Stability and performance verification of dynamical systems controlled by neural networks: algorithms and complexity
SStability and performance verification ofdynamical systems controlled by neural networks: algorithms and complexity
Milan Korda , March 4, 2021
Abstract
This note makes two observations on stability and performance verification of non-linear dynamical systems controlled by neural networks. First, we show that the stabil-ity and performance of a polynomial dynamical system controlled by a neural networkwith semialgebraically representable activation functions (e.g., ReLU) can be certifiedby convex semidefinite programming. The result is based on the fact that the semi-algebraic representation of the activation functions and polynomial dynamics allowsone to search for a Lyapunov function using polynomial sum-of-squares methods; theapproach can be viewed as a special case of the general framework of [3]. Second, we re-mark that even in the case of a linear system controlled by a neural network with ReLUactivation functions, the problem of verifying asymptotic stability is undecidable.
The recent wide-spread success and adoption of neural networks in imagine processing andmachine learning naturally lead to their applications in safety-critical domains such aerospaceor automotive, thereby raising questions of safety. This work addresses this question in thesetting of nonlinear dynamical systems controlled by neural network controllers (see Fig-ure 1). We present a method to certify stability of this closed-loop interconnection usingconvex semidefinite programming (SDP), under the assumption that the dynamics is polyno-mial and the activation functions in the neural network are semialgebraically representable(e.g., ReLU). Similarly, we derive SDPs that yield bounds on performance in terms of thenonlinear L gain or assess robustness and input-to-state stability.The SDPs provide sufficient conditions of the type “If a certain SDP is feasible, then thesystem is stable”. The size of the SDPs can be increased in order to augment their ex-pressive power and hence the chance of finding a stability certificate. On the other hand, CNRS; LAAS; 7 avenue du colonel Roche, F-31400 Toulouse; France. [email protected] Faculty of Electrical Engineering, Czech Technical University in Prague, Technick´a 2, CZ-16626 Prague,Czech Republic. a r X i v : . [ m a t h . O C ] M a r latexit sha1_base64="5/kE7ywjzWhPQnyOUaErhyxdZ5o=">AAAB6HicbVBNS8NAEJ3Ur1q/qh69LBbBU0nEoseCF48t2A9oQ9lsJ+3azSbsboQS+gu8eFDEqz/Jm//GbZuDtj4YeLw3w8y8IBFcG9f9dgobm1vbO8Xd0t7+weFR+fikreNUMWyxWMSqG1CNgktsGW4EdhOFNAoEdoLJ3dzvPKHSPJYPZpqgH9GR5CFn1FipmQ7KFbfqLkDWiZeTCuRoDMpf/WHM0gilYYJq3fPcxPgZVYYzgbNSP9WYUDahI+xZKmmE2s8Wh87IhVWGJIyVLWnIQv09kdFI62kU2M6ImrFe9ebif14vNeGtn3GZpAYlWy4KU0FMTOZfkyFXyIyYWkKZ4vZWwsZUUWZsNiUbgrf68jppX1W9WtVtupX6dR5HEc7gHC7Bgxuowz00oAUMEJ7hFd6cR+fFeXc+lq0FJ585hT9wPn8A3YmM6w== u
Nonlinear dynamical system controlled by a neural network. if the SDP is not feasible, nothing can be concluded about the stability of the closed-loopinterconnection. In fact, we prove a negative complexity result stating that the problem ofdeciding stability of a linear system controlled by a ReLU neural network is undecidable inthe Turing computational model. This immediately implies the non-existence of a boundon the size of the SDPs required for stability certification computable from the input data.Therefore, there may exist bad instances of linear systems and neural networks for which thesize of the SDPs required for stability certification grows to infinity or, possibly, for whichall of the SDPs are infeasible despite the closed-loop interconnection being stable.The method presented here is a specialization of the more general framework for verifyingstability of semialgebraically representable difference inclusions developed in [3]. In relationto our method, we are aware of the work [7] that tackles the problem using integral quadraticconstraints, which can be seen as complementary to the approach presented here. The resulton undecidability is not surprising given the expressive power of ReLU networks (being ableto express arbitrary piecewise affine functions [6, Theorem 3.4]) and given the existing bodyof work on undecidability of closely related problems in control [2]; this perhaps highlightsthat the classically used notions of complexity in computer science are not well-adapted tocontrol problems and other notions of complexity should be sought. Future work will bededicated to this and to computational aspects of the proposed approach.
In this work we consider the closed-loop interconnection of a nonlinear dynamical systemand a neural network as depicted in Figure 1.Specifically, we consider discrete-time dynamical systems of the form x + = f ( x, u ) (1)with x ∈ R n being the state, x + ∈ R n the successor state, u ∈ R m the control input and f : R n × R m → R n a polynomial transition mapping. The goal is the verify the closed-loop stability and performance of system (1) when controlled by a neural network controller u = ψ ( x ). That is, the object of interest is the system x + = f ( x, ψ ( x )) , (2)2here ψ ( x ) = W N ( . . . ρ ( W ρ ( W x + b ) + b ) . . . ) + b N (3)for some weight matrices W i and bias vectors b i . The activation functions ρ i , applied com-ponentwise on the output of each layer, are assumed to be semialgebraic; this is satisfied,e.g., for the ReLU, leaky ReLU or the saturation function . In this case, the graph of thefunction ψ can be expressed asgraph ψ = { ( x, u ) | ∃ λ ∈ R n λ s . t . g ( x, u, λ ) ≥ , h ( x, u, λ ) = 0 } for some polynomials g and h . The variables λ in K x are the so-called lifting variablesassociated to the semialgebraic functions ρ i in ψ . It follows therefore that for each x , thecontrol input u satisfies u ∈ K x , (4)where the set K x is given by K x = (cid:8) u | ∃ λ ∈ R n λ s . t . g ( x, u, λ ) ≥ , h ( x, u, λ ) = 0 (cid:9) . In this case, the set K x is a singleton although the approach of [3] that this work is basedon applies to non-singleton sets K x as well. Example 1 [ReLU] Consider the single-neuron network with a ReLU activation function,i.e., ψ ( x ) = max( w (cid:62) x + b, for some vector of weights w ∈ R n and a bias b ∈ R . The graph of the ReLU function isgiven by { ( x, u ) | u ≥ x, u ≥ , u ( u − x ) = 0 } . It follows therefore that the set K x is given by K x = { u | u ≥ w (cid:62) x + b, u ≥ , u ( u − w (cid:62) x − b ) = 0 } . We note that in this case, no lifting variables λ are needed. Example 2 (Saturation function)
Consider the single-neuron network with the activa-tion function being the saturation at +1 and − , i.e., ψ ( x ) = min(max( w (cid:62) x + b, − , for some vector of weights w ∈ R n and a bias b ∈ R . The graph of the saturation function isgiven by (cid:8) ( x, u ) | ∃ λ ∈ R s . t . u ≥ − , u ≤ , u ≥ x − λ, (5) λ ≥ , ( u − λ = 0 , ( − u − u − x + λ ) = 0 (cid:9) . (6) It follows therefore that the set K x is given by K x = { u | ∃ λ ∈ R s . t . u ≥ − , u ≤ u ≥ w (cid:62) x + b − λ, (7) λ ≥ , ( u − λ = 0 , ( − u − u − w (cid:62) x + b + λ ) = 0 } . (8) In this case, one lifting variables λ is needed. The saturation function is typically applied at the output layer in order to enforce satisfaction of boundson the control. Stability analysis
Stability of the closed-loop interconnection of (1) with (4) can be analyzed using sum-of-squares (SOS) techniques, analogously to [3], where such analysis was carried out in a moregeneral setting. In particular, asymptotic stability of such interconnection is implied by theexistence of a Lyapunov function V such that V ( x + , u + , λ + ) − V ( x, u, λ ) ≤ −(cid:107) x (cid:107) (9) V ( x, u, λ ) ≥ x, u, λ, x + , u + , λ + ) ∈ K , where K = (cid:8) ( x, u, λ, x + , u + , λ + ) | x + = f ( x, u ) , g ( x, u, λ ) ≥ , h ( x, u, λ ) = 0 ,g ( x + , u + , λ + ) ≥ , h ( x + , u + , λ + ) = 0 (cid:9) . Notice that V is allowed to depend on the output of the neural network u as well as thelifting variables λ , which increases the richness of the function class we search over afterprojecting back onto the x variable (e.g., allowing for piecewise polynomial functions of x ). Since K is basic semialgebraic, a polynomial Lyapunov function V can be searched byreplacing the inequality constraints by sufficient sum-of-squares conditions. Specifically,denoting ξ = ( x, u, λ, x + , u + , λ + ), the inequalities (9), (10) are replaced by V ( x, u, λ ) − V ( x + , u + , λ + ) − (cid:107) x (cid:107) = (11a) σ ( ξ ) + σ ( ξ ) (cid:62) g ( x, u, λ ) + σ ( ξ ) (cid:62) g ( x + , u + , λ + )+ p ( ξ ) (cid:62) h ( x, u, λ ) + p ( ξ ) (cid:62) h ( x + , u + , λ + ) + p ( ξ )( x + − f ( x, u )) V ( x, u, λ ) = ¯ σ ( x, u, λ ) + ¯ σ ( x, u, λ ) (cid:62) g ( x, u, λ ) + ¯ p ( x, u, λ ) (cid:62) h ( x, u, λ ) , (11b)where σ , σ , σ , ¯ σ , ¯ σ are (vectors of) polynomial sum of squares and p , p , ¯ p are (vectorsof) polynomials.From the previous discussion we conclude that stability of (2) is implied by the feasibility ofthe following SOS problem:find V, σ , σ , σ , p , p , p , ¯ σ , ¯ σ , ¯ p s . t . (11 a ) , (11 b ) σ , σ , σ , ¯ σ , ¯ σ SOS polynomials
V, p , p , p , ¯ p arbitrary polynomials , (12)4here the decision variables are the coefficients of the polynomials( V, σ , σ , σ , p , p , p , ¯ σ , ¯ σ , ¯ p ) . The two equality constraints (11a), (11b) are imposed by comparing coefficients and hencelead to affine constraints. The constraint that a polynomial σ of degree 2 d is sum-of-squaresis equivalent to the existence of a symmetric positive semidefinite matrix W of size (cid:0) n + dd (cid:1) such that σ ( x ) = β ( x ) (cid:62) W β ( x ), where β ( x ) is a basis of the space of polynomials of degreeat most d (e.g., the monomial basis). Therefore, when the degree of the polynomials is fixed,the optimization problem (12) translates to a convex semidefinite programming feasibilityproblem. More details on sum-of-squares programming can be found in [4, 5].Before stating our main result, we recall a classical definition of stability. Definition 1 (Stability)
The system (2) is called globally asymptotically stable if the fol-lowing two conditions hold:1. For all initial conditions x , it holds lim k →∞ x k = 0 (Global attractivity).2. For all (cid:15) > there exists δ > such that if (cid:107) x (cid:107) ≤ δ , then (cid:107) x k (cid:107) ≤ (cid:15) for all k (Lyapunov stability). The result of this section is summarized by the following theorem:
Theorem 1
If the sum-of-squares optimization problem (12) is feasible, then:1. The system (2) is globally attractive, i.e., x k → for all initial conditions.2. If in addition the function x (cid:55)→ inf {(cid:107) u (cid:107) + (cid:107) λ (cid:107) | g ( x, u, λ ) ≥ , h ( x, u, λ ) = 0 } isbounded on some neighborhood of the origin, or V does not depend on ( u, λ ) , then thesystem (2) is globally asymptotically stable. Proof:
Let ( x k ) ∞ k =0 be a trajectory of (2) and let u k = ψ ( x k ). By construction of K x ,there exists a sequence ( λ k ) ∞ k =0 such that g ( x k , u k , λ k ) ≥ h ( x k , u k , λ k ) = 0. Since x k +1 = f ( x k , ψ ( x k )), it follows that( x k , u k , λ k , x k +1 , u k +1 , λ k +1 ) ∈ K for all k . Therefore V ( x k +1 , u k +1 , λ k +1 ) − V ( x k , u k , λ k ) ≤ −(cid:107) x k (cid:107) . Given
N > k leads to V ( x N +1 , u N +1 , λ N +1 ) − V ( x , u , λ ) ≤ − N (cid:88) k =0 (cid:107) x k (cid:107) . N > N (cid:88) k =0 (cid:107) x k (cid:107) ≤ V ( x , u , λ ) − V ( x N +1 , u N +1 , λ N +1 ) ≤ V ( x , u , λ ) (13)since V is nonnegative. This implies that x k →
0, proving global attractiveness.In order to prove Lyapunov stability (condition 2 of Definition 1), fix (cid:15) > x i → k i such that (cid:107) x ik i (cid:107) > (cid:15) , where x ik i denotes the solution to (2) starting from x i evaluatedat time k i . Observe that (9) implies that 0 is the unique global minimum of V ( · , u, λ ) foreach ( u, λ ). Therefore ˜ V i = V − V (0 , u i , λ i ) is nonnegative and hence satisfies (9) and (10);consequently the estimate (13) holds with ˜ V i instead of V , i.e., N (cid:88) k =0 (cid:107) x ik (cid:107) ≤ ˜ V i ( x i , u i , λ i ) (14)for each N >
0. Denote ( u i , λ i ) a bounded (by assumption) sequence of controls andlifting variables associated to each x i . Since this sequence is bounded we can extract asubsequence (which we do not relabel) that converges to some ( u , λ ). Since x i →
0, itholds h (0 , u , λ ) = 0, g (0 , u , λ ) ≥ h and g . Therefore, by continuity of˜ V we also havelim i →∞ ˜ V i ( x i , u i , λ i ) = lim i →∞ [ V ( x i , u i , λ i ) − V (0 , u i , λ i )] = V (0 , u , λ ) − V (0 , u , λ ) = 0However, by (14), we also have (cid:107) x ik i (cid:107) ≤ ˜ V i ( x i , u i , λ i ) . Since ˜ V i ( x i , u i , λ i ) → (cid:107) x ik i (cid:107) > (cid:15) , proving Lyapunov stability.With V independent of ( u, λ ), the same conclusion follows from (14) by continuity of V . (cid:3) The local boundedness assumption of point 2 of the preceding theorem is satisfied by mostcommonly used neural networks, including the ReLU network. This is highlighted in thefollowing corollary.
Corollary 1
If the sum-of-squares optimization problem (12) is feasible with ψ being aneural network with ReLU activation functions modeled as in Example 1, then the system (2)is globally asymptotically stable. Proof:
In view of Theorem 1, we only need to verify that x (cid:55)→ inf {(cid:107) u (cid:107) + (cid:107) λ (cid:107) | g ( x, u, λ ) ≥ , h ( x, u, λ ) = 0 } is bounded. If modeled as in Example 1, then for each x the polynomialsystem h ( x, u, λ ) = 0 & g ( x, u, λ ) ≥ u being the output of theneural network and λ being the outputs of all hidden layers. Since the ReLU nonlinearity iscontinuous the local boundedness of ( u, λ ) follows. (cid:3) .2 Checking stability is undecidable Several natural questions arise as to the possible limitations of the proposed method basedon semidefinite programming:1. Does there exist a stable closed-loop interconnection of a polynomial system and aneural network controller for which the optimization problem (12) is infeasible nomatter how high the degree of the polynomials (12)?2. Does there exist an interesting class of systems and neural networks for which anupper bound on the degree of the polynomials in (12) necessary for certification ofstability of a given system can be computed from the knowledge of the coefficients ofthe polynomial f and the weights of the neural network?The answer to the first question is negative, at least for continuous-time systems, sincein this case there exist polynomial dynamical systems for which no polynomial Lyapunovfunction exists [1, Proposition 5.2]. What is perhaps more surprising is that the answer tothe second question is negative even for the very simple class of linear systems controlledby ReLU neural networks. This is implied by the following result, stating that the stabilityverification problem in this case is undecidable : Theorem 2
Let A and B be rational matrices and ψ the neural network (3) with ReLUactivation functions and rational weights and biases. The following problem is undecidable:“Is the system x + = Ax + B ψ ( x ) globally asymptotically stable?”. Proof:
The result follows from the undecidability of the global asymptotic stability problemfor the saturated systems of the form x + = sat( Dx ), where sat = min(max( x, − ,
1) is thesaturation function applied componentwise [2, Theorem 2.1]. Using the observation thatsat( x ) = ReLU( x + 1) − ReLU( x − − , we can express any saturated linear system x + = sat( Dx ) in the form of x + = Ax + B ψ ( x )by taking A = 0, B = I and W = (cid:20) DD (cid:21) , b = (cid:20) − (cid:21) , W = [ I , − I ] , b = − , where is the vector of ones and I is the identity matrix. This finishes the proof. (cid:3) In this section we briefly outline how the proposed approach extends to performance androbustness certification. We consider the system of the form x + = f ( x, ψ ( x ) , w ) (15a) y = f y ( x ) , (15b)7here y is the so-called performance output and w is the disturbance taking values in thepossibly state and control dependent set W ( x, u ) = { w | ψ ( x, u, w ) ≥ } . The following set will take place of the K in this setting: K w = (cid:8) ( x, u, λ, w, x + , u + , λ + , w + ) | x + = f ( x, u, w ) , g ( x, u, λ ) ≥ , h ( x, u, λ ) = 0 ,ψ ( x, u, w ) ≥ , g ( x + , u + , λ + ) ≥ , h ( x + , u + , λ + ) = 0 (cid:9) . The performance metric chosen is the (cid:96) gain from w to y ; we also treat the closely relatedrobust stabilization and input to state stability. Other performance metrics, both in deter-ministic and stochastic settings, can be considered using the same computation framework;see [3, Section 5.3]. (cid:96) gain We consider the nonlinear (cid:96) gain starting from a given initial condition (taken without lossof generality to be zero) defined asinf (cid:110) α | ∞ (cid:88) k =0 (cid:107) y k (cid:107) ≤ α ∞ (cid:88) k =0 (cid:107) w k (cid:107) , x = 0 (cid:111) , (16)where ( y k ) ∞ k =0 is the output of system (15) with zero initial condition and disturbance ( w k ) ∞ k =0 .An upper bound on the (cid:96) gain is provided by the following set of constraints: V ( x + , u + , λ + , w + ) − V ( x, u, λ, w ) ≤ −(cid:107) f y ( x ) (cid:107) + γ (cid:107) w (cid:107) (17) V ( x, u, λ, w ) ≥ V (0 , u, λ, w ) = 0 (19)for all ( x, u, λ, w, x + , u + , λ + , w + ) ∈ K w . Lemma 1 If ( V, γ ) satisfies (17)-(18) for all ( x, u, λ, w, x + , u + , λ + , w + ) ∈ K w , then the (cid:96) gain (16) is bounded by √ γ . Proof:
Lemma 5 and Corollary 1 in [3]. (cid:3)
In order to find a bound on the (cid:96) gain computationally, one solves the optimization problemof minimizing γ subject to the constraints (17)-(18) enforced via sufficient sum-of-squaresconstraints as in Section 3.1, leading to a convex SDP.8 .2 Robust stabilization and Input-to-state stability A minor modification of inequalities (17)-(18) allows us to verify robust stabilization andinput to state stability. In this case, we enforce, V ( x + , u + , λ + , w + ) − V ( x, u, λ, w ) ≤ −(cid:107) x (cid:107) + γ (cid:107) w (cid:107) (20) V ( x, u, λ, w ) ≥ (cid:107) x (cid:107) (21)for all ( x, u, λ, w, x + , u + , λ + , w + ) ∈ K w . The following result follows by combining the arguments of Theorem 1 in this work andLemma 5 and Corollary 1 in [3].
Lemma 2 If ( V, γ ) satisfies (20)-(21) for all ( x, u, λ, w, x + , u + , λ + , w + ) ∈ K w with γ < ∞ and if ψ is the ReLU neural network modeled as in Example 1, then the the system (15a) isinput-to-state stable (ISS). If these inequalities are satisfied with γ = 0 , then the system (15a)is robustly globally asymptotically stable. As before, replacing the inequalities by sufficient sum-of-squares constraints and minimizing γ , leads to a convex SDP. This work has been supported by European Union’s Horizon 2020 research and innovationprogramme under the Marie Sk(cid:32)lodowska-Curie Actions, grant agreement 813211 (POEMA),by the Czech Science Foundation (GACR) under contract No. 20-11626Y and by the AIInterdisciplinary Institute ANITI funding, through the French “Investing for the FuturePIA3” program under the Grant agreement n ◦ ANR-19-PI3A-0004.
References [1] A. Bacciotti and L. Rosier.
Liapunov functions and stability in control theory . SpringerScience & Business Media, 2006.[2] V. D. Blondel, O. Bournez, P. Koiran, and J. N. Tsitsiklis. The stability of saturatedlinear dynamical systems is undecidable.
Journal of Computer and System Sciences ,62(3):442–462, 2001.[3] M. Korda and C. N. Jones. Stability and performance verification of optimization-basedcontrollers.
Automatica , 78:34–45, 2017.[4] J. B. Lasserre.
Moments, Positive Polynomials and Their Applications, . Imperial CollegePress, first edition, 2009. 95] P. A. Parrilo. Semidefinite programming relaxations for semialgebraic problems.
Math-ematical programming , 96(2):293–320, 2003.[6] P. C. Petersen. Neural network theory.
University of Vienna , 2020.[7] H. Yin, P. Seiler, and M. Arcak. Stability analysis using quadratic constraints for systemswith neural network controllers. arXiv preprint arXiv:2006.07579arXiv preprint arXiv:2006.07579