SlowGuess/NeurIPS_2023_OCR huggingface dataset:
$$
\left(\overline {{\mathbf {W}}} _ {i - 1} \left(\mathbf {S} _ {l}\right) W _ {i j}\right) ^ {T} (f (x) + g (x) u) \geq 0 \quad \forall (i, j) \in \mathbf {T} \left(\mathbf {S} _ {1}, \dots , \mathbf {S} _ {r}\right) \cap \mathbf {S} _ {l} \tag {12}
$$
$$
\left. \left(\overline {{\mathbf {W}}} _ {i - 1} \left(\mathbf {S} _ {l}\right) W _ {i j}\right) ^ {T} (f (x) + g (x) u) \leq 0 \quad \forall (i, j) \in \mathbf {T} \left(\mathbf {S} _ {1}, \dots , \mathbf {S} _ {r}\right) \backslash \mathbf {S} _ {l} \right. \tag {13}
$$
$$
\overline {{W}} \left(\mathbf {S} _ {l}\right) ^ {T} (f (x) + g (x) u) \geq 0 \tag {14}
$$
(ii) For all activation sets  $\mathbf{S}$ , we have
$$
(\overline {{\mathcal {X}}} (\mathbf {S}) \cap \mathcal {D}) \backslash \mathcal {C} = \emptyset \tag {15}
$$
The proof can be found in the supplementary material. We refer to any  $x$  that fails to meet at least one of conditions (i) and (ii) of Proposition 1 as a safety counterexample.
Figure 1: Illustration of proposed coarser-to-finer searching method. Hyper-cubes that intersect the safety boundaries are marked in red. When all possible activation sets are listed, we can identify exact activation set and intersections.
4 Verification Algorithm
The preceding proposition motivates our overall approach to verifying NCBFs, consisting of the following steps. (Step 1) We conduct coarser-to-finer search by discretizing the state space into hyper-cubes and use linear relaxation based perturbation analysis (LiRPA) to identify grid squares that intersect the boundary  $\{x : b(x) = 0\}$ . (Step 2) We enumerate all possible activation sets within each hyper-cube using Interval Bound Propagation (IBP). We then identify the activation sets and intersections that satisfy  $b(x) = 0$  using linear programming. (Step 3) For each activation set and intersection of activation sets, we verify the conditions of Proposition 1. In what follows, we describe each step in detail.
4.1 Enumeration of Activation Set Boundaries
We next present the approach to enumerate activation sets of a given ReLU NCBF that intersect the safety boundary,  $b(x) = 0$ . Our approach first conducts a coarse-grained search that overapproximates the collection of activation sets that intersect with the safety boundary. We then prune this collection to remove activation sets that cannot be realized. Specifically, we first identify regions that contain  $b(x) = 0$ , then enumerate all possible activation sets within the region and finally identify the sets that intersect the safety boundaries.
We first discretize the given state space  $\mathcal{X}$  into hyper-cubes. We compute lower and upper bounds of  $b(x)$  on each hyper-cube, denoted  $b_{l}$  and  $b_{u}$  respectively, with linear relaxation based perturbation analysis (LiRPA), i.e., auto LiRPA [38]. For each hyper-cube  $B$ , we determine  $B$  contains  $b(x) = 0$  (red squares in Fig 1) if criteria  $sgn(b_{l}) \cdot sgn(b_{u}) \leq 0$  holds, where  $sgn(*)$  is the sign function. For each  $B$  contains  $b(x) = 0$ , we utilize IBP to over-approximate unstable neurons. Details on this IBP procedure can be found in Section A.7. Let  $\tilde{S}$  denote the over-approximated collection of activation
sets computed by IBP. Note that  $S \in \tilde{S}$  may not intersect with  $b(x) = 0$ . As shown in Fig. 1, we let  $S$  denote the collection of activation sets  $\mathbf{S} \in \tilde{S}$  that satisfy
$$
\overline {{W}} (\mathbf {S}) ^ {T} x + \bar {r} (\mathbf {S}) = 0
$$
$$
\left(\overline {{\mathbf {W}}} _ {i - 1} (\mathbf {S}) W _ {i j}\right) ^ {T} x + \bar {r} _ {i j} (\mathbf {S}) \geq 0 \forall (i, j) \in \mathbf {S} \tag {16}
$$
$$
(\overline {{\mathbf {W}}} _ {i - 1} (\mathbf {S}) W _ {i j}) ^ {T} x + \bar {r} _ {i j} (\mathbf {S}) \leq 0 \forall (i, j) \notin \mathbf {S}
$$
for some  $x \in B$ . The activation set boundaries indicate unstable neurons, which need to be verified separately. Hence, we search for intersections as follows, where  $2^{\mathcal{S}}$  denotes the set of subsets of  $\mathcal{S}$ .
$$
\mathcal {V} = \left\{Z \in 2 ^ {\mathcal {S}}: \left(\bigcap_ {\mathbf {S} \in Z} \overline {{\mathcal {X}}} (\mathbf {S})\right) \cap \{x: b (x) = 0 \} \neq \emptyset \right\}
$$
4.2 Verifying Safety of Each Activation Set
With the activation sets enumerated, the following result gives an equivalent condition for verifying that there is no safety counterexample in the interior of  $\overline{\mathcal{X}}(\mathbf{S})$  for a given activation set  $\mathbf{S}$ .
Lemma 3. There is no safety counterexample in the set  $\overline{\mathcal{X}}(\mathbf{S}) \setminus \bigcup_{\mathbf{S}' \neq \mathbf{S}} \overline{\mathcal{X}}(\mathbf{S})$  if and only if:
1. There do not exist  $x\in \mathcal{X}$  and  $y\in \mathbb{R}^{p + 1}$  satisfying (a)  $x\in \operatorname {int}(\overline{\mathcal{X}} (\mathbf{S}))$  , (b)  $b(x) = 0$  ,(c)
$$
y \geq 0, (d)   y ^ {T} \left( \begin{array}{c} - \overline {{W}} (\mathbf {S}) ^ {T} g (x) \\ A \end{array} \right) = 0, a n d (e)   y ^ {T} \left( \begin{array}{c} \overline {{W}} (\mathbf {S}) ^ {T} f (x) \\ c \end{array} \right) <   0.
$$
2. There does not exist  $x \in \mathcal{X}$  with  $b(x) = 0$ ,  $x \in \operatorname{int}(\overline{\mathcal{X}}(\mathbf{S}))$ , and  $h(x) < 0$ .
The proof can be found in the supplementary material. Conditions 1 and 2 of Lemma 3 can be verified by solving nonlinear programs (see supplementary material for the formulations of these nonlinear programs). Such nonlinear programs are solved for each activation set  $\mathbf{S}$  in the collection  $S$  computed during the enumeration phase. The following corollary describes the special case where there are no constraints on the control, i.e.,  $\mathcal{U} = \mathbb{R}^m$ .
Corollary 1. If  $\mathcal{U} = \mathbb{R}^m$ , then there is no safety counterexample in the set  $\overline{\mathcal{X}}(\mathbf{S}) \setminus \bigcup_{\mathbf{S}' \neq \mathbf{S}} \overline{\mathcal{X}}(\mathbf{S}')$  if and only if (1) there does not exist  $x \in \mathcal{X}$  satisfying  $x \in \operatorname{int}(\overline{\mathcal{X}}(\mathbf{S}))$ ,  $b(x) = 0$ ,  $\overline{W}(\mathbf{S})^T g(x) = 0$ , and  $\overline{W}(\mathbf{S})^T f(x) < 0$  and (2) there does not exist  $x \in \mathcal{X}$  with  $b(x) = 0$ ,  $x \in \operatorname{int}(\overline{\mathcal{X}}(\mathbf{S}))$ , and  $h(x) < 0$ .
Under the conditions of Corollary 1, the complexity of the verification problem can be reduced. If  $g(x)$  is a constant matrix  $G$ , then safety is automatically guaranteed if  $\overline{W}(\mathbf{S})^T G \neq 0$ . If  $f(x)$  is linear in  $x$  as well, then verification can be performed via a linear program.
4.3 Verification of Activation Set Intersections
With the activation set boundaries enumerated, we now describe an approach for verifying safety of intersections between activation sets.
Lemma 4. Suppose that the sets  $\mathbf{S}_1, \ldots, \mathbf{S}_r$  satisfy condition (ii) of Lemma 3. There is no safety counterexample in the set
$$
\overline {{\mathcal {X}}} (\mathbf {S} _ {1}) \cap \dots \cap \overline {{\mathcal {X}}} (\mathbf {S} _ {r}) \backslash \bigcup_ {S ^ {\prime} \notin \{\mathbf {S} _ {1}, \dots , \mathbf {S} _ {r} \}} \overline {{\mathcal {X}}} (\mathbf {S} ^ {\prime})
$$
if and only if there do not exist  $x \in \mathcal{X}$  and  $y_1, \ldots, y_r \in \mathbb{R}^{T + p + 1}$ , where  $T = |\mathbf{T}(\mathbf{S}_1, \ldots, \mathbf{S}_r)|$ , satisfying (a)  $x \in \operatorname{int}(\overline{\mathcal{X}}(\mathbf{S}_1)) \cap \dots \cap \operatorname{int}(\overline{\mathcal{X}}(\mathbf{S}_r))$ , (b)  $b(x) = 0$ , (c)  $y_l \geq 0 \forall l$ , (d)  $\forall l = 1, \ldots, r$ ,  $y_l^T\Theta_l(\mathbf{S}_1, \ldots, \mathbf{S}_r(x)) = 0$ , where  $\Theta_l(\mathbf{S}_1, \ldots, \mathbf{S}_r, x)$  is a  $(T + p + 1) \times m$  matrix
$$
\Theta_ {l} \left(\mathbf {S} _ {1}, \dots , \mathbf {S} _ {r}, x\right) \triangleq \left( \begin{array}{c} - \left(\overline {{\mathbf {W}}} _ {i - 1} \left(\mathbf {S} _ {l}\right) W _ {i j}\right) ^ {T} g (x): (i, j) \in \mathbf {T} \left(\mathbf {S} _ {1}, \dots , \mathbf {S} _ {r}\right) \cap \mathbf {S} _ {l} \\ \left(\overline {{\mathbf {W}}} _ {i - 1} \left(\mathbf {S} _ {l}\right) W _ {i j}\right) ^ {T} g (x): (i, j) \in \mathbf {T} \left(\mathbf {S} _ {1}, \dots , \mathbf {S} _ {r}\right) \setminus \mathbf {S} _ {l} \\ - W \left(\mathbf {S} _ {l}\right) ^ {T} g (x) \\ A \end{array} \right) \tag {17}
$$
and  $(e)\forall l = 1,\ldots ,r,y_l^T\Lambda_l(\mathbf{S}_1,\ldots ,\mathbf{S}_r,x) <   0$  where  $\Lambda_l(\mathbf{S}_1,\dots ,\mathbf{S}_r,x)\in \mathbb{R}^{T + p + 1}$  is given by
$$
\Lambda_ {l} \left(\mathbf {S} _ {1}, \dots , \mathbf {S} _ {r}, x\right) \triangleq \left( \begin{array}{c} \left(\overline {{\mathbf {W}}} _ {i - 1} \left(\mathbf {S} _ {l}\right) W _ {i j}\right) ^ {T} f (x): (i, j) \in \mathbf {T} \left(\mathbf {S} _ {1}, \dots , \mathbf {S} _ {r}\right) \cap \mathbf {S} _ {l} \\ - \left(\overline {{\mathbf {W}}} _ {i - 1} \left(\mathbf {S} _ {l}\right) W _ {i j}\right) ^ {T} f (x): (i, j) \in \mathbf {T} \left(\mathbf {S} _ {1}, \dots , \mathbf {S} _ {r}\right) \setminus \mathbf {S} _ {l} \\ \overline {{W}} (\mathbf {S} _ {l}) ^ {T} f (x) \\ c \end{array} \right) \tag {18}
$$
The proof can be found in the supplementary material. The verification problem can be mapped to solving a nonlinear program. This nonlinear program is solved for each  $(\mathbf{S}_1, \ldots, \mathbf{S}_r) \in \mathcal{V}$ , where  $\mathcal{V}$  is computed during the enumeration phase. Note that, if  $g(x)$  is constant, then the constraints of the nonlinear program are linear, and if  $f(x)$  is linear then the problem reduces to solving a system of linear and bilinear inequalities. Furthermore, if  $f(x)$  can be bounded over  $x \in \overline{\mathcal{X}}(\mathbf{S}_1) \cap \dots \cap \overline{\mathcal{X}}(\mathbf{S}_r)$  and  $b(x) = 0$ , then this bound can be used to derive a linear relaxation to the objective function of (27), thus relaxing the nonlinear program to a linear program.
The complexity of this approach can also be reduced by utilizing sufficient conditions for safety that are easier to check. For instance, if there exists  $u \in \mathcal{U}$  such that  $\overline{W}(\mathbf{S})^T(f(x) + g(x)u) \geq 0$  for all  $\mathbf{S} \in \mathbf{S}(x)$ , then the criteria of Lemma 4 are satisfied. In particular, if  $\overline{W}(\mathbf{S})^Tf(x) \geq 0$  for all  $\mathbf{S} \in \mathbf{S}(x)$ , then the conditions are satisfied with  $u = 0$ . The following result is a straightforward consequence of Proposition 1, Lemma 3, and Lemma 4.
Theorem 2. Suppose that the conditions of Lemma 3 are satisfied for each  $\mathbf{S} \in S$  and the conditions of Lemma 4 are satisfied for each  $\{\mathbf{S}_1, \ldots, \mathbf{S}_r\} \in \mathcal{V}$ . Then the NCBF  $b$  satisfies the conditions of Problem 1.
In this section, we evaluate our proposed method to verify neural control barrier functions on three systems, namely Darboux, obstacle avoidance and spacecraft rendezvous. The experiments run on a 64-bit Windows PC with Intel i7-12700 processor, 32GB RAM and NVIDIA GeForce RTX 3080 GPU. We include experiment details in the supplement.
Darboux: We consider the Darboux system [39], a nonlinear open-loop polynomial system that has been widely used as a benchmark for constructing barrier certificates. The dynamic model is given in the supplement. We obtain the trained NCBF by following the method proposed in [24].
Obstacle Avoidance (OA): We evaluate our proposed method on a controlled system [40]. We consider an Unmanned Aerial Vehicles (UAVs) avoiding collision with a tree trunk. We model the system as a Dubins-style [41] aircraft model. The system state consists of 2-D position and aircraft yaw rate  $x \coloneqq [x_1, x_2, \psi]^T$ . We let  $u$  denote the control input to manipulate yaw rate and the dynamics defined in the supplement. We train the NCBF via the method proposed in [24] with  $v$  assumed to be 1 and the control law  $u$  designed as  $u = \mu_{\text{nom}}(x) = -\sin \psi + 3 \cdot \frac{x_1 \sin \psi + x_2 \cos \psi}{0.5 + x_1^2 + x_2^2}$ .
Spacecraft Rendezvous (SR): We evaluate our approach on a spacecraft rendezvous problem from [42]. A station-keeping controller is required to keep the "chaser" satellite within a certain relative distance to the "target" satellite. The state of the chaser is expressed relative to the target using linearized Clohessy-Wiltshire-Hill equations, with state  $x = [p_x,p_y,p_z,v_x,v_y,v_z]^T$ , control input  $u = [u_{x},u_{y},u_{z}]^{T}$  and dynamics defined in the supplement. We train the NCBF as in [13].
$\mathbf{h}\mathbf{i}\text{-}\mathbf{ord}_{8}$ : We evaluate our approach on an eight-dimensional system that first appeared in [21] to evaluate the scalability of proposed verification method.
5.2 Experiment Results
We first verify that  $\mathcal{D} \subseteq \mathcal{C}$  in the Darboux and obstacle avoidance scenarios. We trained four 1 hidden layer NCBFs with 20, 5, 32, 10 neurons, respectively. NCBF (a) and (c) completed training, (b) terminated after 3 epochs and (d) terminated after 5 epochs. Our verification algorithm identifies safety violations. NCBF (a) and (c) pass the verification while NCBF (b) and (d) fail. As shown in
(b)
Figure 2: Comparison of NCBFs that pass and fail the proposed verification. We show 0-level set boundary in blue, initial region in green and the unsafe region in red. (a) and (b) visualize NCBFs for Darboux. (c) and (d) shows projection of NCBFs for Obstacle Avoidance.
Fig. 2a, the fully-trained NCBF (a) separates the safe and unsafe regions while the NCBF (b) with unfinished training has a boundary that intersects the unsafe region in Fig. 2b. As shown in Fig. 2d, the 2-D projection with  $\psi = -0.5$  of NCBF (d) shows its boundary overlap the unsafe region.
We next verify the positive invariance of  $\mathcal{D}$ . All NCBFs for Darboux pass feasibility verification with run-time presented in Table 1. We compare the run-time of proposed verification with SMT-based approaches using translator proposed in [21] and SMT solver dReal [43] and Z3 [44]. The proposed method can verify NCBFs with more ReLU neurons while SMT-based verifier return nothing. All of
Table 1: Comparison of verification run-time of NCBF in seconds. The table contains the dimension  $n$ , network architecture with  $\sigma$  denoting ReLU, the number of activation sets  $N$  and run-time of proposed method including time of enumerating, verification and total run-time denoted as  $t_e$ ,  $t_v$  and  $T$ , respectively. We compare with the run-time of dReal ( $T_{dReal}$ ) and Z3 ( $T_{Z3}$ ).
Case	n	NN Architecture	N	te	tv	T	TdReal	TZ3
Darboux	2	2-20-σ-1	13	0.39	0.04	0.43	0.36	>3hrs
2	2-32-σ-1	20	0.23	0.03	0.27	1.27	>3hrs
2	2-64-σ-1	47	1.89	0.13	2.02	>3hrs	>3hrs
2	2-96-σ-1	63	4.17	0.14	4.31	>3hrs	>3hrs
2	2-128-σ-1	65	4.77	0.03	4.90	>3hrs	>3hrs
2	2-512-σ-1	258	33.44	0.61	34.05	>3hrs	>3hrs
2	2-1024-σ-1	548	107.63	0.81	108.44	>3hrs	>3hrs
Darboux	2	2-10-σ-10-σ-1	4	0.42	0.05	0.47	7.70	15.81
2	2-16-σ-16-σ-1	26	2.13	0.11	2.23	>3hrs	>3hrs
2	2-32-σ-32-σ-1	58	8.35	6.28	14.64	>3hrs	>3hrs
2	2-48-σ-48-σ-1	58	13.69	0.19	13.88	>3hrs	>3hrs
2	2-64-σ-64-σ-1	102	31.30	0.47	31.77	>3hrs	>3hrs
2	2-256-σ-256-σ-1	402	319.81	1.92	321.73	>3hrs	>3hrs
2	2-512-σ-512-σ-1	1150	619.10	0.75	619.85	>3hrs	>3hrs
hi-ord8	8	8-8-σ-1	98	3.70	0.02	3.72	>3hrs	>3hrs
8	8-16-σ-1	37	35.05	0.0	35.05	>3hrs	>3hrs
the generated NCBFs for obstacle avoidance and spacecraft rendezvous passed the verification. The run-times are presented in Table 2. We find that the activation set sizes grow with the size of neural network and the state dimension  $n$ . We conjecture that this growth rate could be reduced by using tighter approximations for the activated sets.
A key feature of our approach is that the verification process does not depend on the control policy  $\mu$ , but rather we verify that any  $\mu$  satisfying (7)-(9) for all  $x \in \partial \mathcal{D}$  is safe. This improves flexibility while reducing false negatives in safety verification, as we illustrate in the following example. The NCBF for obstacle avoidance with one hidden layer and 32 neurons fails the SMT-based verification using dReal given nominal controller  $\mu_{nom}$ . The counter example is at the point  $(-0.20, 0, -0.73)$ . At this point, we have  $b(x) = 0.0033$ ,  $\frac{\partial b}{\partial x} f(x) = 0.0095$ , which satisfies the sufficient conditions for safety in Lemma 2. However, the nominal controller yields  $\frac{\partial b}{\partial x} (f(x) + g(x)u) = -1.30$  and hence
fails verification. Hence, by following a safe control policy of the form (10) with the learned value of  $b$  and nominal policy  $\mu_{\text{nom}}$ , we can retain the performance of  $\mu_{\text{nom}}$  while still ensuring safety.
Table 2: Comparison of verification run-time of NCBF in seconds. We denote the run-time as 'UTD' when the method is unable to be directly used for verification.
Case	n	NN Architecture	N	te	tv	T	TdReal	TZ3
OA	3	3-32-σ-1	436	6.94	0.40	7.35	>6hrs	>6hrs
3	3-64-σ-1	1645	19.17	1.87	21.05	>6hrs	>6hrs
3	3-96-σ-1	3943	58.96	6.26	65.22	>6hrs	>6hrs
3	3-128-σ-1	5695	169.51	15.56	185.07	>6hrs	>6hrs
OA	3	3-16-σ-16-σ-1	467	18.72	2.66	21.39	>6hrs	>6hrs
3	3-32-σ-32-σ-1	1324	218.86	54.51	273.37	>6hrs	>6hrs
3	3-48-σ-48-σ-1	3754	3197.59	9.75	3207.34	>6hrs	>6hrs
3	3-64-σ-64-σ-1	6545	11730.28	18.22	11748.50	>6hrs	>6hrs
SR	6	6-8-σ-8-σ-8-1	270	78.77	10.23	89.00	UTD	UTD
6	6-16-σ-16-σ-16-1	32937	1261.60	501.06	1762.67	UTD	UTD
6	6-32-σ-32-σ-32-1	207405	12108.11	1798.08	13906.19	UTD	UTD
The computational complexity of our approach will be determined by several factors including the dimension of the state, the number of layers, the number of neurons in each layer, and the geometry of the 0-level set of the NCBF. As shown in Table 2, the dimension of the system plays the most important role.
This paper studied the problem of verifying safety of a nonlinear control system using a NCBF represented by a feed-forward neural network with ReLU activation function. We leveraged a generalization of Nagumo's theorem for proving invariance of sets with nonsmooth boundaries to derive necessary and sufficient conditions for safety. The exact safety conditions addressed the issue that ReLU NCBFs will be nondifferentiable at certain points, thus invalidating traditional safety verification methods. Based on this condition, we proposed an algorithm for safety verification of NCBFs that first decomposes the NCBF into piecewise linear segments and then solves a nonlinear program to verify safety of each segment as well as the intersections of the linear segments. We mitigated the complexity by only considering the boundary of the safe region and pruning the segments with IBP and LiRPA. We evaluated our approach through numerical studies with comparison to state-of-the-art SMT-based methods. Future extensions of this work could include improving scalability for higher-dimensional systems and deeper neural networks, as well as other activation functions.
This research was partially supported by the NSF (grants CNS-1941670, ECCS-2020289, IIS-1905558, and IIS-2214141), AFOSR (grants FA9550-22-1-0054 and FA9550-23-1-0208), and ARO (grant W911NF-19-1-0241).
[1] Devansh R Agrawal and Dimitra Panagou. Safe control synthesis via input constrained control barrier functions. In 2021 60th IEEE Conference on Decision and Control (CDC), pages 6113-6118. IEEE, 2021.
[2] Shao-Chen Hsu, Xiangru Xu, and Aaron D Ames. Control barrier function based quadratic programs with application to bipedal robotic walking. In 2015 American Control Conference (ACC), pages 4542-4548. IEEE, 2015.
[3] Xiangru Xu, Jessy W Grizzle, Paulo Tabuada, and Aaron D Ames. Correctness guarantees for the composition of lane keeping and adaptive cruise control. IEEE Transactions on Automation Science and Engineering, 15(3):1216-1229, 2017.
[41] Lester E Dubins. On curves of minimal length with a constraint on average curvature, and with prescribed initial and terminal positions and tangents. American Journal of mathematics, 79(3):497-516, 1957.
[42] Christopher Jewison and R Scott Erwin. A spacecraft benchmark problem for hybrid control and estimation. In 2016 IEEE 55th Conference on Decision and Control (CDC), pages 3300-3305. IEEE, 2016.
[43] Sicun Gao, Soonho Kong, and Edmund M Clarke. dreal: An SMT solver for nonlinear theories over the reals. In *Automated Deduction-CADE-24: 24th International Conference on Automated Deduction*, Lake Placid, NY, USA, June 9-14, 2013. Proceedings 24, pages 208-214. Springer, 2013.
[44] Leonardo De Moura and Nikolaj Björner. Z3: An efficient SMT solver. In Tools and Algorithms for the Construction and Analysis of Systems: 14th International Conference, TACAS 2008, Held as Part of the Joint European Conferences on Theory and Practice of Software, ETAPS 2008, Budapest, Hungary, March 29-April 6, 2008. Proceedings 14, pages 337-340. Springer, 2008.
[45] Stephen Prajna, Antonis Papachristodoulou, Peter Seiler, and Pablo A Parrilo. SOSTOOLS and its control applications. Positive polynomials in control, pages 273-292, 2005.
In what follows, we give some details of content omitted in the paper due to space limit. The supplements are organized as follows. We give some proof of Lemma 1, 2, Proposition 1, Lemma 3, 4, and Theorem 2 in Section A.1 -A.6, respectively. We present system dynamics for Darboux, obstacle avoidance, spacecraft rendezvous and  $\mathrm{hi - ord_8}$  in Section A.9-A.12. We provide some training details in Section A.13 as well as experiment details and results in Section A.14. We compare polynomial CBFs with NCBF in A.15, compare NCBFs with different activation functions in A.16. We present more details in A.17 on the example in 3.2.
We prove by induction on  $L$ . If  $L = 1$ , then  $x \in \overline{\mathcal{X}}(\mathbf{S})$  if the pre-activation input to the  $(1, j)$  neuron is nonnegative for all  $j \in S_1$  and nonpositive for all  $j \notin S_1$ . We have that the pre-activation input is equal to  $W_{1j}^T x + r_{1j}$ , establishing the result for  $L = 1$ .
Now, inducting on  $L$ , we have that  $x \in \overline{\mathcal{X}}(S_1, \ldots, S_{L-1})$  if and only if
$$
\begin{array}{l} x \in \bigcap_ {i = 1} ^ {L - 1} \left(\bigcap_ {j \in S _ {i}} \left\{x: W _ {i j} ^ {T} \left(\overline {{\mathbf {W}}} _ {i - 1} (\mathbf {S}) ^ {T} x + \overline {{\mathbf {r}}} _ {i - 1}\right) + r _ {i j} \geq 0 \right\} \right. \\ \left. \cap \bigcap_ {j \notin S _ {i}} \left\{x: W _ {i j} ^ {T} \left(\overline {{\mathbf {W}}} _ {i - 1} (\mathbf {S}) ^ {T} x + \overline {{\mathbf {r}}} _ {i - 1}\right) + r _ {i j} \leq 0 \right\}\right) \\ \end{array}
$$
by induction. If  $x \in \overline{\mathcal{X}}(S_1, \ldots, S_{L-1})$ , then  $x \in \overline{\mathcal{X}}(S_L)$  if and only if the pre-activation input to the  $j$ -th neuron at layer  $L$  is nonnegative for all  $j \in S_L$  and nonpositive for  $j \notin S_L$ . The pre-activation input is equal to  $W_{Lj}^T z_{L-1} + r_{Lj}$ , which we can expand by induction as
$$
\begin{array}{l} W _ {L j} ^ {T} z _ {L - 1} + r _ {L j} = \sum_ {j ^ {\prime} = 1} ^ {M _ {L - 1}} \left(W _ {L j}\right) _ {j ^ {\prime}} z _ {L - 1, j ^ {\prime}} + r _ {L j} \\ = \sum_ {j ^ {\prime} = 1} ^ {M _ {L - 1}} \left(W _ {L j}\right) _ {j ^ {\prime}} \left(\overline {{\mathbf {W}}} _ {L - 1, j ^ {\prime}} (\mathbf {S}) ^ {T} x + \overline {{\mathbf {r} _ {L - 1 , j ^ {\prime}}}} (\mathbf {S}) + r _ {L j} \right. \\ = \left(\sum_ {j ^ {\prime} = 1} ^ {M _ {L - 1}} \left(W _ {L j}\right) _ {j ^ {\prime}} \bar {W} _ {L - 1, j ^ {\prime}} (\mathbf {S})\right) ^ {T} x + \bar {\mathbf {r}} _ {L j} (\mathbf {S}) \\ { = } { ( \overline { { \mathbf { W } } } _ { L - 1 } ( \mathbf { S } ) W _ { L j } ) ^ { T } x + \overline { { \mathbf { r } } } _ { L j } ( \mathbf { S } ) } \\ \end{array}
$$
The proof approach is based on Nagumo's Theorem, which gives necessary and sufficient conditions for positive invariance of a set. We first define the concept of tangent cone, and then present positive invariance conditions based on the tangent cone. The approach of the proof is to characterize the tangent cone to the set  $\mathcal{D} = \{x : b(x) \geq 0\}$ .