PaperlayerView exact revision on arXiv

Source-linked AI summary

Finite-Sample Probabilistic Safety Certification for AI-Based Grid-Edge Coordination

Yihong Zhou, Hanbin Yang, Thomas Morstyn

arXiv:2609.28182v1cs.AIcs.LGcs.SYeess.SY

TL;DR

Operators need an independent way to assess whether black-box grid AI is safe, while existing power-system statistical verification is limited. The paper reduces closed-loop evaluations to binary unsafe outcomes and uses exact binomial inference, adding sample-space adversarial attacks for distribution shifts. Its case studies with 1,000-agent models verify the finite-sample guarantee and show the value of adversarial attacks in a rolling-window workflow.

  • Problem

    Operators need an independent safety check before deploying black-box grid AI, while existing power-system statistical verification is limited and calibration distributions may differ from future conditions.

    Source: §I · pp. 1–2, §VI · p. 8

  • Method

    The framework converts closed-loop evaluations to binary unsafe outcomes, applies a one-sided finite-sample certificate, and adds physically interpretable sample-space adversarial attacks.

    Source: §I · p. 2, A. Bernoulli Reduction and Binomial… · p. 3

  • Results

    Case studies with 1,000-agent AI models verify the finite-sample safety guarantee and demonstrate the value of integrating adversarial attacks into a rolling-window workflow.

    Source: §VII · p. 9

  • Takeaways & Limitations

    The framework's computational complexity is of the same order as held-out evaluation, providing a finite-sample validity guarantee for large systems in the near term.

    Source: §VII · p. 9

    Validity relies on calibration scenarios being i.i.d. samples from the real-world distribution, an assumption that time-series grid data may violate or accompany with distribution shift.

    Source: §VI · p. 8

Abstract

from arXiv · show

Coordinating large population of flexible grid-edge devices can alleviate the need for time-consuming and capital-intensive network upgrades, and AI-based control methods such as multi-agent reinforcement learning or imitation learning are promising in their real-time decision scalability. However, system operators still need an independent and rigorous way to decide whether a given AI system is safe enough for deployment. This paper develops a finite-sample probabilistic safety certification framework for black-box AI decision models in closed-loop grid operation. The central idea is to reduce the complete input--AI--grid evaluator workflow to a binary unsafe outcome under an operator-defined safety specification, and then use exact binomial inference to certify the corresponding unsafe operation probability. Given a set of held-out calibration scenarios, the framework returns the tightest one-sided upper certificate and an accept/reject deployment criterion that controls the probability of false safety certification. Because the certification is for the calibration distribution that may deviate from the future operation, we further combine the nominal certificate with physically interpretable sample-space adversarial attacks, a concept widely used in AI to investigate the fragility of AI models. Case studies on grid-edge flexibility coordination with 1{,}000-agent AI models (independent parameters) verify the finite-sample safety guarantee and the value of integrating adversarial attacks into a rolling-window training-certification-deployment flow.

I. INTRODUCTION

AI coordination can help manage large populations of flexible grid-edge devices, but operators still need an independent way to assess deployment safety. This paper proposes finite-sample certification and sample-space adversarial attacks, then illustrates the framework in an IEEE 123-bus case study with 1,000-agent models.

I. INTRODUCTION

  • Operators lack a scalable independent check for black-box AI: exhaustive verification is rigorous, but its computational complexity limits large-scale applications.The challenge grows when many device-specific AI models interact through complex power-system constraints.Source: §I · p. 1
  • Statistical verification samples executions, evaluates a specified property, and uses confidence intervals or tests for finite-sample probability statements.Its computational cost can remain roughly the same order as model inference, unlike held-out evaluation's asymptotic-only guarantee.Source: §I · pp. 1–2
  • Prior power-system statistical verification and conformal prediction do not directly provide the systematic safety-probability certification targeted here.The cited statistical-model-checking study did not discuss guarantee tightness, while conformal prediction verifies output ranges for inputs.Source: §I · p. 2
  • The certification distribution may differ from future grid conditions, including through operating changes, simulator inaccuracy, or effects of the implemented decision.Existing distributionally robust certification uses plausible-distribution sets whose distance parameter can be difficult to interpret physically.Source: §I · p. 2
  • The framework gives a tightest finite-sample upper confidence bound on unsafe-operation probability and an accept/reject deployment criterion.It applies to held-out calibration data of any size and has computational cost on the order of ordinary closed-loop inference.Source: §I · p. 2
  • Sample-space adversarial attacks approximate worst-case unsafe-operation probability under physically interpretable perturbation budgets.The perturbations apply to scenarios such as demand or generation, rather than to the distribution itself.Source: §I · p. 2
  • The case study applies the framework to an IEEE 123-bus grid-edge coordination problem with 1,000-agent AI models having different parameters.It also includes a rolling-window safety-certification study.Source: §I · p. 2

II. SAFETY CERTIFICATION PROBLEM

  • The paper frames certification as using representative operating scenarios to derive a rigorous statistical guarantee about AI outputs' grid safety.The input scenario and AI workflow can vary, including time-series inputs and one-shot or sequential decision processes.Source: §II · p. 2

A. Mathematical Formulation

The formulation maps operating scenarios through an AI system and grid-safety simulator to a binary unsafe outcome, then estimates its probability using calibration scenarios. The calibration scenarios are assumed to be i.i.d. draws from the future operating distribution.

A. Mathematical Formulation

  • The operator specifies a real-valued safety score and threshold; the outcome is one when the score reaches or exceeds that threshold, and zero otherwise.Possible scores include line current, nodal voltage, frequency nadir, or short-circuit current magnitude.Source: A. Mathematical Formulation · p. 3
  • The safety score may combine multiple metrics, and its calculation is intended to use simulators rather than tests of an unverified AI on the real grid.Simulator mismatch is an unknown sim-to-real gap that the proposed adversarial attack can investigate.Source: A. Mathematical Formulation · p. 3
  • The workflow treats an operating scenario as input to an AI system whose outputs are evaluated by a grid-safety simulator.The AI can map observed conditions to outputs such as a control sequence.Source: A. Mathematical Formulation · pp. 2–3
  • For grid-edge energy management, quasisteady-state power flow can evaluate nodal phase voltages across the certification horizon.The example defines unsafe operation by whether the maximum voltage-magnitude deviation exceeds a prescribed limit.Source: A. Mathematical Formulation · p. 3
  • The operator's safety specification sets the voltage-deviation threshold for the binary outcome.The passage gives 0.03 or 0.05 p.u. as possible thresholds depending on the distribution-network operator's specification.Source: A. Mathematical Formulation · p. 3

B. Calibration Setup and Objective

  • Calibration scenarios are independent and identically distributed samples from the future operating-scenario distribution to be verified.The calibration dataset is therefore itself a random object.Source: B. Calibration Setup and Objective · p. 3
  • Independence is required across calibration scenarios, while spatial and temporal dependence may remain within each scenario.The components of an individual scenario need not be mutually independent.Source: B. Calibration Setup and Objective · p. 3
  • The target is the probability that a scenario drawn from the operating distribution produces an unsafe outcome; its complement is the safe-operation probability.This probability answers how likely the AI system is to be unsafe under the specified operating-scenario distribution.Source: B. Calibration Setup and Objective · p. 3

III. FINITE-SAMPLE PROBABILISTIC SAFETY CERTIFICATES

The method converts calibration evaluations into a binomial count and applies a one-sided Clopper–Pearson upper bound to unsafe-operation probability. This yields a finite-sample coverage guarantee, a tightest bound within a specified class, and an accept/reject rule for a chosen risk tolerance.

A. Bernoulli Reduction and Binomial Conversion

  • Thresholding each scenario's safety evaluation yields a binary outcome, so the unsafe count across calibration scenarios follows a binomial model.This reduces inference from a potentially complex operating-scenario distribution to the induced Bernoulli unsafe-outcome probability.Source: A. Bernoulli Reduction and Binomial… · p. 3

B. One-Sided Exact Upper Certificate

  • The one-sided Clopper–Pearson bound gives finite-sample coverage for the unsafe-operation probability from the realized calibration count.The coverage applies to a fixed AI system, calibration size, and confidence parameter under the stated sampling setup.Source: B. One-Sided Exact Upper Certificate · p. 3
  • The 1 − α confidence level describes the long-run fraction of repeated fresh calibration datasets for which the upper bound covers the true unsafe probability.The authors relate this to the long-run fraction of correct certifications made by an operator.Source: B. One-Sided Exact Upper Certificate · pp. 3–4
  • The one-sided Clopper–Pearson upper certificate is the smallest non-decreasing upper confidence bound with finite-sample coverage of at least 1 − α.The result establishes tightness within the class of bounds where more observed unsafe events cannot lower the bound.Source: B. One-Sided Exact Upper Certificate · p. 4
  • If the upper bound for the observed unsafe count is at most the prespecified risk tolerance ε, the operator may assert unsafe-operation probability at most ε with confidence 1 − α.This provides the stated accept/reject decision rule relative to the operator's risk tolerance.Source: B. One-Sided Exact Upper Certificate · p. 4
  • The risk tolerance ε should be fixed before inspecting calibration outcomes or the certification map to avoid post-hoc selection.Neither ε nor the unsafe-operation probability is random; confidence concerns the data-driven assertion procedure.Source: B. One-Sided Exact Upper Certificate · p. 4
  • Under the sampling assumption, the upper certificate converges to the empirical unsafe frequency as calibration size grows, and that frequency converges to the true probability.The stated bound on the difference between certificate and empirical frequency tends to zero with n.Source: B. One-Sided Exact Upper Certificate · p. 4

IV. SAMPLE-SPACE ROBUST CERTIFICATION

The method strengthens nominal safety certification by perturbing calibration scenarios within a physically interpretable sample-space budget and certifying the resulting adversarial set. Its upper bound is no smaller than the nominal Clopper–Pearson bound.

IV. SAMPLE-SPACE ROBUST CERTIFICATION

  • The robustness layer addresses calibration-to-operation shifts, simulator bias, possible violations of the i.i.d. assumption, and operators’ desire for stronger stress tests.The actual worst-case scenario may be model-specific because neural networks are nonlinear, especially in large systems.Source: §IV · pp. 4–5
  • A perturbation budget ρ defines a neighborhood around each calibration scenario, with distances chosen to represent limits such as 10% solar-generation deviation or a bounded number of contingencies.This makes the stress-test budget physically interpretable to system operators.Source: §IV · p. 5
  • For differentiable input-to-grid-evaluation chains, projected gradient descent can search for unsafe neighbors; non-differentiable chains can use heuristic or RL searches, including random perturbation.The final candidate is retained only if it is less safe than the original scenario.Source: §IV · p. 5
  • Unlike a standard AI adversarial attack, the search evaluates the grid safety score after the AI output, using implicit differentiation for AC power flow or sample-based gradient estimates when needed.The safety-score step may use a simulator, and the optimization can be difficult because it involves both the AI system and grid physics.Source: §IV · p. 5
  • The adversarial calibration set is then passed through the nominal certification process to obtain an upper bound on unsafe-operation probability.Theorem 4 establishes that this bound is no smaller than the nominal Clopper–Pearson upper bound.Source: §IV · p. 5

V. CASE STUDIES

The case studies evaluate safety verification for 1,000 independent agents on an IEEE 123-bus feeder, using both generated independent daily trajectories and a real-world rolling-window setting. They compare AI and rule-based controllers under voltage-based safety evaluation.

V. CASE STUDIES

  • The study evaluates 1,000 independent device agents on an IEEE 123-bus feeder, with three-phase unbalanced AC power flow and voltage magnitude as the primary safety measure.The agents control batteries, heat pumps, or generators at 15-minute intervals.Source: §V · pp. 5–6
  • The compared controllers include GradMA, IPPO, and SuperNaive; MAPPO is omitted because its memory use exceeds the available hardware limit.The paper focuses on safety verification, treating control performance as less important.Source: §V · p. 6
  • Case Study I uses HEDGE-generated independent daily demand and solar trajectories, with 365 training, 10,000 calibration, and 10,000 testing days; its safety outcome is each day’s maximum voltage deviation across 96 steps.A synthetic temperature profile is used for heat pumps.Source: §V · p. 6
  • The rolling-window case trains on five months, verifies on the sixth, and tests on the following month using raw daily trajectories; temporal correlation remains, so Assumption 1 does not hold.Each window uses the most recent six months of real-world time-series data.Source: §V · p. 6

A. Case Study I: Nominal Certification

With 100 daily calibration scenarios, the nominal Clopper–Pearson certificate provides a statistically valid upper confidence bound, while empirical calibration unsafe rates are often below out-of-sample rates.

A. Case Study I: Nominal Certification

  • The calibration empirical unsafe probability is lower than the out-of-sample unsafe probability in most tested cases, whereas the nominal Clopper–Pearson certificate gives a valid upper confidence bound under the calibration distribution.As the voltage threshold increases, verification probability cannot fall below about 0.03 with the limited calibration data.Source: A. Case Study I: Nominal Certification · p. 6

B. Case Study I: Sample-Size Effect

As calibration sample size grows, the proposed verification probabilities tighten toward out-of-sample empirical probabilities, although the held-out empirical metric can remain unreliable beyond 1,000 samples.

B. Case Study I: Sample-Size Effect

  • As n increases, proposed verification probabilities tighten toward out-of-sample empirical probabilities despite some variation; the validation-set empirical metric remains potentially unreliable with more than 1,000 samples.The sample-size study examines whether additional calibration data tighten the verification probability, as stated in Theorem 3.Source: B. Case Study I: Sample-Size Effect · p. 6

C. Case Study I: Confidence Level and Statistical Assertion

The study repeats certification across 1,000 HEDGE-generated calibration sets and checks whether the upper bounds cover independently estimated out-of-sample unsafe probabilities. The observed coverage matches or exceeds the specified confidence level.

C. Case Study I: Confidence Level and Statistical Assertion

  • The calibration sets use different HEDGE-generated scenarios, and the coverage test is repeated 1,000 times for the selected GradMAP system.The synthetic time-series data visualizes Case Study I inputs; a separate figure presents real-world time-series data for Case Study II.Source: C. Case Study I: Confidence Level and… · p. 6, Figure 2 · p. 7, Figure 3 · p. 7
  • For each representative voltage threshold, the proportion of 1,000 upper bounds at least as large as the out-of-sample unsafe probability matches or exceeds confidence level 1 −α.Each out-of-sample estimate uses a separate independent 10,000-day HEDGE-generated test set.Source: C. Case Study I: Confidence Level and… · pp. 6–7
  • As calibration data size increases, the distribution of upper bounds should have diminishing variance, as specified by Theorem 3.The observed pattern is illustrated in Fig. 6.Source: C. Case Study I: Confidence Level and… · p. 7

D. Case Study I: Robust Certificate

The robust certificate evaluates worst-case unsafe probabilities under sample-space perturbations, with results examined across perturbation budgets, confidence levels, and unsafe thresholds. Increasing the budget raises the certificate, while confidence level has its greatest impact at very low unsafe probabilities.

D. Case Study I: Robust Certificate

  • The robust certificates vary perturbation budget ρ under an ℓ∞ norm, and PGD approximates the optimization in Eq. (18).Fig. 5 compares SuperNaive with IPPO and GradMA with GradMAP using n = 100 and α = 0.05; Fig. 4 shows GradMAP dispatch on a typical held-out day with voltage limits at 0.95 and 1.05 p.u.Source: D. Case Study I: Robust Certificate · p. 7, Figure 5 · p. 7, Figure 4 · p. 7
  • The certified unsafe probability increases as the perturbation budget increases, and the heatmap can be converted into pass/fail assertions at different unsafe thresholds.The robust-certificate visualization compares nominal and robust cases and presents threshold-dependent statistical assertions.Source: D. Case Study I: Robust Certificate · p. 7
  • Increasing confidence level 1 −α has the greatest impact when certifying a very low unsafe probability.Fig. 6 examines calibration sample size at α = 0.01; its caption defines nominal CP, calibration empirical frequency, and OOS probability estimated on 10,000 scenarios.Source: D. Case Study I: Robust Certificate · p. 8, Figure 6 · p. 8

E. Case Study II

In rolling-window tests, nominal bounds were usually useful but sometimes failed to cover next-month unsafe probabilities when Assumption 1 did not hold. Adversarial CP bounds using a 1.5% PGD perturbation budget covered those probabilities.

E. Case Study II

  • With a 1.5% PGD perturbation budget, adversarial CP upper bounds cover next-month unsafe probabilities in rolling windows where nominal bounds are insufficient.The nominal certificate is usually useful, but some next-month unsafe probabilities exceed it because Assumption 1 no longer holds.Source: E. Case Study II · p. 8

VI. DISCUSSION

The discussion examines calibration sample requirements and the conditions needed for valid certification, while the conclusion presents the framework and its adversarial extension for grid-edge AI. Its case studies verify the finite-sample guarantee and demonstrate the value of integrating attacks into a rolling-window workflow.

VI. DISCUSSION

  • Validity relies on independent calibration samples from the real-world distribution, an assumption challenged by time-series data and distribution shifts.The discussion identifies simulator mismatch as another possible source of shift; suggested responses include independent simulated or trajectory samples, subsampling, recent calibration data, and sample-space attacks.Source: §VI · p. 8
  • Calibration data are not used to train, tune, select, or early-stop the AI model, so using the method as a learning metric requires another held-out dataset.Source: §VI · p. 8
  • Fig. 8 maps nominal or adversarial robust CP upper certificates and pass/fail outcomes across voltage-deviation thresholds ν and load/PV perturbation budgets ρ.The binary maps apply ε = 0.001, 0.01, and 0.05.Source: Figure 8 · p. 9
  • Approximately 299, 2,995, and 29,956 calibration samples are required to certify ε = 10^-2, 10^-3, and 10^-4, respectively, with α = 0.05 and zero observed unsafe outcomes.The required sample count grows approximately as 1/ε.Source: §VI · pp. 8–9
  • For fixed ε, required calibration samples grow only logarithmically with 1/α: at ε = 10^-3, raising confidence from 95% (α = 0.05) to 99.9999% (α = 10^-6) increases sample size from 2,995 to 13,809.Source: §VI · p. 9

VII. CONCLUSION

  • The framework provides finite-sample safety guarantees at inference-order computational cost, and grid-edge case studies with 1,000-agent models demonstrate the value of adversarial attacks in rolling-window certification and deployment.Source: §VII · p. 9
Loading 2609.28182v1…