{"id":"a3b648a8-b30a-40db-9b01-f5b3b928cbe1","arxiv_id":"2412.03919","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"A single observed trajectory plus a known disturbance bound is enough to synthesize a robust safety certificate and controller for unknown input-affine polynomial systems.","lead":"This paper derives a data-driven method that builds robust safety certificates for discrete-time polynomial control systems whose equations are unknown except for bounded disturbances. The certificates and controllers are solved directly from a single input-state trajectory using sum-of-squares optimization, avoiding model identification.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Theorem 2 implicitly assumes L(x)^† L(x) = I; without it the P in (14c) is not the matrix in the barrier, and L^† is non-polynomial, breaking the SOS formulation.","rationale":"I focused on Theorem 2 because every downstream guarantee (Lemma 2, Algorithm 1, the two case studies) flows from it. The S-procedure and Schur-complement steps in the proof of Theorem 2 are broadly sound: (14c) is a dilation of (20), and the data inequality (19) is a valid consequence of the disturbance bound. The single weakest point is the reconciliation of the matrix P in the LMI conditions with the B(x) in the conclusion. Condition (13) links H and P, but the theorem's B uses [L^† R0,T H]^{-1}. Left-multiplying (13) by L^† gives L^† R0,T H = L^† L P^{-1}; equality with P^{-1} requires L^† L = I. This is not stated, and for a generic monomial dictionary L^† is not even polynomial, so the SOS conditions in Lemma 2 are not polynomial feasibility problems as written. The case studies evade the issue because the dictionary construction 'all monomials up to degree 3' happens to start with x1,x2, making L = [I_2; *] and L^† = [I_2,0] constant. This is an accident of the examples, not a theorem. The concern is fixable by stating the assumption explicitly (or by defining the barrier directly via P and rewriting (14a)-(14b)), but as written the central claim is not established for general dictionaries. Hence the conditional verdict stands: the paper is promising and the examples work, but Theorem 2 needs a stated hypothesis and the SOS encoding of L^† needs clarification.","tokens_in":14317,"tokens_out":26935,"duration_ms":221754,"concrete_test":"Take the academic case study (22) and re-order the dictionary R(x) so that the linear monomials x1,x2 are not the first entries (e.g., move them to the end). Re-run Algorithm 1: solve (21a)-(21c) with (13) for Z=P^{-1} and H, then compute B(x)=x^T (L^† R0,T H)^{-1} x as stated in Theorem 2. Check whether B is polynomial, whether L^† L = I, and whether (3a)-(3b) hold with the reported γ1,γ2. If B is rational or violates (3a)-(3b), the missing assumption is confirmed.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim depends on Theorem 2, which uses condition (13) R0,T H = L P^{-1} to define a barrier, but concludes B(x)=x^T [L^† R0,T H]^{-1} x. These two match only if P^{-1} = L^† R0,T H, which follows from (13) only when L^† L = I (left-multiply (13) by L^†). This identity is never stated in Theorem 2 or Remark 3; it holds in the case studies only because the dictionaries place the linear monomials x1,...,xn first, so L takes the form [I_n; M(x)] and L^† = [I_n, 0] is a constant polynomial. For a general monomial dictionary, L^† is a state-dependent Moore-Penrose pseudoinverse, generally a rational matrix, so the expressions in (14a)-(14b) and (21a)-(21b) are not polynomials and the SOS program in Lemma 2 is not well-defined as stated. Without L^† L = I, the P used in (14c) is not the matrix appearing in (14a)-(14b), so SOS feasibility does not imply the constructed B is an R-CBC. This is a missing hypothesis in the main theorem, not merely a technical nuisance.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper develops a direct data-driven method for synthesizing robust control barrier certificates (R-CBCs) B(x) = x^T P x and associated robust safety controllers (R-SCs) for discrete-time input-affine polynomial systems (dt-IAPS) with unknown dynamics and unknown-but-bounded disturbances, using a single finite input-state trajectory satisfying a persistency-of-excitation rank condition. The main results are Lemma 1 (data-based closed-loop representation), Theorem 1 (infinite-horizon safety guarantee from an R-CBC), Theorem 2 (sufficient conditions (14a)-(14c) derived via the S-procedure and Schur complement), Lemma 2 (SOS reformulation (21a)-(21c)), Algorithm 1, and two case studies (an academic system and a Lorenz system). The central claim is that if R0,T has full row rank and conditions (13) and (21a)-(21c) are feasible, then B(x) = x^T [L(x)^dagger R0,T H(x)]^-1 x is an R-CBC and u = U0,T H(x) [L(x)^dagger R0,T H(x)]^-1 x is its R-SC, guaranteeing that all trajectories from X0 avoid X1 for all disturbances with ||w||^2 <= delta over an infinite horizon.","tokens_in":2326,"tokens_out":2541,"duration_ms":450525,"significance":"If the gaps identified in the major comments are fixed, this is a worthwhile contribution to direct data-driven safety synthesis for discrete-time nonlinear systems. The construction is a legitimate certificate-synthesis framework: no quantity is fitted to data and then re-used as a prediction, and the design is validated against external benchmarks (De Persis-Tesi data representations, barrier-certificate theory, the S-procedure). The S-procedure argument over the data-conformity set and the Schur-complement dilation that removes the bilinear term H(x) P H(x)^T are correct and implementable as SOS, and the relaxed barrier condition (3c) with the rho ||w||^2 term is a sensible improvement over strict-decay conditions in prior single-trajectory discrete-time results. Treating state-dependent input matrices G(x) and multiple unsafe regions also extends existing work. The two case studies, including a chaotic Lorenz system, substantiate the practical claims. The main shortcomings are a missing hypothesis in Theorem 2 and a well-posedness gap in Lemma 2, both fixable without changing the manuscript's scope, plus a numerical inconsistency in the reported case-study parameters.","major_comments":[{"comment":"The stress-test concern is valid: Theorem 2 omits a hypothesis that is load-bearing for the identification of the certificate matrix. The conclusion and the proof set P = [L(x)^dagger R0,T H(x)]^-1, but condition (13) only implies L(x)^dagger R0,T H(x) = L(x)^dagger L(x) P^-1; the desired equality L(x)^dagger R0,T H(x) = P^-1 requires L(x)^dagger L(x) = I_n. The theorem never assumes that L(x) in (8) has a left inverse (for example, that the dictionary contains the linear monomials x1,...,xn as its first entries), and Remark 3's \"without loss of generality\" claim addresses only the existence of L, not its left-invertibility. Without L^dagger L = I_n, the P appearing in (14c) and in c = (1 + 1/pi) ||sqrt(P)||^2 delta is not the matrix appearing in (14a)-(14b), so the verification of (3a)-(3b) in the proof fails; moreover, for a general monomial dictionary L^dagger is a rational function of x, making (14a)-(14b) and the SOS expressions (21a)-(21b) non-polynomial and Lemma 2 ill-defined. The case studies happen to satisfy the missing hypothesis only because their dictionaries list the linear monomials first, so L = [I_n; M(x)] and L^dagger = [I_n, 0] is a constant polynomial matrix. Please add this assumption to Theorem 2 and Lemma 2, and note that it is without loss of generality because redundant monomials, including the linear ones, can always be added to the dictionary as permitted by Remark 7.","section":"Theorem 2, Section III (Eqs. (13)-(14))"},{"comment":"The SOS formulation in Lemma 2 is not well-posed as written and does not match the actual implementation. Conditions (21a)-(21b) declare expressions in x^T [L(x)^dagger R0,T H(x)]^-1 x to be SOS polynomials in the decision variables H(x), but for a free polynomial matrix H(x) this expression is generally a rational function of x, so the proof's assertion that B(x) is a non-negative SOS polynomial is unjustified at the point where feasibility is being decided. The intended procedure, evident from Remark 5 and both case studies (\"we set Z = P^-1\"), is to solve constraints (21c) and (13) for Z and H, recover P = Z^-1, and then compute the level sets gamma1 and gamma2 from (14a)-(14b), which is exactly what Algorithm 1 does in Steps 4-6. Please rewrite Lemma 2 with Z (= P^-1) and H as decision variables, impose (13) as the polynomial equality R0,T H = L Z, and state that (21a)-(21b) are level-set verifications performed after P is recovered (or impose them with the additional constraint P Z = I_n); this aligns the lemma with Algorithm 1 and makes the SOS problem polynomial.","section":"Lemma 2, Section III (Eqs. (21a)-(21c)); Algorithm 1"}],"minor_comments":[{"comment":"The reported case-study parameters are inconsistent with the formula rho = (1 + 1/pi) ||sqrt(P)||^2 and the induced-2-norm definition of ||sqrt(P)||: for the academic system, lambda_max(P) is approximately 7.73 x 10^4, so with pi = 10^-5 one obtains rho approximately 7.7 x 10^9 rather than the reported rho = 1.4257 x 10^5, and the Lorenz case has the same problem (lambda_max(P) is on the order of 10^5). Please correct pi, P, or rho so that the reported values satisfy the hypotheses of Theorem 2 and the numbers are reproducible.","section":"Section IV (case studies)"},{"comment":"The induction in the proof of Theorem 1 applies condition (3c) at x = x(k), which requires x(k) to lie in X~ = X intersect {x : B(x) < gamma2}, but the induction hypothesis only establishes B(x(k)) < gamma2. Please add the assumption {x : B(x) < gamma2} is a subset of X (which holds in both case studies because the ellipsoid B < gamma2 lies inside the box X) or otherwise close the gap in the infinite-horizon argument.","section":"Section II-C, Theorem 1 (proof)"},{"comment":"The claim that inequality (20) is equivalent to (14c) is not correct as stated: the Schur complement shows that (14c) is equivalent to the (n + N + N-hat)-dimensional matrix inequality M(x) <= 0, which is only sufficient for the congruence (20) with [I_n; A~^T], not necessary. Since the proof ultimately uses (14c) as a sufficient condition, the argument is valid, but the equivalence wording should be corrected.","section":"Section III, Eqs. (20) and (14c)"},{"comment":"The paper states that R(x) and G(x) are unknown, yet G0,T in (6a) and G(x) in R~(x) in (14c) are used as known quantities computed from data; please clarify that the monomial dictionaries are known functions of x and only the coefficient matrices A and B are unknown (Remark 7 makes this point for R(x) only).","section":"Section II-B and Section III (Eqs. (6a), (14c))"},{"comment":"The multiplier alpha(x) must be explicitly constrained to be pointwise nonnegative (for example, SOS) in the SOS program; writing alpha(x) in R_+ as in (14c) does not guarantee that the solver returns a nonnegative polynomial, and a negative multiplier would invalidate the S-procedure step in the proof of Theorem 2.","section":"Section III, Lemma 2"},{"comment":"The input constraint set U is never specified; the constructed controller u = U0,T H(x) P x is assumed to be feasible for all x in X~, which implicitly requires U = R^m. Please state this assumption, or add input constraints to the SOS formulation.","section":"Section II-B and case studies"}],"recommendation":"major_revision","confidential_remarks":"To the editor: This is a competent paper in scope for the journal, and the central idea (single-trajectory SOS synthesis of R-CBC/R-SC with disturbance robustness and state-dependent G(x)) is publishable after revision. The required changes are structural: add the left-invertibility hypothesis to Theorem 2 and Lemma 2, align Lemma 2 with the Z-based implementation, and clean up the case-study numbers, where the reported pi/rho/P values do not satisfy the theorem's formula. The novelty over the closely related preprint [29] is moderate but real. I recommend major revision rather than rejection because the identified gaps are fixable without changing the method's scope."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"This is a real step forward for direct data-driven safety: single trajectory, discrete time, bounded disturbances, state-dependent input matrix, and a relaxed c-martingale barrier condition. The SOS formulation is the natural next move after the same group's prior work [29], and the two case studies show the method working. The S-procedure argument in (14c) is, as far as I can tell, a valid sufficient condition, and the proof of Theorem 1 (the invariance argument) is clean.\n\nThe soft spot is real and in the main theorem. Condition (13) gives R_{0,T} H = L P^{-1}. The paper then sets P = [L† R_{0,T} H]^{-1}. These match only if P^{-1} = L† R_{0,T} H, which follows from (13) only after left-multiplying by L† and using L† L = I. That identity is never stated. For a general monomial dictionary, L† is a state-dependent Moore-Penrose pseudoinverse, typically rational, so the expressions in (14a)-(14b) and the SOS constraints in (21a)-(21b) are not polynomials and Lemma 2 is not well-defined. In both case studies the dictionaries put the linear monomials first, so L = [I_n; M(x)] and L† = [I_n, 0] is constant — the gap is silently papered over. This is a missing hypothesis, not a philosophical objection, and it is fixable: state the dictionary ordering assumption explicitly, or present the proof with L† L = I as an assumption, or reformulate in a way that avoids the pseudoinverse.\n\nSecond, the proof of Theorem 2 says (20) is \"equivalent\" to (14c) via Schur complement/dilation, but only sufficiency is shown (and needed). That overclaim should be corrected, and the dilation derivation should be written out; right now it is a one-liner. Third, no code, no data, and H(x) is not reported, so the case studies are not independently reproducible. That matters for a data-driven paper; the reader cannot check that the rank condition holds or that the SOS feasibility is real.\n\nThe central idea holds up despite these issues. With the assumptions stated and the dilation spelled out, this is a publishable contribution in the formal-methods/control subfield. It deserves a serious referee, and I would send it out. The right outcome is major revision, not rejection.","headline":"Solid extension of single-trajectory data-driven barrier synthesis, but Theorem 2 quietly assumes L†L = I, which breaks the SOS formulation for general dictionaries.","tokens_in":15127,"tokens_out":2606,"would_cite":false,"duration_ms":24689,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["93C10","93C55","93D30","90C22"],"pacs":[],"model":"deepseek-v4-flash","headline":"From a single finite-horizon input-state trajectory, an SOS program can synthesize a robust safety certificate and controller for an unknown discrete-time input-affine polynomial system, guaranteeing that trajectories starting from a…","keywords":["data-driven control","robust control barrier certificates","input-affine polynomial systems","unknown dynamics","bounded disturbances","sum-of-squares optimization","discrete-time systems","safety verification"],"falsifier":"Take the academic system (22), add a monomial of degree four to its true dynamics while keeping the declared maximum degree at three, collect a trajectory that is full row rank for this reduced dictionary, and run the SOS conditions (21a)--(21c). If they return a feasible $P$ and controller, simulate many disturbance realizations bounded by $\\delta$ from $X_0$; any trajectory reaching $X_1$ would refute the infinite-horizon claim.","tokens_in":14093,"feed_emoji":"🛡️","tokens_out":7404,"duration_ms":73876,"temperature":0.7,"pith_summary":"This paper sets out to prove that robust infinite-horizon safety for a discrete-time input-affine polynomial system can be certified and controlled directly from a single finite-horizon input-state trajectory, without identifying the system matrices or the disturbance sequence. The proposed construction turns collected data into a data-consistent representation of the closed loop, then asks a sum-of-squares program for a quadratic barrier function $B(x)=x^{\\top}P x$ and a state-feedback controller that keep $B$ below a threshold for all time despite disturbances satisfying $\\|w\\|^2\\le \\delta$. If the conditions in the main theorem are feasible, every trajectory starting in the initial set avoids the unsafe set forever. A sympathetic reader would care because the method reduces a safety-certificate design that normally needs exact dynamics to a data-driven feasibility problem with a concrete rank check and a finite computation.","feed_headline":"One trajectory certifies robust safety of unknown systems","feed_subtitle":"A sum-of-squares program turns one recorded trajectory into a controller that keeps states safe forever, despite bounded noise.","key_machinery":"The load-bearing device is a data-based reformulation of the closed loop: with $u=U_{0,T}Q(x)x$ and $Q(x)$ chosen so that $R_{0,T}Q(x)=L(x)$, where $R(x)=L(x)x$, the unknown dynamics become $x^{+}=\\tilde{A}\\tilde{R}(x)Q(x)x+w$, with $\\tilde{A}=[A\\; B]$ and $\\tilde{R}(x)=[R_{0,T};\\; G(x)U_{0,T}]$ built entirely from measured data. This reduces the barrier condition to a matrix inequality in $H(x)$ and $P$; block-matrix elimination and an $S$-procedure rewrite it as the SOS condition (21c), avoiding the bilinear term $H(x)PH(x)^{\\top}$ by dilation. The rank condition that $R_{0,T}$ be full row rank is what allows $Q(x)$ to exist and encodes persistency of excitation.","core_discovery":"The paper's central claim is that for an unknown system of the form $x^{+}=A R(x)+B G(x)u+w$ whose chosen dictionaries contain the true monomials, if the collected data make the matrix $R_{0,T}$ full row rank and there exist matrices $H(x)$ and $P$ satisfying $R_{0,T}H(x)=L(x)P^{-1}$, then the SOS feasibility conditions (21a)--(21c) produce a quadratic $B(x)=x^{\\top}P x$ that is a robust control barrier certificate and $u(x)=U_{0,T}H(x)[L(x)^{\\dagger}R_{0,T}H(x)]^{-1}x$ is its associated robust safety controller. The certificate uses a relaxed decay condition $B(x^{+})\\le \\lambda B(x)+\\rho\\|w\\|^2$ with $c=\\rho\\delta\\le \\gamma_2(1-\\lambda)$, so the barrier may grow by a bounded amount instead of strictly decaying. Consequently, by the safety-guarantee theorem, all trajectories from $X_0$ avoid $X_1$ for any disturbance sequence with $\\|w\\|^2\\le \\delta$ over an infinite horizon.","pith_inferences":["Editorial inference: the same rank-conditioned data representation should apply to non-quadratic barrier candidates of the form $B(x)=R(x)^{\\top}P R(x)$ whenever the dictionary is rich enough to express $R(x^{+})$ in the data coordinates; the paper's quadratic choice $B(x)=x^{\\top}P x$ is a special case.","Editorial inference: the degree-bound assumption is the practical point of failure. Before deployment, one could validate the certificate on a second independent trajectory and check that the defining barrier inequality holds on it; a violation would indicate a missing monomial in the dictionary.","Editorial inference: the scalar parameters $\\lambda$ and $\\pi$ are fixed a priori, and tuning them trades feasibility against the allowable disturbance size $c= (1+1/\\pi)\\|\\sqrt{P}\\|^2\\delta$; a systematic line search over these parameters is a natural extension that the paper leaves implicit.","Editorial inference: the factorization $R(x)=L(x)x$ with $L^{\\dagger}L=I$ is asserted for general monomial dictionaries, but it holds cleanly only when the dictionary contains the coordinate monomials; the paper does not list this as an explicit assumption in Theorem 2."],"forward_implications":["For any system satisfying the assumptions, the synthesized controller guarantees robust safety for all time, not only for the horizons seen in the data.","No system identification or disturbance estimation step is needed; the same data that certify safety also define the controller.","Because the barrier only needs to decay relative to a constant, certificates become feasible for systems where a strictly decreasing barrier would not exist.","The framework accommodates multiple disjoint unsafe regions by repeating the barrier condition for each region, as demonstrated in both case studies.","After fixing the scalar parameters $\\lambda$ and $\\pi$, the design is a convex SOS and semidefinite program, so the synthesis can be automated.","The method extends to state-dependent control matrices $G(x)$, going beyond static input matrices treated in prior discrete-time data-driven safety work."],"supporting_citations":[{"why":"Supplies the data-based formula $R_{0,T}Q(x)=L(x)$ and the rank condition used to represent unknown dynamics from input-state data.","marker":"[3]"},{"why":"Establishes persistency of excitation as the rank condition under which a single trajectory is informative enough.","marker":"[19]"},{"why":"Provides the robust-safety guarantee that a barrier satisfying conditions (3a)--(3c) keeps trajectories out of the unsafe set forever.","marker":"[32]"},{"why":"Extends the data-driven representation to noisy data, underpinning the disturbance-aware reformulation used in the proof.","marker":"[33]"},{"why":"The prior discrete-time polynomial-system safety synthesis that this work extends to state-dependent control matrices and bounded disturbances.","marker":"[29]"},{"why":"Motivates the quadratic barrier form $B(x)=R(x)^{\\top}P R(x)$ in continuous time and highlights the difficulty that discrete time creates for representing $R(x^{+})$.","marker":"[25]"},{"why":"Serves as the comparison baseline for data-driven safety controllers of polynomial systems, generalized here from polyhedral invariance to multiple unsafe sets.","marker":"[22]"}],"fun_headline_variants":["One trajectory certifies robust safety of unknown systems","SOS program yields robust safety from single data path","Robust safety guarantees from one recorded rollout","Data-driven robust barriers for input-affine systems","Infinite-horizon safety from a single trajectory"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The whole construction stands on knowing in advance a degree bound large enough that the true monomials of the dynamics appear in the chosen dictionaries $R(x)$ and $G(x)$, and on the collected trajectory making the monomial matrix $R_{0,T}$ full row rank with a factorization $R(x)=L(x)x$; if the bound is too low or the data are not exciting enough, the synthesized certificate need not describe the real system.","fun_headline_variants_meta":{"raw":{"variants":["One trajectory certifies robust safety of unknown systems","SOS program yields robust safety from single data path","Robust safety guarantees from one recorded rollout","Data-driven robust barriers for input-affine systems","Infinite-horizon safety from a single trajectory"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000251,"raw_usage":{"total_tokens":1555,"prompt_tokens":939,"completion_tokens":616,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":555,"completion_tokens_details":{"reasoning_tokens":544}},"tokens_in":555,"tokens_out":616,"duration_ms":6224,"temperature":1.0,"reasoning_tokens":544,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T21:59:01.977071+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take the academic system (22), add a monomial of degree four to its true dynamics while keeping the declared maximum degree at three, collect a trajectory that is full row rank for this reduced dictionary, and run the SOS conditions (21a)--(21c). If they return a feasible $P$ and controller, simulate many disturbance realizations bounded by $\\delta$ from $X_0$; any trajectory reaching $X_1$ would refute the infinite-horizon claim.","supporting_citations":[{"cited_title":"Formulas for data-driven contr ol: Stabi- lization, optimality, and robustness,","cited_arxiv_id":null,"evidence_quote":"Supplies the data-based formula $R_{0,T}Q(x)=L(x)$ and the rank condition used to represent unknown dynamics from input-state data."},{"cited_title":"A note on persistency of excitation,","cited_arxiv_id":null,"evidence_quote":"Establishes persistency of excitation as the rank condition under which a single trajectory is informative enough."},{"cited_title":"Formal V erification of Unknown Discrete- and Continuous-Time syst ems: A Data-Driven Approach,","cited_arxiv_id":null,"evidence_quote":"Provides the robust-safety guarantee that a barrier satisfying conditions (3a)--(3c) keeps trajectories out of the unsafe set forever."},{"cited_title":"Data-driven stabiliz ation of nonlinear polynomial systems with noisy data,","cited_arxiv_id":null,"evidence_quote":"Extends the data-driven representation to noisy data, underpinning the disturbance-aware reformulation used in the proof."},{"cited_title":"Data-dr iven controller synthesis of unknown nonlinear polynomial syst ems via control barrier certificates,","cited_arxiv_id":null,"evidence_quote":"Motivates the quadratic barrier form $B(x)=R(x)^{\\top}P R(x)$ in continuous time and highlights the difficulty that discrete time creates for representing $R(x^{+})$."},{"cited_title":"Data-dri ven design of safe control for polynomial systems,","cited_arxiv_id":null,"evidence_quote":"Serves as the comparison baseline for data-driven safety controllers of polynomial systems, generalized here from polyhedral invariance to multiple unsafe sets."}],"review_version":1}