CPED-NCBFs: Expert Demo Neural CBFs

• CPED-NCBFs is a framework that learns neural control barrier functions from expert demonstrations to certify safety in control-affine nonlinear systems.
• It employs split conformal prediction to calibrate region-specific robustness margins, balancing safety and conservatism based on local Lipschitz properties.
• Experimental results show improved safety and generalization in low-data settings compared to fixed-margin baselines.

CPED-NCBFs denotes a framework for Conformal Prediction for Expert Demonstration-based Neural Control Barrier Functions, in which a neural control barrier function is learned from expert demonstrations and then verified with split conformal prediction to obtain probabilistic safety guarantees over sampled safe, unsafe, and derivative-constrained regions (MS et al., 20 Jul 2025). The method is designed for control-affine nonlinear systems in which a barrier function $h$ defines the safe set $$\mathcal{C} := \{x \in \mathbb{R}^n \mid h(x)\ge 0\}$$, and its central technical claim is that calibration quantiles computed on held-out data can be converted into data-driven robustness margins for training and verification. Within the neural CBF literature, CPED-NCBFs occupy a specific niche: they are demonstration-driven, region-calibrated, and probabilistic rather than worst-case symbolic.

1. Formal setting and barrier-based safety objective

CPED-NCBFs are formulated for a control-affine nonlinear dynamical system

$\dot{x} = f(x) + g(x)u,$

with state $x \in \mathcal{X} \subseteq \mathbb{R}^n$ and control input $u \in \mathcal{U} \subseteq \mathbb{R}^m$, where $f$ and $g$ are locally Lipschitz (MS et al., 20 Jul 2025). The safe set is represented by a function $h$, with the goal that

$$\mathcal{C} := \{x \in \mathbb{R}^n \mid h(x)\ge 0\}$$

is forward invariant under a suitable controller.

The framework uses the standard continuous-time CBF condition: there exists an extended class-$\mathcal{K}$ function $$\mathcal{C} := \{x \in \mathbb{R}^n \mid h(x)\ge 0\}$$0 such that

$$\mathcal{C} := \{x \in \mathbb{R}^n \mid h(x)\ge 0\}$$1

To implement safety online, the method adopts the usual CBF-QP safety filter

$$\mathcal{C} := \{x \in \mathbb{R}^n \mid h(x)\ge 0\}$$2

subject to

$$\mathcal{C} := \{x \in \mathbb{R}^n \mid h(x)\ge 0\}$$3

This places CPED-NCBFs squarely within the standard barrier-certificate pipeline: a neural network parameterizes the barrier, and a minimally invasive quadratic program enforces the barrier inequality at runtime.

What distinguishes the framework is not the control law itself, but the source of supervision and the verification strategy. The neural CBF $$\mathcal{C} := \{x \in \mathbb{R}^n \mid h(x)\ge 0\}$$4 is learned from expert demonstrations $$\mathcal{C} := \{x \in \mathbb{R}^n \mid h(x)\ge 0\}$$5, rather than from exhaustive state-space coverage, and the resulting verification problem is addressed with split conformal prediction rather than SMT, MIP, or interval-based worst-case reasoning (MS et al., 20 Jul 2025).

2. Demonstration-derived domains and local propagation conditions

The learning problem is organized around three region-specific datasets: $$\mathcal{C} := \{x \in \mathbb{R}^n \mid h(x)\ge 0\}$$6 for safe states, $$\mathcal{C} := \{x \in \mathbb{R}^n \mid h(x)\ge 0\}$$7 for unsafe states, and $$\mathcal{C} := \{x \in \mathbb{R}^n \mid h(x)\ge 0\}$$8 for derivative-constrained states near the safety boundary (MS et al., 20 Jul 2025). Because demonstrations cover only part of the state space, the method defines a local demonstration domain by

$$\mathcal{C} := \{x \in \mathbb{R}^n \mid h(x)\ge 0\}$$9

where $\dot{x} = f(x) + g(x)u,$0 is the closed $\dot{x} = f(x) + g(x)u,$1-norm ball of radius $\dot{x} = f(x) + g(x)u,$2. An unsafe layer $\dot{x} = f(x) + g(x)u,$3 is similarly defined around the unsafe region by a width $\dot{x} = f(x) + g(x)u,$4, and the stated objective is to ensure $\dot{x} = f(x) + g(x)u,$5 on $\dot{x} = f(x) + g(x)u,$6, so that the zero level set lies inside the unsafe boundary layer.

A key structural element is a set of local Lipschitz propagation lemmas that connect sampled constraints to neighborhood-wise guarantees. For safe states, if $\dot{x} = f(x) + g(x)u,$7 is Lipschitz with local constant $\dot{x} = f(x) + g(x)u,$8, if $\dot{x} = f(x) + g(x)u,$9 is an $x \in \mathcal{X} \subseteq \mathbb{R}^n$0-net of $x \in \mathcal{X} \subseteq \mathbb{R}^n$1 with

$x \in \mathcal{X} \subseteq \mathbb{R}^n$2

and if

$x \in \mathcal{X} \subseteq \mathbb{R}^n$3

then

$x \in \mathcal{X} \subseteq \mathbb{R}^n$4

The unsafe analogue states that if $x \in \mathcal{X} \subseteq \mathbb{R}^n$5 is an $x \in \mathcal{X} \subseteq \mathbb{R}^n$6-net of $x \in \mathcal{X} \subseteq \mathbb{R}^n$7 with

$x \in \mathcal{X} \subseteq \mathbb{R}^n$8

and

$x \in \mathcal{X} \subseteq \mathbb{R}^n$9

then

$u \in \mathcal{U} \subseteq \mathbb{R}^m$0

For the derivative condition, the paper introduces a function $u \in \mathcal{U} \subseteq \mathbb{R}^m$1 and states that if $u \in \mathcal{U} \subseteq \mathbb{R}^m$2 is Lipschitz with constant $u \in \mathcal{U} \subseteq \mathbb{R}^m$3, if $u \in \mathcal{U} \subseteq \mathbb{R}^m$4 is an $u \in \mathcal{U} \subseteq \mathbb{R}^m$5-net of $u \in \mathcal{U} \subseteq \mathbb{R}^m$6 with

$u \in \mathcal{U} \subseteq \mathbb{R}^m$7

and if

$u \in \mathcal{U} \subseteq \mathbb{R}^m$8

for all $u \in \mathcal{U} \subseteq \mathbb{R}^m$9, then

$f$0

These lemmas supply the local geometric rationale for using region-wise robustness margins $f$1: sampled separation, together with sufficient sample density and Lipschitz regularity, propagates to the surrounding domain.

3. Scenario optimization and split-conformal quantile calibration

The central verification problem is the choice of robustness margins. If the margins are too small, safety may fail; if they are too large, the learned safe set becomes unnecessarily conservative (MS et al., 20 Jul 2025). CPED-NCBFs formalize this through a scenario optimization problem: $f$2 with

$f$3

$f$4

$f$5

The paper’s main statistical result, stated as Theorem 1: Safety Quantification of Neural CBF, uses split conformal prediction on i.i.d. calibration samples from each constraint set (MS et al., 20 Jul 2025). For each set $f$6, $f$7, the conformal scores are

$f$8

and the quantile is

$f$9

where $g$0 is the number of constraint sets. Choosing $g$1 and $g$2 such that

$g$3

the theorem states that, with probability at least $g$4,

$g$5

The quantiles $g$6 are then turned into training margins by setting

$g$7

The interpretation given in the paper is direct. If $g$8, the corresponding constraint is satisfied on most of the region with high confidence. If $g$9, the magnitude measures the observed severity of violation, and retraining with that margin enforces stricter separation.

4. Loss construction and iterative training procedure

CPED-NCBFs parameterize the barrier as a feedforward neural network $h$0 and optimize a weighted composite loss

$h$1

where

$h$2

$h$3

$h$4

The three terms penalize failures of safe-state positivity, unsafe-state negativity, and derivative feasibility, respectively (MS et al., 20 Jul 2025).

Training is explicitly organized as a two-stage procedure. First, all margins are initialized to zero and $h$5 is trained until the loss is small. Second, a separate validation set, excluded from training, is used to compute conformal scores and quantiles $h$6. If any quantile is positive, the corresponding margin is updated and the network is retrained. The paper describes the loop as follows: sample data from $h$7; initialize all $h$8; train the NCBF until the current loss becomes nonpositive or sufficiently small; for each constraint set, draw $h$9 i.i.d. validation samples, compute the scores, sort them decreasingly, choose $$\mathcal{C} := \{x \in \mathbb{R}^n \mid h(x)\ge 0\}$$0, set $$\mathcal{C} := \{x \in \mathbb{R}^n \mid h(x)\ge 0\}$$1 to the corresponding score, update $$\mathcal{C} := \{x \in \mathbb{R}^n \mid h(x)\ge 0\}$$2, and retrain. The procedure returns the final learned $$\mathcal{C} := \{x \in \mathbb{R}^n \mid h(x)\ge 0\}$$3 (MS et al., 20 Jul 2025).

The separation between training and calibration is essential to the method’s statistical interpretation. The calibration quantiles are intended to reflect generalization beyond the optimization samples rather than memorization of the training set. This is the point at which CPED-NCBFs diverge most sharply from purely optimization-based barrier learning.

5. Guarantee structure, assumptions, and known limitations

The guarantee delivered by CPED-NCBFs is probabilistic rather than deterministic (MS et al., 20 Jul 2025). The theorem provides a simultaneous high-confidence statement over the three constraint regions, parameterized by a violation level $$\mathcal{C} := \{x \in \mathbb{R}^n \mid h(x)\ge 0\}$$4 and confidence level $$\mathcal{C} := \{x \in \mathbb{R}^n \mid h(x)\ge 0\}$$5, under the assumption that the calibration samples are i.i.d. samples drawn from each constraint set. The method therefore certifies that each calibrated constraint is satisfied on at least a $$\mathcal{C} := \{x \in \mathbb{R}^n \mid h(x)\ge 0\}$$6 fraction of its region with probability at least $$\mathcal{C} := \{x \in \mathbb{R}^n \mid h(x)\ge 0\}$$7, rather than proving a pointwise worst-case statement over the entire state space.

The framework is also explicitly local in its data geometry. The demonstration layer $$\mathcal{C} := \{x \in \mathbb{R}^n \mid h(x)\ge 0\}$$8 and unsafe layer $$\mathcal{C} := \{x \in \mathbb{R}^n \mid h(x)\ge 0\}$$9 are central objects, and the propagation lemmas depend on $\mathcal{K}$0-nets or $\mathcal{K}$1-nets, local Lipschitz constants, and region-specific margins. This means that expert-demonstration coverage is not incidental: it is part of the verification mechanism itself.

The paper identifies several practical limitations. The guarantee depends on the representativeness of the held-out calibration data. Performance can become conservative when the estimated margins $\mathcal{K}$2 are large or when data are scarce. In the authors’ summary, the method is attractive when the barrier is neural and hard to verify symbolically, when expert data are available, and when a probabilistic safety certificate is acceptable, but it does not constitute a deterministic global proof (MS et al., 20 Jul 2025).

A closely related conformal formulation, CP-NCBF, learns a neural barrier and then verifies or corrects it with split conformal prediction to obtain a probabilistically certified safe set, but it is not expert-demonstration-based (Tayal et al., 18 Mar 2025). In that framework, the conformal score is the worst barrier-condition violation

$\mathcal{K}$3

the quantile threshold is $\mathcal{K}$4, and the corrective margin is set as $\mathcal{K}$5 (Tayal et al., 18 Mar 2025). This suggests that CPED-NCBFs should be understood as a demonstration-specialized extension of the same statistical verification idea rather than as a fundamentally different safety formalism.

6. Experimental evidence and position within the NCBF verification literature

The reported experiments cover a 2D point-mass collision-avoidance system and a unicycle model learned from expert demonstrations (MS et al., 20 Jul 2025). In the point-mass case,

$\mathcal{K}$6

with $\mathcal{K}$7, state $\mathcal{K}$8, control $\mathcal{K}$9, safe set

$$\mathcal{C} := \{x \in \mathbb{R}^n \mid h(x)\ge 0\}$$00

and candidate CBF

$$\mathcal{C} := \{x \in \mathbb{R}^n \mid h(x)\ge 0\}$$01

The dataset is generated with boundary-focused radial sampling, including safe samples, unsafe samples, derivative samples, and a buffer band of width $$\mathcal{C} := \{x \in \mathbb{R}^n \mid h(x)\ge 0\}$$02 around the safe/unsafe transition. Evaluation is reported as the maximum trajectory radius $$\mathcal{C} := \{x \in \mathbb{R}^n \mid h(x)\ge 0\}$$03 for which the learned barrier remains safe.

In the unicycle case,

$$\mathcal{C} := \{x \in \mathbb{R}^n \mid h(x)\ge 0\}$$04

with $$\mathcal{C} := \{x \in \mathbb{R}^n \mid h(x)\ge 0\}$$05 and $$\mathcal{C} := \{x \in \mathbb{R}^n \mid h(x)\ge 0\}$$06. Expert demonstrations are generated using an MPC controller combined with a pre-trained barrier function

$$\mathcal{C} := \{x \in \mathbb{R}^n \mid h(x)\ge 0\}$$07

The task is to reach either $$\mathcal{C} := \{x \in \mathbb{R}^n \mid h(x)\ge 0\}$$08 or $$\mathcal{C} := \{x \in \mathbb{R}^n \mid h(x)\ge 0\}$$09 while staying safe, and the reported metric is safety rate over 100 trajectories (MS et al., 20 Jul 2025).

System	Setup	Reported outcome
Point mass	Generalization versus rollout radius $$\mathcal{C} := \{x \in \mathbb{R}^n \mid h(x)\ge 0\}$$10	With 390 samples, FM-NCBF is unsafe at all $$\mathcal{C} := \{x \in \mathbb{R}^n \mid h(x)\ge 0\}$$11 while CPED-NCBF is safe up to $$\mathcal{C} := \{x \in \mathbb{R}^n \mid h(x)\ge 0\}$$12; with 650 samples, FM-NCBF is safe up to $$\mathcal{C} := \{x \in \mathbb{R}^n \mid h(x)\ge 0\}$$13 and CPED-NCBF up to $$\mathcal{C} := \{x \in \mathbb{R}^n \mid h(x)\ge 0\}$$14; with 910 and 1430 samples, CPED-NCBF is safe up to $$\mathcal{C} := \{x \in \mathbb{R}^n \mid h(x)\ge 0\}$$15
Unicycle	Safety over 100 simulated trajectories	At 1,000 samples, FM-NCBF is 90.5% and CPED-NCBF 98.8%; at 5,000 samples, 98.1% versus 99.1%; at 10,000 samples, 99.7% versus 99.4%

The main empirical pattern is that CPED-NCBFs outperform the fixed-margin baseline in low-data settings and improve generalization from expert demonstrations to previously unseen states (MS et al., 20 Jul 2025). The paper also notes that when sample availability is low, the estimated $$\mathcal{C} := \{x \in \mathbb{R}^n \mid h(x)\ge 0\}$$16 can become large, making the barrier more conservative; conversely, with large datasets, the FM-NCBF baseline can slightly outperform CPED-NCBF on the unicycle benchmark.

Within the broader literature, CPED-NCBFs are positioned against symbolic and bound-based verification methods. The paper explicitly contrasts them with SMT, mixed-integer programming (MIP), and interval or bound-propagation methods, arguing that those approaches can become overly conservative or computationally expensive in high dimensions (MS et al., 20 Jul 2025). Other strands of the literature pursue different tradeoffs: exact verification for ReLU NCBFs via generalized Nagumo conditions and piecewise-linear decomposition (Zhang et al., 2023); synthesis with efficient exact verification for ReLU barriers using boundary regularization and exact region checking (Zhang et al., 2024); continuous-time stochastic neural CBFs with Lipschitz certificates for the network, Jacobian, and Hessian-trace terms (Tayal et al., 2024); scalable post-training verification using linear bound propagation and McCormick relaxations (Vertovec et al., 9 Nov 2025); and LightCROWN for tighter Jacobian bounds with smooth nonlinear activations such as $$\mathcal{C} := \{x \in \mathbb{R}^n \mid h(x)\ge 0\}$$17 (Zhang et al., 8 May 2026). This suggests a division of labor in the field: exact and relaxation-based verifiers target worst-case certification, whereas CPED-NCBFs target calibration-based probabilistic assurance in the expert-demonstration regime.