Neural Control Barrier Functions

Updated 22 May 2026

Neural Control Barrier Functions are neural network-parameterized functions that enforce safe state sets in nonlinear, high-dimensional control systems.
They extend classical CBFs by leveraging sample-based training and end-to-end differentiability for scalable, adaptive safety verification.
Robust verification methods such as reachability analysis and bound propagation provide formal safety guarantees and fault tolerance.

Neural Control Barrier Functions (CBFs) are a class of data-driven safety certificates for nonlinear, often high-dimensional, dynamical control systems. By parameterizing classical control barrier functions with neural networks, these methods generalize the ability to enforce and certify forward-invariance of state constraints (safe sets) to systems with complex, uncertain, or partially observable dynamics. Neural CBFs extend, adapt, and verify barrier properties through sample-based training, end-to-end differentiability, reachability analysis, adaptive architectures, and scalable automated certification.

1. Classical and High-Order Control Barrier Functions

Control barrier functions (CBFs) formalize forward invariance of a “safe set” $\mathcal{C} = \{x \in \mathbb{R}^n \mid h(x) \geq 0\}$ under closed-loop system dynamics. For a control-affine system $\dot{x} = f(x) + g(x)u$ , a classical (relative-degree-1) CBF, $h(x)$ , satisfies the condition

$L_{f}h(x) + L_{g}h(x)u + \alpha(h(x)) \ge 0,$

where $L_{f}h = \nabla h \cdot f$ , $L_{g}h = \nabla h \cdot g$ , and $\alpha$ is an extended class-K function. This ensures that, given any control $u(x)$ satisfying this condition, $\mathcal{C}$ becomes forward-invariant—no trajectory can exit the safe set as long as the condition is upheld at its boundary.

For safe set boundaries of higher relative degree $m>1$ , high-order CBFs (HOCBFs) introduce a recursive sequence: $\dot{x} = f(x) + g(x)u$ 0 leading to a final constraint,

$\dot{x} = f(x) + g(x)u$ 1

which remains linear in $\dot{x} = f(x) + g(x)u$ 2 and can be integrated into quadratic programs (QPs) for real-time safe controller synthesis (Xiao et al., 2023).

2. Neural Parameterizations and Architecture Extensions

Neural CBFs replace $\dot{x} = f(x) + g(x)u$ 3 with a neural network $\dot{x} = f(x) + g(x)u$ 4, leveraging universal approximation to represent non-polynomial, nonconvex, or high-dimensional safe sets. Neural CBF frameworks allow:

Flexible parameterizations (MLPs, CNNs, hypernetworks, residual architectures).
Extensions to systems not affine in control, using differentiable HOCBFs parameterized as functions of $\dot{x} = f(x) + g(x)u$ 5, such that the resulting constraint $\dot{x} = f(x) + g(x)u$ 6 is affine in $\dot{x} = f(x) + g(x)u$ 7, suitable for neural ODE-based controllers (Xiao et al., 2023).
Adaptive penalty and slack parameters, often trained end-to-end via differentiable QP layers such as BarrierNet (Xiao et al., 2021).
Physics-informed neural networks (PINNs) with Zubov or Hamilton-Jacobi PDE constraints for scalable, sample-efficient learning of barriers aligning with maximal or user-defined safe sets (Agrawal et al., 15 Apr 2025, Kim et al., 16 May 2025).
Composite constructions for multi-agent or dynamic environments, aggregating individual barrier outputs (e.g., via soft-min) for multiple moving obstacles (Derajić et al., 6 Mar 2026, Derajić et al., 20 Sep 2025).
Output-feedback CBFs operating over augmented $\dot{x} = f(x) + g(x)u$ 8 spaces, synchronized with jointly trained observers for partially observed systems (Jagabathula et al., 30 Sep 2025).

3. Synthesis and Training Approaches

The synthesis of neural CBFs spans several paradigms:

Imitation Learning: The neural policy is trained to imitate the solution of a CBF-QP enforcing affine (or high-order) barrier constraints computed from expert controllers, sometimes relying on dataset aggregation (DAgger) to avoid distribution drift (Yaghoubi et al., 2020, Xiao et al., 2023).
Barrier Loss Formulation: Losses enforce positive values within the safe set, negative outside, and penalize violations of the CBF derivative condition (barrier inequality), optionally including action constraints, boundary margin terms, and volume regularizers (Liu et al., 2022, Yang et al., 24 Oct 2025, Hu et al., 2024).
Physics-Informed and Reachability-Driven Methods: PINNs are trained to minimize residuals of the HJ or Zubov PDEs, thereby aligning the learned barrier function with the reachability-derived maximal safe set (Agrawal et al., 15 Apr 2025, Kim et al., 16 May 2025, Derajić et al., 6 Mar 2026). Softplus output activations, signed-distance-based residuals, and explicit reachability supervision enforce noninterference with the failure set (provable conservativeness).
Inverse Constraint Learning: When unsafe sets are implicit, constraint functions are inferred via separation of expert (safe) and candidate (unsafe) data; these label the training set for the neural CBF (Yang et al., 24 Oct 2025).
Adaptive, Robust, and Fault-Tolerant CBFs: Model uncertainties, sensor faults, or actuator input limits are incorporated via residual DNNs for drift terms with real-time adaptation (Sweatland et al., 2024), robustified derivative bounds (Sweatland et al., 2024), ensemble EKF state estimation over possible sensor fault patterns (Zhang et al., 2024), or regularization and counterexample-driven training for input-constrained systems (Liu et al., 2022).
Stochastic CBFs: For Itô SDEs, barrier conditions involve the generator $\dot{x} = f(x) + g(x)u$ 9, with direct optimization over the sample points or verification-in-the-loop using LP/MILP (for ReLU nets) (Zhang et al., 26 Jun 2025).

4. Formal Verification Techniques

Guaranteeing safety for a neural CBF requires certifying that the derivative condition holds everywhere on the intended safe set boundary:

Bound Propagation: Linear (LBP) (Vertovec et al., 9 Nov 2025) and symbolic bound propagation (Hu et al., 2024) compute tight affine/constant bounds on $h(x)$ 0 and $h(x)$ 1 over state-space partitions (boxes or simplices) using McCormick relaxations and CROWN-like layer-wise bound propagation. These bounds enable checking linearized (conservative) CBF constraints over each region, with refinement by adaptive mesh/split to resolve conservatism.
Piecewise-Linear/Region-Based Decomposition: For ReLU networks, exact verification relies on partitioning the state space into linear regions (combinatorial activation sets), characterizing the Clarke tangent cone at nondifferentiable points, and solving a nonlinear program (or LP/MILP for each region/intersection). Interval Bound Propagation (IBP) and LiRPA prune intractable numbers of potential regions to only those intersecting the barrier boundary (Zhang et al., 2023).
Branch-and-Bound Verification-in-the-Loop: Training and verification alternate, with regions failing the barrier constraint flagged as counterexamples to augment the training set. This hybrid approach iteratively tightens and certifies the barrier function (Wang et al., 2023).
Conformal Prediction: Split-conformal methods establish probabilistic guarantees (marginal or high-confidence) that the learned barrier passes the derivative conditions with at most $h(x)$ 2 violation, calibration is performed with i.i.d. state samples, and the resulting margin is enforced through retraining (Tayal et al., 18 Mar 2025).
Sample Efficiency and Scalability: LBP-based methods have verified networks with up to ∼500k parameters, outperforming SMT/MIP/SAT solvers, which scale exponentially in network size or depth (Vertovec et al., 9 Nov 2025, Hu et al., 2024, Zhang et al., 2023). Conformal approaches avoid the curse of dimensionality facing global Lipschitz-based verifiers (Tayal et al., 18 Mar 2025).

Verification Method	Core Principle	Notable Features
LBP + McCormick (Vertovec et al., 9 Nov 2025)	Affine relaxations	GPU-parallelizable, scalable to large nets
Symbolic derivative bounds (Hu et al., 2024)	Piecewise-const. Jacobian	Tight bounds, CROWN integration, fewer splits
Exact ReLU region (Zhang et al., 2023)	Piecewise-linear decomp	Nagumo via Clarke tangent cone, NLPs per region
Verification-in-the-loop (Wang et al., 2023)	Iterative refinement	Branch-and-bound plus dynamic data augmentation
Conformal prediction (Tayal et al., 18 Mar 2025)	Calibration on samples	Probabilistic violations, sample-efficient, scalable

5. Applications and Empirical Performance

Neural CBFs have demonstrated success in a wide range of safety-critical control applications:

Autonomous driving: LiDAR-based overtaking, adaptive cruise control, urban navigation in randomized occupancy environments (Xiao et al., 2023, Sweatland et al., 2024, Harms et al., 2024).
Robot navigation: Ground and aerial robots, dynamic multi-agent collision avoidance with up to 20 moving obstacles, quadcopter-pendulum tasks with 10D state (Derajić et al., 6 Mar 2026, Liu et al., 2022).
Partially observed systems: Joint observer-barrier-controller neural co-design for DC motors, pendulums, and tank levels under limited sensing (Jagabathula et al., 30 Sep 2025).
Fault-tolerant and robust control: GNSS/GPS sensor attack mitigation via EKF banks and FT-NCBFs, model uncertainty adaptation, and real-time feedback-loss resilience (Zhang et al., 2024, Sweatland et al., 2024).
Stochastic systems: Neural SNCBFs in Itô SDE settings, e.g. inverted pendulum under process noise, validated both in smooth and ReLU architectures (Zhang et al., 26 Jun 2025).
Large-scale and flexible safe sets: Physics-informed PINNs and reachability-generated barriers allow synthesis in up to 9D state spaces, outperforming standard neural CBFs in empirical safety and conservativeness metrics (Agrawal et al., 15 Apr 2025, Kim et al., 16 May 2025).

Performance comparisons demonstrate:

Zero or near-zero violation rates for CBF-augmented neural policies, sharply reduced compared to plain neural controllers or classic CBFs without explicit uncertainty adaptation (Xiao et al., 2023, Sweatland et al., 2024, Derajić et al., 6 Mar 2026).
Substantially less conservatism and larger certified safe sets than grid/Lipschitz or classic analytic CBFs (Tayal et al., 18 Mar 2025, Wang et al., 2023).
Real-time feasibility (e.g., QP layers solving in milliseconds or at 250 Hz control rates) on high-dimensional, perception-rich control loops (Derajić et al., 6 Mar 2026, Harms et al., 2024).
Robustness to sensor attacks, feedback loss, and process noise, where baseline methods fail (Zhang et al., 2024, Sweatland et al., 2024, Zhang et al., 26 Jun 2025).

6. Limitations and Future Directions

Major open challenges for neural CBFs include:

Scalability to high-dimensional and high-relative-degree tasks: Although PINN and LBP-based approaches push the current boundary, the curse of dimensionality remains, especially for exhaustive safety verification.
Verification for stochastic, hybrid, or non-affine dynamics: Extensions to systems with jumps, multiplicative noise, or blackbox neural dynamics necessitate further development of certifiable relaxations and reachability-based surrogates (Zhang et al., 26 Jun 2025, Vertovec et al., 9 Nov 2025).
Joint synthesis and verification: Verification-in-the-loop and conformal approaches are promising but remain computationally demanding for very deep networks or dense safe set boundaries (Wang et al., 2023, Tayal et al., 18 Mar 2025).
Integration with performance objectives and adaptive policies: Current formulations are often decoupled from reward shaping, reinforcement learning, or direct risk-constrained optimization, an active area of research.
Formal certification under real-world uncertainty and non-determinism: Current robustness and fault-tolerant models address only subclasses of uncertainty. Bridging formally certified safe learning with online adaptation and complex, uncertain environments is a significant ongoing challenge.

7. Theoretical Guarantees and Design Principles

Neural CBF frameworks inherit forward invariance guarantees of classical CBFs, provided the learned barrier and its derivative conditions can be certified—either exactly (via region enumeration), conservatively (via bound propagation), or probabilistically (via sample-efficient calibration).
Residual architectures leveraging unsigned distance or HJ value function surrogates produce safe sets that do not “cut into” failure sets, ensuring no false negatives (Derajić et al., 6 Mar 2026, Derajić et al., 20 Sep 2025).
Adaptive and robust training objectives, including explicit slack or volume regularization, mitigate conservativeness, while QP-based safety filters remain critical at deployment (Xiao et al., 2021, Liu et al., 2022).
Output-feedback neural CBFs extend invariance to partial observation with jointly optimized observer-barrier-controller parameterizations, avoiding prior manual error bounds (Jagabathula et al., 30 Sep 2025).
In practice, moderate depth/width networks with tanh or ReLU activations offer a favorable tradeoff between expressivity and verifiability. Non-differentiability at network kinks (ReLU nets) is handled via Clarke cones and explicit region-based verification (Zhang et al., 2023).