Asynchronous Hyperproperties

• Asynchronous hyperproperties are logical frameworks that compare multiple system executions via stuttering, delays, and event-based resynchronization.
• They enable precise verification of security, concurrency, and timing properties in systems where trace comparisons are not uniformly synchronized.
• Various formalisms such as A-HLTL, HyperLTLₛ, and Hₘ leverage distinct mechanisms to manage asynchronous trace progress and alignment challenges.

Asynchronous hyperproperties are hyperproperties whose satisfaction depends on relations among multiple executions that need not be compared in lockstep. Whereas synchronous hyperlogics such as HyperLTL advance all quantified traces at the same temporal rate, asynchronous formalisms permit stuttering, delays, mismatched granularity, event-based resynchronization, or scheduler-controlled speed differences. The resulting area includes trajectory-based extensions of HyperLTL, stuttering- and context-based logics, asynchronous fixpoint calculi and automata, second-order logics over sets of traces, probabilistic and strategic variants, and runtime formalisms that combine observed with constructed traces (Gutsfeld et al., 2020, Baumeister et al., 2021, Bombardelli et al., 2024).

1. Conceptual foundations

A hyperproperty is a set of sets of traces. In the standard linear-time setting, a trace is an infinite word over $2^{AP}$, while a system is represented by the set of traces it generates. Many security properties, including noninterference and observational determinism, are hyperproperties because they constrain multiple executions simultaneously rather than single executions in isolation (Gutsfeld et al., 2020).

The synchronous-asynchronous distinction concerns how positions on different traces are compared. In synchronous hyperlogics, temporal operators advance all quantified traces uniformly. In asynchronous settings, different named traces may advance at different speeds, one trace may wait while another progresses, or comparison may occur only at designated observation points. This relaxation is used to model delays, mismatched granularity, independent scheduling, and stutter-insensitive observation (Gutsfeld et al., 2020).

Several semantic devices recur across the literature. One is the fair trajectory of asynchronous HyperLTL, where each trajectory step selects a nonempty subset of trace variables that advance; fairness requires that every quantified variable is selected infinitely often (Baumeister et al., 2021). Another is fair stuttering, used in A-HLTL with explicit stuttering variables, where $t' \stutter t$ iff there exists $f : \mathbb{N} \to \mathbb{N}$ such that $t'(i)=t(f(i))$, $f$ is monotonically increasing, and $f$ is surjective (Beutner et al., 29 Dec 2025). A third mechanism identifies relevant positions directly: in mumbling $H_\mu$, a trace-level formula $\delta$ determines the next position to which a trace variable jumps, so asynchronous progression is driven by designated events rather than by global time (Gutsfeld et al., 2022).

These mechanisms all decouple relational reasoning from a single shared clock. The common purpose is to compare traces modulo stuttering, observation boundaries, call-return structure, or scheduler choices rather than modulo raw step count.

2. Semantic mechanisms and logical formalisms

The literature has developed several orthogonal ways of internalizing asynchrony.

Formalism	Core asynchronous device	Characteristic feature
A-HLTL	Fair trajectories or quantified stutterings	Explicit alignment witnesses
HyperLTL$_S$, HyperLTL$_C$	Stuttering by $t' \stutter t$0; contexts $t' \stutter t$1	Observable-change alignment or local clocks
$t' \stutter t$2, mumbling $t' \stutter t$3	Per-path next; relevant-position jumps	Fixpoints over asynchronous trace relations
Hyper$t' \stutter t$4LTL	Second-order sets of traces	Resynchronization via set closure
Team semantics for LTL	Per-trace temporal indices	Asynchronous team evaluation

A-HLTL in its trajectory-based form extends HyperLTL with modalities $t' \stutter t$5 and $t' \stutter t$6, meaning that $t' \stutter t$7 holds under some fair trajectory or under all fair trajectories. Inside $t' \stutter t$8, $t' \stutter t$9 and $f : \mathbb{N} \to \mathbb{N}$0 are interpreted relative to trajectory steps rather than synchronous positions, so $f : \mathbb{N} \to \mathbb{N}$1 advances exactly those variables selected by the current trajectory letter (Baumeister et al., 2021). A later A-HLTL variant quantifies both traces and stutterings: $f : \mathbb{N} \to \mathbb{N}$2 Here the alignment object is itself a quantified trace $f : \mathbb{N} \to \mathbb{N}$3 satisfying $f : \mathbb{N} \to \mathbb{N}$4, which makes the existence or universality of asynchronous alignments explicit in the logic (Beutner et al., 29 Dec 2025).

HyperLTL$f : \mathbb{N} \to \mathbb{N}$5 and HyperLTL$f : \mathbb{N} \to \mathbb{N}$6 provide two orthogonal asynchronous extensions of HyperLTL. HyperLTL$f : \mathbb{N} \to \mathbb{N}$7 uses relativized temporal operators $f : \mathbb{N} \to \mathbb{N}$8 and $f : \mathbb{N} \to \mathbb{N}$9, where $t'(i)=t(f(i))$0 is a finite set of LTL formulas. Each trace is partitioned into maximal segments on which all formulas in $t'(i)=t(f(i))$1 keep the same truth values, and temporal progression jumps between the boundaries of those segments. HyperLTL$t'(i)=t(f(i))$2 adds a context modality $t'(i)=t(f(i))$3, where $t'(i)=t(f(i))$4 is a nonempty set of trace variables; under $t'(i)=t(f(i))$5 and $t'(i)=t(f(i))$6, only variables in the current context advance while the others remain fixed (Bozzelli et al., 2021).

GHyperLTL$t'(i)=t(f(i))$7 unifies stuttering and contexts. It extends the underlying language with past operators $t'(i)=t(f(i))$8 and $t'(i)=t(f(i))$9, unrestricted trace quantification, and a single framework in which temporal operators can be relativized by a set $f$0 of PLTL formulas while acting only on a context $f$1. The simple fragment of GHyperLTL$f$2 is singled out because it subsumes HyperLTL, known decidable asynchronous fragments, synchronous KLTL, and the one-agent fragment of asynchronous KLTL (Bombardelli et al., 2024).

Mumbling $f$3 generalizes the relevant-position idea. Its multitrace operator $f$4 uses a successor assignment $f$5, where each trace variable $f$6 is paired with a trace-level formula $f$7; a step moves $f$8 to the next position satisfying $f$9, or to the next index if no later satisfying position exists. In recursive settings, the trace language also includes CaRet-style modalities for global successor, abstract successor, and caller predecessor, and the pushdown fragment introduces well-aligned operators $f$0 and its dual to constrain jumps by shared call-return profiles (Gutsfeld et al., 2022).

A different route dispenses with explicit trace quantification and instead evaluates LTL on teams of traces. Under asynchronous team semantics, temporal operators use per-trace index functions rather than a single global time. For ordinary LTL formulas, this semantics is flat: $f$1 When enriched with team atoms such as dependence, it becomes a hyperproperty formalism that is naturally stutter-insensitive (Ho et al., 2018).

3. Automata, fixpoints, and second-order encodings

A central fixpoint formalism is $f$2, introduced as the first fixpoint calculus that can systematically express hyperproperties in an asynchronous manner while subsuming HyperLTL. Its grammar is

$f$3

The operator $f$4 advances only the named path $f$5; the other paths do not move. The semantics is $f$6-indexed: for $f$7 trace variables, index tuples are drawn from

$f$8

with $f$9. This yields a monotone $H_\mu$0-approximation hierarchy, and by Knaster–Tarski every guarded $H_\mu$1-formula has the expected least-fixpoint semantics (Gutsfeld et al., 2020).

The automata-theoretic counterpart is the Alternating Asynchronous Parity Automaton (AAPA). An AAPA $H_\mu$2 runs on an $H_\mu$3-tuple of $H_\mu$4-words, and every expansion step chooses exactly one direction $H_\mu$5; only the offset of that direction is incremented. Acceptance is by a parity condition on every branch of the run tree. Over fixed path assignments, quantifier-free $H_\mu$6 and AAPA have equivalent expressive power: every quantifier-free $H_\mu$7 formula in positive normal form yields a linear-size AAPA in the DAG size, and every AAPA yields a quantifier-free $H_\mu$8 formula whose DAG size is linear in the automaton size (Gutsfeld et al., 2020).

A second family of encodings uses second-order quantification over sets of traces. Hyper$H_\mu$9LTL extends HyperLTL with quantification over sets $\delta$0 of traces: $\delta$1 This makes asynchronous reasoning possible by existentially quantifying a set $\delta$2 of resynchronized traces and then constraining $\delta$3 to be closed under the chosen alignment relation, such as stuttering or one independent swap in a Mazurkiewicz trace relation (Beutner et al., 2023). The fixpoint fragment Hyper$\delta$4LTL$\delta$5 replaces arbitrary second-order choice by a unique least-set construction $\delta$6, which is particularly effective on finite structures such as trees and DAGs (Finkbeiner et al., 18 Jan 2026).

Hyper$\delta$7LTL thereby encodes AHLTL-style asynchrony without explicit trajectory variables. Given an AHLTL sentence $\delta$8, the construction in the paper assigns to each $\delta$9 a smallest set $_S$0 closed under stuttering and then existentially selects $_S$1 so that $_S$2 holds. The same second-order closure pattern is used for common knowledge and for Mazurkiewicz trace classes (Beutner et al., 2023).

4. Decidability, hardness, and approximation regimes

The general verification picture is sharply negative. Model checking asynchronous HyperLTL in the trajectory-based sense is undecidable, and the 2026 complexity classification shows that model checking AHLTL is equivalent to truth in second-order arithmetic. For satisfiability, E-AHLTL is $_S$3-complete, while A-AHLTL satisfiability is $_S$4-hard and in $_S$5 (Baumeister et al., 2021, Regaud et al., 4 Jun 2026). The same pattern of extreme hardness appears elsewhere: emptiness of AAPA is undecidable and $_S$6-hard, $_S$7 model checking and satisfiability are $_S$8-hard, and these problems are “not arithmetical” in the sense emphasized by the paper (Gutsfeld et al., 2020). Full HyperLTL$_S$9 and HyperLTL$_C$0 are undecidable even under strong syntactic restrictions, and timed alternation in HyperMTL is undecidable in both asynchronous and synchronous semantics unless the formula is alternation-free (Bozzelli et al., 2021, Ho et al., 2018).

The positive results come from carefully delimited fragments and approximation principles. For $_C$1, $_C$2-synchronous analysis bounds relative drift and reduces AAPA to synchronous parity automata with $_C$3 states; emptiness for $_C$4-synchronous AAPA is EXPSPACE-complete and drops to PSPACE-complete for fixed $_C$5. $_C$6-context-bounded analysis instead bounds the number of asynchronous phases, yielding EXPSPACE$_C$7-complete emptiness. These automata-side restrictions transfer to $_C$8 model checking and satisfiability via the construction $_C$9 (Gutsfeld et al., 2020). For HyperLTL$t' \stutter t$00, the simple fragment has the same $t' \stutter t$01-complete model-checking complexity as HyperLTL at trace-quantifier alternation depth $t' \stutter t$02, whereas bounded HyperLTL$t' \stutter t$03 is $t' \stutter t$04-complete. Simple GHyperLTL$t' \stutter t$05 remains decidable and is stated to be more expressive than HyperLTL and known decidable fragments of asynchronous extensions of HyperLTL (Bozzelli et al., 2021, Bombardelli et al., 2024).

Several settings recover decidability by restricting the model class or the quantifier pattern. On finite tree-shaped models, Hyper$t' \stutter t$06LTL model checking is in PSPACE; on acyclic models it is in EXPSPACE. For the fixpoint fragment Hyper$t' \stutter t$07LTL$t' \stutter t$08, the corresponding bounds drop to P-complete on trees and EXP-complete on acyclic models (Finkbeiner et al., 18 Jan 2026). For recursive programs, mumbling $t' \stutter t$09 becomes decidable only after replacing unrestricted jumps by well-aligned operators: the fair pushdown model-checking problem is in $t' \stutter t$10EXPTIME at quantifier alternation depth $t' \stutter t$11, and in $t' \stutter t$12EXPTIME for fixed formulas (Gutsfeld et al., 2022). HyperTWTL similarly obtains decidability for alternation-free fragments and for a bounded $t' \stutter t$13 fragment by reducing asynchronous formulas to synchronous TWTL through invariant-trace generation and self-composition; the covered fragments have PSPACE-complete complexity, aligned with HyperLTL-style bounds (Bonnah et al., 2023).

A-HLTL with quantified stutterings occupies an intermediate position. The game-based verification framework is sound for arbitrary $t' \stutter t$14 formulas on reactive systems for every window bound $t' \stutter t$15, but incomplete in general. It becomes complete for alternation-free formulas with at most one stuttering per trace when $t' \stutter t$16, for terminating systems when $t' \stutter t$17 equals the system depth, and for admissible or rectangle-closed invariants again with $t' \stutter t$18 (Beutner et al., 29 Dec 2025). In probabilistic settings, the full model-checking problem for AHyperPCTL is undecidable, but the fragment with uniform probabilistic memoryless schedulers and $t' \stutter t$19-bounded counting stutter-schedulers is decidable by reduction to quantifier-free SMT over nonlinear real arithmetic with linear integer constraints (Gerlach et al., 2023).

5. Application domains and representative specifications

Security is the dominant application domain. Observational determinism, noninterference, McLean’s non-inference, and stuttering refinement all require comparing traces up to stuttering or delay rather than by raw synchronous position. In A-HLTL, asynchronous observational determinism is written as

$t' \stutter t$20

so the property holds when there exist stutterings that align low inputs and preserve output equality globally (Beutner et al., 29 Dec 2025). Variants of asynchronous noninterference and changing-input alignment are expressed by allowing different stutterings on the same base trace, which is precisely the setting where the 2025 game semantics shows practical utility (Beutner et al., 29 Dec 2025).

Concurrency and systems verification provide a second cluster of applications. $t' \stutter t$21 contains formulas for lock-sensitive interleavings of two threads, asynchronous agreement under delays, and observational determinism with explicit skipping of unobservable states (Gutsfeld et al., 2020). HyperLTL$t' \stutter t$22 and GHyperLTL$t' \stutter t$23 encode after-initialization synchronization, bounded response, diagnosability, and global promptness. Hyper$t' \stutter t$24LTL expresses common knowledge and Mazurkiewicz trace theory by quantifying least closure sets under indistinguishability or independent swaps (Bombardelli et al., 2024, Beutner et al., 2023). Hypernode automata capture asynchronous hyperproperties of concurrent systems by combining asynchronous node formulas with synchronous action-labeled transitions, and the paper highlights declassifying observational determinism in multithreaded programs as a natural use case (2305.02836).

Strategic and probabilistic asynchronous hyperproperties extend the same intuition into richer models. HyperATL* introduces a dedicated scheduling agent $t' \stutter t$25 that decides whether a copy of the system advances or stutters. Asynchronous observational determinism then takes the form

$t' \stutter t$26

so asynchrony becomes a strategic question about whether the scheduler has an aligning strategy (Beutner et al., 2022). AHyperPCTL brings the same idea into probabilistic branching time: stutter-schedulers choose whether to idle or proceed after each scheduler action, enabling properties such as scheduler-specific probabilistic observational determinism under stuttering and equalization of timing distributions (Gerlach et al., 2023).

Timed and quantitative settings have their own asynchronous versions. HyperTWTL augments trace quantification with trajectory variables and a two-interval operator $t' \stutter t$27, where one interval constrains local time and the other bounds relative alignment via a duration map $t' \stutter t$28. This is used for robotics mission constraints, service-level agreements, and timing side-channel countermeasures (Bonnah et al., 2023). Generalized A-HLTL with nested trajectory quantification supports bounded model checking of concurrent programs, scheduling attacks, secure compiler optimizations, speculative execution, and cache timing attacks, with nested trajectories required when several independent asynchronous sources of nondeterminism interact (Hsu et al., 2023).

6. Tooling, monitoring, and open directions

The algorithmic landscape has produced several prototypes, each tied to a particular semantic choice. HyMCA implements the game-based A-HLTL approach for $t' \stutter t$29 formulas, constructs the arena $t' \stutter t$30 explicitly from NuSMV systems, uses Spot to build the deterministic Büchi automaton for the temporal body, and solves the resulting Büchi game with Oink. It is complete on the fragments identified above and provides sound answers more generally (Beutner et al., 29 Dec 2025). HySO implements the approximate model-checking algorithm for Hyper$t' \stutter t$31LTL and Hyper$t' \stutter t$32LTL$t' \stutter t$33, combining fixpoint iteration for under-approximations with automata learning for over-approximations (Beutner et al., 2023). The HyperATL* prototype hyperatlmc handles the bracketed fragment $t' \stutter t$34, using Rabinizer 4 and parity-game solving to check scheduler-based asynchronous properties on small finite-state systems (Beutner et al., 2022).

Runtime verification has also acquired genuinely asynchronous machinery. The genHL framework distinguishes passive trace quantifiers over observed traces from active trace quantifiers instantiated by generator functions. Generator functions can construct traces that may never be observed at runtime, such as linearizations of concurrent histories, and the corresponding monitor tree can handle asynchronous hyperproperties with alternating trace quantifiers for the first time. The paper states this explicitly as the main novelty of the monitoring algorithm (Chalupa et al., 4 Aug 2025). Hypernode automata occupy a related but distinct position: they are not monitors in the runtime-verification sense, but they give a decidable offline model-checking formalism for asynchronous hyperproperties over action-labeled Kripke structures (2305.02836). Bounded model checking for generalized A-HLTL provides another pragmatic route: the QBF-based method of the 2023 paper handles formulas with arbitrary trace-quantifier alternation but at most one trajectory-quantifier alternation, and evaluates case studies using HyperQB-style infrastructure and QBF solving (Hsu et al., 2023).

The open problems are now well delineated. For $t' \stutter t$35, the equivalence with automata is established only over fixed path assignments; the paper explicitly leaves open a tree-automata model corresponding to full quantified $t' \stutter t$36 (Gutsfeld et al., 2020). For A-HLTL with quantified stutterings, going beyond $t' \stutter t$37 would require games of incomplete information (Beutner et al., 29 Dec 2025). For AHLTL in the trajectory sense, the remaining precise upper bound for A-AHLTL satisfiability is unresolved, and the pushdown case for recursive programs still has a gap between upper and lower bounds under well-alignedness (Regaud et al., 4 Jun 2026, Gutsfeld et al., 2022). Across the area, recurring directions include symbolic methods for infinite-state systems, richer combinations of bounded-drift and context restrictions, and stronger monitoring or synthesis procedures that preserve the semantic benefits of asynchrony without inheriting the full undecidability of the unconstrained logics.