{"id":"b066d915-39e1-4f40-90b2-afcfcd857211","arxiv_id":"2507.23280","paper_version":2,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":6.0,"correctness_risk":"high","formal_verification":"none","parameter_count":1,"one_line_summary":"A data-driven framework synthesizes stochastic control barrier certificates and safety controllers for unknown polynomial stochastic systems, with probabilistic safety guarantees and certified confidence from multiple noisy trajectories.","lead":"This paper develops a way to prove that a controller keeps an unknown stochastic system safe, using only measured trajectories and rough information about the noise. If valid, it gives numerical safety guarantees with a confidence level, which could matter for autonomous systems and robots.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Theorem 2's confidence bound relies on a Gaussian fourth-moment identity; for arbitrary heavy-tailed noise with the same mean and covariance, the certified confidence 1-beta_2 can be violated.","rationale":"The reader's weakest_assumption identifies exactly the load-bearing concern: Lemma 1 is Gaussian-specific, and the extension to arbitrary distributions via Remark 9 is unsupported because the fourth moment of the noise is not bounded by the assumed mean and covariance bounds. This is the central promise of the paper, stated in the abstract, Problem 1, and Definition 1 ('process noise with arbitrary distributions'). The counterexample in my concrete test shows that the claimed confidence can fail by a wide margin for a heavy-tailed distribution with the same Gamma_mu and Gamma_Sigma, so the issue is not a minor proof detail but an internal inconsistency with the stated problem. The framework may be repairable by adding an explicit bound on E[||zeta||^4] or by restricting to Gaussian/sub-Gaussian noise, and the numerical examples would remain valid for the specific distributions tested, but the advertised distribution-free guarantee is not established. Other potential issues, such as the skipped equivalence between (39) and (13c) via the dilation/Schur-complement argument and the S-lemma's technical conditions, are secondary and likely fixable; they do not change the verdict. Therefore the reader's CONDITIONAL verdict is appropriate: the paper should not be accepted as-is, but rejection is too strong given the likely repair path. My read does not change the reader's verdict, so I set verdict_should_be to UNCHANGED.","tokens_in":24641,"tokens_out":6738,"duration_ms":70273,"concrete_test":"Reproduce Lemma 1 without the Gaussian identity: choose univariate zero-mean noise with variance 1, distribution Z=±1/sqrt(p) with probability p/2 each and Z=0 otherwise. Set p=0.001, N=1000, epsilon=0.1, Gamma_mu=0, Gamma_Sigma=1. The claimed beta_bar_2 from (9) is 2/(N epsilon^2)=0.2. The exact probability P(|(1/N)sum Z_i^2 - 1| > 0.1) equals P(Binomial(1000,0.001) != 1) ≈ 0.264, which exceeds 0.2. This shows the bound in (9) is not distribution-free, so Theorem 2's confidence guarantee fails for arbitrary noise.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The load-bearing gap is in Lemma 1 (Eq. 9). Its proof computes E[||zeta||^4] using the Gaussian fourth-moment identity (Eq. 20a) and then bounds the variance in terms of Gamma_mu and Gamma_Sigma (Eq. 21). Remark 9 asserts distribution-freeness because only Markov/Chebyshev inequalities are used, but it does not provide a general upper bound on E[||zeta||^4] in terms of the first two moments, and no such bound exists: the fourth moment is not controlled by the mean and covariance. Concretely, for n=1, take zero-mean noise with variance 1 and distribution Z=±a with probability p/2 each, Z=0 otherwise, where a=1/sqrt(p). The variance is 1 and the fourth moment is 1/p, which is unbounded as p->0. For fixed N and epsilon, choosing p small makes the actual probability of a large deviation exceed the Gaussian-based beta_bar_2 = 2/(N epsilon^2). Therefore Lemma 2's data-conformity constraint (10) and Theorem 2's confidence 1-beta_2 = 1 - T beta_bar_2 are not certified for arbitrary noise distributions. Since the problem statement (Problem 1) and the abstract explicitly promise arbitrary distributions, this is a genuine correctness gap, not merely conservatism.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a data-driven, trajectory-based framework for synthesizing stochastic control barrier certificates (S-CBC) and safety controllers for discrete-time stochastic nonlinear polynomial systems with unknown system matrices A and B and process noise of arbitrary distribution. Data are collected as N finite-horizon trajectories generated from the same initial condition and input sequence under different noise realizations. The main result, Theorem 2, provides SOS conditions (13) whose feasibility implies, with confidence at least 1 - T * beta_bar_2, that B(x) = x^T P x is an S-CBC and u = K(x)x is its safety controller, where beta_bar_2 is defined in Lemma 1 using only upper bounds Gamma_mu, Gamma_Sigma on the noise mean and covariance. The paper also includes three simulation studies (Lorenz, Chen, spacecraft) and a comparison with robust worst-case analysis.","tokens_in":24847,"tokens_out":7608,"duration_ms":88832,"significance":"If the main theorem were correct as stated, the paper would make a useful contribution: it extends trajectory-based data-driven safety synthesis to stochastic systems with unbounded noise support, using only first- and second-moment bounds, and it demonstrates via a spacecraft example that stochastic analysis can succeed where robust worst-case analysis fails. The algorithmic pipeline (Algorithm 1) is concrete, the SOS formulation is tractable, and the experiments provide a useful sanity check. However, the central distribution-free claim is not supported by the proof: Lemma 1, which is the statistical foundation of Theorem 2, is derived under a Gaussian assumption and no distribution-free replacement is supplied. This is a load-bearing gap, not a matter of conservatism.","major_comments":[{"comment":"Lemma 1 is stated for a Gaussian random vector and its proof computes E[||zeta||^4] using the Gaussian fourth-moment identity (20a). The statement of Theorem 2 and Problem 1, however, promise arbitrary noise distributions. Remark 9 asserts distribution-freeness because only Markov/Chebyshev inequalities are used, but it does not provide any upper bound on E[||zeta||^4] in terms of the assumed bounds Gamma_mu and Gamma_Sigma, and no such general bound exists: the fourth moment is not controlled by the first two moments. For example, for scalar zero-mean noise with variance 1, take Z = +/-a with probability p/2 each and Z = 0 otherwise, with a = 1/sqrt(p); then E[Z^4] = 1/p, which is unbounded as p -> 0. For fixed N and epsilon, choosing p sufficiently small makes the actual probability of a large deviation exceed the Gaussian-based beta_bar_2 = 2/(N epsilon^2). Consequently, the data-conformity constraint (10) in Lemma 2 and the certified confidence 1 - beta_2 in Theorem 2 are not guaranteed for arbitrary noise distributions. This gap is inherited by every downstream result and directly invalidates the paper's central claim.","section":"Lemma 1 (Eq. 9) and Remark 9"},{"comment":"The proof's event decomposition is incorrect. It defines E1 = {inequality (34) holds} and E2 = {inequality (38) holds}, then asserts P(not E1) = 0 'since E1 is a deterministic inequality and holds true.' But (34) is a condition involving the unknown matrix Phi = [A B]; it is not a priori true. The correct reasoning is that (13c) together with E2 implies E1, so E2 is a subset of E1 and P(E1 intersect E2) = P(E2) >= 1 - beta_2. As written, the proof attributes zero failure probability to an event that is actually guaranteed only conditional on the data event E2. The final confidence claim can be repaired by replacing this step, but the current proof is formally invalid.","section":"Proof of Theorem 2, probabilistic argument"},{"comment":"Assumption 2 only postulates upper bounds on the mean and covariance. For non-Gaussian noise the fourth moment E[||zeta||^4] is needed to evaluate the variance in (19), and no such bound is assumed or derived. Thus even the corrected statement of Lemma 1 requires an additional assumption (e.g., known fourth-moment bound) that is absent from the problem formulation. This is a mismatch between the assumptions stated in Theorem 2 and the statistical tool used in its proof.","section":"Assumption 2 vs. Lemma 1"}],"minor_comments":[{"comment":"The phrase 'provided the fourth moment exists' is insufficient: existence alone does not give a numeric upper bound, so beta_bar_2 in (9) cannot be evaluated for a general distribution. The text should either restrict the scope to Gaussian noise or explicitly add a fourth-moment bound to Assumption 2 and revise (9) accordingly.","section":"Remark 9"},{"comment":"The implication from the Frobenius-norm bound to the spectral-norm bound is correct, but the notation in (26) uses a strict inequality '<' while the conclusion (10) uses a non-strict '<='. Since Lemma 1 gives strict inequality with probability at least 1 - beta_bar_2, the final non-strict inequality follows; the proof should state this explicitly to avoid confusion.","section":"Proof of Lemma 2, Eq. (25)-(26)"},{"comment":"The text says (13c) becomes an LMI after 'selecting appropriate scalar values for rho > 0 and kappa in (0,1)', but rho appears as a variable in the term -(1+rho)^{-1} \\bar{P}. Unless rho is fixed before solving, the condition is not an LMI. Please clarify that rho is fixed a priori or handled by line search.","section":"Theorem 2 statement, Eq. (13c)"},{"comment":"There is a mismatched parenthesis in 'Tr(P mu mu^top)' (the opening parenthesis after 'Tr' is not closed). In addition, the trace arguments use the cyclic property, but the presentation would benefit from a one-line derivation of Tr(P mu mu^top) <= Tr(P Gamma_mu) from mu mu^top <= Gamma_mu, since that inequality is used repeatedly.","section":"Proof of Theorem 2, Eq. (30)-(31)"},{"comment":"The lower bound on N given in Section IV contains the same expression as beta_bar_2 and is correct only if the Gaussian or fourth-moment assumption is in place. Please add a qualifying remark that, for non-Gaussian noise, the sample-size bound requires a known upper bound on E[||zeta||^4].","section":"Section IV, trade-off discussion"}],"recommendation":"reject","confidential_remarks":"The core technical gap is fundamental: with only first- and second-moment bounds, no finite-N confidence can be certified for the empirical second moment under arbitrary distributions, as the heavy-tailed counterexample in the stress-test note shows. The paper would need to narrow its scope (e.g., Gaussian noise or a known fourth-moment bound) to be correct, which changes the advertised contribution. I also note that the paper is heavily self-cited but the cited S-CBC background is standard; the main issue is technical, not scholarly. The experimental section does not include heavy-tailed noise, so the gap is not detected by the reported benchmarks."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The core idea is worth your time: a direct, trajectory-based SOS synthesis of stochastic control barrier certificates for unknown polynomial systems, using multiple non-i.i.d. trajectories and only moment bounds on the noise. That combination is genuinely new relative to the cited deterministic or bounded-disturbance literature, and the three benchmarks, including the spacecraft case where robust analysis fails, make the practical motivation concrete. The writing is clear and the pipeline is easy to follow.\n\nThe soft spot is load-bearing. Lemma 1, the concentration bound that feeds the data-conformity constraint and Theorem 2's confidence level, is proved only for Gaussian noise. The proof explicitly uses the Gaussian fourth-moment identity (20a). Remark 9 asserts distribution-freeness because only Markov/Chebyshev appear, but no general bound on E[||zeta||^4] in terms of Gamma_mu and Gamma_Sigma is given, and none exists: fourth moments are not controlled by mean and covariance. The stress-test example is correct. For zero-mean unit-variance noise with a heavy-tailed two-point mixture, the fourth moment is 1/p, unbounded as p→0, and the actual failure probability can exceed the certified beta_bar_2. So the paper's advertised problem—arbitrary noise distributions with certified confidence—is not supported. This is a genuine correctness gap, not conservatism. The fix is straightforward: either add a fourth-moment assumption or derive a distribution-free bound, then the rest likely goes through.\n\nThere is also a smaller technical gap: the proof of Theorem 2 asserts the equivalence (39)⇔(13c) with no detail beyond a Schur complement dilation. I suspect it is fixable, but as written it is a real skipped step. On the positive side, the safety guarantee itself is borrowed from standard model-based results, the noise-moment bounds are inputs rather than fitted parameters, and there is no circularity. No code is shipped, but the numerical results are documented in enough detail to reproduce.\n\nWho should read it: anyone working on data-driven safety verification or barrier certificates for stochastic systems. The framework is promising and repairable, but do not take the arbitrary-distribution confidence claim at face value. I would send it to a serious referee—the core idea deserves scrutiny and the flaw is local, not fundamental. For my own work, I would not cite it in its current form.","headline":"A plausible new data-driven synthesis pipeline for stochastic safety, but the advertised distribution-free confidence guarantee rests on a Gaussian fourth-moment calculation and is not established.","tokens_in":25395,"tokens_out":1043,"would_cite":false,"duration_ms":14023,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Noisy finite-horizon trajectories suffice to synthesize safety controllers with quantified probabilistic guarantees for unknown stochastic systems.","keywords":["data-driven control","stochastic control barrier certificates","non-i.i.d. trajectories","sum-of-squares optimization","probabilistic safety guarantees","unknown nonlinear systems","matrix S-lemma","process noise"],"falsifier":"Repeat the data-collection experiment in Algorithm 1 with a heavy-tailed noise (for example, Student-$t$ with five degrees of freedom) scaled to satisfy the same covariance bound $\\Gamma_\\Sigma$, and count how often the data-conformity inequality (10) fails across many independent data sets; if the failure frequency exceeds $\\bar\\beta_2$, the Gaussian fourth-moment calculation in Lemma 1 is not distribution-free and the stated confidence is not valid for that noise.","tokens_in":24356,"feed_emoji":"🛡️","tokens_out":11590,"duration_ms":109065,"temperature":0.7,"pith_summary":"This paper establishes that safety controllers for stochastic nonlinear control systems can be synthesized directly from noisy input-state trajectories, without identifying the system matrices $A$ and $B$. The framework allows process noise with arbitrary distribution, known only through upper bounds $\\Gamma_\\mu$ and $\\Gamma_\\Sigma$ on its mean and covariance, and the trajectories are temporally dependent rather than i.i.d. The design conditions are cast as a sum-of-squares (SOS) feasibility problem, a tractable polynomial optimization formulation, and a feasible solution yields a quadratic stochastic control barrier certificate $B(x)=x^\\top P x$ together with a state-feedback controller $u=K(x)x$. If the conditions hold, the safety probability is quantified as at least $1-\\beta_1$ and the certificate itself is correct with confidence at least $1-\\beta_2=1-T\\bar\\beta_2$. A sympathetic reader would care because this moves formal safety guarantees from model-based and worst-case bounded-disturbance settings to a purely data-driven stochastic setting, and in one benchmark the robust analysis is infeasible while the stochastic certificate succeeds.","feed_headline":"No model needed: noisy trajectories yield certified safety controllers","feed_subtitle":"Noisy finite-horizon trajectories yield a barrier certificate with quantified safety and confidence.","key_machinery":"The load-bearing machinery is a quadratic stochastic control barrier certificate $B(x)=x^\\top P x$, a Lyapunov-like function whose expected one-step growth is controlled. To synthesize it from data, the paper builds the data-conformity matrix $R_{\\mathrm{DC}}^j$ in (15) from the empirical second moments $\\frac{1}{N}\\sum_{i=1}^N \\vec X_j^i \\vec X_j^{i\\top}$ and the noise bounds; with confidence $1-\\bar\\beta_2$ it characterizes every $\\Phi=[A\\;B]$ consistent with the data. A matrix S-lemma eliminates the unknown $\\Phi$ and turns the stochastic barrier condition into the linear matrix inequality (13c), with multipliers $\\alpha_j(x)$. The concentration estimate in Lemma 1 uses a Gaussian fourth-moment identity to bound $\\mathbb{E}[\\|\\varsigma\\|^4]$ in terms of $\\Gamma_\\mu$ and $\\Gamma_\\Sigma$, and Boole's inequality converts the per-step confidence into the horizon-wide confidence $\\beta_2=T\\bar\\beta_2$.","core_discovery":"The central claim is Theorem 2: under Assumptions 1-3, for a discrete-time stochastic polynomial system $x^+=AF(x)+BG(x)u+\\varsigma$ with unknown $A,B$, known dictionaries $F,G$, and noise statistics satisfying $\\mu\\mu^\\top\\preceq\\Gamma_\\mu$ and $\\Sigma\\preceq\\Gamma_\\Sigma$, feasibility of the SOS/LMI conditions (13a)-(13c) implies that $B(x)=x^\\top P x$ with $P=\\bar P^{-1}$ is a stochastic control barrier certificate and $u=\\bar K(x)P x$ is its safety controller, with $\\psi=(1+\\rho^{-1})\\mathrm{Tr}(P\\Gamma_\\mu)+\\mathrm{Tr}(P\\Gamma_\\Sigma)$ and confidence at least $1-\\beta_2=1-T\\bar\\beta_2$. The certificate then gives the finite-horizon safety probability $1-\\beta_1$ via Theorem 1. The inputs to the condition are only the empirical average of $N$ noisy trajectories and the noise-moment bounds; the matrices $A$ and $B$ are never estimated.","pith_inferences":["If Lemma 1 were re-proved with a generic bound on $\\mathbb{E}[\\|\\varsigma\\|^4]$ rather than the Gaussian identity, the same S-lemma machinery would carry over to heavy-tailed noise; the paper remarks that this replacement is possible but gives no general formula.","Because the Chebyshev route gives only polynomial decay of $\\bar\\beta_2$ in $N$, swapping in a matrix-Bernstein concentration inequality for sub-Gaussian or bounded noise would yield exponential sample-complexity improvements while leaving the synthesis conditions unchanged.","The same data-conformity and S-lemma template could plausibly be adapted to input-output data by replacing state measurability with an observability dictionary, since the inequalities only use empirical covariance blocks of trajectory segments.","One could turn the feasibility problem into an optimization by maximizing the certified safety probability $1-\\beta_1$ over the level-set parameters, at the cost of the bilinear couplings the paper identifies."],"forward_implications":["A feasible solution of (13) certifies before deployment that with probability at least $1-\\beta_1$ trajectories starting in $X_\\eta$ avoid $X_\\delta$ over the horizon $T$, and this guarantee itself holds with confidence at least $1-T\\bar\\beta_2$.","The scenario approach's i.i.d. requirement is relaxed: the state trajectories may be temporally dependent, and the only independent randomness across the $N$ runs is the process noise, because the input sequence is fixed during data collection.","Noise with unbounded support is admissible whenever upper bounds on the first two moments are known, which is outside the reach of robust methods that require a bounded disturbance set.","The number of realizations required for a chosen confidence is explicit, $N\\ge \\bar\\beta_2^{-1}\\epsilon^{-2}(\\mathrm{Tr}(\\Gamma_\\Sigma^2)+(\\mathrm{Tr}\\Gamma_\\Sigma)^2+2\\lambda_{\\max}(\\Gamma_\\Sigma)\\mathrm{Tr}(\\Gamma_\\mu)+2\\mathrm{Tr}(\\Gamma_\\Sigma)\\mathrm{Tr}(\\Gamma_\\mu))$, and the data-uncertainty layer $\\bar\\beta_2$ vanishes as $N\\to\\infty$.","In the spacecraft case study the robust worst-case analysis with $\\varsigma\\varsigma^\\top\\preceq\\kappa^2 I_3$ finds no controller, while the stochastic formulation with the same noise bounds yields a controller and quantified guarantees, showing when the probabilistic relaxation converts an infeasible problem into a feasible one."],"supporting_citations":[{"why":"Supplies the direct trajectory-based data-driven framework and the matrix S-lemma starting point that the stochastic formulation generalizes.","marker":"[14]"},{"why":"Introduces the matrix S-lemma for noisy data, the key tool for encoding data-conformity constraints on the unknown matrix.","marker":"[15]"},{"why":"Defines stochastic control barrier certificates and their safety role, providing the definition used in the paper.","marker":"[46]"},{"why":"Gives the stochastic-stability and supermartingale result behind the finite-horizon safety probability in Theorem 1.","marker":"[47]"},{"why":"Provides the model-based safety guarantee (Theorem 1) that the data-driven synthesis inherits.","marker":"[48]"},{"why":"Supplies the Gaussian fourth-moment identities used in Lemma 1 to compute the concentration bound.","marker":"[57]"},{"why":"Is the matrix S-lemma applied in the proof of Theorem 2 to combine the barrier condition with data-conformity constraints.","marker":"[60]"}],"fun_headline_variants":["No dynamics, just noise: safety with certified odds","Non-iid data yields stochastic safety guarantees","Correlated trajectories learn safety barriers","Beyond worst-case: certified safety from noisy runs","Stochastic control certificates from finite-horizon data"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The certified confidence rests on a bound on the noise's fourth moment that the proof computes exactly only for Gaussian noise, so for heavier-tailed distributions the same confidence level is not established by the paper.","fun_headline_variants_meta":{"raw":{"variants":["No dynamics, just noise: safety with certified odds","Non-iid data yields stochastic safety guarantees","Correlated trajectories learn safety barriers","Beyond worst-case: certified safety from noisy runs","Stochastic control certificates from finite-horizon data"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000192,"raw_usage":{"total_tokens":1401,"prompt_tokens":1056,"completion_tokens":345,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":672,"completion_tokens_details":{"reasoning_tokens":276}},"tokens_in":672,"tokens_out":345,"duration_ms":4788,"temperature":1.0,"reasoning_tokens":276,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-06T10:54:15.693582+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Repeat the data-collection experiment in Algorithm 1 with a heavy-tailed noise (for example, Student-$t$ with five degrees of freedom) scaled to satisfy the same covariance bound $\\Gamma_\\Sigma$, and count how often the data-conformity inequality (10) fails across many independent data sets; if the failure frequency exceeds $\\bar\\beta_2$, the Gaussian fourth-moment calculation in Lemma 1 is not distribution-free and the stated confidence is not valid for that noise.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Gives the stochastic-stability and supermartingale result behind the finite-horizon safety probability in Theorem 1."},{"cited_title":"From small-gain theory to com- positional construction of barrier certificates for large-scale stochastic systems,","cited_arxiv_id":null,"evidence_quote":"Provides the model-based safety guarantee (Theorem 1) that the data-driven synthesis inherits."},{"cited_title":"The matrix cookbook,","cited_arxiv_id":null,"evidence_quote":"Supplies the Gaussian fourth-moment identities used in Lemma 1 to compute the concentration bound."},{"cited_title":"From noisy data to feedback controllers: Nonconservative design via a matrix s-lemma,","cited_arxiv_id":null,"evidence_quote":"Is the matrix S-lemma applied in the proof of Theorem 2 to combine the barrier condition with data-conformity constraints."}],"review_version":1}