Title: SEEV: Synthesis with Efficient Exact Verification for ReLU Neural Barrier Functions
Venue: NeurIPS 2024
Accepted: yes
Keywords: Safe Control

Barrier Functions

Control Barrier Functions

Neural Networks
Abstract: Neural Control Barrier Functions (NCBFs) have shown significant promise in enforcing safety constraints on nonlinear autonomous systems. State-of-the-art exact approaches to verifying safety of NCBF-based controllers exploit the piecewise-linear structure of ReLU neural networks, however, such approaches still rely on enumerating all of the activation regions of the network near the safety boundary, thus incurring high computation cost. In this paper, we propose a framework for Synthesis with Efficient Exact Verification (SEEV). Our framework consists of two components, namely (i) an NCBF synthesis algorithm that introduces a novel regularizer to reduce the number of activation regions at the safety boundary, and (ii) a verification algorithm that exploits tight over-approximations of the safety conditions to reduce the cost of verifying each piecewise-linear segment. Our simulations show that SEEV significantly improves verification efficiency while maintaining the CBF quality across various benchmark systems and neural network structures. Our code is available at https://github.com/HongchaoZhang-HZ/SEEV.

SEEV: Synthesis with Efficient Exact Verification for ReLU Neural Barrier Functions

Abstract

Neural Control Barrier Functions (NCBFs) have shown significant promise in enforcing safety constraints on nonlinear autonomous systems. State-of-the-art exact approaches to verifying safety of NCBF-based controllers exploit the piecewiselinear structure of ReLU neural networks, however, such approaches still rely on enumerating all of the activation regions of the network near the safety boundary, thus incurring high computation cost. In this paper, we propose a framework for Synthesis with Efficient Exact Verification (SEEV). Our framework consists of two components, namely (i) an NCBF synthesis algorithm that introduces a novel regularizer to reduce the number of activation regions at the safety boundary, and (ii) a verification algorithm that exploits tight over-approximations of the safety conditions to reduce the cost of verifying each piecewise-linear segment. Our simulations show that SEEV significantly improves verification efficiency while maintaining the CBF quality across various benchmark systems and neural network structures. Our code is available at https://github.com/HongchaoZhang-HZ/SEEV .

1 Introduction

Safety is a crucial property for autonomous systems that interact with humans and critical infrastructures in applications including medicine, energy, and robotics [1, 2], which has motivated recent research into safe control [3, 4, 5, 6, 7]. Control Barrier Functions (CBFs), which apply a constraint on the control input at each time in order to ensure that safety constraints are not violated, have attracted significant research attention due to their ease of implementation and compatibility with a variety of safety and performance criteria [8]. Recently, CBFs that are defined by neural networks, denoted as Neural Control Barrier Functions (NCBFs), have been proposed to leverage the expressiveness of NNs for safe control of nonlinear systems [9, 10, 11]. NCBFs have shown substantial promise in applications including robotic manipulation [10], navigation [12, 13], and flight control [14].

A key challenge in NCBF-based control is safety verification, which amounts to ensuring that the constraints on the control can be satisfied throughout the state space under actuation limits. The NCBF safety verification problem effectively combines two problems that are known to be difficult, namely, input-output verification of neural networks (VNN) [15, 16, 17, 18, 19, 20] and reachability verification of nonlinear systems. While sound and complete verifiers such as dReal can be applied to

NCBFs, they typically can only handle systems of dimension three or small neural networks [21, 22]. In [23], exact conditions for safety verification of NCBFs with ReLU activation functions were proposed that leverage the piecewise-linearity of ReLU-NNs to reduce verification time compared to dReal for general activation functions. The exact conditions, however, still require checking correctness of the NCBF by solving a nonlinear optimization problem along each piecewise-linear segment. Hence, the NCBF verification problem remains intractable for high-dimensional systems.

In this paper, we propose a framework for Synthesis with Efficient Exact Verification (SEEV) for piecewise-linear NCBFs. The main insight of SEEV is that the computational bottleneck of NCBF verification is the inherent requirement of verifying each linear segment of the neural network. We mitigate this bottleneck by (i) developing a training procedure that reduces the number of segments that must be verified and (ii) constructing verification algorithms that efficiently enumerate the linear segments at the safety boundary and exploit easily-checked sufficient conditions to reduce computation time. Towards (i), we introduce a regularizer to the loss function that penalizes the dissimilarity of activation patterns along the CBF boundary. Towards (ii), we propose a breadthfirst search algorithm for efficiently enumerating the boundary segments, as well as tight linear over-approximations of the nonlinear optimization problems for verifying each segment. Moreover, we integrate the synthesis and verification components by incorporating safety counterexamples returned by the safety verifier into the training dataset. Our simulation results demonstrate significant improvements in verification efficiency and reliability across a range of benchmark systems.

Related Work: Neural control barrier functions have been proposed to describe complex safety sets to remain inside and certify safety of a controlled system [24, 21, 25, 26] or synthesize control input based on NCBFs to ensure safety [8, 9, 10, 27]. However, the synthesized NCBF may not ensure safety. Safety verification of NCBFs is required. Sum-of-squares (SOS) optimization [28, 29, 30, 31, 32] has been widely used for polynomial barrier functions, however, they are not applicable due to the non-polynomial and potentially non-differentiable activation functions of NCBFs. VNN [33, 34, 35] and methods for ReLU neural networks [36, 37] are also not directly applicable to NCBF verification. Nonlinear programming approach [23] provides another route for exact verification but is computationally intensive and relies on VNN tools. To synthesize neural networks with verifiable guarantees, Counterexample Guided Inductive Synthesis (CEGIS) has been applied using SMTbased techniques [21, 38, 39, 40, 41]. Other verification-in-the-loop approaches utilize reachability analysis [42] and branch-and-bound neural network verification tools [43]. However, existing works suffer from the difficulty of performing verification and generating counterexamples in a computationally efficient manner. Sampling-based approaches [41, 11] aim to prove safety using Lipschitz conditions, but they rely on dense sampling over the state space, which is computationally prohibitive. In this work, we present SEEV to integrate the synthesis and efficient verification by incorporating safety counterexamples from the exact verification.

Organization The remainder of the paper is organized as follows. Section 2 gives the system model and background on neural networks and the conditions of valid NCBFs. Section 3 presents the SEEV framework. Section 4 presents our efficient and exact verification. Section 5 contains simulation results. Section 6 concludes the paper.

2 Preliminaries

This section presents the system model, notations on neural networks, and exact conditions of safety.

2.1 System Model

We consider a system with state x ( t ) ∈ X ⊆ R n and input u ( t ) ∈ U ⊆ R m , with initial condition x ( t 0 ) = x 0 where x 0 lies in an initial set I ⊆ X . The continuous-time nonlinear control-affine system has the dynamics given by

where f : R n → R n and g : R n → R n × m are known continuous functions.

We consider the case that the system is required to remain inside a given set of states, i.e., x ( t ) ∈ C for all time t ≥ t 0 . The set C , referred to as the safe set , is defined as C = { x : h ( x ) ≥ 0 } by some given continuous function h : R n → R . The unsafe region is given by X \ C .

2.2 Neural Network Model and Notations

We let W and r denote the weight and bias of a neural network, and let θ be a parameter vector obtained by concatenating W and r . We consider a θ -parameterized feedforward neural network b θ : R n → R constructed as follows. The network consists of L layers, with each layer i consisting of M i neurons. We let ( i, j ) ∈ { 1 , . . . , L }×{ 1 , . . . , M i } denote the j -th neuron at the i -th layer. We denote the pre-activation input as z ( i ) j , piecewise linear activation function σ and the post-activation output as ˆ z ( i ) j = σ ( z ( i ) j ) . Specifically, we assume that the NN has the Rectified Linear Unit (ReLU) activation function, defined by σ ( z ) = z for z ≥ 0 and σ ( z ) = 0 for z < 0 . We define the neuron ( i, j ) as active if z ( i ) j > 0 , inactive if z ( i ) j < 0 and unstable if z ( i ) j = 0 . Let S = τ S ( x ) = { ( i, j ) : z ( i ) j ≥ 0 } ⊆ { ( i, j ) : i = 1 , . . . , L, j = 1 , . . . , M i } denote the set of activated and unstable neurons, produced by state x and function τ S . Let T ( x ) = τ T ( x ) = { ( i, j ) : z ( i ) j = 0 } denote the set of unstable neurons produced by x and τ T . T ( S 1 , . . . , S r ) denote the set of unstable neurons produced by activation sets S 1 , . . . , S r . The set of inactive neurons is given by S c , i.e., the complement of S , and consists of neurons with negative pre-activation input. We define vectors W ij ( S ) ∈ R n and scalars r ij ( S ) ∈ R such that z ( i ) j = W ij ( S ) T x + r ij ( S ) in the Appendix A.1. The symmetric difference between two sets A and B , denoted by A ∆ B , is defined as A ∆ B = ( A \ B ) ∪ ( B \ A ) . Finally, we define the terms hyperplane and hinge . For any S ⊆ { 1 , . . . , L }×{ 1 , . . . , M i } , we define X ( S ) := { x : S ( x ) = S } . The collection of X ( S ) for all S is the set of hyperplanes associated with the ReLU neural network. A hyperplane that intersects the set { x : b θ ( x ) = 0 } is a boundary hyperplane . The intersection of hyperplanes X ( S 1 ) , . . . , X ( S r ) is called a hinge . A hinge that intersects the set { x : b θ ( x ) = 0 } is a boundary hinge .

2.3 Guaranteeing Safety via Control Barrier Functions

Barrier certificates [28] ensure the safety of a feedback-controlled system under policy µ ( x | λ ) by identifying a CBF to represent the invariant safe set. The barrier certificate defines an inner safe region D := { x : b ( x ) ≥ 0 } for some continuous function b . The verifiable invariance of D is obtained from the following result.

Theorem 1 (Nagumo's Theorem [44], Section 4.2) . A closed set D is controlled positive invariant if, whenever x ∈ ∂ D , where ∂ D denotes the boundary of D . we have

for some u ∈ U where A D ( x ) is the tangent cone to D at x .

We denote a state ˆ x c ce with ˆ x c ce ∈ ∂ D that violates (2) as a safety counterexample . In the case where b is continuously differentiable, (2) can be satisfied by selecting u to satisfy the condition ∂b ∂x ( f ( x ( t )) + g ( x ( t )) u ( t )) ≥ -α ( b ( x ( t ))) , where α : R → R is a strictly increasing function with α (0) = 0 . When b is not continuously differentiable, as in a ReLU NCBFs, a modified condition is needed. Prior work [23] introduces exact conditions for safety verification of ReLU NCBFs, based on the following proposition. A collection of activation sets S 1 , . . . , S r is complete if, for any S ′ / ∈ { S 1 , . . . , S r } , we have X ( S 1 ) ∩ · · · ∩ X ( S r ) ∩ X ( S ′ ) = ∅ .

Proposition 1. Suppose the function ReLU neural network-defined function b satisfies the following conditions:

(i) For all activation sets S 1 , . . . , S r with { S 1 , . . . , S r } complete and any x satisfying b ( x ) = 0 and

there exist l ∈ { 1 , . . . , r } and u ∈ U such that

(ii) For all activation sets S , we have

Any feedback control law µ : X → U that satisfies (4)-(6) is guaranteed to ensure safety and is referred to as an NCBF control policy. Given a nominal control policy π nom ( x ) , safe actions can be derived from a ReLU NCBF as a safety filter[29, 9] by solving the following optimization problem proposed in [23, Lemma 2]:

̸

The solution to this optimization problem provides a control u that minimally deviates from the nominal control π nom ( x ) while satisfying NCBF constraints derived in Proposition 1 ensuring that D is positive invariant and is contained in C . Based on Proposition 1, we can define different types of safety counterexamples. Correctness counterexamples, denoted by ˆ x c ce , refers to a state ˆ x c ce ∈ D ∩ ( X \ C ) . Hyperplane verification counterexamples refer to states ˆ x h ce that violate (6). Hinge verification counterexamples are states x with T ( x ) = ∅ that violate (4)-(6).

3 Synthesis

In this section, we present the framework to synthesize NCBF b θ ( x ) to ensure the safety of the system (1). The synthesis framework aims to train an NCBF and construct an NCBF-based safe control policy. We first formulate the problem and present an overview of the framework in 3.1. Then we demonstrate the design of the loss function in 3.2.

3.1 Overall Formulation

Our primary objective is to synthesize a ReLU Neural Control Barrier Function (ReLU-NCBF) for (1) and develop a safe control policy to ensure system safety.

Problem 1. Given a system (1) , initial set I and a safety set C , synthesize a ReLU NCBF b θ ( x ) parameterized by θ such that the conditions in Proposition 1 are satisfied. Then construct a control policy to synthesize u t such that the system remains positive invariant in D := { x : b θ ( x ) ≥ 0 } ⊆ C .

We propose SEEV to address this problem with the synthesis framework demonstrated in Fig. 1. The training dataset T is initialized by uniform sampling over X . The training framework consists of two loops. The inner loop attempts to choose parameter θ for b θ ( x ) to satisfy the safety condition by minimizing the loss function over training data T . The outer loop validates a given NCBF b θ ( x ) by searching for safety counterexamples ˆ x ce and updates the training dataset as T ∪ { ˆ x ce } .

To train the parameters of the NCBF to satisfy the conditions of Proposition 1, we propose a loss function that penalizes the NCBF for violating constraints (i) and (ii) at a collection of sample points. The loss function is a weighted sum of three terms. The first term is the correctness loss penalizing state ˆ x ∈ X \ C with b θ ( x ) ≥ 0 . The second term is verification loss that penalizes states ˆ x that ∄ u such that (4)-(6) hold. The third term is a regularizer minimizing the number of hyperplanes and hinges along the boundary. However, minimizing the loss function is insufficient to ensure safety [9] because there may exist safety counterexamples outside of the training dataset. In order to guarantee safety, SEEV introduces an efficient exact verifier to certify whether b θ ( x ) meets the safety conditions outlined in Proposition 1. The verifier either produces a proof of safety or generates a safety counterexample that can be added to the training dataset to improve the NCBF.

The integration of the verifier can improve safety by adding counterexamples to guide the training process, however, it may also introduce additional computation complexity. We propose a combined approach, leveraging two complementary methods to address this issue. First, the verification of SEEV introduces an efficient algorithm in Section 4 to mitigate the computational scalability challenges that arise as neural network depth and dimensionality increase. Second, SEEV introduces a regularizer to limit the number of boundary hyperplanes and hinges to be verified, addressing the complexity that arises as neural network size increases.

Enumeration

Sec. 4.1

Efficient

Verification

Sec. 4.2

Training

Dataset

NCBF

Training

Sec. 3

NCBF

Hyperplanes

& Hinges

Yes

No

Counterexamples

Valid

NCBF

(i)	in

Proposition	1

(ii)	in

Proposition	1

Boundary

Activation

Regularizer

3.2 Loss Function Design and NCBF Training

The goal of the inner loop is to choose parameters θ so that the conditions of Proposition 1 are satisfied for all ˆ x ∈ T and the computational cost of verifying safety is minimized. To achieve the latter objective, we observe (based on results presented in Table 2) that the computational complexity of verification grows with the cardinality of the collection of activation sets that intersect the safety boundary ∂ D . The collection is defined as B := { S i : ∂ D∩X ( S i ) = ∅} . Hence, we formulate the following unconstrained optimization problem to search for θ .

̸

where L B ( T ) regularizer to minimize |B| , L f ( T ) is the loss penalizing the violations of constraint (4)-(6) ((i) of Proposition 1), L c ( T ) penalizes the violations of constraint (7) ((ii) of Proposition 1), and λ B , λ f and λ c are non-negative coefficients defined as follows.

L f Regularizer: For each sample ˆ x ∈ T the safe control signal is calculated by

where W = W for differentiable points and W = ˜ W defined as the subgradient at non-differentiable points. The regularizer L f enforces the satisfaction of the constraint by inserting a positive relaxation term r in the constraint and minimizing r with a large penalization in the objective function. We have the loss L f defined as L f = || u -π nom ( x ) || 2 2 + r . We use [45] to make this procedure differentiable, allowing us to employ the relaxation loss into the NCBF loss function design.

L c Regularizer: L c regularizer enforces the correctness of the NCBF. In particular, it enforces the b θ ( x ) of safe samples x ∈ T I to be positive, and b θ ( x ) of unsafe samples T X\C to be negative. Define N safe = |T I | and N unsafe = |T X\C | , and with a small positive tuning parameter ϵ > 0 , the loss term L c can be defined as

where [ · ] + = max ( · , 0) . a 1 and a 2 are positive parameters controlling penalization strength of the violations of safe and unsafe samples.

L B Regularizer: We propose a novel regularizer to limit the number of boundary hyperplanes and hinges by penalizing the dissimilarity, i.e., S (ˆ x i )∆ S (ˆ x j ) of boundary activation sets S (ˆ x ) ∈ B . However, the dissimilarity measure of boundary activation sets is inherently nondifferentiable. To address this issue the regularizer introduces the generalized sigmoid function σ k ( z ) = 1 1+exp( -k · z ) to compute the vector of smoothed activation defined as ϕ σ k ( x ) := [ σ k ( z i,j ) , ∀ i, j ∈ { 1 , . . . , L } × { 1 , . . . , M i } ] . The L B regularizer conducts the following two steps to penalize dissimilarity.

In the first step, the regularizer identifies the training data in the boundary hyperplanes and hinges denoted as ˆ x ∈ T ∂ D . The set is defined as T ∂ D := { ˆ x : ˆ x ∈ X ( S ) , ∀ S ∈ B} . To further improve the efficiency, the regularizer approximates T ∂ D with a range-based threshold ϵ on the output of the NCBF, i.e., | b θ (ˆ x ) | ≤ ϵ .

The second step is to penalize the dissimilarity of S ∈ B . To avoid the potential pitfalls of enforcing similarity across the entire boundary B , the regularizer employs an unsupervised learning approach to

group the training data into N B clusters. We define the collection of the activation set in each cluster as B i ⊆ B and the collection in each cluster as T B i := { ˆ x : ˆ x ∈ ⋃ S ∈ B i X ( S ) } . The L B is then defined as follows, with an inner sum over all pairs of ˆ x ∈ T B i and an outer sum over all clusters.

4 Verification

Enumerate boundary

hyperplanes using

NBFS (LP)

Correctness

Verification (18)

Safety CE

Sufficient Condition

Verification

Interval

𝒰

(20)

𝒰 ∈ ℝ

!

(21)

𝑺

!

=

[1 1 0

…

1 0]

𝑺

"

=

[1 1 1

…

0 0]

𝑺

#

=

[1 1 0

…

0 0]

𝑺

$

=

[1 1 1

…

0 0]

⋮

Exact Condition

Verification for

Fail

Fail

Pass

{ 𝑺

!

, 𝑺

$

,

𝑺

"

, 𝑺

#

,

𝑺

!

, 𝑺

$

, 𝑺

#

}

Enumerate hinges (LP)

Sufficient

Condition

Heuristics

Fail

Exact Condition

Verification for

Hinges (22)

Safety Guarantee

Theorem 2

Pass

Pass

Safety CE

Fail

Safety CE

Fail

Pass

In this section, we demonstrate the efficient exact verification of the given NCBF b θ ( x ) to ensure the positive invariance of the set D under the NCBF-based control policy. In what follows, we propose an efficient enumeration and progressive verification moving from sufficient to exact conditions. The overview of the proposed approach is as shown in Fig. 2. SEEV decomposes the NCBF into hyperplanes and hinges and verifies each component hierarchically, with novel tractable sufficient conditions verified first and the more complex exact conditions checked only if the sufficient conditions fail. Given an NCBF b θ ( x ) , the verification of SEEV returns (i) a Boolean variable that is 'true' if the conditions of Proposition 1 are satisfied and 'false' otherwise, and (ii) a safety counterexample ˆ x that violates the conditions of Proposition 1 if the result is 'false'. Algorithm 1 presents an overview of the verification of SEEV. The algorithm consists of an enumeration stage to identify all boundary hyperplanes and hinges, and a verification stage to certify satisfaction of conditions in Proposition 1 for all hyperplanes and hinges.

Algorithm 1 Efficient Exact Verification

4.1 Enumeration of Hyperplanes and Hinges

The boundary enumeration identifies the boundary hyperplanes S 0 ∈ B . It initially identifies the initial boundary activation set S 0 ∈ B , enumerates all S ∈ B by NBFS starting from S 0 , and finally enumerates all hinges consisting of the intersections of hyperplanes. The NBFS approach avoids over-approximation of the set of boundary hyperplanes that may be introduced by, e.g., interval propagation methods, and hence is particularly suited to deep neural networks.

In what follows, we assume that the unsafe region X \ C and initial safe set I are connected, and use ∂ D to refer to the connected component of the boundary of D that separates I and X \ C . This

assumption is without loss of generality since we can always repeat the following procedure for each connected component of I and X \ C .

Initial Activation Set Identification: First, we identify the initial boundary activation set S 0 . Given ˆ x U ∈ X \ C and ˆ x I ∈ I , define a line segment

The following lemma shows the initial boundary activation set S 0 can always be produced as S 0 = S (˜ x ) for some ˜ x ∈ ˜ L .

Lemma 1. Given two sample points ˆ x U , such that b (ˆ x U ) < 0 , and ˆ x I , such that b (ˆ x U ) > 0 , let ˜ L denote the line segment connecting these two points. Then, there exists a point ˜ x ∈ ˜ L with b θ (˜ x ) = 0 .

Lemma 1 follows from the intermediate value theorem and continuity of b θ ( x ) . In order to search for S 0 , we choose a sequence of N ˜ L points x 0 1 , . . . , x 0 N ˜ L ∈ ˜ L . For each x 0 i , we check to see if X ( S ( x 0 i )) ∩ ∂ D ̸ = ∅ by solving boundary linear program BoundaryLP ( S ( x 0 i )) (14) in Appendix A.4

Activation Sets Enumeration: We next describe Neural Breadth-First Search (NBFS) for enumerating all activation sets along the zero-level set, given an initial set S 0 . NBFS enumerates a collection of boundary hyperplanes denoted as S by repeating the following two steps.

Step 1: Given a set S , NBFS identifies a collection of neighbor activation sets denoted as ˜ B

We check whether S ∈ B by solving the linear program USLP ( S , ( i, j )) (15) in Appendix A.4.

as follows. For each ( i, j ) with i = 1 , . . . , L and j = 1 , . . . , M i , construct S ′ as S ′ = { S \ ( i, j ) , ( i, j ) ∈ S ′ S ∪ ( i, j ) , ( i, j ) / ∈ S ′ . ′

If there exists such a state x , then S ′ is added to ˜ B . To further improve efficiency, we employ the simplex algorithm to calculate the hypercube that overapproximates the boundary hyperplane, denoted as H ( S ) ⊇ X ( S ) , and relax the last constraint of (14) to x ∈ H ( S ) .

Step 2: For each S ′ ∈ ˜ B , NBFS determines if the activation region X ( S ′ ) is on the boundary (i.e., satisfies X ( S ′ ) ∩ ∂ D ̸ = ∅ ) by checking the feasibility of BoundaryLP ( S ′ ) . If there exists such a state x , then S ′ is added to S . This process continues in a breadth-first search manner until all such activation sets on the boundary have been enumerated. When this phase terminates, S = B . Detailed procedure is described as Algorithm 3 in Appendix A.3.

Hinge Enumeration: The verifier of SEEV enumerates a collection V of boundary hinges, where each boundary hinge V ∈ V is a subset S 1 , . . . , S r of B with X ( S 1 ) ∩ X ( S r ) ∩ ∂ D ̸ = ∅ .

Given S i ⊆ B and S , hinge enumeration filter the set of neighbor activation sets of S defined as N S ( S i ) := { S ′ : S ′ ∆ S = 1 , S ′ ∈ S i } . Then, hinge enumeration identifies hinges V by solving linear program HingeLP ( N ( d ) S ( S i )) (16) in Appendix A.4. If ∃ x , hinge enumeration includes the hinge into the set V∪ V . The efficiency can be further improved by leveraging the sufficient condition verification proposed in Section 4.2. The following result describes the completeness guarantees of S and V enumerated in Line 5 and 8 of Algorithm 1.

Proposition 2. Let S and V denote the output of Algorithm 1. Then the boundary ∂ D satisfies ∂ D ⊆ ⋃ S ∈S X ( S ) . Furthermore, if S is complete and (⋂ r i =1 X ( S i ) ) ∩ { x : b ( x ) = 0 } ̸ = ∅ , then { S 1 , . . . , S r } ∈ V .

The proof is omitted due to the space limit. A detailed proof is provided in Appendix A.2

4.2 Efficient Verification

The efficient verification component takes the sets of boundary hyperplanes S and boundary hinges V and checks that the conditions of Proposition 1 hold for each of them. As pointed out after Proposition 1, the problem of searching for safety counterexamples can be decomposed into searching for correctness, hyperplane, and hinge counterexamples. In order to maximize the efficiency of our approach, we first consider the least computationally burdensome verification task, namely, searching for correctness counterexamples. We then search for hyperplane counterexamples, followed by hinge counterexamples.

Correctness Verification: The correctness condition ((7)) can be verified for boundary hyperplane X ( S ) by solving the nonlinear program (17) in Appendix A.5. When h ( x ) is convex, (17) can be solved efficiently. Otherwise, dReal can be used to check satisfiability of (17) in a tractable runtime.

Hyperplane Verification: Hyperplane counterexamples can be identified by solving the optimization problem (18) in Appendix A.5. Solving (18) can be made more efficient when additional structures on the input set U and dynamics f and g are present. Consider a case U = { Dω : || ω || ∞ ≤ 1 } . In this case, the problem reduces to the nonlinear program (19) in Appendix A.5. If f ( x ) and g ( x ) are linear in x , then the problem boils down to a linear program. If bounds on the Lipschitz coefficients of f and g are available, then they can be used to derive approximations of (19).

̸

If U = R m , then by [23, Corollary 1], the problem can be reduced to the nonlinear program (20) in Appendix A.5. If g ( x ) is a constant matrix G , then safety is automatically guaranteed if W ( S ) T G = 0 . If f ( x ) is linear in x as well, then (20) is a linear program.

Hinge Verification: The hinge V = { S 1 , . . . , S r } can be certified by solving the nonlinear optimization problem (21) in Appendix A.5. In practice, simple heuristics are often sufficient to verify safety of hinges without resorting to solving (21). If W ( S ) T f ( x ) > 0 for all x ∈ X ( S 1 ) ∩· · ·∩X ( S r ) , then the control input u = 0 suffices to ensure safety. Furthermore, if U = R m and there exists i ∈ { 1 , . . . , m } and s ∈ { 0 , 1 } such that sign (( W ( S l ) T g ( x )) i ) = s for all x ∈ X ( S 1 ) ∩ · · · X ( S r ) and l = 1 , . . . , r , then u can be chosen as u i = Ks for some sufficiently large K > 0 to ensure that the conditions of Proposition 1.

Safety Guarantee: The safety guarantees of our proposed approach are summarized in Theorem 2.

Theorem 2. Given a NCBF b θ ( x ) , b θ ( x ) is a valid NCBF if it passes the verification of Algorithm 1 using dReal to solve the optimization problems (17) , (18) , and (21) .

The proof is derived from completeness of the enumeration in Algorithm 1 and dReal. A detailed proof can be found in Appendix A.6

5 Experiments

In this section, we evaluate the proposed SEEV in regularizer efficacy and verification efficiency. We also demonstrated the improved performance with counter-example guidance in the synthesis framework, whose results are detailed in B.2. We experiment on four systems, namely Darboux, obstacle avoidance, hi-ord 8 , and spacecraft rendezvous. The experiments run on a workstation with an Intel i7-11700KF CPU, and an NVIDIA GeForce RTX 3080 GPU. We include experiment settings in Appendix B.1 and hyperparameters settings in Table 4 in Appendix B.3.

5.1 Experiment Setup

Darboux: We consider the Darboux system [46], a nonlinear open-loop polynomial system with detailed settings presented in Appendix B.1

Obstacle Avoidance (OA): We evaluate our proposed method on a controlled system [47]. We consider Unmanned Aerial Vehicles (UAVs) avoiding collision with a tree trunk. The system state consists of a 2-D position and aircraft yaw rate x := [ x 1 , x 2 , ψ ] T . The system is manipulated by the yaw rate input u with detailed settings presented in Appendix B.1.

Spacecraft Rendezvous (SR): We evaluate our approach on a spacecraft rendezvous problem from [48]. The system state is x = [ p x , p y , p z , v x , v y , v z ] T and control input is u = [ u x , u y , u z ] T with with detailed settings presented in Appendix B.1.

hi-ord 8 : We evaluate our approach on an eight-dimensional system that first appeared in [21] to evaluate the scalability of the proposed method. Detailed settings can be found in Appendix B.1

5.2 Regularizer Efficacy Evaluation

Table 2 and Figure 3 illustrates the impact of regularization on the CBF boundary's activation sets. Table 2 compares various configurations, where n denotes the input dimensions, L represents the number of layers, and M indicates the number of hidden units per layer. N o and N r are the number of

1.0

0.5

0.0

0.5

1.0

1.0

0.5

0.0

0.5

1.0

X1

0.25

0.00

0.25

0.50

0.75

1.00

(a)

r

= 0

1.0

0.5

0.0

0.5

1.0

1.0

0.5

0.0

0.5

1.0

X1

0.25

0.00

0.25

0.50

0.75

1.00

(b)

r

= 50

hyperplanes along the zero-level boundary of the CBF without and with regularization, respectively, with r indicating the regularization strength. C o captures the CBF's coverage of the safe region, while ρ ( · ) = C ( · ) /C o represents the safety coverage ratio relative to the unregularized CBF. Notably, "N/A" entries indicate configurations where training a fully verifiable network was infeasible due to the excessive number of boundary hyperplanes, which leads the verification process to time out.

The results demonstrate that regularization effectively reduces the number of activation sets along the CBF boundary without compromising the coverage of the safe region. The efficiency is especially improved in cases with a greater number of hidden layers, where the unregularized model results in a significantly higher number of hyperplanes. For instance, in the SR case with n = 6 , L = 4 , and M = 8 , the regularization reduces N r =50 to 627 from N o = 6218 , maintaining the same safety coverage ( ρ r =50 = 1 ). See Appendix B.4 for hyperparameter sensitivity analysis.

Figure 3 illustrates the level sets of two CBFs trained for the SR case with n = 6 , L = 4 , and M = 8 . These level sets are extracted from the first two dimensions with the rest set to zero. Each colored patch represents an activation pattern. The regularizer organizes the activation sets around the boundary, reducing unnecessary rapid changes and thereby enhancing the verification efficiency.

5.3 Efficient Verification Evaluation

The results presented in Table 2 illustrate a significant improvement in verification efficiency for Neural Control Barrier Functions NCBFs using the proposed method. In the table t h represents the time spent searching for hyperplanes containing the CBF boundary and verifying CBF sufficient conditions on these boundaries, and t g represents the time spent in hinge enumeration and verification. The total time, T , is the sum of t h and t g . We compare our approach with three baselines, exact verification [23], SMT-based verification [21] with dReal and Z3. Baseline methods' run times are represented by Baseline [23], dReal, and Z3.

In the Darboux cases, our method achieves verification in 2.5 seconds and 3.3 seconds for M = 256 and M = 512 respectively, whereas baseline methods take substantially longer, with Baseline [23]

taking 315 seconds and 631 seconds, and both dReal and Z3 taking more than 3 hours. Similarly, in the OA cases, our method's run times range from 0.39 seconds to 20.6 seconds, faster than the baseline methods. In the more higher dimensional systems high-ord 8 and SR, our method significantly outperforms Baseline [23]. Specifically, in high-ord 8 our methods finishes within 22.4 seconds while Baseline [23], dReal and Z3 times out, due to the need to enumerate the 8-dimensional input space. For the SR case, SEEV's run time are 9.8 seconds and 60.1 seconds, beating Baseline [23] which takes 179 seconds and 298.7 seconds respectively. Neural barrier certificate based dReal and Z3 are able to directly applicable since they require an explicit expression of the controlled feedback system. However, the SR system is manipulated by an NCBF-based safe controller that is nontrivial to derive an explicit expression.

Note that hinge enumeration and certification may be time-consuming procedure, since they involve enumerating all combinations of hyperplanes. However, the results from Table 2 show that the certification can be completed on most hyperplanes with sufficient condition verification in Section 4.2, greatly improving the overall run time.

6 Conclusion

This paper considered the problem of synthesizing and verifying NCBFs with ReLU activation function in an efficient manner. Our approach is guided by the fact that the main contribution to the computational cost of verifying NCBFs is enumerating and verifying safety of each piecewise-linear activation region at the safety boundary. We proposed Synthesis with Efficient Exact Verification (SEEV), which co-designs the synthesis and verification components to enhance scalability of the verification process. We augment the NCBF synthesis with a regularizer that reduces the number of piecewise-linear segments at the boundary, and hence reduces the total workload of the verification. Wethen propose a verification approach that efficiently enumerates the linear segments at the boundary and exploits tractable sufficient conditions for safety.

Limitations: The method proposed in this paper mitigated the scalability issue. However, the synthesis and verification of NCBFs for higher-dimensional systems is challenging. Exact verification of non-ReLU NCBFs, which lack ReLU's simple piecewise linearity, remains an open problem.

References

Shao-Chen Hsu, Xiangru Xu, and Aaron D Ames. Control barrier function based quadratic programs with application to bipedal robotic walking. In 2015 American Control Conference (ACC) , pages 4542-4548. IEEE, 2015.

Devansh R Agrawal and Dimitra Panagou. Safe control synthesis via input constrained control barrier functions. In 2021 60th IEEE Conference on Decision and Control (CDC) , pages 6113-6118. IEEE, 2021.

Xiangru Xu, Jessy W Grizzle, Paulo Tabuada, and Aaron D Ames. Correctness guarantees for the composition of lane keeping and adaptive cruise control. IEEE Transactions on Automation Science and Engineering , 15(3):1216-1229, 2017.

Joseph Breeden and Dimitra Panagou. High relative degree control barrier functions under input constraints. In 2021 60th IEEE Conference on Decision and Control (CDC) , pages 6119-6124. IEEE, 2021.

Hongkai Dai and Frank Permenter. Convex synthesis and verification of control-lyapunov and barrier functions with input constraints. In 2023 American Control Conference (ACC) , pages 4116-4123. IEEE, 2023.

Shucheng Kang, Yuxiao Chen, Heng Yang, and Marco Pavone. Verification and synthesis of robust control barrier functions: Multilevel polynomial optimization and semidefinite relaxation, 2023.

Nicholas Rober, Michael Everett, Songan Zhang, and Jonathan P How. A hybrid partitioning strategy for backward reachability of neural feedback loops. In 2023 American Control Conference (ACC) , pages 3523-3528. IEEE, 2023.

Charles Dawson, Sicun Gao, and Chuchu Fan. Safe control with learned certificates: A survey of neural Lyapunov, barrier, and contraction methods for robotics and control. IEEE Transactions on Robotics , 2023.

Oswin So, Zachary Serlin, Makai Mann, Jake Gonzales, Kwesi Rutledge, Nicholas Roy, and Chuchu Fan. How to train your neural control barrier function: Learning safety filters for complex input-constrained systems. arXiv preprint arXiv:2310.15478 , 2023.

Charles Dawson, Zengyi Qin, Sicun Gao, and Chuchu Fan. Safe nonlinear control using robust neural Lyapunov-barrier functions. In Conference on Robot Learning , pages 1724-1735. PMLR, 2022.

Manan Tayal, Hongchao Zhang, Pushpak Jagtap, Andrew Clark, and Shishir Kolathaya. Learning a formally verified control barrier function in stochastic environment. arXiv preprint arXiv:2403.19332 , 2024.

Kehan Long, Cheng Qian, Jorge Cortés, and Nikolay Atanasov. Learning barrier functions with memory for robust safe navigation. IEEE Robotics and Automation Letters , 6(3):4931-4938, 2021.

Wei Xiao, Tsun-Hsuan Wang, Ramin Hasani, Makram Chahine, Alexander Amini, Xiao Li, and Daniela Rus. Barriernet: Differentiable control barrier functions for learning of safe robot control. IEEE Transactions on Robotics , 2023.

Hengjun Zhao, Xia Zeng, Taolue Chen, Zhiming Liu, and Jim Woodcock. Learning safe neural network controllers with barrier certificates. Formal Aspects of Computing , 33:437-455, 2021.

Huan Zhang, Tsui-Wei Weng, Pin-Yu Chen, Cho-Jui Hsieh, and Luca Daniel. Efficient neural network robustness certification with general activation functions. Advances in Neural Information Processing Systems , 31:4939-4948, 2018.

Kaidi Xu, Zhouxing Shi, Huan Zhang, Yihan Wang, Kai-Wei Chang, Minlie Huang, Bhavya Kailkhura, Xue Lin, and Cho-Jui Hsieh. Automatic perturbation analysis for scalable certified robustness and beyond. Advances in Neural Information Processing Systems , 33, 2020.

Hadi Salman, Greg Yang, Huan Zhang, Cho-Jui Hsieh, and Pengchuan Zhang. A convex relaxation barrier to tight robustness verification of neural networks. Advances in Neural Information Processing Systems , 32:9835-9846, 2019.

Kaidi Xu, Huan Zhang, Shiqi Wang, Yihan Wang, Suman Jana, Xue Lin, and Cho-Jui Hsieh. Fast and Complete: Enabling complete neural network verification with rapid and massively parallel incomplete verifiers. In International Conference on Learning Representations , 2021.

Shiqi Wang, Huan Zhang, Kaidi Xu, Xue Lin, Suman Jana, Cho-Jui Hsieh, and J Zico Kolter. Beta-CROWN: Efficient bound propagation with per-neuron split constraints for complete and incomplete neural network verification. Advances in Neural Information Processing Systems , 34, 2021.

Huan Zhang, Shiqi Wang, Kaidi Xu, Yihan Wang, Suman Jana, Cho-Jui Hsieh, and Zico Kolter. A branch and bound framework for stronger adversarial attacks of ReLU networks. In Proceedings of the 39th International Conference on Machine Learning , volume 162, pages 26591-26604, 2022.

Alessandro Abate, Daniele Ahmed, Alec Edwards, Mirco Giacobbe, and Andrea Peruffo. Fossil: A software tool for the formal synthesis of Lyapunov functions and barrier certificates using neural networks. In Proceedings of the 24th International Conference on Hybrid Systems: Computation and Control , pages 1-11, 2021.

Alec Edwards, Andrea Peruffo, and Alessandro Abate. Fossil 2.0: Formal certificate synthesis for the verification and control of dynamical models. arXiv preprint arXiv:2311.09793 , 2023.

Hongchao Zhang, Junlin Wu, Yevgeniy Vorobeychik, and Andrew Clark. Exact verification of relu neural control barrier functions. Advances in Neural Information Processing Systems , 36, 2024.

Felix Berkenkamp, Matteo Turchetta, Angela Schoellig, and Andreas Krause. Safe model-based reinforcement learning with stability guarantees. Advances in Neural Information Processing Systems , 30, 2017.

Zengyi Qin, Kaiqing Zhang, Yuxiao Chen, Jingkai Chen, and Chuchu Fan. Learning safe multiagent control with decentralized neural barrier certificates. arXiv preprint arXiv:2101.05436 , 2021.

Zhizhen Qin, Tsui-Wei Weng, and Sicun Gao. Quantifying safety of learning-based selfdriving control using almost-barrier functions. In 2022 IEEE/RSJ International Conference on Intelligent Robots and Systems (IROS) , pages 12903-12910. IEEE, 2022.

Simin Liu, Changliu Liu, and John Dolan. Safe control under input limits with neural control barrier functions. In Conference on Robot Learning , pages 1970-1980. PMLR, 2023.

Stephen Prajna, Ali Jadbabaie, and George J Pappas. A framework for worst-case and stochastic safety verification using barrier certificates. IEEE Transactions on Automatic Control , 52(8):1415-1428, 2007.

Aaron D Ames, Samuel Coogan, Magnus Egerstedt, Gennaro Notomista, Koushil Sreenath, and Paulo Tabuada. Control barrier functions: Theory and applications. In 2019 18th European control conference (ECC) , pages 3420-3431. IEEE, 2019.

Weiye Zhao, Tairan He, Tianhao Wei, Simin Liu, and Changliu Liu. Safety index synthesis via sum-of-squares programming. In 2023 American Control Conference (ACC) , pages 732-737. IEEE, 2023.

Michael Schneeberger, Florian Dörfler, and Silvia Mastellone. SOS construction of compatible control Lyapunov and barrier functions. arXiv preprint arXiv:2305.01222 , 2023.

Andrew Clark. Verification and synthesis of control barrier functions. In 2021 60th IEEE Conference on Decision and Control (CDC) , pages 6105-6112. IEEE, 2021.

Claudio Ferrari, Mark Niklas Muller, Nikola Jovanovic, and Martin Vechev. Complete verification via multi-neuron relaxation guided branch-and-bound. arXiv preprint arXiv:2205.00263 , 2022.

Patrick Henriksen and Alessio Lomuscio. Deepsplit: An efficient splitting method for neural network verification via indirect effect analysis. In IJCAI , pages 2549-2555, 2021.

Huan Zhang, Shiqi Wang, Kaidi Xu, Linyi Li, Bo Li, Suman Jana, Cho-Jui Hsieh, and J Zico Kolter. General cutting planes for bound-propagation-based neural network verification. Advances in Neural Information Processing Systems , 35:1656-1670, 2022.

Guy Katz, Clark Barrett, David L Dill, Kyle Julian, and Mykel J Kochenderfer. Reluplex: An efficient SMT solver for verifying deep neural networks. In Computer Aided Verification: 29th International Conference, CAV 2017, Heidelberg, Germany, July 24-28, 2017, Proceedings, Part I 30 , pages 97-117. Springer, 2017.

Guy Katz, Derek A Huang, Duligur Ibeling, Kyle Julian, Christopher Lazarus, Rachel Lim, Parth Shah, Shantanu Thakoor, Haoze Wu, Aleksandar Zelji´ c, et al. The Marabou framework for verification and analysis of deep neural networks. In Computer Aided Verification: 31st International Conference, CAV 2019, New York City, NY, USA, July 15-18, 2019, Proceedings, Part I 31 , pages 443-452. Springer, 2019.

Hengjun Zhao, Xia Zeng, Taolue Chen, and Zhiming Liu. Synthesizing barrier certificates using neural networks. In Proceedings of the 23rd international conference on hybrid systems: Computation and control , pages 1-11, 2020.

Alessandro Abate, Daniele Ahmed, Mirco Giacobbe, and Andrea Peruffo. Formal synthesis of lyapunov neural networks. IEEE Control Systems Letters , 5(3):773-778, 2020.

Andrea Peruffo, Daniele Ahmed, and Alessandro Abate. Automated and formal synthesis of neural barrier certificates for dynamical models. In Tools and Algorithms for the Construction and Analysis of Systems , pages 370-388. Springer International Publishing, 2021.

Mahathi Anand and Majid Zamani. Formally verified neural network control barrier certificates for unknown systems. IFAC-PapersOnLine , 56(2):2431-2436, 2023.

Yixuan Wang, Chao Huang, Zhaoran Wang, Zhilu Wang, and Qi Zhu. Design-while-verify: correct-by-construction control learning with verification in the loop. In Proceedings of the 59th ACM/IEEE Design Automation Conference , pages 925-930, 2022.

Xinyu Wang, Luzia Knoedler, Frederik Baymler Mathiesen, and Javier Alonso-Mora. Simultaneous synthesis and verification of neural control barrier functions through branch-and-bound verification-in-the-loop training. In 2024 European Control Conference (ECC) , pages 571-578. IEEE, 2024.

Franco Blanchini and Stefano Miani. Set-Theoretic Methods in Control , volume 78. Springer, 2008.

A. Agrawal, B. Amos, S. Barratt, S. Boyd, S. Diamond, and Z. Kolter. Differentiable convex optimization layers. In Advances in Neural Information Processing Systems , 2019.

Xia Zeng, Wang Lin, Zhengfeng Yang, Xin Chen, and Lilei Wang. Darboux-type barrier certificates for safety verification of nonlinear hybrid systems. In Proceedings of the 13th International Conference on Embedded Software , pages 1-10, 2016.

Andrew J Barry, Anirudha Majumdar, and Russ Tedrake. Safety verification of reactive controllers for uav flight in cluttered environments using barrier certificates. In 2012 IEEE International Conference on Robotics and Automation , pages 484-490. IEEE, 2012.

Christopher Jewison and R Scott Erwin. A spacecraft benchmark problem for hybrid control and estimation. In 2016 IEEE 55th Conference on Decision and Control (CDC) , pages 3300-3305. IEEE, 2016.

A Supplement

A.1 Definition of W ij ( S ) and r ij ( S )

In what follows, we define vectors W ij ( S ) ∈ R n and scalars r ij ( S ) ∈ R such that z ( i ) j = W ij ( S ) T x + r ij ( S ) . The weight and bias of the input layer is defined by

Proceeding inductively, define W i ( S ) ∈ R M i × n to be a matrix with columns W ij ( S ) for j = 1 , . . . , M i and r i ( S ) ∈ R M i to be a vector with elements r ij ( S ) . We then define

At the last layer, let W ( S ) = W L ( S )Ω and r ( S ) = Ω T r L ( S ) + ψ , so that y = W ( S ) T x + r ( S ) if S = { ( i, j ) : z ( i ) j ≥ 0 } .

A.2 Proof of Proposition 2

Proof. Suppose that x ′ ∈ ∂ D\ (⋃ S ∈S X ( S ) ) , and let x denote the state on ∂ D found by Line 5 of Algorithm 1. Since ∂ D is connected, there exists a path γ with γ (0) = x and γ (1) = x ′ contained in ∂ D . Let S 0 , S 1 , . . . , S K denote a sequence of activation sets with S 0 ∈ S ( x ) , S K ∈ S ( x ′ ) , and S 0 equal to the set computed at Line 5 of Algorithm 1. Then there exists i ≥ 2 such that S i -1 ∈ S and S i / ∈ S , and there exists t ′ such that γ ( t ′ ) ∈ X ( S i -1 ) ∩ X ( S i ) ∩ { x : b ( x ) = 0 } . We then have that T ( S i -1 , S i ) is a subset of the set T , and hence S i will be identified and added to S at Line 5 of Algorithm 1.

Now, suppose that S 1 , . . . , S r ∈ S is complete and (⋂ r i =1 X 0 ( S i ) ) ∩ { x : b ( x ) = 0 } ̸ = ∅ . Let T = T ( S 1 , . . . , S r ) . Then T is a subset of the sets S 1 , . . . , S r ∈ S . Since the intersection of the X ( S ) sets with { x : b ( x ) = 0 } is nonempty, { S 1 , . . . , S r } is added to V .

A.3 Algorithm for Verification

SEEV identifies the initial activation set by conducting a BoundaryLP-based binary search as shown in Algorithm. 2. The algorithm presents a procedure to identify a hyperplane characterized by an initial activation set S 0 that may contain the boundary ∂ D . It iterates over pairs of sample states from the unsafe training set T X\C and the safe training set T I . For each pair (ˆ x X\C , ˆ x I ) , the algorithm initializes the left and right points of a search interval. It then performs a binary search by repeatedly computing the midpoint x mid and checking the feasibility of the boundary linear program BoundaryLP ( x mid ) . The algorithm terminates when BoundaryLP ( x mid ) is feasible, returning the activation set S ( x mid ) as S 0 .

SEEV utilizes NBFS for enumerating all activation sets along the zero-level set in a breadth-first search manner, starting from an initial set S 0 . The algorithm initializes a queue Q and a set S with S 0 . While Q is not empty, it dequeues an activation set S and checks if the set S ∈ B by solving the boundary linear program BoundaryLP ( S ) . If so, S is identified and added to S . The algorithm then explores its neighboring activation sets by flipping each neuron activation ( i, j ) in S . For each flip, it solves the unstable neuron linear program USLP ( S , ( i, j )) . If USLP is feasible, the new activation set S ′ obtained by flipping ( i, j ) is added to Q for further search on its neighbors. This process continues until all relevant activation sets are explored, resulting in a set S that contains activation sets potentially on the boundary.

SEEV enumerates all hinges V ∈ V with Algorithm 4. Algorithm 4 outlines a method to enumerate all feasible hinge hyperplanes formed by combinations of activation sets up to size n . The algorithm takes as input a set of activation sets S and a maximum combination size n . It initializes an empty list to store feasible hinges. For each combination size k from 2 to n , the algorithm iterates over all activation sets in S . For each activation set S , it generates candidate combinations V c based on adjacency-either the set of adjacent activation sets when k = 2 , or the feasible combinations

Algorithm 2 Binary Search for S 0

Algorithm 3 Enumerate Activated Sets

from the previous iteration when k > 2 . It then checks each candidate combination S c by verifying adjacency and solving the hinge linear program HingeLP ( S c ∪ { S } ) . If the HingeLP is feasible, the combination is added to the list of feasible hinges V . This process continues until all combinations up to size n have been examined, resulting in a comprehensive list of feasible hinge hyperplanes that are essential for understanding the intersections of activation regions.

A.4 Linear Programs for Enumeration

Given a state x 0 i , we define the activation set is S = τ S ( x 0 i ) . To determine if the activation set S ∈ B , we solve a linear program referred to as the boundary linear program. The program checks the existence of a state x ∈ X ( S ( x 0 i )) that satisfies W ( S ( x 0 i )) T x + r ( S ( x 0 i )) = 0 . The boundary linear program (BoundaryLP ( S ( x 0 i )) ) is defined as follows.

NBFS conducts its search in a breadth-first manner. To determine if a neighboring activation set, resulting from a flip in its ( i, j ) neuron, may contain the boundary, NBFS solves a linear program, referred to as the unstable neuron linear program of USLP ( S , ( i, j )) . This linear program checks the existence of a state x ∈ X ( S ) ∩ { x : W ij x + r ij = 0 } that satisfies W ( S ) x + r ( S ) = 0 . The

Algorithm 4 Enumerate Hinges

unstable neuron linear program is defined as follows.

Finally, we enumerate all hinges by solving the hinge linger program HingeLP ( S i ) , defined as follows.

A.5 Nonlinear Programs for Verification

The correctness condition ((7)) can be verified for boundary hyperplane X ( S ) by solving the nonlinear program

If we found some state x such that h ( x ) < 0 and W ( S ) T x + r ( S ) = 0 , it indicates that the state lies on the boundary of the set D but not inside the set C , i.e., x ∈ ∂ D / ∈ C . This implies a violation of the condition D ⊆ C .

Hyperplane counterexamples can be identified by solving the optimization problem

Consider a case U = { Dω : || ω || ∞ ≤ 1 } . The bounded input set U allows us to replace the maximization over u with L -1 norm term ∥ W ( S ) T g ( x ) D ∥ 1 , which simplifies the computational complexity. In this case, the problem reduces to the nonlinear program

If U = R m , then by [23, Corollary 1], the problem can be reduced to the nonlinear program

The hinge V = { S , . . . , S }

A.6 Proof of Theorem 2

Proof. By Lemma 1, the initial boundary activation set S 0 is ensured to be identified by the verification of SEEV in Line 4 Algorithm. 1. Given S 0 and the enumeration in Line 5 and 6 Algorithm. 1 being complete, the completeness of S and V is guaranteed by Proposition 2. By dReal solving the equivalent NLPs, the conditions of Proposition 1, are satisfied. Therefore, b θ ( x ) is a valid NCBF

B Experiments

B.1 Experiment Settings

Experiment Settings of Darboux: The dynamic model of Darboux is given as follows.

We define state space, initial region, and safe region as X : { x ∈ R 2 : x ∈ [ -2 , 2] × [ -2 , 2] } , I : { x ∈ R 2 : 0 ≤ x 1 ≤ 1 , 1 ≤ x 2 ≤ 2 } and C : { x ∈ R 2 : x 1 + x 2 2 ≥ 0 } respectively.

Experiment Settings of the Obstacle Avoidance: The dynamic model of obstacle avoidance is given as follows.

We define the state space, initial region and safe region as X , I and C , respectively as

Experiment Settings of the Spacecraft Rendezvous: The state of the chaser is expressed relative to the target using linearized Clohessy-Wiltshire-Hill equations, with state x = [ p x , p y , p z , v x , v y , v z ] T , control input u = [ u x , u y , u z ] T and dynamics defined as follows.

We define the state space and safe region as X , initial safe region X I and C , respectively as

hi-ord 8 : The dynamic model of hi-ord 8 is given as follows.

x (8) +20 x (7) +170 x (6) +800 x (5) +2273 x (4) +3980 x (3) +4180 x (2) +2400 x (1) +576 = 0 (27) where we denote the i -th derivative of variable x by x ( i ) . We define the state space X , initial region X I and safe region C , respectively as

B.2 Synthesis Framework Evaluation

The experimental results presented in Table 3 demonstrate the effectiveness of Counter Example (CE) guided training on Darboux and hi-ord 8 system. In this method, after each training epoch, we calculate the Control Barrier Function (CBF) outputs on representative samples. If the CBF correctly categorizes the samples into safe and unsafe regions, the certification procedure is initiated. If the CBF fails certification, the counter example is added to the training dataset for retraining. Otherwise, training is stopped early.

We capped the maximum training epochs at 50 and conducted three rounds of training for each network structure and system using different random seeds. The results indicate that without CE, the training process could basrely generate a CBF that passes certification. In contrast, with CE enabled, there was a success rate of at least 1/3 for most network structure, with verifiable policies generated in as few as 10 epochs. This highlights the improvement in training efficiency and reliability with the incorporation of CEs.

B.3 Hyperparameters

Table 4 shows values the following hyperparameters used during CBF synthesis:

N data: number of samples to train CBF on.

a 1 : weight penalizing incorrect classification of safe samples in Equation 11.

a 2 : weight penalizing incorrect classification of unsafe samples Equation 11.

λ f : weight penalizing violation of Lie derivative condition of CBF in Equation 9.

λ c : weight penalizing correct loss for in Equation 9.

n cluster: number of clusters in L B regularization.

k σ : value of k used in generalized sigmoid function to perform differentiable activation pattern approximation.

ϵ boundary: the threshold for range-based approximation of CBF boundary.

B.4 Sensitivity Analysis of Hyperparameters

Next, we performed a sensitivity analysis of the hyperparameters. We chose the case study of Spacecraft Rendezvous with the number of layers L = 4 and the number of hidden units per layer

N = 8 . We studied the sensitivity of the training performance to the hyperparameters λ B , λ f , and λ c in Equation 8, corresponding to the weightings for regularizing the number of boundary hyperplanes, NCBF value violation, and NCBF Lie derivative violation, respectively. We also studied the sensitivity to the hyperparameter k employed in the modified sigmoid function σ k ( z ) = 1 1+exp( -k · z ) to approximate the regularization pattern. We compared against the settings used in the original paper: λ B = 10 , λ f = 2 , λ c = 100 , and k = 4 . For each hyperparameter, we chose four values to perform the ablation study: λ B ∈ { 0 , 1 , 10 , 50 } , λ f ∈ { 1 , 2 , 4 , 8 } , λ c ∈ { 1 , 10 , 100 , 200 } , and k ∈ { 1 , 2 , 4 , 8 } . For each setting, we performed three runs with different random seeds. We measured the results by Success Rate (SR) , Min Epoch (ME) , and N , as described in the caption of Table 5.

λ c regularizes the shape of the NCBF by penalizing incorrectly categorized samples. Table 5a indicates that when λ c is too small, the training procedure fails to train an NCBF that correctly separates the safe and unsafe regions, resulting in failure of certification. Meanwhile, a larger weight delivers similarly good performance.

λ f penalizes violations of Lie derivative conditions. Table 5b shows that the result is not sensitive to this hyperparameter, as this term quickly goes down to 0 when the Lie derivative condition is satisfied. We note that over-penalizing this condition should be avoided since the NCBF would otherwise learn an unrecoverable incorrect shape, as demonstrated by the failure case when λ f = 8 .

λ B has been studied in the original paper, with detailed analysis in Section 5.2. The boundary regularization term reduces the number of boundary hyperplanes and benefits convergence.

Table 5c shows the importance of the term k used in the modified sigmoid function. Since this term appears in the exponential part of the sigmoid function, when it is too large, it leads to gradient explosions during backpropagation, which crashes the training process. Conversely, a reasonably larger k better approximates the activation pattern, leading to a reduced number of boundary hyperplanes.

In summary, balancing the hyperparameters is relatively straightforward, as the training performance remains robust across a wide range of hyperparameter values. When training failures do occur, we can systematically identify the cause from observation. This enables proper guidance in choosing and adjusting the appropriate hyperparameters.

NeurIPS Paper Checklist

The checklist is designed to encourage best practices for responsible machine learning research, addressing issues of reproducibility, transparency, research ethics, and societal impact. Do not remove the checklist: The papers not including the checklist will be desk rejected. The checklist should follow the references and follow the (optional) supplemental material. The checklist does NOT count towards the page limit.

Please read the checklist guidelines carefully for information on how to answer these questions. For each question in the checklist:

You should answer [Yes] , [No] , or [NA] .

[NA] means either that the question is Not Applicable for that particular paper or the relevant information is Not Available.

Please provide a short (1-2 sentence) justification right after your answer (even for NA).

The checklist answers are an integral part of your paper submission. They are visible to the reviewers, area chairs, senior area chairs, and ethics reviewers. You will be asked to also include it (after eventual revisions) with the final version of your paper, and its final version will be published with the paper.

The reviewers of your paper will be asked to use the checklist as one of the factors in their evaluation. While "[Yes] " is generally preferable to "[No] ", it is perfectly acceptable to answer "[No] " provided a proper justification is given (e.g., "error bars are not reported because it would be too computationally expensive" or "we were unable to find the license for the dataset we used"). In general, answering "[No] " or "[NA] " is not grounds for rejection. While the questions are phrased in a binary way, we acknowledge that the true answer is often more nuanced, so please just use your best judgment and write a justification to elaborate. All supporting evidence can appear either in the main paper or the supplemental material, provided in appendix. If you answer [Yes] to a question, in the justification please point to the section(s) where related material for the question can be found.

IMPORTANT, please:

Delete this instruction block, but keep the section heading 'NeurIPS paper checklist" ,

Keep the checklist subsection headings, questions/answers and guidelines below.

Do not modify the questions and only use the provided macros for your answers .

1. Claims

Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?

Answer: [Yes]

Justification: The abstract and introduction clearly states the paper's contributions and scope. Guidelines:

The answer NA means that the abstract and introduction do not include the claims made in the paper.

The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.

The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.

It is fine to include aspirational goals as motivation as long as it is clear that these goals are not attained by the paper.

2. Limitations

Question: Does the paper discuss the limitations of the work performed by the authors? Answer: [Yes]

Justification: We point out the limitation on dynamical models in Section 2.1 and limitations on the type of activation functions throughout the paper.

Guidelines:

The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.

The authors are encouraged to create a separate "Limitations" section in their paper.

The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.

The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on a few datasets or with a few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.

The authors should reflect on the factors that influence the performance of the approach. For example, a facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or a speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.

The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.

If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.

While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an important role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.

3. Theory Assumptions and Proofs

Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?

Answer: [Yes]

Justification: We present assumptions in Section 2, and theoretical contributions in Section 4 with proof in the appendix.

Guidelines:

The answer NA means that the paper does not include theoretical results.

All the theorems, formulas, and proofs in the paper should be numbered and crossreferenced.

All assumptions should be clearly stated or referenced in the statement of any theorems.

The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch to provide intuition.

Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.

Theorems and Lemmas that the proof relies upon should be properly referenced.

4. Experimental Result Reproducibility

Question: Does the paper fully disclose all the information needed to reproduce the main experimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?

Answer: [Yes]

Justification: We specified random seeds for reproducibility. The code is uploaded with all the commands containing random seeds.

Guidelines:

The answer NA means that the paper does not include experiments.

If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.

If the contribution is a dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.

Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.

While NeurIPS does not require releasing code, the conference does require all submissions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example

(a) If the contribution is primarily a new algorithm, the paper should make it clear how to reproduce that algorithm.

(b) If the contribution is primarily a new model architecture, the paper should describe the architecture clearly and fully.

(c) If the contribution is a new model (e.g., a large language model), then there should either be a way to access this model for reproducing the results or a way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).

(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.

5. Open access to data and code

Question: Does the paper provide open access to the data and code, with sufficient instructions to faithfully reproduce the main experimental results, as described in supplemental material?

Answer: [Yes]

Justification: The code is submitted with the paper.

Guidelines:

The answer NA means that paper does not include experiments requiring code.

Please see the NeurIPS code and data submission guidelines ( https://nips.cc/ public/guides/CodeSubmissionPolicy ) for more details.

While we encourage the release of code and data, we understand that this might not be possible, so 'No' is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for a new open-source benchmark).

The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines ( https: //nips.cc/public/guides/CodeSubmissionPolicy ) for more details.

The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.

The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only a subset of experiments are reproducible, they should state which ones are omitted from the script and why.

At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).

Providing as much information as possible in supplemental material (appended to the paper) is recommended, but including URLs to data and code is permitted.

6. Experimental Setting/Details

Question: Does the paper specify all the training and test details (e.g., data splits, hyperparameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?

Answer: [Yes]

Justification: We provide the detailed experiment settings with hyperparameters in the appendix. We present how to generate training data in Section 3.

Guidelines:

The answer NA means that the paper does not include experiments.

The experimental setting should be presented in the core of the paper to a level of detail that is necessary to appreciate the results and make sense of them.

The full details can be provided either with the code, in appendix, or as supplemental material.

7. Experiment Statistical Significance

Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?

Answer: [Yes]

Justification: All verification experiments are conducted in a deterministic manner. We also present the success rate of training with random seeds in the appendix.

Guidelines:

The answer NA means that the paper does not include experiments.

The authors should answer "Yes" if the results are accompanied by error bars, confidence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.

The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).

The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)

The assumptions made should be given (e.g., Normally distributed errors).

It should be clear whether the error bar is the standard deviation or the standard error of the mean.

It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have a 96% CI, if the hypothesis of Normality of errors is not verified.

For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative error rates).

If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.

8. Experiments Compute Resources

Question: For each experiment, does the paper provide sufficient information on the computer resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?

Answer: [Yes]

Justification: We present the details of the machine we experiment on in Section 5.

Guidelines:

The answer NA means that the paper does not include experiments.

The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.

The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.

The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make it into the paper).

9. Code Of Ethics

Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https://neurips.cc/public/EthicsGuidelines ?

Answer: [Yes]

Justification: the research conducted in the paper conforms, in every respect, with the NeurIPS Code of Ethics

Guidelines:

The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.

If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics.

The authors should make sure to preserve anonymity (e.g., if there is a special consideration due to laws or regulations in their jurisdiction).

10. Broader Impacts

Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?

Answer: [NA]

Justification: This paper focuses on the safe control problem of dynamical systems. Therefore it would not harm or raise technology to harm the society.

Guidelines:

The answer NA means that there is no societal impact of the work performed.

If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.

Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.

The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.

The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.

If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML).

11. Safeguards

Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?

Answer: [NA]

Justification: the paper poses no such risks. The experiments we conduct only generate simulation-based data of dynamic systems with no such risks.

Guidelines:

The answer NA means that the paper poses no such risks.

Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.

Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.

We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make a best faith effort.

12. Licenses for existing assets

Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?

Answer: [Yes]

Justification: We cited all references in the both the paper and the code Readme file.

Guidelines:

The answer NA means that the paper does not use existing assets.

The authors should cite the original paper that produced the code package or dataset.

The authors should state which version of the asset is used and, if possible, include a URL.

The name of the license (e.g., CC-BY 4.0) should be included for each asset.

For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.

If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswithcode.com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of a dataset.

For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.

If this information is not available online, the authors are encouraged to reach out to the asset's creators.

13. New Assets

Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?

Answer: [Yes]

Justification: We upload our code with the submission.

Guidelines:

The answer NA means that the paper does not release new assets.

Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.

The paper should discuss whether and how consent was obtained from people whose asset is used.

At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.

14. Crowdsourcing and Research with Human Subjects

Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?

Answer: [NA]

the paper does not involve crowdsourcing nor research with human subjects

Guidelines:

The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.

Including this information in the supplemental material is fine, but if the main contribution of the paper involves human subjects, then as much detail as possible should be included in the main paper.

According to the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.

15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects

Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?

Answer: [NA]

Justification: the paper does not involve crowdsourcing nor research with human subjects.

Guidelines:

The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.

Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.

We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.

For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.

Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper proposes for synthesizing (and verifying) Neural Barrier Certificates with ReLU activation functions.\nThe authors focus on continuous-time systems which are controlled via a control input u(t) and define a dynamical\nsystem as safe if for every state there exists a control output u(t) such that some unsafe region is never reachable.\nTo synthesize Neural Barrier Certificates, the authors build on characterization of ReLU Barrier Certificates by [15].\nIn particular, [15] observed that Relu NNs are piece-wise linear and it therefore suffices to check specific linearly constrained\nregions at the border of the region $\\mathcal{D}$ described by the barrier certificate.\nThe authors then extend prior work in two directions. First, they propose a technique for training ReLU Barrier Certificates\nin a manner that minimizes the number of different linearly constrained regions at the border of $\\mathcal{D}$.\nSecondly, the authors propose an optimized scheme for verification of the resulting constraints w.r.t. the NN.\n\nReferences cited below:\n- [R1] Bak, Stanley, et al. \"Improved geometric path enumeration for verifying relu neural networks.\" Computer Aided Verification: 32nd International Conference, CAV 2020, Los Angeles, CA, USA, July 21–24, 2020, Proceedings, Part I 32. Springer International Publishing, 2020.\n- [R2] Wang, Shiqi, et al. \"Beta-crown: Efficient bound propagation with per-neuron split constraints for neural network robustness verification.\" Advances in Neural Information Processing Systems 34 (2021): 29909-29921.\n\nSTRENGTHS:\n(S10) The approach presented by the authors makes the work described in [15] much more applicable:\nAs shown in the experiments, both novel techniques improve the performance of the overall approach and push beyond what was analyzable using [15].\n\n(S20) The paper is mostly well-written and provides a good overview of the work.\n\nWEAKNESSES:\nMinor opportunities for improvement:\n\n(O1) In Section 4.1 the paper develops a new algorithm for enumerating linear NN regions along the border of $\\mathcal{D}$.\nI wonder how this technique materially differs from the branch exploration approaches used by branch-and-bound NN verification tools [R1,R2].\nFor example, geometric path enumeration [R1] also enumerates feasible linear regions.\nWhile I agree that this approach would probably not be directly applicable due to the additional constraints w.r.t. the border of $\\mathcal{D}$,\na conceptual comparison might help in making the paper better digestible to the NN verification community.\n\n(O2) For an audience less familiar with neural barrier certificates, it would be helpful to provide insights into how such an NN could be used\nto control a dynamical system in practice. I assume the barrier certificate can somehow be used to choose the correct control signal u at runtime, however, this correspondence is not entirely obvious to me.\n\n\nMinor notes:\n- Line 148: $\\not\\exists u$ makes the text harder to read, I would suggest writing this in english (similarly in other places)\n\nQUESTIONS:\n(Q1) I would be really interested to hear something about (O2).\n  In a similar direction: I assume there is some limit on how often I have to choose control actions using the barrier certificate to ensure the dynamical system stays safe?\n\nLIMITATIONS:\nThe limitations of the work become clear throughout the paper.", "TITLE": "Official Review", "RECOMMENDATION": 7, "REVIEWER_CONFIDENCE": 3, "SOUNDNESS_CORRECTNESS": 4, "DATE": "2024-07-10"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper presents an efficient NCBF training and verification framework by leveraging activation regions along the safety boundary. Specifically, reducing piecewise-linear segments acts as a regularizer and nonlinear programs are solves for efficient verificaiton. Experiemnts validates the efficiency of the proposed method compared to the exact verificaiton baselines.\n\nSTRENGTHS:\nThe motivation for training and verifying neural CBFs is sound and important, especially for improving the efficiency of exact (complete) verification. Sections 2 and 3 are well-written and easy to follow. I like the idea of regularizer as a training loss to limit the number of boundary hyperplanes, and it is insightful and novel. The experiments are comprehensive, and the effectiveness of the proposed method is validated.\n\nWEAKNESSES:\n- The idea of incorporating verification in the training process by counterexample is not new; it is also called verificaiton-in-the-loop training in the literature [1,2]. The last two terms of training losses in Eq. (8) are also off-the-shelf, which weakens the contribution. The new regularizer in Eq. (9) is not very clear, how to determine k here?\n- Section 4 is poorly organized and looks sophisticated but trivial for each individual part. It is recommended that figures are adopted to illustrate the high-level idea clearly and more details are included in the appendix.\n- For the Hyperplane Verification in Section 4.2, it is hard to find a global solution for nonlinear programming. But if we adopt bounds on the Lipschitz of f and g, the approximation error may cause incompleteness or unsoundness for the exact verification. \n- Similarly, in the Hige Verification, if the sufficient condition is verified for efficiency, the verification will be sound but incomplete, which is OK but not exact. Consequently, the baselines in the experiment should include incomplete verification methods for a fair comparison, or at least the verified rate should be reported compared to the exact verification.\n\n---\n[1] Wang et al. Design-while-verify: correct-by-construction control learning with verification in the loop, 2022\n\n[2] Wang et al. Simultaneous synthesis and verification of neural control barrier functions through branch-and-bound verification-in-the- loop training, 2023\n\nQUESTIONS:\nSee Weaknesses.\n\nLIMITATIONS:\nThere is no explicit Limitation section in the main text or appendix.", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 3, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2024-07-12"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe authors propose a novel approach to synthesize neural control barrier functions (NCBFs) for continuous-time deterministic dynamical systems. Their goal is to synthesize a NCBF to prove the set invariance of the system wrt a given set. In order to do that, the authors propose a verification algorithm to prove that a neural network is a NCBF for a given system based on enumerating boundary segments. The efficacy of the method is evaluated on various benchmarks.\n\nSTRENGTHS:\n- The paper consider an important problem that is of interest for the community\n\n- The approach developed by the authors seems sound to me and the empirical evaluation highlights the improved efficiency of the methods compared to other existing approaches\n\nWEAKNESSES:\n- The approach considered in this paper follows closely the approach developed in [15]. While this is not necessarily a problem, I feel that the results in this paper are a bit too incremental compared to the ones in [15]. To limit this risk, it would be important that the authors would extend the discussion in the related works compared to [15]. On this context, I acknowledge that in Table 2 SEEV shows improved computation times compared to [15], but it is not clear if that comes with an increased conservatism (because of the over-approximations introduced in SEEV) or if both methods are guaranteed to always return the same verification value.\n\n- I found some parts of the paper to be non-clear. For instance:\n\na) The overloading of notation of \\mathbb{S} in Section 2.1 makes understanding the rest of the paper hard. In fact, first  \\mathbb{S} is first presented as a function of x and then is used as a set of neurons. Please, be precise and if you overload notation please say it explicitly\n\nb) Proposition 1, I could not find the definition of what it means for a set of activation sets to be complete.\n\nc) Problem 1 is a bit unclear. In fact, according to Proposition 1 a NCBF guarantees invariance with respect to set \\mathcal{C}. But in Problem 1 additionally to that, it is required that a control action keep the system invariant wrt to another set \\mathcal{D}\\subseteq \\mathcal{C}. Why is it this? Please, motivate why you need both of these conditions\n\n- Related to point c) it is unclear how in this paper the authors synthesize a control policy to satisfy Problem 1\n\nQUESTIONS:\nAdditionally for for the points identified in the Weaknesses Section, consider also the following:\n\n- If I got it correctly, in solving the various non-linear optimization problems to prove that a neural network is a NCBF in practice you are relying on over-approximations and heuristics. Is this correct? If so, why you can call your method exact?\n\nLIMITATIONS:\nPlease, see Weaknesses Section", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2024-07-14"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes a new training and verification method to synthesize control barrier functions to formally prove the safety of a neural network-controlled nonlinear system. The approach used by this paper involves a new verification procedure that systematically enumerates all linear pieces of ReLU neural networks at the boundary of the barrier function via a breadth-first manner, as well as training strategies with various regularizations to ensure that the neural network does not have too many nonlinear pieces and also encourage the satisfaction of the safety condition. During training, counterexamples were also added to ensure convergence. The proposed method is then evaluated on several dynamical systems and the proposed approach outperformed the previous baseline and naive approaches.\n\nSTRENGTHS:\n1. The new verification approach, which enumerates linear pieces on the boundary in a breadth-first search manner, is (relatively) efficient and technically novel.\n\n2. The training procedure is carefully designed with several loss terms to aid the synthesizing of neural barrier functions. Some of these loss terms, such as the regularizer to limit the number of boundary hyperplanes, are insightful and may inspire future work.\n\n3. Numerical evaluations are comprehensive and also noticeably outperform existing baselines.\n\nBased on these contributions, I tend to accept this paper.\n\nWEAKNESSES:\n1. The proposed verification procedure is based on enumeration of the linear pieces in a ReLU neural network, and can be slow when the neural network is large. But since the problem under study is very difficult and the proposed approach can outperform naive baselines like directly using SMT solvers (dReal, Z3), this is not a big concern.\n\n2. The training loss involves multiple regularization terms, each with its own regularization parameter. Adjusting these parameters to balance each term can be difficult. It would be ideal to show a sensitivity analysis for these hyperparameters.\n\n3. The writing of this paper can be improved. It is difficult to follow the technical details in this paper as many essential formulations are presented only in the appendix.\n\nQUESTIONS:\nAccording to the appendix, several nonlinear programs are needed for the enumeration procedure, and some of them still require expensive solvers such as dReal to solve. Among these nonlinear programs, which ones are harder and take the majority of computation time? Is it possible to further scale up this approach using SOTA neural network verification tools such as alpha-beta-CROWN? A recent work (https://arxiv.org/pdf/2404.07956) has successfully applied neural network verification tools for synthesizing Lyapunov functions, which is also quite related to this work.\n\nLIMITATIONS:\nA limitation paragraph can be helpful. There are still many unsolved challenges in this field, and while this paper outperforms existing approaches, the scalability is still limited to less than 100 neurons and low dimensional environments, and it cannot be applied to non-ReLU neural networks.", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 3, "SOUNDNESS_CORRECTNESS": 4, "DATE": "2024-07-31"}