1 Introduction
The guarded negation fragment (GNFO) is a syntactic fragment of firstorder logic, introduced in [BtCS11icalp] as an extension to the muchstudied guarded fragment of firstorder logic [AvBN98JPL, Gr99JSL]. Both fragments restrict the use of certain syntactic constructs by requiring the presence of guards, with the aim of taming the language from an algorithmic point of view, with an acceptable compromise on expressiveness. The guarded fragment is obtained by requiring all quantification to be guarded. This idea has its roots in modal logic and, accordingly, the model theory of the resulting fragment has a very similar flavour to that of modal logic. The guarded negation fragment is obtained instead by requiring all use of negation to be guarded. As it turns out, the latter use of guards is more general than the former. Formally, every sentence of the guarded fragment can be equivalently expressed in the guarded negation fragment [BtCS15jacm]. GNFO also properly contains the positive existential fragment of FO.
GFO constitutes a rich formalism that captures many of the integrity constraint languages and schemamapping languages proposed in databases [dataint, FKMP05], and also many of the description logics [dl] proposed in knowledge representation. But GNFO is more suitable than GFO for expressing database queries; that is, mappings from structures to relations. Indeed, as noted above, GNFO properly contains all positive existential formulas. These are the most common SQL queries, built up using the basic SELECT FROM WHERE construct and UNION.
The defining characteristic of GNFO formulas is that a subformula with free variables can only be negated when used in conjunction with a positive literal , i.e. a relational atomic formula or an equality atom, containing all free variables of , as in
where order and repetition of variables is irrelevant. One says that the literal guards the negation. Unguarded negations of formulas with at most one free variable are also supported; this can be seen as a special case of guarded negation through the use of a vacuous equality guard .
It was shown in [BtCS15jacm] that GNFO possesses a number of desirable computational properties. For example, every satisfiable GNFO formula has a finite model (finite model property), as well as a, typically infinite, model of bounded treewidth (treelike model property). It follows that satisfiability and entailment (hence, by the finite model property, satisfiability and entailment in the finite) of GNFO formulas are decidable.
In [bbo] the implications of GNFO for database theory are explored. For example, an SQLbased syntax for GNFO is defined, and an analogously constrained variant of stratified Datalog is also presented. Several computational problems concerning GNFO formulas (e.g. the “boundedness problem” for a fragment of the fixpoint extension of GNFO) are shown to be decidable.
In this work we investigate modeltheoretic properties of GNFO. We first present results showing that GNFO formulas satisfying specific semantic properties can be rewritten into restricted syntactic forms. For example, we show that every GNFO formula that is preserved under extensions can be effectively rewritten as an existential GNFO formula. We give an analogous result for queries preserved under homomorphisms.
Next we consider GNFO sentences that can also be expressed as a kind of generalized Horn sentence known in the database community as a tuplegenerating dependencies (TGD). We provide a syntactic characterization of the GNFO sentences that are equivalent to a finite set of TGDs and give a similar result for sentences in the guarded fragment.
We then turn to model theoretic results concerning explicit and implicit definability. The Projective Beth Definability theorem states that for any property that is implicitly defined by a firstorder theory there is a firstorder formula that explicitly defines the property. We show the analogous result with firstorder replaced by GNFO. Following ideas of Marx [Marx07pods] we establish a Craig Interpolation Theorem for GNFO and from this conclude the Projective Beth Definability theorem for GNFO. This is in contrast with the situation for the Guarded Fragment, which does enjoy the simpler Beth definability property [HMO]. Contradicting claims made in earlier work [Marx07pods] we show that Projective Beth fails for the socalled Packed Fragment.
Finally, we study definability issues related to the “open world query answering” problem for GNFO. Open world query answering concerns determining which results of formulas are implied by partial information about the underlying structure, in the form of a subset of the interpretations of relations and a logical theory constraining the completion. More formally, the input to this problem is a set of GNFO sentences, a finite structure , and a positive existential formula . The goal is to determine the values of that hold in every structure extending the interpretations of relations in and satisfying . These values are sometimes referred to as “the certain answers to under ”. The complexity of open world query answering has already been identified for several GNFObased languages in [bbo]. Here we show that GNFO sentences that are equivalent to a set of TGDs have additional attractive properties from the point of view of open world query answering. Specifically, we extend and correct results of Baget et. al. [bagetconf] by showing that the certain answers can always be determined by evaluating a sentence in a small fragment of (guarded negation) fixpoint logic, Guarded Negation Datalog, for which boundedness was shown decidable in [bbo]. From this we conclude that firstorder definability of certain answers of GNFO TGDs is decidable.
An extended abstract of the present paper appeared in [mfcs14] and a journal version in [jsl]. This article contains revised versions of the proofs in Section 5. Related work both prior to and subsequent to [mfcs14] is discussed in Section 6.
Organization: Section 2 contains preliminaries. Section 3 looks at rewriting for restricted fragments of GNFO, while Section 4 looks at rewriting of queries with respect to views, via results on Craig interpolation and Beth definability. Section 5 presents our results on rewriting the certain answers of conjunctive queries with respect to GNFO TGDs. Section 6 covers conclusions and related work.
2 Definitions and Preliminaries
We work with fragments of firstorder logic (FO) with equality and with its usual semantics, restricting attention to finite signatures consisting of relation symbols and constant symbols and no function symbols.
We assume familiarity with basic notions from model theory, such as a reduct of a structure (restricting the signature), an expansion of a structure, and a type (a satisfiable set of formulas in a collection of variables, possibly with parameters from a structure); and will only rely on material that can be found in the first few chapters of a standard model theory textbook, such as Chang and Keisler [ChangKeisler]. For example, we will make use of the Compactness Theorem and work with saturated elementary extensions. We briefly review the notion of saturation that we need in this work. A structure is an elementary extension of a structure , denoted , if is an extension of and every FO sentence with parameters from that is true in is also true in . A structure is saturated if for every set of formulas (where ) containing finitely many parameters from , if every finite subset of is realized by some tuple in , then the entire set is realized by an tuple in . The conclusion means that there is a tuple of elements of the domain of such that for all . A firstorder structure is recursively saturated if the conclusion above holds when the collection is further required to be recursive (or, in other words, decidable). A basic result in model theory is that every structure has an saturated elementary extension, and every countable structure (in a countable signature) has a countable recursivelysaturated elementary extension.
A homomorphism between structures and is a map from the domain of to the domain of that preserves the relations (i.e., implies ) as well as the interpretation of all constant symbols (i.e., ).
The primary focus of this paper is on finite structures. Finite model theory is concerned with logical semantics restricted to finite structures. When working with both classical and finite model semantics additional care must be taken to make it clear in each instance which semantics is meant. Crucially, both GFO and GNFO possess the finite model property (every satisfiable sentence has a finite model), which for most purposes voids the distinction between the two semantics and allows us to employ classical tools in the service of finite model theory. But at times, when working with different formalisms, we will need to be more specific as to which semantics is meant. We shall use the shorthand “(Both classically and in the finite.)” in formal assertions to signify that the statement holds equally true when semantic entailment is unrestricted and when it is restricted to finite structures.
Database query languages and constraint languages. One motivation for this work is to explore how well GNFO is suited for database applications. Accordingly, we will work with several logics and that are common in database theory, introduced below.

Existential FO, comprises formulas , where is quantifierfree.

Conjunctive queries (CQ), are the subset of existential FO where the quantifierfree kernel above does not contain disjunction or negation. Equivalently, these are the firstorder formulas in prenex normal form built up using only and . A boolean conjunctive query is a CQ without free variables, that is, expressed as a FO sentence.

Acyclic conjunctive queries form an algorithmically wellbehaved subclass of conjunctive queries [Yannakakis81, FFG02, GLS03]. The standard definition of acyclic CQ involves the notions of hypergraph acyclicity and hypergraph structure of a CQ [GLS03]. We will not need to directly use this definition, but only the following equivalent characterization, which generalizes one in [GLS03] for boolean acyclic CQs. A formula is answerguarded if it is of the form for some and relation symbol . Then we have the following alternative characterization of acyclic answerguarded CQs:
Fact 2.1
An answerguarded conjunctive query is acyclic iff it is equivalent to a positive existential GFO formula.

Tuplegenerating dependencies (TGD) are sentences of the form
where and are conjunctions of positive relational atoms (no equalities), and every variable from occurs in at least one conjunct of . is called the body of the TGD, while is referred to as the head.
In addition to the above fragments of FO, some of our arguments involve Datalog a language that extends positiveexistential FO with a fixpoint mechanism. Datalog programs use a signature that is partitioned into “intensional relations”, representing the results of a fixpoint computation, and “extensional relations” that represent an input structure. In terms of secondorder logic, intensional relations can be viewed as secondorder variables, while extensional relations are part of the signature of the structure over which the program is being evaluated. A Datalog program consists of rules , where is an intensional relation and is a CQ over intensional and extensional relations, such that each variable occurs in at least one conjunct of . Associated to the program is an operator that takes as input a structure in the extended signature that includes both the extensional and intensional relations and returns a structure over the same extended signature. agrees with on all extensional relations. For each intensional relation , is the set of tuples obtained by evaluating a rule of of the form (that is, evaluating in and projecting on variables ). This “immediate consequence” operator on structures is monotone, and thus has a unique least fixpoint. The result of evaluating a program on a structure is the least fixpoint (starting with all intensional relations empty). Given a distinguished intensional predicate (the goal predicate), the output of a Datalog program is the set of tuples belonging to the goal predicate in the least fixpoint. Datalog can be viewed as the positiveexistential fragment of leastfixpoint logic.
Abiteboul, Hull, and Vianu [AHV] is a good reference for all of these languages.
One subtle but notable difference in the treatment of query languages in the database literature and the logic literature concerns the relationship between database instances and (finite) firstorder structures. A database instance (or simply instance) for a signature , assigns to every relation symbol of arity a collection of tuples, and to every constant symbol a value, called the interpretation of , and respectively of , in . A fact over a signature is an expression , where is a relation symbol and are values. An interpretation of a relation can be equivalently considered as a set of facts, namely the facts of the form where belongs to the interpretation of . The active domain of an instance or a structure is the set of values that participate in some fact, or, in other words, the union of the onedimensional projections of the relations. We write for the active domain of . Note the difference between an instance and a relational structure: a relational structure is defined over an explicitly given domain, which can contain any number of “inactive” elements. Two structures can thus correspond to the same instance while having different domains. In database theory one is typically interested in domainindependent formulas, that is, formulas that do not distinguish between structures corresponding to the same instance. For example the sentence is domainindependent, while is not. Both CQs and Datalog are languages defining only domainindependent formulas. In parts of this work, we will deal with logical formulas that are domainindependent. For a domainindependent sentence we can talk about “being true on instance ”, and similarly give semantics to domainindependent formulas in terms of instances rather than structures. Thus if we are dealing with questions about domainindependent formulas, it will often be convenient to perform constructions that form instances from instances, rather than constructions that form structures from structures. A homomorphism between instances and is defined as with structures, but is now defined on the active domain of , and is required to preserve the interpretation of the relations as well as any constants occurring in the active domain of .
Given two structures over the same signature , we write if the two structures agree on the interpretation of the constant symbols, and, for every relation , . This can be thought of as a weak version of the usual substructure relation, where we do not require the substructure to be induced by taking a subset of the domain. Since the definition does not refer to the domains of the structures , it is clearly also applicable to instances.
To every CQ of signature one can associate the instance , the canonical instance associated to : the active domain of consists of the set of variables and constants occurring in and the facts are the literals . Evaluation of a CQ can be restated in terms of homomorphisms from : for every ary CQ and every tuple a of an instance we have that iff there exists a homomorphism [CM77].
The GuardedNegation Fragment. The Guarded Negation Fragment (GNFO) is a syntactic fragment of firstorder logic, from which it inherits the usual semantics. The formulas of GNFO are built up inductively according to the grammar^{1}^{1}1In practice, the parentheses are often omitted and parsing ambiguity is resolved with the help of the standard order of precedence of logical connectives. ϕ::= R(t_1, …, t_n) — t_1=t_2 — ∃x (ϕ) — (ϕ∨ϕ) — (ϕ∧ϕ) — (α∧¬ϕ) where is a relation symbol, each is a variable or a constant symbol, and, in the last clause, is an atomic formula (possibly an equality) in which all free variables of the negated formula occur. That is, each use of negation must occur conjoined with an atomic formula that contains all the free variables of the negated formula. The atomic formula that witnesses this is called a guard for . Since we allow equalities as guards, every formula with at most one free variable can be trivially guarded, and we often write instead of , when has no free variables besides (possibly) . For a signature consisting of constant symbols and relation symbols, denotes the GNFO formulas in signature .
GNFO should be compared to the Guarded Fragment (GFO) of firstorder logic [AvBN98JPL, Gr99JSL] typically defined via the grammar ϕ::= R(t_1, …, t_n) — t_1 = t_2 — ∃x (α∧ϕ) — (ϕ∨ϕ) — (ϕ∧ϕ) — ¬ϕ where, in the third clause, is again an atomic formula in which all free variables of occur (and may be a sequence of variables). Note that, in GFO formulas, all quantification must occur in conjunction with a guard, while there is no restriction on the use of negation.
Since GNFO is closed under conjunction and existential quantifications, every conjunctive query is expressible in GNFO. It is not much more difficult to verify that every GFO sentence can also be equivalently expressed in GNFO [BtCS15jacm]. Turning to fragments of firstorder logic that are common in database theory, consider guarded tuplegenerating dependencies: that is, sentences of the form
By simply writing out such a sentence using , one sees that it is convertible to a GNFO sentence. In particular, every inclusion dependency (i.e. every formula , where the atomic formulas and have no constants and no repeated variables) is expressible in GNFO. As mentioned in the introduction, many of the common dependencies used to describe relationships between schemas (e.g. see [dataint, FKMP05]) are expressible in GNFO. In addition, many of the common description logic languages used in the semantic web (e.g. and [dl]) are known to admit translations into GFO and hence into GNFO.
We will frequently make use of the key result from [BtCS15jacm] showing that GNFO is decidable and has the finite model property:
Theorem 2.2
A GNFO formula is satisfiable over all structures iff it is satisfiable over finite structures. Satisfiability and validity of GNFO is decidable (and 2ExpTimecomplete).
It was shown in [bbo] that GNFO can be equivalently restated as a fragment of Codd’s relational algebra, and of the standard database query language SQL. More specifically, in [bbo], a fragment of relational algebra, called GuardedNegation Relation Algebra (GNRA) is introduced, and is shown to capture domainindependent GNFO. It is worth noting also that we can actually decide whether a given GNFO formula is domainindependent (and hence whether it can be converted to GNRA). This is in contrast to the wellknown fact that domainindependence is undecidable for firstorder logic [AHV]. To see the decidability, we simply note that the statement expressing that a GNFO formula is domainindependent can be expressed as the validity of a GNFO sentence: the sentence is formed by introducing relations for the two domains, and relativizing quantification to those domains. We can then apply Theorem 2.2 to this sentence.
Note that if we have two GNFO open formulas and , the sentence stating that they are equivalent, or that one implies the other, is not necessarily a GNFO sentence. This does hold, however, if and are answerguarded. We will need to require answerguardedness in some of our results involving open formulas.^{2}^{2}2Note, however, that the equivalence problem and the entailment problem are decidable in 2ExpTime even for nonanswerguarded GNFO formulas (as follows from a easy reduction in which free variables are replaced by constant symbols). See, for example, Corollary 5.9. Most results about GNFO sentences trivially generalize to answerguarded GNFO formulas. For instance, the observation from [BtCS15jacm] that every GFO sentence can be equivalently transcribed into GNFO extends to answerguarded GFO formulas.
Guarded sets and tuples. Let be a structure and be the interpretation of all constants in the signature of . A subset of the domain of is guarded if there is a fact (in some relation) in which all members of occur together. We will sometimes apply the same notion to tuples: a tuple of values from the domain of a structure is guarded (in the structure), if the set of all elements of the tuple is guarded. Note that an answerguarded query can only be satisfied by guarded tuples.
Treelike model property. Satisfiable GFO formulas always have models that are “treelike”: this is the treelike model property of GFO [AvBN98JPL, Gr99JSL]. For any relational structure with constants, and any guarded tuple there is a guarded unravelling [AvBN98JPL] of at , a structure and tuple such that:

is tree like in the sense that it has a tree decomposition with guarded bags [GO14survey];

if and only if for all .
We conclude this section by recalling an important result about approximating arbitrary answerguarded conjunctive queries by conjunctive queries that are in GFO, which is proven using the unravellings above.
Paraphrasing [BGO14lmcs] we define the treeification of an answerguarded CQ as the collection of minimal acyclic CQ that imply . From [BGO14lmcs] we know that is finite if the signature is finite. We will thus sometimes identify the treeification with the (answerguarded) UCQ .
The next fact is a simple consequence of the definition of treeification and of the properties of guarded unravellings. It was first observed in [BGO14lmcs] in the case of boolean CQs, but the same reasoning applies to answerguarded CQs.
Fact 2.3 (Treeification)
For every answerguarded CQ , every structure and guarded tuple of it holds that iff . Consequently, for every answerguarded GFO formula and answerguarded conjunctive query it holds that iff .
We note that guarded unravellings are typically infinite and that it takes considerably more work to show that the last claim remains valid when restricting attention to finite structures [BGO14lmcs]. This claim is what underpins the argument in [BtCS15jacm] establishing the finite model property of GNFO.
3 Characterization and Preservation theorems
Preservation theorems are results showing that every property definable within a certain logic and which additionally satisfies some important semantic invariance can be expressed by a formula in the logic whose syntactic form guarantees that invariance. One example from classical model theory is the ŁośTarski theorem, stating that a property of structures definable in firstorder logic is definable by a universal formula if and only if it is preserved under taking substructures. A second example is the Homomorphism Preservation theorem, stating that a property of structures definable in firstorder logic is expressible by an existential positive sentences if and only if it is preserved under homomorphism [ChangKeisler]. One can consider the “finite model theory analogs” of each of these statements: for example, the finite model theory analog of ŁośTarski would be that a property of finite structures definable in firstorder logic that is preserved under taking substructures must be definable by a universal formula of firstorder logic. This analog is known to fail [EF99]. Rossman [ross] has shown that the finite analog of the Homomorphism Preservation theorem does hold.
A wellknown preservation theorem from modal logic is Van Benthem’s theorem, stating that basic modal logic can express precisely the properties expressible in firstorder logic invariant under bisimulation [vdb]. Rosen [rosen] has shown that Van Benthem’s theorem also remains valid if one restricts attention to finite structures, cf. also [Otto04APAL]. Analogous results on arbitrary structures have been established for both GFO [AvBN98JPL] and GNFO [BtCS15jacm]. In the context of finite model theory, Otto [Otto12jacm, Otto13apal] provided Van Benthemstyle characterizations of GFO and of the “bounded fragment of GNFO” indexed by a number . Central to these results are the notions of guarded bisimulation and guarded negation bisimulation that play similar roles in the model theory of GFO, respectively, GNFO as does bisimulation in the model theory of modal logic. For a comprehensive survey the interested reader should turn to [GO14survey].
3.1 Characterizing Gnfo within FO
We first look at the question of characterizing GNFO as a fragment of firstorder logic invariant under certain simulation relations. In [BtCS15jacm] guardednegation bisimulations (GNbisimulations) were introduced, and it was shown that GNFO expresses the firstorder logic properties that are invariant under GNbisimulations. A related characterization over finite structures for the variable fragment of GNFO is given in [Otto13apal]. Here we will work over all structures, giving a characterization theorem for a simpler kind of simulation relation, which we call a strong GNbisimulation. We will use this characterization as a basic tool throughout the paper: to show that a certain formula is equivalent to one in GNFO, to argue that two structures must agree on all GNFO formulas and to amalgamate structures that cannot be distinguished by GNFO sentences in a subsignature. The many uses of strong GNbisimulations suggest that it is really the right equivalence relation for GNFO.
Recall that a homomorphism from a structure to a structure is a map from the domain of to the domain of that preserves the relations as well as the interpretation of the constant symbols. Recall also that a set, or tuple, of elements from a structure is guarded in if there is a fact of that contains all elements within the fact except possibly those that are the interpretation of some constant symbol.
Definition 3.1 (Strong GNbisimulations)
A strong GNbisimulation between structures and is a nonempty collection of pairs of guarded tuples of elements of and of , respectively, such that for every :

there is a homomorphism such that and “ is compatible with ”, meaning that for every guarded tuple in .

there is a homomorphism such that and “ is compatible with ”, meaning that for every guarded tuple in .
We write if the map extends to a homomorphism from to that is compatible with some strong GNbisimulation between and . Note that, here, a and b are not required to be guarded tuples. We write if, furthermore, a is a guarded tuple in (in which case we also have that ). These notations can also be indexed by a signature , in which case they are defined in terms of reducts of the respective structures.
It is easy to see that if there exists a strong GNbisimulation between two structures, then the respective substructures consisting of the elements designated by constant symbols must be isomorphic.
The key distinction between strong GNbisimulation and the GNbisimulation of [BtCS15jacm] is that the homomorphisms whose existence is postulated in the backandforth properties of GNbisimulation are only required to be “local”, that is, defined on arbitrary finite neighbourhoods of the guarded tuple in question, while our definition above asks for a single “global” homomorphism that is defined on the entire domain of the respective structure, i.e. one that is uniformly appropriate for all neighbourhoods according to the requirements of GNbisimulations of [BtCS11icalp]. This is a very significant strengthening of requirements, which makes strong GNbisimulation more powerful as a tool in our proofs.
Another distinction between the notions is that while GNbisimulations are only defined on guarded tuples, our notion of strong GNbisimulation is meaningful on arbitrary tuples. It is an equivalence relation on guarded tuples, but is asymmetric on general tuples.
In [BtCS15jacm] it was shown that GNFO corresponds to the GNbisimulationinvariant fragment of firstorder logic. In light of our previous remark, it follows that GNFO formulas are also invariant under strong GNbisimulations as far as guarded tuples are concerned. In fact, for arbitrary tuples one can verify via structural induction on the construction of formulas that all GNFO formulas are preserved by strong GNbisimulations. That is, one can show that implies , where the notation
expresses that, for every GNFO formula , implies .
Strong GNbisimulations will play a key role in our remaining results. Informally, when we want to show that a GNFO formula can be replaced by another simpler , we will often justify this by showing that an arbitrary model of can be replaced by a strongly bisimilar structure where holds (or vice versa).
Our first “expressive completeness” result characterizes GNFO as the fragment of firstorder logic that is preserved by strong GNbisimulations.
Theorem 3.2
A firstorder formula is preserved by (over all structures) iff it is equivalent to a GNFO formula.
The proof of the of Theorem 3.2 relies on the following lemma. Further, in the remainder of the paper, we will make use of the lemma directly. For example, the second part of the lemma will be instrumental in our proof of Craig Interpolation for GNFO presented in Section 4.
The first part of the lemma will be used in the “easy direction” of Theorem 3.2: it formalizes the notion that strong bisimulation preserves GNFO formulas. The second part of the lemma will be used in the harder direction of Theorem 3.2. It asserts that can always be lifted to by passing from a pair of structures to suitable elementary extensions. The second part will be established using the technique of recursively saturated models [ChangKeisler].
Lemma 3.3

If then .

If and both structures are countable, then there are countable elementary extensions and , respectively, such that .
The first part can be proved by a straightforward formula induction. For the second part, we will use countable recursively saturated structures.
Consider the pair of countable structures viewed as a single structure over an extended signature with additional unary predicates and to denote the domain of and of , respectively. Let be any countable recursively saturated elementary extension of . Let be the collection of all pairs of guarded tuples of and that are GNFOindistinguishable. To establish the lemma, we need to show that is a strong GNbisimulation, and that the partial map extends to a homomorphism that is compatible with . Both follow directly from the following claim.

Claim. Every finite partial map from to , or vice versa, that preserves truth of all GNFOformulas, can be extended to a homomorphism compatible with .

Proof of claim. We assume that is a finite partial map from to ; the other direction is symmetric. Fix an enumeration of the (countably many) elements of the domain of that are not in the domain of . We will define a sequence of finite partial maps such that , and such that each preserves truth of all GNFO formulas. It then follows that is a homomorphism extending and compatible with .
It remains only to show how to construct from . Here, we use the fact that is recursively saturated. Let c be an enumeration of the domain of , and d an enumeration of the range of , corresponding to the enumeration of c, and let be the set of all firstorder formulas of the form
where is a GNFO formula with parameters c and , and is obtained by replacing each parameter in c by its image, and replacing by . In the above definition of we only consider formulas that belong to GNFO even when the parameters are treated as free variables (thereby excluding formulas such as ).
The set is clearly a recursive set. From the fact that preserves truth of GNFO formulas it follows that every finite subset of is realized in . Note that in the argument above we are only relying on the closure of GNFO under conjunction and existential quantification.
By compactness, therefore, is consistent and, by virtue of recursive saturation, it is realized by some element . It follows from the construction that the partial map preserves truth of all GNFO formulas.
This concludes the proof of the lemma.
Proof of Theorem 3.2. We prove only the harder direction, following the template often used in preservation theorems in classical model theory. Let be preserved by , and let be the set of all GNFO formulas it entails. Thanks to compactness, it is enough to show that .
Let , and let be the set of all negations of GNFO formulas false of in . We claim that is consistent. Suppose it were not consistent. Then by the Compactness Theorem we would have that implies , where is the negation of some finite conjunction of formulas from . It follows from the construction of that is (up to logical equivalence) a GNFO formula, which therefore must belong to . This yields a contradiction because we have that and .
Thus there is and a such that . By construction, every GNFO formula true of in is also true of in . Note that we may assume that both and are countable. Using Lemma 3.3, we can find elementary equivalent extensions completing the following diagram.
By virtue of being invariant under elementary equivalence and being preserved by strong GNbisimulations, we can chase it around the diagram starting from and concluding . Given that was arbitrary, this shows that and so the theorem follows.
Note that our proof makes use of infinite structures in a fundamental way. We do not claim the analogous result for preservation over finite structures.
We now look at characterizing the intersection of GNFO with smaller fragments of firstorder logic. We will start with tuplegenerating dependencies.
3.2 Tuplegenerating dependencies within Gnfo
Recall that a tuplegenerating dependency (TGD) is a sentence of the form:
where and are conjunctions of relational atomic formulas (not equalities). TGDs arise in databases, as a way of specifying natural restrictions on data and as a way of capturing relationships between different datasources. They also arise in ontological reasoning. Static analysis and query answering problems have motivated research to identify expressive yet computationally wellbehaved classes of TGDs. A guarded TGD (GTGD) is one in which includes an atomic formula containing all the variables occurring in . Guarded TGDs constitute an important class of TGDs at the heart of the Datalog framework [CGL09pods, BGO14lmcs] for which many computational problems are decidable. More recently, Baget, Leclère, and Mugnier [baget2010] introduced frontierguarded TGDs (FGTGDs), defined like guarded TGDs, but where only the variables occurring both in and in (the exported variables) must be guarded by an atomic formula in . Every FGTGD is equivalent to a GNFO sentence, obtained just by writing it out using existential quantification, negation, and conjunction. Theorem 3.7 below shows that these are exactly the TGDs that GNFO can express.
We need two lemmas: one about GNFO and one about TGDs. For two structures , let us denote by the structure obtained from by removing all facts containing only values from the active domain of . We say that is a squidextension of if

every set of elements from the active domain of that is guarded in is already guarded in ; and

is a union of structures such that: for two distinct and their active domains overlap only in , and each is guarded in , where is the set of elements of named by a constant symbol.
Intuitively, we can think of as a squid, where each is one of its tentacles. We refer to the as the tentacles, and the partition into as a squid decomposition of .
We extend the notation to instances in the obvious way (since it does not depend on the domain of or ). The following lemma allows one to turn an arbitrary extension of a structure into a squidextension of , modulo strong GNbisimulation.
Lemma 3.4
For every pair of structures with , there is a squidextension of and a homomorphism whose restriction to is the identity function, such that via a strong GNbisimulation that is compatible with . Moreover, we can choose to be finite if is.
We will make use of Lemma 3.4 as a tool for bringing certain conjunctive queries into a restricted syntactic form, by exploiting the fact that, whenever a tuple from satisfies a conjunctive query in a squidextension of , then we can partition the atomic formulas of the query into independent subsets that are mapped into different tentacles of .
For every set of elements that is guarded in , we create a structure that is a fresh isomorphic copy of in which only the elements of are kept constant (i.e., mapped to themselves by the isomorphism), where is the set of all elements named by a constant symbol. We define to be the union of all such . Clearly, is a squidextension of , and the natural projection is a homomorphism. Furthermore, we claim that via a strong GNbisimulation that is compatible with . The claimed strong GNbisimulation consists of all pairs where is a guarded tuple of .
The following lemma expresses a general property of TGDs that follows from the fact that TGDs are preserved under taking direct products of structures [Fagin82].
Lemma 3.5
(Both classically and in the finite.) Let be any set of TGDs and suppose that , where and the are conjunctions of atomic formulas. Then for some .
To simplify the presentation, we consider the case where . Let
and suppose for the sake of a contradiction that there are structures and such that . Let be the direct product , that is, the structure whose domain is the cartesian product of the domains of and and such that a tuple of pairs belong to a relation in if and only if the tuple of firstprojections belongs to the corresponding relation in and the tuple of secondprojections belongs to the corresponding relation in . If a constant symbol denotes in and in , it denotes the pair in . Since TGDs are closed under taking direct products, we have that . It also follows from the construction that

the natural projections and are homomorphisms, and

whenever is satisfied by tuples in and in , then the tuple of pairs whose firstprojections are and whose second projections are also satisfies in .
Putting this together, we obtain that , which contradicts the fact that .
Because is finite if both and are, the above argument is equally valid over finite structures as over arbitrary structures.
We now return to describing our characterization of TGDs that are equivalent to some GNFO sentence. Consider a TGD . A specialization of is a TGD of the form obtained from by applying some substitution mapping the variables to constant symbols or to variables among and . Clearly, a specialization of a TGD entails . The following lemma states that as far as strong GNbisimulation invariant TGDs are concerned, we can replace any TGD by specializations of it that are equivalent to frontierguarded TGDs. Its proof relies heavily on the two lemmas above.
Lemma 3.6
[TGD specializations] (Both classically and in the finite.) Let be a set of TGDs that is strong GNbisimulation invariant and let be a TGD such that . Then there exists a specialization of such that , and such that is logically equivalent to a conjunction of frontierguarded TGDs.
First we introduce the notion of a quasifrontier guarded TGD. By the graph of a TGD we mean the undirected graph whose nodes are the conjuncts of and where two conjuncts are connected by an edge if they share an existentially quantified variable. Observe that if the graph of is not connected, then can be decomposed into several TGDs, one for each connected component. We say that is quasifrontier guarded if, for each connected component of its graph, the set of universally quantified variables occurring in atomic formulas belonging to that component is guarded by some atomic formula in the TGD body . This is equivalent to saying that the decomposition into TGDs just mentioned yields a set of frontierguarded TGDs.
We will show that, if is a set of TGDs that is strong GNbisimulation invariant and is a TGD such that , then there exists a specialisation of such that , and such that is quasifrontier guarded.
Thus fix such that .
Consider any structure and homomorphism . Let be the image of . By Lemma 3.4, has a squidextension such that via some strong GNbisimulation that is compatible with a homomorphism whose restriction to is the identity function. Since is invariant for strong GNbisimulations, . Therefore since , . In particular, can be extended to a homomorphism from to . We can extract from a substitution , namely the one that sends a variable to a constant symbol if is the interpretation of (if is the interpretation of several constant symbols we choose one arbitrarily), or else sends to an arbitrary for which if there is such , otherwise sends to . Applying to the conjunctive query yields another conjunctive query (where is a subset of . By construction we have that
is a specialization of such that the CQ is satisfied in , hence also in , under the assignment for the universally quantified variables . We first show that each is quasifrontierguarded. Consider the decomposition of
such that the graphs of enumerate the connected components of the graph of and let be arbitrary.
Note that, by construction, all existential variables are mapped by to elements that neither belong to nor interpret any constant symbol: if had mapped an existential variable to , then this variable would have been removed and replaced by a universal variable. Next note that the active domains of the tentacles of overlap only on elements of . Using connectivity of , we see that the existential variables must map to the active domain of a single tentacle. From connectedness of the graph of , we know there are two possibilities: if there are no existential variables in , then consists of a single atom. In this case the universal variables map into a guarded set of . If there is any existential variable in , then every universal variable lies in some atom with an existential variable. Since the existential variables do not map into , it follows that the image of under must be entirely contained in a single tentacle of . Now the subset of the universallyquantified variables occurring in is mapped into , since mapped into and extended . Thus the variables must be mapped by to the intersection of a tentacle and the active domain of , hence (by the properties of a squid decomposition) again we can conclude that maps to a guarded set of elements of . And since agrees with on these variables, the same statement holds with substituted for . Since was defined as the image of , we can conclude that the universallyquantified variables occurring in are guarded in ; that is, is frontierguarded. Since was arbitrary, this shows that is indeed quasifrontierguarded.
Now we need to show that one such is entailed by . What we have shown thus far is that any that is satisfied by satisfies one such . But there are only finitely many such , and thus by Lemma 3.5 we can conclude that entails one such .
Suppose we apply the lemma above to each TGD is . We get a finite set of frontierguarded TGDs whose conjunction implies each TGD in . Further, each TGD in the set is implied by . Thus we have obtained our first main characterization:
Theorem 3.7
Every GNFO sentence that is equivalent to the conjunction of a finite set of TGDs on finite structures is equivalent to the same conjunction of a finite set of TGDs on arbitrary structures, and such a formula is equivalent (over all structures) to a finite set of FGTGDs.
In light of the above result, it may seem tempting to suppose that, similarly, guarded TGDs can express all that can be expressed both by TGDs and in GFO. This is, however, not the case: the TGD can be equivalently expressed in GFO, but not by means of a guarded TGD; and the guarded TGD is not expressible in GFO. Instead, we show that every property expressible both in GFO and by a finite set of TGDs is in fact expressible by a finite set of acyclic frontierguarded TGDs.
Recall from Section 2 that a CQ is answerguarded if its free variables cooccur in one of its atomic subformulas and that such a CQ is acyclic if it is equivalent to a positiveexistential GFO formula. We say that a frontierguarded TGD is acyclic if the answerguarded CQ and the answerguarded CQ are both acyclic. Note that both CQs are indeed answerguarded, by virtue of being frontierguarded.
Theorem 3.8
Every GFO sentence that is equivalent to a finite set of TGDs over finite structures is equivalent (over all structures) to a finite set of acyclic FGTGDs.
Let be any GFO sentence that is equivalent to a finite set of TGDs over finite structures. Then, by Theorem 3.7, is equivalent to a finite set of FGTGDs over arbitrary structures.
Recall the notion of guarded unravelling of a structure and the notion of treeification of an answerguarded CQ from Section 2. Note that for each TGD in , its lefthand side is answerguarded by definition, and its righthand side can be assumed answerguarded as well. Consider the set of disjunctive GTGDs obtained by replacing the head and body of each TGD by its treeification, and expanding out the disjunction in the lefthand side.
We claim that is equivalent to . Note that since is in GFO, for any structure , . Similarly, since is in GFO, . Thus it is enough to show equivalence of and on guarded unravellings. But from Fact 2.3 we see that each formula is equivalent to its treeification on guarded unravellings, and so our claim is proven.
Now by Lemma 3.5, we obtain that each disjunctive TGD in is equivalent to one of the GTGDs obtained by replacing the disjunction in its head by one of the disjuncts. Since the head and body of each such TGD are acyclic, each such TGD is acyclic.
3.3 Existential and PositiveExistential Formulas
We turn to characterizing the existential formulas within GNFO, establishing an analog of the ŁośTarski theorem.
Theorem 3.9
Every GNFO formula that is preserved under extensions over finite structures has the same property over all structures, and such a formula is equivalent (over all structures) to an existential formula in GNFO. Furthermore, we can decide whether a formula has this property, and also find an equivalent existential GNFO formula effectively.
Let be a GNFO formula containing constants c and with free variables x. Let d be fresh constants, one for each variable in x. Then is preserved under extensions over finite structures iff the GNFO sentence is a validity over finite structures, where is the relativization of to a new unary predicate . Since is a GNFO formula, it is a validity over finite structures iff it is a validity over all structures. Also, the decidability of GNFO allows us to decide this validity.
As to the effective content of the claim, note that once an equivalent existential formula is known to exist in GNFO, we can find it by exhaustive search relying on the decidability of equivalence of GNFO formulas.
By the classical ŁośTarski theorem, if a firstorder formula is preserved under extensions over all structures, it is equivalent to an existential formula . Thus, to complete the proof, it suffices to show that every GNFO formula that is equivalent to an existential formula is also equivalent to an existential GNFO formula . We can assume that is satisfiable, since otherwise it is clearly equivalent to a GNFO formula. We can convert into the form , where with each a possibly negated relational atom and where each is a conjunction of equalities an inequalities of a complete equality type on cxy. That is, is a maximal satisfiable set of equalities and inequalities involving the constants c and variables xy.
In general, some of the negated atomic formulas and inequalities in may not be guarded. Let be obtained from by removing all conjuncts that are unguarded negative atomic formulas or unguarded inequalities.
We claim that and are equivalent. One direction is obvious, since clearly implies . In the remainder of the proof, we show that implies .
Consider an arbitrary structure and tuple a such that . It is our task to show that . Our general approach will be to construct another structure and tuple b such that . In addition, we will show that . By Theorem 3.2, this will allow us to conclude as needed, since is logically equivalent to .
Let be a variable assignment from an appropriate to elements of , witnessing . In particular, is in general an incomplete equality type on cxy that only includes an equality or inequality of every pair of variables that cooccur in a positive relational atom in some . We need to show that . The main obstacles to overcome are:

the possibility that maps two variables to the same element of while includes the (unguarded) inequality .

the possibility that contains a fact that is the image of an atomic formula occurring under an (unguarded) negation in .
Based on these considerations, our construction of and b will, intuitively, involve (i) making sure that only those equalities are satisfied that are either explicitly contained in or that follow (by transitivity) from guarded equalities true in at a and (ii) making sure that every fact satisfied in whose values are in the range of is guarded by a fact that is an image of a positive atomic formula of .
The precise construction is as follows. Let be the set of constants and all variables occurring, free or bound, in . Further let be the equivalence relation on generated by all pairs of constants or variables such that contains the equality . Let be the natural map that sends each variable to its equivalence class. We define the structure with domain and, for each relation symbol , the relation consisting of tuples such that occurs as a positive atomic subformula in or, what is the same, in . Further let the class of each constant interpret in the corresponding constant symbol and let . Note that depends on solely through the choice of the disjunct that is assumed to be satisfied at a in via the variable assignment .

Observation 1: there is a homomorphism such that and such that is injective on guarded subsets of . That is, maps distinct elements cooccurring in a fact of to distinct elements of .

Observation 2: assigns elements of to variables of in a manner witnessing .
Observation 1 follows from the definition of and of . Observation 2 follows from the construction of (for the equalities, inequalities, and positive atomic formulas) and from the previous observation (for the negative atomic formulas).
As a next step, we transform into as follows. For each fact of we make an isomorphic copy of denoted , where the isomorphism maps the elements belonging to the image of to their, by Observation 1, unique preimage and maps all other elements to distinct fresh elements. We define as the union , and let be the map that extends by mapping every newlycreated element in some to the corresponding element of . Note that, by construction, is a homomorphism.

Observation 3: via the variable assignment .

Observation 4: .
Observation 3 follows from Observation 2, , and the observation that does not add any new facts on elements of . For Observation 4, it can be easily verified that the graph of is in fact a strong GNbisimulation, which is compatible with the homomorphism and . From Observation 4 and Theorem 3.2 we get that as needed.
Note. This theorem can also be proven by refining the GNFO interpolation theorem of Section 4 to get a Lyndonstyle interpolation theorem. The approach via interpolation is spelled out in the paper [csllics14].
Finally, we consider the situation for GNFO formulas that are positive existential (for short, ). Since GNFO contains all formulas, Rossman’s homomorphism preservation theorem [ross] implies that the formulas are exactly the formulas in GNFO preserved under homomorphism, over all structures or (equivalently, by the finite model property for GNFO) over finite structures. In addition, using the proof of Rossman’s theorem plus the decidability of GNFO we can effectively decide whether a GNFO formula can be rewritten in .
Theorem 3.10
There is an effective algorithm for testing whether a given GNFO formula is equivalent to a positive existential formula, and, if so, computing such a formula.
Rossman’s proof [ross] shows that if an arbitrary FO formula is equivalent to an formula, it is equivalent to one of the same quantifier rank as . If is in GNFO, we can test equivalence of a given formula with , using the decidability of GNFO. We can thus test all formulas with quantifier rank bounded by the quantifier rank of , giving an effective procedure.
4 Interpolation and Beth definability for Gnfo
The Craig Interpolation theorem for firstorder logic [craig57beth] can be stated as follows: given formulas such that , there is a formula such that

, and

all relations occurring in occur in both and

all constants occurring in occur in both and

all free variables of are free variables of both and .
The Craig Interpolation theorem has a number of important consequences, including the Projective Beth Definability theorem [beth]. Suppose that we have a sentence over a firstorder signature of the form , where is an ary predicate, and suppose is a subset of . A sentence implicitly defines predicate over if: for every structure , every expansion to a structure satisfying has the same restriction to .Informally, the structure and the sentence determine a unique value for . An ary predicate is explicitly definable over for models of if there is another formula using only predicates from such that . It is easy to see that whenever is explicitly definable over for models of , then implicitly defines over . The Projective Beth Definability theorem states the converse: if implicitly defines over , then is explicitly definable over for models of . In the special case where , this is called simply the Beth Definability theorem.
A proof of the Craig Interpolation theorem can be found in any model theory textbook (e.g. [ChangKeisler]). The Projective Beth Definability theorem follows from the Craig Interpolation theorem. Both theorems fail when restricted to finite structures [EF99].
We say that a fragment of firstorder logic has the Craig Interpolation Property (CIP) if for all in the fragment, the result above holds relative to the fragment. We similarly say that a fragment satisfies the Projective Beth Definability Property (PBDP) if the Projective Beth Definability theorem holds relativized to the fragment – that is, if in the hypothesis of the theorem lies in the fragment then there is a corresponding formula lying in the fragment as well. We talk about the Beth Definability Property (BDP) for a fragment in the same way. The argument for firstorder logic applies to any fragment with reasonable closure properties [hooglandthesis] to show that CIP implies PBDP.
CIP and PBDP do not hold when implication is restricted to finite models [EF99]. However, the finite and unrestricted versions of these properties are equivalent when considering fragments of FO with some basic closure properties that have the finite model property, since there equivalence (resp. consequence) over finite structures can be replaced by equivalence (resp. consequence) over all structures. Thus it is particularly natural to look at CIP and PBDP for such fragments, such as GFO and GNFO. Hoogland, Marx, and Otto [HMO] showed that the Guarded Fragment satisfies BDP but lacks CIP. Marx [Marx07pods] went on to explore PBDP for the Guarded Fragment and its extensions. He argues that the PBDP holds for an extension of GFO called the Packed Fragment. The definition of the Packed Fragment is not important for this work, but at the end of this section we show that PBDP fails for GFO, and also (contrary to [Marx07pods]) for the Packed Fragment. But we will adapt ideas of Marx to show that CIP and PBDP do hold for GNFO.
The main technical result of this section is then:
Theorem 4.1 (Gnfo has Craig interpolation)
For each pair of GNFOformulas such that , there is a GNFOformula such that

, and ,

all relations occurring in occur in both and ,

all free variables of are free variables of both and .
Section 4.1 is dedicated to the proof of Theorem 4.1. In Section 4.2 we present further applications of the result, and in Section 4.3 we discuss failure of interpolation for the Guarded Fragment.
We first comment that item (iii) can be ensured by preprocessing and . We can assume that contains only free variables that are common to : if it has variables that are not, then we can existentially quantify them. We can also assume that has only free variables that are common to : if it has variables that are not, then we can universally quantify them, restricting the universal quantification to a new “dummy guard”. This new guard will not occur in the interpolant, since it is not common, so this does not impact the other items. quantifying any violating free variables of the interpolant. Thus it suffices to ensure (i) and (ii).
Also observe that in Theorem 4.1, the interpolant is allowed to contain constant symbols outside of the common language. Indeed, this must be so, for GNFO lacks the stronger version of interpolation where the interpolant can only contain constant symbols occurring both in the antecedent and in the consequent. Recall that, in GNFO, as well as GFO, constant symbols are allowed to occur freely in formulas, and that their occurrence is not governed by guardedness conditions. In particular, for example, the formula belongs to GFO (and is equivalent to a formula of GNFO), while the formula does not. Now, consider the valid entailment . It is not hard to show that any interpolant not containing the constants and must be equivalent to . This shows that there are valid GFOimplications for which interpolants cannot be found in GNFO, if the interpolants are required to contain only constant symbols occurring both in the antecedent and the consequent. In fact, in [tencate:JSL05] it was shown that, in a precise sense, every extension of GFO with this strong form of interpolation has full firstorder expressive power and is undecidable for satisfiability.
4.1 Proof of Craig interpolation for Gnfo
To establish Theorem 4.1 we follow a common approach in modal logic (see, in particular, Hoogland, Marx, and Otto [HMO]). We make use of a result saying that we can take two structures over different signatures, behaving similarly in the common signature, and amalgamate them to get a structure that is simultaneously similar to both of them (in the respective signatures). The precise statement of the theorem will be in terms of the notion of strong GNbisimulation introduced in Section 3, and the proof will make use of the results there. Our specific amalgamation construction is inspired by the zigzag products introduced by Marx and Venema [MarxVenema]. In the lemma and claims below, a will range over tuples, not necessarily guarded.
Lemma 4.2 (Amalgamation)
Let and be signatures containing the same constant symbols but possibly different relation symbols. If , then there is a structure such that
Let be the strong GNbisimulation between and witnessing the fact that . Below, for any partial map from to or vice versa, with a slight abuse of notation, we will write if can be extended to a homomorphism that is compatible with . In particular, we have . Note that, for individual elements and , if and only if . In addition, with some further abuse of notation, for any tuple of elements of and for any tuple of elements of , we will denote by the tuple .
We define the amalgam as follows:

the domain of is ;

for every ;

for every ;

for every constant symbol ;

.
To see that is thus well defined, note that for , if and then also and , and vice versa.

Claim 1:

Proof of claim 1. Let be the collection of all pairs for and v guarded (by a atomic formula) in . We will show that is a strong GNbisimulation between and , and that .
Consider any pair . By construction, we have that and hence, there is a homomorphism that is compatible with , and such that . Let for all . It can easily be verified that is a homomorphism from to that is compatible with , and that