Verification of Neural Network Control Policy Under Persistent Adversarial Perturbation

Luca Daniel; Tsui-Wei Weng; Yuh-Shyang Wang

REVIEW 2 major objections 5 minor 38 references

Verification of Neural Network Control Policy Under Persistent Adversarial Perturbation

T0 review · 2 major / 5 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Neural network policies in feedback loops can be certified to respect state and control bounds against every persistent $\ell_\infty$-bounded adversarial perturbation, with no Lipschitz or continuity assumption.

desk verdict A genuinely useful bridge between static NN verification and invariant-set control; core theorem holds, but the 5x comparison and learned-model certificate need honest caveats. read the letter →

arxiv 1908.06353 v1 pith:3RIMGA3J submitted 2019-08-18 cs.LG stat.ML

Yuh-Shyang Wang , Tsui-Wei Weng , Luca Daniel This is my paper · ORCID

classification cs.LGstat.ML MSC 93B3593D0968T07

keywords neuralnetworkverificationadversarialperturbationclosed-loopcontrolpositivelyinvariantsetrobustl-infinitynormpersistentattackcart-pole

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that the safety of a neural-network control policy inside a feedback loop can be certified against adversarial disturbances that persist forever, not just against one-shot input corruptions. The authors combine static neural-network verification, which checks what a network can output on a box of inputs, with robust control arguments that track worst-case signal bounds through the loop. The end product is a sufficient condition and an iterative algorithm that output a certified box: if the attack is bounded in $\ell_\infty$-norm, then the state, measurement, and control action provably stay inside user-specified limits for every time step. The authors also construct an attack sequence that finds violations far larger than exhaustive Monte-Carlo simulation can, which motivates needing the certificate in the first place.

What carries the argument

The load-bearing object is the positively invariant set $\mathcal{I} = \{(y,u,\alpha,\delta): |y| \preceq \bar{y},\, |u| \preceq \bar{u},\, |\alpha| \preceq \bar{\alpha},\, |\delta| \preceq \bar{\delta}\}$ for the closed-loop dynamics. The mechanism that makes it invariant is the absolute transfer-matrix operator $\mathrm{abs}(\Phi) = \sum_{t=0}^\infty |\Phi[t]|$, applied to the input-output maps $y = \Phi_{yu}u + \Phi_{yw}w + \Phi_{y\delta}\delta$ and $\alpha = \Phi_{\alpha u}u + \Phi_{\alpha w}w + \Phi_{\alpha \delta}\delta$. Because $\mathrm{abs}$ sums the absolute impulse response, the triangle inequality turns any signal bound into a one-shot worst-case convolution bound, and the feedback inequalities in Theorem 1 close the loop: if the box contains the current signals, the next signals stay inside it. The static neural-network certificate supplies the box relation between $y$ and $u$; the uncertainty model supplies the box relation between $\alpha$ and $\delta$.

What would settle it

Run the true nonlinear cart-pole plant, not the nominal learned model, with the adversarial sequence from (14) at the certified attack level and check whether the pole angle ever leaves $\bar{x}$; if it does, the bootstrap uncertainty envelope was not conservative enough. A cheaper check is to record whether fresh rollouts of the true plant ever violate $|\delta[t]| \leq \Gamma_\Delta |\alpha[t]|$ inside the certified box.

Watch

Extended reading notes

Core claim

The paper's central claim is Theorem 1. For a discrete-time LTI plant connected to a static neural-network policy and a stable norm-bounded uncertainty block, suppose one can find positive vectors $\bar{y}, \bar{u}, \bar{\alpha}, \bar{\delta}$ such that a static verifier certifies $|u| \preceq \bar{u}$ on the input box $|y| \preceq \bar{y}$, the uncertainty block maps any signal with $|\alpha[k]| \preceq \bar{\alpha}$ for $k \le t$ to $|\delta[t]| \preceq \bar{\delta}$, and the feedback inequalities $\mathrm{abs}(\Phi_{yw})\bar{w} + \mathrm{abs}(\Phi_{yu})\bar{u} + \mathrm{abs}(\Phi_{y\delta})\bar{\delta} \preceq \bar{y}$ and $\mathrm{abs}(\Phi_{\alpha w})\bar{w} + \mathrm{abs}(\Phi_{\alpha u})\bar{u} + \mathrm{abs}(\Phi_{\alpha \delta})\bar{\delta} \preceq \bar{\alpha}$ hold. Then $|y[t]| \preceq \bar{y}$, $|u[t]| \preceq \bar{u}$, $|\alpha[t]| \preceq \bar{\alpha}$, $|\delta[t]| \preceq \bar{\delta}$, and $|x[t]| \preceq \bar{x}$ hold for all $t \ge 0$, with $\bar{x} = \mathrm{abs}(\Phi_{xw})\bar{w} + \mathrm{abs}(\Phi_{xu})\bar{u} + \mathrm{abs}(\Phi_{x\delta})\bar{\delta}$. The proof is an induction that the box is positively invariant, so no differentiability or continuity of the policy is needed.

Load-bearing premise

Everything in the practical learned-model certificate rests on the elementwise modeling-error bound $|\delta[t]| \le \Gamma_\Delta |\alpha[t]|$; in Experiment II that bound is the maximum deviation over 100 bootstrap samples rather than a proof, so a plant that escapes that envelope can invalidate the certificate, and for unstable plants the argument also presupposes a stabilizing linear output-feedback gain.

Editorial extensions

If this is right

Certified safety holds for all $t \ge 0$ rather than a finite horizon, and the certificate requires no global Lipschitz constant, so quantized or discontinuous policies are covered whenever a box input-output certificate for the network exists.
Theorem 2 makes the Lipschitz-based small-gain condition a special case of the new condition, and the cart-pole experiment shows the new certificate remains valid at attack levels about five times larger than the Lipschitz baseline can certify.
On an unstable plant, the linear approximation $K_0$ only needs to stabilize the nominal closed loop; the residual policy, whether differentiable or not, is handled by the same invariant-box machinery.
The attack rule $w_j[t] = \mathrm{sign}((\Phi_{xw}[T-t])_{ij})$ exposes worst-case state deviations that exhaustive Monte-Carlo simulation at the same attack level misses, so the robustness of such control loops cannot be established by simulation alone.
When the plant model is learned, a conservative elementwise uncertainty bound $\Gamma_\Delta$ built from bootstrap samples gives certificates that approach the true-model certificate as the number of episodes grows.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The box certificate only needs a sound input-output box for the policy, so any verifier that emits such a box should slot into Algorithm 1; this is an interface-level consequence rather than an experimental claim in the paper.
The paper's attack ignores the $u_0$ and $\delta$ terms when choosing $w$, so a richer attack that optimizes $w$ with those terms included would likely shrink the gap between the certified safe region and the discovered unsafe region.
A finite-sample probabilistic replacement for the bootstrap uncertainty envelope, for instance a concentration guarantee over the plant-estimation error, would turn the learned-model certificate from an empirical over-approximation into a guarantee with stated confidence.
The same invariant-set argument is stated for vector signals, so the one-dimensional pole-angle experiment is a demonstration rather than the method's limit; certifying multi-dimensional attacks would use exactly the same inequalities.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Colleague,

Here's my read on Wang, Weng, Daniel (1908.06353). The central idea is clean: take an off-the-shelf NN output-set certifier (ReLU bound propagation, etc.), use it to bound the policy output on a measurement box, combine that with an L1/gain-bound model of uncertainty, and close the loop with a positive-invariance argument. Theorem 1 is exactly this, and the induction proof in Appendix A works. Removing the Lipschitz assumption matters in practice—quantized or otherwise discontinuous policies are not pathological, and the cart-pole experiment with a quantized policy shows the framework still certifies bounds.

The constructive search in Algorithm 1 is reasonable, and the attack rule (14) is a nice byproduct: simple, model-based, and clearly beats 1M random simulations at finding violating trajectories. The paper is honest about the limits of Monte-Carlo safety evaluation.

Now the soft spots, in order of real weight. First, the headline claim—'5.3x better than a Lipschitz-based method'—compares against a baseline whose Lipschitz constant is a lower bound obtained by sampling. The paper itself says, in the footnote on page 9, that 'Lemma 1 does not offer a safety certificate' in that setting. So the blue-vs-red comparison in Figure 2a is really 'our upper bound vs. a non-certificate lower bound'; the gap is persuasive but the claimed '5.3x larger attack level' is not a fair comparison between two valid certificates. This should be restated.

Second, the data-driven uncertainty set in Experiment II: Gamma_Delta is the elementwise max deviation over 100 bootstrap fits. That gives a statistical envelope, not a worst-case bound on the true nonlinear residual. The text only says 'empirically, there is high probability' the modeling error is bounded. Consequently, the certificate for the learned model is conditional on the envelope holding for all reachable (x,u); nothing in the paper guarantees that. The framework itself is sound—if a true Gamma_Delta existed, Theorem 1 applies—but the experimental instantiation does not establish a worst-case certificate for a real nonlinear plant.

Third, Theorem 2's claim that Lemma 1's conditions imply Theorem 1's is proved in the appendix, and the algebra looks right, but the 'strictly larger class' strengthening is not quantified. That's minor.

Who benefits: anyone working on verification of NN policies for safety-critical control; the paper gives a clean template and a strong attack baseline. Is it worth serious refereeing? Yes. The core framework is novel, useful, and the proofs hold. I'd ask for revision that rewrites the 5x claim honestly and either removes the word 'certificate' from the learned-model experiment or adds a formal uncertainty bound with a real guarantee.

Recommendation: engage, send to review, and push for those two clarifications.

Referee Report

2 major / 5 minor

Summary. This paper proposes a framework for certifying the boundedness of a feedback loop comprising a linear plant (possibly with an uncertainty block) and a neural network control policy against persistent l∞-norm-bounded adversarial perturbations. The central theoretical contribution is Theorem 1, which gives three sufficient conditions — a box-type input-output certificate for the neural network policy, a gain-type input-output property of the uncertainty block, and a set of feedback inequalities on the abs(Φ) matrices — under which the box {|y| ≤ ȳ, |u| ≤ ū, |α| ≤ ᾱ, |δ| ≤ δ̄} is positively invariant, so that state, measurement, and control remain bounded for all time (with zero initial condition; Section 3.2). Theorem 2 proves that the small-gain/Lipschitz conditions of the robust-control baseline Lemma 1 imply the conditions of Theorem 1. Algorithm 1 searches for the invariant box by iterating the neural-network certificate and the closed-loop transfer matrices, with an unstable-plant extension via a stabilizing linear gain K0 (Section 3.3). A heuristic l∞ attack is also proposed (Section 4.2). Experiments on a cart-pole example compare the certificate with a Lipschitz-based baseline (claiming a 5.3× improvement), demonstrate an attack that far exceeds Monte-Carlo-discovered deviations, and apply the algorithm to learned nonlinear models and to a quantized non-Lipschitz policy.

Significance. The invariant-set criterion in Theorem 1 is a clean and correct sufficient condition, and it is a genuine conceptual advance to combine static neural-network certifiers with robust control via positive invariance rather than through Lipschitz or Lyapunov assumptions; the framework therefore covers discontinuous and quantized policies. The proof of Theorem 1 is complete, the construction in Theorem 2 is algebraically valid, and the paper is unusually transparent: footnote 4 explicitly concedes that the Lipschitz baseline used in the experiments is not a safety certificate, and Section 5.2 concedes that the bootstrap uncertainty envelope is only an 'empirically high probability' bound. The attack algorithm is simple, independent of the certificate, and experimentally striking (a 31.4 deviation versus 5.2 under 10^6 Monte-Carlo steps). If the two load-bearing empirical gaps identified below are closed or honestly reframed, the paper would be a useful contribution to neural-network control verification. The theorems are not machine-checked, but the induction proof of Theorem 1 is short enough to be verified by hand.

major comments (2)

[§5.1, Fig. 2a, footnote 4] The paper's headline quantitative claim ('5.3× better' in §5.1, '5 times better' in the abstract) compares Algorithm 1 to the robust-control baseline of Lemma 1 whose local Lipschitz constant γπ is obtained by a sampling-based approach. Footnote 4 concedes that this gives only a lower bound on γπ and that 'Strictly speaking, since it is only a lower bound, Lemma 1 does not offer a safety certificate.' A lower bound on γπ relaxes conditions (10a)–(10c), so the red curve in Figure 2a is optimistically biased relative to any valid Lipschitz-based certificate: the baseline as plotted is not a certificate, and the experiment does not establish the advertised comparison 'to certify the robustness' with a traditional method. Either re-run the comparison with a valid upper bound on the local Lipschitz constant (e.g., the method of [37], which the paper cites), or relabel the comparison as a benchmark against a non-rigorous baseline and adjust the abstract accordingly.
[§5.2, Appendix B, Eqs. (29)–(30); Theorem 1, condition 2] For the learned-model experiment, condition 2 of Theorem 1 — the input-output property of the uncertainty block — is instantiated as |δ[t]| ≤ Γ∆ |α[t]| with Γ∆ = [∆A, ∆B] chosen as the element-wise maximum deviation over 100 bootstrap fits in (29)–(30). This quantity brackets the spread of the bootstrap estimates (A(j), B(j)) around the nominal fit (A(0), B(0)); it does not bound the true residual δ[t] = x[t+1] − A(0)x[t] − B(0)u[t] of the nonlinear plant, and it does not even account for the bias of the nominal linear model relative to the nonlinear dynamics. Consequently, for the actual unknown plant, the safety requirement (8) is not certified, and the text's own caveat ('Empirically, there is high probability that the modeling error is bounded by Δ') confirms that the required worst-case hypothesis is not verified. Since the abstract and the contribution list advertise certification on learned models of unknown, unstable, nonlinear dynamics, this gap is load-bearing. The experiment should either use a formal model-bounding procedure of the type cited from [27], or it should be reframed and reworded as an empirical demonstration under a statistically estimated envelope, with the word 'certificate' restricted to the nominal model plus the stated envelope.

minor comments (5)

[Abstract; §5.1; Fig. 2a] The improvement factor appears as '5 times' in the abstract and as '5.3 times' in the text; standardize the number and state explicitly that the comparison point is xlim = 50.
[Appendix A, proof of Lemma 1, Eq. (17d)] The expression '||Φyww||_{l∞}' should read '||Φyw w||_{l∞}' (the l∞ norm of the disturbance term); as typeset, it is confusing.
[§3.2, after Theorem 2] The claim that Theorem 1 'can be applied on a strictly larger class of problems than that of Lemma 1' is stronger than what is proven; Theorem 2 establishes only the inclusion of the condition sets. Either prove the strictness (e.g., with an explicit policy whose box certificate is non-vacuous while the Lipschitz bound fails) or soften the claim to an inclusion.
[Algorithm 1, §3.3] Clarify which bound — ū on the full policy output or ū0 on the residual policy — enters the feedback inequalities in line 7 and which one is checked against the control limit ulim; the text currently uses both without precisely defining their relationship for the unstable-plant case.
[§3.3, experiment setup] The unstable-plant extension is conditional on finding K0 with ρ(A + BK0C) < 1, an acknowledged NP-hard problem; the authors should report the achieved spectral radius in the cart-pole experiments so the reader can confirm the condition is actually met.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: Theorem 1 is a genuine sufficient-condition certificate; the only caveat is the bootstrap uncertainty envelope in Experiment II, which is an empirical assumption rather than a circular reduction.

full rationale

The derivation chain in Theorem 1 is self-contained: the paper proves by induction that the box {|y| <= ybar, |u| <= ubar, |alpha| <= alphabar, |delta| <= deltabar} is positively invariant whenever the three stated conditions hold (Appendix A). No quantity in the conclusion is used as an input to the certificate; the feedback inequalities are sufficient conditions evaluated from the plant transfer matrices, the static neural-network certificate, and the assumed uncertainty relation. Algorithm 1 searches for a fixed point and terminates with the invariant bounds, so the 'prediction' |y[t]| <= ybar, |u[t]| <= ubar, |alpha[t]| <= alphabar, |delta[t]| <= deltabar follows from the same conditions rather than being fitted. The comparison with the Lipschitz baseline is also legitimate: Theorem 2 proves a formal implication between the two sufficient conditions, and the paper explicitly notes that the sampled Lipschitz constant used for the baseline is only a lower bound. The only load-bearing empirical element is in Experiment II (Section 5.2), where Gamma_Delta is obtained as the element-wise maximum deviation over 100 bootstrap samples; the paper states only that 'Empirically, there is high probability that the modeling error is bounded by Delta.' This means the practical learned-model certificate inherits an unverified hypothesis, and if the true residual leaves the bootstrap envelope the invariant-set guarantee may fail. That is a missing-support/correctness limitation, not a circular reduction: the bootstrap bound is not fitted to the target bounds (ybar, ubar, xbar), and the theorem does not change its logical status. The availability of a stabilizing K0 is likewise an explicitly acknowledged assumption (static output feedback is NP-hard in general), not a hidden circular step. No fitted parameter is renamed as a prediction, and no load-bearing conclusion rests on a self-citation chain.

Assumptions & free parameters 2 free parameters · 5 assumptions · 0 invented entities

The central theorem is self-contained given standard control assumptions and a valid NN certificate. The practical weak points are the input-output bound of the NN policy, delegated to external tools, and the uncertainty envelope Gamma_Delta, which is empirical in Experiment II. For unstable plants, the method additionally assumes a stabilizing linear approximation K0 exists and is supplied.

free parameters (2)

Modeling error bounds Delta_A, Delta_B (Gamma_Delta) = Not numerically specified in the paper
Estimated from 100 bootstrap samples as element-wise maximum deviation; the certificate's validity for the true plant depends on this empirical bound.
Stabilizing linear approximation K0 = Not stated; candidate obtained from Jacobian at origin or from (KU+KL)/2 over a region
Algorithm 1 assumes a matrix Kd with rho(A+B Kd C) < 1 is given; the certificate for unstable plants depends on this choice, and the paper notes the static output feedback problem can be NP-hard.

assumptions (5)

standard math L1 system norm and abs(Phi) properties for stable transfer matrices
Used throughout Theorem 1 and Theorem 2 to compute worst-case l-infinity bounds from convolutions.
domain assumption The neural network certification tool returns valid bounds |u| <= ubar for all |y| <= ybar
Condition 1 of Theorem 1; the paper delegates this to external certifiers [7-13] without proving them.
domain assumption The uncertainty block Delta is stable and satisfies |delta[t]| <= Gamma_Delta |alpha[t]| over the relevant range
Condition 2 of Theorem 1; in Experiment II Gamma_Delta is obtained empirically from bootstrap samples, so this is not a formal guarantee.
ad hoc to paper For unstable plants, a stabilizing static gain K0 exists and is available
Section 3.3 and Algorithm 1 input; the paper acknowledges NP-hardness in the worst case (footnote 3).
domain assumption Zero initial condition x[0] = 0 for the main theorem
Equation (4); presented as a simplification and stated to be extendable, but the nonzero initial condition case is not formalized.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Verification of Neural Network Control Policy Under Persistent Adversarial Perturbation." pith.science (2026). https://pith.science/paper/3RIMGA3J

@misc{pith2026190806353,
  author       = {Pith},
  title        = {Pith review of: Verification of Neural Network Control Policy Under Persistent Adversarial Perturbation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/3RIMGA3J}},
  note         = {Machine review of arXiv:1908.06353}
}

read the original abstract

Deep neural networks are known to be fragile to small adversarial perturbations. This issue becomes more critical when a neural network is interconnected with a physical system in a closed loop. In this paper, we show how to combine recent works on neural network certification tools (which are mainly used in static settings such as image classification) with robust control theory to certify a neural network policy in a control loop. Specifically, we give a sufficient condition and an algorithm to ensure that the closed loop state and control constraints are satisfied when the persistent adversarial perturbation is l-infinity norm bounded. Our method is based on finding a positively invariant set of the closed loop dynamical system, and thus we do not require the differentiability or the continuity of the neural network policy. Along with the verification result, we also develop an effective attack strategy for neural network control systems that outperforms exhaustive Monte-Carlo search significantly. We show that our certification algorithm works well on learned models and achieves 5 times better result than the traditional Lipschitz-based method to certify the robustness of a neural network policy on a cart pole control problem.

Figures

Figures reproduced from arXiv: 1908.06353 by the authors.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

38 extracted references · 25 canonical work pages

[37]

Efﬁcient and accurate estimation of lipschitz constants for deep neural networks,

M. Fazlyab, A. Robey, H. Hassani, M. Morari, and G. J. Pappas, “Efﬁcient and accurate estimation of lipschitz constants for deep neural networks,”arXiv preprint arXiv:1906.04893, 2019

arXiv 1906
[27]

On the sample complexity of the linear quadratic regulator,

S. Dean, H. Mania, N. Matni, B. Recht, and S. Tu, “On the sample complexity of the linear quadratic regulator,”arXiv preprint arXiv:1710.01688, 2017

arXiv 2017
[1]

Learning deep control policies for autonomous aerial vehicles with mpc-guided policy search,

T. Zhang, G. Kahn, S. Levine, and P. Abbeel, “Learning deep control policies for autonomous aerial vehicles with mpc-guided policy search,” in 2016 IEEE international conference on robotics and automation (ICRA), pp. 528–535, IEEE, 2016

work page 2016
[2]

Adversarial attacks on neural network policies,

S. Huang, N. Papernot, I. Goodfellow, Y . Duan, and P. Abbeel, “Adversarial attacks on neural network policies,”arXiv preprint arXiv:1702.02284, 2017

arXiv 2017
[3]

Intriguing properties of neural networks,

C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus, “Intriguing properties of neural networks,”arXiv preprint arXiv:1312.6199, 2013

arXiv 2013
[4]

Adversarial examples for semantic segmentation and object detection,

C. Xie, J. Wang, Z. Zhang, Y . Zhou, L. Xie, and A. Yuille, “Adversarial examples for semantic segmentation and object detection,” inICCV, https://arxiv.org/pdf/1703.08603, 2017

arXiv 2017
[5]

Adversarial examples for evaluating reading comprehension systems,

R. Jia and P. Liang, “Adversarial examples for evaluating reading comprehension systems,” in Empirical Methods in Natural Language Processing (EMNLP), Outstanding paper award, https://arxiv.org/pdf/1707.07328, 2017

arXiv 2017
[6]

Houdini: Fooling deep structured visual and speech recognition models with adversarial examples,

M. M. Cisse, Y . Adi, N. Neverova, and J. Keshet, “Houdini: Fooling deep structured visual and speech recognition models with adversarial examples,” inAdvances in Neural Information Processing Systems, pp. 6980–6990, https://arxiv.org/pdf/1707.05373, 2017

arXiv 2017

Show all 38 references

[7]

Reluplex: An efﬁcient smt solver for verifying deep neural networks,

G. Katz, C. Barrett, D. L. Dill, K. Julian, and M. J. Kochenderfer, “Reluplex: An efﬁcient smt solver for verifying deep neural networks,” in International Conference on Computer Aided Veriﬁcation, pp. 97–117, Springer, 2017

2017
[8]

Provable defenses against adversarial examples via the convex outer adversarial polytope,

J. Z. Kolter and E. Wong, “Provable defenses against adversarial examples via the convex outer adversarial polytope,”ICML, 2018

2018
[9]

Towards fast computation of certiﬁed robustness for relu networks,

T.-W. Weng, H. Zhang, H. Chen, Z. Song, C.-J. Hsieh, D. Boning, I. S. Dhillon, and L. Daniel, “Towards fast computation of certiﬁed robustness for relu networks,”ICML, 2018

2018
[10]

Ai2: Safety and robustness certiﬁcation of neural networks with abstract interpretation,

T. Gehr, M. Mirman, D. Drachsler-Cohen, P. Tsankov, S. Chaudhuri, and M. Vechev, “Ai2: Safety and robustness certiﬁcation of neural networks with abstract interpretation,” in IEEE Symposium on Security and Privacy (SP), vol. 00, pp. 948–963, 2018

2018
[11]

A dual approach to scalable veriﬁcation of deep networks,

K. Dvijotham, R. Stanforth, S. Gowal, T. Mann, and P. Kohli, “A dual approach to scalable veriﬁcation of deep networks,” UAI, 2018

2018
[12]

Cnn-cert: An efﬁcient framework for certifying robustness of convolutional neural networks,

A. Boopathy, T.-W. Weng, P.-Y . Chen, S. Liu, and L. Daniel, “Cnn-cert: An efﬁcient framework for certifying robustness of convolutional neural networks,” inAAAI, Jan 2019

2019
[13]

Fast neural network veriﬁcation via shadow prices,

V . R. Royo, R. Calandra, D. M. Stipanovic, and C. Tomlin, “Fast neural network veriﬁcation via shadow prices,”arXiv preprint arXiv:1902.07247, 2019

1902 arXiv
[14]

Optimal and autonomous control using reinforcement learning: A survey,

B. Kiumarsi, K. G. Vamvoudakis, H. Modares, and F. L. Lewis, “Optimal and autonomous control using reinforcement learning: A survey,” IEEE transactions on neural networks and learning systems, vol. 29, no. 6, pp. 2042–2062, 2017

2017
[15]

A comprehensive survey on safe reinforcement learning,

J. Garcıa and F. Fernández, “A comprehensive survey on safe reinforcement learning,”Journal of Machine Learning Research, vol. 16, no. 1, pp. 1437–1480, 2015

2015
[16]

A lyapunov-based ap- proach to safe reinforcement learning,

Y . Chow, O. Nachum, E. Duenez-Guzman, and M. Ghavamzadeh, “A lyapunov-based ap- proach to safe reinforcement learning,” in Advances in Neural Information Processing Systems, pp. 8092–8101, 2018

2018
[17]

Safe model-based reinforcement learning with stability guarantees,

F. Berkenkamp, M. Turchetta, A. Schoellig, and A. Krause, “Safe model-based reinforcement learning with stability guarantees,” in Advances in neural information processing systems , pp. 908–918, 2017

2017
[18]

The lyapunov neural network: Adaptive stability certiﬁcation for safe learning of dynamic systems,

S. M. Richards, F. Berkenkamp, and A. Krause, “The lyapunov neural network: Adaptive stability certiﬁcation for safe learning of dynamic systems,” arXiv preprint arXiv:1808.00924, 2018

2018 arXiv
[19]

Stability-certiﬁed reinforcement learning: A control-theoretic perspective,

M. Jin and J. Lavaei, “Stability-certiﬁed reinforcement learning: A control-theoretic perspective,” arXiv preprint arXiv:1810.11505, 2018

2018 arXiv
[20]

Control-theoretic analysis of smoothness for stability-certiﬁed reinforce- ment learning,

M. Jin and J. Lavaei, “Control-theoretic analysis of smoothness for stability-certiﬁed reinforce- ment learning,” in 2018 IEEE Conference on Decision and Control (CDC) , pp. 6840–6847, IEEE, 2018. 13

2018
[21]

Verisig: verifying safety properties of hybrid systems with neural network controllers,

R. Ivanov, J. Weimer, R. Alur, G. J. Pappas, and I. Lee, “Verisig: verifying safety properties of hybrid systems with neural network controllers,” in Proceedings of the 22nd ACM International Conference on Hybrid Systems: Computation and Control, pp. 169–178, ACM, 2019

2019
[22]

Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples,

A. Athalye, N. Carlini, and D. Wagner, “Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples,”ICML, 2018

2018
[23]

Reachability analysis and safety veriﬁcation for neural network control systems,

W. Xiang and T. T. Johnson, “Reachability analysis and safety veriﬁcation for neural network control systems,”arXiv preprint arXiv:1805.09944, 2018

2018 arXiv
[24]

l1-optimal feedback controllers for mimo discrete-time systems,

M. A. Dahleh and J. B. Pearson, “ l1-optimal feedback controllers for mimo discrete-time systems,”IEEE Transactions on Automatic Control, vol. 32, no. 4, pp. 314–322, 1987

1987
[25]

K. Zhou, J. C. Doyle, and K. Glover, Robust and optimal control, vol. 40. Prentice hall New Jersey, 1996

1996
[26]

A. V . Oppenheim, A. S. Willsky, and S. H. Nawab,Signals & systems. Prentice-Hall, Inc., 1996

1996
[28]

A tour of reinforcement learning: The view from continuous control,

B. Recht, “A tour of reinforcement learning: The view from continuous control,”Annual Review of Control, Robotics, and Autonomous Systems, vol. 2, pp. 253–279, 2019

2019
[29]

Performance robustness of discrete-time systems with structured uncertainty,

M. Khammash and J. Pearson, “Performance robustness of discrete-time systems with structured uncertainty,”IEEE Transactions on Automatic Control, vol. 36, no. 4, pp. 398–412, 1991

1991
[30]

The complex structured singular value,

A. Packard and J. Doyle, “The complex structured singular value,”Automatica, vol. 29, no. 1, pp. 71–109, 1993

1993
[31]

K. J. Aström and R. M. Murray, Feedback systems: an introduction for scientists and engineers. Princeton university press, 2010

2010
[32]

Np-hardness of some linear control design problems,

V . Blondel and J. N. Tsitsiklis, “Np-hardness of some linear control design problems,”SIAM Journal on Control and Optimization, vol. 35, no. 6, pp. 2118–2127, 1997

1997
[33]

Proximal policy optimization algorithms,

J. Schulman, F. Wolski, P. Dhariwal, A. Radford, and O. Klimov, “Proximal policy optimization algorithms,”arXiv preprint arXiv:1707.06347, 2017

2017 arXiv
[34]

Stable baselines

A. Hill, A. Rafﬁn, M. Ernestus, A. Gleave, R. Traore, P. Dhariwal, C. Hesse, O. Klimov, A. Nichol, M. Plappert, A. Radford, J. Schulman, S. Sidor, and Y . Wu, “Stable baselines.” https://github.com/hill-a/stable-baselines , 2018

2018
[35]

Openai gym,

G. Brockman, V . Cheung, L. Pettersson, J. Schneider, J. Schulman, J. Tang, and W. Zaremba, “Openai gym,” 2016

2016
[36]

Efﬁcient neural network robustness certiﬁcation with general activation functions,

H. Zhang, T.-W. Weng, P.-Y . Chen, C.-J. Hsieh, and L. Daniel, “Efﬁcient neural network robustness certiﬁcation with general activation functions,” inNIPS, dec 2018

2018
[38]

H. K. Khalil, Nonlinear systems, vol. 3. Prentice hall Upper Saddle River, NJ, 2002. 14 Appendix A: proof of Theorems Here we give the proofs for Lemma 1 and Theorems 1 and 2. We also introduce Corollary 1, which is the globalH∞ version of Lemma 1. Proof of Lemma 1 Proof of Le...

2002

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.

[1] [37]

Efﬁcient and accurate estimation of lipschitz constants for deep neural networks,

M. Fazlyab, A. Robey, H. Hassani, M. Morari, and G. J. Pappas, “Efﬁcient and accurate estimation of lipschitz constants for deep neural networks,”arXiv preprint arXiv:1906.04893, 2019

arXiv 1906

[2] [27]

On the sample complexity of the linear quadratic regulator,

S. Dean, H. Mania, N. Matni, B. Recht, and S. Tu, “On the sample complexity of the linear quadratic regulator,”arXiv preprint arXiv:1710.01688, 2017

arXiv 2017

[3] [1]

Learning deep control policies for autonomous aerial vehicles with mpc-guided policy search,

T. Zhang, G. Kahn, S. Levine, and P. Abbeel, “Learning deep control policies for autonomous aerial vehicles with mpc-guided policy search,” in 2016 IEEE international conference on robotics and automation (ICRA), pp. 528–535, IEEE, 2016

work page 2016

[4] [2]

Adversarial attacks on neural network policies,

S. Huang, N. Papernot, I. Goodfellow, Y . Duan, and P. Abbeel, “Adversarial attacks on neural network policies,”arXiv preprint arXiv:1702.02284, 2017

arXiv 2017

[5] [3]

Intriguing properties of neural networks,

C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus, “Intriguing properties of neural networks,”arXiv preprint arXiv:1312.6199, 2013

arXiv 2013

[6] [4]

Adversarial examples for semantic segmentation and object detection,

C. Xie, J. Wang, Z. Zhang, Y . Zhou, L. Xie, and A. Yuille, “Adversarial examples for semantic segmentation and object detection,” inICCV, https://arxiv.org/pdf/1703.08603, 2017

arXiv 2017

[7] [5]

Adversarial examples for evaluating reading comprehension systems,

R. Jia and P. Liang, “Adversarial examples for evaluating reading comprehension systems,” in Empirical Methods in Natural Language Processing (EMNLP), Outstanding paper award, https://arxiv.org/pdf/1707.07328, 2017

arXiv 2017

[8] [6]

Houdini: Fooling deep structured visual and speech recognition models with adversarial examples,

M. M. Cisse, Y . Adi, N. Neverova, and J. Keshet, “Houdini: Fooling deep structured visual and speech recognition models with adversarial examples,” inAdvances in Neural Information Processing Systems, pp. 6980–6990, https://arxiv.org/pdf/1707.05373, 2017

arXiv 2017