HyperSTL: Model Checking for Hyperproperties

• HyperSTL is an extension of STL that verifies hyperproperties by quantifying over multiple traces in discrete-time dynamical systems.
• The method employs bounded optimization and recursive counterexample-guided synthesis to check if the system's trace set satisfies the given HyperSTL formula.
• It clearly distinguishes synchronous, product-style verification from asynchronous approaches, outlining complexity boundaries and relations to adjacent hyperlogics.

HyperSTL model checking studies whether the set of traces generated by a system satisfies a HyperSTL formula, where HyperSTL extends STL from single-trace specifications to hyperproperties over multiple traces. In the material considered here, HyperSTL is treated most directly for discrete-time dynamical systems: a system $\Sigma$ satisfies a formula $\Phi$ exactly when its induced trace set satisfies $\Phi$, written $\Sigma \models \Phi$ iff $\mathcal T_\Sigma \models \Phi$ (Zhao et al., 2 Sep 2025). The current landscape is therefore split between a direct bounded, optimization-based treatment of HyperSTL itself and a broader surrounding literature on adjacent hyperlogics, asynchronous semantics, and STL monitoring that clarifies what is algorithmically feasible, what is only partially decidable, and where severe hardness enters.

1. Formal semantics of HyperSTL

In the formulation used for discrete-time dynamical systems, HyperSTL is a trace-quantified extension of STL in which atomic predicates may depend on several traces simultaneously. Its syntax is given by

$\Phi ::= \exists \pi.\Phi \mid \forall \pi.\Phi \mid \phi, \qquad \phi ::= \top \mid \mu_{\nu}^\Theta \mid \neg\phi \mid \phi_1\wedge\phi_2 \mid \phi_1\until_{[a,b]}\phi_2,$

where $\pi$ ranges over trace variables, $\Theta \subseteq \mathcal V$ is a set of trace variables, and each atomic predicate $\mu_\nu^\Theta$ is induced by a function

$\nu:\mathbb R^{n\times |\Theta|}\to \mathbb R.$

The predicate is true exactly when $\Phi$0, where $\Phi$1 is the tuple of current states of the traces assigned to the variables in $\Phi$2 (Zhao et al., 2 Sep 2025).

The semantic object is a trace set $\Phi$3 together with a partial trace assignment $\Phi$4. Satisfaction is written $\Phi$5. For atomic predicates, the semantics is synchronous and pointwise: $\Phi$6 Negation and conjunction have the usual Boolean clauses, while the bounded-until clause quantifies over a time $\Phi$7 and requires $\Phi$8 at $\Phi$9 together with $\Phi$0 on the preceding interval. Global satisfaction is then defined by

$\Phi$1

and system satisfaction by

$\Phi$2

(Zhao et al., 2 Sep 2025).

This semantics generalizes STL in two precise ways. First, HyperSTL adds explicit trace quantification $\Phi$3 and $\Phi$4. Second, it replaces single-trace atomic predicates by multi-trace predicates $\Phi$5, so the quantified-free body can directly relate synchronized state tuples from several executions. In the formulation above, time is shared across all traces appearing in $\Phi$6; no separate asynchronous alignment mechanism is built into the HyperSTL semantics itself (Zhao et al., 2 Sep 2025).

2. Systems, trace sets, and the model-checking problem

The direct HyperSTL treatment is developed for discrete-time dynamical systems

$\Phi$7

with state $\Phi$8, control input $\Phi$9, and transition map $\Sigma \models \Phi$0. From a fixed initial state $\Sigma \models \Phi$1, a control sequence $\Sigma \models \Phi$2 induces a finite trajectory suffix $\Sigma \models \Phi$3. The associated trace-set objects are $\Sigma \models \Phi$4, the set of traces reachable from $\Sigma \models \Phi$5, and $\Sigma \models \Phi$6, the set of traces over all initial states (Zhao et al., 2 Sep 2025).

The paper’s explicit formal problem statement is posed as a planning problem for existential HyperSTL: $\Sigma \models \Phi$7 and, if so, synthesize a control sequence $\Sigma \models \Phi$8 such that $\Sigma \models \Phi$9 is an instance satisfying $\mathcal T_\Sigma \models \Phi$0. At the same time, the paper states that the same recursive counterexample-guided machinery extends to HyperSTL model checking for discrete-time dynamical systems (Zhao et al., 2 Sep 2025).

The scope of this formulation is bounded and operational. The framework is finite-horizon, since STL operators are bounded and the search space is $\mathcal T_\Sigma \models \Phi$1. The system model includes control inputs but no explicit disturbance variable in the main formulation. Universally quantified traces are operationalized by alternative control sequences rather than by a separate adversarial disturbance channel. The result is a notion of HyperSTL model checking over a system-generated trace language, but realized through optimization and recursive search over bounded trajectory tuples rather than through an automata-theoretic exhaustive exploration of an abstract transition system (Zhao et al., 2 Sep 2025).

3. Recursive counterexample-guided algorithms for HyperSTL

For alternation-free existential formulas

$\mathcal T_\Sigma \models \Phi$2

the problem is reduced to an STL planning problem on an augmented $\mathcal T_\Sigma \models \Phi$3-copy system. The paper solves an optimization problem over control sequences $\mathcal T_\Sigma \models \Phi$4 subject to the dynamics of all copies and the mixed-integer constraint encoding $\mathcal T_\Sigma \models \Phi$5 of the quantified-free STL body. Operationally, this is written as

$\mathcal T_\Sigma \models \Phi$6

so alternation-free HyperSTL checking becomes witness synthesis on a synchronized product system (Zhao et al., 2 Sep 2025).

For alternation depth one,

$\mathcal T_\Sigma \models \Phi$7

the paper introduces a counterexample-guided loop. It first generates a candidate tuple with SolvePlan, initializes finite candidate domains $\mathcal T_\Sigma \models \Phi$8 for the universally quantified variables, and then invokes CountCheck to search for universal-side counterexamples by minimizing STL robustness

$\mathcal T_\Sigma \models \Phi$9

If the minimum robustness is positive, no falsifying universally quantified tuple has been found. Otherwise, the discovered counterexample tuple is added to the finite candidate sets and the existential witness is re-synthesized against all accumulated counterexamples. If that refinement problem becomes infeasible, the specification is declared infeasible (Zhao et al., 2 Sep 2025).

For general alternating prefixes, the paper groups adjacent quantifiers of the same polarity and uses the recursive procedure CheckHyper. The current quantifier block is solved by SolvePlan, and the remaining suffix is checked recursively by attempting to falsify it through the next opposing block. The recursive call is made on a negated suffix, so the procedure alternates between witness generation and falsifier generation in a CEGIS-style search over trace tuples. This is the paper’s principal mechanism for handling HyperSTL specifications with multiple alternating quantifiers (Zhao et al., 2 Sep 2025).

The quantified-free STL body is compiled into mixed-integer constraints on the augmented multi-copy system. For each predicate $\Phi ::= \exists \pi.\Phi \mid \forall \pi.\Phi \mid \phi, \qquad \phi ::= \top \mid \mu_{\nu}^\Theta \mid \neg\phi \mid \phi_1\wedge\phi_2 \mid \phi_1\until_{[a,b]}\phi_2,$0, a binary variable $\Phi ::= \exists \pi.\Phi \mid \forall \pi.\Phi \mid \phi, \qquad \phi ::= \top \mid \mu_{\nu}^\Theta \mid \neg\phi \mid \phi_1\wedge\phi_2 \mid \phi_1\until_{[a,b]}\phi_2,$1 enforces the sign of $\Phi ::= \exists \pi.\Phi \mid \forall \pi.\Phi \mid \phi, \qquad \phi ::= \top \mid \mu_{\nu}^\Theta \mid \neg\phi \mid \phi_1\wedge\phi_2 \mid \phi_1\until_{[a,b]}\phi_2,$2 by big-$\Phi ::= \exists \pi.\Phi \mid \forall \pi.\Phi \mid \phi, \qquad \phi ::= \top \mid \mu_{\nu}^\Theta \mid \neg\phi \mid \phi_1\wedge\phi_2 \mid \phi_1\until_{[a,b]}\phi_2,$3 inequalities. Boolean connectives introduce the standard binary encodings for negation, conjunction, and disjunction. Temporal operators are encoded by bounded-time constraints such as

$\Phi ::= \exists \pi.\Phi \mid \forall \pi.\Phi \mid \phi, \qquad \phi ::= \top \mid \mu_{\nu}^\Theta \mid \neg\phi \mid \phi_1\wedge\phi_2 \mid \phi_1\until_{[a,b]}\phi_2,$4

for eventually,

$\Phi ::= \exists \pi.\Phi \mid \forall \pi.\Phi \mid \phi, \qquad \phi ::= \top \mid \mu_{\nu}^\Theta \mid \neg\phi \mid \phi_1\wedge\phi_2 \mid \phi_1\until_{[a,b]}\phi_2,$5

for always, and the usual bounded until expansion for $\Phi ::= \exists \pi.\Phi \mid \forall \pi.\Phi \mid \phi, \qquad \phi ::= \top \mid \mu_{\nu}^\Theta \mid \neg\phi \mid \phi_1\wedge\phi_2 \mid \phi_1\until_{[a,b]}\phi_2,$6 (Zhao et al., 2 Sep 2025).

The paper proves an overview-oriented soundness theorem: the control inputs returned by Algorithm 2 satisfy the HyperSTL formula. It also states that the same framework is applicable to HyperSTL model checking. However, it does not separately state a model-checking theorem, does not provide completeness under infinite control domains, and does not give a complexity classification. It explicitly notes that if $\Phi ::= \exists \pi.\Phi \mid \forall \pi.\Phi \mid \phi, \qquad \phi ::= \top \mid \mu_{\nu}^\Theta \mid \neg\phi \mid \phi_1\wedge\phi_2 \mid \phi_1\until_{[a,b]}\phi_2,$7 is infinite, a maximum number of iterations must still be set for the two while loops in Algorithm 2 (Zhao et al., 2 Sep 2025).

4. Reduction-based and automata-based methods in adjacent hyperlogics

A substantial part of the methodological background for HyperSTL model checking comes from neighboring hyperlogics rather than from HyperSTL itself. HyperTWTL extends TWTL with trace quantifiers and offers both synchronous and asynchronous semantics over timed traces. For its supported fragments, model checking proceeds by asynchronous-to-synchronous normalization, self-composition of the timed Kripke structure, translation of HyperTWTL into plain TWTL, and reduction to an existing TWTL verifier. The paper focuses on alternation-free fragments and $\Phi ::= \exists \pi.\Phi \mid \forall \pi.\Phi \mid \phi, \qquad \phi ::= \top \mid \mu_{\nu}^\Theta \mid \neg\phi \mid \phi_1\wedge\phi_2 \mid \phi_1\until_{[a,b]}\phi_2,$8-style cases under additional restrictions, and it makes explicit that the transferable insight is the reduction architecture rather than a signal-level HyperSTL procedure (Bonnah et al., 2023).

HyperTSL(T) addresses a different niche: software systems with infinite data domains. Its core machinery combines LTL-to-Büchi translation over atomized theory terms, symbolic program automata, self-composition for hyperproperties, and feasible-trace reasoning. The paper gives exact model checking for TSL(T) and alternation-free HyperTSL(T), together with a sound but necessarily incomplete automata-based procedure for the $\Phi ::= \exists \pi.\Phi \mid \forall \pi.\Phi \mid \phi, \qquad \phi ::= \top \mid \mu_{\nu}^\Theta \mid \neg\phi \mid \phi_1\wedge\phi_2 \mid \phi_1\until_{[a,b]}\phi_2,$9 fragment of HyperTSL(T) that does not rely on a finite-state abstraction (Finkbeiner et al., 2023). This does not supply HyperSTL model checking directly, but it identifies a distinct route for hyperproperty verification once the underlying temporal language is data-rich rather than signal-rich.

At a more abstract level, the automata-theoretic template for temporal hyperlogics is articulated for HyperLTL, HyperQPTL, HyperCTL$\pi$0, HyperQCTL$\pi$1, and MPL[$\pi$2]. The template is to negate the formula, represent tuples of traces or paths synchronously, translate the quantifier-free temporal kernel into automata, eliminate hyperquantifiers by projection plus system-consistency constraints, and reduce correctness to emptiness. In that landscape, HyperLTL, HyperQPTL, HyperCTL$\pi$3, and MPL[$\pi$4] model checking are presented as decidable, whereas HyperQCTL$\pi$5 is undecidable (Finkbeiner, 2021). For HyperSTL, these results do not determine a complexity class, but they delimit the algorithmic design space: product semantics and quantifier elimination are standard, while unrestricted combinations of branching structure and stronger second-order power are not.

5. Asynchrony, stuttering, and hardness boundaries

The sharpest current hardness warning relevant to HyperSTL model checking comes from generalized HyperLTL with stuttering and contexts, $\pi$6, which is explicitly designed for asynchronous hyperproperties. In that setting, HyperLTL’s synchronous lockstep progression is extended by two mechanisms: stuttering, which advances time by semantic changepoints, and contexts, which allow time to advance on selected traces while others are frozen. The resulting logic can express asynchronous hyperproperties that standard HyperLTL cannot express (Regaud et al., 11 Apr 2025).

For this logic, satisfiability remains $\pi$7-complete, but model checking is dramatically harder: the paper proves that model checking for $\pi$8, $\pi$9, and $\Theta \subseteq \mathcal V$0 is equivalent to truth in second-order arithmetic. The lower bounds already hold when only stuttering is allowed or when only contexts are allowed. The paper contrasts this directly with standard HyperLTL model checking, which it cites as decidable and Tower-complete (Regaud et al., 11 Apr 2025).

This result is not a theorem about HyperSTL itself, because HyperSTL is not the logic analyzed there. Its relevance is comparative. HyperSTL as formulated for discrete-time dynamical systems uses synchronized tuples of states at a common time index, and the direct model-checking development does not introduce stutter-based progression, changepoint alignment, or context-style selective advancement. The neighboring $\Theta \subseteq \mathcal V$1 result therefore marks a semantic boundary: once a hyperlogic can compare traces without forcing lockstep time, model checking may move from a difficult but structured setting into one equivalent to truth in second-order arithmetic (Regaud et al., 11 Apr 2025).

This suggests a concrete distinction inside the HyperSTL design space. A synchronous, bounded, product-style HyperSTL body over discrete-time traces admits the recursive optimization methods described above. By contrast, a HyperSTL variant intended to support stutter-insensitive comparison, asynchronous alignment by events, or selective temporal advancement would plausibly inherit the same kind of severe hardness seen for asynchronous hyperlogics, although that extrapolation is presently an informed implication rather than a proved HyperSTL theorem (Regaud et al., 11 Apr 2025).

6. Relation to STL monitoring and single-trace verification

A recurrent source of confusion is the difference between HyperSTL model checking and STL monitoring or single-trace STL model checking. HySIA is a reliable runtime verification tool for nonlinear hybrid automata and STL properties. It combines validated interval simulation with interval-aware STL monitoring, returns $\Theta \subseteq \mathcal V$2, $\Theta \subseteq \mathcal V$3, or unknown, and can make universal claims over the trajectory family enclosed by interval initial conditions. But it does not define HyperSTL, does not quantify over multiple traces, and is best classified as sound simulation-based STL monitoring with interval reachability over bounded executions rather than as HyperSTL model checking (Ishii et al., 2017).

The same distinction holds for mstlo. It is a high-performance Rust library for online monitoring of bounded STL, supporting delayed Boolean semantics, delayed robustness, eager Boolean semantics with early verdicts, and RoSI. Its architecture is based on an AST, bottom-up dynamic programming, per-operator caching, and streaming min/max computation for $\Theta \subseteq \mathcal V$4 and $\Theta \subseteq \mathcal V$5. Yet it does not mention HyperSTL, does not provide trace quantifiers or multi-trace semantics, and addresses runtime verification of a single observed execution rather than model checking of a trace set (Thomsen et al., 26 May 2026).

Single-trace STL model checking can also be exact and highly formal without becoming hyperproperty verification. For quantum continuous-time Markov chains, STL model checking is developed by reducing atomic propositions to real-root isolation for analytic signals and evaluating temporal formulas bottom-up by interval operations, with decidability claimed under Schanuel’s conjecture. This result is technically significant for continuous-time STL, but it remains single-trace and does not introduce trace quantification, relational predicates across traces, or HyperSTL semantics (Xu et al., 2021).

The present state of HyperSTL model checking is therefore stratified. Directly, the literature provides a bounded, optimization-based framework for discrete-time dynamical systems with trace quantifiers and multi-trace predicates (Zhao et al., 2 Sep 2025). Methodologically, adjacent hyperlogics contribute self-composition, automata-based projection, feasible-trace reasoning, and explicit synchronous-versus-asynchronous semantics (Bonnah et al., 2023, Finkbeiner et al., 2023, Finkbeiner, 2021). Negatively, asynchronous and stutter-aware hyperlogics show that modest-looking departures from lockstep time can push model checking to second-order-arithmetic equivalence (Regaud et al., 11 Apr 2025). Everything else in the current tool ecosystem that works directly with STL—reliable monitoring, online monitoring, or exact single-trace model checking—remains infrastructure for temporal specification rather than HyperSTL model checking proper (Ishii et al., 2017, Thomsen et al., 26 May 2026, Xu et al., 2021).