SEEV: Synthesis with Efficient Exact Verification for ReLU Neural Barrier Functions

Neural Control Barrier Functions (NCBFs) have shown significant promise in enforcing safety constraints on nonlinear autonomous systems. State-of-the-art exact approaches to verifying safety of NCBF-based controllers exploit the piecewise-linear structure of ReLU neural networks, however, such approaches still rely on enumerating all of the activation regions of the network near the safety boundary, thus incurring high computation cost. In this paper, we propose a framework for Synthesis with Efficient Exact Verification (SEEV). Our framework consists of two components, namely (i) an NCBF synthesis algorithm that introduces a novel regularizer to reduce the number of activation regions at the safety boundary, and (ii) a verification algorithm that exploits tight over-approximations of the safety conditions to reduce the cost of verifying each piecewise-linear segment. Our simulations show that SEEV significantly improves verification efficiency while maintaining the CBF quality across various benchmark systems and neural network structures. Our code is available at https://github.com/HongchaoZhang-HZ/SEEV.

Paper

References (50)

Scroll for more · 38 remaining

Similar papers

Peer review

Reviewer Ufq97/10 · confidence 3/52024-07-10

Summary

The paper proposes for synthesizing (and verifying) Neural Barrier Certificates with ReLU activation functions. The authors focus on continuous-time systems which are controlled via a control input u(t) and define a dynamical system as safe if for every state there exists a control output u(t) such that some unsafe region is never reachable. To synthesize Neural Barrier Certificates, the authors build on characterization of ReLU Barrier Certificates by [15]. In particular, [15] observed that Relu NNs are piece-wise linear and it therefore suffices to check specific linearly constrained regions at the border of the region $\mathcal{D}$ described by the barrier certificate. The authors then extend prior work in two directions. First, they propose a technique for training ReLU Barrier Certificates in a manner that minimizes the number of different linearly constrained regions at the border of $\mathcal{D}$. Secondly, the authors propose an optimized scheme for verification of the resulting constraints w.r.t. the NN. References cited below: - [R1] Bak, Stanley, et al. "Improved geometric path enumeration for verifying relu neural networks." Computer Aided Verification: 32nd International Conference, CAV 2020, Los Angeles, CA, USA, July 21–24, 2020, Proceedings, Part I 32. Springer International Publishing, 2020. - [R2] Wang, Shiqi, et al. "Beta-crown: Efficient bound propagation with per-neuron split constraints for neural network robustness verification." Advances in Neural Information Processing Systems 34 (2021): 29909-29921.

Strengths

(S10) The approach presented by the authors makes the work described in [15] much more applicable: As shown in the experiments, both novel techniques improve the performance of the overall approach and push beyond what was analyzable using [15]. (S20) The paper is mostly well-written and provides a good overview of the work.

Weaknesses

Minor opportunities for improvement: (O1) In Section 4.1 the paper develops a new algorithm for enumerating linear NN regions along the border of $\mathcal{D}$. I wonder how this technique materially differs from the branch exploration approaches used by branch-and-bound NN verification tools [R1,R2]. For example, geometric path enumeration [R1] also enumerates feasible linear regions. While I agree that this approach would probably not be directly applicable due to the additional constraints w.r.t. the border of $\mathcal{D}$, a conceptual comparison might help in making the paper better digestible to the NN verification community. (O2) For an audience less familiar with neural barrier certificates, it would be helpful to provide insights into how such an NN could be used to control a dynamical system in practice. I assume the barrier certificate can somehow be used to choose the correct control signal u at runtime, however, this correspondence is not entirely obvious to me. Minor notes: - Line 148: $\not\exists u$ makes the text harder to read, I would suggest writing this in english (similarly in other places)

Questions

(Q1) I would be really interested to hear something about (O2). In a similar direction: I assume there is some limit on how often I have to choose control actions using the barrier certificate to ensure the dynamical system stays safe?

Rating

7

Confidence

3

Soundness

4

Presentation

3

Contribution

3

Limitations

The limitations of the work become clear throughout the paper.

Reviewer q91P6/10 · confidence 3/52024-07-12

Summary

This paper presents an efficient NCBF training and verification framework by leveraging activation regions along the safety boundary. Specifically, reducing piecewise-linear segments acts as a regularizer and nonlinear programs are solves for efficient verificaiton. Experiemnts validates the efficiency of the proposed method compared to the exact verificaiton baselines.

Strengths

The motivation for training and verifying neural CBFs is sound and important, especially for improving the efficiency of exact (complete) verification. Sections 2 and 3 are well-written and easy to follow. I like the idea of regularizer as a training loss to limit the number of boundary hyperplanes, and it is insightful and novel. The experiments are comprehensive, and the effectiveness of the proposed method is validated.

Weaknesses

- The idea of incorporating verification in the training process by counterexample is not new; it is also called verificaiton-in-the-loop training in the literature [1,2]. The last two terms of training losses in Eq. (8) are also off-the-shelf, which weakens the contribution. The new regularizer in Eq. (9) is not very clear, how to determine k here? - Section 4 is poorly organized and looks sophisticated but trivial for each individual part. It is recommended that figures are adopted to illustrate the high-level idea clearly and more details are included in the appendix. - For the Hyperplane Verification in Section 4.2, it is hard to find a global solution for nonlinear programming. But if we adopt bounds on the Lipschitz of f and g, the approximation error may cause incompleteness or unsoundness for the exact verification. - Similarly, in the Hige Verification, if the sufficient condition is verified for efficiency, the verification will be sound but incomplete, which is OK but not exact. Consequently, the baselines in the experiment should include incomplete verification methods for a fair comparison, or at least the verified rate should be reported compared to the exact verification. --- [1] Wang et al. Design-while-verify: correct-by-construction control learning with verification in the loop, 2022 [2] Wang et al. Simultaneous synthesis and verification of neural control barrier functions through branch-and-bound verification-in-the- loop training, 2023

Questions

See Weaknesses.

Rating

6

Confidence

3

Soundness

3

Presentation

2

Contribution

3

Limitations

There is no explicit Limitation section in the main text or appendix.

Reviewer bZn25/10 · confidence 4/52024-07-14

Summary

The authors propose a novel approach to synthesize neural control barrier functions (NCBFs) for continuous-time deterministic dynamical systems. Their goal is to synthesize a NCBF to prove the set invariance of the system wrt a given set. In order to do that, the authors propose a verification algorithm to prove that a neural network is a NCBF for a given system based on enumerating boundary segments. The efficacy of the method is evaluated on various benchmarks.

Strengths

- The paper consider an important problem that is of interest for the community - The approach developed by the authors seems sound to me and the empirical evaluation highlights the improved efficiency of the methods compared to other existing approaches

Weaknesses

- The approach considered in this paper follows closely the approach developed in [15]. While this is not necessarily a problem, I feel that the results in this paper are a bit too incremental compared to the ones in [15]. To limit this risk, it would be important that the authors would extend the discussion in the related works compared to [15]. On this context, I acknowledge that in Table 2 SEEV shows improved computation times compared to [15], but it is not clear if that comes with an increased conservatism (because of the over-approximations introduced in SEEV) or if both methods are guaranteed to always return the same verification value. - I found some parts of the paper to be non-clear. For instance: a) The overloading of notation of \mathbb{S} in Section 2.1 makes understanding the rest of the paper hard. In fact, first \mathbb{S} is first presented as a function of x and then is used as a set of neurons. Please, be precise and if you overload notation please say it explicitly b) Proposition 1, I could not find the definition of what it means for a set of activation sets to be complete. c) Problem 1 is a bit unclear. In fact, according to Proposition 1 a NCBF guarantees invariance with respect to set \mathcal{C}. But in Problem 1 additionally to that, it is required that a control action keep the system invariant wrt to another set \mathcal{D}\subseteq \mathcal{C}. Why is it this? Please, motivate why you need both of these conditions - Related to point c) it is unclear how in this paper the authors synthesize a control policy to satisfy Problem 1

Questions

Additionally for for the points identified in the Weaknesses Section, consider also the following: - If I got it correctly, in solving the various non-linear optimization problems to prove that a neural network is a NCBF in practice you are relying on over-approximations and heuristics. Is this correct? If so, why you can call your method exact?

Rating

5

Confidence

4

Soundness

3

Presentation

2

Contribution

2

Limitations

Please, see Weaknesses Section

Reviewer nDkY6/10 · confidence 3/52024-07-31

Summary

This paper proposes a new training and verification method to synthesize control barrier functions to formally prove the safety of a neural network-controlled nonlinear system. The approach used by this paper involves a new verification procedure that systematically enumerates all linear pieces of ReLU neural networks at the boundary of the barrier function via a breadth-first manner, as well as training strategies with various regularizations to ensure that the neural network does not have too many nonlinear pieces and also encourage the satisfaction of the safety condition. During training, counterexamples were also added to ensure convergence. The proposed method is then evaluated on several dynamical systems and the proposed approach outperformed the previous baseline and naive approaches.

Strengths

1. The new verification approach, which enumerates linear pieces on the boundary in a breadth-first search manner, is (relatively) efficient and technically novel. 2. The training procedure is carefully designed with several loss terms to aid the synthesizing of neural barrier functions. Some of these loss terms, such as the regularizer to limit the number of boundary hyperplanes, are insightful and may inspire future work. 3. Numerical evaluations are comprehensive and also noticeably outperform existing baselines. Based on these contributions, I tend to accept this paper.

Weaknesses

1. The proposed verification procedure is based on enumeration of the linear pieces in a ReLU neural network, and can be slow when the neural network is large. But since the problem under study is very difficult and the proposed approach can outperform naive baselines like directly using SMT solvers (dReal, Z3), this is not a big concern. 2. The training loss involves multiple regularization terms, each with its own regularization parameter. Adjusting these parameters to balance each term can be difficult. It would be ideal to show a sensitivity analysis for these hyperparameters. 3. The writing of this paper can be improved. It is difficult to follow the technical details in this paper as many essential formulations are presented only in the appendix.

Questions

According to the appendix, several nonlinear programs are needed for the enumeration procedure, and some of them still require expensive solvers such as dReal to solve. Among these nonlinear programs, which ones are harder and take the majority of computation time? Is it possible to further scale up this approach using SOTA neural network verification tools such as alpha-beta-CROWN? A recent work (https://arxiv.org/pdf/2404.07956) has successfully applied neural network verification tools for synthesizing Lyapunov functions, which is also quite related to this work.

Rating

6

Confidence

3

Soundness

4

Presentation

2

Contribution

4

Limitations

A limitation paragraph can be helpful. There are still many unsolved challenges in this field, and while this paper outperforms existing approaches, the scalability is still limited to less than 100 neurons and low dimensional environments, and it cannot be applied to non-ReLU neural networks.

Reviewer Ufq92024-08-08

Dear authors, thank you for your answers which address my questions and concerns. In particular, the response to (O1) I found quite useful -- I believe for future readers it may be worthwhile to say this even more explicitly in the paper's final version. Given the response, I stick to my rating.

Authorsrebuttal2024-08-08

Dear Reviewer, Thank you for your feedback and for taking the time to review our paper our responses. We are glad to hear that our responses addressed your questions and concerns, particularly regarding (O1). We appreciate your suggestion to make this point even more explicit in the final version of the paper and will ensure to incorporate this improvement. Thank you once again for your reviews and for maintaining your rating.

Reviewer q91P2024-08-09

Thanks for the clarification. It is suggested to put the ablation study of finding k into the main context to make it more clear. In the revised version, it is also suggested to compare the verification performance and time of inexact verification only with sufficient conditions with the proposed combined exact verification. Overall, considering the incremental verification-in-the-loop training techniques, I decide to raise my rating to be weak accept.

Authorsrebuttal2024-08-09

We sincerely thank the reviewer for their valuable suggestions and for raising the rating. We will incorporate the suggested comparison between the sufficient conditions verification and exact verification in the final version. Additionally, we will put the ablation study on the hyperparameter $k$ in the main text to provide greater clarity. We appreciate your thoughtful feedback and consideration.

Reviewer bZn22024-08-12

I would like to thank the authors for their reply, which clarified some of my doubts. I will then increase my score to 5. In fact, while I still feel the paper is borderline because of the similarities with [15], after the clarification of the authors on the guarantees of the method, I am now tending more towards acceptance. I would also encourage the authors to add the discussion on the synthesis of the safe policy in the paper.

Authorsrebuttal2024-08-12

Dear Reviewer, Thank you for your feedback and for taking the time to review our paper and responses. We are glad to hear that our response helped clarify some of your doubts, and we appreciate your decision to increase your score. While we acknowledge the reference to [15], we would like to briefly reiterate that our work extends beyond the scope of [15] by addressing both the synthesis and verification of neural CBFs (NCBFs), while [15] focuses solely on verification. Additionally, our novel contributions significantly enhance the scalability of the verification process, as summarized in our earlier response. We appreciate your suggestion to include the discussion on the synthesis of the safe policy, and we will ensure to add this to the final version of the paper. Thank you once again for your reviews and for increasing your score.

Reviewer nDkY2024-08-13

Thank you for the response

Thank you for the response. In the final version, it would be great if you could add a clear time deposition of each nonlinear program to the paper so people can understand which part is more challenging in this proposed method. Given its complex nature, it helps people understand the scalability of this algorithm. The addition of discussions and comparisons to NN verifier-based approaches such as [1] and [15] would also be very beneficial. Although many things can be improved, I think this paper is above the bar of NeurIPS and overall I support the acceptance of this paper.

Authorsrebuttal2024-08-13

Thank you for your feedback and for supporting the acceptance of our paper. We will incorporate the suggested changes in our final version by providing a detailed breakdown of the runtime for the Space Rendezvous scenario, as well as a time comparison to [15] in the Obstacle Avoidance case study. We appreciate your valuable suggestions and support.

Program Chairsdecision2024-09-25

Decision

Accept (poster)

© 2026 NYSGPT2525 LLC