The controller crashes. Which training example caused it?
Neural network controllers learned from demonstrations — behavior cloning — are deployed in physical systems: HVAC, autonomous vehicles, robotic manipulators. When they fail, the failure is physical. The temperature oscillates. The car drifts. The arm collides. Standard debugging asks what the model does wrong. IF-CPS (Li, Li, Bakshi, Xu, and Chen, arXiv:2603.21543) asks which training data point made the model do it wrong.
Influence functions, originally developed for statistical estimators, quantify how removing or perturbing a single training point changes a model's output. For standard ML tasks, this works directly — perturb a data point, measure the change in loss. For cyber-physical systems, three complications arise.
First, closed-loop dynamics: the controller's output feeds back through the physical system, which generates the next input. A bad action doesn't produce a single bad prediction — it corrupts the entire subsequent trajectory. Safety influence handles this by attributing constraint violations, not just prediction errors.
Second, temporal structure: early actions have cascading effects; late actions don't. Trajectory influence applies temporal discounting, weighting earlier data points more heavily because their influence propagates further.
Third, plant dynamics: the physical system mediates between the controller's actions and the observed outcomes. Propagated influence traces effects through the plant model, connecting training data to physical consequences rather than just controller outputs.
The results: perfect detection (AUROC 1.00) of poisoned training data in a pendulum controller with 5-10% poisoning. In HVAC control, 0.92 AUROC versus 0.50 for standard influence functions. The standard methods fail because they don't account for the feedback loop — they measure influence on next-step prediction, not on trajectory-level safety.
The contribution is not just better debugging. It's a formal connection between data provenance and physical safety. When a neural controller violates a safety constraint, IF-CPS identifies which training demonstrations are responsible — enabling targeted data curation rather than wholesale retraining.