ISS-CLF/RCBF Neural Policy Shield
Implementation & benchmark of arXiv:2607.28353 — Input-to-state Stable Approximate Nonlinear Model Predictive Control with Realtime Feasibility
Source paper: Input-to-state Stable Approximate Nonlinear Model Predictive Control with Realtime Feasibility arXiv:2607.28353 ⓘ · analyzed Aug 31, 2026
AI-generated research hypothesis, automatically tested. Not peer-reviewed.
Idea description
Attach a small robust quadratic-program layer to a neural controller. The network proposes an action, and the QP returns the closest action satisfying an ISS Lyapunov decrease constraint and a robust safety-barrier constraint under bounded model disturbances. This should preserve the network's behavior away from constraint boundaries while preventing unstable or unsafe actions near those boundaries.
Formulas
Mathematical statement
For a continuous-time input-affine plant or learned latent dynamics, let x in R^n be the state, u in R^m the action, w in W an unknown disturbance, and x_dot = f_0(x) + g(x)u + p(x)w. Let V(x) >= 0 be an ISS control Lyapunov function and h(x) >= 0 define the safe set. Assume W = {w: ||w||_2 <= w_bar}. The worst-case disturbance contribution to the derivative of a differentiable scalar q is bounded by w_bar ||p(x)^T grad q(x)||_2. Enforce the ISS-CLF condition grad V(x)^T(f_0(x)+g(x)u) + w_bar ||p(x)^T grad V(x)||_2 + c_V V(x) <= s_V and the robust CBF condition grad h(x)^T(f_0(x)+g(x)u) - w_bar ||p(x)^T grad h(x)||_2 + alpha_h(h(x)) >= -s_h, where c_V > 0, alpha_h is an extended class-K function such as alpha_h(h)=c_h h, and s_V,s_h >= 0 are penalized slacks. With zero slacks, the Lyapunov condition predicts V(t) <= exp(-c_V t)V(0) + d_V(1-exp(-c_V t))/c_V when residual disturbance effects are bounded by d_V. The QP chooses the smallest deviation from the neural action while satisfying these inequalities and actuator bounds.
Implementation notes
1. Integration point: use a neural policy u_theta(x) in an RL agent, an RNN/SSM controller, or a learned latent-dynamics controller. At every control step, evaluate the policy once and pass its action through a tiny QP layer. For an initial MVP, use a known two-dimensional plant such as a pendulum or point mass, choose V(x)=||x-x_goal||_2^2 and h(x) as the signed distance to obstacles or state limits, and use box constraints for u. 2. Pseudocode: compute f_0(x), g(x), and p(x); compute u_net=u_theta(x); compute gradients of V and h by autodiff; calculate r_V=w_bar ||p^T grad V||_2 and r_h=w_bar ||p^T grad h||_2; solve the displayed QP; execute u*. During training, backpropagate through a differentiable QP solver or stop gradients through the projection initially. 3. Computed quantities are the CLF/CBF gradients, nominal vector fields, actuator bounds, and analytic worst-case norm margins. Estimate w_bar from held-out model residuals using a high quantile, and log both slack variables and QP infeasibility. 4. First cheap experiment: train the same PPO or SAC MLP on a two-dimensional obstacle-avoidance task with and without the shield, using identical seeds and injected bounded disturbances. The quantitative prediction is that trajectories satisfying the CLF with negligible slack obey an empirical envelope V(t) approximately less than or equal to exp(-c_V t)V(0)+d_V/c_V; fit the decay rate and require it to agree with c_V within 20 percent. Increase w_bar until the robust margin crosses the available control authority; QP infeasibility and safety violations should exhibit a sharp transition near that predicted feasibility boundary. Compare action deviation, violation rate, and episode return.
Verification
Stage 1 · Toy mechanism gate: Passed ✓
Stage 2 · Mechanism transferred to benchmark: Not reproduced ✗
Stage 2 · Practical benchmark result: Significantly worse ✗
Methodology: 8 paired seeds, permutation test (p<0.05) against a learning-rate-tuned baseline. How verification works
Stage 1 — Mechanism check agent confidence 8/10
Built a scalar robust ISS-CLF/CBF policy shield with box-bounded control, analytic disturbance margins, slacked QP projection, and deterministic sweeps. The mechanism manifested: robust CLF margin scaled linearly with disturbance at observed slope 0.600 versus predicted 0.600, zero-slack feasibility ended in the predicted interval [0.80, 0.85] around the analytic boundary 0.80, and the adversarial trajectory stayed within the exponential Lyapunov envelope with max ratio 0.9999998 and residual 1.22e-6. The shield reduced safety violation fraction from 0.917 to 0 while requiring substantial action deviation, so this is evidence for safety behavior but not general RL performance.
- Agent confidence
- 8/10
- Baseline
- Adversarial scalar episode: violation_fraction=0.917, final_abs_x=3.2000.
- Idea
- Scaling slope=0.600 vs predicted 0.600; feasibility boundary predicted wbar=0.800 and observed grid transition between 0.800 and 0.850; envelope max V/bound=0.999999845, max robust CLF residual=1.22e-6; shield episode violation_fraction=0.000, final_abs_x=0.5362, mean action deviation=1.3319, mean slack=1.02e-6.
Limitations: Only a scalar known plant was tested; no neural policy training, differentiable QP backpropagation, learned dynamics, multidimensional obstacles, stochastic seeds, runtime profiling, or PPO/SAC comparison was performed. The QP uses active-set enumeration rather than a production solver, and the feasibility sweep resolution is 0.05.
How to run: python3 shield_experiment.py
Stage 2 — Benchmark vs. tuned baseline (arXiv:2607.28353)
Significantly WORSE than the tuned baseline (+277.1%, p=0.0081, wins 0 / 8 paired seeds).
- Benchmark
- Dynamics forecasting
- Model
- rnn_small
- Paired seeds
- 8
- Baseline mean
- 0.0014
- Idea mean
- 0.0054
- Effect (Δ)
- 0.0039 (+277.1%; negative = idea better)
- Wins
- 0 / 8 paired seeds
- p-value
- 0.0081 (permutation test, 20 000 shuffles)
- Smallest detectable effect
- ±70.6%
- Mechanism
- Not confirmed ✗
- Practical effect
- Hurts
- Baseline tuning
- swept over 9 configs
The benchmark evaluates supervised next-angle prediction rather than closed-loop RL return or deployed action-level QP control. The local intervention uses a scalar Euler-derived shield surrogate rather than a production differentiable QP solver; no PPO/SAC training or deployment-time safety-violation metric was tested.
How to run: python3 math_sanity.py && /home/maxwelhelp/main/bin/python3 bench_shield.py
Verdict computed by deterministic test code from paired-seed statistics — not by the language model.
Stage 2 — Benchmark latest Failed ✗
Agent confidence: 9/10
The robust shield was implemented and tested on the structurally matched dynamics track using the shared rnn_small architecture. The independent robust-margin and scalar-QP sanity checks passed, but the trained shield significantly worsened test MSE: baseline mean 0.00141983 versus idea mean 0.00535441, paired delta +0.00393458, permutation p=0.0081. Therefore the idea did not produce a benchmark win, and its neural-scale mechanism signature was not confirmed.
- Baseline
- test MSE mean=0.0014198302378645167, std=0.00039839114901047844, best_cfg={"lr":0.01,"wbar":0.05}
- Idea
- test MSE mean=0.005354407912818715, std=0.0011548517240013176, best_cfg={"lr":0.01,"wbar":0.05}; paired delta=0.003934577674954198; p_value=0.0081; idea_wins=0/8
Benchmark result
Significantly WORSE than the tuned baseline (+277.1%, p=0.0081, wins 0 / 8 paired seeds).
- Benchmark
- Dynamics forecasting
- Model
- rnn_small
- Paired seeds
- 8
- Baseline mean
- 0.0014
- Idea mean
- 0.0054
- Effect (Δ)
- 0.0039 (+277.1%; negative = idea better)
- Wins
- 0 / 8 paired seeds
- p-value
- 0.0081 (permutation test, 20 000 shuffles)
- Smallest detectable effect
- ±70.6%
- Mechanism
- Not confirmed ✗
- Practical effect
- Hurts
- Baseline tuning
- swept over 9 configs
The benchmark evaluates supervised next-angle prediction rather than closed-loop RL return or deployed action-level QP control. The local intervention uses a scalar Euler-derived shield surrogate rather than a production differentiable QP solver; no PPO/SAC training or deployment-time safety-violation metric was tested.
How to run: python3 math_sanity.py && /home/maxwelhelp/main/bin/python3 bench_shield.py
Artifacts
- bench_report.json 4.4 KB View Raw
- bench_shield.py 5.9 KB View Raw
- math_sanity.py 0.9 KB View Raw
- report.md 1.7 KB View
- report_bench_2026-08-31T193518.md 4.9 KB View
- results.json 4.1 KB View Raw
- shield_experiment.py 4.0 KB View Raw