Certifying Plans under Model Mismatch: A Trilemma for Reachability from Scarce Data

2026-08-03

AI Summary

This work addresses the problem of certifying safety reachability prior to executing a fixed control sequence under model mismatch and sparse single-step transition data. By constructing a set-membership envelope of model errors and propagating reachability tubes via zonotopes, certification is granted only when safety constraints are satisfied. The key contribution lies in uncovering a trilemma among trajectory inclusion, finite projection width, and model error, leading to a condition-dependent certification mechanism that avoids overconfidence in regions lacking data. The approach integrates component-wise Lipschitz bounds, set-membership modeling, and lower-bound analysis of projection width. Evaluated on two benchmark systems, it outperforms calibrated baselines by rejecting certification for sequences unsupported by data while recovering valid certification when relevant data and sufficient collision-avoidance margins are present.

Abstract

Sim-to-real policies are designed under nominal dynamics, but target-system trials may yield only a few isolated one-step transitions. We study pre-execution certification of a fixed control sequence, such as an action chunk produced by a learned policy. If the sequence reaches an unobserved state-input region, the observations remain consistent with target systems whose trajectories separate along it by an arbitrarily large amount. Any deterministic certifier sound for all of them must then decline to certify or return a reachable tube with arbitrarily large projected width. For bounded smooth classes of the target-nominal model error, we derive a finite plan-dependent projected-width lower bound. These results expose a trilemma among uniform trajectory containment, finite projected width, and unrestricted model-error behavior beyond the observations. ForeReach requires a supplied componentwise Lipschitz bound on the model error. Observed transition pairs can refute this declaration but cannot establish it outside the observed locations. Conditional on a valid declaration, our method constructs a set-membership envelope for the model error, propagates a zonotopic reachable tube, and certifies only when propagation remains within the certification domain and every projected tube slice avoids the unsafe set. In two benchmark systems, calibration baselines may remain narrow after losing trajectory containment outside data support, whereas our method declines to certify unsupported sequences and recovers certification when relevant target data and sufficient obstacle clearance are available.

Problem

• model mismatch
• reachability certification
• sim-to-real
• scarce data
• trilemma

Innovation

• model mismatch
• reachability certification
• trilemma
• zonotopic propagation
• sim-to-real