Safe and Stable Control via Lyapunov-Guided Diffusion Models
Authors: Xiaoyuan Cheng
Xiaohang Tang
Yiming Yang
Venue: NeurIPS 2025 poster ()
Keywords: safe and stable control
diffusion for control
Lyapunov-guided sampling
Primary area: reinforcement_learning

Abstract: Diffusion models have made significant strides in recent years, exhibiting strong generalization capabilities in planning and control tasks. However, most diffusion-based policies remain focused on reward maximization or cost minimization, often overlooking critical aspects of safety and stability. In this work, we propose Safe and Stable Diffusion ($S^2$Diff), a model-based framework that explores how diffusion models can ensure safety and stability from a Lyapunov perspective. We demonstrate that $S^2$Diff eliminates the reliance on both complex gradient-based solvers (e.g., quadratic programming, non-convex solvers) and control-affine structures, leading to globally valid control policies driven by the learned certificate functions. Additionally, we uncover intrinsic connections between diffusion sampling and almost Lyapunov theory, enabling the use of trajectory-level control policies to learn better certificate functions for safety and stability guarantees. To validate our approach, we conduct experiments on a wide variety of dynamical control systems, where $S^2$Diff consistently outperforms both certificate-based controllers and model-based diffusion baselines in terms of safety, stability, and overall control performance.

Safe and Stable Control via Lyapunov-Guided Diffusion Models
Xiaoyuan Cheng" Xiaohang Tang Yiming Yang University College London, United Kingdom
Abstract
Diffusion models have made significant strides in recent years, exhibiting strong generalization capabilities in planning and control tasks. However, most diffusion- based policies remain focused on reward maximization or cost minimization, often overlooking critical aspects of safety and stability. In this work, we propose Safe and Stable Diffusion Diffiff), a model-based diffusion framework that explores how diffusion models ensure safety and stability from Lyapunov perspective. We demonstrate that Diff eliminates the reliance on both complex gradient- based solvers (e.g., quadratic programming, non-convex solvers) and control- affine structures, leading to globally valid control policies driven by the learned certificate functions. Additionally, we uncover intrinsic connections between diffusion sampling and Almost Lyapunov theory, enabling the use of trajectory- level control policies to learn better certificate functions for safety and stability guarantees. To validate our approach, we conduct experiments on wide variety of dynamical control systems, where Diff consistently outperforms both certificate- based controllers and model-based diffusion baselines in terms of safety, stability, and overall control performance.
Introduction
Real-world control tasks often go beyond simple cost minimization or reward maximization, requiring safety [19] and stability (7) as essential requirements in various fields such robotics and aerospace. Specifically, safety ensures a risk-free trajectory during control, while stability drives the system toward convergence to achieve desired goal. However, achieving both safety and stability remains an open problem in control theory due to the complexity of synthesizing numerous non-convex constraints, including both equalities and inequalities (21) within single formulation.
Model Predictive Control. common approach address this challenge to leverage convex optimization techniques, minimizing the accumulated costs under multiple constraints [I] 52 One
of the most well-known methods is the model predictive control (MPC) 23 and its variants [17 I8 While MPC is widely used to ensure safety and stability, the policies derived from MPC algorithms often remain suboptimal in exccution [38). Moreover, MPC can easily become infeasible for some problems with many safety constraints and tight control limitations. Another significant drawback of MPC is its computational complexity [24). Achieving better performance typically requires a longer receding horizon, making MPC inefficient for high-dimensional nonlinear problems.
Certificate- Method. Another approach to ensuring safety and stability control relies certificate functions, such control Lyapunov functions (CLFs) 4 6 43 and control barrier functions (CBFs) [5] 36, 46). However, identifying a valid certificate function is challenging and highly problem-dependeen [ most existing methods rely convex optimization with known system dynamics 34 37 In addition, these approaches struggle to scale to high-dimensional control
"Corresponding Xiaoyuan Cheng: ucesxc4@ucl.ac.
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

tasks. To improve the generality of certificate- baste methods, several approaches have been proposed learn certificate functions from data 3 12
54.. These techniques have been shown effective in control-affine dynamics, enabling the learning of a control policy based on optimized certificate functions. Specifically, the policy is generated by solving step-wise quadratic programs (QPs) using learned parameterized certificate functions and a nominal policy. Two representative methods in this field are proposed in [35] and [3]. The former [35] formulates an approach to synthesizing CBFs for goal-oriented multi-agent control tasks, while the latter [13 introduces the control Lyapunov barrier function (CLBF) which ensures safe and stable control performance [36]. However, synthesizing
45
53
QP- based control with certificate functions remains challenging [39 [50], due to several factors: (I) QP formulation typically requires control- -fffnn dynamics; (2) ensuring the existence of a control policy for step-widd weep-wie greedy optimization often requires the introduction of slack variables, which can lead to globally inconsistent behavior; and (3) jointly learning the certificate and policy may lead to an infeasible QP, destabilizing training and degrading certificate quality.
To address the aforemen- tioned challenges in gradient-based meth- ods, we propose Safe and Stable Diffusion Difffff), a novel sampling-bane based method based on model-based diffusion planning framework where we learn the certificate functions based on policies sampled via diffusion models and do policy improve- ment via guided policy sampling iteratively. Crucially, since the guidance is learned certificate functions (CLBF), the control se- quence obtained by guided diffusion sam- pling is guaranteed to be safe and stable. Unlike previous MPC QP-based meth- ods, our approach goes beyond step-wise greedy policies for control-affine dynamies, avoids the use of slack variables, and can be extended to trajectory-level optimization for general differentiable dynamics (the core idea is illustrated in Figure [ Theo- retically, we uncover intrinsic connections between diffusion sampling and Almost Lyapunov theory: the cefflusion-sampllr
Contribution.
V vector field
Lyapunov function V
generated trajectory
Spdiate Lyspunov functinn
guicance
updane
vicltiin
salistattin
Overview of Difff. Bottom top: as guid- ance function improves, vector fields align better with the goal, Lyapunov landscapes get smooth, and trajecto- ries converge more reliably. Right to left: the generated policy guided by the Lyapunov function, and diffusion sampled trajectories are used to update the Lyapunov function.
Figure 1:
certificate function is not merely a weak relaxation of classical methods - constitutes a realization of Almost Lyapunov theory, which prioritizes global convergence rather than pointwise strict descent. In experiments, we evaluate D'ff across a wide range of dynamical systems, where consistently outperforms both gradient-base based methods and model-based diffusion approaches in terms of safety and stability. We summarize the comparison with other methods in Table
Related Work. In parallel with gradicnt- based approaches, an increasing number of works have
explored diffusion models 226 41 42 for control problems [2 15 20
29 30
49). One work
focuses specifically on diffusion planning, as formulated Diffuser (22). a probabilistic diffusion model that generates action plans by iteratively denoising trajectories. Diffusion planning shows strong performance in long-horizon decision- making and trajectory generation at test time [2 30) To address safety in control, model-free safe diffusion planning methods have been proposed, integrating QP based on handcrafted control barrier functions (CBFs) (51). However, designing valid CBF' prior remains a challenge [1 and the stability guarantee of diffusion policies still unexplored.
2 Preliminary
Consider a general differentiable nonlinear dynamical system given by
t = f(r u),
(1)
Moodel-based diffusion planning here refers planning with known dynamics defined in 32

---

Table 1: Comparison of existing methods and Diff (ours). Policy inference includes, quadratic programming (QP), non-convex optimization (NCO), and Diffusion Sampling (DS).
Methods
Control-affine
Trajectory level
Safe
Stable
Policy Inference
CLBF-QP
QP (fast)
MPC
X
X
NCO (slow)
MBD 32
X
x
DS (fast)
Diff (ours)
X
v
V
DS (fast)
where the state and control input belong to the compact sets X C R" and U R respectively, The function f X' x x + R" is globally Lipschitz. While most existing works on learning certificate functions assume control-affine dynamics [13 45 50]. we argue that this assumption is unnecessary in our approach due to diffusion sampling. The symbol X, S X' denotes the safe set and L. denotes the Lie derivative. The control Lyapunov barrier function (CLBF) is defined follows.
Definition 2.1 (CLBF [6)). A potential function V X - a CLBF if the function V satisfies following conditions, for some constant c, À >
Equilibrium:
V(x+) = 0,
(2a)
Positivity:
V(x) > 0, E E (x+),
(2b)
Safe State:
V(x) Sc. Vr N
(2c)
Unsafe State:
V(x) > E X,,
(2d)
Uniform Dissipation:
inf (,V(z) + AV $0, Vo E X {re}. wEld
(2e)
Remark 2.2. CLBFs are Lyapunov-like functions that simultancously guarantee system's 's safety and
stability. Under the conditions specified in Equations Equation (2a). Equation (2b). and Equation (2e). there exists control policy that steers the system toward unique equilibrium point with monotonic decrease. In general, Equation (2e) implies an exponential stability as || x+1| ((exp(-Xt)), proof in Appendix [ In this framework, the sublevel and superlevel sets identify the safe and unsafe regions, respectively. Since the uniform dissipation of is along the trajectory, the state can always be kept in safe region. With the aid of CLBFs, establish rigorous mathematical framework to enforce safety and stability constraints.
Problem Definition. Following the conventional setting, the control problem can be formulated as an optimization problem in a fixed horizon with CLBF V().. For Vt E [T] and Vu, E U::
argmin
Ed(xa un)
à. (1), dynamics
(xV( AV))
V(x)) of safety
constraint Eyapunov stahility
Here, thesacly cost function q X' U1 R + is predefined and non-negative. The objective is to minimize the accumulated control cost while satisfying multiple constraints. The constraints include conditions derived from the CLBF and bounded control inputs, ensuring global safety and stability.
Challenges in Gradient-based Methods. We briefly revisit gradient- based optimization techniques and its challenges. Traditionally, cost minimization problems for control policies are solved using LQR or MPC approaches, often without incorporating safe or stable constraints. The resulting solution, known as the nominal (or reference) control policy denoted as u nominal Then, the new cost can be simply transformed to 12 distance with u nominal as ||u - u nominul]] || Under this setting, many methods are proposed incorporate certificate functions V(-) into the one-step policy optimization
formulation as QP 13 39 40 45 50):: for Vt E [T'.
argmin ||u w nominal 112, s.t. L, + AV
feasible solution may not always exist in Equation 4 if u lying bounded set 24 To make the optimization tractable, the constraint term is usually relaxed by introducing large slack variable
3

---

2 E R and coefficient Apenatyy showing as
argmin u u nominal| | +
Apenalty2
s.t. + +
S 2
(5)
In this approach, the optimized control solution is a trade-off between cost minimization and safety/stabilityy However, solving the problem in Equation (3) using gradient-based optimization presents three challenges: 1). The construction of QP inherently requires dynamics to be control- affine, extending to general nonlinear systems is non-triv non-trivial; 2). The step-wise greedy optimization of u can lead to globally inconsistent behavior across the trajectory. often resulting in excessive reliance on a large slack variable 2 to satisfy CLBF constraints; 3). The CLBF function V is learned jointly with the optimized control policy u, which introduces coupling issue: as V evolves during training. it alters the feasible region of the QP. potentially destabilizing optimization and degrading the learned certificate. These limitations motivate the exploration of alternative approaches diffusion We pose the following research question:
Can guided diffusion sampling overcome the limitations of gradient-based approaches while ensuring both safety and stability?
We will answer this question by linking Almost Lyapunov theory and diffusion sampling.
3 Method
We propose Safe and Stable Diffusion Diffi, a model-based diffusion framework that unifies diffusion sampling with Lyapunov-inspire certificates address safety and stability in general nonlinear systems. The section is organized as follows: (a) We formulate CLBF- CLBF-guided diffusion process for sampling trajectory-level policies without requiring slack variables and control- assumptions. (b) We design a loss to iteratively refine CLBFs using diffusion -aatulliinn-sppeeddddeeee trajectories. (c) We provide theoretical insights linking diffusion sampling to Almost Lyapunov theory.
3.1 Probabilistic Formulation and Diffusion Sampling
To apply diffusion for sampling a safe and stable control policy, we first reformulate Equation (3) as a probabilistic formulation. This formulation captures the key insight of the Almost Lyapunov theorem: even if the Lie derivative condition is locally violated with small probability. as long as such violations are confined to regions with minimal influence, the overall system can still exhibit long- term exponential decay, ensuring global stability and safety. By framing probabilistic formulation as a sampling task, we can leverage diffusion models to efficiently explore safe and stable trajectories.
We define the target trajectory sequence distribution p(U) as a Gibbs measure, proportional to
p(U) x Psate Psaae(U) Pstable (U) Pana (U),
where U denotes the full trajectory sequence (I1:T, (1::) over fixed horizon. Here, Psate (U), Pstable (U), and (U') are scalar-valued functions that score the trajectory according to safety, stability, and accumulated cost, respectively. These functions shape the unnormalized distribution over policies, reflecting their relative importance. Leveraging the definition of CLBFs, we specify these components follows:
T Psafe x II (V( Pstable x II Lic, Poost O exp (-1 -- g((e,, a(ae, (7)
T
T
where the variable notation U = (x1.7. u1:r) for each probability is omitted for simplification, 1 1 denotes the indicator function. The definitions of Psate and Pstable adhere to the CLBF conditions as stated in Definition 2. while Peoa is expressed as an exponential function of the negative cumulative cost with temperature parameter 7. When nominal control policy u1.7 is given, the cost term can be formulated as Peos exp( 31 ||u1:r moominal|2) [[2), which biases the sampling process toward the nominal policy and improves efficiency.
Almost Lyapnunov Function Guidance. As demonstrated in prior work 10 16) it theoretically impossible to learn Lyapunov function that satisfies the required properties at every point, such as

---

strictly negative Lie derivative using only a finite number of sampled data points. Nevertheless, Almost Lyapunov theory [27] suggests that despite the existence of regions with non-negative Lie derivative, system trajectories can still converge to sufficiently small neighborhood around the equilibrium point. Thus, instead of enforcing the second hard constraint Equation 7 we can
adopt a soft constraint formulation:
[ AV(..) +VV IP).
Patable X exp
72 Σ
(8)
where [a]+ A Re)U(2) and 0 72 1 is low temperature parameter. When the temperature factor "/2 is sufficiently small, the sampled control policy can guarantee trajectory-leve safety and stability under the guidance of CLBF. We provide statement to verify this point see Theorem 3.1 Moreover, this probabilistic (soft) constraint formulation addresses key limitation of gradient- based methods, which often require introducing large slack variables that can shift the feasible region of the control solution (see Equation (5)). In contrast, the soft constraint Equation (8) leaves the optimization problem B unchanged and improves sampling efficiency by avoiding the high rejection rate associated with strict indicator-based constraints.
Control Trajectory Sampling. We adopt Monte Carlo score ascent within diffusion sampling to iteratively denoise trajectories toward the target distribution p(U). The forward and reverse diffusion process with Gaussian noise is defined as follows [4]. Denote scale factor ā; = II Ctk.
plU ( (Va, a:) Uー1 1 (U" (1 az V log (())) Vas
(9)
Notably, the unbiased estimator of score function relies on the posterior expectation Ep (10 [U9] estimated from sequential Monte Carlo [4,
33 (with provided proof in Lemma B.5
1
Ue log
U
Vos EUo (09)
(10)
estimate
In contrast to QP-based approaches for solving Equation 5 our sampling-basee method avoids introducing slack variables and does not require a control-aftine structure. After generating the clean trajectory U we implement the control policy 4 in environments.
3.2 CLBF Update via Sampled Trajectories
The process of diffusion sampling and CLBF updating is iterative. After generating control policies through diffusion sampling, we use the sampled trajectories to update the CLBF function iteratively. Let D denote the dataset of sampled trajectories; the CLBF update is formulated as follows:
argmin E.
Σ 1m,=,, (x+)) + (z)) + ( - of Imexxx V
+ aal + (i) + + + a2li(((1)) - ((x) + Ai + +ejt]
(11)
Here, 01 and 02 are two tunable parameters. Unlike the quadratic form used in prior work
13 we
parameterize the CLBF with a general N-layer neural network À V'Nox=iWWN-1 to handle nonconvex constraints. Our experiments show that such flexible parameterization outper- forms the quadratic form in problems with nonconvex safe sets (see Section 4.1 Each component targets fundamental control principle as:
(Wi x)).
The first term, 1 1g,=a. | [x, enforces (xx)) as required by Equation 2a
The second term, [<v((x))** enforces positivity of the Lyapunov function as Equation 2b).
The third and fourth terms, 1,, 1,, (v(;)) - c|+ and 2,,,xx (c (
encode the
sub-level and super-level set conditions, aligning with Equations 22c and 2d
5

---

The fifth term, Σ Ei=llC,(a,)) + (x1) ) + = enforces trajectory-level stability using diffusion-sanii control inputs.. The buffer term e accounts for the small violation as formalized in Theorem (see Equation (32). Lie derivatives are computed via automatic differentiation, and minimizing this term reduces violations, enhancing global stability.
Finally, the sixth term, complements the continuous constraint by regulating the discrete-time Lyapunov condition.
(zz) with #++11 + f Uz),
Our algorithm leverages model-based diffusion as its foundation, and the implementation details presented in Appendix B
Diffusion Sampling vs. Gradient-based Optimization. Diffusion sampling, formulated in Section 3.1 avoids the need for slack variables and does not rely on control-affine assumptions, enabling the effective exploration of complex, nonconvex control policy landscapes [32 As result, the generated policies can be used to update CLBFs without altering the original optimization objective. In contrast, QP-based methods rely carefully tuned relaxations and yield locally greedy solutions that may fail globally. Likewise, nonconvex MPC often gets stuck in local minima, limiting its ability ensure global stability and safety.
3.3 Theoretical Results
In this section, we establish the theoretical guarantees of safety and stability for diffusion diffusion-sampled policies under the framework of an Almost Lyapunov function. Furthermore, we introduce an auxiliary theorem from a paaningg-theorete perspective to demonstrate that diffusion-sampled policies give rise to an Almost Lyapunov function.
Theorem 3.1 (Safety and Stability with Almost Sure Guarantees). Let X a compact state space and consider the continuously differentiable dynamical system f in Equation (T). Let V : X + R be a smooth positive definite function. Assume that there exist constants >> O and > and connected, see-sel--vverappingg and measurable set Ω C X satisfying the small volume Vol(S)) < such that the following holds:
(A) For every S2, the Lie derivative of V along f satisfies min L,V(s) <XV(2).
(B) For I E Ω we allow (v (xx) without any further restrictions, i.e. no uniform dissipation condition.
Then, there exist positive constants x1 and M, with 0 < A1 X, such that for any Tu E X, C X, the solution Ie of Equation ① under the diffusion-sampled policy satisfies, almost surely,
V(x.) S exxp(->1t)V((a)) + -Me,, 2
(12)
In other words, the influence of the "bad" region $2 introduces only an additive buffer term of order Oce)) ). ensuring that the overall decay remains almost exponential over time.
implies that the CLBF V is not necessary decrease at every local point in time, reflecting the probabilistic formulation in Equation (8). Instead, even V leads to local increases, the long-term trajectory exhibits exponential decay (reflecting the core idea of Almost Lyapunov function). As long as any violation is confined to regions with sufficiently weak influence (i.c., small E), the net behavior of system dynamics guarantees global safety and stability. This suggests robust strategy is to prioritize global performance while allowing small chance of local Lie derivative violations. the diffusion- diffusion-sampled policy can be reused to train and improve the neural CLBF V, progressively reducing the measure of the violation region. Theorem 3.1 holds when the violation region Ω has sufficiently small volume. This establishes end-to-end guarantee: the data-driven learning of V ensures the small-volume condition required by the theorem (see detailed proof in Appendix C
Connection to Almost Lyapunov Theory. Theorem 3.1
the other hand, the trajectories generated under
Experiment
In this section, we comprehensively evaluate the performance our model across various nonlinear dynamical systems, covering both tracking and control tasks, In the first subsection, compare

---

Pendulum
Car tracking
Segway
Neural lander
Quadrotor
F-16
Figure Benchmark control tasks for safety and stability.
Contour of kamndd CLBFs for invorted pondulum
mape algorit
Auguar vabcc (rads)
16.8
1200
04
Goll Regien
L577
600
Ours
Angle trad)
0.0
250
Vaieo 18:0
AlBtudle IE:
Figure 3: Left: CLBFs learned by Gradient-based method (left-1) vs. Diffusion Sampling (left-2) for inverted pendulum Right: Contour maps along different axes of the CLBF learned by D for the nigh-dimensional, non-control-affine F-16 with non-convex constraints. The smooth level sets across 2D projections highlight the CLBF's expressiveness and its ability to capture complex, constrained dynamics.
algorithm, Diff, with competitive baseline methods and interpret how our design contributes to per- formance improvements. In the second subsection, investigate the impact of key hyperparameters, such as sampling horizons and temperature factors, on control performance.
4.1 Control Performance Comparison
Tasks. (1) Inverted pendulum (n 2): stabilize the pendulum in the upright position by moving the
base left or right. (2) Car trajectory tracking (n = 5, 7): make the car follow a desired trajectory by
controlling its speed and steering angle. (3) Segway (n 4): keep the two-wheeled robot balanced
while moving forward or backward as commanded. (4) Neural lander (n2 = 6): land a aircraft smoothly and accurately on the target space by adjusting thrusters and orientation. (5) 2D and 3D Quadrotor (n = 6, 9): stabilize the quadrotor in hover or level flight with complex obstacles. (6) F-16 (n 16): control F-16 aircraft stabilize key variables such altitude, velocity, angle of attack, elevator position and other critical states. The first five systems are control-affine while the F-16 is non-control-affine See illustrations in Figure
Baseline Algorithms. (1) Robust Control Lyapunov Barrier Function based QP (rCLBF-QU)
a certificate-bi based control method for control-affine dynamics, utilizing step-wise greedy policy derived from learned quadratic CLBF. (2) Model Predictive Control (MPC) [25 28
13
robust MPC framework designed for safe control tasks. (3) Model-Basee Diffusion (MBD) B3
model-based diffusion planning approach that leverages known dynamics with constraints.
evaluate the control policies from three aspects: (1) Safety rate-the percentage of trajectories that remain safe, computed over 20 initial states; (2) Stability the distance between the fixed-horizon terminal state and the equilibrium state; (3) Efficiency-the inference time required to generate control policies.
Evaluation Metric.
Result Analysis. We present an analysis of our results by addressing four key questions that explore the contributions of diffusson sampling and CLBFs in our framework:
(1) Does diffussion sampling help in learning certificate functions? Yes diffusinn sampling signifi- cantly improves the learning of certificate functions. In Figure (left), (leute we compare contour maps of the CL.F for the inverted pendulum obtained via diffusion sampling and traditional step-wise QP-based approach. The diffusion- based method results in noticeably larger contraction region, indicating stronger stability guarantees. Moreover, this advantage generalizes more complex, high-dimennional systems. For example, in Figure (right), visualize contour slices of the CLBF
7

---

Table Comparison of controller performance various control environments. The first three tasks are for stability, and other tasks need to consider both safety and stability. means not applicable.
Task
Algorithm
Safety rate
| - x.
Eval. (ms)
cCLBF-QP
0.02 + 0.01
4.4 0.2
Inverted Pendulum
MPC
109.3 0.8 0.01 - 0.01
MBD
0.12 0.05
49.5 0.3
Difff
0.01 = 0.01
23.5 0.1
CLBF-QP
0.75 + 0.37
10.2 0.3
Car (Kin.)
MPC
1.51 1 0.86
1946 1.6
MBD
1.57 + 0.91
88.5+1.1
D'fiff
0.61 = 0.12
3.5
CLBF QP
1.03 + 0.34
9.6 0.2
Car (Slip)
MPC
0.15 = 0.09
336.5
MBD
1.84 0.62
69.2
Diff
0.51 + 0.18
34.7 0.9
CLBF-QP
90%
0.11 0.13
5.2 0.1
Segway
MPC
20%
1.39 0.55
254.6
MBD
85%
+.789
205.7
S Diff
100%
0.23
21.8
CLBF-QP
55%
0.06
12.7
Neural Lander
MPC
100%
0.11
247.2
MBD
35%
0.12
165.9
S Diff
100%
0.06 - 0.02
0.7
CLBF-QP
70%
1.09
18.6
2D Quad
MPC
45%
0.15 0.03
279.6
MBD
75%
0.47 0.29
112.3 0.2
S Diff
95%
0.11 = 0.03
82.4 0.3
CLBF-QP
100%
0.46 + 0.12
9.7 + 0.4
3D Quad
MPC
100%
0.09 1 0.02
324.9 2.7
MBD
100%
0.78 + 0.38
168.0 1
5 Diff
100%
0.05 = 0.02
83.5 0.8
CLBF-QP
78.75%
0.384
10.06
Average Performance above
MPC
66.25%
0.501
249.53
MBD
73.75%
0.954
122.73
Diff
98.75%
0.226
45.64
CLBF-QP
F-16 (non-control-affinc)
MPC
MBD
100%
68.34 1 32.77
611.3
13.7
Dififf
100%
47.61
12.45
257.2 5.5
rCLBF-QP
MPC
MBD
Ours
Figure 4: Control trajectories of a 2D quadrotor with four methods including ours Diff). The and x mark the start and end points, respectively. Green lines denote safe states; red lines indicate constraint violations. Diff achieves higher safety and stability, effectively handling non-convex constraints where baselines struggle.
learned for the F-16 system. Unlike gradient-based methods reliant explicit lincarization, Diffff can directly handle general nonlinear and non-control-affine dynamics. The resulting non-quadratic level sets highlight the flexibility and expressiveness of the neural network-based CLBF.
(2) ceffusion-sapller policies outperform those obtained through gradient gradient-based methods? Empirical results indicate that iiffusiion-sapple policies generally achieve superior performance. As shown Table 2 they outperform both MBD and rCLBF-QP across multiple metrics. This is further illustrated in Figure 4 which depicts trajectories for 2D quadrotor navigating around non-convex obstacles. While rCL.F-QPP performs reasonably well near the goal, the QP-based controller often struggles when the system starts far from the target, due to its myopic nature. In

---

contrast, diffusion-samee sampled policies produce smoother. more globally consistent trajectories and maintain significantly higher safety rate throughout the task.
(3) Are soflusion-sampplle policies further improved under the guidance of CLBFs? Yes- ges-guiding the diffusion process with learned CLBF enhances both safety and robustness. Unguided model-based diffusion with fixed penalties offer only local repulsion near unsafe boundaries, leaving most of the space uninformative; as result, the sampler exhibits low sampling efficiency due largely unguided exploration, leading to high variance and unsafe outcomes (see Table Figure Sa 12 In contrast, the CLBF shapes global energy landscape that funnels trajectories toward safe, gial-directed regions, yielding more stable behavior, consistently safer policies, and lower inference cost.
(4) Is the Almost Lyapunov theory reflected in empirical results? Our empirical evaluations provide strong support for the theoretical guarantees Theorem 3.1 showing that the violation rate empirically small (see Table 3). In the F-16 control task, for instance, we monitor violations of the Lie derivative condition and find that they occur with a frequency below 1.5%, as illustrated in Figures [b) IO] These low violation rates, together with the near-monotonic decrease of the CLBF scalar values, indicate that the observed system behavior is consistent with the Almost Lyapunoy stability property Equation (30p. Additional quantitative results are provided in Appendix F2
ours
MBD
8
2000
(1) apradt
1500
V63
Safe Level
1000
50d
North Position (f)
420
East Position (ft
0.025
0.050
0.075
450
0.100
(b) Evolution of the CLBF scalar value under the
(a) Comparison control performance between MBD and D on the F-16 system.
S Diff control policy, indicating Almost Lyapunov theory.
Figure 5: Comparison of control performance and Lyapunov behavior on the F-16 system. (a) Diff achieves improved tracking compared to MBD. (b) The scalar value of the CLBF under Diff shows a nearly monotonic decrease, demonstrating Almost Lyapunov stability.
Table 3: Estimated violation rate Val(X) on selected benchmark tasks. This fraction quantifies the relative size of the violation region within the compact state X (see Equation (18). and is empirically estimated via uniform sampling over X' to assess the practical violation rate.
(ol(
Task
Segway
Neural Lander
2D Quad
3D Quad
F-16
Violation rate
0.5%
1.1%
1.6%
1.3%
2.4%
4.2 Ablation Study
To assess the sensitivity diffusion sampling and loss function hyperparameters. we conduct a series of ablation experiments in the neural lander environment. More ablation studies in Appendix F.I
Violation Temperature. To evaluate robustness to the stability temperature 72, we train our CLBF with 72 E {0.5, 0.2, 0.1, 0.05, 0.02, 0.01). fixing 71 0.5 (selection from grid search). As shown in Table 4 both high and low 72 degrade performance: high values overly relax stability, increasing violation of stability and safety: low values impose striet constraints, leading to suboptimal solutions. An intermediate value 7/2 = 0.1 offers the best balance between stability and control performance.
Hyperparameter Loss Function. We study the effect of Lie derivative formulations in the loss comparing automatic differentiation (a1) and discretized approximations (az). Here, a1

---

Table 4: Control performance Diff across different temperatures for stability term.
Metric
0.5
0.2
0.1
0.05
0.02
0.01
Safety rate
35%
75%
100%
100%
100%
100%
x 2.ll
0.18 = 0.08
0.09 + 0.06
0.06 + 0.02
0.08 = 0.08
0.11 = 0.03
0.12 - 0.02
and ag weight the penalties from automatic (auto.) and discretized (dis.) Lie derivatives, respectively, shows that using only the discretized term (01 0, 1) degrades safety and convergence. Incorporating with balanced weights (a) = a2 1). yields the best stability and accuracy.
Table 5: Control performance of Diff under various CLBFs with different an, 02 configurations.
Metric
Or =
0g
01
0
Q1 = 0.5
1
01 0.5
01
Or = 0 CBF
0g 0
1
02 =
0g
CLBF (auto.)
CLBF (dis.)
CLBF
Safety rate 1 2.1l
10% 0.65 = 0.14
100%
85%
100%
100%
100%
0.15 0.07
0.21 + 0.09
0.09 0.03
0.11 + 0.05
0.06 + 0.02
5
Conclusion
In this work, we introduced Safe and Stable Diffusion DSfDiff), a novel model-based control frame- work that demonstrates how diffusion sampling can be leveraged learn certificate functions inspired by Almost Lyapunov theory. Conversely, we show that these learned certificate functions can effec- tively guide the diffusion process, resulting safe and stable control policies. Through a probabilistic formulation, our approach avoids the limitations of traditional gradient- methods, requiring neither relaxations nor control-affine assumptions. Furthermore, the framework is flexible and can be extended to more expressive neural certificate functions, offering promising direction for safe learning-bas based control. current limitation the slower inference speed compared to QP methods, which may be addressed via policy distillation.
References
[1] Amir Ali Ahmadi and Anirudha Majumdar. Some applications of polynomial optimization in operations research and real-time decision making. Optimization Letters, 10:709-729, 2016.
[2] Anurag Ajay, Yilun Du Abhi Gupta, Joshua Tenenbaum, Tommi Jaakkola, and Pulkit Agrawal. Is conditional generative modeling all you need for decision-makingg arXiv preprint arXiv:2211.15657 2022.
[3] Alberto Alfarano, François Charton, Amaury Hayat, and CERMICS-Ecole des Ponts Paristech. Discovering Цyарunov functions with transformers. In The 3rd Workshop on Mathematical Reasoning and Al at NeurIPS, volume 23, 2023.
[4] Aaron Ames, Kevin Galloway, and Jessy W Grizzle. Control Iyapunov functions and hybrid zero dynamics. In 2012 IEEE 51st IEEE Conference on Decision and Control (CDC), pages 6842. IEEE, 2012.
[5] Aaron D Ames, Jessy W Grizzle, and Paulo Tabuada. Control barrier function based quadratic programs with application to adaptive cruise control. In 53rd IEFE conference on decision and control, pages 6271-6278. IEEF, 2014.
[6] 7vi Artstein. Stabilization with relaxed controls. Nonlinear Analysis: Theory, Methods & Applications, 7(11):1163-117)) 1983.
[7] Andrea Bacciotti and Lionel Rosier. Liapunov functions and stability in control theory. Springer Science & Business Media, 2005.
[8] Peter I. Bartlett, Dylan J Foster, and Matus J Telgarsky. Spectrally-normalizeed margin bounds for neural networks. Advances in neural information processing systems, 30, 2017.
10

---

[9] Peter L Bartlett and Shahar Mendelson. Rademacher and gaussian complexities: Risk bounds and structural results. Journal of Machine Learning Research, 3(Nov):463344 48266333422228 2002.
[10] Nicholas Boffi, Stephen Tu, Nikolai Matni, Jean-Jacques Slotine, and Vikas Sindhwani. Learn- ing stability certificates from data. In Conference on Robot Learning, pages 1341-1350. PMLR, 2021.
[11] Eduardo F Camacho, Carlos Bordons, Eduardo F Camacho, and Carlos Bordons. Constrained model predictive control. Springer, 2007.
[12] Ya-Chien Chang, Nima Roohi, and Sicun Gao. Neural дyарunov control. Advances in neural information processing systems, 32, 2019.
[13] Charles Dawson, Zengyi Qin, Sicun Gao, and Chuchu Fan. Safe nonlinear control using robust neural lyapunov-barrier functions. In Conference on Robot Learning, pages 1724-1735. PMLR, 2022.
[14] Pierre Del Moral and Laurent Miclo. Branching and interacting particle systems approximations of Feynman-Kan Kac formulae with applications to non-linear filtering. Springer, 2000.
[15] Shutong Ding, Ke Hu, Zhenhao Zhang, Kan Ren, Weinan Zhang, Jingyi Yu, Jingya Wang, and Ye Shi. Diffusion-based reinforcement learning via q-weighted variational policy optimization. arXiv preprini arXiv:2405.16172 2024.
[16] Peter Giesl, Boumediene Hamzi, Martin Rasmussen, and Kevin N Webster. Approximation of Iyapunov functions from noisy data. arXiv preprint 16K1:16001.01666 2016.
[17] Lars Grne and Jrgen Pannek. Nonlinear model predictive control: theory and algorithms. Springer Publishing Company, Incorporated, 2013.
[18] Lars Grüne, Jürgen Pannek, Lars Grüne, and Jürgen Pannek. Nonlinear model predictive control. Springer, 2017.
[19] Shangding Gu, Long Yang, Yali Du, Guang Chen, Florian Walter, Jun Wang, and Alois Knoll. A review of safe reinforcement learning: Methods, theory and applications. arXiv preprint arXiv:2205. 10330, 2022.
[20] Philippe Mansen-Estruch Ilya Kostrikov, Michael Janner, Jakub Grudzien Kuba, and Sergey Levine. Idql: Implicit geaarning as an actor-critic method with diffusion policies. arXiv preprint arXiv:2304. 10573, 2023.
[21] Lukas Hewing, Kim P Wabersich, Marcel Menner, and Melanie N Zeilinger. Learning- model predictive control: Toward safe learning in control. Annual Review of Control, Robotics, and Autonomous Systems, 3(1):269-229 296, 2020.
baased based
[22] Michael Janner, Yilun Du, Joshua B Tenenbaum, and Sergey Levine. Planning with diffusion for flexible behavior synthesis. arXiv preprint urXiv:2205.09991, 2022.
[23] Basil Kouvaritakis and Mark Cannon. Model predictive control. Switzerland: Springer International Publishing, (,11-
[24] Wook Hyun Kwon and Soo Hee Han. Receding horizon control: model predictive control for state models. Springer Science & Business Media, 2005.
[25] William Levine, Lars Grüne, Rafal Goebel, Saša V Rakovic, Ali Mesbah, Ilya Kolmanovsky, Stefano Di Cairano, Douglas A Allan, James B Rawlings, Martin A Sehr, et al. Handbook of model predictive control. Control Engineering. Birkhäuser Cham, 2018.
[26] Yaron Lipman, Ricky TQ Chen, Heli Ben-Hamu, Maximilian Nickel, and Matt Lc. Flow matching for generative modeling. arXiv preprint arXiv:22 2022.
[27] Shenyu Liu, Daniel Liberzon, and Vadim Zharnitsky, Almost іyаpunov functions for nonlinear systems. Automatica, 113:108758 2020.

---

[28] Johan Löfberg. Automatic robust convex programming. Optimization methods and software, 27(1):115-129, 2012.
[29] Cheng Lu, Huayu Chen, Jianfei Chen, Hang Su, Chongxuan Li, and Jun Zhu, Contrastive energy prediction for exact mnegy--giied diffusion sampling in offline reinforcement learning. In International Conference on Machine Learning, pages 22825-22855 22855. PMLR, 2023.
[30] Haofei Lu, Dongqi Han, Yifei Shen, and Dongsheng Li. What makes a good diffusion planner for decision making? In The Thirteenth International Conference on Learning Representations, 2025.
[31] Colin McDiarmid et al. On the method of bounded differences. Surveys in combinatorics, 141(1):148-188, 1989.
[32] Chaoyi Pan, Zeji Yi, Guanya Shi, and Guannan Qu. Model-based diffusion for trajectory optimization. Advances in Neural Information Processing Systems, 37:57914-57943, 2024.
[33] Chaoyi Pan, Zeji Yi, Guanya Shi, and Guannan Qu Model-based diffusion for trajectory optimization. Advances in Neural Information Processing Systems, 37:57914-57943, 2025.
[34] Antonis Papachristodooloou and Stephen Prajna. On the construction of Iyарunov functions using the sum of squares decomposition. In Proceedings of the 41st IEEE Conference on Decision and Control, 2002., volume 3, pages 3482-3487. IEEE, 2002.
[35] Zengyi Qin, Kaiqing Zhang, Yuxiao Chen, Jingkai Chen, and Chuchu Fan. Learning safe multi- agent control with decentralized neural barrier certificates. arXiv preprint arXiv:2101.05466. 2021.
[36] Muhammad Zakiyullah Romdlony and Bayu Jayawardhana. Stabilization with guaranteed safety using control lyarunov-barrier function. Automatica, 66:39-47, 2016.
[37] Carsten Scherer and Siep Weiland. Linear matrix inequalities in control. Lecture Notes, Dutch Institute for Systems and Control, Delft, The Netherlands, 3(2), 2000.
[38] Pierre OM Scokaert, David Q Mayne, and James B Rawlings. Suboptimal model predictive control (feasibility implies stability). IEEE Transactions on Automatic Control, 44(3):648-66 1999.
[39] Oswin So and Chuchu Fan. Solving stabilize-avoid optimal control via epigraph form and deep reinforcement learning. arXiv preprint 230.::3300..1144,, 2023.
[40] Oswin So, Zachary Serlin, Makai Mann, Jake Gonzales, Kwesi Rutledge, Nicholas Roy, and Chuchu Fan. How to train your neural control barrier function: Learning safety filters for complex input-constrained systems. In 2024 IEEE International Conference on Robotics and Automation (ICRA), pages 11532-11539. IEEE, 2024.
[41] Jiaming Song, Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. arXiv preprint arXi::2010.02502 2020.
[42] Yang Song, Jascha Sohl-Dickstein, Diederik P Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. Score-based generative modeling through stochastic differential equations. arXiv preprint arXiv:2011. 13456, 2020.
[43] Eduardo D Sontag. A lyapunov-like characterization of asymptotic controllability. SIAM journal on control and optimizution, 21(3):462-471, 1983.
[44] Nathan Srebro, Karthik Sridharan, and Ambuj Tewari. Smoothness, low noise and fast rates. Advances in neural information processing systems, 23, 2010.
[45] Dawei Sun, Susmit Jha, and Chuchu Fan. Learning certified control using contraction metric. In conference on Robot Learning, pages 1519-1539, PMLR, 2021.
[46] Keng Peng Tee, Shuzhi Sam Ge, and Eng Hock Tay. Barrier Iyapunov functions for the control of output-constrained nonlinear systems. Automatica, 45(4):918-9) 2009.
12

---

[47] Toshihide Ubukata, Jialong Li, and Kenji Tei. Diffusion model for planning: A systematic literature review. arXiv preprint arXiv:2408. 10266, 2024.
[48] Sara van de Geer and Sara van de Geer. Symmetrization, contraction and concentration. Estimation and Testing Under Sparsity: École d' Été de Probabilités de Saint-Flour XLV-2015, pages 233-238, 2016.
[49] Zhendong Wang, Jonathan J Hunt, and Mingyuan Zhou. Diffusion policies expressive policy class for offline reinforcement learning. arXiv preprint (eXXi:2208.06199 2022.
[50] Wei Xiao and Calin Belta. High-order control barrier functions. IEEE Transactions on Automatic Control, 67(7):365--300 2021.
[51] Wei Xiao, Tsun-Hsuan Wang, Chuang Gan, and Daniela Rus. Safediffuser: Safe planning with diffusion probabilistic models. arXiv preprint arXiv:2306. 2000::23000004446 00148, 2023.
[52] Melanie N Zeilinger. Manfred Morari, and Colin N Jones. Soft constrained model predictive control with robust stability guarantees. IEEE Transactions on Automatic Control, 59(5):1 1990- 1202, 2014.
[53] Jiechao Zhang, Hadi Beik Mohammadi, and Leonel Rozo. Learning riemannian stable dynami- cal systems via diffeomorphisms. In 6th Annual Conference on Robot Learning, 2022.
[54] Ruikun Zhou, Thanin Quartz, Hans De Sterck, and Jun Liu, Neural Iyаpunov control of unknown nonlinear systems with stability guarantees. Advances in Neural Information Processing Systems, 35:29113-291 2022.
13

---

A
Notation
Notations
Meaning
safety level differentiable dynamics probability distribution cost function discrete time step control policy nominal control policy
f
p
t
u nominal
state
2x
equilibrium state
0n, 02
tunable parameters in loss function 11
activation function
Y
7171:2 72
temperature constants
A
dissipation rate Rademacher complexity trajectory sequence (#1.7, (1.r)
R
U
4
compact control policy space control Lyapunov barrier function
V
X
compact state space compact safe state space indicator function
X.
14
L
Lie derivative volume measure function violating set lying in the compact set X' spectrum norm of operator
Vol(.)
Ω
|||||
||||2
1-norm of 2-norm of the rows of matrices
14

---

B Preliminaries
Definition B.1 (Safe and Stable Control Policy), Given differentiable dynamical system á, f(z,, uz) with target goal non-empty safe set X,, and an avoid set X' \\ Xx. safe and stable control policy must satisfy the following properties:
Stability: The system state x, asymptotically approaches x, within a small tolerance e, i.e.
limsup
|| - x. s.
1-
Safety: The system remains within the safe set all times, i.e.,
By E Xx: WEN..
Remark B.2. The stability ensures the reachability the dynamical system asymptotically contracting to x. while avoiding all unsafe states in X' \ Xz We make mild assumption that control policy always exists to satisfy both safety and stability requirements.
Definition B.3 (Lie Derivative). Let V : + R be a continuously differentiable scalar function and let f: X' U RR be continuously differentiable vector field. The Lie derivative of V along the V, is defined as:
vector field f, denoted V,
LfV(2) = VV(x)T((() u)
where (V()) R" the gradient of V at point æ. This quantity represents the rate change of V along the trajectories of the dynamical system á f(x, u).
Proposition B.4. Let V : X + R be a continuously differentiable function satisfying the following conditions 66:
1. Equilibrium: V(z.)=0 0.
2. Positivity: V(x) > for all X \ {x+).
3. Uniform dissipation: There exists À such that inf
LzV(x) (V 00, Vo X {x,), wEll
where (x) is the Lie derivative of V along the system dynamics ã f(x, u).
Then the equilibrium point is exponentially stable under suitable control policy u E U, in the sense that:
V(x.) S ((ro)e->, VI 0. Moreover, (x) radially unbounded and satisfies bounds
on a1 - x=ll) S V(x) S az([1 - xx11),
for some class Koe functions a1 Q22 then:
|| x.1l < 3(11=0 x 11,),,),
for some class K.C. function B, and in particular:
Ix, x.1 Ke- for some K > 0.
While the ideal Lyapunov function highlights that uniform dissipation ensures exponential stability, learning such a perfect function from finite data theoretically impossible. Rather than focusing on these strict conditions, we turn to the framework of Almost Lyapunov theory.
15

---

Lemma B.5 Carlo Estimation of Score). In the Diffusion process defined as follows. The
marginal distribution satisfies:
p(U) / p(U II p(U U³) U
(13)
And the forward process:
p(U ( ~ N(Vo, (1-a5))),
(14)
where is the scaling factor and I is the identity matrix. the score function of corrupted samples can be rewritten as
1 - (U' varuo) 1- aj
V y log p(U)) = Eto~p(t9)19
(15)
Proof. We leverage the estimated for Diffusion Sampling, start with:
Ve log Virp(U') Vos I p(U UU))(UU)) de du
p(U
p(U))
VoPUU DU) awo
p(U))
/ VpppUU U p(U p(T))) dvo p(U!)
(16)
p(Us (U))
dvn f U log (1))((m (U))
((o0)())) V p(U' [0)].
Using the known form of p(U ( from Equation
p the score function becomes:
ai (U* varuo)
Ve (U')) Ego
(17)
16

---

C
Theoretical Guarantees
This section is divided into parts:
Appendix C.T:: we give a sharinng-theorete analysis showing that one cannot, in general, learn a neural CLBF that enforces uniform dissipation everywhers bounded domain. Instead, with sufficiently many samples, the volume (Lebesgue measure) of the "dissipation- violating" region can be driven arbitrarily close to zero.
Appendix C.2 we further prove that-even when uniform dissipation fails furls-our
our diffusion- sampled control policy still achieves almost-sure stability, provided the volume of the dissipation-violatin region is sufficiently small.
C.1 Convergence Analysis of Neural CLBFs
To establish error bound for the neural CLBF, consider the probability- under the uniform distribution over a compact set X C R=- that the Lyapunov dissipation condition is violated. Specifically, we define the violation probability
Px(C)V(x) XV > 0) Ex~UnI(()) ([vcooo))
Vol (fx E (,V(x) XV
(18)
Vol(X)
where V-l(-) denotes the volume measure (e.g.. Lebesgue measure in probability theory) in R", Our goal is to minimize the violation region's volume. This expression quantifies the fraction of the domain X' over which the Lie derivative condition fails to hold. It follows that a small expectation corresponds small violation region. Throughout we assume the dataset D drawn i.i.d. from the uniform distribution over X' therefore training and test distributions coincide.
Regularity Assumptions. Before proceeding with the formal analysis, we introduce regularity assumption on the candidate CLBF V. Specifically, we assume that V V, where V C C²(B", .)) denotes the class continuously differentiable functions that are uniformly bounded in magnitude by constant B > 0; that is |l ||[| B for all x X, where X' C IR is compact. In addition, we assume that the policy u(x)) is Lipschitz continuous with respect to the state x, i.e., for all 22 X, [[u(;;) - u(>2)]l & L| I2l for some constant I, > O.
The following lemma provides an upper bound on the probability of constraint violation of uniform dissipation with the learned V in terms of the model complexity and the number of training samples.
Lemma C.1. Fix ô E (0, 1). Assume that the function V V is bounded by a constant B compact set. Suppose that the minimization of Equation (8)) is feasible and let V denote a solution. The following statement holds with probability at least 8 over the randomness of æ1..... F'n drawn i...d. from dataset D
log
2log(log(4B/m)/5 (4B/1//))
(onD(C,V(z)) + +V 71) & M
R² (V) +
(19)
172
m
where R., (V) A sup ED (en-Uni((++1
Em (C, XV is the
supvev m
Rademacher complexity of the function class V and M is universal constant. Also, the positive constant 7) is margin parameter.
Remark C.2. Lemma C.1 is directly derived from Theorem 5 in 44 which connects the probabilistic error in Equation (88 to an upper bound involving the Rademacher complexity R. (V). Different from the previous proof in [10, [6], we prove the general enror bound of neural CLBF without any quadratic form assumptions.
Lemma C.3 (Concentration of the Sampled Control Policy). Let wi.r.... .ir be i...d. random vectors in (a, 6)" from the target distribution U in Equation (6), and define
Q
Wir = E B[ }, WIT =
u "i.r-
Q
17

---

Then for any > O,
2Q=²
- 2e) s 2T exp
(6 ab-
In particular, if
Q (b-a)²
21
log
2²
then with probability at least 6,
11. 1iorllo Se.
The proof of Lemma C.3 follows by applying Hoeffding's inequality to each coordinate of the trajectory and then taking a union bound over the T time-steps. When the sample number Q is greater than [b-o)² log( 2T
8 ), the probability is at least -. 8.
To prove the convergence of violation region's 's volumn of a neural CLBF trained using diffusion- sampled policies, two key factors must be taken into account: (1) the Rademacher complexity the function class V, denoted (VV); and (2) the perturbations introduced by the diffusion-sampled policy, contrast to the noiseless case, we denote the Rademacher complexity the learned neural CLBF under diffusion-inducee noise as R))).
Theorem C.4 (Sample Complexity of Neural CLBF). Under the regularized assumptions, the function class V is controlled by a N - laaer neural network with ReLU activation function such that V(x) WxoN-1(WN-I
d1 (Wzz)). The following statement holds with probability at least
1 - 26 over the randomness of #1, Zm drawn i..dd. from dataset D and Q (b-a)²
log( 2I
26
(2-D(L,V(x)) + XV(x) > -n)
log
R
Wall2a (31)
3/2
2
<M
7m
((1
A Σ
| Wee
n
Wallz
R2,(1))
2 logglog( (Blllogg(A///)) 4B/n)/8)
(20)
Here, [Wll2 is the spectral norm of W and 1l,,, e EivEn En W is denoted the 1 noro of 2-norm of the rows of W. Also, || ف sup fz, 4)ll2. R a supzex ||0|||-
Proof. We now take V be the class of N -lyeer neural network with ReLU activation function:
V(x) W WwwN- ... on (Wix)), (x(2) max(0,2),
(21)
with bounded spectral norm and row-sum norm || and || 1111,,11 respectively. show that the Rademacher complexity of N N- neural network with fe-lipsschit activation function is
Rm IN IP: W
Will2a 2/3 [Wil22
3/2
(22)
V Vm
where R supzex ||ز||
Back to the Rademacher complexity Rm, (V), 1 is different from V since it also influenced by perturbations from the diffusion-samplee policy. we first adapt fundamental fact from the calculus of Rademacher complexities [9]. along with the trivial identity
Rn,)),,
1
m (CCre.,,)V(..))) - C (a)))
Rm S Rm (V) + Ee [sup VEY m
18

---

Since 1/m Ei=1 G - 1 Ei=1 |6,| S sup; 16:1, we can further decompose it as
Σ (v) S E. sup VVE m
1
+ sup sup (f de), VV(x,)) (f(2s, VV(x;))
3E VEV
S E. sup VEV
1 Σ (<C)V(x))
- +E, VVE
sup
Σ (AV
(23)
+ sup sup (f(x;,))) dz), VV(x.)) (f(as, u.), VV(x.)) E Vev
gellcy
R2 is exactly follows the complexity in Equation
22
Based on the definition of Lie derivative, the
Rademacher complexity R1 can be bounded as
R1 = E, sup VEV
Σ
- 11 E.
sup VVE
sup
ciu, VV
(24)
||=|||=1
i=1
1f II
IP:
[
Willza Willa
2/3
3/2
Vm
The derivation of Equation 24 from the first to second line is based on Ledoux-Taalle Talagrand lemma and Lie derivative properties (x)] S |l [>))2]] The second line to third line from the Jacobian Lipschitz property, in which we can use 11::PP || to bound the norm of Jacobian matrix. On each linear piece of the ReLU network, the gradient is given by the same weight matrices, so the spectral-norm product likewise controls the complexity the Jacobian.
48
The third term Apolicy can be bounded according Lemma C,3 and the probability holds with at least
1 - when sample number Q >
(b-a)²
log( (T):
20
policy
sup sup (f(x,, û.), VV(x:)) (f(es, u)), VV(x:))
sE VEV
< sup sup (f,,,, (4) f( w.). VV(x)) sEX VEV
(26)
V..illl bo S |V 1v.fllolln I Pi [Wll2c.
Due to the properties of ReLU activation function, P: is bounded by 1. Combining the R1, R2,
Lemma C.I. and perturbations of diffusion-sampled policy in Equation (26) together, we obtain that the probability holds at least 28:
PEND (L,D((,V(x))))))) + AV(x)= 77)
log
R
Willaa 2/3) |Will2
3/2
2
<M
((1 + X)II (W m
+ VV I I
2 loog(og( (4B/n)/8) +
m
(27)
Here, M universally bounded constant, which avoids to use many constant terms. We can know that the volume of violation region will decrease as Ō L). The proof end.
For arbitrary L Lipschitz function Φ R" -> R. we have
E
sup
1 M
(((a(()))) & LE. sup m
ag <x)
(25)
19

---

C.2 Almost Sure Guarantees
To establish safety and stability with an almost sure guarantee, we also adopt the regularity assump- tions detailed in Appendix C.I. Specifically, we assume that the gradients and Hessians of the candidate CLBF, as well as the dynamics function and Jacobian, are uniformly bounded over the compact sets X' and U. That is,
ol
|V S B
for some constant B > O.
Lemma C.5 (Comparison Lemma (6). Suppose that a continuously differentiable functioo V R + R satisfies the following differential inequality:
V(xa)= -XV(xx, +C, VER
(28)
where A E aB,,CCE
C E IR, and (10o E R. Then, we have
V(n)) S exp(->M)V(z0) + X (1-exp(-AM
(29)
Theorem C.6 (Safety and Stability with Almost Sure Guarantees), Let X' be a compact state space and consider the continuously differentiable dynamical system f in Equation (T). Let V X - R be smooth positive definite function. Assume that there exist constants X >> 0 and >> 0, and an invariant, connected, non-set con-self-overlapping and measurable set Q X with small volume Vol(S)) <e, such that the following holds:
(A) For every x E X2 the Lie derivative of along J satisfies minweu L2V(x) < <>V(2a).
(B) For x E Q,, we allow (vV -VV(x) without any further restrictions, i.e. no uniform dissipation condition.
Then, there exist positive constants aı and C, with < < < X. such that for any E X, C X, the solution In of Equation ①1) under the diflusion-sampled policy satisfies, almost surely.
((a.) S exp((>itLV( Cet, V.
(30)
In other words, the influence of the "bad" region Ω introduces only additive term of order O(e ensuring that the overall decay remains almost exponential over time.
Proof. We split the argument into two main parts. In Step I we show that, by choosing small "buffer" around the bad set, we recover uniform dissipation everywhere else. In Step we discretize the trajectory generated by diffusion policy, build suitable supermartingale, and invoke Azuma- Azuma-Hogffding together with the Borcl-Cantelli lemma to conclude almost-sure exponential decay.
Step Uniform dissipation outside small ball.
We firstly define ball with radius r in Euclidean space R", it can be formally written as
B(g.r) A (x || 4/la S r}.
Concretely, for any radius > 0 define the neighooordd of Ω by
Ω2 = {x E X' dist(ar <r),
which is equivalently the Minkowski sum Ω B(0,r). r). By standard volume growth estimates (e.g.. from Steiner's formula), the volume of S2, satisfies
Vol(2,, S Vol( + O(r).
for some constant C, > O depending on the geometry Ω and the ambient dimension n. Therefore,
by choosing r = (/a), we can ensure that Vol(Ω,,) & 2e for sufficiently small e. This allows us to recover uniform dissipation on the complement X' [r..
20

---

To analyze the local behavior, if 24 is in the small bad region Ω. In such case, the extreme point can be write as follow:
sup s ) sup (x))
S <-V((a)) + sup [1 VV (f(1,, ue), (V(x)))I
(31)
& -VV(2)) + (1V VV + /VV sup
sup || xalls
where the derivation from this inequality is based the regularity assumptions of f. V and Here, the extreme point Fy is lying in the bad region Q2 and z is just outside of a covering region Ω2 Since Ω is always contained in pre-defined region S2,. We can always find xy, with the distance between Iy and of bounded by oE with e > O. The fact can easy to derive based on the geometric properties the volume of hyper-sphere. According to this fact, we have
- -AV(2 +
sup || xzl
< <-AV(a)) - S-
-- (1 - (V0--)/VV))---2VV/0==( //V
+ IVVII1//)
(32)
- -EI + 2c
sced.
According to the radially unbounded of CLBF see Proposition B.4 we have the property that V(x.) 2 /|| with some > 0. Then, we have the following result such that
BeBeen
-(1- -(-a))Vo)--AVVc))+++ 2 S --(1G))A(()), E
(33)
Step 2. Probabilistic convergence via supermartingale
Stochastic model. Assume the controlled dynamics via diffusion policy are given by dæ, = f(z,, 4z) dt + 72 ((x)) dW,,
where W. is n-dimensional Wiener noise, Let h be fixed time step and define the discrete- time sequence
Z (x),), where 4x kh.
Let F& ( Z1... 2x) be the associated filtration.
Itō increment decomposition. Applying Itt's formula V(re)) over interval [4x, [e+1] yields:
Zx+1 Zz
(IV(I,, us) ds +
12
fu+1
tr (xx.)))(())))) ds
2
Mk.
(34)
where Mj is a bounded martingale increment with E[M, Fil = 0, and
Mr S Emax || VV VT.
Uniform dissipation outside small region. Let X = X B(O,r.), where
2/B2el/v
r.
From Step 1, we have
(2V(z) -(1 Vr Yre X.
Moreover, if 72 is sufficiently small, then exist e2 0 when the CLBF is radially unbounded (see Proposition B.4)
1/ tr (()2) (x).
2
21

---

Combining these, we obtain from
34
E x
Z
A = (1 6 (2) A.
Thus, ] is a nonnegative supermartingale.
Concentration via Azuma-Hoeffding 31 Since the trajectory generated by diffusion policy is
always bounded, there exists a constant max = OhB + 72v v2/BB) such that
Z++1 Zn A max: a.s.
By Azuma-Hoeftding incquality, for any E N and 17 >
N-1
211²
p IN Zo + A
Σ
hBx 21
S sexp
NA2
Inxx
Choosing 1) = max V N log N, we ensure the sum is finite as N= P(ZN Zo+ + A ENE Zx) S
Σ N-2 0o. Then, by the first Morel-Cantelly lemma:
(Zx+1 Zk + >1hZz 2 0 infinitely often) 0,
which implies that almost surely:
Zk+1 Zk S ~>1 for all large k.
Therefore,
2x S (1 71 a.s.
This implies that once the initial state Tog lies within the safe set, safety is almost surely guaranteed, the CLBF exhibits almost monotonic decrease.
Return to continuous time and add influence of Ωt Replacing the discrete time & to continuous time t/h and incorporating the worst-case additive term from the bad region Q, which is bounded by / in Equation 32 we invoke the Comparison Lemma C.5 to conclude:
Cm (1-exp( (pt)),
V(x,)= S exp((>nt) +
Vt 2 a.s.
A1
where 0 << A1 < A. This completes the probabilistic part of the proof.
22

---

D
More Details About Experiments
D.1
Tasks
Inverted Pendulum.
The state of the inverted pendulum is given by = [0, 0), where is the angular displacement from the upright position (measured counterclockwise from the vertical) and 0 is the angular velocity. The control input is torque applied the pivot. The system parameterized by the pendulum mass m, length and moment of inertia I = ml? The dynamics are given by the second-order nonlinear equation given by
mg!!
sin 0 + 7
and g the gravitational acceleration. We consider stabilization task the upright equilibrium. The goal set is r, 0, the safe set is defined as Sate fx: : |0 s 0.5 A | S 2}, and the unsafe set is defined as Xinsafe = { 0 2 π ||>||| 2 2.5}.
Car (Kin). The kinematic single-track car model is to catch reference path. The reference path is parameterized by its linear velocity Uref, acceleration Ozef, heading Vrrff and angular velocity Wref-
The state the path-centric model is defined as x = [Ee: Me, 5, Ue seel where (re, Me) denotes the position error in the Frenet frame, ō is the steering angle, U. is the velocity error and the is the heading error. The control input is u = [1s, (long] representing the steering rate and the longitudinal acceleration, respectively. The dynamics takes the form fxx + ((x),, where
T coos((e) Uref + Wrefffe usin( (e)) Wref
0
0
0
0
f(z)
g(x) =
1 0
Oref
0
1
(a) Weef
0
0
with + Uref. and 4, denoting the distances from the vehicle's center of mass to the front and rear axles, respectively. The goal state defined as x, O. Since the reference heading and position do not explicitly appear in the dynamics, this formulation describes tracking task rather than reach-avoid task.
Car (Slip). The dynamic single-track (sideslip) car model is used for trajectory tracking task, where the objective to follow reference path. This model captures more complex vehicle behavior than the kinematic model by incorporating lateral dynamics and tire slip, which become significant at higher speeds or during aggressive maneuvers. The state of the model is x [Ze. yee 8, Ve. Me, Ve. }). where ze. Ve are lateral and longitudinal errors, ō is the steering angle, ve is the velocity error, dhe is the heading error, di is its time derivative, and 3 the sideslip angle. The control inputs u = [Us, Along] the same in the kinematic model. The dynamics takes the control form & f(x) + (()) where
t cos( (b)) - Uver + Wroffle
1 viin(1/s (t))
Wheffe
0
0
f(x)
dia
(1, + Wret) + 1,(,+1,))
I,0,,1,) (1 (gsggl.)) (.0)+ - - (iie whet) ,0, (Os.gg (Cs.gl पा. (Cs (Cssgl,)ō
um
um
am
0
0
1
0
g(x)
O
0
0
0
0
0
23

---

with v = ve + Uzef- and parameters z Ir, Csy, Csr: g denotes gravitational acceleration. The goal state defined as I. 0.
Segway. We consider the Segway obstacle avoidance task, where the system must move forward while avoiding circular obstacle. Successful avoidance requires the Segway to temporarily tilt forward to maneuver around the obstruction. The state of the system is defined as = (p, 0, 0, w], where p is the horizontal position, is the tilt angle and v, are the corresponding linear and angular velocities. The control input w is a horizontal force applied at the base. We assume the wheel's vertical position remains at zero and the Segway length normalized one. The obstacle is modeled as circle of radius 0.1 centered at (0. 1). The position of the Segway's 's top is given by (px. Py) (p sin 0, cos The unsafe is defined
=(x
uunsafo
(Py-1)2 1 $0.
and the safe set is
V1 + (pv 1 0.15
Xaai
Let M the base mass, m and the mass and moment of inertia of the body, and the distance from the base to the center of mass. Define total mass M, M + m and total inertia J, = J + ml?. The gravitational constant is denoted g. The dynamics are expressed in form as = f(x) + g(x)u. where
W
[(x)
sin cos 4+ cos 0 44 u
Ia sin
g(0))
(No +os 8)
cbs Mr.j
Au
cos? 0 2,12 +
Aau 8-4-
8-w sin
2gl (cos 0+
cos2
Made Ao
one
Mr +Dgg m²12
Here, >; denote intermediate constants derived from model parameters and simplifications. This formulation captures the coupled nonlinear dynamics and their dependence on tilt for obstacle avoidance.
Neural Lander. The state of the Neural Lander model is defined as [Pæy Py: Uay Vy Usl. where Py. P=] denotes position and ['z, Uy. Vz] velocity. The control input is [f fg fz). with defined to be positive in the upward direction. This model is parameterized by the mass m. and system dynamies are expressed as f(x) + g(x) u,, where
Uz
0
Uy
0
0000
f(x)
U2 Fa/m Faz/m
s(x)
0
1/m
0
0
1/m
Fas/m-a
0
0
1/m
and is the gravitational acceleration. The term Fg = [Fa1, Faz, Fas) represents the aerodynamic
disturbance due the ground effect. The goal state defined as x. the safe set as X {a
p= 2 -0.05 A ||>||| < 3), and the unsafe set as Xunsate (x: : P= < 0.3 v |||||| 2 3.5).
The state vector of the 2D quadrotor model is defined as x = [Pz. Pz. O, Cz. Us 0). where P2. denotes position, is the pitch angle, and [Mz, Uz]. represent the corresponding velocities. The control input is u = [u,, ug]. with Pa. "1, and ti2 taken be positive in the upward direction. The system is characterized by the mass m, moment of inertia I, and rotor arm length The dynamics are described by the system = ((x + g(x)u, where
2D Quadrotor.
Ux
0
f(x)
g(x)
1.
sin 0
sin
T
T
cos
COs
0

---

and denotes the gravitational constant. The unsafe set Nunsate is defined as the region occupied by obstacles, while the safe Sate is specified as 0.1 m oftset from the obstacle boundaries.
3D Quadrotor. The state of the 9-dimensional quadrotor model is defined as [Px> Pys Pz, Uzy Uy, Us Φ, 0, vb). where ps and v, denote positions and velocities, and Φ, 0, to are the roll, pitch, and yaw angles, respectively. The control input is given by u = [f. ø, 0, æb]. This model is parameterized by the mass m, and system dynamics expressed form, f(x (()),, with
Up By
0
0
U2
0
0
0
1 sin 0
0 0
0
f(x) =
0
g(x)
=
1
cos sin d
0
0
T
g
cos cos d
0
O
0 0
0 0
1 0
0 1
where ! denotes the gravitational acceleration. The goal state is defined w. {0]. the safe as
Naate {x P= 2 0 A ||||| I 3}, and the unsafe set as Aunsate {or Ps I -0.3 V || 2 3.5}.
F-16. The F-16 aircraft is modeled nonlinear dynamical system with 16-dimensional state vector I E R and 4-dimensional control input vector E R Each component of the state vector has a physical interpretation as follows:
VV,, 0,0,8, P.Q.R. Pes h, pow, int,,, intps, int
Vr: True airspeed (ft/s) - the speed of the aircraft relative to the surrounding air.
Angle attack (rad) - the angle between the aircraft's longitudinal axis and the oncoming airflow.
a:
3: Sideslip angle (rad) the angle between the aircraft's 's heading and its actual flight path laterally.
Φ: Roll angle (rad) the rotation of the aircraft about its longitudinal axis.
0: Pitch angle (rad) the rotation of the aircraft about its lateral axis.
v: Yaw angle (rad) the rotation about the vertical axis, determining heading.
P: Roll rate (rad/s) angular velocity about the longitudinal (roll) axis.
Q: Pitch rate (rad/s) angular velocity about the lateral (pitch) axis.
R: Yaw rate (rad/s) angular velocity about the vertical (yaw) axis.
Pn: Northward position (ft) - horizontal displacement in the north direction.
Pe: Eastward position (ft) horizontal displacement in the east direction.
Altitude (ft) - vertical position above sea level.
pow: Engine power state internal dynamic state representing engine thrust lag.
int,_: Integrator state for vertical acceleration (normal G-force) regulation.
intps: Integrator state for stability-axis roll rate tracking.
Ny. Integrator state for lateral acceleration and yaw rate tracking.
The control input vector is: u [ of Nu. ref throttle]
Nref, Reference normal acceleration (G-forces) controls pitch via the elevator.
pef Reference roll rate governs rolling motion via ailerons and rudder.
Nyje Reference combination of side acceleration and yaw rate maintains coordinated
flight and yaw control.
25

---

throttle: Throttle command scalar value in [0, 1], where 0 represents idle and 1 represents full throttle.
This system is not affine in control; that is, it cannot be expressed as E - f(x) + g(z) u because the inputs pass through nonlinear autopilot that internally computes actuator commands, which are then applied via complex, nonlinear aircraft model involving aerodynamic forces, actuator dynamics, and engine lag.
Goal Set:
2+ = f 16 + 20. 0. |0l S 0.1, |P| S 0.25, h 2 1000}
Safe Set:
Xaaee = fxr E 18 h 2 500, 0.95 min S a S 0.95 Tmax: T $ Bgoal
where Bgoal is buffer region around the goal set defined as:
B Booal = f E R 16 1+ -.2, |øl s 0.2, |P| S 0.5, h 2 800}
Unsafe Set:
Nunsate for 16 h $ 100)
26

---

E
Implementation
Algorithm 1: Diff
Input:
Distribution of initial states Da., model dynamics f, nominal policy, number of training
epochs K
Output: Certificate function (CLBF) VK
Initialize the certificate function (CLBF) Vo with parameters 8: for epock
K do // === Phase 1: Guided Trajectory Sampling ===
Initialize an empty dataset new trajectories D;
for each initial state zo in butch sampled from Droo do
Generate one full trajectory via guided denoising process by maximizing Equations (6) and (8;
Sample clean trajectory U by applying the reverse diffusion process (Equation TO
with model dynamics f. starting from noise;
The process is guided at each step by the current CLBF Vk-1i
Add the resulting trajectory U to the dataset D;
// Phase 2: CLBF Update
Use the entire newly generated dataset D for training: Update CLBF parameters by performing gradient descent on the loss from Equation using trajectories from D, obtain V&;
In Phase 1, we use the current CLBF V to guide a model-hased diffusion 33 sampler to generate batch of trajectories. This is done by sampling from CLBF-shaped target distribution p(U), defined Equation (6) and 8 and using the reverse diffusion process. At each denoising step, we approximate the score log p(U*) via sequential Monte Carlo, leveraging the known dynamics model f f(r,u).
Importantly, diffusion process is not learned via neural network training. Instead, it is fully algorithmic, model-based diffusion guided by the CLBF through the structure the target distribution p(U). This distribution is explicitly designed to assign higher likelihood to trajectories that satisfy the safety and stability criteria, i.c., Psate and Psuale As a result, the diffusion process is biased toward generating CLBBF-cmpliant trajectories without requiring gradient-based training of score network. While there is no learned diffusion model, the objective p(U) still plays a central role-it guides the sampling, not learning.
Phase 2, the CLBF updated using the sampled trajectories by minimizing the supervised loss defined in Equation (IT). This alternating process is repeated over training epochs, allowing the CLBF and the sampler to iteratively improve.
27

---

More Experiment Results
We also present additional experimental results, including extended ablation studies and further quantitative analysis. Note that all inference time evaluations were conducted on the same device: Intel 13900 CPU with one RTX 4090 GPU.
F.1 More Ablation Studies
Ablation Trajectory Length We conduct an ablation study to evaluate the impact of trajectory length on the performance of Diff in neural lander, as shown in Table Short trajectories (length 2) lead to low evaluation time but suffer from poor safety (35%) due to limited foresight. Increasing the trajectory length 5 significantly improves both safety (100%) and accuracy, achieving the best performance in terms of tracking error However, further increasing the trajectory length results in diminishing returns for safety and degraded tracking performance, along with substantially higher evaluation time. This suggests that moderate trajectory lengths strike good balance between efficiency, safety, and control accuracy, while excessively long rollouts introduce variance and unnecessary computational cost.
Table Control performance of Diff under different trajectory lengths in neural lander.
Trajectory length
Eval. time (ms)
Safety rate
2 x+1l
28.9 + 0.4
35%
0.08 + 0.05
5
35.4 + 0.7
100%
0.06 + 0.02
10
105.1 + 2.4
100%
0.09 0.06
15
126.3 = 1.5
100%
0.17 = 0.09
20
237.5 + 6.8
100%
0.26 0.07
50
598.6 + 25.0
100%
0.35 + 0.17
Parameterization of V. We observed that the quadratic-form parameterization V(x) w(z) w(x), as used in [13, can result in a high failure probability for systems with non-convex constraints, such as the 2D quadrotor, Segway, and F-16. In contrast, employing a general neural network parameterization for V improves both training stability and control performance.
28

---

F.2
Other Quantitative Results
F.2.1
Inverted Pendulum
rCLBF-QP
Control Imput (ooque))
Control Input (toque))
-0
20
-20
20
-40
-1
Velocity
Angle
Velacity
Angle
6
3
Figure 6: Comparison of policy landscapes for the inverted pendulum task - -CLBB-QP (left) vs. ours (right). Each surface visualizes the controller's output torque over a 2D slice of the state space (pendulum angle angular velocity). The surface height and color both represent the magnitude of control input, providing physical interpretation of how each policy maps states actions. Our method yields smooth and symmetric policy around the upright equilibrium (angle 0, velocity contrast, the rCLBF-QP policy produces
= 0), which is desirable for stability and generalization. irregular and less structured patterns, likely due to its step-wise greedy updates and slack variable usage.
F.2.2
Car Tracking
Figure and Figure compare compare the control performance of rCLBF-QP and D in car tracking tasks. While both methods closely follow the reference trajectory, Siff achieves more globally consistent performance with notably lower tracking error across time. The error profile of D (Figure right) shows reduced oscillation and slower accumulation compared to rCIBB--QP (Figure right), indicating improved stability and accuracy in long-horizon tracking.
1.2
25
Controller
1.0
15
0.4
0.2
2
4
10
Figure 7: Control performance of rCLBF-QP in car tracking tasks. The left plot shows the reference and controlled trajectories, while the right plot depicts the tracking error over time.
29

---

25
Controller
15
Tracking
10
0.3
0.0
2
4
10
Figure 8: Control performance of Diff in car tracking tasks. The left plot shows the reference and controlled trajectories, while the right plot depicts the tracking error over time.
F2.3 Segway
15
ICLBF-QP
14
MBD
14
Ours
Tryectory Tieestory Invectory
Tejectory 2
Tajectory
rnjectory 3
Fnjectory
Pajectory 4
Tejectory
Trajctory
02
112
-35
-1.
-3.5
Posttion
Position
Phictton
Figure 9: Comparison of control performance across three methods rCLBF-QP (left), MBD (center), and Ours (right). The objective of this task is to stabilize the system to the target point (). The figure shows that rCLBF-QP struggles ensure stability due to globally inconsistent behavior induced by its step-wise QP formulation. MBD approaches the boundary of the unsafe set and exhibits unstable performance with higher variance. In contrast, our method achieves safe and consistent control, with most initial conditions stabilizing close to the target point (2, 0). This demonstrates that our algorithm ensures more globally consistent behavior and delivers more stable performance than MBD, guided by the learned CLBE.
30

---

F22.4
Quadrotor
1.0
0.8
Trajectory 1
Trajectory 2
Trajectory 3
v(x)
Trajectory
Trajectory
0.4
Trajectory 6
Safe Level
0.2
0.0
Time (s)
Figure 10: Change the scalar value the CLBF under the control policy of Diff for the 2D quadrotor. The color of each trajectory corresponds to Figure The scalar values of the CLBF from different initial conditions under S Diff exhibit nearly monotonic decrease, closely aligning with Lyapunov theory.
F.2.5 Neural Lander
rCLBF-QP
1.00
Ours
1.00
0.75
0.75
350
Posttion
0.0
Pusttio
0.25
0.25
0.00
1.00
10
0.5 Position
0030
1.0
0.5
0.30
0.5 0.0
Y Position
-0.5
-1.0
Position
-0.5
-1.0
0.5
Position
0.0
-0.5
-.0
Figure 11: Comparison of 3D trajectories under rCLBF-QP (left) and our method (right). Each colored trajectory represents a system evolution from a different initial condition, with the black star indicating the target. The rCLBF-QP controller fails to guarantee global safety when the slack variable is reduced, leading to constraint violations and unsafe behavior. In contrast, our method consistently maintains safe and stable trajectories across all initial conditions.
31

---

F.2.6 F-16
Ntttude (N)
Nttade
600
MBD
Ours
800
600
400
Ptch (te0)
0:35
0.38
0.30
Velecity (ets)
800
Velocity
630
500
Eagle (rod)
Angle
0.050
0.025
0.000
0.000
Mamp M /
8.0
Invotlee
0.0
my
Thvottle
-0.1
Figure 12: Comparison of F-16 control performance between MBD (left) and our method (right). The plots illustrate the evolution of altitude, pitch angle, velocity, angle of attack, and control inputs (elevator and throttle) over time. Our method achieves smoother and more stable flight dynamics, with significantly less oscillation in pitch and angle of attack, and well-regulated velocity recovery. Control inputs remain continuous and low-frequency, indicating efficient and robust control. In contrast, MBD shows high-frequency fluctuations in both elevator and throttle signals, suggesting aggressive or unstable control behavior.
32

---

G Implementation of Baselines.
The implementation of this baseline, including network architectures and hyperpa- rameters, strictly follows the settings described in the original paper [3]. 'he corresponding code is publicly available at https:: /ettps://github... wtw.gh................. WWIIMMITTRRAAAMMEEE REALM/neural. /EA.L///ouurlllllll////eeeee//// cltp///ee/eteeeennnnnnaa
rCLBF-QP.
MPC.
This baseline employs model predictive control (MPC), solved using the Gurobi optimizer each time step. The implementation strictly follows the settings described in [33. including time discretization of 0.1 seconds and a lookahead horizon of steps. The MPC is configured to track reference trajectories while satisfying both dynamic and control constraints.
This baseline is implemented following the methodology and hyperparameter settings outlined the original paper [33] To ensure a fair comparison with MPC, the MBD controller uses a time step of 0.1 seconds and planning horizon of 5 steps. The controller is trained to generate control sequences that track reference trajectories while satisfying learned dynamics and safety constraints. The implementation code is available at httttt:////e http:::///gttuts Lom/LeCAR-LLLl model-basede diffusiinn
MBD.
Ours. The following Table 7 provides the experimental details, including the network architecture and other relevant hyperparameters.
Table 7: Hyperparameter configurations for eight tasks using S Diff.
Task
NN Architecture
Safe Level
Temp.
Loss Coeff.²
Traj. Len.
Inverted Pendulum
3x64
0.1
1,1
5
Car (Kin.)
3x64
1
0.1
1,1
5
Car (Slip)
3x64
1
0.1
1,1
5
Segway
3x64
1
0.1
1,1
5
Neural Lander
3x64
10
0.1
1,1
5
2D Quad
3x64
0.1
1,1
5
3D Quad
3x64
10
0.1
1,1
5
F-16
3x128
10
0.1
1,1
5
Format "LxH" denotes layers with H hidden units per layer. Two coefficients (on, (2) represent weights for Lie derivative and discrete differences and CLBF losses, respectively.
33

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes].
Justification: The abstract and introduction clearly state the key contributions of the paper: the introduction of Difff a novel diffusion-basee control framework that jointly learns and utilizes certificate functions inspired by Almost Lyapunov theory. The claims about avoiding control- assumptions, enabling safe and stable control, and offering flexible probabilistic formulation well-supported by both the theoretical exposition and the empirical results. The limitations of diffusion speed are also akknowlldged along with a potential remedy via policy distillation, aligning well with the scope of the current work.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results be expected to generalize other settings.
It is fine include aspirational goals as motivation as long is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification:
The paper includes discussion of its main limitation in conclusion.
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model vell-specificattin, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested few datasets with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and faimess.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't acknowledged the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
34

---

3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer:
[Yes]
Justification:
We provide assumptions and complete proof in Appendix
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results the paper to the extent that affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Answer: [Yes]
Justification:
All code and data are provided in supplementary materials.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution a specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility instructions for how to replicate the results, access to a hosted model (e.g.. in the case of large language model), releasing of a model checkpoint, other means that appropriate to the research performed.
also be provided via detailed
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make it clear how to reproduce that algorithm. (b) If the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution is a new model (c.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (c.g., to registered users), but it should be possible for other researchers to have some path to reproducing verifying the results.
35

---

5. Open access to data and code
Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
Question:
Answer: [Yes]
Justification:
See supplementary materials.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nips. ec/
sublic/guidess hetiii/ggiides/oodeubbbimiieee
for more details.
While we encourage the release of code and data, we understand that this might be possible, so "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurlPS code and data submission guidelines (https
//nips ccpps.cc/ppp wttpppullllllppiee http:///eeeeuaaasssooooolll..eee
for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible supplemental material (appended the paper) is recommended, but including URLs to data and code is permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (c.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: The paper specifies the necessary experimental details to understand and reproduce the results.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, as supplemental material.
7. Experiment statistical significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer: [Yes]
Justification: The paper reports statistical variability for key experimental results using bars that reflect standard deviation over multiple runs with different random seeds.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by emoor bars, confi- dence intervals, or statistical significance tests, least for the experiments that support the main claims of the paper.
36

---

The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g.. Normally distributed errors).
It should be clear whether the error bar is the standard deviation or the standard error of the mean.
OK to report 1-sigma error bars, but one should state The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that out of range (e.g. negative error rates).
If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures tables in the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed reproduce the experiments?
Question:
Answer: [Yes]
Justification: The paper provides details of the compute resources used in the experiments.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make into the paper).
9. Code of ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurlPS Code of Ethics
Answer:
[Yes]
Justification:
The research fully conforms to the NeurIPS Code of Ethics.
Guidelines:
The answer NA means that the authors have not reviewed the NeurlPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g.. there special consid- eration due to laws or regulations in their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
The paper includes discussion of broader impacts. On the positive side, the proposed framework has the potential to improve the safety and stability of learning-bar based control systems, which could benefit applications such as roboties, autonomous vehicles, and other real-world systems where safety is critical. On the negative side, like other advanced control techniques, there is risk that the method could misapplied high-stakes systems without sufficient verification, potentially leading to unintended behavior. While this work
Justification:
37

---

is primarily theoretical and demonstrated in simulation, awareness of deployment risks is important. We believe transparency and further research into verification and robustness can help mitigate these concerns.
Guidelines:
The answer NA means that there no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious unintended uses (e.g., disinformation. generating fake profiles, surveillance), faimess considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility of ML).
Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data or models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification:
The models and data used in this work do not pose a high risk of misuse.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Are the creators or original owners of assets (e.g., code, data, models), used in the paper. properly credited and are the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [Yes]
Justification; All external assets used in this work-such as code and datasets are properly cited in the paper. The licenses and terms of use are respected and, where applicable, included in the references or appendix.
Guidelines:
The answer NA means that the paper does not existing assets.
38

---

The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license ge.g.. CC-BY 4.0) should be included for each asset. For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
assets are released, the license, copyright information, and terms use in the package should be provided. For popular datasets, papprssitthheeeocc thoode com datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-pace re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
If this information is not available online, the authors are encouraged to reach out to the asset's s creators.
13. New assets
Question: Are assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
Justification: The paper introduces new code assets implementing the proposed Diffff framework. Documents are provided in supplementary materials.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details the dataset/code/mooel as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset used.
At submission time, remember to anonymize your assets (if applicable). You can either create anonymized URL or include an anonymized zip file.
14. Crowdsourcing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given participants and screenshots. if applicable, as well as details about compensation (if any)?
Answer: [NA]
Justification; This work does not involve any crowdsourcing or research with human subjects. All experiments are conducted in simulated environments without human data or interaction.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with
human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According to the NeurIPS Code of Ethics, workers involved data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Question:
Answer: [NA]
39

---

This work does not involve human subjects, user studies, or the collection of human data. Therefore, IRB approval is not applicable.
Justification:
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with
human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere the NeurlPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
Declaration LLM usage
Does the paper describe the usage of LLMs if it is an important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, formatting purposes and does not impact the core methodology. scientific rigorousness, or originality of the research, declaration is not required.
Question:
Answer: [NA]
Justification: LLMs were not used as part of the core methodology, experiments, or technical contributions of this work. Any use of LLMs was solely for writing refinement and editing
purposes.
Guidelines:
The answer NA means that the method development in this research does not involve LLMs as any important, original, or non-standard components.
Please refer to our LLM policy http::///berrrgsecccc//ooerrrrrr for what should or should not be described.
40


Reviews:
[{"review_id": "ipxkAOsxND", "reviewer": "Reviewer_qHr1", "summary": "The paper proposes to modify the trajectory sampling in diffusion models by considering both safety and stability factors. It leverages Almost Lyapnunov Function (ALF) to incorporate safety and stability constraints into the sampling probability. So in the diffusion sampling phase, the score function is updated to the joint probability between cost, safety and stability. The paper analyses the proposed ALF and its relaxations and evaluates such formation in benchmark control tasks.", "questions": "1. In ALF Guidance (line 157), it’s a bit unclear how the soft constraint is used as guidance. Does the paper mean that soft constraint is used as a guidance in the diffusion sampling? \n2. In line 172, if Monte Carlo score ascent is adopted within diffusion sampling to iteratively denoise trajectories toward the target distribution, then why the forward process is required in Eq. (9)? \n3. What’s $p(U^0|U^i)$ in Eq. (10)? \n4. Line 180, “After generating control policies through diffusion sampling”. In what way are the control policies generated? The diffusion sampling only gives the trajectory samples. There is no control policy generated through diffusion sampling. \n5. it’s unclear how Eq. (11) is optimized. \n6. In abstract, “uncover intrinsic connections between diffusion sampling and almost Lyapunov theory”. Can the authors explain what are the intrinsic connections between diffusion sampling and almost Lyapunov theory?", "limitations": "no. the paper should discuss the limitations of using the relaxed constraints in Eq. (11) and whether it's possible to learn $\\hat{V}$ that minimizes the objective in Eq. (11)", "rating": 3, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 1, "significance": 2, "originality": 1, "strengths_and_weaknesses": "### Strength\n**Quality**: The paper presents a comprehensive analysis, including both theory and empirical evaluation,  of Almost Lyapnunov Function and its applications in modelling safety and stability constraints. The empirical results are complete and convincingly shows that the proposed modification to the score function generates target trajectory distribution. The method reads solid. \n\n### Weakness\nFrom my perspective and understanding, **the main weaknesses for this paper in its current version is the clarity in technical details, especially on the diffusion sampling, and originality in modifying the probability distribution** (maybe my understanding was wrong?). \n\n* The diffusion sampling, as one of the main components in the method, is a bit hard to understanding. The paper sometimes refers to this sampling as a way to generate “control policies” and sometimes means the sampled trajectories. Since $U^0$ is the original trajectory distribution, it’s not clear how to generate control policies. Furthermore, the score function is written as $\\nabla\\log p(U)$, not even in the product form as specified in Eq. (6), or in the approximate as specified in Eq. (7). \n\n* Re the originality, the proposed target distribution and the later-on formulation is similar to the classifier guidance formulation (only differs in the classifier guidance paper: there is no classifier but a likelihood model, which makes the formulation a bit even easier). My understanding is that the main idea proposed by this paper is to modify directly the score function by incorporating the safety and stability constraints (which is defined by ALF but then relaxed to soft constraint). This can be achieve by modifying the diffusion sampling directly, even without the ALF (please correct me if wrong). So the baselines should at least include such naïve modification of the score function by directly modifying it via the safety and stability constraints (e.g., soft regularization).", "was_revised": true, "final_justification": "The rebuttal adds quite some new information, most of which were not in the original draft (as far i could recall). For example, \"we do not compute the score $\\nabla \\log p(U)$ by directly differentiating Eq. (6), as it involves non-differentiable .... Instead, we follow a model-based diffusion approach and estimate the score using the posterior...\". Also, \"optimize Eq. (11) via standard gradient descent\" but later \"We use the Adam optimizer in all experiments.\" My opinion is that this paper might need further review given all these new contents and thus I tend to boderline reject.", "rebuttal": "Thank you for recognizing the quality of our work. We appreciate the opportunity to clarify the diffusion sampling process and the novelty of our method.\n\n- **Weakness 1.**  `The diffusion sampling procedure, control policies and score function.`\n\n We thank the reviewer for highlighting the need for a clearer explanation of the training procedure and guidance mechanism. Our method follows an iterative two-phase loop, summarized in Algorithm 1.\n```text\nAlgorithm 1: S²Diff  \nRequire: Distribution of initial states 𝒟ₓ₀, model dynamics f, nominal policy, number of training epochs K\n\n1:  Initialize the certificate function (CLBF) V_0 with parameters θ\n2:  for epoch k = 1 to K do\n3:              === Phase 1: Guided Trajectory Sampling ===\n4:      Initialize an empty dataset of new trajectories D\n5:      for each initial state x₀ in a batch sampled from 𝒟ₓ₀ do\n6:          Generate one full trajectory via a guided denoising process by maximizing Eq. (6,8)\n7:          Sample a clean trajectory U⁰ by applying the reverse diffusion process (Eq. 10) with model dynamics f, starting from noise\n8:          The process is guided at each step by the current CLBF V_k-1\n9:          Add the resulting trajectory U⁰ to the dataset D\n10:     end for\n\n11:                  === Phase 2: CLBF Update ===\n12:     Use the entire newly generated dataset D for training \n13:     Update CLBF parameters by performing gradient descent on the loss from Eq. (11), using trajectories from D, obtain V_k\n14: end for\n```\n\nIn Phase 1, we use the current CLBF $V_{k-1}$ to guide a model-based diffusion [1] sampler to generate a batch of trajectories. This is done by sampling from a CLBF-shaped target distribution $p(U)$, defined in Eqs. (6) and (8), using the reverse diffusion process. At each denoising step, we approximate the score $\\nabla \\log \\ p(U^i)$ via Sequential Monte Carlo (see Lines 175–176), leveraging the known dynamics model $f(x, u)$. \n\nImportantly, our diffusion process is not learned via neural network training. Instead, it is a fully algorithmic, model-based diffusion guided by the CLBF through the structure of the target distribution $p(U)$. This distribution is explicitly designed to assign higher likelihood to trajectories that satisfy the safety and stability criteria, i.e., $p_{safe}$ and $p_{stable}$. As a result, the diffusion process is biased toward generating CLBF-compliant trajectories without requiring gradient-based training of a score network. While there is no learned diffusion model, the objective $p(U)$ still plays a central role—it guides the sampling, not learning. \n\nIn Phase 2, the CLBF is updated using the sampled trajectories by minimizing the supervised loss defined in Eq. (11). This alternating process is repeated over training epochs, allowing the CLBF and the sampler to iteratively improve. \n\n[1] Pan, Chaoyi, et al. \"Model-based diffusion for trajectory optimization.\"\n\n`a. On the Sampled Object: \"Control Policies\" vs. \"Trajectories\" and question 4.`\n\nWhile the diffusion model generates full trajectories $U = (x_{1:T}, u_{1:T})$ during the sampling process, only the control sequence $u_{1:T}$ is actually executed in the environment as an open-loop policy. The state sequence $x_{1:T}$ is used internally for training, not for execution in control stage. \n\n`b. On the Score Function and guidance in question 1` \n\nThe target distribution $p(U)$, defined as a product of likelihoods in Eq. (6), serves as the desired distribution for guided sampling, but we do not compute the score $\\nabla \\log p(U)$ by directly differentiating Eq. (6), as it involves non-differentiable components and complex dependencies. \n\nInstead, we follow a model-based diffusion approach and estimate the score using the posterior expectation $E_{p(U^0 | U^i)} [U^0]$, as described in Eq. (10). We approximate the expectation using a Monte Carlo procedure, where a set of candidate trajectories are sampled and weighted according to their likelihood under $p(U)$. Eq. (6) thus defines the importance weights used to guide the sampling process toward trajectories satisfying the CLBF constraints. \n\nThrough repeated denoising steps guided by Monte Carlo procedure, the sampling process progressively approximates the target distribution. \n\nWe appreciate the reviewer’s comment regarding potential confusion, and will revise Section 3 and the notations around Eqs. (6–10) to make this connection more transparent and technically grounded.\n\n\n- **Weakness 2.** ` Re the originality, difference with classifier guidance and naive soft constraints`\n\nWhile both methods guide diffusion sampling, our method differs fundamentally in purpose, structure, and guarantees:\n\n1. Control-oriented Objective: Our method enforces safety and stability, not just conditional generation. The CLBF is learned directly from data and applies to general nonlinear systems, without assuming control-affine structure or slack variables—this remains an open problem in control theory. \n\n2. Closed-loop Guidance: Unlike classifier guidance which uses a fixed classifier, we use a learnable CLBF that is iteratively refined using the diffusion-sampled trajectories. This creates a closed-loop between generation and learning, essential for stability.\n\n3. Theoretical insights: We prove that the learned CLBF forms an Almost Lyapunov Function from diffusion samples (Appendix C.1), and the resulting policy guarantees almost sure safety and stability (Theorem 3.1). Classifier guidance has no such control-theoretic guarantees. \n\n**Naive regularized baselines underperform:** We already include model-based diffusion (MBD) which is exactly this idea (Table 2). MBD incorporates constraints by adding a fixed safety penalty term (a form of soft regularization), which shows poor performance in both safety and stability. We also include unconstrained diffusion, where no CLBF is used. As expected, this leads to fast but unsafe and unstable policies: \n\n| Task|Segway | Neural Lander | 2D Quad | 3D Quad | F-16 |\n|-|-|-|-|-|-|\n| safety (eval. time ms) | 70% (19.4 ± 0.5) |  15% (28.1 ± 1.0) | 65% (65.7 ± 0.8) |100% (69.6 ± 1.5) |85% (219.9 ± 4.3)|\n| ‖$x$ − $x_*$‖ | 1.45  ± 0.35|0.43  ± 0.21|0.39  ± 0.17| 0.75  ± 0.42|94.57   ±  76.48|\n\n**These comparisons demonstrate that without our algorithmic framework—including CLBF learning and guidance—there is no stability guarantee.** Naive guidance or unconstrained sampling may reduce inference time, but they sacrifice stability and safety entirely, especially on complex dynamics. Our approach is essential to achieve safe, stable control in general nonlinear systems—a capability that prior diffusion-based methods, including classifier-style guidance, cannot provide.\n\n- **Question 1.** `unclear how the soft constraint is used as guidance.`\n\nThe answer is refer to the description of algorithm in **Weakness 1**. \n\n- **Question 2.** `forward process in Eq. (9)?`\n\nThank you for the insightful question. While the forward process is not explicitly run during sampling, it is essential for defining the reverse denoising steps. Specifically, the Monte Carlo score approximation in Eq. (10) relies on the conditional distribution $p(U^0|U^i)$, which is derived from the forward process defined in Eq. (9). As shown in Lemma B.5, this forward formulation is necessary to construct the posterior used for score estimation in the reverse process. \n\n- **Question 3.** `What's $p(U^0 | U^i)$ in Eq.(10).` \n\nThank you for the question. In Eq. 10, $p(U^0 | U^i)$ is the posterior over clean trajectories, defined by Bayes’ rule: $p(U^0 | U^i) \\propto p(U^i | U^0) p(U^0)$, where $p(U^i | U^0)$ is the forward process in Eq. 9 and $p(U^0)$ is the target distribution (Eq. 6) shaped by CLBF constraints. \n\nSince the posterior $p(U^0 | U^i)$ is intractable, using Sequential Monte Carlo (see Lines 175-178). Specifically, we sample a set of candidate trajectories and assign importance weights proportional to $p(U^0)$ via Eq .6 . This weighting biases the average toward trajectories that better satisfy safety and stability constraints. This posterior expectation is then plugged into Eq. 10 to compute an unbiased estimate of the score $\\nabla \\log p(U^i)$, which guides the denoising process toward the target distribution.\n\n- **Question 4.** `control policies generation.`\n\nThe answer is refer to the `a` in **Weakness 1**. \n\n- **Question 5.** `it’s unclear how Eq. (11) is optimized.`\n\nGood question. As shown in Algorithm 1, we optimize Eq. (11) via standard gradient descent. Specifically, after collecting a batch of diffusion-sampled trajectories, we compute the supervised loss over the entire batch and update the CLBF parameters using backpropagation. The dataset $D$ is constructed from Phase 1: Guided Trajectory Sampling in the algorithm 1. This loss quantifies how well the CLBF satisfies the five essential conditions (in Eq. (2)) along sampled trajectories (see Lines 180–197). We use the Adam optimizer in all experiments.\n\n- **Question 6.** `intrinsic connection to almost Lyapunov theory.`\n\nThank you for the question. The intrinsic connection lies in how diffusion sampling enables learning a CLBF from data in a way that aligns with Almost Lyapunov stability guarantees:\n1. Diffusion sampling preferentially generates trajectories that satisfy safety and stability constraints, enabling us to learn a CLBF from finite samples.\n2. While the learned CLBF may violate Lyapunov conditions in small regions, we prove in Appendix C.1 that with sufficient samples, the volume of these violation regions becomes sufficiently small.\n3. This connects to Almost Lyapunov theory (Theorem 3.1): even if the CLBF is violated in a small region, the diffusion-guided sampling still achieves almost sure safety and exponential stability. \n\nThank you again for the thoughtful comments and we will clarify the limitations in final version. If the revisions adequately address your concerns, we would greatly appreciate your consideration of a higher score."}, {"review_id": "J41Sz30VqD", "reviewer": "Reviewer_yH3K", "summary": "This paper proposes a diffusion-based policy which can incorporate safety and stability into the training objective.", "questions": "- What is $\\alpha_k$ on line 174?\n- What do $U^0$ and $U^i$ represent in Equation 9?\n- Why is the distance between the fixed horizon terminal state and the equilibrium state much larger for the F-16 task?\n- What do the grey boxes represent in Table 2?\n- What does the color scale in Figure 3 represent, and should each environment have the same scale?", "limitations": "yes", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths\n- This paper proposes an interesting and novel approach for certifying safety and stability for systems with non-affine dynamics. \n- Overall, the text is very clear and easy to follow.\n- Equations are motivated well and are followed by a clear description.\n\nWeaknesses\n- Figure 1 is quite small and difficult to understand. In particular, it is difficult to interpret the difference between violation and satisfaction. \n- The methods/results section is missing information about how the diffusion model is trained and how many denoising steps are required.\n- There is no concrete algorithm provided that the audience can follow to easily implement the approach proposed in this paper.\n- It is difficult to interpret the surface plot shown in Figure 6 as the colour map makes the surface look like a coloured silhouette.", "was_revised": true, "final_justification": "The authors have addressed my concerns regarding the clarity of this work. I believe the revised version will make for a much better paper, and so I am raising my score to 5.", "rebuttal": "We sincerely thank reviewer yH3K for carefully reviewing our manuscript, providing valuable feedback and reconzing the strengths of our work. We'd like to address your concerns in the initial review and answer you questions as follows.\n\n- **Weakness 1.** \n   `Figure 1 is quite small and difficult to understand. In particular, it is difficult to interpret the difference between violation and satisfaction.`\n\nWe thank the reviewer for the valuable feedback. Figure 1 illustrates the core two-phase loop of our framework: the learned  guidance function (i.e., Lyapunov) (center column) guides the diffusion sampler to generate safe and stable trajectories (right column), and these trajectories are in turn used as data to update and improve the guidance function itself. As this mutual improving process repeats over training (shown progressing from bottom to top), the guidance quality improves, resulting in a final, smooth Lyapunov landscape (left column) that ensures trajectories reliably and safely converge to the target.\n\nWe acknowledge that the figure is currently too small and that the distinction between “violation” and “satisfaction” is not sufficiently clear. In the revised version, we will enlarge Figure 1 and improve its visualization by:\n\n    1. Increasing font size and line weight;\n    2. Clearly differentiating violation and satisfaction (e.g., using contrasting colors or visual styles); \n    3. Adding a descriptive legend and a more detailed caption to explicitly explain all visual elements.\n\n- **Weakness 2 and 3.** \n   `The methods/results section is missing information about how the diffusion model is trained and how many denoising steps are required.  There is no concrete algorithm provided that the audience can follow to easily implement the approach proposed in this paper`\n\nWe thank the reviewer for the insightful comment. We give a concrete algorithm as follows: \n```text\nAlgorithm 1: S²Diff  \nRequire: Distribution of initial states 𝒟ₓ₀, model dynamics f, nominal policy, number of training epochs K\n\n1:  Initialize the certificate function (CLBF) V_0 with parameters θ\n2:  for epoch k = 1 to K do\n3:              === Phase 1: Guided Trajectory Sampling ===\n4:      Initialize an empty dataset of new trajectories D\n5:      for each initial state x₀ in a batch sampled from 𝒟ₓ₀ do\n6:          Generate one full trajectory via a guided denoising process by maximizing Eq. (6,8)\n7:          Sample a clean trajectory U⁰ by applying the reverse diffusion process (Eq. 10) with model dynamics f, starting from noise\n8:          The process is guided at each step by the current CLBF V_k-1\n9:          Add the resulting trajectory U⁰ to the dataset D\n10:     end for\n\n11:                  === Phase 2: CLBF Update ===\n12:     Use the entire newly generated dataset D for training \n13:     Update CLBF parameters by performing gradient descent on the loss from Eq. (11), using trajectories from D, obtain V_k\n14: end for\n```\n\nIn Phase 1, we use the current CLBF $V_{k-1}$ to guide a model-based diffusion [1] sampler to generate a batch of trajectories. This is done by sampling from a CLBF-shaped target distribution $p(U)$, defined in Eqs. (6) and (8), using the reverse diffusion process. At each denoising step, we approximate the score $\\nabla \\log \\ p(U^i)$ via Sequential Monte Carlo (see Lines 175–176), leveraging the known dynamics model $f(x, u)$. \n\nImportantly, our diffusion process is not learned via neural network training. Instead, it is a fully algorithmic, model-based diffusion guided by the CLBF through the structure of the target distribution $p(U)$. This distribution is explicitly designed to assign higher likelihood to trajectories that satisfy the safety and stability criteria, i.e., $p_{safe}$ and $p_{stable}$. As a result, the diffusion process is biased toward generating CLBF-compliant trajectories without requiring gradient-based training of a score network. While there is no learned diffusion model, the objective $p(U)$ still plays a central role—it guides the sampling, not learning. **In our experiments, we use 50 denoising steps throughout.** \n\nIn Phase 2, the CLBF is updated using the sampled trajectories by minimizing the supervised loss defined in Eq. (11). This alternating process is repeated over training epochs, allowing the CLBF and the sampler to iteratively improve. \n\nWe appreciate the reviewer’s comment, and will include the pesudo code into the camera-ready version to make it more transparent. \n\n[1] Pan, Chaoyi, et al. \"Model-based diffusion for trajectory optimization.\" Advances in Neural Information Processing Systems 37 (2024): 57914-57943. \n\n- **Weakness 4.** \n   `It is difficult to interpret the surface plot shown in Figure 6 as the colour map makes the surface look like a coloured silhouette.`\n\nWe thank the reviewer for the insightful comment. Figure 6 is designed to visualize the policy landscape over a 2D slice of the state space (angle and velocity) for the inverted pendulum task. The surface height and color both represent the control input (torque) produced by the controller at each state. This provides a physical interpretation of how the policy maps different states to control actions.  \n\nThe goal of this visualization is to show the structure and smoothness of the policy induced by the learned CLBF. As shown in the figure, our method produces a more symmetric and smoother policy around the upright equilibrium (angle = 0, velocity = 0), which is desirable for generalization and stability. In contrast, the rCLBF-QP policy appears irregular due to its step-wise greedy updates and the use of slack variables.\n\nWe acknowledge that the current color shading may obscure these patterns. In the revised version, we will enhance the figure by: 1. Improving lighting and surface shading to better show 3D structure; 2. Clarifying the physical meaning of the surface and colors in the caption.\n\n- **Question 1.** `What is $\\alpha_k$ on line 174?`\n\nThank you for the question. In our formulation, $\\alpha_k$ follows the standard definition in diffusion models. It controls how much of the original (clean) trajectory is retained at step $k$ of the forward diffusion process—i.e., how gradually the system injects noise over time. \n\n- **Question 2.** `What do $U^0$ and $U^i$ represent in Eq. 9?`\n\nThank you for the question. In Eq. 9, $U^0$ and $U^i$ represent different noise levels of a trajectory $U = (x_{1:T}, u_{1:T})$ in the diffusion process:\n1. $U^0$ is a clean, uncorrupted trajectory sampled from the target distribution—i.e., the ideal trajectory the model aims to generate. \n2.  $U^i$ is the noisy version of this trajectory after $i$ steps of the forward diffusion (noise injection) process. \n\n- **Question 3.** `Why is the distance between the fixed horizon terminal state and the equilibrium state much larger for the F-16 task?`\n\nThank you for the observation. The larger terminal distance in the F-16 task arises mainly due to:\n\n1. State scaling: The F-16 system has higher-dimensional states with larger numeric ranges, making absolute distances inherently larger even under similar relative deviations. \n\n2. Short window horizon: We use a fixed 5-second evaluation window, which may be insufficient for full convergence in such a complex, nonlinear system. (See Fig. 12 for illustration.)\n\n- **Question 4.** `What do the grey boxes represent in Table 2?`\n\nThank you for the question. The grey boxes indicate the best-performing method for both safety and stability metrics in each task. We will clarify this explicitly in the caption of Table 2 in the camera-ready version.\n\n- **Question 5.** `What does the color scale in Figure 3 represent, and should each environment have the same scale?`\n\nThank you for the question. The color scale in Figure 3 represents the value of the learned Lyapunov function $V(x)$ over state slices. The scales are not normalized across plots for two reasons:\n\n1. Different safe level set thresholds $c$ across methods (e.g., rCLBF-QP original setting vs. ours in the inverted pendulum) result in different value ranges of $V(x)$.\n\n2. Different state slices in high-dimensional systems (e.g., F-16) naturally yield different value distributions of $V(x)$, and we do not normalize across these slices.\n\nThe contours are intended to show the relative shape and structure within each plot.\n\nWe sincerely thank the reviewer once again for their insightful comments and suggestions. We believe that the revisions made in response have significantly improved the quality of our manuscript. We eagerly anticipate any further feedback."}, {"review_id": "jzcgKt27FF", "reviewer": "Reviewer_rxhx", "summary": "The paper introduces a control algorithm for Lipschitz-continuous systems that combines a learned Lyapunov function with guided sampling. It provides general safety and stability theorems and evaluates the approach on several benchmark problems.", "questions": "**Questions:**\nI list here the questions that result from the weakness section above:\n\n- What is the connection of Theorem 3.1 with the learned Lyapunov function?\n- Is Theorem 3.1 only an existence result?\n- Can we make explicit statements about the algorithm using the results in Appendix C.1?\n- What types of results does the paper actually provide, which results are missing, and what additional assumptions would be needed to make explicit statements about the learned policy?\n- Is the CLBF trained during the diffusion process?\n- Do we retrain a new CLBF every time we denoise a trajectory?\n- Or is the CLBF trained on a separate dataset collected from past trajectories? If so, how big are the datasets used for the results in Section 4?", "limitations": "See weaknesses and questions", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 4, "originality": 3, "strengths_and_weaknesses": "**Strengths:**\n- The formulation applies to a broad class of systems.\n- Systematic empirical evaluation on challenging simulation tasks.\n- Clear presentation.\n\n**Weaknesses:**\n\n- Gap between theory and implementation:\n\nThe link between Theorem 3.1 and the learned Lyapunov function is unclear. Is the theorem merely an existence result, or can it yield explicit guarantees for the algorithm via the results in C.1? The paper should state this connection and clearly state what assumptions are necessary to apply Theorem 3.1 to the output of algorithm.\n\n- Insufficient method details:\n\nThe training loop for the CLBF and diffusion policy is under-specified. Do you retrain the CLBF after every denoised trajectory, on a growing dataset, or some other schedule? A step-by-step description (e.g., concise pseudocode) of how data are collected, how the CLBF is updated, and how policies are evaluated would make the method reproducible and easier to assess.", "was_revised": true, "final_justification": "The rebuttal has addressed my main concern regarding the paper. I believe the outcome of this discussion and the other discussions during this review would improve the paper and encourage the authors to include it.\n\nSince my main concern has been addressed I increased my score and recommend accepting the paper.", "rebuttal": "We thank reviewer rxhx for the thoughtful review, constructive feedback, and recognition of our work’s strengths.\n\n- **Weakness 1.**  `Gap between theory and implementation `\n\nWe thank the reviewer for the insightful question. We clarify that Theorem 3.1 is not merely an existence result—it provides a practical, algorithm-level guarantee that connects directly to the behavior of the learned CLBF.\n\n1. Theorem 3.1 guarantees that such a CLBF ensures system Lyapunov stability. Specifically, Theorem 3.1 states that even when a small violation region $\\Omega$ exists where the CLBF (Lyapunov) decrease condition is not satisfied, the system still achieves almost exponential stability, with an additive error term that scales with the volume of $\\Omega$. This means the system remains stable under minor approximation errors in the learned CLBF function. Thus, it is an Almost Lyapunov function. \n\n2. Guarantees in Practical Algorithm. In practice, we find that our learned CLBF satisfies the conditions of Theorem 3.1: we empirically observe violation rates below 1.5% and consistent monotonic decay in CLBF values along sampled trajectories (see Figures 5b and 10; discussion in Lines 278–283). This suggests the theoretical properties in Theorem 3.1 hold well under real-world training.\n\n3. Necessary Asssumptions. Moreover, Theorem 3.1 builds upon the results in Appendix C.1, which justify that a CLBF learned from diffusion-sampled trajectories will satisfy the Lyapunov decrease condition outside a small $\\Omega$, provided two key assumptions are met:\n(1) sufficient sampling coverage of the state space, and\n(2) adequate expressive capacity of the neural network CLBF.\nThis logic is detailed in Lines 476–483.\n\nWe will revise the camera-ready version to state the assumptions of Theorem 3.1 and connect Appendix C.1 to the algorithm's output in main text. \n\n- **Weakness 2:** `Insufficient method details: The training loop for the CLBF and diffusion policy is under-specified. Do you retrain the CLBF after every denoised trajectory, on a growing dataset, or some other schedule? A step-by-step description (e.g., concise pseudocode) of how data are collected, how the CLBF is updated, and how policies are evaluated would make the method reproducible and easier to assess.`\n\nWe thank the reviewer for suggesting more detailed procedural descriptions. Algorithm 1 summarizes the core training loop of our method. We provide the following clarifications to address specific concerns: \n\n```text\nAlgorithm 1: S²Diff  \nRequire: Distribution of initial states 𝒟ₓ₀, model dynamics f, nominal policy, number of training epochs K\n\n1:  Initialize the certificate function (CLBF) V_0 with parameters θ\n2:  for epoch k = 1 to K do\n3:              === Phase 1: Guided Trajectory Sampling ===\n4:      Initialize an empty dataset of new trajectories D\n5:      for each initial state x₀ in a batch sampled from 𝒟ₓ₀ do\n6:          Generate one full trajectory via a guided denoising process\n7:          Sample a clean trajectory U⁰ by applying the reverse diffusion process (Eq. 10) with model dynamics f, starting from noise\n8:          The process is guided at each step by the current CLBF V_k-1\n9:          Add the resulting trajectory U⁰ to the dataset D\n10:     end for\n\n11:                  === Phase 2: CLBF Update ===\n12:     Use the entire newly generated dataset D for training\n13:     Update CLBF parameters by performing gradient descent on the loss from Eq. (11), using trajectories from D, obtain V_k\n14: end for\n```\n\n1. Phase 1: Data Collection (Lines 4-9): In the first phase of an epoch, we use the current, fixed CLBF $V_{k-1}$  as a guide. For a batch of initial states, we perform guided model-based diffusion [1] sampling to generate a new, fixed-size dataset of safe and stable trajectories. Crucially, the CLBF is not updated after every single trajectory; it remains constant throughout this entire data collection phase. \n\n2. Phase 2: CLBF Update (Line 13): Once the new dataset $D$ is fully collected, we proceed to the update phase. Here, we use this newly generated dataset $D$ as training data to update the CLBF's parameters for a set number of gradient steps, using the loss function from our Equation (11).\n\n3. Control and Evaluation: We evaluate the final CLBF $V$ after all training epochs. At test time, this fixed certificate is used to guide the diffusion sampler. Evaluation is performed by generating trajectories from a set of randomly sampled initial states and measuring task-specific metrics such as safety violation rate, Lyapunov stability, and inference time. \n\nWe appreciate the reviewer’s comment, and will include the detailed training process in our main text. \n\n[1] Pan, Chaoyi, et al. \"Model-based diffusion for trajectory optimization.\" Advances in Neural Information Processing Systems 37 (2024): 57914-57943.\n\n- **Question 1.**  ` What is the connection of Theorem 3.1 with the learned Lyapunov function?` \n\nThanks for your question. We refer the answer to **Weakness 1**. \n\n- **Question 2.**  ` Is Theorem 3.1 only an existence result?` \n\nThanks for your question. We refer the answer to \"Guarantees in Practical Algorithm\" in **Weakness 1**. \n\n- **Question 3.**  `Can we make explicit statements about the algorithm using the results in Appendix C.1?` \n\nThank you for this insightful question. Yes, the results in Appendix C.1 allow us to make explicit statements about the algorithm—particularly through sample complexity bounds that control the volume of the violation region $\\Omega$. Specifically: \n\n1. Data size. The volume of violation region $\\Omega$ is bounded by a term proportional to $\\frac{1}{m}$, where $m$ is the number of sampled trajectories used for training. This shows that increasing training data directly strengthens the theoretical guarantees on the learned CLBF. \n\n2. Sampler quality. The bound also depends on the accuracy of diffusion sampling. Adjusting the temperature (lower is better) and increasing the number of Monte Carlo samples improves the reliability of the learned CLBF.\n\nTogether, these results provide the theoretical foundation for Theorem 3.1 and justify the algorithm’s behavior in practice. Additionally, we also provide a post-training analysis for the fraction of violation region $\\Omega$ over compact set $X$.  \n\n| Task| Inv. Pend. | Car (Kin.) | Car (Slip) | Segway | Neural Lander | 2D Quad | 3D Quad | F-16 |\n|-|-|-|-|-|-|-|-|-|\n| Violation Fraction | <0.1% | 1.2% |0.9% |0.5%| 1.1% |1.6%|1.3% | 2.4%|\n\nThe consistently low empirical fractions reinforce the result in Appendix C.1.\n\n- **Question 4.**  `What types of results does the paper actually provide, which results are missing, and what additional assumptions would be needed to make explicit statements about the learned policy?`\n\nWe appreciate the opportunity to clarify what results our paper provides and where additional assumptions would be needed for stronger guarantees.\n\n- **What we provide:** \n\n  (1) Framework: We propose a novel guided-diffusion framework where a learnable CLBF guides the diffusion sampling of safe and stable trajectories. This creates a closed-loop between policy sampling and certificate learning.\n\n  (2) Theoretical Results: We prove that the learned CLBF forms an Almost Lyapunov Function based on diffusion-sampled trajectories (Append C.1), and the resulting policy ensures almost sure safety and stability (Theorem 3.1). \n\n  (3) Empirical Support: We evaluate our framework across a diverse set of dynamic systems, demonstrating its ability to ensure safety and stability in practice.\n\n- **Assumptions for our current results:** To derive explicit convergence statements about the learned policy, we would need:\n\n  (1) known dynamics. \n\n  (2) a manual definition of the safe state set. \n\n  (3) smoothness assumptions on the dynamics and the function class, as detailed in Appendix C.1. \n\n- **What is not claimed and future work:** Our current work does not provide an explicit convergence rate for the control policy itself. A valuable direction for future work would be to prove such guarantees, along with tighter sample complexity bounds, which would likely require stronger structural assumptions on the dynamics. \n\nWe hope this clarifies the scope and rigor of our results.\n\n- **Question 5 and 6.** `Is the CLBF trained during the diffusion process? Do we retrain a new CLBF every time we denoise a trajectory?`\n\nThe answer is no. The CLBF is not trained during diffusion, nor is it updated after each trajectory. Instead, we first use the current CLBF to guide diffusion sampling and collect a full batch of trajectories. Then, we update the CLBF once per training epoch using the entire batch. Once trained, the CLBF guides the sampler reliably during test-time inference. \n\n\n- **Question 7.** `Or is the CLBF trained on a separate dataset collected from past trajectories? If so, how big are the datasets used for the results in Section 4?`\n\nThank you for the question. No, the CLBF is trained on a dataset $D$ composed of trajectories sampled via the guided diffusion process, as shown in Algorithm 1 (Phase 1). Each trajectory is of length 5 and generated from a batch of initial states.\n\n\n| Task               | Inverted Pendulum | Car (Kin.) | Car (Slip) | Segway | Neural Lander | 2D Quad | 3D Quad | F-16 |\n|--------------------|-------------------|------------|------------|--------|----------------|---------|---------|------------|\n| Size |         10,000         |      10,000      |      10,000      |    20,000    |         20,000      |    20,000     |    30,000     |             50,000            |\n\n\nWe use the full collected dataset to train the CLBF at each epoch. The CLBF is not trained on a separate offline buffer, but on the evolving batch sampled via the current CLBF-guided policy.\n\nMany thanks again for your time and consideration, please let us know if we have addressed the concerns and increased your confidence in our work."}, {"review_id": "qF6wRifLPZ", "reviewer": "Reviewer_xnzn", "summary": "This paper proposes the $S^2$ framework, which combines diffusion policies with Control Lyapunov Barrier Functions (CLBFs) to ensure safety and stability in control tasks. For this purpose, the authors propose an iterative training procedure that alternates between training a diffusion policy and a CLBF. The diffusion policy is trained to generate actions that are safe and stable, while the CLBF is trained to ensure that it captures accurately the safety and stability constraints of the system. The paper demonstrates the effectiveness of the $S^2$ framework through experiments on various control tasks (e.g., Inverted Pendulum, Car, Segway, Neural Lander, and F-16) and against various baselines, including robust CLBF-QP, MPC, Model-Based Diffusion, showing that it outperforms existing methods in terms of stability/convergence behavior and safety at a greater computational efficiency than MPC and Model-Based Diffusion.\nAn additional advantage of the proposed method compared to MPC and rCLBF-QP is that it also admits to non-control-affine systems, as demonstrated in the experiments on the F-16 aircraft.\nFinally, the paper connects the proposed framework to Almost Lyapunov theory, showing that the policy almost-always guarantees convergence to the desired equilibrium point with exponential convergence rate.", "questions": "- How is the diffusion policy trained to ensure adherence to the CLBF constraints? Furthermore, how many iterations alternating between training the diffusion policy and the CLBF are performed? Is there a stopping criterion for this iterative training procedure? Finally, the reviewer would like to see an ablation study that compares the iterative training procedure with a joint training procedure of the diffusion policy and the CLBF. How do you sample the trajectories, which you mention in Section 3.2? What are the initial conditions?\n- Could you plot the results of Table 3, preferably with a smaller discretization, in a Pareto fron style plot, to better visualize the trade-off between safety and stability/convergence? Furthermore, why is the best convergence rate achieved for an intermediate temperature value? The reviewer would expect the convergence characteristics to improve with a lower temperature. Could this possibly point to issues in the evaluation procedure and/or the definition of the evaluation metric for convergence?\n- Re Table 4: Why does adding a term based on the discrete approximation of the Lie derivative actually improve the performance compared to the sole reliance on the analytical Lie derivative? This is unintuitive. Do the authors have an explanation for this?\n- Re Results Tables and Appendix F: The selection of the discretization and the horizon for MPC seems arbitrary and might partly explain why the MPC is not able to accomplish high/perfect safety rates. Therefore, the reviewer would like to see different MPC configurations reported in the results tables (e.g., MPCs with short, medium and long horizons). One would expect the short-horizon MPC to be computationally more efficient but to achieve lower safety rates, while the long-horizon MPC to be computationally less efficient but to achieve higher safety rates.\n\nThe questions touch on the presentation and the quantitative evaluation in the paper. The reviewer expects that a satisfactory answer to these questions will be provided in the rebuttal and that the paper score could be adjusted accordingly.", "limitations": "The paper mentions a single limitation at the end of the conclusion regarding its slower inference speed compared to QP methods. However, the reviewer imagines that there must be other limitations to this method and the authors should transparently discuss those in the main text and possibly more extensively in the appendix.\n\n- For example, another limitation is that the proposed method does not formally guarantee convergence in all situations, but rather \"just\" almost-always guarantees.\n- Related to the previous point, the reviewer understands that the \"almost lypunov\" guarantees only hold if the loss function actually converges to zero. Is this indeed the case? Please clarify this in the main text - preferably also in the introduction and the conclusion.\n- In the introduction, you claim that \"However, designing valid CBFs priors remains a challenge.\". Indeed, while the proposed approach learns the CBFs, it still requires a manual definition of the safe state set, which should be explicitly discussed in the main text.\n- Finally, another limitation is that the proposed method requires knowledge about the system dynamics, which is not always (accurately) available in practice.", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 2, "significance": 4, "originality": 3, "strengths_and_weaknesses": "## Strengths\n\n- The paper is a timely contribution to the field of safe and stable control by integrating safety and stability guarantees into state-of-the-art diffusion policies.\n- The proposed $S^2$ framework is an interesting, novel, and valuable contribution and offers interesting theoretical and technical insights into the integration of diffusion models with control theory.\n- The proposed framework is comprehensively quantitatvely evaluated on a variety of control tasks and against various relevant baselines, demonstrating its effectiveness in terms of safety, stability, and computational efficiency.\n\n## Weaknesses\n\n- The current manuscript fails to clearly and in detail define the overall training procedure that consists of this iterative training procedure alternating between training the diffusion policy and the CLBF. For example, it is not clear according to which objectives the diffusion policy is trained in order to ensure adherence to the CLBF constraints. The reviewer recommends a clear and easily understandable description of the overall training procedure and the algorithm in the main text, before each of the components are described in detail. Also, the manuscript is missing illustrations and figures that illustrate the methodology and the training procedure.\n- The quantitative evaluation is lacking in some aspects: (1) unconstrained diffusion policies should be included as a baseline, (2) different configurations of MPC should be included as a baseline (i.e, some with short, medium, and long horizons) in order to demonstrate that long-horizon MPC can achieve high safety rates, (3) adopting SafeDiffuser as a baseline would be interesting, (4) arguably **most importantly**, an evaluation metric for the task performance is missing: while the paper evaluates the convergence/stability of the methods, the safety rate, and the computational efficiency, it does not evaluate the task performance of the methods (i.e., reward, cost to goal, etc.).\n- The paper shows the connections to Almost Lyapunov theory. However, the paper does not take the next step of actually applying Theorem 3.1 to practical examples. For the considered tasks, what is the epsilon value? Does this epsilon value together with the learned Lyapunov function satisfy the conditions/asssumptions? Can the authors conduct a post-training analysis of the learned CLBF function and how it connects to the Almost Lyapunov theory? This would be a valuable addition to the paper.\n\n### Detailed Comments on Minor Issues\n\n- Figure 1: The authors introduce a color map from \"violation to satisfaction\". However, it is using the same colormap as for the \"update Lyapunov function\". This is confusing and unclear. Please revise.\n- Page 2, line 85: \"... the stability properties of such methods are still unexplored\". The reviewer disagrees with this statement as CBF+CLF approaches guarantee simultatenously safety and stability. Please clarify this statement.\n- Section 2 (Preliminary) is missing a clear structure. The reviewer suggests to carefully reflect about the order and structure of this section and to possibly split it into subsections.\n- Section 2 \"Challenges in Gradient-Based Methods\": Despite the subsection title, many of the concepts discussed in this section (e.g., safety filters via CBFS, CLBFs, etc.) are not fundamentally connected to gradient-based methods but instead rather formulations that allow ensuring safety via the introduction of dynamics-based constraints. Furthermore, the referenced MPC setting could also be solved using sampling-based techniques (e.g., MPPI). Please clarify this and revise the structure.\n- Page 3, line 110: \"Traditionally, cost minimization problems for control policies are solved using LQR or MPC approaches, often without incoporating any constraints.\". The reviewer disagrees with this statement as a vanilla, safety-unaware MPC formulation would at least consider the dynamics of the system as an equality constraint. Please clarify this statement.\n- Section 3.1: You could stress here that you are proving \"**Exponential** Almost Lyapunov Stability\" and not just \"Almost Lyapunov Stability\". This is a strong result and should be highlighted.\n- Everywhere: Inconsistent capitalization of \"Almost Lyapunov theory\".\n- Table 1 has some deficiencies: (1) \"Safe and Stable\" should be two separate columns, (2) why does MPC not ensure safety and stability? This can be done via constraints - at least in the horizon? (3) to the best of the reviewer's knowledge, MPC can also be used for non-control-affine systems, although this will be more difficult and computationally expensive. See for example the Embotech Forces Pro solver documentation.\n- Equation (3): Add some underbraces what is the meaning of each of the constraints.\n- Section 4.1: Please include a concise overview over the characteristics of the tasks (e.g., control-affine, presence of safety constraints, definition of the equilibrium point, etc.).\n- Table 2: Add references for the baseline methods.\n- Figure 4: What do you encounter unsafe trajectories for both rCLBF-QP method and for the MPC methods? Is it because of the slack variables and the short horizons, respectively? In the reviewer's opinion, you should be able to avoid such unsafe trajectories for CLBF-QP-based and MPC-based methods with appropriate hyperparameter tuning.\n- Appendix D3.1: The reviewer suggests to be more explicit pointing out that most of the systems/tasks are control-affine and that in some tasks (e.g., Car) safety constraints are not established as the safe set is the whole state space.", "was_revised": true, "final_justification": "The reviewer very much appreciates the author's responsiveness and the extensive explanations during the rebuttal and discussion phase. The reviewer values the contributions of the paper, the added ablations and baselines, and, most importantly, the changes that the authors laid out and promised for the final version of the paper. \n\nStill, the reviewer needs to conclude that the scheduled changes are relatively substantive in quantity and that the final review justification cannot be _solely_ based on promised changes to the manuscript, but instead with a substantial share on the initially submitted manuscript.\n\nRecognizing the author's effort and proposed improvements to the manuscript, the reviewer decides to elevate their score to a \"5: Accept:\", although the most appropriate and fair score would probably be a \"4.5\".", "rebuttal": "Thank you for this very constructive and detailed feedback. \n\n-  **W1.** `Training procedure and details `\n\nWe thank the reviewer for highlighting the need for a clearer explanation of the training procedure and guidance mechanism. Our method follows an iterative two-phase loop, summarized in Algorithm 1.\n```text\nAlgorithm 1: S²Diff  \nRequire: Distribution of initial states 𝒟ₓ₀, model dynamics f, nominal policy, number of training epochs K\n\n1:  Initialize the certificate function (CLBF) V_0 with parameters θ\n2:  for epoch k = 1 to K do\n3:              === Phase 1: Guided Trajectory Sampling ===\n4:      Initialize an empty dataset of new trajectories D\n5:      for each initial state x₀ in a batch sampled from 𝒟ₓ₀ do\n6:          Generate one full trajectory via a guided denoising process by maximizing Eq. (6,8)\n7:          Sample a clean trajectory U⁰ by applying the reverse diffusion process (Eq. 10) with model dynamics f, starting from noise\n8:          The process is guided at each step by the current CLBF V_k-1\n9:          Add the resulting trajectory U⁰ to the dataset D\n10:     end for\n\n11:                  === Phase 2: CLBF Update ===\n12:     Use the entire newly generated dataset D for training \n13:     Update CLBF parameters by performing gradient descent on the loss from Eq. (11), using trajectories from D, obtain V_k\n14: end for\n```\nIn Phase 1, we use the current CLBF $V_{k-1}$ to guide a model-based diffusion [1] sampler to generate a batch of trajectories. This is done by sampling from a CLBF-shaped target distribution $p(U)$, defined in Eqs. (6) and (8), using the reverse diffusion process. At each denoising step, we approximate the score $\\nabla \\log p(U^i)$ via Sequential Monte Carlo (see Lines 175–176) with the known dynamics model $f(x, u)$. \n\nImportantly, the model-based diffusion is not trained—it is an algorithmic process guided by the CLBF through the structure of $p(U)$. The distribution is explicitly constructed to assign higher likelihood to trajectories that satisfy the safety $p_{safe}$ and Almost Lyapunov $p_{stable}$, hereby biasing the sampling process toward CLBF-compliant behavior. In this sense, while there is no loss function used to optimize a diffusion network, the objective $p(U)$ still plays a central role—it guides the sampling, not learning. \n\nIn Phase 2, the CLBF is updated using the sampled trajectories by minimizing the supervised loss defined in Eq. (11). This alternating process is repeated over training epochs, allowing the CLBF and the sampler update iteratively. This iterative process allows the CLBF and the sampling distribution to mutually improve, leading to the safety and stability results.\n\nWe will revise the main text and add a high-level figure illustrating the two-phase training loop and guidance mechanism.\n\n[1]  Pan, Chaoyi, et al. \"Model-based diffusion for trajectory optimization.\"\n\n-  **W2.** `More evaluation`\n\nWe appreciate the suggestion that a more comprehensive evaluation would strengthen the paper.\n\n- unconstrained diffusion: Without CLBF guidance, the sampler behaves like a greedy open-loop policy. This reduces inference time compared to our method, but at the cost of significantly degraded safety and stability. \n\n| Task|Segway | Neural Lander | 2D Quad | 3D Quad | F-16 |\n|-|-|-|-|-|-|\n| safety (eval. time ms) | 70% (19.4 ± 0.5) |  15% (28.1 ± 1.0) | 65% (65.7 ± 0.8) |100% (69.6 ± 1.5) |85% (219.9 ± 4.3)|\n| ‖$x$ − $x_*$‖ | 1.45  ± 0.35|0.43  ± 0.21|0.39  ± 0.17| 0.75  ± 0.42|94.57   ±  76.48|\n\n- MPC refers to **Q4**.\n\n- SafeDiffuser: We appreciate the reviewer’s suggestion and agree that such a comparison would strengthen the experimental section. While SafeDiffuser is indeed an interesting baseline, its original formulation is model-free and not fairly comparable to our model-based setting. \n\n- Due to limited space, we evaluate the performance using quadratic cost functions for 4 systems (lower is better), each one value is estimated by 20 trajectories, each with 500 time-steps. All evaluation will be provided in camera-ready version. \n\n| Task| Inv. Pend. | Neural Lander | 3D Quad | F-16 |\n|-|-|-|-|-|\n| CLBF-QP | 74 ± 13 | 548 ± 174   | 564 ± 97  |-| \n| MPC | 69 ± 11 |  664 ± 198  |   359 ± 43     | - |\n| MBD | 96 ± 17|  873 ± 282  |  628 ± 135  |  395 ± 87 |\n| Ours | 71 ± 13 |  392 ± 129 | 317 ± 49 |  286 ± 52  |\n\n- **W3.** ` Almost Lyapunov evaluation`\n\nThanks for the excellent suggestion. We fully agree that a post-training analysis connecting Theorem 3.1 to empirical results strengthens the paper. \n\n- Interpret the physical meaning of $\\epsilon$: The $\\epsilon$ in Theorem 3.1 corresponds to the volume bound of the violation set \n$\\Omega \\subset X$.\n\n- Direct computation of $\\epsilon$ is intractable. Instead, we approximate $\\frac{\\epsilon}{Vol(X)}$ by evaluating violation set over a uniformly spaced grid (50 points per dimension) and reporting the fraction of violating points. The table below summarizes the estimated violation fraction across tasks:\n\n| Task| Inv. Pend. | Car (Kin.) | Car (Slip) | Segway | Neural Lander | 2D Quad | 3D Quad | F-16 |\n|-|-|-|-|-|-|-|-|-|\n| Violation Fraction | <0.1% | 1.2% |0.9% |0.5%| 1.1% |1.6%|1.3% | 2.4%|\n\nThis violation fraction serves as a practical estimator of $\\frac{\\epsilon}{Vol(X)}$, allowing us to empirically validate the assumptions underlying Theorem 3.1 across tasks.\n\n- **Minior Issues.**\n\nWe thank the reviewer for the detailed suggestions.\n\n    1. We will revise the colormap.\n    2. The statement is discussed under diffusion policy setting not general control theory. \n    3. Section 2 will be restructured with clearer subsections.\n    4. The \"gradient-based methods\" will be revised to clarify its focus on certificate functions.\n    5. The “without constraints” statement refers to the absence of external inequality constraints.\n    6. We will emphasize the exponential aspect of the stability result.\n    7. Capitalization will be fixed.\n    8. Table 1 will be revised for MPC.\n    9. Underbraces will be added.\n    10. Sec. 4.1 will include a concise task overview.\n    11. Baseline references will be added.\n    12. We agree unsafe trajectories in MPC are due to short horizons; but our setup follows original CLBF-QP settings.\n    13. We will clarify the control-affine stuctures and constraint domains.\n\n-  **Q1.** `Training details and more ablation studies`\n\nThe answer to training details refers to **Weakness 1**. \n\n**Clarification on diffusion training and ablation request:**  To clarify, there is no diffusion policy being trained in our method. The diffusion process is model-based and fully algorithmic. Once the CLBF $V$ is learned, we directly sample trajectories by guiding the reverse diffusion process using the structure of $p(U)$. \n\nTherefore, the “joint training” ablation is not applicable in our setting —**once $V$ fixed, no further learning is needed for sampling.**\n\n\n-  **Q2.** `Temperature on stability factor `\n\nThank you for your insightful observation. We provide a finer-grained analysis of temperature vs. performance below. Interestingly, we observe that the best convergence rate is achieved at an intermediate temperature, rather than at the lowest one. \n| Temperature| 0.4|0.3|0.2|0.15|0.13|0.10 |0.08|0.06|0.05|\n|-|-|-|-|-|-|-|-|-|-|\n| Safety rate| 45% | 60%| 75%| 95%| 100% | 100%| 100%| 100%| 100% | 100%| \n| ‖$x$ − $x_*$‖ | 0.15 ± 0.08 | 0.11 ± 0.07 | 0.09 ± 0.06 | 0.08 ± 0.04 | 0.07 ± 0.04 | 0.06 ± 0.02 | 0.05 ± 0.02 | 0.07 ± 0.04 | 0.08 ± 0.03 \n\nIn particular, we find a lower temperature can lead a better convergence rate at early stage. However, when the system state approaches the equilibrium $x_*$, the Lie derivative condition becomes more sensitive and may even become hard to satisfy due to flat gradients or local instability. As shown in prior work (see Theorem 5.1 in [2]), even globally valid Lyapunov functions may admit local regions —especially near $x_*$ — where the condition is temporarily violated. At very low temperatures, the sampler relies too heavily on learned CLBFs for guidance. While this enforces safety, it can also restrict exploration and lead to the sampler getting “stuck” near such locally unstable regions—hurting convergence. In contrast, intermediate temperatures offer a better trade-off, allowing more effective global movement while still enforcing stability. \n\n[2] Boffi, Nicholas, et al. \"Learning stability certificates from data.\" \n\n-  **Q3.** `Analytical and discrete Lie derivative`\n\nThank you for the question. Adding a discrete Lie derivative term improves performance for two reasons:\n\n1. Easier to optimize. The analytical Lie derivative is based on auto-differentiation of $V$, which can be hard to optimize—especially near flat regions. In contrast, the discrete version captures the actual change in the Lyapunov function between time steps, making it easier for the CLBF to learn meaningful behavior.\n\n2. Better alignment with practical discretisation. Since the system runs in discrete time, using both analytical and discrete terms bridges theory and implementation. This improves the CLBF’s consistency with how it is actually evaluated during sampling.\n\n-  **Q4.** `MPC horizon`\n\nThanks for the suggestion. We have added results across multiple MPC horizons to show the trade-off between safety and inference time. As expected, longer horizons lead to better safety but incur significantly higher computation cost.\n\n| Horizon | Segway| 2D Quad|\n|-|-|-|\n| 2  | 10% (97 ± 2 ms)| 30% (108 ± 1 ms)|\n| 5  | 20% (254 ± 4 ms)| 45% (279 ± 2 ms)|\n| 10 | 85% (483 ± 7 ms)| 95% (585 ± 8 ms)|\n| 20 | 100% (1243 ± 20 ms)| 100% (1556 ± 52 ms)|\n\n-  **Limitations.** \nThank you for the valuable suggestions. We will include a clearer discussion of additional limitations in the main text and appendix, including the almost guarantees, the need to define a safe set, and the assumption of known dynamics, alongside the previously noted inference speed limitation."}]

Author rebuttal:

Meta-review: This paper presents safe and stable Diffusion which explores how diffusion models can ensure safety and stability from a Lyapunov perspective. Overall, the proposed method is very interesting and timely as it focuses on safety from diffusion sampling. The weak point is the clarification of training details that have been pointed out by the reviewers. The paper would benefit a lot by clarifying training in the next version of the paper.
Decision: Accept (poster)