  Hyperproperties are properties of sets of computation traces. In this paper,
we study quantitative hyperproperties, which we define as hyperproperties that
express a bound on the number of traces that may appear in a certain relation.
For example, quantitative non-interference limits the amount of information
about certain secret inputs that is leaked through the observable outputs of a
system. Quantitative non-interference thus bounds the number of traces that
have the same observable input but different observable output. We study
quantitative hyperproperties in the setting of HyperLTL, a temporal logic for
hyperproperties. We show that, while quantitative hyperproperties can be
expressed in HyperLTL, the running time of the HyperLTL model checking
algorithm is, depending on the type of property, exponential or even doubly
exponential in the quantitative bound. We improve this complexity with a new
model checking algorithm based on model-counting. The new algorithm needs only
logarithmic space in the bound and therefore improves, depending on the
property, exponentially or even doubly exponentially over the model checking
algorithm of HyperLTL. In the worst case, the new algorithm needs polynomial
space in the size of the system. Our Max#Sat-based prototype implementation
demonstrates, however, that the counting approach is viable on systems with
nontrivial quantitative information flow requirements such as a passcode
checker.
