Constrained Diffusers for Safe Planning and Control
Authors: Jichen Zhang
Liqun Zhao
Antonis Papachristodoulou
Jack Umenberger
Venue: NeurIPS 2025 poster ()
Keywords: Diffusion Models
Constrained Optimization
Primary area: deep_learning
TL;DR: Develop constrained optimization based reverse diffusion process for constrained diffusers for safe planning and control tasks.

Abstract: Diffusion models have shown remarkable potential in planning and control tasks due to their ability to represent multimodal distributions over actions and trajectories. However, ensuring safety under constraints remains a critical challenge for diffusion models. This paper proposes Constrained Diffusers, an extended framework for planning and control that incorporates distribution-level constraints into pre-trained diffusion models without retraining or architectural modifications. Inspired by constrained optimization, we apply a constrained Langevin sampling method for the reverse diffusion process that jointly optimizes the trajectory and achieves constraint satisfaction through three iterative algorithms: projected method, primal-dual method and augmented Lagrangian method. In addition, we incorporate discrete control barrier functions as constraints for constrained diffusers to guarantee safety in online implementation, following a receding-horizon control that we generate a short-horizon plan and execute only the first action before replanning. Experiments in Maze2D, locomotion, and PyBullet ball running tasks demonstrate that our proposed methods achieve constraint satisfaction with less computation time, and are competitive with existing methods in environments with static and time-varying constraints.

Constrained Diffusers for Safe Planning and Control
Jichen Zhang Liqun Zhao
Antonis Papachristodoulou Jack Umenberger
University Oxford
liqun zhao, antonis, jack. umenberger))engg a...a.... uk
Abstract
Diffusion models have shown remarkable potential in planning and control tasks due to their ability represent multimodal distributions actions and trajecto- ries. However, ensuring safety under constraints remains a critical challenge for dif- fusion models. This paper proposes Constrained Diffusers, extended framework for planning and control that incorporates distribution-level constraints into pre- trained diffusion models without retraining architectural modifications. Inspired by constrained optimization, we apply constrained Langevin sampling method for the reverse diffusion process that jointly optimizes the trajectory and achieves constraint satisfaction through three iterative algorithms: projected method, primal- dual method and augmented Lagrangian method. In addition, we incorporate discrete control barrier functions as constraints for constrained diffusers to guaran- tee safety in online implementation, following a grreding-hoizzen control that we generate short-horizon plan and execute only the first action before replanning. Experiments in Maze2D, locomotion, and PyBullet ball running tasks demonstrate that our proposed methods achieve constraint satisfaction with less computation time, and are competitive with existing methods in environments with static and time-varying constraints. The implementation can be found here.
Introduction
In recent years, diffusion models that learn data distributions by gradually adding noise and then reversing the process have achieved remarkable success image generation [1]. The forward process corrupts expert data into noise via predefined Gaussian steps, while the reverse process trains neural network iteratively denoise, reconstructing the original distribution from random noise [2]. This success has naturally extended to policy representation in planning and control, surpassing traditional imitation learning by denoising trajectories for planning [3] and modeling policies as return-conditional diffusion models to obtain optimal trajectories [4].
Despite these advances, deploying diffusion based planning policies real physical systems raises safety challenges, as such systems operate under strict constraints. Recent works incorporate constraints conditions within generative models-e.g, classifier-guided [5] and classifier-free [6] methods. Although effective in image or text generation, their applications in planning/control still lead to substantial violations under nonconvex, mane-iayyngg constraints and often require retraining for specific constraints [3, 4, 7, 8]. Other efforts enforce safety with Control Barrier Functions (CBFs) each reverse step [9], but this involves solving a Quadratic Program (QP) per diffusion step, incurring heavy computation. Projection-basee approaches instead map sampled points to the safe set [10, 11], effectively guaranteeing strict constraint satisfaction for samples during the diffusion process. However, they typically focus on pointwise constraints rather than general expectation constraints on distributions. Furthermore, the hard constraint projection can potentially disrupt trajectory smoothness, posing challenges for safe online implementation.
We propose Constrained Diffusers for planning and control, formulating diffusion generation with constraints on distributions through the lens of Stochastic Gradient Langevin Dynamics (SGLD)
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

Reverse Diffusion Process
Safe Trajectories
Projected
Env
Constraints
Expert Trajectories
Pretrained Diffuser
(DCBFs)
Primal Dual
Augmented
IDM
Lagrangian
Figure 1: Overall Framework. We use expert trajectories to train the diffuser, apply constrained sampling methods for DCBF constraints in the reverse sampling process to get safe trajectories and finally use an inverse dynamics model obtain actions, ensuring the safety online implementation. We follow a receding-horizon horizon scheme that only the first action is executed before replanning.
[12, 13]. We interpret generation constrained sampling, viewing the iterations as stochastic gradient descent, and integrate constraints using projected, primal-dual, and augmented Lagrangian methods (ALM). To keep system states within the safe set, impose discrete CBF (DCBF) constraints during the reverse diffusion process. This coupling allows reverse steps to optimize trajectories while enforcing safety without solving QPs for DCBF, and avoids retraining when pre-trained diffusion model exists for the task. Building on [14, 15, 16, 17, 18), we analyze convergence under mild conditions and provide on datasets, to map states to actions and execute control in a receding horizon scheme. At each step, we replan over a short horizon, execute the first action, update with the new observation, and repeat, mirroring Model Predictive Control (MPC) and mitigating errors by replanning.
sattraaatttttissattion guarantees. We use inverse dynamics model, trained
The main contributions of our work are summarized follows:
We propose Constrained Diffusers, an extended framework for planning and control that enforces distribution-level constraints for trajectories generated by pre- pre-trained diffusion models, modify- ing the reverse diffusion process with constrained sampling methods- Projected [10], a novel -atiiiaann--ussssae Primal-Dual method, and Augmented Lagrangian- thus avoiding retraining at deployment. We further introduce DCBF on physical trajectories ensure safe sreding-horizznn execution that executes only the first action in the plan, then repeat, leveraging the iterative diffusion process for efficient constraint satisfaction.
We demonstrate the effectiveness of our proposed methods in Maze2D, locomotion, PyBullet ball rumning tasks and manipulation tasks in the Appendix showing that our method effectively enforces constraints with competitive performance and computational efficiency.
Related Work
Diffusion Models and Policy Representation Diffusion models [1, 2] have demonstrated signif- icant potential in image [5, 6] and text generation [19, 20]. They gradually add noise to the data, transforming them into a random distribution over time [12, 21] and learn to iteratively denoise the data by reversing the forward diffusion steps [22]. This success extended to planning tasks [3, 4], outperforming traditional imitation learning methods through the ability to model complex distribu- tions [23, 7]. Recent literature focuses on trajectory optimization through diffusion models [24, 25] while they require interactions with environments in the optimization process. Some rescarchers have also investigated how diffusion can be combined with reinforcement learning to guide strategy improvement [8]. However, they did not handle constraints in the trajectory generation and online implementation through diffusion.
Constrained Sampling Constrained sampling methods have been developed for support constraints in the standard sampling process [26]. Projected Langevin Monte Carlo extends the algorithm to compactly supported measures through projection step when sampling from log-concave distribution [15]. Primal-dual methods simultaneously sample from the target distribution and constrain it through gradient descent-ascent dynamics in the Wasserstein space [16, 17]. addition,
some Langevin Monte Carlo methods based on mirror maps [27]. barriers [28], and penalties [29]

---

have also demonstrated significant advantages in constrained sampling. However, they do not make connections with diffusion models and do not extend them to nonconvex settings.
Safe Reinforcement Learning and Control Barrier Functions Safe control is a central research area in robotics and autonomous systems [30]. Traditional model-based methoos-HHamilon--aaee reachability [31] and Model Predictive Control [32]-offer rigorous guarantees. Safety-reinforeement learning typically formulates a Constrained Markov Decision Process, optimizing expected cumulative costs with trajectory-level constraints [33, 34, 35]; safe exploration adds safety layers to adjust actions [36], and other algorithms strengthen policy robustmess to safety risks [37]. Beyond safe RL, constrained sampling methods include task-constraiig
RRT [38], while overall complexity limits broad applicability across robotics [39]. Control Barrier Functions (CBFs) are widely used for safe control [40, 41]; recent work embeds CBFs in diffusion to ensure generated trajectories avoid obstacles [9]. [42] proposes BarrierNet, differentiable layer that learns CBF parameters for end-to-end training of less conservative policies. Other studies tackle safety in imitation learning and uncertainty by solving QPs, which is time-consuming [43, 44, 45].
Compared to classical planners, we use diffusion models as planners for their ability to represent when objectives are unknown and policies complex, multimodal trajectory Compared to SafeDiffuser [9], which interprets each denoising come from expert demonstrations. step as control action over the diffusion horizon and applies CBFs at intermediate steps, and Projected Diffusion [10], which works on constraints for samples, our PD and ALM treat diffusion as a constrained optimization problem on distributions, enforce DCBFs along the entire trajectory in the physical world, and use efficient first-order updates to ensure safety-thereby avoiding costly per-step QP solves. Detailed comparisons with Projected Diffusion and summarized table on comparisons with other literature can be found in Appendix A.
3 Background
3.1 Diffusion Models and Langevin Dynamics
Diffusion models are type of generative model inspired by principles of thermodynamics and work by simulating a two-step process. The forward process perturbs data 2o ~~ q(2o) by gradually adding noise over diffusion time & E [0, T). and the reverse process reconstructs the target data distribution from a simple prior distribution. These processes can be formulated as the following SDEs [21]:
dr.- = fIz, t)dt + g())dW, dr, [f t) V log pe (r:))dt + g())WW, (1)
where Wt and W, are standard Wiener processes running forward and backward in time, fax, t) and g(t) are drift and diffusion coefficients chosen such that pr (2rr approximates simple prior, e.g.. (0, I), and Vz, log Pr (a,e) the score function of the marginal distribution (x.)).
Langevin Dynamics is a method that leverages gradient information and noise to sample from a given distribution, resembling simulating the diffusion reverse SDE [21] starting from øт ~ pr and evolving backward to t = O. Standard Langevin Monte Carlo (LMC) aims to sample from target distribution p(x)) x e fx)) using the update rule derived from the Langevin SDE:
dx(t) = (x)()) + V2dW((t.
In practice, due to the challenges in directly computing the path of SDE, we often use discrete-time approximation, Stochastic Gradient Langevin Dynamics (SGLD):
It+1 = Ie + ! V logg(z:) + VTT
where 17 is the step size, and 2, NO, T) is standard Gaussian noise. By iterating this update rule with appropriate step size 7), the sequence 2, can be considered samples drawn from p(æ).
Denoising Diffusion Probabilistic Model (DDPM) can be connected to a Langevin-like update rule through its iterative denoising process. In DDPM, the forward process gradually adds Gaussian noise data over T steps, defined by ( = Nzz v1 3, 1, B,II), where 3, controls the noise schedule. The reverse process, pe ( (x))) approximates the data distribution by learning the noise via neural network, enabling the following reverse update:
B
((( + v Biz.
It-1
Zt
(4)
VI
Br
VI
a
3

---

where is the learned noise estimate, ā₁ IT +=1 B&) and & I0. is standard Gaussian noise. This reverse step resembles Langevin dynamics, where the score function V., log p(z,) is implicitly approximated by the denoising model's prediction of the noise component. According to [46], we can rewrite the score function with respect to the noise term by combining Tweedie's Formula with this reparameterization:
mi logp(r)) = co( t)
Ze V Vo
(5)
VI
This reformulates the DDPM reverse process update into a Langevin Sampling process terms of the score function Zz, log p(z;) instead of the noise estimate eo (z),t).
3 = It + Br 2 V., logp(r+) BBzz.
This formulation bridges the DDPM reverse process stochastic gradient- based Langevin dynamics, aligning denoising with probabilistic inference, forming the basis for leveraging optimization tech- niques within the sampling process. To ensure consistency in the time scale, assume the iterative process proceeds from to as + co in this paper.
3.2 Constrained Sampling
In practical applications, it is crucial to generate samples that satisfy specific constraints physical laws. This motivates the problem of constrained sampling, where the goal is to sample from a distribution q that is "close" to reference distribution (c.g., ., the distribution implicitly defined by expert data) while satisfying certain constraints. As formulated by [16], this can be posed as an optimization problem in the space of probability measures:
q arg min (L(gl)p) s.t. Eang [g(2)) S.
(EP)(R")
where g(-) represent inequality constraint functions and KL(g])p) measures the divergence from the reference distribution p.
For the task we aim to solve, we do not assume constraints are convex. Therefore, approach involves adapting existing methods and extending them to non-convex settings, while proving the effectiveness of the proposed algorithm in experiments and giving theoretical analysis.
3.3 Discrete Control Barrier Functions
To enforce safety constraints dynamical systems, Control Barrier Functions (CBFs) are designed to ensure forward invariance of desired safe set C, which is typically defined as the superlevel set of a continuously differentiable function (xx),, i.e., C = (x E Rd M(x)) 2 0) [40].
For general discrete- -imee deterministic system -+ = fa(x", u²",, where x² E Rd is the system state at physical system time step т, u, E l C Ih' is the control input, and fa denotes the discrete- time system dynamics, a function h(z)) is Discrete Control Barrier Function (DCBF) if there exists an extended class K. function such that for all æ E C[41]:
Mfal(o wT)) h(*") -a(hx>"))
This condition ensures that the decrease in fu(x)) between discrete time steps is bounded, thus preserving the forward invariance of the safe set C. In practice, this often involves solving a quadratic programme (QP) at each time step to find a control input u that satisfies the CBF condition while minimally deviating from a nominal control policy.
4 Problem Statement
The generative power of diffusion models extends to sequential decision decision-making problems, leveraging the models to represent distributions over trajectories or action sequences. Specifically, these models are trained to model the distribution over expert demonstrations by corrupting trajectories (a",..., xT)) with noise in a forward diffusion process and learning to reverse this corruption during training [3]. Despite the demonstrated success of diffusion models in trajectory planning and control,

---

(a) Projected Method
(b) Primal- Dual Method
(c) ALM
Figure 2: Constrained sampling trajectories through (a) projected, (b) primal-dual and (c) augmented Lagrangian Method. The goal is to use Langevin sampling methods to sample from 2-dimensional Gaussian distribution with the constraint x² + y² 2 r². Yellow regions show the high density of Langevin sampling trajectory distributions. Trajectories of the projected method mostly concentrate on the constraint boundary while the other two are more distributed.
their practical deployment in safety-critical systems faces fundamental challenge: enforeing dynamic constraints during the sampling process without costly retraining or architectural modifications.
To address this, we propose solving the constrained generation problem by formulating it as the following optimization problem: given pretrained diffusion model defining an implicit distribution p(2"-7) over trajectories, and constraint functions (I":7), where T is physical system time step, we design an alternative reverse process that produces a "similar" trajectory distribution g" satisfying:
4º arg min (I((llp) s.t. Ega: (g 0:T S 0, (EP)(R(")
while remaining computationally tractable. We assume access the differentiable constraints and their gradients. For notational brevity, we omit the superscript 0 : when possible.
Remark 1. For constraints on samples rather than expectations under distributions, we could formulate
the constraints as E ( ( ]++] < O, which ensures the probability of any constraint violation
exactly zero under q. For cases where the constraints need to be differentiable, we can use
o(a":T) Ega.T 1+e-sta""
S 0 as smooth approximation of [9(x::7))++
In the context of control systems, we implement these constraints using DCBF to ensure safety. The DCBF conditions are treated the specific constraint imposed on the system's actuation dynamics within our general formulation in (9). This approach provides plug-and-play mechanism to enforce constraints directly into the reverse diffusion process, as illustrated our framework Figure 1.
5 Constrained Diffusers
In this section, we present three methods for handling constraints during reverse diffusion sampling: Projected methods, Primal- methods, and Augmented Lagrangian methods. Visualization of the modified reverse process can be found in Appendix N.
5.1 Projected Diffusion Sampling
This approach leverages Projected Gradient Descent (PGD) to enforce trajectory constraints during the diffusion denoising process, extended from the work [10], which has shown that projected diffusion model can be successfully applied to some planning tasks, with analysis on the convergence and applications to the control tasks. each denoising diffusion time step of the diffusion process. we modify the standard update rule with constraint projection as follows,
Vi log pzz:) + BBz
It- = 1l or
+
(10)
2
where He denotes the projection operator onto the constraint set C defined in (9). The projection operator He solves the constrained optimization problem:
TT(2) arg min | z||2
C
(11)
zER
5

---

Through these updates, the samples will converge to stationary points. Detailed analysis to the statement can be found in Appendix This method applies for constraints for samples and the constraints are met at every diffusion step.
5.2 Primal-Dual Methods (PD)
This approach addresses the constrained optimization problem (9) by solving the following problem:
max min { [L A) = (L(alb) + AEE-o
(12)
X20
where À is the corresponding Lagrange multiplier.
Definition 5.1. local saddle point of L(g. A) is point (q", such that for some > Vq E (2(R)) n Bg (r) and AY 2 0, we have
L(g. X²) I(q", X²) 2 M(q A)
where BB- (r) is ball centered at 9" with radius r > 0 under the 2- 2-Wasserstein metric.
According to [47, 48], local saddle point for the maxmin problem is local optimal solution to the primal constrained optimization problem (9). The optimal constrained distribution q" can be characterized -(((a)++A* s(x)) Sampling from q" can then be achieved by modifying the LMC dynamics to target this tilted distribution. In practice, solve the maxmin problem by alternatively updating and A: The primal update to incorporate gradients related to the constraint functions; the dual update is to ascend in À using the gradients of L(g, >) w.r.t. X, i.e.,
tilted version of the original distribution p(x) x -f((x, given by q ("(x) x
B V logp(a,) VV (..)(=))) ViEE
Tt-1 Iz +
(13)
2
At-1 D + n2 (a
(14)
where [++ max(0, -) denotes projection onto the non-negative orthant, and y are step sizes.
Theorem 5.1. Under mild conditions, the sequence of updates (13) and (14) converges almost surely to local saddle point, i.e. a local optimal solution to the constrained optimization problem (9), as goes infinity.
The detailed proof of the theorem can be found in the Appendix other words, under the proposed update strategy, when score function already exists, constraint satisfaction can be achieved by their gradients with respect to the samples, eliminating the need for solving a QP.
5.3 Augmented Lagrangian Methods (ALM)
This approach enhances constraint handling by introducing a quadratic penalty term into the La-
grangian relaxation which enhances numerical stability[49, 50]. To handle inequality constraints [z-][g(x)] < O, we introduce slack variables s 2 O and let [x=]]g[<=]] + s 0. Then, we reformulate the constrained optimization problem (9) using the augmented Lagrangian:
La(g. X, = (L((lp)) + X (l (x:)) + s] 2 [9(x))) + s||²
(15)
The slack variable enables exact constraint satisfaction while maintaining differentiability. The update scheme features three components:
3t V log bogp()))= (h. pa ((m, T Vo.)( VBrr,
Ft-1 +
(16)
2
\/ pp]+ (Slack Update) \ > Pr (Terr~g (g( (2., sc) (Dual Update)
= 1-Bringgg
(17)
(18)
To obtain / - OG, we update the penalty term Pt- = c (c > 1). These updates will finally converge to the local optimal solution of (9) under certain conditions. Detailed analysis of the statement can found Appendix K. Compared to the primal-dual method, this method provides better constraint satisfaction for inequality-constrained diffusion processes.

---

Online Safety Implementation
To ensure that the trajectories produced by our model remain safe during online implementation with actions feeding into environments, we incorporate two key components: discrete control barrier functions (DCBFs) and inverse dynamics model based on the following two assumptions: that an inverse dynamics model exists for the system, although it is not accessible in a closed form derived from pritepprieeppe physics, 2) that there are no constraints on the inputs.
6.1 Discrete Control Barrier Function Constraints in Physical Environments
To enhance safety during the implementation stage, we incorporate discrete control barrier functions in our reverse diffusion process. In practice, this condition typically enforced through a QP at each time step. Since our approach directly generates trajectories, we could directly consider safety constraints between consecutive states x' and x*+ at the trajectory level. Specifically, we guarantee that consecutive states in our generated trajectories satisfy the safety condition by rewriting (8);
h( 2 (1 - a))(x),, =
(19)
here we use a proportional function to replace extended class I. function where a E (0, 1] is the coefficient that determines how aggressively the system state is required to remain within approach the safe set. By enforcing this condition directly on the state trajectory. we ensure that the system trajectory evolves safely without explicitly computing control actions during the generation process. The detailed update scheme for DCBF constraints can be found in Appendix I..
6.2 Inverse Dynamics Model
When applying the proposed methods implementation stage in control tasks, the diffuser generates sequences states. To guarantee the consistency of state and action, we employ an inverse dynamics model (IDM), denoted by u" IDM(2", I which predicts the action required to transition from state z" to state ++1 after obtaining the constrained state through the proposed algorithms. This ensures that the action executed corresponds to the constraint-satiifying state achieved after the modified reverse diffusion step. To address the potential inconsistency that the mapping from a state transition control input may not be one-to-one in systems with redundancy, approach implements IDM using deterministic neural network, which provides unique action output. Furthermore, the IDM is applied well-behaved transitions whose distribution closely matches the expert distribution, which further reduces the risk of ambiguity. More clarifications can be found in Appendix M.
The pse of the complete algorithm shown below.
Algorithm Constrained Diffusers (use Primal-Dual as an example)
Input parameters:
Expert data, constraints g(x), variance B, dual step 7)x initial Lagrangian
multiplier X
1: Training: Use the expert data to train the score function and IDM.
2: For T 0,.., T: // environment timesteps
3: Initialize Æт (O, I).
4: Planning:
5: Fort= T'.., 0: diffusion timesteps
6: Update x; based on (13) with DCBFs as constraints.
Update A based on (14)
8: end for
return 2y for planning
10: Control:
11: u² IIDM( att)
12: Feed u" into environment.
13:
end for
Note that our algorithm involves two time horizons: the diffusion process horizon denoted by / and T. and the physical environment horizon denoted by and T. Zo represents the entire clean trajectory
7

---

over the planning horizon T at diffusion timestep 0. 2; denotes the noisy version of this trajectory at diffusion step t. The notation z refers to the T-th state Io. where z9 is the current agent state, and vi is the next planned state. During inference, the agent first observes its current state, which becomes zg- Then full reverse diffusion process is run from noise to generate Jp. The constrained sampling method ensures safety state constraints are satisfied. The IDM computes the control a² for the safe state transition =B + zb which is executed the environment. The remaining trajectory is discarded. After the environment updates to the next state, the process repeats from Step 1. Thus, the policy predicts a full safe trajectory at each time step but executes only the first action.
7 Experiments
We evaluate Constrained Diffusers on Maze2D planning, locomotion, manipulation, and PyBullet ball-running tasks. Our experiments address four questions: (i) can methods enforce trajectory constraints without retraining? (ii) how do they compare to existing techniques in constraint satis- faction, task success, and computational efficiency? (iii) can they adapt to tame-varying constraints during deployment? and (iv) what are the strengths and weaknesses of the proposed approaches integrated within diffusion sampling? Detailed settings in Appendix C and further experiments on scalability to high-dimensional tasks can be found in Appendix D.
7.1 Constraint Satisfaction in Maze2D Planning tasks
First, we evaluate the constrained diffusers on trajectory planning tasks in two Maze2D environments: Maze2D-umaze and Maze2D-large. We set obstacles in these environments (Figure 3), requiring the agent's planned trajectory reach the goal while avoiding these obstacles. Obstacles are
Conditional
Total Violations
Projected
7.5
Primol Dual
5.0
ALM
2.5
0.0
Maze2D-Umaze
(b) Mazc2D-Large
Diffosion Steps
Figure 3: Trajectories generated by Constrained Dif- Figure 4: Convergence Results for algo- fuser in Maze2D Environment with Black obstacles. rithms in Maze2D. Proposed methods can The blue part shows the start of the trajectories and the satisfy constraints. ALM shows better con- red part shows the target. We observe that the trajecto- vergence and projected methods satisfy con- ries avoid the obstacles and reach the goal
straints throughout reverse diffusion process.
expressed as linear or quadratic inequalities. which we explicitly embed into the trajectory generation process. We compare against three baselines: Diffuser (vanilla trajectory diffusion), Conditional Dif- fuser [4] (constraint-conditione) generation), and SafeDiffuser [9] (CBF-guided denoising). Table 1 reports, for both environments, the Euclidean distance to the original trajectory, the total constraint violations (g<"" )], and computation time per diffusion step.
From Table 1, conditional diffusion struggles handle constraints in environments. Both SafcDiffuser and the Projected method can strictly satisfy all constraints, achieving zero violations, because they solve QP problem at every diffusion step. This strict enforcement, however, comes substantial computational cost. In contrast, PD and ALM use numerical iterative updates, which introduce minor violations in the plamning phase but still reduce constraint violations by over 99% compared to vanilla Diffuser, while only increasing computation time by approximately 10%. ALM adds squared constraint penalty, making slightly more effective in violation reduction than PD at the cost of 10% additional computation, which is still only 1/10 of the closed-form method and 1/100 of QP-based methods. This result demonstrates the ability of our proposed approach: being nearly consistent with expert behavior while flexibly handling constraints to ensure safety, all without retraining.

---

Table Performance comparison for Maze2D tasks. We can find that our algorithm nearly satisfies constraints and reduce computational time, compared to baseline algorithms. We report the mean and the standard error over 10 random environments.
Env
Algorithm
Distance
Total Violations
Time(s)
Diffuser[3]
0.00
7.316 0.884
0.0016
Conditional[4]
23.96 + 2.14
1.109 + 0.834
0.0017
SafeDiffuser(9)
42.81 8.66
0.000 0.000
0.1208
maze2d-umaze
Projected[109
10.24 + 1.39
0.000 + 0.000
0.0107
Primal-Dual
9.78 + 1.14
0.013 0.032
0.0017
ALM
9.81 + 1.65
0.002 + 0.002
0.0018
Diffuser[3]
0.00
12,400 = 2.440
0.0022
Conditional[4]
194.31 + 13.25
1.653 + 1.124
0.0027
SafeDiffuser(9]
196.25 33.06
0.000 0.000
0.2219
maze2d-large
Projected[10]
199.95 + 37.45
0.000 + 0.000
0.0083
Frimal-Dual
187.52 + 33.80
0,069 0.056
0.0028
ALM
195.85 + 21.82
0.033 + 0.044
0.0029
7.2 Safe control in locomotion tasks
We evaluate our algorithm planning and control in two Gymnasium MuJoCo environments, Hopper and Swimmer [51]. In Hopper, we bound the thigh-hinge angular velocity; in Swimmer, we bound the second rotor's 's angular velocity. We impose DCBF constraints and use an IDM to generate actions. Baselines are Diffuser, Conditional Diffuser, and SafeDiffuser. For the Projected Gradient Descent methods, we adapt the approach from [10] to handle sample-based constraints. However, compare to [10), for online execution, we further embed DCBF constraints rather than simple state-based hard constraints smooth the resulting trajectories with a receding- horrzonn loop that executing only the first action of a planned sequence before replanning. This ensures the IDM can generate feasible and effective control solutions in real-time. Metrics include (i) rewards, (ii) planning constraint violations for 1000 steps, (iii) online violations and rates under IDM execution, and (iv) per-step diffusion compute time (Table 2). In Hopper, Projected achieves zero planning violations but lower online returns and occasional violations from IDM generalization and stochasticity, reduced by 90% vs. Diffuser. PD and ALM cut planning violations by 96% and yielding higher rewards and an 85% violation reduction, at just 1/400 the computation time of [9. 10]. In Swimmer, Projected reduces online violations by only 50%, whereas PD/ALM achieve 98%, which we attribute to better alignment with the expert distribution and hence safer IDM actions. We also compare the constraint violations during both the planning and implementation stage with and without DCBF constraint (directly use hard constraints). The results demonstrate that both planned violations and implementing violations can be effectively reduced by incorporating DCBFs. Based our analysis, we conclude that when constraints are directly applied, the IDM may fail to generate a reasonable and feasible action. validating that DCBF improves safety during online execution. In addition. we perform sensitivity analysis of the IDM model to assess its impact on the control stage in Appendix F.
Table Performance comparison for locomotion tasks. We report the mean and standard error over 10 random environments.
Planning Violations
Planning (w/o CBF)
Impl. Violations
Impl. (w/o CBF)
Violation Rate (%)
Algorithm
Reward
(s)
Diffuser[3]
3592
- 37
2.55 0.21
2.61 0.21
4.82 = 0.60
0.0026
Conditionul[4]
3608
36
1.06
0.19
1.21 + 0.33
1,38 0.27
1.14
4,74 0.83
0.0027
SufcDiffusr(9]
3514 = 46
0.00
0.00
0.00
= 0.00
0.28 0.06
1.22
0.27 = 0.05
0,9307
Hopper
Projected] [0]
3547
13
0.00
0.09
0.42
0.08
0,9305
Primal-Dun Dual
3551
= 10
0.10
: 0.03
0.13 = 0.03
0.43 :: 0.12
0.46
+ 0.43
0.41 = 0.30
0.0027
AL.M
3553
14
0.08
0.02
0.10 + 0.03
0.16 0.38
0.61
+ 0.12
0.09 0.11
0.0031
Diffuser(3)
57.4 8.7
8.38
0.87
1.12 0.26
1.30 0.26
0.0026
Conditional[4]
5.6
8,02
0.78
5.21 = 0.66
1.31
0.93
1.11 0.43
0.0027
SafeDifuser(9)
60.4 6.1
0.00
1: 0.00
0.00 = 0.00
0.65 0.21
0.78 0.38
0.97 0 0.25
0,9301
Swimmer
Projected[10]
58.7
0.00 0.00
0.00 = 0.00
0.61 0.25
0.75 0.29
0.81 0 0.26
0.9049
Primal-Duul
86.4
0.17 0.08
0.16 = 0.06
0.02 0.02
0.06
0.08
0.07 0.07
0.0027
ALM
88.7 4.4
0.08 1 0.05
180 = 0.52
0.00 1000:0000 0.02
0.42 1.220022
0.03 = 0.04
0.0029

---

7.3 Adaptability to Time-varying Constraints
Finally, we evaluate the adaptability of our proposed algorithm in the PyBullet
environment, where safety con- straints vary over time. In this setup, we have an obstacle ball that moves in the space, requiring the ball to avoid collision while con- tinuing to move. We assume that the agent ball has no knowledge of the obstacle's dynamics and can only observe its current states, making planning infeasible. During implementation, we construct the discrete control barrier functions (DCBF) based the current observation of obstacles as constraints in the constrained diffuser to generate trajectory. Following the same recedig-horizon strategy and compared to [10], this approach ensures the IDM pro- duces feasible actions. We use Diffuser and Conditional Diffuser as baseline algorithms. We compare rewards, constraint violations and violation rates during implementation stage, and computation time per diffusion step in the experiment. The results are summarized in Table 3. Ablation studies on hyperparameter DCBF and worst-case analysis of initial conditions can be found in Appendices and G.
Figure 5: PyBulletBallRunniig tasks with the black-white ball and red moving obstacles ball.
Table Performance comparison for PyBullet ball running tasks. The results indicate our methods effectively adapt to time-varying constraints. We report the mean and the standard error over 10 random environments.
Impl. Violations
Impl. (w/o CBF)
Violation Rate (%)
Env
Algorithm
Reward
Time (s)
Diffuser[3]
646.4 + 30.3
2.20 + 0.77
37.7 = 5.1
9.6c-3
Conditional[4]
616.5 + 33.9
1.55 + 0.53
1.99 + 1.09
33.1 = 11.1
9.7c-3
SafctyBall Running
SafeDiffuser[9]
820.8 = 29.8
1.13 1.08
1.36 + 0.46
21.9 12.8
2.6c-2
Projected[ 10]
586.7 + 33.7
1.01 0.63
1.50 + 0.14
25.8 = 13.9
2.6c-2
Primal-Dual
722.2 + 118.6
0.02
0.10
2.2 3.2
1.3c-2
ALM
696.1 = 99.9
0.02 + 0.02
0.02 = 0.02
1.6 = 3.4
2.1e-2
Compared to the baselines, we can ensure effective collision reduction with less decision time. The Projected method reduces violations by only 50%, with 170% more computation time based on the closed-form projection. In contrast, PD and ALM achieve 99% reduction, with 35% and I 19% computation overhead, respectively. In addition, we also observed an improvement in the reward during implementation. We interpret this as the adjustment bringing the ball closer to the target.
8 Conclusions
In this work, proposed constrained diffusers for planning and control tasks. The model integrates constraints over distributions directly into pre-trained diffusion models without requiring retraining architectural changes. By re-interpreting safe trajectory generation problem, we apply three methoos--rojjetedd Primal-Dual and Augmented Lagrangian methods-to realize the constrained reverse Langevin sampling. Then we introduce DCBFs as constraints in the Constrained Diffusers and use inverse dynamics models to obtain actions, following a receding- horizon control that only the first action of the selected plan is executed before replanning, ensuring safety in the implementation stage. We demonstrated them in Maze2D, robotic locomotion, and PyBullet ball running tasks showing that the proposed constrained diffusion model not only meets safety requirements but also reduces computational time compared to existing approaches. We summarize the limitations into theoretical and practical ones. On the theoretical end, our methods rely on assumptions including accurate score function estimation. On the practical end, we made an assumption that we have access to constraints, and lack robustness analysis. For a detailed analysis, please refer to Appendix B.
constrained sampling
10

---

Acknowledgments and Disclosure of Funding
AP was supported part by UK's Engineering and Physical Sciences Research Council projects EP/X017982/1, EP/Y014073/1 and UKRI2108, JU was supported by the University of Oxford's Strategic Research Fund through the University of Oxford's ZERO Institute.
References
Jascha Sohl- Diikkkiieit,,, Eric Weiss, Niru Maheswaranathan, and Surya Ganguli. Deep unsupervised learning using nonequilibrium thermodynnamis.. International Conference on Machine Learning, pages 2256-2265. PMLR, 2015.
[2] Jonathan Ho, Ajay Jain, and Pieter Abheel. Denoising diffusion probabilistic models. Advances in Neural Information Processing Systems, 33:6840-6855 2020.
[3] Michael Janner, Yilun Du, Joshua B Tenenbaum, and Sergey Levine. Planning with diffusion for flexible behavior synthesis. arXiv preprint arXiv:2205.09991, 2022.
[4] Anurag Ajay. Yilun Du, Abhi Gupta, Joshua Tenenbaum, Tommi Jaakkola, and Pulkit Agrawal. Is conditional generative modeling all you need for decision-making" arXiv preprint arXiv:2211.15657 2022.
[5] Prafulla Dhariwal and Alexander Nichol. Diffusion models beat gans on image synthesis. Advunces in Neural Information Processing Systems, 34:8780 8794, 2021.
[6] Jonathan Ho and Tim Salimans. Classifier-free diffusion guidance. arXiv preprint arXiv:200711259. 2022.
[7] Allen Z Ren, Justin Lidard, Lars I. Ankile, Anthony Simeonov, Pulkit Agrawal, Anirudha Majumdar, Benjamin Burchfiel, Hongkai Dai, and Max Simchowitz. Diffusion policy policy optimization. arXiv preprint 24::24090000888 2024.
[8] Yinan Zheng, Jianxiong Li, Dongjie Yu, Yujie Yang, Shengbo Eben Li, Xianyuan Zhan, and Jingjing Liu. Safe offline reinforcement learning with feasibility-guided diffusion model. arXiv preprint 2rXiv:240J. 10700, 2024.
[9] Wei Xiao, Tsun-Hsuan Wang, Chuang Gan, and Daniela Rus. Safediffuser: Safe planning with diffusion probabilistic models. arXiv preprint wxXi:2336.000145 2023.
[10] Jacob Christopher, Stephen Baek, and Nando Fioretto. Constrained synthesis with projected diffusion models. Advances in Neural Information Processing Systems, 37:89307-8933: 2024.
[11] Jinhao Liang. Jacob K Christopher, Sven Koenig. and Ferdinando Fioretto. Simultaneous multi-robot motion planning with projected diffusion models. arXiv preprint arXiv:2502.03607 2025.
[12] Yang Song and Stefano Ermon. Generative modeling by estimating gradients of the data distribution. Advances Neural Information Processing Systems, 32, 2019.
[13] Andre Wibisono. Sampling as optimization in the space of measures: The langevin dynamics as composite optimization problem. In Conference Learning Theory, pages 2093-3021 PMLR, 2018
[14] Mohammad R Karimi Jaghargh. Stochastic Approximation on Riemannian Manifolds and the Space of Measures. PhD thesis, ETH Zurich, 2024.
[15] Sébastien Bubeck, Ronen Eldan, Joseph Lehec. Sampling from log-concave distribution with projected langevin monte carlo. Discrete & Computational Geometry, 59:757-783, 2018.
[16] Luiz Chamon, Mohammad Reza Karimi Jaghargh, and Anna Korba. Constrained sampliin with primal-dual langevin monte carlo. Advances in Neural Information Processing Systems, 37:222855299333 2024.
[17] Xingchao Liu, Xin Tong, and Qiang Liu. Sampling with trustworthy constraints: A variational gradient framework. Advances in Neural Information Processing Systems, 34:23557-23566 2021.
[18] Vivek S Borkar. Stochastic approximation: dynamical systems viewpoint, volume 9. Springer, 2008.
[19] Alexander Quinn Nichol, Prafulla Dhariwal, Aditya Ramesh, Pranav Shyam, Pamela Mishknn, Bob Megrew, 1lya Sutskever, and Mark Chen. Glide: Towards photorealistic image generation and editing with rext-guided diffusion models. In International Conference on Machine Learning, pages 16784 16804. PMLR, 2022.

---

[20] Chitwan Saharia, William Chan, Saurabh Saxena, Lala Li, Jay Whang, Emily L Denton. Kamyar Ghasemipour, Raphael Gontijo Lopes. Burcu Karagol Ayan. Tim Salimans, al. Photorealistic text-to- image diffusion models with deep language understanding. Advances in Neural Information Processing Systems, 55:36479-36494, 2022.
[21] Yang Song, Jascha Sohl-Dickstein, Diederik P Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. Score-based generative modeling through stochastic differential equations. arXiv preprint urXiv:2011.13450 2020.
[22] Brian DO Anderson. Reverse- diffusion equation models. Stochastic Processes and their Applications. 1233)333--326, 1982.
[23] Cheng Chi, Zhenjia Xu, Siyuan Feng, Eric Cousineau, Yilun Du, Benjamin Burchfiel, Russ Tedrake, and Shuran Song. Diffusion policy: Visuomotor policy learning via action diffusion. The International Journal of Robotics Research, page 02783649241173666, 2023.
[24] Chaoyi Pan, Zeji Yi, Guanya Shi, and Guannan Qu Model-based diffusion for trajectory optimization. Advances in Neural Information Processing Systems, 37:57914-57943, 2024.
[25] Anjian Li, Zihan Ding, Adji Bousso Dieng, and Ryne Beeson. Diffusolve: Diffusion- -based solver for non-convex trajectory optimization. arXiv preprint arXiv:2403.05577 2024.
[26] Nic Fishman, Leo Klarner, Valentin De Bortoli, Emile Mathieu, and Michael Hutchinson. Diffusion models for constrained domains. arXiv preprint arXiv:2304.05366 2023.
[27] Kwangjun Ahn and Sinho Chewi. Efficient constrained sampling via the mirror-langevin algorithm. Advances in Neural Information Processing Systems, 34:28405 28418, 2021.
[28] Yunbum Kook, Yin-Ta Tat Lee, Ruoqi Shen, and Santosh Vempala. Sampling with riemannian hamiltonian monte carlo in constrained space. Advances in Neural Information Processing Systems, 35:31684-3 31696. 2022.
[29] Mert Gürbüzhalaban, Yuanhan Hu, and L Lingjiong Zhu. Penalized langevin and hamiltonian monte carlo algorithms for constrained sampling, arXiv preprint arXiv:221 2022.
[30] Lukas Brunke, Melissa Greeff, Adam W Hall, Zhaocong Yuan, Siqi Zhou, Jacopo Panerati, and Angela Schoellig. Safe learning in robotics: From learning based control to safe reinforcement learning. Annual Review of Control, Robotics, and Autonomous Systems, 5(1):41 444, 2022.
[31] Ian M Mitchell. Comparing forward and backward reachability as tools for safety analysis. In International Workshop Hybrid Systems: Computation and Control, pages 428-443. Springer, 2007.
[32] Carlos E Garcia, David M Prett, and Manfred Morari. Model predictive control: Theory and practice-a survey. Automatica, 25(3):335-344 -48, 1989.
[33] Javier Gareia and Fernando Fernández. A comprehensive survey on safe reinforcement learning. Journal of Machine Learning Research, 16(1):1437-1444 1480, 2015.
[34] Joshua Achiam, David Held, Aviv Tamar, and Pieter Abbeel. Constrained policy optimization. In International Conference on Machine Learning, pages 22-31. PMLR, 2017.
[35] Alex Ray. Joshua Achiam, and Dario Amodei. Benchmarking safe exploration in deep reinforcement lcarning. 2019.
[36] Brandon Amos and J Zico Kolter. Optnet: Differentiable optimization layer in neural networks. In International Conference on Machine Learning, pages 136-145. PMLR, R, 2017.
[37] Yinlam Chow, Mohammad Ghavamzadeh, Lucas Janson, and Marco Pavone. Risk-constrained rein- forcement learning with percentile risk criteria. Journal of Machine Learning Research, 18(167):1-51 11, 2018
[38] Mike Stilman. Global manipulation planning in robot joint space with task constraints. IEEE Transactions Robotics, 26(3):57--584, 2010.
[39] Zachary Kingston, Mark Moll, and Lydia E Kavraki. Sampling-based methods for motion planning with constraints. Annual review of control, robotics, and autonomous systems, 1(1):159-185, 2018
[40] Aaron D Ames, Samuel Coogan, Magnus Egerstedt, Gennaro Notomista, Koushil Sreenath, and Paulo Tabuada. Control barrier functions: Theory and applications. In 2019 18th European Control Conference (ECC), pages 4420-3431 JEEE, 2019.
12

---

[41] Ayush Agrawal and Koushil Sreenath. Discrete control barrier functions for safety-critical control of discrete systems with application to bipedal robot navigation. In Robotics: Science and Systems, volume 13, pages 1-10. Cambridge, MA, USA, 2017.
[42] Wei Xiao, Tsun-Hsuan Wang, Ramin Hasani, Makram Chahine, Alexander Amini, Xiao Li, and Daniela Rus. Barriernet: Differentiable control barrier functions for learning safe robot control. IEEE Transac- tions on Robotics, 39(3):2289-2333 2307, 2023.
[43] Ryan K Cosner, Yisong Yue, and Aaron Ames. End-to-end imitation learning with safety guarantees using control barrier functions. In 2022 IEEE 61st Conference on Decision and Control (CDC), pages 5316-5322. IEEE, 2022.
[44] Wei Xiao, Calin Belta, and Christos G Cassandras. Adaptive control barrier functions. JEEE Transactions on Automatic Control, 67(5):2267-223 2281,, 2021.
[45] Andrew Taylor, Andrew Singletary, Yisong Yue, and Aaron Ames. Learning for safety-critical control with control barrier functions. In Learning for dynamics and control, pages 708-717. PMLR, 2020.
[46] Calvin Luo. Understanding diffusion models: A unified perspective. arXiv preprint arXiv:2208.1197 2022.
[47] Dimitri Bertsekas. Nonlinear Programming. Athena Scientific, 2003.
[48] Bonnans Alexander Shapiro. Perturbation Analysis of Optimization Problems. Springer, 2000.
[49] Dimitri P Bertsekas. Constrained optimization and Lagrange multiplier methods. Academic press, 2014.
[50] Jingqi Li, David Fridovich Keil, Somayeh Sojoudi, and Claire Tomlin. Augmented lagrangian method for instantancously constrained reinforcement learning problems. In 2021 60th IEEE Conference on Decision and Control (CDC), pages 2982-2989. TEFE, 2021.
[51] Mark Towers, Ariel Kwiatkowski, Jordan Terry, John U Balis, Gianluca De Cola, Tristan Deleu, Manuel Goulão, Andreas Kallinteris, Markus Krimmel, Arjun KG, et Gymnasium: standard interface for reinforcement learning environments. arXiv preprint arXiv:2407.1700 2024.
[52] Aravind Rajeswaran, Vikash Kumar, Abhishek Gupta, Giulia Vezzani, John Schulman, Emanuel Todorov, and Sergey Levine. Learning complex dexterous manipulation with deep reinforcement learning and demonstrations. arXiv preprint arXiv: 10087, 2017.
13

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: the abstract and introduction accurately reflect contributions and scope, i.e. Constrained Diffusers for safe planning and control tasks.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
is fine to include aspirational goals as motivation as long as is clear that these goals not attained by the paper.
2. Limitations
Question:
Does the paper discuss the limitations the work performed by the authors?
Answer: [Yes]
Justification: discuss the limitations in Appendix B.
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't 't acknowledged judgment and recognize that individual actions in favor of transparency play impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
the paper. The authors should use their best
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [Yes]
14

---

we have justified assumptions, making the problem clear and provided detailed proofs in the appendix.
Justification:
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide short proof sketch provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Question:
Answer: [Yes]
Justification: we provide the detailed results in the experiment section and appendix, and codes in supplemental material.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution a specific model and empirical evaluation, it may be necessary either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of large language model), releasing of a model checkpoint, or other means that appropriate to the research performed.
While NeurlPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) the contribution is primarily a new algorithm, the paper should make clear how reproduce that algorithm. (b) If the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution is a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
15

---

Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, as described in supplemental material?
Question:
Answer: [Yes]
Justification:
we provide codes in the supplemental material.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nips.c cc/
for more details.
While we encourage the release of code and data, we understand that this might not be possible, "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for a new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurlPS code and data submission guidelines (https: //nips.co ctips.cc/public/eeee http:/uublc/gguudeeeee guidee/ /CodeSubmia onsoiicy) for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only subset of experiments are reproducible, they should state which ones omitted from the script and why.
At submission time, preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (c.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: we provide the detailed settings in the experiment section and appendix. Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to a level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, or as supplemental material.
7. Experiment statistical significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer: [Yes]
Justification: We give all precisions relative to the the evaluation of our models.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
16

---

The assumptions made should be given (e.g.. Normally distributed errors).
It should be clear whether the error bar is the standard deviation the standard error of the mean.
is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out range (e.g. negative enror rates).
If error bars reported in tables plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification: the compute resources are shown in supplemental material.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental rums as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported the paper (e.g., preliminary or failed experiments that didn't 't make it into the paper).
9. Code of ethics
Question: Does the research conducted the paper conform, in every respect, with the NeurlPS Code of Ethics https http:///neuuipeeeeeeeeee httpp///bbl///tiicccttieeeeeeeee
Answer: [Yes]
Justification: The authors have reviewed the NeurIPS Code of Ethics and this paper does not address societal impact directly.
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special cireumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g.. if there is a special consid- eration due to laws or regulations their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [NA]
Justification:
In our opinion the paper does not have direct social impact
Guidelines:
The answer NA means that there no societal impact of the work performed.
If the authors answer NA or No. they should explain why their work has no societal impact why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
17

---

The conference expects that many papers will be foundational research and not tied particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology being used intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms monitor how system learns from feedback over time, improving the efficiency and accessibility of MI..
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification: in our opinion the paper does not present such risks.
Guidelines:
The answer NA means that the paper poses such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Lieenses for existing assets
Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper. properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification: we have included all information for the assets used.
Guidelines:
The answer NA means that the paper does not existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (c.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (c.g., website), the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswi thcode. com com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
18

---

If this information is not available online, the authors are encouraged to reach out to the asset's creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
Justification: include our codes in supplemental material.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/cooe/mmodl as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsoureing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification: The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included the main paper.
According the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Question:
Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification:
The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Depending the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and expect authors to adhere to the NeurlPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such the institution conducting the review.
16. Declaration of LLM usage
19

---

Question: Does the paper describe the usage of LLMs if it is important, original, or non-standard component of the core methods this research? Note that if the LLM used only for writing, editing, or formatting purposes and does not impact the core methodology. scientific rigorousness, or originality the research, declaration is not required.
Answer: [NA]
Justification: The core method development in this research does not involve LLMs any important, original, or non-standard components.
Guidelines:
The answer NA
that the method development in this research does involve LLMs as any important, original, or non-standard components.
Please refer to our LLM policy (https: (bttps://neur) h/tp:///enuu..eeeeeee http://uiip..cee/eeeeeeeeeeeeeee wctp////ooeeeeccc/22////1111 for what should or should be described.
20

---

A Comparisons on Related Works
Compared with Projected Diffusion [10], which enforces feasibility by projecting each sampled point onto predefined safe set, our Constrained Diffusers treat generation as constrained sampling the distribution level. Beyond the projected method, we introduce primal-dual and augmented constraints, jointly update trajectories and Lagrange
Lagrangian updates that support distribution-len multipliers inside the reverse process. For online execution, we further embed DCBF constraints rather than state-based hard constraints and use receding-horizz loop that executes only the first action before replanning, avoiding per-step QP solves and aligning the generated trajectory with system dynamics. Under some assumptions we establish convergence and constraint-satisfactio guarantees, and empirically show in Maze2D, locomotion, and PyBullet tasks that our methods satisfy constraints with less computation while matching improving task performance.
We provide comparative analysis of several key approaches in safety-critical planning and control in Table 4.
Table 4: Performance Comparison
Method
Constraint Satisfaction
Computational Efficiency
Primary Application Notes
Traditional QP
Strict; can find an optimal plan with minimal costs if one exists.
Average; solving QP for each action (e.g.. via primal-dual interior point method).
Known dynamics and cost functions.
with CBF
SafeDiffuser
High; Planning: solves a QP at each diffusion denoising step to ensure the planned trajectory is safe. Inference: uses state-based hard constraints.
Low; solving a QP at every step of the diffusion process is computationally expensive.
Safety-critical systems where having guaranteed safe plan is essential.
Projected
Striet; Planning: guarantees the planned trajectory has violations. Inference: DCBF constraints, violations can occur due to errors from the IDM or environment randomness.
Low, solving optimization problem each diffusion denoising step.
Systems that require strict safety guarantees during the planning phase.
Diffusion (Ours [10])
Primal-Dual Diffusion (Ours)
Good; Planning: may have very small violations in the final plan due the iterative process.
Extremely high; uses simple gradient updates and avoids solving optimization problems.
Real-time applications where planning speed is more important than perfect constraint satisfaction.
Inference: keeps the system safe with DCBF constraints, especially when the planned path is similar to expert behavior.
ALM Diffusion
Strong; Planning: produces plans with near-zero violations; Inference: provides robust online safety with DCBF.
High: slightly slower than the PD method but much faster than solving QPs.
General use cases that need good balance between safety and planning speed.
(Ours)
B Limitations
We categorize limitations into theoretical and practical aspects.
Theoretical Aspects. Our theoretical derivations and analyses rely on assumptions that may not hold perfectly in practice.
21

---

We assume that the trained neural network yields an accurate Po estimate of the score function (Vx, log Pt. (x)). Our analysis does not quantify how these errors impact the probability or degree of constraint violation in the final samples.
Score Estimation Accuracy:
Convergence Guarantees: Our convergence analysis relies on standard, but potentially strong, assumptions regarding the score and constraint functions. Furthermore, the results established provide guarantees for local, rather than global, convergence.
Practical Aspects. can be extended.
From a practical standpoint, the applicability and scope of the current method
Constraint Complexity and Guarantees: We have not addressed more complex scenarios involving, e.g., constraints coupled with system dynamics or other constraints beyond safety. Moreover, while empirically demonstrate high rate of satisfaction, the proposed method does not, in its current form, offer formal, provable guarantees of 100% constraint satisfaction for every sample, which may be a requirement for safety-critical applications.
Known and Differentiable Constraints: A core assumption is that the constraints g(x) are known in an explicit, analytical form, and that their gradients Vg(Ø)) are readily available.
Robustness to Uncertainty: The formulation assumes that constraints are deterministic. We do not currently address how to handle uncertainty in the environment, which is vital for robust deployment in noisy or variable conditions.
C Experimental Details
The experiments are all running on the machine with Intel Core i7-14700 X 28, 32GB Memory, NVIDIA GeForce RTX 4060 and the operational system Ubuntu 24.04. All diffuser models in our experiments were trained from scratch using expert demonstration data. For Maze2D, we used Maze2D-umazo-v/ I and Margee-l from D4RL; for MuJoCo locomotion tasks, we used copper-medium--xpeer- from D4RL and ball running tasks, we used SafetyBallRun-vd from DSRL.
from Minari; for PyBullet
The experimental details are summarized as follows:
In Maze2D environment, the noise is approximated by a temporal U-Net [3]. The training settings and codes are borrowed from [3. 9]. For Maze2D-una -umaee tasks, we use a planning horizon of 128, 64 diffusion steps and additional 64 steps in reverse process. The constraint formulated as + y S. 6, where (Ir, v) is the position state of the agent and b is the parameter of the boundary. The learning rate 1) for dual variables primal-dual methods is 0.025 and the initial penalty p is 0.05. For Maze2D-large tasks, we use planning horizon of 384, 256 diffusion steps and additional 200 steps in reverse process. The constraint is formulated as where (a., y) the position state of the agent and (zo. Yo, a, b) are the parameters of the boundary. The learning rate 1) for dual variables in primal-dual methods is 1e-3 and the initial penalty p 2.5e
("-=0)² + (0- )2 Z
In Gymnasium Mujoco and PyBullet environment, the temporal U-Net architecture, training settings and codes are borrowed from [4]. For Hopper tasks, we use a planning horizon of 100, 200 diffusion steps and additional 100 steps in reverse process. The constraint is formulated as w < Wmax, where w is the angular velocity of the thigh hinge. The learning rate 7) for dual variables in primal-dual methods is 0.1 and the initial penalty p is 0.01. The hyperparameter a in DCBFs is 0.85. For Swimmer, we use a planning horizon of 100, 200 diffusion steps and additional 100 steps in reverse process. The constraint is formulated as w < Wmax. where w is the angular velocity of the second rotor. The learning rate 17 for dual variables in primal-dual methods is 0.5 and the initial penalty p is 0.01. The hyperparameter a in DCBFs is 0.85. For Safety BallRunning tasks, we use planning horizon of 100, 200 diffusion steps and additional 100 steps in reverse process. The constraint is formulated as [x: - (Zu + T)2 + [y (yo + 2 ]2 2 ()+ where (x, v) is the position state of the ball agent, (Io. yo) represents the position of the obstacle ball, (va, Uyy) represents the velocity, R represents the radius of agent ball and r represents the radius of the obstacle ball. The learning rate 1) for dual variables in primal-dual methods 0. and the initial penalty p is 0.01. The hyperparameter in DCBFs ranges from 0.3 to 0.8.
22

---

We assume access to differentiable constraint function and its gradient: for common geometric obstacles these are analytic; in more complex settings, constraints can be built online from sensor data (e.g., camera-based segmentation of obstacle boundaries). For black-box constraints, neural network learns differentiable approximation from cost signals collected via interaction with the environment.
D Scalability to high-dimensional action space in manipulation tasks
To demonstrate the wider applicability of the algorithm, we conducted additional experiments on the Dexterous Hand Manipulation Adroit Relocate task with a 30-dimensional action space. The new environment Adroit Relocate was introduced in [52] as part of the Adroit manipulation platform. For our new experiments, we use the D4RL dataset relocate-eperr-a trajectories sampled from an expert that solves the task. We imposed two constraints: one is that the translation distance of the full arm at each step cannot exceed a certain value (x² + + 2² S <r),, and the other is that the angular up-and-down movement of the full arm cannot exceed a certain value. Note that since the robot's action is its end-effector pose, the constraints are directly applied to the action. Therefore, it is not necessary to use an IDM and compare planning violations this task. Results summarized below show that even with similarly sized models, algorithms satisfy constraints, demonstrating scalability to high-dimensions tasks.
which contains 5,000 expert
Table 5: Performance comparison for relocate tasks. We can find that our algorithm could almost satisfy constraints and reduce computational time, compared baseline algorithms. We report the mean and the standard error over 10 random environments.
Eny
Algorithm
Rewards
Violations
Violation Rate (%)
Time (s)
Diffuser[3]
550:1938
87.0++30.4
74.0=1...4
0.0028
Conditional[4]
422-8377
32.0
58.5+16.3
0.0029
Relocate
Projected[10]
321=791
0.0:+0.0
0.0+0.0
0,9515
Primal-Dual
499--951
0.04++0.03
2,9+11.9
0.0031
ALM
325+6700
0.04++0.02
2.9+1.66
0.0035
E
Ablation Studies on hyperparameters
In the control tasks, apply discrete control barrier functions constraints in the reverse diffusion process. We find that a plays an important role in the safety implementation. To show its importance, compare the performance of our Constrained Diffusers with different values of in SafetyBall- Running tasks. Also, when we use hard constraints rather than DCBFs, it is equivalent to a 1. Theoretically, smaller may lead to may occur as a result the smaller a making the trajectories deviate more from the distribution and the inverse dynamics model is not accurate enough. Results are summarized in Table
robust solution which contradiets the final results. This
Table 6: Performance comparison for PyBullet the mean and the standard error over 10 random environments.
tasks with different a. We report
Total Impl. Violations
Violation Rate (%)
a
Algorithm
Reward
Projected[10]
586.7 + 33.7
1.01 + 0.63
25.8 + 13,9
0.3
Primal-Dual
717.3 + 107.7
0.21 + 0.23
10.4 + 11.38
ALM
696.0 + 144.5
0.29 + 0.19
9.3 = 9,87
Projected[10]
595.3 + 46.3
1.47 + 0.50
29.7 + 10.5
a 0.5
Primal-Dual
720.6 = 80.97
0.09 + 0.09
9.2 + 7.9
ALM
647.7 + 74.34
0.17 + 0.17
10.3 9.8
Projected[10]
595.7 + 19.6
1.54 0.53 0.02 + 0.03
36,0 + 1.41
a = 0.8
Primal-Dual
722.2 + 118.6
2.2 + 3.2
ALM
696.1 = 99.9
0.02 - 0.02
1.6
23

---

Sensitivity Analysis to IDM Prediction Errors
The accuracy of the IDM is critical because errors cause mismatch between planned and actual states, leading to potential task failures and safety violations. We quantify this sensitivity by defining the IDM error as Au R u u". Linearizing the dynamics shows the resulting state deviation 8f Au, which affects the safety function as h(arattn)) R plan/ Vh(ap()) Az, meaning Ar R3 Du
the change in constraints is primarily influenced by (h( 0f To validate the capability of our plan Du
method to maintain safety constraints in the presence of prediction errors, we conducted a sensitivity analysis Hopper. We evaluated three algorithms (Projected, Primal-Dual, ALM) with varying levels of IDM errors (2%, 10%, 25%). Results show that increasing IDM error generally lowers reward and increases constraint violations, but 10% error is still acceptable for the tasks. The results are shown Table
Table 7: Sensitivity analysis on IDM errors in Hopper and Swimmer
Env
Error
Algorithm
Reward
Impl. Violations
Violation Rate (%
P10jected[10]
3437=196
0.28
1.76:t0.75
2%
Primal-Dual
3501=130
0.48:10.21
3.47:10.85
ALM
3370=
0.44
3.13
Projected[10]
3391=325
0.32+10.08
1.98
Hopper
10%
Primal-Dual
2690=707
0.46#0.11
3.33=00.6
ALM
23691455
0.41
3.51
Projected[10) 10]
1900+4471
0.62++0.12
2.09++0.29
25%
Primal-Dual
1446=354
1.19::022
4.67+00.5
ALM
16141:504
0.95+10.33
4.11::0.02
Projected[10]
58.1
0.58+0.31
0.72+10.31
2%
Primal-Dual
89.4116.2
0.05
0.10::0.07
ALM
89.2
0.03
0.05
Projected[
62.1
0.66:10.23
0.77
Swimmer
10%
Primal-Dual
87.6
0.03
0.09:10.08
ALM
88.9+45.3
0.03
0.07+0..10
Projected[10]
61.5+:.2
0.73+00.11
0.6910029
25%
Primal-Dual
86.3+
0.07+-0.03
0.50++0.07
ALM
92.8+
0.04
0.30++0.45
G Worst-Case Analysis under Extreme Initial Conditions
To show the robustness of our methods under extreme initial conditions, we performed additional worst-case analysis in the PyBullet Safety BallRunning environment. In the original setup, the agent and the moving obstacle start with a safe distance between them. In this new analysis, we created more extreme initial conditions by placing the obstacle closer to the agent, reducing the initial safety distance. The results are summarized Table The "SafctyMargin" denotes the starting distance as percentage of the sum of the radii of the ball and the obstacle, with "Boundary" meaning the agent and obstacle start at the point of collision.
Even in the most extreme case starting at the point of collision, our methods still effectively reduce magnitude and frequency of constraint violations compared to the baseline. As the initial safety margin increases to 10% and 25%, the number of violations is further and substantially reduced, showcasing the framework's ability to maintain safety even when initialized in very near to compromised state.
24

---

Table Worst-Case initial case analysis Safety BallRunning task
MargtyMargin
Algorithm
Reward
Violaaioos
Violation Rate (%)
[iffuser(3]
640.61129.0
14.04::.27
81.9
Projected[10 10]
336.7++3.2
3,44
7..6=1.6
Boundary
Primal-Dual
457.1=48.4
2.9910.12
67.5+2.3
ALM
380.9427.1
3.10=0.17
70.1
Diffuser[3]
640.8+28.9
13.08
76.5
Projected[10] 10]
507.1=57.6
2.63
57.8+2.0
10%
Primal-Dual
479.5++54.6
1.55+
32.5+5.6
ALM
421.9=59.77
1.33+0.21
29.0+4.4
Diffuser[3]
640.6+29.00
11.42
69.2+2.99
Projected[10]
525.0+55.2
0.31
19.6+3.7
25%
Primal-
413.9487.9
0.45
18.9=16.5
ALM
422.1470.4
0.06+10.11
8.0+8.5
H
Variations of executing steps
We conducted an experiment to evaluate the impact of executing multiple steps (1, 2, and 3) before replanning in the Swimmer task. The results are summarized in Table 9.
The results demonstrate that performance degrades dramatically for all methods when executing two more steps at time before replanning. This finding supports our hypothesis that multi-step execution strategies are highly sensitive the accumulation of errors, which can stem from the generalization of the diffusion model and potential inaccuracies in the inverse dynamics model. Therefore, a single-step, "closed-loop" execution strategy, where replanning occurs each timestep, proves to be the most robust and effective approach for achieving high performance in our experiments.
Table 9: Performance and constraint violations under different numbers of execution steps before replanning in the Swimmer task. We report the mean and standard error over 10 random seeds.
Impl. Violations
Violation
Steps
Algorithm
Reward
Rate (%)
Diffuser[3]
57.4 + 8.7
1.12 0.26
1.30 + 0.26
Projected[10 100]
58.7 + 4.1
0.61 = 0.25
0.81 + 0.26
step
Primal-Dual
86.4 9.2
0.02 0.02
0.07 0.07
ALM
88.7 + 5.4
0.00 + 0.02
0.03 + 0.04
Diffuser[3]
12.4 + 25.9
0.09 0.15
0.20 0.20:00 0.24 0.24
Projected[ 10]
8.2 13.2
0.00 0.00
0.00 + 0.00
steps
Primal-Dual
7.9
0.05 0.08
0.13
ALM
2.4 12.3
0.00 + 0.01
0.01 + 0.03
Diffuser[3]
0.7 16.7
0.04 + 0.12
0.06 0.15
Projected[ 10]
5.2 20.1
20.1
0.02 0.06
0.04 0.09
3 steps
Primal-Dual
13.7
0.01 + 0.03
0.04 0.08
ALM
8.9 23.2
0.00 0.00
0.00 0.00
I Analysis of Projected Methods
Recall that the projected Langevin sampling can be written
3r vz, logp(æ,) + v BBz 2
ll +
(20)
From [15], we could conclude that when the distribution is log-concave with smooth potential and there exists convex body K C. _ that K, K contains Euclidean ball of radius and K is
25

---

contained in a Euclidean ball of radius R. projected Langevin Monte Carlo will target at sampling from distribution x e e=(()){(ZE)) While in our problem settings, the distributions are not always log-concave and the constrained sets are not always convex. Therefore, it is always difficult to analyze it from the perspective of distributions. In the following part, we prove that the samples from projected methods will converge a nearly stationary point under certain assumptions.
Assumption 1. We assume that the iterates satisfy:
1. log is bounded and has L-Lipschitz continuous gradient:
V (()) V logp(y))l s D|| yll Vx,y E
(21)
2. =0
<0
Remark 2. Since we interpret the reverse diffusion process as a Langevin sampling process, in our theoretical analysis, the iteration flows from backward time direction in the original reverse diffusion process.
t T when T + oo, rather than following the
Theorem I.I. Under the above assumptions, when B S L for all t and we define the gradient mapping G(æz)= 2 (zt It-1), then when samples from the projected methods satisfies:
inf inf ((. +
(22)
Proof. Because of the Lipschitz gradient assumption, we have:
logp(x;-1) & log p(x,)) + VV logg((;;), I1-1 xz) + L || 1 xz/1?
(23)
2
From the projection property (y [T( IT(xx)) S 0, we have:
3
(5t-1 3tt
v Vlogp(#) VB - -
(24)
2
Br V logp(x) + v B12) > | 1
(xx 21-1 2
(25)
Hence, we can conclude that
2
2
2
V ((g:(()), It xz)
5
(xt 11-1 1
2)
|
1
(26)
3
vB.
Be
Then combine (23) and (26),
L
1ogp(((-1) < log p(x,))
(it
21-1,
2)
| - x2ll2
I - x111
(27)
3g
VBr
Br
2
2 L
= log p(x:)
||:,-1 -x1
(It -1
/Br" x)
(28)
Br 2
Br
Then we take expectations on the equations,
2
L
Ellog p( < E[logp(=:)]
E.
-
(29)
B
since E((x - F1-1, vor
2
=} = 0. Then we define 62 ==
2 and sum over / - T....,
T
Ell|a--1 - m.l1 < logp(zo) log p(xr)
(30)
8
t=
Since log p(x:) is bounded, we can rewrite (30) as
T
Blll -
xx|| S logp(zo) inf logp(x) < oo
(31)
t=
26

---

Then we relate (31) to the projected methods. Note that the update rule of projected methods is It-1 = Ile Iz + Va, pog)( + VB.2). Recall the definition gradient mapping G( = De
2 (Iz - Ie-1). Then, we have the following inequality according to (31),
T
[B|]G( x
(32)
0
Since Et 3r = 20, we have
inf [[]] G(x))]]1]] +
(33)
when goes to oc.
Under the given conditions, the number of iterations & tends to infinity, the inferior of the expected squared norm of the gradient mapping G(x,) goes to zero. In other words, the algorithm approaches stationary point during the iterations.
J Proof of Primal-Dual Methods
We employ the multi- timescale stochastic approximation framework [18] to analyze the convergence of the primal-dual update and show that the convergent results satisfy the constraints. Combined with Remark 2, we make the following assumptions that the step sizes satisfy the standard approximation framework conditions:
Assumption 2 (Step Sizes).
The step size schedules (Br) and {mt) satisfy:
1. Σe 31 = 00,
Ei 1// = 00.
2. Σ 33. 00,
Et= th < 00
3. 1/2 = ((3))
The condition 7/t = ((3)) ensures that the primal variables (x4) evolve on a faster timescale than the dual variables (A+).
Step 1 (Convergence of primal update) Consider the dynamics of x, while holding the dual variable X fixed at some value X. The primal update (13) becomes:
Br .V., logp(æ.) - X ((,))((T)) + VB, 2
T++1 = Ft
(34)
Defining the potential function of the distribution as Ux, Å) = logp(r:) + X g(x)), we have that VU (xx, 2) -z, p(x,) + A X ((r)). Consequently the update can be written as:
Br T++1 = z; VU X) BBa
(35)
This the Euler- Marly-aa discretization of the overdamped Langevin stochastic differential equation (SDE). The update rule (34) falls under the Theorem 4.9, Section 4.4 of [14]. The theorem states that for Langevin LangevinRRobinns- (LRM) scheme of the form:
(LRM) scheme described in
Fa+1 = x, + (v,,)) + Zn+13 + (
(36)
where Ex+1 are i..dd standard Gaussian, the stochastic interpolation (X)) of {øn heen is an asymptotic pseudo trajectory of the flow & corresponding to the SDE
dY: v(Yi)dt (Yi)dW,
(37)
in the Wasserstein space, provided the some assumptions for theorem 4.9 in [14] hold. We now verify the assumptions for specific update.
A1 (Lipschitz): Firstly, we need the drift term r(x) = Vlog((>) - VV)g(z) to be Lipschitz. We make the following assumption for the proof:
27

---

Assumption 3. Assume that the gradients V llogp(>) and Vg(z) are Lipschitz continuous with constants b and g. respectively.
Under Assumption 3, v(x) is Lipschitz continuous:
[|0())) - (v)ll = || (V p(a) X Vg(x)) - (V ((ogp(u) - X Vo(i))
V log p(x) - V log p(y)) + (Vg()= V
1pl1x yll + ||
Lp yll + | | yll
(Lp || - y|1
Therefore, v(x)) is Lipschitz with constant L,p = (T.p + ||A|I For diffusion term, we have (1) = la which is a constant function. Thus, (a:) Lipschitz with constant Tig 0. In conclusion, under Assumption 3, Assumption 4.2 in [14] holds.
A2 (Robbin-Monro): Based on Assumption 2, we have D Br 0o and Ei= Bf oo which satisfies conditions in Assumption 4.3 in[14].
A3 (Error term): We have Zn+1 0, Un+1 0 and B,+1 O. For Assumption 4.1 in [14], measurability holds for Zn+1 = O. For Condition 4.14 in [14], | = 0.
suN E 1|2 = 0 < D0. For Condition 4.15, Ba+1| = 0. We need to check
S 3 (1, I[2 + fn. Since 3n > and ||=(( 2 0, this inequality holds trivially. Thus, Assumption 4.4 in [14] holds.
A5 (Bounded Moments): We need to verify that supnen E | co. Theorem 4.13 in [14] provides sufficient conditions for this, requiring e to be dissipative and either L3 (where a is the dissipativity constant) or a to be bounded.
Definition J.1 (Dissipativity (Def 4. in [14])). The drift e (a, diisssiiiieeeeee if (x, v(x)) s
-a | 3 for some > 3 2 0.
Assumption 4. Assume the drift v(x)= = - V logp(x) V())(r)) is (ox, -iddsiiipa for some 0,3 3 2 O.
Also, we could find that (x) = Ia is Lipschitz, lim,- Bn = 0, Condition (ii) of Theorem 4.13 in [14]requires to be bounded in Frobenius norm. [|a(x)]| = || vd < oo all hold. Therefore, by Theorem 4. 13, we have suPn.N xr 1| co.
At this point, all assumptions are satisfied and we could conclude that the update rule (2) is an asymptotic pseudo trajectory of the flow corresponding the following SDE:
dx, VU(X, A)di + dW,
(38)
when f + oc, it converges to the stationary distribution of this SDE, denoted by 9x:
qx (x) x exp(- log p(z) + g())).
(39)
Furthermore, similar to Lemma 4.10 in [14], the relative entropy H (xx) acts as Lyapunov function, set for the SDE flow is the singleton {qx}. This
implying that the only internally implies:
Lemma J.1 (Fast Scale Convergence). Under the ussumptions above, for any fixed À 2 0, the distribution of xe generated by (34) converges to the unique stationary distribution ax.
Step 2 (Convergence of dual update) We analyze the slower dynamics of X based on the previous stationary distribution conclusion. However, in practice, the approximation of Eg(g(<)) may be inefficient. Therefore, we directly use the term g(x) and rewrite the dual update:
Aet1 [} + (=+(
(40)
Consider the associated ordinary differential equation (ODE) related to the behavior of under the distribution qx.:
d'r
[V2((q, A1+ [E [g]x)]]
(41)
dt
28

---

where t represents the slow time scale associated with nt. Then, we prove that the update (40) is stochastic approximation of the ODE (41) based on stochastic approximation theory. To illustrate the proof, we write the dual update into the following formulation:
1+1 [A. + T7 (V X) + M++1)++:
(42)
where M,+1 is Martingale differences w.r. the o-field a (A,, M,, < t) and here M++1 = g(x)
VxL(q", X) = g(x) E Ex [2())] Because the samples are generated independently and randomly from the distribution a we can easily obtain that E [x,1] E[(((r)
En [xx)) 0
where Fx,t = (Ai, M,, i < 1) is the filtration of X generated by the update trajectories. Then, we show that M, is square integrable. To illustrate this proof, notice that
[V) - s(>)ll = [ + |la(z))
(VVL(() g(x))
We analyze the term separately. By the Cauchy-Schwarz inequality, we can obtain
2 (V>L(A) g(r)) < 2 |ل(())|
[|)] + [[
Substitute the bound into the expanded squared norm:
[VvL(A)) g())|l = 2 211g(
Then we apply Lipschitz and Boundedness Conditions, Using V - (1 [|Il3) and
|| s C::
2 2/))11 + +1])(()) < 2K ||||)) 2C.
Since 1 S 1 + ||al for all X, we have:
2K + [|a13) + 2C & (2K1 + + [|X133).
Let K 2K1 2C. Therefore:
[V - -(())l K(1+ ||X113).
Then, we can conclude that M, is square integrable. By combining these results, we could say that the update (40) is a stochastic approximation of the ODE (41) with a Martingale difference error term.
To show that the system converges locally stable point, we consider the following Lyapunov function,
((A) (A) + (A")
(43)
where X is local maximum point of the Langragian function. Consequently, there exists neighborhood By-(r) centered at X with radius r, such that C(A) is locally positive definite (i.c., ((A) 2 0) for all À within this neighborhood. Since it is local maximum point, obtain that
dd = LV ,1]1==x>- = 0.
(44)
dt
which means that X stationary point. Then we calculate the time-derivative of the Lyapunov function,
d(((a)) VLL (L)) < (1))+1
<
(45)
which is nonzero when LV (N+)l+ # O. Based on the Lyapunov theory, X will finally converge to X²
Therefore, under conditions above, iterates de converge the set of stable equilibrium points of the ODE (41), i.e., X", which is the local maximum point of L(q" (A),
Step 3 (Local Saddle Point) After the steps above, we could conclude that q" is the minimum point of the L(g. X*) over the feasible set. We now show that the equilibrium condition implies that the constraint satisfaction and the local saddle point for the original problem (9) are satisfied at (g". X*). To complete the proof, we firstly show
E Ex~glo(2) O,
(46)
29

---

when d converges to A², Suppose that Ex~glg(<)] > O, this implies that dd > 0, which contradicts
de
that dA. lA,=A- 0. Therefore, the constraints satisfied when dual update converges. Then show that
A 0.
(47)
When the constraints are tight, we can easily show that the equation is satisfied. When ([) Suppose that X (0, Amax] then there exists small constant c such that
<
ddc
dt A= 1 ((X - --Ee~gll( - X*) Ex [x))] < 0
(48)
which contradicts the stationary conditions. Then, we can obtain that L'q", A) - L(g", X²) - L(q. X*)
(49)
In conclusion, (g", a local saddle point of L(g, A), i... q"' is local optimal solution the original optimization problem (9)
K Analysis of Augmented Lagrangian Methods
In this section, analyze the results of the Augmented Lagrangian methods. In the proposed methods, we introduce slack variables to handle inequality constraints, but the problem is still based on equality constraints. Therefore, in the analysis, we omit the slack variables and consider the case of equality constraints. We rewrite the equation (15),
Lg A, s) KL(g A
2 ( [x+))
(50)
Similar to the primal-dua methods, the optimal constrained distribution q" can be characterized as tilted version of the original distribution p(x) e-f(w), given by ox (z). Sampling from (x)) can then be achieved by the update (16). Our analysis proceeds the assumption that the iterates are in neighborhood of an optimal solution (q", X*) that satisfies KKT conditions of original constrained optimization problem.
SL 8q
= log g(x) log + +1+ Ag(x) ~
(51)
[g]]]
(52)
where v is the term related to the normalization. The directions of time flows follow Remark 2. At time step of the Augmented Lagrangian method, have the following update rules,
Be [aa logp(x.) - (Ae + ( v..zx() + Bea (53)
Jt+1 = xt + 2
When we have fixed X and pt. following the same assumptions in the proof of convergence of primal update for primal-dual methods, could conclude that the distribution of generated by (53) converges to the unique stationary distribution &r which is the optimal solution to the problem (9) with fixed de and Pt.
G++1 Kx.0p. = arg min L (e)
(54)
In the neighborhood of the optimal solution, the (53) approximates the related optimal solution, which is analogous the first-order approximation optimization methods. Since the solution is optimal, we have the following first-order optimality conditions ALa 0, stating that the optimal distribution (z) for this subproblem satisfies:
log 41+1 (I:) log + 1 Xeg(z) + Pe [o(x)]g(() + v =
(555
where is the term related to the normalization. This implies that q:+1 (x)) has the form:
g++1 (x) x p(x) exp (- (Ae + pr (Enn-olg(xz))) g(x))
(56)
Following the solution of the Langevin update to obtain ge+1, the Lagrange multiplier estimate is updated as follows:
Att1 Xe prlEurgu [g(x)]
(57)
30

---

Then we substitute (57) into (55) and obtain
log (x) - log p(x) + 1+ (t-19(æ) -
(58)
This form is identical to the KKT condition for the original constrained optimization problem. For convergence, we need \ X and, that the constraints satisfied, i.e., Pe---- [[([=] 0. If
the penalty parameter sequence p! is chosen such that p(k) + oc, the solution to the optimization problem will make [x)r + 0. Furthermore, based on the dual update rule, X will converge to X when bounded. Otherwise, the augmented Lagrangian will goes to infinity. According to Proposition 2.4 with Assumption S in [49], when we have conditions
twice differentiability and linear independence constraint qualification, we could have a rigorous convergence result in augmented Lagrangian methods. Given these conditions, as t + oc, (((x) q" (z), A++1 + X"
Ex-ugn x)] + O,
Thus, the sequence of distributions dr generated by the iterative process converges to the optimal dis- tribution q" that minimizes KL(gllp) subject to Ex~g]g(<=] 0. The penalty term 2 11 [=)]] ensures that for large p. any significant constraint violation heavily penalizes LA, driving iterates towards feasibility.
L Clarifications on DCBF constraints
Unlike static state constraint, the DCBF constraint each state x" depends on its neighboring state x=+1_ This coupling means that the gradient guidance at each trajectory point varies according to the states of adjacent points. our three methods, the implementation differs as follows: for the Projected Method, the projection step solves a constrained optimization problem where the feasible set is defined by all coupled DCBF inequalities simultaneously enforced along the entire trajectory. For the Primal-Dual Methods, the update rule should be written follows:
Be (vag log p(g)( + Ve,,,())
2 27
- + VBEE
2
X N
nn Ex (1
For ALM, the update rule should be written as follows:
3t
T/-
V Va logp(z?) ( [,;
pe pe(Ex-pl((z?)) (1 a))(xx--))
- 5/ - 2 h(*)) (1 a)
pe(1 a) -
(1-a)h $/ ' o. h(x7))
BB22
o5 En 11 (1( - (1)x))(=T]] XT/Pp]
N_1 = N7 Pe ((2 - (1 a-)((h))) - 1.-
M The Inverse Dynamics Model (IDM)
We provide detailed description and discussion of the Inverse Dynamics Model (IDM) used in our framework, including its rationale, architecture, and training methodology.
M.1 Rationale and Training from Expert Data
In our framework, we assume that while an inverse dynamics model exists for the system, is not accessible in a closed form derived from first-prineiple physics. The forward dynamics treated as a black box, making classical model-based inversion infeasible.
To overcome this, we learn the IDM from data. Both the diffusion model and the IDM are trained offline using dataset of expert trajectories. These trajectories are collected from interactions with the true physical system and are therefore composed entirely of dynamically feasible state-action
31

---

sequences. By training on this data, the IDM learns a valid mapping from state transitions (x", x-+1) the actions (u") that produce them.
Once trained, this neural network-based model is "available" during deployment. It can efficiently convert the safe state trajectories generated by our constrained diffuser into the corresponding actions through single forward pass, ensuring both state-action consistency and high computational efficiency.
M.2 Model Architecture and Consistency
We implement the IDM as a deterministic model using multilayer perceptrons (MLPs). To enhance stability, we discretize the continuous action space into finite number of bins, transforming the regression task of predicting an action into a more stable classification task.
The model's architecture is autoregressive, generating the action vector dimension by dimension. It first encodes the concatenated initial and next states (x",, x=+1) into a latent feature vector. Then, for each dimension of the action vector, dedicated MLP predicts its value based on both the state feature vector and an embedding of all previously generated action dimensions. This autoregressive structure allows the model capture dependencies between action dimensions, leading more coordinated and realistic actions. The specific implementation follows the methodology presented in [4].
To ensure the model leams smooth and consistent mapping within the expert data distribution, consistency can further encouraged by adding a regularization term to the loss function during training. This term typically penalizes large action magnitudes, promoting minimum-effort solutions that generalize well and avoid erratic behavior.
M.3 Dynamic Feasibility and Future Work
A key challenge, particularly for underactuated systems, is the risk that the planner could generalize outside the expert data distribution and propose a kinematically impossible transition. While our current experiments focus state-based constraints validate the core framework, method is general and can be extended to handle constraints related to dynamic feasibility.
Specifically, can enforce constraints directly on the output of the IDM during the reverse diffusion process, ensuring that the planner only generates trajectories that are executable within the system's actuation limits. This ensures all planned states are reachable, assuming the learned IDM is accurate.
While ensuring the existence of control actions for underactuated robots critical topic, a full exploration is beyond the scope of this paper. We plan to address this in future work, which will also explore more expressive and efficient IDM architectures, such as Neural ODE-based models, to better capture complex continuous- time dynamics.
N Visualization of Diffusion Process
The following visualizations show how trajectories evolve during denoising under different constraint- handling strategies.
SDR
Figure 6: Diffusion process for vanilla diffusion
32

---

Vanilla Diffusion: The trajectory is recovered from Gaussian noise through stepwise denoising over the entire trajectory. No constraints are enforced and paths may intersect obstacles or violate safety conditions.
LDE
Figure 7: Conditional Diffusion
Conditional Diffuser: Each denoising step is guided by the gradient of a classifier: Early steps resemble vanilla diffusion, while later steps steer entire trajectories away from obstacles, producing safer paths at the cost of potential deviation from expert-like behavior.
SLC
Figure 8: Diffusion process for SafeDiffuser
SafeDiffuser: If any point enters a constraint-violating region during denoising, that step is adjusted move the point directly the safe boundary. This ensures all points remain within the constraint boundary at every step while leading to some local traps.
Figure 9: Diffusion process for projected methods
Projected methods: Similar SafeDiffuser, but applies geometric projection operator that any violating point is immediately projected onto the nearest constraint boundary.
33

---

S
Figure 10: Diffusion process for primal-dual methods
Primal-Dual methods: Early denoising close vanilla diffusion. Near the end, only points violating constraints are gradually guided out, while safe points evolve like vanilla diffusion. This minimizes deviation from expert data while ensuring constraint satisfaction.
S
Figure 11: Diffusion process for ALM
Uses quadratic penalty term to gradually guide violating points out during late denoising. This enables stronger constraint satisfaction.
ALM:
34


Reviews:
[{"review_id": "SxaS3cKOtQ", "reviewer": "Reviewer_UkXA", "summary": "The paper introduces Constraint Diffusers,  a framework that incorporates constraints into pre-trained diffusion models without retraining or architectural modifications, by incorporating constrained barrier functions into the model. The objective is to make diffusion predictions safe and use them with planning. Constrained Diffusers aim to inject safety constraints into pretrained diffusion-based models that generate full action sequences or trajectories. The method recognizes that retraining large diffusion models to account for new constraints is computationally expensive. Instead, they modify the sampling process to ensure constraint satisfaction post hoc.", "questions": "How does your work compare with current literature that uses barrier functions to enhance the safety of planning systems?\n\nWhy is this method useful when in fact there are closed form model-based and computationally efficient solutions for the problem you address? How does the method compare to other planning methods like MPC with safety layers or goal-conditioned RL with constraints?\n\nHow sensitive is constraint enforcement to the quality of the inverse dynamics model? What happens when the IDM is inaccurate or poorly generalized? \n\nDo these constrained sampling methods scale well to high-dimensional action spaces (e.g., humanoid robotics)?\n\nHow does the method perform when multiple competing constraints (e.g., safety vs. performance) must be balanced?\n\nIs there a quantitative analysis of trade-offs between computation time and constraint satisfaction for each method?\n\nWhat assumptions are made about access to constraints, and how realistic are those assumptions in practical deployment?", "limitations": "No this section is missing from the paper", "rating": 3, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 2, "originality": 2, "strengths_and_weaknesses": "Pros: \nThe method works directly with pretrained diffusion models, avoiding expensive retraining.\nThe method makes safety a post-training concern, improving modularity and practical usability.\nThe paper offers a toolkit of constraint-handling strategies\n\nCons:\nSuccess in enforcing complex, nonconvex, or time-varying constraints is dependent on the optimization dynamics—true safety guarantees may still be fragile.\nExperiments are simple and preliminary. Experiments are done in simulation only on toy examples. The results look very preliminary.\nNo mention of prior control barrier function methods. How is your paper improving on/ different from several papers on the same topic which are not cited, specifically mapaers that use CBFs with ML such as BarrierNet and papers that address safe diffusion such as Safediffuser: Safe planning with diffusion probabilistic models (ICML 2025 and arXiv)? \nThe solution requires accurate learning or specification of inverse dynamics to translate constrained trajectories into executable actions.", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for the constructive review and feedback. We have carefully addressed each of your points below.\n\n**W1: Fragile Guarantees**\n\n**Response:** The success of PD and ALM methods depends on the optimization dynamics. Multi-scale analysis of PD updates uses two learning rates and assumes a local optimum near the initialization, without requiring global convexity. The same applies to ALM, which drives constraint violations asymptotically to zero with sufficient iterations. Our work also offers a trade-off by providing different kinds of solutions: For hard safety guarantees, the Projected method enforces strict constraints. For efficiency, PD and ALM offer practical alternatives by replacing expensive optimization with simple updates.\n\n**W2: Preliminary Experiment**\n\n**Response:** Our goal is to propose a foundational framework for diffusion models that addresses critical safety challenges and offers a spectrum of solutions. To this end, we evaluate it in standard, well-understood environments such as MuJoCo and PyBullet to demonstrate effectiveness under different safety requirements and validate its broad applicability. Following your suggestion, we also conducted additional experiments on a high-dimensional dexterous hand manipulation task, detailed in our response to Q4.\n\n**W3: Prior Work**\n\n**Response:** We extensively discuss related work, including SafeDiffuser, in Section 7 Related Work and compare to it in our experiments. [1] proposes BarrierNet, a differentiable layer that embeds learnable CBF parameters into neural networks for end-to-end training of less conservative policies. Other studies address safety in imitation learning and uncertainties through solve QP [2]-[4]. Compared to SafeDiffuser, our key difference is that it applies CBFs at intermediate diffusion steps, whereas we enforce CBFs along the entire trajectory in the physical world. Moreover, most prior CBF methods rely on solving costly QPs, while two of our methods exploit diffusion properties to impose CBFs efficiently without per-step constrained optimization.\n\n**W4: Accurate Inverse Model**\n\n**Response:** We agree that the accuracy of the IDM is crucial for converting planned trajectories into actions. Our experiments show the learned IDM performs well on the tasks studied. To further investigate, we conducted additional tests with an inaccurate IDM, detailed in our response to Q3. Future work will focus on improving robustness by exploring advanced models like PINNs and Neural ODEs, and designing policies less sensitive to IDM errors.\n\n**Q1: Compare to other barrier function literatures**\n\n**Response:** Compared to the current literature discussed above, we use diffusion models as planner due to their exceptional ability to represent complex and multimodal distributions over trajectories. It provides advantage over traditional planning methods that may have difficulty capturing the diversity of expert behaviours. While the current literature has successfully combined CBF for safe planning, our work introduces a different paradigm that leverages the properties of diffusion processes with gradient-based techniques to iteratively guide the diffusion process toward satisfying the safety constraints, leading to a significant reduction in computation time.\n\n**Q2: Why methods useful? Compare to other planning methods?**\n\n**Response:** Our method is suited for scenarios where the objective is unknown and policies are learned from expert demonstrations, where model-based MPC is often impractical. Constraints may allow a closed-form solution, but integrating them into behavioral cloning is challenging. Our Primal-Dual and ALM approaches address this by only requiring the gradient of each constraint. Compared to learning-based MPC with safety layers or goal-conditioned RL with constraints, our diffusion framework has several advantages. Diffusion models naturally learn multimodal distributions from expert data, generating diverse trajectories that adapt well to changing environments. Our gradient-based constraint enforcement is also more efficient than typical QP-based safety layers. Diffusion models also support vision and language inputs, enabling our framework to scale to more complex, real-world problems than many traditional planning algorithms.\n\n**Q3: How sensitive is constraint to IDM? What happens with inaccurate IDM?**\n\n**Response:** The accuracy of the IDM is critical because errors cause a mismatch between planned and actual states, leading to potential task failures and safety violations. We quantify this sensitivity by defining the IDM error as $\\\\Delta u = \\\\tilde{u}^\\\\tau - u^\\\\tau$. Linearizing the dynamics shows the resulting state deviation $\\\\Delta x \\\\approx \\\\frac{\\\\partial f_d}{\\\\partial u} \\\\Delta u$, which affects the safety function as $h(x_{actual}^{t+1}) \\\\approx h(x_{plan}^{t+1}) + \\\\nabla h(x_{plan}^{t+1})^\\\\top \\\\Delta x,$ meaning the change in constraints is primarily influenced by $\\\\nabla h(x^{t+1}_{plan})^\\\\top \\\\frac{\\\\partial f_d}{\\\\partial u}$. We conducted sensitivity experiments on Hopper with varying IDM errors (2%, 10%, 25%) and evaluated three algorithms (Projected, Primal-Dual, ALM). Results show that increasing IDM error generally lowers reward and increases constraint violations, but a 10% error is still acceptable for the tasks (see table below). \n\n|Env|Error|Algorithm|Reward|Impl.Violations|ViolationRate(%)|\n|-|-|-|-|-|-|\n|Hopper|2%|Projected|3437±196|0.28±0.12|1.76±0.75|\n|||PrimalDual|3501±130|0.48±0.214|3.47±0.85|\n|||ALM|3370±442|0.44±0.19|3.13±0.10|\n||10%|Projected|3391±325|0.32±0.08|1.98±0.60|\n|||PrimalDual|2690±707|0.46±0.12|3.33±0.86|\n|||ALM|2369±455|0.41±0.08|3.09±0.02|\n||25%|Projected|1900±471|0.62±0.12|2.09±0.29|\n|||PrimalDual|1446±354|1.19±0.22|4.67±0.75|\n|||ALM|1614±504|0.95±0.33|4.11±0.02|\n\nAdditional swimmer experiments will be included in the revised paper due to space constraints.\n\n**Q4: Scalibility to high-dimensional action spaces**\n\n**Response:** Compared to traditional algorithms that suffer from the curse of dimensionality, learning-based methods handle high-dimensional action spaces better through end-to-end learning and strong nonlinear fitting, without explicit search. We conducted additional experiments on the 30-dimensional Dexterous Hand Manipulation Adroit Relocate task from D4RL with two translation constraints. Results summarized below (details to appear in the revised paper) show that even with similarly sized models, our algorithms satisfy constraints, demonstrating scalability to high-dimensional tasks.\n\n|Env|Algorithm|Rewards|Violations|ViolationRates(%)|Time(s)|\n|-|-|-|-|-|-|\n|Relocation|Diffuser|550±938|87.0±30.4|74.0±16.4|0.0028|\n||Conditional|422±837|32.0±14.7|58.5±16.3|0.0029|\n||Projected|321±791|0.0±0.0|0.0±0.0|0.9515|\n||PrimalDual|499±951|0.04±0.03|2.9±1.9|0.0031|\n||ALM|325±670|0.04±0.02|2.9±1.6|0.0035|\n\n**Q5: Performance when multiple competing constraints must be balanced?**\n\n**Response:** Our method formulates diffusion as a constrained optimization problem with safety as the top priority. The algorithm first finds feasible solutions satisfying all constraints, then searches along the safe boundary under some assumptions, keeping safety dominant even when optimizing performance. From a dual perspective, each constraint has a Lagrange multiplier updated during reverse diffusion to push violated trajectories back into the feasible region. When constraints compete, the process behaves like a dynamic game, minimizing the original objective while balancing a weighted sum of violations to explore the Pareto frontier. We often relax non-critical constraints by adding them to the objective function or introduce slack variables to maintain overall feasibility. We enforce Control Barrier Functions (CBFs) over entire trajectories, which guarantees safety but risks local trapping; stochastic denoising mitigates this by occasionally escaping traps, balancing strict safety with feasible performance exploration.\n\n**Q6: Quantitative analysis of trade-offs?**\n\n**Response:** Based on the experimental data, we analyze the trade-off between computation time and constraint satisfaction. The Projected Method achieves zero violations but incurs high computation cost due to solving an optimization at every diffusion step. Primal-Dual is highly efficient, running near the speed of vanilla diffusion with only minor violations. ALM strikes a balance, trading slightly more computation for improved constraint satisfaction. A more detailed analysis will be added in the revised paper.\n\n**Q7: Assumptions made on constraints, and how realistic in practical deployment?**\n\n**Response:** Our framework assumes a differentiable constraint function and its gradient. For common cases like geometric obstacles, this can be derived analytically. In more complex settings, constraints can be built in real time from sensor data, e.g., camera-based segmentation for obstacle boundaries. For black-box constraints, a neural network can learn a differentiable approximation from cost signals collected via environmental interactions.\n\n[1] Xiao, W., et al. (2023). \"BarrierNet: Differentiable Control Barrier Functions for Learning of Safe Robot Control.\" IEEE Transactions on Robotics, vol. 39, no. 3, pp. 2289-2307, June 2023, doi: 10.1109/TRO.2023.3249564.\n\n[2] Cosner, R. K., Yue, Y., and Ames, A. D. (2022). \"End-to-End Imitation Learning with Safety Guarantees using Control Barrier Functions.\" 2022 IEEE 61st Conference on Decision and Control (CDC).\n\n[3] W. Xiao, C. Belta and C. G. Cassandras, \"Adaptive Control Barrier Functions,\" in IEEE Transactions on Automatic Control, vol. 67, no. 5, pp. 2267-2281, doi: 10.1109/TAC.2021.3074895.\n\n[4] Taylor, A. J., Singletary, A., Yue, Y., and Ames, A. D. (2020). \"Learning for Safety-Critical Control with Control Barrier Functions.\" 2nd Annual Conference on Learning for Dynamics and Control."}, {"review_id": "15E8R899zj", "reviewer": "Reviewer_x55D", "summary": "This paper proposes Constrained Diffusers, a method for enforcing safety constraints in planning and control using pretrained diffusion models. Rather than modifying the model or retraining, the authors modify the reverse sampling process using constrained Langevin dynamics with three algorithmic variants: Projected Gradient, Primal-Dual, and Augmented Lagrangian. The framework supports discrete control barrier functions (DCBFs) to enforce safety online. Experiments in Maze2D, MuJoCo locomotion, and PyBullet demonstrate the efficacy and efficiency of these methods under static and time-varying constraints.", "questions": "- Can you compare the three methods? What are the pros and cons of each one?\n\n- If I understand correctly, while (9) is formulated as a general constraint, later on the constraint is chosen as the constraint barrier function. I wonder what’s the difference between using CBF as constraint vs. directly impose safety set constraints on the states? Further, as the proposed method generates state trajectory, how to ensure the state trajectory is dynamically feasible?\n\n- In Theorem 1, does a local saddle point always satisfy constraint?", "limitations": "Yes", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 4, "clarity": 4, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strength: \n\n- The paper addresses a critical gap in diffusion-based planners: enforcing constraints without retraining. This is highly relevant for real-world safety-critical systems.\n\n- This paper has nice connection to classical constrained optimization. By formulating constraint satisfaction as KL-regularized sampling, the authors connect reverse diffusion with well-established constrained optimization principles. \n\n\nWeakness:\nI do not see major weakness of the paper. See questions.", "was_revised": true, "final_justification": "I appreciate the reviewer for the detailed response. The comparison of the three is nice. I keep my (positive) score as is.", "rebuttal": "We thank the reviewer for their positive and insightful feedback on our work. We are pleased that they recognized the key strengths of our paper, and we will now address the specific questions raised in detail.\n\n**Q1: Pros and Cons of the three methods**\n\n**Response: Projected Method** :This method modifies the standard diffusion update rule by projecting the generated sample onto the feasible set defined by the constraints at each denoising step. **Pros:**- This method provides the strictest safety guarantee among the three methods. It ensures constraints are met at every diffusion step and consistently achieves zero planning violations in experiments. **Cons:** The projection operation can be time-consuming especially when constraints are complex because we need to solve an optimization problem, making this method significantly slower than the Primal-Dual and ALM approaches. \n**Primal-Dual (PD) Method**: This approach treats the problem as a constrained optimization task, using Lagrange multipliers to incorporate constraints. It simultaneously updates the trajectory (primal variable) and multipliers (dual variables) using gradient-based steps. **Pros:** This method has a high computational efficiency with computation times often comparable to the unconstrained baseline diffuser and admitstheoretical convergence analysis even for nonconvex constraints based on the assumptions given in the paper.  **Cons:** This method does not may not practically guarantee strict constraint satisfaction in some experiments because more diffusion steps are needed for convergence. The final generated trajectories often have small, non-zero violations. \n**Augmented Lagrangian Method (ALM)** ALM enhances the Primal-Dual method with another quadratic penalty term to the Lagrangian function. **Pros:**: This method has the best balance of computational efficiency and safety:  Similar to the PD method, it slightly increases the computational time and provides better constraint satisfaction compared to the standard Primal-Dual method. **Cons:**  Like the PD method, it does not offer the absolute guarantee of constraint satisfaction of the Projected method. The convergence analysis is based on some strong assumptions which may be hard to guarantee in real-world experiments.\n\n**Q2: Difference between using CBF as constraint vs. directly impose safety set constraints on the states**\n\n**Response:** The reviewer is correct that the paper first formulates a general constraint problem and then uses a Discrete Control Barrier Function (DCBF) as a specific type of constraint. Safety Set Constraint is a static constraint applied to each individual state in a trajectory. If the safe set is defined as $\\\\mathcal{C} = \\\\{x \\in \\\\mathbb{R}^d : h(x) \\\\ge 0\\\\}$, a direct constraint would simply enforce that for every state $x^\\\\tau$ in the planned trajectory, the condition $h(x^\\\\tau) \\\\ge 0$ holds. This ensures each point of the plan is in a safe location. The obstacle avoidance constraints in the Maze2D experiments are an example of this. The Discrete Control Barrier Function (DCBF) constraint provides a stronger, dynamics-aware safety guarantee due to input constraints. Instead of just ensuring each state in the safe set, it imposes a condition on the transition between consecutive states to ensure that the safety margin does not decrease too quickly. The goal of a DCBF is to guarantee the forward invariance of the safe set, meaning that if the system starts in a safe state, the entire trajectory generated under this constraint will remain safe, ensuring the trajectories plan from one point to the next is safe. Also, the dynamic feasibility of the generated state trajectory is ensured by using a learned Inverse Dynamics Model (IDM) combined with DCBF. After the constrained diffuser generates a safe sequence of states $(x^0,x^1,...,x^\\mathcal{T})$, the framework uses the IDM to determine the action required for each transition and is then fed into the environment. This approach relies on the assumption that an IDM exists for these tasks. Since the expert trajectories are by definition dynamically feasible, the IDM learns the underlying dynamics of the system. DCBF then plays a role in providing safe guarantees on the actions from the IDM, ensuring that the generated safe state trajectory can be translated into a safe actions. We give an experimental comparison below. The reviewer can also refer to Section G in Appendix for more details.\n| Env                | Algorithm     | Planned Violations | Planned Violations (w/o CBF) | Implementing Violations | Implementing Violations (w/o CBF) |\n|--------------------|---------------|-------------------|-----------------------------|------------------------|----------------------------------|\n| **Hopper**         | Projected     | **0.00 ± 0.00**   | **0.00 ± 0.00**             | **0.29 ± 0.09**        | 0.42 ± 0.10                     |\n|                    | Primal Dual   | 0.10 ± 0.03       | 0.13 ± 0.03                 | 0.43 ± 0.12            | 0.46 ± 0.43                     |\n|                    | ALM           | 0.08 ± 0.02       | 0.10 ± 0.03                 | 0.38 ± 0.16            | 0.61 ± 0.12                     |\n| **Swimmer**        | Projected     | **0.00 ± 0.00**   | **0.00 ± 0.00**             | 0.61 ± 0.25            | 0.75 ± 0.29                     |\n|                    | Primal Dual   | 0.17 ± 0.08       | 0.16 ± 0.06                 | 0.02 ± 0.02            | 0.06 ± 0.08                     |\n|                    | ALM           | 0.08 ± 0.05       | 1.80 ± 0.52                 | **0.00 ± 0.02**        | 0.42 ± 0.24                     |\n| **SafetyBallRunning** | Projected  | -                 | -                           | 1.01 ± 0.63            | 1.50 ± 0.14                     |\n|                    | Primal Dual   | -                 | -                           | 0.02 ± 0.03            | 0.10 ± 0.13                     |\n|                    | ALM           | -                 | -                           | **0.02 ± 0.02**        | **0.02 ± 0.02**                 |\n\n**Q3: Does a local saddle point always satisfy constraint?**\n\n**Response:** Yes. According to Definition 4.1 in the paper, a point $(q*, \\\\lambda*)$ is a local saddle point if and only if it satisfies, for all $\\\\lambda \\\\ge 0$: $L(q*, \\\\lambda*) \\\\ge L(q*, \\\\lambda).$  We have the following Lagrangian function as: $L(q, \\\\lambda) = KL(q \\\\| p) + \\\\lambda^\\\\top \\\\mathbb{E}_{x \\\\sim q}[g(x)].$  Then we obtain $KL(q* \\\\| p) + (\\\\lambda*)^\\\\top \\\\mathbb{E}[g(x*)] \\\\ge KL(q* \\\\| p) + \\\\lambda^\\\\top \\\\mathbb{E}[g(x*)].$ Simplifying gives  $(\\\\lambda* - \\\\lambda)^\\\\top \\\\mathbb{E}[g(x*)] \\\\ge 0.$  This inequality must hold for all non-negative $\\\\lambda$ (i.e., $\\\\lambda \\\\ge 0$). Suppose that at the saddle point $(q*, \\\\lambda*)$, the constraint is not satisfied. This implies that at least one constraint is positive, i.e., some component in $\\\\mathbb{E}[g(x*)]$ is greater than $0$.  Under this assumption, we check whether the inequality  $(\\\\lambda^* - \\\\lambda)^\\\\top \\\\mathbb{E}[g(x*)] \\ge 0$  can still hold for all $\\\\lambda \\\\ge 0$. Choose a very large positive value $\\lambda$, in the dimensions where $\\\\mathbb{E}[g(x*)] > 0$. Then $(\\\\lambda* - \\\\lambda)$ becomes highly negative in those dimensions. Consequently, the inner product  $(\\lambda^* - \\\\lambda)^\\\\top \\\\mathbb{E}[g(x*)]$  becomes a negative number which violates the inequality  $(\\\\lambda* - \\\\lambda)^\\\\top \\\\mathbb{E}[g(x*)] \\\\ge 0,$  creating a direct contradiction. Therefore, the saddle point condition must also satisfy the constraint, i.e.,  $\\\\mathbb{E}[g(x*)] \\\\le 0.$  Please refer to Section E, Step 3 in the Appendix from supplementary materials for a detailed proof."}, {"review_id": "p3btz2oBxQ", "reviewer": "Reviewer_3UpD", "summary": "This paper presented a constrained diffuser framework that does not rely on pre-training and is able to ensure safety when using the diffusion model for control and planning. The authors designed three different methods (ALM, projection, and Primal-Dual) to complete constrained sampling and satisfy the constraints represented by synthesized discrete control barrier functions. In the end, an inverse env model, which is supposed to be known a priori, is used to compute the action. By using this framework, the diffuser-based controller can have a good constraint satisfaction performance compared with existing baseline methods in various environments.", "questions": "See above", "limitations": "No societal impact relevant to this work", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 3, "significance": 2, "originality": 2, "strengths_and_weaknesses": "Strengths: \n1. The paper is written clearly will good illstration. Fig 1 is pretty intuitive and can demonstrate the performance of different methods. Fig 2 is  easy to understand and is able to help the audience understand the gist of the framework quickly. \n2. The topic is important and interesting. The method proposed in this paper is easy to use since no additional training is required. \n3. A time-varying situation is considered important but relatively less studied. \n\nWeakness: \n1. The benchmark method SafeDiffuser is discussed and compared in the experiments where the environments are not changed. However, the performances in time-varying scenarios are not shown. \n2. The author used an inverse dynamical model to generate the control from the state transition. However, in many dynamical models, there could be different action solutions from the inverse dynamical model. It would be nice if the author could elaborate on how to guarantee the consistency of the controls due to the significance in practice. \n3. The constrained sampling framework for safe control/planning is not a new idea and has been extensively studied and applied in areas like safe RL for robotics. It would be better if the authors could summarize those works and draw a comparison between the proposed safety-enhanced diffuser method with the safe RL methods. \n4. For the Primal Dual and ALM methods there are chances that the control will still violate the constraints even in the simpler time invariant cases. It would be nice if the authors could do more worst-case analysis and discuss how bad the performance will be in extreme cases to help the reader evaluate the risk of the method.", "was_revised": true, "final_justification": "My concerns have been resolved.", "rebuttal": "We thank the reviewer for all the constructive comments. We are glad the reviewer found our work to be an \"interesting and important topic.\" We will now address each of your comments in detail.\n\n**Q1: The performances of SafeDiffuser in time-varying scenarios are not shown.**\n\n**Response:** Thank you for this observation. The problem comes from a mismatch between states and actions in the original SafeDiffuser when moving from planning to online execution. SafeDiffuser uses CBF during reverse diffusion to create a safe state trajectory in planning. However, the actions used in execution are not based on this planned safe state. The model is trained on both states and actions, but during diffusion, only the states are guided, and actions are sampled directly without adjustment. This leads to a mismatch where the executed actions may not follow the planned safe states. Therefore, the original method is mainly suitable for planning, and online execution results were not reported. To compare fairly, we ran additional experiments combining SafeDiffuser with our IDM on all tasks. The results, shown in the table, show SafeDiffuser works well in planning but performs less well online. We will include these results in the revised paper.\n|Algorithm|Env|Reward|PlanningViolations|Impl.Violations|ViolationRates(%)|Time/s|\n|-|-|-|-|-|-|-|\n|SafeDiffuser(IDM)|Hopper|3514±46|0.00±0.00|0.28±0.06|0.27±0.05|0.9307|\n||Swimmer|60.4±6.1|0.00±0.00|0.65±0.21|0.97±0.25|0.9301|\n||SafetyBallRunning|820.8±29.8|--|1.13±1.08|21.9±12.8|2.6e-2|\n\n\n**Q2: How to guarantee the consistency of the controls due to the significance in practice.**\n\n**Response:** In some dynamical systems, an inverse dynamical model can indeed produce multiple control solutions for a given state transition. The mapping from desired state transitions to control inputs is not always one-to-one, especially in systems with redundancy or underdetermined dynamics. This is a known challenge and has been studied extensively in both robotics and aerospace communities. One effective approach is to introduce additional constraints or optimization criteria. For example, if multiple controls can achieve the same state transition, selecting the one that minimizes a cost function -- such as energy consumption, control effort, or time -- can provide a unique and consistent solution. In our research, we use a deterministic neural network to provide the action output which is unique when we make the assumption that the inverse dynamics models are available. To avoid  inconsistency, we could always add a regularization term to the loss function during training to explicitly encourage minimum-effort solutions that may generalize well within the training distribution. Moreover, the inverse dynamics model is queried on well-behaved transitions whose distribution closely matches the expert distribution, which further reduces the risk of inconsistency. In future work, this framework could be enhanced to more explicitly handle ambiguity in complex or underactuated systems.\n\n**Q3: Summarize the constrained sampling works for safe planning and control like safe RL and draw a comparison.**\n\n**Response:** We thank the reviewer for raising this important point. While constrained sampling has been explored in safe RL, our work differs significantly in both the problem formulation and the solution paradigm. For Problem Setting, previous safe RL methods typically formulate the problem either as a Constrained Markov Decision Process (CMDP)[1][2], focusing on expected cumulative costs and enforcing trajectory-level constraints, or impose state-wise constraints via CBF[3] or reachability analysis[4]. Beyond safe RL, several other methods have also been proposed for constrained sampling. Task-constrained RRT [5] employs tangent spaces for manipulators under general constraints while they usually have the shortcoming that computing the kernel of the constraint Jacobian is computationally expensive and may require multiple matrix decompositions. These methods are generally complex to implement, which prevents widespread applicability to many different robotic systems[6]. \n\nOur work explicitly considers state-wise constraints during planning and control, ensuring that individual states along the trajectory remain within safety bounds. This is particularly important in safety-critical applications where violations at any step (not just on average, as is commonly done in many prior safe RL studies) can be unacceptable. For Solution Approach, previous safe RL methods usually aim to learn, from scratch, a policy by jointly optimizing performance and satisfying constraints. This usually leads to a sophisticated learning process and requires a large number of interactions with the environment. Alternatively, some approaches solve complex constrained optimization problems during training by combining the RL controller with safety filters (typically QP-based). However, such approaches can be computationally demanding and may impose additional requirements on the system dynamics, such as the need for a control-affine structure to ensure tractable optimization. In contrast, our method follows a modular two-stage framework: \n\n1. We first train a powerful trajectory generator (diffusion model) to model expert behaviours without enforcing safety constraints.\n\n2. Then, we inject safety at sampling time via constraint-guided denoising, producing trajectories that satisfy state-wise constraints. \n\nThe IDM can be then applied to generate safe actions based on the planned safe trajectories. This decoupling offers several advantages: \n\n1. Modularity: Safety and performance are handled independently, allowing for better reuse and flexibility. \n\n2. No specific requirements on the dynamics model: Unlike many QP-based filtering methods in prior safe RL studies, our approach does not require specific structural assumptions such as control-affine dynamics. \n\n3. Lower computational burden: The diffusion model is trained offline, and constraint satisfaction is imposed only during sampling, avoiding the need to backpropagate safety constraints throughout training.\n\n4. Expressivity: While RL policies are typically modeled as multivariate Gaussian distributions, diffusion models can represent complex and multimodal trajectory distributions effectively. \n\nWe will add a discussion in the revised manuscript to clarify these distinctions and summarize related works. We believe our framework offers a scalable and flexible alternative to traditional safe RL.\n\n[1] Achiam, J., Held, D., Tamar, A. and Abbeel, P., 2017, July. Constrained policy optimization. In International conference on machine learning (pp. 22-31). PMLR.\n\n[2] Tessler, C., Mankowitz, D.J. and Mannor, S., 2018. Reward constrained policy optimization. arXiv preprint arXiv:1805.11074.\n\n[3] Cheng, R., Orosz, G., Murray, R.M. and Burdick, J.W., 2019, July. End-to-end safe reinforcement learning through barrier functions for safety-critical continuous control tasks. In Proceedings of the AAAI conference on artificial intelligence (Vol. 33, No. 01, pp. 3387-3395).\n\n[4] Yu, D., Ma, H., Li, S. and Chen, J., 2022, June. Reachability constrained reinforcement learning. In International conference on machine learning (pp. 25636-25655). PMLR.\n\n[5] Stilman, M., 2010. Global manipulation planning in robot joint space with task constraints. IEEE Transactions on Robotics, 26(3), pp.576-584.\n\n[6] Kingston, Z., Moll, M. and Kavraki, L.E., 2018. Sampling-based methods for motion planning with constraints. Annual review of control, robotics, and autonomous systems, 1(1), pp.159-185.\n\n**Q4: Do worst-case analysis and discuss how bad the performance will be in extreme cases to help evaluate the risk of the method**\n\n**Response:** Our paper provides a quantitative analysis of the trade-offs in its experimental tables, which show the mean and standard error of constraint violations across various tasks, offering insight into the methods' typical performance and variance. For practical deployment, one could adopt more robust strategies, such as defining more conservative constraints, to ensure safe outcomes even in worst-case scenarios.\nTo more directly address your concern, we have conducted an additional worst-case analysis experiment in the PyBullet Safety BallRun environment. In the original setup, the agent and the moving obstacle start with a safe distance between them. In this new analysis, we created more extreme initial conditions by placing the obstacle at different starting positions to our agent:\n\nWorst-Case: Starting at the point of collision (zero margin).\n\n|Env|SafetyMargin|Algorithm|Reward|Impl.Violations|ViolationRates(%)|\n|-|-|-|-|-|-|\n|SafetyBallRunning|Boundary|Diffuser|640.6±29.0|14.04±1.27|81.9±1.92|\n|||PrimalDual|457.1±48.4|2.99±0.12|67.5±2.3|\n|||ALM|380.9±27.1|3.10±0.17|70.1±1.5|\n||10%|Diffuser|640.8±28.9|13.08±1.40|76.5±2.2|\n|||PrimalDual|479.5±54.6|1.55±0.23|32.5±5.6|\n|||ALM|421.9±59.77|1.33±0.21|29.0±4.4|\n||25%|Diffuser|640.6±29.0|11.42±1.65|69.2±2.99|\n|||PrimalDual|413.9±87.9|0.45±0.75|18.9±16.5|\n|||ALM|422.1±70.4|0.06±0.11|8.0±8.5|\n\nThe results demonstrate the robustness of our approach. Even in the most extreme case starting at the point of collision, our methods still effectively reduce the magnitude and frequency of constraint violations compared to the baseline. As the initial safety margin increases to 10% and 25%, the number of violations is further and substantially reduced, showcasing the framework's ability to maintain safety even when initialized in or very near to a compromised state."}, {"review_id": "V8vLIB8DCU", "reviewer": "Reviewer_SjPT", "summary": "This paper introduces _Constrained Diffusers_, a framework that allows to enforce non-convex inequality constraints during the diffusion process. For enforcing such constraints, the authors propose three methods inspired by the constrained optimization literature: (1) projected diffusion sampling, (2) a primal-dual method, and (3) an Augmented Lagrangian Method (ALM). Practically, the constraints a formulated based on Discrete Control Barrier Functions which allows to enforce safety constraints for planning and control tasks. The method is evaluated on various tasks in simulation: Maze2D, locomotion (Hopper and Swimmer), and ball running. As baselines, and unconstrained (i.e., unsafe) diffusion model, SafeDiffuser, and Conditional Diffuser are considered. The results show that that some of the proposed techniques, such as the projected diffusion sampling, exhibit a good trade-off between task performance, limiting unsafe actions, and computational efficiency.\n\nOne important preface for this review: the manuscript that was available to the reviewer did not contain the appendix. Therefore, the reviewer was not able to fully assess all technical details and experimental results. The review is based on the main manuscript only.", "questions": "- What are the limitations of the proposed approach(es)?\n- The authors do not discuss how the Diffuser models are trained. Are they trained from scratch or are you adopting pre-trained models? If the former, how are the demonstrations provided in the given environments (e.g., Maze2D, Hopper, Swimmer, PybulletBallRunning) If the latter, which pre-trained models are used?\n- How can enforcing such constraints during the diffusion process be (\"inuitively\") understood? Can you show a visualization that shows diffusion of the trajectories as done by the vanilla diffusion model and how such trajectories are diffused differently when the constraints are enforced? Please aim to do so for all three constrained optimization methods that are proposed in this paper and also, preferably, for the baselines (SafeDiffuser and Conditional Diffuser).\n- The SafeDiffuser baseline is only (fully) evaluated on the Maze2D task. Why is this the case? The reviewer does not understand the commeent in line 238 of page 8 that states \"SafeDiffuser methods applies only to the planning stage so we do not compare their metrics in the implementation stage.\" Why is this the case? The reviewer would expect that the SafeDiffuser method can be applied to all tasks in a similar way as the proposed methods. Also, why is the SafeDiffuser not evaluated on the PybulletBallRunning task? The reviewer would expect that the SafeDiffuser can be applied to this task as well.\nMost of these questions relate to the clarity and presentation of the paper and if the authors addresses these questions in the rebuttal and the revised version of the paper, the reviewer would be happy to increase the score.\n- How are the Discrete Control Barrier Functions $h(x)$ transformed into the diffusion constraints $g(\\cdot)$. Is this just a simple reshuffling of terms in the inequality equation? Or is there more to it? This seems like a crucial detail that is ommited in the paper.\n- How is $x_t$/$x_0$ defined? Does it contain the entire trajectory? If yes, over which horizon? In Algorithm 1, the authors also use the variables $x_0^0$ and $x_0^1$ but they are not defined. How do they related to $x_0$? Also, practically speaking, how is the constrained diffusion policy used during inference? Does re-planning occur at every time step (i.e., the policy predicts an entire trajectory but only the first action is executed and then the policy is re-evaluated at the next time step)? Or does the policy predict a single action at every time step? The reviewer would like to see a more detailed description of how the constrained diffusion policy is used during inference.\n- Contribution 2 (lines 53-56 of page 2): The reviewer questions why contribution 2 is a contribution. What exactly is the contribution here? Is it to use Control Barrier Functions in the context/as constraints of diffusion models? If so, this is not a new contribution as there has been prios work on this (e.g., SafeDiffuser). To the reviewer, it just seems that the authors use CBFs as a particular choice for generating the constraints $g(\\cdot)$, which seems like a reasonable choice but not a contribution in itself. The reviewer suggests that the authors clarify this point in the paper.", "limitations": "The authors do not discuss the limitations of their approach in the main text, although they state that the limitations are discussed in the appendix to which the reviewer did not have access. In any case, the reviewer suggest that the authors should include a concise discussion of the limitations in the main text.", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 4, "originality": 3, "strengths_and_weaknesses": "## Strengths\n\n- The paper's contribution seems to be novel and valuable for the community and takes a step towards integrating safety constraints into state-of-the-art diffusion models.\n- The paper includes a comprehensive benchmarking between various methods of enforcing constraints and a comparison to existing baselines, such as SafeDiffuser and Conditional Diffuser.\n\n## Weaknesses\n\n- The paper's presentation and clarity could be improved. The reviewer found it to be somewhat difficult to follow how all the pieces and components touched in this paper fit together. Furthermore, illustrations of how the different constrained optimization methods modulate the vanilla difffusion process are missing and would be helpful. The reviewer suggest that the authors rewrite the paper to improve clarity and presentation. At least the section that describes the overall idea and approach of the paper should be relatively easy to follow (also in terms of notation) and should not require the reader to have a deep understanding of all the concepts that are touched in this paper.\n- The paper's discussion of the related work is not sufficient and appears vague and hand-wavy. Specifically, the reviewer is referring here to lines 26-33 of the introduction. The reviewer excepts a clear discussion about the limitations of the existing methods in this area (e.g., SafeDiffuser, Conditional Diffuser) and how the proposed approach overcomes these limitations.\n- The paper does not include real-world experiments, which seems acceptable though given the focus and contributions of the paper.\n\n### Detailed Comments on Minor Issues\n\n- Page 3, line 81: \"... by learning the noise to denoise...\" Is this a typo?\n- Equation (4): From this point, you use $z$ all of the sudden without the subscript $t$ (i.e., instead of $z_t$) without redefining it. Please clarify.\n- Maybe Figure 2 should be Figure 1? The current Figure 2 seems suitable to communicate the overall idea of the method and should be the first figure in the paper.\n- Tables 1-3: Please cite the baselines in the tables.\n- Table 1: why is the \"Time/s\" result for \"Projected\" in \"maze2d-umaze\" marked in bold? There are other methods that are equally fast or even slightly faster that are not marked in bold.\n- Figure 4: Please use the same order for the methods in the legend as in the tables. Also, I am not able to visually distinguish the \"Projected\" method (in purple) from the other methods. Please improve the presentation of the figure.", "was_revised": true, "final_justification": "The authors have been very responsive during this interactive discussion period, and their comprehensive replies helped answer the questions and address the concerns raised by the reviewers. Furthermore, the authors have added additional results and ablation studies to better support the claims made in the paper. The reviewer greatly appreciates the authors for their work and communication during this discussion period. Finally, the reviewer also greatly values the timely topic of this paper and the contributions made that allow for a new approach for integrating safety constraints into (robot) diffusion policies.\n\nTherefore, the reviewer recommends this paper for acceptance and adjusts their score to a \"5: Accept\".\n\nHowever, as the discussion period with all reviewers has shown, the \"devil lies in the details\" and many of these details, contributions, etc., were not clear in the initially submitted manuscript. Therefore, the reviewer strongly recommends that the authors carefully revise their manuscript and ensure that these elements, questions, and contributions become **much** clearer in the final paper.", "rebuttal": "We thank the reviewer for the detailed comments and valuable feedback. We appreciate your recognition of the novelty and significance of our work. We would like to clarify that the appendix is included in the supplementary materials, packaged with our code as a single ZIP file. If there are any remaining access issues, we are happy to provide the appendix text during the discussion phase.\n\n**W1: Improve the presentation and clarification**\n\n**Response:** We thank the reviewer for their constructive feedback. In the revision, we will reorganize the introduction and methods to present a clear overview and refine the notation. We plan to put the vanilla diffusion process before the constrained optimization methods to clearly show the connections.\n\n**W2: Discussion on the limitations of the existing method**\n\n**Response:** We will explain the limits of existing methods to motivate our approach in the revised paper. Conditional Diffusers work well for qualitative constraints like “grab the purple box,” but have trouble with strict safety rules like avoiding collisions. Their soft conditioning can’t always enforce these rules exactly, causing violations. SafeDiffuser uses CBF to enforce hard safety constraints but needs to solve a slow optimization problem at every step, which hurts real-time performance. Also, SafeDiffuser changes states during diffusion but not actions, causing a mismatch that may break safety during online execution.\n\n**W3: Does not include real-world experiments**\n\n**Response:** We thank the reviewer for their comment and understanding of our paper’s scope. This work focuses on establishing the Constrained Diffusers framework and validating its efficiency in some standard environments. We will extend to this in the future.\n\n**W4: Detailed Comments on Minor Issues**\n\n**Response:** 1. We revised it to \"...by learning the noise via neural networks.\" 2. $z_t \\sim \\mathcal{N}(0, I)$ is standard Gaussian noise. 3. The reviewer is correct that Figure 2 shows the overall framework, and we will rearrange the order. 4. We will cite the baselines in the tables. 5. We marked the \"Time/s\" result for \"Primal Dual\" in \"maze2d-umaze\" rather than \"Projected\". 6. We will mark it in order, and make each line clearer.\n\n**Q1: Limitations of the proposed approaches**\n\n**Response:** We summarize the limitations into theoretical and practical ones. On the theoretical end, our methods rely on assumptions including inaccurate score function estimation. On the practical end, we made an assumption that we have access to constraints, and lack robustness analysis. For detailed analysis, please refer to Section A in the Appendix from Supplementary materials.\n\n**Q2: How the Diffuser models are trained**\n\n**Response:** All diffuser models in our experiments were trained from scratch using expert demonstration data. For Maze2D, we used Maze2D-umaze-v1 and Maze2D-large-v1 from D4RL; for MuJoCo locomotion tasks, we used hopper-medium-expert-v2 from D4RL and swimmer-medium-expert-v2 from Minari; for pybullet ball running tasks, we used SafetyBallRun-v0 from DSRL.\n\n**Q3: How to understand diffusion process when enforcing such constraints?**\n\n**Response:** Since figures cannot be included in this rebuttal, we provide a brief explanation using the umaze environment as an example. Detailed figures will be added in the revised paper.\n- Vanilla Diffusion: The trajectory is recovered from Gaussian noise through stepwise denoising over the entire trajectory.\n- Conditional Diffusion: Each denoising step is guided by the gradient of a classifier. Early steps resemble vanilla diffusion, while later steps steer entire trajectories away from obstacles, producing safer paths.\n- Safe Diffuser and Projected: If a point enters a constraint-violating region during denoising, that step is adjusted to move or project to the point directly to the safe boundary, ensuring all points remain within or on the constraint boundary at every step.\n- PD: Similar to conditional diffusion, early denoising is close to vanilla diffusion. Near the end, only points violating constraints are gradually guided out, while safe points evolve like vanilla diffusion, minimizing deviation from expert data.\n- ALM: Uses a quadratic penalty term to gradually guide violating points out during late denoising, enabling smoother corrections and stronger constraint satisfaction.\n\n**Q4: Fully evaluate SafeDiffuser on all tasks**\n\n**Response:** Thank you for this observation. he problem comes from a mismatch between states and actions in the original SafeDiffuser when moving from planning to online execution. SafeDiffuser uses CBF during reverse diffusion to create a safe state trajectory in planning. However, the actions used in execution are not based on this planned safe state. The model is trained on both states and actions, but during diffusion, only the states are guided, and actions are sampled directly without adjustment. This leads to a mismatch where the executed actions may not follow the planned safe states. Therefore, the original method is mainly suitable for planning, and online execution results were not reported. To compare fairly, we ran additional experiments combining SafeDiffuser with our IDM on all tasks. The results show SafeDiffuser works well in planning but performs less well online. We will include them in the revised paper.\n\n|Algorithm|Env|Reward|PlanningViolations|Impl.Violations|ViolationRates(%)|Time/s|\n|-|-|-|-|-|-|-|\n|SafeDiffuser(IDM)|Hopper|3514±46|0±0|0.28±0.06|0.27±0.05|0.9307|\n||Swimmer|60.4±6.1|0±0|0.65±0.21|0.97±0.25|0.9301|\n||SafetyBallRunning|820.8±29.8|--|1.13±1.08|21.9±12.8|2.6e-2|\n\n**Q5: How are the DCBF transformed into the diffusion constraints**\n\n**Response:** Thank you for the feedback. You are correct that unlike a static state constraint, the DCBF constraint at each state$x^\\\\tau$ depends on its neighboring state $x^{\\\\tau+1}$. This coupling means that the gradient guidance at each trajectory point varies according to the states of adjacent points. In our three methods, the implementation differs as follows: for the Projected Method, the projection step solves a constrained optimization problem where the feasible set is defined by all coupled DCBF inequalities simultaneously enforced along the entire trajectory. For the Primal-Dual Methods, the update rule should be written as follows:\n\n$$\n{x_{t-1}^\\\\tau} = {x_{t}^\\\\tau} + \\frac{\\beta_t}{2}\\\\left({\\\\nabla _{x_t^\\\\tau}}\\\\log p(x_t^\\\\tau)- (\\\\lambda_t^{\\\\tau-1})^T{\\\\nabla _{x_t^\\\\tau}} h(x_t^\\\\tau)+(\\\\lambda_t^{\\\\tau})^T(1-\\\\alpha){\\nabla _{x_t^\\\\tau}} h(x_t^\\\\tau)\\right) + \\\\sqrt \\\\beta_t  {{z}_t},\n$$\n\n$$\n\\\\bf{\\\\lambda}_{t-1}^\\\\tau = \\\\left[\\\\bf{\\\\lambda}_t^\\\\tau + {\\\\eta_{\\\\bf{\\\\lambda}}}\\\\mathbb{E}_{x \\\\sim q}[h(x_t^{\\\\tau+1})-(1-\\\\alpha)h(x_t^\\\\tau)]\\\\right]_+.\n$$\n\nFor ALM, the update rule should be written as follows:\n\n$$\n{x_{t-1}^\\\\tau} = {x_{t}^\\\\tau} + \\\\frac{\\\\beta_t}{2}\\\\left[\\\\nabla_{x_t^\\\\tau}\\log p(x_t^\\\\tau) - (\\\\lambda_{t}^{\\\\tau-1} + \\\\rho_t\\\\left(\\\\mathbb{E}_{x_t \\\\sim q}[h(x_t^{\\\\tau})-(1-\\\\alpha)h(x_t^{\\\\tau-1})] + s_{t}^{\\\\tau-1}\\\\right) \\\\\n-\\\\lambda_{t}^{\\\\tau}(1-\\\\alpha) - \\\\rho_t(1-\\\\alpha)\\\\left(\\\\mathbb{E}_{x_t \\\\sim q}[h(x_t^{\\\\tau+1})-(1-\\\\alpha)h(x_t^\\\\tau)] + s_t^\\\\tau\\\\right))^T\\\\nabla_{x_t} g(x_t)\\\\right] + \\\\sqrt{\\\\beta_t}{z_t},\n$$\n\n$$\ns_t^\\\\tau = \\\\left[-\\\\mathbb{E}_{x_t \\\\sim q}[h(x_t^{\\\\tau+1})-(1-\\\\alpha)h(x_t^\\\\tau)] - \\\\lambda_t^\\\\tau / \\\\rho_t\\\\right]_+,\n$$\n\n$$\n\\\\lambda_{t-1}^\\\\tau = \\\\lambda_{t}^{\\tau + \\\\rho_t\\\\left(\\\\mathbb{E}_{x_t \\\\sim q}[h(x_t^{\\\\tau+1})-(1-\\\\alpha)h(x_t^\\\\tau)] + s_t^\\\\tau \\\\right).\n$$\nWe will add this in the revised paper.\n\n**Q6: Clarification on notations and description on how the constrained diffusion is used during inference**\n\n**Response:** We first clarify that our paper involves two time horizons: the diffusion process horizon denoted by $t$ and $T$, and the physical environment horizon denoted by $\\\\tau$ and $\\\\mathcal{T}$.\n- $x_0$ represents the entire clean trajectory over the planning horizon $\\\\mathcal{T}$ at diffusion timestep 0.\n- $x_t$ denotes the noisy version of this trajectory at diffusion step $t$.\n- The notation $x_0^\\\\tau$ refers to the $\\\\tau$-th state in $x_0$, where $x_0^0$ is the current agent state, and $x_0^1$ is the next planned state. \nDuring inference, our method proceeds as follows:\n1. The agent observes its current state, which becomes $x_0^0$. \n2. A full reverse diffusion process is run from noise to generate $x_0$. The constrained sampling method ensures safety state constraints are satisfied. \n3. The IDM computes the control $u^\\tau$ for the safe state transition $x_0^0 \\\\to x_0^1$, which is executed in the environment.\n4. The remaining trajectory is discarded. After the environment updates to the next state, the process repeats from Step 1. \nThus, the policy predicts a full safe trajectory at each time step but executes only the first action.\n\n**Q7: Clarification on Contribution 2**\n\n**Response:** We will rephrase it to \"We incorporate the DCBF to ensure that pairs of consecutive states are safe and dynamically feasible, allowing the IDM to find valid actions during online execution.\" To clarify, our method leverages the iterative diffusion process to enforce DCBF constraints efficiently, avoiding the heavy computation of traditional QP-based CBF methods. Compared to static constraints, DCBF ensures forward invariance, making the trajectory dynamically feasible and more reliable during online execution. Unlike SafeDiffuser, which solves a costly quadratic program at each diffusion step, we focus on safety between consecutive states in the planned trajectory, guaranteeing dynamic feasibility. Instead of solving QPs, we guide the reverse sampling using gradients of the DCBF, gradually pushing noisy trajectories toward clean, feasible ones. Therefore, we believe that our approach provides an efficient and practical way to generate safe, dynamically feasible trajectories for online execution."}]

Author rebuttal:

Meta-review: This paper introduces Constrained Diffusers, a novel framework for incorporating safety constraints into pretrained diffusion models used for planning and control. The key innovation is the development of three constrained sampling methods, which guide the reverse diffusion process to produce constraint-satisfying trajectories without retraining or modifying the model architecture. Additionally, the authors propose using discrete control barrier functions to ensure dynamic feasibility and safety during online execution. The framework is evaluated on standard and high-dimensional simulated tasks, showing improved safety and competitive task performance compared to baselines like SafeDiffuser and Conditional Diffuser.

The paper’s strengths lie in its timely and impactful contributions at the intersection of diffusion models and safety-critical control. It provides a modular, efficient alternative to retraining-heavy or optimization-intensive methods, and the three proposed constrained sampling methods exhibit clear trade-offs between safety and computational efficiency. The paper demonstrates broad applicability, including to high-dimensional tasks, and offers insightful comparisons to prior work. The rebuttal added new empirical studies (e.g., worst-case analysis, robustness to IDM errors, and high-dimensional scenarios) that significantly strengthened the paper.

The main weaknesses were related to clarity, presentation of theoretical concepts, and the need for more explicit comparisons to related work (especially SafeDiffuser). Some reviewers also noted that the original manuscript lacked a clear discussion of limitations and constraints on generalizability. These concerns were effectively addressed during the rebuttal, with the authors providing detailed clarifications, new results, and plans to revise the manuscript significantly for clarity and completeness.

In conclusion, this paper presents a novel, practical, and well-validated contribution to safe planning with diffusion models. While not perfectly polished in its initial form, the authors' responsiveness and the strength of the core ideas warrant acceptance at NeurIPS. I encourage the author to carefully revise their paper based on reviewers' comments.
Decision: Accept (poster)