\section{Conclusions}
\vspace{-.5\baselineskip}
We have presented an abstract learning framework for synthesis that encompasses several
existing techniques that use learning or counter-example guided inductive synthesis to
create objects that satisfy a specification.
We were motivated by abstract interpretation~\cite{cc77} and how it
gives a general framework and notation for verification; our formalism is an attempt at such a generalization
for learning-based synthesis. The conditions we have proposed that the abstract concept spaces, hypotheses spaces,
and sample spaces need to satisfy to define a learning-based synthesis domain seem to be cogent
and general in forming a vocabulary for such approaches. We have also addressed various strategies
for convergent synthesis that generalizes and extends existing techniques (again, in a similar
vein as to how widening and narrowing in abstract interpretation give recipes for building convergent
algorithms to compute fixed-points). We believe that the notation and general theorems herein
will bring more clarity, understanding, and reuse of learners in synthesis algorithms.

\subsection{Transfinite convergence}\label{sec:transfinite_convergence}
From Lemma~\ref{lem:progress-honesty} one can conclude that the
transfinite sequence of hypotheses constructed by the learner
converges to a target set.

\begin{theorem} \label{the:transfinite-convergence}
Let $\mathcal{S}$ be a complete sample lattice, $\mathcal{T}$ be realizable,
$\lambda$ be a consistent learner, and $\tau$ be a teacher. Then
there exists an ordinal $\alpha$ such that
$\lambda(S_{\tau,\lambda}^\alpha) \in \mathcal{T}$.
\end{theorem}
\begin{proof}
Let $\alpha$ be an ordinal with cardinality bigger than $|\mathcal{H}|$
(bigger than $|\mathcal{S}|$ also works). If
$\lambda(S_{\tau,\lambda}^\beta) \not\in \mathcal{T}$ for all $\beta
< \alpha$, then Lemma~\ref{lem:progress-honesty}~(a) implies that all
$\lambda(S_{\tau,\lambda}^\beta)$ for $\beta < \alpha$ are
pairwise different, which contradicts the cardinality assumption. \qed
\end{proof}

The above theorem ratifies the
choice of our definitions, and the proof (relying on Lemma~\ref{lem:progress-honesty}) crucially uses all aspects of our
definitions (the honesty and progress properties of the teacher, the condition imposed on $\kappa$ in an ALF, the notion of consistent
learners, etc.).

Convergence in finite time is clearly the more desirable notion, and we
propose tactics for designing learners that converge in
finite time.
For an ALF instance $(\mathcal{A},\mathcal{T})$, we say that a learner
$\lambda$ \emph{converges for a teacher $\tau$} if there is an $n
\in \mathbb{N}$ such that $\lambda(S_{\tau,\lambda}^n) \in \mathcal{T}$,
which means that $\lambda$ produces a target hypothesis after $n$
steps. We say that $\lambda$ converges if it converges for every
teacher. We say that $\lambda$ converges from a sample $S$ in case
the learning process starts from a sample $S \not= \bot_\mathrm{s}$ (i.e., if
$S_{\lambda,\tau}^0 = S$).

\subsubsection{Finite hypothesis spaces}\label{sec:finite_hypothesis_space}
We first note that if the hypothesis space (or the concept
space) is finite, then any consistent learner converges: by Lemma~\ref{lem:progress-honesty}, the learner always
makes progress, and hence never proposes two hypotheses that
correspond to the same concept. Consequently,
the learner only produces a finite number of hypotheses before finding one
that is in the target (or declare that no such hypothesis exists).

There are several synthesis engines using learning that use finite hypothesis spaces. For example, Houdini~\cite{houdini} is a learner of \emph{conjunctions} over a fixed finite set of predicates and, hence, has a finite hypothesis space. Learning decision trees over purely Boolean attributes (not numerical)~\cite{DBLP:books/mk/Quinlan93} is also convergent because of finite hypothesis spaces, and this extends to the ICE learning model as well~\cite{ICEML}. Invariant generation for arrays and lists using \emph{elastic QDAs}~\cite{CAVQDA} also uses a convergence argument that relies on a finite hypothesis space.

\subsubsection{Occam Learners}\label{sec:occam_learner}
We now discuss the most robust strategy we know for convergence, based on the Occam's razor principle. Occam's razor advocates parsimony or simplicity~\cite{sep_simplicity},
that the simplest concept/theory that explains a set of observations is better, as a virtue in itself.
There are several learning algorithms that use parsimony as a learning bias in machine learning
(e.g., \emph{pruning} in decision-tree learning~\cite{mitchell}), though the general applicability of Occam's razor
in machine learning as a sound means to generalize is debatable~\cite{DBLP:journals/datamine/Domingos99}.
We now show that in \emph{iterative} learning, following Occam's principle leads
to convergence in finite time. However, the role of \emph{simplicity} itself is not the technical
reason for convergence, but that there is \emph{some} ordering of concepts that biases the learning.

Enumerative learners are a good example of this. In enumerative learning, the
learner enumerates hypotheses in some order, and always conjectures the first
consistent hypothesis. In an iterative learning-based synthesis
setting, such a learner always converges on some target concept, if one exists, in finite time.

Requiring a total order of the hypotheses is in some situations too
strict. If, for example, the hypothesis space consists of
deterministic finite automata (DFAs), we could build a learner that
always produces a DFA with the smallest possible number of states that
is consistent with the given sample. However, the relation
$\preceq$ that compares DFAs w.r.t.\ their number of states is not
an ordering because there are different DFAs with the same number of
states.

In order to capture such situations, we work with a \emph{total
  quasi-order} $\preceq$ on $\mathcal{H}$ instead of a total
order. A quasi-order (also called preorder) is a transitive and
reflexive relation. The relation being total means that $H \preceq
H'$ or $H' \preceq H$ for all $H,H' \in \mathcal{H}$. The difference
to an order relation is that $H \preceq H'$ and $H' \preceq H$
can hold in a quasi-order, even if $H \not= H'$.

In analogy to enumerations, we require that each hypothesis has only
finitely many hypotheses ``before'' it w.r.t.\ $\preceq$, as
expressed in the following definition.

\begin{definition}
A \emph{complexity ordering} is a total quasi-order $\preceq$ such
that for each $x \in \mathcal{H}$ the set $\{y \in \mathcal{H} \mid y \preceq
x\}$ is finite.
\end{definition}

The example of comparing DFAs with respect to their number of states is such a
complexity ordering.

\begin{definition}
A consistent learner that always constructs a smallest hypothesis with
respect to a complexity ordering $\preceq$ on $\mathcal{H}$ is called an
\emph{$\preceq$-Occam learner}.
\end{definition}

\begin{example} \label{ex:complexity-ordering}
Consider $\mathcal{H} = \mathcal{C}$ to be the interval domain over the integers
consisting of all intervals of the form $[l,r]$, where $l,r \in
\mathbb{Z} \cup \{-\infty,\infty\}$ and $l \le r$.  We define $[l,r]
\preceq [l',r']$ if either $[l,r] = [-\infty,\infty]$ or
$\max\{|x| \mid x \in \{l,r\} \cap \mathbb{Z}\} \le \max\{|x| \mid
x \in \{l',r'\} \cap \mathbb{Z}\}$.  For example, $[-4,\infty]
\preceq [1,7]$ because $4 \le 7$.
This ordering $\preceq$ satisfies the property that for each
interval $[l,r]$ the set $\{[l',r'] \mid [l',r'] \preceq [l,r]\}$
is finite (because there are only finitely many intervals using
integer constants with a bounded absolute value). A standard
positive/negative sample $S= (P,N)$ with $P,N
\subseteq \mathbb{N}$ is consistent with all intervals that
contain the elements from $P$ and do not contain an element from $N$.
A learner that maps $S$ to an interval that uses integers with the
smallest possible absolute value (while being consistent with $S$) is
an $\preceq$-Occam learner. For example, such a learner would map
the sample $(P=\{-2,5\},N=\{-8\})$ to the interval
$[-2,\infty]$. \hfill{\tikz \draw (0, 0) -| +(1ex, 1ex);}
\end{example}

The next theorem shows that $\preceq$-Occam learners ensure
convergence in finite time.

\begin{theorem} \label{the:occam-learner}
If $\mathcal{T}$ is realizable and $\lambda$ is a $\preceq$-Occam
learner, then $\lambda$ converges.  Furthermore, the
learner converges to a $\preceq$-minimal target element.
\end{theorem}
\begin{proof}
Pick any target element $T \in \mathcal{H}$, which exists because
$\mathcal{T}$ is realizable. Since $\tau$ is honest,
$T \in \kappa(S_{\tau,\lambda}^n)$ for all $n$ by
Lemma~\ref{lem:progress-honesty}(b). Thus, on the iterated sample
sequence, a $\preceq$-Occam learner never constructs an element
which is strictly above $T$ w.r.t.\ $\preceq$. Since there are only
finitely many hypothesis that are not strictly above $T$, and since
the learner always makes progress according to
Lemma~\ref{lem:progress-honesty}, it converges to a target element in
finitely many steps, which itself does not have any other target
elements below, and thus is $\preceq$-minimal. \qed
\end{proof}

There are several existing algorithms in the literature that use such
orderings to ensure convergence. Several enumeration-based solvers are
convergent because of the ordering of enumeration (e.g., the
generic enumerative solver for SyGuS
problems~\cite{DBLP:conf/fmcad/AlurBJMRSSSTU13,DBLP:series/natosec/AlurBDF0JKMMRSSSSTU15}).
The invariant-generation ranging over conditional linear arithmetic
expressions described in~\cite{DBLP:conf/cav/0001LMN14} ensures
convergence using a total quasi-order based on the number of
conditionals and the values of the coefficients.  The learner uses
templates to restrict the number of conditionals and a
constraint-solver to find small coefficients for linear constraints.

\subsubsection{Convergence using Tractable Well Founded Quasi-Orders}
The third strategy for convergence in finite time that we propose is based on well
founded quasi-orders, or simply well-quasi-orders.
Interestingly, we know of no existing learning algorithms in the literature
that uses this recipe for convergence (a technique of similar flavor is used in \cite{Blum92}). We exhibit in this section a learning
algorithm for intervals and for conjunctions of inequalities of numerical attributes based on this recipe.
A salient feature of this recipe is that the convergence actually uses the
samples returned by the teacher in order to converge (the first two
recipes articulated above, on the other hand, would even guarantee convergence if the teacher
just replies yes/no when asked whether the hypothesis is in the target set).

A binary relation $\preceq$ over some set $X$ is a well-quasi-order if it is transitive and
reflexive, and for each infinite sequence $x_0,x_1,x_2, \ldots$ there
are indices $i < j$ such that $x_i \preceq x_j$. In other words, there
are no infinite descending chains and no infinite anti-chains for
$\preceq$.

\begin{definition}
Let $(\mathcal{A}, \mathcal{T})$ be an ALF instance with
$\mathcal{A} = (\mathcal{C}, \mathcal{H}, (\mathcal{S},\sqsubseteq_\mathrm{s},\sqcup,\bot_\mathrm{s}) , \gamma, \kappa)$. A subset of hypotheses $\mathcal{W} \subseteq \mathcal{H}$ is called
\emph{wqo-tractable} if
\begin{enumerate}[nosep]
\item there is a  well-quasi-order $\preceq_{\mathcal{W}}$ on
$\mathcal{W}$, and
\item for each realizable sample $S \in \mathcal{S}$ with
  $\kappa_\mathcal{H}(S) \subseteq \mathcal{W}$, there is some
  $\preceq_\mathcal{W}$-maximal hypothesis in $\mathcal{W}$ that is consistent with $S$.
\end{enumerate}
\end{definition}

\begin{example} \label{ex:wqo-tractable}
Consider again the example of intervals over $\mathbb{Z} \cup
\{-\infty, \infty\}$ with samples of the form $S = (P,N)$ (see
Example~\ref{ex:complexity-ordering}). Let $p \in \mathbb{Z}$ be a point
and let $\mathcal{I}_p$ be the set of all intervals that contain the
point $p$. Then, $\mathcal{I}_p$ is wqo-tractable with the standard
inclusion relation for intervals, defined by $[\ell,r] \subseteq [\ell',r']$
iff $\ell \ge \ell'$ and $r \le r'$. Restricted to intervals that
contain the point $p$, this is the product of two well-founded orders
on the sets $\{x \in \mathbb{Z} \mid x \le p\}$ and $\{x \in \mathbb{Z} \mid x \ge
p\}$, and as such is itself well-founded \cite[Theorem~2.3]{Higman52}.
 %
Furthermore, for each realizable sample $(P,N)$, there is a unique
maximal interval over $\mathbb{Z} \cup \{-\infty,\infty\}$ that
contains $P$ and excludes $N$. Hence, the two conditions of
wqo-tractability are satisfied.
(Note that this ordering on the set of \emph{all} intervals is not a well-quasi-order;
 the sequence $[-\infty, 0], [-\infty, -1], [-\infty, -2], \ldots$ witnesses this.) \hfill{\tikz \draw (0, 0) -| +(1ex, 1ex);}
\end{example}

On a wqo-tractable $\mathcal{W} \subseteq \mathcal{H}$ a learner can ensure
convergence by always proposing a maximal consistent hypothesis, as
stated in the following lemma.
\begin{lemma} \label{lem:wqo-tractable}
Let $\mathcal{T}$ be realizable, $\mathcal{W} \subseteq \mathcal{H}$ be wqo-tractable
with well-quasi-order $\preceq_\mathcal{W}$, and $S$ be a sample such that
$\kappa_\mathcal{H}(S) \subseteq \mathcal{W}$. Then, there exists a learner that
converges from the sample $S$.
\end{lemma}
\begin{proof}
For any sample $S'$ with $S \sqsubseteq_\mathrm{s} S'$, the set
$\kappa_\mathcal{H}(S')$ of hypotheses consistent with $S'$ is a
subset of $\mathcal{W}$. Therefore, there is some $\preceq_\mathcal{W}$-maximal element in
$\mathcal{W}$ that is consistent with $S'$. The strategy of the learner is to
return such a maximal hypothesis. Assume, for the sake of
contradiction, that such a learner does not converge from $S$ for some
teacher $\tau$.  Let $H_0,H_1, \ldots$ be the infinite sequence of
hypothesis produced by $\lambda$ and $\tau$ starting from $S$,
and let $S_0,S_1,S_2, \ldots$ be the corresponding sequence of samples
(with $S_0 = S$).  The well-foundedness of $\preceq_\mathcal{W}$ implies that
there are $i < j$ with $H_i \preceq_\mathcal{W} H_j$. However, $S_i \sqsubseteq_\mathrm{s} S_j$
because $S_j$ is obtained from $S_i$ by joining answers of the
teacher. Therefore, $H_j$ is also consistent with $S_i$
(Remark~\ref{rem:consistency-monotonic}). This contradicts the
choice of $H_i$ as a maximal hypothesis that is consistent with $S_i$. \qed
\end{proof}
As shown in Example~\ref{ex:wqo-tractable}, for each $p \in
\mathbb{Z}$, the set $\mathcal{I}_p$ of intervals containing $p$ is
wqo-tractable. Using this, we can build a convergent learner starting
from the empty sample $\bot_\mathrm{s}$. First, the learner starts by proposing the empty interval,
the teacher must either confirm that this is a target or return a positive example, that is, a point $p$
that is contained in every target interval. Hence, the set of hypotheses
consistent with this sample is wqo-tractable and the learner can
converge from here on as stated in Lemma~\ref{lem:wqo-tractable}.
In general, the strategy for the learner is to force in one step a sample $S$ such that the set $\kappa_\mathcal{H}(S) =
\mathcal{I}_p$ is wqo-tractable. This is generalized in the following
definition.

\begin{definition}
We say that an \emph{ALF is wqo-tractable} if there is a finite set
$\{H_1, \ldots, H_n\}$ of hypotheses such that $\kappa_\mathcal{H}(S)$
is wqo-tractable for all samples $S$ that are inconsistent with all
$H_i$, that is, $\kappa_\mathcal{H}(S) \cap
\{H_1, \ldots, H_n\} = \emptyset$.
\end{definition}

As explained above, the interval
ALF is wqo-tractable with the set $\{H_1, \ldots, H_n\}$ consisting
only of the empty interval.

Combining all the previous observations, we obtain convergence for
wqo-tractable ALFs.

\begin{theorem} \label{the:wqo-learner}
For every ALF instance $(\mathcal{A},\mathcal{T})$ such that $\mathcal{A}$ is wqo-tractable
and  $\mathcal{T}$ is realizable, there is a convergent learner.
\end{theorem}
\begin{proof}
A convergent learner can be built as follows. Let $\{H_1, \ldots,
H_n\}$ be the finite set of hypotheses from the definition of
wqo-tractability of an ALF.
\begin{itemize}
\item As long as the current sample is consistent with some $H_i$,
  propose such an $H_i$.

\item Otherwise, the current sample $S$ is such that
  $\kappa_\mathcal{H}(S)$ is wqo-tractable, and thus the learner
  can apply the strategy from Lemma~\ref{lem:wqo-tractable}. \qed
\end{itemize}
\end{proof}

\paragraph{A convergent learner for  conjunctive linear inequality
constraints.}  We have illustrated wqo-tractability for intervals in
Example~\ref{ex:wqo-tractable}. We finish this section by showing that
this generalizes to higher dimensions, that is, to the domain of
$n$-dimensional hyperrectangles in $(\mathbb{Z} \cup
\{-\infty,\infty\})^n$, which form the hypothesis space in this
example. Each such hyperrectangle is a product of intervals over
$(\mathbb{Z} \cup \{-\infty,\infty\})^n$.
Note that hyperrectangles can, e.g., be used to model
conjunctive linear inequality constraints over a set $f_1, \ldots, f_n:
\mathbb{Z}^d \rightarrow \mathbb{Z}$ of numerical
attributes.

The sample space depends on the type of target specification that we
are interested in. We consider here the typical sample space of
positive and negative samples (however, the reasoning below also works
for other sample spaces, e.g., ICE sample spaces that additionally
include implications). So, samples are of the form $S = (P,N)$,
where $P,N$ are sets of points in $\mathbb{Z}^n$ interpreted as
positive and negative examples (as for intervals, see
Example~\ref{ex:complexity-ordering}).

The following lemma provides the ingredients for building a convergent
learner based on wqo-tractability.
\begin{lemma}\label{lem:wqo-hyperrectangle}
\begin{enumerate}
\item For each realizable sample $S = (P,N)$, there are maximal
hyperrectangles that are consistent with $S$ (possibly more than one).
\item For each $p \in \mathbb{Z}^n$, the set $\mathcal{R}_p$ of
hyperrectangles containing $p$ is well-quasi-ordered by inclusion.
\end{enumerate}
\end{lemma}
\begin{proof}
For the first claim, note that for each increasing chain $R_0
\subseteq R_1 \subseteq \cdots$ of hyperrectangles that are all
consistent with $S$, the union $R := \bigcup_{i \ge 0} R_i$ is also a
hyperrectangle that is consistent with $S$. More precisely, if $R_i =
[l_1^i,r_1^i] \times \cdots \times [l_n^i,r_n^i]$, then $R = [l_1,r_1]
\times \cdots \times [l_n,r_n]$ with $l_j = \inf\{l_j^i \mid i \ge 0\}$
and $r_j = \sup\{r_j^i \mid i \ge 0\}$.

Furthermore, if the chain is strictly increasing, then there exists
$j$ such that $l_j = -\infty$ and all $l_j^i \not= -\infty$, or $r_j =
\infty$ and all $r_j^i \not= \infty$. Hence, if $R$ itself can be
extended again into an infinite strictly increasing chain, then the
union of this chain will contain an additional $\infty$ of
$-\infty$. This can happen at most $2n$ times before reaching the
hyperrectangle containing all points, which is certainly
maximal. Thus, there has to be a maximal hyperrectangle consistent
with $S$.

We now prove the second claim. For a point $p = (p_1, \ldots, p_n)$,
the set $\mathcal{R}_p$ is the product $\mathcal{R}_p =
\mathcal{I}_{p_1} \times \cdots \times \mathcal{I}_{p_n}$ of the sets
of intervals containing the points $p_i$.  Furthermore, the inclusion
order for hyperrectangles is the $n$-fold product of the inclusion
order for intervals. Thus, the inclusion order on $\mathcal{R}_p$ is a
well-quasi-order because it is a product of well-quasi-orders
\cite{Higman52}. \qed

\end{proof}

We conclude that the following type of learner is convergent: for
the empty sample, propose the empty hyperrectangle; for every
non-empty sample $S$, propose a maximal hyperrectangle consistent with
$S$.

\section{Synthesis Problems Modeled as ALFs}\label{sec:examples}
In this section, we list a host of existing synthesis problems and algorithms that can be seen as ALFs. Specifically, we consider examples from the areas of program verification and program synthesis.
We encourage the reader to look up the referenced algorithms to better understand their mapping into our framework.
Moreover, we have new techniques based on ALFs to compute fixed-points in the setting of abstract interpretation using learning.

\subsection{Program Verification} \label{subsec:program_verification}
While program verification itself does not directly relate to
synthesis, most program verification techniques require some form of
help from the programmer before the analysis can be
automated. Consequently, synthesizing objects that replace manual help
has been an area of active research. We here focus on \emph{learning
  loop invariants}. Given adequate
invariants (in terms of pre/post-conditions, loop invariants, etc.), the rest of the verification process can often be completely
automated~\cite{floyd,hoare} using logical constraint-solvers~\cite{z3,cvc4}.
For the purposes of this article, let us consider while-programs with a single loop. Given a pre- and post-condition, assertions, and contracts for functions called, the problem is to find a loop invariant that proves the post-condition and assertions (assuming the program is correct).

\subsubsection{Invariant synthesis using the ICE learning model}
Given a program with a single loop whose loop invariant we want to synthesize, there are \emph{many} inductive invariants that prove
the assertions in the program correct--- these invariants are characterized by the following three properties:
\begin{enumerate*}
	\item that it include the states when the loop is entered the first time,
	\item that it exclude the states that immediately exit the loop and reach the end of the program and not satisfy the post-condition, and
	\item that it is inductive (i.e., from any state satisfying the invariant, if we execute the loop body once, the resulting state is also in the invariant).
\end{enumerate*}
The teacher knows these properties, and must reply to conjectured hypotheses of the learner using these properties. Violation of properties (a) and (b) are usually easy to check using a constraint solver, and will result in a \emph{positive} and \emph{negative} concrete configuration as a sample, respectively. However, when inductiveness fails, the obvious counterexample is a \emph{pair} of configurations, $(x,y)$, where $x$ is in the hypothesis but $y$ is not, and where the program state $x$ evolves to the state $y$ across one execution of the loop body.

The work by Garg et.~al.~\cite{DBLP:conf/cav/0001LMN14} hence proposes what they call the \emph{ICE model} (for implication counterexamples), where the learner learns from positive, negative, and implication counterexamples. The author's claim is that without implication counterexamples, the teacher is stuck when presented a hypothesis that satisfies the properties of being an invariant save the inductiveness property.

From the described components we build an ALF $\mathcal{A}_{\mathrm{ICE}} =
(\mathcal{C}, \mathcal{H}, \gamma, \mathcal{S}, \kappa)$, where
$\mathcal{C}$ is the set of all subsets of program configurations, the hypothesis space $\mathcal{H}$ is the language used to describe the invariant, and the sample space is defined as follows:
\begin{itemize}
\item A sample is of the form $S = (P, N, I)$, where $P,N$ are sets of
  program configurations (interpreted as positive and negative
  examples), and $I$ is a set of pairs of program configurations
  (interpreted as implications).
\item A set $C \in \mathcal{C}$ of program configurations is consistent
  with $(P, N, I)$ if $P \subseteq C$, $N \cap C = \emptyset$, and if
  $(c,c') \in I$ and $c \in C$, then also $c' \in C$.
\item The order on samples is defined by component-wise set inclusion (i.e., $(P,N,I) \sqsubseteq_\mathrm{s} (P',N',I')$ if $P \subseteq P'$, $N \subseteq N'$, and $I \subseteq I'$).
\item The join is the component-wise union, and $\bot_\mathrm{s} = (\emptyset,\emptyset,\emptyset)$.
\end{itemize}
Since this sample space contains implications in addition to the standard positive and negative examples, we refer to it as an \emph{ICE sample space}.

We can now show that there is a teacher for these ALF instances, because
a teacher can refute any hypothesis made by a learner with a positive, negative,
or implication counterexample, depending on which property of invariants is violated.

\begin{proposition} \label{pro:ice-teacher}
There is a teacher for ALF instances of the form $(\mathcal{A}_{\mathrm{ICE}},
\mathcal{T}_{\mathit{Inv}})$.
\end{proposition}

Furthermore, we can show that having only positive and negative samples precludes the existence of teachers. In fact, we can show that if $\mathcal{C} = 2^D$ (for a domain $D$) and the sample space $\mathcal{S}$ consists of only positive and negative examples in $D$, then a target set $\mathcal{T}$ has a teacher only if it is defined in terms of excluding a set $B$ and including a set $G$.

\begin{lemma}
Let $C=H=2^D$, $\gamma = id$, $S = \{(P, N) \mid P, N \subseteq D \}$, and
$\kappa((P,N)) = \{ R \subseteq D \mid P \subseteq R \wedge R \cap N = \emptyset \}$.

Let $\mathcal{T} \subseteq C$ be a target. If there exists a teacher for $\mathcal{T}$,
then there must exists sets $B,G \subseteq D$ such that
$\mathcal{T} = \{ R \subseteq D \mid B \cap R = \emptyset \text{ and } G \subseteq R\}$.
\end{lemma}

\begin{proof}
 Assume that there exists a teacher for the target set $\mathcal{T}$, and let $G$ and $B$ be the union of all positive examples and the union of all negative examples, respectively, that the teacher returns. Now, we claim that $\mathcal{T} = \{ R \subseteq D \mid B \cap R = \emptyset \text{ and } R \subseteq G\}$. Towards a contradiction, assume that this is not the case. Then, there exists an $R \in \mathcal{T}$ such that $B \cap R \not = \emptyset$ or $G \not \subseteq R$. If $B \cap R \not = \emptyset$, then there is some $b \in R$ that was returned as a negative counterexample for some hypothesis. Since $R \in \mathcal{T}$ is not consistent with this negative example $b$, this contradicts the requirement that the teacher is honest. Similarly, if $G \not \subseteq R$, then there is some $g \in G$ that was returned as a positive counterexample, which contradicts the teacher's honesty.
\end{proof}

The above proves that positive and negative samples are not sufficient for learning invariants,
as invariants cannot be defined as all sets that exclude a set of states and include a set of states.\par\vskip\baselineskip

There are several ICE-based invariant synthesis formalisms that we can capture. First, Garg~et.~al.~\cite{DBLP:conf/cav/0001LMN14} have considered arithmetic invariants over a set of integer variables  $x_1, \ldots, x_\ell$ of the form $\bigvee_{i=1}^n \bigwedge_{j=1}^{m_i} \bigl( \sum_{k=1}^\ell a_k^{i,j} x_k \leq c^{i,j} \bigr)$, $a_k^{i, j} \in \{{-1}, 0, 1\}$, where the learner is implemented using a constraint solver that finds smallest invariants that fit the sample. This is accurately modeled in our framework, as in the ICE formulation above, with the hypotheses space being the set of all formulas of this form. The fact that Garg~et.~al.'s learner produces smallest invariants makes it an Occam learner in the sense of Section~\ref{sec:occam_learner} and, hence, it converges in finite time.
The approach proposed by Sharma and Aiken~\cite{DBLP:conf/cav/0001A14}, {\sc C2I}, is also an ICE-learner, except that the learner uses \emph{stochastic search} based on a Metropolis Hastings MCMC (Markov chain Monte Carlo) algorithm, which again can be seen as an ALF.

We can also see the work by Garg~et.~al.~\cite{CAVQDA} on synthesizing quantified invariants for linear data structures such as lists and arrays as ALFs. This framework can infer quantified invariants of the form
\[ \forall y_1, y_2 \colon (y_1 \leq y_2 \leq i) \Rightarrow a[y_1] \leq a[y_2]. \]
However, Garg~et.~al.\ do not represent sets of configurations by means of logical formulas (as shown above) but use an automata-theoretic approach, where a special class of automata, called \emph{quantified data automata (QDAs)}, represent such logical invariants; hence, these QDAs form the hypothesis space in the ALF. The sample space there is also unusual: a sample (modeling a program configuration consisting of arrays or lists) is a \emph{set of valuation words}, where each such word encodes the information about the array (or list) for specially quantified pointer variables pointing into the heap, and where data-formulas state conditions of the keys stored at these locations.

ALFs can also capture the ICE-framework described by Neider~\cite{daniel_phd}, where invariants are learned in the context of \emph{regular model-checking}~\cite{DBLP:conf/cav/BouajjaniJNT00}. In regular model checking, program configurations are captured using (finite---but unbounded---or even infinite) words, and sets of configurations are captured using finite automata. Consequently, the hypothesis space is the set of all DFAs (over an a~priori chosen, fixed alphabet), and the sample space is an ICE-sample consisting of configurations modeled as words. The learner proposed by Neider constructs consistent DFAs of minimal size and, hence, is an Occam learner that converges in finite time (cf.\ Section~\ref{sec:occam_learner}).
\par\vskip\baselineskip

We now turn to two other invariant-generation frameworks that skirt the ICE model.

\subsubsection{Houdini}
The Houdini algorithm~\cite{houdini} is a learning algorithm for synthesizing invariants that avoids learning from ICE samples.
Given a finite set of \emph{predicates} $P$, Houdini learns an invariant that is expressible as a conjunction of some subset
of predicates (note that the hypothesis space is finite but exponential in the number of predicates).
Houdini learns an invariant in time \emph{polynomial} in the number of predicates (and in linear number rounds) and
is implemented in the Boogie program verifier~\cite{boogie}. It is widely used
(for example, used in verifying device drivers~\cite{DBLP:conf/sigsoft/LalQ14,DBLP:conf/cav/LalQL12} and in race-detection in GPU kernels~\cite{DBLP:conf/oopsla/BettsCDQT12}.

The setup here can be modeled as an ALF: we take the concept space $\mathcal{C}$ to be all subsets of program configurations, and the hypothesis space $\mathcal{H}$ to be the set of all conjunctions of subsets of predicates in $P$, with the map $\gamma$ mapping each conjunctive formula in $\mathcal{H}$ to the set of all configurations that satisfy the predicates mentioned in the conjunction. We take the sample space to be the ICE sample space, where each sample is a valuation $v$ over $P$ (indicating which predicates are satisfied) and where implication counterexamples are pairs of valuations.

The Houdini learning algorithm itself is the classical conjunctive learning algorithm for positive and negative samples (see \cite{KearnsV94}), but its mechanics are such that it works for ICE samples as well. More precisely, the Houdini algorithm always creates the \emph{semantically smallest} formula that satisfies the sample (it hence starts with a conjunction of all predicates, and in each round ``knocks off'' predicates that are violated by positive samples returned). Since Houdini always returns the semantically-smallest conjunction of predicates, it will never receive a negative counterexample
(assuming the program is correct and has a conjunctive invariant over $P$). Furthermore, for an implication counterexample $(v,v')$, the algorithm knows that since it proposed the semantically smallest conjunction of predicates, $v$ cannot be made negative; hence it treats $v'$ as a positive counterexample. Houdini converges since the hypothesis space is finite (matching the first recipe for convergence we outlined in Section~\ref{sec:finite_hypothesis_space}); in fact, it converges in linear number of rounds since in each round at least one predicate is removed from the hypothesized invariant.

\subsubsection{Learning invariants in regular model-checking using witnesses}
The learning-to-verify project reported in~\cite{DBLP:conf/icfem/VardhanSVA04,DBLP:conf/fsttcs/VardhanSVA04,DBLP:conf/tacas/VardhanSVA05,DBLP:conf/kbse/VardhanV05} leverages machine learning to the verification of infinite state systems that result from processes with FIFO queues,
but skirts the ICE model using a different idea.
The key idea is to view the the identification of the reachable states of such a system as a machine learning problem instead of computing this set iteratively (which, in general, requires techniques such as acceleration or widening).
In particular, we consider the work of Vardhan~et.~al.~\cite{DBLP:conf/icfem/VardhanSVA04} and show that this is an instantiation of our abstract learning framework. The key idea in this work is to represent configurations as traces through the system and to add a notion of \emph{witness} to this description, resulting in so-called annotated traces. The teacher, when receiving a set of annotated traces, can actually check whether the configurations are reachable based on the witnesses (a witness can be, say, the length of the execution or the execution itself) and, consequently, the model allows learning from such traces directly.
Indeed, this approach can be modeled by an ALF: the concept space consists of subsets of configurations, the target space consists of the set of reachable configurations, the hypothesis space consists of automata over annotated traces, and the sample space consists of positive and negatively labeled annotated traces.

\subsection{Synthesis of Fixpoints in Abstract Domains}\label{subsec:abstract}
\input{ice-for-abstract-interpretation}

\subsection{Program Synthesis}
In this section, we study several examples of learning-based program synthesis, which include synthesizing program expressions,
expressions to be plugged in program sketches, snippets of programs, etc., and show how they can be modeled as ALFs.

\subsubsection{End-user synthesis from examples: Flashfill}
One application of synthesis is to use it to help end-users to program using examples. A prime example of this is \textsc{Flashfill} by Gulwani et al~\cite{DBLP:conf/popl/Gulwani11}, where the authors show how string manipulation macros from user-given input-output examples can be synthesized in the context of Microsoft Excel spreadsheets. Flashfill can be seen as an ALF: the concept space consists of all functions from strings to strings, the hypothesis space consists of all string manipulation macros, and the sample space consists of a sets of input-output examples for such functions. The consistency relation $\kappa$ maps each sample to all functions that agree with the sample. The role of the teacher is played by the \emph{user}: the user has some function in mind and gives new input-output examples whenever the learner returns a hypothesis that she is not satisfied with. The learning algorithm here is based on version-space algebras (which, intuitively, compactly represents \emph{all} possible macros with limited size that are consistent with the sample) and in each round proposes a simple macro from this collection.

\subsubsection{Completing sketches and the SyGuS solvers}
The sketch-based synthesis approach~\cite{armando_thesis} is another prominent synthesis application, where programmers write partial programs with holes and a system automatically synthesizes expressions or programs for these holes so that a specification (expressed using input-output pairs or logical assertions) is satisfied. The key idea here is that given a sketch with a specification, we need expressions for the holes such that \emph{for every possible input}, the specification holds. This roughly has the form
$\exists \vec{e}. \forall \vec{x} \psi (\vec{e}, \vec{x})$, where $\vec{e}$ are the expressions to synthesize and
$\vec{x}$ are the inputs to the program.

The Sketch system works by
\begin{enumerate*}
	\item unfolding loops a finite number of times, hence, bounding the length of executions, and
	\item encoding the choice of expressions $\vec{e}$ to be synthesized using bits (typically using templates and representing integers by a small number of bits).
\end{enumerate*}
For the synthesis step, the Sketch system implements a CEGIS (counterexample guided synthesis) technique using SAT solving, whose underlying idea is to learn the expressions from examples using only a SAT solver. The CEGIS technique works in rounds: the learner proposes hypothesis expressions and the teacher checks whether
$\forall \vec{x} \psi (\vec{e}, \vec{x})$ holds (using SAT queries) and if not, returns a valuation for $\vec{x}$ as a counterexample. Subsequently, the learner asks, again using a SAT query, whether there exists a valuation for the bits encoding the expressions such that $\psi (\vec{e}, \vec{x})$ holds for every valuation of $\vec{x}$ returned by the teacher thus far; the resulting expressions are the hypotheses for the next round. Note that the use of samples avoids quantifier alternation both in the teacher and the learner.

The above system can be modeled as an ALF. The concept space consists of tuples of functions modeling the various expressions to synthesize, the hypothesis space is the set of expressions (or their bit encodings), the map $\gamma$ gives meaning to these expressions (or encodings), and the sample space can be seen as the set of \emph{grounded formulae} of the form $\psi(\vec{e}, \vec{v})$ where the variables $\vec{x}$ have been substituted with a concrete valuation. The relation $\kappa$ maps such a sample to the set of all expressions $\vec{f}$ such that the formulas in the sample all evaluate to true if $\vec{f}$ is substituted for $\vec{e}$. The Sketch learner can be seen as a learner in this ALF framework that uses calls to a SAT solver to find hypothesis expressions consistent with the sample.
Since expressions are encoded by a finite number of bits, the hypothesis space is finite, and the Sketch learner converges in finite time (cf.\ Section~\ref{sec:finite_hypothesis_space}).

The SyGuS format~\cite{DBLP:conf/fmcad/AlurBJMRSSSTU13} is a competition format for synthesis, and extends the Sketch-based formalism above to SMT theories, with an emphasis on syntactic restrictions for expressions. More precisely, SyGuS specifications are parameterized over a background theory $T$, and an instance is a pair $(G, \psi(\vec{f}))$ where $G$ is a grammar that imposes syntactic restrictions for  functions (or expressions) written using symbols of the background theory, and $\psi$ is a formula, again in the theory $T$, including function symbols $\vec{f}$; the functions $\vec{f}$ are
typed according to domains of $T$. The goal is to find functions $\vec{g}$ for the symbols $\vec{f}$ in the syntax $G$ such that $\psi$ holds. The competition version further restricts $\psi$ to be of the form $\forall \vec{x} \psi'(\vec{f}, \vec{x})$ where $\psi'$ is a quantifier-free formula in a decidable SMT theory---this way, given a hypothesis for the functions $\vec{f}$, the problem of checking whether the functions meet the specification is decidable.

There have been several solvers developed for SyGuS (cf.\ the first SyGuS competition~\cite{DBLP:conf/fmcad/AlurBJMRSSSTU13,DBLP:series/natosec/AlurBDF0JKMMRSSSSTU15}), and all of them are in fact learning-based (i.e., CEGIS) techniques. In particular, three solvers have been proposed: an enumerative solver, a constraint-based solver, and a stochastic solver. All these solvers can be seen as ALF instances: the concept space consists of all possible tuples of functions over the appropriate domains and the hypothesis space is the set of all functions allowed by the \emph{syntax} of the problem (with the natural $\gamma$ relation giving its semantics). All three solvers work by generating a tuple of functions such that $\forall \vec{x} \psi'(\vec{f}, \vec{x})$ holds for all valuations of $\vec{x}$ given by the teacher thus far.
The enumerative solver enumerates functions until it reaches such a function, the stochastic solver searches the space of functions randomly using a measure that depends on how many samples are satisfied till it finds one that satisfies the samples, and the constraint-based solver queries a constraint-solver for instantiations of template functions so that the specification is satisfied on the sample valuations.
Both the enumerative and the constraint-solver are Occam learners and, hence, converge in finite time.

Note that the learners \emph{know} $\psi$ in this scenario. However, we can model SyGuS as ALFs by taking the sample space to be grounded formulas $\psi'(\vec{f}, \vec{v})$ consisting of the specification with particular values $\vec{v}$ substituted for $\vec{x}$. The learners can now be seen as learning from these samples, without knowledge of $\psi$ (similar to the modeling of Sketch above).

We would like to emphasize that this embedding of SyGuS as an ALF clearly showcases the difference between different synthesis approaches (as mentioned in the introduction). For example, invariant generation can be done using learning either by means of ICE samples (see Section~\ref{subsec:program_verification}) or modeled as a SyGuS problem. However, it turns out that the sample spaces (and, hence, the learners) in the two approaches are \emph{very different}! In ICE-based learning, samples are only single configurations (labeled positive or negative) or pairs of configurations, while in a SyGuS encoding, the samples are grounded formulas that encode the entire program body, including instantiations of universally quantified variables intermediate states in the execution of the loop.

\subsubsection{Machine-learning based approaches to synthesis}
One can implement the \emph{passive} machine-learning algorithm to synthesize hypotheses from samples, in order to build a synthesis engine (along with an appropriate teacher that can furnish such samples). Recent work by Garg et.~al.~\cite{ICEML} proposes an algorithm for synthesizing invariants in the ICE-framework using machine learning classifiers (decision trees) that can be viewed as an ALF.

\subsubsection{Synthesizing guarded affine functions}
Recent work~\cite{alchemist} explores the synthesis of \emph{guarded affine functions} from a sample space that consists of information of the form $f(\vec{s})=t$, where $\vec{s}$ and $\vec{t}$ are integers. The learner here uses a combination of computational geometry techniques and decision tree learning, and can also be modeled as an ALF. Notice that this sample space  precisely matches the sample space for deobfuscation problems
(where the teacher can return counterexamples of this form -- see Example at the end of Section~\ref{sec:alf} on page~\pageref{ex:deobfuscation} -- using the program being deobfuscated). Consequently, the
learner in Alchemist~\cite{alchemist} can be used for deobfuscating programs that compute guarded affine functions from tuples of integer inputs
to integers (like the ``multiply by 45'' example  in~\cite{DBLP:conf/icse/JhaGST10}).

\subsubsection{Other synthesis engines}
There are several algorithms that are self-described as CEGIS frameworks, and, hence, can be modeled using ALFs. For example, synthesizing loop-free programs~\cite{DBLP:conf/pldi/GulwaniJTV11}, synthesizing synchronizing code for concurrent programs~\cite{scheduling} (in this work, the sample space consists of abstract concurrent partially-ordered traces), work on using synthesis to \emph{mine specifications}~\cite{DBLP:conf/hybrid/JinDDS13}, synthesizing bit-manipulating programs and deobfuscating programs~\cite{DBLP:conf/icse/JhaGST10} (here, the use of separate I/O-oracle can be modeled as the teacher returning the output of the program together with a counterexample input), superoptimization~\cite{DBLP:conf/asplos/Schkufza0A13}, deductive program repair~\cite{DBLP:conf/cav/KneussKK15}, synthesis of recursive functional programs over unbounded domains~\cite{DBLP:conf/oopsla/KneussKKS13}, as well as synthesis of protocols using enumerative CEGIS techniques~\cite{DBLP:conf/pldi/UdupaRDMMA13}.

\section{Introduction}
\input{intro}

\section{Abstract Learning Frameworks for Synthesis} \label{sec:alf}
\input{alf}

\section{Convergence of iterative learning} \label{sec:convergence}
\input{convergence}

\input{examples}

\section{Variations and Limitations of the Framework} \label{app:variations}
\input{variations}

\input{conclusions}

\vspace{-.25\baselineskip}
\paragraph{\normalfont\bfseries Acknowledgements:} This work was partially supported by NSF Expeditions
in Computing ExCAPE Award \#1138994.
\vspace{-.5\baselineskip}

\enlargethispage{\baselineskip}
\bibliographystyle{splncs03}

\subsection{Omitting the Concept Space}
We believe that, for a clean modeling of a synthesis problem, one
should specify the concept space $\mathcal{C}$. This makes it possible to
compare different synthesis approaches that work with different
representations of hypotheses and maybe different types of samples
over the same underlying concept space.

However, for the actual learning process, the concept space
itself is not of great importance because the learner proposes elements from
the hypothesis space, and the teacher returns an element from the
sample space. The concept space only serves as a semantic space that gives
meaning to hypotheses (via the concretization function $\gamma$),
and to the samples (via the consistency relation $\kappa$).

Therefore, it is possible to omit the concept space from an ALF, and
to directly specify the consistency of samples with hypotheses. Such a
reduced ALF would then be of the form $\mathcal{A} = (\mathcal{H}, \mathcal{S},
\kappa)$ with a function $\kappa: \mathcal{S} \rightarrow
2^\mathcal{H}$. In the original framework, this corresponds to the
function $\kappa_\mathcal{H}$ defined by
$\kappa_\mathcal{H}(S) = \gamma^{-1}\kappa(S)$.

To create ALF instances, the target specification is also directly
given as a subset of the hypothesis space $\mathcal{T}
\subseteq \mathcal{H}$. All the other definitions can be adapted directly
to this framework.

\subsection{Limitations}
The ALF framework we develop in this paper is not meant to capture every
existing method that uses learning from samples. There are several synthesis techniques
that use grey-box techniques (a combination of black-box learning from samples and by utilizing
the specification of the target directly in some way) or use query models (where they query the
teacher for various aspects of the target set).

For instance, there are active iterative learning scenarios
in which the learner can ask other types of questions to the teacher than just proposing
hypotheses that are then accepted or refuted by the teacher. One
prominent scenario of this kind is Angluin's active learning of DFAs
\cite{Angluin87}, where the learner can ask \emph{membership queries}
and \emph{equivalence queries}. (The equivalence queries correspond to
proposing a hypothesis, as in our framework, which is then refuted
with a counterexample if it is not correct.)
Such learning scenarios for synthesis are used, for example, in
\cite{AlurCMN05} for the synthesis of interface specifications for Java classes,
and in \cite{PasareanuGBCB08} for
automatically synthesizing assumptions for assume-guarantee reasoning.
Our framework does not have a mechanism for directly modeling such
queries.
The ALF framework that we have presented
is intentionally a simpler framework by design that captures and cleanly models emerging synthesis
procedures in the literature where the learner only proposes hypotheses and learns
from samples the teacher provides in terms of samples to show that the
hypothesis is wrong. The learner in our framework, being a completely passive learner
(as opposed to an active learner), can also be implemented by the variety of scalable passive
machine-learning algorithms in vogue~\cite{mitchell}.  A clean extension of ALFs to query
settings and grey-box settings would be an interesting future direction to pursue.