σ → τ M : σ → τ Γ fix M : σ → τ 1.3. PROBABILISTIC TYPED HIGHER-ORDER LANGUAGES

Keywords: probabilistic higher-order computations, semantics of programming languages, applicative bisimulation, probabilistic coherence spaces, distance for programs

Titre : Distances comportementales pour des programmes probabilistes d'ordre supérieur.

Mots-clés : Computations probabilistes d'ordre supérieur, sémantique des langages de programmation, bisimulation applicative, espace cohérents probabilistes, distances entre programmes Cette thèse est consacrée à l'étude d'équivalences et de distances comportementales destinées à comparer des programmes probabilistes d'ordre supérieur. Le manuscrit est divisé en trois parties. La première partie consiste en une présentation des langages probabilistes d'ordre supérieur, et des notions d'équivalence et de distance contextuelles pour de tels langages.

Dans une deuxième partie, on suit une approche opérationnelle pour construire des notions d'équivalences et de métriques plus simples à manipuler que les notions contextuelles : on prend comme point de départ les deux équivalences comportementales pour le lambdacalcul probabiliste équipé d'une stratégie d'évaluation basée sur l'appel par nom introduites par Dal Lago, Sangiorgi and Alberti : ces derniers définissent deux équivalencesla trace équivalence, et la bisimulation probabiliste, et montrent que pour ce langage, la trace équivalence permet de complètement caractériser-i.e. est pleinement abstraitel'équivalence contextuelle, tandis que la bisimulation probabiliste est une approximation correcte de l'équivalence contextuelle, mais n'est pas pleinement abstraite. Dans la partie opérationnelle de cette thèse, on montre que la bisimulation probabiliste redevient pleinement abstraite quand on remplace la stratégie d'évaluation par nom par une stratégie d'évaluation par valeur. Le reste de cette partie est consacrée à une généralisation quantitative de la trace équivalence, i.e. une trace distance sur les programmes. On introduit d'abord une trace distance pour un λ-calcul probabiliste affine, i.e. où le contexte peut utiliser son argument au plus une fois, et ensuite pour un λ-calcul probabiliste où les contextes ont la capacité de copier leur argument; dans ces deux cas, on montre que les distances traces obtenues sont pleinement abstraites.

La troisième partie considère deux modèles dénotationnels de langages probabilistes d'ordre supérieur : le modèle des espaces cohérents probabiliste, dû à Danos et Ehrhard, qui interprète le langage obtenu en équipant PCF avec des probabilités discrètes, et le modèle des cônes mesurables et des fonctions stables et mesurables, développé plus récemment par Ehrhard, Pagani and Tasson pour le langage obtenu en enrichissant PCF avec des probabilités continues. Cette thèse établit deux résultats sur la structure de ces modèles. On montre d'abord que l'exponentielle de la catégorie des espaces cohérents peut être exprimée en utilisant le comonoide commutatif libre : il s'agit d'un résultat de généricité de cette catégorie vue comme un modèle de la logique linéaire. Le deuxième résultat éclaire les liens entre ces deux modèles : on montre que la catégorie des cônes mesurables et des fonctions stables et mesurable est une extension conservatrice de la catégorie de co-Kleisli des espaces cohérents probabilistes. Cela signifie que le modèle récemment introduit par Ehrhard, Pagani et Tasson peut être vu comme la généralisation au cas continu du modèle de PCF équipé avec des probabilités discrètes dans les espaces cohérents probabilistes.

Introduction Context

Randomized algorithms-i.e. algorithms which are allowed to perform probabilistic choices, formalized for instance as throwing a dice-are present from the beginning in computer science [START_REF] De Leeuw | Computability by probabilistic machines[END_REF][START_REF] Rabin | Probabilistic automata[END_REF]: they are for instance central to most algorithms in computational cryptography (where, e.g., secure public key encryption schemes are bound to be probabilistic [START_REF] Goldwasser | Probabilistic encryption[END_REF]). Probabilistic algorithms may also allow to solve a problem more efficiently-in less time-than deterministic algorithms, with the payoff that the output coincides with the correct answer with high probability, but not necessarily always. This idea is reflected for instance in computational complexity, e.g. the BPPcomplexity class consists of all problems that are solved by polynomial-time algorithms with probability at least 2 3 . For instance, we know that the polynomial identity testing problem-i.e. the problem of deciding whether some given polynomial with several variables is the 0-polynomial-is known to be in BPP, but it is still not known whether it is in P. Recently, there was a renewed-and widened-interest in the role of probability theory in computing, in particular in the machine-learning community. At the core of many machine-learning algorithms, there is indeed Bayesian reasoning, that can be roughly summarized as the following paradigm: we start from statistical models-i.e. a network of probability distributions over the set of possible events-that express our beliefs about the world, and then we update those models using Bayesian inference-this way developing the ability to condition values of variables via observations. This kind of reasoning usually focuses on statistical models expressed using continuous probability distributions, for instance probability distributions on reals.

In order to formally write and execute probabilistic algorithms, both abstract and concrete programming languages have been developed. Our focus here is on functional programming languages that are also higher-order, i.e. where subroutines can take functions in input and produce functions in output. Higher-order languages enjoy a strong connection with logic, formalized by the Curry-Howard correspondence, that originally connects typed λ-calculus-a minimal deterministic higher-order language without ground types or side-effects-with intuitionistic logic. This connection with logic makes higherorder languages a natural place to develop mathematical tools guaranteeing programs to be well-behaved-where what well-behaved means may depend on which properties we are interested in checking, for instance that the execution terminates, or that there is no deadlock. Randomized algorithms can be written in language like Ocaml or Haskell, that comes with a random primitive-that returns a real number chosen randomly between 0 and 1. Several concrete probabilistic higher-order languages handling Bayesian reasoning have also been introduced such as Church [START_REF] Goodman | Church: a language for generative models[END_REF], or more recently Anglican [START_REF] Tolpin | Probabilistic programming in anglican[END_REF].

In the present thesis, we focus on a problem central to program semantics: comparing two programs implementing distinct algorithms, in order to decide whether they are equivalent. This problem occurs for instance when we want to know whether a program implements a given specification, or when we do code optimization, and we want to be sure that we do not trigger any major change in the program behavior. Observe that, even in the case of deterministic programs, it is not enough to simply execute two programs once to decide if they always behave the same way, since the behavior of the program can depend on the external environment: we need to check that no environment can force the two programs to behave differently. In the case of higher-order programming languages, this can be illustrated by taking programs distinguishers to be program themselves. This idea was formalized in Morris's context equivalence [START_REF] Morris | Lambda-calculus models of programming languages[END_REF], where the external environment is modeled as a context, i.e. a program that contains a hole; the interaction of a program with its environment is then modeled as filling the context's hole with the program. Two programs are context equivalent when their observable behavior-i.e. what an external observer can see during the execution-is the same in any context. Morris's context equivalence is an almost universally accepted criterion for program equivalence, but is complicated to use in practice, because all possible contexts need to be considered. From there, the goal becomes to find handier ways to compare programs, that are sound with respect to Morris's context equivalence-i.e. they give us stronger or equal guarantees than context equivalence-or ideally even fully abstract-i.e. fully characterizes context equivalence.

Program analysis-including the study of Morris's context equivalence-asks for a formalization of the behavior of programs. In the present thesis, we will focus on two approaches: the operational view where we mostly see programs as processes that can be executed, and the denotational view, designed to abstract away from the implementation details and the way the program is actually executed, in order to focus on its mathematical meaning. Denotational semantics was introduced by the pioneering work of Scott and Strachey [START_REF] Scott | Outline of a mathematical theory of computation[END_REF][START_REF] Scott | Toward a mathematical semantics for computer languages[END_REF] on domain theory, with the aim of building denotational models, i.e. mathematical universes in which programs can be interpreted. In those universes, there are often objects that are not the interpretation of any program, and this gap can be used to inform the development of new programming constructs. Program interpretation is usually built in a compositional way-i.e. the interpretation of a program can be recovered from the interpretation of its sub-programs. Two programs are considered equivalent in a denotational model when their denotational interpretations coincide. Operational and denotational approaches should be seen as complementary: while operational semantics allows to formalize-hence to reason about-how a program is executed, denotational semantics aim to understand what a program actually do. When introducing a denotational model for some language, this connection need to be made formal by proving an adequacy theorem, that states that the program interpretation in the denotational model is invariant under one step of execution on the operational side. Beyond the adequacy result, we can look for stronger connections between operational and denotational worlds, by looking at the ability of a denotational model to talk about the operational context equivalence. A denotational model is sound when, in order to know whether two program of our language are context equivalent, we can compare their interpretations in our model: if the two interpretations coincide, then we know that the two programs are equivalent. The model is fully-abstract when we obtain this way a characterization of context equivalence, meaning that it is enough to look at program interpretations in the model to decide context equivalence.

Among the operational methods for studying Morris context equivalence, we will focus in the present thesis on coinductive methodologies [START_REF] Sangiorgi | On the bisimulation proof method[END_REF], that were first used in computer science for concurrency. Those techniques have been imported into the study of sequen-tial higher-order languages by Abramsky's applicative bisimulation [START_REF] Abramsky | The Lazy λ-Calculus[END_REF] in the setting of λ-calculus. Applicative bisimulation has been generalized to a wide range of higher-order languages: for instance languages with ground types [START_REF] Pitts | Operationally-based theories of program equivalence[END_REF], non-deterministic languages [START_REF] Lassen | Relational reasoning about contexts[END_REF], stateful languages [START_REF] Sangiorgi | Environmental bisimulations for higherorder languages[END_REF][START_REF] Koutavas | From applicative to environmental bisimulation[END_REF]... Abramsky's applicative bisimulation consists in building a transition system that models the operational semantics of the language interactively: this way we obtain a labeled graph that represents all the possible interactions between a program and the external environment. Then, we use a built-in-usually coinductive-notion of equivalence for the corresponding class of transition systems, this way obtaining an equivalence on programs. In λ-calculus, the unique way for the environment to interact with a program is to apply it to some argument, hence the name applicative bisimulation. This approach enables us to use coinductive techniques-as for instance up-to reasoning [START_REF] Sangiorgi | On the bisimulation proof method[END_REF]-developed as enhancement of the bisimulation proof method, and thus gives us new tools to handle context equivalence between programs. While denotational semantics aims to understand the structure of those functions that can be implemented by programs-thus enabling the use of adapted mathematical tools-in the contrary coinductive methodologies transform higher-order programs into first-order processes-i.e. forgetting about functions in order of being able to reason on a transition graph. By the way, the quest for soundness and full abstraction also holds for operationally inspired techniques for program equivalence.

State of the Art.

The operational semantics of higher-order probabilistic languages have been studied in depth in recent years, both for discrete and continuous probabilistic programming languages, with two main approaches. The first one handles explicitly probabilistic distributions, using a monadic type system: if σ is a type, then P σ is the type for probability distributions over type σ. Since probability distributions have a monadic structure, this approach fits into Moggi's computational λ-calculus [START_REF] Moggi | Computational lambda-calculus and monads[END_REF]: a probabilistic program taking objects of type σ in input and outputing objects of type τ can be typed as σ → P τ , meaning that it can be seen as a process taking non-probabilistic data of type σ, and outputing a probability distribution over data of type τ . It also gives a roadmap to then find a denotational semantics, by building a categorical model of computational λ-calculus, as defined by Moggi in [START_REF] Moggi | Computational lambda-calculus and monads[END_REF]. This approach has been for instance used for the discrete language used by Jones and Plotkin [START_REF] Jones | A probabilistic powerdomain of evaluations[END_REF], or the continuous languages introduced by Park, Pfenning and Thrun [START_REF] Park | A probabilistic language based on sampling functions[END_REF]. In the present thesis, we will focus on another approach, that consists in seeing all programs as possibly probabilistic, hence treating the same way non-probabilistic and probabilistic data. It is the case of the untyped discrete probabilistic λ-calculus Λ ⊕ introduced by Dal Lago and Zorzi [START_REF] Lago | Probabilistic operational semantics for the lambda calculus[END_REF]-and that will be our base language in this thesis. This approach is especially adapted to probabilistic extensions of PCF-the λ-calculus with integers as ground types introduced by Scott-since the monadic approach enforces a callby-value evaluation strategy, while the PCF evaluation strategy is call-by-name: it is the case of the discrete probabilistic variants of PCF used by Ehrhard, Pagani and Tasson [START_REF] Ehrhard | Probabilistic coherence spaces are fully abstract for probabilistic PCF[END_REF], or Goubault-Larrecq [START_REF] Goubault-Larrecq | Full abstraction for non-deterministic and probabilistic extensions of pcf i: The angelic cases[END_REF] . This approach has also been used for higher-order languages with continuous probabilities as for instance the variant of PCF with continuous probabilities used by Ehrhard, Pagani and Tasson in [START_REF] Ehrhard | Measurable cones and stable, measurable functions: a model for probabilistic higher-order programming[END_REF]-that have continuous distributions, but does not allow bayesian reasoning-or the λ-calculus with continuous probabilities and primitives for Bayesian reasoning introduced by Borgström et al [START_REF] Borgström | A lambda-calculus foundation for universal probabilistic programming[END_REF] as a foundational calculus for Church.

A generalization of Abramsky's applicative bisimulation to a probabilistic higher-order language was introduced by Dal Lago, Sangiorgi and Alberti in [START_REF] Lago | On coinductive equivalences for higherorder probabilistic functional programs[END_REF]: the authors introduced two equivalence relations on programs there-both of them being probabilistic adaptations of Abramsky's applicative bisimulation: probabilistic trace equivalence and probabilistic applicative bisimilarity. They showed that for their probabilistic λ-calculus equipped with a call-by-name evaluation strategy, probabilistic trace equivalence is fully abstract with respect to context equivalence, while probabilistic applicative bisimilarity is sound, but not fully abstract. These results were generalized by Deng, Feng, and Dal Lago [START_REF] Deng | On coinduction and quantum lambda calculi[END_REF] to a λcalculus designed for quantum computation. More recently, Sangiorgi and Vignudelli [START_REF] Sangiorgi | Environmental bisimulations for probabilistic higherorder languages[END_REF] studied environmental bisimilarity for a λ-calculus with state-i.e. the possibility for the program to write and read from memory. Several denotational models have been introduced for higher-order languages enriched with either discrete or continuous probabilistic primitives, starting with Jones and Plotkin's seminal work [START_REF] Jones | A probabilistic powerdomain of evaluations[END_REF][START_REF] Jones | Probabilistic non-determinism[END_REF]. From there, different approaches to build models have been enriched to model discrete probabilities: the domain-theoretic approach with the line of work initiated by Plotkin and Keimel using Kegelspitzen [START_REF] Plotkin | Mixed powerdomains for probability and nondeterminism[END_REF], the game-semantics one starting from the denotational model of probabilistic Idealized Algol of Danos and Harmer [START_REF] Danos | Probabilistic game semantics[END_REF], and the Linear Logic one with the introduction by Danos and Ehrhard of probabilistic coherence spaces [START_REF] Danos | Probabilistic coherence spaces as a model of higher-order probabilistic computation[END_REF]. There have been several full-abstraction results for higher-order languages enriched with discrete probabilities: for instance the Danos and Harmer's model of probabilistic Idealized Algol, or the model introduced by Danos and Ehrhard for probabilistic PCF. It is also the case for a domain-theoretic model introduced by Goubault-Larrecq for probabilistic PCF extended with statistical convergence testers, i.e. the ability to talk inside the language about the probability that a program terminates [START_REF] Goubault-Larrecq | Full abstraction for non-deterministic and probabilistic extensions of pcf i: The angelic cases[END_REF]. More recently, several models have been introduced for higher-order languages with continuous probabilities: for instance the model developed by Staton et al [START_REF] Heunen | A convenient category for higherorder probability theory[END_REF] using quasi-Borel spaces with a focus on interpreting Bayesian reasoning, or models that extend the game-semantics approach to handle continuous probability [START_REF] Ong | S-finite kernels and game semantics for probabilistic programming[END_REF][START_REF] Paquet | Continuous probability distributions in concurrent games[END_REF]. Here, we will mostly focus on the model introduced by Ehrhard, Pagani and Tasson [START_REF] Ehrhard | Measurable cones and stable, measurable functions: a model for probabilistic higher-order programming[END_REF] for PCF with continuous probability, that is based to a probabilistic generalization of the domain-theoretic notion of stability-used for instance by Berry for building dI-domains to handle sequentiality.

Challenges

• The results obtained by Dal Lago, Sangiorgi and Alberti [START_REF] Lago | On coinductive equivalences for higherorder probabilistic functional programs[END_REF] strongly rely on the probabilistic language they chose: for instance, two programs can be context equivalent in some language, and not context equivalent in an extension of the same language that gives more discriminating power to contexts. Even when fixing the syntax of the language to be the one of the probabilistic λ-calculus [START_REF] Lago | On coinductive equivalences for higherorder probabilistic functional programs[END_REF], the results are still only valid for the considered evaluation strategy-i.e. which part of the program should be executed first. The evaluation strategy chosen in [START_REF] Lago | On coinductive equivalences for higherorder probabilistic functional programs[END_REF] is call-by-name, meaning that when the program consists of a function applied to an argument, the argument is passed unevaluated to the function. While the λ-calculus is confluent-i.e. the evaluation strategy does not matter-it is not the case anymore when we add probabilistic primitives to the language, which limit the scope of the soundness and full-abstraction results [START_REF] Lago | On coinductive equivalences for higherorder probabilistic functional programs[END_REF].

• The study of Morris context equivalence for higher-order language enriched with continuous probabilities is still in its infancy, even though machine-learning algorithms have focused the attention on programming languages able to directly handle probability distributions on reals. There is for instance no definition of applicative bisimulation for an higher-order continuous probabilistic language. As mentioned earlier, sound denotational models have been developed in this setting in recent years, but there is no full abstraction result yet. On the operational side, Culpepper et al [START_REF] Culpepper | Contextual equivalence for probabilistic programs with continuous random variables and scoring[END_REF][START_REF] Wand | Contextual equivalence for a probabilistic language with continuous random variables and recursion[END_REF] have full-abstraction results for equivalences build in the tradition of Logical Relations, for a language with continuous random variables and scoring, but there is as for now no work on coinductive methodologies for a higher-order language with continuous probabilities.

• In a probabilistic setting, the observable behavior of any program is inherently quantitative: for instance, two programs can behave the same way on almost all probabilistic paths, but have a totally different behavior on the few remaining paths. Sometimes, we are not really interested to know if two programs have exactly the same behavior, but rather investigate how close they are. This is the case for instance in computational indistinguishability-a security notion coming from cryptography, where two algorithms are indistinguishable when the difference between their observable behavior when interacting with any possible adversary must be negligible with respect to the size of the security parameter. Accordingly, we would like to be able to study a quantitative counterpart to Morris's context equivalence: context distance, namely a measure of how much a context may distinguish two programs. Notions of distance have been studied in depth for probabilistic processes-for instance [START_REF] Desharnais | The metric analogue of weak bisimulation for probabilistic processes[END_REF][START_REF] Desharnais | Metrics for labeled markov systems[END_REF][START_REF] Van Breugel | A behavioural pseudometric for probabilistic transition systems[END_REF]. Gebler and Tini [START_REF] Gebler | Fixed-point characterization of compositionality properties of probabilistic processes combinators[END_REF] introduced and studied a context distance for a first-order probabilistic language. We can also mention differential privacy [START_REF] Dwork | Differential privacy[END_REF], which does not use Morris context distance, but look at certifying that algorithms do not leak too much information. However, when this thesis started, there was-at the best of my knowledge-no study of context distance for higher-order languages. More recently, Gaboardi [START_REF] Azevedo De Amorim | A semantic account of metric preservation[END_REF] et al looked at a denotational model for a probabilistic language based on metric spaces, thus going towards a denotational handling of context distance.

Our Approach

The present thesis aims at adapting tools that come from program semantics for nonprobabilistic-either deterministic or non-deterministic-programs, to the setting of programming languages in which some kind of probabilistic primitive is available. In order to do this, a major trend in the literature consists in transforming a qualitative structure already used in language-programming theory into a quantitative one. We can interpret this way the probabilistic generalizations of Abramsky's applicative bisimulation by Dal Lago, Sangiorgi and Alberti: indeed, they can be seen as transforming the underlying LTS used for applicative bisimulation on the λ-calculus into a quantitative transition system. For probabilistic trace equivalence, this transformation is distribution-based, hence we obtain a Observable Labeled Transition System (WLTS) [START_REF] Girard | Approximation metrics for discrete and continuous systems[END_REF], i.e. a LTS where each state is equipped with a weight. In the case of probabilistic applicative bisimulation, this transformation is state-based, meaning that the transitions themselves become quantitative, and the transition system obtained this way is a Labeled Markov Chain (LMC) [START_REF] Desharnais | Bisimulation for labelled markov processes[END_REF] -a structure developed to represent the evolution of probabilistic processes. In gamesemantics [START_REF] Danos | Probabilistic game semantics[END_REF], the approach taken is usually to transform strategies into probabilistic strategies. Likewise, probabilistic coherence spaces-the objects at the core of the denotational model developed by Danos and Ehrhard-are built in the tradition of web-based Linear Logic models [START_REF] Girard | Linear logic: its syntax and semantics[END_REF], but the cliques becomes quantitative. These quantitative structures often come with new tools to analyze them, that are not present in their qualitative counterparts. For instance, programs are interpreted in Danos and Ehrhard model as power series, thus allowing us to use the rich class of results on analytic functions from real analysis [START_REF] Krantz | A primer of real analytic functions[END_REF]. Similarly, LMCs comes not only with a builtin notion of equivalence -the coinductive notion of bisimulation given by Larsen and Skou [START_REF] Larsen | Bisimulation through probabilistic testing[END_REF]-but also with notions of distances, based on the Kantorowitch-Wasserstein lifting [START_REF] Desharnais | The metric analogue of weak bisimulation for probabilistic processes[END_REF]. On the other hand, quantitative problems arise when studying probabilistic languages: for instance, as highlighted above, program equivalence may sometimes be seen as too much discriminating, and we can instead ask for approximated equivalences-designed to guarantee that two programs have almost always the same behavior-or for distances -i.e. determining how much their behavior is different.

Beyond the usual qualitative measures to evaluate models relevance-i.e. soundness and full abstraction-we would like to have a better understanding of the connection between the quantitative structure of the models, and the quantitative behavior of programs. This work was more specifically designed as an attempt to use existing models of higherorder languages to talk about context distance. This approach led us first to take a closer look at context distance directly at the level of programs, and more precisely to explore the trivialization problem: depending on the expressive power of contexts, when do there exist programs at context distance strictly between 0 and 1? We then chose three models of probabilistic higher-order languages, with the aim to explore built-in distances in those models, that could allow us to gather information about context distance: we considered two operational-the state-based and distribution-based probabilistic generalizations of Abramsky's applicative bisimulation-and a denotational one-the model based on probabilistic coherence spaces introduced by Danos and Ehrhard. On the operational side, this approach yields encouraging results: we present here results on how to retrieve the context distance from the distribution-based model. We also obtained partial results on the state-based models, that we do not present in this thesis, but that can be found elsewhere [START_REF] Crubillé | Metric reasoning about λ-terms: The affine case[END_REF]. On the denotational side, we ended up to explore more widely the structure of the probabilistic coherent spaces model, with results designed to go towards a better understanding of the kind of quantitative reasoning enabled by the study of probabilistic higher-order languages.

Contributions

The contributions of the present thesis can be split into two parts: the first ones are results on behavioral equivalences and metrics, which arise from an analysis of higher-order probabilistic programming languages using transition systems. Their common starting point is the seminal work by Dal Lago, Sangiorgi and Alberti on probabilistic generalizations of Abramsky's applicative bisimulation, where they consider a call-by-name pure probabilistic λ-calculus.

• Full abstraction of applicative probabilistic bisimulation for a call-byvalue pure probabilistic λ-calculus. Dal Lago, Sangiorgi and Alberti [START_REF] Lago | On coinductive equivalences for higherorder probabilistic functional programs[END_REF] showed that for their call-by-name probabilistic λ-calculus, applicative probabilistic bisimulation is sound, but not fully-abstract. By contrast, we show here that applicative probabilistic bisimulation is fully abstract for the call-by-value counterpart of their calculus. This result shows a gap between non-deterministic and probabilistic choice, since in a λ-calculus with non-deterministic choice, applicative bisimilarity is not fully abstract neither in call-by-name nor in call-by-value [START_REF] Lassen | Relational reasoning about functions and nondeterminism[END_REF]. We also showed that the asymmetrical counterpart of probabilistic applicative bisimulation-probabilistic applicative simulation-isn't fully abstract in call-by-value, thus highlighting a gap between simulation and bisimulation. This result is a joint work with Dal Lago, and published in [START_REF] Crubillé | On probabilistic applicative bisimulation and call-byvalue λ-calculi[END_REF].

• Full abstraction of applicative probabilistic simulation for call-by-value probabilistic λ-calculus with Abramsky's parallel convergence tester [START_REF] Abramsky | Full abstraction in the lazy lambda calculus[END_REF].

In order to bridge the gap between the context preorder and applicative probabilistic bisimulation, we looked at how to enhance the expressive power of contexts, thus making them able to distinguish more programs. Introducing a programming construct with some sort of non-sequential behavior has often proved successful in the literature to transform a sound model into a fully abstract one-for instance, Plotkin showed that the Scott model of continuous functions is fully abstract for PCF extended with parallel or [START_REF] Plotkin | LCF considered as a programming language[END_REF]. The parallel convergence tester works as follows: it takes two programs as arguments, then evaluate them in parallel, and stops as soon as one of those evaluation stops. This result is a joint work with Dal Lago, Sangiorgi and Vignudelli, and published in [START_REF] Crubillé | On applicative similarity, sequentiality, and full abstraction[END_REF].

• Two trivialization results for a Morris-style context distance-a quantitative generalization of Morris's context equivalence introduced as a way to talk about how far apart two programs are. The context distance trivializes when the context distance between any pair of non-equivalent programs is 1, hence the context distance does not give more information as context equivalence. We show that trivialization occurs as soon as the considered language has copying abilities and moreover at least one of the two following assertions holds: all programs terminates, or Abramsky's parallel convergence tester is present in the language. The proofs are based on the construction of amplification contexts, i.e. contexts powerful enough to transform any small difference in programs behavior into a much bigger one. These results are a joint work with Dal Lago, and published in [START_REF] Crubillé | Metric reasoning about \lambda -terms: The general case[END_REF].

• Definition of fully abstract trace distances for both an affine probabilistic λ-calculus, and a probabilistic λ-calculus with copying abilities that are fully abstract with respect to the context distance on their respective languages. These trace distances are a quantitative generalization of the notion of probabilistic trace equivalence. On the affine λ-calculus, our trace distance is a direct generalizing to the quantitative case of the probabilistic trace equivalence from Dal Lago, Sangiorgi and Alberti. However, the direct way of generalizing trace equivalence lead to a distance which is unsound for the probabilistic λ-calculus where functions have an unrestricted access to their arguments. To overcome this problem, we introduced a different Labeled Transition System to model interactively the operational semantics of the language, with the aim to keep trace of the way different copies of the same program could be used by an external environment. To build this LTS, we started from a probabilistic higher-order language with explicit copying operator, that embeds the more generic probabilistic λ-calculus from Dal Lago, Sangiorgi and Alberti. These results are joint works with Dal Lago and published in [START_REF] Crubillé | Metric reasoning about λ-terms: The affine case[END_REF][START_REF] Crubillé | Metric reasoning about \lambda -terms: The general case[END_REF].

The present thesis also contains contributions about the denotational semantics of probabilistic higher-order languages. Our main focus here is the denotational model of probabilistic coherence spaces, introduced by Danos and Ehrhard [START_REF] Danos | Probabilistic coherence spaces as a model of higher-order probabilistic computation[END_REF], and later shown to be fully abstract for probabilistic PCF by Ehrhard, Pagani and Tasson [START_REF] Ehrhard | Probabilistic coherence spaces are fully abstract for probabilistic PCF[END_REF]. We present here two results that shed light on the structure of this model:

• The exponential comonad of the category of probabilistic coherence spaces (PCoh)-seen as a model of Linear Logic-is the free exponential comonoid, thus making PCoh a Lafont model of linear logic. The exponential comonad ! in Linear Logic transform an object A into an object !A that interpret an unlimited source of objects of type A. In a model of Linear Logic, several distinct exponential comonads may coexist: it is for instance the case in the category of coherence spaces, introduced by Girard [START_REF] Girard | Linear logic[END_REF]. When the free exponential comonoid exists, however, it defines uniquely-i.e. by a universal property from category theory, that specifies it is more generic that any other exponential structure-an exponential comonad. This result gives a category-theoretic justification to the choice of exponential comonad of probabilistic coherence spaces done by Danos and Ehrhard. Our proof use the construction developed by Melliès, Tabareau and Tasson [START_REF] Melliès | An explicit formula for the free exponential modality of linear logic[END_REF] to build a free exponential comonoid in a symmetric monoidal category equipped with finite products. This result is a joint work with Ehrhard, Pagani and Tasson, and was published in [START_REF] Crubillé | The free exponential modality of probabilistic coherence spaces[END_REF].

• The model of PCF equipped with continuous probability, based on measurable cones and stable, measurable functions-introduced recently by Ehrhard, Pagani, Tasson [START_REF] Ehrhard | Measurable cones and stable, measurable functions: a model for probabilistic higher-order programming[END_REF]-is a conservative extension of the model of probabilistic coherent spaces. In particular, we showed that stable functions between discrete cones-i.e. cones that can be expressed as PCSs-are in fact morphisms in the co-Kleisli category of PCoh, that is power series with non-negative coefficients. This result is significant, because it allows to see stable functions between cones as a generalization of analytic functions, and so we can hope to replicate the full-abstraction proof for the probabilistic language PCF ⊕ in the model of probabilistic coherence spaces, with the aim to obtain a full-abstraction proof of PCF extended with continuous probabilities in the model of measurable cones and stable, measurable functions. Our proof use a generalization done by McMillan [START_REF] Mcmillan | Absolutely monotone functions[END_REF] of a theorem from real analysis due to S.Bernstein-presented for instance in [START_REF] Simon | Convexity: An analytic viewpoint[END_REF]-, that we recall at the beginning of this Chapter. The result was published in [START_REF] Crubillé | Probabilistic stable functions on discrete cones are power series[END_REF].

Outline.

The manuscript is divided in three parts:

• In a prelude, we mostly precise our approach, and the operational context which we want to study : in Chapter 1, we present the probabilistic higher-order languages, in Chapter 2 we introduce Morris style context-equivalence, and in Chapter 3 we formalize its generalization into a context distance for probabilistic languages.

• In a second part, we use tools from quantitative transition systems to study higherorder probabilistic programming languages: Chapter 4 is a background chapter, where we present both probabilistic applicative bisimulation and probabilistic trace equivalence as they were introduced by Dal Lago, Sangiorgi and Alberti, and we state the soundness and full-abstraction results already established in the literature. In Chapter 5, we complete this picture by showing various new soundness and full-abstraction results: the more interesting one-as explained there-being full abstraction for CBV probabilistic applicative bisimulation. In Chapter 6, we show our trivialization results for the context distance. In the next Chapter 7, we define probabilistic λ-calculi that allows for a finer understanding of copying: an affine language, where no copying can occur, and a language with an explicit operator for copying. In Chapter 8, we define fully-abstract trace distances for both the affine calculus and the calculus with explicit copying, and we show that in these case the trivialization phenomenon does not occur.

• The third part focus on denotational models of probabilistic higher-order languages.

In Chapter 9, we first give a brief overview of the denotational models developed for probabilistic higher-order languages; then we present in depth two of these models: the model introduced by Ehrhard and Danos for PCF with discrete probabilities based on probabilistic coherent spaces, and the model developed by Ehrhard, Pagani and Tasson for PCF with continuous probabilities using measurable cones and stable measurable functions. While doing so, we will highlight the categorical structure behind those models, i.e. that the first one is build as a model of Linear Logic, and the second one is directly given as a cartesian closed category. Before doing that, we will briefly recall what a model of Linear Logic is, and we will give two standard ways to build one: as a Seely category and as a Lafont model. In Chapter 10, we show that the model of probabilistic coherence spaces is a Lafont model of Linear Logic.

In Chapter 11, we show that the model based on measurable cones and measurable, stable functions is a conservative extension of the one build of probabilistic coherent spaces.

We sum up graphically the structure of the thesis in Figure 1; the arrows indicate the dependencies between chapters.

Prelude Background Chapters Contribution Chapters

Chapter 1: Probabilistic λ-calculi.

Contents

I Prelude.

Probabilistic λ-calculi

In the present chapter, we present several abstract languages that have been introduced in order to model and study higher-order probabilistic computation. They are all based on λ-calculus, a functional higher-order language introduced by Church. In the literature, λ-calculus comes in many flavors: typed or untyped, pure or effectful, with different evaluation strategies... In the first part of this chapter, we recall briefly some basic information about the pure untyped λ-calculus. Through the present thesis, we will be interested only in head-first, weak reduction-i.e. the left-most term is executed first, and no reduction occurs under a λ-abstraction; this paradigm will be precised in Section 1.1 -for the probabilistic λ-calculi we will consider; the reader interested in the study or probabilistic λ-calculi with a strong reduction strategy can look for instance at Thomas Leventis's work [START_REF] Leventis | Probabilistic böhm trees and probabilistic separation[END_REF]. Accordingly, we focus on two evaluation strategies in our presentation of the pure λ-calculus: the head-first, weak call-by-value and call-by-name strategies. In a second part, we do a detailed presentation of Λ ⊕ , the λ-calculus extended with a probabilistic binary choice operator introduced by Dal Lago and Zorzi [START_REF] Lago | Probabilistic operational semantics for the lambda calculus[END_REF]. We will do this presentation in such a way as to highlight the genericity of such a probabilistic extension for a deterministic higher-order language; we will use the same framework later in this thesis to equip with probabilistic primitives various other λ-calculi. In the third part, we present two typed discrete probabilistic λ-calculi with ground types, that have been studied in the literature. The first one is a probabilistic variant of Gödel's System T, that has been studied by Breuvart, Dal Lago and Herrou [START_REF] Breuvart | On higher-order probabilistic subrecursion[END_REF]: we will use it in the present thesis when we will need a probabilistic programming language where all programs terminate with probability 1. The second one is the probabilistic variant of Plotkin's PCF that has been given a fully abstract denotational semantics using probabilistic coherent spaces by Ehrhard, Pagani and Tasson [START_REF] Ehrhard | Probabilistic coherence spaces are fully abstract for probabilistic PCF[END_REF]. Finally, we illustrate how to equip an higher-order language with continuous probabilities by presenting the extension of PCF with continuous probabilistic primitives studied by Ehrhard, Pagani and Tasson in [START_REF] Ehrhard | Probabilistic coherence spaces are fully abstract for probabilistic PCF[END_REF].

1.1 The Pure λ-Calculus Λ λ calculus was introduced by Church in the 1930s, first as a logical formalism, and then as a programming language. It has then been used to design concrete programming language, as for instance Caml or Haskell. It is a functional higher-order language, in the sense that programs represent functions, and that both their input and their output are also functions. As a programming language, λ-calculus is Turing-complete-i.e. every function computable by a Türing machine can be expressed in λ-calculus. It moreover has the benefit of having a very clean mathematical presentation, with very strong connections with the field of logic. We give here a brief overview of the syntax and operational semantics of pure untyped λ-calculus-i.e. without computational effects or ground types-and while doing so we introduce formalism that we will reuse when presenting probabilistic λ-calculi. A more detailed introduction to the λ-calculus can be found for instance in [START_REF] Barendregt | The Lambda Calculus -Its Syntax and Semantics[END_REF].

Syntax of Pure λ-Calculus

The pure λ-calculus is characterized as a set of terms, designed to represent programs, and a family of reduction rules, that specifies how to execute the programs represented by the terms. We first define what terms are: let us suppose that we dispose of a countable set of variables V. We define the set of λ-terms Λ by giving a grammar in BNF (Backus Normal Form, see [START_REF] Mitchell | Concepts in programming languages[END_REF]) that generates it:

M, N, L . . . ∈ Λ ::= x | λx.M | M N when x ∈ V. (1.1)
Observe that there are two constructs in the grammar above: the λ-abstraction construct, and the application construct. A term of the shape λx.M represents a function as follows:

M specify the behavior of the function on an argument represented by the variable x. The application construct models passing an argument N to a function M . If a term is of the shape λx.M , we say that the variable x is bound, meaning it is under the scope of a λ-abstraction. In the following, we will always consider terms up to αequivalence, i.e. up to renaming of the bound variables. If M is a term, and x is a variable that occurs in a non-bounded position-i.e. not under the scope of a λ-abstraction-in M , we will say that x is free in M . We will denote F V (M ) the set of variables free in M . We say that a term is closed, when it does not have free variables. It is only those closed terms which have a computational meaning, in the sense that they can be executed. For this reason, we will call them programs in the following, and we will note P Λ the set of programs.

Operational Semantics for Λ

We have now to specify how these programs should be executed, i.e. their operational semantics. Several distinct choices of reduction rules are a priori admissible: the ones we need to choose depend on the evaluation strategy we want to model, i.e. which part of the program is going to be evaluated first. Observe that we could also choose to give a non-deterministic reduction relation, in such a way that every reduction strategy would then be valid. However, we would have then to consider the question of confluence: does a program has the same computational behavior under all evaluation strategies? In the case of pure λ-calculus, it is well-known that it is actually the case. However, as soon as we make computational effects available, as for instance the ability for the program to read and write, or to do probabilistic choices-as we will do in the next section-the confluence property is lost.

For this reason, we look here only at deterministic reduction relations: at each step of the evaluation of the program, there is only one possible thing to do to go on with the evaluation. More precisely, we will consider through the present thesis two evaluation paradigms, called call-by-name (CBN), and call-by-value (CBV). Both specify head-first, weak reduction-meaning respectively that we first reduce the left-sided term in the application case, and that we never reduce under a λ-abstraction. The difference between them lies in the moment where arguments are passed to functions: in a CBN strategy, we pass terms as argument to functions without evaluating them first, while in a CBV strategy we do the evaluation first. In the literature, strong CBV and CBN strategies-i.e.

where reduction may occur also under λ-abstraction-have also been considered. Weak paradigms present however benefits for concrete programming languages, since it allows for instance to not reduce the body of a function when it is never going to be used. For instance the evaluation strategy in Haskell is weak call-by-name, while in Caml it is weak call-by-value.

We present here CBN and CBV operational semantics for programs in Λ. We do this using the notion of redexes and evaluation contexts, that give us a generic framework to define a reduction strategy that we will be able to reuse when looking at probabilistic λ-calculi. This style of operational semantics was first advocated by Felleisen and Flatt in [START_REF] Felleisen | Programming languages and lambda calculi[END_REF].

CBN and CBV One-Step Reduction Relations for Λ.

The basic reduction rule for Λ-programs is the β-rule, which corresponds to passing an argument to a function. We denote by M {N/x} the term obtained by replacing in M every free occurrence of the variable x by N . To define the β-rule for the call-by-value paradigm, we need first to define formally when a program is a value: for the pure λcalculus, it only happens when it is a λ-abstraction, i.e. it can be written as λx.M . We note V Λ the set of all values: it corresponds to those programs that are already in normal form. (1.2)

(λx.M )V → CBV β M {V /x}, V ∈ V Λ . (1.3)
Looking at Definition 1.1.1 above, we see that when we follow the CBN reduction strategy, the β-rule can be used on an application as soon as the left-sided program is a λ-abstraction, while in the CBV paradigm it is allowed only when both the left-sided and the right-sided programs are values: it models the fact that the argument is evaluated before being passed to the function in CBV, but not in CBN.

Redexes are those programs that can be reduced using directly the β-rule-or more generally by other basic reduction rules when we will consider extensions of λ-calculus. When a program is not a redex, it can possibly contain sub-programs that are redexes in a position of being executed-i.e. not under the scope of a λ. The aim of the evaluation consists in reducing all redexes inside a program until it contains no more executable redexes, and then the program is in normal form. Observe that in a program, there can possibly be more than one redex, hence the evaluation strategy must specify which redex is going to be reduced first. To formalize the evaluation strategy, we use the notion of evaluation contexts. (1.4)

E ∈ E CBV Λ ::= [•] | EM | V E M ∈ P Λ , V ∈ V Λ . (1.5)
Observe that in an evaluation context C, there is exactly one occurrence of the hole [•]. We denote by C[M ] the term obtain when we replace the hole [•] with M in C. A choice of evaluation contexts for some language L is valid when evaluation contexts uniquely specify where the reduction should take place, i.e. any program M that is not in normal form can be written in a unique way as E[R], with R a redex, and E an evaluation context. We can see that it is indeed the case for the evaluation contexts for the language Λ that we presented in Definition 1.1.2 above. We now use the β-rule, and the set of evaluation contexts to define the one-step reduction relation, in a generic way. Observe that our choice of evaluation strategy is entirely encoded into the way we define the β-rules, and the evaluation contexts we take.

Definition 1.1.3 Let S ∈ {CBN, CBV } denoting one of the two evaluation strategies we consider. Then the reduction relation with respect to the strategy S, that we denote → S is the binary relation in P Λ × P Λ defined by the following rule:

M → S β N E ∈ E S Λ E[M ] → S E[N ]
We denote by → the reflexive and transitive closure of →: it means that a step of → corresponds to an arbitrary number of execution steps.

Example 1.1.1 We illustrate Definition 1.1.3 on two prototypical Λ-programs: the program I representing the identity function, and the program Ω well-known to be nonterminating-i.e. its execution loops forever. The identity term is defined as I := λx.x.

Observe that it is a normal form, and moreover for any program M , IM → M , meaning that the function I simply output the argument it has been given as input. The term Ω that we define is the textbook example of a term whose reduction never stops:

Ω := (λx.xx)(λx.xx).
We can see that Ω → S Ω for S ∈ {CBV, CBN }, hence we can indeed see that the reduction of Ω is never going to reach a normal form.

We illustrate now on an example the difference between the call-by-name and the call-by-value strategy.

Example 1.1.2 We define a program M := (λx.I)Ω. If we consider the CBN evaluation strategy, we have M → CBN I, and since I is a normal form it means that the execution stops there. By contrast, when we look at the CBV evaluation strategy, we see that we need to first reduce Ω before doing the β-reduction. As a consequence M → CBV M , hence the execution of M never stops.

Big-Step and Small-Step Operational Semantics

The reduction relations we have defined above talk about exactly one step of execution. We want now to look more globally at program execution by associating to every program the normal form reached at the end of its execution-when it exists. We present here two equivalent ways of doing so: small-step operational semantics and big-step operational semantics. The small-step semantics explicitly uses the one-step execution relation, and iterates here until reaching a normal form. The big-step semantics is more self-contained, and takes a more compositional view of computation: the execution of a program is deduced from the result of the execution of dependent programs. Definition 1.1.4 (Small-step operational Semantics on Λ) Given a reduction relation → on Λ, the operational semantics on Λ with respect to → is the relation ↓ ⊆ Programs × Normal Forms defined inductively using the following rules:

V is a normal form. V ↓ V M → N N ↓ V M ↓ V
Observe that the fact that we have fixed a particular reduction strategy ensures that for every program M , there is at most one normal form V such that M ↓ V . If a program M is such that there is no normal form V with M ↓ V , we will write M ↑: it means that the program M never terminates. On the contrary, we will sometimes write M ↓ to mean that there exists a normal form V such that M ↓ V . Proposition 1.1.1 (Big-step semantics for CBN Λ) The operational semantics with respect to the call-by-name evaluation strategy can be characterized as the smallest relation ↓ verifying the following rules:

λx.M ↓ λx.M M ↓ λx.L L{N/x} ↓ V M N ↓ V
The first rule says that every abstraction is already a normal form. The second one says that, if we have already done the evaluation of M and we have obtained the normal form λx.L, then to evaluate the program M N , we have only to do the β-rule: (λx.L)N → L{N/x}, and then evaluate the resulting program.

We can do the same as Proposition 1.1.1 for the call-by-value operational semantics: in Proposition 1.1.2 we give a big-step characterization of the call-by-value operational semantics: the λ-abstraction rule is the same as for CBN, but the application rule changes, since now we need to evaluate both the left-sided and the right-sided programs before doing the substitution. Proposition 1.1.2 (Big-step semantics for CBV Λ) The operational semantics with respect with the call-by-value evaluation strategy can be characterized as the smallest relation ↓ verifying the following rules:

λx.M ↓ λx.M M ↓ λx.L N ↓ W L{W/x} ↓ V M N ↓ V
This way of looking at operational semantics is called big-step, since we do not consider in the rules just one execution step, but all of them at the same time. In the present thesis, we will consider interchangeably the small-step or the big-step view of operational semantics, depending on which will be more convenient at the time.

Encoding of Basic Data Types in Λ

We present here examples designed both to illustrate the expressive power of λ-calculus, and to introduce programs that will be useful in the examples later in the present thesis. Specifically, we give here an encoding in Λ of booleans and their if-then-else procedure, then we will present an efficient scheme due to Scott for encoding the natural numbers in weak λ-calculus, and finally we will present briefly the fixpoint construction. Unless otherwise specified, the evaluation strategy considered here is the call-by-name ones, but the situation would be similar with the call-by-value strategy. We can see that for every programs M, N :

ITE trueM N → M and ITE falseM N → N.
It means that ITE represents a function that takes three arguments, and behave as follows: when it has true as first argument, it outputs its second argument, while when it has false as first argument it outputs its third argument. In other words, true simulate the boolean true, false simulate the boolean false, and ITE simulates the if-then-else construct.

We now present the Scott encoding of integers in λ-calculus. While the Church encoding is more often used, the Scott encoding is -as highlighted in [START_REF] Lago | The weak lambda calculus as a reasonable machine[END_REF]-more efficient when dealing with weak operational semantics. We then define Λ-programs encoding the successor function, and a case construct.

S := λn.λx.λy.(yn); case := λn.λa.λf.(naf ).

Observe that for every n ∈ N, n is a value, and as a consequence n ↓ n . The programs S , and case allow to encode basic operations on integers. We need now to show that those programs behave as expected with respects to integers, i.e. to look at their operational semantics.

Example 1.1.3 Let be n ∈ N. Then looking at the reduction relation, we can see that:

• S n ↓ n + 1;
• for any programs M , N , it holds that case 0 M N → M ;

• for any programs M, N , it holds that case n + 1 M N → N n .

While there is no recursion operator available in the syntax of pure λ-calculus, we are able to encode it. We present here Curry's fixpoint combinator Y :

Λ ⊕ : A Probabilistic Extension of Λ.

We are now going to present Λ ⊕ , the probabilistic extension of pure λ-calculus designed by Dal Lago and Zorzi in [START_REF] Lago | Probabilistic operational semantics for the lambda calculus[END_REF]. The idea is to add to the pure λ-calculus a binary probabilistic choice operator ⊕. Intuitively, we want the program M ⊕ N behaves with probability 1 2 as M , and with probability 1 2 as N . Formally, it means that the set of Λ ⊕ -terms is generated by the following grammar:

M, N, L . . . ∈ Λ ⊕ ::= x | λx.M | M N | M ⊕ N when x ∈ V.
Here we have simply taken the grammar generating the pure λ-calculus (1.1), and added the probabilistic choice operator to it. Observe that, as a consequence all closed λterms-as for instance those defined in Example 1.1.1 and Example 1.1.5-can also be seen as Λ ⊕ programs.

We need now to endow Λ ⊕ with an operational semantics, to specify how such programs are executed. As previously, we are going to specify a CBN and a CBV evaluation strategies. We are going to follow the same path as we did for the pure λ-calculus: first we are going to define one-step reduction relations, and then we will use them to give the operational semantics.

One Step Reduction Relation.

As before, the one-step reduction relation is meant to talk about one step of execution of the program. However, observe that we need now to take into account the fact that program behavior is now probabilistic. One solution would be to use a probabilistic reduction relation: it is for instance what is done by Ehrhard, Pagani and Tasson [START_REF] Ehrhard | Probabilistic coherence spaces are fully abstract for probabilistic PCF[END_REF] when defining a probabilistic variant of PCF. Here however the approach we take is different: we replace the Λ one-step reduction relation →⊆ P Λ × P Λ between programs by a deterministic relation →⊆ P Λ ⊕ × ∪ i∈{1,2} P i Λ ⊕ between programs and sequences of programs. It means that when M is not a normal form, we will write:

M → N 1 , . . . , N n ,
which is designed to express that M is going to be reduced in each of the N i with probability 1 n .

The Redex Rules

As before, we need first to specify what are the redexes, and the rules to reduce them.

Recall that in Λ, we had only one kind of redexes: the ones of shape (λx.M )N . We now have to deal also with a second kind of redexes: the ones corresponding to the evaluation of a probabilistic choice M ⊕ N . As before, we have to make a decision here regarding the evaluation paradigm: do we want to first do the probabilistic choice and then evaluate the resulting program, or first evaluate both M and N and only then choose fairly between the resulting normal forms ? By analogy with β-reduction, we can see these options respectively as a choice-by-name and choice-by-value. In their original paper on Λ ⊕ , Dal Lago and Zorzi look at a choice-by-value paradigm-with the aim to be coherent with their overall call-by-value reduction strategy. In the present thesis, however, we will only consider choice-by-name-regardless if we consider a call-by-name or call-by-value reduction strategy-because we consider it to be more significant computationally: we want a program M ⊕ N to encode a probabilistic choices between two execution branches represented by M and N , instead of the juxtaposition of these two execution branches followed by a probabilistic choice on values. To illustrate this point, we can look at the program I ⊕ Ω: in choice-by-name, it behaves half the time as I, and never terminates half the time, while in choice-by-value it never terminates. In Definition 1.2.1 below, we define the redex rules for Λ ⊕ . We keep unchanged βreduction rules from Definition 1.1.1, and we add a redex rule corresponding to a choiceby-name paradigm.

CBN R , → CBV R ⊆ P Λ ⊕ × P Λ ⊕ : M ⊕ N → R M, N for S ∈ {CBN, CBV }; (1.6) (λx.M )N → CBN β M {N/x}; (1.7) (λx.M )V → CBV β M {V /x} when V ∈ V Λ . (1.8)
The One-Step Reduction Relation for Λ ⊕ .

The evaluation contexts are built exactly as those defined for the pure λ-calculus-recalled in Definition (1.1.2). We define V Λ ⊕ -the set of Λ ⊕ -values-as the set of all λ-abstractions in Λ ⊕ , and the evaluation contexts for Λ ⊕ in respectively the CBN and the CBV evaluations strategies as follows:

E ∈ E CBN Λ ⊕ ::= [•] | EM, M ∈ P Λ ⊕ ;
(1.9)

E ∈ E CBV Λ ⊕ ::= [•] | EM | V E M ∈ P Λ ⊕ , V ∈ V Λ ⊕ . (1.10)
The following definition is simply the adaptation of Definition 1.1.3 to the probabilistic case: we have now to take sequences of programs into account. Definition 1.2.2 Let S ∈ {CBN, CBN }. The reduction relation on Λ ⊕ with respect to S is defined as:

M → S R N 1 , . . . N n E ∈ E S Λ ⊕ E[M ] → S E[N 1 ], . . . , E[N n ]
We are going to illustrate on an example how we can write reduction for programs that are probabilistic in a intrinsic way, i.e which cannot be written in pure λ-calculus.

Operational Semantics

Recall that in the deterministic case, the operational semantics of a program M is given by a relation M ↓ V , meaning that when we execute the program M , we obtain the value V . However, in a probabilistic setting, when we execute a program, we may obtain several different values with different probabilities. It means that the operational semantics of a probabilistic program cannot consist in a value, but in a sub-distribution of values, designed to indicate for each value, with how much probability we may obtain it when executing the program. We precise in Definition 1.2.3 what we mean formally when we talk about sub-distributions. Definition 1.2.3 We call sub-distribution over a set S any function D : S → [0, 1], such that s∈S D(s) ≤ 1. We call weight of a sub-distribution D, and we denote |D| the quantity s∈S D(s). We say that a sub-distribution is a proper distribution when its weight is equal to 1.

In the following, we will often say simply distributions when talking about sub-distributions.

Observe that a sub-distribution can possibly contain no value at all: we call empty sub-distribution over S, and note ∅ the zero function S → [0, 1]. If s is an element of S, we can construct a distribution giving probability 1 to s: we call s-Dirac distribution, and we denote {s 1 } the function defined by {s 1 }(s ) = 1 if s is equal to s, and {s 1 }(s ) = 0 otherwise. Moreover, if D is a sub-distribution over S, we will call support of D, and we will note S(D) the set of all the s ∈ S with D(s) > 0.

Approximate Operational Semantics

We are now going to explain how we use a one-step reduction relation for Λ ⊕ , for instance the ones we defined before for CBN and CBV reduction strategies, in order to define an operational semantics for Λ ⊕ . The idea is to do it in a similar way to what we have done for the pure λ-calculus in Definition 1.1.4. Recall that the idea was to say: if the program M is already a normal form, then M ↓ M . Otherwise, we do one step of computation, and if the resulting term is evaluated into a normal form V , then M is evaluated in the same normal form V . We are going to adapt this definition to the probabilistic case.

Actually, we are going to give the definition of approximate operational semantics in a generic way, that is for any probabilistic language L ⊕ endowed with a one-step reduction relation → L ⊕ between terms and finite sequences of terms. Definition 1.2.4 can obviously be applied when we take as language Λ ⊕ , with the CBV or the CBN one-step reduction relation. Definition 1.2.4 Let L ⊕ be a probabilistic language, and →⊆ P L ⊕ × ∪ i∈{1,2} P L ⊕ its onestep reduction relation. We define the approximation semantics for L ⊕ with respect to → as the smallest relation ⇒ between programs and sub-distributions over normal forms for → verifying:

Empty M ⇒ ∅.
V is a normal form for →.

NF V ⇒ {V 1 } M → N 1 , . . . , N n (N i ⇒ E i ) 1≤i≤n Step M ⇒ 1≤i≤n 1 n • E i
Observe the second and third rules are similar to the one in Definition 1.1.4 for pure λcalculus. Accordingly, our notion of CBN (CBV) operational approximation semantics for Λ ⊕ can be seen as a probabilistic extension of the CBN (CBV) operational semantics for Λ, in the following sense: if M is a Λ-program such that M ↓ V , then it also holds that M ⇒ {V 1 } when M is seen as a Λ ⊕ -program. We illustrate on an example the role played by the first rule. Moreover, we know that when we consider Λ with a CBN semantics, it holds that true I Ω ↓ I, hence: true I Ω ⇒ {I 1 }.

(1.12) We now use (1.11) and (1.12) to deduce a non-trivial approximation semantics for M . Indeed, we can construct the following valid proof derivation for ⇒:

(1.11)

M → true I Ω , false I Ω.

(1.12)

true I Ω ⇒ {I 1 } false I Ω ⇒ ∅ M ⇒ 1 2 • {I 1 } Observe that in Example 1.2.
2, the first rule of Definition 1.2.4 is used to give up on a branch of the probabilistic execution tree. We see this rule is necessary, because not all branches of this probabilistic tree are necessarily going to reach a value. However, adding this rule forces us to accept that we may give up at any point in the execution tree. As a consequence, for a program D, there may be different sub-distribution D such that M ⇒ D. In particular, we have always M ⇒ ∅, which says that if we decide to stop the execution before the beginning, no value at all is collected. Observe moreover that we cannot be sure that there exists even one of the approximations semantics of a program M that describes completely the possible behavior of M . Indeed, the fact that ⇒ is inductively defined implies that, whenever M ⇒ D, then D has finite support, that is that it always collects only a finite number of values. But it is possible to write Λ ⊕ program whose execution terminates with non-zero probability on an infinite number of different values. We give below an example of such program:

Example 1.2.3 Here, Y corresponds to the fixpoint combinator defined in Example 1.1.4, S and n are the Λ-programs used respectively to encode the successor function and the integer n using Scott's scheme, as we presented in Example 1.1.3. We consider the following program-that we have extracted from [START_REF] Lago | Probabilistic operational semantics for the lambda calculus[END_REF]. Observe that when we execute the program M of Example 1.2.3, we are going to obtain each Scott's numeral n with probability 1 2 n . Accordingly, we would like to obtain as semantics of M the distribution over values D = ∞ 1≤n 1 2 n {n 1 }. However, D cannot be an approximation semantics for M since every approximation semantics has finite support. To overcome this problem, we consider a partial order on the set of sub-distribution over normal-form, in such a way that D will be the least upper-bound of the approximation semantics for M -that are the (D N ) N ∈N as illustrated in Example 1.2.3.

Operational Semantics for Λ ⊕

We define a partial order on sub-distribution over a set, that consists simply in taking the pointwise order. Definition 1.2.5 Let be D, E two sub-distributions over a set S. We say that D ≤ E , if for any s ∈ S, D(s) ≤ E (s).

Looking at the set of sub-distributions over a set S endowed with this partial order, we see that it is a complete meet semi-lattice. Moreover, as shown in [START_REF] Lago | Probabilistic operational semantics for the lambda calculus[END_REF], the set of all approximation semantics for some fixed program M is directed. Lemma 1.2.1 For every program M , the set {D | M ⇒ D} is a directed subset of the set of sub-distributions over normal forms. Lemma 1.2.1 allows us to talk about the supremum of all approximation semantics of M . Accordingly, we take the operational of a program M as the supremum of all its approximation semantics, as stated in Definition 1.2.6 below for a generic probabilistic programming language. Definition 1.2.6 Let L ⊕ be a probabilistic language, and →⊆ P L ⊕ × ∪ i∈{1,2} P L ⊕ its onestep reduction relation. We define the semantics of the program M with respect to → as:

M = sup{D | M ⇒ D},
where ⇒ denotes the approximation semantics relation as defined in Definition 1.2. For pure λ-calculus, we have seen that we could characterize alternatively the operational semantics by way of a big-step definition. We are actually able to do the same for Λ ⊕ . As for the small-step semantics, the idea is to define for every program a family of approximation semantics, and then to take the supremum. It is a non-trivial result, shown in [START_REF] Lago | Probabilistic operational semantics for the lambda calculus[END_REF], that for both the CBN and the CBV strategy, it characterizes the operational semantics for Λ ⊕ as defined in Definition 1.2.6.

CBN Big-step

stop M ⇓ ∅ nf λx.M ⇓ {λx.M 1 } M ⇓ D N ⇓ E prob M ⊕ N ⇓ 1 2 D + 1 2 E M ⇓ D (L{N/x} ⇓ E L ) (L with λx.L∈S(D)) appl-cbn M N ⇓ L D(λx.L) • E L
Observe that, similarly to what happened in the small-step approximation semantics, we need a rule (stop) allowing us to give up on some part of the evaluation of a term. The rule (prob) says that the semantics of a program M ⊕ N is the probabilistic sum of the semantics of M and the semantics of N . The other two rules (appl-cbn) and (nf ) are the probabilistic counterparts of the rules given for pure λ-calculus in Proposition 1.1.1. Bigstep approximation semantics and small-step approximation semantics do not coincide: indeed it is not the case that the same sub-distributions D verify M ⇒ D and M ⇓ D. However, the supremum of these two sets coincide, as shown in [START_REF] Lago | Probabilistic operational semantics for the lambda calculus[END_REF]. That's the sense of Proposition 1.2.2 below.

Proposition 1.2.2 (From [START_REF] Lago | Probabilistic operational semantics for the lambda calculus[END_REF])

Let be M a program in Λ ⊕ . Then M cbn = sup{D | M ⇓ D}.

CBV Big-step Approximation Semantics

We are also able to do something similar to characterize the CBV operational semantics. More precisely, we define ⇓ cbv -the big-step approximation semantics relation for the CBV strategy-by keeping the rules stop, nf, and prob given in Definition 1.2.7, and replacing the rule appl-cbn by the following appl-cbv rule:

M ⇓ D N ⇓ E {L{V /x} ⇓ F L,V } λx.L∈S(D),V ∈S(E ) appl-cbv M N ⇓ D(λx.L) • E (V ) • F L,V
Similarly to Proposition 1.2.2 for the CBN case, it holds that small-step and big-step operational semantics for CBV Λ ⊕ coincide, as shown by Dal Lago and Zorzi [START_REF] Lago | Probabilistic operational semantics for the lambda calculus[END_REF], and stated in Proposition 1.2.3 below:

Proposition 1.2.3 (From [START_REF] Lago | Probabilistic operational semantics for the lambda calculus[END_REF]) Let be M a program in Λ ⊕ . Then

M cbv = sup{D | M ⇓ cbv D}.

Probabilistic Typed Higher-Order Languages

As seen before, we can express some wild programs in Λ and Λ ⊕ , in particular nonterminating programs as Ω. A standard way to tame them, is by adding additional constraints by way of a type system. It may also be convenient to have primitives to handle ground data-for instance natural numbers or booleans-instead of dealing with encodings of those types in untyped λ-calculus. In the present thesis, we will follow this approach in order to obtain probabilistic higher-order languages where all programs terminate with probability 1, or when we will want to have more control on which argument of functions can be copied. We present below two probabilistic higher-order languages with ground types: the first one is a probabilistic variant of Gödel's system T that has been studied by Breuvart, Dal Lago and Herrou in [START_REF] Breuvart | On higher-order probabilistic subrecursion[END_REF], while the second one is a probabilistic variant of the more expressive Scott's PCF, that has been used as base language to define a probabilistic denotational semantics by Ehrhard, Pagani and Tasson [START_REF] Ehrhard | Probabilistic coherence spaces are fully abstract for probabilistic PCF[END_REF].

PCF ⊕ : A Probabilistic Variant of PCF

The language PCF was first introduced by Scott in [START_REF] Scott | A type-theoretical alternative to iswim, cuch, owhy[END_REF] as a formal system, and then an operational semantics was given by Plotkin [START_REF] Plotkin | Lcf considered as a programming language[END_REF]: it is an higher-order typed language with natural numbers as ground type and fixpoint operator. A probabilistic extension of PCF has been first considered by Saheb-Djahromi [START_REF] Saheb-Djahromi | Probabilistic LCF[END_REF]. In the present thesis, we will use the variant considered by Ehrhard, Pagani and Tasson [START_REF] Ehrhard | Probabilistic coherence spaces are fully abstract for probabilistic PCF[END_REF], that is obtained from PCF by adding to it a fair coin primitive-i.e. a program that returns 0 with probability 1 2 , and 1 with probability 1 2 . The overall evaluation strategy of PCF ⊕ is call-by-name, but ground types are used in a call-by-value fashion in the if-then-else construct. We present here only the syntax and the type system for this language; a detail led presentation of the operational semantics can be found in [START_REF] Ehrhard | Probabilistic coherence spaces are fully abstract for probabilistic PCF[END_REF]. There is only one ground type N-that models natural numbers-and an arrow construct, hence the grammar of types is given by: σ, τ ∈ A PCF ⊕ ::= N | σ → τ.

We look now at the syntax of PCF ⊕ -we again consider a fixed countable set of variables V.

M ::= x | n | succ(M ) | if(M, N, z • L) | coin | λx σ .M | M N | fix M where σ ∈ A PCF ⊕ , x ∈ V, n ∈ N.
The fix M construct is an explicit function construct: it is needed because the fixpoint operators from λ-calculus-for instance the Curry fixpoint that we presented in Example 1.1.4-cannot be typed in the PCF type system. As said before, the if-then-else construct is not the standard one in PCF, since in a probabilistic setting we need to handle natural numbers in a call-by-value way, as explained in depth in [START_REF] Ehrhard | Probabilistic coherence spaces are fully abstract for probabilistic PCF[END_REF]. The program if(M, N, z • L) first executes M , then executes N -as expected-when the natural number obtained is 0 . The call-by-value behavior occurs when the natural number obtained is of the form n with n > 0: the program then executes L{ n /z}. This construction was chosen because we want to be able to use the output value of the conditional test when executing the branch modeled by L, and since the execution of M is probabilistic, there is no way to be sure to recompute the exact same value if it is not stored in he variable z.

We now give the typing rules for PCF ⊕ . A typing context is a partial function Γ from variables to A PCF ⊕ , with finite domain; it represents a way to associate a type to each free variable that occurs in an open term. We note Dom(Γ) the domain of the function Γ. If x ∈ Dom(Γ), (x : σ, Γ) represents the function which extends Γ to Dom(Γ) ∪ {x}, by associating σ to x. It is important to notice that for a term fix M to be typable, we need M to be a function-i.e. typable by an arrow type σ → τ . Moreover, observe that the type system do not take probabilities into account; it is obtained from the type system for deterministic PCF simply by adding the rule for the fair coin primitive. It is because we consider probabilistic and non-probabilistic data in the same way. As mentioned in introduction, an alternative typing discipline for probabilistic languages views probability as a monad, this way reflecting the behavior of programs in types: if σ is a type, σ would be the type of probabilistic distributions over σ, and the fair coin operator would always produces elements of type N.

Example 1.3.1 The program Ω from λ-calculus-see Example 1.1.1-is not typable in PCF. However, we can use the fixpoint primitive to build never-terminating programs. We define Ω := (fix x) 0 . We can also easily simulate a fair choice operator ⊕ similar to the one used in Λ ⊕ :

⊕ := λx.λy.if(coin, x, z • y).

We call PCF ⊕ -programs those terms M such that there exists σ with M : σ. In [START_REF] Ehrhard | Probabilistic coherence spaces are fully abstract for probabilistic PCF[END_REF], Ehrhard, Pagani and Tasson give an operational semantics for PCF ⊕ , that associates to every PCF ⊕ -program M of type σ a sub-distribution M over the normal-forms of type σ.

Example 1.3.2

The following type assignments are valid:

• For every type σ, and typing context Γ, Γ Ω : σ;

• ∅ fix ((λz.0) ⊕ λz.((x 0) + 1)) : N → N. 1.3.2 T ⊕ : A Probabilistic Variant of Gödel's System T.
Similarly to PCF, Gödel's T is a λ-calculus with natural numbers as ground type. Contrary to PCF, there is no fixpoint primitive in T, and as a consequence the execution of a program typable in T always stop. Breuvart, Dal Lago and Herrou [START_REF] Breuvart | On higher-order probabilistic subrecursion[END_REF] studied a probabilistic extension of T, such that this termination property still holds. Here, we only present the syntax of T ⊕ , and we state its termination property. The type system and the operational semantics can be found in [START_REF] Breuvart | On higher-order probabilistic subrecursion[END_REF]. The type system of T ⊕ is à la Curry, i.e. without explicit typing annotations in terms. The grammar for types in T ⊕ is as follows: the only ground type is the type for natural numbers, and we can build product types and functional types.

σ, τ ∈ A T ⊕ ::= N | σ → τ | σ × τ.
The syntax of T ⊕ is the one of T extended with a binary fair choice operator ⊕. Definition 1.3.3 The T ⊕ terms are generated as follows:

M ::= x | 0 | succ(M ) | M, N | π 1 | π 2 | rec | M ⊕ N | λx.M | M N, with x ∈ V, n ∈ N.
The type system for this language is the type system for T extended with a rule for the binary choice operator that can be summed up as follows: M ⊕ N is of type σ if and only if both M and N are of type σ.

Γ M : σ Γ N : σ Γ M ⊕ N : σ .
The operational semantics given by Breuvart, Dal Lago and Herrou is call-by-value. The behavior of λ-abstraction and application is as usual in λ-calculi, and the binary fair choice operator ⊕ behaves as the one in Λ ⊕ . The construct M, N represent a pair, and π 1 , π 2 are respectively the left and right projections: if V, W are two values, the one step reduction relation is such that π 1 V, W → V , and π 2 V, W → W . The operator rec is a recursion operator on natural numbers, whose operational behavior is given by the following rules:

rec V, W , 0 → V ; and rec V, W , succ( n ) → V n rec V, W , n .
Observe that contrary to PCF ⊕ , there is no primitive if-then-else construct in T ⊕ . However, it can be easily encoded in T ⊕ using the recursion operator. Accordingly we will consider to have such a primitive available when using the language T ⊕ in Chapter 6.

Definition 1.3.4 Let L ⊕ be a probabilistic programming language, equipped with an operational semantics • . We say that L ⊕ is almost surely terminating (AST) when for every program M , it holds that | M | = 1.

Proposition 1.3.1 (From [START_REF] Breuvart | On higher-order probabilistic subrecursion[END_REF]) The language T ⊕ is AST.

The authors of [START_REF] Breuvart | On higher-order probabilistic subrecursion[END_REF] actually showed a much stronger result-that all the branches in the execution tree have finite length-but we will need only the almost-sure termination property in the present thesis.

1.4 Extending λ-calculus with Continuous Probabilities.

As highlighted in Introduction, in some cases we want to model systems where the underlying space of events has inherent continuous aspects: for instance in hybrid control systems [START_REF] Alur | Hybrid Systems III: Verification and Control[END_REF], as used e.g. in flight management. In this Section, we look at how to extend higher-order language extended with primitives designed to model continuous probabilities.

First, we will recall basic concepts of measure theory-needed to handle continuous probability distributions in a rigorous way-and then we will present the language PCF sample introduced by Ehrhard, Pagani and Tasson [START_REF] Ehrhard | Measurable cones and stable, measurable functions: a model for probabilistic higher-order programming[END_REF] as a continuous probabilistic extension of PCF.

Overview of Measure Theory

Before now, we were considering discrete probabilities, and consequently we were able to handle distributions over a countable set X in rather informal ways: they are those functions D : X → [0, 1] such that x∈X D(x) = 1. Suppose now that f is a function X → R, and that we are interested in the average value of the following procedure: first we sample from the distribution D, and then we apply f to the obtained value. Then this average value-the expected value of f with respect to D-can be computed as x∈X f (x) • D(x). That's because defining a distribution over a countable set means assigning a probability to every element of this set. However, when X is not countable, it is not always possible to do that: indeed when we consider for instance the uniform distribution U over [0, 1], we see that for every element a ∈ [0, 1], the probability of obtaining exactly a when sampling from U is 0. Therefore, what we want to do in that case to describe this distribution is to assign probability not to single points anymore, but to intervals: that way, we can say that for every a, b with a ≤ b, the probability of obtaining an element in [a, b] when sampling from U is b -a. Now, to compute the expected value of a function f : [0, 1] → R, we need to use an integral instead of a discrete sum: indeed this expected value may be computed as x∈[0,1] f (x) • dx. Measure theory allows to generalize the ideas behind continuous probability beyond the real case. It provides a general framework to talk about probabilities and integration on a large class of spaces, called measurable spaces. We review the basics ideas here, but the reader should refer for instance to [START_REF] Schechter | Handbook of Analysis and its Foundations[END_REF] for a more complete presentation of this field.

In the setting of measure theory, specifying a probability distribution means to assign some non-negative real to some subsets-seen as event sets, and called the measurable subsets. There are however constraints on the collection of measurable subsets we can choose, namely that they have to form a σ-algebra. Definition 1.4.1 (Measureable Spaces) A σ-algebra-also called σ-field-over a set S is a collection Σ ⊆ Parts(X), such that:

• ∅ ∈ Σ; • For every countable family (A n ) n∈N , with A i ∈ Σ, 1≤i≤n A i ∈ Σ; • For every A ∈ Σ, X \ A ∈ Σ.
We call measurable space a pair (X, Σ), where Σ is a σ-algebra over X. If Ω = (X, Σ) is a measurable space, we will use x ∈ Ω to means x ∈ S, and A a measurable subset of Ω to means that A ∈ Σ. We call measurable those function f : X → Y , such that for every

A ∈ Σ X , it holds that f -1 (A) ∈ Σ Y .
A useful fact is that from any collection of subsets, we can form a σ-algebra by considering the closure by countable unions, countable intersections and relative complement. It allows us to construct the smallest σ-algebra containing this collection.

Proposition 1.4.1 Let X be a set, and Θ ⊆ Parts(X) a collection of subsets of X. Then there exists a smallest σ-algebra containing Θ, that we call the σ-algebra generated by Θ.

Example 1.4.1 (Borel σ-algebra) For any topological space X, the Borel σ-algebra is the smallest σ-algebra over X containing all open sets. In the particular case where we consider X to be R with the usual topology, the Borel σ-algebra coincides with the smallest σ-algebra that contains intervals.

We call measurable functions R n → R k the functions measurable when both R n and R k are endowed with the Borel Σ-algebra associated with the standard topology of R. The relevant properties of the class of measurable functions R n → R k is that they are closed under arithmetic operations, composition, and pointwise limit, see for example Chapter 21 of [START_REF] Schechter | Handbook of Analysis and its Foundations[END_REF]. Definition 1.4.2 (Measure over a Measurable Space) Let (X, Σ) be a measurable space. A measure over (X, Σ) is a function ν : Σ → [0, ∞] such that:

• ν(∅) = 0 • for every countable collection (A i ) i∈N of pairwise disjoint A i ∈ Σ: ν( i∈N A i ) = i∈N ν(A i ).
When ν(X) < ∞, we say that ν is a finite measure. When moreover ν(X) ≤ 1, we say that ν is a sub-distribution over X, and we say that ν is a (proper) distribution when ν(X) = 1. We note Meas((X, Σ)) the set of all measures over the measurable space (X, Σ).

As said before, one of the main purposes of measure theory is to generalize the Riemann integral well-known for real functions. We fix here a measurable space(X, Σ X ), and ν is a measure over X, and we equip R with the Borel algebra. To every measurable function f : X → R + , a quantity X f • dν ∈ R + ∪ {+∞} is defined, call the Lebesgue integral of f with respect to ν. We do not recall here the construction or properties of the Lebesgue integral, but all results needed for our purposes may be found in [START_REF] Schechter | Handbook of Analysis and its Foundations[END_REF]. If f : X → R is a measurable function, f is Lebesgue-integrable with respect to ν when X |f | • dν < +∞, and we note L 1 ν (X) the set of those functions. Measure theory also allows us to recover the intuitive view of discrete probability theory, as we highlight now.

Example 1.4.2 Let X be a countable space. Then Parts(X) is the smallest σ-algebra that contains the atoms {a} for every a ∈ X. We call it the generic σ-algebra over X, and we call measurable spaces of the form (X, Parts(X)) discrete measurable spaces. Proposition 1.4.2 Let S be any countable set, equipped with the generic σ-algebra over S. Then it holds that:

• if X is a measurable space, every function f : S → X is measurable;

• for every measure µ on S, and f :

S → R, f • dµ = s∈S f (s) • µ(s).
A measure on a discrete measurable space is entirely characterized by its values on atoms: indeed, for any A ∈ Parts(S), we can write A as the countable disjoint union a∈A {a}, and consequently µ(A) = s∈A µ({a}). It means that on a discrete space, a measure can be seen simply as a function µ : S → R + ∪ {∞}.

Lemma 1.4.3 Let S be a countable space, and f : S → R + ∪ {∞}. Then µ f : Parts(S) → R + ∪ ∞ defined as µ f (A) = s∈A µ({a}) is a measure over (S, Parts(S)), and moreover:

• µ f is a finite measure, if s∈ § f (s) < ∞; • µ f is a distribution if s∈ § f (s) = 1; • µ f is a sub-distribution if s∈ § f (s) = 1.
Proof. We verify easily that µ f is a measure: indeed µ f (∅) = 0, and for every countable collection of pairwise disjoints

A n ∈ Parts(S), it holds that µ f ( n∈N A n ) = n∈N µ f (A n ).
Moreover,µ f (S) = s∈S f (s), which concludes the proof.

The Language PCF sample

An example of higher-order language that handles continuous probability distributions is PCF sample , defined by Ehrhard, Pagani and Tasson in [START_REF] Ehrhard | Measurable cones and stable, measurable functions: a model for probabilistic higher-order programming[END_REF]. PCF sample can be seen as a continuous counterpart to PCF ⊕ , where the ability to flip a fair coin is replaced by the possibility to sample from the uniform distribution on [0, 1]. As such, it does not offer the full range of continuous probabilistic primitives that other languages [START_REF] Borgström | A lambda-calculus foundation for universal probabilistic programming[END_REF][START_REF] Staton | Semantics for probabilistic programming: higher-order functions, continuous distributions, and soft constraints[END_REF] often consider, for instance the score primitive used for Bayesian conditioning. An investigation on the expressiveness of PCF sample with respect to these probabilistic primitives can be found in [START_REF] Ehrhard | Measurable cones and stable, measurable functions: a model for probabilistic higher-order programming[END_REF]. The base type of PCF sample is the real type R, and types are generated by:

σ, τ ∈ A PCF sample ::= R | σ → τ.
The terms of the language are generated by the grammar below:

M, N ∈ PCF sample ::= x | λx σ .M | M N | fix M | let(x, M, N ) | if(M, N, L) | r | sample | f (M 1 , . . . , M n ),
where r is any real number, and f is in a fixed countable set of measurable functions R n → R. The constant sample stands for the uniform distribution over [0,[START_REF] Abramsky | Observation equivalence as a testing equivalence[END_REF]. Observe that since we can choose arbitrarily the countable set of measurable functions we take as primitives, we can encode classical probability distributions as soon as they can be obtained in a measurable way from the uniform distribution, as it is for instance the case for Gaussian or normal distributions. Moreover, we can argue that this language is also more general than PCF ⊕ : first it allows to encode integers (since N ⊆ R) and basic arithmetic operations over them. Secondly, since the order operator ≥: R×R → {0, 1} ⊆ R is measurable, we can construct in PCF sample a program that simulates the fair coin as follows: ≥(sample, 1 2 ).

In [START_REF] Ehrhard | Measurable cones and stable, measurable functions: a model for probabilistic higher-order programming[END_REF] Ehrhard,Pagani and Tasson formalize the operational semantics for PCF sample . They give a call-by-name semantics, but the let construct allows to simulate for instance the non-standard if-then-else construct of PCF ⊕ . Recall that for any PCF ⊕ -term M of type τ , M is a discrete distribution over normal forms of type τ . Accordingly, if M is now a PCF sample -term of type τ , M should be a continuous probability distribution of the values of type τ . However, as we highlighted when presenting the basic principles of continuous probabilistic reasoning, to talk about a continuous probability distribution on some set X, we have first to specify which σ-algebra on X we consider. For this reason, the first step if the construction of an operational semantics for PCF sample [START_REF] Ehrhard | Measurable cones and stable, measurable functions: a model for probabilistic higher-order programming[END_REF] is to define, for each type τ , a σ-algebra over each set of normal forms of type τ , and then the operational semantics is built as a Markov process on this probabilistic space.

Chapter 2

Observational Equivalence

Having a good-and usable in practice-notion of program equivalence is a problem that appears very often in computer science: for example, when we want to check that a program implements a given specification, or that a compiled program is equivalent to the original program. When the two programs considered output data of ground type-e.g. booleans or integers-it is sufficient, while not necessarily easy, to look at whether they output the same value-or, in the probabilistic case, the same distribution over values. However, we consider here higher-order languages, hence the result obtained after evaluating a program can itself be a function. To illustrate this point, let us consider for instance the two Λ-programs λx.x and λx.(λy.y)x: since we are in a weak evaluation paradigm-see our presentation of Λ in Chapter 1-those two programs are already in normal form. These normal forms are distinct, but whenever we pass them an argument M , the resulting terms (λx.x)M and (λx.(λy.y)x)M have the same operational semantics: it is an example of two programs that reduce to distinct values but that we nonetheless would like to see as equivalent.

This idea leads to the notion of context equivalence, that was formalized by Morris [START_REF] Morris | Lambda-calculus models of programming languages[END_REF]: we say that two programs are equivalent if they have the same observable behavior in any context. In this chapter, our goal is to formalize Morris context equivalence in the setting of a generic probabilistic programming language. Observe first that in order to instantiate this definition on a particular language, we need to decide what is an observable behavior, and what is a context.

Observables

We first have to specify what is the observable behavior of a program. It depends on the language we consider, as well as the distinguishing abilities we want to give to the observer. For example, if we allow the observer to count the number of execution steps, then two programs with different running times would never be equivalent. Such a notion may be of interest-e.g. in computational cryptography, where side-channel attacks can be executed by adversaries with this ability-but in the present thesis, we will never allow observers to distinguish between programs that output the exact same data, no matter how much time they take to produce it.

Deterministic Case:

Let us first consider the pure λ-calculus Λ, with the weak reduction paradigm that we describe in Chapter 1. Recall that here our programs are actually closed λ-terms. The 2.1. OBSERVABLES reasonable thing to observe in this setting is program termination: consequently, we formalize our notion of observables by a function Obs() : P Λ → {0, 1}, such that for any closed λ-terms M , we define:

Obs(M ) = 0 if M ↑ 1 if M ↓ ∈ {0, 1}.
Observe that {0, 1}-which can be seen as the set of observations-is naturally equipped with an order structure. It allows us to talk not only about observational equivalence, but also about the observational preorder. If we compare for instance the observable behavior of the non-terminating program Ω and the identity function I-both defined in Example 1.1.1 of Chapter 1-we see that 0 = Obs(Ω) < Obs(I) = 1: it means that Ω ≤ obs I, and that Ω and I are not context equivalent-where ≤ obs is the observational preorder that we will formally define in the next section. The above definition is suitable for the untyped λ-calculus. If we consider a typed higher-order language L with ground types, for example PCF, we can also wish to allow observations only at ground type-e.g. at type Bool. Formally, it means that the observation becomes two functions that express whether a program of type Bool stops on respectively true or false:

Obs T (), Obs F () : {M ∈ P L | M : Bool} → {0, 1}.

Non-deterministic Case:

We now look briefly at how the above notion of observation should be adapted for nondeterministic higher-order languages, for instance the pure λ-calculus extended with a binary non-deterministic operator ⊕. Observe that we cannot say anymore that a program either terminates or has a non-terminating run. Actually, we have to choose between observing the may-convergence, that is the fact that at least one run of the program terminates, or the must-convergence, that is the fact that every possible run of the program terminates. Observational equivalence for both may-convergence and must-convergence have been investigated in depth by Lassen [START_REF] Lassen | Relational reasoning about functions and nondeterminism[END_REF], as well as coinductive methods for studying equivalence in a non-deterministic setting.

Probabilistic Case:

When we pass from the non-deterministic case to the probabilistic case, we see a change in the nature of the observables: they are not binary anymore, but quantitative. Indeed, a probabilistic program terminates with a given probability, that can be strictly between 0 and 1. Formally, we define a function Obs() :

P Λ ⊕ → [0, 1] as: Obs(M ) = Prob(M ↓) ∈ [0, 1].
It is the fact that observables are now quantitative that will allow us later to extend the notion of observational equivalence to metrics, because now we can compare the observables of two programs, and talk about how far they are, instead of just look at if they coincide or not.

Observe, that as in the probabilistic case, if we are considering a probabilistic λcalculus with base type (for example, a probabilistic variant of PCF), we can also restrict the observed program to consider only the type Bool, and then we take as observables the sub-distribution over the booleans obtained when evaluating the program.

CONTEXTS

Contexts

Contexts are meant to represent every way the environment can interact with the program. Here, we consider that the environment itself consists in agents that use the same programming language. Since languages that we consider are compositional, we can express that by saying that the environment is a term of a language with a hole inside, that is replaced by the program at the time of the interaction. This idea give us a generic way to construct, for a compositional language L (where L is one of the variation around the λ-calculus we are considering here), a set C L of contexts for L.

We give here formally the grammar generating contexts in C Λ ⊕ when we take as language the probabilistic λ-calculus:

C ∈ C Λ ⊕ ::= [•] | λx.C | CM | M C | C ⊕ M | M ⊕ C.
We will denote as C[M ] the term obtained by replacing the hole [•] by M . We would like the execution of C[M ] to correspond to the interaction between the execution environment C and the program M . Observe, however, that we have to be careful here: for this to be the case, we need to be able to certify that C[M ] is indeed an executable program, that is a closed term: it means that every free variable in M has to be bounded by the context.

To do that, we introduce closeness judgment on contexts, which are of the forms:

x 1 , . . . x n C.
It is designed to mean: for any term with free variables among the x 1 , . . . , x n , then C[M ] is a closed term. To design such ordered family of distinct variables x 1 , . . . , x n , we will use the notation x, and we will denote by V the set of all such families. We will denote by x, x the appending of x to the list x, where x is distinct of all elements in x. We define validity for judgments of this form by inductive rules on the structure of C, that can be found in Figure 2.1. Observe that, if we consider a typed

[•] x C x ∈ x x, x λx.C x C x M C x C x CM x C M ∈ P x C ⊕ M x C M ∈ P x M ⊕ C Figure 2.1: Closeness Judgment for Λ ⊕ contexts.
language, we will have to certify that the resulting program is well-typed too, and so we have to replace our closeness judgment on contexts by well-typed judgments on contexts.

Observational Equivalence

We are now ready to give the definition of observational equivalence. We first formalize the minimal requirements that must hold for a programming language so that our definition of observational equivalence will make sense: we need a notion of programs, a notion of contexts and a notion of observables, Definition 2.3.1 An untyped observable programming language consists of:

• a set of terms Terms, built from the variables V and syntactical constructs, and a function F V () : Terms → V that denotes the free variables of a term;

• a notion of observation for programs: i.e. Obs() : P → O, where P is the set of closed terms, and O is a set of possible outcomes for the observation function;

• a notion of contexts: i.e. for each family of variables x, a set C x of contexts-where a context is formally a function Terms → Terms-such that for every term M with

F V (M ) ⊆ x, C[M ] ∈ P.
When we consider a typed language, we have to take into account the fact that, as mentioned in Section 2.1, the observation is not necessarily done at all types.

Definition 2.3.2 A typed observable programming language consists of:

• a set of terms Terms, built from the variables V and syntactical constructs, a set of types A and a set of valid typing judgments of the form Γ M : σ, where σ is a type in A , and Γ a typing context of the form x 1 : σ 1 , . . . , x n : σ n ;

• a set of observables types A obs , a set of possible outcomes for the observation O, and a notion of observation for programs: i.e. for every σ ∈ A obs : Obs σ () : {M ∈ P σ } → O, where P σ = {M | M : σ}.

• a notion of contexts: i.e. for each typing context Γ, types σ, τ , a set C (Γ,σ)→τ of contexts C such that for every term M with Γ M : σ, C[M ] ∈ P τ . We will also note Γ, [•] : σ C : τ to mean that C ∈ C (Γ,σ)→τ .

Two terms M and N are observationally equivalent if, no matter which contexts we consider, we obtain exactly the same observables. We have however to be careful: the set of contexts we consider depends on the free variables of the terms we want to compare. For these reasons, we work with generalizations of relations, that we call open relations with respect to the language L: those are families of relations R = (R x ) x∈V over terms of L, indexed by families x of variables. Moreover, we will also note x M RN for denoting M (R x )N .

We extend now the usual notions of reflexivity, symmetry and transitivity to open relations.

Definition 2.3.3 Let be R an open relation with respect to the language L. We say that R is:

• reflexive, if for any M , for any x such that the free variables of M are among the x, it holds that x M RM ;

• transitive, if for any x ∈ V,for any M, N, L with x M RN and x N RL, it holds that x M RL;

• symmetric, if for any x ∈ V,for any M, N with x M RN , it holds that x N RM . We give below the generic definition of observational equivalence for a language L with an observables function Obs(), and a set of contexts C. Definition 2.3.4 (Observational Equivalence) Let L be an untyped observable programming language, with (C x ) x∈V its contexts. The observational equivalence ≡ L is the open relation with respect to L defined by: for x = x 1 , . . . , x n a family of variables of L, and M , N two terms of L with free variables among the x 1 , . . . , x n , it holds that x M ≡ obs L N , when:

∀C ∈ C x , Obs(C[M ]) = Obs(C[N ]).
We can see that ≡ L,C is indeed an open equivalence relation. We will say that M and N are observationally equivalent-or context equivalent-if there exists a family x of variables with x M ≡ L N .

We are now going to give some examples. We take here L as the probabilistic language Λ ⊕ . In the case of the (deterministic) λ-calculus, the evaluation strategy we choose has no effect on the equivalence between terms (it comes from the fact that the calculus is confluent). However, it is not the case anymore in the probabilistic case, as we are going to illustrate here by two examples. Observe that the difference between these two terms is the place where we do the probabilistic choice: in the left term, the probabilistic choice is done when the term is evaluated, while in the right term, it is done when we pass an argument to the program and evaluate the result.

Let us first place ourselves in a call-by-value strategy. We consider the context:

C = (λy.(yI)(yI))[•].
Using the definition of operational (CBV) semantics for Λ ⊕ in Chapter 1, we can see that:

C[M ] CBV = 1 2 {I 1 }, and C[N ] CBV = 1 4 {I 1 }.
Observe that, when we know the semantics of a program L, then we know Obs(L): indeed, Obs(L) is the probability of termination of L, which is exactly the weight of the sub-distribution L . As a consequence, we can see that: Obs(C[M ]) = 1 2 , and similarly Obs(C[N ]) = 1 4 : it shows that M and N are not observationally equivalent for a CBV evaluation strategy.

In Example 2.3.2 below, we are going to consider the same terms as in Example 2.3.1 above, but in the setting of a CBN evaluation strategy. We are going to see that, contrary to the CBV case, these two terms are equivalent.

Example 2.3.2 (CBN Evaluation Strategy) Observe that the context C used in Example 2.3.1 can not anymore be used to distinguish M and N : indeed, we can see that

C[M ] CBN = C[N ] CBN = 1 4 {I 1 }.
Actually, no context is going to work, because M and N are observationally equivalent for a CBN semantics. To show that, we need to show that every context C is unable to distinguish them, that is

| C[M ] | = | C[N ] |.
Recall that the definition of • is based on the definition of an approximation semantics ⇓. It means that, to do the proof of equivalence, we need to use the approximation semantics. More precisely, we have to show that for any approximation semantics D of C[M ], we can find an approximation semantics E of C[N ] of at least as much weight as D, and reversely. Formally, we can see that for every terms L such that F V (L) ⊆ x: We now give the definition of observational equivalence for a typed language. We call open typed relations with respect to the language L the families of relations R = (R (Γ,σ) ) Γ a typing context,σ∈A , where R Γ,σ is a relation over the set of those terms M such that Γ M : σ. Moreover, we will also note Γ M RN : σ for denoting M (R (Γ,σ) )N . Definition 2.3.5 (Observational Equivalence for typed Languages) Let L be an typed observable programming language, with (C (Γ,σ)→τ ) x∈V its contexts. The observational equivalence ≡ L is the open typed relation with respect to L defined by: for Γ a typing context, and σ a type, the relation ≡ (Γ,σ) ⊆ {M | Γ M : σ} 2 is defined as:

•
x M ≡ obs L N when: ∀τ ∈ A obs , C ∈ C (Γ,σ)→τ , Obs τ (C[M ]) = Obs τ (C[N ]).

On the Observational Equivalence on Open Terms

In Definition 2.3.4, we were considering all terms in the language, even those which are not closed. However, in this section, we are going to argue that it is actually sufficient to look at the equivalence between programs, i.e. closed terms: the idea is that, if we know everything on the equivalence between programs, then we are able to deduce if any two terms are equivalent or not. Let us suppose that we consider a language L such that: for any open terms M , and any family of variables x 1 , . . . , x n containing the free variables of M , it holds that M is observationally equivalent to (λx 1 . . . . λx n .M )x 1 , . . . , x n . It is a reasonable thing to ask, since these two terms are β-equivalent. In particular, we can see that it is the case for Λ ⊕ with the CBV or CBN semantics.

With this hypothesis, it can be seen that the following holds:

x 1 , . . . , x n M ≡ obs L N ⇔ (λx 1 . . . . λx n .M ) ≡ obs L (λx 1 . . . . λx n .N )
These considerations will allow us, in the following, to focus on equivalence relation on programs. In particular, the coinductive definition of applicative bisimularity, that we will give in Chapter 4 for Λ ⊕ , doesn't take open terms into account.

Context Preorder

We would like also to express the fact that, no matter its execution environment, a program is going to terminate more often than another. That is the sense of the observational context preorder, which consists in an asymmetrical version of the observational equivalence.

Definition 2.3.6 Let L be an untyped observable programming language. Let x 1 , . . . , x n be a family of variables of L, and M , N two terms of L with free variables among the x 1 , . . . , x n . We write x 1 , . . . , x n M ≤ obs L N , and we say that M is observationally smaller than N , when for every C ∈ C with x 1 , . . . , x n C it holds that:

Obs(C[M ]) ≤ Obs(C[N ]).

Go Beyond Observational Equivalence

As explained in the previous chapter, two programs are observationally equivalent if they have exactly the same behavior in any context. However, when we consider quantitative languages, for instance probabilistic languages, we could wish to be able to talk about not only equivalent programs, but also close programs, i.e. programs that behave almost the same way. We are going to illustrate this idea in Example 3.0.1 below.

Example 3.0.1 For every ∈]0, 1], we define:

M := Ω and N := Ω ⊕ I.
Observe that, when become very small, M and N have almost the same behavior: the program M never terminates, when N terminates with the very small probability . However, it is immediate that these two terms are not equivalent whenever > 0, since it is sufficient to consider the evaluation context [•] to distinguish them.

We would like to be able to use the quantitative difference between the observables to define a metric about terms: when we consider two programs, we want to know how far they are from each other. In that end, we are going to introduce a metric generalization of the observational equivalence in Section 3.1 below.

Observational Metric

We consider from now on a probabilistic programming language, hence a language with observation outcomes the set O = [0, 1]. The idea is to say that the context C is able to distinguish two terms M and N as far as |Obs(C[M ]) -Obs(C[N ])|, and then, similarly to the observational equivalence, we say that the observational distance between M and N is the supremum of how far any context can distinguish them. We need first to transform the open relations that we considered in Chapter 2 into open quantitative valuations. Definition 3.1.1 A quantitative valuation on a set X is simply a function q : X × X → [0, 1]. An open quantitative valuation with respect to a language L ⊕ is a family (q x ) x∈V , where for each x, q x is a quantitative valuation on the terms M with F V (M ) ⊆ x. Definition 3.1.2 Let L ⊕ be an untyped observable programming language, with [0, 1] as set of possible observation outcomes. We define δ ctx L ⊕ as the open quantitative valuation with respect to L ⊕ defined as: for every set of variables x, and M , N two terms of L ⊕ with free variables among the x,

δ ctx L ⊕ ,x (M, N ) := sup{|Obs(C[M ]) -Obs(C[N ])| with C ∈ C x }.
Observe that the observational distance behaves indeed as a distance, in the sense that is symmetric, reflexive, and verify the triangular inequality. Formally, it is exactly what is required to be a pseudo-metric, in the mathematical sense. Definition 3.1.3 Let S be any set. We say that a function q : S × S → R + is a pseudometric if:

• q is reflexive, i.e. for every x ∈ S, q(x, x) = 0;

• q is symmetric, i.e. for every x, y ∈ S, q(x, y) = q(y, x);

• the triangular inequality holds for q, i.e. for every x, y, z ∈ S, q(x, z) ≤ q(x, y) + q(y, z).

Moreover, we can recover the observational equivalence from the observational distance, since the observational equivalence is exactly the kernel of the observational distance-i.e. two programs M and N are observationally equivalent if and only the observational distance between them is 0. It means that the observational distance encodes at least as much information as the observational equivalence. We are going to illustrate Definition 3.1.2 here on a simple example: we are going to consider the two terms I and Ω. We know already that they are not equivalent, but we now look at how much different they are. We have seen that I and Ω are as far as possible with our definition of distance. Now, we are going to look at what happens when we consider programs that are intuitively between I and Ω: we consider the terms N = Ω ⊕ I, as in Example 3.0.1. Recall that we showed in Example 3.0.1 that the N and Ω were not equivalent by considering the context C. Using the same context, we see in Example 3.1.2 below that it gives us also quantitative information, i.e. that the distance between Ω and N is greater or equal to .

δ ctx Λ ⊕ (Ω, N ) ≥ and δ ctx Λ ⊕ (I, N ) ≥ (1 -).
Observe that, in Example 3.1.2, we show a lower bound on the distance between the programs we were considering. It is much more complicated to show an upper bound, since to do that, we have to consider the separation induced by every possible context. We can notice that, the more expressive power we allow to contexts, the more the distance between two given terms may decrease, since then the contexts are able to do more tests to separate the terms.

We look now at the observational distance for a typed probabilistic language L ⊕ . We work here with typed open quantitative valuations, i.e. family of quantitative valuations (q (Γ,σ) ) Γ a typing context,σ∈A where each q (Γ,σ) is a quantitative valuation over {M | Γ M : σ}. Definition 3.1.4 Let L ⊕ be a typed observable programming language, with [0, 1] as set of possible observation outcomes. We define δ ctx L ⊕ as the open quantitative valuation with respect to L ⊕ given by:

∀M, N with Γ M :, N σ, δ ctx L ⊕ ,(Γ,σ) (M, N ) := sup τ ∈A obs {|Obs τ (C[M ])-Obs τ (C[N ])| with C ∈ C (Γ,σ)→τ }.

The Trivialization Problem

We argued, as a motivation to look at the distance, that it would allow us to express quantitative information, and not only whether two terms are equivalent or not. However, observe that it is not immediate that the observational distance is something else that an equivalence: depending of the expressive power of the contexts, they can indeed achieve to amplify every small difference to separate completely two terms.

Amplifying the Observed Distance by Copying

We are going to illustrate here, on an example, how, from a small difference in the semantics of two terms, it is sometimes possible to construct contexts that amplify it. Recall that we have shown in the previous section, that the distance between I and N = Ω ⊕ I is at least (1 -). We are going to show that, if the class of C we consider is expressive enough, then the distance between I and N is actually 1 when > 0. As a consequence, the separation induced by the context C n between I and N is (1-n ). By taking the supremum over all these context C n , we see that the observational distance between I and N is 1.

We can see that if we take C Λ ⊕ (defined in 2.2) as our class of contexts, it will verify conditions of Example 3.2.1: indeed it has as much expressive power as the language Λ ⊕ itself. More generally, observe that the important point here is the ability of copying of contexts: the idea is, if we are able to build a context C separating a little two programs, then we can build a context that has the same behavior as several sequential copies of C.

Amplification Contexts

We can see that the behavior illustrated in Example 3.2.1 is not specific to the terms I and Ω ⊕ I. More generally, if we have two closed terms M, N , and that we have been able to construct a context D, such that Obs(D[M ]) = 1, and Obs(D[N ]) = (1 -), with < 1, we can use the family of contexts C n to amplify this distance . Indeed,it holds that the separation induced between M and N by the context

C n [D] is always (1 -(1 -) n ).
It means that the family of contexts C n gives us a generic way to amplify a difference between two terms that we have already been able to observe. For this reason, we say that the family of contexts C n defined in Example 3.

Trivialization

By looking at Example 3.2.1 and 3.2.2, we see that in some circumstances, even a small difference in the behavior of two programs can be amplified until the maximal distance, but that building such amplification contexts can be complicated depending on the expressive power of the language, and on the programs we consider.

Actually, observe that it is not direct (and actually not always true, depending on the language we consider), that there exist terms such that the distance between them is not 0 or 1. Definition 3.2.1 Let be L a language, and C a class of contexts. We say that the observational distance on L with respect to the class C trivializes, if for every comparable programs M, N of the language, δ ctx (M, N ) ∈ {0, 1}.

Observe that, if we know that the observational distance trivializes, it means that it is exactly the same thing as the observational equivalence. It means that trivialization of the observational distance can be seen as some kind of negative result, since it proves that it is not possible to talk about quantitative information about the similarity in terms, for a given language and class of context. It may also be seen as an indication that the class of context we consider is very expressive, and possibly too much to obtain the quantitative information we want.

Link with Cryptography

Here, we highlight a motivation for our developments on metrics, coming from security, in order to give intuition of what kind of quantitative information we may want. A central notion in security is the notion of computational indistinguishability: two programs are computationally indistinguishable, if for any adversary running in polynomial time, the advantage of the adversary is a negligible function of the security parameter. The advantage of the adversary is then defined as the probability for the adversary to be able to recognize if it interacts with the program M or with the program N . We can relate out notion of observational distance with computational indistinguishability by seeing the adversary as a context C, and expressing its advantage using observables, i.e. as:

|Obs(C[M ]) -Obs(C[N ])|.

Part II

Operational Reasoning on Discrete

Probabilistic λ-calculi. A weaker requirement-but easier to enforce-that we can ask an equivalence notion to verify, is observational correctness: if two programs are equivalent, then their observables are the same. For most equivalence notions that we will consider in the following, observational correctness will be a immediate consequence of the definition. Definition 4.0.2 An equivalence relation R on programs is said to be an observationally correct equivalence, if for every programs such that M R N , it holds that Obs(M ) = Obs(N ). A pre-order R on programs is said to be an observationally correct pre-order, if M R N implies that Obs(M ) ≤ Obs(N ).

Ideally, we would also like the relation R to coincide with context equivalence: when this is the case, we say that R is fully abstract.

Several different lines of work have been followed in order to define sound equivalence relations for higher-order languages. One possibility is to define a denotational semantics, i.e. a mathematical model of the language, and to say that two programs are equivalent when they have the same interpretation in the denotational model. We will review the results of this approach for the probabilistic case in Chapter 9, when we will present a fully abstract denotational model of PCF ⊕ introduced by Ehrhard, Pagani and Tasson in [START_REF] Ehrhard | Probabilistic coherence spaces are fully abstract for probabilistic PCF[END_REF]. In this section, we will focus on the approach initiated by Abramsky in [START_REF] Abramsky | The Lazy λ-Calculus[END_REF] when he defined so-called applicative bisimulation for call-by-name λ-calculus.

Abramsky's Applicative Bisimulation

In concurrency theory, a widely used notion to define equivalences between processes is the one based on bisimulations relations (see [START_REF] Sangiorgi | On the origins of bisimulation and coinduction[END_REF] for an overview, and an historical take on the parallel origins of bisimulation notions in computer science, philosophy and set theory). Bisimulation is a generic coinductive way of defining equivalence relations for non-deterministic processes, which comes equipped with a proof technique to show that two states s, t of a system are indeed equivalent: it is sufficient to construct a relation containing (s, t) which moreover is a pre-fixpoint for some operator on relations. For programming languages, bisimulation-based equivalence have been first developed for the concurrent language CCS by Milner in [START_REF] Milner | Communication and concurrency[END_REF]. In its pioneering work [START_REF] Abramsky | The Lazy λ-Calculus[END_REF], Abramsky adapted it in order to define applicative bisimulation for an higher-order language, the deterministic λ-calculus with a weak call-by-name semantics. Programs of Λ are seen as processes, to which the environment may ask to perform some elementary applicative action, consisting in passing another program as argument to the current process. From there, Abramsky defined his equivalence relation for Λ based on ideas from bisimulations for such processes. Abramsky showed that his notion of applicative bisimulation is fully abstract for weak callby-name Λ. From there, notions of applicative bisimulations have been shown to be sound for various λ-calculi, for instance for λ-calculus endowed with a non-deterministic choice operator [START_REF] Lassen | Relational reasoning about functions and nondeterminism[END_REF], as well as with a probabilistic one [START_REF] Lago | On coinductive equivalences for higherorder probabilistic functional programs[END_REF].

In this chapter, we do a brief presentation of Abramsky's applicative bisimulation, and we formalize the link with bisimulation for processes, by giving the underlying Labeled Transition System used to define applicative bisimulation. Then, we present two sound applicative equivalence notions developed by Dal Lago, Sangiorgi and Alberti [START_REF] Lago | On coinductive equivalences for higherorder probabilistic functional programs[END_REF] for Λ ⊕ : trace equivalence, and probabilistic applicative bisimulation. We do this presentation in some details, since a major contribution of the present thesis is to generalize this applicative approach to a quantitative setting, with the aim of obtaining metrics sound with respect to context distance.

Abramsky's applicative bisimilarity comes actually in two flavors, depending on the underlying operating semantics of the weak λ-calculus, which can be call-by-name or as call-by-value: in a CBN setting, the environment may pass any argument to the program, while it can only pass values in a CBV setting. We present below Abramsky's applicative similarity for call-by-name Λ. Definition 4.1.1 (From [START_REF] Abramsky | The Lazy λ-Calculus[END_REF]) A relation R on the closed terms of Λ is a simulation if for any programs M and N , M RN implies:

• if M ↓ V , then there exists a normal form W such that N ↓ W , and moreover V RW .

• if (λx.M )R(λx.N ), then for all programs L, M {L/x}RN {L/x}.

A relation R is a bisimulation if both R and R -1 are simulations ( where R -1 stands for the R-opposite relation: M R -1 N when N RM .). We consider simulations and bisimulations to be pre-ordered by the inclusion preorder. As shown in [START_REF] Abramsky | The Lazy λ-Calculus[END_REF], the relation appl defined as (∪ R|a simulation R) ⊆ P × P-the union of all the simulations-is also a simulation, and in the same way the relation ≡ appl defined as (∪ R|a bisimulation R) ⊆ P × P is also a bisimulation. It means that ≡ appl is the greatest bisimulation, and appl the greatest simulation. Definition 4.1.2 (Abramsky's Applicative Bisimilarity) We will call applicative similarity the relation appl , and applicative bisimilarity the relation ≡ appl . If M ≡ appl N , we say that M and N are bisimilar. Moreover, appl is a pre-order, and ≡ appl an equivalence relation. We can also show that (≡ appl ) = ( appl ∩ appl -1 ) 1 . If two programs are related by ≡ appl , we say that they are bisimilar. We illustrate in Example 4.1.2 below the bisimulation proof technique: to show that two terms are bisimilar, it is sufficient to show that there exists a bisimulation that relates them. 1 that there exists a bisimulation R, such that M RN . Since ≡ appl is the greatest bisimulation, it holds that R ⊆ (≡ appl ), and consequently M ≡ appl N .

In [START_REF] Abramsky | The Lazy λ-Calculus[END_REF], Abramsky showed that applicative bisimulation is fully abstract for call-by-name Λ, hence can be used as a complete proof technique for context equivalence, i.e that it is sound with respect to context equivalence. We illustrate on the example below how soundness of applicative bisimulation allows to turn the bisimulation proof technique into a proof technique for context equivalence. Abramsky's applicative bisimulation is actually an instance of bisimulation on Labeled Transition Systems (LTSs), a generic way of representing non-deterministic processes that evolve by interacting with their environment, by performing actions. Here, we make explicit the underlying LTS for applicative bisimulation. A LTS is a labeled directed graph, where the nodes are the different possible system states, the labels are all the possible actions the environment can do, and the edges specify how the system state changes when the environment does some action on the system. We say that a LTS is deterministic if it does not have internal non-determinism, i.e. that for any pair (s, a), there exists at most one state t such that s a -→ t. We say that an action a is admissible from a state s if there exists a state t with (s, a, t) ∈→.

Bisimulation techniques are a well-accepted way of defining equivalence for structures describing non-deterministic processes, for instance on relational structures (unlabeled directed graphs) or on Kripke structures (see [START_REF] Sangiorgi | On the origins of bisimulation and coinduction[END_REF]). We give below the formal definition of bisimulation in the LTS case, since it is the one we use for describing Abramsky's applicative bisimulation. Intuitively, we ask to a simulation R on the states of a LTS to verify the following property: if two states s and t are related by R,whenever s may reach a state s by doing an action a, then t is able to simulate this move, i.e. to perform the same action a and to end up in a state t such that s Rt . Definition 4.1.4 Let L = (S, L, →) be a LTS.

• A simulation is a relation R on S, such that ∀s, t ∈ S with sRt, it holds that whenever s a -→ u, there exists v such that t a -→ v, and moreover uRv.

• A bisimulation is a relation R such that both R and R -1 are simulations.

The greatest simulation-called similarity and denoted L -and the greatest bisimulation-called bisimilarity and denoted ≡ L -exist (see [START_REF] Lago | On coinductive equivalences for higherorder probabilistic functional programs[END_REF]), and they are respectively the union of all simulations and the union of all bisimulations; we call them respectively similarity and bisimilarity . We explicit now the link with Abramsky's applicative bisimulation, by building a deterministic LTS L Λ modeling the operational semantics of Λ. Then, we will see that bisimilarity on L Λ coincides with Abramsky's applicative bisimulation.

Definition 4.1.5 (The Applicative LTS for Λ) We define L Λ as the LTS (S Λ , L Λ , → Λ ) where we take:

• the set of states S Λ = P Λ V Λ , where closed terms and normal forms are taken as usual modulo α-equivalence and V = { V |V ∈ V} is a set containing copies of the normal forms in Λ decorated with . We call these normal forms distinguished normal forms.

• the set of labels L Λ = P Λ {eval}, where, again, closed terms are taken modulo α-equivalence.

• the transition relation → defined by:

• for every M ∈ P Λ , M eval -→ λx.N when M ↓ λx.N . • for every λx.M ∈ V and for every

N ∈ P Λ , λx.M N -→ M {N/x}.
We can see the LTS L Λ as an interactive way of modeling the operational semantics of Λ: the environment is able to make a program evolves by asking it to do some action: either to be evaluated, or, if it is already a value, to be applied to some argument. We illustrate this idea by representing a fragment of L Λ in Figure 4.1. We can see that the LTS L Λ is indeed the underlying structure for applicative bisimulation, in the sense that appl and ∼ L Λ coincide on programs, as well as ≡ appl and ≡ L Λ .

The Non-Deterministic Case

Notions of applicative bisimulations have also been developed for Λ endowed with a nondeterministic operator ⊕. Recall from Chapter 2 that there are two different ways of defining context equivalence for non-deterministic higher-order languages: one where we take may-convergence as observable, and the other one where we take must-convergence. These two paradigms lead to two distinct ways of adapting Abramsky's applicative bisimilarity, which are sound respectively for may and must context equivalence (see the extensive study carried out by Lassen in his Phd Thesis [START_REF] Lassen | Relational reasoning about functions and nondeterminism[END_REF] on equivalences for non-deterministic Λ). In particular, it was shown [START_REF] Lassen | Relational reasoning about functions and nondeterminism[END_REF] that applicative bisimilarity in this setting is not fully abstract, neither for call-by-name nor for call-by-value operational semantics. 4.2 Sound Equivalences for Λ ⊕ .

Ω λy.I λy.y V 1 V 2 . . . eval V 1 V 2 . . .
We are going in this section to present two different generalizations of Abramsky's applicative bisimulation, developed by Dal Lago, Sangiorgi and Alberti in [START_REF] Lago | On coinductive equivalences for higherorder probabilistic functional programs[END_REF] for the weak probabilistic λ-calculus Λ ⊕ endowed with a call-by-name semantics: trace equivalence, and probabilistic applicative bisimilarity. We will do this presentation in such a way as to highlight how both equivalences can be seen as arising from a probabilistic generalization of the Λ LTS.

Trace Equivalence for CBN Λ ⊕ .

The difficult part while proving that two terms are context equivalent is usually to handle the universal quantification on contexts. One way to make it easier may be to decide to consider only a restricted set C of contexts: to obtain a sound equivalence, we need to choose C such that, if no context in C is able to distinguish two programs, then there is no arbitrary context either that can distinguish them. Here, we present trace equivalence, also known as CIU equivalence, which is the equivalence notion obtained by restricting the contexts to applicative contexts , i.e contexts that are in the shape: [•]M 1 . . . M n , and so that correspond to the environment passing successively the terms M 1 , . . . , M n as arguments to the program. In the deterministic λ-calculus, trace equivalence coincide with applicative bisimilarity. It is not the case anymore for non-deterministic λ-calculus (see [START_REF] Lassen | Relational reasoning about functions and nondeterminism[END_REF]).

For CBN Λ ⊕ , trace equivalence was defined and studied in [START_REF] Lago | On coinductive equivalences for higherorder probabilistic functional programs[END_REF]. To highlight the link with bisimulation for LTSs, we give here the definition using applicative tests, that we'll also call traces, and that can be seen both as an applicative context, or as a sequence of actions done on the program by the environment.

Definition 4.2.1 A trace α is a sequence in the form M 1 • • • •M n , where M 1 , • • • M n are programs.
In other words, traces are generated by the following grammar:

α ::= | M • α
We note T r the set of traces, and we associate to any trace α a context C α , that we define inductively as:

C = [•] and C M •α = C α [[•]M ].
Observe that the contexts associated to traces are exactly the applicative contexts, and as a corollary, they are also evaluation contexts. We are going to show that they are trace equivalent, i.e. that for every trace α,

Prob(M 1 ↓ )(α) = Prob(M 2 ↓)(α).
The proof is done by case analysis on the trace α:

• Prob(M 1 ↓)( ) = Prob(M 2 ↓)( ) = 1.
• We look now to the case where α = L • β. Unfolding the definition that a program performs successfully under a trace α, we can see that for every term M , Prob(M ↓

)(α) = Obs(C β [M L]
). Moreover, since C β is an evaluation context, it holds that: The definition of trace equivalence we have given in Definition 4.2.3, following [START_REF] Lago | On coinductive equivalences for higherorder probabilistic functional programs[END_REF], is inductive in nature. But trace equivalence may also be defined coinductively, using a LTS obtained by doing the probabilistic lifting of L Λ . We present here this alternative view, that allows us to see trace equivalence on Λ ⊕ as a probabilistic generalization of Abramsky's Applicative bisimulation. To do that, we construct a LTS L (Λ ⊕ cbn ), which we obtain from L Λ by adding probabilities as follows: states are not programs anymore, but distributions over programs, while the labels of L (Λ ⊕ cbn ) are defined as in L Λ . The transition function of L (Λ ⊕ cbn ) is obtained from the one of L Λ by lifting it to distributions.

Obs(C β [M L]) = V ∈V M L (V ) • Obs(C β [V ]). Since M 1 L = M 2 L = 1 2 • L , we can conclude that indeed Prob(M 1 ↓)(α) = Prob(N 2 ↓)(α).
Definition 4.2.4 We define the probabilistic trace LTS L (Λ ⊕ cbn ) = (S L (Λ ⊕ cbn ) , L L (Λ ⊕ cbn ) , →
) where:

• the set of states is S L (Λ ⊕ cbn ) = ∆ = (P Λ ⊕ ) ∆ = ( V Λ ⊕ );
• the set of labels is L L (Λ ⊕ cbn ) = P Λ ⊕ {eval};

• the transition relation → is defined by:

-if D ∈ ∆ = (P Λ ⊕ ), D eval -→ M ∈P Λ ⊕ D(M ) • M . -if D ∈ ∆ = ( V Λ ⊕ ), and N ∈ P Λ ⊕ : D N -→ λx.M ∈ V Λ ⊕ D(λx.M ) • {M {N/x} 1 }.
We would like now to use bisimulation one L (Λ ⊕ cbn ) to define an equivalence relation for Λ ⊕ programs: two programs M and N would be equivalent whenever {M 1 } and {N 1 } are bisimilar as states of L (Λ ⊕ cbn ). However, the notion of bisimulation for LTSs we have presented in Definition 4.1.3 is not coarse enough: indeed, we can see that for instance the states {I ⊕ Ω 1 } and {I 1 } are bisimilar in the LTS L (Λ ⊕ cbn ). To overcome this problem, we need to specify that whenever two distributions have different weight, they cannot be bisimilar. To formalize this idea, we introduced an enriched notion of LTSs -weighted LTSs-, where we add to the LTS a function associating a weight to every state, and we ask for an bisimulation on weighted LTS, that every bisimilar states should have the same weight.

Definition 4.2.5 A weighted LTS (WLTS) is a pair (L , w), where L = (S, L, →) is a LTS, and w is a function S → [0, 1]. A simulation on the WLTS (L , w) is a simulation R on the LTS L , such that moreover sRt implies that w(s) ≤ w(t). A bisimulation on (L , w) is a simulation R on (L , w) such that R -1 also is a simulation on (L , w).

Lemma 4.2.2

The greatest simulation and bisimulation on a WLTS exist, and moreover they are respectively a pre-order and an equivalence. We call them respectively similarity and bisimilarity.

Proof. Let be S the set of states of the WLTS. We first show that the greatest simulation exists. We define: R = (∪ R is a WLTS-simulation R) ⊆ S × S.

We want to show that R is the greatest simulation; to do that it is enough to show that it is indeed a simulation. Let s, t be such that s Rt. Then there exists R a WLTS-bisimulation, such that sRt. We see immediately that it implies that w(s) ≤ w(t). Moreover, suppose that s a -→ s . Then, since sRt, it holds that there exists t , such that t a -→ t , and s Rt . Since R ⊆ R, it means that s Rt , which allows us to conclude that R is a simulation.

We still have to show that R is a preorder. First, we see easily that it is reflexive: indeed R = {(s, s) | s ∈ S} is a simulation, and as a consequence R ⊆ R. We want now to show that it is transitive: let s, t, u be such that s Rt, and t Ru. It means that there exists R 1 , R 2 two simulations, such that sR 1 t and tR 2 u. We define

R 1 • R 2 = {(s, u) | ∃t s.t. sR 1 t ∧ tR 2 u}. We can see that R 1 • R 2 is a WLTS simulation, which implies that R is transitive.
The proof for bisimilarity is similar to the one for similarity.

We can now enriched the LTS L (Λ ⊕ cbn ) into a WLTS, by taking as weight function w : S L (Λ ⊕ cbn ) → [0, 1] defined by: w(D) = s∈S(D) D(s). In the following, we will denote (by abuse of notation) also L (Λ ⊕ cbn ) the WLTS (L (Λ ⊕ cbn ), w). Observe that, as in L Λ , the transition relation of the WLTS L (Λ ⊕ cbn ) is deterministic: it comes from the fact that we have embedded probabilistic aspects on the semantics of Λ ⊕ purely in the states. In the next section, we will present another way of adding probabilities to the LTS L Λ , by transforming it into a labeled Markov Chain where the transition function itself becomes probabilistic. We define, using the notations s i , t j , u to denote the states of L (Λ ⊕ cbn ) as represented in Figure 4.2: R = ({M 1 }, {N 1 }) ∪ (s 1 , t 1 ) ∪ (s 2 , t 2 ) ∪ (u, u).

{M 1 } = {(λx.I) ⊕ (λx.Ω) 1 } weight = 1 {N 1 } = {λx.(I ⊕ Ω) 1 } weight = 1 s 1 = 1 2 • { λx.I 1 } + 1 2 • { λx.Ω 1 } weight = 1 t 1 = { λx.(I ⊕ Ω) 1 } weight = 1 s 2 = 1 2 • {I 1 } + 1 2 • {Ω 1 } weight = 1 t 2 = {(I ⊕ Ω) 1 } weight = 1 u = 1 2 • { I 1 } weight = 1 2 eval eval L L eval eval
Looking at Figure 4.2, we can see that both R and R -1 are simulation, hence {M 1 } and {N 1 } are bisimilar as states of the WLTS L (Λ ⊕ cbn ).

On deterministic WLTS, bisimulation can be characterized by linear tests, i.e by looking at the behavior of states when we apply to them finite sequences of action.

Definition 4.2.6 (Traces for a LTS) Let be L = (S, L, →) a LTS. A trace in L is a (possibly empty) finite sequence of actions α = a 1 , . . . , a n such that for every i, a i ∈ L.

Formally, the set of traces is generated by the following grammar:

α ∈ T L ::= | a • α
where a ∈ L.

If s ∈ S, and α ∈ T L , we denote s α -→ t when there exist u 0 , . . . , u n ∈ S, such that u 0 = s, u n = t, and ∀i, u i-1 a i -→ u i . A trace α is said to be admissible for s if there exists t such that s α →t. The set of admissible traces for s is indicated as T (s). We denote Dom(α) the set of those states s such that ∃t, s α -→ t. The following is a well-posed definition since by definition the underlying LTS of a deterministic WLTS is deterministic. Definition 4.2.7 (Success Probability of a Trace) Let be L = (w, (S, L, →)) a deterministic WLTS. Let be s ∈ S, and α ∈ T (s). Then there is a unique u such that s α →u, and we define the success probability of α starting from s, that we note Prob(α ↓)s, as w(u).

We can now use the traces to give an inductive characterization of WLTS bisimilarity. Definition 4.2.8 (Trace Equivalence for a Deterministic WLTS) Let be L w = (w, (S, L, → )) a deterministic WLTS. We define the trace preorder tr L w on L as: s tr L w t when for every trace t, if there exists s such that s α -→ s , then there exists also t such that t α -→ t , and moreover w(s ) ≤ w(t ).

We say that two states s, t ∈ S are trace equivalent, and we denote s≡ tr L w t when s tr L w t and t tr L w s. Proof. We consider the deterministic WLTS L = (w, (S, L, →))

• Let be α a finite sequence over L: we are going to show by induction on the length of α that if s L t, it holds that whenever s α -→ s , there exists t with t α -→ t and w(s ) ≤ w(t ).

-If α is the empty sequence, then the result holds: indeed since s and t are WLTS-similar, it holds that w(s) ≤ w(t).

-If α = a • β. We suppose that there exists s , such that s a•β -→ s . It means that there exists s , such that s a -→ s , and s β -→ s . Since s and t are WLTS-similar, s a -→ s implies that there exists t , such that t a -→ t , and s L t . We can now apply the induction hypothesis to β, and it tells us that there exists t such that t β -→ t , and moreover w(s ) ≤ w(t ). From there, we can deduce that t α -→ t , and we see that the result holds.

• Now, we suppose that s tr L t. In order to show that s and t are WLTS-similar, we construct a simulation relating them. We take:

R = {(s , t ) | ∃α, s α -→ s ∧ t α -→ t }.
We have now to show that it is a WLTS simulation. First, since s tr L t, we see that whenever s Rt , it holds that w(s ) ≤ w(t ). Moreover, for any action a such that s a -→ s , we can deduce from s tr L t that there exists t such that t a -→ t , and moreover we see by looking at the definition of R that it also holds that s Rt . So R is a WLTS-simulation, and the result holds. Proof. To do the proof, we are going to use Proposition 4.2.3: we see that it is enough to show that {M 1 } ≡ L (Λ ⊕ cbn ) {N 1 } whenever M and N are trace equivalent as Λ ⊕ -programs. We are going to use the fact that the traces applied to programs can be converted in finite sequence of actions on the WLTS L (Λ ⊕ cbn ): for every α

= N 1 . . . N n ∈ T r, we denote α = eval • N 1 • eval . . . N n • eval. We see that for every program M , it holds that Prob(M ↓)(α) = w(D), where D is such that {M 1 } α -→ D.
• We suppose that {M 1 }≡ tr L (Λ ⊕ cbn ) {N 1 }. Then as we have observed above, for every trace α ∈ T r, there exists

D, E such that Prob(M ↓)(α) = w(D), Prob(N ↓)(α) = w(E ) and {M 1 } α -→ D, {N 1 } α -→ E . Since {M 1 }≡ tr L (Λ ⊕ cbn ) {N 1 }, it holds that w(D) = w(E ). It means that Prob(M ↓)(α) = Prob(N ↓)(α)
, and since it holds for every α ∈ T r, we see that M ≡ tr N .

• Now, we suppose that M ≡ tr N , and we want to show that {M 1 }≡ tr

L (Λ ⊕ cbn ) {N 1 }.
Let α be a finite sequence of actions in L (Λ ⊕ cbn ), and D such that {M 1 } α -→ D. Our goal is to show that the exists E with {N 1 } α -→ E , and w(D) = w(E ). We do the proof by case analysis on α: first, we see that α has to be an alternated sequence of the shape eval • L 1 • eval . . ., otherwise we would not have {M 1 } α -→ D. There is actually only two possible cases:

-or α = eval • L 1 • eval . . . L n •
eval, and then we see that there exists indeed

E = V N L 1 . . . L n (V ) • { V 1 } with {N 1 } α -→ E , and moreover w(D) = Prob(M ↓)(L 1 . . . L n ), and w(E ) = Prob(N ↓)(L 1 . . . L n ).
Since M and N are trace equivalent, the result holds.

either α = eval • L 1 • eval . . . L n , and then we see that there exists indeed

E = K N L 1 . . . L n-1 (λx.K) • {K{L n /x} 1 } with {N 1 } α -→ E . Moreover w(D) = Prob(M ↓)(L 1 . . . L n-1 ), and w(E ) = Prob(N ↓)(L 1 . . . L n-1
), so as previously the result holds since M and N are trace equivalent.

The characterization of bisimilarity on deterministic WLTSs using traces makes it easier to show that two states are not bisimilar, as we highlight in Example 4.2.4 below.

Example 4.2.4

We consider the two programs M = λx.I, and N = (λx.I ⊕ λx.Ω), in the setting of the CBN reduction theory. We associate to M and N the L (Λ ⊕ cbn ) states respectively {M 1 } and {N 1 }. In Figure 4.3 we represent the relevant fragment of L (Λ ⊕ cbn ). We consider now the trace α = eval • I • eval. We can see that α ∈ T ({M 1 }) ∩ T ({N 1 }); it means that we can look at the success probability of α starting from respectively

{M 1 } and {N 1 }. Looking at Figure 4.3, we see that Prob(α ↓)({M 1 }) = 1, while Prob(α ↓ )({N 1 }) = 1 2 .
Using the trace characterization of bisimilarity on L (Λ ⊕ cbn ), we see that it means that {M 1 } and {N 1 } are not bisimilar.

Larsen Skou applicative bisimulation for CBN Λ ⊕ .

In [START_REF] Lago | On coinductive equivalences for higherorder probabilistic functional programs[END_REF], Dal Lago, Sangiorgi and Alberti introduced also another sound notion of equivalence for CBN Λ ⊕ , by adapting the Λ LTS into a Labeled Markov Chain (LMC)-aka reactive probabilistic labeled transition system-to model the operational semantics of Λ ⊕ , and then use the bisimulation notion introduced by Larsen and Skou for LMCs to define an equivalence on Λ ⊕ programs, that they call probabilistic applicative bisimulation.

We first introduce the notion of Labeled Markov Chain, that also appears in the literature as reactive probabilistic labeled transition systems. It is a probabilistic generalization of LTSs, in the sense that when we do some action starting from some system state, we do not reach a single system state anymore, but a distribution-or sub-distribution-over states. LMCs allow for external non-determinism (several different actions may be performed from a given state), but not for internal non-determinism: given a state, and a

{M 1 } = {(λx.I) ⊕ (λx.Ω) 1 } weight = 1 {N 1 } = {λx.I 1 } weight = 1 s 1 = 1 2 • { λx.I 1 } + 1 2 • { λx.Ω 1 } weight = 1 t 1 = { λx.I 1 } weight = 1 s 2 = 1 2 • {I 1 } + 1 2 • {Ω 1 } weight = 1 t 2 = {I 1 } weight = 1 s 3 = 1 2 • { I 1 } weight = 1 2 t 3 = { I 1 } weight = 1 eval eval L L eval eval Figure 4.3: A Fragment of the weighted LTS L (Λ ⊕ cbn )
label, the system can reach only one distribution over states. The LMCs we consider take divergence into account, since an action can lead to a strict sub-distribution. For this reason, it has been also called in the literature partial LMC, or LMC with divergence.

Definition 4.2.9 A labeled Markov chain (LMC) is a triple M = (S, L, P), where S is a countable set of states, L is a countable set of labels, and P is a transition probability matrix, i.e., a function P : S × L × S → R such that for every state s ∈ S and for every label l ∈ L, t∈S P(s, l, t) ≤ 1.

Larsen and Skou gave in [START_REF] Larsen | Bisimulation through probabilistic testing[END_REF] a definition of bisimulation for Labeled Markov Chain.

Notation 4.2.5 For any R ⊆ X × Y , when A is a subset of X, we denote R(A) = {z | ∃x ∈ A, xRz} ⊆ Y .
We can observe that this notation is well-behaved with respect to composition of relation, in the sense where for every relation R, S, it holds that (R; S)(A) = S(R(A)).

Definition 4.2.10 Let X, Y be two countable sets, and R ⊆ X × Y a binary relation. We define the asymmetric lifting of R to sub-distributions, as the relation

-→ (R)⊆ ∆(X) × ∆(Y )
given by:

D -→ (R) E when ∀A ⊆ X, D(A) ≤ E (R(A)).
We first state some easily checked fact about the asymmetric lifting of a relation.

Remark 4.2.1 Let X, Y, Z be countable sets. Then the following properties hold:

• If R ⊆ S, then -→ (R)⊆ -→ (S). • If R ⊆ S × T, S ⊆ T × U binary relation, then D -→ (R) E and E -→ (S) F implies D -→ (R; S) F .
• If (D i ) i∈N and (E i ) i∈N are two countable family of sub-distributions over respectively

X and Y such that for every i, it holds that D i -→

(S) E i , and

(α i ) i∈N a family of non-negative coefficients with i∈N α i ≤ 1, then i∈N α i • D i -→ (S) i∈N α i • E i . • If E ≤ F , and D -→ (R) E , then also D -→ (R) F .
Definition 4.2.11 Let M = (S, L, P) be a labeled Markov chain. A probabilistic simulation is a relation R on S such that (s, t) ∈ R implies that for every l ∈ L, (P(s, l, •))

-→

(R) (P(t, l, •)). A probabilistic bisimulation is a relation R on S such that both R and R -1 are probabilistic simulation relations. We say that s is simulated by t (s M t) if there exists a probabilistic simulation R such that sRt. States s, t are bisimilar (s≡ M t) if there exists a probabilistic bisimulation R such that sRt. Lemma 4.2.6 For any labeled Markov chain M = (S, L, P):

• relations M and ≡ M are the largest simulation and the largest bisimulation on S, respectively;

• relation M is a preorder and relation ≡ M is an equivalence.

We can adapt the Λ LTS to obtain a LMC M cbn Λ ⊕ for Λ ⊕ . The states and labels are the same as in L λ , while the transition relation → of L λ is replaced by a probability matrix. Definition 4.2.12 (from [START_REF] Lago | On coinductive equivalences for higherorder probabilistic functional programs[END_REF]) The labeled Markov chain

M cbn Λ ⊕ = (S cbn Λ ⊕ , L cbn Λ ⊕ , P cbn Λ ⊕ ) is given by: • the set of states is S cbn Λ ⊕ = P Λ ⊕ V Λ ⊕ ; • the set of labels is L cbn Λ ⊕ = P Λ ⊕ {eval};
• the transition probability matrix P cbn Λ ⊕ is defined as: • for every M ∈ P Λ ⊕ and for every V ∈ V Λ ⊕ :

P cbn Λ ⊕ (M, eval, V ) = M (V ) P cbn Λ ⊕ (M, eval, M ) = 0 ∀M ∈ P Λ ⊕ ;
• for every λx.M ∈ V Λ ⊕ and for every N ∈ P Λ ⊕ : . In Figure 4.4, we have represented the relevant fragment of the LMC M cbn Λ ⊕ . We do the proof by contradiction: suppose that there exists a simulation R, such that M RN . We take X = { λy.(Ω ⊕ I)}:

P cbn Λ ⊕ ( λx.M , N, M {x/N }) = 1; P cbn Λ ⊕ ( λx.M , N, M ) = 0 ∀M ∈ P Λ ⊕ s.t. M = M {x/N }.
it holds that P cbn Λ ⊕ (M )(eval)(X) = 1.
From the definition of simulation for LMC, we can deduce that

P cbn Λ ⊕ (N )(eval)(R(X)) = 1.
As a consequence (and by looking at Observe that Example 4.2.5 tells us that probabilistic applicative bisimulation is coarser than trace equivalence, since there exist terms that are trace equivalent, but that probabilistic applicative bisimulation is able to distinguish. As a corollary, since trace equivalence is fully abstract, it means that probabilistic applicative bisimulation cannot be complete.

Proposition 4.2.7 (from [START_REF] Lago | On coinductive equivalences for higherorder probabilistic functional programs[END_REF]) Probabilistic applicative bisimulation for CBN Λ ⊕ is sound, but not fully abstract.

Chapter 5

Full Abstraction of Applicative Larsen-Skou's bisimilarity in CBV.

We have presented in Chapter 4 two distinct equivalence notions developed by Dal Lago, Sangiorgi and Alberti [START_REF] Lago | On coinductive equivalences for higherorder probabilistic functional programs[END_REF] for the probabilistic higher-order language Λ ⊕ endowed with a CBN semantics: trace equivalence and probabilistic applicative bisimilarity. In the same work, they also investigate the link of these equivalences with context equivalence: trace equivalence is fully abstract, while probabilistic applicative bisimulation is sound, but not complete. One of the contributions of this thesis is a study of these equivalences in the setting of call-by-value Λ ⊕ : in this chapter, we show that CBV trace equivalence is not even sound, while CBV probabilistic applicative bisimulation is fully abstract.

Most of the results we present here have been published in a joint work with Ugo Dal Lago [START_REF] Crubillé | On probabilistic applicative bisimulation and call-byvalue λ-calculi[END_REF], in the setting of the typed language PCFL ⊕ , which is a CBV probabilistic variant of PCFL-an extension of PCF with pairs and infinite lists introduced by Pitts in [START_REF] Pitts | Operationally-based theories of program equivalence[END_REF]. Furthermore, we also studied probabilistic applicative bisimulation for CBV Λ ⊕ extended with Abramsky and Ong's parallel convergence tester operator, in a joint work with Dal Lago, Sangiorgi and Vignudelli [START_REF] Crubillé | On applicative similarity, sequentiality, and full abstraction[END_REF]. To keep the proofs simple, we chose to present our results here in the setting of pure CBV Λ ⊕ , but it is worth noting that the techniques presented here are robust enough to be extended without much complications to higher-order languages with more programming features than Λ ⊕ . Throughout this chapter, we will denote by →, ⇓ , and • respectively the one-step reduction relation, big-step evaluation relation and the operational semantics with respect to the weak CBV strategy on Λ ⊕ , as they were defined in Chapter 1.

Probabilistic Applicative Bisimulation for CBV Λ ⊕ .

We see in Chapter 4 that probabilistic applicative bisimulation was defined by Abramsky for weak CBN Λ in [START_REF] Abramsky | The Lazy λ-Calculus[END_REF]. Ong introduced in [START_REF] Ong | Concurrent lambda calculus and a general precongruence theorem for applicative bisimulations[END_REF] a variant of Abramsky's applicative bisimulation for call-by-value Λ, and showed it to be fully abstract with respect to context equivalence. At the end of their work on equivalences for CBN Λ ⊕ , Dal Lago, Sangiorgi and Alberti [START_REF] Lago | On coinductive equivalences for higherorder probabilistic functional programs[END_REF] consider briefly the CBV case; they give a definition of probabilistic applicative bisimulation in this setting, and claim that this equivalence relation is sound with respect to context equivalence. In this section, we present probabilistic applicative bisimulation for CBV Λ ⊕ , and we spell out the soundness proof, that uses Howe's method similarly to what is done in [START_REF] Lago | On coinductive equivalences for higherorder probabilistic functional programs[END_REF] for the CBN case.

The Labelled Markov Chain

M cbv Λ ⊕ .
In order to adapt the definition of probabilistic applicative bisimulation-given in Definition 4.2.12 for CBN Λ ⊕ -to the CBV setting, we have first to slightly change the Markov Chain M cbn Λ ⊕ , in order to model CBV interactions instead of CBN ones: accordingly the labels of M cbv Λ ⊕ are values instead of being the set of all possible programs.

Definition 5.1.1 (from [START_REF] Lago | On coinductive equivalences for higherorder probabilistic functional programs[END_REF])

The CBV labeled Markov chain M cbv Λ ⊕ is defined as M cbv Λ ⊕ = (S cbv Λ ⊕ , L cbv Λ ⊕ , P cbv Λ ⊕ ) where: • the set of states is S cbv Λ ⊕ ::= S cbn Λ ⊕ = P Λ ⊕ V Λ ⊕ . • the set of labels is L cbv Λ ⊕ ::= VΛ ⊕ {eval}; • the transition probability matrix P cbv Λ ⊕ is defined as: • for every M ∈ P Λ ⊕ and for every V ∈ V Λ ⊕ : P cbv Λ ⊕ (M, eval, V ) = M (V ); and P cbv Λ ⊕ (M, eval, M ) = 0 ∀M ∈ P Λ ⊕ . • for every λx.M ∈ V Λ ⊕ and for every V ∈ V Λ ⊕ : P cbv Λ ⊕ ( λx.M , V, M {x/V }) = 1; and P cbv Λ ⊕ ( λx.M , V, M ) = 0 for all M ∈ P Λ ⊕ such that M = M {x/V }.
Similarly to the CBN case-see Section 4.2.2 from Chapter 4-we define a preorder cbv Λ ⊕ and an equivalence relation ≡ cbv Λ ⊕ on Λ ⊕ programs, by taking respectively the similarity and bisimilarity relations on the LMC M cbv Λ ⊕ . The question now, is whether the bisimilarity ≡ cbv Λ ⊕ may be used to obtain some information on CBV Λ ⊕ context equivalence. In Section 5.1.2 below, we show that ≡ cbv Λ ⊕ is sound with respect to context equivalence, and in Section 5.2 we show that it even coincides with context equivalence.

In order to keep the notations readable, in the remainder of this chapter, we will denote the CBV probabilistic applicative similarity cbv Λ ⊕ simply as , and the bisimilarity ≡ cbv Λ ⊕ simply as ≡.

≡ cbv Λ ⊕ is Sound wrt CBV Context Equivalence

Few years after Abramsky's introduction of applicative bisimulation, Howe [START_REF] Howe | Equality in lazy computation systems[END_REF] gave an alternative-more direct1 -soundness proof for this equivalence relation. His proof technique was then adapted by Ong [START_REF] Ong | Concurrent lambda calculus and a general precongruence theorem for applicative bisimulations[END_REF] to show soundness of applicative bisimulation for CBV Λ. Later, in [START_REF] Howe | Proving congruence of bisimulation in functional programming languages[END_REF], Howe gave a more general framework for his method, that encompassed both call-by-name and call-by-value reduction strategies, as well as non-deterministic variants of Λ obtained by adding some non-deterministic operator. From there, this proof method has been adjusted to higher-order languages with various programming features, for instance to higher-order languages with types [START_REF] Gordon | Bisimilarity as a theory of functional programming[END_REF], or with states [START_REF] Ritter | A fully abstract translation between a λ-calculus with reference types and standard ml[END_REF]. When proving soundness for probabilistic applicative bisimulation in CBN Λ ⊕ , Dal Lago, Sangiorgi and Alberti adapted Howe's method to a probabilistic setting. Here, we are going to adapt their proof technique in order to show soundness of probabilistic applicative bisimilarity for CBV Λ ⊕ . More precisely, Howe's method is designed to show a stronger result than soundness. Recall that-as defined in Section 2.3-we call open relation a family R = (R x ) x⊆V , such that each R x is a relation over the set of Λ ⊕ -terms that have their free variables contained in x. Howe's method provides a path to prove that some fixed open relation R is compositional, in the following sense: Definition 5.1.2 Let R be an open relation for an untyped observable language L ⊕ . We say that R is compositional if whenever two terms M and N are such that M R x N , then for every context C that captures all variables in x, it holds that

C[M ] R ∅ C[N ].
So the first step we have to take is to extend ≡-a relation on programs-into an open relation on all terms: we do that below by defining the open extension of the simulation preorder.

Open Extension of Simulation Preorder.

To transform a relation R on programs into an open relation (R)

• on all terms, there is a generic way formalized by instance in [START_REF] Pitts | Operationally-based theories of program equivalence[END_REF]: two terms are related by (R) • , if for every possible choice of values2 to replace their free variables, the programs obtained after doing the substitution are related by R.

M, N with F V (M ), F V (N ) ⊆ x = {x 1 , . . . , x n }, we have x M (R) • N if: for all V 1 , . . . , V n ∈ VΛ ⊕ , M {x 1 , . . . , x n /V 1 , . . . , V n }RN {x 1 , . . . , x n /V 1 , . . . , V n }.
Observe that, since is a preorder on programs, its open extension • is also a reflexive and transitive open relation-in the sense of Definition 2.3.3 in Chapter 2. Our goal now is to show that • is compositional; we will see that among other things, compositionality for • induces soundness for the original relation with respect to the context preorder.

Compatibility for Open Relations.

Instead of considering directly compositionality, we first introduce compatibility, an inductively defined property on open relations that guarantee compositionality. Intuitively, an open relation R is compatible, if when we start from pairs of programs related by R, and we apply any possible sequence of rules in the grammar of Λ ⊕ , we end up with a pair of program still in R.

Definition 5.1.4 An open relation R is compatible if and only if the following conditions

hold: (Com1) ∀x ∈ V, ∀x ∈ x, x xRx ; (Com2) ∀x ∈ V, ∀y ∈ x, ∀M, N , x, y M RN ⇒ x λy.M Rλy.N ; (Com3) ∀x, ∀M, N, P, Q, (x M RN ∧ x P RQ) ⇒ x M P RN Q; (Com4) ∀x, ∀M, N, P, Q, x (M RN ) ∧ x (P RQ) ⇒ x (M ⊕ P )R(N ⊕ Q).
Observe that this definition is purely syntactic: in particular, it would be identical if we were in a call-by-name setting. As a consequence, our definition of compatibility is exactly the same as the one from Dal Lago, Sangiorgi and Alberti for CBN Λ ⊕ [START_REF] Lago | On coinductive equivalences for higherorder probabilistic functional programs[END_REF].

We see now that compatibility is a stronger requirement than compositionality: first, observe that we cannot derive (Com3) by compositionality, since the contexts we consider have only one hole. However, compatibility implies compositionality, as stated in Lemma 5.1.1 below. Proof.

• We first show that R is reflexive. Let M be such that F V (M ) ⊆ x. We want to show that x M R M . The proof is done by induction on the structure of M .

-We first suppose that M = x. Since x ∈ F V (M ), it holds that x ∈ x. As a consequence, we see using (Com1) that x xRx.

-We consider now the case where M = λx.N . Since terms are considered modulo α-equivalence, we can suppose that x ∈ x. Moreover, we see that

F V (N ) ⊆ x, x.
As a consequence, we have by induction hypothesis that x, x N RN . Applying (Com2), we can conclude that x M RM .

-If M = N L, we have by induction hypothesis that x N RN and x LRL.

We can then conclude by applying (Com3).

-If M = N ⊕ L, we obtain the result by applying (Com4).

• We now prove that R is compositional, by induction on the validity proof tree of κ :

x C. Recall that validity for closeness judgments on contexts is defined inductively in Figure 2.1 of Chapter 2.

-If κ is [•], then C[M ] = M , C[N ] = N
, and the result holds.

-If κ is x, x λx.D, then the last rule in the proof tree of κ is of the shape: We explain now the relevance of the compatibility property for our purposes, namely proving soundness of probabilistic applicative bisimulation. If a binary relation R on programs is an observationally correct equivalence-in the sense of Definition 4.0.2 in Chapter 4, i.e an equivalence relation such that whenever two programs are connected, they have the same termination probability-then compatibility of (R) • implies soundness with respect to context equivalence. A similar result holds in the asymmetric case: if R is a observationally correct preorder -i.e. a preorder such that whenever N is related to M , the termination property of M is greater or equal to that of N -then as soon as (R) • is compatible, it is also sound with respect to the context preorder.

x D x ∈ x x,
Proposition 5.1.2 Let be R a relation on Λ ⊕ programs, such that (R) • is compositional. Then:
1. if R is an observationally correct preorder, then (R) • is sound with respect to the context preorder;

2. if R is an observationally correct equivalence, then (R) • is sound with respect to context equivalence.

Proof. We suppose that R is a relation on programs verifying item 1, and such that moreover (R) The proof of ( 2) is done similarly

• is compatible. Let be M, N such that x M (R) • N ; our objective is to show that x M ≤ obs N . Let be C any context in the set C Λ ⊕ such that x C: it guarantees that both C[M ] and C[N ] are closed terms. Since (R) • is compositional, Lemma 5.1.1 tells us that x M (R) • N implies C[M ](R) • C[N ].
From there, we may see that in our path towards proving soundness of and ≡ with respect to respectively context preorder and context equivalence, the key step consists in showing that • is compatible. Indeed, since is observationally correct, Proposition 5.1.2 tells us that compatibility of • implies soundness of with respect to context equivalence. Moreover, soundness of ≡ with respect to context equivalence is implied as soon as we know that is sound with respect to the context preorder-because ≡ coincides with ∩( ) -1 (see Chapter 4), and also

≡ ctx coincides with ≤ ctx ∩ ( ≤ ctx ) -1 . Howe's Method for CBV Λ ⊕ .
This paragraph is devoted to show that • is indeed compatible, by adapting Howe's method to our setting. The main idea behind Howe's method is to define an auxiliary relation ( • ) H , which is compatible by design, and thereafter to show that in fact

x ∪ {x} x R M x ∪ {x} x R H M x ∪ {x} M R H N x λx.N R L x λx.M R H L x M R H N x L R H K x N K R T x M L R H T x M R H N x L R H K x (N ⊕ K) R T x (M ⊕ L) R H T Figure 5.1: Howe's Construction
Observe that Howe's construction is asymmetric in nature; it is the reason why Howe's method has to focus on the similarity preorder, instead of considering directly bisimilarity. Since the definition of Howe's lifting depends only on the language, and not on the reduction strategy, our definition of R H coincides with the one presented in [START_REF] Lago | On coinductive equivalences for higherorder probabilistic functional programs[END_REF]. It means that the structural properties of Howe's lifting shown in [START_REF] Lago | On coinductive equivalences for higherorder probabilistic functional programs[END_REF] still hold: we state them in Lemma 5.1.3 below.

Lemma 5.1.3 (from [START_REF] Lago | On coinductive equivalences for higherorder probabilistic functional programs[END_REF]) Let R be an open relation with respect to Λ ⊕ .

• Compatibility: If R is reflexive, then R H is compatible. • Pseudo-Transitivity: If R is transitive, then: x M R H N ∧(x N R L) ⇒ x M R H L . • Extended Reflexivity: If R is reflexive, then x M R N implies x M R H N .
Observe that these properties do not imply a priori that R H is a preorder, since pseudotransitivity is weaker that transitivity. When moreover it holds that x M R H N implies x M R N -i.e. that the Howe's lifting is contained in the original relation-we say that the Howe's lifting of R is conservative.

When building • as the open extension of , we have noted that • is a reflexive and transitive open relation. As a consequence, we can deduce from Lemma 5.1.3 that ( • ) H is compatible, and contains • . So to conclude that • is compatible, we just need to know that the Howe's lifting of ( • ) H is conservative, i.e that ( • ) H ⊆ • . Recall that to show that some relation R on programs in contained in , there is the powerful coinductive proof technique, i.e. it is enough to show that R is a simulation. Here, we need to adapt this tool for the purpose of showing that an open relation is contained in • . For an open relation R, we call the binary relation R ∅ over P the restriction of R to programs, and we denote it R |P . We would like to know that hypothesizing (

• ) H |P ⊆ ,implies that ( • ) H ⊆ • . It comes as a consequence from the fact that ( • ) H is value-substitutive,
V, W such that x, x M (R) •H N and ∅ V (R) •H W , it holds that x M {x/V } (R) •H N {x/W }
Looking at the structure of Howe's lifting, we can see that ( • ) H is value-substitutive. That's because Howe's lifting is designed in such a way that for any relation R on programs (R) •H is value-substitutive, as expressed in Lemma 5.1.4 below.

Lemma 5.1.4 Let be R a relation on Λ ⊕ programs. Then (R) •H is value-substitutive.
Proof. We have to show that ∀M, N ∈ Terms, and

V, W ∈ V such that x, x M (R) •H N and ∅ V (R) •H W , it holds that x M {x/V } (R) •H N {x/W }. The proof is by induction on the proof derivation for x, x M ((R) • ) H N . • If M = x and x, x x(R) • N -with x ∈ x-then the result holds by definition of call-by-value open extension: for all V ∈ VΛ ⊕ , x V (R) • N {x/V }.
• In the case where the derivation is of the form:

x, x, y P (R)

•H Q x, x λy.Q (R) • N x, x λy.P (R) •H N
Then it holds by induction hypothesis that x, y P {V /x} (R) The proof is similar in the remaining cases.

We now see that value-substitutivity allows us to extend the coinductive proof technique to open relations: to show that a value-substitutive open relation R is contained in

• , it is enough to show that its restriction to program is a simulation, hence contained in . The validity of this proof technique comes as a direct consequence of Lemma 5.1.5 below.

V 1 , . . . , V n values, it holds that M {x 1 , . . . , x n /V 1 , . . . , V n } S N {x 1 , . . . , x n /V 1 , . . . , V n }. Since R is value-substitutive, we can deduce from x M R N that: ∅ M {x 1 , . . . , x n /V 1 , . . . , V n } R N {x 1 , . . . , x n /V 1 , . . . , V n }, which allows us to conclude the proof since R ∅ = R |P is contained in S.
Since ( • ) H is value-substitutive-from Lemma 5.1.4-Lemma 5.1.5 tells us that conservativity of the Howe's lifting of • will be implied as soon as we know that ( • ) H |P is contained in . For this purpose, we use the coinductive proof technique, and show that ( • ) H

|P is a simulation3 on the LMC M cbv Λ ⊕ . To be precise, we have to consider the binary relation on S cbv Λ ⊕ naturally induced by ( • ) H |P : M and N are connected as soon as

M ( • ) H
|P N , and V , W are connected as soon as

V ( • ) H |P W . We will denote ( • ) H |S cbv Λ ⊕
this relation on S cbv Λ ⊕ . We first recall the Disentangling Lemma, shown by Dal Lago, Sangiorgi and Alberti for the purpose of the soundness proof for probabilistic applicative bisimilarity in CBN. Our formulation here is actually a corollary of their Disentangling Lemma. The intuition is that when D and E are related by the asymmetric lifting of R, then it is possible to go from D to E by moving weight on paths that are valid for R, that is the path is either in R, or go from the divergent state ⊥ to a state of T . Lemma 5.1.6 (From [START_REF] Lago | On coinductive equivalences for higherorder probabilistic functional programs[END_REF]) Let S, T be two countable sets, and R ⊆ S × T a binary relation. Let D be a finitely supported distribution over S, and E any sub-distribution over T . Then D -→ (R) E if and only if there exists a sub-distribution π over R such that :

• for every t ∈ S, s∈S(D) π(s, t) ≤ E (t); • for every t ∈ T , t∈S(E ) π(s, t) = D(s).
We will say that such a π is an asymmetric coupling from D to E that respects R, and we will write π D&E .

Lemma 5.1.7 (Key Lemma)

( • ) H |S cbv Λ ⊕ is a simulation on the LMC M cbv Λ ⊕ .
Proof. Looking at the definition of simulation, and at the structure of the LMC M cbv Λ ⊕ , we see that we have to show:

1. For every V ∈ V, and M, N ∈ Terms such that ∅ λx.M ( • ) H λx.N , it holds that ∅ M {V /x} ( • ) H N {V /x}. 2. For all programs M, N such that ∅ M ( • ) H N , it holds that M -→ (( • ) H ) N -where -→ (( • ) H
) is the asymmetric lifting to sub-distributions, as defined in Definition 4.2.10 of Chapter 4 i.e.:∀A ⊆ V,

M (A) ≤ N (( • ) H (A)). Proof of item 1. If ∅ λx.M ( • ) H λx.N ,
∅ M {V /x} ( • ) H N {V /x}.
Proof of item 2. We first use the following property of the asymmetric lifting-that can be easily checked from its definition: for any binary relation on S ×T , if D is a directed set of sub-distributions over S, and E any sub-distribution over T , it holds that:

∀D ∈ D, D -→ (R) E ⇒ sup D -→ (R) E .
This remark allows us to use the approximations semantics instead of the exact semantics of M , so we we can now reformulate our goal as:

∅ M ( • ) H N ⇒ ∀D with M ⇓ D, D -→ (( • ) H ) N . (5.1)
It is easier to show (5.1) that directly the statement in Lemma 5.1.7, since now we can reason by induction on the proof derivation of M ⇓ D.

We will also use the fact that given a set of set of open terms X, let λx.X = {λx.M | M ∈ X}. Since all values are λ-abstractions, a set A ⊆ V may be represented as λx.X, where X is a set of open terms that no other free variables that x. Now, by looking at the definition of ( • ) H , we see that (

• ) H (A) = • (λx.( • ) H (X)). To sum up: ( • ) H ∩ {(L, K) | L ∈ V} = {(λx.L, K) | ∃T with L ( • ) H T ∧ λx.T • K}, (5.2)
We now show (5.1) by induction on the proof derivation of M ⇓ D. We consider separately each possible rule which can be applied at the bottom of the derivation:

• If the rule used corresponds to the fact that, for every term, the empty distribution is an approximate semantics, the derivation is: bv M ⇓ ∅ then D = ∅, and indeed

∅ -→ (( • ) H ) N . • If M is a value V = λx.L and the last rule of the derivation is b v V ⇓ {V 1 } then D = {V 1 }
is the Dirac distribution for V and, by the definition of Howe's lifting, ∅ λx.L ( • ) H N was derived by the following rule:

x L( • ) H K ∅ λx.K • N ∅ λx.L( • ) H N Recall that (∅ λx.K • N )
and that is a simulation on our LMC. Since and • coincide on closed terms, it tells us that {λx.

K 1 } -→ ( • ) N . Our goal now is to show that also λx.K -→ (( • ) H ) N . Let λx.X ⊆ V. If λx.L ∈ λx.X then D(λx.X) = 0. Otherwise, D(λx.X) = D(λx.L) = 1 = N ( • {λx.K}). It follows from L( • ) H K and from λx.L ∈ λx.X that λx.K ∈ λx.(( • ) H X); hence, N ( • {λx.K}) ≤ N ( • λx.(( • ) H X)). So using (5.2), we can conclude that {V 1 } -→ (( • ) H ) N . • If the derivation of M ⇓ D is of the following form: M 1 ⇓ K M 2 ⇓ F {P {x/V } ⇓ E P,V } λx.P ∈S(K ), V ∈S(F ) M 1 M 2 ⇓ V ∈S(F ) F (V ) λx.P ∈S(K ) K (λx.P ).E P,V
Then M = M 1 M 2 and we have that the last rule used in the derivation of ∅ M ( • ) H N is:

∅ M 1 ( • ) H M 1 ∅ M 2 ( • ) H M 2 ∅ M 1 M 2 • N ∅ M 1 M 2 ( • ) H N
We are first going to apply the induction hypothesis to the derivation of M 1 ⇓ K and M 2 ⇓ F : by using the Disentangling Lemma-that we recalled in Lemma 5.1.6-we see that there are two couplings π 1 , π 2 that respect

-→ (( • ) H ) such that π 1 K & M 1 and π 2 F & M 2 .
Recall that our goal is to show that D -→ (( • ) H ) N . First, we use these couplings to express the sub-distribution D:

D = V F (V ) λx.P K (λx.P ).E P,V = V,P W π 1 (V, W )   Q π 2 (λx.P, λx.Q)   E P,V = W,Q P,V π 1 (V, W ) • π 2 (λx.P, λx.Q) • E P,V
We fix now W and Q, and we consider V, P such that π 1 (V, W ) > 0 and π 2 (λx.P, λx.Q) > 0. Observe that since π 1 and

π 2 respect ( • ) H , it means that ∅ V ( • ) H W and ∅ λx.P ( • ) H λx.Q.
It implies-by construction of Howe's lifting-that there exists S with x P ( • ) H S and ∅ λx.S • λx.Q.

• We first utilize x P ( • ) H S . Since ( • ) H is value-substitutive, it holds that ∅ P {V /x} ( • ) H S{W/x};
we may apply the induction hypothesis, and we obtain that

E P,V -→ (( • ) H ) S{W/x} .
(5.3)

• We now utilize the fact that ∅ λx.S • λx.Q. Since is a simulation-and and • coincide on closed terms-and that in the LMC

L cbv Λ ⊕ , for U ∈ {S, Q}, λx.U W →{U {W/x} 1 }, it holds that ∅ S{W/x}
( • •( • ) H ) Q{W/x} . Recall that we know also from Lemma 5.1.3 that • •( • ) H ⊆ ( • ) H . Moreover, we know also-from Remark 4.2.1 of Chapter 4 -that whenever R ⊆ S, then -→ (R) ⊆ -→ (S). As a consequence, we deduce that E P,V -→ (( • ) H ) Q{W/x} .
Summing up, and using that -→ (( • ) H ) is stable by linear combinations -from Remark 4.2.1 of Chapter 4 -we obtain that:

D -→ (( • ) H ) W,Q P,V π 1 (V, W ) • π 2 (λx.P, λx.Q) • Q{W/x} .
(5.5)

Now, we use the fact that

π 1 K & M 1 and π 2 F & M 2 tell us: P π 1 (λx.P, λx.Q) ≤ M 1 (λx.Q), and similarly V π 2 (V, W ) ≤ M 2 (W ).
From there, we can use the fact that -→ (R) is right-stable under pointwise order-see once again Remark 4.2.1-we can deduce from (5.5) that:

D -→ (( • ) H ) W,Q M 1 (λx.Q) • M 2 (W ) • Q{W/x} .
(5.6)

Observe now that the right part in (5.6) is exactly

M 1 M 2 . As a consequence (5.6) implies D -→ (( • ) H ) M 1 M 2 .
We are now almost ready to conclude: indeed we know by hypothesis that ∅ M 1 M 2 • N , and that • is a bisimulation, it holds that also M 1 M 2 -→ ( • ) N , and we can conclude by using again that

(( • ) H ) N . • If M ⇓ D is derived by: M 1 ⇓ D 1 M 2 ⇓ D 2 ⇓ M 1 ⊕ M 2 1 2 D 1 + 1 2 D 2 then ∅ M ( • ) H N is derived by: ∅ M 1 ( • ) H N 1 ∅ M 2 ( • ) H N 2 ∅ N 1 ⊕ N 2 • N ∅ M 1 ⊕ M 2 ( • ) H N
By the inductive hypothesis, for i ∈ {1, 2} we have that for any λx.X ⊆ V,

D i (λx.X) ≤ N i ( • λx.(( • ) H X))
Hence, the result follows from:

1 2 • D 1 (λx.X) + 1 2 • D 2 (λx.X) ≤ 1 2 • N 1 ( • λx.(( • ) H X)) + 1 2 • N 2 ( • λx.(( • ) H X))
We have now all ingredients necessary to state compatibility of We may now apply Proposition 5.1.2 since is a observationally correct preorder, and • a compatible open relation, and we obtain that is sound with respect for the context preorder, and by symmetry we also obtain soundness of ≡.

Corollary 5.1.1 cbv

Λ ⊕ is sound with respect to context preorder, and ≡ cbv Λ ⊕ is sound with respect to context equivalence.

Full Abstraction for Probabilistic Applicative Bisimulation.

In the setting of CBN Λ ⊕ , Dal Lago, Sangiorgi and Alberti [START_REF] Lago | On coinductive equivalences for higherorder probabilistic functional programs[END_REF] showed that neither probabilistic applicative bisimilarity nor probabilistic applicative similarity are complete-i.e bisimilarity does not coincide with context equivalence, and similarity does not coincide with context preorder. In this section, we show that by contrast, for CBV Λ ⊕ , probabilistic applicative bisimilarity and context equivalence actually coincide, while probabilistic applicative similarity do not coincide with the context preorder. It highlights a previously unobserved gap both between the CBN and the CBV semantics, and between the symmetric and the asymmetric case. At the time where we published it-in a joint work with Ugo Dal Lago [START_REF] Crubillé | On probabilistic applicative bisimulation and call-byvalue λ-calculi[END_REF]-, it was an unexpected result, because these phenomenon appear neither in the deterministic case-where both applicative similarity and applicative bisimilarity are fully abstract, irrespective of whether the reduction strategy is call-by-name or call-by-value-nor in Λ enriched with a non-deterministic operator-where neither applicative similarity nor applicative bisimilarity are complete, irrespective of whether the reduction strategy is call-by-name or call-by-value, and of whether we take a may-converge or must-converge flavor [START_REF] Lassen | Relational reasoning about functions and nondeterminism[END_REF].

To show full-abstraction of probabilistic applicative bisimilarity, we are going to use the characterization of LMC bisimilarity established by Breugel et. al., that is based on a notion of testing: two states are bisimilar if they have the same success probability under some family of tests. Our proof method consists in showing that when we consider the LMC M cbv Λ ⊕ , every relevant test α may be emulated by a Λ ⊕ -context C-i.e. for any program M , the termination probability of C[M ] is the same as the probability that the test α succeeds when executed on M .

Labeled Markov Processes (LMP)

Breugel et al actually work with more general objects than LMCs: they consider Labeled Markov Processes, that are a generalization of LMCs designed to deal with continuous probabilities. The concept of probabilistic bisimulation has been generalized to LMPs by Desharnais et al, more than ten years ago [START_REF] Desharnais | Bisimulation for labelled markov processes[END_REF][START_REF] Desharnais | Approximating labelled markov processes[END_REF]. Later, Breugel et al showed that similarity and bisimilarity as defined in the aforementioned paper exactly correspond to appropriate, and relatively simple, notions of testing [START_REF] Van Breugel | Domain theory, testing and simulation for labelled markov processes[END_REF]. We are going to summarize here those of their results that are relevant for our purposes. To this end, we will need the elementary notions of measure theory that have been presented in Chapter 1.

The first step consists in giving a the definition of Labelled Markov Processes: they are a generalization of LMCs in which the set of states is not restricted to be countable: Definition 5.2.1 A Labelled Markov Process (LMP in the following) is a triple M process = (Ω, Act, µ), consisting of a measurable set of states Ω = (S, Σ)-i.e. S is a set, and Σ a σ-field over S-, a countable set of labels Act, and a transition probability function µ : S × Act × Σ → [0, 1], which has to be a Markov Kernel on (Ω, Act), i.e. such that:

• for all x ∈ S, and a ∈ Act, the naturally defined function µ x,a (•) : Σ → [0, 1] is a sub-probability measure on Ω; • for all a ∈ Act, and A ∈ Σ, the naturally defined function µ (•),a (A) : S → [0, 1] is measurable. We note Ker(Ω, Act) the set of all Markov Kernels on (Ω, Act).

The notion of (bi)simulation can be smoothly generalized to the continuous case. We give here the definition following [START_REF] Desharnais | Approximating labelled markov processes[END_REF]. The one given in [START_REF] Van Breugel | Domain theory, testing and simulation for labelled markov processes[END_REF] is slightly different, but as noted there it leads to the same similarity and bisimilarity notions. Definition 5.2.2 (From [START_REF] Van Breugel | Domain theory, testing and simulation for labelled markov processes[END_REF]) Let (Ω, Act, µ) be a LMP, with Ω = (S, Σ) and let R be a relation on S.

• R is a simulation, if it is a preorder and if whenever s R t, then for every a ∈ Act and A measurable R-closed subset of Ω, it holds that µ s,a (A) ≤ µ t,a (A).

• R is a bisimulation if it is an equivalence relation, and if whenever s R t, then for every a ∈ Act and A measurable and R-closed subset of Ω, it holds that µ s,a (A) = µ t,a (A).

For a LMP M process , both the greatest simulation and the greatest bisimulation exist [START_REF] Desharnais | Approximating labelled markov processes[END_REF]: we call them respectively similarity-that we denote M process -and bisimilarity-denoted ≡ M process . Labelled Markov Chains can be seen as a particular kind of LMPs-the ones on discrete measurable spaces, where the states space S is countable, and the σ field Σ is taken as Parts(S) -as highlighted in Example 1.4.2 from Chapter 1 it is indeed a σ-field over S. We express in Lemma 5.2.1 below that Markov Kernels on those kind of discrete LMPs are in one-to-one correspondence with probability matrices, meaning that discrete LMPs are exactly LMCs.

Lemma 5.2.1 Let S be a countable set, and Act a countable set of labels. Let Ω S be the measurable set (S, Parts(S)). Then we can build a bijection φ from Ker(Ω s , Act) into the sets of all probability matrices over S, by taking:

φ : µ ∈ Ker(Ω s , Act) → P µ with P µ (s, a, t) = µ s,a ({t}).
Proof. First, we have to show that for every Markov Kernel µ ∈ Ker(Ω S , Act), φ(µ) is indeed a probability matrix i.e that for every state s ∈ S and for every label l ∈ L, t∈S φ(µ)(s, l, t) ≤ 1. It is a direct consequence of the fact that µ s,a (•) is a sub-probability measure on Ω S : indeed 1 ≥ µ s,a (S) = s∈S µ s,a ({t}) since S is countable.

Then, we define a function ψ from the set of probability matrices over S into the set of Markov kernels over (Ω S ), and we show that ψ is the inverse of φ. Whenever P is a probability matrix, we define ψ(P) : S × Act × Parts(S) → [0, 1] as ψ(P)(s, Act, S) = x∈S M (s, a, x). We see that ψ(P) is indeed a sub-distribution over Ω S . Moreover since S is countable, any function S → [0, 1] is a measurable function: it means that ψ(P) is indeed a Markov kernel. Moreover, we see easily that both φ • ψ and ψ • φ coincide with the identity, that concludes the proof.

In the following, if M = (S, Act, P) is a LMC, we will use M σ to denote the LMP ((S, Parts(S)), Act, φ -1 (P)). We show now that bisimilarity and similarity are preserved by φ. Lemma 5.2.2 Let M = (S, Act, P) be a LMC, and s, t two states in S. Then it holds that:

1. s M t, if and only if s M σ t;

2. s ≡ M t, if and only if s ≡ M σ t;
Proof. We first show item 1. We are going to show that any pre-order R on S is a simulation for the LMC M if and only if it is a simulation for the LMP M σ .

• Let R be a preorder on S which is a simulation for the LMC M . Let s, t ∈ S be such that s R t. Let a ∈ Act and A be a measurable R-closed subset of Ω S . Since R is a simulation on the LMC M , it holds that P(s, a, A) ≤ P(t, a, R(A))). Since A is R-closed, P(t, a, R(A)) = P(t, a, A), hence P(s, a, A) ≤ P(t, a, (A)). We can rewrite this inequality using the bijection φ as

µ φ -1 (M ) (s, a, A) ≤ µ φ -1 (M ) (t, a, A). As a consequence, R is a simulation on the LMP φ -1 (M ) = M σ .
• Let R be a preorder on S which is a simulation for the LMP M σ . Let s, t ∈ S be such that s R t. Let a ∈ Act and X ⊆ S. First, observe that R(A) is a measurable set with respect to the σ-field Ω S -since in the discrete σ-algebra, all subsets are measurable. Since R is a preorder, it holds that

R(R(X)) = R(X), hence R(A) is a R-closed measurable subset of Ω S .
As a consequence, we can use the fact that R is a simulation for the LMP M σ , and we obtain that: µ M σ (s, a, R(A)) ≤ µ M σ (t, a, R(A)), which we can rewrite by looking at the way we define M σ from M as: P(s, a, R(A)) ≤ P(t, a, R(A)). Since moreover A ⊆ R(A)-since R is reflexive-we can deduce that also P(s, a, A) ≤ P(s, a, R(A)). By combining these two inequalities, we deduce that P(s, a, A) ≤ P(t, a, R(A)) and from there we obtain that R is a bisimulation for the LMC M .

Since we know that both the greatest simulation for the LMC M and the greatest simulation for the LMP M σ are pre-order, we can conclude that they coincide. The proof of item 2 is similar.

It means that we are able, using the function φ defined in Lemma 5.2.1, to transfer all results that hold for bisimilarity or similarity on LMPs to the analogous notions of LMCs. It is in particular the case of Breugel et. al.'s testing characterization for LMP bisimilarity, that we present in the next paragraph.

Bisimilarity and Similarity are Characterized by Tests

In 1980, Milner and Hennessy [START_REF] Hennesy | On observing non-determinism and concurrency lecture notes in computer science[END_REF][START_REF] Hennessy | Algebraic laws for nondeterminism and concurrency[END_REF] introduced the so-called Hennessy-Milner modal logic (HML), and showed it fully characterize bisimilarity on LTSs that are image-finite-i.e. such that, from any state s, and for every action a there is a finite number of state t such that s a →t-, i.e. that two states s and t are bisimilar if and only if they satisfy the same formulas. Using this logical characterization, Abramsky developed in [START_REF] Abramsky | Observation equivalence as a testing equivalence[END_REF] a testing characterization for those LTSs that are both image-finite and finitely branching -for every s, there is a finite number of actions a that may be done. Intuitively, a test specifies an interaction between an experimenter and a process, and this interaction may succeed or fail. Since LTSs are non-deterministic, several runs of a test on a given process may lead to different outcomes; for this reason, the behavioral semantics of a test α is a function α : S → Parts({⊥, }). Abramsky's showed that his testing language characterizes bisimilarity, in the sense that two states s, t are bisimilar if and only if, for every test α, α (s) = α (t).

When introducing bisimilarity for LMCs [START_REF] Larsen | Bisimulation through probabilistic testing[END_REF], Larsen and Skou also introduced a test language designed to characterize it. As in the LTS case, different runs of a test may lead to different outcomes; however since we are now in a probabilistic setting, we are not interested anymore into the set of all possible outcomes, but in the probability of obtaining each outcome. It means that the semantics of a test is now a function α : S → ∆ = ({⊥, }).

Observe that since we consider proper distributions, the probability of obtaining ⊥ can actually be computed from the probability of obtaining , and so we see that it is enough to specify for each state s the success probability of α on s. Larsen and Skou showed that when a LMC verifies the so-called minimal deviation assumption [START_REF] Larsen | Bisimulation through probabilistic testing[END_REF]-intuitively, it requires that whenever two transition probabilities are different, they must not be arbitrarily close-two states s and t are bisimilar if and only if for each test α expressible in the test language, the success probability of α is the same irrespective of whether it is applied to s or t. Unfortunately, the minimal deviation assumption is not verified by the LMC L cbv Λ ⊕ we are interested in. Breugel et al extended in [START_REF] Van Breugel | Domain theory, testing and simulation for labelled markov processes[END_REF] Larsen Skou's testing characterization to the more general class of LMPs, which encompass all LMCs, and so allows us to get rid of the minimal deviation requirement. They actually consider two test languages: a language T 0 similar to the one of Larsen Skou, that characterizes bisimilarity, and a larger one T 1 that characterizes similarity: two states s, t of a LMP are bisimilar if and only if they have the same probability of passing successfully each test of T 0 , while they are connected by the similarity relation if for every test in T 1 , t has a greater or equal probability of passing it successfully than s. We present here the test language T 1 , T 0 and how to compute the success probability of tests when executed on some LMP state.

We first define tests as purely syntactic objects, generated by a BNF grammar, and then we construct a family of measurable functions S → [0, 1], that specify the success probability of a given test starting from any state in S.

Definition 5.2.3 Let M process = (S, Act, µ) be a LMP. We define the test language for similarity T 1 (M process ), and the test language for bisimilarity T 0 (M process ) respectively as:

α ∈ T 1 (M process ) ::= ω | a • α | α, α | α ∨ α; α ∈ T 0 (M process ) ::= ω | a • α | α, α
where a ∈ Act.

Please observe that tests are finite objects. Each test in T 1 specifies an interaction between an experimenter and a system with buttons: for each action in a, the experimenter may push the corresponding button, and then the system may fail or accept to carry on the interaction. We describe now for each test which experiment it specifies. ω is the test that always succeeds. The test a•α represents the experimenter pushing the button a to ask the system to perform this action, and in case of success proceeds with performing the test α. The test α, β is a conjunctive test, that makes two copies of the current underlying state of the system, tests them independently according to α and β and succeeds iff both tests succeed. The test α ∨ β is a disjunctive test, that also makes two copies of the underlying state and tests them independently according to α and β, but succeeds as soon asat least one of these experiments succeed. We now give a behavioral semantics to tests, in a way consistent with the interpretation of tests as experiments described above. It consists in associating a success probability to every tests, that depends on the LMP describing the underlying system being tested, and also on which state of this LMP we take as initial state when starting the test run. It is formalized accordingly in Definition 5.2.4 below. Definition 5.2.4 (From [START_REF] Van Breugel | Domain theory, testing and simulation for labelled markov processes[END_REF]) Given a labeled Markov Process M process = (S, Σ, µ), we define the behavioral semantics for tests in T 1 (M process ), as the indexed family {Pr M process (•, α)} α∈T 1 (M process ) (such that Pr M process (•, α) : S → R is a measurable function) by induction on the structure of α:

Pr M process (s, ω) = 1; Pr M process (s, a • α) = Pr M process (•, α)dµ s,a ; Pr M process (s, α, β ) = Pr M process (s, α) • Pr M process (s, β); Pr M process (s, α ∨ β) = Pr M process (s, α) + Pr M process (s, β) -Pr M process (s, α) • Pr M process (s, β)
Observe that both T 1 and T 0 encompass traces-i.e. the linear tests presented in Section 4.2.1 from Chapter 4-but also offer more possibilities to the experimenter who, at each step of the experiment, may also decide to copy the process he interacts with.

We consider now the particular case where LMPs are discrete, i.e of the form M σ where M is a LMC, we denote Pr M (s, α) to mean Pr M σ (s, α). Looking at the way success probability for tests on M σ are defined, we see that we can give a more direct formulation of Pr M (s, α) as expressed in Proposition 5.2.3 below, that takes advantage of the discrete setting to replace Lebesgue integration with an infinite sum.

Pr M (s, a • α) = t∈S Pr M (t, α) • P(s, a, t); Pr M (s, α, β ) = Pr M (s, α) • Pr M (s, β); Pr M (s, α ∨ β) = Pr M (s, α) + Pr M (s, β) -Pr M (s, α) • Pr M (s, β)
Proof. It is a direct consequence of the characterization of Lebesgue integrals for discrete spaces given in Chapter 1.

Example 5.2.1 We give here an example of how operates a test on the LMC L cbv Λ ⊕ . We consider the test

α = eval • V • eval • ω, eval • ω ∈ T 0 (M cbv Λ ⊕ )
, where V is any value in V. The interaction specified by this test is as follows: first the experimenter evaluates the program, and passes to it the value V as an argument, then he takes two copies of the resulting program, and evaluates each of them independently; the test succeeds if both evaluations terminate.

We look now at what happens when we apply α to the programs M = λy.(Ω ⊕ I), and N = (λy.Ω) ⊕ (λy.I). We represent in Figure 5.2 the main steps needed to compute Pr

L cbv Λ ⊕ (M, α) and Pr L cbv Λ ⊕ (N, α).
Due to the inductive nature of the definition of tests success probability, this computation has to be done starting from the states represented to the bottom of Figure 5.2, towards the states represented at the top: we start from the fact that Pr(u, ω) = 1, and from there, we build step by step the success probability of α on M and N . At the end, we obtain that Pr We state now the characterization of bisimilarity and similarity by testing, as shown by Breugel et al. for LMPs: it is possible to decide which pair of states are similar and bisimilar by looking at the probability success of tests when applied to these states.

L cbv Λ ⊕ (M, α) = 1 4 , while Pr L cbv Λ ⊕ (N, α) = 1 2 . s 1 = λy.(Ω ⊕ I) t 1 = (λy.Ω) ⊕ (λy.I) p 1 (s 2 ) = 1 4 p 1 (t 1 ) = 1 2 p 1 (v) ::= Pr(v, eval • α ) s 2 = λy.(Ω ⊕ I) α ::= V • eval • ω, eval • ω p 2 (v) ::= Pr(v, α ) p 2 (s 2 ) = 1 4 p 2 (t 2 ) = 0 p 2 (t 2 ) = 1 t 2 = λy.Ω t 2 = λy.I s 3 = (Ω ⊕ I) p 3 (v) ::= Pr(v, eval • ω) p 3 (s 3 ) = 1 2 p 3 (t 3 ) = 0 p 3 (t 3 ) = 1 t 3 = Ω t 3 = I u = I Pr(u, ω) = 1 eval eval 1 2 1 2 V V V
Theorem 5.2.4 ( [START_REF] Van Breugel | Domain theory, testing and simulation for labelled markov processes[END_REF]) Let M process = (S, Σ, µ) be a LMP, and s, t ∈ S. Then:

• s ≡ M process t iff Pr M process (s, α) = Pr M process (t, α) for every test α ∈ T 0 (M process ).

• s M process t iff Pr M process (s, α) ≤ Pr M process (t, α) for every test α ∈ T 1 (M process ).

Recall that bisimilarity on M and M σ coincide, and it is also true for similarity. It means that for characterizing bisimilarity or similarity on M , Theorem 5.2.4 tells us it is enough to consider the success probability of tests on M σ .

Every Test in T 0 has an Equivalent Context

Our objective now is to apply the testing characterization given in Theorem 5.2.4 to the particular case where we consider the LMC L cbv Λ ⊕ -introduced in Section 5.1.1 to define probabilistic applicative bisimilarity on CBV Λ ⊕ -in order to show completeness of ≡ cbv Λ ⊕ with respect to context equivalence for CBV Λ ⊕ . Theorem 5.2.4 tells us indeed that proving (≡ cbv Λ ⊕ ) ⊇ ( ≡ ctx ) boils down to show that whenever M and N have exactly the same convergence probability under any contexts, they have also exactly the same success probabilities for all tests. Or, more precisely, that for a given test α, there exists a context C, such that for all programs M , the success probability of α on M is exactly the convergence probability of C[M ]:

Pr L cbv Λ ⊕ (M, α) = | C[M ] |.
When we are able to build such context C, we say that C emulates the test α. We have to be careful here, since we have in fact two different kinds of states in S cbv Λ ⊕ : programs and distinguished values. In consequence, we define two encodings Θ P , Θ V : T 0 → C Λ ⊕ that build contexts emulating the action of tests when they are executed respectively on programs and distinguished values. It means that for each test α, its success probability starting from the state M is the same as the termination probability of the context

α • ∧ ω ω Θ P (α) = λz.(Θ V (V • eval • ω, eval • ω )[z])[•] Θ V (V • eval • ω, eval • ω ) = Θ P ( eval • ω, eval • ω )[([•]V )]; Θ P ( eval • ω, eval • ω ) = f (Θ P (eval • ω), Θ P (eval • ω)) Θ P (eval • ω) = (λx.((Θ V (α)[x])))[•] Θ V (ω) = λy.[•] eval V eval eval Figure 5.3: Context Θ P (α) emulating the test α = eval • V • eval • ω, eval • ω . Θ P (α)[M ]
, and similarly, its success probability starting from the state V is the same as the termination probability of Θ

V (α)[V ]. Definition 5.2.5 We define Θ V , Θ P : T 0 (M cbv Λ ⊕ ) → C Λ ⊕ by mutual induction on the structure of α ∈ T 0 (M cbv Λ ⊕ )
, as specified below:

1. Non-relevant actions:

Θ P (V • α) = Ω[•] and Θ V (eval • α) = Ω[•]; 2. Ever-Successful Test: Θ P (ω) = λx.[•]; Θ V (ω) = λx.[•]; 3. Action V : Θ V (V • α) = Θ P (α)[([•]V )];
4. Action eval:

Θ P (eval • α) = λx.(Θ V (α)[x])[•] with x ∈ VΘ V (α); 5. Conjunction: Θ P ( α, β ) = f (Θ P (α), Θ P (β)) and Θ V ( α, β ) = f (Θ V (α), Θ V (β)); where f : C Λ ⊕ × C Λ ⊕ → C Λ ⊕ is defined as 4 : f (C, D) = (λx.(λy, z.I)(C[xI])(D[xI]))(λx.[•]); where x ∈ VC ∪ VD
Observe that Definition 5.2.5 is actually ambiguous, since we have to choose the variable x arbitrarily in item 4, item 5. However, the contexts it is possible to build are equivalent using α-conversion, which is enough since we fill them with programs only.

In the example below, we show how the ability of CBV contexts to first evaluate and next copy programs allows us to emulate tests with a conjunctive structure. By contrast, CBN contexts do no have this ability, and in consequence are not able to emulate conjunctive tests.

Example 5.2.2 We look at the test α = eval•V • eval • ω, eval • ω of Example 5.2.1: recall that we used this test to distinguish the programs λx.(Ω ⊕ I) and (λx.Ω) ⊕ (λx.I), that cannot be distinguished by linear traces alone. We illustrate Definition 5.2.5 by building the context emulating the test α: we want to compute Θ P (α). The inductive step-bystep computation from Definition 5.2.5 is represented in Figure 5.3, where the test α is represented by its syntax tree. We analyze here the behavior of the resulting context, looking at each block used to built it.

• First, we see that Θ P (eval•ω) = (λx.(λy.x)) [•]. We denote this context C ↓ ; intuitively, it evaluates its argument and then store the result. Observe that for every N , it holds that the convergence probability of C ↓ [N ] is equal to that of N .

• We look now at the context Θ P ( eval • ω, eval • ω ), that we denote C 2×↓ . Observe that as represented in Figure 5.3, we may compute C 2×↓ by using C ↓ and the conjunctive function f . We obtain:

C 2×↓ = (λx.(λy.λz.I)C ↓ [xI]C ↓ [xI])(λx.[•]).
We denote this context We see that for any program N , it holds that:

C 2×↓ [N ] → (λy.λz.I)(C ↓ [(λx.N )I])(C ↓ [(λx.N )I]).
Recall from Chapter 2 that (λx.N )I is contextually equivalent to N -since they reduce to exactly the same distribution over values. As a consequence, the termination probability of C 2×↓ [N ] is the same as that of the program below:

(λy.λz.I)(C ↓ [N ])(C ↓ [N ]).
On this form, it is easier to understand what C 2×↓ does: it takes two copies of its argument N , evaluates each of them independently using the context C ↓ , and returns I-the identity term -whenever this computation terminates.

• Finally, we see that

Θ P (α) = (λx.Θ P ( eval • ω, eval • ω )[xV ])[•].
It means that Θ P (α) does the following: first it evaluates its argument, then it passes to them the value V , and finally it gives the result to the context C 2×↓ .

If we sum up the considerations above, we see that the context Θ P (α) emulates indeed the interaction specified by the test α, that has been analyzed in details in Example 5.2.1.

We now state the main result of this section: for each test α ∈ T 0 , its behavior on programs is indeed emulated by the context Θ P (α). This result is crucial for showing completeness of ≡ cbv Λ ⊕ with respect to context equivalence in CBV, since it amounts to show that the testing characterization of bisimilarity on M cbv Λ ⊕ can be translated into a characterization by a family of contexts. Theorem 5.2.5 Let α be a test in T 0 (M cbv Λ ⊕ ). Then for every M closed term and every V value it holds that:

Pr M cbv Λ ⊕ (M, α) = | Θ P (α)[M ] |; Pr M cbv Λ ⊕ ( V , α) = | Θ V (α)[V ] |.
Proof. We are going to show the thesis by induction on the structure of the test α.

• If α = ω, then for every closed term M , and every closed value V , both Pr

M cbv Λ ⊕ (M, ω)
and Pr

M cbv Λ ⊕ ( V , ω) are equal to 1, and we have defined accordingly

Θ P (ω) = Θ V (ω) = λx.[•]. Since Θ P (ω)[M ] and Θ V (ω)[V ]
are values, their termination probability is 1, and so the result holds.

• If α = β 1 , β 2 we see by induction hypothesis, that for all 1 ≤ i ≤ 2, ∀M ∈ P, ∀V ∈ V: Pr M cbv Λ ⊕ (M, β i ) = | Θ P (β i )[M ] | and Pr M cbv Λ ⊕ ( V , β i ) = | Θ V (β i )[V ] |.
Looking at Definition 5.2.5, we see that :

Θ P ( β 1 , β 2 ) = f (Θ P (β 1 ), Θ P (β 2 )) Θ V ( β 1 , β 2 ) = f (Θ V (β 1 ), Θ V (β 2 ))
The overall behavior of the context f (C, D) is to copy the content of its hole into the holes of the two contexts C and D. For any closed term M , and as soon as x does not already appear neither in C nor in D, we can express the convergence probability of f (C, D)[M ] as a function of the convergence probability of C[M ] and D[M ]:

| f (C, D)[M ] | = (| C[(λx.M )I] |) • (| D[(λx.M )I] |) = (| C[M ] |) • (| D[M ] |) since ∀L ∈ P, L ≡ ctx (λx.L)I
As a consequence, for any closed term M , and any value V :

| Θ P ( β 1 , β 2 )[M ] | = Pr M cbv Λ ⊕ (M, β 1 ) • Pr M cbv Λ ⊕ (M, β 2 ) = Pr M cbv Λ ⊕ (M, β 1 , β 2 ); | Θ V ( β 1 , β 2 )[V ] | = Pr M cbv Λ ⊕ ( V , β 1 ) • Pr M cbv Λ ⊕ ( V , β 2 ) = Pr M cbv Λ ⊕ ( V , β 1 , β 2 );
and so the result holds. • If α = a • β, then we consider separately the case where a is the action eval, and the case where it is a value:

• First, let us suppose that a = eval. We first consider Θ V (α): since the eval action is relevant only for states of M cbv Λ ⊕ which are terms (and not distinguished values), we want to show that Θ V (α)[V ] always diverges. Since Θ V (α) = Ω[•] and since Ω = ∅, we have indeed that for any V ∈ V, Θ V (α)[V ] = ∅. We consider now Θ P (α): by the induction hypothesis, we know that Pr

M cbv Λ ⊕ ( V , β) = | Θ V (β)[V ] |. Please recall that we have defined Θ P (a • β) = λx.(Θ V (β)[x])[•]
, where x is a fresh variable that in particular does not already appear in Θ V (β). We can see now that for every M ∈ P, it holds that:

| Θ P (a • β)[M ] | = V M (V ) • | Θ V (β)[V ] | = V M (V ) • Pr M cbv Λ ⊕ ( V , β) = s∈S cbv Λ ⊕ P cbv Λ ⊕ (M, eval, s) • Pr M cbv Λ ⊕ (s, β) = Pr M cbv Λ ⊕ (M, β)
• Now, we suppose that a = V , with V ∈ V. First, recall that we have defined

Θ P (V • β) = Ω[•],
and so Pr

M cbv Λ ⊕ (M, V • β) = 0 = | Θ P (V • β)[M ] |.
We look now at Θ V (V • β), that as been defined in Definition 5.2.5 as

Θ P (β)[[•]V ]. For any W = λx.M ∈ V, we can see that: | Θ V (V • β)[W ] | = | Θ P (β)[W V ] | = Pr M cbv Λ ⊕ (W V, β) by induction hypothesis = Pr M cbv Λ ⊕ (M {V /x}, β) since W V = M {V /x} = Pr M cbv Λ ⊕ ( Ŵ , V • β).
We can now use the contexts emulating T 0 (M cbv Λ ⊕ ) to finally show that ≡ cbv Λ ⊕ is fully abstract with respect to context equivalence in CBV Λ ⊕ . Theorem 5.2.6 ≡ is fully abstract with respect to the contextual equivalence.

Proof. We already know from corollary 5.1.1 that ≡ is sound, that is ≡⊆ ≡ ctx . Hence, what is left to show is that ≡ ctx ⊆≡. Let M, N ∈ P be such that M ≡ ctx N . We want to show that M ≡ N . The testing characterization of simulation tells us that it is sufficient to show that, for every test α ∈ T 0 (M cbv Λ ⊕ ), Pr

M cbv Λ ⊕ (M, α) = Pr M cbv Λ ⊕ (N, α)
, which in turn is a consequence of Theorem 5.2.5, since every test α of T 0 (M cbv Λ ⊕ ) can be simulated by a context of CBV Λ ⊕ . Proof. We are able to build a test

The

α = eval • V • eval • ω, eval • ω that distinguished M
β ∈ T 1 (M cbv Λ ⊕ ), that witnesses ¬(M cbv Λ ⊕ N ). We take β = eval • V • (eval • ω ∨ eval • ω)
, and we compute its success probability when executed on M and N as represented in Figure 5.4: we see that that Pr

M cbv Λ ⊕ (β, M ) = 3 4 , while Pr M cbv Λ ⊕ (β, N ) = 1 2 .
Observe that the test β that witnesses

¬(M cbv Λ ⊕ N ) contains a disjunctive construct, hence is not in T 0 (M cbv Λ ⊕ ).
It means that we cannot construct a context emulating it by using Θ P . Actually, there doesn't' exist a context that emulates β, because it does hold that M ≤ ctx N . Since we cannot use soundness of applicative similarity to show it, we need to deal with the universal quantification over all contexts. The proof has been detailed in [START_REF] Crubillé | On probabilistic applicative bisimulation and call-byvalue λ-calculi[END_REF], we recall here only the main steps. Let us first introduce some notation: we call L 0 = λy.Ω, and L 1 = λy.I.

If b = b 1 , . . . , b n ∈ {0, 1} n , then L b denotes the sequence of terms L b 1 • • • L bn . If K is a term, K ⇒ p means
that there is a distribution D such that K ⇒ D and |D| = p (where ⇒ is small-step approximation semantics; see Definition 1.2.4 from Chapter 1). The idea, now, is to prove that in any term K, if we replace an occurrence of M by an occurrence of N , we obtain a term T which converges with probability smaller than the one with which K converges. We first need an auxiliary lemma, which proves a similar result for L 0 and L 1 .

s 1 = λy.(Ω ⊕ I) t 1 = (λy.Ω) ⊕ (λy.I) p 1 (s 2 ) = 3 4 p 1 (t 1 ) = 1 2 p 1 (v) ::= Pr(v, eval • β) s 2 = λy.(Ω ⊕ I) β ::= V • (eval • ω ∨ eval • ω) p 2 (v) ::= Pr(v, β) p 2 (s 2 ) = 3 4 p 2 (t 2 ) = 0 p 2 (t 2 ) = 1 t 2 = λy.Ω t 2 = λy.I s 3 = (Ω ⊕ I) p 3 (v) ::= Pr(v, eval • ω) p 3 (s 3 ) = 1 2 p 3 (t 3 ) = 0 p 3 (t 3 ) = 1 t 3 = Ω t 3 = I u = I Pr(u, ω) = 1 eval eval 1 2 1 2 V V V eval 1 2 eval Figure 5.4: The test β ∈ T 1 (M cbv Λ ⊕ ) witnessing ¬(M cbv Λ ⊕ N )
Lemma 5.2.8 For every term K, if (K{x/L 0 }) ⇒ p, then there is another real number q ≥ p such that (K{x/L 1 }) ⇒ q.

We are now ready to prove the central lemma of this section, which takes a rather complicated form just for the sake of its inductive proof: We may then conclude by using Lemma 5.2.9 in the case where n = 0, that indeed M ≤ ctx N . As a consequence, cbv Λ ⊕ is not complete with respect to the context preorder, since there are programs connected by ≤ ctx but not by cbv Λ ⊕ .

Proposition 5.2.10 cbv Λ ⊕ is not fully abstract with respect to the contextual preorder.

Adding Parallel Convergence Testing to Λ ⊕

The incompleteness result for the preorder cbv Λ ⊕ may be seen as a consequence of the impossibility to write Λ ⊕ contexts that emulate disjunctive tests: the crucial point here is that failure for tests means non-termination for the corresponding contexts. For this reason, a context is not actually able to emulate the independent execution of two tests, since once a program in Λ ⊕ begin to evaluates a sub-term, it may only stop when the evaluation of this sub-term stops. However, when we consider a conjunctive test α, β , we are able to sequentialise the experiment: we can decide that the experimenter first executes the test α, and then if α succeeds he executes the test β. But it is no possible to sequentialise the disjunctive test α ∨ β, since the experiment should succeed as soon as one of the two tests succeed: it is not possible for the experimenter to decide to begin by executing α or β. To sum up, non-completeness of the similarity cbv Λ ⊕ comes from the fact that the Λ ⊕ contexts may only emulates sequential tests.

A way to address this issue is to add parallelism to the language Λ ⊕ , by enriching it with a parallel convergence testing operator, similar to the one introduced by Abramsky and Ong in [START_REF] Abramsky | Full abstraction in the lazy lambda calculus[END_REF] for lazy Λ-calculus. The addition to a higher-order language of some kind of parallel operator has been used before to close the gap between soundness of a denotational semantics and its full abstraction, for instance in [START_REF] Abramsky | Full abstraction in the lazy lambda calculus[END_REF] for CBN Λ, or by Plotkin in [START_REF] Plotkin | LCF considered as a programming language[END_REF], where he adds a parallel or operator to PCF 5 . In a joint work with Dal Lago, Vignudelli and Sangiorgi [START_REF] Crubillé | On applicative similarity, sequentiality, and full abstraction[END_REF], we looked at applicative similarity for the higher-order language Λ ⊕ , which is Λ ⊕ extended with a parallel convergence testing operator. We sum up briefly the results presented there.

The syntax of Λ ⊕ is generated formally as follows:

M, N, L . . . ∈ Λ ⊕ ::= x | λx.M | M N | M ⊕ N | [M N ] .

The behavior of the parallel convergence testing construct ( [• •]

) is meant to be as specified in [START_REF] Abramsky | Full abstraction in the lazy lambda calculus[END_REF]: the program [M N ] returns I if at least one of the two programs M or N terminates, and otherwise does not terminate. We need to extend the operational semantics to implement this behavior; we define the operational semantics of Λ ⊕ , by adding the two following redex-rules to the Λ ⊕ reduction relation presented in Chapter 1:

[V N ] → R I and [M V ] → R I,
We define now the evaluation contexts of Λ ⊕ as follows:

E ::= [•] | EM | V E | [E M ] | [M E] .
Observe that the reduction may now happens arbitrarily in the two branches of [M N ] : it means that the one-step semantics becomes non-deterministic. However it is still true that {D | M ⇒ D} is a directed set, which allows to extend the operational semantics • to Λ ⊕ , by taking M = sup{D | M ⇒ D}. Equivalently, we can also define a big-step approximations operational semantics:

M ⇓ D N ⇓ E b or [M N ] ⇓ (|D| + |E | -(|D| • |E |)) • {I 1 }
, and we can still show that M = sup{D | M ⇓ D}.

We may easily define a LMC M cbv Λ ⊕ that is the counterpart of the LMC M cbv Λ ⊕ for CBV Λ ⊕ , that allows us to define probabilistic applicative similarity and bisimilarity for CBV Λ ⊕ . Soundness of probabilistic applicative similarity and bisimilarity for CBV Λ ⊕ is shown in [START_REF] Crubillé | On applicative similarity, sequentiality, and full abstraction[END_REF], using Howe's method-the proof is an immediate extension of the one for CBV Λ ⊕ . We look now at the full abstraction problem for cbv Λ ⊕ with respect to the context preorder. Recall that in the completeness proof for bisimilarity for CBV Λ ⊕ , we build contexts designed to emulate all tests in T 0 . By adding the parallel convergence tester we gain the ability to emulate also the disjunctive test, hence the whole testing language T 1 . We illustrate this by showing that we can write a context that emulates the test

β = V • (eval • ω ∨ eval • ω).
Recall that it is the precise test we have used in Section 5.2.4 when showing that it was not the case that λy.(Ω ⊕ I) cbv Λ ⊕ (λy.Ω) ⊕ (λy.I).

Example 5.2.3 We consider

β = eval•V •(eval • ω ∨eval • ω). We consider the Λ ⊕ context C = (λx. [xV xV ] )[•]. Observe that for every program M : C[M ] = (| M V | -| M V |)• {I 1 }.
As we outlined in [START_REF] Crubillé | On applicative similarity, sequentiality, and full abstraction[END_REF] we are able to systematize the construction we have done in Example 5.2.3, i.e. to extend the encodings Θ V , Θ P :

T 0 (M cbv Λ ⊕ ) → C Λ ⊕ into Θ V , Θ P : T 1 (M cbv Λ ⊕ ) → C Λ ⊕ ,
in such a way that the context Θ P (α) indeed emulates the test α when applied on states of the LMC that are programs. It means that all tests in T 1 can be emulated by contexts of Λ ⊕ , and consequently we have the following full-abstraction theorem for CBV Λ ⊕ :

On Trace Equivalence For CBV Λ ⊕ .

Recall that for CBN Λ ⊕ , Dal Lago, Sangiorgi and Alberti studied two behavioral equivalences: probabilistic applicative bisimilarity and trace equivalence, that was fully abstract in this setting. We look here briefly to trace equivalence for CBV Λ ⊕ . We can actually follow two distinct approach when generalizing trace equivalence to CBV Λ ⊕ , depending how we interpret CBN trace equivalence. The first possibility consists in considering that trace equivalence is the behavioral equivalence witnessed by traces, i.e. linear tests, while the second one consists in considering that it is the behavioral equivalence corresponding to evaluation contexts. Recall that in CBN, these two notions coincide, because evaluation contexts are exactly applicative contexts, i.e. those contexts that emulate linear tests.

Applicative Contexts Equivalence for CBV

We first define the CBV counterpart of CBN applicative contexts that were defined in Section 4.2.1 of Chapter 4: CBV applicative contexts are those contexts of shape [•]V 1 . . . V n , where V 1 , . . . , V n are values. Similarly to what was done for CBN, we say that two programs M , N are trace equivalent, if for every CBV applicative context C, it holds that Obs(C[M ]) = Obs(C[N ]). However, the induced equivalence relation is unsound. Indeed, let us consider again the terms: M = λx.(I ⊕Ω) and N = (λx.I)⊕(λx.Ω). We have shown in example 4.2.1 that M and N were trace equivalent in CBN, and we can see similarly that they are also trace equivalent in CBV. However, they are not context equivalent in CBV, as we have shown in Example 2.3.1 of Chapter 2: it is because in CBV, we can write contexts that evaluate their argument before copying and using it, which is never done by an applicative context.

It means that trace equivalence is not really relevant when we consider Λ ⊕ endowed with a CBV evaluation strategy.

On CBV CIU-Equivalence

We look now at what happens if we consider the equivalence notion induced by CBV evaluations contexts. By contrast with the CBN case, evaluations contexts in CBV are more expressive as linear tests. Indeed, recall from Chapter 1 that CBV evaluations contexts are generated by the grammar below:

E ::= [•] | EM | V E
We denote ≡ CIU the equivalence relation based on evaluation contexts. Observe that it is immediate that ≡ ctx ⊆≡ CIU .

We show now that the reverse inclusion also holds. First, observe that it is equivalent to show ≡ CIU ⊆≡ cbv Λ ⊕ . Suppose that M, N are two programs that verify ¬(M ≡ cbv Λ ⊕ N ); we want to show that ¬(M ≡ CIU N ). We are again going to use the testing characterization. Observe that whenever a test α is of the shape eval • α, Θ P (α) is an evaluation context. Moreover, we can see that whenever two terms can be distinguished by some test in T 0 , the they may also be distinguished by a test of the shape eval • α. As a consequence, M and N may also be separated by an evaluation context, and so we obtain the result. Proposition 5.3.1 ≡ CIU is fully abstract with respect to context equivalence for CBV Λ ⊕ .

Chapter 6

The Trivialization Problem for Observational Distance: A Case Study.

We argued in Chapter 3 that for the purpose of comparing probabilistic programs, observational distance is often a more adapted notion than the 2-valued observational equivalence, because it allows us to talk about programs which behave very similarly, although not being equivalent. This chapter and the next one are devoted to a more in-depth look at the structure of observational distance, when considering higher-order languages with discrete probabilistic primitives. In the present chapter, we focus on the trivialization problem, which we have informally described before in Section 3.2: more precisely, we identify two distinct cases where we can build enough amplification contexts-see the considerations on trivialization in Section 3.2-to enable trivialization of the observational distance: in the former all programs terminate with probability 1, while in the latter the expressive power of contexts is enhanced with parallel or. We develop these two cases on concrete languages: for the first one, we consider T ⊕ the probabilistic extension of Gödel's system T-introduced by Breuvart, Dal Lago and Herrou [START_REF] Breuvart | On higher-order probabilistic subrecursion[END_REF]-that we presented in Section 1.3.2 of Chapter 1. For the second one, we will consider the language Λ ⊕ -i.e. the variant of Λ ⊕ enriched with parallel convergence testing that we have presented in Section 5.2.5 of Chapter 5.

The work we present here was published jointly with Ugo Dal Lago [START_REF] Crubillé | Metric reasoning about λ-terms: The affine case[END_REF].

On Amplification Contexts

As we have illustrated in Example 3.2.1 of Chapter 3, there can well be classes of terms such that the observational distance collapses to observational equivalence, due to the copying capabilities of the underlying language. The trivialization problem can in fact be seen as a question about the expressive power of contexts: given two duplicable terms, how much can any context amplify the observable differences between their behaviors? More precisely, we would like to identify trivializing fragments of Λ !, ⊕ , that is to say fragments such that for any pair of duplicable terms, their context distance (with respect to the fragment) is either 0 or 1.

Our approach is as follows: as soon as two programs M , N are not observationally equivalent, there exists at least one context C that separates them. Our idea is to take this context as a starting point, and to see if it is then possible to amplify the difference induced by C, by building another context D with

|Obs(D[C[M ]]) -Obs(D[C[N ]])| > |Obs(C[M ]) -Obs(C[N ])|.
The context D that we are going to build for this purpose actually interacts with its argument only by copying it, and then evaluating all the copies: essentially, Obs(D[L]) depends only of the termination probability of L-it is because D is designed just to amplify existing differences in the observables.

We want to present this approach in the setting of a generic probabilistic programming language, no matter typed or untyped: this way, we will be able to apply it to both T ⊕ -probabilistic variant of Gödel's system T-and Λ ⊕ . We use here the formalism for a generic observable programming language that we have introduced in Chapter 2-in Definition 2.3.1 for an untyped language, and in Definition 2.3.2 for a typed language. In order to talk about amplification contexts in this setting, we first need to enforce that contexts can be composed. Definition 6.1.1 (Compositionality for Contexts) Let L ⊕ be an observable programming language. We say that the compositionality requirement for contexts holds when:

• if L ⊕ is an untyped language, we ask that for every

C, D ∈ C ∅ , C[D] is also in C ∅ ;
• if L ⊕ is a typed language, we ask that for every type σ, ι, for every observable type

τ ∈ A obs , if C ∈ C (∅,σ)→τ , and D ∈ C (∅,ι)→σ , it holds that C[D] ∈ C (∅,ι)→τ .
In the following, the compositionality requirement for contexts will hold for all the probabilistic programming languages that we will consider. Looking now at the amplification context we mentioned above, we see that we must require that it accepts all observable programs in argument. We formalize this by asking it to be an universal context, in the sense of the definition below. Definition 6.1.2 (Universal context.) Let L ⊕ be a probabilistic observable programming language. We say a universal observable context is:

• any context C ∈ C ∅ , if L ⊕ is an untyped language; • if L ⊕ is a typed language, a context C such that: ∀σ ∈ A obs , ∃τ ∈ A obs with C ∈ C (∅,σ)→τ .
Ideally, we would like to be able to build for every α an universal amplification contexts D α that simulate the threshold functions T α , that we define in Definition 6.1.4. We first precise in Definition 6. • T 0 (0) = 0, and T 0 (x) = 1 for x > 1.

• if α > 0: T α (x) = 0 if x < α, 1 otherwise.
The threshold functions are represented in Figure 6.1. However, requiring the existence of a context D that simulate T α for every α ∈ [0, 1] is too strong: we are now going to progressively weaken this condition. First, we observe considering every α

∈ [0, 1] is not necessary: since the set Q is dense in R, it is sufficient to look at the T α for α ∈ Q ∩ [0, 1].
We then see that we don't really have to find a context that exactly simulates T α , but that it is enough to find a family of contexts that approximates this function, in the sense of Definition 6.1.5 below. We illustrate now the notion of approximation by contexts. Recall the Λ ⊕ -contexts C n considered in Example 3.2.1 in Chapter 3, that we used to show that δ ctx Λ ⊕ (I, I ⊕ Ω) = 1. In Example 6.1.1 below, we reformulate them as a family of approximations for

T 1 . Example 6.1.1 We first build in Λ ⊕ a n-ary conjunction operator n ([•] 1 , . . . , [•] n ) such that if M 1 , . . . , M n are programs, n (M 1 , . . . , M n ) terminates if
and only if all the M i terminate. Indeed, for every n ∈ N, and n terms M 1 , . . . , M n , we take:

n (M 1 . . . M n ) = (λz 1 .λz 2 . . . . λy.(yz 1 . . . z n ))M 1 . . . M n .
Using this conjunction operator, we can now use the copying ability of Λ ⊕ to build for every n ∈ N, a Λ ⊕ -context C n as follows:

C n = (λx. n (xI, . . . , xI))(λx.[•]).
The behavior of this context on a program M is as follows: first it produces n copies of M , then it evaluates successively all those copies of M , and stops only if all of them terminate. As a consequence:

∀ program M, Obs(C n [M ]) = Obs(M ) n → n→∞ T 1 (Obs(M )).
It means that (C n ) n∈N is an approximation family for the threshold test T 1 on the whole interval [0, 1]. As a consequence, for every program M, N , with Obs

(M ) = 1, Obs(N ) < 1, it holds that δ ctx Λ ⊕ (M, N ) = 1. 0 0.2 0.4 0.6 0.8 1 0 0.2 0.4 0.6 0.8 1 Obs(M ) Obs(C[M ]) C 5 C 10 C 20 C 50 Figure 6.2: Approximation Contexts (C n ) n∈N in Λ ⊕ for T 1 .
As soon as we are able to approximate this way every threshold function by a family of contexts, we can show that the observational distance trivializes. We state this formally in the following lemma. Lemma 6.1.1 Let L ⊕ be any probabilistic observable programming language. If for every α ∈ (0, 1) there exists an approximation of T α by universal L ⊕ -contexts on [0, 1] \ {α}, then the observational distance on L ⊕ trivializes, i.e.:

∀M, N comparable programs ∈ L ⊕ , δ ctx L ⊕ (M, N ) ∈ {0, 1}.
Proof. We give the proof for the untyped case, but the proof when L ⊕ is a typed probabilistic language is similar. Let M, N be two programs in L ⊕ . If M and N are observationally equivalent in L ⊕ , then δ ctx L ⊕ (M, N ) = 0, and so the result holds. We suppose now that M and N are not observationally equivalent: it means that there exists a

L ⊕ context C such that Obs(C[M ]) = Obs(C[N ]
). We now fix > 0, and show that 1 -δ ctx L ⊕ (M, N ) ≤ . We denote t 0 := Obs(C[M ]), and t 1 := Obs(C[N ]). Suppose for instance that t 0 < t 1 . Then we take α ∈ (t 0 , t 1 ). By hypothesis, there exists a sequence of universal L ⊕ contexts (D n ) n∈N that approximates T α . Looking at Definition 6.1.5, we see that it implies:

lim n→∞ Obs(D n [C[M ]]) = 0 and lim n→∞ Obs(D n [C[N ]]) = 1
As a consequence, there exists n ∈ N such that both:

Obs(D n [C[M ]]) ≤ 2 and Obs(D n [C[N ]]) ≥ 1 - 2 ,
and from there we deduce that indeed 1 -

δ ctx L ⊕ (M, N ) ≤ .
We now add a supplementary layer to the condition given in Lemma 6.1.1 that guarantees trivialization. Indeed, in some cases it is too complicated to explicitly write the family of contexts approximating the threshold function itself, but we are able to write a sequence of functions that tends towards it, and such that every function in it sequence can be approximated by contexts. We precise this idea in Lemma 6.1.2 below.

Lemma 6.1.2 Let L ⊕ be a probabilistic observable programming language. If for every α ∈ (0, 1) there exists a sequence of real function f n : [0, 1] → [0, 1] such that:

• for every t ∈ [0, 1] \ {α}, lim n→∞ f n (t) = T α (t);
• and for every n ∈ N, there exists a family (C n m ) m∈N of universal contexts that approximates f n on [0, 1], then the observational distance on L ⊕ trivializes.

In the case where the language considered is Λ ⊕ -with the CBN or the CBV operational semantics-it is not possible to approximate all the T α by Λ ⊕ contexts: indeed the observational distance on Λ ⊕ doesn't trivialize since for instance δ ctx Λ ⊕ (Ω, (I ⊕ Ω)) = 1 2 -the formal proof can be done using the coinductive tools we will develop in Chapter 8. It also means that there is no possible ways to approximate T 0 in Λ ⊕ . We are now going to explore two paths that lead to trivialization: in the first one, we enhances the expressive power of contexts by adding a parallel convergence tester operator, while the second consists in enforcing termination for all programs. We will illustrate these two approaches respectively on the languages T ⊕ and Λ ⊕ , by showing that in these two cases, we are able to approximate the threshold functions, and that consequently the observational distance trivializes.

Trivialization in Λ ⊕

We work here with the language Λ ⊕ , which is strictly more expressive that Λ ⊕ , since it has a parallel convergence tester operator: [M N ] returns I if at least one of the two programs M and N terminates, and doesn't terminate otherwise. Recall that we have introduced and studied the language Λ ⊕ in Section 5.2.5 of Chapter 5. To be consistent with our development there, we keep the same CBV operational semantics-but our trivialization result would also hold for a CBN strategy. Our goal here is to show that all threshold functions T α can be approximated by Λ ⊕ contexts, which will then allow us to obtain trivialization of the observational distance on Λ ⊕ by using Lemma 6.1.1.

Recall from Example 6.1.1 that we can approximate T 1 in Λ ⊕ ; we can see that the same reasoning still holds in Λ ⊕ . In contrast, we are not able to approximate T 0 in Λ ⊕ . Here, we first illustrate how the presence of the parallel convergence tester enhances the discriminating power of contexts by highlighting that T 0 can be approximated by a family of Λ ⊕ contexts. Example 6.2.1 In the same way as we defined n-ary conjunction operator in Example 6.1.1, we now define a n-ary disjunction operator in Λ ⊕ .

n (M 1 , . . . M n ) = [M 1 [M 2 . . .] ] ;
The term n (M 1 , . . . , M n ) behaves as a n-ary disjunction: if M 1 , . . . , M n are programs, it terminates if at least one of the M i terminates. We now build the family of Λ ⊕ universal contexts designed to approximate the threshold function T 0 . For every n ∈ N, we build C n as:

C n = (λx. Our goal now is to show the existence, for every α ∈ (0, 1), of an approximation by contexts of T α on [0, 1] \ {α}. From there, we will be able to apply Lemma 6.1.1, and thus to show that δ ctx Λ ⊕ trivializes. To this purpose, we are going to mix the conjunction and the disjunction operators-defined respectively in Example 6.1.1 and 6.2.1-in order to obtain a new kind of contexts that we will use later to build threshold approximations. Definition 6.2.1 We call mixed amplification context of conjunction order n and disjunction order m, the universal context (♦ m n ) n,m∈N defined as follows: Observe that the contexts ♦ m n compute m-ary conjunctions of n-ary disjunctions. If we look at the termination probability, we see that:

♦ m n = λy.
Obs(♦ m n [M ]) = (1 -Obs(M ) m ) n .
Using these mixed amplifications contexts, we are now able to approximate threshold tests. More precisely, for every α ∈ (0, 1), we need to associate to every index n ∈ N a mixed amplification context of the form ♦ r(n,α) n . We do this construction in Definition 6.2.2 below, and we will then show that the family of contexts (C α n ) n∈N obtained this way is indeed an approximation by contexts of T α on [0, 1] \ {α}. Definition 6.2.2 Let α ∈ (0, 1), and n ∈ N. We build the n-th context approximation of

T α as the Λ ⊕ context C α n := ♦ r(n,α) n
, where we take: We illustrate in Figure 6.4 the action of C α n : we can see on an example that indeed the greater the value of n is, the closer the n-th approximation function is to T α . We need now to prove that this is always the case, i.e. that the C α n are an approximation by contexts of the threshold tests. To keep the notations readable, we introduce functions

r(n, α) = 1 1 -α n . 0 0.2 α 0.4 0.6 0.8 1 0 0.2 0.4 0.6 0.8 1 Obs(M ) Obs(C α n [M ]) C 0.3 3 C 0.
f n,α : [0, 1] → [0, 1] defined by f n,α (x) = (1 -(1 -x) n ) r(n,ι) , i.e. such that: ∀M, Obs(C α n [M ]) = f n,α (Obs(M )).
Accordingly, we can reformulate our goal as follows: we want to show that for every α ∈ (0, 1), and t ∈ [0, 1] \ {α}, lim n→∞ f n,α (t) = T α (t). The proof will use tools from real analysis, essentially the Bounded Convergence Theorem, that we recall below. The statement and the proof can for instance be found in [START_REF] Royden | Real analysis[END_REF]. It is a particular instance of a number of theorems in classical analysis, that give conditions to permute limit and integration. Theorem 6.2.1 (Bounded Convergence Theorem) If k n is a sequence of uniformly bounded real-valued measurable functions which converges pointwise on a bounded measure space (S, Σ, µ) to a function k, then the limit k is an integrable function and:

S lim n→∞ k n = lim n→∞ S k n .
The bounded convergence theorem is relevant here, because we can express the approximations functions f n,α using an integral. In order to simplify the proof, we will work with the reverse approximation functions g n,α : R → R defined as g n,α (x) := f n,1-α (1-x). We can express the g n,α as an integral: indeed, the function g is derivable, and as a consequence, for every x ∈ (0, 1):

g n,α (x) = x 0 g n,α (t)dt + 1 if x < α - 1 x g n,α (t)dt if x > α (6.1)
We are now going to fix α, and use the Bounded Convergence Theorem by taking the k n as g n,α .

Lemma 6.2.2 For every α ∈ (0, 1), it holds that:

lim n→∞ x 0 g n,α (t)dt = 0 when x < α lim n→∞ 1 x g n,α (t)dt = 0 when x > α.
Proof. We first fix an α

∈ [0, 1], x -∈ [0, α[, x + ∈]α, 1]
. Our goal now is to show that both (g n,α : [0, x -] → R) n∈N and (g n,α : [x + , 1] → R) n∈N are indeed two sequences of uniformly-i.e. by a constant that does not depend from n-bounded real-valued measurable functions which converge pointwise. Observe first that the measurability assumption obviously holds-we endow as usual both [0, x -] and [x + , 1] with the Lebesgue measure-since the g n,α are continuous functions. Let us now look for uniform bounds. First, we can give a closed form for the function g n,α : indeed it holds that for every t ∈ [0, 1]:

g n,α (t) = -r(n, 1 -α) • n • (1 -t n ) r(n,1-α)-1 • t n-1
Recall that r(n, 1 -α) = ( 1 α ) n , and that moreover 0 < α < 1. As a consequence, there exists N , such that ∀n ≥ N , r(n,

1 -α) ≤ 1 α n + 1 ≤ 1 α n+1
. From there-and since 0 ≤ (1 -t n ) ≤ 1-we can deduce the following bound on the absolute value of the g n,α :

∀t ∈ [0, 1], |g n,α (t)| ≤ 1 α 2 • t α n-1 • n • (1 -t n ) ( 1 α ) n -1 (6.2)
From there, we consider separately the domains S 1 = [0, x -] and S 2 = [x + , 1].

• We first consider the sequence g n,α : S 1 → R. From (6.2), we see that for every

t ∈ S 1 , | g n,α (t) |≤ K • n • t α n-1
, where K is a constant. We need now to use the following well-know result of asymptotic hierarchy.

lim n→∞ n m • e -n•b = 0 for every m ∈ N, b > 0. (6.3)
Observe that (6.3) can also be retrieved by seeing that lim y→∞ (ln(y) -α • y) = -∞ for every α > 0. We can now use (6.3) to see that g n,α : S 1 → R converge pointwise to the 0-function. We're now going to show that this sequence of functions admits a uniform bound.

| g n,α (t) | ≤ K • n • x - α n-1 since t ≤ x -. ≤ K • sup n∈N (n • x - α n-1
) < ∞ since (6.3) and x -< α

Thus we have shown that the sequence g α,n : S 1 → R is a sequence of uniformly bounded real-valued measurable functions that converges pointwise toward the 0 function. Consequently, we can apply the Bounded Convergence Theorem, and we obtain that lim n→∞ x - 0 g n,α (t)dt = 0.

• We now consider the sequence of functions g n,α : S 2 → R. We start from (6.2), and we use the fact that since t ∈ [0, 1], ln(1 -t n ) ≤ -t n . We moreover assume that we take n ≥ N 0 , where N 0 is the first natural number with ( 1 α ) n -1-it eventually holds, since 0 < α < 1. We obtain that for every t ∈ S 2 :

|g n,α (t)| ≤ 1 α 2 • t α n-1 • n • e (( 1 α ) n -1)•(-t n ) (6.4) ≤ 1 α 2 • t α n-1 • n • e -( t α ) n • e t n ≤ 1 α 2 • 1 α n-1 • n • e -( x + α ) • e (6.5)
It is another classical result from the asymptotic hierarchy-that can be retrieved from 6.3-that for every a, b > 1, it holds that:

lim m→∞ a m • m • exp(-b m ) = 0.
From this equation, we can deduce that:

lim n→∞ 1 α 2 • 1 α n-1 • n • e -( x + α ) n • e = 0 (6.6)
Now, please observe that combining (6.5) and (6.6) gives us both the pointwise limit and the uniform bound (since g n,α (t) is bounded by a sequence that doesn't depends on t, and has a finite limit when n goes towards infinity). So we can apply the bounded convergence theorem, and we obtain that lim n→∞ 1

x + g n,α (t)dt = 0, and this concludes the proof of Lemma 6.2.2. Lemma 6.2.3 Let n ∈ N, and α ∈ (0, 1). Then for every x ∈ (0, 1) \ {α} it holds that lim n→∞ f n,α (x) = T α (x).

Proof. By combining Equation (6.1) and Lemma 6.2.2, we obtain that:

lim n→+∞ g n,α (x) = 1 if x < α 0 if x > α (6.7) Since g n,α (x) = f n,1-α (1 -x), it concludes the proof.
Lemma 6.2.3 means that for every α ∈ (0, 1), the family of Λ ⊕ contexts (C α n ) n∈N is indeed an approximation by contexts of T α on [0, 1] \ {α}-in the sense formally stated in Definition 6.1.5. As a consequence, we can now apply Lemma 6.1.1, and we obtain trivialization of the observational distance on Λ ⊕ , as stated below. Theorem 6.2.4 δ ctx Λ ⊕ trivializes.

Trivialization in T ⊕ .

We now consider the language T ⊕ , introduced by Breuvart, Dal Lago and Herrou [START_REF] Breuvart | On higher-order probabilistic subrecursion[END_REF], and that we have presented in Section 1.3.2 of Chapter 1. Recall that this language is AST, i.e. that for every term M , | M | = 1.

Since T ⊕ is a typed language, the relevant notion of observational distance is the one we gave in Definition 3.1.4 from Chapter 3 for typed observable programming languages. Recall that, following our formalism for a generic typed observable language, we need to fix a set of observable types: we choose the natural number type N, and if M is a program of type N, we take Obs(M ) = M ( 0 ), i.e. the probability that the outcome of the execution of M will be 0. Observe that since this language is AST, we are forced to take a non termination-based notion of observation.

(δ ctx T ⊕ ) σ (M, N ) = sup C s.t. [•]:σ C:N | C[M ] ( 0 ) -C[N ] ( 0 )|
In the following, our goal is to show trivialization of context distance on T ⊕ , as defined above. To do so, we will use Lemma 6.1.2 based on a double-layered approximation of the threshold tests T α : the first step consists in building for every α ∈ (0, 1) a sequence of real functions that converge pointwise to T α , while in the second step we need to exhibit an approximation by contexts for each of those functions. Our approach to the second step is based on Bernstein's constructive proof [START_REF] Bernstein | Constructive proof of weierstrass approximation theorem[END_REF] of the Stone-Weierstrass theorem which states that every continuous function [0, 1] → R can be uniformly approximated by polynomials. Bernstein's proof consists in building, for any fixed continuous function f : [0, 1] → R, a concrete sequence of polynomials that indeed uniformly converges towards f . More precisely, our overall approach is as follows: we first construct contexts that are able to simulate Bernstein's polynomials for some class of functions f , and then we exhibit in this class of functions a particular sequence f α n that approximates the Threshold test T α .

Simulating Bernstein's Polynomials.

Bernstein's construction is as follows: the n-th Bernstein's polynomial with respect to f is defined as:

P f n (x) = 0≤k≤n f k n • B n k (x), where B n k (x) = n k • x k • (1 -x) n-k . (6.8)
We illustrate on Figure 6.5 how Bernstein's polynomials approximate a particular continuous function f built as follows: it is zero before some real number α, 1 after some real number β > α, and an affine function between α and β. Our goal is to show that the contexts in T ⊕ are able to simulate the Bernstein's Polynomials for some continuous functions that globally looks like the f of Figure 6.5, i.e. that verifies the following specification: it must be a partial test separating α and β, i.e. that returns 0 if x ≤ α, and 1 if x ≥ β.

Observe that this test is partial, in the sense where we do not specify what happens when x ∈ (α, β).

In the following, even if our base data are natural numbers, we will consider them as booleans, where 0 is the encoding of true, and any other n the encoding of false.

We are going to build now step by step the contexts that we will use to simulate Bernstein's polynomials. The first step consists in a context C such that for any program M 1 , . . . , M n , C[M 1 , . . . , M n ] has the following behavior: it counts the number of its arguments that are equal to true, and then executes the corresponding M i . with n + 1 holes, as follows:

C[[•] 0 , . . . , [•] n ] = λx 1 .λx 2 . . . . λx n . let i = & 0≤i≤n x i in if (i == 0) then [•] 0 if (i == 1) then [•] 1 . . . if (i == n) then [•] n .
Remark that local variables definitions are not a primitive of T ⊕ . However, we used them in Definition 6.3.1 as a notation for nested if-then-else procedure, to keep the definition above readable. For instance, when n = 1, the real context C is as follows:

C[[•] 0 , [•] 1 ] = λx 1 .λx 2 . if x 0 then ( if x 1 then [•] 2 else [•] 1 ) else ( if x 1 then [•] 1 else [•] 0 ).
An important point guaranteed in the unfolded context is that during an execution each variable x i is evaluated exactly once.

Observe that for every type σ, it holds that

[•] 1 : σ, . . . , [•] n : σ C[[•] 0 , . . . , [•] n ] : N → . . . → N → σ.
We formalize now the operational semantics of C. Lemma 6.3.1 We fix σ a type in T ⊕ . Then for every n-uple M 1 , . . . , M n of programs of type N, and every (n + 1)-uple (N 0 , . . . , N n ) of programs of type σ, it holds that:

C[M 1 , . . . , M n ]N 0 , . . . , N n = 0≤j≤n p j • N j ,
where for every j, the coefficient p j ∈ [0, 1] is as follows:

p j = {k 1 ,...,k i }⊆{1,...,n} j∈{k 1 ,...,kn}
Obs(M j ) j∈{1,...,n}\{k 1 ,...,kn}

(1 -Obs(M j )).

Proof. Intuitively-and looking at C as given in the Definition 6.3.1-it is because the probability that the local variable i is equal to j is exactly p j : indeed, it is the probability that exactly j among the programs M j are true, and that the remaining n -j are false. Formally, we have to show the result by unfolding the if-then-else procedure, and then doing the proof by induction on n.

Actually, for our purpose, we will only ever fills the counting context C with n identical copies of some program M . In this setting, we can give a more compact formulation of Lemma 6.3.1, that highlight the link with Bernstein's polynomials.

Lemma 6.3.2 For every M program of type N, and every (n + 1)-uple (N 0 , . . . , N n ) of programs of same type σ, it holds that:

C[M, . . . , M ]N 0 , . . . , N n = 0≤j≤n B n j (Obs(M )) • N j ,
where B n j are the polynomials defined in (6.8)-as a building block for Bernstein's polynomials.

The next step is to look at the N j programs. First, since we want the program C[M, . . . , M ][N 0 , . . . , N n ] to be observable, it needs to be of N type, which means that the N j themselves must be all natural numbers. We now use Lemma 6.

Obs(C[M, . . . , M ]N 0 , . . . , N n ) = 0≤j≤n B n j (Obs(M )) • Obs(N j ),
Proof. It is a direct consequence of Lemma 6.3.2, and from the definition of observable for T ⊕ .

Looking now at Lemma 6.3.3 and at the shape of Bernstein's polynomials in (6.8), we see that the last step before being able to simulates -in the sense of Definition 6.1.3-Bernstein's polynomials P f n , is to exhibit T ⊕ programs N j such that Obs(N j ) = f ( j n ). A natural candidate is given by N j = false ⊕ f ( j n ) true. However, recall that this term is only defined when f ( j n ) is a dyadic number-since the construction in Λ ⊕ of a p-biased probabilistic choice in Example 7.4.1 of Chapter 7 is valid only when p ∈ D. Observe that it is not guaranteed for instance for the function f represented in Figure 6.5.

Proposition 6.3.4 Let f : [0, 1] → [0, 1] be a continuous function, such that f (Q) ⊆ D.
Then there exists a T ⊕ context that simulates P f n . We call reachable functions, and we denote by R the class of such continuous functions

[0, 1] → [0, 1] such that f (Q) ⊆ D.

Approximating T α with reachable functions

We can first remark that the existence of one function in this class can be established by looking at Minkowski's question mark function ?, which is a continuous function [0, 1] → [0, 1] that sends Q into D. We don't recall here the concrete definition of the questionmark function, but the interested reader can find a detailed description of its definition and properties for instance in [START_REF] Vepstas | The minkowski question mark, psl (2, z) and the modular group[END_REF].

Using this question mark function, we now define a sequence of reachable functions that converge pointwise towards T α on [0, 1] \ {α}. Definition 6.3.2 Let α ∈ (0, 1). Since Q is dense in R, there exists two sequences (a n ) n∈N and (b n ) n∈N of elements in Q such that for every n ∈ N, a n < α < b n , and moreover lim n→∞ a n = lim n→∞ b n = α. We define the function r α n : [0, 1] → [0, 1] as:

r α n (x) =      0 if x ≤ a n 1 if x ≥ b n ?( x-an bn-an ) otherwise.
Observe that for every n ∈ N, the function r α n is a reachable function, and moreover that the sequence r α n converges pointwise towards T α . Using this result, and Proposition 6.3.4-which says that the Bernstein's polynomials of any reachable functions can be simulated by T ⊕ contexts-we see that the requirements of Lemma 6.1.2 are met, and so the observational distance trivializes on T ⊕ . Theorem 6.3.5 The context distance δ ctx T ⊕ trivializes.

Proof. We see that the requirements of Lemma 6.1.2 hold:

• for every t ∈ [0, 1] \ {α}, lim n→∞ r α n (t) = T α (t);

• for every n ∈ N, there exists-by Proposition 6.3.4 a family of contexts C m n that simulates the Bernstein's polynomials of r n . From there, Bernstein's theorem tells us that the Bernstein's polynomials of r n converge towards r n , and consequently that the C m n are a family of approximations for r n .

As a consequence, Lemma 6.1.2 tells us that the observational distance trivializes.

Chapter 7

Λ ! ⊕ : A λ-calculus with Explicit Copying

As we have seen in Chapter 6, the behaviour of the context distance depends strongly on the copying abilities of the language. For this reason, we will use in this thesis a variant of probabilistic λ-calculus, that we call Linear Probabilistic λ-Calculus (Λ ! ⊕ ), designed to give us more control on the copying mechanisms: we are able to specify in Λ ! ⊕ which function arguments can be duplicated, and which one cannot. The present chapter is devoted to the presentation of Λ ! ⊕ .

7.1 The Language Λ ! ⊕ .

Simpson Surface Calculus

In [START_REF] Simpson | Reduction in a linear lambda-calculus with applications to operational semantics[END_REF], Simpson introduced a deterministic λ-calculus called Surface Calculus, which we denote Λ ! . We give here a very short overview of this programming language, since we designed Λ ! ⊕ as a probabilistic extension of it. The language is based on a distinction in the syntax between those subterms that can be copied, and those that cannot. To that end, two λ-abstractions coexist in the syntax: a linear one λx.M , where we ask x to be used exactly once in M , and a non-linear (or exponential ) one λ!x.M , where x may appear several times in M . In the syntax, there is also a box operator !: the term !M represents the term M endowed with the ability to be duplicated infinitely often. To an exponential λ-abstraction λ!x.M , we can only pass as argument a box !N . In [START_REF] Simpson | Reduction in a linear lambda-calculus with applications to operational semantics[END_REF], two different ways of enforcing this linear/ non-linear policy are presented: the definition of criterion on variables assuring that terms are well-formed, and a type system with !-types.

To fix ideas, we give here the syntax of Λ ! :

M, N ::= x | M N | λx.M | λ!x.M | !M where x ∈ V.
It is endowed in [START_REF] Simpson | Reduction in a linear lambda-calculus with applications to operational semantics[END_REF] by an operational semantics. Since there are two different λabstractions, there are also two different kinds of β-redexes:

(λx.M )N → β M {N/x} (λ!x.M )!N → β M {N/x}
Observe that, as a consequence, only functions of the form λ!x.N can open a box, and thus destroy it.

Reduction in [START_REF] Simpson | Reduction in a linear lambda-calculus with applications to operational semantics[END_REF] is strong, i.e. it goes under the λ-abstractions, and surface, in the sense where it doesn't go inside a box !M . The idea is that boxes can be copied, but the content of the box cannot be executed until the box is opened. It is shown in [START_REF] Simpson | Reduction in a linear lambda-calculus with applications to operational semantics[END_REF] that this reduction is confluent, hence CBV and CBN evaluation strategies are equivalent.

Surface Calculus is an untyped language, but it is inspired by the explicitely typed language Lily, introduced by Bierman, Pitts and Russo in [START_REF] Bierman | Operational properties of lily, a polymorphic linear lambda calculus with recursion[END_REF]. We will inspire ourselves loosely of Lily type system when we will design a type system for Λ ! ⊕ . The main difference is that, since Lily has also a recursive operator in the syntax, the variant of system F with !-types given as type system for Lily in [START_REF] Bierman | Operational properties of lily, a polymorphic linear lambda calculus with recursion[END_REF] gives an expressive enough calculus, in particular with infinite behaviour. For Λ ! ⊕ , we will need to incorporate also recursive types.

The Language Λ !

⊕ .

While there is no computationnal effects in Surface Calculus, managing copying through boxes interacts well with probabilistic execution, since delaying the opening of the box allows us also to delay the moment when we do the probabilistic choice. Here, we are going to present Λ ! ⊕ as a probabilistic extension of Λ ! .

Syntax of Λ ! ⊕ . The syntax of Λ !
⊕ is an extension of both Λ ⊕ and Surface Calculus. Together with λabstractions, applications and the operator ⊕ for fair probabilistic choice, we take the same operators as in Surface Calculus to manage copying: the operator ! , which is the constructor for boxes, and the exponential λ-abstraction λ!x.•, which is the destructor for boxes-functions of the form λ!x.M accept only boxes as argument, and destroy the box passed to them in the application process. Therefore, as in Surface Calculus, we have two distinct λ-abstractions in the syntax. However, we modify here slightly the meaning of λx.M : we do not want the variable x to appear in M exactly once anymore, but at most once. It means that the resource x in M is now affine instead of being linear. We will enforce this by a type system, that we will present in Section 7.2. Definition 7.1.1 We assume a countable set of variables V. The set of terms of Λ ! ⊕ is defined by the following grammar:

M, N, L . . . ∈ Λ ! ⊕ ::= x | M N | λx.M | λ!x.M | !M | M ⊕ N where x ∈ V.
As in Chapter 1, we call programs those terms in Λ ! ⊕ that are closed, i.e have no free variables.

Operationnal Semantics of Λ ! ⊕ . We define now an operationnal semantics for Λ ! ⊕ programs, following the approach presented in Section 1.2 for Λ ⊕ : we first define the one-step reduction relation between programs and finite sequences of programs modelizing one execution step, then we use it to associate to a program M a family of distribution over programs-the approximation semantics of M -and finally we take the semantics of M as the supremum of its approximation semantics.

As in [START_REF] Simpson | Reduction in a linear lambda-calculus with applications to operational semantics[END_REF], the reduction in Λ ! ⊕ is going to be surface-we do not reduce inside boxes. However it is also going to be weak-we don't reduce under λ-abstractions either, in order to be in line with the presentation of Λ ⊕ in [START_REF] Lago | Probabilistic operational semantics for the lambda calculus[END_REF], as well as with the work on coinductively defined equivalences for Λ ⊕ done in [START_REF] Lago | On coinductive equivalences for higherorder probabilistic functional programs[END_REF]. Unfortunately, this choice of weak reduction stop us to have confluence, therefore we have to choose a non-ambiguous evaluation strategy. We choose the call-by-value paradigm: this semmingly arbitrary choice is justified by the fact that, as we will show later, we can embedd both CBN Λ ⊕ and CBV Λ ⊕ in Λ ! ⊕ endowed with our CBV semantics.

The One-Step Reduction Relation for Λ ! ⊕ . The one-step reduction we take now depends on the evaluation strategy we want: actually, as highlighted in Chapter 1 for a generic probabilistic calculus, the one-step reduction completely determines the language operational semantics. We are going to define it using the reduction semantics approach based on evaluation contexts, that we have presented in Chapter 1 for the probabilistic λ-calculus Λ ⊕ . Since we are in a call-by-value framework, the first step consists of defining the set of values-programs, that we want to be nonreducible under our reduction strategy. Since we want our reduction to be weak and surfaces, they are λ-abstraction, and boxes.

Definition 7.1.2 We define the set V Λ ! ⊕ of Λ !
⊕ values as follows:

V ∈ V Λ ! ⊕ ::= λx.M | λ!x.M | !M.
We need now to define what our redexes are, and to give rules specifying how to reduce them. We have three different kinds of redexes: the β-reduction of linear abstraction, the β-reduction of a !-abstraction and the fair probabilistic choice.

(λx.M )V → R Λ ! ⊕ M {V /x} M ⊕ N → R Λ ! ⊕ M, N (λ!x.M )!N → R Λ ! ⊕ M {N/x}.
Observe that the two first rules are the same as for Λ ⊕ in call-by-value, while the third one is the same as the opening of a box in Surface Calculus. Following the reduction semantics approach, we need now to define the evaluations contexts: it specifies where in a term we are allowed to reduce redexes. As in Λ ⊕ , the execution of a program is done left-first, i.e. a function is evaluated before its argument. Since we are in call-by-value, the argument has to be evaluated too before reducing the redex. We sum up these considerations by giving the following grammar for evaluation contexts:

E, F ::= [•] | EM | V E with M ∈ Λ ! , V ∈ V Λ ! .
Approximate Semantics for Λ ! ⊕ . We then define the approximate operationnal semantics M ⇒ D by applying Definition 1.2.4 of Chapter 1, which has been given for a generic probabilistic language endowed by a reduction semantics. For any program M , it gives us a family of approximation semantics. We would like now be able to say that this family has a supremum. Recall that Lemma 1.2.1 of Chapter 1 tells us that it is the case, provided that the one step reduction relation is unambiguous. Proof. It is enough to see that for every M , there exists at most one E, and R, such that

M = E[R].
As a consequence, we see using Lemma 1.2.1 that sup{D | M ⇒ D} is a directed set. Following Definition 1.2.6, we define for any closed term M :

M = sup{D | M ⇒ D}.
Example 7.1.1 We adapt the non-terminating term given in Example 1.1.1 to our explicit copying setting: we need to replace the λ-abstractions by exponential λ-abstractions, since the variables are used several times. Hence, we define:

Ω = (λ!x.x(!x))(!λ!x.x(!x)).
We look now at the operational semantics of Ω:

Ω → β Ω
As a consequence, we see that the only approximate denotational semantics for Ω is given by the (Empty) rule of Definition 1.2.4: Ω ⇒ ∅: it means that Ω = ∅.

We will see later that Ω can be typed in the type system for Λ ! that we will give in Section 7.2.

Recall that we have also defined a recursion operator Y in Example 1.1.4, which has a shape similar as Ω. We are going to do here the same thing as we have done for Ω: modify it in order to obtain a program in Λ ! respecting our policy on affine/exponential variables.

Example 7.1.2 We are going to present here a variant of Y fixpoint combinator for callby-name Λ, which we adapted to our affine/exponential policy, as well as to our evaluation strategy. We define Y ! the fixpoint combinator in Λ ! ⊕ as:

Y ! = λ!x. ((λ!y.x!(y(!y)))! (λ!y.x!(y(!y)))) .
We are now going to highlight how we can see Y ! as a fixpoint operator. Observe that we have to pass as argument to Y ! a term in a box: it corresponds to the fact that the variable x is used twice. Let be M in Λ ! ⊕ . We define L = (λ!y.M !(y(!y)))! (λ!y.M !(y(!y))) .

Then we can see that Y ! (!M ) → L and moreover when we do one step of execution from L, we obtain the function M applied to L: indeed it holds that L → M !L.

7.2 Type System for Λ ! ⊕ .

As explained before, when we write a program of the form λx.M , the variable x is meant to be affine i.e. it has to be used at most once in M . However, we are able to write terms in Λ ! ⊕ that do not respect this rule. To leave such terms out, we introduce now a type system to enforce our affine/exponential policy on variables. Besides, this type system will also allow us to avoid deadlocks, i.e. terms that are not values, but are not reductible by the reduction • → • either: for instance terms as (λ!x.x)λx.x, where the left-hand side wait for a term in a box, but is given a λ-abstraction.

Observe that we do not want our type system to be too restrictive: we want to enforce our policies on the use of resources and the absence of deadlocks, but we also want to be still able to encode Λ ⊕ . To do that, we use first-order recursive types.To sum up, our approach consists in combining in our type system tools to manage resources (using affine and exponentials variables, as well as a ! operator on types to denote the ability to be copied infinitely often), and tools to increase expressiveness (recursive types), thus enabling us to encode Λ ⊕ . We first give a presentation of generic first-order recursive types for λ-calculi, following [START_REF] Brandt | Coinductive axiomatization of recursive type equality and subtyping[END_REF]. We give it a brief and presentation of it, see [START_REF] Barendregt | Lambda Calculus with Types. Perspectives in logic[END_REF] for a more complete account.

Types for Λ !

⊕

Our Λ ! ⊕ -type system is à la Curry-we don't add typing anotations to the syntax, but instead define typing judgments for terms without typing annotations. We have a functionnal type constructor →, a pair type constructor ×, a constructor ! to denote the ability to be copied, and the fixpoint type operator µα.σ.

The fixpoint type operator µ should be seen as a finite notation for a solution of a recursive type equation. For instance, the type σ = µα.α → α represents a solution to the recursive type equation:

A = A → A. Definition 7.2.1 (Types for Λ ! ⊕ )
We consider here a fixed countable set of type variables V T . The set A Λ ! ⊕ of types for Λ ! ⊕ is defined by the following grammar:

σ, τ . . . ∈ A Λ ! ⊕ ::=α | σ → τ | !σ | µα.σ with α, β ∈ V T
The least fixpoint operator µα.σ bound the variable α in σ. From now on, we consider types up to α-congruence on the bound type variables. We have to formalize in which sense a type µα.σ can be seen as a solution of an associated recursive type equation. We follow here [START_REF] Barendregt | Lambda calculi with types[END_REF], and do this by interpreting every type σ in A Λ ! with its (possibly) infinite unfolding of every recursive equation in it: thus we obtain a (possibly) infinite tree T (σ). We denote by Tree the set of all regular -i.e with a finite set of subtrees-trees whose leaves are in V T ∪ {⊥}, and whose nodes are the non-recursive operators of the language, i.e O = {!, →, ×, ∀α}. Definition 7.2.2 Let be σ ∈ A Λ ! . We define co-inductively T (σ) ∈ Tree as follows:

• T (α) = α; • T (σ → τ ) = Node(→, T (σ), T (τ )); • T (!σ) = Node(!, T (σ)); • T (µα.σ) = ⊥ if σ = µβ 1 . . . µβ n • α T (σ{µα.σ/α}) otherwise. .
We consider the set Tree up to α-equivalence. We illustrate below how first-order recursive typescan be used for encoding infinite data types. For the purpose of this example, we add a product type × to our type constructors. Observe however that our language Λ ! ⊕ has no constructors for pairs, and accordingly our type system for Λ ! ⊕ has no product operator.

Example 7.2.1 Let be α ∈ V T , and σ such that α doesn't occur freely in σ. We consider the type:

InfiniteList σ = µα.(σ × α).
Observe that this type is indeed designed to model infinite lists of elements of type σ, since every element of type InfiniteList σ is the given of an element of type σ-the head element -and another element of type InfiniteList σ -the tail. We see that T (InfiniteList σ ) is the following infinite tree:

× σ × σ × σ . . .
Observe that two different Λ ! ⊕ types can be the finite representation of the same infinite tree. For instance, the type µα.(σ × (σ × α)) has the same associated tree as InfiniteList σ . It is an intrinsic feature of recursive types, since the same type can be a solution of several different recursive equations. Since we are actually interested in the tree itself, and not its finite representation, we will consider Λ ! ⊕ types modulo equality of their associated tree, following [START_REF] Barendregt | Lambda calculi with types[END_REF].

Definition 7.2.3 = A is the equivalence relation on A Λ ! ⊕ defined as: σ = A τ if T (σ) = T (τ ).
With this definition, we can now formalize our earlier idea of recursive equations: if we consider the type InfiniteList σ of Example 7.2.1, we see that it indeed holds that: InfiniteList σ = A σ × InfiniteList σ . In the following, we will always consider implicitly the types up to this equality relation.

Typing System for Λ !

⊕

Now that we have defined a set of types A Λ ! ⊕ , we are going to specify the typing rules. The typing rules we are going to give here are inspired of the one for Lily (see [START_REF] Bierman | Operational properties of lily, a polymorphic linear lambda calculus with recursion[END_REF]). We want to establish typing judgments, that guarantee that a term M of Λ ! ⊕ is well-typed under some typing environment Γ: this typing environment specify the type of the free variable in M . More precisely, a typing judgment will be of the form Γ M : σ: it means that when the free variables of M are replaced by terms having the type specified by the typing environment Γ, then the resulting term is of type σ.

Recall that in a term M of Λ ! ⊕ , free variables may have two different meanings: they may be meant to be affine, and in this case they must appear at most once in M , or they

Fold-Unfold µα.A = A A[α → µα.A] B = A A µ-compat µα.A = A µα.B Ai = A Bi for 1 ≤ i ≤ n op ∈ O = {→, ×, !, ∀α.} op(A1, . . . , An) = A op(B1, . . . , Bn) σ = A A[α → σ] τ = A A[α → τ ] A contractive in α Contract σ = A τ
where σ[α → τ ] is the type obtained by substituting all free occurrences of α by τ in σ;

A is contractive in α when every free occurence of α arrive under an operator in O. may be meant to be exponential, and then they may appear several times. Accordingly, there will be two kind of elements in our typing environment: affine pairs of the form (x, σ) which specify that x is an affine free variable of type σ, and exponential pairs of the form (!x, !σ), that specify that x is an exponential free variable of type σ.

Definition 7.2.4 An environment is a set of expressions in the form x : σ or !x :!σ, where x ∈ V and σ ∈ A Λ ! ⊕ , and in which any variable x occurs at most once.

To make notations more readable, we will indicate the exponential part with metavariables like !Γ, which stands for an environment with only exponential pairs (!x, !σ), and the affine part by metavariables like ∆ standing for an environment where all the elements are affine.

Definition 7.2.5 We say that a typing judgment !Γ, ∆ M : σ is valid it it can be derived from the rules given in Figure 7.2. We give now some explanations on the typing rules given in Figure 7.2. First, observe that the (Var) and (!-Var) rules imply the ability to weaken variables, in the sense that non-used variables (both affine or exponential) can be discarded.

!-V !Γ, !x :!σ, ∆ x : σ V !Γ, ∆, x : σ x : σ !Γ, x : σ, ∆ M : τ Abstr !Γ, ∆ λx.M : σ → τ !x :!σ, !Γ, ∆ M : τ !-Abstr !Γ, ∆ λ!x.M :!σ → τ !Γ, ∆ M : σ → τ !Γ, Θ N : σ App !Γ, ∆, Θ M N : τ !Γ M : σ Box !Γ !M :!σ !Γ, ∆ M : σ !Γ, ∆ N : σ Choice !Γ, ∆ M ⊕ N : σ
Then, we can see that we have two rules (Abstr) and (!-Abstr), respectively, for the affine and exponential abstractions. It us an adaption to our affine/ exponential framework of the standard abstraction rule in typed lambda-calculus.

Let us now look at the application rule (App). We see a difference in the treatment of the affine typing context and the one of the exponential typing context: when exponential variables can be used to type both M and N , we have to choose for every affine variable whether it is going to be used to type M or to type N . This specifies that exponential variables can be duplicated, while affine variables cannot.

The rule (Box) allow to type terms of the shape !M . It says that if we are able to type M with the type σ using a typing context with only duplicable variables, then we can put M in an exponential box, and we obtain a term of type !σ. The idea is that, since all the free variables of M may be duplicated, we are also able to duplicate M .

The rule (Choice) for probabilistic choice says that we can only do a probabilistic choice between two programs of the same type. Crucially, an affine variable x can be used to type both components of a probabilistic choice: it is because it is not a duplication, but simply the consequence of the fact that x can be used in every probabilistic execution path. Definition 7.2. [START_REF] Azevedo De Amorim | A semantic account of metric preservation[END_REF] We say that M ∈ Λ ! ⊕ is a program of type σ, if ( M : σ ) is a valid typing judgment. We denote by P σ the set of programs of type σ. We denote by V σ the set of programs of type σ which are also values.

We are now going show that there exist valid typing judgments for the terms of Λ ! ⊕ we gave as examples in the previous section. In the proof tree, we will use the type τ = µα.!α → σ. The relevance of τ comes from the fact that looking at the fold-unfold equation in Figure 7.1, we can see that

τ = A !τ → σ. τ = A !τ → σ !-V !x :!τ x :!τ → σ !-V !x :!τ x : τ Box !x :!τ !x :!τ Appl !x :!τ x(!x) : σ !-Abstr λ!x.x(!x) :!τ → σ . . . λ!x.x(!x) : τ = A !τ → σ Box !(λ!x.x(!x)) :!τ App (λ!x.x(!x))(!λ!x.x(!x)) : σ
where we take τ ::= (µα.!α → σ).

Observe that, on the right, it remains to be shown that λ!x.x(!x) :!τ → σ. However, we see that it is sufficient to use again the same derivation tree as in the left part.

Recall that we have also defined a recursion operator Y for Λ ! ⊕ in Example 7.1.2. We are now going to see that we can adapt the proof of typability of Ω to Y . We are also able to type Y in our type system. Indeed, it holds that for every type σ

∈ A Λ ! ⊕ : Y : !(!σ → σ) → σ.
In the proof, we use the same auxilliary type τ = µα.!α → σ as in Example 7.2.2: recall that it verifies τ = A !τ → σ. We also use the fact that we have shown in the proof of Example 7.2.2 that !y :!τ y!y : σ (it is the premise of a sub-derivation in the proof tree presented in Example 7.2.2).

!-V !x :!(!σ → σ), !y :!τ x :!σ → σ (see Example 7.2.2) !y :!τ y!y : σ Box !y :!τ !(y!y) :!σ App !x :!(!σ → σ), !y :!τ x!(y(!y)) : σ !-Abstr !x :!(!σ → σ) Lx :!τ → σ . . . !x :!(!σ → σ) Lx : τ = A !τ → σ Box !x :!(!σ → σ) !Lx :!τ App !x :!(!σ → σ) Lx!Lx : σ !-Abstr λ!x.Lx!Lx :!(!σ → σ) → σ ∀ intro Y = λ!x.Lx!Lx : ∀σ.!(!σ → σ) → σ
where we take τ ::= (µα.!α → σ).

and Lx ::= (λ!y.x!(y(!y)))

Figure 7.3: Proof Tree of Y : !(!σ → σ) → σ
Since we are able to type the fixpoint operator Y , we may now use it to express program recursively defined.

In the following, it will be sometimes useful to type evaluation contexts too. We write [•] : σ E to express the fact that, if we fill some evaluation context E by any program of type σ, then we will obtain a well-typed program. Notation 7.2.2 (Typing Judgment for Contexts) Let C be a context. We write [•] : σ C : τ when x : σ E[x] : τ . When we don't need to specify the result type, we will note [•] : σ E, whenever there exists a type ι such that [•] : σ C : ι is a valid typing judgment.

Soundness of the Type System for Λ !

⊕ .

We are now going to study which properties on programs are enforced by our type system. We first want to ensure that no deadlock can occur when we execute a well-typed program.

To show that, we need the following two lemmas, that ensure that our type system is well behaved. The first one is the probabilistic counterpart of the Subject Reduction property for deterministic typed λ-calculi: it says that, whenever we do one execution step from a program of type σ, every program we may obtain as a result is also of type σ.

Lemma 7.2.3 (Subject Reduction) Let be M a program such that M : σ, and moreover M → N 1 , . . . , N n . Then for every i ∈ {1, . . . , n}, it holds that N i : σ.

Proof. As in the deterministic case, the proof of Lemma 7.2.3 is based on an auxilliary Substitution Lemma: Lemma 7.2.4 Let be M a program such that M : σ. Then:

• if x : σ N : τ , then it holds that N {M/x} : τ .

• if !x :!σ N : τ , then it holds that N {M/x} : τ .

Proof. The substitution lemma is shown by induction on the structure of N .

We conclude the proof of the Subject Reduction lemma by case distinction on redex rules.

We show now that our type system enjoys the Progress Property, that says that if a well typed program cannot be reduced anymore, then it is a value, and not merely a deadlocked term. Lemma 7.2.5 (Progress) If M is a typable program which is a normal form for →, then it is a value.

We are now able to use Subject Reduction and Progress to show that our Λ ! ⊕ type system is sound: if an execution path with a non-zero probability stops at a normal form, then this normal form is a value of the same type as the original program. We can interpret this property by saying that it guarantees that well-typed programs are well-behaved. • If the derivation uses the (Empty) rule as last rule, it means that it is of the form:

M ⇒ ∅ = D ,
and since the support of the empty distribution is empty, the result holds.

• If the derivation uses the (NF) rule as last rule, it means that it is of the form:

V is a → normal form. Val M = V ⇒ {V 1 } = D .
It means that the only term in the support of D is M itself, and moreover it is already in normal form. Using Lemma 7.2.5, we see that it implies that M is a value.

• If the derivation use the (Step) rule as last rule, it is of the form:

M → N 1 , . . . , N n (N i ⇒ E i ) 1≤i≤n Step M ⇒ D = 1≤i≤n 1 n • E i .
First, we apply Lemma 7.2.3: it tells us that each one of the program N 1 , . . . , N n is of type σ. We can apply now the induction hypothesis on every one of the subderivations N i ⇒ E i . As a consequence, we know already that S(E i ) ⊆ V σ for every i ∈ {1, . . . , n}. Since D = 1≤i≤n While our type system for Λ ! ⊕ is sound and allows us to enforce our ressource policy on variables, we should also note that type inference is undecidable.

Example 7.2.4 (Boolean in Λ !

⊕ .) Recall the terms true = λx.λy.x, false = λx.λy.y, and ITE = λx.λy.λz.xyz, that we presented in Example 9.2.1 to simulate the boolean data type in Λ. For every type σ, we note B σ := σ → σ → σ. Then for every type σ, we have:

true

: B σ false : B σ ITE : (B σ → σ → σ)
Since we have fixed a CBV strategy, it means in particular that when evaluating ITE M N L both conditional branches N and L are executed. To obtain a more intuitive version of conditional, we use the term ITE to define the if-then-else procedure, which is a Λ ! ⊕ context with three holes, defined as:

if

([•] 1 ) then [•] 2 else [•] 3 := ( ITE [•] 1 (λx.[•] 2 )(λx.[•] 3 ))I 7.3 Embeddings from Λ ⊕ into Λ ! ⊕
We see now that Λ ! ⊕ allows to encode the untyped probabilistic λ-calculus Λ ⊕ . To make this connection more precise, we will define encodings

[•] L ⊕ : L ⊕ → Λ ! ⊕ , for L ⊕ ∈ {Λ cbn ⊕ , Λ CBV ⊕
}, and we will show that these encoddings preserve operational semantics. Here, we present the embedding [] cbn from Λ ⊕ endowed with its CBN semantics as presented in Chapter 1, into Λ ! ⊕ . To design it, we made use of the connexion between Λ ! ⊕ and Linear Logic (LL). Linear Logic is a logic which talk about the use of ressources. Λ ! ⊕ can be seen as a linear calculus, in the sens that the syntactic construct of the language (apart from the probabilitic choice) correspond to the connector of the MELC (Multiplicative Exponential Linear Logic) fragment of LL. In [START_REF] Girard | Linear logic[END_REF], Girard looked at standard ways to translate the intuitionnistic logic into intuitionnistic linear logic. Using the connection between logic and lambda-calculi, it gives equivalently a way to translate the simply typed λ-calculus in the linear term calculus. Girard proposed actually two translations, which were shown to correspond to a CBN and CBV evaluation strategy. Here, we are going to adapt these translations to translations from the untyped probabilistic lambda-calculus Λ ⊕ into Λ ! ⊕ , that can be seen as a probabilistic linear language enhanced with recursive types.

The Call-By-Name Embedding

We adapt here this translation to an embedding

[•] cbn : Λ ⊕ → Λ ! ⊕ . Definition 7.3.1 We define σ cbn = µα.!α → α, and [•] cbn : Λ ⊕ → Λ ! ⊕ as: [x] cbn = x [λx.M ] cbn = λ!x.[M ] cbn [M N ] cbn = [M ] cbn ![N ] cbn [M ⊕ N ] cbn = [M ] cbn ⊕ [N ] cbn
Observe that the type σ cbn is a solution to the recursive equation σ cbn =!σ cbn → σ cbn .We illustrate it by giving the representation of its infinite unfolding: A positive point about this embedding, that will be relevant in the following, is that it is compositionnal, i.e. it preserves the structure of the term. We formalize this idea in Lemma 7.3.2 below.

∈ Λ ⊕ , it holds that E[[L] cbn ] ∈ [Λ ⊕ ] cbn .
The operational semantics of CBN Λ ⊕ is preserved by the embedding in the following sense:

Proposition 7.3.3 Let be M a closed term in Λ ⊕ . Then [ M ] cbn = [M ] cbn .

The Call-By-Value Embedding

Girard gives actually another translation from intutionnistic logic into ILL, that lead to a CBV evaluation strategy.

Definition 7.3.2 We define σ cbv = µα.!(α → α), and [•] cbv : Λ ⊕ → Λ ! ⊕ as: [x] cbv =!x [λx.M ] cbv =!λ!x.[M ] cbv [M N ] cbv = (λ!x.x[N ] cbv )[M ] cbv [M ⊕ N ] cbv = [M ] cbv ⊕ [N ] cbv 7.4 Λ ≤1 ⊕ : An affine λ-calculus
Here, we are going to define a λ-calculus which is affine, i.e. no variable can be duplicated. This language is designed to model functions using their arguments at most once.

Observe that we could obtain such an affine higher-order language by looking at the fragment of Λ ! ⊕ obtained when removing the exponential constructs of the syntax of the language, and similarly the exponential type operator ! of the syntax for types. However, we instead opt for a presentation with affinity constraints, which is the one we used in the joint work with Dal Lago in [START_REF] Crubillé | Metric reasoning about λ-terms: The affine case[END_REF]. The Λ ≤1 ⊕ terms are generated by the following grammar:

M ::= x | λx.M | M M | M ⊕ M | Ω,
where Ω models divergence-since we only consider affine terms, we cannot encode divergence by the usual constructions of λ-calculus, and x ranges as usual over a countable set V of variables. The valid terms of Λ ≤1 ⊕ are isolated by way of a formal system, whose judgements are in the form Γ M (where Γ is any finite set of variables) and whose rules are the following (where Γ, ∆ stands for the union of two disjoints contexts):

Γ, x x Γ, x M Γ λx.M Γ M ∆ N Γ, ∆ M N Γ M Γ N Γ M ⊕ N Γ Ω
A program is a term such that ∅ M , and P Λ ≤1 ⊕ is the set of all such terms. We will call them closed terms. We say that a program is a value if it is of the form λx.M , and V Λ ≤1 ⊕ is the set of all such programs. The semantics of the just defined calculus is expressed as a binary relation ⇓ between programs and value subdistributions.

Ω ⇓ ∅ V ∈ V V ⇓ {V 1 } M ⇓ D N ⇓ E M ⊕ N ⇓ 1 2 D + 1 2 E M ⇓ D N ⇓ E {L{V /x} ⇓ F L,V } λx.L∈S(D),V ∈S(E ) M N ⇓ D(λx.L) • E (V ) • F L,V
The divergent program Ω, as expected, evaluates to the empty value distribution ∅ which assigns 0 to any value. Recall that the expression {V 1 } stands for the Dirac's value distribution on V ; more generally the expression {V p 1 1 , . . . , V pn n } indicates the value distribution assigning probability p i to each V i (and 0 to any other value). For every program M , there exists precisely one value distribution D such that M ⇓ D, that we note M . This holds only because we restrict ourselves to affine terms. Moreover, M is always a finite distribution. The rule for application expresses the fact that the semantics is call-by-value: the argument is evaluated before being passed to the function. There is no special reason why we adopt call-by-value here, and all we are going to say also holds for (weak) call-by-name evaluation.

The way ⇓ is defined means that it is a big-step notion of semantics. In some circumstances, we need to have a more local view of how programs behave. We can define small-step semantics, again as a relation ⇒ between programs and value distributions (itself defined on top of a relation → between programs and program distributions capturing a single evaluation step).

Λ ≤1 ⊕ , seen as a fragment of Λ ! ⊕ , is stable by the Λ ! ⊕ reduction relation →. It means that we can endow Λ ≤1 ⊕ with an operational semantics simply by taking the restriction of the Λ ! ⊕ -operational semantics. However, we can also give a simpler caracterisation of for Λ ≤1 ⊕ programs. Indeed, enforcing affinity in terms leads to removind recursion. As a consequence, the set of approximation semantics of a program in Λ ≤1 ⊕ becomes finite. Recall that the operational semantics of a program is defined as the supremum of its approximation semantics: the previous observation means that we can give a direct inductive caracterisation of the Λ ≤1 ⊕ -operational semantics.

Proposition 7.4.1 The operational semantics in Λ ≤1 ⊕ can be caracterised by the following inductive definition:

V is a → normal form. NF V = {V 1 } M → N 1 , . . . , N n Step M = 1≤i≤n 1 n • N i
Observe that the rules are the same as for defining approximation semantics (see Chapter 1 Definition 1.2.4), except that we removed the (Empty) rule.

Proof. What we have to show is that for every program M ∈ P ≤1 , there exists D such that we can show M ⇒ D using the rules of Λ ! ⊕ for the approximation semantics, but without using the (Empty) rule.

The proof is based on the fact that we can define a function c : P ≤1 → N, such that, if M is a well-typed affine program, and M → N 1 , . . . , N n , it holds that for every i ∈ N, c(M ) > c(N i ). We define c(M ) inductively on the structure of M , as follows:

c(x) = 0 c(λx.N ) = c(N ) c(Ω) = 1 c(N L) = 1 + c(N ) + c(L) c(M ⊕ N ) = 1 + max{c(M ), c(N )} c( M, N ) = c(M ) + c(N ) c(let x, y = M in L) = c(M ) + c(N ) + 1
The idea is that we take c(M ) as the maximal number of redexes on every possible execution path. We first show the following auxilliary lemma:

Lemma 7.4.2 Let be M such that x 1 : τ 1 , . . . , x m : τ m M : σ is a valid affine typing judgment, and a family of terms N such that N i : τ i . Then it holds that

c(M {N 1 /x 1 } . . . {N m /x m }) ≤ c(M ) + 1≤i≤m c(N i )
Proof. The proof of Lemma 7.4.2 is done by induction on the structure of M . We do explicitely here the application case: suppose that M = KL. Using the typing rules, we see that we can split the typing context ∆ = x 1 : τ 1 , . . . , x m : τ m into two disjoints typing contexts ∆ 1 = x i 1 : τ i 1 , . . . , x i k : σ i k , and ∆ 2 = x j 1 : τ j 1 , . . . , x j l : τ j l , such that ∆ 1 N : ι → σ, and ∆ 2 L : ι. Moreover, since ∆ 1 and ∆ 2 are disjoint, a free variable x i of M is substituted either in K, or in L, but not in both. It means that we can write:

M {N 1 /x 1 } . . . {N m /x m } = K L with K = K{N i 1 /x i 1 } . . . {N i k /x i k } and L = L{N j 1 /x j 1 } . . . {N j l /x j l }
Using the definition of c, it tells us that

c(M {N 1 /x 1 } . . . {N m /x m }) = 1 + c(K ) + c(L ). (7.1)
We apply now the induction hypothesis to both K and L: we obtain that:

c(K ) ≤ c(K) + p∈{i 1 ,...,i k } c(N p ) (7.2) and c(L ) ≤ c(L) + p∈{j 1 ,...,j l } c(N p ) (7.3) (7.4) Since c(M ) = c(K) + c(L)
i ∈ N, c(N i ) ≤ c(M ) -1.
Proof. The proof is by case distinction on the redex which is actually reduced by →.

We can now end the proof of Proposition 7.4.1 using Lemma 7.4.3. Indeed, recall that we have to show that there exists a finite proof derivation of M ⇒ D (seen as the operational semantics of Λ ! ⊕ ) which does not use the (Empty) rule. Suppose by contradiction that this is not the case. Since we have a progress Lemma, the fact that there is no finite proof derivation implies that there exists a family of programs (M n ) n∈N , such that M = M 0 , and for every i ∈ N, it holds that M i → N 1 , . . . N k , where M i+1 is one of the N j . But then we have build an infinite strictly decreasing sequence of natural numbers by considering c(M i ), which does not exist.

Observe that since we don't have recursion anymore, the program Ω ! is not in Λ ≤1 ⊕ . However, we still have non-terminating programs: indeed the generic non-terminating term Ω is still a constant in the syntax. It is actually our motivation for introducing Ω in the syntax: we wanted to keep the possiblilty to express non-termination in the affine fragment of Λ ! ⊕ : indeed recall that we take as our notion of observation on programs-for defining context equivalence or context distance-the probability of non-termination (see Chapters 2 and 3).

⊕ ε • such that M ⊕ ε N = (1 -ε) M + ε N for every closed M, N . It can be defined in Λ ≤1
⊕ , e.g., as follows by induction on m:

M ⊕ 0 N = M M ⊕ 1 N = N M ⊕ n 2 m N = M ⊕ (M ⊕ n 2 m-1 N ) if n ≤ 2 m-1 N ⊕ (M ⊕ n-2 m-1 2 m-1 N ) if n > 2 m-1 Definition 7.4.2 Contexts in Λ ≤1 ⊕
We call open Λ ≤1 ⊕ -contexts the terms C build using the grammar of Λ ≤1 ⊕ , with V ars() as set of potential bounded variables, and [•] ∪ V ars() as set of potential free variables, and such that there exists

X ⊆ V ars() with X ∪ [•] C. We call Λ ≤1 ⊕ -context the open Λ ≤1 ⊕ -context such that [•] C. Lemma 7.4.4
We can caracterise the open Λ ≤1 ⊕ -contexts as the terms generated by the following grammar: Applicative Trace Distances for Higher-order Probabilistic Calculi.

C ::= [•] | M C | CM | λx.C | C ⊕ D | M,
In Chapter 4 and 5 we studied two extensions of Abramsky's applicative bisimilarity in the setting of higher-order probabilistic calculi, that were both introduced by Dal Lago, Sangiorgi and Alberti [START_REF] Lago | On coinductive equivalences for higherorder probabilistic functional programs[END_REF]: trace equivalence-that was shown by the authors of [START_REF] Lago | On coinductive equivalences for higherorder probabilistic functional programs[END_REF] to be fully abstract for CBN Λ ⊕ -and the probabilistic applicative bisimilarity-that we have shown in Chapter 5 to be fully abstract for CBV Λ ⊕ . We now want to extend this line of reasoning to the quantitative case, i.e. to build distances on programs that are easier to handle than the observational distance, while still allowing us to gather as much useful information as possible about the observational distance. In the first part of the present Chapter, we revisit the properties for equivalence relations on programs that we presented in Chapters 4 and 5 -i.e. observational correctness, compositionality, and soundness-by adapting them to distances, in the setting of a generic observable probabilistic programming language. In the second part of the present chapter, our goal thus becomes to extend trace equivalence into a quantitative notion, thus defining sound trace distances on probabilistic higher-order programs. In the next chapter, we will do the same for probabilistic applicative bisimilarity, thus obtaining applicative bisimilarity distances.

When introducing trace equivalence for CBN Λ ⊕ , Dal Lago, Sangiorgi and Alberti used a presentation based on applicative contexts. Recall that in Chapter 4, we give also an alternative presentation using WLTSs, that are deterministic Labeled Transition Systems with weight. With this viewpoint, defining a trace equivalence for some higher-order probabilistic language means giving a WLTS that expresses interactively the operational semantics of this language, and then to use bisimilarity on this WLTS to build an equivalence on programs.

Our approach towards a quantitative extension of trace equivalence is as follows: we first adapt the notion of WLTS-bisimilarity into a quantitative notion of bisimilarity distance for WLTSs, and then as in the equivalence case, we build a distance on the set of programs of a particular language by using the bisimilarity distance of its associated WLTS. Observe however that while this approach can a priori be used for any higher-order probabilistic programming language, there is no guarantee that the resulting equivalences and distances on programs will be sound with respect to the observational equivalence and the observational distance of the language respectively. To illustrate this point, let us recall what happens for the language Λ ⊕ : while the WLTS L (Λ ⊕ cbn )-the applicative WLTS for CBN Λ ⊕ that we defined in Definition 4.2.4 in Chapter 4 -leads to a sound trace equivalence, that is not the case anymore if we use a similarly built WLTS for CBV Λ ⊕ , as we mentioned in Section 5.3 in Chapter 5.

Actually, the situation becomes worse in the quantitative case, since-as we will show in this Chapter-the trace distance on CBN Λ ⊕ induced by L (Λ ⊕ cbn ) is not sound. As we will highlight, this gap between the 2-valued case and the quantitative case comes actually from the copying phenomenon. For this reason, we will first consider the affine language Λ ≤1 ⊕ , in which no copying can occur: we will adapt to this language the applicative WLTS used for CBN Λ ⊕ , and show that this WLTS indeed leads to a sound-and even fully abstract-distance for Λ ≤1 ⊕ programs. The last part of this Chapter deals then with the copying phenomenon: we look at the language Λ ! ⊕ with ! explicit that we presented in Chapter 7: the presence of this additional syntactic structure allows us to design a WLTS specifically to get around of the copying problem. We then show that the distance for Λ ! ⊕ -programs obtained with this WLTS is sound-and even fully abstract. The work we present here was published jointly with Ugo Dal Lago in [START_REF] Crubillé | Metric reasoning about λ-terms: The affine case[END_REF][START_REF] Crubillé | Metric reasoning about \lambda -terms: The general case[END_REF], and our presentation here follows closely the structure of these papers.

Well-behaved Distances for Higher-Order Languages

We have defined in Chapter 3 the observational distance for a generic observable probabilistic programming language-that is any language equipped with a notion of observation and a notion of contexts as formalized in Definition 2.3.1 for untyped languages, and in Definition 2.3.2 for typed languages. In this section, we want to look at a larger class of distances for such generic observable programming language, and at how we can describe their behavior with respect to the observational distance.

The distances that we are going to consider are-contrary to the observational distance-defined on the set of programs, instead of all terms of the language; recall that it is also the case of the coinductively defined equivalences that we have built in Chapter 4 and 5. In the same way that we used open extension to go from a relation on programs to a relation on all terms in the equivalence case, we will also be able to go from a distance on programs to a distance on all terms, as we will illustrate in the next chapter. We ask our distances to be essentially pseudo-metrics-see Definition 3.1.3 of Chapter 3-on programs, but when we work with a programming language which is typed, we need to take also into account the fact that we can compare only programs that have the same type. Summing up, we formalize below in Definition 8.1.1 the class of distances for any observable probabilistic programming language. Definition 8.1.1 Let L ⊕ be an observable programming language. A distance on programs is:

• if L ⊕ is untyped, a pseudo-metric µ : P × P → [0, 1]
, where P is the set of programs of L ⊕ ;

• if L ⊕ is typed, a family of pseudo-metrics indexed by the types: (µ σ ) σ∈A L ⊕ with µ σ : P σ × P σ → [0, 1], where A L ⊕ is the set of L ⊕ -types, and for every σ ∈ A L ⊕ , P σ is the set of all programs of type σ.

As we have explained in Chapter 4, the primary requirement enforced in the literature on an equivalence relation R on programs is soundness with respect to observational equivalence, i.e. that M ≡ ctx L ⊕ N whenever (M, N ) ∈ R. We give here the quantitative counterpart of this requirement: we ask to a distance µ to move apart programs at least as much as the observational distance does, in the sense formalized in Definition 8.1.2 below. Definition 8.1.2 Let L ⊕ be an observable programming language, and µ a distance on programs. We say that µ is sound with respect to the observational distance when the following conditions hold:

• if L ⊕ is an untyped language, we ask that for every programs M and N , δ ctx (M, N ) ≤ µ(M, N ).

• if L ⊕ is a typed language, we ask that for every σ ∈ A , M, N ∈ P σ , δ ctx σ (M, N ) ≤ µ σ (M, N ).

Observe that this soundness requirement on distances is a generalization of soundness for equivalence relations, in the sense that whenever a pseudo-metric is sound w.r.t observational distance, then its kernel is sound w.r.t. observational equivalence. Proving soundness of an equivalence relation on programs for some higher-order language usually consists in proving both observational correctness and compositionality; this approach was for instance followed [START_REF] Lago | On coinductive equivalences for higherorder probabilistic functional programs[END_REF] for trace equivalence and applicative probabilistic bisimilarity for CBN Λ ⊕ , and we also illustrated it here when proving soundness of applicative probabilistic bisimilarity for CBV Λ ⊕ in Chapter 5. We first look at how to generalize observational correctness to the quantitative case. Recall that an equivalence relation R is observationally correct when:

M R N ⇒ Obs(M ) = Obs(N ).
It means that whenever M and N are equivalent with respect to R, the dummy context [•] that simply executes its argument should not be able to distinguish between M and N . Similarly, we say that a distance µ is observationally correct when it is at least as informed as this dummy context, in the sense that it should separate programs at least as much.

Definition 8.1.3 Let L ⊕ be an observable programming language, and µ a distance on programs. We say that µ is an observationally correct distance if the following conditions hold:

• if L ⊕ is an untyped language, we ask that for all programs M, N ∈ P, µ(M, N ) ≥ |Obs(M ) -Obs(N )|;

• if L ⊕ is a typed language, we ask that for every observable type σ ∈ A obs , and every programs M, N ∈ P σ : µ σ (M, N ) ≥ |Obs σ (M ) -Obs σ (N )|., where A obs is the set of observable types of L ⊕ .

Observe that observational correctness is weaker than soundness, since being sound means to be at least as informed as all possible contexts. As developed in Chapter 5-see Proposition 5.1.2-if a relation is an observationally correct equivalence, then we know it is sound with respect to observational equivalence as soon as it is also compositional, i.e. :

M R N ∧ C a context ⇒ (C[M ]) R (C[N ]).
We now want to generalize compositionality to the quantitative case. We choose here to ask for the distance µ to be non-expansive, i.e. that an environment cannot increase the µ-distance between two programs by filling them into some context. It is the notion which is used for instance by Reed and Pierce [START_REF] Reed | Distance makes the types grow stronger: a calculus for differential privacy[END_REF] to do compositional reasoning for differential privacy, as well as by Azevedo et al [START_REF] Azevedo De Amorim | A semantic account of metric preservation[END_REF] when developing denotational semantics that are distance-based. We formalize in our setting this non-expansiveness requirement below.

Definition 8.1.4 Let L ⊕ be an observable programming language, and µ a distance on programs. We say that µ is non-expansive, when:

• if L ⊕ is an untyped language, we ask that for every programs M, N ∈ P, and every context C, it holds that µ(C[M ], C[N ]) ≤ µ(M, N );

• if L ⊕ is a typed language, we ask that for every σ, τ ∈ A , every programs M, N ∈ P σ , and every context

C ∈ C (∅,σ)→τ , it holds that µ τ (C[M ], C[N ]) ≤ µ σ (M, N ).
It can be interesting to note that non-expansiveness is not the only quantitative generalization of compositionality considered in the literature. Gebler and Tini [START_REF] Gebler | Fixed-point characterization of compositionality properties of probabilistic processes combinators[END_REF], for instance, ask in their work on distances on a first-order probabilistic language for uniform continuity, i.e. that if we fix a context C, and an objective ε ∈ [0, 1], to be sure that C[M ] and C[N ] are not farther away than our objective ε, it is enough to know that M and N are closer than some quantity δ. Formally, it means that for every small ε ∈ (0, 1], and for every context C, there exists a δ ∈ [0, 1], such that for all programs M , N µ(M, N

) ≤ δ ⇒ µ(C[M ], C[N ]) ≤ ε.
Observe that our non-expansiveness requirement is stronger than uniform continuity. In Proposition 5.1.2 of Chapter 5, we showed that when an equivalence relation on program is both observationally correct and compositional, then it is sound with respect to the observational equivalence. We prove now in Proposition 8.1.1 below that the quantitative counterpart is also true, i.e. as soon as we have established both observational correctness and non-expansiveness for some distance µ on programs, we obtain that µ is sound with respect to the observational distance. Observe that the non-expansiveness requirement is also interesting on its own, since it allows us to reason by compositionality when computing the distance between two programs. Proposition 8.1.1 Let L ⊕ be an observable programming language, and µ a distance on programs. If µ is both observationally correct and non-expansive, then it is sound with respect to the observational distance.

Proof. We show Proposition 8.1.1 in the case where L ⊕ is an untyped language, but the reasoning is similar in the typed case. Let µ be a distance on programs, that is both observationally correct and non-expansive. Let M, N be two programs. Recall the definition of observational distance:

δ ctx (M, N ) = sup C a context |Obs(C[M ]) -Obs(C[N ])|.
It means that it is enough to show that for every context

C, |Obs(C[M ]) -Obs(C[N ])| ≤ µ(M, N ). Since µ is observationally correct, we see that |Obs(C[M ]) -Obs(C[N ])| ≤ µ(C[M ], C[N ]), and since µ is non-expansive, µ(C[M ], C[N ]) ≤ µ(M, N ).
By combining these two inequalities, we can conclude the proof.

Bisimilarity Distance for WLTSs

Recall that our presentation of sound equivalences for Λ ⊕ in Chapter 4 and Chapter 5 relied on built-in notions of equivalence on various classes of quantitative transition systems. As highlighted there, WLTSs-Weighted Labeled Transition Systems, that we have introduced in Section 4.2.1 of Chapter 4-is the class of transition systems that allows to express trace equivalences for probabilistic higher-order languages. In this section, we focus on WLTSs, and we see that bisimilarity on WLTS can be generalized in a natural way into bisimilarity distance. Recall that we have gave two equivalent definitions of bisimilarity for WLTSs: the first one is inherently coinductive, while the other one characterizes bisimilarity inductively by using linear tests. We follow a similar path here: we first give a coinductive definition of bisimilarity distance, and then we show that we can also characterize it by linear tests.

A Coinductive Definition of Bisimilarity Distance for WLTSs.

We look here for a quantitative generalization of the coinductive definition of WLTSbisimilarity as the largest WLTS-bisimulation-see Definition 4.2.5 of Chapter 4. Observe that a necessary condition for two states s and t to be bisimilar is that w(s) and w(t) must be equal. When dealing with distances, however, we want to be able to express the fact that two states -that can possibly have distinct images by w(•)-are not farther away than some small quantity ε. This idea leads us to a relaxed notion of bisimulation: for each ε ∈ [0, 1], we define below the ε-bisimulation requirement, designed to guarantee that whenever two states s, t are related, their w-valuation will never be farther away than ε no matter the evolution of the system. Definition 8.2.1 Let L w = (w, (S, L, →)) be a WLTS. Let R be a binary relation on S, and ε ∈ [0, 1]. We say that R is a ε-bisimulation whenever the following two conditions hold:

1. R is a bisimulation on the LTS L = (S, L, →);

2. if s R t, then |w(s) -w(t)| ≤ ε.
When only the condition (2) holds, we will say that the relation R is ε-bounded. For every ε ∈ [0, 1], there exists a largest ε-bisimulation, that we indicate as R ε L w , and call ε-bisimilarity on L w .

Observe that a 0-bisimulation is simply a WLTS-bisimulation, so the 0-bisimilarity R 0 L w coincides with the bisimilarity on L w : in that sense our relaxed notion of ε-bisimilarity is indeed a quantitative extension of bisimilarity. If we now look at the 1-bisimilarity, we see that since the image of w is contained in [0, 1], R 1 L w is the bisimilarity on the underlying LTS L .In particular, it is an equivalence relation: we say that two states are comparable when they are in the same equivalence class for R 1 L w , and we denote by E (L w ) the set of equivalence classes for R 1 L w . We will often in the following ask binary relations on states to be clustered, i.e. to respect the equivalence class of R 1 . We formalize this notion in Definition 8.2.2 below. Definition 8.2.2 Let L w be a WLTS. We say that a relation R is clustered if s R t implies that there exists E ∈ E (L ), such that both s ∈ E and t ∈ E.

When R is a clustered relation, we use the following notation: for every E ∈ E (L w ), we will denote s R E t to mean that s, t ∈ E, and s R t. Observe that as soon as R is a ε-bisimulation for some ε ∈ [0, 1], it holds that R is a clustered binary relation. If we look now at the ε-relaxed version of bisimilarity R ε L w , we see that it is not necessarily an equivalence relation (since it is not transitive). It is however an reflexive and symmetric binary relation, as we show below: Lemma 8.2.1 For every ε ∈ [0, 1], it holds that R ε L w is reflexive and symmetric.

Proof. The proof is similar to the one we did to show that the bisimilarity on some LTS is an equivalence relation: we show that {(s, s) | s ∈ S} is a 0-bisimulation; and that if R is a ε bisimulation, then also R -1 is a ε-bisimulation. We illustrate on an example the notion of ε-bisimulation, by looking at the WLTS L (Λ ⊕ cbn ), which is the applicative WLTS for CBN Λ ⊕ that we used to present trace equivalence in Chapter 4. We want to compare the two programs M = λx.I, and N = (λx.I ⊕ λx.Ω). Recall that we have shown-in Example 4.2.4 of Chapter 4-that their corresponding states s(M ) := {M 1 } and s(N ) := {N 1 } are not bisimilar on L (Λ ⊕ cbn ); in other words there is no 0-bisimulation that connects them. We show in Example 8.2.1 below that we can however build a 1 2 -bisimulation that connects those states.

Example 8.2.1 We consider the two L (Λ ⊕ cbn )-states s(M ) := {M 1 } and s(N ) := {N 1 }, with M = λx.I, and N = (λx.I ⊕ λx.Ω). We represent the fragment of L (Λ ⊕ cbn ) relevant for these two states in Figure 4.3 of Chapter 4. We build now a 1 2 -bisimulation that connect s(M ) and s(N ): recall that the set of states for this WLTS is S L (Λ ⊕ cbn ) = ∆(P Λ ⊕ ) ∆( V Λ ⊕ ), i.e. consists of both the distributions over the set of Λ ⊕ terms, and the distributions over the set of Λ ⊕ distinguished values; we define a relation R ⊆ S L (Λ ⊕ cbn ) × S L (Λ ⊕ cbn ) as:

R := {({M 1 }, {N 1 }), (s 1 , t 1 ), (s 2 , t 2 )} ∪ {(D, 1 2 • D) | D ∈ ∆(P Λ ⊕ ) ∆( V Λ ⊕ )},
where s and t are as represented in Figure 4.3. We can then check that R is indeed a

1 2 -bisimulation over L (Λ ⊕ cbn ).
Intuitively, each of the ε-bisimilarity R ε L w is designed to contain all the pairs (s, t) such that the states s and t are not farther away as ε. When looking at this the other way around, it means that the distance between s and t should be the smallest ε such that (s, t) ∈ R ε L w . Accordingly with this intuition, we define now the bisimilarity distance on the states of a WLTS. Definition 8.2.3 Let be L w = (w, (S, L, →)) a WLTS. We define the bisimulation distance for the WLTS L w as the family of quantitative valuations (δ L w E ) E∈E (L w ) where δ L w E : E × E → [0, 1] is defined as:

δ L w E (s, t) = inf {ε | s R ε L w t}.
Observe that the definition above is indeed well-posed, since whenever s and t are comparable, the set {ε | s R ε L w t} ⊆ [0, 1] contains at least 1-since s R 1 L w t by definition of comparable states-so it is not empty.

Lemma 8.2.2 For every class

E ∈ E (L w ), it holds that δ L w E is a pseudo-metric.
Proof. Using Lemma 8.2.1, we see that δ L w E is reflexive and symmetric. To see that the triangular inequality holds, we use the fact that if R is a ε 1 -bisimulation, and S is a ε 2 bisimulation, then R • S-i.e. the composition of R and S, see its definition in Chapter 4-is a (ε 1 + ε 2 )-bisimulation.

Moreover, the infinum in the definition of δ L w E is actually a minimum, as we show in Lemma 8.2.3 below. Lemma 8.2.3 Let L w = (w, (S, L, →)) be a WLTS, E ∈ E (L w ), and s, t ∈ E. Then

δ L w E (s, t) ≤ ε if and only if s R ε L w t.
Proof. The right-to-left implication is given by the definition of δ L w E . The other one comes from the fact that for every ε ∈ [0, 1], the relation

R := {(s, t) | δ L w E (s, t) ≤ ε} is a ε-bisimulation.
The coinductive definition of the bisimilarity distance is well-adapted to show upper bounds on the distance between two states: indeed, as we illustrate in the Example below, it is enough to build one ε-bisimulation that contains (s, t) in order to show that δ L w E (s, t) ≤ ε.

Example 8.2.2 We consider once again the WLTS L (Λ ⊕ cbn ). Observe first that R 1

L (Λ ⊕ cbn )
has two equivalence classes:

E (L (Λ ⊕ cbn )) = {E P , E V } with E P := ∆(P Λ ⊕ ), E V := ∆( V Λ ⊕ ).
δ L (Λ ⊕ cbn ) E P ({(λx.I) ⊕ (λx.Ω) 1 }, {(λx.I) 1 }) ≤ 1 2 .

An Inductive Characterization of Bisimilarity Distance for WLTS

In Section 4.2.1 of Chapter 4, we also characterized inductively bisimilarity for WLTSs, by using linear tests that are represented by traces, i.e. finite sequences of actions. Recall that for each state s, we defined T (s) the set of traces that we can execute with s as point of departure, and for every trace α ∈ T (s), we defined the success probability Prob(α ↓)(s) designed to represent the probability that α succeeds when applied to the state s. Then we showed-in Proposition 4.2.3-that two states are bisimilar if and only if they have the same set of admissible traces, and for each such trace the probability of success is the same for the two states. Here, we keep the same class of tests, and we show that they also characterize the bisimilarity distance: indeed, as stated formally in Proposition 8.2.4 below, the bisimilarity distance between two comparable states s and t coincides with the supremum of the separation induced by any trace α on (s, t).

Proposition 8.2.4 Let L w = (w, (S, L, →)) be a WLTS. For any set of traces A ⊆ T L w , we define: E A := {s | T (s) = A}. Then it holds that the equivalence classes of R 1 L w are the E A , i.e. more precisely E (L w ) = {E A | A ⊆ T L w , E A = ∅}. Moreover, when A ⊆ T L w and s, t ∈ E A , it holds that:

δ L w E A (s, t) = sup α∈A |Prob(α ↓)(s) -Prob(α ↓)(t)|.
Proof. We show separately the two inequalities: • First, if two states s and t are related by an ε-bisimulation, we can see that their set of admissible traces coincide, and moreover |Prob(α ↓)(s) -Prob(α ↓)(t)| ≤ ε (the proof is by induction on the length of the trace α, since the states obtained after having done every action in α are still ε-bisimilar). As a consequence:

δ L w E A (s, t) ≥ sup α∈A |Prob(α ↓ )(s) -Prob(α ↓)(t)|.
• To show the other implication, we define for every ε the binary relation on states

R ε := {(s, t) | ∃A ⊆ T L w , s, t ∈ E A ∧ ∀α ∈ A, |Prob(α ↓)(s) -Prob(α ↓)(t) ≤ ε}. We can see that R ε is indeed a ε-bisimulation, by remarking that if s a -→ s , it holds that T (s ) = {α | a • α ∈ T (s)}, and for α ∈ T (s ), Prob(α ↓)(s ) = Prob(a • α ↓)(s).
It means that two states s, t with the same admissible traces are ε-bisimilar as soon as the difference between their success probabilities for traces is never greater that ε. As a consequence,

δ L w E A (s, t) ≤ sup α∈A |Prob(α ↓)(s) -Prob(α ↓)(t)|.
(α ↓)(({M 1 })) = 1, while Prob(α ↓)(({N 1 })) = 1
2 . As a consequence, Proposition 8.2.4 tells us that:

δ L (Λ ⊕ cbn ) E P ({M 1 }, {N 1 }) ≥ 1 2 .
By combining this result with the reverse inequality that we have shown in Example 8.2.2, we see that the bisimilarity distance between {M 1 } and {N 1 } in the WLTS L (Λ ⊕ cbn ) is

The Trace Distance in Λ ≤1

⊕ .

We want now to build well-behaved-i.e. at least sound-distances for higher-order probabilistic programming languages, by using the built-in notion of bisimilarity distance for WLTSs. Since they are characterized by linear tests, and by analogy with trace equivalences, we will call such distances trace distances. At this point, a natural thing to do would be to look once again at the language CBN Λ ⊕ , since we know already that the WLTS L (Λ ⊕ cbn ) leads to a sound-and even fully abstract-notion of trace equivalence for this language, as shown by Dal Lago, Sangiorgi, Alberti [START_REF] Lago | On coinductive equivalences for higherorder probabilistic functional programs[END_REF]. However, a major problem occurs when we try to do so: the resulting trace distance on programs would be unsound with respect for the context distance on Λ ⊕ , as we state in Lemma 8.3.1 below.

Lemma 8.3.1 There exist M, N programs in

Λ cbn ⊕ such that δ L (Λ ⊕ cbn ) ({M 1 }, {N 1 }) < δ ctx (M, N ).
Proof. We take M = (λx.I) ⊕ (λx.Ω) and N = λx.I. We can see from Example 8.2.3 that the bisimilarity distance-on the WLTS L (Λ ⊕ cbn )-between {M 1 } and {N 1 } is equal to 1 2 . However, as illustrated in Chapter 3, the context distance between these two Λ ⊕ programs is 1-for both the CBV and the CBN reduction theory: it is the usual trivialization phenomenon.

As argued in Chapter 6, trivialization arises primarily from the copying ability of the language. For this reason, as a first step to look at how we can build trace distances for higher-order probabilistic languages, we ban copying altogether, by considering the affine language Λ ≤1 ⊕ -that we introduced in Section 7.4 of Chapter 7. So we first build a WLTS that expresses interactively the operational semantics for this affine language. There are two main differences with respect to the WLTS for CBN Λ ⊕ . First, since the reduction strategy on Λ ≤1 ⊕ is call-by-value, the applicative labels are going to be only values, instead of all programs. Second, the affinity constraint on the language enforces that the operational semantics of a program has always finite support-see Corollary 7.4.1 in Chapter 7-so the states of the WLTS are not all sub-distributions over programs, but only those sub-distributions that have finite support.

• ∀D ∈ ∆(P Λ ≤1 ⊕ ), D eval -→ M ∈P Λ ≤1 ⊕ D(M ) • M ; • ∀D ∈ ∆( V Λ ≤1 ⊕ ), V ∈ V Λ ≤1 ⊕ , D V -→ λx.M ∈V Λ ≤1 ⊕ D( λx.M ) • {M {V /x} 1 }.
We turn L (Λ ≤1 ⊕ ) into a WLTS by adding a weight function w : S Λ ≤1 ⊕ → [0, 1], taken as:

w(D) := |D|.
We first want to know which states s, t of L (Λ ≤1 ⊕ ) are comparable, i.e. what are the equivalence classes in E (L (Λ ≤1 ⊕ )). As stated in Lemma 8.3.2 below, the situation is similar to the case of L (Λ ⊕ cbn ): we can compare two states when either they are both subdistribution over programs, or they are both sub-distributions over distinguished values. Recall that we called E P and E V the two equivalence classes of R 1 L (Λ ⊕ cbn ) . To keep the notations readable, we will also write E P and E V for the two elements in E (L (Λ ≤1 ⊕ )), without specifying the language considered-unless otherwise specified, in the following we will be referring to the affine language.

Lemma 8.3.2 The equivalence relation R 1 L (Λ ≤1 ⊕ )
has two equivalence classes, that are

E P := {D ∈ ∆(P Λ ≤1 ⊕ ) | D has finite support} and E V := {D ∈ ∆( V Λ ≤1 ⊕ ) | D has finite support}.
Proof. The proof is similar to the one we did for L (Λ ⊕ cbn )-see Example 8.2.2 in Section 8.2.

We now associate to every program M in Λ ≤1

⊕ a L (Λ ≤1 ⊕ )-state-in the same way as when characterizing trace equivalence for CBN Λ ⊕ , by taking s(M ) := {M 1 } ∈ E P . From there, we define the trace distance between two programs as the bisimilarity distance on L (Λ ≤1 ⊕ )-as given in Definition 8.2.3-between their associated states.

Definition 8.3.2 We define the applicative trace distance as the quantitative valuation δ tr

Λ ≤1 ⊕ : P L (Λ ≤1 ⊕ ) × P L (Λ ≤1 ⊕ ) → [0, 1] taken as: δ tr Λ ≤1 ⊕ (M, N ) := δ L (Λ ≤1 ⊕ ) E P ({M 1 }, {N 1 }).
Observe that δ tr Λ ≤1 ⊕ is indeed a distance on programs for the untyped observable language Λ ≤1 ⊕ -in the sense of Definition 8.1.1-since Lemma 8.2.2 tells us it is a pseudo-metric. Recall that in Example 8.2.3 we saw that the trace distance between the CBN Λ ⊕ -programs λx.I and (λx.I ⊕ λx.Ω)-i.e. the bisimilarity distance between their associated states in the WLTS L (Λ ⊕ cbn )-is 1 2 . In Example 8.3.1 below we show that the situation is similar when we look at those programs as Λ ≤1 ⊕ -programs.

Example 8.3.1 We consider here the Λ ≤1 ⊕ programs M := (λx.I ⊕ λx.Ω) and N := λx.I-recall that Ω is here a primitive construct of Λ ≤1 ⊕ , designed as a tool to add divergence to our simplified affine language. To compute the trace distance between M and N , we need to consider the L (Λ ≤1 ⊕ )-states s = {M 1 }, and t = {N 1 }. We can show that the bisimilarity distance between s and t is 1 2 : the proof is similar to the one we did for s and t seen as states of L (Λ ⊕ cbn ), in Example 8.2.2 and Example 8.2.3. From there, we conclude:

δ tr Λ ≤1 ⊕ (M, N ) = 1 2 .

A Roadmap to Soundness.

We want now to show that the trace distance on Λ ≤1 ⊕ is sound with respect to the observational distance, i.e:

∀M, N programs, δ ctx Λ ≤1 ⊕ (M, N ) ≤ δ tr Λ ≤1 ⊕ (M, N ).
To do that, we use Proposition 8.1.1-see Section 8.1-that tells us it is enough to show that the trace distance is both observationally correct and non-expansive. The first step is easily done, by using the inductive characterization by linear tests. Proof. We can see it immediately by using the inductive characterization of bisimilarity distance on the WLTS L (Λ ≤1 ⊕ ). Indeed, for every program M , Obs(M ) can be computed as the success probability of the empty trace on the state s M .

The proof of non-expansiveness, however, is considerably more involved. Since the distance on programs is actually defined using the bisimilarity distance on a WLTS, the first step consists in expressing non-expansiveness directly as a WLTS-property. More precisely, we extend the notion of contexts, by transforming the Λ ≤1 ⊕ -contexts-that represent an algorithm that takes in input a program and returns another program-into state-contexts that are algorithm that take in input a state of L (Λ ≤1 ⊕ ) and return another state. Since the structure of this non-expansiveness proof is similar to the one of the proof for the trace distance on Λ ! ⊕ -that we will introduce in the next section-we will present the next steps in the setting of a generic WLTS equipped with state-contexts, in the following sense. Definition 8.3.3 (WLTS equipped with States-Contexts) Let L w be a WLTS. We say that we equip L w with state-contexts when specifying for each pair

(E 1 , E 2 ) of ele- ments in E (L w ), a set of functions E 1 → E 2 , that we denote C(E 1 → E 2 ), such that: ∀C ∈ C(E 1 → E 2 ), ∀s ∈ E 1 , w(C(s)) = w(s).
By analogy with the contexts of a programming language, we will use C, D . . . to denote the elements of C(E 1 → E 2 ), and if s ∈ E 1 , we will note C[s] for C(s). There is a slight abuse in notation here, in the sense that it also depends on the type B that we specify as output type: the same state-context can be both in C(A → B 1 ) and C(A → B 2 ). We are now ready to formalize the non-expansiveness property on WLTSs that are equipped with states-contexts: we ask that no state-context can increase the bisimilarity distance between two states. Definition 8.3.4 (Non-Expansiveness for WLTS) Let L w be a WLTS equipped with state contexts. We say that L w is non-expansive, if for every s, t in the same equivalence class E, for any state-context C ∈ C(E → E ), it holds that:

δ L w E (C[s], C[t]) ≤ δ L w E (s, t).
We now equip our WLTs L (Λ ≤1 ⊕ ) with state-contexts: in this case, a state-context is simply a context of the language Λ ≤1 ⊕ . Recall that here the states are sub-distributions over Λ ≤1 ⊕ -programs; in this setting, applying a context to a state consists in applying it to all the programs in the support of the sub-distribution. We have however to be careful, because we have two equivalence classes in E (L (Λ ≤1 ⊕ )): the class E P , that contains those states that are sub-distributions over programs, and the class E V that contains those states that are sub-distribution over distinguished values. It means that when considering C(E P → E V ), we keep only the Λ ≤1 ⊕ contexts that return always a value-even when they are filled by a program that is not a value. We sum up these considerations in Definitions 8.3.5 and 8.3.6 below. Definition 8.3.5 For every pair (E 1 , E 2 ) of equivalence classes in E (L (Λ ≤1 ⊕ )), we define the set of state-contexts with input E 1 and output in E 2 -denoted C(E 1 → E 2 )-as follows:

• If E 2 = E P , C(E 1 → E 2 ) := CΛ ≤1 ⊕ ; • If E 1 = E 2 = E V , C(E 1 → E 2 ) := {C ∈ CΛ ≤1 ⊕ | C = [•] ∨ C = λx.D}; • If E 1 = E P , and E 2 = E V , C(E 1 → E 2 ) := {C ∈ CΛ ≤1 ⊕ | C = λx.D}.
We now formalize what happens when we fill a L (Λ

= s if E 1 = P, or D such that D = s, if E 1 = V. Let C be a state-context in C(E 1 → E 2 )
. We define the state C[s] in E 2 as follows:

• if E 2 = P, we take C[s] = M D(M ) • {C[M ] 1 }; • if E 2 = V, we take C[s] = M D(M ) • { C[M ] 1 };
In Proposition 8.3.4 below, we show that our approach is valid, in the sense that as soon as we are able to show that L (Λ ≤1 ⊕ ) is non-expansive, it also holds that the trace distance on Λ ≤1 ⊕ -programs is non-expansive.

Proposition 8.3.4 We suppose that the non-expansiveness property holds for L (Λ ≤1 ⊕ ), equipped with state-contexts as specified in Definitions 8.3.5 and 8.3.6. Then the trace metric δ tr

Λ ≤1 ⊕ on Λ ≤1
⊕ programs is non-expansive.

Proof. Let M , N be two Λ ≤1 ⊕ -programs, and C a context in Λ ≤1 ⊕ . Then C can also be seen as a state-context in C(E P → E P ). Since the WLTS L (Λ ≤1 ⊕ ) is non expansive, we obtain that: δ

L (Λ ≤1 ⊕ ) E P (C[s M ], C[s N ]) ≤ δ L (Λ ≤1 ⊕ ) E P (s M , s N ). Observe that moreover, C[s M ] = s C[M ] and similarly C[s N ] = s C[N ] .
From there, we obtain that δ

L (Λ ≤1 ⊕ ) E P (s C[M ] , s C[N ] ) ≤ δ L (Λ ≤1
⊕ ) E P (s M , s N ), and it concludes the proof. 123

Contexts Composition for Relations on States

Our objective now thus becomes to show non-expansiveness for L (Λ ≤1 ⊕ ). We see that we can reformulate the non-expansiveness for a WLTS by asking that all ε-bisimilarities must be compatible, i.e. that as soon as two states s, t are ε-bisimilar, then for every context C that can be filled with s, t, it holds that also C[s] and C[t] are ε-bisimilar. As a consequence, a first idea would be to look at the binary relation we obtain by composing R by state-contexts and to show that whenever R is an ε-bisimulation, the relation we obtain this way is also a ε-bisimulation. Let us first formalize how we compose by states-contexts a clustered-see Definition 8.

= C[s ], t = C[t ]. Observe that the relation C[R] is also a clustered relation. Moreover, if R is ε-bounded for some ε ∈ [0, 1], that is also the case for C[R].
As stated in Proposition 8.3.5 below, we are now able to re-frame our objective of proving non-expansiveness for L (Λ ≤1 ⊕ ) using the composition by contexts of a relation on states. Proposition 8.3.5 Let L w be a WLTS equipped with state-contexts. If for every εbisimulation R, there exists a ε-bisimulation S such that C[R] ⊆ S, then non-expansiveness holds for L w .

As said before, we would like to establish that composition by contexts preserves εbisimulations, i.e. that when R is a ε-bisimulation on L (Λ ≤1 ⊕ ), then C[R] itself is also an -bisimulation. This is unfortunately not the case, as we can see in Example 8.3.2 below.

Example 8.3.2 We consider the states s = {(I ⊕ Ω) 1 } and t = {I 1 }. Using these two states, we build an 1 2 -bisimulation:

R = {(s, t)} ∪ {( 1 2 • D, ∅) | D ∈ E V } ∪ {( 1 2 • D, ∅) | D ∈ E P }.
We consider now the relation C[R], and we show that it is not a 1 2 -bisimulation. We start from the context C = [•] ⊕ λx.[•]; we can see C as a state-context in C(E P → E P , hence we can fill C with s and t, and C[s] and C[t] in E P are as follows:

C[s] = (I ⊕ Ω) ⊕ λx.(I ⊕ Ω); C[t] = (Ω) ⊕ λx.(Ω).
We now look at the effect of the eval action on C[s] and

C[t]. We see that C[s] eval -→ u, C[t] eval -→ v,
where the states u, v ∈ E V are as follows:

u := 1 4 • { I 1 } + 1 2 { λx.I ⊕ Ω 1 }; v := 1 2 { λx.Ω 1 }.
We show by contradiction that

(u, v) ∈ C[R]. Indeed, let us suppose that (u, v) ∈ C[R].
Looking at the definition of C[R], we see that one among the three following statements must hold:

∃C ∈ C(E V → E V ), u = C[ 1 2 • D], v = C[ ∅] with D ∈ E V (8.1) ∃C ∈ C(E P → E V ), u = C[s], v = C[t] (8.2) ∃C ∈ C(E P → E V ), u = C[ 1 2 • D], v = C[∅] with D ∈ E P (8.3)
By looking at Definition 8.3.6 that specifies how to fill a state-context by a state in L (Λ ≤1 ⊕ ), we see that we can rewrite the cases (8.1), (8.2), (8.3) respectively as follows:

∃C ∈ C(E V → E V ), u = 1 2 V D(V ) • { C[V ] 1 }, v = ∅ with D ∈ E V ∃C ∈ C(E P → E V ), u = { C[I] 1 }, v = { C[Ω] 1 } ∃C ∈ C(E P → E V ), u = 1 2 M D(M ) • { C[M ] 1 }, v = ∅ with D ∈ E P
Since none of the three cases above holds, we obtain a contradiction.

Convex Structure for a WLTS

Recall that our goal is to find a way to build from an ε-bisimulation R, ⊕ ) with a convex structure: we use the fact that the set of finite measures-i.e. distributions-like object with weight in R + , see Definition 1.4.2 of Chapter 1-with finite support over some countable set is stable under addition and multiplication by a non-negative scalar.

a
Example 8.3.3 For E ∈ {E P , E V }, we build a cone C E as follows:

C E P := {µ finite measure over P | card(S(µ)) < ∞}; µ C = µ(P) C E V := {µ finite measure over V | card(S(µ)) < ∞}; µ C = µ( V)
We take as +, and . respectively the usual addition and multiplication by a scalar for finite measures. We can check that C E P and C E V are indeed cones, and that moreover BC E = E for E ∈ {E P , E V }. It means that this way we have indeed equipped L (Λ ≤1 ⊕ ) with a convex structure.

If L w is a WLTS equipped with a convex structure, we can define for every clustered binary relation R on states its convex closure. Definition 8.3.9 Let L w be a WLTS equipped with a convex structure. Let R be a clustered binary relation on states. We say that R is convex closed, if for every E ∈ E (L w ), for every α, β ∈ [0, 1] with α + β ≤ 1, for every s 1 , s 2 , t 1 , t 2 such that s 1 R E t 1 and

s 2 R E t 2 it holds that (α • s 1 + β • s 2 ) R E (α • t 1 + β • t 2
u = 1 2 (λx.[•])[s] + 1 2 ([•])[ 1 2 • { I 1 }]; v = 1 2 (λx.[•])[t] + 1 2 ([•])[ ∅].
Moreover it holds that both the pair (s, t) and the pair

( 1 2 • { I 1 }, ∅) ∈ R are in R, and C 1 = λx.[•] ∈ C(E V → E V ), C 2 = [•] ∈ C(E P → E P ).
As a consequence, we obtain that

u (C[R]) + v.
We look more in depth to the behavior of the convex closure: we are going to show that it leads actually to an up-to technique for WLTS. A survey of up-to reasoning on transition structures can for instance be found in [START_REF] Sangiorgi | Beyond bisimulation: The "up-to" techniques[END_REF]. The general idea is as follows: we want to show that two states are bisimilar, without going all the way to find a bisimulation that relates them. If we have a valid up-to technique, it becomes enough to show that the two states are connected by a relation which is a bisimulation up-to some operator on relation, which is a weaker requirement as being a bisimulation. With this notation, we can rewrite the ε-bisimulation requirement: R is a ε-bisimulation if and only if it is ε-bounded, and R R. In [START_REF] Sangiorgi | Environmental bisimulations for probabilistic higherorder languages[END_REF], Vignudelli and Sangiorgi studied up-to techniques for environmental bisimulations-that are equivalences defined using bisimilarity on structures similar to our WLTSs-on probabilistic λ-calculi. Here, since we are interested in distances, we look at quantitative up-to techniques, that give us proof techniques for ε-bisimulation.

Definition 8.3.11 Let L w = ((S, L, →), w) be a WLTS. We say that O an operator on L w -relations is a valid quantitative up-to technique, if every R which is a ε-bisimulation up-to O is also contained in a ε-bisimulation.

We are now going to exhibit a class of WLTSs with convex structure, such that taking the convex closure is a valid quantitative up-to technique. Definition 8.3.12 We say that a WLTS L w is equipped with a well-behaved convex structure if it is equipped with a convex structure such that:

1. ∀s, t states, and α, β with α

+ β ≤ 1, w(α • s + β • s) = α • w(s) + β • w(t).
2. for every state s that can be decomposed as s = 1≤i≤N α i • t i with α i > 0, then:

• Act(s) = Act(t i ) for every i ∈ N. • for a ∈ Act(s), it holds that v a -→ 1≤i≤N α i • u i , where the u i are defined by t i a -→ u i
We can see easily that the convex structure on the WLTS L (Λ ≤1 ⊕ )-as described in Example 8.3.3-is indeed well-behaved. Lemma 8.3.8 Let L w be a WLTS equipped with a well-behaved convex structure. If R is a ε-bisimulation then (R)

+ is also a ε-bisimulation.

Proof. The proof consists of two steps:

• if a clustered relation R is ε-bounded, then also (R) + is ε-bounded-it comes from
Condition 1 in our definition of a well-behaved convex structure;

• if R (R) + then also (R) + (R) + -it
[R]) + .
Requirements ( 1) and ( 2) are represented respectively on the right and the left part of Figure 8.1. We first show the requirement (1), that deals with the case of applicative

E P : s t C[R] s t (C[R]) + eval eval : E V s t C[R] s t C[R] V V Figure 8.1: Overview of the proof that (C[R]) + is a ε-bisimulation.
actions. The proof is based on the fact that when the environment performs an applicative action V on a state s of the form s = C[s ], it is going to trigger at most one action on the internal state s. C(E,E V ), for some E ∈ {E P , E V }. We consider separately the case where E = E V and the case where E = E P .

Lemma 8.3.10 Let s, t ∈ E V , with s C[R] t. Let V ∈ V,
• We first suppose that E = E P . It means that s and t are sub-distributions over programs, and that C is of the form C = λx.D, where D is an open context for the language Λ ≤1 ⊕ , with x as only possible free variable -see how we defined C(E → E ) in Definition 8.3.5. We now spell out what it implies for the states s and t:

s = s (M ) • {λx.D[M ] 1 }; t = t (M ) • {λx.D[M ] 1 }.
From there, we look at the effect of the applicative action V on s and t. Observe that D{V /x} ∈ C(E P → E P ); as a consequence we can fill D{V /x} by the states s and t . By looking at the transition relation in the WLTS L (Λ ≤1 ⊕ ), we can see that s

t = t.
Since R is a ε-bisimulation, and s R t , we see that s

V -→ u and t V -→ v, with u R v. Since R ⊆ C[R],
it implies that the result of Lemma 8.3.10 holds.

We have now to look at the eval action, and to show that Requirement (2) is also satisfied. This case is harder to handle that the case of applicative actions, because when the environment performs an action eval on a state of the form t = C[s ], it can trigger a variety of possible sequences of actions on the state s -depending on the form of the context C. We first look at the simple case where every program in the support of the states s, t is actually already a value: it means that the action eval for those states consists only in transforming values into distinguished values. Lemma 8.3.11 Let R be an -bisimulation on L (Λ ≤1 ⊕ ). For every s, t ∈ E P such that s (C[R])

+ t, if moreover the support of s and t consists only of values, then it also holds that

s (C[R])
+ t-where u simply refers to the distribution u where every value in the support of u has been replaced by the associated distinguished value.

Our approach to the general case is as follows: we are going to define an auxiliary operational semantics, where programs are replaced by pairs of the form (C, s), that allows us to split the action eval into a sequence of actions that have an atomic effect on s . Observe that if e = (C, s) is a (C × S)-value, then in particular all the programs in the support of C[s] are Λ ≤1 ⊕ -values. We call (C × S)-state a sub-distribution over (C × S) with finite support, and we denote S (•,•) the set of all such states. We first formalize how we can retrieve back a L (Λ ≤1 ⊕ )-state from any state in S (•,•) . Definition 8.3.14 We define the forgetful function F :

S (•,•) → S Λ ≤1 ⊕
, as follows:

F(s) := (C,t)∈(C×S) s(C, t) • C[t].
For any clustered relation R, we build the explicit composition of R by contexts, which is a binary relation on S (•,•) . It consists of simply putting side by side R-connected programs and states-contexts. . In Lemma 8.3.12 below, this observation is formalized using the forgetful function F. Lemma 8.3.12 Let R be a clustered binary relation on L (Λ ≤1 ⊕ ), and s, t ∈ S (•,•) such that s (C♦R) t. Then it holds that F(s) C[R] F(t).

(C♦R) = {({(C, s) 1 }, {(C, t) 1 }) | ∃E ∈ {E V , E P }, C ∈ C(E → E P ), s R E t}.
We want now to define an small-step operational semantics on (C × S), designed to express how we can execute-in a probabilistic way-the elements of (C × S). ⊕ is affine: indeed that N {C/x} is still a context is guaranteed by the Λ ≤1 ⊕ -affinity constraints-see Section 7.4 of Chapter 7. Observe that this one-step reduction is deadlocks-free, in the sense that for an element e ∈ (C × S), there exists D such that e -→ D if and only if e is not a (C × S)-value. We now extend this one-step reduction to elements of S (•,•) -i.e. sub-distributions over (C × S) with finite support. •) , that we call the one-step transition relation over S (•,•) , as follows: if s = i∈I p i • {e i 1 } + E where all elements in the support of E are (C × S)-values, and the e i are not (C × S)-values, and I not empty, then we define s→ We say that a state s ∈ S (•,•) is in normal form if there is no t such that s → (C×S) t. Using the fact that the calculus is affine, and that we consider only finite sub-distributions, we are able to show that the one-step reduction relation on S (•,•) is strongly normalizing, i.e. there exists a normal form. • either s is in normal form, and then all e ∈ S(s) are (C × S)-values;

Definition 8.3.17 We define → S (•,•) ⊆ S (•,•) × S (•,
S (•,•) D + i∈I p i • t i with e i → (C×S) t i . N → E CR (N C, s) → (C×S) L E (L) • {(LC, s) 1 } (C, s) a (C × S)-value N → E CL (CN, s) → (C×S) L E (L) • {(CL, s) 1 } (C, s) → (C×S) E V ∈ V SR (V C, s) τ → (C×S) D,t E (D, t) • {(V D, t) 1 } (C, s) a (C × S)-value β ((λx.N )C, s) → (C×S) {(N {C/x}, s) 1 } Div (Ω, s) → (C×S) ∅ ⊕ (C ⊕ D, s) → (C×S) 1 2 • {(C, s) 1 } + 1 2 {(D, s) 1 } s ∈ E P s eval -→ t eval ([•], s) → (C×S) {([•], t) 1 } s ∈ E V s V -→ t V ([•]V, s) → (C×S) {([•], t) 1 }
(I ⊕ [•]V, {λx.(I ⊕ Ω) 1 }) (I, {λx.(I ⊕ Ω) 1 }) (C × S)-value ([•]V, {λx.(I ⊕ Ω) 1 }) ([•]V, {λx.(I ⊕ Ω) 1 }) ([•], {(I ⊕ Ω) 1 }) ([•], 1 2 • {I 1 }) (C × S)-value 1
• or s is not in normal form, and then there exists a unique t in normal form such that s→ S (•,•) t.

Proof. We can see that the first point holds simply by looking at the rules of Figure 8. • We suppose now that the result holds as soon as c(C) = n, and we want to show it when c(C) = n + 1. We first show an intermediary result:

(C, s) → (C×S) D ⇒ either ∀(D, t) ∈ S(D), c(D) < c(C) or s ∈ E P , D = {C, t 1 } with t ∈ E V
To show this intermediary result, we do the proof by induction on the structure of the proof derivation of (C, s) → (C×S) s 2 -i.e. the first reduction step.

if the first rule applied is eval

, i.e. if C = [•],then ([•], s) → (C×S) {([•], t) 1 }, with s eval -→ t, and indeed s ∈ E P , t ∈ E V .
if the first rule applied is Div, i.e. if C = Ω, then (C, s) → (C×S) ∅, and the result holds;

if the first rule applied is CR, i.e. if C = N D, when N is not a value, we see that (C, s) if the first rule applied is SR, it means that C = V D. We apply the induction hypothesis on (D, s) → (C×S) E , and this way we obtain the result.

→ (C×S) L D(L) • {(LD, s) 1 }, with N → D. Recall that,
-If the first rule applied is β or V , we see that ((C, s)

→ (C×S) {(D, t) 1 } with c(D) < c(C).
We now use the intermediary result to conclude the proof of Lemma 8.3.13:

-We first suppose that s 2 is such that ∀(D, t) ∈ S(s 2 ), c(D) < c(C). If s 2 is actually the empty sub-distribution ∅, then the result holds since ∅ is a (C×S)-value. Otherwise, we can apply the induction hypothesis to all the e = (D, t) ∈ S(s 2 ):

for every e, there exists a reduction sequence

t e 1 = {e 1 }→ S (•,•) t e 2 . . . → S (•,•) t e Ne , with t e
Ne is a normal form. Then we see that for every n, we can rewrite s n as:

s n = e∈S(s 2 )|Ne≥n-1 •t e n-1 + e∈S(s 2 )|Ne≤n-2 •t e Ne .
Looking at the definition of → S (•,•) , we see that if the length of the sequence (t n ) is greater than N , it implies that {e | N e -1 ≥ N } must be non-empty. Since all the reduction sequences for the e ∈ S(s 2 ) are of finite length, and that S(s 2 ) is a finite set, we can conclude that the sequence (t n ) is also of finite length.

-We now suppose that the second alternative of the intermediary result holds, i.e. s ∈ E P , and (C, s) → (C×S) {C, t 1 } with t ∈ E V . Then the first alternative holds for (C, t), so we obtain the result.

We define accordingly the operational semantics for elements in (C × S).

Definition 8.3.18 Let e ∈ (C × S). We call operational semantics of e, and we denote e the sub-distribution over (C × S)-values defined as the unique state s ∈ S (•,•) in normal form such that {e 1 }→ S (•,•) s.

We extend this notation to all states in S (•,•) : if s ∈ S (•,•) , we denote s the unique normal form t such that s→ S (•,•) t. This operational semantics on S (•,•) can be connected with the operational semantics on Λ ≤1 ⊕ -programs: more precisely, executing (C, {M 1 }) is the same thing as executing the Λ ≤1 ⊕ -program C[M ], but with using a small-step reduction for C, and a big-step reduction for M . We formalize this correspondence in Lemma 8.3.14 below. Lemma 8.3.14 Let s ∈ S (•,•) . Then it holds that:

M ∈P F(s)(M ) • M = F( s ).
Proof. In order to simplify the notations, we extend the operational semantics on Λ ≤1 ⊕programs to E P , by noting t = M ∈P t(M ) • M , when t ∈ E P , i.e. t is a subdistribution over Λ ≤1 ⊕ -programs. With this notation, we can rewrite our goal as: ∀s ∈ S (•,•) , F(s) = F( s ). We show this result in two steps: We represent graphically in Figure 8.5 our proof strategy, i.e how to use the WLTS L (C×S) in order to conclude the proof of non-expansiveness for L (Λ ≤1 ⊕ ). Recall that what remains to be shown is:

s 0 t 0 C[R] s (C×S) 0 t (C×S) 0 (C♦R) s (C×S) 0 t (C×S) 0 ((C♦R)) + F ( s (C×S) 0 ) ) F ( t (C×S) 0 ) (C[R]) + F ( s (C×S) 0 ) F ( t (C×S) 0 ) (C[R]) + eval eval • • F F • •
∀s, t ∈ S Λ ≤1 ⊕ , s (C[R]) P t ⇒ u (C[R]) + V v, with s eval -→ u, t eval -→ v. (8.6)
So we fix s 0 , t 0 ∈ S Λ ≤1 ⊕ such that s 0 (C[R]) P t 0 . Our approach is as follows: we split the moves s 0 eval -→ u 0 and t 0 eval -→ v 0 into a sequence of transformations with (s 0 , t 0 ) as point of departure, and (u 0 , v 0 ) as end point.

1. In a first step, we translate our L (Λ ≤1 ⊕ )-states s 0 and t 0 into L (C×S) -states. By definition of C[R], we know that there exists E ∈ E (L (Λ ≤1 ⊕ )), s , t ∈ E, and C ∈ C(E → E P ) such that s 0 = C[s ], and t 0 = C[t ]. From there, we define s (C×S) 0 := {(C, s ) 1 }, and t (C×S) 0 := {(C, t ) 1 }. Looking at the definition of (C♦R), we can immediately see that-as represented in Figure 8.5-this transformation guarantees that the resulting pair (s

(C×S) 0 , t (C×S) 0 ) is in (C♦R).
2. Then, we take the operational semantics -as states of L (C×S) -of s (C×S) 0

, and t (C×S) 0

. For this step to work, we need to guarantee that the operational semantics preserves the relation ((C♦R))

+ , i.e. that the resulting pair of S (•,•) -elements ( s

(C×S) 0 , t (C×S) 0 ) is still in (C[R])
+ . We will prove this-which in fact consists in the core of the non-expansiveness proof -in Lemma 8.3.16 later.

3. In the third step, we go back from S (•,•) to S L (Λ ≤1 ⊕ ) , by applying the forgetful function to s .We know that the resulting pair of states is back in (C[R]) + as represented in Figure 8.5: it is an immediate consequence of Lemma 8.3.12.

4. At the end of the third step, we have states that are still in E P -i.e. sub-distributions over programs-but such that all the program in their support are actually values. We now show that the trace distance is fully-abstract, i.e. that it coincides on programs with the observational distance. Since we already know that it is sound, what remains to be shown is that it is complete, i.e.:

∀ programs M, N, δ tr Λ ≤1 ⊕ (M, N ) ≥ δ ctx Λ ≤1 ⊕ (M, N ).
Our proof is based on the testing characterization of the bisimilarity distance on a WLTS-that we presented in Proposition 8.2.4. More precisely, we show that the traces on L (Λ ≤1 ⊕ ) can be emulated by Λ ≤1 ⊕ contexts, that play a similar role to the applicative contexts we used to define the trace equivalence for CBN Λ ⊕ in Definition 4.2.1 in Chapter 4-or the Λ ⊕ -contexts we used to show completeness of the probabilistic applicative bisimilarity for CBV Λ ⊕ in Chapter 5-Observe that our construction is closer of the former than of latter, since we are using WLTSs here instead of LMCs. When we look at the set of those traces that are admissible from a state that consists in a sub-distribution over programs-that is, a state in E P -we see that:

T (E P ) = { } ∪ {eval.V 1 . . . eval.V n .eval | ∀i, V i a value} ∪ {eval.V 1 . . . eval.V n | ∀i, V i a value}.
For every trace α ∈ T (E P ), we build a context that emulates α, i.e. for every program M , Obs(C[M ]) = Prob(α ↓)(s(M )).

Definition 8.3.20 Let α be a trace in T (E P ). We define the Λ ≤1 ⊕ -context emulating α, that we denote C α , as follows:

C = [•]; C eval.V 1 ...eval.Vn.eval = [•]V 1 . . . V n ; C eval.V 1 ...eval.Vn = C eval.V 1 ...eval.V n-1 .eval
Observe that we indeed obtain Λ ≤1 ⊕ -context, since for every trace α, x C[x] is indeed a valid affinity judgment. Moreover, we can see that for any program M , and for α admissible trace from {M 1 }, it holds that: Prob({M 1 } ↓)(α) = Obs(C α [M ])-the proof is done by induction on traces, and uses the fact that all applicative actions are deterministic. From there, looking at the inductive definition of bisimulation distance for WLTS, we can show that the context distance is a lower bound on the trace distance. Proof. Let M, N be two Λ ≤1 ⊕ programs. Using the trace characterization of bisimilarity distance-Proposition 8.2.4-we see that:

δ tr Λ ≤1 ⊕ (M, N ) = sup α∈T (E P ) |Prob({M 1 } ↓)(α) -Prob({N 1 } ↓)(α)|.
If we take α ∈ T (E P ), we see now that Prob({M

1 } ↓)(α) = Obs(C α [M ]), while Prob({N 1 } ↓ )(α) = Obs(C α [N ]
). Now we observe that by definition of the observational distance it holds that:

|Obs(C α [M ]) -Obs(C α [N ])| ≤ δ ctx Λ ≤1 ⊕ (M, N ).
Since it is true for every trace α ∈ T (E P ), it implies that δ tr

Λ ≤1 ⊕ (M, N ) ≤ δ ctx Λ ≤1 ⊕ (M, N ),
which shows the result.

When we combine this completeness result with the soundness result from Theorem 8.3.20, we obtain that the trace distance and the observational distance coincide on Λ ≤1 ⊕ -programs. 8.3.8 ε up-to composition by contexts and convex sums.

We have shown already that taking the convex closure is a valid quantitative up-to technique. We want now to study a more involved up-to technique, in the aim of generalizing to the quantitative case the up-to-contexts line of reasoning, that is a regular occurrence in the study of higher-order programming languages. Since we work in a probabilistic affine setting, we need to combine up-to contexts with up-to convex closure: more precisely, we are going to show that the operator R → (C[R])

+ is a valid quantitative up-to technique.

First, we can see that this operator preserves ε-boundedness. Recall that in the course of the non-expansiveness proof, we have shown that:

R R ⇒ C[R] (C[R]) + .
This statement is however weaker than what we need to show now, that is:

R (C[R]) + ⇒ C[R] (C[R]) + .
The proof follows roughly the same path as the non-expansiveness proof. We consider separately the applicative actions and the eval action: we deal with the first ones in Lemma 8. [START_REF] Abramsky | Computational interpretations of linear logic[END_REF]

∈ E (L (Λ ≤1 ⊕ )), (s , t ) ∈ R E , C ∈ C(E → E V ) such that s = C[s ] and t = C[t ].
We distinguish two cases:

• either C is of the form λx.D, and then u = D[s ]{V /x}, and v = D[t ]{V /x}, and we see that the result holds.

• or C = [•], and it implies that E = E V . In this case, we see that s

V -→ u, t V
-→ v and from there we can conclude using the hypothesis on R.

We want now to show the counterpart of Lemma 8.3.23 for the action eval. In this end, we need once again to use the WLTS L (C×S) . The main idea is as follows: as in the proof of non expansiveness, we reduce step-by-step an element in (C × S) of the form (C, s), with s a L (Λ ≤1 ⊕ )-state, but we now allow ourselves to also rearrange the L (C×S) -state as each step of the reduction. Essentially, a rearrangement is a change in the way we split the underlying global L (Λ ≤1 ⊕ )-state between a context and a program.

Definition 8.3.21 Let S be a clustered relation on L (Λ ≤1 ⊕ ), and (s, t) a pair of L (C×S)states in (C♦S) such that there exist:

• I a finite set, a family (E i ) i∈I over E (L (Λ ≤1 ⊕ ))
, and a family (C i ) i∈I over statescontexts such that C i ∈ C(E i → E P );

• for every i, a finite set J i , a family (F i,j ) j∈I j over E (L (Λ ≤1 ⊕ )), and a family (D i,j ) j∈I j over C(F i,j → E i ); such that the L (C×S) -states s and t can be written as follows:

s = i∈I α i • {(C i , s i ) 1 }; ∀i ∈ I, s i = j∈J i β i,j • D i,j [s i,j ]; s i,j ∈ F i,j ; t = i∈I α i • {(C i , t i ) 1 }; ∀i ∈ I, t i = j∈J i β i,j • D i,j [t i,j ]; t i,j ∈ F i,j ; with ∀i ∈ I, (w(s i ) = 0 ∧ w(t i ) = 0) implies J i = ∅.
Then we say that the pair of states (u, v) is a meaningful rearrangement for the pair (s, t), where u, v are defined as:

u := i∈I,j∈J α i • β i,j • {(C i [D i,j ], s i,j ) 1 } v := i∈I,j∈J α i • β i,j • {(C i [D i,j ], t i,j ) 1 }
Observe that rearranging does not change the underlying global L (Λ ≤1 ⊕ )-state, that can be retrieved by the forgetful function F: whenever (u, v) is a rearrangement of (s, t), it holds that F(s) = F(u), and F(t) = F(v). We can also observe that if s, t are both in normal form, then it is also the case that u and v are in normal form. Moreover, rearranging is exactly what is needed to go back to ((C♦R))

+ when we start from two states (u, v) + t. Then there exists (u, v) a meaningful rearrangement of (s, t) such that u ((C♦R))

obtained as s τ -→ u, t τ -→ v with (s, t) ∈ ((C♦R)) + ,
+ v.

We represent our proof technique in Figure 8.6. The idea is that-similarly to what we have done in the non-expansiveness proof-we start with two L (C×S) -states that are in (C♦R). Then, we reduce these two states step-by-step in parallel, and at each step we rearrange them in order to force them to go back in ((C♦R)) + . In Lemma 8.3.25 below, we

show that this process indeed terminates-i.e. we reach S (•,•) -elements that are in normal form-and then in Lemma 8.3.26, we will show that by using F we can indeed retrieve from those normal forms the L (Λ ≤1 ⊕ )-states produced by the action eval.

Lemma 8.3.25 Let S be any clustered relation, and (s, t) ∈ (C♦S). Then there exists no pair of infinite sequences (u n ) n∈N , (v n ) n∈N over S (•,•) such that:

1. u 0 = s, v 0 = t; 2. if i is odd, u i → S (•,•) u i+1 and v i → S (•,•) v i+1 ; 3. if i is even, (u i+1 , v i+1 ) is a meaningful rearrangement of (u i , v i ).
Proof. Observe that we had to show in Lemma 8. where is-val(s) = 0 if s ∈ E V , 1 if s ∈ E P ; and height(s) = sup M ∈S(s) height(M ) with height(M ) the number of symbols in M . We now associate to each pair s, t ∈ S (•,•) a element in N 3 , by taking

p(s, t) = sup{p(C, s ) | (C, s ) ∈ (S(s) ∪ S(t)) not a (C × S)-value},
where the sup is taken with respect to the lexicographical order on N 3 . We first show the following auxiliary result: if (s n , t n ) n∈N is a sequence such that Conditions 1, 2, 3 hold, then:

1. if i is odd-i.e. there is a step of reduction in L (C×S) -then p(s i+1 , t i+1 ) < p(s i , t i ),

2. if i is even-i.e. the step consists in a rearranging-then p(s i+1 , t i+1 ) ≤ p(s i , t i ).

From this auxiliary result, we will be able to conclude since there can't be any infinite decreasing sequence in N 3 equipped with the lexicographical order. We now show that our auxiliary result indeed holds:

• We first show item 2. We can see by looking at the definition of rearrangement that if p(s i , t i ) = (α, β, γ), then the first component of p(s i+1 , t i+1 ) is also α-since a rearranging cannot change F(s i ), F(t i ). We then see that γ can increase only when β decreases, and that β cannot increase, and we have the result.

• We then show item 1. To do that, we see-by looking at the rules of Figure

F(v N ) = F(s) .
Proof. The proof is similar to the one we did when showing validity for the operational semantics on (C × S).

We are now ready to show the counterpart of Lemma 8.3.23 for the action eval.

(Λ ≤1 ⊕ ), such that R (C[R]) + .
Then it holds that, for every s, t such that s C

[R] E P t, u (C[R]
)

+ E V v,
with u, v defined by s + , there exists a pair of sequences (u n ) 1≤n≤N , (v n ) 1≤n≤N over the states of L (C×S) such that:

• u 0 = {(C, s ) 1 }, v 0 = {(C, t ) 1 }, and if i is odd, u i → (C×S) u i+1 , v i → (C×S) v i+1 , while if i is even, (u i+1 , v i+1 ) is a meaningful rearrangement of (u i , v i ).
• N is even, and one among the u N , v N is in normal-form for → (C×S) ;

• if i is even, (u i , v i ) ∈ ((C♦(C[R]) + )) + ; if i is odd, (u i , v i ) ∈ ((C♦R)) + .
Observe that we can indeed suppose that one among u N , v N is in normal form, because otherwise we could do one more step → (C×S) . It means that we can apply Lemma 8.3.26, that tells us: F(u N ) = u, and F(v N ) = v. We moreover know that (u N , v N ) ∈ ((C♦R)) + , so when we apply the forgetful function to this pair, we end up in (C[R])

+ , i.e. it means that (F(u N ), F(v N )) ∈ (C[R]) + .
We are now able to conclude by using Lemma 8. + is a valid up-to technique on the WLTS L (Λ ≤1 ⊕ ).

s 0 t 0 C[R] s (C×S) 0 t (C×S) 0 (C♦R) u 1 v 1 ((C♦(C[R]) + )) + u 3 v 3 ((C♦(C[R]) + )) + . . . . . . u 2 v 2 ((C♦R)) + u N v N ((C♦R)) + Normal Forms F (u N ) F (v N ) (C[R]) + F (u N ) F (v N ) (C[R]) + eval eval τ τ τ τ F F • • Figure 8.6: Proof Scheme for validity of the up-to technique R → (C[R]) + .
Proof. Recall that since we know already that taking the convex closure is a valid up-to technique, it is enough to show that:

R (C[R]) + ⇒ C[R] (C[R]) + .
So we take R such that R (C[R]) + . Lemma 8.3.23 and Lemma 8.3.27 tell us that the right-hand side holds.

We now illustrate how the up-to techniques we have just developed help us to compute the trace distance between Λ ≤1 ⊕ -programs. Example 8.3.5 Consider, as an example, a sequence of terms (M n ) n∈N defined inductively as follows:

M 0 = λx.Ω; N 0 = λx.Ω; M n+1 = λy.(yM n ); N n+1 = λy.(y(N n ⊕ 1 2 n+1 Ω)).
We define α N := 1≤i≤N (1 -1 2 N ). Our goal is to show that the trace distance between M N and N N is smaller or equal to (1 -α N ). To do that, we fix N ∈ N, and we build a (1 -α N )-bisimulation up-to closure by oriented contexts. We first define a sequence (β N ) 0≤i≤N of non-negative real numbers in [0, 1], by: β N = 1, and

β N i = N j=i+1 (1 -1 2 j ).
From there, we take as ε-bisimulation candidate the reflexive closure of:

R N ={({M N 1 }, {N N 1 })} ∪ {({ M i 1 }, β i • { N i 1 }) | 0 ≤ i ≤ N } ∪ {({M i 1 }, β i+1 • { N i ⊕ 1 2 i+1 Ω 1 }) | 0 ≤ i ≤ N -1}.
several copies of the same program. In this chapter, we build accordingly an applicative WLTS for Λ ! ⊕ and thus define the trace distance for Λ ! ⊕ , using the bisimilarity distance on this WLTS. We then show that this trace distance is fully abstract with respect to the observational distance for Λ ! ⊕ . The work in this section has been published in a joint paper with Ugo Dal Lago [START_REF] Crubillé | Metric reasoning about \lambda -terms: The general case[END_REF]. A long version of this paper can be found in [START_REF] Crubillé | Metric reasoning about λ-terms: The general case (long version)[END_REF]. It contains in particular the details of the non-expansiveness proof, which is similar-while more involved-to the non-expansiveness proof for the affine calculus Λ ≤1 ⊕ , and that we will not recall in full details in the present thesis.

Some Useful Terminology and Notation

In this section, we will make heavy use of sequences of terms and types. It is thus convenient to introduce some terminology and notation about them.

A finite (ordered) sequence whose elements are e 1 , . . . , e n will be indicated as e = [e 1 , . . . , e n ], and called an n-sequence. Metavariables for sequences are boldface variations of the metavariables for their elements. Whenever E = {i 1 , . . . , i m } ⊆ {1, . . . , n} and i 1 < . . . < i m , the sub-sequence [e i 1 , . . . , e im ] of an n-sequence e will be indicated as e E . If the above holds, E will be called an n-set. If e is an n-sequence, and I is a permutation on {1, . . . , n}, we note e I the n-sequence [e I(1) , . . . , e I(n) ]. We can turn an n-sequence into an (n + 1)-sequence by adding an element at the end: this is the role of the semicolon operator. We denote by [e n ] the n-sequence in which all components are equal to e. We denote by 0 the unique 0-sequence-i.e. the empty sequence.

Whenever this does not cause ambiguity, notations like the ones above will be used in conjunction with syntactic constructions. For example, if σ is an n-sequence of types, then !σ stands for the sequence [!σ 1 , . . . , !σ n ]. As another example, if σ is an n-sequence of types and E is an n-set, then x E : σ E stands for the environment assigning type σ i to x i for every i ∈ E. As a final example, if M is an n-sequence of terms and σ is an n-sequence of types, M : σ holds iff M i : σ i is provable for every i ∈ {1, . . . , n}.

The WLTS L (Λ ! ⊕ ).

Our first building block towards formalizing what the states of L (Λ ! ⊕ ) are is the notion of a tuple: a tuple element consists in two sequences of programs, where the programs in the first sequence are non-evaluated programs meant to be duplicable, while programs in the other one are not allowed to be copied. We now equip tuple elements with types, in order to be able to control the type of each program contained in the tuple. Moreover, we design typing judgments for tuples which specify that the programs that appear at some fixed indexes in the linear part of the tuple must be Λ L (Λ ! ⊕ ) has applicative and evaluation actions. However, it has also two other kinds of actions, called storing actions and Milner's actions, that are designed to track more closely the copying phenomenon. All these actions are type directed in the sense that when we consider some state s = (D, A) ∈ S M ! ⊕ , the ability of the environment of performing an action a depends only on the type A, and similarly the type we will obtain after having done the action a depends also uniquely on A. Similarly, the actions respect the convex structure of the states, in the sense that the effect of a on (D, A) can be recovered-in the natural way-from the action of a on the ({K 1 }, A) for all K ∈ S(D). As a consequence, our approach to define the transition relation for the WLTS L (Λ ! ⊕ ) is as follows: for each kind of action, we first specify the effect those actions have on types-i.e. for each action a of this kind, we give a relation a -→ ⊆ T × T-and then we specify the effect they have on atomic states -i.e. we give a relation

a -→ ⊆ T × S Λ ! ⊕ .
From there, we will put back everything together, and we will define the full transition relation in Definition 8.4.18.

Evaluation Actions

We first define the counterpart of the eval action for L (Λ ≤1 ⊕ ). The base principle is that only programs in the linear part of the tuple can be evaluated: this reflects the fact that in the operational semantics of Λ ! ⊕ , no reduction can take place inside !-boxes. Observe that a major difference with the WLTS L (Λ ≤1 ⊕ ), or the applicative WLTSs for Λ ⊕ , is that a state can now contain possibly more than one non-evaluated program available to the environment. It means that the environment must choose to which one of those programs he wants to apply an evaluation action. It must be a program that has not been already evaluated, i.e. it must be typed by a τ ⊥ ; after the evaluation, the tuple type will be updated to indicate that the program has been evaluated. Definition 8.4.6 (Evaluation Actions on Types) We define the transition reduction at type level for evaluation actions:

eval i -→ ⊆ T × T by: (σ, τ ) eval i -→ (σ, τ {1,...,i-1} ; τ i ; τ {i+1,...,n} ) when τ i = τ ⊥ i .
If A is in the domain of

eval i
-→ , we say that eval i is an admissible action on A.

Definition 8.4.7 Let i ∈ N. We define

eval i -→ ⊆ T × S Λ ! ⊕
-that we call atomic transition relation for the action eval i -as follows: if k = (K, A) ∈ T such that eval i is an admissible action for A, we say that eval i is an admissible action for k, and we define:

k eval i -→ ( V N i (V ) • {(M , N {1,...,i-1} ; V ; N {i+1,...,n} ) 1 }, B),
where the sequences M , N are such that K = (M , N ), and

A eval i -→ B.

Storing Actions

We introduce now the storing actions: it corresponds to the environment choosing a term of the form !M from the linear part of the underlying tuple, unboxing it and transferring the content to the exponential part of the tuple. Observe that for specifying such an action, it is sufficient to give the index corresponding to the position of the program that we want to unbox. We will denote (? i ) the corresponding label, so we define:

A ? := {(? i ) | i ∈ N}.
Definition 8.4.8 (The Storing Action on Types) Let A = (σ, τ ) be a tuple type. We say that (? i ) is an admissible action at the type A if ∃ι with τ i =!ι . If it is the case, we write A

(? i )
-→ B with B = (σ; ι, τ {1,...,n}\{i} ).

Observe that whenever the action (? i ) is admissible for some type for tuple A, it holds that for every tuple K = (M , N ) of type A, the program N i must be of the form !L. This remark allows us to define the storing action on such tuple K: we remove N i of the linear part of the tuple, and we store L in the exponential part.

Definition 8.4.9 (The Storing Action on Tuple Element) Let i ∈ N. We define

(? i ) -→ ⊆ T × S Λ ! ⊕
-that we call transition relation for the action (? i ) -as follows: if

(K, A) ∈ T is such that (? i
) is an admissible action at the type A, we say that (? i ) is an admissible action for (K, A), and we define:

(K, A) (? i ) -→ ({(M ; L, N {1,...,n}\{i} ) 1 }, B)
where B is the unique type with A

(? i ) -→ B, the sequences M , N are such that K = (M , N ), and the program L is such that N i =!L.
Please observe that this action is in fact deterministic: it means that the resulting tuple element is uniquely determined. We can see that K : A with A = ([σ] , σ ⊥ , !σ ) ∈ T. Looking at Definition 8.4.8 and Definition 8.4.9, we see that the action (? 1 ) is admissible at the type A, so the atomic transition relation

(? 1 )
-→ is admissible from (K, A), and:

(K, A) (? 1 ) -→ ({([I, Ω] , [I]) 1 }, ([σ, σ] , σ ⊥ )).

Milner's Actions

We now look at Milner's actions, that we named this way in reference to the so called Milner's law !A ≡ A⊗!A in Linear Logic. The action (! i ) takes the i-th term in the exponential part of the tuple, makes a copy of it, evaluates it and put the result into the linear part. Observe that-as storing actions-a Milner's action is entirely specified by giving the index i identifying the program. We denote (! i ) the corresponding label, and accordingly we define

A ! := {(! i ) | i ∈ N}.
Definition 8.4.10 (Milner's action on Tuple Types) Let A = (σ, τ ) be a tuple type. We say that (! i ) is an admissible action at the type A if the length of the exponential part σ is not smaller than i; when it is the case, we define A

(! i ) -→ (σ, τ ; σ i ).

⊕

We now formalize how we can fill a tuple context with a tuple element: Definition 8.4.13 Let A, B be two tuple types, and

C = L, K ∈ C(A → B). Let K = (M , N ) such that K : A. Then we define C[K] = (T , U ) ∈ TUPLES where: ∀i ∈ {1, . . . , n}, T i = L i {M /[•] ! } ∀i ∈ {1, . . . , m}, U i = K i {M /[•] ! }{N /[•]},
and n, m are such that B is a (n, m)-tuple type.

Observe that when C ∈ C(A → B), and K : A, it indeed holds that C[K] : B. Recall that our goal here is to build a value that will be passed as argument to one of the values of type σ → τ contained in the linear part of the original tuple, in order to model the environment doing an applicative action-so we need to generate a tuple that consists only of a value in the linear part. More precisely, if we fix A a tuple type, and σ a Λ ! ⊕ -type that we take as target, we have to ask for a tuple context C ∈ C(A → ( 0, σ )): indeed it guarantees that C[K] will be of the form V , with V some value of type σ, as soon as K : A. We also have to keep track of the programs in the linear part that are consumed when building the value V , hence if A is a tuple type, and E a set of indexes, we define a set C V (A → σ | E) that corresponds to all the way of generating a value when having in input a tuple of type A, and such that the only non-duplicable programs used are the ones with index in E. Definition 8.4.14 Let A = (σ, τ ) an tuple type. We denote by C

V (A → σ | E) the set of those Λ ! ⊕ -terms M -with possible free variables the [•] i and [•] ! i -such that ( 0, [M ]) ∈ C((σ, τ E ) → ( 0, σ )).
We now define the applicative actions: we need to specify which tuple type we take as starting point, the index i 0 of the non-duplicable program to which we want to pass a value as argument, and a Λ ! ⊕ -term that will be used to generate the argument. Definition 8.4. [START_REF] Bierman | What is a categorical model of intuitionistic linear logic?[END_REF] We call applicative labels the objects of the form (A, i, E, M ) where:

• A = (σ, τ ) is an tuple type, and there exists ι, υ such that τ i = (ι → υ) ;

• M is a Λ ! ⊕ -term such that M ∈ C V (A → ι | E)
, and i ∈ E. We note A @ the set of all applicative labels. We will also sometimes denote @ i A (E, M ) for the label (A, i, E, M ). An applicative action (A, i, E, M ) is admissible only when starting from the type A. After having done the action, the resulting tuple type is as follows: τ i must be replaced by υ, and all the programs in the linear part-hence usable only once-that have been used to build the argument must be removed. Definition 8.4.16 (Applicative actions on Types) Let B = (σ, τ ) be a tuple type, and a = (A, i, E, M ) be an applicative label . We say that this label is an admissible action for the tuple type B when A = B. If it is the case, we write B a -→ (σ, τ {1,...,n}\(E∪{i}) ; υ ), with A = (σ, τ ), and υ the Λ ! ⊕ -type such that τ i = (ι → υ) . Definition 8.4.17 (Applicative actions on Tuple elements) Let a = (A, i, E, M ) be an applicative label. We define a -→ ⊆ T × S Λ ! ⊕ as follows: for every (K, A) ∈ T such that a is admissible for A, we take:

(K, A) a -→ ( V W i (M [K]) (V ) • {(M , N {1,...,n}\(E∪{i}) ; V ) 1 }, B).
where B is the unique type with A a -→ B, the sequences M , N are such that K = (M , N ).

⊕

Definition of the WLTS

We are now ready to define the applicative WLTS for Λ ! ⊕ . Our definition is based on the atomic transition relations a -→ that we have defined for evaluation actions, storing actions, Milner's actions, and applicative actions respectively in Definitions 8.4.7, 8.4.9, 8.4.11 and 8.4.17. We also add actions indexed by tuple types, in order to be always able to distinguish between two explicitly typed tuples with distinct types. Definition 8.4.18 We define the applicative WLTS for Λ

! ⊕ as L (Λ ! ⊕ ) = (S Λ ! ⊕ , L Λ ! ⊕
, → , w) where:

• S Λ ! ⊕ is as defined in Definition 8.4.4; • L Λ ! ⊕ := {eval i | i ∈ N} ∪ A ! ∪ A ? ∪ A @ ∪ A TUPLES ;
• The transition relation is defined as follows: if s = (D, A), then an action a is admissible for s if:

or a = A, and then s

A -→ s. -or a ∈ {eval i | i ∈ N} ∪ A ! ∪ A ? ∪ A @ ,
and the action a is admissible at the type A. Then:

s a -→ ( K∈D D(K) • E K , B),
where B is defined by A a -→ B, and for every K ∈ S(D), D K is defined by

(K, A) a -→ (E K , B). • w(D, A) = |D|.
Example 8.4.5 We give in Figure 8.8 a fragment of L (Λ ! ⊕ ), designed to illustrate our definitions. We consider programs of the form M ε =!(Ω ⊕ ε I), for ε ∈ D. We type those programs with the recursive type σ := µα.(!α →!α): recall that it means that σ =!σ →!σ. We look at the effect of some of the actions that can be triggered by the environment when starting from the state:

s !σ (M ε ) = ({( 0, [M ε ]) 1 }, 0, !σ ⊥ ).

The Trace Distance for Λ !

⊕

Our goal now is to use the WLTS L (Λ ! ⊕ ) to build a distance on Λ ! ⊕ -programs, as we have done for the affine language Λ ≤1 ⊕ with L (Λ ≤1 ⊕ ). We first look at which states of L (Λ ! ⊕ ) are comparable: we have to find the equivalence classes for R 1

L (Λ ! ⊕ ) .
As stated in Lemma 8.4.1 below, these equivalence classes are obtained by taking all states with the same underlying tuple type. Lemma 8.4.1 For every tuple type A, we define

E A := {s ∈ S Λ ! ⊕ | ∃D, s = (D, A)}. Then E (L (Λ ≤1 ⊕ )) = {E A | A ∈ T, E A = ∅}.
Definition 8.4. [START_REF] Breuvart | On higher-order probabilistic subrecursion[END_REF] We define the applicative trace distance as the distance on Λ ! ⊕ programs (δ tr

Λ ! ⊕ ) σ : P σ × P σ → [0, 1] taken as: (δ tr Λ ! ⊕ ) σ (M, N ) := δ L (Λ ! ⊕ ) E σ (s σ (M ), s σ (N )). s !σ (Mε) {( 0, !(Ω ⊕ ε I)) 1 }, ( 0, !σ ) {([Ω ⊕ ε I] , 0) 1 }, ([σ] , 0) ε • {([Ω ⊕ ε I] , [I]) 1 }, ([σ] , σ ) (ε 2 • {[Ω ⊕ ε I] , [I, I] 1 }), ([σ] , σ , σ ) (ε • {([Ω ⊕ ε I] , [V ]) 1 } , ([σ] , !σ )) with V :!σ (ε • {([Ω ⊕ ε I] , [!(Ω ⊕ ε I)]) 1 }, ([σ] , !σ ) since ![•] ! 1 :!σ ![•] ! 1 :!σ eval 1 (? 1 ) (! 1 ) (! 1 ) @ 1 ([σ],[σ ]) (∅, V ) @ 1 ([σ],[σ ]) (∅, ![•] ! 1 ) Figure 8.8: A Fragment of L (Λ ! ⊕ )
Example 8.4.6 Recall that the two Λ ≤1 ⊕ -programs (Ω ⊕ ε 1 I) and (Ω ⊕ ε 2 I) are at observational distance |ε 1 -ε 2 | -as we can see easily for instance using the characterization by traces of the observational distance for Λ ≤1 ⊕ . We want now to look at what happens when we are allowed to duplicate these programs, so we consider the family of Λ ! ⊕ -programs M ε := !(Ω ⊕ ε I) for ε ∈ D that we introduced in Example 8.4.5. We fix any type τ , and define σ = τ → τ ; we can see that M ε :!σ. In the present Example, we show-again by using a characterization by traces-that:

(δ tr Λ ! ⊕ ) σ (M ε 1 , M ε 2 ) ≥ sup n∈N |ε n 1 -ε n 2 |. Indeed, observe that s( M ε :!σ) = ({( 0, [!(Ω ⊕ ε I)]) 1 }, ( 0, !σ ⊥ )).
Let us now consider, for every n ∈ N, the trace α n = eval 1 • (? 1 ) • (! 1 ) n . For every ε ∈ [0, 1], the execution of the trace α n starting from s Mε := s( M ε :!σ) is as follows: s Mε

eval 1 → t (? 1 ) → s 0 (! 1 ) →. . . (! 1 )
→s n with:

t = ({( 0, [!(Ω ⊕ ε I)]) 1 }, ( 0, !σ )) s i = (ε i • {([Ω ⊕ ε I] , [I, . . . , I]) 1 }, ([σ] , σ , . . . , σ ));
As a consequence, we see that Prob(s Mε ↓)(α n ) = ε n , which allows us to conclude that:

(δ tr Λ ! ⊕ ) !σ (M ε 1 , M ε 2 ) ≥ sup n∈N |Prob(s Mε 1 ↓)(α n ) -Prob(s Mε 2 ↓)(α n )| = sup n∈N |ε n 1 -ε n 2 |.
We will show later-using an up-to technique combining contexts and convex closure-that the other inequality also holds.

Our first correctness criterion for a distance on programs is that it should be observationally correct, in the sense of Definition 8.1.3, i.e. that the distance should distinguish at least as much as the context [•], that simply executes the program it receives as input. As we show in Proposition 8.4.2 below, it is indeed the case for the trace distance on Λ ! ⊕ that we have just defined. ) σ , and rewrite the observational correctness requirement using the trace distance on L (Λ ! ⊕ ). It becomes:

δ L (Λ ! ⊕ ) E σ (s σ (M ), s σ (N )) ≥ |Obs σ (M ) -Obs σ (N )|.
We are going to use the characterization by traces of distance bisimilarity. Observe first that w(s σ (L)) = Obs σ (M ) for every L with L : σ. Then we see that the empty trace is admissible for every state s, and besides w(s) = Prob(s ↓)(α), hence we can conclude:

δ L (Λ ! ⊕ ) E σ (s σ (M ), s σ (N )) ≥ |Prob(s σ (M ) ↓)( ) -Prob(s σ (N ) ↓)( )| = |w(s σ (M )) -w(s σ (N ))| = |Obs σ (M ) -Obs σ (N )|.

Full Abstraction

The proofs of soundness and non-expansiveness for the trace distance on Λ ! ⊕ follow the same path as the ones for the Λ ≤1 ⊕ trace distance-that we have presented in details in Section 8.3.1. We give here the main steps, but a complete proof can be found in [START_REF] Crubillé | Metric reasoning about λ-terms: The general case (long version)[END_REF]. We first equip the WLTS L (Λ ! ⊕ ) with state-contexts-in the sense of Definition 8.3.3-since we want to be able to express non-expansiveness as a property of the WLTS L (Λ ! ⊕ ). To do this, we use the tuple-contexts that we have build in Definition 8.4.12: recall that for every pair of tuple types A, B, we called C(A → B) the set of tuple context with A as point of departure, and B as target. Here, we need to define sets of state-contexts

C(E 1 → E 2 ) for every pair E 1 , E 2 of equivalence classes in E (L (Λ ! ⊕ )). Recall that we have shown in Lemma 8.3.2 that E (L (Λ ! ⊕ )) = {E A | A ∈ T},
C[s] := ( K D(K) • {C[K] 1 }.
Any context for the programming language Λ ! ⊕ can also be seen as a state-context: we state this formally in Remark 8.4.1 below.

Remark 8.4.1 For every Λ ! ⊕ -program M of type σ, and C a Λ ! ⊕ -context such that [•] : σ C : τ . Then C = ( 0, [C{[•] 1 /[•]}]) is a state-context in C(E σ → E τ )
. By abuse of notation, we will again note C for the state-context C . Observe that with these notation, for every program

M of type σ, s τ (C[M ]) = C[s σ (M )].
We first show that proving non-expansiveness for the WLTS L (Λ ! ⊕ ) is a valid approach to show non-expansiveness of the trace distance on the programming language Λ ! ⊕ . Proposition 8.4.3 If the WLTS L (Λ ! ⊕ ) equipped with state-contexts as specified in Definition 8.4.12 is non-expansive, then the trace distance on Λ ! ⊕ is also non-expansive.

⊕

Proof. Let M, N be two Λ ! ⊕ -programs of type σ, and C a Λ ! ⊕ -context such that [•] : σ C : τ . To prove non-expansiveness of the trace distance, we need to show: δ

L (Λ ! ⊕ ) E τ (s τ (C[M ]), s τ (C[N ])) ≤ δ L (Λ ! ⊕ ) E σ
(s σ (M ), s σ (N )). Using Remark 8.4.1, we are able to rewrite our objective as:

δ L (Λ ! ⊕ ) E τ (C[s σ (M )], C[s σ (N )]) ≤ δ L (Λ ! ⊕ ) E σ
(s σ (M ), s σ (N )). We see that the latter statement holds as soon as the WLTS L (Λ ! ⊕ ) is non-expansive, which concludes the proof.

The path to show non-expansiveness for the WLTS L (Λ ! ⊕ ) is broadly similar to the one we followed when showing non-expansiveness of the WLTS L (Λ ≤1 ⊕ ). The first step consists in equipping L (Λ ! ⊕ ) with a convex sum operator. As for L (Λ ≤1 ⊕ ), our construction here is based on the fact that finite measure are a cone: if s = (D, A) and t = (E , A) are two states in E A , we can take α•s+β •t := (α•D +β •E , A). It means that we can consider the convex closure of any clustered relation on states, as defined in Definition 8.3.9. Moreover, we can see that the convex structure L (Λ ! ⊕ ) is well-behaved, in the sense of Definition 8.3.12: as a consequence, using Proposition 8.3.9, we see that taking the convex closure is a valid up-to technique. However, there is a major difference with L (Λ ≤1 ⊕ ), that essentially comes from the fact that Λ ≤1

⊕ is an affine calculus, hence the operational semantics of a Λ ! ⊕ -program has always finite support. It is not the case here for Λ ! ⊕ , and as illustrated in Example 8.4.7 below, it implies that we cannot replicate the main component of the non-expansiveness proof for Λ ≤1 ⊕ -the fact that as soon as R is a ε-bisimulation, it is also the case of (C[R]) + .

Example 8.4.7 We fix σ = σ cbn → σ cbn -where σ cbn is the type for the encoding of CBN Λ ⊕ into Λ ! ⊕ , that we defined in Chapter 7-, and we build a 1 2 -bisimulation on L (Λ ! ⊕ ) as follow:

R = {(s σ (Ω), s σ (I ⊕ Ω))} ∪ {(∅, A), ( 1 2 • D, A) | (D, A) ∈ S Λ ! ⊕ }.
We are now going to build a particular context C in C(E σ → σ), such that it is not the case that

(C[s σ (Ω)], C[s σ (I ⊕ Ω)]) (C[R]) + .
To do this, we are going to use the program

L ∈ Λ ⊕ -that
⊕ is L = ∞ 1≤n 1 2 n • {n 1 },
where n is the n-th Scott natural number. We look at the encoding of L in Λ ! ⊕ , and we denote again n for the encoding of n in Λ ! ⊕ . We now consider the Λ ! ⊕ -context C = λx.(λy.[•]x)L, and we transform it into a tuple context by taking as usual ( 0,

[C{[•] 1 /[•]}]).
We denote again C this state-contexts, and we see that C ∈ C( σ → σ). We see that:

C[s σ (M )] = ({( 0, [C[Ω]]) 1 }, σ) eval 1 -→ s = n∈N 1 2 n • { 0, [λy.(Ωn)] 1 }, ( 0, σ ) C[s σ (N )] = ({( 0, [C[I ⊕ Ω]]) 1 }, σ) eval 1 -→ t = n∈N 1 2 n • { 0, [λy.((I ⊕ Ω)n)] 1 }, ( 0, σ ) But we can see now that (s, t) ∈ (C[R]) + , hence (C[R]) + is not a 1 2 -bisimulation.
This problem comes from the fact that the probabilistic execution tree of a Λ ! ⊕ -program can have infinite branches. To overcome this, we define the closure of a relation up-to infinite convex sum. We first need to add additional structure to a WLTS equipped with a convex structure, in order to be able to talk about infinite sum of states. Definition 8.4.21 We say that a WLTS L w is equipped with a countable convex sum operator, if it is equipped with a convex structure, and that moreover for every E ∈ E (L w ), the cone C E is sequentially complete-in the sense of Definition 11.1.1 in Chapter 9.

The completeness requirement on cones guarantee that, if (s n ) n∈N is a sequence in E for some E ∈ E (L w ), such that all the terms of the increasing sequence t N = n≤N s n are still in E, then the sequence (t N ) N ∈N has a supremum in E, that we denote by n∈N s n . Definition 8.4.22 Let L w be a WLTS equipped with a countable convex sum convex operator. Let R be a clustered binary relation on states. We call closure of R by infinite convex sum, and we denote (R) the clustered relation defined as: for every E ∈ E (L (Λ ! ⊕ )):

∀(s n ) n∈N , (t n ) n∈N sequences over E, ∀(p n ) n∈N with p i ≤ 1, (∀n ∈ N, s n R t n ) ⇒ ( n∈N p n • s n ) (R) ( n∈N p n • t n ).
The key of our non-expansiveness proof is that the operator R → (C[R]) preserves εbisimulation on the WLTS L (Λ ! ⊕ ). The proof of this result-that can be found in [START_REF] Crubillé | Metric reasoning about λ-terms: The general case (long version)[END_REF]-is similar to the one we did to show that R → (C[R])

+ preserves ε-bisimulation on L (Λ ≤1 ⊕ ), but more involved, since we need to deal with approximation semantics.

Proposition 8.4.4 Let R be a ε-bisimulation on L (Λ ! ⊕ ). Then (C[R]) is also an ε- bisimulation. Since C[R] ⊆ (C[R]) , Proposition 8.4.4 tells us that the WLTS L (Λ ! ⊕ ) is non-expansive.
Theorem 8.4.5 The WLTS L (Λ ! ⊕ ), equipped with state-contexts as specified in Definition 8.4.12, is non-expansive.

As a consequence, we obtain using Proposition 8.4.3 that the trace distance on Λ ! ⊕ is non-expansive. Theorem 8.4.6 (Non-Expansiveness) The trace distance on Λ ! ⊕ is non-expansive.

Since we have shown that the trace distance on Λ ! ⊕ is both observationally correct and non-expansive, we can now use Proposition 8.1.1, and concludes that it is sound with respect to observational distance. We can also prove completeness of the trace distance, by using the inductive characterization of the bisimilarity distance on the WLTS L (Λ ! ⊕ ). Similarly to the Λ ≤1 ⊕ case, the proof-that can be found in [START_REF] Crubillé | Metric reasoning about λ-terms: The general case (long version)[END_REF]-is based on building contexts design to emulate traces. By combining completeness with soundness, we obtain full-abstraction as stated in Theorem 8.4.7 below. Theorem 8.4.7 (Full Abstraction) For every σ, for every program M, N of type σ, it holds that:

(δ tr

Λ ! ⊕ ) σ (M, N ) = (δ ctx Λ ! ⊕ ) σ (M, N ).

Up-to techniques on the applicative WLTS for Λ !

⊕

We also looked at up-to techniques on the applicative WLTS L (Λ ! ⊕ ). A detailed account can be found in [START_REF] Crubillé | Metric reasoning about λ-terms: The general case (long version)[END_REF], we recall here only the main results. We can observe that these quantitative up-to technique are respectively the quantitative counterpart of the up-to lifting technique and up-to lifting and contexts technique that Vignudelli and Sangiorgi [START_REF] Sangiorgi | Environmental bisimulations for probabilistic higherorder languages[END_REF] develop for environmental bisimulation on Λ ⊕ .

Example 8.4.8 Recall the programs M ε := !(Ω ⊕ ε I), for ε ∈ D, that we considered in Example 8.4.6, and we fix σ any type of the form τ → τ . We have shown in Example 8.4.6-using the trace characterization of the bisimilarity distance on L (Λ ! ⊕ ) a lower bound on the trace distance between M ε 1 and M ε 2 for any ε 1 , ε 2 ∈ D:

(δ tr Λ ! ⊕ ) !σ (M ε 1 , M ε 2 ) ≥ sup n∈N |ε n 1 -ε n 2 |.
Using our up-to techniques, we are now able to show that this lower bound is also an upper bound. In order to simplify the notations, we define for every ε ∈ D, and n ∈ N ∪ {-1}, the states

s ε n ∈ L w Λ ! ⊕ as: s ε -1 = ({( 0, !(Ω ⊕ ε I) 1 }, ( 0, !σ )) s ε n = (ε n • {([(Ω ⊕ ε I)], 0) 1 }, ([σ] , 0)),
We fix ε 1 , ε 2 ∈ D, and we define the relation R as:

R = {(s !σ (M ε 1 ), s !σ (M ε 2 ))} ∪ {(s ε 1 n , s ε 2 n ) | n ∈ N ∪ {-1}} .
For any ε, We represent in Figure 8.9 the effect of all admissible actions that start from the states s !σ (M ε ) and

s ε n . We can see that R is a α-bisimulation up to R → (C[R]) , with α = sup n∈N |ε n 1 -ε n 2 |.
Since, as stated in Proposition 8.4.8, the infinite convex closure of the composition by contexts is a valid up-to technique, we obtain that:

(δ tr Λ ! ⊕ ) σ (M ε 1 , M ε 2 ) = sup n∈N |ε n 1 -ε n 2 |.
8.4.5 Trace Distance for Λ ⊕ via encoding in Λ !

⊕

In [START_REF] Crubillé | Metric reasoning about λ-terms: The general case (long version)[END_REF], we also show that our results on the trace distance for Λ ! ⊕ can be lifted back to ordinary probabilistic λ-calculi Λ ⊕ , both when call-by-name evaluation and call-by-value are considered. It is based on the embeddings of CBN and CBV Λ ⊕ into Λ ! ⊕ , that we have presented in Section 7.3 of Chapter 7. More precisely, we defined L (Λ ⊕ CBN ) and L (Λ ⊕ CBV ) two restrictions of the WLTS L (Λ ! ⊕ ) for respectively the CBN and the CBN operational semantics, by keeping only the states and action relevant in the setting of the embedding, and we showed that the trace distances obtained this way are fully abstract. It may be remarked that the WLTS obtained this way looks closely like the structure used by Vignudelli and Sangiorgi to define environmental bisimulation on CBN and CBV Λ ⊕ in [START_REF] Sangiorgi | Environmental bisimulations for probabilistic higherorder languages[END_REF]. In this sense, what we obtain in this case can be seen as a quantitative extension of the environmental bisimulation studied by Vignudelli and Sangiorgi. We actually develop our trace distance for Λ ! ⊕ roughly at the same time as Vignudelli and Sangiorgi worked on environmental bisimulation for probabilistic λ-calculi, and our common point of departure was the behavioral equivalences for Λ ⊕ developed by Dal Lago, Sangiorgi and Alberti in [START_REF] Lago | On coinductive equivalences for higherorder probabilistic functional programs[END_REF]. Our objectives were however different, since our goal was to be able to talk about distances instead of equivalences, while they were looking for a notion of applicative equivalence compatible with imperative features as the ability for programs to store data.

s !σ (Mε) s ε -1 = {( 0, [!(Ω ⊕ ε I)]) 1 }, ( 0, !σ ) s ε 0 = {([Ω ⊕ ε I] , 0) 1 }, ([σ] , 0) s ε 1 = ε • {([Ω ⊕ ε I] , 0) 1 }, ([σ] , 0) s ε 2 = ε 2 • {([Ω ⊕ ε I] , 0) 1 }, ([σ] , 0) ε • {([Ω ⊕ ε I] , [I]) 1 }, ([σ] , σ ) = C[s ε 1 ] ε 2 • {([Ω ⊕ ε I] , [I]) 1 }, ([σ] , σ ) = C[s ε 2 ] C = (( [•] ! 1 , [I])) ∈ C(([σ] , 0) → ([σ] , σ )) . . . eval 1 (? 1 ) (! 1 ) (! 1 ) (! 1 ) Figure 8.9: A Fragment of L (Λ ! ⊕ )
It is remarkable that the answer to these two problems actually happened to be similar, i.e. to look at states that track the evolution of several programs-that correspond to the program we test, and its environment in environmental bisimulation-instead of just one program.

Part III

Denotational Semantics for Higher-Order Languages with Probabilities.

Chapter 9

Background: Two Denotational Models for Higher-Order Languages with Probability

The growing interest in enhancing programming languages with various probabilistic primitives led to a drive for adapting existing denotational semantics in order to make them able to interpret probabilistic behaviors. The first denotational semantics for an higherorder language with probabilistic features was put forward by Saheb-Djahromi in [START_REF] Saheb-Djahromi | Probabilistic LCF[END_REF], but while overall his language is higher-order, the probability distributions are considered only on values of ground types, i.e. integers and booleans. To handle his language, Saheb-Djahromi adapts the non-deterministic powerdomain-considered before by Plotkin-into a probabilistic powerdomain for ground domains, i.e. the ones that interpret the integers and booleans types. Then, in their pioneering work [START_REF] Jones | A probabilistic powerdomain of evaluations[END_REF][START_REF] Jones | Probabilistic non-determinism[END_REF] Jones and Plotkin extend the probabilistic powerdomain to all types, and use it to give a denotational semantics for a higher-order language similar to PCF ⊕ , resulting in a computationally adequate model. Their construction is based on Moggi's work on computational λ-calculus [START_REF] Moggi | Computational lambda-calculus and monads[END_REF]-where he gives a denotational semantics to a λ-calculus with generic computational effect in any Cartesian closed category equipped with a strong monad-that they apply with a monad built from the probabilistic power-domain. This monadic approach has been continued by several works [START_REF] Barker | A monad for randomized algorithms[END_REF] [84] aiming to add a notion of approximation to Jones and Plotkin's model, with changes to both the monad and the underlying category. Another branch of the domain-theoretic approach based on the study of powerdomains for probability led to the introduction of Kegelspitzen by Keimel and Plotkin [START_REF] Plotkin | Mixed powerdomains for probability and nondeterminism[END_REF] that combines both the structure of a convex set and the structure of a directed-complete partial order; it has resulted in a denotational model of a variant of PCF ⊕ based on Kegelspitzen that has been built in [START_REF] Rennela | Convexity and order in probabilistic call-by-name fpc[END_REF]. A very different perspective on denotational semantics for higher-order probabilistic languages has been brought from the tradition of games semantics, where types are interpreted as games, and programs as strategies on these games. The first probabilistic model using games semantics is defined by Danos and Harmer [START_REF] Danos | Probabilistic game semantics[END_REF], who introduced a fully abstract semantics for a probabilistic variant of idealized algol -i.e. an extension of PCF ⊕ with ground state. Recently, a model of PCF ⊕ itself, using concurrent game semantics has also been introduced and shown to be fully abstract [START_REF] Castellan | The concurrent game semantics of probabilistic pcf[END_REF]. In this thesis, we are actually mainly interested by yet another approach, that uses ideas coming from quantitative semantics and Linear Logic. It has been introduced by Girard in [START_REF] Girard | Between logic and quantic: a tract[END_REF] for the purpose of defining probabilistic coherent spaces, designed as a generalization of coherent spaces, the objects he used in his model of Linear Logic. Danos and Ehrhard [START_REF] Danos | Probabilistic coherence spaces as a model of higher-order probabilistic computation[END_REF] then used this notion to build a model of PCF ⊕ , that was then shown to be fully abstract in [START_REF] Ehrhard | Probabilistic coherence spaces are fully abstract for probabilistic PCF[END_REF]. Probabilistic coherent spaces were also used to build a fully abstract model of a probabilistic variant of Levy's Call-by-push-value language [START_REF] Tasson | Probabilistic call by push value[END_REF].

If instead of adding primitives for expressing discrete probabilities, we want to add primitives for continuous probabilities to a programming language, the problem of giving an adequate denotational semantics becomes even more complex. The first attempt in this direction was done by Kozen [START_REF] Kozen | Semantics of probabilistic programs[END_REF] on a first-order language with a while loop that was enriched with a random generator on real numbers. Kozen interpreted programs as stochastic Markov kernels between measurable spaces, obtaining a fully abstract denotational semantics. The category of Markov kernels and measurable spaces, however, is not Cartesian closed, which makes it impossible to use this category to build a model of an higher-order language. While there is at the present time no known fully abstract model for higher-order languages with continuous probabilities, a variety of models have been proposed over the past few years, and are still under investigation. Staton et al. developed [START_REF] Heunen | A convenient category for higherorder probability theory[END_REF] a denotational semantics for a continuous higher-order language that moreover handles Bayesian reasoning. Their model is based on Quasi-Borel spaces, that both allow to express continuous probability, and give rise to a Cartesian closed category. More recently, Ehrhard Pagani and Tasson [START_REF] Ehrhard | Measurable cones and stable, measurable functions: a model for probabilistic higher-order programming[END_REF] introduced a denotational model for PCF sample based on the notion of cones and a stability condition on morphisms. The game semantics approach has been extended as well to the continuous case: Danos and Harmer model has been generalized by Ong and Vákár [START_REF] Ong | S-finite kernels and game semantics for probabilistic programming[END_REF] into an adequate model of Idealized Algol enriched with continuous probabilities, while Paquet and Winskel [START_REF] Paquet | Continuous probability distributions in concurrent games[END_REF] gave an adequate model for PCF sample -PCF enriched with continuous probabilities, presented in Chapter 1-using concurrent game semantics.

In this chapter, we are going to present the model of PCF ⊕ based on probabilistic coherent spaces introduced by Danos and Ehrhard [START_REF] Danos | Probabilistic coherence spaces as a model of higher-order probabilistic computation[END_REF], and the model for PCF sample based on complete cones and stable functions introduced by Ehrhard, Pagani and Tasson [START_REF] Ehrhard | Measurable cones and stable, measurable functions: a model for probabilistic higher-order programming[END_REF]. In the first part of this chapter, we recall briefly some notions of category theory, that we then use to describe the underlying structure of the models. We then introduce PCoh, the category of probabilistic coherence spaces, and Cstab m , the category of measurable cones and measurable stable functions.

Categorical Semantics For Higher-Order Languages

In this section, we are going to present some tools from category theory that are designed to build denotational models for programming languages. Indeed, category theory allows us to describe which structural properties a concrete model should verify, in order to be a good candidate for soundness with respect to a given programming language. We assume the reader familiar with the basic definitions about category theory, for which we refer to [START_REF] Lane | Categories for the working mathematician[END_REF]. A category is a collection of objects connected by arrows -called morphisms-that can be combined by a composition operator •. If C is a category, and A, B two object of C, we denote by C(A, B) the collection of morphisms from A to B. Since we will usually consider in the following small categories, this collection will actually be a set, and accordingly we will call hom-sets the sets of morphisms of the form C(A, B). We denote by C × D the product category of two categories C and D, as defined in Chapter 2 of [START_REF] Lane | Categories for the working mathematician[END_REF] .

Cartesian Closed Categories

When interpreting a typed programming language in a category, types are interpreted as objects, while programs are interpreted as morphisms. It means that the category we consider should come with functors designed to express the type constructs. For instance, in the very simple setting of the simply typed λ-calculus with pairs, there are two type constructs: the binary product ×, and the arrow construct →. The corresponding categorical structure is Cartesian closeness, that ensures that every objects A, B of such category have a product object A × B, and an arrow object A ⇒ B. We recall here the definition of Cartesian Closed Category, since such categories are the natural place to build any model of higher-order computations. Definition 9.1.1 (Product) Let C be a category, and

A 1 , A 2 two objects of C. A prod- uct of A 1 and A 2 is an object (A 1 × A 2 ) together with two morphisms π 1 : A 1 × A 2 → A 1 , π 2 : A 1 × A 2 → A 2 ,
that verifies the universal property represented below:

B A 1 A 1 × A 2 A 2 f 1 f 2 f 1 ×f 2 π 1 π 2
Whenever-as it is the case for Cartesian Closed categories, that we define below -binary product exists for every pair of objects, it actually defines a functor × : C × C → C (see [START_REF] Lane | Categories for the working mathematician[END_REF]). To interpret also the → type construct, we need our category to have moreover an arrow object. Accordingly, we ask for it to be cartesian closed, as defined below: Definition 9.1.2 A category C is a Cartesian closed category (CCC) if:

• it has a terminal object -i.e. such that, for every object A of C, there exists exactly one morphism from A to .

• Any two objects A, B have a product A × B in C-in the sense of Definition 9.1.1.

• For any two objects A, B, there exists an object (A ⇒ B), and a morphism eval A,B :

(

A ⇒ B) × A → B in C such that: ∀C object , ∀g ∈ C(C × A, B), ∃!curry(g) ∈ C(C, A ⇒ B) such that g = eval A,B • (curry(g) × id A ) C A ⇒ B curry(g) C × A (A ⇒ B) × A B curry(g)×id A g eval A,B
We say that the morphism curry(g) is the currying of g.

In any Cartesian closed category, we can construct a model of simply typed λ-calculus: a typing judgments of the form x 1 : σ 1 , . . . , x n : σ n M : τ is interpreted as a morphism from the object σ 1 × . . . × σ n to the object τ . If we want to be able to interpret not only the simply typed λ-calculus, but also more expressive higher-order languages, we need to add additional structures to some Cartesian closed category. We can for instance add coproducts, which led to models of λ-calculus with sum-types, and on the logical side to models of propositional intuitionistic logic. We could also want to interpret the untyped λ-calculus: in this case we have to ask for the presence of a reflexive object A, i.e. such that A is isomorphic to A ⇒ A; it comes from the fact that in an untyped setting, we cannot distinguish between first order function, second-order function, etc, as we do in the simply typed λ calculus. The first example of such Cartesian closed category with reflexive object to be looked at-the category DCpo of directed complete partial orders and Scott continuous functions-was built by Scott and Strachey [START_REF] Scott | Outline of a mathematical theory of computation[END_REF][START_REF] Scott | Toward a mathematical semantics for computer languages[END_REF] in their pioneering work that gave rise to domain theory.

If our target language is PCF, we need to add to a model of simply typed λ-calculus the categorical structures needed to deal with ground types and with the fixpoint construction. Scott [START_REF] Scott | A type-theoretical alternative to iswim, cuch, owhy[END_REF] introduced the standard model of PCF in the category DCpo, that was then shown by Plotkin [START_REF] Plotkin | LCF considered as a programming language[END_REF] to be adequate, while not fully abstract. It has been then generalized into the class of standard models of PCF which are the cartesian closed category, with moreover a natural number object-the categorical structure encoding a recursive definition of natural numbers-and that is ω-cpo-enriched -in particular, it has for consequence that for every object A, B, the hom-set C(A, B) is a ω complete partial-order. A more general axiomatisation of sound models for PCF has been later formalized by Hyland and Ong [START_REF] Hyland | On full abstraction for pcf: I, ii, and iii[END_REF] using the notion of c-fix category. A categorical axiomatisation for adequate-i.e. every non-terminating program is interpreted by the bottom element of hom-sets-models of PCF has also been proposed in [START_REF] Braüner | A simple adequate categorical model for pcf[END_REF].

Categorical Model of Linear Logic

Linear Logic (LL) has been introduced by Girard in [START_REF] Girard | Linear logic[END_REF]. We recall here only some basic facts about this logic; more intuitions and details may be found for instance in [START_REF] Girard | Linear logic: its syntax and semantics[END_REF]. Linear Logic has three kind of connectives used to build formulas: the multiplicative connectives `, ⊗, 1, ⊥, the additive ones &, ⊕, , 0, and the exponential ones !, ?. An essential feature of LL is the presence of two disjunctions `and ⊕, as well as two conjunctions & and ⊗. The formulas of LL can be interpreted in terms of resources available to some operator; for instance, we can interpret the two conjunctions as follows: A ⊗ B corresponds to the case where the operator may use simultaneously the resource A and B, while A & B means that the operator has to choose whether he wants to use the resource A or the resource B. The exponential construct !A means that the operator have unlimited access to the resource A.

The Classical Linear Logic (LL) formulas are generated as follows:

A ::= p | p ⊥ | A ⊗ A | A ⊕ A | A & A | A `A | | ⊥ | 1 | 0 | !A | ?A,
where p is an element of a fixed set of logical atoms. Moreover, the dual operator ⊥ is extended from logical atoms to all formulas using the following rules:

In its original presentation of LL, Girard defined inference rules using one-sided sequents, of the form γ, where γ is a list of formulas. The sequent should be understood as follows: whenever all the formulas A i are true, then at least one of the formula B j holds. The LL inference rules are the ones presented in Figure 9.2. Observe that both the cut rule and the initial sequent rule use the duality operator defined in Figure 9.1. The resource policy is reflected in the deduction rules: for instance, the rule ⊗ may be read as follows: in order to know that Γ ⊥ , A ⊗ B-i.e. if all formulas in the list Γ hold, then A ⊗ B also holds-we have to split the list Γ into two disjoint parts, where the first one has the resources needed to build A, and the second one has the resources needed to build B. By contrast, the rule & may be understood as: in order to show Γ ⊥ , A & B, it is enough to prove that with the resources from Γ, we are able to construct separately both A and B. We can interpret the rules for exponentials in the same resource oriented framework. The weakening rule expresses the possibility of discarding a resource of type !A. The contraction rule allows to transform a data of type !A into a pair consisting of two data of type !A: it may be interpreted as observing that whenever we have an unlimited source of A, this situation is equivalent to having two unlimited sources of A available. The promotion rule should be interpreted as follows: if we are able to construct an element of type A using only resources of type !B, then as soon as we have an unlimited access to resources of type B, we can also build as many resource of type A as we like ; it is because we can duplicate the procedure to produce a A res-source as many times as we want, and so we are actually able to build an unlimited number of data of type A. The dereliction rule should be interpreted as extracting a single resource of type A from an unlimited supply of resources of type A.

A ⊥ 1 , . . . , A ⊥ n , B 1 , . . . , B m (p) ⊥ := p ⊥ (p ⊥ ) ⊥ := p (A ⊗ B) ⊥ := A ⊥ `B⊥ (A `B) ⊥ := A ⊥ ⊗ B ⊥ (A ⊕ B) ⊥ := A ⊥ & B ⊥ (A & B) ⊥ := A ⊥ ⊕ B ⊥ 1 ⊥ := ⊥ ⊥ ⊥ := 1 0 ⊥ := ⊥ := 0 (!A) ⊥ := ?(A ⊥ ) (?A) ⊥ := !(A ⊥ ) Figure 9.1: Duality Operator in Linear Logic Γ, A, B, ∆ exch Γ, B, A, ∆ init.seq. A, A ⊥ Γ, A A ⊥ , ∆ cut Γ, ∆ Γ, A ∆, B ⊗ Γ, ∆, A ⊗ B Γ, A, B ` Γ, A `B 1 1 Γ ⊥ Γ, ⊥ Γ, A Γ, B & Γ, A & B Γ, A ⊕L Γ, A ⊕ B Γ, B ⊕R Γ, A ⊕ B Γ, Γ weakening Γ, ?A Γ, ?A, ?A contraction Γ, ?A ?Γ, A promotion ?Γ, !A Γ, A dereliction Γ, ?A
If we have a proof-i.e. a derivation tree built using the rules and axioms of Figure 9.2-for a particular sequent Γ, we are able to transform this proof into another proof of the same sequent Γ that is cut-free-i.e. such that the rule Cut doesn't appear in its derivation tree; this transformation is called the cut-elimination procedure, and its definition may be found in [START_REF] Girard | Linear logic: its syntax and semantics[END_REF]. There is also an intuitionistic variant of Linear Logic-ILL (Intuitionistic Linear Logic)-that was formalized in a subsequent paper by Girard and Lafont [START_REF] Girard | Linear logic and lazy computation[END_REF]. In ILL, the connective `, ?, ⊥ are absent, and we add as connective the linear implication , that can be encoded in LL as A B ::= A ⊥ `B. The rules for ILL may be found for instance in [START_REF] Girard | Linear logic: its syntax and semantics[END_REF]. We will consider also in the following the fragments MLL-Multiplicative Linear Logic-and MILL-Multiplicative Intuitionistic Linear Logic, that consists in the restriction of respectively LL and ILL to formulas and proof trees that use only the multiplicative connectives.

The resource interpretation makes LL a natural framework for building a type system for higher-order programming languages that handle limited resources. LL, and relevant fragments of it, have been given this way a computational content in the spirit of the Curry-Howard correspondence; several linear λ-calculi have been proposed, including by Lafont [START_REF] Lafont | The linear abstract machine[END_REF], Abramsky [START_REF] Abramsky | Computational interpretations of linear logic[END_REF], by Wadler [START_REF] Wadler | A syntax for linear logic[END_REF], etc. The Surface λ-calculus we presented in Chapter 7, corresponds to ILL extended with recursive types. Recall that this language has non-terminating programs, meaning that the underlying logic has no cut-elimination procedure.

Categorical Semantics for Exponential Free Linear Logic

As illustrated before, when building a model for a typed programming language in some category, we usually interpret types as objects, and programs as morphisms. Similarly-once again in the spirit of the Curry-Howard's correspondence-a model of a logical system L is a category C equipped with an interpretation function • , that associates to every formula of L an object in C, and to every proof in L a morphism in C. We also ask for a correctness criterion on models: a model of a programming language is sound if the program interpretation is invariant by reduction. Similarly, we look at the equivalence on proofs defined as the reflexive and transitive closure of the cut-elimination procedure, plus some additional modularity constraints -we refer to [START_REF] Mellies | Categorical semantics of linear logic[END_REF] for a more precise definition of this equivalence relation-and we say that a model of LL should be sound with respect to this equivalence, i.e. that whenever two proofs are equivalent then their interpretation in the model coincide.

Definition 9.1.3 If L is a logical system equipped with a cut-elimination procedure, a category C is a sound model of L if there exists an interpretation function • such that whenever two proofs are equivalent with respect to the cut-elimination procedure, their interpretation by • coincide.

The next step consists in investigating the minimal requirements needed to guarantee that some concrete category is indeed a sound model for LL. We follow here the perspective developed by Melliès in [START_REF] Mellies | Categorical semantics of linear logic[END_REF]. We first look at less complex fragments of LL. First in order to have a model of MILL-multiplicative intuitionistic linear logic, i.e only the connectives ⊗, , 1 are present-, we need a symmetric closed monoidal category (SMCC): it is a category equipped with a tensor product, and an object of morphisms, that allows to interpret respectively the connective ⊗ and , and with symmetry morphisms, that allows to implement the exchange rule. Below, we present the formal definition of SMCC in three steps: first we define what a monoidal category is, then we add symmetry requirement to it, and finally we give the definition of SMCC. Definition 9.1.4 (Monoidal Category) A monoidal category (MC) is a category C equipped with:

• A bifunctor ⊗ : C × C → C, called the tensor product;

• An object 1 called the unit object;

• Three natural isomorphisms expressing respectively associativity of ⊗, and that 1 is a left and right neutral element:

a A,B,C : (A ⊗ B) ⊗ C ∼ = A ⊗ (B ⊗ C); l A : (1 ⊗ A) ∼ = A; r A : (A ⊗ 1) ∼ = A;
such that the two diagrams below commute:

(A ⊗ 1) ⊗ B A ⊗ (1 ⊗ B) A ⊗ B a A,1,B r A ⊗id B id A ⊗l B ((A ⊗ B) ⊗ C) ⊗ D (A ⊗ B) ⊗ (C ⊗ D) (A ⊗ (B ⊗ C)) ⊗ D A ⊗ ((B ⊗ C) ⊗ D) A ⊗ (B ⊗ (C ⊗ D)) a A,B,C ⊗id D a A⊗B,C,D a A,B,C⊗D a A,B⊗C,D id A ⊗a B,C,D
If we want moreover to be able to swap the objects A, B in the tensor product A ⊗ B, we need to ask the monoidal category to be also symmetric, i.e. equipped with a natural isomorphism swap that performs the swapping. Definition 9.1.5 (Symmetric Monoidal Categories) A symmetric monoidal category (SMC) is a monoidal category (C, ⊗, 1) equipped with a natural isomorphism swap A,B : A ⊗ B ∼ = B ⊗ A, such that the three following diagrams commute:

A ⊗ 1 1 ⊗ A A swap A,1 r A l A B ⊗ A A ⊗ B A ⊗ B swap B,A swap A,B id A⊗B (A ⊗ B) ⊗ C (B ⊗ A) ⊗ C A ⊗ (B ⊗ C) B ⊗ (A ⊗ C) (B ⊗ C) ⊗ A B ⊗ (C ⊗ A) swap A,B ⊗id C a A,B,C a B,A,C swap A,B⊗C id B ⊗swap A,C a B,C,A
Every cartesian category-i.e. equipped with a terminal object and finite products-is also a symmetric monoidal category: indeed, we can define natural isomorphisms for associativity and elimination of the neutral element as a, l, r by combining the projections π 1 , π 2 .

To model the linear arrow of ILL, we need to add a closed structure to a SMC. The approach is similar to the way we add a closed structure to a cartesian category in Definition 9.1.2, thus obtaining a cartesian closed category. We want now to add to a categorical model of MILL-i.e. a SMCC-the categorical structure required in order to obtain a categorical model for MLL. Observe that the LL multiplicative connective `not present in ILL may be expressed by using the duality operator and the multiplicative connectives from ILL. It means that as soon as we have an appropriate duality mechanism in our category, we can reconstruct a denotation for multiplicative LL from a denotation for multiplicative ILL. We can use this observation to define what is a categorical model of multiplicative LL: it is a -autonomous category, i.e. a SMCC with a dualizing object. The notion of -autonomous category was introduced by Barr [START_REF] Barr | Autonomous categories[END_REF]. Definition 9.1.7 ( -autonomous category) A -autonomous category is a symmetric monoidal closed category (C, ⊗, 1, ) endowed with a dual object ⊥ such that the morphism

d A : A → (A ⊥) ⊥
is an isomorphism -where d A is defined as the transpose of the evaluation map eval A,⊥ :

(A ⊥) ⊗ A → ⊥.
The definition of a -autonomous category may also be understood in a logical way: indeed asking for d to be an isomorphism correspond to adding the law of excluded middle to a model of ILL.

When we want to add the additive connectives &, ⊕, we need to add Cartesian product to our model: accordingly, a model of exponential-free LL is a -autonomous category with finite products.

Categorical Models for Linear Logic

Difficulties arise, however, when we want to add to a -autonomous category a structure interpreting the exponential connective !. Our account here follows again [START_REF] Mellies | Categorical semantics of linear logic[END_REF], to which we refer the reader for a more extensive presentation. A slightly different viewpoint may be also found in [START_REF] Paiva | Categorical semantics of linear logic for all[END_REF]. We can see first that ! should be a comonad, i.e. a functor ! : C → C with two natural transformation η : ! → Id C and µ : ! → ! 2 that moreover verify additional commutative diagrams (that the reader may find in [START_REF] Lane | Categories for the working mathematician[END_REF]). From this co-monadic structure, we obtain morphisms for the dereliction and digging : for every object A ∈ L, we have morphisms der A : !A → A, and digg A : !A → !!A. However, a co-monad ! does not necessarily give rise to a sound model of LL. From there, several distinct propositions to strengthen the interaction of ! with the structure of the -autonomous category had been put forward, and it's only recently that they were discovered to be all particular instances of linear-non-linear models, a categorical axiomatisation introduced by Benton [START_REF] Benton | A mixed linear and non-linear logic: Proofs, terms and models[END_REF].

We present below two of the earlier axiomatisations of sound LL models, in the sense of Definition 9.1.3 : the new-Seely Model and the Lafont Model. The notion of Lafont's model was introduced by Lafont in [START_REF] Lafont | Logiques, catégories et machines[END_REF], while the new-Seely model is due to Seely [START_REF] Seely | Linear logic,*-autonomous categories and cofree coalgebras[END_REF] and Bierman [START_REF] Bierman | What is a categorical model of intuitionistic linear logic?[END_REF].

Lafont Models of Linear Logic

Lafont's model is based on the notion of commutative comonoid, that we recall below.

M M ⊗ M (M ⊗ M ) ⊗ M M ⊗ M M ⊗ (M ⊗ M ) d d d⊗id M a M,M,M id M ⊗d 1 ⊗ M M ⊗ M (M ⊗ 1) M l e⊗id M id M ⊗e r d If (M 1 , d 1 , e 1
) and (M 2 , d 2 , e 2 ) are two comonoids, a morphism of comonoid from M 1 to M 2 , denoted f : (M 1 , d 1 , e 1 ) → (M 2 , d 2 , e 2 ), is a morphism f ∈ C(M 1 , M 2 ) that respects the comonoid structure, i.e. such that the two diagrams below commute:

M 1 M 2 M 1 ⊗ M 1 M 2 ⊗ M 2 f d 1 d 2 f ⊗f M 1 M 2 1 e 1 f e 2
If moreover (C, ⊗, 1) is a commutative monoidal category, a comonoid (M, d, e) is commutative if the following diagram holds:

M M ⊗ M M ⊗ M d d swap M,M
The next step to present Lafont construction is the notion of free commutative comonoid generated by some object A.

M A M A f f †
The universal property of Definition 9.1.9 implies that when it exists, the free comutative comonoid over A is unique up to (unique) isomorphism. Another formulation of this universal property is that the category of commutative comonoids over A has M as terminal object. By definition, the structure of an exponential modality turns an object A into a commutative comonoid !A, with the comultiplication given by contraction and the neutral element given by weakening:

1 !A !A ⊗ !A. weak !A contr !A
The converse does not hold in general, since commutative comonoids may lack a comonad structure (dereliction, digging, and the action on morphisms). However, Lafont proves that in case the commutative comonoid is the free one then its universal property allows one to canonically construct the missing structure, in such a way that we obtain a sound model of LL.

Definition 9.1.10 (Lafont Model) A -autonomous category C is a Lafont model if:

1. it has finite products and, 2. for every object A, there exists a commutative comonoid (! f A, weak ! f A , contr ! f A ) which is the free commutative comonoid generated by A.

For every A, we denote by der f A the morphism in C(! f A, A) obtained by the universal property stated in Definition 9.1.9. It is this morphism that implements the dereliction rule of LL.

New-Seely Models of Linear Logic

Another axiomatisation was proposed by Seely-and then corrected by Bierman. It may be noted that until now, every known concrete sound models of LL is a new-Seely category. such that the diagrams below commute:

!A ⊗ !B !(A & B) !!(A & B) !!A ⊗ !!B !(!A & !B) m 2 A,B digg A ⊗digg B digg A&B !(!π 1 ×!π 2 ) m 2 !A,!B (!A ⊗ !B) ⊗ !C !A(!B ⊗ !C) !(A & B) ⊗ !C !A ⊗ !(B & C) !((A & B) & C) !(A & (B & C)) a !A,!B,!C m 2 A,B ⊗id !C id !A ⊗m 2 B,C m 2 A&B,C m 2 A,B&C !a A,B,C !A ⊗ 1 !A !A ⊗ ! !(A & ) r !A id !A ⊗m 0 m 2 A, !r A 1 ⊗ !B !B ! ⊗ !B !( & B) l !B m 0 ⊗id !B m 2 ,B !l B !A ⊗ !B !B ⊗ !A !(A & B) !(B & A) swap !A,!B m 2 A,B m 2 B,A !swap A,B
The definition of new-Seely category may also be expressed in a more elegant way by using the notion of monoidal adjunction; this viewpoint is developed in [START_REF] Mellies | Categorical semantics of linear logic[END_REF].

Every model of Linear Logic may be seen as a model of Intuitionistic Logic, i.e. we can construct a Cartesian closed category from any sound model of Linear Logic. The Seely axiomatisation of LL models had the explicit purpose of guaranteeing that the co-Kleisli category associated to ! should be cartesian closed, thus giving a model of Intuitionistic Logic, or equivalently of simply typed λ-calculus. We recall below the co-Kleisli construction.

! f A| = {µ ∈ M f (|A|) | ∀a, a ∈ S(µ),
a ¨A a } is given by the finite multi-cliques functor, as shown in [120]. The morphism (der !A ) † factoring !A through ! f A is given by the support relation:

(der !A ) † = {(S(µ), µ) ; µ ∈ |! f A|}.
On the non-uniqueness of exponential structure.

The additive and multiplicative connectives of LL are entirely determined by the logical rules that we have presented in Figure 9.2: indeed, if we add another tensor product ⊗ to the logical system, then for every formulas A, B, it holds that A ⊗ B and A ⊗ B are isomorphic. This phenomenon is reflected in the categorical semantics of LL: given a category, the multiplicative-additive structures (if exist) are unequivocally characterized by universal properties as soon as a notion of multilinear map is given. It is notably different for the exponential: if we add another exponential connective ! into the linear system, we are not able, using the linear logic rules, to show that ! and ! are equivalent. This has also consequences on the semantics side: it means that several unrelated exponential notions can coexist in a model of linear logic. An example of such situation may be found when looking at the category Coh, the model of Linear Logic introduced by Girard, that we have already considered in Example 9.1.1. As mentioned in Example 9.1.1, we can define two distinct exponentials in the Coh model: the finite cliques functor and the finite multi-cliques functor. Such a situation also arises in the category Rel of sets and relations, when the standard exponential is given by the multiset functor, but where a wide family of exponential modalities has been introduced using infinite multiplicities [START_REF] Carraro | Exponentials with infinite multiplicities[END_REF].

The choice of an exponential structure decides how the model is going to implement the erasure and copy operations when interpreting a programming language. It may have deep consequences on the structure of programs interpretations: for instance choosing the finite cliques functor lead to a finite model of simply typed λ-calculus with finite ground types-e.g. booleans. Such a choice of exponential structure may also depend on which computational properties we want the denotational semantics to capture: for instance, in Rel the exponential from [START_REF] Carraro | Exponentials with infinite multiplicities[END_REF] leads to a non-sensible -meaning that non-terminating terms do not have necessarily the same denotational semantics-model of untyped λcalculus, while every model of this language based on the standard exponential is sensible. A well-chosen exponential modality may also allow to model a more expressive language in the category: for instance, the Rel modalities introduced in [START_REF] Carraro | Exponentials with infinite multiplicities[END_REF] were used in [START_REF] Breuvart | Modelling coeffects in the relational semantics of linear logic[END_REF] to give a denotational semantics to a λ-calculus with co-effects.

In this setting, Lafont's models-presented in Definition 9.1.10-offer a canonical criterion to choose an exponential modality. Indeed, while for every exponential modality, !A is a commutative comonoid generated by A with respect to ⊗, there is at most one free commutative comonoid.

Moreover, Lafont's way of defining the exponential structure expresses a direct connection with the tensor product of the underlying symmetric monoidal category. The universal property associated to the free exponential allows to express every exponential modality using the free one, thus giving some genericity to the Lafont construction. More precisely, if ! is any exponential modality in the same symmetric monoidal category, the fact that der † is a morphism of comonoids means that we have the diagrams presented in Figure 9.3:

! f A A !A der f A der ∃!der † ! f A !A 1 der † w f w ! f A !A ! f A⊗! f A !A⊗!A A ⊗ A ⊗ ... . . . . . . der † c !f c der † ⊗ der †

PCoh: The Category of Probabilistic Coherent Spaces

We present now the category PCoh of probabilistic coherence spaces, and its structure as a model of Linear Logic, as investigated by Danos and Ehrhard in [START_REF] Danos | Probabilistic coherence spaces as a model of higher-order probabilistic computation[END_REF]. Linear Logic formulas are interpreted by probabilistic coherence spaces (PCS). A PCS consists of both a web, and a set of quantitative cliques that are vectors over this web, and that moreover must verify some conditions designed to guarantee that the set of quantitative cliques is well-formed.

We use the following notations: R + is the set of non-negative real numbers. When talking about vectors over a countable set |A|, e a denotes the base vector for a ∈ |A|: (e a ) b := δ a,b , with δ the Kronecker delta; and for any vector v ∈ R |A| , we denote v a its a component. If X is a set of vectors over |A|, we call dual of X the set X ⊥ = {y | ∀x ∈ X, x, y ≤ 1}, where the scalar product for x, y ∈ R |A| + is taken as x, y = a∈|A| x a y a ∈ R + ∪ {∞}. Definition 9.2.1 ( [START_REF] Girard | Between logic and quantic: a tract[END_REF][START_REF] Danos | Probabilistic coherence spaces as a model of higher-order probabilistic computation[END_REF]) A probabilistic coherence space is a pair A = (|A| , P (A)) where |A| is a countable set called the web of A and P (A) is a subset of (R + ) |A| called the cliques of A, such that the following conditions hold:

closeness: P (A) ⊥⊥ = P (A), boundedness: ∀a ∈ |A|, ∃µ > 0, ∀v ∈ P (A), v a ≤ µ, completeness: ∀a ∈ |A|, ∃λ > 0, λe a ∈ P (A),
where the dual of a PCS A is defined by A ⊥ := (|A| , P (A) ⊥ ).

A pair (|A| , P (A)) that verifies the boundedness and completeness conditions-but that may not be closed-is called a pre-PCS.

The boundedness condition means that for every a in the web, we can look at the supremum of the valuation of any clique on this particular element of the web. Since we will need later to talk about those least upper bound, we introduce the following notation now. Notation 9.2.1 For any PCS A, we will call maximum coefficient of a in A the positive real (sup A) a := sup x∈P(A) x a .

We may observe that the family of maximum coefficients for all a do not completely characterize the PCS: it can be seen for instance by looking at the PCSs represented respectively in Example 9.2.1 and Example 9.2.6.

PCSs are a probabilistic generalization of coherent spaces: instead of coherence spaces cliques-sets of vertices contained in the web-we are now interested into quantitative cliques: a PCS clique do not associate a boolean value at each vertex anymore, but a weight that is an element in R + . The bi-duality condition enforced in Definition 9.2.1 is also similar to the one used by Girard on coherence spaces, in order to distinguish the family of set vertices that are indeed the cliques of some underlying graph structure.

The duality operator gives us a standard way to construct PCS from some generating elements: indeed if we take any pre-PCS X, it holds that X ⊥⊥ is a PCS. We also endows the set of cliques P (A) with a partial order : we take the pointwise order on vectors, i.e. u ≤ v when for all a ∈ |A|, u a ≤ v a . With this partial order, we can express in a more geometrical way the requirements enforced in Definition 9.2.1. The bi-duality operation can indeed be interpreted as taking the closure of the space of cliques under Scott-closure and convexity. It is expressed by the following proposition, proved in [START_REF] Girard | Between logic and quantic: a tract[END_REF] by a standard application of the Hahn-Banach Theorem. The convexity inherent to PCSs makes PCoh particularly suitable for modeling (discrete) probabilistic computations: the barycentric sum κv + ρw (for κ, ρ ∈ [0, 1], κ + ρ ≤ 1, v, w vectors) expresses a computation which returns v with probability κ, w with probability ρ, and the remainder 1 -(κ + ρ) is the probability that the computation diverges. We illustrate this idea by looking at the PCSs modeling data, i.e. corresponding to ground types.

Example 9.2.1 (The PCS Bool.)

t f P (Bool)
To model the boolean type, we take as web the pure-i.e. nonprobabilistic-data of this type, i.e. |Bool| = {t, f}. The cliques are then generated as P (Bool) = {(1, 0), (0, 1)} ⊥⊥ , meaning that we take the convexity closure and Scott closure of the program that returns true with probability 1, and the one that returns false with probability 1. What we obtain is all the sub-probability distributions over booleans, i.e P (Bool) = {(p, q) ; p + q ≤ 1}.

The way we defined the PCS Bool may be extended to other kinds of ground type data. We give below the PCS modeling the type N of natural numbers in PCF ⊕ : the cliques are all sub-distributions over natural numbers. We look now at the morphisms of the category PCoh: the morphisms from a PCS A to a PCS B are the Scott-continuous and linear functions mapping the vector set P (A) into the vector set P (B). These linear maps are described as (usually infinite-dimensional) matrices. The connective is interpreted in such a way that we have immediately the correspondence with PCoh-morphisms: the cliques over A B are exactly the morphism from A to B. Definition 9.2.2 (PCS morphisms) Let A, B two PCSs.

• A PCS morphism from A to B is a matrix f ∈ (R + ) |A|×|B| s.t.:

∀v ∈ P (A) , f v ∈ P (B) , (9.1)
where f v is the usual matricial product:

∀b ∈ |B|, (f v) b := a∈|A| f a,b v a .
• The object of linear morphisms A B is defined as |A B| := |A| × |B|, and P (A B) := PCoh(A, B).

We will often use Lemma 9.2.3 below, allowing us to infer condition (9.1) for all v ∈ P (A), just by testing it on a set G of generators of P (A).

Lemma 9.2.3 Let A, B be two probabilistic coherence spaces and f be a matrix in

R |A|×|B| + . Let G ⊆ P (A) such that: (i) G ⊥⊥ = P (A), and (ii) ∀v ∈ G, f v ∈ R |B| + ,then: f (G) ⊥⊥ = f (P (A)) ⊥⊥ .
We illustrate Definition 9.2.3 by looking at the morphisms from Bool to itself. Using Lemma 9.2.3, we see that it is those matrices that send both e t -the pure state true-and e f -the pure state false-into the cliques space of Bool. We see that these morphisms correspond exactly to Markov chains on two states.

Example 9.2.3 (Morphisms in Bool

Bool.) The element of P (Bool Bool) are the matrices x ∈ R {t,f}×{t,f} + such that x t,t + x t,f ≤ 1, and also x f,t + x f,f ≤ 1. Those matrices are the one that represent Markov Chains on two states, as illustrated on the figure below.

true false

x ∈ P (Bool Bool) defined as:

x t,t = 0 x t,f = 1 x f,t = 1 2 x f,f = 1 2 . 1 1 2 1 2
We define now the category PCoh: we need to specify its objects, its hom-sets, and how the composition and identity for morphisms are defined. Definition 9.2.3 The category PCoh has as objects PCSs, and PCSs morphisms as morphisms.

• The identity id A on A is defined as the diagonal matrix given by (id A ) a,a = δ a,a .

• Composition of morphisms is matrix multiplication:

(g•f ) a,c = b∈|B| f a,b g b,c
, where f ∈ PCoh(A, B), g ∈ PCoh(B, C), and a ∈ |A|, c ∈ |C|.

The above sum b∈|B| f a,b g b,c converges in R + , because f, g verify condition (9.1).

PCoh as Model of Exponential-Free Linear Logic

We are now going to present the structure of PCoh as a model of linear logic, that have been built by Danos and Ehrhard in [START_REF] Danos | Probabilistic coherence spaces as a model of higher-order probabilistic computation[END_REF]. First, we give the -autonomous structure of PCoh, and then we define the comonad that have been introduced in [START_REF] Danos | Probabilistic coherence spaces as a model of higher-order probabilistic computation[END_REF] in order to make PCoh a new-Seely category. Our presentation here follows the same structure as the one done in [START_REF] Crubillé | The free exponential modality of probabilistic coherence spaces[END_REF].

We first look at the monoidal structure of PCoh: we present here the bifunctor ⊗ : PCoh × PCoh → PCoh that interprets the tensor product. The other natural isomorphisms (associativity, neutrality) are given similarly.

Example 9.2.4 (The PCS Bool ⊗ Bool.) Looking at the definition of ⊗, we see that:

|Bool ⊗ Bool| = {(t, t), (t, f), (f, t), (f, f)} P (Bool ⊗ Bool) = {x ∈ R |Bool⊗Bool| + | x t,t + x t,f + x f,t + x f,f ≤ 1}.
Observe that the cliques of Bool ⊗ Bool correspond to all sub-distributions over pair of booleans-it is because the tensor product distributes on the coproduct due to the monoidal closure. Consider the program M = N, N , where N = true ⊕ false. We see that we can take as denotation: The unit of ⊗ is given by the singleton web PCS 1 := ({ }, [0, 1] { } ), which is also equal to A ⊗0 for any A. Observe that, accordingly to the rules of Linear Logic, we can express the object of linear morphisms in PCoh using only the bifunctor ⊗ and the dual construction on PCSs: indeed, it holds that A B = (A ⊥ ⊗ B) ⊥ . With the bifunctor ⊗, and the linear implication , we have in effect equipped the category PCoh with a symmetric monoidal closed structure, i.e. a model of multiplicative ILL. Proposition 9.2.4 (from [START_REF] Danos | Probabilistic coherence spaces as a model of higher-order probabilistic computation[END_REF]) The category PCoh is symmetric monoidal closed. To obtain a model of multiplicative LL -i.e Linear Logic with only the multiplicative connective ⊗, `, 1-we need to define now a dualizing object ⊥ in the category PCoh, that makes it -autonomous: we take ⊥ := 1 ⊥ . Moreover, we can see that 1 is preserved by dualization, i.e. ⊥ = 1.

M (b 1 ,b 2 ) = 1
(false, true) 1 2 1 2 1 2 1 2 1 2 1 2 1 2 1 2 (c) u ⊗ v ∈ PCoh(Bool ⊗ Bool, Bool ⊗ Bool)
Proposition 9.2.5 (from [START_REF] Danos | Probabilistic coherence spaces as a model of higher-order probabilistic computation[END_REF]) The category PCoh is -autonomous. We illustrate here the use of the dualizing object by considering the PCS (Bool ⊥). Looking at the definition of the linear implication , we see that |Bool ⊥| = {(t, ), (f, )} and P (Bool

⊥) = {x ∈ R |Bool ⊥| + | x (t, ) ≤ 1 ∧ x f, ≤ 1}. Observe that this PCS is isomorphic to Bool ⊥ .
Recall that to have a model of exponential-free LL, we need to build finite products on top of the -autonomous structure of PCoh. It will allow to interpret the additive connective &, and by duality also the additive connective ⊕. Proposition 9.2.6 (from [START_REF] Danos | Probabilistic coherence spaces as a model of higher-order probabilistic computation[END_REF]) PCoh admits Cartesian products of any countable family (A i ) i∈I of PCSs, defined as

|& i∈I A i | := i∈I |A i | = i∈I ({i}×|A i |), P (& i∈I A i ) := v ∈ R + |& i∈I A i | ; ∀i ∈ I, π i v ∈ P (A i )
where π i v is the vector in (R + ) |A i | denoting the i-th component of v, i.e. π i v a := v (i,a) .

Notice that the empty product yields the terminal object defined as | | = ∅ and P ( ) = {0}. We may write the binary product by A 1 & A 2 . If u ∈ P (A) and v ∈ P (B), we note u, v the cartesian product of the vector u and v defined as: for a ∈ P (A), u, v (1,a) = u a , and for b ∈ P (B), u, v (2,b) = v b . When P (A) and P (B) are disjoint, we will also omit the indexes. Observe that any v ∈ P (A 1 & A 2 ) is equal to the pair ( π 1 v, π 2 v ) ∈ P (A 1 ) × P (A 2 ) of its components.

Example 9.2.7 We illustrate the product construct of Proposition 9.2.6 by looking at the PCS Bool & Bool. By definition, P (Bool & Bool) consists of those elements x such that both π 1 x and π 2 x are in P (Bool). For instance, it contains the following element:

x (1,t) = 1 2 x (1,t) = 1 2 and x (2,t) = 1 x (2,f) = 0.
We can see that elements in P (Bool & Bool) encode two independent distribution over the booleans, in contrast with elements in P (Bool ⊗ Bool), that encode one distribution over the set of pairs of booleans.

Observe that using the product construct &, we can easily constructs PCSs that cannot be interpreted as the set of sub-distributions on some underlying set: it is for instance the case of the PCS Bool & Bool of Example 9.2.7.

PCoh as a new-Seely category, hence a model of LL.

We recall here briefly the exponential modality given by Danos and Ehrhard in [START_REF] Danos | Probabilistic coherence spaces as a model of higher-order probabilistic computation[END_REF], that makes PCoh a new-Seely category and as a consequence gives it the structure of a model of linear logic. We call this exponential modality the entire exponential modality, denoted by ! e . The use of the adjective entire is motivated by the fact that the morphisms in the Kleisli category associated to ! e should be seen as entire functions from P (A) to P (B), as we will highlight in this section. We refer to [START_REF] Danos | Probabilistic coherence spaces as a model of higher-order probabilistic computation[END_REF] for details.

Definition 9.2.5 We define a functor ! e : PCoh → PCoh.

• Its action on objects is taken as:

|! e A| := M f (|A|), P (! e A) := {v !e | v ∈ P (A)} ⊥⊥ , (9.2)
where v !e is the promotion of v, i.e. the vector of (R + ) M f (|A|) defined as v !e µ := Notice that the above sum varies on the set of different enumerations of µ. If µ is a multiset [a, . . . , a] of support a singleton, then the sum has only one term, while in case of multisets with no repetitions, the sum has n! terms. Remark also that the definition is independent from the chosen enumeration of ν.

Example 9.2.8 We look to the effect of ! e on the morphisms from Bool to itself. Let us consider the morphism g ∈ PCoh(Bool, Bool) defined at Example 9.2.3. ! e g becomes then a morphism from ! e Bool to itself. First, we see that ! e g µ,ν = 0 whenever the cardinality of µ and ν are not equal. We look then at what happens when we consider multiset ν, µ of cardinality 1:

(! e g) [t],[t] = g (t,t) (! e g) [t],[f] = g (t,f) (! e g) [f],[t] = g (f,t) (! e g) [f],[f] = g (f,f)
So we can see that the projections of ! e g on the set of multiset of cardinality 1 are essentially the linear morphism g. If we consider now the multisets of cardinality 2, we see that for instance:

(! e g) [t 2 ],[t,f] = g (t,t) g (t,f) (! e g) [f 2 ],[t,f] = g (f,t) g (f,f) (! e g) [t,f],[t,f] = g (t,t) g (f,f) + g (t,f) g (f,t)
We see that the coefficients are obtained by looking at all the possible ways to choose how to send elements of the multisets µ into elements of the multiset ν, and then taking into account the cost of sending them using the Markov transition g. . We can however represent them also as functions from P (A) into P (B), as highlighted below.

f :P (A) → (R + ∪ {∞}) |B| x → f x !e
Lemma 9.2.7 (from [START_REF] Danos | Probabilistic coherence spaces as a model of higher-order probabilistic computation[END_REF]) The functional interpretation entirely characterizes the morphisms in PCoh(! e A, B), in the following sense:

• For any f ∈ R M f (|A|)×|B| +
, f is a morphism in PCoh(! e A, B), if and only if the image of the functional interpretation of f is contained in P (B).

• Two morphisms f, g ∈ PCoh(! e A, B) are equal if and only if their functional interpretation f and g coincide.

Observe that the functional interpretation of morphisms in PCoh(! e A, B) are the power series with non-negative coefficients from A cliques into B cliques. We highlight this below on examples for the Bool type.

Example 9.2.10 We consider the denotation of the following two PCF ⊕ programs-for a CBN operational semantics.

M 1 = λx. [if x then (if x then I else Ω) else (if x then Ω else I)] ; M 2 = λx. [if x then (if x then Ω else I) else (if x then I else Ω)] .
These programs take as argument a probability distribution on booleans. At execution time, they both sample two times their argument. M 1 L terminates if and only if the two sampling of L coincide, while M 2 L terminates if and only if the two sampling of L do not coincide.

We represent this idea below by looking at the execution tree:

M 1 L ↓ M 2 L ↑ M 1 L ↑ M 2 L ↓ M 1 L ↓ M 2 L ↑ M 1 L ↑ M 2 L ↓ L ← true L ← false L ← true L ← false L ← true L ← false
The morphism f 1 , f 2 in PCoh(!Bool, 1) interpreting respectively the program M 1 and N 2 are as follows:

f 1 µ, = 1 if µ = [t, t] or µ = [f, f]; 0 otherwise. f 2 µ, = 2 if µ = [t, f]; 0 otherwise.
Observe that the coefficient f i µ, above corresponds to the number of paths in the execution tree such that the multiset consisting of all sample results coincide with µ, and moreover the path end up in a terminating state for M i L. In particular, we see that we can obtain coefficients that are greater that 1, as soon as we consider types build using ! e . Those scalars may become arbitrarily large when we construct programs that sample arbitrarily many times from their argument. We can now look at the functional interpretation of f : it it the function from P (Bool) into P (1) defined as:

f 1 (x) = f 1 x !e = x !e [t,t] + x !e [f,f] f 2 (x) = f 2 x !e = 2 • x !e [t,f] = x 2 t + x 2 f = 2 • x t • x f
We can see that both f 1 and f 2 are polynomials of order two with two indeterminates, that moreover have all their coefficients non-negative.

Example 9.2.11 We present here an example of morphism in PCoh(! e Bool, 1) that is not a polynomial, but is still an analytic function, i.e. a power series. Let us consider the following program of PCF ⊕ , build using the fixpoint construction-see the syntax of PCF ⊕ in Definition 1.3.1 of Chapter 1:

N = fix x B→1 λy. B (if y then I else xy)
This program's behavior is as follows: it takes an argument of boolean type, and samples it repeatedly until it gets the value true. In PCoh, the program N is interpreted as the morphism g ∈ PCoh(! e Bool, 1) defined as:

g µ,b = 1 if ∃n, µ = [f n , t]; 0 otherwise.
Looking now at the functional interpretation of g, we see that g is a power series which has as indeterminates x t and x f :

g(x) = n∈N x n f x t
The functorial promotion is equipped with a structure of comonad. The counit (or dereliction) der A ∈ PCoh(! e A, A) is defined as (der A ) µ,a = δ µ, [a] . The comultiplication (or digging), denoted as digg A ∈ PCoh(! e A, ! e ! e A), is given by (digg A ) µ,M = δ µ, M , where M is the multiset in |! e A| obtained as the multiset union of the multisets in M ∈ |! e ! e A|. Proposition 9.2.8 (from [START_REF] Danos | Probabilistic coherence spaces as a model of higher-order probabilistic computation[END_REF]) PCoh with the co-monad ! e is a new-Seely category, hence a model of Linear Logic.

In particular, contraction contr A ∈ PCoh(! e A, ! e A⊗! e A) and weakening weak A ∈ PCoh(! e A, 1) are given by (contr A ) µ,(µ ,µ ) = δ µ,µ µ , and (weak A ) µ, = δ µ,[ ] . 9.2.3 PCoh ! : a model for higher-order languages with discrete probability.

In [START_REF] Danos | Probabilistic coherence spaces as a model of higher-order probabilistic computation[END_REF], Danos and Ehrhard define a denotational semantics in PCoh ! for both Λ ⊕ and PCF ⊕ . We first look at how the convexity inherent to the PCS structure allows to encode the probabilistic choice: the interpretation of a term M ⊕ N is taken as the morphism

1 2 M + 1 2 N
, where M and N are respectively the denotational interpretation of the terms M and N . Danos and Ehrhard then need to build in PCoh ! the categorical structure allowing to build models of untyped λ-calculus and PCF: as we have already mentioned, it is respectively the existence of a reflexive object, and the existence of a natural numbers object and cpo-enrichment. The reflexive object is obtained in PCoh ! as the fixpoint of the operation A → (!( & n∈N A)) ⊥ . The natural numbers object is the PCS N PCoh that we have presented in Example 9.2.2, while the partial order on morphisms is taken as the componentwise order on matrices-i.e if u, v ∈ PCoh ! (A, B), u ≤ v if for all µ ∈ M f (|B|), and b ∈ |B|, it holds that u µ,b ≤ v µ,b . Observe that this order is stronger that the extensional order on the functional interpretations of morphisms-where the extensional order is taken as: u ≤ ext v if for every x ∈ P (A), u(x) ≤ v(x), with ≤ the componentwise order on |A|.

Building on these elements, Ehrhard and Danos define formally an interpretation of every PCF ⊕ term in PCoh ! . The resulting denotational model has been shown to be fully abstract by Ehrhard, Pagani, and Tasson in [START_REF] Ehrhard | Probabilistic coherence spaces are fully abstract for probabilistic PCF[END_REF]. 9.3 Cstab m : The Category of Measurable cones and measurable stable functions.

We give here a brief overview of the Cartesian closed category Cstab m that was introduced by Ehrhard, Pagani, and Tasson in [START_REF] Ehrhard | Measurable cones and stable, measurable functions: a model for probabilistic higher-order programming[END_REF]. It has been designed to provide a model of higherorder computations with continuous probabilities. To illustrate this, the authors of [START_REF] Ehrhard | Measurable cones and stable, measurable functions: a model for probabilistic higher-order programming[END_REF] built in Cstab m a computationally adequate model of the language PCF sample -the higherorder language with continuous probabilities presented in Chapter 1. The construction of the category Cstab m in [START_REF] Ehrhard | Measurable cones and stable, measurable functions: a model for probabilistic higher-order programming[END_REF] is done in two steps: the authors first built the category Cstab of abstract cones and so-called stable functions between cones, and then defined the category Cstab m as a refinment of Cstab with additional measurability constraints.

We present here the two categories Cstab and Cstab m following the presentation in [START_REF] Ehrhard | Measurable cones and stable, measurable functions: a model for probabilistic higher-order programming[END_REF].

All the results we state in this section have also been extracted from [START_REF] Ehrhard | Measurable cones and stable, measurable functions: a model for probabilistic higher-order programming[END_REF].

Cones

The use of a notion of cones in denotational semantics to deal with probabilistic behavior goes back to Kozen [START_REF] Kozen | Semantics of probabilistic programs[END_REF]. We take here the same definition of cone as in [START_REF] Ehrhard | Measurable cones and stable, measurable functions: a model for probabilistic higher-order programming[END_REF].

Definition 9.3.1 A cone C is a R + -semimodule given together with an R + valued function • C called norm of C, and verifying:

x + y = x + y ⇒ y = y αx C = α x C x + x C ≤ x C + x C x C = 0 ⇒ x = 0 x C ≤ x + x C
The most immediate example of cone is the non-negative real half-line, when we take as norm the identity. Another example is the positive quadrant in a 2-dimensional plane, endowed with the euclidean norm. In a way, the notion of cone is the generalization of the idea of a space where all elements are non-negative. This analogy gives us a generic way to define a pre-order, using the + of the cone structure.

Definition 9.3.2 Let be C a cone. Then we define a partial order C on C by: x C y if there exists z ∈ C, with y = x + z.

If x C y, we will denote by y -x the-unique-element z such that y = x + z. We define BC as the set of elements in C of norm smaller or equal to 1. We will sometimes call it the unit ball of C. Moreover, we will also be interested in the open unit ball B • C, defined as the set of elements of C of norm smaller than 1. In [START_REF] Ehrhard | Measurable cones and stable, measurable functions: a model for probabilistic higher-order programming[END_REF], the authors restrict themselves to cones verifying a completeness criterion: it allows them to define the denotation of the recursion operator in PCF sample , thus enforcing the existence of fixpoints.

Definition 9.3.3 A cone C is said to be sequentially complete if any non-decreasing sequence (x n ) n∈N of elements of BC has a least upper bound sup n∈N x n ∈ BC.

We illustrate Definition 11.1.1 by giving the sequentially complete cone used in [START_REF] Ehrhard | Measurable cones and stable, measurable functions: a model for probabilistic higher-order programming[END_REF] as the denotational semantics of the base type R in PCF sample .

Example 9.3.1 We take Meas(X) as the set of finite measures over a measurable space X and we take µ Meas(X) = µ(X) as the underlying norm. It holds that Meas(X) is a sequentially complete cone, and moreover its unit ball is exactly the set of sub-probability measures.

The cone Meas(R) -where R is endowed with the Borel σ-field as done in Example 1.4.1 in Chapter 1-allows to model continuous data, as shown in [START_REF] Ehrhard | Measurable cones and stable, measurable functions: a model for probabilistic higher-order programming[END_REF]: indeed we can interpret in it the term r of PCF sample for every r ∈ R: we take its denotational semantics as δ r , the Dirac measure with respect to r defined by taking δ r (U ) = 1 if r ∈ U , and δ r (U ) = 0 otherwise. Example 9.3.2 We look now at another example of sequentially complete cone. We fix X a measurable space, and µ a measure on X. We take as cone the set of measurable function X → R + for some measurable space X, with the norm given as f = A f dµ. Lebesgue Monotone Convergence Theorem-see [START_REF] Royden | Real analysis[END_REF]-shows that this cone is sequentially complete. Definition 9.3.4 The product cone is defined as andx i∈I C i = sup i∈I x i C i . We denote by C 1 × C 2 the binary product i∈{1,2} C i .

i∈I C i = {(x i ) i∈I | ∀i ∈ I, x i ∈ C i },
The object of the category Cstab are going to be sequentially complete cones. We need now to look at the morphisms between such cones. The relevant part of the cone for interpreting programs is actually its unit ball: as a consequence, our morphisms from a cone C into a cone D are going to be a particular class of functions BC → D. Definition 9.3.5 Let C, D be cones. We call cone-functions from C to D the functions BC → D.

• We say that a cone function f from C to D is bounded, if there exists α > 0 such that f (BC)

⊆ α • BD = {α • x | x ∈ BD}.
We say that f is 1-bounded if it holds with α = 1.

• We say that a bounded cone function is sequentially Scott-continuous if it is nondecreasing, and it commutes with the least upper bound of non-decreasing sequences.

It is standard, in order-based denotational models, to ask morphisms to be Scottcontinuous. We can first observe that the addition and the scalar operation-seen as cones functions-of a sequentially complete cone are always Scott-continuous. However, Ehrhard Pagani and Tasson remarked that if we take as morphisms all Scottcontinuous and 1-bounded cones functions, the resulting category is not Cartesian closed. We sum up briefly the problem here; it essentially comes from the fact that the cone order on Scott-continuous functions is much stronger than the extensional order. First, we will consider the denotation of Abramsky's parallel convergence tester -it takes two programs, and terminates if at least one of them terminates; see Chapter 5 for a more detailed computational description.

T (x, y) = x + y -x • y.
The cone function T is 1-bounded, non-decreasing, and also Scott-continuous-it can be seen by observing that it is continuous in the sense of real analysis.

Suppose now that the category of sequentially complete cones, and Scott-continuous 1bounded cones functions is Cartesian closed. It means that we can consider the currying of T , that is a morphism T curr : 1 → (1 ⇒ 1). Since it is a morphism, it has to be non-decreasing, and as a consequence T curr (0) ≤ T curr (1). It's here that the fact that we take an order on cones much stronger than the extensional order intervenes: indeed, what the previous inequality means is that there exists a 1-bounded non-decreasing Scottcontinuous function g : B1 → 1 such that T curr (0) + g = T curr (1). However, we can see that:

T curr (0, •) :B1 → 1 T curr (1, •) :B1 → 1 z → z z → 1,
and as a consequence we should have g = 1 -z. We reach a contradiction here, because it means that g isn't non-increasing: it proves that the category we considered cannot be Cartesian closed.

To obtain a Cartesian closed category, Ehrhard Pagani and Tasson ask for an additional condition, i.e. the stability condition presented in the next section. Another possibility would be to relax the requirement of Scott-continuity, by asking them to be Scott-continuous for the extensional order, instead of the cone order. It is similar to what is done for Kegelspitzen, for instance in [START_REF] Plotkin | Mixed powerdomains for probability and nondeterminism[END_REF]. However, sticking with the cone order and adding the stability condition also allows to put more constraints on the morphisms. 9.3.2 Cstab: The Category of cones and stable functions.

Stable functions on cones are a generalization of well-known absolutely monotonic functions in real analysis: they are those functions f : [0, ∞) → R + which are infinitely differentiable, and such that moreover all their derivatives are non-negative. The relevance of such functions in real analysis comes from a result due to Bernstein: every absolutely monotonic function coincides with a power series. Moreover, it is possible to characterize absolutely monotonic functions without explicitly asking for them to be differentiable: it is exactly those functions such that all the so-called higher-order differences-which are quantities that can be define for any real function-are non-negative. (see [START_REF] Widder | Laplace Transform (PMS-6)[END_REF], chapter 4). The definition of pre-stable functions in [START_REF] Ehrhard | Measurable cones and stable, measurable functions: a model for probabilistic higher-order programming[END_REF] generalizes this characterization.

First, we want to be able to talk about those u = (u 1 , . . . , u n ), such that x + u i C ≤ 1 for a fixed x ∈ BC, and n ∈ N. To that end, we introduce a cone C n x whose unit ball is exactly such elements. It is an adaptation of the definition given in [START_REF] Ehrhard | Measurable cones and stable, measurable functions: a model for probabilistic higher-order programming[END_REF] for the case where n = 1, and we show in the same way that it is indeed a cone. x the cone C n endowed with the following norm:

(u 1 , . . . , u n ) C n x = inf    1 r | x + r • 1≤i≤n u i ∈ BC ∧ r > 0    .
For n ∈ N, we use P + (n) (respectively P -(n)) for the set of all subsets I of {1, . . . , n} such that n -card(I) is even (respectively odd). We are now ready to introduce higher-order differences. Since we have only explicit addition, not subtraction, we define separately the positive part ∆ n + and the negative part ∆ n -of those differences: For f : BC → D, x ∈ BC, u ∈ BC n

x , and ∈ {-, +}, we define:

∆ n (f )(x | u) = I∈P (n) f (x + i∈I u i ) Definition 9.3.8
We say that a cone function f : BC → D is pre-stable if, for every n ∈ N, for every x ∈ BC, u ∈ BC n x , it holds that:

∆ n -(f )(x | u) ≤ ∆ n + (f )(x | u). If f is pre-stable, we will set ∆ n f (x | u) = ∆ n + f (x | u) -∆ n -f (x | u).
Observe that the quantity ∆ n f (x | u) is actually symmetric in u, i.e. stable under permutations of the coordinates of u. Definition 9.3.9 A cone function f : BC → D is called a stable function from C to D if it is bounded, sequentially Scott-continuous, and pre-stable. Definition 9.3.10 The category Cstab has as objects the sequentially complete cones, and as morphisms from C to D the stable functions f from C to D such that f (BC) ⊆ BD.

It was shown in [START_REF] Ehrhard | Measurable cones and stable, measurable functions: a model for probabilistic higher-order programming[END_REF] that it is possible to endow Cstab with a Cartesian closed structure.

The function cone C ⇒ D is the set of all stable functions, with f C⇒D = sup x∈BC f (x) D . It was also shown in [START_REF] Ehrhard | Measurable cones and stable, measurable functions: a model for probabilistic higher-order programming[END_REF] that these cones are indeed sequentially complete, and that the lub in C ⇒ D is computed pointwise. We will use also the cone of pre-stable functions from C to D, which is also sequentially complete.

Adding Measurability Requirements

In order to obtain a model of PCF sample based on stable functions, the authors of [START_REF] Ehrhard | Measurable cones and stable, measurable functions: a model for probabilistic higher-order programming[END_REF] imposed measurability requirements to the category Cstab. The necessity of taking into account the measurability appears when looking at the denotational semantics of the let x = M in N . First, recall the typing rule for the let • = • in construct: Γ, x : R M : R Γ N : R Γ let x = N in M : R

The interpretation of those typing judgments-in the case where Γ is the empty typing context-in the denotational model should be as follows:

x : R M : R : Meas(R) → Meas(R)

N : R : Meas(R)
The computational behavior of the term let x = N in M is as follows: first it samples from the distribution over reals encoded by M , and then it executes the program N with replacing the variable x by the result of the sampling. To express this behavior mathematically, we would like let x = N in M : R to be the measure over R expressed as follows:

let x = N in M : R : Borels(R) → R + U → r∈R g U (r)dµ
where the measure µ is obtained as µ = Γ N : R , and the function g U : R → R + is defined as g U (r) = let x = N in M : R ({r 1 })(U ). However, to be able to write this integral, we need to be sure that the function g U is measurable. It is for this purpose that Ehrhard Pagani and Tasson impose additional measurability constraint at all types, thus refining the category Cstab into another category Cstab m .The objects of Cstab m are going to be complete cones, endowed with a family of measurability tests.

If C is a complete cone, we denote by C the set of linear and Scott-continuous functions C → R + . Definition 9.3.11 A measurable cone (MC) is a pair consisting of a cone C, and a collection of measurability tests (M n (C)) n∈N ), where for every n, M n (C) ⊆ C R n , such that:

• for every n ∈ N, 0 ∈ M n (C);

• for every n, p ∈ N, if l ∈ M n (C), and h : R p → R n is a measurable function, then l • h ∈ M p (C);

Chapter 10

! is the free comonoid in PCoh.

As we developed at some length in Chapter 9, distinct exponential structures may coexist in a model of Linear Logic. The axiomatisation proposed by Lafont, where the exponential modality !A is the free comonoid generated by A, leads to a genericity criterion, since there is at most one free exponential modality in a model, and moreover it allows-up to some point, see the considerations in Section 9.1.2-to factorize every other exponential structure. The free exponential modality is well-known in both the coherence space model of LL Coh-see Example 9.1.1 in Chapter 9-and the relational model of LL Rel, being given respectively by the multi-clique and the multi-set functors. The goal of this chapter is to prove the existence of and to study the free exponential modality of the category PCoh of probabilistic coherence spaces. The only known exponential modality of PCoh is the entire exponential modality ! e , introduced by Danos and Ehrhard in [START_REF] Danos | Probabilistic coherence spaces as a model of higher-order probabilistic computation[END_REF], that we have presented in Chapter 9, and which is based on the notion of entire function. It is then natural to ask whether ! f exists in PCoh and if it is the case, how it relates with ! e . In this chapter, we answer the first question positively and prove that ! f and ! e are the same modality, in spite of their different presentations. This result was published in a joint work with Ehrhard, Pagani and Tasson in [START_REF] Crubillé | The free exponential modality of probabilistic coherence spaces[END_REF].

Our main tool is a recipe given by Melliès, Tabareau and Tasson [START_REF] Melliès | An explicit formula for the free exponential modality of linear logic[END_REF] for constructing ! f out of a model of the multiplicative additive fragment of LL-i.e. a -autonomous category with finite products, see Chapter 9. The idea is to adapt the well-known formula defining the symmetric algebra generated by a vector space, the latter being the free commutative monoid. More precisely, the recipe gives (under suitable conditions) ! f A as the limit of a sequence of approximates A ≤n which correspond to the equalizers of the tensor symmetries of a suitable space (see Section 10.1). At a first sight, A ≤n moves us far away from the entire exponential ! e A of [START_REF] Danos | Probabilistic coherence spaces as a model of higher-order probabilistic computation[END_REF], in fact the coefficients appearing in A ≤n are greater than those of ! e A, so that one is tempted to suppose that ! f A is a space much bigger than ! e A, exactly as it is the case for standard coherence spaces where the images under the finite multi-clique functor strictly contain those under the finite clique functor (Example 9.1.1). For any n, the coefficients of A ≤n are larger than those of ! e A, but as n → ∞, these coefficients tend to be exactly those of ! e A (see Section 10.3).

Melliès, Tasson and Tabareau's formula

Melliès et al. give a recipe for constructing free commutative comonoids in [START_REF] Melliès | An explicit formula for the free exponential modality of linear logic[END_REF], adapting the well-known formula defining the symmetric algebra generated by a vector space in the setting of LL. This adaptation is non-trivial mainly because the vector space construction uses biproducts, while products and coproducts are in general distinct in LL models, and in fact this is the case for PCoh. The idea of [START_REF] Melliès | An explicit formula for the free exponential modality of linear logic[END_REF] is to define ! f A as the projective limit of the sequence of its "approximates" A ≤0 , A ≤1 , A ≤2 , . . . , where an approximate A ≤n is the equalizer of the n! tensor symmetries over (A & 1) ⊗n . Intuitively, the object A ≤n describes the behavior of data of type ! f A when duplicated at most n times. This behavior is given by the equalizers of the tensor symmetries because the model does not distinguish between the evaluation order of the n copies (in categorical terms, we are considering commutative comonoids). We start from A & 1 instead of A because, in order to have a sequence, we need that each A ≤n in some sense encompasses its predecessors A ≤0 , A ≤1 , . . . , A ≤n-1 . The exact meaning of "to encompass" is given by a family of morphisms p n,n-1 ∈ C(A ≤n , A ≤n-1 ) generated by the right projection of the product A & 1 (see Definition 10.1.9). In standard coherence spaces, this turns out to be the simple fact that the set of cliques of A ≤n+1 contains the cliques of A ≤n . In contrast, this intuition is misleading for PCoh (Example 10.2.5), making our construction considerably subtler.

The tensor product of n objects

This section deals with the formal definition of the categorical object A ⊗n , as well as the n! symmetries over it, in the setting of any symmetric monoidal category. The formal construction is a bit involved, but we deemed necessary to include this presentation here, because symmetries are the basic building blocks of the categorical construction done by Melliès, Tabareau and Tasson, on which we rely heavily for this work. However, as it will be highlighted in Example 10.1.7, the concrete symmetry morphisms in PCoh are actually quite simple, and can be easily inferred from the definition of the ⊗ bifunctor-Definition 9.2.4 from Chapter 9.

To handle the tensor product of n objects in a monoidal category C, we would like to consider an object of the form A 1 ⊗ (A 2 ⊗ (. . .)), but we have to be careful since there are different possible ways to do the bracketing. In [START_REF] Lane | Categories for the working mathematician[END_REF], Mac Lane encodes syntactically those bracketing as ⊗-words. Definition 10.1.1 The set of ⊗-words is generated by the following grammar:

w ::= 1 | | (w ⊗ w)
We associate inductively a length to all ⊗-words, by taking length(1) = 0, length( ) = 1 and length(w ⊗ w ) = length(w) + length(w ).

For any ⊗-word of length n, and any MC C, we define a functor w C : C n → C, as follows: when A 1 , . . . , A n are objects of C, w C (A 1 , . . . , A n ) is defined inductively on the length n of w as:

1 C () = 1 C ; ( ) C (A) = A; (w ⊗ w ) C (A 1 , •, A n , A n+1 , •, A n+m ) = w C (A 1 , •, A n ) ⊗ C w C (A n+1 , •, A n+m )
when w of length n, w of length m.

w C (A 1 , . . . , A 4 ) = (A 1 ⊗ C A 2 ) ⊗ C (A 3 ⊗ C A 4 ) w C (A 1 , . . . , A 4 ) = 1 C ⊗ C (A 1 ⊗ C (A 2 ⊗ C (A 3 ⊗ C A 4 ))).
Notation 10.1.1 We illustrate here how the functors w allow to formalize the different ways of bracketing a tuple of elements. We place ourselves in the symmetric monoidal category Set, when we take the monoidal product as ×-the cartesian product on sets-and the set with a unique element { } as 1 Set . If a 1 , . . . , a n are n elements of some set X, we note w Set (a 1 , . . . , a n ) for the unique element in the set w({a 1 }, . . . , {a n }). With this notation, we see that if we consider for instance the ⊗-word w = ( ⊗ ) ⊗ ( ⊗ ), w Set (a 1 , a 2 , a 3 , a 4 ) is the tuple ((a 1 , a 2 ), (a 3 , a 4 )), while if we take w = 1⊗( ⊗( ⊗( ⊗ ))), we obtain w Set (a 1 , a 2 , a 3 , a 4 ) = ( , (a 1 , (a 2 , (a 3 , a 4 )))).

Notation 10.1.2 Recall that when we presented the bifunctor ⊗ for PCoh-in Definition 9.2.4 of Chapter 9-we also defined a tensorial product ⊗ on vectors with nonnegative real coefficients: if

x ∈ R X + , y ∈ R Y + , x ⊗ y is the vector in R X×Y + defined as (x ⊗ y) (v,w) = x v • y w .
Below, we formalize the n-tensor product of such vectors by using the functors w from Definition 10.1.1. We will indeed need to talk about n-tensor products of vectors when considering the n-tensor product in the category PCoh.

We define the category Vect as follows: the objects are the pair (A, x) such that A is a countable set, and x ∈ R A + , and the only morphisms in the category are the identity morphisms. We endow Vect with a symmetric monoidal structure: the action of ⊗ on objects is as follows (A, x) ⊗ (B, y) = (A × B, x ⊗ y), where (x ⊗ y) a,b = x a • y b for every a ∈ A, b ∈ B, accordingly to what we did in Definition 9.2.4. Since the only morphisms are the identity morphisms, we define ⊗ on morphisms as id A,x ⊗id B,y = id (A,x)⊗(B,y) . We take as 1 Vect the pair ( , 1). If x ∈ R A + , we will also note simply x for the object (A, x) in Vect. To illustrate the notation, we see that if w = ( ⊗ ) ⊗ , then w Vect ( 1 2 e t + 1 2 e f , e t , e f ) =

1 2 e ((t,t),f) + 1 2 e ((f,t),f) ∈ R {t,f} 3 + .
We look now at the unitary restriction of the functors w, i.e. when they are seen as functors C → C instead of C n → C. Indeed recall that our goal in this part is to investigate the n-th tensor product of a single object A. For every n ∈ N, we define a particular ⊗-word w n : it is the ⊗ word of length n that corresponds to the precise bracketing ((( ⊗ ) ⊗ ) . . .), i.e. the rightmost bracketing. We call n power of A the object A ⊗n := w n C (A).

Observe that the bracketing is chosen in such a way that A ⊗n+1 = A ⊗n ⊗ A. We illustrate her the n-th tensor power when applied to the category PCoh: recall indeed that we are primarily interested in applying Melliès, Tabareau and Tasson recipe to this concrete SMC.

Example 10.1.2 Let be n ∈ N, and A be a PCS. Recall the definition of the bifunctor ⊗ in PCoh-given in Definition 9.2.4. We see that A ⊗n is the PCS described as follows:

A ⊗n = { w Set (a 1 , . . . , a n ) | ∀i, a i ∈ |A|} P A ⊗n = { w Vect (x 1 , . . . , x n ) | ∀i, x i ∈ P (A)} ⊥⊥
The next step is to look at how we can go from one bracketing to another, when using only the morphisms induced by the monoidal structure of C, i.e. a, l, r and their inverses. Observe that, as we illustrate in Example 10.1.3 below, if w 1 and w 2 are two different ⊗-words, then there may actually be several different ways to construct such morphism from w 1 (A) to w 2 (A).

Example 10.1.3 Let C be a monoidal category. We consider the two ⊗-words w 1 = ((( ⊗ ) ⊗ ) ⊗ ), and w 2 = ( ⊗ ( ⊗ ( ⊗ ))). The two paths in the diagram below represent two different ways to go from the bracketing specified by w 1 to the one specified by w 2 .

((A ⊗ A) ⊗ A) ⊗ A (A ⊗ (A ⊗ A)) ⊗ A (A ⊗ A) ⊗ (A ⊗ A) A ⊗ ((A ⊗ A) ⊗ A) A ⊗ (A ⊗ (A ⊗ A)) a A,A,A ⊗id A a A⊗A,A,A a A,A⊗A,A a A,A,A⊗A id A ⊗a A,A,A
From the coherence diagrams for a symmetric monoidal category-that we recalled in Definition 9.1.4 from Chapter 9-it it possible to show that the diagram above commutes. As a consequence these two different ways to go from w 1 to w 2 are equivalent.

As illustrated in Example 10.1.1, the morphisms induced by the monoidal structure may be combined in different ways to go from one bracketing to another. Mac Lane shows in [START_REF] Lane | Categories for the working mathematician[END_REF] a coherence theorem, that states that all these combinations lead actually to the same morphism in the category C. We first define syntactic expressions to handle the construction of those morphisms. We say that a formal SMC morphism is a syntactic element generated by the following grammar.

e ::= (e ⊗ e) | e -1 | id w | l w | r w | a w 1 ,w 2 ,w 3 | e • e,
where w, w 1 , w 2 , w 3 are ⊗-words. To an expression e, we can associate in a natural way both a domain D(e) and a co-domain C(e), that are ⊗-words. Observe that we cannot in fact do this for all expressions, but for those which are valid, i.e. such that • occurs only between expressions such that the domain of the first and the codomain of the second coincide.

Definition 10.1.3 We say that a formal morphism e is valid if it is possible to associate to it a domain Dom(e) and a codomain C(e) under the inductive procedure of Figure 10.1. [idw We illustrate here how we interpret a formal morphism in some monoidal category C. We consider the formal morphism

D(idw) = w C(idw) = w D(lw) = 1 ⊗ w C(lw) = w D(rw) = w ⊗ 1 C(rw) = w D(aw 1 ,w 2 ,w 3 ) = (w1 ⊗ w2) ⊗ w3 C(aw 1 ,w 2 ,w 3 ) = w1 ⊗ (w2 ⊗
] C A = id C w C (A) [lw] C A = l C w C (A) [rw] C A = r C w C (A) [aw 1 ,w 2 ,w 3 ] C A = a C w 1 C (A),w 2 C (A),w 3 C (A) [e ⊗ e ] C = [e] C ⊗ [e ] C [e -1 ] C = ([e] C ) -1 [e • e ] C = [e] C • [e ] C
e = (id ⊗ ⊗ l -1 ) • a -1 , ,
It is indeed a valid morphism, since we are able to attribute a domain and a codomain to e, by following the procedure in Figure 10.1. We represent graphically this procedure below, by splitting e into its basic components, and exhibiting the domain and codomain for each of them.

⊗ ( ⊗ ) ( ⊗ ) ⊗ ( ⊗ ) ⊗ (1 ⊗ ) a -1 , , id ⊗ ⊗l -1
It means that Dom(e) = ⊗ ( ⊗ ), while C(e) = ( ⊗ ) ⊗ (1 ⊗ ). Since e is a valid formal morphism, it has an interpretation in every MC C: for every object

A in C, [e] C A is the C morphism in A ⊗ (A ⊗ A) → (A ⊗ A) ⊗ (1 C ⊗ A) built as follows: A ⊗ (A ⊗ A) (A ⊗ A) ⊗ A (A ⊗ A) ⊗ (1 ⊗ A) a -1 A,A,A id A⊗A ⊗l -1 A
As stated in Mac Lane's Coherence Theorem below, if we take any two expression e and e with the same domain and codomain, then their interpretation in any MC C coincide. Moreover, there always exists such an interpretation between two ⊗ words of same length.

Proposition 10.1.3 (Mac Lane's Coherence Theorem) Let C be a monoidal category, and w 1 , w 2 be two ⊗-words of length n. Then for every object A, there exists a unique (natural) isomorphism w 1 C (A) → w 2 C (A) which is the interpretation of a valid SMC formal morphism.

As a consequence of the coherence theorem, every formal morphism-i.e. resulting from the interpretation of a formal morphism with w n as both domain and co-domain-that we can draw from A ⊗n to itself coincide with id A ⊗n .

When moreover the category C is a symmetric monoidal category, we can also use the symmetry swap on the object A ⊗n , and we obtain a new class of formal endomorphisms on A ⊗n . Definition 10.1.5 The SMC formal morphisms are the syntactic expression generated by the grammar below:

e ::= e ⊗ e | e -1 | id w | l w | r w | a w 1 ,w 2 ,w 3 | e • e | swap w 1 ,w 2 ,
where w, w 1 , w 2 , w 3 are ⊗ words.

We now extend the definition of valid formal morphisms, domain and codomain to this new class of formal morphisms. We need to extend both the definition of domain and codomain from Figure 10.1, and the definition of interpretations from Figure 10.2 to the SMC formal morphisms, i.e. to specify how we deal with the formal morphism swap w 1 ,w 2 .

D(swap w 1 ,w 2 ) = (w 1 ⊗ w 2 ) C(swap w 1 ,w 2 ) = (w 2 ⊗ w 1 ) [swap w 1 ,w 2 ] C A = swap C w 1 C (A),w 2 C (A)
Observe that it is not necessarily true-i.e. false in the non trivial case-that the interpretations of all SMC formal morphisms with w n as both domain and codomain coincide with the identity on A ⊗n . This phenomenon is highlighted in Example 10.1.5 below.

Example 10.1.5 Let C be any SMC. Observe that we can construct for instance a formal morphism f with w 3 = ( ⊗ ) ⊗ as both domain and codomain, as follows:

( ⊗ ) ⊗ ( ⊗ ) ⊗ ⊗ ( ⊗ ) ( ⊗ ) ⊗ ⊗ ( ⊗ ) swap , ⊗id a , , id ⊗swap , a -1 , ,
It does not hold in general-and indeed it does not holds in PCoh, that the interpretation of f and the interpretation of id coincide on every A ⊗3 .

What actually happens is that a formal morphism is not characterized just by its domain and co-domain anymore, but also by its underlying permutation, that keep track of all the transposition done while applying the morphism, and that can be defined inductively on the structure of formal morphisms. Mac Lane showed for SMC a similar coherence theorem as the one for MC: essentially it states that every formal diagrams generated by the structural SMC morphisms commute as soon as they have the same underlying permutation, and that moreover such a diagram exist for every permutation. Then for every permutation σ, there exists a unique natural isomorphism A ⊗n → A ⊗n which is the interpretation of a formal morphism with w n as domain and codomain, and underlying permutation σ. We will call symmetry specified by σ over A ⊗n this isomorphism, and we will denote it s σ A : A ⊗n → A ⊗n .

Example 10.1.7 Let A be a PCS. Recall the expression of A ⊗n from Example 10.1.2. For every n ∈ N, and σ ∈ S n , we can see that s σ A ∈ PCoh(A ⊗n , A ⊗n ) is the matrix defined as follows:

(s σ A ) w n (a 1 ,...,an),w n (a 1 ,...,a n ) = δ a 1 ,a σ(1) . . . δ a n ,a σ(n) .
In the following, we will use sequences of the form a = a 1 , . . . , a n to represent the elements w n (a 1 , . . . , a n ) ∈ |A ⊗n |. We will also use x 1 ⊗ . . . ⊗ x n to represent w n (x 1 , . . . , x n ), when the x i are vectors with non-negative real coefficients.

The Equalizer of symmetries

We present now the first building block of Melliès, Tabareau and Tasson's construction: it consists in building the exponential approximations A ≤n , for every order n ∈ N. These A ≤n are taken as-when it exists-the equalizer of the n! symmetries from (A & 1) ⊗n .

Here, we recall the definition of equalizers in category theory, as well as Melliès, Tabareau, Tasson's definition of the exponential approximations. A,B). An equalizer of the (f i ) 1≤i≤n is a pair (E, eq E ), where E is an object in C, and eq E ∈ C(E, A), such that:

A B E f 1 fn eq E . . . ∀i, j, (f i • eq E = f j • eq E ) A B E C f 1 fn eq E g ∃!g † . . . Universal property: ∀i, j f i • g = f j • eq E ⇒ ∃!g † , g = eq E • g †
Observe that there is no guarantee on the existence of such equalizer. However, as soon as it exists, the universal property implies that the equalizer object is unique up to (unique) isomorphism. Melliès, Tabareau and Tasson's construction does not only ask for the existence of some equalizers, but also ask for those to commute with the tensor product, in the sense of Definition 10.1.8 below. Definition 10.1.8 (Commutation of an equalizer with ⊗) Let C be a monoidal category, A 1 , A 2 two objects of C, and f 1 , . . . , f n a family of morphisms in C(A 1 , A 2 ). We suppose that the equalizer of the (f i ) 1≤i≤n exists, and we denote it by (E, eq E ). We say that this equalizer commutes with the tensor product, if for every object B in C, (E ⊗ B, eq E ⊗ id B ) is an equalizer for the family of morphisms

(f i ⊗ id B : A 1 ⊗ B → A 2 ⊗ B) 1≤i≤n .
Looking at Definition 10.1.8 we can see that asking for an equalizer (E, eq) for the (f i ) 1≤i≤n to additionally commutes with the tensor product actually boils down to require the following additional universal property:

E ⊗ B A 1 ⊗ B C eq E ⊗ id B A 2 ⊗ B . . . (f i ⊗ id B ) i∈N g ∃!g † (10.1)
Melliès, Tabareau and Tasson's construction asks for equalizers to exist for very specific families of morphisms: the symmetry morphisms over objects build as (A & 1) ⊗n . We consider from now on C to be a SMC with finite products. Recall that the symmetry morphisms s σ A are the one formalized in Proposition 10.1.4. Once such equalizers are obtained, Melliès, Tabareau and Tasson use them to define the exponential approximations to all orders, that will be used in the next step of the construction to build the free exponential structure. Definition 10.1.9 (Exponential Approximations) Let C be a SMC with finite products, such that for every object A, and every n ∈ N, the equalizer of the family of morphisms s σ A&1 : (A & 1) ⊗n → (A & 1) ⊗n exists. Then we denote by (A ≤n , eq A ≤n ) this equalizer, and we say that the object A ≤n is the exponential approximation of the object A at order n.

We sum up graphically below the requirements for the A ≤n -they are inferred from the relevant instantiation of Definition 10.1.7.

A ≤n (A&1) ⊗n C eq A ≤n (A&1) ⊗n . . . n! symm. f ∃!f † Universal property of (A ≤n , eq): ∀C, ∀f ∈ C(C, (A ⊗ 1) ⊗n ) invariant under ⊗ symm., ∃!f † ∈ C(C, A ≤n ) making the adjacent dia- gram commute.
The exponential approximation A ≤n should be understood as follows: it contains the resources of type A that can be duplicated as most n times. If we go on with this analogy, we see that whenever a resource of type A may be duplicated at most n + 1 times, we can discard the information about its n + 1-th occurrence, and obtain a resource that may be duplicated at most n times. Melliès, Tabareau and Tasson formalize this in their categorical framework by looking at the canonical projection morphisms A ≤n+1 → A ≤n , that arise from the universal property for exponential approximations as described below.

Definition 10.1.10 Let C be a SMC with products, and n ∈ N such that both A ≤n and A ≤n+1 are defined. We define the projection morphism at order n, that we note p n+1,n as the morphism in C(A ≤n+1 , A ≤n ) obtained by applying the universal property of the equalizer (A ≤n , eq A ≤n ) to:

• the object C = A ≤n+1 • the morphism f : C → A ≤n taken as f = r (A&1) ⊗n • (id ⊗ π 2 ) • eq A ≤n+1 , with π 2 denoting the right projection of A & 1.
We represent graphically the definition of p n+1,n below:

A ≤n (A&1) ⊗n (A & 1) ⊗n ⊗ 1 (A & 1) ⊗n+1 A ≤n+1 eq A ≤n (A&1) ⊗n . . . n! symm. eq A ≤n+1 id (A&1) ⊗n ⊗ π 2A&1 r (A&1) ⊗n ∃!p n+1,n
10.1.3 The free Commutative Comonoid as limit of the exponential approximations.

To complete their construction, Melliès, Tabareau and Tasson assume the existence of the exponential approximations to all orders, and additionally ask for the existence of a categorical limit to the diagram formed by the projection morphisms between them. More precisely, the idea is to look at the diagram ∆ ≤ below, that sums up the action of the projection morphisms on the A ≤n and to take ! f A as the limit cone, when it exists, of this diagram ∆ ≤ -what it precisely meant for such a diagram to have a limit will be stated later in Definition 10.1.12:

∆ ≤ : A ≤0 A ≤1 A ≤2 A ≤3 . . . p 4,3 p 3,2 p 2,1 p 1,0
The next definitions deal with the formal presentation of limit cones for diagrams that are chain-like-i.e. that have the same shape as ∆ ≤ . There is in fact also a generic categorical way to define the limit object of an arbitrary diagram, that can be found for instance in [START_REF] Lane | Categories for the working mathematician[END_REF], but for this work we need to consider only chain-like diagram. We actually split our definition in two parts: in Definition 10.1.11 below, we define projective cones for chain-like diagram, and then we take the limit cone as the most general projective cone, in a sense formalized by a universal property that we give in Definition 10.1.12. Definition 10.1.11 (∆-cone) Let C be a category, and ∆ a chain-like diagram, i.e. that consists of a family of objects (A i ) i∈N and a family of morphisms (f i+1,i :

A i+1 → A i ) i∈N : ∆ : A 1 A 2 A 3 A 4 . . . f 4,3 f 3,2 f 2,1 f 1,0
A projective cone based on ∆ is an object C, and a family of morphisms (g i : C → A i ) i∈N such that ∀i ∈ N, (g i = f i+1,i • g i+1 ) i.e. the following diagram commute:

A 0 A 1 A 2 . . . . . . C . . . f 3,2 f 2,1 f 1,0 g 0 g 1 g 2
A chain-like diagram ∆ admits a limit when one of its projective cones is more general than all the others. We formalize this idea by a universal property in Definition 10.1.12 below.

Definition 10.1.12 Let C be a category, and ∆ = (

(A i ) i∈N , f i+1,i : A i+1 → A i ) a chain- like diagram. A limit cone for the diagram ∆ is a projective cone based on ∆ (A ∞ , (f ∞,i : A ∞ → A i ))
such that: for every projective cone based on ∆ (C, (g i :

C → A i ) i∈N ) ∃!u : C → A ∞ such that ∀i ∈ N, (g i = f ∞,i • u).
We represent this requirement graphically below:

A 0 A 1 A 2 . . . . . . A ∞ C . . . f ∞,0 f ∞,1 f ∞,2 f 3,2 f 2,1 f 1,0 g 0 g 1 g 2 ∃! u
We say that moreover the limit cone

(A ∞ , (f ∞,i : A ∞ → A i ) i∈N ) of the diagram ∆ com- mutes with tensor products, if the projective cone (A ∞ ⊗ B, (f ∞,i ⊗ id B : A ∞ ⊗ B → A i ⊗ B) i∈N )
is the limit cone of the diagram ∆ ⊗ B taken as:

∆ ⊗ B : A 0 ⊗ B A 1 ⊗ B A 2 ⊗ B . . . f 3,2 ⊗ id B f 2,1 ⊗ id B f 1,0 ⊗ id B
Observe that the universal property specified in Definition 10.1.12 above guarantees that as soon as the limit of ∆ exists, it is unique-as usual, up to unique isomorphism. The result of Melliès, Tabareau and Tasson in [START_REF] Melliès | An explicit formula for the free exponential modality of linear logic[END_REF] said that: assuming the existence of all the A ≤i , and moreover of a limit cone for ∆ ≤ , as well as some additional requirements with respect to the commutation of these structures with ⊗, it holds that the limit cone of ∆ ≤ is exactly the free commutative comonoid. It means that when we start from a category C which is already a model of exponential-free LL-i.e. -autonomous, see Chapter 9-we obtain this way a Lafont model-see Section 9.1.2-and consequently a sound model of LL.

We state formally this result in Proposition 10.1.5 below.

Proposition 10.1.5 (Melliès, Tabareau Tasson [START_REF] Melliès | An explicit formula for the free exponential modality of linear logic[END_REF]) Let A be an object of a symmetric monoidal category with finite products C. The free commutative comonoid generated by A is the limit cone ! f A of the diagram ∆ ≤ , provided that:

1. ∀n ∈ N, the equalizer A ≤n exists and commutes with tensor products;

2. the limit cone (! f A, (p ∞,i :! f A → A ≤i ) i∈N ) of the diagram ∆ ≤ exists and commutes with tensor products.

We sum up graphically condition 2 of Proposition 10.1.5, in Figure 10.4. 10.2 The free exponential structure in PCoh.

A ≤0 ⊗ B A ≤1 ⊗ B A ≤2 ⊗ B . . . . . . ! f A ⊗ B C . . . p ∞,0 ⊗ id p ∞,1 ⊗ id p ∞,2 ⊗ id p 3,2 ⊗ id p 2,1 ⊗ id p 1,0 ⊗ id f 0 f 1 f 2 ∃! u
Our goal now is to apply Melliès, Tabareau and Tasson's construction in order to build the free commutative comonoid in PCoh. In that end, we need to check that PCoh verifies the conditions 1 and 2 of Proposition 10.1.5. We introduce now some notations to handle sequences and multiset over a PCS web, that we will need in the following technical development Notation 10.2.1 We denote by M n (X) the subset of M f (X) consisting of the finite multisets over X of length exactly n, and M ≤n (X) = k≤n M k (X) the set of those of length not greater than n. If a is a sequence of n elements in |X|, we denote by ∼ a the underlying multiset in M n (X). With this notation, if we have any multiset µ ∈ M f (X), we call enumerations of µ all sequences a such that their underlying multiset ∼ a coincides with µ. We denote Enum(µ) the set of all enumerations of µ. We call multinomial coefficient of µ, and denote m(µ) the number of the enumeration of µ, i.e. the cardinality of Enum(µ).

Construction of the equalizer of n! symmetries.

The next lemmas and definitions deal with the proof that condition 1 indeed holds in the category PCoh; we will be able to state this result in Proposition 10.2.6. More precisely, starting from any PCS A, we build here the equalizer of the symmetries over A ⊗n -that we will note A =n -and we show that it commutes with ⊗. From there, we will be able to build the exponential approximations, since by Definition 10.1.9, A ≤n = (A & 1) ⊗n .

We first discuss our construction informally: we want to build a PCS A =n such that the diagram below commutes:

A ⊗n A ⊗n A =n s σ,n A eq A =n .
. . and we want to do so in the most general possible way, in the aim that A =n also meets the requirements of the universal properties of Definition 10.1.7. Our approach is as follows: we take the cliques in P (A ⊗n ) as a starting point, and we seek to erase from them any information that is not invariant under symmetries. This erasure operation can be expressed internally in the category PCoh, by the morphism j n A : A ⊗n → A ⊗n formed as the barycentric sum of the actions of S n over A. Formally, for n ∈ N, and A a PCS, we define j n A ∈ PCoh(A ⊗n , A ⊗n ) as:

j n A := 1 n! σ∈Sn s σ,n A .
Observe that this construction is made possible by the convex structure on PCoh-morphisms highlighted in Proposition 9.2. Proof. To see why Lemma 10.2.2 holds, it is enough to see that:

(j n A ) a, a = # σ ∈ S n ; ∀i ≤ n, a σ(i) = a i n! = δ∼ a , ∼ a a∈S( ∼ a ) ( ∼ a)(a)! n! .
We can think about this endomorphism as a jammer, in the sense that it chooses randomly a permutation, and then applies it to its input. We illustrate this point in Example 10.2.1 below, where we consider pairs of booleans.

Example 10.2.1 (Jammer morphism on Bool ⊗2 ) There are only two elements in the permutation group S 2 : the identity and the exchange map. As a consequence, we see that:

j 2 Bool = 1 2 id Bool⊗Bool + 1 2 swap Bool,Bool : Bool ⊗2 → Bool ⊗2
1 1 2 1 2 1 1 2 1 2
Observe that as desired, the morphism j 2 Bool erases asymmetric information: when we apply the morphism j 2

Bool to some arbitrary distribution D over pairs of booleans, the probabilities D(true, false) and D(false, true) are uniformly reallocated between these two states. We illustrate this by looking for instance at u = 1 2 • e (t,t) + 1 2 • e (t,f) in P (Bool ⊗ Bool). Then we see that indeed (j 2

Bool u) ∈ P (Bool ⊗ Bool) is as follows:

j 2 Bool u = 1 2 • e (t,t) + 1 4 • e (t,f) + 1 4 • e (f,t) .
The observation done in the example above holds more generally: indeed for any PCS A, j n A acts on A ⊗n by reallocating the coefficients in such a way as to erase the information about the orders of the elements in a n-length sequence. Accordingly the morphism j n A is invariant by all symmetries, in the following sense: for every σ ∈ S n , it holds that s σ,n A •j n A = j n A -we prove this by looking at the definition of j n A , since τ ∈ S n → σ•τ ∈ S n is a bijection over S n .

It is tempting, as a consequence, to choose as cliques for A =n the set j n A (P (A ⊗n )) := {j n A x | x ∈ P (A ⊗n )}. We have however to be careful, since (|A ⊗n | , j n A (P (A ⊗n ))) is not a PCS: indeed it is not even downward closed for the pre-PCS order-see Section 9.2 from Chapter 9-as we illustrate on the example below,.

Example 10.2.2 We look at the same vector u ∈ Bool ⊗2 as the one we defined in Example 10.2.1. We see that for instance 1 4 • e (t,f) ≤ |A ⊗n | j 2 Bool u, but we can see that • e (t,f) ∈ j 2 Bool (P Bool ⊗2 ), since indeed this vector is not invariant under symmetry morphisms-for instance, it is not invariant by the symmetry morphism that swaps the states (t, f) and (f, t).

To overcome this problem, we choose to build a PCS (|A =n | , P (A =n )) whose set of cliques P (A =n ) is isomorphic to j n A (P (A ⊗n )), through a change of basis: we see by Lemma 10.2.2 that every vector of the form (j n A x) may be expressed as:

j n A x = µ∈Mn(|A|)   1 m(µ) • a∈Enum(µ) x a   • e µ ,
where for any multiset µ ∈ M n (|A|) we have taken e µ = a∈Enum(µ) e a . It means that M n (|A|) can be seen as the canonical base of the image set j n A (P (A ⊗n )).To make this change of basis formal, we construct now a matrix jm n A ∈ R

|A ⊗n |×Mn(|A|)

+ , such that:

∀x ∈ P A ⊗n , j n A x = µ∈Mn(|A|) (jm n A x) µ • e µ
(jm n A ) a,µ := δ µ, ∼ a • 1 m(µ) , for µ ∈ M n (|A|), a ∈ A ⊗n
Observe that (jm n A ) a,µ = (j n A ) a, a for a any enumeration of µ. Essentially

j n A x ∈ R |A ⊗n | + and jm n A x ∈ R Mn(|A|) +
are the same vector, but expressed in a different canonical base. It is relevant, because the canonical base generated by multisets lead to a presentation of jm n A ( A ⊗n ) as the cliques of a PCS-that we make explicit below-while it was not the case with the base generated by sequences. Definition 10.2.2 Let A be a PCS, and n ∈ N. We define the PCS A =n by:

|A =n | = M n (|A|) P (A =n ) = {jm n A u | u ∈ P A ⊗n }.
We see that the space A =n is indeed a PCS by using Proposition 9.2.2. Our goal now is to check that it is indeed the equalizer of n! symmetry. First, we define a morphism eq A =n : A =n → A ⊗n , designed to meet the requirements of Definition 10.1.7. We define it as the matrix (eq A =n ) µ, a := δ µ, ∼ a . Observe that it essentially reverses the change of basis, since indeed:

(eq

A =n • jm n A ) x = j n A x . (10.2)
We need first to check that eq A =n is indeed a morphism in PCoh(A =n , A ⊗n ). It comes as a consequence of Equation 10.2, as can be seen in the proof of Lemma 10.2.3 below:

Proof. We only prove the commutation with ⊗, as the universal property of the equalizer is a direct consequence of the commutation, taking B = 1. Let C be a PCS and f ∈ PCoh(C, A ⊗n ⊗ B) be a morphism such that (s σ,n

A ⊗ id B ) • f = f for any σ ∈ S n . Then, define f † ∈ PCoh(C, A n ⊗ B) as follows: for every c ∈ |C|, b ∈ |B|, µ ∈ |A =n |, f † c,(µ,b) = f c,( a,b)
, where a is any enumeration of µ (no matter which one because f is invariant under the tensor symmetries). The fact that f † is the unique morphism commuting the diagram of Equation (10.1) is a trivial calculation. We have then to prove that it is indeed a morphism in PCoh(C, A =n ⊗ B), that means that, for any v ∈ P (C), f † v ∈ P (A =n ⊗ B).

Consider w ∈ P (A =n ⊗ B) ⊥ and let us prove that f † v, w ≤ 1. This will allow us to conclude f † v ∈ P (A =n ⊗ B). Our proof strategy is as follows: we build a vector w derived from w, such that: . We first show that Equation (10.4) holds.

w ∈ P A ⊗n ⊗ B ⊥ (10.4) f † v, w = f v, w (10.5
In fact, for any u ∈ P (A ⊗n ), z ∈ P (B):

u ⊗ z, w = a,b u a z b w ( a,b) = a,b u a z b 1 m( ∼ a) w∼ a ,b = µ,b z b w µ,b a∈Enum(µ) 1 m(µ) u a = µ,b z b w µ,b (jm n A u) µ = (jm n A u) ⊗ z, w .
From there, we can use the fact that by definition of A =n , (jm n A u) ∈ P (A =n ). Since z ∈ P (B), it means that (jm n A u) ⊗ z ∈ P (A ⊗n ⊗ B). Recall moreover that we have taken w ∈ P (A =n ⊗ B) ⊥ ; it allows us to conclude that u ⊗ z, w ≤ 1. Since the elements u ⊗ z, with u ∈ P (A ⊗n ), z ∈ P (B) are generators of A ⊗n ⊗B -see the definition of the bifunctor ⊗ in PCoh stated in Chapter 9-it means that indeed w ∈ P (A ⊗n ⊗ B) ⊥ .

We show now Equation 10.5: f † v, w = f v, w . In fact,

f † v, w = µ,b (f † v) µ,b w µ,b = a,b (f v) a,b w∼ a ,b m( ∼ a) = a,b (f v) a,b w a,b = f v, w .
Now from Equations (10.4) and (10.5) we can obtain the result, because by hypothesis f v ∈ P (A ⊗n ⊗ B), and thus f † v, w = f v, w ≤ 1.

Remark 10.2.1 We have tried to present above a way to understand where our construction for A =n comes from, by starting from the jammer morphism j n A . It should be reminded, however, that the notion of equalizer is only defined up to (unique) isomorphism, which means that the choice of the matrix jm n A is somewhat arbitrary. Our construction has the advantage to make the equalizer morphism eq A =n as simple as possible, i.e. a web morphism, in the sense defined by Danos and Ehrhard: a morphism entirely specified by a function between the PCSs webs.

Example 10.2.3 Let us illustrate the construction of A =n in the case where A is the boolean space Bool. It is trivial to check that Bool =0 is isomorphic to 1 and Bool =1 to Bool. Concerning Bool =2 , we have:

Bool =2 = {[t, f], [t, t], [f, f]}.
that G = {v 1 ⊗ . . . ⊗ v n | v i ∈ P (A & 1)} is a set of generators for (A & 1) ⊗n . Moreover, observe that for every v ∈ P (A & 1) it holds that v ≤ |A&1| π 1 v, e . As a consequence, if we denote G = {( u 1 , e ) ⊗ • • • ⊗ ( u n , e ) | u ∈ P (A)}, we see that G ⊆ G,
and that every element in G is dominated by an element in G , and since the bi-duality operator is downward closing, it implies that G ⊥⊥ = G ⊥⊥ . As a consequence, G also is a set of generators for A & 1, and we can conclude using Lemma 9.2. One can observe more generally that (sup Bool ≤n ) µ = 1 for any multiset µ ∈ M ≤n ({t, f}) which is uniform (i.e. of which support is at most a singleton), while (sup Bool ≤n ) µ < 1 for µ non-uniform.

Henceforth, we will consider A ≤n as presented in Lemma 10.2.7.

The limit ! f A

The quest for a limit ! f A of the family (A ≤n ) n∈N requires studying the relations between exponential approximations of different degree. This is done starting from the following notions of injection and projection. Given

PCoh is a full subcategory of Cstab m

The category Cstab m was introduced as a model for PCF sample -the higher-order language with continuous probabilities that we presented in Section 9.3 from Chapter 9 -by Ehrhard, Pagani and Tasson in [START_REF] Ehrhard | Measurable cones and stable, measurable functions: a model for probabilistic higher-order programming[END_REF], i.e. they built in Cstab m a sound and adequate interpretation of PCF sample . It is not known, however, if this model is also fully abstract. We do not solve this question here, but the work we present now was designed in the hope that it could be a first step in this direction. Our perspective is as follows: while we have until now no full abstraction result for a model of an higher-order language with continuous probabilities, it is different in the case of discrete probabilities: for instance PCoh is a fully abstract model of PCF ⊕ , and there are also game models that have been shown to be fully abstract for diverse higher-order language with probabilities-see Chapter 9 for a more precise account. What we do here is to look at Cstab m from the perspective of discrete probabilities: our result consists in establishing that the discrete model induced by Cstab m is exactly the PCF ⊕ model in PCoh. It enables us to reformulate the fullabstraction problem as follows: is it possible to generalize the full-abstraction proof for PCoh in a more general-i.e. continuous-setting ?

To make more precise what we mean when we talk about Cstab m as a model of discrete higher-order computation, let us first consider a continuous higher-order language with an explicit discrete fragment. We define a language PCF ⊕,sample that has all syntactic constructs of both PCF ⊕ and PCF sample , with both a real type R, and a natural number type N as base types. We want this language to be able to convert natural data types into real data type, and reversely, in the following sense: first, we endow this language with a conversion operator real, that turns every distribution over N into a distribution over R, without information loss, and consequently is associated with a typing rule as follows:

Γ M : N Γ real(M ) : R
This operator is designed to enable the continuous constructs to act on the discrete fragment, by giving a way to see any distribution on N as a distribution on R. The language PCF ⊕,sample is designed to talk about approximating by discrete tests the programs in PCF sample : for instance if we consider a PCF sample program M : R → R, we can approximate its behavior by considering all programs λx • KM (Lx) : N → N , where L and K are PCF ⊕,sample programs of type respectively N → R, and R → N . Observe that the program K may be built using for instance the order operators-see Section 1.4.2 of Chapter 1-while the existence of such programs L is guarantee by our real(•) construct.

We can extend in a natural way the denotational semantics of PCF sample given in [START_REF] Ehrhard | Measurable cones and stable, measurable functions: a model for probabilistic higher-order programming[END_REF] to PCF ⊕,sample : in the same way that the denotational semantics of R is taken as the set of all finite measures on R, we take the denotational semantics of N as the set Meas(N) of all finite measures over N. We take as denotational semantics of the operator real the function: real Cstabm : µ ∈ Meas(N) → (A ∈ Σ R → n∈N∩A µ(n)) ∈ Meas(R). We will see later that this function is indeed a morphism in Cstab m (Meas(N), Meas(R)). What we would like to know is: what is the structure of the sub-category of Cstab m given by the discrete types of PCF ⊕,sample , i.e generated inductively by N Cstabm , ⇒, × ?

The starting point of our work is the connection highlighted in [START_REF] Ehrhard | Measurable cones and stable, measurable functions: a model for probabilistic higher-order programming[END_REF] between PCSs and complete cones: every PCSs can be seen as a complete cone, in such a way that the denotational semantics of N in PCoh ! becomes the set of finite measures over N. We formalize this connection by a functor F m : PCoh ! → Cstab m . However, to be able to use PCoh ! to obtain information about the discrete types sub-category of Cstab m , we need to know whether this connection is preserved at higher-order types: does the ⇒ construct in Cstab m make some wild functions not representable in PCoh ! to appear, e.g. not analytic? In this paper, we show that this is not the case, meaning that the functor F m is full and faithful, and cartesian closed. Since PCoh ! is a fully abstract model of PCF ⊕ , it means that the discrete fragment of PCF ⊕,sample is fully abstract in Cstab m . More generally, it tells us also that for any PCF sample program M , regardless of the continuous computations it does, every approximation of M by discrete tests has for denotation in Cstab m a power series: hence we are able to gather information on the behavior of M by looking only at power series, that are much easier to handle that general functions between cones.

It was noted in [START_REF] Ehrhard | Measurable cones and stable, measurable functions: a model for probabilistic higher-order programming[END_REF] that there is a natural way to see any probabilistic coherent space as an object of Cstab. In this work, we show that this connection leads to a full and faithful functor F from PCoh ! -the Kleisli category of PCoh-into Cstab. We do that by showing that every stable function between probabilistic coherent spaces can be seen as a power series, using McMillan's extension [START_REF] Mcmillan | Absolutely monotone functions[END_REF] to an abstract setting of Bernstein's theorem for absolutely monotonic functions. We then show that this functor F is cartesian closed, i.e. respects the cartesian closed structure of PCoh ! . In the last part, we turn F into a functor F m : PCoh ! → Cstab m , and we show that F m too is cartesian closed. To sum up, the contribution of this paper is the construction of a cartesian closed full embedding from PCoh ! into Cstab m . Since PCoh ! is known to be a fully abstract denotational model of PCF ⊕ , an immediate corollary is that Cstab m too is a fully abstract model of PCF ⊕ .

A generalization of Bernstein's theorem for pre-stable functions

In [START_REF] Mcmillan | Absolutely monotone functions[END_REF], McMillan generalized Bernstein's Theorem on absolutely monotonic function from real analysis to general domains with partitions systems. Here, we present its result in the more restricted setting of pre-stable functions on directed-complete lattice cones. Its approach consists in first defining an analogue of derivatives for pre-stable functions, and then showing that pre-stable functions can be written as the infinite sum generated by an analogue of Taylor expansion on B • C. We give here the main steps of the construction directly on cones, and highlight some properties of the Taylor series which are true for directed-complete lattice cones, but not in the general framework McMillan considered.

Lemma 11.1.1. It means that z = 1≤i≤n z i , with z i ≤ y i . But since for all i, z ⊥ y i , it folds that z i = 0 for all i, and so z = 0, and we have a contradiction. Now, we are going to present a procedure to construct a partition π of x with π ≤ π 1 , and π ≤ π 2 . We can suppose that all elements of π 1 and π 2 are non-zero. We start form π = [], θ 1 = π 1 , θ 2 = π 2 , and w = x, v = 0. Through the procedure, we guarantee:

• θ 1 , θ 2 ∈ Parts(w), π ∈ Parts(v), and w + v = x;

• all the elements of Θ 1 and Θ 2 are non-zero;

• π + Θ 1 ≤ π 1 , and π + Θ 2 ≤ π 2 (for the refinment order).

Then at each step of the procedure, if θ 1 is non empty, we do the following: let θ 1 = [a 1 , . . . , a n ], and θ 2 = [b 1 , . . . , b m ]. Then we know that there is a j, such that a 1 and b j are not orthogonal. We modify the variables as follows: decreases. Indeed:

π = π + [a 1 ∧ b j ] v = v + a 1 ∧ b j θ 1 = [a 1 -a 1 ∧ b j ,
• or we remove either a 1 of Θ 1 , or b j of Θ 2 , and then the statement above holds.

• or we replace a 1 by (a 1 -a 1 ∧ b j ), and b j by (b j -a 1 ∧ b j ). Then we see that (a 1 -a 1 ∧ b j ) ⊥ (a 1 -a 1 ∧ b j ). Moreover, the pairs that were orthogonal before are still orthogonal: indeed for every z with z ⊥ a 1 it holds that z ⊥ a 1 -a 1 ∧ b j , and the same for b j .

As a consequence, the procedure will terminates. It means that we reach a state where Θ 1 is empty, and all the invariants presented above hold. Then we see that π ∈ Parts(x), and π ≤ π 1 , π 2 . We are going to illustrate the procedure above on a very basic example. We consider the cone consisting of the positive quadrant of R 2 , endowed by the order defined as: x ≤ y if x 1 ≤ y 1 , and x 2 ≤ y 2 . We take two partitions of a vector x ∈ R It holds (see [START_REF] Mcmillan | Absolutely monotone functions[END_REF] for more details) that Φ f,n x, u is a non-increasing function whenever f is pre-stable (it is shown in Lemma 3.2 of [START_REF] Mcmillan | Absolutely monotone functions[END_REF] by looking at the definition of higher-order differences). Since Parts( u) is a directed set (by Lemma 11.1.2), Φ f,n

x, u has a greatest lower bound whenever D is a directed-complete cone. Definition 11.1.4 (from [START_REF] Mcmillan | Absolutely monotone functions[END_REF]) Let be C a lattice cone, D a directed-complete lattice cone, and f : BC → D a pre-stable function. Let be u ∈ BC n

x . Then the derivative of f in x at rank n towards the direction u is the function D n f (x | •) : BC n x → D defined as

D n f (x | u) = inf π∈Parts( u)
Φ f x, u ( π).

In order to highlight the link with differentiation in real analysis, we illustrate Definition 11.1.4 on the basic case where f : R + → R + , Example 11.1.1 We take C and D as the positive real half-line, and x ∈ [0, 1). Let be h such that x + h ≤ 1. Then:

D 1 f (x | h) = inf
π with π∼h y∈π f (x + y) -f (x).

Since f is pre-stable hence an absolutely monotonic function on reals, f is convex, and moreover differentiable (see [START_REF] Widder | Laplace Transform (PMS-6)[END_REF]). From there, by considering a particular family of partitions, we can show that

D 1 f (x | h) = h • f (x).
Proof. First, let π be any partition of y. Since f is differentiable and convex, it holds that: ∀z, f (x + z) -f (x) ≥ f (x) • z.

As a consequence, we see that for any partition π of h, it holds that y∈π f (x+y)-f (x) ≥ f (x) • h, and it implies that D 1 f (x | h) ≥ f (z) • h. To show the reverse inequality, it is enough to consider the particular family of partition π n = [ h n , . . . , h n ] of h: we see that Proof. The proof is given in Lemma 3.31 in [START_REF] Mcmillan | Absolutely monotone functions[END_REF]. It comes almost directly from Definition 11.1.4.

y∈πn f (x + y) -f (x) = n • f (x + h n ) -f (x) = h • f (x + h n ) -f (x) h n → n→∞ h • f (x).
We have seen in Example 11.1.1 that our so-called derivatives of pre-stable functions play the same role as the differential of a differentiable function, which are actually linear operators df n

x : R n → R. While the abstract domains considered in [START_REF] Mcmillan | Absolutely monotone functions[END_REF] do not have to be R + semi-modules, so have no notion of linearity, we are able to show in our case that the D n f are linear in the sense of Lemma 11.1.4 below.

Taylor Series for pre-stable functions

We have seen above that the D n f are a notion of differential for pre-stable functions. Following further this idea, McMillan defined an analogue to the Taylor expansion. We give here a slightly different, but equivalent, formulation, taking advantage of the linearity of the derivatives for cones (the original formulation, as well as the proof of equivalence, are detailed in the long version). In all this section C and D are going to be directed complete lattice cones, and f : BC → D a pre-stable function. The next step consists in establishing that the T N f are actually a non-increasing bounded sequence in the cone of pre-stable functions from C to D, which will allow to define the Taylor series of f , as the supremum of the T N f . To that end, we are first going to establish an alternative characterization of the Taylor series, which is the one used in [START_REF] Mcmillan | Absolutely monotone functions[END_REF], in the framework of abstract domains. It consists in substituting each of the D n f (x | y, . . . , y) with its expression given by Lemma 11.1.6 below. The validity of Lemma 11.1.4, and thus the equivalence of the two definitions, depends on the fact we work with directed-complete cones.

Proof. It is an algebraic calculation, done in [START_REF] Mcmillan | Absolutely monotone functions[END_REF]. We give here the proof for n = 2. Let π = [y 1 , y 2 ] a partition of y. Then we see that:

f (x) + 1≤k≤n 1 k! σ:[[1,k]] →[[1,n]] ∆ k f (x, σ(π)) = f (x) + ∆ 1 f (x, y 1 ) + ∆ 1 f (x, y 2 ) + 1 2
• (∆ 2 f (x, y 1 , y 2 ) + ∆ 2 f (x, y 2 , y 1 ))

= f (x) + (f (x + y 1 ) -f (x)) + (f (x + y 2 ) -f (x))

+ (f (x + y 1 + y 2 ) -f (x + y 1 ) -f (x + y 2 ) + f (x))

= f (x + y 1 + y 2 ) = f (x + y).

Moreover we are also able to express the derivatives of f at x towards the direction y also using the partitions of y (it is the sense of Lemma 11.1.6). Accordingly: We can now use the Scott continuity of + and •, and we obtain:

T f N (x | y) = f (x) +
T f N (x | y) ≤ sup π∈Parts(y) f (x) + N k=1 1 k! σ:[[1,k]] →[[1,#(π)]] ∆ k f (x | σ(π))
We can now conclude using (11.1):

T f N (x | y) ≤ sup π∈Parts(y) f (x + y) ≤ f (x + y)
The proof of the pre-stability of the function can be found in [START_REF] Mcmillan | Absolutely monotone functions[END_REF]. It is based on the fact that each one of the above inequality can be seen as an inequality in the cone of pre-stable functions.

Since we have shown that the partial sum of the Taylor series of f was a bounded nondecreasing sequence in the sequentially complete cone of pre-stable functions from C 1

x to D, we can now define the Taylor series of f as its supremum.

Extended Bernstein's theorem

Our goal from here is to show that for any x ∈ B • C, Rf (0 | x) = 0. We recall here the main steps of the proof of [START_REF] Mcmillan | Absolutely monotone functions[END_REF]. It is based on two technical lemmas, that analyze more precisely the behavior of the remainder of f . The first one is actually a summary of several technical results shown separately in [START_REF] Mcmillan | Absolutely monotone functions[END_REF]. Proof. We give here only sketches of the proofs. The detailed proof can be found in [START_REF] Mcmillan | Absolutely monotone functions[END_REF].

• For Rf y , it is a consequence of the fact that both f y : (x ∈ BC 1 y → f (x + y) and T f y : x ∈ BC 1 y → T f (x | y) are pre-stable functions, with T f y ≤ f y in the cone of pre-stable functions, and Rf y = f y -T f y .

• The pre-stability of Rf x is stated in Theorem 4.1. of [START_REF] Mcmillan | Absolutely monotone functions[END_REF]. It is based on a previous technical lemma shown in [START_REF] Mcmillan | Absolutely monotone functions[END_REF], which says it is sufficient for a function to be prestable, to have all its differences in 0 to be non-negative. Then the idea is to fix x, and to consider for every N ∈ N, the function g N : y ∈ BC 1 x → f (x + y) -T f N (x | y). It is then possible to show that for any n ∈ N, and u ∈ BC n y , ∆ n g N (0

| u) = ∆ n f (x | u) -∆ n (T f N x )(0 | u), with T f N x : y → T f N (x | y)
. By a computation on the ∆ n (T f N x )(0 | u), we see that the ∆ n g N (0 | u) are non-negative. Then, we conclude using the fact that Rf x (y) = inf N ∈N T f N x (y).

• The fact that Rf x (0) = 0 is a direct consequence of the n-linearity of the map u → D n f (x | u) for n ≥ 1.

• The fact that T (Rf y )(0 | x) = 0 is shown in [START_REF] Mcmillan | Absolutely monotone functions[END_REF] Proof. We give here a brief sketch of the proof of the first statement. More details can be found in [START_REF] Mcmillan | Absolutely monotone functions[END_REF]. We introduce the function Rf +x : y ∈ BC 1 x → Rf (0 | x + y). The proof is based on the fact that it is possible to establish (see [START_REF] Mcmillan | Absolutely monotone functions[END_REF] We use Lemma 11.1.9 to show the a more involved upper bound on Rf (0 | x).

Lemma 11.1.10 Let be x ∈ BC, and π = [x 1 , . . . , x n ] a partition of x, such that for every x i ∈ π, x + x i ∈ BC. Then Rf (0 | x) ≤ 1≤i≤n inf π i |π i ∼x i z∈π i Rf (x | z).

Proof. For every x ∈ BC, we denote g x : y ∈ BC 1

x → f (x + y). From the definitions of the D n , we see that it holds that Rg x (0 | y) = Rf (x | y).

Let be π 1 , . . . , π n such that π i is a partition of x i over J. Then π 1 + . . . + π n is a partition of x. Lemma 11.1.9 applied several times , combined with the fact that Rg x (0 | y) = Rf (x | y), tells us that:

Rf (0 | x 0 ) ≤ z∈π 1 +...+πn Rf (z | z),
where z = u∈π 1 +...+πn|u =z u. Moreover, we know that Rf z is pre-stable (by lemma 11.1.8). Since, for every z ∈ π 1 + . . . + π n , z ≤ x (it is immediate, since π 1 + . . . + π n is a partition of x), it folds that Rf (z | z) = Rf z (z ) ≤ Rf z (x) = Rf (x | z). As a direct consequence, we see that Rf (0 | x 0 ) ≤ i z∈π i Rf (x | z), which leads to the result.

We are now ready to show the main result of this section. Rf (x | u i ). (11.4) Observe that the above expression is valid, since for every u i in a partition π of x N , x + u i ∈ BC. We know, by Lemma 11.1.8 that Rf (x | 0) = 0. Therefore, we can rewrite (11.4) Moreover, we are able to express the right part of (11.5) by the finite differences of the pre-stable function Rf x ; indeed for each i,

∆ 1 Rf x (0, u i ) = Rf (x | u i ) -Rf (x | 0). (11.6)
By the definition of derivatives (see Definition 11.1.4), we see that

D 1 Rf x (0 | x N ) = inf π∈Parts( x N ) v∈π ∆ 1 Rf x (0, v) (11.7)
We see now that combining (11.5), (11.6) and (11. 11.2 Cstab is a conservative extension of PCoh ! Probabilistic coherence spaces (PCSs) were introduced by Ehrhard and Danos in [START_REF] Danos | Probabilistic coherence spaces as a model of higher-order probabilistic computation[END_REF] as a model of higher-order probabilistic computation. We presented them in Chapter 9. In this section, we highlight an embedding from PCSs into cones. As highlighted in Example 4.4 from [START_REF] Ehrhard | Measurable cones and stable, measurable functions: a model for probabilistic higher-order programming[END_REF], we can associate in a generic way a cone to any PCS. The idea is that we consider the extension of the space of cliques by all uniform scaling by positive reals. We formalize this idea in Definition 11.2.1 below.

Definition 11.2.1 Let be X a PCS. We define a cone C X as the R + semi-module {α • x s.t. α ≥ 0, x ∈ P (X )} where the + is the usual addition on vectors. We endow it with • C X defined by:

x C X = sup y∈P(X ⊥ )

x, y = inf{ 1 r | r • x ∈ P (X )}.

It is easily seen that it is indeed a cone-observe that the proof uses the so-called technical conditions from Definition 9.2.1. Moreover, we can see that BC X consists exactly in the set P (X ) of cliques of X . Looking at the cone order C X , as defined in Definition 9.3.2, we see that it coincides on P (X ) with the pointwise order in R + |X |. It is relevant since we know already from [START_REF] Danos | Probabilistic coherence spaces as a model of higher-order probabilistic computation[END_REF] that P (X ) is a bounded-complete and ω-continuous cpo with respect to this pointwise order.

Lemma 11.2.1 For every PCS X , it holds that C X is a directed-complete lattice cone.

Proof. To show that C X is directed complete, we use the fact that P (X ) is a complete partial order. To show that it is a lattice, we see that x ∨ y can be defined as: (x ∨ y) a = max x a , y a ∀a ∈ |X |. Proof. We know from [START_REF] Danos | Probabilistic coherence spaces as a model of higher-order probabilistic computation[END_REF] that f : P (X ) → P (Y) is sequentially Scott-continuous with respect to the orders C X , C Y . Moreover f is pre-stable: it comes from the fact that f can be written as a power series with all its coefficients non-negative. Finally, we have to show that f (BC X ) ⊆ BC Y ). Since BC X = P (X ), BC X = P (X ), and moreover f is a morphism in PCoh ! (X , Y), we see that the result holds.

Thus we can define a functor F : PCoh ! → Cstab, by taking FX = C X , and Ff = f . Our goal now is to show that F is full and faithful, which will make PCoh ! a full subcategory of Cstab. As mentioned before, it was shown in [START_REF] Danos | Probabilistic coherence spaces as a model of higher-order probabilistic computation[END_REF] that • is a bijection from PCoh ! (X , Y) to E X ,Y . It tells us directly that F is indeed faithful. In the remainder of this section, we are going to show that F is actually also full, hence makes Cstab a conservative extension of PCoh ! .

In the following, we fix X and Y two PCSs, and g ∈ Cstab(FX , FY). Our goal is to show that there exists f ∈ PCoh ! (X , Y) such that f = g. First, recall that we have shown in Lemma 11.2.1 that for every PCS Z, the cone FZ is a directed complete lattice cone. It means that all results in Section 11.1 can be used here: in particular, g has higher-order derivatives D n g, which makes Definition 11.2.2 below valid. We have to show now that f ∈ PCoh ! (X , Y), and that f coincides with g on P (X ). The key observation here is that we have actually built f in such a way that it is going to coincide with T g(0 | •)-the Taylor series of g defined in Definition 11.1.6. We first show it for the elements of P (X ) with finite support, by using finite additivity of the D k g(0 | •).

Lemma 11.2.3 Let be x ∈ P (X ), such that Supp(x) = {a ∈ P (X ) | x a > 0} is finite.

Then it holds that f • x ! is finite, and moreover f • x ! = T g(0 | x).

Proof. Let A = {a 1 , . . . , a m } ⊆ |X | be the set Supp(x). For any b ∈ |Y|, we can deduce from the definition of f that:

(f • x ! ) b = ∞ k=0 µ=[c 1 ,...,c k ]∈Mn(k)A α µ k! • D k g(0 | e c 1 , . . . e c k ) b • x µ
Looking at the definition of α µ , we see that this implies: We are now going to apply the generalized Bernstein's theorem, as stated in Proposition 11.1.11, to the stable function g from FX to FY. It tells us that: ∀x ∈ B • C X , g(x) = T g(0 | x).

(f • x ! ) b = ∞ k=0 (
(11.9)

Combining (11.9) with Lemma 11.2.3, we obtain that:

∀x ∈ B • C X with Supp(x) is finite, f • x ! = g(x). (11.10) We can now use (11.10) to show that f and g coincide on P (X ): the key point is that the subset of elements in P (X ) of norm smaller than 1 and finite support is dense, and that moreover g is Scott-continuous. Lemma 11.2.4 ∀x ∈ P (X ) , f • x ! = g(x), and moreover f ∈ PCoh ! (X , Y).

Proof. Let be x ∈ P (X ). It is easy to see that there exists a non-decreasing sequence y n , with x = sup n∈N y n , and for every n, y n C X < 1, and y n has finite support. For every y n , we can use (11.10), and we see that g(y n ) = f • y ! n . Since g is a morphism in Cstab, g is sequentially Scott-continuous, hence: g(x) = sup n∈N g(y n ). (11.11) Moreover, we know from [START_REF] Danos | Probabilistic coherence spaces as a model of higher-order probabilistic computation[END_REF] that both x → x ! and x → u • x are Scott continuous. It means that:

f • x ! = sup n∈N f • y ! n . (11.12)
Combining (11.11) and (11.12), we obtain f • x ! = g(x). Since g(BC X ) ⊆ BC Y , it implies also that f (P (X )) ⊆ P (Y). Thus by Lemma 9.2.7 f ∈ PCoh ! (X , Y).

Since we have indeed be able to show in Lemma 11.2.4 that for any fixed stable function g in Cstab(FX , FY), there exists a f ∈ PCoh ! (X , Y) such that Ff = g, we have indeed shown that F is full.

11.2.2 F preserves the cartesian structure.

We want now to give more guarantee on the functor F: we want to show that it is a cartesian closed functor, meaning that it embeds the cartesian closed category PCoh ! into the cartesian closed category Cstab in such a way that:

• F preserves the product: for every family (X i ) i∈I of PCSs, F( PCoh ! i∈I X i ) is isomorphic to Cstabm i∈I FX i ;

• F preserves function spaces: for every X , Y PCSs, F(X ⇒ Y) is isomorphic to FX ⇒ FY.

Lemma 11.2.5 F preserves cartesian products.

Proof. We fix a family F = (X i ) i∈I of PCSs. In order to construct an isomorphism, we have a canonical candidate, given by:

Ψ F = F(π i ) | i ∈ I ∈ Cstab(F( PCoh ! i∈I X i ), Cstabm i∈I FX i ).
We see now that the series n∈N h n is uniformly convergent on J: for every r ∈ J, it holds that: Since b < c, we know that the quantity in the right part of (11.18) defines a convergent series. As a consequence, the series n∈N h n is uniformly convergent on J, which means that we are able to apply Lemma 11.4.4: we see that ∂g ∂r 1 exists on J n , and moreover: ∂g ∂r 1

( r) = a ν • r ν- [1] • ν(1) and the result folds.

We iterate now Lemma 11.4.5 in order to look at higher-order partial derivatives. ∂r 1 ν(1) ...∂rp ν(p) exists, and moreover:

∂g card(ν) ∂r 1 ν(1) . . . ∂r p ν(p) ( r) = η∈M f ({1,...,p})

a ν+η • r η • 1≤i≤p (η + ν)(i)! η(i)! .
Proof. The proof is by induction on card(ν), and uses Lemma 11.4.5. It is clear that the result holds for ν = ∅. Now, we suppose that it holds for every ν of cardinality N . Let κ be a multiset of cardinality N + 1, and we take ν, and i such that κ = ν + [i]. By the induction hypothesis, there exists c > 0, such that, when we define g : r ∈ [-c, c] p → S( r), the partial derivative ∂g card(ν) ∂r 1 ν(1) ...∂rp ν(p) exists, and is equal to: We see that it is indeed absolutely convergent on I =] -1 p , 1 p [ p , using the fact that for r ∈ [0, 1 p ] p , S u ( r) = ψ µ,b ( r, u) for r ∈ R p . We can now end the proof of Lemma 11.4.2. Indeed, since the class of real-valued measurable functions is closed by addition, multiplication by a scalar and pointwise limit, and that ψ µ,b : K × R p → R + is measurable, it holds that the partial derivatives (when they exist) are measurable too. Indeed, observe that ∂ψ µ,b ∂r 1 ((r 1 , r), u) = lim n→∞ f n ((r 1 , r), u), with f n ((r 1 , r), u) = n • f ((r 1 + 1 n , r), u) -f ((r 1 , r), u).

T ( r) =
As a consequence, applying Lemma 11.4.3 with ν = µ leads us to:

u ∈ R n → ∂(ψ µ,b ) card(µ)
∂r 1 µ(1) . . . ∂r p µ(p) ( 0, u) is measurable.

Therefore (again by Lemma 11.4.3), ( u ∈ R n → Ξ X ,Y (γ( u)) µ,b • 1≤i≤p µ(i)! is measurable), and the result folds.

Theorem 11.4.7 F m is a cartesian closed full and faithful functor.

Conclusion

Our full embedding of PCoh ! into Cstab implies that every stable function f from P (X ) to P (Y) can be characterized by an element Ξ X ,Y (f ) ∈ R M f (|X |)×|Y| , that has to be seen as a power series. It gives us a concrete representation of stable functions on discrete cones, similar to the notion of trace introduced by Girard in [START_REF] Girard | The system f of variable types, fifteen years later[END_REF] for stable functions on quantitative domains. There are well-known real analysis results on power series, as for instance the uniqueness theorem-any power series which is null on an open subset has all its coefficients equal to 0-on which is based the proof of full abstraction for PCF ⊕ in PCoh ! [START_REF] Ehrhard | Probabilistic coherence spaces are fully abstract for probabilistic PCF[END_REF]. While we have not been able to extend such a concrete representation to cones which are not directed-complete, as for instance the cone Meas(R) ⇒ m Meas(R), our result could hopefully be a first step in this direction. This kind of characterization could lead to a way towards a full abstraction result for the continuous language PCF sample in Cstab m , and more generally gives us new tools to reason about continuous probabilistic programs.

Chapter 12 Perspectives 12.1 Abramsky's applicative bisimulation for an higherorder language with continuous probabilities.

The present thesis aimed to contribute to a better understanding of coinductive techniques for studying context equivalence and distance for higher-order languages with discrete probabilities. In this setting, we now have quite an extensive picture of the situation: we can cite for instance the seminal work of Dal Lago, Sangiorgi and Alberti [START_REF] Lago | On coinductive equivalences for higherorder probabilistic functional programs[END_REF] on state-based and distribution-based generalization of Abramsky's applicative bisimulation for call-by-name Λ ⊕ , the study presented in the present thesis for call-by-value Λ ⊕ , the development by Vignudelli and Sangiorgi [START_REF] Sangiorgi | Environmental bisimulations for probabilistic higherorder languages[END_REF] of an environmental bisimulation for a probabilistic λ-calculus with imperative features as local states... By contrast, operational techniques based on coinduction have not yet been extended to higher-order languages equipped with primitives handling continuous distributions. Such a step further would ask to replace the quantitative transition systems on which are based the discrete probabilistic generalization of Abramsky's applicative bisimulation with quantitative transition systems that also embed concepts of measure theory. This necessity already appears when defining the operational semantics of the language: for instance when Ehrhard Pagani and Tasson [START_REF] Ehrhard | Measurable cones and stable, measurable functions: a model for probabilistic higher-order programming[END_REF] define the operational semantics for their continuous language PCF sample , they need to express it as a Labeled Markov Process-thus generalizing to continuous probabilities the way they defined the operational semantics of the discrete probabilistic language PCF ⊕ using a Labeled Markov Chain. Coinductively defined notions of both equivalences and distances have been studied in depth for Labelled Markov Processes [START_REF] Desharnais | Bisimulation for labelled markov processes[END_REF][START_REF] Desharnais | Approximating labelled markov processes[END_REF][START_REF] Ferns | Metrics for markov decision processes with infinite state spaces[END_REF] -and in some cases, reasoning on these continuous transition systems has proved easier than reasoning on their discrete counterpart, as we have highlighted in Chapter 5 when looking at the testing characterization of equivalence on Labeled Markov Processes developed in [START_REF] Van Breugel | Domain theory, testing and simulation for labelled markov processes[END_REF].

12.2 State-based Applicative Bisimulation Distances for Probabilistic Higher-Order Languages.

As we presented in details in Chapter 4, Dal Lago, Sangiorgi and Alberti introduced [START_REF] Lago | On coinductive equivalences for higherorder probabilistic functional programs[END_REF] two generalizations of Abramsky's applicative bisimulation to a discrete probabilistic setting: the state-based and distribution-based applicative bisimulation. It may be noted that while the underlying transition system of the state-based applicative bisimulation has a more complex transition structure than the one obtained in the distribution-based setting-in the sense that the transition are truly probabilistic-the states space of the former is by contrast simpler as the one of the latter, since it consists of all programs of the language instead of all distributions over all programs of the language. In Chapter 8, we looked at quantitative generalizations of distribution-based applicative bisimulation, for both a probabilistic affine λ-calculus and a probabilistic λ-calculus with copying capabilities, and in both cases we showed that the resulting distances on programs are fullyabstract with respect to context distance. In a joint work [START_REF] Crubillé | Metric reasoning about λ-terms: The affine case[END_REF] with Ugo Dal Lago-that is not presented in the present thesis-we looked at a quantitative generalization of statebased applicative bisimulation, for our affine probabilistic λ-calculus, and we showed that we obtain this way a sound but not fully abstract notion of distance. To do so, we used the existence of a built-in notion of coinductive distance on the states of a Labelled Markov Chain [START_REF] Desharnais | Metrics for labeled markov systems[END_REF][START_REF] Desharnais | The metric analogue of weak bisimulation for probabilistic processes[END_REF], and we applied it to the particular Labelled Markov Chain built to model interactively the operational semantics of our language. The next step would be to generalize the notion of state-based applicative bisimulation distance to the case of a probabilistic language with copying abilities. The definition of such a state-based applicative bisimulation distance for a λ-calculus with copying abilities would have two challenges to face. The first one is similar to the one we encountered when defining distribution-based context distance: it consists in the fact that we cannot keep the Labelled Markov Chain used to define state-based equivalence on Λ ⊕ , because we will then obtain an unsound distance.

Similarly to what we did for the distribution-based distance, the solution may lay in embedding the ability to copy into the states space of the transition system. The second complication is more specific to the state-based setting. The soundness proof for the state-based distance in the affine case were greatly facilitated by the fact that the Labelled Markov Chain we used for the affine λ-calculus was finitely branching-i.e. there are a finite number of states that can be reached with non-zero probability when we fix the state of departure and the transition label, hence allowing us to use the results from [START_REF] Desharnais | The metric analogue of weak bisimulation for probabilistic processes[END_REF]. However, it is not be the case anymore as soon as we consider a Labelled Markov Chain of a language at least as expressive as Λ ⊕ , because it becomes possible to write programs that can output an infinite numbers of possible values.

12.3 The Full Abstraction Problem for PCF sample in the category of measurable cones and measurable stable functions.

There is no known fully-abstract denotational model yet for an higher-order language with continuous probabilities. When introducing the model of measurable complete cones and measurable stable functions for PCF sample [START_REF] Ehrhard | Measurable cones and stable, measurable functions: a model for probabilistic higher-order programming[END_REF], Ehrhard, Pagani and Tasson designed it as an extension of the denotational model based on probabilistic coherence spaces for the discrete probabilistic language PCF ⊕ , already known to be fully abstract [START_REF] Ehrhard | Probabilistic coherence spaces are fully abstract for probabilistic PCF[END_REF]. In Chapter 11, we formalized this connection categorically by defining a full and faithful functor from PCoh ! -the co-Kleisli category of the LL model based on probabilistic coherence spaces-and Cstab m -the category of complete measurable cones and stable measurable functions. The fullness of this functor means that when we consider two discrete cones, the stable measurable functions between them are exactly the power series with non-negative coefficients that are morphisms in PCoh ! . This connection could hopefully be a first step towards generalizing the full abstraction proof for PCF ⊕ in PCoh ! into a full-abstraction proof for PCF sample in Cstab m . The ability of seeing measurable stable function as a generalization of power series is especially encouraging, because the full-abstraction proof for PCF ⊕ uses crucially the power-series structure of program interpretation. More precisely, if f is a power series is the denotation of some program M , it is possible to build for any index a a sequence of arguments to pass to M that allow us to recover the coefficient f a of the power series. From there, the aim would be to study stable functions with the aim of generalizing the reasoning done on power series to the case where the cones we consider are not discrete anymore.

12.4 Is Cstab m the co-Kleisli category of a LL model ?

As highlighted in Chapter 9, the denotational model of PCF ⊕ lives actually in the co-Kleisli category of the PCoh model of Linear Logic(LL). By contrast, the category of measurable cones and measurable stable functions is a cartesian closed category, which is not yet known as being the co-Kleisli category of a model of LL. The connection between PCoh ! and Cstab m that we highlighted in Chapter 11 lead to the question of whether we can draw a similar connection between PCoh, and a LL model that would generate Cstab m as its co-Kleisli category. Such a construction would allow for instance to interpret a linear λ-calculus with primitive for handling continuous probabilities-e.g. a continuous variant of Λ ! ⊕ . We can also recall that Ehrhard and Tasson [START_REF] Tasson | Probabilistic call by push value[END_REF] gave a fully-abstract denotational semantics in PCoh to a discrete probabilistic extension of Levy's Call-by-Push-Value-a λ-calculus with a polarized type system, that allows for the call-by-name and call-byvalue evaluation paradigm to coexist. Their construction of program interpretation use the structure of PCoh as a model of Linear Logic. Similarly, having a model of LL that would generate Cstab m as its co-Kleisli category could potentially be used to give a denotational semantics to a call-by-push-value with continuous probabilities.

12.5 A Context Distance adapted to Polytime Adversaries.

In Chapter 6 we show that for an expressive enough calculus where moreover all programs stop, the context distance always trivializes, i.e. the distance between two programs is either 0 or 1. Termination of programs is a strong requirement, but nonetheless one which is often enforced on concrete programming situation. As a consequence, we can ask ourselves whether our notion of context distance is really adapted to the aim of talking about programs that are close without being equivalent, and in particular whether take all contexts into account is really significant. In some setting, as for instance computational cryptography, we do not want to consider all contexts, but only those that are run in polynomial time on some security parameter -e.g. the size of the encryption key. Formally, it would mean to have a more restricted language for contexts as the one for programs, possibly using a type system guaranteeing polytime execution in the spirit of Bounded Linear Logic [START_REF] Girard | Bounded linear logic: a modular approach to polynomial-time computability[END_REF]. Another option would be to explore tamed versions of the context distances, where context have a price to pay each time they use their input: concretely every time they call their input, they enter in an infinite loop with some fixed probability ε. These tamed distances are for instance considered for PCF ⊕ in a recent unpublished work by Ehrhard [START_REF] Ehrhard | Differentials and distances in probabilistic coherence spaces[END_REF]. The problem would then become how to adapt the coinductive operational techniques for context distances that we explored in Chapter 8 to these new way of comparing quantitatively programs.

Definition 1 . 1 . 1 (

 111 The CBN and CBV β-rule) We define the CBN and CBV β-rules as respectively the following relations → CBN β , → CBV β ⊆ P Λ × P Λ : (λx.M )N → CBN β M {N/x};

Definition 1 .

 1 1.2 (Λ-Evaluation Contexts for CBN and CBV.) We define the Λevaluations contexts for CBN and CBV as respectively the sets E CBN Λ and E CBV Λ generated by the grammars below: E ∈ E CBN Λ ::= [•] | EM, M ∈ P Λ ;

Definition 1 . 1 . 5 (

 115 Encodding of booleans) We define λ-terms true, false and ITE as follows: true := λx.(λy.x); false := λx.(λy.y); ITE := λx.λy.λz.xyz.

Definition 1 . 1 . 6

 116 For every n ∈ N, we define a program n in Λ by the following inductive definition on n: 0 := λx.λy.x; n + 1 := λx.λy.y n .

Y

  := λx. ((λy.xyy)(λy.xyy)) . Example 1.1.4 If we consider any term M , we see that: Y M → (λy.M yy)(λy.M yy) → M (λy.M yy)(λy.M yy).

Example 1 . 2 . 1

 121 We consider the following Λ ⊕ closed term: M = ITE (true ⊕ false) I Ω, where ITE , true, false are as defined in Example 1.1.5. We look at what happens when we reduce M by the CBN one-step reduction relation: M → (true ⊕ false) I Ω → true I Ω , false I Ω.

Example 1 . 2 . 2

 122 We use here the CBN one-step reduction relation, and we consider the program M := (true ⊕ false) I Ω. We know already, as seen in Example 1.2.1, that: M → true I Ω , false I Ω.(1.11)

M

  := (Y λx.λy.(y ⊕ x( S y))) 0 We are able to show, that for every N ∈ N, M ⇒ D N with D N := 1≤n≤N 1 2 n { n 1 }. The proof can be done by induction on N .

Figure 1 . 1 :

 11 Figure 1.1: Type Assignment in PCF ⊕

We say that a transitive

  and reflexive open relation is an open preorder, while a transitive, reflexive and symmetric open relation is an open equivalence relation.

Example 2 . 3 . 1 (

 231 CBV Evaluation Strategy) Let us consider the two following terms M and N : M := (λx.I) ⊕ (λx.Ω) N := λx. (I ⊕ Ω) .

Example 2 . 3 . 3

 233 We place ourselves in the CBV operational strategy, and we look again at the programs M = (λx.I) ⊕ (λx.Ω) and N = λx. (I ⊕ Ω) of Example 2.3.1. Recall that we have shown in Example 2.3.1 that these two programs are not observationally equivalent, by building a context C such that Obs(C[N ]) < Obs(C[M ]). We will show in Section 5.2.4 of Chapter 5 that however they are comparable, in the sense that N ≤ Λ ⊕ M .

Example 3 . 1 . 1

 311 If we take C = [•] as context, we see that Obs(C[I])-the probability of termination of C[I] = I-is equal to 1, and in the other hand, Obs(C[Ω]) = 0. It means that C pulls apart I and 1 from the maximal separation possible, which is 1. As a consequence, we see that δ ctx Λ ⊕ (Ω, I) = 1.

Example 3 . 1 . 2

 312 For every ∈]0, 1], we define N = Ω ⊕ I. By considering again the context C = [•], we see that Obs(C[N ]) = . We know already, as seen in Example 3.1.1, that Obs(C[I]) = 1, and Obs(C[Ω]) = 0. Looking at the definition of context distance, we see that it implies:

Example 4 . 1 . 1

 411 We give here an example of simulation to illustrate Definition 4.1.1. Let us consider: M = λy.Ω, and N = λy.((λz.Ω)I). We define R = {(M, N )} ∪ {(Ω, (λz.Ω)I)}. Observe that both R and R -1 are simulations, so R is a bisimulation.

Example 4 . 1 . 2

 412 Recall the programs M and N of Example 4.1.1. We have shown in Example 4.1.

Example 4 . 1 . 3

 413 Consider again the programs M and N defined in Example 4.1.1. In Example 4.1.2, we have shown that they are bisimilar. As a consequence, the soundness property of applicative bisimulation tells us that M and N are context equivalent.

4. 1 . 1

 11 Modeling Λ Operational Semantics by a Labeled Transition System (LTS)

Definition 4 . 1 . 3 A

 413 Labeled Transition System (LTS) is a triple L = (S, L, →), where S is a countable set of states, L is a countable set of labels, and →⊆ S × L × S is the transition relation of L .

Figure 4 . 1 :

 41 Figure 4.1: Fragment of the Applicative CBV LTS L Λ .

Proposition 4 . 2 . 1 (

 421 From[START_REF] Lago | On coinductive equivalences for higherorder probabilistic functional programs[END_REF]) Trace equivalence is fully abstract for CBN Λ ⊕ .

Figure 4 . 2 :Example 4 . 2 . 2 1 . 4 . 2 . 3

 424221423 Figure 4.2: A Fragment of the weighted LTS L (Λ ⊕ cbn )

Proposition 4 . 2 . 4

 424 Let be L a deterministic WLTS. For every M, N ∈ P Λ ⊕ , M and N are trace equivalent if and only if {M 1 } and {N 1 } are bisimilar in the WLTS L (Λ ⊕ cbn ).

Example 4 . 2 . 5

 425 We fix the CBN semantics, and we consider the terms M = λx.(I ⊕ Ω) and N = (λx.I) ⊕ (λx.Ω). Recall from Example 4.2.3 that they are trace equivalent. However, we are going to show that they are not in ≡ M cbn Λ ⊕

Figure 4 .Figure 4 . 4 :

 444 Figure 4.4: A Fragment of the LMC M cbn Λ ⊕ .

Definition 5 . 1 . 3

 513 Let R be a relation on Λ ⊕ program. We define the call-by-value open extension of R, that we denote (R) • by considering all closing substitutions, i.e., for all

Lemma 5 . 1 . 1

 511 Let R be a compatible open relation with respect to Λ ⊕ . Then the following hold: 1. R is a reflexive open relation; 2. R is compositional: if C is any context such that x C, and y, M, N are such that x, y M R N , then it holds that y C[M ] R C[N ].

  x λx.D . Then C[M ] = λx.D[M ], while C[N ] = λx.D[N ]. By induction hypothesis, it holds that x, y (D[M ]) R (D[N ]). It allows us to apply (Com2), and to conclude that y (λx.D[M ]) R (λx.D[N ]). -If κ is x D ⊕ L. Looking at the rules in Figure 2.1, it means that x D, and L ∈ P. By induction hypothesis, we obtain that D[M ] R D[N ]. The first statement of Lemma 5.1.1 tells us that R is reflexive: as a consequence, since L is a closed term, F V (L) = ∅, and consequently L R L. We can conclude by applying (Com4).

  Looking at the definition of the open extension, we see that since C[M ] and C[N ] are closed terms, it means: C[M ]RC[N ]. Now, we apply (1), and we can deduce from there that Obs(C[M ]) ≤ Obs(C[N ]). Since it is the case for any context C with x C, it means that x M ≤ obs N .

  • and ( • ) H coincides. This auxiliary relation ( • ) H is build as the Howe's lifting of • , where Howe's lifting is a generic way to construct syntactically a bigger open relation R H starting from any reflexive open relation R. Definition 5.1.5 Let R be an open relation. The Howe's lifting of R is the open relation R H defined inductively by the rules in Figure 5.1.

  in the sense of the definition below. Definition 5.1.6 Let be R an open relation. Then we say that R is value-substitutive if for all terms M, N and values

Lemma 5 . 1 . 5

 515 Let R be a reflexive, value-substitutive open relation, and S a relation on programs, such that R |P ⊆ S. Then it holds that R ⊆ (S) • . Proof. We suppose that R |P ⊆ S. Let x = {x 1 , . . . , x n } ∈ V, and M, N be such that x M R N . We want to show that x M (S) • N . Recall the definition of open extension given in Definition 5.1.3: we have to show that for all

Proposition 5 . 2 . 3

 523 Let M = (S, L, P) be a LMC. Pr M (s, ω) = 1;

Figure 5 . 2 :

 52 Figure 5.2: Examples of Tests's Success Probability in the LMC M cbv Λ ⊕ .

  and N . Since C emulates α, we can in particular deduce from the success probability of α when applied to M and N -as computed in Example 5.2.1 -that | C[M ] | < | C[N ] |: it means that the context C and the test α actually witness respectively ¬(N ≤ ctx M ) and ¬(N cbv Λ ⊕ M ). We look now at the reverse comparison: does M ≤ ctx N and M cbv Λ ⊕ N hold ? We first consider the situation with respect to the probabilistic applicative similarity. Lemma 5.2.7 M cbv Λ ⊕ N does not hold.

Lemma 5 . 2 . 9

 529 Suppose that K is a term and suppose that (K{x, y/M, L}) ⇒ p, where y = y 1 , . . . , y n . Then for every b ∈ {0, 1} n there is p b such that (K{x, y/N, L b }) ⇒ p b and b p b 2 n ≥ p.

Theorem 5 . 2 . 11

 5211 Both cbv Λ ⊕ and ≡ cbv Λ ⊕ are fully abstract with respect to respectively context preorder and context equivalence for CBV Λ ⊕ .

Figure 6 . 1 :

 61 Figure 6.1: The threshold test functions T α .

Definition 6 . 1 . 5

 615 Let f : [0, 1] → [0, 1] be a real function, and I ⊆ [0, 1]. An approximation by contexts of f on I is a family (C n ) n∈N of universal contexts such that for every program M with Obs(M ) ∈ I, lim n→∞ Obs(C n [M ]) = f (Obs(M )).

n( 50 Figure 6 . 3 :

 5063 Figure 6.3: Approximation family (C n ) n∈N in Λ ⊕ for T 0 with n ∈ {5, 10, 20, 50}. Observe that from Example 6.2.1, we can in particular derive that δ ctx Λ ⊕ (Ω, Ω ⊕ I) = 1.

  ), . . . , (xI)), . . . , m ((xI), . . . , (xI))) (λy.[•])

Figure 6 . 4 :

 64 Figure 6.4: Behavior of the contexts C α n for n ∈ {3, 5, 10, 20}.

Definition 6 . 3 . 1 ( 50 Figure 6 . 5 :

 6315065 Figure 6.5: f and its approximations P f n for n ∈ {5, 20, 50}.

  3.2 in order to compute the observable of the program C[M, . . . , M ][N 0 , . . . , N 0 ]. Lemma 6.3.3 Let M be a program of type N, and (N 0 , . . . , N n ) of n + 1 programs of type N. Then:

Definition 7 . 1 . 3

 713 We define the sets of Λ ! ⊕ -redexes R Λ ! ⊕ as follows: R, S ∈ R Λ ! ⊕ ::= (λx.M )V | (λ!x.M )!N | M ⊕ N, where M, N, L ∈ Λ ! , V ∈ V Λ ! ⊕ and x, y ∈ V. We define the reduction → R Λ ! ⊕ for redexes, as a relation between elements in R Λ ! ⊕ and sequences of programs in Λ ! ⊕ :

Lemma 7 . 1 . 1

 711 The relation → induced by redexes, redexes rules and evaluation contexts is unambiguous.

Lemma 7 . 2 . 1

 721 The equality relation on types = A verify the rules given in Figure7.1.

Figure 7 . 1 :

 71 Figure 7.1: Rules verified by = A Relation

Figure 7 . 2 :

 72 Figure 7.2: Typing Rules

Example 7 . 2 . 2 (

 722 Type for Ω) We are going to show here that for every type σ ∈ A Λ ! ⊕ , it holds that ( Ω : ∀α.α) is a valid typing judgment. Ω = (λ!x.x(!x))(!λ!x.x(!x)).

Example 7 . 2 . 3 (

 723 Type for the fixpoint combinator Y .) Recall the fixpoint combinator Y that we have defined in Example 7.1.2: Y = λ!x. ((λ!y.x!(y(!y)))! (λ!y.x!(y(!y)))) .

Proposition 7 . 2 . 6 (

 726 Soundness of the Type System.) Let be M a program of type σ. Then for every term N in the support of M , it holds that N is a value of type σ. Proof. Let be M a program of type σ. Recall that M = sup{D | M ⇒ D}. It means that to show Propsition 7.2.6, it is sufficient to show that whenever M ⇒ D, S(D) ⊆ V σ . The proof is done by induction on the derivation of M ⇒ D.

Proposition 7 . 3 . 1

 731 Let be M ∈ Λ ⊕ , with F V (M ) ⊆ {x 1 , . . . , x n }. Then it holds that !x 1 :!σ cbn , . . . , !x n :!σ cbn [M ] cbn : σ cbn .

Lemma 7 . 3 . 2 •

 732 Let be M, N ∈ Λ ⊕ , and z ∈ V ars(). Then [M {N/z}] cbn = [M ] cbn {[N ] cbn /z}; • Let be M ∈ [Λ ⊕ ] cbn , such that there exists an evaluation context E, and N ∈ Λ ⊕ , verifying [M ] cbn = E[[N ] cbn ]. There for any term L

Definition 7 . 4 . 1

 741 The relation ⇓ is inductively defined by the following rules:

Corollary 7 . 4 . 1

 741 For any Λ ≤1 ⊕ -program M , M is a sub-distribution with finite support. Example 7.4.1 (Dyadic Choice.) Let D be the set of dyadic numbers (i.e. those rational numbers in the form n 2 m (with n, m ∈ N and n ≤ 2 m ). It is easy to derive, for every ε ∈ D, a new binary operator on terms •

  and such that [•] C. Chapter 8

Definition 8 . 3 . 1

 831 We define the affine LTS L (Λ ≤1 ⊕ ) := (S Λ ≤1 ⊕ , L Λ ≤1 ⊕ , →) by taking its set of states as: S Λ ≤1 ⊕ := {D | D ∈ ∆(P Λ ≤1 ⊕ ) ∆( V Λ ≤1 ⊕ ) ∧ D has finite support.}, its set of labels as L Λ ≤1 ⊕ := V Λ ≤1 ⊕ {eval}, and the transition relation → as follows:

Proposition 8 . 3 . 3

 833 The distance on programs δ tr Λ ≤1 ⊕ is observationally correct for the language Λ ≤1 ⊕ .

Notation 8 . 3 . 7

 837 Let L w = ((S, L, →), w) be a WLTS, and R, S ⊆ S × S. Then we write R S when: ∀(s, t) ∈ R, Act(s) = Act(t), and ∀a ∈ Act(s), (u, v) ∈ S with s a -→ u and t a -→ v.

Definition 8 . 3 .

 83 [START_REF] Barker | A monad for randomized algorithms[END_REF] Let L w = ((S, L, →), w) be a WLTS. We call operator on L wrelations a function O : {R ⊆ S × S} → {R ⊆ S × S}, non-decreasing for the inclusion order. If O is an operator on L w -relations, we say that a binary relation R ⊆ S × S is a ε-bisimulation up-to O, if it is ε-bounded, and R O(R).

V

  -→ u, and t V -→ v with: u := { (D{V /x})[s ] (s , t ) ∈ R, Equations (8.4), and (8.5) tell us that (u, v) ∈ C[R], hence Lemma 8.3.10 holds. • We now look at the case where E = E V : then s and t are sub-distributions over distinguished values, and C can be either of the form C = λx.D-as in the previous case-or of the form [•]. In the first case, we obtain the result in the same way as when E = E P . From now on, we suppose that C = [•]. It means that s = s, and

8. 3 . 5 ADefinition 8 . 3 . 13

 358313 Contexts-Programs WLTS for Λ ≤1 ⊕ . We call (C × S) the set of all pairs of the form (C, s), where there exists E ∈ E (L (Λ ≤1 ⊕ )) such that s ∈ E, C ∈ C(E → E P ) . We say that e ∈ (C × S) is a (C × S)-value if either s ∈ E V and C = [•], or C is of the form λx.D, where D is a Λ ≤1 ⊕ open context with x as only possible free variable.

Definition 8 . 3 .

 83 15 Let R be a clustered binary relation on S Λ ≤1 ⊕ . Then we define a binary relation (C♦R) ⊆ S (•,•) × S (•,•) as:

  The relation (C♦R) on S (•,•) should be seen as a transposition of the relation C[R] on S Λ ≤1 ⊕

Definition 8 . 3 . 16

 8316 We define the one-step transition relation over (C × S), that we note → (C×S) ⊆ (C × S) × ∆((C × S), as specified in Figure 8.2 below. The β-rule of Figure 8.2 is valid only because Λ ≤1

Figure 8 . 2 :

 82 Figure 8.2: The one-step reduction relation on (C × S).

Figure 8 . 3 :

 83 Figure 8.3: Example of the effect of the one-step transition relation for (C × S)

2 .

 2 We now look at the second point. Recall the cost function c : Terms Λ ≤1 ⊕ → N that we have used when proving termination for Λ ≤1 ⊕ -programs in Proposition 7.4.1 from Chapter 7. We defined c inductively on the structure of terms. We extend here the inductive definition of C by c([•]) = 1, which allows us to see c as a function C Λ ≤1 ⊕ → C Λ ≤1 ⊕ . We now consider a sequence of reduction: s = {(C, t) 1 }→ S (•,•) s 2 → S (•,•) . . .. We are going to show by induction on c(C) that this sequence is finite: • If c(C) = 0, it means that C = λx.D, and moreover c(D) = 0. As a consequence, (C, s) is a (C × S)-value, and so the result holds.

  as shown in Lemma 7.4.3, the cost function c decreases at each step of the execution of programs: it means that for every L ∈ S(D), c(L) ≤ c(N ) -1. From there, we obtain that c(LD) = c(L) + c(D) < c(C). if the first rule applied is CL, it means that C = DN , with (D, s) a (C × S)value. Then s 2 = L∈S(D) D(L) • {(DL, s) 1 }, with N → D. We can see that c(DL) ≤ c(C) -1 for every L ∈ S(D), and we conclude similarly to the previous case.

Figure 8 . 5 :

 85 Figure 8.5: Proof Scheme

Proposition 8 . 3 . 21 (

 8321 Completness of the Trace Distance on Λ ≤1 ⊕ )

Theorem 8 . 3 . 22

 8322 The trace distance δ tr Λ ≤1 ⊕ is fully abstract with respect to observational distance for Λ ≤1 ⊕ .

  3.13 a similar-but weaker-result -with the aim of defining the operational semantics on (C × S). Recall that a key point there was that if (C, s) → (C×S) D, then for every (D, t) in the support of D, c(D) < c(C), where c : C → N is as defined in Proposition 7.4.1 from Chapter 7. Here, we cannot use the function c(•) anymore, because when rearranging a state {(C, s) 1 }, we can obtain for instance a state {(D, t) 1 } with c(C) < c(D). Instead, we build a function p : (C×S) → N 3 , where N 3 is equipped with the lexicographic order, as follows: p((C, s)) = (sup{c(M ) | M ∈ S(F(C[s]))}, height(s), is-val(s)),

Lemma 8 . 3 .

 83 [START_REF] Crubillé | On applicative similarity, sequentiality, and full abstraction[END_REF] Let R be a clustered relation on the states of the WLTS L

  The proof is as represented in Figure 8.6. First s C[R] E P t means that there exist E ∈ E (L (Λ ≤1 ⊕ )), and a state-context C ∈ C(E → E P ), such that s = C[s ], and t = C[t ]. Looking at the L (C×S) -states {(C, s ) 1 } and {(C, t ) 1 }, we see-using Lemma 8.3.24-that because R (C[R])

3 . 11 ,

 311 that tells that (C[R])+ is preserved by . Proposition 8.3.28 The closure up-to convex sum combined with the composition by context R → (C[R])

Definition 8 . 4 . 1

 841 Tuples are pairs of the form K = (M , N ) where M and N are sequences of Λ ! ⊕ -programs. The set of all such tuples is indicated as TUPLES. The first component of a tuple is called its exponential part, while the second one is called its linear part.

  ! ⊕ -values. Observe that this idea is a generalization of what happens in L (Λ ≤1 ⊕ ), where we have the class of programs, and the class of distinguished values. We first extend our typing judgments on Λ ! ⊕ -program: if M is a program, and σ = (σ, b) ∈ A × {⊥, }, we write M : σ when M : σ and moreover ((b = ) ⇒ M ∈ V Λ ! ⊕ ).

8. 4 .

 4 TRACE DISTANCE FOR Λ ! ⊕ Action Modalities for the environment How do states in S M ! ⊕ interact with the environment? This is captured by the labels in A M ! ⊕ , and the associated probability matrix. As the WLTSs L (Λ ≤1 ⊕ ) and L (Λ ⊕ cbn ),

Example 8 . 4 . 3

 843 We consider the tuple element K = [I] , [I, !Ω], and we note σ = α → α.

8. 4 .Proposition 8 . 4 . 2

 4842 TRACE DISTANCE FOR Λ ! ⊕ The trace distance on Λ ! ⊕ -programs δ tr Λ ! ⊕ is observationally correct. Proof. Let σ be a type in A Λ ! ⊕ , and M, N two Λ ! ⊕ -programs at this type. Our goal is to show that (δ tr Λ ! ⊕ ) σ (M, N ) ≥ |Obs σ (M ) -Obs σ (N )|. As a first step, we unfold the definition of (δ tr Λ ! ⊕

  where the E A are all the states of the form (D, A) ∈ S Λ ! ⊕ . Definition 8.4.20 We take C(E A → E B ) := C(A → B). If s = (D, A) ∈ E A , and C = (M , N ) ∈ C(A → B), we denote by C[s] the state in E B defined as:

Proposition 8 . 4 . 8

 848 Both R → (R) and R → (C[R]) are valid quantitative up-to techniques on L (Λ ! ⊕ ).

Figure 9 . 2 :

 92 Figure 9.2: Deduction Rules for Linear Logic

Definition 9 . 1 . 6 (

 916 Symetric Monoidal Closed Category) A symmetric monoidal closed category (SMCC) C is a SMC equipped, for every object A, B with an object (A B) and a morphism eval A,B : (A B) ⊗ A → B such that:∀C object , ∀g ∈ C(C ⊗ A, B), ∃!curry(g) ∈ C(C, A B) such that g = eval A,B • (curry(g) ⊗ id A ).

Definition 9 . 1 . 8

 918 Let (C, ⊗, 1) be a monoidal category. Then a co-monoid consists of a triple (M, d, e), where M is an object of C, and d : M → M ⊗ M -called comultiplication-and e : M → 1 -called the co-unit-are two morphisms in C such that the two diagrams below hold:

Definition 9 . 1 . 9

 919 Let (C, ⊗, 1) a commutative monoidal category, and A an object of C. A comonoid (M, d, e) is the free commutative comonoid over A if there exists a morphism A : M → A, such that moreover the following universal property holds:∀(M , d , e ) commutative comonoid ∀f : M → A ∃!f † comonoid morphism(M , d , e ) → (M, d, e)such that the diagram below commutes in C :

Definition 9 . 1 . 11 (

 9111 New-Seely Category) A new-Seely category consists of: • A -autonomous category C with finite products • A comonad (!, der, digg) to model the modality • Two natural isomorphisms m 0 : 1 ∼ = ! and m 2 : !A ⊗ !B ∼ = !(A & B).

Definition 9 . 1 . 12 (

 9112 Co-Kleisli Category) Let C be a category, and (T, η, µ) a co-monad on C. The co-Kleisli category C T associated to T is defined as:• the objects of C T are the same as those of C;• for every A, B objects of C T , C T (A, B) = C(T A, B).When the category C is a new-Seely category, the co-Kleisli category C ! becomes Cartesian closed, and consequently a model of simply typed λ-calculus. Proposition 9.1.1 If C is a new-Seely category, then the category C ! is Cartesian closed. Example 9.1.1 (Coh) The first model of LL was introduced by Girard using the notion of coherence space [51]. A coherence space A = (|A| , ¨A) is a pair of a set |A|, the web, and a symmetric reflexive relation ¨A, the coherence. The exponential modality of the original model is given by the finite cliques functor, |!A| = {x ⊆ f |A| | ∀a, a ∈ x, a ¨A a }, leading to a new-Seely model. By contrast, the free exponential modality |

Figure 9 . 3 :

 93 Figure 9.3: Expressing any exponential modality ! using the free exponential modality ! f .

Proposition 9 .

 9 2.2 ([55]) Let I be a countable set and S ⊆ R + [I]. The pair (I, S) is a probabilistic coherence space iff: 1. S is bounded and complete (see Def. 9.2.1); 2. S is Scott closed, i.e. ∀u ≤ v ∈ S, u ∈ S, and ∀D ⊆ S directed, it holds that sup D ∈ S; 3. S is convex, i.e. ∀u, v ∈ S, λ ∈ [0, 1], λu + (1 -λ)v ∈ S.

Example 9 . 2 . 2 (

 922 PCS of Natural Numbers) We define the PCS N PCoh by taking |N| PCoh = N, and P N PCoh = {u ∈ R N + | n∈N u n ≤ 1}.

Definition 9 . 2 . 4 (

 924 The bifunctor ⊗.) We define a bifunctor ⊗ : PCoh × PCoh → PCoh as follows: • The action of ⊗ on objects is specified by: |A ⊗ B| := |A| × |B|, and P (A ⊗ B) := {v ⊗ w | v ∈ P (A) , w ∈ P (B)} ⊥⊥ , where (x ⊗ y) (a,b) = x a y b , for a ∈ |A| and b ∈ |B|. • The action of ⊗ on morphisms u ∈ PCoh(A, B) and v ∈ PCoh(A , B ) is defined as (u ⊗ v) (a,a ),(b,b ) := u a,b v a ,b , for (a, a ) ∈ |A ⊗ A |, (b, b ) ∈ |B ⊗ B |. • The symmetry swap ∈ PCoh(A ⊗ B, B ⊗ A) is given by swap (a,b),(b ,a ) := δ a,a δ b,b .

4 for every b 1

 1 , b 2 ∈ {t, f}. It corresponds to the fact that the probability of obtaining (b 1 , b 2 ) after evaluating M is equal to the probability of obtaining first b 1 and then b 2 when we evaluate twice N . Example 9.2.5 (Actions of ⊗ on morphisms from Bool to Bool.) We illustrate here the action of ⊗ on morphisms, by considering u, v ∈ PCoh(Bool, Bool) corresponding to the Markov chains in Figure 9.4a and 9.4b respectively. The resulting morphism u⊗v may be interpreted as follows: it is the Markov chain that has for states the pair of booleans, and whose transition function is defined as follows: from a state (b 1 , b 2 ), it applies independently the transition function of the Markov chain encoded by u to the boolean on the left, and the one encoded by v to the boolean on the right. This morphism u ⊗ v is represented in Figure 9.4c.

  v ∈ PCoh(Bool, Bool) (true, true) (false, false) (true, false)

Figure 9 . 4 :

 94 Figure 9.4: Example of tensor product of morphisms in PCoh.

,•

  for any µ ∈ M f (|A|). The action of ! e on a morphism f ∈ PCoh(A, B) is defined, for any µ ∈ |! e A| and ν = [b 1 , . . . , b n ] ∈ |! e B|, as: (! e f ) µ,ν := (a 1 ,...,an) s.t. [a 1 ,...,an]=µ n i=1 f a i ,b i (9.3)

Example 9 . 2 . 9

 929 Equation (9.3) introduces arbitrary large scalars, moving us away from the intuitive setting of distributions and stochastic matrices (see Examples 9.2.1, 9.2.3). For an example, consider the morphism f ∈ PCoh(Bool, 1) defined by f true, * = f false, * = 1. Remark that for any n, m ∈ N, we have:! e f [true n ,false m ],[ n+m ] = (n+m)! n!m! ,which is the number of different enumerations of the multiset [true n , false m ] with n (resp. m) occurrences of true (resp. false). This shows why, in the definition of a PCS, coefficients have to be in the whole of R + and cannot be restricted to [0, 1]. Denotations of PCF ⊕ programs are going to be morphisms in the co-Kleisli category associated with the comonad ! e , i.e. elements of PCoh(! e A, B). Recall that the morphisms in PCoh(A, B) are the linear functions from the set of A cliques to the set of B cliques. Formally, morphisms in PCoh(! e A, B) are matrices in R M f (|A|)×|B| +

Definition 9 . 2 . 6

 926 We call functional interpretation of a matrix f ∈ R M f (|A|)×|B| + the function:

Lemma 9 . 3 . 1

 931 Let C be a sequentially complete cone. The addition + : BC × C → C and the scalar multiplication • : [0, 1] × BC → C are sequentially Scott-continuous.

Definition 9 . 3 . 6 (

 936 Parallel Convergence Tester for Cones) We denote as 1 the sequentially complete cones R + , with the absolute value |•| as norm. We consider the cone function T : B1 × B1 → B1, defined as:

Definition 9 . 3 . 7 (

 937 Local Cone) Let be C a cone, n ∈ N, and x ∈ B • C. We call n-local cone at x, and we denote C n

Example 10 . 1 . 1

 1011 We illustrate here the action of ⊗-words on any MC C, by looking at ⊗-words of length 4. We consider the two different bracketings given by the ⊗-words: w = ( ⊗ ) ⊗ ( ⊗ ) and w = 1 ⊗ ( ⊗ ( ⊗ ( ⊗ ))). Whenever A 1 , . . . , A 4 are four objects of C, the functors w C and w C act on these objects as follows:

Definition 10 . 1 . 2 (

 1012 Power Tensor Functors) Let be C a MC. If w is an ⊗-word of length n, we note w C : C → C the functor defined as w C (A) = w C (A, . . . , A), and w C (f ) = w C (f, . . . , f ).

Figure 10 . 1 : 1 C → w 2 C

 10112 Figure 10.1: Domain and codomain for formal morphisms

Figure 10 . 2 :

 102 Figure 10.2: Interpretation for valid formal morphisms

Definition 10 . 1 . 6 (

 1016 Underlying Permutation) For every SMC formal morphisms e, with domain and co-domain of length n, we define its underlying permutation as the element p(e) ∈ S n defined inductively on the structure of e as specified in Figure10.3. Example 10.1.6 We see that the underlying permutation of the formal SMC morphism f defined in Example 10.1.5 is σ = (2, 3) • (1, 2) ∈ S 3 .

p(idw) = 1 Figure 10 . 3 :

 1103 Figure 10.3: Underlying permutation for SMC formal morphisms

Definition 10 . 1 . 7 (

 1017 Equalizer) Let C be some category, and A, B two objects of C. Let f 1 , . . . , f n a family of morphisms in C(

Figure 10 . 4 :

 104 Figure 10.4: Diagram defining the commutation of the limit ! f A with ⊗: for every objects B, C and family of morphisms (f i ) i∈N as represented in the diagram, there exists a unique u ∈ C(C, ! f A ⊗ B) making the diagram commute.

  have meaning as specified in Notation 10.2.1.

Definition 10 . 2 . 1

 1021 Let A be a PCS, and n ∈ N. We define the modified jammer matrixjm n A ∈ R |A ⊗n |×Mn(|A|)+ as:

)

  Define w ∈ R |A ⊗n ⊗B| + as w ( a,b) = 1 m(

  A, B s.t. |A| ⊆ |B|, we define the matrices injection ι A,B ∈ R |A|×|B| + and projection ρ B,A ∈ R |B|×|A| + as follows: (ι A,B ) a,b = (ρ B,A ) b,a = δ a,b . (10.9) The injection ι A,B maps a vector u ∈ R |A| + to the vector ( u, 0 ) ∈ R |B| + associating the directions in |B| \ |A| with zero-here × denotes the cartesian product between vectors as defined in Section 9.2.1 of Chapter 9, and 0 the zero vector. The projection ρ B,A maps Chapter 11

θ 2 =

 2 [b 1 , . . . , b j-1 , b j -a 1 ∧ b j , b j+1 , . . . , b m ] if a 1 ∧ b j = b j [b 1 , . . . , b j-1 , b j+1 , . . . , b m ] otherwise. x = x -a 1 ∧ b jAt every step of the procedure presented above, the quantity: card((i, j) | not (a i ⊥ b j ))

2 :•

 2 π 1 = [b 1 , b 2 ], and π 2 = [a 1 , a 2 ], where a 1 , a 2 , b 1 , b 2 are taken as pictured in Figure11.1a. We are going to apply our procedure in order to obtain a refinment of both π 1 and π 2 . At the beginning, we have Θ1 = π 1 , Θ 2 = π 2 , w = x, v = 0.• The first step is represented in Figure11.1a. Observe that the procedure is actually non-deterministic: we may choose any (a, b) with a ∈ π 1 , b ∈ π 2 , and a and b not orthogonal. Here, we choose to start from (b 1 , a 1 ). We take v = a 1 ∧ b 1 (and we represent it by a red vector in Figure11.1a): it is going to be the first element of our new partition π. Accordingly, we take π = [v]. We know update the partition Θ 1 and Θ 2 into partitions of w = x -v: Θ 2 becomes [a 1 , a 2 ], and Θ 1 becomes [b 1, b 2 ] where a 1 = a 1 -b 1 ∧ a 1 and b 1 = b 1 -a 1 ∧ b 1 are represented also in red in Figure 11.1a. • The second step is represented in Figure 11.1b. Observe that now a 1 and b 1 are orthogonal, so we have to choose another pair. Here, we choose (b 1 , a 2 ). As before, we add to π the glb of b 1 and a 2 : we obtain π = [a 1 ∧ b 1 , b 1 ∧ a 2 ]. Observe that now (as can be seen on Figure 11.1b, b 1 ≤ a 2 , and so b 1 ∧ a 2 = b 1 . So when we update the partition Θ 1 and Θ 2 , we take: Θ 2 = [b 2 ], and Θ 1 = [a 1, a 2 ] where a 2 = a 2 -b 1 is represented in purple in Figure 11.1b. By doing again two steps of the procedure, we see that the final partition π is [a 1 ∧b 1 , b 1 , a 1 , a 2 ]. We can see by looking at Figure 11.1b that it is indeed a refinment of both π 1 and π 2 ..

2 b 1 ∧ a 1 (Figure 11 . 1 :

 211111 Figure 11.1: Illustration of the Proof of Lemma11.1.2

Lemma 11 . 1 . 3 (

 1113 from[START_REF] Mcmillan | Absolutely monotone functions[END_REF]) Let C be a lattice cone, D a directed complete cone, f a pre-stable function fromC to D. Let be x ∈ B • C. Then D n f (x | •) is a symmetric function B(C nx ) → D such that moreover:• 0 ≤ D n f (x | u) ≤ ∆ n f (x | u); • both u → D n f (x | u) and u → ∆ n f (x | u) -D n f (x | u) are pre-stable functions from C n x to D.

Lemma 11 . 1 . 4 2 ••

 11142 Let C, D be two directed complete lattice cones, x ∈ B • C.• Let f : BC → D be a pre-stable function. ThenD n f (x | •) : B(C n x ) → D is n-linear, in the sense that: D n f (x | u 1 , . . . , λ • v + w, . . . u n ) = λ • D n f (x | u 1 , . . . , v, . . . u n ) + D n f (x | u 1 , . . . , w, . . . u n ). • For any u ∈ B(C n x ), the function f ∈ Cstab(C, D) → D n f (x | u) ∈ D is linear and directed Scott-continuous. and by Scott-continuity of •, it tells us that D n f (x | u 1 , . . . , λ 2 •u i , . . . , u n ) = λD n f (x | u 1 , . . . , 1 2 • u i , . . . , u n ). We can now conclude: recall that D n f (x | v) = 2 • D n f (x | u 1 , . . . , λ 2 • u i , .. . u n ). Therefore:D n f (x | v) = 2 • λ • D n f (x | u 1 , . . . , 1 u i , . . . , u n ) = λ • D n f (x | u) We show now that f ∈ Cstab(C, D) → D n f (x | u) ∈ D is linear and Scottcontinuous. It is immediate that it is linear, since every one of the f → ∆ n f (x | u) is.We are now going to use 11.1.5 to show the Scott-continuity: it tells us that we have only to check that for every E ⊆ C ⇒ m D directed for the reverse order,D n f (inf E | u) = inf D n f (E | u). Observe that: D n (inf E)(x | u) = inf π∈Parts( u) y 1 ∈π 1 . . . yn∈πn ∆ n (inf E)(x |y 1 , . . . , y n ) = inf π∈Parts( u) y 1 ∈π 1 . . . yn∈πn inf f ∈E {∆ n f (x | y 1 , . . . , y n )

yn∈πn∆

  n f (x | y 1 , . . . , y n )} = inf f ∈E D n f (x | u) since the infs can be exchanged.The linearity of the derivatives means that for every x ∈ B • C, we can extend D n f (x | •) to a function C x n → D. We will use implicitly this extension in the following, especially in Definition 11.1.5.

Definition 11 . 1 . 5

 1115 Let be x ∈ B • C. We call Taylor partial sum of f in x at the rank N the function T f N (x | •) : BC 1x → D defined as:T f N (x | y) = f (x) + k f (x | y, .. . , y).

  k f (x | y, . . . , y) π∈Parts(y) σ:[[1,k]] →[[1,n]] D k f (x | σ(π))Using Lemma 11.1.3, we see that it implies:T f N (x | y) ≤ f (x) + π∈Parts(y) σ:[[1,k]] →[[1,#(π)]] ∆ k f (x | σ(π))

Definition 11 . 1 . 6

 1116 We define T f (x | •) : BC 1 x → D the Taylor series of f in x and Rf (x | •) : BC 1x → D the Remainder of f in x as:T f (x | y) = sup N ∈N T f N (x | y) Rf (x | y) = f (x + y) -T f (x | y).

Lemma 11 . 1 . 8

 1118 Let be x ∈ B • C. Then it holds that both:Rf x : y ∈ BC 1 x → Rf (x | y) ∈ D and Rf y : x ∈ BC 1 y → Rf (x | y) ∈ Dare pre-stable functions. Moreover Rf x (0) = 0, and for every x ∈ BC 1 y , it holds that T (Rf y )(0 | x) = 0.

Lemma 11 . 1 . 9

 1119 in Lemma 5.26. It is based on the fact that the Scott-continuity of f → D n f (x | u) allows us to show that if we take g(y) = D n f (x | u), then D k g(x | v) = D n+k f (y 0 | u, v),and from there to compute the Taylor series of Rf y . The second technical lemma gives us a way to decompose Rf (x | y) into smaller pieces. It is stated in Theorem 5.3 in [80]. Let be x, y such that x + y ∈ BC. Then Rf (0 | x + y) ≤ Rf (y | x) + Rf (x | y), and furthermore Rf (0 | x + y) ≥ Rf (x | y), and Rf (0 | x + y) ≥ Rf (y | x), and moreover all the inequality are in the cone of pre-stable functions.

  ]):T (Rf +x )(0 | y) = T (Rf x )(0 | y) (11.2) and R(Rf +x )(0 | y) = R(Rf x )(0 | y) (11.3)As a consequence, we can write:Rf (x | y) + Rf (y | x) = Rf x (y) + Rf x (y) = T (Rf x )(0 | y) + R(Rf x )(0 | y) + T (Rf x )(0 | y) + R(R x f )(0 | y) = T (Rf x )(0 | y) + R(Rf +x )(0 | y) + T (Rf +x )(0 | y) + R(R x f )(0 | y) by (11.2) and (11.3) = Rf +x (y) + T (Rf x )(0 | y) + R(R x f )(0 | y) ≥ Rf +x (y) = Rf (0 | x + y),and we see that we have also shown that the difference is pre-stable. The other two statement are shown in a similar way.

  Proposition 11.1.11 (Extended Bernstein's Theorem) Let be C, D directed-complete lattice cones, and f : BC → D a pre-stable function. Then for every x ∈ B • C, it holds that f (x) = T f (0 | x). Proof. Let be x ∈ BC. First, we consider the partition π = [ x N , . . . , x N ] of x, with N taken such as x + x N ∈ BC. We know that such an N exists since x is in the open unit ball B • C. We use Lemma 11.1.10 on Rf (0 | x), and the partition π, and it tells us that: Rf (0 | x) ≤ 1≤j≤N inf π=(u 1 ,...,un)∈Parts( x N ) 1≤i≤n

  as:Rf (0 | x) ≤ 1≤j≤N inf π=(u 1 ,...,un)∈Parts( x N ) 1≤i≤n Rf (x | u i ) -Rf (x | 0). (11.5)

7 )

 7 leads us to Rf (0 | x) ≤ 1≤j≤N D 1 Rf x (0 | x N ). Moreover, we know that for every y ∈ BC 1x ,D 1 Rf x (0 | y) ≤ T (Rf x )(0 | y).Hence by using again Lemma 11.1.8, which says that T (Rf x )(0 | x N ) = 0, it holds that Rf (0 | x) = 0.

Definition 11 . 2 . 2

 1122 We define f ∈ R + M f (|X |) × |Y| by taking: f [a 1 ,...,a k ],b = α [a 1 ,...,a k ] k! D k g(0 | e a 1 , . . . e a k ) b ∈ R + .whereα µ = #{(c 1 , . . . , c k ) ∈ |X | k with µ = [c 1 , . . . , c k ]}.

4 ,

 4 c 1 ,...,c k )∈A k 1 k! D k g(0 | e c 1 , . . . e c k ) b • we know that D k g(0 | •) is k-linear.As a consequence, and since x = m i=1 x c i • e c i and that moreover A is finite, we see that(11.8) implies the result:(f • x ! ) b = ∞ k=0 1 k! D k g(0 | x, . . . x) b = T g(0 | x).

• |r| n-1 c n- 1

 1 |h n (r)| ≤ ( ν∈M f (2,...,p) a ν+[1 n ] • | u| ν ) • n • |r| n-1 = ( ν∈M f (2,...,p) a ν+[1 n ] • | u| ν • c n ) • n • f (1,...,p)|η(1)=n a η • |(c, u)| η ) • n • 1 cSince the series S( r) = a µ • r µ is convergent on I, and (c, | u|) ∈ I, it holds that there exists M ≥ 0, with ν∈M f (1,...,p)|ν(1)=n a ν • |(c, u)| ν ≤ M. As a consequence, and since moreover for each r ∈ J, it holds that |r| ≤ b, we can now write:∀r ∈ J, |h n (r)| ≤ M • n

n∈N h n 1 =

 n1 (r, (r 2 , . . . , r p )) = n∈N ( ν∈M f ({2,...,p}) a ν+[1 n ] (r 2 , . . . , r n ) ν ) • n • r n-ν∈M f ({1,...,p})|1∈ν

Lemma 11 . 4 . 6

 1146 Let S( r) = ν∈M f ({1,...,p}) a ν •( r) ν with a ν ≥ 0. We suppose S convergent on I =] -b, b[ p , with b > 0. Then for every multiset ν ∈ M f ({, 1 . . . , p}), there exists 0 < b ≤ a, such that, when we define g : r ∈ [-b, b] p → S( r), the partial higher-order derivative ∂g card(ν)

  η∈M f ({1,...,p}) a η+ν • r η • 1≤j≤p (η + ν)(j)! η(j)! .

11. 5 .

 5 CONCLUSIONWe see we can apply Lemma 11.4.5 with T as multiset series, and I = [-c, c] p . It means that there exist 0 < d < c, such that ∂T ∂r i exists, and ∂T ∂r i( r) =η∈M f ({1,...,p})|i∈η a η+ν • r η-[i] • η(i) • 1≤j≤p (η + ν)(j)! η(j)! = ι∈M f ({1,...,p}) a ι+κ • r ι • (ι + [i])(i) • 1≤j≤p (ι + κ)(j)! (ι + [i])(j)! = ι∈M f ({1,...,p}) a ι+κ • r ι • 1≤j≤p (ι + κ)(j)! ι(j)! .We end the proof of Lemma 11.4.3 by using Lemma 11.4.6 for each u ∈ R n on the multiset series given by S u ( r) = ν∈M f ({1,...,p})(Ξ X ,Y γ( u)) ν,b • r ν .

12. 4 .

 4 IS CSTAB M THE CO-KLEISLI CATEGORY OF A LL MODEL ?

  The Pure λ-Calculus Λ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.1.1 Syntax of Pure λ-Calculus . . . . . . . . . . . . . . . . . . . . . . . . 1.1.2 Operational Semantics for Λ . . . . . . . . . . . . . . . . . . . . . . 1.2 Λ ⊕ : A Probabilistic Extension of Λ. . . . . . . . . . . . . . . . . . . . . . . 1.2.1 One Step Reduction Relation. . . . . . . . . . . . . . . . . . . . . . . 1.2.2 Operational Semantics . . . . . . . . . . . . . . . . . . . . . . . . . . 1.2.3 Big-step operational semantics for Λ ⊕ . . . . . . . . . . . . . . . . . . 1.3 Probabilistic Typed Higher-Order Languages . . . . . . . . . . . . . . . . . Contexts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.3 Observational Equivalence . . . . . . . . . . . . . . . . . . . . . . . . . . . . Observational Metric . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.2 The Trivialization Problem . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.2.1 Amplifying the Observed Distance by Copying . . . . . . . . . . . . 3.2.2 Amplification Contexts . . . . . . . . . . . . . . . . . . . . . . . . . 3.2.3 Trivialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.2.4 Link with Cryptography . . . . . . . . . . . . . . . . . . . . . . . . . PCoh ! is a full subcategory of Cstab m . . . . . . . . . . . . . . . . . . . . 11.4 F m is cartesian closed. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11.5 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Abramsky's applicative bisimulation for an higher-order language with continuous probabilities. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12.2 State-based Applicative Bisimulation Distances for Probabilistic Higher-Order Languages. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12.3 The Full Abstraction Problem for PCF sample in the category of measurable cones and measurable stable functions. . . . . . . . . . . . . . . . . . . . . . 12.4 Is Cstab m the co-Kleisli category of a LL model ? . . . . . . . . . . . . . . 12.5 A Context Distance adapted to Polytime Adversaries. . . . . . . . . . . . .

	1 Probabilistic λ-calculi 1.1 3 Go Beyond Observational Equivalence Prelude. 3.1 12 Perspectives 12.1 Part I Chapter 1

1.3.1 PCF ⊕ : A Probabilistic Variant of PCF . . . . . . . . . . . . . . . . . 1.3.2 T ⊕ : A Probabilistic Variant of Gödel's System T. . . . . . . . . . . . 1.4 Extending λ-calculus with Continuous Probabilities. . . . . . . . . . . . . . 1.4.1 Overview of Measure Theory . . . . . . . . . . . . . . . . . . . . . . 1.4.2 The Language PCF sample . . . . . . . . . . . . . . . . . . . . . . . . . 2 Observational Equivalence 2.1 Observables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.1.1 Deterministic Case: . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.1.2 Non-deterministic Case: . . . . . . . . . . . . . . . . . . . . . . . . . 2.1.3 Probabilistic Case: . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.2 2.3.1 On the Observational Equivalence on Open Terms . . . . . . . . . . 2.3.2 Context Preorder . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II Operational Reasoning on Discrete Probabilistic λ-calculi. 4 Background: Applicative Bisimilarities for Higher-Order Probabilistic Calculi CONTENTS 11.3

  1.2. Λ ⊕ : A PROBABILISTIC EXTENSION OF Λ. Definition 1.2.1 (The CBN and CBV Redex Rules for Λ ⊕ ) We define the CBN and CBV redex-rules as respectively the following relations →

4 .

 4 Example 1.2.[START_REF] Abramsky | Full abstraction in the lazy lambda calculus[END_REF] We look again at the program M defined in Example 1.2.3. We can see that the operational semantics of M is as expected, i.e. M = ∞

	1≤n	1 2 n {n 1 }.

  2.1 above are amplification contexts. However, observe that the family C n can amplify an observed difference only if one of the program D[M ] or C[N ] terminates with probability 1, where D is the original context separating M and N of a distance . As an illustration of that, we look in Example 3.2.2 below what happens if we take the programs Ω and Ω ⊕ I. We have seen in Example 3.1.2 that the terms Ω and Ω ⊕ I were at distance at least , and we have shown that this separation was done by the context D = [•]. We see that Obs(C n [Ω]) = 0: the program C n [I] never terminates. On the other hand, it holds (as before) that Obs(C n [Ω ⊕ I]) = n . But contrary to the previous case, we see here that using the context C n does not amplify the difference: actually, the context C n separates less these two programs than the original context [•].

	Example 3.2.2

  An equivalence relation R on programs is said to be sound with respect to observational equivalence if for any programs M and N , M RN implies M ≡ obs N .

	Chapter 4
	Background: Applicative
	Bisimilarities for Higher-Order
	Probabilistic Calculi
	As illustrated in the examples in Chapter 2, it is relatively easy to show that two given
	programs are not equivalent: this boils down to exhibiting one context able to distinguish
	them. However, it is much harder to show that these programs are equivalent, since we
	have to show that their observables are the same under any context, as highlighted in
	Example 2.3.2. For this reason, an important part of the work on equivalences for higher-
	order languages has been focused on developing notions or proof techniques for program
	equivalence. To be useful, such an alternative equivalence relation R should fulfill two
	objectives: proving that two programs are related by R has to be easier than proving that
	they are contextually equivalent, and moreover whenever two programs are R-related,
	they should also be context equivalent. The second requirement is the so-called soundness
	property, and is formalized in Definition 4.0.1 below.
	Definition 4.0.1

  We may now test a program M under a trace α by evaluating C α [M ], and this succeed whenever the execution of C α [M ] terminates. We consider the programs M 1 = (λx.I) ⊕ (λx.Ω) and M 2 = λx.(I ⊕ Ω).

	Definition 4.2.2 We define the probability that the program M performs successfully un-
	der the trace α as Prob(M ↓)(α) = Obs(C α [M ]).
	Two programs are trace equivalent, if their probability of success is the same for all traces,
	i.e. if no applicative context is able to distinguish them.
	Definition 4.2.3 We say that M and N are trace equivalent, and we note M ≡ tr N , if
	for every trace α, it holds that Prob(M ↓)(α) = Prob(N ↓)(α). We note M ≤ tr N if for
	every tract α, Prob(M ↓)(α) ≤ Prob(N ↓)(α)
	Example 4.2.1

  Proposition 4.2.3 Let be L a deterministic WLTS. Then two states s, t of L w are WLTS-similar if and only if s tr L w t, and they are WLTS-bisimilar if and only if they are trace equivalent.

  and that V is a value. Then looking at Howe's construct, we see that it means that there exists L with x M ( • ) H L and ∅ λx.L • λx.N . Since ( • ) H is reflexive and value substitutive, we obtain that ∅ M {V /x} ( • ) H L{V /x}, and since is a simulation, we obtain that ∅ L{V /x} ( • ) H N {V /x} . We can now conclude by the pseudo-transitivity property from Lemma 5.1.3, and we see that

  Recall that we know already that ( • ) H is compatible, and moreover • ⊆ ( • ) H : as a consequence it is enough to show that the Howe's lifting of • is conservative. Using the key Lemma 5.1.7, we see that ( • ) H • ) H |P ⊆ . We can conclude by applying Lemma 5.1.5: it tells us that ( • ) H ⊆ • .

	Λ ⊕ |S cbn	is a simulation. Since	is the greatest
	simulation, it holds that (

• . Theorem 5.1.8 • is compatible. Proof.

  Asymmetric Case: cbv Λ ⊕ is not complete Theorem 5.2.6 establishes a precise correspondence between bisimilarity and context equivalence. However, it cannot be extended into a correspondence between similarity and the context preorder; we are actually able to show that similarity and context preorder do not coincide, by giving a counterexample, namely a pair of terms which can be compared in the context preorder but which are not similar. This counter-example actually consists of the same programs as the counter example to completeness of probabilistic applicative bisimilarity for CBN Λ By contrast, in CBV M and N are neither context equivalent, nor bisimilar: it is for instance witnessed by the context C = Θ P (α) build in Example 5.2.2 as the context emulating the test

⊕ . Let us fix the following terms: M = λy.(Ω ⊕ I) and N = (λy.Ω) ⊕ (λy.I).

Recall that in CBN, M and N are contextually equivalent, but not bisimilar.

  It means that we can compare either two states that are distributions over programs, or two states that are distributions over distinguished values. Recall that we have shown in Example 8.2.1 the existence of a 1 2 -bisimulation, that connects {(λx.I) ⊕ (λx.Ω) 1 } and {(λx.I) 1 }. As a consequence:

  An immediate corollary of Proposition 8.2.4 is that T (s) and T (t) coincide as soon as s, t are comparable. Accordingly, we will denote for E ∈ E (L w ), T (E) := T (s) with s any element of E. Recall that the coinductive definition of bisimilarity distance is welladapted to show upper bounds on the distance between states, as we have illustrated in Example 8.2.2. By contrast, the inductive characterization allows to easily show lower bounds, as we can see in Example 8.2.3 below. We consider once again the Λ ⊕ programs M := λx.I, and N := λx.I ⊕ λx.Ω, and we look at what we can learn using the trace characterization of the bisimilarity distance on the WLTS L (Λ ⊕ cbn ). Recall that we have shown in Example 4.2.4 of Chapter 4 the existence of a trace α with Prob

	Example 8.2.3

  Let E 1 , E 2 be two equivalence classes in E (L (Λ ≤1

	Definition 8.3.6

≤1 ⊕ ) state-context in C(E 1 → E 2 ) by a state in E 1 . ⊕ ))

, and s ∈ E 1 . Let D be the sub-distribution obtained by taking either D

  2.2-binary relation on states. Definition 8.3.7 Let L w be a WLTS equipped with state-contexts. Let R be a clustered binary relation on states. We call compositions of R by states-contexts, and we denote by C[R] the binary relation on states defined as follows: for every equivalence class E for R 1 L w , s (C[R] E ) t when there exists E , C ∈ C(E → E) and two states s , t such that s R E t and s

  relation which is both a ε-bisimulation and contains C[R]. Example 8.3.2 tells us that this relation must be larger that C[R]. To this end, we draw on the inherent convex structure of S Λ ≤1 ⊕-i.e. the fact that we are able to take convex combination of states, since they are sub-distributions over programs. We formalize this idea by defining a class of WLTSs that have this property, in Definition 8.3.8 below. We use there the concept of cone, that can be found in Definition 9.3.1 of Chapter 9-where we use it for totally different purposes, i.e. when presenting a denotational model developed by Ehrhard, Pagani and Tasson of the language PCF enriched with continuous probability. A cone C is essentially a R + -semimodule with a norm • C , that allows to talk about its unit ball BC. We say that a WLTS L w is equipped with a convex structure, if for every E ∈ E (L w ), there exists a cone C E such that E = BC E , and w and • C E coincide on BC E .

	Definition 8.3.8 In Example 8.3.3 below we equip L (Λ ≤1

  Observe that since each E ∈ E (L w ) is stable by convex sums, it holds that the convex closure of R is also a clustered relation. We are in fact able to build explicitly (R) Lemma 8.3.6 Let L w be a WLTS equipped with a convex structure, and R be a clustered binary relation on states. Then s (R) + t if and only if there exists a finite sequence (s n , t n ) 1≤n≤N of pairs of states in R, and (α n ) 1≤n≤N a finite sequence of non-negative real numbers, such that s = 1≤n≤N α n • s n and t = 1≤n≤N α n • t n . -the convex closure of the relation obtained by composing R by contexts-also is an ε-bisimulation and contains C[R]-thus enabling us to apply Proposition 8.3.5. We see immediately that (C[R]) + contains C[R], so from now on we will work towards proving that this combination of contexts and convex closure preserves ε-bisimulations. We first look back at the 1 2 -bisimulation R considered in Example 8.3.2, and we see that taking the context closure of C[R] allows us to overcome the problem highlighted there. Indeed, recall that our proof of C[R] not being a ε-bisimulation consisted of exhibiting a pair of states (s, t) ∈ R, and a context C such that (u, v) ∈ C[R] with u and v defined as In Example 8.3.4 below, we show that (u, v) ∈ (C[R])

	Our goal in the following is to show that if R is a ε-bisimulation on L (Λ ≤1 ⊕ ), then
	(C[R])
	C[s]

). We write (R) + for the smallest relation that is convex closed and that contains R. + starting from R, as stated in Lemma 8.3.6 below. + eval -→ u, C[t] eval -→ v. + : it means that in this particular case we are indeed able to overcome the problem by considering (C[R]) + instead of C[R]. Example 8.3.4 We keep the notation of Example 8.3.2. We can split u and v as follows:

  If L w is a WLTS equipped with a well-behaved convex structure, the convex closure R → (R)+ is a valid quantitative up-to technique. 8.3.4 Combining Composition by Contexts and Convex Closure. . if s, t are in E P with s C[R] t then the pair of states we obtain after doing a eval action is in (C

	comes from Condition 2 in our definition of
	a well-behaved convex structure.
	An immediate consequence of Lemma 8.3.8 is that taking the convex closure is indeed a
	valid quantitative up-to-technique for the WLTS L (Λ ≤1 ⊕ ).
	Proposition 8.3.9 Recall that our goal in the present Section is to show that if R is a ε-bisimulation, and
	(s, t) are in C[R], then s and t are ε-bisimilar. Since taking the convex closure is a
	valid quantitative up-to technique, it is enough to show that C[R] is ε-bounded-which
	is apparent from the definition of C[R]-and that C[R]	(C[R])

+ . So we fix R an ε-bisimulation, and we show that C[R] (C[R]) + , i.e. : 1. if s, t are in E V , with s C[R] t then the pair of states we obtain after doing a V action -for any value V -is again in C[R].

2

  Since the composition by contexts preserves ε-boundedness, it means that if R is a εbisimulation, then C[R] is a ε-bisimulation up to convex closure. From there-and since the convex closure is a valid up-to technique-we can conclude-as stated in Proposition 8.3.18 that the WLTS L (Λ ≤1 ⊕ ) is non-expansive.We know-from Proposition 8.3.3-that the trace distance on Λ ≤1 ⊕ is observationally correct and-from Theorem 8.3.19-that it is also non-expansive. As a consequence, we are now able to apply Proposition 8.1.1, which allows us to finally conclude that it is sound.

	Proposition 8.3.18 The WLTS L (Λ ≤1 ⊕ )-equipped with state-contexts as specified in
	Definitions 8.3.5 and 8.3.6-is non-expansive.
	Since we have shown non-expansiveness for L (Λ ≤1 ⊕ ), we are now able to apply Proposi-
	tion 8.3.4, which tells us that the trace distance on Λ ≤1 ⊕ is non-expansive.
	Theorem 8.3.19 δ tr ⊕ Λ ≤1	is a non-expansive distance.
	Theorem 8.3.20 The trace distance δ tr ⊕ Λ ≤1	is sound with respect to the observational dis-
	tance in Λ ≤1 ⊕ .

8.3.7 Full Abstraction of the Trace Distance on Λ ≤1

⊕ .

  .[START_REF] Crubillé | Probabilistic stable functions on discrete cones are power series[END_REF].Proof. By looking at our definition of C[R], we see that there exists E

	Lemma 8.3.23 Let R be such that R	(C[R])

+

. Let V ∈ V, and s, t be such that

s C[R] E V t. Then it holds that u (C[R]

)

+ E P v, where u, v are the L (Λ ≤1 ⊕ )-states defined as s V -→ u, and t V -→ v.

  as we state in Lemma 8.3.24 below. Lemma 8.3.24 Let s, t be two states in L (C×S) such that s ((C♦(C[R])

+ ))

  8.2-that for any (C, s) ∈ (C × S), (C, s) → (C×S) D implies that for every (C , s ) ∈ S(D), it holds that p(C , s ) < p(C, s).It means that a sequence of pairs (s i , t i ) as specified in Lemma 8.3.25 must at some point reach a pair (s N , t N ), such that at least one among s N , t N is in normal form for → S (•,•) . In Lemma 8.3.26 below, we show that when it happens, then both s N , t N are in normal form, and moreover when applying the forgetful function, we get back the pair (u, v) of L (Λ ≤1 ⊕ )-states defined as F(s 0 ) Lemma 8.3.26 Let S be any clustered relation, and s, t be two states connected by (C♦S). Let (un) 0≤n≤N , (v n ) 0≤n≤N be two maximal finite sequences-i.e. there cannot be extended-such that the conditions 1, 2, 3 of Lemma 8.3.25 hold. Then it holds that u N and v N are in normal for for → S (•,•) , and moreover F(u

eval

-→ u and F(t 0 ) eval -→ v. N ) = F(s) , and

  we build in Example 1.2.3 and analyzed in Example 1.2.4 of Chapter 1-such that its operational semantics in CBN Λ

  2. Looking at the concrete description -done in Example 10.1.7-of the symmetry morphisms s σ,n A in PCoh, we also give in Lemma 10.2.2 below a more direct characterization of this morphism, as a matrix in R |A ⊗n |×|A ⊗n | Lemma 10.2.2 Let A be a PCS, and n ∈ N. Then for every a, a ∈ |A ⊗n |:

	(j n A ) a, a = δ∼

+

.

  Bool ) (a 1 ,a 2 ),(a 1 ,a 2 ) = 1 2 δ a 1 ,a 1 δ a 2 ,a 2 + 1 2 δ a 1 ,a 2 δ a 2 ,a 1 , i.e. represents the following Markov chain:

	Thus j 2 Bool is the matrix in R	{t,f}×{t,f} +	defined as: (j 2
	(true, true)		(false, false)
	(true, false)	(false, true)

  where, for any [a 1 , . . . , a k ] ∈ A ≤n , u 1 , . . . , u n [a 1 ,...,a k ] = Proof. In the proof, we note A ≤n for the new presentation proposed in the statement, and (A & 1) =n for the one coming from the definition of symmetries equalizers in Definition 10.2.2. First, notice that there is a bijection between A ≤n and M n (|A| { }) = |(A & 1) =n | obtained just by adding the necessary number of 's to a multiset in A ≤n . Second, the definitions of P A ≤n and of u 1 , . . . , u n follow by remarking that the latter is a notation for jm n A ((u 1 , e ) ⊗ • • • ⊗ ( u n , e )), with jm n A the morphism (A & 1) ⊗n → (A & 1)≤n defined in Definition 10.2.1, and u, v the cartesian product between vectors defined in Section 9.2.1 of Chapter 9-i.e. when defining the cartesian product in PCoh. The result is then a consequence of Lemma 9.2.3: indeed recall from the definition of ⊗

		1 n!	σ∈Sn	k i=1	(u σ(i) ) a i	(10.7)
	=	(n -k)! n!	f :{1,...,k} →{1,...,n}	k i=1	(u f (i) ) a i .	(10.8)

  3, that tells us that P ((A & 1) =n ) = jm n A ( G ) ⊥⊥ .

	Example 10.2.4 We have no simple characterization of Bool ≤2 , but Lemma 10.2.7 helps
	us in computing its generators. For example, we have:
	e t , e f = e [•] +	1 2	e [t,f] +	1 2	e [t] +	1 2	e [f]

e t , e t = e [•] + e [t] + e [t,t] ,

  a 2 , . . . a n ] if a 1 ∧ b j = a 1 [a 2 , . . . , a n ] otherwise.

  11.2.1 A fully faithful functor F : PCoh ! → Cstab m . that Definition 11.2.1 gave a way to see a PCS as a cone. Moreover, as stated in Proposition 11.2.2 below, a morphism in PCoh ! can also be seen as a stable function, in the sense that E X ,Y ⊆ Cstab(C X , C Y ).

	Recall

Proposition 11.2.2 Let be f ∈ PCoh ! (X , Y). Then f is a stable function from C X to C Y .

Background: Two Denotational Models for Higher-Order Languages with Probability

1.1. THE PURE λ-CALCULUS Λ

1.2. Λ ⊕ : A PROBABILISTIC EXTENSION OF Λ.

Definition 1.3.2 A typing judgment is an assertion of the form Γ M : σ, where Γ is a context, M is a term, and σ is a type. A typing judgment is valid if it can be inductively derived by the rules of the formal system given in Figure1.1.(x, σ) ∈ Γ Γ x : σ n ∈ N Γ n : N Γ M : N Γ N : σ Γ, z : N L : σ Γ if(M, N, z • L)σ Γ, x : σ M : τ Γ λx.M : σ → τ Γ coin : N Γ M : N Γ succ(M ) : N

1.4. EXTENDING λ-CALCULUS WITH CONTINUOUS PROBABILITIES.

2.3. OBSERVATIONAL EQUIVALENCE

It will still be true in the probabilistic case, but it doesn't hold for instance in the non-deterministic case.

Abramsky's original proof is done by way of a denotational semantics, while Howe's proof uses only operational semantics.

Our definition of open extension depends on our reduction strategy; indeed in CBV, only values may be substituted during the execution of a program, while in CBN all terms may be.

In the proof of congruence for the probabilistic call-by-value λ-calculus in[START_REF] Lago | On coinductive equivalences for higherorder probabilistic functional programs[END_REF], we had to consider the transitive closure of ( • ) H , since the definition of simulation required the relation to be preorder, which implies that the transitivity of ( • ) H is needed. Here, however, following the presentation in[START_REF] Crubillé | On applicative similarity, sequentiality, and full abstraction[END_REF], we have relaxed the definition of simulation, so this is not anymore necessary.

Actually, we could replace I in the definition of f by any other program that terminates with probability 1.

It should be noted that in a calculus with ground data, parallel or and parallel convergence testing are not equivalent: for instance parallel or is not expressible in PCF enriched with a parallel convergence tester, see for instance[START_REF] Abramsky | Full abstraction in the lazy lambda calculus[END_REF]

n • E i , it holds that S(D) = 1≤i≤n S(E ) i . We can see that it leads to the result.

10.1. MELLI ÈS, TASSON AND TABAREAU'S FORMULA

10.2. THE FREE EXPONENTIAL STRUCTURE IN PCOH.

11.1. A GENERALIZATION OF BERNSTEIN'S THEOREM FOR PRE-STABLE FUNCTIONS

11.2. CSTAB IS A CONSERVATIVE EXTENSION OF PCOH !

11.4. F M IS CARTESIAN CLOSED.

• first, we see-by looking at the rule for → (C×S) -that if s→ S (•,•) t, then the operational semantics of the underlying Λ ≤1 ⊕ -subdistribution is not modified, i.e. F(s) = F(t) ;

• then we see that if s is a normal-form, then F(s) = F(s), since all the program in the support of F(s) are Λ ≤1 ⊕ -values.

We are now able to conclude: let s ∈ S (•,•) . By iterating the first step we obtain that F(s) = F( s ) , and then since s ∈ S (•,•) is a normal-form, we can use the second step, and we see that F( s ) = F( s ), and we have the result.

Our goal now is to start from a binary relation on S (•,•) of the form (C♦R)-where R is taken as a ε-bisimulation-and to study the binary relation over S (•,•) that we obtain after one step of reduction, that is {(u, v) | (s, t) ∈ (C♦R), s→ S (•,•) u, t→ S (•,•) v}. We thus introduce a WLTS L (C×S) , which has S (•,•) as set of states, and whose transition relation is designed to embed the one-step reduction relation on (C × S). Definition 8.3.19 (The WLTS L (C×S) .) We define the execution WLTS for S (•,•) as L (C×S) := (w, (S (•,•) , {τ }, -→ )), where:

• the weight function w is defined as: w(D) := (C,s)∈S(D) D(C, s) • |s|;

• if s → (C×S) t, then s τ -→ t; and if s is in normal form, s τ -→ s.

Observe that L (C×S) has only one equivalence class in E (L (C×S) ), that contains all its states. Moreover, it has an obvious well-behaved convex structure, based on sum and multiplication by a non-negative scalar for measures with finite support. We illustrate how we build the WLTS L (C×S) starting from the relation → (C×S) in Figure 8.4.

The fourth step consists in taking the associated states in E V . This transformation also preserves (C[R]) + , as we have shown in Lemma 8.3.11.

5. In the last step, we see that the states F ( s (C×S) 0

) and F ( t (C×S) 0

) obtained as described above actually coincide with the states u and v defined by s 0 eval -→ u and t eval -→ v. It is a consequence of Lemma 8.3.14, and of the fact that F (s (C×S) 0 ) = s 0 , and F (t (C×S) 0 ) = t 0 . From there, as represented in Figure 8.5, we can conclude that u (C[R])

+ v, and as a consequence, we have proved Equation (8.6).

To sum up, it means that what remains to be shown to conclude the proof that (C[R])

+ is a ε-bisimulation is:

The proof is based on the fact that (C♦R) is a ε-bisimulation on the WLTS L (C×S) . We first remark that we have built (C♦R) in such a way that if R is a L (Λ ≤1 ⊕ ) ε-bisimulation, then the convex closure of (C♦R) is a ε-bisimulation on L (C×S) . Lemma 8.3.15 Let R be a ε-bisimulation on L (Λ ≤1 ⊕ ). Then ((C♦R))

+ is a ε-bisimulation on L (C×S) .

Proof. The action τ is the only action on the WLTS L (C×S) , and the transition relation is defined using the one-step transition for S (•,•) . It means that it is enough to look at each rule of Figure 8.2, and to see that indeed ((C♦R))

+ is preserved under those rules.

Lemma 8.3. [START_REF] Borgström | A lambda-calculus foundation for universal probabilistic programming[END_REF] If s ((C♦R))

+ t, then it holds that also s ((C♦R)) + t .

Proof. The proof is by induction on the length of the reduction sequence s→ S (•,•) s .

• If it is 0, it means that s is a normal form. Then we can see from the definition of ((C♦R))

+ that it implies that t too is in normal form: as a consequence t = t, which shows the result.

• We suppose that the results holds for n, and that the length of the reduction sequence is n + 1. Then we do one step of reduction for both s and t, and since ((C♦R))

+ is a bisimulation, the resulting states are still related by ((C♦R))

+ . From there, we can apply the induction hypothesis, and it concludes the proof.

Observe that we have now shown that all implications represented in Figure 8.5 can be derived; we can deduce from there that whenever s C[R] E P t, we have also that s (C[R])

, where s and t are the states obtained by doing the eval action respectively on s and t. When combining this with the similar result we already have for the applicative actions in Lemma 8.3.10, we obtain Lemma 8.3.17 below. Lemma 8.3.17 Let R be a clustered binary relation for

Trace Distance for Λ !

⊕

Recall that the bisimilarity distance on WLTSs L (Λ ⊕ cbn ) and L (Λ ⊕ cbv ) lead to unsound distances for respectively CBN Λ ⊕ and CBV Λ ⊕ . Moreover, as we will see in the next chapter, it is also the case when we consider the bisimilarity distance on the LMC M cbv Λ ⊕ . So in order to account for the copying phenomenon, we need a significant change into the structure of the underlying transition systems. Our approach consists in asking a state of the transition system to represent several programs-instead of just one program, as we have done until now. This way, we become able to keep track of the evolution of ⊕ Definition 8.4.2 We define the set of tuple types as

We write (M , N ) : (σ, τ ) if M : σ , N : τ .

We say that (σ, τ ) is a (n, m)-tuple type if σ and τ are, respectively, an n-sequence and an m-sequence. To make the notations more readable, if (σ, b) ∈ A × {⊥, }, we will sometimes denote it as σ b . Definition 8.4.3 We call a pair (K, A) ∈ TUPLES × T such that K : A an explicitly typed tuple. We denote by T the set of all explicitly typed tuples.

In Example 8.4.1 below, we illustrate this notion of valid typing judgment for tuples.

Example 8.4.1 We consider the program M := (λ!x.I) ⊕ Ω. Observe first-using the typing rules for Λ ! ⊕ given in Chapter 7-that M : σ with σ := !α → β → β. We use this program M to build a tuple element: we take K = ([M, Ω] , [I]). We look now for a tuple type for K: we take A := ([σ, α → α] , (α → α) ) ). Since α → α is a valid type for both I and Ω, and that moreover I is a value, we see that K : A, hence (K, A) is an instance of explicitly typed tuple.

We now define the set of states we will use for the Λ ! ⊕ -applicative WLTS. Recall that the states of the WLTS L (Λ ≤1 ⊕ ) were of two kinds: sub-distributions over programs, and sub-distributions over distinguished values. Here, we generalize this idea: the set of states is the disjoint union over all tuple types A, of sub-distribution over tuples of type A. We formalize this in Definition 8.

Similarly to what we have done for the WLTS L (Λ ≤1 ⊕ ) for the affine calculus, or the WLTS L (Λ ⊕ cbn ) for Λ ⊕ , we associate a state to every valid typing judgment on Λ ! ⊕programs. First, to any program M , we associate a tuple element Ṁ as follows: we put M in the linear part, and we leave the exponential part empty. Definition 8.4.5 Let M be a Λ ! ⊕ -program, and σ a Λ ! ⊕ -type. We define Ṁ as the tuple element Ṁ := ( 0, [M ]), and σ as the tuple type σ := ( 0, σ ⊥ ) . If κ = ( M : σ) is a valid typing judgment in Λ ! ⊕ , we define the state associated to κ as s(κ

We will also use the notation s σ (M ) to mean s( M : σ), when M : σ is a valid typing judgment.

-that we call transition relation for the action (! i ) -as follows: if (K, A) ∈ T is such that (! i ) is an admissible action at the type A, we say that (! i ) is an admissible action for (K, A), and we define:

where B is the unique tuple type with A (! i ) -→ B, and the sequences M , N are such that K = (M , N ).

Example 8.4. [START_REF] Abramsky | Full abstraction in the lazy lambda calculus[END_REF] We note σ = α → α. We define respectively a tuple element K and a type for tuple A as:

We see that K : A holds, and that the action (! 1 ) is admissible at the indexed tuple type A, hence the action (! 1 ) is admissible when starting from (K, A). We see that:

Applicative Actions

We look now at applicative actions, that play the same role as the applicative action on L (Λ ≤1 ⊕ ): they model environments passing arguments to programs. Here, we have to adapt this idea to our tuple framework: indeed, we can see the tuple as a collection of programs available to the environment, which is free to choose with which of the programs to interact with by passing it an argument. A crucial point, however, is that when building this argument, the environment is allowed to use other components of the tuple. For this reason, we need to be able to express all open terms M that can be build by the environment using free variables that are designed to be replaced by components of the tuple.

We first look at a more general problem, which is to describe how we can transform a tuple into another tuple-in a uniform way: to do this, we define here a notion of tuple context, that we will use also later. Intuitively, a tuple context is simply a tuple whose components can possibly have free variables, taken in the set of special symbols

n -that are not regular variables, so cannot be used as bounded variables.

Definition 8.4.12 A tuple context is a pair (M , N ) where M and N are sequences of (not necessarily closed) typable terms, and their free variables are contained in the set

) is a tuple context, and B = (σ, τ ), A = (ι, υ ) are tuple types, we say that C is a tuple context from A to B, and we note C ∈ C(B → A) when:

• We note τ and υ the underlying sequences over A from τ and υ , and n and m their respective length. We ask that there exists a partition {E 1 , . . . E m } of {1, . . . , n} such that for every j ∈ {1, . . . , m}, it holds that ![•] ! :!σ, [•] E j : τ E j N j : υ j . • for every j such that υ j is of the form υ j , then either N j = [•] i with τ i = τ i , or N j is of the form λz.N , λ!z.N , or !N .

• for any l ∈ M n (C), and x ∈ C, the function u ∈ R n → l(u)(x) ∈ R is measurable.

Example 9.3.3 (from [START_REF] Ehrhard | Measurable cones and stable, measurable functions: a model for probabilistic higher-order programming[END_REF]) Let X be a measurable space. We endow the cone of finite measures Meas(X) with the family M(X) of measurable tests defined as:

where Σ X is the set of all measurable subsets of X. Observe that in this case, the measurable tests are those functions that takes a measure-and a parameter r-and return the value of the measure on some measurable set U . In the following, we will denote Meas(X) the measurable cone (Meas(X), (M n (X)) n∈N ).

We define now measurable paths, which are meant to be the admissible ways to send R n into a MC C.

We denote Paths n (C) the set of measurable paths of arity n for the MC C . When a measurable path γ verifies γ(R n ) ⊆ BC , we say it is unitary. Using measurable paths, the authors of [START_REF] Ehrhard | Measurable cones and stable, measurable functions: a model for probabilistic higher-order programming[END_REF] add measurability requirements to their definition of stable functions.

The category Cstab m is therefore the category whose objects are MCs, and whose morphisms are measurable stable functions between MCs. In [START_REF] Ehrhard | Measurable cones and stable, measurable functions: a model for probabilistic higher-order programming[END_REF], the Cartesian closed structure of Cstab m is derived from that of Cstab by endowing its exponentials and products with the measurability tests presented in Figure 9.5. Lemma 10.2.3 Let A be a PCS, and n ∈ N. Then eq A =n is a morphism in PCoh(A =n , A ⊗n ).

Proof. We need to show that for every x ∈ P (A =n ), it holds that (eq A =n ) x ∈ P (A ⊗n ).

Looking at the definition of the PCS A =n , we see that our goal can be reformulated as:

From Equation (10.2), we can go one step further: (10.3) can actually be deduced as soon as we know: ∀y ∈ P (A ⊗n ) , (j n A ) y ∈ P (A ⊗n ) . Since j n A is a morphism in PCoh(A ⊗n , A ⊗n ), we see that the latter claim holds, which ends the proof.

Using equation ( 10.2) we also see that every vector of the form eq A =n x is invariant by all symmetry morphisms, as stated in Lemma 10.2.4 below. Lemma 10.2.4 Let A be a PCS, and n ∈ N. Then for every σ ∈ S n , it holds that (eq A =n • s σ,n A = eq A =n ), i.e.:

Proof.

We have to show that for every σ ∈ S n , and x ∈ P (A =n ), it holds that (eq A =n • s σ,n A ) x = eq A =n x. Let σ ∈ S n , and x ∈ P (A =n ). Let y ∈ A ⊗y , such that x = s n y; from Equation 10.2, we see that:

A y, and it ends the proof.

Our goal now is to check that the universal property for equalizers-as stated in Definition 10.1.7-holds for (A =n , eq A =n ). Toward this goal, we first show in Lemma 10.2.5 below, an alternative characterization of A =n , focusing on a set of generators that can be computed directly from A.

Lemma 10.2.5 For every PCS A, and n ∈ N,

Proof. We denote by (A =n ) the pre-PCS defined as |(A =n ) | = M n (|A|), and P ((

First, we can observe that (A =n ) is a PCS, since it is generated by bi-duality, and that the boundedness conditions on coefficients also hold. The equivalence between (A =n ) and A =n is then obtained by Lemma 9.2.3 from Chapter 9, taking ⊥⊥ which turns out to be the bipolar of B by Lemma 9.2.3. We conclude since we have already shown A =n to be a PCS, and as thus A =n = (A =n ) ⊥⊥ .

We are now ready to check that (A =n , eq A =n ) is indeed the equalizer of the n! symmetry over A ⊗n . Recall that it is the first step in order to apply Melliès, Tabareau and Tasson recipe to PCoh, as presented in Proposition 10.1.5. Proposition 10.2.6 Let A be a PCS and n ∈ N. The object A =n together with the morphism eq A =n ∈ PCoh(A =n , A ⊗n ), is the equalizer of the n! symmetries of the n-fold tensor A ⊗n . Moreover, these equalizers commute with the tensor product, in the sense of Definition 10.1.8.

By definition, P Bool

Looking now at the definition of jm 2 Bool we see that the action of jm 2 Bool on any clique u ∈ P Bool ⊗2 is as follows:

We want now to obtain a more direct characterization-i.e. one that does not use P (Bool) explicitly. Recall that Example 9.2.4 computes P Bool ⊗2 as the set of sub-probability distributions over boolean pairs. As a consequence every element of the form (jm 2 Bool u) must verify the following constraint:

This constraint means that P Bool =2 ⊆ X, where X is the vector set defined as

We want now to show that the reverse inclusion also holds. Recall that since Bool =2 is a PCS, it coincides with its bi-dual, and consequently for every

So let x ∈ X, and y ∈ P (Bool =2 ) ⊥ . To show that x, y ≤ 1, we first enforce upper bounds on the coefficients of y. Since y has to be dual with every element of the form jm 2 Bool (u 1 ⊗ u 2 ) with u i ∈ P (Bool), we obtain in particular the following inequalities:

From those inequalities we are now able to show that:

And using Equation 10.6 we can now conclude that

The approximations A ≤n

The existence of equalizers for the symmetry morphisms over A =n for any PCS A -that we established in Proposition 10.2.6 -implies that we can now define in PCoh the exponential approximations, that consist of the family of PCSs A ≤n := (A & 1) =n . Here, we look at those PCSs more extensively, thus obtaining a direct characterization of A ≤n by means of an operator u 1 , . . . u n over the vectors in P (A), crucial for the next step. This characterization is presented in Lemma 10.2.7 below, where we use the following notation: M ≤n (X) is the set of all multisets over X of length smaller or equal to n, and f : X → Y to denote an injective function from X to Y . Lemma 10.2.7 (Caracterisation of the A ≤n ) The PCS A ≤n can be presented as follows:

to its restriction u to the directions within |A|. In order to have these matrices as morphisms in PCoh, we have to prove that ( u, 0 ) ∈ P (B) whenever u ∈ P (A) (resp. u ∈ P (A) whenever ( u, v ) ∈ P (B)).

The projection matrix ρ A ≤n+1 ,A ≤n of A ≤n+1 into A ≤n actually coincide with the categorically defined projection morphisms p n+1,n from Definition 10.1.10. As a corollary, we get the following lemma. Lemma 10.2.8 For any m ≥ n and A, we have: ρ A ≤m ,A ≤n ∈ PCoh(A ≤m , A ≤n ) and

Proof. Let n ∈ N. Recall that p n+1,n is defined as the unique morphism such that the following morphisms A ≤n+1 → (A & 1) ⊗n coincide:

When we unfold Equation (10.10) by looking at matrix coefficients-recall the expressions of r, π 2 in PCoh, stated in Section 9.2.1-we obtain that for every µ ∈ M ≤n+1 (|A|), and

. We see that these constraints entirely characterize the matrix p n+1,n , and more precisely that p n+1,n must be exactly ρ A ≤n+1 ,A ≤n . As a consequence, ρ A ≤n+1 ,A ≤n ∈ PCoh(A ≤n+1 , A ≤n ). Since for every m, n with m > n,

, it also holds that ρ A ≤m ,A ≤n is a morphism in PCoh(A ≤m , A ≤n ). Moreover, we can also see that ι A ≤n ⊥ ,A ≤m ⊥ is indeed a morphism

The interesting point is that the dual version of Lemma 10.2.8 does not hold: in general, the injection of A ≤n into A ≤n+1 (resp. projection of (A ≤n+1 ) ⊥ into (A ≤n ) ⊥ ) is not a morphism of PCoh. We illustrate this using the boolean PCS

The latter claim is because: and the maximal value of these generators on [t, f] is 1 3 . Since the bi-duality operator consists in the convex, downward and Scott-closure, it means that no element in P Bool ≤3 may have a coefficient on [t, f] greater that 1 3 .

One can however, for every N ≥ n, add a correction factor to the injection matrix ι A,n,N in order to obtain a new matrix ι cor A,n,N that embeds A ≤n into A ≤N , i.e. that is both invertible, and a morphism A ≤n → A ≤N . We define the amended injection matrix ι cor as follows:

and q = N n and r = N mod n; 0 otherwise.

(10.11)

Lemma 10.2.9 For every PCS A, and for any n, N ∈ N with n < N , the amended injection matrix ι cor A,n,N is a morphism in PCoh(A ≤n , A ≤N ) mapping, in particular, u 1 , . . . , u n ∈ P A ≤n to u q 1 , . . . , u q n , 0 r ∈ P A ≤N , where q is the quotient N n and r the remainder N mod n of the euclidean division N n . Moreover, u q i is a notation for u i , . . . , u i q times

(and similarly for 0 r ).

Proof. One has just to prove the last part of the statement, the rest follows by Lemma 9.2.3 because the vectors of the form u 1 , . . . , u n are a set of generators for P A ≤n (Lemma 10.2.7).

We have, for any multiset µ = [a 1 , . . . , a k ],

where we use → to denote injective functions and where from line 2 to 3, we use the count q k to enlarge the codomain of the injections f indexing the sum.

At this point, we can do the following crucial observation: if we fix n ∈ N, and we look at the morphism ι cor A,n,N : A ≤n → A ≤N when N tends towards +∞, we can see that the corresponding matrix coefficients also admit a limit. We express that formally in Equations (10.12) and (10.13) below. If we note N = nq + r, it holds that:

( lim .13) This observation allows us to take the following approach to construct the limit object: the contribution of each A ≤n to the limit object ! f A should be the limit of its contribution to the A ≤N , when N is greater than n and tends toward +∞. We formalize this intuition in Definition 10.2.3 below, and then proceed to show that the object we build this way is indeed the free exponential comonoid.

Definition 10.2.3 Given A, we define ! f A as:

Notice that whenever k > n, u 1 , . . . , u n [a 1 ,...,a k ] = 0.

Proposition 10.2.10 Let A be a PCS. The object ! f A together with the family of morphisms ρ ! f A,A ≤n ∈ PCoh(! f A, A ≤n ) for n ∈ N, constitutes the limit of the chain:

Moreover, this limit commutes with the tensor product (Figure 10.4).

Proof. First, we prove that ρ ! f A,A ≤m is a correct morphism mapping P (! f A) into P A ≤m , for any m. By Lemma 9.2.3 it is enough to check that any u 1 , . . . , u n is mapped to the PCS P A ≤m by ρ ! f A,A ≤m . As P A ≤m = P A ≤m ⊥⊥ , it is equivalent to show that for any n ∈ N, u i ∈ P (A), and w ∈ P A ≤m ⊥ we have:

Line 2 gives line 3 using of the definition of ι and π in (10.9). Now we prove that ! f A together with its projections ρ ! f A,A ≤m is indeed a limit cone. As for Proposition 10.2.6, we prove straight the commutation with the ⊗, as the first part of the statement is a consequence of this latter, taking B = 1. Take a PCS C and an N-indexed family of morphisms

← . . . . We should define a unique f † s.t. Figure 10.4 commutes. The matrix f † is defined as:

The fact that f † is the unique one such that Figure 10.4 commutes is an easy calculation. We should then prove that it is a morphism in PCoh(C, ! f A ⊗ B), i.e. for every v ∈ P (C),

, it is equivalent to prove that: Notice that, for any u 1 , . . . , u n ∈ P A ≤n and z ∈ P (B), we have the inequality:

We conclude that w ↓ n ∈ P A ≤n ⊗ B ⊥ , for any n. Then we have: This remark can be generalized, showing that the exponential approximations A ≤n are actually approaching to ! e A from above, giving that their limit is equal to ! e A.

Proposition 10.3.1 For any PCS A, we have

Proof. The two spaces have the same web, we prove that P (! f A) = P (! e A). We first show that P (! f A) ⊆ P (! e A). Take any u 1 , . . . , u n ∈ P (! f A), we have u 1 , . . . , u n ∈ P (! e A), because u 1 , . . . , u n ≤ ( 1 n i u i ) ! ∈ P (! e A). Conversely, let u n denotes u, . . . , u repeated n times in

As for k < n, n! n k (n-k)! is an increasing sequence converging to 1, we get that ∀u ∈ P (A), sup n u n = u ! . Now, u ! ∈ P (! f A) since it is Scott-closed. Since u ! for u ∈ P (A) are generating P (! e A), we conclude that P (! e A) ⊆ P (! f A).

Directed-complete Lattice Cones

We first define the restricted set of cones that we consider; it is designed to enable us to use McMillan's results while also containing all cones fenrated by PCSs. Definition 11.1.1 A cone C is said to be:

• directed complete if for any directed subset D of BC, D has a least upper bound sup D ∈ BC.

• a lattice cone if any two elements x, y of C have a least upper bound x ∨ y.

Observe that a directed-complete cone is always sequentially complete.

Lemma 11.1.1 Let be C a lattice cone. Then it holds that:

• Any two element x, y of C have a greatest lower bound x ∧ y.

• Decomposition Property: if z ≤ x + y, there there exists z 1 , z 2 ∈ C such that z = z 1 + z 2 , and z 1 ≤ x, and z 2 ≤ y.

Proof. Recall that, if a ≥ b, we denote by a -b the element c such that a = b + c.

• We consider z = x + y -(x ∨ y), and we show that z is indeed the greatest lower bound of x and y.

• We take z 2 = (x ∨ z) -x, and z 1 = z -z 1 . First, we see that z 2 ≤ (x + y) -x, and so z 2 ≤ y. Moreover,

Derivatives of a pre-stable function

We are now going, following McMillan [START_REF] Mcmillan | Absolutely monotone functions[END_REF], to construct derivatives for pre-stable functions on directed complete cones. This construction is based on the use of a notion of partition:

We write π ∼ x when the multiset π is a partition of x. We will denote by + the usual union on multiset: [y Observe that when π 1 and π 2 are partition of x, π 2 ≤ π 1 means that π 1 is a more finely grained decomposition of x. If u is an n-tuple in BC, we extend the refinement order to Parts( u) = Parts(u 1 ) × . . . × Parts(u n ). Proof. We are going to use the following notion: we say that two non-zero elements x and y of C are orthogonal, and we note x ⊥ y, if x ∧ y = 0. Let be π 1 , π 2 ∈ Parts(x). We first show that it cannot exist z ∈ π 1 which is orthogonal to all the element of π 2 . Indeed, suppose that it is the case: we take y 1 , . . . , y n such that π 2 = [y 1 , . . . , y n ]. Then by hypothesis, z ≤ x = 1≤i≤n y i . We can now use the decomposition property from Proof. We are going to use the following auxiliary lemma: Lemma 11.1.5 (from [START_REF] Mcmillan | Absolutely monotone functions[END_REF]) Let C and D be two directed cones, and f : C → D linear and non-decreasing, such that moreover for all subset F of C directed for the reverse order, f (inf F ) = inf f (F ). Then f is directed Scott-continuous.

Proof. Let be E a directed subset of C. We define F = {sup E -x | x ∈ E}. Since E is directed, F is directed for the reverse order, and as a consequence:inf f (F ) = f (inf F ). But we see that inf F = 0. Therefore, since f is linear, f (inf F ) = 0. As a consequence (and again by linearity of f ):

We are now going to show Lemma 11.1.4.

The additivity is given by Lemma 3.72 of [START_REF] Mcmillan | Absolutely monotone functions[END_REF]. The commutation with scalar multiplication is not proved on this form in [START_REF] Mcmillan | Absolutely monotone functions[END_REF] because they have a more general notion of a system of partition. We first show that the result holds when λ is a rational number. To do that, we use the fact that π = [ x n , . . . , x n ] is always a partition of x. Then, let λ ∈ R + and u = (u 1 , . . . , u n ) such that both u and v = (u 1 , . . . , λu i , . . . , u n ) are in BC n

x . Let be r = (r m ) m∈N , q = (q m ) m∈N two sequences of rational number such that r tends to λ by below, and q tends to λ by above. We see that:

We take N such that for every m ≥ N , q m ≤ 2•λ: since

we see that:

Applying now the linearity for rational numbers, we see that for every m ≥ N :

As a consequence:

x , and k ∈ N. Then it holds that D k f (x | y, . . . , y) is equal to:

Proof. We first introduce the following notation: if π = (u 1 , . . . , u n ) is a partition of x, and σ : [ [1, k]] → [ [1, n]] an injective function, we denote σ(π) = (u σ(1),...,uσ(k) ). We denote by A = sup π∈Parts(y) σ:

We show separately the two inequalities.

• We first show that A ≥ D k f (x | y, . . . , y). For every n ∈ N, it holds that π = ( 1 n • y, . . . , 1 n • y) is a partition of y. Therefore for every n ∈ N:

The sequence n! (n-k)!•n k tends to 1 when n tends to infinity (see in the long version). By Scott-continuity, it means that A ≥ D k f (x | y, . . . , y).

• Let us show now that

Then:

. . , y), which ends the proof.

With this characterization, [START_REF] Mcmillan | Absolutely monotone functions[END_REF] shows that the sequence of functions (x

Proof. Let be x ∈ B • C and y ∈ BC x . We are able to express f (x + y) by using f (x) and finite differences on any partition of y: indeed, for every partition π of y, it holds that:

Let us now see that Ψ F is an isomorphism. Looking at the definition of cartesian product in PCoh ! defined in Section 9.2 of Chapter 9, and the one of cartesian product in Cstab, defined in Section 9.3.2, we see that for every x ∈ BF( PCoh ! i∈I X i ):

We want now to show that Ψ F has an inverse. The only candidate is Θ F : y ∈ B( Cstab

, defined by: ∀i ∈ I, a ∈ |X i | , Θ(y) i,a = (y i ) a . We see immediately that Θ F is linear, hence pre-stable, and that moreover it is Scottcontinuous. Besides, it is also non-expansive since∀y ∈ BD, Θ F (y) F ( PCoh ! i∈I X i ) = y Cstab i∈I F X i . We show now the non-expansiveness of Θ F :

Thus Θ F is a morphism in Cstab.

Lemma 11.2.6 F preserves function spaces.

Proof. Let X , Y two PCSs. As previously, there is a canonical candidate for the isomorphism: we define Υ X ,Y as the currying in Cstab of the morphism:

where Θ X ⇒Y,X is as defined in the proof of Lemma 11.2.5 above.

Unfolding the definition, we see that actually: Υ X ,Y : f ∈ BF(X ⇒ Y) → f ∈ (FX ⇒ FY). Since we have shown that F is full and faithful, we can consider Ξ X ,Y the inverse function of Υ X ,Y . Recall from the proof of the fullness of F in Section 11.2.1 that for every µ = [a 1 , . . . , a k ] ∈ M f (|X |), and b ∈ |Y|:

Recall from Lemma 11.1.4 that for any u ∈ B(C k x ), the function f ∈ Cstab(FX , FY) → D k f (x | u) ∈ FY is linear and Scott-continuous. As a consequence, Ξ X ,Y too is linear and Scott-continuous.

To know that Ξ X ,Y is stable, we have still to show that it is bounded: we are actually going to show that it preserves the norm. Indeed, for every f ∈ B(FX ⇒ FY), we see using the definition of the norm on a cone obtained from a PCS (see Definition 11.2.1), that:

It was shown in [START_REF] Danos | Probabilistic coherence spaces as a model of higher-order probabilistic computation[END_REF] that:

We see that (r

since Ξ X ,Y has been defined as the inverse of Υ X ,Y . It means that we can rewrite (11.14) as:

Since for every PCS Z, it holds that P (Z) = BFZ, we can now use (11.15) to rewrite (11.13) as: (11.16)

Looking now at the definition of the norm in the cone FX ⇒ F Y, we can complete the proof using (11.16) and the homogeneity of the norm. Indeed:

As a direct consequence of Lemma 11.2.5 and Lemma 11.2.6, we can state the following theorem:

Theorem 11.2.7 F is full and faithful, and it respects the cartesian closed structures.

PCoh ! is a full subcategory of Cstab m

We want now to convert the functor F : PCoh ! → Cstab into a functor F m : PCoh ! → Cstab m . To build F m , we are going to endow each FX with measurability tests, in such a way that F(f ) will be a measurable stable function for any morphism f ∈ PCoh ! .

Observe that this requirement does not determine uniquely the choice of measurability tests. For instance, it would be verified if we choose {0} as measurability tests for every FX . However, as explained in the introduction of the present chapter, we want also F m (N PCoh ) to be isomorphic to Cstab m Cstabm : we would like to be able to inject any discrete distribution on N into a distribution on R. A natural way to ensure this is to use the discrete structure of the web to give the following definition of the MC arising from a PCS. Definition 11.3.1 For any X ∈ PCoh, we define C m X as the measurable cone C X endowed with the family M n (X ) n∈N of measurability tests defined as M n (X ) = { a | a ∈ |X |}, where a ( r, x) = x a .

We see that the a are indeed linear (i.e commuting with linear combinations), and moreover Scott-continuous: hence they are indeed element of C X . It is easy to verify that the other conditions are verified, and so C m X is indeed a MC.

Lemma 11.3.1 Let be X a PCS. Then Paths n (C m X ) is the set of those γ : R n → C X such that:

Two MCs with the same underlying cone, but different measurability tests may be isomorphic in Cstab: it is enough for them to have the same measurable paths. It is what happens in the example below, where we consider F m N PCoh and Meas(N). It is actually also what happens at higher-order types, as we will explain in Section 11.4.

Example 11.3.1 Recall from the definition of F m that the underlying cones of F m N PCoh and Meas(N) are the same. However they have not the same measurable tests:

We consider the identity function id : x ∈ P (N) PCoh → (A → n∈A x n ) ∈ Meas(N). Let γ ∈ Paths n (F m N PCoh ). We want to show that for every U ⊆ N:

Since the class of measurable functions are closed by finite sum and pointwise limit, we see that

Since γ ∈ Paths n (C m X ), it holds that γ a : R n → R + is measurable for all a ∈ |X |. We conclude by using the fact that the class of measurable functions R n → R + is closed under multiplication, finite sums and limit of non-decreasing sequences: it tells us that r ∈ R n → (Ff • γ) b ( r) ∈ R + is measurable, and the result folds. Proof. It is a direct consequence of the fact that F is full and faithful, coincide with F m on morphisms, and moreover Cstab m (F m X , F m Y) ⊆ Cstab(FX , FY).

F m is cartesian closed.

We want now to show that just as F, F m is cartesian closed. Since the forgetful functor between Cstab m and Cstab is cartesian closed, we see that we have only to show that the Cstab-isomorphisms used in the proofs Lemmas 11.2.5 and 11.2.6 are also morphisms in Cstab m . Observe that it is immediate that the Ψ F and Υ X ,Y are also morphisms in Cstab m : indeed we have defined them canonically by using the structural morphisms linked to the cartesian structure of Cstab, which are the same in Cstab m (see [START_REF] Ehrhard | Measurable cones and stable, measurable functions: a model for probabilistic higher-order programming[END_REF]).

Lemma 11.4.1 For all F = (X i ) i∈I a finite family of PCSs,

Proof. Since we already know that Θ F is a morphism in Cstab, we have only to show that it is measurable, i.e. that it preserves measurable paths. Let γ be in Paths n ( Cstabm i∈I F m X i ). We have to show that Θ F • γ is a measurable path for F m ( PCoh ! i∈I X i ). Recall that Lemma 11.3.1 gives us a characterization of such paths. Since both Θ F and γ are bounded, it is immediate that Θ F •γ is bounded too. Now we show that for all (i, a

By looking at the definition of Θ F , we see that (Θ F • γ) (i,a i ) ( r) = (γ( r) i ) a . We see now that we can construct a measurability test m ∈ M 0 ( Cstabm i∈I F m X i ) such that (γ( r) i ) a = m(•)(γ( r)): it is enough to take m = ⊕ j∈I l j , with l j = 0 if j = i, and l i = a i . Since γ is a measurability tests, it means that r ∈ R n → m(•)(γ( r)) ∈ R + is measurable, and the result folds.

Proof. We have to show that Ξ X ,Y preserves measurable paths. Let γ be in Paths n (F m X ⇒ F m Y). We fix µ ∈ M f (|X |), and b ∈ |Y|. Our goal is to show that (Ξ X ,Y •γ) µ,b : R n → R + is measurable. Since γ is a measurable path, we know that for every p ∈ N, and l ∈ Paths p (F m X ), b l is a measurability test on F m X ⇒ F m Y, and therefore: ( r, u) ∈ R p+n → ( b l( r))(γ( u)) ∈ R + is measurable. (11.17) We are going to apply (11.17) to a particular measurable path on F m X . Let p be the cardinality of Supp(µ), and {a 1 , . . . , a p } = Supp(µ). We define l µ : R p → F m X as: l µ : r ∈ R p → 1≤i≤m r i • e a i if r i ≥ 0∀i and 1≤i≤m r i ≤ 1; 0 otherwise. We see that l µ (R p ) is bounded in F m X , and moreover for every a ∈ |X |, the function r ∈ R p → l µ ( r) a ∈ R + is measurable. Using the characterization of Paths p (F m X ) in Lemma 11.3.1, we see that l µ is in Paths p (F m X ). Thus we can apply (11.17) with l = l µ . Observe that ( b l µ ( r))(γ( u)) = (γ( u)(l µ ( r))) b .

Therefore (11.17) tells us that φ µ,b : R p+n → R + is measurable, with φ µ,b defined as φ µ,b : ( r, u) ∈ R p+n → γ( u)(l µ ( r)) b ∈ R + . We define J ⊆ R p as [0, 1 p [ p . We are going to look at the restriction of the function φ µ,b to J × R n : indeed we are going to show that φ µ,b has partial derivatives on that interval. We define ψ µ,b : J × R n → R + as the restriction of φ µ,b to J × R n . Since φ µ,b is a measurable function, and J × R n a measurable subset of R p+n , ψ µ,b also is measurable.

Lemma 11.4.3 below (which is shown in the long version) is key: it says that we can recover the coefficients of the power series ψ µ,b by looking at its partial derivatives. We will then show that we can do it in a measurable way. We recall here a classical result of real analysis on power series, that we will use in the following. ( r) = ν∈M f ({1,...,p})|i∈ν

Proof. We take b = c 2 , and set J =] -b, b[. To simplify the notations, we suppose here that i = 1, but the proof is the same in other cases. We want to show that for any fixed u ∈ J p-1 , the function h u : r → g(r, u) is derivable on J. Let us fix u ∈] -b, b[ p-1 . We are going to use Lemma 11.4.4 on h u . We see that h u (r) = n∈N h n (r), where

where [1 n ] is the multiset consisting of n occurrences of 1. We see that for every n ∈ N, the function h n is derivable on J, and: