Scenario Approach with Post-Design Certification of User-Specified Properties

CAR ` E et al. : SCENARIO APPR OA CH WITH POST -DESIGN CER TIFICA TION OF USER-SPECIFIED PR OPERTIES 1 Scenario Approach with Post-Design Certification of User -Specified Properties Algo Car ` e, Member , IEEE , Marco C. Campi, F ellow , IEEE , Simone Garatti, Member , IEEE Abstract —The scenario approach is an established data-driven design framework that comes equipped with a powerful the- ory linking design complexity to generalization properties. In this approach, data are simultaneously used both for design and for certifying the design’ s reliability , without resorting to a separate test dataset. This paper takes a step further by guaranteeing additional properties, useful in post-design usage but not considered during the design phase. T o this end, we introduce a two-le vel framework of appropriateness: baseline appropriateness , which guides the design process, and post-design appropriateness , which serv es as a criterion for a posteriori evaluation. W e pro vide distribution-fr ee upper bounds on the risk of failing to meet the post-design appropriateness; these bounds are computable without using any additional test data. Under additional assumptions, lower bounds are also deriv ed. As part of an effort to demonstrate the usefulness of the pr oposed methodology , the paper presents two practical examples in H 2 and pole-placement problems. Moreov er , a method is provided to infer comprehensiv e distributional knowledge of rele vant performance indexes from the available dataset. Index T erms —Scenario appr oach, data-driven control design, post-design verification I . I N T R O D U C T I O N T HE scenario approach is a well-established methodol- ogy in systems and control for data-driv en design with probabilistic guarantees. The distincti ve feature of the scenario approach is that data-driven designs are certified without the need for separate test datasets. Since its introduction in the mid-2000s, [2], [3], the scenario approach has evolv ed into a versatile framework supporting robust optimization, [4]–[6], optimization with constraint re- laxation, [7], [8], risk-averse formulations using Conditional A preliminary version of this work appeared as a conference paper in [1]. The present paper has been substantially re vised and extended. In particular , besides extensive rewriting and se veral additions introduced throughout the manuscript, all the material in Sections III and V, as well as the numerical example in Section IV -B, is entirely new . The authors gratefully ackno wledge Dr . Kristina Frizyuk for her assistance with the simulations. Paper supported by the PRIN 2022 project 2022RRNAEX “The Scenario Approach for Control and Non-Conv ex Design” (CUP: D53D23001440006), funded by the NextGeneration EU program (Mission 4, Component 2, In vestment 1.1), by the PRIN PNRR project P2022NB77E “ A data-driven cooperativ e framework for the management of distributed energy and water resources” (CUP: D53D23016100001), funded by the NextGeneration EU program (Mission 4, Component 2, In vestment 1.1), and by the F AIR (Future Artificial Intelligence Research) project, funded by the NextGenerationEU program within the PNRR-PE-AI scheme (M4C2, Inv estment 1.3). A. Car ` e and M.C. Campi are with the Department of Information Engi- neering - Univ ersity of Brescia, via Branze 38, 25123 Brescia, Italia (e-mail: [algo.care,marco.campi]@unibs.it). S. Garatti is with the Dipartimento di Elettronica, Informazione e Bioingeg- neria - Politecnico di Milano, piazza Leonardo da V inci 32, 20133 Milano, Italia (e-mail: simone.garatti@polimi.it). V alue at Risk (CV aR), [9], [10], [8], as well as broader decision-making strategies, [7], [8], [11]; the reader is referred to the book [12] and the revie w article [13] for a general background. A lar ge body of research, [14]–[36], has contributed to the theoretical development of the scenario approach, addressing the following central question: given a scenario design based on a finite sample of observ ations, what is the probability that it will generalize and remain appropriate for previously unseen situations? For the scope of the present paper , two contributions are particularly relev ant. The first is paper [7], where the frame work of consistent decision-making was intro- duced, formalizing the abstract notion of appr opriateness and providing tight upper and lower bounds on the probability of inappropriateness under non-de generacy assumptions. These bounds were further studied in an asymptotic setting in [11]. The second contribution is [8], which extended the frame work by remo ving the non-de generacy assumption and proved that the upper bounds remain valid in this more general setup. This paper further advances the scenario theory by con- sidering settings in which a design is carried out with re- spect to a baseline appr opriateness criterion , while additional properties of interest are assessed after the design has been determined. W e term these additional properties post-design appr opriateness conditions . Within this extended framew ork, we establish upper bounds on the probability of violating post- design appropriateness, and, under additional assumptions, deriv e complementary lower bounds, thereby enclosing the post-design risk within certified interv als. Importantly , all bounds are computable without resorting to any additional data besides those used during the design. These guarantees pro vide informativ e and practically relev ant assessments of additional or stricter performance requirements. T ypical situations where these ne w results can be applied include: (i) the quantification of the probability of achie ving en- hanced performances beyond a guaranteed baseline. For example, the assessment of the probability that a con- troller meets a stricter performance requirement than those enforced at design time; (ii) certain design goals lead to mathematical problems that are difficult to handle. For instance, their formalization may inv olve non-con vex or computationally complex op- timization procedures. In such cases, one often resorts to surrogate or heuristic design criteria to obtain a solution, and the theory presented here can then be used to verify whether the original goals of interest are met by the solution obtained using the simplified scheme. CAR ` E et al. : SCENARIO APPR OA CH WITH POST -DESIGN CER TIFICA TION OF USER-SPECIFIED PR OPER TIES 2 In the second part of this paper , we present two examples illustrating points (i) and (ii). Furthermore, when a cost quantifies the quality of a design in relation to an uncertain en vironment, we sho w that a suitable post-design criterion enables the assessment of the full cost distrib ution, thus providing a comprehensi ve ev aluation of the scenario solution. The remainder of the paper is organized as follows. Sec- tions IIA–C de velop upper bounds on post-design risk, while Section III establishes lower bounds under additional condi- tions. Applications to two examples in H 2 control and pole- placement are presented in Section IV, while Section V deals with the ev aluation of the distribution of costs associated with the scenario solution. Conclusions are drawn in Section VI. I I . P RO B L E M S TA T E M E N T A N D T E C H N I C A L R E S U LT S A. A scenario decision framework with two notions of appr o- priateness W e first recall how the data-to-decision process is modeled within the scenario approach of [7], [8]. A list δ 1 , . . . , δ N of observations of an uncertain variable δ is modeled as an independent and identically distrib uted (i.i.d.) sample from a probability space (∆ , D , P ) . Each observed δ i is called a “scenario”, and, borrowing a machine learning terminology , the list of scenarios δ 1 , . . . , δ N is sometimes called a tr aining set . The probability P is typically unknown to the user , so the framew ork is often called a gnostic , or distribution-fr ee . Let Z be a generic set, which is interpreted as the domain from which a decision z has to be chosen. From an abstract perspectiv e, a data-driv en decision scheme corresponds to a family of maps from lists of scenarios to decisions, namely M m : ∆ m → Z , m = 0 , 1 , 2 , . . . . When m = 0 , the list δ 1 , . . . , δ m is meant to be the empty list and M 0 returns the decision that is made when no observ ations are available. W e will often denote the decision returned by M m ( δ 1 , . . . , δ m ) as z ∗ m . A further ingredient of the standard scenario approach is a criterion of appropriateness, based on which a giv en decision z ∈ Z is deemed appropriate or inappropriate for a specific scenario δ ∈ ∆ . The main objectiv e of the theory of the scenario approach is to certify the le vel of appropriateness of the decision M N ( δ 1 , . . . , δ N ) , where N is the actual number of scenarios used to design. Importantly , this certification must be based on δ 1 , . . . , δ N only , i.e., without the aid of additional data. This goal is pursued in [7], [8] under the requirement that the maps M m satisfy certain consistency properties, which we recall in Assumption 1 belo w , linking the maps M m with the notion of appropriateness. In this paper , we consider two distinct notions of appropri- ateness: • Baseline appr opriateness : this is the “standard” notion of appropriateness, relativ e to which the decision map is required to satisfy the consistency condition in Assump- tion 1 belo w; • P ost-design appr opriateness : this is an additional, de- sirable notion of appropriateness, which complements baseline appropriateness in characterizing the quality of the design for a giv en scenario; no assumption is made that M m is consistent with respect to this post-design appropriateness. The baseline appropriateness plays the same role as the standard notion of appropriateness of [7], [8] and it is termed here “baseline” to contrast it with the ne w , post-design ap- propriateness. These two notions of appropriateness represent abstractions of concrete criteria encountered in applications. For example, in control design, the baseline appropriateness may correspond to the requirement that the controller stabilizes a plant, whereas the post-design appropriateness may refer to the achie vement of stability with a pre-specified mar gin. For future use, we introduce notation to denote the set of decisions that are baseline and post-design appropriate for a giv en scenario δ . Definition 1 (sets of baseline and post-design appr opriate decisions): The set of decisions that are baseline appropriate for a giv en δ is denoted by Z ′ δ , while the set of post-design appropriate decisions is denoted by Z ′′ δ . 1 ⋆ The requirement of baseline consistency is specified in the following assumption. Assumption 1: The maps M m satisfy the consistency re- quirements as per Property 1 in [8] with respect to the baseline appropriateness. That is, for e very integers m ≥ 0 and n > 0 , and every δ 1 , . . . , δ m , δ m +1 , . . . , δ m + n , the follo wing three conditions, called permutation in variance , confirmation under appr opriateness and r esponsiveness to inappropriateness , are satisfied: - gi ven an y permutation ( i 1 , . . . , i m ) of (1 , . . . , m ) , it holds that M m ( δ 1 , . . . , δ m ) = M m ( δ i 1 , . . . , δ i m ) ; - if M m ( δ 1 , . . . , δ m ) ∈ Z ′ δ m + i , ∀ i ∈ { 1 , . . . , n } , then M m + n ( δ 1 , . . . , δ m + n ) = M m ( δ 1 , . . . , δ m ) ; - if ∃ i ∈ { 1 , . . . , n } : M m ( δ 1 , . . . , δ m ) / ∈ Z ′ δ m + i , then M m + n ( δ 1 , . . . , δ m + n )  = M m ( δ 1 , . . . , δ m ) . ⋆ Giv en its importance, we reiterate that no assumption is made linking M m to post-design appropriateness. B. The risk of inappr opriateness - r eview and new goal The notion of lev el of appropriateness for both baseline and post-design criteria is formalized in the follo wing definition. Definition 2 (baseline and post-design risk): For a giv en decision z ∈ Z , the risk of baseline inappropriateness, or baseline risk , is defined as the probability that a ne w δ is baseline inappropriate for that decision, i.e., R ′ ( z ) := P { δ ∈ ∆ : z / ∈ Z ′ δ } ; similarly , the risk of post-design inappropriateness, or post- design risk , is the probability that a ne w δ is post-design inappropriate for the decision, i.e., R ′′ ( z ) := P { δ ∈ ∆ : z / ∈ Z ′′ δ } . 1 For a giv en z , the measurability of the sets { δ ∈ ∆ : z ∈ Z ′ δ } and { δ ∈ ∆ : z ∈ Z ′′ δ } , as well as that of similar sets defined throughout the paper , is tacitly assumed without being stated explicitly each time. CAR ` E et al. : SCENARIO APPR OA CH WITH POST -DESIGN CER TIFICA TION OF USER-SPECIFIED PR OPER TIES 3 ⋆ While the baseline risk can be dealt with through the theory of [7], [8], the main contribution of the present paper is the certification of R ′′ ( z ∗ N ) , the post-design risk of the decision z ∗ N designed through M N . Although R ′′ ( z ∗ N ) cannot be directly computed because P is unknown, the goal is to demonstrate that certain statistics of the data can be used to bound R ′′ ( z ∗ N ) with high confidence 1 − β with respect to the variability of δ 1 , . . . , δ N . The statistics that serve to certify R ′′ ( z ∗ N ) are constructed from the same dataset used for design, av oiding any loss of data. T o wards the goal of certifying R ′′ ( z ∗ N ) , we find it advisable to revisit the results prov en in [7] and [8] concerning R ′ ( z ∗ N ) as this will allow us to introduce some notions that will be instrumental in our analysis. The first relev ant definition, taken from [8], is that of support list and complexity . Definition 3 (baseline support list and baseline complexity): Giv en a list of scenarios δ 1 , . . . , δ m , a baseline support list of M m is a sub-list δ i 1 , . . . , δ i k , with i 1 < i 2 < · · · < i k , such that: (a) M m ( δ 1 , . . . , δ m ) = M k ( δ i 1 , . . . , δ i k ) ; (b) δ i 1 , . . . , δ i k is irreducible, that is, no element can be further removed from δ i 1 , . . . , δ i k while lea ving the decision unchanged. For a giv en δ 1 , . . . , δ m , there can be more than one selection of the index es i 1 , i 2 , . . . , i k , possibly with different cardinality k , yielding a baseline support list. The minimal cardinality among all baseline support lists is called the baseline complexity and is denoted by s b, ∗ m . ⋆ The notion of complexity plays a key role in the analysis of the baseline risk dev eloped in [8]. In fact, Theorem 4 in that paper states that R ′ ( z ∗ N ) can be probabilistically bounded according to relation P N { R ′ ( z ∗ N ) ≤ ϵ ( s b, ∗ N ) } ≥ 1 − β , (1) where β ∈ (0 , 1) is a user-chosen confidence parameter , and the function ϵ ( · ) is defined as follo ws: ϵ ( N ) = 1 and, for k = 0 , 1 , . . . , N − 1 , ϵ ( k ) := 1 − t ( k ) where t ( k ) is the only solution in the interval (0 , 1) of the equation in the t variable β N N − 1 X m = k  m k  t m − k −  N k  t N − k = 0 . 2 (2) In view of (1), the baseline complexity s b, ∗ N , which is a statistic of the data, can be used to obtain a certified upper bound on R ′ ( z ∗ N ) . Furthermore, Theorem 2 in [7] complements this result by providing, under additional conditions, a lo wer bound for R ′ ( z ∗ N ) . These were kno wn results. The goal of this paper is to assess the risk of z ∗ N with respect to post-design appr opriateness . Bounding R ′′ ( z ∗ N ) is nontrivial because, in general, the maps M m do not satisfy the consistency requirements as per Prop- erty 1 in [8] in relation to post-design appropriateness: the results in [8] and [7] cannot be applied and a new theoretical dev elopment is required to pursue this goal. 2 Equtation (2) can be efficiently solved numerically by bisection. See Appendix B.1 of [11] for a ready-to-use MA TLAB code that directly returns ϵ ( k ) . C. Novel r esults: post-design risk certification En r oute to certifying the post-design risk R ′′ ( z ∗ N ) , our first step consists in defining new , instrumental decision maps from lists of scenarios to an augmented decision space Z + := Z × N ( N denotes the set of non-ne gative integers), along with an instrumental notion of appropriateness for these maps. Definition 4 (instrumental decision map): For any m = 0 , 1 , . . . and any list δ 1 , . . . , δ m of scenarios, the instru- mental decision map is defined as M + m ( δ 1 , . . . , δ m ) := ( z ∗ m , c ∗ m ) , where z ∗ m = M m ( δ 1 , . . . , δ m ) and c ∗ m = # { i ∈ { 1 , . . . , m } such that z ∗ m / ∈ Z ′′ δ i } (the symbol “#” denotes cardinality). ⋆ Definition 5 (instrumentally appr opriate decisions): For ev ery δ , the set of the instrumentally appr opriate decisions for δ is defined as Z + δ := ( Z ′ δ × N ) ∩ ( Z ′′ δ × N ) . ⋆ According to Definition 5, an instrumental decision ( z , ℓ ) is instrumentally appropriate if and only if its first element, z , is both baseline and post-design appropriate. In this definition, the second element, ℓ , does not play any role. Nevertheless, as we will see later, this second element is important to de velop the theoretical framework that supports the establishment of the bounds. The instrumental risk of an instrumental decision is defined as follo ws. Definition 6 (instrumental risk): For an instrumental deci- sion ( z , ℓ ) ∈ Z × N , the risk of instrumental appropriateness, or instrumental risk , is defined as the probability that a new δ is instrumentally inappropriate for that decision, i.e., R + ( z , ℓ ) := P { δ ∈ ∆ : ( z , ℓ ) / ∈ Z + δ } . ⋆ Since, as already noticed, the element ℓ does not play any role in the definition of instrumental appropriateness, R + ( z , ℓ ) only depends on z , and it coincides with R + ( z ) := P { δ ∈ ∆ : z / ∈ Z ′ δ ∩ Z ′′ δ } . (3) The following lemma is ke y in the de velopment of the theory . Lemma 1: The maps M + m satisfy the consistency require- ments with respect to the instrumental appr opriateness (i.e., the same conditions in Assumption 1 hold with M m replaced by M + m and Z ′ δ m + i replaced by Z + δ m + i ). Pr oof: W e recall that M + m ( δ 1 , . . . , δ m ) = ( z ∗ m , c ∗ m ) , where z ∗ m = M m ( δ 1 , . . . , δ m ) and c ∗ m = # { i ∈ { 1 , . . . , m } such that z ∗ m / ∈ Z ′′ δ i } . Clearly , M + m is permutation in variant because M m is permutation inv ariant by Assump- tion 1, and c ∗ m does not depend on the order in which data points appear in the sample. T o check confirmation under appr opriateness , observe that M + m ( δ 1 , . . . , δ m ) ∈ Z + δ m + i implies that (a) z ∗ m ∈ Z ′ δ m + i and (b) z ∗ m ∈ Z ′′ δ m + i . Since M m satisfies confirmation under appr opriateness with respect to baseline appropriateness (Assumption 1), condition (a) entails that z ∗ m + n = z ∗ m ; moreo ver , this fact along with condition (b) entails that c ∗ m + n = c ∗ m . Regarding r esponsiveness to CAR ` E et al. : SCENARIO APPR OA CH WITH POST -DESIGN CER TIFICA TION OF USER-SPECIFIED PR OPER TIES 4 inappr opriateness , observe that if M + m ( δ 1 , . . . , δ m ) / ∈ Z + δ m + i for some i , then either (a) z ∗ m / ∈ Z ′ δ m + i or (b) z ∗ m / ∈ Z ′′ δ m + i . If (a), then z ∗ m + n  = z ∗ m because M m is responsiv e to baseline inappropriateness, and therefore ( z ∗ m + n , c ∗ m + n ) differs from ( z ∗ m , c ∗ m ) in its first component; on the other hand, if z ∗ m + n = z ∗ m because only (b) occurs, then ( z ∗ m + n , c ∗ m + n ) and ( z ∗ m , c ∗ m ) must differ in their second components, thus concluding the proof. ■ Lemma 1 enables the use of the results of the scenario ap- proach to certify the instrumental risk based on the complexity of the instrumental map. In turn, this result provides the basis to establish the post-design risk, as sho wn in Theorem 1 belo w . The formal definitions of support lists and of complexity for the instrumental map are the same as in Definition 3, where: the map M m is replaced by the instrumental map M + m ; the word “baseline” is replaced by “instrumental”; the symbol “ s + , ∗ m ” is used in place of “ s b, ∗ m ” to denote the instrumental complexity . Remark 1 (on computing s + , ∗ N ): Any instrumental support list needs to be formed by a baseline support list augmented with the remaining δ i ’ s in the training set for which z ∗ N is post-design inappropriate. 3 Nonetheless, appending to a giv en baseline support list all the δ i ’ s from the remaining ones for which z ∗ N is post-design inappropriate surely suf fices to preserve ( z ∗ N , c ∗ N ) b ut may result in a reducible list. Therefore, constructing a minimal instrumental support list requires care. On the other hand, it is worth observing that the cardinality of any list formed by a baseline support list augmented with the δ i ’ s in the training set for which z ∗ N is post-design inappropriate provides an upper bound on the instrumental complexity s + , ∗ N , and using such upper bounds in place of the actual complexity in Theorem 1 returns a valid bound on the risk since function ϵ ( · ) can be shown to be increasing in its argument. ⋆ W e are now ready to prove our first fundamental result, which provides an upper bound on R ′′ ( z ∗ N ) . Theor em 1 (upper bound for post-design risk): Let β ∈ (0 , 1) be a confidence parameter , and define ϵ ( k ) := 1 − t ( k ) , k = 0 , . . . , N − 1 , and ϵ ( N ) = 1 , where t ( k ) is the unique solution of (2) in (0 , 1) . Then, under Assumption 1, it holds for e very probability P that P N { R ′′ ( z ∗ N ) ≤ ϵ ( s + , ∗ N ) } ≥ 1 − β . (4) Pr oof: Thanks to Lemma 1, we can apply Theorem 4 in [8] to the instrumental maps M + m , with instrumental appropriateness giv en by Z + δ , which yields P N { R + ( z ∗ N ) ≤ ϵ ( s + , ∗ N ) } ≥ 1 − β . 3 Indeed, an instrumental support list must return z ∗ N ; by progressively removing from the instrumental support list scenarios that do not change z ∗ N , if any , the process terminates with a baseline support list, so that an instrumental support list must contain a baseline support list. Augmenting the baseline support list with the remaining δ i ’ s in the training set for which z ∗ N is post-design inappropriate is then necessary to return the second element c ∗ N in the instrumental solution. Finally , no other scenario can be added because this would infringe the requirement of irreducibility of the instrumental support list. Equation (4) then readily follo ws from observing that R ′′ ( z ∗ N ) ≤ R + ( z ∗ N ) in vie w of (3), so that P N { R ′′ ( z ∗ N ) ≤ ϵ ( s + , ∗ N ) } ≥ P N { R + ( z ∗ N ) ≤ ϵ ( s + , ∗ N ) } . This concludes the proof. ■ I I I . T I G H T P O S T - D E S I G N R I S K C E R T I FI C A T I O N Lower bounds on the post-design risk can be established under additional conditions, thus providing certifications that place the risk sandwiched between a lower and an upper threshold. This topic is explored in the present section. A first situation of interest occurs when post-design ap- propriateness is more stringent than baseline appropriateness, that is, mathematically , Z ′′ δ ⊆ Z ′ δ . An example of this situation is provided in Section IV-A, where post-design appropriateness corresponds to performance requirements that are more stringent than those used at the design stage in an H 2 control problem. In this case, we say that the two lev els of appropriateness are nested , and a tight upper and lower bound on R ′′ ( z ∗ N ) can be obtained under the following non- degenerac y assumption borrowed from [8]. Assumption 2 (baseline non-deg eneracy): For any m , with probability 1, there exists a unique choice of indexes i 1 < i 2 < · · · < i k such that δ i 1 , . . . , δ i k is a baseline support list for δ 1 , . . . , δ m . ⋆ Theor em 2 (upper and lower bounds under baseline non- de generacy in the nested case): Let β ∈ (0 , 1) be a confidence parameter . For each k = 0 , . . . , N − 1 , consider the polynomial equation in the variable t  N k  t N − k − β 2 N N − 1 X i = k  i k  t i − k − β 6 N 4 N X i = N +1  i k  t i − k = 0 , (5) and, for k = N , consider 1 − β 6 N 4 N X i = N +1  i N  t i − N = 0 . (6) For each k = 0 , 1 , . . . , N − 1 , equation (5) has exactly two solutions in [0 , + ∞ ) , denoted by t ( k ) and t ( k ) with t ( k ) ≤ t ( k ) . For k = N , equation (6) admits a unique solution in [0 , + ∞ ) , denoted by t ( N ) , and we set t ( N ) = 0 . Define ( ϵ ( k ) := max { 0 , 1 − t ( k ) } ϵ ( k ) := 1 − t ( k ) , k = 0 , . . . , N . 4 Under Assumptions 1 and 2, and assuming that Z ′′ δ ⊆ Z ′ δ for all δ , it holds that P N { ϵ ( s + , ∗ N ) ≤ R ′′ ( z ∗ N ) ≤ ϵ ( s + , ∗ N ) } ≥ 1 − β . (7) Pr oof: W e claim that baseline non-degeneracy implies instru- mental non-degenerac y , that is, with probability one there is a unique choice of indexes i + 1 , . . . , i + k + such that δ i + 1 , . . . , δ i + k + is an instrumental support list for δ 1 , . . . , δ m . T o see this, recall 4 Also ϵ ( k ) and ϵ ( k ) can be ef ficiently computed numerically by bisection. See Appendix B.2 of [11] for a ready-to-use MA TLAB code. CAR ` E et al. : SCENARIO APPR OA CH WITH POST -DESIGN CER TIFICA TION OF USER-SPECIFIED PR OPER TIES 5 that an y instrumental support list needs to be formed by a baseline support list augmented with the remaining δ i ’ s in the training set for which z ∗ N is post-design inappropriate (a fact already noticed in Remark 1). Since the index es identifying the baseline support list are unique with probability one, the uniqueness of the index es identifying the instrumental support list with probability one immediately follo ws. Thanks to the instrumental non-degenerac y , Theorem 2 of [7] can be applied to M + m , with instrumental appropriateness gi ven by Z + δ , yielding P N { ϵ ( s + , ∗ N ) ≤ R + ( z ∗ N ) ≤ ϵ ( s + , ∗ N ) } ≥ 1 − β (8) T o close the proof, note that the assumption that Z ′′ δ ⊆ Z ′ δ for all δ (nested case) implies that Z ′′ δ ∩ Z ′ δ = Z ′′ δ for all δ , Therefore (see Definition 2 and equation (3)), we have that R + ( z ) = R ′′ ( z ) for all z , and (8) is equiv alent to (7). ■ The bounds in Theorem 2 inv olve computing the zeros of the polynomials (5) and (6), which offer little intuitiv e insight into the structure of these bounds. On the other hand, as we have seen, these bounds follow from Theorem 2 of [7], and their expressions have been analyzed in greater detail in Proposition 8 of [11], which provides insight into their dependencies on N , β , and k . Specifically , Proposition 8 establishes that ϵ ( k ) ≤ k N + 2 √ k + 1 N  p ln( k + 1) + 4  + 2 √ k + 1 r ln 1 β N + ln 1 β N , and that ϵ ( k ) ≥ k N − 3 √ k + 1 N  p ln( k + 1) + 2  − 3 √ k + 1 r ln 1 β N . Hence, the bounds defines interv als around k N , with a margin that squeezes to zero as O ( p ln( N ) / √ N ) uniformly in k , while the dependence on β is logarithmic. W e next mo ve to considering the case where condition Z ′′ δ ⊆ Z ′ δ can be violated, still under baseline non-degenerac y . In this case, a non-vacuous lower bound can sometimes be obtained using the following theorem (an instance of use is provided in the example of Section IV-B). Theor em 3 (upper and lower bounds under baseline non- de generacy): Let β ∈ (0 , 1) be a confidence parameter , and define ϵ ( k ) , ϵ ( k ) as in Theorem 2 and ϵ ( k ) as in Theorem 1. Then, under Assumptions 1 and 2, it holds that P N { ϵ ( s + , ∗ N ) − ϵ ( s b, ∗ N ) ≤ R ′′ ( z ∗ N ) ≤ ϵ ( s + , ∗ N ) } ≥ 1 − 2 β . Pr oof: By applying the union bound to relation { δ ∈ ∆ : z / ∈ Z ′ δ ∩ Z ′′ δ } ⊆ { δ ∈ ∆ : z / ∈ Z ′ δ } ∪ { δ ∈ ∆ : z / ∈ Z ′′ δ } , we ob- tain that R + ( z ) ≤ R ′ ( z ) + R ′′ ( z ) ; moreover , R ′′ ( z ) ≤ R + ( z ) follows from the very definition of post-design and instrumen- tal risk. Thus, it holds that R + ( z ) − R ′ ( z ) ≤ R ′′ ( z ) ≤ R + ( z ) for all z ∈ Z , which in turn gives R + ( z ∗ N ) − R ′ ( z ∗ N ) ≤ R ′′ ( z ∗ N ) ≤ R + ( z ∗ N ) . (9) By Theorem 4 in [8], R ′ ( z ∗ N ) exceeds ϵ ( s b, ∗ N ) with probability at most β , a fact that we have already recalled in equation (1). On the other hand, in the proof of Theorem 2, we ha ve established the v alidity of equation (8), which ensures that R + ( z ∗ N ) / ∈ [ ϵ ( s + , ∗ N ) , ϵ ( s + , ∗ N )] with probability at most β . Therefore, R ′ ( z ∗ N ) ≤ ϵ ( s b, ∗ N ) and ϵ ( s + , ∗ N ) ≤ R + ( z ∗ N ) ≤ ϵ ( s + , ∗ N ) occur simultaneously with probability no smaller than 1 − 2 β . From this, in view of (9), we conclude that relation ϵ ( s + , ∗ N ) − ϵ ( s b, ∗ N ) ≤ R ′′ ( z ∗ N ) ≤ ϵ ( s + , ∗ N ) holds with probability no smaller than 1 − 2 β . This concludes the proof. ■ I V . E X A M P L E S W e demonstrate the usefulness of the de veloped theory through two significant control-theoretic settings: H 2 control and pole-placement. A. Pr obabilistically r obust H 2 contr ol W e consider the H 2 control problem for the lateral motion of an aircraft, a classic example originally introduced in [37] and later revisited in several papers and textbooks, [12], [38]– [40]. The numerical values that we use are taken from [37], while the uncertainty intervals are from [12]. The lateral motion of the aircraft is described by the equation ˙ x ( t ) =    0 1 0 0 0 L p L β L r 0 . 086 0 − 0 . 11 − 1 0 . 086 N ˙ β N p N β + 0 . 11 N ˙ β N r    x ( t ) +    0 0 0 − 3 . 91 0 . 035 0 − 2 . 53 0 . 31    u ( t ) , (10) where the four state variables are the bank angle, the deriv ativ e of the bank angle, the sideslip angle, and the yaw rate. The two inputs are the rudder deflection and the aileron deflection. The various parameters that appear in the state matrix are uncertain, i.e., the uncertain variable is δ = [ L p , L β , L r , N p , N β , N ˙ β , N r ] , so ∆ is a subset of R 7 . For short, the state and input matrices will be written as A δ and B . Giv en tw o symmetric positi ve definite matrices S and R and an initial condition x 0 ∈ R 4 , we aim to design the state feedback law u ( t ) = K x ( t ) that minimizes the cost function J ( K , δ ) = Z ∞ 0  x ( t ) ⊤ S x ( t ) + u ( t ) ⊤ Ru ( t )  dt, while ensuring that the closed-loop system is quadratically stable within a high-probability subset of ∆ . 1) Review of the H 2 contr ol problem with no uncertainty: W e consider here the case in which there is no uncertainty , that is, the value of δ is fixed, and revie w some known facts in preparation of the probabilistically robust part. Giv en the system ˙ x ( t ) = A δ x ( t ) + B u ( t ) with x (0) = x 0 , and a stabilizing control law u ( t ) = K x ( t ) , the system state ev olution is giv en by x ( t ) = CAR ` E et al. : SCENARIO APPR OA CH WITH POST -DESIGN CER TIFICA TION OF USER-SPECIFIED PR OPER TIES 6 e ( A δ + B K ) t x 0 , t ≥ 0 . Substituting this e xpression into the cost function yields J ( K , δ ) = x ⊤ 0 P x 0 , with P = R ∞ 0 h e ( A δ + B K ) ⊤ t ( S + K ⊤ RK ) e ( A δ + B K ) t i dt , which is pos- itiv e definite in view of the positi ve definiteness of S and R . Observing now that ( A δ + B K ) ⊤ P + P ( A δ + B K ) = R ∞ 0 d dt h e ( A δ + B K ) ⊤ t ( S + K ⊤ RK ) e ( A δ + B K ) t i dt , which, by an application of the fundamental theorem of calculus, equals − ( S + K ⊤ RK ) because the closed-loop system is stable, we conclude that P satisfies the L yapunov equation ( A δ + B K ) ⊤ P + P ( A δ + B K ) = − ( S + K ⊤ RK ) . (11) Moreov er, from the stability of A δ + B K easily follows that P is the only solution of (11). Summarizing: a stabilizing K yields J ( K , δ ) = x ⊤ 0 P x 0 , where P ≻ 0 is the only solution of the L yapunov equation (11). V iceversa, giv en a pair of matrices ( K, P ) , with P ≻ 0 satisfying the L yapunov equation (11), it is straightforward to check that V ( x ) = x ⊤ P x is a L yapunov function for the closed-loop system, and therefore K is stabilizing, and that J ( K , δ ) = x ⊤ 0 P x 0 . Thus, the problem min K,P ≻ 0 x ⊤ 0 P x 0 (12) subject to ( A δ + B K ) ⊤ P + P ( A δ + B K ) = − ( S + K ⊤ RK ) is equiv alent to minimizing J ( K, δ ) over all stabilizing K . Note also that problem (12) can as well be infeasible, which happens whene ver ( A δ , B ) is not stabilizable. 2) The scenario problem: W e next consider the case of a variable δ . Suppose that { ( A δ , B ) } is quadratically stabilizable, that is, there exist a feedback gain K and a matrix P ≻ 0 such that ( A δ + B K ) ⊤ P + P ( A δ + B K ) ≺ 0 for all δ . 5 Next, suppose we hav e av ailable a sample of N i.i.d. scenarios δ 1 , . . . , δ N of the uncertainty parameter δ , and consider the following scenario optimization problem inspired by (12): min K,P ≻ 0 x ⊤ 0 P x 0 (13) subject to ( A δ i + B K ) ⊤ P + P ( A δ i + B K ) ⪯ − ( S + K ⊤ RK ) , i = 1 , . . . , N . Notice that the constraint in (13) is expressed as an inequality , a fact that makes the problem alw ays feasible: due to quadratic stabilizability , there exists a pair ( K , P ) that makes the left- hand side of the constraint negati ve definite for all i ; then, the requirement that the left-hand side is less than or equal to − ( S + K ⊤ RK ) for all i can be obtained by an appropriate rescaling of P . In special cases, it may happen that (13) has multiple solutions. F or e xample, if x 0 = 0 and ( K ∗ , P ∗ ) is a so- lution, then ( K ∗ , 2 P ∗ ) is also a solution. In the following, 5 This assumption serves the purpose to make the scenario problem stated below in (13) always feasible. While feasibility is not strictly required, and the reader can see a treatment of the case where infeasibility may occur in Section 4.2 of [8], it is here assumed to av oid complications that do not contribute to the substance of the discussion. by ( K ∗ , P ∗ ) we indicate the solution that is obtained by a tie-break rule in the domain of the pairs ( K , P ) , and refer to it as “the solution” of (13). Clearly , K ∗ stabilizes all systems ( A δ i , B ) , i = 1 , . . . , N , with P ∗ being a common L yapunov function. Moreover , x ⊤ 0 P ∗ x 0 serves as a common upper bound on the cost. T o see this, rewrite the constraint ( A δ i + B K ∗ ) ⊤ P ∗ + P ∗ ( A δ i + B K ∗ ) ⪯ − ( S + K ∗ ⊤ RK ∗ ) as ( A δ i + B K ∗ ) ⊤ P ∗ + P ∗ ( A δ i + B K ∗ ) = − ( S + K ∗ ⊤ RK ∗ ) − Ξ i , (14) where Ξ i ≻ 0 fills the gap between the two sides of the inequality . Then, we ha ve J ( K ∗ , δ i ) = x ⊤ 0 h Z ∞ 0 e ( A δ i + B K ∗ ) ⊤ t ( S + K ∗ ⊤ RK ∗ ) e ( A δ i + B K ∗ ) t dt i x 0 ≤ x ⊤ 0 h Z ∞ 0 e ( A δ i + B K ∗ ) ⊤ t ( S + K ∗ ⊤ RK ∗ + Ξ i ) e ( A δ i + B K ∗ ) t dt i x 0 (14) = − x ⊤ 0 h Z ∞ 0 e ( A δ i + B K ∗ ) ⊤ t (( A δ i + B K ∗ ) ⊤ P ∗ + P ∗ ( A δ i + B K ∗ )) e ( A δ i + B K ∗ ) t dt i x 0 = − x ⊤ 0 h Z ∞ 0 d dt ( e ( A δ i + B K ∗ ) ⊤ t P ∗ e ( A δ i + B K ∗ ) t ) dt i x 0 = x ⊤ 0 P ∗ x 0 . (15) 3) Baseline and post-design appr opriateness: Problem (13), re written for a generic m in place of N , defines a decision map M m from δ 1 , . . . , δ m to ( P ∗ , K ∗ ) . W e say that a pair ( P , K ) is baseline appropriate for a δ if the constraint in (13), rewritten for this δ , is satisfied: ( A δ + B K ) ⊤ P + P ( A δ + B K ) ⪯ − ( S + K ⊤ RK ) . As can be readily verified (see e.g. Section 3 in [8] for a detailed explanation), decision maps defined through a robust optimization problem, where constraint satisfaction plays the role of baseline appropriateness, are consistent in the sense of Assumption 1. Hence, our maps M m are consistent. In post-design, we consider the obtained solution ( P ∗ , K ∗ ) to be post-design appropriate if, for a predefined v alue of parameter γ ∈ (0 , 1) , the mor e stringent constraint ( A δ + B K ∗ ) ⊤ P ∗ + P ∗ ( A δ + B K ∗ ) ⪯ − 1 γ ( S + K ∗ ⊤ RK ∗ ) is satisfied. By a computation similar to (15), it is easy to see that post-design appropriateness of ( P ∗ , K ∗ ) for δ implies that J ( K ∗ , δ ) ≤ γ x ⊤ 0 P ∗ x 0 . 4) Equivalent formulation as an LMI for easy implemen- tation: The scenario problem (13) can be reformulated as a con vex program in volving LMIs (Linear Matrix Inequalities). T o this end, we first note that, since P is inv ertible, the constraint in (13) can be re written as P − 1 ( A δ i + B K ) ⊤ +( A δ i + B K ) P − 1 ⪯− P − 1 ( S + K ⊤ RK ) P − 1 . Therefore, introducing the ne w optimization variables Q := P − 1 and X := K P − 1 (the same change of v ariables is used CAR ` E et al. : SCENARIO APPR OA CH WITH POST -DESIGN CER TIFICA TION OF USER-SPECIFIED PR OPER TIES 7 e.g. in Chapter 7.2.1 of [41]), the problem can be reformulated as follo ws min K,Q ≻ 0 x ⊤ 0 Q − 1 x 0 (16) subject to QA ⊤ δ i + A δ i Q + X ⊤ B ⊤ + B X ⪯ − ( QS Q + X ⊤ RX ) , i = 1 , . . . , N . Moreov er, K ∗ can be recovered from the solution to this problem by formula K ∗ = X ∗ ( Q ∗ ) − 1 . Now , by an application of the Schur complement (see e.g. Chapter 2 of [41]), the problem becomes min X,Q ≻ 0 x ⊤ 0 Q − 1 x 0 subject to   − ( QA ⊤ δ i + A δ i Q + X ⊤ B ⊤ + B X )  X ⊤ Q   X Q   R − 1 0 0 S − 1    ⪰ 0 , i = 1 , . . . , N , in which the constraints are conv ex LMIs, and x ⊤ 0 Q − 1 x 0 is a con vex cost function, as it can be argued from the following reasoning. For Q ≻ 0 , the function x ⊤ 0 Q − 1 x 0 is con vex if and only if its epigraph { Q, h : x ⊤ 0 Q − 1 x 0 ≤ h } is a conv ex set. By applying the Schur complement, the latter set can be equiv alently written as { Q, h : h − x ⊤ 0 Q − 1 x 0 ≥ 0 } = { Q, h :  h x ⊤ 0 x 0 Q  ⪰ 0 } , which is the con vex set defined by an LMI. 5) Numerical r esults: W e solved the lateral motion problem with S = 0 . 01 I , R = I , x 0 = [1 , 1 , 1 , 1] ⊤ and N = 2000 scenarios, 6 and set β = 10 − 7 . The LMI reformulation of the problem was solved in MA TLAB © with the CVX package, [42], [43], obtaining P ∗ =     0 . 2678 0 . 1462 − 1 . 1967 0 . 3250 0 . 1462 0 . 1323 − 1 . 1120 0 . 3413 − 1 . 1967 − 1 . 1120 22 . 2723 − 4 . 7196 0 . 3250 0 . 3413 − 4 . 7196 1 . 7959     K ∗ =  0 . 8641 0 . 9024 − 12 . 7202 4 . 7089 0 . 4709 0 . 4114 − 2 . 8849 0 . 7778  . This solution yields x ⊤ 0 P ∗ x 0 = 12 . 0367 . The cardinality of the baseline support list was s b, ∗ N = 4 , which, according to (1), corresponds to a baseline risk of at most 1.53% (this is ϵ ( s b, ∗ N ) = ϵ (4) ) with practical certainty (confidence 1 − 10 − 7 ). Since the value 12 . 0367 is relatively large, we moved to post-design to assess the probability of a smaller value. With γ = 0 . 8 , there were 71 scenarios for which the more stringent constraint ( A δ i + B K ) ⊤ P ∗ + P ∗ ( A δ i + B K ∗ ) ⪯ − 1 0 . 8 ( S + K ∗ ⊤ RK ∗ ) 6 For reproducibility , we disclose that, follo wing [12], the uncertain variables were independently and uniformly sampled from the following intervals: L p ∈ [ − 2 . 93 , − 1] , L β ∈ [ − 73 . 14 , − 4 . 75] , L r ∈ [0 . 78 , 3 . 18] , N p ∈ [ − 0 . 042 , 0 . 086] , N β ∈ [2 . 59 , 8 . 94] , N ˙ β ∈ [0 , 0 . 1] , N r ∈ [ − 0 . 39 , − 0 . 29] . W e remark that our approach does not make use of this knowledge, which is here provided only for reproducibility purposes. is violated, yielding s + , ∗ N ≤ 75 (see Remark 1). Applying Theorem 1, we obtain a bound on the post-design risk of 6.94% with confidence 1 − 10 − 7 . This means that no more than 6.94% of the uncertain plants will result in a cost lar ger than 0 . 8 · 12 . 0367 = 9 . 6294 . B. P ole placement A linear plant is described by a transfer function with uncertain parameters: G ( s, δ ) = b ( s, δ ) a ( s, δ ) = b 0 ( δ ) s n + b 1 ( δ ) s n − 1 + · · · + b n ( δ ) s n + a 1 ( δ ) s n − 1 + · · · + a n ( δ ) . W e aim to design a controller C ( s ) = f ( s ) g ( s ) = f 1 s n − 1 + f 2 s n − 2 + · · · + f n s n + g 1 s n − 1 + · · · + g n such that, with high probability , the poles of the closed- C ( s ) G ( s, δ ) + − Fig. 1. Feedback configuration for the pole placement problem. loop system in Figure 1 have real part no greater than r and damping coefficient no less than ζ . This requirement defines a desirable re gion of the complex plane (a conic sector): S r,ζ :=    s ∈ C : ℜ ( s ) ≤ r , ℑ ( s ) ℜ ( s ) ≤ q 1 − ζ 2 ζ    . This objective is not easily cast into an algorithmic form because of the complex dependence of the polynomial’ s roots on its coef ficients. Therefore, we resort to a heuristic approach: minimizing the distance between the coefficients of the closed- loop polynomial p cl ( s, δ ) = s 2 n + p cl, 1 ( δ ) s 2 n − 1 + · · · + p cl, 2 n ( δ ) = a ( s, δ ) g ( s ) + b ( s, δ ) f ( s ) , with those of a reference polynomial r ( s ) = s 2 n + r 1 s 2 n − 1 + · · · + r 2 n chosen in such a way that its roots lie well within the desired region S r,ζ . More precisely , given a list of scenarios δ 1 , . . . , δ N , the controller coefficients are obtained from the follo wing opti- mization problem: min f 1 ,...,f n ,g 1 ,...,g n   2 n X j =1 max i =1 ,...,N | p cl,j ( δ i ) − r j |   . Since the coefficients p cl,j ( δ ) depend linearly on the controller parameters f k and g k , this is a con vex problem and can be efficiently solved. W e denote by f ∗ 1 , f ∗ 2 , . . . , f ∗ n , g ∗ 1 , . . . , g ∗ n its optimal solution (after breaking possible ties in the domain of coefficients by any rule), and by p ∗ cl ( s, δ ) the corresponding uncertain closed-loop polynomial. CAR ` E et al. : SCENARIO APPR OA CH WITH POST -DESIGN CER TIFICA TION OF USER-SPECIFIED PR OPER TIES 8 1) Equivalent formulation as a linear pr oblem: The follow- ing reformulation of the problem is equi valent b ut handier: min f 1 ,...,f n , g 1 ,...,g n , h 1 ,...,h 2 n 2 n X j =1 h j (17) subject to | p cl,j ( δ i ) − r j |≤ h j , j = 1 , . . . , 2 n, i = 1 , . . . , N . In fact, (17) can be easily turned into a linear program by replacing the constraint | p cl,j ( δ i ) − r j |≤ h j with the two linear inequalities p cl,j ( δ i ) − r j ≤ h j and − ( p cl,j ( δ i ) − r j ) ≤ h j . Moreov er, the solution to (17) incorporates both the controller f ∗ 1 , . . . , f ∗ n , g ∗ 1 , . . . , g ∗ n (as above, possible ties are broken in the domain of coef ficients by any rule) and h ∗ 1 , . . . , h ∗ n , which bound the maximum variability of the coefficients of p ∗ cl ( s, δ i ) as a ( s, δ i ) and b ( s, δ i ) v ary across the N scenarios. 2) Baseline and post-design appr opriateness: Problem (17), rewritten for a generic m in place of N , defines a decision map M m from δ 1 , . . . , δ m to ( f ∗ 1 , . . . , f ∗ n , g ∗ 1 , . . . , g ∗ n , h ∗ 1 , . . . , h ∗ 2 n ) . W e say that a giv en ( f 1 , . . . , f n , g 1 , . . . , g n , h 1 , . . . , h 2 n ) is baseline appropriate for a δ if | p cl,j ( δ ) − r j |≤ h j for all j = 1 . . . , 2 n, and maps M m are easily seen to be consistent. While baseline appropriateness serves as a tool to shift the closed-loop poles toward a location well inside the desired conic sector S r,ζ , its satisfaction does not imply that the closed-loop system poles actually lie within S r,ζ . Then, in post-design, ( f ∗ 1 , . . . , f ∗ n , g ∗ 1 , . . . , g ∗ n , h ∗ 1 , . . . , h ∗ 2 n ) is deemed post-design appropriate if the roots of p ∗ cl ( s, δ i ) indeed belong to the conic sector S r,ζ , and guarantees are deriv ed on the probability that the roots of p ∗ cl ( s, δ ) belong to this region using Theorem 1. 3) Numerical results: The pole-placement methodology is applied to the stabilization of an in verted pendulum using a linearization procedure. W e consider a classical pendulum system (see Figure 2) gov erned by the dif ferential equation M ℓ ¨ θ ( t ) = − α ˙ θ ( t ) − M g sin( θ ( t )) + u ( t ) , where θ is the angular displacement measured counterclock- wise from the downward vertical, u is a tangential force (con- trol variable), g is the gravitational acceleration ( 9 . 8[ m/s 2 ] ), M the pendulum mass, ℓ is the rod length, and α is a viscous friction coefficient. The parameters M , ℓ and α are uncertain, and are collected in δ = [ M , ℓ, α ] ⊤ ∈ R 3 . 7 7 For completeness, we specify the distrib ution of the uncertain parameters used in the simulation. M is uniformly distributed between 9[ K g ] and 10[ K g ] ; ℓ is independent of M and uniformly distributed between 0 . 9[ m ] and 1[ m ] ; the parameter α depends on M and its conditional distribution (expressed in [ K g m/s 2 ]) is uniform between the values M and 1 . 1 M . W e remark that the theory de veloped in this paper certifies appropriateness without using this information, which is provided here solely for reproducibility purposes. ℓ M M g u θ Fig. 2. A classic pendulum By linearizing the differential equation of the pendulum around the upright equilibrium ( θ = π ) , we find the transfer function between the control action u and the angle θ to be: Θ( s ) U ( s ) = 1 s 2 + α M ℓ s − g ℓ . W e desire closed-loop system poles with real part no greater than r = − 0 . 7 and damping coef ficient no less than ζ = 0 . 5 . The procedure in Section IV -B was applied with reference polynomial r ( s ) = s 4 + 8 s 3 + 32 s 2 + 48 s + 36 (which has roots in − 1 ± j and − 3 ± 3 j ). The confidence parameter w as set to value β = 10 − 5 and N = 2000 independent scenarios were drawn from the uncertain parameter region. The optimization program (17) was solved in MA TLAB © using the linprog function, which yielded the controller C ∗ ( s ) = 724 s + 3536 s 2 + 6 . 889 s + 34 . 72 . The closed-loop polynomials p ∗ cl ( s, δ i ) corresponding to the N = 2000 scenarios were in the range s 4 + (8 ± 0 . 1) s 3 + (32 ± 0 . 5) s 2 + (48 ± 8) s + (36 ± 22 . 4) , (18) where the intervals of variability of the coef ficients were obtained from the optimal values h ∗ j . An examination of the Lagrange multipliers rev ealed that eight constraints were acti ve at the optimum, and the sce- narios associated with these constraints formed the unique baseline support list; hence, s b, ∗ N = 8 . 8 A certificate (v alid with confidence 1 − 10 − 5 ) on the baseline risk was obtained by applying (1): the closed-loop polynomial for a ne wly sampled δ falls outside the computed range with probability at most 1.64%. Ultimately , our goal was to certify post- design appr opriateness . T o this end, we needed to compute the post-design complexity s + , ∗ N . By e valuating ho w many of the N = 2000 scenarios, e xcluding those corresponding to acti ve constraints, led to closed-loop system poles not all contained in S − 0 . 7 , 0 . 5 , and incrementing s b, ∗ N = 8 with this number , we obtained s + , ∗ N = 199 (see Figure 3 for a plot of the closed- loop system poles for the N = 2000 scenarios considered). Applying Theorem 1, again with β = 10 − 5 , the post-design risk was found to be bounded by ϵ (193) = 13 . 91% . 8 In conve x optimization problem as (17), any support list is always formed by scenarios corresponding to active constraints; in the instance at hand none of these constraints could be removed without altering the solution. CAR ` E et al. : SCENARIO APPR OA CH WITH POST -DESIGN CER TIFICA TION OF USER-SPECIFIED PR OPER TIES 9 ℜ ℑ Fig. 3. Locations in the complex plane of the closed-loop system poles corresponding to the N = 2000 scenarios in problem (17). The dotted line is the border of the desired conic sector S − 0 . 7 , 0 . 5 . The black dots in − 1 ± j and − 3 ± 3 j are the poles of the reference polynomial. In the conte xt of (17), the non-degenerac y condition in Assumption 2 is a relativ ely mild condition; it is equiv alent to requiring that the scenarios corresponding to activ e constraints together form a support list with probability 1. In this case, Theorem 3 allows one to certify (with confidence 1 − 2 · 10 − 5 ) that the post-design risk is between 5 . 07% ( ϵ ( s + , ∗ N ) − ϵ ( s b, ∗ N ) = 6 . 71% − 1 . 64% ) and 13 . 56% ( ϵ ( s + , ∗ N ) ). Interestingly , the post-design ev aluation can be performed for alternativ e regions, which also provides a way to assess how much the performance can be further guaranteed by slightly relaxing the initial requirements. In this example, we repeated the e valuation described above reducing the requirement on the real part to r = − 0 . 6 , − 0 . 5 , − 0 . 4 while keeping ζ at its original v alue 0 . 5 . For r = − 0 . 6 , we obtained s + , ∗ N = 130 , resulting in a post-design risk between 2 . 32% and 9 . 85% ; for r = − 0 . 5 , s + , ∗ N was 46 with a post-design risk between 0 and 4 . 66% ; and for r = − 0 . 4 , s + , ∗ N was 14 with a post-design risk between 0 and 2 . 17% . Note, ho wever , that shifting r from − 0 . 7 to − 0 . 4 corresponds to an approximate 75% increase in the settling time. V . U S I N G P O S T - D E S I G N C E RT I FI C A T I O N S T O E V A L UAT E C O S T D I S T R I B U T I O N S In this section, we show ho w post-design risk results can be used to obtain a distributional ev aluation of the scenario solution z ∗ N when performance is expressed in terms of a cost. Suppose that a cost function f ( z , δ ) : Z × ∆ → R measures the performance of a decision z when scenario δ occurs. Then, a comprehensive assessment of the quality of z is provided by the cumulativ e distribution function (CDF) of the random variable f ( z , δ ) : F z ( ℓ ) := P { f ( z , δ ) ≤ ℓ } . In the context of scenario-based decision making, one is interested in ev aluating F z ∗ N ( ℓ ) , the CDF associated with the scenario solution z ∗ N , constructed according to a gi ven decision scheme and baseline appropriateness criterion. 9 T o this end, consider a grid ℓ 1 < ℓ 2 < · · · < ℓ h cov ering a relev ant interval of R over which f ( z ∗ N , δ ) is expected to vary , and introduce a family of post-design appropriateness criteria Z ′′ δ,ℓ j := { z : f ( z , δ ) ≤ ℓ j } , j = 1 , . . . , h. By definition of post-design risk, we ha ve R ′′ ℓ j ( z ) := P { δ ∈ ∆ : z / ∈ Z ′′ δ,ℓ j } = P { f ( z , δ ) > ℓ j } = 1 − F z ( ℓ j ) . (19) Applying Theorem 1 for each ℓ j yields that R ′′ ℓ j ( z ∗ N ) ≤ ϵ ( s + , ∗ N ,j ) with confidence 1 − β , where s + , ∗ N ,j denotes the post- design complexity associated with Z ′′ δ,ℓ j . Combining this result with (19), and using a union bound over the grid points ℓ j ’ s, giv es that the inequalities F z ∗ N ( ℓ j ) ≥ 1 − ϵ ( s + , ∗ N ,j ) , j = 1 , . . . , h, hold simultaneously with confidence 1 − hβ . Observe now that any lo wer bound on F z ∗ N ( ℓ j ) extends to all ℓ ≥ ℓ j because CDFs are monotonically increasing. Therefore, defining F ϵ ( ℓ ) =      1 − ϵ ( s + , ∗ N ,h ) , ℓ ≥ ℓ h , 1 − ϵ ( s + , ∗ N ,j ) , ℓ j ≤ ℓ < ℓ j +1 , j = 1 , . . . , h − 1 , 0 , ℓ < ℓ 1 , we obtain the bound F z ∗ N ( ℓ ) ≥ F ϵ ( ℓ ) , ∀ ℓ ∈ R , with confidence 1 − hβ . Thus F ϵ ( ℓ ) is, with confidence 1 − hβ , a valid lower bound for the entir e CDF of f ( z ∗ N , δ ) . 10 The abo ve results can be further strengthened under As- sumption 2. In this case, repeating the argument above, with the obvious modifications, and resorting to Theorems 2 and 3 giv es that 1 − ˜ ϵ ( s b, ∗ N , s + , ∗ N ,j ) ≥ F z ∗ N ( ℓ j ) ≥ 1 − ϵ ( s + , ∗ N ,j ) , j = 1 , . . . , h, hold simultaneously with confidence 1 − ( h + r ) β , where ˜ ϵ ( s b, ∗ N , s + , ∗ N ,j ) = ( ϵ ( s + , ∗ N ,j ) , if Z ′′ δ,ℓ j ⊆ Z ′ δ for all δ , ϵ ( s + , ∗ N ,j ) − ϵ ( s b, ∗ N ) , otherwise , and r counts the number of thresholds ℓ j for which the non- nested case occurs. 11 Proceeding as before, and using the fact that an upper bound for F z ∗ N ( ℓ j ) e xtends to all ℓ ≤ ℓ j , we obtain upper and lo wer bounds on the entire CDF of f ( z ∗ N , δ ) . Specifically , define F ϵ as before b ut with ϵ ( · ) in place of ϵ ( · ) , and F ϵ ( ℓ ) =      1 , ℓ ≥ ℓ h , 1 − ˜ ϵ ( s b, ∗ N , s + , ∗ N ,j ) , ℓ j − 1 < ℓ ≤ ℓ j , j = 2 , . . . , h, 1 − ˜ ϵ ( s b, ∗ N , s + , ∗ N , 1 ) , ℓ ≤ ℓ 1 . 9 Sometimes, one takes f ( z , δ ) ≤ ¯ ℓ as baseline appropriateness, where ¯ ℓ is a cost threshold rele vant for design purposes. 10 Note that F ϵ is also monotonically increasing. Indeed, since ℓ j < ℓ j +1 , the implication f ( z ∗ N , δ ) > ℓ j +1 ⇒ f ( z ∗ N , δ ) > ℓ j holds, from which it follows that s + , ∗ N ,j ≥ s + , ∗ N ,j +1 . The monotonicity of F ϵ ( ℓ ) then follows from the fact that ϵ ( · ) is an increasing function, as previously noted in Remark 1. 11 When baseline appropriateness is expressed as f ( z , δ ) ≤ ¯ ℓ , the nested case holds for ℓ j ≤ ¯ ℓ and fails when ℓ j > ¯ ℓ . CAR ` E et al. : SCENARIO APPR OA CH WITH POST -DESIGN CER TIFICA TION OF USER-SPECIFIED PR OPER TIES 10 Then, F ϵ ( ℓ ) ≥ F z ∗ N ( ℓ ) ≥ F ϵ ( ℓ ) , ∀ ℓ ∈ R , with confidence 1 − ( h + r ) β . Hence, the entire CDF of f ( z ∗ N , δ ) is sandwiched between two data-driv en functions, resulting in a complete characterization of the performance of z ∗ N in the uncertain environment. A. An example: open-loop input design The previously discussed results are no w illustrated by means of a simple open-loop input design problem inspired by an e xample in [44]. Consider the discrete-time uncertain linear system η ( t + 1) = Aη ( t ) + B u ( t ) , η (0) = η 0 , (20) where η ( t ) ∈ R 2 is the state and u ( t ) ∈ R is the control input, which takes v alue in U := [ − 10 , 10] due to actuation constraints. The initial state and the matrix B are fixed and giv en by η 0 =  1 1  ⊤ and B =  0 0 . 25  ⊤ , respectiv ely . Instead, the state matrix A ∈ R 2 × 2 is uncertain, with entries drawn independently from four Gaussian distributions with means ¯ A =  0 . 8 − 1 0 − 0 . 9  , and standard deviations 0 . 05(1 + 2 v i ) , i = 1 , 2 , 3 , 4 , where the v i ’ s are independent draws of a Bernoulli random variable taking value 1 with probability 0 . 03 and value 0 otherwise. These distributions are specified solely to enable reproducibil- ity and they play no role in the design of the solution or in its quality assessment. The only information used for design consists of N = 1000 realizations of A , say A 1 , . . . , A 1000 , which are identified with the scenarios δ 1 , . . . , δ 1000 . Informally , the control objectiv e is to select the input se- quence u (0) , · · · , u ( T − 1) so as to driv e the system state at time T = 5 as close as possible to the origin, where the distance is measured according to the maximum norm ∥ η ( T ) ∥ ∞ := max( | η 1 ( T ) | , | η 2 ( T ) | ) . Observing that η ( T ) = A T η 0 + P T − 1 t =0 A T − 1 − t B u ( t ) , it is immediately seen that ∥ η ( T ) ∥ ∞ =   A T η 0 + R u   ∞ , where R =  B AB · · · A T − 1 B  and u =  u ( T − 1) u ( T − 2) · · · u (0)  ⊤ . In formal terms, the input design problem is formulated as follows: min h ≥ 0 , u ∈U T , ξ i ≥ 0 h + ρ N X i =1 ξ i (21) subject to:   A T i η 0 + R i u   ∞ − h ≤ ξ i , i = 1 , . . . , N , which is a scenario program with constraint relaxation, [8]. When ρ is very lar ge, this problem reduces to min h ≥ 0 , u ∈U T h subject to:   A T i η 0 + R i u   ∞ ≤ h, i = 1 , . . . , N , which is a robust problem whose optimal value h ∗ represents the maximum deviation of the final states, across the available scenarios, from the origin. Allowing for smaller values of ρ results instead in a program where violation of the constraints   A T i η 0 + R i u   ∞ ≤ h is tolerated, b ut this is discouraged by the penalization term ρ P N i =1 ξ i . This is expected to reduce the influence of particularly adverse scenarios, so yielding a better threshold h ∗ and η ( T ) closer to the origin for all the other scenarios. For each ρ , replacing N in (21) with m = 0 , 1 , . . . defines a family of decision maps M m that are consistent with respect to the appropriateness criterion   A T i η 0 + R i u   ∞ − h ≤ 0 , taken here as baseline appr opriateness . See [8] for details. Problem (21) was solv ed for ρ = 1 , resulting in u ∗ N = [ − 0 . 27 − 0 . 58 − 1 . 34 0 . 45 5 . 85] ⊤ , h ∗ N = 0 . 15 , and this solution was found to coincide with the rob ust solution as no constraints were violated (we had ξ i = 0 for all i ). W e then solved (21) with ρ = 0 . 05 , resulting in u ∗ N = [1 . 19 − 0 . 38 − 4 . 76 0 . 11 7 . 38] ⊤ , h ∗ N = 0 . 07 , a less conserv ativ e solution which howe ver violates 18 constraints (we had ξ i > 0 in 18 cases). T o gain further insight into the performance of these two solutions, we e valuated the distrib ution of f ( z ∗ N , δ ) =   A T η 0 + R u ∗ N   ∞ − h ∗ N following the methodology of Sec- tion V. T o this end, ℓ 1 , . . . , ℓ h were taken as a grid of h = 100 uniformly spaced values in the interval [ − 0 . 15 , 0] , β was set to 10 − 7 , and F ϵ ( ℓ ) and F ϵ ( ℓ ) were computed for both solutions. W ith high confidence 1 − 10 − 5 (this is 1 − h · 10 − 7 ), these functions provide an upper and a lower bound for the entire CDF of   A T η 0 + R u ∗ N   ∞ − h ∗ N . 12 A more meaningful interpretation of the results is ob- tained by observing that shifting f ( z ∗ N , δ ) by h ∗ N yields   A T η 0 + R u ∗ N   ∞ , which is the maximum norm ∥ η ( T ) ∥ ∞ , of the final state. Therefore, F ϵ ( ℓ − h ∗ N ) and F ϵ ( ℓ − h ∗ N ) serve as an upper and a lower bound on the entire CDF of ∥ η ( T ) ∥ ∞ . Functions F ϵ ( ℓ − h ∗ N ) and F ϵ ( ℓ − h ∗ N ) are shown in Figure 4 for ρ = 1 (top panel) and ρ = 0 . 05 (bottom panel). These plots offer sev eral useful insights. In particular , the conserv atism of the solution obtained with ρ = 1 is evident: in an effort to safeguard against the worst, the adopted control actions produce values of ∥ η ( T ) ∥ ∞ that are predominantly distributed abov e 0 . 05 . In contrast, the solution corresponding to ρ = 0 . 05 yields values of ∥ η ( T ) ∥ ∞ that are concentrated between 0 and 0 . 05 , at the cost of a potentially heavier tail in the distribution. Since this example was conducted entirely in silico , we also validated the analysis by generating 100000 new scenarios A i and computing Monte Carlo the actual CDF of ∥ η ( T ) ∥ ∞ for both solutions. The resulting CDFs, sho wn as dashed lines in the plots, indeed lie between F ϵ ( ℓ − h ∗ N ) and F ϵ ( ℓ − h ∗ N ) in both cases, as predicted with confidence 1 − 10 − 5 by the theory . V I . C O N C L U S I O N S In this paper , we have introduced a nov el framework to certify data-driv en decisions in post-design. W e have dis- tinguished two levels of appropriateness: baseline appropri- ateness , which guides the design process, and post-design appr opriateness , which serves as a criterion for a posteriori 12 Prov ably , Assumption 2 is satisfied in the present case because δ admits a density . Moreover , since ℓ j ≤ 0 for all j ’s, the nested case applies throughout. CAR ` E et al. : SCENARIO APPR OA CH WITH POST -DESIGN CER TIFICA TION OF USER-SPECIFIED PR OPER TIES 11 -0.1 -0.05 0 0.05 0.1 0.15 0.2 || (T)|| 0 0.5 1 CDF -0.1 -0.05 0 0.05 0.1 0.15 0.2 || (T)|| 0 0.5 1 CDF Fig. 4. F ϵ ( ℓ − h ∗ N ) and F ϵ ( ℓ − h ∗ N ) (solid lines) vs. actual cumulative distribution function of ∥ η ( T ) ∥ ∞ (dashed lines) for ρ = 1 (top) and ρ = 0 . 05 (bottom). ev aluation. These notions correspond to two different kinds of risk: the first, termed baseline risk , is the traditional subject of the scenario approach, while the second, termed post- design risk , was not previously covered by the scenario theory . In alternati ve approaches, the post-design risk is typically ev aluated using test datasets. W e hav e sho wn that ef fectiv e bounds on the post-design risk can be deri ved via an extended notion of complexity , computable directly from the training set without the need for any additional test data. Moreover , we hav e demonstrated that, in relev ant settings, both upper and lower bound on the post-design risk can be obtained, yielding tight e valuations. The theory developed in this paper is relev ant when ad- ditional, or more stringent, requirements need to be veri- fied in post-design. Moreov er, it offers a viable approach to using heuristics in problems that are impractical to handle according to their original formulation, while still providing rigorous guarantees on the original requirements. These two paradigms hav e been illustrated by means of two examples: the design of lateral motion control, and pole-placement for stabilizing an inv erted pendulum. W e have also illustrated a method that exploits the notion of post-design appropriateness to infer comprehensiv e distributional knowledge of relev ant performance index es from the a vailable dataset. R E F E R E N C E S [1] A. Car ` e, M. C. Campi, and S. Garatti, “Post-design verification in the scenario approach, ” in Proceedings of the 64th IEEE Conference on Decision and Contr ol (CDC) . Rio de Janeiro, Brazil: IEEE, 2025. [2] G. Calafiore and M. Campi, “Uncertain con vex programs: randomized solutions and confidence levels, ” Mathematical Pr ogramming , vol. 102, no. 1, pp. 25–46, 2005. [3] G. C. Calafiore and M. C. Campi, “The scenario approach to robust control design, ” IEEE T ransactions on Automatic Control , vol. 51, no. 5, pp. 742–753, 2006. [4] M. Campi and S. Garatti, “The exact feasibility of randomized solutions of uncertain conv ex programs, ” SIAM J ournal on Optimization , vol. 19, no. 3, pp. 1211–1230, 2008. [5] A. Car ` e, S. Garatti, and M. C. Campi, “Scenario min-max optimization and the risk of empirical costs, ” SIAM Journal on Optimization , vol. 25, no. 4, pp. 2061–2080, 2015. [6] S. Garatti, A. Car ` e, and M. C. Campi, “Complexity is an effecti ve observable to tune early stopping in scenario optimization, ” IEEE T ransactions on A utomatic Control , vol. 68, no. 2, pp. 928–942, 2023. [7] S. Garatti and M. C. Campi, “Risk and complexity in scenario optimiza- tion, ” Mathematical Pro gramming , vol. 191, pp. 243–279, 2022. [8] ——, “Non-conv ex scenario optimization, ” Mathematical Pro gramming , vol. 209, pp. 557–608, 2025. [9] F . A. Ramponi and M. C. Campi, “Expected shortfall: Heuristics and certificates, ” European Journal of Operational Research , vol. 267, no. 3, pp. 1003–1013, 2018. [10] G. Arici, M. C. Campi, A. Car ` e, M. Dalai, and F . A. Ramponi, “ A theory of the risk for empirical cv ar with application to portfolio selection, ” Journal of Systems Science and Complexity , v ol. 34, pp. 1879–1894, 2021. [11] M. C. Campi and S. Garatti, “Compression, generalization and learning, ” Journal of Mac hine Learning Researc h , vol. 24, no. 339, pp. 1–74, 2023. [12] ——, Intr oduction to the scenario appr oach . SIAM, 2018. [13] M. Campi, A. Car ` e, and S. Garatti, “The scenario approach: A tool at the service of data-driven decision making, ” Annual Reviews in Contr ol , vol. 52, pp. 1–17, 2021. [14] T . Alamo, R. T empo, and E. F . Camacho, “ A randomized strategy for probabilistic solutions of uncertain feasibility and optimization problems, ” IEEE T ransactions on Automatic Control , vol. 54, no. 11, pp. 2545–2559, 2009. [15] G. Schildbach, L. Fagiano, and M. Morari, “Randomized solutions to con vex programs with multiple chance constraints, ” SIAM Journal on Optimization , vol. 23, no. 4, pp. 2479–2501, 2013. [16] G. Schildbach, L. Fagiano, C. Frei, and M. Morari, “The scenario approach for Stochastic Model Predictive Control with bounds on closed-loop constraint violations, ” Automatica , v ol. 50, no. 12, pp. 3009– 3018, 2014. [17] S. Grammatico, X. Zhang, K. Margellos, P . J. Goulart, and J. L ygeros, “ A scenario approach for non-con vex control design, ” IEEE T ransactions on Automatic Control , vol. 61, no. 2, pp. 334–345, 2016. [18] T . Alamo, R. T empo, A. Luque, and D. R. Ramirez, “Randomized meth- ods for design of uncertain systems: sample complexity and sequential algorithms, ” Automatica , vol. 51, pp. 160–172, 2015. [19] K. Margellos, P . J. Goulart, and J. L ygeros, “On the road between robust optimization and the scenario approach for chance constrained optimiza- tion problems, ” IEEE Tr ansactions on Automatic Control , vol. 59, no. 8, pp. 2258–2263, 2014. [20] K. Margellos, M. Prandini, and J. Lygeros, “On the connection between compression learning and scenario based single-stage and cascading op- timization problems, ” IEEE T ransactions on Automatic Contr ol , vol. 60, no. 10, pp. 2716–2721, 2015. [21] X. Zhang, S. Grammatico, G. Schildbach, P . J. Goulart, and J. L ygeros, “On the sample size of random conv ex programs with structured dependence on the uncertainty , ” Automatica , vol. 60, pp. 182–188, 2015. [22] P . Mohajerin Esfahani, T . Sutter, and J. L ygeros, “Performance bounds for the scenario approach and an extension to a class of non-conv ex programs, ” IEEE T ransactions on Automatic Control , vol. 60, no. 1, pp. 46–58, 2015. [23] G. Darivianakis, A. Eichler, R. S. Smith, and J. L ygeros, “ A data- driv en stochastic optimization approach to the seasonal storage energy management, ” IEEE Contr ol Systems Letters , vol. 1, no. 2, pp. 394–399, 2017. [24] F . A. Ramponi, “Consistency of the scenario approach, ” SIAM Journal on Optimization , vol. 28, no. 1, pp. 135–162, 2018. [25] C. Shang and F . Y ou, “ A posteriori probabilistic bounds of con vex sce- nario programs with v alidation tests, ” IEEE T ransactions on Automatic Contr ol , vol. 66, no. 9, pp. 4015–4028, 2021. [26] A. Falsone, L. Deori, D. Ioli, S. Garatti, and M. Prandini, “Optimal disturbance compensation for constrained linear systems operating in stationary conditions: A scenario-based approach, ” Automatica , vol. 110, Article 108537, 2019. CAR ` E et al. : SCENARIO APPR OA CH WITH POST -DESIGN CER TIFICA TION OF USER-SPECIFIED PR OPER TIES 12 [27] M. Assif, D. Chatterjee, and R. Banav ar, “Scenario approach for minmax optimization with emphasis on the nonconv ex case: Positi ve results and cav eats, ” SIAM Journal on Optimization , vol. 30, no. 2, pp. 1119–1143, 2020. [28] L. Romao, A. Papachristodoulou, and K. Margellos, “On the exact feasibility of con vex scenario programs with discarded constraints, ” IEEE T ransactions on Automatic Contr ol , vol. 68, no. 4, pp. 1986–2001, 2022. [29] R. Rocchetta, A. Mey , and F . A. Oliehoek, “ A survey on scenario theory , complexity , and compression-based learning and generalization, ” IEEE T ransactions on Neural Networks and Learning Systems , 2023. [30] Z. W ang and R. M. Jungers, “On objecti ve function v alue performance of the scenario approach under re gularity conditions, ” IEEE T ransactions on Automatic Control , vol. 69, no. 7, pp. 4215–4229, 2023. [31] D. Jalota, D. Paccagnan, M. Schiffer , and M. Pav one, “Online routing over parallel networks: Deterministic limits and data-driven enhance- ments, ” INFORMS Journal on Computing , vol. 35, no. 3, pp. 560–577, 2023. [32] A. Falsone, K. Margellos, J. Zizzo, M. Prandini, and S. Garatti, “On the sensitivity of linear resource sharing problems to the arriv al of new agents, ” IEEE T ransactions on Automatic Control , vol. 68, no. 1, pp. 272–284, 2023. [33] Z. W ang, G. O. Berger, and R. M. Jungers, “Data-driven control of unknown switched linear systems using scenario optimization, ” IEEE T ransactions on A utomatic Control , 2024. [34] X. W ang and E. W eyer , “Scenario based optimisation over uncertain system identification models, ” Automatica , vol. 165, Article 111686, 2024. [35] G. Pantazis, F . Fele, and K. Margellos, “ A priori data-driv en robustness guarantees on strategic deviations from generalised Nash equilibria, ” Automatica , vol. 167, Article 111746, 2024. [36] H. W ang, A. Papachristodoulou, and K. Margellos, “Distributed safe control design and probabilistic safety verification for multi-agent sys- tems, ” Automatica , 2025. [37] J. T yler and F . T uteur , “The use of a quadratic performance inde x to design multivariable control systems, ” IEEE T ransactions on Automatic Contr ol , vol. 11, no. 1, pp. 84–92, 1966. [38] B. T . Polyak and R. T empo, “Probabilistic robust design with linear quadratic regulators, ” Systems & Control Letters , vol. 43, no. 5, pp. 343–353, 2001. [39] B. D. Anderson and J. B. Moore, Optimal contr ol: linear quadratic methods . Courier Corporation, 2007. [40] R. T empo, G. Calafiore, F . Dabbene et al. , Randomized algorithms for analysis and contr ol of uncertain systems: with applications . Springer, 2013, vol. 7. [41] S. Boyd, L. El Ghaoui, E. Feron, and V . Balakrishnan, Linear matrix inequalities in system and control theory . SIAM, 1994. [42] M. Grant and S. Boyd, “CVX: Matlab software for disciplined conve x programming, version 2.2, ” https://cvxr .com/cvx, Jan. 2020. [43] ——, “Graph implementations for nonsmooth conv ex programs, ” in Recent advances in learning and contr ol . Springer, 2008, pp. 95–110. [44] M. Campi, S. Garatti, and F . Ramponi, “ A general scenario theory for noncon vex optimization and decision making, ” IEEE T ransactions on Automatic Control , vol. 63, no. 12, pp. 4067–4078, 2018. Algo Car ` e (M’19) received the Ph.D. degree in informatics and automation engineering in 2013 from the University of Brescia, Italy , where he is currently an Associate Professor with the Depart- ment of Information Engineering. After his Ph.D., he spent two years at the Uni versity of Melbourne, VIC, Australia, as a Research Fellow in system identification with the Department of Electrical and Electronic Engineering. In 2016, he was a recipient of a two-year ERCIM Fellowship that he spent at the Institute for Computer Science and Control (SZ- T AKI), Hungarian Academy of Sciences (MT A), Budapest, Hungary , and at the Multiscale Dynamics Group, National Research Institute for Mathematics and Computer Science (CWI), Amsterdam, The Netherlands. He was one of the recipients of the 2025 IEEE CSS Roberto T empo CDC Best Paper A ward and he received the triennial Stochastic Programming Student Paper Prize of the Stochastic Programming Society for the period 2013–2016. He is an Associate Editor for Automatica and for the International Journal of Adaptive Contr ol and Signal Processing . He is a member of the EUCA Conference Editorial Board , of the IF A C T echnical Committee on Modeling, Identification and Signal Processing , and of the IEEE T echnical Committee on Systems Identification and Adaptive Contr ol . His current research interests include: data-driven decision methods , system identification , and learning theory . Marco Claudio Campi (F’12) is Professor of Au- tomatic Control at the University of Brescia , Italy . He has held visiting and teaching appointments at the Australian National University , Canberra, Australia; the University of Illinois at Urbana- Champaign , USA; the Centr e for Artificial Intelli- gence and Robotics , Bangalore, India; the University of Melbourne , Australia; K yoto University , Japan; T exas A&M University , USA; and the NASA Langley Resear ch Center , Hampton, V irginia. USA. Marco Campi was the chair of the T echnical Committee IF A C on Modeling, Identification and Signal Processing (MISP) , and is now leading the Italian section of ERNSI - European Research Network on System Identification. He has served in various capacities on the editorial boards of Automatica , Systems and Contr ol Letters and the Eur opean Journal of Contr ol . In 2008, he receiv ed the IEEE CSS George S. Axelby outstanding paper aw ard for the article The Scenario Appr oach to Robust Contr ol Design . He has deliv ered plenary and semi-plenary addresses at major conferences, including CDC, SYSIDand , MTNS, and has served multiple terms as a Distinguished Lectur er of the Control Systems Society . Marco Campi is a Fellow of IEEE and a Fellow of IF AC. His research interests include: data-driven decision making , inductive learning , system identification , and stochastic systems . Simone Garatti (M’13) is Associate Professor at the Dipartimento di Elettronica ed Informazione of the P olitecnico di Milano , Italy . He received the Laurea degree cum laude and the Ph.D. cum laude in Infor- mation T echnology Engineering in 2000 and 2004, respectiv ely , both from the Politecnico di Milano. He held visiting positions at the Lund University of T echnology , at the University of California San Die go , at the Massachusetts Institute of T echnology , and at the University of Oxfor d . Simone Garatti is currently member of the IEEE-CSS Conference Editorial Board and Associate Editor of the International Journal of Adaptive Control and Signal Processing and of the Machine Learning and Knowledge Extraction journal . In 2024, he served as T utorial Chair in the organizing committee of the 6th Learning for Dynamics and Control Confer ence (L4DC), while he was a member of the EUCA Conference Editorial Board from 2013 to 2019. With his co-authors, Simone Garatti has pioneered the theory of the scenario approach for which he was keynote speaker at the IEEE 3rd Conference on Norbert Wiener in the 21st Century in 2021, and semi- plenary speaker at the 2022 European Conference on Stochastic Optimization and Computational Management Science (ECSO-CMS). His current research interests include: data-driven optimization and decision-making , stochastic optimization , system identification , uncertainty quantification , and statistical learning theory .