Safety filter

Overview

A safety filter sits between a nominal controller and the actuators. It passes the nominal input through while the state stays safe, and replaces it when it would not 2604.02401 §II-B. The goal is to keep the state inside a safe set C for all times, from every start in a set D inside C, even though the nominal controller alone gives no such guarantee [arxiv:2604.02401 §II-B]. The states where the filter returns the nominal input unchanged form its filter-inactive set 2604.02401 eq. 5.

The first three control variants on this page are backup-based. They need a backup policy π_b that keeps a terminal set S_0 invariant and can bring a neighbourhood of S_0 back into S_0 within a horizon T_B [arxiv:2604.02401 §II-A]. All three share one check: follow the nominal policy for a switch time T_S, then the backup for T_B. The candidate is valid if it stays in C over the whole interval and ends in S_0 2604.02401 §IV-A eq. 11. The variants differ in how they use this check. They come from one source, the review Backup-Based Safety Filters, which puts them in one notation. The later control variants come from their own papers and are not compared with the backup-based ones on the same task.

The same words name a different idea in generative models: a filter that steers sampling away from unwanted content rather than the state of a machine. It is covered in its own section at the end of this page 2211.05105 §3.

Variants

The variants in this section are control filters. Content filters are in the section below.

Backup CBF

The safe set is not written by hand. It is the recoverable set of the backup over [0, T_B]: states that stay in C and reach S_0 by time T_B [arxiv:2604.02401 §III] eq. 6. The paper cites a result from the literature. If S_0 is forward invariant under the backup, this set is controlled invariant and lies between S_0 and C 2604.02401 §III-A.

The filter does not switch to the backup. Each step it solves a quadratic program that changes the nominal input as little as possible, subject to barrier constraints on the backup path over [t, t+T_B] and at the terminal set 2604.02401 §III eq. 10a eq. 10b eq. 10c. The path constraints are checked at finitely many collocation times 2604.02401 §III-B. The class-K gain is not specified 2604.02401 §III-B. The card is Backup-Based Safety Filters.

Model predictive shielding (MPS)

MPS checks one switch time per monitor update, T_S = Δt [arxiv:2604.02401 §IV-B] eq. 12. If the candidate is valid, it applies the nominal input. Otherwise it applies the backup input at the current state [arxiv:2604.02401 §IV] eq. 13. Its filter-inactive set is the set of states valid at T_S = Δt 2604.02401 eq. 14. The paper says this matches the original recovery check, written in its notation 2604.02401 §IV-B. The procedure is in Algorithm 1 2604.02401 alg. 1.

Gatekeeper

Gatekeeper uses the same candidate and check, but treats the switch time as a decision. It takes the largest valid T_S in [0, T_H] 2604.02401 §V eq. 15. It applies the nominal input when that time is positive and the backup input when it is zero 2604.02401 eq. 16. In practice it searches a grid with step Δt, from T_H = N_H·Δt down 2604.02401 §V-C eq. 18. The search stops at the first valid candidate [arxiv:2604.02401 alg. 2]. The candidates are independent, so they can be evaluated in parallel with the same result 2604.02401 §V-C. Between checks, a positive certificate counts down by Δt instead of being searched again [arxiv:2604.02401 alg. 2].

How the three relate

MPS is a special case of gatekeeper. For 0 < Δt ≤ T_H, every state MPS accepts is also accepted by gatekeeper 2604.02401 §VI-A eq. 19. The part of the Backup CBF inactive set that lies in the relative interior of the implicit safe set is contained in gatekeeper's inactive set [arxiv:2604.02401 §VI-B] eq. 21. The paper does not claim the full inclusion, because boundary points may have no positive nominal hold time 2604.02401 §VI-B.

Backup CBF and MPS both judge safety through the backup maneuver, not through a continued safe run of the nominal policy. The paper says this can make them give up the nominal controller when it would have been safe [arxiv:2604.02401 §V-A]. Gatekeeper's stated limit is its dependence on T_H. All three inherit conservatism from the backup policy and the model 2604.02401 §VI-C tab. 1.

Learned value-function filter (OCR)

This filter has no backup. A network predicts a Hamilton-Jacobi safety value and its spatial gradient from a LiDAR scan, a disturbance bound and the relative state 2412.09989 §V-A.3. It is trained by regression on a reachability solver's output, over 1,000 random environments [arxiv:2412.09989 §V-A.2]. The paper reports about 8 hours on one GPU 2412.09989 §V-A.3. Its output is then calibrated with a split-conformal bound. This gives a probabilistic guarantee on the validation distribution, and the authors say it does not carry over under distribution shift 2412.09989 §V-A.4 eq. 11 eq. 12 §VIII.

At run time the disturbance bound comes from the gap between measured and predicted state over a 2 s window 2412.09989 §V-B.1 eq. 13 eq. 14. When the calibrated value is above the threshold δ, the nominal twist passes through. Otherwise a QP picks the twist closest to the nominal one, under a worst-case margin from the disturbance bound, with a slack weighted by 10^3 2412.09989 §V-B.2 eq. 15 eq. 16. The filter needs only a twist command, so the paper pairs it with three planners and three low-level policies 2412.09989 §III §VI-A. The card is One Filter to Deploy Them All.

Geometric check (LiCS)

This is a rule, not an optimisation. The robot is a rectangle. A straight motion is flagged if an obstacle point lies ahead or behind the robot within half its height 2406.14947 §II-C eq. 6. A turning motion is flagged if a point falls in the swept annulus between an inner and an outer radius 2406.14947 §II-C eq. 7 eq. 8. A flagged motion may be slowed, turned in place, or stopped. The paper calls these recovery actions handcrafted and does not say which one applies when 2406.14947 §II-C. The check runs on hardware only 2406.14947 §IV-D, and the paper does not state a guarantee for it. The card is LiCS: Navigation using Learned-imitation on Cluttered Space. Its main contribution is an imitation policy, so only the check is relevant here.

Speed-capping layer (InterFuser)

This is a safety controller, not a filter in the set-based sense above. The paper's driving model predicts waypoints, a 20x20 object density map and traffic-rule outputs. A separate safety controller reads the map and the traffic outputs and picks a desired speed 2207.14024 §3.3. In the paper this is a linear programme. It maximises the speed for the first step, subject to distance limits on the predicted route at 0.5 s and 1 s, and to speed and acceleration limits 2207.14024 app. B. A red light or a stop sign triggers an emergency stop 2207.14024 §3.3. The layer sets a speed on every step rather than switching in when a state leaves a safe set. The authors report that removing it lowers the driving and infraction scores 2207.14024 §4.3 tab. 3. All results are from the CARLA simulator, and the authors' own. The card is Safety-Enhanced Autonomous Driving Using Interpretable Sensor Fusion Transformer. Its released controller is a fixed-formula heuristic with extra red-light and stall rules; see the card's Paper vs code section before reimplementing.

When to use which

The paper compares the three filters only in simulation: a reach-avoid scenario and a highway overtake, with five trials each. Hardware is not stated 2604.02401 §VII tab. 2. The timings below are author-reported averages.

Table 2 also reports that Backup CBF and MPS repeatedly retreated and failed to reach the goal in reach-avoid, while gatekeeper reached it [arxiv:2604.02401 §VII-B] fig. 3. In the highway case, the text says they triggered a lane change although the nominal lane was clear 2604.02401 §VII-C fig. 4. Both results come from one simulated setup each.

Implementation sketch

Language-agnostic outline of the shared check and the decision rules of the backup-based filters, then the learned filter. The paper gives no explicit terminal set S_0 or barrier functions for its experiments [arxiv:2604.02401 §VII], so you must design them. Check the exact constraints in the paper's equations before you implement Backup CBF.

# Shared check: candidate is nominal for T_S, then backup  [arxiv:2604.02401 §IV-A]
# Input:  state (x); nominal policy (pi_nom); backup policy (pi_b)
#         switch time (T_S); backup horizon (T_B)
# Output: True if the candidate stays in C and ends in S_0

def is_valid(x, T_S, pi_nom, pi_b, T_B):
    # Roll out nominal for T_S, then backup for T_B  [§IV-A]
    path = rollout(x, pi_nom, T_S, pi_b, T_B)
    # Valid: every state in C, and the end in S_0  [eq. 11]
    return all_in_C(path) and ends_in_S0(path)

# MPS: one check per monitor update  [arxiv:2604.02401 §IV] [eq. 13]
# Input:  state (x); monitor interval (dt)

def mps_input(x, dt, pi_nom, pi_b, T_B):
    # Valid candidate at T_S = dt: keep nominal  [eq. 12]
    if is_valid(x, dt, pi_nom, pi_b, T_B):
        return pi_nom(x)
    return pi_b(x)

# Gatekeeper: largest valid switch time on the grid  [arxiv:2604.02401 §V] [eq. 15-16]
# Input:  state (x); search horizon (T_H); grid step (dt)

def gatekeeper_input(x, T_H, dt, pi_nom, pi_b, T_B):
    # Search from the longest switch time downwards  [eq. 18] [alg. 2]
    for T_S in grid_descending(T_H, dt):   # ends at 0
        if is_valid(x, T_S, pi_nom, pi_b, T_B):
            # Positive T_S*: nominal input; zero: backup  [eq. 16]
            return pi_nom(x) if T_S > 0 else pi_b(x)
    return pi_b(x)

# Learned value filter: decision rule  [arxiv:2412.09989 §V-B.2] [eq. 15] [eq. 16]
# Input:  state (x); LiDAR scan (s); disturbance bound (d);
#         nominal twist (u_nom); calibrated level (delta)
# Output: filtered twist (v, w)

def value_filter(x, s, d, u_nom, delta, value_net):
    # Predicted value and spatial gradient  [§V-A.3]
    value, grad = value_net(x, s, d)
    # Outside the boundary: nominal twist unchanged  [eq. 15]
    if value > delta:
        return u_nom
    # Twist closest to nominal, with worst-case margin  [eq. 16]
    # Slack weighted by 10^3  [§V-B.2]
    # The paper gives no fallback if the QP fails
    return solve_qp(u_nom, grad, d, slack_weight=1e3)

Content filters for generative models

Here the filter does not keep a machine in a safe set. It steers a generative model during sampling so that unwanted content is less likely in the output 2211.05105 §1 §3. The one source is safe latent diffusion (SLD). It needs no retraining and no external classifier 2211.05105 §1 §3.

Safe latent diffusion (SLD)

The unwanted content is described in plain text, such as a list of harmful categories 2211.05105 §4. At each step the sampler forms three noise estimates: unconditional, prompt and unwanted concept. It moves the prompt estimate away from the concept estimate, through a term added to classifier-free guidance 2211.05105 §3 eq. 3 eq. 4. The term is switched off where the prompt estimate already exceeds the concept estimate by at least a threshold λ 2211.05105 eq. 5. A warm-up delays it, and a momentum term accumulates it over steps 2211.05105 §3 eq. 7 eq. 8. The full loop is Algorithm 1 2211.05105 alg. 1. Card: Safe Latent Diffusion.

Author-reported results on the I2P benchmark of 4703 prompts, with Stable Diffusion v1.4 and 10 images per prompt: the probability of an inappropriate image falls from 0.39 to 0.09 at the strongest setting. Negative prompting reaches 0.18 and the weakest SLD setting 0.29 2211.05105 tab. 2. The price is image quality: FID on COCO rises from 14.43 to 18.76 at the same setting 2211.05105 tab. 3. Image-text alignment in a user study stays close to the baseline 2211.05105 tab. 3.

When to use SLD

Limits the paper states: bias is reduced, not removed. A correlation of r = 0.52 remains between country-level nudity rates with and without SLD 2211.05105 §6. An image counts as inappropriate if Q16 or NudeNet flags it, and NudeNet flags exposed genitalia only, so the results do not cover suggestive content 2211.05105 app. D. The authors ask that any deployment say which content is suppressed, since the same mechanism can serve censorship 2211.05105 §7.

Contradictions

The two senses of "safety filter" do not disagree. They name different mechanisms: one keeps a state in a set, the other steers a sampler.

The control papers do not test the same systems, so their success numbers cannot be compared. The review uses a double integrator and a car in simulation 2604.02401 §VII. OCR uses a quadruped in simulation and on hardware 2412.09989 §VI §VII. The geometric check is described for a wheeled robot 2406.14947 §II. InterFuser's layer is evaluated only in CARLA 2207.14024 tab. 3, and its scores are driving scores, not success rates, so they cannot be set against the others.

The paper's speed limit and the released config also differ. The paper's v_max is 6.5 2207.14024 app. B, while the released config sets 5 (see the card's Paper vs code section). The released controller also adds rules the paper does not describe. Pick the paper's programme or the released heuristic, and say which.

The review's own results rest on simulation and are not checked on hardware 2604.02401 §VII.

Within OCR, the paper and its released hardware config disagree on the switching threshold and on the disturbance window. The paper switches to the QP when the uncalibrated output is at most δ = 0.49 m [arxiv:2412.09989 §V-B.2] eq. 15. The config switches when the calibrated value is below 0.35, which is about 0.85 in raw network units (card, Paper vs code). The paper uses a 2 s window 2412.09989 §V-B.1. The config uses 10 s (card, Paper vs code). Pick one knowingly.

The review's theorems do not match its public code in every detail. The code's default search step is 5Δt, not Δt, and its validity check looks at collisions only (card, Paper vs code). The code's candidates therefore do not always include T_S = Δt, so the inclusion in 2604.02401 eq. 19 is not guaranteed for the code as run. Implementers should follow the paper's definitions or document the change.

Within SLD, the paper's equation for the scale μ gives a value of at least 1, while its text says the scale is clipped 2211.05105 §3 eq. 5. The released code clips it (card, Paper vs code). Pick one knowingly.

Papers

• Comparative review of backup-based safety filters (2026): a review, not a new method. It puts Backup CBF, MPS and gatekeeper in one framework, and proves MPS is a special case of gatekeeper.
• One Filter to Deploy Them All (2024): a learned, conformally calibrated reachability value function drives a QP filter on a quadruped. In simulation it is paired with three planners and three low-level policies.
• LiCS: Navigation using Learned-imitation on Cluttered Space (2024): a handcrafted geometric check on a wheeled robot's motion commands, used on hardware. The main contribution is an imitation policy; only the check is covered here.
• Safety-Enhanced Autonomous Driving Using Interpretable Sensor Fusion Transformer (2022): a driving model whose separate safety controller caps speed from a predicted object map. The paper's controller is a linear programme; the released one is a heuristic.
• Safe Latent Diffusion: Mitigating Inappropriate Degeneration in Diffusion Models (2022): the content-filter sense. Steers Stable Diffusion's sampling away from a text-defined unsafe concept with a safety term added to classifier-free guidance.