### 12.3.1

### The correctness statement

We might have asked for the following correctness property: Theorem 12.3.1 (Incorrect correctness statement)

If Γ ⊢ t : τ and ρ1⊕ dρ= ρ2then (⟦ t ⟧ ρ1) ⊕ (_{⟦ D ⟦ t ⟧ ⟧ dρ) = (⟦ t ⟧ ρ2}). _{□}
However, this property is not quite right. We can only prove correctness if we restrict the
statement to input changes dρ that are valid. Moreover, to prove this statement by induction we
need to strengthen its conclusion: we require that the output change ⟦ D ⟦ t ⟧ ⟧ dρ is also valid. To

92 Chapter 12. Changes and differentiation, formally see why, consider term (λx → s) t: Here the output of t is an input of s. Similarly, in D ⟦ (λx → s) t ⟧, the output of D ⟦ t ⟧ becomes an input change for subterm D ⟦ t ⟧, and D ⟦ s ⟧ behaves correctly only if only if D ⟦ t ⟧ produces a valid change.

Typically, change types contain values that invalid in some sense, but incremental programs will preserve validity. In particular, valid changes between functions are in turn functions that take valid input changes to valid output changes. This is why we formalize validity as a logical relation.

### 12.3.2

### Invalid input changes

To see concretely why invalid changes, in general, can cause derivatives to produce incorrect results, consider again grandTotal = λxs ys → sum (merge xs ys) from Sec. 10.2. Suppose a bag change dxsremoves an element 20 from input bag xs, while dys makes no changes to ys: in this case, the output should decrease, so dz = dgrandTotal xs dxs ys dys should be −20. However, that is only correct if 20 is actually an element of xs. Otherwise, xs ⊕ dxs will make no change to xs, hence the correct output change dz would be 0 instead of −20. Similar but trickier issues apply with function changes; see also Sec. 15.2.

### 12.3.3

### Alternative environment changes

Environment changes can also be defined differently. We will use this alternative definition later (in Appendix D.2.2).

A change dρ from ρ1to ρ2contains a copy of ρ1. Thanks to this copy, we can use an environ-
ment change as environment for the result of differentiation, that is, we can evaluate D ⟦ t ⟧ with
environment dρ, and Definition 12.2.1 can define ⟦ t ⟧∆_{as λρ1}

dρ →⟦ D ⟦ t ⟧ ⟧ dρ. But we could adapt definitions to omit the copy of ρ1from dρ, by setting

∆ (Γ, x: τ ) = ∆Γ, dx : ∆τ

and adapting other definitions. Evaluating D ⟦ t ⟧ still requires base inputs; we could then set ⟦ t ⟧∆_{=}
λρ1 dρ → ⟦ D ⟦ t ⟧ ⟧ (ρ1, dρ), where ρ1, dρsimply merges the two environments appropriately
(we omit a formal definition). This is the approach taken by Cai et al. [2014]. When proving
Theorem 12.2.2, using one or the other definition for environment changes makes little difference;
if we embed the base environment in environment changes, we reduce noise because we need not
define environment meging formally.

Later (in Appendix D.2.2) we will deal with environment explicitly, and manipulate them in programs. Then we will use this alternative definition for environment changes, since it will be convenient to store base environments separately from environment changes.

### 12.3.4

### Capture avoidance

Differentiation generates new names, so a correct implementation must prevent accidental capture. Till now we have ignored this problem.

Using de Bruijn indexes Our mechanization has no capture issues because it uses de Bruijn indexes. Change context just alternate variables for base inputs and input changes. A context such as Γ = x : Z, y : Bool is encoded as Γ = Z, Bool; its change context is ∆Γ = Z, ∆Z, Bool, ∆Bool. This solution is correct and robust, and is the one we rely on.

Alternatively, we can mechanize ILC using separate syntax for change terms dt that use separate namespaces for base variables and change variables.

Chapter 12. Changes and differentiation, formally 93 ds, dt::= dc

| λ(x: σ) (dx : ∆σ) → dt | ds t dt

| dx

In that case, change variables live in a separate namespace. Example context Γ = Z, Bool gives rise to a different sort of change context, ∆Γ = ∆Z, ∆Bool. And a change term in context Γ is evaluted with separate environments for Γ and ∆Γ. This is appealing, because it allows defining differentiation and proving it correct without using weakening and applying its proof of soundness. We still need to use weakening to convert change terms to their equivalents in the base language, but proving that conversion correct is more straightforward.

Using names Next, we discuss issues in implementing this transformation with names rather than de Bruijn indexes. Using names rather than de Bruijn indexes makes terms more readable; this is also why in this thesis we use names in our on-paper formalization.

Unlike the rest of this chapter, we keep this discussion informal, also because we have not mechanized any definitions using names (as it may be possible using nominal logic), nor attempted formal proofs. The rest of the thesis does not depend on this material, so readers might want to skip to next section.

Using names introduces the risk of capture, as it is common for name-generating transfor- mations [Erdweg et al., 2014]. For instance, differentiating term t = λx → f dx gives D ⟦ t ⟧ = λx dx → df dx ddx. Here, variable dx represents a base input and is free in t, yet it is incorrectly captured in D ⟦ t ⟧ by the other variable dx, the one representing x’s change. Differentiation gives instead a correct result if we α-rename x in t to any other name (more on that in a moment).

A few workarounds and fixes are possible.

• As a workaround, we can forbid names starting with the letter d for variables in base terms, as we do in our examples; that’s formally correct but pretty unsatisfactory and inelegant. With this approach, our term t = λx → f dx is simply forbidden.

• As a better workaround, instead of prefixing variable names with d, we can add change variables as a separate construct to the syntax of variables and forbid differentiation on terms that containing change variables. This is a variant of the earlier approach using separate change terms. While we used this approach in our prototype implementation in Scala [Cai et al., 2014], it makes our output language annoyingly non-standard. Converting to a standard language using names (not de Bruijn indexes) raises again capture issues.

• We can try to α-rename existing bound variables, as in the implementation of capture-
avoiding substitution. As mentioned, in our case, we can rename bound variable x to y and
get t′_{= λy → f dx. Differentiation gives the correct result D ⟦ t}′

⟧ = λy dy → df dx ddx. In general we can define D ⟦ λx → t ⟧ = λy dy → D ⟦ t [x := y] ⟧ where neither y nor dy appears free in t; that is, we search for a fresh variable y (which, being fresh, does not appear anywhere else) such that also dy does not appear free in t.

This solution is however subtle: it reuses ideas from capture-avoiding substitution, which is well-known to be subtle. We have not attempted to formally prove such a solution correct (or even test it) and have no plan to do so.

• Finally and most easily we can α-rename new bound variables, the ones used to refer to changes, or rather, only pick them fresh. But if we pick, say, fresh variable dx1to refer to the change of variable x, we must use dx1consistently for every occurrence of x, so that

94 Chapter 12. Changes and differentiation, formally D ⟦ λx → x ⟧ is not λdx1→ dx2. Hence, we extend D ⟦ – ⟧ to also take a map from names to names as follows:

D ⟦ λ(x : σ ) → t, m ⟧ = λ(x : σ ) (dx : ∆σ ) → D ⟦ t, (m [x → dx ]) ⟧ D ⟦ s t, m ⟧ = D ⟦ s, m ⟧ t D ⟦ t, m ⟧

D ⟦ x, m ⟧ = m(x) D ⟦ c, m ⟧ = DC⟦ c ⟧

where m(x) represents lookup of x in map m, dx is now a fresh variable that does not appear in t, and m [x → dx ] extend m with a new mapping from x to dx.

But this approach, that is using a map from base variables to change variables, affects the interface of differentiation. In particular, it affects which variables are free in output terms, hence we must also update the definition of ∆Γ and derived typing rule Derive. With this ap- proach, if term s is closed then D ⟦ s, emptyMap ⟧ gives a result α-equivalent to the old D ⟦ s ⟧, as long as s triggers no capture issues. But if instead s is open, invoking D ⟦ s, emptyMap ⟧ is not meaningful: we must pass an initial map m containing mappings from s’s free variables to fresh variables for their changes. These change variables appear free in D ⟦ s, m ⟧, hence we must update typing rule Derive, and modify ∆Γ to use m.

We define ∆mΓby adding m as a parameter to ∆Γ, and use it in a modified rule Derive’: ∆mε= ε

∆m(Γ, x : τ ) = ∆mΓ, x : τ,m(x) : ∆τ . Γ ⊢ t: τ

∆mΓ ⊢ D ⟦ t, m ⟧ : ∆τ Derive’

We conjecture that Derive’ holds and that D ⟦ t, m ⟧ is correct, but we have attempted no formal proof.