Pith. sign in

REVIEW 4 major objections 5 minor 22 references

CPED-NCBFs: A Conformal Prediction for Expert Demonstration-based Neural Control Barrier Functions

T0 review · 4 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper establishes that split-conformal prediction on held-out states turns an expert-demonstration-trained neural control barrier function into a probabilistically certified safety filter, with per-region violation probability at…

desk verdict The empirical story is plausible and the combination is new, but the central probabilistic safety guarantee does not transfer to the returned network, so the paper overclaims as written. read the letter →

arxiv 2507.15022 v1 pith:NK7INRET submitted 2025-07-20 cs.RO cs.SYeess.SY

Sumeadh MS , Kevin Dsouza , Ravi Prakash This is my paper
classification cs.ROcs.SYeess.SY
keywords neuralcontrolbarrierfunctionsconformalpredictionexpertdemonstrationssafety-criticalquadraticprogramprobabilisticverificationpoint-masssystemunicyclemodel
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper contends that split-conformal prediction can verify a neural control barrier function (NCBF) learned from expert demonstrations, giving it a probabilistic safety certificate instead of a worst-case one. The motivation is that existing certifiers based on SMT, mixed-integer programming, or interval propagation are conservative and expensive, while an NCBF trained only on trajectory data has no out-of-sample guarantee. The paper's Theorem 1 states that with probability at least $1-\beta$ over the calibration data, every one of the three constraint regions satisfies $P(q_i(x) \le \hat{q}_i) \ge 1-\epsilon$; the $\hat{q}_i$ are sorted hold-out scores turned into robustness margins $\gamma_s,\gamma_u,\gamma_d$. The algorithm retrains the network against those margins and then filters a reference controller through a CBF-QP, and the point-mass and unicycle experiments report higher safety rates than a fixed-margin baseline when data are scarce.

What carries the argument

The central object is the per-region conformal quantile $\hat{q}_k$, computed by split-conformal prediction from the constraint residues $q_1,q_2,q_3$ on validation states. It does double duty: it is the robustness margin $\gamma_k$ fed into the scenario-optimization problem and the retraining loss, and it is the statistic that Theorem 1 certifies. The mechanism is exchangeability of the held-out scores: sorting $N$ i.i.d. scores and taking the $(1-\alpha/3)$-quantile with the regularized-incomplete-$\beta$ sample-size condition yields the simultaneous high-probability coverage bound, replacing Lipschitz-based worst-case margin selection.

What would settle it

Run Algorithm 1 to completion, then sample a fresh test set from each of $X_s$, $X_u$, and $X_d$ and count how often the final $h_\theta$ gives $q_i(x)>\hat{q}_i$; if any region's empirical violation frequency exceeds $\epsilon$ at the claimed confidence $1-\beta$, the guarantee as stated for the returned network fails.

Watch

Extended reading notes

Core claim

The central claim is that demonstration data plus a split-conformal calibration step are enough to turn a neural network into a valid control barrier function with high probability. For each constraint set $X_s$, $X_u$, and $X_d$, the paper computes scores $q_1(x)=-h_\theta(x)$, $q_2(x)=h_\theta(x)$, and $q_3(x)=-\frac{\partial h_\theta}{\partial x}(f(x)+g(x)u)-\kappa(h_\theta(x))$ on $N$ held-out states, sorts them, and takes the $\lfloor (N+1)\alpha/3\rfloor$-th largest as $\hat{q}_i$. Theorem 1 then gives the simultaneous coverage bound $P(q_i(x)\le \hat{q}_i)\ge 1-\epsilon$ with confidence $1-\beta$, provided $N$ is large enough that the regularized incomplete $\beta$ condition holds. Setting $\gamma_i=\hat{q}_i$ and retraining with these margins yields a barrier whose zero level set separates the demonstrated safe region from the unsafe layer, and whose QP-filtered rollouts on point-mass and unicycle systems stay safe more often than the fixed-margin baseline, particularly at small dataset sizes.

Load-bearing premise

The argument assumes that the safety margins measured on held-out data before the final retraining loop still describe the retrained network, and it never re-estimates those margins on the returned model.

Editorial extensions

If this is right

  • The returned network, used inside the CBF-QP filter, carries a per-region probabilistic safety bound on the three constraint sets, with no SMT, MIP, or interval-propagation solver needed.
  • Because the margins are chosen from calibration rather than from Lipschitz worst-case estimates, the certified safe set is less conservative than fixed-margin alternatives.
  • In the small-sample regime the calibrated margins improve rollout safety over the fixed-margin baseline on both the point-mass and unicycle systems, while the advantage narrows as more demonstration data are added.
  • The method yields a barrier whose zero level set lies inside the demonstrated safe region, so the forward-invariance condition for the CBF-QP controller is satisfied on the sampled regions with high probability.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: the theorem's coverage guarantee is stated for the scores used during calibration, so the certificate strictly applies to the pre-retraining network; a clean way to close the gap is to re-run calibration on the final weights after retraining.
  • Editorial inference: because the conformal guarantee is distribution-free and only requires exchangeable held-out scores, the same quantile-to-margin conversion should transfer to other differentiable barrier families, such as higher-order or stochastic CBFs.
  • Editorial inference: the experiments report trajectory safety rates rather than the per-region coverage of Theorem 1, so a direct extension is to report empirical violation frequencies for $q_1,q_2,q_3$ separately on fresh test states.
  • Editorial inference: the radius-versus-sample-size results suggest the calibrated margin acts as a data-dependent safety reserve, so tuning the confidence pair $(\beta,\epsilon)$ could expand or shrink the certified safe radius in a principled way.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes CPED-NCBF, a split-conformal-prediction framework for learning neural control barrier functions (NCBFs) from expert demonstrations. The method trains an NCBF in two stages: first with zero safety margins, then it computes conformal quantiles of constraint-violation scores on a validation set and retrains the network using those quantiles as robustness margins. A CBF-QP controller is then used for safety-critical control. The paper claims that Theorem 1 provides a probabilistic safety guarantee for the returned NCBF, and it reports simulations on a point-mass system and a unicycle model comparing the proposed method with a fixed-margin baseline.

Significance. If the probabilistic safety guarantee were valid, the paper would contribute a useful data-driven alternative to conservative worst-case verification for neural CBFs. The empirical setup, especially the comparison of generalization radius with varying sample sizes and the safety-rate tables, is relevant to the imitation-learning and safety-critical control communities. However, the central theoretical claim is not supported by the presented analysis: the conformal quantiles are computed on a network that is subsequently retrained, and the theorem does not apply to the final network. In addition, the bridge from finite sample constraints to pointwise safety relies on Lipschitz constants and epsilon-net conditions that are never estimated or verified. These issues affect the core contribution rather than presentation.

major comments (4)
  1. [Section IV, Algorithm 1] The conformal quantiles qhat_k are computed from scores s_k^i(0, D_k) of the network trained with gamma_k = 0 (lines 5-8), but the returned network is produced by a second training loop (lines 16-19) using those quantiles as margins. Theorem 1 states a coverage guarantee for the model whose scores define the quantile, and retraining changes h_theta and hence the scores. No step recomputes qhat_k on the final network or uses a fresh calibration set after training. The narrative paragraph says the process repeats until all qhat_k <= 0, but the pseudocode returns immediately after the second loop, and even under an iterative reading, reusing the same validation set for selecting margins and for stopping would violate the exchangeability assumption required for split conformal prediction. Therefore the paper's central claim that CPED-NCBF provides probabilistic safety guarantees for the returned network is not established.
  2. [Section III, Lemmas 1-3] Lemmas 1-3 convert sample constraints of the form h_theta(x_i) >= gamma_s, h_theta(x_i) <= -gamma_u, and the derivative constraint into pointwise statements over D and N. Each lemma requires an epsilon-net or bar-epsilon-net with epsilon bounded by gamma/L_{h_theta}, where L_{h_theta} is a local Lipschitz constant. The manuscript never provides a method to compute or bound L_{h_theta}, nor does it establish that the sampled sets X_s, X_u, X_d actually form such nets at the required resolution. Without these estimates, the finite-sample constraints do not imply pointwise safety, and the subsequent SOP and conformal-quantile construction have no verified connection to the continuous safety condition in Eq. (II.3).
  3. [Section IV, Theorem 1] The theorem states a probabilistic bound on P_{x in Xi}(q_i(x) <= qhat_i) for a distribution over each constraint set Xi. This is a statement about the validation distribution, not about all x in D or N. To obtain a safety certificate for the CBF-QP controller, one needs the pointwise conditions in Lemmas 1-3 over the continuous regions, which in turn require the Lipschitz and epsilon-net conditions that are not established. Moreover, Eq. (III.8) defines q_3 with an explicit indicator 1_Xd, whereas Lemma 3 and the SOP treat q_3 as a function on all of Xd; the indicator notation is inconsistent with the claim that the constraint holds for all x in D. The gap between distributional coverage and pointwise safety is load-bearing for the paper's verification claim.
  4. [Section IV, Subsection 3 and Section VI, Table II] The training algorithm sets gamma_k = qhat_k and then retrains with these margins as loss targets. On the final network, no fresh validation or calibration is performed, so the actual violation rates of the returned network are unknown. The empirical safety rates in Table II are rollout statistics under a specific controller and initial condition distribution; they do not provide confidence intervals or a finite-sample guarantee and therefore cannot substitute for the missing post-training certificate. The abstract and conclusion claim 'probabilistic safety guarantees' for the learned NCBF, but the evidence supports at most an empirical safety rate on the tested scenarios.
minor comments (5)
  1. [Section III, Lemma 3 and Eq. (III.8)] The symbol alpha is used for the extended class K function in Lemma 3, while kappa is used in the CBF-QP in Eq. (II.4) and in the definition of q_3 in Eq. (III.8). This notational inconsistency should be fixed.
  2. [Section V, Data Generation Strategies] The text refers to 'proposition 3' when discussing radial sampling near decision boundaries, but no proposition numbered 3 is stated in the paper; the intended reference appears to be Lemma 3 or the derivative-constrained set Xd.
  3. [Section V, Experiments] The experiments use known, hand-coded CBFs (min{1-x1, 1-x2} for the point mass and a pre-trained barrier for the unicycle) to generate expert demonstrations. The paper should state clearly that the method is evaluated on recovering a known barrier, not on discovering a previously unknown safe set.
  4. [Section VI, Table II] The safety rates are reported as point estimates without standard errors or confidence intervals; a comparison based on 100 trajectories would benefit from error bars. In addition, the claim that CPED-NCBF 'significantly outperforms' FM-NCBF in the low-sample regime is not supported by any statistical test.
  5. [Section IV, Algorithm 1] The notation s_k^i(0, D_k) is not defined in the pseudocode; it is not clear whether the scores are evaluated with the network trained at gamma=0 or with updated margins. This ambiguity matters for the correctness of the calibration step.

Circularity Check

1 steps flagged · score 6.0 of 10

Conformal quantiles are computed on the pre-retraining network and then reused as training margins, so the claimed probabilistic safety guarantee for the returned NCBF is an input to training rather than an independent verification.

  1. fitted input called prediction [Section IV, 'Training Algorithm' paragraph; Algorithm 1 lines 9-19; Theorem 1]
    "Next, for each set Xk, a conformal score ˆqk is computed using a validation dataset that was strictly excluded from the training process. This separation ensures that the estimated margins reflect the model’s generalization ability rather than overfitting to the training data. . If any ˆqk > 0, indicating potential safety violations, the corresponding margin is updated as γk = ˆqk, and the NCBF is retrained using the updated margins."

    The q̂k are quantiles of the violation scores q_i(x) computed with the network trained under γ=0 (Algorithm 1 lines 5-8). Theorem 1's coverage statement is a split-conformal guarantee about that same network: it requires the calibration samples Dk to be independent of the model that produced the scores. Algorithm 1 then sets γk = q̂k and retrains h_θ with these margins in the loss (lines 16-19), so the returned network depends on the calibration data through the margins. No fresh calibration set is drawn and q̂k is not recomputed for the returned h_θ. The paper's conclusion that 'the final safe control policy ...

full rationale

The central conformal-prediction theorem (Theorem 1) is a standard split-conformal statement and, considered in isolation, is not circular; the paper also borrows its Lipschitz-margin lemmas from external prior work ([22]), so there is no load-bearing self-citation chain. However, the algorithmic use of the theorem is circular in effect: Algorithm 1 calibrates q̂k on a network trained with zero margins, then uses those same q̂k as the robustness margins γk in the loss to retrain the returned h_θ, and finally claims Theorem 1's probabilistic safety guarantee for that retrained network. Because the calibration data (through q̂k) has influenced the final model, the split-conformal exchangeability assumption underlying Theorem 1 is violated, and no recalibration is performed on the returned network. The paper's 'probabilistic safety guarantee' thus reduces to a fitted margin that was inserted into the training objective, rather than an independent property verified for the final network. The empirical safety-rate comparisons in Tables I-II are real external benchmarks, which is why the score is not higher, but the advertised guarantee for CPED-NCBF itself is unsupported by the stated derivation.

Assumptions & free parameters 5 free parameters · 5 assumptions · 0 invented entities

The central claim rests on several unverified premises: the conformal quantiles survive retraining, the samples form epsilon-nets with known Lipschitz constants, and the validation data are i.i.d. from the deployment distribution. These are standard assumptions for split-conformal prediction but are not checked for the final network.

free parameters (5)
  • gamma_s, gamma_u, gamma_d robustness margins = calibrated via conformal quantiles, values not reported
    Safety margins are chosen from validation quantiles and used as training targets, so they are fitted to data rather than derived.
  • lambda_s, lambda_u, lambda_d loss weights = not stated
    Weights in the composite loss are chosen by hand and not reported.
  • epsilon and sigma set widths = not stated
    D and N are constructed from expert samples using widths epsilon and sigma; values are not reported and affect the guarantee.
  • buffer width w and radial sampling parameters = not stated
    Data generation uses boundary-focused radial sampling with a buffer width w; these parameters are unspecified and impact empirical safety.
  • class-K function alpha/kappa = not stated
    The CBF condition uses alpha(h) but the concrete function is not specified.
assumptions (5)
  • domain assumption The dynamics f and g are known and locally Lipschitz continuous.
    Used throughout the CBF conditions and Lemmas 1-3; no model uncertainty or identification is considered.
  • domain assumption Expert demonstrations are safe and representative of the safe region S.
    The construction of D and the sampling strategy rely on demonstrations lying in int(S) and covering relevant safe regions.
  • ad hoc to paper The neural network h_theta has known local Lipschitz constants and the sampled points form an epsilon-net of D and N.
    Lemmas 1-3 require this to lift sample constraints to all of D and N, but the algorithm never estimates Lipschitz constants or verifies net conditions.
  • standard math Validation samples are i.i.d. draws from each constraint set Xi.
    Split-conformal Theorem 1 requires i.i.d. calibration data; this is assumed without checking stationarity or deployment distribution.
  • domain assumption The zero level set of h_theta lies inside D, so C subset D subset S.
    Validity of the learned CBF as a local CBF depends on this geometric placement, asserted through enforcement on N but not formally checked.

how reviews work

0 comments
Cite this review

Pith. "Pith review of CPED-NCBFs: A Conformal Prediction for Expert Demonstration-based Neural Control Barrier Functions." pith.science (2026). https://pith.science/paper/NK7INRET

@misc{pith2026250715022,
  author       = {Pith},
  title        = {Pith review of: CPED-NCBFs: A Conformal Prediction for Expert Demonstration-based Neural Control Barrier Functions},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/NK7INRET}},
  note         = {Machine review of arXiv:2507.15022}
}
read the original abstract

Among the promising approaches to enforce safety in control systems, learning Control Barrier Functions (CBFs) from expert demonstrations has emerged as an effective strategy. However, a critical challenge remains: verifying that the learned CBFs truly enforce safety across the entire state space. This is especially difficult when CBF is represented using neural networks (NCBFs). Several existing verification techniques attempt to address this problem including SMT-based solvers, mixed-integer programming (MIP), and interval or bound-propagation methods but these approaches often introduce loose, conservative bounds. To overcome these limitations, in this work we use CPED-NCBFs a split-conformal prediction based verification strategy to verify the learned NCBF from the expert demonstrations. We further validate our method on point mass systems and unicycle models to demonstrate the effectiveness of the proposed theory.

Figures

Figures reproduced from arXiv: 2507.15022 by the authors.

Figure 2
Figure 2. shows 3D surface plots of the learned control barrier functions (CBFs) for two systems, each with FM￾NCBF (Fixed Margin) and CPED-NCBF variants. Both cases aim to approximate the safety boundaries, the boundary generated by FM-NCBF exhibits a rougher surface with less distinct separation between safe and unsafe regions. In contrast,the CPED-NCBF push safe states deeper into the safe region and unsafe states further … view at source ↗
Figure 4
Figure 4. Trajectory plots comparing FM-NCBF and CPED [PITH_FULL_IMAGE:figures/full_fig_p005_4.png] view at source ↗

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

22 extracted references · 20 canonical work pages

  1. [1]

    Constrained policy op- timization,

    J. Achiam, D. Held, A. Tamar, and P. Abbeel, “Constrained policy op- timization,” in International conference on machine learning. PMLR, 2017, pp. 22–31

    work page 2017

  2. [2]

    Model-based safe deep reinforcement learning via a constrained proximal policy optimization algorithm,

    A. K. Jayant and S. Bhatnagar, “Model-based safe deep reinforcement learning via a constrained proximal policy optimization algorithm,” in Advances in Neural Information Processing Systems , vol. 35, 2022, pp. 24 432–24 445

    work page 2022

  3. [3]

    Safe model-based reinforcement learning with stability guarantees,

    F. Berkenkamp, M. Turchetta, A. Schoellig, and A. Krause, “Safe model-based reinforcement learning with stability guarantees,” in Advances in Neural Information Processing Systems , vol. 30, 2017

    work page 2017

  4. [4]

    Hamilton-Jacobi reachability: A brief overview and recent advances,

    S. Bansal, M. Chen, S. Herbert, and C. J. Tomlin, “Hamilton-Jacobi reachability: A brief overview and recent advances,” in 2017 IEEE 56th Annual Conference on Decision and Control (CDC) , 2017

    work page 2017

  5. [5]

    A physics- informed machine learning framework for safe and optimal control of autonomous systems,

    M. Tayal, A. Singh, S. Kolathaya, and S. Bansal, “A physics- informed machine learning framework for safe and optimal control of autonomous systems,” in Forty-second International Conference on Machine Learning , 2025. [Online]. Available: https://openreview.net/forum?id=SrfwiloGQF

    work page 2025

  6. [6]

    Control barrier function based quadratic programs for safety critical systems,

    A. D. Ames, X. Xu, J. W. Grizzle, and P. Tabuada, “Control barrier function based quadratic programs for safety critical systems,” IEEE Transactions on Automatic Control , vol. 62, no. 8, pp. 3861–3876, 2017

    work page 2017

  7. [7]

    Control barrier functions: Theory and applications,

    A. D. Ames, S. Coogan, M. Egerstedt, G. Notomista, K. Sreenath, and P. Tabuada, “Control barrier functions: Theory and applications,” in 18th European control conference (ECC) . IEEE, 2019, pp. 3420– 3431

    work page 2019

  8. [8]

    Safety-critical control of a planar quadrotor,

    G. Wu and K. Sreenath, “Safety-critical control of a planar quadrotor,” in 2016 American Control Conference (ACC) , 2016, pp. 2252–2258

    work page 2016

Show all 22 references
  1. [9]

    Control barrier functions in dynamic uavs for kinematic obstacle avoidance: A col- lision cone approach,

    M. Tayal, R. Singh, J. Keshavan, and S. Kolathaya, “Control barrier functions in dynamic uavs for kinematic obstacle avoidance: A col- lision cone approach,” in 2024 American Control Conference (ACC) . IEEE, 2024, pp. 3722–3727

    2024

  2. [10]

    Safety-critical control for dy- namical bipedal walking with precise footstep placement,

    Q. Nguyen and K. Sreenath, “Safety-critical control for dy- namical bipedal walking with precise footstep placement,” IFAC- PapersOnLine, vol. 48, no. 27, pp. 147–154, 2015

    2015

  3. [11]

    Safe legged locomotion using collision cone control barrier functions (c3bfs),

    M. Tayal and S. Kolathaya, “Safe legged locomotion using collision cone control barrier functions (c3bfs),” arXiv preprint arXiv:2309.01898, 2023

    2023 arXiv

  4. [13]

    Fossil: A software tool for the formal synthesis of Lyapunov functions and barrier certificates using neural networks,

    A. Abate, D. Ahmed, A. Edwards, M. Giacobbe, and A. Peruffo, “Fossil: A software tool for the formal synthesis of Lyapunov functions and barrier certificates using neural networks,” in Proceedings of the 24th International Conference on Hybrid Systems: Computation and Control,...

    2021

  5. [14]

    Learning a formally verified control barrier function in stochastic environment,

    M. Tayal, H. Zhang, P. Jagtap, A. Clark, and S. Kolathaya, “Learning a formally verified control barrier function in stochastic environment,” in 2024 IEEE 63rd Conference on Decision and Control (CDC), 2024, pp. 4098–4104

    2024

  6. [15]

    Learning control barrier functions from expert demonstrations,

    A. Robey, H. Hu, L. Lindemann, H. Zhang, D. V . Dimarogonas, S. Tu, and N. Matni, “Learning control barrier functions from expert demonstrations,” in 59th IEEE Conference on Decision and Control (CDC), 2020, pp. 3717–3724

    2020

  7. [16]

    Safe nonlinear control using robust neural lyapunov-barrier functions,

    C. Dawson, Z. Qin, S. Gao, and C. Fan, “Safe nonlinear control using robust neural lyapunov-barrier functions,” in Conference on Robot Learning, 2022, pp. 1724–1735

    2022

  8. [17]

    Semi-supervised safe visuomotor policy synthesis using barrier certificates,

    M. Tayal, A. Singh, P. Jagtap, and S. Kolathaya, “Semi-supervised safe visuomotor policy synthesis using barrier certificates,” arXiv preprint arXiv:2409.12616, 2024

    2024 arXiv

  9. [18]

    Verifying neural network controlled systems using neural networks,

    Q. Zhao, X. Chen, Z. Zhao, Y . Zhang, E. Tang, and X. Li, “Verifying neural network controlled systems using neural networks,” in 25th ACM International Conference on Hybrid Systems: Computation and Control, 2022, pp. 1–11

    2022

  10. [19]

    Cp-ncbf: A con- formal prediction-based approach to synthesize verified neural control barrier functions,

    M. Tayal, A. Singh, P. Jagtap, and S. Kolathaya, “Cp-ncbf: A con- formal prediction-based approach to synthesize verified neural control barrier functions,” arXiv preprint arXiv:2503.17395 , 2025

    2025 arXiv

  11. [20]

    Genosil: Generalized optimal and safe robot control using parameter-conditioned imitation learning,

    M. Tayal, M. Tayal, and R. Prakash, “Genosil: Generalized optimal and safe robot control using parameter-conditioned imitation learning,” 2025. [Online]. Available: https://arxiv.org/abs/2503.12243

    2025

  12. [21]

    Safe nonlinear control using robust neural Lyapunov-barrier functions,

    C. Dawson, Z. Qin, S. Gao, and C. Fan, “Safe nonlinear control using robust neural Lyapunov-barrier functions,” in Conference on Robot Learning. PMLR, 2022, pp. 1724–1735

    2022

  13. [22]

    Synthesizing barrier certifi- cates using neural networks,

    H. Zhao, X. Zeng, T. Chen, and Z. Liu, “Synthesizing barrier certifi- cates using neural networks,” in Proceedings of the 23rd international conference on hybrid systems: Computation and control , 2020, pp. 1–11

    2020

  14. [23]

    Learning control barrier functions from expert demonstrations,

    C. Squires, M. Yin, A. D. Ames, and A. Bhoopchand, “Learning control barrier functions from expert demonstrations,” in Learning for Dynamics and Control (L4DC) , 2023

    2023

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.