cs.LGSep 29, 2026
SaveSafe-by-Design Learning via Energy-based Neural Networks
Organizations: RIAS Lab The Italian Institute of Artificial Intelligence for Industry Torino, 10129, ITA · RECUV University of Colorado Boulder Boulder, CO 80303, USA · Delft Center for Systems and Control, TU Delft, Delft, 2600 AA, The Netherlands
Abstract
Learning neural-network models of dynamical systems with safety guarantees is a fundamental requirement for their deployment in safety-critical settings. Safety is commonly established by proving the invariance of a desired subset in state-space, ensuring that every trajectory initialized in this subset remains confined to it for all time under admissible inputs. Existing frameworks, however, either rely on computationally expensive post-hoc verification or employ safety-enforcing mechanisms without formal correctness guarantees. In this paper, we introduce a novel neural architecture grounded in energy-based modern Hopfield networks to guarantee safety-by-design while retaining sufficient expressiveness to model complex nonlinear dynamics. Specifically, we integrate modern Hopfield networks with a port-Hamiltonian neural ODE, enabling by design the construction of barrier functions yielding explicit admissible-input sets and quantitative robustness radii. Across several benchmarks, including an 12-dimensional nanodrone model, our framework achieves state-of-the-art performance while producing certified invariant sets that are more robust to external solicitations than comparable existing approaches.
Figures & tables
Figure 1: Safe-by-design Energy-Based Model. a) Input-output trajectories from physical or simulated systems are used to train the pH-EBM: the external input drives the neural dynamics, while the measured output supervises reconstruction. b) The learned Hamiltonian, parameterized by a modern Hopfield energy, organizes the neural ODE into a continuous energy landscape whose low-energy regions encode stable operating regimes. Beyond interpolating between sparsely observed trajectories, this geometry identifies energy sublevel sets that can be certified as invariant for prescribed classes of inputs. c) Inputs lying within the certified admissible set therefore generate trajectories that remain confined to the desired operating region, turning the learned energy landscape into an explicit quantitative safety certificate.
| Benchmark | Published | portHNN-u | pH-EBM |
|---|---|---|---|
| Metrics | RMSE | RMSE | RMSE |
| Silverbox | [ ,-] | [ , ] | [ , ] |
| CED | [ , -] | [ , ] | [ , ] |
| Duffing double-well | [-, -] | [ , ] | [ , ] |
| -link pendulum | [ , -] | [ , ] | [ , ] |
| NanoDrone | [ , -] | [-, -] | [ , ] |
Table 1: Prediction accuracy and certified robustness across nonlinear dynamical systems. Comparative performance of the pH-EBM across benchmarks addressing nonlinear system identification, nonconvex dynamics, and higher-dimensional controlled systems.
Figure 2: Safe long-horizon reconstruction of NanoDrone flight dynamics with pH-EBM. a) Mean absolute error (MAE) of pH-EBM and the black-box baseline ( Busetto et al., 2026 ) over a Random rollout, ten times the training horizon. The pH-EBM maintains substantially lower error, while the BB error rapidly grows beyond the training window. b-c) Random-trajectory reconstruction relative to the projected certified region at . The pH-EBM remains inside the certified set and turns inward near , whereas the BB trajectory exits the region after approximately . d) Extrapolation to the unseen Melon excitation. Although BB is more accurate over the original horizon, its long-rollout error quickly increases, while pH-EBM remains bounded, highlighting the distinction between short-horizon accuracy and safe recursive deployment. e-f) Two- and three-dimensional projections of the learned Hamiltonian and shell , revealing a strongly nonconvex yet radially unbounded energy landscape that supports certified long-horizon evolution.
Figure 3: Geometry reconstruction, accuracy, and certified robustness in the 2D Duffing oscillator. a) Ground-truth Duffing Hamiltonian (left) and energies reconstructed by portHNN-u (center) and pH-EBM (right). Both recover the characteristic nonconvex double-well geometry. The pH-EBM panel additionally reports the pointwise input tolerance, whose minimum occurs near the saddle separating the two wells. b) Theoretical (purple) and empirical (blue) state-independent radii across an energy-level sweep. The certificate decreases as the shell approaches the saddle energy, then increases again after the certified component expands beyond it, revealing reduced input tolerance near transitions between operating regimes. c) Reconstruction error and empirical robustness radius for portHNN-u and pH-EBM. While both models achieve accurate trajectory reconstruction, the pH-EBM yields certified radii approximately - orders of magnitude larger than portHNN-u.
Appendix figures & tables10 assets
Supplementary material from the paper’s appendix.
Appendix
| Benchmark | Metric | Published | portHNN-u | pH-EBM |
|---|---|---|---|---|
| Silverbox | RMSE | |||
| CED | RMSE | |||
| Duffing double-well | RMSE | - | ||
| -link pendulum | RMSE | |||
| NanoDrone | RMSE | - | ||
| NanoDrone (Melon) | RMSE |
Table 2: Prediction accuracy and certified robustness across nonlinear dynamical systems. Comparative performance of the pH-EBM across benchmarks addressing nonlinear system identification, nonconvex dynamics, and higher-dimensional controlled systems. Results reported within square brackets, , correspond to evaluations on distinct test sets of the same benchmark, while entries separated by semicolons refer to variants of the reference architecture.
Figure 4: Silverbox: learned energy geometry and certificate diagnostics. The upper composite shows the profiled two-dimensional energy view at the nominal shell: traced boundary states are colored by their pointwise admissible-input radius, the red cross marks the least tolerant sampled state, and the adjacent panel resolves the same radii along the shell. The lower sweep compares the sampled shell minimum with the regular-shell estimate as the relative energy budget increases; green diamonds mark detected saddle-energy shells. The second composite contrasts an affine Hamiltonian slice with the profiled envelope in both 2D and 3D. Their close agreement indicates that the selected plane captures the dominant single-well geometry over the explored region. These plots visualize the learned Hamiltonian and should not be interpreted as recovery of a unique physical Silverbox potential.
Figure 5: CED: learned energy geometry and certificate diagnostics. The upper composite shows the profiled safe-set boundary, colored by pointwise admissible-input radius, together with the shell-wise radius distribution and the least tolerant sampled state. The energy sweep compares the sampled minimum radius with the regular-shell estimate from the nominal shell into higher-energy regions. The second composite compares the affine slice and profiled envelope in 2D and 3D. The smooth, nearly monotone radius trend and close slice/profile agreement are consistent with an effectively single-well learned geometry over the explored region; they do not establish convexity of an underlying physical energy.
Figure 6: Duffing Hamiltonian reconstruction in physical coordinates. Analytic (left) and learned pH-EBM (right) energies are shown directly in , so no latent projection is involved. Both the contour and 3D views recover the characteristic double-well topology and the central saddle separating the two basins. The comparison supports qualitative recovery of the physical energy geometry; it does not imply unique or exact identification of the underlying Hamiltonian.
Figure 7: -link pendulum: prediction, OOD forcing, and certificate geometry. The first composite reports the nominal pulse input and the two official OOD inputs, representative trajectory reconstructions, per-trajectory RMSE across pH-EBM and dissipative/naive DDM baselines, the empirical safety margin of the evaluated OOD trajectories, the admissible-input-radius sweep across energy shells, and the projected shell colored by pointwise radius. The radius decreases near several detected saddle-energy shells before increasing beyond the nominal operating energy. The second composite compares an affine Hamiltonian slice with the profiled envelope, showing the nonconvex structure that is hidden by any single trajectory projection.
Figure 8: -link pendulum: prediction, OOD forcing, and certificate geometry. The first composite mirrors the -link protocol: nominal and official OOD inputs, representative reconstructions, per-trajectory RMSE, empirical safety margins, and an energy-shell sweep of the sampled and regular-shell admissible radii. Detected saddle-energy shells coincide with pronounced changes in the radius curve. The projected energy field is shown for geometric context, but the shell boundary is intentionally omitted because too few rays met the reconstruction threshold; it should therefore not be read as a complete projected boundary certificate. The second composite compares affine-slice and profiled-envelope views of the learned nonconvex Hamiltonian.
Figure 9: NanoDrone: training-supported long-horizon Chirp and Square rollouts. For each excitation, the top panels report channel-averaged position, velocity, and angular-velocity errors; the 3D panel compares the nominal trajectory with pH-EBM and black-box rollouts inside the projected learned-energy envelope; the exit-timing panel tracks the most critical projected coordinate; and the final panel reports physical MAE over the extended horizon. The pH-EBM remains inside the displayed envelope for the shown rollouts, whereas the black-box trajectory exits at the indicated time. The envelope is a visualization of the high-dimensional certificate, not a substitute for its full-state evaluation.
Figure 10: NanoDrone: held-out Melon extrapolation and learned Hamiltonian geometry. The first composite evaluates the unseen Melon family over a rollout, reporting channel-wise error, projected trajectory evolution relative to the learned-energy envelope, exit timing, and physical MAE. The black-box prediction is initially competitive but develops rapidly growing long-horizon error and leaves the displayed envelope, whereas the pH-EBM remains bounded in the shown rollout. The second composite compares an affine two-dimensional Hamiltonian slice with the profiled envelope obtained by optimizing over unshown coordinates, in both contour and 3D views, exposing the nonconvex geometry of the learned high-dimensional energy.
Figure 11: NanoDrone projected certificate. Left: projection of the traced full-state energy shell, with boundary samples colored by their pointwise admissible-input radius and the least tolerant sampled state marked explicitly. Right: the same pointwise radii ordered along the projected shell, together with the sampled shell minimum and regular-shell estimate. The projection is diagnostic only: certification is evaluated in the full model state space, and the displayed contour is not asserted to contain every high-dimensional boundary extremum.
| Benchmark | Hamiltonian architecture | Activation | Parameters | ||||
|---|---|---|---|---|---|---|---|
| Silverbox | 4 | softmax( ) poly( ) | free skew | free | k | ||
| CED | 4 | softmax( ) poly( ) | free skew | free | k | ||
| Duffing double-well | 2 | poly( ) | free skew | free | k | ||
| -link pendulum | 8 | poly( ) | free skew | free | k | ||
| NanoDrone † | 12 | poly( ) | free pH field | learned PSD | unrestricted 4-port | 43,738 |
Table 3: Per-benchmark pH-EBM configurations. Architectures and active parameter counts reconstructed from the supplied champion configurations and frozen provenance artifacts. Entries marked “not in release” correspond to rows already present in the draft for which no experiment code or champion configuration was supplied.