🤖 AI

Set-Based Training of Neural Barrier Certificates for Safety Verification of Dynamical Systems

This paper proposes a set-based training approach for neural barrier certificates that integrates formal verification directly into the training process via a specialized loss function, thereby collapsing the iterative training and verification loop into a single procedure that scales effectively with system dimension and handles complex nonlinear dynamics.

Original authors: Miriam Kranzlmüller, Lukas Koller, Tobias Ladner, Matthias Althoff

Published 2026-05-06

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Miriam Kranzlmüller, Lukas Koller, Tobias Ladner, Matthias Althoff

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Big Picture: Building an Invisible Safety Wall

Imagine you are designing a self-driving car or a robot arm. You need to be 100% sure that the machine will never crash into a wall or hurt a person. In the world of engineering, this is called safety verification.

To prove a machine is safe, mathematicians use something called a Barrier Certificate. Think of this as an invisible, magical wall drawn in the air around the machine.

On one side of the wall is the "Safe Zone" (where the machine starts).
On the other side is the "Danger Zone" (where the machine must never go).
The wall is designed so that if the machine touches it, it gets pushed back toward safety, never allowed to cross over.

If you can mathematically prove this wall exists and works perfectly, the machine is certified safe.

The Old Way: The "Guess and Check" Game

Previously, scientists tried to build this invisible wall using a neural network (a type of AI brain). The process was like a frustrating game of "Hot and Cold":

Guess: The AI brain draws a wall based on a few random samples.
Check: A separate, very slow computer program (a verifier) checks if the wall holds up everywhere.
Fail: If the verifier finds even one tiny hole in the wall, the AI has to go back, redraw the wall, and try again.
Repeat: This cycle of "Draw -> Check -> Fail -> Redraw" could take hours or days, especially for complex machines.

The New Way: The "Self-Checking" Wall

The authors of this paper propose a new method called Set-Based Training. Instead of checking the wall after drawing it, they build the checking mechanism into the drawing process itself.

Here is how their new approach works:

1. The "Set" Concept (The Foggy Box)
Instead of checking the wall at single points (like checking if a specific pixel is safe), they check the wall against entire "foggy boxes" (mathematically called zonotopes). Imagine wrapping the entire path the robot might take inside a fuzzy, 3D box. The AI doesn't just look at one spot; it looks at the whole box at once.

2. The "Loss" Score (The Safety Meter)
In standard AI training, the "loss" score tells you how wrong the AI is. In this new method, the loss score is a Safety Meter.

The AI is trained to minimize this score.
The score is calculated by mathematically proving that the "foggy boxes" of the Danger Zone and the "foggy boxes" of the Safe Zone never touch.
The Magic: If the AI gets the score down to zero, it doesn't just mean "it looks good." It means mathematically, the wall is perfect. The safety is proven instantly.

3. The Result: One Step, Not Two
Because the "checking" is part of the "drawing," the AI doesn't need to stop and ask a separate computer for permission. It trains, and the moment the score hits zero, the job is done. There is no second step.

Why This Matters (According to the Paper)

The authors tested this new method on 13 different complex scenarios, including:

Simple systems: Like a car moving in a straight line.
Complex systems: Robots with wobbly, non-linear movements (like a pendulum or a drone in a storm).
High dimensions: Systems with many moving parts (up to 9 dimensions).

The Findings:

100% Success: Their method found a valid safety wall for every single test case.
Speed: It was significantly faster than the old "guess and check" methods. For example, on one complex test, the old method took 47 seconds, while their method took just 1 second.
Versatility: It handled "weird" math (non-polynomial dynamics) that other tools simply couldn't solve.

The Analogy Summary

Old Method: Like a sculptor chiseling a statue, stepping back to ask a judge "Is this safe?" If the judge says "No," the sculptor chisels again. This takes forever.
New Method: Like a sculptor who has a magical chisel that only removes stone if the statue is becoming safer. The sculptor never has to stop and ask for permission. When the sculptor stops, the statue is guaranteed to be perfect because the tool itself ensured it.

What the Paper Does Not Claim

It does not claim this will immediately fix self-driving cars on the road tomorrow.
It does not claim this works for every possible type of machine in the universe (only the specific mathematical models tested).
It does not claim to replace all other safety methods, but rather to offer a faster, more reliable way to synthesize these specific "barrier certificates."

In short, the paper introduces a smarter way to train AI to draw invisible safety walls, turning a slow, repetitive guessing game into a single, fast, and mathematically guaranteed procedure.

Technical Summary: Set-Based Training of Neural Barrier Certificates for Safety Verification of Dynamical Systems

1. Problem Statement

The safety verification of continuous-time dynamical systems is critical for autonomous agents in safety-critical environments (e.g., self-driving vehicles, UAVs, robotic manipulators). A system is considered safe if no trajectory starting from an initial set $X_I$ enters an unsafe set $X_U$ .

Existing verification methods face significant limitations:

Simulation-based methods suffer from exponential runtime growth relative to system dimension.
Reachability analysis uses set-based computations to avoid exponential runtime but can be computationally intensive.
Barrier Certificates offer a formal proof of safety by defining a scalar function $B$ that separates $X_I$ from $X_U$ via its zero-level set. However, recent approaches to synthesize neural network-based barrier certificates rely on an iterative training-verification cycle. In this cycle, a neural network is trained on state-space samples, then formally verified using an external solver (e.g., SMT). If the verification fails (counterexamples found), the network is retrained. This process is costly, potentially requiring many cycles, and does not guarantee convergence to a valid certificate within a single procedure.

2. Methodology: Set-Based Training

The authors propose a novel set-based training approach that integrates formal verification directly into the neural network training process, eliminating the need for a separate verification step.

Core Concept

Instead of training on discrete samples and verifying later, the method trains the neural network $B_\theta$ using a sound set-based loss function. This loss function is computed over entire sets (enclosures) of the state space rather than individual points. When the loss reaches zero, the validity of the barrier certificate is formally proven by construction.

Key Technical Components

A. Sound Set-Based Loss Function
The loss function encodes the three properties required for a barrier certificate (Theorem 1):

Property P I (Unsafe States): All states in $X_U$ must map to positive values. The loss $L_I$ penalizes the lower bound of the set-based image of $X_U$ .
Property P II (Initial States): All states in $X_I$ must map to non-positive values. The loss $L_{II}$ penalizes the upper bound of the set-based image of $X_I$ .
Property P III (Zero-Level Set Dynamics): The Lie derivative $L_f B_\theta$ $L_{f} B_{θ}$ must be negative on the zero-level set $X_Z = \{x \mid B_\theta(x) = 0\}$ $X_{Z} = {x ∣ B_{θ} (x) = 0}$ .
- Since $X_Z$ is unknown and non-convex, the method computes a tight enclosure of $X_Z$ using a union of zonotopes via a recursive branch-and-bound strategy (splitting the input space and discarding regions without zero points).
- For each zonotope in the enclosure, the Lie derivative is enclosed using set-based forward propagation of gradients and the system dynamics.
- The loss $L_{III}$ penalizes the upper bounds of these Lie derivative enclosures.

The total loss is $L = L_I + L_{II} + L_{III}$ . If $L=0$ , the system is formally verified as safe.

B. Set-Based Forward Propagation
To compute these losses, the method propagates zonotopes (a specific type of convex polytope) through the neural network layers:

Linear Layers: Computed exactly via affine maps.
Nonlinear Layers: Enclosed using conservative over-approximations (e.g., range bounding).
Gradients and Lie Derivatives: The set of gradients is propagated backward, and the Lie derivative is computed as the inner product of the gradient set and the flow set.

C. Algorithm
The training loop (Algorithm 1) initializes the network, computes set-based losses for $P_I$ , $P_{II}$ , and $P_{III}$ , updates parameters via gradient descent, and terminates once the total loss is zero.

3. Key Contributions

Single-Procedure Synthesis: A novel approach to synthesize neural barrier certificates in a single set-based training procedure, removing the iterative training-verification cycle.
Sound Loss Function: A set-based loss that soundly encodes all barrier certificate properties. A zero loss value constitutes a formal proof of safety.
Iterative Refinement: An iterative procedure to dynamically enclose the zero-level set and the Lie derivative required for Property P III.
Extensive Evaluation: Evaluation on 13 benchmarks covering linear, polynomial, and non-polynomial dynamics, including high-dimensional systems (up to 9D) and complex set configurations.

4. Experimental Results

The approach was implemented using the CORA toolbox and compared against state-of-the-art tools: SynNBC and FOSSIL (iterative training-verification) and PRoTECT (sum-of-squares optimization).

Success Rate: The proposed method achieved a 100% success rate across all 13 benchmarks.
- In contrast, SynNBC and PRoTECT failed on non-polynomial dynamics and benchmarks with multiple initial/unsafe sets.
- FOSSIL achieved high success rates but degraded on higher-dimensional systems (e.g., 70% on Peruffo 6D, 80% on Peruffo 8D).
Runtime: The set-based training approach was significantly faster than FOSSIL. For example, on the Peruffo (8D) benchmark, the proposed method took 1.0s on average, compared to 47.7s for FOSSIL.
Training Efficiency: The method typically converged in a few training epochs. In contrast, FOSSIL often required multiple training-verification cycles, where each cycle could involve up to 1,000 epochs.
Ablation Studies:
- Network Architecture: Shallow networks (single linear layer) sufficed for linear systems but failed on non-polynomial systems. Deeper networks were required for complex dynamics.
- Zero-Level Set Enclosure: More complex dynamics required more elaborate zero-level set enclosures (more splits/iterations) to satisfy Property P III.

5. Significance and Claims

The paper claims that this approach represents a paradigm shift in safety verification by collapsing the training and verification phases.

Formal Guarantees: Unlike standard neural network training which offers no formal safety guarantees, this method ensures that a zero loss implies a valid barrier certificate.
Scalability: The operations reduce to efficient matrix multiplications, yielding polynomial complexity that scales well with system dimension.
Versatility: The approach is largely agnostic to system dynamics, naturally handling complex nonlinear (non-polynomial) dynamics and complex set representations (e.g., unions of sets, non-convex regions) that interval-based methods struggle with.
Efficiency: By eliminating the costly iterative cycle, the method provides a more efficient path to formal verification for high-dimensional and nonlinear systems.

The authors conclude that their set-based synthesis can efficiently generate barrier certificates without requiring subsequent verification, outperforming prior works particularly on high-dimensional and non-polynomial systems.