Safe-by-Design Learning via Energy-based Neural Networks

Simone Betteti; Morteza Lahijanian; Luca Laurenti

cs.LGSep 29, 2026

Safe-by-Design Learning via Energy-based Neural Networks

Authors: Simone Betteti, Morteza Lahijanian, Luca Laurenti

Organizations: RIAS Lab The Italian Institute of Artificial Intelligence for Industry Torino, 10129, ITA · RECUV University of Colorado Boulder Boulder, CO 80303, USA · Delft Center for Systems and Control, TU Delft, Delft, 2600 AA, The Netherlands

Abstract

Learning neural-network models of dynamical systems with safety guarantees is a fundamental requirement for their deployment in safety-critical settings. Safety is commonly established by proving the invariance of a desired subset in state-space, ensuring that every trajectory initialized in this subset remains confined to it for all time under admissible inputs. Existing frameworks, however, either rely on computationally expensive post-hoc verification or employ safety-enforcing mechanisms without formal correctness guarantees. In this paper, we introduce a novel neural architecture grounded in energy-based modern Hopfield networks to guarantee safety-by-design while retaining sufficient expressiveness to model complex nonlinear dynamics. Specifically, we integrate modern Hopfield networks with a port-Hamiltonian neural ODE, enabling by design the construction of barrier functions yielding explicit admissible-input sets and quantitative robustness radii. Across several benchmarks, including an 12-dimensional nanodrone model, our framework achieves state-of-the-art performance while producing certified invariant sets that are more robust to external solicitations than comparable existing approaches.

Figures & tables

Figure 1: Safe-by-design Energy-Based Model. a) Input-output trajectories from physical or simulated systems are used to train the pH-EBM: the external input $u$ drives the neural dynamics, while the measured output $y$ supervises reconstruction. b) The learned Hamiltonian, parameterized by a modern Hopfield energy, organizes the neural ODE into a continuous energy landscape whose low-energy regions encode stable operating regimes. Beyond interpolating between sparsely observed trajectories, this geometry identifies energy sublevel sets that can be certified as invariant for prescribed classes of inputs. c) Inputs lying within the certified admissible set therefore generate trajectories that remain confined to the desired operating region, turning the learned energy landscape into an explicit quantitative safety certificate.

Benchmark	Published	portHNN-u	pH-EBM
Metrics	RMSE $\downarrow\>$ $\uprho_{\epsilon,\star}$ $\uparrow$	RMSE $\downarrow\>$ $\uprho_{\epsilon,\star}$ $\uparrow$	RMSE $\downarrow\>$ $\uprho_{\epsilon,\star}$ $\uparrow$
Silverbox	[ $\mathbf{0.293}$ ,-]	[ $47.821$ , $2\text{e-}2$ ]	[ $0.422$ , $\mathbf{2}\textbf{e-}\mathbf{1}$ ]
CED	[ $\mathbf{0.054}$ , -]	[ $0.217$ , $3\text{e-}2$ ]	[ $0.064$ , $\mathbf{6}\textbf{e-}\mathbf{1}$ ]
Duffing double-well	[-, -]	[ $0.254$ , $5\text{e-4}$ ]	[ $\mathbf{0.048}$ , $\mathbf{4}\textbf{e-}\mathbf{1}$ ]
$3$ -link pendulum	[ $0.051$ , -]	[ $0.276$ , $\text{5e-}3$ ]	[ $\mathbf{0.014}$ , $\mathbf{2}\textbf{e-}\mathbf{1}$ ]
NanoDrone $0.5\>\mathrm{s}$	[ $13.712$ , -]	[-, -]	[ $\mathbf{12.521}$ , $\mathbf{6}\textbf{e-}\mathbf{2}$ ]

Table 1: Prediction accuracy and certified robustness across nonlinear dynamical systems. Comparative performance of the pH-EBM across benchmarks addressing nonlinear system identification, nonconvex dynamics, and higher-dimensional controlled systems.

Figure 2: Safe long-horizon reconstruction of NanoDrone flight dynamics with pH-EBM. a) Mean absolute error (MAE) of pH-EBM and the black-box baseline ( Busetto et al., 2026 ) over a $5,\mathrm{s}$ Random rollout, ten times the $0.5,\mathrm{s}$ training horizon. The pH-EBM maintains substantially lower error, while the BB error rapidly grows beyond the training window. b-c) Random-trajectory reconstruction relative to the projected certified region $\mathcal{C}_{\epsilon,\star}$ at $\epsilon=-12.926$ . The pH-EBM remains inside the certified set and turns inward near $\Gamma_{\epsilon,\star}$ , whereas the BB trajectory exits the region after approximately $2,\mathrm{s}$ . d) Extrapolation to the unseen Melon excitation. Although BB is more accurate over the original $0.5,\mathrm{s}$ horizon, its long-rollout error quickly increases, while pH-EBM remains bounded, highlighting the distinction between short-horizon accuracy and safe recursive deployment. e-f) Two- and three-dimensional projections of the learned Hamiltonian and shell $\Gamma_{-12.926,\star}$ , revealing a strongly nonconvex yet radially unbounded energy landscape that supports certified long-horizon evolution.

Figure 3: Geometry reconstruction, accuracy, and certified robustness in the 2D Duffing oscillator. a) Ground-truth Duffing Hamiltonian (left) and energies reconstructed by portHNN-u (center) and pH-EBM (right). Both recover the characteristic nonconvex double-well geometry. The pH-EBM panel additionally reports the pointwise input tolerance, whose minimum occurs near the saddle separating the two wells. b) Theoretical (purple) and empirical (blue) state-independent radii $\uprho_{\epsilon,\star}$ across an energy-level sweep. The certificate decreases as the shell approaches the saddle energy, then increases again after the certified component expands beyond it, revealing reduced input tolerance near transitions between operating regimes. c) Reconstruction error and empirical robustness radius for portHNN-u and pH-EBM. While both models achieve accurate trajectory reconstruction, the pH-EBM yields certified radii approximately $2$ - $3$ orders of magnitude larger than portHNN-u.

Appendix figures & tables10 assets

Supplementary material from the paper’s appendix.

Appendix

Benchmark	Metric $\downarrow$	Published	portHNN-u	pH-EBM
Silverbox	RMSE	$[0.289,0.334,0.257]$	$[51.343,50.981,41.138]$	$[0.395,0.545,0.327]$
CED	RMSE	$[0.062,0.047]$	$[0.241,0.366]$	$[0.073,0.055]$
Duffing double-well	RMSE	-	$0.254$	$0.048$
$3$ -link pendulum	RMSE	$0.162;0.162$	$0.051;0.051$	$0.014$
NanoDrone	RMSE	-	$[1.532,5.260,2.150,15.541]$	$[1.368,3.550,1.343,11.648]$
NanoDrone (Melon)	RMSE	$[4.051,12.581,6.059,35.5735]$	$[3.939,12.445,5.574,30.802]$	$[11.860,28.014,7.169,36.597]$

Appendix

Table 2: Prediction accuracy and certified robustness across nonlinear dynamical systems. Comparative performance of the pH-EBM across benchmarks addressing nonlinear system identification, nonconvex dynamics, and higher-dimensional controlled systems. Results reported within square brackets,

[..]

, correspond to evaluations on distinct test sets of the same benchmark, while entries separated by semicolons refer to variants of the reference architecture.

Panel of Figure 4 — Figure 4: Silverbox: learned energy geometry and certificate diagnostics. The upper composite shows the profiled two-dimensional energy view at the nominal shell: traced boundary states are colored by their pointwise admissible-input radius, the red cross marks the least tolerant sampled state, and the adjacent panel resolves the same radii along the shell. The lower sweep compares the sampled shell minimum with the regular-shell estimate as the relative energy budget increases; green diamonds mark detected saddle-energy shells. The second composite contrasts an affine Hamiltonian slice with the profiled envelope in both 2D and 3D. Their close agreement indicates that the selected plane captures the dominant single-well geometry over the explored region. These plots visualize the learned Hamiltonian and should not be interpreted as recovery of a unique physical Silverbox potential.

Panel of Figure 5 — Figure 5: CED: learned energy geometry and certificate diagnostics. The upper composite shows the profiled safe-set boundary, colored by pointwise admissible-input radius, together with the shell-wise radius distribution and the least tolerant sampled state. The energy sweep compares the sampled minimum radius with the regular-shell estimate from the nominal shell into higher-energy regions. The second composite compares the affine slice and profiled envelope in 2D and 3D. The smooth, nearly monotone radius trend and close slice/profile agreement are consistent with an effectively single-well learned geometry over the explored region; they do not establish convexity of an underlying physical energy.

Figure 6: Duffing Hamiltonian reconstruction in physical coordinates. Analytic (left) and learned pH-EBM (right) energies are shown directly in $(q,p)$ , so no latent projection is involved. Both the contour and 3D views recover the characteristic double-well topology and the central saddle separating the two basins. The comparison supports qualitative recovery of the physical energy geometry; it does not imply unique or exact identification of the underlying Hamiltonian.

Panel of Figure 7 — Figure 7: $2$ -link pendulum: prediction, OOD forcing, and certificate geometry. The first composite reports the nominal pulse input and the two official OOD inputs, representative trajectory reconstructions, per-trajectory RMSE across pH-EBM and dissipative/naive DDM baselines, the empirical safety margin of the evaluated OOD trajectories, the admissible-input-radius sweep across energy shells, and the projected shell colored by pointwise radius. The radius decreases near several detected saddle-energy shells before increasing beyond the nominal operating energy. The second composite compares an affine Hamiltonian slice with the profiled envelope, showing the nonconvex structure that is hidden by any single trajectory projection.

Panel of Figure 8 — Figure 8: $3$ -link pendulum: prediction, OOD forcing, and certificate geometry. The first composite mirrors the $2$ -link protocol: nominal and official OOD inputs, representative reconstructions, per-trajectory RMSE, empirical safety margins, and an energy-shell sweep of the sampled and regular-shell admissible radii. Detected saddle-energy shells coincide with pronounced changes in the radius curve. The projected energy field is shown for geometric context, but the shell boundary is intentionally omitted because too few rays met the reconstruction threshold; it should therefore not be read as a complete projected boundary certificate. The second composite compares affine-slice and profiled-envelope views of the learned nonconvex Hamiltonian.

Panel of Figure 9 — Figure 9: NanoDrone: training-supported long-horizon Chirp and Square rollouts. For each excitation, the top panels report channel-averaged position, velocity, and angular-velocity errors; the 3D panel compares the nominal trajectory with pH-EBM and black-box rollouts inside the projected learned-energy envelope; the exit-timing panel tracks the most critical projected coordinate; and the final panel reports physical MAE over the extended horizon. The pH-EBM remains inside the displayed envelope for the shown $5\,\mathrm{s}$ rollouts, whereas the black-box trajectory exits at the indicated time. The envelope is a visualization of the high-dimensional certificate, not a substitute for its full-state evaluation.

Panel of Figure 10 — Figure 10: NanoDrone: held-out Melon extrapolation and learned Hamiltonian geometry. The first composite evaluates the unseen Melon family over a $5\,\mathrm{s}$ rollout, reporting channel-wise error, projected trajectory evolution relative to the learned-energy envelope, exit timing, and physical MAE. The black-box prediction is initially competitive but develops rapidly growing long-horizon error and leaves the displayed envelope, whereas the pH-EBM remains bounded in the shown rollout. The second composite compares an affine two-dimensional Hamiltonian slice with the profiled envelope obtained by optimizing over unshown coordinates, in both contour and 3D views, exposing the nonconvex geometry of the learned high-dimensional energy.

Figure 11: NanoDrone projected certificate. Left: projection of the traced full-state energy shell, with boundary samples colored by their pointwise admissible-input radius and the least tolerant sampled state marked explicitly. Right: the same pointwise radii ordered along the projected shell, together with the sampled shell minimum and regular-shell estimate. The projection is diagnostic only: certification is evaluated in the full model state space, and the displayed contour is not asserted to contain every high-dimensional boundary extremum.

Benchmark	$d_{z}$	Hamiltonian architecture	Activation	$J$	$R$	$G$	Parameters
Silverbox	4	$128\!\rightarrow\!64$	softmax( $2$ ) $\rightarrow$ poly( $4$ )	free skew	$LL^{\top}$	free $G\in\mathbb{R}^{4\times 1}$	$\approx 9.1$ k
CED	4	$96\!\rightarrow\!48$	softmax( $2$ ) $\rightarrow$ poly( $4$ )	free skew	$LL^{\top}$	free $G\in\mathbb{R}^{4\times 1}$	$\approx 5.25$ k
Duffing double-well	2	$64\!\rightarrow\!32$	$\tanh(2)\rightarrow$ poly( $4$ )	free skew	$LL^{\top}$	free $G\in\mathbb{R}^{2\times 1}$	$\approx 2.28$ k
$n$ -link pendulum	8	$64\!\rightarrow\!32$	$\tanh(2)\rightarrow$ poly( $4$ )	free skew	$LL^{\top}$	free $G\in\mathbb{R}^{8\times 1}$	$\approx 2.99$ k
NanoDrone †	12	$128\!\rightarrow\!64$	$\tanh\rightarrow$ poly( $4$ )	free pH field	learned PSD	unrestricted 4-port	43,738

Appendix

Table 3: Per-benchmark pH-EBM configurations. Architectures and active parameter counts reconstructed from the supplied champion configurations and frozen provenance artifacts. Entries marked “not in release” correspond to rows already present in the draft for which no experiment code or champion configuration was supplied.

Explore similar work

Jun 29, 2026eess.SY

ShardNet: Training Neural Controllers with Hard, Non-Convex Constraints

While neural network control policies are powerful, their deployment on safety critical systems depends on ensuring that they obey strict constraints. Existing work often treats safety as a metric to optimize for, which competes with other performance objectives, if training converges at all. Instead, we introduce ShardNet, a neural network architecture that strictly enforces unions of polyhedral constraints by construction, using a differentiable projection layer parameterized by a classification network. The key insight is to embed safety into the neural network's structure, allowing performance to be optimized independently because formal safety guarantees are always given. In contrast with existing neural architectures that can only enforce simple convex constraints, ShardNet enables the first safe-by-construction synthesis of forward-invariant neural network controllers on closed-loop systems where safety constraints are expressed as nonconvex unions of polyhedras or learned value function level sets. To support this, we also introduce a technique to verify and train such value functions correctly as rectified linear unit (ReLU) networks, which has not previously been possible. On double integrator benchmarks drawn from the literature, ShardNet policies maintain 100% safety on verified sets and achieves significantly lower objective loss compared to existing formal methods. Furthermore, our value function training technique also produces safe sets more than 3 times larger than existing verification approaches.

Long Kiu Chung, Shreyas Kousik

Department of Mechanical Engineering, Georgia Institute of Technology, Atlanta, GA.

Safety Constraints Learning-Based Control Neural Policies Value Functions Shard Nonconvex+2

Ask PDF

May 4, 2026eess.SY

Set-Based Training of Neural Barrier Certificates for Safety Verification of Dynamical Systems

Barrier certificates are scalar functions over the state space of dynamical systems that separate all unsafe states from all reachable states. The existence of a barrier certificate formally verifies the safety of the dynamical system. Recent approaches synthesize barrier certificates by iteratively training a neural network. In each iteration, the candidate is formally verified - if successful, the barrier certificate is found. Instead, we propose a set-based training approach that tightly integrates verification into training via a set-based loss function that soundly encodes all barrier certificate properties. A loss of zero formally proves the validity of the barrier certificate, collapsing the iterative training and verification into a single training procedure. Our experiments demonstrate that our set-based training approach scales well with the system dimension and naturally handles complex nonlinear dynamics.

Miriam Kranzlmüller, Lukas Koller, Tobias Ladner +1

Technical University of Munich, Germany · Ludwig-Maximilians-Universität in Munich, Germany

Neural Network Verification Finite-Sample Certificates Certificates Dynamical Systems State-Tracking Loss Function

Ask PDF

Sep 11, 2026cs.RO

VertexCBF: Improving Neural Control Barrier Functions via Vertex-Restricted Control Search

As the number of autonomous robots continues to grow, safety becomes increasingly important. Control barrier functions (CBFs) provide a theoretically grounded framework for ensuring safety, but existing design methods often face limitations in effectiveness, scalability, or interpretability, and may result in overly conservative safe sets. In this paper, we propose \emph{VertexCBF}, a framework for learning neural CBFs in a scalable, systematic, and explainable way. We approximate the stationary Hamilton--Jacobi value function using a neural network trained via a combination of physics-informed and sparsely supervised learning. By exploiting control-affine dynamics and a convex polytope control set, under which the Hamiltonian is maximized at the control vertices, we efficiently generate supervision points via GPU-parallel vertex-restricted tree search, while a residual architecture guarantees that the learned CBF is never larger than the specified constraint function. We evaluate the method on 15 systems and compare it against relevant baselines, showing that it reliably recovers large safe sets where the baselines are conservative or fail completely. In addition, we perform a hardware experiment in which a mobile robot safely avoids pedestrians using a neural CBF trained with our method.

Bojan Derajić, Sebastian Bernhard, Wolfgang Hönig

Technical University of Berlin, Germany · AUMOVIO, Germany · Technical University of Applied Sciences Augsburg, Germany +1

Control Barrier Functions Learning-Based Control Mobile Robots Tree Search

Ask PDF