Elton: Urn Resources for Reasoning about Adversarial Probabilistic Programs

2026-07-15

AI Summary

This work addresses the challenge of performing erasable and mechanized formal verification for higher-order probabilistic programs containing unknown adversarial code—a task beyond the reach of existing methods. The paper introduces Elton, a novel separation logic built on the Iris framework, which enables such verification by introducing “urn resource” predicates to capture invariants over probability distributions and integrating a language-level delayed sampling mechanism. This combination allows, for the first time, erasable reasoning about higher-order probabilistic programs under arbitrary adversarial contexts. Implemented in the Rocq proof assistant, Elton successfully mechanizes the verification of error bounds for several security-critical case studies, surpassing the capabilities of prior techniques in some instances.

Abstract

Probabilistic programs are important for many applications. For security applications in particular, one is interested in establishing properties that hold in the presence of arbitrary adversaries, i.e., unknown pieces of code. We present Elton, a higher-order separation logic for reasoning about higher-order probabilistic programs utilizing unknown adversarial code. Elton incorporates novel logical facilities for specifying invariants over distributional properties using delayed samplings at the language level, and a new kind of separation-logic predicate called urn resources at the logic level. We show that these extensions are sound and can be erased back to a standard call-by-value semantics. Combined with other features, e.g. invariants and ghost resources, Elton is expressive enough to prove error bounds on a wide range of security examples, some of which are beyond the scope of previous techniques. All proofs are mechanized with the Rocq proof assistant and the Iris separation logic framework.

Problem

• probabilistic programs
• adversarial code
• formal verification
• security properties
• higher-order

Innovation

• higher-order separation logic
• probabilistic programs
• adversarial code
• urn resources
• delayed sampling