The automation of all sorts of processes through Artificial Intelligence (AI) systems has made significant progress. More recently, whether through self-regulation and soft law such as guidelines or through legal regulation (e.g., the General Data Protection Regulation (GDPR) or the Regulation on AI, both by the EU), it has become apparent that this development needs to be accompanied by measures that safeguard the fundamental rights and safety of people affected by AI systems. In this sense, Explainable Artificial Intelligence (XAI) [2] is of foremost importance to design trustworthy systems. Proposals such as s(LAW) [3], which are based on Answer Set Programming, have shown their ability to model values and explain the reasons for their decisions, thanks to their rule-based models. But these explanations could lead to the disclosure of sensitive information, such as details about victims of gender-based violence. This could violate the right to privacy and confidentiality, or even cause legal issues, among other concerns. Although explanations can be adjusted to prevent leaks, e.g., using the s(CASP) framework to control which elements are shown and/or hidden [4], adapting the models requires the application of techniques such as forgetting (variable elimination) to avoid revealing sensitive information during an audit. However, current forgetting techniques are mostly only applied in propositional ASP programs, and they have limitations dealing with even loops.
In this work, we present π πΆπ΄ππ , a new forgetting technique that supports the presence of nonstratified negations in Constraint Answer Set Programs. π πΆπ΄ππ is based on the dual rules of s(CASP), a goal-directed CASP reasoner, and therefore, we believe that it can be applied to generic CASP programs without grounding. We have validated our proposal by solving flagship examples from the literature, and we plan to use this technique in the context of school places allocation while preserving the privacy of victims of gender-based violence.
Comparison of the more relevant forgetting operators vs. π πΆπ΄ππ
In Table 1, we compare f CASP with other relevant operators such as those described in [9] and [10], evaluating its preliminary performance and properties. Through validation using literature examples, we believe that π πΆπ΄ππ can generate programs with the same answer sets, even when additional facts (when complying with UP) or propositional rules (when complying with SP) are added to both programs, avoiding the removed or auxiliary predicates. Additionally, we have tested the operator with programs involving even loops, and it can generate equivalent programs regardless of the order in which predicates are removed, that is, it is commutative. In the future, there is potential to extend it to programs with variables and constraints, thanks to the use of s(CASP) dual rules.
The preliminary design of the algorithm involves three steps repeated iteratively for each predicate marked to be forgotten, plus a final optional step.
Figure 1 shows an implementation sketch of the operator's steps:
β’ The first step (lines 2 β 4) involves adding auxiliary predicates (neg_x) and clauses when the predicate to be forgotten is part of an even loop, is a fact, or is a missing predicate. β’ The second step (lines 5 and 6) is generating the dual rule of the predicate to forget, being the dual rule the negated version of all the predicate's clauses. β’ The third step (lines 7 and 8) is forgetting the predicate, replacing its appearances with the content of its clauses and its negation with the content of its dual rule. β’ The final step (line 12) is transforming the double negations (not not) into even loops, as s(CASP)
does not explicitly support them. This step is optional.
We have performed an evaluation of f CASP using examples from the literature.
In the first example, we forget predicates in even loops. To conserve the symmetry in answer sets [11], (preserving the predicates not forgotten in the answer sets even when adding additional rules), it is necessary to add additional predicates (neg_x) as strong persistence (SP) cannot be achieved (in some cases) without them [12,8]. Below we can see the result of forgetting p and q, and the answer sets of both the original program and the generated one. As they have the same answer sets (ignoring the forgotten and auxiliary predicates), the programs are equivalent.
To evaluate the practicality of π πΆπ΄ππ , we have defined two (real) use cases in which we use the operator to remove private and confidential information.
In the first use case, we model the Spanish Organic Law 2/2004, May 3, Articles 116 and 117 and the Spanish Constitution Articles 27 and 149.1.30. This legislation establishes the criteria used for assigning public school places in the Comunidad de Madrid, Spain, when the number of applications for a given center is greater than the offer. After applying π πΆπ΄ππ , we can successfully remove the students' medical, socio-economical and gender-based violence related private information while conserving the original model decisions and explainability, complying with the need for transparency required by the applicable regulations such as the recent European AI Act.
In the second use case [13], we propose an automated decision-making system for energy assignment in agricultural cooperatives. In this case, the energy is assigned based on how fairly the workers are paid, pondering their salary and productivity, which are considered confidential and, in some cases, private. After applying forgetting, we can preserve the confidentiality of the stakeholders without affecting the decisions and justifications of the model, crucial to make these answers trustworthy.
In conclusion, we have presented a new forgetting operator, π πΆπ΄ππ , designed to work with goaldirected Answer Set Programs and support dual rules and double negations while being commutative. As potential lines of work for the future, we have identified the extension of the algorithm to support variables and constraints, formally determining and proving π πΆπ΄ππ 's properties, and applying the operator to real use cases.
In the second example, we forget predicates present in double negations. This case cannot be resolved without the use of additional predicates. As we can see on the next example, both the original program and the one generated with π πΆπ΄ππ forgetting p are equivalent. π 2 = Example 4 from [11] {p, q}, {r} 1 p :-not not p. π πΆπ΄ππ (π 2 , {π}) {q}, {r, neg_1} 1 q :-not neg_1. In the third example we forget multiple predicates regardless of the order. [7] {p}, {q} 1 a :-p, q. 2 q :-not p. In the final example, we compare the performance of π πΆπ΄ππ with π π΄πΆ , the operator that is closer to the desired properties. As we can see, π π΄πΆ may generate a program that outputs redundant answers, while the one generated with π πΆπ΄ππ preserves the original count. π 4 = Example 5 from [8] {c} 1 q :-not not q, b. π π΄πΆ (π 4 , {π}).