PaperlayerView exact revision on arXiv

Source-linked AI summary

Anytime-Valid Certification of Robustness Margins for Safe Control via E-Values

Panagiotis S. Trakas, Omid Mirzaeedodangeh, Lars Lindemann

arXiv:2610.23746v1eess.SYcs.SY

TL;DR

Unknown model error makes robustness-margin selection difficult: small margins may underprotect, while large ones restrict feasibility and performance. The paper tests candidate margins online with anytime-valid e-value tests for robust CBF control; across five settings, certified variants had 0% deployment-event frequency over 200 trajectories, unlike ACI and QT.

  • Problem

    The model error needed to choose a robust CBF margin is typically unknown, and margins that are too small may underprotect while unnecessarily large margins restrict feasibility and performance.

    Source: §I · p. 1

  • Method

    The method tests candidate margins using anytime-valid sequential e-value tests on online barrier-loss data, then transfers certified margins into robust CBF control.

    Source: Nominal model · pp. 1–2

  • Results

    Across five settings, certified variants had 0% deployment-event frequency over 200 trajectories (95% upper confidence bound 1.5%) and false-certification frequency ≤2.5%, versus ACI (99.5%) and QT (65.5%) deployment-event frequencies.

    Source: C. Results · p. 8

  • Takeaways & Limitations

    Certified margins control exceedance risk at every decision time with probability at least 1−δ; at S1, smaller V-C margins improved navigation performance but allowed more realized CBF violations.

    Source: C. Results · pp. 8–9

    Transferring certified margins into control actions relies on a bound on the increase in exceedance risk, which introduces conservatism.

    Source: Nominal model · p. 2

Abstract

from arXiv · show

Robust control uses the error between a known model and the true system as a robustness margin. However, this error is usually unknown: conservative estimates restrict feasibility and performance, while underestimates can result in violations of the control property. We estimate this robustness margin from online data using e-values, a statistical tool for hypothesis testing, in the setting of discrete-time control barrier functions (CBFs). Here, we measure the robustness margin as the difference between the observed CBF and the model-based CBF prediction. We then design a robust CBF controller in three steps by: (1) selecting a set of candidate margins, (2) obtaining validity certificates for these candidates via sequential tests based on e-values, and (3) updating the CBF controller with the smallest certified candidate. The deployed tests accumulate evidence against the hypothesis that an exceedance risk, the probability of the robustness margin exceeding the candidate margin, remains at or above a pre-specified failure probability $\alpha$. Our tests are anytime valid and thus enable the use of certified candidates in the CBF controller, guaranteeing that the probability that the exceedance risk of a certified margin exceeds $\alpha$ is at most a user-chosen confidence $\delta$. We validate our approach on navigation problems across different environments with visualizations in NVIDIA Isaac Sim.

I. INTRODUCTION

Robust CBFs address model mismatch by tightening safety constraints with a margin larger than model error, but that error is often unknown and depends on the operating range. The introduction motivates online, probabilistic approaches while noting limitations of existing Gaussian-process and conformal-prediction methods.

I. INTRODUCTION

  • Unknown, operating-range-dependent model error makes margin selection difficult: undersized margins may provide insufficient protection, while oversized ones can be conservative or infeasible.The issue also applies to robust model predictive control and control Lyapunov functions.Source: §I · p. 1
  • Gaussian-process approaches rely on a well-calibrated model assumption, while conformal prediction struggles with distribution shifts under closed-loop controller–data dependence.The supplied passage ends before completing its discussion of this issue.Source: §I · p. 1
  • The overview depicts navigation under model uncertainty and closed-loop barrier losses as evidence for selecting valid robustness margins.The figure labels online certification and adaptation as the second step.Source: §I · p. 1

Nominal model

This section describes e-value-based certification of candidate robustness margins for CBF control, including simultaneous control of false certifications and the limitation that its guarantee concerns past observations rather than safety at certification time.

A. Related Work

  • Unlike conformal-prediction approaches that require offline calibration [6]–, the proposed anytime-valid tests require neither offline calibration data nor i.i.d. observations.The paper positions direct online certification as distinct from prior martingale-based safety methods requiring precise disturbance-distribution knowledge and offline verification, –.Source: Nominal model · p. 1, A. Related Work · p. 2

Nominal model

  • Sequential e-value tests assess whether each candidate’s exceedance risk remains at or above a chosen insufficiency level; the controller uses the smallest certified candidate and adds a buffer for possible future risk increases.A certificate establishes that the candidate’s exceedance risk was below the insufficiency level at some point in the past; an anytime-valid guarantee bounds the probability of any false certification by δ.Source: Nominal model · pp. 1–2, A. Simultaneous Margin Certification · pp. 4–5

IV. ANYTIME-VALID ROBUSTNESS MARGIN CERTIFICATION

  • The paper’s contributions include online e-value certificates, expected certification-time upper bounds, a robust CBF controller using an exceedance-increase bound, and comparisons on unicycle navigation in corridor and maze environments.Parallel tests are permitted to support efficient control design despite conservatism from the risk-increase bound.Source: Nominal model · p. 2

A. Stochastic System and Nominal Model

  • The system’s true transition map is unknown, so the method assumes an available nominal one-step predictor and defines model error as the difference between the observed next state and its prediction.The nominal predictor may come from first principles or system identification.Source: A. Stochastic System and Nominal Model · p. 2

B. Robust CBF Safety Filter

  • A robust CBF filter tightens the nominal barrier condition by a margin, and the barrier loss measures the shortfall of the true barrier condition; loss no greater than the margin suffices for safety.If the initial state is safe and this loss bound holds at every time, the state remains in the safe set.Source: B. Robust CBF Safety Filter · pp. 2–3

C. Problem Statement

  • The target is to choose the smallest margin whose exceedance risk is at most α0, but the margin affects the control and thus the loss, so a prevalidated feasible fallback is required before certification.The known cmax fallback is feasible and ensures the loss is bounded by cmax almost surely; smaller candidate margins are drawn from a finite ordered grid.Source: C. Problem Statement · p. 3

A. Composite Null Hypotheses and E-Values

  • E-values provide evidence against a composite null, and multiplying one-step e-variables into a test supermartingale permits checking evidence at every time with false-rejection probability bounded by δ.The test rejects when evidence reaches 1/δ, using Ville’s inequality for the anytime-valid guarantee.Source: A. Composite Null Hypotheses and… · p. 3, B. Test Supermartingales · p. 4

A. Simultaneous Margin Certification

  • For each candidate margin, the method tests whether its exceedance risk is at least α; combining gains in parallel preserves anytime validity, and monotonicity across margins yields a simultaneous false-certification bound of δ.The α0−α difference provides a buffer against risk increases between the past observations used for certification and the current transition.Source: A. Simultaneous Margin Certification · pp. 4–5
  • With probability at least 1 − delta, every certified candidate c had exceedance risk below alpha at some earlier time s < tau(c), using the shared threshold 1/delta without independent or stationary observations.The guarantee applies to past observations; it does not identify the exact certification time or ensure p_tau(c)(c) < alpha.Source: A. Simultaneous Margin Certification · p. 5
  • Because certification does not ensure risk below alpha at the current time, the later controller combines certificates with an exceedance-risk buffer to compute safe future control inputs.The guarantee is about past observations and neither identifies the exact certification time nor ensures p_tau(c)(c) < alpha.Source: A. Simultaneous Margin Certification · p. 5

B. Evidence Growth and Certification Time

Certification-time analysis assumes the exceedance risk stays uniformly below α, yielding evidence-growth and expected-time bounds. A synthetic stock example illustrates sequential certification under time-varying, dependent losses.

B. Evidence Growth and Certification Time

  • Equation (22) bounds expected certification time when the uniform-below-α assumption holds.The proposition states the bound under its stated conditions.Source: B. Evidence Growth and Certification… · p. 5
  • Under a uniform bound ¯p(c) < α, a gain with positive g¯p(c)(λ) yields almost-sure evidence growth and finite certification time.The assumption is used only for this result; other paper results remain valid without it.Source: B. Evidence Growth and Certification… · p. 5
  • In the 1000-day TV-GARCH example, c = 0.096 was certified at day 98 without risk exceedance, while c = 0.023 was certified at day 725 after 21 exceedances.The smallest certified margin changed across eight values, from 0.06 at day 98 to 0.022 at day 937.Source: B. Evidence Growth and Certification… · p. 5
  • The exceedance risk for c = 0.023 later rose above α after certification, motivating the next section’s restarting tests.Figure 2 shows mixture evidence, smallest certified margin, mean capped certification times over 5000 trials, and conditional risks.Source: B. Evidence Growth and Certification… · p. 5, Figure 2 · p. 6

V. ROBUSTNESS MARGINS FOR SAFE CONTROL

A past certificate may no longer reflect current exceedance risk, so deployment accounts for risk increases from certification to the present. Under the stated assumptions, the resulting controller bounds conditional next-step violation risk along the closed-loop trajectory.

V. ROBUSTNESS MARGINS FOR SAFE CONTROL

  • A certificate establishes that risk was below α at an unknown past time, so deployment must account for possible risk increases to the present.The transfer uses a risk-increase bound based on changes in operating conditions and an additional bound ∆t.Source: §V · p. 6

A. Certificate Transfer and Deployment Guarantee

  • A certified margin is deployable when its risk-increase bound is at most α0 − α; the controller selects the smallest qualifying margin, or cmax if none qualifies.Certificate eligibility is checked at each decision time using the current bound.Source: A. Certificate Transfer and Deployment… · p. 6
  • Theorem 2 guarantees, with probability at least 1 − δ, that conditional next-step CBF-violation risk remains at most α0 at every decision time.This guarantee assumes Assumptions 1 and 2 and the safety filter in (26).Source: A. Certificate Transfer and Deployment… · p. 6
  • A single certificate can become too conservative as operating conditions change, motivating parallel tests for more recent certificates.A certificate no longer supports deployment when its current bound exceeds α0 − α.Source: A. Certificate Transfer and Deployment… · p. 6

B. Repeated Certification and Parallel Tests

Repeated parallel tests let the controller use more recent certificates when older margins become ineligible. Allocating the error budget across tests preserves a joint deployment guarantee and yields a finite-horizon safety bound.

B. Repeated Certification and Parallel Tests

  • Parallel tests restart for each candidate while unfinished tests continue, allowing a margin to qualify through any certificate that satisfies the deployment condition.The controller uses the minimum current risk-increase bound among certificates issued by time t.Source: B. Repeated Certification and Parallel… · pp. 6–7
  • Allocating δ across test starts preserves, with probability at least 1 − δ, the simultaneous bound pt(ct) ≤ α0 for all decision times.The same allocated level is used for every candidate within each test index.Source: B. Repeated Certification and Parallel… · pp. 6–7
  • The finite-horizon bound concerns the probability of leaving C within T steps and accounts for the initial n0 steps using fallback margin cmax.The passage contrasts this whole-horizon safety guarantee with online conformal prediction coverage averaged over time.Source: B. Repeated Certification and Parallel… · p. 7

VI. NUMERICAL EXAMPLES

  • The evaluation uses two robot-navigation scenarios, Corridor and Maze, and presents Maze results in this section.The second-order unicycle robot navigates walls and cones under a time-varying-magnitude disturbance; trajectories are visualized in NVIDIA Isaac Sim.Source: §VI · p. 7, A. Setup · p. 7

A. Setup

  • The evaluation compares five settings, each with four method variants, with additional parameter sweeps reported in a supplementary ablation report.Each setting comprises α0, α, δ, and test period K.Source: A. Setup · p. 7

B. Methods and Metrics

The evaluation varies risk-increase bounds across four method variants, compares them with nominal, fixed-margin, and adaptive baselines, and reports navigation, margin, risk, and certification metrics.

B. Methods and Metrics

  • V-U uses uniform risk-increase bounds, while V-∆, V-L, and V-C tighten bounds using candidate-specific obstacle geometry, predicted nose-point distance, or both refinements.V-C also tightens the contribution from disturbance-distribution changes; the other variants add the full drift bound ∆t.Source: B. Methods and Metrics · pp. 7–8
  • Baselines include unfiltered nominal control, fixed-margin CBF filters at 0 and cmax, ACI adapted in, and QT adapted in [18].ACI and QT target an asymptotic average loss-exceedance frequency, unlike the method’s simultaneous trajectory-wide risk limit.Source: B. Methods and Metrics · p. 8
  • For each method, scenario, and setting, validation simulates NMC = 200 trajectories, reporting mean mission time, normalized mean robustness margin, mean CBF-violation fraction, exceedance risk, deployment-risk events, and false certifications.The deployment-risk fraction counts trajectories whose deployed margin has pt(ct) > α0 at least once; false certifications are candidates certified despite exceedance risk remaining above α at all times.Source: B. Methods and Metrics · p. 8
  • In the S3 V-L maze example, Figure 3 panels (b)–(d) show selected margin, loss and margin with crosses marking Yt > ct, and estimated exceedance risk for the same trajectory.Source: Figure 3 · p. 8

C. Results

Across five settings, certified variants had no deployment violations in 200 trajectories, while V-C achieved the smallest mean margin among certified variants. The results also show a trade-off: smaller margins can improve navigation performance while permitting more realized CBF violations.

C. Results

  • 0% deployment violations were observed for every certified variant across five settings and 200 trajectories; the 95% upper confidence bound was 1.5%.False-certification frequencies were at most 2.5%, with upper confidence bounds below the corresponding δ budget.Source: C. Results · p. 8
  • V-C achieved the smallest mean margin among certified variants in every setting; at S1, it reduced the mean margin by 48% relative to cmax and shortened mission time from 54.4 to 51.3 s.At S1, V-C’s mean margin and mission time were close to QT’s, with a lower CBF-violation fraction (7.4% versus 8.0%).Source: C. Results · p. 9
  • At S1, V-C’s tighter risk-increase bounds corresponded to a 0.1% CBF-violation fraction, and smaller margins improved navigation performance while allowing more realized CBF violations.Realized violations can occur even when exceedance risk remains within its limit.Source: C. Results · p. 9
  • In the V-L trajectory at S3, observed loss exceedances occurred at 12.21% of steps while estimated exceedance risk remained below α0 = 0.30.The example distinguishes realized exceedances from the exceedance risk bounded by the theory.Source: C. Results · p. 9
  • Reducing δ from 0.20 to 0.15 raised the certification threshold and slightly increased mean margins; reducing α had competing effects whose margin outcome depended on the risk-increase bound.From S1 to S3, V-C’s mean margin increased from 0.52cmax to 0.61cmax, while V-U and V-∆ decreased from 0.97cmax to 0.82cmax.Source: C. Results · p. 9

APPENDIX A MONOTONE CERTIFICATION

  • The monotone-certification lemma states that if c is certified, every candidate c′ ≥ c is certified as well.The proof passage explains this through nondecreasing evidence in the candidate margin.Source: Appendix A · p. 10

A. Proof of Theorem 1

  • Theorem 1’s proof treats candidates that have remained α-insufficient as an initial segment of the candidate set, with that set shrinking over time.The cited passage defines this set and states its initial-segment and nesting properties.Source: A. Proof of Theorem 1 · p. 10

B. Proof of Theorem 2

  • Theorem 2’s proof deploys the largest fallback margin when no deployable candidate exists; otherwise it selects the smallest deployable candidate.The proof passage connects the selected candidate to its certification time and risk-increase bound.Source: B. Proof of Theorem 2 · p. 10

D. Proof of Corollary 1

This section develops risk-increase bounds from obstacle geometry and conditional disturbance-direction uniformity, then uses them to establish certificate bounds and their ordering. It also supports the appendix’s certification and safety claims with bounds and examples for general dynamics and unicycle systems, gain-selection guidance, and a numerical example.

D. Proof of Corollary 1

  • The Corollary 1 proof combines initial safety before certification with a finite-horizon exit bound that requires no independence between exceedance events.Before n0, the controller uses cmax and the state remains safe almost surely; an exceedance need not cause an exit.Source: D. Proof of Corollary 1 · p. 11

A. Proof of Proposition 1

  • The Proposition 1 proof establishes that the certification stopping time is finite almost surely.The proof derives the stopping-time bound (22) and concludes P(τ(c) < ∞) = 1.Source: A. Proof of Proposition 1 · p. 12

B. Gain Selection and Numerical Setup

RISK BOUND

  • Under the stated regularity conditions, Proposition 2 bounds conditional risk increases during a certificate’s monitoring period using model variation and interval-probability bounds.The proof obtains the bound from total-variation distance and a bound on probability within an interval of signed barrier shortfall.Source: RISK BOUND · p. 13

A. Deterministic bounds for general dynamics

  • For general dynamics, sufficient bounds can use a bounded-density disturbance component whose effect on the barrier is strictly monotone and does not vanish over the operating region.This construction allows nonlinear disturbance dependence but requires a component with a nonvanishing effect on the barrier.Source: A. Deterministic bounds for general… · p. 14

B. Risk-Increase Terms for the Unicycle Examples

  • For the unicycle examples, the risk-increase terms use disturbance drift and obstacle-clearance geometry, and the shortfall bound ensures Yt ≤ cmax.The variants replace the risk-increase bound with its largest value over the monitoring period; directional exceedance fractions are bounded by ¯P(c).Source: B. Risk-Increase Terms for the… · pp. 14–15
  • A geometric check ensures one obstacle feature determines ψ near the predicted nose point, with rectangle checks requiring the uncertainty disk to remain in one exterior face or corner.The check also requires nonempty feasible inputs and clearances at the predicted and past positions of at least gmin.Source: B. Risk-Increase Terms for the… · p. 15
  • The risk-increase comparison separates clearance changes, bounded by a sensitivity term, from effective-radius changes, bounded by a feature-change term.The clearance bound is uniform over g ≥ gmin and A ≤ cmax; the feature-change bound uses the effective radii of the nearest features.Source: B. Risk-Increase Terms for the… · pp. 15–16
  • The geometric construction bounds risk increase directly from obstacle geometry and conditional uniformity of disturbance direction, avoiding Proposition 2’s density bound Kp.Source: B. Risk-Increase Terms for the… · p. 16
  • The four certificate variants use uniform or candidate-specific feature-change and clearance bounds; failed required geometric checks set the corresponding bound to 1.V-C also bounds distribution changes using P̄(c); the underlying distributions are used in the proof, not to compute the bound.Source: B. Risk-Increase Terms for the… · p. 16
  • For the same history and monitoring period, the certificate bounds are ordered and satisfy condition (23), while a bound of 1 prevents deployment at that decision time.This ordering does not imply that margins selected along different closed-loop trajectories are ordered.Source: B. Risk-Increase Terms for the… · p. 17

APPENDIX E EMPIRICAL METRICS AND CHECKS

The appendix defines how simulated exceedance risks, certification and deployment events, and trajectory-level performance are evaluated. It also checks the assumptions and tightened control condition used by the guarantees.

A. False-Certification and Deployment Events

  • Exceedance risk is estimated at each recorded decision by fixing the state, input, and history, then numerically integrating the exceedance indicator over the disturbance distribution.The estimate uses the relation between Yt > c and the signed barrier shortfall exceeding c.Source: A. False-Certification and Deployment… · p. 17
  • False certification means a certified candidate’s exceedance risk stays at least α throughout monitoring; a deployment event means risk exceeds α0 at some decision.For finite K, Theorem 3 bounds both event probabilities by δ; for K = ∞, Theorems 1 and 2 bound them by δ1, subject to Assumptions 1 and 2 for deployment events.Source: A. False-Certification and Deployment… · p. 17
  • Trajectory event frequencies are estimated across independent trajectories, with 95% Clopper–Pearson upper confidence bounds used to check them against guarantee levels.Zero possible events in 200 trajectories gives a 1.5% upper confidence bound.Source: A. False-Certification and Deployment… · p. 17

B. Performance and Safety Metrics

  • Performance metrics include mission time, normalized mean robustness margin, decision fractions for violations, and mean peak exceedance risk and minimum barrier value.A trajectory that does not reach the goal counts with horizon T for mean mission time; safe-set violation means leaving C.Source: B. Performance and Safety Metrics · pp. 17–18

C. Empirical Checks of the Assumptions and the Tightened Condition

  • Assumption checks test whether the support and tightened-input conditions hold and whether estimated risk increases exceed the stated bounds at checked decisions.The bound-excess frequencies record whether positive excess occurs at any checked decision.Source: C. Empirical Checks of the Assumptions… · p. 18

D. Scenario-Specific Quantities

  • The simulations use a clearance barrier and bounded disturbances; Appendix F specifies the simulations and says methods share initial states and disturbance realizations for each Lµ.Contact is defined by clearance ψ(yk,t) ≤ 0, and the support condition holds almost surely under the stated Lipschitz and disturbance bounds.Source: D. Scenario-Specific Quantities · p. 18, Appendix F · p. 18

A. Compared Methods and Simulation Models

The simulations compare nominal, fixed-margin, adaptive-quantile, and certified filtered controllers that differ in their robustness margins. They use robot models with bounded disturbances and allocate error levels across sequential tests.

A. Compared Methods and Simulation Models

  • All filtered methods share the nominal input, limits, and weighted input-deviation objective, differing only in the robustness margin; baselines include unfiltered nominal control and fixed margins 0 and cmax.ACI and QT update online quantile estimates, raising them after an exceedance and lowering them otherwise.Source: A. Compared Methods and Simulation… · p. 18
  • The robot simulations use a clearance barrier and scenario-specific dynamics, with the Maze model including velocity and angular velocity as states and acceleration and turn-rate change as inputs.The nominal one-step predictor advances the state over one sampling period with the input held constant.Source: A. Compared Methods and Simulation… · pp. 19–20
  • The true system adds a planar displacement whose direction is uniform and independent of its magnitude given the history; the magnitude distribution shifts over time, but its distribution is unknown to the controller.The simulations contain no other model error.Source: A. Compared Methods and Simulation… · p. 20

B. Error Allocation and Bound Factor

  • The error budget normalizer b adjusts test error levels, with Theorem 3’s guarantee using δκ/b; the default sets b = κ, rounded up to 2.11.For K = ∞, only the first test starts, at σ1 = 0, with error level δ1.Source: B. Error Allocation and Bound Factor · p. 20
  • The default bound factor ϕ = 1 gives the certificate bounds, while shrinking them with ϕ < 1 need not satisfy Assumption 2.The bounds vary by candidate in the refined variants; V-∆, V-L, and V-C tailor or combine refinements to obstacle- and distance-related risk changes.Source: B. Error Allocation and Bound Factor · p. 20

C. Corridor Results

In the Corridor results, certified methods meet the event-frequency levels while reducing robustness margins relative to cmax; S1 with V-C also has a lower CBF-violation fraction than ACI and QT.

C. Corridor Results

  • 0% deployment-event frequency and at most 3.5% false-certification frequency occur in all certified Table IV rows, with mean peak exceedance risk bmpmax ≤ 0.21.Both event frequencies meet their levels.Source: C. Corridor Results · p. 20
  • 38% for S3 with V-L and 50% for S1 with V-C are the reductions in normalized mean robustness margin relative to cmax; V-C minimizes it at every setting.The S3 with V-L comparison is shown in Fig. 4.Source: C. Corridor Results · p. 20
  • 9.7% for S1 with V-C is the CBF-violation fraction, compared with 15.2–17.7% for ACI and QT.ACI, QT, and S1 with V-C have mean mission times of 33.1, 33.4, and 33.9 s, respectively.Source: C. Corridor Results · p. 20

D. Guarantees and Assumptions

Most finite-K simulation cells meet the event-frequency levels, while some cells at K = ∞ do not. The appendix also reports assumption checks and parameter sweeps, including a bound-factor setting that carries no guarantee.

D. Guarantees and Assumptions

  • 5.13% of 3000 main-grid cells have deployment events; 0.375% of 2400 finite-K cells miss a level, including a Corridor false-certification frequency of 1.0% with a 3.2% upper confidence bound.The cited finite-K cell uses (α, δ, K) = (0.15, 0.025, 10).Source: D. Guarantees and Assumptions · p. 20

CONTROL HAS CONTACT IN EVERY TRAJECTORY AND DOES NOT REACH

  • A reported control case has contact in every trajectory and does not reach the goal, giving mean mission time equal to the 70 s horizon.The section heading identifies the case; the passage reports its horizon-based mission time.Source: CONTROL HAS CONTACT IN EVERY… · p. 20

D. Guarantees and Assumptions

  • At zero possible events, δ1 = 1.23% lies below the 1.5% upper confidence bound; in the Corridor, 6.67% is reported at α = 0.05 for δ ∈ {0.05, 0.10}.Source: CONTROL HAS CONTACT IN EVERY… · p. 20
  • With ϕ = 1, Assumption 1 and the tightened condition hold at every recorded decision, no checked bound excess is positive, and every trajectory reaches the goal without contact.Some main-grid cells do not deploy margins below cmax for V-U, V-∆, or V-L, so no decision is checked there.Source: CONTROL HAS CONTACT IN EVERY… · p. 20

A. Bound Factor and Distribution-Drift Bound

B. Trajectories and Estimated Exceedance Risk

C. Distributions and Robustness-Margin Heatmap

The section visualizes trajectory distributions and certified-variant comparisons, then examines one-parameter sweeps around S3 across Corridor and Maze.

C. Distributions and Robustness-Margin Heatmap

D. Parameter Sweeps

  • Fig. 8 varies one parameter at a time around S3 for V-L and V-C in Corridor and Maze, with QT and ACI means labeled at right.Boxes show quartiles and median, whiskers mark the 5th and 95th percentiles, and markers show means; ▲/▼ indicate values above/below the axis range.Source: D. Parameter Sweeps · p. 24, Figure 8 · p. 24

Related papers

Loading 2610.23746v1…