{"id":"2d675eab-8aa9-4191-9d3c-bb586d867299","arxiv_id":"1908.06353","paper_version":1,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"A sufficient-condition algorithm certifies boundedness of a closed-loop neural-network control system under l-infinity-bounded persistent adversarial perturbation, without requiring Lipschitz continuity of the policy.","lead":"This paper gives a method to certify that a neural network controller keeps a physical system inside safety limits even when an adversary continuously perturbs the sensor readings. It combines static neural-network robustness tools with robust control theory using invariant sets, and also presents an attack that finds failures Monte-Carlo simulation misses.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The invariant-set theorem is sound, but for learned unknown plants the bootstrap uncertainty envelope is not a formal bound, so the advertised certificate is not a guarantee.","rationale":"The reader's verdict is CONDITIONAL, and I agree with the core conditional: the framework in Theorem 1 is a valid sufficient-condition certificate, and the proof of Theorem 1 holds. The most load-bearing unresolved issue is the empirical nature of the uncertainty envelope, because the paper's broader claim is that the method certifies learned models of unknown nonlinear plants. Unlike the baseline comparison issue (a lower-bound Lipschitz constant) or the unproven strictness claim in Theorem 2, the bootstrap envelope directly enters the certificate: if it fails, condition 2 of Theorem 1 fails and no guarantee remains. The proposed test settles the concern because the cart-pole model is known, so the true residual can be computed exactly over the certified box. I therefore keep the verdict at CONDITIONAL; the concern does not invalidate the theorem, but it should be resolved or the wording softened before the advertised certificate is taken as a formal safety guarantee for the real plant. The reader identified the same empirical uncertainty issue; I weight it as the single load-bearing concern rather than treating the K0 availability as equally load-bearing, hence 'partial' agreement.","tokens_in":18196,"tokens_out":7649,"duration_ms":78315,"concrete_test":"Take the N=100 learned model from Figure 4a with its certified box (xbar, ybar, ubar), and use the known nonlinear cart-pole equations in Appendix B to compute the exact residual delta(t) = x(t+1) - A(0)x(t) - B(0)u(t) over a dense grid of (x,u) covering the certified box. Check elementwise whether max over the grid of |delta| is <= Gamma_Delta |[x;u]|. If any grid point violates the inequality, or if the paper's attack (14) produces a trajectory inside the box whose residual violates it, then the bootstrap envelope is not a valid certificate and the Experiment II claim must be downgraded to an empirical validation rather than a safety guarantee.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The theoretical result in Theorem 1 is internally consistent: the induction in Appendix A verifies that the box {|y| ≤ ybar, |u| ≤ ubar, |alpha| ≤ alphabar, |delta| ≤ deltabar} is positively invariant under the three stated conditions. The load-bearing gap is in the bridge from that theorem to the paper's advertised application to unknown nonlinear plants (Experiment II, Section 5.2, Appendix B). Condition 2 of Theorem 1 requires a deterministic input-output property of the true uncertainty block: |alpha[k]| ≤ alphabar for k ≤ t must imply |delta[t]| ≤ deltabar. In the learned-model pipeline, deltabar is set to Gamma_Delta alpharef with Gamma_Delta = [Delta_A Delta_B] obtained by taking the elementwise maximum deviation over 100 bootstrap estimates (A(j), B(j)) from the nominal model (A(0), B(0)) in equations (29)-(30). The text itself states only that 'Empirically, there is high probability that the modeling error is bounded by Delta.' This is a statistical quantity, not a worst-case bound on the true nonlinear residual delta(t) = x(t+1) - A(0)x(t) - B(0)u(t). If the actual residual exceeds the bootstrap envelope for any state/action pair reachable under an admissible adversarial sequence, the invariance argument can fail and the claimed |x| <= xbar, |y| <= ybar, |u| <= ubar certificate for the real plant is void. The availability of a stabilizing K0 is also an assumption, acknowledged as NP-hard in general, but it is stated as such rather than a hidden gap.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper proposes a framework for certifying the boundedness of a feedback loop comprising a linear plant (possibly with an uncertainty block) and a neural network control policy against persistent l∞-norm-bounded adversarial perturbations. The central theoretical contribution is Theorem 1, which gives three sufficient conditions — a box-type input-output certificate for the neural network policy, a gain-type input-output property of the uncertainty block, and a set of feedback inequalities on the abs(Φ) matrices — under which the box {|y| ≤ ȳ, |u| ≤ ū, |α| ≤ ᾱ, |δ| ≤ δ̄} is positively invariant, so that state, measurement, and control remain bounded for all time (with zero initial condition; Section 3.2). Theorem 2 proves that the small-gain/Lipschitz conditions of the robust-control baseline Lemma 1 imply the conditions of Theorem 1. Algorithm 1 searches for the invariant box by iterating the neural-network certificate and the closed-loop transfer matrices, with an unstable-plant extension via a stabilizing linear gain K0 (Section 3.3). A heuristic l∞ attack is also proposed (Section 4.2). Experiments on a cart-pole example compare the certificate with a Lipschitz-based baseline (claiming a 5.3× improvement), demonstrate an attack that far exceeds Monte-Carlo-discovered deviations, and apply the algorithm to learned nonlinear models and to a quantized non-Lipschitz policy.","tokens_in":18512,"tokens_out":18194,"duration_ms":170042,"significance":"The invariant-set criterion in Theorem 1 is a clean and correct sufficient condition, and it is a genuine conceptual advance to combine static neural-network certifiers with robust control via positive invariance rather than through Lipschitz or Lyapunov assumptions; the framework therefore covers discontinuous and quantized policies. The proof of Theorem 1 is complete, the construction in Theorem 2 is algebraically valid, and the paper is unusually transparent: footnote 4 explicitly concedes that the Lipschitz baseline used in the experiments is not a safety certificate, and Section 5.2 concedes that the bootstrap uncertainty envelope is only an 'empirically high probability' bound. The attack algorithm is simple, independent of the certificate, and experimentally striking (a 31.4 deviation versus 5.2 under 10^6 Monte-Carlo steps). If the two load-bearing empirical gaps identified below are closed or honestly reframed, the paper would be a useful contribution to neural-network control verification. The theorems are not machine-checked, but the induction proof of Theorem 1 is short enough to be verified by hand.","major_comments":[{"comment":"The paper's headline quantitative claim ('5.3× better' in §5.1, '5 times better' in the abstract) compares Algorithm 1 to the robust-control baseline of Lemma 1 whose local Lipschitz constant γπ is obtained by a sampling-based approach. Footnote 4 concedes that this gives only a lower bound on γπ and that 'Strictly speaking, since it is only a lower bound, Lemma 1 does not offer a safety certificate.' A lower bound on γπ relaxes conditions (10a)–(10c), so the red curve in Figure 2a is optimistically biased relative to any valid Lipschitz-based certificate: the baseline as plotted is not a certificate, and the experiment does not establish the advertised comparison 'to certify the robustness' with a traditional method. Either re-run the comparison with a valid upper bound on the local Lipschitz constant (e.g., the method of [37], which the paper cites), or relabel the comparison as a benchmark against a non-rigorous baseline and adjust the abstract accordingly.","section":"§5.1, Fig. 2a, footnote 4"},{"comment":"For the learned-model experiment, condition 2 of Theorem 1 — the input-output property of the uncertainty block — is instantiated as |δ[t]| ≤ Γ∆ |α[t]| with Γ∆ = [∆A, ∆B] chosen as the element-wise maximum deviation over 100 bootstrap fits in (29)–(30). This quantity brackets the spread of the bootstrap estimates (A(j), B(j)) around the nominal fit (A(0), B(0)); it does not bound the true residual δ[t] = x[t+1] − A(0)x[t] − B(0)u[t] of the nonlinear plant, and it does not even account for the bias of the nominal linear model relative to the nonlinear dynamics. Consequently, for the actual unknown plant, the safety requirement (8) is not certified, and the text's own caveat ('Empirically, there is high probability that the modeling error is bounded by Δ') confirms that the required worst-case hypothesis is not verified. Since the abstract and the contribution list advertise certification on learned models of unknown, unstable, nonlinear dynamics, this gap is load-bearing. The experiment should either use a formal model-bounding procedure of the type cited from [27], or it should be reframed and reworded as an empirical demonstration under a statistically estimated envelope, with the word 'certificate' restricted to the nominal model plus the stated envelope.","section":"§5.2, Appendix B, Eqs. (29)–(30); Theorem 1, condition 2"}],"minor_comments":[{"comment":"The improvement factor appears as '5 times' in the abstract and as '5.3 times' in the text; standardize the number and state explicitly that the comparison point is xlim = 50.","section":"Abstract; §5.1; Fig. 2a"},{"comment":"The expression '||Φyww||_{l∞}' should read '||Φyw w||_{l∞}' (the l∞ norm of the disturbance term); as typeset, it is confusing.","section":"Appendix A, proof of Lemma 1, Eq. (17d)"},{"comment":"The claim that Theorem 1 'can be applied on a strictly larger class of problems than that of Lemma 1' is stronger than what is proven; Theorem 2 establishes only the inclusion of the condition sets. Either prove the strictness (e.g., with an explicit policy whose box certificate is non-vacuous while the Lipschitz bound fails) or soften the claim to an inclusion.","section":"§3.2, after Theorem 2"},{"comment":"Clarify which bound — ū on the full policy output or ū0 on the residual policy — enters the feedback inequalities in line 7 and which one is checked against the control limit ulim; the text currently uses both without precisely defining their relationship for the unstable-plant case.","section":"Algorithm 1, §3.3"},{"comment":"The unstable-plant extension is conditional on finding K0 with ρ(A + BK0C) < 1, an acknowledged NP-hard problem; the authors should report the achieved spectral radius in the cart-pole experiments so the reader can confirm the condition is actually met.","section":"§3.3, experiment setup"}],"recommendation":"major_revision","confidential_remarks":"To the editor: the paper's own footnotes contain the material for two of the major criticisms — the baseline comparison is admittedly not a certificate, and the learned-model envelope is admittedly statistical. The authors are candid, and the underlying Theorem 1 is sound; the main task for revision is to align the abstract and headline claims with these conceded limitations, either by strengthening the experiments or by weakening the claims. The novelty claim is appropriately hedged as 'to our best knowledge.' I judge the paper publishable after a major revision, but the abstract must not ship with '5 times better' and 'certificate on learned models' as currently stated."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nHere's my read on Wang, Weng, Daniel (1908.06353). The central idea is clean: take an off-the-shelf NN output-set certifier (ReLU bound propagation, etc.), use it to bound the policy output on a measurement box, combine that with an L1/gain-bound model of uncertainty, and close the loop with a positive-invariance argument. Theorem 1 is exactly this, and the induction proof in Appendix A works. Removing the Lipschitz assumption matters in practice—quantized or otherwise discontinuous policies are not pathological, and the cart-pole experiment with a quantized policy shows the framework still certifies bounds.\n\nThe constructive search in Algorithm 1 is reasonable, and the attack rule (14) is a nice byproduct: simple, model-based, and clearly beats 1M random simulations at finding violating trajectories. The paper is honest about the limits of Monte-Carlo safety evaluation.\n\nNow the soft spots, in order of real weight. First, the headline claim—'5.3x better than a Lipschitz-based method'—compares against a baseline whose Lipschitz constant is a lower bound obtained by sampling. The paper itself says, in the footnote on page 9, that 'Lemma 1 does not offer a safety certificate' in that setting. So the blue-vs-red comparison in Figure 2a is really 'our upper bound vs. a non-certificate lower bound'; the gap is persuasive but the claimed '5.3x larger attack level' is not a fair comparison between two valid certificates. This should be restated.\n\nSecond, the data-driven uncertainty set in Experiment II: Gamma_Delta is the elementwise max deviation over 100 bootstrap fits. That gives a statistical envelope, not a worst-case bound on the true nonlinear residual. The text only says 'empirically, there is high probability' the modeling error is bounded. Consequently, the certificate for the learned model is conditional on the envelope holding for all reachable (x,u); nothing in the paper guarantees that. The framework itself is sound—if a true Gamma_Delta existed, Theorem 1 applies—but the experimental instantiation does not establish a worst-case certificate for a real nonlinear plant.\n\nThird, Theorem 2's claim that Lemma 1's conditions imply Theorem 1's is proved in the appendix, and the algebra looks right, but the 'strictly larger class' strengthening is not quantified. That's minor.\n\nWho benefits: anyone working on verification of NN policies for safety-critical control; the paper gives a clean template and a strong attack baseline. Is it worth serious refereeing? Yes. The core framework is novel, useful, and the proofs hold. I'd ask for revision that rewrites the 5x claim honestly and either removes the word 'certificate' from the learned-model experiment or adds a formal uncertainty bound with a real guarantee.\n\nRecommendation: engage, send to review, and push for those two clarifications.","headline":"A genuinely useful bridge between static NN verification and invariant-set control; core theorem holds, but the 5x comparison and learned-model certificate need honest caveats.","tokens_in":19021,"tokens_out":2675,"would_cite":true,"duration_ms":25135,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["93B35","93D09","68T07"],"pacs":[],"model":"deepseek-v4-flash","headline":"Neural network policies in feedback loops can be certified to respect state and control bounds against every persistent $\\ell_\\infty$-bounded adversarial perturbation, with no Lipschitz or continuity assumption.","keywords":["neural network verification","adversarial perturbation","closed-loop control","positively invariant set","robust control","l-infinity norm","persistent attack","cart-pole control"],"falsifier":"Run the true nonlinear cart-pole plant, not the nominal learned model, with the adversarial sequence from (14) at the certified attack level and check whether the pole angle ever leaves $\\bar{x}$; if it does, the bootstrap uncertainty envelope was not conservative enough. A cheaper check is to record whether fresh rollouts of the true plant ever violate $|\\delta[t]| \\leq \\Gamma_\\Delta |\\alpha[t]|$ inside the certified box.","tokens_in":17967,"feed_emoji":"🛡️","tokens_out":10469,"duration_ms":94550,"temperature":0.7,"pith_summary":"This paper tries to establish that the safety of a neural-network control policy inside a feedback loop can be certified against adversarial disturbances that persist forever, not just against one-shot input corruptions. The authors combine static neural-network verification, which checks what a network can output on a box of inputs, with robust control arguments that track worst-case signal bounds through the loop. The end product is a sufficient condition and an iterative algorithm that output a certified box: if the attack is bounded in $\\ell_\\infty$-norm, then the state, measurement, and control action provably stay inside user-specified limits for every time step. The authors also construct an attack sequence that finds violations far larger than exhaustive Monte-Carlo simulation can, which motivates needing the certificate in the first place.","feed_headline":"Neural control loops get hard safety bounds under persistent attacks","feed_subtitle":"By finding a positively invariant set, the method bounds state and control forever without Lipschitz assumptions.","key_machinery":"The load-bearing object is the positively invariant set $\\mathcal{I} = \\{(y,u,\\alpha,\\delta): |y| \\preceq \\bar{y},\\, |u| \\preceq \\bar{u},\\, |\\alpha| \\preceq \\bar{\\alpha},\\, |\\delta| \\preceq \\bar{\\delta}\\}$ for the closed-loop dynamics. The mechanism that makes it invariant is the absolute transfer-matrix operator $\\mathrm{abs}(\\Phi) = \\sum_{t=0}^\\infty |\\Phi[t]|$, applied to the input-output maps $y = \\Phi_{yu}u + \\Phi_{yw}w + \\Phi_{y\\delta}\\delta$ and $\\alpha = \\Phi_{\\alpha u}u + \\Phi_{\\alpha w}w + \\Phi_{\\alpha \\delta}\\delta$. Because $\\mathrm{abs}$ sums the absolute impulse response, the triangle inequality turns any signal bound into a one-shot worst-case convolution bound, and the feedback inequalities in Theorem 1 close the loop: if the box contains the current signals, the next signals stay inside it. The static neural-network certificate supplies the box relation between $y$ and $u$; the uncertainty model supplies the box relation between $\\alpha$ and $\\delta$.","core_discovery":"The paper's central claim is Theorem 1. For a discrete-time LTI plant connected to a static neural-network policy and a stable norm-bounded uncertainty block, suppose one can find positive vectors $\\bar{y}, \\bar{u}, \\bar{\\alpha}, \\bar{\\delta}$ such that a static verifier certifies $|u| \\preceq \\bar{u}$ on the input box $|y| \\preceq \\bar{y}$, the uncertainty block maps any signal with $|\\alpha[k]| \\preceq \\bar{\\alpha}$ for $k \\le t$ to $|\\delta[t]| \\preceq \\bar{\\delta}$, and the feedback inequalities $\\mathrm{abs}(\\Phi_{yw})\\bar{w} + \\mathrm{abs}(\\Phi_{yu})\\bar{u} + \\mathrm{abs}(\\Phi_{y\\delta})\\bar{\\delta} \\preceq \\bar{y}$ and $\\mathrm{abs}(\\Phi_{\\alpha w})\\bar{w} + \\mathrm{abs}(\\Phi_{\\alpha u})\\bar{u} + \\mathrm{abs}(\\Phi_{\\alpha \\delta})\\bar{\\delta} \\preceq \\bar{\\alpha}$ hold. Then $|y[t]| \\preceq \\bar{y}$, $|u[t]| \\preceq \\bar{u}$, $|\\alpha[t]| \\preceq \\bar{\\alpha}$, $|\\delta[t]| \\preceq \\bar{\\delta}$, and $|x[t]| \\preceq \\bar{x}$ hold for all $t \\ge 0$, with $\\bar{x} = \\mathrm{abs}(\\Phi_{xw})\\bar{w} + \\mathrm{abs}(\\Phi_{xu})\\bar{u} + \\mathrm{abs}(\\Phi_{x\\delta})\\bar{\\delta}$. The proof is an induction that the box is positively invariant, so no differentiability or continuity of the policy is needed.","pith_inferences":["The box certificate only needs a sound input-output box for the policy, so any verifier that emits such a box should slot into Algorithm 1; this is an interface-level consequence rather than an experimental claim in the paper.","The paper's attack ignores the $u_0$ and $\\delta$ terms when choosing $w$, so a richer attack that optimizes $w$ with those terms included would likely shrink the gap between the certified safe region and the discovered unsafe region.","A finite-sample probabilistic replacement for the bootstrap uncertainty envelope, for instance a concentration guarantee over the plant-estimation error, would turn the learned-model certificate from an empirical over-approximation into a guarantee with stated confidence.","The same invariant-set argument is stated for vector signals, so the one-dimensional pole-angle experiment is a demonstration rather than the method's limit; certifying multi-dimensional attacks would use exactly the same inequalities."],"forward_implications":["Certified safety holds for all $t \\ge 0$ rather than a finite horizon, and the certificate requires no global Lipschitz constant, so quantized or discontinuous policies are covered whenever a box input-output certificate for the network exists.","Theorem 2 makes the Lipschitz-based small-gain condition a special case of the new condition, and the cart-pole experiment shows the new certificate remains valid at attack levels about five times larger than the Lipschitz baseline can certify.","On an unstable plant, the linear approximation $K_0$ only needs to stabilize the nominal closed loop; the residual policy, whether differentiable or not, is handled by the same invariant-box machinery.","The attack rule $w_j[t] = \\mathrm{sign}((\\Phi_{xw}[T-t])_{ij})$ exposes worst-case state deviations that exhaustive Monte-Carlo simulation at the same attack level misses, so the robustness of such control loops cannot be established by simulation alone.","When the plant model is learned, a conservative elementwise uncertainty bound $\\Gamma_\\Delta$ built from bootstrap samples gives certificates that approach the true-model certificate as the number of episodes grows."],"supporting_citations":[{"why":"Supplies the static neural-network certification used in Algorithm 1 to bound the residual policy output over the current input box.","marker":"[9]"},{"why":"Another neural-network certifier the paper invokes for the same box input-output relation, showing the algorithm is agnostic to the choice of static verifier.","marker":"[12]"},{"why":"Defines the $\\ell_\\infty$-to-$\\ell_\\infty$ $L_1$ system norm that underlies both the Lipschitz baseline and the absolute-transfer bounds.","marker":"[24]"},{"why":"Provides the robust-control and $H_\\infty$ background for the small-gain argument that the new theorem embeds.","marker":"[25]"},{"why":"Contributes the data-driven model-learning procedure whose bootstrap uncertainty envelope supplies $\\Gamma_\\Delta$ for the learned-model certificate.","marker":"[27]"},{"why":"Gives the global small-gain input-output stability result that the paper compares with and extends.","marker":"[29]"},{"why":"Supplies the local-stability lemma used to justify choosing $K_0$ as the Jacobian of the policy at the origin for unstable plants.","marker":"[31]"},{"why":"Supports the remark that static output feedback stabilization can be NP-hard, clarifying the role of the assumed stabilizing gain $K_0$.","marker":"[32]"}],"fun_headline_variants":["Invariant-set proof certifies neural control under attacks","Neural policy safety verified without Lipschitz assumptions","Bounded attacks on NN controllers: new certificate method","5x better than Lipschitz for certifying neural control","Persistent adversarial perturbations neutralized by invariant set"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"Everything in the practical learned-model certificate rests on the elementwise modeling-error bound $|\\delta[t]| \\le \\Gamma_\\Delta |\\alpha[t]|$; in Experiment II that bound is the maximum deviation over 100 bootstrap samples rather than a proof, so a plant that escapes that envelope can invalidate the certificate, and for unstable plants the argument also presupposes a stabilizing linear output-feedback gain.","fun_headline_variants_meta":{"raw":{"variants":["Invariant-set proof certifies neural control under attacks","Neural policy safety verified without Lipschitz assumptions","Bounded attacks on NN controllers: new certificate method","5x better than Lipschitz for certifying neural control","Persistent adversarial perturbations neutralized by invariant set"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.00125,"raw_usage":{"total_tokens":5217,"prompt_tokens":1126,"completion_tokens":4091,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":742,"completion_tokens_details":{"reasoning_tokens":4014}},"tokens_in":742,"tokens_out":4091,"duration_ms":24870,"temperature":1.0,"reasoning_tokens":4014,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-14T12:48:22.417105+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the true nonlinear cart-pole plant, not the nominal learned model, with the adversarial sequence from (14) at the certified attack level and check whether the pole angle ever leaves $\\bar{x}$; if it does, the bootstrap uncertainty envelope was not conservative enough. A cheaper check is to record whether fresh rollouts of the true plant ever violate $|\\delta[t]| \\leq \\Gamma_\\Delta |\\alpha[t]|$ inside the certified box.","supporting_citations":[{"cited_title":"Towards fast computation of certified robustness for relu networks,","cited_arxiv_id":null,"evidence_quote":"Supplies the static neural-network certification used in Algorithm 1 to bound the residual policy output over the current input box."},{"cited_title":"Cnn-cert: An efficient framework for certifying robustness of convolutional neural networks,","cited_arxiv_id":null,"evidence_quote":"Another neural-network certifier the paper invokes for the same box input-output relation, showing the algorithm is agnostic to the choice of static verifier."},{"cited_title":"l1-optimal feedback controllers for mimo discrete-time systems,","cited_arxiv_id":null,"evidence_quote":"Defines the $\\ell_\\infty$-to-$\\ell_\\infty$ $L_1$ system norm that underlies both the Lipschitz baseline and the absolute-transfer bounds."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides the robust-control and $H_\\infty$ background for the small-gain argument that the new theorem embeds."},{"cited_title":"Performance robustness of discrete-time systems with structured uncertainty,","cited_arxiv_id":null,"evidence_quote":"Gives the global small-gain input-output stability result that the paper compares with and extends."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the local-stability lemma used to justify choosing $K_0$ as the Jacobian of the policy at the origin for unstable plants."},{"cited_title":"Np-hardness of some linear control design problems,","cited_arxiv_id":null,"evidence_quote":"Supports the remark that static output feedback stabilization can be NP-hard, clarifying the role of the assumed stabilizing gain $K_0$."}],"review_version":1}