Safe-by-Design Learning via Energy-based Neural Networks

1 Introduction

• Accuracy over observed trajectories is insufficient when learned dynamics may behave unstably or undesirably under new inputs or longer rollouts.This matters in applications such as flight, autonomous operation, and human-robot interaction, where behavior outside densely sampled training regions is operationally relevant.Source: §1 · p. 1
• Existing safety approaches add filters, monitors, constrained controllers, or post-hoc verification, leaving open whether certifiability can be intrinsic to learned dynamics.Port-Hamiltonian models provide an energy balance linking interconnection, dissipation, and external actuation.Source: §1 · p. 2
• Expressive nonconvex energy landscapes can represent multiple stable regimes, whereas restrictive convex parameterizations may simplify certification around a single equilibrium.The paper proposes using the energy geometry directly to determine inputs compatible with safe evolution.Source: §1 · p. 2
• The learned Hamiltonian defines energy barriers that identify inputs unable to inject enough energy to move trajectories across a prescribed sublevel boundary.The construction uses the same energy governing the neural dynamics, rather than an additional network or post-processing stage.Source: §1 · p. 2
• The pH-EBM combines port-Hamiltonian structure with a coercive, globally nonconvex modern-Hopfield Hamiltonian and reports competitive, often state-of-the-art accuracy with safety guarantees.Its benchmarks span physical systems, multi-attractor dynamics, out-of-distribution forcing, and high-dimensional flight identification.Source: §1 · p. 2

2 Problem formulation

• The physical state and vector field are unknown; observations comprise sampled inputs and outputs, with a known bounded external input and measurement perturbations.The formulation assumes the vector field satisfies standard Carathéodory conditions, ensuring unique forward-complete solutions.Source: §2 · p. 2
• The objective is a latent continuous-time model that reproduces observed input-output behavior and generalizes within a neighborhood sufficiently covered by data.Recovering the unobserved physical state itself is not required.Source: §2 · p. 3
• A ρ-robust invariant set keeps its latent states inside the set for all time under inputs of intensity at most ρ, while decoded outputs remain in the prescribed safe region.The definition requires both output safety and state-set invariance.Source: §2 · p. 3
• The latent safe set generally cannot be prescribed before training, so the model must jointly learn a maximal ρ-robust invariant set within the target region.Continuity of the decoder extends latent-space safety to compact sets in measurement space.Source: §2 · p. 3
• Post-hoc invariant-set certification can scale poorly with state dimension and network size, motivating architectures whose Hamiltonian sublevel components yield certificates under explicit dissipation and input conditions.The stated route uses barrier certificates to characterize robustly forward-invariant sets.Source: §2 · p. 4

3 Safe-by-design port-Hamiltonian neural ODEs

• The port-Hamiltonian model pairs energy-preserving interconnection and dissipative dynamics with an input port, while allowing a nonconvex modern Hopfield Hamiltonian and expressive hidden features.Skew-symmetry of J preserves energy, positive semidefiniteness of R makes the internal dynamics dissipative, and G accounts for energy exchanged with the environment.Source: §3 · p. 4
• A bounded first hidden activation makes the Hamiltonian coercive: later contributions grow at most linearly, leaving its quadratic leading term to ensure compact sublevels.Coercivity and continuity keep sublevel sets compact despite potentially nonconvex hidden-layer contributions.Source: §3 · p. 4

3.1 ρ-Robust Invariant Set Computation

• Each isolated local energy minimum yields a compact sublevel component whose boundary admits an explicit robustness radius, ensuring invariance for inputs within that radius.The radius quantifies each energy component’s tolerance to external inputs.Source: §3.1 · p. 5
• The certificate extends to bounded additive perturbations and compact convex input sets; repeating it across suitable energy levels assigns certified operating envelopes to learned regimes.The admissible input envelope can accommodate norm balls, boxes, polytopes, ellipsoids, and asymmetric actuator constraints.Source: §3.1 · p. 5

3.2 Computable robustness bounds from local geometry

• A conservative geometric lower bound relates robustness to energy-shell steepness, dissipation along the energy normal, and exposure of that normal to the input port.The overall input gain is not necessarily detrimental; only its component normal to the energy shell consumes the available margin.Source: §3.2 · p. 6
• A local PL condition can bound shell steepness and yield a radius estimate when the selected component lies in the local neighborhood with uniform dissipation; the analysis also treats energy-tube confinement under bounded forcing.The local PL argument leaves the global Hamiltonian free to remain nonconvex and multi-well.Source: §3.2 · p. 6

Accuracy and robustness across benchmarks

• Across tested systems, pH-EBM combines competitive or improved predictive accuracy with substantially larger certified input margins, with strongest prediction gains on nonconvex mechanics and long-horizon NanoDrone.The suite covers Silverbox, CED, Duffing, n-link pendulum, and NanoDrone, using benchmark-native prediction metrics and a common energy-shell and normalized-radius protocol.Source: §4 · p. 7
• Duffing RMSE decreases from 0.254 to 0.048 as radius rises from 5 × 10−4 to 4 × 10−1; 3-link pendulum RMSE falls from 0.276 to 0.014 as radius rises from 5 × 10−3 to 2 × 10−1.The 3-link pendulum also improves on the published RMSE of 0.051.Source: §4 · p. 7, Figure 3 · p. 9

Robust long time-horizon rollouts in high-dimensional Nanodrone application

• At 5 s, NanoDrone RMSE is 369.025 vs. 1363.701, and pH-EBM stays within its certified energy component while the black-box trajectory exits.The 5 s rollout is ten times the 0.5 s training horizon; the black-box trajectory exits the projected safe region after approximately 2 s.Source: §4 · pp. 7–8, Figure 2 · p. 8
• On unseen Melon excitation, the black-box model is more accurate over the original 0.5 s horizon, but its long-rollout error grows rapidly while pH-EBM remains bounded.The pH-EBM sacrifices some short-horizon Melon accuracy while remaining inside the certified region during the 5 s rollout.Source: §4 · p. 8, Figure 2 · p. 8

Nonconvex geometry and attractor-dependent certification

• Near the Duffing saddle, pointwise and state-independent input tolerance falls as the certified shell approaches critical energy, then rises after the certified component expands beyond it.The pH-EBM's state-independent certificate is approximately two orders of magnitude larger than portHNN-u under the adopted configuration.Source: §4 · p. 8, Figure 3 · p. 9

Out-of-distribution robustness and mechanical scaling

• For 2- and 3-link pendulums, pH-EBM combines lower error under Brownian and step out-of-distribution forcing with a certified ρ-robust invariant region, using approximately 1/20 of the dissipative reference's training time.Across the pendulum systems, the reported comparisons include predictive accuracy, adversarial-input robustness, and training efficiency.Source: §4 · pp. 7, 9

5 Conclusions

• The certificates apply directly to learned model dynamics, not automatically to the physical plant; extending them requires a validated enclosure of model mismatch and external disturbances in the robust barrier condition.The paper also reports longer training and more targeted model selection than unconstrained NODEs, while computational cost remains comparable to portHNN-u and can be lower than dissipative NODEs.Source: §5 · p. 9
• Future work includes contact and hybrid dynamics, feedback-controller integration, scalable certificate-aware training, and closed-loop safety guarantees.These extensions are presented as steps toward end-to-end safety-critical deployment.Source: §5 · pp. 9–10
• The authors report using large language models for language polishing, codebase organization and optimization, and dataset-interface implementation, but not for research ideation or theoretical results.They state that authors reviewed and validated the scientific content, experimental design, implementation choices, and reported results.Source: §5 · p. 10
• The appendix documents theoretical assumptions and proofs alongside datasets, preprocessing, architectures, training protocols, hyperparameters, evaluation procedures, and certificate computations.Supplementary material includes the framework implementation, experiment configurations, and scripts for reproducing benchmarks and robustness analyses.Source: §5 · p. 10

A.1 Lie and Clarke’s derivatives

• Lie derivatives characterize how energy changes along model trajectories, while Clarke’s generalized gradient and directional derivative extend derivative tools to locally Lipschitz functions.The paper uses these tools to characterize negative definiteness of energy along EBM dynamics.Source: §A.1 · p. 13

B.1 Port-Hamiltonian energy balance

• Port-Hamiltonian dynamics separate skew-symmetric interconnection, positive-semidefinite dissipation, and external input; coercivity makes energy sublevel sets compact without requiring convexity.Coercivity alone does not imply convergence to a particular minimum; that requires additional information about the invariant set where dissipation vanishes.Source: §B.1 · pp. 13–14

B.2 Derivation and coercivity of the hybrid Hamiltonian

• The hybrid modern Hopfield construction makes hidden layers static feedforward maps of the visible state, reducing the dynamical architecture to its visible layer; bounded first-hidden activation yields coercivity.The quadratic term dominates the affine lower bound as the visible-state norm grows.Source: §B.2 · pp. 14–15

B.3 Barrier functions and invariance

• A superlevel set of a barrier function is invariant when the barrier condition prevents crossing its zero boundary; requiring it for all prescribed inputs and disturbances gives robust invariance.At regular boundary points, this reduces to an inward-pointing vector field, equivalently the tangent-cone condition.Source: §B.3 · p. 15

B.5 Exact robust boundary certificate

• The certified energy component is compact by coercivity, and the cited solution assumptions ensure unique solutions for the admissible measurable inputs considered.The section also extends certification to arbitrary compact input sets.Source: §B.5 · pp. 16–17
• When the Hamiltonian has isolated critical points, the shells are regular for almost every energy level; exceptional levels can contain saddle points or local maxima.Open regions of constant energy are possible but described as unlikely.Source: §B.5 · p. 16
• For almost every regular boundary energy shell, the defined robust input set makes the certified component robustly invariant for admissible inputs and measurable disturbances in W(z).The set is maximal by inclusion among state-independent subsets of U whose elements satisfy the boundary condition at every boundary state.Source: §B.5 · pp. 16–17
• Intersecting the pointwise admissible half-spaces over the full boundary yields the robust input set; the inward-pointing condition then places the dynamics in the component's tangent cone.The tangent condition gives invariance by Nagumo’s criterion.Source: §B.5 · p. 17
• If zero input is robustly admissible on the boundary, the exact radius of the largest origin-centered norm ball contained in the robust input set is given by the boundary certificate.Boundary points where a_H(z) = 0 impose no radius restriction when residual boundary dissipation is nonnegative.Source: §B.5 · p. 17

B.6 Regular energy shells and normal robustness decomposition

• A compact energy boundary with nonzero Hamiltonian gradient is a regular (d −1)-dimensional surface, and its minimum gradient norm κϵ,⋆ is positive.Regularity lets the energy gradient serve as a boundary normal for the barrier test.Source: §B.6 · p. 18
• At a regular boundary, feasible first-order directions satisfy ∇H(z)⊤v ≤0, while input directions tangent to the shell consume no energy margin.If the input port is tangent along the entire boundary, the certificate imposes no magnitude restriction on the input, though the disturbance margin must remain nonnegative.Source: §B.6 · p. 18
• As shell energy approaches a critical value containing a saddle or other stationary point, κϵ,⋆ can collapse toward zero; beyond the saddle, the certified region includes sets on both sides.Compact shells below the maximal regular-shell energy remain eligible for the regular-boundary certificate.Source: §B.6 · p. 19

B.7 Bounds under local PL and persistent forcing

• Under a local PL condition and positive dissipation, a sufficient conservative approximation can ensure the selected zeroing-BF inequality throughout the component when Aϵ > 0.This interior condition is stronger, and correspondingly more conservative, than boundary-only invariance.Source: §B.7 · p. 19
• The robust PL corollary gives an invariance-only certificate when its numerator is nonnegative, without requiring the selected zeroing-BF inequality at every interior point.The boundary regularity bound used is κϵ,⋆ ≥ √2µ⋆ϵ.Source: §B.7 · p. 19

B.8 Input-to-energy robustness under persistent forcing

• With uniform bounds on input, input port, and disturbances, the input-to-energy tube result gives robust invariance and bounds trajectories to energy levels above a forcing-dependent threshold.The stated forcing magnitude is c := ¯g¯u + ¯w; the asymptotic level condition is s ≥ ϵ − c²/(2r⋆µ⋆).Source: §B.8 · p. 20
• The tube bound follows by controlling the energy difference along port-Hamiltonian trajectories and applying the local PL condition and a comparison lemma.The proof invokes Young’s inequality to bound the forcing contribution.Source: §B.8 · p. 20

B.9 Activation-dependent guidance for local PL

• For nonsmooth compositions, a tractable outer-set condition may be strict, but positivity over that outer set remains a sound certificate.Source: §B.9 · p. 21
• Softmax, tanh, and sigmoid are smooth and bounded, making them compatible with the stated local regularity and bounded-first-hidden-layer conditions.Softmax is specifically noted as compatible with the bounded-first-hidden-layer condition used to establish coercivity.Source: §B.9 · pp. 21–22
• ReLU permits a worst-case generalized-slope check at activation kinks without fixing the activation pattern, but its unboundedness precludes using it as the first hidden activation under the stated coercivity condition.The local Clarke certificate still applies when ReLU occurs only in deeper layers or coercivity is ensured another way.Source: §B.9 · p. 22
• Hard-tanh supports the same worst-case diagonal test and, unlike ReLU, can also satisfy the bounded-first-hidden-layer condition for coercivity.Its generalized slopes are one in the unsaturated region, zero outside it, and any value in [0, 1] at the kinks.Source: §B.9 · p. 22
• For locally Lipschitz Hamiltonians, a positive-definite projected Clarke generalized-Hessian condition supplies a sufficient local PL certificate, though exact checks for deeper networks may be conservative or expensive.A tractable outer approximation is sound when every matrix has a common positive spectral margin.Source: §B.9 · pp. 20–22

• Benchmark architectures vary, while the common construction is a learned Hopfield storage function coupled to free port-Hamiltonian interconnection, dissipation, and input maps.Source: C Experimental details and… · p. 23
• Unless stated otherwise, continuous-time rollouts use fourth-order Runge–Kutta integration.Source: C Experimental details and… · p. 23
• Reported certificates are evaluated after training without modifying learned parameters.Source: C Experimental details and… · p. 23
• Table 2 compares prediction accuracy and certified robustness across nonlinear-system benchmarks; bracketed results denote distinct test sets, and semicolon-separated entries denote reference-architecture variants.Source: Table 2 · p. 23

C.1 Datasets, splits, and preprocessing

• Silverbox uses three official test records, averages their RMSE, and trains a four-dimensional latent model from standardized data with a burn-in initial-state estimate.The same training-record standardization is applied unchanged to each test record.Source: §C.1 · p. 23
• CED concatenates and jointly standardizes two training realizations but evaluates their distinct actuation-amplitude test records separately, using a four-dimensional latent state.The two test rollouts have no state carried between them.Source: §C.1 · p. 23
• The Duffing dataset includes trajectories initialized in both wells and held-out forcing families reserved for out-of-distribution evaluation, with physical states used directly as model states and targets.No state or input normalization is used, making the learned Hamiltonian directly comparable with analytic mechanical energy.Source: §C.1 · p. 23
• Pendulum experiments reuse the reference generator’s arrays and use an output-only first-joint observation with an eight-dimensional latent state for both two- and three-link cases.The supplied release contains complete champion artifacts for n = 2 and n = 3.Source: §C.1 · pp. 23–24
• NanoDrone uses 12 physical-state coordinates and four rotor-speed inputs; Melon trajectories are held out from scaler fitting and model selection, with a 500-step primary comparison against 50-step training/evaluation horizons.The confirmation protocol uses four frozen seeds and selects models only on training-supported families.Source: §C.1 · p. 24

C.2 Per-benchmark model configurations

• Configurations share the pH-EBM construction but not a forced common width, and Table 3 reports architectures and active parameter counts while marking some draft rows as unavailable in the release.The table caption ties unavailable rows to missing experiment code or champion configurations.Source: §C.2 · p. 24, Table 3 · p. 24

C.3 Training, validation, and model selection

• Training uses finite rollout windows, Huber loss, Adam/AdamW, gradient clipping, RK4, and a stop-gradient warm-up before full-rollout differentiation.The warm-up changes the optimization path, not the test-time model; benchmark schedules and data interfaces vary by system.Source: §C.3 · p. 24

C.4 Baselines and comparison protocol

• Baselines are selected for each benchmark’s scientific question, with shared test records or paired inputs where specified.NanoDrone’s pH-EBM and black-box comparison is not parameter-matched; missing baseline certification is recorded as unavailable, not zero.Source: §C.4 · p. 25

C.5 Prediction metrics and statistical reporting

• Prediction metrics preserve benchmark-native units, while NanoDrone’s primary paired comparison is physical trajectory MAE at 500 steps.Additional NanoDrone horizons and channel-family diagnostics are reported; its quaternion observations are evaluated in SO(3) logarithmic coordinates.Source: §C.5 · p. 25

C.6 Operational energy-shell selection

• Energy shells are traced from discovered wells by ray search and refinement, with failed rays recorded rather than projected elsewhere.Finite ray samples yield shell estimates, not an exhaustive proof of the continuous high-dimensional boundary.Source: §C.6 · p. 25

C.7 Numerical computation and verification of certificates

• The sampled shell radius takes the least favorable pointwise margin, while a separate regular-boundary estimate exposes factors in its analytic lower bound.Both are numerical shell estimates unless continuous extrema are independently bounded; energy sweeps retrace each shell and recompute both radii.Source: §C.7 · p. 26
• The empirical normalized radius enables cross-model comparison by matching validation-energy occupancy and measuring inputs in validation-derived coordinates.It is an empirical metric from a numerically reconstructed shell; the radius at a prescribed energy level remains the exact continuous-state certificate.Source: §C.7 · pp. 26–27

C.8 Additional benchmark results

• Figures 4–11 provide diagnostic views across single-well benchmarks, Duffing’s nonconvex physical energy, n-link prediction and OOD behavior, and NanoDrone’s long-horizon rollouts.The figures accompany the main quantitative table; shell radii are obtained from full-state certificate computations, not the visualizations.Source: §C.8 · p. 27

C.9 Ablations and sensitivity analyses

• The experiments vary certificate-relevant choices: Duffing changes Hamiltonian parameterization, n-link changes mechanical dimension, and NanoDrone pairs models on shared starts and horizons.Energy sweeps track certificate factors as the operating region approaches critical energy levels.Source: §C.9 · p. 27
• Silverbox slice and profile views closely agree over the explored region, while CED’s radius trend is smooth and nearly monotone; neither establishes recovery of a unique physical energy.The CED pattern is consistent with effectively single-well learned geometry, not proof of physical-energy convexity.Source: Figure 4 · p. 28, Figure 5 · p. 29
• Duffing’s learned energy recovers the characteristic double-well topology and central saddle in physical coordinates, supporting qualitative—not unique or exact—reconstruction.The figure compares analytic and learned energies directly in (q, p).Source: Figure 6 · p. 30
• For the 3-link pendulum, detected saddle-energy shells coincide with pronounced radius-curve changes, but too few rays support a complete projected shell boundary.The 2-link radius decreases near detected saddle shells before increasing beyond nominal operating energy.Source: Figure 7 · p. 31, Figure 8 · p. 32
• In the shown 5 s NanoDrone rollouts, pH-EBM stays inside the displayed envelope while the black-box trajectory exits; held-out Melon extrapolation also shows the black-box error growing.The displayed envelope is a projection and does not replace full-state evaluation.Source: Figure 9 · p. 33, Figure 10 · p. 34, Figure 11 · p. 35