Formal Verification of Trust in Multi-Agent Systems Under Generalized Possibility Theory

Abstract

In multi-agent systems, the interactions between autonomous agents within dynamic and uncertain environments are crucial for achieving their objectives. Current research leverages model checking techniques to verify these interactions, with social accessibility relations commonly used to formalize agent interactions. In multi-agent systems that incorporate generalized possibility measures, the quantification, computation, and model checking of trust properties present significant challenges. This paper introduces an indirect model checking algorithm designed to transform social trust under uncertainty into quantifiable properties for verification. A Generalized Possibilistic Trust Interpreted System (GPTIS) is proposed to model and characterize multi-agent systems with trust-related uncertainties. Subsequently, the trust operators are extended based on Generalized Possibilistic Computation Tree Logic (GPoCTL) to develop the Generalized Possibilistic Trust Computation Tree Logic (GPTCTL), which is employed to express the trust properties of the system. Then, a model checking algorithm that maps trust accessibility relations to trust actions is introduced, thereby transforming the model checking of GPTCTL on GPTIS into model checking of GPoCTL on Generalized Possibility Kripke Structures (GPKSs). The proposed algorithm is provided with a correctness proof and complexity analysis, followed by an example demonstrating its practical feasibility.

1. Introduction

Multi-agent Systems (MASs) are composed of multiple autonomous agents characterized by reactivity, proactivity, social capability, and rationality. These agents interact within dynamic and uncertain environments to achieve their respective objectives [1,2,3,4]. With the continuous advancement of artificial intelligence (AI) and computing technologies, MASs have emerged as powerful tools for addressing complex problems and are widely applied across domains such as automation, decision support, and resource allocation [5,6]. In MASs, trust is a fundamental element for enabling effective collaboration among agents. By reasoning about trust, it becomes possible to evaluate whether interactions among agents adhere to predefined expectations, thereby improving the overall reliability and security of the system. Verifying the properties of MASs is critical in ensuring effective communication and cooperation among agents, as well as maintaining the safe and stable operation of the system. This remains a significant challenge in AI research.

Model checking is an automated formal verification technique used to determine whether a system satisfies specific properties. It has been extensively adopted for safety verification in MASs [7,8]. Since the development of model checking, both academia and industry have continuously worked to expand its applicability to more complex systems. Traditional model checking approaches reply on temporal logic, particularly Computation Tree Logic (CTL) and Linear Temporal Logic (LTL), to specify system properties. However, temporal logic alone is insufficient to express trust-related attributes within MASs. To accurately describe communication behaviors among agents and meet the verification demands of MASs, trust operators have been integrated into temporal logic, thereby broadening the applicability of model checking techniques.

In the context of communication and collaboration within MASs, the inherent uncertainty of trust and the dynamic nature of agent interactions generate substantial imprecision and fuzzy information. This poses significant challenges for traditional model checking techniques, which lack the capability to quantitatively analyze such communicative behaviors. Classical and probabilistic model checking methods are limited in their ability to accurately represent fuzzy relationships [9]. For example, consider a scenario where an agent has never observed any interaction with another agent. A probabilistic model, due to normalization constraints, must assign probabilities that sum to one—often leading to the assignment of low probability to malicious behavior and high probability to trustworthy behavior by default (e.g., via uniform priors or Laplace smoothing). This conflates lack of evidence with positive evidence, treating “unknown” as “likely safe.” In contrast, generalized possibility theory allows the possibility of both trustworthy and untrustworthy behaviors to remain non-zero, reflecting genuine epistemic uncertainty. The non-additive nature of possibility measures—where the possibility of a disjunction is the maximum of individual possibilities—enables a more cautious and semantically faithful representation of trust under sparse or qualitative evidence. Generalized possibility measures, due to their intrinsic linguistic vagueness and non-additivity, offer a promising framework for capturing these fuzzy properties. In response, Li Yongming et al. [10] proposed the Generalized Possibilistic Computation Tree Logic (GPoCTL) as a model checking approach. They further introduced the Generalized Possibilistic Markov Decision Process (GPMDP) model, which transforms the model checking into fuzzy matrix operations or fixed-point computations solvable in polynomial time [11]. Currently, research in generalized possibility theory primarily focuses on the analysis of individual agents interacting with the environment, with relatively limited investigation into multi-agent scenarios. In MAS communication, trust is characterized by a high degree of uncertainty. Compared with classical and probabilistic methods, fuzzy model checking is better suited to handle the possibilistic values of agent attributes, particularly in the analysis of fuzzy communicative behaviors. Additionally, the fuzzy model checking approaches are preliminarily investigated for MASs based on fuzzy temporal logic incorporating cognition and commitment operators [12,13,14].

1.1. Related Work

In multi-agent systems (MASs), the definition and modeling of trust is a central research topic. The most widely accepted definition of trust was proposed by Castelfranchi and Falcone, often referred to as C&F [15]. In [16], the authors proposed a logical framework for the formal analysis of trust and reputation. They formalized the definition of trust proposed by C&F using a logic that incorporates temporal, action-based, belief, and choice operators. They also introduced a reputation definition that mirrors trust but shifts the belief concept to the collective level. Additionally, they distinguished between two primary types of trust: occurrent trust and dispositional trust. In [17], Herzig simplified the logic in [16] by restricting the truth values of propositional variables to either true or false in the action logic, providing a simple yet expressive framework and proving its completeness.

Research on trust in multi-agent systems can be categorized into two main approaches. The first approach enables agents to measure the trustworthiness of other agents during interactions, with higher-trust agents being prioritized in repeated interactions [18,19,20]. The second approach, which is adopted in this paper, involves using trust models to reason about the honesty or reliability of agents, establishing trust relationships, and proposing formal semantic frameworks for reasoning. Several trust semantic frameworks have already been proposed and are widely applied [21,22,23,24,25]. For example, in [21], Liu and Lorini proposed a DL-BET logic for reasoning about the interplay among belief, evidence, and trust, and they provided an axiomatic system for the logic. In [22], a modal logic was developed for reasoning about the trust an agent places in another based on reputation. This work refined trust values as interactions between agents evolve, allowing the system to assess an agent’s trustworthiness. Furthermore, agents can exchange testimonies regarding the trustworthiness of third-party agents, even without direct interactions. In [23], Nagat Drawel et al. proposed a Trust Computation Tree Logic (TCTL), extending Computation Tree Logic (CTL) to model trust and proposing an algorithm to capture trust-based actions. In [24], a Trust Reputation System and a Trust Reputation Interaction Model were proposed to enhance the system’s resistance against malicious agents. In contrast, [25] presented a formal framework that extends the scope of trust reasoning from individual interactions to group–individual interactions. They introduced a branching-time (BT) logic that incorporates operators to express concepts such as collective trust, distributed trust, and propagated trust.

Table 1. Comparison between publications and evaluation criteria.

Approach	C1	C2	C3	C4	C5	C6	C7	C8
Castelfranchi-Falcone [15]	✓	✓	✓	-	✓	-	-	-
Logic of Trust and Reputation [16,17]	✓	✓	✓	-	✓	✓	✓	-
Norm-Based Trust [19]	-	✓	✓	-	✓	-	-	-
Trust-Hedonic Game [20]	-	✓	✓	✓	✓	-	-	-
Belief-Evidence-Trust Logic [21]	✓	-	-	-	✓	✓	-	-
Normal Modal Logic for Trust in Sincerity [22]	-	✓	✓	-	-	-	✓	-
Trust-Based Multi-Agent Systems [23]	-	✓	✓	✓	✓	✓	-	-
Our Work	-	✓	✓	✓	✓	✓	✓	✓

presents a comparison of relevant publications against key evaluation criteria, illustrating how our approach relates to and differs from prior work.

In this study, we evaluate and compare existing trust system modeling approaches using eight criteria, denoted as C1 through C8. These criteria are as follows: whether the approach is founded on BDI logic to describe the mental states of agents, reflecting the cognitive dimension; whether it accounts for interactions and social relationships among multiple agents, capturing the social dimension; whether it employs a dedicated modality to explicitly model trust rather than using predicates, thereby demonstrating an explicit conceptualization of trust; whether it includes a rigorous analysis of computational complexity; whether it supports fine-grained expressions of trust levels, indicating its capability for graded modality handling; whether it incorporates formal verification techniques such as model checking to ensure correctness; whether it establishes the soundness and completeness of the logical framework, validating its theoretical foundation; and whether it integrates fuzzy logic to model uncertainty and subjectivity. These criteria collectively provide a comprehensive evaluation of the theoretical foundations, practical applicability, and verification capabilities of different trust modeling methods.

1.2. Main Contributions

Both classical and probabilistic model checking techniques face limitations when trying accurately represent certain fuzzy relationships. Generalized possibility measures, due to their inherent language fuzziness and the non-additivity of possibility measures, are well-suited for effectively capturing these fuzzy relationships. This approach fills the gap in generalized possibility model checking for trust-based multi-agent systems. As illustrated in Figure 1, the proposed approach defines a GPTIS based on vector-based interpreted systems and introduces GPTCTL. An indirect model checking algorithm that transforms the model checking of GPTCTL into a model checking of GPoCTL is employed. First, the GPTIS model is converted into a Generalized Possibilistic Decision Process (GPDP) model. Given that each state in the GPDP model can have multiple actions, a scheduler is introduced to select a unique action at each state, transforming the GPDP model into a GPKS model, which is used to solve the maximal possibility. Then, the GPTCTL formulas are converted into their GPoCTL equivalents. Finally, the corresponding algorithm along with its complexity analysis is presented, and its application is demonstrated using an example from a shopping system.

1.3. Structure of This Paper

The remainder of this article is organized as follows. Section 2 introduces the concepts of fuzzy theory. Section 3 introduces the related theories of IS (Interpreted System) and VIS (Vector-based Interpreted System) and defines a Generalized Possibility Trust Interpretation System. Section 4 defines Generalized Possibility Trust Computation Tree Logic (GPTCTL). Section 5 presents a Generalized Possibility Model Checking algorithm. Section 6 provides a complexity analysis of the algorithm. Section 7 discusses the limitations and practical scalability of the proposed framework, analyzing the impact of trust graph structure on computational complexity and proposing practical strategies—such as trust pruning, aggregation, and symbolic representation—to address challenges in large-scale systems. An illustrative example using an online shopping system is given in Section 8. Section 9 concludes this article with a summary the findings and suggests directions for future research.

2. Preliminaries

This section provides the concepts of fuzzy theory.

Definition 1

([10,11]). A fuzzy set A over a universe of discourse X is defined as a mapping $A:X\to [0,1]$, also referred to as the membership function of the fuzzy set A, and is commonly denoted by ${\mu }_A$. For any element $x\in X$, the value ${\mu }_A(x)$ represents the degree of membership of x in fuzzy set A. Let $F(X)$ denote the class of all fuzzy sets on X; that is $F(X)=\{A|A:X\to [0,1]\}$.

Definition 2

([10,11]). Let $A,B\in F(X)$. For any $x\in X$, the membership functions of the fuzzy sets $A\cup B$ and $A\cap B$ are defined as follows:

$$(A\cup B)(x)=A(x)\vee B(x)=max\{A(x),B(x)\}$$

$$(A\cap B)(x)=A(x)\wedge B(x)=min\{A(x),B(x)\}$$

In these definitions, ∨ (equivalently, max) denotes the maximum operation, and ∧ (equivalently, min) denotes the minimum operation.

Definition 3

([10]). Let $X={(x_{ij})}_{m\times n}$ and $Y={(y_{ij})}_{m\times n}$ be two fuzzy matrices of size $m\times n$. The intersection, union, and complement of X and Y are defined as follows: $X\cap Y={(x_{ij}\wedge y_{ij})}_{m\times n}$, $X\cup Y={(x_{ij}\vee y_{ij})}_{m\times n}$, $X^c={(1-x_{ij})}_{m\times n}$

Here, the operators ∧ and ∨ denote the minimum and maximum operations, respectively.

Definition 4

([10]). Let $X={(x_{ij})}_{m\times l}$ be an $m\times n$ fuzzy matrix and $Y={(y_{ij})}_{l\times n}$ be an $l\times n$ fuzzy matrix. The inner product of fuzzy matrices X and Y, denoted as $X\circ Y$, is defined as:

$$X\circ Y={(z_{ij})}_{m\times n}$$

where $z_{ij}=\underset{k=1}{\overset{n}{\vee }}(x_{ik}\wedge y_{kj})(i=1,\dots ,m;j=1,\dots ,n)$.

Definition 5

([10]). Let U denote a nonempty universe of discourse, with all subsets assumed to be measurable. A possibility measure ∏ is defined as a function from the powerset $2^U$ to the interval $[0,1]$, satisfying the following conditions:

(1) 

$\mathrm{\Pi }(\mathsf{\varnothing })=0$;

(2) 

$\mathrm{\Pi }(U)=1$;

(3) 

$\mathrm{\Pi }({\cup }_{i\in I}{E}_i)={\vee }_{i\in I}\mathrm{\Pi }(E_i)$ for any subset family $\left\{E_i\right\}$ of the universe set U.

Here, we use ${\vee }_{i\in I}{a}_i$ to denote the supremum (or least upper bound) of the family of real numbers ${\{a_i\}}_{i\in I}$. Dually, we use ${\wedge }_{i\in I}{a}_i$ to denote the infimum (or greatest lower bound) of the real family ${\{a_i\}}_{i\in I}$.

If ∏ only satisfies Conditions (1) and (3), then ∏ is called a generalized possibility measure.

3. Generalized Possibilistic Trust Interpreted System

This study introduces a Generalized Possibility Trust Interpreted System based on vector-based interpreted systems in order to better characterize the trust accessibility relations inside the system due to the presence of fuzzy behaviors among agents. The definition is as follows:

Definition 6

([26]). An Interpreted System (IS) is a tuple consisting of n agents, denoted as $IS=({(L_i,ac{t}_i,{\rho }_i,{\tau }_i)}_{i\in Agt},S,I,Act,\tau )$, where:

1. 

For each agent $i\in Agt$, the following components are defined:

(1) 

A non-empty set of local states $L_i$, where $l_i\in L_i$ represents the local state of the agent i at a given time;

(2) 

A set of local actions $ac{t}_i$, representing the possible actions agent i can take;

(3) 

A local protocol ${\rho }_i:L_i\to 2^{ac{t}_i}$ mapping each local state to the set of enabled actions for agent i in that state;

(4) 

A local evolution function ${\tau }_i=L_i\times ac{t}_i\to L_i$ determining how the local state of agent i evolves based on its current state and action;

We also define the following global components:

2. 

A set of global states $S\subseteq L_1\times L_2\times \dots \times L_n$, where a global state $s=(l_1,l_2,\dots ,l_n)$ represents a snapshot of the local states of all agents. The local state of agent i in global state s is denoted as $l_i(s)$;

3. 

$I\subseteq S$ is a set of initial global states, representing the possible starting configurations of the system;

4. 

$Act=ac{t}_1\times \dots \times ac{t}_n$ is a set of joint actions performed by all agents in the system, and $\sigma =({\sigma }_1,{\sigma }_2,{\sigma }_3,\dots {\sigma }_n)\in Act$;

5. 

A global evolution function $\tau :S\times Act\to S$, defined as $\tau (s,\sigma )=({\tau }_1(l_1,{\sigma }_1),{\tau }_2(l_2,{\sigma }_2)$$,\dots ,{\tau }_n(l_n,{\sigma }_n))$, where $s=(l_1,l_2,\dots ,l_n)$, $\sigma =({\sigma }_1,{\sigma }_2,\dots ,{\sigma }_n)$.

Definition 7

([23]). To explicitly represent the trust relationship between the truster and trustee, we extend the interpreted system by defining a Vector-based Interpreted System (VIS) as a 5-tuple: $VIS=({(L_i,ac{t}_i,v_i,{\rho }_i,{\tau }_i)}_{i\in Agt},S,I,Act,\tau )$. For each agent $i\in Agt$ and each of its local states $l_i\in L_i$, the following trust-related component is added:

(1) 

A trust vector $v_i$ of size $|Agt|$ is associated with $l_i$, defined as $v_i(i),v_i(j),\dots ,v_i(n)$, where $v_i(j)\in [0,1]$ represents the degree of trust agent i has in agent j in that state. $l_i(s)(v_i(j))$ represents the degree of trust that agent i has in agent j at state s;

(2) 

The trust vector $v_i$ defines agent i’s trust accessibility relation, determining how much agent i “believes” or “responds to” the behavior of other agents.

All other components $(L_i,ac{t}_i,{\rho }_i,{\tau }_i,S,I,Act,\tau )$ follow the same structure and semantics as in the standard interpreted system defined in Definition 6.

Definition 8.

A Generalized Possibilistic Trust Interpreted System (GPTIS) is an 8-tuple $M=(S,Act,P,I,L,AP,v_i,\sim i\to j)$ consisting of n agents, where the definitions of S, $Act$, I, and $v_i$ are the same as before, defined in VIS (see Definition 7). The main distinction between VIS and GPTIS lies in the fact that in GPTIS, there are four new tuples, P, L, $AP$, and $\sim i\to j$. The definition is given as follows:

1. 

$P:S\times Act\times S\to [0,1]$ is the possibility of transition distribution. For any state $s\in S$ and action $\alpha \in Act$, there exists a state $t\in S$ such that $P(s,\alpha ,t)>0$;

2. 

$L:Agt\times S\times AP\to [0,1]$ is a fuzzy labeling function, where $L{(i,s,p)}_{i\in Agt,s\in S,p\in AP}$ represents the possibilistic truth value of atomic proposition p in local state $l_i(s)$;

3. 

$AP$ is the set of atomic propositions for all agents, where ${\left\{A{P}_i\right\}}_{i\in Agt}$ is the set of atomic propositions for agent i;

4. 

$\sim i\to j:S\times S\to [0,1]$ is the trust accessibility relation, as shown in Figure 2. The following conditions must be satisfied:

(1) 

$l_i(s)(v_i(j))=l_i(s^{\prime })(v_i(j))$;

(2) 

s can reach $s^{\prime }$ through the transition distribution;

Example 1.

Figure 2 illustrates the dashed line representing the possibility value of 0.7 for the trust accessibility relation from agent i to agent j in the transition from global state s to global state $s^{\prime }$. Here, $l_i(s)(v^i(j))=l_i(s^{\prime })(v^i(j))$ denotes that within the GPTIS of these two states, the vector $v^i(j)$ has the same value, thus enabling the trust accessibility relation from i to j.

If $|S|$, $|AP|$, $|Agt|$ are finite, then M is called a finite GPTIS. For a GPTIS $M=(S,P,I,L,AP,v_i,\sim i\to j)$, a finite path starting from state $s_0$ in M is denoted by the sequence $\widehat{\pi }=s_0{\sigma }_0{s}_1{\sigma }_1{s}_2\dots s_{n-1}{\sigma }_{n-1}{s}_n$. An infinite path starting from state $s_0$ in M is denoted by the sequence $\pi =s_0{\sigma }_0{s}_1{\sigma }_1\dots \in {(S\times Act)}^w$. The set of all infinite paths starting from global state s in M is denoted by $Paths(s)$. The set of all finite paths starting from the global state s in M is denoted by $Path{s}_{fin}(s)$. The set of all infinite paths in M is denoted by $Paths(M)$. The set of all finite paths in M is denoted by $Path{s}_{fin}(M)$.

Figure 2. An example of trust accessibility relation $\sim i\to j(s,s^{\prime })=0.7.$

Figure 2. An example of trust accessibility relation $\sim i\to j(s,s^{\prime })=0.7.$

Definition 9

([10]). Let $M=(S,Act,P,I,L,AP,v_i,\sim i\to j)$ be a finite set GPTIS. Then, $GPo:Paths(M)\to [0,1]$ is defined as follows:

$$GPo(\pi )=I(s_0)\wedge \underset{i\ge 0}{\wedge }P(s_i,{\sigma }_i,s_{i+1})$$

For $\pi =s_0{\sigma }_0{s}_1{\sigma }_1\dots \in Path{s}_{Adv}(M)$ and $E\subseteq Paths(M)$, we can define $GPo(E)=\vee \{GPo(\pi )|\pi \in E\}$, which leads to the function

$$GPo:2^{P\mathrm{a}ths(M)}\to [0,1]$$

This function is called the generalized possibility measure on $K=2^{P\mathrm{a}ths(M)}$.

4. Generalized Possibilistic Computation Tree Logic

This section extends the trust operators based on GPoCTL and introduces GPTCTL. Below, we provide the syntax of GPTCTL and its semantics in the context of GPTIS.

Definition 10

(GPTCTL Syntax). The state formulas of GPTCTL are recursively defined as follows:

$$\mathrm{\Phi }::=\mathrm{true}|a|{\mathrm{\Phi }}_1\wedge {\mathrm{\Phi }}_2|\neg \mathrm{\Phi }|GPo(\phi )|T_P(i,j,{\mathrm{\Phi }}_1,{\mathrm{\Phi }}_2)|T_c(i,j,{\mathrm{\Phi }}_1,{\mathrm{\Phi }}_2)$$

The path formulas of GPTCTL are recursively defined as follows:

$$\phi ::=◯\mathrm{\Phi }|{\mathrm{\Phi }}_1\cup {\mathrm{\Phi }}_2$$

where Φ, ${\mathrm{\Phi }}_1$ and ${\mathrm{\Phi }}_2$ represents a state formula, φ represents a path formula.

$T_p(i,j,{\mathrm{\Phi }}_1,{\mathrm{\Phi }}_2)$ is a premise trust formula, representing the degree of possibility that agent i trusts agent j to achieve ${\mathrm{\Phi }}_2$, given that ${\mathrm{\Phi }}_1$ holds.

$T_c(i,j,{\mathrm{\Phi }}_1,{\mathrm{\Phi }}_2)$ is a conditional trust formula, representing the degree of possibility that agent i trusts agent j to achieve ${\mathrm{\Phi }}_2$ when ${\mathrm{\Phi }}_1$ holds.

Example 2.

Figure 3 presents an intuitive illustration of the premise trust formula and the conditional trust formula. In the premise trust formula $T_p(i,j,{\mathrm{\Phi }}_1,{\mathrm{\Phi }}_2)$, the current state $s_0$ must satisfy proposition ${\mathrm{\Phi }}_1$ and not satisfy ${\mathrm{\Phi }}_2$, while ${\mathrm{\Phi }}_2$ must hold in the next state that is reachable via the trust accessibility relation. In the conditional trust formula $T_c(i,j,{\mathrm{\Phi }}_2,{\mathrm{\Phi }}_3)$, the current state $s_1$ must not satisfy ${\mathrm{\Phi }}_3$, and in the next state $s_2$, which is accessible through the trust accessibility relation, both ${\mathrm{\Phi }}_2$ and ${\mathrm{\Phi }}_3$ must be satisfied.

Definition 11

(GPTCTL Semantics). Let $M=(S,Act,P,I,L,AP,v_i,\sim i\to j)$ be a finite GPTIS and $\Vert \mathrm{\Phi }\Vert :S\to [0,1]$ be a function. The semantics of a GPTCTL state formula Φ are recursively defined as follows, where $s\in S$, $a\in AP$, $i,j\in Agt$:

$$\Vert true\Vert (s)=1,$$

(1)

$$\Vert a\Vert (s)=L(i,s,a),$$

(2)

$$\Vert {\mathrm{\Phi }}_1\wedge {\mathrm{\Phi }}_2\Vert (s)=\Vert {\mathrm{\Phi }}_1\Vert (s)\wedge \Vert {\mathrm{\Phi }}_2\Vert (s),$$

(3)

$$\Vert \neg \mathrm{\Phi }\Vert (s)=1-\Vert \mathrm{\Phi }\Vert (s),$$

(4)

$$\Vert GPo(\phi )\Vert (s)=GPo(s\vDash \phi ),$$

(5)

$$\begin{array}{cc}\hfill \Vert T_p(i,j,{\mathrm{\Phi }}_1,{\mathrm{\Phi }}_2)\Vert (s)=& \Vert {\mathrm{\Phi }}_1\wedge \neg {\mathrm{\Phi }}_2\Vert (s)\wedge \underset{\left\{\pi \in Paths(s)|s{\sim }_{i\to j}{s}^{\prime }\right\}}{\bigvee }({\sim }_{i\to j}(s,s^{\prime })\hfill \\ \hfill & \wedge \Vert {\mathrm{\Phi }}_2\Vert (s^{\prime })\wedge GPo(\pi )),\hfill \end{array}$$

(6)

$$\begin{array}{cc}\hfill \Vert T_c(i,j,{\mathrm{\Phi }}_1,{\mathrm{\Phi }}_2)\Vert (s)=& \Vert \neg {\mathrm{\Phi }}_2\Vert (s)\wedge \underset{\left\{\pi \in Paths(s)\mid s{\sim }_{i\to j}{s}^{\prime }\right\}}{\bigvee }(\sim i\to j(s,s^{\prime })\hfill \\ \hfill & \wedge \Vert {\mathrm{\Phi }}_1\wedge {\mathrm{\Phi }}_2\Vert (s^{\prime })\wedge GPo(\pi ))\hfill \end{array}$$

(7)

For any path $\pi =s_0{\sigma }_0{s}_1{\sigma }_1{s}_2\dots \in Paths(M)$, the semantics of a path formula φ in M are recursively defined as follows, where $\Vert \phi \Vert :Paths(M)\to [0,1]$ represents the path formula:

$$\Vert ◯\mathrm{\Phi }\Vert (\pi )=P(\pi \left[0\right],{\sigma }_0,\pi \left[1\right])\wedge \Vert \mathrm{\Phi }\Vert (\pi \left[1\right])$$

(8)

$$\begin{array}{cc}\hfill \Vert {\mathrm{\Phi }}_1\cup {\mathrm{\Phi }}_2\Vert (\pi )=& \Vert {\mathrm{\Phi }}_2\Vert (\pi \left[0\right])\vee \underset{j\ge 1}{\bigvee }(\Vert {\mathrm{\Phi }}_1\Vert (\pi \left[0\right])\wedge \underset{k<j}{\bigwedge }\left(P(\pi [k-1],{\sigma }_{k-1},\pi \left[k\right])\right)\hfill \\ \hfill & \wedge \Vert {\mathrm{\Phi }}_1\Vert (\pi \left[k\right])\wedge P(\pi [j-1],{\sigma }_{j-1},\pi \left[j\right])\wedge \Vert {\mathrm{\Phi }}_2\Vert (\pi \left[j\right]))\hfill \end{array}$$

(9)

$GPo(s|=\phi )$ represents the set of all paths starting from state s that satisfies the path formula φ. It is defined as follows:

$$GPo(s\vDash \phi )=\underset{\pi \in Paths(s)}{\bigvee }\left(GPo(\pi )\wedge \Vert \phi \Vert (\pi )\right)$$

(10)

5. Model Checking GPTIS Based on GPTCTL

Given a GPTIS M and a GPTCTL state formula $\mathrm{\Phi }$, the GPTCTL model checking problem for GPTIS is to compute the possibility of $\Vert \mathrm{\Phi }\Vert (s)$. Inspired by the model checking methods proposed in [13,14], this section adopts an indirect model checking approach consisting of two main components: model transformation and formula simplification. Through transformation and simplification, the problem is reduced to a GPoCTL model checking problem based on GPKS.

Definition 12

([10]). A Generalized Possibilistic Kripke Structure is a tuple $M_k=(S_k,P_k,I_k,$$A{P}_k,L_k)$, where

(1) 

$S_k$ is a countable, nonempty set of states;

(2) 

$P_k:S_k\times S_k\to [0,1]$ is the transition possibility distribution such that for all states $s\in S_k$, there exists $t\in S_k$ satisfying $P_k(s,t)>0$;

(3) 

$I_k:S_k\to [0,1]$ is the initial distribution, such that $I_k(s)>0$ for some states $s\in S_k$;

(4) 

$A{P}_k$ is a set of atomic propositions;

(5) 

$L_k:S_k\times A{P}_k\to [0,1]$ is a labeling function, $L_k(s,a)$ denotes the possibility of an atomic proposition a that is supposed to hold in s.

Definition 13

([11]). A GPDP (Generalized Possibilistic Decision Process) is a tuple $M_d=(S_d,Ac{t}_d,P_d,I_d,A{P}_d,L_d)$, where

(1) 

$S_d$ is a countable, nonempty set of states;

(2) 

$Ac{t}_d$ is a set of actions;

(3) 

$P_d:S_d\times Ac{t}_d\times S_d\to [0,1]$ is the possibilistic action transition function, such that for all states $s\in S_d$ and all actions $\alpha \in Ac{t}_d$, there exists $t\in S_d$ satisfying $P_d(s,\alpha ,t)>0$;

(4) 

$I_d:S_d\to [0,1]$ is the possibilistic initial distribution function, such that $I_d(s)>0$ for some states $s\in S_d$;

(5) 

$A{P}_d$ is a set of atomic propositions;

(6) 

$L_d:S_d\times A{P}_d\to [0,1]$ is a labeling function, $L_d(s,a)$ denotes the possibility of an atomic proposition a that is supposed to hold in s.

Definition 14

([11]). Let $M_d=(S_d,Ac{t}_d,P_d,I_d,A{P}_d,L_d)$ be a finite GPDP. A function $Adv:S_d\to Ac{t}_d$ is defined as a scheduler of $M_d$, such that for any state $s\in S_d$, there exists $Adv(s)\in Ac{t}_d(s)$, where $Ac{t}_d(s)$ denotes the set of all enabled actions at state s.

For all $i>0$, if ${\alpha }_i=Adv(s_0{s}_1\dots s_{i-1})$, then the path $\pi =s_0{\alpha }_1{s}_1{\alpha }_2{s}_2{\alpha }_3{s}_3\dots$ is called an $Adv$ path of $M_d$. We use $Path{s}_{Adv}(s)$ to denote the set of all paths starting from state s under the control of scheduler $Adv$.

Definition 15

([10]). Let $M_d=(S_d,Ac{t}_d,P_d,I_d,A{P}_d,L_d)$ be a finite set GPDP, $r_{Adv}:S_d\to [0,1]$ as $r_{Adv}(s)=\vee \{\underset{i\ge 0}{\wedge }{P}_{Adv}(s_i,{\sigma }_i,s_{i+1})|s_0=s,s_i\in S,{\sigma }_i\in Act\}$. It is a computation method is denoted as

$$r_{Adv}(s)=\underset{t\in S_d}{\vee }(P_{Adv}^{+}(s,t)\wedge P_{Adv}^{+}(t,t))$$

The form of computation using fuzzy matrices is

$$r_{Adv}=P_{Adv}^{+}\circ D_{Adv},$$

where $D_{Adv}={(P_{Adv}^{+}(t,t))}_{t\in S}$. The proof of the computation method is given in [10].

5.1. Model Transformation

In the model transformation, Algorithm 1 is first utilized to convert the GPTIS model into a GPDP model. The GPDP is used to describe the fuzzy and uncertain behaviors of the system, and each state has at least one enabled action. The transformation process mainly includes two aspects:

(1)

Transformation between trust accessibility relations and action sets: The trust accessibility relations in the GPTIS are transformed into corresponding action sets in the GPDP.

(2)

Transformation of different actions into different possibility transition distributions: The different actions in the GPTIS are mapped to different possibility transition distributions in the GPDP. During the transformation process, the states, the set of initial global states, the atomic propositions, and the labeling function remain unchanged.

Algorithm 1 GPTIS is converted to GPDP

Require: GPTIS $M=(S,Act,P,I,L,AP,v_i,\sim i\to j)$ Ensure: GPDP $M_d=(S_d,Ac{t}_d,P_d,I_d,A{P}_d,L_d)$  1: $S_d:=S;$  2: $I_d:=I;$  3: $A{P}_d:=AP;$  4: $L_d:=L;$  5: Action $Ac{t}_d$ is defined as $Ac{t}_d=\{\sigma ,\delta \}$:  6: (1)Set $\sigma =\left\{{\sigma }_1,{\sigma }_2,{\sigma }_3,\dots {\sigma }_n\right\}$: Represents the set of joint actions performed by a group of agents.  7: (2)Set $\delta =\left\{{\delta }^{11},{\delta }^{12},\dots ,{\delta }^{ij},\dots ,{\delta }^{nn}(n\le |Agt|)\right\}$: Represents the trust accessibility relations labeled as trust actions. Specifically, ${\delta }^{ij}$ denotes that agent i performs a trust action towards agent j.  8: The fuzzy transition function $P_d$ combines the temporal transition function and the transition function based on trust accessibility relations: For states $s,s^{\prime }\in S,\theta \in Ac{t}_d$.  9: if $\theta \in \sigma$ then 10:    $P_d(s,\theta ,s^{\prime }):=P(s,\sigma ,s^{\prime })$ 11: else 12:    $P_d(s,\theta ,s^{\prime }):=\sim i\to j$ 13: end if

To address the uncertainty in actions within the GPDP, Algorithm 2 introduces a scheduling function to transform the GPDP into a deterministic GPKS model. This transformation allows for the resolution of the maximum possibility problem. The scheduling function is defined as follows:

Let $M_d=(S_d,Ac{t}_d,P_d,I_d,A{P}_d,L_d)$ be a finite GPDP. Define the function $Adv:S_d\to Ac{t}_d$ as the scheduling of $M_d$. For any global state $s\in S_d$, there exists $Adv(s)\in Ac{t}_d(s)$. We define $Adv$ as two different scheduling functions, where $Ad{v}_t$ is used to interpret temporal formulas and $Ad{v}_{\delta }$ is used to interpret trust formulas.

(1)

$Ad{v}_{\sigma }:S_d\to \sigma$, For any state $s\in S_d$, given a scheduling function $Ad{v}_{\sigma }$, the action $\sigma$ is selected at the state S denoted as $Ad{v}_{\sigma }(s)=\sigma$. The fuzzy transition matrix is defined as $P_{Ad{v}_{\sigma }}$, such that

$$P_{Ad{v}_{\sigma }}(s,t)=P{(s,Ad{v}_{\sigma }(s),t)}_{s,t\in S_d}$$

(2)

$Ad{v}_{\delta }:S_d\to \delta$, For any state $s\in S_d$, given a scheduling function $Ad{v}_{\delta }$, the action $\delta$ is selected at state S, denoted as $Ad{v}_{\delta }(s)=\delta$. The fuzzy transition matrix is defined as $P_{Ad{v}_{\delta }}$, such that

$$P_{Ad{v}_{\delta }}(s,t)=P{(s,Ad{v}_{\delta }(s),t)}_{s,t\in S_d}$$

Based on the selection of different actions by the scheduling function, we obtain a deterministic GPKS model.

Algorithm 2 GPDP is converted to GPKS

Require: GPDP $M_d=(S_d,Ac{t}_d,P_d,I_d,A{P}_d,L_d)$ Ensure: GPKS $M_k=(S_k,P_k,I_k,A{P}_k,L_k)$  1: $S_k:=S_d;$  2: $I_k:=I_d;$  3: $A{P}_k:=A{P}_d;$  4: $L_k:=L_d;$  5: The possibility transition distribution $P_k$ is defined as $P_k=\{P_{Ad{v}_{\sigma }},P_{Ad{v}_{\delta }}\}$:  6: if $Adv=Ad{v}_{\sigma }$ then  7:    $P_{Ad{v}_{\sigma }}(s,t)=P{(s,Ad{v}_{\sigma }(s),t)}_{s,t\in S_d}$;  8: else  9:     $P_{Ad{v}_{\delta }}(s,t)=P{(s,Ad{v}_{\delta }(s),t)}_{s,t\in S_d}$; 10: end if

Any GPKS can be viewed as a GPDP with only one available action (either the maximum likelihood action or the minimum likelihood action) per state. Therefore, GPKS is a special case of GPDP. Consequently, the semantic interpretation of GPoCTL remains consistent across both models. Figure 4 presents an illustrative example of the stepwise model transformation, starting from GPTIS, proceeding through GPDP, and finally reaching GPKS.

5.2. GPTCTL to GPoCTL Formula Reduction

To simplify the formula using Algorithm 3, it is necessary to ensure that the simplified formula retains the same semantics as the original formula, i.e., $\Vert {\mathrm{\Phi }}_{GPTIS}\Vert (M,s)=\Vert {\mathrm{\Phi }}_{GPKS}\Vert (M_k,s)$. The syntax definition of GPoCTL logic is given in [10].

Algorithm 3 GPTCTL Formula Simplification Algorithm

Require: GPTCTL state formula ${(\mathrm{\Phi })}_{GPTCTL}$ Ensure: GPoCTL state formula ${(\mathrm{\Phi })}_{GPoCTL}$  1: Case ${(\mathrm{\Phi })}_{GPTCTLC}$  2: p return p  3: $\neg \mathrm{\Phi }$ return $\neg \mathrm{\Phi }$  4: ${\mathrm{\Phi }}_1\wedge {\mathrm{\Phi }}_2$ return ${\mathrm{\Phi }}_1\wedge {\mathrm{\Phi }}_2$  5: $GPo(\psi )$ return ${(GPo(\psi ))}_{Ad{v}_{\sigma }}$  6: $T_p(i,j,{\mathrm{\Phi }}_1,{\mathrm{\Phi }}_2)$ return ${(({\mathrm{\Phi }}_1\wedge \neg {\mathrm{\Phi }}_2)\wedge GPo(◯{\mathrm{\Phi }}_2))}_{Ad{v}_{\delta }}$  7: $T_c(i,j,{\mathrm{\Phi }}_1,{\mathrm{\Phi }}_2)$ return ${\left(\neg {\mathrm{\Phi }}_2\wedge GPo(◯({\mathrm{\Phi }}_1\wedge {\mathrm{\Phi }}_2))\right)}_{Ad{v}_{\delta }}$  8: End case

Given a scheduling function $Ad{v}_t$ and a state formula $\mathrm{\Phi },{\mathrm{\Phi }}_1,{\mathrm{\Phi }}_2$, let the transition function be $\xi :\mathrm{\Phi }\to {\mathrm{\Phi }}_{GPKS}$. The GPTCTL temporal formulas are converted to GPoCTL formulas as follows:

$$\xi (a)=a$$

(11)

$$\xi (\neg \mathrm{\Phi })=\neg \mathrm{\Phi }$$

(12)

$$\xi ({\mathrm{\Phi }}_1\wedge {\mathrm{\Phi }}_2)={\mathrm{\Phi }}_1\wedge {\mathrm{\Phi }}_2$$

(13)

$$\xi (GPo(\phi ))={(GPo(\phi ))}_{Ad{v}_{\sigma }}$$

(14)

When given the scheduling function $Ad{v}_t$, it only captures the temporal transitions in each state of the model. Since GPTCTL is an extension of GPoCTL with trust operators, Formulas (11)–(14) do not require further simplification.

Theorem 1.

Given a scheduling function ${\mathit{Adv}}_{\delta }$ and a transition function $\zeta :\mathrm{\Phi }\to {\mathrm{\Phi }}_{GPKS}$, the GPTCTL trust formulas are converted into quantitatively computable temporal formulas as follows:

$$\zeta (T_p(i,j,{\phi }_1,{\phi }_2))={(({\mathrm{\Phi }}_1\wedge \neg {\mathrm{\Phi }}_2)\wedge GPo(◯{\mathrm{\Phi }}_2))}_{Ad{v}_{\delta }}$$

(15)

$$\zeta (T_c(i,j,{\phi }_1,{\phi }_2))={\left(\neg {\mathrm{\Phi }}_2\wedge GPo(◯({\mathrm{\Phi }}_1\wedge {\mathrm{\Phi }}_2))\right)}_{Ad{v}_{\delta }}$$

(16)

When the scheduling function is ${\mathit{Adv}}_{\delta }$, the GPKS model will only select the probability transition distribution labeled as action ${\delta }^{ij}$. According to the intuitive interpretation of trust, for two states connected by the trust accessibility relation, the current state must satisfy trust content ${\mathrm{\Phi }}_1$, and the subsequent next state must satisfy trust content ${\mathrm{\Phi }}_2$. This explains why the trust formula is translated into the next operator.

Proof. 

Let $M_d=(S_d,Ac{t}_d,P_d,I_d,A{P}_d,L_d)$ be a finite GPDP, and let $D_{\mathrm{\Phi }}$ be the fuzzy diagonal matrix of state formula $\mathrm{\Phi }$ for $|S|\times |S|$. For any $s,t\in S_d$:

$$D_{\mathrm{\Phi }}(s,t)=\left\{\begin{array}{c}\Vert \mathrm{\Phi }\Vert (s)\\ 0\end{array}\right.\begin{array}{c}s=t\\ otherwise\end{array}$$

$P_{\mathrm{\Phi }}$ is denoted as a fuzzy matrix of $|S|\times 1$. E is denoted as an identity matrix of $|S|\times 1$, where all elements are equal to 1.

Define $r_{Adv}:S_d\to [0,1]$ as $r_{Adv}(s)=\vee \{\underset{i\ge 0}{\wedge }{P}_{Adv}(s_i,{\sigma }_i,s_{i+1})|s_0=s,s_i\in S,{\sigma }_i\in Act\}$. The proof of the computation method is given in [9].

In GPoCTL syntax and semantics, the formula $\Vert {\mathrm{\Phi }}_1\wedge GPo(◯{\mathrm{\Phi }}_2)\Vert (s)$ denotes that, starting from state s, under the scheduler $Adv$, there exists a path $\pi$ such that the state formula ${\mathrm{\Phi }}_1$ is satisfied in state s, and the next state satisfies the state formula ${\mathrm{\Phi }}_2$.

$$\begin{array}{c}\Vert {\mathrm{\Phi }}_1\wedge GPo(◯{\mathrm{\Phi }}_2)\Vert {(s)}_{s\in S}\hfill \\ =\Vert {\mathrm{\Phi }}_1\Vert (s)\wedge \underset{\left\{\pi \in Paths(s)\right\}}{\vee }(\Vert ◯{\mathrm{\Phi }}_2\Vert (\pi )\wedge GPo(\pi ))\hfill \\ =\Vert {\mathrm{\Phi }}_1\Vert (s)\wedge \underset{s,s_i\in S}{\vee }(P(s,\sigma ,s_i)\wedge \Vert {\mathrm{\Phi }}_2\Vert (s_i)\wedge \underset{i\ge 0}{\wedge }P(s_i,\sigma ,s_{i+1}))\hfill \\ =\Vert {\mathrm{\Phi }}_1\Vert (s)\wedge \underset{s,s_i\in S}{\vee }(P_{Ad{v}_{\sigma }}(s,s_i)\wedge \Vert {\mathrm{\Phi }}_2\Vert (s_i)\wedge \underset{i\ge 0}{\wedge }{P}_{Ad{v}_{\sigma }}(s_i,s_{i+1}))\hfill \\ =\Vert {\mathrm{\Phi }}_1\Vert (s)\wedge \underset{s,s_i\in S}{\vee }(P_{Ad{v}_{\sigma }}(s,s_i)\wedge \Vert {\mathrm{\Phi }}_2\Vert (s_i)\wedge r_{Ad{v}_{\sigma }}(s_i))\hfill \\ =\left((D_{{\mathrm{\Phi }}_1}\circ E)\cap (P_{Ad{v}_{\sigma }}\circ D_{{\mathrm{\Phi }}_2}\circ r_{Ad{v}_{\sigma }})\right)(s)\hfill \end{array}$$

In the syntax and semantics of GPTCTL, the trust formula $\Vert T_p(i,j,{\mathrm{\Phi }}_1,{\mathrm{\Phi }}_2)\Vert {(s)}_{s\in S}$ denotes that, in state s, given that ${\mathrm{\Phi }}_1$ holds, agent i trusts agent j to bring about the satisfaction of ${\mathrm{\Phi }}_2$, and the value is computed as follows:

$$\begin{array}{c}\Vert T_p(i,j,{\mathrm{\Phi }}_1,{\mathrm{\Phi }}_2)\Vert {(s)}_{s\in S}\hfill \\ =\Vert {\mathrm{\Phi }}_1\wedge \neg {\mathrm{\Phi }}_2\Vert (s)\wedge \underset{\left\{\pi \in Paths(s)|s{\sim }_{i\to j}{s}_i\right\}}{\vee }(\sim i\to j(s,s_i)\wedge \Vert {\mathrm{\Phi }}_2\Vert (s_i)\wedge GPo(\pi ))\hfill \\ =\Vert {\mathrm{\Phi }}_1\wedge \neg {\mathrm{\Phi }}_2\Vert (s)\wedge \underset{s,s_i\in Sand\delta \in Ac{t}_d}{\vee }(P(s,\delta ,s_i)\wedge \Vert {\mathrm{\Phi }}_2\Vert (s_i)\wedge \underset{i\ge 0}{\wedge }P(s_i,\delta ,s_{i+1}))\hfill \\ =\Vert {\mathrm{\Phi }}_1\wedge \neg {\mathrm{\Phi }}_2\Vert (s)\wedge \underset{s,s_i\in S}{\vee }(P_{Ad{v}_{\delta }}(s,s_i)\wedge \Vert {\mathrm{\Phi }}_2\Vert (s_i)\wedge \underset{i\ge 0}{\wedge }{P}_{Ad{v}_{\delta }}(s_i,s_{i+1}))\hfill \\ =\Vert {\mathrm{\Phi }}_1\wedge \neg {\mathrm{\Phi }}_2\Vert (s)\wedge \underset{s,s_i\in S}{\vee }(P_{Ad{v}_{\delta }}(s,s_i)\wedge \Vert {\mathrm{\Phi }}_2\Vert (s_i)\wedge r_{Ad{v}_{\delta }}(s_i))\hfill \\ =\left((D_{{\mathrm{\Phi }}_1\wedge \neg {\mathrm{\Phi }}_2}\circ E)\cap (P_{Ad{v}_{\delta }}\circ D_{{\mathrm{\Phi }}_2}\circ r_{Ad{v}_{\delta }})\right)(s)\hfill \\ =\Vert ({\mathrm{\Phi }}_1\wedge \neg {\mathrm{\Phi }}_2)\wedge GPo(◯{\mathrm{\Phi }}_2)\Vert {(s)}_{s\in S}\hfill \end{array}$$

In the syntax and semantics of GPTCTL, the trust formula $\Vert T_c(i,j,{\mathrm{\Phi }}_1,{\mathrm{\Phi }}_2)\Vert {(s)}_{s\in S}$ denotes that, in state s, when ${\mathrm{\Phi }}_1$ holds, agent i trusts agent j to bring about the satisfaction of ${\mathrm{\Phi }}_2$, and the value is computed as follows:

$$\begin{array}{c}\Vert T_c(i,j,{\mathrm{\Phi }}_1,{\mathrm{\Phi }}_2)\Vert {(s)}_{s\in S}\hfill \\ =\Vert \neg {\mathrm{\Phi }}_2\Vert (s)\wedge \underset{\left\{\pi \in Paths(s)|s{\sim }_{i\to j}{s}_i\right\}}{\vee }(\sim i\to j(s,s_i)\wedge \Vert {\mathrm{\Phi }}_1\wedge {\mathrm{\Phi }}_2\Vert (s_i)\wedge GPo(\pi ))\hfill \\ =\Vert \neg {\mathrm{\Phi }}_2\Vert (s)\wedge \underset{s,s_i\in Sand\delta \in Ac{t}_d}{\vee }(P(s,\delta ,s_i)\wedge \Vert {\mathrm{\Phi }}_1\wedge {\mathrm{\Phi }}_2\Vert (s_i)\wedge \underset{i\ge 0}{\wedge }P(s_i,\delta ,s_{i+1}))\hfill \\ =\Vert \neg {\mathrm{\Phi }}_2\Vert (s)\wedge \underset{s,s_i\in S}{\vee }(P_{Ad{v}_{\delta }}(s,s_i)\wedge \Vert {\mathrm{\Phi }}_1\wedge {\mathrm{\Phi }}_2\Vert (s_i)\wedge \underset{i\ge 0}{\wedge }{P}_{Ad{v}_{\delta }}(s_i,s_{i+1}))\hfill \\ =\Vert \neg {\mathrm{\Phi }}_2\Vert (s)\wedge \underset{s,s_i\in S}{\vee }(P_{Ad{v}_{\delta }}(s,s_i)\wedge \Vert {\mathrm{\Phi }}_1\wedge {\mathrm{\Phi }}_2\Vert (s_i)\wedge r_{Ad{v}_{\delta }}(s_i))\hfill \\ =\left((D_{\neg {\mathrm{\Phi }}_2}\circ E)\cap (P_{Ad{v}_{\delta }}\circ D_{{\mathrm{\Phi }}_1\wedge {\mathrm{\Phi }}_2}\circ r_{Ad{v}_{\delta }})\right)(s)\hfill \\ =\Vert \neg {\mathrm{\Phi }}_2\wedge GPo(◯({\mathrm{\Phi }}_1\wedge {\mathrm{\Phi }}_2))\Vert {(s)}_{s\in S}\hfill \end{array}$$

Therefore, the trust formula can be transformed into the following equivalent matrix expression:

$$\Vert T_p(i,j,{\mathrm{\Phi }}_1,{\mathrm{\Phi }}_2)\Vert {(s)}_{s\in S}=\Vert ({\mathrm{\Phi }}_1\wedge \neg {\mathrm{\Phi }}_2)\wedge GPo(◯{\mathrm{\Phi }}_2)\Vert {(s)}_{s\in S}$$

$$\Vert T_c(i,j,{\mathrm{\Phi }}_1,{\mathrm{\Phi }}_2)\Vert {(s)}_{s\in S}=\Vert \neg {\mathrm{\Phi }}_2\wedge GPo(◯({\mathrm{\Phi }}_1\wedge {\mathrm{\Phi }}_2))\Vert {(s)}_{s\in S}$$

This proves the validity of Equations (15) and (16).    □

Model transformation is performed using Algorithms 1 and 2, while formula simplification is conducted using Algorithm 3 to convert the model checking algorithm of GPTCTL into that of GPoCTL. The  $GPoCTLCheck({\mathrm{M}}_k,\mathrm{s},\mathrm{\Phi })$ is provided in Reference [10]. The model checking algorithm for GPTCTL based on the GPTIS model is illustrated in Algorithm 4.

Algorithm 4 GPTCTL model checking algorithm: $GPTCTLCheck{(M,s,\mathrm{\Phi })}_{s\in S}$

Require: GPTIS M,s,GPTCTL state formula $\mathrm{\Phi }$ Ensure: the truth value of $\Vert \mathrm{\Phi }\Vert (s)$  1: Procedure $\mathrm{GPTCTLCheck}(M,s,\mathrm{\Phi })$  2: Step 1: Call algorithm 1 Convert the GPTIS model to the GPDP model  3: Step 2: Call algorithm 2 Convert the GPDP model to the GPKS model  4: Step 3: Call algorithm 3 Convert the GPTCTL formulas into GPoCTL formulas.  5: Step 4: Call $GPoCTLCheck({\mathrm{M}}_k,\mathrm{s},{\mathrm{\Phi }}_{GPoCTL})$  6: Return the truth value of $\Vert \mathrm{\Phi }\Vert (s)$

6. Complexity Analysis

This paper adopts an indirect generalized possibility model checking algorithm to verify properties in the GPTIS. The computational steps of the algorithm include:

(1)

Convert the GPTIS model into a GPDP model, then transform the GPDP model into a GPKS model. The time complexity of this transformation process is calculated;

(2)

Convert the GPTCTL formulas into GPoCTL formulas. The time complexity of this conversion is also calculated;

(3)

Calculate the time complexity of the GPoCTL model checking process.

Lemma 1.

The time complexity of the model transformation is positively correlated with the size M of the input model, i.e., $O(M)$

Proof. 

To prove this, we use a Deterministic Turing Machine (DTM) to sequentially read all states in the input GPTIS model, along with their temporal transition relations and trust accessibility relations. The DTM then converts the trust accessibility relations into trust actions. Finally, the transformed states and actions are written on the output tape. The time complexity of the transformation process is positively correlated with the size of the input model. □

Lemma 2.

The time complexity of converting GPTCTL formulas to GPoCTL formulas is linear with respect to the size φ of the input formula, i.e., $\mathrm{O}(|\mathrm{\Phi }|)$.

Proof. 

The conversion steps from GPTCTL formulas to GPoCTL formulas are as follows:

(1)

Input GPTCTL formula Φ.

(2)

Expand the formula Φ into n layers (i.e., n subformulas) until a state formula with trust operators is encountered. This step is performed in linear time proportional to the size of the formula, i.e., $\mathrm{O}(|\mathrm{\Phi }|)$.

(3)

Simplify the state formula with trust operators according to the reduction rules specified in Algorithm 3. The time complexity of this step is constant, i.e., $\mathrm{O}(1)$.

(4)

Replace the state formula with the trust operator with the transformed GPoCTL state formula.

(5)

Repeat the above steps until the formula no longer contains any state formulas with trust operators. In summary, each subformula needs to go through Steps (2) to (4). Therefore, the process requires n iterations, where n is the number of subformulas. Since the number of subformulas is linearly related to the size of the formula, the overall time complexity of the conversion process is linear.

□

Lemma 3.

The time complexity of the GPTCTL fuzzy model checking algorithm based on the GPTIS model is $\mathrm{O}(size\left(M\right)·poly(S)·|\mathrm{\Phi }|)$.

Proof. 

According to [10], the time complexity of GPoCTL model checking is $\mathrm{O}(size\left(M\right)·poly(S)·|\mathrm{\Phi }|)$. By combining Lemmas 1 and 2, the overall time complexity of the proposed algorithm is $◯(size(M)·poly(S)·|\mathrm{\Phi }|)+◯(|\eta |)+◯(|\mathrm{\Phi }|)$. Since the size of the Generalized Possibilistic Trust-Interpreted System (GPTIS) model and the formulas is linearly related to the size of the transformed models and formulas, the total time complexity of the algorithm is $\mathrm{O}(size\left(M\right)·poly(S)·|\mathrm{\Phi }|)$. □

7. Limitations and Practical Scalability

While our framework provides a sound formal basis for possibilistic trust verification, its practical scalability depends critically on the structure of the trust graph. Specifically, the construction of the GPDP model introduces a distinct trust action ${\delta }_{ij}$ for each directed trust relation $(i,j)$ in the GPTIS. For a system with N agents, the number of potential trust relations is $O(N^2)$ in the worst case (i.e., a complete trust graph). This leads to quadratic growth in the action space, which in turn affects the size of the transition relation in the GPKS model and increases the computational burden of model checking.

This limitation implies that the current approach is most suitable for:

• Sparse trust networks, where each agent maintains trust relationships with only a small, bounded number of peers (e.g., d-regular graphs with constant d);
• Bounded-neighborhood verification, where properties are localized (e.g., “agent i trusts someone within 2 hops”), allowing the model to be restricted to a subgraph;
• Offline or moderate-scale deployment, such as in consortium blockchains, smart grids, or team-based robotics, where N is typically tens to hundreds.

To mitigate scalability challenges in larger systems, several practical strategies can be employed:

• Trust pruning: Remove trust edges below a possibility threshold or older than a time window;
• Aggregation: Group agents into roles or clusters and reason about inter-group trust;
• Symbolic representation: Encode trust relations using BDDs or first-order structures to avoid explicit enumeration.

We emphasize that optimizing for large-scale dense MASs is beyond the scope of this foundational work, which prioritizes semantic expressiveness and formal correctness. Nonetheless, we view scalability as a critical direction for future research.

8. Illustrative Examples

Since there is currently no benchmark logic that supports the joint modeling of fuzziness and trust, and because the generalized possibilistic semantics adopted by GPTCTL fundamentally differ from both the Boolean semantics of classical logic and the probabilistic semantics of probabilistic logic, numerical results across these frameworks are not directly comparable. This case study employs a multi-agent interaction scenario to verify the feasibility of the reasoning process of the proposed logic and to examine whether its theoretical computations fall within the range of outcomes observed in simulation experiments, thereby demonstrating the theoretical viability of GPTCTL.

It should be emphasized that the correctness of the proposed approach has been rigorously established through the formal derivations and complexity analysis presented in Section 5 and Section 6. The simulation experiments in this section are not intended to replace formal verification; rather, they aim to demonstrate the reasonableness of the computed results and the semantic interpretability of the method in representative application scenarios.

8.1. Multi-Agent Shopping Interaction Model

This section adopts a case study similar to the online shopping system presented in [13] to illustrate the application of the GPTCTL model checking method. Below are the specific steps for constructing the model.

In the online shopping system, there are three key roles: merchants $i_1$ and $i_2$, and a customer j.

• Global state: $S=\{S_0,S_1,S_2,S_3\}$, where $S_0$ represents the initial state of the system.
• Atomic proposition sets for agents $i_1,i_2,j$:

  (1)

  For agents $i_1,i_2$, the set of atomic propositions is defined as $A{P}_{i_1}=\{A_1,B_1\}$, $A{P}_{i_2}=\{A_2,B_2\}$. Among them, atomic proposition A represents that the merchant is idle, and atomic proposition B represents that the merchant has shipped the order;

  (2)

  For agent j, the set of atomic propositions is defined as $A{P}_j=\{C,D,F\}$, where C represents that the customer gives positive feedback, D represents that the order is delivered quickly, and F represents that the customer has made the payment;

  In the global states, the atomic propositions have fuzzy values. For example, $A_1=0.7$ represents that the possibility of merchant $i_1$ being idle in state $s_0$ is 0.7.
• Joint actions between global states are denoted by $\sigma$;
• There exists a possibility of transition distribution between each pair of global states, represented by solid arrows in the diagram;
• Trust accessibility relations: Trust accessibility relations are represented by dashed arrows with arrowheads in the diagram. For example, to represent the trust accessibility relation between agents in states $S_0$ and $S_1$, we denote it as $S_0\stackrel{<0.8,0.6,0.9,0.8>}{..................>}{S}_1$. Additionally, $<0.8,0.6,0.9,0.8>$ represents the possibility values of the trust accessibility relations between Agent $i_1$ and Agent $i_2$ with respect to Agent j, as well as from Agent j to Agents $i_1$ and $i_2$, denoted as $<\sim i_1\to j(s_0,s_1)=0.8,\sim i_2\to j(s_0,s_1)=0.6,\sim j\to i_1(s_0,s_1)=0.9,\sim j\to i_2(s_0,s_1)=0.8>$. Here, null indicates that there is no trust accessibility relation between the agents;
• For vector $v_i$, it is assumed by default that the trust accessibility relations correspond to the same level of trust between each pair of agents. This is not explicitly shown in the diagram, i.e., $l_i(s_0)(v^i(j))=l_i(s_1)(v^i(j))$, and is detailed in Definition 8.

Converting the GPTIS model in Figure 5 to the GPDP model in Figure 6. The conversion, ${\delta }^{i_{1}j},{\delta }^{i_{2}j},{\delta }^{j{i}_1},{\delta }^{j{i}_2}$ represents the trust actions between merchant $i_1,i_2$ and customer j. $S_0\stackrel{{\delta }^{j{i}_1}0.9}{\to }{S}_1$ denotes that there is a trust action from customer j to merchant $i_1$ between global state $S_0$ and global state $S_1$, with a possibility of 0.9.

Trust formulas generated in action ${\delta }^{j{i}_1}$ are as follows:

• $\Vert T_p(j,i_1,F,B_1)\Vert (S_0)=0.7$ represents that in state $S_0$, the possibility of merchant $i_1$ shipping the order, given that customer j trusts merchant $i_1$ and the customer has made the payment, is 0.7.
• $\Vert T_p(j,i_1,F,D)\Vert (S_0)=0.3$ represents that in state $S_0$, the possibility of a fast order delivery, given that customer j trusts merchant $i_1$ and the customer has made the payment, is 0.3.
• $\Vert T_c(j,i_1,\neg F,F\wedge B_1)\Vert (S_0)=0.1$ represents that in state $S_0$, the possibility of the customer making the payment at the time of shipment, given that customer j trusts merchant $i_1$ and the customer has not yet made the payment, is 0.1.
• $\Vert T_c(j,i_1,\neg F,F\wedge D)\Vert (S_0)=0.1$ represents that in state $S_0$, the possibility of a fast order delivery, given that customer j trusts merchant $i_1$ and the customer has not yet made the payment, is 0.1 (Similarly for action ${\delta }^{j{i}_2}$).

The trust formulas generated in action ${\delta }^{i_{1}j}$ are as follows,

• $\Vert T_p(i_1,j,D,C)\Vert (S_1)=0.4$ represents that in state $S_1$, the possibility of the customer giving positive feedback, given that merchant $i_1$ trusts customer j and the order is delivered quickly, is 0.4.
• $\Vert T_p(i_1,j,B_1,F)\Vert (S_1)=0.1$ represents that in state $S_1$, the possibility of the customer making the payment after the merchant has shipped the order, given that merchant $i_1$ trusts customer j, is 0.1.
• $\Vert T_c(i_1,j,\neg B_1,B_1\wedge F)\Vert (S_1)=0.3$ represents that in state $S_1$, the possibility of the merchant shipping the order when the customer makes the payment, given that merchant $i_1$ trusts customer j and the merchant has not yet shipped the order, is 0.3.
• $\Vert T_c(i_1,j,\neg B_1,B_1\wedge C)\Vert (S_1)=0.3$ represents that in state $S_1$, the possibility of the customer giving positive feedback, given that merchant $i_1$ trusts customer j and the merchant has not yet shipped the order, is 0.3 (Similarly for action ${\delta }^{i_{2}j}$).

Converting the GPDP model in Figure 6 to the GPKS model. By considering only the trust actions, two GPKS models $M_k=(S_k,P_{k_{max}},I_k,A{P}_k,L_k)$ and $M_k=(S_k,P_{k_{min}},I_k,A{P}_k,L_k)$ can be obtained.

Their fuzzy matrices are shown in the following figure:

$$\begin{array}{c}I=\left[\begin{array}{c}1\\ 0\\ 0\\ 0\end{array}\right] P_{{\delta }_{max}}=\left[\begin{array}{cccc}0.8& 0.9& 0.7& 0.9\\ 0.9& 0.8& 0.8& 0.9\\ 0.9& 0.9& 0.8& 0.9\\ 0.9& 0.9& 0.8& 0.9\end{array}\right] P_{{\delta }_{min}}=\left[\begin{array}{cccc}0.7& 0.6& 0.6& 0.5\\ 0.7& 0.6& 0.5& 0.5\\ 0.5& 0.5& 0.6& 0.6\\ 0.4& 0.4& 0.6& 0.7\end{array}\right]\end{array}$$

(1)

$\Vert T_p(j,i_1,F,B_1){\Vert }_{max}(S_0)=0.6$ and $\Vert T_p(j,i_2,F,B_1){\Vert }_{min}(S_0)=0.6$ are represented as, in state $S_0$, the maximum possibility of the merchant shipping the order, given that customer j trusts the merchant and the customer has made the payment, which is 0.6, and the minimum possibility is also 0.6.

(2)

$\Vert T_c(i_2,j,\neg B_2,B_2\wedge F){\Vert }_{max}(S_3)=0.3$ and $\Vert T_c(i_1,j,\neg B_1,B_1\wedge F){\Vert }_{min}(S_3)=0.2$ are represented as, in state $S_3$, the maximum possibility of the merchant shipping the order when the customer makes the payment, given that the merchant trusts customer j and the merchant has not yet shipped the order, which is 0.3, and the minimum possibility is 0.2.

The specific meanings of the formulas are consistent with the explanations provided above and will not be reiterated here.

8.2. Simulation Modeling Using NetLogo

This study develops and implements a multi-agent trust interaction simulation system based on the NetLogo platform to model the dynamic interactions between a customer and two distinct sellers. In each simulation round, the customer randomly selects one of the sellers and randomly adopts one of eight trust evaluation types. Specifically, TP1 through TP8 denote the trust values computed between the customer and Seller A using the eight trust computation methods listed in the leftmost column of

Table 2. Truth table for trust and action possibility based on Figure 5.

Trust Formula	${\mathit{S}}_0$	${\mathit{S}}_1$	${\mathit{S}}_2$	${\mathit{S}}_3$
$\Vert T_p(j,i_1,F,B_1)\Vert$	0.7	0.3	0.4	0.2
$\Vert T_p(j,i_1,F,D)\Vert$	0.3	0.3	0.3	0.3
$\Vert T_c(j,i_1,\neg F,F\wedge B_1)\Vert$	0.1	0.1	0.2	0.1
$\Vert T_c(j,i_1,\neg F,F\wedge D)\Vert$	0.1	0.1	0.2	0.1
$\Vert T_p(i_1,j,D,C)\Vert$	0.7	0.4	0.4	0.5
$\Vert T_p(i_1,j,B_1,F)\Vert$	0.1	0.1	0.2	0.1
$\Vert T_c(i_1,j,\neg B_1,B_1\wedge F)\Vert$	0.6	0.3	0.3	0.1
$\Vert T_c(i_1,j,\neg B_1,B_1\wedge C)\Vert$	0.7	0.3	0.4	0.2

in top-to-bottom order, while TP1b through TP8b denote the corresponding results for interactions with Seller B using the same set of methods.

In each round of interaction, the system not only updates the corresponding trust value but also adjusts the seller’s behavioral action probability and the internal state variables of the agents based on the feedback from the trust result. The state adjustment mechanism adopts a directionally consistent linear fine-tuning strategy in which each relevant state variable incrementally moves toward the current trust value. This design is intended to simulate the agents’ learning and behavioral adaptation over time. Figure 7 and Figure 8 illustrate the trust dynamics trends between a customer and sellers A and B, respectively.

The aforementioned partial scenario is computed using a fuzzy model checking algorithm.

$$\begin{array}{cc}\hfill TP1& =\Vert T_p(j,i_1,F,B_1)\Vert (S)\hfill \\ & =\Vert (F\wedge \neg B_1)\wedge GPo(◯B_1)\Vert (s)\hfill \\ & =\left((D_{F\wedge \neg B_1}\circ E)\cap (P_{Adv}\circ D_{B_1}\circ r_{Adv})\right)(s)\hfill \\ & =\Vert F\wedge \neg B_1\Vert (s)\wedge E\wedge P(s_0,{\delta }^{j{i}_1},s_1)\hfill \\ & \wedge \Vert B_1\Vert (s)\underset{i\ge 0}{\wedge }{P}_{Ad{v}_{\delta }}(s_i,s_{i+1})\hfill \\ & =0.36\hfill \end{array}$$

$$\begin{array}{cc}\hfill TP2& =\Vert T_p(j,i_1,F,D)\Vert (S)\hfill \\ & =\Vert (F\wedge \neg D)\wedge GPo(◯D)\Vert (s)\hfill \\ & =\left((D_{F\wedge \neg D}\circ E)\cap (P_{Adv}\circ D\circ r_{Adv})\right)(s)\hfill \\ & =\Vert F\wedge \neg D\Vert (s)\wedge E\wedge P(s_0,{\delta }^{j{i}_1},s_1)\hfill \\ & \wedge \Vert D\Vert (s)\underset{i\ge 0}{\wedge }{P}_{Ad{v}_{\delta }}(s_i,s_{i+1})\hfill \\ & =0.30\hfill \end{array}$$

$$\begin{array}{cc}\hfill TP3& =\Vert T_c(j,i_1,\neg F,F\wedge B_1)\Vert (S)\hfill \\ & =\Vert \neg F\wedge GPo(◯(F\wedge B_1))\Vert (s)\hfill \\ & =\left((D_{\neg F}\circ E)\cap (P_{Adv}\circ D_{F\wedge B_1}\circ r_{Adv})\right)(s)\hfill \\ & =\Vert \neg F\Vert (s)\wedge E\wedge P(s_0,{\delta }^{j{i}_1},s_1)\hfill \\ & \wedge \Vert F\wedge B_1\Vert (s)\underset{i\ge 0}{\wedge }{P}_{Ad{v}_{\delta }}(s_i,s_{i+1})\hfill \\ & =0.32\hfill \end{array}$$

$$\begin{array}{cc}\hfill TP4& =\Vert T_c(j,i_1,\neg F,F\wedge D)\Vert (S)\hfill \\ & =\Vert \neg F\wedge GPo(◯(F\wedge D))\Vert (s)\hfill \\ & =\left((D_{\neg F}\circ E)\cap (P_{Adv}\circ D_{F\wedge D}\circ r_{Adv})\right)(s)\hfill \\ & =\Vert \neg F\Vert (s)\wedge E\wedge P(s_0,{\delta }^{j{i}_1},s_1)\hfill \\ & \wedge \Vert F\wedge D\Vert (s)\underset{i\ge 0}{\wedge }{P}_{Ad{v}_{\delta }}(s_i,s_{i+1})\hfill \\ & =0.31\hfill \end{array}$$

$$\begin{array}{cc}\hfill TP5& =\Vert T_p(i_1,j,D,C)\Vert (S)\hfill \\ & =\Vert (D\wedge \neg C)\wedge GPo(◯C)\Vert (s)\hfill \\ & =\left((D_{D\wedge \neg C}\circ E)\cap (P_{Adv}\circ D_C\circ r_{Adv})\right)(s)\hfill \\ & =\Vert D\wedge \neg C\Vert (s)\wedge E\wedge P(s_0,{\delta }^{i_{1}j},s_1)\hfill \\ & \wedge \Vert C\Vert (s)\underset{i\ge 0}{\wedge }{P}_{Ad{v}_{\delta }}(s_i,s_{i+1})\hfill \\ & =0.31\hfill \end{array}$$

$$\begin{array}{cc}\hfill TP6& =\Vert T_p(i_1,j,B_1,F)\Vert (S)\hfill \\ & =\Vert (B_1\wedge \neg F)\wedge GPo(◯F)\Vert (s)\hfill \\ & =\left((D_{B_1\wedge \neg F}\circ E)\cap (P_{Adv}\circ D_F\circ r_{Adv})\right)(s)\hfill \\ & =\Vert B_1\wedge \neg F\Vert (s)\wedge E\wedge P(s_0,{\delta }^{i_{1}j},s_1)\hfill \\ & \wedge \Vert F\Vert (s)\underset{i\ge 0}{\wedge }{P}_{Ad{v}_{\delta }}(s_i,s_{i+1})\hfill \\ & =0.32\hfill \end{array}$$

$$\begin{array}{cc}\hfill TP7& =\Vert T_c(i_1,j,\neg B_1,B_1\wedge F)\Vert (S)\hfill \\ & =\Vert \neg B_1\wedge GPo(◯(B_1\wedge F))\Vert (s)\hfill \\ & =\left((D_{\neg B_1}\circ E)\cap (P_{Adv}\circ D_{B_1\wedge F}\circ r_{Adv})\right)(s)\hfill \\ & =\Vert \neg B_1\Vert (s)\wedge E\wedge P(s_0,{\delta }^{j{i}_1},s_1)\hfill \\ & \wedge \Vert B_1\wedge F\Vert (s)\underset{i\ge 0}{\wedge }{P}_{Ad{v}_{\delta }}(s_i,s_{i+1})\hfill \\ & =0.34\hfill \end{array}$$

$$\begin{array}{cc}\hfill TP8& =\Vert T_c(i_1,j,\neg B_1,B_1\wedge C)\Vert (S)\hfill \\ & =\Vert \neg B_1\wedge GPo(◯(B_1\wedge C))\Vert (s)\hfill \\ & =\left((D_{\neg B_1}\circ E)\cap (P_{Adv}\circ D_{B_1\wedge C}\circ r_{Adv})\right)(s)\hfill \\ & =\Vert \neg B_1\Vert (s)\wedge E\wedge P(s_0,{\delta }^{j{i}_1},s_1)\hfill \\ & \wedge \Vert B_1\wedge C\Vert (s)\underset{i\ge 0}{\wedge }{P}_{Ad{v}_{\delta }}(s_i,s_{i+1})\hfill \\ & =0.36\hfill \end{array}$$

The trust values computed by the model checking algorithm consistently lie within the ranges observed in the simulation experiments, thereby validating that the model behaves as intended. This confirms the accuracy and effectiveness of the proposed approach in reasoning about fuzzy trust relationships. Due to space constraints, only representative scenarios are presented; nevertheless, all verified cases exhibit consistent alignment with the simulation results.

9. Conclusions

To study the verification of trust properties in multi-agent systems under generalized possibility measures, this paper uses the GPTIS model to model the system and employs GPTCTL to describe the system properties. An indirect model checking algorithm is used to transform the GPTCTL model checking problem based on GPTIS into a GPoCTL model checking problem based on GPKS. The calculation method for trust formulas is derived, and the corresponding algorithms are provided along with an analysis of their time complexity. An example of an online shopping system is given to illustrate the application of the algorithm in practice. Next, we will develop specific application tools to perform verification using a more direct model checking approach. Additionally, we will incorporate commitment operators or reputation operators into the trust operators to enrich the system properties.