Self testing quantum apparatus We study, in the context of quantum information and quantum communication, a configuration of devices that includes (1) a source of some unknown bipartite quantum state that is claimed to be the Bell state Φ + and (2) two spatially separated but otherwise unknown measurement apparatus, one on each side, that are each claimed to execute an orthogonal measurement at an angle θ ∈ {−π/8, 0, π/8} that is chosen by the user. We show that, if the nine distinct probability distributions that are generated by the self checking configuration, one for each pair of angles, are consistent with the specifications, the source and the two measurement apparatus are guaranteed to be identical to the claimed specifications up to a local change of basis on each side. We discuss the connection with quantum cryptography. Typically, when one considers the task of testing a quantum system, for example using quantum state tomography, one makes the assumption that the measurement apparatus are perfect or reasonably close to perfect. Moreover, it is typically assumed that every measured system has the correct dimension. In contrast, here we consider the problem of testing a quantum system without trusting the measuring apparatus that are used in the test, except the fact that two measurements that are space like separated in the ideal specification can be modeled in the real setting by two silmutaneous quantum operators on distinct systems. In particular, we assume no apriori information about the dimension of the measured systems or on the rank of the measurement operators. The intuition that applies to ordinary tests where the dimensions are correct does not apply here. The problem that we have is more difficult. In fact, it will already be an interesting challenge to consider the case where the probability distribution for measurement outcomes in the real setting are identical to the corresponding probability distributions in the ideal specification.. To be more specific, we describe the setting that we will consider. The source has specification to emit two systems (say photons) A and B in the Bell state Φ + = (|00 AB + |11 AB )/ √ 2. The photons A and B are sent to two measuring apparatus, one for each photon, that respectively receive the classical inputs α, β ∈ {−π/8, 0, π/8} that represent the measurement bases { |α + 0 , |α + π/2 } and { |β + 0 , |β + π/2 }. The photons A and B are respectively measured in the bases α and β and the respective classical outcomes x and y of these measurements are noted on each side.. Let p((α, x), (β, y)) be the probability of the pair of outcomes (x, y) given the pair of measurements (α, β) when the system respects perfectly the original specification. Letp((α, x), (β, y)) be the corresponding probabilities for the actual system which might not be built to the orginal specification. Let Θ = {−π/8, 0, π/8}×{0, 1}, the space of pairs (α, x) where α is a basis and x an associated outcome. Our main result states that if, ∀(a, b) ∈ Θ 2 , we havep(a, b) = p(a, b), the setting is neccessarily identical modulo some local isomorphisms (see section III) to the original specification. This result would not be surprising at all if we assumed that the two measured systems are two dimensional systems or that the measurement operators are executed on two dimensional systems, but we do not use any assumption of this kind here. No assumption on the measuring apparatus or the source are required in our proof of the theorem, except that before a measuring apparatus receives its choice of basis and until after the measurement is executed, the apparatus (and whatever has selected the basis) is isolated from the other measuring apparatus. In the specific context of quantum key distribution, this separation assumption is also needed after the measurement to guarantee the privacy of the generated key, but this is another issue. If we only worry about testing the source, we only need the separation assumption until after the test is executed. This separation assumption is only an assumption on the device or mechanism that is used to isolate the measuring apparatus; it is not a direct assumption on the measuring apparatus. If the actual system is not built to the original specification, we might havep(a, b) = p(a, b). A test could eventually be executed to check how close the probabilities p(a, b) are to the ideal case p(a, b). A robust variation on the theorem should consider the case |p(a, b)−p(a, b)| ≤ ǫ, but we do not do this analysis. The problem and the main theorem are described in section III. A specific connection with the BB84 protocol [2] in quantum cryptography is discussed in section IV. Finally, the proof of the theorem is provided in section V. Thus far, this result was not generalised to a large class of settings. Of course, if we only vary the angles a little, it will still hold, but nothing is known for more interesting variations. For example, it is still an open question whether a similar result applies if we used the angles {0, π/4} on one side and the angles {π/8, −π/8} on the other side, instead of {π/8, 0, −π/8} on both sides. Also, it is known that the GHZ state can also be self tested [19] , but no rule is known for a large class of states.. The theorem was obtained in the context of quantum cryptography. It would be useful to obtain a robust variation on this theorem in which the probabilities do not have to exactly respect the ideal specification. The idea is that a statistical test could then be used to obtain enough constraints on the source for the purpose of quantum cryptography. One may also ask what are the implications of this result in the foundation of quantum mechanics. Somehow, the essential processus of science is that we try to figure out what specific models describe the observed classical data in different settings. In particular, we make hypothesis and then conduct experiments to verify them. This is essentially the situation that is analysed in our theorem. Therefore, it would be interesting to see if the analysis of self-checking quantum apparatus says anything interesting about the way we build our different quantum models. If there is a link, it is not a trivial link because, typically, experimentalits know what their measuring apparatus are when they verify a model whereas our theorem applies when the measuring apparatus on each side are not known. Finally, in view of the fact that configurations such as the one we consider in our theorem have been studied for many years in the context of violation of Bell's inequalities, it is interesting to know that they are uniquely determined (up to a natural isomorphism) by the probability distributions that they generate.. The first author would like to acknowledge useful discussions with Daniel Gottesman. This research was done in part while the first author was professor at Maharishi University of Management and, later, a visitor at the Perimeter Institute. It was supported in part by the National Science Foundation through Caltech's Institute for Quantum Information under Grant No. EIA-0086038.

B I O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O


Hypervolume-based Multiobjective Optimization: Theoretical Foundations and Practical Implications In recent years, indicator-based evolutionary algorithms, allowing to implicitly incorporate user preferences into the search, have become widely used in practice to solve multiobjective optimization problems. When using this type of methods, the optimization goal changes from optimizing a set of objective functions simultaneously to the singleobjective optimization goal of finding a set of µ points that maximizes the underlying indicator. Understanding the difference between these two optimization goals is fundamental when applying indicator-based algorithms in practice. On the one hand, a characterization of the inherent optimization goal of different indicators allows the user to choose the indicator that meets her preferences. On the other hand, knowledge about the sets of µ points with optimal indicator values-so-called optimal µ-distributions-can be used in performance assessment whenever the indicator is used as a performance criterion. However, theoretical studies on indicator-based optimization are sparse.One of the most popular indicators is the weighted hypervolume indicator. It allows to guide the search towards user-defined objective space regions and at the same time has the property of being a refinement of the Pareto dominance relation with the result that maximizing the indicator results in Pareto-optimal solutions only. In previous work, we theoretically investigated the unweighted hypervolume indicator in terms of a characterization of optimal µ-distributions and the influence of the hypervolume's reference point for general bi-objective optimization problems. In this paper, we generalize those results to the case of the weighted hypervolume indicator. In particular, we present general investigations for finite µ, derive a limit result for µ going to infinity in terms of a density of points and derive lower bounds (possibly infinite) for placing the reference point to guarantee the Pareto front's extreme points in an optimal µ-distribution. Furthermore, we state conditions about the slope of the front at the extremes such that there is no finite reference point that allows to include the extremes in an optimal µ-distribution-contradicting previous belief that a reference point chosen just above the nadir point or the objective space boundary is sufficient for obtaining the extremes. However, for fronts where there exists a finite reference point allowing to obtain the extremes, we show that for µ to infinity, a reference point that is slightly worse in all objectives than the nadir point is a sufficient choice. Last, we apply the theoretical results to problems of the ZDT, DTLZ, and WFG test problem suites. Multiobjective optimization aims at optimizing several criteria simultaneously. In the last decades, evolutionary algorithms have been shown to be well-suited for those problems in practice (Deb, 2001; Coello Coello et al., 2007) . A recent trend is to use quality indicators to turn a multiobjective optimization problem into a single-objective one by optimizing the quality indicator itself. An indicator-based algorithm uses a specific quality indicator to assign every individual a single-objective fitness-most of the time proportional to the indicator loss, a measure of how much the quality indicator decreases if the corresponding individual is removed from the population. Instead of optimizing the objective functions directly, indicator-based algorithms therefore aim at finding a set of solutions that maximizes the underlying quality indicator and a fundamental question is whether these two optimization goals coincide or how they differ. In practice, the population size of indicator-based algorithms is usually finite, i.e., equal to µ ∈ N, and the optimization goal changes to finding a set of µ solutions optimizing the quality indicator 1 . We call such a set an optimal µ-distribution for the given indicator generalizing the definition given by Auger et al. (2009b) . In this case, the additional questions arise how the number of points µ influences the optimization goal and to which set of µ objective vectors the optimal µ-distribution is mapped, i.e., which search bias is introduced by changing the optimization goal. Ideally, the optimal µ-distribution for an indicator only contains Pareto-optimal points and an increase in µ covers more and more points until the entire Pareto front is covered if µ approaches infinity. It is clear that in general, two different quality indicators yield a priori two different optimal µ-distributions, or in other words, introduce a different search bias. This has for instance been shown experimentally by Friedrich et al. (2009) for the multiplicative ε-indicator and the hypervolume indicator.. The hypervolume indicator and its weighted version (Zitzler et al., 2007) are particularly interesting indicators since they are refinements of the Pareto dominance relation (Zitzler et al., 2010) 2 . Thus, an optimal µ-distribution for these indicators contains only Pareto-optimal solutions and the set (probably unbounded in size) that maximizes the (weighted) hypervolume indicator covers the entire Pareto front (Fleischer, 2003) . Many other quality indicators do not have this fundamental property. It explains the success of the hypervolume indicator as quality indicator applied to environmental selection of indicator-based evolutionary algorithms such as ESP (Huband et al., 2003) , SMS-EMOA (Beume et al., 2007b) , MO-CMA-ES (Igel et al., 2007) , or HypE (Bader and Zitzler, 2011) . Nevertheless, it has been argued that using the (weighted) hypervolume indicator to guide the search introduces a certain bias. Interestingly, several contradicting beliefs about this bias have been reported in the literature which we will discuss later on in more detail (see Sec. 3). They range from stating that convex regions may be preferred to concave regions to the argumentation that the hypervolume is biased towards boundary solutions. In the light of those contradicting beliefs, a thorough investigation of the effect of the hypervolume indicator on optimal µ-distributions is necessary.. Another important issue when dealing with the hypervolume indicator is the choice of the reference point, a parameter, both the unweighted and the weighted hypervolume indicator depend on. The influence of this reference point on optimal µ-distributions has not been fully understood, especially for the weighted hypervolume indicator, and only rules-of-thumb exist on how to choose the reference point in practice. In particular, it could not be observed from practical investigations how the reference point has to be set to ensure to find the extremes of the Pareto front. Several authors recommend to use the corner of a space that is a little bit larger than the actual objective space as the reference point (Knowles, 2005; Beume et al., 2007b) . For performance assessment, others recommend to use the estimated nadir point as the reference point (Purshouse and Fleming, 2003; Purshouse, 2003; Hughes, 2005) . Also here, theoretical investigations are highly needed to assist in practical applications.. First theoretical studies on optimal µ-distributions for the (unweighted) hypervolume indicator and the choice of its reference point have been published in an earlier work by the authors (Auger et al., 2009b) . The theoretical analyses resulted in a better understanding of the search bias the hypervolume indicator introduces and in theoretically founded recommendations on where to place the reference point in the case of two objectives. In particular, some beliefs about the indicator's search bias could be disproved and others confirmed, the optimal µ-distributions for linear Pareto fronts were characterized exactly (see also (Brockhoff, 2010) ), and lower bounds on the reference point's objective values that allow to include the extremes of the Pareto front in certain cases have been given. Recently, a specific result of Auger et al. (2009b) has been already generalized to the weighted hypervolume indicator (Auger et al., 2009a) and another exact result for specific Pareto fronts have been provided (Friedrich et al., 2009) .. In this paper, we extend all results by Auger et al. (2009b) to the weighted case and provide a general theory of the weighted hypervolume indicator in terms of both the inherently introduced search bias and the choice of the reference point. In particular, we. • characterize the sets of µ points that maximize the (weighted) hypervolume indicator; besides general investigations for finite µ, we derive a limit result for µ going to infinity in terms of a density of points. The presented results for the weighted hypervolume indicator comply with the results for the unweighted case (Auger et al., 2009b) . Furthermore, we • investigate the influence of the reference point on optimal µ-distributions, i.e., we derive lower bounds for the objective values of the reference point (possibly infinite) for guaranteeing the Pareto front's extreme points in an optimal µ-distribution and investigate cases where the extremes are never contained in such a set; these results generalize the work by Auger et al. (2009b) to the weighted hypervolume indicator. In addition, we • prove, in case the extremes can be obtained, that for any reference point dominated by the nadir point-with any small but positive distance between the two points-there is a finite number of points µ 0 (possibly large in practice) such that for all µ > µ 0 , the extremes are included in optimal µ-distributions. Last, we • apply the theoretical results to linear Pareto fronts (Auger et al., 2009b; Brockhoff, 2010) and to benchmark problems of the ZDT (Zitzler et al., 2000) , DTLZ (Deb et al., 2005b) , and WFG (Huband et al., 2006) test problem suites resulting in recommended choices of the reference point including numerical and sometimes analytical expressions for the resulting density of points on the front. The paper is structured as follows. First, we recapitulate the basics of the (weighted) hypervolume indicator and introduce the notations and definitions needed in the remainder of the paper (Sec. 2). Then, we consider the bias of the weighted hypervolume indicator in terms of optimal µ-distributions. After characterizing optimal µ-distributions for a finite number of solutions (Sec. 3.1), we derive results on the density of points if the number of points goes to infinity (Sec. 3.2). Section 4 investigates the influence of the reference point on optimal µ-distributions especially on the extremes. The application of the results to test problems is presented in Sec. 5, and Sec. 6 concludes the paper. Indicator-based evolutionary algorithms transform a multiobjective optimization problem into a single-objective one that corresponds to finding a set of µ points that maximizes the underlying quality indicator. Theoretically understanding these so-called optimal µ-distributions for a given indicator is a fundamental issue both for performance assessment of multiobjective optimizers and for the decision which indicator to take for the optimization in practice such that the search bias introduced by the indicator meets the user's preferences.. In this paper, we theoretically characterize optimal µ-distributions for the weighted hypervolume indicator in case of bi-objective problems. The results generalize previous work on the unweighted hypervolume indicator and are, in addition, applied to several known test problems. In particular, we investigate the sets of µ points that maximize the weighted hypervolume indicator and, besides general investigations for finite µ, we derive a limit result for µ going to infinity in terms of a density of points. Furthermore, we investigate the influence of the reference point on optimal µ-distributions, i.e., we derive lower bounds for placing the reference point (possibly infinite) for guaranteeing the Pareto front's extreme points in an optimal µ-distribution and investigate cases where the extremes are never contained in an optimal µ-distribution. In addition, we show that the belief, the best choice for the reference point corresponds to a point that is slightly worse than the nadir point in all objectives, can be founded theoretically if the number of points goes to infinity. Last, we apply the theoretical results to problems of the ZDT, DTLZ, and WFG test problem suites resulting in recommended choices of the reference point including numerical and sometimes analytical expressions for the resulting density of points on the front.. We believe the results presented in this paper are important for several reasons. On the one hand, we prove that several previous beliefs about the bias of the hypervolume indicator and the choice of the reference point to obtain the extremes of the front have been wrong. On the other hand, the results on optimal µ-distributions are highly useful in performance assessment if the hypervolume indicator is used as a quality measure. For the first time, approximations of optimal µ-distributions for finite µ allow to compare the outcome of indicator-based evolutionary algorithms to the actual optimization goal. Moreover, the actual hypervolume indicator of optimal µ-distributions (or the approximations we provide) offers a way to interpret the obtained hypervolume indicator values in an absolute fashion as the hypervolume of an optimal µ-distribution is a better estimate of the best achievable hypervolume than the hypervolume of the entire Pareto front. Last, we would like to mention that the presented results for the weighted hypervolume indicator also provide a basis for a better understanding of how to articulate user preferences with the weighted hypervolume indicator in terms of the question on how to choose the weight function in practice.. Combining Eq. 27 and Eq. 26 in Eq. 25 we obtain. w(α, y)dy which gives Eq. 23.. To compute the second partial derivative of g, we need to compute, for any α, the derivative of the function g 2 : β → g(α, β). The function g 2 can be rewritten as g 2 : β →. w(x, y)dy. Therefore, from the fundamental theorem of calculus we have that ∂ 2 g(α, β) = g 2 (β) = θ(β) and thus. w(β, y)dy .. We are now ready to prove Theorem 2. Proof. From the first order necessary optimality conditions, we know that if (x From Eq. 21, we have that. 2 ) and from Lemma 3 we therefore obtain that . ). Using Lemma 3 we obtain. Gathering the first and last term of the right-hand side, we obtain. and thus if x µ i+1. x min and x µ i+1. x max , by setting the previous equation to zero, we obtain. 7.2. Proof of Lemma 1 stated on page 9. Proof. Let us first note that the Cauchy-Schwarz inequality implies that. 23 inria-00638989, version 1 -7 Nov 2011. and since x → f (x)w(x, f (x)) ∈ L 2 (0, x max ) and 1 δ ∈ L 2 (0, x max ), the right-hand side of Eq. 29 is finite and Eq. 10 is well-defined. The proof is divided into two steps. First, we rewrite E µ and, in a second step, the limit result is derived by using this new characterization of E µ .. Step 1. In a first step we are going to prove that E µ defined in Eq. 9 satisfies. To this end, we elongate the front to the right such that f equals f (x max ) = 0 for x ∈ [x max , x µ µ+1 ]. Like that, we can decompose. w(x, y) dy dx, while using the fact that. w(x, y)dydx = 0. Using the right-hand side of the previous equation in Eq. 9, we find that. w(x, y) dy dx . (31) At the first order, we have that. Since f is differentiable, we can use a Taylor approximation of f in each interval [. 2 ), which thus implies that f (x. 2 ) and thus the left-hand side of Eq. 32 becomes −w(x. 2 ). By integrating the previous equation between x µ i and x µ i+1 we obtain. Summing up for i = 0 to i = µ, multiplying by µ and using Eq. 31, we obtain Eq. 30, which concludes Step 1.. Step 2. We now decompose 1 2. For the sake of convenience in the notations, for the remainder of the proof, we redefine x µ µ+1 as x max such that the previous equation becomes 1 2. For µ to ∞, the assumption µ sup((sup 0≤i≤µ−1 |x . Moreover by definition of the density δ,. δ(x)dx approximates the number of points contained in the interval. e., one) normalized by µ: . . Therefore for every i we have that 1. Since x → f (x)w(x, f (x))/δ(x) is continuous, we also obtain. Injecting Eq. 36 in the previous equation, we obtain. Multiplying by 1/2 and summing up for i from 0 to µ and using Eq. 30 and Eq. 33, we obtain 1 2. Let us define ∆ µ as sup((sup 0≤i≤µ−1 |x. . By assumption, we know that µ∆ µ converges to a positive constant c. The last term of Eq. 37 satisfies. where K > 0. Since µ∆ µ converges to c, (µ∆ µ ) 2 converges to c 2 . With ∆ µ converging to 0, we therefore have that µ 2 ∆ 3 µ converges to 0. Taking the limit in Eq. 37, we therefore obtain − 1 2

O B I O O O O O O O O O B I O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O B I O O O O O B I O O O O O O O O B I O O O O O O B I O O O O O O O O O O O O B I O O O O O O O O O B I O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O B I O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Pervasive Flexibility in Living Technologies through Degeneracy-Based Design A version of this paper with color figures is available online at http://dx.doi.org/10.1162/ artl_a_00116. Subscription required.Abstract The capacity to adapt can greatly influence the success of systems that need to compensate for damaged parts, learn how to achieve robust performance in new environments, or exploit novel opportunities that originate from new technological interfaces or emerging markets. Many of the conditions in which technology is required to adapt cannot be anticipated during its design stage, thus creating a challenge for the designer. Inspired by the study of a range of biological systems, we propose that degeneracy-the realization of multiple, functionally versatile components with contextually overlapping functional redundancy-will support adaptation in technologies, because it effects pervasive flexibility, evolutionary innovation, and homeostatic robustness. We provide examples of degeneracy in a number of rudimentary living technologies, from military sociotechnical systems to swarm robotics, and we present design principles-including shared protocols, loose regulatory coupling, and functional versatility-that allow degeneracy to arise in both biological and man-made systems. Unanticipated requirements can arise throughout a technologyʼs life and are a notoriously difficult engineering problem and a challenging research topic, because past routines and contingency plans will be of limited utility. Dealing with new challenges requires exploration, diversity, and bet-hedging: principles that are common to any discipline in which responses to novelty determine competitive success.. However, these conceptualizations of adaptive behavior provide only approximate descriptive accounts of how complex technologies can be designed to achieve robustness and adaptation in novel circumstances. Importantly, it is still poorly understood how adaptive options are generated and exploited within a systems context without sacrificing other objectives related to efficiency and effectiveness. Recent theories have proposed that a biological property known as degeneracy plays an important role in establishing synergistic relationships between biosystem complexity, adaptive potential, robustness, and efficiency [48] . In this article, we will explore how the development of degeneracy in living technologies [5] may help these systems acquire desirable adaptive features. We will propose a. Researchers and engineers from largely isolated disciplines have uncovered similar principles that contribute to the design or evolution of adaptive systems and appear to be widely applicable within ecosystems, biochemical networks, systems engineering, and human organizations [12, 13, 30, 42] . Primary factors that contribute to resilience of food webs, canalization of multicellular development, physiological homeostasis, and robust control of automated manufacturing processes include intuitive engineering concepts such as functional redundancy, bet-hedging, saturation effects, and fail-safe principles.. Feedback control concepts have been particularly successful in explaining robustness in a wide range of systems, including biological networks [4, 9, 33, 53] . These findings have received considerable publicity in biology, in part because they support the view of a top-down deconstruction of biological complexity that could reveal intuitive insights into the exceptional robustness and adaptive potential of living systems [14] .. Less attention has been given to evidence that the majority of robustness in biological systems cannot be attributed to simple feedback loops or component redundancy [12, 13, 19, 34, 43, 46, 47, 50] . Even though control theoretic principles are relevant to biological robustness, the sets of components displaying single-reference-point, closed-loop control principles only do so within tightly restricted (microenvironment) conditions. It is more often the case that numerous interdependent actions among diverse biological elements are integrated over space and time, with robustness emerging in a distributed fashion. In biology, this phenomenon is referred to as distributed robustness [47, 50] or emergent flexibility [52] .. Biological and ecological research on distributed robustness has uncovered statistical patterns of regulatory (activation/inhibition) and mass-action interactions that are positively correlated with robustness, including nested feedback loops, bow-tie architectures, and long-tail distributions of regulatory interactions [15, 43, 45] . For instance, in the immune system [29] and metabolism [15] , distributed robustness is facilitated in part by a multi-scaled bow-tie architecture: At many scales of the system there exist multiple pathways to achieving a given function or effect. The result of these multiple pathways is that the system is endowed with exceptional flexibility when operating under stressed conditions. Interestingly, these pathways are compensatory but not entirely redundant: In many circumstances they contribute to entirely different functions. As a simple example, the metabolism of glucose can take place through two distinct pathways: glycolysis and the pentose phosphate pathway. Although these pathways can substitute for each other when necessary, the entirety of their metabolic effects is not identical.. Distributed robustness can emerge in similar ways within human organizational contexts such as military forces. For instance, in traditional warfare, the tactical advance of an adversary can be suppressed by employing artillery, cavalry, air strike assets, or other force elements. A deployed military force in need of suppressing an adversaryʼs advance therefore has multiple courses of action (COAs) available. These COAs represent different utilizations and orchestrations of the same deployed force elements. While different COAs may generate the same effect, for example, during the suppression of an adversaryʼs advance, they differ in other tasks, such as the own forceʼs tactical mobility. When circumstances change in an unanticipated manner, a deployed force can quickly readjust the utilizations and orchestrations of force elements and shift from the COA executed so far to another that promises success under the changed new conditions. In short, military adaptive capabilities arise from force elements that compensate and complement each other. This allows for a changeable organizational form that emerges in response to deployment contexts of large (and dangerous) uncertainty.. Degeneracy and network buffering architectures can be incorporated into living technologies through clearly definable system features. These features have evolved in biological systems over long periods of time through major evolutionary transitions and have become ubiquitous in present-day species, particularly in multicellular eukaryotes [28] . In contrast to their possibly fortuitous development in biological contexts, we contend that they can be intentionally selected, designed, and encouraged. By enabling the systematic development of degeneracy, these properties support the development of living technologies that flexibly respond to unplanned changes at all scales of a system-from operational environment and internal design to user preferences and competitive marketplaces.. As a design principle, degeneracy can be realized in technological systems that exhibit the following features:. 1. Shared protocols 2. Agent versatility 3. Loose regulatory coupling An overview of these design features is provided in Figure 6 . In the following sections, we describe each feature while ignoring their biological and engineering motivations, their history, and the technical jargon that pervades the research informing this discussion. Our research into distributed robustness suggests that the reductionist evaluation of resource redundancy can sometimes be highly inaccurate and lead to erroneous conclusions regarding the value of versatile assets that are deployed within a volatile and uncertain environment [52] . We claim that a better understanding of distributed robustness requires moving beyond heuristics that only attribute robustness from diversity to bet-hedging and portfolio-theoretic principles. What is sorely lacking is a principled approach to the systematic design of living technologies where forms of robustness and flexibility can emerge on demand [52] .. The NB described in this article illustrates one form of emergent robustness that can be understood and designed without knowing precisely where flexibility will be needed or what perturbations will be experienced. To achieve NB, elements in the system must display a partial overlap in functional capabilities: in some contexts providing functional redundancy, in others providing response diversity. In biology this unique type of group behavior is known as degeneracy.. Previous investigations into the potential importance of degeneracy in multi-agent systems suggest that degeneracy could broadly contribute to the flexibility needed in living technologies because:. 1. Degeneracy can lead to an emergent form of systemic flexibility through NB. The NB hypothesis [50] extends the value of diversity beyond that of portfolio theory toward a system-level relationship between diversity, performance, and resilience.. 2. When organized into buffering networks, degeneracy can enhance a systemʼs capacity to take advantage of opportunities originating from component changes; exploit novel environmental conditions; and mitigate the effects from unanticipated stresses [52] . Stated differently, systems with inbuilt degeneracy can develop an innate capacity to deal with unforeseen, new challenges.. 3. Degenerate systems can sometimes violate robustness-efficiency tradeoffs that are widely perceived as hard constraints. The robustness-efficiency balance attainable in systems with innate degeneracy significantly outperforms that achievable in systems where degeneracy is absent [32] .. 4. The strategic advantage of highly degenerate multi-agent systems does not appear to degrade operational effectiveness. In particular, the benefits of NB appear to be attainable at small cost in management overheads when decision making is distributed across the system [52] .. Degeneracy is a system property that can be clearly articulated and defined for any system composed of functionally versatile elements. Currently, several research programs are exploring how the degeneracy concept can be translated into design principles for the realization of more flexible and resilient systems in different disciplines [23, 38, 51, 52] . For instance, in defense capability simulations, we have shown that fleets of military field vehicles with high degeneracy in task capabilities can improve operational robustness within anticipated mission scenarios, yet at the strategic level provide exceptional design and organizational adaptability for responding to unanticipated challenges [6, 52] . We are also looking at how the degeneracy concept can be translated into the design of more flexible manufacturing and assembly systems [23] , and can improve the performance of populationbased dynamic optimization [51] . Other researchers are using the concept to understand the requisite conditions for embodied [21] and simulated artificial life [10, 27, 36] .. In this article we have described how component-level functional versatility and network-level functional redundancy enable degenerate elements to facilitate exaptations. We have also described how the inclusion of protocols and loose coupling can enable the incremental evolution of highly degenerate systems. We looked at how these ideas can help realize some of the desirable features of living technologies and focused on swarm robotics as a case study. We evaluated a particular system known as the swarmanoid. In many ways, the Swarmanoid Project captures key design principles for the realization of behavioral adaptation, configurational flexibility, and design evolvability that are rare outside of natural systems. Swarmanoid exemplifies a system architecture with loose coupling in component design and a plug-and-play modularity that facilitates dynamic assembly guided by environmental context. The swarmanoid system supports self-assembly, distributed decision making, and component diversity: features that are absent from most robotics research.. However, to fully realize its potential as an applied living technology within environments that are volatile and uncertain, the swarmanoid system needs a greater degree of flexibility for responding to real-world conditions. The flexibility afforded by degeneracy could provide advantages in the design and operation of robotic swarms, while the swarmanoidʼs plug-and-play architecture should enable this diversity to arise from a relatively small set of core building blocks.

B I O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O B I O O O O O O O O O B O O O O O B I O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O B O O O O O B O O O O O O O O B I O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Local analysis of atomicity sphere for B2B collaboration Atomicity is a desirable property for business processes to conduct transactions in Business-to-Business (B2B) collaboration. Although it is possible to reason about atomicity of B2B collaboration using the public views, yet such reasoning requires the presence of a trustworthy party who has complete knowledge of these views. It is inapplicable when some parties may want to keep the confidentiality of their collaborative partners for privacy and other business reasons, or the trustworthy party is not available. To address this problem, we propose a novel approach that allows each party to jointly conduct local atomicity checking with its direct partners. It is based on iterative forwarding and regression of compensability properties between each pair of direct partners. This approach is applied to a case study based on a real-life insurance process in the motor damage claims domain. It is vital to respect the privacy of individual process collaborators in a Business-to-Business (B2B) environment, where collaborating business processes are typically distributed, autonomous, heterogeneous and enacted individually. To retain business interest or privacy, organizations only expose their restricted public views, hiding the internal business logistics (or internal processes) from others. The collaboration of these processes is through message exchanges between their public views [3] [4] [17] . To handle the inconsistency problem in process collaboration, weak consistency approaches, such as exception handling, are often adopted in such environments [10] .. Exception handling approaches relax conventional database transaction requirements and impose atomicity sphere on business processes [10] . Satisfaction of atomicity sphere is a desirable approach to guarantee atomicity property in a business process. If a business process satisfies atomicity sphere, it should warrant the business process to terminate with the semantics of all or nothing. Such a business process can always terminate successfully by retrying the failed tasks, or rolling back to its original state without undesirable side effects by compensating all the executed tasks. In contrast, the abortion of a business process that does not exhibit atomicity sphere may suffer from side effects and result in value loss, e.g., payment cannot be refunded when a procurement transaction is aborted. * Even if atomicity sphere property is held in every collaborating process individually, this property may still not be respected in their collaboration. It is therefore desirable to check in advance to determine whether the atomicity sphere property may be violated in a potential B2B process collaboration. The global analysis approach, which checks atomicity sphere by composing all the collaborating business processes into a composite process, is not applicable in some scenarios when the business parties refuse to expose their internal business processes due to business or privacy reasons. Our earlier work [21] has solved this problem by proposing a novel process algebraic model to derive atomicityequivalent public views from detailed business processes. By checking the atomicity sphere in the composition of these public views, the atomicity property of their collaboration can be verified. It exempts business parties from releasing the details of its business processes to its partners while checking the atomicity sphere of their collaboration. Thus, such a checking requires a trustworthy party who has complete knowledge of the public views that forms the composite process.. Many organizations may hesitate to take avoidable risks and conduct potentially problematic business transactions. Therefore, how to verify atomicity sphere of B2B collaborations in time when the trustworthy party is unavailable, even temporarily? Let us illustrate this problem using an example. To ease the discussion, we refer to a direct business collaborator of an organization as a direct partner of the organization. Consider the scenario involving a retailer, a supplier, a bank, a producer, and a shipper. Suppose that they collaboratively provide a supply chain application, and a trustworthy party does not exist in such scenario because each party wants to hide their collaboration information from others due to privacy or business reasons. For instance, from the supplier's perspective, its customer (i.e., the retailer) should better be blind to observe its vendors (i.e., the producer) and on how they collaborate. Similarly, from the perspective of the retailer, its suppliers should not know its interactions with its clearance bank. Hence, the global checking approach for atomicity sphere [21] is inapplicable in this scenario.. To solve the problem, we propose a local analysis approach to verify atomicity sphere of B2B process collaboration. Instead of composing all the public views and checking the atomicity sphere by a trustworthy party, each business party in this approach verifies locally whether the collaboration with its direct partners satisfies atomicity sphere. In this way, the mandate for a trustworthy party is not required. Our model assumes that each party may publish different public views for its different direct partners. We call them local views. Each local view of a business process is restricted to contain the essential information directly relevant to a particular direct partner of the business process. Thus, this approach avoids disclosing information amongst direct concerned partners.. The main challenge of the proposed approach lies in the problem of analyzing atomicity sphere accurately without global knowledge of all involved parties. Reasoning the atomicity sphere of a B2B collaboration requires some global knowledge of process interaction, including the partial ordering of all tasks, and their compensability and retriability properties. We will discuss them further in Section 2. These kinds of information, however, are unavailable or only partially available in each organization. Hence, it is difficult to conduct accurate analysis of atomicity sphere of their B2B collaboration locally by each involved business party. We will elaborate on this problem and examine various inaccuracies that may arise in Section 3. Currently, methods to uncover the global knowledge required for the checking of global atomicity in local analysis has not been addressed in existing related research work.. The main contributions of this paper are twofold: First, a novel analysis approach based on property propagation on local views is proposed to confine the potential violation of atomicity sphere within individual processes. By analyzing a local atomicity sphere criterion of every involved process, business parties as a whole could identify whether the atomicity property is achieved in their collaboration. Second, algorithms are presented to construct local views, propagate property amongst business parties, and check the local atomicity sphere criterion.. The rest of this paper is organized as follows: Section 2 reviews the background of a process algebraic model for business processes, and global checking of atomicity sphere. Section 3 analyzes the problems in local checking. Section 4 gives our solution and theoretical results. Section 5 illustrates this proposal by using an insurance case study based on motor damage claims. Section 6 presents the evaluation and discussions of this proposal. Section 7 summarizes the related work and draws a comparison. This is followed by our conclusions in Section 8. To tackle the two inaccuracy problems presented in Section 3, we propose a property propagation technique. We observe that if a process can transfer the relative positions of its pivot tasks to a destination process, the latter can judge whether its tasks may fail atomicity sphere. However, such propagation of pivot tasks from one process to another may expose the privacy. A solution is to propagate only the non-compensable property of pivot tasks instead of the tasks themselves. For example, as depicted in Figure 1 (a), the non-compensable property of pivot task a 1 in. process p 1 can be propagated to the start position of p 2 (a dashed arrow represents the property propagation direction). The intuition of such propagation is that a 1 can be executed before the first task of p 2 in their collaboration. Thus the propagation reveals to p 2 that some non-compensable task in p 1 could be executed before any task of p 2 . This non-compensable property can then be propagated to p 3 and p 4 in similar ways. Thus, process p 4 knows that there is some non-compensable task in some other process which may be executed before its non-retriable task a 5 . Hence, p 4 can determine locally that their collaboration violates atomicity sphere. Likewise, in Figure 1 (b), the non-compensable property of pivot task a 6 can be propagated to p 3 at the point right after a 5 . Its intuitive meaning is that task a 6 cannot be executed before a 5 , but can be executed before any of a 5 's subsequent tasks in p 3 . The subsequent propagation of this property from p 3 to p 2 at the point after a 4 explores to p 2 that the pivot task a 6 is always executed after a 4 . Therefore, p 2 knows that a 6 is always executed after a 3 so that the local checking of p 2 does not give a false report.. The above observation has inspired us to propose an approach based on property propagation of pivot tasks to analyze atomicity sphere locally. The basic idea is as follows: First, it confines the potential violation of atomicity sphere of the global process to individual private processes by propagating the non-compensable property of some pivot tasks to all the partners. Next, by checking a local atomicity sphere criterion of each individual process, business parties can identify whether their collaboration satisfies atomicity sphere.. In the next section, we will formalize the property propagation approach and prove that it is sound for checking the satisfaction of atomicity sphere locally. This paper presents a novel approach to analyze atomicity sphere locally for B2B collaboration without compromising privacy.. This method provides a criterion for business parties to identify suitable partners. It is based on a novel process algebraic model, under which different local views are derived from a private process for different roles. With the aid of these local views, property propagation is applied to localize any potential violation of atomicity sphere to individual private processes. By analyzing the business process using the proposed local atomicity sphere criterion at each involved process, business parties could identify whether their collaboration exhibits any atomicity sphere. In this way, each party discloses minimal privacy information to the others during the checking of atomicity sphere. Algorithms are also provided to construct the local views, propagate property and check the local criterion.. Our present work still has some limitations, e.g., trustworthiness is required for involved processes and the like. In the future, we will improve our work to address these restrictions and perform more case studies to investigate the usability and scalability of our approach in practice. In this section, we will review some major techniques proposed by recent studies in the areas of transactional support, quality of services (QoS), and privacy protection for B2B collaboration.. To guarantee consistency in process collaboration, some researchers extend advanced transaction models (ATMs) [15] to support business processes. Grefen et al. [9] extends the Saga model [7] to facilitate an arbitrary distribution of and flexible rollback semantics of business processes over multiple workflow management systems. To keep consistency, each task in this model is required to be paired with a compensating task so that the failure of any task could be handled by compensating all or partial executed tasks. However, this requirement is too strict for B2B transaction because some tasks may not be able to compensate in reality. Similar works in the area of transactional workflow, such as [8] , however compromise the autonomy and privacy of involved processes. In addition, some transactional protocols for process collaboration and web services, such as Business Transaction Protocol (BTP) [2] , WS-C [19] /WS-T [20] , use mechanisms like two-phase outcome protocol to guarantee the consistency of involved partners at runtime, which, however, sacrifices the autonomy of the participating processes because some involved processes may have to commit their tasks together.. Another well-studied area is distributed, cooperative fault-tolerant systems [11] , where consistency is achieved by rolling the execution back to some checkpoints using backward recovery and restarting the execution from the checkpoints in case of a failure. These approaches, however, are inapplicable to processes in B2B environment because business processes may not be able to compensate executed tasks in some situations due to expensive costs. Moreover, tasks failed in a business process may not be able to restart. For example, the payment could not restart if the bank account is out of money. In addition, privacy issues are not considered in these approaches.. The work in this paper and our previous work [21] provide a flexible approach to achieve atomicity sphere property in B2B collaboration. Business processes do not have to conform to some specific protocols at runtime. As a result, the involved organizations have greater freedoms (i.e., loose coupling) to conduct B2B transactions. The main difference between the work in this paper and [21] is that the work of [21] uses a global checking approach, which may be inapplicable in some scenarios. This paper adopts a local analysis approach to analyze atomicity sphere when the global approach is inapplicable, and thus complements the work of [21] .. Currently, little efforts have been spent on studying the privacy issue in B2B environment. Public view is a promising way to protect privacy, but existing works on public view based process collaboration, such as [3] [4] [12] [17], could not be used to check atomicity sphere of B2B collaboration. Local views used in our work not only protect privacy of involved process, but also propagate non-compensable property so that business parties can analyze atomicity sphere locally without disclosing their privacy.. Lastly, we review related work in the area of quality of services (QoS) for process collaboration. Wohlstadter et al. [18] tackle the QoS problem in service matchmaking by using a middleware based methodology. This approach allows services to use a metalevel protocol to negotiate with one another and exchange their QoS policy information so that they can compute the agreeable common sets of QoS policies. Although their work may be used by the parties to negotiate transactional configurations, their work does not show the method to do so. We view that it is non-trivial, because atomicity sphere is different from the QoS aspects stated in [18] in the sense that atomicity sphere may be affected by all the involved processes. Other works on QoS aspect for service computing, such as [16] [23], do not consider atomicity (sphere). In contrast, our work provides a viable approach for business parties to exchange their atomicity information and check locally whether atomicity sphere is held in their collaboration.

O O O B O O O O B O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O B O O O O O O O B O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O B I O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O B O O O B I O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O B O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O B O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O B O O O O O O O O B O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O B O O O O O O O B I O O O O O O O O O O O O B O O O O O O O O O O O O O B O O O O O O O O O O O O O O B O O O O O B O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O B O O O O O B O O O O O O


Martingale Families and Dimension in P We introduce a new measure notion on small complexity classes (called F -measure), based on martingale families, that gets rid of some drawbacks of previous measure notions: it can be used to define dimension because martingale families can make money on all strings, and it yields random sequences with an equal frequency of 0's and 1's. On larger complexity classes (E and above), F -measure is equivalent to Lutz resource-bounded measure. As applications to F -measure, we answer a question raised in [1] by improving their result to: for almost every language A decidable in subexponential time, P A = BPP A . We show that almost all languages in PSPACE do not have small non-uniform complexity. We compare F -measure to previous notions and prove that martingale families are strictly stronger than Γ-measure [1], we also discuss the limitations of martingale families concerning finite unions. We observe that all classes closed under polynomial many-one reductions have measure zero in EXP iff they have measure zero in SUBEXP. We use martingale families to introduce a natural generalization of Lutz resource-bounded dimension [15] on P, which meets the intuition behind Lutz's notion. We show that P-dimension lies between finite-state dimension and dimension on E. We prove an analogue of a Theorem of Eggleston in P, i.e. the class of languages whose characteristic sequence contains 1's with frequency α, has dimension the Shannon entropy of α in P. Resource-bounded measure has been successfully used to understand the structure of the exponential time classes E and EXP; see [14] for a survey. Recently resource-bounded measure has been refined via effective dimension which is an effectivization of Hausdorff dimension, yielding applications in a variety of topics, including algorithmic information theory, computational complexity, prediction, and data compression [15, 11, 16, 4, 2, 6] .. Unfortunately both Lutz's resource-bounded measure and dimension formulations [12, 15] only work on classes containing E (apart from finite-state dimension). One reason for this is that when a martingale is to bet on some string x depending on the history of the language for strings y < x, the history itself is exponentially larger than the string x. Thus even reading the history is far above the computational power of P.. One way to overcome this difficulty was proposed in [1] , with a measure notion (called Γ-measure) defined via martingales betting only on a sparse subset of strings of the history, with the drawback that the class of sparse languages does not have measure zero. Nevertheless it seems that sparse languages -and more generally, languages with a characteristic sequence such that the frequency of occurrences of 1s is some fixed number different from 1/2-should be small for an appropriate measure notion on P, because there exist simple (exponential-time computable) martingales always making the same fixed bet that succeed on such languages. Such martingales are relatively "simple"; exponential computational power is only required to keep track of the current capital. This also shows how important it is for a martingale to be able to bet on all strings, in order to succeed. This "betting on all strings" property becomes crucial in Lutz's recent formulation of effective Hausdorff dimension [15] .. A stronger measure notion called dense martingale measure (denoted Γ d ) was then proposed in [21] , with the surprising result that the polynomial time version of Lutz's hypothesis "NP does not have measure zero in E" does not hold [3] . Γ d -measure does not satisfy the finite union property though; it was then shown that a restricted version (denoted Γ/(P)) of it does, unfortunately Γ/(P)-measure has some unnatural properties: a language with infinitely many easy instances can still be random.. Another limitation of previous martingale-based measure notions on P from [1, 21] and on PSPACE [17] is the inability of the corresponding martingales to bet on all strings. Γ-martingales can only bet on a polynomial number out of the exponentially many strings of length n, whereas Γ d and Γ/(P) martingales can only double their capital a polynomial number of times while betting on (the exponentially many) strings of size n, with the direct consequence that neither can be used to define a dimension notion, because the ability to bet on every string is essential for this purpose (notice that simply keeping track of the capital won by a martingale doubling its capital on every string is impossible in polynomial time). Moreover the random sequences yielded by either of those two measure notions do not necessarily have an equal frequency of 0's and 1's in the limit, whereas this property is captured by Lutz's resource-bounded measure notion on E, corresponding to the intuitive idea of a random sequence.. In this paper we introduce a measure notion on P based on martingale families (called F -measure), where martingale families can double their capital on all strings, thus enabling us to define dimension in P. On larger complexity classes (E and above), F -measure is equivalent to Lutz resource-bounded measure. F -measure gets rid of the unnatural random sequences of Γ/(P)-measure [21] , and yields random sequences with an equal frequency of 0's and 1's, similarly to Lutz resource-bounded measure [12] . Moreover F -measure is strictly stronger than Γ-measure. United, we stand; divided, we fall is the key idea behind F -measure, i.e. whereas a single polynomial time computable martingale is not able to make money on all exponentially many strings of size n, a family of martingales working together and sharing their capital can. The idea is to separate the exponentially many strings of size n into groups of polynomial size, where each member of the family bets on one of these groups of strings. The family shares a common bank account: When such a martingale bets on a string x, the capital at its disposal amounts to the capital currently gathered by its family on predecessors of x, although it has no information about how much this (possibly) doubly exponential large capital is.. Constructing the appropriate measure on P has turned out to be much more difficult as previously thought; it is now widely believed that this appropriate measure on P might be very difficult to achieve, and that for any measure notion on P some desirable properties must be abandoned; and F -measure is no exception. Similarly to Γ d -measure [21] , martingale families do not satisfy the finite union property, but only satisfy the union property in some non-general sense: we can only guarantee the union property for families that bet on the same group of strings; however this is usually enough to prove theorems where the union property is needed.. We show in Section 3.1 that except for general unions, martingale families satisfy the basic measure properties, i.e., every singleton set has measure zero and the whole class P does not have measure zero. We then introduce uniform P-unions and show that the union property holds for those. We observe that it is easy to derive an F -measure notion on classes between P and E like QUASIPOLY, SUBEXP and PSPACE; for BPP see [19] .. Next we show that the concept of randomness yielded by F -measure is optimal regarding frequency: every language L such that there are infinitely many n with |L[1 · · · n]| ≤ n (with < 1/2), has measure zero in P (Section 3.2).. As applications of F -measure, we answer a question raised in [1] , improving their result to: almost all (all except a measure zero class) languages computable in subexponential time, are hard enough to derandomize BPP, i.e. a polynomial time algorithm can use almost every language L ∈ SUBEXP to derandomize every probabilistic polynomial time algorithm, even if the probabilistic algorithm has also oracle access to L.. We also investigate the nonuniform complexity of languages in PSPACE, and show that almost all languages in PSPACE do not have small nonuniform complexity, thus reducing the resource-bounds of a similar result in [13] .. Next we compare F -measure to previous measure notions on P, and show that F -measure is strictly stronger than Γ-measure, i.e. every Γ-measure zero set has F -measure zero, and there are classes with Γ-measure non-zero that have F -measure zero. Due to their intrinsic differences, we cannot compare Γ d -measure and Γ/(P)-measure [21] to F -measure. Nevertheless all sets proved to be small for Γ/(P)-measure in [21] are also small for F -measure. Regarding density arguments, F -measure performs better; indeed a (Lebesgue) random language has (1/2 − o(1))2 n words of length n (with high probability), and this property is captured by Fmeasure, whereas for Γ/(P)-measure, the set of languages having o(2 n ) words of length n has Γ/(P)-measure zero. The advantage of Γ/(P)-measure over F -measure is that it satisfies the finite union property. Concerning Γ d -measure and F -measure, both their respective strengths are different, whereas Γ d -measure cannot be used to define dimension in P, F -measure fails to capture the Γ d -measure zero sets in [3] .. We also show that all classes closed under polynomial many-one reductions have measure zero in EXP iff they have F -measure zero in E α , which reduces the time bounds of many results [8, 22, 8, 7] from measure on E to measure on SUBEXP.. For a Baire category notion on small complexity classes, see [18] . The second part of the paper is devoted to dimension in P. Lutz resource-bounded dimension [15] , has been introduced on a wide variety of complexity classes ranging from finite state automata, exponential time and space up to the class of recursively enumerable languages [11] , with the exception of small classes like P.. Hausdorff dimension is a refinement of Lebesgue measure, where every measure zero class of languages is assigned a real number between 0 and 1, called its Hausdorff dimension. The key idea of Lutz is to impose a tax after each round (even if the martingale did not bet during that round): the largest tax rate which can be imposed without preventing the martingale from succeeding on a given class represents the dimension of the class.. Trying to bridge the gap between finite state automata and exponential time requires a measure notion which is able to bet and double the capital at every round. Whereas all previous measure notions on P [1, 21] are unable to do so, it is not a problem for martingale families. This leads to a natural generalization of Lutz resource-bounded dimension [15] on P, which meets the idea behind Lutz's notion.. We give some evidence that P-dimension is a natural extension to P of previously ex-isting dimension notions, by showing that it lies exactly between finite-state dimension and dimension on E, i.e. we show that for any sequence S,. Finally we prove an analogue of a Theorem of Eggleston [5] in P, i.e. the class of languages whose characteristic sequences contain 1's with frequency α, has strong dimension equal to the Shannon entropy of α in P. More than a decade after the first measure notion on P was introduced, it is now widely believed that for measure on small complexity classes some properties need to be renounced. The main contribution of our measure notion is that, unlike previous measure notions on P, it leads to a reasonable way to define dimension in P. The price to pay is that martingale families only satisfy a non-general union property. We expect our measure and dimension notions to be useful for further measure-based investigations in small complexity classes.

O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O B I O O O O B I O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O