PaperlayerView exact revision on arXiv

Source-linked AI summary

Restorative Control and the Limits of Safe Model Discrimination

Micheal Myers Jr

arXiv:2610.09442v1eess.SYcs.SYmath.OC

TL;DR

The paper asks how to secure lasting recovery through a finite intervention when candidate models route irreversible damage differently. It derives exposure-based conditions for impossibility and for restoration without identification, and bounds sampled-feedback safe-restoration probability using failure risk under the alternative model.

  • Problem

    The paper studies when uncertainty about damage routing prevents safe lasting recovery, even though either known candidate can be restored.

    Source: §I · p. 1

  • Method

    It formulates restoration as safe reachability of a recovery basin and derives exposure certificates for basin transfer and sampled-output feedback.

    Source: §I · p. 1

  • Results

    When Jint exceeds summed tolerances, no common safe open-loop input restores either candidate; with sufficient tolerance, proportional allocation restores both without identification.

    Source: §III · pp. 3–4

  • Takeaways & Limitations

    The results identify conditions under which shared control can restore both candidate models and bound feedback safe-restoration probability through alternative-model failure risk.

    Source: §I · p. 1, §III · p. 4

    The analysis uses candidates with a shared scalar baseline drift; with several recovery variables, the least-exposure path into the basin may need to be considered.

    Source: §VI · p. 6

Abstract

from arXiv · show

Restorative control seeks lasting recovery through an intervention that ends in finite time. We formulate this objective as a reach-avoid problem in which the input must bring the system safely into a desired basin of attraction before withdrawal. Two candidates share bistable baseline dynamics but accumulate irreversible damage through different allocations of drive-generated exposure. We derive a lower bound on the exposure required for basin transfer and a sufficient construction for safe restoration. When the lower bound exceeds the summed tolerances, every common open-loop input that restores either model causes failure under at least one. With sufficient tolerance, proportional allocation restores both without identification. For feedback from output samples with Gaussian noise, we bound safe-restoration probability in terms of failure risk under the alternative model. A numerical example illustrates the certificates under two sensing regimes.

I. INTRODUCTION

Restorative control seeks recovery that persists after a finite intervention, but intervention-generated harm and uncertainty about damage routing complicate withdrawal. The paper frames this as safe basin transfer and develops exposure-based certificates for when common restoration is impossible or possible without identification.

I. INTRODUCTION

  • CML treatment studies motivate balancing lasting recovery against treatment harm and learning about withdrawal outcomes.The cited trial reported cardiovascular events over ten years in 16.5% and 23.5% of patients in two nilotinib dose groups, versus 3.6% with imatinib.Source: §I · p. 1
  • The stylized problem asks when uncertainty about which candidate routes damage prevents safe lasting recovery, even though either known candidate can be restored.The candidates share bistable baseline output dynamics but damage different vulnerable components.Source: §I · p. 1
  • Restoration is a reach-avoid task: reach the recovery basin while keeping intervention-induced damage below tolerance before withdrawal.The basin depends on the applicable candidate and damage remaining at withdrawal.Source: §I · p. 1
  • A nonlinear exposure certificate lower-bounds the exposure needed for basin crossing; above summed tolerances, no common safe open-loop input restores either candidate.The bound applies even when output pauses or reverses.Source: §I · p. 1
  • When tolerance exceeds suitable comparison-drive exposure, proportional allocation certifies restoration of both candidates without identification; sampled-feedback analysis also bounds safe-restoration probability using alternative-model failure risk.The feedback bound includes a correction for noise, sample count, and horizon in the exposure-obstructed regime.Source: §I · p. 1

II. PROBLEM FORMULATION

The formulation models bistable output dynamics under drive and candidate-dependent, irreversible damage. Safety requires staying below the applicable damage tolerance, while restoration requires withdrawal from a sufficiently high output so recovery persists despite residual drag.

II. PROBLEM FORMULATION

  • The control input combines drive and allocation, while the two candidate models share output dynamics but route drive-generated damage differently.Damage accumulates irreversibly, and each candidate has a known finite tolerance.Source: §II · p. 2
  • The undamaged output has degraded and desired stable equilibria separated by an unstable threshold, and full drive can cross that barrier.Bounded-operation and separation-rate assumptions constrain the output and its response to common inputs.Source: §II · p. 2
  • Damage can approach tolerance while causing only small output drag, so measured output may reveal little about imminent failure.The pre-failure drag bound is converted into a measured-output separation bound.Source: §II · p. 2
  • A policy is viable when damage stays below tolerance; robust viability requires this under both candidates, though feedback may choose different inputs from different observations.Open-loop rules produce the same input under either candidate.Source: §II · pp. 2–3
  • Withdrawal defines restoration when drive is stopped after reaching at least s + a; bounded residual drag preserves convergence to the desired basin.Under the persistence lemma, withdrawal below s − a instead leads back to the degraded equilibrium.Source: §II · p. 3

III. EXPOSURE AND SAFE RESTORATION

The section derives exposure certificates that delimit when common safe restoration is impossible and when proportional allocation suffices. The key boundary compares the minimum exposure required to cross the basin barrier with the candidates’ combined damage tolerances.

III. EXPOSURE AND SAFE RESTORATION

  • Every trajectory reaching the basin threshold without prior failure requires at least Jint exposure, including paths that wait or backtrack.The certificate integrates a barrier-crossing potential; its band estimate explains how bounded crossing speed and damage rate combine.Source: §III · p. 3
  • When minimum crossing exposure Jint exceeds Θ1 + Θ2, no robustly viable open-loop input restores either candidate, regardless of margin or horizon.The contradiction follows because a common safe input's total damage is below summed tolerances, while restoration requires at least Jint exposure.Source: §III · p. 3
  • The crossing obstruction also applies to continuous non-complementary damage rates when their combined rate has a nondecreasing lower bound..Source: §III · p. 4
  • If a comparison trajectory reaches s + a within exposure J̄ below the summed tolerances, proportional allocation Θ1/(Θ1 + Θ2) restores both candidates without identification.The construction uses a fixed drive and withdrawal at the comparison time.Source: §III · p. 4
  • Knowing the candidate can permit restoration below Jint by allocating all drive away from that model’s damage route.A constant drive can reach s + a, although the same input may fail under the other candidate if its damage accumulates beyond tolerance.Source: §III · p. 4

IV. OUTPUT SEPARATION AND NOISY FEEDBACK

The section bounds how well noisy sampled feedback can restore one candidate without risking failure under the alternative, when the exposure lower bound exceeds total tolerance. It also compares noisy sensing with output separation under common inputs and an exact-sensing construction.

IV. OUTPUT SEPARATION AND NOISY FEEDBACK

  • Before either candidate fails, output separation under a common input is bounded because the common drive cancels and the damage terms bound the difference growth.Negative slopes contract the difference, so only the upper bound on f′ enters.Source: §IV · p. 4
  • The feedback protocol uses N noisy Gaussian output samples and permits inputs between samples to depend on prior measurements and a model-independent random seed.The controller receives no separate failure indicator, and failure is allowed.Source: §IV · p. 4
  • When Jint exceeds Θ1 + Θ2, Theorem 3 bounds safe-restoration probability under one candidate using failure risk under the alternative and a correction for sensing conditions.The proof transfers safe restoration under one candidate to a failure event under the other; the restriction can become vacuous with more samples, less noise, or a longer horizon.Source: §IV · pp. 4–5
  • With finitely many Gaussian samples, zero failure probability under both candidates rules out restoration under either, even with arbitrarily small positive noise.Better sensing can relax positive risk allowances but cannot remove this zero-risk obstruction.Source: §IV · p. 5
  • Exact continuous sensing can identify the safe allocation at arbitrarily small exposure, after which a suitable constant drive can reach the withdrawal margin when vmax > ua + ρ̄.This construction assumes a known field and exact output integration, which noisy samples do not provide.Source: §IV · p. 5

V. CERTIFIED BISTABLE INSTANCE

The bistable instance separates an exposure-based impossibility certificate from a sufficient proportional-allocation construction, then illustrates how noisy sensing changes the alternative-model failure allowance.

V. CERTIFIED BISTABLE INSTANCE

  • For the tested cubic drift, νf=7/3 globally, whereas supY |f′|=19; the instance also uses a saturating analytic damage-rate ramp and analytic drag maps.The parameters and resulting certificates are identified as the contents of Table I, but its cell values are not supplied here.Source: §V · p. 5, Table I · p. 6
  • ρ*≈0.0473 exceeds ρbar, while the steep damage-rate rise separates low-drive operation from the substantial exposure needed for basin transfer.The persistence condition also holds for the evaluated instance.Source: §V · p. 5
  • 0.1 total tolerance is below Jint ≈0.5039, ruling out common safe restoration; proportional allocation is certified when tolerance exceeds Jbar ≈0.511831.The comparison drive reaches s+a at withdrawal, with exposure only 1.57% above the lower bound.Source: §V · pp. 5–6
  • At T=2 and N=100, β1+α2 is bounded below by 0.955 (σ=0.01) and 0.549 (σ=0.001); a 0.9 target requires candidate-2 failure allowances ≈0.871 and ≈0.476.These sensing calculations use T=2, not the longer constructive horizon, and exposure tightness does not establish tightness of the noisy risk bound.Source: §V · p. 6

VI. DISCUSSION

The discussion distinguishes structural exposure obstruction from failure of a particular schedule, and connects safe preparation for withdrawal with learning which intervention to use. It also identifies open questions about sensing and the scope of the scalar recovery model.

VI. DISCUSSION

  • The gap between Jint and Jbar is undecided: the lower certificate omits drag and stops at s, while the construction reaches s+a under ρbar with one fixed schedule.The certificates distinguish a structural obstacle to common safe restoration from failure of a particular schedule.Source: §VI · p. 6
  • Because the unknown candidate determines the safe allocation, noisy learning depends on output separation before failure, and the exposure-obstructed regime bounds restoration through alternative-model failure risk.The discussion notes that a probe can retain different drag without accumulating further damage.Source: §VI · p. 6
  • How probe exposure, noise, and observation time affect safe-restoration probability under a fixed horizon and failure allowance remains open.Source: §VI · p. 6
  • The model shares a scalar baseline drift, unlike Hähnel et al.’s coupled leukemic and immune populations; with several recovery variables, basin-entry paths could have different exposure costs.A lower certificate would then need to account for the least costly path, and uncertainty in recovery dynamics would enlarge the candidate class.Source: §VI · p. 6
  • Preparing for withdrawal and learning to intervene safely are parts of the same control problem; the certificates assess whether lasting recovery is compatible with required safety.Source: §VI · p. 6
Loading 2610.09442v1…