Private Announcements on Topological Spaces

In this work, we present a multi-agent logic of knowledge and change of knowledge interpreted on topological structures. Our dynamics are of the so-called semi-private character where a group G of agents is informed of some piece of information φ\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$\varphi $$\end{document}, while all the other agents observe that group G is informed, but are uncertain whether the information provided is φ\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$\varphi $$\end{document} or ¬φ\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$\lnot \varphi $$\end{document}. This article follows up on our prior work (van Ditmarsch et al. in Proceedings of the 15th TARK. pp 95-102, 2015) where the dynamics were public events. We provide a complete axiomatization of our logic, and give two detailed examples of situations with agents learning information through semi-private announcements.


Introduction
This work follows the tradition of modelling (dynamic) epistemic logics on spatial, rather than relational, structures, such as neighbourhood frames [23,37], subset spaces [1,10,11,17,18,35,36], and more importantly topological spaces [2,3,12,30,31].Unlike the rather standard approaches to modelling knowledge and information dynamics using relational semantics (see, e.g., [9,26,29,32] for a survey on this topic), our work acknowledges the observation based nature of these notions that demands richer, neighbourhoodlike structures.In this work, we propose a multi-agent topological semantics for knowledge and semi-private announcements in the style of subset space semantics equipped with neighbourhood functions.While knowledge is entailed by the agents' current observation sets (roughly speaking, represented by some opens of the given topological model), the precondition of an announcement is captured by means of the topological interior operator that refers to the existence of a possible observation set entailing the announcement (we formalize these notions in Section 3).Therefore, we do not take the precondition of an announcement to be only that the announced formula Presented by Heinrich Wansing; Received April 4, 2016 Studia Logica (2018) 106: 481-513 https://doi.org/10.1007/s11225-017-9750-zc The Author(s) 2017.This article is an open access publication be true, but that it be 'observable', as in [12].It is this observational aspect of our work that makes it different from most approaches to knowledge and semi-private announcements based on standard relational semantics.
An initial investigation by Moss and Parikh [24] presented a single-agent subset space logic (SSL) for the notions of knowledge and effort.In this work, the knowledge modality Kϕ has the standard reading "the agent knows ϕ (is true)," while the effort modality ϕ captures a notion of effort as any action that results in an increase in knowledge, read as "after (any) effort ϕ is true".Effort can be in the form of measurement, computation, approximation or even announcement, depending on the context and the information source, with, observation considered particularly relevant [24].In [24], Moss and Parikh evaluate the formulas in the bimodal language on subset spaces (X, O), where X is a non-empty domain and O is a non-empty set of subsets of X.A subset space is not necessarily a topological space, but topological spaces constitute a particular case of subset spaces.The elements of O are taken to be possible observations or possible observation sets, and the formulas are interpreted not only with respect to the actual state, but also with respect to a (truthful) observation set.The unit of evaluation is a pair (x, U ) such that x ∈ U ∈ O, where the point x represents the true state of affairs, and the set U represents all the points the agent considers possible, i.e., her epistemic range.According to subset space semantics, given a pair (x, U ), the knowledge modality K quantifies over the elements of U (Kϕ is true in (x, U ), if ϕ is true in (y, U ) for all y ∈ U ), whereas the effort modality quantifies over all open subsets of U that include x ( ϕ is true in (x, U ), if ϕ is true in (x, V ) for all V ∈ O with x ∈ V ⊆ U ).More precisely, ϕ being true in (x, U ) means that ϕ is true with respect to the actual state x and any further refinements of the current observation set U .
The epistemic motivation for subset space semantics and the dynamic nature of the effort modality clearly suggests a link with dynamic epistemic logic (DEL).The relationships between some of the well-known dynamic modalities studied in the DEL literature, such as the public and arbitrary public announcement modalities, have recently received considerable attention.In spite of the intuitive connections between SSL and the informational attitudes studied in DEL, connecting SSL to DEL is not entirely straightforward, even in the relatively simple case of public announcements.Connections between single-agent public announcement logic and SSL were made in [1,7,[10][11][12]36].To the best of our knowledge, Wáng and Ågotnes [36] were the first to propose semantics for public announcements on subset spaces in terms of open set refinement rather than model restriction.Bjorndahl [12] then proposed a revision of the semantics in [36], based on topological spaces, and with an interior modality int(ϕ) capturing the precondition of an announcement, associated with the interior operator of topological spaces.In previous work [30], we further extended the proposal in [12] with the arbitrary public announcement modality capturing information change caused by any announcement (rather than any effort) and studied a particular type of 'effort' that is in the shape of public announcements.Baltag et al. [7] further investigated the relationship between the dynamic notions effort, public announcements, and arbitrary announcements, building on the settings presented in [12,30].While the standard requirement for a truthful public announcement in DEL literature is only that it be true, the precondition int(ϕ) is stronger than ϕ simply being true (see also [12]) and it states that "ϕ is supported by truthful observation".In a framework where knowledge is based on truthful observations the agent possesses (such as the subset space setting), this precondition for the announcements seems to be the right notion to consider.We thus find this reading to be a good fit with the intuition behind the subset space/topological semantics and the observation-based dynamics we study in this paper: for an announcement to be successfully implemented, it is not sufficient that the announced formula be true, but there has to be a truthful observation set available to the agent, i.e., an open neighbourhood of the actual state, that entails the proposition in question.This is explained in great detail in [12] with several examples; we adopt one of these examples to motivate and explain our semantics in later sections.Although using topological spaces rather than subset spaces restricts our class of models, topological spaces are equipped with more structure and natural topological operators, such as the interior operator, helping us model information change based on observation.
The generalization of this framework to a multi-agent setting was the next natural step.Multi-agent subset space logics and topological logics were presented in [10,17,18,31,35].We generalize our knowledge operator, so we now have formulas K i ϕ, for "agent i knows ϕ", but we must deal with the complication of 'jumping out of the epistemic range' of an agent while evaluating higher-order knowledge formulas.This issue occurs independently from the dynamic extensions, and it is explained in a greater detail in [31,35].To briefly recall the problem, for example, consider two agents i and j, each having an associated observation set so the semantic primitive becomes a triple (x, U i , U j ) instead of a pair (x, U ). Evaluating a higher order knowledge formula such as K i Kj K i p with respect to the triple (x, U i , U j ) requires checking the truth of Kj K i p at (y, U i , U j ) for all y ∈ U i .
However, there might exists a state y ∈ U i such that y ∈ U j , which renders the triple (y, U i , U j ) ill-defined.This dilemma can be solved in different ways.In [35], it is solved with subsets containing partitions of the entire space, and in [31] by considering neighbourhoods that are not only relative to each agent, as usual in multi-agent subset space logics, but also relative to each state.Such a logic, including arbitrary public announcement modalities that capture a particular type of effort, was axiomatized in [31].Although the setting was multi-agent, the dynamics was that of publicly observable events.
A further step in this story is non-public dynamics: actions such as announcements that are observed by some agents but not by other agents, or that are only partially observed by other agents.A well-known example of such an action from the dynamic epistemic logic literature is the so-called private announcement [16].In the current work, we present a multi-agent logic of knowledge and change of knowledge interpreted on topological structures.For the dynamic part we consider not only public announcements but also private events called semi-private, or equivalently, semi-public announcements [6].Semi-private announcements describe a type of information gain of a group of agents A where a subgroup G of agents is informed of some piece of information ϕ, while all the other agents in A observe that group G is informed, but are uncertain whether the information provided is ϕ or ¬ϕ.As a simple example, we can consider the following scenario involving two agents and a number of well-described alternatives: the envelope agent 1 is opening contains p or contains ¬p, while agent 2 is seeing that 1 opens the envelope but cannot read the letter.After the semi-private announcement to 1 that p, where 2 is uncertain between p and ¬p, it holds that 1 knows that p, and 2 knows that 1 knows whether p: K 1 p, and K 2 (K 1 p ∨ K 1 ¬p).For the reader who is not familiar with these notions, we refer to "Appendix A" for examples on Kripke models, and [16,28] for a more detailed discussion.
We proceed with an overview of the paper.In Section 2, we introduce the topological notions used throughout the paper.Section 3 starts with two examples motivating our framework and then provides the syntax and semantics for our multi-agent logic sPAL int of knowledge and semi-private announcements.At the end of this section, we go back to the initial examples and illustrate the interpretation of the modal operators of our syntax.Section 4 includes the technical results of the paper where we give the axiomatization of the logic sPAL int and present its soundness and completeness with respect to our proposed semantics.We then mention some further results in Section 5 and conclude.

Background on Topology
In this section, we introduce the topological concepts that will be used throughout this paper.All the topological notions presented in this section and a more thorough introduction to topology can be found in [13,14].Definition 1. (Topological Space) A topological space (X, τ ) is a pair consisting of a non-empty set X and a family τ of subsets of X satisfying ∅ ∈ τ and X ∈ τ , and closed under finite intersections and arbitrary unions.
The set X is called the space.The subsets of X belonging to τ are called open sets (or opens) in the space; the family τ of open subsets of X is also called a topology on X.If for some x ∈ X and an open U ⊆ X we have x ∈ U , we say that U is an open neighborhood of x.Complements of opens are called closed sets.
A point x is called an interior point of a set A ⊆ X if there is an open neighborhood U of x such that U ⊆ A. The set of all interior points of A is called the interior of A and denoted by Int(A).We can then easily observe that for any A ⊆ X, Int(A) is an open set and is indeed the largest open subset of A. Dually, Cl (A) denotes the closure of A and it is the smallest closed set containing A. More precisely, x ∈ Cl (A) iff for every open neighbourhood U of x, U ∩ A = ∅.Finally, for any subset A ⊆ X, we define the boundary of A, denoted by Bd (A), to be the set Bd (A) = Cl(A) ∩ Cl(X \ A).
Proposition 2. For any topological space (X, τ ) and A ⊆ X, the point x belongs to Bd (A) if and only if for every open neighbourhood U of x we have U ∩ A = ∅ = U \ A (or, equivalently, U ⊆ A and U ⊆ X \ A).
Given a topological space (X, τ ) and a non- Definition 3. (Base) A family B ⊆ τ is called a base for a topological space (X, τ ) if every non-empty open subset of X can be written as a union of elements of B.
We can also give an equivalent definition of an interior point by referring only to a base B for a topological space (X, τ ): for any A ⊆ X, x ∈ Int(A) if and only if there is an open set U ∈ B such that x ∈ U and U ⊆ A.
Given any family Σ = {A i | i ∈ I} of subsets of X, there exists a unique, smallest topology τ (Σ) with Σ ⊆ τ (Σ) [13,Theorem 3.1,p. 65].The family τ (Σ) consists of ∅, X, all finite intersections of the A i , and all arbitrary unions of these finite intersections.Σ is called a subbase for τ (Σ), and τ (Σ) is said to be generated by Σ.The set of finite intersections of members of Σ forms a base for τ (Σ).

Motivation
Dynamics of information change and higher-order knowledge becomes much more interesting when more than one agent is involved.In this section, we motivate our setting by two examples demonstrating different situations.We start with a rather simple example of a discrete nature that is taken from [12] and adapted here for the multi-agent setting with two agents.The second example (also inspired by an example in [12]) concerns pairs of infinite binary strings (to represent a real number pair in the unit square [0, 1] × [0, 1]).A suitable topology can be defined on the set of such pairs, and we investigate how different agents that are uncertain about one or both strings can be informed about individual digits in these binary strings; i.e., semi-privately informed, without the other agent getting the information but with the other agent knowing that the opponent is informed.
Example 4. (The Jewel and the Tomb-Revisited with two agents) Indiana Jones (i) and Emile Belloq (e) are both scouring for a priceless jewel placed in a tomb.The tomb could either contain a jewel (J) or not (¬J) and the tomb could have been rediscovered in modern times (D) or not (¬D).The propositional variables corresponding to these propositions are, respectively, J and D. We represent a valuation of these variables by a pair xy, where x, y ∈ {0, 1}.This scenario with the given relevant alternatives can be represented in a 4-state model with the domain X = {xy | x, y ∈ {0, 1}} and the topology τ that we consider is generated by the base B = {{00, 10}, {01}, {11}}.The idea is that one can only conceivably know (or learn) about the jewel on the condition that the tomb has been rediscovered (as in [12]).Therefore, {00, 10} has no strict subsets besides the empty set: if the tomb has not yet been rediscovered, no one can observe whether there is a jewel in the tomb.Moreover, in this example, we stipulate that the actual state is 11, stating that the tomb contains a jewel and that the tomb has been rediscovered in modern times.We are then interested in designing a topological framework that could answer the following questions: (1) if both Indiana and Emile are initially ignorant about the jewel and the tomb, what facts would they come to know if Emile receives some further information?, (2) Would they end up in a similar epistemic state?, (3) What would they come to know about each other?
The next example concerns the transmission of partial information about a probe's location, and different agents' perspective on this information.
Example 5. (The probe in the unit square) A group of scientists wants to launch a probe on a certain field to collect evidence for an experiment.They target a designated point in the field, but previous measurements show that the probe launches within a small square-shaped error range due to external reasons such as the weather conditions, possible mechanical problems etc. (see Figure 1).
They thus design a feedback mechanism from the probe to the source by encoding the coordinates as infinite binary strings.The probe can measure its location in a step by step manner and encodes it as pairs of binary strings.It transmits this information to two sources, a x and a y , receiving the coding of coordinate-x and the coding of coordinate-y only, respectively.Since the precise location is described by a pair of infinite binary strings, observing the exact location of the probe corresponds to observing the entire infinite pair.Since the agents are finite beings, they can do this only for a finite amount of time.Moreover, for the same reason, the probe can measure at most a string of finite length, so they can only approximate the location of the probe: the exact location is not observable.
This situation can be modelled on a topological space based on the set {0, 1} ∞ × {0, 1} ∞ of the ordered pairs of infinite binary strings.Since the agents can learn the infinite binary sequence encoding the location of the probe up to a finite length n, the topology (representing what agents can in principle observe) will be generated by subsets of X whose every element has the same prefix up to length n, for all n ∈ N.
These two example will be reconsidered in Section 3.2 to their full (technical) extent and used to illustrate our proposed topological semantics for knowledge and semi-private announcements.

Syntax and Semantics
In this section, we introduce the syntax and semantics for the multi-agent logic of knowledge and semi-private announcements.This logic is a generalization of the public announcement logic introduced in [31] in the sense that it formalizes not only the information change within a group of agents when the new information is synchronously received by all the members of the group, but it also captures the information change when the new information is accessible to only a subset of the group.Here we do not consider completely private announcements and rather model semi-private announcements on topological spaces.Throughout the rest of this paper, we use the phrases semi-private announcements and private announcements interchangeably.
We let Prop denote a countable set of propositional variables and A a finite non-empty set of agents.Definition 6. (Language) The language L is defined by where p ∈ Prop, i ∈ A and G ⊆ A. Abbreviations for the connectives ∨, → and ↔ are standard, and ⊥ is defined as an abbreviation of p ∧ ¬p.We employ Ki for ¬K i ¬ϕ, and ϕ G ψ for ¬[ϕ] G ¬ψ.We denote the non-modal part of L (without the modalities

and [ϕ]
A ψ by [ϕ]ψ and the latter corresponds to the public announcement operator.We denote the extension of L EL int only with the public announcement modality [ϕ]ψ by L P AL int .
While the knowledge and semi-private announcement modalities K i and [ϕ] G ψ are standard, the modality int intends to capture the precondition for an announcement in our setting.We read int(ϕ) as "ϕ is announceable", where announceable is interpreted as being supported/entailed by a truthful observation set.This modality, as suggested by its notation, is interpreted as the topological interior operator and plays a crucial role in the formalization of the observation-based information dynamics we study in this paper.It is important to note that L EL int is the multi-agent extension of the single-agent epistemic language with the interior modality introduced in [12] and L P AL int is its extension with the public announcement modalities.The topological semantics for the corresponding single-agent languages has been investigated in [12], which was later extended to a multi-agent setting in [31] where only public events were considered.
We interpret the above language L of knowledge and semi-private announcements on topological spaces endowed with (partial) neighbourhood functions that assign an open neighbourhood for each agent i ∈ A at a given state x.The semantics introduced in this paper is similar to the topological semantics for the multi-agent logic of public announcements proposed in [31].In this paper, however, the neighbourhood functions are general enough to interpret semi-private announcements.We therefore generalize the approach in [31].
The main role for the neighbour functions θ is to assign a truthful observation set to a given state for each agent.It simply defines the current observation set of each agent at the state in question.Each condition given in Definition 7 guarantees certain requirements that render the semantics well-defined and meaningful for the language L. In particular, by the help of the neighbourhood functions, we also solve the problem of 'jumping out of the epistemic range' explained in the introduction.We will provide a more detailed explanation regarding the definition of the neighbourhood functions together with our proposed semantics given in Definition 9. Definition 8. (Topological Model) A multi-agent topological model (topomodel ) is a tuple M = (X, τ, Φ, V ), where (X, τ ) is a topological space, Φ a neighbourhood function set, and V : P rop → X a valuation function.The tuple X = (X, τ, Φ) is a multi-agent topological frame (topo-frame).
Given a topo-model M = (X, τ, Φ, V ) (or a topo-frame X = (X, τ, Φ)), τ is considered to be the set of observation sets that are 'potentially' available for all the agents and, following the intuition behind the subset space semantics [24], we refer to the opens as possible observation sets.A pair (x, θ) is a neighbourhood situation if x ∈ D(θ).The open set θ(x)(i) is an epistemic neighbourhood at x of agent i.An epistemic neighbourhood θ(x)(i) represents the actual, current observation set of the agent i at x and it is her only source of knowledge at state x with respect to the neighbourhood situation (x, θ) (see Definition 9 below).If (x, θ) is a neighbourhood situation in M we write (x, θ) ∈ M. Similarly, if (x, θ) is a neighbourhood situation in X we write (x, θ) ∈ X .For any (x, θ) ∈ M, we call M, (x, θ) a pointed model.Definition 9. (Semantics for L) Given a topo-model M = (X, τ, Φ, V ) and a neighbourhood situation (x, θ) ∈ M, the semantics for the language L is defined recursively as: It is not hard to see that the domain of an updated function θ ϕ G does not depend on G, it depends only on the initial function θ and the proposition ϕ.We thus write D(θ ϕ ) for D (θ ϕ G ) when confusion is unlikely to occur.
A formula ϕ ∈ L is valid in a topo-model M, denoted M |= ϕ, iff M, (x, θ) |= ϕ for all (x, θ) ∈ M; ϕ is valid, denoted |= ϕ, iff for all topomodels M we have M |= ϕ.Soundness and completeness with respect to topo-models are defined as usual.
For any topo-model M = (X, τ, Φ, V ), the agents' current observation sets, i.e., the epistemic neighbourhood of each agent at a given state x, is defined by (partial) functions θ ∈ Φ, where θ : X A → τ .As briefly stated in Section 1, one important feature of the subset space semantics is the local interpretation of the propositions: once the evaluation pair of a state and an observation set (x, U ) has been determined, the rest of the model does not have any effect on the truth of the proposition in question.Similarly in our setting, by choosing a neighbourhood situation (x, θ), we localize the interpretation to an open subdomain of the whole space, namely to D(θ), that embeds an observation set at every state in D(θ) for each agent i ∈ A. For every θ ∈ Φ and x ∈ D(θ), the function θ(x) : A → τ is defined to be a total function.Therefore, given a neighbourhood situation (x, θ), the neighbourhood function θ assigns a neighbourhood at x to each agent.Moreover, the conditions of neighbourhood functions given in Definition 7 make the semantics work for the multi-agent setting.To be more precise, Condition 1 guarantees that θ always gives a truthful observation set at the state in question for each agent.In particular, it also implies that the agents cannot have inconsistent, i.e., empty, observation sets.Since the neighbourhoods given by the neighbourhood functions depend not only on the agent but also on the current state of the agent, and since x ∈ θ(x)(i) ⊆ D(θ) for every x ∈ D(θ) and every i ∈ A (due to conditions 1 and 2), our semantics do not face the problem of ending up with ill-defined evaluation pairs in the interpretation of iterated epistemic formulas such as Kj K i p (see, e.g., [31, Section 2.5] for an example).Moreover, conditions 1 and 3 of Definition 7 make the axioms of the system S5 for knowledge sound.We will give the weaker conditions for S4, S4.2 and S4.3 in Section 5. Finally, Condition 4 defines the refined neighbourhoods resulted by a semi-private announcement.By the nature of the semi-private announcements, the effect of the semi-private announcement of a proposition ϕ to the group G ⊆ A is different on the agents in G than it is on the ones in A \ G.We therefore define the restricted neighbourhood function θ ϕ in such a way that it captures this difference and assigns open sets to the agents accordingly.We continue analysing Definition 7 together with a discussion on the semantics for the modalities in L.
The neighbourhood functions, and thus, the observation sets become important in the evaluation of the modalities.Recall that for any neighbourhood situation (x, θ), the epistemic neighbourhood θ(x)(i) is the particular truthful observation set that the agent i curently has at the state x.For the semantic clause of the knowledge modalities, we can simply write meaning that "agent i knows ϕ iff her current observation set entails ϕ (with respect to the neigbourhood function θ)".Therefore, as in the original subset space setting, K i quantifies over the observation set of agent i.
Let us now focus on the semantics of the dynamic part, starting with the interpretation of the modality int(ϕ) intending to capture the precondition of the announcement of ϕ.To be more precise, we note that Given the observation-based interpretation of the open sets, we can read the above semantic clause as "the precondition of the announcement of ϕ is satisfied at the state x (with respect to the neighbourhood function θ) iff there exists a truthful observation set that entails/supports ϕ (with respect to θ)".Therefore, in our setting, the precondition of an announcement is not only that the announced formula be true but also that it be entailed by a possible observation set, as in [12].Moreover, since Int( it is the largest, and consequently, the weakest observation entailing the proposition ϕ with respect to the neighbourhood function θ.Following [20,33], we say ϕ can be verified (via some true observation) at the neighbourhood situation (x, θ) if Moreover, the existence of a possible, truthful observation set supporting the new information ϕ, i.e., the verifiability of ϕ, in no way depends on the agents but only on the model in question and so is objectively determined.The definition of the restricted neighbourhood functions θ ϕ (see Definition 7.4) is mainly based on this intuition behind the use of the interior operator as a precondition for announcements.
In our setting, i.e., in the setting of semi-private events, while a group of agents G ⊆ A is announced a proposition ϕ, the agents in A \ G are not totally blind to the new information.They get to learn that either ϕ or ¬ϕ is announced, however, unlike the members of G, they do not receive any further information as to which one was announced.Given that the initial neigbourhood situation is (x, θ), the domain of the updated function θ ϕ becomes ) and this domain restriction does not depend on the group G.This represents the fact that the announcement of ϕ conveys the information to all the agents that either ϕ or ¬ϕ can be verified.Therefore, from the opposite perspective, the refinement of D(θ) to D(θ ϕ ) simply leaves out the states in which neither ϕ nor ¬ϕ is observable with respect to (x, θ).In fact, the set of states in which neither ϕ nor ¬ϕ is observable with respect to a neighbourhood situation (x, θ) (or equivalently, the states in which ϕ is neither verifiable nor refutable) corresponds to another topological concept, namely to the set of boundary points of Proposition 11.For any topo-model M = (X, τ, Φ, V ), any (x, θ) ∈ M and any ϕ ∈ L, we have Proof.Let (D(θ), τ θ ) be the subspace of (X, τ ) generated by D(θ), and Int θ , Cl θ and Bd θ be the interior, closure and boundary point operators of (D(θ), τ θ ).Since D(θ) ∈ τ , we have Int θ (A) = Int(A) for any A ⊆ D(θ).And, as usual, Cl θ (A) = Cl (A) ∩ D(θ) and Bd θ (A) = Bd (A) ∩ D(θ) for any A ⊆ D(θ).We can therefore write Therefore, topologically speaking, the domain restriction induced by the announcement of ϕ boils down to disregarding the boundary points of the truth set of ϕ under the domain of the initial neighbourhood function.Note that if the actual state x is an element of Bd ([[ϕ]] θ ) ∩ D(θ), the update is not applicable.Therefore, a first step of a successful implementation of the announcement of ϕ neglects the states in which it is not possible to find a truthful observation set entailing either ϕ or ¬ϕ, and thus refines the domain of the initial neighbourhood functions.This naturally leads to a refinement of the current observation sets of all the agents (see Definitions 7.2 and 7.4).While the observation sets of the members of A \ G who do not receive any further information are only restricted by the domain of the updated function θ ϕ , the members of G can further strengthen their epistemic state depending on the content of the information received: without loss of generality, if ϕ can be verified at x (i.e., x ∈ Int([[ϕ]] θ )), then the refined observation set becomes θ(x)(i) ∩ Int([[ϕ]] θ ) for each agent in G.We can see how the semantics works on Examples 4 and 5.
Example 12. (The Jewel and The Tomb-continued) Consider the topomodel M = (X, τ, Φ, V ) based on the topological space (X, τ ) described in Example 4 where Φ is the set of all neighbourhood functions that partition the domain X and is closed under the condition Definition 7.4.For instance, the neighbourhood function θ ∈ Φ defined as θ(x)(i) = θ(x)(e) = X for all x ∈ X describes total ignorance of both agents.Consider this is the initial state and Emile is semi-privately announced that the tomb has a jewel in it (J).This means that Indiana received the information that either J or ¬J is observable but he did not learn which one.Modelling this situation on M requires calculating that [[J]] θ ={10, 11} and Int([[J]] θ )={11}.The fact that 10 ∈ Int([[J]] θ ) captures the intuition that one can only learn about the jewel on the condition that the tomb has been rediscovered in modern times.We moreover calculate that after the semi-private announcement of J to Emile, he does not only come to know J but he also comes to know D: This amounts to calculating θ J e (e)(11) = θ(e) (11) ∩ Int([[J]] θ ) = {11}.Observe that the only state 11 in θ J e (e)(111) makes both J and D true.On the other hand, Indiana is still ignorant about whether the tomb has a jewel or not, however, he comes to know that Emile knows whether the tomb has jewel and he also comes to know that the tomb has been rediscovered: (11) includes the state 01 that falsifies J, and the state 11 that falsifies ¬J, and every state in θ J e (i) (11) makes D true.For the last conjunct K i (K e J ∨ K e ¬J), we check whether every state in θ J e (i) (11) makes K e J ∨K e ¬J true with respect to the updated neighbourhood function θ J e .An intermediate step to reach this result is calculating θ J e (e)(x), for all x ∈ θ J e (i)(11) = {11, 01}.We then obtain (1) θ J e (e)(11) = θ(e) (11) We thus have that Emile knows J (i.e., K e J holds) at 11 and he knows ¬J (i.e., K e ¬J holds) at 01 (with respect to θ J e ).Therefore, every state in the observation set θ J e (i) (11) of Indiana satisfies K e J ∨K e ¬J, hence, Indiana knows Emile knows whether the tomb has jewel after the announcement of J to Emile.
Example 13.(The probe in the unit square-continued) Recall that the probe is located in a square region and it transmits information about the x and y-coordinates of its location to two different agents, a x and a y , in the form of binary bits giving increasingly precise information about each coordinate.We model this situation and the corresponding information dynamics described in Example 5 on a topological space based on the domain {0, 1} ∞ × {0, 1} ∞ of the ordered pairs of infinite binary strings.
In order to define our model more formally, we need to introduce some notation.If s ∈ {0, 1} ∞ , for n ∈ N + , we let s| n be the first n bits of s, and we let s[n] be the nth bit of s.As usual, we let {0, 1} * be the set of finite strings over {0, 1} and for d ∈ {0, 1} * , |d| denotes the length of the finite string d.For d ∈ {0, 1} * we define S d = {x ∈ {0, 1} ∞ | x| |d| = d}, in other words, S d is the set of all infinite binary strings that have d as a prefix.Note that S is {0, 1} ∞ , since is the empty string.Note also that when we consider the elements of {0, 1} ∞ as points on the unit interval, we can think of S d as a certain subinterval of the unit interval.More precisely, each S d is the interval bounded by d 2 |d| and d+1 2 |d| when d is viewed as the binary representation of a natural number.We cannot, however, go in the opposite direction and consider all such intervals to be sets of the form S d , since there are multiple possible representations of some of the points in [0, 1] as binary strings.
Now consider the topology τ generated by the set B = {S d | d ∈ {0, 1} * }.It is not hard to see that B indeed constitutes a base over the domain {0, 1} ∞ : Therefore, B is closed under finite intersections.
For our example, we use the product space ({0, 1} ∞ ×{0, 1} ∞ , τ × τ ) and we have two agents a x and a y .This scenario concerns the following propositional variables: We read x i as "the ith bit of x is 1" and y i as "the ith bit of y is 1".
By using this model, we will model the agents observing the bits of the binary sequences and what they come to know about the location of the probe and about what the other agent knows.Moreover, we will further extend this model and have a look at a situation in which the agent receives some information that is not observable, i.e., whose truth set does not correspond to any open set in τ × τ .
We start by describing the situation in which both agents are totally ignorant about the exact location of the probe within the unit square.This is described by the neighbourhood function θ such that θ((x, y))(a x ) = θ((x, y))(a y ) = {0, 1} ∞ × {0, 1} ∞ .In order to obtain a well-defined neighbourhood function set Φ on the topology ({0, 1} ∞ ×{0, 1} ∞ , τ × τ ), we must close the singleton set {θ} under open domain restrictions described in Definition 7.4, so we let Φ = {θ : {0, It is easy to see that Φ satisfies the properties of a neighbourhood function set given in Definition 7.
We can model agent a x learning bits of x and agent a y learning bits of y in the following way: a x learning that the first bit of x is 1 induces the function θ x 1 a x .We note that Other functions for updating with propositional variables work similarly.We now see for example that after a x learns that the first bit of x is 1, a x knows this, but a y does not know that a x knows this.On the other hand, as a result of the semi-private . Updated situation where ax knows the first bit of x is 1 and ay is ignorant about the first bit of x and she does not know that ax knows the first bit of x is 1.On the other hand, ay know that ax is informed of the first bit of x.We have θ x 1 ax ((x, y)(ax) = S1 × {0, 1} ∞ and θ x 1 ax ((x, y)(ay) = X nature of the announcement, a y knows that a x knows the value of the first bit of x (see Figure 2): Observe that this was not the case before the announcement: In case of iterative private announcements to different agents, for example, we have meaning that after a x was announced that the first bit of x is 1 and then a y was announced that the first bit of y is 0, they come to know the first bit of their own sequences, however, neither of the two knows the other's first bit.A public announcement of x 1 ∧ ¬y 1 , on the other hand, results in the situation where each agent knows the first bit of both sequences and they also know that everyone knows the first bit of both sequences (see Figure 3).The public announcement of propositional variables and their boolean combinations indeed lead to common knowledge among the informed agents.
The above case captures a scenario in which the agents receive only observable information from the probe that corresponds to opens in the given topology.We can further extend this example and talk about a situation where the agents receive intercepted information from the probe that is known to be errant in the sense that the shape of the signal does not match the one that could be sent by the probe in terms of the first nth bit of the binary sequences.In this case, the agents only consider the observable part of the new information by the help of the interior modality.In order to capture such a scenario, we extend the set of propositional variables by the set where ∼ is defined as (x, y) ∼ (.i, .j)iff (x, y) corresponds to the pair (.i, .j) on R 2 .
For example, V (z (.5,.5) ) = {(0111 . . ., 0111 . ..), (1000 . . ., 1000 . ..), (0111 . . ., 1000 . ..), (1000 . . ., 0111 . ..)}, and the proposition z (.5,.5) states that "the probe is at one of the coordinates in V (z (.5,.5) )".The propositions of type z (.i,.j) clearly form discrete options as to where the probe stands and require measurement of infinitely many bits of both sequences.Since the probe, by design, cannot calculate as accurately, even if the agents receive such information, they simply focus on the observable part of the new information that corresponds to what could actually be measured and sent by the probe.This phenomena is captured by the help of the interior modality int.
Even though z (.75,.25) is true (since its truth set at θ contains the actual state (11000 . . ., 01000 . ..)), it is not observable, or equivalently for this example, it cannot be sent by the probe.Therefore, it is not an announceable formula in our setting.This is formalized by the interior modality: Int([[z (.75,.25) ]] θ ) = ∅.We therefore obtain ((x, y), θ) |= z (.75,.25) a x ϕ for any ϕ ∈ L.More interestingly, consider the case the agent a y receives the information y 2 ∨ z (.75,.25) .Note that

Axiomatization, Soundness and Completeness
In this section, we define an axiomatization for the multi-agent (topological) semi-private announcement logic with the interior modality sPAL int , comment on alternative and equivalent axiomatizations (following [34]), and prove soundness and completeness results for the given axiomatization.
The logic sPAL int is the smallest subset of L containining the axioms and closed under the derivation rules given in Table 1.An element of sPAL int is called a theorem (of sPAL int ), notation ϕ, or equivalently ϕ ∈ sPAL int .
Let us elaborate on the meaning of some axioms and rules.While the (K-) named axioms express the S5 character of the knowledge modality K i , the first three axioms for the modality int reflects the S4 nature of the topological interior operator.Moreover, the occurances of int(ϕ) on the right-hand-side of the reduction axioms capture that this modality is used as a precondition for the announcements.Moreover, the axioms (Rp5- , where i ∈ G, are the obvious instantiations of the [6]-style reduction of knowledge after action model execution.In the former case, agent i ∈ G completely observes the announcement.Therefore, after the announcement she knows something (say, [ϕ] G K i ψ is the Without the (Rp-) named axioms and (DRp4) we get the axiomatization of ELint .The (non-standard) meaning of the substitution χ[ϕ/ψ] is given in the accompanying text case), iff, on the condition that the announcement can be executed (the precondition int(ϕ)), she knows that after the announcement it is true (i.e., K i [ϕ] G ψ holds).In the latter case, agent i ∈ G only partially observes the announcement.She cannot distinguish the announcement of ϕ from the announcement of ¬ϕ.Therefore, after the announcement she only knows something (i.e., [ϕ] G K i ψ), iff, again on the condition int(ϕ), she knows that after the announcement it is true (i.e., K i [ϕ] G ψ), but she also knows that after the announcement of ¬ϕ it is true (i.e., K i [¬ϕ] G ψ).This is because the announcements ϕ and ¬ϕ are indistinguishable for her.To illustrate, consider agent a successfully being informed of the truth of p. Then after this announcement, a comes to know that p. Whereas agent b, who is partially observing this semi-private announcement, only learns that a knows whether p is true.So we have that [p] a K a p, but not that [p] a K b p.In order for a formula ψ to be known by b after [p] a , it also has to be true after [¬p] a .Such a formula ψ for which this holds is K a p ∨ K a ¬p.Indeed, we have that The derivation rule (DRp4) is one of replacement of equivalents, where χ[ϕ/ψ] denotes any formula obtained by replacing one or more non-dynamic occurrences of ϕ in χ with ψ.Non-dynamic occurrences of ϕ are the occurrences of ϕ which are not inside any [ ] G [34].As usual, we could also give alternative equivalent axiomatizations for the logic sPAL int .One possible choice would be replacing (DRp4) by the Necessitation rule for the dynamic modality [ ] G (i.e., from ϕ, infer [ψ] G ϕ) and adding the K-axiom for . This would slightly change the completeness proof and we elaborate on this issue after Theorem 19.
We now continue with the soundness and completeness proofs with respect to the class of all topo-models for the system sPAL int .While the soundness proof consists of a standard validity check, the completeness proof will be given via reduction, a method commonly used in the DEL literature (see, e.g., [32] for a more detailed discussion of DEL).In order to be able to apply this method, we need the static fragment EL int of sPAL int to be complete with respect to the topo-models: Theorem 14. ( [31]) EL int is sound and complete with respect to the class of all topo-models.
Theorem 15. sPAL int is sound with respect to the class of all topo-models.
We prove the completeness of sPAL int via reduction.More precisely, we will define an inductive translation from the language L to L EL int that provides us an algorithm converting each formula of the language L to a semantically and provably equivalent formula in L EL int .This method is commonly used in the DEL literature to prove completeness of public announcement logics and, more generally, of action model logics [6].For a more detailed discussion on this proof method, we refer the reader to [32].Definition 16. (Translation) The translation t : L → L EL int is defined recursively as follows: If we compare the left-hand side of each equation in the translation to its right-hand side, we can observe that the main logical connective bound by t on the left is out of the scope of t on the right.For example, in t(ϕ ∧ ψ), on the left, the translation function t binds the conjunction, but not in t(ϕ) ∧ t(ψ), on the right.However, when the main connective is an announcement modality, t operates on the main logical connective of the formula bound by the announcement.For example, with t([ϕ] G ¬ψ) on the left (t binds announcement, which binds negation), we get with some further rewriting t(int(ϕ)) → ¬t ([ϕ] G ψ) on the right (negation binds t, which binds announcement).More importantly, whereas on the left the announcement binds the negation, on the right the negation binds the announcement.We can see this as pushing the announcement operator deeper into the formula: on the right, it has been 'pushed' beyond the negation.All the cases for announcement, except the last one, have the main operator that is bound by the announcement on the left, bind the announcement on the right.If the announcement binds a propositional variable on the left, then on the right the announcement has disappeared: t([ϕ] G p) versus t(int(ϕ) → p).
In order to show that for each formula, this translation produces an equivalent formula without announcements, we need to address two concerns: (i) the formula without announcements thus produced is equivalent to the original formula, and (ii) such a formula is always produced, i.e., the rewrite procedure terminates.Concerning equivalence it is sufficient to show that each step in the translation is truth preserving.For example, t ([ϕ] But we also have to show that the process of iteratively translating formulas terminates.To prove that, we will define a complexity measure on formulas and show (A) that the right-hand side is always less complex than the left-hand side, and (B) that eventually all the announcement operators disappear from the formula (the proof is by induction on the number of announcements in a formula).Even so, this is tricky: comparing , we even have more announcement operators on the right!Will they eventually disappear?Two different ways to produce formulas with fewer announcements by rewriting are the outside-in reduction strategy and the inside-out reduction strategy.In the first case, take an outermost announcement modality (an announcement modality that is not in the scope of another announcement modality), and apply one or more of the translation rules above.Eventually, you will get a logically equivalent formula with at least one less announcement modality.In the second case, take an innermost announcement modality (an announcement modality with no announcement modality in its scope).Then do the same.Either way, we will have to apply the derivation rule (DRp4), 'replacement of equivalents' (from ϕ ↔ ψ, infer χ ↔ χ[ϕ/ψ]).
In our logic, the outside-in strategy fails since we cannot always express two or more consecutive announcements by means of a single announcement.One way to do that is to have a composition axiom for announcements that makes a single announcement out of the two announcements of the form [ϕ] G [ψ] G .We do not have that: there is no [χ] G that has the same effect as [ϕ] G [ψ] G .Namely, as already mentioned, what should then be the group G learning this χ?But the inside-out reduction works in our case: comparing producing an equivalent ξ, and then continue by reducing [ϕ] G ξ. To illustrate the inside-out style reduction, we can consider the simple dynamic proposition [p][q]K 1 r.We then obtain the formula corresponding to t([p][q]K 1 r) recursively by starting the reduction with the innermost dynamic modality and following the rules given in Definition 16: For a more detailed discussion on alternative reduction rules, see e.g., [29,Chapter 6] and [34].
The soundness of sPAL int shows that the translation given in Definition 16 preserves the truth of a formula.We now define a complexity measure on the formulas of the language L which will help us to obtain the desired completeness result.Definition 17. (Complexity) The complexity measure c : L → N defined recursively as follows: Proof.The proof is elementary and follows from routine complexity calculations.
Proof.The proof follows by induction on the complexity of ϕ.We only prove the case ϕ = [ψ] G [χ] G η.For the other cases, see [21, p. 188].IH: For all ψ ∈ L with c(ψ) ≤ c(ϕ), ψ ↔ t(ψ). Case: Theorem 19 shows that we can do inside-out reduction in the proof system of sPAL int .In case we were to axiomatize sPAL int by the Necessitation Rule and the K-axiom for the dynamic modality for [] G instead of (DRp4), the derivation presented for the case [ψ] G [χ] G η would be slightly different in the following way: Theorem 20. sPAL int is complete with respect to the class of all topomodels.

Conclusion, Further Results, and Future Work
We presented a multi-agent logic of knowledge and change of knowledge interpreted on topological structures.The dynamic part consisted of semiprivate announcements to subgroups.We then modelled public announcements as a special case.We provided a complete axiomatization of our logic.We presented two detailed examples.While the first example consists in an 4-state model, the other example is about infinite binary strings.
We can then also work with the weakenings of sPAL int based on the epistemic systems S4 and S4.3 for the modalities K i by simply closing the neighbourhood function sets under Condition 4 of Definition 7, however we cannot obtain such a dynamic extension for S4.2: the characterizing axiom Ki K i ϕ → K i Ki ϕ (for 'confluence', 'Church-Rosser') may no longer hold after update, as the intersection of updated open neighbourhoods θ ϕ (y)(i) ∩ θ ϕ (z)(i) may have become empty after the refinement.The details of our various results for these S4 extensions are not presented in this paper.
For further research we wish to investigate whether sPAL int is expressive enough to model all non-public forms of dynamics (that are S5 preserving), and not merely semi-private announcements.A first step in such a project could be to study completely private annoucenements because in combination with obvious program manipulations they are already sufficiently expressive to describe all dynamics, e.g., all action models, see [15,16].Such results may possibly carry over to a topological setting.
In this work, the observation component of knowledge and information dynamics is represented mostly in the semantics by means of open sets.We can further extend our syntax by observation modalities and belief and study the connection between knowledge, belief and observation together in one framework (as in [5]).An extension with the original effort modality of [24] is also of great interest.

Appendices A From Public to Private Announcement in Kripke Models
Consider two agents 1 and 2 who are uncertain about the value of a proposition p, and such that this ignorance is known to them.Model i in Figure 4 encodes this situation.The result of a public announcement of p is model ii, where both 1 and 2 have learned p.The ¬p world has been eliminated by this announcement.At this stage, we observe that an equally good way to describe the result of this public announcement is the model iii, where the ¬p world is not eliminated but where the accessibility links between the p and the ¬p world are cut.Refinement is an alternative semantics for public announcement logic (rather than restriction).From the perspective of the agents there is indeed no difference between the two models.Given that p is true, both in ii and iii the agents 1 and 2 have common knowledge of p.The ¬p world is inaccessible.
The result of a private announcement to agent 1 that p is the model iv.We note that in the top right p world agent 1 knows that p, whereas agent 2 believes that both agents are still ignorant about p.In other words, 2 believes that nothing happened.This belief is incorrect.It is not knowledge.Just like for public announcement, for private announcement it does not hurt to also keep the original state where p is false, as in model v. From that perspective it represents 1 being privately informed that ¬p.The beliefs of both 1 and 2 in the top right world remain the same in iv and in v, as the top left ¬p world is inaccessible.
The difference between models v and vi is that now 2 is no longer unaware of 1 being informed of p, but that 2 considers it possible that 1 is informed about the value of p.However, 2 still keeps his options open; he also considers it possible that 1 was not informed at all.We note that 2 has universal access in this model.Unlike v, in model vi the agents' epistemic stances are again described as knowledge: their accessibility relations are equivalence relations.Now that we have vi, the step to vii is fairly small: vii represents the value of p being privately announced to 1 (or, from the perspective of the actual world where p is true: p is privately announced to 1), whereas 2 learns that 1 learns the value of p; and where both agents are aware of this (so that the action has some public character as well, it is not truly private).The model vii consists of the top row of model vi: the alternative where 1 did not learn anything is now ruled out.Again, this is a model where both agents have knowledge: their accessibility relations are equivalence relations.The transition from model i to model vii goes under the name of semi-private (or semi-public) announcement.
Instead of private announcements to individual agents we can consider private announcements to subgroups of agents: among the members of the addressed subgroup, it functions as a public announcement, whereas the remaining agents think nothing happens.In that sense the public announcement of p is a private announcement of p to agents 1 and 2. When we have private announcement to subgroups, there are other connections between the depicted models.A private announcement

Figure 1 .
Figure 1.The arrows are pointing to the target point.Dashed square represents the error range and (x, y) denotes the real location of the probe

Table 1 .
The axiomatization of sPALint