Global Safe Sequential Learning via Efficient Knowledge Transfer
Authors: Cen-You Li
Olaf Dünnbier
Marc Toussaint
Barbara Rakitsch
Christoph Zimmer
Venue: Accepted by TMLR ()

Abstract: Sequential learning methods, such as active learning and Bayesian optimization, aim to select the most informative data for task learning. In many applications, however, data selection is constrained by unknown safety conditions, motivating the development of safe learning approaches. A promising line of safe learning methods uses Gaussian processes to model safety conditions, restricting data selection to areas with high safety confidence. However, these methods are limited to local exploration around an initial seed dataset, as safety confidence centers around observed data points. As a consequence, task exploration is slowed down and safe regions disconnected from the initial seed dataset remain unexplored. In this paper, we propose safe transfer sequential learning to accelerate task learning and to expand the explorable safe region. By leveraging abundant offline data from a related source task, our approach guides exploration in the target task more effectively. We also provide a theoretical analysis to explain why single-task method cannot cope with disconnected regions. Finally, we introduce a computationally efficient approximation of our method that reduces runtime through pre-computations. Our experiments demonstrate that this approach, compared to state-of-the-art methods, learns tasks with lower data consumption and enhances global exploration across multiple disjoint safe regions, while maintaining comparable computational efficiency.

Published in Transactions on Machine Learning Research (1/2025)
Global Safe Sequential Learning via Efficient Knowledge Transfer
Cen-You Li
cen-jon.lifcamppusuuu.ee www.rriiuuu....rr.inn...m
Technicol University of Berlin, Germany Bosch Center for Artificial Intelligence, Germany
Olaf Duennbier
Mlffddeenmbier@de hww.:/bbwwwwddbbb.b.....o.ooo.c. bosch. com
Robert Bosch GmbHH, Cermany
Marc Toussaint
touseaint@taa-erllis
Technical University of Berlin, Germany
Barbara Rakitsch'
burbara.rukitschhr
bosch. bow.shhhhh.debebb..cccco
Bosch Center for Artificial Intellgence, Germany
Christoph Zimmer"
christoph. bosch.
Bosch Center for Artificial Intelligence, Germany
Reviewed on OpenReview: https: // openreview. net/ forum? id= VtD2ggmm3
Abstract
Sequential learning methods, such active learning and Bayesian optimization, aim to select the most informative data for task learning. In many applications, however, data selection is constrained by unknown safety conditions, motivating the development of safe learning approaches. A promising line of safe learning methods uses Gaussian processes to model safety conditions, restricting data selection to areas with high safety confidence. However, these methods are limited to local exploration around an initial seed dataset, as safety confidence centers around observed data points. As consequence, task exploration slowed down and safe regions disconnected from the initial seed dataset remain unexplored. In this paper, propose safe transfer sequential learning to accelerate task learning and to expand the explorable safe region. By leveraging abundant offline data from related source lask, our approach guides exploration in the target task more effectively. We also provide a theoretical analysis to explain why single-task method cannot cope with disconnected regions. Finally, we introduce computationally efficient approximation of our method that reduces runtime through pro-computations. Our experiments demonstrate that this approach, compared to stale-of-the-arl methods, learns tasks with lower data consumption and enhances global exploration across multiple disjoint safe regions, while maintaining comparable computational efficiency.
1 Introduction
Despite the great success of machine learning, acquiring data remains significant challenge. One prominent approach to consider experimental design (Lindley, 1956; Chaloner & Verdinelli, 1995; Brochu al., 2010). In particular, active learning (AL) (Krause et al., 2008; Kumar & Gupta, 2020) and Bayesian optimization (BO) (Brochu et al., 2010; Snoek et al., 2012) resort to a sequential data selection process in which the most informative data points are incrementally added to the dataset. The methods begin with small dataset, iteratively compute an acquisition function to prioritize data points for querying, select new data based
"Equa contribution

---

Published in Transactions on Machine Learning Research (1/2025)
Our transfer safe sequential learning iteration D
Iteration 5
Iteration 16
Faster exploration
Disjoint safe region explored
Conventional safe sequential learning Iteration
Iteration 5
iteration 16
initial ditta queried data safe area
Figure 1: Illustration: Safe sequential learning with transfer (lop) and conventional (bottom) learning. The light yellow data points represent source data. The main benefit of transfer learning is to accelerate exploration and identify larger and potentially disjoint safe regions by leveraging the source data.
on this information, receive observations from the oracle, and update the belief. This process repeated until the learning goal is achieved, until the acquisition budget is exhausted. These learning algorithms often utilize Gaussian processes (GPs, Rasmussen & Williams (2006) as surrogate models for the acquisition computation (Krause et al., 2008; Brochu et al., 2010).
In many applications, such as spinal cord stimulation (Harkema et al., 2011) and robotic learning (Berkenkamp el al., 2016; Baumaun el al., 2021), data acquisition can introduce safety risks due to unknown salely constraints in the input space. For instance, tuning a robot controller requires testing various controller parameters; however, certain parameter settings may lead unsafe behaviors, such as a drone flying high speed toward human-at an issue only observed after executing the controller (Berkenkamp highlights the need for safe learning approach that selects data points being safe and maximally informative within safety limits. One effective approach to safe learning is to model safety constraints using additional GPs (Sui et al., 2015; Schreiter et al., 2015; Zimmer et al., 2018; Sui et al., 2018; Turchetta et al., 2019; Berkenkamp et al., 2020; Sergeyev et al., 2020; Baumann et al., 2021; Li et al., 2022). These algorithms begin with a small set safe observations, and define safe set restrict exploration to regions with high safety confidence. As learning progresses, this safe set expands, allowing the explorable area to grow over time. Safe learning approaches have also been explored in related fields, such as Markov Decision Processes (Turchetta et al., 2019) and reinforcement learning (García et al., 2015).
al., 2016). This scenario
While safe learning methods have demonstrated significant impact, several challenges remain. First, the GP hyperparameters must be specified before exploration begins (Sui et al., 2015; Berkenkamp et al., 2016; 2020) or fitted using an initially small dataset (Schreiter et al., 2015; Zimmer et al., 2018; Li et al., 2022). addition, safe learning algorithms often suffer from local exploration: GP models are typically smooth, with uncertainty increasing beyond the boundaries of the reachable safe set. This results in slow convergence, and disconnected safe regions often classified as unsafe and remain unexplored. We provide detailed analysis and visual illustration of this issue in Section 4. In practice, local exploration complicates the deployment of safe learning algorithms, as domain experts must supply safe data from multiple distinct safe regions.
Our contribution: Safe learning generally begins with prior knowledge (Schreiter et al., 2015; Sui et al., 2015; Berkenkamp et al., 2020). We assume that correlated experiments have already been performed, and their results are readily available. This assumption enables transfer learning, offering two key benefits (see also Figure 1): (1) Exploration and expansion of safe regions significantly accelerated,, and (2)
2

---

Published in Transactions on Machine Learning Research (1/2025)
disconnected safe regions can be explored allowing to discover larger safe regions. Both advantages made possible by guidance from the source task. We empirically demonstrate both of the benefits and provide a theoretical analysis showing that conventional single-task approaches cannot identify unconnected safe regions. Real-world applications of this approach are ubiquitons, inchuding simulation-to-realiyy transfer (Marco et al., 2017), serial production, and multi-fidelity modeling (Li et al., 2020).
Transfer learning can be implemented by jointly modeling the source and target tasks as multi-output GPs (Journel & Huijbregts, 1976; Álvarez et al., 2012). However, GPs are notorious for their cubic time complexity due to the inversion of Gram matrices (Section 3.1). Consequently, large volumes of source data significantly increase computational time, which is often bottleneck in real-world experiments. To address this, we modularize the multi-oulput GPs, allowing source-related components to be precomputed and fixed, which reduces the computational complexity while retaining the benefits of transfer learning.
In summary, we 1) introduce the idea of safe transfer sequential learning, 2) derive that conventional singlo-task approaches cannot discover disjoint safe regions, 3) provide modularized approach to multi-oulput GPs that alleviates the computational burden of incorporating the source data, and 4) demonstrate the empirical efficacy on safe AL problems.
Related work: Safe learning is considered in many applications including AL, BO, Markov Decision Processes (Turchetta et al., 2019) and reinforcement learning (García et. al., 2015). In this paper, we focus on GP learning problems, as GPs are considered the gold-standard when it comes to calibrated uncertainties which is particularly important for safe learning under uncertainty. Previous works (Gelbart et al., 2014; Hernandez- Lobato et al., 2015; Hernández-Lobate et al., 2016) investigated constrained learning with GPs by incorporating constraints directly into the acquisition function (e.g., discounting the acquisition score by the probability of constraint violation). However, these approaches do not exclude unsafe data from the search pool, and generally address sesssafft---riiiiie applications. A safe set concept was introduced for safe BO (Sui et al., 2015) and safe AL (Schreiter et al., 2015), and later extended to BO with multiple safety constraints (Berkenkamp et al., 2020), to AL for time scries modeling (Zimmer et al., 2018), and to AL for multi-oulput problems (Li et al., 2022). For safe BO, Sui et al. (2018) proposed a two-stage approach, separating safe set exploration and BO. However, all of these methods suffer from local exploration (Section 4). Some recent methods address disjoint safe regions. For example, Sergeyev et al. (2020) considered regions separated by small gaps where the constraint functions briefly fall below, but remain near, the safety threshold. Baumann et al. (2021) proposed a global safe BO method for dynamical systems, assuming that unsafe regions can be approached slowly enough such that an intervention mechanism exists to stop the system in time. Despite these advances, none of these approaches leverages safe transfer learning, which can allow for global exploration by utilizing prior knowledge from source tasks for a wide range of scenarios.
Transfer learning and multitask learning have gained increasing attention. In particular, multi-output GP methods have been developed for multitask BO (Swersky et al., 2013; Poloczek et al., 2017), sim-to-real transfer for BO (Marco et al., 2017), and multitask AL (Zhang et al., 2016). However, GPs face cubic time complexity with respect to the number of observations, challenge that grows with multiple outputs. In Tighineanu et al. (2022), the authors assume specific structure of the multi-output kernel, which allows to factorize the computation with an ensembling technique. This eases the computational burden for transfer sequential learning. In our paper, we propose a modularized safe transfer learning that avoids the cubic complexity.
Paper structure: The remaining of this paper is structured as follows. We provide the setup and problem statement in Section 2, background on GPs and safe AL in Section 3. Section 4 discusses theoretical perspective of safe learning and demonstrate that safe learning approaches based on standard GPs suffer from local exploration. Scction elaborates our safe transfer learning approach and our modular computation scheme. Section 6 is the experimental study. Finally, we conclude our paper in Section 7.
3

---

Published in Transactions on Machine Learning Research (1/2025)
Table 1: Key Notation
Symbols
Mcaning
Nint
number of initial target data points number of target data points added by AL number of total target points
N Nquery
N Nmit, .. Ninit + Nquery
Nsouree
number of source data points
DN = PTI:N,9I:NG 21:N}
dataset of the target task dataset of the source task
Nonury
(2
N:Noouee Vo, Nanuree a NNNourn
= (=
safety variables of the target task safety variables of the source task
2g = (2)
f(x)
+ tcs
model of the target observation model of the target safety observation 2² model of the source observation ye model of the source safety observation x!
2 = o ( + Ex'
y. f.( ( +
2 2 (z) + +
[ ~ GP (0, ky)
single-output GP prior over largel main function J single-output GP prior over target safety function qu multi-output GP prior over main functions fa and f multi-output GP prior over safety functions of and q²
9¹ GP kpp)
f ~ GP (0, kf)
q GP (0,
2 Safe Transfer Active Learning Setup
Transfer Learning aims to transfer knowledge from previous, source, systems to a new, target, system. Usually, there exist lot of data from one or more source systems and only few or no data from the target system. Safe Transfer Active Learning will exploit the knowledge from the source systems' data and allows for safe and active data collection the target system. Throughout this paper, we inspect regression problems.
Target and Safety- - Notation: Each D-dimensional input x E & C TRD has a corresponding regression output y E R and safety values jointly expressed as z = (=',..,,"') ) E IR,", J is the number of safety variables. and an input æ is safe if the corresponding safety values 2 2 T₁
There are thresholds T, E F. 1, J, J, for all j = 1,..,,J. J. It is assumed that the underlying functions of y, v,21, ,.,,," 2 are all unknown.
Source and Safety- Notation: Similarly, there exist output and safety values of one or more source tasks, again from unknown underlying functions. The source output value is denoted by ya E R and source safety values by 2, = (z!...., E R', s is the index of source task(s). The source tasks are defined on the same domain X. The source and target tasks may have different numbers of constraint variables, but we can add trivial constraints (e.g. 1 12- -oo) to any of the tasks in order to have the same number J. Furthermore, the source data may or may not be measured with the same safety constraints as the target task. For example, in comulatioonto-relliit transfer (Marco et al., 2017), the source dataset can be obtained unconstrained.
Datascts Notation: A datasct over the target task is denoted by DN = (aIN, Z1:N), } EiaN (at,,.., NN C X, VI.N = (yI,..,,y/ } C R safety observations 21.N == {z, = (2), ...; " S R and is the number of observed data. In this paper, N is not fixed, as we may actively add new labeled data. We denote the source data by Di = (Ix,,1 1:N 1: 2. } C X x R R is the index of source task and Nsource is the number of all source data points. In our main paper, we consider only one source task for simplicity, while Appendix D.2 provides formulation on more source tasks. Please also see Table 1 for a summary of our notation.
Safe Active Learning Procedure: The goal of safe AL is to collect data actively and safely on the target system, such that the final dataset helps to model the regression output y on the safe region of input space X, i.e. subset of X corresponding to = > Ti,..., 2 ' T).
4

---

Published in Transactions on Machine Learning Research (1/2025)
Concretely speaking, we are given small amount of data the target task, i.c. DN where the initial size N = -init is small. The initial data are typically given by a domain expert and are safe, i.e. for DD D {II:Nma Mi:N #1:Nma J. Vn =
2n = (Zu::.,, 2 satisfy the safety constraints 2, Ti..... 2 TT.
At each N, one seeks the next point Is E Epoot S X to be evaluated. Xpool S the search pool which can be the entire space X' or a predefined subspace of X, depending on the applications. The evaluation is budget consuming and safety critical, and it will return noisy y. and noisy safety values 2.. Ideally, we need to make sure that 2, = (z.....,,;) 2." respect the safety constraints 2 2 T for all j = l..... J and that ye is informative for the modeling of target y. As the safety outputs are unknown when æ, is selected, guarantecing safcty is challenging. Safe learning methods resort to allowing queries that are safe only with high probability (Sui et al., 2015; 2018; Zimmer et al., 2018; Li et al., 2022).
Afterward, the labeled point added to DN (observed dataset becomes DN+1), and we proceed to the next iterations. N is initially Mit and grows to Ninit + Nquuer- Nquery the number of the learning iterations, i.e. the number of data points actively added.
Safe Transfer Active Learning Aim: In particular, this paper aims to build a new safe transfer AL, a safe AI. algorithm with multi-output GPs, so that we leverage the information of the source data Dauue to explore a larger safe area. Our algorithm aims to
(i) collect as few (small Nquery) data possible for building an accurate regression model of y (in the safe part of the input domain X),
(ii) collect the data in safe way and hereby explore the safe region including its boundaries,
(iii) in particular explore larger safe areas than benchmarks in faster way.
3 Background: Gaussian Processes of Single- Task, Safe Active Learning
In this section, we introduce Gaussian Processes (GPs) and state-of-the-art safe Active Learning (safe AL.. GPs are the workhorse of safe AL in which they are routinely applied to select safe and informative data points (Schreiter et al., 2015; Zimmer et al., 2018; Li et al., 2022).
3.1 Gaussian Processes (GPs)
Suppose we aim to model the output y and the safety observations 21 ...,. 2d with GPs. Here, we introduce the modeling scheme and the underlying assumptions. The first assumption is that the data represent functional values blurred with i..d. Gaussian noises.
Assumption 3.1 (Data: targel lask). Assume y = f(ar) + ey, where ef ~ N (0.03). for our target observations. We further assume that 2و = o² (xx) + Eqi; where Ep ~ ~N (0.0%) and j I,..., J indexes the safety constraints. All of the noise variances (07, o?.....,.o?! oop are positive.
We then place a GP assumption on each of the underlying functions f. "....'''' A GP is a stochastic process defined by a mcan and a kernel function (Rasmussen Williams, 2006; Kanagawa et al., 2018; Schoclkopf & Smola, 2002). In this work, we set the mean to zero justifies this assumption. The kernel function, X' X' - R, specifies the covariance of function values at different input points. Without prior knowledge of the data, we make the standard assumption that the governing kernels are stationary. The GP assumption is then formulated as the following.
common practice, as normalized data typically
Assumption 3.2 (Model: single-task). For each function, 9 E {S. :..,, 9²), we assume that g ~~0696000 GP(0,kg) with stationary kernel with bounded variance, kz x') == k (x x¹) 1.
Bounding the kernels by one provides advantages in theoretical analysis (Srinivas al., 2012) and is not restrictive since the data is usually normalized to unit variance.
5

---

Published in Transactions on Machine Learning Research (1/2025)
Assumption 3.1 and Assumption 3.2 provide the predictive distribution of the functions f.q' ....'' We write down the distribution for the function at test point V.,:
p [( N (H.,((
(1)
where
(x,,( = (0 (K, + +071) -1 VI:N.
(2)
(x.)) - x.) (XIIN v.)" (Ky + +z (FLIN,
We the nolation ky (MrINN v..) (2) v. ,..),..,hs( (2E, x.)) RRNx1 to denote the kernel vector between the training points #1:N and the test point I.. The kernel matrix K RNN contains the covariances between the training points E1.N with [Ky] mm., = k (am; 2a), m, 72 = N.
Typically, ky parameterized and can be jointly fitted with the noise variance 03. Common fitting techniques involve computing the marginal likelihood, N (ILN 0, K + o9T). where the the runtime complexity is O (N*), dominated by the inversion of the Gram matrix (K, + o71 o
The predictive distributions of the safety functions q'..... d² can be obtained by replacing f with g'..... q" and the outputs V1.N with =/.N.j= = J.... in Equations (1) and (2). Similarly, the log-likeliibee likelihood can be maximized for each q² by jointly learning kn and o in the same manner, j I....,J. "'
Remark 3.3. In our paper, all safety measurements z z',.. are modeled independently. If the variables are not independent, our analysis and arguments still apply, as the dependent constraints can be grouped, and the problem reduces back to the independent case.
3.2 Safe Active Learning (Safe AL)
In this section, introduce state-of-the-arl safe AL. The stale-of-the-art safe AL cannot exploit knowledge in form of source data. Although source data is not considered in this section, we will still write target task to make the distinction between the two tasks clear.
Safe AL (Schreiter et al., 2015; Zimmer et al., 2018; Li et al., 2022) aims to select data actively and safely to learn about target task. At a given number of available target data N, the goal is to select x. E &Poot S X, that gives us safe 2. (=,,..,,,? and informative y, (informative in the context of modeling).
The key of safe AL is the safety and data selection criteria. Commonly, these criteria employ GPs due to the well calibrated predictive uncortainty (Schreiter et al., 2015; Zimmer et al., 2018; Li et al., 2022). It is worth highlighting a closely related field, safe Bayesian optimization (BO) (Sui et al., 2015; 2018; Berkenkamp et al., 2020), which follows a similar procedure except that the goal is to search for an optimum y. subject to safety constraints 2 > Ti. Ti...., 2 TT.
Safety Condition: The safety variables modeled by GP functions qt, "'."""''' (Section 3.1), and the core is to compare the safety confidence bounds (Equation (2)) with the thresholds Ti,.... Ty R. At each
Algorithm Safe AL
Require: Assumption 3.1, Assumption 3.2, D Apoots 8 or o, Nquery, thresholds Tı,.... ....,.]
1: for N = Nimit,.., Ninit + Nquery do
2: Fit GPs TI,,,.., UJ with DN
SN - - E &poollPpi (x))) B1/2 0 Jg (x) 2 T (Equations (2) and (3))
æ. argmax a(x), a(x:) E (ge ....))))))))))))))))))))))))))))
Hg [x]DN)]
Query to get evaluations y, and
6: DN+1 t- Dx U (I., yo, 2,), Xpool f- Xpoot {x.}
7: end for
8: Return D N trained models f, f.q.,..,9.)

---

Published in Transactions on Machine Learning Research (1/2025)
iteration N, we can compute the safety probability p (gr (1)) = N (Mo.NNE)), (g.(()))) for each safety constraint j = I,..... J. Sui al. (2015) defines the safe set SN S Xpool as
SN = -z-1 E ( 3112 oo (x()) 2 T;};
(3)
where E RR is a parameter for probabilistic tolerance control. This definition is equivalent to Vo E 2 (1 (1-a)² when a = $(3122 (a E [0, where & is the standard Gaussian cumulative distribution function (CDF) (Schreiter et al., 2015; Zimmer et al., 2018; Li et al., 2022). Note that 0.5 corresponds to g¹/2 0 (assume this exists) which is usually not considered because safe learning aims for high safety confidence while > 0.5 indicates safety confidence of at most 50% per constraint so at most a random guess.
Sx.P (g' 2 (') [ T>)
Information Criterion: Safe AL queries new point by mapping safe candidate inputs to acquisition
scores:
x= arggaa (x).
(4)
where a(-) is an acquisition function. Notice here that a(-) and Sy both depend on the observed dataset DN- In AL problems, a prominent acquisition function is the predictive entropy (Schreiter et al., 2015; Zimmer et al., 2018; et al., 2022): a(x) = H [mr[N]] = 1/2 log (xreo)),(((a)) where oi..v is defined Equation (2). To accelerate the exploration of the safety functions, Berkenkamp et al. (2020) incorporate the information of the safety functions by using a(x=)= = maxgelf.a...... .....""> HH [x] Our acquisition function is built upon this and is written in Algorithm 1.
Please note again the close connection to BO: it is possible to exchange the acquisition function by the SafeOpt criteria if one wants to address safe BO problems (Sui et al., 2015; Berkenkamp et al., 2020; Rothfuss et al., 2022)).
Constrained Acquisition Optimization: Solving Equation (4) is challenging, In the literature (Schreiter et al., 2015; Li et al., 2022: Sui et al., 2013; Berkenkamp et al., 2020), this is solved on a discrete pool with finite elements, i.e. Npool = |Xpoall < co. One would compute the GP posteriors on the entire pool Xpoot to determine the safe set, then optimize the acquisition scores over the safe set. In our paper, we inherit this finite discrete pool setting.
Time Complexity: The complexity comprises O (Na) for GP training and O NN) for GP inference, assuming the Gram matrices, (K,+07 + + Yg (t ...,."..,,,, I'}, are already computed during the train- ing (Equation (2)). Importantly, GP inference is only performed once per query, whereas GP training (or more specifically, its most computationally expensive step, the matrix inversion) is repeated multiple times during parameter learning. As a consequence, the size of the discretized pool Npool can be much larger than the training dataset N, e.g. Xpoot can include up to tens or even hundreds of thousands of samples.
The whole learning process is summarized in Algorithm 1. In the next section, we provide theoretical analysis to demonstrate the presence of local exploration in safe learning approaches.
4 Safe Learning Solely on Target Task: Local Exploration
Before we introduce our safe transfer AL approach in the next Section 5, we analyze shortcoming of the standard safe AL (Algorithm 1). We quantify the upper bound for an explorable safe region, and prove that safe AL is limited to local exploration within the given bound. Note, that the analysis will not involve the acquisition function, and therefore the result applies not only to safe AL but also to GP based safe BO settings with safe set as in Equation (3).
Given observations DN. we would like to know, until how far into the input space the safety confidence is sufficiently high.
7

---

Published in Transactions on Machine Learning Research (1/2025)
Correlation weakened with increasing distance: The conventional safe AL (Algorithm 1) builds models based on standard GP assumption (Assumption 3.1, Assumption 3.2), and then the explorable region is obtained by quantifying the safety confidence, conditioned on observed data Dn (Equation (3)). The safety confidence is calculated from the GP prodictive distributions (Equation (2)), and it thus depends on the kernel to correlate input points of various locations. Commonly used stationary kernels measure the distance between a pair of points, while the actual output values do not matter (for two points æ, x E X, || 2'Il determines the covariance). These kernels have the property that closer points have higher kernel values, indicating stronger correlation, while distant points result in small kernel values. We first formulate this property as the following.
Definition 4.1. We call a kernel h a kernel with corvelation weakened by distance if ls X X -+ R fulfills the following property: VS > 0, 3r > 0 s.t. || x'll 2 r + k(x, x²) S 8 under L2 norm.
This definition will later help us quantify the upper bound of an explorable region. We provide expressions of popular stationary kernels (RBF kernel and Matérn kernels), as well as their relations between input distance r and covariance d in the Appendix B.
Low correlation leading to small safety probability: With Definition 4.1, we can now derive a theorem measuring the explorable region. The main idea is: when an unlabeled point æ, is far away from the observed inputs, the value of 8 can become very small (i.e. small covariance measured by the kernel). Thus, for each J, the model weakly correlates (x(x)) to the observations. As a result, the predictive mean is close to zero (GP prior) and the predictive uncertainty is large, both of which imply that the method has small safety confidence," at least if Vij = J,..., J, o² 2 Tý is not a trivial condition, e.g. a trivial condition would be if a function q¹ has values majorly distributed in [-1, 1] but thresholded at T₃ =22.
Theorem 4.2 (Local exploration of singlo-output GPs). We are given x1.N C For any safety constraint indezed by j = J,.,,, let zi.N- = (zi,.., be the observed noisy safety values and let ([.,),.., xx)1 S VN. The safely value 2 = q² (x)) + egp satisfies the GP assumplions (Assumption 3.1, Assumplion 3.2): d² GP(O, kep) kig (..-) Egi N o0.o%)). The kernel hig is kernel with correlation weakened
by distance (Definition 4.1). Denote ni h = max (..)) Then Va E (0, / Ra /aaeee/////// /,N,, Fr > 0 s.t.
dx. X that fulfill ean ||,, xxll r, the probability thresholded on a constant T₃ is bounded by N6/0", -T,
(gg (x.) 2 TEM + s + (7 ( (VNN6/N,N,
4 is the CDF of standard Gaussian.
To prove this theorem, we need Equation (2) to compute the safety likelihood, and then we use the eigenvalues of the kernel Gram matrix together with Definition 4.1 to derive the final bound (see Appendix C for the detailed proof).
Our theorem provides the maximum safety probability of a point as function of its distance to the observed data in X. The safe set tolerance parameter B (Equation (3)) can be used to compute the covariance bound 5. For example, when J = 1 and /1/2 2, which means p(g(x) 2 T) > (2) is safe (Equation (3)), we < (2) (j omitted when J = 1). Such 8 exists in all situation
NT
choose a such that +b -
of our interest, as we will soon discuss. Given a ó, we can then determine a corresponding radius r (see o.g. Appendix B). Interpreting r as the radius around the observed data, the safety confidence outside this region always remains low. Since safety confidence decides the explorable regions (Equations (3) and (4)), this theorem measures an upper bound of explorable safe area. The upper bound is given for one safety constraint, and we can see from Equation (3) that the final bound of safety confidence is the product of the & term over different j. In other words, the more safety constraints, the smaller the explorable regions may be, which is intuitive.
AA small safety confidence indicates 7i = 1,,,,, J. p (m))
(mx)) 2 Ty) ManN FI.N) not high enough.
8

---

Published in Transactions on Machine Learning Research (1/2025)
Notice that (((=),..., VN I,,,.) is not very restrictive because unit-variance dataset has [[ ..., xx)Il || N. Note further that ô E 0, Kogntt /VN) implies kaoate (VNo/ag)) )2, which means the bound @
No -T, is always valid.
Mectte (vNb/o
This theorem indicates that a standard GP with commonly used kernels explores only neighboring regions of the initial T1 The theorem is independent of the acquisition functions, and thus the local exploration problems present in all safe learning methods based on standard GPs.
Existence of ó for common safe learning situations: We would like to illustrate an example of using our theorem to compute an explorable bound. Before that, will make statement relating the safety level & to the quantity 5 used in Theorem 4.2. This shows that ō and, therefore, local exploration is present in all but some (at least) uncommon scenarios, which are in fact out of interest for the sake of safe exploration. Corollary 4.3 (Existence of 6). We are given the assumptions in Theorem 4.2. For each j I,,... J, /VN) s.t.
if either (1) T3 2 0,3 > or (2) T3 < 0,3 IT.L then 38 E (0,
N6102, ① W (VN6)o,)){²
$(B112).
This corollary can be proved by inspecting the boundary of each constant (detailed in Appendix C).
The key insight is that, a 8 in Theorem 4.2, which bounds the safety likelihood, always exists for common selection of safety level B1/2 There are two scenarios considered in Corollary 4.3. The first scenario, T₁ 2 0, g1/2 > is common because 31/2 0 is always desired for safe exploration and stricter safety thresholds Tı 2 .... T2 may also occur. In the second scenario, the thresholds are softer, i.c. one or more of the thresholds Ti...., TJ are smaller than zero. It turns out that 81/2 > |Ty1/ becatee J = -...., J is
desired as well for safe learning. Consider [Ty]/ V 2 at > 0 for Joraje [I, which is the scenario not fulfilling the condition. We focus normalized variable 2,, where the underlying function is modeled by GP 9² ~ GP(O, k.)) When this model extrapolates in regions where data are absent, the inference is highly based on the prior o² (z) NO0 ky R.cate). The safe set considers p(g (z) 2 TT) 2 ((31/2 as safety condition on the j-th constraint, but the prior indicates 4 Q(-T3/V K 2 42212) which becomes a trivial condition /T)l////aat when [T,1/V Moaate 3 O. In other words, any input has a safe prior unless the data disagree. This is
scenario that not of interest for safe learning.
Therefore, for all common selection of safety level 31/2, Corollary 4.3 implies that can find 6 and apply Theorem 4.2 to quantify the upper bound of explorable safe set, which shows the presence of local exploration.
Illustrating the theoretical result: In the following, we plug exact numbers into Theorem 4.2 for an illustration.
Example 4.4. We consider a one-dimensional toy dataset visualized in Figure 2. Assume N 10, of = 0.01 and constraint T = 0. We omit safety constraint index j, since J = in this case. In this example, the generated data have || S v10. ag/vN roughly 0.0316. We train an unit-variance (ksonte max kg(-.-) 1, theorem requires d < 0.0316) Matérn-5/2 kernel on this example, resulting in learned lengthscale of around 0.1256. The Matérn-5/2 kernel is kernel with correlation weakened by distance (Definition 4.1). In particular, 4.485 0.1256 0.563316 + 8 < 0.002 (Appendix B), noticing that 5 = 0.002 + Φb -6/05-T ~ (2). Consider g1/² 2, then it is safe only when the safety Vi-(VN6Jo,)'
likelihood is above (2). We can thus know from Theorem 4.2 that safe regions that are 0.563316 further from the observed ones are always identified as unsafe and is not explorable. In Figure 2, the two safe regions are more than 0.7 distant from each other, indicating that the right safe region is never explored by conventional safe learning methods.
9

---

Published in Transactions on Machine Learning Research (1/2025)
True safety constraint
Unfound safe region
Data, after exploration
0.56,
Initial safe region Initial data
Surrogate model"
Figure 2: A safety function (shown in black) with safe regions above threshold zero. Left graphics: Based the initial data within one of the safe regions, GP surrogate is trained. The blue line represents the mean prediction, while the blue shaded area indicates the uncertainty (e.g., confidence interval) around the mean. The green area indicates the learned safe area. Right graphics: After exploration, more points are sampled within the first safe region. However, the gap to the second safe region exceeds T, preventing the discovery of the second region, rendering the learned safe area almost unchanged. The true safety function used here is ((x) = sin (10x - 5x 10) + a²² 1 The observations are with noise drawn from (N0,, 0.12).
N6/02, -T,
(for each j= J). is the worst case obtained with very mild assumptions. Empirically, the explorable regions found by GP models are smaller (see Figure 2).
GP might even explore less in practice: Our probability bound &
V - (VNN6/
Transfer learning may overcome the local exploration: We extended the Example 4.4 to compare the standard GP model against a transfer task GP which will be introduced in the next Section 5. In Figure 3, a linear model of corregionalization is trained (a kind of multitask GP, Álvarez et al. (2012)). On the right. region, which is beyond the explorable bound of standard single-task GP, the transfer task GP incorporates the source data allowing to build high safety confidence. As result, the right region can be included into the explorable safe set (detailed in the following Section 5). We will also confirm in our experiments in Section 6 that guidance from source data enables our new safe transfer AL framework to explore beyond the immediate neighborhood of the target points #1:N-
To summarize, we see in this section that the safe set standard GPs (Equation (3)) limited to local region. In the next scction, we transfer knowledge from the source data expand the exploration beyond the seed dataset of the larget lask.
5 Safe Transfer Active Learning and Source Pre- Pre-Computation
In this section, formulate safe transfer AL method. We start from introducing transfer task GPs, then we leverage the source data and the transfer task GPs to adapt Algorithm 1. We state the resulting new constrained optimization problem for safe transfer AL. We then explain the complexity and consider a modular computation to facilitate the algorithm. We conclude the section by describing our kernel choices for the experiments.
5.1 Background: Transfer Task GPs
In the presence of a source task, one can model the source task and the target task jointly with multi-output GPs (Journel & Huijbregts, 1976; Álvarez et al., 2012; Tighincanu et al., 2022). The key idca to augment the input with task index variable, allowing the model to distinguish between tasks while sharing information across them. Leveraging source task in this way improves data efficiency the target system, relevant.
10

---

Published in Transactions on Machine Learning Research (1/2025)
r 2 0.563316
0.7
data
single e task GP
transfer task GP
The same safety constraint in Figure 2 with two safe regions. Left: the single-task GP cannot reach the right safe region the distance is greater than the radius r. Right: The multitask GP is able to exploit knowledge from the source data and build high safety confidence on the right region. The source data comes from the function (x) = sin (10x - 5x 10) + sin(2²) - and is shown in yellow.
Figure 3:
information can flow from the source to the target task. To proceod, it is necessary to first make a hypothesis on the source data, similar to Assumption 3.1 made for standard GPs.
Assumption 5.1 (Data: source task). The source data are modeled as y. fa( + gf()) + cdd where (..... .... } are unknown source main and safety functions, and indexes the souree task. We assume additive noise distributed as Cr. ~ (0. Cot N (0.02) with all noise variancos fot, oz. being positive.
Next, introduce task indices, with for the source task, and for the target task. These indices allow to describe the source and target functions jointly as multitask functions. The data are then concatenated with the task indices, and, based on Assumption 3.1 and Assumption 5.1, we define the multitask functions f.q f. .q.'....''''" q¹ : x (task indices) + R, where f(..) = fa(-) corresponds to the source main function, f(.,t) - f()) to the target main function, (,)))) = (-) to the source safety function and (-(-tt = g'()) to the target safety function. We use bold symbols indicate the multitask functions. Subscquently, we assign GP priors the multitask functions.
Assumption 5.2 (Model: multitask). For each multitask function g E {f q' ....."")) .'), we assume g GP (0, kg) with kernel kg (X' x (task index)) x (X (task index]) R.
Note that the structure of our new assumption resembles Assumption 3.2 of a standard GP. However, the GP is now defined jointly over the source and target task, allowing information to flow between them. Example kernels are provided in Scction 5.4. We proceed by presenting the predictive distribution for the main target task, leveraging source and target data. To incorporate task indices into the given input data, we hat notation: We denote the source input, 1.,,N:Noomee paired with the source index s, with Ct. I:Nouue := ((.,,,,))) s), E &. Analogously, the target training and test points, ÆI and æ., paired with the target index t, are represented as êi.N = {(x,, f) E æ1.N] and a. = (x.. The predictive distribution then given by:
p (m., 1) 1)I VI:N, F.s,I:Nource Us.1:Nwuured N (
11

---

Published in Transactions on Machine Learning Research (1/2025)
where the predictive mean (x,) and variance of (7,((x)) (x.) are given by
(f,N((x)) = 2/ (ye,l:Noouree
91:N
(x.)) = kig (#.: f.) 0i 05
The vector vy represents the covariances between the training points, aggregated over the source points @s,1:Nooucce and the target training points iI.N, and the target test point a.. It. defined as:
(K+1 (ka(( k (#I.N ..:)) (E R(
y (
(6)
The matrix Sy combines the kernel matrices and noise variances for both souree and target tasks, forming block structure:
K + +0 INsuree KJ f.J
K + oooIN) ) (E R R(Nooorrett (N
Gz
denotes the kernel matrix between the source data points, K ky (i., 1NNors @1.N) between source and target training points, and K₃ ky(#,,, (1:N) between target training points. For brevity, omitted the task index from the predictive terms (f,N(w.) and oj. (x.)) as this paper focuses exclusively on predictions for the target task. For brevity, we present formulas only for the main function; the safety functions are analogous.
where (:,, 1.
The time complexity of the predictive distribution is ((Nsource - N) due to the inversion of the Gram matrix S2y Similarly, the runtime for estimating the likelihood, and consequently for training the hyperpa- rameters, is also O ((Nsouree + 2))) While this higher time complexity introduces additional computational overhead, it is offset by the benefit of improved data efficiency through the joint modcling of source and target lasks. Our main paper considers one single source task, while Appendix D elaborate the GP formulation of multiple source tasks.
5.2 Safe AL with Transfer Task GPs
In comparison to the conventional safe AL (Algorithm 1), we employ multitask GPs to model the target task
jointly with the source data. As introduced in Section 5.1, the multitask functions g E (f g'. ....4')) q4) are assumed be GPs. At an unobserved point a E X, p (g(x, ()[Dx, Nagurce = (Hg.N o² g. (x)) (t is the target task index, Equation (5)). The safe and the acquisition function may then incorporate the source task information:
SN = -0--1t E MooillagiNNe - 31/2
og (p Tz},
a (x) =
Σ
Hg DN, Danurec
gelf.q .'..''.....
(8)
1
Σ
log (2Tr00g
2
gE(f.g' .....g'))
2. = argmax (x).
In contrast to the standard safe AL, a(-) and Sy here depend on the observed target data Dy and the source data Deource as they rely on q and f (multitask functions in bold symbols), which represent the multitask GPs based on source and target data.
The whole learning process is summarized Algorithm Its computational complexity dominated by litting the GPs (line 2). Common fitting techniques include Type II ML, Type II MAP and Bayesian treatment (Snoek et al., 2012; Riis et al., 2022) over kernel and noise parameters (Rasmussen & Williams, 2006). All of these approaches have in common that they require computing the marginal likelihoods,
N/ (
10.22) ((MhlMMomn))) VIEN
(Vo.I.Nuouren
((Shag and AV
10, 10,9qp
12

---

Published in Transactions on Machine Learning Research (1/2025)
for each safety constraint J. J. In this work, do not consider Bayesian treatments due to the high computational cost of Monte Carlo sampling. Obtaining 2 (and 9 = .) for the marginal likelihood takes O ((N ([uuree + N))) time, where Nouuree can be large in our set-up. Moreover, the process must be iterated for N Ninit, Nit + Nquery adding to the computational burden. Tn the next section, we demonstrate how the computational burden can be significantly reduced by pre-computing the source-specific terms necessary for the matrix inversion.
5.3 Source Pre- Crepuutpttaoion
In this section, we propose an ellicient algorithm to mitigate the computational burden of repeatedly calculating 277 and ?-1 in full. For clarity, we describe the approach for 277', the same principles apply to qr 27 for all j= J.......J
For GP models, the matrix inversion is routinely achieved by performing Cholesky decomposition L( which has cubic complexity. This decomposes U2 as S2 (()))))()))) where I( is a lower triangular matrix (Rasmussen & Williams, 2006). Once the decomposition is obtained, operations such as C( for any matrix C, can be efficiently computed by solving a lincar system with minor complexity. The Cholesky decomposition is well known for its numerically stability and computationally efficiency, making it a widely preferred approach for efficient. GP computations.
We propose to perform the Cholesky decomposition in two steps, as described below. The key idea is to precompute the source-specific terms of the Cholesky decomposition, which account for large amount of the computational costs. Importantly, our technique is general and can be applied to any multi-output kernel. Recall from Equation (7) that the covariance S2 has a block structure, in which the source block Ky. + of N has size N Naurre x Souuree that dominates the computation. The Cholesky decomposition can also be expressed as block structure,
L.. 0 - (Lrid
L((2))
where the source block L,, can be precomputed independently of the remaining covariances (Press et al., 1988). Once L,, is obtained, it is then used to compute the cross-term Lf..J and target block Ly that are both a function of the source block L,, (details in Appendix D.1). the source covariance, K,, + 77, I NNaurce: remains unchanged between different covariances Qy its precomputed Cholesky decomposition L,, can be reused, significantly reducing computational overhead.
Fixed source parameters for efficient training: To leverage the precomputed Cholesky decomposition Lf. during our safe transfer AL scheme, the parameters governing the source covariance, Ky, + of, I I must remain fixed throughout the algorithm.
To achieve this, we split the kernel parameters Oy into two groups, 0, = -0,,00), where 0,, include all parameters required for computing K,, and 0, contains the remaining parameters. We first train on the
Algorithm 2 Full safe transfer AL
Require: Assumption 3.1, Assumption 5.1, Assumption 5.2, D D , Doource Kpool, B or a, N Nquery, thresholds
Th,..,, TT
1: for N Ninit.... Ninit + Nquery - do
2: Fit. GPs f. F.qI.... "hy...00 Is with Dx, Doource
SN + -f/=1 E ApootlPgs (x()))xxx)))))))))))()) g112 ( 2 Tī} (Equation (8))
3:
E. argmax a(x) a(x)== (f
Hg [D= Dorce
Query æ. to get evaluations y. and
6: DN+1 t Dx U (x., yo, 2,), Xpool f- Xpoot {x.}
7: end for
8: Return Diint : trained models f, qu....
13

---

Published in Transactions on Machine Learning Research (1/2025)
source data Diuure alone, then fix f,, and of. Once these parameters are fixed, the Cholesky decomposition I,f, can be precomputed and reused across all subsequent iterations when acquiring the larget dataset 'x- During this phase, we can still update the parameters f and the target noise variance oj.
The learning procedure summarized in Algorithm time complexity reduces from (oNsouece + N) to Soree N) + (NNourre + (( We provide mathematical details in the Appendix D.1. Note that our approach offers a trade-off: it reduces parameter flexibility in exchange for computational efficiency. We will discuss the pros and cons of this approach, depending on the kernel choice, in more detail in the following section.
In each iteration (line of Algorithm 3), the
5.4 Kernel Selection
Multitask kernels are often defined as matrix of functions (Journel & Huijbregts, 1976; Álvarez et al., 2012), where each element maps X' x X - IR similar to a standard kernel. The task indices determine which element of the matrix is used. Specifically, for task indices i, E t), the kernel can be expressed as
(Kg ((..)).(..))) (Ng Ki
hg ((.s),(:.t)) Kg ((,t), (.t)) 1,2'
Kg (g((..))
where the dots are placeholders for input data from X. Here, each E q', ...,.".''''... g²) is multi-output GP correlating source and target lasks for the main and safety functions.
Linear model of coregionalization (LMC): A widely investigated multi-output framework is the linear model of coregionalization (LMC) which we also use in our experiments. In our setup, the kernel is defined
E (WWT
( 2)) 100k(..)). k((
kg((, (o((:,s,))) (s,tt) (, (8,1)))
where @ denote the Kronecker product. We assume two latent effects and each latent effect specified The paramcters Wi E 22x1, fig. > 0 model the task correlations
by the base kernel ka(::)) X' induced by the 1-th latent pattern encoded by k (Álvarez et al., 2012). Here, each g has its own kernel, but for brevity, omit g in the parameter subscripts. Furthermore, if k includes variance scaling term, e.g. Matérn kernels, it is fixed to 1 because the scale can be absorbed into WT, K2 and K.
This kernel design is tied to our experimental setup and facilitates the transfer of information from the source to the target task. However, when paired with Algorithm 3, training can become unstable, because the algorithm assumes that the kernel parameters can be cleanly scparated between source and task terms. In the case of the LMC, this separation is not straightforward: The latent components Wi encode shared task correlations, while K, and represent task-specifie effects. Training on source data alone provides insufficient.
Algorithm 3 Modularized safe transfer AL.
Require: Assumption 3.1, Assumption 5.1, Assumption 5.2, DD Num Doource Kpoot, B or a, Nquery, thresholds
Ti,..,,y
1: Fit GPs f........ qJ with Deouree
Neamen
2: Fix source specific parameters f 1 %
J.: σ d Vj = -,...,
3: Compute and fix Ly,; L.g Vj = = J (line 5, 6, below faster)
4: for N = Ninit ..., Ninit + +Nquery - do
Fit. GPs with DN and Deource
Nanure (free parameters 0g, as agt =j= 1,.,, J)
6: SN + +n-=1f E ApootlPgp xx()))))))))))))))))))))))) 31/2 Ti (x) 2 Tř} (Equation (8))
E. argmax a(x) a(x= = Lo
Hg [x (DN, D
8: Query to get evaluations y, and
DN+1 h Dx U (I., yo, ),), Xpool f- Xpoot {x.}
10: end for
11: Return Diins : trained models f, 9u....
14

---

Published in Transactions on Machine Learning Research (1/2025)
information to disentangle these shared and individual contributions, potentially leading to suboptimal solutions that destabilize the training process.
Hierarchical GP (HGP): In Poloczek et al. (2017); Marco et al. (2017); Tighineanu et al. (2022), the authors consider a hierarchical GP (HGP) framework, where the kernel defined as:
(ka(t.))
ko(:.-) ). (:..)) k.(:,)) + +ha(.)))
kg((, (s. (s.t))
with ks, kg X' x X' as base kernels. HGP is a variant of LMC, where the target task is modeled as the sum of the source kernel k; and the target-specific residual k, (Tighineamu et al., 2022). This formulation has the benefit that the fitting of terms k2 and & can be easily decoupled, making HGP particularly well suited for the use of Algorithm 3.
In Tighineanu et al. (2022), the authors derived an ensembling technique that also supports source pre- computation. While their approach is equivalent to our method when applied to HGP, our framework generalizes any multi-output kernel, provided that the fitting of the source and target parameters can be dccoupled. In contrast, the ensembling technique explicitly tailored HGP and does not generalize other kernel structures.
Kernel selection in our experiments: In our experiments, perform Algorithm 3 with HGP our main method, and Algorithm 2 with LMC and HGP as ablation methods. While our main method is more computationally efficient, LMC offers greater flexibility in model task correlations. Rumning HGP with Algorithm 2 and Algorithm 3 allows us to study the effect of sequential parameter learning against joint parameter learning, with the latter having an increased runtime. For both HGP and LMC, we construct the kernels using Matérn-5/2 kernels with lengthscale parameters. This choice is restrictive and can be replaced with other base kernels suited to specific applications.
Although we did not pair Algorithm 3 with LMC as discussed above, our modularized computation scheme can still provide benefits in closely related settings, e.g. (i) datasets with multiple sources or (ii) sequential learning frameworks where GPs are refitted only after a batch of query points has been acquired.
6 Experiments
In this section, we empirically evaluate our approach against state-of-tho-art competitors on a range of syuthetic and real-world dalasets. We first provide details on the experimental setup in Section 6.1. Then, we analyze whether our transfer learning scheme more data-efficient than conventional methods in Section 6.2, whether it facilitates the learning of disconnected safe regions in Section 6.3, and how the runtime of our modularized approach compares in Section 6.4.
Our code is available at httpp://githuue httpa/////oooooooaaeeeaoerrrrrer
6.1
Experimental Details
First, we describe comparison partners and the datasets we use in our experiments.
6.1.1 Comparison Partners
We compare five different methods: 1) EfTTranSHGP: Algorithm with multi-output HGP, 2) FullTran- sHGP: Algorithm 2 with multi-output HGP, 3) FulfTransLMC: Algorithm 2 with multi-output LMC, 4) Rothfuss2022: GP model meta learned with the source data by applying Rothfuss et al. (2022), and 5) SAL: the conventional Algorithm 1 with single-output GPs.
The first three methods are our proposed approaches, listed in order of increasing complexity. The HGP kernel is a variant of the LMC kernel. We test two variations of the HGP: one using our modularized implementation (Algorithm 3), with runtime complexity comparable the single-task approach, and another one using naive implementation (Algorithm 2) that has a similar runtime complexity as LMC. For
15

---

Published in Transactions on Machine Learning Research (1/2025)
GP1D, additional 4. threshold
tave
*206 1/2
022
0.00
GP2D, additional q. threshold
005
0.04
1952.00
Rot Aorthas 2002
beod inc S1L
0.00
100
60
00
Asration
64
qrf, thrmsholdo00
Efthanangg Rattanndlic
0:50
0.
0.00
0.00
00:0014
de/ation
Eeration
Hartmann3, q-f, threshold >
PA poetue tone stonio)
DihhraliGe
0.635
02-
0.000
Mo27
2022
Beaeline
0.23
200
PEngine, learn f (engine roughness), constraint (temperature), threshold c=1.0
0.04
Lomne pen
0.85
2022
0.8
0.60
s02e
06-
0.
100
GEngine, (emission), constraint q (temperature), threshold
13000 poo tursa porkent
affkarsHee FUlTFarSLMC
The prottes port
hultroromap
0.10
Pull fowwu 2012
Basctrie SAL
0.25
10-
1000
134
202
50
102
130
20C
50
300
120
200
beration
beration
Therat 611
Figure 4: Empirical performance across all six benchmark datasets: RMSE to assess model convergence, TP rate to measure the coverage of the safe space explored, and FP rate to evaluate the safety of each approach. Both TP and FP compute the rates to the area of Xpool- The ground truth safe area portion for cach datasct is indicated by a black line in the second column. Our approach generally shows improved convergence in terms of model performance and the extent of explored safe regions, while maintaining safety levels comparable to the bascline SAL. On GEngine, we additionally provide a zoomod-in RMSE figure (Figure 5).
the safety tolerance, we always fix 3 = 4, which corresponds = ((31/2) 0.02275 (Equations (3) and (8)), implying that each fitted GP safety model allows 2.275% unsafe tolerance. For the baseline
16

---

Published in Transactions on Machine Learning Research (1/2025)
Table 2: Dataset Summary: For each dataset, we list the imput dimension D, the size of the source dataset Nsources the size of the initial target dataset Nini:: the number of queries Nuuery decription, safety threshold and whether the disjoint safe regions can be tracked. Datasets are listed in order of increasing complexity. Each task has one safety variable.
Dataset
D
Nsouree
Mini
N Nquery
Description
Threshold
Disjoint regions
GP1D
1
100
10
50
Synthetic, f + q,
0 N
Tracked
GP2D
2
250
20
100
Syuthetic, I + Syuthetic, f = q. Synthetic, f q Semi-real-world, f
0
Tracked
Branin
2
100
20
100
2 0
Tracked
Hartmann3
3
100
20
100
2 0
Intractable
PEngine
2
500
20
100
S 1.0
Intractable
GEngine
13
500
20
200
Real-world, f # q 2 -1.5, S 0.5
Intractable
following Rothfuss et al. (2022), the GP model parameters are meta learned up-front using source data, and remain fixed throughout the experiments. While the authors of the original paper applied this approach to safe BO problems, we modify the acquisition function to entropy, transforming it into safe AL method. All methods use Matérn-5/2 kernels the base kernels. To be consistent with Rothfuss et al. (2022), we consider noisy variables when we compute the safe set (model 2 2 T3 instead of q² 2 T for all = 1, J). in our experiments. We claborate in Appendix E that our theoretical analysis of Section 4 extends to this case.
6.1.2 Datasets
We benchmark our methods on six datasets. An overview of the datasets is given in Table 2.
Synthetic Datasets: We first create two low-dimensional synthetic datasets, GP1D (D= 1) and GP2D (D = 2), generating multi-output GP samples following algorithm 1 of Kanagawa et al. (2018). For each dataset, we treat the first output as the source task and the second as the target task. Each dataset has a main function f and an additional safety function q. We generate 10 datasets and repeat each experiment five times for each method on every dataset. For the Branin dataset, we follow the settings from Rothfuss et al. (2022); Tighineanu each datasct. Unlike GP1D and GP2D, Branin uses the same function for both main and safety tasks. In these initial experiments, we simulate multiple datasets but retain only those in which the target lask has at least two disjoint safe regions, with each disjoint region also having a safe counterpart in the source dataset. This design aligns with our use of the Matérn-5/2 kernel, which measures similarity between data points based on proximity. Our fourth synthetic dataset is the Hartmann3 dataset (D = 3), created using the settings from Rothfuss et al. (2022); Tighineanu et al. (2022). We generate five datasets and repeat, experiments on each datasets five times. Here, the source and initial target datasets are sampled randomly, unlike the structured, disjoint safe regions in GP1D, GP2D, and Branin. All datasets are normalized, and the synthetic datasets are provided in Appendix F.2.
al. (2022) to produce five datasets and run five repetitions for each method
constraint thresholds are set to zero. Further details
Semi- Remi-Real-Te World Dataset (PEngine): The PEngine dataset consists of two datasets measured on the same engine prototype under varying conditions. The outputs temperature, roughness, HC, and NOx emissions are recorded. We perform separate AL experiments to learn roughness (Figure 4) and temperature (Appendix Figure 12), both constrained by a normalized temperature q, threshold on noisy observation E 1.0, resulting in a safe set covering approximately 52.93% of the input space. 2 The upper bound constraint is equivalent to - 2 11.0 described in our Section 2, being the negative noisy temperature. The raw datasets contain four input variables: two free variables and two contextual variables, with the contextual inputs recorded with noise. To fix the contextual inpuls at constant values, interpolate these noisy values using a multi-output GP simulator trained on the full datasets. This allows us to perform active learning experiments solely on the two-dimensional space of the free variables, ercating a semi-simulated environment. Further details are provided in Appendix F.2. Our GitHub repository provides a link to the dataset.
2 In general, use the notation frl....,'') represent safety constraints. However, since all datasets in our experiments involve only a single safety function, we simplify the notation to z.
17

---

Published in Transactions on Machine Learning Research (1/2025)
Real- World Dataset (GEngine): Our final benchmark is high-dimnnsional, real-world problem involving two datasets, each recorded by related but distinct engine (one the source and the other as the target task) from Li et al. (2022). The original dataset are split into training and test sets, and we conduct AL experiments on the training sets, while RMSE and safe set performance are evaluated on the target test set. These datasets are dynamic, and our model applies a history structure by concalenating relevant past points into the inputs, resulting an input dimension of 13. The recording include emissions and temperature, and we learn the normalized emission (J), subject to normalized temperature q, threshold on noisy value -15 S 2 S 0.5.3 The upper bound on temperature is crucial for safety, while the lower bound increases robustness against outliers. Overall, the safe region covers approximately 65% of the target dataset. For the source task, we sample the data under a different constraint of -2 S 2g S 0.5 to make the model more resistant to outliers. More details can be found in Appendix F.2. Our GitHub repository provides a link to the dataset.
6.2 Modeling Performance & Safety Coverage
In the following, we study the empirical performance of our algorithms to find out whether our methods can accelerate space exploration and model convergence while maintaining safety.
Metrics: We evaluate model convergence of the main function f using root mean square error (RMSE)
between the GP predictive mean and test y sampled from true safe regions. To measure the performance of our safety function q, we use the area of Sv, as this indicates the explorable coverage of the space. Specifically, we consider the area of Sy O Strue (true positive or TP arca, the larger the better) and Sy n (Xpool \ Strue) (false positive or FP area, the smaller the better). Here, Stree S Xpool denotes the set of true safe candidate inputs, which we can precompute as use fixed data pool. Strue takes noise-free variables except for GEngine where only noisy data are available. Area of Kpool, Strue are all measured by counting the number of points.
Results: We report results in Figure 4.
Results on GPID, GP2D, Branin: We begin by focusing on the GP1D, GP2D, and Branin datasets, which have been simulated to contain multiple disconnected safe regions. On these datasets, only methods capable of jumping between regions can achieve optimal performance. In Figure 4, we observe that our transfer learning approaches achieve lower RMSE and significantly greater safe set coverage than competing methods, while maintaining small false detection rate of safe arca. These results suggest that our methods can successfully identify and explore disconnected safe regions, while our competitor methods cannot. We will conduct an in-depth analysis of this aspect in the next section. The higher RMSE of our competing methods can be partially attributed to the evaluation approach: test points are sampled from the entire safe area, including regions that competing methods fail to explore. Additional safe query ratios, provided in Appendix Table 5, confirm that our methods maintain high levels of safety.
Results on Hartmann, PEngine: In the Hartmann and PEngine experiments, our transfer learning approaches demonstrate superior performance, achieving lower RMSEs and broader safe area coverage with fewer data points than competing methods (sce Figure 4). Since SAL eventually covers the entire safe area by the end of the iterations, we hypothesize that the target task do not contain clearly separated disjoint regions. Nonetheless, conventional SAL requires more queries to achieve the same performance, as they lack the efficiency of our approach.
Results GEngine: Our final dataset, GEngine, has a larger input space, resulting in more hyperparam- eters and making GP fitting more computationally expensive (sec also Table 4). Given that each individual query minimally affects the GP hyperparameters, we update them every 50 queries to enhance runtime efficiency and report results at the same interval. Overall, the HGP-based transfer learning approaches clearly outperform competitors, as they explore the safe set with significantly fewer target task queríes while achieving better or equal test error and false safe positive rates. Zooming into the RMSE results in Figure 5, find that the HGP approaches learns the main function as well the baseline SAL Training the LMC
18

---

Published in Transactions on Machine Learning Research (1/2025)
Table 3: Identified Disjoint Safe Regions: We count the number of safe regions explored by the queries. The total numbers of queries are listed in Table 2. Transfer learning discovers multiple disjoint safe regions while baselines stick to neighborhood of the initial region.
Methods
GP1D
GP2D
Branin
Hff
1.79 + 0.07
2.77 0.13
2 0
FulITransHGGP
1.78 = 0.07
0.14213
2
LC
1.78 = 0.08
2.68
2
Rothfuss2022
1.22 + 0.05
1.07
1+0
SAL
1
+
1
model, however, appears to be more challenging; only after the sccond training (itcration 100), the RMSE stabilizes and the number of false positives reduces. Initially, LMC seems to be overconfident regarding safety conditions, which we think can be attributed to overfitting caused by the larger number of hyperparameters due to the higher input dimension.
In the main experiments, Nsouree (the number of source data points) fixed for each dataset. In our Appendix G, we provide ablation studies on the Branin dataset, in which we vary the number of source data points and number of source tasks.
GEngine, zoom in
EITTransHGP
FullTransHGP
1.0
Rothfuss
RMSE off
Baseline SAL
0.8
Summary: Our approaches generally demonstrate improved convergence in terms of model performance and the extent of explored safe regions, while maintaining safety levels comparable to the baseline SAL. The benefits of our mothods are most pronounced when multiple unconnected sale regions exist, as our methods are the only one capable of finding them. Among the three variants of our approach, we observe that LMC struggles when the input space is high-dimensional and data is scarce, potentially due to the larger number of hyperparameters. In contrast, the HGPe- methods show consistently strong performance across all experiments.
iteration
Figure The RMSE zoom-in version of GEngine in Figure 4.
6.3 Disconnected Regions
Next, we examine in more detail hhe the increased safe coverage observed in the previous section can be attributed our transfer learning approaches effectively jumping between disconnected regions.
We analyse the number of disjoint regions for our synthetic problems with input dimension D or D 2 (GP1D, GP2D, Brainin). For these datasets, it is analytically and computationally possible to cluster the disconnected safe regions via connected component labeling (CCL) algorithms (He et al., 2017). Please see Appendix F.1 for further discussion of the CCL algorithm and its applicability. This allows us to track, in each experiment iteration, the specific safe region to which each observation belongs and count the number of disconnected regions (sce Appendix Figure 11). At the end of the AL algorithm, we report the number of explored safe regions in Table 3. We say a region is explored if at least one query is in the region. This is valid because the safe set expand from the at least one point. The results confirm the ability of our transfer learning approaches to explore disjoint safe regions, while the baseline methods cannot jump to disconnected regions. Notably, the Branin function is smooth and has two well-defined safe regions, while the GP data exhibit high stochasticity, leading to a range of small or large safe regions scatlered throughout the space. While limited exploration is expected for the single-task approach SAL, it is surprising that the meta-learning approach Rothfuss2022 also fails to reach disconnected regions. This could be due to having only single souree task, which is uncommon for meta-learning as typically involves multiple source tasks to differentiate between common and task-specific effects.
19

---

Published in Transactions on Machine Learning Research (1/2025)
Table 4: Training Time of f and q (in seconds) at the last AL training; We observe that runtime increases sequentially from SAL EffTransHGP, then Full'TranHHGP and finally FullTransLMC. Rothfuss2022 performs only an initial training upfront which is included in our runtime estimate, resulting in zero traing time.
Datasets
EffTransHGP
FullTrranSIMC FullTransHGG
Rothfuss2022
SAL
GP1D
8.947 0.198
9.171 0.133
26.56 + 0.628
0:0
6.881 + 0.083
GP2D
10.73 0.190
39.31 0.639
202.8 = 12.43
0.0
8.044 + 0.142
Branin
3.754 0.121
8.129 + 0.267
21.16 1.207
0.0
4.691 + 0.078
Hartmann3
3.662 = 0.089
9.092 = 0.467
34.43 = 1.664
0.0
4.073 0.083
PEngine
9.596 + 0.418
124.99 + 5.608
615.7 27.99
0.0
4.686 0.243
GEngine
18.525 + 2.508
503.11 + 63.94
4357.8 661.4
0.0
10.485 = 0.578
For the remaining datasets (Hartmann3, PEngine and GEngine), we cannot count the number of disconnected regions since the CCL algorithm cannot be applied. This due its limitations in dcaling with noisy measurements (PEngine, GEngine) and dimensions greater than D (Hartmann, GEngine).
Our findings demonstrate that our transfer learning approaches effectively identify and explore multiple disjoint safe regions when they are present, capability lacking in competing methods.
6.4 Runtime Analysis
Finally, we report training times in Table 4, measured as the time (in seconds) required to optimize the GP hyperparamters at the final iteration.
We observe that runtime increases scquentially from SAL < EffTranHHGP < FullTransHGP < LuC which a aligns with our theoretical findings in Section 5. While both, SAL and EfTransHHPP scale cubically with the number of target points N, EffTransHGP takes longer due to the increased number of hyperparameters to optimize. FullTransHHGP and FulfTransLMC, in contrast, scale cubically with the combined number of source and target data Nsouree + N, with FullTransLMC requiring additional runtime due to an even larger number of hyperparameters.
The flexibility of our transfer approaches is inversely proportional to the training time. However, in our experiments, we do not observe significant advantage of the FullTransLMCC approach over HGP, likely due to the increased hyperparameter count in MC, which can lead to overfitting issues. In summary, HGP proves to be the strongest approach, offering high efficiency without compromising on performance.
7 Conclusion
We propose a safe transfer sequential learning to facilitate real-world experiments. We demonstrate its pronounced acceleration of learning, evidenced by faster RMSE, reduction and a greater safe set coverage. Additionally, our modularized multi-output modeling 1) retains the potential for global GP safe learning and 2) alleviates the cubic complexity from the source data, significantly reducing the runtime.
Our modularized method in theory compatible with any multi-output kernel, in contrast. to the ensemble technique in Tighineanu et al. (2022) which is limited to a specific kernel structure. However, one limitation of source precomputation is that it requires to fix correct source relevant hyperparameters solely with source data. For example, HGP is well-suited due to its separable source-target structure while LMC, which learns joint patterns of tasks, may not correctly optimize with source data only.
Limitations:
While we only explored linear task correlations in this work, more sophisticated multi-output kernels, such as those in Álvarez al. (2019), or the use of more complex base kernels, could support richer multitask correlations. However, investigating these approaches beyond the scope of this paper (see, e.g., Bitzer et al. (2022) for kernel selection strategies).
20

---

Published in Transactions on Machine Learning Research (1/2025)
When correlation exists between the source and the target data, two outcomes are possible depending the kernel design: (i) if the multi-output kernel includes the standard single-task kernel as a special case, performance may revert to that of baseline methods; (ii) if the standard kernel is not included as special case, the signal may not be effectively modeled, resulting suboptimal performance.
Future work: In this paper, we focus on problems of hundreds or to thousands of data points (source and target data). Scaling further to tens thousands or millions of data points may require approximations, such as sparse GP models (Titsias, 2009; Hensman et al., 2015), which use limited set of inducing points to represent the original data. However, the optimal selection strategy for inducing points for sequential learning approaches is still an open research question (Moss al., 2023; Pescador-Barric instance, the safety model requires inducing points that effectively represent the safe set, while the inducing points of the acquisition model need to be updated after cach query (or batch of queries) to appropriately reflect changes in uncertainty.
al., 2024). For
Acknowledgements
This work supported by Bosch Center for Artificial Intelligence, which provided finacial support, computers and GPU clusters. The Bosch Group is carbon neutral, Administration, manufacturing and research activities do no longer leave a carbon footprint. This also includes GPU clusters on which the experiments have been performed.
References
Mauricio A. Álvarez, Lorenzo Rosasco, and Neil D. Lawrence, Kernels for vector-valued functions: a review. arXiu, 2012.
Mauricio A Álvarez, Wil Ward, and Cristian Guarnizo. Non-linear process convolutions for multi-oulput gaussian processes. International Conference on Arlificial Intelligence and Statistics, 2019.
Dominik Baumann, Alonso Marco, Matteo Turchetta, and Sebastian Trimpe. GoSafe: Globally Optimal Safe Robot Learning. IEEE International Conference on Robotics and Automation, 2021.
Felix Berkenkamp, Angela P. Schoellig, and Andreas Krause. Safe controller optimization for quadrotors with gaussian processes. International Conference on Roboties and Automation, 2016.
Felix Berkenkamp, Andreas Krause, and Angela P. Schoellig. Bayesian optimization with safety constraints: Safe and automatic parameter tuning in robotics. Machine Learning, 2020.
Matthias Bitzer, Mona Meister, and Christoph Zimmer. Structural kernel scarch via. bayesian optimization and symbolical optimal transport. Advances in Neural Information Processing Systems, 2022.
Eric Brochu, Vlad M. Cora, and Nando de Freitas. tutorial on bayesian optimization of expensive cost functions, with application to active user modeling and hierarchical reinforcement learning. arXiu, 2010.
Kathryn Chaloner and Isabella Verdinelli. Bayesian experimental design: A review. Statistical Science, 1995.
Javier García, Fern, and Fernández. A comprehensive survey safe reinforcement learning. Journal of Machine Learning Research, 2015.
Michael A. Gelbart, Jasper Snock, and Ryan P. Adams. Bayesian optimization with unknown constraints.
Conference on Uncerlainly in Artificial Intelligence, 2014.
Susan Harkema, Yury Gerasimenko, Jonathan Hodes, Joel Burdick, Claudia Angeli, Yangsheng Chen, Christie Ferreira, Andrea Willhite, Enrico Reje, Robert G Grossman, and V Reggic Edgerton. Effect of epidural stimulation of the lumbosacral spinal cord on voluntary movement, standing, and assisted stepping after motor complete paraplegia: case study. The Lancet, 2011.
21

---

Published in Transactions on Machine Learning Research (1/2025)
Lifeng He, Xiwei Ren, Qihang Gao, Xiao Zhao, Bin Yao, and Yuyan Chao. The comnected-componentt labeling problem: A review of state-of-the-art algorithms. Poltern Recognition, 2017.
James Hensman, Alexander Matthews, and Zoubin Ghahramani. Scalable Variational Gaussian Process Classification. International Conference on Artificial Intelligence and Statistics, 2015.
Jose Miguel Lleraandez-Lobato, Michael Gelbart, Matthew Hoffman, Ryan Adams, and Zoubin Ghahramani. Predictive entropy search for bayesian optimization with unknown constraints. International Conference on Machine Learning, 2015.
José Miguel Hernández-Tobato Michael A. Gelbart, Ryan P. Adams, Matthew W. Hoffman, and Zoubin Ghahramani, A general framework for constrained bayesian optimization using information-base based search. Journal of Machine Learning Research, 2016.
A. G. Journel and C. J. Huijbregts. Mining geostatisties. Academic Press London, 1976.
M. Kanagawa, P. Hennig, D. Sejdinovic, and B. K. Sriperumbudur. Gaussian processes and kernel methods:
A review on connections and equivalences. arXiv, 2018.
Andreas Krause, Ajit Singh, and Carlos Guestrin. Near-optimal sensor placements gaussian processes:
Theory, efficient algorithms and empirical studies. Journal of Machine Learning Research, 2008
Punit Kumar and Atul Gupta, Active learning query strategies for classification, regression, and clustering: A survey, Journal of Compuler Science and Technology, 2020.
Armin Lederer, Jonas Umlauft, and Sandra Hirche. Posterior variance analysis of gaussian processes with application to average learning curves. arXiv, 2019.
You-You Li, Barbara Rakitsch, and Christoph Zimmer. Safe active learning for multi-output gaussian processes. International Conference Artificial Intelligence and Statistics, 2022. 2022.
Shibo Li, Wei Xing, Robert Kirby, and Shandian Zhe. Multi-fidelity bayesian optimization via deep neural networks. Advances in Neural Information Processing Systems, 2020.
V. Lindley. On a Measure of the Information Provided by an Experiment. The Annals of Mathematical Statistics, 1956.
Alonso Marco, Felix Berkenkamp, Philipp Hennig, Angela P. Schoellig, Andreas Krause, Stefan Schaal, and Scbastian Trimpo. Virtual vs. real: Trading off simulations and physical experiments in reinforcement learning with bayesian optimization. IEEE International Conference on Robolics and Aulomation, 2017.
Henry Moss, Sebastian W. Ober, and Victor Picheny. Inducing point allocation for sparse gaussian processes in high- tigh-hhrooghput bayesian optimisation. International Conference on Artificial Intelligence and Statistics, 2023.
Guiomar Pescador- Barrios, Sarah Filippi, and Mark van der Wilk. "how big is big enough?" adjusting model size in continual gaussian processes. arXiv, 2024.
Matthias Poloczek, Jialei Wang, and Peter Frazier. Multi-information source optimization. Advances in Neural Information Processing Systems, 2017.
William H Press, William T Vetterling, Saul A Teukolsky, and Brian P Flannery. Numerical recipes. Combridge University Press, 1988.
CE. Rasmussen and CKI. Williams. Gaussian processes for machine learning, MIT Press, 2006.
Christoffer Riis, Francisco Antunes, Frederik Boe Hüttel, Carlos Lima Azevedo, and Francisco Cámara Percira. Bayesian active learning with fully bayesian gaussian processes. Advances in Neural Information Processing Systems, 2022.
22

---

Published in Transactions on Machine Learning Research (1/2025)
Jonas Rothfuss, Christopher Koenig, Alisa Rupenyan, and Andreas Krause. Meta-Learning Priors for Safe Bayesian Optimization. Conference on Robot Learning, 2022.
Bernhard Schoelkopf and Alexander J. Smola. Learning with kernels: Support vector machines, regularization, optimization, and beyond. MTT Press, 2002.
Jens Schreiter, Duy Nguyen-Thong, Mona Eberts, Bastian Bischoff, Heiner Markert, and Marc Toussaint. Safe exploration for active learning with gaussian processes, Machine Learning and Knowledge Discovery in Databases, 2015.
Yaroslav D. Sergeyev, Antonio Candelieri, Dmitri E. Kvasov, and Riccardo Perego. Safe global optimization of expensive noisy black-box functions in the d-Lipschitz framework. Soft Compuling, 2020.
B. W. Silverman. Spline smoothing: The equivalent variable kernel method. Annals of Statistics, 1984.
Jasper Snoek, Hugo Larochelle, and Ryan P Adams. Practical bayesian optimization of machine learning algorithms. Advances in Neural Informalion Processing Systems, 2012.
Niranjan Srinivas, Andreas Krause, Sham M. Kakade, and Matthias W. Seeger. Information-theoree regret bounds for gaussian process optimization in the bandit setting. IEEE Transactions on Information Theory, 2012.
Yanan Sui, Alkis Gotovos, Joel Burdick, and Andreas Krause. Safe exploration for optimization with gaussian processes. International Conference on Machine Learning, 2015.
Yanan Sui, Vincent Zhuang, Joel W. Burdick, and Yisong Yue. Stagewise Safe Bayesian Optimization with Gaussian Processes. International Conference Machine Learning, 80, 2018.
Kevin Swersky, Jasper Snock, and Ryan Adams. Multi-task bayesian optimization. Advances in Newral Information Processing Systems, 2013.
Petru Tighincanu, Kathrin Skubch, Paul Baireuther, Attila Reiss, Felix Berkenkamp, and Julia Vinogradska. Transfer learning with gaussian processes for bayesian optimization. International Conference on Artificial Intelligence and Statistics, 2022.
Michalis Titsias. Variational learning of inducing variables in sparse gaussian processes. International
Conference on Artificial Intelligence and Statistics, 2009.
Mattco Turchetta, Felix Berkenkamp, and Andreas Krause. Safe Exploration for Interactive Machine Learning. Advances in Neural Information Processing Systems, 2019.
Ychong Zhang, Trong Nghia Hoang, Kian Hsiang Low, and Mohan Kankanhalli. Ncar-optimal active lcarning of multi-output gaussian processes. AAAI Conference on Artificial Intelligence, 2016.
Christoph Zimmer, Mona Meister, and Duy Nguyen-Tuong, Safe active learning for time-series modeling with gaussian processes. Advances in Neural Information Processing Systems, 2018.
23

---

Published in Transactions on Machine Learning Research (1/2025)
A Appendix Overview
Appendix lists commonly used kernels and the r-ő relation needed for our theoretical analysis. Appendix C provides the proof of our main theorem. In Appendix D, we demonstrate the math of our source pre- computation technique well general transfer task GPs with more than one source tasks. Appendix E extends the safe set by considering observation noises in the predictive models. Appendix F contains the experiment details and Appendix G the ablation studies, additional plots and tables.
B Common Kernels and r-o Relation
Our main theorem use Definition 4.1, which is restated here, to measure the covariance with respect to the distance of data:
Definition 4.1. We call kernel k kernel with corvelation weakened by distance if k: X x X + R fulfills the following property: Ag > 0, 3r > 0 s.t. I æ'|l 2 k(x, x') < 8 under L2 norm.
Notice that this property is weaker than being strictly decreasing (see e.g. Lederer al. (2019)). In addition, it does not explicitly force stationarity, while not all stalionary kernels have this properly, e.g. cosine kernel k(x, x²) cos (I|= x' 22) does not follow this definition.
Here we want to find the exact for commonly used kernels, given a 8. The following kernels (denoted by :) are described their standard forms. In the experiments, we often add a lengthscale > 0 and variance kscale > O, i.e. Kparameterizedd (z, x²) = kacatek(x//1 x' x//1) where kacate and are trainable parameters. The lengthscale: can also be a vector, where each component scaling factor of the corresponding dimension of the data.
RBF kernel k(x, x¹) = cxp (-1Ia-x'l133) 2211
k 2 8 | x'|| 2 log
F.g. 5 0.3
|| 2'1
2 1.552
8 0.1
|ar x'|
2 2.146
8 < 0.002
| x'| 3.526
Matérn-1/2 kernel
k(x, x') = exp (-1|x - x' dlll): k(xxx²) 5 +
|
-x'l log
E.g. 8.3 + || =='1|| 1.204
8 0.1
| -x'll 2 2.303
0.002
| x'1 6.217
Matérn-3/2 kernel
k(x, x') = (1 (1+ v33 2 - æ'|l) exp (-V3llæe x²()):
E.g. 8 0.3 - || - 2 1.409
0.0.1 + | -- -x'l 2 2.246
< 0.002 = | ->'l 2 4.886
24

---

Published in Transactions on Machine Learning Research (1/2025)
Matérn-5/2 kernel
k(x, x²) = (1 + v5 [ a/| a 2²113)
exp (-v5lla: x'l)):
E.g. 8 < 0.3 || -='1| 2 1.457
8 < 0.1 + | x'| 2 2.214
& 0.002 = || x'1 2 4.485
C
GP Local Exploration Proof
In our main script, we provide a bound of the safety probability. In this section, we provide the proof of this theorem.
We first introduce some necessary theoretical properties in Appendix C.I, and then the properties to prove Theorem 4.2 and Corollary 4.3 in Appendix C.2.
C.1 Additional Lemmas
Definition C.1. Let k: X' X be a kernel, C X be any dataset finite number of elements, and let be any positive real number, denote A k(A, A) + 1²1.
Definition C.2. Given a kernel k X X + R, dataset A C X, and some positive real number o, then for æ E X, the k-, A-, and dependeent function h(z) ((A, >)" a A.A is called weight function (Silverman, 1984).
Proposition C.3. C MXM is a positive definite matriz and b E R M is vector. Amaz is the mazimum eigenvalue of C. We have ||Cb]l2 I Amaz
Proof of Proposition C.3.
Because C is positive definite (symmetric), we find orthonormal eigenvectors (e1,-.., eNS of C that form basis of R Let X be the cigenvalue corresponding to e; we have ); 0.
As fei..... em} is a basis, there exist b.....,b E R s.t. b Em b,e, Since {er} is orthonormal, | = Σ, 63. Then
|Cbb|2 = Σ 2, =
Σ b7
Amaz
Σ 63
Amaz b
Proposition C.4. AA C X, any kernel k, and any positive real number a, an eigenvalue À of A4, (Defi- nition C.1) must satisfy 2 o²
Proof of Proposition C.4-
Let K = k)A, We know that
K is positive semidefinite, so it has only non-negative eigenvalues, denote the minimal one by Axs and
2. o² is the only eigenvalue of TTI.
25

---

Published in Transactions on Machine Learning Research (1/2025)
Then Weyl's inequality immediately gives us the result: À 2 + 2
Corollary C.5. We are given Vz. X, A X, any kernel & with correlation weakened by distance (Defiri- tion 4.1), and any positive real number Let M = nembeer of elements of A, and let B E RM be vector. Then 45 > 0, 3r > 0 s.t. when m - x'1 2 r, we have
I. Ih(x.) Bl/ (see also Definition C.2),
xt.., k(A, ... A 2 k( v.) - M62/00² (see also Definition C.1).
Proof of Corollary C.5. Let K k(A, A).
Proposition C.4 implies that the cigenvalues of (K + o²1)
-1 are bounded by 22
In addition, Definition 4.1 gives us mingee A x'| 2 all components of row vector k(x,, A) are in
region [0, 60.
Apply Cauchy-Schwarz inequality (line 1) and Proposition C.3 (line 2), we obtain
[k(A, x.)² (k(A, o21) -21) - B s |k(A, x. )²
(K 021)
B
|A
B
x 11(6, ..., 6)
|B|
02
v M B
σ²
(K + 021)~ -1
is positive definite Hermititian matrix, so
1
k(A.,.)" (K+
(K 021) k(A, - |
x.1
03
1
< M68.
Then, immediately see that
1
(K+ - (K 0211) k(A, 2 k(2,, xx)
|K[A, x.2
> [(F,, 0² M82
Remark C.6. Φ is the cumulative density function (CDF) of standard Gaussian (00, 1). p(x - IT) +T)).
p(# < -T) ④ (TT) = p(x T).
C.2 Main Proof
The theorem is restated again.
Theorem 4.2 (Local exploration of single-output GPs). We are given F1.N C., For any safety constroint indered by = I,...,J, let 2i (zi,,.,, zxx) be the observed noisy safety values and let (1(=),..,, < VN. The safety value zi q² (x) + egt satisfies the GP assumptions (Assumption 3.1, Assumption 3.2): e' gP(O, ki)) high (..)) S 1, Egg -N (0.0g)) The kernel ligs a kernel with correlation weakened
by distance (Definition 4.1). Denote Weeate mar kyp (.))) Then 46 (0. Raoale Tei /VN), 0 s.t.
26

---

Published in Transactions on Machine Learning Research (1/2025)
Vz. X' that fulfill mine: ||,. - xzil 2 r, the probability thresholded on constant T₃ is bounded by o is the CDF of standard Gaussian.
(q (a,)) 2 TT,, = s $ ( (h..ate (VN61/,)))))
N -2;
Proof. From Equation (2) in the main script, we know that
q0 (..) FIIN Z.,N) N (a. (a. (e.1 .N (x.)) of (v
Mo (2L,N,, x.)² (Rip (101:,, m1:N) + og Tg )x)=²()) =2f.N
(2,)( = kg (2.,, -
(Kp( + o IN)
Rip (II x.).
We also know that (Remark C.6)
(T) (17.)
p (x.) T;) 21:N)
Tgg ,N (2)a)
Mg Mo' (x).)(
0 (I:.)
From Corollary C.5, we get (w). No + 11/0 TT (a)))
Augt (2, 12 -N This valid because we assume < V Recate Tgs / /VN. Then with || /N and the fact that 1 an increasing function, we immediately see the result
N8102, - T3
p (g'()))) k2)
21NN =NN) s $
Vileate (VN8/00g))
Then, we would like to prove the Corollary 4.3 which is restated here. Corollary 4.3 (Existence of 8). We are given the assumptions in Theorem 4.2. For each j = 1,....). J,
if either (1) T3 2 0,
0 (2) T3 0,3
1T then 38 E (0, v Keeate Gg) / /VN) s.t.
N8/0 o
Wonlee- (VN8)0 < (B312))
Proof. This can be proved by substituting the constants.
Condition (1) T, 0, 1/2 0:
N8/02, -T,
5 N8/02
V Wd seate (VN8/og:)2
V W (VN8/o,p)
limg- V
Noj02
guarantees 36 E (0, W D /VN) 8.1.
W
No/02
$ 1// for
R -VNN8/0
N8/0² T
Bt/2 > 0. Then because & is strictly increasing, the same 8 gives &b
5 $$31112)
(VN6/a
Condition T2 < 0/3
T We see here that lims-ot
Nb/0"/ -T3
-T,
< 31/2
Weate
(VN6/o,))
Vi
Therefore, there must exist 8 (0, VO.VK.. W H R /VN) s.1. (
N8/02 -T,
S (3(1122..
- (VN61o,,)
27

---

Published in Transactions on Machine Learning Research (1/2025)
D Multi-output GPs with Source Pre- Pre-Computation
D.1 Two-steps Cholesky Decomposition
Given multi-oulpui GP g GP hig,; 9 E , ,..,,,,),, where Kg an arbitrary kernel, the main computational challenge is to compute the inverse or Cholesky decomposition of
[gg, + o² Noource K 9019
K gogg Kg + 1
Ωg
Such computation has time complexity O ((NV + N)) We wish to avoid this computation repeatedly. As in our main script, ki parameterized and we write the parameters as 0g (0g, 0g), where kig ((, (: 8)) is independent of gg.
Here we propose to fix Kg. (0g. must be fixed) and og. and precompute the Cholesky decomposition of the source components, Lg. = L(Kg, + o² Noouee) then
Lg.
0
L (12g)
(I gg.
I. (K.)
(9)
K, = K, + o (I.g0 K )
T I. K go..
This is obtained from the definition of Cholesky decomposition, iee. Ωg L (22) ( ( and from the fact that Cholesky decomposition exists and is unique for any positive definite matrix.
The complexity of computing L (2t) thus becomes D(N + O (NNourc) + O(N3) instead of O ((Nsuurce + 2)) In particular, computing L Kgg.. is O(N2uree acquiring matrix product K, is O(Nouree and Cholesky decomposition L I(K,) is O(N3).
The learning procedure summarized in Algorithm 3 in the main script. We prepare safe learning experiment with Nuouree and initial DN; we fix 0,., I 1, to appropriate values, and we precompute Lf. Lgg.. During the experiment, the fitting and inference of GPs (for data acquisition) are achieved by incorporating Equation (9) in Equation (5) the main script (Section 5).
D.2 Transfer Task GPs beyond One Source Tasks
We extend Section 5.1 beyond one single source task. Let say we have total of P source tasks, and the source task index is = -1..., P. In our main paper, Deouree is the source data with only one task. Here, Deource = Dir S X x x X Dir, (I.,I:M,, Is.1:M,; Zx,I,M)) the dataset of source task indexed by s, M, is the mumber of data of task and Nsouree Σ. M. is still the number of data of all P source tasks jointly.
We now want to write down the predictive distributions for each E {ʃ, g., g³), Similar to Section 5.1, &,,1:M, = {(.,,..)) M, M C X x (task indices) denotes the input data with task index. The data can be plugged in how was in Section 5.1, and the prodictive distributions have only minor changes. We write f as an example below in Equation (10), while q' .... and & is the index of target task. We color the modification compared to single source task (Equation (5)).
....q' q are analogous. ã. t).,t), E X is again test point
28

---

Published in Transactions on Machine Learning Research (1/2025)
p (f), Msouree
= (ug,N(a)), oN (x.)).
11,1:M1
(),x(xx)= =
UP.1:MP
V1:N
07,x(10))) = ky (o. ). -1 0 1g.
k ( )..)
(10)
oz=
ky@0p1Mp 2n))
kgl
oi IM
0
U (K Nouucct
0
0 of IM
0
of
where [K NNouece (2 (2,=1,1:M, C. P.I:Mpps.... placed exactly in this order. The GP model f is governed by the multi- task kernel ky and noise parameters of, where o3, noise variance of source task s = I...,. The pre-computation will fix the part of all source tasks (still the top left Nsouree by Nsouree block of s2z).
ky((ul (dul)), and du is a joint expression of source and target data
Multitask Kernels: Few examples of actual GP models, ie. actual kernels, are described the following. The LMC, linear model of corregionalizatio,, can be taken simply by adding more dimension:
P+1 Σ
kg -,,())))))))===
WWW. +
0
0
& k((,)))
KP
0
where is a multitask function but does not matter to the expression here, each kj X' X' standard kernel such as a Matérn-5/2 kernel encoding the 1-th latent pattern, @ is a Kronecker product, and Wi E (P+1)x1 and "i....pp, > are task scale parameters (Alvarez et al., 2012). is a numbering index used only here.
The HGP be extended in two ways, models in Poloczek al. (2017) in Tighineanu et al. (2022). Here we take the model from Tighineanu el al. (2022):
Oixi (PP+1-))x
0 ((x(P+1-)) 1(+1-00(P+1-1) k((,)),
(o(((.))))))))) Σ
where xm and 1 mx are matrices of shape m by n with all elements being zero and one, respectively, m, n = O.,,,. P. ke(..)) is a standard kernel such as a Matérn-5/2 kernel, a numbering index.
E
Safe Set: Noise-free v.s. Noisy Variables
The safe set can be calculated on noise-free ,t,.., d or noisy variables 21 =',..,,'. The first is useful when the system's criticality depends on the noise- free value and is common the literature, e.g. Berkenkamp et al. (2020). The second useful when the criticality depends on the noisy value as e.g. this noisy value triggers an emergency stop. This second scenario of noisy safety values is considered in our main comparison partners work Rothfuss et al. (2022). Therefore, we consider noisy safety values in experiments.
29

---

Published in Transactions on Machine Learning Research (1/2025)
f.q
Figure 6: Example simulated GP data of D= 1, f is the function we want to learn (top), under an additional safety function q (constraint 2 0, bottom). The curves are true source (ycllow) and target (black) functions. The dots safe source data and pool of initial target ticket (this pool of target data more than those actually used in the experiments).
9_0+m0
5.35
0,53
0.20
0.900
0.5
-..0
-1.5
-7.304
-2.364
-2.0
-3,000
-3.000
05
6.36
6.636
0.0
2030
0,050
-0.5
-0.87
678
-.0
-5
-20
-3.000
-1.000
Figure 7: Example simulated GP data of D = 2, f is the function we want to learn (left), with an additional safety function q (middle), and the green true safe regions q 2 0 (right). The top is source task and the bottom target task. The dots are safe source data and a pool initial target ticket (this pool of target data are more than those actually used in the experiments).
The result of local exploration our thcoretical analysis are presented on noiso-free variables. This leads the stronger theoretical statement: noise added the safety variables, their uncertainty becomes larger. Therefore, the safe set becomes smaller making exploration more local.
30

---

Published in Transactions on Machine Learning Research (1/2025)
Vj = J, J. let say (x) is the predictive noisy value æ. We can model with single-task GP p (=)( (x)) N (f'(x), N (Mp og x (x) +
og a multitask GP p ( (z)(x))a" t))
N ( og (x) (x)) /3 based on the Gaussian noise assumption (Assumption 3.1) and the fact that Gaussian distributions have additive variances. Consequently, a safe set computed by Algorithms to 3 is ooz
g112 V pp pN (xx)) + og 2 Tj} (single lask, Equation (3)) or SN 0/=1 e Xpoot (x) - 32/² V xg (x) og. 2 Tj} (transfer task, Equation (8)). One can see that the uncertainty is larger and the safe set thus smaller compared to noise- free modeling.
SN -00=1 E Mpo
The theoretical result is not affected because ( (4 (a.)) 2 T;) =i.N): the safety likelihood quantified in our Theorem 4.2, is larger than p (= (a.) 2 T,) MI =i.N) indicating that noisy safe set is bounded by an even smaller value and, therefore, is clearly also bounded by the previously derived quantity.
F Experiment & Numerical Details
F.1 Labeling Safe Regions
The goal is to label disjoint safe regions, so that we may track the exploration of each land. We access safety values as binary labels of equidistant grids (as if these are pixels). This is always possible for synthetic problems. We then perform connected component labeling (CCL, see He et al. (2017)) ) to the safety classes. This algorithm will cluster safe pixels into connected lands. When D = 1, this labeling is trivial. When D 2, we consider 4-neighbors of each pixel (Ile al., 2017). For noise-free ground truth safety values, the CCL is deterministic. This algorithm can however be computationally intractable on high dimension (number of grids grows exponentially), and can be inacurrate over real data because the observations are noisy and the grid values need interpolation from the measurements.
After clustering the safe regions over grids, we identify which safe region each test point a. belongs to by searching the grid nearest to x., The accuracy can be guaranteed by considering grids denser than the pool. This is computationally possible only for D 1,2. See main Table and the queried regions count. of Figure 11 for the results.
F.2 Numerical Settup & Datasets
For our main experiments (Algorithm 1, Algorithm 2, Algorithm 3), we set Nin (mumber initial observed target data), Nsouree (number of observed source data), Nquery (number of AL queries/ learning iterations) and Npool (size of discretized input space Xpool) as follows:
1. GPID: Noource = 100, Nuat = 10, Nquery = 50, N Npool 5000, constraints 9 2 0 up to noise;
GP2D: Nsource = 250, Nini = 20, Nquery = 100, Npoot = 5000, constraints q 2 up to noise;
3. Branin & Hartmann3: Nsource 100, Nin
20, N Nquery 100, Npool 5000, q 0 up to noise;
4. PEngine: Neource 500, Nunt
20, N Qqeery = 100, and Npool = 3000, constraints S 1 up to noise;
5. GEngine: Naouree = 500, Niit = 20, Nquery = 200, Npool = 10000, 1.5 s g 0.5 up to noise.
In the following, we describe in details how to prepare each dataset.
F.2.1
Synthetic Datasets of Tractable Safe Regions
We first sample source and target test functions and then sample initial observations from the functions. With GPID, GP2D and Branin problems, we reject the sampled functions unless all of the following conditions are satisfied: (i) the larget task has at least two disjoint safe regions, (ii) each of these regions has common safe
31

---

Published in Transactions on Machine Learning Research (1/2025)
area shared with the source, and (iii) for at least two disjoint target safe regions, each aforementioned shared area is larger than 5% of the overall space (in total, at least 10% of the space is safe for both the source and the target tasks).
GP Data: We generate datasets of two outputs. The first output is treated source task and the second output as the target task.
To generate the multi-output GP datasets, we use GPs with zero mean prior and multi-output kernel Σi= WoW? @ :), where & is the Kronecker product, each Wj is a 2 by 2 matrix and ky a unit variance Matérn-5/2 kernel (Álvarez et al., 2012). All components of Wi are generated in the following way: we randomly sample from uniform distribution over interval [-1,1), and then the matrix is normalized such that each row of Wi has norm 1. Each b has an unit variance and a vector of lengthscale parameters, consisting of D components. For GPID and GP2D problems, each component of the lengthscale sampled from uniform distribution over interval [0.1, 1). We adapt algorithm of Kanagawa et al. (2018) for GP sampling, detailed as follows:
1. sample input dataset X E R2xD within interval [-2, and 100P.
for [ - 1,2, compute Gram matrix K₁ ,x, X).
3. compute Cholesky decomposition L. L(W.W7 (K)) = L(WW))) (ie. o L,T,, I E IR 2
4. for I = 1,2, draw ~ N(O, T2.a) (u E (22m))1).
obtain noise-free output dataset F =Z Luu
6. reshape [[(X,5) E 2-nx into F F= (f(X,ss f(x,)) e Raxx 5(x,1)
normalize again s.t. each column has mean 0 and unit variance.
8. generate initial obscrvations (more than needed in the experiments, always sampled from the largest safe region shared ween the source and the target).
During the AL experiments, the generated data X and are treated as grids. We construct an oracle on continuous space [-2, by interpolation. During the experiments, the training data and test data are blurred with a Gaussian noise of standard deviation 0.01 A (0,0.013).
Once we sample the GP lyperparameters, from the GP. During the experiments, the constraint is set to 2,, 2 (z., = are noisy Qs. q). For each dimension, we generate 10 datasets and repeat the AL experiments 5 times for each dataset. We illustrate examples of X and in Figure and Figure 7.
sample one main function f and an additional safety function
Branin Data: The Branin function is function defined over (x1, X = [-5, 10) x 10, 15] as
faboana (x11) = a(02 - ba + cæ - r) + s(1 t)cos (x)) + +
where a, b, c, r, s, are constants. It is common to set (a, (a.b,..r,stt)) (1, 3:3 5 6. 10, + which is our setting for target task.
32

---

Published in Transactions on Machine Learning Research (1/2025)
We take the numerical setting of Tighineanu et al. (2022); Rothfuss et al. (2022) to generate five different source datasets (and later repeat 5 experiments for each dataset):
a annniform( (0.5, 1.5),
b bUnniforml (0.1, 0.15),
c~Uniform( 0, 2.0),
~UUifform(55. 5.0, 7.0),
~Uniform(88A 8.0, 12.0),
I L~Uniform(00.0 0.05).
After obtaining the constants for our experiments, we sample noisc free data points and use the samples to normalize our output
fabbera (21, normalize Salbars ((11, mean(fabhars))
sld sld(Jap...rs..)))
Then we set safety constraint 0 (y is noisy f) and sample initial safe data. The sampling noise is Gaussian N (0, 0.013) during the experiments.
F.2.2 Hartmann3, PEngine, Gengine
Hartmann3 Data: Unlike GP and Branin data, we do not enforce disjoint safe regions, and do not track safe regions during the learning. The task generation is not restricted to any safe region characteristics.
The Hartmann3 function is a function defined over a EEA X [0, 1|3 as
3
farezaasns (221, x3))
apeop
Ais(z -
j=1
3
10
30
0.1
10
35
A
3
10
30
0.1
10
35
(3689
1170
2673
4699
4387
7470
P=
1091
8732
5547
381
5743
8828
where 01, 02 a3 04 are constants. common to (a1, 02 03, 04) = (1,1,2,3,3.2), which is our setting for target task.
We take the numerical setting of Tighineanu et al. (2022) to generate five different source datasets (and later repeat experiments for each dataset);
Unnnfor [.0, 1.02),
02 Uniiorrm(118,,1 1.2),
a3 (Uniforrm(22.8 3.0), a4 (3Uniformm3.2233.
After obtaining the constants for experiments, sample noise free data points and use the samples to normalize our output
F2, Say,0g.03.44 (111, 133) normatise Lai.a2.0s.a4 (10), X2,
(2,, 1z)) mean sta(ffar,agaaa.
Then we set safety constraint y 2 (y is noisy f) and sample initial safe data. The sampling noise Gaussian during the experiments N (0,0.012).
33

---

Published in Transactions on Machine Learning Research (1/2025)
We have 2 datasets, measured from the same prototype of engine under different conditions. Both datasets measure the temperature, roughness, emission HC, and emission NOx. The inputs are engine speed, relative cylinder air charge, position of camshaft phaser and air-fuel-ratio. The contextual input variables 'position of camshaft phascr" and "air-fucl-ratio" are desired to be fixed. These two contextual inpuls are recorded with noise, so we interpolate the values with a multi-out GP simulator. We construct. a LMC trained with the datasets, each task as one output. During the training, we split each of the datasets (both safe and unsafe) into 60% training data and 40% test data. After the model parameters are selected, the trained models along with full dataset are utilized our GP simulators (one simulator for each output chamnel, e.g. temperature simulator, roughness simulator, etc). The first output of each GP simulator is the source task and the second output the target task. The simulators provide GP predictive mean as the observations. During the AL experiments, the input space is a rectangle spanned from the datasets, and Epoot is a discretization of this space from the simulators with Nooo = 3000. We set Na = 500, N = 20 (initially) and we query for 100 iterations (N = 20 + 100). When we fit the models for simulators, the test RMSEs (60% training and 40% test data) of roughness is around 0.45 and of temperalure around 0.25.
PEngine Data:
In sequential learning experiment, the surrogate models are trainable GP models. These surrggate models interact with the simulators, i.c. take Xpoot from the simulators, infer the safety and query from Xpool: and then obtain observations from the simulators. In our main Algorithms 1 to 3, the surrogate models are the GP models while the GP simulators are systems that respond to queries C..
Figure 8: The historgram of GEngine data. The first 5 columns are inputs without NX history structure, the second last column is the output we model with Js, and the last column the temperature raint variable. The rows are the following in order: (1) source task training set, (2) source task test set (not used in the experiments), (3) target task training set, and (4) target task test set. Blues are the histograms of raw data, and oranges are subsets if we add constraints on the temperature channel.
This problem has two datasets, one taken the source task and one as the target task. Both datascts were published by Li et al. (2022). Each datasct is split into training set and test set. The original datasets have the following inputs: (1) the first dataset has speed, load, lambda, ignition angle, and fuel cutoff (dimension D = 5) which we take as the source task (2) speed, load, lambda, and ignition angle (D = 4, no fuel cutoff) which we take as the target task. The 5th input of the source data, fuel cutoff, is irrelevant and we exclude it (not used in the original paper). Please see Figure for the data histogram. The datasets are dynamic and are available with nonlinear exogenous (NX) history structure, concatenating the
GEngine Data:
34

---

Published in Transactions on Machine Learning Research (1/2025)
relevant past points into the imputs (handled by Li et al. (2022) in their published code). The final input dimension of this problem is D = 13. As outputs, the source dataset measures the temperature, emission particle mumbers, CO, CO2, HC, NOx, O2 and temperature. The target dataset measures particle numbers, HC, NOx and temperature. We take HC as our main learning output and temperature as the constraint variable.
Both the source and target datasets have hundreds of thousands of data, but Li et al. (2022) discover that the performance saturates with few thousand randomly selected points with few hundred actively selected points. We thus decide to run our experiments with Noooo 10000, random subset of the training set. This pool subset is sampled before we compute the acquisition scores in cach itcration. Furthermore, we start our AL experiments with Minit 20 and we query for 200 iterations. The initial target data are sampled from the following input domain (written in the original space, no NX history structure here) [-1, x (-20,- 0.5] [0, 0.5) [0, 0.2). This domain chosen by taking the density peak of the inputs, see row 3 of Figure for the data histogram. Note that values of datasets were normalized.
In this problem, the effect of one single query the GP hyperparameters is not obvious. Therefore, to speed up the experiments, train the hyperparameters only every 50 queries (and at the beginning). The constraint is temperature -1.5 S 2 S 0.5, and source temperature -2 S 2g S 0.5. The temperature lower bound matters only to the outliers, it is the upper bound 0.5 that plays the major role. The overall safe set is around 65% of the input space (target test set).
G Ablation Studies and Further Experiments
In this section, we provide ablation studics on the size of source datasct.
One Source Task, Varied : We perform experiments on the Branin function. The results are presented Figure 9. The first conclusion is that all of the multitask methods outperform baseline safe AL (safe AL result shown in Figure 4). Note again that the RMSEs are evaluated on the entire space while the baseline safe AL explore only one safe region. In addition, we observe that source data result in better performances, i.e. lower RMSE and larger safe set coverage (TF area), while there exist a saturation level at around Nsource = 100.
Multiple Source Tasks: Next, we wish to manipulate the number of source tasks. The transfer task GP formulation and the exact models are described Appendix D.2. We take LMC and HGP with Matérn-5/2 kernels as the base kernels. In this study, we generate source data with constraints, but discard the disjoint safe regions requirement when we sample the source tasks and data (in Figure 4, the data are generated s.t. source and target task has large enough shared safe area). We consider 1, 4 source tasks, and generate 20 30 data points per task (Figure 10). In general, we see that 3 source tasks significantly outperform 1 source task while the performance saturates as adding 10 more points per source task seems to benefit more than adding one more source lask. Note here that all source data are generated independently, i.e. the observations of each task are not restricted to the same input locations.
Further Plots and Experiments: The main Table and Table 4 present only the summaar results. In Figure 11, we additionally provide the region clustering and fitting time w.r.t. AL iterations. Further- more, Table 5 counts the AL selected queries which, after safety measurements are accessed, actually satisfy the safety constraints. This table is sanity check that the methods are selecting points safely.
With the PEngine datasets, we perform additional experiments of learning f = =temperature, and the results are shown in Figure 12.
35

---

Published in Transactions on Machine Learning Research (1/2025)
Table 5: Ratio of Safe Queries
Methods
GP1D
GP2D
Branin
Hartmann3 100
GEngine
N Nquery
50
100
100
200
TGP
0.986 + 0.001
0.974 + 0.002
0.999 + 0.0006
0.972 = 0.003
0.936 = 0.003
0.979 + 0.004
0.952 + 0.005
0.9996 + 0.0004
0.972 = 0.003
0.947 = 0.01
FullTrans
0.984 + 0.002
0.969 + 0.002
0.993 + 0.0009
0.968 + 0.003
0.91 0.008
Rothfuss2022
0.975 = 0.003
0.905 + 0.006
1.0 0.0
0.84 = 0.011
0.765 = 0.035
SAL
0.995 + 0.001
0.958 + 0.005
1.0 0.0
0.966 + 0.002
0.954 + 0.005
Ratio of all queries selected by the methods which are safe the ground truth (initial data not included, see Section for the experiments). This a sanity check additional to FP safe set area, demonstrates that all the methods are safe during the experiments. Note that our benchmark problems all have around 35% to 65% of the space unsafe. Note that = 4 implies that, with well-fitted safety GP, tolerate 2.275% probability of unsafe evaluations. PEngine results are not shown because the queries are all safe (the modcling FP safe set area is almost zero in this problem, see Figure and Figure 12).
36

---

Published in Transactions on Machine Learning Research (1/2025)
fraris
Drasin
Branis
Eraris
04
122
3.2
180
3.0
23
2.0
2.0
1.4
12-
1.4
33-
50-
0.000
3000
Hoarcs
sscural 100
0.322
Hoorcc
koearz: (3),
0.07
2.00
0.00
1.2
32.1
32-
12"
187
Figure 9: Safe AL experiments: Branin data with different number of source data. Each multitask method is plotted in one column. The results are mean and one standard error 25 experiments per sctting. Xpool is discretized from with Npool = 5000. The TP/FP areas are computed as number of TP/FP points divided by Npool (i.e. TP/FP as portion of Xpoot). The third row shows the number of disjoint safe regions explored by the queries. The fifth row, the unsafe queries ratio, are presented (e.g. at the 2nd-iteration out of total of 100 iterations, one of the two queries is unsafe, then the ratio is divided by 100). The last row demonstrates the model fitting time. At the first iteration (iter 0-th), this includes the time for fitting both the source components and the target components (EffTranHHGP) With Rothfuss et al. 2022, source fitting is the meta learning phase.
percentage of number of iterations
37

---

Published in Transactions on Machine Learning Research (1/2025)
ETRunHidr
Tut TharstiP Erands
fothleus 2002 Brann
20-1
23
140
3.20
0.000
0.00
0130
0100
0.000
Vooure 2013 HeR:24
0317
031
2013
0,333
0100
12
23
2.00
200
200
2.00
Figure 10: Safe AL experiments with more than one source tasks: Branin data with multiple source tasks. Each multitask method is plotted one column. We consider 1, 3 or 4 source tasks and sample 20 or 30 data points per task. The remaining setting is the same as described in Figure RMSE plots are plotted in log scale.
38

---

Published in Transactions on Machine Learning Research (1/2025)
additionel q
additional
0.5
8855 ot.
10
20
10
50
20
40
80
100
Tux bestbve (tres porcets
posibe Gana portoel:
0.35
0.5-
0.30
6.4
0.4
0.5
0.20
0.5
20
60
80
100
2.-
Qu8ted COURE
1.0
-10
quered reoino count
2.
que tusteriggooos
16-
2.0
15
10.
1.0
10
20
90
20
50
100
Telle podiie (erse pertzo
0.8
EffMaasHHP
Filce portive tare porton)
0.95
BffiransHSP
Ta0 poantire Lana pantont
afftran SHOP
nulthami
RUfTannHHP
0.44
RulthancHOP
0.000
3.4
0.88
0.055
Basatine
8.02
3.02
8.0
0.005
3.00
8.00
0.000
70
20
60
80
100
12.8
0123te OvENtE 1005 (52
Unsate QHePRS 1tt (54
UnS20e quoncs catb
15
02-
0.0
0.0
30
10a
12
teoro timetsi
301
133
400
mang
-101
10
10
50
26
60
60
100
keration
Eeration
Figure Safe AL experiments on three benchmark datasets: GP data with [-,, D or 2, constrained to 0, and the benehmark Branin function with constraint y 2 0. The results are mean and one standard error of 100 (GP data) 25 (Branin data) experiments. Xpool is discretized from X with Npool = 5000. We set Ngource 100 and N is from 10 (Oth iteration) to 60 (50th iteration) for GP1D, Nsource = 250, N is 20 to 120 for GP2D, and Nsource = 100, N is 20 to 120 for Branin. The first, second and fourth rows are presented in Figure 4 of the main paper. The TP/FP areas are computed as number of TP/FP points divided by Npool (i.e. TP/FP as portion of Xpoot). The third row shows the number of disjoint safe regions explored by the queries (main Table 3 taken from the last iteration here). The fifth percentage of number of iterations (e.g. the 2nd-iteration of the two queries is unsafe, then the ratio
row, the unsafe queries ratio, are presented out of total of 50 iterations, demonstrates the model fitting time. At the first iteration (iter 0-th), this includes the time for fitting both the source components and the target components (EffTranHGPP). With Rothfuss et al. 2022, source fitting the meta learning phase.
divided by 50). The last.
39

---

Published in Transactions on Machine Learning Research (1/2025)
PEngine, learn fsq=temperature, 1.0 is safe
Thue portion)
0.5
0.4
0.3
RMSE
0.75
0.2
0.50
0.1
0.25
False positive (area portion)
10a
EffTransHGP
FullTransLMC
102
FullTransHGP
fittngg time
Rothfuss et al. 2022
10a
Baseline SAL
10
iteration
iteration
Figure 12: Safe AL experiments PEngine temperature, AL on f (temperature) constrained by q 1.0. Bascline is safe AL without source data. Transfer is LMC without modularization. Efficient transfer is HGP with fixed and pre-computed source knowledge. Neource 500, Nis from 20 to 120. The results are mean and one standard error of repetitions. The fitting time is in seconds.
40


Reviews:
[{"review_id": "eg3eKiZwq1", "reviewer": "Reviewer_SxvX", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n- Deals with an interesting problem setup: The paper addresses the problem of safe sequential learning with Gaussian processes, which is a relevant and challenging area of research.\n- Attempts at reducing computational complexity of the problem: The authors introduce a modularized approach to multi-output GPs that reduces the computational complexity of incorporating source data. This is important in real-world applications where large amounts of source data may be available.  \n- Has sufficient experiments for a theory paper: The authors conduct experiments on a variety of real-world datasets to demonstrate the effectiveness of their proposed method. The experiments cover different scenarios, including cases with multiple disjoint safe regions and high-dimensional data. \n\nWeakness: \n\n- Poorly Written & Lacks Clarity: The paper's clarity and organization could be significantly improved.  \n  1) “we introduce the idea of transfer safe sequential learning supported by a thorough mathematical formulation” : From a mathematical standpoint the paper has sloppy writing. I mention several of such mistakes in the requested changes.\n\n- Experiment don't have a message: While the paper includes several experiments, the presentation of the results and the takeaways could be more concise and impactful.\n   1. There are 3 claims that the authors make that the experiments should verify, however in the experiment section it is not clear what is the performance improvement with respect to these claims and how much are they verified\n   2. It is unclear as to what is the safety aspect in the experiments from a practical standpoint. In general, what is the safety constraint parallel in active learning? \n\n\n- Intuition for the theory is absent: Although the paper presents theoretical analysis and proofs, it sometimes lacks the necessary intuition to help readers understand the underlying concepts\n   1. Theorem 3.4 can lead to a vacous bound if the sigma_f is too big,\n   2. There should be some intuition to the proofs in the main paper. \n   3. The problem statement is not clear mathematically in the text.\n   4. Also what is the theoretical improvement of the results you propose", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "No", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The paper introduces a transfer learning method for safe sequential learning with Gaussian processes (GPs). The authors first show that standard GPs with stationary kernels cannot explore regions that are distant from the initial observations. To overcome this, the authors use a multi-output GP which incorporates source data to make the exploration more efficient. Furthermore, the authors propose a modularized approach to multi-output GPs that can reduce the computational burden of the source data. The authors demonstrate the efficacy of their method on a variety of real-world datasets for active learning.", "claims_and_evidence_yn": "No", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "My main concern with the paper is the writing. This is not to the standards of TMLR in the current form. I was unable to decipher some of the theoretical results. I would be happy to have a look again and give more feedback on the theory and empirical results and engage in a conversation. The same goes for my \"No\" response to the claims and evidence, which is based on \"clarity\" of the arguments presented for the claims, I'll be happy to change my response based on our discussion. \n\n1. The problem statement is not clear mathematically or in text and the assumptions are all over the place. Perhaps have a look at the other accepted papers of TMLR to understand what is the expectation of the journal. \n2. The abstract should be rewritten so as to have a better structure but also make clear what the exact problem is that the paper is looking at and the approach that the paper is using. For example, what is being transferred (offline data, which the paper assumes is available in abundance (which is fine but should be reflected in the abstract))? The content is there but needs to be organized better. \n3. Equation (4) seems to be important for the transfer learning part. Perhaps explaining it and explaining where exactly transfer learning happens should be made clear.\n4. Assumption 3.3 seems logically inconsistent is the order correct? Then there exists a variable that is the one implying the condition? Perhaps you meant the other way?\n5. Add references for the statement \"These learning algorithms often utilize Gaussian processes “ with respect to Active learning. Also explain in the paper why safety is a critical point in active learning. I don’t understand why safety constraints would be there while annotating something? Perhaps an example?\n6. Since Figure 1 is the main motivating figure of the paper it should have Descriptive Caption. Also Figure 2 and Figure 3 should have a take-home mes\n7. Please add what is the implication of (4) and where exactly is the transfer learning part?\n8. What is D, J in preliminary?\n9. What is index_space in section 4?\n10. Why do you have t=0 and s=1,..? This is a really confusing notation. Just say t is the index of the target tasks and s the notation of the source tasks. If you are considering only a single source and target task in the main paper, you can just use s and t, and then have a subsection or footnote explain their extension and point to the appendix\n11. In Notations, Why is z^j_1:N a set? Isn’t this ordered information?\n12. What is the condition on the function f, g? It is mentioned first in Assumption 2.1 but much later made clear the assumption 3.1\n13. Phi is not defined in the main text to the best of my reading, it is the CDF of the normal function (which I inferred from the proof)\n14. g = f, q1 , … \\in (instead of =)\n15. Please label the algorithms appropriately. Sequential learning is a very broad term that can be used for MDPs, Bandits, and even deterministic optimization.\n16. For each theoretical and numerical result central to your argument there should be a) motivation b) intuition and c) implication.\nAlso, one suggestion to the author is to ensure that each important section of the paper is written so that if a researcher familiar with the field wants to understand and use your results, they can do so without much effort, i.e., the text is accessible. This can greatly help the readability of the paper and also help your work garner more attention.", "broader_impact_concerns": "N/A", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "76UjvV8YyE", "reviewer": "Reviewer_qhhS", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "### Strengths\n\n1. The paper clearly explains the weakness of conventional safe learning methods in safe exploration, including a theoretical upper bound on the maximum explorable safe regions of conventional safe learning methods.\n\n2. The paper is well-structured and the writing is mostly clear\n\n### Weaknesses\n1. As expected, and also mentioned by the authors in the limitations and conclusion, the success of safe exploration by the proposed method largely depends on the positive correlation between safe regions of the source and target problems. When there is no such correlation, how does the method perform, especially, its worst-case performance? Can the authors provide more discussion on whether this existence of good correlation is too strong an assumption to have in real-world settings? Ideally, I think for safety-critical applications, it would be great to have some quantitative lower-bound in terms of prediction error and safety measure (or risk of querying the unsafe region) in relation to the source-target correlation. But I totally understand this is beyond the scope of this paper.\n\n2. Even in the low dimension case, in Figure 3, the proposed methods sometimes have initially higher false positives than the baselines. Would this cause a major issue in safety-critical scenarios, where mistakes, i.e., querying the unsafe regions, are extremely costly so false positives outweigh true positives?\n\n3. It might be that I have not fully understood the problem settings. I wonder, in the safe sequential learning setups, when you mistakenly query an unsafe data point, do you still receive the target label despite the data point being unsafe? If this is allowed, how does relying on a source prior to encourage exploration compare to directly modifying the acquisition function in equation 3? For example, instead of constraining the search space to $S_n$, you give more reward for querying data points with higher entropy under the GPs model $q$ for the safety constraint in addition to its entropy under the predictive function $f$. Will relying on some source prior (which can be good or bad), on average, outperform this heuristic in terms of data efficiency and safety measure?\n\n4. What do the yellow dots represent in Figure 1, top, for \"our transfer sequential learning\"?", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The paper proposes an approach for safe sequential learning by leveraging two key strategies: 1) transfer learning to enhance the exploration of safe regions and improve data efficiency in tasks with potentially multi-modal safety regions, and 2) a modularized approach in multi-output GPs that reduces computational complexity by pre-computing source-relevant components. \n\nThe transfer learning aspect allows for the acceleration of learning by utilizing source knowledge to guide the exploration of disjoint safe regions, which is particularly beneficial in scenarios where safety conditions are unknown a priori. The modularized GP approach addresses the computational challenges associated with the cubic time complexity of GPs by fixing certain components related to the source data, thus facilitating more efficient computation during the learning process.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "Please kindly refer to the weaknesses above", "broader_impact_concerns": "n/a", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "ccKCwZwKwq", "reviewer": "Reviewer_B8BG", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "## Strengths\n\nThe work presents a meaningful contribution by combining safe learning with transfer learning, allowing for more efficient and effective safe exploration. Through computationally efficient kernel computation by fixing blocks associated with source data, the authors address a key challenge in, e.g., GPs framework related to computation. This strategy is an extension of Tighineanu et al. (2022) and offers a generalized approach to safe learning that could potentially be applied beyond HGPs. Experimental results suggest that this method does improve exploration efficiency in scenarios where the source and target tasks share similar safety criteria.\n\n## Weaknesses\n\nThe paper could benefit from significant improvements in clarity, particularly in the problem statement and sections involving mathematical formulation. When emphasizing the “mathematical formulation” and “theoretical contributions,”you normally don’t want the reader to begin losing confidence in the claim and theoretical soundness when encountering a problem formulation that still falls short of good standards for mathematical rigor.\n\nAlthough the work provides a theoretical demonstration on the limitations of traditional approaches, it lacks a comparable theoretical validation of the benefits of the proposed method, relying instead on empirical support through experiments. \n\nAdditionally, while the authors claim that the method generalizes beyond hierarchical Gaussian Processes (HGP), the paper demonstrates its application using Algorithm 2 only with HGP. This may restrict the perceived impact of the approach, and it remains somewhat unclear to what extent the methods proposed here deviate from those of Tighineanu et al. (2022). Furthermore, as the authors acknowledge in their limitations section, while the work introduces the use of the LMC kernel, this choice does not appear to offer a particularly practical solution.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This work introduces an interesting approach to safe learning by using transfer learning to enhance the efficiency of safe exploration. Specifically, it addresses the \"local exploration\" issue encountered by traditional methods (formally illustrated through a theorem) by incorporating data from relevant \"source tasks\" to support broader \"global exploration.\" However, this added benefit introduces computational challenges, particularly for methods like Gaussian Processes (GPs), where an increased number of data leads to substantial computational overhead. To address this, the authors propose a more efficient kernel computation strategy that fixes blocks related to source data. This approach generalizes the work of Tighineanu et al. (2022), extending the advantages of hierarchical Gaussian Processes (HGP) to a broader class of kernels. Empirical results demonstrate that the proposed approach effectively tackles the local exploration issue, improving both sample efficiency and computation time. This demonstration is conducted within the GP and AL frameworks, assuming that the source and target tasks share similar safety criteria.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "## Writing\n\nI might have overlooked things you already have done. However, I feel the entire problem statement can be organized with a better structure for a smoother presentation. Currently, the elements appear somewhat scattered and placed arbitrarily. The mathematical formulas also need careful attention. Here are some examples, but I highly recommend the authors review the entire article with these points in mind.\n\n1. As a suggestion, you might consider combining “preliminary” with the first paragraph of the “safe learning problem statement” to streamline the protocol description regarding data (e.g., data type, how the data come, etc.). You could then explain how $y$ and $z$ relates to $x$ through functions and the corresponding assumptions. Finally, state the goal regarding evaluating the function $f$ under certain constraints.\n\n2. Again, this is just a suggestion. I don’t think it’s necessary to use so many different formulas to define $z\\_{1:N\\_{init}}$. This might introduce more confusion than clarity. For example, the following might be sufficient:\nThe initial safe data $D\\_{\\text{init}} = \\\\{ x\\_{1:N_{\\text{init}}}, y\\_{1:N\\_{\\text{init}}}, z\\_{1:N\\_{\\text{init}}} \\\\}$ consists of $N\\_{\\text{init}}$ input samples $x\\_{1:N\\_{\\text{init}}} = \\\\{ x\\_n \\\\}\\_{n=1}^{N\\_{\\text{init}}} \\subseteq X$, corresponding regression outputs $y\\_{1:N\\_{\\text{init}}} = \\\\{ y\\_n \\\\}\\_{n=1}^{N\\_{\\text{init}}} \\subseteq \\mathbb{R}$, and safety observations $z\\_{1:N\\_{\\text{init}}} = \\\\{ z\\_n = (z\\_n^1, \\dots, z\\_n^J) \\\\}\\_{n=1}^{N\\_{\\text{init}}}\\subseteq \\mathbb{R}^J$.\n\n3. Please remember to specify domains so that quantities are clearly defined. For example, the safety constraints $T_j$ and most of the $\\sigma$ terms are not defined, and this also applies to most of the $k_g$ and $\\theta$ terms.\n\n4. In several instances, expressions like “$\\forall j\\in[J]$” and “$\\\\{q^j\\\\}_{j=1}^J$” are missing when describing safety-related quantities. Very often, you only cover a specific “$j$”.\n\n5. Adding small words like “let,” “assume,” “where,” and “and” could make the text flow more smoothly. Since there are quite a few notations, it would also help to introduce elements with descriptions as you go, rather than assuming subscripts like “s,” “j,” or “init” will be automatically understood without explanation.\n\n6. Regarding the source data, I noticed that you define $s$ as the index for source tasks, yet in the formulation of $ D\\_{N\\_{\\text{source}}}^{\\text{source}} $, all samples seem to belong to a single, specific source task. I understand that in the main paper, you primarily address the case of a single source task and intend to defer the multi-task formulation to the appendix or supplementary material. However, from what I can see, there is no additional formulation provided for multiple source tasks. Consequently, the current formulation in the main paper doesn’t seem to support multiple source tasks.\n\n7. You overload $k_g$ for a lot of different purposes. In Assumption 3.1, it can be function $k_g:X\\times X\\rightarrow \\mathbb{R}$ or a parameter. Later on, it’s used as $k_g:X^N\\times X\\rightarrow\\mathbb{R}^{N\\times 1}$, and, without further specification, as $k_g:X^N\\times X^N\\rightarrow\\mathbb{R}^{N\\times N}$. Overloading notations is fine, but please ensure it doesn’t create ambiguity.\n\n8. In the statement of Theorem 3.4, you might want to consider placing “for any $x_*\\in X$” only before you state $\\forall \\delta$ …\n\n9. In “Kernel selection”, the notation $\\otimes$ and $W_{l,s}$ are not defined.\n\n10. Please ensure consistency in numbering corollaries, theorems, and other items between the appendix and the main paper.\n\n## Ambiguities in explanations\n\n1. In Algorithm 1, is num_step a given quantity? Additionally, it would be helpful to specify in each step what is used as input and what is produced as output. For instance, Lines 2 and 4 in Algorithm 1 are somewhat unclear, and this creates confusion later about why you combine Algorithm 1 with HGP and LMC; as currently stated, Algorithm 1 does not mention source data. I assumed that including source data later on in the experiments implies they are considered part of $D_{N_{\\text{init}}}$, which was before only defined to include data from the target task. Hence, please make the data you use more explicitly. Also, in Algorithm 2, a line mentioning the use of decomposition $L$ might add clarity.\n\n2. Regarding the safety constraints, are the unknowns the functions $q_j$ or the thresholds $T_j$ or both? In some cases, such as Example 3.6, the safety constraint function $q$ and the threshold $T = 0$ are clearly defined. However, in examples like GP1D, GP2D, and Branin, the function $q$ and threshold $T$ are not separated, making their interpretation unclear.\n\n3. In your experiments in, e.g., Table 2, how do you define and compute the number of true and explored “regions”?\n\n4. On page 6, could you formally clarify what is meant by “$T_j$ is in the sensitive domain of $g$”? The meaning here is unclear to me.\n\n5. On page 8, could you elaborate on the phrase “cluster the parameters of $k_{f}$ into $\\theta_f=(\\theta_{f_s}, \\theta_f)$”? How exactly is this clustering performed? Also, is this notation essential for the explanation or is it enough to explain merely by the corresponding kernels? Furthermore, why does the clustering not require $k_f$ to be independent of $\\theta_{f_s}$? Is this the result of some mathematical properties or does it stem from another consideration?\n\n6. On page 8, what does it mean that the source likelihood “can be barely increased while we explore for the target task”? The formula itself does not appear to change with the target task, so it’s unclear what might drive an increase. Following this, the text states, “Thus, we assume $K_{f_s}$ and $\\sigma^2_{f_s}$ remain fixed in the experiments.” Is this reduction in computation based on an assumption or is it a mathematical fact? Either is fine, but it would be useful to clarify.\n\n## Minor\n\nI might have overlooked the description, but are the yellow dots in Figure 1 the source data?\n\nIn the second line of page 3, there is some citation/format issue with “Sui et al.”", "broader_impact_concerns": "No", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: This paper proposes a new approach to safe active learning in Bayesian optimization. The authors demonstrate the limitations of classic approaches, and validate their approach on both synthetic and real-world problems. The initial reviews of this paper were positive and mostly raised clarity concerns:

* Cumbersome writing

* Unclear notation

* No intuition in theory

* Poorly justified experiments

The authors completely revised the paper and took the many comments of the reviewers into account. The reviewers recognized this effort and unanimously agreed that the paper should be accepted.
Decision: Accept (poster)