SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Definition 2. Let  $\mathcal{A}$  be a closed set. The tangent cone to  $\mathcal{A}$  at  $x$  is defined by
$$
\mathcal {T} _ {\mathcal {A}} (x) = \left\{z: \lim  _ {\tau \rightarrow 0} \inf  _ {\tau} \frac {\operatorname {d i s t} (x + \tau z , \mathcal {A})}{\tau} = 0 \right\} \tag {19}
$$
The following result gives an approach for constructing the tangent cone.
Lemma 5 ([37]). Suppose that the set  $\mathcal{A}$  is defined by
$$
\mathcal {A} = \{x: q _ {k} (x) \leq 0, k = 1, \dots , N \}
$$
for some collection of differentiable functions  $q_{1},\ldots ,q_{N}$  . For any  $x$  , let  $J(x) = \{k:q_k(x) = 0\}$  Then
$$
\mathcal {T} _ {\mathcal {A}} (x) = \left\{z: z ^ {T} \nabla q _ {k} (x) \leq 0 \forall k \in J (x) \right\}.
$$
The following is a fundamental preliminary result for establishing positive invariance.
Theorem 3 (Nagumo's Theorem [37], Section 4.2). A closed set  $\mathcal{A}$  is controlled positive invariant if and only if, whenever  $x(t)\in \partial \mathcal{A}$ ,  $u(t)\in \mathcal{U}$  satisfies
$$
(f (x (t)) + g (x (t)) u (t)) \in \mathcal {T} _ {\mathcal {A}} (x (t)) \tag {20}
$$
The following lemma characterizes the tangent cone to  $\mathcal{D}$ .
Proposition 2. For any  $x \in \partial \mathcal{D}$ , we have
$$
\begin{array}{l} \mathcal {T} _ {\mathcal {D}} (x) = \bigcup_ {\mathbf {S} \in \mathbf {S} (x)} \left[ \left(\bigcap_ {(i, j) \in \mathbf {T} (x) \cap \mathbf {S}} \left\{z: \left(\overline {{\mathbf {W}}} _ {i - 1} (\mathbf {S}) W _ {i j}\right) ^ {T} z \geq 0 \right\}\right) \cap \right. \\ \left. \left(\bigcap_ {(i, j) \in \mathbf {T} (x) \backslash \mathbf {S}} \left\{z: \left(\overline {{\mathbf {W}}} _ {i - 1} (\mathbf {S}) W _ {i j}\right) ^ {T} z \leq 0 \right\}\right) \cap \left\{z: \overline {{W}} (\mathbf {S}) ^ {T} z \geq 0 \right\} \right] \tag {21} \\ \end{array}
$$
Proof. Define  $\overline{\mathcal{X}}_0(\mathbf{S}) = \overline{\mathcal{X}}(\mathbf{S}) \cap \mathcal{D}$ . We will first show that, for all  $x$  with  $b(x) = 0$ ,
$$
\mathcal {T} _ {\mathcal {D}} (x) = \bigcup_ {\mathbf {S} \in \mathbf {S} (\mathbf {x})} \mathcal {T} _ {\overline {{\chi}} _ {0} (\mathbf {S})} (x). \tag {22}
$$
$$
\operatorname {d i s t} \left(x, \mathcal {D} \backslash \bigcup_ {\mathbf {S} \in \mathbf {S} (x)} \overline {{\mathcal {X}}} _ {0} (\mathbf {S})\right) > 0,
$$
$$
\operatorname {d i s t} (x + \tau z, \mathcal {D}) = \min  _ {\mathbf {S} \in \mathbf {S} (x)} \operatorname {d i s t} (x + \tau z, \overline {{\mathcal {X}}} _ {0} (\mathbf {S}))
$$
for  $\tau$  sufficiently small.
Suppose that  $z \in \mathcal{T}_{\overline{\mathcal{X}}_0(\mathbf{S})}(x)$ . Then for any  $\tau \geq 0$ ,  $\mathrm{dist}(x + \tau z, \mathcal{D}) \leq \mathrm{dist}(x + \tau z, \overline{\mathcal{X}}_0(\mathbf{S}))$  since  $\overline{\mathcal{X}}_0(\mathbf{S}) \subseteq \mathcal{D}$ , and hence
$$
\liminf_{\tau \to 0}\frac{\operatorname{dist}(x + \tau z,\mathcal{D})}{\tau} \leq \liminf_{\tau \to 0}\frac{\operatorname{dist}(x + \tau z, \overline{\mathcal{X}}_{0}(\mathbf{S}))}{\tau} = 0.
$$
We therefore have  $z \in \mathcal{T}_{\mathcal{D}}(x)$ .
Now, suppose that  $z \in \mathcal{T}_{\mathcal{D}}(\mathbf{x})$  and yet  $z \notin \bigcup_{\mathbf{S} \in \mathbf{S}(x)} \mathcal{T}_{\overline{\mathcal{X}}_0(\mathbf{S})}(x)$ . Then for all  $\mathbf{S} \in \mathbf{S}(x)$ , there exists  $\epsilon_{\mathbf{S}} > 0$  such that
$$
\liminf_{\tau \to 0}\frac{\operatorname{dist}(x + \tau z, \overline{\mathcal{X}}_{0}(\mathbf{S}))}{\tau} = \epsilon_{\mathbf{S}}.
$$
Let  $\bar{\epsilon} = \min \left\{\epsilon_{\mathbf{S}}: \mathbf{S} \in \mathbf{S}(x)\right\}$ . For any  $\delta \in (0, \bar{\epsilon})$ , there exists  $\overline{\tau} > 0$  such that  $\tau < \overline{\tau}$  implies
$$
\frac {\operatorname {d i s t} (x + \tau z , \mathcal {D})}{\tau} = \min  _ {\mathbf {S} \in \mathbf {S} (x)} \frac {\operatorname {d i s t} (x + \tau z , \overline {{\mathcal {X}}} _ {0} (\mathbf {S}))}{\tau} > \delta
$$
implying that  $\lim \inf_{\tau \to 0} \frac{\mathrm{dist}(x + \tau z, \mathcal{D})}{\tau} > 0$  and hence  $z \notin \mathcal{T}_{\mathcal{D}}(x)$ . This contradiction implies (22). It now suffices to show that, for each  $\mathbf{S} \in \mathbf{S}(x)$ ,
$$
\begin{array}{l} \mathcal {T} _ {\overline {{\mathcal {X}}} _ {0} (\mathbf {S})} (x) = \left(\bigcap_ {(i, j) \in \mathbf {T} (x) \cap \mathbf {S}} \left\{z: \left(\overline {{\mathbf {W}}} _ {i - 1} (\mathbf {S}) W _ {i j}\right) ^ {T} z \geq 0 \right\}\right) \cap \\ \left(\bigcap_ {(i, j) \in \mathbf {T} (x) \backslash \mathbf {S}} \left\{z: (\overline {{\mathbf {W}}} _ {i - 1} (\mathbf {S}) W _ {i j}) ^ {T} z \leq 0 \right\}\right) \cap \left\{z: \overline {{W}} (\mathbf {S}) ^ {T} z \geq 0 \right\}. \\ \end{array}
$$
We have that each  $\overline{\mathcal{X}}_0(\mathbf{S})$  is given by
$$
\begin{array}{l} \overline {{\mathcal {X}}} _ {0} (\mathbf {S}) = \left\{x ^ {\prime}: \left(\overline {{\mathbf {W}}} _ {i - 1} (\mathbf {S}) W _ {i j}\right) ^ {T} x ^ {\prime} + r _ {i j} (\mathbf {S}) \geq 0 \forall (i, j) \in \mathbf {S} \right\} \\ \cap \left\{x ^ {\prime}: (\overline {{\mathbf {W}}} _ {i - 1} (\mathbf {S}) W _ {i j}) ^ {T} x ^ {\prime} + r _ {i j} (\mathbf {S}) \leq 0 \forall (i, j) \notin \mathbf {S} \right\} \cap \left\{x ^ {\prime}: \overline {{W}} (\mathbf {S}) ^ {T} x ^ {\prime} + r (\mathbf {S}) \geq 0 \right\}, \\ \end{array}
$$
thus matching the conditions of Lemma 5 when each  $g_{k}$  function is affine. Furthermore, the set  $J(x)$  is equal to the set of functions that are exactly zero at  $x$ , which consists of  $\{(\overline{\mathbf{W}}_{i - 1}(\mathbf{S})W_{ij})^T x + \overline{r}_{ij}(\mathbf{S}): (i,j)\in T(\mathbf{x})\}$  together with  $\overline{W} (\mathbf{S})^T x + \overline{r} (\mathbf{S})$ . This observation combined with Lemma 5 gives the desired result.
Lemma 2 is a consequence of Proposition 2. For ease of exposition, we first reproduce the lemma and then present the proof.
Lemma 6. The set  $\mathcal{D}$  is positive invariant if and only if, for all  $x\in \partial \mathcal{D}$ , there exist  $\mathbf{S}\in \mathbf{S}(x)$  and  $u\in \mathcal{U}$  satisfying
$$
\left(\overline {{\mathbf {W}}} _ {i - 1} (\mathbf {S}) W _ {i j}\right) ^ {T} (f (x) + g (x) u) \geq 0 \forall (i, j) \in \mathbf {T} (x) \cap \mathbf {S} \tag {23}
$$
$$
\left. \left(\overline {{\mathbf {W}}} _ {i - 1} (\mathbf {S}) W _ {i j}\right) ^ {T} (f (x) + g (x) u) \leq 0 \forall (i, j) \in \mathbf {T} (x) \backslash \mathbf {S} \right. \tag {24}
$$
$$
\left(\overline {{\mathbf {W}}} _ {i - 1} (\mathbf {S}) W _ {i j}\right) ^ {T} (f (x) + g (x) u) \geq 0 \tag {25}
$$
Proof. By Theorem 3, the set  $\mathcal{D}$  is positive invariant if and only if for every  $x\in \partial \mathcal{D}$ , there exists  $u$  such that  $(f(x) + g(x)u)\in \mathcal{T}_{\mathcal{D}}(x)$ . By Proposition 2, this condition holds iff there exists  $\mathbf{S}\in \mathbf{S}(x)$  such that
$$
\begin{array}{l} (f (x) + g (x) u) \in \left( \right.\left(\bigcap_ {(i, j) \in \mathbf {T} (x) \cap \mathbf {S}} \left\{z: (\overline {{\mathbf {W}}} _ {i - 1} (\mathbf {S}) W _ {i j}) ^ {T} z \geq 0 \right\}\right) \cap \\ \left(\bigcap_ {(i, j) \in \mathbf {T} (x) \backslash \mathbf {S}} \left\{z: \left(\overline {{\mathbf {W}}} _ {i - 1} (\mathbf {S}) W _ {i j}\right) ^ {T} z \leq 0 \right\}\right) \cap \left\{z: \overline {{W}} (\mathbf {S}) ^ {T} z \geq 0 \right\}\left. \right) \\ \end{array}
$$
The above condition is equivalent to the conditions of the lemma, completing the proof.
A.3 Proof of Proposition 1
First, suppose that condition (i) holds. Then for any  $x \in \mathcal{D}$  with  $\mathbf{S}(x) = \{\mathbf{S}_1, \dots, \mathbf{S}_r\}$ , there exists  $l \in \{1, \dots, r\}$  and  $u \in \mathcal{U}$  such that  $x \in \overline{\mathcal{X}}(\mathbf{S}_l)$  and (7)-(8) hold. For this choice of  $u$ , we have  $(f(x) + g(x)u) \in \mathcal{T}_{\Psi_i}(x)$  by Proposition 2. Hence  $\mathcal{D}$  is positive invariant under any control policy consistent with  $b$  by Lemma 2.
Next, suppose that condition (ii) holds. Since  $\mathcal{D}$  is contained in the union of the activation sets  $\overline{\mathcal{X}}(\mathbf{S})$ , this condition implies that  $\mathcal{D} \subseteq \mathcal{C}$ .
A.4 Proof of Lemma 3
Suppose that condition 1 holds. Then for any  $x \in \partial \mathcal{D}$  with  $\mathbf{S}(x) = \{\mathbf{S}_1, \ldots, \mathbf{S}_r\}$ , there exists  $l \in \{1, \ldots, r\}$  such that  $x \in \overline{\mathcal{X}}(\mathbf{S}_l)$  and  $u \in \mathcal{U}$  satisfy (7) and (8). For this choice of  $u$ , we have  $(f(x) + g(x)u) \in \mathcal{T}_{\mathcal{D}}(x)$  by Proposition 2. Hence  $\mathcal{D}$  is positive invariant under any control policy consistent with  $b$  by Theorem 3.
If Condition 2 holds, then there is no  $x$  with  $b(x) = 0$  and  $x \in \operatorname{int}(\overline{\mathcal{X}}(\mathbf{S}))$  such that  $x \notin \mathcal{C}$ . Hence, there are no counterexamples to condition (ii) of Proposition 1.
A.5 Proof of Lemma 4
The approach is to prove that condition (ii) of Proposition 1 holds; condition (i) holds automatically if each  $\mathbf{S}_1, \ldots, \mathbf{S}_r$  satisfies condition (ii) of Lemma 3. We have that conditions (a) and (b) are equivalent
to  $b(x) = 0$  and (11). In order for  $x$  to be a safety counterexample, for all  $l = 1, \dots, r$ , at least one of Eqs. (7) and (8) must fail. Equivalently, for all  $l = 1, \dots, r$ , there does not exist  $u$  satisfying
$$
\begin{array}{l} - \left(\overline {{\mathbf {W}}} _ {i - 1} (\mathbf {S} _ {l}) W _ {i j}\right) ^ {T} g (x) u \leq \left(\overline {{\mathbf {W}}} _ {i - 1} (\mathbf {S} _ {l}) W _ {i j}\right) ^ {T} f (x) \forall (i, j) \in T (\mathbf {S} _ {1}, \dots , \mathbf {S} _ {r}) \cap \mathbf {S} _ {l} \\ - \left(\overline {{\mathbf {W}}} _ {i - 1} (\mathbf {S} _ {l}) W _ {i j}\right) ^ {T} g (x) u \geq \left(\overline {{\mathbf {W}}} _ {i - 1} (\mathbf {S} _ {l}) W _ {i j}\right) ^ {T} f (x) \forall (i, j) \in T (\mathbf {S} _ {1}, \dots , \mathbf {S} _ {r}) \setminus \mathbf {S} _ {l} \\ - \bar {W} _ {i j} (\mathbf {S} _ {l}) ^ {T} g (x) u \leq \bar {W} (\mathbf {S} _ {l}) ^ {T} f (x) \\ A u \leq c \\ \end{array}
$$
By Farkas Lemma, non-existence of such a  $u$  is equivalent to existence of  $y_{l}$  satisfying  $y_{l} \geq 0$  as well as (17) and (18).
A.6 Proof of Theorem 2
Suppose that  $x$  is a safety counterexample for the NCBF  $b$  with  $b(x) = 0$ . If  $x \in \operatorname{int} \overline{\mathcal{X}}(\mathbf{S})$  for some  $\mathbf{S}$ , then we have that  $\mathbf{S} \in \mathcal{S}$  and hence a contradiction with Lemma 3. If  $x \in \overline{\mathcal{X}}(\mathbf{S}_1) \cap \dots \overline{\mathcal{X}}(\mathbf{S}_r)$  for some  $\mathbf{S}_1, \ldots, \mathbf{S}_r$ , then there is a contradiction with Lemma 4.
A.7 Details on the IBP Procedure
Interval bound propagation aims to compute an interval of possible output values by propagating a range of inputs layer-by-layer, and is integrated into our approach as follows. We first use partition the state space into cells and, for each cell, use LiRPA to derive upper and lower bounds on the value of  $\mathsf{b}(\mathbf{x})$  when  $\mathbf{x}$  takes values in that cell. When the interval of possible  $\mathsf{b}(\mathbf{x})$  values in a cell contains zero, we conclude that that cell may intersect the boundary  $\mathsf{b}(\mathbf{x}) = 0$ . For each neuron, we use IBP to compute the pre-activation input interval for values of  $\mathbf{x}$  within the cell. When the pre-activation input has a positive upper bound and negative lower bound, we identify the neuron as unstable, i.e., it may be either positive or negative for values of  $x$  within the cell. Using this approach, we enumerate a collection of activation sets  $S$ . We then identify the activation sets  $\mathbf{S} \in \tilde{\mathcal{S}}$  such that  $b(x) = 0$  for some  $x \in \overline{\mathcal{X}}(\mathbf{S})$  by searching for an  $x$  that satisfies the linear constraints in (16). This approach uses LiRPA and IBP to identify the activation regions that intersect the boundary  $\{x : b(x) = 0\}$  without enumerating and checking all possible activation sets, which would have exponential runtime in the number of neurons in the network.
A.8 Nonlinear Programming
The condition 2 of Lemma 3 suffices to solve the nonlinear program
minimize  $h(x)$
s.t.  $\begin{array}{rl} & {\overline{W}_{ij}(\mathbf{S})^T x + \overline{r}_{ij}(\mathbf{S})\geq 0\forall (i,j)\in \mathbf{S}}\\ & {\overline{W}_{ij}(\mathbf{S})^{T}x_{+}\overline{\overline{\tau}}_{-}(\mathbf{S}) <   0\forall (i,j)\notin \mathbf{S}} \end{array}$  (26)
$\overline{W}_{ij}(\mathbf{S})^T x + \overline{r}_{ij}(\mathbf{S})\leq 0\forall (i,j)\notin \mathbf{S}$  (26)
$\overline{W} (\mathbf{S})^T x + \bar{r} (\mathbf{S}) = 0$
and check whether the optimal value is nonnegative (unsafe) or negative (safe).
The verification problem of Lemma 4 can then be mapped to solving the nonlinear program
$$
\min  _ {x, y _ {1}, \dots , y _ {r}} \quad \max  _ {l = 1, \dots , r} \left\{y _ {l} ^ {T} \Lambda_ {l} (\mathbf {S} _ {1}, \dots , \mathbf {S} _ {r}, x) \right\}
$$
s.t.  $(\mathbf{W}_{i - 1}(\mathbf{S}_1)W_{ij})^T x + \overline{r}_{ij}(\mathbf{S}_1) <   0\forall (i,j)\notin S_1\cup \dots \cup S_r$
$(\overline{\mathbf{W}}_{i - 1}(\mathbf{S}_1)W_{ij})_T^T x + \overline{r}_{ij}(\mathbf{S}_1) > 0\forall (i,j)\in S_1\cap \dots \cap S_r$  (27)
$(\overline{\mathbf{W}}_{i - 1}(\mathbf{S}_1)W_{ij})^T x + \overline{r}_{ij}(\mathbf{S}_1) = 0\forall (i,j)\in \mathbf{T}(\mathbf{S}_1,\dots ,\mathbf{S}_r)$
$y_{l}^{T}\Theta_{l}(\mathbf{S}_{1},\dots ,\mathbf{S}_{r}(x)) = 0\forall l = 1,\dots ,r$
$y_{l}\geq 0\forall l = 1,\ldots ,r$
and checking whether the optimal value is nonnegative (safe) or negative (unsafe).
A.9 Experiment Settings: Darboux
We show the settings of NCBF verification for Darboux system whose dynamic is defined as
$$
\left[ \begin{array}{c} \dot {x} _ {1} \\ \dot {x} _ {2} \end{array} \right] = \left[ \begin{array}{c} x _ {2} + 2 x _ {1} x _ {2} \\ - x _ {1} + 2 x _ {1} ^ {2} - x _ {2} ^ {2} \end{array} \right]. \tag {28}
$$
We define state space, initial region, and unsafe region as  $\mathcal{X}:\{\mathbf{x}\in \mathbb{R}^2:x\in [-2,2]\times [-2,2]\}$ ,  $\mathcal{X}_I:\{\mathbf{x}\in \mathbb{R}^2:0\leq x_1\leq 1,1\leq x_2\leq 2\}$  and  $\mathbf{x}_U:\{\mathbf{x}\in \mathbb{R}^2:x_1 + x_2^2\leq 0\}$  respectively.
A.10 Experiment Settings: Obstacle Avoidance
We next evaluate that our proposed method on a controlled system [40]. The system state consists of 2-D position and aircraft yaw rate  $x \coloneqq [x_{1}, x_{2}, \psi]^{T}$ . We let  $u$  denote the control input to manipulate yaw rate and define the dynamics as
$$
\left[ \begin{array}{c} \dot {x} _ {1} \\ \dot {x} _ {2} \\ \dot {\psi} \end{array} \right] = \left[ \begin{array}{c} v \sin \psi \\ v \cos \psi \\ 0 \end{array} \right] + \left[ \begin{array}{c} 0 \\ 0 \\ u \end{array} \right]. \tag {29}
$$
We define the state space, initial region and unsafe region as  $\mathcal{X}$ ,  $\mathcal{X}_I$  and  $\mathcal{X}_U$ , respectively as
$$
\mathcal {X}: \left\{\mathbf {x} \in \mathbb {R} ^ {3}: x _ {1}, x _ {2}, \psi \in [ - 2, 2 ] \times [ - 2, 2 ] \times [ - 2, 2 ] \right\}
$$
$$
\mathcal {X} _ {I}: \left\{\mathbf {x} \in \mathbb {R} ^ {3}: - 0. 1 \leq x _ {1} \leq 0. 1, - 2 \leq x _ {2} \leq - 1. 8, - \pi / 6 <   \psi <   \pi / 6 \right\} \tag {30}
$$
$$
\mathcal {X} _ {U}: \left\{\mathbf {x} \in \mathbb {R} ^ {3}: x _ {1} ^ {2} + x _ {2} ^ {2} \leq 0. 0 4 \right\}
$$
A.11 Experiment Settings: Spacecraft Rendezvous
The state of the chaser is expressed relative to the target using linearized Clohessy-Wiltshire-Hill equations, with state  $x = [p_x,p_y,p_z,v_x,v_y,v_z]^T$ , control input  $u = [u_x,u_y,u_z]^T$  and dynamics defined as follows.
$$
\left[ \begin{array}{l} \dot {p} _ {x} \\ \dot {p} _ {y} \\ \dot {p} _ {z} \\ \dot {v} _ {x} \\ \dot {v} _ {y} \\ \dot {v} _ {z} \end{array} \right] = \left[ \begin{array}{c c c c c c} 1 & 0 & 0 & 0 & 0 & 0 \\ 0 & 1 & 0 & 0 & 0 & 0 \\ 0 & 0 & 1 & 0 & 0 & 0 \\ 3 n ^ {2} & 0 & 0 & 0 & 2 n & 0 \\ 0 & 0 & 0 & - 2 n & 0 & 0 \\ 0 & 0 & - n ^ {2} & 0 & 0 & 0 \end{array} \right] \left[ \begin{array}{l} p _ {x} \\ p _ {y} \\ p _ {z} \\ v _ {x} \\ v _ {y} \\ v _ {z} \end{array} \right] + \left[ \begin{array}{c c c} 0 & 0 & 0 \\ 0 & 0 & 0 \\ 0 & 0 & 0 \\ 1 & 0 & 0 \\ 0 & 1 & 0 \\ 0 & 0 & 1 \end{array} \right] \left[ \begin{array}{l} u _ {x} \\ u _ {y} \\ u _ {z} \end{array} \right]. \tag {31}
$$
We define the state space and unsafe region as  $\mathcal{X}$  and  $\mathcal{X}_U$ , respectively as
$$
\mathcal {X}: \left\{\mathbf {x} \in \mathbb {R} ^ {3}: p, v, \in [ - 1. 5, 1. 5 ] \times [ - 1. 5, 1. 5 ] \right\}
$$
$$
\mathcal {X} _ {U}: \left\{0. 2 5 \leq r \leq 1. 5, \text {w h e r e} r = \sqrt {p _ {x} ^ {2} + p _ {y} ^ {2} + p _ {z} ^ {2}} \right\} \tag {32}
$$
We obtain the trained NCBF with neural CLBF training in [13] with a nominal model predictive controller.
A.12 Experiment Settings: hi-ord8
The dynamic model of the system is captured by an ODE as follows.
$$
x ^ {(8)} + 2 0 x ^ {(7)} + 1 7 0 x ^ {(6)} + 8 0 0 x ^ {(5)} + 2 2 7 3 x ^ {(4)} + 3 9 8 0 x ^ {(3)} + 4 1 8 0 x ^ {(2)} + 2 4 0 0 x ^ {(1)} + 5 7 6 = 0 \tag {33}
$$
where we denote the  $i$ -th derivative of variable  $x$  by  $x^{(i)}$ . We define the state space and unsafe region as  $\mathcal{X}$  and  $\mathcal{X}_U$ , respectively as
$$
\mathcal {X}: \left\{x _ {1} ^ {2} + \dots + x _ {8} ^ {2} \leq 4 \right\}
$$
$$
\left. \mathcal {X} _ {U}: \left\{(x _ {1} + 2) ^ {2} + \dots + (x _ {8} + 2) ^ {2} \leq 0. 1 6 \right\} \right. \tag {34}
$$
We obtain the trained NCBFs with training method proposed in [21].
A.13 Training Details
We trained the NCBFs for Darboux and obstacle avoidance via the approach proposed in [24]. Models are trained with their open source code<sup>1</sup> with default settings. Detailed parameters for both cases listed in Table 3a.
<https://github.com/zhaohj2017/HSCC20-Repeatability>
We then trained NCBFs for Spacecraft Rendezvous by following approach proposed in [13] with the empirical loss defined in Eq. (5) in [12]. Models are trained with their open source code  $^2$  with default settings. The hyper-parameters are listed in Table 3b.
Table 3: Hyper-parameters for training NCBFs to be verified
(a) Hyper-parameters for Darboux and OA
Hyper-Parameters	Value
LEARNING_RATE	0.01
LOSS_OPT_FLAG	1e-16
TOL_MAX_GRAD	6
EPOCHS	5
TOL_INIT	0.0
TOLSAFE	0.0
TOLBOUNDARY	0.05
TOL_LIE	0.0
TOL_NORM_LIE	0.0
WEIGHT_LIE	1
WEIGHT_NORM_LIE	0
DECAY_LIE	1
DECAY_INIT	1
DECAY_UNSAFE	1
(b) Hyper-parameters for Spacecraft Randezvous
Hyper-Parameters	Value
LEARNING_RATE	0.01
BATCH_SIZE	512
CONTROLLER_PERIOD	0.01
SIMULATION_DT	0.01
CBF_HIDDEN_layers	1
CBF_HIDDEN_SIZE	16
CBF_LAMBDA	0.1
CBF_RELAXATION_PEN	1e4
SCALE_PARAMETER	10.0
PRIMAL_LEARNING_RATE	1e-3
LEARN_SHAPE_EPOCHS	100
A.14 Experiment Details and Results
We use translators and verifiers proposed in FOSSIL<sup>3</sup> for SMT-based verification with solver dReal and Z3 as baselines. Our proposed enumerating algorithm utilize auto-LiRPA<sup>4</sup> with default settings and linear program with HiGHS solvers provided by SciPy<sup>5</sup>. Detailed settings can be found in our attached code.
We further visualize the trend of the number of activation sets and run-time with respect to the total number of neurons with ReLU activation function in Fig. 3. We can find that the logarithm of the activation sets size grows with the size of the neural network. The dimensionality of the state is the dominant factor in determining the run-time. The logarithm of the run-time is determined by both the state dimension and the number of ReLU hidden layers. The potential result can be cause by loose activation set estimation. Methods deriving tighter bounds than IBP may mitigate the influence of the ReLU hidden layers.
A.15 Comparison of NCBF and SOS-based Synthesis
We compare NCBF with traditional SOS synthesized polynomial CBF for the obstacle avoidance case study in two aspects, namely, training time  $T_{t}$  and volume  $V$  of the guaranteed safe region. In order to synthesize the polynomial CBF, we adopt the procedure introduced in [45]. This procedure first constructs a nominal controller  $\mu(x)$ , and then uses SOS programming to construct a barrier certificate for the system  $\dot{x}(t) = f(x) + g(x)\mu(x)$ . We choose  $\mu(x) = -x_{3}$  as the nominal controller and synthesize CBFs of degree 2, 4, 6, 8, and 10 using the Matlab SOSTOOLS toolbox. We compared the result with an NCBF with one hidden layer of 32 neurons trained using the method proposed in [24] with the same nominal controller. The experiment results are shown below. The time of SOS CBF synthesis grows with the degree of the barrier function. Degree 10 CBF takes twice the time compared to NCBF. On the other hand, NCBF outperforms all SOS synthesized CBFs by having the largest safe region volume.
$^{2}$ https://github.com/MIT-REALM/neural_clbf
<sup>3</sup>https://github.com/oxford-oxcav/fossil
<sup>4</sup>https://github.com/Verified-Intelligence/auto_LiRPA
<sup>5</sup>https://docs.scipy.org/doc/scipy-1.10.1/reference/optimize.linprog-highs.html
(b)
Figure 3: Comparison of the number of activation sets and run-time with respect to number of neurons in total. (a) shows logarithm of activation set size. (b) shows logarithm of run-time. We denote NCBFs for Darboux with 1 and 2 hidden layers as Darboux 1 and Darboux 2, respectively. We denote NCBFs for obstacle avoidance with 1 and 2 hidden layers as obs 1 and obs 2, respectively.
Table 4: Comparison of the training time  ${T}_{t}$  and safe region volume  $V$  of a NCBF and SOS synthesized CBFs for Obstacle Avoidance
Types	Tt(s)	V (m2× deg)
NCBF 3-32-σ-1	262.89s	37.76
SOS Degree 2	7.36s	16.14
SOS Degree 4	6.65s	13.44
SOS Degree 6	19.88s	31.36
SOS Degree 8	125.10s	25.93
SOS Degree 10	551.31s	19.99
A.16 Comparison between Activation Functions
We considered three case studies, namely, Darboux, obstacle avoidance, and spacecraft rendezvous. For each case study, we trained and verified three NCBFs with the same architecture (2 hidden layers of 32 neurons each) but different activation functions, namely, ReLU, sigmoid, and tanh. We found
Table 5: Comparison of training time  ${T}_{t}$  ,safety region volume  $V$  and verification time  ${T}_{v}$  of ReLU, Sigmoid and Tanh NCBF for Darboux,Obstacle Avoidance and Spacecraft Rendezvous. ReLU NNs are verified by proposed method while others are verified by dReal and Z3. We write UTD when the method cannot be not directly used for verification
Case	Darboux	Obstacle
Avoidance	Spacecraft
Rendezvous
ReLU	Sigmoid	Tanh	ReLU	Sigmoid	Tanh	ReLU	Tanh
Tt	28.53s	51.14s	69.49s	71.44s	78.66s	76.49s	879.388s	953.469s
V	2.27	1.62	2.8	4.99	2.17	3.50	0.20	0.22
Tv	14.64	>3hrs	>3hrs	273.37s	>3hrs	>3hrs	13906.19s	UTD
that, for the Darboux and obstacle avoidance case studies, the ReLU NCBF completed training faster than both sigmoid and tanh NCBFs. The volume of the safe region was comparable for all three activation functions, with the tanh outperforming the ReLU NCBF in Darboux and the ReLU NCBF providing the largest volume for obstacle avoidance. The most significant difference between the three activation functions was at the verification stage. Our proposed method for verifying ReLU NCBFs terminated within 15 and 274 seconds in the Darboux and obstacle avoidance, respectively, while SMT-based methods did not terminate within three hours for both test cases. In the spacecraft rendezvous example, the ReLU NCBF completed training before the tanh NCBF. Moreover, while our approach verified the correctness of the ReLU NCBF within 4 hours, the tanh NCBF exhibited a safety violation.
A.17 Example Details