Category detection using hierarchical mean shift Many applications in surveillance, monitoring, scientific discovery, and data cleaning require the identification of anomalies. Although many methods have been developed to identify statistically significant anomalies, a more difficult task is to identify anomalies that are both interesting and statistically significant. Category detection is an emerging area of machine learning that can help address this issue using a "human-in-the-loop" approach. In this interactive setting, the algorithm asks the user to label a query data point under an existing category or declare the query data point to belong to a previously undiscovered category. The goal of category detection is to bring to the user's attention a representative data point from each category in the data in as few queries as possible. In a data set with imbalanced categories, the main challenge is in identifying the rare categories or anomalies; hence, the task is often referred to as rare category detection. We present a new approach to rare category detection based on hierarchical mean shift. In our approach, a hierarchy is created by repeatedly applying mean shift with an increasing bandwidth on the data. This hierarchy allows us to identify anomalies in the data set at different scales, which are then posed as queries to the user. The main advantage of this methodology over existing approaches is that it does not require any knowledge of the dataset properties such as the total number of categories or the prior probabilities of the categories. Results on real-world data sets show that our hierarchical mean shift approach performs consistently better than previous techniques. Many applications in surveillance, monitoring, scientific discovery, and data cleaning require the identification of anomalies. Ideally, these anomalies correspond to data points or events of interest, such as a disease outbreak in biosurveillance or a network attack in intrusion detection. Although many methods have been developed to characterize anomalies as statistically unusual events, not all statistically significant anomalies are necessarily useful. In fact, many anomalies are simply uninteresting, corresponding to known sources of noise or known combinations of features that are irrelevant to actual events of interest.. Consider the following two examples. The first example, taken from [15] , involves the task of scientific discovery from the Sloan Digital Sky Survey (SDSS) [17] , which is a 5 year survey of the northern skies by ground-based telescopes. Most of the images in the SDSS capture known phenomena such as stars, comets, nebulae, etc. which have already been discovered. Anomalies in the data correspond to unusual or unknown objects which could potentially lead to new scientific discoveries. However, the majority of anomalies in the SDSS are of no interest to astronomers. These anomalies include diffraction spikes, which are artifacts of the telescope, and satellite trails. Such anomalies clearly do not lead to new discoveries in astronomy. The anomalies of interest, such as unusual galaxies, are extremely rare and constitute a miniscule 0.001% of the entire data set. A similar task exists in the analysis of network log files. The IT infrastructure of a company can contain thousands of computers and devices networked together. These components are often equipped with monitoring agents that generate log files that capture characteristics of the network traffic. Statistical anomalies in these log files often correspond to uninteresting events such as those arising from events that are already known or expected, such as events arising from maintenance upgrades. A very small fraction of the log file anomalies correspond to actual network failures or attacks of interest. Identifying these meaningful anomalies would be beneficial for the diagnosis of faults and the prevention of malicious attacks.. Thus, a challenging new task has emerged for the field of anomaly detection -identifying anomalies that are not only statistically significant but also interesting. Since the "interestingness" of an anomaly is subjectively defined, a humanin-the-loop approach is needed. Category detection [15] is an emerging area of machine learning that can help address this issue. Category detection operates on a set of unlabeled examples S = {x1, x2, ...., xn} where xi ∈ ℜ d are from m distinct categories 1 labeled yi = {1, 2..., m}. The category detection algorithm asks the user to label a query data point under an existing category or declare the query data point to belong to a previously undiscovered category. The goal of category detection is to bring to the user's attention at least a single instance from each category in as few queries to the user as possible. Figure 1 illustrates the interactive category detection process. The main challenge in this task is discovering the rare categories, which appear as small, dense clusters or isolated outliers in the data set. This task becomes especially challenging if the data set is dominated by a handful of disproportionately large categories, which makes the rare categories become extremely difficult to discover through manual inspection. As a result, category detection is often referred to as rare category detection. In this paper we present a new approach to rare category detection using a Hierarchical Mean Shift procedure. Mean Shift is a nonparametric clustering technique widely used in computer vision for segmentation. In our approach, we use Mean Shift to discover cluster modes. By repeatedly applying Mean Shift with increasing bandwidths, we can create a hierarchy of clusters at different scales and thus use this information to score each cluster by how "anomalous" it is. This score can then be used to rank the representative data points of each cluster for labeling by a user. The main advantage of the proposed method over previous related work [15, 8] is twofold. First, our approach dramatically reduces the number of queries to the user needed to discover all the categories in the data. Secondly, our approach does not require any prior knowledge regarding the properties of the data set, such as the total number of clusters present in the data or the prior probability of a data point belonging to a cluster. We have proposed a rare category detection method using Hierarchical Mean Shift. A cluster hierarchy is built by successively running Mean Shift first on the dataset and then on the cluster centers using a series of increasing bandwidth values. Then, data points are chosen for querying using two different criteria: Outlierness and CompactnessIsolation. For data points with identical criterion values, we use a highest average distance heuristic as a tiebreaker. This HMS approach has a number of attractive properties. It does not require the user to provide information regarding the dataset properties such as the number of classes or the prior probabilities of the classes. Furthermore, the nonparametric nature of Mean Shift removes any restrictions on the shapes of the clusters. Finally, and most importantly, the HMS approach discovers all the categories in the data sets used in our experiments in much fewer queries than existing approaches such as Interleave and NNDM. The results in Table 2 and Table 4 show that the HMS approaches outperform both NNDM and Interleave. Without the tiebreaker heuristic, the HMS variants outperform Interleave and NNDM on 4 out of the 6 datasets and come within one hint of Interleave on the Shuttle dataset.. The Abalone data set was a difficult data set for category Table 3 : Area under the category detection curves in Table 4 , normalized by the total area in the graph.. detection by HMS. From the category detection curves for Abalone in Table 4 , we see that the HMS-CI method finds 18 of the total 20 classes more quickly than NNDM and Interleave, but fails to find the last 2 classes. The HMS-Out method finds 17 of 20 classes more quickly than NNDM and Interleave and also fails to discover the same 2 classes as HMS-CI. Analyzing the Abalone dataset reveals that these classes are small compact clusters that are very close to more than one large cluster. As a result, their Outlierness lifetime is low as they are merged into one of the larger clusters early on in the cluster hierarchy building phase, resulting in a low Outlierness value. Hence, HMS-Out fails to find these clusters quickly. Similarly, in the case of HMS-CI, the points from nearby larger clusters contribute substantially to the denominators of the compactness and isolation criteria of the small cluster, resulting in low values for CompactnessIsolation. The end result is that for Abalone, there are several data points that are tied either in terms of Outlierness or Compactness-Isolation near the bottom of the cluster hierarchy. The NNDM algorithm performs well on the Abalone data set because it is successful at discovering changes in local density. If we add the HAD tiebreaker heuristic, the HMS category detection methods outperform both NNDM and Interleave on all six data sets. The HAD heuristic allows the category detection algorithm to query the data points that are tied with the same criterion values using a more intelligent ordering. The improvement in category detection for the Abalone data set is due to the ability of the HAD heuristic to require the queries to be further away from all of the already queried data points. Without this tiebreaker, the HMS algorithms will query the data points with identical criterion values in some arbitrary order.. The HMS-CI methods, both with and without the HAD tiebreaker heuristic, outperform the HMS-Out methods on all data sets except for Shuttle. The CI criteria appears to be a better criterion for selecting data points for category detection but it is more computationally expensive to compute than Outlierness.. We also experimented with a range of values for the bandwidth increment k. Due to space limitations, we do not include the results here. Our empirical results show that for a range of k = 1.1 − 1.9, the HMS-CI+HAD algorithm has little variation in the total number of hints needed to discover all classes. The running times initially decrease as k increases. However, at a certain point when k becomes large, the running time starts to increase due to the cost of computing the HAD tiebreaker heuristic.. For future work, we would like to improve the use of the user feedback for category detection. Currently, the feedback is only used in the HAD tiebreaker heuristic. We would also like explore different presentation options, such as presenting the entire cluster to the user, rather than just the representative point from the cluster. In addition, we would like to make the HMS algorithm even more efficient. The bottleneck in the algorithm is building the cluster hierarchy. Although the data standardization and the cluster hierarchy construction can be completed offline while the query selection can be performed online, we would like to make the algorithm scale to extremely large data sets. Finally, we would like to investigate the theoretical issues surrounding the use of HMS for category detection. Category detection incorporates ideas from active learning [11] and semi-supervised learning [19, 1, 21] but work that investigates category detection itself is relatively sparse. We briefly review the main contributions in the area of category detection.. Category detection was first proposed by Pelleg et al. [15] through their Interleave algorithm, which assumes that the data is generated by a mixture model. Interleave starts with an entirely unlabeled data set and clusters it using EM for mixture models. Using the results of EM, the Interleave algorithm maintains, for every mixture component, a list of data points that are "most owned" by that mixture component. This list is sorted in increasing order of the "degree 1 We will use the word category and class interchangeably.. of ownership" by the mixture component. Intuitively, the algorithm queries data points that are "least owned" by the components. It cycles through all the lists in a round robin fashion and selects the data point in the first position of each component's list for user-labeling. Once the user has provided the category labels, the Interleave algorithm clamps the labeled data points to their user-supplied labels before EM is applied again. This process continues until the user terminates the loop.. Despite some nice properties such as being model-independent and robust to noise in the data, Interleave has several shortcomings. First, the algorithm is sensitive to initial conditions as the EM clustering converges to a local optimum. Second, the algorithm requires an initial estimate of the number of classes in the data. Although the number of classes changes as the user provides feedback to the Interleave algorithm, this initial estimate of the number of classes is often not known in advance and an incorrect value at the outset can adversely affect the algorithm. Finally, as pointed out by [8] , Interleave requires the classes to be separable in feature space.. He et al. [8] propose a nearest-neighbor based active learning for rare category detection (NNDM) to address the separability assumption in Interleave. NNDM uses an unsupervised local density differential sampling strategy. It makes use of nearest neighbors to measure the local density around each data point. The algorithm starts with an entirely unlabeled data set. In each iteration, the algorithm selects for labeling the data point with the largest change in local density. Like Interleave, NNDM needs to know the number of classes in advance. NNDM also requires the prior probability of a data point belonging to each class. Although NNDM is effective at discovering categories that overlap each other, we have noticed some undesirable behavior by NNDM in which the algorithm repeatedly queries data points (with large local density differential values) from the same cluster which has already been discovered.. Fine et al. [5] abstract the rare category detection problem as an output identification task in a learning model. The learning model has an unknown target function f which maps every input in χ to one of m output values. The output identification task is to find m inputs, one for each output value. The algorithm knows that the target function f is in a given function class F . The work assumes an unknown distribution over the inputs and describes algorithms for many classes of functions. The algorithms are shown to have an expected sample bound of the order of m and log(1/ǫ) where ǫ is the lower bound on the probability of each output class. The work similarly reports sample bounds in special cases like binary outputs i.e. m = 2, specific distributions (the uniform distribution) and a concept class defined over the Boolean hypercube {0, 1} n . Our approach to category detection is based on Hierarchical Mean Shift (HMS) [12, 4] , which produces a hierarchy of clusters by repeatedly blurring the data. The repeated blurring of the data is accomplished by re-running Mean Shift with increasingly larger bandwidths, using at each iteration the cluster centers from the previous iteration. HMS is closely related to scale-space theory [12] , which is a multiscale data representation framework designed to model how the human visual system sees details in an image as the image is progressively smoothed.. One of the main reasons we chose HMS is because Mean Shift is a non-parametric clustering algorithm, which permits clusters to take on arbitrary shapes, unlike a Gaussian Mixture Model. Initially, we created a non-parametric version of the Interleave algorithm by replacing EM with Mean Shift and measuring cluster ownership by the total distance shifted to reach the cluster mode. However, this Interleave variant (called MS-Interleave) requires estimating the bandwidth parameter h. After trying many different bandwidth estimation techniques [9] on a variety of data sets, we found that in many cases, the bandwidth estimates tend to undersmooth the data, producing a large number of modes when Mean Shift is applied 2 . With a large number of modes, the MS-Interleave algorithm produces many redundant queries for the same cluster as the algorithm believes that the data points belonging to that cluster belong to different clusters.. In order to avoid selecting a single optimal bandwidth value, we used HMS, which repeatedly blurs the data with increasing bandwidths. HMS results in a cluster hierarchy similar to a dendrogram, except the clustering algorithm used is Mean Shift and not single-linkage clustering. This hierarchy contains extremely useful information regarding the properties of the clusters such as their outlierness, compactness, and isolation, which we will define in more detail in Section 4.3. We use these properties to determine which data points, that are representative of these clusters, should be brought to the attention of the user. One other benefit to our HMS-based category detection is the fact that it does not require the user to input parameters requiring knowledge of the data set properties, such as an initial guess as to the number of clusters in the data (in the case of Interleave) or the category priors (in the case of NNDM).. Our HMS procedure for category detection consists of 3 phases: 1) data standardization, 2) building the cluster hierarchy and 3) querying data points.

B I O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O B I O O O B I O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O B I O O O O O O O O O O B I O O O B I O B I O O O B O O O O O O O O O O O O O B I O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O B I O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I B I O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O B I B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O B I O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O


Verification condition generation for conditional information flow We formulate an intraprocedural information flow analysis algorithm for sequential, heap manipulating programs. We prove correctness of the algorithm, and argue that it can be used to verify some naturally occurring examples in which information flow is conditional on some Hoare-like state predicates being satisfied. Because the correctness of information flow analysis is typically formulated in terms of noninterference of pairs of computations, the algorithm takes as input a program together with two-state assertions as postcondition, and generates two-state preconditions together with verification conditions. To process heap manipulations and while loops, the algorithm must additionally be supplied "object flow invariants" as well as "loop flow invariants" which are themselves two-state, and possibly conditional. A recently popular approach to information flow analysis is self-composition, first proposed by Barthe et al. [9] and later extended by, e.g., Terauchi and Aiken [25] and Naumann [23] . Self-composition works as follows: for a given program S , a copy S is created with all variables renamed (primed); with the observable variables say x , y, then NI holds provided the sequential composition S ; S when given precondition x = x ∧ y = y also ensures postcondition x = x ∧ y = y .. Terauchi and Aiken [25] use self-composition to verify information flow automatically using the BLAST tool [21] . To obtain good experimental results, they introduce sound program transformations of self-composed programs; it is also often necessary to leverage the results of a standard information flow analysis, e.g., one based on security types. In a sense, our approach is dual in that noninterference properties are explicit in our analysis but we can leverage standard assertions, inserted and/or checked by general verifiers. An interesting question is whether the 2-assertions generated by VCgen could be translated into assertions that would assist the self-composition approach.. Terauchi and Aiken [25] do not address heap-manipulating programs, so the work most closely related to ours is the one by Naumann [23] whose goal is the verification of information flow using existing verifiers like Spec# [8] or ESC/Java2 [14] . Naumann's contribution is to extend the theory of self-composition to account for manipulations of heap objects. In some cases, like for while loops, it is more practical (but not necessary) for the technique to perform program transformations. For heap-manipulating programs, the two copies of the programs involve different sets of objects and therefore the correspondence between the objects ("mates" in Naumann's terminology) must be made explicit in the specification of the composed program. Our approach avoids program transformations, and our specifications do not need to specify mates: that is handled by the semantics of assertions. On the other hand, we cannot use an existing verifier like Spec# or ESC/Java2 directly; we must thus show how preconditions and VCs are actually generated.. Dufay et al. [17] use self-composition to check noninterference for data mining algorithms implemented in Java, using the Krakatoa tool, based on the Coq theorem prover and using JML [12] . The tool reads Java input files and produces specifications for Coq and a representation of the semantics of the Java program into the input language of Why 5 , an annotated, ML-like core language with references. We leave the comparison between Krakatoa's handling of the heap and that of ours to future work. Darvas et al. [16] use the KeY tool for interactive verification of noninterference. Information flow is modeled by a dynamic logic formula, rather than by assertions as in self-composition.. Bergeretti and Carré [11] present a compositional method for inferring dependence among variables; this technique forms the basis for the Spark Ada Examiner [13] which requires that each method is annotated with derives annotations like derives v from y,z & w from x,y. It is interesting to observe that such "channels" of information flow are captured by our R component, as when. [VC ]{x , y , z } (R) ⇐= S {v , w } with R containing the elements (y , , v ), (z , , v ), (x , , w ), (y , , w ). Our approach is more general in that it also captures conditional channels; we are part of current work investigating how to extend the Spark Ada Examiner framework to express R elements like (i > 5 ⇒ y , , j > 7 ⇒ v ). Also, we hope to investigate the relationship to the path conditions presented by Hammer et al. [20] .. In the near future, we plan to experiment with the prototype implementation which is currently being developed by our student Jonathan Hoag. In future work, we might try to integrate it with the Bogor tool [18] to generate and/or check standard assertions that will increase precision. To ease expressiveness, we would like to allow multiple scopes to be simultaneously open. To handle realistic applications, we must extend the framework to an interprocedural setting. 5 On the web at http://why.lri.fr/ An important long-term goal is to provide for automatic information flow analysis. This requires (i) implementing a tool to check the satisfiability of VCs; and (ii) developing techniques for the automatic computation of loop flow invariants, and even object flow invariants. We expect that (ii) will involve fixed point iteration, using (i) to check for convergence, and using a form of widening [15] to ensure termination. For (i), we would need a sound axiomatization of 2 , where a trivial rule is that {φ ⇒ x , φ ⇒ w } 2 (φ ⇒ (x + w ) ) holds for all φ,x ,w ; it remains to be seen whether one can hope for a tool which is not just sound but also complete. Relatedly, we would like to investigate whether our analysis is in some sense "optimal", with the preconditions being "weakest", assuming that the program is decorated with suitable assertion statements (without such assertions our analysis can be imprecise, cf. the example at the end of Sect. 1).. [VC ]{Θ} (R) ⇐= while B do S0 {Θ} iff We shall define, in Figs. 5 and 6, an algorithm VCgen for inferring preconditions, and verification conditions, from postconditions. We write 4 [VC ]{Θ} (R) ⇐= S {Θ } if from input S and Θ , VCgen returns output Θ, R, and VC . Here S is a command, Θ is the desired postcondition for S , and Θ is a precondition for S that is designed so as to be sufficient to establish Θ ; if S is a top-level command then VCgen requires Θ to be field-free and ensures that Θ is fieldfree. We shall shortly explain the role of the verification conditions VC , but shall first explain the R component which captures how 2-assertions in Θ relate to 2-assertions in Θ . More precisely, we have R ⊆ Θ×{m, u}×Θ where tags m,u are mnemonics for "modified" and "unmodified"; we use γ to range over {m, u}. We write dom(R) = {θ | ∃(θ, , ) ∈ R} and ran(R) = {θ | ∃( , , θ ) ∈ R}. Intuitively, if (θ, , θ ) ∈ R then θ is in the precondition because θ is in the postcondition (θ is an origin of θ); moreover, if (θ, u, θ ) ∈ R then additionally it holds that S modifies no "relevant" variable or field name, where a "relevant" variable is one occurring in the consequent of θ . For example, if S is x := w then R might contain the triplets (q

B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Model Based Vehicle Detection and Tracking for Autonomous Urban Driving Abstract Situational awareness is crucial for autonomous driving in urban environments. This paper describes the moving vehicle detection and tracking module that we developed for our autonomous driving robot Junior. The robot won second place in the Urban Grand Challenge, an autonomous driving race organized by the U.S. Government in 2007. The module provides reliable detection and tracking of moving vehicles from a high-speed moving platform using laser range finders. Our approach models both dynamic and geometric properties of the tracked vehicles and estimates them using a single Bayes filter per vehicle. We present the notion of motion evidence, which allows us to overcome the low signal-to-noise ratio that arises during rapid detection of moving vehicles in noisy urban environments. Furthermore, we show how to build consistent and efficient 2D representations out of 3D range data and how to detect poorly visible black vehicles. Experimental validation includes the most challenging conditions presented at the Urban Grand Challenge as well as other urban settings. Autonomously driving cars have been a long-lasting dream of robotics researchers and enthusiasts. Self-driving cars promise to bring a number of benefits to society, including prevention of road accidents, optimal fuel usage, comfort and convenience. In recent years the Defense Advanced Research Projects Agency (DARPA) has taken a lead on encouraging research in this area and organized a series of competitions for autonomous vehicles. In 2005 autonomous vehicles were able to complete a 131 mile course in the desert (Buehler et al, 2007) . In the 2007 competition, the Urban Grand Challenge (UGC), the robots were presented with an even more difficult task: autonomous safe navigation in urban environments. In this competition the robots had to drive safely with respect to other robots, human-driven vehicles and the environment. They also had to obey the rules of the road as described in the California rulebook (see DARPA (2007) for a detailed description of the rules). One of the most significant changes from the previous competition is the need for situational awareness of both static and dynamic parts of the environment. Several successful approaches have been developed in parallel by the UGC participants (Leonard et al, 2008; Urmson et al, 2008) . Our robot, Junior, won second prize in the 2007 competition. An overview of Junior's software and hardware architecture is given in Montemerlo et al (2008) . In this paper we describe the approach we developed for detection and tracking of moving vehicles.. Vehicle tracking has been studied for several decades. A number of approaches focused on the use of vision exclusively (Zielke et al, 1993; Dickmanns, 1998; Dellaert and Thorpe, 1998) , whereas others utilized laser range finders (Zhao and Thorpe, 1998; Streller et al, 2002; Wang et al, 2007) sometimes in combination with vision (Wender and Dietmayer, 2008) . We give an overview of prior art in Sect. 2. Purple rectangles group together points that have been associated together. In (b) the purple rectangle also denotes the geometric vehicle model. Gray areas are objects. Gray dotted lines represent laser rays. Black dots denote laser data points. (Best viewed in color.) For our application we are concerned with laser based vehicle tracking from the autonomous robotic platform Junior, to which we will also refer as the ego-vehicle (see Fig. 1 ). In contrast to prior art, we propose a model based approach which encompasses both geometric and dynamic properties of the tracked vehicle in a single Bayes filter. The approach eliminates the need for separate data segmentation and association steps. We show how to properly model the dependence between geometric and dynamic vehicle properties using anchor point coordinates. The geometric model allows us to naturally handle the disjoint point clusters that often result from partial occlusion of vehicles (see Fig. 2 ). Moreover, the estimation of geometric shape leads to accurate prediction of dynamic parameters (see Fig. 3 ).. Further, we introduce an abstract sensor representation, called the virtual scan, which allows for efficient computation and can be used for a wide variety of laser sensors. We present techniques for building consistent virtual scans from 3D range data and show how to detect poorly visible black vehicles in laser scans. To battle the low signal-to-noise ratio during rapid detection of vehicles in noisy urban settings, we introduce the notion of motion evidence, which allows us to quickly prune false positives caused by noise. Our approach runs in real time with an average update rate of 40Hz, which is 4 times faster than the common sensor frame rate of 10Hz. The results show that our approach is reliable and efficient even in the challenging traffic situations presented at the UGC. We have presented the vehicle detection and tracking module developed for Stanford's autonomous driving robot Junior. Tracking is performed from a high-speed moving platform and relies on laser range finders for sensing. Our approach models both dynamic and geometric properties of the tracked vehicles and estimates them with a single Bayes filter per vehicle. In contrast to prior art, the common data segmentation and association steps do not need to be carried out prior to the filtering step. The approach has proved reliable, efficient and capable of handling challenging traffic situations, such as the ones presented at the Urban Grand Challenge.. Our approach explicitly models tracked vehicle's geometric shape, which is estimated simultaneously with the vehicle's motion using an efficient RBPF method. The introduced anchor point notion allows us to correctly model the shape vs motion ambiguity, previously unaddressed in vehicle tracking literature. This reduces motion uncertainty and improves the estimation of vehicle dynamics.. Unlike prior vehicle tracking approaches, which relied on features for tracking, we introduced a direct measurement model for range scans. This approach eliminates the need for data segmentation and association steps. Moreover it naturally handles partial occlusions of the tracked vehicles, including situations where the vehicle scan is split up into multiple disjoint clusters by occlusion.. We presented a number of optimization techniques to improve accuracy and efficiency of vehicle detection. These techniques are largely independent of each other. To aid the design decisions of future vehicle tracking approaches, we provided an analysis of how each technique influences the end result.. We presented techniques for efficient manipulation of 3D data clouds and construction of 2D virtual sensor models. The method relies on a ground estimation technique, Table 2 Vehicle detector performance on data sets from three urban environments. For each car we counted how many frames it took to detect it. By construction of the algorithm, at least three frames are required. We also counted the number of false detections. The '% Detected' columns give the percentages of cars detected by frame three, four and five. 'FP %' is the false positive rate attained by the vehicle detection algorithm. which we expect to be applicable not only in urban environments but also in off-road settings with rugged terrain. The method purposefully ignores short obstacles in an effort to extract data useful specifically for vehicle tracking. As a result, detection and tracking of vehicles is unimpeded by curbs and short foliage present in urban settings, or even small rocks and rough features in completely off-road environments. It also ignores overhanging obstacles -such as trees, signs, and overpasses -if there is sufficient clearance for a vehicle to pass underneath. However, due to the fact that short obstacles are ignored, the presented data extraction method is not suitable for estimation of terrain drivability. For this reason, we used a separate method for detection of small hazards as described in Montemerlo et al (2008) . We also introduced a method for detection of poorly visible black objects in 3D range data. This method is applicable not only for vehicle tracking but also for static mapping and collision avoidance. Moreover it can be extended to dark object detection using 3D range scanners in indoor settings.. There is ample room for future work in the field of perception for autonomous urban driving. The presented approach does not model pedestrians, bicyclists, or motorcyclists -a prerequisite for driving in populated areas. Another promising direction for future work is fusion of different sensors, including laser, radar and vision. A number of vehicle tracking approaches have been developed over the past few decades (e.g. Zhao and Thorpe (1998) ; Streller et al (2002) ; Wang (2004) ; Wender and Dietmayer (2008) ) including most recent developments by the UGC participants (Darms et al, 2008; Leonard et al, 2008) . Typically these approaches proceed in three stages: data segmentation, data association, and Bayesian filter update. During data segmentation the sensor data is divided into meaningful pieces -usually line features (Zhao and Thorpe, 1998; Darms et al, 2008) or clusters (Wender and Dietmayer, 2008; Leonard et al, 2008) . During data association these pieces are assigned to tracked vehicles. Next, a Bayesian filter update is performed to fit targets to the data.. The second stage -data association -is generally considered the most challenging stage of the vehicle detection and tracking problem because of the association ambiguities that arise. Typically this stage is carried out using variants of the multiple hypothesis tracking (MHT) algorithm (e.g. Streller et al (2002) ; Wang et al (2007) ).. In the third stage, the filter update is usually carried out using variants of Kalman filter (KF), which is augmented by the interacting multiple model method in some cases (Zhao and Thorpe, 1998; Wang et al, 2007) .. Although vehicle tracking literature primarily relies on variants of KF, there is a great body of multiple target tracking literature for other applications where parametric, samplebased, and hybrid filters are used. Blackman et al (2004) provides a summary. For example Särkkä et al (2007) uses a Rao-Blackwellized particle filter (RBPF) for multiple target tracking on simulated data. A popular alternative to MHT for data association is the joint probabilistic data association (JPDA) method, which is used by Schulz et al (2001) to track multiple targets from an indoor mobile robot platform.. The work included in this paper has been presented at two conferences: Petrovskaya and Thrun (2008a) focused on efficient detection of vehicles and Petrovskaya and Thrun (2008b) focused on model based tracking. In contrast to prior vehicle tracking literature, we utilize a model based approach, which uses RBPFs and eliminates the need for separate data segmentation and association stages. Our approach estimates position, velocity and shape of tracked vehicles.. Further, we propose techniques for fast and accurate moving vehicle detection, which is a prerequisite for vehicle tracking. In prior art, the detection problem has been solved by addition of vision sensors (e.g. Wender and Dietmayer (2008) ), although visual classification does not help distinguish moving vehicles from stationary. Another approach is to sample frames at lower rates to overcome the low signalto-noise ratio (Wang et al, 2007) , although this increases the time it takes to detect a new moving vehicle. Other described approaches detect vehicles by scan shape (Zhao and Thorpe, 1998; Streller et al, 2002) or by location (Wang et al, 2007) . Due to possible ambiguities in the range data, these approaches tend to have lower detection accuracy.

O O O O O O O O B I O O O O O O B I O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Recursively Defined Metric Spaces without Contraction In this paper we use the theory of accessible categories to find fixed points of endofunctors on the category of 1-bounded complete metric spaces and nonexpansive functions. In contrast to previous approaches, we do not assume that the endofunctors are locally contractive, and our results do not depend on Banach's fixed-point theorem.Our approach is particularly suitable for constructing models of systems that feature quantitative data. For instance, using the Kantorovich metric on probability measures we construct a quantitative model for probabilistic transition systems. The metric in our model can reasonably be seen as measuring the behavioural distance between states of the system; it depends exclusively on the transition probabilities and not on an arbitrary discount factor. There is a long tradition in denotational semantics that uses complete metric spaces to build models of concurrency. The operative idea in this approach is to model recursion using Banach's fixed-point theorem for contractive functions. One might think that using metric spaces in this way is a mere trick or artifice, that is, that metrics have no significance other than allowing the construction of fixed points. However, it is typically the case that metrics arising in this approach can be seen as measuring the behavioural distance between programs or states of a system. For instance, Arnold and Nivat [6] model concurrent systems as trees whose edges are labelled by actions. The distance between two trees T 1 and T 2 is 2 −n , where n is the largest number such that T 1 and T 2 are bisimilar up-to n steps. Thus one could say that the metric measures the behavioural distance between T 1 and T 2 while discounting the future, that is, giving less weight to differences further in the future. This example is quite typical, and we refer the reader to, for example, Smyth [51] for a full discussion of the intuitions behind the use of metric, uniform and topological spaces in semantics.. More recently there has been increasing interest in concurrent systems with quantitative data, such as probabilities, time, costs, or rewards. Such systems can often be modelled as transition systems where the set of states or actions carries a metric. In this context it is desirable to also use metrics to measure the similarity of systems. Metrics are preferable to discrete notions of behavioural equivalence, in which states are either equivalent or they are not, since the latter do not adequately reflect the richer quantitative structure of the underlying systems. For instance, we may want to express that two states are hard to distinguish, though not equivalent, and we might also want to express the behavioural distance between two states as a function of some parameters in the model. Furthermore, discrete equivalences are not robust. For example, in a Markov-chain model of a probabilistic system the transition probabilities are often obtained experimentally, or are given as approximations. Thus it may not make sense to say that two states are exactly equivalent.. Thus there are two separate intuitions guiding the construction of metric models of concurrent systems. On the one hand, the metric may model the depth of similarity of two systems, and on the other hand the metric may reflect quantitative data in the underlying systems themselves. Intuitively, the purpose of the present paper is to give mathematical techniques for constructing models guided solely by the second intuition. However, our techniques are also applicable to build models that support the first intuition. Existing techniques are only appropriate for models that discount the future according to the first intuition.. 2 Next we give a more precise technical explanation of our results and their relationship to previous work.. The metric spaces that arise in semantics can often be characterized as fixed points of endofunctors on the category CMet 1 of 1-bounded complete metric spaces and nonexpansive functions. A classical result in this regard is America and Rutten's [4] construction of unique fixed points for locally contractive endofunctors on CMet 1 . (See also [2, 9, 10, 27, 38, [43] [44] [45] 50, 54, 56, 58] for closely related results.) This theorem cannot be directly applied to most of the 'natural' functors arising from constructions on metric spaces. Indeed, while many standard constructions on a metric space X, such as forming the space H(X) of compact subsets in the Hausdorff metric, or forming the space K(X) of Borel probability measures in the Kantorovich metric, can be turned into functors in a natural way, typically these functors are locally nonexpansive but not locally contractive. To apply America and Rutten's theorem or any of the related theorems, one usually has first to compose the functor of interest with a discount functor δ · −, where δ is a constant smaller than 1 (typically δ is chosen to be 1 2 ). This functor maps a space X to the space δ · X with the same points but in which all distances multiplied by δ. When one computes the fixed point of the resulting functor, the discount factor expresses itself in giving a metric that discounts the future in the sense discussed above. For instance, De Bakker and Zucker [10] showed that Arnold and Nivat's complete metric space of trees is the unique fixed point of the functor H(A × 1 2 · X), where the set of actions A is endowed with the discrete metric. In a similar fashion, De Vink and Rutten [55] modelled probabilistic transition systems using (a variation on) the functor K(A × 1 2 · X), also discounting the future.. The main contribution of the present paper is to give a method for constructing fixed points of endofunctors on CMet 1 that need not be locally contractive. In place of local contractiveness we use the notion of accessibility for categories and functors. This notion arose in categorical model theory, and is useful to prove results, like the existence of adjoint functors, that require a 'smallness' condition. In particular, we use the theorem that every accessible endofunctor on a complete and accessible category has a fixed point. To employ this result we first show, in Section 2, that the category of CMet 1 is accessible by giving an axiomatization of 1-bounded complete metric spaces in a certain fragment of infinitary first-order logic. Then, in Section 3, 4 and 5, we exhibit a range of accessible endofunctors on CMet 1 , including the Hausdorff functor H and the Kantorovich functor K. The proof that H is accessible involves a characterization of H(X) as a free metric semilattice over a metric space X. Similarly the proof that K(X) is accessible involves a characterization of K(X) as a free metric mean-value algebra over X. Apart from the nonexpansive function space functor (which is only rarely used [3, 7] ), all other basic functors on CMet 1 used in semantics of which we are aware are accessible. As a consequence, our method can be exploited to prove that endofunctors built from these basic functors have a fixed point.. A missing ingredient in the discussion above is an explanation of why we use fixed points of endofunctors on CMet 1 to model particular types of system. This connection is explained through the notion of a coalgebra of an endofunctor. In the coalgebraic approach one models a class of transition systems as coalgebras of an endofunctor F : CMet 1 → CMet 1 , where each endofunctor F determines a particular class of system. An F -coalgebra is a pair (S, t), where S is an object of CMet 1 , that is, a 1-bounded complete metric space, representing the state space of the system, and t : S → F (S) is a morphism of CMet 1 , that is, a nonexpansive function, which captures the transitions of the system. Given another. Intuitively, a morphism of coalgebras is a function such that s and f (s) are behaviourally equivalent for each s ∈ S.. A terminal object in the category of F -coalgebras, if it exists, is a fixed point of the functor F [40] . The fixed points of endofunctors that we construct in this paper are all terminal coalgebras. Intuitively, a terminal F -coalgebra-call it (T, t ′ )-can be seen as a universal system in that the unique map h : (S, t) → (T, t ′ ) from an arbitrary F -coalgebra (S, t) to (T, t ′ ) maps each state of s ∈ S to the unique state of T that is behaviourally equivalent to s. In particular, the equivalence relation ker (h) = {(s 1 , s 2 ) | h(s 1 ) = h(s 2 )} characterizes a behavioural equivalence on S (see, for example, [49] ). Furthermore, since T is a metric space, its distance function can be transferred along h to induce a behavioural pseudometric 3 on S. That is, the behavioural distance of states s 1 , s 2 ∈ S is defined to be the distance between h(s 1 ) and h(s 2 ) in T , and states in S have distance zero only if they are behaviourally indistinguishable.. We illustrate the above ideas in the case of probabilistic transition systems. For this class of systems, behavioural pseudometrics have been defined in [16, 24] . The definition of the pseudometric by Desharnais, Gupta, Jagadeesan and Panangaden involves giving a real-valued semantics for Larsen and Skou's probabilistic modal logic [41] , where the next-step modality is interpreted by integration. Then the behavioural distance between two states s 1 and s 2 in a probabilistic transition system is defined by the logical formula ϕ that distinguishes s 1 and s 2 the most. In fact, Desharnais et al. define a family of pseudometrics d δ parametric in a discount factor δ ≤ 1. This discount factor determines how much the pseudometric discounts the future. The pseudometrics arising from values of δ < 1 all yield the same topology on the state space of a given probabilistic transition system, whereas the choice δ = 1, which corresponds to not discounting the future at all, leads to a different topology (see, for example, [24] ).. A different definition of the pseudometric d δ for δ < 1 was given by the present authors in [16] . There we modelled probabilistic transition systems as coalgebras of the functor. A , where K is the Kantorovich functor mentioned above, δ · − is a discount functor, A is a discrete space of actions, and 1 is the one-point space (representing refusal). We showed that the pseudometric induced on a probabilistic transition system by the terminal F -coalgebra is identical to the pseudometric described in the paragraph above. This characterization led to some new results about the pseudometric d δ . For instance, we were able to give an algorithm for approximating d δ [15] and we showed that d δ was complete-so one can define probabilistic processes as limits. However our coalgebraic characterization of d δ was only valid for δ < 1 since we were reliant on the terminal coalgebra theorem of Turi and Rutten [54] which required that F be locally contractive.. The above limitation was one of the major motivations to seek a terminal coalgebra theorem that could be applied to non-locally-contractive functors. In this paper we consider the functor F (X) = K(1 + X). A , that is, the same functor as above, but without the discount factor δ. Since, as we establish below, CMet 1 and K are accessible, there is a terminal F -coalgebra. We show that the behavioural pseudometric induced on a probabilistic transition system by the terminal coalgebra coincides with the metric d δ defined by Desharnais et al. in the case δ = 1. The arguments used to show this last result are similar to those used in [16] , however there are some subtle differences.. One can give a fixed-point definition of a behavioural pseudometric on a class of transition systems without using category theory. For instance, motivated by our coalgebraic definition, Desharnais et al. [23] gave a definition of a related pseudometric on transition systems (with probabilistic and nondeterministic choice) as the greatest fixed point of a certain functional ∆ on a complete lattice of pseudometrics. The definition of the functional ∆ is related to the Kantorovich metric. In Section 6 we give a definition of the behavioural pseudometric d δ (defined above) in this style-using a cut-down version of the functional employed in [23] . We go on to show that this fixed-point definition of d δ agrees with the definition of d δ via the terminal F -coalgebra. Let us briefly highlight our main contributions, before discussing related and future work. This paper was motivated by a desire to construct recursivelydefined metric spaces without inserting a discount factor in the defining equation. Intuitively this corresponds to the decision to adopt a semantics that does not 'discount the future': using an arbitrary discount factor would mean that the metric is no longer solely determined by the data in the original model.. We used the theory of accessible categories to prove our main results. We showed that an accessible endofunctor on an accessible and complete category has a terminal coalgebra. This terminal coalgebra theorem follows from work of Makkai and Paré [46] (see also [11] ). Our main contribution was to show that the category CMet 1 is accessible (it is well-known to be complete) and that most functors on CMet 1 used in semantics are accessible. In particular, we showed that the metric powerspace functor (based on the Hausdorff metric) is accessible and also a metric probabilistic powerspace functor (based on the Kantorovich metric) is accessible. In each case we used the fact that these functors describe free-algebra constructions to prove accessibility.. As a consequence of the above results we deduce that for most endofunctors F used in metric semantics, a terminal F -coalgebra exists and, hence, the equation X = F (X) can be solved, even if F does not discount the future. This result complements Turi and Rutten's theorem that every locally contractive endofunctor on CMet 1 has a terminal coalgebra [54] .. As an application of the theory developed in the first part of the paper, we present a coalgebraic definition of a behavioural pseudometric for probabilistic transition systems that does not discount the future. This pseudometric coincides with one given, in a different style, by Desharnais, Gupta, Jagadeesan and Panangaden [24] . The pseudometric can be seen as a quantitative version of probabilistic bisimilarity where, in particular, two states have distance zero iff they are probabilistically bisimilar.. Furthermore, we have provided a fixed-point characterization and a logical characterization of the behavioural pseudometric for probabilistic transition systems. As far as we know, we are the first to relate a fixed-point definition to the corresponding coalgebraic and logical definitions. We have also shown that there is no need to restrict to finite action sets when relating the different approaches. We should also mention that the theory developed in this paper has also been applied to a large class of timed transition systems. The details have been presented in [13] .. We can extend our results to a class of systems the state spaces of which are uncountable. In particular, we can handle those systems that are represented by P A -coalgebras. These are labelled Markov processes [21] whose state spaces are 1-bounded complete metric spaces and whose transition functions are nonexpansive (see [16, page 127] for details). In [14, Section 2] , it has been shown that the pseudometric (that discounts the future) on this class of systems can be extended to the class of all labelled Markov processes. However, if we do not discount the future then we cannot exploit the results of [14] to extend the pseudometric to the class of all labelled Markov processes.. We are confident that the results developed here can also be exploited to provide coalgebraic characterizations of the fixed-point and logical definitions of behavioural pseudometrics given in [17] [18] [19] [20] .. In Section 6 we have introduced two alternative characterizations of the behavioural pseudometric: a logical characterization and a fixed-point characterization. A similar situation exists for ordinary and probabilistic bisimilarity. These behavioural equivalences are characterized by means of a logic, as a fixed point and coalgebraically. (An intriguing missing piece in this analogy is the lack of a game-theoretic characterization of the behavioural pseudometric. We discuss this below.) Having different characterizations of behavioural equivalences and behavioural pseudometrics has proved advantageous. For example, it was Park's fixed point characterization of Milner's behavioural equivalence that led to the definition of bisimilarity.. Each approach has its advantages and disadvantages. The main disadvantage of the coalgebraic approach its reliance on category theory. However, the coalgebraic approach has also advantages over the other approaches. Once it has been shown that the systems of interest can be captured as F -coalgebras for some endofunctor F , the general theory of coalgebra (see, for example, [34] ) can be exploited. This theory includes a definition of F -bisimilarity (which coincides with well known behavioural equivalences for various endofunctors F ). If F is an accessible endofunctor on CMet 1 , then the functor also induces a be-havioural pseudometric in which distance zero exactly captures F -bisimilarity. The whole development is driven by a single endofunctor and this endofunctor is usually the composition of a rather small set of basic functors.. Proofs of properties of behavioural equivalences and pseudometrics can be carried out in all three settings. However, in some cases a proof may be considerably simpler in one setting than in another. For example, proving that the state space of a system endowed with the behavioural pseudometric is complete is considerably simpler in the coalgebraic setting than in the logical setting. In the coalgebraic setting it suffices to show that the basic functors, of which the endofunctor is composed, preserve completeness.. Van Breugel and Worrell [15] have already used a coalgebraic characterization of a behavioural pseudometric on probabilistic transition systems to give an approximation algorithm for probabilistic bisimilarity. However the pseudometric considered in op. cit. is one which discounts the future. The question of devising an algorithm for the corresponding non-discounting pseudometric remains an open (and in our opinion interesting) problem.. The existing algorithm for approximating behavioural distances is analogous to the Kanellakis-Smolka partition-refinement algorithm [36] for computing bisimilarity in labelled transition systems. It computes a behavioural pseudometric in a series of rounds, starting with the pseudometric that assigns distance zero to all pairs of states. Each round of the algorithm involves solving a network-flow problem using linear programming. Since the solution of a linear programming problem can be seen as a solution of a two-player matrix game, this suggests that the behavioural distance between two states could be characterized as the solution to a multi-round two-player payoff game. This would provide a natural analogue of the game-theoretic characterization of bisimilarity for labelled transition systems [52] , and we are currently investigating this question. In passing, we should add that in game theory there is a distinction between games in which the payoff is discounted with each round, and undiscounted games.

O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


The Compactness of Adaptive Routing Tables ABSTRACT: The compactness of a routing table is a complexity measure of the memory space needed to store the routing table on a network whose nodes have been labelled by a consecutive range of integers. It is defined as the smallest integer such that, in every node Ù, every set of labels of destinations having the same output in the table of Ù can be represented as the union of intervals of consecutive labels. While many works studied the compactness of deterministic routing tables, few of them tackled the adaptive case when the output of the table, for each entry, must contain a fixed number « of routing directions. We prove that every Ò-node network supports shortest path routing tables of compactness at most Ò « for an adaptiveness parameter «, whereas we show a lower bound of Ò « Ç´½µ . We showed that «-adaptive routing tables on Ò-node graphs, that are routing tables mapping each destination on exactly « directions, have compactness at most Ò « (i.e., require Ò « intervals of destination labels per link), computable in polynomial time. We proved also that, if at least one shortest path must be represented, there are Ò-node graphs for which every «-adaptive routing table has compactness larger than Ò « Ç´½µ .. In the other side, it is known that if all the shortest paths must be represented, then such routing tables require compactness Ò for some worst-case graphs. Therefore, it would be interesting to study the compactness of ¬-shortest path «-adaptive routing tables, a natural extension of shortest path «-adaptive routing tables, that map each destination on « directions and whose at least ¬ must be on a shortest path. The present paper concerns ¬ ½.. We stress also that our Ò « Ç´½µ -lower bound is not a serious obstacle for the study of graphs having small compactness, even for « ¾. Indeed, due to some large constants in this existential lower bound, the smallest example of graphs we can prove by Theorem 4.5 to have a compactness greater than 1 must have more than ¾ ¾ nodes.. It suggests that the class of graphs supporting shortest path ¾-adaptive routing tables is rather large, and it would be interesting to develop this study to various class of concrete networks. Previous works on compact and adaptive routing schemes can be founded in [1, 2, 9, 21] for general schemes, and in [10, 11, 23, 26] for interval routing schemes and its generalizations. However, most of theses works try to give a compact representation of all the shortest paths. Although these schemes extend the deterministic case, they suffer by the fact that many general lower bounds for deterministic routing established in [12, 18, 19, 20, 21] apply as well for the adaptive case. Indeed, these lower bounds are based on the uniqueness of the shortest paths between specific subset of nodes in some worst-case graphs. Thus, on these graphs all-shortest-path routing would consist to route along one shortest path as in deterministic routing. In essence, all-shortestpath compact routing schemes are not more compact than deterministic shortest path routing schemes. For instance, the asymptotic Ò -lower bound on the compactness for deterministic shortest path IRS applies also for all-shortest-path IRS [18] .

O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O