in our more general setting. Updforget provides a counterexample: if we update by B and then by C using Updforget> we get all the probability measures that give C probability 1; if we update by C and then B, then we get all the probability measures that give B probability 1; if we update by B n C, we get all probability measures that give B n C probability 1. Thus, we add the requirement that updates commute to our list of properties as well. Although P3 is a standard property of conditioning, it is far from innocuous. It can be viewed as encoding an assumption of "no forgetting". Intuitively, in order for updating by B and then C to be the same as updating by B n C, the agent must remember the information in B when he is updating by C. 

It is easy to see that P3 is not satisfied by either Updforget or UpdML' although it is satisfied by the other update rules defined in Section 2. As observed in [Fagin and Halpern 1991; Jaffray 1992], the update rule for belief functions define by Bel(·IB) = 
infPrEPBet Pr(AIB) also does not satisfy P3.7 On the other hand, Dempster's Rule of Conditioning does satisfy P3. Gilboa and Schmeidler [1993] provide sufficient conditions on X that guarantee that UpdML satisfies P3.8 Moreover, they show UpdML(X, B) acts like Dempster's Rule of Conditioning for those sets X that satisfy these conditions. 

We clearly need further postulates to rule out functions besides UpdML and Updfor et· The next postulate says our beliefs don't change it we learn information that we expected to be true all along (i.e., which was given probability 1 by all measures in our current set). This suffices to rule out Updtrivial· 

## P4. Updm(X, B) =X If Pr(B) = 1 For All Pre X.

It is easy to see that P4 is satisfied by Updsubset as well as Updcond and Updconstrain· (Note that the special treatment of Updsubset(Pr, B) in the case that Pr(B) = 1 was necessary to ensure this.) Although P4 is not satisfied by Updclosure> we could modify Updclosure(X, B) in the special case that Pr(B) = 1 for all Pr E X so that it does satisfy P4. We thus need a stronger condition to rule out update functions such as Updclosure· The next postulate, which says that the action of an update function on a set of measures is determined by its action on the individual members of the set, does that. 

7 J affray [1992, Corollary 2) characterizes the restricted circumstances when P3 holds for this update rule. 

8Suppose that X consist of a set of probability measures on M = (W,F). Let fx(A) = min{Pr(A) :PrE X} for A E :F. The Gilboa-Schmeidler conditions say that (1) X 
is convex, (2) X= {PrE b.M : Pr(A);::: fx(A)}, and (3) 
fx(AUB)+ fx (An B);::: fx(A)+ fx(B), for all A, BE :F. 

See [Gilboa and Schmeidler 1993) for the motivation for these conditions. 

As we have seen, Updclosure does not satisfy P5; it acts like Updcond on finite sets, but disagrees with Updcond in general on arbitrary sets. UpdML does not satisfy P5 either. It might seem that once we force the behavior of an update function to depend only on its behavior of singletons, we should be able to appeal immediately to van Fraassen's result. This, however, is not true, because UpdM(Pr, B) can still be an arbitrary set of probability measures. All of the update functions in our examples other than Updclosure and UpdML satisfy P1, P2, and P5. 

It might seem that P5 gives too special a role to the action of Upd on singleton sets. This is not in keeping with the spirit modeling uncertainty by arbitrary sets of probability measures. We can rewrite P5 to avoid mention of singleton sets by requiring instead that Upd commute with arbitrary unions, that is, 

## Updm(Ujejxj, B) = Ujejupdm(Xj, B),

where J is an arbitrary index set. It is easy to see that this postulate is equivalent to P 5 while not giving a special role to singleton sets. We wrote P5 as we did because in fact we need it only for singleton sets. 

Note that it is important to allow the index set J to be arbitrary here. The perhaps more appealing postulate UpdM (X U Y, B) = UpdM (X, B) U UpdM (Y, B) 
(which can be extended by induction to show that Upd commutes with finite unions) is not strong enough to eliminate Updclosure· 
All of the properties we have considered so far are satisfied by Updsubset· We consider here two ways of eliminating Updsubset· Neither is as clean as we would like. 

After introducing the postulates, we discuss possible alternatives. 

One way of eliminating Updsubset is to require that on a singleton argument, Upd returns either a singleton or the empty set.9 More precisely, we have 

## P6'. L Updm(Pr, B)Ls1.

P6' again puts more emphasis on singleton sets than we would like, and seems somewhat strong. A quite different approach to eliminating Updsubset is based on the observation that it is not "continuous": every event in B that has nonzero probability according to Pr (including ones whose probability is negligible) 
will be given full belief (probability 1) in at least one of the post-update measures, while the rest of B (perhaps containing almost all of B's probability according to Pr) is given probability 0. Perhaps there should be some limit on how much the probability of a small event can increase. The next postulate ensures this, by requiring an upper bound on the post-update probability relative to the original conditional probability. 

9We must allow it to return an empty set since UpdM (Pr, B) is required to be 0 if Pr(B) = 0. 