A Semantic Account of Metric Preservation

Program sensitivity measures how robust a program’s outputs are to changes in its input. This is a useful measure in fields like differential privacy and cyber-physical systems, in order to guarantee that small input changes have a limited effect on the program behavior. A natural way to formalize program sensitivity is in terms of metrics on the input and output spaces, requiring that an r-sensitive function maps inputs that are at distance d to outputs that are at most at distance r ⋅ d. Program sensitivity is thus an analog of Lipschitz continuity for programs. Reed and Pierce introduced Fuzz, a functional language with a linear type system that can express program sensitivity. They show soundness operationally, in the form of a metric preservation property. Inspired by their work, we study program sensitivity and metric preservation from a denotational point of view. In particular, we introduce metric CPOs, a novel semantic structure for reasoning about computation on metric spaces, endowing CPOs with a compatible notion of distance. This structure is useful for reasoning about metric properties of programs, and specifically about program sensitivity. We demonstrate metric CPOs by giving a model for the deterministic fragment of Fuzz.