Efficient Verification of Neural Control Barrier Functions with Smooth Nonlinear Activations

Abstract: Formal verification of neural control barrier functions (NCBFs) remains challenging, especially for neural networks with nonlinear activations like (\tanh). Existing CROWN-based methods rely on conservative linear relaxations for Jacobian bounds, limiting scalability. We propose LightCROWN, which computes tighter Jacobian bounds by exploiting the analytical properties of activation functions. Experiments on nonlinear control systems including the inverted pendulum, Dubins car, and planar quadrotor demonstrate that LightCROWN improves verification success rates up to 100\%, while enhancing speed and scalability. Our approach provides a generalizable improvement for CROWN-based frameworks, enabling more efficient verification of complex NCBFs. The code can be found at github.com/Autonomous-Systems-and-Control-Lab/verify-neural-CBF.

• The paper introduces LightCROWN, a framework that leverages analytic activation properties to yield tighter Jacobian bounds for neural control barrier function verification.
• The methodology employs a four-stage pipeline—including subregion search and interval arithmetic—to efficiently certify safety in high-dimensional nonlinear systems.
• Empirical results show up to a 1.48× improvement in verification rates and 61% faster performance, highlighting the framework’s scalability and robustness.

Efficient Verification of Neural Control Barrier Functions with Smooth Nonlinear Activations

Introduction and Motivation

The formal verification of neural control barrier functions (NCBFs) for safety-critical continuous-time systems presents significant computational challenges, particularly when networks use smooth nonlinear activations such as $\tanh$. Classical methods—SMT solvers, MIP, Lipschitz constraints—offer theoretical guarantees but suffer in scalability or restrict expressiveness. CROWN-based frameworks have emerged as the scalable approach, propagating interval bounds to facilitate tractable verification. However, their effectiveness diminishes when Jacobian bounds are computed via generic linear relaxations, resulting in overly conservative bounds and degraded performance.

LightCROWN addresses this by exploiting the analytic properties of smooth activation functions directly, yielding strictly tighter Jacobian bounds and facilitating efficient verification on complex nonlinear robotic systems, including the inverted pendulum, Dubins car, and planar quadrotor.

Problem Formulation and Preliminaries

Consider a nonlinear control system $\dot{x} = f(x, u)$, with state space $D \subset \mathbb{R}^n$ and input set $U \subset \mathbb{R}^k$. Safety is encoded as forward invariance of a set $C := \{ x \mid h(x) \leq 0 \}$, where $h(x)$, the NCBF, is modeled as a neural network. Forward invariance is guaranteed when the CBF condition

$\mathcal{L}_f h(x) + \alpha(h(x)) \leq 0$

holds, where $\mathcal{L}_f h(x)$ is the Lie derivative, and $\alpha$ is a class-$\mathcal{K}$ function.

Due to the high-dimensional, non-convex nature of the neural network zero-level set $\dot{x} = f(x, u)$0, the verification domain is reduced to a conservative union of axis-aligned hyper-rectangular subregions covering $\dot{x} = f(x, u)$1. Safety verification entails checking the CBF condition in each subregion, which reduces to interval arithmetic for the Lie derivative and Jacobian over the region.

LightCROWN Verification Pipeline

The verification pipeline consists of four major stages, as depicted in (Figure 1):

Figure 1: Overview of the verification pipeline, including subregion search, system bounding, Jacobian bounding, and verification condition checking.

1. Subregion Search: Using gridded state space, subregions containing boundary crossings (where $\dot{x} = f(x, u)$2 changes sign at vertices) are retained for verification.
2. System Dynamics Bounding: Affine Taylor bounds are computed entrywise using mid-point linearization and Hessian-based remainders for the nonlinear system dynamics over each subregion.
3. Jacobian Bounding: Backward interval propagation yields Jacobian bounds for the NCBF. LightCROWN computes exact interval bounds for activation derivatives by exploiting monotonicity and derivative extrema, rather than defaulting to generic linear relaxations.
4. Lie Derivative Bound/Condition Checking: The maximal value of $\dot{x} = f(x, u)$3 in the subregion is efficiently computed via decomposed interval products, pairing positive/negative components for maximality, and checking the CBF invariance condition.

The technical innovation of LightCROWN lies in direct analytic bounding of activation derivatives: for $\dot{x} = f(x, u)$4, the maximum is attained at zero, minimum at the endpoint, and for more general activations, critical points and endpoints are systematically evaluated.

Experimental Results

LightCROWN is evaluated on three benchmark systems: Inverted Pendulum (2D), Dubins Car (3D), Planar Quadrotor (6D), with NCBFs modeled as 2-layer $\dot{x} = f(x, u)$5-activated MLPs. Verification is conducted under both regular and adversarial training regimes, varying the safety margin parameter $\dot{x} = f(x, u)$6 and network size.

Verification Performance

Across all systems, LightCROWN demonstrates consistently higher verified rates and improved scalability, especially under adversarial training:

• Inverted Pendulum: All methods have comparable verified rates ($\dot{x} = f(x, u)$791%) under regular training, but LightCROWN achieves better computational efficiency.
• Dubins Car: LightCROWN attains the peak verified rate (86.0%) at $\dot{x} = f(x, u)$8, retaining robust performance as $\dot{x} = f(x, u)$9 increases.
• Planar Quadrotor: At $D \subset \mathbb{R}^n$0, LightCROWN achieves a 1.48$D \subset \mathbb{R}^n$1 higher verified rate than CROWN, and is 61% faster.

Under adversarial training, LightCROWN’s verified rates remain stable and less sensitive to $D \subset \mathbb{R}^n$2, while CROWN and BBV degrade, particularly on higher-dimensional models.

Boundary Discretization Sensitivity

Figure 2: Verified rate and verification time as a function of subregion count under regular training, for various $D \subset \mathbb{R}^n$3 values.

LightCROWN consistently achieves superior rates on coarse boundary discretization, and while higher $D \subset \mathbb{R}^n$4 induces some “reversal” (the rate dips below that of CROWN/BBV), this effect vanishes under adversarial training, where LightCROWN outperforms in both tightness and speed.

Figure 3: Verified rate and verification time under adversarial training, demonstrating consistent superiority of LightCROWN across discretization granularity.

Scalability with Network Size

LightCROWN maintains high verified rates as hidden layer width increases, with a significant advantage on large networks (128 units, $D \subset \mathbb{R}^n$5: 78% certified vs 53% for CROWN/BBV).

Figure 4: Verified rate and verification time as a function of network size for the Dubins Car model, across different $D \subset \mathbb{R}^n$6 values.

Practical and Theoretical Implications

The LightCROWN framework provides a practically scalable solution for the formal verification of NCBFs with smooth activations. The tighter Jacobian bounds enable efficient certification of forward invariance for complex neural architectures and high-dimensional nonlinear systems—directly applicable to safety-critical domains such as autonomous vehicles and UAVs. The method readily transfers to sensitivity analysis, robustness certification, and Lipschitz estimation in learning-enabled control.

Adversarial training further enhances verifiability by increasing margin robustness, making LightCROWN suitable for integration into safety-constrained learning pipelines.

Future Directions

Potential future work includes hybrid verification approaches combining LightCROWN’s efficient interval bounding with exact solvers (SMT/MIP) for intractable subregions, incorporation of higher-order approximation techniques, and extension to more general classes of nonlinear systems or hybrid control settings.

Conclusion

LightCROWN advances the state-of-the-art by formally certifying safety in complex neural control systems using direct analytic bounds on activation derivatives. Empirical evaluation validates its scalability, speed, and robustness across diverse nonlinear benchmarks. The framework constitutes a generalizable improvement to CROWN-based verification and strengthens the formal deployment of NCBFs in safety-critical AI and robotics applications.