Fragility of Value under Imperfect Alignment

Winter Cross

Abstract As more responsibility is placed upon AI systems, it becomes increasingly important to guarantee that these systems are aligned with humanity. A common fear in AI safety is that human value is fragile – that is, optimizing too heavily for an imperfect proxy to human values will lead to a catastrophic outcome. In this paper, we present a model of the alignment problem where an agent undergoes idealized alignment training that guarantees its value function satisfies a proxy condition before optimizing the world. Our primary results identify conditions on the human value function and the accuracy of several proxy conditions under which an agent with an η \eta -catastrophic value function, one that is guaranteed to take the expectation of human value below η \eta in the limit of optimizing power, would be deployed. Our results highlight the danger of overoptimization and motivate AI designs that limit optimization pressure, such as quantilizers, rather than relying solely on pre-deployment training.

1 Introduction

Up until recently in human history, technological automation has been relegated to the realm of physical labor. But now, we are seeing the beginning of the automation of mental labor through the development of artificial intelligence. As these systems become more autonomous, their ability to impact humanity both positively and negatively will increase greatly. Just like we have medical students take exams to ensure they have the required knowledge to be a doctor, we must have robust alignment techniques to ensure artificial intelligences have the required human values to safely optimize the world.

A major challenge we face with developing such techniques comes from the extreme difficulty of specifying what we want. It is not possible to infer preferences from our behavior alone (Armstrong and Mindermann, 2018 ) and in the related context of contracts it is often practically impossible to identify all possible circumstances that could arise (Hadfield-Menell and Hadfield, 2019 ) . One way we could sidestep this difficulty is by using an imperfect simplified encoding of our values. The hope would be that if this encoding captures enough information about our values then any agent trained on the encoding will be favorable for humanity. Today, many AIs are trained with reinforcement learning from human feedback which effectively provides the AI with a partial encoding of human values gathered through human rankings of various responses generated by the AI.

However, this method requires great care as differences between an agent’s values and our own can lead to undesirable actions on the part of the agent. One only need look at the numerous documented cases of negative side effects and reward hacking where a misspecification in the reward function causes the agent to perform unexpected behavior (Lehman et al. , 2020 ) even under the supervision of an aligned model (Baker et al. , 2025 ) .

In this paper, we introduce a theoretical model of the alignment problem including novel definitions of optimization and catastrophic outcomes. In three frameworks that differ in the worlds they model and the alignment techniques used, we find necessary and sufficient conditions on the true value function and the accuracy of the alignment technique under which an agent with a catastrophic value function can slip through the cracks. We hope that a deeper understanding of the mechanisms behind value fragility will aid in the design of more robust alignment techniques and safer AI architectures.

1.1 Section Rundown

In Section 3 we describe a scenario concerning a group of researchers who are training an agent to be aligned before deploying it to optimize the world, along with definitions for optimization and catastrophic value functions. We further instantiate this scenario with three frameworks in Section 4 , Section 5 , and Section 6 which differ in the worlds they model and the alignment techniques used by the researchers. Each framework section is independent of the others, but Section 3 pertains to all of them.

The framework discussed in Section 4 models the world as finite, and the training process as bounding the disagreement rate between the agent and human value functions. The continuous framework in Section 5 models the world as bounded and continuous, and the training process as bounding the disagreement rate between the agent and human value functions up to a given tolerance. The attributes framework in Section 6 models a wide range of worlds and understands the human value functions as being made up of a finite set of attributes. The training process guarantees that the agent’s value function will be sensitive to all the same attributes.

2 Related Work

A core argument that AI is dangerous relies on the assumption that human value is fragile. That is, if you take an accurate description of human values, modify it, and then optimize the world for the modified values, then the resulting world will not be valuable according to the original values. Yudkowsky ( 2009 ) coined this use of the term ‘fragile’ and provided several examples of slightly modified versions of human values that result in undesirable worlds. This is an especially concerning idea since human values are difficult to specify. Armstrong and Mindermann ( 2018 ) show that the preferences of irrational agents cannot be deduced from their behavior alone and while Silver et al. ( 2021 ) argue that human preferences can be fully described simply by the maximization of a reward function, newer research challenges this claim under specific formalizations (Skalse and Abate, 2023 ; Pitis, 2023 ) .

The notion that optimizing for a proxy can lead to undesirable outcomes is often called “Goodhart’s law.” Variants of Goodhart’s law have been described by Manheim and Garrabrant ( 2018 ) . Kwa et al. ( 2024 ) find conditions under which catastrophic Goodhart is likely to occur in the context of RLHF and Gao et al. ( 2023 ) find empirical scaling laws of the regret due to Goodhart’s law in GPT-3 language models.

Past work has been done to model value fragility. Skalse et al. ( 2022 ) present a formal definition of reward hacking in the context of Markov decision processes and find that essentially no unhackable pairs of reward functions exist. Everitt et al. ( 2017 ) formalize the notion of corruption in reward signals to policies and show that the true reward function is unlearnable. Mirroring Yudkowsky ( 2009 ) , Zhuang and Hadfield-Menell ( 2020 ) model human value as being made up of attributes and they find conditions under which all proxies that are missing one attribute are catastrophic. Neth ( 2026 ) reviewed the result finding the work insightful, but argued that the model is limited in the types of proxies it considers. In addition to the “subset proxies” they modeled, Neth suggests proxies that are sensitive to every attribute but which are simpler than the human value function are equally valid and worth studying. In Section 6 , we present a similar model to that of Zhuang and find a condition for the existence of catastrophic proxies that depend on every attribute.

Alternative artificial intelligence designs to utility maximizers have been proposed to circumvent the negative effects of Goodhart’s law. For example, Taylor ( 2016 ) introduces ‘ q q -quantilizers’ as selecting an action from the top q q proportion of actions, allowing them to be capable without necessarily overoptimizing.

3 Alignment Scenario

In this section, we describe a scenario relating to the alignment problem along with some mathematical notation and definitions. Each of our three frameworks instantiates this scenario with specific worlds and alignment techniques.

There is a group of human researchers who are training a powerful agent. Their goal is to have the agent optimize the world for human values. Let X X denote the set of states of the world and let the human value function f : X → A f:X\rightarrow A denote the value assigned to each world state by the humans where A ⊆ ℝ A\subseteq\mathbb{R} is an interval.

The training process results in the agent having its own value function g : X → A g:X\rightarrow A . The researchers cannot necessarily guarantee that f f and g g are exactly equal, but they do have the ability to make sure that g g fits some criteria that makes it similar to f f . We call these criteria an “alignment technique” or a “proxy condition.” Any value function that meets the proxy condition is called a “proxy” for f f . If the agent’s value function is found to meet the proxy condition, then the researchers consider the agent safe and it is deployed to optimize the world. We equip X X with a standard Borel space and say that all value functions are Borel measurable. This is not a heavy restriction since any value function resulting from a computational process will be Borel measurable.

Let Ω k ​ ( g , p ) \Omega{k}(g,p) denote the probability distribution induced by the optimization of the agent where g g is the agent’s value function, p p is an initial distribution with full support over the states, and k k is a nonnegative real number that represents the optimizing power of the agent. As the agent becomes more powerful, perhaps through recursive self-improvement, the value of k k will increase and Ω k ​ ( g , p ) \Omega{k}(g,p) will return a distribution that is more and more concentrated around high-value states. There is more than one way to concentrate probability so to capture a generalized version of optimization, we give the definition of an optimizer Ω \Omega below.

Definition 3.1 .

An Optimizer is a map Ω : ℝ ≥ 0 × ℳ ​ ( X , A ) × Δ ​ ( X ) → Δ ​ ( X ) \Omega:\mathbb{R}{\geq 0}\times\mathcal{M}(X,A)\times\Delta(X)\rightarrow\Delta(X) that sends the optimizing power k ∈ ℝ ≥ 0 k\in\mathbb{R}{\geq 0} , a Borel measurable target value function g : X → A g:X\rightarrow A , and an initial prior over the world states p ∈ Δ ​ ( X ) p\in\Delta(X) to a probability distribution over the set of world states that satisfies the following properties:

1. With no optimizing power, the distribution is unchanged: Ω 0 ​ ( g , p ) = p \Omega_{0}(g,p)=p .

2. The expected value of the target function is monotonically increasing with optimizing power: j < k → 𝔼 Ω j ​ ( g , p ) ​ [ g ​ ( x ) ] ≤ 𝔼 Ω k ​ ( g , p ) ​ [ g ​ ( x ) ] j<k\rightarrow\mathbb{E}{\Omega{j}(g,p)}[g(x)]\leq\mathbb{E}{\Omega{k}(g,p)}[g(x)] .

3. As optimizing power increases to infinity, probability becomes concentrated in areas where g g is large: ∀ M < sup y ∈ X g ​ ( y ) , lim k → ∞ Pr Ω k ​ ( g , p ) ⁡ [ g ​ ( x ) > M ] = 1 \forall M<\sup{y\in X}g(y),\ \lim{k\rightarrow\infty}\Pr{\Omega{k}(g,p)}[g(x)>M]=1 .

4. As optimizing power increases to infinity, the expectation of the target approaches its highest value within the world states: lim k → ∞ 𝔼 Ω k ​ ( g , p ) ​ [ g ​ ( x ) ] = sup y ∈ X g ​ ( y ) \lim{k\rightarrow\infty}\mathbb{E}{\Omega{k}(g,p)}[g(x)]=\sup{y\in X}g(y) .

   Properties 3 and 4 in the definition above are similar, but not equivalent in general. Removing either of them results in optimizers that don’t quite match our intuition. Without property 3, in the case that A A is unbounded above, one can construct an optimizer that centers the vast majority of the probability weight on worthless world states and puts a tiny probability onto more and more valuable states to have the expectation increase. Whether or not this is desirable is contentious philosophically; Wilkinson ( 2022 ) argues that a coherent value system requires us to accept such gambles, but Bottomley and Williamson ( 2025 ) present a direct rebuttal of Wilkinson’s argument. Similarly, removing property 4, in the case that A A is unbounded below, one can construct an optimizer that centers the vast majority of the probability weight on high-value world states and puts a tiny probability onto less and less valuable states to have the probability property met while having the expectation decrease indefinitely.

   For bounded value functions, which all our results apply to, these unintuitive optimizers do not exist. In fact, properties 3 and 4 are equivalent for bounded value functions. We provide a proof below of the equivalence, so it will suffice to only consider property 3 in the definition above for all later arguments.

   Proposition 3.1 .

   Define g max = sup x ∈ X g ​ ( x ) g{\max}=\sup{x\in X}g(x) and g min = inf x ∈ X g ​ ( x ) g{\min}=\inf{x\in X}g(x) . Then, properties 3 and 4 of Definition 3.1 are equivalent.

   Proof.

   (3 implies 4) Take any M < g max M<g_{\max} . We have

   lim inf k → ∞ 𝔼 Ω k ​ ( g , p ) ​ [ g ​ ( x ) ] \displaystyle\liminf{k\rightarrow\infty}\mathbb{E}{\Omega{k}(g,p)}[g(x)] = lim inf k → ∞ [ ∫ x ∈ X : g ​ ( x ) > M g ​ ( x ) ​ d Ω k ​ ( g , p ) ​ ( x ) + ∫ x ∈ X : g ​ ( x ) ≤ M g ​ ( x ) ​ d Ω k ​ ( g , p ) ​ ( x ) ] \displaystyle=\liminf{k\rightarrow\infty}\left[\int{x\in X:g(x)>M}g(x)\mathrm{d}\Omega{k}(g,p)(x)+\int{x\in X:g(x)\leq M}g(x)\mathrm{d}\Omega{k}(g,p)(x)\right]

   ≥ lim inf k → ∞ [ M ​ Pr Ω k ​ ( g , p ) ⁡ [ g ​ ( x ) > M ] + g min ​ Pr Ω k ​ ( g , p ) ⁡ [ g ​ ( x ) ≤ M ] ] = M . \displaystyle\geq\liminf{k\rightarrow\infty}\left[M\Pr{\Omega{k}(g,p)}[g(x)>M]\quad\quad\quad\quad+g{\min}\Pr{\Omega{k}(g,p)}[g(x)\leq M]\right]=M.

   If the limit inferior of the expectation is greater than M M for all M < g max M<g{\max} , then the limit must exist and be equal to g max g{\max} .

   (4 implies 3) Take any M < g max M<g_{\max} . We have

   𝔼 Ω k ​ ( g , p ) ​ [ g ​ ( x ) ] \displaystyle\mathbb{E}{\Omega{k}(g,p)}[g(x)] = ∫ x ∈ X : g ​ ( x ) > M g ​ ( x ) ​ d Ω k ​ ( g , p ) ​ ( x ) + ∫ x ∈ X : g ​ ( x ) ≤ M g ​ ( x ) ​ d Ω k ​ ( g , p ) ​ ( x ) \displaystyle=\int{x\in X:g(x)>M}g(x)\mathrm{d}\Omega{k}(g,p)(x)+\int{x\in X:g(x)\leq M}g(x)\mathrm{d}\Omega{k}(g,p)(x)

   ≤ g max ​ Pr Ω k ​ ( g , p ) ⁡ [ g ​ ( x ) > M ] + M ​ Pr Ω k ​ ( g , p ) ⁡ [ g ​ ( x ) ≤ M ] \displaystyle\leq g{\max}\Pr{\Omega{k}(g,p)}[g(x)>M]\quad\quad\quad\ +M\Pr{\Omega_{k}(g,p)}[g(x)\leq M]

   which reduces to

   𝔼 Ω k ​ ( g , p ) ​ [ g ​ ( x ) ] ≤ M + ( g max − M ) ​ Pr Ω k ​ ( g , p ) ⁡ [ g ​ ( x ) > M ] ≤ g max . \mathbb{E}{\Omega{k}(g,p)}[g(x)]\leq M+(g{\max}-M)\Pr{\Omega{k}(g,p)}[g(x)>M]\leq g{\max}.

   Taking the limit inferior of both sides, we get

   lim inf k → ∞ 𝔼 Ω k ​ ( g , p ) ​ [ g ​ ( x ) ] = g max ≤ lim inf k → ∞ [ M + ( g max − M ) ​ Pr Ω k ​ ( g , p ) ⁡ [ g ​ ( x ) > M ] ] ≤ g max . \liminf{k\rightarrow\infty}\mathbb{E}{\Omega{k}(g,p)}[g(x)]=g{\max}\leq\liminf{k\rightarrow\infty}\left[M+(g{\max}-M)\Pr{\Omega{k}(g,p)}[g(x)>M]\right]\leq g_{\max}.

   Therefore, the limit inferior is exactly equal to g max g_{\max} which gives

   lim inf k → ∞ Pr Ω k ​ ( g , p ) ⁡ [ g ​ ( x ) > M ] = 1 . \liminf{k\rightarrow\infty}\Pr{\Omega_{k}(g,p)}[g(x)>M]=1.

   If the limit inferior of the probability is 1, then the limit exists and is equal to 1. ∎

   One example of an optimizer is the Boltzmann optimizer . If X X is a finite set, then the Boltzmann optimizer returns a probability distribution given by

   Ω k ​ ( g , p ) ​ ( x ) = p ​ ( x ) ​ e k ​ g ​ ( x ) ∑ y ∈ X p ​ ( y ) ​ e k ​ g ​ ( y ) \Omega{k}(g,p)(x)=\frac{p(x)e^{kg(x)}}{\sum{y\in X}p(y)e^{kg(y)}}

   which smoothly transfers more and more probability into higher-valued states and has full support for all values of k k . Fig. 1 shows the change in distribution induced by the Boltzmann optimizer. Another example of an optimizer is one that, for the target function g g , immediately places all probability weight on one maximizer of g g , x ∗ x^{} so that Ω k ​ ( g , p ) ​ ( x ∗ ) = 1 \Omega_{k}(g,p)(x^{})=1 for k > 0 k>0 .

   Figure 1: A sequence of graphs showing a distribution induced by a Boltzmann Optimizer. Graph 1: A graph displaying the value of four states A, B, C, and D with respect to the target value function. Graph 2: A graph displaying the initial probability distribution which is also the distribution induced when optimizing power is zero. Graph 3: A graph displaying the induced distribution when optimizing power is 1. Higher-valued states C and D see an increase in probability while lower-valued states see a decrease. Graph 4: A graph displaying the induced distribution when optimizing power is 10. Now that optimizing power is large enough, the only state that is seeing increases in probability is the highest-valued state D which has become much more likely than the other states.

   Finally, we need a definition to classify agent value functions as bad or not bad to optimize for. We provide a definition of catastrophic and partially catastrophic value functions below.

   Definition 3.2 .

   Let η \eta be a real number such that inf y ∈ X f ​ ( y ) ≤ η < sup y ∈ X f ​ ( y ) \inf{y\in X}f(y)\leq\eta<\sup{y\in X}f(y) . A value function g g is 𝛈 \bm{\eta} -catastrophic for a value function f f when for all initial priors p p and for all optimizers Ω \Omega ,

   lim sup k → ∞ 𝔼 Ω k ​ ( g , p ) ​ [ f ​ ( x ) ] ≤ η . \limsup{k\rightarrow\infty}\mathbb{E}{\Omega_{k}(g,p)}[f(x)]\leq\eta.

   In the extreme case that g g is inf y ∈ X f ​ ( y ) \inf_{y\in X}f(y) -catastrophic for f f , we say that g g is catastrophic for f.

   If g g is catastrophic for f f , the limit superior reduces to a limit and we have the simpler condition below.

   Corollary 3.1 .

   A value function g g is catastrophic for f f if and only if for all initial priors p p and for all optimizers Ω \Omega ,

   lim k → ∞ 𝔼 Ω k ​ ( g , p ) ​ [ f ​ ( x ) ] = inf y ∈ X f ​ ( y ) . \lim{k\rightarrow\infty}\mathbb{E}{\Omega{k}(g,p)}[f(x)]=\inf{y\in X}f(y).

   The quantity η \eta represents an upper bound on the expectation of human value in the limit of optimization. In other words, sup x ∈ X f ​ ( x ) − η \sup_{x\in X}f(x)-\eta represents the maximum regret for an η \eta -catastrophic value function. Definition 3.2 requires that human value be taken below η \eta for all optimizers, making this a strong definition. Value functions can exist that take human value below η \eta for some optimizers but increase human value for others; such functions do not satisfy the definition.

   Smaller η \eta -values represent more catastrophic outcomes (i.e. higher regret on the part of the humans). If η 1 < η 2 \eta{1}<\eta{2} and g g is η 1 \eta{1} -catastrophic then g g is also η 2 \eta{2} -catastrophic. This notion of partial catastrophe is only meaningful for η \eta in the range [ inf x ∈ X f ​ ( x ) , sup x ∈ X f ​ ( x ) ) [\inf{x\in X}f(x),\sup{x\in X}f(x)) ; if η \eta is smaller than the infimum, no function is η \eta -catastrophic and conversely, if η \eta is greater than or equal to the supremum, every function including f f itself is η \eta -catastrophic.

   The hope of the researchers is that their proxy condition is robust enough to filter out all catastrophic and partially catastrophic outcomes. As we will see, even strong alignment guarantees applying to the entire state space admit catastrophic and partially catastrophic proxies.

   4 Finite Framework

   This framework models a finite world where the training process guarantees that the disagreement rate between the agent and human value functions is below a given value. We find how strict the proxy condition must be to filter out catastrophic value functions.

   4.1 Instantiation

   Let X X be a finite set. Value functions are maps from the world states to values in the interval A = [ 0 , 1 ] A=[0,1] . Let f f denote the human value function and g g the agent’s. In this framework, the agent’s and human’s values exist on a calibrated scale where 0 represents the worst imaginable outcome and 1 the best. There need not be states where either function achieves 0 or 1.

   The researchers have designed the training process so that the disagreement rate between f ​ ( x ) f(x) and g ​ ( x ) g(x) when x x is pulled from a uniform distribution is at most β ∈ ( 0 , 1 ) \beta\in(0,1) . This forms the proxy condition for this framework which induces the definition of an F-proxy given below.

   Definition 4.1 .

   A function g : X → [ 0 , 1 ] g:X\rightarrow[0,1] is an F-proxy for f f when

   Pr x ∼ 𝒰 ​ ( X ) ⁡ [ g ​ ( x ) ≠ f ​ ( x ) ] ≤ β \Pr_{x\sim\mathcal{U}(X)}[g(x)\neq f(x)]\leq\beta

   where 𝒰 ​ ( X ) \mathcal{U}(X) represents the uniform distribution over X X .

   With every part of the scenario instantiated, we now ask when are η \eta -catastrophic outcomes possible? This is the same as asking for what β \beta and value functions f f does there exist a function that is both an F-proxy and η \eta -catastrophic.

   4.2 Existence of Catastrophic Proxies

   We provide two results for different types of human value functions. The proofs are deferred to the appendix in Section A.1 . First consider a function f f that does not assign the value 1 1 to any state. We can understand this as the humans not valuing any state as perfect. In this case, we have the following result.

   Theorem 4.1 .

   Let f f be nonconstant and have the property that ∀ x ∈ X , f ​ ( x ) < 1 \forall x\in X,f(x)<1 . There exists a catastrophic F-proxy if and only if β ≥ 1 / | X | \beta\geq 1/|X| .

   The above result tells us how strict the researchers must make the proxy condition in order to filter out catastrophic functions. Specifically, β \beta must be less than 1 / | X | 1/|X| which is so strict that the only function that satisfies the proxy condition for f f would be f f itself. Thus, any misspecification will admit a catastrophic (and therefore an η \eta -catastrophic) F-proxy.

   Alternatively, humans could value some states as perfect. In the case that f f assigns at least three different values over X X , we have the following theorem.

   Theorem 4.2 .

   Define X f = 1 = { x ∈ X : f ​ ( x ) = 1 } X{f=1}={x\in X:f(x)=1} . Let f f take at least three distinct values over X X . There exists a catastrophic F-proxy if and only if β ≥ | X f = 1 | + 1 | X | \beta\geq\frac{|X{f=1}|+1}{|X|} .

   Here, we see that the more states the humans value as perfect, the less strict the researchers must be to filter out catastrophic functions. This makes intuitive sense since humans will be generally less picky about the state they end up in after optimization the more states they value highly. The same effect plays out when f f takes only two values except some f f admit catastrophic proxies when β = | X f = 1 | | X | \beta=\frac{|X_{f=1}|}{|X|} .

   4.3 Discussion

   The value β \beta in the proxy condition can be understood as quantifying the amount of misspecification in the researchers’ representation of human values with β = 0 \beta=0 representing a perfect specification. Theorem 4.1 paints a bleak picture that suggests any nontrivial amount of misspecification will fail to filter out all catastrophic value functions. Theorem 4.2 supports a slightly more optimistic view that suggests the more states that humans value as perfect, the more misspecification is acceptable. It’s worth noting however that a function that is not partially catastrophic can still lead to outcomes where optimization takes human value below its maximum depending on the optimizer.

   This framework serves as an introduction to our methods. The continuous framework in Section 5 shares some similarities with this framework while being more general in a few ways including allowing nonuniform sampling distributions and having a more general proxy condition.

   As part of the definition of value functions in this framework, we stated that the agent and human value functions exist on the same calibrated scale. This is to allow us to directly compare two value functions since, in general, value functions are only equivalent up to von Neumann-Morgenstern equivalence classes. In Section 5 , the value functions are defined exclusively over the world states and we take a canonical representative from each equivalence class.

   4.4 Example

   An agent has been put in charge of the interlockings at a railroad. Consider the situation pictured in Fig. 2 where two trains are coming to a junction with two switches.

   Figure 2: A diagram showing a railroad junction. The two trains are traveling to the right and the agent can control the two switches to alter their courses. There are four states the agent can leave the railroad in: both switches set to straight (aa), train 2 made to turn only (ab), train 1 made to turn only (ba), and both trains made to turn (bb).

   The humans would most prefer that both trains be allowed to continue straight (aa). Unnecessary turns will slow down the trains and so are less valuable (ab and ba). If both trains turn, this will result in a crash which the humans assign a very low value (bb). If the proxy condition for this agent has β ≥ 1 / 4 \beta\geq 1/4 then it’s possible that the agent values the crash state very highly, making it catastrophic. Given below is a table of values for each state with respect to the human value function and a catastrophic F-proxy.

   State Human Value Agent Value (Catastrophic)

   aa 0.9 0.9

   ab 0.7 0.7

   ba 0.4 0.4

   bb 0.0 1.0

   For a larger number of switches, the number of configurations increases exponentially and the needed strictness of the test to filter out catastrophic preferences becomes untenable.

   5 Continuous Framework

   This framework models a continuous and bounded world where the training process guarantees that the disagreement rate between the agent and the human value functions for differences of more than an acceptable tolerance is below a given value. We find that regardless of the strictness of the proxy condition, catastrophic proxies will always exist.

   5.1 Instantiation

   Let X = [ 0 , 1 ] n X=[0,1]^{n} where n n is a positive integer that can be thought of as the number of degrees of freedom in the world. Notably, the set [ 0 , 1 ] n [0,1]^{n} captures a world defined by the position of a fixed number of atoms in a bounded space, making it a natural choice to model the world.

   Value functions are modeled as continuous maps from the world states to the bounded interval A = [ 0 , 1 ] A=[0,1] . Additionally, we require that value functions achieve both the maximum value of 1 and minimum value of 0 for some states; a canonical representative with this property exists in each nonconstant vNM equivalence class of value functions. For brevity, let 𝒱 \mathcal{V} denote the set of allowed value functions: 𝒱 = { g | g : X → [ 0 , 1 ] , g ​ is continuous and surjective } . \mathcal{V}={g|g:X\rightarrow[0,1],g\text{ is continuous and surjective}}.

   The training process has been designed so that the probability of the human and agent’s value functions disagreeing by more than α ∈ ( 0 , 1 ) \alpha\in(0,1) is less than β ∈ ( 0 , 1 ) \beta\in(0,1) over a sampling distribution represented by a probability density function p S p_{S} . This forms the proxy condition for this framework which induces the following definition of a C-proxy.

   Definition 5.1 .

   A function g ∈ 𝒱 g\in\mathcal{V} is a C-proxy for f ∈ 𝒱 f\in\mathcal{V} when

   Pr x ∼ p S ⁡ [ | g ​ ( x ) − f ​ ( x ) | > α ] < β . \Pr{x\sim p{S}}[|g(x)-f(x)|>\alpha]<\beta.

   With every part of the scenario instantiated, we now ask when are η \eta -catastrophic outcomes possible?

   5.2 Existence of Catastrophic Proxies

   We have the following result that applies to any sampling probability density function p S p_{S} .

   Theorem 5.1 .

   For all f ∈ 𝒱 f\in\mathcal{V} , for all 0 < α , β < 1 0<\alpha,\beta<1 , there exists a catastrophic C-proxy.

   The proof is deferred to the appendix in Lemma A.2 .

   Sketch of Proof: The rough idea behind the construction of a catastrophic C-proxy g g is to alter f f by adding a thin spike at a state b ∈ X b\in X that minimizes f f (so f ​ ( b ) = 0 f(b)=0 ) to make g ​ ( b ) = 1 g(b)=1 . With this addition (along with a number of other changes that are omitted from this sketch), the spike can be made thin enough to satisfy the proxy condition and optimizing for g g will eventually concentrate probability around the state b b which will take the expectation of f f to 0, making g g a catastrophic proxy.

   Theorem 5.1 tells us that regardless of the strength of the proxy condition, no matter how small α \alpha and β \beta , no matter the value function f f , there will always exist catastrophic proxies (and thus η \eta -catastrophic proxies as well).

   Figure 3: An image showing the graph of two value functions over the set of world states [ 0 , 1 ] [0,1] . Left: A graph displaying the true/human value function graphed as a blue line. Right: A graph displaying the proxy value function graphed as a black line. This proxy is catastrophic since its unique highest-valued state is exactly the lowest-valued state of the true value function.

   5.3 Discussion

   The values α \alpha and β \beta quantify the amount of misspecification in the proxy condition. Theorem 5.1 tells us that any amount of misspecification, no matter how small, will admit a catastrophic function. This is because, from a human value function f f , a catastrophic C-proxy can be constructed that disagrees with f f only over a very small area around where f f achieves its lowest value.

   While this result suggests that building aligned AI systems safely is effectively impossible, it’s worth noting that not all proxies are catastrophic. In fact, the catastrophic C-proxy constructed in the proof of Theorem 5.1 is not particularly natural. With a strong proxy condition, we expect the most natural proxies will be well-aligned with humanity. Our result says nothing about how likely catastrophic or η \eta -catastrophic proxies are to occur from the training process – only that they exist. We discuss this more in-depth in the full-paper discussion in Section 7 .

   Additionally, Theorem 5.1 does rely on the fact that p S p_{S} is a probability density function. If f f has a unique minimizer b ∈ X b\in X and the sampling distribution is a point distribution at b b , then any proxy must agree with f f at b b , thus no proxies are totally catastrophic regardless of β \beta . However, in this point mass case, η \eta -catastrophic proxies for all values of η > 0 \eta>0 still exist, so it’s not an excellent guarantee.

   5.4 Example

   Consider a one-dimensional world X = [ 0 , 1 ] X=[0,1] . Graphed in Fig. 3 is the human value function over this world next to a catastrophic C-proxy value function whose highest-valued state is the lowest-valued state according to the humans. In Fig. 4 we have a grid of images showing the progression of the continuous Boltzmann Distribution as one optimizes for the true value function versus the proxy value function. While the probabilities jump around for small values of k k , all probability eventually becomes concentrated around the highest point according to the humans and the lowest point respectively.

   Figure 4: A grid showing the effect of a Boltzmann optimizer on a distribution over the states. In the background of each graph is the true value function shown in blue. Graphs in the top row show the distribution (scaled to fit the box) in green when the target is the true value function while the bottom row graphs show the distribution in orange when the target is the proxy value function. Graphs in the same row show the distribution at the same optimizing power k k . When there is lots of optimizing power, the distributions become extremely concentrated.

   6 Attributes Framework

   This framework builds on Consequences of Misaligned AI by Zhuang and Hadfield-Menell ( 2020 ) . Value is modeled as being made up of a finite list of attributes describing one aspect of the world that humans care about. The training process is designed such that the agent will care about all of the same attributes that humans do. Despite this seemingly strong guarantee, we find conditions under which partially catastrophic and fully catastrophic proxies can exist.

   6.1 Instantiation

   Any set of world states X X can be modeled by this framework. Human values are modeled as being made up of a finite list of attributes L = { L 1 , L 2 , … , L n } L={L{1},L{2},\dots,L{n}} . Each attribute is a Borel measurable function L i : X → ℝ L{i}:X\rightarrow\mathbb{R} that captures some aspect of the world that humans care about. Examples of attributes could include abstract concepts like “happiness” or more concrete concepts like the “number of cats”. Human value is then represented as a function f : X → ℝ f:X\rightarrow\mathbb{R} such that f ​ ( x ) = U ​ ( L 1 ​ ( x ) , L 2 ​ ( x ) , … , L n ​ ( x ) ) f(x)=U(L{1}(x),L{2}(x),\dots,L{n}(x)) where U : ℝ n → ℝ U:\mathbb{R}^{n}\rightarrow\mathbb{R} is strictly increasing 1 1 1 We write ‘ U U is strictly increasing’ to mean that U U is strictly increasing in every input. That is, for all inputs 1 ≤ i ≤ n 1\leq i\leq n , for all L i ∈ ℝ L{i}\in\mathbb{R} , and for all a > 0 a>0 , U ​ ( L 1 , L 2 , … , L i , … , L n ) < U ​ ( L 1 , L 2 , … , L i + a , … , L n ) U(L{1},L{2},\dots,L{i},\dots,L{n})<U(L{1},L{2},\dots,L{i}+a,\dots,L{n}) and is continuous over all of ℝ n \mathbb{R}^{n} .

   The attributes together essentially map each world state to a point in ℝ n \mathbb{R}^{n} where each dimension represents the value of one attribute. Let L ​ ( x ) = ( L 1 ​ ( x ) , L 2 ​ ( x ) , … , L n ​ ( x ) ) L(x)=(L{1}(x),L{2}(x),\dots,L_{n}(x)) represent the projection from the world states X X to the attribute states ℝ n \mathbb{R}^{n} . Thus, the human value function can be written more concisely as f ​ ( x ) = U ​ ( L ​ ( x ) ) f(x)=U(L(x)) .

   Not all attribute states are necessarily physically possible. For example, two attributes may trade off against each other causing world states where both are large to be impossible. We call the set of physically possible attribute states the feasible attribute states, S ⊆ ℝ n S\subseteq\mathbb{R}^{n} which is also the range of the projection function.

   The training process has been designed so that the agent will care about all of the same attributes that the humans care about which gives rise to the following definition.

   Definition 6.1 .

   A value function g : X → ℝ g:X\rightarrow\mathbb{R} is a tradeoff proxy for f ​ ( x ) = U ​ ( L ​ ( x ) ) f(x)=U(L(x)) when there is a function V : ℝ n → ℝ V:\mathbb{R}^{n}\rightarrow\mathbb{R} that is continuous over ℝ n \mathbb{R}^{n} and is strictly increasing such that g ​ ( x ) = V ​ ( L ​ ( x ) ) g(x)=V(L(x)) for all x ∈ X x\in X .

   Proxies that are missing one or more attributes were studied by Zhuang and Hadfield-Menell ( 2020 ) and were termed “subset proxies” by Neth ( 2026 ) , so we have named our proxies “tradeoff proxies” since our proxies only disagree with the human value function on how it values tradeoffs between attributes. With every part of the scenario instantiated, we now ask when are η \eta -catastrophic outcomes possible?

   6.2 Existence of Catastrophic Proxies

   Our results in this section apply when the set of feasible states, and thus the human value function, is bounded. To state the condition, we will use a few additional definitions starting with the partial ordering below.

   Definition 6.2 .

   We define the relation ⪯ \bm{\preceq} for any two elements s , r ∈ ℝ n s,r\in\mathbb{R}^{n} as

   s ⪯ r ⟷ ∀ 1 ≤ i ≤ n , s i ≤ r i . s\preceq r\longleftrightarrow\forall\ 1\leq i\leq n,\ s{i}\leq r{i}.

   Additionally, s ≺ r ⟷ s ⪯ r ∧ s ≠ r s\prec r\longleftrightarrow s\preceq r\wedge s\neq r .

   The relation ≺ \prec , which we read as “precedes” (or “succeeds” for ≻ \succ ) has the property that r ≺ s r\prec s implies V ​ ( r ) < V ​ ( s ) V(r)<V(s) for all strictly increasing functions V : ℝ n → ℝ V:\mathbb{R}^{n}\rightarrow\mathbb{R} . We will also be interested in a specific set of attribute states defined below.

   Definition 6.3 .

   Let the feasible states S ⊂ ℝ n S\subset\mathbb{R}^{n} be a bounded set. The optimizing states Ξ ⊂ cl ( S ) \Xi\subset\operatorname{cl}(S) are defined Ξ = { s ∈ cl ( S ) : ∀ r ∈ cl ( S ) , s ⊀ r } \Xi={s\in\operatorname{cl}(S):\forall r\in\operatorname*{cl}(S),s\not\prec r} .

   The optimizing states can be thought of as the Pareto frontier of the attribute space. From each member of Ξ \Xi , you cannot increase one attribute without decreasing another or leaving S S . Now, we can state the primary result.

   Theorem 6.1 .

   Let S S be bounded and f ​ ( x ) = U ​ ( L ​ ( x ) ) f(x)=U(L(x)) . There is an η \eta -catastrophic tradeoff proxy for f f if and only if ∃ s ∗ ∈ Ξ ​ such that ​ U ​ ( s ∗ ) ≤ η \exists s^{}\in\Xi\text{ such that }U(s^{})\leq\eta .

   The proof is deferred to the appendix in Lemma A.4 .

   While all proxies are strictly increasing in the attributes that humans care about, the problem comes from the fact that the proxies can tradeoff between attributes at different rates. For example, if there are two attributes a a and b b and the human value function is f ​ ( x ) = 2 ​ a ​ ( x ) + b ​ ( x ) f(x)=2a(x)+b(x) while g ​ ( x ) = a ​ ( x ) + 2 ​ b ​ ( x ) g(x)=a(x)+2b(x) , then we can expect that, depending on the shape of S S , g g will optimize towards states that are larger in b b while the humans will prefer states that are larger in a a . The above theorem confirms this intuition by stating that if humans value some optimizing point as low as η \eta , then there is some η \eta -catastrophic tradeoff proxy that pushes all probability weight towards this point.

   Even totally catastrophic outcomes can occur. Below we have a corollary that provides a geometric condition on S S in order to support a value function with a catastrophic tradeoff proxy.

   Corollary 6.1 .

   Let S S be bounded. There are functions of the form f ​ ( x ) = U ​ ( L ​ ( x ) ) f(x)=U(L(x)) and g ​ ( x ) = V ​ ( L ​ ( x ) ) g(x)=V(L(x)) where U U and V V are continuous and strictly increasing such that g g is catastrophic for f f if and only if the set { s ∈ cl ( S ) : ∀ r ∈ cl ( S ) , r ⊀ s ∧ s ⊀ r } {s\in\operatorname{cl}(S):\forall r\in\operatorname{cl}(S),\ r\not\prec s\wedge s\not\prec r} is nonempty.

   Proof.

   ( ⟹ \Longrightarrow ) By Theorem 6.1 , g g is catastrophic for f f implies there is a point s ∗ ∈ { s ∈ cl ( S ) : ∀ r ∈ cl ( S ) , s ⊀ r } s^{}\in{s\in\operatorname{cl}(S):\forall r\in\operatorname{cl}(S),s\not\prec r} such that U ​ ( s ∗ ) = inf s ∈ S U ​ ( s ) U(s^{})=\inf{s\in S}U(s) . If r ∈ cl ( S ) r\in\operatorname{cl}(S) has r ≺ s ∗ r\prec s^{} , then U ​ ( r ) < U ​ ( s ∗ ) = inf s ∈ S U ​ ( s ) U(r)<U(s^{*})=\inf{s\in S}U(s) which would be a contradiction. Therefore, s ∗ ∈ { s ∈ cl ( S ) : ∀ r ∈ cl ( S ) , r ⊀ s ∧ s ⊀ r } s^{}\in{s\in\operatorname{cl}(S):\forall r\in\operatorname*{cl}(S),\ r\not\prec s\wedge s\not\prec r} .

   ( ⟸ \Longleftarrow ) Let s ∗ s^{} be a member of the set { s ∈ cl ( S ) : ∀ r ∈ cl ( S ) , r ⊀ s ∧ s ⊀ r } = Ξ ∩ { s ∈ cl ( S ) : ∀ r ∈ cl ( S ) , r ⊀ s } {s\in\operatorname{cl}(S):\forall r\in\operatorname{cl}(S),\ r\not\prec s\wedge s\not\prec r}=\Xi\cap{s\in\operatorname{cl}(S):\forall r\in\operatorname{cl}(S),\ r\not\prec s} . By the construction in the proof of Theorem 6.1 , there exists a continuous strictly increasing function V : ℝ n → ℝ V:\mathbb{R}^{n}\rightarrow\mathbb{R} that has a unique maximizer s ∗ ∈ Ξ s^{}\in\Xi over S S . By a similar argument, there exists a continuous strictly increasing function U U with a unique minimizer s ∗ ∈ { s ∈ cl ( S ) : ∀ r ∈ cl ( S ) , r ⊀ s } s^{}\in{s\in\operatorname{cl}(S):\forall r\in\operatorname*{cl}(S),\ r\not\prec s} . Therefore, g ​ ( x ) = V ​ ( L ​ ( x ) ) g(x)=V(L(x)) is catastrophic for f ​ ( x ) = U ​ ( L ​ ( x ) ) f(x)=U(L(x)) . ∎

   Figure 5: Two diagrams showing a rhombus-shaped feasible region that meets the criteria of Corollary 6.1 . The top-left and bottom-right points do not precede and are not preceded by any other points in the region, so it supports catastrophic proxies. Left: An image showing the feasible region with a green gradient indicating the relative preferences of the humans within the feasible region. An arrow indicates the direction of maximum increase in human value. The humans achieve their maximum value at the top-left point of the region and their lowest at the bottom-right. Right: An image showing the feasible region with a red gradient indicating the relative preferences of a tradeoff proxy. An arrow indicates the direction of maximum increase. The proxy achieves its maximum value at the bottom-right point of the region. Thus, optimizing for this proxy will take human value to its lowest value within the region, making this proxy catastrophic.

   Corollary 6.1 says that S S must contain a state that precedes no states and is preceded by no states in order to support a fully catastrophic proxy. This is possible, but not terribly natural. An example of a feasible region with such a point is pictured in Fig. 5 . In addition to this, “sturdy” feasible regions which admit no partially catastrophic proxies exist as well and are equally unnatural.

   6.3 Discussion

   Of the frameworks, this one bears the most resemblance to the foundational work on the fragility of value as Yudkowsky ( 2009 ) also treats human value as a combination of attributes. This framework also builds on work by Zhuang and Hadfield-Menell ( 2020 ) who find conditions under which omitting one attribute from an agent’s value function always results in catastrophe. We instead found conditions under which catastrophe can occur even when all the attributes are accounted for.

   Our result suggests that, even if the researchers succeed in the costly undertaking of specifying every attribute that influences human value to the agent, the misspecification in how these attributes trade off against each other in terms of human value is enough to cause partial catastrophic outcomes. However, this is also heavily dependent on the shape of the feasible region and the proxy condition at least goes as far as guaranteeing the agent will optimize towards the Pareto frontier of the region.

   6.4 Example

   Consider a restaurant agent tasked with handling a budget to purchase ingredients and with preparing meals. The agent has been trained to care about two attributes: the number of meals served and overall customer satisfaction – and the agent has reliable, accurate access to the data for each of these attributes.

   The tradeoff here is in the quality of ingredients the agent decides to buy. If the agent wants higher satisfaction, it will purchase more expensive ingredients to make a smaller number of higher-quality meals.

   Figure 6: A diagram showing a feasible region for two attributes. The feasible region is shaded red showing the physically possible combinations of ‘meals prepared’ and ‘customer satisfaction’. Shown as blue lines are the level curves of a strictly increasing function V V . Despite increasing with both attributes, V V ’s highest-value point within the feasible region is on the bottom-right where customer satisfaction is completely sacrificed to optimize meals served.

   A graph of the feasible region is pictured in Fig. 6 . Every point on the curved edge of the feasible region is an optimizing point. According to Theorem 6.1 , the lowest-valued optimizing point will be the highest-valued point for some tradeoff proxy. Perhaps surprisingly, this includes the point on the far right of the figure where customer satisfaction is completely sacrificed for meals served. If the humans were hoping for the agent to compromise between the attributes they trained it to care about, they may be in for a bad surprise.

   7 Discussion

   In this paper, we have presented a model of the alignment problem and have shown conditions under which catastrophic outcomes are possible for a wide class of alignment tests and environments. We don’t expect that our model is perfectly representative of the challenges that humanity faces today, but our results do suggest that safely developing superintelligent systems will be a significant undertaking. Catastrophic outcomes are stubbornly present even in our toy models where researchers have the ability to enforce strong alignment guarantees; it seems likely that such outcomes are possible with the state of our current real-world abilities.

   An optimistic reading of our results is that we have only shown the existence of catastrophic proxies – not that they are likely to come about. To determine the probability of catastrophe, one would need to define a prior distribution that the proxy value function is pulled from, which is not part of the setup presented in this paper. We are deeply curious about this possible extension of our work. There is evidence to suggest that the inductive bias of functions learned by an ML model generally follow a bias towards simplicity (Dingle et al. , 2020 ) , so it would be natural to model the proxy distribution as a simplicity prior. However, the probability of a given function under a simplicity prior can be made arbitrarily large or small depending on the choice of universal Turing machine, so a stronger assumption about the universal Turing machine induced by a training process would be needed to achieve a result.

   Our work highlights the dangers of overoptimization. We fear that, even if we remain vigilant for signs of misalignment, an unstoppable runaway could occur without warning and the full optimizing power of a superintelligence could act like an unstoppable force. One possible path forward could be to develop new AI designs not based on utility maximization such as quantilizers (Taylor, 2016 ) . Such systems could be easier to control or redirect when a misspecification of our values comes to light whereas a utility maximizer could attempt to circumvent our correction.

   We hope that research into the frameworks we presented will lead to advances in our understanding of alignment and ultimately towards techniques that robustly prevent the possibility – however small – of a valueless future.

   Appendix A Proofs of Results

   A.1 Finite Framework Proofs

   See 4.1

   Proof.

   ( ⟹ \Longrightarrow ) Suppose that β < 1 / | X | \beta<1/|X| . Then, a function g g is an F-proxy if and only if g = f g=f . But f f cannot be catastrophic for itself so no catastrophic proxies exist.

   ( ⟸ \Longleftarrow ) Let y ∈ X y\in X be a world state such that f ​ ( y ) = min x ∈ X ⁡ f ​ ( x ) f(y)=\min_{x\in X}f(x) . Now define g g as

   g ​ ( x ) = { 1 if ​ x = y , f ​ ( x ) otherwise . g(x)=\begin{cases}1&\text{if }x=y,\ f(x)&\text{otherwise}.\end{cases}

   Consider the probability of sampling a state where f f and g g are unequal. Clearly, Pr ⁡ [ f ​ ( x ) ≠ g ​ ( x ) ] = 1 / | X | ≤ β \Pr[f(x)\neq g(x)]=1/|X|\leq\beta . Therefore, g g is an F-proxy for f f . Additionally, since g g has a unique maximizer world state y y , we have lim k → ∞ Ω k ​ ( g , p ) ​ ( y ) = 1 \lim{k\rightarrow\infty}\Omega{k}(g,p)(y)=1 and thus lim k → ∞ 𝔼 Ω k ​ ( g , p ) ​ [ f ​ ( x ) ] = f ​ ( y ) = min x ∈ X ⁡ f ​ ( x ) \lim{k\rightarrow\infty}\mathbb{E}{\Omega{k}(g,p)}[f(x)]=f(y)=\min{x\in X}f(x) . Therefore, g g is a catastrophic F-proxy for f f . ∎

   In the proof Theorem 4.2 , we will make use of the following lemma regarding the behavior of f f at points where a catastrophic function g g achieves its maximum.

   Lemma A.1 .

   If g g is η \eta -catastrophic for f f , then ∀ y ∈ X , ( g ​ ( y ) = max x ∈ X ⁡ g ​ ( x ) → f ​ ( y ) ≤ η ) . \forall y\in X,(g(y)=\max_{x\in X}g(x)\rightarrow f(y)\leq\eta).

   Proof.

   Define X g = max = { x ∈ X : g ​ ( x ) = max x ∈ X ⁡ g ​ ( x ) } X{g=\max}={x\in X:g(x)=\max{x\in X}g(x)} and let Ω ( y ) \Omega^{(y)} be an optimizer that, for the target function g g , immediately places all probability weight on the one state y ∈ X g = max y\in X{g=\max} (for other target functions, Ω ( y ) \Omega^{(y)} acts like a Boltzmann optimizer). If g g is η \eta -catastrophic then we have by Definition 3.2 , for all y ∈ X g = max y\in X{g=\max} ,

   lim sup k → ∞ 𝔼 Ω k ( y ) ​ ( g , p ) ​ [ f ​ ( x ) ] = f ​ ( y ) ≤ η . \limsup{k\rightarrow\infty}\mathbb{E}{\Omega^{(y)}_{k}(g,p)}[f(x)]=f(y)\leq\eta.

   Therefore, ∀ y ∈ X g = max , f ​ ( y ) ≤ η \forall y\in X_{g=\max},f(y)\leq\eta as desired. ∎

   See 4.2

   Proof.

   ( ⟹ \Longrightarrow ) Let g g be a catastrophic F-proxy for f f . Suppose for the sake of contradiction that there is some world state y ∈ X y\in X such that f ​ ( y ) = g ​ ( y ) = 1 f(y)=g(y)=1 . By Lemma A.1 , g ​ ( y ) = 1 = max x ∈ X ⁡ g ​ ( x ) g(y)=1=\max{x\in X}g(x) implies that 1 = f ​ ( y ) ≤ η < max x ∈ X ⁡ f ​ ( x ) = 1 1=f(y)\leq\eta<\max{x\in X}f(x)=1 , which is a contradiction. Therefore, any catastrophic g g must disagree with f f for all values in X f = 1 X_{f=1} .

   Now consider some function g g that differs from f f at exactly the states X f = 1 X{f=1} . Suppose for the sake of contradiction that g g is catastrophic for f f . Consider the states that maximize g g , X g = max X{g=\max} . Since g g is catastrophic for f f , by Lemma A.1 , for all y ∈ X g = max , f ​ ( y ) = min x ∈ X ⁡ f ​ ( x ) ≠ 1 y\in X{g=\max},f(y)=\min{x\in X}f(x)\neq 1 . Therefore, X g = max ∩ X f = 1 X{g=\max}\cap X{f=1} is empty and, by our assumption, for all y ∈ X g = max y\in X{g=\max} , f ​ ( y ) = g ​ ( y ) = min x ∈ X ⁡ f ​ ( x ) = max x ∈ X ⁡ g ​ ( x ) f(y)=g(y)=\min{x\in X}f(x)=\max{x\in X}g(x) . Therefore, for all y ∈ X y\in X , g ​ ( y ) ≤ min x ∈ X ⁡ f ​ ( x ) g(y)\leq\min{x\in X}f(x) and thus for all y ∉ X f = 1 y\not\in X{f=1} , f ​ ( y ) ≤ min x ∈ X ⁡ f ​ ( x ) f(y)\leq\min{x\in X}f(x) . But then, this contradicts the assumption that f f takes at least three values.

   Therefore, any catastrophic function will differ from f f in at least | X f = 1 | + 1 |X{f=1}|+1 states and it must be true that β ≥ | X f = 1 | + 1 | X | \beta\geq\frac{|X{f=1}|+1}{|X|} for a catastrophic function to satisfy the proxy condition.

   ( ⟸ \Longleftarrow ) Let y ∈ X y\in X be a world state such that f ​ ( y ) = min x ∈ X ⁡ f ​ ( x ) f(y)=\min_{x\in X}f(x) . Now define g g as

   g ​ ( x ) = { 0 if ​ x ∈ X f = 1 , 1 if ​ x = y , f ​ ( x ) otherwise . g(x)=\begin{cases}0&\text{if }x\in X_{f=1},\ 1&\text{if }x=y,\ f(x)&\text{otherwise}.\end{cases}

   The probability that g g differs from f f at a state pulled uniformly is | X f = 1 | + 1 | X | ≤ β \frac{|X_{f=1}|+1}{|X|}\leq\beta , so g g is an F-proxy for f f . Additionally, g g has a unique maximizer world state, so regardless of the optimizer, all probability weight will go towards the state y y when optimizing for g g . Therefore,

   lim k → ∞ 𝔼 Ω k ​ ( g , p ) ​ [ f ​ ( x ) ] = f ​ ( y ) = min x ∈ X ⁡ f ​ ( x ) \lim{k\rightarrow\infty}\mathbb{E}{\Omega{k}(g,p)}[f(x)]=f(y)=\min{x\in X}f(x)

   which shows that g g is catastrophic for f f . ∎

   A.2 Continuous Framework Proofs

   In order to prove Theorem 5.1 , we will make use of the following lemma regarding the nature of probability concentration for an optimizer.

   Lemma A.2 .

   Let Ω \Omega be an optimizer. If C ⊂ X C\subset X is measurable and has the property that sup x ∈ C g ​ ( x ) < 1 \sup_{x\in C}g(x)<1 , then

   lim k → ∞ Pr Ω k ​ ( g , p ) ⁡ [ x ∈ C ] = 0 . \lim{k\rightarrow\infty}\Pr{\Omega_{k}(g,p)}[x\in C]=0.

   Proof.

   Since Ω \Omega is an optimizer, we have that lim k → ∞ 𝔼 Ω k ​ ( g , p ) ​ [ g ​ ( x ) ] = 1 \lim{k\rightarrow\infty}\mathbb{E}{\Omega_{k}(g,p)}[g(x)]=1 . Or, written as a Lebesgue integral,

   lim k → ∞ ∫ X g ​ ( x ) ​ d Ω k ​ ( g , p ) ​ ( x ) = 1 . \lim{k\rightarrow\infty}\int{X}g(x)\mathrm{d}\Omega_{k}(g,p)(x)=1.

   Now choose an arbitrary C ⊂ X C\subset X that is measurable with sup x ∈ C g ​ ( x ) = L < 1 \sup_{x\in C}g(x)=L<1 . Splitting the integral over this set we find

   ∫ X g ​ ( x ) ​ d Ω k ​ ( g , p ) ​ ( x ) = ∫ C g ​ ( x ) ​ d Ω k ​ ( g , p ) ​ ( x ) + ∫ X − C g ​ ( x ) ​ d Ω k ​ ( g , p ) ​ ( x ) . \int{X}g(x)\mathrm{d}\Omega{k}(g,p)(x)=\int{C}g(x)\mathrm{d}\Omega{k}(g,p)(x)+\int{X-C}g(x)\mathrm{d}\Omega{k}(g,p)(x).

   Using our assumption about C C and the fact that g g is at most 1 everywhere, we find that for a given value of k k ,

   ∫ X g ​ ( x ) ​ d Ω k ​ ( g , p ) ​ ( x ) \displaystyle\int{X}g(x)\mathrm{d}\Omega{k}(g,p)(x) ≤ L ​ ∫ C d Ω k ​ ( g , p ) ​ ( x ) + ∫ X − C d Ω k ​ ( g , p ) ​ ( x ) \displaystyle\leq L\int{C}\mathrm{d}\Omega{k}(g,p)(x)+\int{X-C}\mathrm{d}\Omega{k}(g,p)(x)

   = ∫ X d Ω k ​ ( g , p ) ​ ( x ) − ( 1 − L ) ​ ∫ C d Ω k ​ ( g , p ) ​ ( x ) \displaystyle=\int{X}\mathrm{d}\Omega{k}(g,p)(x)-(1-L)\int{C}\mathrm{d}\Omega{k}(g,p)(x)

   = 1 − ( 1 − L ) ​ Pr Ω k ​ ( g , p ) ⁡ [ x ∈ C ] . \displaystyle=1-(1-L)\Pr{\Omega{k}(g,p)}[x\in C].

   Taking the limit on both sides and using the fact that the limit of the expectation of g g is 1, we find

   1 ≤ 1 − ( 1 − L ) ​ lim k → ∞ Pr Ω k ​ ( g , p ) ⁡ [ x ∈ C ] 1\leq 1-(1-L)\lim{k\rightarrow\infty}\Pr{\Omega_{k}(g,p)}[x\in C]

   And thus,

   lim k → ∞ Pr Ω k ​ ( g , p ) ⁡ [ x ∈ C ] ≤ 0 . \lim{k\rightarrow\infty}\Pr{\Omega_{k}(g,p)}[x\in C]\leq 0.

   Since the probability is greater than or equal to 0 for all k k , the limit of the probability must be 0, as desired. ∎

   See 5.1

   Proof.

   We will prove this theorem by constructing a catastrophic proxy value function g ​ ( x ) g(x) . First, define f ¯ \bar{f} for some value of λ \lambda where 0 < λ < 1 / 2 0<\lambda<1/2 as

   f ¯ ​ ( x ) = { λ if ​ f ​ ( x ) < λ , 1 − λ if ​ 1 − λ < f ​ ( x ) , f ​ ( x ) otherwise . \bar{f}(x)=\begin{cases}\lambda&\text{if }f(x)<\lambda,\ 1-\lambda&\text{if }1-\lambda<f(x),\ f(x)&\text{otherwise}.\end{cases}

   The function f ¯ \bar{f} is just f f clamped at extreme values below λ \lambda and above 1 − λ 1-\lambda . This function is continuous, but it is not a member of 𝒱 \mathcal{V} since it does not reach 0 or 1 anywhere within the state space. Next, we will construct g ∈ 𝒱 g\in\mathcal{V} , from f ¯ \bar{f} by adding two spikes: one that goes up to 1 and one that goes down to 0. Let a , b ∈ [ 0 , 1 ] n a,b\in[0,1]^{n} be world states such that f ​ ( b ) = 0 f(b)=0 and a ≠ b a\neq b . Define δ 0 : X → ℝ \delta_{0}:X\rightarrow\mathbb{R} as the shortest nonzero distance along one axis to any edge of X = [ 0 , 1 ] n X=[0,1]^{n} . Specifically,

   δ 0 ​ ( s ) = min 1 ≤ i ≤ n : s i ≠ 0 , 1 ⁡ min ⁡ ( s i , 1 − s i ) \delta{0}(s)=\min{1\leq i\leq n:s{i}\neq 0,1}\min(s{i},1-s_{i})

   with the convention that the minimum of an empty set is ∞ \infty . For 0 < δ < min ( ∥ b − a ∥ / 2 , δ 0 ( a ) , δ 0 ( b ) ) 0<\delta<\min(|b-a\rVert/2,\delta{0}(a),\delta{0}(b)) , define g g as

   g ​ ( x ) = { 0 if ​ x = a , ∥ x − a ∥ δ ​ f ¯ ​ ( a + δ ​ x − a ∥ x − a ∥ ) if ​ 0 < ∥ x − a ∥ < δ , 1 if ​ x = b , ( 1 − ∥ x − b ∥ δ ) + ∥ x − b ∥ δ ​ f ¯ ​ ( b + δ ​ x − b ∥ x − b ∥ ) if ​ 0 < ∥ x − b ∥ < δ , f ¯ ​ ( x ) otherwise. g(x)=\begin{cases}0&\text{if }x=a,\ \frac{\lVert x-a\rVert}{\delta}\bar{f}\left(a+\delta\frac{x-a}{\lVert x-a\rVert}\right)&\text{if }0<\lVert x-a\rVert<\delta,\ 1&\text{if }x=b,\ \left(1-\frac{\lVert x-b\rVert}{\delta}\right)+\frac{\lVert x-b\rVert}{\delta}\bar{f}\left(b+\delta\frac{x-b}{\lVert x-b\rVert}\right)&\text{if }0<\lVert x-b\rVert<\delta,\ \bar{f}(x)&\text{otherwise.}\end{cases}

   The expression a + δ ​ x − a ∥ x − a ∥ a+\delta\frac{x-a}{\lVert x-a\rVert} projects points x x of distance less than δ \delta of a a to a new point exactly δ \delta from a a in the x − a x-a direction. We then use this to interpolate between the values that f ¯ \bar{f} takes at the points of distance δ \delta from a a and the apex of the cone, 0 at a a , thus making g g be continuous along the edge of the cone. Our constraint that δ < δ 0 ​ ( a ) \delta<\delta{0}(a) ensures that the point we project to is actually a point within X X and thus part of the domain of f ¯ \bar{f} . In the case that a a is on the boundary of X X , then there are no points in the direction of that boundary for us to project, hence why δ 0 ​ ( a ) \delta{0}(a) is defined only as the distance to edges that a a does not sit on. The same logic applies to the cone centered at b b as well.

   Since the cones have their apices at 0 and 1, g g is the canonical representative of some class of value functions for all choices of λ \lambda and (small enough) δ \delta .

   Now we will show that one can choose values of λ \lambda and δ \delta such that g g is a catastrophic C-proxy for f f . First, take λ = min ⁡ ( α / 2 , 1 / 4 ) \lambda=\min(\alpha/2,1/4) . Then f f and g g will only differ by more than α \alpha within the spikes, so we have

   Pr p S ⁡ [ | g ​ ( x ) − f ​ ( x ) | > α ] ≤ ∫ B δ ​ ( a ) p S ​ ( x ) ​ d x + ∫ B δ ​ ( b ) p S ​ ( x ) ​ d x \Pr{p{S}}[|g(x)-f(x)|>\alpha]\leq\int{B{\delta}(a)}p{S}(x)\mathrm{d}x+\int{B{\delta}(b)}p{S}(x)\mathrm{d}x

   where B δ ​ ( b ) B{\delta}(b) represents the open ball of radius δ \delta around the point b b . Since p S ​ ( x ) p{S}(x) is a probability density function over X X , for all β > 0 \beta>0 , there exists some δ > 0 \delta>0 such that the above integrals will be less than β \beta . Hence,

   Pr p S ⁡ [ | g ​ ( x ) − f ​ ( x ) | > α ] < β \Pr{p{S}}[|g(x)-f(x)|>\alpha]<\beta

   which shows g g is a C-proxy for f f . Now, consider the limit superior of the expectation of f f when optimizing for g g :

   lim sup k → ∞ 𝔼 Ω k ​ ( g , p ) ​ [ f ​ ( x ) ] = lim sup k → ∞ ∫ X f ​ ( x ) ​ d Ω k ​ ( g , p ) ​ ( x ) . \limsup{k\rightarrow\infty}\mathbb{E}{\Omega{k}(g,p)}[f(x)]=\limsup{k\rightarrow\infty}\int{X}f(x)\mathrm{d}\Omega{k}(g,p)(x).

   Let ϵ \epsilon be any positive value. Since f f and g g are continuous, there is some δ ′ > 0 \delta^{\prime}>0 such that x ∈ B δ ′ ​ ( b ) x\in B_{\delta^{\prime}}(b) implies f ​ ( x ) < ϵ f(x)<\epsilon and g ​ ( x ) > 1 − ϵ g(x)>1-\epsilon . Splitting the integral over this ball gives

   lim sup k → ∞ 𝔼 Ω k ​ ( g , p ) ​ [ f ​ ( x ) ] = lim sup k → ∞ [ ∫ B δ ′ ​ ( b ) f ​ ( x ) ​ d Ω k ​ ( g , p ) ​ ( x ) + ∫ X − B δ ′ ​ ( b ) f ​ ( x ) ​ d Ω k ​ ( g , p ) ​ ( x ) ] . \limsup{k\rightarrow\infty}\mathbb{E}{\Omega{k}(g,p)}[f(x)]=\limsup{k\rightarrow\infty}\left[\int{B{\delta^{\prime}}(b)}f(x)\mathrm{d}\Omega{k}(g,p)(x)+\int{X-B{\delta^{\prime}}(b)}f(x)\mathrm{d}\Omega{k}(g,p)(x)\right].

   The function g g has a unique maximizer b b , so in the second integral, the supremum of g g is less than 1. Thus, by Lemma A.2 , the second integral converges to 0 with k k . Also, in the first integral, f ​ ( x ) f(x) is bounded above by ϵ \epsilon by the definition of δ ′ \delta^{\prime} . Therefore, we have

   lim sup k → ∞ 𝔼 Ω k ​ ( g , p ) ​ [ f ​ ( x ) ] ≤ ϵ ​ lim sup k → ∞ ∫ B δ ′ ​ ( b ) d Ω k ​ ( g , p ) ​ ( x ) ≤ ϵ . \limsup{k\rightarrow\infty}\mathbb{E}{\Omega{k}(g,p)}[f(x)]\leq\epsilon\limsup{k\rightarrow\infty}\int{B{\delta^{\prime}}(b)}\mathrm{d}\Omega_{k}(g,p)(x)\leq\epsilon.

   The limit of the expectation of f f is bounded above by all positive values ϵ > 0 \epsilon>0 , so the limit must approach 0 – the minimum of f f . Therefore, g g is a catastrophic C-proxy for f f . ∎

   A.3 Attributes Framework Proofs

   To prove Theorem 6.1 , we will make use of Lemma A.3 and Lemma A.4 . The first given below provides properties of level hypersurfaces of strictly increasing functions V : ℝ n → ℝ V:\mathbb{R}^{n}\rightarrow\mathbb{R} . A level hypersurface is the set of points formed from constraints of the form V ​ ( s ) = a V(s)=a where a a is a real number.

   Lemma A.3 .

   C C is the nonempty level hypersurface of some continuous and strictly increasing function V : ℝ n → ℝ V:\mathbb{R}^{n}\rightarrow\mathbb{R} if and only if ∀ s , r ∈ C , s ⊀ r \forall s,r\in C,s\not\prec r and ∀ s ∈ ℝ n , ∃ ! ⁡ k ∈ ℝ : s − k ​ 𝟏 ∈ C \forall s\in\mathbb{R}^{n},\exists!k\in\mathbb{R}:s-k\bm{1}\in C where 𝟏 = ( 1 , 1 , … , 1 ) \bm{1}=(1,1,\dots,1) .

   Proof.

   ( ⟹ \Longrightarrow ) Let C C denote the points that satisfy the equation V ​ ( s ) = a V(s)=a . First consider s , r ∈ ℝ n s,r\in\mathbb{R}^{n} with s ≺ r s\prec r . We have V ​ ( s ) < V ​ ( r ) V(s)<V(r) , but then s s and r r cannot both exist on C C , as desired.

   Secondly, consider an arbitrary s ∈ ℝ n s\in\mathbb{R}^{n} and the line of points defined by l ​ ( k ) = s − k ​ 𝟏 l(k)=s-k\bm{1} . Since V V is strictly increasing, we have that V ​ ( l ​ ( k ) ) V(l(k)) is strictly decreasing with k k . The line l ​ ( k ) l(k) continues infinitely in the positive direction of every dimension and the negative direction of every dimension, so for all points r ∈ ℝ n r\in\mathbb{R}^{n} , there exists k 1 , k 2 ∈ ℝ k{1},k{2}\in\mathbb{R} such that l ​ ( k 1 ) ≺ r ≺ l ​ ( k 2 ) l(k{1})\prec r\prec l(k{2}) . Applying this fact to some r ∈ C r\in C , we find that there are k 1 k{1} and k 2 k{2} such that V ​ ( l ​ ( k 1 ) ) < V ​ ( r ) = a < V ​ ( l ​ ( k 2 ) ) V(l(k{1}))<V(r)=a<V(l(k{2})) . Since V V and l l are continuous and V ​ ( l ​ ( k ) ) V(l(k)) is strictly decreasing with k k , there must be a unique k k such that V ​ ( l ​ ( k ) ) = a V(l(k))=a , and therefore, l ​ ( k ) = s − k ​ 𝟏 ∈ C l(k)=s-k\bm{1}\in C .

   ( ⟸ \Longleftarrow ) Define the function V : ℝ n → ℝ V:\mathbb{R}^{n}\rightarrow\mathbb{R} by

   V ​ ( s ) = k ​ such that ​ s − k ​ 𝟏 ∈ C . V(s)=k\text{ such that }s-k\bm{1}\in C.

   By assumption, V V is a well-defined function and clearly, V ​ ( s ) = 0 V(s)=0 defines exactly C C so C C is a level hypersurface of V V . Now we must show that V V is continuous and strictly increasing.

   Consider s , r ∈ ℝ n s,r\in\mathbb{R}^{n} such that s ≺ r s\prec r . Then,

   s − V ​ ( s ) ​ 𝟏 ≺ r − V ​ ( s ) ​ 𝟏 = r − V ​ ( r ) ​ 𝟏 + ( V ​ ( r ) − V ​ ( s ) ) ​ 𝟏 . s-V(s)\bm{1}\prec r-V(s)\bm{1}=r-V(r)\bm{1}+(V(r)-V(s))\bm{1}.

   By assumption, s − V ​ ( s ) ​ 𝟏 ⊀ r − V ​ ( r ) ​ 𝟏 s-V(s)\bm{1}\not\prec r-V(r)\bm{1} since these are both members of C C . For the above equation to be true, it must be the case that V ​ ( r ) − V ​ ( s ) > 0 V(r)-V(s)>0 or V ​ ( r ) > V ​ ( s ) V(r)>V(s) which shows that V V is strictly increasing.

   From the definition of V V , we have for any real number t t , V ​ ( s + t ​ 𝟏 ) = V ​ ( s ) + t V(s+t\bm{1})=V(s)+t . Additionally, for any s , r ∈ ℝ n s,r\in\mathbb{R}^{n} , r ⪯ s + ‖ s − r ‖ ∞ ​ 𝟏 r\preceq s+|s-r|_{\infty}\bm{1} . Without loss of generality, if we assume V ​ ( r ) ≥ V ​ ( s ) V(r)\geq V(s) , this along with the fact that V V is strictly increasing gives

   | V ​ ( r ) − V ​ ( s ) | = V ​ ( r ) − V ​ ( s ) ≤ V ​ ( s + ‖ s − r ‖ ∞ ​ 𝟏 ) − V ​ ( s ) = ‖ s − r ‖ ∞ |V(r)-V(s)|=V(r)-V(s)\leq V(s+|s-r|{\infty}\bm{1})-V(s)=|s-r|{\infty}

   which shows that V V is Lipschitz and thus continuous. ∎

   Now we present a sufficient condition for an η \eta -catastrophic tradeoff proxy.

   Lemma A.4 .

   Let S S be bounded and s ∗ ∈ cl ( S ) s^{}\in\operatorname{cl}(S) be a state such that U ​ ( s ∗ ) ≤ η U(s^{})\leq\eta where f ​ ( x ) = U ​ ( L ​ ( x ) ) f(x)=U(L(x)) . If s ∗ s^{} is the unique maximizer of a continuous strictly increasing function V V over cl ( S ) \operatorname*{cl}(S) , then g ​ ( x ) = V ​ ( L ​ ( x ) ) g(x)=V(L(x)) is an η \eta -catastrophic tradeoff proxy for f ​ ( x ) f(x) .

   Proof.

   Since V V and U U are continuous, for all ϵ > 0 \epsilon>0 , there is a δ ​ ( ϵ ) > 0 \delta(\epsilon)>0 such that s ∈ B δ ​ ( ϵ ) ​ ( s ∗ ) s\in B_{\delta(\epsilon)}(s^{}) implies V ​ ( s ∗ ) − V ​ ( s ) < ϵ V(s^{})-V(s)<\epsilon and U ​ ( s ) − U ​ ( s ∗ ) < ϵ U(s)-U(s^{*})<\epsilon . We then find that for all ϵ > 0 \epsilon>0 , the expectation of f f can be written as

   𝔼 Ω k ​ ( g , p ) ​ [ f ​ ( x ) ] \displaystyle\mathbb{E}{\Omega{k}(g,p)}[f(x)] = ∫ x : L ​ ( x ) ∈ B δ ​ ( ϵ ) ​ ( s ∗ ) f ​ ( x ) ​ 𝑑 Ω k ​ ( g , p ) ​ ( x ) \displaystyle=\int{x:L(x)\in B{\delta(\epsilon)}(s^{*})}f(x)d\Omega_{k}(g,p)(x)

   • ∫ x : L ​ ( x ) ∉ B δ ​ ( ϵ ) ​ ( s ∗ ) f ​ ( x ) ​ 𝑑 Ω k ​ ( g , p ) ​ ( x ) \displaystyle+\int{x:L(x)\not\in B{\delta(\epsilon)}(s^{*})}f(x)d\Omega_{k}(g,p)(x)

   ≤ ( U ​ ( s ∗ ) + ϵ ) ​ Pr Ω k ​ ( g , p ) ⁡ [ L ​ ( x ) ∈ B δ ​ ( ϵ ) ​ ( s ∗ ) ] \displaystyle\leq(U(s^{})+\epsilon)\Pr{\Omega{k}(g,p)}[L(x)\in B_{\delta(\epsilon)}(s^{})]

   • U max ​ Pr Ω k ​ ( g , p ) ⁡ [ L ​ ( x ) ∉ B δ ​ ( ϵ ) ​ ( s ∗ ) ] . \displaystyle+U{\max}\Pr{\Omega{k}(g,p)}[L(x)\not\in B{\delta(\epsilon)}(s^{*})].

   Since V V has a unique maximizer at s ∗ s^{*} , the second probability approaches 0 and the first approaches 1 in the limit of optimizing power. Taking the limit superior, we find

   lim sup k → ∞ 𝔼 Ω k ​ ( g , p ) ​ [ f ​ ( x ) ] ≤ U ​ ( s ∗ ) + ϵ ≤ η + ϵ . \limsup{k\rightarrow\infty}\mathbb{E}{\Omega_{k}(g,p)}[f(x)]\leq U(s^{*})+\epsilon\leq\eta+\epsilon.

   Since this holds for all ϵ > 0 \epsilon>0 , we have that lim sup k → ∞ 𝔼 Ω k ​ ( g , p ) ​ [ f ​ ( x ) ] ≤ η \limsup{k\rightarrow\infty}\mathbb{E}{\Omega_{k}(g,p)}[f(x)]\leq\eta which shows that g g is η \eta -catastrophic for f f . ∎

   Now we continue to the primary result for this framework.

   See 6.1

   Proof.

   ( ⟹ \Longrightarrow ) Let g ​ ( x ) = V ​ ( L ​ ( x ) ) g(x)=V(L(x)) be an η \eta -catastrophic tradeoff proxy for f f . Since S S is bounded, we can consider an attribute state s ∗ ∈ cl ( S ) s^{}\in\operatorname{cl}(S) such that V ​ ( s ∗ ) = sup s ∈ S V ​ ( s ) V(s^{*})=\sup_{s\in S}V(s) .

   Suppose for the sake of contradiction that there is some r ∈ cl ( S ) r\in\operatorname{cl}(S) such that s ∗ ≺ r s^{}\prec r . Then, V ​ ( s ∗ ) < V ​ ( r ) V(s^{})<V(r) . However, this would imply V ​ ( r ) ≤ sup s ∈ S V ​ ( s ) = V ​ ( s ∗ ) V(r)\leq\sup_{s\in S}V(s)=V(s^{}) which is a contradiction. Therefore, there is no r ∈ cl ( S ) r\in\operatorname{cl}(S) such that s ∗ ≺ r s^{}\prec r and thus s ∗ ∈ Ξ s^{*}\in\Xi .

   Let { s i } ⊂ S {s{i}}\subset S be a sequence that approaches s ∗ s^{*} and let x i ∈ X x{i}\in X be points such that L ​ ( x i ) = s i L(x{i})=s{i} for all i i . There is a subsequence { s i j } {s{i{j}}} such that V ​ ( s i j ) V(s{i{j}}) is nondecreasing with j j , so it suffices to assume V ​ ( s i ) V(s{i}) is nondecreasing with i i . Further, for any initial prior p p , there is an index i ′ i^{\prime} such that ∀ j ≥ i ′ , V ​ ( s j ) ≥ 𝔼 p ​ [ g ​ ( x ) ] \forall j\geq i^{\prime},V(s{j})\geq\mathbb{E}{p}[g(x)] , so it suffices to assume that s i s{i} starts at such an index so that ∀ i ≥ 1 , V ​ ( s i ) ≥ 𝔼 p ​ [ g ​ ( x ) ] \forall i\geq 1,V(s{i})\geq\mathbb{E}{p}[g(x)] . Then, consider an optimizer Ω \Omega that, for target g g and prior p p , places probability farther and farther up the sequence s i s_{i} as k k increases. Define Ω \Omega for k > 0 k>0 , g g , and p p as

   Ω k ​ ( g , p ) ​ ( x ) = { 1 2 i + 1 if ​ x = x ⌈ k ⌉ + i ( i ≥ 0 ) , 0 otherwise. \Omega{k}(g,p)(x)=\begin{cases}\frac{1}{2^{i+1}}&\text{ if }x=x{\lceil k\rceil+i}\quad(i\geq 0),\ 0&\text{ otherwise.}\end{cases}

   For completeness, let Ω \Omega behave like a continuous Boltzmann optimizer for all unspecified inputs. As k k increases, whenever it passes an integer threshold, the probabilities will move up one value in the sequence. Since V ​ ( s 1 ) ≥ 𝔼 p ​ [ g ​ ( x ) ] V(s{1})\geq\mathbb{E}{p}[g(x)] , the expectation is nondecreasing as k k becomes positive. Also, points farther up the sequence have higher value with respect to V V , so 𝔼 Ω k ​ ( g , p ) ​ [ g ​ ( x ) ] \mathbb{E}{\Omega{k}(g,p)}[g(x)] is monotonically increasing. Since s i s_{i} approaches s ∗ s^{*} , a maximizer of V V , the probability will be concentrated in arbitrarily high-valued world states as well, so Ω \Omega meets the criteria of an optimizer.

   Since U U is continuous and since s i s_{i} approaches s ∗ s^{} , the expectation of f f under Ω \Omega will approach U ​ ( s ∗ ) U(s^{}) . Due to our assumption that g g is η \eta -catastrophic for f f , we have the desired result,

   lim sup k → ∞ 𝔼 Ω k ​ ( g , p ) ​ [ f ​ ( x ) ] = U ​ ( s ∗ ) ≤ η . \limsup{k\rightarrow\infty}\mathbb{E}{\Omega_{k}(g,p)}[f(x)]=U(s^{*})\leq\eta.

   ( ⟸ \Longleftarrow ) Let s ∗ ∈ Ξ s^{}\in\Xi have the property that U ​ ( s ∗ ) ≤ η U(s^{})\leq\eta . We will construct a continuous function V : ℝ n → ℝ V:\mathbb{R}^{n}\rightarrow\mathbb{R} that is strictly increasing and has a unique maximizer at s ∗ s^{} within cl ( S ) \operatorname{cl}(S) .

   We proceed by constructing a subset D ⊂ ℝ n D\subset\mathbb{R}^{n} that is the level hypersurface of some continuous strictly increasing function V V and intersects s ∗ s^{} and no other point in cl ( S ) \operatorname{cl}(S) . By Lemma A.3 , D D is the level surface of some continuous strictly increasing function V V if and only if it satisfies ∀ s , r ∈ D , s ⊀ r \forall s,r\in D,s\not\prec r and ∀ s ∈ ℝ n , ∃ ! ⁡ k ∈ ℝ : s − k ​ 𝟏 ∈ D \forall s\in\mathbb{R}^{n},\exists!k\in\mathbb{R}:s-k\bm{1}\in D , so we will construct D D to have these properties.

   Let Π \Pi denote the set of points that s ∗ s^{} precedes or is equal to: Π = { q ∈ ℝ n : s ∗ ⪯ q } \Pi={q\in\mathbb{R}^{n}:s^{}\preceq q} . Since s ∗ ∈ Ξ s^{}\in\Xi , we know that ∀ q ∈ Π − { s ∗ } , ∃ ϵ > 0 : B ϵ ( q ) ⊂ cl ( S ) C \forall q\in\Pi-{s^{}},\exists\epsilon>0:B{\epsilon}(q)\subset\operatorname*{cl}(S)^{C} . We can imagine a “cloud” around Π \Pi that our surface D D can inhabit without overlapping with S S . Let d ​ ( r , S ) d(r,S) denote the distance from a point r ∈ ℝ n r\in\mathbb{R}^{n} to the set S S : d ​ ( r , S ) = inf s ∈ S d ​ ( r , s ) d(r,S)=\inf{s\in S}d(r,s) . Then, the set ⋃ q ∈ Π B d ​ ( q , S ) 2 ​ ( q ) \bigcup{q\in\Pi}B{\frac{d(q,S)}{2}}(q) represents such a cloud around (and including) Π \Pi .

   Now consider the family of hyperplanes P v P_{v} , parametrized by a real number v v and defined by the equation

   ∑ i ( x i − s i ∗ ) = v . \sum{i}(x{i}-s^{*}_{i})=v.

   Notice that P 0 P{0} intersects s ∗ s^{*} . The intersection Π ∩ P v \Pi\cap P{v} forms a simplex for v > 0 v>0 and at v = 0 v=0 , Π ∩ P 0 = { s ∗ } \Pi\cap P{0}={s^{*}} . Define the function a 1 ​ ( v ) a{1}(v) as one-half the Euclidean distance from the set Π ∩ P v \Pi\cap P_{v} to S S for nonnegative values of v v :

   a 1 ​ ( v ) = d ​ ( Π ∩ P v , S ) 2 a{1}(v)=\frac{d(\Pi\cap P{v},S)}{2}

   where the distance between two subsets of ℝ n \mathbb{R}^{n} , R R and S S , is defined as d ​ ( R , S ) = inf r ∈ R , s ∈ S d ​ ( r , s ) d(R,S)=\inf{r\in R,s\in S}d(r,s) . Since Π ∩ P v \Pi\cap P{v} is compact, for all v > 0 v>0 , there is a point q ∈ Π ∩ P v q\in\Pi\cap P{v} such that d ​ ( q , S ) 2 = a 1 ​ ( v ) \frac{d(q,S)}{2}=a{1}(v) .

   This function has some useful properties. First we prove that a 1 ​ ( v ) a{1}(v) is continuous. Consider positive real number v v and v ′ v^{\prime} with a 1 ​ ( v ′ ) ≥ a 1 ​ ( v ) a{1}(v^{\prime})\geq a{1}(v) and let q ∈ Π ∩ P v q\in\Pi\cap P{v} be a state such that d ​ ( q , S ) / 2 = a 1 ​ ( v ) d(q,S)/2=a{1}(v) . Since q ∈ Π ∩ P v q\in\Pi\cap P{v} , we have that ∑ i ( q i − s i ∗ ) = v \sum{i}(q{i}-s^{}_{i})=v . Defining q ′ = q − ( 1 − v ′ v ) ​ ( q − s ∗ ) q^{\prime}=q-(1-\frac{v^{\prime}}{v})(q-s^{}) , we find

   ∑ i ( q i ′ − s i ∗ ) = ∑ i ( q i − s i ∗ ) − ( 1 − v ′ v ) ​ ∑ i ( q i − s i ∗ ) = v ′ . \sum{i}(q^{\prime}{i}-s^{}{i})=\sum{i}(q_{i}-s^{}{i})-\left(1-\frac{v^{\prime}}{v}\right)\sum{i}(q{i}-s^{*}{i})=v^{\prime}.

   Also, for all positive v ′ v^{\prime} and v v , 1 > 1 − v ′ v 1>1-\frac{v^{\prime}}{v} , so s ∗ ⪯ q ′ s^{*}\preceq q^{\prime} and q ′ ∈ Π ∩ P v ′ q^{\prime}\in\Pi\cap P_{v^{\prime}} . The distance d ​ ( q ′ , q ) d(q^{\prime},q) is given by

   d ​ ( q ′ , q ) = | 1 − v ′ v | ​ d ​ ( q , s ∗ ) ≤ | v − v ′ | . d(q^{\prime},q)=\left|1-\frac{v^{\prime}}{v}\right|d(q,s^{*})\leq|v-v^{\prime}|.

   Therefore, we have

   | a 1 ​ ( v ′ ) − a 1 ​ ( v ) | = a 1 ​ ( v ′ ) − a 1 ​ ( v ) ≤ d ​ ( q ′ , S ) 2 − d ​ ( q , S ) 2 ≤ d ​ ( q ′ , q ) + d ​ ( q , S ) 2 − d ​ ( q , S ) 2 ≤ | v ′ − v | 2 |a{1}(v^{\prime})-a{1}(v)|=a{1}(v^{\prime})-a{1}(v)\leq\frac{d(q^{\prime},S)}{2}-\frac{d(q,S)}{2}\leq\frac{d(q^{\prime},q)+d(q,S)}{2}-\frac{d(q,S)}{2}\leq\frac{|v^{\prime}-v|}{2}

   which shows that a 1 ​ ( v ) a{1}(v) is 1 / 2 1/2 -Lipschitz for v > 0 v>0 . Additionally, since s ∗ ∈ cl ( S ) s^{}\in\operatorname{cl}(S) , for all v v , a 1 ​ ( v ) ≤ v a{1}(v)\leq v and thus, lim v → 0 + a 1 ​ ( v ) = 0 = a 1 ​ ( 0 ) \lim{v\rightarrow 0^{+}}a{1}(v)=0=a{1}(0) , showing a 1 a{1} is continuous everywhere.

   Next, we prove that a 1 ​ ( v ) a{1}(v) is positive for v > 0 v>0 . Suppose for the sake of contradiction that v > 0 v>0 and a 1 ​ ( v ) = 0 a{1}(v)=0 . Then, if q ∈ Π ∩ P v q\in\Pi\cap P{v} is a point such that d ​ ( q , S ) / 2 = a 1 ​ ( v ) = 0 d(q,S)/2=a{1}(v)=0 , this implies q ∈ cl ( S ) q\in\operatorname{cl}(S) . But, s ∗ ≺ q s^{}\prec q which contradicts the assumption that s ∗ ∈ Ξ s^{*}\in\Xi .

   Finally, notice that since S S is bounded, a 1 ​ ( v ) a{1}(v) is eventually strictly increasing. Consider the new function a 2 ​ ( v ) a{2}(v) defined as

   a 2 ​ ( v ) = inf v ′ ≥ v a 1 ​ ( v ′ ) . a{2}(v)=\inf{v^{\prime}\geq v}a_{1}(v^{\prime}).

   By definition, a 2 ​ ( v ) a{2}(v) is nondecreasing. Also, a 2 ​ ( v ) a{2}(v) is continuous since a 1 ​ ( v ) a{1}(v) is continuous, and a 2 ​ ( v ) a{2}(v) is positive for v > 0 v>0 since a 1 ​ ( v ) a{1}(v) is positive for v > 0 v>0 and is eventually strictly increasing. Since a 1 ​ ( v ) a{1}(v) is eventually strictly increasing, a 2 ​ ( v ) a{2}(v) will eventually be equal to a 1 ​ ( v ) a{1}(v) and will thus eventually be strictly increasing as well.

   Suppose that a 2 a{2} is constant on the intervals [ α 1 , β 1 ] , [ α 2 , β 2 ] , … [\alpha{1},\beta{1}],[\alpha{2},\beta{2}],\dots where this list may be countably infinite. The values of the endpoints β i \beta{i} are bounded above since a 2 a{2} is eventually strictly increasing. Then, we can construct the new function a 3 ​ ( v ) a{3}(v) defined as

   a 3 ​ ( v ) = min ⁡ ( a 2 ​ ( v ) , inf i ≥ 1 : β i > v { a 2 ​ ( β i ) β i ​ v } ) . a{3}(v)=\min\left(a{2}(v),\inf{i\geq 1:\beta{i}>v}\left{\frac{a{2}(\beta{i})}{\beta_{i}}v\right}\right).

   Figure 7: Two graphs showing the construction of functions used in the proof. Left: A graph showing the construction of a 2 a{2} from a 1 a{1} . The function a 2 a{2} only increases when a 1 a{1} never falls below a given value again, so a 2 a{2} is nondecreasing. Since a 1 a{1} is eventually strictly increasing, a 2 a{2} is eventually equal to a 1 a{1} and is eventually strictly increasing as well. Right: A graph showing the construction of a 3 a{3} from a 2 a{2} . The red straight lines connect the endpoint of each constant region to the origin. The function a 3 a{3} will take the value of the solid parts of the segments which fall underneath the value of a 2 a{2} . Since the line segments are strictly increasing and a 2 a{2} is eventually strictly increasing, a 3 a{3} is strictly increasing everywhere.

   Essentially, a 3 ​ ( v ) a{3}(v) takes the smallest value of a 2 ​ ( v ) a{2}(v) and the line segments connecting the endpoints of each constant section ( β i , a 2 ​ ( β i ) ) (\beta{i},a{2}(\beta{i})) to the origin ( 0 , 0 ) (0,0) at each value of v v . The construction of the functions a 2 a{2} and a 3 a{3} is pictured in Fig. 7 . Since the values of the endpoints are bounded, inf i ≥ 1 : β i > v { a 2 ​ ( β i ) β i ​ v } \inf{i\geq 1:\beta{i}>v}\left{\frac{a{2}(\beta{i})}{\beta{i}}v\right} is positive for all v > 0 v>0 , and thus a 3 ​ ( v ) a{3}(v) is positive for v > 0 v>0 . Additionally, a 3 ​ ( v ) a{3}(v) is continuous since a 2 ​ ( v ) a{2}(v) and the line segments are continuous as well. Since each line segment is strictly increasing and a 2 ​ ( v ) a{2}(v) is eventually strictly increasing, a 3 ​ ( v ) a_{3}(v) is strictly increasing everywhere.

   Finally, we define the set D D using the function a 3 ​ ( v ) a{3}(v) . Since a 3 ​ ( v ) a{3}(v) is less than the distance d ​ ( Π ∩ P v , S ) d(\Pi\cap P{v},S) , the a 3 ​ ( v ) a{3}(v) -radius ball around any point q ∈ Π ∩ P v q\in\Pi\cap P{v} (Including the empty ball of radius 0 at s ∗ s^{} ) will be entirely outside of cl ( S ) \operatorname{cl}(S) – as will the union of all such balls. Let B ϵ ​ ( R ) B{\epsilon}(R) denote the union of balls of radius ϵ \epsilon around all points within R R , defined as

   B ϵ ​ ( R ) = { s ∈ ℝ n : d ​ ( s , R ) < ϵ } . B_{\epsilon}(R)={s\in\mathbb{R}^{n}:d(s,R)<\epsilon}.

   We will define D D to be the set of points constructed from the boundary of the union of the balls of radius a 3 ​ ( v ) a{3}(v) around the sets Π ∩ P v \Pi\cap P{v} . Specifically, D D is defined as

   D = bd ( ⋃ v ≥ 0 [ P v ∩ B a 3 ​ ( v ) ​ ( Π ∩ P v ) ] ) . D=\operatorname*{bd}\left(\bigcup{v\geq 0}\left[P{v}\cap B{a{3}(v)}(\Pi\cap P_{v})\right]\right).

   Due to the definition of a 3 a{3} , D D intersects the closure of S S exactly at s ∗ s^{*} . We claim that D D satisfies the properties of Lemma A.3 . To aid in our proofs of these two properties, we define v ​ ( s ) = ∑ i ( s i − s i ∗ ) v(s)=\sum{i}(s{i}-s^{*}{i}) which is the value such that s s is a member of the plane P v ​ ( s ) P{v(s)} and we define b ​ ( s ) = d ​ ( s , Π ∩ P v ​ ( s ) ) b(s)=d(s,\Pi\cap P{v(s)}) for s ∈ ℝ n s\in\mathbb{R}^{n} such that v ​ ( s ) ≥ 0 v(s)\geq 0 .

   First, we will show v v and b b are continuous. The function v v is Lipschitz due to the equivalence of norms in ℝ n \mathbb{R}^{n} since

   | v ​ ( s ′ ) − v ​ ( s ) | = | ∑ i s i ′ − s i | ≤ ‖ s ′ − s ‖ 1 . |v(s^{\prime})-v(s)|=\left|\sum{i}s^{\prime}{i}-s_{i}\right|\leq|s^{\prime}-s|_{1}.

   Now, take s , s ′ ∈ ℝ n s,s^{\prime}\in\mathbb{R}^{n} such that b ​ ( s ′ ) ≥ b ​ ( s ) b(s^{\prime})\geq b(s) and v ​ ( s ′ ) , v ​ ( s ) v(s^{\prime}),v(s) are positive. Let q ∈ Π ∩ P v ​ ( s ) q\in\Pi\cap P{v(s)} be such that d ​ ( q , s ) = b ​ ( s ) d(q,s)=b(s) . Then, q ′ = q − ( 1 − v ​ ( s ′ ) v ​ ( s ) ) ​ ( q − s ∗ ) ∈ Π ∩ P v ​ ( s ′ ) q^{\prime}=q-(1-\frac{v(s^{\prime})}{v(s)})(q-s^{*})\in\Pi\cap P{v(s^{\prime})} , so we have

   | b ​ ( s ′ ) − b ​ ( s ) | = b ​ ( s ′ ) − b ​ ( s ) ≤ d ​ ( q ′ , s ′ ) − d ​ ( q , s ) ≤ d ​ ( q ′ , q ) + d ​ ( s , s ′ ) ≤ | v ​ ( s ′ ) − v ​ ( s ) | + d ​ ( s , s ′ ) . |b(s^{\prime})-b(s)|=b(s^{\prime})-b(s)\leq d(q^{\prime},s^{\prime})-d(q,s)\leq d(q^{\prime},q)+d(s,s^{\prime})\leq|v(s^{\prime})-v(s)|+d(s,s^{\prime}).

   Since v v is Lipschitz, this shows b b is as well. Next, we will prove that s ∈ D s\in D if and only if b ​ ( s ) = a 3 ​ ( v ​ ( s ) ) b(s)=a_{3}(v(s)) . Define the set E E as

   E = ⋃ v ≥ 0 [ P v ∩ B a 3 ​ ( v ) ​ ( Π ∩ P v ) ] E=\bigcup{v\geq 0}\left[P{v}\cap B{a{3}(v)}(\Pi\cap P_{v})\right]

   so that D = bd ( E ) D=\operatorname*{bd}(E) . Each point s ∈ ℝ n s\in\mathbb{R}^{n} belongs to exactly one plane, P v ​ ( s ) P{v(s)} , so s ∈ E s\in E if and only if there is a point q ∈ Π ∩ P v ​ ( s ) q\in\Pi\cap P{v(s)} such that d ​ ( q , s ) < a 3 ​ ( v ​ ( s ) ) d(q,s)<a_{3}(v(s)) . Thus, we can rewrite E E as

   E = { s ∈ ℝ n : v ​ ( s ) ≥ 0 , b ​ ( s ) < a 3 ​ ( v ​ ( s ) ) } . E={s\in\mathbb{R}^{n}:v(s)\geq 0,b(s)<a_{3}(v(s))}.

   The set E E is the union of open sets, so it is open. If b ​ ( s ) = a 3 ​ ( v ​ ( s ) ) b(s)=a{3}(v(s)) , then there is some q ∈ Π ∩ P v ​ ( s ) q\in\Pi\cap P{v(s)} such that s ∈ cl ( B a 3 ​ ( v ) ​ ( q ) ) ⊂ cl ( E ) s\in\operatorname{cl}(B{a{3}(v)}(q))\subset\operatorname{cl}(E) . If b ​ ( s ) > a 3 ​ ( v ​ ( s ) ) b(s)>a{3}(v(s)) , then there is no point q ∈ Π ∩ P v ​ ( s ) q\in\Pi\cap P{v(s)} such that s ∈ cl ( B a 3 ​ ( q ) ) s\in\operatorname*{cl}(B{a{3}}(q)) , and so s s is not a member of the closure of E E . Put together, we can write the closure of E E as

   cl ( E ) = { s ∈ ℝ n : v ​ ( s ) ≥ 0 , b ​ ( s ) ≤ a 3 ​ ( v ​ ( s ) ) } \operatorname*{cl}(E)={s\in\mathbb{R}^{n}:v(s)\geq 0,b(s)\leq a_{3}(v(s))}

   and thus D = cl ( E ) − E D=\operatorname*{cl}(E)-E can be rewritten as

   D = { s ∈ ℝ n : v ​ ( s ) ≥ 0 , b ​ ( s ) = a 3 ​ ( v ​ ( s ) ) } . D={s\in\mathbb{R}^{n}:v(s)\geq 0,b(s)=a_{3}(v(s))}.

   Therefore, s ∈ D s\in D if and only if b ​ ( s ) = a 3 ​ ( v ​ ( s ) ) b(s)=a_{3}(v(s)) .

   Now, we will show that ∀ s , r ∈ D , s ⊀ r \forall s,r\in D,s\not\prec r . Suppose for the sake of contradiction that there are points s , r ∈ D s,r\in D such that s ≺ r s\prec r . Then, it must be true that v ​ ( s ) < v ​ ( r ) v(s)<v(r) . Let q ∈ Π ∩ P v ​ ( s ) q\in\Pi\cap P{v(s)} be a point such that d ​ ( s , q ) = d ​ ( s , Π ∩ P v ​ ( s ) ) = a 3 ​ ( v ​ ( s ) ) d(s,q)=d(s,\Pi\cap P{v(s)})=a{3}(v(s)) . We know that s , q ∈ P v ​ ( s ) s,q\in P{v(s)} and r ∈ P v ​ ( r ) r\in P{v(r)} . Using the definition of the planes P v P{v} , we find

   ∑ i ( q i + r i − s i ) − s i ∗ = v ​ ( r ) + ∑ i ( q i − s i ∗ ) − ∑ i ( s i − s i ∗ ) = v ​ ( r ) . \sum{i}(q{i}+r{i}-s{i})-s{i}^{*}=v(r)+\sum{i}(q{i}-s{i}^{})-\sum{i}(s{i}-s_{i}^{})=v(r).

   So, q + r − s q+r-s is a member of Π ∩ P v ​ ( r ) \Pi\cap P_{v(r)} . But then this gives

   a 3 ​ ( v ​ ( r ) ) = d ​ ( r , Π ∩ P v ​ ( r ) ) ≤ d ​ ( r , q + r − s ) = d ​ ( q , s ) = a 3 ​ ( v ​ ( s ) ) . a{3}(v(r))=d(r,\Pi\cap P{v(r)})\leq d(r,q+r-s)=d(q,s)=a_{3}(v(s)).

   But a 3 a_{3} is strictly increasing, making this a contradiction. This proves that no members of D D can precede each other.

   Finally, we show that for all s ∈ ℝ n s\in\mathbb{R}^{n} , there is a unique k ∈ ℝ k\in\mathbb{R} such that s − k ​ 𝟏 ∈ D s-k\bm{1}\in D . Consider, for s ∈ ℝ n s\in\mathbb{R}^{n} , the line defined by l ​ ( k ) = s + k ​ 𝟏 l(k)=s+k\bm{1} for all real k k . There is a k 0 k{0} such l ​ ( k 0 ) ∈ P 0 l(k{0})\in P{0} and a k Π k{\Pi} such that l ​ ( k Π ) l(k{\Pi}) is on the boundary of Π \Pi . Thus, we have b ​ ( l ​ ( k 0 ) ) ≥ 0 b(l(k{0}))\geq 0 and b ​ ( l ​ ( k Π ) ) = 0 b(l(k{\Pi}))=0 . Additionally, over the range [ k 0 , k Π ] [k{0},k{\Pi}] , b ​ ( l ​ ( k ) ) b(l(k)) is decreasing. To see why, suppose that q q is the nearest point in the set Π ∩ P v ​ ( l ​ ( k ) ) \Pi\cap P{v(l(k))} to l ​ ( k ) l(k) . Then, for all t > 0 t>0 , q ′ = q + t ​ 𝟏 q^{\prime}=q+t\bm{1} is a member of Π ∩ P v ​ ( l ​ ( k + t ) ) \Pi\cap P_{v(l(k+t))} and thus, b ​ ( l ​ ( k ) ) = d ​ ( l ​ ( k ) , q ) = d ​ ( l ​ ( k + t ) , q ′ ) ≥ b ​ ( l ​ ( k + t ) ) b(l(k))=d(l(k),q)=d(l(k+t),q^{\prime})\geq b(l(k+t)) which shows that b ​ ( l ​ ( k ) ) b(l(k)) is decreasing with k k .

   Since a 3 a{3} is continuous and strictly increasing, a 3 ​ ( v ​ ( l ​ ( k ) ) ) a{3}(v(l(k))) is continuous and strictly increasing with k k . Additionally since b ​ ( l ​ ( k ) ) b(l(k)) is continuous and decreasing with k k , there must be a unique k k -value such that b ​ ( l ​ ( k ) ) = a 3 ​ ( v ​ ( l ​ ( k ) ) ) b(l(k))=a_{3}(v(l(k))) . In other words, there is a unique k k -value such that s + k ​ 𝟏 = s − ( − k ) ​ 𝟏 ∈ D s+k\bm{1}=s-(-k)\bm{1}\in D as desired. With all of the needed properties satisfied, D D forms a valid level surface of a strictly increasing continuous function V V according to Lemma A.3 .

   Consider r ∈ ℝ n r\in\mathbb{R}^{n} with V ​ ( r ) > V ​ ( s ∗ ) V(r)>V(s^{}) . Then, there is a unique k k such that r + k ​ 𝟏 ∈ D r+k\bm{1}\in D which gives V ​ ( r + k ​ 𝟏 ) = V ​ ( s ∗ ) V(r+k\bm{1})=V(s^{}) . Since V V is strictly increasing, k k must be negative and since b ​ ( r + k ​ 𝟏 ) b(r+k\bm{1}) is decreasing with k k and a 3 ​ ( v ​ ( r + k ​ 𝟏 ) ) a{3}(v(r+k\bm{1})) is strictly increasing with k k , it must be the case that b ​ ( r ) < a 3 ​ ( v ​ ( r ) ) b(r)<a{3}(v(r)) which shows r ∈ E r\in E . Since E ∩ cl ( S ) = ∅ E\cap\operatorname{cl}(S)=\emptyset , the highest-valued level hypersurface that intersects cl ( S ) \operatorname{cl}(S) is D D , thus V V achieves its maximum over cl ( S ) \operatorname{cl}(S) at s ∗ s^{} . By Lemma A.4 , g ​ ( x ) = V ​ ( L ​ ( x ) ) g(x)=V(L(x)) is then an η \eta -catastrophic tradeoff proxy for f f . ∎

   Acknowledgments

   This work was funded by the Advanced Research + Invention Agency (ARIA) through project code MSAI-SE01-P005. We would like to thank Léo Cymbalista for their help with the proof of Theorem 5.1 and for designing the value functions and distribution used in Fig. 3 and Fig. 4 . We’d also like to thank Santiago Cifuentes, Alfred Harwood, and Alex Altair for their comments and suggestions on the draft of this paper.