Sufficient and necessary causation are dual
SSufficient and necessary causation are dual
Robert K¨unnemann
CISPA, Saarland UniversitySaarland Informatics Campus
Abstract
Causation has been the issue of philosophic de-bate since Hippocrates. Recent work definesactual causation in terms of Pearl/Halpern’scausality framework, formalizing necessarycauses (IJCAI’15). This has inspired causal-ity notions in the security domain (CSF’15),which, perhaps surprisingly, formalize sufficientcauses instead. We provide an explicit relationbetween necessary and sufficient causes.
Notation
Let N be the set of natural numbers and as-sume that they begin at 0. r r v ÞÑ val s : “ p r zp v, r p v qqq Yp v, val q is short-hand for the function mapping v to val and otherwise behaving like r . We write (cid:126)t for a sequence t , . . . , t n if n is clear from the context and denote the i th element with (cid:126)t | i . We use (cid:126)a ¨ (cid:126)b to denote concatena-tion of vectors (cid:126)a and (cid:126)b . We filter a sequence l by a set S , denoted l | S , by removing each element that is not in S . We review the causal framework introduced by Pearl andHalpern [Pearl, 2000; Halpern, 2015], also known as the structural equations model , which provides the notion ofcausality which we will investigate for the case of se-curity protocols. The causality framework models howrandom variables influence each other. The set of ran-dom variables is partitioned into a set U of exogenous variables, variables that are outside the model, e.g., inthe case of a security protocol, the attack the adversarydecides to mount, and a set V of endogenous variables,which are ultimately determined by the value of the ex-ogenous variables. We call the triple consisting of U , V and function R associating a range to each variable Y P U Y V a signature . A causal model on this signa-ture defines the relation between endogenous variablesand exogenous variables or other endogenous variablesin terms of a set of functions. Definition 1 (Causal model) . A causal model M overa signature S “ p U , V , R q is a pair of said signature S and a set of functions F “ t F X u X P V such that, for each X P V , F X : p ą U P U R p U qq ˆ p ą Y P V zt X u R p Y qq Ñ R p X q Each causal model subsumes a causal network , a graphwith a node for each variable in V , and an edge from X to Y iff F Y depends on X . If the causal graph associatedto a causal model M is acyclic, then each setting (cid:126)u of thevariables in U provides a unique solution to the equationsin M . All causal models we will derive in this paper havethis property. We call a vector setting the variables in U a context , and a pair p M, (cid:126)u q of a causal model and asetting a situation .As hinted at in the introduction, the definition ofcausality follows a counterfactual approach, which re-quires to answer ‘what if’ questions. Definition 2 (Modified causal model) . Given a causalmodel M “ pp U , V , R q , F q , we define the modified causalmodel M (cid:126)X Ð (cid:126)x over the signature S (cid:126)X “ p U , V z (cid:126)X, R | V z (cid:126)X q by setting the values of each variable in (cid:126)X to the corre-sponding element (cid:126)x in each equation F Y P F , obtaining F (cid:126)X Ð (cid:126)x . Then, M (cid:126)X Ð (cid:126)x “ p S (cid:126)X , F (cid:126)X Ð (cid:126)x q . Definition 3 (Causal formula) . A causal formula hasthe form r Y Ð y , . . . , Y n Ð y n s ϕ (abbreviated r (cid:126)Y Ð (cid:126)y s ϕ ), where • ϕ is a boolean combination of primitive events, i.e.,formulas of form X “ x for X P V , x P R p X q , • Y , . . . , Y n P V Y U distinct, • y i P R p Y i q .We write p M, (cid:126)u q ( r (cid:126)Y Ð (cid:126)y s ϕ if the (unique) solution tothe equations in M (cid:126)Y Ð (cid:126)y in the context (cid:126)u is an element of ϕ . Furthermore, we allow intervention on exogenous vari-ables. This is equivalent to a modification of the context: p M, (cid:126)u q $ r U i Ð u i s ϕ equals p M, p (cid:126)u | i ´ ¨ u i ¨ (cid:126)u | i ` n qq $ ϕ .We review Halpern’s modification [Halpern, 2015] ofPearl and Halpern’s definition of actual causes [Halpernand Pearl, 2013]. a r X i v : . [ c s . A I] O c t efinition 4 (actual cause+ necessary cause) . (cid:126)X “ (cid:126)x isa (minimal) actual cause of ϕ in p M, (cid:126)u q if the followingthree conditions hold.AC1. p M, (cid:126)u q ( p (cid:126)X “ (cid:126)x q ^ ϕ .AC2. There is a set of variables (cid:126)W and a setting (cid:126)x ofthe variables in (cid:126)X such that if p M, (cid:126)u q ( p (cid:126)W “ (cid:126)w q ,then p M, (cid:126)u q ( r (cid:126)X Ð (cid:126)x , (cid:126)W Ð (cid:126)w, s(cid:32) ϕ .AC3. (cid:126)X is minimal: No strict subset (cid:126)X of (cid:126)X satisfiesAC1 and AC2.We say (cid:126)X is an actual cause for ϕ if this is the casefor some (cid:126)x . For a weaker AC2 as follows, we speak of a(minimal) necessary causeNC2. There exists (cid:126)x such that p M, (cid:126)u q ( r (cid:126)X Ð (cid:126)x s(cid:32) ϕ . The major difference underlying actual causesaccording to DGKSS [Datta et al. , 2015] andPearl/Halpern [Halpern, 2015] is that the formerconsiders sufficient rather than necessary causes. Wetransfer this concept to Pearl’s causation framework asfollows.
Definition 5 (sufficient cause) . Sufficient causes are de-fined like actual causes (see Definition 4), but with AC2modified as follows: SF2. For all (cid:126)z , p M, (cid:126)u q ( r V z (cid:126)X Ð (cid:126)z s ϕ . In this section, we show that sufficient causes and nec-essary causes (Definition 4) are dual to each other, andthat sufficient causes are in fact preferable, as they havea clearer interpretation of what constitutes a part of acause.While several formalisations of sufficient causes wereproposed [Datta et al. , 2015; G¨ossler and Le M´etayer,2013], so far they were never related to necessary causes.Strongest necessary conditions and weakest sufficientconditions in propositional logic are known to be dualto each other, however, sufficient and necessary causesare first-order predicates, and there is no such result infirst-order logic. Even defining these notions is problem-atic [Lin, 2001].We fix some finite set V res Ă V and some ordering t V , . . . , V n u “ V res . We will see in the next sectionwhy this restriction is useful. Let X denote the bit-string representation of X Ď V res relative to V res , i.e., X ¨¨“ p X p V q , . . . , X p V n qq . We can now represent theset of necessary causes, or more generally, any set of setsof variables X “ X , . . . , X m , as a boolean formula indisjunctive normal form (DNF) that is true whenever X is the bitstring representation of X Ď V res such that X P X . p X “ X _ x “ X _ ¨ ¨ ¨ _ X “ X m q , where X “ X i is a conjunction Ź j P N n X | j “ X i | j . If (cid:126)X “ (cid:126)x is an actual cause under contingency (cid:126)W “ (cid:126)w ,then (cid:126)X ¨ (cid:126)W “ (cid:126)x ¨ (cid:126)w is a necessary cause. Hence actual causesare parts of necessary causes. Theorem 1 (sufficient and necessary causes) . For X the set of (not necessarily minimal) necessary causes,let X be the DNF representation of X . Then the set of(not necessarily minimal) sufficient causes is representedby Y , which is obtained from X by transforming X intoCNF and switching _ and ^ . The same holds for theother direction.Proof. By Definition 4, NC2, we can rephrase theassumption as follows: @ X. D x . p M, (cid:126)u q ( r X Ð x s(cid:32) ϕ ðñ X P X . Now the right-hand side is equiva-lent to p X “ X q _ ¨ ¨ ¨ _ p X “ X m q . This is a booleanfunction over t , u n . As any boolean function can betransformed into canonical CNF, the right-hand side canbe expressed as c ^ ¨ ¨ ¨ ^ c k with conjuncts c i of form Ž j P N n p(cid:32)q X | j . @ X.c ^ ¨ ¨ ¨ ^ c k ðñ D x . p M, (cid:126)u q ( r X Ð x s(cid:32) ϕ Now we can negate both sides of the implication. @ X. (cid:32) c _ ¨ ¨ ¨ _ (cid:32) c k ðñ @ x . p M, (cid:126)u q ( r X Ð x s ϕ. We rename X to Z and x to z . Let t b { a u denote b literally replacing a . @ Z. (cid:32) c ! Z { X ) _ ¨ ¨ ¨ _ (cid:32) c k ! Z { X ) ðñ @ z . p M, (cid:126)u q ( r Z Ð z s ϕ We can replace Z by X “ V res z Z , as Z ÞÑ V res z Z is isa bijection between the domain of Z and the domain of X . Thus @ X. (cid:32) c ! (cid:32) X { X ) _ ¨ ¨ ¨ _ (cid:32) c k ! (cid:32) X { X ) ðñ @ z . p M, (cid:126)u q ( r V res z X Ð z s ϕ. As each conjunct c i is a disjunction, the negation of c i with X substituted by (cid:32) X can be obtained by switching _ and ^ . The resulting term is, again, a boolean formulain DNF, so X transforms into X easily. The reversedirection follows by first applying the above bijectionand renaming backwards, and then following the firstproof steps.To obtain the set of minimally sufficient causes fromthe set of minimally necessary causes, one saturates theformer by adding all non-minimal elements (pick an el-ement, and add its supersets by iteratively switching allzeros to ones until a fixed point is reached) and com-putes the set of (not-necessarily minimal) elements us-ing the above method. The conversion to CNF can beperformed via the Quine–McCluskey algorithm, which isthe obvious bottleneck in this computation. Finally, theresulting set representation can be minimised by remov-ing all elements X such that (cid:32) X ^ Y for some elementin Y (where (cid:32) and ^ are applied bitwise). ecessary sufficient Conj p , q p A q , p B q p A, B q Disj p , q p A, B q p A q , p B q Table 1: Comparison: set of all (minimal) necessary/-sufficient causes.
References [Datta et al. , 2015] Anupam Datta, Deepak Garg, Dil-sun Kaynar, Divya Sharma, and Arunesh Sinha. Pro-gram actions as actual causes: A building block foraccountability. In , pages 261–275. IEEE, 2015.[G¨ossler and Le M´etayer, 2013] Gregor G¨ossler andDaniel Le M´etayer. A General Trace-Based Frame-work of Logical Causality. In
FACS - 10th Interna-tional Symposium on Formal Aspects of ComponentSoftware - 2013 , Nanchang, China, 2013.[Halpern and Pearl, 2013] Joseph Y. Halpern and JudeaPearl. Causes and explanations: A structural-modelapproach — part 1: Causes.
CoRR , abs/1301.2275,2013.[Halpern, 2015] Joseph Y. Halpern. A modification ofthe halpern-pearl definition of causality. In QiangYang and Michael Wooldridge, editors,
Proceedingsof the Twenty-Fourth International Joint Conferenceon Artificial Intelligence, IJCAI 2015, Buenos Aires,Argentina, July 25-31, 2015 , pages 3022–3033. AAAIPress, 2015.[Lin, 2001] Fangzhen Lin. On strongest necessary andweakest sufficient conditions.
Artif. Intell. , 128(1-2):143–159, 2001.[Pearl, 2000] Judea Pearl.