This paper studies the relation between agreement and strongly linearizable implementations of various objects. This leads to new results about implementations of concurrent objects from various primitives including window registers, interfering primitives and stacks. We identify that lock-free, respectively, wait-free, strongly linearizable implementations of several concurrent objects entail a form of agreement that does not require full consensus but cannot be implemented in a strongly-linearizable manner with combinations of non-universal primitives. In both cases, lock-free and wait-free, this form of agreement requires a distinguished process to referee a competition that involves all other processes. Our results show that consistent refereeing of such competitions (i.e., once resolved, the outcome cannot be revised in any extension of the execution) requires high coordination power. More specifically, two contest objects are defined and used to help characterize coordination constraints imposed by strong linearizability in lock-free and wait-free implementations, respectively. Both objects are strictly weaker than consensus, in the sense that they have a wait-free linearizable (in fact, decisively linearizable) implementation from reads and writes. The contest objects capture strong linearizability in two complementary ways. First, they admit strongly linearizable implementations from several high-level objects such as queues, snapshots, and counters, so impossibility results for the contest objects immediately carry over to these objects. Second, they admit powerful impossibility results for strong linearizability that involve window registers, interfering primitives and stacks, which are non-universal.

Auditability enables tracking of all read operations performed on a register, allowing data owners to monitor access to their data. This paper explores formal models of single-writer auditable registers and examines their feasibility and synchronization requirements.A natural definition of auditable registers, atomic audit, requires that all write, read, and audit operations be linearized. We show that atomic auditing is a powerful synchronization primitive, as it can be used to solve consensus. The ability to solve consensus with atomic audit depends on the number of readers and auditors: if there is a single reader or a single auditor (the writer), consensus can be solved among two processes. If there are n readers and n auditors, consensus can be solved among n processes. This result highlights the strong synchronization needed to support atomic auditing.We present wait-free implementations of single-writer atomic registers with atomic audit. For multiple readers and a single auditor, our implementation relies on primitives with consensus number 2 (e.g., swap and test&set). When there are n readers and multiple auditors, we introduce an implementation based on (n+1)-sliding registers, which have consensus number n+1.Due to the inherent complexity of atomic auditing, we introduce a weaker definition: regular audit, where audit operations are not linearized with reads and writes. We prove that atomic registers with regular audit can be implemented using standard atomic registers, demonstrating that auditability can be achieved with lower synchronization costs in this weaker model.

The fundamental tension between availability and consistency shapes the design of distributed storage systems. Classical results capture extreme points of this trade-off: the CAP theorem shows that strong models like linearizability preclude availability under partitions, while weak models like causal consistency remain implementable without coordination. These theorems apply to simple read-write interfaces, leaving open a precise explanation of the combinations of object semantics and consistency models that admit available implementations. This paper develops a general semantic framework in which storage specifications combine operation semantics and consistency models. The framework encompasses a broad range of objects (key-value stores, counters, sets, CRDTs, and SQL databases) and consistency models (from causal consistency and sequential consistency to snapshot isolation and bounded staleness). Within this framework, we prove the Arbitration-Free Consistency (AFC) theorem, showing that an object specification within a consistency model admits an available implementation if and only if it is arbitration-free, that is, it does not require a total arbitration order to resolve visibility or read dependencies. The AFC theorem unifies and generalizes previous results, revealing arbitration-freedom as the fundamental property that delineates coordination-free consistency from inherently synchronized behavior.

Abstract specifications of concurrent objects determine which values operations may return, but they also implicitly constrain which information operations may know, for example the arguments of other operations that do not affect their outcome, or even whether such operations occurred. Concrete implementations, while correct with respect to the abstract specification, may nonetheless expose additional information through their internal coordination mechanisms. We introduce a framework for reasoning about information leakage in concurrent implementations. The framework uses epistemic logic to compare what a process may know under an abstract specification with what it may know in a concrete implementation, using the abstract object itself as the reference for permissible observations. This yields several notions of non-leaking implementations. Using this framework, we investigate both the possibilities and limitations of non-leaking implementations. We present fully-non-leaking wait-free implementations of multi-valued registers and bounded max registers, but show that a fully-non-leaking unbounded max register cannot be implemented in a wait-free manner from finite-state base objects. We then consider a weaker guarantee, obtaining argument-non-leaking implementations of stacks, queues, and approximate agreement. These results demonstrate that non-leakage guarantees are often compatible with correctness and progress requirements, while also indicating their limitations.

Linear probing is one of the simplest and most space-efficient approaches to hash table design, and is widely used in sequential settings due to its compact memory layout. However, designing a concurrent linear-probing hash table with strong liveness guarantees has proved difficult, and only a handful of such algorithms have been proposed, all of which either restrict concurrency or rely on large per-entry metadata, thereby compromising space efficiency. We present a lock-free linear-probing hash table with wait-free lookups that retains the core advantages of sequential linear probing while handling contention gracefully. Our design uses only a small amount of metadata per table entry: a constant number of additional bits when using LL/SC, or a logarithmic number of bits when using CAS. The algorithm is linearizable and lock-free, supports insert, delete, and wait-free lookup operations, and is able to safely reclaim space used by deleted elements without rebuilding the table. We analyze the amortized step complexity of our hash table assuming no concurrent insertions of the same key, and show that each operation has expected amortized step complexity matching that of sequential linear probing, up to the point contention per key.

This paper presents the first transformation that introduces both lock-freedom and recoverability. Our transformation starts with a lock-based implementation, and provides a recoverable, lock-free substitution to lock acquire and lock release operations. The transformation supports nested locks for generality and ensures recoverability without jeopardising the correctness of the lock-based implementation it is applied on.

We revisit the relationship between two fundamental models of distributed computation: the asynchronous message-passing model with up to f crash failures ( AMP_f ) and the Heard-Of model with up to f message omissions ( HO_f ). We show that for n > 2f , the two models are equivalent with respect to the solvability of colorless tasks, and that for colored tasks the equivalence holds only when f = 1 (and n > 2 ). The separation for larger f arises from the presence of silenced processes in HO_f , which may lead to incompatible decisions. The results are proved through bidirectional simulations between AMP_f and HO_f , using an intermediate model that captures this notion of silencing. The results extend to randomized protocols against a non-adaptive adversary, indicating that the expressive limits of canonical rounds are structural rather than probabilistic. Together, these results help to delineate where round-based abstractions capture asynchronous computation, and where they do not.

A history-independent data structure does not reveal the history of operations applied to it, only its current logical state, even if its internal state is examined. This paper studies history-independent concurrent dictionaries, in particular, hash tables, and establishes inherent bounds on their space requirements. This paper shows that there is a lock-free history-independent concurrent hash table, in which each memory cell stores two elements and two bits, based on Robin Hood hashing. Our implementation is linearizable, and uses the shared memory primitive LL/SC. The expected amortized step complexity of the hash table is $O(c)$, where $c$ is an upper bound on the number of concurrent operations that access the same element, assuming the hash table is not overpopulated. We complement this positive result by showing that even if we have only two concurrent processes, no history-independent concurrent dictionary that supports sets of any size, with wait-free membership queries and obstruction-free insertions and deletions, can store only two elements of the set and a constant number of bits in each memory cell. This holds even if the step complexity of operations on the dictionary is unbounded.

When a concrete concurrent object refines another, more abstract object, the correctness of a program employing the concrete object can be verified by considering its behaviors when using the more abstract object. This approach is sound for trace properties of the program, but not for hyperproperties, including many security properties and probability distributions of events. We define strong observational refinement, a strengthening of refinement that preserves hypersafety properties, and prove that it is equivalent to the existence of forward simulations. We show that strong observational refinement generalizes strong linearizability, a restriction of linearizability, the prevalent consistency condition for implementing concurrent objects. Our results imply that strong linearizability is also equivalent to existence of forward simulations, and show that strongly linearizable implementations can be composed both horizontally and vertically. This paper also investigates whether there are wait-free strongly-linearizable implementations from realistic primitives such as test set or fetch add, whose consensus number is 2. We show that many objects with consensus number 1 have wait-free strongly-linearizable implementations from fetch add. We also show that several objects with consensus number 2 have wait-free or lock-free implementations from other objects with consensus number 2. In contrast, we prove that even when fetch add, swap and test set primitives are used, some objects with consensus number 2 do not have lock-free strongly-linearizable implementations. This includes queues and stacks, and relaxed variants thereof.

A recent breakthrough by Alistarh, Aspnes, Ellen, Gelashvili, and Zhu [STOC 2019] established that there are no extension-based proofs of impossibility for set-agreement within the class of non-uniform iterated immediate snapshot (NIIS) algorithms. An extension-based proof can be modeled as a game between a prover and an algorithm claiming to solve set-agreement, where this algorithm can be from a class 𝒞 of algorithms. Note that the non-existence of extension-based proofs of impossibility for a class 𝒞 of algorithms implies the non-existence of extension-based proofs of impossibility for all classes of algorithms containing 𝒞 . This result has then been revisited by Attiya, Castañeda, and Rajsbaum [OPODIS 2020] who showed that the same holds for the smaller class of uniform iterated immediate snapshot (IIS) algorithms, and even with a slightly stronger prover. The main takeaway message of our work is that these previous results, which show the non-existence of extension-based proofs of impossibility for set-agreement within smaller and smaller universal classes of algorithms, do not necessarily preclude the existence of an extension-based proof of impossibility for set-agreement for an even smaller class of algorithms. To illustrate this, we exhibit an extension-based proof of impossibility for set-agreement for the class of memoryless IIS algorithms. This latter class may not be universal but is strong enough to solve non-trivial tasks such as approximate agreement and renaming. Moreover, we show that the result by Attiya et al. for IIS algorithms, with the stronger prover, does not extend to colorless IIS algorithms. These two results underline the fact that the existence of an extension-based proof of impossibility for a task strongly depends on the considered class of algorithms, and is still open even for set-agreement.

Auditability allows to track operations performed on a shared object, recording who accessed which information. This gives data owners more control on their data. Initially studied in the context of single-writer registers, this work extends the notion of auditability to other shared objects, and studies their properties. We start by moving from single-writer to multi-writer registers, and provide an implementation of an auditable n-writer m-reader read / write register, with O( n + m) step complexity. This implementation uses ( m + n)-sliding registers, which have consensus number m + n. We show that this consensus number is necessary. The implementation extends naturally to support an auditable load-linked / store-conditional (LL/SC) shared object. LL/SC is a primitive that supports efficient implementation of many shared objects. Finally, we relate auditable registers to other access control objects, by implementing an anti-flickering deny list from auditable registers. 2012 ACM Subject Classification Theory of computation -> Distributed algorithms

A key result of distributed computing in asynchronous systems is a characterization for the wait-free solvability of colorless tasks by the existence of a continuous map from the task's input complex (representing the valid input configurations) to its output complex (representing the valid output configurations) which respects that task's specification. This natural characterization led to many proofs, mainly of impossibility: showing that a colorless task is not wait-free solvable, can be done by proving that there is no continuous map (respecting the task's specification) between two simplicial complexes, which can be done using classical topological machinery. The seminal work of Herlihy and Shavit (JACM '99) characterized the solvability of general (not necessarily colorless) tasks. However, this characterization is much more involved than the colorless one, as it uses the new notions of chromatic subdivisions and color-preserving maps. The characterization asks whether there exists a chromatic subdivision of the input complex and a colorpreserving map from the resulting subdivided complex to the output complex. This characterization is much harder to check as there are no ready-made topological tools for it, and in fact, finding such a subdivision and map is related to finding an algorithm for the task. This work presents a new and simpler characterization for the solvability of general tasks with three processes. In our characterization, the output complex undergoes a bounded number of simple combinatorial transformations. Then, we check if there is a continuous map from the input complex to the resulting output complex; we show that this suffices for determining whether the original task is solvable. Our approach provides a new and more direct way for deciding the solvability of a task, and also for proving impossibility and possibility of wait-free solutions for general tasks.

Auditing data accesses helps preserve privacy and ensures accountability by allowing one to determine who accessed (potentially sensitive) information. A prior formal definition of register auditability was based on the values returned by read operations, without accounting for cases where a reader might learn a value without explicitly reading it or gain knowledge of data access without being an auditor. This paper introduces a refined definition of auditability that focuses on when a read operation is effective, rather than relying on its completion and return of a value. Furthermore, we formally specify the constraints that prevent readers from learning values they did not explicitly read or from auditing other readers' accesses. Our primary algorithmic contribution is a wait-free implementation of a multi-writer, multi-reader register that tracks effective reads while preventing unauthorized audits. The key challenge is ensuring that a read is auditable as soon as it becomes effective, which we achieve by combining value access and access logging into a single atomic operation. Another challenge is recording accesses without exposing them to readers, which we address using a simple encryption technique (one-time pad). We extend this implementation to an auditable max register that tracks the largest value ever written. The implementation deals with the additional challenge posed by the max register semantics, which allows readers to learn prior values without reading them. The max register, in turn, serves as the foundation for implementing an auditable snapshot object and, more generally, versioned types. These extensions maintain the strengthened notion of auditability, appropriately adapted from multi-writer, multi-reader registers.

Canonical asynchronous rounds are a widely used abstraction for structuring distributed algorithms, making asynchronous executions appear synchronous and enabling modular reasoning. We show that this abstraction is fundamentally incompatible with optimal resilience in the Byzantine setting, even when randomization is allowed. Specifically, we prove that when 3f < n ≤ 5f, where n is the number of processes and at most f may be Byzantine faulty, no randomized canonical-round algorithm can solve consensus with bounded expected round complexity, and that communication-closed variants fail to solve consensus altogether in this regime. We establish these lower bounds via a unifying notion of nontrivial convergence, which captures consensus as well as classical relaxations, such as approximate agreement and connected consensus. Using simple reductions, the same impossibility extends to fundamental communication primitives such as reliable broadcast and gather. Our results identify a sharp boundary: while bounded canonical-round algorithms for these problems exist when n > 5f, they cannot when n ≤ 5f. Thus optimal resilience, n > 3f, cannot be achieved within the canonical-round framework. On the positive side, we show that the gather primitive captures the content-dependent communication needed to bypass this limitation. We use gather to obtain a simple and modular algorithm for connected consensus with optimal resilience, clarifying the communication structures required for optimal resilience.

In response to the impossibility of solving the consensus problem in asynchronous systems subject to failures, various relaxations of the consensus problem have been proposed, including approximate agreement, crusader agreement, gather, and reliable broadcast. Some are interesting in their own right while others are useful building blocks for solving other problems. We focus on message-passing systems of n processes, up to f of which can experience malicious (Byzantine) failures. These problems all require that n > 3f and they frequently have fairly simple and efficient algorithms when n > 5f. Challenges arise when considering resilience between 3f + 1 and 5f. For instance, nearly twenty years elapsed between the discovery of an approximate agreement algorithm for n > 5f [10] and one for n > 3f [1]. A stumbling block could be too much focus on looking for algorithms in a certain natural and intuitive form, which we call canonical (asynchronous) rounds. In such an algorithm, each process repeatedly sends a message containing its entire state tagged with a round number, then waits to receive n - f messages with that same round number, does some local computation and proceeds to the next round number. The n > 5f approximate agreement algorithm is in canonical round form but the n > 3f one is not. For algorithms in canonical round form, an obvious way of measuring time is the number of canonical rounds until the algorithm completes. However, this approach does not apply to other algorithms, such as those in which processes wait to receive a certain number of messages that have other properties besides simply having a certain round number. Attempts to rewrite these latter algorithms in canonical round form can result in drastically increased round complexity. This blow-up in the round complexity is inherent, as we show in this paper that for a wide set of problems, there is no algorithm in canonical round form that has a finite upper bound on the number of rounds if n = 5f. In contrast, the standard way of measuring time results in constant time complexity. We first show the impossibility of a bounded number of canonical rounds for a generic problem that captures the key properties needed in the proof. The result then follows immediately for, most notably, crusader agreement and flavors of approximate agreement. We then show via reductions that the same result holds for reliable broadcast and gather, since there are crusader agreement algorithms that use reliable broadcast and gather with no round overhead. 2012 ACM Subject Classification Theory of computation -> Distributed algorithms

Algorithms to solve fault-tolerant consensus in asynchronous systems often rely on primitives such as crusader agreement, adopt-commit, and graded broadcast, which provide weaker agreement properties than consensus. Although these primitives have a similar flavor, they have been defined and implemented separately in ad hoc ways. We propose a new problem called connected consensus that has as special cases crusader agreement, adopt-commit, and graded broadcast, and generalizes them to handle multi-valued inputs. The generalization is accomplished by relating the problem to approximate agreement on graphs. We present three algorithms for multi-valued connected consensus in asynchronous message-passing systems, one tolerating crash failures and two tolerating malicious (unauthenticated Byzantine) failures. We extend the definition of binding, a desirable property recently identified as supporting binary consensus algorithms that are correct against adaptive adversaries, to the multi-valued input case and show that all our algorithms satisfy the property. Our crash-resilient algorithm has failure-resilience and time complexity that we show are optimal. When restricted to the case of binary inputs, the algorithm has improved time complexity over prior algorithms. Our two algorithms for malicious failures trade off failure resilience and time complexity. The first algorithm has time complexity that we prove is optimal but worse failure-resilience, while the second has failure-resilience that we prove is optimal but worse time complexity. When restricted to the case of binary inputs, the time complexity (as well as resilience) of the second algorithm matches that of prior algorithms.

Auditability allows to track all the read operations performed on a register. It abstracts the need of data owners to control access to their data, tracking who read which information. This work considers possible formalizations of auditing and their ramification for the possibility of providing it. The natural definition is to require a linearization of all write, read and audit operations together (atomic auditing). The paper shows that atomic auditing is a powerful tool, as it can be used to solve consensus. The number of processes that can solve consensus using atomic audit depends on the number of processes that can read or audit the register. If there is a single reader or a single auditor (the writer), then consensus can be solved among two processes. If multiple readers and auditors are possible, then consensus can be solved among the same number of processes. This means that strong synchronization primitives are needed to support atomic auditing. We give implementations of atomic audit when there are either multiple readers or multiple auditors (but not both) using primitives with consensus number 2 (swap and fetch add). When there are multiple readers and multiple auditors, the implementation uses compare swap. These findings motivate a weaker definition, in which audit operations are not linearized together with the write and read operations (regular auditing). We prove that regular auditing can be implemented from ordinary reads and writes on atomic registers.