\SetWatermarkScale

10 \SetWatermarkLightness0.95

Divergences on Monads for Relational Program Logics

Tetsuya Sato Shin-ya Katsumata

Abstract

Several relational program logics have been introduced for integrating reasoning about relational properties of programs and measurement of quantitative difference between computational effects. Towards a general framework for such logics, in this paper, we formalize quantitative difference between computational effects as divergence on monad, then develop a relational program logic acRL that supports generic computational effects and divergences on them. To give a categorical semantics of acRL supporting divergences, we give a method to obtain graded strong relational liftings from divergences on monads. We derive two instantiations of acRL for the verification of 1) various differential privacy of higher-order functional probabilistic programs and 2) difference of distribution of costs between higher-order functional programs with probabilistic choice and cost counting operations.

1 Introduction

Comparing behavior of programs is one of the fundamental activities in the verification and analysis of programs, and many concepts, techniques and formal systems have been proposed for this purpose, such as product program construction ([11]), relational Hoare logic ([14]), higher-order relational refinement types ([9]) and so on.

Several recent relational program logics integrate compositional reasoning about relational properties of programs and over-approximation of quantitative difference between computational effects of programs; the latter is done in the style of effect system ([36]). One successful logic of this kind is Barthe et al.’s approximate probabilistic relational Hoare logic (apRHL for short) designed for verifying differential privacy of probabilistic programs ([12]). A judgment of apRHL is of the form $c\sim_{\epsilon,\delta}c^{\prime}:\Phi\Rightarrow\Psi$ , and its intuitive meaning is that for any state pair $(\rho,\rho^{\prime})$ related by $\Phi$ , the $\epsilon$ -distance between two probability distributions of final states $[\![c]\!]\rho$ and $[\![c^{\prime}]\!]{\rho^{\prime}}$ is below $\delta$ , and final states satisfy $\Psi$ . Another relational program logic that measures the difference between computational effects of programs is Çiçek et al.’s RelCost ([18]). The target of the reasoning is a higher-order programming language equipped with cost counting effect. When we derive a judgment $\Delta;\Psi;\Gamma\vdash M_{1}\ominus M_{2}\precsim n\colon\Phi$ in RelCost, the sound semantics ensures that the difference of cost counts by $M_{1}$ and $M_{2}$ is bound by $n$ .

A high-level view on these relational program logics is that they integrate the feature of measuring quantitative difference between computational effects into relational program logic. We are interested in extracting mathematical essence of this design and making relational program logics versatile. Towards this goal, we contribute the following development.

•

We introduce a structure called divergence on monad for measuring quantitative difference between computational effects (Section 4, 5). This generalizes various statistical divergences, such as Kullback-Leibler divergence and total variation distance on probability distributions. After exploring examples of divergence on monads, we introduce a method to transfer divergences on a monad to those on another monad through monad opfunctors.
•

The key structure to integrate divergences on monads and relational program logics is something called graded strong relational lifting of monads that extends given divergences. We present a general construction of such liftings from divergences on monads in Section 7. This generalization shows that the development of relational program logics with quantitative measurement on computational effects can be done with various combinations of monads and divergences on them.
•

We introduce a generic relational program logic (called acRL) over Moggi’s computational metalanguage (the simply-typed lambda calculus with monadic types) in Section 8. Inside acRL, we can use graded strong relational liftings constructed from divergences on a monad, and reason about relational properties of programs together with quantitative difference of computational effects. To illustrate how the reasoning works in acRL, we instantiate it with the computational metalanguage having effectful operations for continuous random sampling (Section 9) and cost counting operation (Section 10).

2 Preliminaries

We assume basic knowledge about category theory ([37]) and Moggi’s model of computational effects ([42]). The definition of monad [37, Chapter VI] and Kleisli category [37, Section VI.5] are omitted.

In this paper, a Cartesian category (CC for short) is specified by a category $\mathbb{C}$ with a designated final object $1$ and a binary product functor $(\times)\colon\mathbb{C}^{2}\to\mathbb{C}$ . The associated pairing operation and projection morphisms are denoted by $\langle-,-\rangle,\pi_{1},\pi_{2}$ , respectively. The unique morphism to the terminal object is denoted by $!_{I}:I\to 1$ . A Cartesian closed category (CCC for short) is a CC $(\mathbb{C},1,(\times))$ with a specified exponential functor $(\Rightarrow)\colon\mathbb{C}^{\mathrm{op}}\times\mathbb{C}\to\mathbb{C}$ . The associated evaluation morphism and currying operation is denoted by $\mathrm{ev},\lambda(-)$ respectively.

Let $(\mathbb{C},1,(\times))$ be a CC. A global element of $I\in\mathbb{C}$ is a morphism of type $1\rightarrow I$ . For a category $\mathbb{C}$ , we define the functor $U^{\mathbb{C}}:\mathbb{C}\to{\bf Set}$ by $U^{\mathbb{C}}=\mathbb{C}(1,-)$ . When $\mathbb{C}$ is obvious, $U^{\mathbb{C}}$ is denoted by $\mathbb{C}$ . Morphisms in $\mathbb{C}$ act on global elements by the composition. To emphasize this action, we introduce a dedicated notation $(\mathbin{\bullet})$ whose type is $\mathbb{C}(I,J)\times UI\to UJ$ . Of course, $f\mathbin{\bullet}x\triangleq f\circ x=(Uf)(x)$ . We also define the partial application of a binary morphism $f\colon I\times J\rightarrow K$ to a global element $i\in UI$ by $f_{i}\triangleq f\circ\langle i\circ!_{J},\operatorname{id}_{J}\rangle:J\to K$ . When $\mathbb{C}$ is a CCC, there is an evident isomorphism $\lfloor{-}\rfloor\colon U(I\Rightarrow J)\cong\mathbb{C}(I,J)$ . We write $\lceil{-}\rceil$ for its inverse.

A monad $(T,\eta,\mu)$ on a category $\mathbb{C}$ determines the operation $(-)^{\sharp}:\mathbb{C}(I,TJ)\to\mathbb{C}(TI,TJ)$ called Kleisli extension. It is defined by $f^{\sharp}\triangleq\mu_{J}\circ Tf$ . A monad may be given as a Kleisli triple [42, Definition 1.2]. A strong monad on a CC $(\mathbb{C},1,(\times))$ is a pair of a monad $(T,\eta,\mu)$ and a natural transformation $\theta_{I,J}\colon I\times TJ\to T(I\times J)$ called strength. It should satisfy four axioms; see [42, Definition 3.2] for detail.

In a CC-SM $(\mathbb{C},1,(\times),T,\eta,\mu,\theta)$ , the application of the strength to a global element can be expressed by the unit and the Kleisli extension of $T$ [42, Proof of Proposition 3.4]:

\theta_{I,J}\mathbin{\bullet}\langle i,c\rangle=((\eta_{I\times J})_{i})^{\sharp}\mathbin{\bullet}c\quad(i\in UI,c\in U(TJ)).

(1)

We will use this fact in Proposition 7 and Proposition 1.

There are plenty of examples of C(C)Cs. For the models of probabilistic computation, we will later use CC ${\bf Meas}$ of measurable spaces and CCC ${\bf QBS}$ of quasi-Borel spaces ([28]). Their definitions are deferred to Section 13.

2.1 Category of Binary Relations

We next introduce the category ${\bf BRel}(\mathbb{C})$ of binary relations over $\mathbb{C}$ -objects. This category is equivalent to subscones of $\mathbb{C}^{2}$ ([41]). It offers an underlying category for relational reasoning about programs interpreted in $\mathbb{C}$ .

•

An object in ${\bf BRel}(\mathbb{C})$ is a triple $(I_{1},I_{2},R)$ where $R\subseteq UI\times UJ$ .
•

A morphism from $(I_{1},I_{2},R)$ to $(J_{1},J_{2},S)$ in ${\bf BRel}(\mathbb{C})$ is a pair of $\mathbb{C}$ -morphisms $f_{1}\colon I_{1}\rightarrow J_{1}$ and $f_{2}\colon I_{2}\rightarrow J_{2}$ such that for any $(i_{1},i_{2})\in R$ , we have $(f_{1}\mathbin{\bullet}i_{1},f_{2}\mathbin{\bullet}i_{2})\in S$ .

When $X$ is a name of a ${\bf BRel}(\mathbb{C})$ -object, by $X_{1},X_{2}$ we mean its first and second component, and by $R_{X}$ we mean its third component; so $X=(X_{1},X_{2},R_{X})$ . By $(x_{1},x_{2})\in X$ we mean $(x_{1},x_{2})\in R_{X}$ . For objects $X,Y\in{\bf BRel}(\mathbb{C})$ and a morphism $(f_{1},f_{2})\colon(X_{1},X_{2})\to(Y_{1},Y_{2})$ in $\mathbb{C}^{2}$ , by

(f_{1},f_{2})\colon X\mathbin{\dot{\rightarrow}}Y

we mean that $(f_{1},f_{2})\in{\bf BRel}(\mathbb{C})(X,Y)$ , that is, for any $(x_{1},x_{2})\in X$ , we have $(f_{1}\mathbin{\bullet}x_{1},f_{2}\mathbin{\bullet}x_{2})\in Y$ . We say that $X\in{\bf BRel}(\mathbb{C})$ is an endorelation (over $I$ ) if $X_{1}=X_{2}(=I)$ .

We next define the forgetful functor $p_{\mathbb{C}}:{\bf BRel}(\mathbb{C})\to{\mathbb{C}}^{2}$ by

p_{\mathbb{C}}X\triangleq(X_{1},X_{2}),\quad p_{\mathbb{C}}(f_{1},f_{2})\triangleq(f_{1},f_{2}).

For $(I_{1},I_{2})\in\mathbb{C}^{2}$ , by ${\bf BRel}(\mathbb{C})_{(I_{1},I_{2})}$ we mean the complete boolean algebra $\{X\in{\bf BRel}(\mathbb{C})~{}|~{}X_{1}=I_{1}\wedge X_{2}=I_{2}\}$ with the order given by $X\leq Y\iff R_{X}\subseteq R_{Y}$ .

When $\mathbb{C}$ is a C(C)C, so is ${\bf BRel}(\mathbb{C})$ [41, Proposition 4.3]. We specify a final object, a binary product functor and an exponential functor (in case $\mathbb{C}$ is a CCC) on ${\bf BRel}(\mathbb{C})$ by:

	$\displaystyle\dot{1}$	$\displaystyle\triangleq(1,1,\{({\rm id}_{1},{\rm id}_{1})\})$
	$\displaystyle X\mathbin{\dot{\times}}Y$	$\displaystyle\triangleq(X_{1}\times Y_{1},X_{2}\times Y_{2},\{(\langle x_{1},y_{1}\rangle,\langle x_{2},y_{2}\rangle)~{}\|~{}(x_{1},x_{2})\in X,(y_{1},y_{2})\in Y\})$
	$\displaystyle X\mathbin{\dot{\Rightarrow}}Y$	$\displaystyle\triangleq(X_{1}\Rightarrow Y_{1},X_{2}\Rightarrow Y_{2},\{(f_{1},f_{2})~{}\|~{}\forall{(x_{1},x_{2})\in X}~{}.~{}(\mathrm{ev}\circ\langle f_{1},x_{1}\rangle,\mathrm{ev}\circ\langle f_{2},x_{2}\rangle)\in Y\}).$

3 Divergences on Objects

We introduce the concept of divergence on objects in a CC $\mathbb{C}$ . Major differences between divergence and metric are threefold: 1) it is defined over objects in $\mathbb{C}$ , 2) no axioms is imposed on it, and 3) it takes values in a partially ordered monoid called divergence domain, which we define below.

Definition 1.

A divergence domain $\mathcal{Q}=(Q,\leq,0,(+))$ is a partially ordered commutative monoid whose poset part is a complete lattice.

The monoid addition $(+)$ is only required to be monotone; no interaction with the sup / inf is required. We reserve the letter $\mathcal{Q}$ to denote a general divergence domain. Examples of divergence domains are:

$\displaystyle\mathcal{N}$	$\displaystyle=(\mathbb{N}\cup\{\infty\},\leq,0,(+)),$	$\displaystyle\mathcal{R}^{+}$	$\displaystyle=([0,\infty],\leq,0,(+)),$
$\displaystyle\mathcal{R}^{\times}$	$\displaystyle=([0,\infty],\leq,1,(\times)),$	$\displaystyle\mathcal{R}^{+}_{1}$	$\displaystyle=([0,\infty],\leq,0,\lambda{(p,q)}~{}.~{}p+q+pq),$
$\displaystyle\mathcal{Z}$	$\displaystyle=(\mathbb{Z}\cup\{\infty,-\infty\},\leq,0,(\mathbin{\bar{+}})),$	$\displaystyle\mathcal{R}$	$\displaystyle=([-\infty,\infty],\leq,0,(\mathbin{\bar{+}}))$

Here, $\mathbin{\bar{+}}$ is an extension of the addition by $r\mathbin{\bar{+}}(-\infty)=(-\infty)\mathbin{\bar{+}}r=-\infty$ .

Definition 2.

Let $\mathbb{C}$ be a CC. A $\mathcal{Q}$ -divergence on an object $I\in\mathbb{C}$ is a function $d\colon(UI)^{2}\to\mathcal{Q}$ .

A suitable notion of morphism between $\mathbb{C}$ -objects with divergences is nonexpansive morphism.

Definition 3.

Let $\mathbb{C}$ be a CC. We define the category ${\bf Div}_{\mathcal{Q}}({\mathbb{C}})$ of $\mathcal{Q}$ -divergences on $\mathbb{C}$ -objects and nonexpansive morphisms between them by the following data.

•

An object is a pair $(I,d)$ of an object $I\in\mathbb{C}$ and a $\mathcal{Q}$ -divergence $d$ on $I$ .
•

A morphism from $(I,d)$ to $(J,e)$ is a $\mathbb{C}$ -morphism $f\colon I\to J$ such that for any $x_{1},x_{2}\in UI$ , $e(f\mathbin{\bullet}x_{1},f\mathbin{\bullet}x_{2})\leq d(x_{1},x_{2})$ holds.

For an object $X\in{\bf Div}_{\mathcal{Q}}({\mathbb{C}})$ , by $d_{X}$ we mean its $\mathcal{Q}$ -divergence part. We also define the forgetful functor $V_{\mathcal{Q},\mathbb{C}}:{\bf Div}_{\mathcal{Q}}({\mathbb{C}})\to{\mathbb{C}}$ by $V_{\mathcal{Q},\mathbb{C}}(I,d)\triangleq I$ and $V_{\mathcal{Q},\mathbb{C}}(f)\triangleq f$ .

We remark that the forgetful functor $V_{\mathcal{Q},{\bf Set}}:{\bf Div}_{\mathcal{Q}}({{\bf Set}})\to{{\bf Set}}$ is a (Grothendieck) fibration, and the functor $\overline{U}\colon{\bf Div}_{\mathcal{Q}}({\mathbb{C}})\to{\bf Div}_{\mathcal{Q}}({{\bf Set}})$ defined by $\overline{U}(I,d)\triangleq(UI,d)$ and $\overline{U}(f)\triangleq f$ makes the following commutative square a pullback in ${\bf CAT}$ (the large category of categories and functors between them):

Therefore this pullback diagram asserts that $V_{\mathcal{Q},\mathbb{C}}:{\bf Div}_{\mathcal{Q}}({\mathbb{C}})\to{\mathbb{C}}$ arises from the change-of-base of the fibration $V_{\mathcal{Q},{\bf Set}}$ along the global section functor $U:\mathbb{C}\to{\bf Set}$ ([29]).

4 Divergences on Monads

We introduce the concept of divergence on monad as a quantitative measure of difference between computational effects. This is hinted from Barthe and Olmedo’s composable divergences on probability distributions ([13]). Divergences on monads are defined upon two extra data called grading monoid and basic endorelation.

Definition 4.

A grading monoid is a partially ordered monoid $(M,\leq,1,(\cdot))$ .

Definition 5.

A basic endorelation is a functor $E\colon\mathbb{C}\to{\bf BRel}(\mathbb{C})$ such that $EI$ is an endorelation on $I$ .

Grading monoids will be used when formulating $(\varepsilon,\delta)$ -differential privacy as a divergence on a monad. Basic endorelations specify which global elements are regarded as identical. Any CC $\mathbb{C}$ has at least two basic endorelations of equality relations and total relations:

\displaystyle{\color[rgb]{0,0,0}\mathrm{Eq}}I

\displaystyle\triangleq(I,I,\{(i,i)~{}|~{}i\in UI\})

\displaystyle{\color[rgb]{0,0,0}\mathrm{Top}}I

\displaystyle\triangleq(I,I,UI\times UI).

Other examples of basic endorelations can be found in concrete categories.

•

The category ${\bf Div}_{\mathcal{Q}}({\mathbb{C}})$ of $\mathcal{Q}$ -divergences on $\mathbb{C}$ -objects has a basic relation $E_{\delta}$ parameterized by $\delta\in\mathcal{Q}$ . It collects all pairs of global elements whose divergence is bound by $d$ . That is, $E_{\delta}(I,d)\triangleq(I,I,\{(x_{1},x_{2})~{}|~{}d(x_{1},x_{2})\leq\delta\})$ .
•

The category of preorders and monotone functions has the basic endorelation $E_{eq}$ collecting equivalent global elements: $E_{eq}(I,\leq)\triangleq(I,I,\{(x,y)~{}|~{}x\leq y\wedge y\leq x\})$ .

Definition 6.

Let $(\mathbb{C},1,(\times),T,\eta,\mu,\theta)$ be a CC-SM, $\mathcal{Q}$ be a divergence domain, $(M,\leq,1,(\cdot))$ be a grading monoid and $E\colon\mathbb{C}\to{\bf BRel}(\mathbb{C})$ be a basic endorelation. An $E$ -relative $M$ -graded $\mathcal{Q}$ -divergence (when $M=1$ , we drop “ $M$ -graded”) on the monad $T$ is a doubly-indexed family of $\mathcal{Q}$ -divergences ${\mathsf{\Delta}}=\{{\mathsf{\Delta}}^{m}_{I}\colon(U(TI))^{2}\to\mathcal{Q}\}_{m\in M,I\in\mathbb{C}}$ satisfying the following conditions:

Monotonicity

For any $m\leq m^{\prime}$ in $M$ , $I\in\mathbb{C}$ and $c_{1},c_{2}\in U(TI)$ ,

{\mathsf{\Delta}}^{m}_{I}(c_{1},c_{2})\geq{\mathsf{\Delta}}^{m^{\prime}}_{I}(c_{1},c_{2}).

$E$ -unit Reflexivity

For any $I\in\mathbb{C}$ ,

\sup_{(x_{1},x_{2})\in EI}{\mathsf{\Delta}}^{1}_{I}(\eta_{I}\mathbin{\bullet}x_{1},\eta_{I}\mathbin{\bullet}x_{2})\leq 0.

$E$ -composability

For any $m_{1},m_{2}\in M$ , $I,J\in\mathbb{C}$ , $c_{1},c_{2}\in U(TI)$ and $f_{1},f_{2}\colon I\to TJ$ ,

{\mathsf{\Delta}}^{m_{1}\cdot m_{2}}_{J}(f_{1}^{\sharp}\mathbin{\bullet}c_{1},f_{2}^{\sharp}\mathbin{\bullet}{c_{2}})\leq{\mathsf{\Delta}}^{m_{1}}_{I}(c_{1},c_{2})+\sup_{(x_{1},x_{2})\in EI}{\mathsf{\Delta}}^{m_{2}}_{J}(f_{1}\mathbin{\bullet}x_{1},f_{2}\mathbin{\bullet}x_{2}).

We write ${\bf Div}(T,E,M,\mathcal{Q})$ for the collection of $E$ -relative $M$ -graded $\mathcal{Q}$ -divergences on $T$ . We introduce a partial order $\preceq$ on ${\bf Div}(T,E,M,\mathcal{Q})$ by:

{\mathsf{\Delta}}_{1}\preceq{\mathsf{\Delta}}_{2}\iff\forall{m\in M,I\in\mathbb{C},c_{1},c_{2}\in U(TI)}~{}.~{}({\mathsf{\Delta}}_{1})^{m}_{I}(c_{1},c_{2})\geq({\mathsf{\Delta}}_{2})^{m}_{I}(c_{1},c_{2}).

The $E$ -composability condition is a generalization of the composability of differential privacy stated as [13, Theorem 1]. What is new in this paper is that 1) we introduce a condition on the monad unit ( $E$ -unit reflexivity), and that 2) the sup computed in $E$ -unit reflexivity and $E$ -composability scans global elements related by $E$ , while [13] only considers the case where $E={\color[rgb]{0,0,0}\mathrm{Eq}}$ . We will later show that both $E$ -unit reflexivity and $E$ -composability play an important role when connecting divergences, relational liftings of $T$ , and the monad structure of $T$ - these conditions are necessary and sufficient to construct strong graded relational liftings of $T$ satisfying fundamental property with respect to divergences (Proposition 2).

5 Examples of Divergences on Monads

5.1 Cost Difference for Deterministic Computations

To aid in understanding the $E$ -unit reflexivity and $E$ -composability conditions, we illustrate a few divergences on an elementary monad: the cost count monad $T=\mathbb{N}\times-$ on ${\bf Set}$ . Its unit and Kleisli extension are defined by

\displaystyle\eta_{I}(x)

\displaystyle\triangleq(0,x)

\displaystyle f^{\sharp}(i,x)

\displaystyle\triangleq(i+\pi_{1}(f(x)),\pi_{2}(f(x)))

\displaystyle(x\in I,i\in\mathbb{N},f\colon I\to TJ).

The monad $T$ can be used to record the cost incurred by deterministic computations. For instance, consider the quick sort algorithm $\mathsf{qsort}$ and the insertion sort algorithm $\mathsf{isort}$ , both of which are modified so that they tick a count whenever they compare two elements to be sorted. These two modified sort programs are interpreted as functions $[\![\mathsf{qsort}]\!],[\![\mathsf{isort}]\!]\colon\mathbb{N}^{*}\to T(\mathbb{N}^{*})$ , so that the first component of $[\![\mathsf{qsort}]\!](x)$ and that of $[\![\mathsf{isort}]\!](x)$ report the number of comparisons performed during sorting $x$ .

We first define an $\mathcal{N}$ -divergence $\mathsf{C}_{I}$ on $TI$ , for each $I\in{\bf Set}$ , by

{\mathsf{C}_{I}}{((i,x),(j,y))}\triangleq|i-j|.

This divergence $\mathsf{C}_{I}$ computes the difference of costs between two computations $(i,x),(j,y)\in TI$ , ignoring their return values. The family $\mathsf{C}=\{\mathsf{C}_{I}\}_{I\in{\bf Set}}$ forms a ${\color[rgb]{0,0,0}\mathrm{Top}}$ -relative $\mathcal{N}$ -divergence on $T$ . The ${\color[rgb]{0,0,0}\mathrm{Top}}$ -unit reflexivity of $\mathsf{C}$ means that the difference of costs between pure computations is zero:

\mathsf{C}_{I}(\eta_{I}(x),\eta_{I}(y))=\mathsf{C}_{I}((0,x),(0,y))=0.

The ${\color[rgb]{0,0,0}\mathrm{Top}}$ -composability of $\mathsf{C}$ says that we can limit the cost difference of two runs of programs $f^{\sharp}(i,x)$ and $g^{\sharp}(j,y)$ by the sum of cost difference of the preceding computations $(i,x),(j,y)$ and that of two programs $f,g\colon I\to TJ$ . The latter is measured by taking the sup of cost difference of $f(x)$ and $g(y)$ , where $(x,y)$ range over the basic endorelation ${\color[rgb]{0,0,0}\mathrm{Top}}I$ .

	$\displaystyle\mathsf{C}_{I}(f^{\sharp}(i,x),g^{\sharp}(j,y))$	$\displaystyle=\mathsf{C}_{I}(i+\pi_{1}(f(x)),\pi_{2}(f(x)),j+\pi_{1}(g(y)),\pi_{2}(g(y)))$
		$\displaystyle\leq\|i-j\|+\sup_{x,y\in I}\|\pi_{1}(f(x))-\pi_{1}(g(y))\|$
		$\displaystyle=\mathsf{C}_{I}((i,x),(j,y))+\sup_{(x,y)\in{\color[rgb]{0,0,0}\mathrm{Top}}I}\mathsf{C}_{J}(f(x),g(y)).$

We remark that $\mathsf{C}$ is not an ${\color[rgb]{0,0,0}\mathrm{Eq}}$ -relative $\mathcal{N}$ -divergence on $T$ because the ${\color[rgb]{0,0,0}\mathrm{Eq}}$ -composability fails: when $f(x)=(0,w)$ , $f(y)=(1,w)$ and $f(z)=(0,v)$ (for $z\neq x,y$ ) we have $\mathsf{C}_{I}((0,x),(0,y))=0$ and $\sup_{(x,y)\in{\color[rgb]{0,0,0}\mathrm{Eq}}I}\mathsf{C}_{J}(f(x),f(y))=0$ , but we have $\mathsf{C}_{J}(f^{\sharp}(0,x),f^{\sharp}(0,y))=\mathsf{C}_{J}((0,w),(1,w))=1$ .

Alternatively, we may consider the following $\mathcal{N}$ -divergence $\mathsf{C}^{\prime}_{I}$ on $TI$ for each $I\in{\bf Set}$ :

\mathsf{C}^{\prime}_{I}((i,x),(j,y))\triangleq\begin{cases}|i-j|&x=y\\ \infty&x\neq y\end{cases}.

This divergence is sensitive on return values of computations. When return values of two computations agree, $\mathsf{C}^{\prime}$ measures the cost difference as done in $\mathsf{C}$ , but when they do not agree, the cost difference is judged as $\infty$ . This divergence is an ${\color[rgb]{0,0,0}\mathrm{Eq}}$ -relative $\mathcal{N}$ -divergence on $T$ .

5.2 Cost Difference for Nondeterministic Computations

Deterministic and nondeterministic computations with cost counting can be respectively modeled by the monads $(\mathbb{N}\times-)$ and $P(\mathbb{N}\times-)$ on ${\bf Set}$ .

We define the divergences for cost difference as in Table 1. These divergences extract the upper bound of cost difference between two computations. The divergences $\mathsf{C}$ and $\mathsf{NC}$ measure the usual distance of costs for deterministic and nondeterministic computations respectively. The divergence $\mathsf{NCI}$ measures the subtraction of costs of two nondeterministic computations. For results of two nondeterministic computations $A,B\in P(\mathbb{N}\times I)$ , the divergence $\mathsf{NCI}_{I}(A,B)$ is an upper bound of $i-j$ for all possible choices of $(i,x)\in A$ and $(j,y)\in B$ , where a lower bound of $i-j$ is also given by $-\mathsf{NCI}_{I}(B,A)$ . The same idea to measure the difference of costs between two programs by subtraction also appears in ([18, 47]). If either $A$ or $B$ is empty, we fail to get an information of costs. We then have $\mathsf{NCI}_{I}(A,B)=-\infty$ . On the other hand, if both $A$ and $B$ are not empty, their cost intervals are defined by

[l_{A},h_{A}]\triangleq[\inf_{(i,x)\in A}i,\sup_{(i,x)\in A}i],\qquad[l_{B},h_{B}]\triangleq[\inf_{(j,y)\in B}j,\sup_{(j,y)\in B}j].

We then have $\mathsf{NCI}_{I}(A,B)=h_{A}-l_{B}$ and $-\mathsf{NCI}_{I}(B,A)=l_{A}-h_{B}$ .

Table 1: (

1

-graded)

{\color[rgb]{0,0,0}\mathrm{Top}}

-relative

Q

-divergences for cost counting monads

${\mathsf{\Delta}}\in{\bf Div}(T,{\color[rgb]{0,0,0}\mathrm{Top}},1,\mathcal{Q})$	$T$	$\mathcal{Q}$	Definition of ${{\mathsf{\Delta}}_{I}}(c_{1},c_{2})$
$\mathsf{C}$	$\mathbb{N}\times-$	$\mathcal{N}$	${\mathsf{C}_{I}}{((i,x),(j,y))}=\|i-j\|$
$\mathsf{NC}$	$P(\mathbb{N}\times-)$	$\mathcal{N}$	${\mathsf{NC}_{I}}{(A,B)}=\sup_{(i,x)\in A,(j,y)\in B}\|i-j\|$
$\mathsf{NCI}$	$P(\mathbb{N}\times-)$	$\mathcal{Z}$	$\mathsf{NCI}_{I}(A,B)=\sup_{(i,x)\in A,(j,y)\in B}i-j$

5.3 Divergences for Differential Privacy

Differential privacy (DP for short) is a quantitative definition of privacy of randomized queries in databases. DP is based on the idea of noise-adding anonymization against background-knowledge attacks. In the study of DP, a query is modeled by a measurable function $c\colon I\to GJ$ , where $I$ and $J$ are measurable spaces of inputs and outputs respectively, and $GJ$ is the measurable space of all probability measures over $J$ ; here $G$ itself refers to the Giry monad ([26]; see also Section 13).

Definition 7 (Differential Privacy, ([21])).

Let $c\colon I\to GJ$ be a morphism in ${\bf Meas}$ , representing a randomized query. The query $c$ satisfies $(\varepsilon,\delta)$ -differential privacy ( $\epsilon,\delta\geq 0$ are reals) if for any adjacent datasets $(d_{1},d_{2})\in R_{\mathrm{adj}}$ ¹¹1 Strictly speaking, differential privacy depends on the definition of adjacency of datasets. The adjacency relation $R_{\mathrm{adj}}$ is usually defined as $\{(d_{1},d_{2})|\rho(d_{1},d_{2})\leq 1\}$ with a metric $\rho$ over $I$ ., the following holds:

\forall S\subseteq_{\mathrm{measurable}}J.~{}\Pr[c(d_{1})\in S]\leq\exp(\varepsilon)\Pr[c(d_{2})\in S]+\delta.

To express this definition in terms of divergence on monad, we introduce a doubly-indexed family of $\mathcal{R}^{+}$ -divergence $\mathsf{DP}=\{\mathsf{DP}_{J}^{\varepsilon}\}_{\varepsilon\in[0,\infty],J\in{\bf Meas}}$ on $GJ$ by

\mathsf{DP}_{J}^{\varepsilon}(\mu_{1},\mu_{2})\triangleq\sup_{S\in\Sigma_{J}}(\mu_{1}(S)-\exp(\varepsilon)\mu_{2}(S))\quad(\mu_{1},\mu_{2}\in GJ).

Then the query $c\colon I\to GJ$ satisfies $(\varepsilon,\delta)$ -DP if and only if

\forall{(d_{1},d_{2})\in R_{\mathrm{adj}}}~{}.~{}\mathsf{DP}_{J}^{\varepsilon}(c(d_{1}),c(d_{2}))\leq\delta.

The pair $(\varepsilon,\delta)$ indicates the difference between output probability distributions $c(d_{1})$ and $c(d_{2})$ of the query $c$ for given datasets $d_{1}$ and $d_{2}$ . Intuitively, the parameter $\varepsilon$ is an upper bound of the ratio $\Pr[c(d_{1})=s]/\Pr[c(d_{2})=s]$ of probabilities which indicates the leakage of privacy. If $\varepsilon$ is large, attackers can distinguish the datasets $d_{1}$ and $d_{2}$ from the outputs of the query $c$ . The parameter $\delta$ is the probability of failure of privacy protection.

The family $\mathsf{DP}$ forms an ${\color[rgb]{0,0,0}\mathrm{Eq}}$ -relative $\mathcal{R}^{+}$ -graded $\mathcal{R}^{+}$ -divergence on the Giry monad $G$ [52, Lemma 6]. This is proved by extending the composability of the divergence for DP on discrete probability distributions shown as [12, Lemmas 3 and 6] and [13, Proposition 5], based on the composition theorem of DP [22, Section 3.5].

The conditions in Definition 6 on $\mathsf{DP}$ corresponds to the following basic properties of DP:

(monotonicity)

The monotonicity of $\mathsf{DP}$ corresponds to weakening the differential privacy of queries: if $c$ satisfies $(\varepsilon,\delta)$ -DP and $\varepsilon\leq\varepsilon^{\prime}$ and $\delta\leq\delta^{\prime}$ holds, then $c$ satisfies $(\varepsilon^{\prime},\delta^{\prime})$ -DP.

( ${\color[rgb]{0,0,0}\mathrm{Eq}}$ -unit reflexivity)

The ${\color[rgb]{0,0,0}\mathrm{Eq}}$ -unit reflexivity of $\mathsf{DP}$ implies $\mathsf{DP}_{J}^{0}(\eta_{J}\circ h(x),\eta_{J}\circ h(x))=0$ for any measurable function $h\colon I\to J$ and $x\in I$ . This, together with the composability below, ensures the robustness of DP of a query $c\colon I\to GJ$ with respect to deterministic postprocessing:

\forall{h:J\to K}~{}.~{}\text{$c$ is $(\epsilon,\delta)$-DP}\implies\text{$Gh\circ c$ is $(\epsilon,\delta)$-DP}.

(2)

In fact, the divergence $\mathsf{DP}$ is reflexive: we have $\mathsf{DP}_{J}^{0}(\mu,\mu)=0$ for every $\mu\in GJ$ . Therefore $h\colon J\to K$ and $Gh$ in (2) can be replaced by $h\colon J\to GK$ and $h^{\sharp}$ ; the replaced condition states the robustness of DP of a query with respect to probabilistic postprocessing.

( ${\color[rgb]{0,0,0}\mathrm{Eq}}$ -composability)

The ${\color[rgb]{0,0,0}\mathrm{Eq}}$ -composability of $\mathsf{DP}$ corresponds to the known property of DP called the sequential composition theorem ([22]). If $c_{1}\colon I\to GJ^{\prime}$ and $c_{2}\colon J^{\prime}\to GJ$ are $(\varepsilon_{1},\delta_{1})$ -DP and $(\varepsilon_{2},\delta_{2})$ -DP respectively, then the sequential composition $c_{2}^{\sharp}\circ c_{1}\colon I\to GJ$ of the queries $c_{1}$ and $c_{2}$ is $(\varepsilon_{1}+\varepsilon_{2},\delta_{1}+\delta_{2})$ -DP.

A Non-Example: Pointwise Differential Privacy.

We stated above that a parameter $(\varepsilon,\delta)$ of DP intuitively gives an upper bound of the probability ratio $\Pr[c(d_{1})=s]/\Pr[c(d_{2})=s]$ and the probability of failure of privacy protection. However, strictly speaking, there is a gap between the definition of $(\varepsilon,\delta)$ -DP and this intuition of $\varepsilon$ and $\delta$ . Pointwise differential privacy ([46, Definition 3.2] and [27, Proposition 1.2.3]) is a finer definition of DP that is faithful to the intuition.

Definition 8.

A measurable function $c\colon I\to GJ$ (regarded as a query) is pointwise $(\varepsilon,\delta)$ -differentially private if whenever $d_{1}$ and $d_{2}$ are adjacent, for some $A\in\Sigma_{J}$ with $\Pr[c(d_{1})\notin A]\leq\delta$ , we have

\forall s\in A.~{}\Pr[c(d_{1})=s]\leq\exp(\varepsilon)\Pr[c(d_{2})=s],

which is equivalent to ²²2 Remark that $\Pr[c(d_{1})=s]$ and $\Pr[c(d_{2})=s]$ are Radon-Nikodym derivatives of $c(d_{1})$ and $c(d_{2})$ with respect to a measure $\nu$ such that $c(d_{1}),c(d_{2})\ll\nu$ . [ $\implies$ ] Obvious. [ $\impliedby$ ] By Radon-Nikodym theorem we can take the Radon-Nikodym derivatives $\Pr[c(d_{1})=s]$ and $\Pr[c(d_{2})=s]$ with respect to $\nu=c(d_{1})+c(d_{2})$ . The inequality does not depend on the choice of $\nu$ .

\forall S\subseteq_{\mathrm{measurable}}A.~{}\Pr[c(d_{1})\in S]\leq\exp(\varepsilon)\Pr[c(d_{2})\in S].

To express this definition in terms of divergence on monad, we introduce a doubly-indexed family of $\mathcal{R}^{+}$ -divergences $\mathsf{pwDP}=\{\mathsf{pwDP}_{J}^{\varepsilon}\}_{\varepsilon\in\mathcal{R}^{+},J\in{\bf Meas}}$ called pointwise indistinguishability:

\mathsf{pwDP}_{J}^{\varepsilon}(\mu_{1},\mu_{2})\triangleq\inf\left\{\mu_{1}(J\setminus A)~{}|~{}A\in\Sigma_{X}\wedge(\forall{S\in\Sigma_{J}}.S\subseteq A\implies\mu_{1}(S)\leq\exp(\varepsilon)\mu_{2}(S))\right\}.

Then $c\colon I\to GJ$ is pointwise $(\varepsilon,\delta)$ -differentially private if and only if

\forall{(d_{1},d_{2})\in R_{\mathrm{adj}}}~{}.~{}\mathsf{pwDP}_{J}^{\varepsilon}(c(d_{1}),c(d_{2}))\leq\delta.

The family $\mathsf{pwDP}$ is obviously reflexive: $\mathsf{pwDP}_{J}^{\varepsilon}(\mu,\mu)=0$ holds for any $\mu\in GJ$ and $\varepsilon\geq 0$ . Hence it is ${\color[rgb]{0,0,0}\mathrm{Eq}}$ -unit reflexive too. However, it is not ${\color[rgb]{0,0,0}\mathrm{Eq}}$ -composable. We let $3=\{0,1,2\}$ and $2=\{0,1\}$ be discrete spaces, and let $\alpha=\exp(\varepsilon)$ . We define two probability distributions $\mu_{1},\mu_{2}\in G3$ by

\mu_{1}\triangleq\frac{1}{10}\mathbf{d}_{0}+\frac{9}{10}\mathbf{d}_{1},\qquad\mu_{2}\triangleq\frac{9}{10\alpha}\mathbf{d}_{1}+(1-\frac{9}{10\alpha})\mathbf{d}_{2}.

We then have $\mathsf{pwDP}_{3}^{\varepsilon}(\mu_{1},\mu_{2})=\frac{1}{10}$ with $A=\{1,2\}$ since $\frac{1}{10}>\exp(\varepsilon)\cdot 0$ , $\frac{9}{10}\leq\exp(\varepsilon)\cdot\frac{9}{10\alpha}$ , and $0\leq\exp(\varepsilon)\cdot(1-\frac{9}{10\alpha})$ . Next, we define $f\colon 3\to G2$ by

f(0)\triangleq\frac{1}{10}\mathbf{d}_{0}+\frac{9}{10}\mathbf{d}_{1},\quad f(1)\triangleq\frac{9}{10}\mathbf{d}_{0}+\frac{1}{10}\mathbf{d}_{1},\quad f(2)\triangleq\mathbf{d}_{1}.

We then calculate

f^{\sharp}(\mu_{1})=\frac{82}{100}\mathbf{d}_{0}+\frac{18}{100}\mathbf{d}_{1},\quad f^{\sharp}(\mu_{2})=\frac{81}{100\alpha}\mathbf{d}_{0}+(\frac{100\alpha-90+9}{100\alpha})\mathbf{d}_{1}.

Then, we obtain $\mathsf{pwDP}_{2}^{\varepsilon}(f^{\sharp}(\mu_{1}),f^{\sharp}(\mu_{2}))=\frac{82}{100}$ with $A=\{0\}$ since $\frac{82}{100}>\exp(\varepsilon)\frac{81}{100\alpha}$ . Hence $\mathsf{pwDP}_{2}^{\varepsilon}(f^{\sharp}(\mu_{1}),f^{\sharp}(\mu_{2}))=\frac{82}{100}>\frac{1}{10}=\mathsf{pwDP}_{3}^{\varepsilon}(\mu_{1},\mu_{2})$ . Thus $\mathsf{pwDP}$ is not ${\color[rgb]{0,0,0}\mathrm{Eq}}$ -composable, because by the reflexivity of $\mathsf{pwDP}$ , we have $\sup_{(x,y)\in{\color[rgb]{0,0,0}\mathrm{Eq}}_{3}}\mathsf{pwDP}^{0}(f(x),f(y))=0$ .

Various Relaxations of Differential Privacy

Since the seminal work on DP by [21], various relaxations of differential privacy have been proposed: Rényi DP ([40]), zero-concentrated DP ([17]) and truncated zero-concentrated DP ([16]). They give tighter bounds of differential privacy. These relaxations of differential privacy can be expressed by suitable divergences on the Giry monad $G$ and sub-Giry monad $G_{s}$ ; see Table 2 for their definitions. There, $\alpha,w\in(1,\infty)$ are non-grading parameters for $\mathsf{Re}$ and $\mathsf{tCDP}$ . Each row of the table represents that ${\mathsf{\Delta}}$ is an ${\color[rgb]{0,0,0}\mathrm{Eq}}{}$ -relative $\mathcal{Q}$ - (resp. $\mathcal{Q}_{s}$ -) divergences on $G$ (resp. $G_{s}$ ), and the definition of ${\mathsf{\Delta}}_{I}(\mu_{1},\mu_{2})$ follows.

Table 2:

{\color[rgb]{0,0,0}\mathrm{Eq}}{}

-relative

M

-graded

\mathcal{Q}

- (

\mathcal{Q}_{s}

-)divergences on

G

(

G_{s}

)

${\mathsf{\Delta}}$	$M$	$\mathcal{Q}$	$\mathcal{Q}_{s}$	Definition of ${{\mathsf{\Delta}}^{m}_{I}}(\mu_{1},\mu_{2})$	Composability proof
$\mathsf{DP}$	$\mathcal{R}^{+}$	$\mathcal{R}^{+}$	$\mathcal{R}^{+}$	$\sup_{S\in\Sigma_{I}}(\mu_{1}(S)-\exp(\varepsilon)\mu_{2}(S))$	([13])
${}^{\alpha}\mathsf{Re}$	1	$\mathcal{R}^{+}$	$\mathcal{R}$	$\frac{1}{\alpha-1}\log\int_{I}\left(\frac{\mu_{1}(x)}{\mu_{2}(x)}\right)^{\alpha}\mu_{2}(x)~{}dx.$	([40])
$\mathsf{zCDP}$	$\mathcal{R}^{+}$	$\mathcal{R}^{+}$	$\mathcal{R}$	$\sup_{1<\alpha}\frac{1}{\alpha}({}^{\alpha}\mathsf{Re}_{I}(\mu_{1},\mu_{2})-m)$	([17])
${}^{w}\mathsf{tCDP}$	1	$\mathcal{R}^{+}$	$\mathcal{R}$	$\sup_{1<\alpha<w}\frac{1}{\alpha}({}^{\alpha}\mathsf{Re}_{I}(\mu_{1},\mu_{2}))$	([16])

5.4 Statistical Divergences and Composablity of $f$ -Divergences

Apart from differential privacy, various distances between (sub-)probability distributions are introduced in probability theory. They are called statistical divergences. Examples include: total variation distance $\mathsf{TV}$ , Hellinger distance $\mathsf{HD}$ , Kullback-Leibler divergence $\mathsf{KL}$ , and $\chi^{2}$ -divergence $\mathsf{Chi}$ ; they are defined in Table 3. These statistical divergences are ${\color[rgb]{0,0,0}\mathrm{Eq}}$ -relative divergences on the Giry monad $G$ (and $G_{s}$ for $\mathsf{TV}$ ); see the same table for their divergence domains. Question marks in the column of $\mathcal{Q}_{s}$ means that we do not know with which monoid structure the ${\color[rgb]{0,0,0}\mathrm{Eq}}$ -composability holds. We remark that these divergences are also reflexive, that is, ${\mathsf{\Delta}}(c,c)=0$ . ${\color[rgb]{0,0,0}\mathrm{Eq}}$ -composability of these divergences in discrete form are proved in ([13, 45]). Later, [52] extends their results to the composability of divergences in continuous form.

Table 3: Statistical divergences that are

{\color[rgb]{0,0,0}\mathrm{Eq}}{}

-relative

\mathcal{Q}

- (resp.

\mathcal{Q}_{s}

-) divergences on

G

(resp.

G_{s}

)

Name	${\mathsf{\Delta}}$	$\mathcal{Q}$	$\mathcal{Q}_{s}$	Definition of ${{\mathsf{\Delta}}^{m}_{I}}(\mu_{1},\mu_{2})$
Total variation distance	$\mathsf{TV}$	$\mathcal{R}^{+}$	$\mathcal{R}^{+}$	$\frac{1}{2}\int_{I}\|\mu_{1}(x)-\mu_{2}(x)\|~{}dx$
Kullback-Leibler divergence	$\mathsf{KL}$	$\mathcal{R}^{+}$	?	$\int_{I}\mu_{1}(x)\log\left(\frac{\mu_{1}(x)}{\mu_{2}(x)}\right)~{}dx$
Hellinger distance	$\mathsf{HD}$	$\mathcal{R}^{+}$	?	$\frac{1}{2}\int_{I}\left(\sqrt{\mu_{1}(x)}-\sqrt{\mu_{2}(x)}\right)^{2}~{}dx$
$\chi^{2}$ -divergence	$\mathsf{Chi}$	$\mathcal{R}^{+}_{1}$	?	$\int_{I}\frac{(\mu_{1}(x)-\mu_{2}(x))^{2}}{\mu_{2}(x)}~{}dx$

Each of four divergences in Table 3 can be expressed as an $f$ -divergence ${}^{f}\mathsf{Div}$ ([19, 20, 43]):

{}^{f}\mathsf{Div}_{I}(\mu_{1},\mu_{2})\triangleq\int_{I}\mu_{2}(x)f\left(\frac{\mu_{1}(x)}{\mu_{2}(x)}\right)dx.

Here, $f$ is a parameter called weight function, and has to be a convex function $f\colon[0,\infty)\to\mathbb{R}$ , continuous at $0$ and satisfying $\lim_{x\to+0}xf(x)=0$ . Weight functions for four divergences $\mathsf{TV},\mathsf{KL},\mathsf{HD},\mathsf{Chi}$ are in Table 4. In fact, $\mathsf{DP}^{\varepsilon}$ is also an $f$ -divergence with weight function $f(t)=\max(0,t-\exp(\varepsilon))$ ; see [13, Proposition 2]. We also remark that Rényi divergence ${}^{\alpha}\mathsf{Re}$ of order $\alpha$ is the logarithm of the $f$ -divergence with weight function $f(t)=t^{\alpha}$ .

$f$ -divergences have several nice properties such as reflexivity, postprocessing inequality, joint-convexity, duality and continuity ([20, 35]). However, the ${\color[rgb]{0,0,0}\mathrm{Eq}}$ -composability of $f$ -divergences is not guaranteed in general. Here we provide a sufficient condition for the ${\color[rgb]{0,0,0}\mathrm{Eq}}$ -composability of ${}^{f}\mathsf{Div}$ over a specific form of divergence domain.

Proposition 1.

Let $\gamma\geq 0$ be a nonnegative real number, $\mathcal{R}^{+}_{\gamma}=([0,\infty],\leq,0,\lambda{(p,q)}~{}.~{}p+q+\gamma pq)$ be the divergence domain, and $f$ be a weight function such that $f\geq 0$ and $f(1)=0$ . If there exists $\alpha,\beta,\beta^{\prime}\in\mathbb{R}$ such that, for all $x,y,z,w\in[0,1]$ , the following hold (suppose $0f(0/0)=0$ ):

	$\displaystyle 0$	$\displaystyle\leq(\beta^{\prime}z+(1-\beta^{\prime})x)+\gamma xf\left({z}/{x}\right)$
	$\displaystyle xyf\left({zw}/{xy}\right)$	$\displaystyle\leq(\beta w+(1-\beta)y)xf\left({z}/{x}\right)+(\beta^{\prime}z+(1-\beta^{\prime})x)yf\left({w}/{y}\right)$
		$\displaystyle\quad+\gamma xyf\left({z}/{x}\right)f\left({w}/{y}\right)+\alpha(x-z)(w-y),$

then ${}^{f}\mathsf{Div}$ is an ${\color[rgb]{0,0,0}\mathrm{Eq}}{}$ -relative $\mathcal{R}^{+}_{\gamma}$ -divergence on the Giry monad $G$ . When $\alpha=0$ and $\beta,\beta^{\prime}\in[0,1]$ , $G$ can be replaced with the sub-Giry monad $G_{s}$ .

The proof of this proposition generalizes and integrates the proofs given in [45, Section 5.A.2]. This proposition is applicable to prove the composability of divergences in Table 3 by choosing suitable parameters; see Table 4.

Table 4: Parameters for Proposition 1

${}^{f}\mathsf{Div}$	Weight function $f$	$\gamma$	$\alpha$	$\beta$	$\beta^{\prime}$
$\mathsf{TV}$	$f(t)=\|t-1\|/2$	$0$	$0$	$1$	$0$
$\mathsf{KL}$	$f(t)=f\log(t)-t+1$	$0$	$-1$	$1$	$1$
$\mathsf{HD}$	$f(t)=(\sqrt{t}-1)^{2}/2$	$0$	$-1/4$	$1/2$	$1/2$
$\mathsf{Chi}$	$f(t)=(t-1)^{2}/2$	$1$	$-2$	$2$	$2$

5.5 Divergences on the Probability Monad on QBS via Monad Opfunctors.

We have seen various divergences on the Giry monad $G$ . It would be nice if they are transferred to the probability monad $P$ on ${\bf QBS}$ (Section 13). For this, we first develop a generic method for transferring divergences on monads.

Let $(\mathbb{C},S)$ and $(\mathbb{D},T)$ be two CC-SMs. A monad opfunctor [53, Section 4] is a functor $p\colon\mathbb{C}\to\mathbb{D}$ together with a natural transformation $\lambda\colon p\circ S\to T\circ p$ making the following diagrams commute:

Proposition 2.

Let $(\mathbb{C},S),(\mathbb{D},T)$ be two CC-SMs, $(p\colon\mathbb{C}\to\mathbb{D},\lambda\colon p\circ S\to T\circ p)$ be a monad opfunctor, and assume that $U^{\mathbb{D}}\circ p=U^{\mathbb{C}}$ holds, and basic endorelations $F\colon\mathbb{C}\to{\bf BRel}(\mathbb{C})$ and $E\colon\mathbb{D}\to{\bf BRel}(\mathbb{D})$ satisfy $R_{FpI}=R_{EI}$ for all $I\in\mathbb{C}$ (we here use $U^{\mathbb{D}}\circ p=U^{\mathbb{C}}$ ). Then for any ${\mathsf{\Delta}}\in{\bf Div}(T,E,M,\mathcal{Q})$ , the following doubly-indexed family of $\mathcal{Q}$ -divergences $\langle{p,\lambda}\rangle^{*}{\mathsf{\Delta}}=\{(\langle{p,\lambda}\rangle^{*}{\mathsf{\Delta}})^{m}_{I}\}_{m\in M,I\in\mathbb{C}}$ on $SI$ is an $F$ -relative $M$ -graded $\mathcal{Q}$ -divergence on $S$ :

\displaystyle(\langle{p,\lambda}\rangle^{*}{\mathsf{\Delta}})^{m}_{I}(\nu_{1},\nu_{2})

\displaystyle\triangleq{\mathsf{\Delta}}^{m}_{pI}(\lambda_{I}\mathbin{\bullet}\nu_{1},\lambda_{I}\mathbin{\bullet}\nu_{2})={\mathsf{\Delta}}^{m}_{pI}((U^{\mathbb{D}}\lambda_{I})(\nu_{1}),(U^{\mathbb{D}}\lambda_{I})(\nu_{2})).

The left adjoint $L\colon{\bf QBS}\to{\bf Meas}$ of the adjunction $L\dashv K\colon{\bf Meas}\rightarrow{\bf QBS}$ and the natural transformation $l\colon LP\Rightarrow GL$ defined by $l_{X}([\alpha,\mu]_{\sim_{X}})=\mu(\alpha^{-1}(-))$ forms a monad opfunctor from the probability monad $P$ on ${\bf QBS}$ to the Giry monad $G$ on ${\bf Meas}$ [28, Prop. 22 (3)]. Through this monad opfunctor $(L,l)$ , we can convert ${\color[rgb]{0,0,0}\mathrm{Eq}}{}$ -divergences on $G$ to those on $P$ . This conversion can be applied to all the statistical divergences in Table 2 and 3.

In addition, for any standard Borel space, we can view such converted divergences $\langle{L,l}\rangle^{*}{\mathsf{\Delta}}$ as the same thing as the original ${\mathsf{\Delta}}$ . When $\Omega\in{\bf Meas}$ is standard Borel, we have an equality $LK\Omega=\Omega$ , and $l_{K\Omega}$ is an isomorphism. Therefore we obtain an isomorphism $l_{K\Omega}\colon LPK\Omega\cong GLK\Omega=G\Omega$ [28, Prop. 22 (4)]. A concrete description of its inverse is $l_{K\Omega}^{-1}\mathbin{\bullet}\mu=[\gamma^{\prime},\mu(\gamma^{-1}(-))]_{\sim_{K\Omega}}$ , where $\gamma^{\prime}\colon\mathbb{R}\to\Omega$ and $\gamma\colon\Omega\to\mathbb{R}$ are a section-retraction pair (i.e. $\gamma^{\prime}\circ\gamma=\mathrm{id}_{\Omega}$ ) that exists for any standard Borel $\Omega$ .

Theorem 1.

For any ${\mathsf{\Delta}}\in{\bf Div}(G,{\color[rgb]{0,0,0}\mathrm{Eq}},M,\mathcal{Q})$ and standard Borel $\Omega\in{\bf Meas}$ ,

(\langle{L,l}\rangle^{*}{\mathsf{\Delta}})^{m}_{K\Omega}(l_{K\Omega}^{-1}\mathbin{\bullet}\mu_{1},l_{K\Omega}^{-1}\mathbin{\bullet}\mu_{2})={\mathsf{\Delta}}^{m}_{\Omega}(\mu_{1},\mu_{2})\quad(\mu_{1},\mu_{2}\in U(G\Omega)).

5.6 Divergences on State Monads

The state monad $T_{S}\triangleq S\Rightarrow(-\times S)$ with a state space $S$ is used to represent programs that update the state. We construct divergences on $T_{S}$ using divergences $d_{S}$ on the state space $S$ in several ways.

5.6.1 Lipschitz Constant on States

We first consider the state monad $T_{S}$ on ${\bf Set}$ . We also consider a function $d_{S}\colon S^{2}\to[0,\infty]$ satisfying $d_{S}(s,s)=0$ . The following $\mathcal{R}^{\times}$ -divergence ${\mathsf{\Delta}}^{\mathsf{lip},d_{S}}_{I}(f_{1},f_{2})$ on $T_{S}I$ measures how much the function pair $(\pi_{2}\circ f_{1},\pi_{2}\circ f_{2})$ extends the distance between two states before updated. In short, ${\mathsf{\Delta}}^{\mathsf{lip},d_{S}}$ measures the Lipschitz constant on state transformers.

Proposition 3.

The family ${\mathsf{\Delta}}^{\mathsf{lip},d_{S}}=\{{\mathsf{\Delta}}^{\mathsf{lip},d_{S}}_{I}\}_{I\in{\bf Set}}$ of $\mathcal{R}^{\times}$ -divergences on $T_{S}I$ defined by

{\mathsf{\Delta}}^{\mathsf{lip},d_{S}}_{I}(f_{1},f_{2})\triangleq\sup_{s_{1},s_{2}\in S}\frac{d_{S}(\pi_{2}(f_{1}(s_{1})),\pi_{2}(f_{2}(s_{2})))}{d_{S}(s_{1},s_{2})}\quad(f_{1},f_{2}\in T_{S}I,\text{ we suppose }0/0=1)

is a ${\color[rgb]{0,0,0}\mathrm{Top}}$ -relative $\mathcal{R}^{\times}$ -divergence on $T_{S}$ .

For state transformers $f_{1},f_{2}\in T_{S}I$ , their state-updating part is given as functions $\pi_{2}\circ f_{1},\pi_{2}\circ f_{2}\in S\Rightarrow S$ . When $f_{1}=f_{2}=g$ , ${\mathsf{\Delta}}^{\mathsf{lip},d_{S}}_{I}(g,g)$ is exactly the Lipschitz constant of $\pi_{2}\circ g$ .

5.6.2 Distance between State Transformers with the Same Inputs

Suppose that the function $d_{S}$ also satisfies the triangle inequality. The following $\mathcal{R}^{+}$ -divergence ${\mathsf{\Delta}}^{\mathsf{met},d_{S}}_{I}(f_{1},f_{2})$ on $T_{S}I$ estimates the distance between updated states after the state transformers $f_{1}$ and $f_{2}$ are applied to the same input.

Proposition 4.

Suppose that the function $d_{S}$ also satisfy the triangle-inequality. The family ${\mathsf{\Delta}}^{\mathsf{met},d_{S}}=\{{\mathsf{\Delta}}^{\mathsf{met},d_{S}}_{I}\}_{I\in{\bf Set}}$ of $\mathcal{R}^{+}$ -divergences on $T_{S}I$ defined by:

\displaystyle{\mathsf{\Delta}}^{\mathsf{met},d_{S}}_{I}(f_{1},f_{2})

\displaystyle\triangleq\begin{cases}\sup_{s\in S}\!d_{S}(\pi_{2}(f_{1}(s)),\pi_{2}(f_{2}(s)))&\pi_{1}\circ f_{1}=\pi_{1}\circ f_{2}~{}\text{and}\\ &\pi_{2}\circ f_{1},\pi_{2}\circ f_{2}\colon\text{nonexpansive}\\ \infty&\text{otherwise}\end{cases}

is an ${\color[rgb]{0,0,0}\mathrm{Eq}}{}$ -relative $\mathcal{R}^{+}$ -divergence on $T_{S}$ .

5.6.3 Sup-Metric on the State Monad on the Category of Generalized Ultrametric Spaces

The category $\mathbf{Gum}$ of generalized ( $[0,1]$ -valued) ultrametric spaces³³3Recall that an ultrametric space $(I,d_{I})$ is a set $I$ together with a function $d_{I}\colon I^{2}\to[0,1]$ such that $d_{I}(x,x)=0$ and $d_{I}(x,z)\leq\max(d_{I}(x,y),d_{I}(y,z))$ . and nonexpansive functions is Cartesian closed [49, Section 2.2]. We consider the state monad $T_{S}=S\Rightarrow(-\times S)$ on $\mathbf{Gum}$ for a fixed space $(S,d_{S})\in\mathbf{Gum}$ . From the definition of exponential objects in $\mathbf{Gum}$ , $T_{S}(I,d_{I})$ consists of the set of nonexpansive state transformers with the sup metric between them. In fact, the metric part of all $T_{S}(I,d_{I})$ forms a divergence on $T_{S}$ .

Proposition 5.

The family $\{d_{T_{S}I}\colon(T_{S}(I,d_{I}))^{2}\to[0,1]\}_{(I,d_{I})\in\mathbf{Gum}}$ consisting of the metric part of the spaces $T_{S}(I,d_{I})$ , given by

\displaystyle d_{T_{S}I}(f_{1},f_{2})\triangleq\sup_{s\in S}\max\left(d_{I}(\pi_{1}(f_{1}(s)),\pi_{1}(f_{2}(s))),d_{S}(\pi_{2}(f_{1}(s)),\pi_{2}(f_{2}(s)))\right)

forms an ${\color[rgb]{0,0,0}\mathrm{Eq}}{}$ -relative $([0,1],\leq,\max,0)$ -divergence on $T_{S}$ .

In the category $\mathbf{Gum}$ , instead of ${\color[rgb]{0,0,0}\mathrm{Eq}}$ , there is another basic endorelation $\mathsf{Dist}_{0}$ :

\mathsf{Dist}_{0}(I,d_{I})\triangleq\{(x_{1},x_{2})~{}|~{}d_{I}(x_{1},x_{2})=0\}.

By modifying the divergence $d_{T_{S}(-)}$ , we obtain a $\mathsf{Dist}_{0}$ -relative $([0,1],\leq,\max,0)$ -divergence as below:

Proposition 6.

The following forms a $\mathsf{Dist}_{0}{}$ -relative $([0,1],\leq,\max,0)$ -divergence on $T_{S}$ .

{\mathsf{\Delta}}^{\mathsf{Dist}_{0}}_{(I,d_{I})}(f_{1},f_{2})\triangleq\sup_{d_{S}(s_{1},s_{2})=0}\max(d_{S}(\pi_{1}(f_{1}(s_{1})),\pi_{1}(f_{2}(s_{2}))),d_{I}(\pi_{2}(f_{1}(s_{1})),\pi_{2}(f_{2}(s_{2})))).

5.7 Combining Divergence with Cost

In Section 5.2, we have introduced a divergence on the monad $P(\mathbb{N}\times-)$ modeling nondeterministic choice and cost counting. In this section we construct a divergence on the combination of a general computational effect and cost counting.

Let $(\mathbb{C},T)$ be a CC-SM and ${\mathsf{\Delta}}\in{\bf Div}(T,{\color[rgb]{0,0,0}\mathrm{Eq}},1,\mathcal{Q})$ be a divergence and $(N,1_{N}\colon 1\to N,(\star)\colon N\times N\to N)$ be a monoid object in $\mathbb{C}$ (for cost counting). Then the composite $T(N\times-)$ of the monad $T$ and the monoid action monad $N\times(-)$ again carries a monad structure. We now define a family ${\mathsf{C}}({\mathsf{\Delta}},N)=\{{\mathsf{C}}({\mathsf{\Delta}},N)_{I}\colon(U(T(N\times I)))^{2}\to\mathcal{Q}\}_{I\in\mathbb{C}}$ of $\mathcal{Q}$ -divergences by

\displaystyle{\mathsf{C}}({\mathsf{\Delta}},N)_{I}(c_{1},c_{2})\triangleq\begin{cases}{\mathsf{\Delta}}_{N}(T\pi_{1}\mathbin{\bullet}c_{1},T\pi_{1}\mathbin{\bullet}c_{2})&{\mathsf{\Delta}}_{N\times I}(c_{1},c_{2})\leq{\mathsf{\Delta}}_{N}(T\pi_{1}\mathbin{\bullet}c_{1},T\pi_{1}\mathbin{\bullet}c_{2})\\ \top_{\mathcal{Q}}&\text{otherwise}\end{cases}.

Proposition 7.

The family ${\mathsf{C}}({\mathsf{\Delta}},N)$ is an ${\color[rgb]{0,0,0}\mathrm{Eq}}$ -relative $\mathcal{Q}$ -divergence on $T(N\times-)$ .

For example, the divergence ${\mathsf{C}}(\mathsf{KL},\mathbb{R})$ on the composite monad $G(\mathbb{R}\times-)$ on ${\bf Meas}$ describes Kullback-Leibler divergence between distributions of costs in the probabilistic computations with real-valued costs. Intuitively, the side condition $\mathsf{KL}_{\mathbb{R}\times I}(\mu_{1},\mu_{2})\leq\mathsf{KL}_{\mathbb{R}}(G\pi_{1}\mathbin{\bullet}\mu_{1},G\pi_{1}\mathbin{\bullet}\mu_{2})$ in the definition of ${\mathsf{C}}(\mathsf{KL},\mathbb{R})$ means that the difference between $\mu_{1}$ and $\mu_{2}$ lies only in the costs.

5.8 Preorders on Monads

To explore the generality of our framework, we look at the case where the divergence domain is $\mathcal{B}=(\{0\geq 1\},1,\times)$ ; here $\times$ is the numerical multiplication. We identify an indexed family ${\mathsf{\Delta}}=\{{\mathsf{\Delta}}_{I}\colon(U(TI))^{2}\to\mathcal{B}\}_{I\in\mathbb{C}}$ of $\mathcal{B}$ -divergences and a family of adjacency relations $\tilde{\mathsf{\Delta}}(1)I\triangleq\{(c_{1},c_{2})~{}|~{}{\mathsf{\Delta}}_{I}(c_{1},c_{2})\leq 1\}$ .

We point out a connection between ${\color[rgb]{0,0,0}\mathrm{Eq}}$ -relative $\mathcal{B}$ -divergences and preorders on monads studied in ([32, 50]). A preorder on a monad $T$ on ${\bf Set}$ assigns a preorder $\sqsubseteq_{I}$ on $TI$ for each $I\in{\bf Set}$ , and this assignment satisfies:

Substitutivity: For any function $f\colon I\to TJ$ and $c_{1},c_{2}\in TI$ , $c_{1}\sqsubseteq_{I}c_{2}$ implies $f^{\sharp}(c_{1})\sqsubseteq_{J}f^{\sharp}(c_{2})$ .
Congruence: For any function $f_{1},f_{2}\colon I\to TJ$ , if $f_{1}(x)\sqsubseteq_{J}f_{2}(x)$ holds for any $x\in I$ , then $f_{1}^{\sharp}(c)\sqsubseteq_{J}f_{2}^{\sharp}(c)$ holds for any $c\in TI$ .

Proposition 8.

A preorder on a monad $T$ on ${\bf Set}$ bijectively corresponds to an ${\color[rgb]{0,0,0}\mathrm{Eq}}$ -relative $\mathcal{B}$ -divergence ${\mathsf{\Delta}}$ on $T$ such that each $\tilde{\mathsf{\Delta}}(1)I$ is a preorder.

For a preorder $\sqsubseteq$ on a monad $T$ on ${\bf Set}$ , by ${\mathsf{\Delta}}^{\sqsubseteq}$ we mean the divergence corresponding to $\sqsubseteq$ by Proposition 8 (in fact, we have $\widetilde{{\mathsf{\Delta}}^{\sqsubseteq}}(1)I={\sqsubseteq_{I}}$ for all set $I$ ).

6 Properties of Divergences on Monads

6.1 Divergences on Monads as Structures in ${\bf Div}_{\mathcal{Q}}({\mathbb{C}})$

In this section we examine divergences on monads from the view point of monoidal structure of ${\bf Div}_{\mathcal{Q}}({\mathbb{C}})$ . For any CC $\mathbb{C}$ , the category ${\bf Div}_{\mathcal{Q}}({\mathbb{C}})$ has a symmetric monoidal structure, whose unit and tensor product are given by

	$\displaystyle{\bf I}$	$\displaystyle\triangleq(1,\lambda{(x_{1},x_{2})}~{}.~{}0),$
	$\displaystyle(I,d)\otimes(J,e)$	$\displaystyle\triangleq(I\times J,\lambda{(\langle x_{1},y_{1}\rangle,\langle x_{2},y_{2}\rangle)}~{}.~{}d(x_{1},x_{2})+e(y_{1},y_{2})).$

The coherence isomorphisms of this symmetric monoidal structure are inherited from the Cartesian monoidal structure on $\mathbb{C}$ . Moreover, $V_{\mathcal{Q},\mathbb{C}}:{\bf Div}_{\mathcal{Q}}({\mathbb{C}})\to{\mathbb{C}}$ becomes a symmetric strict monoidal functor of type $({\bf Div}_{\mathcal{Q}}({\mathbb{C}}),{\bf I},\otimes)\to(\mathbb{C},1,(\times))$ .

6.1.1 Enrichments of Kleisli Categories Induced by Divergences

Let $(\mathbb{C},T)$ be a CC-SM. We first show that a (non-graded) divergence on a monad $T$ attaches a ${\bf Div}_{\mathcal{Q}}({{\bf Set}})$ -enrichment on the Kleisli category $\mathbb{C}_{T}$ of $T$ . What we mean by attaching an enrichment to an ordinary category is formulated as follows.

Definition 9.

A ${\bf Div}_{\mathcal{Q}}({{\bf Set}})$ -enrichment of a category $\mathbb{D}$ is a family $\{d_{I,J}:\mathbb{D}(I,J)^{2}\to\mathcal{Q}\}_{I,J\in\mathbb{D}}$ of $\mathcal{Q}$ -divergences on the homset $\mathbb{D}(I,J)$ such that the following inequalities hold:

	$\displaystyle d_{I,I}({\rm id}_{I},{\rm id}_{I})\leq 0,$		(3)
	$\displaystyle d_{I,K}(g_{1}\circ f_{1},g_{2}\circ f_{2})\leq d_{J,K}(g_{1},g_{2})+d_{I,J}(f_{1},f_{2}).$		(4)

Such an enrichment determines a ${\bf Div}_{\mathcal{Q}}({{\bf Set}})$ -enriched category $\mathbb{D}^{d}$ , whose object collection and homobjects are given by

{\bf Obj}(\mathbb{D}^{d})\triangleq{\bf Obj}(\mathbb{D}),\quad\mathbb{D}^{d}(I,J)\triangleq(\mathbb{D}(I,J),d_{I,J}).

The identity and composition morphisms of $\mathbb{D}^{d}$ :

j_{I}:{\bf I}\to\mathbb{D}^{d}(I,I),\quad m_{I,J,K}:\mathbb{D}^{d}(J,K)\otimes\mathbb{D}^{d}(I,J)\to\mathbb{D}^{d}(I,K)

are inherited from $\mathbb{D}$ ; they are guaranteed to be nonexpansive by the conditions (3) and (4). The change of base of enrichment of $\mathbb{D}^{d}$ by the symmetric strict monoidal functor $V_{\mathcal{Q},\mathbb{D}}:{\bf Div}_{\mathcal{Q}}({\mathbb{D}})\to{\mathbb{D}}$ coincides with $\mathbb{D}$ . ⁴⁴4The underlying category of $\mathbb{D}^{d}$ [34, Section 1.3] does not coincide with $\mathbb{D}$ .

We relate conditions (3) and (4) with the unit reflexivity and composability conditions in the definition of divergence on monad (Definition 6).

Theorem 2.

Let $(\mathbb{C},T)$ be a CC-SM, $E:\mathbb{C}\to{\bf BRel}(\mathbb{C})$ be a basic endorelation such that $R_{E1}\neq\emptyset$ ⁵⁵5 $R_{E1}=\emptyset$ happens if and only if $R_{EI}=\emptyset$ for any $I\in\mathbb{C}$ . Therefore nontrivial basic endorelations always satisfy $R_{E1}\neq\emptyset$ . , $\mathcal{Q}$ be a divergence domain and ${\mathsf{\Delta}}=\{{\mathsf{\Delta}}_{I}:(U(TI))^{2}\to\mathcal{Q}\}_{I\in\mathbb{C}}$ be a family of $\mathcal{Q}$ -divergences on $TI$ . Define a family $d=\{d_{I,J}\}_{I,J\in\mathbb{C}}$ of $\mathcal{Q}$ -divergences on the homset $\mathbb{C}_{T}(I,J)$ of the Kleisli category $\mathbb{C}_{T}$ by

d_{I,J}(f_{1},f_{2})\triangleq\sup_{(x_{1},x_{2})\in EI}{\mathsf{\Delta}}_{J}(f_{1}\mathbin{\bullet}x_{1},f_{2}\mathbin{\bullet}x_{2}).

(5)

Then $d$ is a ${\bf Div}_{\mathcal{Q}}({{\bf Set}})$ -enrichment of $\mathbb{C}_{T}$ if and only if ${\mathsf{\Delta}}$ is an $E$ -relative $\mathcal{Q}$ -divergence on $T$ .

6.1.2 Internalizing Divergences as Structures in ${\bf Div}_{\mathcal{Q}}({\mathbb{C}})$

One might wonder how the $\mathcal{Q}$ -divergence (5) given to each homset of $\mathbb{C}_{T}$ arises. Under a strengthened assumption, we derive it from the closed structure with respect to the monoidal product of ${\bf Div}_{\mathcal{Q}}({\mathbb{C}})$ . This allows us to internalize divergences on monads as structures in ${\bf Div}_{\mathcal{Q}}({\mathbb{C}})$ .

Let $(\mathbb{C},T)$ be a CCC-SM and $\mathcal{Q}$ be a divergence domain whose monoid operation $(+)$ preserves the largest element $\top\in\mathcal{Q}$ , that is, $x+\top=\top$ . A consequence of this strengthened assumption is the following:

Lemma 1.

Let $(I,d)\in{\bf Div}_{\mathcal{Q}}({\mathbb{C}})$ be an object such that $d(x_{1},x_{2})$ takes only values in $\{0,\top\}\subseteq\mathcal{Q}$ . Then the functor $(-)\otimes(I,d):{\bf Div}_{\mathcal{Q}}({\mathbb{C}})\to{\bf Div}_{\mathcal{Q}}({\mathbb{C}})$ has a right adjoint, which we denote by $(I,d)\multimap(-)$ . Moreover, $V_{\mathcal{Q},\mathbb{C}}:{\bf Div}_{\mathcal{Q}}({\mathbb{C}})\to{\mathbb{C}}$ is a map of adjunction of type:

V_{\mathcal{Q},\mathbb{C}}:((-)\otimes(I,d)\dashv(I,d)\multimap(-))\to((-)\times I\dashv I\Rightarrow(-)).

The proof of this lemma exhibits that the $\mathcal{Q}$ -divergence $h$ associated to the internal hom object $(I,d)\multimap(J,e)$ measures the divergence between $f_{1},f_{2}\in U(I\Rightarrow J)$ by

h(f_{1},f_{2})=\sup_{x_{1},x_{2}\in UI,d(x_{1},x_{2})=0}e(\lfloor{f_{1}}\rfloor\bullet x_{1},\lfloor{f_{2}}\rfloor\bullet x_{2}),

which almost coincides with the sup part of (5); here $\lfloor{-}\rfloor:U(I\Rightarrow J)\to\mathbb{C}(I,J)$ is the bijection given in Section 2. We use this coincidence to characterize the unit-reflexivity and composability conditions in the definition of divergence on monad (Definition 6). First, we define the internal Kleisli extension morphism $kl_{I,J}:TI\times(I\Rightarrow TJ)\rightarrow TJ$ by

kl_{I,J}\triangleq\lx@xy@svg{\hbox{\raise 0.0pt\hbox{\kern 36.44435pt\hbox{\ignorespaces\ignorespaces\ignorespaces\hbox{\vtop{\kern 0.0pt\offinterlineskip\halign{\entry@#!@&&\entry@@#!@\cr&&&\crcr}}}\ignorespaces{\hbox{\kern-36.44435pt\raise 0.0pt\hbox{\hbox{\kern 0.0pt\raise 0.0pt\hbox{\hbox{\kern 3.0pt\raise 0.0pt\hbox{$\textstyle{TI\times(I\Rightarrow TJ)\ignorespaces\ignorespaces\ignorespaces\ignorespaces}$}}}}}}}\ignorespaces\ignorespaces\ignorespaces\ignorespaces{}{\hbox{\lx@xy@droprule}}\ignorespaces\ignorespaces\ignorespaces{\hbox{\kern 34.59305pt\raise 8.0pt\hbox{{}\hbox{\kern 0.0pt\raise 0.0pt\hbox{\hbox{\kern 3.0pt\hbox{\hbox{\kern 0.0pt\raise-2.5pt\hbox{$\scriptstyle{\langle\pi_{2},\pi_{1}\rangle}$}}}\kern 3.0pt}}}}}}\ignorespaces{\hbox{\kern 60.44435pt\raise 0.0pt\hbox{\hbox{\kern 0.0pt\raise 0.0pt\hbox{\lx@xy@tip{1}\lx@xy@tip{-1}}}}}}{\hbox{\lx@xy@droprule}}{\hbox{\lx@xy@droprule}}{\hbox{\kern 60.44435pt\raise 0.0pt\hbox{\hbox{\kern 0.0pt\raise 0.0pt\hbox{\hbox{\kern 3.0pt\raise 0.0pt\hbox{$\textstyle{(I\Rightarrow TJ)\times TI\ignorespaces\ignorespaces\ignorespaces\ignorespaces}$}}}}}}}\ignorespaces\ignorespaces\ignorespaces\ignorespaces{}{\hbox{\lx@xy@droprule}}\ignorespaces\ignorespaces\ignorespaces{\hbox{\kern 133.53654pt\raise 6.50278pt\hbox{{}\hbox{\kern 0.0pt\raise 0.0pt\hbox{\hbox{\kern 3.0pt\hbox{\hbox{\kern 0.0pt\raise-1.35834pt\hbox{$\scriptstyle{\theta_{I\Rightarrow TJ,I}}$}}}\kern 3.0pt}}}}}}\ignorespaces{\hbox{\kern 157.33305pt\raise 0.0pt\hbox{\hbox{\kern 0.0pt\raise 0.0pt\hbox{\lx@xy@tip{1}\lx@xy@tip{-1}}}}}}{\hbox{\lx@xy@droprule}}{\hbox{\lx@xy@droprule}}{\hbox{\kern 157.33305pt\raise 0.0pt\hbox{\hbox{\kern 0.0pt\raise 0.0pt\hbox{\hbox{\kern 3.0pt\raise 0.0pt\hbox{$\textstyle{T((I\Rightarrow TJ)\times I)\ignorespaces\ignorespaces\ignorespaces\ignorespaces}$}}}}}}}\ignorespaces\ignorespaces\ignorespaces\ignorespaces{}{\hbox{\lx@xy@droprule}}\ignorespaces\ignorespaces\ignorespaces{\hbox{\kern 240.26343pt\raise 5.89583pt\hbox{{}\hbox{\kern 0.0pt\raise 0.0pt\hbox{\hbox{\kern 3.0pt\hbox{\hbox{\kern 0.0pt\raise-2.89583pt\hbox{$\scriptstyle{\mathrm{ev}^{\#}}$}}}\kern 3.0pt}}}}}}\ignorespaces{\hbox{\kern 261.99956pt\raise 0.0pt\hbox{\hbox{\kern 0.0pt\raise 0.0pt\hbox{\lx@xy@tip{1}\lx@xy@tip{-1}}}}}}{\hbox{\lx@xy@droprule}}{\hbox{\lx@xy@droprule}}{\hbox{\kern 261.99956pt\raise 0.0pt\hbox{\hbox{\kern 0.0pt\raise 0.0pt\hbox{\hbox{\kern 3.0pt\raise 0.0pt\hbox{$\textstyle{TJ}$}}}}}}}\ignorespaces}}}}\ignorespaces.

(6)

Next, for a basic endorelation $E:\mathbb{C}\to{\bf BRel}(\mathbb{C})$ , we define the functor $E^{\prime}:\mathbb{C}\to{\bf Div}_{\mathcal{Q}}({\mathbb{C}})$ by

E^{\prime}I\triangleq(I,d_{E^{\prime}I}),\quad E^{\prime}f\triangleq f,\quad\text{where}\quad d_{E^{\prime}I}(x_{1},x_{2})\triangleq\left\{\begin{array}[]{ll}0&(x_{1},x_{2})\in E\\ \infty&(x_{1},x_{2})\not\in E.\end{array}\right.

Theorem 3.

Let $(\mathbb{C},T)$ be a CCC-SM, $(M,\leq,1,(\cdot))$ be a grading monoid, $\mathcal{Q}$ be a divergence domain whose monoid operation $(+)$ satisfies $x+\top=\top$ , and $E:\mathbb{C}\to{\bf BRel}(\mathbb{C})$ be a basic endorelation. Let ${\mathsf{\Delta}}=\{{\mathsf{\Delta}}^{m}_{I}\}_{m\in M,I\in\mathbb{C}}$ be a doubly-indexed family of $\mathcal{Q}$ -divergences on $TI$ , regarded as ${\bf Div}_{\mathcal{Q}}({\mathbb{C}})$ -objects. Then

1.

${\mathsf{\Delta}}$ satisfies the $E$ -unit reflexivity condition if and only if for any $I\in\mathbb{C}$ , the following nonexpansivity holds on the global element $\lceil{\eta_{I}}\rceil:1\to I\Rightarrow TI$ corresponding to the monad unit:

$\lceil{\eta_{I}}\rceil\in{\bf Div}_{\mathcal{Q}}({\mathbb{C}})({\bf I},E^{\prime}I\multimap{\mathsf{\Delta}}^{1}_{I}).$

${\mathsf{\Delta}}$ satisfies the $E$ -composablity condition if and only if for any $I,J\in\mathbb{C}$ and $m,n\in M$ , the following nonexpansivity holds on the internal Kleisli extension morphism $kl_{I,J}:TI\times(I\Rightarrow TJ)\rightarrow TJ$ :

kl_{I,J}\in{\bf Div}_{\mathcal{Q}}({\mathbb{C}})({\mathsf{\Delta}}^{m}_{I}\otimes(E^{\prime}I\multimap{\mathsf{\Delta}}^{n}_{J}),{\mathsf{\Delta}}^{m\cdot n}_{J}).

[5] formalized families of composable divergences as parameterized assignment in weakly closed monoidal refinement. Roughly speaking, they adopted the equivalence (2) of Theorem 3 as the definition of parameterized assignment. However, divergence on monads and parameterized assignments are built on slightly different categorical foundations, and their generalities are incomparable. Notable differences from parameterized assignment are: 1) divergences on monads are defined in relative to basic endorelations, and 2) the underlying category of divergences on monads is any CCs, while parameterized assignments requires closed structure on their underlying category. In this sense divergences on monads are a mild generalization of parameterized assignments.

6.1.3 Divergences on Monads and Divergence Liftings of Monads

We next relate graded divergences on monads and monad-like structures on the category ${\bf Div}_{\mathcal{Q}}({\mathbb{C}})$ of $\mathcal{Q}$ -divergences on $\mathbb{C}$ -objects. What we mean by monad-like structures is graded divergence liftings of monads on $\mathbb{C}$ , which we introduce below. It is a graded monad on ${\bf Div}_{\mathcal{Q}}({\mathbb{C}})$ ([31]) whose unit and multiplication are inherited from a monad on $\mathbb{C}$ .

Definition 10.

Let $(\mathbb{C},T)$ be a CC-SM, $M$ be a grading monoid and $\mathcal{Q}$ be a divergence domain. An $M$ -graded $\mathcal{Q}$ -divergence lifting of $T$ is an mapping $\dot{T}:M\times{\bf Obj}({\bf Div}_{\mathcal{Q}}({\mathbb{C}}))\rightarrow{\bf Obj}({\bf Div}_{\mathcal{Q}}({\mathbb{C}}))$ such that (below $V$ stands for the forgetful functor $V_{\mathcal{Q},\mathbb{C}}:{\bf Div}_{\mathcal{Q}}({\mathbb{C}})\to{\mathbb{C}}$ )

1.

$V(\dot{T}mX)=T(VX)$
2.

$m\leq n$ implies $\dot{T}mX\leq\dot{T}nX$
3.

$\eta_{VX}\in{\bf Div}_{\mathcal{Q}}({\mathbb{C}})(X,\dot{T}1X)$
4.

$\mu_{VX}:{\bf Div}_{\mathcal{Q}}({\mathbb{C}})(\dot{T}m(\dot{T}nX),\dot{T}(m\cdot n)X)$ .

Let $E:\mathbb{C}\rightarrow{\bf BRel}(\mathbb{C})$ be a basic endorelation. We say that an $M$ -graded $\mathcal{Q}$ -divergence lifting $\dot{T}$ of $T$ is $E$ -strong if the strength $\theta$ of $T$ satisfies

\theta_{VX,J}\in{\bf Div}_{\mathcal{Q}}({\mathbb{C}})(X\otimes\dot{T}m(E^{\prime}J),\dot{T}m(X\otimes E^{\prime}J)).

We write ${\bf SGDLift}(T,E,M,\mathcal{Q})$ for the collection of $E$ -strong $M$ -graded $\mathcal{Q}$ -divergence liftings of $T$ . We introduce a partial order $\preceq$ on ${\bf SGDLift}(T,E,M,\mathcal{Q})$ by

\dot{T}\preceq\dot{S}\iff\forall{m\in M,X\in{\bf Div}_{\mathcal{Q}}({\mathbb{C}}),c_{1},c_{2}\in U(T(VX))}~{}.~{}d_{\dot{T}mX}(c_{1},c_{2})\geq d_{\dot{S}mX}(c_{1},c_{2}).

We will later see a similar concept of strong graded relational lifting of monad in Definition 15. Divergence lifting and relational lifting are actually instances of a common general definition of strong graded lifting of monad ([31]), but in this paper we omit this general definition.

The following theorem relates that every divergence can be expressed as the composite of a graded divergence lifting and the divergence corresponding to a basic endorelation.

Theorem 4.

Let $(\mathbb{C},T)$ be a CC-SM, $M$ be a grading monoid, $\mathcal{Q}$ be a divergence domain and $E:\mathbb{C}\rightarrow{\bf BRel}(\mathbb{C})$ be a basic endorelation. For any ${\mathsf{\Delta}}\in{\bf Div}(T,E,M,\mathcal{Q})$ , define a mapping $[{\mathsf{\Delta}}]:M\times{\bf Obj}({\bf Div}_{\mathcal{Q}}({\mathbb{C}}))\to{\bf Obj}({\bf Div}_{\mathcal{Q}}({\mathbb{C}}))$ by, for $X=(I,d)$ , $[{\mathsf{\Delta}}]mX\triangleq(TI,d_{[{\mathsf{\Delta}}]mX})$ where

d_{[{\mathsf{\Delta}}]mX}(c_{1},c_{2})\triangleq\sup_{J\in\mathbb{C},n\in M,f\in{\bf Div}_{\mathcal{Q}}({\mathbb{C}})(X,{\mathsf{\Delta}}^{n}_{J})}{\mathsf{\Delta}}^{m\cdot n}_{J}(f^{\sharp}\mathbin{\bullet}c_{1},f^{\sharp}\mathbin{\bullet}c_{2}).

Then $[{\mathsf{\Delta}}]$ is an $M$ -graded $\mathcal{Q}$ -divergence lifting $\dot{T}$ such that ${\mathsf{\Delta}}^{m}_{I}=[{\mathsf{\Delta}}]m(E^{\prime}I)$ .

When $M=1$ , Theorem 4 implies that the assignment $I\mapsto{\mathsf{\Delta}}_{I}$ extends to the $E^{\prime}$ -relative monad $[{\mathsf{\Delta}}]\circ E^{\prime}:\mathbb{C}\to{\bf Div}_{\mathcal{Q}}({\mathbb{C}})$ in the sense of [3].

When we strengthen the assumptions on $(\mathbb{C},T)$ and $\mathcal{Q}$ as done in Section 6.1.2, we obtain a sharper correspondence between divergences on monads and strong graded divergence liftings of monads.

Theorem 5.

Let $(\mathbb{C},T)$ be a CCC-SM, $M$ be a grading monoid, $\mathcal{Q}$ be a divergence domain such that $(+)$ satisfies $x+\top=\top$ and $E:\mathbb{C}\rightarrow{\bf BRel}(\mathbb{C})$ be a basic endorelation. Then there exists an adjunction between partial orders:

where $\langle\dot{T}\rangle mI\triangleq\dot{T}m(E^{\prime}I)$

6.2 Generation of Divergences

It has been shown that DP can be interpreted as hypothesis testing ([54, 30]). Given a query $c\colon I\to GJ$ and adjacent datasets $(d_{1},d_{2})\in R_{\mathrm{adj}}\subseteq I^{2}$ , we consider the following hypothesis testing with the null and alternative hypotheses:

	$\displaystyle H_{0}\colon\text{The output $y$ comes from the dataset $d_{1}$},$
	$\displaystyle H_{1}\colon\text{The output $y$ comes from the dataset $d_{2}$}.$

For any rejection region $S\in\Sigma_{J}$ , the Type I and Type II errors are then represented by $\Pr[c(d_{1})\in S]$ and $\Pr[c(d_{2})\notin S]$ , respectively. [30] showed that $c$ is $(\varepsilon,\delta)$ -DP if and only if for any adjacent datasets $(d_{1},d_{2})\in R_{\mathrm{adj}}\subseteq I^{2}$ , the pair of Type I error and Type II error lands in the privacy region $R(\varepsilon,\delta)$ :

\forall{S\in\Sigma_{J}}~{}.~{}(\Pr[c(d_{1})\in S],\Pr[c(d_{2})\notin S])\in\underbrace{\{(x,y)\in[0,1]^{2}|(1-x)\leq\exp(\varepsilon)y+\delta\}}_{\triangleq R(\varepsilon,\delta)}.

They also showed that this is equivalent to the testing using probabilistic decision rules [30, Corollary 2.3]:

\forall{k\colon J\to G\{\mathsf{Acc},\mathsf{Rej}\}}~{}.~{}(\Pr[k^{\sharp}c(d_{1})=\mathsf{Acc}],\Pr[k^{\sharp}c(d_{2})=\mathsf{Rej}])\in R(\varepsilon,\delta).

Later [7] generalized this probabilistic variant of hypothesis testing to general statistical divergences, and arrived at a notion of $k$ -generatedness of statistical divergences ( $k\in\mathbb{N}\cup\{\infty\}$ ). Following their generalization, we introduce the concept of $\Omega$ -generatedness of divergences on monads.

Definition 11.

Let $\Omega\in\mathbb{C}$ . A divergence ${\mathsf{\Delta}}\in{\bf Div}(T,E,M,\mathcal{Q})$ is $\Omega$ -generated if for any $m\in M$ , $I\in\mathbb{C}$ and $c_{1},c_{2}\in U(TI)$ ,

{\mathsf{\Delta}}^{m}_{I}(c_{1},c_{2})=\sup_{k\colon I\to T\Omega}{\mathsf{\Delta}}^{m}_{\Omega}(k^{\sharp}\mathbin{\bullet}c_{1},k^{\sharp}\mathbin{\bullet}c_{2}).

An equivalent definition of ${\mathsf{\Delta}}\in{\bf Div}(T,E,M,\mathcal{Q})$ being $\Omega$ -generated is: the following holds for any $m\in M,I\in\mathbb{C},c_{1},c_{2}\in U(TI),v\in\mathcal{Q}$ :

{\mathsf{\Delta}}^{m}_{I}(c_{1},c_{2})\leq v\iff\forall{k\colon I\to T\Omega}~{}.~{}(k^{\sharp}\mathbin{\bullet}c_{1},k^{\sharp}\mathbin{\bullet}c_{2})\in\tilde{\mathsf{\Delta}}(m,v)\Omega.

Here $\tilde{\mathsf{\Delta}}(m,v)\Omega$ is the binary relation $\{(c_{1},c_{2})~{}|~{}{\mathsf{\Delta}}^{m}_{\Omega}(c_{1},c_{2})\leq v\}$ ; see also (9). For an $\Omega$ -generated divergence ${\mathsf{\Delta}}$ , its component ${\mathsf{\Delta}}^{m}_{\Omega}$ at $\Omega$ is an essential part that determines all components ${\mathsf{\Delta}}^{m}_{I}$ of ${\mathsf{\Delta}}$ . When a divergence is shown to be $\Omega$ -generated, the calculation of the codensity lifting $T^{[{\mathsf{\Delta}}]}$ given in Section 7 will be simplified (Section 7.1).

We illustrate $\Omega$ -generatedness of various divergences. First, we show the $\Omega$ -generatedness of divergences on the Giry monad $G$ in Tables 2 and 3.

•

Divergence $\mathsf{DP}$ is generated over the two-point discrete space $2$ [7, Section B.7]. The binary relation $(\widetilde{\mathsf{DP}}(\varepsilon,\delta)2)$ coincides with the privacy region $R(\varepsilon,\delta)$ .
•

Divergence $\mathsf{TV}$ is also generated over $2$ [7, Section C.1].
•

Divergences $\mathsf{Re}^{\alpha}$ , $\mathsf{Chi}$ , $\mathsf{HD}$ and $\mathsf{KL}$ are generated over the countably infinite discrete space $\mathbb{N}$ . In contrast, they are not $N$ -generated for every finite discrete space $N$ [7, Sections B.5 and B.9].

On the sub-Giry monad $G_{s}$ , the divergence $\mathsf{DP}$ is $1$ -generated, and the total variation distance $\mathsf{TV}$ is $2$ -generated.

Proposition 9.

The divergence $\mathsf{DP}\in{\bf Div}(G_{s},{\color[rgb]{0,0,0}\mathrm{Eq}},\mathcal{R}^{+},\mathcal{R}^{+})$ is $1$ -generated.

Proposition 10.

The divergence $\mathsf{TV}\in{\bf Div}(G_{s},{\color[rgb]{0,0,0}\mathrm{Eq}},1,\mathcal{R}^{+})$ is not $1$ -generated but $2$ -generated.

$\Omega$ -Generatedness of Preorders on Monads

We relate $\Omega$ -generatedness of divergences and preorders on monads studied in ([32]). Let $T$ be a monad on ${\bf Set}$ and $\Omega$ be a set. [32] introduced the concept of congruent and substitutive preorders on $T\Omega$ as those satisfying:

Substitutivity: For any function $f\colon\Omega\to T\Omega$ and $c_{1},c_{2}\in T\Omega$ , $c_{1}\leq c_{2}$ implies $f^{\sharp}(c_{1})\leq f^{\sharp}(c_{2})$ .
Congruence: For any function $f_{1},f_{2}\colon J\to T\Omega$ , if $f_{1}(x)\leq f_{2}(x)$ holds for any $x\in J$ , then $f_{1}^{\sharp}(c)\leq f_{2}^{\sharp}(c)$ holds for any $c\in T\Omega$ .

For instance, any component of a preorder on $T$ at $\Omega$ forms a congruent and substitutive preorder on $T\Omega$ . We write $\mathbf{CSPre}(T,\Omega)$ for the set of all congruent and substitutive preorders on $T\Omega$ , and $\mathbf{Pre}(T)$ for the collection of all preorders on $T$ . [32] gave a construction $[-]^{\Omega}\colon\mathbf{CSPre}(T,\Omega)\to\mathbf{Pre}(T)$ of preorders on $T$ from congruent and substitutive preorders on $T\Omega$ :

c_{1}[\leq]^{\Omega}_{J}c_{2}\iff\forall{g\colon J\to T\Omega}~{}.~{}g^{\sharp}(c_{1})\leq g^{\sharp}(c_{2})

The constructed preorders on $T$ are $\Omega$ -generated in the following sense:

Proposition 11.

For any ${\leq}\in\mathbf{CSPre}(T,\Omega)$ , the $\mathcal{B}$ -divergence ${\mathsf{\Delta}}^{[\leq]^{\Omega}}$ corresponding to the preorder ${[\leq]}^{\Omega}$ on $T$ is $\Omega$ -generated (see Proposition 8 for the correspondence).

Applying this proposition, we can determine $\Omega$ -generatedness of preorders on monads:

•

If the monad $T$ has a rank $\alpha$ , the construction $[-]^{\alpha}$ is bijective [32, Theorem 7]. Hence for such a monad, each preorder on $T$ corresponds to an $\alpha$ -generated $\mathcal{B}$ -divergence.
•

For the subprobability distribution monad $D_{s}$ on ${\bf Set}$ , [50] identified all preorders on $D_{s}$ : there are 41 preorders on $D_{s}$ . Among them, 25 preorders are 1-generated, while 16 preorders are 2-generated [50, Proposition 6.3].

6.3 An Adjunction between Quantitative Equational Theories and Divergences

[39] introduced a concept of quantitative equational theory as an algebraic presentation of monads on the category of (pseudo-)metric spaces. A quantitative equational theory is an equational theory with indexed equations ${t}=_{\varepsilon}{u}$ having the axioms of pseudometric spaces, plus suitable axioms reflecting properties of quantitative algebras. A quantitative equational theory determines a pseudometric on the set of $\Omega$ -terms.

Consider a set $\Omega$ of function symbols of finite arity. If $n$ is the arity of a function $f\in\Omega$ , we write $f\colon n\in\Omega$ . Let $X$ be a set of variables, and let $T_{\Omega}X$ be the $\Omega$ -term algebra over $X$ . For $f\colon n\in\Omega$ and $t_{1},\ldots,t_{n}\in T_{\Omega}X$ , we write $f(t_{1},\ldots,t_{n})$ for the term obtained by applying $f$ to $t_{1},\ldots,t_{n}$ . The construction $X\mapsto T_{\Omega}X$ forms a (strong) monad on ${\bf Set}$ whose unit sends variables to terms, that is, $\eta_{X}(x)=x$ , and Kleisli extension $h^{\sharp}\colon T_{\Omega}I\to T_{\Omega}X$ of function $h\colon I\to T_{\Omega}X$ is defined inductively by

h^{\sharp}(x)\triangleq h(x),\quad h^{\sharp}(f(t_{1},\ldots,t_{n}))\triangleq f(h^{\sharp}(t_{1}),\ldots,h^{\sharp}(t_{n})).

A substitution of $\Omega$ -terms over $X$ is a function $\sigma\colon X\to T_{\Omega}X$ . For $t\in T_{\Omega}X$ , we call $\sigma^{\sharp}(t)$ the substitution of $\sigma$ to $t$ . We define the set of indexed equations of terms by

\mathbb{V}(T_{\Omega}X)\triangleq\{{t}=_{\varepsilon}{u}~{}|~{}t,u\in T_{\Omega}X,\varepsilon\in\mathbb{Q}^{+}\}.

Here the index $\varepsilon$ runs over non-negative rational numbers. A conditional quantitative equation is a judgment of the following form

\{{t_{i}}=_{\varepsilon_{i}}{u_{i}}~{}|~{}i\in I\}\vdash{t}=_{\varepsilon}{u}\qquad(I\colon\text{countable},{t_{i}}=_{\varepsilon_{i}}{u_{i}},{t}=_{\varepsilon}{u}\in\mathbb{V}(T_{\Omega}X));

the left hand side of turnstile ( $\vdash$ ) is called hypothesis and the right hand side conclusion. We denote by $\mathbb{E}(T_{\Omega}X)$ the set of conditional quantitative equations. For any countable subset $\Gamma$ of $\mathbb{V}(T_{\Omega}X)$ and any substitution $\sigma\colon X\to T_{\Omega}X$ , we define $\sigma(\Gamma)\triangleq\{{\sigma^{\sharp}(t_{i})}=_{\varepsilon_{i}}{\sigma^{\sharp}(u_{i})}~{}|~{}{t_{i}}=_{\varepsilon_{i}}{u_{i}}\in\Gamma\}$ .

Definition 12 (Quantitative Equational Theory [39, Definition 2.1]).

A quantitative equational theory (QET for short) of type $\Omega$ over $X$ is a set $U\subseteq\mathbb{E}(T_{\Omega}X)$ closed under the rules summarized as Figure 1.

$\displaystyle\emptyset$	$\displaystyle\vdash{t}=_{0}{t}\in U$	(Ref)
$\displaystyle\{{t}=_{\varepsilon}{u}\}$	$\displaystyle\vdash{u}=_{\varepsilon}{t}\in U$	(Sym)
$\displaystyle\{{t}=_{\varepsilon}{u},{u}=_{\varepsilon^{\prime}}{v}\}$	$\displaystyle\vdash{t}=_{\varepsilon+\varepsilon^{\prime}}{v}\in U$	(Tri)
$\displaystyle\forall{\varepsilon^{\prime}\in\mathbb{Q}^{+}}~{}.~{}\{{t}=_{\varepsilon}{u}\}$	$\displaystyle\vdash{t}=_{\varepsilon+\varepsilon^{\prime}}{u}\in U$	(Max)
$\displaystyle\forall{\varepsilon\in\mathbb{Q}^{+}}~{}.~{}\{{t}=_{\varepsilon^{\prime}}{u}\|\varepsilon<\varepsilon^{\prime}\}$	$\displaystyle\vdash{t}=_{\varepsilon}{u}\in U$	(Arch)
$\displaystyle\forall{f\colon n\in\Omega}~{}.~{}\{{t_{i}}=_{\varepsilon}{u_{i}}\|1\leq i\leq n\}$	$\displaystyle\vdash{f(t_{1},\ldots,t_{n})}=_{\varepsilon}{f(u_{1},\ldots,u_{n})}$	(Nonexp)
$\displaystyle\forall{\sigma\colon X\to T_{\Omega}X}~{}.~{}{\Gamma\vdash{t}=_{\varepsilon}{u}\in U}$	$\displaystyle\implies{\sigma(\Gamma)\vdash{\sigma^{\sharp}(t)}=_{\varepsilon}{\sigma^{\sharp}(u)}\in U}$	(Subst)
$\displaystyle\Gamma^{\prime}\vdash{t}=_{\varepsilon}{u}\in U\land\forall{\psi\in\Gamma^{\prime}}~{}.~{}\Gamma\vdash\psi\in U$	$\displaystyle\implies{\Gamma\vdash{t}=_{\varepsilon}{u}\in U}$	(Cut)
$\displaystyle{{t}=_{\varepsilon}{u}\in\Gamma}$	$\displaystyle\implies{\Gamma\vdash{t}=_{\varepsilon}{u}\in U}$	(Assumpt)

Figure 1: Quantitative Equational Theory Rules

We write ${\bf QET}(\Omega,X)$ for the set of QETs of type $\Omega$ over $X$ . We regard it as a poset $({\bf QET}(\Omega,X),\subseteq)$ by the set inclusion order. Given a set $U_{0}$ of conditional quantitative equations of type $\Omega$ over $X$ , by $\overline{U_{0}}^{\mathrm{QET}({\Omega},{X})}$ we mean the least QET containing $U_{0}$ .

We state an adjunction between quantitative equational theories and divergences on free-algebra monads on ${\bf Set}$ . More specifically, we construct the following adjunction and isomorphism between posets:

\lx@xy@svg{\hbox{\raise 0.0pt\hbox{\kern 38.15974pt\hbox{\ignorespaces\ignorespaces\ignorespaces\hbox{\vtop{\kern 0.0pt\offinterlineskip\halign{\entry@#!@&&\entry@@#!@\cr&&\crcr}}}\ignorespaces{\hbox{\kern-38.15974pt\raise 0.0pt\hbox{\hbox{\kern 0.0pt\raise 0.0pt\hbox{\hbox{\kern 3.0pt\raise 0.0pt\hbox{$\textstyle{({\bf QET}(\Omega,X),\subseteq)}$}}}}}}}{\hbox{\kern 80.83887pt\raise 0.0pt\hbox{\hbox{\kern 0.0pt\raise 0.0pt\hbox{\hbox{\kern 3.0pt\raise 0.0pt\hbox{$\textstyle{({\bf CSEPMet}(T_{\Omega},X),\preceq)\ignorespaces\ignorespaces\ignorespaces\ignorespaces\ignorespaces\ignorespaces\ignorespaces\ignorespaces\ignorespaces\ignorespaces\ignorespaces\ignorespaces\ignorespaces\ignorespaces\ignorespaces\ignorespaces\ignorespaces\ignorespaces\ignorespaces\ignorespaces\ignorespaces\ignorespaces}$}}}}}}}\ignorespaces\ignorespaces\ignorespaces\ignorespaces{}{\hbox{\lx@xy@droprule}}\ignorespaces\ignorespaces\ignorespaces{\hbox{\kern 50.6169pt\raise-11.29993pt\hbox{{}\hbox{\kern 0.0pt\raise 0.0pt\hbox{\hbox{\kern 3.0pt\hbox{\hbox{\kern 0.0pt\raise-1.75pt\hbox{$\scriptstyle{U[-]}$}}}\kern 3.0pt}}}}}}\ignorespaces{\hbox{\kern 38.15974pt\raise-4.79993pt\hbox{\hbox{\kern 0.0pt\raise 0.0pt\hbox{\lx@xy@tip{1}\lx@xy@tip{-1}}}}}}{\hbox{\lx@xy@droprule}}{\hbox{\lx@xy@droprule}}\ignorespaces\ignorespaces\ignorespaces\ignorespaces{}\ignorespaces{\hbox{\kern 59.49931pt\raise 0.0pt\hbox{{}{}\hbox{\kern-3.8889pt\raise-3.47221pt\hbox{\xyRotate@@{-1024}\kern 0.0pt\kern 0.0pt}}}}}\ignorespaces{}\ignorespaces\ignorespaces\ignorespaces\ignorespaces{\hbox{\kern 80.83887pt\raise 4.79993pt\hbox{\hbox{\kern 0.0pt\raise 0.0pt\hbox{\lx@xy@tip{1}\lx@xy@tip{-1}}}}}}{\hbox{\lx@xy@droprule}}\ignorespaces\ignorespaces\ignorespaces{\hbox{\kern 51.56651pt\raise 11.29993pt\hbox{{}\hbox{\kern 0.0pt\raise 0.0pt\hbox{\hbox{\kern 3.0pt\hbox{\hbox{\kern 0.0pt\raise-1.75pt\hbox{$\scriptstyle{d[-]}$}}}\kern 3.0pt}}}}}}\ignorespaces{}{\hbox{\lx@xy@droprule}}{\hbox{\lx@xy@droprule}}\ignorespaces\ignorespaces\ignorespaces\ignorespaces{}{\hbox{\lx@xy@droprule}}\ignorespaces\ignorespaces\ignorespaces{\hbox{\kern 195.38962pt\raise 8.9917pt\hbox{{}\hbox{\kern 0.0pt\raise 0.0pt\hbox{\hbox{\kern 3.0pt\hbox{\hbox{\kern 0.0pt\raise-2.39166pt\hbox{$\scriptstyle{\mathrm{Gen}}$}}}\kern 3.0pt}}}}}}\ignorespaces{\hbox{\kern 225.97572pt\raise 3.60004pt\hbox{\hbox{\kern 0.0pt\raise 0.0pt\hbox{\lx@xy@tip{1}\lx@xy@tip{-1}}}}}}{\hbox{\lx@xy@droprule}}{\hbox{\lx@xy@droprule}}\ignorespaces\ignorespaces\ignorespaces\ignorespaces{}\ignorespaces{\hbox{\kern 202.01115pt\raise 0.0pt\hbox{\hbox{\kern 0.0pt\raise-1.75pt\hbox{$\scriptstyle{\cong}$}}}}}\ignorespaces{}{\hbox{\kern 225.97572pt\raise 0.0pt\hbox{\hbox{\kern 0.0pt\raise 0.0pt\hbox{\hbox{\kern 3.0pt\raise 0.0pt\hbox{$\textstyle{(\mathbf{DivEPMet}(T_{\Omega},X),\preceq)\ignorespaces\ignorespaces\ignorespaces\ignorespaces}$}}}}}}}\ignorespaces\ignorespaces\ignorespaces\ignorespaces{}{\hbox{\lx@xy@droprule}}\ignorespaces\ignorespaces\ignorespaces{\hbox{\kern 195.9334pt\raise-10.10004pt\hbox{{}\hbox{\kern 0.0pt\raise 0.0pt\hbox{\hbox{\kern 3.0pt\hbox{\hbox{\kern 0.0pt\raise-1.75pt\hbox{$\scriptstyle{(-)_{X}}$}}}\kern 3.0pt}}}}}}\ignorespaces{\hbox{\kern 183.2966pt\raise-3.60004pt\hbox{\hbox{\kern 0.0pt\raise 0.0pt\hbox{\lx@xy@tip{1}\lx@xy@tip{-1}}}}}}{\hbox{\lx@xy@droprule}}{\hbox{\lx@xy@droprule}}\ignorespaces}}}}\ignorespaces.

(7)

By combining these, a QET of type $\Omega$ over $X$ determines an $X$ -generated ${\color[rgb]{0,0,0}\mathrm{Eq}}$ -relative $\mathcal{R}^{+}$ -divergence on $T_{\Omega}$ and vice versa. The poset in the middle is that of congruent and substitutive pseudometrics, which are a quantitative analogue of congruent and substitutive preorders.

Definition 13.

Let $T$ be a monad on ${\bf Set}$ and $X\in{\bf Set}$ . A congruent and substitutive pseudometric (CS-EPMet for short) on $TX$ is an extended pseudometric⁶⁶6A function $d\colon A^{2}\to\mathcal{R}^{+}$ is called an extended pseudometric on $A$ if $d(a,a)=0$ (reflexivity), $d(b,a)=d(a,b)$ (symmetry) and $d(a,c)\leq d(a,b)+d(b,c)$ (triangle-inequality) hold for all $a,b,c\in A$ . $d\colon(TX)^{2}\to\mathcal{R}^{+}$ on $TX$ satisfying

Substitutivity: For all function $fX\to TX$ and $c_{1},c_{2}\in TX$ , $d(f^{\sharp}(c_{1}),f^{\sharp}(c_{2}))\leq d(c_{1},c_{2})$ .
Congruence: For all set $I$ , function $f_{1},f_{2}\colon I\to TX$ and $c\in TI$ , $d(f_{1}^{\sharp}(c),f_{2}^{\sharp}(c))\leq\sup_{i\in I}d(f_{1}(i),f_{2}(i))$ .

We denote by ${\bf CSEPMet}(T,X)$ the set of CS-EPMets on $TX$ . We then make it into a poset $({\bf CSEPMet}(T,X),\preceq)$ by the following pointwise opposite order:

d\preceq d^{\prime}\iff\forall{c_{1},c_{2}\in TX}~{}.~{}d(c_{1},c_{2})\geq d^{\prime}(c_{1},c_{2}).

Definition 14.

Let $T$ be a monad on ${\bf Set}$ and $X\in{\bf Set}$ . We denote by $\mathbf{DivEPMet}(T,X)$ the collection of $X$ -generated ${\color[rgb]{0,0,0}\mathrm{Eq}}$ -relative $\mathcal{R}^{+}$ -divergences ${\mathsf{\Delta}}$ on $T$ such that each component ${\mathsf{\Delta}}_{I}$ is an extended pseudometric. We restrict the partial order $\preceq$ on ${\bf Div}(T,{\color[rgb]{0,0,0}\mathrm{Eq}},1,\mathcal{R}^{+})$ to $\mathbf{DivEPMet}(T,X)$ .

We next introduce various monotone functions appearing in (7).

	$\displaystyle d[U](t,u)\triangleq\inf\left\{\varepsilon\in\mathbb{Q}^{+}~{}\middle\|~{}\emptyset\vdash{t}=_{\varepsilon}{u}\in U\right\}$	$\displaystyle\mathrm{Gen}(d)_{I}(c_{1},c_{2})\triangleq\sup_{k\colon I\to TX}d(k^{\sharp}(c_{1}),k^{\sharp}(c_{2}))$
	$\displaystyle U[d]\triangleq\overline{\left\{\emptyset\vdash{t}=_{\varepsilon}{u}~{}\middle\|~{}\varepsilon\in\mathbb{Q}^{+},d(t,u)\leq\varepsilon\right\}}^{\mathrm{QET}({\Omega},{X})}$	$\displaystyle({\mathsf{\Delta}})_{X}\triangleq{\mathsf{\Delta}}_{X}$

Proposition 12.

The functions $d[-],U[-],\mathrm{Gen},(-)_{X}$ defined above are all well-defined monotone functions having types given in (7).

That $d[U]$ is an extended pseudometric is shown in the beginning of [39, Section 5]. Here we additionally show that it enjoys congruence and substitutivity of Definition 13. The function $\mathrm{Gen}$ is taken from the right hand side of the definition of $\Omega$ -generatedness (Definition 11). The function $(-)_{X}$ simply extracts the $X$ -th component of a given divergence.

Theorem 6.

For any set $\Omega$ of function symbols with finite arity and set $X$ , the following holds for the monotone functions in (7):

1.

$\mathrm{Gen}$ is the inverse of $(-)_{X}$ .

We have an adjunction satisfying $d[U[-]]={\rm id}$ :

(8)

In the proof of this theorem, we used the definition of models of QET ([6]). Intuitively, the right adjoint $d[-]$ extracts the pseudometric on $T_{\Omega}X$ from a given QET. The left adjoint $U[-]$ constructs the least QET containing all information of a given pseudometric on $T_{\Omega}X$ . The adjunction (8) also implies that we can construct monads on the category of extended metric spaces from CS-EPMets by Mardare et al.’s metric term monad construction ([39]). Overall adjunction (7) says that $X$ -generated divergences can be axiomatized with QETs whose variable set is $X$ .

The range of $U[-]$ is a subset of $\mathbf{UQET}(\Omega,X)$ of unconditional QETs defined below (See also [38, Section 3]):

\mathbf{UQET}(\Omega,X)\triangleq\left\{V\in{\bf QET}(\Omega,X)~{}\middle|~{}\exists S\subseteq\{\emptyset\vdash{t}=_{\varepsilon}{u}~{}|~{}t,u\in T_{\Omega}X,\varepsilon\in\mathbb{Q}^{+}\}.~{}V=\overline{S}^{\mathrm{QET}({\Omega},{X})}\right\}.

Unconditional QETs of type $\Omega$ over $X$ are equivalent to $X$ -generated divergence on $T_{\Omega}$ : restricting QETs to unconditional QETs, the adjunction (8) becomes a pair of isomorphisms.

Theorem 7.

$(\mathbf{UQET}(\Omega,X),\subseteq)\cong({\bf CSEPMet}(T_{\Omega},X),\preceq)\cong(\mathbf{DivEPMet}(T_{\Omega},X),\preceq)$ .

7 Graded Strong Relational Liftings for Divergences

We have introduced the concept of divergence on monad for measuring quantitative difference between two computational effects. To integrate this concept with relational program logic, we employ a semantic structure called graded strong relational lifting of monad. It is introduced for the semantics of approximate probabilistic relational Hoare logic for the verification of differential privacy ([12]), then later used in various program logics ([13, 8, 9, 51, 52]). Independently, it is also introduced as a semantic structure for effect system ([31]). Liftings introduced in the study of differential privacy are designed to satisfy a special property called fundamental property [12, Theorem 1]: when we supply the equivalence relation to the lifting, it returns the adjacency relation of the divergence. This special property is the key to express the differential privacy of probabilistic programs in relational program logics.

In this paper, we present a general construction of graded strong relational liftings from divergences on monads. First, we recall its definition ([31, 24]).

Definition 15.

Let $(\mathbb{C},T)$ be a CC-SM and $(M,\leq,1,(\cdot))$ be a grading monoid. An $M$ -graded strong relational lifting $\dot{T}$ of $T$ is a mapping $\dot{T}:M\times{\bf Obj}({\bf BRel}(\mathbb{C}))\rightarrow{\bf Obj}({\bf BRel}(\mathbb{C}))$ satisfying the following conditions:

1.

$p_{\mathbb{C}}(\dot{T}mX)=(TX_{1},TX_{2})$ , and $m\leq m^{\prime}$ implies $\dot{T}mX\leq\dot{T}m^{\prime}X$ .
2.

$(\eta_{X_{1}},\eta_{X_{2}}):X\mathbin{\dot{\rightarrow}}\dot{T}1(X)$ .
3.

$(f_{1},f_{2}):X\mathbin{\dot{\rightarrow}}\dot{T}m(Y)$ implies $(f^{\sharp}_{1},f^{\sharp}_{2}):\dot{T}m^{\prime}X\mathbin{\dot{\rightarrow}}\dot{T}(m\cdot m^{\prime})Y$ .
4.

$(\theta_{X_{1},Y_{1}},\theta_{X_{2},Y_{2}}):X\mathbin{\dot{\times}}\dot{T}mY\mathbin{\dot{\rightarrow}}\dot{T}m(X\mathbin{\dot{\times}}Y)$ .

Our interest is in the graded strong relational lifting that carries the information of a given divergence ${\mathsf{\Delta}}\in{\bf Div}(T,E,M,\mathcal{Q})$ . We identify such liftings by the following fundamental property. First define the adjacency relation of ${\mathsf{\Delta}}$ by

\tilde{{\mathsf{\Delta}}}(m,v)I\triangleq(TI,TI,\{(c_{1},c_{2})~{}|~{}{\mathsf{\Delta}}^{m}_{I}(c_{1},c_{2})\leq v\})\quad(m\in M,v\in\mathcal{Q},I\in\mathbb{C}).

(9)

Note that $\tilde{\mathsf{\Delta}}$ is monotone on $m$ and $v$ .

Definition 16.

We say that an $M\times\mathcal{Q}$ -graded strong relational lifting $\dot{T}$ of $T$ satisfies the fundamental property with respect to ${\mathsf{\Delta}}\in{\bf Div}(T,E,M,\mathcal{Q})$ if the following holds:

\dot{T}(m,v)(EI)=\tilde{\mathsf{\Delta}}(m,v)I\quad(m\in M,v\in\mathcal{Q},I\in\mathbb{C}).

Theorem 8.

Let $(\mathbb{C},T)$ be a CC-SM, $(M,\leq,1,(\cdot))$ be a grading monoid, $\mathcal{Q}$ be a divergence domain and ${\mathsf{\Delta}}=\{{\mathsf{\Delta}}^{m}_{I}\colon(U(TI))^{2}\to\mathcal{Q}\}_{m\in M,I\in\mathbb{C}}$ be a doubly-indexed family of $\mathcal{Q}$ -divergences satisfying monotonicity on $m$ (Definition 6). Define the following mapping $T^{[{\mathsf{\Delta}}]}:(M\times\mathcal{Q})\times{\bf Obj}({\bf BRel}(\mathbb{C}))\to{\bf Obj}({\bf BRel}(\mathbb{C}))$ :

	$\displaystyle T^{[{\mathsf{\Delta}}]}(m,v)X\triangleq(TX_{1},TX_{2},\{(c_{1},c_{2})~{}\|~{}$	$\displaystyle\forall{I\in\mathbb{C},n\in M,w\in\mathcal{Q},(k_{1},k_{2}):X\mathbin{\dot{\rightarrow}}\tilde{\mathsf{\Delta}}(n,w)I}~{}.~{}$
		$\displaystyle\quad(k_{1}^{\sharp}\mathbin{\bullet}c_{1},k_{2}^{\sharp}\mathbin{\bullet}c_{2})\in\tilde{\mathsf{\Delta}}(m\cdot n,v+w)I\})$

1.

The mapping $T^{[{\mathsf{\Delta}}]}$ is an $M\times\mathcal{Q}$ -graded strong relational lifting of $T$ .

Let $E:\mathbb{C}\to{\bf BRel}(\mathbb{C})$ be a basic endorelation. Then

	${\mathsf{\Delta}}$ is $E$ -unit-reflexive	$\displaystyle\iff\forall{I\in\mathbb{C},(m,v)\in M\times\mathcal{Q}}~{}.~{}T^{[{\mathsf{\Delta}}]}(m,v)(EI)\leq\tilde{\mathsf{\Delta}}(m,v)I$		(S)
	${\mathsf{\Delta}}$ is $E$ -composable	$\displaystyle\iff\forall{I\in\mathbb{C},(m,v)\in M\times\mathcal{Q}}~{}.~{}T^{[{\mathsf{\Delta}}]}(m,v)(EI)\geq\tilde{\mathsf{\Delta}}(m,v)I.$		(C)

The construction of $T^{[{\mathsf{\Delta}}]}$ is a graded extension of the codensity lifting ([51, 33]). The remainder of this section is the proof of Theorem 8.

Proof.

(Proof of (1)) Proving conditions 1-3 of graded strong relational lifting (Definition 15) are routine generalization of [33] and [31, Section 5]; thus omitted here (see Lemma 4 in appendix).

However, condition 4 of Definition 15 needs a special attention because in general codensity lifting does not automatically lift strength. The current setting works because of our particular choice of the category of binary relations over $\mathbb{C}$ . We prove condition 4 as follows. Since $f_{i}\mathbin{\bullet}j=f\mathbin{\bullet}\langle i,j\rangle$ for any $j\in UJ$ holds, we have the equivalence

	$\displaystyle(f,g):X\mathbin{\dot{\times}}Y\mathbin{\dot{\rightarrow}}Z$	$\displaystyle\iff\forall(x,x^{\prime})\in X,(y,y^{\prime})\in Y.(f\mathbin{\bullet}{\langle x,y\rangle},g\mathbin{\bullet}{\langle x^{\prime},y^{\prime}\rangle})\in Z$
		$\displaystyle\iff\forall(x,x^{\prime})\in X,(y,y^{\prime})\in Y.\left(\left(f_{x}\right)\mathbin{\bullet}{y},\left(g_{x^{\prime}}\right)\mathbin{\bullet}{y^{\prime}}\right)\in Z$
		$\displaystyle\iff\forall(x,x^{\prime})\in X.(f_{x},g_{x^{\prime}})\colon Y\mathbin{\dot{\rightarrow}}Z.$

From this, condition 3 (law of graded Kleisli extension), and the equation (1) on the strength of a CC-SM, we prove condition 4 from condition 2 (unit law): for all $m\in M$ and $v\in\mathcal{Q}$ , we have

	$\displaystyle(\eta_{X_{1}\times Y_{1}},\eta_{X_{2}\times Y_{2}})\colon X\mathbin{\dot{\times}}Y\mathbin{\dot{\rightarrow}}T^{[{\mathsf{\Delta}}]}(1,0)(X\mathbin{\dot{\times}}Y)$
	$\displaystyle\iff\forall{(x,x^{\prime})\in X}~{}.~{}((\eta_{X_{1}\times Y_{1}})_{x},(\eta_{X_{2}\times Y_{2}})_{x^{\prime}})\colon Y\mathbin{\dot{\rightarrow}}T^{[{\mathsf{\Delta}}]}(1,0)(X\mathbin{\dot{\times}}Y)$
	$\displaystyle\implies\forall{(x,x^{\prime})\in X}~{}.~{}(((\eta_{X_{1}\times Y_{1}})_{x})^{\sharp},((\eta_{X_{2}\times Y_{2}})_{x^{\prime}})^{\sharp}):T^{[{\mathsf{\Delta}}]}(m,v)Y\mathbin{\dot{\rightarrow}}T^{[{\mathsf{\Delta}}]}(m,v)(X\mathbin{\dot{\times}}Y)$
	$\displaystyle\iff\left(\begin{aligned} &\forall{(x,x^{\prime})\in X,(c_{1},c_{2})\in T^{[{\mathsf{\Delta}}]}(m,v)Y}~{}.~{}\\ &\qquad(((\eta_{X_{1}\times Y_{1}})_{x})^{\sharp}\mathbin{\bullet}c_{1},((\eta_{X_{2}\times Y_{2}})_{x^{\prime}})^{\sharp}\mathbin{\bullet}c_{2})\in T^{[{\mathsf{\Delta}}]}(m,v)(X\mathbin{\dot{\times}}Y)\end{aligned}\right)$
	$\displaystyle\iff\left(\begin{aligned} &\forall{(x,x^{\prime})\in X,(c_{1},c_{2})\in T^{[{\mathsf{\Delta}}]}(m,v)Y}~{}.~{}\\ &\qquad(\theta_{X_{1},Y_{1}}\mathbin{\bullet}\langle x,c_{1}\rangle,\theta_{X_{2},Y_{2}}\mathbin{\bullet}\langle x^{\prime},c_{2}\rangle)\in T^{[{\mathsf{\Delta}}]}(m,v)(X\mathbin{\dot{\times}}Y)\end{aligned}\right)$
	$\displaystyle\iff\forall{(x,x^{\prime})\in X}~{}.~{}((\theta_{X_{1},Y_{1}})_{x},(\theta_{X_{2},Y_{2}})_{x^{\prime}})\colon T^{[{\mathsf{\Delta}}]}(m,v)Y\mathbin{\dot{\rightarrow}}T^{[{\mathsf{\Delta}}]}(m,v)(X\mathbin{\dot{\times}}Y)$
	$\displaystyle\iff(\theta_{X_{1},Y_{1}},\theta_{X_{2},Y_{2}})\colon X\mathbin{\dot{\times}}T^{[{\mathsf{\Delta}}]}(m,v)Y\mathbin{\dot{\rightarrow}}T^{[{\mathsf{\Delta}}]}(m,v)(X\mathbin{\dot{\times}}Y).$

(Proof of (2)-(S)) We show the equivalence of ${\mathsf{\Delta}}$ being $E$ -unit-reflexive and the implication

	$\displaystyle\forall{I\in\mathbb{C},m\in M,v\in\mathcal{Q},c,c^{\prime}\in U(TI)}~{}.~{}$
	$\displaystyle\qquad(\forall{J\in\mathbb{C},m^{\prime}\in M,v^{\prime}\in\mathcal{Q},(k,l):EI\mathbin{\dot{\rightarrow}}\tilde{\mathsf{\Delta}}(m^{\prime},v^{\prime})J}~{}.~{}{\mathsf{\Delta}}^{m\cdot m^{\prime}}_{J}(k^{\sharp}\mathbin{\bullet}c,l^{\sharp}\mathbin{\bullet}{c^{\prime}})\leq v+v^{\prime})$		(10)
	$\displaystyle\qquad\qquad\implies{\mathsf{\Delta}}^{m}_{I}(c,c^{\prime})\leq v.$

We suppose that the above implication holds. We fix $I\in\mathbb{C}$ . Let $(i,j)\in EI$ . By instantiating the whole implication with $m=1,v=0,c=\eta_{I}\mathbin{\bullet}i,c^{\prime}=\eta_{I}\mathbin{\bullet}j$ , the middle part of (10) becomes

\forall{J\in\mathbb{C},m^{\prime}\in M,v^{\prime}\in\mathcal{Q},(k,l):EI\mathbin{\dot{\rightarrow}}\tilde{\mathsf{\Delta}}(m^{\prime},v^{\prime})J}~{}.~{}{\mathsf{\Delta}}^{m^{\prime}}_{J}(k\mathbin{\bullet}i,l\mathbin{\bullet}j)\leq v^{\prime},

which is trivially true. Therefore we conclude ${\mathsf{\Delta}}^{m}_{I}(\eta_{I}\mathbin{\bullet}i,\eta_{I}\mathbin{\bullet}j)\leq 0$ for any $(i,j)\in EI$ , that is, $E$ -unit reflexivity holds.

Conversely, we suppose that ${\mathsf{\Delta}}$ satisfies the unit-reflexivity. We take $I,m,v,c,c^{\prime}$ of appropriate type and assume the middle part of (10). By instantiating it with $J=I,m^{\prime}=1,v^{\prime}=0,k=l=\eta_{I}$ , we conclude ${\mathsf{\Delta}}^{m}_{I}(c,c^{\prime})\leq v$ .

(Proof of (2)-(C)) We show the equivalence of ${\mathsf{\Delta}}$ being $E$ -composable and the implication $\forall{I\in\mathbb{C},m\in M,v\in\mathcal{Q}}~{}.~{}\tilde{\mathsf{\Delta}}I(m,v)\leq T^{[{\mathsf{\Delta}}]}I(m,v)(EI)$ as follows:

	$\displaystyle\forall{I\in\mathbb{C},m\in M,v\in\mathcal{Q}}~{}.~{}\tilde{\mathsf{\Delta}}I(m,v)\leq T^{[{\mathsf{\Delta}}]}I(m,v)(EI)$
		$\displaystyle\iff\left(\begin{aligned} &\forall{I\in\mathbb{C},m\in M,v\in\mathcal{Q},c,c^{\prime}\in U(TI)}~{}.~{}\\ &\qquad{\mathsf{\Delta}}^{m}_{I}(c,c^{\prime})\leq v\implies\\ &\qquad\qquad\forall{J\in\mathbb{C},m^{\prime}\in M,v^{\prime}\in\mathcal{Q},(k,l)\colon EI\mathbin{\dot{\rightarrow}}\tilde{\mathsf{\Delta}}(m^{\prime},v^{\prime})J}~{}.~{}\\ &\qquad\qquad\qquad(k^{\sharp}\mathbin{\bullet}c,l^{\sharp}\mathbin{\bullet}c^{\prime})\in\tilde{\mathsf{\Delta}}(m\cdot m^{\prime},v+v^{\prime})J\end{aligned}\right)$
		$\displaystyle\iff\left(\begin{aligned} &\forall{I,J\in\mathbb{C},m\in M,v\in\mathcal{Q},c,c^{\prime}\in U(TI),m^{\prime}\in M,v^{\prime}\in\mathcal{Q},k,l\in\mathbb{C}(I,TJ)}~{}.~{}\\ &\qquad{\mathsf{\Delta}}^{m}_{I}(c,c^{\prime})\leq v\implies\\ &\qquad\qquad(\forall{(i,j)\in EI}~{}.~{}(k\mathbin{\bullet}i,l\mathbin{\bullet}j)\in\tilde{\mathsf{\Delta}}(m^{\prime},v^{\prime})I)\implies{\mathsf{\Delta}}^{m\cdot m^{\prime}}_{I}(k^{\sharp}\mathbin{\bullet}c,l^{\sharp}\mathbin{\bullet}c^{\prime})\leq v+v^{\prime}\end{aligned}\right)$
		$\displaystyle\iff\left(\begin{aligned} &\forall{I,J\in\mathbb{C},m\in M,v\in\mathcal{Q},c,c^{\prime}\in U(TI),m^{\prime}\in M,v^{\prime}\in\mathcal{Q},k,l\in\mathbb{C}(I,TJ)}~{}.~{}\\ &\qquad{\mathsf{\Delta}}^{m}_{I}(c,c^{\prime})\leq v\implies\\ &\qquad\qquad\textstyle\sup_{(i,j)\in EI}{\mathsf{\Delta}}^{m^{\prime}}_{J}(k\mathbin{\bullet}i,l\mathbin{\bullet}j)\leq v^{\prime}\implies{\mathsf{\Delta}}^{m\cdot m^{\prime}}_{J}(k^{\sharp}\mathbin{\bullet}c,l^{\sharp}\mathbin{\bullet}{c^{\prime}})\leq v+v^{\prime}\end{aligned}\right)$
		$\displaystyle\iff\left(\begin{aligned} &\forall{I,J\in\mathbb{C},m\in M,c,c^{\prime}\in U(TI),m^{\prime}\in M,k,l\in\mathbb{C}(I,TJ)}~{}.~{}\\ &\qquad{\mathsf{\Delta}}^{m\cdot m^{\prime}}_{I}(k^{\sharp}\mathbin{\bullet}c,l^{\sharp}\mathbin{\bullet}{c^{\prime}})\leq{\mathsf{\Delta}}^{m}_{I}(c,c^{\prime})+\textstyle\sup_{(i,j)\in EI}{\mathsf{\Delta}}^{m^{\prime}}_{I}(k\mathbin{\bullet}i,l\mathbin{\bullet}j).\end{aligned}\right).$

The first two equivalences are obtained by expanding the definitions of ${\bf BRel}(\mathbb{C})$ , $T^{[{\mathsf{\Delta}}]}{}$ and $\tilde{\mathsf{\Delta}}$ , the last two equivalences hold because $\mathcal{Q}$ is a divergence domain. ∎

Combining the fundamental property and the strength of $T^{[{\mathsf{\Delta}}]}$ , we recover a strength law of divergences.

Proposition 13.

Let $(\mathbb{C},T)$ be a CC-SM, $E:\mathbb{C}\to{\bf BRel}(\mathbb{C})$ be a basic endorelation, $(M,\leq,1,(\cdot))$ be a grading monoid and $\mathcal{Q}$ be a divergence domain. Suppose also that $EI\mathbin{\dot{\times}}EJ\subseteq E(I\times J)$ holds for all $I,J\in\mathbb{C}$ . Then each divergence ${\mathsf{\Delta}}\in{\bf Div}(T,E,M,\mathcal{Q})$ satisfies: for all $(x_{1},x_{2})\in EI$ and $c_{1},c_{2}\in U(TI)$ ,

{\mathsf{\Delta}}^{m}_{I\times J}(\theta_{I,J}\mathbin{\bullet}\langle x_{1},c_{1}\rangle,\theta_{I,J}\mathbin{\bullet}\langle x_{2},c_{2}\rangle)\leq{\mathsf{\Delta}}^{m}_{J}(c_{1},c_{2}).

7.1 Simplifying Codensity Liftings by $\Omega$ -Generatedness of Divergences

We here show that for an $\Omega$ -generated divergence ${\mathsf{\Delta}}$ , the calculation of the codensity lifting $T^{[{\mathsf{\Delta}}]}{}$ can be simplified. For an object $I\in\mathbb{C}$ , we define $T^{[{\mathsf{\Delta}}],I}$ by

	$\displaystyle(c_{1},c_{2})\in T^{[{\mathsf{\Delta}}],I}(m,v)X$
	$\displaystyle\iff\forall{n,w,(k_{1},k_{2})\colon X\mathbin{\dot{\rightarrow}}\tilde{\mathsf{\Delta}}(n,w)I}~{}.~{}(k_{1}^{\sharp}\mathbin{\bullet}c_{1},k_{2}^{\sharp}\mathbin{\bullet}c_{2})\in\tilde{\mathsf{\Delta}}(m\cdot n,v+w)I.$

The original calculation of $T^{[{\mathsf{\Delta}}]}{}$ is a large intersection $T^{[{\mathsf{\Delta}}]}=\bigwedge_{I\in\mathbb{C}}T^{[{\mathsf{\Delta}}],I}$ where $I$ runs over all $\mathbb{C}$ -objects, but if ${\mathsf{\Delta}}$ is $\Omega$ -generated, the parameter $I$ can be fixed at $\Omega$ .

Proposition 14.

For any $\Omega$ -generated divergence ${\mathsf{\Delta}}\in{\bf Div}(T,E,M,\mathcal{Q})$ , we have $T^{[{\mathsf{\Delta}}]}{}=T^{[{\mathsf{\Delta}}],\Omega}$ .

Proof.

We show the equivalence $T^{[{\mathsf{\Delta}}]}X=T^{[{\mathsf{\Delta}}],\Omega}X$ for each $X\in{\bf BRel}(\mathbb{C})$ .

( $\supseteq$ ) Immediate from $T^{[{\mathsf{\Delta}}]}=\bigwedge_{I\in\mathbb{C}}T^{[{\mathsf{\Delta}}],I}$ .

( $\subseteq$ ) By the $\Omega$ -generatedness of ${\mathsf{\Delta}}$ , we have for all $I\in\mathbb{C}$ and $c^{\prime}_{1},c^{\prime}_{2}\in U(TI)$ ,

(c^{\prime}_{1},c^{\prime}_{2})\in\tilde{\mathsf{\Delta}}(m^{\prime},v^{\prime})I\iff\forall{k\colon I\to T\Omega}~{}.~{}(k^{\sharp}\mathbin{\bullet}c^{\prime}_{1},k^{\sharp}\mathbin{\bullet}c^{\prime}_{2})\in\tilde{\mathsf{\Delta}}(m^{\prime},v^{\prime})\Omega

Therefore, for any $(c_{2},c_{2})\in U(TX_{1})\times U(TX_{2})$ , we have

	$\displaystyle(c_{1},c_{2})\in T^{[{\mathsf{\Delta}}],\Omega}X$
		$\displaystyle\iff\forall{n\in M,w\in\mathcal{Q},(k_{1},k_{2})\colon X\mathbin{\dot{\rightarrow}}\tilde{\mathsf{\Delta}}(n,w)\Omega}~{}.~{}(k_{1}^{\sharp}\mathbin{\bullet}c_{1},k_{2}^{\sharp}\mathbin{\bullet}c_{2})\in\tilde{\mathsf{\Delta}}(m\cdot n,v+w)\Omega$
		$\displaystyle\implies\left(\begin{aligned} \forall{I\in\mathbb{C},n\in M,w\in\mathcal{Q},(l_{1},l_{2})\colon X\mathbin{\dot{\rightarrow}}\tilde{\mathsf{\Delta}}(n,w)I,k\colon I\to T\Omega}~{}.~{}\\ \qquad(k^{\sharp}\circ l_{1}^{\sharp}\mathbin{\bullet}c_{1},k^{\sharp}\circ l_{2}^{\sharp}\mathbin{\bullet}c_{2})\in\tilde{\mathsf{\Delta}}(m\cdot n,v+w)\Omega\end{aligned}\right)$
		$\displaystyle\iff\forall{I\in\mathbb{C},n\in M,w\in\mathcal{Q},(l_{1},l_{2})\colon X\mathbin{\dot{\rightarrow}}\tilde{\mathsf{\Delta}}(n,w)I}~{}.~{}(l_{1}^{\sharp}\mathbin{\bullet}c_{1},l_{2}^{\sharp}\mathbin{\bullet}c_{2})\in\tilde{\mathsf{\Delta}}(m\cdot n,v+w)I$
		$\displaystyle\iff(c_{1},c_{2})\in T^{[{\mathsf{\Delta}}]}X.$

This completes the proof. ∎

For example, the generatedness of $\mathsf{DP}$ shown in Section 6.2 implies that $G^{[\mathsf{DP}]}=G^{[\mathsf{DP}],2}$ and $G_{s}^{[\mathsf{DP}]}=G_{s}^{[\mathsf{DP}],1}$ . In fact, the simplification $G_{s}^{[\mathsf{DP}],1}$ is equal to the $(\mathcal{R}^{+})^{2}$ -graded relational lifting $G_{s}^{\top\top}$ for DP given in [51, Section 2.2], which is defined by, for each $(X_{1},X_{2},R_{X})\in{\bf BRel}({\bf Meas})$ ,

	$\displaystyle G_{s}^{{\top\top}}(\varepsilon,\delta)(X_{1},X_{2},R_{X})$
	$\displaystyle\triangleq(G_{s}(X_{1}),G_{s}(X_{2}),\{(\nu_{1},\nu_{2})\mid\forall{A\in\Sigma_{X_{1}},B\in\Sigma_{X_{2}}}~{}.~{}R_{X}(A)\subseteq B\implies\nu_{1}(A)\leq\exp(\varepsilon)\nu_{2}(B)+\delta\}).$

For detail, see the proof of equalities (†) and (‡) in the proof of [51, Theorem 2.2(iv)].

7.2 Two Lifting Approaches: Codensity and Coupling

We briefly compare two lifting approaches: graded codensity lifting and coupling-based lifting employed in ([12, 13, 8, 9, 52]).

We compare the role of the unit-reflexivity and composability in the codensity graded lifting and the coupling-based graded lifting. Consider the CCC-SM $({\bf Set},D)$ , where $D$ is the probability distribution monad. Given an ${\color[rgb]{0,0,0}\mathrm{Eq}}$ -relative $M$ -graded $\mathcal{Q}$ -divergence ${\mathsf{\Delta}}$ on $D$ , the coupling-based graded lifting is defined by

\dot{D}^{{\mathsf{\Delta}}}(m,v)X\triangleq\{(Dp_{1}\mathbin{\bullet}\mu_{1},Dp_{2}\mathbin{\bullet}\mu_{2})~{}|~{}(\mu_{1},\mu_{2})\in(DR_{X})^{2},{\mathsf{\Delta}}^{m}_{R_{X}}(\mu_{1},\mu_{2})\leq v\}

(11)

where $p_{i}\colon R_{X}\rightarrow X_{i}$ is the projection ( $i=1,2$ ) from the binary relation. The pair $(\mu_{1},\mu_{2})$ of probability distributions collected in the right hand side of (11) is called a coupling.

The fundamental property $\dot{D}^{\mathsf{\Delta}}({\color[rgb]{0,0,0}\mathrm{Eq}}I)=\tilde{\mathsf{\Delta}}(m,v)I$ immediately follows from the definition of $\dot{D}^{\mathsf{\Delta}}$ , while the composability and unit-reflexivity of ${\mathsf{\Delta}}$ are used to make $\dot{D}^{{\mathsf{\Delta}}}$ a strong $M\times\mathcal{Q}$ -graded lifting [13, Proposition 9]. On the other hand, the codensity graded lifting $D^{[{\mathsf{\Delta}}]}$ is always an $M\times\mathcal{Q}$ -graded lifting; this does not rely on the unit-reflexivity and composability of ${\mathsf{\Delta}}$ (Proposition 1). These properties are used to show that $D^{[{\mathsf{\Delta}}]}$ satisfies the fundamental property (Proposition 2).

The coupling-based lifting (11) can be naturally generalized to any ${\bf Set}$ -monad $T$ . However, at this moment we do not know how to generalize the coupling technique to any CC-SM $(\mathbb{C},T)$ . As the prior study by [52] pointed out, there is already a difficulty in extending it to the CC-SM $({\bf Meas},G)$ .

We illustrate how the problem arises. Let $X\in{\bf BRel}({\bf Meas})$ . We would like to pick two probability measures over $R_{X}$ as couplings, but $R_{X}$ is merely a set. We therefore equip it with the subspace $\sigma$ -algebra of $X_{1}\times X_{2}$ , and let $H_{X}$ be the derived measurable space (hence $|H_{X}|=R_{X}$ ). We write $p_{i}:H_{X}\rightarrow X_{i}$ for measurable projections ( $i=1,2$ ). We then define a candidate $M\times\mathcal{Q}$ -graded lifting of $G$ by

\dot{G}(m,v)X=\{(Gp_{1}\mathbin{\bullet}\mu_{1},Gp_{2}\mathbin{\bullet}\mu_{2})~{}|~{}(\mu_{1},\mu_{2})\in(UGH_{X})^{2},{\mathsf{\Delta}}^{m}_{H_{X}}(\mu_{1},\mu_{2})\leq v\}.

We now verify that $\dot{G}$ also lifts the Kleisli extension of $G$ , that is,

(f,g)\colon Y\mathbin{\dot{\rightarrow}}\dot{G}(m^{\prime},v^{\prime})X\implies(f^{\sharp},g^{\sharp})\colon\dot{G}(m,v)Y\to\dot{G}(mm^{\prime},v+v^{\prime})X.

Let $(f,g)\colon Y\mathbin{\dot{\rightarrow}}\dot{G}(m^{\prime},v^{\prime})X$ be pair of measurable functions. Then for each $(x,y)\in R_{Y}$ , we have $(f\mathbin{\bullet}x,g\mathbin{\bullet}y)\in R_{\dot{G}(m,v)X}$ . Therefore there exists $(\mu^{(x,y)}_{1},\mu^{(x,y)}_{2})\in(UGH_{X})^{2}$ such that $G\pi_{1}\mathbin{\bullet}\mu^{(x,y)}_{1}=f\mathbin{\bullet}x$ and $G\pi_{2}\mathbin{\bullet}\mu^{(x,y)}_{2}=g\mathbin{\bullet}y$ . Using the axiom of choice, we turn this relationship into functions $\mu_{1},\mu_{2}\colon R_{Y}\to UGH_{X}$ . If they were measurable functions of type $H_{Y}\rightarrow GH_{X}$ , then from the composability of ${\mathsf{\Delta}}$ , we would have ${\mathsf{\Delta}}^{mm^{\prime}}_{H_{X}}(\mu^{\sharp}_{1}\mathbin{\bullet}w_{1},\mu^{\sharp}_{2}\mathbin{\bullet}w_{2})\leq v+v^{\prime}$ for $w_{1},w_{2}\in UGH_{Y}$ such that ${\mathsf{\Delta}}^{m^{\prime}}_{H_{Y}}(w_{1},w_{2})\leq v^{\prime}$ . This gives $(f^{\sharp},g^{\sharp})\colon\dot{G}(m,v)Y\mathbin{\dot{\rightarrow}}\dot{G}(mm^{\prime},v+v^{\prime})X$ . However, in general, ensuring the measurability of $\mu_{1},\mu_{2}$ is not possible, especially because they are picked up by the axiom of choice. A solution given in [52] is to use the category ${\bf Span}({\bf Meas})$ of spans, that guarantees the existence of good measurable functions $h_{1},h_{2}\colon H_{Y}\rightarrow GH_{X}$ .

8 Approximate Computational Relational Logic

We introduce a program logic called approximate computational relational logic (acRL for short). It is a combination of Moggi’s computational metalanguage and a relational refinement type system ([9]). The strong graded relational lifting of a monad constructed from a divergence will be used to relationally interpret monadic types, and gradings give upper bounds of divergences between computational effects caused by two programs. acRL is similar to the relational refinement type system HOARe2 ([9]), which is designed for verifying differential privacy of probabilistic programs. Compared to HOARe2, acRL supports general monads and divergences, while it does not support dependent products nor non-termination.

The relational logic acRL adopts the extensional approach (cf. [44, Chapter 9.2]):

•

Relational assertions between contexts $\Gamma$ and $\Delta$ are defined as binary relations between $U[\![\Gamma]\!]$ and $U[\![\Delta]\!]$ , or equivalently ${\bf BRel}(\mathbb{C})$ -objects $\phi$ such that $p_{\mathbb{C}}(\phi)=([\![\Gamma]\!],[\![\Delta]\!])$ . Logical connectives and quantifications are defined as operations on such ${\bf BRel}(\mathbb{C})$ -objects. This is in contrast to the standard design of logic where assertions are defined by a BNF.
•

Let $\Gamma\vdash M:\tau$ and $\Delta\vdash N:\sigma$ be well-typed terms, $\phi$ be a relational assertion between $\Gamma,\Delta$ , and $\psi$ be an assertion between $\tau,\sigma$ . The main concern of acRL is the statement “ $\forall(\gamma,\delta)\in\phi.([\![M]\!]\mathbin{\bullet}\gamma,[\![N]\!]\mathbin{\bullet}\delta)\in\psi$ ” (equivalently $([\![M]\!],[\![N]\!]):\phi\mathbin{\dot{\rightarrow}}\psi$ ). In this section we denote this statement by $\phi\vdash(M,M^{\prime}):\psi$ .
•

Inference rules of the logic consists of the facts about the statement $\phi\vdash(M,M^{\prime}):\psi$ . We remark that in the standard logic, proving these facts corresponds to the soundness of inference rules.

8.1 Moggi’s Computational Metalanguage

Figure 2: Syntax of Types and Raw Terms of the Computational Metalanguage

	$\displaystyle{\bf Typ}(B)\ni\tau\mathbin{::=}$	$\displaystyle b\mid 1\mid\tau\times\tau\mid 0\mid\tau+\tau\mid\tau\Rightarrow\tau\mid\mathtt{T}\tau\quad(b\in B)$
	$\displaystyle M\mathbin{::=}$	$\displaystyle x\mid o(M)\mid c(M)\mid()\mid(M,M)\mid\pi_{1}(M)\mid\pi_{2}(M)\quad(o\in O_{v},c\in O_{e})$
	$\displaystyle\mid$	$\displaystyle\iota_{1}(M)\mid\iota_{2}(M)\mid M\mathbin{\mathtt{with}}\iota_{1}(x:\tau).M\mathbin{\rule{0.4pt}{4.30554pt}}\iota_{2}(x:\tau).M$
	$\displaystyle\mid$	$\displaystyle(\lambda{x:\tau}~{}.~{}M)\mid(MM)\mid\mathop{\mathtt{ret}}(M)\mid\mathop{\mathtt{let}}{x:\tau=M}\mathbin{\mathtt{in}}M$

8.1.1 Syntax of the Computational Metalanguage

For the higher-order programming language, we adopt Moggi’s computational metalanguage ([42]). It is an extension of the simply typed lambda calculus with monadic types. For a set $B$ , we define the set ${\bf Typ}(B)$ of types over $B$ by the first BNF in Figure 2. We then define the set ${\bf Typ}_{1}(B)$ of first-order types to be the subset of ${\bf Typ}(B)$ consisting only of $b,1,\times,+$ .

We next introduce computational signatures for specifying constants in the computational metalanguage. A computational signature is a tuple $(B,\Sigma_{v},\Sigma_{e})$ where $B$ is a set of base types, and $\Sigma_{v}$ and $\Sigma_{e}$ are functions whose range is ${\bf Typ}_{1}(B)^{2}$ . The domains of $\Sigma_{v},\Sigma_{e}$ are sets of value operation symbols and effectful operation symbols, and are denoted by $O_{v},O_{e}$ , respectively. These functions assign input and output types to these operations.

Fix a countably infinite set $V$ of variables. A context is a function from a finite subset of $V$ to ${\bf Typ}(B)$ ; contexts are often denoted by capital Greek letters $\Gamma,\Delta$ . For contexts $\Gamma,\Delta$ such that ${\rm dom}(\Gamma)\cap{\rm dom}(\Delta)=\emptyset$ , by $\Gamma,\Delta$ we mean the join of $\Gamma$ and $\Delta$ .

The set of raw terms is defined by the second BNF in Figure 2. The type system of the computational metalanguage has judgments of the form $\Gamma\vdash M:\tau$ where $\Gamma$ is a context, $M$ a raw term and $\tau$ a type. It adopts the standard rules for products, coproducts, implications and monadic types; see e.g. [42]. The typing rules for value operations and effectful operations are given by

\Gamma\vdash o(M):b^{\prime}\lx@proof@logical@and o\in O_{v}\Sigma_{v}(o)=(b,b^{\prime})\Gamma\vdash M:b\qquad\Gamma\vdash c(M):\mathtt{T}b^{\prime}\lx@proof@logical@and o\in O_{e}\Sigma_{e}(c)=(b,b^{\prime})\Gamma\vdash M:b

A simultaneous substitution from $\Gamma$ to $\Gamma^{\prime}$ is a function $\theta$ from the set ${\rm dom}(\Gamma^{\prime})$ of variables to raw terms such that the well-typedness $\Gamma\vdash\theta(x):\Gamma^{\prime}(x)$ holds for each $x\in{\rm dom}(\Gamma^{\prime})$ . The application of $\theta$ to a term $\Gamma^{\prime}\vdash M:\tau$ is denoted by $M\theta$ , which has a typing $\Gamma\vdash M\theta:\tau$ . For disjoint contexts $\Gamma_{i}$ ( $i=1,2$ ), we define the projection substitutions $\Gamma_{1},\Gamma_{2}\vdash\pi_{i}^{\Gamma_{1},\Gamma_{2}}:\Gamma_{i}$ by $\pi_{i}^{\Gamma_{1},\Gamma_{2}}(x)=x$ .

8.1.2 Categorical Semantics of the Computational Metalanguage

Figure 3: Data for the Categorical Semantics of Metalanguage

1.

$(\mathbb{C},T)$ is a CCC-SM and $\mathbb{C}$ has finite coproducts.
2.

$[\![b]\!]\in\mathbb{C}$ for each $b\in B$
3.

$[\![o]\!]:[\![b]\!]\to[\![b^{\prime}]\!]$ for each $o\in O_{v}$ such that $\Sigma_{v}(o)=(b,b^{\prime})$
4.

$[\![c]\!]:[\![b]\!]\to T[\![b^{\prime}]\!]$ for each $c\in O_{e}$ such that $\Sigma_{e}(c)=(b,b^{\prime})$

The interpretation of the computational metalanguage over a computational signature $(B,\Sigma_{v},\Sigma_{e})$ is given by the data specified by Figure 3.

We first inductively extend the interpretation of base types to all types using the bi-Cartesian closed structure and the monad. Next, for each context $\Gamma$ , we fix a product diagram $([\![\Gamma]\!],\{\pi_{x}:[\![\Gamma]\!]\to[\![\Gamma(x)]\!]\}_{x\in{\rm dom}(\Gamma)})$ ; when ${\rm dom}(\Gamma)=\{x\}$ , we assume that $[\![\Gamma]\!]=[\![\Gamma(x)]\!]$ with $\pi_{x}={\rm id}$ . Lastly we interpret a typing derivation of $\Gamma\vdash M:\tau$ as a morphism $[\![M]\!]:[\![\Gamma]\!]\to[\![\tau]\!]$ in the standard way, using the interpretations of operations given in Figure 3. We further extend this to the interpretation of each simultaneous substitution $\Gamma\vdash\theta:\Gamma^{\prime}$ as a morphisms $[\![\theta]\!]:[\![\Gamma]\!]\to[\![\Gamma^{\prime}]\!]$ .

8.2 Approximate Relational Computational Logic

8.2.1 Relational Logic in External Form

A relational assertion $\phi$ between disjoint contexts $\Gamma$ and $\Delta$ is a binary relation between $U[\![\Gamma]\!]$ and $U[\![\Delta]\!]$ . We denote such a relational assertion by ${}^{\Gamma}_{\Delta}\vdash\phi$ , and identify it as a ${\bf BRel}(\mathbb{C})$ -object $\phi$ such that $p_{\mathbb{C}}(\phi)=([\![\Gamma]\!],[\![\Delta]\!])$ . Similarly, a relational assertion between types $\tau$ and $\sigma$ is defined to be a relational assertion ${}^{u:\tau}_{d:\sigma}\vdash\phi$ ; here $u,d$ are reserved and fixed variables.

Relational assertions between contexts $\Gamma$ and $\Delta$ carry a boolean algebra structure $\wedge,\vee,\neg$ given by the set-intersection, set-union and set-complement (see the boolean algebra ${\bf BRel}(\mathbb{C})_{([\![\Gamma]\!],[\![\Delta]\!])}$ in Section 2.1). The pseudo-complement $\phi\Rightarrow\psi$ is defined to be $\neg\phi\vee\psi$ . For ${}^{\Gamma,x:\tau}_{\Delta,y:\sigma}\vdash\phi$ , by ${}^{\Gamma}_{\Delta}\vdash\forall^{x}_{y}~{}.~{}\phi$ and ${}^{\Gamma}_{\Delta}\vdash\exists^{x}_{y}~{}.~{}\phi$ we mean the relational assertions defined by the following equivalence:

	$\displaystyle(\gamma,\delta)\in\forall^{x}_{y}~{}.~{}\phi\iff$	$\displaystyle\forall{\gamma^{\prime}\in U[\![\Gamma,x:\tau]\!],\delta^{\prime}\in U[\![\Delta,y:\sigma]\!]}~{}.~{}$
		$\displaystyle\quad\quad([\![\pi_{1}^{\Gamma,x:\tau}]\!]\mathbin{\bullet}\gamma^{\prime}=\gamma)\wedge([\![\pi_{1}^{\Delta,y:\sigma}]\!]\mathbin{\bullet}\delta^{\prime}=\delta)\Rightarrow(\gamma^{\prime},\delta^{\prime})\in\phi$
	$\displaystyle(\gamma,\delta)\in\exists^{x}_{y}~{}.~{}\phi\iff$	$\displaystyle\exists{\gamma^{\prime}\in U[\![\Gamma,x:\tau]\!],\delta^{\prime}\in U[\![\Delta,y:\sigma]\!]}~{}.~{}$
		$\displaystyle\quad\quad([\![\pi_{1}^{\Gamma,x:\tau}]\!]\mathbin{\bullet}\gamma^{\prime}=\gamma)\wedge([\![\pi_{1}^{\Delta,y:\sigma}]\!]\mathbin{\bullet}\delta^{\prime}=\delta)\wedge(\gamma^{\prime},\delta^{\prime})\in\phi$

The boolean algebra structure and the above quantifier operations allow us to interpret first-order logical formulas as relational assertions; we omit its detail here. In addition to these standard logical connectives, we will use graded strong relational lifting $T^{[{\mathsf{\Delta}}]}$ to form relational assertions. That is, for any basic endorelation $E:\mathbb{C}\to{\bf BRel}(\mathbb{C})$ , grading monoid $M$ , divergence domain $\mathcal{Q}$ and divergence ${\mathsf{\Delta}}\in{\bf Div}(T,E,M,\mathcal{Q})$ , we obtain a relational assertion ${}^{u:\mathtt{T}\tau}_{d:\mathtt{T}\sigma}\vdash T^{[{\mathsf{\Delta}}]}(m,v)\phi$ from any ${}^{u:\tau}_{d:\sigma}\vdash\phi$ , $m\in M$ and $v\in\mathcal{Q}$ .

For substitutions $\Gamma\vdash\theta:\Gamma^{\prime},\Delta\vdash{\theta^{\prime}}:\Delta^{\prime}$ and an assertion ${}^{\Gamma}_{\Delta}\vdash\phi$ , by ${}^{\Gamma^{\prime}}_{\Delta^{\prime}}\vdash\phi[{\theta};{\theta^{\prime}}]$ we mean the relational assertion $\{(\gamma,\delta)~{}|~{}([\![\theta]\!]\mathbin{\bullet}\gamma,[\![\theta^{\prime}]\!]\mathbin{\bullet}\delta)\in\phi\}$ . For disjoint context pairs $\Gamma,\Gamma^{\prime}$ and $\Delta,\Delta^{\prime}$ and relational assertions ${}^{\Gamma}_{\Delta}\vdash\phi$ and ${}^{\Gamma^{\prime}}_{\Delta^{\prime}}\vdash\psi$ , by the juxtaposition ${}^{\Gamma,\Gamma^{\prime}}_{\Delta,\Delta^{\prime}}\vdash\phi,\psi$ we mean the relational assertion ${}^{\Gamma,\Gamma^{\prime}}_{\Delta,\Delta^{\prime}}\vdash\phi[{\pi_{1}^{\Gamma,\Gamma^{\prime}}};{\pi_{1}^{\Delta,\Delta^{\prime}}}]\wedge\psi[{\pi_{2}^{\Gamma,\Gamma^{\prime}}};{\pi_{2}^{\Delta,\Delta^{\prime}}}]$ .

8.2.2 Inference Rules for acRL

For well-typed computational metalanguage terms $\Gamma\vdash M:\tau$ and $\Delta\vdash N:\sigma$ , and relational assertions ${}^{\Gamma}_{\Delta}\vdash\phi$ and ${}^{u:\tau}_{d:\sigma}\vdash\psi$ , by the judgment

\phi\vdash{}(M,N)\colon\psi

we mean the inclusion $\phi\subseteq\psi[{[M/u]};{[N/d]}]$ of binary relations. This is equivalent to $([\![M]\!],[\![N]\!]):\phi\mathbin{\dot{\rightarrow}}\psi$ . We show basic facts about judgments $\phi\vdash{}(M,N)\colon\psi$ .

Proposition 15.

1.

$\phi\vdash{}(M,N)\colon\psi$ and $[\![M]\!]=[\![M^{\prime}]\!]$ and $[\![N]\!]=[\![N^{\prime}]\!]$ implies $\phi\vdash{}(M^{\prime},N^{\prime})\colon\psi$ .
2.

$\phi\vdash{}(M,N)\colon\psi$ and $\phi^{\prime}\subseteq\phi$ and $\psi\subseteq\psi^{\prime}$ implies $\phi^{\prime}\vdash{}(M,N)\colon\psi^{\prime}$ .
3.

$\phi\vdash{}(M,N)\colon T^{[{\mathsf{\Delta}}]}(m,v)\psi$ and $m\leq n$ and $v\leq w$ and $\psi\leq\psi^{\prime}$
implies $\phi\vdash{}(M,N)\colon T^{[{\mathsf{\Delta}}]}(n,w){\psi^{\prime}}$ .
4.

$\phi\vdash{}(M,N)\colon\psi$ implies $\phi\vdash{}(\mathop{\mathtt{ret}}(M),\mathop{\mathtt{ret}}(N))\colon T^{[{\mathsf{\Delta}}]}(1,0){\psi}$ .
5.

$\phi\vdash{}(M,N)\colon T^{[{\mathsf{\Delta}}]}(m,v)\psi$ and $\phi,\psi[{[x/u]};{[x^{\prime}/d]}]\vdash{}(M^{\prime},N^{\prime})\colon T^{[{\mathsf{\Delta}}]}(n,w)\rho$
implies $\phi\vdash{}(\mathop{\mathtt{let}}{x=M}\mathbin{\mathtt{in}}M^{\prime},\mathop{\mathtt{let}}{x^{\prime}=N}\mathbin{\mathtt{in}}N^{\prime})\colon T^{[{\mathsf{\Delta}}]}(m\cdot n,v\cdot w)\rho$ .

We next establish relational judgments on effectful operations. We present a convenient way to establish such judgments using the fundamental property of the graded relational lifting $T^{[{\mathsf{\Delta}}]}$ .

Proposition 16.

For any $c\in O_{e}$ such that $\Sigma_{e}(c)=(b,b^{\prime})$ , relational assertion ${}^{u:b}_{d:b}\vdash\phi$ and $m\in M$ , putting $v=\sup\{{\mathsf{\Delta}}^{m}_{[\![b^{\prime}]\!]}([\![c]\!]\mathbin{\bullet}x,[\![c]\!]\mathbin{\bullet}y)~{}|~{}(x,y)\in\phi\}$ , we have $\phi\vdash{}(c(u),c(d))\colon T^{[{\mathsf{\Delta}}]}(m,v)(E[\![b^{\prime}]\!])$ .

Proof.

Take an arbitrary pair $(x,y)\in\phi$ . We have ${\mathsf{\Delta}}^{m}_{[\![b^{\prime}]\!]}([\![c]\!]\mathbin{\bullet}x,[\![c]\!]\mathbin{\bullet}y)\leq v$ by definition of $v$ . Thanks to the fundamental property of $T^{[{\mathsf{\Delta}}]}$ (Theorem 8), it is equivalent to $([\![c]\!]\mathbin{\bullet}x,[\![c]\!]\mathbin{\bullet}y)\in T^{[{\mathsf{\Delta}}]}(m,v)(E[\![b^{\prime}]\!])$ . ∎

9 Case Study I: Higher-Order Probabilistic Programs

We represent a higher-order probabilistic programming language with sampling commands from continuous distributions as a computational metalanguage. For now we assume that the language supports sampling from Gaussian distribution and Laplace distribution. This computational metalanguage is specified by the computational signature:

\mathcal{C}=(\{\mathtt{R}\},\Sigma_{v},\{\mathtt{norm}:(\mathtt{R}\times\mathtt{R},\mathtt{R}),~{}\mathtt{lap}:(\mathtt{R}\times\mathtt{R},\mathtt{R})\}),

where $\Sigma_{v}$ is some chosen signature for value operations over reals. We interpret this computational metalanguage by filling Figure 3 as follows:

1.

for the CCC-SM, we take $(\mathbb{C},T)=({\bf QBS},P)$ (see Section 13),
2.

for the interpretation $[\![\mathtt{R}]\!]$ of $\mathtt{R}$ , we take the quasi-Borel space $K\mathbb{R}$ associated with the standard Borel space $\mathbb{R}$ ,
3.

the interpretation of value operations is given as expected (we omit it here); for example when $\Sigma_{v}$ contains the real number addition operator $+$ as type $(\mathtt{R}\times\mathtt{R},\mathtt{R})$ , its interpretation is the QBS morphism $[\![+]\!](x,y)=x+y:[\![\mathtt{R}\times\mathtt{R}]\!]\rightarrow[\![\mathtt{R}]\!]$ ,

for the interpretation of effectful operations, we put

\displaystyle[\![\mathtt{norm}]\!](x,\sigma)

\displaystyle=[\mathrm{id},\mathcal{N}(x,\sigma^{2})]_{\sim_{K\mathbb{R}}},

\displaystyle[\![\mathtt{lap}]\!](x,\lambda)

\displaystyle=[\mathrm{id},\mathrm{Lap}(x,\lambda)]_{\sim_{K\mathbb{R}}}.

Here, $\mathcal{N}(x,\sigma^{2})\in G\mathbb{R}$ is the Gaussian distribution with mean $x$ and variance $\sigma^{2}$ . $\mathrm{Lap}(x,\lambda)\in G\mathbb{R}$ is the Laplacian distribution with mean $x$ and variance $2\lambda^{2}$ ⁷⁷7If $\sigma=0$ (or $\lambda\leq 0$ ), $\mathcal{N}(x,\sigma^{2})$ (resp. $\mathrm{Lap}(x,\lambda)$ ) is not defined, thus we replace it by the Dirac distribution $\mathbf{d}_{x}$ at $x$ instead.. Every probability (Borel-)measure $\mu\in G\mathbb{R}$ on $\mathbb{R}$ can be converted to the probability measure $[\mathrm{id},\mu]_{\sim_{K\mathbb{R}}}\in PK\mathbb{R}$ on the quasi-Borel space $K\mathbb{R}$ (see Section 5.5).

9.1 A Relational Logic Verifying Differential Privacy

To formulate differential privacy and its relaxations in the quasi-Borel setting, we convert statistical divergences ${\mathsf{\Delta}}$ on the Giry monad $G$ in Table 2 to ${\color[rgb]{0,0,0}\mathrm{Eq}}{}$ -relative divergences $\langle{L,l}\rangle^{*}{\mathsf{\Delta}}$ on the probability monad $P$ on ${\bf QBS}$ by the construction in Section 5.5. Then, we construct the graded relational lifting $P^{[\langle{L,l}\rangle^{*}{\mathsf{\Delta}}]}$ by Theorem 8. Using this, as an instantiation of acRL, we build a relational logic reasoning about differential privacy and its relaxations, supporting higher-order programs and continuous random samplings. Basic proof rules can be given by Proposition 15.

For effectful operations, we import basic proof rules on noise-adding mechanisms given in prior studies ([21, 22, 40, 16]) via Theorem 1 and Proposition 16. For example, consider the ${\color[rgb]{0,0,0}\mathrm{Eq}}$ -relative $\mathcal{R}^{+}$ -graded $\mathcal{R}^{+}$ -divergence ${\mathsf{\Delta}}=\langle{L,l}\rangle^{*}\mathsf{DP}$ on $P$ . Proposition 16 with an effectful operation $c=\mathtt{lap}$ and a relational assertion (below we identify global elements in $K\mathbb{R}$ and real numbers)

{}^{u:\mathtt{R}\times\mathtt{R}}_{d:\mathtt{R}\times\mathtt{R}}\vdash\phi=\{(\langle x,1/\varepsilon\rangle,\langle y,1/\varepsilon\rangle)~{}|~{}|x-y|\leq 1\},

together with Theorem 1 and the prior result [21, Example 1] yields the following judgment:

\phi\vdash{}(\mathtt{lap}(u),\mathtt{lap}(d))\colon P^{[\langle{L,l}\rangle^{*}\mathsf{DP}]}(0,\epsilon)({\color[rgb]{0,0,0}\mathrm{Eq}}{K\mathbb{R}}).

By letting $\mathrm{diff}_{r}$ be the relational assertion ${}^{u:\mathtt{R}}_{d:\mathtt{R}}\vdash\{(x,y)~{}|~{}|x-y|\leq r\}$ , the above judgment is equivalent to:

\mathrm{diff}_{1}\vdash{}(\mathtt{lap}(u,1/\epsilon),\mathtt{lap}(d,1/\epsilon)))\colon P^{[\langle{L,l}\rangle^{*}\mathsf{DP}]}(0,\epsilon)({\color[rgb]{0,0,0}\mathrm{Eq}}{K\mathbb{R}}).

(12)

This rule corresponds to the rule [LapGen] of the program logic apRHL+ ([11]) for differential privacy. For another example, by the reflexivity of $\mathsf{DP}$ , $\langle{L,l}\rangle^{*}\mathsf{DP}$ is also reflexive, hence we obtain the following judgments (below $\mathrm{succ}_{r}$ is the relational assertion ${}^{u:\mathtt{R}}_{d:\mathtt{R}}\vdash\{(x,y)~{}|~{}y=x+r\}$ ):

	$\displaystyle\mathrm{succ}_{1}\vdash{}(\mathtt{lap}(u,\lambda),\mathtt{lap}(d,\lambda))\colon P^{[\langle{L,l}\rangle^{*}\mathsf{DP}]}(0,0)(\mathrm{succ}_{1})$		(13)
	$\displaystyle\mathrm{succ}_{1}\vdash{}(\mathtt{norm}(u,\sigma),\mathtt{norm}(d,\sigma))\colon P^{[\langle{L,l}\rangle^{*}\mathsf{DP}]}(0,0)(\mathrm{succ}_{1}).$		(14)

The judgment (13) correspond to [LapNull] of apRHL+. Similarly, the following judgments about the DP, Rényi-DP, zero-concentrated DP of the Gaussian mechanism can be derived as (15)–(17).

	$\displaystyle\mathrm{diff}_{1}\vdash{}(\mathtt{norm}(u,\sigma),\mathtt{norm}(d,\sigma))\colon P^{[\langle{L,l}\rangle^{*}\mathsf{DP}]}{(\epsilon,\delta)}{({\color[rgb]{0,0,0}\mathrm{Eq}}{K\mathbb{R}})}$		(15)
	$\displaystyle\mathrm{diff}_{r}\vdash{}(\mathtt{norm}(u,\sigma),\mathtt{norm}(d,\sigma))\colon P^{[\langle{L,l}\rangle^{*}{}^{\alpha}\mathsf{Re}]}{(\alpha r^{2}/2\sigma^{2})}{({\color[rgb]{0,0,0}\mathrm{Eq}}{K\mathbb{R}})}$		(16)
	$\displaystyle\mathrm{diff}_{r}\vdash{}(\mathtt{norm}(u,\sigma),\mathtt{norm}(d,\sigma))\colon P^{[\langle{L,l}\rangle^{*}\mathsf{zCDP}]}{(0,r^{2}/2\sigma^{2})}{({\color[rgb]{0,0,0}\mathrm{Eq}}{K\mathbb{R}})}$		(17)

In (15) we require $\sigma\geq\max((1+\sqrt{3})/2,~{}\sqrt{2\log(0.66/\delta)}/\epsilon)$ . The derivation is done via Proposition 16, Theorem 1 and prior studies ([51, 40, 17]).

10 Case Study II: Probabilistic Programs with Costs

We further extend the computational signature $\mathcal{C}$ in the previous section with an effectful operation $\mathtt{tick}$ such that $\Sigma_{e}(\mathtt{tick})=(\mathtt{R},1)$ . The intention of $\mathtt{tick}(r)$ is to increase cost counter by $r$ during execution⁸⁸8To make examples simpler, we allow negative costs.. To interpret this extended metalanguage, we fill Figure 3 as follows:

1.

for the CCC-SM, we take $(\mathbb{C},T)=({\bf QBS},P_{c})$ where $P_{c}\triangleq P(K\mathbb{R}\times-)$ is the monad for modeling probabilistic choice and cost counting (see Section 5.7).
2.

interpretation of $b\in B$ is the same as Section 9,
3.

interpretation of value operations is also the same as Section 9,

for the interpretation of effectful operations, put

	$\displaystyle[\![\mathtt{norm}]\!](x,\sigma)$	$\displaystyle=[(0,\mathrm{id}),\mathcal{N}(x,\sigma^{2})]_{\sim_{K\mathbb{R}\times K\mathbb{R}}},$
	$\displaystyle[\![\mathtt{lap}]\!](x,\lambda)$	$\displaystyle=[(0,\mathrm{id}),\mathrm{Lap}(x,\lambda)]_{\sim_{K\mathbb{R}\times K\mathbb{R}}},$
	$\displaystyle[\![\mathtt{tick}]\!](r)$	$\displaystyle=\eta^{P}_{K\mathbb{R}\times[\![1]\!]}(r,\ast)=[\mathrm{const}(r,\ast),\mu]_{\sim_{K\mathbb{R}\times 1}}.$

We derive a closed term $\mathtt{ntick}\colon\mathtt{R}\Rightarrow\mathtt{R}\Rightarrow\mathtt{T}1$ for ticking with a cost sampled from Gaussian distribution:

\mathtt{ntick}\triangleq(\lambda s.\lambda r.~{}\mathop{\mathtt{let}}{x=\mathtt{norm}(r,s)}\mathbin{\mathtt{in}}\mathtt{tick}(x)).

The term $\mathtt{ntick}~{}s~{}r$ adds cost counter by a random value sampled from the Gaussian distribution $\mathtt{norm}(r,s^{2})$ .

10.1 Relational Reasoning on Probabilistic Costs

We convert the total valuation distance $\mathsf{TV}\in{\bf Div}(G,{\color[rgb]{0,0,0}\mathrm{Eq}},1,\mathcal{R}^{+})$ to the divergence ${\mathsf{\Delta}}_{c}\triangleq{\mathsf{C}}(\langle{L,l}\rangle^{*}\mathsf{TV},K\mathbb{R})\in{\bf Div}(P_{c},{\color[rgb]{0,0,0}\mathrm{Eq}},1,\mathcal{R}^{+})$ on $P_{c}$ by Propositions 2 and 7. We also prove basic facts on effectful operations. First, the following relational judgments on $\mathtt{tick}$ can be easily given:

	$\displaystyle\top\vdash{}(\mathtt{tick}(u),\mathtt{tick}(d))\colon T^{[{\mathsf{\Delta}}_{c}]}(1)(\top)$		(18)
	$\displaystyle u=d\vdash{}(\mathtt{tick}(u),\mathtt{tick}(d))\colon T^{[{\mathsf{\Delta}}_{c}]}(0)(\top)$

Remark that ${\color[rgb]{0,0,0}\mathrm{Eq}}1=\top$ and $[\![\mathtt{tick}(0)]\!]=[\![\mathop{\mathtt{ret}}(\ast)]\!]$ holds. Next, in the similar way as (13), by the reflexivity of $\mathsf{TV}$ , we have the reflexivity of $\langle{L,l}\rangle^{*}\mathsf{TV}$ , and we obtain, for each real number constant $\sigma,\lambda$ ,

		$\displaystyle\mathrm{succ}_{r}\vdash{}(\mathtt{norm}(u,\sigma),\mathtt{norm}(d,\sigma))\colon T^{[{\mathsf{\Delta}}_{c}]}(0)(\mathrm{succ}_{r})$
		$\displaystyle\mathrm{succ}_{r}\vdash{}(\mathtt{lap}(u,\lambda),\mathtt{lap}(d,\lambda))\colon T^{[{\mathsf{\Delta}}_{c}]}(0)(\mathrm{succ}_{r})$		(19)

We also directly verify the following judgment on $\mathtt{ntick}$ using Theorem 1 and Proposition 16:

\displaystyle\mathrm{diff}_{1}\vdash{}(\mathtt{ntick}~{}\sigma~{}u,\mathtt{ntick}~{}\sigma~{}d)\colon T^{[{\mathsf{\Delta}}_{c}]}{({\textstyle\Pr_{r\sim\mathcal{N}(0,\sigma^{2})}}[|r|<0.5])}{(\top)}.

(20)

10.1.1 An Example of Relational Reasoning

We give examples of verification of difference (of distributions) of costs between two runs of a probabilistic program whose output and cost depend on the input. We consider the following program:

M\triangleq\lambda r\colon\mathtt{R}.~{}\lambda t\colon\mathtt{R}\to T1.~{}\mathop{\mathtt{let}}{x=\mathtt{lap}(r,5)}\mathbin{\mathtt{in}}\mathop{\mathtt{let}}{\_=t(r)}\mathbin{\mathtt{in}}\mathop{\mathtt{ret}}(x-r).

It first samples a real number $x$ from the Laplacian distribution centered at the input $r$ , call the (possibly effectful) closure $t$ with $r$ and return $x-r$ . Since the return type of $t$ is $T1$ , it can only probabilistically tick the counter. We show that the following two judgments in acRL:

		$\displaystyle\vdash{}(M~{}0~{}(\lambda x.\mathtt{tick}(x)),M~{}1~{}(\lambda x.\mathtt{tick}(x)))\colon T^{[{\mathsf{\Delta}}_{c}]}{(1)}{({\color[rgb]{0,0,0}\mathrm{Eq}}{[\![\mathtt{R}]\!]}}),$		(A)
		$\displaystyle\vdash{}(M~{}0~{}(\mathtt{ntick}(2)),M~{}1~{}(\mathtt{ntick}(2)))\colon T^{[{\mathsf{\Delta}}_{c}]}{(0.20)}{({\color[rgb]{0,0,0}\mathrm{Eq}}{[\![\mathtt{R}]\!]}})$		(B)

In judgment (A), we pass the tick operation $t=\lambda x.\mathtt{tick}(x)$ itself to $M~{}0$ and $M~{}1$ . By the fundamental property of $T^{[{\mathsf{\Delta}}_{c}]}$ , the difference of costs between two runs of $M~{}0~{}t$ and $M~{}1~{}t$ is $1$ , because each of these programs reports cost $0$ and $1$ deterministically. In contrast, in judgment (B), we pass to $M~{}0$ and $M~{}1$ the probabilistic tick function $t^{\prime}=\mathtt{ntick}(2)$ that ticks a real number sampled from the Gaussian distribution with variance $2^{2}=4$ . Therefore the cost reported by the runs of programs $M~{}0~{}t^{\prime}$ and $M~{}1~{}t^{\prime}$ follow the Gaussian distributions $\mathcal{N}(0,4)$ and $\mathcal{N}(1,4)$ , whose difference by $\mathsf{TV}$ is bounded by $0.20$ .

We first show (A). By (18) and 2 of Proposition 15, we have,

\mathrm{succ}_{1}\vdash{}(\mathtt{tick}(u),\mathtt{tick}(d))\colon T^{[{\mathsf{\Delta}}_{c}]}{(1)}{(\top)}.

(21)

By (21), and 4, 5 of Proposition 15, we obtain,

	$\displaystyle\mathrm{succ}_{1}\vdash$	$\displaystyle(\mathop{\mathtt{let}}{\_=\mathtt{tick}(u)}\mathbin{\mathtt{in}}\mathop{\mathtt{ret}}(u),$
		$\displaystyle\quad\mathop{\mathtt{let}}{\_=\mathtt{tick}(d)}\mathbin{\mathtt{in}}\mathop{\mathtt{ret}}(d-1))\colon T^{[{\mathsf{\Delta}}_{c}]}{(1)}{({\color[rgb]{0,0,0}\mathrm{Eq}}[\![\mathtt{R}]\!])}.$		(22)

By (19), (22), and 1 and 5 of Proposition 15 again, we conclude (A).

To show (B), it suffices to replace (21) by the following judgment proved by (20), the inequality $\Pr_{r\sim\mathcal{N}(0,4)}[|r|<0.5]\leq 0.20$ and 2 of Proposition 15:

\mathrm{succ}_{1}\vdash{}(\mathtt{ntick}~{}2~{}u,\mathtt{ntick}~{}2~{}d)\colon T^{[{\mathsf{\Delta}}_{c}]}{(0.20)}{(\top)}.

The rest of proof is the same as (A).

11 Related Work

This work is based on the frameworks for verifying the differential privacy of probabilistic programs using relational logic, summarized in Table 5. Composable divergences employed in these frameworks include the one for differential privacy, plus its recent relaxations, such as, Rényi DP, zero-concentrated DP, and truncated-concentrated DP ([16, 17, 40]).

Table 5: Approximate Probabilistic Relational Logic

Work	Monad	Relation	Lifting Method	Supported divergences
[8, 10, 12]	Dist	${\bf BRel}({\bf Set})$	coupling	DP
[13]	Dist	${\bf BRel}({\bf Set})$	coupling	$f$ -divergences
[52]	Giry	${\bf Span}({\bf Meas})$	coupling (spans)	composable ones
[51]	Giry	${\bf BRel}({\bf Meas})$	codensity	DP
This work	Generic	${\bf BRel}(\mathbb{C})$	codensity	composable ones

The key semantic structure in these frameworks is graded relational liftings of the probability distribution monad. Barthe et al. gave a graded relational lifting of the distribution monad based on the existence of two witnessing probability distributions (called coupling) ([12]). Since then, coupling-based liftings have been refined and used in several works ([8, 10, 13, 52]). They can be systematically constructed from composable divergences on the probability distribution monad ([13]). One advantage of coupling-based liftings is that, to relate two probability distributions, it suffices to exhibit a coupling; this is exploited in the mechanized verification of differential privacy of programs ([1, 2]). These coupling-based liftings, however, are developed upon discrete probability distributions, and measure-theoretic probability distributions, such as Gaussian or Cauchy distributions, were not supported until the work ([52]).

The relational Hoare logic supporting sampling from continuous probability measures is given in the study by [51]. In his work, the graded relational lifting for $(\epsilon,\delta)$ -DP is given in the style of codensity lifting ([33]), which does not rely on the existence of coupling. Yet, it has been an open question [52, Section VIII] how to extend his graded relational lifting to support various relaxations of differential privacy. This paper answers to this question as Theorem 8. Later, coupling-based liftings has also been extended to support samplings from continuous probability measures ([52]). This extension is achieved by redefining the concept of binary relations as spans of measurable functions. Comparison of these approaches is in the next section.

The verification of differential privacy in functional programming languages has also been pursued ([48, 23, 9, 5]). [48] introduced a linear functional programming language with a graded monadic type that supports reasoning about $\epsilon$ -differential privacy. Later, Gaboardi et al. strengthen Reed-Pierce type system with dependent types ([23]). A category-theoretic account of Reed and Pierce type system is given in [5], where general $(\epsilon,\delta)$ -differential privacy is also supported. These works basically regard types as metric spaces, allowing us to reason about sensitivity of programs with respect to inputs. The coupling-based lifting techniques are also employed in the relational models of higher-order probabilistic programming language ([9]).

The study [5] gives a categorical definition of composable divergences in a general framework called weakly closed refinements of symmetric monoidal closed categories [5, Definition 1]. A comparison is given in Section 6.1.2.

[39] introduced a quantitative refinement of algebraic theory called quantitative equational theory, and studied variety theorem for quantitative algebras. [6] discussed tensor products of quantitative equational theories. QETs and divergences on monads share the common interest of measuring quantitative differences between computational effects. Divergences on monads are derived as a generalization of the composability condition of statistical divergences studied by [13]. To make a precise connection between these two concepts, in Section 6.3, we have given an adjunction between QETs of type $\Omega$ over $X$ and $X$ -generated divergences on the free monad $T_{\Omega}$ . The adjunction cuts down to the isomorphism between unconditional QETs of type $\Omega$ over $X$ and $X$ -generated divergences on $T_{\Omega}$ .

The use of metric-like spaces in the semantics is seen in several recent work. [25] studies quantitative refinements of Abramsky’s applicative bisimilarity for Reed-Pierce type system. He introduces a monadic operational semantics of the language and formalized quantitative applicative bisimilarity using monad liftings to the category of quantale-valued relations. [15] also used metric-like spaces to study bisimulations and up-to techniques in the category of quantale-valued relations. In this work our interest is relational program verification of effectful programs, and it is carried out in the relational category ${\bf BRel}(\mathbb{C})$ , rather than ${\bf Div}_{\mathcal{Q}}({\mathbb{C}})$ . The quantitative difference of computational effects measured by a divergence ${\mathsf{\Delta}}$ is represented by the binary relation $\tilde{\mathsf{\Delta}}$ graded by upper bounds of distance.

12 Future Work

The framework for relational cost analysis given in ([47])(extension of $\mathsf{RelCost}$ ([18])) consists of the relational logic verifying the difference of costs between two programs and the unary logic verifying the lower and upper bound of costs (i.e. cost intervals) in one program. We expect that the relational logic can be reformulated by an instantiation of acRL with the divergence $\mathsf{NCI}$ on $P(\mathbb{N}\times-)$ (or its variant). However to reformulate the unary logic, we want a unary version of divergence on $P(\mathbb{N}\times-)$ for cost intervals. To establish the connection between the unary logic and relational logic, we want a conversion from the unary version of divergence (for cost intervals) to $\mathsf{NCI}$ (for cost difference).

There might be many other examples and applications of divergences on monads. In this paper, we mainly discussed examples of divergences with basic endorelations ${\color[rgb]{0,0,0}\mathrm{Top}}$ and ${\color[rgb]{0,0,0}\mathrm{Eq}}$ , but various other basic endorelations can be considered.

13 Measurable Spaces and Quasi-Borel Spaces

Measurable Spaces.

For the treatment of continuous probability distributions, we employ the category ${\bf Meas}$ of measurable spaces and measurable functions. For a measurable space $I$ we write $|I|$ and $\Sigma_{I}$ for the underlying set and $\sigma$ -algebra of $I$ respectively. The category ${\bf Meas}$ is a (well-pointed) CC, and it has all small limits and small colimits that are strictly preserved by the forgetful functor $|{-}|\colon{\bf Meas}\to{\bf Set}$ . It is naturally isomorphic to the global element functor ${\bf Meas}(1,-)$ .

Standard Borel Spaces.

A standard Borel space is a special measurable space $(|\Omega|,\Sigma_{\Omega})$ whose $\sigma$ -algebra $\Sigma_{\Omega}$ is the coarsest one containing the topology $\sigma_{\Omega}$ of a Polish space $(|\Omega|,\sigma_{\Omega})$ . In particular, the real line $\mathbb{R}$ forms a standard Borel space. In fact, a measurable space $\Omega$ is standard Borel if and only if there are $\gamma\colon\Omega\to\mathbb{R}$ and $\gamma^{\prime}\colon\mathbb{R}\to\Omega$ in ${\bf Meas}$ forming a section-retraction pair, that is, $\gamma^{\prime}\circ\gamma={\rm id}_{\Omega}$ . For example, $[0,1]$ , $[0,\infty]$ , $\mathbb{N}$ , $\mathbb{R}^{k}$ ( $k\in\mathbb{N}$ ) are standard Borel.

The Giry Monad.

We recall the Giry monad $G$ ([26]). For every measurable space $I$ , $GI$ is the set $|GI|$ of all probability measures over $I$ with the coarsest $\sigma$ -algebra induced by functions $\mathrm{ev}_{A}\colon|GI|\to[0,1]$ ( $A\in\Sigma_{X}$ ) defined by $\mathrm{ev}_{A}(\mu)=\mu(A)$ . The unit $\eta_{I}\colon I\to GI$ assigns to each $x\in I$ the Dirac distribution $\mathbf{d}_{x}$ centered at $x$ . For every $f\colon I\to GJ$ , the Kleisli extension $f^{\sharp}\colon GI\to GJ$ is given by $(f^{\sharp}(\mu))(A)=\int_{x}f(x)(A)~{}d\mu(x)$ for each $\mu\in GI$ . We also denote by $G_{s}$ the subprobabilistic variant of $G$ (called sub-Giry monad), where the underlying set $|G_{s}I|$ of $G_{s}I$ is relaxed to the set of subprobaility measures over $I$ .

The Giry monad $G$ (resp. the sub-Giry monad $G_{s}$ ) carries a (commutative) strength $\theta_{I,J}\colon I\times GJ\to G(I\times J)$ over the CC $({\bf Meas},1,(\times))$ . It computes the product of measures ( $(x,\mu)\mapsto\mathbf{d}_{x}\otimes\mu$ ). Therefore $({\bf Meas},G)$ and $({\bf Meas},G_{s})$ are (well-pointed) CC-SMs.

Quasi-Borel Spaces.

The category ${\bf Meas}$ is not suitable for the semantics of higher-order programming languages since it is not Cartesian closed ([4]). For the treatment of higher-order probabilistic programs with continuous distributions, we employ the Cartesian closed category ${\bf QBS}$ of quasi-Borel spaces and morphisms between them, together with the probability monad $P$ on ${\bf QBS}$ ([28]). A quasi-Borel space is a pair $I=(|I|,M_{I})$ of a set $|I|$ and a subset $M_{I}$ of the function space $\mathbb{R}\Rightarrow|I|$ satisfying

1.

for $\alpha\in M_{I}$ and a measurable function $f\colon\mathbb{R}\to\mathbb{R}$ , $\alpha\circ f\in M_{I}$ .
2.

for any $x\in I$ , $(\lambda r\in\mathbb{R}.x)\in M_{I}$ .
3.

for all $P\colon\mathbb{R}\to\mathbb{N}$ and a family $\{\alpha_{i}\}_{i\in\mathbb{N}}$ of functions $\alpha_{i}\in M_{I}$ , $(\lambda r\in\mathbb{R}.\alpha_{P(r)}(r))\in M_{I}$ .

A morphism $f\colon(|I|,M_{I})\to(|J|,M_{J})$ is a function $f\colon|I|\to|J|$ such that $f\circ\alpha\in M_{J}$ holds for all $\alpha\in M_{I}$ . The category ${\bf QBS}$ is a (well-pointed) CCC, and has all countable products and coproducts that are strictly preserved by the forgetful functor $|{-}|\colon{\bf QBS}\to{\bf Set}$ . It is naturally isomorphic to the global element functor ${\bf QBS}(1,-)$ .

Connection to Measurable Spaces: an Adjunction

We can convert measurable spaces and quasi-Borel spaces using an adjunction $L\dashv K\colon{\bf Meas}\to{\bf QBS}$ . They are given by

	$\displaystyle LI$	$\displaystyle\triangleq(\|I\|,\{U\subseteq\|I\|~{}\|~{}\forall\alpha\in M_{X}.\alpha^{-1}(I)\in\Sigma_{\mathbb{R}}\})$	$\displaystyle Lf$	$\displaystyle\triangleq f$
	$\displaystyle KI$	$\displaystyle\triangleq(\|I\|,{\bf Meas}(\mathbb{R},I))$	$\displaystyle Kf$	$\displaystyle\triangleq f$

For any standard Borel space $\Omega\in{\bf Meas}$ , we have $LK\Omega=\Omega$ . The right adjoint $K$ is full-faithful when restricted to the standard Borel spaces [28, Proposition 15-(2)]. The right adjoint $K$ preserves countable coproducts and function spaces (if exists) of standard Borel spaces [28, Proposition 19].

Probability Measures and the Probability Monad.

A probability measure on a quasi-Borel space $I$ is a pair $(\alpha,\mu)\in M_{I}\times G\mathbb{R}$ . We introduce an equivalence relation $\sim_{I}$ over probability measures on $I$ by

(\alpha,\mu)\sim_{I}(\beta,\nu)\iff\mu(\alpha^{-1}(-))=\nu(\beta^{-1}(-)).

Using this, we introduce a probability monad $P$ on ${\bf QBS}$ as follows:

•

On objects, we define $P:{\bf Obj}({\bf QBS})\to{\bf Obj}({\bf QBS})$ by

\displaystyle|P(I)|

\displaystyle\triangleq(M_{I}\times G\mathbb{R})/\sim_{I},

\displaystyle M_{P(I)}\triangleq\{\lambda r.[(\alpha,g(r))]_{\sim_{I}}~{}|~{}\alpha\in M_{I},g\in{\bf Meas}(\mathbb{R},G\mathbb{R})\}.

•

The unit is defined by $\eta_{I}(x)\triangleq[\lambda r.x,\mu]_{\sim_{I}}$ for an arbitrary $\mu\in G\mathbb{R}$ .
•

The Kleisli extension of $f\colon I\to P(J)$ is defined by $f^{\sharp}[\alpha,\mu]_{\sim_{I}}\triangleq[\beta,g^{\sharp}\mu]$ where there are $\beta\in M_{J}$ and $g\in{\bf Meas}(\mathbb{R},G\mathbb{R})$ satisfying $f\circ\alpha=\lambda r\in\mathbb{R}.[\beta,g(r)]_{\sim_{J}}$ by definition of $M_{P(J)}$ .

The monad $P$ is (commutative) strong with respect to the CCC $({\bf QBS},1,(\times))$ .

Acknowledgments

Tetsuya Sato carried out this research under the support by JST ERATO HASUO Metamathematics for Systems Design Project (No. JPMJER1603) and JSPS KAKENHI Grant Number 20K19775, Japan. Shin-ya Katsumata carried out this research under the support by JST ERATO HASUO Metamathematics for Systems Design Project (No. JPMJER1603) and JSPS KAKENHI Grant Number 18H03204, Japan. The authors are grateful to Ichiro Hasuo providing the opportunity of collaborating in that project. The authors are grateful to Satoshi Kura, Justin Hsu, Marco Gaboardi, Borja Balle and Gilles Barthe for fruitful discussions.

References

[1] Aws Albarghouthi and Justin Hsu. Constraint-based synthesis of coupling proofs. In Computer Aided Verification - 30th International Conference, CAV 2018, Proceedings, Part I, volume 10981 of LNCS, pages 327–346. Springer, 2018.
[2] Aws Albarghouthi and Justin Hsu. Synthesizing coupling proofs of differential privacy. PACMPL, 2(POPL):58:1–58:30, 2018.
[3] Thorsten Altenkirch, James Chapman, and Tarmo Uustalu. Monads need not be endofunctors. Log. Methods Comput. Sci., 11(1), 2015.
[4] Robert J. Aumann. Borel structures for function spaces. Illinois J. Math., 5(4):614–630, 12 1961.
[5] Arthur Azevedo de Amorim, Marco Gaboardi, Justin Hsu, and Shin-ya Katsumata. Probabilistic relational reasoning via metrics. In 34th Annual ACM/IEEE Symposium on Logic in Computer Science, LICS 2019, pages 1–19. IEEE, 2019.
[6] Giorgio Bacci, Radu Mardare, Prakash Panangaden, and Gordon Plotkin. Tensor of Quantitative Equational Theories. In Fabio Gadducci and Alexandra Silva, editors, 9th Conference on Algebra and Coalgebra in Computer Science (CALCO 2021), volume 211 of Leibniz International Proceedings in Informatics (LIPIcs), pages 7:1–7:17, Dagstuhl, Germany, 2021. Schloss Dagstuhl – Leibniz-Zentrum für Informatik.
[7] Borja Balle, Gilles Barthe, Marco Gaboardi, Justin Hsu, and Tetsuya Sato. Hypothesis testing interpretations and renyi differential privacy. In Silvia Chiappa and Roberto Calandra, editors, Proceedings of the Twenty Third International Conference on Artificial Intelligence and Statistics (AISTATS 2020), volume 108 of Proceedings of Machine Learning Research, pages 2496–2506, Online, 26–28 Aug 2020. PMLR.
[8] Gilles Barthe, Marco Gaboardi, Emilio Jesús Gallego Arias, Justin Hsu, César Kunz, and Pierre-Yves Strub. Proving differential privacy in Hoare logic. In IEEE 27th Computer Security Foundations Symposium, CSF 2014, pages 411–424. IEEE Computer Society, 2014.
[9] Gilles Barthe, Marco Gaboardi, Emilio Jesús Gallego Arias, Justin Hsu, Aaron Roth, and Pierre-Yves Strub. Higher-order approximate relational refinement types for mechanism design and differential privacy. In Proceedings of the 42nd Annual ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages, POPL 2015, Mumbai, India, January 15-17, 2015, pages 55–68. ACM, 2015.
[10] Gilles Barthe, Marco Gaboardi, Benjamin Grégoire, Justin Hsu, and Pierre-Yves Strub. Proving differential privacy via probabilistic couplings. In Proceedings of the 31st Annual ACM/IEEE Symposium on Logic in Computer Science, LICS ’16, pages 749–758. ACM, 2016.
[11] Gilles Barthe, Benjamin Grégoire, Justin Hsu, and Pierre-Yves Strub. Coupling proofs are probabilistic product programs. In Proceedings of the 44th ACM SIGPLAN Symposium on Principles of Programming Languages, POPL 2017, pages 161–174, New York, NY, USA, 2017. Association for Computing Machinery.
[12] Gilles Barthe, Boris Köpf, Federico Olmedo, and Santiago Zanella Béguelin. Probabilistic relational reasoning for differential privacy. In Proceedings of the 39th ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages, POPL 2012, pages 97–110. ACM, 2012.
[13] Gilles Barthe and Federico Olmedo. Beyond differential privacy: Composition theorems and relational logic for f-divergences between probabilistic programs. In Automata, Languages, and Programming - 40th International Colloquium, ICALP 2013, Proceedings, Part II, volume 7966 of LNCS, pages 49–60. Springer, 2013.
[14] Nick Benton. Simple relational correctness proofs for static analyses and program transformations. SIGPLAN Not., 39(1):14–25, January 2004.
[15] Filippo Bonchi, Barbara König, and Daniela Petrisan. Up-To Techniques for Behavioural Metrics via Fibrations. In 29th International Conference on Concurrency Theory (CONCUR 2018), volume 118 of Leibniz International Proceedings in Informatics (LIPIcs), pages 17:1–17:17, Dagstuhl, Germany, 2018. Schloss Dagstuhl–Leibniz-Zentrum fuer Informatik.
[16] Mark Bun, Cynthia Dwork, Guy N. Rothblum, and Thomas Steinke. Composable and versatile privacy via truncated CDP. In Proceedings of the 50th Annual ACM SIGACT Symposium on Theory of Computing, STOC 2018, pages 74–86, New York, NY, USA, 2018. Association for Computing Machinery.
[17] Mark Bun and Thomas Steinke. Concentrated differential privacy: Simplifications, extensions, and lower bounds. In Theory of Cryptography, pages 635–658, Berlin, Heidelberg, 2016. Springer Berlin Heidelberg.
[18] Ezgi Çiçek, Gilles Barthe, Marco Gaboardi, Deepak Garg, and Jan Hoffmann. Relational cost analysis. SIGPLAN Not., 52(1):316–329, January 2017.
[19] Imre Csiszár. Eine informationstheoretische Ungleichung und ihre Anwendung auf den beweis der ergodizitat von markoffschen ketten. Magyar. Tud. Akad. Mat. Kutato Int. Kozl., 8:85–108, 1963.
[20] Imre Csiszár. Information-type measures of difference of probability distributions and indirect observations. Studia Sci. Math. Hungar., 2:299–318, 1967.
[21] Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. Calibrating noise to sensitivity in private data analysis. In Theory of Cryptography, volume 3876 of LNCS, pages 265–284. Springer Berlin Heidelberg, 2006.
[22] Cynthia Dwork and Aaron Roth. The algorithmic foundations of differential privacy. Foundations and Trends® in Theoretical Computer Science, 9(3-4):211–407, 2013.
[23] Marco Gaboardi, Andreas Haeberlen, Justin Hsu, Arjun Narayan, and Benjamin C. Pierce. Linear dependent types for differential privacy. In The 40th Annual ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages, POPL ’13, pages 357–370. ACM, 2013.
[24] Marco Gaboardi, Shin-ya Katsumata, Dominic Orchard, and Tetsuya Sato. Graded hoare logic and its categorical semantics. In Nobuko Yoshida, editor, Programming Languages and Systems - 30th European Symposium on Programming, ESOP 2021, Held as Part of the European Joint Conferences on Theory and Practice of Software, ETAPS 2021, Luxembourg City, Luxembourg, March 27 - April 1, 2021, Proceedings, volume 12648 of Lecture Notes in Computer Science, pages 234–263. Springer, 2021.
[25] Francesco Gavazzo. Quantitative behavioural reasoning for higher-order effectful programs: Applicative distances. In Proceedings of the 33rd Annual ACM/IEEE Symposium on Logic in Computer Science, LICS ’18, pages 452–461, New York, NY, USA, 2018. Association for Computing Machinery.
[26] Michèle Giry. A categorical approach to probability theory. In B. Banaschewski, editor, Categorical Aspects of Topology and Analysis, volume 915 of LNM, pages 68–85. Springer, 1982.
[27] Rob Hall. New Statistical Applications for Differential Privacy. PhD thesis, Machine Learning Department School of Computer Science Carnegie Mellon University, 2012.
[28] Chris Heunen, Ohad Kammar, Sam Staton, and Hongseok Yang. A convenient category for higher-order probability theory. In 32nd Annual ACM/IEEE Symposium on Logic in Computer Science, LICS 2017, pages 1–12, 2017.
[29] B. Jacobs. Categorical Logic and Type Theory. Elsevier, 1999.
[30] Peter Kairouz, Sewoong Oh, and Pramod Viswanath. The composition theorem for differential privacy. In Proceedings of the 32nd International Conference on Machine Learning, ICML 2015, Lille, France, 6-11 July 2015, pages 1376–1385, 2015.
[31] Shin-ya Katsumata. Parametric effect monads and semantics of effect systems. In The 41st Annual ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages, POPL ’14, pages 633–646. ACM, 2014.
[32] Shin-ya Katsumata and Tetsuya Sato. Preorders on monads and coalgebraic simulations. In Frank Pfenning, editor, Foundations of Software Science and Computation Structures, pages 145–160, Berlin, Heidelberg, 2013. Springer Berlin Heidelberg.
[33] Shin-ya Katsumata, Tetsuya Sato, and Tarmo Uustalu. Codensity lifting of monads and its dual. Logical Methods in Computer Science, 14(4), 2018.
[34] Max Kelly. Basic Concepts of Enriched Category Theory, volume 64. Cambridge University Press, 1982. Republished in: Reprints in Theory and Applications of Categories, No. 10 (2005) pp.1-136.
[35] Friedrich Liese and Igor Vajda. On divergences and informations in statistics and information theory. IEEE Transactions on Information Theory, 52(10):4394–4412, Oct 2006.
[36] John M. Lucassen and David K. Gifford. Polymorphic effect systems. In Conference Record of the Fifteenth Annual ACM Symposium on Principles of Programming Languages, pages 47–57. ACM Press, 1988.
[37] Saunders Mac Lane. Categories for the Working Mathematician (Second Edition), volume 5 of Graduate Texts in Mathematics. Springer, 1998.
[38] R. Mardare, P. Panangaden, and G. Plotkin. On the axiomatizability of quantitative algebras. In 2017 32nd Annual ACM/IEEE Symposium on Logic in Computer Science (LICS), pages 1–12, Los Alamitos, CA, USA, jun 2017. IEEE Computer Society.
[39] Radu Mardare, Prakash Panangaden, and Gordon Plotkin. Quantitative algebraic reasoning. In Proceedings of the 31st Annual ACM/IEEE Symposium on Logic in Computer Science, LICS ’16, page 700–709, New York, NY, USA, 2016. Association for Computing Machinery.
[40] Ilya Mironov. Rényi differential privacy. In 2017 IEEE 30th Computer Security Foundations Symposium (CSF), pages 263–275, Aug 2017.
[41] John C. Mitchell and Andre Scedrov. Notes on sconing and relators. In Computer Science Logic, 6th Workshop, CSL ’92, volume 702 of LNCS, pages 352–378. Springer, 1992.
[42] Eugenio Moggi. Notions of computation and monads. Information and Computation, 93(1):55–92, 1991.
[43] Tetsuzo Morimoto. Markov processes and the H-theorem. Journal of the Physical Society of Japan, 18(3):328–331, 1963.
[44] Hanne Riis Nielson and Flemming Nielson. Semantics with Applications: An Appetizer. Springer-Verlag, Berlin, Heidelberg, 2007.
[45] Federico Olmedo. Approximate Relational Reasoning for Probabilistic Programs. PhD thesis, Technical University of Madrid, 2014.
[46] Shiva Prasad and Kasiviswanathan Adam Smith. A note on differential privacy: Defining resistance to arbitrary side information. Journal of Privacy and Confidentiality, 6(1), 2014.
[47] Ivan Radiček, Gilles Barthe, Marco Gaboardi, Deepak Garg, and Florian Zuleger. Monadic refinements for relational cost analysis. Proc. ACM Program. Lang., 2(POPL):36:1–36:32, December 2017.
[48] Jason Reed and Benjamin C. Pierce. Distance makes the types grow stronger: a calculus for differential privacy. In Proceeding of the 15th ACM SIGPLAN international conference on Functional programming, ICFP 2010, pages 157–168. ACM, 2010.
[49] J. J. M. M. Rutten. Elements of generalized ultrametric domain theory. Theor. Comput. Sci., 170(1-2):349–381, December 1996.
[50] Tetsuya Sato. Identifying all preorders on the subdistribution monad. In Bart Jacobs, Alexandra Silva, and Sam Staton, editors, Proceedings of the 30th Conference on the Mathematical Foundations of Programming Semantics, MFPS 2014, Ithaca, NY, USA, June 12-15, 2014, volume 308 of Electronic Notes in Theoretical Computer Science, pages 309–327. Elsevier, 2014.
[51] Tetsuya Sato. Approximate relational hoare logic for continuous random samplings. In The Thirty-second Conference on the Mathematical Foundations of Programming Semantics, MFPS 2016, volume 325 of Electronic Notes in Theoretical Computer Science, pages 277–298. Elsevier, 2016.
[52] Tetsuya Sato, Gilles Barthe, Marco Gaboardi, Justin Hsu, and Shin-ya Katsumata. Approximate span liftings: Compositional semantics for relaxations of differential privacy. In 34th Annual ACM/IEEE Symposium on Logic in Computer Science, LICS 2019, pages 1–14. IEEE, 2019.
[53] Ross Street. The formal theory of monads. Journal of Pure and Applied Algebra, 2(2):149 – 168, 1972.
[54] Larry Wasserman and Shuheng Zhou. A statistical framework for differential privacy. Journal of the American Statistical Association, 105(489):375–389, 2010.

relax

Proof.

relax∎

relax__relax

Proposition 17.

The family $\mathsf{C}^{\prime}=\{{\mathsf{C}^{\prime}_{I}}\colon(\mathbb{N}\times I)^{2}\to\mathcal{N}\}_{I\in{\bf Set}}$ of $\mathcal{N}$ -divergences defined by

\mathsf{C}^{\prime}_{I}((i,x),(j,y))\triangleq\begin{cases}|i-j|&x=y\\ \infty&x\neq y\end{cases}.

is a ${\color[rgb]{0,0,0}\mathrm{Eq}}$ -relative $\mathcal{N}$ -divergence on the monad $\mathbb{N}\times-$ .

Proof.

The monotonicity of $\mathsf{C}^{\prime}$ is obvious.

We show the ${\color[rgb]{0,0,0}\mathrm{Eq}}$ -unit-reflexivity of $\mathsf{C}^{\prime}$ . For all $(x,y)\in{\color[rgb]{0,0,0}\mathrm{Eq}}I$ (that is, $x=y\in I$ ), we have

\mathsf{C}^{\prime}_{I}(\eta_{I}(x),\eta_{I}(y))={\mathsf{C}^{\prime}_{I}}{((0,x),(0,y))}=0.

We show the ${\color[rgb]{0,0,0}\mathrm{Eq}}$ -composability of $\mathsf{C}^{\prime}$ . Let $(i,x),(j,y)\in\mathbb{N}\times I$ and $f,g\colon I\to\mathbb{N}\times J$ . We write $f(z)=(i_{z},f_{z})$ and $g(z)=(j_{z},g_{z})$ for each $z\in Z$ .

•

If $x=y$ and $x_{z}=y_{z}$ for all $z\in I$ , we have

	$\displaystyle\mathsf{C}^{\prime}_{J}(f^{\sharp}(i,x),g^{\sharp}(j,y))$	$\displaystyle=\mathsf{C}^{\prime}_{J}(i+i_{x},f_{x}),(j+j_{x},g_{x}))$
		$\displaystyle=\|(i+i_{x})-(j+j_{x})\|\leq\|i-j\|+\|i_{x}-j_{x}\|$
		$\displaystyle\leq\mathsf{C}^{\prime}_{I}((i,x),(j,y))+\sup_{(x,y)\in{\color[rgb]{0,0,0}\mathrm{Eq}}I(\iff x=y\in I)}\mathsf{C}^{\prime}_{J}(f(x),g(y))$

•

If $x\neq y$ or $f_{z}\neq g_{z}$ for some $z\in I$ , we have

\mathsf{C}^{\prime}_{J}(f^{\sharp}(i,x),g^{\sharp}(j,y))\leq\infty=\mathsf{C}^{\prime}_{I}((i,x),(j,y))+\sup_{(x,y)\in{\color[rgb]{0,0,0}\mathrm{Eq}}I(\iff x=y\in I)}\mathsf{C}^{\prime}_{J}(f(x),g(y)).

This completes the proof. ∎

Proposition 18.

The family $\mathsf{NC}=\{\mathsf{NC}_{I}\colon(P(\mathbb{N}\times I))^{2}\to\mathcal{N}\}_{I\in{\bf Set}}$ of $\mathcal{N}$ -divergences defined by

\mathsf{NC}_{I}(A,B)\triangleq\sup_{(i,x)\in A,(j,x)\in B}|i-j|

is a ${\color[rgb]{0,0,0}\mathrm{Top}}$ -relative $\mathcal{N}$ -divergence on the monad $P(\mathbb{N}\times-)$ .

Proof.

The monotonicity of $\mathsf{NC}$ is obvious.

We show the ${\color[rgb]{0,0,0}\mathrm{Top}}$ -unit-reflexivity of $\mathsf{NC}$ . For all $(x,y)\in{\color[rgb]{0,0,0}\mathrm{Top}}I$ (that is, $x,y\in I$ ), we have

\mathsf{NC}_{I}(\eta_{I}(x),\eta_{I}(y))={\mathsf{NC}_{I}}{(\{(0,x)\},\{(0,y)\})}=|0-0|=0.

We show the ${\color[rgb]{0,0,0}\mathrm{Top}}$ -composability of $\mathsf{NC}$ . For all $f,g\colon I\to P(\mathbb{N}\times J)$ and $A,B\in P(\mathbb{N}\times I)$ , we have

	$\displaystyle\mathsf{NC}_{J}(f^{\sharp}A,g^{\sharp}B)$	$\displaystyle=\sup\{\|i-j\|\mid(i,x)\in f^{\sharp}(A),(j,y)\in g^{\sharp}(B)\}$
		$\displaystyle=\sup\left\{\|i_{1}+i_{2}-j_{1}-j_{2}\|~{}\middle\|\begin{array}[]{l@{}}(i_{1},x)\in A,(j_{1},y)\in B,\\ (i_{2},x^{\prime})\in f(x),(j_{2},y^{\prime})\in g(y)\end{array}\right\}$
		$\displaystyle\leq\sup\{\|i_{1}-j_{1}\|~{}\|~{}(i_{1},x)\in A,(j_{1},y)\in B\}$
		$\displaystyle\qquad+\sup_{(x,y)\in{\color[rgb]{0,0,0}\mathrm{Top}}I(\iff x,y\in I)}\{\|i_{2}-j_{2}\|~{}\|~{}(i_{2},x^{\prime})\in f(x),(j_{2},y^{\prime})\in g(y)\}$
		$\displaystyle=\mathsf{NC}_{I}(A,B)+\sup_{(x,y)\in{\color[rgb]{0,0,0}\mathrm{Top}}I(\iff x,y\in I)}\mathsf{NC}_{J}(f(x),g(y)).$

This completes the proof. ∎

Proposition 19.

The family $\mathsf{NCI}=\{\mathsf{NCI}_{I}\colon(P(\mathbb{N}\times I))^{2}\to\mathcal{N}\}_{I\in{\bf Set}}$ of $\mathcal{Z}$ -divergences defined by

\mathsf{NCI}_{I}(A,B)\triangleq\sup_{(i,x)\in A,(j,y)\in B}i-j

is a ${\color[rgb]{0,0,0}\mathrm{Top}}$ -relative $\mathcal{Z}$ -divergence on the monad $P(\mathbb{N}\times-)$ .

Proof.

The monotonicity of $\mathsf{NCI}$ is obvious.

We show the ${\color[rgb]{0,0,0}\mathrm{Top}}$ -unit-reflexivity of $\mathsf{NCI}$ . For all $(x,y)\in{\color[rgb]{0,0,0}\mathrm{Top}}I$ (that is, $x,y\in I$ ), we have

\mathsf{NCI}_{I}(\eta_{I}(x),\eta_{I}(y))={\mathsf{NCI}_{I}}{(\{(0,x)\},\{(0,y)\})}=0-0=0.

We show the ${\color[rgb]{0,0,0}\mathrm{Top}}$ -composability of $\mathsf{NCI}$ . For all $f,g\colon I\to P(\mathbb{N}\times J)$ and $A,B\in P(\mathbb{N}\times I)$ , we have

	$\displaystyle\mathsf{NCI}_{J}(f^{\sharp}A,g^{\sharp}B)$	$\displaystyle=\sup\{i-j\mid(i,x)\in f^{\sharp}(A)\land(j,y)\in g^{\sharp}(B)\}$
		$\displaystyle=\sup\left\{i_{1}+i_{2}-j_{1}-j_{2}~{}\middle\|\begin{array}[]{l@{}}(i_{1},x)\in A,(j_{1},y)\in B,\\ (i_{2},x^{\prime})\in f(x),(j_{2},y^{\prime})\in g(y)\end{array}\right\}$
		$\displaystyle\leq\sup\{i_{1}-j_{1}~{}\|~{}(i_{1},x)\in A,(j_{1},y)\in B\}$
		$\displaystyle\qquad+\sup_{(x,y)\in{\color[rgb]{0,0,0}\mathrm{Top}}I(\iff x,y\in I)}\{i_{2}-j_{2}~{}\|~{}(i_{2},x^{\prime})\in f(x),(j_{2},y^{\prime})\in g(y)\}$
		$\displaystyle=\mathsf{NCI}_{I}(A,B)+\sup_{(x,y)\in{\color[rgb]{0,0,0}\mathrm{Top}}I(\iff x,y\in I)}\mathsf{NCI}_{J}(f(x),g(y)).$

This completes the proof. ∎

__relaxaxp@oldproof (Proof of Proposition 1) We have ${\color[rgb]{0,0,0}\mathrm{Eq}}{}$ -unit reflexivity because the reflexivity ${}^{f}\mathsf{Div}_{I}(\mu,\mu)=0$ is obtained from $f(1)=0$ . We show ${\color[rgb]{0,0,0}\mathrm{Eq}}{}$ -composability. To show this, we prove a bit stronger statement. Consider three positive weight functions $f,f_{1},f_{2}\geq 0$ with $f(1)=f_{1}(1)=f_{2}(1)=0$ . Assume that there are some $\alpha,\beta,\beta^{\prime}\in\mathbb{R}$ satisfying the following conditions: {itembox}[l](A’) for all $x,y,z,w\in[0,1]$ , $0\leq(\beta^{\prime}z+(1-\beta^{\prime})x)+\gamma xf_{1}\left({z}/{x}\right)$ and

	$\displaystyle xyf\left({zw}/{xy}\right)$	$\displaystyle\leq(\beta w+(1-\beta)y)xf_{1}\left({z}/{x}\right)+(\beta^{\prime}z+(1-\beta^{\prime})x)yf_{2}\left({w}/{y}\right)$
		$\displaystyle\quad+\gamma xyf_{1}\left({z}/{x}\right)f_{2}\left({w}/{y}\right)+\alpha(x-z)(w-y).$

Let $\mu_{1},\mu_{2}\in G_{s}I$ , and let $h,k\colon I\to G_{s}J$ . We want to show the composability in the sense of [45, Definition 5.2]:

\begin{split}&{{}^{f}\mathsf{Div}}_{J}(h^{\sharp}\mu_{1},k^{\sharp}\mu_{2})\\ &\leq{{}^{f_{1}}\mathsf{Div}}_{I}(\mu_{1},\mu_{2})+\sup_{x\in I}{{}^{f_{2}}\mathsf{Div}}_{J}(h(x),k(x))+\gamma{{}^{f_{1}}\mathsf{Div}}_{I}(\mu_{1},\mu_{2})\cdot\sup_{x\in I}{{}^{f_{2}}\mathsf{Div}}_{J}(h(x),k(x)).\end{split}

(23)

We first fix a measurable partition $\{A_{i}\}_{i=0}^{n}$ of $J$ , that is a family $\{A_{i}\}_{i=0}^{n}$ of measurable subsets $A_{i}\in\Sigma_{J}$ satisfying $i\neq j\implies A_{i}\cap A_{j}=\emptyset$ and $\bigcup_{i=0}^{n}A_{i}=J$ . For each $0\leq i\leq n$ , we fix two monotone increasing sequences $\{h^{i}_{l}\}_{l=0}^{\infty}$ and $\{k^{i}_{l}\}_{l=0}^{\infty}$ of simple functions that converge uniformly to measurable functions $h(-)(A_{i})\colon I\to[0,1]$ and $k(-)(A_{i})\colon I\to[0,1]$ respectively. The above composability (23) is then equivalent to

\begin{split}&\lim_{l\to\infty}\sum_{i=0}^{n}(\int_{X}k^{i}_{l}~{}d\mu_{2})f\left(\frac{\int_{X}h^{i}_{l}~{}d\mu_{1}}{\int_{X}k^{i}_{l}~{}d\mu_{2}}\right)\\ &\leq{{}^{f_{1}}\mathsf{Div}}_{I}(\mu_{1},\mu_{2})+\sup_{x\in I}{{}^{f_{2}}\mathsf{Div}}_{J}(h(x),k(x))+\gamma{{}^{f_{1}}\mathsf{Div}}_{I}(\mu_{1},\mu_{2})\sup_{x\in I}{{}^{f_{2}}\mathsf{Div}}_{J}(h(x),k(x)).\end{split}

(24)

We fix $l\in\mathbb{N}$ . We suppose $h^{i}_{l}=\sum_{j=0}^{m}\alpha^{i}_{j}\chi_{B_{j}}$ and $k^{i}_{l}=\sum_{j=0}^{m}\beta^{i}_{j}\chi_{B_{j}}$ for some $\alpha^{i}_{j},\beta^{i}_{j}\in[0,1]$ ( $0\leq j\leq m$ ) and a measurable partition $\{B_{j}\}_{j=0}^{m}$ of $I$ .

Thanks to the condition (A’), we calculate as follows:

	$\displaystyle\sum_{i=0}^{n}(\int_{X}k^{i}_{l}~{}d\mu_{2})f\left(\frac{\int_{X}h^{i}_{l}~{}d\mu_{1}}{\int_{X}k^{i}_{l}~{}d\mu_{2}}\right)$
		$\displaystyle\leq\sum_{i=0}^{n}\sum_{j=0}^{m}\beta^{i}_{j}\mu_{2}(B_{j})f\left(\frac{\alpha^{i}_{j}\mu_{1}(B_{j})}{\beta^{i}_{j}\mu_{2}(B_{j})}\right)$
		$\displaystyle\leq\quad\underbrace{\sum_{i=0}^{n}\sum_{j=0}^{m}(\beta\alpha^{i}_{j}+(1-\beta)\beta^{i}_{j})~{}\mu_{2}(B_{j})f_{1}\left(\frac{\mu_{1}(B_{j})}{\mu_{2}(B_{j})}\right)}_{\triangleq V_{1}}$
		$\displaystyle\quad+\underbrace{\sum_{i=0}^{n}\sum_{j=0}^{m}\left(\beta^{\prime}\mu_{1}(B_{j})+(1-\beta^{\prime})\mu_{2}(B_{j}))+\gamma\mu_{2}(B_{j})f_{1}\left(\frac{\mu_{1}(B_{j})}{\mu_{2}(B_{j})}\right)\right)\beta^{i}_{j}f_{2}\left(\frac{\alpha^{i}_{j}}{\beta^{i}_{j}}\right)}_{\triangleq V_{2}}$
		$\displaystyle\quad+\underbrace{\sum_{i=0}^{n}\sum_{j=0}^{m}\alpha(\mu_{2}(B_{j})-\mu_{1}(B_{j}))(\alpha^{i}_{j}-\beta^{i}_{j})}_{\triangleq V_{3}}$

We evaluate the above three subexpressions $V_{1},V_{2},V_{3}$ as follows.

We evaluate $V_{1}$ as follows:

	$\displaystyle V_{1}$	$\displaystyle\leq\left(\sup_{0\leq j\leq m}\sum_{i=0}^{n}(\beta\alpha^{i}_{j}+(1-\beta)\beta^{i}_{j})\right)\cdot\sum_{j=0}^{m}\mu_{2}(B_{j})f_{1}\left(\frac{\mu_{1}(B_{j})}{\mu_{2}(B_{j})}\right)$
		$\displaystyle=\sup_{x\in I}\left(\beta\sum_{i=0}^{n}h^{i}_{l}(x)+(1-\beta)\sum_{i=0}^{n}k^{i}_{l}(x)\right)\cdot\sum_{j=0}^{m}\mu_{2}(B_{j})f_{1}\left(\frac{\mu_{1}(B_{j})}{\mu_{2}(B_{j})}\right)$
		$\displaystyle\leq\sup_{x\in I}\left(\beta\sum_{i=0}^{n}h^{i}_{l}(x)+(1-\beta)\sum_{i=0}^{n}k^{i}_{l}(x)\right)\cdot{{}^{f_{1}}\mathsf{Div}}_{I}(\mu_{1},\mu_{2})$
		$\displaystyle\xrightarrow[]{~{}l\to\infty~{}}\sup_{x\in I}\left(\beta h(x)(J)+(1-\beta)k(x)(J)\right)\cdot{{}^{f_{1}}\mathsf{Div}}_{I}(\mu_{1},\mu_{2})$
		$\displaystyle\leq{{}^{f_{1}}\mathsf{Div}}_{I}(\mu_{1},\mu_{2})$

Here, the first inequality is given from the non-negativity of each $\mu_{2}(B_{j})f_{1}\left(\frac{\mu_{1}(B_{j})}{\mu_{2}(B_{j})}\right)$ ; the equality is given by definition of $\alpha_{j}^{i}$ and $\beta_{j}^{i}$ ; the second inequality can be given by the continuity of ${{}^{f_{1}}\mathsf{Div}}$ ([35, Theorem 16]; [52, Theorem 3] for the sub-Giry monad $G_{s}$ ):

{{}^{f_{1}}\mathsf{Div}}_{I}(\mu_{1},\mu_{2})=\sup\left\{\sum_{j=0}^{m}\mu_{2}(B_{j})f_{1}\left(\frac{\mu_{1}(B_{j})}{\mu_{2}(B_{j})}\right)\middle|\{B_{j}\}_{j=0}^{m}\colon\text{measurable partition of }I\right\};

the last inequality is derived by $\beta h(x)(J)+(1-\beta)k(x)(J)\in[0,1]$ from the assumption that either $\beta\in[0,1]$ or $h(x)(J)=k(x)(J)$ for all $x\in I$ holds.

We next evaluate $V_{2}$ as follows:

	$\displaystyle V_{2}$	$\displaystyle\leq\left(\sup_{0\leq j\leq m}\sum_{i=0}^{n}\beta^{i}_{j}f_{2}\left(\frac{\alpha^{i}_{j}}{\beta^{i}_{j}}\right)\right)\sum_{j=0}^{m}\left(\beta^{\prime}\mu_{1}(B_{j})+(1-\beta^{\prime})\mu_{2}(B_{j}))+\gamma\mu_{2}(B_{j})f_{1}\left(\frac{\mu_{1}(B_{j})}{\mu_{2}(B_{j})}\right)\right)$
		$\displaystyle=\left(\sup_{x\in I}\sum_{i=0}^{n}k^{i}_{l}(x)f_{2}\left(\frac{h^{i}_{l}(x)}{k^{i}_{l}(x)}\right)\right)\left(\beta^{\prime}\mu_{1}(I)+(1-\beta^{\prime})\mu_{2}(I)+\gamma\sum_{j=0}^{m}\mu_{2}(B_{j})f_{1}\left(\frac{\mu_{1}(B_{j})}{\mu_{2}(B_{j})}\right)\right)$
		$\displaystyle\leq\left(\sup_{x\in I}\sum_{i=0}^{n}k^{i}_{l}(x)f_{2}\left(\frac{h^{i}_{l}(x)}{k^{i}_{l}(x)}\right)\right)\left(\beta^{\prime}\mu_{1}(I)+(1-\beta^{\prime})\mu_{2}(I)+\gamma{{}^{f_{1}}\mathsf{Div}}_{I}(\mu_{1},\mu_{2})\right)$
		$\displaystyle\xrightarrow[]{~{}l\to\infty~{}}\left(\sup_{x\in I}\sum_{i=0}^{n}k(x)(A_{i})f_{2}\left(\frac{h(x)(A_{i})}{k(x)(A_{i})}\right)\right)\left(\beta^{\prime}\mu_{1}(I)+(1-\beta^{\prime})\mu_{2}(I)+\gamma{{}^{f_{1}}\mathsf{Div}}_{I}(\mu_{1},\mu_{2})\right)$
		$\displaystyle\leq\sup_{x\in I}{{}^{f_{2}}\mathsf{Div}}_{J}(h(x),k(x))\left(\beta^{\prime}\mu_{1}(I)+(1-\beta^{\prime})\mu_{2}(I)+\gamma{{}^{f_{1}}\mathsf{Div}}_{I}(\mu_{1},\mu_{2})\right)$
		$\displaystyle\leq\sup_{x\in I}{{}^{f_{2}}\mathsf{Div}}_{J}(h(x),k(x))\cdot\gamma{{}^{f_{1}}\mathsf{Div}}_{I}(\mu_{1},\mu_{2})$
		$\displaystyle=\gamma{{}^{f_{1}}\mathsf{Div}}_{I}(\mu_{1},\mu_{2})\cdot\sup_{x\in I}{{}^{f_{2}}\mathsf{Div}}_{J}(h(x),k(x)).$

Here, the first inequality is derived from the non-negativity of each

(\beta^{\prime}\mu_{1}(B_{j})+(1-\beta^{\prime})\mu_{2}(B_{j}))+\gamma\mu_{2}(B_{j})f_{1}\left(\frac{\mu_{1}(B_{j})}{\mu_{2}(B_{j})}\right);

(25)

the first equality is given by definition of $\alpha_{j}^{i}$ and $\beta_{j}^{i}$ and the countable additivity of $\mu_{1}$ and $\mu_{2}$ ; the second inequality is given by the continuity of ${{}^{f_{1}}\mathsf{Div}}$ and $0\leq\gamma$ ; the last inequality is derived by $\beta^{\prime}\mu_{1}(I)+(1-\beta^{\prime})\mu_{2}(I)\in[0,1]$ from the assumption that either $\beta^{\prime}\in[0,1]$ or $\mu_{1}(I)=\mu_{2}(I)$ holds. We prove the third inequality. Since $f_{2}$ is convex function, and sequences $\{h^{i}_{l}(x)\}_{l=0}^{\infty}$ and $\{k^{i}_{l}(x)\}_{l=0}^{\infty}$ are monotone increasing at each $x\in I$ , By Jensen’s inequality, the sequence $\left\{\sum_{i=0}^{n}k^{i}_{l}(x)f_{2}\left({h^{i}_{l}(x)}/{k^{i}_{l}(x)}\right)\right\}_{l=0}^{\infty}$ is monotone increasing for each $x\in I$ . Then, the sequence $\left\{\sup_{x\in I}\sum_{i=0}^{n}k^{i}_{l}(x)f_{2}\left({h^{i}_{l}(x)}/{k^{i}_{l}(x)}\right)\right\}_{l=0}^{\infty}$ of supremums is also monotone increasing, because each $\sum_{i=0}^{n}k^{i}_{l+1}(x)f_{2}\left({h^{i}_{l+1}(x)}/{k^{i}_{l+1}(x)}\right)$ is always greater than $\sum_{i=0}^{n}k^{i}_{l}(x)f_{2}\left({h^{i}_{l}(x)}/{k^{i}_{l}(x)}\right)$ . Hence,

	$\displaystyle\lim_{l\to\infty}\sup_{x\in I}\sum_{i=0}^{n}k^{i}_{l}(x)f_{2}\left(\frac{h^{i}_{l}(x)}{k^{i}_{l}(x)}\right)$	$\displaystyle=\sup_{l\in\mathbb{N}}\sup_{x\in I}\sum_{i=0}^{n}k^{i}_{l}(x)f_{2}\left(\frac{h^{i}_{l}(x)}{k^{i}_{l}(x)}\right)$
		$\displaystyle=\sup_{x\in I}\sup_{l\in\mathbb{N}}\sum_{i=0}^{n}k^{i}_{l}(x)f_{2}\left(\frac{h^{i}_{l}(x)}{k^{i}_{l}(x)}\right)$
		$\displaystyle=\sup_{x\in I}\sum_{i=0}^{n}k(x)(A_{i})f_{2}\left(\frac{h(x)(A_{i})}{k(x)(A_{i})}\right)$
		$\displaystyle\leq\sup_{x\in I}{{}^{f_{2}}\mathsf{Div}}(h(x),k(x)).$

Finally, we evaluate $V_{3}$ as follows:

	$\displaystyle V_{3}$	$\displaystyle=\sum_{j=0}^{m}\alpha(\mu_{2}(B_{j})-\mu_{1}(B_{j}))(\sum_{i=0}^{n}\alpha^{i}_{j}-\beta^{i}_{j})$
		$\displaystyle=\alpha\left(\int_{I}h^{i}_{l}~{}d\mu_{2}-\int_{I}k^{i}_{l}~{}d\mu_{2}+\int_{I}k^{i}_{l}~{}d\mu_{1}-\int_{I}h^{i}_{l}~{}d\mu_{1}\right)$
		$\displaystyle\xrightarrow[]{~{}l\to\infty~{}}\alpha\left(\int_{I}h(-)(J)~{}d\mu_{2}-\int_{I}k(-)(J)~{}d\mu_{2}+\int_{I}k(-)(J)~{}d\mu_{1}-\int_{I}h(-)(J)~{}d\mu_{1}\right).$

Here, if either $\alpha=0$ or $h(x)(J)=k(x)(J)$ for any $x\in I$ holds then the limit will be $0$ . To sum up the above evaluations of $V_{1},V_{2},V_{3}$ , we obtain the inequality (24) if we have either

1.

$\mu_{1}(I)=\mu_{2}(I)=1$ and $\forall x\in I.~{}h(x)(J)=k(x)(J)=1$ , or
2.

$\alpha=0$ and $\beta,\beta\in[0,1]$ .

This completes the proof. __relaxaxp@oldproof Parameters for Proposition 1 for for weight functions of $\mathsf{TV}$ , $\mathsf{KL}$ , $\mathsf{HD}$ and $\mathsf{Chi}$ are shown in Table 4. Below, we check the conditions in Proposition 1.

•

For the weight function $f(t)=|t-1|/2$ of $\mathsf{TV}$ , the tuple $(\gamma,\alpha,\beta,\beta^{\prime})=(0,0,1,0)$ satisfies for all $x,y,z,w\in[0,1]$ , we have

	$\displaystyle 0$	$\displaystyle\leq w+xf({z}/{x}),$
	$\displaystyle xyf(zw/xy)$	$\displaystyle=\|{zw}-xy\|/2\leq\|{zw}-{wx}\|+\|{xw}-xy\|/2=wxf({z}/{x})+xf(\|{w}/{y})/2.$

•

For the weight function $f(t)=t\log(t)-t+1$ of $\mathsf{KL}$ , the tuple $(\gamma,\alpha,\beta,\beta^{\prime})=(0,-1,1,1)$ satisfies for all $x,y,z,w\in[0,1]$ , we have

	$\displaystyle 0$	$\displaystyle\leq z+xf(z/x),$
	$\displaystyle xy((zw/xy)\log(zw/xy)-zw/xy+1)$
		$\displaystyle=zw\log(w/y)+zw\log(z/x)-zw+xy$
		$\displaystyle=xw((z/x)\log(z/x)-z/x+1)+zy((w/y)\log(w/y)-w/y+1)-(x-z)(w-y).$

•

For the weight function $f(t)=(\sqrt{t}-1)^{2}/2$ of $\mathsf{HD}$ , the tuple $(\gamma,\alpha,\beta,\beta^{\prime})=(0,-1/4,1/2,1/2)$ satisfies for all $x,y,z,w\in[0,1]$ ,

	$\displaystyle 0$	$\displaystyle\leq(z+x)/2+f(z/x),$
	$\displaystyle xyf(zw/xy)$	$\displaystyle=(zw+xy)/2-((x+z)-(\sqrt{x}-\sqrt{z})^{2})((y+w)-(\sqrt{y}-\sqrt{w})^{2})/4$
		$\displaystyle=(zw+xy)/2-((x+z)-xf(z/x))((y+w)-yf(w/y))/4$
		$\displaystyle\leq(y+w)/2\cdot xf(z/x)+(x+z)/2\cdot yf(w/y)-(x-z)(w-y)/4.$

•

For the weight function $f(t)=({t}-1)^{2}/2$ of $\mathsf{Chi}$ , The tuple $(\gamma,\alpha,\beta,\beta^{\prime})=(1,-2,2,2)$ satisfies for all $x,y,z,w\in[0,1]$ ,

	$\displaystyle 0$	$\displaystyle\leq(2z-x)+xf(z/x)=(2z-x)+((z/x)-1)(z-x)=z+(z^{2}/x),$
	$\displaystyle xyf(zw/xy)=z^{2}w^{2}/xy+xy-2zw$
		$\displaystyle=(xf(z/x)+2z-x)(yf(w/y)+2w-y)-2zw+xy$
		$\displaystyle=(2w-y)xf(z/x)+(2z-x)yf(w/y)+xyf(z/x)f(w/y)-2(x-z)(w-y).$

__relaxaxp@oldproof (Proof of Proposition 2)

We first show the monotonicity of $\langle{p,\lambda}\rangle^{*}{\mathsf{\Delta}}$ . Assume $m\leq m^{\prime}$ . From the monotonicity of the original ${\mathsf{\Delta}}$ , we obtain for each $\nu_{1},\nu_{2}\in U^{\mathbb{C}}(SI))$ ,

	$\displaystyle(\langle{p,\lambda}\rangle^{*}{\mathsf{\Delta}})^{m}_{I}(\nu_{1},\nu_{2})$	$\displaystyle={\mathsf{\Delta}}^{m}_{pI}((U^{\mathbb{D}}\lambda_{I})(\nu_{1}),(U^{\mathbb{D}}\lambda_{I})(\nu_{2}))$
		$\displaystyle\geq{\mathsf{\Delta}}^{m^{\prime}}_{pI}((U^{\mathbb{D}}\lambda_{I})(\nu_{1}),(U^{\mathbb{D}}\lambda_{I})(\nu_{2}))$
		$\displaystyle=(\langle{p,\lambda}\rangle^{*}{\mathsf{\Delta}})^{m^{\prime}}_{I}(\nu_{1},\nu_{2}).$

Second, we show the $F$ -unit-reflexivity of $\langle{p,\lambda}\rangle^{*}{\mathsf{\Delta}}$ . For $FI=(I,I,R_{FI})$ , we have $EpI=(p=(pI,pI,R_{FI})$ for all $I\in\mathbb{C}$ . We can calculate for all $(x,y)\in R_{F}$ ,

	$\displaystyle(\langle{p,\lambda}\rangle^{*}{\mathsf{\Delta}})^{1_{M}}_{I}(\eta^{S}_{I}\mathbin{\bullet}x,\eta^{S}_{I}\mathbin{\bullet}y)$	$\displaystyle={\mathsf{\Delta}}^{1_{M}}_{pI}(U^{\mathbb{D}}\lambda_{I}\circ U^{\mathbb{C}}\eta^{S}_{I}\circ x,U^{\mathbb{D}}\lambda_{I}\circ U^{\mathbb{C}}\eta^{S}_{I}\circ y)$
		$\displaystyle={\mathsf{\Delta}}^{1_{M}}_{pI}((\lambda_{I}\circ p\eta^{S}_{I})\mathbin{\bullet}x,(\lambda_{I}\circ p\eta^{S}_{I})\mathbin{\bullet}y)$
		$\displaystyle={\mathsf{\Delta}}^{1_{M}}_{pI}(\eta^{T}_{pI}\mathbin{\bullet}x,\eta^{T}_{pI}\mathbin{\bullet}y)\leq 0.$

Finally, we show the ${\color[rgb]{0,0,0}F}$ -composability of $\langle{p,\lambda}\rangle^{*}{\mathsf{\Delta}}$ . For all $J\in\mathbb{C}$ , $c_{1},c_{2}\in U^{\mathbb{C}}TI$ , and $f_{1},f_{2}\colon I\to SJ$ we can calculate

	$\displaystyle(\langle{p,\lambda}\rangle^{*}{\mathsf{\Delta}})^{mn}_{J}(f_{1}^{\sharp}\mathbin{\bullet}c_{1},f_{2}^{\sharp}\mathbin{\bullet}c_{2})$	$\displaystyle={\mathsf{\Delta}}^{mn}_{pJ}(U^{\mathbb{D}}\lambda_{J}\circ U^{\mathbb{D}}p(f_{1}^{\sharp})\circ c_{1},U^{\mathbb{D}}\lambda_{J}\circ U^{\mathbb{D}}p(f_{2}^{\sharp})\circ c_{2})$
		$\displaystyle={\mathsf{\Delta}}^{mn}_{pJ}(U^{\mathbb{D}}((\lambda_{J}\circ pf_{1})^{\sharp})\circ U^{\mathbb{D}}\lambda_{I}\circ c_{1},U^{\mathbb{D}}((\lambda_{J}\circ pf_{2})^{\sharp})\circ U^{\mathbb{D}}\lambda_{I}\circ c_{2})$
		$\displaystyle={\mathsf{\Delta}}^{mn}_{pJ}((\lambda_{J}\circ pf_{1})^{\sharp}\mathbin{\bullet}(\lambda_{I}\mathbin{\bullet}c_{1}),(\lambda_{J}\circ pf_{2})^{\sharp}\mathbin{\bullet}(\lambda_{I}\mathbin{\bullet}c_{2}))$
		$\displaystyle\leq{\mathsf{\Delta}}^{m}_{pI}(\lambda_{I}\mathbin{\bullet}c_{1},\lambda_{I}\mathbin{\bullet}c_{2})+\sup_{(x,y)\in EpI}{\mathsf{\Delta}}^{n}_{pJ}((\lambda_{J}\circ pf_{1})\mathbin{\bullet}x,(\lambda_{J}\circ pf_{2})\mathbin{\bullet}x)$
		$\displaystyle=(\langle{p,\lambda}\rangle^{}{\mathsf{\Delta}})^{m}_{I}(c_{1},c_{2})+\sup_{(x,y)\in FI}(\langle{p,\lambda}\rangle^{}{\mathsf{\Delta}})^{n}_{J}(f_{1}\mathbin{\bullet}x,f_{2}\mathbin{\bullet}y).$

To prove the second equality, we calculate

	$\displaystyle U^{\mathbb{D}}\lambda_{J}\circ U^{\mathbb{D}}p(f_{i}^{\sharp})$	$\displaystyle=U^{\mathbb{D}}(\lambda_{J}\circ p\mu^{S}_{J}\circ pSf_{i})=U^{\mathbb{D}}(\mu^{T}_{pJ}\circ T\lambda_{J}\circ\lambda_{SJ}\circ pSf_{i})$
		$\displaystyle=U^{\mathbb{D}}(\mu^{T}_{pJ}\circ T\lambda_{J}\circ Tpf_{i}\circ\lambda_{I})=U^{\mathbb{D}}((\lambda_{J}\circ pf_{i})^{\sharp}\circ\lambda_{I}).$

This completes the proof. __relaxaxp@oldproof __relaxaxp@oldproof (Proof of Proposition 3)

It suffices to show ${\color[rgb]{0,0,0}\mathrm{Top}}$ -unit reflexivity and ${\color[rgb]{0,0,0}\mathrm{Top}}$ -composability:

	$\displaystyle{\mathsf{\Delta}}^{\mathsf{lip},d_{S}}_{I}(\eta_{I}(x),\eta_{I}(y))=\sup_{s^{\prime},s\in S}\frac{d_{S}(\pi_{2}(s,x),\pi_{2}(s^{\prime},y))}{d_{S}(s,s^{\prime})}=\frac{d_{S}(s,s^{\prime})}{d_{S}(s,s^{\prime})}=1,$
	$\displaystyle{\mathsf{\Delta}}^{\mathsf{lip},d_{S}}_{J}(F_{1}^{\sharp}(f_{1}),F_{1}^{\sharp}(f_{2}))$
	$\displaystyle=\sup_{s^{\prime},s\in S}\frac{d_{S}(\pi_{2}(F_{1}(\pi_{1}f_{1}(s))(\pi_{2}f_{1}(s))),\pi_{2}(F_{2}(\pi_{1}f_{2}(s^{\prime}))(\pi_{2}f_{2}(s^{\prime}))))}{d_{S}(s,s^{\prime})}$
	$\displaystyle=\sup_{s^{\prime},s\in S}\frac{d_{S}(\pi_{2}f_{1}(s),\pi_{2}f_{2}(s^{\prime}))}{d_{S}(s,s^{\prime})}\cdot\frac{d_{S}(\pi_{2}(F_{1}(\pi_{1}f_{1}(s))(\pi_{2}f_{1}(s))),\pi_{2}(F_{2}(\pi_{1}f_{2}(s^{\prime}))(\pi_{2}f_{2}(s^{\prime}))))}{d_{S}(\pi_{2}f_{1}(s),\pi_{2}f_{2}(s^{\prime}))}$
	$\displaystyle\leq\sup_{s^{\prime},s\in S}\frac{d_{S}(\pi_{2}f_{1}(s),\pi_{2}f_{2}(s^{\prime}))}{d_{S}(s,s^{\prime})}\cdot\sup_{t^{\prime},t\in S}\frac{d_{S}(\pi_{2}(F_{1}(\pi_{1}f_{1}(s))(t)),\pi_{2}(F_{2}(\pi_{1}f_{2}(s^{\prime}))(t^{\prime})))}{d_{S}(t,t^{\prime})}$
	$\displaystyle\leq{\mathsf{\Delta}}^{\mathsf{lip},d_{S}}_{I}(f_{1},f_{2})\cdot\sup_{x,y\in I}{\mathsf{\Delta}}^{\mathsf{lip},d_{S}}_{J}(F_{1}(x),F_{2}(y))$

Here $F_{1},F_{2}\colon I\to T_{S}J$ and $f_{1},f_{2}\in T_{S}I$ . __relaxaxp@oldproof __relaxaxp@oldproof (Proof of Proposition 4)

It suffices to show ${\color[rgb]{0,0,0}\mathrm{Eq}}$ -unit reflexivity and ${\color[rgb]{0,0,0}\mathrm{Eq}}$ -composability:

	$\displaystyle{\mathsf{\Delta}}^{\mathsf{met},d_{S}}_{I}(\eta_{I}(x),\eta_{I}(x))$	$\displaystyle=\sup_{s\in S}d_{S}(\pi_{2}(x,s),\pi_{2}(x,s))=\sup_{s\in S}d_{S}(s,s)=0.$
	$\displaystyle{\mathsf{\Delta}}^{\mathsf{met},d_{S}}_{J}(F_{1}^{\sharp}(f_{1}),F_{1}^{\sharp}(f_{2}))$	$\displaystyle=\sup_{s\in S}d_{S}(\pi_{2}(F_{1}(\pi_{1}f_{1}(s))(\pi_{2}f_{1}(s))),\pi_{1}(F_{2}(\pi_{1}f_{2}(s))(\pi_{2}f_{2}(s))))$
		$\displaystyle\leq\sup_{s\in S}d_{S}(\pi_{2}(F_{1}(\pi_{1}f_{1}(s))(\pi_{2}f_{1}(s))),\pi_{2}(F_{2}(\pi_{1}f_{1}(s))(\pi_{2}f_{1}(s))))$
		$\displaystyle\quad+\sup_{s\in S}d_{S}(\pi_{2}(F_{2}(\pi_{1}f_{1}(s))(\pi_{2}f_{1}(s))),\pi_{2}(F_{2}(\pi_{1}f_{1}(s))(\pi_{2}f_{2}(s))))$
		$\displaystyle\leq\sup_{x\in I}{\mathsf{\Delta}}^{\mathsf{met},d_{S}}_{J}(F_{1}(x),F_{2}(x))+{\mathsf{\Delta}}^{\mathsf{met},d_{S}}_{I}(f_{1},f_{2})$

Here $F_{1},F_{2}\colon I\to T_{S}J$ and $f_{1},f_{2}\in T_{S}I$ . Without loss of generality, we may assume $\pi_{1}f_{1}=\pi_{1}f_{2}$ holds and $\pi_{2}f_{1}$ and $\pi_{2}f_{2}$ are nonexpansive, and for every $x\in I$ , $\pi_{1}F_{1}(x)=\pi_{1}F_{2}(x)$ holds and $\pi_{2}F_{1}(x)$ and $\pi_{2}F_{2}(x)$ are nonexpansive. __relaxaxp@oldproof __relaxaxp@oldproof (Proof of Proposition 5) We first show the ${\color[rgb]{0,0,0}\mathrm{Eq}}{}$ -unit reflexivity of $d^{T_{S}(-)}$ . For any $s\in S$ , we calculate

	$\displaystyle d_{T_{S}I}(\eta_{I}(x),\eta_{I}(x))$	$\displaystyle=\sup_{s\in S}\max\left(d_{I}(\pi_{1}(x,s),\pi_{1}(x,s)),d_{S}(\pi_{2}(x,s),\pi_{2}(x,s)\right)$
		$\displaystyle=\sup_{s\in S}\max(d_{I}(x,x),d_{S}(s,s))=0.$

We next show the ${\color[rgb]{0,0,0}\mathrm{Eq}}{}$ -composability of $d^{T_{S}(-)}$ . For any $f_{1},f_{2}\in T_{S}(I,d_{I})$ and nonexpansive functions $F_{1},F_{2}\colon(I,d_{I})\to T_{S}(J,d_{J})$ , we compute

	$\displaystyle d^{T_{S}J}(F_{1}^{\sharp}(f_{1}),F_{1}^{\sharp}(f_{2}))$	$\displaystyle=\sup_{s\in S}\max\left(\begin{aligned} d_{J}(\pi_{1}(F_{1}(\pi_{1}f_{1}(s))(\pi_{2}f_{1}(s))),\pi_{1}(F_{2}(\pi_{1}f_{2}(s))(\pi_{2}f_{2}(s))),\\ d_{S}(\pi_{2}(F_{1}(\pi_{1}f_{1}(s))(\pi_{2}f_{1}(s))),\pi_{2}(F_{2}(\pi_{1}f_{2}(s))(\pi_{2}f_{2}(s)))\end{aligned}\right)\allowdisplaybreaks[0]$
		$\displaystyle\leq\sup_{s\in S}\max\left(\begin{aligned} d_{J}(\pi_{1}(F_{1}(\pi_{1}f_{1}(s))(\pi_{2}f_{1}(s))),\pi_{1}(F_{2}(\pi_{1}f_{1}(s))(\pi_{2}f_{1}(s))),\\ d_{J}(\pi_{1}(F_{2}(\pi_{1}f_{1}(s))(\pi_{2}f_{1}(s))),\pi_{1}(F_{2}(\pi_{1}f_{2}(s))(\pi_{2}f_{2}(s))),\\ d_{S}(\pi_{2}(F_{1}(\pi_{1}f_{1}(s))(\pi_{2}f_{1}(s))),\pi_{2}(F_{2}(\pi_{1}f_{1}(s))(\pi_{2}f_{1}(s))),\\ d_{S}(\pi_{2}(F_{2}(\pi_{1}f_{1}(s))(\pi_{2}f_{1}(s))),\pi_{2}(F_{2}(\pi_{1}f_{2}(s))(\pi_{2}f_{2}(s)))\end{aligned}\right)\allowdisplaybreaks[1]$
		$\displaystyle=\sup_{s\in S}\max\left(\begin{aligned} d_{J}(\pi_{1}(F_{2}(\pi_{1}f_{1}(s))(\pi_{2}f_{1}(s))),\pi_{1}(F_{2}(\pi_{1}f_{2}(s))(\pi_{2}f_{2}(s))),\\ d_{S}(\pi_{2}(F_{2}(\pi_{1}f_{1}(s))(\pi_{2}f_{1}(s))),\pi_{2}(F_{2}(\pi_{1}f_{2}(s))(\pi_{2}f_{2}(s))),\\ d_{J}(\pi_{1}(F_{1}(\pi_{1}f_{1}(s))(\pi_{2}f_{1}(s))),\pi_{1}(F_{2}(\pi_{1}f_{1}(s))(\pi_{2}f_{1}(s))),\\ d_{S}(\pi_{2}(F_{1}(\pi_{1}f_{1}(s))(\pi_{2}f_{1}(s))),\pi_{2}(F_{2}(\pi_{1}f_{1}(s))(\pi_{2}f_{1}(s)))\end{aligned}\right)\allowdisplaybreaks[0]$
		$\displaystyle\leq\sup_{s\in S}\max\left(\begin{aligned} d_{I}(\pi_{1}(f_{1}(s)),\pi_{1}(f_{2}(s))),\\ d_{S}(\pi_{2}(f_{1}(s)),\pi_{2}(f_{2}(s))),\\ \ \sup_{x\in I}\sup_{s^{\prime}\in S}\max\left(\begin{aligned} d_{J}(\pi_{1}(F_{1}(x)(s^{\prime})),\pi_{1}(F_{2}(x)(s^{\prime})),\\ d_{S}(\pi_{2}(F_{1}(x)(s^{\prime})),\pi_{2}(F_{2}(x)(s^{\prime}))\end{aligned}\right)\end{aligned}\right)\allowdisplaybreaks[1]$
		$\displaystyle=\max\left(\begin{aligned} \sup_{s\in S}\max(d_{I}(\pi_{1}(f_{1}(s)),\pi_{1}(f_{2}(s))),d_{S}(\pi_{2}(f_{1}(s)),\pi_{2}(f_{2}(s)))),\\ \sup_{x\in I}\sup_{s^{\prime}\in S}\max\left(\begin{aligned} d_{J}(\pi_{1}(F_{1}(x)(s^{\prime})),\pi_{1}(F_{2}(x)(s^{\prime})),\\ d_{S}(\pi_{2}(F_{1}(x)(s^{\prime})),\pi_{2}(F_{2}(x)(s^{\prime}))\end{aligned}\right)\end{aligned}\right)\allowdisplaybreaks[0]$
		$\displaystyle=\max(d_{T_{S}I}(f_{1},f_{2}),\sup_{x\in I}d^{T_{S}J}(F_{1}(x),F_{2}(x)).$

We note here that the nonexpansivity of $F_{2}\colon(I,d_{I})\to(S,d_{S})\Rightarrow(S,d_{S})\times(J,d_{J})$ is equivalent to the one of its uncurrying $\overline{F_{2}}\colon(S,d_{S})\times(I,d_{I})\to(S,d_{S})\times(J,d_{J})$ . __relaxaxp@oldproof __relaxaxp@oldproof (Proof of Proposition 6) We first show the $\mathsf{Dist}_{0}{}$ -unit reflexivity of ${\mathsf{\Delta}}^{\mathsf{Dist}_{0}}$ . For $(x_{1},x_{2})\in\mathsf{Dist}_{0}(I,d_{I})$ (i.e. $d_{I}(x_{1},x_{2})=0$ ), we calculate

	$\displaystyle{\mathsf{\Delta}}^{\mathsf{Dist}_{0}}_{(I,d_{I})}(\eta_{I}(x_{1}),\eta_{I}(x_{2}))$	$\displaystyle=\sup_{d_{S}(s_{1},s_{2})=0}\max\left(d_{I}(\pi_{1}(x_{1},s_{2}),\pi_{1}(x_{2},s_{2})),d_{S}(\pi_{2}(x_{1},s_{1}),\pi_{2}(x_{2},s_{2})\right)$
		$\displaystyle=\sup_{d_{S}(s_{1},s_{2})=0}\max(d_{I}(x_{1},x_{2}),d_{S}(s_{1},s_{2}))=0.$

Next, we show the $\mathsf{Dist}_{0}{}$ -composability of ${\mathsf{\Delta}}^{\mathsf{Dist}_{0}}$ . For any $f_{1},f_{2}\in T_{S}(I,d_{I})$ and nonexpansive functions $F_{1},F_{2}\colon(I,d_{I})\to T_{S}(J,d_{J})$ , we compute

	$\displaystyle{\mathsf{\Delta}}^{\mathsf{Dist}_{0}}_{J}(F_{1}^{\sharp}(f_{1}),F_{1}^{\sharp}(f_{2}))$
		$\displaystyle=\sup_{d_{S}(s_{1},s_{2})=0}\max\left(\begin{aligned} d_{J}(\pi_{1}(F_{1}(\pi_{1}f_{1}(s_{1}))(\pi_{2}f_{1}(s_{1}))),\pi_{1}(F_{2}(\pi_{1}f_{2}(s_{2}))(\pi_{2}f_{2}(s_{2}))),\\ d_{S}(\pi_{2}(F_{1}(\pi_{1}f_{1}(s_{1}))(\pi_{2}f_{1}(s_{1}))),\pi_{2}(F_{2}(\pi_{1}f_{2}(s_{2}))(\pi_{2}f_{2}(s_{2})))\end{aligned}\right)\allowdisplaybreaks[0]$
		$\displaystyle\leq\sup_{d_{S}(s_{1},s_{2})=0}\max\left(\begin{aligned} d_{J}(\pi_{1}(F_{1}(\pi_{1}f_{1}(s_{1}))(\pi_{2}f_{1}(s_{1}))),\pi_{1}(F_{2}(\pi_{1}f_{1}(s_{1}))(\pi_{2}f_{1}(s_{1}))),\\ d_{J}(\pi_{1}(F_{2}(\pi_{1}f_{1}(s_{1}))(\pi_{2}f_{1}(s_{1}))),\pi_{1}(F_{2}(\pi_{1}f_{2}(s_{2}))(\pi_{2}f_{2}(s_{2}))),\\ d_{S}(\pi_{2}(F_{1}(\pi_{1}f_{1}(s_{1}))(\pi_{2}f_{1}(s_{1}))),\pi_{2}(F_{2}(\pi_{1}f_{1}(s_{1}))(\pi_{2}f_{1}(s_{1}))),\\ d_{S}(\pi_{2}(F_{2}(\pi_{1}f_{1}(s_{1}))(\pi_{2}f_{1}(s_{1}))),\pi_{2}(F_{2}(\pi_{1}f_{2}(s_{2}))(\pi_{2}f_{2}(s_{2})))\end{aligned}\right)\allowdisplaybreaks[1]$
		$\displaystyle=\sup_{d_{S}(s_{1},s_{2})=0}\max\left(\begin{aligned} d_{J}(\pi_{1}(F_{2}(\pi_{1}f_{1}(s_{1}))(\pi_{2}f_{1}(s_{1}))),\pi_{1}(F_{2}(\pi_{1}f_{2}(s_{2}))(\pi_{2}f_{2}(s_{2}))),\\ d_{S}(\pi_{2}(F_{2}(\pi_{1}f_{1}(s_{1}))(\pi_{2}f_{1}(s_{1}))),\pi_{2}(F_{2}(\pi_{1}f_{2}(s_{2}))(\pi_{2}f_{2}(s_{2}))),\\ d_{J}(\pi_{1}(F_{1}(\pi_{1}f_{1}(s_{1}))(\pi_{2}f_{1}(s_{1}))),\pi_{1}(F_{2}(\pi_{1}f_{1}(s_{1}))(\pi_{2}f_{1}(s_{1}))),\\ d_{S}(\pi_{2}(F_{1}(\pi_{1}f_{1}(s_{1}))(\pi_{2}f_{1}(s_{1}))),\pi_{2}(F_{2}(\pi_{1}f_{1}(s_{1}))(\pi_{2}f_{1}(s_{1})))\end{aligned}\right)\allowdisplaybreaks[0]$
		$\displaystyle\leq\sup_{d_{S}(s_{1},s_{2})=0}\max\left(\begin{aligned} d_{I}(\pi_{1}(f_{1}(s_{1})),\pi_{1}(f_{2}(s_{2}))),\\ d_{S}(\pi_{2}(f_{1}(s_{1})),\pi_{2}(f_{2}(s_{2}))),\\ \ \sup_{(x_{1},x_{2})\in\mathsf{Dist}_{0}(I,d_{I})}\sup_{d_{S}(s^{\prime}_{1},s^{\prime}_{2})=0}\max\left(\begin{aligned} d_{J}(\pi_{1}(F_{1}(x)(s^{\prime}_{1})),\pi_{1}(F_{2}(x)(s_{2}^{\prime})),\\ d_{S}(\pi_{2}(F_{1}(x)(s^{\prime}_{1})),\pi_{2}(F_{2}(x)(s^{\prime}_{2}))\end{aligned}\right)\end{aligned}\right)\allowdisplaybreaks[1]$
		$\displaystyle=\max\left(\begin{aligned} \sup_{d_{S}(s^{\prime}_{1},s^{\prime}_{2})=0}\max(d_{I}(\pi_{1}(f_{1}(s_{1})),\pi_{1}(f_{2}(s_{2}))),d_{S}(\pi_{2}(f_{1}(s_{1})),\pi_{2}(f_{2}(s_{2})))),\\ \sup_{(x_{1},x_{2})\in\mathsf{Dist}_{0}(I,d_{I})}\sup_{d_{S}(s^{\prime}_{1},s^{\prime}_{2})=0}\max\left(\begin{aligned} d_{J}(\pi_{1}(F_{1}(x_{1})(s^{\prime}_{1})),\pi_{1}(F_{2}(x_{2})(s^{\prime}_{2})),\\ d_{S}(\pi_{2}(F_{1}(x_{1})(s^{\prime}_{1})),\pi_{2}(F_{2}(x_{2})(s^{\prime}_{2}))\end{aligned}\right)\end{aligned}\right)\allowdisplaybreaks[0]$
		$\displaystyle=\max({\mathsf{\Delta}}^{\mathsf{Dist}_{0}}_{I}(f_{1},f_{2}),\sup_{(x_{1},x_{2})\in\mathsf{Dist}_{0}(I,d_{I})}{\mathsf{\Delta}}^{\mathsf{Dist}_{0}}_{J}(F_{1}(x),F_{2}(x)).$

This completes the proof. __relaxaxp@oldproof __relaxaxp@oldproof

(Proof of Proposition 7) The monotonicity of ${\mathsf{C}}({\mathsf{\Delta}},N)$ is obvious since $M=1$ .

We show the ${\color[rgb]{0,0,0}\mathrm{Eq}}$ -unit reflexivity of ${\mathsf{C}}({\mathsf{\Delta}},N)$ . For all $x\in UI$ , we have

$\displaystyle T\pi_{1}\mathbin{\bullet}(\eta^{T(N\times-)}_{I}\mathbin{\bullet}x)$	$\displaystyle=(T\pi_{1}\circ\eta^{T(N\times-)}_{I})\mathbin{\bullet}x$	$\displaystyle=(T\pi_{1}\circ T\eta^{(N\times-)}_{I}\circ\eta^{T}_{I})\mathbin{\bullet}x$
	$\displaystyle=(T(1_{N}\circ!_{I})\circ\eta^{T}_{I})\mathbin{\bullet}x$	$\displaystyle=(\eta^{T}\circ 1_{N}\circ!_{I})\mathbin{\bullet}x$
	$\displaystyle=\eta^{T}\mathbin{\bullet}((1_{N}\circ!_{I})\mathbin{\bullet}x)$	$\displaystyle=\eta^{T}\mathbin{\bullet}(1_{N}\mathbin{\bullet}(!_{I}\mathbin{\bullet}x))$
	$\displaystyle=\eta^{T}\mathbin{\bullet}1_{N}$

Hence,

	$\displaystyle{\mathsf{C}}({\mathsf{\Delta}},N)_{I}(\eta^{T(N\times-)}\mathbin{\bullet}x,\eta^{T(N\times-)}\mathbin{\bullet}x)$	$\displaystyle={\mathsf{C}}({\mathsf{\Delta}},N)_{I}(\eta^{T(N\times-)}\mathbin{\bullet}x,\eta^{T(N\times-)}\mathbin{\bullet}x)$
		$\displaystyle={\mathsf{\Delta}}_{N}(T\pi_{1}\mathbin{\bullet}(\eta^{T(N\times-)}\mathbin{\bullet}x),T\pi_{1}\mathbin{\bullet}(\eta^{T(N\times-)}\mathbin{\bullet}x)$
		$\displaystyle={\mathsf{\Delta}}_{N}(\eta^{T}\mathbin{\bullet}1_{N},\eta^{T}\mathbin{\bullet}1_{N})$
		$\displaystyle\leq 0_{\mathcal{Q}}.$

We next show the ${\color[rgb]{0,0,0}\mathrm{Eq}}$ -composability of ${\mathsf{C}}({\mathsf{\Delta}},N)$ . For any $f\colon I\to T(N\times I)$ , we define $h_{f}\colon N\times I\to T(N)$ by $h_{f}=T(\star)\circ\theta_{N,N}\circ(N\times(T\pi_{1}\circ f))$ . Then, we have $T\pi_{1}\mathbin{\bullet}f^{\sharp(T(N\times I))}\mathbin{\bullet}\nu=h_{f}^{\sharp T}\mathbin{\bullet}\nu$ for any $\nu\in U(T(N\times I))$ . First, for all $m,n\in UN$ , we have

$\displaystyle(T(\star)\circ(\eta_{N\times N})_{n})\mathbin{\bullet}m$	$\displaystyle=T(\star)\mathbin{\bullet}(\eta_{N\times N}\mathbin{\bullet}\langle n,m\rangle)$	$\displaystyle=(T(\star)\circ\eta_{N\times N})\mathbin{\bullet}\langle n,m\rangle)$
	$\displaystyle=(\eta_{N}\circ\star)\mathbin{\bullet}\langle n,m\rangle)$	$\displaystyle=\eta_{N}\mathbin{\bullet}(\star\mathbin{\bullet}\langle n,m\rangle)$
	$\displaystyle=\eta_{N}\mathbin{\bullet}(\star_{n}\mathbin{\bullet}m)$	$\displaystyle=(\eta_{N}\circ\star_{n})\mathbin{\bullet}m.$

From this and the equality (1), we can calculate as follows:

$\displaystyle h_{f}\mathbin{\bullet}\langle n,i\rangle$
	$\displaystyle=(T(\star)\circ\theta_{N,N}\circ(N\times(T\pi_{1}\circ f)))\mathbin{\bullet}\langle n,i\rangle$	$\displaystyle=(T(\star)\circ\theta_{N,N})\mathbin{\bullet}((N\times(T\pi_{1}\circ f))\mathbin{\bullet}\langle n,i\rangle)$
	$\displaystyle=(T(\star)\circ\theta_{N,N})\mathbin{\bullet}(U(N\times(T\pi_{1}\circ f))(n,i))$	$\displaystyle=(T(\star)\circ\theta_{N,N})\mathbin{\bullet}((U(N)\times U(T\pi_{1}\circ f))(n,i))$
	$\displaystyle=(T(\star)\circ\theta_{N,N})\mathbin{\bullet}\langle U(N)(n),U(T\pi_{1}\circ f)(i)\rangle$	$\displaystyle=(T(\star)\circ\theta_{N,N})\mathbin{\bullet}\langle n,(T\pi_{1}\circ f)\mathbin{\bullet}i\rangle$
	$\displaystyle=T(\star)\mathbin{\bullet}(\theta_{N,N}\mathbin{\bullet}\langle n,(T\pi_{1}\circ f)\mathbin{\bullet}i\rangle)$	$\displaystyle=T(\star)\mathbin{\bullet}((\theta_{N,N})_{n}\mathbin{\bullet}((T\pi_{1}\circ f)\mathbin{\bullet}i))$
	$\displaystyle=T(\star)\mathbin{\bullet}(((\eta_{N\times N})_{n})^{\sharp}\mathbin{\bullet}((T\pi_{1}\circ f)\mathbin{\bullet}i))$	$\displaystyle=(T(\star)\circ((\eta_{N\times N})_{n})^{\sharp})\mathbin{\bullet}((T\pi_{1}\circ f)\mathbin{\bullet}i)$
	$\displaystyle=(T(\star)\circ(\eta_{N\times N})_{n})^{\sharp}\mathbin{\bullet}((T\pi_{1}\circ f)\mathbin{\bullet}i)$	$\displaystyle=(\eta_{N}\circ(\star_{n}))^{\sharp}\mathbin{\bullet}((T\pi_{1}\circ f)\mathbin{\bullet}i).$

From the assumption ${\mathsf{\Delta}}_{N\times I}(c_{1},c_{2})\leq{\mathsf{C}}({\mathsf{\Delta}},N)_{I}(c_{1},c_{2})$ , the ${\color[rgb]{0,0,0}\mathrm{Eq}}$ -unit-reflexivity and ${\color[rgb]{0,0,0}\mathrm{Eq}}$ -composability of the original divergence ${\mathsf{\Delta}}$ , we obtain the ${\color[rgb]{0,0,0}\mathrm{Eq}}$ -composability of ${\mathsf{C}}({\mathsf{\Delta}},N)$ as follows:

	$\displaystyle{\mathsf{C}}({\mathsf{\Delta}},N)_{J}(f_{1}^{\sharp(T(N\times I))}\mathbin{\bullet}c_{1},f_{2}^{\sharp(T(N\times I))}\mathbin{\bullet}c_{2})$
		$\displaystyle={\mathsf{\Delta}}_{N}(T\pi_{1}\mathbin{\bullet}f_{1}^{\sharp(T(N\times I))}\mathbin{\bullet}c_{1},T\pi_{1}\mathbin{\bullet}f_{2}^{\sharp(T(N\times I))}\mathbin{\bullet}c_{2})$
		$\displaystyle={\mathsf{\Delta}}_{N}(h_{f_{1}}^{\sharp T}\mathbin{\bullet}c_{1},h_{f_{2}}^{\sharp T}\mathbin{\bullet}c_{2})$
		$\displaystyle\leq{\mathsf{\Delta}}_{N\times I}(c_{1},c_{2})+\sup_{\langle n,i\rangle\in U(N\times I)}{\mathsf{\Delta}}_{N}(h_{f_{1}}\mathbin{\bullet}\langle n,i\rangle,h_{f_{2}}\mathbin{\bullet}\langle n,i\rangle)$
		$\displaystyle={\mathsf{\Delta}}_{N\times I}(c_{1},c_{2})$
		$\displaystyle\qquad+\sup_{\langle n,i\rangle\in U(N\times I)}{\mathsf{\Delta}}_{N}((\eta_{N}\circ(\star)_{n})^{\sharp T}\mathbin{\bullet}((T\pi_{1}\circ f)\mathbin{\bullet}i),(\eta_{N}\circ(\star)_{n})^{\sharp T}\mathbin{\bullet}((T\pi_{1}\circ f)\mathbin{\bullet}i))$
		$\displaystyle\leq{\mathsf{\Delta}}_{N\times I}(c_{1},c_{2})$
		$\displaystyle\qquad+\sup_{\langle n,i\rangle\in U(N\times I)}\left(\begin{aligned} &{\mathsf{\Delta}}_{N}((T\pi_{1}\circ f)\mathbin{\bullet}i,(T\pi_{1}\circ f)\mathbin{\bullet}i)\\ &\qquad+\sup_{m\in UN}{\mathsf{\Delta}}_{N}(\eta_{N}\circ(\star)_{n})\mathbin{\bullet}m,(\eta_{N}\circ(\star)_{n})\mathbin{\bullet}m)\end{aligned}\right)$
		$\displaystyle\leq{\mathsf{\Delta}}_{N\times I}(c_{1},c_{2})+\sup_{\langle n,i\rangle\in U(N\times I)}{\mathsf{\Delta}}_{N}((T\pi_{1}\circ f)\mathbin{\bullet}i,(T\pi_{1}\circ f)\mathbin{\bullet}i)$
		$\displaystyle={\mathsf{\Delta}}_{N\times I}(c_{1},c_{2})+\sup_{i\in UI}{\mathsf{\Delta}}_{N}((T\pi_{1}\circ f_{1})\mathbin{\bullet}i,(T\pi_{1}\circ f_{2})\mathbin{\bullet}i)$
		$\displaystyle\leq{\mathsf{C}}({\mathsf{\Delta}},N)_{I}(c_{1},c_{2})+\sup_{i\in UI}{\mathsf{C}}({\mathsf{\Delta}},N)_{J}(f_{1}\mathbin{\bullet}i,f_{2}\mathbin{\bullet}i).$

This completes the proof. __relaxaxp@oldproof __relaxaxp@oldproof (Proof of Proposition 8)

We consider a preorder $\sqsubseteq$ on a monad $T$ . We define the $\mathcal{B}$ -divergence ${\mathsf{\Delta}}^{\sqsubseteq}$ on $TI$ by

{\mathsf{\Delta}}^{\sqsubseteq}_{I}(c_{1},c_{2})\triangleq\begin{cases}0&c_{1}\not\sqsubseteq_{I}c_{2}\\ 1&c_{1}\sqsubseteq_{I}c_{2}\end{cases}

Each $\tilde{\mathsf{\Delta}}(1)I$ is a preorder because $\tilde{\mathsf{\Delta}}(1)I={\sqsubseteq_{I}}$ holds for each $I$ .

The ${\color[rgb]{0,0,0}\mathrm{Eq}}$ -unit reflexivity of ${\mathsf{\Delta}}^{\sqsubseteq}$ is derived from the reflexivity of $\sqsubseteq$ . For all set $I$ and $c\in TI$ ,

({\mathsf{\Delta}}^{\sqsubseteq}_{I}(c,c)\leq 1)\iff(c\sqsubseteq_{I}c).

Since $\sqsubseteq$ is a preorder on $T$ , for all set $I,J$ , $c_{1},c_{2}\in TI$ and $f,g\colon I\to TJ$ ,

	$\displaystyle({\mathsf{\Delta}}^{\sqsubseteq}_{I}(c_{1},c_{2})\times\sup_{x\in I}{\mathsf{\Delta}}^{\sqsubseteq}_{J}(f(x),g(x)))=1$
	$\displaystyle\iff({\mathsf{\Delta}}^{\sqsubseteq}_{I}(c_{1},c_{2})=1)\land(\sup_{x\in I}{\mathsf{\Delta}}^{\sqsubseteq}_{J}(f(x),g(x))=1)$
	$\displaystyle\iff(c_{1}\sqsubseteq_{I}c_{2})\land(\forall{x\in I}.~{}f(x)\sqsubseteq_{J}g(x))$
	$\displaystyle\implies(f^{\sharp}(c_{1})\sqsubseteq_{J}f^{\sharp}(c_{2}))\land(f^{\sharp}(c_{2})\sqsubseteq_{J}g^{\sharp}(c_{2}))$
	$\displaystyle\implies(f^{\sharp}(c_{1})\sqsubseteq_{J}g^{\sharp}(c_{2}))$
	$\displaystyle\iff({\mathsf{\Delta}}^{\sqsubseteq}_{J}(f^{\sharp}(c_{1}),g^{\sharp}(c_{2}))=1)$

Hence, we have the ${\color[rgb]{0,0,0}\mathrm{Eq}}$ -composability

\displaystyle{\mathsf{\Delta}}^{\sqsubseteq}_{J}(f^{\sharp}(c_{1}),g^{\sharp}(c_{2}))\leq{\mathsf{\Delta}}^{\sqsubseteq}_{I}(c_{1},c_{2})\times\sup_{x\in I}{\mathsf{\Delta}}^{\sqsubseteq}_{J}(f(x),g(x)).

Conversely, we consider an ${\color[rgb]{0,0,0}\mathrm{Eq}}$ -relative $\mathcal{B}$ -divergence ${\mathsf{\Delta}}$ on $T$ such that each $\tilde{\mathsf{\Delta}}(1)I$ is a preorder. We show that the family $\sqsubseteq^{\mathsf{\Delta}}=\{\sqsubseteq^{\mathsf{\Delta}}_{I}\}_{I\in{\bf Set}}$ defined by ${\sqsubseteq^{\mathsf{\Delta}}_{I}}\triangleq\tilde{\mathsf{\Delta}}(1)I$ forms a preorder on monad $T$ .

Each component $\sqsubseteq^{\mathsf{\Delta}}_{I}$ of $\sqsubseteq^{\mathsf{\Delta}}$ at set $I$ is a preorder on the set $TI$ . We here note that the divergence ${\mathsf{\Delta}}$ must be reflexive (i.e. ${\mathsf{\Delta}}_{I}(c,c)\leq 1$ for all $I\in{\bf Set},c\in TI$ ) because of the reflexivity of $\sqsubseteq^{\mathsf{\Delta}}_{I}$ :

({\mathsf{\Delta}}_{I}(c,c)\leq 1)\iff(c\sqsubseteq^{\mathsf{\Delta}}_{I}c),\quad\text{ for all }I\in{\bf Set},c\in TI.

From the reflexivity and ${\color[rgb]{0,0,0}\mathrm{Eq}}$ -composability of ${\mathsf{\Delta}}$ , we have for all $c_{1},c_{2},c\in TI$ and $f,g\colon I\to TJ$ ,

	$\displaystyle\forall{c_{1},c_{2}\in TI,f\colon I\to TJ}~{}.~{}$	$\displaystyle{\mathsf{\Delta}}_{J}(f^{\sharp}(c_{1}),f^{\sharp}(c_{2}))\leq{\mathsf{\Delta}}_{I}(c_{1},c_{2}),$		(26)
	$\displaystyle\forall{c\in TI,f,g\colon I\to TJ}~{}.~{}$	$\displaystyle{\mathsf{\Delta}}_{J}(f^{\sharp}(c),g^{\sharp}(c))\leq\sup_{x\in I}{\mathsf{\Delta}}_{J}(f(x),g(x)).$		(27)

They are equivalent to the substitutivity and congruence of $\sqsubseteq^{\mathsf{\Delta}}$ respectively:

	$\displaystyle(\ref{divergence_premonad_subst})$	$\displaystyle\iff\forall{c_{1},c_{2}\in TI,f\colon I\to TJ}~{}.~{}(c_{1}\sqsubseteq^{\mathsf{\Delta}}_{I}c_{2}\implies f^{\sharp}(c_{1})\sqsubseteq^{\mathsf{\Delta}}_{J}f^{\sharp}(c_{2})),$
	$\displaystyle(\ref{divergence_premonad_congr})$	$\displaystyle\iff\forall{c\in TI,f,g\colon I\to TJ}~{}.~{}(\forall{x\in I}.~{}f(x)\sqsubseteq^{\mathsf{\Delta}}_{J}g(x)\implies f^{\sharp}(c)\sqsubseteq^{\mathsf{\Delta}}_{J}g^{\sharp}(c)).$

Finally, the above conversions ${\mathsf{\Delta}}^{(-)}$ and $\sqsubseteq^{(-)}$ are mutually inverse:

	$\displaystyle{\mathsf{\Delta}}^{\sqsubseteq^{{\mathsf{\Delta}}^{\prime}}}_{I}(c_{1},c_{2})\leq 1\iff c_{1}\sqsubseteq^{{\mathsf{\Delta}}^{\prime}}_{I}c_{2}\iff{\mathsf{\Delta}}^{\prime}_{I}(c_{1},c_{2})\leq 1,$
	$\displaystyle c_{1}\sqsubseteq^{{\mathsf{\Delta}}^{\sqsubseteq^{\prime}}}_{I}c_{2}\iff{\mathsf{\Delta}}^{\sqsubseteq^{\prime}}_{I}(c_{1},c_{2})\leq 1\iff c_{1}\sqsubseteq^{\prime}_{I}c_{2}.$

This completes the proof. __relaxaxp@oldproof __relaxaxp@oldproof (Proof of Theorem 2) First, it is easy to see that the inequality (3) is equivalent to ${\mathsf{\Delta}}$ satisfying $E$ -unit reflexivity.

We next show that the inequality (4) is equivalent to ${\mathsf{\Delta}}$ satisfying $E$ -composability.

(only if) Since $U1=\{{\rm id}_{1}\}$ , we have $R_{E1}=\{({\rm id}_{1},{\rm id}_{1})\}$ . Therefore it holds $d_{1,J}(c_{1},c_{2})={\mathsf{\Delta}}_{J}(c_{1},c_{2})$ . By letting $I=1$ in the inequality (4), we obtain the $E$ -composability:

			$\displaystyle d_{1,K}(f_{1}\circ_{\mathbb{C}_{T}}c_{1},f_{2}\circ_{\mathbb{C}_{T}}c_{2})\leq d_{J,K}(f_{1},f_{2})+d_{1,J}(c_{1},c_{2})$
		$\displaystyle\iff$	$\displaystyle{\mathsf{\Delta}}_{K}(f_{1}^{\sharp}\circ c_{1},f_{2}^{\sharp}\circ c_{2})\leq\sup_{(x_{1},x_{2})\in EI}{\mathsf{\Delta}}_{K}(f_{1}\mathbin{\bullet}x_{1},f_{2}\mathbin{\bullet}x_{2})+{\mathsf{\Delta}}_{J}(c_{1},c_{2}).$

(if) From the $E$ -composability, for any $f_{1},f_{2}:I\to TJ$ and $g_{1},g_{2}:J\to TK$ and $(x_{1},x_{2})\in EI$ , we have

{\mathsf{\Delta}}_{K}(g_{1}^{\sharp}\mathbin{\bullet}(f_{1}\mathbin{\bullet}x_{1}),g_{2}^{\sharp}\mathbin{\bullet}(f_{2}\mathbin{\bullet}x_{2}))\leq d_{J,K}(g_{1},g_{2})+{\mathsf{\Delta}}_{J}(f_{1}\mathbin{\bullet}x_{1},f_{2}\mathbin{\bullet}x_{2}).

Next, for any $(x_{1},x_{2})\in EI$ , we have ${\mathsf{\Delta}}_{J}(f_{1}\mathbin{\bullet}x_{1},f_{2}\mathbin{\bullet}x_{2})\leq d_{I,J}(f_{1},f_{2})$ . Thus by monotonicity of $(+)$ we have

{\mathsf{\Delta}}_{K}(g_{1}^{\sharp}\mathbin{\bullet}f_{1}\mathbin{\bullet}x_{1},g_{2}^{\sharp}\mathbin{\bullet}f_{2}\mathbin{\bullet}x_{2})\leq d_{J,K}(g_{1},g_{2})+d_{I,J}(f_{1},f_{2}).

By discharging $(x_{1},x_{2})\in EI$ , we conclude

d_{I,K}(g_{1}^{\sharp}\circ f_{1},g_{2}^{\sharp}\circ f_{2})\leq d_{J,K}(g_{1},g_{2})+d_{I,J}(f_{1},f_{2}).

__relaxaxp@oldproof __relaxaxp@oldproof (Proof of Theorem 4) $[{\mathsf{\Delta}}]$ is a graded variant of codensity lifting performed along the fibration $V_{\mathcal{Q},\mathbb{C}}:{\bf Div}_{\mathcal{Q}}({\mathbb{C}})\to{\mathbb{C}}$ ([33]; see also Definition 15). Proving that it is a graded lifting of $T$ is routine. We show ${\mathsf{\Delta}}^{m}_{I}=[{\mathsf{\Delta}}]m(E^{\prime}I)$ . The direction $[{\mathsf{\Delta}}]m(E^{\prime}I)\leq{\mathsf{\Delta}}^{m}_{I}$ is easy. We show the converse. From the composability of ${\mathsf{\Delta}}$ , for any $c_{1},c_{2}\in U(TI)$ , $J\in\mathbb{C}$ , $n\in M$ and $f\in{\bf Div}_{\mathcal{Q}}({\mathbb{C}})(E^{\prime}I,{\mathsf{\Delta}}^{n}_{J})$ , we have

{\mathsf{\Delta}}^{m\cdot n}_{J}(f^{\sharp}\mathbin{\bullet}c_{1},f^{\sharp}\mathbin{\bullet}c_{2})\leq{\mathsf{\Delta}}^{m}_{I}(c_{1},c_{2})+\sup_{(x_{1},x_{2})\in EI}{\mathsf{\Delta}}^{n}_{J}(f\mathbin{\bullet}x_{1},f\mathbin{\bullet}x_{2}).

Next, the nonexpansivity of $f$ is equivalent to

\sup_{(x_{1},x_{2})\in EI}{\mathsf{\Delta}}^{n}_{J}(f\mathbin{\bullet}x_{1},f\mathbin{\bullet}x_{2})\leq 0.

Therefore we conclude ${\mathsf{\Delta}}^{m\cdot n}_{J}(f^{\sharp}\mathbin{\bullet}c_{1},f^{\sharp}\mathbin{\bullet}c_{2})\leq{\mathsf{\Delta}}^{m}_{I}(c_{1},c_{2})$ . By discharging $J,n,f$ , we conclude the inequality $[{\mathsf{\Delta}}]m(EI)\leq{\mathsf{\Delta}}^{m}_{I}$ . __relaxaxp@oldproof __relaxaxp@oldproof (Proof of Theorem 5) Let ${\mathsf{\Delta}}\in{\bf Div}(T,E,M,\mathcal{Q})$ . We have already shown that $[{\mathsf{\Delta}}]$ is an $M$ -graded $\mathcal{Q}$ -divergence lifting of $T$ . We show that $[{\mathsf{\Delta}}]$ is $E$ -strong (this proof does not need the closedness of $\mathbb{C}$ ). Let $X\triangleq(I,d)\in{\bf Div}_{\mathcal{Q}}({\mathbb{C}})$ and $J\in\mathbb{C}$ be objects. We first rewrite the goal:

	$\displaystyle\theta\in{\bf Div}_{\mathcal{Q}}({\mathbb{C}})(X\otimes[{\mathsf{\Delta}}]m(E^{\prime}J),[{\mathsf{\Delta}}]m(X\otimes E^{\prime}J))$
		$\displaystyle\iff\left(\begin{aligned} &\forall{x_{1},x_{2}\in UI,c_{1},c_{2}\in U(TJ)}~{}.~{}\\ &\qquad d_{[{\mathsf{\Delta}}]m(X\otimes E^{\prime}J)}(\theta\mathbin{\bullet}\langle x_{1},c_{1}\rangle,\theta\mathbin{\bullet}\langle x_{2},c_{2}\rangle)\leq d(x_{1},x_{2})+d_{[{\mathsf{\Delta}}]m(E^{\prime}J)}(c_{1},c_{2})\end{aligned}\right)$
		$\displaystyle\iff\left(\begin{aligned} &\forall{x_{1},x_{2}\in UI,c_{1},c_{2}\in U(TJ),K\in\mathbb{C},n\in M,f\in{\bf Div}_{\mathcal{Q}}({\mathbb{C}})(X\otimes E^{\prime}J,{\mathsf{\Delta}}^{n}_{K})}~{}.~{}\\ &\qquad{\mathsf{\Delta}}^{m\cdot n}_{K}(f^{\sharp}\mathbin{\bullet}\theta\mathbin{\bullet}\langle x_{1},c_{1}\rangle,f^{\sharp}\mathbin{\bullet}\theta\mathbin{\bullet}\langle x_{2},c_{2}\rangle)\leq d(x_{1},x_{2})+d_{[{\mathsf{\Delta}}]m(E^{\prime}J)}(c_{1},c_{2})\end{aligned}\right)$
		$\displaystyle\mathbin{\stackrel{{\scriptstyle{\dagger}}}{{\iff}}}\left(\begin{aligned} &\forall{x_{1},x_{2}\in UI,c_{1},c_{2}\in U(TJ),K\in\mathbb{C},n\in M,f\in{\bf Div}_{\mathcal{Q}}({\mathbb{C}})(X\otimes E^{\prime}J,{\mathsf{\Delta}}^{n}_{K})}~{}.~{}\\ &\qquad{\mathsf{\Delta}}^{m\cdot n}_{K}((f_{x_{1}})^{\sharp}\mathbin{\bullet}c_{1},(f_{x_{2}})^{\sharp}\mathbin{\bullet}c_{2})\leq d(x_{1},x_{2})+d_{[{\mathsf{\Delta}}]}^{m}(c_{1},c_{2})\end{aligned}\right).$

In the step $\mathbin{\stackrel{{\scriptstyle{\dagger}}}{{\iff}}}$ , we used the equality (1). To show this goal, we proceed as follows. Let $x_{1},x_{2}\in UI,c_{1},c_{2}\in U(TJ),K\in\mathbb{C},n\in M$ and $f\in{\bf Div}_{\mathcal{Q}}({\mathbb{C}})(X\otimes E^{\prime}J,{\mathsf{\Delta}}^{n}_{K})$ . First, from the composability of ${\mathsf{\Delta}}$ , we obtain

{\mathsf{\Delta}}^{m\cdot n}_{K}((f_{x_{1}})^{\sharp}\mathbin{\bullet}c_{1},(f_{x_{2}})^{\sharp}\mathbin{\bullet}c_{2})\leq{\mathsf{\Delta}}_{J}^{m}(c_{1},c_{2})+\sup_{(y_{1},y_{2})\in EJ}{\mathsf{\Delta}}^{n}_{K}(f_{x_{1}}\mathbin{\bullet}y_{1},f_{x_{2}}\mathbin{\bullet}y_{2}).

We look at summands of the right hand side. First, we easily obtain ${\mathsf{\Delta}}^{m}_{J}(c_{1},c_{2})\leq d_{[{\mathsf{\Delta}}]m(E^{\prime}J)}(c_{1},c_{2})$ . Next, from the nonexpansivity of $f$ , for any $x_{1},x_{2}\in UI,y_{1},y_{2}\in UJ$ , we have

{\mathsf{\Delta}}^{n}_{K}(f_{x_{1}}\mathbin{\bullet}y_{1},f_{x_{2}}\mathbin{\bullet}y_{2})={\mathsf{\Delta}}^{n}_{K}(f\mathbin{\bullet}\langle x_{1},y_{1}\rangle,f\mathbin{\bullet}\langle x_{2},y_{2}\rangle)\leq d(x_{1},x_{2})+E^{\prime}J(y_{1},y_{2}).

Because $x+\top=\top$ , we obtain

\forall{x_{1},x_{2}\in UI}~{}.~{}\sup_{(y_{1},y_{2})\in EJ}{\mathsf{\Delta}}^{n}_{K}(f_{x_{1}}\mathbin{\bullet}y_{1},f_{x_{2}}\mathbin{\bullet}y_{2})\leq d(x_{1},x_{2}).

Therefore we obtain the goal:

{\mathsf{\Delta}}^{m\cdot n}_{K}((f_{x_{1}})^{\sharp}\mathbin{\bullet}c_{1},(f_{x_{2}})^{\sharp}\mathbin{\bullet}c_{2})\leq d_{[{\mathsf{\Delta}}]m(E^{\prime}J)}(c_{1},c_{2})+d(x_{1},x_{2})=d(x_{1},x_{2})+d_{[{\mathsf{\Delta}}]m(E^{\prime}J)}(c_{1},c_{2}).

Next, let $\dot{T}\in{\bf SGDLift}(T,E,M,\mathcal{Q})$ . We show that $\langle\dot{T}\rangle\in{\bf Div}(T,E,M,\mathcal{Q})$ .

The unit law of $\dot{T}$ immediately entails

\eta_{I}\in{\bf Div}_{\mathcal{Q}}({\mathbb{C}})(E^{\prime}I,\dot{T}1(E^{\prime}I)).

Next, under the assumption on $(\mathbb{C},T)$ and $\mathcal{Q}$ , in ${\bf Div}_{\mathcal{Q}}({\mathbb{C}})$ the functor $(-)\otimes E^{\prime}I$ has a right adjoint $E^{\prime}I\multimap(-)$ above the adjunction $(-)\times I\dashv I\Rightarrow(-)$ (Lemma 1). Therefore each component of the internal Kleisli extension morphism $kl$ given in (6) are nonexpansive morphisms in ${\bf Div}_{\mathcal{Q}}({\mathbb{C}})$ :

Therefore we conclude

\operatorname{kl}\in{\bf Div}_{\mathcal{Q}}({\mathbb{C}})(\langle\dot{T}\rangle m(E^{\prime}I)\otimes(E^{\prime}I\multimap\langle\dot{T}\rangle n(E^{\prime}J)),\langle\dot{T}\rangle(m\cdot n)(E^{\prime}J)).

We also easily have monotonicity: $\langle\dot{T}\rangle m(E^{\prime}I)\leq\langle\dot{T}\rangle n(E^{\prime}I)$ for $m\leq n$ by condition 1 of graded divergence lifting. We thus conclude that $\langle\dot{T}\rangle mE^{\prime}I\in{\bf Div}(T,E,M,\mathcal{Q})$ .

We finally show $\dot{T}\preceq[\langle\dot{T}\rangle]$ . Let $c_{1},c_{2}\in U(TI)$ . We show

\sup_{n\in M,J\in\mathbb{C},f\in{\bf Div}_{\mathcal{Q}}({\mathbb{C}})(X,\dot{T}n(E^{\prime}J))}d_{\dot{T}(m\cdot n)(E^{\prime}J)}(f^{\sharp}(c_{1}),f^{\sharp}(c_{2}))\leq d_{\dot{T}mX}(c_{1},c_{2}).

(28)

Let $n\in M,J\in\mathbb{C},f\in{\bf Div}_{\mathcal{Q}}({\mathbb{C}})(X,\dot{T}n(E^{\prime}J))$ . Since $\dot{T}$ is an $M$ -graded $\mathcal{Q}$ -divergence lifting of $T$ , we obtain

f^{\sharp}\in{\bf Div}_{\mathcal{Q}}({\mathbb{C}})(\dot{T}mX,\dot{T}(m\cdot n)(E^{\prime}J)).

This implies the inequality $d_{\dot{T}(m\cdot n)(E^{\prime}J)}(f^{\sharp}(c_{1}),f^{\sharp}(c_{2}))\leq d_{\dot{T}mX}(c_{1},c_{2})$ in $\mathcal{Q}$ . By taking the sup for $n,J,f$ , we obtain the inequality (28). __relaxaxp@oldproof __relaxaxp@oldproof (Proof of Proposition 9) We write $|1|=\{\ast\}$ . We first check the measurable isomorphism $G_{s}1\cong[0,1]$ . The measurable functions $\mathrm{ev}_{\{\ast\}}\colon G_{s}1\to[0,1]$ ( $\nu\mapsto\nu(\ast)$ ) and the function $H\colon|[0,1]|\to|G_{s}1|$ ( $r\mapsto r\cdot\mathbf{d}_{\ast}$ ) are mutually inverse. For any (Borel-)measurable $U\in\Sigma_{[0,1]}$ , we have $H^{-1}(\mathrm{ev}_{\{\ast\}}^{-1}(U))=U$ and $H^{-1}(\mathrm{ev}_{\emptyset}^{-1}(U))=[0,1]$ if $0\in U$ and $H^{-1}(\mathrm{ev}_{\emptyset}^{-1}(U))=\emptyset$ otherwise. Since all generators of $\Sigma_{G_{s}1}$ are $\mathrm{ev}_{\{\ast\}}^{-1}(U)$ and $\mathrm{ev}_{\emptyset}^{-1}(U)$ where $U\in\Sigma_{[0,1]}$ , we conclude the measurability of $H$ . Thus, $f\colon I\to[0,1]$ corresponds bijectively to $H\circ f\colon I\to G_{s}1$ , and

\int_{I}fd\nu_{1}=\int_{I}\mathrm{ev}_{\{\ast\}}\circ H\circ fd\nu_{1}=((H\circ f)^{\sharp}\nu_{1})(\{\ast\}).

We then obtain, for all $I\in{\bf Meas}$ , $\nu_{1},\nu_{2}\in G_{s}I$

	$\displaystyle\mathsf{DP}_{I}^{\varepsilon}(\nu_{1},\nu_{2})$	$\displaystyle=\sup_{S\in\Sigma_{I}}(\nu_{1}(S)-\exp(\varepsilon)\nu_{2}(S))$
		$\displaystyle\leq\sup_{f_{S}\colon I\to[0,1]}(\int_{I}f_{S}d\nu_{1}-\exp(\varepsilon)\int_{I}f_{S}d\nu_{2})$
		$\displaystyle=\sup_{f_{S}\colon I\to G_{s}[0,1]}(((H\circ f_{S})^{\sharp}\nu_{1})(\ast)-\exp(\varepsilon)((H\circ f_{S})^{\sharp}\nu_{2})(\ast))$
		$\displaystyle\leq\sup_{f_{S}\colon I\to G_{s}[0,1]}\sup_{S^{\prime}\in\Sigma_{1}(\iff S^{\prime}=\{\ast\},\emptyset)}((H\circ f_{S})^{\sharp}\nu_{1})(S^{\prime})-\exp(\varepsilon)((H\circ f_{S})^{\sharp}\nu_{2})(S^{\prime}))$
		$\displaystyle=\sup_{f_{S}\colon I\to G_{s}[0,1]}\mathsf{DP}_{1}^{\varepsilon}((H\circ f_{S})^{\sharp}\nu_{1},(H\circ f_{S})^{\sharp}\nu_{2})$
		$\displaystyle=\sup_{g\colon I\to G_{s}1}\mathsf{DP}_{1}^{\varepsilon}(g^{\sharp}\nu_{1},g^{\sharp}\nu_{2})$
		$\displaystyle\leq\mathsf{DP}_{I}^{\varepsilon}(\nu_{1},\nu_{2}).$

The first inequality is given by $\nu(S)=\int_{I}\chi_{S}d\nu$ where $\chi_{S}\colon I\to[0,1]$ is the indicator function of $S$ defined by $\chi_{S}(x)=1$ when $x\in S$ and $\chi_{S}(x)=0$ otherwise. The last inequality is given by the data-processing inequality which is given by the reflexivity and ${\color[rgb]{0,0,0}\mathrm{Eq}}{}$ -composability of $\mathsf{DP}$ . __relaxaxp@oldproof __relaxaxp@oldproof (Proof of Proposition 10) We first prove that $\mathsf{TV}$ is not $1$ -generated. We write $|2|=\{0,1\}$ . We define $\nu_{1},\nu_{2}\in G_{s}2$ by

\nu_{1}=\frac{1}{2}\cdot\mathbf{d}_{0}+\frac{1}{2}\cdot\mathbf{d}_{1},\qquad\nu_{2}=\frac{1}{3}\cdot\mathbf{d}_{0}+\frac{2}{3}\cdot\mathbf{d}_{1}.

Then the total variation distance between them is calculated by

\mathsf{TV}_{2}(\nu_{1},\nu_{2})=\frac{1}{2}\left(\left|\frac{1}{2}-\frac{1}{3}\right|+\left|\frac{1}{2}-\frac{2}{3}\right|\right)=\frac{1}{6}.

On the other hand, for any $f\colon 2\to G_{s}1$ , we have

	$\displaystyle\mathsf{TV}_{1}(f^{\sharp}(\nu_{1}),f^{\sharp}(\nu_{2}))$	$\displaystyle=\frac{1}{2}\left\|\frac{1}{2}f(0)+\frac{1}{2}f(1)-\frac{1}{3}f(0)-\frac{2}{3}f(1)\right\|$
		$\displaystyle=\frac{1}{2}\left\|\frac{1}{6}f(0)-\frac{1}{6}f(1)\right\|$
		$\displaystyle=\frac{1}{12}\left\|f(0)-f(1)\right\|$
		$\displaystyle\leq\frac{1}{12}.$

This implies that $\mathsf{TV}$ is not $1$ -generated.

Next, we prove that $\mathsf{TV}$ is $2$ -generated. From the data-processing inequality $\mathsf{TV}$ which is given by the reflexivity and ${\color[rgb]{0,0,0}\mathrm{Eq}}{}$ -composability of $\mathsf{TV}$ , we obtain for any $\nu_{1},\nu_{2}\in G_{s}I$ ,

\mathsf{TV}_{I}(\nu_{1},\nu_{2})\geq\sup_{g\colon I\to G_{s}2}\mathsf{TV}_{2}(g^{\sharp}\nu_{1},g^{\sharp}\nu_{2}).

We show that the above inequality becomes the equality for some $g$ .

We fix $\nu_{1},\nu_{2}\in G_{s}I$ , a base measure $\mu$ over $I$ satisfying the absolute continuity $\nu_{1},\nu_{2}\ll\mu$ and the Radon-Nikodym derivatives (density functions) $\frac{d\nu_{1}}{d\mu},\frac{d\nu_{2}}{d\mu}$ of $\nu_{1},\nu_{2}$ with respect to $\mu$ respectively.

Let $A=(\frac{d\nu_{1}}{d\mu}-\frac{d\nu_{2}}{d\mu})^{-1}([0,\infty))$ and $B=I\setminus A$ . We define $g\colon I\to G_{s}2$ by $g(x)=\mathbf{d}_{0}$ if $x\in B$ and $g(x)=\mathbf{d}_{1}$ otherwise. Then for any $\nu\in G_{s}I$ we have

(g^{\sharp}\nu)(\{0\})=\int_{I}g(-)(\{0\})d\nu=\int_{A}g(-)(\{0\})d\nu+\int_{B}g(-)(\{0\})d\nu=\int_{A}1d\nu+\int_{B}0d\nu=\nu(A).

Similarly we have $(g^{\sharp}\nu)(\{1\})=\nu(B)$ . Therefore, we obtain

	$\displaystyle\frac{1}{2}\mathsf{TV}_{I}(\mu_{1},\mu_{2})$	$\displaystyle=\frac{1}{2}\int_{I}\left\|\frac{d\nu_{1}}{d\mu}(x)-\frac{d\nu_{2}}{d\mu}(x)\right\|~{}d\mu(x)$
		$\displaystyle=\frac{1}{2}\int_{A}\frac{d\nu_{1}}{d\mu}(x)-\frac{d\nu_{2}}{d\mu}(x)~{}d\mu(x)+\frac{1}{2}\int_{B}\frac{d\nu_{2}}{d\mu}(x)-\frac{d\nu_{1}}{d\mu}(x)~{}d\mu(x)$
		$\displaystyle=\frac{1}{2}(\nu_{1}(A)-\nu_{2}(A)+\nu_{2}(B)-\nu_{1}(B))$
		$\displaystyle=\frac{1}{2}((g^{\sharp}\nu_{1})(\{0\})-(g^{\sharp}\nu_{2})(\{0\})+(g^{\sharp}\nu_{2})(\{1\})-(g^{\sharp}\nu_{2})(\{1\}))$
		$\displaystyle=\frac{1}{2}(\|(g^{\sharp}\nu_{1})(\{0\})-(g^{\sharp}\nu_{2})(\{0\})\|+\|(g^{\sharp}\nu_{2})(\{1\})-(g^{\sharp}\nu_{2})(\{1\})\|)$
		$\displaystyle=\mathsf{TV}_{2}(g^{\sharp}(\mu_{1}),g^{\sharp}(\mu_{2}))$

We then conclude that $\Delta^{\mathrm{TV}}$ is $2$ -generated. __relaxaxp@oldproof __relaxaxp@oldproof (Proof of Proposition 11) For all set $J$ and $c_{1},c_{2}\in TJ$ , we have

	$\displaystyle{\mathsf{\Delta}}^{[\leq]^{\Omega}}_{J}(c_{1},c_{2})=1$	$\displaystyle\iff c_{1}[\leq]^{\Omega}_{J}c_{2}$
		$\displaystyle\iff\bigwedge_{g\colon J\to T\Omega}g^{\sharp}(c_{1})\leq g^{\sharp}(c_{2})$
		$\displaystyle\iff\bigwedge_{g\colon J\to T\Omega}g^{\sharp}(c_{1})\mathbin{[\leq]^{\Omega}_{\Omega}}g^{\sharp}(c_{2})$
		$\displaystyle\iff\sup_{g\colon J\to T\Omega}{\mathsf{\Delta}}([\leq]^{\Omega})_{\Omega}(g^{\sharp}(c_{1}),g^{\sharp}(c_{2}))=1.$

This implies that ${\mathsf{\Delta}}^{[\leq]^{\Omega}}$ is $\Omega$ -generated. __relaxaxp@oldproof

Lemma 2.

For any $U\in{\bf QET}(\Omega,X)$ , the function $d[U]\colon(T_{\Omega}X)^{2}\to\mathcal{R}^{+}$ defined by

d[U](t,u)\triangleq\inf\left\{\varepsilon\in\mathbb{Q}^{+}~{}\middle|~{}\emptyset\vdash{t}=_{\varepsilon}{u}\in U\right\}

is a CS-EPMet on $T_{\Omega}X$ such that $d[U](t,u)\in\mathbb{Q}^{+}\implies\emptyset\vdash{t}=_{d[U](t,u)}{u}$ .

Proof.

We first check the axioms of extended pseudometric.

By (Ref), $U$ contains $\emptyset\vdash{t}=_{0}{t}$ for each $t\in T_{\Omega}X$ . Hence $d[U](t,t)=0$ holds for all $t\in T_{\Omega}X$ .

By (Sym) and (Cut), $\emptyset\vdash{t}=_{\varepsilon}{u}$ if and only if $\emptyset\vdash{u}=_{\varepsilon}{t}$ . Hence, for all $t,u\in T_{\Omega}X$ ,

d[U](t,u)=\inf\left\{\varepsilon\in\mathbb{Q}^{+}~{}\middle|~{}\emptyset\vdash{t}=_{\varepsilon}{u}\right\}=\inf\left\{\varepsilon\in\mathbb{Q}^{+}~{}\middle|~{}\emptyset\vdash{u}=_{\varepsilon}{t}\right\}=d[U](u,t)

By (Tri) and (Cut), if $\emptyset\vdash{t}=_{\varepsilon}{u}$ and $\emptyset\vdash{u}=_{\varepsilon^{\prime}}{v}$ then $\emptyset\vdash{t}=_{\varepsilon+\varepsilon^{\prime}}{v}$ . Hence, for all $t,u,v\in T_{\Omega}X$ ,

	$\displaystyle d[U](t,v)$	$\displaystyle=\inf\left\{\varepsilon^{\ast}\in\mathbb{Q}^{+}~{}\middle\|~{}\emptyset\vdash{t}=_{\varepsilon^{\ast}}{v}\right\}$
		$\displaystyle\leq\inf\left\{\varepsilon+\varepsilon^{\prime}~{}\middle\|~{}\emptyset\vdash{t}=_{\varepsilon}{u}\land\emptyset\vdash{u}=_{\varepsilon^{\prime}}{v}\right\}$
		$\displaystyle\leq\inf\left\{\varepsilon\in\mathbb{Q}^{+}~{}\middle\|~{}\emptyset\vdash{t}=_{\varepsilon}{u}\right\}+\inf\left\{\varepsilon^{\prime}\in\mathbb{Q}^{+}~{}\middle\|~{}\emptyset\vdash{u}=_{\varepsilon^{\prime}}{v}\right\}$
		$\displaystyle=d[U](t,u)+d[U](u,v).$

We next check the substitutivity. Let $t,u\in T_{\Omega}X$ and $h\colon X\to T_{\Omega}X$ . By (Subst), we have

\emptyset\vdash{t}=_{\varepsilon}{u}\in U\implies\emptyset\vdash{h^{\sharp}(t)}=_{\varepsilon}{h^{\sharp}(u)}\in U.

Since $\varepsilon$ is arbitrary, we conclude the substitutivity as follows:

	$\displaystyle d[U](h^{\sharp}(t),h^{\sharp}(u))$	$\displaystyle=\inf\left\{\varepsilon\in\mathbb{Q}^{+}~{}\middle\|~{}\emptyset\vdash{h^{\sharp}(t)}=_{\varepsilon}{h^{\sharp}(u)}\in U\right\}$
		$\displaystyle\leq\inf\left\{\varepsilon\in\mathbb{Q}^{+}~{}\middle\|~{}\emptyset\vdash{t}=_{\varepsilon}{u}\in U\right\}$
		$\displaystyle=d[U](t,u).$

Next, we check the congruence, Let $t\in T_{\Omega}I$ and $h_{1},h_{2}\colon I\to T_{\Omega}X$ By applying (Nonexp) and (Cut) inductively by unfolding the structure of $t$ ,

\forall{i\in I}~{}.~{}\emptyset\vdash{h_{1}(i)}=_{\varepsilon}{h_{2}(i)}\in U\implies\emptyset\vdash{h_{1}^{\sharp}(t)}=_{\varepsilon}{h_{2}^{\sharp}(t)}\in U.

(29)

If $\sup_{i\in I}d[U](h_{1}(i),h_{2}(i))\leq\varepsilon^{\prime}$ for some $\varepsilon^{\prime}\in\mathbb{Q}^{+}$ , then we have $d[U](h_{1}(i),h_{2}(i))\leq\varepsilon^{\prime}$ for all $i\in I$ . By (Max),(Cut) and definition of $d_{X}^{U}$ , we have $\vdash{h_{1}(i)}=_{\varepsilon^{\prime}}{h_{2}(i)}\in U$ for all $i\in I$ . Hence,

\sup_{i\in I}d[U](h_{1}(i),h_{2}(i))\leq\varepsilon^{\prime}\implies\forall{i\in I}~{}.~{}\emptyset\vdash{h_{1}(i)}=_{\varepsilon^{\prime}}{h_{2}(i)}\in U.

(30)

From the above two implications (29) and (30), We conclude the congruence as follows:

	$\displaystyle d[U](h_{1}^{\sharp}(t),h_{2}^{\sharp}(t))$	$\displaystyle=\inf\left\{\varepsilon^{\prime}\in\mathbb{Q}^{+}~{}\middle\|~{}\emptyset\vdash{h_{1}^{\sharp}(t)}=_{\varepsilon^{\prime}}{h_{2}^{\sharp}(t)}\in U\right\}$
		$\displaystyle\leq\inf\left\{\varepsilon^{\prime}\in\mathbb{Q}^{+}~{}\middle\|~{}\forall{i\in I}~{}.~{}\emptyset\vdash{h_{1}(i)}=_{\varepsilon^{\prime}}{h_{2}(i)}\in U\right\}$
		$\displaystyle\leq\inf\left\{\varepsilon^{\prime}\in\mathbb{Q}^{+}~{}\middle\|~{}\sup_{i\in I}d_{X}^{U}(h_{1}(i),h_{2}(i))\leq\varepsilon^{\prime}\right\}$
		$\displaystyle=\sup_{i\in I}d[U](h_{1}(i),h_{2}(i)).$

Finally, we assume $d[U](t,u)\in\mathbb{Q}^{+}$ . By definition of $d[U](t,u)$ , for any $\varepsilon\in\mathbb{Q}^{+}$ such that $d[U](t,u)<\varepsilon$ , there is $\varepsilon^{\prime}\in\mathbb{Q}^{+}$ satisfying $d[U](t,u)\leq\varepsilon^{\prime}<\varepsilon$ and ${t}=_{\varepsilon^{\prime}}{u}\in U$ . Since $\varepsilon\in\mathbb{Q}^{+}$ is arbitrary, by (Max) and (Cut), we conclude

\forall{\varepsilon\in\mathbb{Q}^{+}}~{}.~{}(d[U](t,u)<\varepsilon\implies{t}=_{\varepsilon}{u}\in U).

Since $d[U](t,u)\in\mathbb{Q}^{+}$ , by (Arch) and (Cut), we have ${t}=_{d[U](t,u)}{u}\in U$ . ∎

The monotonicity of $d[-]\colon({\bf QET}(\Omega,X),\subseteq)\to({\bf CSEPMet}(T_{\Omega},X),\preceq)$ is easy to prove:

	$\displaystyle U\subseteq V$	$\displaystyle\implies\forall{t,u\in T_{\Omega}X}~{}.~{}\inf\left\{\varepsilon\in\mathbb{Q}^{+}~{}\middle\|~{}\emptyset\vdash{t}=_{\varepsilon}{u}\in U\right\}\geq\inf\left\{\varepsilon\in\mathbb{Q}^{+}~{}\middle\|~{}\emptyset\vdash{t}=_{\varepsilon}{u}\in V\right\}$
		$\displaystyle\iff\forall{t,u\in T_{\Omega}X}~{}.~{}d[U](t,u)\geq d[V](t,u)$
		$\displaystyle\iff d[U]\preceq d[V].$

Lemma 3.

Let $T$ be a monad on ${\bf Set}$ , and let $X\in{\bf Set}$ . For any $d\in{\bf CSEPMet}(T,X)$ , the family $\mathrm{Gen}(d)=\{\mathrm{Gen}(d)_{I}\colon(TX)^{2}\to\mathcal{R}^{+}\}$ defined by

\mathrm{Gen}(d)_{I}(c_{1},c_{2})=\sup_{k\colon I\to TX}d(k^{\sharp}(c_{1}),k^{\sharp}(c_{2}))

is an $X$ -generated ${\color[rgb]{0,0,0}\mathrm{Eq}}$ -relative $\mathcal{R}^{+}$ -divergence on $T$ where each $\mathrm{Gen}(d)_{I}$ is a pseudometric.

Proof.

From the reflexivity of $d$ , we have the reflexivity of $\mathrm{Gen}(d)_{I}$ : for each $c\in TI$ ,

\mathrm{Gen}(d)_{I}(c,c)=\sup_{k\colon I\to TX}d(k^{\sharp}(c),k^{\sharp}(c))=0.

Hence, the ${\color[rgb]{0,0,0}\mathrm{Eq}}$ -unit-reflexivity of ${\mathsf{\Delta}}^{d}$ is already proved from the (proper) reflexivity. From the symmetry of $d$ , we have the symmetry of ${\mathsf{\Delta}}^{d}_{I}$ : for each $c_{1},c_{2}\in TI$ ,

	$\displaystyle\mathrm{Gen}(d)_{I}(c_{1},c_{2})$	$\displaystyle=\sup_{k\colon I\to TX}d(k^{\sharp}(c_{1}),k^{\sharp}(c_{2}))$
		$\displaystyle=\sup_{k\colon I\to TX}d(k^{\sharp}(c_{2}),k^{\sharp}(c_{1}))$
		$\displaystyle=\mathrm{Gen}(d)_{I}(c_{2},c_{1}).$

From the triangle-inequality of $d$ , we have the triangle-inequality of $\mathrm{Gen}(d)_{I}$ : for all $c_{1},c_{2},c_{3}\in TI$ ,

	$\displaystyle\mathrm{Gen}(d)_{I}(c_{1},c_{3})$	$\displaystyle=\sup_{k\colon I\to TX}d(k^{\sharp}(c_{1}),k^{\sharp}(c_{3}))$
		$\displaystyle\leq\sup_{k\colon I\to TX}d(k^{\sharp}(c_{1}),k^{\sharp}(c_{2}))+d(k^{\sharp}(c_{2}),k^{\sharp}(c_{3}))$
		$\displaystyle\leq\sup_{k\colon I\to TX}d(k^{\sharp}(c_{1}),k^{\sharp}(c_{2}))+\sup_{k\colon I\to TX}d(k^{\sharp}(c_{2}),k^{\sharp}(c_{3}))$
		$\displaystyle=\mathrm{Gen}(d)_{I}(c_{1},c_{2})+\mathrm{Gen}(d)_{I}(c_{2},c_{3}).$

From the reflexivity, congruence and substitutivity of $d$ and the triangle-inequality of ${\mathsf{\Delta}}^{d}_{I}$ , we next show the composability. Let $c_{1},c_{2}\in TI$ and $f_{1},f_{2}\colon I\to TJ$ . We obtain,

	$\displaystyle\mathrm{Gen}(d)_{J}(f_{1}^{\sharp}(c_{1}),f_{2}^{\sharp}(c_{2}))$
		$\displaystyle\leq\mathrm{Gen}(d)_{J}(f_{1}^{\sharp}(c_{1}),f_{1}^{\sharp}(c_{2}))+\mathrm{Gen}(d)_{J}(f_{1}^{\sharp}(c_{2}),f_{2}^{\sharp}(c_{2}))$
		$\displaystyle=\sup_{k\colon J\to TX}d((k^{\sharp}\circ f_{1})^{\sharp}(c_{1}),(k^{\sharp}\circ f_{1})^{\sharp}(c_{2}))+\sup_{k\colon J\to TX}d((k^{\sharp}\circ f_{1})^{\sharp}(c_{2}),(k^{\sharp}\circ f_{2})^{\sharp}(c_{2}))$
		$\displaystyle\leq\sup_{k\colon J\to TX}d(f_{1}^{\sharp}(c_{1}),f_{1}^{\sharp}(c_{2}))+\sup_{k\colon J\to TX}\sup_{i\in I}d(k^{\sharp}\circ f_{1}(i),k^{\sharp}\circ f_{2}(i))$
		$\displaystyle=d(f_{1}^{\sharp}(c_{1}),f_{1}^{\sharp}(c_{2}))+\sup_{k\colon J\to TX}\sup_{i\in I}d(k^{\sharp}\circ f_{1}(i),k^{\sharp}\circ f_{2}(i))$
		$\displaystyle\leq\sup_{f_{1}\colon I\to TX}d(f_{1}^{\sharp}(c_{1}),f_{1}^{\sharp}(c_{2}))+\sup_{i\in I}\sup_{k\colon J\to TX}d(k^{\sharp}\circ f_{1}(i),k^{\sharp}\circ f_{2}(i))$
		$\displaystyle=\mathrm{Gen}(d)_{I}(c_{1},c_{2})+\sup_{i\in I}\mathrm{Gen}(d)_{J}(f_{1}(i),f_{2}(i)).$

Finally we show the $X$ -generatedness of $\mathrm{Gen}(d)$ by definition

	$\displaystyle\mathrm{Gen}(d)I(c_{1},c_{2})$	$\displaystyle=\sup_{k\colon I\to TX}d(k^{\sharp}(c_{1}),k^{\sharp}(c_{2}))$
		$\displaystyle=\sup_{h\colon X\to TX}\sup_{k\colon I\to TX}d(h^{\sharp}(k^{\sharp}(c_{1})),h^{\sharp}(k^{\sharp}(c_{2})))$
		$\displaystyle=\sup_{k\colon I\to TX}\sup_{h\colon X\to TX}d(h^{\sharp}(k^{\sharp}(c_{1})),h^{\sharp}(k^{\sharp}(c_{2})))$
		$\displaystyle=\sup_{k\colon I\to TX}\mathrm{Gen}(d)_{X}(k^{\sharp}(c_{1}),k^{\sharp}(c_{2}))$

This completes the proof. ∎

The monotonicity of $\mathrm{Gen}\colon({\bf CSEPMet}(T_{\Omega},X),\preceq)\to(\mathbf{DivEPMet}(T_{\Omega},X),\preceq)$ is easy to prove:

	$\displaystyle d\preceq d^{\prime}$	$\displaystyle\implies\forall{c_{1},c_{2}\in TI}~{}.~{}\sup_{k\colon I\to TX}d(k^{\sharp}(c_{1}),k^{\sharp}(c_{2}))\geq\sup_{k\colon I\to TX}d^{\prime}(k^{\sharp}(c_{1}),k^{\sharp}(c_{2}))$
		$\displaystyle\iff\forall{c_{1},c_{2}\in TI}~{}.~{}\mathrm{Gen}(d)_{I}(c_{1},c_{2})\geq\mathrm{Gen}(d^{\prime})_{I}(c_{1},c_{2})$
		$\displaystyle\iff\mathrm{Gen}(d)\preceq\mathrm{Gen}(d^{\prime}).$

__relaxaxp@oldproof (Proof of Theorem 6) We first show $(\mathrm{Gen}(-))_{X}=\mathrm{id}$ . Let $d\in{\bf CSEPMet}(T_{\Omega},X)$ . We fix arbitrary $t,u\in T_{\Omega}X$ . From the substitutivity of $d$ , we have $d(k^{\sharp}(t),k^{\sharp}(u))\leq d(t,u)$ , but we can take $k=\eta_{X}$ , we obtain

\mathrm{Gen}(d)XC(t,u)=\sup_{k\colon X\to TX}d(k^{\sharp}(t),k^{\sharp}(u))=d(t,u).

Since $d,t,u$ are arbitrary, we conclude $(\mathrm{Gen}(-))_{X}=\mathrm{id}$ .

We show $\mathrm{Gen}((-)_{X})=\mathrm{id}$ . Let ${\mathsf{\Delta}}\in\mathbf{DivEPMet}(T_{\Omega},X)$ . By the $X$ -generatedness of ${\mathsf{\Delta}}$ , we have for all set $I$ and $t,u\in T_{\Omega}I$ ,

\mathrm{Gen}(({\mathsf{\Delta}})_{X})_{I}(t,u)=\sup_{k\colon I\to TX}{\mathsf{\Delta}}_{X}(k^{\sharp}(t),k^{\sharp}(u))={\mathsf{\Delta}}_{I}(t,u).

Since ${\mathsf{\Delta}},I,t,u$ are arbitrary, we conclude $(\mathrm{Gen}(-))_{X}=\mathrm{id}$ .

We show the adjointness: $U[d]\subseteq V\iff d\geq d[V]$ for any $V\in{\bf QET}(\Omega,X)$ and $d\in{\bf CSEPMet}(T_{\Omega},X)$ .

	$\displaystyle U[d]\subseteq V$	$\displaystyle\iff\overline{\left\{\emptyset\vdash{t}=_{\varepsilon}{u}~{}\middle\|~{}\varepsilon\in\mathbb{Q}^{+},d(t,u)\leq\varepsilon\right\}}^{\mathrm{QET}({\Omega},{X})}\subseteq V$
		$\displaystyle\iff\forall{t,u\in T_{\Omega},\varepsilon\in\mathbb{Q}^{+}}~{}.~{}d(t,u)\leq\varepsilon\implies\emptyset\vdash{t}=_{\varepsilon}{u}\in V$
		$\displaystyle\iff\forall{t,u\in T_{\Omega},\varepsilon\in\mathbb{Q}^{+}}~{}.~{}d(t,u)\leq\varepsilon\implies\inf\left\{\varepsilon^{\prime}\in\mathbb{Q}^{+}~{}\middle\|~{}\emptyset\vdash{t}=_{\varepsilon^{\prime}}{u}\in V\right\}\leq\varepsilon$
		$\displaystyle\iff\forall{t,u\in T_{\Omega}}~{}.~{}\inf\left\{\varepsilon^{\prime}\in\mathbb{Q}^{+}~{}\middle\|~{}\emptyset\vdash{t}=_{\varepsilon^{\prime}}{u}\in V\right\}\leq d(t,u)$
		$\displaystyle\iff d\geq d[V]$

We notice that since $V$ is closed under (Max), (Arch) and (Cut), we have the equivalence

	$\displaystyle\inf\left\{\varepsilon^{\prime}\in\mathbb{Q}^{+}~{}\middle\|~{}\emptyset\vdash{t}=_{\varepsilon^{\prime}}{u}\in V\right\}\leq\varepsilon$
		$\displaystyle\implies(\forall{\varepsilon^{\prime}\in\mathbb{Q}^{+}}~{}.~{}\varepsilon^{\prime}>\varepsilon\implies\emptyset\vdash{t}=_{\varepsilon^{\prime}}{u}\in V)$
		$\displaystyle\implies\emptyset\vdash{t}=_{\varepsilon}{u}\in V$
		$\displaystyle\implies\inf\left\{\varepsilon^{\prime}\in\mathbb{Q}^{+}~{}\middle\|~{}\emptyset\vdash{t}=_{\varepsilon^{\prime}}{u}\in V\right\}\leq\varepsilon.$

We finally show $d[U[-]]=\mathrm{id}_{{\bf CSEPMet}(T_{\Omega},X)}$ . From the adjointness, $d[U[d]]\leq d$ holds for each $d\in{\bf CSEPMet}(T_{\Omega},X)$ . We can rewrite $d\leq d[U[d]]$ as follows:

	$\displaystyle d\leq d[U[d]]$	$\displaystyle\iff\forall{t,u\in T_{\Omega}}~{}.~{}d(t,u)\leq d[U[d]](t,u)$
		$\displaystyle\iff\forall{t,u\in T_{\Omega}}~{}.~{}d(t,u)\leq\inf\left\{\varepsilon\in\mathbb{Q}^{+}~{}\middle\|~{}\emptyset\vdash{t}=_{\varepsilon}{u}\in U[d]\right\}$
		$\displaystyle\iff\forall{t,u\in T_{\Omega},\varepsilon\in\mathbb{Q}^{+}}~{}.~{}\implies d(t,u)\leq\varepsilon$
		$\displaystyle\iff\{\emptyset\vdash{t}=_{\varepsilon}{u}\in u[d]\}\subseteq\{\emptyset\vdash{t}=_{\varepsilon}{u}\|d(t,u)\leq\varepsilon\}.$

Thanks to the minimality of $U[d]$ , it suffices to have a QET $V\in{\bf QET}(\Omega,X)$ such that

\{\emptyset\vdash{t}=_{\varepsilon}{u}\in V\}=\{\emptyset\vdash{t}=_{\varepsilon}{u}|d(t,u)\leq\varepsilon\}.

Inspired from the definition of models of QET ([6]), we define $V$ as follows:

	$\displaystyle{\Gamma\vdash{t}=_{\varepsilon}{u}}\in V$
	$\displaystyle\iff\forall{\sigma\colon X\to T_{\Omega}X}~{}.~{}\left(\left(\forall{{t^{\prime}}=_{\varepsilon^{\prime}}{u^{\prime}}\in\Gamma}~{}.~{}d(\sigma^{\sharp}(t^{\prime}),\sigma^{\sharp}(u^{\prime}))\leq\varepsilon^{\prime}\right)\implies d(\sigma^{\sharp}(t),\sigma^{\sharp}(u))\leq\varepsilon\right).$

By the substitutivity of $d$ and the definition of $V$ , we obtain for all $t,u\in T_{\Omega}X$ and $\varepsilon\in\mathbb{Q}^{+}$ ,

{\emptyset\vdash{t}=_{\varepsilon}{u}}\in V\iff(\forall{\sigma\colon X\to T_{\Omega}X}~{}.~{}d(\sigma^{\sharp}(t),\sigma^{\sharp}(u))\leq\varepsilon)\iff d(t,u)\leq\varepsilon.

We check that $V$ satisfies all rules of QET:

(Ref) Immediate from the reflexivity of $d$ .

(Sym) Immediate from the symmetry of $d$ .

(Tri) Immediate from the triangle-inequality of $d$ .

(Max) Immediate from the transitivity of ordering $\leq$ and the monotonicity of $+$ .

(Arch) Immediate from the Archimedean property and the completeness of $[0,\infty]$ .

(Nonexp) Let $f\colon|I|\in\Omega$ . We then take a term $t_{f}\in T_{\Omega}I$ corresponding to $f$ . Let $t,s:I\rightarrow T_{\Omega}X$ be functions. We fix an arbitrary $\sigma\colon X\to T_{\Omega}X$ . Assume $d(\sigma^{\sharp}(t(i)),\sigma^{\sharp}(s(i)))\leq\varepsilon$ for each $i\in I$ . Then this asserts $\sup_{i\in I}d(\sigma^{\sharp}(t(i)),\sigma^{\sharp}(s(i)))\leq\varepsilon$ . From the congruence of $d$ , we conclude

d(\sigma^{\sharp}(f(t(i)|i\in I)),\sigma^{\sharp}(f(s(i)|i\in I)))=d(\sigma^{\sharp}(t^{\sharp}(t_{f})),\sigma^{\sharp}(s^{\sharp}(t_{f})))\leq\sup_{i\in I}d(\sigma^{\sharp}(t(i)),\sigma^{\sharp}(s(i)))\leq\varepsilon.

(Subst) Immediate by definition of $V$ :

	$\displaystyle{\Gamma\vdash{t}=_{\varepsilon}{u}}\in V$
	$\displaystyle\iff\forall{\sigma\colon X\to T_{\Omega}X}~{}.~{}\left(\left(\forall{{t^{\prime}}=_{\varepsilon^{\prime}}{u^{\prime}}\in\Gamma}~{}.~{}d(\sigma^{\sharp}(t^{\prime}),\sigma^{\sharp}(u^{\prime}))\leq\varepsilon^{\prime}\right)\implies d(\sigma^{\sharp}(t),\sigma^{\sharp}(u))\leq\varepsilon\right)$
	$\displaystyle\implies\forall{\sigma^{\prime}\colon X\to T_{\Omega}X}~{}.~{}\forall{\sigma\colon X\to T_{\Omega}X}~{}.~{}\left(\begin{aligned} &\left(\forall{{t^{\prime}}=_{\varepsilon^{\prime}}{u^{\prime}}\in\Gamma}~{}.~{}d(\sigma^{\sharp}({\sigma^{\prime}}^{\sharp}(t^{\prime})),\sigma^{\sharp}({\sigma^{\prime}}^{\sharp}(u^{\prime})))\leq\varepsilon^{\prime}\right)\\ &\qquad\implies d(\sigma^{\sharp}({\sigma^{\prime}}^{\sharp}(t)),\sigma^{\sharp}({\sigma^{\prime}}^{\sharp}(u)))\leq\varepsilon\end{aligned}\right)$
	$\displaystyle\implies\forall{\sigma^{\prime}\colon X\to T_{\Omega}X}~{}.~{}\forall{\sigma\colon X\to T_{\Omega}X}~{}.~{}\left(\begin{aligned} &\left(\forall{{t^{\prime\prime}}=_{\varepsilon^{\prime}}{u^{\prime\prime}}\in\sigma^{\prime}(\Gamma)}~{}.~{}d(\sigma^{\sharp}(t^{\prime\prime}),\sigma^{\sharp}(u^{\prime\prime}))\leq\varepsilon^{\prime}\right)\\ &\qquad\implies d(\sigma^{\sharp}({\sigma^{\prime}}^{\sharp}(t)),\sigma^{\sharp}({\sigma^{\prime}}^{\sharp}(u)))\leq\varepsilon\end{aligned}\right)$
	$\displaystyle\iff\forall{\sigma^{\prime}\colon X\to T_{\Omega}X}~{}.~{}{\sigma^{\prime}}(\Gamma)\vdash{{\sigma^{\prime}}^{\sharp}(t)}=_{\varepsilon}{{\sigma^{\prime}}^{\sharp}(u)}\in V.$

(Cut) Immediate.

(Assumpt) Immediate. __relaxaxp@oldproof __relaxaxp@oldproof (Proof of Theorem 7) Since the range of $U[-]$ is a subset of $\mathbf{UQET}(\Omega,X)$ , we may define the following monotone restrictions of $U[-]$ and $d[-]$ :

	$\displaystyle U^{\prime}[-]$	$\displaystyle\colon({\bf CSEPMet}(T_{\Omega},X),\preceq)\to(\mathbf{UQET}(\Omega,X),\subseteq)$	$\displaystyle U^{\prime}[d]\triangleq U[d]\quad(d\in{\bf CSEPMet}(T_{\Omega},X)),$
	$\displaystyle d^{\prime}[-]$	$\displaystyle\colon(\mathbf{UQET}(\Omega,X),\subseteq)\to({\bf CSEPMet}(T_{\Omega},X),\preceq)$	$\displaystyle d^{\prime}[V]\triangleq d[V]\quad(V\in\mathbf{UQET}(\Omega,X)).$

By Theorem 6, we have $U^{\prime}[-]\vdash d^{\prime}[-]$ and $d^{\prime}[U^{\prime}[-]]={\rm id}$ . We show $U^{\prime}[d^{\prime}[-]]=\mathrm{id}$ . Let $V\in\mathbf{UQET}(\Omega,X)$ . There exists $S\subseteq\{\emptyset\vdash{t}=_{\varepsilon}{u}~{}|~{}t,u\in T_{\Omega}X,\varepsilon\in\mathbb{Q}^{+}\}$ such that $V=\overline{S}^{\mathrm{QET}({\Omega},{X})}$ . We check $U^{\prime}[d^{\prime}[V]]=V$ . By the adjunction $U^{\prime}[-]\dashv d^{\prime}[-]$ , we have $U^{\prime}[d^{\prime}[V]]\subseteq V$ which is equivalent to $d^{\prime}[V]\preceq d^{\prime}[V]$ . It suffices to check $V\subseteq U^{\prime}[d^{\prime}[V]]$ . We have

	$\displaystyle\emptyset\vdash{t}=_{\varepsilon}{u}\in S$
		$\displaystyle\implies\emptyset\vdash{t}=_{\varepsilon}{u}\in V$
		$\displaystyle\implies d^{\prime}[V](t,u)=\inf\{\varepsilon^{\prime}\in\mathbb{Q}^{+}~{}\|~{}\emptyset\vdash{t}=_{\varepsilon^{\prime}}{u}\in V\}\leq\varepsilon$

From the monotonicity of the closure $\overline{(-)}^{\mathrm{QET}({\Omega},{X})}$ , we conclude

V=\overline{S}^{\mathrm{QET}({\Omega},{X})}\subseteq\overline{\{\emptyset\vdash{t}=_{\varepsilon}{u}~{}|~{}d^{\prime}[V](t,u)\leq\varepsilon\}}^{\mathrm{QET}({\Omega},{X})}=U^{\prime}[d^{\prime}[V]].

Since $V\in\mathbf{UQET}(\Omega,X)$ is arbitrary, we have $U^{\prime}[d^{\prime}[-]]=\mathrm{id}$ . __relaxaxp@oldproof

Lemma 4.

Let $(\mathbb{C},T)$ be a CC-SM and ${\mathsf{\Delta}}=\{{\mathsf{\Delta}}^{m}_{I}\colon(U(TI))^{2}\to\mathcal{Q}\}_{m\in M,I\in\mathbb{C}}$ be a doubly-indexed family of $\mathcal{Q}$ -divergences satisfying monotonicity on $m$ (Definition 6). Then $T^{[{\mathsf{\Delta}}]}$ is an $M\times\mathcal{Q}$ -graded relational lifting of $T$ (satisfies conditions 1–3 of Definition 15).

Proof.

(Condition 1) We first show that $(\mathrm{id}_{TX_{1}},\mathrm{id}_{TX_{2}})\in{\bf BRel}(\mathbb{C})(T^{[{\mathsf{\Delta}}]}(m,v)X,T^{[{\mathsf{\Delta}}]}(n,w)X)$ for all $X$ whenever $m\leq n$ and $v\leq w$ . From the monotonicity of ${\mathsf{\Delta}}$ , for all $I\in\mathbb{C}$ , $c^{\prime}_{1},c^{\prime}_{2}\in U(TI)$ , $n^{\prime}\in M$ , $w^{\prime}\in\mathcal{Q}$ , we have

	$\displaystyle(c^{\prime}_{1},c^{\prime}_{2})\in\tilde{\mathsf{\Delta}}(m\cdot n^{\prime},v+w^{\prime})I$
		$\displaystyle\iff{\mathsf{\Delta}}^{m\cdot n^{\prime}}_{I}(c^{\prime}_{1},c^{\prime}_{2})\leq v+w^{\prime}\implies{\mathsf{\Delta}}^{n\cdot n^{\prime}}_{I}(c^{\prime}_{1},c^{\prime}_{2})\leq v+w^{\prime}\implies{\mathsf{\Delta}}^{n\cdot n^{\prime}}_{I}(c^{\prime}_{1},c^{\prime}_{2})\leq w+w^{\prime}$
		$\displaystyle\iff(c^{\prime}_{1},c^{\prime}_{2})\in\tilde{\mathsf{\Delta}}(n\cdot n^{\prime},w+w^{\prime})I.$

Therefore, for any $(c_{1},c_{2})\in T^{[{\mathsf{\Delta}}]}(m,v)X$ , we obtain $(c_{1},c_{2})\in T^{[{\mathsf{\Delta}}]}(n,w)X$ as follows:

	$\displaystyle(c_{1},c_{2})\in T^{[{\mathsf{\Delta}}]}(m,v)X$
		$\displaystyle\iff\forall I\in\mathbb{C},n^{\prime}\in M,w^{\prime}\in\mathcal{Q},(k_{1},k_{2}):X\mathbin{\dot{\rightarrow}}\tilde{\mathsf{\Delta}}(n^{\prime},w^{\prime})I~{}.~{}(k_{1}^{\sharp}\mathbin{\bullet}c_{1},k_{2}^{\sharp}\mathbin{\bullet}c_{2})\in\tilde{\mathsf{\Delta}}(m\cdot n^{\prime},v+w^{\prime})I$
		$\displaystyle\implies\forall I\in\mathbb{C},n^{\prime}\in M,w^{\prime}\in\mathcal{Q},(k_{1},k_{2}):X\mathbin{\dot{\rightarrow}}\tilde{\mathsf{\Delta}}(n^{\prime},w^{\prime})I~{}.~{}(k_{1}^{\sharp}\mathbin{\bullet}c_{1},k_{2}^{\sharp}\mathbin{\bullet}c_{2})\in\tilde{\mathsf{\Delta}}(n\cdot n^{\prime},w+w^{\prime})I$
		$\displaystyle\iff(c_{1},c_{2})\in T^{[{\mathsf{\Delta}}]}(n,w)X.$

(Condition 2) We next show $(\eta_{X_{1}},\eta_{X_{2}}):X\mathbin{\dot{\rightarrow}}T^{[{\mathsf{\Delta}}]}(1,0)X$ . From the definition of morphisms in ${\bf BRel}(\mathbb{C})$ , for all $(x_{1},x_{2})\in X$ , we have $(\eta_{X_{1}}\mathbin{\bullet}x_{1},\eta_{X_{2}}\mathbin{\bullet}x_{2})\in T^{[{\mathsf{\Delta}}]}(1,0)X$ as follows:

	$\displaystyle(x_{1},x_{2})\in X$
		$\displaystyle\implies\forall{I\in\mathbb{C},n\in M,w\in\mathcal{Q},(k_{1},k_{2}):X\mathbin{\dot{\rightarrow}}\tilde{\mathsf{\Delta}}(n,w)I}~{}.~{}(k_{1}\mathbin{\bullet}x_{1},k_{2}\mathbin{\bullet}x_{2})\in\tilde{\mathsf{\Delta}}(n,w)I$
		$\displaystyle\iff\forall{I\in\mathbb{C},n\in M,w\in\mathcal{Q},(k_{1},k_{2}):X\mathbin{\dot{\rightarrow}}\tilde{\mathsf{\Delta}}(n,w)I}~{}.~{}((k_{1}^{\sharp}\circ\eta_{X_{1}})\mathbin{\bullet}x_{1}),(k_{2}^{\sharp}\circ\eta_{X_{2}})\mathbin{\bullet}x_{2})\in\tilde{\mathsf{\Delta}}(n,w)I$
		$\displaystyle\iff\forall{I\in\mathbb{C},n\in M,w\in\mathcal{Q},(k_{1},k_{2}):X\mathbin{\dot{\rightarrow}}\tilde{\mathsf{\Delta}}(n,w)I}~{}.~{}(k_{1}^{\sharp}\mathbin{\bullet}(\eta_{X_{1}}\mathbin{\bullet}x_{1}),k_{2}^{\sharp}\mathbin{\bullet}(\eta_{X_{2}}\mathbin{\bullet}x_{2}))\in\tilde{\mathsf{\Delta}}(n,w)I$
		$\displaystyle\iff(\eta_{X_{1}}\mathbin{\bullet}x_{1},\eta_{X_{2}}\mathbin{\bullet}x_{2})\in T^{[{\mathsf{\Delta}}]}(1,0)X.$

(Condition 3) Finally, we show that $(f_{1}^{\sharp},f_{2}^{\sharp}):T^{[{\mathsf{\Delta}}]}(n,w)X\mathbin{\dot{\rightarrow}}T^{[{\mathsf{\Delta}}]}(n\cdot m,w+v)Y$ holds for any $(f_{1},f_{2}):X\mathbin{\dot{\rightarrow}}T^{[{\mathsf{\Delta}}]}(m,v)Y$ and $(n,w)\in M\times\mathcal{Q}$ . For all $(f_{1},f_{2}):X\mathbin{\dot{\rightarrow}}T^{[{\mathsf{\Delta}}]}(m,v)Y$ , we have

$\displaystyle(f_{1},f_{2}):X\mathbin{\dot{\rightarrow}}T^{[{\mathsf{\Delta}}]}(m,v)Y$
	$\displaystyle\iff\forall{(x_{1},x_{2})\in X}~{}.~{}(f_{1}\mathbin{\bullet}x_{1},f_{2}\mathbin{\bullet}x_{2})\in T^{[{\mathsf{\Delta}}]}(m,v)Y$
	$\displaystyle\iff\left(\begin{aligned} &\forall{(x_{1},x_{2})\in X,I\in\mathbb{C},n^{\prime}\in M,w^{\prime}\in\mathcal{Q},(k_{1},k_{2}):Y\mathbin{\dot{\rightarrow}}\tilde{\mathsf{\Delta}}(n^{\prime},w^{\prime})I}~{}.~{}\\ &\qquad(k_{1}^{\sharp}\mathbin{\bullet}(f_{1}\mathbin{\bullet}x_{1}),k_{2}^{\sharp}\mathbin{\bullet}(f_{2}\mathbin{\bullet}x_{2}))\in\tilde{\mathsf{\Delta}}(m\cdot n^{\prime},v+w^{\prime})I\end{aligned}\right)$
	$\displaystyle\iff\left(\begin{aligned} &\forall{(x_{1},x_{2})\in X,I\in\mathbb{C},n^{\prime}\in M,w^{\prime}\in\mathcal{Q},(k_{1},k_{2}):Y\mathbin{\dot{\rightarrow}}\tilde{\mathsf{\Delta}}(n^{\prime},w^{\prime})I}~{}.~{}\\ &\qquad((k_{1}^{\sharp}\circ f_{1})\mathbin{\bullet}x_{1}),(k_{2}^{\sharp}\circ f_{2})\mathbin{\bullet}x_{2})\in\tilde{\mathsf{\Delta}}(m\cdot n^{\prime},v+w^{\prime})I\end{aligned}\right)$
	$\displaystyle\iff\left(\begin{aligned} &\forall{I\in\mathbb{C},n^{\prime}\in M,w^{\prime}\in\mathcal{Q},(k_{1},k_{2}):Y\mathbin{\dot{\rightarrow}}\tilde{\mathsf{\Delta}}(n^{\prime},w^{\prime})I}~{}.~{}\\ &\qquad(k_{1}^{\sharp}\circ f_{1},k_{2}^{\sharp}\circ f_{2}):X\mathbin{\dot{\rightarrow}}\tilde{\mathsf{\Delta}}(m\cdot n^{\prime},v+w^{\prime})I\end{aligned}\right).$	(a)

For all $(c_{1},c_{2})\in T^{[{\mathsf{\Delta}}]}(n,w)X$ , we have

	$\displaystyle(c_{1},c_{2})\in T^{[{\mathsf{\Delta}}]}(n,w)X$
		$\displaystyle\iff\left(\begin{aligned} &\forall{I\in\mathbb{C},n^{\prime}\in M,w^{\prime}\in\mathcal{Q},(l_{1},l_{2}):X\mathbin{\dot{\rightarrow}}\tilde{\mathsf{\Delta}}(n^{\prime},w^{\prime})I}~{}.~{}\\ &\qquad(l_{1}^{\sharp}\mathbin{\bullet}c_{1},l_{2}^{\sharp}\mathbin{\bullet}c_{2})\in\tilde{\mathsf{\Delta}}(n\cdot n^{\prime},w+w^{\prime})I\end{aligned}\right).$		(b)

We here fix $(f_{1},f_{2}):X\mathbin{\dot{\rightarrow}}T^{[{\mathsf{\Delta}}]}(m,v)Y$ . We show $(f_{1}^{\sharp},f_{2}^{\sharp})\colon T^{[{\mathsf{\Delta}}]}(n,w)X\mathbin{\dot{\rightarrow}}T{\mathsf{\Delta}}(n\cdot m,w+v)Y$ . We also fix $I\in\mathbb{C}$ , $n^{\prime\prime}\in M$ , $w^{\prime\prime}\in\mathcal{Q}$ and $(k_{1},k_{2}):Y\mathbin{\dot{\rightarrow}}\tilde{\mathsf{\Delta}}(n^{\prime\prime},w^{\prime\prime})I$ . From (a), we obtain

(k_{1}^{\sharp}\circ f_{1},k_{2}^{\sharp}\circ f_{2}):X\mathbin{\dot{\rightarrow}}\tilde{\mathsf{\Delta}}(m\cdot n^{\prime\prime},v+w^{\prime\prime})I.

Therefore, by instantiating (b) with $(n^{\prime},w^{\prime})=(m\cdot n^{\prime\prime},v+w^{\prime\prime})$ and $(l_{1},l_{2})=(k_{1}^{\sharp}\circ f_{1},k_{2}^{\sharp}\circ f_{2})$ , for all $(c_{1},c_{2})\in T^{[{\mathsf{\Delta}}]}(n,w)X$ , we have

((k_{1}^{\sharp}\circ f_{1})^{\sharp}\mathbin{\bullet}c_{1},(k_{2}^{\sharp}\circ f_{2})^{\sharp}\mathbin{\bullet}c_{2})\in\tilde{\mathsf{\Delta}}(n\cdot m\cdot n^{\prime\prime},w+v+w^{\prime\prime})I.

Since $(c_{1},c_{2})\in T^{[{\mathsf{\Delta}}]}(n,w)X$ , $I\in\mathbb{C}$ , $n^{\prime\prime}\in M$ , $w^{\prime\prime}\in\mathcal{Q}$ and $(k_{1},k_{2}):Y\mathbin{\dot{\rightarrow}}\tilde{\mathsf{\Delta}}(n^{\prime\prime},w^{\prime\prime})I$ are arbitrary, we conclude $(f_{1}^{\sharp},f_{2}^{\sharp})\colon T^{[{\mathsf{\Delta}}]}(n,w)X\mathbin{\dot{\rightarrow}}T{\mathsf{\Delta}}(n\cdot m,w+v)$ as follows:

	$\displaystyle\left(\begin{aligned} &\forall{(c_{1},c_{2})\in T^{[{\mathsf{\Delta}}]}(n,w)X,I\in\mathbb{C},m^{\prime\prime}\in M,v^{\prime\prime}\in\mathcal{Q},(k_{1},k_{2}):Y\mathbin{\dot{\rightarrow}}\tilde{\mathsf{\Delta}}(m^{\prime\prime},v^{\prime\prime})I}~{}.~{}\\ &\qquad((k_{1}^{\sharp}\circ f_{1})^{\sharp}\mathbin{\bullet}c_{1},(k_{2}^{\sharp}\circ f_{2})^{\sharp}\mathbin{\bullet}c_{2}):X\mathbin{\dot{\rightarrow}}\tilde{\mathsf{\Delta}}(n\cdot m\cdot m^{\prime\prime},w+v+v^{\prime\prime})I\end{aligned}\right)$
	$\displaystyle\iff\left(\begin{aligned} &\forall{(c_{1},c_{2})\in T^{[{\mathsf{\Delta}}]}(n,w)X,I\in\mathbb{C},m^{\prime\prime}\in M,v^{\prime\prime}\in\mathcal{Q},(k_{1},k_{2}):Y\mathbin{\dot{\rightarrow}}\tilde{\mathsf{\Delta}}(m^{\prime\prime},v^{\prime\prime})I}~{}.~{}\\ &\qquad(k_{1}^{\sharp}\mathbin{\bullet}(f_{1}^{\sharp}\mathbin{\bullet}c_{1}),k_{2}^{\sharp}\mathbin{\bullet}(f_{2}^{\sharp}\mathbin{\bullet}c_{2})):X\mathbin{\dot{\rightarrow}}\tilde{\mathsf{\Delta}}(n\cdot m\cdot m^{\prime\prime},w+v+v^{\prime\prime})I\end{aligned}\right)$
	$\displaystyle\iff\forall{(c_{1},c_{2})\in T^{[{\mathsf{\Delta}}]}(n,w)X}~{}.~{}(f_{1}^{\sharp}\mathbin{\bullet}c_{1},f_{2}^{\sharp}\mathbin{\bullet}c_{2})\in T^{[{\mathsf{\Delta}}]}(n\cdot m,w+v)Y$
	$\displaystyle\iff(f_{1}^{\sharp},f_{2}^{\sharp})\colon T^{[{\mathsf{\Delta}}]}(n,w)X\mathbin{\dot{\rightarrow}}T{\mathsf{\Delta}}(n\cdot m,w+v).$

This completes the proof. ∎

__relaxaxp@oldproof (Proof of Proposition 13) By Theorem 8 and the assumption $\forall{I,J\in\mathbb{C}}~{}.~{}EI\mathbin{\dot{\times}}EJ\subseteq E(I\times J)$ , we obtain for all $(x_{1},x_{2})\in EI$ and $c_{1},c_{2}\in U(TI)$ ,

	$\displaystyle(\langle x_{1},c_{1}\rangle,\langle x_{2},c_{2}\rangle)\in EI\mathbin{\dot{\times}}\tilde{\mathsf{\Delta}}(m,v)J$
	$\displaystyle\iff(\langle x_{1},c_{1}\rangle,\langle x_{2},c_{2}\rangle)\in EI\mathbin{\dot{\times}}T^{[{\mathsf{\Delta}}]}(m,v)(EJ)$
	$\displaystyle\implies(\theta_{I,J}\mathbin{\bullet}\langle x_{1},c_{1}\rangle,\theta_{I,J}\mathbin{\bullet}\langle x_{2},c_{2}\rangle)\in T^{[{\mathsf{\Delta}}]}(m,v)(EI\mathbin{\dot{\times}}EJ)$
	$\displaystyle\implies(\theta_{I,J}\mathbin{\bullet}\langle x_{1},c_{1}\rangle,\theta_{I,J}\mathbin{\bullet}\langle x_{2},c_{2}\rangle)\in T^{[{\mathsf{\Delta}}]}(m,v)E(I\times J)$
	$\displaystyle\iff(\theta_{I,J}\mathbin{\bullet}\langle x_{1},c_{1}\rangle,\theta_{I,J}\mathbin{\bullet}\langle x_{2},c_{2}\rangle)\in\tilde{\mathsf{\Delta}}(m,v)(I\times J).$

This completes the proof. __relaxaxp@oldproof

Lemma 5.

The mapping

(x,\sigma)\mapsto\begin{cases}\mathcal{N}(x,\sigma^{2})&\sigma^{2}>0\\ \mathbf{d}_{x}&\sigma=0\end{cases}

forms a measurable function of type $\mathbb{R}\times\mathbb{R}\to G\mathbb{R}$ .

Proof.

We show that for all $A\in\Sigma_{\mathbb{R}}$ , the mapping $f_{A}(x,\sigma)=\mathcal{N}(x,\sigma^{2})(A)$ forms a measurable function of type $\mathbb{R}\times\mathbb{R}_{\neq 0}\to[0,1]$ where $\mathbb{R}_{\neq 0}$ is the subspace of $\mathbb{R}$ whose underlying set is $\{r\in\mathbb{R}|r\neq 0\}$ . We have

\mathcal{N}(x,\sigma^{2})(A)=\sum_{k\in\mathbb{Z}}\mathcal{N}(x,\sigma^{2})(A\cap[k,k+1])=\sum_{k\in\mathbb{Z}}\int_{A\cap[k,k+1]}\frac{1}{\sqrt{2\pi\sigma^{2}}}\exp\left(-\frac{(x-r)^{2}}{\sigma^{2}}\right)dr

The mapping $h(x,\sigma,r)=\frac{1}{\sqrt{2\pi\sigma^{2}}}\exp\left(-\frac{(x-r)^{2}}{\sigma^{2}}\right)$ forms a continuous function of type $\mathbb{R}\times\mathbb{R}_{\neq 0}\times\mathbb{R}\to\mathbb{R}$ , hence it is uniformly continuous on the compact set $I_{1}\times I_{2}\times[k,k+1]$ where $I_{1}$ and $I_{2}$ are arbitrary closed intervals in $\mathbb{R}$ and $\mathbb{R}_{\neq 0}$ respectively. Then, for all $0<\varepsilon$ , there exists $0<\delta$ such that $|h(x,\sigma,r)-h(x^{\prime},\sigma^{\prime},r^{\prime})|<\varepsilon$ holds wherever $|x-x^{\prime}|+|\sigma-\sigma^{\prime}|+|r-r^{\prime}|<\delta$ . Hence, for all $0<\varepsilon$ , there is $0<\delta$ such that whenever $|x-x^{\prime}|+|\sigma-\sigma^{\prime}|<\delta$ ,

\left|\int_{A\cap[k,k+1]}h(x,\sigma,r)dr-\int_{A\cap[k,k+1]}h(x^{\prime},\sigma^{\prime},r)dr\right|\leq|\int_{[k,k+1]}|h(x,\sigma,r)-h(x^{\prime},\sigma^{\prime},r^{\prime})|dr\leq\varepsilon.

Since the closed intervals $I_{1}$ and $I_{2}$ are arbitrary, we conclude that the function $f_{A\cap[k,k+1]}\colon\mathbb{R}\times\mathbb{R}_{\neq 0}\to[0,1]$ is continuous, hence measurable. Hence, the mapping $f_{A}=\sum_{k\in\mathbb{Z}}f_{A\cap[k,k+1]}$ is measurable. Since $A$ is arbitrary and $f_{A}(x,\sigma^{2})=\mathrm{ev}_{A}\circ\mathcal{N}(x,\sigma^{2})$ , the mapping $g(x,\sigma^{2})=\mathcal{N}(x,\sigma^{2})$ forms a measurable function of type $\mathbb{R}\times\mathbb{R}_{\neq 0}\to G\mathbb{R}$ . The rest of proof is routine. ∎

Corollary 1.

$[\![\mathtt{norm}]\!]\in{\bf QBS}(K\mathbb{R}\times K\mathbb{R},PK\mathbb{R})$ .

Lemma 6 (Measurability of $[\![\mathtt{lap}]\!]$ ).

The mapping

(x,\lambda)\mapsto\begin{cases}\mathrm{Lap}(x,\lambda)&\lambda>0\\ \mathbf{d}_{x}&\lambda\leq 0\end{cases}

forms a measurable function of type $\mathbb{R}\times\mathbb{R}\to G\mathbb{R}$ .

Proof.

We have, for all $A\in\Sigma_{\mathbb{R}}$ ,

\mathrm{Lap}(x,\lambda)(A)=\int_{A}\frac{1}{2\lambda}\exp\left(-\frac{|x-r|}{\lambda}\right)dr

The density function $h(x,\lambda,r)=\frac{1}{2\lambda}\exp\left(-\frac{|x-r|}{\lambda}\right)$ is continuous function of type $\mathbb{R}\times\mathbb{R}_{0\leq}\times\mathbb{R}\to\mathbb{R}$ where $\mathbb{R}_{0\leq}$ is the subspace of $\mathbb{R}$ whose underlying set is $\{r\in\mathbb{R}|0\leq r\}$ . The measurability of $\mathrm{Lap}(x,\lambda)$ is proved in the same way as $\mathcal{N}(x,\sigma^{2})$ . The rest of proof is routine. ∎

Corollary 2.

$[\![\mathtt{lap}]\!]\in{\bf QBS}(K\mathbb{R}\times K\mathbb{R},PK\mathbb{R})$ .

	$\displaystyle\mathsf{NC}_{J}(f^{\sharp}A,g^{\sharp}B)$	$\displaystyle=\sup\{\|i-j\|\mid(i,x)\in f^{\sharp}(A),(j,y)\in g^{\sharp}(B)\}$
		$\displaystyle=\sup\left\{\|i_{1}+i_{2}-j_{1}-j_{2}\|~{}\middle\|\begin{array}[]{l@{}}(i_{1},x)\in A,(j_{1},y)\in B,\\ (i_{2},x^{\prime})\in f(x),(j_{2},y^{\prime})\in g(y)\end{array}\right\}$
		$\displaystyle\leq\sup\{\|i_{1}-j_{1}\|~{}\|~{}(i_{1},x)\in A,(j_{1},y)\in B\}$
		$\displaystyle\qquad+\sup_{(x,y)\in{\color[rgb]{0,0,0}\mathrm{Top}}I(\iff x,y\in I)}\{\|i_{2}-j_{2}\|~{}\|~{}(i_{2},x^{\prime})\in f(x),(j_{2},y^{\prime})\in g(y)\}$
		$\displaystyle=\mathsf{NC}_{I}(A,B)+\sup_{(x,y)\in{\color[rgb]{0,0,0}\mathrm{Top}}I(\iff x,y\in I)}\mathsf{NC}_{J}(f(x),g(y)).$

Divergences on Monads for Relational Program Logics

Abstract

1 Introduction

2 Preliminaries

2.1 Category of Binary Relations

3 Divergences on Objects

Definition 1.

Definition 2.

Definition 3.

4 Divergences on Monads

Definition 4.

Definition 5.

Definition 6.

5 Examples of Divergences on Monads

5.1 Cost Difference for Deterministic Computations

5.2 Cost Difference for Nondeterministic Computations

5.3 Divergences for Differential Privacy

Definition 7 (Differential Privacy, ([21])).

A Non-Example: Pointwise Differential Privacy.

Definition 8.

Various Relaxations of Differential Privacy

5.4 Statistical Divergences and Composablity of ff-Divergences

Proposition 1.

5.5 Divergences on the Probability Monad on QBS via Monad Opfunctors.

Proposition 2.

Theorem 1.

5.6 Divergences on State Monads

5.6.1 Lipschitz Constant on States

Proposition 3.

5.6.2 Distance between State Transformers with the Same Inputs

Proposition 4.

5.6.3 Sup-Metric on the State Monad on the Category of Generalized Ultrametric Spaces

Proposition 5.

Proposition 6.

5.7 Combining Divergence with Cost

Proposition 7.

5.8 Preorders on Monads

Proposition 8.

6 Properties of Divergences on Monads

6.1 Divergences on Monads as Structures in 𝐃𝐢𝐯𝒬​(ℂ){\bf Div}_{\mathcal{Q}}({\mathbb{C}})

6.1.1 Enrichments of Kleisli Categories Induced by Divergences

Definition 9.

Theorem 2.

6.1.2 Internalizing Divergences as Structures in 𝐃𝐢𝐯𝒬​(ℂ){\bf Div}_{\mathcal{Q}}({\mathbb{C}})

Lemma 1.

Theorem 3.

6.1.3 Divergences on Monads and Divergence Liftings of Monads

Definition 10.

Theorem 4.

Theorem 5.

6.2 Generation of Divergences

Definition 11.

Proposition 9.

Proposition 10.

Ω\Omega-Generatedness of Preorders on Monads

Proposition 11.

6.3 An Adjunction between Quantitative Equational Theories and Divergences

Definition 12 (Quantitative Equational Theory [39, Definition 2.1]).

Definition 13.

Definition 14.

Proposition 12.

Theorem 6.

Theorem 7.

7 Graded Strong Relational Liftings for Divergences

Definition 15.

Definition 16.

Theorem 8.

Proof.

Proposition 13.

7.1 Simplifying Codensity Liftings by Ω\Omega-Generatedness of Divergences

Proposition 14.

Proof.

7.2 Two Lifting Approaches: Codensity and Coupling

8 Approximate Computational Relational Logic

8.1 Moggi’s Computational Metalanguage

8.1.1 Syntax of the Computational Metalanguage

8.1.2 Categorical Semantics of the Computational Metalanguage

8.2 Approximate Relational Computational Logic

8.2.1 Relational Logic in External Form

8.2.2 Inference Rules for acRL

5.4 Statistical Divergences and Composablity of $f$ -Divergences

6.1 Divergences on Monads as Structures in ${\bf Div}_{\mathcal{Q}}({\mathbb{C}})$

6.1.2 Internalizing Divergences as Structures in ${\bf Div}_{\mathcal{Q}}({\mathbb{C}})$

$\Omega$ -Generatedness of Preorders on Monads

7.1 Simplifying Codensity Liftings by $\Omega$ -Generatedness of Divergences

Lemma 6 (Measurability of $[\![\mathtt{lap}]\!]$ ).