ABNet: Adaptive explicit-Barrier Net for Safe and Scalable Robot Learning
Authors: Wei Xiao
Tsun-Hsuan Wang
Chuang Gan
Daniela Rus
Venue: ICML 2025 poster (2025)
Keywords: Safe learning
Robot learning
Scalable learning
Primary area: applications->robotics
TL;DR: We propose a new safe robot learning model/method that is efficient, scalable, robust, and with provable guarantees

Abstract: Safe learning is central to AI-enabled robots where a single failure may lead to catastrophic results. Existing safe learning methods are not scalable, inefficient and hard to train, and tend to generate unstable signals under noisy inputs that are challenging to be deployed for robots. To address these challenges, we propose Adaptive explicit-Barrier Net (ABNet) in which barriers explicitly show up in the closed-form model that guarantees safety. The ABNet has the potential to incrementally scale toward larger safe foundation models.  Each head of ABNet could learn safe control policies from different features and focuses on specific part of the observation. In this way, we do not need to directly construct a large model for complex tasks, which significantly facilitates the training of the model while ensuring its stable output. Most importantly, we can still formally prove the safety guarantees of the ABNet. We demonstrate the efficiency and strength of ABNet in 2D robot obstacle avoidance, safe robot manipulation, and vision-based end-to-end autonomous driving, with results showing much better robustness and guarantees over existing models.

ABNet: Adaptive explicit- Net for Safe and Scalable Robot Learning
Wei Xiao Tsun-Hsuan Wang!
Chuang Gan Daniela Rus
Abstract
train (Pereira et al., 2020) (Xiao et al., 2023) (Wang et al., 2023b). It is desirable to merge these models we can get better performance controllers in general (Beygelzimer et al., 2015) (Agarwal et al., 2020). Traditional mixture of expert methods (Shazeer et al., 2017) (Riquelme et al., 2021) (Zhou et al., 2022) or other merging approaches (Huang et al., 2023) (Ramé et al., 2023) (Wang et al., 2024) are not designed to retain the safety of the models. In this work, explore to leverage the collective power of many safety- critical models to handle complex tasks while preserving the safety of the models.
Safe learning is central to Al-enabled robots where a single failure may lead to catastrophic results. Existing safe learning methods are not scalable, inefficient and hard to train, and tend to generate unstable signals under noisy inputs that are challenging to be deployed for robots. To address these challenges, Seplicit-Barrier Net (ABNet) in which barriers explicitly show up in the closed-form model that guarantees safety. The ABNet has the potential to incrementally scale toward larger safe foundation models. Each head of ABNet could learn safe con- trol policies from different features and focuses specific part of the observation. In this way, we do not need directly construct a large model for complex tasks, which significantly facilitates the training of the model while ensuring its stable out- put. Most importantly, we can still formally prove the safety guarantees of the ABNet. We demon- strate the efficiency and strength of ABNet in 2D robot obstacle avoidance, safe robot manipulation, and vision-based end-to-end autonomous driving, with results showing much better robustness and guarantees over existing models!
propose Adaptive
There are various definitions of safety for robotics and au- tonomy, and safety can be basically defined as something bad never happens. Mathematically, safety can be defined as continuously differentiable constraint with respect the system state and it can be further captured by the forward invariance of the safe set over such constraint (Ames et al., 2017) (Xiao & Belta, 2021) (Glotfelter et al., 2017). In other words, we can use different constraints and approaches to enforce safety. The way we learn such safety enforcement methods may depend on the focused observation feature. For instance, some human drivers may focus on the left lane boundary in driving in order achieve safe lane keeping, while others may focus on the right lane boundary, shown in Fig. 1. Merging these models enables us to build ro- bust and powerful learning models. However, the adaptivity of the merging method to different safe models is crucial, especially in retaining safety.
1. Introduction
Robot learning usually requires to leverage scalable training and vast amount of data. There are many large models (Li et al., 2022) for complex robotic tasks including manipula- tion, locomotion, autonomous driving (Bommasani al., 2021) (Singh et al., 2023) (Wang et al., 2023a). However, these models are not trustworthy and have safety guar- antees. Existing methods that incorporate guarantees or certificates into neural networks are not scalable and hard to
In the literature, differentiable Quadratic Programs (dQP) (Amos & Kolter, 2017) and differentiable Model Predictive Control (dMPC) (Amos et al., 2018) are widely used for safe robot learning. However, dMPC is restricted to lin- ear systems with linear constraints. Barrier-based learning methods (Robey et al., 2020) (Pereira et al., 2020) (Srini- vasan et al., 2020), such as the BarrierNet (Xiao et al., 2023) (Wang al., 2023b) (Liu et al., 2023), are widely used to transform nonlinear problems into dQPs and can equip deep learning systems with safety guarantees. However, there are several limitations of these learning methods: (i) they are involved with solving batch QPs during training, which is inefficient, and dQPs tend to give awful solutions that signif- icantly deteriorate the model; (ii) they can only implement single safety enforcement method as the last layer of the neural network, which is not scalable to larger safe learning
Computer Science and Artificial Intelligence Lab, MIT, USA UMMss Amherst and MIT-IBM Watson Al Lab, USA. Correspon- dence to: Wei Xiao <weixy @ mit.edux.
Proceedings of the 42nd International Conference on Mochine Learning, Vancouver, Canada. PMLR 267, 2025. Copyright 2025 by the author(s).
Code is available at: https: http///gtttttt/te// com wwt.//oi////////o Wxxxy11/ ABNet

---

ABNet: Adaptive explicit-Barrier Net for Safe and Scalable Robot Learning
An Efficient Safety- Guaratted Learning System with Scalability
Cross connection
Observation
Outputs (Controls)
variables
Gate
Focus
Linear
different parts
CNN
NN: LSTM, etc.
Adaptive explicit-Barrier Net[ABNet]
The proposed ABNet that is efficient, scalable and generates stable output while guaranteeing safety for robots. Each head of ABNet the model could learn safe control policies with focus on different observation feature in scalable or one-shot/direct manner. Barriers play the role of gates in determining the closed-form safe control and are more interpretable.
Figure 1:
models; (iii) these methods tend to generate unstable output under noise, which cannot be deployed for robots.
in vision-basse based driving).
2. Problem Formulation
In this paper, we propose the Adaptive explicit-Barte Barrier Net (ABNet) to merge many safety-critical models while pre- serving the safety guarantees. The ABNet efficient, scal- able, robust to noise, and easy be trained in an incremental manner. As shown in Fig. 1, we may build multi-head mod- els within the ABNet. Each head of the ABNet may pay attention to different observation features to generate safe control policy. We combine the outputs of all the safe learn- ing models a way that provably safe. The weights of this combination quantify the importance of each head of the model, and they are trainable. The structure of the ABNet allows to build larger safe foundation models for complicated robotic applications as we can incrementally train safe models corresponding to different robot skills and this will simply increase the head h of the ABNet.
We consider the following safe robot learning problem:
Problem. Given (a) a robotic system with dynamics; (b)
state-feedhack nominal controller π (x=) = ux" (such as model predictive controller) that provides the training label; (c) a set of safety constraints b,(#) > O. E S (bj is continuously differentiable, S is constraint set); (d) neural network controller x(x, 2 = parameterized by 0 (under observation z);
Our goal is to find the optimal parameter
(I) while satisfying all the safety constraints in (c) and the dynamies constraint (a). E is the expectation, and E is loss function.
e argmin Ex. [elx===[['' ((x)
In summary, we make the following new contributions:
We propose a novel Saplicit-Barrien model that shows su- perior performance in stable training and computation than dQP (Amos& & Kolter, 2017) and BarrierNet (Xiao et al., 2023) while guaranteeing safety of robot learning, and the explicit- Barrier model is crucial to build larger models via merging due to its high-efficiency in dealing with nonlinear systems and constraints.
3. Adaptive Explicit- -arriirr Net
In this section, we present the architecture of the Adaptive Appicit-Barrier Net (ABNet) and formally prove its safety guarantees in learning systems.
Our proposed method can fuse machine learning models that can strictly enforce system safety. In the literature, to make the safety model trainable without losing guarantees, we would usually require the model to be in the form of differentiable convex optimizations, such as differentiable QP (Amos & Kolter, 2017), differentiable MPC (Amos et al., 2018) or differentiable CBF (Xiao et al., 2023). In the former two cases, the considered robot learning prob- lems are usually with linear dynamics and linear constraints. Otherwise, the optimization becomes nonlinear (i.c., not trainable in neural networks). Although one can transform constrained optimizations into unconstrained optimizations that are trainable using classical barrier functions (Boyd
We propose a novel ABNet that merges many safety- critical learning models, and this new model is scalable, robust, and easy to be trained.
We formally prove the safety guarantees of the proposed ABNet.
We demonstrate the strength and effectiveness of our model on variety of robot control tasks, including 2D robot obstacle avoidance, safe robot manipulation, and vision-based end-to-end autonomous driving in an open dataset. We also show that existing models/policies merg- ing could make safety worse in complicated tasks (such as
2

---

ABNet: Adaptive SxplicitBaariee Net for Safe and Scalable Robot Learning
Vandenberghe, 2004), it may make the system lose safety guarantees.
dMPChead
Input: ((x1)
BarrierNet head
n
14
Explicit-Barrier 1
Whh
3.1. Multi-head Explicit-Barris Barrier
U22
W22
14
We focus on general safe robot learning problems with non- linear dynamics and constraints. For such problems, it has been shown that duce nonlinear optimizations onto quadratic optimizations with safery guarantees (Ames et al., 2017) (Xiao & Belta, 2021), which gives rise to the so-called BarrierNet (Xiao et al., 2023).
Input: Pm (11%))
W
Outputs [Controis)
use the CBF transformation to re-
Input: (e..))
Gate: 2, (xx),
Figure 2: Architecture of multi-head explicit- barriers. AB- Net is capable (adaptive) to fuse any safe learning models, such as the proposed etc. The ABNet is usually used in conjunction with any other neural networks and can be implemented in parallel. The parameters (inputs) of each head of ABNet are the out- puts of previous layers (such as CNN or LSTM).
BarrierNet, dMPC,
Specifically, consider robot dynamics as: Φ f(x) g(ar),,, where IR" is the robot state, f: R R and 8: _8 + +x*x are locally Lipschitz, and u E R2 is the con- trol. We can also consider non-a affine control systems by defining auxiliary systems (Xiao et al., 2021).
Caplicit--Brries The constrained optimal control in the considered problem in Sec. 2 is then transformed into the following differentiable CBF/BarrierNet (Xiao et al., 2023), which may form head of the model:
solving batch QPs (Amos & Kolter, 2017), which is ineffi- cient. Since CBFs do not explicitly show up in the solution, we call differentiable CBF (3) as implicit-barrier. barrier. In the following, we derive the trainable explicit solution of the differentiable CBF, which is our proposed explicit-barrier.
ukg = arg min 1 = (1))) (z)(0)))))
u(2) 2
(2) Explicit-Barrier has been shown in (Luenberger, 1997) that we can find the explicit solution of QP if there only two constraints. As the cardinality of the safety constraint set S may be greater than two, the number of HOCBFs in the differentiable CBF (3) will also be greater than two. In order to address this, first, we can define two safety functions (x() = -In(Ej exp(-b,(ar)) and bur(xr) = -in(Ejes, exp( (x((), where S= Si USz By (Boyd & Vandenberghe, 2004), we have that maxjesby S (xx))e))p(b(())) It can be easily shown that bx 2 and bn)(a:) 2 O implies (xx)) 2 0, OS..ES.
s.t.
Lf 1 (1 O,JES,
+ Pmmd
V,,(2,=10,,) = 1z
+p 2)0(1r,200,) bb)
(I....,m m- je,
(3) where 11(z)(0))) E R4x4 is positive definite, and (z. 0y.x) can be interpreted as reference control (the output of previous network layers). The con- straints above are the High-Order CBFs (HOCBFs) con- structed in enforcing the safety constraints b;(x)= 2 of relative degree m m(iiao& & Belta. 2021). It can be shown that the satisfaction of the first HOCBF constraint in the above implies the satisfaction of (zx)) 0, E S, which proves the safety of differentiable CBF In the above, Ly =
Alternatively, we can simply consider the two most risk safety specifications, i.e., by(x)) = min b (x), by((x) = mi aig (x(x)) bx(x). This approach is simpler and it works well for most obstacle avoidance tasks.
Then, the explicit optimal solution of the differentiable CBF with the above two safety specifications can be given by
dy xx fxx Lg V = (x)) k f1,...,, I.). and h is the number of heads (as shown in Fig. 1). p; > 0,i (l....,m- 1]. P.. 2 0 are penalty functions (out- puts of the previous network, as shown in Fig. 2) on
"R = 11) Lg V m (xx
(4)
- -22(x)H Lg Vm-mm1 - H
where H,F are given as (2) with arguments omitted. 2 (z) < 0,A2(z) S 0 are two gate functions ((14), (15) given in Appendix), and Vi- (2), Vi are the two HOCBFs corresponding to by bb)))b(()))))) defined similarly as in (3). As we can see that by bz) bu)))r)())) explicitly show up in the above equation while it guarantees safety, we call it explicit- explicit-Barrier. Barrier. This makes the -alriittBBariee more interpretable. The whole explicit solution derivation process is given in Appendix Sec.
the strictly increasing and tero-passing functions Cj,, E (I.....m). mm. E S, and will determine the conservativeness of the robot. 0 := (0,, k f 6TT 0p),k hh, where 0, = (0) ., 1) are all trainable parameters. z is the observation of the head k, and it is possible that all heads share the same observation, i.e. 2 = 2, Vk E 41.
The training of the above differentiable CBF (3) involves
3

---

ABNet: Adaptive explicit-Barriet Net for Safe and Scalable Robot Learning
Adaptive mechanism. Each head of ABNet may learn different safe control policies even if all the heads have the same observation 2. The benefit is that the final per- formance is achieved "collectively" by all heads and thus each head can just focus on the "subproblem" " with safety. Alternatively, we may also make each head of ABNet focus on different observations Zg. The observation ze may come from different parts of the sensor observation (such as the left lane boundary and right lane boundary in driving shown in Fig. 1), or even different perceptions (such as vision, lidar, etc.)
Algorithm 1 Construction and training of ABNet
Input: the problem setup (a)-(d) given in the problem formulation (Sec. 2).
Output: a robust and safe controller u for the system. (a) Formulate each head of explicit-Barriers as in (4),
(b) Build the cross connection among explicit-Barie Barriers
via pi(z 0)), E (I....., m-1). 1).
(c) Fuse all the heads of explicit- explicit-Barriers Barriers as in (5).
if Incremental training then
Decouple pi(z 0)), i {I....,m m 1} and define them for each explicit- Barrier. aaplicttBBarrier
Cross connection. It can be noted from (3) that each head of ABNet & E (I....,h) h}} has some cross connection with other heads, as also shown in Fig. 1. In other words, W),((,, = 20p)), ( j E S are formulated in the same way through the shared parameter 0, (independent from k). This is to ensure (i) the construction for provable safety (as shown later), and (ii) some shared information across different heads of ABNet as they all generate safe controls for the robot.
Train each head of explicit-Barriers respectively.
Choose a pr 0)). i (1,...,, m 1} from one of the
explicit-Barrie Barciers to build cross connection.
Fuse all the else
Barriers via (6).
Directly train the ABNet via reverse mode error back propagation.
end if
Fusion. Another important consideration is how should we fuse all these controls uR,k {I,...,h} while preserving the safety property of each head of the ABNet. We propose the following form:
ABNet can generate smooth signals.
Theorem 3.2. (Safety of merging of ABNets) Given two ABNets, the merged model using the form as in (5) again guarantees the safety of system.
h Σ
h where Σ Wk 1.
3.2. Model Training
The ABNet can be trained incrementally or in one-shot. This is due to the fact that each head of ABNet can generate control policy that is applicable to the system. The linear combination weights wa,k E (I....,h} in the ABNet denote the importance of the corresponding control policies.
In the above, w& 2 O,KE E {I.....h} h are trainable parameters. The composition of uplicit-Barrier (4), BarrierNet, and dMPCs, etc, in the form of (5) is our proposed ABNet, as shown in Fig. 2. The safety guarantees of the ABNet is shown in the following theorem:
Incremental training, In ABNet, we may train each head k, E (1.....h) ..) of the model in a scalable way as we wish to minimize the loss between their output uq and the label u" as well. The training can be done by directly incorporating the explicit- Barrier (4) into the model. There are some cross connections via (z(26p) between explicit- Barriers in the sxpicit-Barriers ABNet that may prevent the implementation of the training. We may address this by training a p=(=(0p) for each head of the ABNet. After we train all heads of the model, we may fix the parameters of those models, choose a pi(2 (0p) from one of the explicit- explicit-Barriers Barriers (or take average of all pi(z (pp) among the models) to build the cross connection, and train the weights w/ for some more iterations. Another way is to fuse these explicit-Barries by testing loss. In other words, the weight wy.k E (I, can be determined by:
Theorem 3.1. (Safety of ABNets) Given the multi-head ABNeI formulated as in (4) and all other safe learning mod- els (BarrierNet, dMPC, etc.). If the system is initially safe (i.e., by(x((o))= 2 0,Vj S), then a control policy u from the ABNet output (5) guarantees the safety of system, i.e.,
b)()(1))= 0, Vj S, Vi 2 to-
All the proofs for theorems are given in Appendix B. If the system is not initially safe (i.e., ((o) < 0, E S), then the system state x will be driven to the safe side of the state space due to the Lyapunov property of CBF/HOCBFs (Ames et al., 2017) (Xiao & Belta, 2021). This enables the possibility of utilizing data that violates safety to conduct adversary training of the ABNet.
Natural noise filter. The ABNet is a natural noise filter since W& E [0, 11. Ak E (1,...,,) .h in (5). This can ensure that the output u of the model is stable with large enough head number h if all the heads have different observation 2₁ for the current environment. This feature makes ABNet a very robust and adaptive controller for robotic systems, and thus,
1/4x(ux, u²)
W'- = E/ 1/f((uu,))))))
(6)
where lg is a loss function.
If we already have some trained ABNet, and we wish to
4

---

ABNet: Adaptive explicit-Barrii Net for Safe and Scalable Robot Learning
ch-aarter
0.14
0.6
distrbuhos
0.12
Storiing (o/(k/))))
48%c
48% 20
0.10
ABINET 200
Computation
Aoree dirritution
0.08
0.0
0.06
0.04
-0.2
-0.4
0.00
1024
10
Batch size
time//
Steerlnn uncertainty
Accoleration uncertairty
Training time thour)
0.06
0.02
6.307
0:25
0.00
100
0.0
0.5
1.0
3.5
2.0
2.5
3.0
num of heads
Jog log number of BarrierNet heads with scalable training
Figure 3: Computation (upper, numbers in the bracket de- note variance) and training efficiency (lower, numbers in the bracket denote testing loss) comparison of proposed explicit-Bariie Barrier (ABNet) with dQP and BarrierNet (BNet). The use of dQP in BarrienNet could give very bad solutions. NN is normal neural network without safety guarantees.
Figure 2D robot obstacle avoidance closed-loop testing control profiles (upper) and ABNet performance with the increasing of ABNet heads using scalable training (lower). This scalable training for ABNet is with safety guarantees. The controls are subject to input noise, and thus are non- smooth.
How does the proposed explicit- explicit-Barrier Barrier compare with dQP (Amos & Kolter, 2017) and BarrierNet (Xiao & Belta, 2021) in terms of computation and training efficiency?
add some new capabilities (such as safe driving by only focusing on the left lane boundary) to the model, then we
can train some heads of ABNets based on the new data we have. Finally, we can fuse the models similarly with
Does our method match the theoretic results in experiments and is it scalable?
safety guarantees shown in Thm. 3.2. This shows the
scalability of the proposed ABNet that allows to build larger foundational safe models in an incremental way.
How does our method compare with state-of-the-art mod- els in enforcing safety constraints?
One-shot/Direct training. The one-shot training of the AB- Net can be directly done using the traditional reverse mode automatic differentiation. addition to the loss between the eventual output of the ABNet and the label u², we may also consider the losses on u. {l..... h). as well the reference controls H (z F 0f,x), in order to improve the training performance.
The benefit of models/policies merging and the robustness of our models safety and smoothness?
Benchmark models: We compare with (i) baseline: Ta- bles 1, 2-single end-to-end learning model (E2E) (Levine et al., 2016) and Table 3-single vanilla end-to-end (V-E2E) model (Amini et al., 2022), (ii) safety guaranteed models: (implicit-) BarrienNet (BNet) (Xiao et al., 2023), Deep for- ward and backward (DFB) model (Pereira et al., 2020), (iii) policies merging: BarrieNNet policies merged with uncer- tainty propagation (BNet-UP) (Wang al., 2023b) that employs Gaussian kemels with Scott's 's rule (Scott, 2015) to select the bandwidth, (iv) models merging: E2Es merged with Monte-Cand Carlo Dropout (E2Es-MCD) (Gal & Ghahra- mani, 2016), E2Es merged with Deep Resembles (E2Es-DR) (Lakshminarayanan al., 2017).
The construction and training of the ABNet involve the formulation of each head explicit-Barrice as (4), the model fusion as in (5), and the scalable direct training as shown above (Alg.
4. Experiments
In this section, we conduct several experiments to answer the following questions:
5

---

ABNet: Adaptive SsplicitBBarrie Net for Safe and Scalable Robot Learning
Table 1: 2D robot obstacle avoidance closed-loop testing under noisy input.
MODEL
SAFETY
CONSER.
MSE(L)
M1 UNCER-
N2 UNCER-
THEORET.
(2 0)
(2 (200/) !)
TAINTY (U)
TAINTY (L)
GUAR.
B2B (LEVINE ET AL., 2016)
-40.140
-2.976+3.770 0.007+10.004
0.063
0.049
X
E2ES-MCD (GAL &
-2.087
- -1.341+0.824
0.004+0.001
0.041
0.026
X
GHAHRAMANI, 2016)
E2ES-DR (LAKSHMINARAYANAN ET AL., 2017)
-35.130
3.116:14.299
0.080:10.006
0.032
0.020
DFB (PEREIRA ET AL., 2020)
36.659
47.810=4.377
0.013+00003
0.062
0.052
V
V
BNET (XIAO AL.,, 2023)
5.045
7.966 1.287
0.014+0.006
0.074
0.047
BNET-UP (WANG ET AI.., 20238)
5.988
8.573+1.738
0.008
0.054
0.028
X
ABNET- (OURS)
5.731
6.269-10.319
0.011+00000
0.065
0.027
V
ABNET- 10 (OURS)
12.639
13.887=1.323
0.0081:00005
0.049
0.030
ABNET-100 (OURS)
10.122
11.729-0.816
0.012+:00006
0.049
0.013
Our models: We consider the minimum function method in determining by (xx) and ()). Sec. 4.2 and 4.3: ABNet trained in a scalable way with 10 heads (ABNET-1O-SCH, ABNet trained in one shot with 10 heads (ABNET-10), AB-
4.2. 2D Robot Obstacle Avoidance
We aim to find a neural network controller for a 2D robot that can drive the robot from an initial location to an ar- bitrary destination while avoiding crash onto the obstacle. All the models (h copies/heads) have the same input (with uniformly distributed noise, 10% of the input magnitude in testing). The detailed problem setup and model introduc- tions are given in Appendix C.2.
Net trained in one shot with 100 heads (ABNET-100). Sec.
4.4: our ABNet trained in shot with 10 heads using the same input images (ABNET), ABNet with attention images and 10 heads (ABNET-ATT), our ABNet first trained with ABNET scaled by ABNET-ATT (20 heads, ABNET-SC).
The evaluation metrics are defined as follows: mean square error of the model testing (MSE), satisfaction of safety constraints where non-negative val- mean safety guarantees (SAFETY), system conserva- tiveness (CONSER.), steering control иj uncertainty (u) UNCERTAINTY), acceleration control U2 uncertainty (u2 UNCERTAINTY), and theoretical safety guarantees (THE- ORET. GUAR.) respectively. The metrics are explicitly defined in Appendx C.
Evaluation metrics:
Destiaadan
BrG
Maniulattor
ABlle
AR3ee 330
x/m
4.1. Computation and Training Time
We first compare the training stability and efficiency of our proposed Applictt-Barries (or ABNet) with dQP (Amos & Kolter, 2017) and BarrierNet (Xiao et al., 2023). The dQP method is based the "QPFunction" library from OptNet (Amos& & Kolter, 2017), and BarrierNet is based on dQP. The computation times under different batch sizes are shown in Fig. 3 (upper). The computation time significantly increases as the increasing of the batch size, but the proposed explicit- Barrier remains to be efficient. Fig. (lower) shows the training time (of the model based on the 2D robot case in Sec. 4.2) under different number of heads. The training time of our proposed ABNet is comparable (NN is without safety guarantees). While the BarrierNet (based on dQP) tends to give very bad training and testing solutions, as also shown in Fig. in the Appendix, which significantly deteriorates the quality of model training.
Angular sccokiratonn os uncortainy
feguter inceciany
0.010
MSt
0.008
Metrics
0.006
6.0
0.5
2.0 2.5 3.0
Aeglh log number of BarrierNet heads with scal abla training
Figure 5: Robot manipulation closed-loop end-effector tra- jectories (upper) and ABNet performance with the increas- ing of model heads using scalable training (lower). The transparent trajectories in the upper figure are correspond- ing to results all runs.
normal NN
Models/policies merging can improve the performance as
6

---

ABNet: Adaptive Syplict-Baariee Net for Safe and Scalable Robot Learning
Table 2: Robot manipulation closed-loop testing under noisy input and comparisons with benchmarks.
MODEL
SAFETY (2 0)
CONSER.
MSE(L)
"1 UNCER-
i2 UNCER-
THEORET.
(2 0& !)
TAINTY (4)
TAINTY (4)
GUAR.
E2E (LEVINE ET AL., 2016)
-11.027
1.082:1.992
3.6e-411.7e-4
0.013
0.009
X
E2Es-MCD (GAL &
-1.827
0. 0.162:220855
1.le-447.3e-5
0.008
0.005
X
GHAHRAMANI, 2016)
E2Es-DR (LAKSHMINARAYANAN ET AL.., 2017)
11.381
-0.958 1.875
1.3e-418.5e-5
0.007
0.005
X
DFB (PEREIRA ET AL., 2020)
2.905
6.023#3.110
8.7e-4+1.9
0.019
0.018
V
BNET (XIAO ET AL., 2023)
0.147
0.755
2.3e-411.2e-4
0.010
0.009
V
BNET-UP (WANG ET AL., 2023B)
0.206
0.346:0.008
5.2e-513.2e-5
0.005
0.005
X
ABNET- 10-SC (OURS)
0.233
0.570+0.360
5.9e-5+5.5e-5
0.006
0.005
V
ABNET- 10 (OURS)
0.039
0.272::0.443
1.2e-419.6e-5
0.008
0.007
ABNET- 100 (OURS)
0.053
0.123-10.177
1.ee-41444-5
0.005
0.004
shown by the MSE metrics in Table I and the scalable train- ing in Fig. 4. Note that our scalable training for ABNets has safety guarantees. The DFB tends to be very conserva- tive as the CBFs within which are not differentiable, which presents a high conservative value shown in Table Our proposed ABNets can significantly reduce the uncertainty of the outputs (controls) under noisy input while guaranteeing safety, and this uncertainty decreases the increases of the heads in the ABNets, as shown by the last two and three columns in Table 1, as well as shown in Fig. 4 and of Appendix C.2 where the control uncertainty of ABNet-100 is lower than the one of BNet. The smoothness of the con- trols also increases with the increase of model heads (e.g.. blue from ABNet v.s. red from BNet in Fig. 8). In terms of performance, our proposed ABNets can also improve the testing errors compared to BNet and DFB, as shown by the MSE in Table 1. The E2Es-MCD model can achieve the best performance, but this is at the cost of safety (the SAFETY metric in Table 1 is negative, which implies violated safety).
Table 2, the proposed ABNet-100 model is the least con- servative one with the lowest control uncertainties as well under noisy inputs (significantly improved compared with BNet and DFB), which demonstrates its advantage over other models. This uncertainty improvement is also shown by the control distributions in Fig. in Appendix C.3 (BNet: red area v.s. ABNet- blue area). The BNet-UP achieves the best performance without safety guarantees.
4.4. Vision-based End-to-Enn Autonomous Driving
We finally test models in more complicated and real- istic task: vision-based driving, using open dataset and benchmark from the VISTA (Amini et al., 2022). One of ABNets, named ABNet-att, is constructed such that different heads focus on different parts of the image (left lane bound- ary, right lane boundary, etc., the corresponding images are shown in Fig 10 of Appendix C.4). For more experiment and model details, please refer to Appendix C.4.
As shown in Table 3, the proposed ABNets can avoid crash onto obstacles with 100% obstacle passing rate, including the ABNet-sc that is trained in a scalable way with two ABNets (also shown by the scalable training in Fig. 6). This is because the ABNets can learn the correct steering control (the blue and green sine waves shown in Fig. 11 (right) in Appendix C.4) avoid the obstacle without stopping in front it. Compared to the baseline MPC, the proposed AB- Net is much more efficient (0.004s v.s. 0,872s). Although linearization is possible in MPC to improve the efficiency, it may make the MPC lose safety guarantees. The DFB and BNet-related models learn a significant deceleration control (shown in Fig. 11) to avoid crashing onto obstacles. which explains why the corresponding obstacle passing rates low compared to other models in Table 3 and why the blue trajectories (BNet) terminate near the obstacle in Fig. 6 (upper). Nonetheless, there are still some crash cases in DFB and BNet models due to badly learned CBF parame- ters that make the inter-sampling effect (i.e., safety violation
4.3. Safe Robot Manipulation
In robot manipulation, we employ a two-link planar robot manipulator to grasp an object from an arbitrary point to an arbitrary destination while avoiding crashing onto obstacles. All the models (h copies/heads) have the same input (with uniformly distributed noise, 10% of the input magnitude in testing). We compare our proposed ABNets with the same benchmark models as in the last subsection. More detailed problem setup and model introductions are given in Appendix C.3.
Again, models/policies merging can improve the perfor- mance shown by the MSE metrics in Table 2 and the scalable training in Fig. 5. All the E2E-related models are not robust to noise and violate safety constraints (i.e., crash onto obstacles) under noisy input since there are no formal guarantees, and such an example is shown by the magenta trajectory curve of the end-effector in Fig. 5. As shown in

---

ABNet: Adaptive Syplictt-Barrie Net for Safe and Scalable Robot Learning
Table 3: Vision-based end-to-end autonomous driving closed-loop testing and comparisons with benchmarks. New items are short for obstacle crash rate (CRASH), obstacle passing rate (PASS).
MODEL
CRASH
PASS
SAFETY
CONSER. (2 (20& ))
#1 UNCER-
UNCER- TAINTY (4)
THEORET.
(U)
(t)
(2 0)
TAINTY (4)
GUAR.
V-E2E (AMINI ET AL., 2022)
6%
94%
-60.297
-0.60+221.15
0.443
0.222
X
E2ES-MCD (GAL& &
8%
92%
-60.566
2.211112..343
0,429
0.227
X
GHAHRAMANI, 2016)
E2ES-DR (LAKSHMINARAYANAN
9%
91%
-60.572
- -1,499121.500
0.431
0.224
X
AL., 2017)
DFB (PEREIRA ET AI.., 2020)
4%
39%
-18.114
-0.828+554444
0.513
0.125
BNET (XIAO ET AI.., 2023)
3%
33%
-16.694
4.882++4.817
0.724
0.385
V
BNET-UP (WANG ET AL., 2023B)
2%
35%
-23.252
-..190144.900
0.726
0.532
X
ABNET (OURS)
0%
100%
1.455
6.132:12.181
0.168
0.316
ABNET-ATT (OURS)
0%
100%
4.198
8.053+1.449
0.172
0.269
ABNET-SC (OURS)
0%
100%
2.221
7.224+1.667
0.130
0.256
between discretized times) serious. Most importantly, our proposed ABNet can learn less uncertain controls for this complicated task, as shown in Table 3, the scalable training in Fig. 6, and Fig. 11 (c.g., ABNet:blue or ABNet-attgreen area V.S. BNet: red area).
setting, as shown by the magenta (ABNet-att) and cyan (ABNet) trajectories in Fig. 6 (upper) and the green (ABNet- att) and blue (ABNet) areas in Fig, 11. Ablation studies on the robustness of our ABNets in terms of safety under high-noisy inputs (50% noise level) are given in Table 4 of Appendix C.4.
V-E2E
5. Related Works
35
ABNet
30
ABNet-att
Scalability, merging and uncertainty in safe robot learn- ing. Machine learning has been widely used in robot control (Bommasani et al., 2021) (Singh et al., 2023) (Wang et al., 2023a). However, there is increasing concern for machine learning, especially large foundation models, being used in robotics (Bommasani al., 2021). Mixture of expert meth- ods (Shazeer al., 2017) (Riquelme al., 2021) (Zhou et al., 2022) scalable but hard to retain the property (such as safety) of the models. The uncertainty resulting from noisy model input or dataset is preventing the deploy- ment to real robots (Loquercio et al., 2020) (Kahn et al., 2017). To address this, predictive uncertainty quantifica- tion (Gal & Ghahramani, 2016) (Lakshminarayanan et al., 2017), also model merging approach, has been widely adopted. It has been shown to work well in vision-based autonomous driving under noisy input (Wang et al., 2023b) using the Gaussian kernel with Scott's 's rule (Scott, 2015) to select bandwidth. The main challenge of this technique is that may make the system lose performance guarantees, such as safety. Other model merging approaches (Huang et al., 2023) (Ramé et al., 2023) (Wang al., 2024) do not preserve safety either. We address the uncertainty and scal- ablibity problem using the proposed ABNets with provable safety.
ABNct-sc
25
BNet-UP
BNet.
y(m)
20
Road boundaries
Obstacle
-25
-20
-15
-10
x(m)
Crash rabe
Rass rato
Acodie zlin uo220 unceriiitly
upa1D uncyrtienty
Uniorttan
number BorrerNettttttteeeeeee heads with scalable training
Figure 6: Vision-based end-to-end autonomous driving closed-loop testing trajectories in VISTA (upper) and AB- Net performance with the increasing of model heads using scalable training (lower). This scalable training is done by both the ABNet and ABNet-att in Table 3 with safety guar- antees.
CBFs and set invariance. In control theory, the set in- variance has been widely adopted to prove and enforce the safety of dynamical systems (Blanchini, 1999) (Rakovic et al., 2005) (Ames et al., 2017) (Xiao & Belta, 2021) (Xiao
The ABNet-att can learn more consistent autonomous driv- ing behavior than the ABNet due to the image attention
8

---

ABNet: Adaptive explicit-Barrie Net for Safe and Scalable Robot Learning
et al., 2023). The Control Barrier Function (CBF) (Ames et al., 2017) (Xiao & Belta, 2021) is such state of the art technique that can enforce set invariance (Aubin, 2009), (Prajna et al., 2007), (Wisniewski & Sloth, 2013), and trans- forms a nonlinear optimization problem to a quadratic prob- lem that is very efficient to solve. CBFs originates from barrier functions that are originally used in optimization problems (Boyd & Vandenberghe, 2004). However, the CBF tends to make the system conservative (i.e., at the cost of performance) in order to enforce safety, and it is not scalable to build large models. Our proposed ABNet can address all these limitations.
2020), and this can also be done in conjunction with AB- Net. Third, the model merging is done in the output space, future work will further focus model merging with safety guarantees in the parameter space. Finally, we will apply the proposed model in environments that involve contact handling, such as grasping.
Acknowledgements
The research supported in part by Capgemini Engineer- ing. It was also partially sponsored by the United States Air Force Research Laboratory and the United States Air Force Artificial Intelligence Accelerator and was accomplished under Cooperative Agreement Number FA8750- 10000-9----10000 The views and conclusions contained in this document are those of the authors and should not be interpreted as repre- senting the official policies, either expressed or implied, of the United States Air Force or the U.S. Government. The U.S. Government is authorized to reproduce and distribute reprints for Government purposes notwithstanding any copy- right notation herein. This research was also supported in part by the AT2050 program at Schmidt Futures (Grant G- 965 22-63172) 172), and by the ONR Science of Autonomy pro- gram N00014-23-1-2354.
Safety in neural networks. Safety is usually enforced us- ing optimizations. Barrier functions have been widely used in safe Reinforcement Learning (RL) (Tessler et al., 2018; Achiam et al., 2017). However, safety cannot be guaranteed in safe RI. as the barrier functions are used as part of the reward function (a soft constraint). Recently, differentiable optimizations show great potential for learning-basee con- trol with safety guarantees (Pereira et al., 2020; Amos et al., 2018; Xiao et al., 2023; Liu et al., 2023). The quadratic program (QP) can be employed as a layer in the neural net- work, i.e., the OptNet (Amos& & Kolter, 2017). The OptNet has been used with CBFs in neural networks as safe filter controls (Pereira et al., 2020), in which CBFs themselves are not trainable, which can significantly limit the learning capability. Neural network controllers with safety certificate training
Impact Statement
This paper presents work whose goal is to advance the field of Machine Learning. There are many potential societal consequences of our work, none which we feel must be specifically highlighted here.
have been learned through verification-in-the (Deshmukh et al., 2019: Zhao et al., 2021; Ferlez et al., 2020). However, the verification method cannot guarantee to cover the whole state space, and this method is also very computationally expensive. None of these methods are scal- able to larger models, and are subject to uncertainty, which the proposed ABNet can address.
References
Achiam, J., Held, D., Tamar, A., and Abbeel, P. Constrained policy optimization. In International conference ma- chine learning, pp. 22-31. PMLR, 2017.
6. Conclusions, Limitations and Future Work
We propose Adaptive explicit-Barrier Net (ABNet) that merges many safety-critical learning models while preserv- ing the safety in this paper. The proposed ABNet is efficient to train, scalable to build larger safe learning models, can achieve better performance, and is robust to input noise. We have demonstrated the effectiveness of the model on a se- ries of robot control tasks. Nonetheless, our model (and all the other barrier-based learning models (Ferlez et al., 2020) (Xiao et al., 2023)) still have few limitations motivating for further research.
Agarwal, N., Brukhim, N., Hazan, E., and Lu, Z. Boost- ing for control of dynamical systems. In International Conference on Machine Learning, pp. 96-103. PMIR, 2020.
Ames, A. D., Xu, X., Grizzle, J. W., and Tabuada, P. Control barrier function based quadratic programs for safety crit- ical systems. IEEE Transactions on Automatic Control, 62(8):3861-3876 2017.
Amini, A., Wang, T.-H., Gilitschenski, I., Schwarting, W. Liu, Z., Han, S., Karaman, S., and Rus, D. Vista 2.0: An open, data-driven simulator for multimodal sensing and policy learning for autonomous vehicles. In 2022 International Conference on Robotics and Automation (ICRA), pp. 2419 2226.2226..22 IEEE, 2022.
Limitations. First, all the ABNets have the same safety constraints. We will explore how to merge ABNets with different safety constraints in the future. Second, the ABNet also requires safety specifications that may be unknown in some robot control tasks, we may learn the safety specifi- cations from data (Robey et al., 2020), (Srinivasan et al.,
Amos, and Kolter, J. Z. Optnet: Differentiable optimiza-

---

ABNet: Adaptive SyplicttBBarrie Net for Safe and Scalable Robot Learning
tion layer in neural networks. In Proceedings of the 34th International Conference on Machine Learning- Volume 70, pp. 136-145, 2017.
Levine, S., Finn, C., Darrell, T., and Abbeel, P. End-to-end training of deep visuomotor policies. Jourmal of Machine Learning Research, 17(39)11-40, 2016.
Amos, B., Rodriguez, I. D. J., Sacks, J., Boots, B., and Kolter, J. Z. Differentiable mpe for end-to-end planning and control. In Proceedings of the 32nd International Conference on Neural Information Processing Systems, pp. 8299-8310. Curran Associates Inc., 2018.
Li, J., Li, D., Xiong, C., and Hoi, S. Blip: Bootstrapping language-imal image pre-training for unified vision- languaee understanding and generation. In International confer- ence on machine learning, pp. 12888-12900. PMLR. 2022.
Aubin, J.-P. Viability theory. Springer. 2009.
Liu, W., Xiao, W., and Belta, C. Learning robust and correct controllers from signal temporal logic specifications using barriernet. In 2023 62nd IEEE Conference Decision and Control ( (CDC), pp. 7049-7054. IEEE, 2023.
Beygelzimer, A., Hazan, E.,, Kale, S., and Luo, H. On- line gradient boosting. Advances in neural information processing systems, 28, 2015.
Blanchini, Set invariance in control. Automatica, 35(11): 1747-1767, 1999.
Loquercio, A., Segu, M., and Scaramuzza, D. general framework for uncertainty estimation in deep learning, IEEE Robotics and Automation Letters, 111311133600 2020.
Bommasani, R., Hudson, D. A., Adeli, E., Altman, R., Arora, S., von Arx, S., Bernstein, M. S., Bohg, J., Bosse- lut, A., Brunskill, E., et al. On the opportunities and risks of foundation models. arXiv preprint arXiv:2108.07255 2021.
Luenberger, D. G. Optimization by vector space methods. John Wiley & Sons, 1997.
Nagumo, M. Über die lage der integralkurven gewöhnlicher differentialgleichnngen In Proceedings of the Physico- Mathematicul Society Japan. 3rd Series. 24:551-559, 1942.
Boyd, S. P. and Vandenberghe, L. Convex optimization. Cambridge university press, New York, 2004.
Deshmukh, J. V., Kapinski, J. P., Yamaguchi, T., and Prokhorov, D. Learning deep neural network controllers for dynamical systems with safety guarantees: Invited paper. In 2019 IEEE/ACM International Conference on Computer-Aided Design (ICCAD), pp. 1-7, 2019.
Pereira, M. A., Wang. Z., Exarchos, I., and Theodorou, E. A. Safe optimal control using stochastic barrier functions and deep howward-bacwward sdes. In Conference on Robot Learning. 2020.
Ferlez, J., Elnaggar, M., Shoukry, Y., and Fleming, C. Shieldnn: A provably safe nn filter for unsafe nn trollers. preprint arXiv:2006. 205404 2020.
Prajna, S., Jadbabaie. A., and Pappas, G. J. A framework for worst-case and stochastic safety verification using barrier certificates. IEEE Transactions on Automatic Control, 52 10:1415-1428, 2007.
Gal, Y. and Ghahramani, Z. Dropout as a bayesian approx- Representing model uncertainty in deep learn- ing. In international conference on machine learning, pp- 1050-1059. PMLR, 2016.
imation:
Rakovic, S. V., Kerrigan, E. C., Kouramas, K. I., and Mayne, D. Q. Invariant approximations of the minimal robust positively invariant set. IEEE Transactions on automatic control, 50(3):0064411 410, 2005.
Glotfelter, P., Cortes, J., and Egerstedt, M. Nonsmooth barrier functions with applications to multi-robot systems. IEEE control systems letters, 1(2):310-33 100031152200000 2017.
Ramé, A., Ahuja, K., Zhang, J., Cord, M., Bottou, L.,, and Lopez-Paz, D. Model ratatouille: Recycling diverse models for -ut-of-distributtin generalization. In Inter- national Conference on Machine Learning, pp. 28656 28679. PMLR, 2023.
Huang, C., Liu, Q., Lin, B. Y., Pang. T., Du, C., and Lin, M. Lorahub: Efficient cross-task generalization via dynamic lora composition. arXiv preprint arXiv:2307.13269 2023.
Riquelme, C., Puigcerver, J., Mustafa, B., Neumann, M., Jenatton, R., Susamo Pinto, A., Keysers, D., and Houlsby, Scaling vision with sparse mixture of experts. Ad- vances Neural Information Processing Systems, 34: 8583-8595, 2021.
Kahn. G., Villaflor, A., Pong, V., Abbeel, P., and Levine, S. Uncertainty-aware reinforcement learning for collision avoidance. arXiv preprint arXiv: 182, 2017.
Lakshminarayanan, B., Pritzel, A., and Blundell, C. Simple and scalable predictive uncertainty estimation using deep ensembles. Advances in neural information processing systems, 30, 2017.
Robey, A., Hu, H., Lindemann, L.., Zhang, H., Dimarogonas, D. V., Tu, S., and Matni, N. Learning control barrier functions from expert demonstrations, In 2020 59th IEEE
10

---

ABNet: Adaptive explicit-Barriet Net for Safe and Scalable Robot Learning
Conference on Decision and Control (CDC), pp. 3717- 3724, 2020.
Xiao, W., Belta, C., and Cassandras, C. G. Adaptive con- trol barrier functions. IEEE Transactions Automatic Control, 6765):2277-2281, 2021.
Rucco, A., Notarstefano, G., and Hauser, J. An efficient minimum-time trajectory generation strategy for two- track car vehicles. IEEE Transactions on Control Systems Technology, 23(4):1505-1519, 2015.
Xiao, W., Wang, T.-H., Hasani, R., Chahine, M., Amini, A., Li, X., and Rus, D. Barriernet: Differentiable control barrier functions for learning of safe robot control. IEEE Transactions on Robotics, (928922299--
2023.
Scott, D. W. Multivariate density estimation: theory, prac- fice, and visualization. John Wiley & Sons, 2015.
Zhao, H., Zeng, X., Chen, T., Liu, Z., and Woodcock, J. Learning safe neural network controllers with barrier cer- tificates. Form Asp Comp, 33:437 2021.
Shazeer, N., Mirhoseini, A., Maziarz, K., Davis, A., Le,
Q. Hinton, G., and Dean, J. Outrageously large neural networks: The sparsely-gated mixture-of-experts layer. arXiv preprint arXiv: 1eee1170116633 2017.
Zhou, Y., Lei, T., Liu, H., Du, N., Huang, Y., Zhao, V., Dai, M., Le, Q. V., Laudon, J., al. Mixture-of- experts with expert choice routing, Advances in Neural 2022.
Singh, I, Blukis, Mousavian, A., Goyal, A., Xu, D., Tremblay, J., Fox, D., Thomason, J., and Garg, A. Prog- prompt: Generating situated robot task plans using large language models. In 2023 IEEE International Conference on Robotics and Automation (ICRA), pp. 11523-11530. IEEE, 2023.
Information Processing Systems,
Srinivasan, M., Dabholkar, A., Coogan, S., and Vela, A. Synthesis of control barrier functions using a supervised machine learning approach. In 2020 IEEE/RSJ Inter- national Conference on Intelligent Robots and Systems (IROS), pp. 7139-7145, 2020.
Tessler, C., Mankowitz, D. J., and Mannor, S. Re- ward constrained policy optimization. arXiv preprint arXiv: 1074, 2018.
Wang, L., Zhao, Du, Y., Adelson, E. H., and Tedrake, R. Poco: Policy composition from and for heterogeneous robot learning. arXiv preprint uxXiv:240..05511 2024.
Wang, T.-H., Maalouf, A., Xiao, W., Ban, Y., Amini, A., Rosman, G., Karaman, S., and Rus, D. Drive any- where: Generalizable end-to-end autonomous driving with multi-modal foundation models. arXiv preprint arXiv:23 10.1742, 2023a.
Wang, T.-H., Xiao, W., Chahine, M., Amini, A., Hasani, R., and Rus, D. Learning stability attention in vision- based end-to-end driving policies. In Proceedings of The 5th Annual Learning for Dynamics and Control Confer- ence, volume 211 of Proceedings of Machine Learning Research, pp. 1099-00110 1119. PMLR, 15-16 Jun 2023b.
Wisniewski, R. and Sloth, C. Converse barrier certificate thcorem. In Proc. of 52nd IEEE Conference Decision and Control, pp. 4713 4718- Florence, Italy, 2013.
Xiao, W. and Belta, C. High-order control barrier functions. IEEE Transactions on Automatic Control, 67(7)36655- 3662, 2021.

---

ABNet: Adaptive explicit-Barrier Net for Safe and Scalable Robot Learning
A. Closed-form Solution of the Explicit- Explicit-Barrier
Here, we show the process deriving the closed-form solution of the explicit-Banie following (Luenberger, 1997) (Ames al., 2017).
Similarly in (3), we consider the following optimization (with the two specifications bu()) shown in the main text) corresponding to the explicit-Barries
1
u. - arg min 2 11 (aa (z)(0))))) wit)
s.t.
Vt (x, 0p) L m (z, 0p)) + Pm. (2x 17 (mm 2
Vy (2,, LLg V/ =1,)] + Pmn (2 ( 2 0,
We first define
(x) = LLg 82(x) = 1 - h2(2) = L, (2) (p Pm, Zz 07 U41 V/r (xc 16))
(x) = L, 0p) Pm Pm 07x 01 (1 ( 2(0p))
(8)
The matrix H is positive definite in the above optimization (7), we then define
&8 (x)), = (=x 0px)
[g] (2)).))(())))
(x) (2(x))
hi (x)
(x))
(9)
h2)
82(x)²
where
û = (2 0p.A)
Fz (r..)))))
(10)
Next, let 0= ut- úg and (.-)) define an inner product with weight matrix Z (m.x) so that (1x, (6)
(z 1,,x)
The optimization problem (7) equivalent to:
vx = arg (U;, UR)s
s.t., (z), vz) s (x), (82(2)), mL) hr(m=).
(11)
Finally, we have that the optimal solution of (7) is given by
Uk 0 ugg-
(12)
Let = (((()). solution of to (11) is given by
1,2 2 is the Gram matrix. Following (Luenberger, 1997) [Ch. 3], the unique
J = (x) +2(2))22()))
(13)
where the two gate functions 2, (2x) are given by:
0
if G21 (an(a))ma(((())00)-Gz()))
(x)
max(h (=)..)
(=))
if Giz(#) max( Gn
(14)
(Go (2 (G
otherwise.
Gj [1 Gnn]
if Gz)()) (
(x
if Gi2(#) Gaz(m))mx(hpn max(h (æ). (n(()))2(z) <0
(15)
max (a)))) Gna
otherwise.
Gnle)ozzee G2111)
12

---

ABNet: Adaptive Ssplicit-Barries Net for Safe and Scalable Robot Learning
B. Proof of Theorems
Theorem 3.1. (Safety of ABNets) Given the multi-head ABNet formulated as in (4) and all other safe learning models (BarrierNet, dMPC, etc.). If the system is imitially safe (i.e., by (z(()) 2 0,Vj E S), then a control policy u from the ABNet output (5) guarantees the safety of system, i... b)(x(r)) 2 Vj S, Vr 2 to-
Proof: The proof outline is to first show the existence of new HOCBF constraints (corresponding to all the safety specifications) that are defined over the output of the ABNet. Then, we can use Nagumo's 's theorem (Nagumo, 1942) to recursively show the forward invariance of each safety set in the HOCBFs, and this can eventually imply the satisfaction of the safety specifications b, (x: 2 O, S.
First, we show how we may ensure the safety of ABNet when there are other safe learning models, such as BarrierNet, dMPC, etc. Given a safe learning model, we have that by(x) 2 0, By the adaptive CBF theorem (Xiao et al., 2021), have that the satisfaction of the adaptive CBF constraint is a necessary and sufficient condition for the safety of the system. In other words, by 2 V,Vj implies that there exists an adaptive CBF:
j.m- m- (x, z ppp + M j- (ax 0p) + Pm, (m. jm -j ( z(0p)) E,
(16)
where Pm, (Zx 0%) > 0 is the penalty (adaptive) function, and Vim-i (z. = (0p) is defined as in (4).
Next, we consider the Aaplict--Barric model. As shown in Appendix sec. A, the explicit- barrier (4) the exact solution of the QP (7). The solution of the QP (7) further implies the satisfaction of by(x)) 2 0, b))(a) 2 by the HOCBF theory (Xiao
& Belta, 2021), which equivalent to have that (x(x) 2 Vj E S (shown right before (4)). Again, by the adaptive CBF theorem, have that there exist adaptive CBFs in the form of (16).
Finally, we only need to consider the case of fusing controllers ug. E (1,...,h) that satisfy the following:
Ly ( + W. 0p) ux + (= (0, 2 E,
(17)
Multiplying the weight w/ 2 0 to the last equation, we have
W + +
0p)] WaPPaa
(V) o,j
(18)
Taking a summation of the last equation over all & {l....,,h) kJ. the following equation establishes:
h
WyLy Wj 10) Σ wx Wimm 1(1
(19)
WsPm. 10mh) ( (1,x2 20.ees,
Since --m- (22, 21 (0ppi,r is vector that independent k and E We 1, the last equation can be rewritten as:
4pm 11)mm-1(x, - 0p)
w
(20)
W&Pma (V
O,jES.
The summation of class H functions is also class H function. Since aj.. class H functions, the Ei= W&Pm,x<z 1 ) jm (z 0,)) is also a class X function over Vim-i 0,). Therefore, equations (20)
the new HOCBF constraints defined over the output of the ABNet, i.e., Σk Well- In other words, whenever Wj (x, O, we have
h
Ly Vim- i 21p) Lg im (2, =|0,)
Σ Wall 2 20jES.
(21)
13

---

ABNet: Adaptive Sapriett-Barrir Net for Safe and Scalable Robot Learning
The controls (outputs of the ABNet) Σ waty directly used drive the system, and z is taken as a piece-wise constant within discretized time intervals (Xiao al., 2023). Therefore, the last equation can be rewritten
à pm 1(x, 0p) (f(z)
a y 11lm-1((2,))) 20pp 11im-1(2, 0, E
(22)
dx
dx
Since by (20()) 2 O, we can always initialize the HOCBF definition such that V) 2 is satisfied at to (Xiao & Belta, 10 By Nagumo's theorem (Nagumo, 1942) and (20)-(22), we have that ij.-- (z. pp) ) 2 0, 0,Vi 2 To-
Recursively, we can show that W),(x,2(6p) 2 0, Vr Z To. Vi E {0. {O....,m t} from m to O. Since by(x) V),((z,2 0p) by (3), we have that ()((()) 2 0, Vrr To. Vj E S, which the safety guarantees of the ABNet for the system.
Theorem 3.2. (Safety of merging of ABNets) Given two ABNets, the merged model using the form in (5) again guarantees the safety of system.
Proof: The proof outline is similar to that of Theorem 3.1. From each ABNet, we can show the existence of new HOCBF constraints (corresponding to all the safety specifications) that are defined over the output of each ABNet. Then we can again show the existence of another set of new HOCBF constraints (corresponding to all the safety specifications) that are defined over the output the merged ABNet. Finally, we can also use Nagumo's 's theorem (Nagumo, 1942) to recursively show the forward invariance of each safety set in the HOCBFs, and this can eventually imply the satisfaction of the safety specifications (z) 2 E.
The mathematical proof is similar to that of Theorem 3.1, and thus is omitted.
C. Experiment Details
Metrics used in all the tables. The SAFETY metric is defined as:
SAFETY = min min b(x(())),, E (I,...,N), relooT]]
(23)
where N is the number of testing runs (N 100 in this case). T is the final time of each b(x)) 2 0 is the safety constraint that is given explicitly in each experiment below.
The CONSER. metric is defined as
CONSER. mean mean min b(xx11)) (I...,,,); (E(ko.]
(24)
CONSER. std std min k( rE(t..]]
The UNCERTAINTY metric for both controls are calculated by:
Mj UNCERTAINTY = mean (std(u (l, NJ,,,.,,)),ie (1,2).
(25)
re|o.7]
All the class X functions in the BarrierNets/ABNets are implemented as linear functions with trainable slopes.
C.1. Training Stability and Efficiency
The dQP (Amos & Kolter, 2017) could give very bad solutions (although it still satisfies the safety constraints), as shown in Fig. 7 (right), this could significantly deteriorate the training quality of the model.
C.2. 2D Robot Obstacle Avoidance
Models. All the models include fully connected layers of shape [5, 128, 32, 32, 2] with RELU as activation functions. There are some additional layers of differentiable QPs in other models (other than E2E-related models). The model input the system state and the goal.
14

---

ABNet: Adaptive Sxplicit-Barrie Net for Safe and Scalable Robot Learning
0.12
train
100
train
0.10
80
0.08
Lo5s
Loss
60
0.08
40
20
1300
2000
2000
2500
time
time
Figure 7: Comparison of ABNet (left) and BarrierNet (right) (based dQP) in training stability. BarrierNet tends to give very bad solutions. "time" in the x-axis denotes training iterations.
Training and Dataset. The dataset includes 100 trajectories, and each trajectory has 137 trajectory points. The ground truth controls (i.e., training labels) are obtained via solving HOCBF-based QPs (Xiao & Belta, 2021). We use Adam as the optimizer to train the model with MSE loss function and a learning rate 0.001. We use the QPFunction from the OptNet (Amos& & Kolter, 2017) to solve the dQPs. The training time of the ABNet is about I hour for 20 epochs RTX-3090 computer.
Robot dynamics and safety constraints. We employ the bicycle model as the robot dynamics:
x(r) v(t) cos (r)
0
5(()
v(() sin (()
41 (1)
+
(26)
(()
O
(t(
v(()
(())
f())
g(m)
where (x.y) E R.2 denotes the 2D location of the robot, E R is the heading angle of the robot, v E R is the linear speed of the robot. U1, U2 are the angular speed and acceleration controls, respectively.
The safety constraint of the robot is defined as:
b(x) (x-xo) x0) 2 yo) R² 20,
(27)
where yo) E R the 2D location of the obstacle, and R > 0 is its size.
Acceleration control profiles. We show the acceleration control profiles in Fig. The corresponding uncertainty also significantly decreased with the proposed ABNet.
C.3. Safe Robot Manipulation
Models. All the models include fully connected layers of shape [6, 128, 256, 128, 128, 32, 32, 2] with RELU as activation functions. There are some additional layers of differentiable QPs in other models (other than E2E-related models). The model input is the system state and the goal.
Training and Dataset. The dataset includes 1000 trajectories, and each trajectory has about 350 trajectory points. The ground truth controls (i.c., training labels) are obtained via solving HOCBF-based QPs (Xiao & Belta, 2021). We use Adam as the optimizer to train the model with MSE loss function and a learning rate 0.001. We use the QPFunction from the OptNet (Amos & Kolter, 2017) to solve the dQPs. The training time of the ABNet is about 2 hours for epochs on a RTX-3090 computer.
15

---

ABNet: Adaptive explicit- Barrrerr Net for Safe and Scalable Robot Learning
14
Ground truth
12
distribution
Acceleration my (m/////
10
BNet-UP
ABNet-10-sc
0.8
ABNet-10
0.6
ABNet-100
ABNet-100 distribution
0.4
0.0
time/s
Figure 8: 2D robot obstacle avoidance acceleration control profiles and their distributions. The controls are subject to input noise, and thus are non-smooth, All the testings are done in a closed-loop fashion, i.e., the model outputs are directly used to control the robot.
Robot dynamics and safety constraints, We employ the following model as the manipulator dynamics:
@
0
0
0
1
0
+
(28)
@
0
0
0
0
1
f(x)
s(())
where (0), 02) E 2 denotes the angles of the two-link manipulator joints (defined in the Cartesian space, we may get the joint space angles 91 1,42 0₂ 01), (w) (2) E 2R2 the angular speed the two-link manipulator joints, u1 U2 are the angular acceleration controls corresponding the two joints, respectively.
The safety constraint of the robot is defined as:
b(xz) (41 cos 01 12cos O2 xo)² + (4 sin 0 12sin O2 2 22--R= R² 0,
(29)
where yo) 2 is the location of the obstacle, and R 0 is its size. I > 0,12 are the length of the two links of the manipulator, respectively. In the current setting, the non-collision of the end-effector implies the non-collision of the link. Therefore, we only need to consider the safety of the end-effector. We show both the 41 42 control profiles in Fig. 9 to demonstrate the advantage of the proposed ABNet. The metric definitions are the same as in the 2D robot obstacle avoidance, and the number of testing runs is N = 100.
C.4. Vision-based End-to-End Autonomous Driving
Models. All the models include CNN ([13, 24, 5, 2. 2), [24, 36. 5, 2, 21, [36, 48, 3, 2, 11, [48, 64, 3, 1, 11, [64, 64, 3, 1, IJI) and LSTT layers (size: 64) and some fully connected layers of shape [32, 32, 2] x2 with RELU as activation functions. The dropout rates for both CNN and fully connected layers are 0.3. There are some additional layers of differentiable QPs in other models (other than E2E-related models). The model input the front-view RGB images (shape: x x 155) of the ego vehicle, and the outputs are the steering rate and accelcration controls of the vehicle.
Training and Dataset. The dataset is open- sourced including 0.4 million image-control pairs from closed-road sim-to-real driving field. Static and parked cars of different types and colors are used as obstacles in the dataset. The dataset is collected from the VISTA simulator (Amini et al., 2022). The ground truth controls (i.c., training labels) are obtained via solving nonlinear model predictive control (NMPC). We use Adam as the optimizer to train the model with a MSE loss function and a learning rate 0.001. We use the OPFucction from the OptNet (Amos & Kolter, 2017) to solve the dQPs. The training time of the ABNet is about 15 hours for 5 epochs on a RTX-3090 computer.
16

---

ABNet: Adaptive Ssplicit-Barries Net for Safe and Scalable Robot Learning
Ground truth
Angular acceleration un Ara(/rd/ (*)
BNett
Blict distribution
Angular acceleration uz! Mr//vd//s
0.10
BNee-UP
ABNet-1D 10-sc
0.05
10
0.05
ABliet 100 distribttion
0.00
Ground truth
BNet
BNet distribution
-0.05
BNet-UP
ABNet-10-sc
ABNet-10
-0.10
ABNet-100
ABNet-100 distribution
time/s
time/s
Figure 9: Robot manipulation joint control profiles and their distributions. The controls subject to input noise, and thus non-smooth. All the testings are done in closed-loop fashion, i.e., the model outputs are directly used to control the manipulator.
Brief introduction to VISTA. VISTA a sim-to-real driving simulator that can generate driving scenarios from real driving data (Amini et al., 2022). The VISTA allows to train our model with guided policy learning. This learning method has been shown work for model transfer to full-scale real autonomous vehicle. There three steps generate the data: In VISTA, randomly initialize the locations and poses of ego- and ado-cars that are associated with the real driving data; (ii) we use NMPC to collect ground-truth controls (training labels) with corresponding states, and (iii) collect front-view RGB images along the trajectories generated from NMPC.
Vehicle dynamics and safety constraints. The vehicle dynamics are specified with respect to a reference trajectory (Rucco et al., 2015), such as lane center line. The two most important states are the -tajg-trajectrr progress E R and lateral offset distance IR of the vehicle center with respect to the trajectory. The dynamics defined as:
pcos(u+ T-ok vsin BB) Fcos(u+BB)
5
d
18
F T, sin B x 1-dk
(30)
112
8
1A
it
f(2))
((())
where is the local heading error of the vehicle with respect to the reference trajectory, v is the linear speed of the vehicle, k is the curvature of the trajectory at the progess s. I is the length of the vehicle from the tail to the center, 1 tan 8) where I is the length of the vehicle from the head the center. U1, U2 are the steering rate and arctan ,.
acceleration controls of the vehicle, respectively.
The safety constraint of the vehicle is defined as:
b(æ) (s 30) 2- (d -d)) 2-R²
R²
(31)
where do) E 2 the location of the obstacle in the curvi-linear frame (i.e., defined with respect to the reference trajectory), and defines its size that chosen such that satisfaction of the above constraint can make the ego vehicle avoid crashing onto the obstacle.
Closed-loop testing. We test all of our models in closed-loop manner in VISTA. In other words, each time step, we get the front-view RGB image observation from VISTA. Then, the model generates a control based on the image. Finally, the control is used to drive the "virtual" vehicle in VISTA. This process is done recursively until the final time. The total number of testing runs is = 100 for all the tables. The obstacles are randomly initialized (in uniform probability distribution) with lateral distance do ranges from =0. Im to 11.5. In Figs. and 11, the ego vehicle is randomly initialized with E (-0.5, 0.5mm (in uniform probability distribution).
17

---

ABNet: Adaptive explicit-Ban Barrierr Net for Safe and Scalable Robot Learning
Figure 10: Attention-base image observations for the ABNet-att model. From left to right and top to down: attentions on full image, left-most part, left lane boundary, lane center, right lane boundary, and right-most part.
Image observations for the ABNet-att model. We generate the intention-based observations as shown Fig. 10. Each of the attention images may play an important role specific driving scenario (e.g., attention on the left-most part may be crucial for sharp-left turn).
Acceleration control profiles. We present both the acceleration control and steering rate control profiles in Fig. 11. Both the BNet and BN models have forced the ego vehicle to have large deceleration instead of making it to pass the obstacle using the steering control when the vehicle approaches the obstacle. This can make the ego vehicle get stuck at the obstacles, and thus, the obstacle passing rate (as shown in Table 3) is low in these two models.
Ablation studies on the model robustness terms safety under noisy input. To further test the model safety robustness, we add random noise (50% magnitude the image values) to the image observations. The results are presented Table Our proposed ABNets can still guarantee the safety of the vehicle under noisy input (0% crash rate), while the crash rates using other models significantly increase except the DFB model. This is because the HOCBFs in the DFB model not trainable, and the corresponding parameters are fixed. Badly trained HOCBFs could make the method fail to guarantee safety due to the inter-sampling effect.
18

---

ABNet: Adaptive Appicit-Baariie Net for Safe and Scalable Robot Learning
Acceleration Uyl(mis*)
Steering rate Uz/(rad/s)
4
Biet distribttion
-2
Biket distribution
-3
BNel-UP
Bhet-UP
distribution
ABNiet
ABNet distribution
ABNet distrisution
-6
ABNiet-at att distribttion
Allhee--att distribution
2
4
8
10
10
time/s
time/s
Figure 11: Vision-based end-to-end autonomous driving closed-loop testing control profiles. The models directly take images as inputs, and output controls for the vehicle. All the testings are done in closed-loop in VISTA.
Table 4: Ablation study: vision-based end-to-end autonomous driving closed-loop testing under noise and comparisons with benchmarks. Items in the first row short for obstacle crash rate (CRASH), Obstacle passing rate (PASS), satisfaction of safety constraints where non-negative values mean safety guarantees (SAFETY), system conservativenes. (CONSER.), accelcration control uncertainty (4) UNCERTAINTY), steering rate control u2 uncertainty (u2 UNCERTAINTY) and theoretical safety guarantees (THEORET. GUAR.) respectively. In the model column, items are short for single vanilla end- to-end driving model (V-E2E), E2Es merged with Monte-Carlo Dropout (E2EE-MCCD) E2Es merged with deep resembles (E2Es-MERG)) deep forward and backward model (DFB), single BarrierNet (BNET), BarrieNNet policies with uncertainty propagation (BNET-UP), ABNet with 10 heads (ABNET), ABNet with attention images and 10 heads (ABNET-ATT), ABNET-SC denotes our ABNet first trained with ABNET-ATT scaled by ABNET (20 heads)respeettvely. The safety metric is defined as the minimum value of the safety specification by b)(x). j S among all runs. The conservativeness metric is defined as the mean (with std) of the minimum value (in each run) of the safety specification ( E S among all runs. The uncertainty metrics for both and un are measured by the standard deviations of the model outputs (two controls) among all runs.
MODEL
CRASH (L)
PASS (1)
SAFETY (2 0)
CONSER. (2 0& !)
#1 UNCER- TAINTY (L)
#2 UNCER- TAINTY (L)
THEORET.
GUAR.
V-E2E (AMINI ET AL., 2022)
31 %
69%
-59.455
8.932++9.744 14.11
0.529
0.239
E2Es-MCD (GAL& &
28%
72%
-58.405
-.116++20.802
0.524
0.232
GHAHRAMANT, 2016)
E2Es-DR (LAKSHMINARAVANNN ET AL., 2017)
27%
73%
-60.267
8.781++20.910
0.512
0.225
DFB (PEREIRA AI.,, 2020)
1%
37%
-13.281
0.256=1..348
0.482
0.127
BNET (XIAO ET AL., 2023)
23%
37%
-45.415
9.1144113.382
0.730
0.316
V
BNET-UP (WANG AL., 2023B)
24%
39%
-44.334
1..66111.116
0.747
0.278
ABNET (OURS)
0%
100%
4.268
8.31542.147
0.151
0.326
ABNET-AIT (OURS)
0%
100%
5.986
7.032-10.405
0.118
0.213
ABNET-SC (OURS)
0%
100%
4.118
7.515
0.128
0.255
19


Reviews:
[{"review_id": "gdMzA8iVpg", "reviewer": "Reviewer_KxjS", "summary": "The paper presents ABNet, a novel framework that utilizes attention mechanisms to handle diverse input patterns, while incorporating barrier functions to maintain the system state within a safety set, ensuring forward invariance. This approach aims to improve the scalability and robustness of robot learning by enabling each head of BarrierNet to focus on different aspects of the observation space, thereby facilitating the development of safe control policies in a variety of environments.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We appreciate the reviewer for all the positive and constructive comments.\n\n(1) Specific technical challenges\n\n**Response:** There are two main technical challenges: (a) The training and testing efficiency of the scalable robot learning model; (b) Formal proof for the safety of the composed model in scalable robot learning; \n\n(2) Innovative solutions to overcome these challenges\n\n**Response:** For challenge (a), we proposed the explicit-barrier approach (in which a closed-form solution for the QP is given)  to significantly improve the efficiency of the model, as shown in Fig. 3. For (b), we show the existence of a new HOCBF condition from the composed model, which has not been done in the literature ((21) of Appendix sec. B).\n\n(3) Distinctive advantages\n\n**Response:** The most distinctive advantages of the method is the safety guarantee, as shown in Tables 1-4 (SAFETY). This is also the main contribution of our work. We also show the improvement of performance with the increase of heads of explicit-barrier, as given in Figs. 4-6 and Table 3 (PASS).\n\n\n(4) Experiment are relatively simplistic, and lack qualitative analysis.\n\n**Response:** We have two intuitive experiments that are easy to understand (from dynamics, safety perspective). We also have one complex vision-based end-to-end experiment to show how our methods can work in realistic scenarios. We have shown qualitative analysis in Fig. 4, Fig. 8, 9, 11.  All the qualitative results are from videos, and we will attach them in the paper revision (the rebuttal only allows pictures). \n\n(5) Optimal performance: Is there a mechanism to balance performance and safety?\n\n**Response:** The objective of this paper is to show the safety instead of optimality. However, as we solve dQPs, we can indeed ensure optimal task performance. For applications where safety is not critical, we can relax the first condition in (3) with a slack variable, and minimize it in the cost (2). In this way, we can balance task performance and safety. We will add this in the revision.\n\n(6) Criteria for selecting penalty functions: how does the method balance conservatism and optimality?\n\n**Response:**  The penalty functions in (3) are output of previous NNs or trainable parameters, and we do not need to select them by hand. Smaller penalty functions will make the robot more conservative. Our method finds optimal functions through training of the model to achieve a desired balance between conservatism and performance (given by the training data). We will make it clear in the revision.\n\n(7) Figure 6: performance differences between ABNet and methods like MPC or BNet. Table 3 does not provide a comparison with MPC.\n\n**Response:** There is a clear improvement of ABNet over BNet as trajectories with BNet stop near the obstacle (shown by blue trajectories in Fig. 6), while the ones of ABNet can safely pass obstacle. The MPC is the ground truth (that is computationally expensive, cannot be applied in real time), and thus it is not included in Table 3. We will make this clear in the revision.\n\n\n (8) Scalability to dynamic obstacles, and testing in more advanced simulators.\n\n**Response:** Our ABNet can be scaled to dynamic environments as we just need to incorporate the dynamics and states of obstacles in (3). However, identifying dynamics and states of obstacles requires more powerful models, which does not rely on ABNet (not a limitation of ABNet). The ABNet mainly provides safety guarantees, and we can use existing literature in dynamics and state estimation to better augment ABNet in dynamic environments.  We will explore it in future, and make it clear in the revision.\n\n\n**Weakness:** Dependence on predefined, differentiable functions. \n\n**Response:** There are many related works learning differentiable constraints from demonstrations, e.g., [1] Learning control barrier functions from expert demonstrations, [2] Synthesis of control barrier functions using a supervised machine learning approach. Therefore, we can combine existing literature with ABNet to learn constraints in cases that safety is not predefined. \n\n\n**Suggestion:** Large transformer models with safety planning. How do the authors view online planning, and could barrier functions be integrated to enhance safety?\n\n**Response:** Existing approaches with large models can improve safety, however, there are no guarantees. Our method can be integrated into them to formally guarantee safety. The transformer models can be integrated either in the upstream or downstream of ABNet (e.g., via linear attention such that we can still prove the safety of the model).\n\n**Question:** Can the method handle complex contact scenarios?\n\n**Response:** Our method can handle complex contact scenarios by replacing the dynamics with the ones of humanoid. The safety may be different in contact scenarios (e.g., force constraint instead of collision avoidance). This would be another important application of our model, and we will discuss it in the revision.", "claims_and_evidence": "While the incorporation of attention mechanisms into BarrierNet represents a core contribution, the manuscript would benefit from a more thorough technical exposition regarding the non-trivial nature of this integration. The authors should elaborate on: (1) specific technical challenges encountered during this integration process, (2) innovative solutions developed to overcome these challenges, and (3) the distinctive advantages conferred by this particular implementation of attention mechanisms. Such technical insights would significantly enhance our understanding of the methodological novelty and provide clearer differentiation from conventional architectural adaptations.", "methods_and_evaluation_criteria": "The experimental scenarios are relatively simplistic, consisting of static environments with limited dynamics, and lack sufficient qualitative analysis, such as video demonstrations comparing the method to baseline approaches.", "theoretical_claims": "The method does not appear to ensure optimal task performance. As stated in the paper, \"we use NMPC to collect ground-truth controls (training labels) with corresponding states,\" implying that the upper limit of ABNet's task performance is constrained by the performance of NMPC (e.g., minimum time to reach a target). Additionally, optimality does not seem to be the primary focus in training. By employing imitation learning with barrier functions, safety appears to be prioritized, which could further impact task performance. Is there a mechanism to balance task performance and safety? Furthermore, the criteria for selecting the penalty functions in Equation 3 are not well explained. How are these values chosen, and how does the method balance conservatism and performance optimality?", "experimental_designs_or_analyses": "Figure 6 does not clearly highlight the performance differences between ABNet and methods like MPC or BNet. While Figure 6 includes results from MPC, Table 3 does not provide a corresponding quantitative comparison. For the method to be applicable to more complex, real-world scenarios—such as autonomous driving with dynamic obstacles like vehicles or pedestrians—consideration of the environment's external dynamics is essential. This raises concerns about the scalability of ABNet. The authors could consider testing in more advanced simulators, such as [1-2], to better showcase the method's adaptability and robustness in dynamic environments.\n\n[1] CARLA: An open urban driving simulator\n\n[2] Nuscenes: A multimodal dataset for autonomous driving", "relation_to_broader_scientific_literature": "The proposed methodology may prove particularly suitable for safety-critical applications with well-characterized system dynamics.", "essential_references_not_discussed": "[1] CARLA: An open urban driving simulator\n\n[2] Nuscenes: A multimodal dataset for autonomous driving", "other_strengths_and_weaknesses": "1. The approach explicitly incorporates barrier functions into neural network training, ensuring safety constraints are satisfied.\n2. The modular architecture of ABNet with multiple attention heads allows scalable, incremental learning, which is promising for building complex, safe models in stages. \n3. The method demonstrates robustness to noise, yielding lower variance in performance.\n4. The method's practical application is constrained by its dependence on predefined, differentiable constraint functions. This requirement poses significant challenges in real-world implementations, where such functions are often either prohibitively complex to formulate or behave as essentially unknowable systems.", "other_comments_or_suggestions": "To my knowledge, large transformer models are increasingly applied in autonomous driving scenarios involving dynamic external agents, as referenced in [3]. This approach uses transformers as a backbone for safety planning based on sampled trajectories, ensuring collision-free paths while closely resembling NMPC planners or human driving behaviors. How do the authors view the online planning, and could barrier functions be integrated to enhance safety?\n\n[3] Planning-oriented Autonomous Driving", "questions_for_authors": "Can the method handle complex contact scenarios and adapt to humanoid robots managing full-body dynamics with external force feedback?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "Uu26UPEPXn", "reviewer": "Reviewer_kxSJ", "summary": "This paper addresses a critical challenge in AI-enabled robotics—safe learning—by introducing the Adaptive explicit-Barrier Net (ABNet). The authors highlight the limitations of existing safe learning methods, including poor scalability, inefficiency, and instability under noisy inputs. ABNet overcomes these issues by explicitly incorporating safety barriers into a closed-form model, ensuring provable safety guarantees. A key innovation is its multi-head structure, allowing different model heads to learn safe control policies from distinct features, thereby improving training efficiency and stability without requiring a monolithic large model. The approach is validated across diverse robotic tasks, including 2D obstacle avoidance, safe manipulation, and vision-based autonomous driving, demonstrating superior robustness and safety compared to existing models. The paper’s contributions are significant in both theoretical and practical aspects, providing a promising direction for scaling safe learning toward foundation models for robotics.", "questions": "", "limitations": "", "rating": 2, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We appreciate the reviewer for all the helpful and constructive comments. We address all the concerns below.\n\n(1) Claims are not well-supported by experiments, writing is not particularly clear.\n\n**Response:** Our main claim is safety guarantee of the model, and this is supported by the SAFETY or CRASH  in Tables 1-4. The computational efficiency of our method is demonstrated in Fig. 3 with comparison to benchmarks. The performance improvement in scalable learning is shown in Figs. 4-6. We will improve the writing with preliminary on CBFs and BNet in the revision.\n\n(2) Fundamental distinction with Safe RL and optimization approaches based on BFs and Lagrangian\n\n**Response:** There is indeed a fundamental distinction between our method and Safe RL. In safe RL, safety is usually taken as a component of reward function, and thus, it can only improve safety without guarantees. While our method can formally prove safety, as shown in Thm. 3.1 and 3.2. Safety guarantees are also demonstrated in Tables 1-4. We will add discussions on safe RL and include the references in the revision. \n\n(3) Complexity of environments not well-articulated. Could the authors provide clarification on the environments?\n\n**Response:** The complexity of the experimental environments is given in Appendix section C. In summary, we consider different nonlinear dynamics and constraints across three different tasks. We have one complex vision-based end-to-end autonomous driving experiment in which the model directly takes the front-view image as input, and outputs the safe control. All the experiments are done in VISTA, and it is a sim-to-real driving simulator that generates driving scenarios from real driving data [Amini, et.al 2022].  The VISTA allows us to train model with guided policy learning. This learning method has been shown to work for model transfer to a full-scale real vehicle. This is also given in Appendix section C.4.\n\n(4) Does this method remain effective in environments requiring complex contact handling? \n\n**Response:** Our method is still effective in environments requiring complex contact handling, in which case we just need to replace the dynamics by the ones of manipulator. The safety may be different in contact scenarios (e.g., force constraint instead of collision avoidance). The CBF method has been widely used in manipulation in complex environments (e.g., Safe Multi-Robotic Arm Interaction via 3D Convex Shapes), since our model is based on the CBF method, we can apply our model to those complex scenarios when learning is involved.\n\n(5) Lack of clarity in the Background and Related Work.\n\n**Response:** We will add preliminaries on CBFs and BNet to improve the clarity, and discuss more on safe RL and other related works  in Related Works section (now the related work is given in Sec. 5).\n\n\n(6) Some related work is not discussed in the paper.\n\n**Response:** We will add the references suggested by the reviewer and other reviewers (e.g., safe RL), and discuss them.\n\n(7) What are the key advantages of using Barrier Functions in the proposed approach?\n\n**Response:**  The key advantages of using barrier functions in the proposed method is that we can formally train models that have safety guarantees in a scalable way, as shown in Thms. 3.1 and 3.2 and Tables 1-4. Another advantage is the high efficiency of our proposed method, as shown in Fig. 3. \n\n(8) Applicability constrained by known and differentiable constraint functions. Uncertainties, noise, and sensor errors may further degrade performance, potentially leading to failures.\n\n**Response:** There are many related works that learn differentiable constraint functions from demonstrations, such as [1] Learning control barrier functions from expert demonstrations and [2] Synthesis of control barrier functions using a supervised machine learning approach. Therefore, we can combine existing literature with our ABNet to learn constraints in scenarios that the safety is not predefined. This has been made clear in the future work section 6. When there are uncertainties, noise or sensor errors, we can employ robust CBF methods in our model (e.g., Fault tolerant neural control barrier functions for robotic systems under sensor faults and attacks). We will make this clear in the revision.\n\n\n(9) large language models (LLMs) (safely aligned): preventing harmful content—requires defining constraint functions for “human safety,” How do the authors view this issue in the context of their approach?\n\n**Response:** Thanks a lot for pointing out the safety problem of LLMs, we have been actively working on this and on other models or problems where safety is not clearly defined. In LLMs, in order to avoid toxic language, we may learn a differentiable risk function according to the harmfulness of the content, and then we can take this risk function as a CBF in our approach such that we ensure that the harmfulness of generated content be below some level. We will discuss this in the revision.", "claims_and_evidence": "I believe that some of the authors’ claims are not well-supported by the experiments, and the writing of this paper is not particularly clear, making it somewhat difficult to understand. Similar to Control Barrier Functions (CBF), this work primarily addresses the problem of safe robot learning. However, one major concern is the fundamental distinction between the problem studied in this paper and that of Safe Reinforcement Learning (Safe RL). Safe RL also frequently employs Barrier Functions to handle safety constraints, as seen in works such as:\n\n1.\tPenalized Proximal Policy Optimization for Safe Reinforcement Learning\n\n2.\tIPO: Interior-point Policy Optimization under Constraints", "methods_and_evaluation_criteria": "Furthermore, the complexity of the experimental environments used in this paper is not well-articulated, making it difficult to assess the significance of the results. Could the authors provide further clarification on the environments used in the study?", "theoretical_claims": "Yes. I see the appendix and the main page.", "experimental_designs_or_analyses": "Yes, some concerning see above.", "relation_to_broader_scientific_literature": "Additionally, does this method remain effective in environments requiring complex contact handling? Safe robot learning often considers constrained environments, such as those found in safety-gymnasium. The reviewer is interested in understanding how the proposed algorithm performs in more complex scenarios.\n\nThe paper’s structure may make it particularly difficult for readers to follow, especially given the lack of clarity in the Background and Related Work sections.\n\nSafe learning has been extensively explored in the context of Safe Reinforcement Learning, with optimization approaches based on Barrier Functions and Lagrangian formulations. Compared to the following works:\n\n1.\tReward Constrained Policy Optimization\n\n2.\tConstrained Policy Optimization", "essential_references_not_discussed": "some related work is not discussed in the paper.", "other_strengths_and_weaknesses": "What are the key advantages of using Barrier Functions in the proposed approach?\n\nMoreover, the applicability of this method seems to be constrained by the requirement for known and differentiable constraint functions. In many real-world scenarios, defining such functions can be highly complex, often resembling a black-box system. Real-world uncertainties, noise, and sensor errors may further degrade the algorithm’s performance, potentially leading to failures.\n\nFor instance, ensuring that large language models (LLMs) are safely aligned—such as preventing the generation of harmful content—requires defining constraint functions for “human safety,” which is itself a highly challenging task. How do the authors view this issue in the context of their approach?", "other_comments_or_suggestions": "See above.", "questions_for_authors": "See above.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "KEj0RhhfoL", "reviewer": "Reviewer_ftwa", "summary": "The paper proposes to embed control barrier constraints into neural layers to enforce safety assurance to network output. In contrast to implicit formulation with differentiable optimization, the paper argues for a specific QP admitting explicit solution form so as to avoid inefficient batching through multi-threading. The explicit barrier layers are duplicated to construct multiple heads, with each accommodating specific safety features, and can be combined via a linear combination. The results show graceful scale-up with respect to the number of batches and network heads comparing to the differentiable optimization counterpart. Imitation learning results on 2D robot navigation, manipulation and vision-based driving show improvement on deriving less conservative safe behaviors.", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for all the positive and constructive comments. We address the remaining comments below.\n\n(1) The paper needs a clarification on the scope of systems. The target dynamics is of a general control affine form while an assumption is made on relative degree m...\n\n**Response:** The proposed method can be applied to general nonlinear systems. The problem that the coefficient of the control in the CBF constraint becomes 0 at some state is the so-called ``singularity’’ problem (if it is zero for all states, then the relative degree should be increased by one until it is non-zero). This problem can be solved by defining a CBF that avoids those states (e.g., see [1] High-order barrier functions: Robustness, safety, and performance-critical control). When there are multiple controls, there may be the so-called mixed relative degree problem, and we can address this by defining auxiliary dynamics to make all the controls show up (e.g., see [2] Control barrier functions for systems with multiple control inputs). When we have non-affine control systems, we can also define auxiliary dynamics to ensure that the method can still work (e.g., see [3] On the forward invariance of neural ODEs). We will make this clear in the revision.\n\n(2) Limited to low-dimensional system and action space...\n\n**Response:** We totally agree with the reviewer. The scalability is mainly in terms of the safety of the robot, the size of the safe robot learning models, and the computational cost of the model. Our method can also work for high DOF scenarios (e.g., manipulation) by replacing the corresponding system dynamics with the high DOF dynamics (e.g., manipulator dynamics) in the model. We will discuss this in the revision. \n\n(3) The paper seems to take visual observations as piece-wise constant input, ...\n\n**Response:** We thank the reviewer for pointing this out. Although we are taking piece-wise constant input for visual observations, the proposed model works for continuous visual observation as well. This is indeed a very interesting direction that involves differentiating the image input (e.g., in the form of optical flow). We will add this discussion in the revision.\n\n**Question 1**\n\n**Response:** Our method works for dynamics without a globally constant relative degree as well. There are many approaches to deal with such problems, e.g., by defining a CBF that avoids those states (e.g., see [1] High-order barrier functions: Robustness, safety, and performance-critical control). In fact, we only need to care about the states at the boundary of the unsafe sets that may make the coefficient of control in HOCBFs become zero, and safety can still be preserved in such cases. \n\n**Question 2** \n\n**Response:** The implication to other applications is that we always consider the most threatening factors in guaranteeing safety, and it may not necessarily just  be related to the activeness of constraints, but also related to the importance of those constraints. For example, autonomous vehicles should always follow traffic rules, and it should always consider the most important rule (e.g., ensure collision free to pedestrians) rather than less important rules (e.g., lane or road keeping). We do need to care on how to partition the constraints when the problem scales up, and this can be taken care of by leveraging other factors (such as ethics and local culture in driving), e.g., see [1] Liability, Ethics, and Culture-Aware Behavior Specification using Rulebooks  [2] Rule-based optimal control for autonomous driving. \n\nSince the model outputs controls in real time, we can definitely change the activeness of constraints in real time as well. We implement the model in discrete time, thus it won’t cause any differentiability problem since we can address the inter-sampling issue (safety in continuous time) using event-triggered approaches (e.g., [3] Event-triggered control for safety-critical systems with unknown dynamics). Another way to address this differentiability problem is to use the soft min approach (as discussed right before equation (4)) to combine and consider all the constraints.\n\n**Question 3** \n\n**Response:** This is really a good point. Since we always consider the two most important constraints at each time step, and we can get the closed-form solution, therefore, we do not find any infeasibility issue for now (however, there may be other problems that are worth further exploring in future work).  This provides a promising way to address the infeasibility problem, and we will add the discussion in our revision.\n\n**Question 4** \n\n**Response:** We also have some state- net to predict the vehicle and obstacle states from image observations (as also demonstrated in the BNet). The demonstrated safety is based on the assumption that the state is reliably predicted. In cases where there are some uncertainties for the prediction of the states, we can use robust CBFs in our framework. We will add the discussion in the revision.", "claims_and_evidence": "The main claims about the advantage of explicit barrier QP includes:\n1. More efficient inference and batching for training. This is well corroborated with results in Figure 3 in which the proposed approach clearly shows the benefit of avoiding differentiable optimization. \n2. Explicit barrier nets improve the learning performance while conform to safety constraints. This is demonstrated in 2D robot navigation and two-link manipulation examples. \n3. Multi-head explicit barrier nets are possible due to reduced computational costs and the heads can be combined with each focusing on specific safety-relevant features. This is shown case in the vision-based driving example which also proves the possibility of using unstructured context input z.", "methods_and_evaluation_criteria": "The method is based on (Luenberger, 1997) which shows a QP has only two constraints can admit an explicit solution parameterization. To this end, the paper proposes to partition constraints into two sets and choose two that are closest to activeness. The method makes a lot of sense in that explicit parameterization is faster and more amenable to vectored evaluation. \n\nThe benchmark includes 2D robot navigation, 2-DOF robot arm and vision-based car driving. The experiments cover different dynamics and vision as contextual input.", "theoretical_claims": "The paper provides the proof on safety assurance of blended network output subject to control barrier constraints in (3). The correctness is briefly checked but not thorough as the reviewer is not familiar with the adaptive CBF cited from literature.", "experimental_designs_or_analyses": "The experiment design covers claims on computational efficiency (Figure 3), safety-assured learning (Table 1, 2, 3), multi-heads to attend different image features (Figure 10) and robustness against image corruption (Table 4). The design is well made and has a good coverage on all the claims made by the paper.", "relation_to_broader_scientific_literature": "The contribution is related to broader literature on using implicit function for layer design. The findings on effective learning of structured output are in line with existing works arguing for differentiable computing as building blocks for end-to-end learning. The idea of leveraging explicit solution parameterization can be inspiring to works beyond safe learning.", "essential_references_not_discussed": "No extra references are needed.", "other_strengths_and_weaknesses": "The paper needs a clarification on the scope of systems. The part on implicit-barrier (from line 125) suggests the target dynamics is of a general control affine form $\\dot{x} = f(x) + g(x) u$ while an assumption is made on relative degree $m$. The assumption is not made in the neighbourhood of some $\\bar{x}$ to ensure $g(\\bar{x}) \\neq 0$ for the relative degree $m$. In general, I think $g(x)$ may not guarantee the same relative degree everywhere in the state space. The experiments do not contain such a case as the dynamics are either fully-actuated or with a constant control matrix. It is hard to tell what if the dynamics violate this relative-degree or when $m$ is misspecified for some states.  \n\nThe paper advocates scalable learning while the examples are still limited to low-dimensional system and action space. I guess the scalability statement here is about the computational cost of applying differentiable optimization on problems of such a scale. However, I think the contribution can be much more significant if results can be attained on systems with higher DOFs.\n\nThe paper seems to take visual observations as piece-wise constant input. This reads as a strong assumption by breaking the causality between state and generated observation, while it is understandable this can save the analysis of differentiating the observation model.", "other_comments_or_suggestions": "No comments on this regard.", "questions_for_authors": "1. Can the method be demonstrated to work on dynamics without a globally constant relative degree? How much it may invalidate the safety assurance?\n\n2. The minimum trick to select \"the most active\" constraints seems general. What could be its implication to other applications? Do we need some care on how to partition the constraints when the problem scales up? I am wondering whether it can work for optimizing along a trajectory where state may change the activeness of constraints and hence the constraints considered in QPs. Will this create in differentiability or complex loss landscape to gradient-based optimization?\n\n3. Differentiable optimization sometimes suffer from infeasible problem parameterization. Will that also be an issue here? \n\n4. The vision-based driving example takes image as the input and generate control from the ABNets (line 813-814). How is this done without the state input? Is the demonstrated safety formally assured or an empirical verification in this specific task?\n\n\n##update after the rebuttal\nI would like to thank the authors' responses and clarifications, especially on the relative degree. Two points I would like to make after thinking over the rebuttals:\n\n- It is good to know that there are already potential \"patching\" for the cases beyond constant relative degree as in the experiments. I see some issues on resorting to these patches to counter the original criticism. Being able to define safety constraints to let robot operate in a subspace with constant relative degree is not a direct resolution to the criticism on the rigour of the theorem statement. The original statement suggests a fixed relative degree which implicitly assumes this applies to all control matrices. Providing solutions about what we could do if the (implicit) assumption didn't hold is not helping on the clarity and rigorousness of the problem scope. I am also unsure about the implication to empirical performance if state constraints are imposed for making the analysis valid in a subspace. Many under actuated tasks actually rely on going through uncontrollable states and exploiting passive dynamics. \n\n- The clarifications on the vision-based driving and state prediction model make sense. However, ignoring the causal relation between the observation model (state -> image) appears to break the analysis chain of the control loop. This could be fine for empirical driven results, but I feel it is a bit confusing for a work promoting provable control as I thought the example was intended to show the proof also applies to system with unstructured sensory observation.\n\nOverall, I think the paper should still have a good chance to be accepted while I have to admit my confidence is not as strong as it was before the rebuttal, given the way of how the raised questions were approached. My recommendation remains unchanged.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "aOZaALnHB9", "reviewer": "Reviewer_NgUo", "summary": "This paper proposes ABNet, an adaptive explicit-barrier net for safe and scalable robot learning. The ABNet is a combination of multiple safe control nets such as BarrierNet, dMPC, as well as the proposed explicit-barrier net. The authors claim that ABNet has the potential to scale to a larger safe foundation model and show that ABNet is better in terms of robustness, and safety guarantees over existing approaches.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We really appreciate the reviewer for all the positive and helpful comments. We address the remaining comments below.\n\n(1) The part of references/related works is okay, but it would be nice to have more recent papers included, like the ones published in 2023 and 2024.\n\n\n**Response:** We will add more recent references as suggested by other reviewers, especially those in safe RL and CBFs for manipulation.\n\n\n**Weakness 1** Novelty. The explicit barrier can be seen as a novelty, but it is not significant at all. The way of linear combined control output by different heads is not new. And thus the novelty of the whole paper is concerning.\n\n\n**Response:** The proposed explicit barrier is significant in improving the computational efficiency in scalable training, as demonstrated in Fig. 3, we can significantly improve the computation time with our method compared to the benchmark (dQP) from both the batching and training perspectives. Computational efficiency is very important in large safe foundation models, especially when those models are trained in a scalable way (as proposed in this paper).\n\n\nThe linear combined control output is simple, but also very effective. However, proving the property (e.g., safety) of the combined control is non-trivial and challenging. The main contribution of our work is to show the safety of the combined control (Thms 3.1 and 3.2, and their proofs in Appendix B), which has not been done in the literature. We showed the existence of a new HOCBF constraint from the combined control, and thus the idea or approach of safety proof is indeed novel.\n\n\n**Weakness 2** Regarding novelty, as the authors want to push this paper towards a \" safe foundation model\", I would suggest considering adding a self-attention layer for the outputs by different heads. In this way, even if some heads' output actions are not safe (due to learning errors, etc), the self-attention auto-weighting has the ability to correct the final output.\n\n\n**Response:** Thanks a lot for the constructive suggestion. Adding a self-attention layer for the outputs is indeed very interesting. However, proving the safety of the combined control is non-trivial and challenging with such self-attention layers. We will further explore this. One possibility is to consider the linear attention mechanism (e.g., [1] Transformers are rnns: Fast autoregressive transformers with linear attention). We will add the discussion in the revision.\n \n**Question 1** Are there existing works of 'safe foundation model'? If yes, has this paper discussed them?\n\n\n**Response:** We found some survey papers regarding the safety of foundation models (e.g., On the opportunities and risks of foundation models), and we will discuss them in our revision, especially from the perspective of the importance of safety in foundations models, which will make our work stronger. Please let us know if the reviewer has any other suggestions for references.", "claims_and_evidence": "Yes. \nFrom the experiments, we can see that ABNet outperforms the current existing baselines.", "methods_and_evaluation_criteria": "Yes.\nThe explicit-barrier net explicitly computes the optimum control action as the output, which is different from the existing implicit approaches. The experiment setup aligns well with the purposes of the proposed methods. The experiments include 2D navigation and vision-based autonomous driving with obstacles which are common examples of testing control safety. The authors compare their approach with 6 baselines, which should provide enough coverage.", "theoretical_claims": "I've checked the correctness in the main text but not in the appendix. The main text looks good to me.", "experimental_designs_or_analyses": "The experiments are fine for me.", "relation_to_broader_scientific_literature": "I feel this paper does have its value and contribution to the community, as the authors claimed, towards a large safe foundation model. \n\nThe way of considering the combination of multi-safe approaches is interesting to the community.", "essential_references_not_discussed": "The part of references/related works is okay, but it would be nice to have more recent papers included, like the ones published in 2023 and 2024.", "other_strengths_and_weaknesses": "Okay so here comes with the weaknesses.\n1. Novelty. The explicit barrier can be seen as a novelty, but it is not significant at all. The way of linear combined control output by different heads is not new. And thus the novelty of the whole paper is concerning. \n2. Regarding novelty, as the authors want to push this paper towards a \" safe foundation model\", I would suggest considering adding a self-attention layer for the outputs by different heads. In this way, even if some heads' output actions are not safe (due to learning errors, etc), the self-attention auto-weighting has the ability to correct the final output. \n\nStrengths:\n1. The paper is easy to follow and well-written in general. \n2. It is interesting to see the concept of the 'large safe foundation model'. \n3. The experiments are well-designed and validate the effectiveness.", "other_comments_or_suggestions": "See above", "questions_for_authors": "Are there existing works of 'safe foundation model'?  If yes, has this paper discussed them?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {"ethical_review_concerns": "N/A"}}]

Author rebuttal:

Meta-review: Based on my review and the authors' rebuttal, I recommend accepting this paper. The core contribution, an explicit control barrier layer derived from an efficiently solvable QP, presents a valuable alternative to implicit differentiable optimization for enforcing safety constraints in neural networks. The authors provide convincing evidence through well-designed experiments across navigation, manipulation, and vision-based driving tasks, demonstrating significant improvements in computational efficiency, scalability with batch sizes and network heads, and the ability to learn less conservative yet safe behaviors. While I noted limitations regarding the theoretical assumptions on system dynamics (specifically the constant relative degree) and the handling of causality in the vision-based example, which were not fully resolved in the rebuttal, the practical benefits and the novelty of leveraging explicit solution parameterizations for structured output prediction in deep learning are significant. Therefore, despite some reservations about the theoretical scope and rigor that arose post-rebuttal, I believe the paper's strengths and potential impact warrant its acceptance.
Decision: Accept (poster)