Zonotope Active Exposure for Sensor-Fusion Networks

1. Integration point: begin with a two- or three-modality sensor-fusion MLP or graph neural network. At inference time, inject a bounded perturbation \(\delta_t\) into the raw modality vector or into the fused latent before the prediction head. Define the trusted hypothesis as all modalities obeying their calibrated bounded error sets; define each attack hypothesis \(j\) as a subset of modalities whose latent or measurement center is shifted by a bounded attack generator. 2. Pseudocode: for each batch, compute the nominal output \(c=f_\theta(x)\) and Jacobian \(J=\partial f_\theta/\partial x\) using forward-mode autodiff; form \(H_0=JH_e\). For each attack subset, form \(c_j,H_j\) by adding the attack center and generators. Sample 32 normalized directions \(q\), evaluate \(m_j(q,\delta)\), and perform 5 projected gradient-ascent steps on \(\delta\leftarrow\Pi_{[-\epsilon,\epsilon]}(\delta+\alpha\nabla_\delta\min_jm_j)\). Apply the best perturbation, then flag a hypothesis when its observed output lies outside the trusted zonotope or when the certified worst-case margin is positive. During training, add \(\lambda\max(0,\tau-\min_jm_j)\) to the task loss. 3. Computed from the mechanism: zonotope Minkowski propagation, linear maps, support-function terms \(\|q^TH\|_1\), and the positive-margin disjointness certificate. Estimated empirically: the local Jacobian, uncertainty generator sizes, attack generator sizes, and the quality of the linearization; validate the latter by comparing zonotope bounds with Monte Carlo perturbations. 4. First cheap experiment: train a three-sensor MNIST or CIFAR-10 fusion MLP where one sensor is corrupted by a bounded additive shift, using standard ERM versus the active-exposure loss. Sweep exposure budget \(\epsilon\) and plot the worst-case margin and attack detection rate. The quantitative prediction is a transition near the smallest budget \(\epsilon_c\) for which the optimized margin crosses zero; detection should become reliable immediately after \(\min_jm_j>0\), while the measured output-set miss rate should remain below 5% on sampled bounded perturbations. Compare the predicted margin with Monte Carlo extrema and require at least 90% agreement in sign.