Title: Constrained Diffusers for Safe Planning and Control
Venue: NeurIPS 2025
Accepted: yes
Keywords: Diffusion Models

Constrained Optimization
Abstract: Diffusion models have shown remarkable potential in planning and control tasks due to their ability to represent multimodal distributions over actions and trajectories. However, ensuring safety under constraints remains a critical challenge for diffusion models. This paper proposes Constrained Diffusers, an extended framework for planning and control that incorporates distribution-level constraints into pre-trained diffusion models without retraining or architectural modifications. Inspired by constrained optimization, we apply a constrained Langevin sampling method for the reverse diffusion process that jointly optimizes the trajectory and achieves constraint satisfaction through three iterative algorithms: projected method, primal-dual method and augmented Lagrangian method. In addition, we incorporate discrete control barrier functions as constraints for constrained diffusers to guarantee safety in online implementation, following a receding-horizon control that we generate a short-horizon plan and execute only the first action before replanning. Experiments in Maze2D, locomotion, and PyBullet ball running tasks demonstrate that our proposed methods achieve constraint satisfaction with less computation time, and are competitive with existing methods in environments with static and time-varying constraints.


Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper introduces _Constrained Diffusers_, a framework that allows to enforce non-convex inequality constraints during the diffusion process. For enforcing such constraints, the authors propose three methods inspired by the constrained optimization literature: (1) projected diffusion sampling, (2) a primal-dual method, and (3) an Augmented Lagrangian Method (ALM). Practically, the constraints a formulated based on Discrete Control Barrier Functions which allows to enforce safety constraints for planning and control tasks. The method is evaluated on various tasks in simulation: Maze2D, locomotion (Hopper and Swimmer), and ball running. As baselines, and unconstrained (i.e., unsafe) diffusion model, SafeDiffuser, and Conditional Diffuser are considered. The results show that that some of the proposed techniques, such as the projected diffusion sampling, exhibit a good trade-off between task performance, limiting unsafe actions, and computational efficiency.\n\nOne important preface for this review: the manuscript that was available to the reviewer did not contain the appendix. Therefore, the reviewer was not able to fully assess all technical details and experimental results. The review is based on the main manuscript only.\n\nSTRENGTHS AND WEAKNESSES:\n## Strengths\n\n- The paper's contribution seems to be novel and valuable for the community and takes a step towards integrating safety constraints into state-of-the-art diffusion models.\n- The paper includes a comprehensive benchmarking between various methods of enforcing constraints and a comparison to existing baselines, such as SafeDiffuser and Conditional Diffuser.\n\n## Weaknesses\n\n- The paper's presentation and clarity could be improved. The reviewer found it to be somewhat difficult to follow how all the pieces and components touched in this paper fit together. Furthermore, illustrations of how the different constrained optimization methods modulate the vanilla difffusion process are missing and would be helpful. The reviewer suggest that the authors rewrite the paper to improve clarity and presentation. At least the section that describes the overall idea and approach of the paper should be relatively easy to follow (also in terms of notation) and should not require the reader to have a deep understanding of all the concepts that are touched in this paper.\n- The paper's discussion of the related work is not sufficient and appears vague and hand-wavy. Specifically, the reviewer is referring here to lines 26-33 of the introduction. The reviewer excepts a clear discussion about the limitations of the existing methods in this area (e.g., SafeDiffuser, Conditional Diffuser) and how the proposed approach overcomes these limitations.\n- The paper does not include real-world experiments, which seems acceptable though given the focus and contributions of the paper.\n\n### Detailed Comments on Minor Issues\n\n- Page 3, line 81: \"... by learning the noise to denoise...\" Is this a typo?\n- Equation (4): From this point, you use $z$ all of the sudden without the subscript $t$ (i.e., instead of $z_t$) without redefining it. Please clarify.\n- Maybe Figure 2 should be Figure 1? The current Figure 2 seems suitable to communicate the overall idea of the method and should be the first figure in the paper.\n- Tables 1-3: Please cite the baselines in the tables.\n- Table 1: why is the \"Time/s\" result for \"Projected\" in \"maze2d-umaze\" marked in bold? There are other methods that are equally fast or even slightly faster that are not marked in bold.\n- Figure 4: Please use the same order for the methods in the legend as in the tables. Also, I am not able to visually distinguish the \"Projected\" method (in purple) from the other methods. Please improve the presentation of the figure.\n\nQUESTIONS:\n- What are the limitations of the proposed approach(es)?\n- The authors do not discuss how the Diffuser models are trained. Are they trained from scratch or are you adopting pre-trained models? If the former, how are the demonstrations provided in the given environments (e.g., Maze2D, Hopper, Swimmer, PybulletBallRunning) If the latter, which pre-trained models are used?\n- How can enforcing such constraints during the diffusion process be (\"inuitively\") understood? Can you show a visualization that shows diffusion of the trajectories as done by the vanilla diffusion model and how such trajectories are diffused differently when the constraints are enforced? Please aim to do so for all three constrained optimization methods that are proposed in this paper and also, preferably, for the baselines (SafeDiffuser and Conditional Diffuser).\n- The SafeDiffuser baseline is only (fully) evaluated on the Maze2D task. Why is this the case? The reviewer does not understand the commeent in line 238 of page 8 that states \"SafeDiffuser methods applies only to the planning stage so we do not compare their metrics in the implementation stage.\" Why is this the case? The reviewer would expect that the SafeDiffuser method can be applied to all tasks in a similar way as the proposed methods. Also, why is the SafeDiffuser not evaluated on the PybulletBallRunning task? The reviewer would expect that the SafeDiffuser can be applied to this task as well.\nMost of these questions relate to the clarity and presentation of the paper and if the authors addresses these questions in the rebuttal and the revised version of the paper, the reviewer would be happy to increase the score.\n- How are the Discrete Control Barrier Functions $h(x)$ transformed into the diffusion constraints $g(\\cdot)$. Is this just a simple reshuffling of terms in the inequality equation? Or is there more to it? This seems like a crucial detail that is ommited in the paper.\n- How is $x_t$/$x_0$ defined? Does it contain the entire trajectory? If yes, over which horizon? In Algorithm 1, the authors also use the variables $x_0^0$ and $x_0^1$ but they are not defined. How do they related to $x_0$? Also, practically speaking, how is the constrained diffusion policy used during inference? Does re-planning occur at every time step (i.e., the policy predicts an entire trajectory but only the first action is executed and then the policy is re-evaluated at the next time step)? Or does the policy predict a single action at every time step? The reviewer would like to see a more detailed description of how the constrained diffusion policy is used during inference.\n- Contribution 2 (lines 53-56 of page 2): The reviewer questions why contribution 2 is a contribution. What exactly is the contribution here? Is it to use Control Barrier Functions in the context/as constraints of diffusion models? If so, this is not a new contribution as there has been prios work on this (e.g., SafeDiffuser). To the reviewer, it just seems that the authors use CBFs as a particular choice for generating the constraints $g(\\cdot)$, which seems like a reasonable choice but not a contribution in itself. The reviewer suggests that the authors clarify this point in the paper.\n\nLIMITATIONS:\nThe authors do not discuss the limitations of their approach in the main text, although they state that the limitations are discussed in the appendix to which the reviewer did not have access. In any case, the reviewer suggest that the authors should include a concise discussion of the limitations in the main text.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 3, "CLARITY": 3, "IMPACT": 4, "ORIGINALITY": 3, "DATE": "2025-06-11"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper presented a constrained diffuser framework that does not rely on pre-training and is able to ensure safety when using the diffusion model for control and planning. The authors designed three different methods (ALM, projection, and Primal-Dual) to complete constrained sampling and satisfy the constraints represented by synthesized discrete control barrier functions. In the end, an inverse env model, which is supposed to be known a priori, is used to compute the action. By using this framework, the diffuser-based controller can have a good constraint satisfaction performance compared with existing baseline methods in various environments.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths: \n1. The paper is written clearly will good illstration. Fig 1 is pretty intuitive and can demonstrate the performance of different methods. Fig 2 is  easy to understand and is able to help the audience understand the gist of the framework quickly. \n2. The topic is important and interesting. The method proposed in this paper is easy to use since no additional training is required. \n3. A time-varying situation is considered important but relatively less studied. \n\nWeakness: \n1. The benchmark method SafeDiffuser is discussed and compared in the experiments where the environments are not changed. However, the performances in time-varying scenarios are not shown. \n2. The author used an inverse dynamical model to generate the control from the state transition. However, in many dynamical models, there could be different action solutions from the inverse dynamical model. It would be nice if the author could elaborate on how to guarantee the consistency of the controls due to the significance in practice. \n3. The constrained sampling framework for safe control/planning is not a new idea and has been extensively studied and applied in areas like safe RL for robotics. It would be better if the authors could summarize those works and draw a comparison between the proposed safety-enhanced diffuser method with the safe RL methods. \n4. For the Primal Dual and ALM methods there are chances that the control will still violate the constraints even in the simpler time invariant cases. It would be nice if the authors could do more worst-case analysis and discuss how bad the performance will be in extreme cases to help the reader evaluate the risk of the method.\n\nQUESTIONS:\nSee above\n\nLIMITATIONS:\nNo societal impact relevant to this work", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 3, "CLARITY": 3, "IMPACT": 2, "ORIGINALITY": 2, "DATE": "2025-06-12"}

comments: SUMMARY:
This paper proposes Constrained Diffusers, a method for enforcing safety constraints in planning and control using pretrained diffusion models. Rather than modifying the model or retraining, the authors modify the reverse sampling process using constrained Langevin dynamics with three algorithmic variants: Projected Gradient, Primal-Dual, and Augmented Lagrangian. The framework supports discrete control barrier functions (DCBFs) to enforce safety online. Experiments in Maze2D, MuJoCo locomotion, and PyBullet demonstrate the efficacy and efficiency of these methods under static and time-varying constraints.

STRENGTHS AND WEAKNESSES:
Strength: 

- The paper addresses a critical gap in diffusion-based planners: enforcing constraints without retraining. This is highly relevant for real-world safety-critical systems.

- This paper has nice connection to classical constrained optimization. By formulating constraint satisfaction as KL-regularized sampling, the authors connect reverse diffusion with well-established constrained optimization principles. 


Weakness:
I do not see major weakness of the paper. See questions.

QUESTIONS:
- Can you compare the three methods? What are the pros and cons of each one?

- If I understand correctly, while (9) is formulated as a general constraint, later on the constraint is chosen as the constraint barrier function. I wonder what’s the difference between using CBF as constraint vs. directly impose safety set constraints on the states? Further, as the proposed method generates state trajectory, how to ensure the state trajectory is dynamically feasible?

- In Theorem 1, does a local saddle point always satisfy constraint?

LIMITATIONS:
Yes
TITLE: Official Review
CLARITY: 4
IMPACT: 3
ORIGINALITY: 3
DATE: 2025-07-02

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper introduces Constraint Diffusers,  a framework that incorporates constraints into pre-trained diffusion models without retraining or architectural modifications, by incorporating constrained barrier functions into the model. The objective is to make diffusion predictions safe and use them with planning. Constrained Diffusers aim to inject safety constraints into pretrained diffusion-based models that generate full action sequences or trajectories. The method recognizes that retraining large diffusion models to account for new constraints is computationally expensive. Instead, they modify the sampling process to ensure constraint satisfaction post hoc.\n\nSTRENGTHS AND WEAKNESSES:\nPros: \nThe method works directly with pretrained diffusion models, avoiding expensive retraining.\nThe method makes safety a post-training concern, improving modularity and practical usability.\nThe paper offers a toolkit of constraint-handling strategies\n\nCons:\nSuccess in enforcing complex, nonconvex, or time-varying constraints is dependent on the optimization dynamics—true safety guarantees may still be fragile.\nExperiments are simple and preliminary. Experiments are done in simulation only on toy examples. The results look very preliminary.\nNo mention of prior control barrier function methods. How is your paper improving on/ different from several papers on the same topic which are not cited, specifically mapaers that use CBFs with ML such as BarrierNet and papers that address safe diffusion such as Safediffuser: Safe planning with diffusion probabilistic models (ICML 2025 and arXiv)? \nThe solution requires accurate learning or specification of inverse dynamics to translate constrained trajectories into executable actions.\n\nQUESTIONS:\nHow does your work compare with current literature that uses barrier functions to enhance the safety of planning systems?\n\nWhy is this method useful when in fact there are closed form model-based and computationally efficient solutions for the problem you address? How does the method compare to other planning methods like MPC with safety layers or goal-conditioned RL with constraints?\n\nHow sensitive is constraint enforcement to the quality of the inverse dynamics model? What happens when the IDM is inaccurate or poorly generalized? \n\nDo these constrained sampling methods scale well to high-dimensional action spaces (e.g., humanoid robotics)?\n\nHow does the method perform when multiple competing constraints (e.g., safety vs. performance) must be balanced?\n\nIs there a quantitative analysis of trade-offs between computation time and constraint satisfaction for each method?\n\nWhat assumptions are made about access to constraints, and how realistic are those assumptions in practical deployment?\n\nLIMITATIONS:\nNo this section is missing from the paper", "TITLE": "Official Review", "RECOMMENDATION": 3, "REVIEWER_CONFIDENCE": 5, "CLARITY": 3, "IMPACT": 2, "ORIGINALITY": 2, "DATE": "2025-07-05"}