{
 "artifacts": [
  {
   "name": "experiment.py",
   "url": "https://synthcore.org/code/1231/experiment.py"
  },
  {
   "name": "report.md",
   "url": "https://synthcore.org/code/1231/report.md"
  },
  {
   "name": "results.json",
   "url": "https://synthcore.org/code/1231/results.json"
  }
 ],
 "category": "dynamics",
 "description": "Add a bounded probing perturbation to the inputs or intermediate outputs of a neural sensor-fusion model, and choose the perturbation by maximizing separation between the predicted trusted-output set and output sets induced by candidate sensor attacks. Bounded feature and measurement uncertainty are propagated through local neural Jacobians as zonotopes, giving a conservative, geometry-based exposure objective rather than relying on random noise. Training can use the resulting margin as a robustness loss, while deployment can use the receding-horizon perturbation as an active detection action.",
 "download_zip": "https://synthcore.org/download/1231",
 "formulas_latex": [
  "$$\\mathcal{Z}=\\langle c,H\\rangle=\\{c+Hz\\mid z\\in[-1,1]^p\\},\\qquad \\langle c_1,H_1\\rangle\\oplus\\langle c_2,H_2\\rangle=\\langle c_1+c_2,[H_1\\ H_2]\\rangle.$$",
  "$$f_\\theta(x+e+\\delta)\\approx f_\\theta(x)+J_\\theta(x)e+J_\\theta(x)\\delta,\\qquad \\mathcal{Y}_0(\\delta)=\\left\\langle f_\\theta(x)+J_\\theta(x)\\delta,\\ J_\\theta(x)H_e\\right\\rangle.$$",
  "$$m_j(q,\\delta)=q^T(c_0(\\delta)-c_j(\\delta))-\\left\\|q^TH_0(\\delta)\\right\\|_1-\\left\\|q^TH_j(\\delta)\\right\\|_1,$$",
  "$$\\delta^*_{0:T-1}=\\arg\\max_{\\|\\delta_t\\|_\\infty\\leq\\epsilon_t}\\ \\max_{\\|q\\|_2=1}\\min_{j\\in\\mathcal{A}}m_j(q,\\delta),\\qquad \\text{certificate if }\\min_{j\\in\\mathcal{A}}m_j(q,\\delta^*)\u003e0.$$"
 ],
 "id": 3068,
 "implementation": "1. Integration point: begin with a two- or three-modality sensor-fusion MLP or graph neural network. At inference time, inject a bounded perturbation \\(\\delta_t\\) into the raw modality vector or into the fused latent before the prediction head. Define the trusted hypothesis as all modalities obeying their calibrated bounded error sets; define each attack hypothesis \\(j\\) as a subset of modalities whose latent or measurement center is shifted by a bounded attack generator. 2. Pseudocode: for each batch, compute the nominal output \\(c=f_\\theta(x)\\) and Jacobian \\(J=\\partial f_\\theta/\\partial x\\) using forward-mode autodiff; form \\(H_0=JH_e\\). For each attack subset, form \\(c_j,H_j\\) by adding the attack center and generators. Sample 32 normalized directions \\(q\\), evaluate \\(m_j(q,\\delta)\\), and perform 5 projected gradient-ascent steps on \\(\\delta\\leftarrow\\Pi_{[-\\epsilon,\\epsilon]}(\\delta+\\alpha\\nabla_\\delta\\min_jm_j)\\). Apply the best perturbation, then flag a hypothesis when its observed output lies outside the trusted zonotope or when the certified worst-case margin is positive. During training, add \\(\\lambda\\max(0,\\tau-\\min_jm_j)\\) to the task loss. 3. Computed from the mechanism: zonotope Minkowski propagation, linear maps, support-function terms \\(\\|q^TH\\|_1\\), and the positive-margin disjointness certificate. Estimated empirically: the local Jacobian, uncertainty generator sizes, attack generator sizes, and the quality of the linearization; validate the latter by comparing zonotope bounds with Monte Carlo perturbations. 4. First cheap experiment: train a three-sensor MNIST or CIFAR-10 fusion MLP where one sensor is corrupted by a bounded additive shift, using standard ERM versus the active-exposure loss. Sweep exposure budget \\(\\epsilon\\) and plot the worst-case margin and attack detection rate. The quantitative prediction is a transition near the smallest budget \\(\\epsilon_c\\) for which the optimized margin crosses zero; detection should become reliable immediately after \\(\\min_jm_j\u003e0\\), while the measured output-set miss rate should remain below 5% on sampled bounded perturbations. Compare the predicted margin with Monte Carlo extrema and require at least 90% agreement in sign.",
 "math_summary": "A zonotope is \\(\\mathcal{Z}=\\langle c,H\\rangle=\\{c+Hz:z\\in[-1,1]^p\\}\\), where \\(c\\) is the center and \\(H\\) contains generator vectors. Minkowski addition and linear maps obey \\(\\langle c_1,H_1\\rangle\\oplus\\langle c_2,H_2\\rangle=\\langle c_1+c_2,[H_1\\ H_2]\\rangle\\) and \\(K\\langle c,H\\rangle=\\langle Kc,KH\\rangle\\). For a neural fusion map \\(f_\\theta\\), locally approximate \\(f_\\theta(x+e+\\delta)\\approx f_\\theta(x)+J_\\theta(x)(e+\\delta)\\), where \\(e\\) is bounded uncertainty, \\(\\delta\\) is the chosen probing perturbation, and \\(J_\\theta(x)\\) is the input Jacobian. If trusted uncertainty is \\(\\mathcal{Z}_0=\\langle c_0,H_0\\rangle\\) and attack hypothesis \\(j\\) gives \\(\\mathcal{Z}_j=\\langle c_j,H_j\\rangle\\), a sufficient separation certificate is the existence of a direction \\(q\\) such that \\(q^Tc_0-|q^TH_0|_1\u003eq^Tc_j+|q^TH_j|_1\\). The scalar margin is \\(m_j(q)=q^T(c_0-c_j)-|q^TH_0|_1-|q^TH_j|_1\\); positive margin certifies disjointness along projection \\(q\\). Optimize the bounded exposure over a horizon by maximizing the worst-case margin subject to \\(\\|\\delta_t\\|_\\infty\\leq\\epsilon_t\\).",
 "math_tags": [
  "control-theory",
  "dynamical-systems",
  "linear-algebra",
  "geometry",
  "optimization"
 ],
 "ml_areas": [
  "optimizer",
  "training-dynamics",
  "graph-nn",
  "rl"
 ],
 "paper": {
  "arxiv_id": "2609.02587",
  "arxiv_url": "https://arxiv.org/abs/2609.02587",
  "summary_what_math_gives_to_ml": "The paper provides a constructive active-exposure mechanism: represent bounded-noise state/output predictions and attack hypotheses as zonotopes, then optimize bounded control-channel perturbations so the admissible and attack output sets become separated. Its transferable asset is not merely interval uncertainty, but a receding-horizon controller that actively creates a measurable detection margin against multiple simultaneous sensor compromises. For neural sensor-fusion systems, the same mechanism can inject small probing perturbations into inputs or intermediate modalities and use Jacobian-based zonotopes to select perturbations that maximally separate trusted and corrupted-feature predictions. The key falsifiable signature is a sharp transition from overlapping sets to a positive separation margin as exposure budget increases.",
  "title": "Zonotope-Based Active Exposure of Stealthy Deception Attacks in Sensor-Fusion Systems",
  "year": "2026"
 },
 "ratings": {
  "difficulty": 6,
  "novelty": 7,
  "usefulness": 7
 },
 "solves": [
  "stability",
  "accuracy",
  "sample-efficiency"
 ],
 "title": "Zonotope Active Exposure for Sensor-Fusion Networks",
 "url": "https://synthcore.org/idea/3068/zonotope-active-exposure-for-sensor-fusion-networks",
 "verification": {
  "peer_reviewed": false,
  "stage1_mechanism_check": {
   "worked": false,
   "confidence": 9,
   "verdict": "Built a deterministic toy sensor-fusion MLP experiment with exact zonotope Minkowski and linear-map checks, support-function margins, and nonlinear probe evaluation. The algebra checks passed at about 2.2e-16 error and the static example had a positive 0.37 certificate, but under the idea's stated shared local Jacobian the probe term Jδ cancels between trusted and attack centers, so the certified margin stayed exactly constant across the full probe budget. The nonlinear network showed a modest 0.0583 separation increase, but this was not captured or optimized by the proposed first-order objective; therefore the claimed active-exposure mechanism was not demonstrated.",
   "metrics": {
    "baseline": "No probe: nonlinear trusted/attacked output separation 0.58834; local certified margin 0.33129",
    "idea": "Best bounded probe: nonlinear separation 0.64665 (+0.05830), but local certified margin remained 0.33129 for every probe, with margin range 0.0"
   },
   "how_to_run": "python3 experiment.py",
   "files": [
    "experiment.py",
    "results.json"
   ],
   "limitations": "Only a two-input, one-output synthetic regression MLP and one fixed attack hypothesis were tested; no multi-step horizon, training robustness loss, detection-rate benchmark, modality-specific Jacobians, or MNIST/CIFAR sensor-fusion experiment was run. The positive certificate and sampled support-bound check are toy numerical validations, not a deployment-scale robustness evaluation."
  },
  "status": "mechanism_failed",
  "status_label": "Mechanism failed",
  "updated_at": "2026-09-03T13:16:37",
  "verdict_source": "deterministic test code (paired-seed permutation statistics)",
  "verification_axes": {
   "benchmark_mechanism": {
    "confirmed": null,
    "tested": false
   },
   "practical_benchmark": {
    "beats_baseline": null,
    "tested": false
   },
   "toy_mechanism_gate": {
    "confirmed": false,
    "tested": true
   }
  }
 }
}