SOS Backup Shield for Learned Policies

1. Exact integration point: place the shield after the neural policy forward pass in a continuous-control RL agent, learned robot controller, or neural world-model rollout. Let $x$ be the state, $\pi_\theta(x)$ the nominal action, and $h(x)\geq0$ a known instantaneous safety function. Fit polynomial approximations $\hat f,\hat g$ to the dynamics on a compact operating box, or use a polynomial simulator. Choose a terminal safe set $\mathcal{S}_{\mathrm{term}}$ with a simple certified controller and solve an offline SOS program for polynomial $V(t,x)$ and polynomial backup feedback $k_b(t,x)$ over horizon $T$. 2. Pseudocode: at each step compute $u_\pi=\pi_\theta(x)$ and the margin $m=\nabla h(x)^\top[\hat f(x)+\hat g(x)u_\pi]+\alpha(h(x))$. If $m\geq0$ and $V(0,x)\leq1$, execute $u_\pi$; otherwise compute remaining backup time $\tau$ and execute the saturated $k_b(\tau,x)$. During SOS synthesis enforce $-\partial_tV-\nabla V^\top(\hat f+\hat gk_b)\geq0$, input-polytope constraints, and terminal inclusion through SOS multipliers. 3. Computed from the paper: the certificate, backup controller, and certified sublevel geometry. Estimated empirically: dynamics approximation error, actual derivative of $V$, barrier margin, certificate violations under the true simulator, and certified-set volume. Add a robustness margin $\varepsilon$ by requiring the derivative to be at most $-\varepsilon\|x\|^2$ when model error is bounded. 4. First cheap experiment: use a 2-D Dubins car or torque-limited pendulum and compare PPO or SAC with no shield, a hand-designed backup controller, and the SOS shield. Train policies identically and test 1,000 random initial states near the safety boundary. The falsifiable prediction is that every rollout initialized inside the certified $\mathcal{B}_0$ remains safe and reaches $\mathcal{S}_{\mathrm{term}}$ under backup control, subject to the measured model-error margin. Outside $\mathcal{B}_0$, failure probability should rise sharply. The main quantitative signature is a certified-set volume larger than the original terminal backup set, empirical safety violations below the robustness tolerance, and a switch boundary matching the predicted contour $V(0,x)=1$ within 10-20%.