When Names Are Not Commonly Known: Epistemic Logic with Assignments

by   Yanjing Wang, et al.

In standard epistemic logic, agent names are usually assumed to be common knowledge implicitly. This is unreasonable for various applications. Inspired by term modal logic and assignment operators in dynamic logic, we introduce a lightweight modal predicate logic where names can be non-rigid. The language can handle various de dicto and de re distinctions in a natural way. The main technical result is a complete axiomatisation of this logic over S5 models.


page 1

page 2

page 3

page 4


Call Me by Your Name: Epistemic Logic with Assignments and Non-rigid Names

In standard epistemic logic, agent names are usually assumed to be commo...

Dynamic Term-Modal Logic for Epistemic Social Network Dynamics (Extended Version)

Logics for social networks have been studied in recent literature. This ...

Statistical Epistemic Logic

We introduce a modal logic for describing statistical knowledge, which w...

An Epistemic Foundation for Authentication Logics (Extended Abstract)

While there have been many attempts, going back to BAN logic, to base re...

A Logic for Global and Local Announcements

In this paper we introduce global and local announcement logic (GLAL), ...

De Re Updates

In this paper, we propose a lightweight yet powerful dynamic epistemic l...

A program logic for fresh name generation

We present a program logic for Pitts and Stark's ν-calculus, an extensio...

1 Introduction

One dark and stormy night, Adam was attacked and killed. His assailant, Bob, ran away, but was seen by a passer-by, Charles, who witnessed the crime from start to finish. This led quickly to Bob’s arrest. Local news picked up the story, and that is how Dave heard it the next day, over breakfast. Now, in one sense we can say that both Charles and Dave know that Bob killed Adam. But there is a difference in what they know about just this fact. Although Charles witnessed the crime, and was able to identify the murderer and victim to the police, he might have no idea about their names. If asked “Did Bob kill Adam?” he may not know. Yet this is a question that Dave could easily answer, despite not knowing who Adam and Bob are—he is very unlikely to be able to identify them in a line-up.

The distinction between these de re and de dicto readings of “knowing Bob killed Adam” is hard to make in standard epistemic logic, where it is implicitly assumed that the names of agents are rigid designators and thus that it’s common knowledge to whom they refer. But in many cases, the distinction is central to our understanding. On the internet, for example, users of websites and other online applications typically have multiple identities, and may even be anonymous. Names are rarely a matter of common knowledge and distinctions as to who knows who is whom are of great interest.

Further complexities arise with higher-order knowledge and belief. In [7], Grove gives an interesting example of a robot with a mechanical problem calling out for help (perhaps in a Matrix-like future with robots ruling the world unaided by humans). To plan further actions, the broken robot, called , needs to know if its request has been heard by the maintenance robot, called . But how to state exactly what needs to know

? In English we would probably write it as:

  1. knows that knows that needs help.

A naive formulation in standard (predicate) epistemic logic is . But without the assumption that the robots’ names are both commonly known, there are various ambiguities. For example, if does not know which robot is named ‘’ then neither does know whom to help nor has any confidence of being helped. On the other hand, may not know that ‘’ is the name of the maintenance robot, thus merely knowing knows needs help is not enough for to be sure it will be helped. The authors of [4] list several possible readings of (), which we will elaborate as follows: , the broken robot, knows that

  1. the robot named ‘’ knows that the robot named ‘’ needs help, or

  2. the robot named ‘’ knows that it, i.e. the broken robot, needs help, or

  3. the maintenance robot knows that the robot named ‘’ needs help, or

  4. the maintenance robot knows that it, i.e. the broken robot, needs help.

It is impossible to distinguish the above readings in standard epistemic logic. In the literature [8, 7, 4, 5, 11], various approaches are proposed. In [7], Grove correctly pinpoints the problems of scope and manner of reference in giving various de re /de dicto readings for higher-order knowledge, and proposes a new semantics for 2-sorted first-order modal logic that is based on world-agent pairs, so as to cope with indexicals like “me”. A special predicate symbol ‘In’ is introduced to capture scope explicitly: holds at a world iff is someone named by in . In [5, 20], an intensional first-order modal logic uses predicate abstraction to capture different readings. says that agent knows de re that is in need of help, whether or not knows that agent is named ‘’, whereas says that knows de dicto that someone called ‘’ needs help, whether or not knows who is. The authors of [4] propose a very general framework with complex operators based on counterpart semantics.111The counterpart semantics helps to handle the situation in which one agent is mistakenly considered as two people, as illustrated in [4] by the story of the double agent in Julian Symon’s novel The Man who killed himself. Without going into details, the formula means, roughly, that the agent named by term knows de re that of the things denoted by terms . Holliday and Perry also bring the alethic modality into the picture together with the doxastic modality, and highlights the use of roles to capture subtle readings in [11], where the multi-agent cases are handled by perspective switching based on a single-agent framework.

In this paper, we follow the dynamic term modal logic approach proposed by Kooi [13], based on term modal logic proposed in [6]. Term modal logic uses terms to index modalities which can also be quantified, so that says that ’s father knows that not everyone knows . The accessibility relation used in the semantics of , where is a term, is then relative to the world at which this formula is evaluated: it is the one labeled by the agent denoted by term in . Based on this, Kooi [13] borrows dynamic assignment modalities from (first-order) dynamic logic so as to adjust the denotation of names, now assumed to be non-rigid in general, in contrast to the usual constants of first-order modal logic which are assumed rigid.

Full first-order term modal language is clearly undecidable. In [16], it is shown that even its propositional fragment is undecidable,222Only the monodic fragment is decidable [16]. and the addition of the program modalities in dynamic logic makes things worse. As Kooi remarks in [13], the combination of term modal logic and dynamic assignment logic is not even recursively enumerable. A closely related study is the doctoral thesis of Thalmann [20], which provides many results including sequent calculi and tableaux systems for both term modal logic (with quantifiers) and quantifier-free dynamic assignment logic (with regular program constructions). But the two logics are studied separately, leaving their combination as future work.333Thalmann predicts in his conclusion that “Using the scoping operator instead of the quantifiers in term-modal logic, should lead to many interesting decidable fragments of term-modal logic. It is shown that the quantifier-free part of dynamic assignment logic is undecidable with both (Kleene) star operator and (rigid) function symbols but it is decidable if there is no star operator.444The later is only stated without a proof. A rich treatment of various issues of ‘semantic competence’ with names that uses term modal logic is given by Rendsvig in [18].

In this paper, we take a minimalist approach, introducing only the basic assignment modalities from dynamic logic combined with a quantifier-free term modal logic, without function symbols, to obtain a small fragment of the logic in [13], which we conjecture to be decidable over S5 models (see discussions at the end of the paper). However, as we will soon see, it is already a very powerful tool for expressing various de re/de dicto distinctions, as well as a kind of knowing who, which was discussed by Hintikka [10] at the very inception of epistemic logic.555See [22] for a summary of related works on knowing-wh. The language is very simple and intuitive to use as a genuine multi-agent epistemic logic that does not presuppose common knowledge of names.

Before the formal details, let us first illustrate the ideas. As in predicate epistemic logic more generally, the formula says that knows de dicto that is , whereas says that knows de re of that it is . The formula says of that it is , which is equivalent to , but combining operators we get , which says that knows de re of that it is . More precisely, our semantics is based on first-order Kripke models with a constant domain of agents (not names) with formulas evaluated with respect to both a world and a variable assignment function . Formula is then true iff is true at when we change so that it assigns to the agent named by in , and is true iff is true at all worlds indistinguishable from by the agent named in . (This is in line with the innermost-scope semantics of [7].)

Returning to Grove’s poor broken robot , the various readings of ‘ knows that knows that needs help’ can be expressed as follows:

  1. , knows that the robot named ‘’ knows that the robot named ‘’ needs help,

  2. , knows that the robot named ‘’ knows it (the broken robot ) needs help,

  3. , knows that it (the maintenance robot ) knows the robot named ‘’ needs help,

  4. , knows that it (the maintenance robot ) knows that it (the broken robot ) needs help.

Moreover, since names are non-rigid, we can express knowing who is by which says that identifies the right person with name on all relevant possible worlds. This we abbreviate as .666There are a lot of different readings of knowing who. E.g., knowing who went to the party may be formalized as under an exhaustive interpretation [21]. See [1, 2] for a very powerful treatment using conceptual covers to give different interpretations. [17] also contains related discussions. Thus we are able to express the following:

  1. : does not know he is called (c.f., “the most foolish person may not know that he is the most foolish person” in [13]).

  2. : knows who is but does not know who is, although they are just two names of the same person.

  3. : Charles knows who killed whom that night but does not know the names of the murderer and the victim.

  4. : Dave knows that a person named Bob murdered a person named Adam without knowing who they are.

The innocent look of our logical language belies some technical complexity. The main technical result is a complete axiomatisation of the logic over epistemic (S5) models (Section 3 and 4), requires much work to handle the constant domain without Barcan-like formulas. We conclude with discussions on the issues of decidability of our logic (Section 5).

2 Preliminaries

In this section we introduce formally the language and semantics of our logic. [Epistemic language with assignments] Given a denumerable set of names N, a denumerable set of variables X a denumerable set P of predicate symbols, the language is defined as:

where , , and

is a vector of terms of length equal to the arity of predicate

. We write as the the abbreviation of and write as the abbreviation of .777This is for comparison with other modal logics; in fact, the assignment modality is self-dual. We call the -free fragment . We define the semantics of over first-order Kripke models. A constant domain Kripke model for  is a tuple where:

  • is a non-empty set of possible worlds.

  • is a non-empty set of agents.

  • assign a binary relation (also written ) between worlds, to each agent .

  • assigns an -ary relation between agents to each -ary predicate at each world .

  • assigns an agent to each name at each world .

We call an epistemic model if is an equivalence relation for each .

Note that the interpretations of predicates and names are not required to be rigid, and there may be worlds in which an agent has no name or multiple names. To interpret free variables, we need a variable assignment . Formulas are interpreted on pointed models with variable assignments . Given an assignment and a world , let and . So although names may not be rigid, variables are.

The truth conditions are given w.r.t. pointed Kripke models with assignments .

An formula is valid (over epistemic models) if it holds on all the (epistemic) models with assignments .

We can translate into the corresponding (2-sorted) first-order language with not only the equality symbol but also a ternary relation symbol for the accessibility relation, a function symbol for each name , and an -ary relation symbol for each predicate symbol . The non-trivial clauses are for and based on translation for terms:

Note that when we can also (equivalently) define , since there is one and only one value of . When , then is equivalent to according to the semantics.

In the light of this translation, we can define the free and bound occurrences of a variable in an -formula by viewing in as a quantifier for binding . Note that the in is not bound in , even when . The set of free variables in is defined as follows (where is the set of variables in the terms ):

We use to denote the result of substituting for all the free occurrences of in . We say is admissible if all the occurrences of by replacing free occurrences of in are also free.

We first show that  is indeed more expressive than . The assignment operator cannot be eliminated over (epistemic) models with variable assignments. Consider the following two (epistemic) models (reflexive arrows omitted) with a fixed domain , worlds and a fixed assignment for all :

can distinguish and given . But the only atomic formulas other than identities are , and , which are all false at and all true at in both models. Also note that and have exactly the same interpretation on the corresponding worlds in the two models. Based on these observations, a simple inductive proof on the structure of formulas would show that  cannot distinguish the two models given .

Interested readers may also wonder whether we can eliminate in each  formula to obtain an  formulas which is equally satisfiable. However, the naive idea of translating into with fresh will not work in formulas like since the name is not rigid.

To better understand the semantics, the reader is invited to examine the following valid and invalid formulas over epistemic models:

1 valid ,  
invalid ,  ,  
2 valid ,  ,  .
invalid ,  
3 valid ( is admissible)
4 valid ,  
invalid ,  
5 valid

Here are some brief explanations:

  • It shows the distinction between (rigid) variables and (non-rigid) names. The invalid formula shows that although two names co-refer, you may not know it (recall Frege’s puzzle).

  • Axioms 4 and 5 do not work for names in general, since may not know that he is named ‘’. On the other hand, positive and negative introspection hold when the index is a variable. The axiom works in general.

  • It also demonstrates the non-rigidity of names. does not imply since may consider a world possible where does not hold since on that world does not refer to the actual person named by in the real world.

  • This shows that it is fine to do the first-level substitutions for the equal names but not in the scope of other modalities.

  • The last pair also demonstrates the distinction between rigid variables and non-rigid names. In particular, the analog of Barcan formula is not in general valid, if is a name.

3 Axiomatisation

In this section we give a complete axiomatisation of valid -formulas over epistemic models. The axioms and rules can be categorised into several classes:

  • For normal propositional modal logic: ;

  • Axiom for epistemic conditions: ;

  • Axioms for equality and first-level substitutability: SUBAS;

  • Axioms capturing rigidity of variables: RIGIDP and RIGIDN;

  • Properties of assignment operator: KAS (normality), DETAS (determinacy), DAS (executability), and EFAS (the effect of the assignment).

  • Quantifications: SUB2AS and , as in the usual first-order setting (viewing assignments as quantifiers).

Propositional tautologies
( can be )
( is admissible)

where means point-wise equivalence for sequences of terms and such that . It is straightforward to verify the soundness of the system. [Soundness]  is sound over epistemic models with assignments. The following are derivable in the above proof system (where is admissible below in ) :


(Sketch) and are trivial based on and SUBP. is based on DETAS and DAS. is due to the contrapositive of SUB2AS and . is due to and for contrapositive. is based on and (taking ). is a special case of SUB2AS and is a special case of . As a more detailed example, let us look at the proof (sketch) of (we omit the rountine steps using the normality of ):

Based on the above result, we can reletter the bound variables in any  formula like in first-order logic. [Relettering] Let be a fresh variable not in and , then

. Since is fresh, is admissible. We have the following proof (sketch):

4 Completeness

To prove the completeness, besides the treatments of and termed modality , the major difficulty is the lack of the Barcan-like formulas in , which are often used to capture the condition of the constant domain. As in standard first-order logic, we need to provide witnesses for each name, and the Barcan formula can make sure we can always find one when building a successor of some maximal consistent set with enough witnesses. On the other hand, we can build an increasing domain pseudo model without such a formula using the techniques in [12]. Inspired by the techniques in [3], to obtain a constant domain model, when building the successors in the increasing domain pseudo model, we only create a new witness if all the old ones are not available, and we make sure by formulas in the maximal consistent sets that the new one is not equal to any old ones (throughout the whole model). In this way, there will not be any conflicts between the witnesses when we collect all of them together. We may then create a constant domain by considering the equivalence classes of all the witnesses occurring in the pseudo model with an increasing domain.

Here is the general proof strategy:

  • Extend the language with countably many new variables.

  • Build a pseudo canonical frame using maximal consistent sets for various sublanguages of the extended language, with witnesses for the names.

  • Given a maximal consistent set, cut out its generated subframe from the pseudo frame, and build a constant-domain canonical model, by taking certain equivalence classes of variables as the domain.

  • Show that the truth lemma holds for the canonical model.

  • Take the reflexive symmetric transitive closure of the relations in pseudo model and show that the truth of the formulas in the original language are preserved.

  • Extend each consistent set of the original model to a maximal consistent set with witnesses.

We first extend the language with countably infinitely many new variables, and call the new language with the variable set . We say a language is an infinitely proper sublanguage of another language if:

  • and only differ in their sets of variables,

  • ,

  • there are infinitely many new variables in that are not in .

We use maximal consistent sets w.r.t. different infinitely proper sublanguages of that are extensions of to build a pseudo canonical frame.

[Pseudo canonical frame] The pseudo canonical frame is defined as follows:

  • is the set of MCS w.r.t. some infinitely proper sublanguages of such that for each :

    • ,

    • For each there is a variable in (notation: such that (call it -property)

  • For each , iff the following three conditions hold:

    1. in , the set of variables in .

    2. .

    3. if then for all such that .


The last condition for makes sure that every new variable in the successor is distinguished from any other variables by inequalities. It is also easy to see that if then there is such that by -property and .

If in , then:

  • is a sublanguage of

  • for any : iff .

For the first: For all , therefore by RIGIDP, thus .

For the second:

  • Suppose

    • If , then by RIGIDP, thus

    • If then since is an -MCS and . Then by RIGIDN, thus .

  • Suppose w.o.l.g. thus .

    • If or then then iff trivially holds.

    • If and then due to the third condition of . Therefore since is consistent. Thus iff

The second part of the above proposition makes sure that we do not have conflicting equalities in different states which are accessible from one to another.

[Existence lemma] If and then there is a and an such that , , and . If then there is for some , due to the fact that has the -property. Let . We first show that is consistent by and (routine). Next we show that it can be extended to a state in . We can select an infinitely proper sublanguage of such that is an infinitely proper sublanguage of . We can list the new variables in but not in by . We also list the names in N as . In the following, we add the witness to the names by building as follows:

We can show that is always consistent. Note that is consistent, we just need to show if is consistent and do not hold, then is consistent too. Suppose for contradiction that is not consistent then there are fomulas , and such that:

First note that since is not in , is consistent, for otherwise there are such that , then by , we have thus by EFAS we have , contradicting to the consistency of (by DETAS). By , is consistent with one of for some in . Thus is also consistent which contradicts the assumption that condition (2) and (1) do not hold.

Then we define to be the union of all . Clearly, has the -property. We build the language based on . Note that is still an infinitely proper sublanguage of .

Finally, we extend into an MCS w.r.t.  and it is not hard to show by verifying the third condition: when we introduce a new variable we always make sure it is differentiated with the previous one in the construction of .

Given a state in , we can define an equivalence relation : iff or (note that is not in if ). Due to , is indeed an equivalence relation. When is fixed, we write for the equivalence class of w.r.t. . By definition, for all , is a singleton.

Now we are ready to build the canonical model.

[Canonical model] Given a in we define the canonical model based on the psuedo canonical frame

  • is the subset of generated from w.r.t. the relations .

  • where is the set of all the variables appearing in .

  • iff , for any .

  • iff .

Here is a handy observation. If then for all such that . Due to the condition 3 of the relation in and Proposition 4, and the fact that is generated from .

The canonical model is well-defined.

  • For : We show that the choice of the representative in does not change the definition. Suppose then either or . In the first case, iff . In the second case, suppose . We show that the three conditions for hold. For condition 1, since and is generated from by . For condition 2, we just need to note that by SUBK. And condition 3 is given directly by condition 3 for .

  • For : We first show that the choice of the representative in does not change the definition by (). Then we need to show that is unique. Note that due to the -property, there is always some such that in . Suppose towards contradiction that , and then clearly cannot be both in for otherwise . Suppose w.l.o.g.  is not in then we should have due to Proposition 4, contradicting the assumption that is consistent.

is transitive. Suppose and then in and (note that the representative of does not really matter since is well-defined). We have to show the three conditions for . For condition 1, since . For condition 2, by Axiom , we have for any such that we have thus thus , by the definition of . For condition 3, suppose . Then since , , so by Proposition 4 we are done.

Before proving the truth lemma, we have two simple observations: .

  • If is in some then .

  • If then or in all the .

For the first, suppose is in some . We just need to consider the case when for if then by definition. By Proposition 4, and must be both in , thus by RIGIDN and the fact that is connected to , .

The second is immediate by the definition of : if then due to RIGIDP and the fact that all the are connected to .

Although is transitive, the model is not reflexive nor symmetric in general. For the failure of reflexivity, note that some may not be in the language of some state. For the failure of symmetry: We may have and thus it is not the case that by Proposition 4. We will turn this model into an S5 model later on. Before that we first prove a (conditional) truth lemma w.r.t.  and the canonical assignment such that for all . [Truth lemma] For any and any , if then:

We do induction on the structure of the formulas.

For the case of by -property we have some such that .

  • Suppose . Since , by , . Now by Proposition 4, . Thus , then

  • If then . If and are variables , then i.e., . By Proposition 4, either or . Actually, even if , since is in , by . If and are both in N, then by the definition of , there are and in and , which means . By Proposition 4 and again, therefore . Finally, w.l.o.g. if and , then by definition of , for some and . Again, since , therefore .

For the case of .

  • If , then by -property, there are in such that . Then by SUBP we have . Thus by the definition of , . By the definitions of and , . Therefore .

  • If , then the vector