Polymorphic Probabilistic Assertions

• Polymorphic probabilistic assertions are a family of generic frameworks defining assertion languages over probabilistic states, quantitative observables, and embedded sublogics.
• They enable modular reasoning in program verification by leveraging techniques like BI separation, weakest preexpectation, and resource-parametric ownership.
• Systems such as Ellora, PSL, and Amaryllis illustrate how these frameworks balance expressivity and abstraction to support both qualitative and quantitative analyses.

Polymorphic probabilistic assertions are not presented as a single standardized formalism in the cited literature. A plausible synthesis is that the term denotes assertion languages for probabilistic programs whose semantics and proof rules are generic over probabilistic states, quantitative observables, probabilistic resources, or embedded sublogics, rather than fixed to a single monomorphic store model. In that broader sense, the literature spans unary assertions interpreted as predicates on sub-distributions, expectation-valued quantitative assertions, BI assertions whose separating conjunction internalizes probabilistic independence, and resource-parametric assertions over indexed probabilistic resources (Barthe et al., 2018, Batz et al., 2020, Barthe et al., 2019, Lohse et al., 13 May 2026).

1. Semantic domains of probabilistic assertion languages

A central distinction in the area concerns what an assertion denotes semantically. In Ellora, assertions are predicates on sub-distributions over states: $$Assn \triangleq \mathcal{P}(\mathbf{D}(State)), \qquad \mu \models \eta \quad \text{iff} \quad \mu \in \eta.$$ Thus assertions are not predicates over single memories and not expectations themselves; they are predicates over probabilistic states $\mu$, where a probabilistic state is a sub-distribution over memories (Barthe et al., 2018).

The expectation-based line instead takes quantitative assertions to be functions from program states to nonnegative extended reals: $$\mathcal{E} = \{\, X \mid X\colon \Sigma \to \mathbb{R}_{\ge 0}^{\infty}\,\}.$$ These expectations are ordered pointwise,

$$X \preceq Y \qquad \text{iff} \qquad \forall \sigma \in \Sigma \colon\quad X(\sigma) \leq Y(\sigma),$$

and the resulting domain forms a complete lattice with least element $0$ and greatest element $\infty$. This choice is the basis for loop semantics via least fixed points (Batz et al., 2020).

PSL adopts the resource semantics of BI. Its worlds are pairs of partial deterministic stores and distributions over partial probabilistic memories: $$M = \{\, (\sigma,\mu) \mid \sigma \in [S],\ \mu \in \mathcal{D}([T]) \text{ for some } S,T \,\}.$$ The monoid operation combines deterministic stores by compatible union and probabilistic memories by product on disjoint domains. The preorder extends worlds by adding more deterministic and random variables while preserving existing values and laws via marginalization (Barthe et al., 2019).

Amaryllis moves to a richer probabilistic resource algebra parameterized by an underlying Iris-style resource algebra $M$: $\PSpAuth{M} \;\eqdef\; \PSpRA \times \rv{M} \times \moption(\PSpRA), \qquad \rv{M} := (\Rid \to \Bool) \to M.$ A world is roughly $(\psi, R, a)$, where $\mu$0 is a probability space over outcomes, $\mu$1 is an outcome-indexed resource, and $\mu$2 is optional authority. Propositions are upward-closed predicates over this structure with respect to an almost-sure resource order (Lohse et al., 13 May 2026).

These semantic choices induce different notions of assertional modularity. Ellora is distribution-oriented, the expectation calculus is observable-oriented, PSL is factorization-oriented, and Amaryllis is resource-parametric. This suggests that “polymorphism” in the area is better treated as a family resemblance among generic semantic designs than as a single formal feature.

2. Assertion forms and expressive power

Ellora’s concrete syntax is explicitly two-level. It distinguishes state expressions and assertions from probabilistic expressions and assertions: $\mu$3 Its assertion language therefore includes probabilities, expectations, arithmetic combinations of probabilistic quantities, first-order quantification, and the splitting connective $\mu$4. Representative derived forms include

$\mu$5

the law assertion

$\mu$6

and the direct encoding of independence

$\mu$7

This is a strong expressivity result because independence is a genuinely multi-probability property (Barthe et al., 2018).

The expectation language of the relatively complete verification framework is intensional rather than extensional. Its syntactic expectations are generated by

$\mu$8

The key result is closure under weakest preexpectation: if $\mu$9 is syntactically expressible, then $$\mathcal{E} = \{\, X \mid X\colon \Sigma \to \mathbb{R}_{\ge 0}^{\infty}\,\}.$$0 is syntactically expressible. This gives a robust baseline for quantitative assertions without introducing higher-order abstraction or polymorphic typing (Batz et al., 2020).

PSL uses BI formulas

$$\mathcal{E} = \{\, X \mid X\colon \Sigma \to \mathbb{R}_{\ge 0}^{\infty}\,\}.$$1

with atomic propositions such as $$\mathcal{E} = \{\, X \mid X\colon \Sigma \to \mathbb{R}_{\ge 0}^{\infty}\,\}.$$2, $$\mathcal{E} = \{\, X \mid X\colon \Sigma \to \mathbb{R}_{\ge 0}^{\infty}\,\}.$$3, and deterministic predicates. Its assertional emphasis is qualitative: uniformity, equality on support, and independence via separation (Barthe et al., 2019).

Amaryllis adds primitive distribution assertions

$$\mathcal{E} = \{\, X \mid X\colon \Sigma \to \mathbb{R}_{\ge 0}^{\infty}\,\}.$$4

the “sure” modality

$$\mathcal{E} = \{\, X \mid X\colon \Sigma \to \mathbb{R}_{\ge 0}^{\infty}\,\}.$$5

and outcome-indexed ownership

$$\mathcal{E} = \{\, X \mid X\colon \Sigma \to \mathbb{R}_{\ge 0}^{\infty}\,\}.$$6

When $$\mathcal{E} = \{\, X \mid X\colon \Sigma \to \mathbb{R}_{\ge 0}^{\infty}\,\}.$$7 is instantiated with the authoritative heap RA, points-to is lifted branchwise: $$\mathcal{E} = \{\, X \mid X\colon \Sigma \to \mathbb{R}_{\ge 0}^{\infty}\,\}.$$8 A derived assertion combines ownership and distribution: $$\mathcal{E} = \{\, X \mid X\colon \Sigma \to \mathbb{R}_{\ge 0}^{\infty}\,\}.$$9 The separation between branchwise ownership and probabilistic law is deliberate and is needed for frame-preserving specifications of allocation (Lohse et al., 13 May 2026).

3. Independence, separation, and conditioning

In PSL, the probabilistic interpretation of separating conjunction is exact factorization. For product distributions,

$$X \preceq Y \qquad \text{iff} \qquad \forall \sigma \in \Sigma \colon\quad X(\sigma) \leq Y(\sigma),$$0

and, for BI worlds,

$$X \preceq Y \qquad \text{iff} \qquad \forall \sigma \in \Sigma \colon\quad X(\sigma) \leq Y(\sigma),$$1

Specialized to probabilistic memories, this means that the joint distribution factors into independent components over disjoint variable sets. Consequently,

$$X \preceq Y \qquad \text{iff} \qquad \forall \sigma \in \Sigma \colon\quad X(\sigma) \leq Y(\sigma),$$2

but not conversely. The distinction is operationally important because randomized conditionals are interpreted by conditioning and convex combination, so preservation of framed assertions requires independence rather than mere syntactic disjointness (Barthe et al., 2019).

Ellora also internalizes probabilistic splitting, but by a different connective: $$X \preceq Y \qquad \text{iff} \qquad \forall \sigma \in \Sigma \colon\quad X(\sigma) \leq Y(\sigma),$$3 This operator is central to its conditional rule, where the incoming sub-distribution is split according to the guard and the outputs are recombined: $$X \preceq Y \qquad \text{iff} \qquad \forall \sigma \in \Sigma \colon\quad X(\sigma) \leq Y(\sigma),$$4 This is not separation logic in the BI sense, but it is a related decomposition principle over sub-distributions (Barthe et al., 2018).

Amaryllis internalizes independence at the probability-space level and ordinary separation at the resource level. Its probability-space RA composes by independent product,

$$X \preceq Y \qquad \text{iff} \qquad \forall \sigma \in \Sigma \colon\quad X(\sigma) \leq Y(\sigma),$$5

while the full probabilistic resource algebra composes branchwise: $$X \preceq Y \qquad \text{iff} \qquad \forall \sigma \in \Sigma \colon\quad X(\sigma) \leq Y(\sigma),$$6 Thus independence lives in the probabilistic fragment, whereas disjointness of heaps or ghost fragments is required only within each outcome: $$X \preceq Y \qquad \text{iff} \qquad \forall \sigma \in \Sigma \colon\quad X(\sigma) \leq Y(\sigma),$$7 This branchwise lifting is the key to harmonizing dynamic allocation with independence and conditioning (Lohse et al., 13 May 2026).

Conditioning in Amaryllis is primitive: $$X \preceq Y \qquad \text{iff} \qquad \forall \sigma \in \Sigma \colon\quad X(\sigma) \leq Y(\sigma),$$8 The logic also provides an equivalent axiomatic characterization in terms of a random variable $$X \preceq Y \qquad \text{iff} \qquad \forall \sigma \in \Sigma \colon\quad X(\sigma) \leq Y(\sigma),$$9 distributed as $0$0, together with branchwise conditioned assertions. Because authority cannot in general be pushed unchanged into conditioned branches, Amaryllis splits the expected frame principle into $0$1-frame for conditioning-frameable assertions and $0$2-auth for authoritative state. This is a precise response to the measurability and global-knowledge problems created by conditioning (Lohse et al., 13 May 2026).

A recurring theme is that conditioning is where naive formulations of probabilistic framing fail. The literature therefore treats independence not as an optional convenience but as the structural invariant that makes modular probabilistic reasoning possible.

4. Genericity, parameterization, and the limits of true polymorphism

The strongest direct sense in which the surveyed work approaches polymorphism is semantic or resource-parametric genericity rather than type-theoretic polymorphism.

System	Assertion domain	Polymorphism-adjacent feature
Ellora	Predicates on $0$3	Generic over $0$4, $0$5, symbols, and embedded sublogics
Syntactic expectations	Functions $0$6	Closure under $0$7 inside one first-order syntax
PSL	BI assertions over probabilistic worlds	Footprint-local and resource-semantic reuse via $0$8
Amaryllis	Predicates over $0$9	Parametric in an underlying Iris-style resource algebra $\infty$0

Ellora explicitly does not introduce true type polymorphism. There is no System F–style quantification over types, no polymorphic assertion constructors indexed by type variables, and no explicit parametricity theorem. What it does provide is genericity over the typed program state space $\infty$1, sets of operators $\infty$2, function symbols, distribution symbols, and arbitrary assertions $\infty$3. Its concrete language is many-sorted, supports first-order quantification over values, and uses indexed families of assertions $\infty$4 in loop and adversary rules. It also supports modular embeddings of specialized logics, notably IL for independence and distribution laws and aHL for union-bound reasoning (Barthe et al., 2018).

The expectation language of the relatively complete verification framework is an instructive counterpoint. It is many-sorted only in a simple sense, with variables ranging over nonnegative rationals, Boolean expressions over truth values, and expectations over $\infty$5. The paper is explicit about what is absent: no type variables, no higher-order assertion operators, no parametricity principle, no modular abstraction over state shape, and no reusable typed assertion combinators at the object-language level. It is therefore a monomorphic, first-order, expectation-based assertion language, even though it is highly expressive and closed under $\infty$6 (Batz et al., 2020).

PSL does not discuss polymorphism in the type-theoretic sense either, but it does exhibit what the paper characterizes as semantically generic BI structure. The connectives come from abstract BI resource semantics, the restriction lemma ensures that a formula depends only on the variables it mentions,

$\infty$7

and the frame rule supports reuse in larger independent probabilistic contexts. This suggests a form of footprint-polymorphism: the same assertion schema can be instantiated over different probabilistic footprints without changing its meaning (Barthe et al., 2019).

Amaryllis provides the clearest resource-parametric contribution. The entire model is generic in an underlying Iris-style resource algebra $\infty$8. Ordinary composition in $\infty$9 is lifted pointwise over outcomes; ordinary ownership becomes ownership of a random resource variable; ordinary frame-preserving updates on $$M = \{\, (\sigma,\mu) \mid \sigma \in [S],\ \mu \in \mathcal{D}([T]) \text{ for some } S,T \,\}.$$0-resources lift to probabilistic frame-preserving updates. This is a strong form of resource-parametricity, but the paper is equally explicit about what it does not yet provide: no step-indexing, no higher-order ghost state, no concurrency or invariants as in full Iris, finite support only, and discrete distributions only (Lohse et al., 13 May 2026).

A common misconception is to equate these genericity results with full-blown polymorphism. The surveyed systems support abstract state parameters, assertion schemas, or resource-parametric lifting, but they do not provide type-parameterized assertion operators of the form $$M = \{\, (\sigma,\mu) \mid \sigma \in [S],\ \mu \in \mathcal{D}([T]) \text{ for some } S,T \,\}.$$1 or a parametricity theorem guaranteeing uniform behavior across type instantiations.

5. Proof systems, weakest preconditions, and metatheory

Ellora is a Hoare logic whose judgments have the form

$$M = \{\, (\sigma,\mu) \mid \sigma \in [S],\ \mu \in \mathcal{D}([T]) \text{ for some } S,T \,\}.$$2

Validity quantifies over every interpretation of adversarial procedures and every probabilistic state $$M = \{\, (\sigma,\mu) \mid \sigma \in [S],\ \mu \in \mathcal{D}([T]) \text{ for some } S,T \,\}.$$3: $$M = \{\, (\sigma,\mu) \mid \sigma \in [S],\ \mu \in \mathcal{D}([T]) \text{ for some } S,T \,\}.$$4 Its proof system contains basic command rules, a conditional rule based on $$M = \{\, (\sigma,\mu) \mid \sigma \in [S],\ \mu \in \mathcal{D}([T]) \text{ for some } S,T \,\}.$$5, local reasoning rules such as Split and Frame, a rule for adversaries, and four loop rules: $$M = \{\, (\sigma,\mu) \mid \sigma \in [S],\ \mu \in \mathcal{D}([T]) \text{ for some } S,T \,\}.$$6, $$M = \{\, (\sigma,\mu) \mid \sigma \in [S],\ \mu \in \mathcal{D}([T]) \text{ for some } S,T \,\}.$$7, $$M = \{\, (\sigma,\mu) \mid \sigma \in [S],\ \mu \in \mathcal{D}([T]) \text{ for some } S,T \,\}.$$8, and $$M = \{\, (\sigma,\mu) \mid \sigma \in [S],\ \mu \in \mathcal{D}([T]) \text{ for some } S,T \,\}.$$9. The logic proves soundness and relative completeness, using characteristic assertions $M$0 and the denotational semantics of sub-distribution transformers. The soundness and relative completeness of the abstract logic, without adversaries according to the implementation note, are mechanized in Coq (Barthe et al., 2018).

The expectation-based verification framework takes the $M$1 calculus itself as the proof-theoretic core: $M$2 Its defining equations include

$M$3

$M$4

$M$5

and

$M$6

Relative completeness is in Cook’s sense: apart from proving a single inequality between syntactic expectations, every correct verification condition can be reduced to the assertion theory (Batz et al., 2020).

PSL is a Hoare-style logic over BI assertions,

$M$7

with rules such as forward random sampling

$M$8

forward randomized assignment

$M$9

a randomized-conditional rule requiring separation from the guard, and a frame rule formulated in terms of read and write sets. The logic is sound, but the paper explicitly notes that it is not complete (Barthe et al., 2019).

Amaryllis adapts several Iris mechanisms to the probabilistic setting. Hoare triples are defined by weakest preconditions: $\PSpAuth{M} \;\eqdef\; \PSpRA \times \rv{M} \times \moption(\PSpRA), \qquad \rv{M} := (\Rid \to \Bool) \to M.$0 Its WP is defined over random expressions and uses a state interpretation combining the sure part of the probability space, branchwise authoritative global state, and authoritative probabilistic information. The logic validates rules such as bind, sampling, allocation, store, and load: $\PSpAuth{M} \;\eqdef\; \PSpRA \times \rv{M} \times \moption(\PSpRA), \qquad \rv{M} := (\Rid \to \Bool) \to M.$1

$\PSpAuth{M} \;\eqdef\; \PSpRA \times \rv{M} \times \moption(\PSpRA), \qquad \rv{M} := (\Rid \to \Bool) \to M.$2

The paper also reports full mechanization in Rocq and an Iris-based proof mode (Lohse et al., 13 May 2026).

Taken together, these systems show that the proof theory of probabilistic assertions can be organized around Hoare-style rules, backward expectation transformers, BI-style separation, or Iris-style weakest preconditions. What varies is not only the proof calculus but the semantic object over which assertions range.

6. Case studies, misconceptions, and research boundaries

The expressivity claims of the surveyed systems are grounded in case studies. Ellora verifies coupon collector using expectation assertions,

$\PSpAuth{M} \;\eqdef\; \PSpRA \times \rv{M} \times \moption(\PSpRA), \qquad \rv{M} := (\Rid \to \Bool) \to M.$3

pairwise independence constructions using explicit independence assertions, hypercube routing with high-probability bounds,

$\PSpAuth{M} \;\eqdef\; \PSpRA \times \rv{M} \times \moption(\PSpRA), \qquad \rv{M} := (\Rid \to \Bool) \to M.$4

and a PRP/PRF game with adversary using a parameterized invariant family

$\PSpAuth{M} \;\eqdef\; \PSpRA \times \rv{M} \times \moption(\PSpRA), \qquad \rv{M} := (\Rid \to \Bool) \to M.$5

Additional examples include vertex cover approximation, random walk termination and reachability, polynomial identity testing, and private running sums (Barthe et al., 2018).

PSL demonstrates its assertional style on information-theoretic cryptography: private information retrieval, oblivious transfer, secure multi-party addition, and simple oblivious RAM. These proofs are formulated in terms of high-level properties such as independence and uniformity, rather than numeric probability bounds. A representative principle is that fresh sampling yields a new independent resource: $\PSpAuth{M} \;\eqdef\; \PSpRA \times \rv{M} \times \moption(\PSpRA), \qquad \rv{M} := (\Rid \to \Bool) \to M.$6 The examples also reveal the framework’s emphasis: it is particularly effective for qualitative probabilistic structure (Barthe et al., 2019).

Amaryllis uses examples that mix probabilistic structure with heap structure, including a recursive uniform sampler, a Markov blanket example, and sorted linked lists with random elements. The sorted-list development is especially diagnostic because a deterministic heap predicate is reused unchanged and lifted probabilistically by conditioning. Representative specifications include

$\PSpAuth{M} \;\eqdef\; \PSpRA \times \rv{M} \times \moption(\PSpRA), \qquad \rv{M} := (\Rid \to \Bool) \to M.$7

and linked-list insert/delete specifications that combine $\PSpAuth{M} \;\eqdef\; \PSpRA \times \rv{M} \times \moption(\PSpRA), \qquad \rv{M} := (\Rid \to \Bool) \to M.$8 with $\PSpAuth{M} \;\eqdef\; \PSpRA \times \rv{M} \times \moption(\PSpRA), \qquad \rv{M} := (\Rid \to \Bool) \to M.$9. This is practical evidence for the claim that resource-parametric probabilistic assertions can support both probabilistic independence and dynamic heap reasoning (Lohse et al., 13 May 2026).

The limitations are equally important. Ellora is unary, not relational: it has no native judgment of the form

$(\psi, R, a)$0

and no native coupling assertion principle (Barthe et al., 2018). The expectation language is restricted to nonnegative expectations over a flat store of nonnegative rationals, forbids arbitrary product $(\psi, R, a)$1 in the surface syntax, and does not support nondeterminism, heaps, or richer type systems (Batz et al., 2020). PSL does not support direct quantitative reasoning about event probabilities or expectations and lacks quantifiers and a complete proof theory (Barthe et al., 2019). Amaryllis does not yet include step-indexing, higher-order ghost state, full invariants, concurrency, or non-discrete and infinite-support probability (Lohse et al., 13 May 2026).

A precise summary is therefore that the literature does not yet offer a fully type-polymorphic calculus of probabilistic assertions in the strong programming-languages sense. What it does provide are several mature substrates for such a development: predicates on sub-distributions, expressive first-order expectation languages closed under weakest preexpectation, BI connectives that treat independence as separation, and resource-parametric probabilistic ownership models that lift standard Iris reasoning to branch-indexed probabilistic resources. This suggests that any future theory of genuinely polymorphic probabilistic assertions will likely be assembled from these ingredients rather than invented ex nihilo.