Bayesian Separation Logic (BaSL)

• Bayesian Separation Logic (BaSL) is a probabilistic logic designed to model Bayesian updating and conditioning in probabilistic programs with modular reasoning.
• It extends traditional probabilistic separation logics by using σ-finite measure spaces to handle unnormalised distributions and integrate likelihoods and normalising constants.
• BaSL supports modular verification via a frame rule and internal Bayes theorem, enabling precise reasoning about posterior updates, independence, and conjugate priors.

Bayesian Separation Logic (BaSL) is a probabilistic separation logic designed specifically to reason about Bayesian probabilistic programs. It keeps the separation-logic view of probabilistic resources, preserves the interpretation of separating conjunction as probabilistic/resource separation and independence, and extends earlier probabilistic separation logics so that they can express and verify Bayesian updating induced by observe and score. Semantically, BaSL is based on a novel instantiation of a Kripke resource monoid by $\sigma$-finite measure spaces over the Hilbert cube, and its Hoare-triple semantics is compatible with an existing denotational semantics of Bayesian probabilistic programming based on the category of $s$-finite kernels (Ho et al., 21 Jul 2025).

1. Motivation and problem setting

BaSL addresses a gap between standard semantics for Bayesian probabilistic programming languages (BPPLs) and compositional program logic. BPPLs let users denote statistical models as code while the interpreter infers the posterior distribution; execution combines sampling, via constructs such as sample, with conditioning or updating, via constructs such as observe or score. Examples mentioned in the BaSL development include Stan, Anglican, and Gen. A representative fragment is

$$\mathrm{let}\ X = \mathrm{sample}(\mathsf{FairDie})\ \mathrm{in}\ \mathrm{observe}(X > 4);\ \mathrm{return}\ X,$$

which computes the distribution of a die roll conditioned on the event $X>4$ (Ho et al., 21 Jul 2025).

The difficulty is not that existing denotational or operational semantics fail to assign meanings to such programs. Rather, those semantics are “usually mathematically complex and unable to reason about desirable properties such as expected values and independence of random variables.” In particular, they do not directly provide a modular proof system for assertions such as expected values, covariance or correlation, posterior laws, or Bayesian-update properties after observation. The motivating Hoare-style specification is

$$\{X \sim \mathsf{Unif}(\{1,\dots,6\})\}\ \mathrm{observe}(X>4)\ \{X \sim \mathsf{Unif}(\{5,6\})\},$$

which expresses genuine conditioning of the current probabilistic state rather than fresh random generation.

BaSL is introduced to fill exactly this gap. It preserves modularity via the frame rule, but it adds the missing Bayesian ingredients: likelihoods, normalising constants, conditional distributions, unnormalised distributions, and an internal account of Bayes’ theorem. This makes it a logic for Bayesian updating rather than only for independence-preserving randomized computation.

2. Semantic model and resource interpretation

The semantic model of BaSL replaces the probability-space resource models used in earlier probabilistic separation logics with one based on $\sigma$-finite measure spaces. This change is essential because Bayesian observation generally produces an unnormalised measure, whose total mass may be any positive finite number, or even infinite in the case of improper priors. BaSL therefore works over $\sigma$-finite measures rather than probability measures alone (Ho et al., 21 Jul 2025).

As in Lilac, the ambient sample space is the Hilbert cube

$(\Omega,\mathcal B_\Omega) \deq ([0,1]^{\mathbb N}, \mathcal B[0,1]^{\mathbb N}).$

Intuitively, this serves as a canonical random source. BaSL worlds are random generators. A random generator is a pair $(\mathcal F,\mu)$ such that $\mu$ is $s$0-finite, $s$1, $s$2, $s$3 is countably generated, and $s$4 has finite footprint. The finite-footprint condition says that there exists $s$5 such that every $s$6 has the form $s$7 with $s$8. Only finitely many coordinates have been “used.”

Independent composition of resources is defined as follows. For $s$9 and $$\mathrm{let}\ X = \mathrm{sample}(\mathsf{FairDie})\ \mathrm{in}\ \mathrm{observe}(X > 4);\ \mathrm{return}\ X,$$0, their combination exists whenever there is $$\mathrm{let}\ X = \mathrm{sample}(\mathsf{FairDie})\ \mathrm{in}\ \mathrm{observe}(X > 4);\ \mathrm{return}\ X,$$1 such that $$\mathrm{let}\ X = \mathrm{sample}(\mathsf{FairDie})\ \mathrm{in}\ \mathrm{observe}(X > 4);\ \mathrm{return}\ X,$$2 is the smallest $$\mathrm{let}\ X = \mathrm{sample}(\mathsf{FairDie})\ \mathrm{in}\ \mathrm{observe}(X > 4);\ \mathrm{return}\ X,$$3-algebra containing $$\mathrm{let}\ X = \mathrm{sample}(\mathsf{FairDie})\ \mathrm{in}\ \mathrm{observe}(X > 4);\ \mathrm{return}\ X,$$4 and $$\mathrm{let}\ X = \mathrm{sample}(\mathsf{FairDie})\ \mathrm{in}\ \mathrm{observe}(X > 4);\ \mathrm{return}\ X,$$5, and

$$\mathrm{let}\ X = \mathrm{sample}(\mathsf{FairDie})\ \mathrm{in}\ \mathrm{observe}(X > 4);\ \mathrm{return}\ X,$$6

for all $$\mathrm{let}\ X = \mathrm{sample}(\mathsf{FairDie})\ \mathrm{in}\ \mathrm{observe}(X > 4);\ \mathrm{return}\ X,$$7 and $$\mathrm{let}\ X = \mathrm{sample}(\mathsf{FairDie})\ \mathrm{in}\ \mathrm{observe}(X > 4);\ \mathrm{return}\ X,$$8. This yields the partial operation $$\mathrm{let}\ X = \mathrm{sample}(\mathsf{FairDie})\ \mathrm{in}\ \mathrm{observe}(X > 4);\ \mathrm{return}\ X,$$9. The paper proves that $X>4$0 is a partial commutative monoid, and with preorder

$X>4$1

it becomes a Kripke resource monoid.

This construction gives the resource interpretation of separating conjunction. In BaSL, $X>4$2 means that the current probabilistic state can be split into independent probabilistic resources satisfying $X>4$3 and $X>4$4. The connective therefore retains the independence-based reading familiar from earlier probabilistic separation logics, but it is now formulated in a setting rich enough for Bayesian updating and unnormalised mass.

3. Assertions, conditioning, and Hoare triples

BaSL’s assertion language extends BI-style probabilistic assertions with explicitly Bayesian forms. The grammar includes

$X>4$5

The important nonstandard assertions are $X>4$6, $X>4$7, $X>4$8, the conditioning modality $X>4$9, the likelihood or total-mass assertion $$\{X \sim \mathsf{Unif}(\{1,\dots,6\})\}\ \mathrm{observe}(X>4)\ \{X \sim \mathsf{Unif}(\{5,6\})\},$$0, and internal Hoare triples (Ho et al., 21 Jul 2025).

Assertions are interpreted against triples $$\{X \sim \mathsf{Unif}(\{1,\dots,6\})\}\ \mathrm{observe}(X>4)\ \{X \sim \mathsf{Unif}(\{5,6\})\},$$1, where $$\{X \sim \mathsf{Unif}(\{1,\dots,6\})\}\ \mathrm{observe}(X>4)\ \{X \sim \mathsf{Unif}(\{5,6\})\},$$2 is a deterministic environment, $$\{X \sim \mathsf{Unif}(\{1,\dots,6\})\}\ \mathrm{observe}(X>4)\ \{X \sim \mathsf{Unif}(\{5,6\})\},$$3 is a tuple of random variables, and $$\{X \sim \mathsf{Unif}(\{1,\dots,6\})\}\ \mathrm{observe}(X>4)\ \{X \sim \mathsf{Unif}(\{5,6\})\},$$4 is a resource/world. The key semantic clauses are: $$\{X \sim \mathsf{Unif}(\{1,\dots,6\})\}\ \mathrm{observe}(X>4)\ \{X \sim \mathsf{Unif}(\{5,6\})\},$$5

$$\{X \sim \mathsf{Unif}(\{1,\dots,6\})\}\ \mathrm{observe}(X>4)\ \{X \sim \mathsf{Unif}(\{5,6\})\},$$6

iff $$\{X \sim \mathsf{Unif}(\{1,\dots,6\})\}\ \mathrm{observe}(X>4)\ \{X \sim \mathsf{Unif}(\{5,6\})\},$$7 and

$$\{X \sim \mathsf{Unif}(\{1,\dots,6\})\}\ \mathrm{observe}(X>4)\ \{X \sim \mathsf{Unif}(\{5,6\})\},$$8

and

$$\{X \sim \mathsf{Unif}(\{1,\dots,6\})\}\ \mathrm{observe}(X>4)\ \{X \sim \mathsf{Unif}(\{5,6\})\},$$9

Thus $\sigma$0 is BaSL’s internal handle on likelihood and normalisation.

The conditioning modality is defined measure-theoretically. One has

$\sigma$1

iff $\sigma$2 holds, $\sigma$3 is absolutely continuous with respect to $\sigma$4 for $\sigma$5, and for every Borel extension $\sigma$6 of $\sigma$7, and every $\sigma$8-disintegration $\sigma$9, for $\sigma$0-almost all $\sigma$1,

$\sigma$2

This internalizes the claim that $\sigma$3 holds almost surely after conditioning on $\sigma$4.

BaSL is not affine in the usual separation-logic sense, because one cannot always discard resources when unnormalised mass matters. The paper defines $\sigma$5 to be affine if

$\sigma$6

Only normalised assertions are affine, and this yields restricted weakening principles such as

$\sigma$7

Hoare triples are interpreted as partial-correctness triples. A judgment

$\sigma$8

means that for all pre-states satisfying $\sigma$9, and all frames, if running $(\Omega,\mathcal B_\Omega) \deq ([0,1]^{\mathbb N}, \mathcal B[0,1]^{\mathbb N}).$0 from the combined pre-state has non-zero normalising constant, then there exists a post-state and a random variable $(\Omega,\mathcal B_\Omega) \deq ([0,1]^{\mathbb N}, \mathcal B[0,1]^{\mathbb N}).$1 satisfying $(\Omega,\mathcal B_\Omega) \deq ([0,1]^{\mathbb N}, \mathcal B[0,1]^{\mathbb N}).$2, compatible with the frame, and matching program semantics. The restriction to partial correctness is essential because in Bayesian programming a program may normalise to zero mass, and deciding positivity of normalising constants is undecidable.

4. Internal Bayes theorem and proof rules

A central contribution of BaSL is an internal version of Bayes’ theorem. “Internal” means that Bayes’ theorem is not merely established externally about the model; it appears as a logical entailment in BaSL itself. The semantic basis is a $(\Omega,\mathcal B_\Omega) \deq ([0,1]^{\mathbb N}, \mathcal B[0,1]^{\mathbb N}).$3-finite version of disintegration, formulated through the Rokhlin-Simmons disintegration theorem. The development also proves a density theorem stating that for $(\Omega,\mathcal B_\Omega) \deq ([0,1]^{\mathbb N}, \mathcal B[0,1]^{\mathbb N}).$4-almost every $(\Omega,\mathcal B_\Omega) \deq ([0,1]^{\mathbb N}, \mathcal B[0,1]^{\mathbb N}).$5,

$(\Omega,\mathcal B_\Omega) \deq ([0,1]^{\mathbb N}, \mathcal B[0,1]^{\mathbb N}).$6

so the Radon–Nikodym derivative of the pushforward measure is exactly the total mass of the conditional fibers (Ho et al., 21 Jul 2025).

The resulting internal Bayes theorem is

$(\Omega,\mathcal B_\Omega) \deq ([0,1]^{\mathbb N}, \mathcal B[0,1]^{\mathbb N}).$7

This is the logic’s formal correspondence between prior-plus-likelihood information in conditioned fibers and an unnormalised posterior measure. In the paper’s explanation, prior plus conditional likelihood is bi-entailment-equivalent to the posterior.

BaSL’s core proof rules expose the same idea operationally. Sampling is governed by

$(\Omega,\mathcal B_\Omega) \deq ([0,1]^{\mathbb N}, \mathcal B[0,1]^{\mathbb N}).$8

and conditional sampling by

$(\Omega,\mathcal B_\Omega) \deq ([0,1]^{\mathbb N}, \mathcal B[0,1]^{\mathbb N}).$9

Scoring is handled by multiplicative reweighting: $(\mathcal F,\mu)$0 and observation is expressed as

$(\mathcal F,\mu)$1

where

$(\mathcal F,\mu)$2

For continuous observations, the paper defines

$(\mathcal F,\mu)$3

The frame rule is retained: $(\mathcal F,\mu)$4 This preservation of modular framing despite unnormalised mass is one of BaSL’s defining features. It allows independent “bookkeeping” resources such as normalising constants to be separated, carried through proofs, and framed off when not needed.

5. Expressive power and worked examples

BaSL is intended to reason about expected values, independence and dependence, covariance or correlation, conditional distributions, posterior distributions, soft constraints, conjugate priors, improper priors, and unnormalised distributions. The paper’s examples are designed to demonstrate those capabilities directly (Ho et al., 21 Jul 2025).

In the Bayesian coin-flip example, the prior is $(\mathcal F,\mu)$5, then $(\mathcal F,\mu)$6, one observes $(\mathcal F,\mu)$7, then $(\mathcal F,\mu)$8, one observes $(\mathcal F,\mu)$9, and the program returns $\mu$0. BaSL derives

$\mu$1

after the first observation,

$\mu$2

after the second, and hence

$\mu$3

The relevant normalising-constant proposition is

$\mu$4

In the collider Bayesian-network example, one samples $\mu$5 independently, sets $\mu$6, observes $\mu$7, and returns $\mu$8. Before observing $\mu$9,

$s$00

After observing $s$01, BaSL derives

$s$02

which normalises to

$s$03

From this one obtains

$s$04

and therefore

$s$05

This is the paper’s demonstration that conditioning on a collider can induce negative correlation.

In the burglar alarm model, with $s$06, $s$07, $s$08, and phone-ringing evidence modeled by

$s$09

BaSL proves a posterior claim for earthquake: $s$10 hence

$s$11

The paper also derives conjugacy facts as Hoare triples. Examples include Normal-Normal conjugacy,

$s$12

Beta-Bernoulli conjugacy,

$s$13

and Gamma-Poisson conjugacy,

$s$14

BaSL also supports improper priors because its worlds are $s$15-finite rather than probabilistic. The paper gives the example

$s$16

which yields a semantic representation of Lebesgue measure: $s$17 Then observing $s$18 from any density $s$19 gives

$s$20

Finally, even when no closed-form posterior exists, BaSL can verify symbolic posterior formulae, as in the Gaussian mixture model where the posterior is represented iteratively by

$s$21

and the logic proves

$s$22

6. Relation to earlier probabilistic separation logics and scope

BaSL belongs to a line of work in which separation logic’s resource connectives are reinterpreted probabilistically rather than spatially. The key antecedent is PSL, “A Probabilistic Separation Logic,” which introduced a probabilistic model of BI in which separation models probabilistic independence, built a sound program logic on those assertions, and verified information-theoretic security for private information retrieval, oblivious transfer, secure multi-party addition, and simple oblivious RAM (Barthe et al., 2019). In PSL, the central conceptual move is that

$s$23

means factorization of the current probabilistic state into independent components, and sampling adds a fresh independent factor.

The cryptographic extension “On Separation Logic, Computational Independence, and Pseudorandomness” adapts the same general idea to computational rather than exact independence. There, separating conjunction is interpreted through computational indistinguishability from tensor-product decomposition, so that the logic can express independence “to the eyes of efficient adversaries” and reason about the interaction between independence and pseudorandomness (Lago et al., 2024).

BaSL inherits the separation-based view of modularity and independence from these frameworks, especially PSL and Lilac, but changes the semantic setting and proof-theoretic target. Previous separation logics could reason about random generation, independence, and in some cases conditional distributions, but “no existing separation logic can handle Bayesian updating, which is the key distinguishing feature of BPPLs.” BaSL adds direct support for observe and score, internal Bayes, unnormalised distributions, normalising constants, soft constraints, conjugate priors, and improper priors, while retaining the frame rule (Ho et al., 21 Jul 2025).

A common misconception is that any probabilistic separation logic with independence semantics is already Bayesian. The comparison with PSL and the computational variant shows that this is not so. Those logics are highly relevant precursors, but their primary strengths are independence, factorization, and pseudorandomness rather than posterior update. BaSL’s distinctive contribution is to model Bayesian updating inside the logic itself.

The current scope is deliberately limited. The paper identifies future work on mechanization in a theorem prover, extension with mutable state, recursion, higher-order functions, and applications to symbolic execution or program simplification tools. This suggests that present-day BaSL is a first-order logical foundation for Bayesian probabilistic programming rather than a full account of modern higher-order PPLs.