--- kind: concept slug: safety-filter title: Safety filter summary: >- A safety filter overrides a nominal controller only when needed to keep the system in a safe set. Backup-based filters are compared in a 2026 review, which finds gatekeeper keeps the nominal controller most often, in simulation only. A learned value-function filter is tested on a quadruped. A driving model's speed-capping layer is also covered. The term also covers diffusion content filters. tags: [safety, control, safety-filter, diffusion, reachability] papers: ["2207.14024", "2211.05105", "2406.14947", "2412.09989", "2604.02401"] related: [control-barrier-function, model-predictive-control, hamilton-jacobi-reachability, conformal-prediction, imitation-learning, classifier-free-guidance, text-to-image-generation] status: draft updated_at: 2026-11-01 --- ## Overview A safety filter sits between a nominal controller and the actuators. It passes the nominal input through while the state stays safe, and replaces it when it would not [arxiv:2604.02401 §II-B]. The goal is to keep the state inside a safe set C for all times, from every start in a set D inside C, even though the nominal controller alone gives no such guarantee [arxiv:2604.02401 §II-B]. The states where the filter returns the nominal input unchanged form its filter-inactive set [arxiv:2604.02401 eq. 5]. The first three control variants on this page are backup-based. They need a backup policy π_b that keeps a terminal set S_0 invariant and can bring a neighbourhood of S_0 back into S_0 within a horizon T_B [arxiv:2604.02401 §II-A]. All three share one check: follow the nominal policy for a switch time T_S, then the backup for T_B. The candidate is valid if it stays in C over the whole interval and ends in S_0 [arxiv:2604.02401 §IV-A] [eq. 11]. The variants differ in how they use this check. They come from one source, the review [Backup-Based Safety Filters](/papers/2604.02401), which puts them in one notation. The later control variants come from their own papers and are not compared with the backup-based ones on the same task. The same words name a different idea in generative models: a filter that steers sampling away from unwanted content rather than the state of a machine. It is covered in its own section at the end of this page [arxiv:2211.05105 §3]. ## Variants The variants in this section are control filters. Content filters are in [the section below](#content-filters-for-generative-models). ### Backup CBF The safe set is not written by hand. It is the recoverable set of the backup over [0, T_B]: states that stay in C and reach S_0 by time T_B [arxiv:2604.02401 §III] [eq. 6]. The paper cites a result from the literature. If S_0 is forward invariant under the backup, this set is controlled invariant and lies between S_0 and C [arxiv:2604.02401 §III-A]. The filter does not switch to the backup. Each step it solves a quadratic program that changes the nominal input as little as possible, subject to barrier constraints on the backup path over [t, t+T_B] and at the terminal set [arxiv:2604.02401 §III] [eq. 10a] [eq. 10b] [eq. 10c]. The path constraints are checked at finitely many collocation times [arxiv:2604.02401 §III-B]. The class-K gain is not specified [arxiv:2604.02401 §III-B]. The card is [Backup-Based Safety Filters](/papers/2604.02401). ### Model predictive shielding (MPS) MPS checks one switch time per monitor update, T_S = Δt [arxiv:2604.02401 §IV-B] [eq. 12]. If the candidate is valid, it applies the nominal input. Otherwise it applies the backup input at the current state [arxiv:2604.02401 §IV] [eq. 13]. Its filter-inactive set is the set of states valid at T_S = Δt [arxiv:2604.02401 eq. 14]. The paper says this matches the original recovery check, written in its notation [arxiv:2604.02401 §IV-B]. The procedure is in Algorithm 1 [arxiv:2604.02401 alg. 1]. ### Gatekeeper Gatekeeper uses the same candidate and check, but treats the switch time as a decision. It takes the largest valid T_S in [0, T_H] [arxiv:2604.02401 §V] [eq. 15]. It applies the nominal input when that time is positive and the backup input when it is zero [arxiv:2604.02401 eq. 16]. In practice it searches a grid with step Δt, from T_H = N_H·Δt down [arxiv:2604.02401 §V-C] [eq. 18]. The search stops at the first valid candidate [arxiv:2604.02401 alg. 2]. The candidates are independent, so they can be evaluated in parallel with the same result [arxiv:2604.02401 §V-C]. Between checks, a positive certificate counts down by Δt instead of being searched again [arxiv:2604.02401 alg. 2]. ### How the three relate MPS is a special case of gatekeeper. For 0 < Δt ≤ T_H, every state MPS accepts is also accepted by gatekeeper [arxiv:2604.02401 §VI-A] [eq. 19]. The part of the Backup CBF inactive set that lies in the relative interior of the implicit safe set is contained in gatekeeper's inactive set [arxiv:2604.02401 §VI-B] [eq. 21]. The paper does not claim the full inclusion, because boundary points may have no positive nominal hold time [arxiv:2604.02401 §VI-B]. Backup CBF and MPS both judge safety through the backup maneuver, not through a continued safe run of the nominal policy. The paper says this can make them give up the nominal controller when it would have been safe [arxiv:2604.02401 §V-A]. Gatekeeper's stated limit is its dependence on T_H. All three inherit conservatism from the backup policy and the model [arxiv:2604.02401 §VI-C] [tab. 1]. ### Learned value-function filter (OCR) This filter has no backup. A network predicts a Hamilton-Jacobi safety value and its spatial gradient from a LiDAR scan, a disturbance bound and the relative state [arxiv:2412.09989 §V-A.3]. It is trained by regression on a reachability solver's output, over 1,000 random environments [arxiv:2412.09989 §V-A.2]. The paper reports about 8 hours on one GPU [arxiv:2412.09989 §V-A.3]. Its output is then calibrated with a split-conformal bound. This gives a probabilistic guarantee on the validation distribution, and the authors say it does not carry over under distribution shift [arxiv:2412.09989 §V-A.4] [eq. 11] [eq. 12] [§VIII]. At run time the disturbance bound comes from the gap between measured and predicted state over a 2 s window [arxiv:2412.09989 §V-B.1] [eq. 13] [eq. 14]. When the calibrated value is above the threshold δ, the nominal twist passes through. Otherwise a QP picks the twist closest to the nominal one, under a worst-case margin from the disturbance bound, with a slack weighted by 10^3 [arxiv:2412.09989 §V-B.2] [eq. 15] [eq. 16]. The filter needs only a twist command, so the paper pairs it with three planners and three low-level policies [arxiv:2412.09989 §III] [§VI-A]. The card is [One Filter to Deploy Them All](/papers/2412.09989). ### Geometric check (LiCS) This is a rule, not an optimisation. The robot is a rectangle. A straight motion is flagged if an obstacle point lies ahead or behind the robot within half its height [arxiv:2406.14947 §II-C] [eq. 6]. A turning motion is flagged if a point falls in the swept annulus between an inner and an outer radius [arxiv:2406.14947 §II-C] [eq. 7] [eq. 8]. A flagged motion may be slowed, turned in place, or stopped. The paper calls these recovery actions handcrafted and does not say which one applies when [arxiv:2406.14947 §II-C]. The check runs on hardware only [arxiv:2406.14947 §IV-D], and the paper does not state a guarantee for it. The card is [LiCS: Navigation using Learned-imitation on Cluttered Space](/papers/2406.14947). Its main contribution is an imitation policy, so only the check is relevant here. ### Speed-capping layer (InterFuser) This is a safety controller, not a filter in the set-based sense above. The paper's driving model predicts waypoints, a 20x20 object density map and traffic-rule outputs. A separate safety controller reads the map and the traffic outputs and picks a desired speed [arxiv:2207.14024 §3.3]. In the paper this is a linear programme. It maximises the speed for the first step, subject to distance limits on the predicted route at 0.5 s and 1 s, and to speed and acceleration limits [arxiv:2207.14024 app. B]. A red light or a stop sign triggers an emergency stop [arxiv:2207.14024 §3.3]. The layer sets a speed on every step rather than switching in when a state leaves a safe set. The authors report that removing it lowers the driving and infraction scores [arxiv:2207.14024 §4.3] [tab. 3]. All results are from the CARLA simulator, and the authors' own. The card is [Safety-Enhanced Autonomous Driving Using Interpretable Sensor Fusion Transformer](/papers/2207.14024). Its released controller is a fixed-formula heuristic with extra red-light and stall rules; see the card's Paper vs code section before reimplementing. ## When to use which The paper compares the three filters only in simulation: a reach-avoid scenario and a highway overtake, with five trials each. Hardware is not stated [arxiv:2604.02401 §VII] [tab. 2]. The timings below are author-reported averages. | Situation | Use | Why | |---|---|---| | You want a filter that edits the nominal input continuously, and you can solve a QP online | Backup CBF | It is the only variant that solves a QP with barrier constraints [arxiv:2604.02401 §III] [eq. 10a]. It was the slowest in highway overtake, at 27.90 ms on average [arxiv:2604.02401 tab. 2]. | | You want the nominal controller kept on as many steps as possible, and you can afford a search over switch times | Gatekeeper | It kept the nominal input on 87.5% of reach-avoid steps and 100% of highway steps, against 55.3% and 67.5% for MPS and 28.8% and 60.8% for Backup CBF [arxiv:2604.02401 tab. 2]. Each candidate needs its own backup rollout [arxiv:2604.02401 §IV-A] [§V-C]. | | You have a tight per-step budget and accept fewer nominal steps | MPS | It evaluates one candidate per update [arxiv:2604.02401 eq. 12]. Its average was 1.31 ms in reach-avoid and 2.64 ms in highway overtake [arxiv:2604.02401 tab. 2]. | | Gatekeeper's cost is too high, but you want its closed-loop behaviour | Parallel gatekeeper | The paper reports the same closed-loop behaviour with lower average time: 1.30 ms and 2.97 ms [arxiv:2604.02401 §V-C] [tab. 2]. These are timings only, on unstated hardware. | | You can only afford a short search horizon or a coarse grid | MPS, or expect gatekeeper to act like it | Gatekeeper behaves close to MPS when T_H is short or the grid is coarse [arxiv:2604.02401 §VI-C]. | | No backup policy can reach S_0 within T_B from the states you care about | Not stated | Every variant needs this recoverable set [arxiv:2604.02401 §II-A]. The paper gives no rule for this case [arxiv:2604.02401 §VI-C]. | | You can collect reachability ground truth and train offline, and you need a filter that works with several nominal planners | Learned value-function filter (OCR) | It needs no backup policy. In simulation it gave 0.91 success on ABS-Agile, against 0.80 for ABS and 0.75 with no filter [arxiv:2412.09989 tab. III]. Training and calibration cost time, and the paper reports about 8 hours on one GPU [arxiv:2412.09989 §V-A.3]. | | Your task needs high speed, and the filter cannot cost much of it | Measure the speed loss on your task before choosing OCR | In the same hard simulation, the mean speed of ABS-Agile fell from 2.10 to 1.22 m/s with OCR [arxiv:2412.09989 tab. III]. | | You have a 2D LiDAR and a known robot footprint, and a rule-based check is enough | Geometric check (LiCS) | It is a fixed test on the scan and the command [arxiv:2406.14947 eq. 6] [eq. 7] [eq. 8]. The paper gives no timing and no guarantee for it, and its recovery action is not specified [arxiv:2406.14947 §II-C]. Its simulation results do not say whether the check was on [arxiv:2406.14947 §IV-D]. | | You have a learned driving policy that predicts an object map, and you want a speed bound taken from that map on top of it | Speed-capping layer (InterFuser) | The paper's layer is a linear programme over the predicted route, with speed and acceleration limits [arxiv:2207.14024 app. B]. Its effect is reported only in CARLA simulation: without it the Town05 Long driving score falls from 51.6 to 43.9 [arxiv:2207.14024 tab. 3]. The released controller is a heuristic, so write the paper's programme yourself if you need its behaviour [arxiv:2207.14024 app. B]. | Table 2 also reports that Backup CBF and MPS repeatedly retreated and failed to reach the goal in reach-avoid, while gatekeeper reached it [arxiv:2604.02401 §VII-B] [fig. 3]. In the highway case, the text says they triggered a lane change although the nominal lane was clear [arxiv:2604.02401 §VII-C] [fig. 4]. Both results come from one simulated setup each. ## Implementation sketch Language-agnostic outline of the shared check and the decision rules of the backup-based filters, then the learned filter. The paper gives no explicit terminal set S_0 or barrier functions for its experiments [arxiv:2604.02401 §VII], so you must design them. Check the exact constraints in the paper's equations before you implement Backup CBF. ```pseudocode # Shared check: candidate is nominal for T_S, then backup [arxiv:2604.02401 §IV-A] # Input: state (x); nominal policy (pi_nom); backup policy (pi_b) # switch time (T_S); backup horizon (T_B) # Output: True if the candidate stays in C and ends in S_0 def is_valid(x, T_S, pi_nom, pi_b, T_B): # Roll out nominal for T_S, then backup for T_B [§IV-A] path = rollout(x, pi_nom, T_S, pi_b, T_B) # Valid: every state in C, and the end in S_0 [eq. 11] return all_in_C(path) and ends_in_S0(path) ``` ```pseudocode # MPS: one check per monitor update [arxiv:2604.02401 §IV] [eq. 13] # Input: state (x); monitor interval (dt) def mps_input(x, dt, pi_nom, pi_b, T_B): # Valid candidate at T_S = dt: keep nominal [eq. 12] if is_valid(x, dt, pi_nom, pi_b, T_B): return pi_nom(x) return pi_b(x) ``` ```pseudocode # Gatekeeper: largest valid switch time on the grid [arxiv:2604.02401 §V] [eq. 15-16] # Input: state (x); search horizon (T_H); grid step (dt) def gatekeeper_input(x, T_H, dt, pi_nom, pi_b, T_B): # Search from the longest switch time downwards [eq. 18] [alg. 2] for T_S in grid_descending(T_H, dt): # ends at 0 if is_valid(x, T_S, pi_nom, pi_b, T_B): # Positive T_S*: nominal input; zero: backup [eq. 16] return pi_nom(x) if T_S > 0 else pi_b(x) return pi_b(x) ``` ```pseudocode # Learned value filter: decision rule [arxiv:2412.09989 §V-B.2] [eq. 15] [eq. 16] # Input: state (x); LiDAR scan (s); disturbance bound (d); # nominal twist (u_nom); calibrated level (delta) # Output: filtered twist (v, w) def value_filter(x, s, d, u_nom, delta, value_net): # Predicted value and spatial gradient [§V-A.3] value, grad = value_net(x, s, d) # Outside the boundary: nominal twist unchanged [eq. 15] if value > delta: return u_nom # Twist closest to nominal, with worst-case margin [eq. 16] # Slack weighted by 10^3 [§V-B.2] # The paper gives no fallback if the QP fails return solve_qp(u_nom, grad, d, slack_weight=1e3) ``` ## Content filters for generative models Here the filter does not keep a machine in a safe set. It steers a generative model during sampling so that unwanted content is less likely in the output [arxiv:2211.05105 §1] [§3]. The one source is safe latent diffusion (SLD). It needs no retraining and no external classifier [arxiv:2211.05105 §1] [§3]. ### Safe latent diffusion (SLD) The unwanted content is described in plain text, such as a list of harmful categories [arxiv:2211.05105 §4]. At each step the sampler forms three noise estimates: unconditional, prompt and unwanted concept. It moves the prompt estimate away from the concept estimate, through a term added to classifier-free guidance [arxiv:2211.05105 §3] [eq. 3] [eq. 4]. The term is switched off where the prompt estimate already exceeds the concept estimate by at least a threshold λ [arxiv:2211.05105 eq. 5]. A warm-up delays it, and a momentum term accumulates it over steps [arxiv:2211.05105 §3] [eq. 7] [eq. 8]. The full loop is Algorithm 1 [arxiv:2211.05105 alg. 1]. Card: [Safe Latent Diffusion](/papers/2211.05105). Author-reported results on the I2P benchmark of 4703 prompts, with Stable Diffusion v1.4 and 10 images per prompt: the probability of an inappropriate image falls from 0.39 to 0.09 at the strongest setting. Negative prompting reaches 0.18 and the weakest SLD setting 0.29 [arxiv:2211.05105 tab. 2]. The price is image quality: FID on COCO rises from 14.43 to 18.76 at the same setting [arxiv:2211.05105 tab. 3]. Image-text alignment in a user study stays close to the baseline [arxiv:2211.05105 tab. 3]. ### When to use SLD | Situation | Use | Why | |---|---|---| | You cannot retrain a latent diffusion model, and you control its sampler | SLD | It acts during sampling and changes no weights [arxiv:2211.05105 §1] [§3]. The authors state it applies to any latent diffusion model that uses classifier-free guidance, but test only Stable Diffusion [arxiv:2211.05105 app. D]. | | You must withhold an image after it is generated | Not stated | The authors judge Stable Diffusion's built-in post-hoc classifier to have too high a false-positive rate for their editing [arxiv:2211.05105 app. D]. The paper does not test SLD together with a post-hoc classifier. | | You need a stronger effect and accept more drift from the prompt | Strong or Max setting | Strong gives 0.13 and Max 0.09 on I2P [arxiv:2211.05105 tab. 2]. Larger threshold and concept scale move the sample further from the prompt [arxiv:2211.05105 §3]. Max sets the threshold outside the recommended range [arxiv:2211.05105 tab. 1] [§4]. | | Your compute per step is tight | Plan for extra cost | SLD adds a third noise prediction per step [arxiv:2211.05105 eq. 3]. The paper reports no timing. | Limits the paper states: bias is reduced, not removed. A correlation of r = 0.52 remains between country-level nudity rates with and without SLD [arxiv:2211.05105 §6]. An image counts as inappropriate if Q16 or NudeNet flags it, and NudeNet flags exposed genitalia only, so the results do not cover suggestive content [arxiv:2211.05105 app. D]. The authors ask that any deployment say which content is suppressed, since the same mechanism can serve censorship [arxiv:2211.05105 §7]. ## Contradictions The two senses of "safety filter" do not disagree. They name different mechanisms: one keeps a state in a set, the other steers a sampler. The control papers do not test the same systems, so their success numbers cannot be compared. The review uses a double integrator and a car in simulation [arxiv:2604.02401 §VII]. OCR uses a quadruped in simulation and on hardware [arxiv:2412.09989 §VI] [§VII]. The geometric check is described for a wheeled robot [arxiv:2406.14947 §II]. InterFuser's layer is evaluated only in CARLA [arxiv:2207.14024 tab. 3], and its scores are driving scores, not success rates, so they cannot be set against the others. The paper's speed limit and the released config also differ. The paper's v_max is 6.5 [arxiv:2207.14024 app. B], while the released config sets 5 (see the card's Paper vs code section). The released controller also adds rules the paper does not describe. Pick the paper's programme or the released heuristic, and say which. The review's own results rest on simulation and are not checked on hardware [arxiv:2604.02401 §VII]. Within OCR, the paper and its released hardware config disagree on the switching threshold and on the disturbance window. The paper switches to the QP when the uncalibrated output is at most δ = 0.49 m [arxiv:2412.09989 §V-B.2] [eq. 15]. The config switches when the calibrated value is below 0.35, which is about 0.85 in raw network units ([card](/papers/2412.09989), Paper vs code). The paper uses a 2 s window [arxiv:2412.09989 §V-B.1]. The config uses 10 s ([card](/papers/2412.09989), Paper vs code). Pick one knowingly. The review's theorems do not match its public code in every detail. The code's default search step is 5Δt, not Δt, and its validity check looks at collisions only ([card](/papers/2604.02401), Paper vs code). The code's candidates therefore do not always include T_S = Δt, so the inclusion in [arxiv:2604.02401 eq. 19] is not guaranteed for the code as run. Implementers should follow the paper's definitions or document the change. Within SLD, the paper's equation for the scale μ gives a value of at least 1, while its text says the scale is clipped [arxiv:2211.05105 §3] [eq. 5]. The released code clips it ([card](/papers/2211.05105), Paper vs code). Pick one knowingly. ## Papers - [Comparative review of backup-based safety filters (2026)](/papers/2604.02401): a review, not a new method. It puts Backup CBF, MPS and gatekeeper in one framework, and proves MPS is a special case of gatekeeper. - [One Filter to Deploy Them All (2024)](/papers/2412.09989): a learned, conformally calibrated reachability value function drives a QP filter on a quadruped. In simulation it is paired with three planners and three low-level policies. - [LiCS: Navigation using Learned-imitation on Cluttered Space (2024)](/papers/2406.14947): a handcrafted geometric check on a wheeled robot's motion commands, used on hardware. The main contribution is an imitation policy; only the check is covered here. - [Safety-Enhanced Autonomous Driving Using Interpretable Sensor Fusion Transformer (2022)](/papers/2207.14024): a driving model whose separate safety controller caps speed from a predicted object map. The paper's controller is a linear programme; the released one is a heuristic. - [Safe Latent Diffusion: Mitigating Inappropriate Degeneration in Diffusion Models (2022)](/papers/2211.05105): the content-filter sense. Steers Stable Diffusion's sampling away from a text-defined unsafe concept with a safety term added to classifier-free guidance.