Model Theory
Ultraproducts and Łoś's Theorem: Building Models from Averages
Take an infinite family of structures — say, all the finite fields, or an ordered field for each n — glue them together by "voting" with an ultrafilter, and out pops a single new structure that satisfies exactly the first-order sentences a "majority" of the factors satisfy. That is Łoś's theorem (Jerzy Łoś, 1955), and it turns a purely set-theoretic gluing recipe into a machine for constructing models with prescribed properties. Its most famous payoff: an ultraproduct of the real fields ℝ that contains genuine infinitesimals — the hyperreals — and yet obeys every first-order truth about ℝ.
Precisely: for structures (Mᵢ)ᵢ∈I in a language ℒ and an ultrafilter 𝒰 on I, the ultraproduct M = ∏ᵢ Mᵢ / 𝒰 satisfies a formula φ at a tuple [f] if and only if the index set {i ∈ I : Mᵢ ⊨ φ(f(i))} belongs to 𝒰. Truth in the average is truth almost everywhere.
- FieldModel theory / mathematical logic
- First provedJerzy Łoś, 1955
- Key hypothesis𝒰 is an ultrafilter (not merely a filter)
- StatementM ⊨ φ([f]) ⇔ {i : Mᵢ ⊨ φ(f(i))} ∈ 𝒰
- Proof techniqueInduction on formula complexity; ultrafilter closure under ¬, ∧, ∃
- UnlocksCompactness theorem, hyperreals, Ax–Kochen, Keisler–Shelah
Interactive visualization
Press play, or step through manually. The visualization is yours to drive — try it before reading on.
Watch the 60-second explainer
A condensed visual walkthrough — narrated, captioned, under a minute.
The precise statement
Fix a first-order language ℒ, an index set I, and an ℒ-structure Mᵢ for each i ∈ I. Let 𝒰 be an ultrafilter on I: a collection of subsets of I closed under supersets and finite intersections, not containing ∅, and — the crucial extra axiom — such that for every A ⊆ I, either A ∈ 𝒰 or its complement I∖A ∈ 𝒰. Sets in 𝒰 are called large.
On the product ∏ᵢ Mᵢ define f ∼ g iff {i : f(i) = g(i)} ∈ 𝒰. This is an equivalence relation; the ultraproduct M = ∏ᵢ Mᵢ / 𝒰 is the set of classes [f], with relations and functions interpreted coordinatewise on 𝒰-large sets. When all Mᵢ = N, we get the ultrapower Nᴵ/𝒰.
Łoś's theorem. For every ℒ-formula φ(x₁,…,xₙ) and elements [f₁],…,[fₙ] of M,
- M ⊨ φ([f₁],…,[fₙ]) ⟺ {i ∈ I : Mᵢ ⊨ φ(f₁(i),…,fₙ(i))} ∈ 𝒰.
In words: a formula holds in the ultraproduct exactly when it holds in a 𝒰-large set of factors.
The intuition: truth by majority vote
Think of 𝒰 as a finitely-additive {0,1}-valued measure: 𝒰 assigns measure 1 to large sets and 0 to their complements. An ultrafilter is precisely a device that decides every yes/no question about index sets — there are no ties. Each factor Mᵢ casts a vote on whether φ holds at a given tuple, and the ultraproduct declares φ true iff the electorate of "yes" voters is a large set.
Why does this yield a coherent structure rather than mush? Because ultrafilters respect logic. The set of indices where φ ∧ ψ holds is the intersection of the φ-set and the ψ-set, and 𝒰 is closed under intersection. The negation ¬φ holds on the complement, and an ultrafilter puts exactly one of a set and its complement in 𝒰. So the Boolean operations of logic mirror the Boolean structure of 𝒰 exactly.
The picture: you are averaging structures, but averaging with a razor-sharp notion of "almost everywhere" that never returns "maybe." Ordinary product structures lose truth (a product of fields need not be a field); the ultrafilter quotient restores it for all first-order statements.
The mechanism: induction on formula complexity
The proof is an induction on the syntactic structure of φ, and the whole game is which ultrafilter axiom each connective needs.
- Atomic formulas hold by the definition of the interpretations — this is where closure under supersets and the fact that ∼ is 𝒰-defined get used.
- Conjunction φ ∧ ψ: the truth set is Aφ ∩ Aψ. A filter is closed under finite intersection, so both large ⇒ intersection large.
- Negation ¬φ: here you need a genuine ultrafilter. The truth set of ¬φ is I∖Aφ, and the dichotomy "A ∈ 𝒰 or Aᶜ ∈ 𝒰" is exactly what makes ¬φ true in M iff Aφ ∉ 𝒰. A mere filter would leave both undecided.
- Existential ∃y ψ(y): the ⇐ direction picks, for each i in the large truth set, a witness aᵢ ∈ Mᵢ, and the axiom of choice assembles them into a function whose class [a] witnesses ∃y in M.
Every step reduces truth in M to membership in 𝒰. The clever move is not one big trick but the recognition that ultrafilters are the Boolean algebra homomorphism logic secretly wants.
The canonical example: the hyperreals
Take I = ℕ, every factor Mᵢ = ℝ as an ordered field, and any nonprincipal ultrafilter 𝒰 on ℕ (one containing all cofinite sets — its existence needs the axiom of choice via Zorn's lemma). The ultrapower *ℝ = ℝ^ℕ / 𝒰 is the field of hyperreals.
The diagonal map r ↦ [(r, r, r, …)] embeds ℝ into *ℝ, and by Łoś this embedding is elementary: every first-order sentence true of ℝ is true of *ℝ. So *ℝ is a real-closed ordered field — it "looks like" ℝ to first-order eyes.
But now consider ε = [(1, ½, ⅓, ¼, …)]. For each n > 0, the set {k : 1/k < 1/n} is cofinite, hence in 𝒰, so ε < 1/n in *ℝ for every standard n. Thus ε is a positive infinitesimal. Its reciprocal is an infinite element. The order is preserved and first-order faithful, yet *ℝ is non-Archimedean and incomplete — because "Archimedean" and "complete" are not first-order properties. This is the rigorous backbone of Robinson's nonstandard analysis (1966).
Why the hypotheses matter
Filter vs. ultrafilter. Drop the ultra-condition and negation breaks. With the (non-ultra) Fréchet filter of cofinite sets, the truth set of φ might be neither large nor co-large, and the quotient reduced product ∏Mᵢ/F satisfies only the weaker Feferman–Vaught-style preservation for Horn sentences, not full first-order transfer.
Principal vs. nonprincipal. If 𝒰 is principal, generated by a single index i₀ (𝒰 = {A : i₀ ∈ A}), then the ultraproduct is just Mᵢ₀ up to isomorphism — nothing new is built. All the interesting phenomena (infinitesimals, saturation, size blow-up) require a nonprincipal ultrafilter, whose very existence is nonconstructive.
First-order vs. beyond. Łoś transfers first-order sentences only. Each ℝ is Cauchy-complete, but *ℝ is not: completeness quantifies over subsets, so it escapes the theorem. Likewise an ultraproduct of finite fields Fₚ over a nonprincipal 𝒰 is an infinite field of characteristic 0 (each "1+1+…+1 = 0" fails on a cofinite set) — the archetype of the Ax–Kochen theorem on p-adic fields.
What it unlocks
Compactness, for free. The compactness theorem — a set Σ of sentences has a model iff every finite subset does — pops out of Łoś. Index by the finite subsets Δ of Σ; for each Δ pick a model M_Δ ⊨ Δ; let 𝒰 extend the filter generated by the "tails" Δ̂ = {Δ′ : Δ ⊆ Δ′}. Every σ ∈ Σ is true on a large set, so the ultraproduct models all of Σ. This gives a purely algebraic, proof-theory-free route to compactness.
Ultrapowers and saturation. Ultrapowers by suitably incomplete ultrafilters are countably (even κ-) saturated, which is why they realize types and build recursively-saturated and huge homogeneous models.
- Keisler–Shelah (1961/1971): M ≡ N (elementarily equivalent) iff some ultrapowers Mᴵ/𝒰 ≅ Nᴵ/𝒰 are isomorphic — a purely algebraic characterization of first-order equivalence.
- Ax–Kochen (1965): ℚₚ and Fₚ((t)) have the same first-order theory for almost all p, proved by ultraproducts over the primes.
From nonstandard analysis to number theory to measurable cardinals (ultrapowers of the universe V), Łoś's theorem is the load-bearing lemma.
| Property | Preserved in ∏ Mᵢ/𝒰? | Reason / caveat |
|---|---|---|
| First-order sentence true in 𝒰-many Mᵢ | Yes | Direct consequence of Łoś's theorem |
| Being a field / ordered field / group | Yes | Axioms are first-order sentences |
| Being finite (each Mᵢ finite) | No (if 𝒰 nonprincipal, sizes unbounded) | "Finite" is not first-order; ultraproduct is uncountable |
| Being well-ordered / Archimedean | No | Not first-order; hyperreals have infinitesimals |
| Cardinality / completeness (as a metric space) | No | Second-order; ℝ complete but *ℝ is not |
| An elementary substructure (via the diagonal) | Yes — ultrapower M ⪯ Mᴵ/𝒰 | Diagonal embedding is elementary |
Frequently asked questions
Why exactly does the proof need an ultrafilter and not just a filter?
The negation step. In M, ¬φ holds iff φ fails, and φ's truth set is some A ⊆ I. To force ¬φ true in M exactly when A ∉ 𝒰, you need the dichotomy that A ∈ 𝒰 or Aᶜ ∈ 𝒰 — the defining ultra-axiom. A plain filter can leave both A and Aᶜ outside 𝒰, so truth of ¬φ becomes undecided and the biconditional fails. Reduced products by filters only preserve Horn (and more generally certain positive) formulas.
What goes wrong if the ultrafilter is principal?
Nothing goes wrong — but nothing interesting happens either. A principal ultrafilter 𝒰 = {A : i₀ ∈ A} makes the ultraproduct isomorphic to the single factor Mᵢ₀ via [f] ↦ f(i₀). You get no infinitesimals, no cardinality blow-up, no saturation. Every genuinely new model (hyperreals, infinite ultraproducts of finite structures) requires a nonprincipal ultrafilter, and those exist only via the axiom of choice — no nonprincipal ultrafilter on ℕ is explicitly definable.
Does the construction need the axiom of choice?
Yes, in two places. The existence of any nonprincipal ultrafilter follows from the ultrafilter lemma (a weak form of choice, strictly weaker than full AC). Separately, the existential-quantifier step in Łoś's proof selects a witness in each factor and bundles them into one function, which uses choice. Over ZF alone one cannot in general build the hyperreals or prove compactness this way.
Why isn't the hyperreal field *ℝ complete if it's elementarily equivalent to ℝ?
Completeness — every bounded set has a least upper bound — quantifies over subsets of the field, so it is a second-order property, not first-order. Łoś's theorem only transfers first-order sentences. First-order consequences of completeness that ℝ satisfies (like being real-closed) do transfer, but the full least-upper-bound property does not, and indeed the set of infinitesimals in *ℝ is bounded above yet has no supremum.
How does compactness follow from Łoś's theorem?
Given a theory Σ every finite subset of which has a model, index by finite subsets Δ ⊆ Σ and choose M_Δ ⊨ Δ. For each sentence σ ∈ Σ, the index set of Δ's containing σ has the finite intersection property, so these sets generate a proper filter; extend it to an ultrafilter 𝒰. Then each σ is true on a 𝒰-large set of factors, so by Łoś the ultraproduct ∏ M_Δ / 𝒰 satisfies all of Σ. This is the standard model-theoretic (as opposed to syntactic) proof of compactness.
What is an ultrapower versus an ultraproduct, and what is the diagonal embedding?
An ultraproduct glues possibly different structures Mᵢ; an ultrapower is the special case where all factors are the same structure N, giving Nᴵ/𝒰. The diagonal map d: N → Nᴵ/𝒰 sends a ↦ [(a, a, a, …)]. By Łoś's theorem d is an elementary embedding: N ⪯ Nᴵ/𝒰, meaning N and its ultrapower satisfy the same first-order formulas about the image of d. This is why ultrapowers are the engine for saturation and for the Keisler–Shelah characterization of elementary equivalence.