---
title: Information Flow Refinement
url: https://www.emergentmind.com/topics/information-flow-refinement-ifr
type: topic
---

# Information Flow Refinement

Searching arXiv for recent work on Information Flow Refinement and closely related interface/refinement/security papers.
Information Flow Refinement (IFR) is a family of approaches for making information-flow reasoning progressively more precise through refinement of metrics, interfaces, architectures, policies, invariants, or implementations. Across the literature, the term does not denote a single formalism. Instead, it names a recurring methodological pattern: one starts from a coarse description of information flow—such as symmetric association, abstract noninterference, lattice-based policies, channel models, or contract-level no-flow constraints—and then refines that description into structures that support directionality, compositionality, operational interpretation, or implementation-level preservation. In the available arXiv literature, IFR appears in at least three major senses: metric refinement in quantitative information flow [1206.0886], contract- and interface-based refinement of security requirements [2002.06465], [2406.14374], architecture-level refinement of information-flow structures [1409.0309], behavior-preserving refinement calculi for information-flow architectures [1409.6932], implementation-preserving refinement for noninterference in infrastructure and concurrent-system models [2412.10949], [2511.06862], and proof-level refinement of relational invariants in formal hardware verification [2606.22063]. A distinct but related usage appears in recent astrophysical work, where “information flow refinement” describes a hierarchy from Mutual Information to Transfer Entropy and Liang’s information flow rate in order to sharpen undirected co-evolution into directional coupling [2606.16403].

## 1. Conceptual scope and recurring structure

The literature uses IFR to address a common problem: coarse information-flow descriptions are often insufficient for reasoning about causality, compositional design, operational meaning, or preservation under implementation. The response is to refine the representation of information flow while preserving a stronger or more usable security interpretation.

One strand treats IFR as refinement of a quantitative leakage metric. “Refining a Quantitative Information Flow Metric” replaces an unbounded Kullback–Leibler-based accuracy metric with a Jensen–Shannon-based bounded metric, preserving the “accuracy-based, reality-aware, belief-based” structure while making leakage size-consistent and operationally meaningful in terms of exhaustive search effort [1206.0886]. Another strand treats IFR as refinement of contracts or interfaces: information-flow interfaces support “the composition and refinement of both assumptions and guarantees,” and later work shows that these interfaces admit a security-lattice semantics without changing the underlying refinement theory [2002.06465], [2406.14374]. A third strand treats IFR as refinement of abstract architectures, where abstract causal structures and filter functions are refined into more detailed information-flow architectures while preserving security properties proved at the abstract level [1409.0309]. A fourth strand treats IFR as preservation of noninterference through refinement mappings between abstract and concrete state-transition systems, including infrastructures with actors and concurrent systems governed by intransitive policies [2412.10949], [2511.06862]. A fifth strand treats IFR as refinement of proof obligations and relational invariants inside model checking, as in guarded equivalence predicates for scalable hardware information-flow verification [2606.22063].

This suggests that IFR is best understood as a methodological umbrella rather than a single theorem schema. A plausible implication is that the unifying feature is not a fixed semantic domain, but the use of refinement to connect a higher-level information-flow description to a lower-level one while preserving a security-relevant notion of noninterference, bounded leakage, or directed influence.

## 2. Metric refinement and quantitative interpretations

In quantitative information flow, IFR appears as refinement of the metric itself. The central example is the refinement of the accuracy-based metric of Clarkson et al. in “Refining a Quantitative Information Flow Metric” [1206.0886]. The original metric is
\[
\mathcal{Q}(\mathcal{E}, b_H') = D(b_H \to \dot{\sigma}_H) - D(b_H' \to \dot{\sigma}_H)
\]
with \(D\) the Kullback–Leibler divergence, which simplifies to
\[
\mathcal{Q}(\mathcal{E},b_H') = -\log b_H(\sigma_H) + \log b_H'(\sigma_H).
\]
The paper shows that \(\mathcal{Q}\) can report leakage larger than the secret size, and that its range is
\[
\varrho_{\mathcal{Q}} = (-\infty, -\log b_H(\sigma_H)].
\]
This violates the paper’s notion of a “size-consistent QIF quantifier,” namely a quantifier bounded by \(\pm \eta\), where \(\eta = \log |\mathcal{W}_p|\) is the secret size [1206.0886].

The refinement preserves the same accuracy-based structure but replaces KL divergence by
\[
D'(b \to b') = \sum_{\sigma \in \mathcal{W}_p} b'(\sigma)\cdot \log\frac{b'(\sigma)}{\frac{b'(\sigma)+b(\sigma)}{2}},
\]
which is bounded in \([0,1]\), and yields
\[
\mathcal{Q}'(\mathcal{E}, b_H') = -\log\big(1 + b_H(\sigma_H)\big) + \log\big(1 + b_H'(\sigma_H)\big)
\]
with
\[
\varrho_{\mathcal{Q}'} = [-1,1].
\]
Scaling by \(\eta\) gives the final refined metric
\[
\mathcal{Q}''(\mathcal{E}, b_H') = \eta\cdot\Big[ -\log(1 + b_H(\sigma_H)) + \log(1 + b_H'(\sigma_H))\Big],
\]
which satisfies
\[
-\eta \le \mathcal{Q}''(\mathcal{E},b_H') \le \eta
\]
and therefore restores size-consistency [1206.0886].

The significance of this refinement is operational rather than merely algebraic. The refined metric supports the interpretation that if an informing flow of \(k\) bits occurs, then the exhaustive search space needed to uncover the residual \(\eta-k\) bits is
\[
2^{\eta-k},
\]
and Theorem 2 in the paper gives a direct relation between a reported flow \(k\) and the posterior probability of the true secret:
\[
\mathcal{Q}''(\mathcal{E},b_H') = k\ \Longleftrightarrow\ 
b_H'(\sigma_H) = 2^{k/\eta}\cdot b_H(\sigma_H) + 2^{k/\eta} - 1.
\]
In this sense IFR is metric refinement that preserves the conceptual premises of accuracy-based QIF while making the result bounded, interpretable, and suitable for program comparison [1206.0886].

A different quantitative perspective appears in the algebraic channel model of quantitative information flow [1801.08090]. There, the refinement relation is defined by post-processing:
\[
C_1 \sqsubseteq C_2 \iff \exists D.\; C_1 D = C_2,
\]
and the “Coriaceous Theorem” states that this is equivalent to
\[
V_g[\pi\,C_1] \ge V_g[\pi\,C_2]
\]
for all priors \(\pi\) and gain functions \(g\) [1801.08090]. This makes IFR a security-preserving preorder on channels. The same paper develops an algebra of operators—parallel composition, visible choice, and hidden choice—and studies which operators preserve refinement. Visible choice satisfies full relative monotonicity, whereas hidden choice does not [1801.08090]. This establishes that IFR in quantitative settings is not only about defining a preorder but also about understanding which compositional contexts preserve it.

## 3. Contracts, interfaces, and lattice semantics

Information-flow interfaces recast IFR as refinement of assumptions and guarantees in contract-based design. The abstract of “Information-Flow Interfaces” states that the framework provides “a refinement relation and a composition operation that support both incremental design and independent implementability,” and that it develops both stateless and stateful information-flow interfaces [2002.06465]. The same abstract also states that the stateful theory admits “three plausible trace semantics,” two corresponding to temporal logics for hyperproperties and a third defining “a new class of hyperproperties that lies between the other two” [2002.06465]. Although the detailed definitions are absent from the supplied excerpt, the paper explicitly positions refinement as the core interface-theoretic mechanism for system-wide security contracts.

“Information-flow Interfaces and Security Lattices” supplies a semantic interpretation for that theory in terms of security lattices [2406.14374]. The paper begins from information-flow contracts
\[
C_{\text{flow}} = (X, Y, A, G),
\]
where \(X\) and \(Y\) are disjoint sets of input and output variables, \(A \subseteq 2^{Z \times X}\) is the assumption, \(G \subseteq 2^{Z \times Y}\) is the guarantee, and \(Z=X\cup Y\) [2406.14374]. A flow relation \(M\) is a transitive relation over variables that is reflexive over the target set. The new contribution is a translation from such flow relations to security lattices.

A security policy is written
\[
(SC, \sqsubseteq, \oplus),
\]
with \(SC\) finite, \((SC,\sqsubseteq)\) a partial order, a unique lower bound, and \(\oplus\) a least upper bound operator [2406.14374]. Security lattice contracts have the same contract shape,
\[
(X, Y, A, G),
\]
but now \(A=(SC_A,\sqsubseteq_A)\) and \(G=(SC_G,\sqsubseteq_G)\) are lattices over sets of variables [2406.14374]. Algorithm 1 constructs a lattice \(\mathsf{SL}(M)\) from a flow relation \(M\) by deriving labels from loops, defining \(L_1 \sqsubseteq L_2\) whenever \(L_1 \times L_2 \subseteq M\), and then adding least-upper-bound labels until a bounded lattice is obtained [2406.14374]. Theorem 1 states that \(\mathsf{SL}(M)\) is a security lattice and is equivalent to the can-flow restrictions of \(M\); Theorem 2 states that translating back yields exactly the original flow relation:
\[
\mathsf{FR}(\mathsf{SL}(M), Z \times V) = M.
\]
Under natural structural assumptions, Theorem 3 gives the converse reconstruction result for lattices [2406.14374].

The paper then states that composition and refinement for security lattice contracts are defined “directly from their counterpart in information-flow contracts,” and that “information-flow contracts, just as for information-flow interfaces, satisfy incremental design and independent implementability” [2406.14374]. IFR therefore persists unchanged under the move from flow-relation semantics to lattice semantics. This is significant because it aligns interface-based IFR with the Denning lineage of security lattices without requiring a new refinement calculus.

A plausible implication is that the lattice semantics makes IFR easier to integrate with existing IFC mechanisms—such as type systems and label-based analyses—while preserving the compositional refinement guarantees of interface theory.

## 4. Architectural and calculational refinement

A distinct line of work develops IFR directly at the level of information-flow architectures. “Using Architecture to Reason about Information Security” models an abstract architecture as \(\mathcal{A}=(D,\leadsto)\), a reflexive information-flow policy on domains, and extends it to filtered architectures
\[
\mathcal{A}=(D,\rightsquigarrow)
\]
with edges \(\flowstoin[f]{u}{v}\) labeled either by \(\top\) or a filter function name \(f\) [1409.0309]. The semantics is given by filtered transmission functions and \(fta_u\) terms that generalize \(ta_u\) from intransitive noninterference. FTA-compliance requires
\[
fta_u(\alpha)=fta_u(\alpha') \Rightarrow obs_u(\alpha)=obs_u(\alpha')
\]
for all domains \(u\) and traces \(\alpha,\alpha'\) [1409.0309].

Architectural refinement is then defined via mappings \(r:D_1\to D_2\). At the simplest level, \(\mathcal{A}_1 \sqsubseteq_r \mathcal{A}_2\) requires \(r\) to be surjective and to preserve flows:
\[
u \leadsto_1 v \Rightarrow r(u)\leadsto_2 r(v)
\]
[1409.0309]. For interpreted extended architectures, semantic refinement requires
\[
fta_{r(u)}^{\mathcal{A}_2^\circ}(\alpha)=fta_{r(u)}^{\mathcal{A}_2^\circ}(\beta)
\Rightarrow
fta_u^{\mathcal{A}_1^\circ}(\alpha)=fta_u^{\mathcal{A}_1^\circ}(\beta)
\]
for all \(u,\alpha,\beta\) [1409.0309]. Theorem 4.1 states that semantic refinement preserves FTA-compliance from the concrete architecture to its abstraction [1409.0309]. The paper further introduces T-refinement and strict refinement as more local sufficient conditions, and proves a chain of implications from strict refinement to T-refinement to semantic refinement, and hence to preservation of architectural security properties [1409.0309].

The same paper shows that epistemic security properties proved at the abstract level lift along refinement mappings. For formulas \(\phi\) over abstract domains, a syntactic pullback \(r^{-1}(\phi)\) replaces each group \(G\) by its preimage \(r^{-1}(G)\), and if the abstract architecture validates \(\phi\), then the refined architecture validates \(r^{-1}(\phi)\) [1409.0309]. This is IFR in a strong architectural sense: security is proved once at a coarse level and inherited by more detailed architectures.

“Refinement of Information Flow Architectures” develops a separate but related calculus for stepwise refinement of asynchronous communication architectures [1409.6932]. A component is \((n,I,O,B)\), where \(B:I\to\mathcal{P}(O)\) is a relation on timed communication histories. Systems have a glass-box view \(S=(I,O,C)\) and a black-box view
\[
[S] = (&\{\text{behav}.c \mid c \in C\})\;|\;{}_{O}^{I},
\]
where \(&\) is parallel composition with implicit feedback [1409.6932]. Architectural refinement is defined on black-box behavior:
\[
S \sqsubseteq S' \Leftrightarrow \forall i \in I : [S'](i) \subseteq [S](i)
\]
for systems with the same external interface [1409.6932].

The calculus includes rules for behavioral refinement of a component, adding and removing input/output channels, adding and removing components, expanding a component into a subarchitecture, folding a subarchitecture into a component, and behavioral refinement under global invariants [1409.6932]. Most structural rules preserve black-box behavior exactly; behavioral refinement yields proper refinement. This makes IFR a calculational discipline: internal information-flow structure may change substantially, provided the external behavior is preserved or narrowed.

The architecture paper and the calculus paper differ in semantic setting—FTA on domains with epistemic properties versus timed stream-processing architectures—but both embody IFR as a formally justified transition from coarse information-flow structure to finer one.

## 5. Security-preserving refinement for noninterference

Another major use of IFR concerns preservation of noninterference under implementation refinement. “Security Engineering in IIIf, Part II -- Refinement and Noninterference” addresses the classical refinement paradox in the Isabelle Insider and Infrastructure framework [2412.10949]. In IIIf, noninterference is formulated as a 2-run property using an indistinguishability relation indexed by an observer \(a\), with an explicit theorem stating that if two states are initially indistinguishable, then every transition of one can be matched by the other so as to preserve indistinguishability [2412.10949]. The paper shows that standard Kripke-structure refinement does not preserve this property: a refined “speed” component in the Flightradar example leaks high information through low-visible speed values [2412.10949].

The proposed solution generalizes Morgan’s shadow-based approach. For confidential components such as `critloc` and `critpos`, the framework introduces shadow components representing the set of values still possible from the attacker’s viewpoint. Initial shadows encode maximal ignorance, such as
```isabelle
shadow_critloc  = (λ(l,l'). {True, False})
shadow_critpos  = (λf. {x :: (location × location). True})
```
[2412.10949]. The invariant \(\sigma\) states that shadows do not shrink along transitions. The paper proves that this shadow invariant is equivalent to noninterference in the given setting [2412.10949].

IFR is then formulated through a refinement map \(E\) between abstract and concrete systems, together with shadow compatibility and injectivity conditions. The key theorem is:
```isabelle
theorem Security_preservation:
  A ⊑{E} C ⟹
  (∀s. Sha_A (E (C s)) = Sha_A (E s)) ⟹
  inj Sha_A ⟹
  σ_A ⟹ σ_C
```
which states that the abstract shadow invariant implies the concrete shadow invariant under the refinement hypotheses [2412.10949]. Combined with the shadow/noninterference equivalence, this yields information-flow-preserving refinement for infrastructures with actors, decentralization, and policies.

“Generalized Security-Preserving Refinement for Concurrent Systems” extends this preservation story to concurrent systems and potentially intransitive policies [2511.06862]. The system model is a state machine
\[
M = \langle S, A, step, s_0 \rangle
\]
with information-flow configuration
\[
Info = \langle D, \rightarrow, dom, \sim \rangle
\]
and unwinding conditions Local Respect (LR) and Step Consistency (SC) [2511.06862]. Intransitive noninterference is defined using \(sources\) and \(ipurge\), and Theorem 1 states that
\[
SC(M,Info) \wedge LR(M,Info) \Rightarrow NI(M,Info)
\]
[2511.06862].

The refinement relation of interest is
\[
(M_c, Info_c) \preceq (M_a, Info_a)
\]
meaning that LR and SC of the abstraction imply LR and SC of the concrete system [2511.06862]. A constructive sufficient condition is an unwinding-preserving simulation
\[
(M_c, Info_c)\; \xRightarrow[\alpha,\zeta]{}\; (M_a, Info_a),
\]
where \(\alpha\) is a state relation preserving indistinguishability and \(\zeta : A_c \to A_a \cup \{\tau\}\) maps each concrete step either to a silent step or to a matching abstract action with the same domain [2511.06862]. Theorem 2 states that such a simulation implies the security-preserving refinement relation [2511.06862]. The same paper develops a compositional rely-guarantee version for concurrent components and applies it to ARINC 653 multicore IPC and a sealed-bid auction [2511.06862].

These two papers instantiate IFR as preservation of hyperproperties across abstraction layers. The common structure is that plain functional refinement is insufficient; one needs a refinement notion that preserves epistemic indistinguishability, unwinding conditions, or shadow ignorance.

## 6. Proof-level and directed-information refinements

In hardware verification, IFR appears as refinement of relational proof obligations. “Guarded Equivalence Predicates for Scalable Formal Hardware Information-Flow Verification” works in a self-composed hardware model where proving noninterference reduces to proving equality of low-observable outputs across two copies [2606.22063]. Existing PDR-based techniques use global cross-copy equivalence predicates \(X_1=X_2\), but these are often too coarse: many equalities are valid only in a control phase, transaction window, loop state, or protocol region [2606.22063].

The paper introduces guarded equivalence predicates of the form
\[
g \Rightarrow \mathit{eq}_X,
\]
where \(\mathit{eq}_X \equiv (X_1 = X_2)\) and the violating region is
\[
V(g,X) = g \wedge \mathit{neq}_X
\]
with \(\mathit{neq}_X \equiv (X_1 \neq X_2)\) [2606.22063]. Rather than assuming \(g \Rightarrow \mathit{eq}_X\), the verifier submits \(V(g,X)\) as an auxiliary blocking obligation; only if PDR proves that region unreachable does the guarded equality influence the proof [2606.22063]. Candidate guards are extracted from relational counterexamples-to-induction using CTI-local extraction and state-split search [2606.22063].

Across 12 IFV benchmarks and two backends, guarded predicates “convert two contextual baseline timeouts into completed proofs within 34.2--89.5s under an 1800s limit, while reducing proof time by up to 10.8x on additional benchmarks” [2606.22063]. Here IFR is not a refinement of the policy itself but of the inductive invariants used to prove the policy: a global invariant \(X_1=X_2\) is refined into a contextual invariant \(g \Rightarrow (X_1=X_2)\).

A very different but conceptually related refinement appears in “Co-evolution of bar and spiral arms in TNG50 simulations using Information Theory” [2606.16403]. There, the authors describe a hierarchy from static association to directional influence: MI is used first,
\[
I(X;Y) = H(X) + H(Y) - H(X,Y),
\]
with normalized form
\[
\mathrm{NMI}(X;Y) = \frac{2\,I(X;Y)}{H(X)+H(Y)},
\]
to establish a strong association between bar and spiral parameters [2606.16403]. Then Transfer Entropy
\[
T_{J\to I} = \sum p(i_{n+1}, i_n^{(k)}, j_n^{(l)})\, \log \frac{p(i_{n+1} \mid i_n^{(k)}, j_n^{(l)})}{p(i_{n+1} \mid i_n^{(k)})}
\]
with first-order embedding \(k=l=1\), Freedman–Diaconis binning, shuffled bias correction, and windowing is used to refine that association into direction-specific dynamic coupling [2606.16403]. Liang’s information flow rate
\[
T_{J \to I} = \frac{C_{II}\, C_{IJ}\, C_{J,dI} - C_{IJ}^2\, C_{I,dI}}
{C_{II}^2\, C_{JJ} - C_{II}\, C_{IJ}^2}
\]
and its normalized form
\[
\tau_{J\to I} = \frac{T_{J\to I}}{Z}
\]
then provide a continuous-time, covariance-based directional measure that decomposes the receiver’s entropy-rate budget into transfer, intrinsic, and noise terms [2606.16403].

The paper explicitly calls this a “hierarchical refinement of information flow diagnostics”: from static, symmetric MI to dynamic, nonparametric, directed TE, and finally to model-based IFR with entropy-rate decomposition [2606.16403]. Although this is outside computer security, it exemplifies the same methodological intuition: refine an initial information-flow notion until the desired granularity of directionality and mechanism is reached.

## 7. Synthesis, common themes, and limits

Across these literatures, IFR consistently serves four functions.

First, it resolves mismatch between abstraction level and security claim. Size-consistent QIF refines an unbounded metric into one bounded by secret size [1206.0886]. Architectural IFR refines abstract domain graphs into detailed filtered architectures while preserving epistemic guarantees [1409.0309]. Interface IFR refines system requirements into component assumptions and guarantees while retaining compositionality [2002.06465], [2406.14374]. Security-preserving refinement in IIIf and concurrent systems refines abstract secure models into concrete implementations without triggering the refinement paradox [2412.10949], [2511.06862].

Second, it enables compositional reasoning. Channel refinement and operator algebra support modular leakage reasoning but also reveal limits of monotonicity [1801.08090]. Interface and lattice contracts explicitly support incremental design and independent implementability [2002.06465], [2406.14374]. Architectural refinement supports top-down development by abstraction of information-security proofs [1409.0309]. Stream-based architectural calculi support local transformation rules justified by black-box refinement [1409.6932].

Third, it sharpens semantics. In metric QIF, refinement improves interpretability [1206.0886]. In astrophysical information theory, it sharpens undirected association into directional coupling [2606.16403]. In hardware verification, it sharpens global equalities into contextual guarded equalities [2606.22063]. In concurrent-system verification, it sharpens plain simulation into a step-mapping discipline that respects policy-relevant domains and unwinding conditions [2511.06862].

Fourth, it makes explicit the conditions under which refinement is security-preserving. These conditions vary sharply across domains: post-processing in channel models [1801.08090], shadow compatibility and injectivity in IIIf [2412.10949], observer and action matching in machine refinement [1509.06503], or strict/T-/semantic refinement mappings in architecture theory [1409.0309]. This suggests that IFR is never purely syntactic. Its soundness depends on a semantic account of what counts as the same or less information.

The main limitation of IFR as a general concept is precisely its heterogeneity. The papers do not present a single, domain-independent calculus. Some frameworks are possibilistic and hyperproperty-oriented [2002.06465], [1409.0309], [2412.10949], [2511.06862]; others are quantitative [1206.0886], [1801.08090]; others are proof-engineering techniques [2606.22063]; still others are not security papers at all [2606.16403]. This suggests that “Information Flow Refinement” is best treated as a research program centered on refinement-based control of information-flow semantics rather than as a single formal definition.

A plausible implication is that future unification would require an explicit cross-domain account of refinement that can encompass hyperproperties, quantitative leakage, lattice semantics, and proof obligations simultaneously. The current literature instead offers a toolkit of domain-specific IFR mechanisms, each tightly aligned with its semantic setting and preservation theorem.

Source: https://www.emergentmind.com/topics/information-flow-refinement-ifr