Diffusion-Guided Search via Exponential Tilting (DiffTilt): An Application to Falsification of Safety-Critical Systems

# Diffusion-Guided Search via Exponential Tilting (DiffTilt): An Application to Falsification of Safety-Critical Systems
Source: [https://arxiv.org/html/2607.23134](https://arxiv.org/html/2607.23134)
Tanmay Khandait, Preetom Biswas, Hideki Okamoto, Bardh Hoxha, Georgios Fainekos, and Giulia PedrielliT\. Khandait, P\. Biswas, and G\. Pedrielli are with the School of Computing and Augmented Intelligence, Arizona State University, Tempe, AZ, USA \(e\-mail: tkhandai@asu\.edu, pbiswa11@asu\.edu, giulia\.pedrielli@asu\.edu\)\.H\. Okamoto, B\. Hoxha, and G\. Fainekos are with Toyota Motor North America, Research & Development, Ann Arbor, MI 48105, USA \(e\-mail: hideki\.okamoto@toyota\.com, bardh\.hoxha@toyota\.com, georgios\.fainekos@toyota\.com\)\.

###### Abstract

Discovering rare safety\-critical failures in autonomous and cyber\-physical systems is a fundamental challenge in verification and validation\. Existing falsification approaches rely on conditional sampling strategies that factor the joint distribution over environments and system executions, and therefore suffer from multiplicative rarity effects: the simultaneous scarcity of failure\-inducing inputs and failure\-inducing traces makes exhaustive search prohibitively expensive\.

This paper developsDiffTilt, a distributional frameworkthat addresses this challenge by exponentially tiltinga diffusion model\-induced joint distribution over environments and executions\. We show that such diffusion\-guided sampling admits an exact interpretation as importance sampling in the joint space, where guidance scores induce a KL\-optimal reallocation of probability mass towards failure\-relevant behaviors\. In addition, we show that tilting provably amplifies the probability of failure and strictly outperforms conditional sampling strategies, which are limited by multiplicative rarity effects\. In this framework, the joint generative model serves as a reusable prior over scenarios and need not faithfully represent the system under test\. Instead, true system evaluations, by means of expensive simulations, are limited to the learning of a scoring function responsiblefor characterizingthe quality of the produced scenario, thus enabling selective and adaptive use of expensive simulations\.Additionally, while we focus on falsification, the framework is general and applies to other scenario\-generation problems such as planning, synthesis\.

In this work, westudyDiffTiltperformance against benchmarks from the ARCH\-COMP, and we propose an additional tractor\-trailer benchmark for falsification to show the behavior of several approaches when scenario generation is guided by a well\-defined specification as opposed to a reward\. Across all cases, the proposed method achieves competitive or improved falsification performance compared to state\-of\-the\-art approaches, with larger gains when specification definition is not limited to STL formulas\.

## IIntroduction and Related Literature

The discovery of rare but safety\-critical failures in complex cyber\-physical and autonomous systems remains a fundamental challenge due to the high dimensionality, structured constraints, and strong dependencies between environments and system executions\. Existing approaches to scenario testing and falsification typically rely on conditional sampling strategies or heuristic search over inputs, which implicitly factor the joint distribution over environments and trajectories, and therefore suffer from multiplicative rarity effects\[[8](https://arxiv.org/html/2607.23134#bib.bib9),[15](https://arxiv.org/html/2607.23134#bib.bib10),[9](https://arxiv.org/html/2607.23134#bib.bib11)\]\. From a probabilistic perspective, such methods sample at the density of rare events rather than actively reshaping it, leading to prohibitive sample complexity even when conditional generative models are accurate\.

Importance sampling provides a principled framework for rare\-event estimation by reweighting probability mass toward critical regions, with exponential tilting emerging as the KL\-optimal mechanism for enforcing moment constraints and variance reduction\[[4](https://arxiv.org/html/2607.23134#bib.bib13),[3](https://arxiv.org/html/2607.23134#bib.bib14),[2](https://arxiv.org/html/2607.23134#bib.bib12)\]\. These ideas are deeply connected to large deviations theory and Gibbs measures, where exponential reweighting concentrates mass on extremal events\[[7](https://arxiv.org/html/2607.23134#bib.bib15),[5](https://arxiv.org/html/2607.23134#bib.bib3)\]\. However, classical importance sampling requires access to an ideal reference distribution or an explicit likelihood model, assumptions that are rarely satisfied in realistic autonomous\-system testing pipelines\.

Recent advances in score\-based generative modeling and diffusion processes enable the learning of expressive joint distributions over high\-dimensional, structured data, providing a new opportunity to revisit rare\-event discovery from a distributional perspective\[[13](https://arxiv.org/html/2607.23134#bib.bib16),[10](https://arxiv.org/html/2607.23134#bib.bib7),[14](https://arxiv.org/html/2607.23134#bib.bib17)\]\. In parallel, classifier\- and score\-guided diffusion methods have demonstrated that generative processes can be steered toward semantically meaningful regions of the data space via learned guidance signals\[[6](https://arxiv.org/html/2607.23134#bib.bib18)\]\. In this work, we unify these developments by interpreting diffusion\-guided falsification as exponential tilting of a learned joint generative model over environments and executions\. We show that diffusion guidance induces an exact importance sampling scheme on the joint space, where surrogate robustness scores act as likelihood\-ratio tilts that provably amplify failure probability under mild ranking assumptions\. Finally, we demonstrate that for deterministic dynamical systems, joint diffusion\-guided tilting reduces to optimal importance sampling over inputs along the dynamics manifold, yielding a unified theoretical framework for distribution\-guided rare\-event discovery\.

While the analysis is motivated by falsification and counterexample generation, the proposed framework is general\. Exponential tilting of a joint scenario distribution provides a mechanism for steering sampling toward behaviors of interest beyond safety violations, including synthesis, certificate estimation\. From a verification perspective, diffusion\-guided tilting enables distribution\-aware exploration of complex scenario spaces, rather than being restricted to falsification\.

Another aspect of our approach is the separation between the*generative model*and the*system under test \(SUT\)*\. The generative model defines a prior over environments and executions and serves solely as a base density\. Hence, it need not faithfully represent the “true” system dynamics\. Our theoretical results rely on the properties of the score and the tilting mechanism, rather than the accuracy of the learned model\.

In fact, the interaction with the SUT occurs through the score function \(e\.g\., a robustness monitor or runtime oracle\), so simulations are invoked selectively while most sampling is performed within the generative model\. This decoupling enables efficient exploration, maintains compatibility with black\-box verification pipelines, and allowsDiffTiltto use any score defined on trajectories, including robustness, reward, or expert\-defined costs\.

#### Contributions

This paper provides a formal foundation for diffusion\-guided falsification as a principled counterexample generation mechanism\. The contributions are as follows:

1. 1\.We introduce a joint distributional formulation of falsification, in which failure discovery is interpreted as probability mass reallocation, and show that exponential tilting yields the KL\-optimal biased distribution\.
2. 2\.We establish sufficient and necessary conditions under which exponential tilting provably amplifies failure probability, showing via first\-order stochastic dominance \(FOSD\) that tilting is effective precisely when the score ranks failing behaviors ahead of non\-failing ones in distribution\.
3. 3\.We characterize a fundamental limitation of conditional sampling, showing that even with perfect conditionals, failure probability remains bottlenecked by multiplicative rarity, whereas joint tilting overcomes this by reallocating mass in the joint space\.
4. 4\.For deterministic dynamical systems, we show that joint tilting reduces to optimal importance sampling over inputs along the dynamics manifold, bridging the framework with black\-box simulators and existing simulation\-based verification workflows\.
5. 5\.We propose the TT2D tractor\-trailer benchmark adapted from\[[12](https://arxiv.org/html/2607.23134#bib.bib22)\]as a controlled falsification benchmark, providing an expressive setting in which falsification difficulty can be systematically tuned\.

These results make the proposed diffusion\-guided falsificationDiffTilta sound, distribution aware enhancement to counterexample generation, grounded in importance sampling theory and stochastic order analysis, and directly relevant to the verification and validation of complex CPS\.

## IIDiffusion Guided Search as Importance Sampling \(IS\)

We begin by formalizing the class of scenario samplers considered in this work\. Rather than committing to a specific algorithm or implementation, we adopt an abstract view in which a generative model defines a base distribution over environments and executions, and guidance is introduced through a scoring function that biases sampling toward behaviors of interest\. This abstraction allows us to reason about guided sampling independently of how the underlying generative model is obtained, and to isolate the probabilistic mechanisms that drive failure discovery\. In particular, we consider samplers that operate over a joint space of environment parameters and system executions, and that can be guided using likelihood\-based reweighting\. Diffusion models provide a convenient and expressive instantiation of this class, but the formulation in this section applies more broadly to any generative mechanism that supports sampling from a joint density and evaluation of likelihood ratios\. The remainder of this section introduces the notation, assumptions, and sampling primitives that will be used throughout the paper, setting the stage for the formal analysis in Section[III](https://arxiv.org/html/2607.23134#S3)\.

#### Preliminaries

Letz0=\(x,y\)∈ℝdz\_\{0\}=\\left\(x,y\\right\)\\in\\mathbb\{R\}^\{d\}be a vectorized representation of the inputs and the corresponding outputs\. A diffusion model learns to generate samples fromp​\(z0\)p\(z\_\{0\}\)by defining two coupled Markov chains: a fixed*forward process*that gradually corruptsz0z\_\{0\}into Gaussian noise, and a learned*reverse process*that denoises noisy samples and transforms them back into samples from the data distribution\[[10](https://arxiv.org/html/2607.23134#bib.bib7),[14](https://arxiv.org/html/2607.23134#bib.bib17)\]\.

Forward process\.A diffusion model corrupts a data samplez0z\_\{0\}into Gaussian noise via a fixed Markov chain\[[10](https://arxiv.org/html/2607.23134#bib.bib7)\]:

q​\(zt∣zt−1\)=𝒩​\(αt​zt−1,\(1−αt\)​I\),\\displaystyle q\(z\_\{t\}\\mid z\_\{t\-1\}\)=\\mathcal\{N\}\\\!\\left\(\\sqrt\{\\alpha\_\{t\}\}\\,z\_\{t\-1\},\\,\(1\-\\alpha\_\{t\}\)I\\right\),\(1\)with marginalq​\(zt∣z0\)=𝒩​\(α¯t​z0,\(1−α¯t\)​I\)q\(z\_\{t\}\\mid z\_\{0\}\)=\\mathcal\{N\}\(\\sqrt\{\\bar\{\\alpha\}\_\{t\}\}\\,z\_\{0\},\\,\(1\-\\bar\{\\alpha\}\_\{t\}\)I\), whereα¯t=∏s=1tαs\\bar\{\\alpha\}\_\{t\}=\\prod\_\{s=1\}^\{t\}\\alpha\_\{s\}\.

Reverse process and sampler\.The reverse process is a learned Markov chainpθ​\(zt−1∣zt\)=𝒩​\(μθ​\(zt,t\),σt2​I\)p\_\{\\theta\}\(z\_\{t\-1\}\\mid z\_\{t\}\)=\\mathcal\{N\}\(\\mu\_\{\\theta\}\(z\_\{t\},t\),\\,\\sigma\_\{t\}^\{2\}I\)\. A neural networkεθ​\(zt,t\)\\varepsilon\_\{\\theta\}\(z\_\{t\},t\)is trained to predict the noiseε\\varepsiloninjected at leveltt\[[10](https://arxiv.org/html/2607.23134#bib.bib7)\], recovering the posterior mean:

μθ​\(zt,t\)=1αt​\(zt−1−αt1−α¯t​εθ​\(zt,t\)\)\.\\displaystyle\\mu\_\{\\theta\}\(z\_\{t\},t\)=\\frac\{1\}\{\\sqrt\{\\alpha\_\{t\}\}\}\\\!\\left\(z\_\{t\}\-\\frac\{1\-\\alpha\_\{t\}\}\{\\sqrt\{1\-\\bar\{\\alpha\}\_\{t\}\}\}\\,\\varepsilon\_\{\\theta\}\(z\_\{t\},t\)\\right\)\.\(2\)Sampling proceeds as

zT∼𝒩​\(0,I\),zt−1=μθ​\(zt,t\)\+σt​η,η∼𝒩​\(0,I\)\.z\_\{T\}\\sim\\mathcal\{N\}\(0,I\),\\quad z\_\{t\-1\}=\\mu\_\{\\theta\}\(z\_\{t\},t\)\+\\sigma\_\{t\}\\eta,\\quad\\eta\\sim\\mathcal\{N\}\(0,I\)\.\(3\)
Score interpretation and the VP\-SDE connection\.Song et al\.\[[14](https://arxiv.org/html/2607.23134#bib.bib17)\]show that the discrete forward chain above is a discretization of the*Variance Preserving SDE*\(VP\-SDE\):

d​z=−12​β​\(t\)​z​d​t\+β​\(t\)​d​Wt\.\\displaystyle dz=\-\\tfrac\{1\}\{2\}\\beta\(t\)\\,z\\,dt\+\\sqrt\{\\beta\(t\)\}\\,dW\_\{t\}\.\(4\)Under this continuous view, the reverse of any such diffusion is governed by the Stein score∇ztlog⁡pt​\(zt\)\\nabla\_\{z\_\{t\}\}\\\!\\log p\_\{t\}\(z\_\{t\}\)via the reverse\-time SDE\[[14](https://arxiv.org/html/2607.23134#bib.bib17)\]:

d​z=\[f​\(z,t\)−g​\(t\)2​∇zlog⁡pt​\(z\)\]​d​t\+g​\(t\)​d​W¯t\.\\displaystyle dz=\\bigl\[f\(z,t\)\-g\(t\)^\{2\}\\,\\nabla\_\{z\}\\\!\\log p\_\{t\}\(z\)\\bigr\]\\,dt\+g\(t\)\\,d\\bar\{W\}\_\{t\}\.\(5\)The noise predictionεθ\\varepsilon\_\{\\theta\}is related to the score by

∇ztlog⁡pt​\(zt\)≈−εθ​\(zt,t\)1−α¯t,\\displaystyle\\nabla\_\{z\_\{t\}\}\\\!\\log p\_\{t\}\(z\_\{t\}\)\\approx\-\\frac\{\\varepsilon\_\{\\theta\}\(z\_\{t\},t\)\}\{\\sqrt\{1\-\\bar\{\\alpha\}\_\{t\}\}\},\(6\)and the reverse diffusion process used in DDPMs can be viewed as a discrete approximation of Eq\. \([5](https://arxiv.org/html/2607.23134#S2.E5)\) under this identification\[[14](https://arxiv.org/html/2607.23134#bib.bib17)\]\. This interpretation makes*guidance*natural, since modifying the score steers samples toward desired regions ofptp\_\{t\}\.

#### Target Sampling Density\.

The sampler above draws from the base joint distributionpθ​\(x,y\)p\_\{\\theta\}\(x,y\)with no preference for any region\. In many applications one instead wants samples that score highly under a scalar objectiveR:𝒵→ℝR:\\mathcal\{Z\}\\rightarrow\\mathbb\{R\}, whetherRRencodes task reward, constraint violation, or adversarial cost\. The question is how to tilt the sampler toward high\-scoring regions without discarding the prior encoded inpθp\_\{\\theta\}\. Without loss of generality we consider minimizing the objective\. LetR​\(x,y\)R\(x,y\)be the target function andSk​\(x,y\)S\_\{k\}\(x,y\)its surrogate, giving the tilted sampling distribution

p​\(x,y\)\\displaystyle p\\left\(x,y\\right\):=pθ​\(x,y\)​exp⁡\(β​S​\(x,y\)\)Z,\\displaystyle:=\\frac\{p\_\{\\theta\}\\left\(x,y\\right\)\\exp\\left\(\\beta S\\left\(x,y\\right\)\\right\)\}\{Z\},Z\\displaystyle Z=𝔼\(X,Y\)∼pθ​\[exp⁡\(β​S​\(X,Y\)\)\]\.\\displaystyle=\\mathbb\{E\}\_\{\\left\(X,Y\\right\)\\sim p\_\{\\theta\}\}\\left\[\\exp\\left\(\\beta S\\left\(X,Y\\right\)\\right\)\\right\]\.\(7\)

## IIIAnalysis

This section develops a distributional analysis of diffusion\-guided falsification\. We model the generative environment as a joint distribution over environments and executions, and study the effect of exponential tilting on failure probability\. Our goal is to characterize when tilting amplifies failures, how this depends on the score function, and why it overcomes the multiplicative rarity barrier of conditional sampling\.

The analysis isolates the probabilistic mechanisms underlying guided sampling and establishes guarantees independent of a particular diffusion implementation\. These results formalize diffusion\-guided falsification as principled importance sampling \(IS\) and clarify its advantage over conditional approaches\.

#### Summary of results

We cast the efficient discovery of rare failures as IS\. A failure requires both a rare input \(w\.p\.δ≪1\\delta\\ll 1\) and a corresponding rare trace \(w\.p\.ε≪1\\varepsilon\\ll 1\), so its probability is the productδ​ε\\delta\\varepsilonof these two small probabilities, and the expected number of samples required to observe one is of order1/\(δ​ε\)1/\(\\delta\\varepsilon\), even under an exact conditional model \(Proposition[1](https://arxiv.org/html/2607.23134#Thmproposition1)\)\. Rather than draw from the model at this cost, we reweight the joint distribution over inputs and traces so that failures are sampled more often\. The reweighting we adopt is exponential tilting by a scoreSS, a surrogate that is larger on more failure\-like samples, which shifts the joint distribution toward regions where failures are more likely\. Proposition[2](https://arxiv.org/html/2607.23134#Thmproposition2)and Lemma[1](https://arxiv.org/html/2607.23134#Thmlemma1)show that this reweighting is well defined and is the least\-distorting one that raises the expected score, remaining closest to the model in KL divergence\. Proposition[3](https://arxiv.org/html/2607.23134#Thmproposition3)shows that the probability of sampling a failure under the tilted distribution is an exact importance\-sampling reweighting of the original model, and that tilting raises this probability precisely when failures receive higher scores than non\-failures\. Theorem[1](https://arxiv.org/html/2607.23134#Thmtheorem1)weakens this requirement to an FOSD assumption, under which tilting still provably increases the failure probability, at the cost of a weaker guarantee: it raises the probability but no longer drives it to one\. Corollary[1](https://arxiv.org/html/2607.23134#Thmcorollary1)recovers that stronger conclusion under strict score separation, and Corollary[2](https://arxiv.org/html/2607.23134#Thmcorollary2)establishes the advantage over conditional sampling, which is capped by the failure rate within a single input because it cannot reweight traces, a limit the joint tilt overcomes\. Notation is summarized in Table[I](https://arxiv.org/html/2607.23134#S3.T1)\.

TABLE I:Notation used in Section[III](https://arxiv.org/html/2607.23134#S3)\.
#### Problem Setup

Let\(X,Y\)∈𝒳×𝒴\\left\(X,Y\\right\)\\in\\mathcal\{X\}\\times\\mathcal\{Y\}denote a scenario, whereXXis some representation of the input, andYYis a system execution trace consistent withXX\. Letp⋆​\(x,y\)p^\{\\star\}\\left\(x,y\\right\)denote the true \(unknown\) distribution ofplausibleinputs\. We assume access to a learned joint diffusion modelpθ​\(x,y\)p\_\{\\theta\}\\left\(x,y\\right\)that approximatesp⋆p^\{\\star\}and provides a support to the sampler\. We also define a failure event as the set satisfying:

F:=\{\(x,y\)∈𝒳×𝒴:R​\(x,y\)≤0\},F:=\\left\\\{\\left\(x,y\\right\)\\in\\mathcal\{X\}\\times\\mathcal\{Y\}:R\\left\(x,y\\right\)\\leq 0\\right\\\},\(8\)whereR:𝒳×𝒴→ℝR:\\mathcal\{X\}\\times\\mathcal\{Y\}\\rightarrow\\mathbb\{R\}is a cost function, a score, associated with the \(input, trace\) pair\. The goal of sampling is to efficiently discover locations fromFF, or equivalently, to estimate oramplifythe probability mass in regions whereR​\(x,y\)R\\left\(x,y\\right\)is small\. In order to formalize the desired properties for our sampler, we define the concept ofrare failureas failure event of interest in this work\.

###### Definition 1\.

\(Rare Failure\) A failure eventFFis rare if there exists a measurable setA⊂𝒳A\\subset\\mathcal\{X\}such that:

- •p⋆​\(A×𝒴\)=δ<<1p^\{\\star\}\\left\(A\\times\\mathcal\{Y\}\\right\)=\\delta<<1,
- •Failures are negligible outside of the setAA: p⋆​\(F\|X∉A\)=p⋆​\(F∩\(\(𝒳∖A\)×𝒴\)\)p⋆​\(\(𝒳∖A\)×𝒴\)≈0\.p^\{\\star\}\\left\(F\|X\\notin A\\right\)=\\frac\{p^\{\\star\}\\left\(F\\cap\\left\(\\left\(\\mathcal\{X\}\\setminus A\\right\)\\times\\mathcal\{Y\}\\right\)\\right\)\}\{p^\{\\star\}\\left\(\\left\(\\mathcal\{X\}\\setminus A\\right\)\\times\\mathcal\{Y\}\\right\)\}\\approx 0\.
- •Failure is rare but possible withinAA: p⋆​\(F\|X∈A\)=p⋆​\(F∩\(A×𝒴\)\)p⋆​\(A×𝒴\)=ε<<1\.p^\{\\star\}\\left\(F\|X\\in A\\right\)=\\frac\{p^\{\\star\}\\left\(F\\cap\\left\(A\\times\\mathcal\{Y\}\\right\)\\right\)\}\{p^\{\\star\}\\left\(A\\times\\mathcal\{Y\}\\right\)\}=\\varepsilon<<1\.

Hence, the overall failure probability isp⋆​\(F\)=δ​εp^\{\\star\}\\left\(F\\right\)=\\delta\\varepsilon,which we refer to as the*multiplicative rarity*ofFF\.

###### Example 1\(Multiplicative Rarity Effect\)\.

Consider a tractor\-trailer maneuvering task, in which a vehicle composed of a tractor and an attached trailer must drive from an initial configuration to a goal configuration in a bounded planar environment using bounded velocity and steering inputs\. The property used for evaluation is the negation of goal reachability: the system is specified to never reach the goal region\. Thus, a falsifying eventFFcorresponds to a successful goal\-reaching maneuver\. Reaching the goal requires \(i\) that the input trajectory brings the vehicle into the neighborhood of the goal at all, which only a narrow corridor of steering and velocity sequences achieves, so the admissible inputs form a small setAAwithδ=p⋆​\(A×𝒴\)≪1\\delta=p^\{\\star\}\(A\\times\\mathcal\{Y\}\)\\ll 1; and \(ii\) that the final configuration simultaneously satisfies the position tolerance and both the tractor and trailer orientation tolerances, which only a fraction of near\-goal trajectories meet, giving the within\-region rateε≪1\\varepsilon\\ll 1\. Thus, falsification requires both rare conditions to coincide, sop⋆​\(F\)=δ​εp^\{\\star\}\(F\)=\\delta\\varepsilon\. Tightening the tolerances \(smallerε\\varepsilon\) or narrowing the feasible corridor \(smallerδ\\delta\) shrinks the failure region multiplicatively\. Proposition[1](https://arxiv.org/html/2607.23134#Thmproposition1)formalizes this bottleneck\.

###### Assumption 1\(Score Function Characterization\)\.

The score function is positively correlated with the failure, namely:

sup\(x,y\)∈𝒳×𝒴∖FS​\(x,y\)\>sup\(x,y\)∈FS​\(x,y\)\.\\sup\_\{\\left\(x,y\\right\)\\in\\mathcal\{X\}\\times\\mathcal\{Y\}\\setminus F\}S\\left\(x,y\\right\)\>\\sup\_\{\\left\(x,y\\right\)\\in F\}S\\left\(x,y\\right\)\.\(9\)

*Conditional Sampling and the Rare\-event bottleneck\.*A conditional sampling approach generates scenarios viaX∼q​\(x\),Y∼pθ​\(y\|X\)X\\sim q\\left\(x\\right\),Y\\sim p\_\{\\theta\}\\left\(y\|X\\right\), whereqqis a proposal distribution over scenes\. Under this scheme, the probability to observe a failure is:

ℙ​\(F\)=∫q​\(x\)​pθ​\(F\|x\)​𝑑x\.\\mathbb\{P\}\\left\(F\\right\)=\\int q\\left\(x\\right\)p\_\{\\theta\}\\left\(F\|x\\right\)dx\.
###### Proposition 1\.

\(Conditional sampling expected efficiency\) Supposepθ​\(y\|x\)=p⋆​\(y\|x\)p\_\{\\theta\}\\left\(y\|x\\right\)=p^\{\\star\}\\left\(y\|x\\right\), andq​\(x\)≈p⋆​\(x\)q\\left\(x\\right\)\\approx p^\{\\star\}\\left\(x\\right\)\. Then it holds, for the rare failureFFthatℙ​\(F\)=δ​ε,\\mathbb\{P\}\\left\(F\\right\)=\\delta\\varepsilon,and the expected number of samples required to observe a failure isΩ​\(\(δ​ε\)−1\)\\Omega\\left\(\\left\(\\delta\\varepsilon\\right\)^\{\-1\}\\right\)\.

###### Proof\.

See Appendix[VIII\-A](https://arxiv.org/html/2607.23134#S8.SS1)\. ∎

Proposition[1](https://arxiv.org/html/2607.23134#Thmproposition1)tells us that even with a perfect conditional model, a conditional sampling distribution must first draw a rare inputX∈AX\\in Aand then a rare traceY∈BXY\\in B\_\{X\}, which implies a multiplicative effect\. Importantly, improvingpθ​\(y\|x\)p\_\{\\theta\}\\left\(y\|x\\right\)does not mitigate this effect, unless the proposalq​\(x\)q\\left\(x\\right\)already concentrates on the unknown failure inducing regionAA\. Another intuitive characterization of the conditional sampling is that such method wants to identify failure prone inputsxxand then sampley∼pθ​\(y\|x\)y\\sim p\_\{\\theta\}\\left\(y\|x\\right\)and evaluateR​\(x,y\)R\\left\(x,y\\right\)to achieve an estimate forp​\(F\|X=x\)=ℙY∼pθ\(⋅\|x\)​\(R​\(x,y\)≤0\)p\\left\(F\|X=x\\right\)=\\mathbb\{P\}\_\{Y\\sim p\_\{\\theta\}\\left\(\\cdot\|x\\right\)\}\\left\(R\\left\(x,y\\right\)\\leq 0\\right\)\.

Under the base distributionp⋆​\(X,Y\)p^\{\\star\}\\left\(X,Y\\right\), the probability of a failure event is:

p⋆​\(F\)=𝔼p⋆​\[𝟏F​\(X,Y\)\]\.p^\{\\star\}\\left\(F\\right\)=\\mathbb\{E\}\_\{p^\{\\star\}\}\\left\[\\boldsymbol\{1\}\_\{F\}\\left\(X,Y\\right\)\\right\]\.\(10\)An intuitive IS distribution for the estimation ofp⋆​\(F\)p^\{\\star\}\\left\(F\\right\)would then be:

p⋆​\(x,y∣F\)∝p⋆​\(x,y\)​𝟏F​\(x,y\)\.p^\{\\star\}\\left\(x,y\\mid F\\right\)\\propto p^\{\\star\}\\left\(x,y\\right\)\\boldsymbol\{1\}\_\{F\}\\left\(x,y\\right\)\.This distribution places all mass on the failure set and minimizes the variance associated with the estimator\. However, it is infeasible to sample from this IS proposal becauseFFis unknown a priori\. A standard relaxation is to replace the indicator𝟏F​\(x,y\)\\boldsymbol\{1\}\_\{F\}\\left\(x,y\\right\)with a smooth scoreS​\(x,y\)S\\left\(x,y\\right\)correlated with failure\. Now let our score functionS:𝒳×𝒴→ℝS:\\mathcal\{X\}\\times\\mathcal\{Y\}\\rightarrow\\mathbb\{R\}be interpreted as a surrogate for failure \(as an example, this would be the learned robustness predictor\), then the following holds for the tilted distribution defined in equation \([II](https://arxiv.org/html/2607.23134#S2.Ex1)\)\.

###### Proposition 2\(Variational optimality for the tilted distribution\)\.

Define thetilteddistribution

pθ,β​\(x,y\)\\displaystyle p\_\{\\theta,\\beta\}\\left\(x,y\\right\):=pθ​\(x,y\)​exp⁡\(β​S​\(x,y\)\)Z​\(β\),\\displaystyle:=\\frac\{p\_\{\\theta\}\\left\(x,y\\right\)\\exp\\left\(\\beta S\\left\(x,y\\right\)\\right\)\}\{Z\\left\(\\beta\\right\)\},whereZ​\(β\)=𝔼\(X,Y\)∼pθ​\[exp⁡\(β​S​\(X,Y\)\)\],Z\\left\(\\beta\\right\)=\\mathbb\{E\}\_\{\\left\(X,Y\\right\)\\sim p\_\{\\theta\}\}\\left\[\\exp\\left\(\\beta S\\left\(X,Y\\right\)\\right\)\\right\],thenpθ,βp\_\{\\theta,\\beta\}is the solution to

minqKL\(q∣∣pθ\)s\.t\.𝔼\(X,Y\)∼q\[S\(X,Y\)\]≥c\\displaystyle\\min\_\{q\}KL\\left\(q\\mid\\mid p\_\{\\theta\}\\right\)\\quad\\mbox\{s\.t\. \}\\mathbb\{E\}\_\{\\left\(X,Y\\right\)\\sim q\}\\left\[S\\left\(X,Y\\right\)\\right\]\\geq cfor someccfunction ofβ\\beta\.

###### Proof\.

Fixβ∈ℬ\\beta\\in\\mathcal\{B\}so thatZ​\(β\)<∞Z\(\\beta\)<\\inftyandpθ,βp\_\{\\theta,\\beta\}is well\-defined\. Let𝒬:=\{q:q≪pθ,∫q​\(z\)​𝑑z=1\}\\mathcal\{Q\}:=\\\{q:\\ q\\ll p\_\{\\theta\},\\ \\int q\(z\)\\,dz=1\\\}\. Forq∈𝒬q\\in\\mathcal\{Q\}, define the likelihood ratior​\(z\):=q​\(z\)pθ​\(z\)r\(z\):=\\frac\{q\(z\)\}\{p\_\{\\theta\}\(z\)\}so thatq​\(z\)=r​\(z\)​pθ​\(z\)q\(z\)=r\(z\)p\_\{\\theta\}\(z\),r≥0r\\geq 0, and𝔼pθ​\[r\]=1\\mathbb\{E\}\_\{p\_\{\\theta\}\}\[r\]=1\.

We first express KL as a convex functional ofrr\. Specifically, we have

KL​\(q∥pθ\)\\displaystyle\\mathrm\{KL\}\(q\\\|p\_\{\\theta\}\)=∫q​\(z\)​log⁡q​\(z\)pθ​\(z\)​d​z\\displaystyle=\\int q\(z\)\\log\\frac\{q\(z\)\}\{p\_\{\\theta\}\(z\)\}\\,dz=∫pθ​\(z\)​r​\(z\)​log⁡r​\(z\)​𝑑z=𝔼pθ​\[r​log⁡r\]\.\\displaystyle=\\int p\_\{\\theta\}\(z\)\\,r\(z\)\\log r\(z\)\\,dz=\\mathbb\{E\}\_\{p\_\{\\theta\}\}\[r\\log r\]\.Moreover,𝔼q​\[S\]=∫q​\(z\)​S​\(z\)​𝑑z=𝔼pθ​\[r​S\]\\mathbb\{E\}\_\{q\}\[S\]=\\int q\(z\)S\(z\)\\,dz=\\mathbb\{E\}\_\{p\_\{\\theta\}\}\[rS\]\. Now consider the constrained problem

minr≥0⁡𝔼pθ​\[r​log⁡r\]s\.t\.𝔼pθ​\[r\]=1,𝔼pθ​\[r​S\]≥c,\\min\_\{r\\geq 0\}\\ \\mathbb\{E\}\_\{p\_\{\\theta\}\}\[r\\log r\]\\quad\\text\{s\.t\.\}\\quad\\mathbb\{E\}\_\{p\_\{\\theta\}\}\[r\]=1,\\ \\ \\mathbb\{E\}\_\{p\_\{\\theta\}\}\[rS\]\\geq c,for some scalarcc\. Then the Lagrangian with multipliersλ∈ℝ,β′≥0\\lambda\\in\\mathbb\{R\},\\beta^\{\\prime\}\\geq 0\(normalization, and moment constraint respectively\) can be written as:

ℒ​\(r,λ,β′\)=𝔼pθ​\[r​log⁡r\]\+λ​\(𝔼pθ​\[r\]−1\)−β′​\(𝔼pθ​\[r​S\]−c\)\.\\mathcal\{L\}\(r,\\lambda,\\beta^\{\\prime\}\)=\\mathbb\{E\}\_\{p\_\{\\theta\}\}\[r\\log r\]\+\\lambda\(\\mathbb\{E\}\_\{p\_\{\\theta\}\}\[r\]\-1\)\-\\beta^\{\\prime\}\(\\mathbb\{E\}\_\{p\_\{\\theta\}\}\[rS\]\-c\)\.A first\-order optimality condition \(calculus of variations\) yields, forpθp\_\{\\theta\}\-a\.e\.zz,

δ​ℒδ​r​\(z\)=log⁡r​\(z\)\+1\+λ−β′​S​\(z\)=0,\\frac\{\\delta\\mathcal\{L\}\}\{\\delta r\}\(z\)=\\log r\(z\)\+1\+\\lambda\-\\beta^\{\\prime\}S\(z\)=0,hence

r⋆​\(z\)=exp⁡\(β′​S​\(z\)−1−λ\)=C​eβ′​S​\(z\)r^\{\\star\}\(z\)=\\exp\(\\beta^\{\\prime\}S\(z\)\-1\-\\lambda\)=C\\,e^\{\\beta^\{\\prime\}S\(z\)\}for some constantC\>0C\>0\.

We can see that setting𝔼pθ​\[r⋆\]=1\\mathbb\{E\}\_\{p\_\{\\theta\}\}\[r^\{\\star\}\]=1gives

1=𝔼pθ​\[r⋆\]=C​𝔼pθ​\[eβ′​S​\(Z\)\]=C​Z​\(β′\),1=\\mathbb\{E\}\_\{p\_\{\\theta\}\}\[r^\{\\star\}\]=C\\,\\mathbb\{E\}\_\{p\_\{\\theta\}\}\[e^\{\\beta^\{\\prime\}S\(Z\)\}\]=C\\,Z\(\\beta^\{\\prime\}\),soC=1/Z​\(β′\)C=1/Z\(\\beta^\{\\prime\}\)and therefore

qβ′⋆​\(z\)=r⋆​\(z\)​pθ​\(z\)=pθ​\(z\)​eβ′​S​\(z\)Z​\(β′\)\.q^\{\\star\}\_\{\\beta^\{\\prime\}\}\(z\)=r^\{\\star\}\(z\)p\_\{\\theta\}\(z\)=\\frac\{p\_\{\\theta\}\(z\)e^\{\\beta^\{\\prime\}S\(z\)\}\}\{Z\(\\beta^\{\\prime\}\)\}\.
Setβ′=β\\beta^\{\\prime\}=\\betaand definec​\(β\):=𝔼pθ,β​\[S\]c\(\\beta\):=\\mathbb\{E\}\_\{p\_\{\\theta,\\beta\}\}\[S\]\. Thenqβ⋆=pθ,βq^\{\\star\}\_\{\\beta\}=p\_\{\\theta,\\beta\}is feasible with equality:𝔼pθ,β​\[S\]=c​\(β\)\\mathbb\{E\}\_\{p\_\{\\theta,\\beta\}\}\[S\]=c\(\\beta\)\. By convexity ofr↦r​log⁡rr\\mapsto r\\log rand linearity of the constraints, the problem is convex; hence the KKT conditions are sufficient and the optimizer is unique\. Thereforepθ,βp\_\{\\theta,\\beta\}is the unique solution of

minq⁡KL​\(q∥pθ\)​s\.t\.​𝔼q​\[S\]≥c​\(β\)\.\\min\_\{q\}\\mathrm\{KL\}\(q\\\|p\_\{\\theta\}\)\\ \\text\{s\.t\.\}\\ \\mathbb\{E\}\_\{q\}\[S\]\\geq c\(\\beta\)\.This completes the proof\. ∎

Proposition[2](https://arxiv.org/html/2607.23134#Thmproposition2)shows how tilting produces the closest distribution to the data \(in KL divergence\) that amplifies failure\-relevant regions\.

###### Lemma 1\.

Letppbe a density defined over𝒵=𝒳×𝒴\\mathcal\{Z\}=\\mathcal\{X\}\\times\\mathcal\{Y\}, and letS:𝒵→ℝS:\\mathcal\{Z\}\\rightarrow\\mathbb\{R\}be a measurable score\. LetZ​\(β\)Z\\left\(\\beta\\right\)be defined asZ​\(β\):=∫p​\(z\)​exp⁡\(β​S​\(z\)\)Z\\left\(\\beta\\right\):=\\int p\\left\(z\\right\)\\exp\\left\(\\beta S\\left\(z\\right\)\\right\), then an admissible tilt set is

ℬ=\{β:Z​\(β\)<∞\}\.\\mathcal\{B\}=\\left\\\{\\beta:Z\\left\(\\beta\\right\)<\\infty\\right\\\}\.\(11\)The following properties hold forℬ\\mathcal\{B\}:

1. 1\.0∈ℬ,Z​\(0\)=10\\in\\mathcal\{B\},Z\\left\(0\\right\)=1;
2. 2\.ℬ=\(β−,β\+\)\\mathcal\{B\}=\\left\(\\beta\_\{\-\},\\beta\_\{\+\}\\right\), with−∞≤β−≤0≤β\+≤\+∞\-\\infty\\leq\\beta\_\{\-\}\\leq 0\\leq\\beta\_\{\+\}\\leq\+\\infty;
3. 3\.For anyβ∈ℬ\\beta\\in\\mathcal\{B\}the tilted densitypβ​\(z\):=p​\(z\)​exp⁡\(β​S​\(z\)\)Z​\(β\)p\_\{\\beta\}\\left\(z\\right\):=\\frac\{p\\left\(z\\right\)\\exp\\left\(\\beta S\\left\(z\\right\)\\right\)\}\{Z\\left\(\\beta\\right\)\}is a valid density function over𝒵\\mathcal\{Z\}\.

Moreover, withβ∈int​\(ℬ\)\\beta\\in\\mbox\{int\}\\left\(\\mathcal\{B\}\\right\), assume that∫p​\(z\)​exp⁡\(\(β\+δ\)​S​\(z\)\)<∞\\int p\\left\(z\\right\)\\exp\\left\(\\left\(\\beta\+\\delta\\right\)S\\left\(z\\right\)\\right\)<\\inftyfor someδ\>0\\delta\>0, then the following holds:

1. 1\.ψ​\(β\)=log⁡Z​\(β\)\\psi\\left\(\\beta\\right\)=\\log Z\\left\(\\beta\\right\)is finite and differentiable, andψ′​\(β\)=𝔼pβ​\[S​\(Z\)\]\\psi^\{\\prime\}\\left\(\\beta\\right\)=\\mathbb\{E\}\_\{p\_\{\\beta\}\}\\left\[S\\left\(Z\\right\)\\right\]\.
2. 2\.If∫p​\(z\)​exp⁡\(\(β\+δ\)​\|S​\(z\)\|\)<∞\\int p\\left\(z\\right\)\\exp\\left\(\\left\(\\beta\+\\delta\\right\)\|S\\left\(z\\right\)\|\\right\)<\\inftyfor someδ\>0\\delta\>0, thenψ\\psiis twice differentiable andψ′′​\(β\)=Var​\(S​\(Z\)\)≥0\\psi^\{\\prime\\prime\}\\left\(\\beta\\right\)=\\mbox\{Var\}\\left\(S\\left\(Z\\right\)\\right\)\\geq 0\.

###### Proof\.

See Appendix[VIII\-B](https://arxiv.org/html/2607.23134#S8.SS2)\. ∎

After characterizing the tilt we analyze its effect on the failure probability\.

###### Proposition 3\(Effect of tilting on Failure Probability\)\.

Letp≡pθ​\(x,y\)p\\equiv p\_\{\\theta\}\\left\(x,y\\right\)be the base joint density on support𝒵=𝒳×𝒴\\mathcal\{Z\}=\\mathcal\{X\}\\times\\mathcal\{Y\}, and letF⊂𝒵F\\subset\\mathcal\{Z\}be the failure set defined asF=\{\(x,y\):R​\(x,y\)≤0\}F=\\left\\\{\\left\(x,y\\right\):R\\left\(x,y\\right\)\\leq 0\\right\\\}\. LetS:𝒵→ℝS:\\mathcal\{Z\}\\rightarrow\\mathbb\{R\}be a measurable score, and assumeZ​\(β\):=∫p​\(z\)​exp⁡\(β​S​\(z\)\)<∞Z\\left\(\\beta\\right\):=\\int p\\left\(z\\right\)\\exp\\left\(\\beta S\\left\(z\\right\)\\right\)<\\inftyfor admissibleβ\\beta\(Lemma[1](https://arxiv.org/html/2607.23134#Thmlemma1)\)\. For the tilted densitypβ​\(z\):=p​\(z\)​exp⁡\(β​S​\(z\)\)Z​\(β\)p\_\{\\beta\}\\left\(z\\right\):=\\frac\{p\\left\(z\\right\)\\exp\\left\(\{\\beta S\\left\(z\\right\)\}\\right\)\}\{Z\\left\(\\beta\\right\)\}, the following properties hold:

1. \(A\)∫Fpβ​\(z\)​𝑑z=∫Fp​\(z\)​exp⁡\(β​S​\(z\)\)​𝑑z∫p​\(z\)​exp⁡\(β​S​\(z\)\)​𝑑z\\int\_\{F\}p\_\{\\beta\}\\left\(z\\right\)dz=\\frac\{\\int\_\{F\}p\\left\(z\\right\)\\exp\\left\(\{\\beta S\\left\(z\\right\)\}\\right\)dz\}\{\\int p\\left\(z\\right\)\\exp\\left\(\{\\beta S\\left\(z\\right\)\}\\right\)dz\}\.
2. \(B\)LetMF​\(β\):=𝔼p​\[eβ​S​\(z\)∣Z∈F\]M\_\{F\}\\left\(\\beta\\right\):=\\mathbb\{E\}\_\{p\}\\left\[e^\{\\beta S\\left\(z\\right\)\}\\mid Z\\in F\\right\],MF¯​\(β\):=𝔼p​\[eβ​S​\(z\)∣Z∉F\]M\_\{\\bar\{F\}\}\\left\(\\beta\\right\):=\\mathbb\{E\}\_\{p\}\\left\[e^\{\\beta S\\left\(z\\right\)\}\\mid Z\\notin F\\right\], then the following must hold: ∫Fpβ\>∫Fp⇔MF​\(β\)\>MF¯​\(β\)\\int\_\{F\}p\_\{\\beta\}\>\\int\_\{F\}p\\iff M\_\{F\}\\left\(\\beta\\right\)\>M\_\{\\bar\{F\}\}\\left\(\\beta\\right\)\(12\)
3. \(C\)If there existsm\>0m\>0such thatinfz∈FS​\(z\)≥supz∉FS​\(z\)\+m\\inf\_\{z\\in F\}S\\left\(z\\right\)\\geq\\sup\_\{z\\notin F\}S\\left\(z\\right\)\+m, then for allβ≥0\\beta\\geq 0, the following bound overℙβ​\(F\)\\mathbb\{P\}\_\{\\beta\}\\left\(F\\right\)can be derived: ∫Fpβ​\(z\)​𝑑z≥11\+1−∫Fp∫Fp​e−β​m,\\int\_\{F\}p\_\{\\beta\}\\left\(z\\right\)dz\\geq\\frac\{1\}\{1\+\\frac\{1\-\\int\_\{F\}p\}\{\\int\_\{F\}p\}e^\{\-\\beta m\}\},\(13\)and as a result,∫Fpβ​\(z\)→1\\int\_\{F\}p\_\{\\beta\}\\left\(z\\right\)\\rightarrow 1asβ→∞\\beta\\rightarrow\\infty\.

###### Proof\.

\(A\) By definition ofpβp\_\{\\beta\},

∫Fpβ​\(z\)​𝑑z=∫Fp​\(z\)​eβ​S​\(z\)Z​\(β\)​𝑑z=∫Fp​\(z\)​eβ​S​\(z\)​𝑑z∫𝒵p​\(z\)​eβ​S​\(z\)​𝑑z\.\\displaystyle\\int\_\{F\}p\_\{\\beta\}\(z\)\\,dz=\\int\_\{F\}\\frac\{p\(z\)e^\{\\beta S\(z\)\}\}\{Z\(\\beta\)\}\\,dz=\\frac\{\\int\_\{F\}p\(z\)e^\{\\beta S\(z\)\}\\,dz\}\{\\int\_\{\\mathcal\{Z\}\}p\(z\)e^\{\\beta S\(z\)\}\\,dz\}\.
\(B\) Letp​\(F\):=∫Fp​\(z\)​𝑑z∈\(0,1\)p\(F\):=\\int\_\{F\}p\(z\)\\,dz\\in\(0,1\)\. Using the law of total expectation,

∫Fp​\(z\)​eβ​S​\(z\)​𝑑z=p​\(F\)​𝔼p​\[eβ​S​\(Z\)∣Z∈F\]=p​\(F\)​MF​\(β\),\\displaystyle\\int\_\{F\}p\(z\)e^\{\\beta S\(z\)\}\\,dz=p\(F\)\\,\\mathbb\{E\}\_\{p\}\[e^\{\\beta S\(Z\)\}\\mid Z\\in F\]=p\(F\)\\,M\_\{F\}\(\\beta\),and similarly,

∫F¯p​\(z\)​eβ​S​\(z\)​𝑑z=\(1−p​\(F\)\)​MF¯​\(β\)\.\\displaystyle\\int\_\{\\bar\{F\}\}p\(z\)e^\{\\beta S\(z\)\}\\,dz=\(1\-p\(F\)\)\\,M\_\{\\bar\{F\}\}\(\\beta\)\.Substituting into \(A\) yields

∫Fpβ=p​\(F\)​MF​\(β\)p​\(F\)​MF​\(β\)\+\(1−p​\(F\)\)​MF¯​\(β\)\.\\displaystyle\\int\_\{F\}p\_\{\\beta\}=\\frac\{p\(F\)M\_\{F\}\(\\beta\)\}\{p\(F\)M\_\{F\}\(\\beta\)\+\(1\-p\(F\)\)M\_\{\\bar\{F\}\}\(\\beta\)\}\.A direct comparison withp​\(F\)p\(F\)gives

∫Fpβ\>p​\(F\)\\displaystyle\\int\_\{F\}p\_\{\\beta\}\>p\(F\)⇔p​\(F\)​MF​\(β\)\\displaystyle\\iff p\(F\)M\_\{F\}\(\\beta\)\>p​\(F\)​\(p​\(F\)​MF​\(β\)\+\(1−p​\(F\)\)​MF¯​\(β\)\),\\displaystyle\\quad\>p\(F\)\\big\(p\(F\)M\_\{F\}\(\\beta\)\+\(1\-p\(F\)\)M\_\{\\bar\{F\}\}\(\\beta\)\\big\),and

p​\(F\)​MF​\(β\)\\displaystyle p\(F\)M\_\{F\}\(\\beta\)\>p​\(F\)​\(p​\(F\)​MF​\(β\)\+\(1−p​\(F\)\)​MF¯​\(β\)\)\\displaystyle\>p\(F\)\\big\(p\(F\)M\_\{F\}\(\\beta\)\+\(1\-p\(F\)\)M\_\{\\bar\{F\}\}\(\\beta\)\\big\)⇔MF​\(β\)\>MF¯​\(β\)\.\\displaystyle\\iff M\_\{F\}\(\\beta\)\>M\_\{\\bar\{F\}\}\(\\beta\)\.
\(C\) Leta:=infz∈FS​\(z\)a:=\\inf\_\{z\\in F\}S\(z\)andb:=supz∉FS​\(z\)b:=\\sup\_\{z\\notin F\}S\(z\), soa≥b\+ma\\geq b\+m\. Then

∫Fp​\(z\)​eβ​S​\(z\)​𝑑z≥eβ​a​∫Fp​\(z\)​𝑑z=p​\(F\)​eβ​a,\\displaystyle\\int\_\{F\}p\(z\)e^\{\\beta S\(z\)\}\\,dz\\geq e^\{\\beta a\}\\int\_\{F\}p\(z\)\\,dz=p\(F\)e^\{\\beta a\},and

∫F¯p​\(z\)​eβ​S​\(z\)​𝑑z≤eβ​b​∫F¯p​\(z\)​𝑑z=\(1−p​\(F\)\)​eβ​b\.\\displaystyle\\int\_\{\\bar\{F\}\}p\(z\)e^\{\\beta S\(z\)\}\\,dz\\leq e^\{\\beta b\}\\int\_\{\\bar\{F\}\}p\(z\)\\,dz=\(1\-p\(F\)\)e^\{\\beta b\}\.Using \(A\) and these bounds,

∫Fpβ\\displaystyle\\int\_\{F\}p\_\{\\beta\}=∫Fp​eβ​S∫Fp​eβ​S\+∫F¯p​eβ​S\\displaystyle=\\frac\{\\int\_\{F\}pe^\{\\beta S\}\}\{\\int\_\{F\}pe^\{\\beta S\}\+\\int\_\{\\bar\{F\}\}pe^\{\\beta S\}\}≥p​\(F\)​eβ​ap​\(F\)​eβ​a\+\(1−p​\(F\)\)​eβ​b=11\+1−p​\(F\)p​\(F\)​e−β​\(a−b\)\.\\displaystyle\\geq\\frac\{p\(F\)e^\{\\beta a\}\}\{p\(F\)e^\{\\beta a\}\+\(1\-p\(F\)\)e^\{\\beta b\}\}=\\frac\{1\}\{1\+\\frac\{1\-p\(F\)\}\{p\(F\)\}e^\{\-\\beta\(a\-b\)\}\}\.Sincea−b≥ma\-b\\geq m, the stated bound follows\. The limit asβ→∞\\beta\\to\\inftyfollows\. ∎

Result \(A\) expresses the failure probability under tilting as an exact likelihood\-ratio reweighting of the base distribution, making explicit the connection to IS\. Result \(B\) shows that tilting improves failure discovery if and only if the surrogate score assigns larger exponential weight to failure samples than to non\-failures, which is in fact a way to express the notion of score alignment\. Result \(C\) characterizes an idealized regime in which the score perfectly separates failures, in which case increasing the tilt parameter concentrates probability mass arbitrarily close to the failure set\. Together, these results clarify both the mechanism and the limits of diffusion\-guided falsification\.

What we want to show now is that the tilted distribution moves mass towards the failure region\. In order to show this we \(i\) write the tilted failure probability in a form that exposes a likelihood ratio; \(ii\) state sufficient conditions under which it is provably larger than the baselinepθ​\(F\)=δ​εp\_\{\\theta\}\\left\(F\\right\)=\\delta\\varepsilon\. As shown in Proposition[3](https://arxiv.org/html/2607.23134#Thmproposition3), we cannot prove this in general, but we need an assumption on the alignment betweenSSand failure\. Let the base distribution bep≡pθ​\(x,y\)p\\equiv p\_\{\\theta\}\\left\(x,y\\right\), and let the tilted distribution be:

pβ​\(z\)=p​\(z\)​eβ​S​\(z\)Z​\(β\),z=\(x,y\),Z​\(β\)=𝔼p​\[eβ​S​\(Z\)\]\.p\_\{\\beta\}\\left\(z\\right\)=\\frac\{p\\left\(z\\right\)e^\{\\beta S\\left\(z\\right\)\}\}\{Z\\left\(\\beta\\right\)\},\\;z=\\left\(x,y\\right\),\\;Z\\left\(\\beta\\right\)=\\mathbb\{E\}\_\{p\}\\left\[e^\{\\beta S\\left\(Z\\right\)\}\\right\]\.LetF=\{z:R​\(z\)≤0\}F=\\left\\\{z:R\\left\(z\\right\)\\leq 0\\right\\\}\. Then:

pβ​\(F\)\\displaystyle p\_\{\\beta\}\\left\(F\\right\)=𝔼p​\[𝟏F​eβ​S​\(Z\)\]𝔼p​\[eβ​S​\(Z\)\]\\displaystyle=\\frac\{\\mathbb\{E\}\_\{p\}\\left\[\\boldsymbol\{1\}\_\{F\}e^\{\\beta S\\left\(Z\\right\)\}\\right\]\}\{\\mathbb\{E\}\_\{p\}\\left\[e^\{\\beta S\\left\(Z\\right\)\}\\right\]\}=p​\(F\)​MF​\(β\)p​\(F\)​MF​\(β\)\+\(1−p​\(F\)\)​MF¯​\(β\),\\displaystyle=\\frac\{p\\left\(F\\right\)M\_\{F\}\\left\(\\beta\\right\)\}\{p\\left\(F\\right\)M\_\{F\}\\left\(\\beta\\right\)\+\\left\(1\-p\\left\(F\\right\)\\right\)M\_\{\\bar\{F\}\}\\left\(\\beta\\right\)\},where

MF​\(β\)=𝔼p​\[eβ​S​\(Z\)∣F\],MF¯​\(β\)=𝔼p​\[eβ​S​\(Z\)∣F¯\]\.M\_\{F\}\\left\(\\beta\\right\)=\\mathbb\{E\}\_\{p\}\\left\[e^\{\\beta S\\left\(Z\\right\)\}\\mid F\\right\],\\;M\_\{\\bar\{F\}\}\\left\(\\beta\\right\)=\\mathbb\{E\}\_\{p\}\\left\[e^\{\\beta S\\left\(Z\\right\)\}\\mid\\bar\{F\}\\right\]\.We want to show thatpβ​\(F\)\>p​\(F\)=δ​εp\_\{\\beta\}\\left\(F\\right\)\>p\\left\(F\\right\)=\\delta\\varepsilon\.

###### Theorem 1\(Failure Amplification Under Exponential Tilting\)\.

Letppbe a probability density on𝒵=𝒳×𝒴\\mathcal\{Z\}=\\mathcal\{X\}\\times\\mathcal\{Y\}\. LetF⊂𝒵F\\subset\\mathcal\{Z\}be a measurable failure set, and letS:𝒵→ℝS:\\mathcal\{Z\}\\rightarrow\\mathbb\{R\}be a measurable score function\. Define, for anyβ∈ℬ\\beta\\in\\mathcal\{B\}\(see Lemma[1](https://arxiv.org/html/2607.23134#Thmlemma1)\), withZ​\(β\):=∫𝒵p​\(z\)​eβ​S​\(z\)​𝑑zZ\\left\(\\beta\\right\):=\\int\_\{\\mathcal\{Z\}\}p\\left\(z\\right\)e^\{\\beta S\}\\left\(z\\right\)dz, the tilted density

pβ​\(z\)=p​\(z\)​eβ​S​\(z\)Z​\(β\)\.p\_\{\\beta\}\\left\(z\\right\)=\\frac\{p\\left\(z\\right\)e^\{\\beta S\\left\(z\\right\)\}\}\{Z\\left\(\\beta\\right\)\}\.Assume that the conditional distribution ofS​\(Z\)S\\left\(Z\\right\)givenz∈Fz\\in Ffirst\-order stochastically dominates the conditional distribution ofS​\(Z\)S\\left\(Z\\right\)givenZ∉FZ\\notin F, namely

𝔼p​\[ϕ​\(S​\(Z\)\)∣Z∈F\]≥𝔼p​\[ϕ​\(S​\(Z\)\)∣Z∉F\],\\mathbb\{E\}\_\{p\}\\left\[\\phi\\left\(S\\left\(Z\\right\)\\right\)\\mid Z\\in F\\right\]\\geq\\mathbb\{E\}\_\{p\}\\left\[\\phi\\left\(S\\left\(Z\\right\)\\right\)\\mid Z\\notin F\\right\],for all bounded increasingϕ​\(⋅\)\\phi\\left\(\\cdot\\right\)\. Then, for allβ∈ℬ\\beta\\in\\mathcal\{B\},

∫Fpβ​\(z\)​𝑑z≥∫Fp​\(z\)​𝑑z,\\int\_\{F\}p\_\{\\beta\}\\left\(z\\right\)dz\\geq\\int\_\{F\}p\\left\(z\\right\)dz,with strict inequality holding for anyβ\>0\\beta\>0unless the conditional distributions ofS​\(Z\)S\(Z\)givenZ∈FZ\\in Fand givenZ∉FZ\\notin Fcoincide\.

###### Proof\.

Fix anyβ∈ℬ\\beta\\in\\mathcal\{B\}so thatZ​\(β\)<∞Z\(\\beta\)<\\inftyandpβp\_\{\\beta\}is well\-defined\. Letp​\(F\):=∫Fp​\(z\)​𝑑zp\(F\):=\\int\_\{F\}p\(z\)\\,dz\. Ifp​\(F\)∈\{0,1\}p\(F\)\\in\\\{0,1\\\}, the claim is trivial, so assumep​\(F\)∈\(0,1\)p\(F\)\\in\(0,1\)\.

By Proposition[3](https://arxiv.org/html/2607.23134#Thmproposition3)\(A\) and the law of total expectation,

∫Fpβ​\(z\)​𝑑z\\displaystyle\\int\_\{F\}p\_\{\\beta\}\(z\)\\,dz=∫Fp​\(z\)​eβ​S​\(z\)​𝑑z∫𝒵p​\(z\)​eβ​S​\(z\)​𝑑z\\displaystyle=\\frac\{\\int\_\{F\}p\(z\)e^\{\\beta S\(z\)\}\\,dz\}\{\\int\_\{\\mathcal\{Z\}\}p\(z\)e^\{\\beta S\(z\)\}\\,dz\}=p​\(F\)​𝔼p​\[eβ​S​\(Z\)∣Z∈F\]\(p​\(F\)​𝔼p​\[eβ​S​\(Z\)∣Z∈F\]\+\(1−p​\(F\)\)​𝔼p​\[eβ​S​\(Z\)∣Z∉F\]\)\.\\displaystyle=\\frac\{p\(F\)\\,\\mathbb\{E\}\_\{p\}\\\!\\left\[e^\{\\beta S\(Z\)\}\\mid Z\\in F\\right\]\}\{\\left\(\\begin\{multlined\}p\(F\)\\,\\mathbb\{E\}\_\{p\}\\\!\\left\[e^\{\\beta S\(Z\)\}\\mid Z\\in F\\right\]\+\\\\ \(1\-p\(F\)\)\\,\\mathbb\{E\}\_\{p\}\\\!\\left\[e^\{\\beta S\(Z\)\}\\mid Z\\notin F\\right\]\\end\{multlined\}p\(F\)\\,\\mathbb\{E\}\_\{p\}\\\!\\left\[e^\{\\beta S\(Z\)\}\\mid Z\\in F\\right\]\+\\\\ \(1\-p\(F\)\)\\,\\mathbb\{E\}\_\{p\}\\\!\\left\[e^\{\\beta S\(Z\)\}\\mid Z\\notin F\\right\]\\right\)\}\.Define the moment generating function

MF​\(β\)\\displaystyle M\_\{F\}\(\\beta\):=𝔼p​\[eβ​S​\(Z\)∣Z∈F\],\\displaystyle:=\\mathbb\{E\}\_\{p\}\\\!\\left\[e^\{\\beta S\(Z\)\}\\mid Z\\in F\\right\],MF¯​\(β\)\\displaystyle M\_\{\\bar\{F\}\}\(\\beta\):=𝔼p​\[eβ​S​\(Z\)∣Z∉F\]\.\\displaystyle:=\\mathbb\{E\}\_\{p\}\\\!\\left\[e^\{\\beta S\(Z\)\}\\mid Z\\notin F\\right\]\.
Then

∫Fpβ​\(z\)​𝑑z=p​\(F\)​MF​\(β\)p​\(F\)​MF​\(β\)\+\(1−p​\(F\)\)​MF¯​\(β\)\.\\int\_\{F\}p\_\{\\beta\}\(z\)\\,dz=\\frac\{p\(F\)\\,M\_\{F\}\(\\beta\)\}\{p\(F\)\\,M\_\{F\}\(\\beta\)\+\(1\-p\(F\)\)\\,M\_\{\\bar\{F\}\}\(\\beta\)\}\.\(14\)
By assumption, the conditional distribution ofS​\(Z\)S\(Z\)givenZ∈FZ\\in Ffirst\-order stochastically dominates that givenZ∉FZ\\notin F, equivalently, for every bounded non\-decreasing functionϕ\\phi,

𝔼p​\[ϕ​\(S​\(Z\)\)∣Z∈F\]≥𝔼p​\[ϕ​\(S​\(Z\)\)∣Z∉F\]\.\\mathbb\{E\}\_\{p\}\[\\phi\(S\(Z\)\)\\mid Z\\in F\]\\ \\geq\\ \\mathbb\{E\}\_\{p\}\[\\phi\(S\(Z\)\)\\mid Z\\notin F\]\.Given a value ofβ\>0\\beta\>0, the functionϕβ​\(s\):=min⁡\{eβ​s,K\}\\phi\_\{\\beta\}\(s\):=\\min\\\{e^\{\\beta s\},K\\\}is bounded and increasing inK\>0K\>0, hence

𝔼p​\[ϕβ​\(S​\(Z\)\)∣Z∈F\]≥𝔼p​\[ϕβ​\(S​\(Z\)\)∣Z∉F\]\.\\mathbb\{E\}\_\{p\}\[\\phi\_\{\\beta\}\(S\(Z\)\)\\mid Z\\in F\]\\ \\geq\\ \\mathbb\{E\}\_\{p\}\[\\phi\_\{\\beta\}\(S\(Z\)\)\\mid Z\\notin F\]\.LettingK→∞K\\to\\inftyand applying monotone convergence yields

𝔼p​\[eβ​S​\(Z\)∣Z∈F\]≥𝔼p​\[eβ​S​\(Z\)∣Z∉F\],\\mathbb\{E\}\_\{p\}\[e^\{\\beta S\(Z\)\}\\mid Z\\in F\]\\ \\geq\\ \\mathbb\{E\}\_\{p\}\[e^\{\\beta S\(Z\)\}\\mid Z\\notin F\],i\.e\.,MF​\(β\)≥MF¯​\(β\)M\_\{F\}\(\\beta\)\\geq M\_\{\\bar\{F\}\}\(\\beta\)for allβ\>0\\beta\>0\. Forβ=0\\beta=0the two are equal to11\.

SubstitutingMF​\(β\)≥MF¯​\(β\)M\_\{F\}\(\\beta\)\\geq M\_\{\\bar\{F\}\}\(\\beta\)into \([14](https://arxiv.org/html/2607.23134#S3.E14)\) and comparing withp​\(F\)p\(F\)gives

∫Fpβ​\(z\)​𝑑z≥p​\(F\)=∫Fp​\(z\)​𝑑z\.\\int\_\{F\}p\_\{\\beta\}\(z\)\\,dz\\ \\geq\\ p\(F\)=\\int\_\{F\}p\(z\)\\,dz\.Indeed, the mappinga↦p​\(F\)​ap​\(F\)​a\+\(1−p​\(F\)\)​ba\\mapsto\\frac\{p\(F\)a\}\{p\(F\)a\+\(1\-p\(F\)\)b\}is nondecreasing inaafor fixedb\>0b\>0\. Assumeβ\>0\\beta\>0andp​\(F\)∈\(0,1\)p\(F\)\\in\(0,1\)\. From \([14](https://arxiv.org/html/2607.23134#S3.E14)\),

∫Fpβ​\(z\)​𝑑z\>p​\(F\)⟺MF​\(β\)\>MF¯​\(β\)\.\\int\_\{F\}p\_\{\\beta\}\(z\)\\,dz\>p\(F\)\\quad\\Longleftrightarrow\\quad M\_\{F\}\(\\beta\)\>M\_\{\\bar\{F\}\}\(\\beta\)\.Under FOSD, equality of expectations for all bounded increasingϕ\\phican occur only if the two conditional distributions ofS​\(Z\)S\(Z\)\(givenFFand givenF¯\\bar\{F\}\) are identical\. In that case, forβ\>0\\beta\>0we haveMF​\(β\)=MF¯​\(β\)M\_\{F\}\(\\beta\)=M\_\{\\bar\{F\}\}\(\\beta\)and no strict amplification occurs\.

Conversely, if the conditional distributions differ \(i\.e\.,S​\(Z\)S\(Z\)is notpp\-a\.s\. equal onF∪F¯F\\cup\\bar\{F\}\), then by the defining property of first\-order dominance there exists a bounded increasingϕ\\phisuch that

𝔼p​\[ϕ​\(S​\(Z\)\)∣Z∈F\]\>𝔼p​\[ϕ​\(S​\(Z\)\)∣Z∉F\],\\mathbb\{E\}\_\{p\}\[\\phi\(S\(Z\)\)\\mid Z\\in F\]\>\\mathbb\{E\}\_\{p\}\[\\phi\(S\(Z\)\)\\mid Z\\notin F\],which in particular implies strict inequality for the increasing functions↦eβ​ss\\mapsto e^\{\\beta s\}\(via the truncation argument above\), henceMF​\(β\)\>MF¯​\(β\)M\_\{F\}\(\\beta\)\>M\_\{\\bar\{F\}\}\(\\beta\)and therefore∫Fpβ\>∫Fp\\int\_\{F\}p\_\{\\beta\}\>\\int\_\{F\}p\.

This proves the stated strictness condition\. ∎

Theorem[1](https://arxiv.org/html/2607.23134#Thmtheorem1)formalizes when diffusion\-guided tilting helps\. Tilting improves failure probability if and only if failures tend to receive higher scores than non\-failures\. The FOSD assumption is purely ranking\-based: it does not require perfect separation or calibration ofSS\(as Proposition[3](https://arxiv.org/html/2607.23134#Thmproposition3)does\)\. Algorithmically, this means that if the surrogate scoreSSorders failing scenarios ahead of non\-failing ones in distribution, exponential tilting is guaranteed to increase the rate at which failures are sampled\.

###### Corollary 1\(Asymptotic concentration under score separation\)\.

In addition to the assumptions underlying Theorem[1](https://arxiv.org/html/2607.23134#Thmtheorem1), suppose additionally that:

1. \(i\)The setℬ\\mathcal\{B\}is bounded from above, i\.e\.,ℬ⊂\[0,∞\)\\mathcal\{B\}\\subset\[0,\\infty\);
2. \(ii\)There exists a strict separation margin, i\.e\.,infz∈FS​\(z\)\>infz∉FS​\(z\)\\inf\_\{z\\in F\}S\\left\(z\\right\)\>\\inf\_\{z\\notin F\}S\\left\(z\\right\)\.

Then

limβ→∞∫Fpβ​\(z\)​𝑑z=1\.\\lim\_\{\\beta\\rightarrow\\infty\}\\int\_\{F\}p\_\{\\beta\}\\left\(z\\right\)dz=1\.Moreover, lettingm:=infz∈FS​\(z\)−infz∉FS​\(z\)\>0m:=\\inf\_\{z\\in F\}S\\left\(z\\right\)\-\\inf\_\{z\\notin F\}S\\left\(z\\right\)\>0:

∫Fpβ​\(z\)​𝑑z≥11\+1−∫Fp∫Fp​e−β​m\.\\int\_\{F\}p\_\{\\beta\}\\left\(z\\right\)dz\\geq\\frac\{1\}\{1\+\\frac\{1\-\\int\_\{F\}p\}\{\\int\_\{F\}p\}e^\{\-\\beta m\}\}\.

Corollary[1](https://arxiv.org/html/2607.23134#Thmcorollary1)characterizes an idealized limit\. If the score perfectly separates failures from non\-failures, tilting eventually samples only failures\. The explicit bound shows how fast concentration occurs as a function of the marginmm, the tilt parameterβ\\beta, and the baseline failure probability∫F\\int\_\{F\}\. Conceptually, the algorithm itself imposes no barrier to failure discovery; only the quality of the scoreSSlimits performance\.

###### Corollary 2\(Strict advantage over conditional proposals\)\.

Letppbe a base joint density on𝒵=𝒳×𝒴\\mathcal\{Z\}=\\mathcal\{X\}\\times\\mathcal\{Y\}\. LetF⊂𝒵F\\subset\\mathcal\{Z\}be a measurable failure set and define the conditional family of proposals:

𝒬cond:=\{q\(x,y\)=r\(x\)p\(y∣x\):rany density on𝒳\},\\mathcal\{Q\}\_\{\\mbox\{\\tiny\{cond\}\}\}:=\\left\\\{q\\left\(x,y\\right\)=r\\left\(x\\right\)p\\left\(y\\mid x\\right\):r\\mbox\{ any density on \}\\mathcal\{X\}\\right\\\},such family is composed of densities that may change the marginal overxxbut keep the sample conditional as the base distribution\. Define the conditional failure rate as:

f​\(x\):=∫𝒴𝟏F​\(x,y\)​p​\(y∣x\)​𝑑y\.f\\left\(x\\right\):=\\int\_\{\\mathcal\{Y\}\}\\boldsymbol\{1\}\_\{F\}\\left\(x,y\\right\)p\\left\(y\\mid x\\right\)dy\.Assume there exists a measurable setB⊂𝒳B\\subset\\mathcal\{X\}such that:

1. \(i\)p​\(B\)\>0p\\left\(B\\right\)\>0, i\.e\., the base distribution places positive mass onBB, and
2. \(ii\)f​\(x\)≤1−ηf\\left\(x\\right\)\\leq 1\-\\etafor allx∈Bx\\in B, for someη\>0\\eta\>0\.

Then the following holds:

1. \(R1\)For everyq∈𝒬condq\\in\\mathcal\{Q\}\_\{\\mbox\{\\tiny\{cond\}\}\}with supp\(r\)⊆B\\left\(r\\right\)\\subseteq B,∫Fq​\(x,y\)​𝑑x​𝑑y≤1−η\.\\int\_\{F\}q\\left\(x,y\\right\)dxdy\\leq 1\-\\eta\.Equivalently, even the best conditional sampler supported onBBcannot make failure probability exceed1−η1\-\\eta\.
2. \(R2\)Suppose there exists a measurable scoreS:𝒵→ℝS:\\mathcal\{Z\}\\rightarrow\\mathbb\{R\}such thatinfz∈FS​\(z\)\>infz∉FS​\(z\),\\inf\_\{z\\in F\}S\\left\(z\\right\)\>\\inf\_\{z\\notin F\}S\\left\(z\\right\),and suppose the exponential tilt is admissible for allβ≥0\\beta\\geq 0\(i\.e\.,Z​\(β\)=∫p​\(z\)​eβ​S​\(z\)​𝑑z<∞Z\\left\(\\beta\\right\)=\\int p\\left\(z\\right\)e^\{\\beta S\\left\(z\\right\)\}dz<\\inftyfor allβ≥0\\beta\\geq 0, the tilted distributionpβ​\(z\)=p​\(z\)​eβ​S​\(z\)Z​\(β\)p\_\{\\beta\}\\left\(z\\right\)=\\frac\{p\\left\(z\\right\)e^\{\\beta S\\left\(z\\right\)\}\}\{Z\\left\(\\beta\\right\)\}satisfies:limβ→∞∫Fpβ​\(z\)​𝑑z=1\.\\lim\_\{\\beta\\rightarrow\\infty\}\\int\_\{F\}p\_\{\\beta\}\\left\(z\\right\)dz=1\.

R1 is the core limitation: if failure is not guaranteed givenxx\(i\.e\.,f​\(x\)<1f\\left\(x\\right\)<1\), then any conditional proposal that keepsp​\(y∣x\)p\\left\(y\\mid x\\right\)fixed cannot force failure probability to11\. Instead, it is capped by the within\-xxfailure rate\. R2 shows the contrasting capability: a joint proposal \(realized by tilting / guided diffusion\) can re\-weight within the fiber over eachxxand concentrate on failing\(x,y\)\\left\(x,y\\right\)pairs\.

###### Proof\.

We prove each result individually\.

\(R1\) Forq​\(x,y\)=r​\(x\)​p​\(y∣x\)q\\left\(x,y\\right\)=r\\left\(x\\right\)p\\left\(y\\mid x\\right\)\(definition of reward and conditional density\):

∫Fq\\displaystyle\\int\_\{F\}q=∫𝒳r​\(x\)​\(∫𝟏F​\(x,y\)​p​\(y∣x\)​𝑑y\)​𝑑x\\displaystyle=\\int\_\{\\mathcal\{X\}\}r\\left\(x\\right\)\\left\(\\int\\boldsymbol\{1\}\_\{F\}\\left\(x,y\\right\)p\\left\(y\\mid x\\right\)dy\\right\)dx=∫r​\(x\)​f​\(x\)​𝑑x\.\\displaystyle=\\int r\\left\(x\\right\)f\\left\(x\\right\)dx\.\(R2\) This is exactly Corollary[1](https://arxiv.org/html/2607.23134#Thmcorollary1)from before \(score separation implies concentration\) applied to the joint space\. ∎

Together, these results show that diffusion\-guided tilting overcomes the multiplicative rarity barrier faced by conditional sampling\. In the next section, we discuss how this viewpoint motivates the design of our guided sampling procedure\.

## IVImplications for Falsification and Verification

The analysis developed in the previous section establishes diffusion\-guided sampling as a form of distributional importance sampling with provable failure amplification properties\. In this section, we interpret exponential tilting as a principled mechanism for counterexample generation, and clarify how it overcomes fundamental limitations of conditional sampling strategies commonly used in simulation\-based testing\.

Our goal is to ground the proposed framework in established verification practice, showing how diffusion\-guided tilting complements existing falsification pipelines by providing distribution\-aware guidance that remains compatible with black\-box simulators, runtime monitors, and deterministic system dynamics\. This perspective positions diffusion\-guided falsification not as a replacement for formal verification techniques, but as a theoretically justified enhancement to simulation\-based counterexample search in complex, high\-dimensional systems\.

To connect this formulation to practical falsification pipelines, it is important to clarify the role of the deterministic simulator\.In many falsification pipelines, the execution traceyyis not generated by a learned model of the dynamics \(such as a diffusion model\), but rather by a simulator\. In this setting, the method generates a scenario specificationx∈𝒳x\\in\\mathcal\{X\}, withx∼q​\(x\)x\\sim q\(x\), and the corresponding system execution is given byy=Φ​\(x\)y=\\Phi\(x\), whereΦ\\Phidenotes the \(possibly deterministic\) system dynamics\. In this case, the failure set can be equivalently defined in the input space as

F=\{x∈𝒳:R​\(x,Φ​\(x\)\)≤0\}\.F=\\left\\\{x\\in\\mathcal\{X\}:R\\left\(x,\\Phi\\left\(x\\right\)\\right\)\\leq 0\\right\\\}\.Thus, failure becomes an event in𝒳\\mathcal\{X\}, and the rarity is now:

p​\(F\)=ℙX∼q​\(X∈F\),p\\left\(F\\right\)=\\mathbb\{P\}\_\{X\\sim q\}\\left\(X\\in F\\right\),with an associated sample complexityΘ​\(1/p​\(F\)\)\\Theta\\left\(1/p\\left\(F\\right\)\\right\)regardless of whether the simulator is deterministic or stochastic\. Given these considerations, we can interpret the role of joint modeling through the following remark\.

We now adapt the key result from Theorem[1](https://arxiv.org/html/2607.23134#Thmtheorem1)to the case where the physical system is deterministic \(unique rollout\), while the diffusion model may still be stochastic as a generator\. We start by assuming that there existsa measurable function \(simulator/dynamics\)Φ:𝒳→𝒴,y=Φ​\(x\),\\Phi:\\mathcal\{X\}\\rightarrow\\mathcal\{Y\},\\;y=\\Phi\\left\(x\\right\),and define the failure set in input space as

FX:=\{x∈𝒳:\(x,Φ​\(x\)\)∈F\}=\{x:R​\(x,Φ​\(x\)\)≤0\}\.\\displaystyle F\_\{X\}:=\\left\\\{x\\in\\mathcal\{X\}:\\left\(x,\\Phi\\left\(x\\right\)\\right\)\\in F\\right\\\}=\\left\\\{x:R\\left\(x,\\Phi\\left\(x\\right\)\\right\)\\leq 0\\right\\\}\.
###### Proposition 4\(Joint tilting reduces to input\-space tilting on the dynamics manifold\)\.

Assume the base joint distribution is supported on \(or concentrates on\) the dynamics manifoldℳ:=\{\(x,y\):y=Φ​\(x\)\}\\mathcal\{M\}:=\\left\\\{\\left\(x,y\\right\):y=\\Phi\\left\(x\\right\)\\right\\\}\. Then the joint density can be rewritten as:

p​\(x,y\)=pX​δ​\(y−Φ​\(x\)\),p\\left\(x,y\\right\)=p\_\{X\}\\delta\\left\(y\-\\Phi\\left\(x\\right\)\\right\),wherepXp\_\{X\}is the induced marginal over inputs\.

Define the joint tilt with scoreS​\(x,y\)S\\left\(x,y\\right\), and the tilted density

pβ​\(x,y\)∝p​\(x,y\)​eβ​S​\(x,y\)\.p\_\{\\beta\}\\left\(x,y\\right\)\\propto p\\left\(x,y\\right\)e^\{\\beta S\\left\(x,y\\right\)\}\.\(15\)Then, the induced marginal over inputs under the tilted joint satisfies:

pβ,X​\(x\):=∫𝒴pβ​\(x,y\)​𝑑y∝pX​\(x\)​exp⁡\(β​S​\(x,Φ​\(x\)\)\)\.p\_\{\\beta,X\}\\left\(x\\right\):=\\int\_\{\\mathcal\{Y\}\}p\_\{\\beta\}\\left\(x,y\\right\)dy\\propto p\_\{X\}\\left\(x\\right\)\\exp\\left\(\\beta S\\left\(x,\\Phi\\left\(x\\right\)\\right\)\\right\)\.

###### Proof\.

See Appendix[VIII\-C](https://arxiv.org/html/2607.23134#S8.SS3)\. ∎

In the deterministic case, the “joint” method reduces to an importance sampler over inputs where the weights are evaluated along the realized trajectoryy=Φ​\(x\)y=\\Phi\\left\(x\\right\)\. In other words, the proposed mechanism composed of the joint diffusion and tilting provides a principled way to learn a proposal overxxthat respects feasibility \(y=Φ​\(x\)y=\\Phi\\left\(x\\right\)\) automatically\.

###### Corollary 3\(Deterministic comparison: diffusion\-guided tilting vs input\-only search\)\.

LetFX=\{x:R​\(x,Φ​\(x\)\)≤0\}F\_\{X\}=\\left\\\{x:R\\left\(x,\\Phi\\left\(x\\right\)\\right\)\\leq 0\\right\\\}and suppose there exists an input scoreT​\(x\):=S​\(x,Φ​\(x\)\)T\\left\(x\\right\):=S\\left\(x,\\Phi\\left\(x\\right\)\\right\)that separates failures and non\-failures in input space:

infx∈FXT​\(x\)\>supx∉FXT​\(x\),\\inf\_\{x\\in F\_\{X\}\}T\\left\(x\\right\)\>\\sup\_\{x\\notin F\_\{X\}\}T\\left\(x\\right\),and the input space partition function is finite for allβ≥0\\beta\\geq 0:

ZX​\(β\):=∫pX​\(x\)​eβ​T​\(x\)​𝑑x<∞\.Z\_\{X\}\\left\(\\beta\\right\):=\\int p\_\{X\}\\left\(x\\right\)e^\{\\beta T\\left\(x\\right\)\}dx<\\infty\.Define the tilted input proposalpβ,X​\(x\)=pX​\(x\)​eβ​T​\(x\)ZX​\(β\)\.p\_\{\\beta,X\}\\left\(x\\right\)=\\frac\{p\_\{X\}\\left\(x\\right\)e^\{\\beta T\\left\(x\\right\)\}\}\{Z\_\{X\}\\left\(\\beta\\right\)\}\.Then the tilted input distribution satisfies:limβ→∞∫FXpβ,X​\(x\)​𝑑x=1\\lim\_\{\\beta\\rightarrow\\infty\}\\int\_\{F\_\{X\}\}p\_\{\\beta,X\}\\left\(x\\right\)dx=1\.

Hence, even when the underlying system is deterministic, tilting yields an optimal “distributional” way to push probability mass onto failing inputs \(subject to staying close topXp\_\{X\}, i\.e\., realism\)\. This is the deterministic analogue of failure concentration in joint space\.

Proposition[4](https://arxiv.org/html/2607.23134#Thmproposition4)and Corollary[3](https://arxiv.org/html/2607.23134#Thmcorollary3)show that under deterministic dynamics, joint and input\-space tilting target the same distribution\. They still differ in how the prior is learned, how the search is guided, and how validity is ensured, and each favors the joint model\. First, fitting the jointpθ​\(x,y\)p\_\{\\theta\}\(x,y\)to inputs and traces together lets the traces constrain the input marginalpθ​\(x\)p\_\{\\theta\}\(x\), reducing its epistemic uncertainty\. Second, the search is guided without involving the simulator\. For an input\-space score, the gradient with respect to the input must be propagated throughΦ\\Phiand is unavailable whenΦ\\Phiis a black box, whereas the joint model exposes it directly in joint space from its own predicted trace\. This joint\-space gradient is approximate, but it never differentiates throughΦ\\Phi\. Third, validity holds regardless of model accuracy\. Only the candidate inputxxis sent to the simulator, which returns the true executionΦ​\(x\)\\Phi\(x\), so every counterexample is valid by construction even if the predicted tracey^\\hat\{y\}is wrong\. Their gap measures the model’s error on that sample and can refinepθp\_\{\\theta\}online \(Section[VII](https://arxiv.org/html/2607.23134#S7)\)\.

*Illustrative Example\.*To illustrate the deterministic interpretation, consider a low\-dimensional setting with a nonlinear mapy=Φ​\(x\)y=\\Phi\(x\)forx,y∈ℝ2x,y\\in\\mathbb\{R\}^\{2\}\. We define the robustness as the Himmelblau’s function and define the score asS​\(x,y\)=−R​\(y\)S\(x,y\)=\-R\(y\), inducing the input\-space scoreS​\(Φ​\(x\)\)S\(\\Phi\(x\)\)\.

Fig\.[1](https://arxiv.org/html/2607.23134#S4.F1)shows the mapx↦y=Φ​\(x\)x\\mapsto y=\\Phi\(x\)together with the induced robustness landscapeR​\(Φ​\(x\)\)R\(\\Phi\(x\)\)over the input space, which defines the failure\-relevant regions\. Fig\.[2](https://arxiv.org/html/2607.23134#S4.F2)illustrates the effect of exponential tilting for increasingβ\\beta\. Asβ\\betaincreases, probability mass is progressively reallocated toward high\-score \(failure\-prone\) regions, leading to concentration near failures, consistent with Corollary[3](https://arxiv.org/html/2607.23134#Thmcorollary3)\.

![Refer to caption](https://arxiv.org/html/2607.23134v1/x1.png)\(a\)Nonlinear mapx↦y=Φ​\(x\)x\\mapsto y=\\Phi\(x\)\.
![Refer to caption](https://arxiv.org/html/2607.23134v1/x2.png)\(b\)Induced robustnessR​\(Φ​\(x\)\)R\(\\Phi\(x\)\)in input space\.

Figure 1:Deterministic embedding and induced score landscape\. Left: nonlinear mapx↦y=Φ​\(x\)x\\mapsto y=\\Phi\(x\)\. Right: robustness evaluated on outputs, visualized over the input space asR​\(Φ​\(x\)\)R\(\\Phi\(x\)\)\.![Refer to caption](https://arxiv.org/html/2607.23134v1/x3.png)\(a\)β=0\\beta=0
![Refer to caption](https://arxiv.org/html/2607.23134v1/x4.png)\(b\)β=2\\beta=2
![Refer to caption](https://arxiv.org/html/2607.23134v1/x5.png)\(c\)β=10\\beta=10
![Refer to caption](https://arxiv.org/html/2607.23134v1/x6.png)\(d\)β=0\\beta=0
![Refer to caption](https://arxiv.org/html/2607.23134v1/x7.png)\(e\)β=2\\beta=2
![Refer to caption](https://arxiv.org/html/2607.23134v1/x8.png)\(f\)β=10\\beta=10

Figure 2:Effect of exponential tilting on the input distribution\. Top row: reweighted densities proportional topθ​\(x\)​exp⁡\(β​S​\(x\)\)p\_\{\\theta\}\(x\)\\exp\(\\beta S\(x\)\)\. Bottom row: samples obtained by importance sampling from the weighted distribution\.
## VAlgorithmic Details

Fig\.[3](https://arxiv.org/html/2607.23134#S5.F3)provides an overview of theDiffTiltpipeline\.DiffTiltoperates in two phases\. In the offline phase, a diffusion model learns the joint priorpθ​\(x,y\)p\_\{\\theta\}\(x,y\)over plausible input trajectory pairs\(x,y\)\(x,y\), which is then frozen and reused across objectives without retraining\. In the online phase, at each iterationkk, candidates are drawn from the tilted densitypk​\(z\)∝pθ​\(x,y\)​exp⁡\(βk​Sk​\(x,y\)\)p\_\{k\}\(z\)\\propto p\_\{\\theta\}\(x,y\)\\exp\(\\beta\_\{k\}S\_\{k\}\(x,y\)\)via gradient\-guided reverse diffusion, where∇Sk\\nabla S\_\{k\}biases each denoising step toward higher\-score regions of the joint space\. Only the selected candidate is then executed through the black\-box simulator to evaluate the trueRR, with the observation used to refineSkS\_\{k\}if falsification is not achieved\.We next describe each stage of the pipeline and then state the complete procedure in Algorithm[1](https://arxiv.org/html/2607.23134#algorithm1)\.

![Refer to caption](https://arxiv.org/html/2607.23134v1/emsoft-2026/images/Architecture_v4.png)Figure 3:DiffTiltsystem architecture\.Offline, a joint diffusion priorpθ​\(x,y\)p\_\{\\theta\}\(x,y\)is trained once on randomly sampled\(x,y\)\(x,y\)pairs and frozen\.Online, tilted reverse diffusion guided by∇Sk\\nabla S\_\{k\}proposes candidates; the black\-box simulator returnsR​\(x,y\)R\(x,y\), which tests the failure conditionR​\(x,y\)≤0R\(x,y\)\\\!\\leq\\\!0and refines the surrogateSkS\_\{k\}\.Red\(⋆\\star\) steps invoke the true system or train the prior \(expensive\) ;bluesteps run entirely within the learned model \(cheap\); grey denotes data; green denotes the falsifying output\.#### Joint Diffusion

The joint priorpθ​\(z\)p\_\{\\theta\}\(z\)is trained using DDPM\[[10](https://arxiv.org/html/2607.23134#bib.bib7)\]on paired samples\(x0,y0\)\(x\_\{0\},y\_\{0\}\), withz=\(x,y\)z=\(x,y\), using a coupled architecture adapted from JointNet\[[16](https://arxiv.org/html/2607.23134#bib.bib19)\]\. Two interacting branches, one forxxand one foryy, each predict their corresponding noise component while conditioning on the other, capturing dependencies between inputs and trajectories\. Given paired samples\(x0,y0\)\(x\_\{0\},y\_\{0\}\), we train with a joint denoising objective

𝔼​\[‖ϵx−ϵ^x​\(xt,yt,t\)‖22\+‖ϵy−ϵ^y​\(yt,xt,t\)‖22\],\\mathbb\{E\}\\\!\\left\[\\\|\\epsilon\_\{x\}\-\\hat\{\\epsilon\}\_\{x\}\(x\_\{t\},y\_\{t\},t\)\\\|\_\{2\}^\{2\}\+\\\|\\epsilon\_\{y\}\-\\hat\{\\epsilon\}\_\{y\}\(y\_\{t\},x\_\{t\},t\)\\\|\_\{2\}^\{2\}\\right\],where\(xt,yt\)\(x\_\{t\},y\_\{t\}\)are obtained via the forward diffusion process\. To improve learning stability, the input branch is first pretrained, followed by joint training with cross\-conditioning, and finally end\-to\-end fine\-tuning of the full model\.

#### Base Sampling

Sampling from the learned joint priorpθ​\(x,y\)p\_\{\\theta\}\(x,y\)follows the standard DDPM reverse process\[[10](https://arxiv.org/html/2607.23134#bib.bib7)\]\. Starting fromzT∼𝒩​\(0,I\)z\_\{T\}\\sim\\mathcal\{N\}\(0,I\), samples are generated via

zt−1=μθ​\(zt,t\)\+σt​η,η∼𝒩​\(0,I\),\\displaystyle z\_\{t\-1\}=\\mu\_\{\\theta\}\(z\_\{t\},t\)\+\\sigma\_\{t\}\\eta,\\quad\\eta\\sim\\mathcal\{N\}\(0,I\),\(16\)whereμθ​\(zt,t\)\\mu\_\{\\theta\}\(z\_\{t\},t\)is defined in Eq\. \([2](https://arxiv.org/html/2607.23134#S2.E2)\)\. This defines the unguided sampler used to initialize the dataset withBBsamples \(Algorithm[1](https://arxiv.org/html/2607.23134#algorithm1), Lines[1](https://arxiv.org/html/2607.23134#algorithm1)–[1](https://arxiv.org/html/2607.23134#algorithm1)\)\.

#### Scoring Function

The surrogateSk:𝒳×𝒴→ℝS\_\{k\}:\\mathcal\{X\}\\times\\mathcal\{Y\}\\rightarrow\\mathbb\{R\}is a neural network trained on the accumulated datasetℋ\\mathcal\{H\}to approximate−R​\(x,y\)\-R\(x,y\), normalized against the empirical standard deviation of robustness values inℋ\\mathcal\{H\}to stabilize gradient magnitudes across iterations\. Consistent with the joint formulation in Section[III](https://arxiv.org/html/2607.23134#S3), the surrogate takes the full pair\(x,y\)\(x,y\)as input, capturing dependencies between the scenario and the induced trace\.

#### Gradient\-Guided Sampling

For a differentiable surrogate, the log\-gradient of the tilted target decomposes as

∇zlog⁡pk​\(z\)=∇zlog⁡pθ​\(z\)⏟prior score\+βk​∇zSk​\(z\)⏟surrogate guidance,\\nabla\_\{z\}\\log p\_\{k\}\(z\)=\\underbrace\{\\nabla\_\{z\}\\log p\_\{\\theta\}\(z\)\}\_\{\\text\{prior score\}\}\+\\;\\beta\_\{k\}\\,\\underbrace\{\\nabla\_\{z\}S\_\{k\}\(z\)\}\_\{\\text\{surrogate guidance\}\},\(17\)where the diffusion model provides implicit access to∇zlog⁡pθ​\(⋅\)\\nabla\_\{z\}\\log p\_\{\\theta\}\(\\cdot\)via Eq\. \([6](https://arxiv.org/html/2607.23134#S2.E6)\), and the surrogate provides∇zSk​\(⋅\)\\nabla\_\{z\}S\_\{k\}\(\\cdot\)\. SinceSkS\_\{k\}is defined on clean samples, guidance is applied at each reverse stepttby first computing the Tweedie denoised estimate

z^0​\(zt,t\)=1α¯t​\(zt−1−α¯t​εθ​\(zt,t\)\),\\hat\{z\}\_\{0\}\(z\_\{t\},t\)=\\frac\{1\}\{\\sqrt\{\\bar\{\\alpha\}\_\{t\}\}\}\\\!\\left\(z\_\{t\}\-\\sqrt\{1\-\\bar\{\\alpha\}\_\{t\}\}\\,\\varepsilon\_\{\\theta\}\(z\_\{t\},t\)\\right\),and modifying the reverse mean asμ\(k\)​\(zt,t\)=μθ​\(zt,t\)\+γt​βk​∇zSk​\(z^0​\(zt,t\)\)\\mu^\{\(k\)\}\(z\_\{t\},t\)=\\mu\_\{\\theta\}\(z\_\{t\},t\)\+\\gamma\_\{t\}\\beta\_\{k\}\\,\\nabla\_\{z\}S\_\{k\}\(\\hat\{z\}\_\{0\}\(z\_\{t\},t\)\), withβk\\beta\_\{k\}andSkS\_\{k\}fixed across allttwithin iterationkk\. Expressed in the noise\-prediction parameterisation:

ε\(k\)​\(zt,t\)=εθ​\(zt,t\)−αt​1−α¯t1−αt​γt​βk​∇zSk​\(z^0​\(zt,t\)\)\.\\displaystyle\\varepsilon^\{\(k\)\}\(z\_\{t\},t\)=\\varepsilon\_\{\\theta\}\(z\_\{t\},t\)\-\\frac\{\\sqrt\{\\alpha\_\{t\}\}\\sqrt\{1\-\\bar\{\\alpha\}\_\{t\}\}\}\{1\-\\alpha\_\{t\}\}\\,\\gamma\_\{t\}\\beta\_\{k\}\\,\\nabla\_\{z\}S\_\{k\}\\\!\\left\(\\hat\{z\}\_\{0\}\(z\_\{t\},t\)\\right\)\.\(18\)The guided reverse step is then

zt−1=μ\(k\)​\(zt,t\)\+σt​η,η∼𝒩​\(0,I\),z\_\{t\-1\}=\\mu^\{\(k\)\}\(z\_\{t\},t\)\+\\sigma\_\{t\}\\eta,\\quad\\eta\\sim\\mathcal\{N\}\(0,I\),\(19\)keeping the diffusion variance unchanged\. FromMMindependent noise samples this producesMMcandidate scenarios\.

#### Selection and Evaluation

Guided diffusion producesMMcandidate scenarios reweighted aspi∝exp⁡\(βk​Sk,θ​\(xi,yi\)\)p\_\{i\}\\propto\\exp\(\\beta\_\{k\}S\_\{k,\\theta\}\(x\_\{i\},y\_\{i\}\)\)\. A candidate is sampled, simulated usingΦ​\(x\)\\Phi\(x\), and evaluated \(Algorithm[1](https://arxiv.org/html/2607.23134#algorithm1), Lines[1](https://arxiv.org/html/2607.23134#algorithm1)–[1](https://arxiv.org/html/2607.23134#algorithm1)\), with the resulting data used to update the surrogate\. This process repeats until falsification or budget exhaustion\.

Input:Learned priorpθ​\(x,y\)p\_\{\\theta\}\(x,y\), robustnessR​\(x,y\)R\(x,y\), batch sizeBB, candidatesMM, simulation budget, diffusion stepsTT, guidance weight\{βk\}\\\{\\beta\_\{k\}\\\}

Initialize dataset

ℋ←∅\\mathcal\{H\}\\leftarrow\\emptyset;

for*iterationk=1,2,…k=1,2,\\dots*do

if*k=1k=1*then

for*i=1,…,Bi=1,\\dots,B*do

Sample

\(xi,yi\)∼pθ​\(x,y\)\(x\_\{i\},y\_\{i\}\)\\sim p\_\{\\theta\}\(x,y\);

Compute robustness

Ri←R​\(xi,yi\)R\_\{i\}\\leftarrow R\(x\_\{i\},y\_\{i\}\);

Add

\(\(xi,yi\),−Ri\)\(\(x\_\{i\},y\_\{i\}\),\-R\_\{i\}\)to dataset

ℋ\\mathcal\{H\};

if*Ri<0R\_\{i\}<0*then

return

\(xi,yi\)\(x\_\{i\},y\_\{i\}\);

Train surrogate model

Sk,θS\_\{k,\\theta\}on

ℋ\\mathcal\{H\};

if*simulation budget exhausted*then

break;

for*i=1,…,Mi=1,\\dots,M*do

zT∼𝒩​\(0,I\)z\_\{T\}\\sim\\mathcal\{N\}\(0,I\);

for*t=T,…,1t=T,\\dots,1*do

Compute guided noise prediction by Eq\. \([18](https://arxiv.org/html/2607.23134#S5.E18)\);

Apply the guided DDPM reverse update using Eq\. \([16](https://arxiv.org/html/2607.23134#S5.E16)\);

Obtain candidate

\(xi,yi\)\(x\_\{i\},y\_\{i\}\)from

z0z\_\{0\};

Define selection distribution

pi∝exp⁡\(βk​Sk,θ​\(xi,yi\)\)p\_\{i\}\\propto\\exp\(\\beta\_\{k\}S\_\{k,\\theta\}\(x\_\{i\},y\_\{i\}\)\);

Sample scenario index

i^∼pi\\hat\{i\}\\sim p\_\{i\}and simulate

Φ​\(xi^\)\\Phi\(x\_\{\\hat\{i\}\}\);

Compute robustness

R​\(xi^,Φ​\(xi^\)\)R\(x\_\{\\hat\{i\}\},\\Phi\(x\_\{\\hat\{i\}\}\)\);

if*R​\(xi^,Φ​\(xi^\)\)<0R\(x\_\{\\hat\{i\}\},\\Phi\(x\_\{\\hat\{i\}\}\)\)<0*then

return

\(xi^,Φ​\(xi^\)\)\(x\_\{\\hat\{i\}\},\\Phi\(x\_\{\\hat\{i\}\}\)\);

Add

\(\(xi^,yi^\),−R​\(xi^,yi^\)\)\\big\(\(x\_\{\\hat\{i\}\},y\_\{\\hat\{i\}\}\),\-R\(x\_\{\\hat\{i\}\},y\_\{\\hat\{i\}\}\)\\big\)to

ℋ\\mathcal\{H\};

Retrain surrogate model

Sk\+1,θS\_\{k\+1,\\theta\}on updated

ℋ\\mathcal\{H\};

returnNo falsification found within simulation budget;

Algorithm 1DiffTilt

## VINumerical Results

This section evaluates the proposedDiffTiltframework in the context of falsification\. We describe the benchmark systems and evaluation protocol, and compare against a state\-of\-the\-art falsification method, FReaK\[[1](https://arxiv.org/html/2607.23134#bib.bib21)\], across multiple specifications per system\.

### VI\-ABenchmark Algorithm and Systems

We introduce the baseline method and benchmarks, followed by the experimental procedure and scoring definitions\.

#### Baseline

FReaK\[[1](https://arxiv.org/html/2607.23134#bib.bib21)\]is a falsification method based on Koopman operator linearization, which lifts nonlinear dynamics into a higher\-dimensional space where they evolve linearly\. It constructs a data\-driven surrogate model and searches for inputs that maximize the robustness of the negated STL specification using a weighted robustness encoding, reducing the optimization to a linear program\. The weights are iteratively refined based on critical points identified through simulations of the true system\. FReaK consistently achieves high falsification rates with low simulation budgets across ARCH\-COMP benchmarks\[[1](https://arxiv.org/html/2607.23134#bib.bib21),[11](https://arxiv.org/html/2607.23134#bib.bib20)\]\. While other approaches exist, no single method uniformly dominates across all problems\[[11](https://arxiv.org/html/2607.23134#bib.bib20)\]\. Thus, comparing against FReaK provides a meaningful and rigorous evaluation of our approach\.

#### Benchmark Systems

We consider the Automatic Transmission \(AT\) and Chasing Cars \(CC\) benchmarks from ARCH\-COMP\[[11](https://arxiv.org/html/2607.23134#bib.bib20)\], along with a tractor\-trailer \(TT2D\) scenario\[[12](https://arxiv.org/html/2607.23134#bib.bib22)\], additionally introduced here as a falsification benchmark with instances of varying difficulty\. We compare against FReaK under a fixed simulation budget and briefly summarize each benchmark next\.

Automatic Transmission \(AT\)The AT system is a deterministic hybrid system modeling an automatic transmission controller with both continuous and discrete dynamics\[[11](https://arxiv.org/html/2607.23134#bib.bib20)\]\. The system has two input time\-varying signals: throttleut∈\[0,100\]u\_\{t\}\\in\[0,100\]\[%\] and brakeub∈\[0,325\]u\_\{b\}\\in\[0,325\]\[ft\-lb\]\. Given an input trajectory, the system produces output trajectories consisting of vehicle speedvv\[mph\], engine speedω\\omega\[RPM\], and gear indicatorsg1,…,g4g\_\{1\},\\dots,g\_\{4\}\. The simulation horizon is5050\[s\] with a sampling interval of0\.010\.01\[s\]\. The STL specifications are listed in Table[II](https://arxiv.org/html/2607.23134#S6.T2)\.AT has multiple STL specifications over fixed system dynamics, allowing us to evaluate the generalization capability of a single learned prior across diverse specifications without retraining\. Additionally, specifications likeA​T​5​gAT5g\(Table[II](https://arxiv.org/html/2607.23134#S6.T2)\) also allows us to test the method under discrete dynamics, where gradient\-based guidance is predicted to be ineffective due to flat robustness surfaces\.

Chasing Cars \(CC\)The CC is a dynamical system modeling a platoon of five vehicles\[[11](https://arxiv.org/html/2607.23134#bib.bib20)\]\. It has two input signals, throttleut∈\[0,1\]u\_\{t\}\\in\[0,1\]and brakeub∈\[0,1\]u\_\{b\}\\in\[0,1\], applied to the lead vehicle\. The remaining vehicles follow a fixed control law based on the state of the preceding vehicle\. Given an input trajectory, the system produces output trajectories consisting of the longitudinal positionsy1,…,y5y\_\{1\},\\dots,y\_\{5\}of the five vehicles\. The simulation horizon is100100\[s\] with a sampling interval of0\.050\.05\[s\]\. The STL specifications are listed in Table[II](https://arxiv.org/html/2607.23134#S6.T2)\.CC also aids in testing the reusability of a single learned prior across long\-horizon and nested specifications without retraining\.

TABLE II:STL specifications with informal descriptions for the Automatic Transmission \(AT\), Chasing Cars \(CC\), and Tractor\-Trailer \(TT2D\) benchmarks\.□\\Boxdenotes “always”,◇\\Diamonddenotes “eventually”, and∘ϕ\\circ\\phidenotes◇\[0\.001,0\.1\]​ϕ\\Diamond\_\{\[0\.001,0\.1\]\}\\phi\.KeySTL FormulaInformal DescriptionAT1□\[0,20\]​v<120\\Box\_\{\[0,20\]\}v<120Speed remains below 120 mph for the first 20 seconds\.AT2□\[0,10\]​ω<4750\\Box\_\{\[0,10\]\}\\omega<4750Engine RPM remains below 4750 for the first 10 seconds\.AT5gg□\[0,30\]\(\(¬g∧∘g\)→∘□\[0,2\.5\]g\)\\Box\_\{\[0,30\]\}\\big\(\(\\lnot g\\land\\circ g\)\\rightarrow\\circ\\Box\_\{\[0,2\.5\]\}g\\big\)Whenever gearg∈\{1,2,3,4\}g\\in\\\{1,2,3,4\\\}is engaged, it remains engaged for at least 2\.5 seconds\.AT6a\(□\[0,30\]​ω<3000\)→\(□\[0,4\]​v<35\)\(\\Box\_\{\[0,30\]\}\\omega<3000\)\\to\(\\Box\_\{\[0,4\]\}v<35\)If RPM stays below 3000 over the horizon, then speed stays below 35 mph for 4 seconds\.AT6b\(□\[0,30\]​ω<3000\)→\(□\[0,8\]​v<50\)\(\\Box\_\{\[0,30\]\}\\omega<3000\)\\to\(\\Box\_\{\[0,8\]\}v<50\)If RPM stays below 3000 over the horizon, then speed stays below 50 mph for 8 seconds\.AT6c\(□\[0,30\]​ω<3000\)→\(□\[0,20\]​v<65\)\(\\Box\_\{\[0,30\]\}\\omega<3000\)\\to\(\\Box\_\{\[0,20\]\}v<65\)If RPM stays below 3000 over the horizon, then speed stays below 65 mph for 20 seconds\.AT6abcAT6a∧\\landAT6b∧\\landAT6cAll three conditional speed constraints must hold simultaneously\.CC1□\[0,100\]​\(y5−y4≤40\)\\Box\_\{\[0,100\]\}\(y\_\{5\}\-y\_\{4\}\\leq 40\)The distance between car 5 and car 4 is always at most 40 units\.CC2□\[0,70\]​◇\[0,30\]​\(y5−y4≥15\)\\Box\_\{\[0,70\]\}\\Diamond\_\{\[0,30\]\}\(y\_\{5\}\-y\_\{4\}\\geq 15\)At all times up to 70 s, within the next 30 s the distance becomes at least 15\.CC3□\[0,80\]​\(\(□\[0,20\]​\(y2−y1≤20\)\)∨\(◇\[0,20\]​\(y5−y4≥40\)\)\)\\Box\_\{\[0,80\]\}\(\(\\Box\_\{\[0,20\]\}\(y\_\{2\}\-y\_\{1\}\\leq 20\)\)\\lor\(\\Diamond\_\{\[0,20\]\}\(y\_\{5\}\-y\_\{4\}\\geq 40\)\)\)At all times, either cars 1–2 stay within 20 units for 20 s, or cars 4–5 become separated by at least 40 within 20 s\.CC4□\[0,65\]​◇\[0,30\]​□\[0,5\]​\(y5−y4≥8\)\\Box\_\{\[0,65\]\}\\Diamond\_\{\[0,30\]\}\\Box\_\{\[0,5\]\}\(y\_\{5\}\-y\_\{4\}\\geq 8\)At all times, within 30 s there exists a 5 s interval where the distance stays above 8\.CC5□\[0,72\]​◇\[0,8\]​\(\(□\[0,5\]​\(y2−y1≥9\)\)→\(□\[5,20\]​\(y5−y4≥9\)\)\)\\Box\_\{\[0,72\]\}\\Diamond\_\{\[0,8\]\}\(\(\\Box\_\{\[0,5\]\}\(y\_\{2\}\-y\_\{1\}\\geq 9\)\)\\to\(\\Box\_\{\[5,20\]\}\(y\_\{5\}\-y\_\{4\}\\geq 9\)\)\)At all times, within 8 s: if cars 1–2 stay at least 9 apart for 5 s, then cars 4–5 must stay at least 9 apart during the following 5–20 s\.CCx⋀i=14□\[0,50\]​\(yi\+1−yi\>7\.5\)\\bigwedge\_\{i=1\}^\{4\}\\Box\_\{\[0,50\]\}\(y\_\{i\+1\}\-y\_\{i\}\>7\.5\)All adjacent cars maintain a separation greater than 7\.5 units at all times\.TT2D¬◇\[0,T\]​\(‖\(x,y\)−\(xg,yg\)‖2≤ϵp∧\|θ1−θ1g\|≤ϵθ∧\|θ2−θ2g\|≤ϵθ\)\\neg\\Diamond\_\{\[0,T\]\}\\bigl\(\\\|\(x,y\)\-\(x^\{g\},y^\{g\}\)\\\|\_\{2\}\\leq\\epsilon\_\{p\}\\land\|\\theta\_\{1\}\-\\theta\_\{1\}^\{g\}\|\\leq\\epsilon\_\{\\theta\}\\land\|\\theta\_\{2\}\-\\theta\_\{2\}^\{g\}\|\\leq\\epsilon\_\{\\theta\}\\bigr\)The system never reaches the goal region within the horizon \(i\.e\., position and orientations do not satisfy tolerance bounds simultaneously\)\.Tractor\-Trailer \(TT2D:\)The TT2D system is a deterministic nonlinear model of a tractor–trailer operating in a bounded 2D environment with obstacles\. We adopt the model from\[[12](https://arxiv.org/html/2607.23134#bib.bib22)\]and reformulate it as a falsification problem\.The system has two control inputs: longitudinal velocityv∈\[−3,3\]v\\in\[\-3,3\]\[m/s\] and steering angleδ∈\[−0\.95,0\.95\]\\delta\\in\[\-0\.95,0\.95\]\[rad\]\. Given an input trajectory, the system produces state trajectories consisting of position\(x,y\)\(x,y\), tractor headingθ1\\theta\_\{1\}, and trailer headingθ2\\theta\_\{2\}, within spatial limitsX,Y∈\(−32,32\)X,Y\\in\(\-32,32\)\[m\]\.

The objective is to generate a feasible trajectory from an initial stateSs=\[xs,ys,θ1s,θ2s\]S^\{s\}=\[x^\{s\},y^\{s\},\\theta\_\{1\}^\{s\},\\theta\_\{2\}^\{s\}\]to a goal stateSg=\[xg,yg,θ1g,θ2g\]S^\{g\}=\[x^\{g\},y^\{g\},\\theta\_\{1\}^\{g\},\\theta\_\{2\}^\{g\}\]within a horizon of500500\[s\] sampled at time interval0\.250\.25\[s\]\. Feasibility, including collision avoidance and control constraints, is enforced via projection, restricting the search to admissible trajectories\. The goal region is defined by position and orientation tolerances:‖\(x,y\)−\(xg,yg\)‖2≤ϵp\\\|\(x,y\)\-\(x^\{g\},y^\{g\}\)\\\|\_\{2\}\\leq\\epsilon\_\{p\},\|θ1−θ1g\|≤ϵθ\|\\theta\_\{1\}\-\\theta\_\{1\}^\{g\}\|\\leq\\epsilon\_\{\\theta\}, and\|θ2−θ2g\|≤ϵθ\|\\theta\_\{2\}\-\\theta\_\{2\}^\{g\}\|\\leq\\epsilon\_\{\\theta\}, with angles wrapped to\[−π,π\]\[\-\\pi,\\pi\]\. Smaller tolerances correspond to harder instances\.

For TT2D, unlike AT and CC,DiffTiltdefines a trajectory\-level objectiveR​\(x,y\)=−\(lT​\(yT\)\+∑t=0Tlt​\(yt,xt\)\),R\(x,y\)=\-\\left\(l\_\{T\}\(y\_\{T\}\)\+\\sum\_\{t=0\}^\{T\}l\_\{t\}\(y\_\{t\},x\_\{t\}\)\\right\),wherelTl\_\{T\}penalizes deviation from the goal andltl\_\{t\}accumulates stage costs over the horizon\. This highlights a limitation of the current FReaK framework: it cannot directly represent such trajectory\-level objectives, as it requires STL\-based formulations\[[1](https://arxiv.org/html/2607.23134#bib.bib21)\]\. Therefore, we approximate it using the negation of goal reachability defined over the goal region \(Table[II](https://arxiv.org/html/2607.23134#S6.T2)\)\.For consistency, all trajectories generated byDiffTiltare evaluated against the same TT2D STL specification as FReaK, so both methods are compared on identical criteria, with the trajectory\-level cost serving only as the guidance signal withinDiffTilt\.

We consider six scenarios: \(S1\)no obstacles \(easy\)with relaxed tolerances\(ϵp,ϵθ\)=\(1\.25,0\.5\)\(\\epsilon\_\{p\},\\epsilon\_\{\\theta\}\)=\(1\.25,0\.5\), \(S2\)no obstacles \(hard\)with tighter tolerances\(0\.2,0\.2\)\(0\.2,0\.2\), \(S3\)one obstacle: a single rectangular obstacle placed between the start and goal regions, \(S4\)wide parking: a constrained parking configuration with boundaries on the sides and one end, \(S5\)narrow parking: a parking configuration similar to S4 but with reduced available space, \(S6\)random obstacles: multiple small obstacles randomly distributed in the environment\.TT2D additionally tests whetherDiffTiltcan exploit a richer guidance signal than the STL specification alone\.

#### Experimental Procedure

For AT and CC, we follow the ARCH\-COMP evaluation protocol\[[11](https://arxiv.org/html/2607.23134#bib.bib20)\], reporting simulations required for falsification within a budget ofB\+30B\+30, with initial batch sizesB∈\{4,8,16\}B\\in\\\{4,8,16\\\}; FReaK results are taken from\[[11](https://arxiv.org/html/2607.23134#bib.bib20)\]\. For TT2D, both methods start from identical initial states with a budget ofB\+200B\+200\(B=16B=16\)\. All results are averaged over 10 independent runs\.

Allinput signals are normalized to\[−1,1\]\[\-1,1\]before training and sampling, and denormalized to their physical range before simulation\. From the generated pairz0=\(x,y\)z\_\{0\}=\(x,y\), onlyxxis passed to the simulator\. For AT and CC,R​\(x,y\)R\(x,y\)is the STL robustness of the specification under test\. For TT2D,R​\(x,y\)R\(x,y\)is a trajectory\-level goal\-reaching cost, with falsification confirmed against the TT2D STL specification, so both methods are evaluated on identical criteria\. Robustness targets are standardized against the empirical standard deviation of values inℋ\\mathcal\{H\}at each retraining step, stabilizing gradient magnitudes as the dataset grows\.

The tilting strengthβk\\beta\_\{k\}was selected via a coarse pilot search over\{1,10,20,50,100\}\\\{1,10,20,50,100\\\}; values below11had negligible effect and values above100100consistently degraded performance\. The values used areβ=10\\beta=10for TT2D,β=20\\beta=20for AT, andβ=100\\beta=100for CC\. A systematic sensitivity analysis was not conducted, and adaptive tuning ofβ\\betais identified as a future direction\.

### VI\-BResults and Discussion

Inthe offline phase, the joint prior is implemented as two coupled UNet branches111[https://huggingface\.co/docs/diffusers/api/models/unet](https://huggingface.co/docs/diffusers/api/models/unet), one for input signalsxxand one for output trajectoriesyy, connected via zero\-initialized skip adapters following the JointNet architecture\[[16](https://arxiv.org/html/2607.23134#bib.bib19)\]\. The model is trained once for 300 epochs with a DDPM scheduler \(T=1000T=1000\), requiring under 4 hours on a single NVIDIA A100 GPU\. This offline cost is amortized across all downstream specifications, since the same weights are reused without retraining \.

In the online phase,we measure performance according to the falsification rate \(FR\) and mean number of simulations required \(S\), reported in Tables[III](https://arxiv.org/html/2607.23134#S6.T3)and[IV](https://arxiv.org/html/2607.23134#S6.T4)\. In addition to FR and S, we also report the mean runtime \(Tf¯\\bar\{T\_\{f\}\}\) and standard error \(SEf\\text\{SE\}\_\{f\}\) of falsifying runs for TT2D\.

We now present the discussion of the results on the individual benchmarks followed by a summary\.

TABLE III:Falsification performance on ARCH benchmarks \(AT and CC\)\. FR denotes falsification rate \(out of 10 runs\) and S denotes the mean number of simulations required for successful runs\.#### Automatic Transmission \(AT\)

On the AT benchmarks \(Table[III](https://arxiv.org/html/2607.23134#S6.T3)\),DiffTiltis not competitive with FReaK\. FReaK falsifies every specification at low simulation counts, helped by a Koopman surrogate that captures the dynamics accurately and AT specifications that need only a few time indices for robustness encoding\[[1](https://arxiv.org/html/2607.23134#bib.bib21)\]\.DiffTiltfails outright on three specifications, each for an identifiable reason\. AT1 follows a broader ARCH\-COMP pattern\[[11](https://arxiv.org/html/2607.23134#bib.bib20)\]in which most tools fail under smooth input interpolation\. AT51 and AT54 have discrete gear signals that flatten the robustness landscape, since many distinct input signals map to the same robustness value and the guidance gradient becomes uninformative\. This is exactly the regime our analysis flags as unfavorable, since Theorem[1](https://arxiv.org/html/2607.23134#Thmtheorem1)guarantees that tilting raises the failure probability only when the surrogate tends to score failing scenarios above non\-failing ones, an ordering that a flattened landscape erases\. This effect, however, is specification\-specific rather than systematic, as the remaining gear specifications AT52 and AT53 are still falsified at 4000 points\. We did not run experiments targeting these flat\-gradient cases and note them as future work\.

#### Chasing Cars \(CC\)

On CC1\-CC3, shown in Table[III](https://arxiv.org/html/2607.23134#S6.T3), both methods achieve high falsification rates at 4000 points, though FReaK requires fewer simulations\. The picture changes on CC4, CC5, and CCx, which involve longer horizons and nested specifications\. These require a large number of time indices for accurate robustness encoding\[[1](https://arxiv.org/html/2607.23134#bib.bib21)\], making FReaK’s optimization increasingly expensive and forcing a coarser discretization that reduces surrogate accuracy\.DiffTiltavoids this cost, since it is guided by the surrogate score of the STL robustness evaluated on the realized trace rather than by a logical encoding of the formula, so the nesting and horizon length that drive up the baseline’s optimization do not enterDiffTilt’s per\-iteration cost\. On CCx,DiffTiltachieves full falsification in 10\-18 simulations compared to 110\.5 for FReaK\. On CC5,DiffTiltreaches comparable falsification rates with far fewer simulations\. On CC4,DiffTiltdoes not match FReaK’s falsification rate but requires far fewer simulations in successful runs\.

#### Tractor\-Trailer \(TT2D\)

On TT2D,DiffTiltat 4000 points achieves falsification success rate of 1\.0 across all six scenarios\. In S1, S2, S3, and S6, FReaK succeeds in only a fraction of runs requiring significantly more simulations and runtime, often by an order of magnitude\. In contrast,DiffTiltmaintains success rate of 1\.0 on all four scenarios with far fewer simulations and substantially lower runtime\.This holds for two reasons\. The first is that the score\-based robustness is better able to guide search in environments where the admissible search space is large but the falsifying region constitutes only a small subset, a case where optimization\-based approaches tend to struggle\. A second reason is the guidance signal itself\. Our analysis requires only that the score rank failing scenarios above non\-failing ones, soDiffTiltcan be driven by the richer trajectory\-level goal\-reaching cost while still being confirmed against the same goal\-reachability specification as FReaK, and these results show that this richer signal succeeds where an objective tied to the specification alone stalls\.The advantage does not extend to Wide \(S4\) and Narrow Parking \(S5\), where model\-enforced feasibility projections tightly restrict admissible trajectories and both methods perform comparably\. This suggests difficulty in these scenarios is driven more by the geometry of the feasible set than by the search procedure\.On these two scenarios, FReaK exhibits lower runtime thanDiffTilt, highlighting its advantage in such scenarios\.

TABLE IV:Falsification performance on TT2D scenarios\. FR denotes falsification rate \(out of 10 runs\), S the mean number of simulations for successful runs,Tf¯\\bar\{T\_\{f\}\}the mean runtime \(seconds\), andSEf\\text\{SE\}\_\{f\}its standard error over falsifying runs\.The 500\-point results reflect the outcome of insufficient trajectory coverage during training\. When training data does not cover the trajectory space well, the learned prior cannot provide reliable guidance, and falsification rates drop\. This represents an upfront investment, but one that is amortized as the number of specifications increase since the prior is reusable across tasks without retraining\. Whereas FReaK requires optimization from scratch per specification\. Notably, even with 500 points,DiffTiltexceeds FReaK on S1 and S3, despite using a naive implementation of the JointNet\[[16](https://arxiv.org/html/2607.23134#bib.bib19)\]\.

#### Summary

Overall,DiffTiltprovides two key advantages for the benchmarks considered\. First, instead of formulating and solving a new optimization problem for each specification, it learns a joint prior over inputs and trajectories that captures system behavior and can be reused across specifications\. Second, falsification is performed by guiding this prior using any function that evaluates the resulting execution \(e\.g\., a robustness measure, reward, objective function, or expert\-defined score\) without requiring STL encodings or decomposition into logical primitives, making the method applicable across a wide range of tasks\.

## VIIConclusion

DiffTiltcastsfalsification as the exponential tilting of a diffusion\-induced joint distribution over environments and executions toward failures\. This tilting is the KL\-optimal reweighting of the prior, and it admits an exact importance\-sampling interpretation in the joint space\. It provably amplifies failure probability under mild score\-ranking assumptions, and strictly overcomes the multiplicative rarity bottleneck that caps conditional sampling\. For deterministic systems, it reduces to optimal importance sampling over inputs along the dynamics manifold, so every proposed counterexample is validated by the true simulator while the prior need never match the system under test\.

Empirically, a single joint prior trained once and reused without retraining remains competitive with state\-of\-the\-art falsification on the standard ARCH\-COMP specifications and outperforms it on long\-horizon, nested, and non\-STL objectives\. The simulator is called only on selected candidates, and those evaluations train the surrogate whose gradients guide denoising\. Expensive system calls therefore stay confined to scoring, keeping the procedure sample\-efficient and compatible with black\-box pipelines\.

Several aspects require further investigation\. The tilting strengthβ\\betais presently fixed per benchmark from a coarse pilot search, leaving a principled adaptive schedule as a clear next step\. Largeβ\\betadrives mass into high\-score regions where the prior is least accurate and can push denoised samples off the data manifold\. Because onlyxxis simulated, the gap between the generated trace and the true rolloutΦ​\(x\)\\Phi\(x\)is observable at no extra cost, and feeding it back as a mismatch\-correction term during denoising would keep samples on\-manifold and refine the prior online\. Similarly, guided diffusion shifts the proposal rather than reweighting a fixed sample set, so ESS degradation does not affect our results, though a formal account of this interaction remains open\.

The surrogate is a second lever\. In discrete or hybrid dynamics, such as the AT5 gear signals, the surrogate gradient is uninformative and sampling reverts to the unguided prior, preserving coverage but not driving failures, motivating surrogates that exploit hybrid structure and samplers that retain diversity where gradients vanish\. On the systems side, DDPM inference and the coupled architecture limit scaling, motivating faster samplers such as DDIM and more efficient joint architectures\. Finally, the extension of the analysis to stochastic systems, alongside applications to planning, synthesis, and robotics, are natural directions forDiffTilt\.

## References

- \[1\]\(2025\)Fast koopman surrogate falsification using linear relaxations and weights\.InAutomated Technology for Verification and Analysis,S\. Akshay, A\. Niemetz, and S\. Sankaranarayanan \(Eds\.\),Cham,pp\. 234–255\.External Links:ISBN 978\-3\-031\-78750\-8Cited by:[§VI\-A](https://arxiv.org/html/2607.23134#S6.SS1.SSS0.Px1.p1.1),[§VI\-A](https://arxiv.org/html/2607.23134#S6.SS1.SSS0.Px2.p6.3.3),[§VI\-B](https://arxiv.org/html/2607.23134#S6.SS2.SSS0.Px1.p1.1),[§VI\-B](https://arxiv.org/html/2607.23134#S6.SS2.SSS0.Px2.p1.1),[§VI](https://arxiv.org/html/2607.23134#S6.p1.1)\.
- \[2\]J\. A\. Bucklew and J\. Bucklew\(2004\)Introduction to rare event simulation\.Vol\.5,Springer\.Cited by:[§I](https://arxiv.org/html/2607.23134#S1.p2.1)\.
- \[3\]T\. M\. Cover and J\. A\. Thomas\(2006\)Elements of information theory\.Wiley\.External Links:[Document](https://dx.doi.org/10.1002/047174882X)Cited by:[§I](https://arxiv.org/html/2607.23134#S1.p2.1)\.
- \[4\]I\. Csiszár\(1975\)I\-divergence geometry of probability distributions and minimization problems\.The Annals of Probability3\(1\),pp\. 146–158\.External Links:[Document](https://dx.doi.org/10.1214/aop/1176996454)Cited by:[§I](https://arxiv.org/html/2607.23134#S1.p2.1)\.
- \[5\]A\. Dembo and O\. Zeitouni\(1998\)Large deviations techniques and applications\.Springer\.External Links:[Document](https://dx.doi.org/10.1007/978-1-4612-5320-4)Cited by:[§I](https://arxiv.org/html/2607.23134#S1.p2.1)\.
- \[6\]P\. Dhariwal and A\. Nichol\(2021\)Diffusion models beat gans on image synthesis\.InAdvances in Neural Information Processing Systems,External Links:[Document](https://dx.doi.org/10.48550/arXiv.2105.05233)Cited by:[§I](https://arxiv.org/html/2607.23134#S1.p3.1)\.
- \[7\]M\. D\. Donsker and S\. R\. S\. Varadhan\(1975\)Asymptotic evaluation of certain markov process expectations\.Communications on Pure and Applied Mathematics28\(1\),pp\. 1–47\.External Links:[Document](https://dx.doi.org/10.1002/cpa.3160280102)Cited by:[§I](https://arxiv.org/html/2607.23134#S1.p2.1)\.
- \[8\]T\. Dreossi, S\. Jha, and S\. A\. Seshia\(2018\)Semantic adversarial deep learning\.InInternational Conference on Computer Aided Verification,pp\. 3–26\.Cited by:[§I](https://arxiv.org/html/2607.23134#S1.p1.1)\.
- \[9\]D\. J\. Fremont, J\. Chiu, D\. D\. Margineantu, D\. Osipychev, and S\. A\. Seshia\(2020\)Formal analysis and redesign of a neural network\-based aircraft taxiing system with verifai\.InInternational Conference on Computer Aided Verification,pp\. 122–134\.Cited by:[§I](https://arxiv.org/html/2607.23134#S1.p1.1)\.
- \[10\]J\. Ho, A\. Jain, and P\. Abbeel\(2020\)Denoising diffusion probabilistic models\.InAdvances in Neural Information Processing Systems,External Links:[Document](https://dx.doi.org/10.48550/arXiv.2006.11239)Cited by:[§I](https://arxiv.org/html/2607.23134#S1.p3.1),[§II](https://arxiv.org/html/2607.23134#S2.SS0.SSS0.Px1.p1.3),[§II](https://arxiv.org/html/2607.23134#S2.SS0.SSS0.Px1.p2.1),[§II](https://arxiv.org/html/2607.23134#S2.SS0.SSS0.Px1.p3.4),[§V](https://arxiv.org/html/2607.23134#S5.SS0.SSS0.Px1.p1.6),[§V](https://arxiv.org/html/2607.23134#S5.SS0.SSS0.Px2.p1.2)\.
- \[11\]T\. Khandait, D\. Lyu, P\. Arcaini, G\. Fainekos, F\. Formica, S\. Gon, A\. Hekal, A\. Kundu, C\. Menghi, G\. Pedrielli, R\. Ray, Q\. Thibeault, M\. Waga, and Z\. Zhang\(2025\)ARCH\-comp25 category report: falsification\.InProceedings of 12th Int\. Workshop on Applied Verification for Continuous and Hybrid Systems,G\. Frehse and M\. Althoff \(Eds\.\),EPiC Series in Computing, Vol\.108,pp\. 169–189\.External Links:ISSN 2398\-7340,[Link](https://arxiv.org/publications/paper/xX5W),[Document](https://dx.doi.org/10.29007/dgnn)Cited by:[§VI\-A](https://arxiv.org/html/2607.23134#S6.SS1.SSS0.Px1.p1.1),[§VI\-A](https://arxiv.org/html/2607.23134#S6.SS1.SSS0.Px2.p1.1),[§VI\-A](https://arxiv.org/html/2607.23134#S6.SS1.SSS0.Px2.p2.8),[§VI\-A](https://arxiv.org/html/2607.23134#S6.SS1.SSS0.Px2.p3.5),[§VI\-A](https://arxiv.org/html/2607.23134#S6.SS1.SSS0.Px3.p1.4),[§VI\-B](https://arxiv.org/html/2607.23134#S6.SS2.SSS0.Px1.p1.1)\.
- \[12\]T\. Kim, K\. Majd, H\. Okamoto, B\. Hoxha, D\. Panagou, and G\. Fainekos\(2026\)Safe model predictive diffusion with shielding\.InIEEE International Conference on Robotics and Automation \(ICRA\),Cited by:[item 5](https://arxiv.org/html/2607.23134#S1.I1.i5.p1.1),[§VI\-A](https://arxiv.org/html/2607.23134#S6.SS1.SSS0.Px2.p1.1),[§VI\-A](https://arxiv.org/html/2607.23134#S6.SS1.SSS0.Px2.p4.6)\.
- \[13\]Y\. Song and S\. Ermon\(2019\)Generative modeling by estimating gradients of the data distribution\.InAdvances in Neural Information Processing Systems,External Links:[Document](https://dx.doi.org/10.48550/arXiv.1907.05600)Cited by:[§I](https://arxiv.org/html/2607.23134#S1.p3.1)\.
- \[14\]Y\. Song, J\. Sohl\-Dickstein, D\. P\. Kingma, A\. Kumar, S\. Ermon, and B\. Poole\(2021\)Score\-based generative modeling through stochastic differential equations\.InInternational Conference on Learning Representations,External Links:[Document](https://dx.doi.org/10.48550/arXiv.2011.13456)Cited by:[§I](https://arxiv.org/html/2607.23134#S1.p3.1),[§II](https://arxiv.org/html/2607.23134#S2.SS0.SSS0.Px1.p1.3),[§II](https://arxiv.org/html/2607.23134#S2.SS0.SSS0.Px1.p4.1),[§II](https://arxiv.org/html/2607.23134#S2.SS0.SSS0.Px1.p4.3),[§II](https://arxiv.org/html/2607.23134#S2.SS0.SSS0.Px1.p4.4)\.
- \[15\]E\. Vin, S\. Kashiwa, M\. Rhea, D\. J\. Fremont, E\. Kim, T\. Dreossi, S\. Ghosh, X\. Yue, A\. L\. Sangiovanni\-Vincentelli, and S\. A\. Seshia\(2023\)3d environment modeling for falsification and beyond with scenic 3\.0\.InInternational Conference on Computer Aided Verification,pp\. 253–265\.Cited by:[§I](https://arxiv.org/html/2607.23134#S1.p1.1)\.
- \[16\]J\. Zhang, S\. Li, Y\. Lu, T\. Fang, D\. McKinnon, Y\. Tsin, L\. Quan, and Y\. Yao\(2024\)JointNet: extending text\-to\-image diffusion for dense distribution modeling\.InICLR,External Links:[Link](https://arxiv.org/abs/2310.06347)Cited by:[§V](https://arxiv.org/html/2607.23134#S5.SS0.SSS0.Px1.p1.6),[§VI\-B](https://arxiv.org/html/2607.23134#S6.SS2.SSS0.Px3.p2.1),[§VI\-B](https://arxiv.org/html/2607.23134#S6.SS2.p1.3.3)\.

## VIIIAppendix

In this appendix we provide the detailed proofs of the results not shown in the main manuscript\.

### VIII\-AProof of Proposition[1](https://arxiv.org/html/2607.23134#Thmproposition1)

###### Proof\.

Let\(X,Y\)\(X,Y\)denote one draw from the conditional sampling procedure:X∼q,X\\sim q,andY∼pθ\(⋅∣X\)\.Y\\sim p\_\{\\theta\}\(\\cdot\\mid X\)\.By assumptionpθ​\(y∣x\)=p⋆​\(y∣x\)p\_\{\\theta\}\(y\\mid x\)=p^\{\\star\}\(y\\mid x\)for allxx, so for any measurableB⊂𝒴B\\subset\\mathcal\{Y\},

ℙ​\(Y∈B∣X=x\)=∫Bpθ​\(y∣x\)​𝑑y=∫Bp⋆​\(y∣x\)​𝑑y\.\\mathbb\{P\}\(Y\\in B\\mid X=x\)=\\int\_\{B\}p\_\{\\theta\}\(y\\mid x\)\\,dy=\\int\_\{B\}p^\{\\star\}\(y\\mid x\)\\,dy\.Define the conditional failure probability under the true dynamics as

f⋆​\(x\):=∫𝒴𝟏F​\(x,y\)​p⋆​\(y∣x\)​𝑑y=ℙ​\(\(x,Y\)∈F∣X=x\)\.f^\{\\star\}\(x\)\\ :=\\ \\int\_\{\\mathcal\{Y\}\}\\mathbf\{1\}\_\{F\}\(x,y\)\\,p^\{\\star\}\(y\\mid x\)\\,dy\\ =\\ \\mathbb\{P\}\\big\(\(x,Y\)\\in F\\mid X=x\\big\)\.By assumptions \(ii\)–\(iii\),f⋆​\(x\)=εf^\{\\star\}\(x\)=\\varepsilonforx∈Ax\\in Aandf⋆​\(x\)=0f^\{\\star\}\(x\)=0forx∉Ax\\notin A\.

First, we show how, underp⋆p^\{\\star\}we have

p⋆​\(F\)=∫𝒳p⋆​\(x\)​f⋆​\(x\)​𝑑x=∫Ap⋆​\(x\)​ε​𝑑x\\displaystyle p^\{\\star\}\(F\)=\\int\_\{\\mathcal\{X\}\}p^\{\\star\}\(x\)\\,f^\{\\star\}\(x\)\\,dx=\\int\_\{A\}p^\{\\star\}\(x\)\\,\\varepsilon\\,dx=ε​p⋆​\(X∈A\)\\displaystyle=\\varepsilon\\,p^\{\\star\}\(X\\in A\)which provesp⋆​\(F\)=δ​εp^\{\\star\}\(F\)=\\delta\\varepsilonsincep⋆​\(X∈A\)=δp^\{\\star\}\(X\\in A\)=\\delta\.

We now derive the failure probability induced by the conditional sampler\. Under the sampler distribution induced byqqandpθ\(⋅∣x\)=p⋆\(⋅∣x\)p\_\{\\theta\}\(\\cdot\\mid x\)=p^\{\\star\}\(\\cdot\\mid x\),

ℙ​\(F\)=∫𝒳q​\(x\)​f⋆​\(x\)​𝑑x=∫Aq​\(x\)​ε​𝑑x=ε​q​\(A\)\.\\mathbb\{P\}\(F\)=\\int\_\{\\mathcal\{X\}\}q\(x\)\\,f^\{\\star\}\(x\)\\,dx=\\int\_\{A\}q\(x\)\\,\\varepsilon\\,dx=\\varepsilon\\,q\(A\)\.Ifq​\(A\)≤c​δq\(A\)\\leq c\\,\\delta, thenℙ​\(F\)≤c​δ​ε\.\\mathbb\{P\}\(F\)\\leq c\\,\\delta\\varepsilon\.

Finally, letTTbe the number of i\.i\.d\. draws until the first failure event occurs\. Each draw can be modeled as an independent Bernoulli trial with success probabilityℙ​\(F\)\\mathbb\{P\}\(F\), we haveT∼Geom​\(ℙ​\(F\)\)T\\sim\\mathrm\{Geom\}\(\\mathbb\{P\}\(F\)\)\(counting trials until first success\), and therefore:

𝔼​\[T\]=1ℙ​\(F\)≥1c​δ​ε=Ω​\(\(δ​ε\)−1\)\.\\mathbb\{E\}\[T\]=\\frac\{1\}\{\\mathbb\{P\}\(F\)\}\\ \\geq\\ \\frac\{1\}\{c\\,\\delta\\varepsilon\}=\\Omega\\big\(\(\\delta\\varepsilon\)^\{\-1\}\\big\)\.∎

### VIII\-BProof of Lemma[1](https://arxiv.org/html/2607.23134#Thmlemma1)

###### Proof\.

LetZ​\(β\):=∫𝒵p​\(z\)​exp⁡\(β​S​\(z\)\)​𝑑zZ\(\\beta\):=\\int\_\{\\mathcal\{Z\}\}p\(z\)\\exp\(\\beta S\(z\)\)\\,dzand defineℬ:=\{β∈ℝ:Z​\(β\)<∞\}\\mathcal\{B\}:=\\\{\\beta\\in\\mathbb\{R\}:\\ Z\(\\beta\)<\\infty\\\}\.

#### Non\-emptiness\.

Sinceppis a probability density,∫p​\(z\)​𝑑z=1\\int p\(z\)\\,dz=1\. Hence

Z​\(0\)=∫p​\(z\)​exp⁡\(0\)​𝑑z=∫p​\(z\)​𝑑z=1<∞,\\displaystyle Z\(0\)=\\int p\(z\)\\exp\(0\)\\,dz=\\int p\(z\)\\,dz=1<\\infty,\(20\)so0∈ℬ0\\in\\mathcal\{B\}\.

#### Interval property\.

We show thatℬ\\mathcal\{B\}is an interval \(i\.e\., convex\)\. Letβ1,β2∈ℬ\\beta\_\{1\},\\beta\_\{2\}\\in\\mathcal\{B\}andα∈\[0,1\]\\alpha\\in\[0,1\]\. By Hölder’s inequality,

Z​\(α​β1\+\(1−α\)​β2\)=…\\displaystyle\{\}Z\(\\alpha\\beta\_\{1\}\+\(1\-\\alpha\)\\beta\_\{2\}\)=\.\.\.=∫p​\(z\)​exp⁡\(\(α​β1\+\(1−α\)​β2\)​S​\(z\)\)​𝑑z\\displaystyle=\\int p\(z\)\\exp\\\!\\big\(\(\\alpha\\beta\_\{1\}\+\(1\-\\alpha\)\\beta\_\{2\}\)S\(z\)\\big\)\\,dz=∫p​\(z\)​exp⁡\(α​β1​S​\(z\)\)​exp⁡\(\(1−α\)​β2​S​\(z\)\)​𝑑z\\displaystyle=\\int p\(z\)\\exp\(\\alpha\\beta\_\{1\}S\(z\)\)\\exp\(\(1\-\\alpha\)\\beta\_\{2\}S\(z\)\)\\,dz≤\(∫p​\(z\)​exp⁡\(β1​S​\(z\)\)​𝑑z\)α​\(∫p​\(z\)​exp⁡\(β2​S​\(z\)\)​𝑑z\)1−α\\displaystyle\\leq\\Big\(\\int p\(z\)\\exp\(\\beta\_\{1\}S\(z\)\)\\,dz\\Big\)^\{\\alpha\}\\Big\(\\int p\(z\)\\exp\(\\beta\_\{2\}S\(z\)\)\\,dz\\Big\)^\{1\-\\alpha\}=Z​\(β1\)α​Z​\(β2\)1−α<∞\.\\displaystyle=Z\(\\beta\_\{1\}\)^\{\\alpha\}Z\(\\beta\_\{2\}\)^\{1\-\\alpha\}<\\infty\.soα​β1\+\(1−α\)​β2∈ℬ\\alpha\\beta\_\{1\}\+\(1\-\\alpha\)\\beta\_\{2\}\\in\\mathcal\{B\}\. Thusℬ\\mathcal\{B\}is convex, hence an interval \(possibly unbounded\)\. Because0∈ℬ0\\in\\mathcal\{B\}, there exist extended reals−∞≤β−≤0≤β\+≤\+∞\-\\infty\\leq\\beta\_\{\-\}\\leq 0\\leq\\beta\_\{\+\}\\leq\+\\inftysuch thatℬ=\(β−,β\+\)\\mathcal\{B\}=\(\\beta\_\{\-\},\\beta\_\{\+\}\)or possibly with closed endpoints if finiteness holds at an endpoint\. For simplicity we denoteℬ=\(β−,β\+\)\\mathcal\{B\}=\(\\beta\_\{\-\},\\beta\_\{\+\}\)as in the statement \(the open\-interval form always holds forint​\(ℬ\)\\mathrm\{int\}\(\\mathcal\{B\}\)\)\.

#### Validity of the tilted density\.

Fix anyβ∈ℬ\\beta\\in\\mathcal\{B\}\. Sinceexp⁡\(β​S​\(z\)\)≥0\\exp\(\\beta S\(z\)\)\\geq 0andp​\(z\)≥0p\(z\)\\geq 0, we havepβ​\(z\)≥0p\_\{\\beta\}\(z\)\\geq 0\. Moreover

∫𝒵pβ​\(z\)​𝑑z=1Z​\(β\)​∫𝒵p​\(z\)​exp⁡\(β​S​\(z\)\)​𝑑z=Z​\(β\)Z​\(β\)=1,\\int\_\{\\mathcal\{Z\}\}p\_\{\\beta\}\(z\)\\,dz=\\frac\{1\}\{Z\(\\beta\)\}\\int\_\{\\mathcal\{Z\}\}p\(z\)\\exp\(\\beta S\(z\)\)\\,dz=\\frac\{Z\(\\beta\)\}\{Z\(\\beta\)\}=1,sopβp\_\{\\beta\}is a valid probability density on𝒵\\mathcal\{Z\}\.

#### Differentiability ofψ​\(β\)=log⁡Z​\(β\)\\psi\(\\beta\)=\\log Z\(\\beta\)onint​\(ℬ\)\\mathrm\{int\}\(\\mathcal\{B\}\)\.

Fixβ∈int​\(ℬ\)\\beta\\in\\mathrm\{int\}\(\\mathcal\{B\}\)and assume there existsδ\>0\\delta\>0such thatZ​\(β\+δ\)<∞Z\(\\beta\+\\delta\)<\\infty\. Forh∈\(0,δ\)h\\in\(0,\\delta\)define

fh​\(z\):=exp⁡\(\(β\+h\)​S​\(z\)\)−exp⁡\(β​S​\(z\)\)h\.f\_\{h\}\(z\):=\\frac\{\\exp\(\(\\beta\+h\)S\(z\)\)\-\\exp\(\\beta S\(z\)\)\}\{h\}\.For each fixedzz,fh​\(z\)→S​\(z\)​exp⁡\(β​S​\(z\)\)f\_\{h\}\(z\)\\to S\(z\)\\exp\(\\beta S\(z\)\)ash→0\+h\\to 0^\{\+\}by the mean value theorem\. Moreover, for0<h<δ0<h<\\delta, the mean value theorem yields

\|fh​\(z\)\|\\displaystyle\|f\_\{h\}\(z\)\|=\|S​\(z\)\|​exp⁡\(\(β\+ξ\)​S​\(z\)\)\\displaystyle=\|S\(z\)\|\\exp\(\(\\beta\+\\xi\)S\(z\)\)≤\|S​\(z\)\|​\(exp⁡\(\(β\+δ\)​S​\(z\)\)\+exp⁡\(β​S​\(z\)\)\)\\displaystyle\\leq\|S\(z\)\|\\big\(\\exp\(\(\\beta\+\\delta\)S\(z\)\)\+\\exp\(\\beta S\(z\)\)\\big\)for someξ∈\(0,h\)\\xi\\in\(0,h\)\. Under the stated assumptionZ​\(β\+δ\)<∞Z\(\\beta\+\\delta\)<\\inftyandβ∈ℬ\\beta\\in\\mathcal\{B\}, the functionp​\(z\)​exp⁡\(\(β\+δ\)​S​\(z\)\)p\(z\)\\exp\(\(\\beta\+\\delta\)S\(z\)\)is integrable, and the above bound provides an integrable dominating function whenever the right\-hand side is integrable \(standard sufficient condition; see below\)\. Hence, by differentiation under the integral sign justified via dominated convergence,

Z′​\(β\)=∫p​\(z\)​S​\(z\)​exp⁡\(β​S​\(z\)\)​𝑑z\.Z^\{\\prime\}\(\\beta\)=\\int p\(z\)S\(z\)\\exp\(\\beta S\(z\)\)\\,dz\.SinceZ​\(β\)∈\(0,∞\)Z\(\\beta\)\\in\(0,\\infty\)forβ∈ℬ\\beta\\in\\mathcal\{B\},ψ​\(β\)=log⁡Z​\(β\)\\psi\(\\beta\)=\\log Z\(\\beta\)is finite and

ψ′​\(β\)=Z′​\(β\)Z​\(β\)\\displaystyle\\psi^\{\\prime\}\(\\beta\)=\\frac\{Z^\{\\prime\}\(\\beta\)\}\{Z\(\\beta\)\}=∫p​\(z\)​S​\(z\)​exp⁡\(β​S​\(z\)\)​𝑑z∫p​\(z\)​exp⁡\(β​S​\(z\)\)​𝑑z\\displaystyle=\\frac\{\\int p\(z\)S\(z\)\\exp\(\\beta S\(z\)\)\\,dz\}\{\\int p\(z\)\\exp\(\\beta S\(z\)\)\\,dz\}=∫S​\(z\)​pβ​\(z\)​𝑑z=𝔼pβ​\[S​\(Z\)\]\.\\displaystyle=\\int S\(z\)\\,p\_\{\\beta\}\(z\)\\,dz=\\mathbb\{E\}\_\{p\_\{\\beta\}\}\[S\(Z\)\]\.

#### Second derivative and variance identity\.

Assume additionally that for someδ\>0\\delta\>0,∫p​\(z\)​exp⁡\(\(β\+δ\)​\|S​\(z\)\|\)​𝑑z<∞\\int p\(z\)\\exp\(\(\\beta\+\\delta\)\|S\(z\)\|\)\\,dz<\\infty\. This exponential integrability implies∫p​\(z\)​S​\(z\)2​exp⁡\(β​S​\(z\)\)​𝑑z<∞\\int p\(z\)S\(z\)^\{2\}\\exp\(\\beta S\(z\)\)\\,dz<\\infty, allowing a second differentiation under the integral sign:

Z′′​\(β\)=∫p​\(z\)​S​\(z\)2​exp⁡\(β​S​\(z\)\)​𝑑z\.Z^\{\\prime\\prime\}\(\\beta\)=\\int p\(z\)S\(z\)^\{2\}\\exp\(\\beta S\(z\)\)\\,dz\.Therefore,

ψ′′​\(β\)\\displaystyle\\psi^\{\\prime\\prime\}\(\\beta\)=Z′′​\(β\)Z​\(β\)−\(Z′​\(β\)Z​\(β\)\)2\\displaystyle=\\frac\{Z^\{\\prime\\prime\}\(\\beta\)\}\{Z\(\\beta\)\}\-\\Big\(\\frac\{Z^\{\\prime\}\(\\beta\)\}\{Z\(\\beta\)\}\\Big\)^\{2\}=𝔼pβ​\[S​\(Z\)2\]−\(𝔼pβ​\[S​\(Z\)\]\)2=Varpβ​\(S​\(Z\)\)≥0,\\displaystyle=\\mathbb\{E\}\_\{p\_\{\\beta\}\}\[S\(Z\)^\{2\}\]\-\\big\(\\mathbb\{E\}\_\{p\_\{\\beta\}\}\[S\(Z\)\]\\big\)^\{2\}=\\mathrm\{Var\}\_\{p\_\{\\beta\}\}\(S\(Z\)\)\\ \\geq\\ 0,which completes the proof\. ∎

### VIII\-CProof of Proposition[4](https://arxiv.org/html/2607.23134#Thmproposition4)

###### Proof\.

Assume the base joint distributionppis supported on the manifoldℳ:=\{\(x,y\)∈𝒳×𝒴:y=Φ​\(x\)\}\\mathcal\{M\}:=\\\{\(x,y\)\\in\\mathcal\{X\}\\times\\mathcal\{Y\}:\\ y=\\Phi\(x\)\\\}\. Equivalently, the conditional law ofYYgivenX=xX=xis degenerate atΦ​\(x\)\\Phi\(x\), i\.e\.,p​\(d​y∣x\)=δΦ​\(x\)​\(d​y\),p\(dy\\mid x\)=\\delta\_\{\\Phi\(x\)\}\(dy\),and the joint factorizes asp​\(d​x,d​y\)=pX​\(d​x\)​δΦ​\(x\)​\(d​y\)\.p\(dx,dy\)=p\_\{X\}\(dx\)\\,\\delta\_\{\\Phi\(x\)\}\(dy\)\.In density notation \(with respect tod​x​d​ydx\\,dy\) this is written asp​\(x,y\)=pX​\(x\)​δ​\(y−Φ​\(x\)\)p\(x,y\)=p\_\{X\}\(x\)\\,\\delta\(y\-\\Phi\(x\)\)\.

Fixβ∈ℬ\\beta\\in\\mathcal\{B\}so the tilt is well\-defined and define the tilted joint

pβ​\(d​x,d​y\)\\displaystyle p\_\{\\beta\}\(dx,dy\)=eβ​S​\(x,y\)Z​\(β\)​p​\(d​x,d​y\),\\displaystyle=\\frac\{e^\{\\beta S\(x,y\)\}\}\{Z\(\\beta\)\}\\,p\(dx,dy\),Z​\(β\)\\displaystyle Z\(\\beta\)=∬eβ​S​\(x,y\)​p​\(d​x,d​y\)\.\\displaystyle=\\iint e^\{\\beta S\(x,y\)\}\\,p\(dx,dy\)\.To compute the induced marginal over inputs, integrate outyy:

pβ,X​\(d​x\)\\displaystyle p\_\{\\beta,X\}\(dx\):=∫𝒴pβ​\(d​x,d​y\)\\displaystyle:=\\int\_\{\\mathcal\{Y\}\}p\_\{\\beta\}\(dx,dy\)=1Z​\(β\)​∫𝒴eβ​S​\(x,y\)​pX​\(d​x\)​δΦ​\(x\)​\(d​y\)\\displaystyle=\\frac\{1\}\{Z\(\\beta\)\}\\int\_\{\\mathcal\{Y\}\}e^\{\\beta S\(x,y\)\}\\,p\_\{X\}\(dx\)\\,\\delta\_\{\\Phi\(x\)\}\(dy\)=1Z​\(β\)​pX​\(d​x\)​eβ​S​\(x,Φ​\(x\)\)\.\\displaystyle=\\frac\{1\}\{Z\(\\beta\)\}\\,p\_\{X\}\(dx\)\\,e^\{\\beta S\(x,\\Phi\(x\)\)\}\.Hence, in density form,

pβ,X​\(x\)∝pX​\(x\)​exp⁡\(β​S​\(x,Φ​\(x\)\)\),p\_\{\\beta,X\}\(x\)\\ \\propto\\ p\_\{X\}\(x\)\\exp\\\!\\big\(\\beta S\(x,\\Phi\(x\)\)\\big\),which is exactly input\-space exponential tilting with the score restricted to the dynamics manifold\. ∎