@article{20866, abstract = {In this work, we present hypernode automata as a specification formalism for hyperproperties of systems whose executions may be misaligned among themselves, such as concurrent systems. These automata consist of nodes labeled with hypernode logic formulas and transitions marked with synchronizing actions. Hypernode logic formulas establish relations between sequences of variable values among different system executions. This logic enables both synchronous and asynchronous analysis of traces. In its asynchronous view on execution traces, hypernode formulas establish relations on the order of value changes for each variable without correlating their timing. In both views, the analysis of different execution traces is synchronized through the transitions of hypernode automata. By combining logic’s declarative nature with automata’s procedural power, hypernode automata seamlessly integrate asynchronicity requirements at the node level with synchronicity between node transitions. We show that the model-checking problem for hypernode automata is decidable for specifications where each node specifies either a synchronous or an asynchronous requirement for the system’s executions, but not both.}, author = {Bartocci, Ezio and Chalupa, Marek and Henzinger, Thomas A and Nickovic, Dejan and Oliveira da Costa, Ana}, issn = {1432-0525}, journal = {Acta Informatica}, number = {4}, publisher = {Springer Nature}, title = {{Hypernode automata}}, doi = {10.1007/s00236-025-00509-8}, volume = {62}, year = {2025}, } @inproceedings{21020, abstract = {Runtime verification offers scalable solutions to improve the safety and reliability of systems. However, systems that require verification or monitoring by a third party to ensure compliance with a specification might contain sensitive information, causing privacy concerns when usual runtime verification approaches are used. Privacy is compromised if protected information about the system, or sensitive data that is processed by the system, is revealed. In addition, revealing the specification being monitored may undermine the essence of third-party verification. In this work, we propose two novel protocols for the privacy-preserving runtime verification of systems against formal sequential specifications. In our first protocol, the monitor verifies whether the system satisfies the specification without learning anything else, though both parties are aware of the specification. Our second protocol ensures that the system remains oblivious to the monitored specification, while the monitor learns only whether the system satisfies the specification and nothing more. Our protocols adapt and improve existing techniques used in cryptography, and more specifically, multi-party computation. The sequential specification defines the observation step of the monitor, whose granularity depends on the situation (e.g., banks may be monitored on a daily basis). Our protocols exchange a single message per observation step, after an initialisation phase. This design minimises communication overhead, enabling relatively lightweight privacy-preserving monitoring. We implement our approach for monitoring specifications described by register automata and evaluate it experimentally.}, author = {Henzinger, Thomas A and Karimi, Mahyar and Thejaswini, K. S.}, booktitle = {Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security}, isbn = {9798400715259}, location = {Taipei, Taiwan}, pages = {2774--2787}, publisher = {Association for Computing Machinery}, title = {{Privacy-preserving runtime verification}}, doi = {10.1145/3719027.3765137}, year = {2025}, } @inproceedings{21089, abstract = {Hypertrace logic is a sorted first-order logic with separate sorts for time and execution traces. Its formulas specify hyperproperties, which are properties relating multiple traces. In this work, we extend hypertrace logic by introducing trace quantifiers that range over the set of all possible traces. In this extended logic, formulas can quantify over two kinds of trace variables: constrained trace variables, which range over a fixed set of traces defined by the model, and unconstrained trace variables, which can be assigned to any trace. In comparison, hyperlogics such as HyperLTL have only constrained trace quantifiers. We use hypertrace logic to study how different quantifier patterns affect the decidability of the satisfiability problem. We prove that hypertrace logic without constrained trace quantifiers is equivalent to monadic second-order logic of one successor (S1S), and therefore satisfiable, and that the trace-prefixed fragment (all trace quantifiers precede all time quantifiers) is equivalent to HyperQPTL. Moreover, we show that all hypertrace formulas where the only alternation between constrained trace quantifiers is from an existential to a universal quantifier are equisatisfiable to formulas without constraints on their trace variables and, therefore, decidable as well. Our framework allows us to study also time-prefixed hyperlogics, for which we provide new decidability and undecidability results.}, author = {Chalupa, Marek and Henzinger, Thomas A and Oliveira da Costa, Ana A}, booktitle = {45th Annual Conference on Foundations of Software Technology and Theoretical Computer Science}, location = {Pilani, India}, pages = {20:1--20:18}, publisher = {Schloss Dagstuhl - Leibniz-Zentrum für Informatik}, title = {{Flavors of quantifiers in hyperlogics}}, doi = {10.4230/LIPICS.FSTTCS.2025.20}, volume = {360}, year = {2025}, } @inproceedings{21091, abstract = {Neural certificates have emerged as a powerful tool in cyber-physical systems control, providing witnesses of correctness. These certificates, such as barrier functions, often learned alongside control policies, once verified, serve as mathematical proofs of system safety. However, traditional formal verification of their defining conditions typically faces scalability challenges due to exhaustive state-space exploration. To address this challenge, we propose a lightweight runtime monitoring framework that integrates real-time verification and does not require access to the underlying control policy. Our monitor observes the system during deployment and performs on-the-fly verification of the certificate over a lookahead region to ensure safety within a finite prediction horizon. We instantiate this framework for ReLU-based control barrier functions and demonstrate its practical effectiveness in a case study. Our approach enables timely detection of safety violations and incorrect certificates with minimal overhead, providing an effective but lightweight alternative to the static verification of the certificates.}, author = {Henzinger, Thomas A and Kueffner, Konstantin and Yu, Zhengqi}, booktitle = {25th International Conference on Runtime Verification}, issn = {1611-3349}, location = {Graz, Austria}, pages = {54--72}, publisher = {Springer Nature}, title = {{Formal verification of neural certificates done dynamically}}, doi = {10.1007/978-3-032-05435-7_4}, volume = {16087}, year = {2025}, } @inproceedings{21092, abstract = {Formal verification provides assurances that a probabilistic system satisfies its specification—conditioned on the system model being aligned with reality. We propose alignment monitoring to watch that this assumption is justified. We consider a probabilistic model well aligned if it accurately predicts the behaviour of an uncertain system in advance. An alignment score measures this by quantifying the similarity between the model’s predicted and the system’s (unknown) actual distributions. An alignment monitor observes the system at runtime; at each point in time it uses the current state and the model to predict the next state. After the next state is observed, the monitor updates the verdict, which is a high-probability interval estimate for the true alignment score. We utilize tools from sequential forecasting to construct our alignment monitors. Besides a monitor for measuring the expected alignment score, we introduce a differential alignment monitor, designed for comparing two models, and a weighted alignment monitor, which permits task-specific alignment monitoring. We evaluate our monitors experimentally on the PRISM benchmark suite. They are fast, memory-efficient, and detect misalignment early.}, author = {Henzinger, Thomas A and Kueffner, Konstantin and Singh, Vasu and Sun, I}, booktitle = {25th International Conference on Runtime Verification}, issn = {1611-3349}, location = {Graz, Austria}, pages = {140--159}, publisher = {Springer Nature}, title = {{Alignment monitoring}}, doi = {10.1007/978-3-032-05435-7_9}, volume = {16087}, year = {2025}, } @inproceedings{21093, abstract = {We propose a monitoring approach for hyperproperties where the system’s observations range over infinite domains. The specifications are given as formulas of symbolic hypernode logic, an extension of earlier versions of hypernode logic that supports events with data. We demonstrate how to translate terms of symbolic hypernode logic into multi-tape symbolic transducers and we present a monitoring algorithm for universally quantified formulas that is based on this translation. We evaluate our approach against the previous approach for monitoring hypernode logic, and we also compare it to other monitors for hyperproperties.}, author = {Chalupa, Marek and Henzinger, Thomas A and Oliveira da Costa, Ana A}, booktitle = {25th International Conference on Runtime Verification}, issn = {1611-3349}, location = {Graz, Austria}, pages = {417--437}, publisher = {Springer Nature}, title = {{Monitoring hypernode logic over infinite domains}}, doi = {10.1007/978-3-032-05435-7_23}, volume = {16087}, year = {2025}, } @inproceedings{21885, abstract = {Symbolic datatypes have proved to be central for automated reasoning about dynamical systems. In its basic form, a symbolic datatype for a class of dynamical systems supports the representation of state and transition sets, boolean operations and emptiness checks on such sets, and the transformation of a state set by a transition set. Successful examples of symbolic datatypes include BDDs and SAT for reasoning about finitestate systems, as well as polyhedra and SMT for reasoning about discrete dynamical systems over multidimensional realvalued state spaces. Most automated verification engines are based on such symbolic datatypes.}, author = {Henzinger, Thomas A}, booktitle = {Proceedings of the 27th International Symposium on Symbolic and Numeric Algorithms for Scientific Computing}, issn = {2470-881X}, location = {Timisoara, Romania}, publisher = {IEEE}, title = {{Neural Certificates}}, doi = {10.1109/SYNASC69064.2025.00008}, year = {2025}, } @article{17094, abstract = {Contract-based design is a promising methodology for taming the complexity of developing sophisticated systems. A formal contract distinguishes between assumptions, which are constraints that the designer of a component puts on the environments in which the component can be used safely, and guarantees, which are promises that the designer asks from the team that implements the component. A theory of formal contracts can be formalized as an interface theory, which supports the composition and refinement of both assumptions and guarantees. Although there is a rich landscape of contract-based design methods that address functional and extra-functional properties, we present the first interface theory designed to ensure system-wide security properties. Our framework provides a refinement relation and a composition operation that support both incremental design and independent implementability. We develop our theory for both stateless and stateful interfaces. Additionally, we introduce information-flow contracts where assumptions and guarantees are sets of flow relations. We use these contracts to illustrate how to enrich information-flow interfaces with a semantic view. We illustrate the applicability of our framework with two examples inspired by the automotive domain.}, author = {Bartocci, Ezio and Ferrere, Thomas and Henzinger, Thomas A and Nickovic, Dejan and Oliveira da Costa, Ana}, issn = {1572-8102}, journal = {Formal Methods in System Design}, pages = {3--48}, publisher = {Springer Nature}, title = {{Information-flow interfaces}}, doi = {10.1007/s10703-024-00447-0}, volume = {66}, year = {2025}, } @article{19499, abstract = {Quantum hardware is inherently fragile and noisy. We find that the accuracy of traditional quantum error correction algorithms can be improved depending on the hardware. Given different hardware specifications, we automatically synthesize hardware-optimal algorithms for parity correction, qubit resetting, and GHZ (Greenberger–Horne–Zeilinger) state preparation. Using stochastic techniques from computer science, our method presents a computational tool to compute exact accuracy guarantees and synthesize optimal algorithms that are often different from traditional ones. We also show that improvements can be gained with respect to the Qiskit transpiler as we compute the hardware-optimal qubit mapping for the GHZ state-preparation problem.}, author = {Muroya Lei, Stefanie and Chatterjee, Krishnendu and Henzinger, Thomas A}, issn = {1091-6490}, journal = {Proceedings of the National Academy of Sciences}, number = {12}, publisher = {National Academy of Sciences}, title = {{Hardware-optimal quantum algorithms}}, doi = {10.1073/pnas.2419273122}, volume = {122}, year = {2025}, } @inproceedings{19665, abstract = {As AI-based decision-makers increasingly influence human lives, it is a growing concern that their decisions may be unfair or biased with respect to people's protected attributes, such as gender and race. Most existing bias prevention measures provide probabilistic fairness guarantees in the long run, and it is possible that the decisions are biased on any decision sequence of fixed length. We introduce *fairness shielding*, where a symbolic decision-maker---the fairness shield---continuously monitors the sequence of decisions of another deployed black-box decision-maker, and makes interventions so that a given fairness criterion is met while the total intervention costs are minimized. We present four different algorithms for computing fairness shields, among which one guarantees fairness over fixed horizons, and three guarantee fairness periodically after fixed intervals. Given a distribution over future decisions and their intervention costs, our algorithms solve different instances of bounded-horizon optimal control problems with different levels of computational costs and optimality guarantees. Our empirical evaluation demonstrates the effectiveness of these shields in ensuring fairness while maintaining cost efficiency across various scenarios.}, author = {Cano Cordoba, Filip and Henzinger, Thomas A and Könighofer, Bettina and Kueffner, Konstantin and Mallik, Kaushik}, booktitle = {Proceedings of the 39th AAAI Conference on Artificial Intelligence}, issn = {2374-3468}, location = {Philadelphia, PA, United States}, number = {15}, pages = {15659--15668}, publisher = {Association for the Advancement of Artificial Intelligence}, title = {{Fairness shields: Safeguarding against biased decision makers}}, doi = {10.1609/aaai.v39i15.33719}, volume = {39}, year = {2025}, } @inproceedings{19668, abstract = {Learning-based methods provide a promising approach to solving highly non-linear control tasks that are often challenging for classical control methods. To ensure the satisfaction of a safety property, learning-based methods jointly learn a control policy together with a certificate function for the property. Popular examples include barrier functions for safety and Lyapunov functions for asymptotic stability. While there has been significant progress on learning-based control with certificate functions in the white-box setting, where the correctness of the certificate function can be formally verified, there has been little work on ensuring their reliability in the black-box setting where the system dynamics are unknown. In this work, we consider the problems of certifying and repairing neural network control policies and certificate functions in the black-box setting. We propose a novel framework that utilizes runtime monitoring to detect system behaviors that violate the property of interest under some initially trained neural network policy and certificate. These violating behaviors are used to extract new training data, that is used to re-train the neural network policy and the certificate function and to ultimately repair them. We demonstrate the effectiveness of our approach empirically by using it to repair and to boost the safety rate of neural network policies learned by a state-of-the-art method for learning-based control on two autonomous system control tasks.}, author = {Yu, Zhengqi and Zikelic, Dorde and Henzinger, Thomas A}, booktitle = {Proceedings of the 39th AAAI Conference on Artificial Intelligence}, issn = {2374-3468}, location = {Philadelphia, PA, United States}, number = {25}, pages = {26409--26417}, publisher = {Association for the Advancement of Artificial Intelligence}, title = {{Neural control and certificate repair via runtime monitoring}}, doi = {10.1609/aaai.v39i25.34840}, volume = {39}, year = {2025}, } @inproceedings{19739, abstract = {Cooperative verification is gaining momentum in recent years. The usual setup in cooperative verification is that a verifier A is run with some pre-defined resources, and if it is not able to verify the program, the verification task is passed to a verifier B together with information learned about the program by verifier A, then the chain can continue to a verifier C, and so on. This scheme is static: tools run one after another in a fixed pre-defined order and fixed parameters and resource limits (the scheme may differ for properties to be analyzed, though). Bubaak is a program analysis tool that allows to run multiple program verifiers in a dynamically changing combination of parallel and sequential portfolios. Bubaak starts the verification process by invoking an initial set of tasks; every task, when it is done (e.g., because of hitting a time limit or finishing its job), rewrites itself into one or more successor tasks. New tasks can be also spawned upon events generated by other tasks. This all happens dynamically based on the information gathered by finished and running tasks. During their execution, tasks that run in parallel can exchange (partial) verification artifacts, either directly or with Bubaak as an intermediary.}, author = {Chalupa, Marek and Richter, Cedric}, booktitle = {31st International Conference on Tools and Algorithms for the Construction and Analysis of Systems}, isbn = {9783031906596}, issn = {1611-3349}, location = {Hamilton, ON, Canada}, pages = {212--216}, publisher = {Springer Nature}, title = {{BUBAAK: Dynamic cooperative verification}}, doi = {10.1007/978-3-031-90660-2_14}, volume = {15698}, year = {2025}, } @article{19796, abstract = {Motivation: Boolean networks are popular dynamical models of cellular processes in systems biology. Their attractors model phenotypes that arise from the interplay of key regulatory subcircuits. A succession diagram (SD) describes this interplay in a discrete analog of Waddington’s epigenetic attractor landscape that allows for fast identification of attractors and attractor control strategies. Efficient computational tools for studying SDs are essential for the understanding of Boolean attractor landscapes and connecting them to their biological functions. Results: We present a new approach to SD construction for asynchronously updated Boolean networks, implemented in the biologist’s Boolean attractor landscape mapper, biobalm. We compare biobalm to similar tools and find a substantial performance increase in SD construction, attractor identification, and attractor control. We perform the most comprehensive comparative analysis to date of the SD structure in experimentally-validated Boolean models of cell processes and random ensembles. We find that random models (including critical Kauffman networks) have relatively small SDs, indicating simple decision structures. In contrast, nonrandom models from the literature are enriched in extremely large SDs, indicating an abundance of decision points and suggesting the presence of complex Waddington landscapes in nature. Availability and implementation: The tool biobalm is available online at https://github.com/jcrozum/biobalm. Further data, scripts for testing, analysis, and figure generation are available online at https://github.com/jcrozum/biobalm-analysis and in the reproducibility artefact at https://doi.org/10.5281/zenodo.13854760.}, author = {Trinh, Van Giang and Park, Kyu Hyong and Pastva, Samuel and Rozum, Jordan C.}, issn = {1367-4811}, journal = {Bioinformatics}, number = {5}, publisher = {Oxford University Press}, title = {{Mapping the attractor landscape of Boolean networks with biobalm}}, doi = {10.1093/bioinformatics/btaf280}, volume = {41}, year = {2025}, } @article{19854, abstract = {Asynchronous Boolean networks are a type of discrete dynamical system in which each variable can take one of two states, and a single variable state is updated in each time step according to pre-selected rules. Boolean networks are popular in systems biology due to their ability to model long-term biological phenotypes within a qualitative, predictive framework. Boolean networks model phenotypes as attractors, which are closely linked to minimal trap spaces (inescapable hypercubes in the system’s state space). In biological applications, attractors and minimal trap spaces are typically in one-to-one correspondence. However, this correspondence is not guaranteed: motif-avoidant attractors (MAAs) that lie outside minimal trap spaces are possible. MAAs are rare and poorly understood, despite recent efforts. In this contribution to the BMB & JMB Special Collection “Problems, Progress and Perspectives in Mathematical and Computational Biology”, we summarize the current state of knowledge regarding MAAs and present several novel observations regarding their response to node deletion reductions and linear extensions of edges. We conduct large-scale computational studies on an ensemble of 14 000 models derived from published Boolean models of biological systems, and more than 100 million Random Boolean Networks. Our findings quantify the rarity of MAAs; in particular, we only observed MAAs in biological models after applying standard simplification methods, highlighting the role of network reduction in introducing MAAs into the dynamics. We also show that MAAs are fragile to linear extensions: in sparse networks, even a single linear node can disrupt virtually all MAAs. Motivated by this observation, we improve the upper bound on the number of delays needed to disrupt a motif-avoidant attractor.}, author = {Pastva, Samuel and Park, Kyu Hyong and Huvar, Ondřej and Rozum, Jordan C. and Albert, Réka}, issn = {1432-1416}, journal = {Journal of Mathematical Biology}, publisher = {Springer Nature}, title = {{An open problem: Why are motif-avoidant attractors so rare in asynchronous Boolean networks?}}, doi = {10.1007/s00285-025-02235-8}, volume = {91}, year = {2025}, } @inproceedings{20024, abstract = {Cooperative software verification divides the task of software verification among several verification tools in order to increase efficiency and effectiveness. The basic approach is to let verifiers work on different parts of a program and at the end join verification results. While this idea is intuitively appealing, cooperative verification is usually hindered by the fact that program decomposition (1) is often static, disregarding strengths and weaknesses of employed verifiers, and (2) often represents the decomposed program parts in a specific proprietary format, thereby making the use of off-the-shelf verifiers in cooperative verification difficult. In this paper, we propose a novel cooperative verification scheme that we call dynamic program splitting (DPS). Splitting decomposes programs into (smaller) programs, and thus directly enables the use of off-the-shelf tools. In DPS, splitting is dynamically applied on demand: Verification starts by giving a verification task (a program plus a correctness specification) to a verifier V1. Whenever V1 finds the current task to be hard to verify, it splits the task (i.e., the program) and restarts verification on subtasks. DPS continues until (1) a violation is found, (2) all subtasks are completed or (3) some user-defined stopping criterion is met. In the latter case, the remaining uncompleted subtasks are merged into a single one and are given to a next verifier V2, repeating the same procedure on the still unverified program parts. This way, the decomposition is steered by what is hard to verify for particular verifiers, leveraging their complementary strengths. We have implemented dynamic program splitting and evaluated it on benchmarks of the annual software verification competition SV-COMP. The evaluation shows that cooperative verification with DPS is able to solve verification tasks that none of the constituent verifiers can solve, without any significant overhead.}, author = {Richter, Cedric and Chalupa, Marek and Jakobs, Marie-Christine and Wehrheim, Heike}, booktitle = {47th International Conference on Software Engineering}, isbn = {9798331505691}, issn = {1558-1225}, location = {Ottawa, ON, Canada}, pages = {2087--2099}, publisher = {IEEE}, title = {{Cooperative software verification via dynamic program splitting}}, doi = {10.1109/ICSE55347.2025.00092}, year = {2025}, } @article{20186, abstract = {Enforcement of information-flow policies has been extensively studied by language-based approaches over the past few decades. In this paper, we propose an alternative, novel, general, and effective approach using enforcement of hyperproperties– a powerful formalism for expressing and reasoning about a wide range of information-flow security policies. We study black- vs. gray- vs. white-box enforcement of hyperproperties expressed by nondeterministic finite-word hyperautomata (NFH), where the enforcer has null, some, or complete information about the implementation of the system under scrutiny. Given an NFH, in order to generate a runtime enforcer, we reduce the problem to controller synthesis for hyperproperties and subsequently to the satisfiability problem for quantified Boolean formulas (QBFs). The resulting enforcers are transferable with low-overhead. We conduct a rich set of case studies, including information-flow control for JavaScript code, as well as synthesizing obfuscators for control plants.}, author = {Hsu, Tzu Han and Oliveira Da Costa, Ana A and Wintenberg, Andrew and Bartocci, Ezio and Bonakdarpour, Borzoo}, issn = {1432-0525}, journal = {Acta Informatica}, number = {3}, publisher = {Springer Nature}, title = {{Gray-box runtime enforcement of hyperproperties}}, doi = {10.1007/s00236-025-00502-1}, volume = {62}, year = {2025}, } @inproceedings{20189, abstract = {Certification was made mandatory for the first time in the latest hardware model checking competition. In this case study, we investigate the trade-offs of requiring certificates for both passing and failing properties in the competition. Our evaluation shows that participating model checkers were able to produce compact, correct certificates that could be verified with minimal overhead. Furthermore, the certifying winner of the competition outperforms the previous non-certifying state-of-the-art model checker, demonstrating that certification can be adopted without compromising model checking efficiency.}, author = {Froleyks, Nils and Yu, Zhengqi and Preiner, Mathias and Biere, Armin and Heljanko, Keijo}, booktitle = {37th International Conference on Computer Aided Verification}, isbn = {9783031986673}, issn = {1611-3349}, location = {Zagreb, Croatia}, pages = {281--295}, publisher = {Springer Nature}, title = {{Introducing certificates to the hardware model checking competition}}, doi = {10.1007/978-3-031-98668-0_14}, volume = {15931}, year = {2025}, } @inproceedings{20225, abstract = {We present the first supermartingale certificate for quantitative -regular properties of discrete-time infinite-state stochastic systems. Our certificate is defined on the product of the stochastic system and a limit-deterministic Büchi automaton that specifies the property of interest; hence we call it a limit-deterministic Büchi supermartingale (LDBSM). Previously known supermartingale certificates applied only to quantitative reachability, safety, or reach-avoid properties, and to qualitative (i.e., probability 1) -regular properties.We also present fully automated algorithms for the template-based synthesis of LDBSMs, for the case when the stochastic system dynamics and the controller can be represented in terms of polynomial inequalities. Our experiments demonstrate the ability of our method to solve verification and control tasks for stochastic systems that were beyond the reach of previous supermartingale-based approaches.}, author = {Henzinger, Thomas A and Mallik, Kaushik and Sadeghi, Pouya and Zikelic, Dorde}, booktitle = {37th International Conference on Computer Aided Verification}, isbn = {9783031986789}, issn = {1611-3349}, location = {Zagreb, Croatia}, pages = {29--55}, publisher = {Springer Nature}, title = {{Supermartingale certificates for quantitative omega-regular verification and control}}, doi = {10.1007/978-3-031-98679-6_2}, volume = {15932}, year = {2025}, } @inproceedings{20253, abstract = {A quantitative word automaton (QWA) defines a function from infinite words to values. For example, every infinite run of a limit-average QWA 𝒜 obtains a mean payoff, and every word w ∈ Σ^ω is assigned the maximal mean payoff obtained by nondeterministic runs of 𝒜 over w. We introduce quantitative language automata (QLAs) that define functions from language generators (i.e., implementations) to values, where a language generator can be nonprobabilistic, defining a set of infinite words, or probabilistic, defining a probability measure over infinite words. A QLA consists of a QWA and an aggregator function. For example, given a QWA 𝒜, the infimum aggregator maps each language L ⊆ Σ^ω to the greatest lower bound assigned by 𝒜 to any word in L. For boolean value sets, QWAs define boolean properties of traces, and QLAs define boolean properties of sets of traces, i.e., hyperproperties. For more general value sets, QLAs serve as a specification language for a generalization of hyperproperties, called quantitative hyperproperties. A nonprobabilistic (resp. probabilistic) quantitative hyperproperty assigns a value to each set (resp. distribution) G of traces, e.g., the minimal (resp. expected) average response time exhibited by the traces in G. We give several examples of quantitative hyperproperties and investigate three paradigmatic problems for QLAs: evaluation, nonemptiness, and universality. In the evaluation problem, given a QLA 𝔸 and an implementation G, we ask for the value that 𝔸 assigns to G. In the nonemptiness (resp. universality) problem, given a QLA 𝔸 and a value k, we ask whether 𝔸 assigns at least k to some (resp. every) language. We provide a comprehensive picture of decidability for these problems for QLAs with common aggregators as well as their restrictions to ω-regular languages and trace distributions generated by finite-state Markov chains.}, author = {Henzinger, Thomas A and Kebis, Pavol and Mazzocchi, Nicolas Adrien and Sarac, Naci E}, booktitle = {36th International Conference on Concurrency Theory}, isbn = {9783959773898}, issn = {1868-8969}, location = {Aarhus, Denmark}, publisher = {Schloss Dagstuhl - Leibniz-Zentrum für Informatik}, title = {{Quantitative language automata}}, doi = {10.4230/LIPIcs.CONCUR.2025.21}, volume = {348}, year = {2025}, } @inproceedings{20256, abstract = {We study the problem of predictive runtime monitoring of black-box dynamical systems with quantitative safety properties. The black-box setting stipulates that the exact semantics of the dynamical system and the controller are unknown, and that we are only able to observe the state of the controlled (aka, closed-loop) system at finitely many time points. We present a novel framework for predicting future states of the system based on the states observed in the past. The numbers of past states and of predicted future states are parameters provided by the user. Our method is based on a combination of Taylor’s expansion and the backward difference operator for numerical differentiation. We also derive an upper bound on the prediction error under the assumption that the system dynamics and the controller are smooth. The predicted states are then used to predict safety violations ahead in time. Our experiments demonstrate practical applicability of our method for complex black-box systems, showing that it is computationally lightweight and yet significantly more accurate than the state-of-the-art predictive safety monitoring techniques.}, author = {Henzinger, Thomas A and Kresse, Fabian and Mallik, Kaushik and Yu, Zhengqi and Zikelic, Dorde}, booktitle = {7th Annual Learning for Dynamics & Control Conference}, issn = {2640-3498}, location = {Ann Arbor, MI, United States}, pages = {804--816}, publisher = {ML Research Press}, title = {{Predictive monitoring of black-box dynamical systems}}, volume = {283}, year = {2025}, }