SafeDiffuser: Safe Planning with Diffusion Probabilistic Models
Authors: Wei Xiao
Tsun-Hsuan Wang
Chuang Gan
Ramin Hasani
Mathias Lechner
Daniela Rus
Venue: ICLR 2025 Poster (2025)
Keywords: Diffusion model
Safety guarantees
Planning and control
Primary area: generative models
TL;DR: We propose a new method to ensure diffusion probabilistic models satisfy specifications by using a control theoretic method

Abstract: Diffusion models have shown promise in data-driven planning. While these planners are commonly employed in applications where decisions are critical, they still lack established safety guarantees. In this paper, we address this limitation by introducing SafeDiffuser, a method to equip diffusion models with safety guarantees via control barrier functions. The key idea of our approach is to embed finite-time diffusion invariance, i.e., a form of specification consisting of safety constraints, into the denoising diffusion procedure. This way we enable data generation under safety constraints. We show that SafeDiffusers maintain the generative performance of diffusion models while also providing robustness in safe data generation. We evaluate our method on a series of tasks, including maze path generation, legged robot locomotion, and 3D space manipulation, and demonstrate the advantages of robustness over vanilla diffusion models.

Published as a conference paper at ICLR 2025
SAFEDIFFUSER: SAFE PLANNING WITH DIFFUSION PROBABILISTIC MODELS
Wei Xiao Tsun-Hsuan Wang', Chuang Gan", Ramin Hasani', Mathias Lechner', Daniela Rus'
Computer Science and Artificial Intelligence Lab, MIT, Cambridge, MA 02139, USA 2 UMass Amherst and MIT-IBM Watson Lab, USA we weixyemit: edu
ABSTRACT
Diffusion models have shown promise in data-driven planning. While these plan- ners are commonly employed in applications where decisions are critical, they still lack established safety guarantees. In this paper. address this limitation by in- troducing SafeDiffuser, method to equip diffusion models with safety guarantees via control barrier functions. The key idea of our approach is to embed finite-time diffusion invariance, i.c.. a form of specification consisting of safety constraints, into the denoising diffusion procedure. This way we enable data generation under safety constraints. We show that SafeDiffusers maintain the generative performance diffusion models while also providing robustness in safe data generation. We evaluate method a series of tasks, including maze path generation, legged robot locomotion, and 3D space manipulation, and demonstrate the advantages of robustness over vanilla diffusion models
INTRODUCTION
Without guarantees
Diffuser
PLR
Pa '
Diffusion models Sohl- Dickstein et al. (2015) Ho al. (2020) are a family of generative modeling ap- proaches that have enabled major breakthroughs in image synthesis Dhariwal & Nichol (2021) Du et al. (2020b) Saharia et al. (2022). Recently, diffusion models, termed diffusers Janner al. (2022), have shown promise in trajectory planning for variety of robotic tasks. Compared to existing planning methods, diffusion models (a) enable long-horizon plan- ning with multi multi-modal modal action distributions and stable training, (b) casily scale high-dimensional trajectory planning, and (c) offer flexiblity for behavior synthesis.
Ammneeting Noising
Safety oocificztions
Ie( Invariance
Noising
SafeDiffuser
With guarantees
Figure 1: Our proposed SafeDiffuser (lower) generates safe trajectories with guarantees, while the diffuser (upper) fails (from O to ().
During inference, the diffuser, conditioned on the current state and objectives, begins with Gaussian noise to generate clean planning trajectories. From these, control policy is derived. After applying this control policy for one step forward, a new state is obtained, and the diffusion procedure is renun to generate new planning trajectory. This process repeats until the objective is achieved.
Although these planners are primarily applied in safety-critical applications, no known safety guar- antees have been established for them. For instance, the planning trajectory could easily violate safety constraints the maze (as shown in Fig. 1). This shortcoming necessitates a fundamental im-
"Corresoonding to: Wei Xiao
Videos and code available https://ssaa faraddiffuuee ffuser.ueoomm github..tt..gg.g io/safed ffuser/

---

Published as a conference paper at ICLR 2025
provement to diffusion models, ensuring the safe generation of planning trajectories in safety-criticn applications, such as trustworthy policy learning Xiao et al. (2023a).
In this paper, we propose equip diffusion models with specification guarantees using finite-time diffusion invariance (i.c., safety satisfaction within finite diffusion time for all planning times). An invariant set is a form of specification primarily consisting of safety constraints in planning tasks. We ensure that diffusion models are invariant to uncertainties concerning safety during the diffusion procedure. We achieve safety by combining receding horizon control (RHC) with diffusion models. In RHC, we compute safe paths incrementally. The key insight in this work is to replace traditional planning with diffusion based path generation, allowing a broader exploration of the path space and simplifies the incorporation of additional constraints. The computed path is integrated with simulation to ensure it can be safely executed.
To equip diffusers with specifications guarantees, we first find diffusion dynamics for the denoising diffusion procedure. Then, we use control barrier functions (CBFs) Ames et al. (2017) Glotfelter et al. (2017) Nguyen & Sreenath (2016) Xiao & Belta (2019), to formally guarantee the satisfaction of specifications. CBFs work well in planning time using robot dynamics. However, applying CBFs to diffusion models poses extra challenges since the generated data is not directly associated with robot dynamics. This makes the use of CBFs non-trivial. In contrast to existing literature, (i) we suggest embedding invariance directly into the diffusion time for diffusers. Thus, finite-time invariance is required in diffusers since specifications are usually violated as the trajectory is initially Gaussian noise. (ii) We propose add diffusion time components in invariance address local trap problems (i.e., trajectory points that get stuck at obstacle boundaries) that are prominent in planning. (iii) We present an optimization approach incorporate invariance into diffusion to maximally preserve the performance.
This paper contributes the following:
We introduce formal guarantees for diffusion probabilistic models via control-theoretic invariance.
We present novel notion of finite-time diffusion invariance, well using class of CBFs to incorporate it into the diffusion. We propose three different safe diffusers, and show how we may address the local trap problem from specifications that are prominent in planning tasks.
We demonstrate the effectiveness of our method on variety of planning tasks using diffusion, including safe planning in maze, robot locomotion, and manipulation.
2 PRELIMINARIES
In this section, we provide background on diffusion models and forward invariance in control theory.
Diffusion Probabilistic Models. Diffusion probabilistic models Sohl-Dickstein et al. (2015); Ho et al. (2020); Janner al. (2022) are type of latent variable models. They describe the process of data generation as series of iterative denoising steps. Here, the model is represented as ( i E (1,....NY, where r! r!....,7' are latent variables mirroring the dimension of the original, noise- free data - ~ q(79), and N signifies the total number of denoising steps. This denoising sequence is essentially the inverse of a forward diffusion process denoted as q(T')>'-1) where the initial clean data is progressively degraded by adding noise. The process of generating data through denoising is expressed as Janner et al. (2022):
pe( po ( JNN
- -fp(TM) I (
(I)
In this equation, p(T~) represents a standard Gaussian prior distribution. The joint distribution
Pe (=(): is defined as a Markov chain with learned Gaussian transitions that commence at p(>*) Janner al. (2022). The optimization parameter 0 is achieved by minimizing the common variational bound on the negative log- log-likelihood of the reverse process, formalized as Janner et al. (2022):0* = argming E,0 log Pe Pe(+")] The forward diffusion process, denoted q(r')r'-1) is typically predefined. Conversely, the reverse process is frequently characterized as a Gaussian process, featuring mean and variance that vary depending on time.
Notations. For the sake of consistency, we keep our notations as that proposed in Janner et al. (2022) as follows: Here, two distinct 'times" are discussed: associated with the diffusion process and
2

---

Published as a conference paper at ICLR 2025
the other with the planning horizon. These are differentiated follows: superscripts (employing i when unspecified) indicate the diffusion time of trajectory or state, whereas subscripts (using k when unspecified) denote the planning time of a state within the trajectory. For instance, 7 refers to the trajectory at the initial denoising diffusion time step, which is a noiseless trajectory. In a similar vein, Th represents the state the 4 planning time step during the first denoising diffusion step, indicating noiseless state. When clarity permits, we simplify this notation to πą = of (and similarly T = -)). Moreover, a trajectory T is conceptualized as a sequence of states across planning time, articulated as T' (To- Ti...., Tz..... Tir), where H E N defines the planning horizon.
Forward Invariance in Control Theory. We consider an affine control system:
+ = f(x;) + g((z)),,
(2)
where æ, E f: denotes a control constraint set. d;; denotes the (planning) time derivative.
f: IR R"" and g: R - R= are locally Lipschitz, and u, U R2, where U
Consider a safety specification b(ar,) ) 2 for (2), where b IR" > R is continuously differentiable, we define a safe set: C:= ( E R² b(ar)) 2 0}.
Definition 2.1. (Control Barrier Function (CBF) Ames et al. (2017)): A function b IR" + R is a CBF if there exists extended class .X function a (strictly increasing and passing the origin) s.t.
sup [L,b((z))) + [Lab(x;)) aa(b(::;))))) ((b((a))) 20 ueU
for all x, E CC Where L,b(xx)= = db(x)) dx
fxx) and Lig((x)) = dbix:)
g(x)).
du
Theorem 2.2 (Ames et al. (2017)). Given CBF b(æx)) as in Def. 2.1, if wo E C, then any Lipschitz continuous controller u, that satisfies (3), Vi 2 0 renders forward invariant for (2), iee. b(x; 2 0, Vt.
If we need to differentiate b(x;,) more than once along the dynamics (2) until the control u, explicitly shows, we use high-order CBF Nguyen & Sreenath (2016) Xiao & Belta (2019) as general form of CBF to guarantee safety for (2). CBFs are usually used to transform nonlinear optimal control problems into convex optimizations. Time is usually discretized, and the inter-sampling effect is considered Ames et al. (2017). This discretization method matches with the diffusion procedure in which we have to generate data within each diffusion (discretized) time step. In this work, we map the forward invariance in control theory to finite time diffusion invariance in diffusion models, where we incorporate CBFs into the diffusion time. ! as opposed to their regular applications in planning time - In addition, we show how we may address the local traps (i.e., trajectory points getting stuck at obstacle boundaries) during diffusion.
SAFE DIFFUSER
In this section, we propose three different safe diffusers ensure the safe generation of data in diffusion, i.e., to ensure the satisfaction of specifications b(Tx) 2 0, 4k E H). Each of the proposed safe diffusers has its own flexibility, such as avoiding local traps planning. We consider discretized system states in the sequel. Safety in continuous planning time can be guaranteed using a lower hierarchical control framework employing other CBFs, as Ames al. (2017); Nguyen
Sreenath (2016); Xiao & Belta (2019).
In the denoising diffusion procedure, since the learned Gaussian transitions start at ((T)) ~ (O,, it is highly likely that specifications are initially violated, i.e., 3k E (0..... H) b((T)) < O. For safe data generation, we wish to have b(7!)) > O(i.c, b(T,) 0), vk E {O...,, H). Since the maximum denoising diffusion step N is limited, this needs to be guaranteed in a finite diffusion time step. Therefore, we propose the finite-tima diffusion invariance of the diffusion procedure as follows:
Definition 3.1. (Finite- time Diffusion Invariance) If there exists i (O.....NN) such that b b(T/) 2 0, E {O)....H..Vj < i, then denoising diffusion procedure pe pe(ri-((T)) E (I,...,N} with respect specification b(Tz)= 2 O, Vk E [I. finite-time diffusion invariant.
The above definition can be interpreted that if b(TT)
N 2 0,k E (O......H) H) (i.e., initial condition
is within the safe set), then we require b(T)) 2 0, Vi E (0. (O....,N) N) (i.e., the system is always in the
3

---

Published as a conference paper at ICLR 2025
safe set: similar to the forward invariance in Thm. 2.2); otherwise, require that b(T?)) 0, Vj E {O.....I].I (O.....N), where is a finite diffusion time, (i.e., the system converges to the safe set). The tnite-time diffusion invariance implies safety of generated outputs from diffusion models.
We also formally define the local trap problem for navigation planning problems as follows:
Definition 3.2. (Local trap) A local trap problem happens for the denoising diffusion procedure If there exists k E (o..... H) such that b( T(T)) = 0 and TT TX-1l| > 8, where 8 >> is some threshold.
In the following, general form the safe-diffuser (Sec. 3.1), and the other two (Sec. 3.2-3.3 are variants to address local traps in planning. We show their comparisons in Table and the choice principles at the end.
propose three methods for finite-time diffusion invariance. The first method is
The safe denoising diffusion procedure is consid- ered at every diffusion step. Following (1), sample T',j j E [O....,N N } follows the data distribution at the diffusion time j E (O,...,N-- 1} and it is given by:
Table 1: Comparison of RoS, ReS, and TVS diffusers. Items in the first row are short for Local-Trap Free (LTF), safety enforcing ap- proach (APPROACH), Dimension of Decision variable (DD), Hyper- Free (HPF).
~ ~l~po(TT) po(poo) p(T*)
πI
po ( "
MCTION LTF
APPROACI
DD
HPF
1=+1
(4)
ROBUST
RES
ROBUST
2H
V
The denoising diffusion dynamics are then given by:
TIME FUNCTION
T 7/11
lim A--0
(5)
AT
where + is the (diffusion) time derivative of T. At is a small enough diffusion time step length during implementations, and r/tl is available from the last diffusion step. Notably, enforce invariance along diffusion dynamics instead of robot dynamics (commonly in control theory). ). The diffusion models (1) could be in discrete Janner et al. (2022) continuous time (such those based on stochastic differentiable equations Song et al. (2020)). If the models are in discrete time, as the outputs of the model are bounded, the above diffusion dynamics are Lipschitz; Otherwise, the above model is also practically Lipschitz as long as the activation functions are Lipschitz (the stochastic components are practically sampled from bounded distributions). Further, the Lipschitz constant can be reduced using the sharing conditions Yang et al. (2023) in the diffusion time interval with large Lipschitz constants.
In order to impose finite-time diffusion invariance on the diffusion procedure, we wish to make diffusion dynamics (5) controllable. We reformulate (5) as
i+1 + AA
lim
(6)
At
where Aud is perturbation to the diffusion procedure in order to make the generated trajectory safe. The above equation corresponds to the system dynamies (2) (Aví the corresponding control). On the other hand, we wish to make Auf - 0 in order to maximally preserve the diffusion performance. For simplicity, we define the whole part as v', new control variable the same dimensionality as
T/. Equivalently, we wish v to stay close to r/-7/t1 in order to maximally preserve the performance of the diffusion model. The above model can be rewritten in terms of each state the trajectory T': + =V/, where of is the 4t component of v¹. Then, we can use the CBF method enforce the invariance of the diffusion.
We define the general form of SafeDiffuser as the following:
Definition 3.3 (SafeDiffuser). A denoising diffusion procedure (1) is defined to be a SafeDiffuser if the corresponding diffusion dynamics (6) satisfy the following certificate:
db(TT) dt!
vs (
20 (O...., (0.....
(7)
where he1 :R 1 R.
R are two relaxation terms that ensure the diffusion procedure is not overly constrained (e.g.. from the initial time T), and they are set to in default. Their exact forms corresponding to different SafeDiffusers are explicitly given in the following.
4

---

Published as a conference paper at ICLR 2025
3.1 ROBUST-SAFE (RoS) DIFFUSER
We first present the robust-safe Diffuser, and it has the following form to show the finite-time diffusion invariance (proof is given in Appendix A.I, recall H is the planning horizon, N is the diffusion step):
Theorem 3.4. Let the diffusion dynamics be defined as in (5) whose controllable form is defined
as (6). If the robust term Y: R + I is chosen such that 7(N,) E) 2 E)N,))- - b( )e EN .kk E
{O.....H) H and
M 2 0, (O,.....IIVV. NO,....N--I;;
(8)
1 ( E), correponds a linear class H function in CBF (3), then the diffusion procedure (T), {I......N} is finite-time diffusion invariant.
where h(v/(T/)= Ab(T!) dTp
In the above, (i) = 0, (z. x(N,E) corresponding to Def. 3.3. We show how to construct a constraint equation toward the satisfaction of safety (Def. 3.1), resulting in solving quadratic program (QP) in diffusion process as later shown in (13).
One possible issue in the robust-safe diffusion is that if b((z)) 2 O when j is close to the diffusion step N. then T. can never violate the specification after diffusion step j. The state Tद may get stuck at local traps from specifications during diffusion (see Fig. 6 of appendix), i.e., the intermediate generated sample fails to move toward In order to address this issue, propose relaxed-safe diffuser and a Llme-varying-ae -afe diffuser.
regime via diffusion due to safety constraints.
3.2 RELAXED- SAFE (RES) DIFFUSER
In order to address the local trap problems imposed by specifications during the denoising diffusion procedure, we propose a variation of the robust-safe diffuser. We define the diffusion dynamics and their controllable form as in (5) (6). The modified versions for CBFs are in the form:
db(T!), u/ ca(b(T))) wx( 2 0,k (0, (0...., H). (0, (O.....,N. NV (9) dr(
h(v ((1())
where o/ E R is a relaxation variable that is to be determined (later shown in equation 13). wx wx(/) 2 is diffusion time-varying weight the relaxation variable such that it decreases to 0 as - No. 0 < Nn < N - 1, and w = for all j < No (see details in C.I). When wx(() >> 0, the condition (9) is relaxed to reduce barrier from diffusion toward high likelihood; when it decreases to O, the condition becomes a hard constraint. The theorem below shows the finite-time diffusion invariance (proof is given in Appendix A.2):
Theorem 3.5. Let the diffusion dynamics be defined as in (5) whose controllable form is defined as in (6). the robust term y 2 R. is chosen such that 7(No, E) 2 Iy(No, 8) b( No
& )le eNo Vk
(0... 1O....,H,00 0 < No < N - 1 and there exists a time-varying wx(() with wx(i) = 0, vj < No s.
h(v (/(T) > 0, (O.... (O.....H.VVEE (0, NO....,N.II1
(10)
where h(v] -((TT)
db(T() vs + ((b(T)) y(No E)) wx (i) corresponds to a linear class
X function in CBF (3), then the diffusion procedure pe ( (O....,,N) is finite-tine mime diffu- sion invariant.
In the above, = h), (NNo. corresponding to Def. 3.3. Here, relaxation variable r with time-varying weight are introduced upon See. 3.1 soften safety constraints and avoid local traps with additional effort to solve for and to design w. This is implemented as QP later shown in (14).
3.3
TIME- VARYING- (TVS) DIFFUSER
As an alternative the relaxed-safe diffuser, we propose another safe diffuser called the time-varying- safe diffuser in this subsection. The proposed aim--varying-saff diffuser can also address the local trap issues induced by specifications.
5

---

Published as a conference paper at ICLR 2025
Algorithm 1 Enforcing invariance in diffusion models within a diffusion step
Input: the last trajectory of diffusion r/+1 at diffusion step j E (O,
Output: safe diffusion state -/
(a) Run diffusion procedure and sample as in (4) at step j and get T!.
(b) Find diffusion dynamics as in (5) (6).
if Robust-safe diffuser then
Formulate the QP (13), solve it and get wlt.
else if Relaxed-safe diffuser then
Define the time-varying weight w*(() in (9), formulate the QP (14), solve it and get w r! else
Design the time-varying function (g( in (11), formulate the QP (13), solve it and get w
end if
(c) Update dynamics (6) with va v and get ~ Finally, T s- -/"
In this case, we directly modify the specification b(Tz) by diffusion time-varying function
og : j + IR (as opposed to the last two safe diffusers with a constant robust term y(N,)) in the form:
b(Tz) (x) 2 0,k (O.....H).. E (O.....N),
(11)
where (J) is continuously differentiable, and is defined such that (N) S b(T)") and (0) 0.
Finally, we have the following theorem to show the finite-time diffusion invariance:
Theorem 3.6. Let the diffusion dynamics be defined as in (5) whose controllable form is defined
as (6). If there exist an extended class H function a and time-varying function og @+(j) where (N(N) S b((T²) and (0) = s.I.
h(v/lT ox(i)) 2 0, (O.....,HI.VI] Io.....N-II,,
(12)
where [()(
ov))) dbl v 0% O2( + ((((T()) oi), then the diffusion procedure
d
NO is finite-time diffusion invariant.
In the above, hj] (x) hx,()) o²()) corresponding to Def. 3.3. Here, we show an alternative to avoid local traps via a time-varying b Ge()) in contrast to Sec. 3.2 This is implemented similar to Sec. 3.1 with additional time-varying Gg later shown (13).
Principles of choosing the three SafeDiffusers. We first determine if the unsafe set defined by the safety constraint convex or not, and determine if there are any intersections between any two unsafe sets, well as determine if the union of those intersected unsafe sets is convex not. Then, we run the following algorithm to determine which one to choose: If all the unsafe sets are convex and the unions of intersected unsafe sets are convex (if they exist), which implies that there traps, then we choose the RoS diffuser; Else if we wish to have the freedom to choose nonlinear class X functions in designing. then choose the TVS diffuser; Otherwise, In cases where unsafe sets are hard to determine the convexity, we may simultaneously implement the above three SafeDiffusers they are computationally efficient (closed-form solutions are given later). Then, we can select the most desired trajectory (c.g., no local trap points) from them.
choose the ReS diffuser.
4 ENFORCING INVARIANCE IN DIFFUSER
We show how we may incorporate the three proposed methods into diffusion models. In this section, we propose cinimum-devvaaion quadratic program (QP) approach to achieve that. We wish to enforce these conditions at every step of the diffusion those states that are far from the specification boundaries can also be optimized accordingly, and thus, the model may generate coherent trajectories.
Enforcing Invariance for RoS and TVS Diffusers. During implementation, the diffusion time step length AT in (5) is chosen to be small enough, and we wish the control v' to stay close to the right-hand side of (5). Thus, we can formulate the following QP-based optimization to find the optimal control for v that satisfies the condition in Thms. 3.4 or 3.6:
T¹ - - 112
w arg min | wi
s.t., (8) if RoS diffuser else s.t., (12),
(13)
AT

---

Published as a conference paper at ICLR 2025
S
SA
Maze planning (blue red) denoising diffusion procedure with ReS diffuser in narrow setting. Left to right: diffusion time steps 256, 5, 3, 0, respectively. Red areas denote unsafe regions. The proposed ReS diffuser can guarantee safety at the end of diffusion.
Figure 2:
Table 2: Maze planning comparisons. Items are short for minimum metrics of satisfaction of simple specifications (S-SPEC) and complex specifications (C-SPEC), score of planning tasks (SCORE), computation time at each diffusion step (TIME) in seconds, and negative log likelihood (NLL), respectively. In the method column, items are short for Truncate (Trunc.), Classifier- Classifier-guidance guidance (CG), Invariant neural ODE (InvODE), relaxed-safe diffuser with last step invariance (RES-DIFFUSER- 110), respectively. The CG-& & method applies (safe) gradient when the state is & > 0 close to the boundary. The TRAP RATE r denotes the trap rate with the number of trapped trajectory points 2 r.
METHOD
S-SPEC(t 2 0)
C-SPEC(T & 2200)
SCORE (f)
TIME
NLL
TRAP RATE 1
TRAP RATE
DIFFUSER JANNER ET AL. (2022)
-0.983
-0.894
1.598+0.112
0.006
4.501 +-0.455
AL. (2016)
-.1922
-0,759
1.277
4.494:10.465
CG DHARIWAL & NICHOL (2021)
-0.789
-0.979
0. 0.384400020
0.053
6.962++00 350
CG DHARIWAL NICHOL (2021)
-0.553
-0.995
6.975:10.343
INVODE XIAO (2023B)
14,000
1.657e
-0.025:1.0000
0.018
RoS DIFFUSER (OURS)
0.010
0.010
1.519
0.106
4.584.1.0.66 0..66
100%
100%:
ROS-D DIFFUSER-CF (OURS)
0,010
0,010
1.536:10.306
0.007
4.481 298
100%
1005
RES-DIFUSER (OURS)
0.010
0.010
1.557=0,289
0.107
4,434
46%
17%
RES DES-DIFFUSER-CF (OURS)
0.010
0,010
1.54410.280
0.007
4.619:10.652
36%
16
TVS-DUFUSER (OURS)
0.003
0.003
1.44=20.30
0.107
4.533:20494
47%
21%
TVS NVS-DIPUSER-CC (OURS)
0,003
0,003
0.588-0.231
0.007
4,462++0431
48%
18%
RES-DIFFUER-L10 (OURS)
0,010
0.010
0.527=0.291
0.011
4.571::0693
39%
8%
where ||||| denotes the 2-norm of vector. If we have more than one specification, we can add the corresponding conditions in Thm. 3.4 for each of them to the above QP. After we solve the above QP and get n'¹ we update (6) by setting μ² = p within the time step and get a new state for the diffusion procedure. Note that all of these happen at the end of each diffusion step.
Enforcing Invariance for ReS Diffuser. In this case, since have relaxation variables for each of the safety specifications, we wish to minimize these relaxations in the cost function to drive all the states towards the satisfaction of specifications. In other words, have the following QP:
i+1
vi* arg min
|
|p + +IMI s.t., (10).
(14)
At
where r is the concatenation of P for all k (O.....H.. As alternative, all the constraints above may share the same relaxation variable, i.e., the dimension of r is only one. After solve the QP and get v we update (6) by setting vd = in within the time step and get new state.
efficiency. The computational complexity of QP O(g'), where q is the dimension of the decision variable. The SafeDiffusers are more computationally expensive than existing models as they are involved with solving QPs. However, this can be addressed by: (a) Applying the proposed methods to limited diffusion steps while ensuring the satisfaction of the conditions in Thms. 3.4-3.6 6.6 are satisfied to guarantee safety; (b) Using the Batch QP solving method from the OptNet Amos & Kolter (2017); (c) Merging number of safety constraints into a single one Lindemann & Dimarogonas (2018) or consider the most-violating two constraints at each time step, and then more details). The algorithm for enforcing invariance includes the construction proper conditions, the solving of QP, and the update of diffusion state. We summarize the algorithm in Alg. I.
Complexity/Improvinee
find the closed-for form solution of the QP Ames et al. (2017) (See Appendix Sec. B for
7

---

Published as a conference paper at ICLR 2025
5 EXPERIMENTS
We set up experiments to answer the following questions: Does our method match the theoretical potential in various tasks quantitatively and qualitatively? How does our method compare with state-of-the-art approaches in enforcing safety specifications? How does our proposed method affect the performance of diffusion under guaranteed specifications? We focus on three experiments from gym robots (Walker2d-v2 and Hopper-v2), and manipulation. The training data is publicly available, see Janner al. (2022). The experiment details and metrics used are shown in Appendix. The safe diffusers generate both planning trajectory and control for the robots, and the score/reward is based on closed-loop control.
D4RL
maze
5.1 SAFE PLANNING IN MAZE
We focus on the case that the training data does not satisfy safety constraints show how our methods can be generalized to new constraints. For cases where the training data satisfies safety constraints, diffusers may still violate such constraints, while methods still work (see Fig. 8 of Appendix).
The diffuser cannot guarantee the satisfaction of any specifications. The classifier-based guidance in diffusion for safety specifications generates trajectories that largely deviate from the desired one with no safety. The proposed RoS-diffuser may introduce local trap problems (as shown in Fig. of Appendix), but this can be addressed by ReS-diffuser and TVS-diffuser. The safe diffusers can all guarantee the satisfaction of specifications, even when the specifications are complex (as long as they are differentiable), as shown in Table 2. The proposed methods can also maximally preserve the performance of diffusion models, and this is demonstrated by the scores and negative log likelihood (NLL) in Table 2, as well as shown by Fig. 2 lower case. The NLL metric quantifies the similarity between different distributions, and the proposed safe diffusers can achieve similar NLL as the baseline diffuser. The computation time of safe diffusers can be significantly reduced by applying the invariance method to limited diffuser steps, shown in the last column of Table 2 (0.01 Is v.s. 0.007s of diffuser). The invariant neural ODE method Xiao et al. (2023b) can guarantee safety for planning, but it does not work well in the closed-loop control (Fig. 7 of appendix), as shown by the score (-0.025) in Table 2. More ablation studies are given in Appendix C.
5.2 SAFE PLANNING FOR ROBOT LOCOMOTION
Table Robot safe planning comparisons with benchmarks. Abbreviations are the same as Table 2.
EXPERIMENT
METHOD
S-SPEC(T & 2 0)
C-SPEC(T & 2 0)
SCORe (1)
TIME
DIFFUSER JANNER ET AL.. (2022)
-9.375
-4.891 x
0.346++0.
0.037
TRUNC. BROCKMAN ET AL. (2016)
0.0
0.286:10.188 180
0.105
WALKER2D CG DHARIWAL & NICHOL (2021)
-0.575
-0.326
0.208.10.140
0.053
ROS-DIFE DIFFUSEF (OURS)
0.000
0.010
0.312.10.16
0.183
COS-DIFFUSER-CF (OURS)
0.000
0.010
0.321+0.1119
0.040
DIFFUSER JANNER ET AL. (2022)
-2.180
-1.862
0.455 10.038
0.038
TRUNC, BROCKMAN ET AL. (2016)
0.0
0.436:+0.067
0.046
HOPPER
CGDHARIWAL & NICHOL (2021)
-0,894
-0.524
0.478:10.0 038
0.047
ROS DIFFUSER (OURS)
0.000
0.010
0.400
0.170
ROS- DOS-DIFFUSER-CF (OurS)
0.000
0.010
0..64.10.028
0.040
In robot locomotion, there is no local trap problem, we only consider RoS-diffuser. Others work similarly. As expected, collisions with the roof are very likely to happen in the walker and hopper using the diffuser since there are no guarantees, as shown in Table 3. The truncation method can work for simple specifications (S-spec), but not for complex specifications (C-spec). The classifier basedd guidance can improve the satisfaction of specifications but without guarantees. Collision-free is guaranteed using the RoS- and one example of diffusion procedure is shown in Fig. 3.
5.3 SAFE PLANNING FOR MANIPULATION
In manipulation, specifications are joint limitations to avoid collision in joint space. In this case, the truncation method still fails to work for complex specifications (speed-dependent joint limitations).
8

---

Published as a conference paper at ICLR 2025
t= 20
t= 10
t=
Figure 3: Walker2D planning denoising diffusion with the robust-safe diffuser (Up down: diffusion time steps 20, 10, O, respectively). The red line denotes the roof the walker needs to safely avoid during locomotion (safety specifications). Safety is violated step 20 since the trajectory is initially Gaussian noise, but is eventually guaranteed (step 0). Note that the robot top could touch the roof, and this not a collision. This can be avoided by defining a more strict safety constraint.
Table 4: Manipulation planning comparisons. Abbreviations the same Table 2.
METHOD
S-SPEC(T & 2 0)
C-SPEC(T & 2 0)
REWARD (t)
TIME
DIFFUSER JANNER ET AL. (2022)
-0.057
-0.065
0.650-L0.107
0.038
TRUNC. BROCKMAN ET AL. (2016)
1.631e-8
0.575
0.069
CG DHARIWAL & NICHOL (2021)
-0.050
-0.053
0.800:10.328
0.075
ROS-DIFFUSER (OURS)
0.072
0.069
0.925 107
0.088
ROS-DIFFUSER-CF (OURS)
0.093
0.002
0.800-10.114
0.039
Our proposed RoS-diffuser can work for all specifications as long as they are differentiable. An interesting observation is that the proposed RoS-diffuser can even improve the performance (reward) of diffusion models in this case, as shown in Table 4. This may be due to the fact that the satisfaction of joint limitations can avoid collision in the joint space of the robot as Pybullet is a physics simulator. The computation time of the proposed RoS-diffusse is comparable to other methods. An illustration of the safe diffusion and manipulation procedure is shown in Fig.
RELATED WORKS
Diffusion models and planning Diffusion models Sohl-Dickstein et al. (2015) Ho et al. (2020) are data-driven generative modeling tools, widely used in applications to image generations Dhariwal Nichol (2021) Du et al. (2020b), in planning Hafner al. (2019) Janner et al. (2021) Ozair et al. (2021) Janner al. (2022), and in language Saharia et al. (2022) Liu et al. (2023a). Generative models are combined with reinforcement learning to explore dynamic models in the form of convolutional U-networks Kaiser al. (2019). stochastic recurrent networks Ke et al. (2019), neural ODEs Du et al. (2020a), generative adversarial networks Eysenbach et al. (2022), neural radiance fields Li al. (2022), and transformers Chen al. (2022). Further, planning tasks becoming increasingly important for diffusion models Lambert et al. (2021) Ozair et al. (2021) Janner et al. (2022) as they can generalize well in all kinds of robotic problems. Existing methods for improving the safety of diffusion models employ safety constraints to guide the diffusion process Yuan et al. (2022) Ajay al. (2023) Liu et al. (2023b). However, there are no methods to equip diffusion models with safety, which is especially important for many applications. Here, we address this issue using the proposed fnite-time diffusion invariance.
Set invariance and CBFs. An invariant set has been widely used to represent the safe behavior of dynamical systems Preindl (2016) Rakovic al. (2005) Ames et al. (2017) Glotfelter et al. (2017) Xiao & Belta (2021). In the state of the art of control, Control Barrier Functions (CBFs) are also widely used to prove set invariance Aubin (2009), Prajna et al. (2007), Wisniewski & Sloth (2013). CBFs can be traced back to optimization problems Boyd & Vandenberghe (2004), and are Lyapunov- like functions Wieland & Allgöwer (2007). For time-varying systems, CBFs can also be adapted accordingly Lindemann& & Dimarogonas (2018). Existing CBF approaches are usually applied in planning time since they are closely coupled with system dynamics. There are few studies of CBFs in other space, such as the diffusion time. Our work addresses all these limitations.

---

Published as a conference paper at ICLR 2025
Figure Manipulation planning denoising diffusion procedure with the proposed robust-safe diffuser (Left to right: diffusion time steps 1000, 100, O, and execution time step 100, respectively). The red dots denote the planning trajectory of the end-effector.
Guarantees in neural networks. Differentiable optimization methods show promise for neural network controllers with guarantees Pereira et al. (2020); Amos et al. (2018); Xiao et al. (2023a). They are usually served as layer (filter) in the neural networks. In Amos & Kolter (2017), differentiable quadratic program (QP) layer, called OptNet, was introduced. OptNet with CBFs has been used in neural networks as filter for safe controls Pereira et al. (2020), in which CBFs are not trainable, thus, potentially limiting the system's 's learning performance. In Deshmukh et al. (2019); Zhao al. (2021); Ferlez al. (2020), safety guaranteed neural network controllers have been learned through verification-in-the- -he-hhe-lopp training. The verification approaches cannot ensure coverage of the entire state space. More recently, CBFs have been incorporated into neural ODEs to equip them with specification guarantees Xiao et al. (2023b). However, none of these methods can be applicd in diffusion models, which we address in this paper.
CONCLUSIONS, LIMITATIONS AND FUTURE WORK
We have proposed finite-time diffusion invariance for diffusion models to ensure safe planning. The proposed robust-safe diffuser can guarantee safety in general settings, but it may be subject to local trap issues. The proposed relaxed-safe and time-varying safe diffusers can address the local trap problem. Through series of robotic planning tasks, we have demonstrated the effectiveness of our theoretical results. Our methods work better than existing approaches, while maximally preserving the model performance. Nonetheless, our method faces a few shortcomings motivating for future work.
Limitations. Specifically, specifications for diffusion models expressed differentiable con- straints that may be unknown for planning tasks. Further work may explore how to learn specifications from history trajectory data Robey et al. (2020). The computation time of existing diffusion models is still too high to be applied to real robotic systems. We may explore more efficient methods in the future, such as via online replanning Zhou al. (2023). Moreover, there may be some errors when estimating the diffusion dynamics in the current framework. This can be addressed using stochastic differential equations in diffusion models Song et (2020).
ACKNOWLEDGEMENTS
The research was supported in part by Capgemini Engincering, was also partially sponsored by the United States Air Force Research Laboratory and the United States Air Force Artificial Intelligence Accelerator and was accomplished under Cooperative Agreement Number FA8750-19-2- 1000. The views and conclusions contained in this document are those of the authors and should not be interpreted as representing the official policies, either expressed or implied, of the United States Air Force or the U.S. Government. The U.S. Government is authorized to reproduce and distribute reprints for Government purposes notwithstanding any copyright notation herein. This research was also supported in part by the AI2050 program at Schmidt Futures (Grant G- 965 22-63172).
REFERENCES
Anurag Ajay. Yilun Du Abhi Gupta, Joshua B Tenenbaum, Tommi S Jaakkola, and Pulkit Agrawal. Is conditional generative modeling all you need for decision making? In The Eleventh International Conference Learning Representations, 2023.
10

---

Published as a conference paper at ICLR 2025
Aaron D Ames, Xiangru Xu, Jessy W Grizzle, and Paulo Tabuada. Control barrier function based quadratic programs for safety critical systems. IEEE Transactions on Automatic Control, 62(8): 3861-3876, 2017.
Brandon Amos and J. Zico Kolter. Optnet: Differentiable optimization as layer in neural networks. In Proceedings of the 34th International Conference on Machine Learning Volume 70, pp. 136-145, 2017.
Brandon Amos, Ivan Dario Jimenez Rodriguez, Jacob Sacks, Byron Boots, and Zico Kolter. Differentiable mpe for end-to-end planning and control. In Proceedings of the 32nd International Conference on Neural Information Processing Systems, pp. 8299-888888 8310. Curran Associates Inc., 2018.
Jean-Pierre Aubin. Viability theory. Springer, 2009.
P. Boyd and L. Vandenberghe. Convex optimization. Cambridge university press, New York, 2004.
Greg Brockman, Vicki Cheung. Ludwig Pettersson, Jonas Schneider, John Schulman, Jie Tang, and Wojeiech Zaremba. Openai gym, 2016.
Chang Chen, Yi-Fu Wu, Jaesik Yoon, and Sungjin Ahn. Transdreamer: Reinforcement learning with transformer world models. arXiv preprint Siti:2202.09488) 2022.
Jyotirmoy V. Deshmukh, James P. Kapinski, Tomoya Yamaguchi, and Danil Prokhorov. Learning deep neural network controllers for dynamical systems with safety guarantees: Invited paper. In 2019 JEEE/ACM International Conference on Computer-Aided Design (ICCAD), pp. 1-7, 2019.
Prafulla Dhariwal and Alexander Nichol. Diffusion models beat gans image synthesis. Advances in Neural Informtion Processing Systems, 34:8780-8799 2021.
Jianzhun Du Joseph Futoma, and Finale Doshi-Veld Model-based reinforcement learning for semi-markov decision processes with neural odes. Advances Neural Information Processing Systems,
19816, 2020a.
Yilun Du, Shuang Li, and Igor Mordatch. Compositional visual generation with energy based models. Advances in Neural Information Processing Systems, 33:6637-6647, 2020b.
Benjamin Eysenbach, Alexander Khazatsky, Sergey Levine, and Russ R Salakhutdinov. Mismatched
more: Joint model-policy optimization for model-based rl. Advances in Neural Information Processing Systems, 35:23230-23243, 2022.
James Ferlez, Mahmoud Elnaggar, Yasser Shoukry, and Cody Fleming. Shieldnn: A provably safe nn filter for unsafe nn controllers. preprint arXiv:2006.095: 2020.
Glotfelter, J. Cortes, and M. Egerstedt. Nonsmooth barrier functions with applications to multi-robie systems. IEEE control systems letters, 1(2):310-315 2017.
Danijar Hafner, Timothy Lillicrap, Ian Fischer, Ruben Villegas, David Ha, Honglak Lee, and James Davidson. Learning latent dynamics for planning from pixels. In International conference on machine learning, pp. 2555 2565. PMLR, 2019.
Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. Advances in Neural Information P Processing Systems, 33:6840-6851, 2020.
Michael Janner, Qiyang Li, and Sergey Levine. Offline reinforcement learning as big sequence modeling problem. Advances in neural information processing systems, 34:1273-1286, 2021.
Michael Janner, Yilun Du, Joshua Tenenbaum, and Sergey Levine. Planning with diffusion for flexible behavior synthesis. In International Conference on Machine Learning, pp. 9902-9915. PMLR, 2022.
Lukasz Kaiser, Mohammad Babaeizadeh, Piotr Milos, Blazej Osinski, Roy H Campbell, Konrad Czechowski, Dumitru Erhan, Chelsea Finn, Piotr Kozakowski, Sergey Levine, et al. Model-based reinforcement learning for atari. arXiv preprint 1903. 2019.

---

Published as a conference paper at ICLR 2025
Nan Rosemary Ke, Amanpreet Singh, Ahmed Touati, Anirudh Goyal, Yoshua Bengio, Devi Parikh, and Dhruv Batra. Modeling the long term future in model-based reinforcement learning. In International Conference Learning Representations, 2019.
Hassan K. Khalil. Nonlinear Systems. Prentice Hall, third edition, 2002.
Nathan Lambert, Albert Wilcox, Howard Zhang, Kristofer SJ Pister, and Roberto Calandra. Learn- ing accurate long-term dynamics for model-based reinforcement learning. 2021 60th IEEE Conference on Decision and Control (CDC), pp. 2880-2887. IEEE, 2021.
Yunzhu Li, Shuang Li, Vincent Sitzmann, Pulkit Agrawal, and Antonio Torralba. 3d neural scene representations for visuomotor control. In Conference on Robot Learning, pp. 112-123. PMLR, 2022.
L. Lindemann and D. V. Dimarogonas. Control barrier functions for signal temporal logic tasks, In Proc. of 57th IEEE Conference on Decision and Control, 2018. appear.
Haohe Liu, Zehua Chen, Yi Yuan, Xinhao Mei, Xubo Liu, Danilo Mandic, Wenwu Wang, and Mark D Plumbley, Audioldm: Text-to-audio generation with latent diffusion models. arXiv preprint arXiv:2301.12500 2023a.
Zuxin Liu, Zijian Guo, Yihang Yao, Zhepeng Cen, Wenhao Yu, Tingnan Zhang, and Ding Zhao. Con- strained decision transformer for offlin safe reinforcement learning. In International Conference on Machine Learning. pp. 21611-21662 PMLR, 2023b.
David G Luenberger. Optimization by vector space methods. John Wiley & Sons, 1997.
Mitio Nagumo. Über die lage der integralkurven gewöhnlicher differentialglcichungen In Proceed- ings of the Physico-Mathemattin Society of Japan. 3rd Series. 24:551-559, 1942.
Quan Nguyen and Koushil Sreenath. Exponential control barrier functions for enforcing high relative- degree safety-critical constraints. In 2016 American Control Conference (ACC), pp. 322-328. IEEE, 2016.
Sherjil Ozair, Yazhe Li, Ali Razavi, Ioannis Antonoglou, Aaron Van Den Oord, and Oriol Vinyals. Vector quantized models for planning. In International Conference Machine Learning, pp. 8302-8313. PMLR, 2021.
Mareus Aloysius Pereira, Ziyi Wang, Joannis Exarchos, and Evangelos Theodorou. Safe optimal control using stochastic barrier functions and deep forward-backwarr sdes. In Conference on Robot Learning. 2020.
Stephen Prajna, Ali Jadbabaie, and George Pappas. A framework for worst-case and stochastic safety verification using barrier certificates. IEEE Transactions on Automatic Control, 52(8): 1415-1428, 2007.
Matthias Preindl. Robust control invariant and lyapunov-based mpe for ipm synchronous motor drives. IEEE Transactions on Industrial Electronics, 63(6):3925-3933, 2016.
Sasa V Rakovic, Eric Kerrigan, Konstantinos Kouramas, and David Q Mayne. Invariant approxi- mations of the minimal robust positively invariant IEEE Transactions on automatic control, 50 (3):4064410, 2005.
Alexander Robey, Haimin Hu, Lars Lindemann, Hanwen Zhang, Dimos V. Dimarogonas, Stephen Tu, and Nikolai Matni. Learning control barrier functions from expert demonstrations, In 2020 59th IEEE Conference on Decision and Control (CDC), pp. 3717-3724, 2020.
Chitwan Saharia, William Chan, Saurabh Saxena, Lala Li, Jay Whang, Emily Denton, Kamyar Ghasemipour, Raphael Gontijo Lopes, Burcu Karagol Ayan, Tim Salimans, et al. Photorealistic text-to-image diffusion models with deep language understanding. Advances in Neural Information Processing Systems, 35:36479-66494 2022.
Jascha Sohl-Dickstein, Eric Weiss, Niru Maheswaranathan, and Surya Ganguli. Deep unsupervised learning using nonequilibrium thermodynamics. International Conference on Machine Learning, pp. 2266-2265. PMLR, 2015.
12

---

Published as a conference paper at ICLR 2025
Yang Song, Jascha Sohl-Dickstein, Diederik P Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. Score-based generative modeling through stochastic differential equations. arXiv preprint arXiv:2011.13356. 2020.
Peter Wieland and Frank Allgöwer. Constructive safety using control barrier functions. In Proc. of 7th IFAC Symposium on Nonlinear Control System, 2007.
Rafael Wisniewski and Christoffer Sloth. Converse barrier certificate theorem. In Proc. 52nd IEEE Conference on Decision and Control, pp. 4713 1718, Florence, Italy, 2013.
Wei Xiao and Calin Belta. Control barrier functions for systems with high relative degree. In Proc. of 58th IEEE Conference Decision and Control, pp. 474 479, Nice, France, 2019.
Wei Xiao and Calin Belta. High-order control barrier functions. IEEE Transactions Automatic Control, 67(7):3655-3666 2021.
Wang. Ramin Hasani, Makram Chahine, Alexander Amini, Xiao Li, and Wei Xiao, Barrierntt: Differentiable control barrier functions for learning safe robot control. Daniela Rus.
IEEE Transactions on Robotics, 2023a.
Wei Xiao, Tsun- Wang, Ramin Hasani, Mathias Lechner, Yutong Ban, Chuang Gan, and Daniela Rus. On the forward invariance of neural odes. In International conference on machine learning, pp. 38 58100-388 124. PMLR, 2023b.
Zhantao Yang, Ruili Feng, Han Zhang, Yujun Shen, Kai Zhu, Lianghua Huang, Yifei Zhang, Yu Liu, Deli Zhao, Jingren Zhou, et al. Lipschitz singularities in diffusion models. In The Twelfth International Conference on Learning Representations, 2023.
Ye Yuan, Jiaming Song, Umar Iqbal, Arash Vahdat, and Jan Kautz. Physdiff: Physics-guided human motion diffusion model. arXiv preprint arXiv:2212.00555 2022.
Hengjun Zhao, Xia Zeng, Taolue Chen, Zhiming Liu, and Jim Woodcock. Learning safe neural network controllers with barrier certificates. Form Asp Comp, 33:437-455, 2021.
Siyuan Zhou, Yilun Du, Shun Zhang, Mengdi Xu. Yikang Shen, Wei Xiao, Dit- Yan Yeung, and Chuang Gan. Adaptive online replanning with diffusion models, Advances Neural Information Processing Systems, 36:44000-4401,, 2023.
13

---

Published as a conference paper at ICLR 2025
A PROOF
A.
PROOF OF THM. 3.4
Proof: Given continuously differentiable constraint h(æ;) (h(w)) 2 0), by Nagumo's theorem
Nagumo (1942), the necessary and sufficient condition for the satisfaction of h(m;)) 2 0, Vr 2 0 is
h(xr,) 0, when h(m;) = =0,
If ((N,)) 20kE (O.....H), then the condition (8) is equivalent to
dt: db(tg), o + ((b(()))-00 - 20,
where H is the diffusion time derivative. The last equation is equivalent to
+e(b(T() -(N,)) 2 0,
dr
where denotes the diffusion time. Further, we have that
((b(T())>(M)) - as b(T((()) b(T)) y(N,e),
In other words, we have d(b(r))- 2 0 when b(T()) y(N,)). Since b(Tz") 2 Y(N,),k {O..... H,, then by Nagumo's theorem, we have b(T()) 2 y(V,)) > 0,Vj (O....,N- 1}. Therefore, the diffusion procedure po(r"-17r),, {I,...,NN is finite-time diffusion invariant, and the finite time in diffusion invariance is N.
dr
If, on the other hand, b(T(') y(N, (O.....HH)
H). then we can define Lyapunov function:
- V(T²) = -N b(T)),( (O...... (O. (O......N)
(15)
and (a=
Replacing y(N,E) b((()) by V(Tz), the condition (8) is equivalent to (note that + = v²)
dv : (
dt
which is equivalent
+EV()+)V(TT) so,
Suppose we have
+(T/)+EV(TT) =0,
the solution the above equation is
V(T)) = V( )e ee(N-i)
Using the comparison lemma Khalil (2002), equation (8) implies that v(T VV()) (N- {0.... (O....,N), NN.
At diffusion step 0, i.e., 0, the last inequality becomes
V(Tx) VV ,k (0. HO.
Substituting V(T)) = =YN,)= -(N))))b(T().j- {0, [O....,N] into the last equation, we have
y(N,e) -b(z))((())))))))))))(()) ( (r(N,)) b( eN ,N,KE ().
14

---

Published as a conference paper at ICLR 2025
Since b(TT)) x(N,e) in this case, the last equation can be rewritten
b(T.)) < (YN,e) - -b(T y(N,E), (f)...,! Following the condition y(N, 2 ((N,E) b( le in the theorem, we have
-b(T)) ((N,)) - b(Txx) e () (o..... H),
Therefore,
b(Tx) 20, 20 (O..... the diffusion procedure pe po( (1, (I....,N) is finite-time diffusion invariant.
A.2 PROOF OF THM. 3.5
Proof: Since the weight (x) is chosen such that wa wx()) for all No,00 No S then the condition (10) becomes hard constraint when < No. In other words, equation (10) becomes:
((V(T():= ab(TT) v cc(((T))) 2 0,k (O. H).J E (o....,No), dTk
Then, the proof is similar that of the Thm. 3.4, and we have that the diffusion procedure Pe(T'-I(T),iE NN is finite-time diffusion invariant.
A.3 PROOF OF THM. 3.6
Proof: Since (N) S b(TT),, we have that s(Tx, = b(T,)) ox 2 when j N.
The condition (12) is equivalent
2x(T(,o((() uf
as(TT o(()) + csss(t ok)))) 2 0,
dj
which can be rewritten
s <(T (i) a (i))) 20,
Using the Nagumo' theorem presented the proof of Thm. 3.2, we have that s( 5 (j)) 0,Vj (O......N}
since sTT oe (N)) 2 0.
As (0) - 0 and o[ :- b(T)) (j), we have that b(7()) 2 0, Ak H). Therefore, the diffusion procedure pe (e(r"_(TT)) (0....,N) is finite-time diffusion invariant, and the finite time in diffusion invariance 0.
15

---

Published as a conference paper at ICLR 2025
B CLOSED-FORM SOLUTION TO SAFEDIFFUSERS
The enforcement of the proposed SafeDiffusers involve the solving of the QP (13) or (14), which could be computationally expensive for complex tasks. Here, we propose find the closed-form solution to the QP (13) or (14) following Luenberger (1997). We take (13) with the RoS-Diffuser as an example (the closed-form solution to the TVS-Diffuser or ReS-Diffuser is similar by replacing the corresponding constraints).
Consider the following optimization corresponding (13) for the RoS- SoS-Diffuser:
1+1
vi D arg ||||
IP,
At
dbi(Ti) vi + - 20, (O.......-I...... 1},
(16)
s.t.,
dri
dba(T') ny + - 2 2, (o....,N--I)
drl
where b, (two vectors corresponding to the planning horizon H) are the two most risky safety spec- ifications, i.e., by, by have the minimum and second-mininum values (component-wiss corresponding the planning horizon If) among all the safety specifications at the diffusion step E {O,..., 1}. respectively.
Define
81 (1())) = dbj (
h1(7)) = =(bi(T))) y(N,)))
drl
(17)
82(T)) = =1- db2 (
= e(b2(())) =(b(7)) y(N,)))
drj
The standard form of the cost in QP is
where the matrix H(r)) is an
identity matrix corresponding to (16). We further define
(1(T)).82(1)) = H(T)) |8 (T (TT ))2(())) h (T') (z((T)) ] = h1(TT)
]
(I(T
(18)
82( vi
h2(TT)
where
1 ((()),)((TT),
F(T') = 7! -/11 /+1
(19)
Ar
Then, let w/:::= == - V and (,,-) define an inner product with weight matrix H(T)) so that (w0, w/ = (w)) HTT)))()) (Tw).. The optimization problem (16) is equivalent to:
/ i
argmin(w w.))
w/
s.t., (T'(T)), w²) s h1 (T'), (82(T'), w/ < h2(TT),
VjE NN. 1},
(20)
Vje (0. N 1},
where the optimal solution of (16) is given by v : v..
(21)
Following Luenberger (1997) [Ch. 3), the unique solution to (20) is given by
un (T( 22(")))))
(22)
where
if G21 (T)) ( <0
A (TT)
max ( (7)),0 Gn([T)) max max (h (2n
if G12(())) (( <0
otherwise.
GntT (z)(7/) - Gaa(1))
(23)
16

---

Published as a conference paper at ICLR 2025
(7x(0)(7)).0)
if G21 ( <0
Gz((T')
22(+))=
if G12(T)) (n) <0 otherwise
(24)
where = =(
(
1,2 is the Gram matrix.
17

---

Published as a conference paper at ICLR 2025
C EXPERIMENT DETAILS
Planning Tasks Farrmmaaoonndaaiiddd///////ksks
Maze. In maze planning, aim to impose trajectory constraints the planning path of maze. The initial positions and destinations in maze are randomly generated. The diffusion model is conditioned on the initial positions and destinations.
Robot locomotion. For robot locomotion (in MuJoCo), we wish the robot to avoid collisions with obstacles, such as the roof. In this case, since there is no local trap problem, only consider robust-safe diffuser RRoS-diffuser. Others work similarly.
Manipulation. For manipulation (in Pybullet), the diffusion models generate joint trajectories (as controls) for the robot, which are conditioned on the locations of the objects to grasp and place. Specifications are joint limitations avoid collision in joint space.
Metries and methods used in Tables
Metries used in the paper Xiao et al. (2023b). The X-SPEC, X E {c,5) metric is defined as:
X-SPEC min min bx bx(x(1))) {I......N) rE|6.77
(25)
where N is the number of testing runs (N 100 in this case). T the final time of each run. bx (xx) 2 0 the (complex/simple) safety constraint that given explicitly in each experiment below.
Classifier-based guidance is done by applying gradients (towards safe space) to the trajectory points that drive them to the safe side of the space whenever safety constraints are violated. As the trajectory points frequently enter the unsafe sets due to the lack of set invariance property (while the CBF method does have), applying classifier- based guidance at all times could mess up the diffusion process (as shown in Fig. 2). As result, the classifier-based guidance method would fail to identify the constraints and thus fail to satisfy them as there no explicit constraint information involved (the CBF method does have since it evaluates the derivative of the safety constraints along the diffusion dynamics).
The score (results from closed-loop control) represents the normalized reward that is used in RL. The problem uses a sparse reward which has value of 1.0 when the agent is within a 0,5 unit radius of the target. Specificallyy, we use the env.get_normalizer normalized sccererrurc)))))rrrsss function in dr41 to compute a normalized score for an episode, where returns are the undiscounted total sum of rewards accumulated during an episode.
S-spec and C-spec. Simple specifications (S- (S-spec) and Complex specifications (C-spec) are cal- culated by the minimum values of the functions (e.g., b( ()) among all runs that define the safety constraints (e.g., b(v)) 2 0). They are defined by how complex the specifications are. For instance, in the maze example, the elliptical obstacle defined as a simple obstacle as we can easily apply a truncation method to satisfy the safety constraints, while the supper-elliptical obstacle is defined as complex obstacle as it is hard to apply the truncation method.
The NLL metrics for all the baselines and our methods follow the function in guided- diffusion/guided biffusiin//aassiann diffusion. Gaussian terms_ jed from Dhariwal & Nichol (2021).
C.1 SAFE PLANNING IN MAZE
In this experiment, we aim to impose trajectory constraints on the planning path of a maze. The training data is publicly available from Janner et al. (2022), in which initial positions and destinations in maze are randomly generated. The diffusion model is conditioned on the initial positions and destinations.
Specifications. The simple safety specification for the planning trajectory is defined as a super- ellipse-shape obstacle:
x -
X0
y
yo
+
2 1
(26)
18

---

Published as a conference paper at ICLR 2025
S
Figure 5:
Maze planning (blue to red) denoising diffusion procedure with diffuser (Left to right: diffusion time steps 256, 4, O, respectively). Red ellipse and superellipse (outside) denote safe specifications. Both specifications are violated with the trajectory from diffuser.
where (x.y) E I is the state on the planning trajectory, (o) E R is the location of the obstacle. > 0, > 0. Since the state (x.y) is normalized in diffusion models, also need to normalize the above constraint accordingly. In other words, we normalize x and yo, b according to the normalization of (x,y) along the x-axis and y a-ixis, respectively.
The complex safety specification for the planning trajectory is defined as an ellipse-shape obstacle:
X - Xo
Yn
+
21.
(27)
We also normalize the above constraint in the simple case. In this case, it is non-trivial to truncate the planning trajectory to satisfy the constraint. When we have much more complex specifications, it too hard for the truncation method work.
Experiment parameters. In relaxed-safe diffuser, wx()) is defined as wx(j) = 100 when j 2 10; otherwise, w& (J) 0 in the maze example. In time-varying-san safe diffuser, the CBF corresponding to (26) (the CBF is similarly defined for (27)) is defined as (= )² (7
oi()), where oj( sigmoidd - j), and jaius = 5, in which case O (N) is near 0 at the beginning of the diffusion time j N. Therefore, the unsafe set is very small such that all the trajectory points are outside the unsafe set. When j 0, (j) is close to 1, and the safety constraint is satisfied for all the trajectory points. There are many different ways to define both time-varying functions, and their definitions do not greatly affect the safety satisfaction long the initial (i.e., the unsafe set is very small such that all the trajectory points are initially outside the unsafe set) and terminal conditions (the safe set is the same as the safety constraint specification) are satisfied. The robust function in robust-safe diffuser (the same for the relaxed-safe diffuser) is set to 0.01 according to Thm. 3.4 and the given N and (N 256, 1). The extended class function a is linear function with slope (i.e., E = in (8)).
Model setup, training and testing. The diffusion model structure is the same the open source one (Maze2D-large-vl) provided in Janner et al. (2022). We set the planning horizon as 384, the diffusion steps as 256 for the proposed methods. The learning rate is 2e with 2 training steps. The training of the model takes about 10 hours on Nvidia RTX-3090 GPU. More parameters are provided in the attached code: maafcdiffusr/coonn//mzzzzz posed) methods in testing can be modified in "iffusion SisssianDDifuusooppsaapleeee p_tapple(am"""""m_ function.
The switch of different (pro- through
In Fig. 5, we present diffusion procedure using the diffuser, in which case the generated trajectory can easily violate safety constraints. Using the proposed robust-safe diffuser, the generated trajectory can guarantee safety, but some points on the trajectory may get stuck in local traps, shown in 6. Using the proposed relaxed-safe diffuser and same-vayyng--sal diffuser, the local trap problem could be addressed.
Invariant neural ODE. The invariant neural ODE method Xiao et al. (2023b) does not work well in closed-loop control, shown in Fig. 7.
Ablation study 1: Maze2d-umaze-s (training data satisfies safety constraints). In this case, the training data satisfies the safety constraints (modeled maze walls). The diffuser may still violate such safety constraints due to uncertainties in inference, as shown in Fig. left case. While our safe diffuser guarantee safety (Initial positions and destinations are randomly generated).
19

---

Published as a conference paper at ICLR 2025
Figure 6: Maze planning (blue to red) denoising diffusion procedure with robust-safe diffuser at diffusion time step 0. Red ellipse and superellipse (outside) denote safe specifications. Although with safety guarantees, some trajectory points may get stuck in local traps.
Figure 7: Maze planning (blue to red) using neural ODEs with invariance. Although with safety guarantees, the neural ODEs fail work for such long horizon planning problem.
Ablation study 2: Comparison between one-step safe diffusers and multi-step safe diffusers. The safe diffusers have to be applied for multiple diffusion steps, otherwise, the safety constraints may still be violated (as shown in Fig. 9 left case) the proposed diffusion invariance is dynamic process that requires several iterations to drive the trajectory to safe space.
Ablation study 3: Safety portrait statistics. We present in Fig. 10 the distribution of safety portrait (C-spec) among 100 runs with respect to scores. In summary, our safe diffusers can guarantee safety while maximally preserving performance.
Ablation study 4: Minimum diffusion steps for safety. We have done ablation studies on the number of diffusion time steps needed to reduce the computation time while still maintaining the model performance. It actually only requires at least 3 time steps (this is set to 10 in Table to ensure robustness) as the trajectory points can quickly converge to the safe set.
20

---

Published as a conference paper at ICLR 2025
Figure Maze planning (blue red) denoising diffusion procedure using diffuser (left) and safediffuser (right) when the training data satisfies safety constraints. Red and green super-ellipses denote safe specifications for the walls. Diffusers may still violate safety constraints.
Figure 9: Maze planning (blue red) denoising diffusion procedure using safediffuser for the last step (left) and the last 10 steps (right). The generated trajectory is more smooth with safety guarantees when running for the last 10 steps.
C.2 SAFE PLANNING FOR ROBOT LOCOMOTION
For robot locomotion (in MuJoCo), we wish the robot to avoid collisions with obstacles, such as the roof. this case, since there no local trap problem, we only consider robust-safe diffuser (RoS-diffuser). Others work similarly. The training data set is publicly available from Janner et al. (2022).
The simple safety specification for both the Walker2D and Hopper is collision avoidance with the roof. other words, the height of the robot head z should satisfy the following constraint:
Specifications.
hr:
(28)
where h, is the height of the roof. We also need normalize h, according the normalization of the state 2 in the diffusion model.
The complex safety specification for both the Walker2D and Hopper speed-dependent collision avoidance constraint:
z z+ 0v: hr.
(29)
where 0, v. I is the speed of the robot head along the z-axis. The speed-dependent safety constraint is more robust for the robot to avoid collision with the roof since when the robot jumps faster, need to ensure larger safe distance with respect to the roof in order to account for all kinds of uncertainties or perturbations. In this case, the simple truncation method is hard to work since it not clear how to truncate both and v. the same time.
21

---

Published as a conference paper at ICLR 2025
25-
110-
-22-
20"
me Cager
120-
-03
1.3-
-04-
-05-
23
-2.
30
1.0
1.2
3.0
5009
Sc0re
5a0re
Figure 10: Specification satisfaction metrics (C-spec) v.s. scores in maze planning using diffusion models (from left to right: diffuser, truncation, classifier guidance, safediffuser). Safediffusers can guarantee the satisfaction of specifications while making the scores consistently close to 1.6 among all the runs (mean value: 1,527).
Model setup, training and testing. The diffusion model structures are the same as the open source ones Mee-D---Muiuu---ppe---- and Hooper-Mediun-EXperee
provided in Janner et al. (2022). We set the planning horizon as 600, the diffusion steps as 20. The learning rate is 2e with 2 training steps. The training of the model takes about 16 hours a Nvidia RTX-3090 GPU. More The switch of
parameters are provided in the attached code: "safeddfiisefconig/ccmmoioooooo different methods in testing can be modified in "sseclifhsrdfffhhsrrroeessfssoos through "GaussianDiffusion. "taarfiiio.sssapppee" function.
C.3
SAFE PLANNING FOR MANIPULATION
For manipulation (in Pybullet), the diffusion models generate joint trajectories (as controls) for the robot, which conditioned on the locations of the objects grasp and place. The training data set publicly available from Janner et al. (2022). Specifications are joint limitations to avoid collision in joint space.
Specifications.
The simple safety specification for the robot is in the joint space, and we are trying to limit the joint angles of the robot within allowed ranges:
Xmin S Xmaxx
(30)
where x E R² is the state of 7 joint angles, Xmin IR? and Xmax E R² denotes the minimum and maximum joint limits. We need to normalize the limits according to how the state is normalized in the diffusion model.
The complex safety specifications are speed-dependent joint constraints:
Jamin xx+ Φv I Xmaxx
(31)
where @ > 0, E R² is the joint speed corresponding to the joint angle In this example, since the diffusion model does not directly predict v, we evaluate v using x(k) and x(++1 1) along the planning horizon. The joints limits are also normalized in the simple specification case.
Model setup, training and testing. The diffusion model structure is the same as the open source one provided in Janner al. (2022), and we use their pre-tree pre-trained models to evaluate methods when comparing with other approaches.
22


Reviews:
[{"review_id": "PrgHqHLOma", "reviewer": "Reviewer_4UNS", "summary": "The authors propose a method to use control barrier functions (CBFs) with diffusion planning, enabling safety guarantees. The results are demonstrated on a 2D maze problem, Walker2D and a manipulation problem from related work.", "questions": "1) Are \"local traps\" = local minima?\n2) Isn't it a big problem that the method gets stuck in \"local traps\" between 39% and 100% of the time for some of the benchmarks? What does this mean in practice?\n3) What is trap rate 1 vs. trap rate 2 in the table?\n4) Could you comment on why you chose to use CBF here instead of e.g. lagrangian objectives common in safe RL?\n5) Why three methods instead of the most general, or one that picks the best solution approach?", "limitations": "", "rating": 6, "confidence": 3, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "- Safety guarantees are important for some applications and of interest to the safe planning community\n- This may be the first (only?) safety method for diffusion planning.", "weaknesses": "- Some parts are a bit difficult to read and have unusual terminology (e.g., \"local traps\"?) and the paper contains some minor grammar and cosmetic issues which make the quite complex approach harder to understand.\n- The method is actually three methods, and the user is to pick the one most suitable for their problem. This seems a bit complicated, why not go for the most general?\n\nExample presentation issues (I recommend you do another polish pass):\n- General: excessive underlining\n- 470: typo: physical simulator\n- 474: typo: can work in general safety guarantees", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "u0TlnAu1IQ", "reviewer": "Reviewer_hg4A", "summary": "The authors present SafeDiffuser, a modified version of the Diffuser model proposed by Janner et al. (2022), adapted to ensure the satisfaction of safety constraints. They introduces \"Finite-Time Diffusion Invariance,\" leveraging Control Barrier Functions (CBFs) within the denoising diffusion process to enforce specified safety constraints. The authors propose three approaches for implementing their methodology—ROS, RES, and TVS—that demonstrate competitive performance compared to baseline methods, achieving significantly fewer constraint violations. Experiments were conducted across Maze2D-large, locomotion, and manipulation tasks, validating the effectiveness of the proposed approaches in diverse settings.", "questions": "1. In terms of data and experimental results, could you clarify the rationale for selecting D4RL over [2], which is specifically designed for Safe Offline RL?\n2. Can you clarify the motivation of applying CBFs in the diffusion denoising process steps instead of trajectory planning steps? It was not very clear.\n3. Why were the experiments conducted solely in Maze2D-large? Could you clarify the choice of tasks for the locomotion experiments? Specifically, why was only the Medium-Expert variant used for the locomotion environment? What about Cheetah?\n4. Could you elaborate on the generalization capabilities of the model when encountering new safety constraints beyond those specified during training? It would be valuable to understand how well the approach adapts to previously unseen constraints.\n\n\n[2] Liu, Zuxin, et al. \"Datasets and benchmarks for offline safe reinforcement learning.\" arXiv preprint arXiv:2306.09303 (2023).", "limitations": "", "rating": 8, "confidence": 4, "soundness": 3, "presentation": 4, "contribution": 3, "strengths": "1. The proposed method introduces a novel formulation of Control Barrier Functions (CBFs) within diffuser-family models, ensuring that safety constraints are satisfied throughout the diffusion denoising process.\n2. The authors provide a systematic approach for selecting the appropriate variant based on the safety constraints.\n3. Results demonstrate improvements in safety-related metrics while maintaining comparable performance in the downstream task.\n4. The method can be trained using data that violates safety constraints, yet during testing, it reliably generates safe trajectories.", "weaknesses": "1. The proposed methods require solving Quadratic Programs (QPs) at each diffusion step, which is computationally inefficient.\n2. [Minor Weakness] The approach requires predefined safety constraints. However, I think that this limitation is relatively minor, such a setup is not a major weakness.\n3. It would strengthen the paper if the authors included comparisons with other methods, such as CDT [1], which also employ sequential modeling techniques to address offline RL problems with safety constraints.\n\n[1] Liu, Zuxin, et al. \"Constrained decision transformer for offline safe reinforcement learning.\" *International Conference on Machine Learning*. PMLR, 2023.\n\nDespite the weaknesses, I find the formulation and results are enough to have the paper above the acceptance threshold.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "6RkwGT0edS", "reviewer": "Reviewer_vnZo", "summary": "This paper presents control barrier function-based methods to enforce safety constraints on diffusion models. The main idea is to modify the diffusion denoizing step to satisfy safety constraints within a finite number of steps (finite-time diffusion invariance). This is done by formulating a quadratic program to compute a perturbation that steers the generated trajectory towards the safe set in every denoizing step. Evaluations in simulated maze and robotics domains show that the proposed method is superior to baselines in satisfying safety constraints at the cost of longer planning time.", "questions": "- The forward invariance in control theory (equation 2) assumes that the control system is governed by Lipschitz functions. Is any such requirement not required for extending the definition to diffusion neural networks?\n    \n- Diffusion dynamics is estimated online. How does error in this estimation affect the guarantees and performance in practice?\n    \n- In theorem 3.2 what is the intuitive meaning of the robust term?\n    \n- If would be interesting to continually retrain the diffusion models on the generated safe data. Can this improve performance or speed up safediffuser?", "limitations": "", "rating": 8, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "- Diffusion models are an important and effective class of conditional generative models. However, existing methods for guidance do no provide safety guarantees. Hence, the propose algorithm is an important contribution.\n    \n- Applying CBF-based technique to diffusion models is novel to my knowledge. In particular, modifying the denoizing steps seem to be more effective than generating safe trajectories through classifier-free guidance.\n    \n- Proposed extension to handle local traps are effective.\n    \n- Experimental results in simulation demonstrate the effectiveness and robustness of the algorithm.", "weaknesses": "- Safety specifications have to be differentiable.\n    \n- SafeDiffuser is significantly slower (by an order of magnitude) than vanilla diffusion.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "P99ii7ggvr", "reviewer": "Reviewer_gj8X", "summary": "The paper introduces SafeDiffuser, a method to add safety guarantees to diffusion models when used for planning tasks. The key innovation is incorporating control barrier functions (CBFs) into the diffusion process to ensure generated trajectories satisfy safety constraints.", "questions": "1. Regarding to the design choice, the TVS diffuser seems to be the most general safediffuser. Is it possible to further simplify the forward invariance equation (theorem 3.4) by fully discarding the reliance on b, and directly using sigma? For example, imagine sigma at t=0 converges to exactly b. This sigma can be used in analogy to the time-varying CBF and should impose a more relaxed restriction to the intermediate samples. I guess it would need clever design of sigma (or even learning-based), but do you think it is worth the effort?\n2. Another question is the motivation of using CBF. From first principle, all we care about here is the safety at the final timestep, ie, t=0. It sounds more similar to a goal-reaching/liveness problem, where you don’t need to enforce every intermediate sample satisfy the safety. Compared to control Lyapunov function or reachability-based method, why is CBF used for the problem? Applying the other two concepts seem more natural to me.\n3. In control, CBF can usually be compared to potential-field based method to show their effective in terms of avoiding obstacle in a longer time horizon rather than reactively avoiding. Similarly, is it possible to include [1] as a baseline to show the approach’s effectiveness? \n\n[1] Luo, Y., Sun, C., Tenenbaum, J. B., & Du, Y. (2024). Potential based diffusion motion planning. arXiv preprint arXiv:2407.06169.", "limitations": "", "rating": 5, "confidence": 3, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "The approach maintains the model performance while adding safety guarantees.", "weaknesses": "1. The definition of diffusion invariance seems too strict. Essentially we only care about the safety at t=0, and trajectories satisfying t=0 safety don’t necessarily need to satisfy t=1 safety. However the method actively encourages the intermediate trajectories to be safe. This doesn’t mean the method is wrong, but I’m hoping to see a softer way to guarantee the safety. See Q2.\n2. Along with the above weakness, the design choice seems too complex. There’re $\\epsilon$, $w$, $r$, $\\gamma$, $\\sigma$, all of them seem hyper-parameters that need careful tuning.\n3. CBF itself is meant to design for dynamics that are (1) time-invariant; and (2) deterministic. The diffusion process doesn’t belong to any of these two parts. For (1), the alpha bar changes over time steps. For (2), most of the diffusion sampler constantly adds noise to the dynamics (unless the approach is specifically using DDIM). Applying CBF-based technique to the diffusion seems counter-intuitive. \n4. Scaling up seems challenging. I’m hoping to see a highly nonlinear dynamics like drone/quadcopter to see whether the method could scale up. Another challenge for scaling up is from the selection criteria. Page 6 discusses the principle to select different safediffusers. As mentioned, it requires the unsafe set to be known to determine the convexity. This seems challenging for high-dimensional control tasks.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)