{"id":"2354d74e-f7c7-4518-a23f-1ca7b510c238","arxiv_id":"2412.03892","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":6,"one_line_summary":"A two-trajectory data-driven method constructs a symbolic abstraction and a formal alternating simulation certificate, enabling controller refinement for unknown polynomial systems.","lead":"This paper develops a way to control an unknown nonlinear system using just two recorded trajectories: it builds a simplified discrete model and proves a controller for that model also works on the real system. The significance is that it avoids identifying the system equations and avoids scenario-based methods that need many independent experiments.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Theorem 3.4 never verifies that the designed interface map u lies in the constrained input set U, so the ASF and the epsilon-approximate relation are not established for the bounded U used in the case study.","rationale":"Reading the proof of Theorem 3.4 in full, the algebraic derivation is internally coherent: given Y1, Y2, Theta satisfying (3.8a)-(3.8e), the chain using Lemma 3.1, Cauchy-Schwarz, Young's inequality, and the Schur complement yields the desired inequality. The reader's concern about feasibility of conditions (3.8a)-(3.8d) is legitimate and important, but I see a sharper technical gap in the theorem's own statement: Definition 2.4 requires the chosen input u to belong to the admissible set U. The proof displays a particular u and derives the inequality for it, but admissibility is never checked. With U a strict subset of R^m, this is a correctness issue, not merely an applicability concern. The case study uses a bounded U and an interface with coefficients large enough to leave U over the state grid; no range verification is provided. This concern is concrete and directly testable, and it affects the central claim that a hybrid controller with formal guarantees can be synthesized. The Section 2.5 issue that symbolic-model construction requires querying all discrete state-input pairs also undermines the 'just two trajectories' headline, but the input-admissibility gap is the most precise weakness in the main theorem. Since the reader already listed the input constraint among their concerns, this is a refinement of the existing verdict rather than a wholly new objection; the CONDITIONAL verdict remains appropriate pending the proposed check.","tokens_in":14850,"tokens_out":12475,"duration_ms":110567,"concrete_test":"Evaluate the interface map (4.2) over a fine grid, or via global optimization, of x, xhat in [-0.5, 0.5]^2 and uhat in [-2.5, 2.5], computing the maximum absolute value of u. If max |u| > 2.5, then for those arguments Theorem 3.4 does not establish the existence of a feasible input in U, and the reported epsilon = 0.1831 plus the safety and reach-while-avoid guarantees are not formally supported for the constrained U. If the maximum is within U, report that bound and add a verification step to Theorem 3.4; otherwise, add an explicit SOS constraint that bounds the interface map over the relevant compact sets, or restrict the theorem to U = R^m.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Definition 2.4 requires that for every x in X, xhat in Xhat, and uhat in Uhat there exists u in U satisfying inequality (2.5b). Theorem 3.4 proposes the specific interface u = I Y1(x) P x - Ihat Y2(xhat) P xhat + uhat and proves the inequality for this algebraic u, but it never proves u is in U. Since U is a constraint set -- in Section 4, U = [-2.5, 2.5] -- not the whole R^m, the proposed u can lie outside U. When it does, condition (2.5b) is not verified for that (x, xhat, uhat), so S is not proven to be an ASF, and the epsilon bound from Theorem 2.7 and the resulting correctness guarantees do not follow. This is not a purely formal caveat: the interface in (4.2) contains the term 4.9773(xhat2 - x2), whose range over [-0.5, 0.5]^2 already gives values up to about 4.98, exceeding the input bound before adding uhat and the remaining terms. No range check, clipping argument, or additional SOS constraint enforcing u in U is reported. The theorem could be repaired by adding an explicit admissibility condition on Y1, Y2 over X x Xhat x Uhat, or by assuming U = R^m, but as stated this is a gap in the central correctness argument.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper proposes a data-driven abstraction-based control framework for unknown discrete-time input-affine nonlinear polynomial systems (dt-IANSP). The authors claim that using only two input-state trajectories, together with a rank condition ensuring persistent excitation, one can construct a data-driven symbolic model, an alternating simulation function (ASF), and a hybrid interface controller. The main result, Theorem 3.4, gives SOS conditions under which a quadratic function S(x,xhat) = (x-xhat)^T P (x-xhat) is an ASF from the symbolic model to the unknown system, with a data-based interface map. The paper then applies Theorem 2.7 to obtain an epsilon-approximate alternating simulation relation and demonstrates the approach on a safety and a reach-while-avoid case study.","tokens_in":15135,"tokens_out":5174,"duration_ms":49026,"significance":"If the central claim held, the paper would be a significant advance over scenario-based data-driven abstraction methods that require large numbers of i.i.d. samples, since it would use only two finite-length trajectories. The data-based representation in Lemma 3.1 is elegant, and the reduction of ASF construction to an SOS program is concrete and aligns with existing tools. The derivation of Theorem 3.4 is internally coherent conditional on the stated conditions. However, the significance is contingent on closing a major gap: the interface map is never shown to take values in the admissible input set U, and the 'just two trajectories' framing is contradicted by the symbolic-model construction in Section 2.5, which requires querying the unknown system at every discrete state/input pair.","major_comments":[{"comment":"The theorem proves inequality (2.5b) for the algebraic interface map u = I Y1(x) P x - Ihat Y2(xhat) P xhat + uhat, but it never proves that this u belongs to the admissible input set U. Definition 2.4 requires the existence of u in U for every (x,xhat,uhat) in X x Xhat x Uhat. When U is a proper subset of R^m, as it is in the case study (U=[-2.5,2.5]), the proposed u can leave U: the term -4.9773 x2 + 4.9773 xhat2 in (4.2) alone reaches 4.9773 for x2=-0.5 and xhat2=0.5, already exceeding the bound before adding the remaining terms. Consequently, Theorem 3.4 does not establish an ASF as defined, and the epsilon-bound and the correctness guarantees from Theorem 2.7 do not follow. A repair would require either an explicit SOS constraint enforcing u in U over X x Xhat x Uhat, or an explicit assumption that U = R^m.","section":"Section 3, Theorem 3.4"},{"comment":"The proposed data-driven symbolic model is constructed by querying the unknown system at every discrete state/input pair (xhat,uhat) to compute AM(xhat)+B uhat and then apply the quantization map Pi. This requires on the order of |Xhat|*|Uhat| separate experiments. The two trajectories collected in Section 3 are used only for the ASF conditions; they are not sufficient to build the symbolic model. This directly contradicts the abstract and Problem 2.9's claim of 'just two trajectories,' and it overstates the data efficiency of the framework. The paper needs to either clarify that the symbolic-model construction is a separate data-collection phase or rescope the contribution to the ASF design given a preconstructed symbolic model.","section":"Section 2.5"},{"comment":"The rank condition in Remark 3.2 ensures existence of some functions G1 and G2 satisfying the individual equalities M G1 = Upsilon(x) and Mhat G2 = Upsilon(xhat). However, Theorem 3.4 requires the much stronger coupled conditions: the same constant matrix Xi appears in both (3.8a) and (3.8b), the same constant Theta appears in both (3.8c) and (3.8d), and moreover Y1 and Y2 are related to G1 and G2 via P = Xi^{-1}. The paper provides no general feasibility test for these coupled equalities beyond attempting the SOS program, and the rank condition alone does not imply their satisfiability. This is a load-bearing assumption of the main theorem that is not characterized; the claim of a systematic data-driven design is therefore not fully supported.","section":"Section 3, conditions (3.8a)-(3.8d)"},{"comment":"The inequality (3.13) applies the quantization bound (2.4) to the point AM(xhat)+B uhat, yielding ||Pi(AM(xhat)+B uhat) - (AM(xhat)+B uhat)|| <= delta. This is valid only if AM(xhat)+B uhat belongs to X, the domain of Pi. The paper does not state this assumption. In the case study, X is the safe set [-0.5,0.5]^2 and the open-loop dynamics can leave X during data collection, so the quantization map may be applied outside its domain. This is a technical gap in the correctness argument of Theorem 3.4 and in the construction of Section 2.5.","section":"Section 3, proof of Theorem 3.4"}],"minor_comments":[{"comment":"The rendering of boldface notation is badly mangled: for example, O, I, and O+ appear as repeated characters such as 'OOO', 'III', and 'O+O+O+', and the hat versions appear as 'ˆOˆOˆO'. This severely harms readability and should be fixed.","section":"Throughout"},{"comment":"Remark 2.5 refers to 'u = uˆu(x, xhat, uhat)', which is a typo; it should read 'u = u(x, xhat, uhat)' or similar.","section":"Section 2.4, Definition 2.4"},{"comment":"The assertion that the same S is also an ASF from Sigma to Sigma-hat is stated with only a brief proof sketch. Given that the main theorem does not verify input admissibility (see Major Comment 1), the bisimulation claim requires more justification.","section":"Section 3.5, Remark 3.6"},{"comment":"After computing epsilon = 0.1831, the text states the error is always lower than the reported epsilon, but Figure 1b's axis labels are not described; the figure should include an explicit comparison to the epsilon line for clarity.","section":"Section 4"},{"comment":"The related-work discussion is thorough, but the comparison to scenario-based methods would be strengthened by quantifying the number of trajectories needed in prior work versus the two trajectories claimed here, given the additional queries required to build the symbolic model.","section":"Section 1"}],"recommendation":"major_revision","confidential_remarks":"The paper has a promising core idea—using finite-length trajectory data to construct an ASF for abstraction-based control—and the algebraic derivation in Lemma 3.1 is a nice contribution. However, the main theorem's gap concerning input admissibility is serious and directly impacts the validity of the correctness guarantees; the 'just two trajectories' claim is also misleading given the symbolic-model construction requirements. These issues are fixable in principle (e.g., by adding an admissibility constraint to the SOS program and rephrasing the data-efficiency claims), but they require nontrivial changes to the paper's statements and validation. I recommend major revision rather than rejection."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"This is the first trajectory-based (non-i.i.d.) construction of finite abstractions and alternating simulation functions for unknown polynomial systems. The core idea, borrowing the data-based representation trick from GDPT21 and turning it into SOS-verifiable conditions for an ASF, is genuinely new. The proof of Theorem 3.4 is internally coherent: if (3.8a)-(3.8e) hold, the quadratic form is indeed an ASF with rho=0, and the closeness bound follows. Lemma 3.1 is a clean way to avoid explicit identification. The case study is plausible, and the reported epsilon=0.1831 is consistent with the theorem.\n\nNow the soft spots, in order of seriousness.\n\nFirst, the headline \"just two trajectories\" does not hold up. Section 2.5 constructs the symbolic model by querying the unknown system at every discrete state/input pair, which is far more than two trajectories. The two trajectories are used to design the ASF and interface, but the abstraction itself requires many additional evaluations. The title and abstract overstate the data requirement.\n\nSecond, and more serious for correctness: Theorem 3.4 never verifies that the proposed interface u = I Y1 P x - Ihat Y2 P xhat + uhat lies in the input constraint set U. Definition 2.4 requires that for every x, xhat, uhat there exists u in U satisfying (2.5b). The proof only shows the inequality for the algebraic u, with no argument that u is admissible. In the case study, U=[-2.5,2.5] and the interface includes a term 4.9773(xhat2-x2), which alone can exceed the bound before adding uhat. No clipping or constraint is reported. This is a genuine gap, not a stylistic quibble. It can be repaired by adding an SOS condition enforcing u in U, or by assuming U=R^m, but as written the ASF is not established for bounded U.\n\nThird, the feasibility of conditions (3.8a)-(3.8e) is not analyzed. The rank condition on M and Mhat only guarantees existence of some G1, G2 in Lemma 3.1; Theorem 3.4 demands Y1, Y2 satisfying a coupled identity with a single Theta and a common Xi. That is a strong compatibility condition, and the paper gives no general test beyond \"try the SOS program.\" The single case study suggests it can work, but there is no evidence of how often it is satisfiable.\n\nThese are fixable. The central mathematics is not circular; the ASF is a certificate, not a fitted predictor, and the proof steps are correct. The paper deserves a serious referee, but the authors should be pushed to fix the input-admissibility gap and rewrite the data-count narrative before publication.\n\nWho this is for: researchers in data-driven formal methods interested in whether trajectory data can replace i.i.d. samples in abstraction-based control. With the gaps addressed, it would be a useful reference; currently it is more a pointer to an open problem. Recommendation: send to peer review, but expect major revisions, with the input-constraint issue as the key correctness fix.","headline":"First trajectory-based ASF construction for unknown polynomial systems, but the 'two trajectories' claim is inflated and the interface's admissibility w.r.t. the input set is unproven.","tokens_in":863,"tokens_out":884,"would_cite":false,"duration_ms":55206,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Two trajectories suffice to build a certified symbolic model and hybrid controller for unknown polynomial systems.","keywords":["abstraction-based control","symbolic models","alternating simulation functions","data-driven control","nonlinear polynomial systems","sum-of-squares optimization","hybrid interface","persistent excitation"],"falsifier":"For a given unknown dt-IANSP, exhibit a two-trajectory dataset satisfying the stated rank condition (full row rank of the monomial data matrices and T >= M+1) for which the sum-of-squares feasibility problem (3.8a)-(3.8e) has no solution; such a counterexample would show the rank condition alone is not sufficient for the claimed ASF construction.","tokens_in":14586,"feed_emoji":"🎛️","tokens_out":11600,"duration_ms":98011,"temperature":0.7,"pith_summary":"This paper claims that a formal, abstraction-based controller for an unknown nonlinear system can be built from only two input-state trajectories, one recorded from the original system and one from its discretized symbolic dynamics. The key ingredient is a data-driven alternating simulation function, a quadratic function that upper-bounds how far the unknown system's state can drift from its symbolic model under a designed hybrid interface map. When the collected data satisfy a rank condition and a coupled set of polynomial and linear-matrix-inequality constraints is feasible, the resulting simulation function yields an epsilon-approximate alternating simulation relation between the systems, so that a discrete controller designed on the symbolic model transfers to the unknown system with a quantifiable error. The paper demonstrates this pipeline on a two-state polynomial benchmark, enforcing both safety and reach-while-avoid specifications without ever identifying the system matrices.","feed_headline":"Two trajectories unlock formal control of unknown nonlinear systems","feed_subtitle":"A data-driven symbolic model plus a certified interface map give formal guarantees from just two finite runs.","key_machinery":"The load-bearing identity is the data-based representation of the one-step increment (Lemma 3.1): with the interface u = I Y1(x) P x - Ihat Y2(xhat) P xhat + uhat, and with G1 = Y1 P, G2 = Y2 P, the difference A M(x) + B u - (A M(xhat) + B uhat) is exactly O_plus G1 x - Ohat_plus G2 xhat, where O_plus and Ohat_plus are the one-step-shifted data matrices of the two collected trajectories. This identity removes the unknown matrices A and B from the analysis, replacing them by measured data and the monomial matrix M. Conditions (3.8a)-(3.8d) then ensure that the unknown A, B are consistently absorbed into the free functions Y1, Y2 and the constant Theta, while the linear matrix inequality (3.8e) guarantees that the quadratic function S(x, xhat) = (x - xhat)^T P (x - xhat) satisfies the dissipation inequality S(x+, xhat+) <= gamma S(x, xhat) + psi. The mechanism converts the abstract object 'alternating simulation function' into a concrete, data-conditioned semidefinite feasibility problem.","core_discovery":"The central claim is that, for a discrete-time input-affine nonlinear system with polynomial dynamics whose matrices A and B are unknown, two finite input-state trajectories – one from the unknown system and one from the nominal (unquantized) symbolic dynamics – suffice to construct an alternating simulation function from the data-driven symbolic model to the unknown system, provided the data meet a rank condition reflecting persistent excitation. The construction is expressed as a sum-of-squares feasibility problem: find matrix-valued functions Y1 and Y2 and constant matrices Xi and Theta with Xi > 0 satisfying the coupled equations (3.8a)-(3.8d) and the linear matrix inequality (3.8e). When these are satisfied, the quadratic function S(x, xhat) = (x - xhat)^T P (x - xhat) with P = $Xi^{{-1}}$ is an alternating simulation function with $\\alpha$ = lambda_min(P), rho = 0, and psi = (1 + 1/mu) ||$\\sqrt$(P)||^2 $delta^{2}$, and the interface map u = I Y1(x) P x - Ihat Y2(xhat) P xhat + uhat transfers any discrete controller to the unknown system. Combined with the epsilon-approximate simulation relation theorem, this yields a certified closeness bound epsilon = $\\sqrt$( psi / ( $\\alpha$ (1 - gamma) eta1 ) ) in the rho = 0 case, which quantifies how faithfully the symbolic design is realized on the unknown system.","pith_inferences":["An immediate testable extension is to relax the constant-Theta condition (3.8c)-(3.8d) to allow Theta that depends on x and xhat; this would widen feasibility at the cost of a harder SOS program and would likely be necessary for higher-degree polynomial dynamics.","The two-trajectory construction is likely to carry over to other model classes (e.g., systems with rational or trigonometric drift) as long as a data-based representation of the one-step increment analogous to Lemma 3.1 can be established.","Because the interface map uses the measured data matrices, the framework implicitly assumes noise-free measurements; analysing the effect of measurement noise on the closeness bound is a natural next step not addressed in the paper.","A compositional extension to networks of unknown systems could be built by combining the data-driven ASFs of subsystems via small-gain conditions, following the pattern of model-based compositional symbolic control."],"forward_implications":["A controller synthesized on a finite symbolic model can be refined to the unknown dt-IANSP with a certified epsilon closeness bound, so safety, reachability, and reach-while-avoid specifications transfer with formal guarantees.","Only two trajectories are needed, with T >= M+1 samples each, eliminating the i.i.d. sample burden and the large number of independent runs required by scenario-based abstraction methods.","The same ASF and interface map can be reused across different control objectives on the same system, as demonstrated by switching from safety to reach-while-avoid without re-solving the ASF problem.","As the state discretization parameter delta shrinks, the error bound psi scales as delta^2, so the symbolic model becomes arbitrarily accurate at the price of more discrete states.","The construction is algorithmic: once data are collected, the ASF is found by solving a sum-of-squares feasibility program with semidefinite constraints."],"supporting_citations":[{"why":"Supplies the definition of alternating simulation functions and the epsilon-approximate simulation relation theorem (Theorem 2.7) that converts the quadratic ASF into a closeness guarantee.","marker":"[Tab09]"},{"why":"Provides the ASF definition used in Definition 2.4 and the delta-ISS interpretation that justifies collecting the second trajectory from arbitrary states.","marker":"[SZ19]"},{"why":"Introduces the data-based representation trick that Lemma 3.1 adapts, expressing the unknown one-step increment in terms of data matrices and the monomial basis.","marker":"[GDPT21]"},{"why":"Establishes the trajectory-based data-collection paradigm with a rank condition (persistent excitation) that the framework adopts to use just two trajectories without i.i.d. samples.","marker":"[DPT19]"},{"why":"Supplies the polynomial system benchmark used in the case study to demonstrate the safety and reach-while-avoid specifications.","marker":"[GDPT20]"}],"fun_headline_variants":["Two trajectories suffice for formal control of unknown systems","Data-driven symbolic control from just two runs","Control unknown nonlinear systems with only two data runs","Two finite runs yield certified hybrid controller"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The method works only if there exist matrix-valued functions Y1 and Y2 and a fixed matrix Theta that satisfy the coupled compatibility equations (3.8a)-(3.8d) for every state in the domain; the stated rank condition on the data does not by itself guarantee such a solution exists.","fun_headline_variants_meta":{"raw":{"variants":["Two trajectories suffice for formal control of unknown systems","Data-driven symbolic control from just two runs","Control unknown nonlinear systems with only two data runs","Two finite runs yield certified hybrid controller"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.00021,"raw_usage":{"total_tokens":1498,"prompt_tokens":1120,"completion_tokens":378,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":736,"completion_tokens_details":{"reasoning_tokens":322}},"tokens_in":736,"tokens_out":378,"duration_ms":4067,"temperature":1.0,"reasoning_tokens":322,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T21:59:32.759257+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"For a given unknown dt-IANSP, exhibit a two-trajectory dataset satisfying the stated rank condition (full row rank of the monomial data matrices and T >= M+1) for which the sum-of-squares feasibility problem (3.8a)-(3.8e) has no solution; such a counterexample would show the rank condition alone is not sufficient for the claimed ASF construction.","supporting_citations":[],"review_version":1}