
p
μ
i
(
X
i
|
u
)
p
μ
(
X
i
|
u
)
p
μ
(
X
i
|
u
)
g
(
u
)
d
u
Our result will exploit the fact that we do not allow our testing or sampling procedures to have arbitrary implied Radon-Nikodym derivatives. This is reasonable as no statistical guarantees should be available for an intelligently designed but adversarial test procedure that (say) tries to avoid sampling from the given behavior. Suppose that the implied Radon-Nikodym derivative always lies between a constant c and another constant 1/c. That is, the change of measure does not distort the probabilities of observable events by more than a factor of c. Then, we observe that:
Q
(
ρ
<
θ
0
|
X
i
)
≤
∫
0
θ
0
c
p
μ
(
X
i
|
u
)
g
(
u
)
d
u
∫
0
1
1
c
p
μ
(
X
i
|
u
)
g
(
u
)
d
u
=
c
2
P
(
ρ
<
θ
0
|
X
i
)
Furthermore,
Q
(
ρ
<
θ
0
|
X
i
)
≥
1
c
2
P
(
ρ
<
θ
0
|
X
i
)
.
Thus, by allowing the sampling algorithm to change measures by at most c, we have changed the posterior probability of observing a behavior by at most c2.
Example: Suppose, the testing strategy has made n observations X1, X2,... Xn. Then,
Q
(
ρ
<
θ
0
|
X
)
=
∫
0
θ
0
∏
i
=
1
n
p
μ
i
(
X
i
|
u
)
p
μ
(
X
i
|
u
)
p
μ
(
X
i
|
u
)
g
(
u
)
d
u
∫
0
1
∏
i
=
1
n
p
μ
i
(
X
i
|
u
)
p
μ
(
X
i
|
u
)
p
μ
(
X
i
|
u
)
g
(
u
)
d
u
≤
∫
0
θ
0
c
n
∏
i
=
1
n
(
p
μ
(
X
i
|
u
)
)
g
(
u
)
d
u
∫
0
1
1
c
n
∏
i
=
1
n
(
p
μ
(
X
i
|
u
)
)
g
(
u
)
d
u
=
c
2
n
P
(
ρ
<
θ
0
|
X
1
,
X
2
,
…
X
n
)
Similarly,
Q
(
ρ
<
θ
0
|
X
)
≥
1
c
2
n
∫
0
θ
0
∏
i
=
1
n
(
p
μ
(
X
i
|
u
)
)
g
(
u
)
d
u
∫
0
1
∏
i
=
1
n
(
p
μ
(
X
i
|
u
)
)
g
(
u
)
d
u
=
1
c
2
n
P
(
ρ
<
θ
0
|
X
1
,
…
X
n
)
Termination conditions for non-i.i.d. sampling
Traditional (i.e., i.i.d.) Bayesian Sequential Hypothesis Testing is guaranteed to terminate. That is, only a finite number of samples are required before the test selects one of the hypotheses. We now consider the conditions under which a Bayesian Sequential Hypothesis Testing based procedure using non-i.i.d. samples will terminate. To do this, we first need to show that the posterior probability distribution will concentrate on a particular value as we see more an more samples from the model.
To consider the conditions under which our algorithm will terminate after observing n samples, note that the factor introduced due to the change of measure c2n can outweigh the gain made by the concentration of the probability measure e-nb. This is not surprising because our construction thus far does not force the test not to bias against a sample in an intelligent way. That is, a maliciously designed testing procedure could simply avoid the error prone regions of the design. To address this, we define the notion of a fair testing strategy that does not engage in such malicious sampling.
Definition 10. A testing strategy is η-fair (η ≥ 1) if and only if the geometric average of the implied Radon-Nikodym derivatives over a number of samples is within a constant factor η of unity, i.e.,
1
η
≤
∏
i
=
1
n
p
μ
i
(
X
i
|
u
)
p
μ
(
X
i
|
u
)
n
≤
η
Note that a fair test strategy does not need to sample from the underlying distribution in an i.i.d. manner. However, it must guarantee that the probability of observing the given behavior in a large number of observations is not altered substantially by the non-i.i.d. sampling. Intuitively, we want to make sure that we bias for each sample as many times as we bias against it. Our main result shows that such a long term neutrality is sufficient to generate statistical guarantees on an otherwise non-i.i.d. testing procedure.
Definition 11. An η-fair test is said to be eventually fair if and only if 1 ≤ η4 <eb, where b is the constant in the exponential posterior concentration theorem.
The notion of a eventually fair test corresponds to a testing strategy that is not malicious or adversarial, and is making an honest attempt to sample from all the events in the long run.