Safe Time-Varying Optimization based on Gaussian Processes with Spatio-Temporal Kernel

Authors: jialin  li
marta  zagorowska
giulia  de pasquale
alisa  rupenyan
john  lygeros
Venue: NeurIPS_cc_2024_Conference
Published: 2024-05-15 20:39:04

Abstract: Ensuring safety is a key aspect in sequential decision making problems, such as robotics or process control. The complexity of the underlying systems often makes finding the optimal decision challenging, especially when the safety-critical system is time-varying. Overcoming the problem of optimizing an unknown time-varying reward subject to unknown time-varying safety constraints, we propose TVSAFEOPT, a new algorithm built on Bayesian optimization with a spatio-temporal kernel. The algorithm is capable of safely tracking a time-varying safe region without the need for explicit change detection. Optimality guarantees are also provided for the algorithm when the optimization problem becomes stationary. We show that TVSAFEOPT compares favorably against SAFEOPT on synthetic data, both regarding safety and optimality. Evaluation on a realistic case study with gas compressors confirms that TVSAFEOPT ensures safety when solving time-varying optimization problems with unknown reward and safety functions.

Main paper: 
 introduction: 
 We seek to interactively optimize an unknown time-varying reward function f : X × T → R, where X is a finite set of decisions, and T := {0, 1, 2, . . . , T }, T ∈ N + denotes the discretized time domain. We assume that the optimization problem is safety-critical, that is, there are constraints that evaluated decisions must satisfy with high probability. Similar to the reward, the constraints are also unknown and potentially time-varying, encoded through c i : X × T → R, i ∈ I c := {1, 2, . . . , m}, where m ∈ N + denotes the number of safety constraints. The optimization problem at time t ismax x∈X f (x, t) subject to c i (x, t) ≥ 0, i ∈ I c (1)Both the reward function and the safety constraints are assumed to be unknown but can be evaluated. This is a plausible setting, for example, for UAV that need to perform rescue missions in dangerous and poorly lit environments.Bayesian Optimization (BO) is a well-established approach for interactively optimizing unknown reward functions. Various BO based approaches have been proposed to solve a wide range of problems in robotics [1, 2] , combinatorial optimization [3] , sensor networks [4] , and automatic 38th Conference on Neural Information Processing Systems (NeurIPS 2024). and SAFEOPT (bottom row) at t = 30, t = 100, and t = 170. Because TVSAFEOPT takes the possible changes in time into consideration, the safe sets computed by TVSAFEOPT are contained in the ground truth safe regions while those computed by ETSAFEOPT and SAFEOPT have multiple violations. The reason for the violations in ETSAFEOPT is that the algorithm is unable to detect small changes in the constraints, confirming that the performance of ETSAFEOPT depends on the event detection algorithm.machine learning [5, 6] . However, Safe Bayesian Optimization in the time-varying setting is still under-explored.Safe Bayesian Optimization To address safety requirements in safety-critical applications, Safe Bayesian Optimization (SBO) [7] has been proposed to avoid unsafe decisions with high probability by interactively optimizing a reward function under safety constraints. SAFEOPT [7] , one of the first SBO algorithms, expands an initial safe set iteratively based on new evaluations and an updated Gaussian Process (GP) model of safety functions. It calculates two subsets, maximizers and expanders, from the current safe set and selects the most uncertain decision within their union to balance maximizing the reward function and expanding the safe set. Subsequent algorithms extend SAFEOPT to handle multiple constraints [8] , decouple safe set expansion from optimization [9] , and expand the safe set in a goal-oriented manner [10] . These methods also explore disconnected safe Table 1 : Overview of safe learning methods based on BO for time-varying problems.Handling Changes Safety Guarantee Optimality Guarantee Safe Seed in Time A-GOOSE [21, 17] Spatio-temporal kernel ✓ ✗ For all t C-SAFEOPT [8] Spatio-temporal kernel ✓ ✗ For all t ETSAFEOPT [22] Event detection ✗ ✗ For all t TVSAFEOPT (ours) Spatio-temporal kernel ✓ ✓ For initial t regions [11, 12] and enhance information-theoretic efficiency [13, 14] . They have been applied to controller tuning for a ball-screw drive [15] and quadrupeds [16] , and adaptive control on a rotational motion system [17] . However, SBO typically does not take into account changes with time.Contextual Bayesian Optimization Contextual Bayesian Optimization (CBO) has been introduced to address the influence of external environmental factors on reward and safety functions. Krause and Ong [18] extend the Gaussian Process Upper Confidence Bound (GP-UCB) algorithm [19] by incorporating contextual variables into unconstrained BO, demonstrating sub-linear regret analogous to GP-UCB. An advancement of this framework is proposed in [20] , with the Safe Contextual GP-UCB optimizing the contextual upper confidence bound within a safe set to manage room temperature via a PID controller. Berkenkamp et al. [8] present a contextual adaptation of SAFEOPT, discussing its safety and optimality guarantees by framing contextual SBO as distinct SBO sub-problems. Additionally, König et al. [21] extends GOOSE [10] to the contextual domain for model-free adaptive control scenarios. Similarly to SBO, CBO does not explicitly consider time-varying problems.Time-Varying Bayesian Optimization Time-Varying Bayesian Optimization (TVBO) addresses problems where the objective is time-dependent, modeled with a temporal kernel [23] . Methods in this setting include periodical resetting [23] , change detection [24, 25] , sliding-window approaches using recent data [26] , and discounting via exponentially decaying past observations [27] . However, these techniques have been developed for unconstrained BO and are unsuitable for safety-critical applications.Time-Varying Safe Bayesian Optimization In the safety-critical time-varying setting, contextual lower confidence bounds can be optimized within the safe set [20] , but it does not guarantee optimality theoretically. An event triggering mechanism is introduced to SBO to restart exploration from a backup policy [22] , but it may not trigger reliably during changes, posing a safety risk. Extensions to SBO with contextual variables provide theoretical safety and optimality analyses [8, 16] , treating contextual SBO as separate sub-problems for each contextual value, and assuming an initial safe set for each. However, ensuring optimality requires each contextual value to appear frequently, which is impractical in time-varying scenarios.Methodology We propose the TVSAFEOPT algorithm to optimize an unknown time-varying reward subject to unknown time-varying safety constraints. The algorithm focuses on Time-Varying Safe Bayesian Optimization (TVSBO). TVSAFEOPT utilizes a spatio-temporal kernel and time Lipschitz constants as prior knowledge about how the problem depends on time. The temporal part of the kernel encodes the continuity of the functions with time while the Lipschitz constants explicitly provide upper bounds on how fast the functions may change. Instead of considering safe sets at previous iteration as safe at the current iteration, which might lead to unsafe decisions, TVSAFEOPT robustly subtracts the safety margin when updating the safe sets (Figure 1 ). In this way, the algorithm is capable of adapting in real time and guarantees safety even when exploring the safe region of non-stationary problems.Contributions Our contributions are threefold: a) We propose the TVSAFEOPT algorithm based on Gaussian processes with spatio-temporal kernels; b) We provide formal safety guarantees for TVSAFEOPT in the most general time-varying setting and optimality guarantees for TVSAFEOPT for locally stationary optimization problems; c) We show TVSAFEOPT performs well in the most general time-varying setting both on synthetic data and on a realistic case study on gas compressors. In Table 1 , we compare Adaptive GOOSE, Contextual SAFEOPT, ETSAFEOPT, and TVSAFEOPT in terms of how they handle changes in time, safety guarantees, optimality guarantees, and required safe seeds.The TVSAFEOPT algorithm proposed in this paper extends the state of the art in Time-Varying Safe Bayesian Optimization by enabling solving optimization problems with time-varying reward and constraints without pre-defining the time changes that can be compensated.Thus, the algorithm can be used at the design stage of operating strategies for safety-critical systems, such as medical dosage design [28] and controller design in robotics [17] , or during online operation of chemical plants [29] or autonomous racing [30] .Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?Answer: [Yes] Justification: The paper set out to solve the problem of optimizing an unknown time-varying reward subject to unknown time-varying safety constraints, as stated in the Abstract and the Introduction (Section 1). In a partial fulfilment of this goal, the paper develops a safe learning algorithm and provides safety guarantees for a general time-varying case, and near-optimality guarantees for when the time-varying problem becomes stationary.• The answer NA means that the abstract and introduction do not include the claims made in the paper. • The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers. • The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings. • It is fine to include aspirational goals as motivation as long as it is clear that these goals are not attained by the paper. 
tvsafeopt algorithm: 
 The TVSAFEOPT algorithm builds upon SAFEOPT [7] , to handle time-varying reward function and safety functions. The key new feature of TVSAFEOPT is its capability of safely transferring the current safe set to the next time step. TVSAFEOPT achieves this with the help of the spatio-temporal kernel as well as the sequence of time Lipschitz constants. The approach is summarized in Algorithm 1.Following [8] , we incorporate the reward and safety functions into an auxiliary function h : X × T × I → R, whereEQUATIONWe model the auxiliary function using a prior Gaussian Process (GP) with zero mean and spatiotemporal kernel κ : (X × T × I) × (X × T × I) → R, [31] . We require h to be Lipschitz continuous with respect to both x and t, and to have bounded norm in the Reproducing Kernel Hilbert Space (RKHS) [32] associated with the kernel κ as formalized in the following.Assumption 2.1. The spatio-temporal kernel is positive definite, and satisfies κ ((x, t, i), (x, t, i)) ≤ 1, for all x ∈ X , t ∈ T , i ∈ I. The function h(x, t, i) has bounded norm in the RKHS associated with kernel κ. The function h(x, t, i) is L x -Lipschitz continuous with respect to x in the domain X with respect to some metric d : X × X → R ≥0 for all t ∈ N, i ∈ I. There exists a sequence {L(t)} t∈N,t<T , such that, for all x ∈ X , i ∈ I, t ∈ N, t < T , |h(x, t + 1, i) -h(x, t, i)| ≤ L(t).At each algorithm iteration k, we make a decision x k , which we then apply to the system and get noisy measurements y i k of the reward function and safety functions during the iteration. We use the index k to refer to the algorithm iteration. Even though k and t might differ in principle, in practice we run one algorithm iteration k for each time step t. Assumption 2.2. Observations y i k = h(x k , t, i) + ε i k , ∀i ∈ I, t ∈ N are perturbed by i.i.d. zero mean and σ-sub-Gaussian noise.Based on the measurements, we compute the posterior GP and make the decision for the next time step. To start the exploration, an initial set of safe decisions is assumed to be available to the algorithm. To ensure that the safe set remains non-empty after the first iteration, it is necessary that the initial safety function values at every decision within the initial safe set are positive. Assumption 2.3. An initial set S 0 ⊆ X of safe decisions is known and for all decisions x ∈ S 0 , we have c i (x, 0) > 0, ∀i ∈ I c . Similar assumptions have also been made for the standard SAFEOPT algorithm [7] and are necessary to ensure feasibility of the exploration steps and to be able to identify new safe decision.To ensure safety, based on Assumption 2.1 and 2.2, we extend the definition of the confidence intervals from [7] so that, with high probability, they contain f and c i using the posterior GP estimate given the data sampled so far. The confidence intervals for h(x, t, i) given training samples until iteration k ≥ 1 are defined for all x ∈ X and for all i ∈ I asEQUATIONwhere β k is a scalar that determines the desired confidence interval, µ k-1 (x, i) and σ k-1 (x, i) are the posterior mean and standard deviation of h(x, t, i) inferred with D k , training samples till iteration k [31] . The probability of the true function value h lying within this interval depends on the choice of β k [8] . We provide more details for this choice in Section 2.4.We now construct a tighter confidence interval for h(x, t, i) by using the sequence {Q τ (x, i)} τ ≤k instead of Q k (x, i) alone. To this end, we recursively define for all x ∈ X and for all i ∈ I the intersectionEQUATIONwhere ⊕ denotes the Minkowski sum, C 0 (x, i) is [L(0), ∞) for all x ∈ S 0 , i ∈ I c and R otherwise.We use the lower bound l k (x, i) := min C k (x, i) and the upper boundEQUATION) further used to update the safe set as well as pick the next decision to explore.Based on the updated posterior and Lipschitz constants, we can update the safe set S k with the lower bounds l k and the previous safe set S k-1 asEQUATIONThe set S k contains decisions that with high probability fulfill the safety constraints given the GP confidence intervals and the Lipschitz constants. In contrast to SAFEOPT, the safe set of TVSAFEOPT is allowed to shrink to adapt to the potential change of the safe region given the time-varying setting. However, the safe set might even become empty after the update. This is either because the safe region indeed becomes empty or because the updated safe set conservatively excludes all decisions with a lower bound of some safety function below L to guarantee safety. In all these cases, if the updated safe set is empty, we terminate the algorithm.With the safe set updated, the next challenge is to trade off between exploitation and expansion of the safe region. As in the standard SAFEOPT, the potential maximizers are those decisions, for which the upper confidence bound of the reward function is higher than the largest lower confidence boundEQUATIONTo identify the potential expanders, G k , containing all decisions that could potentially expand the safe set, we first quantify the potential enlargement of the current safe set after sampling a new decision x.To do so, we define the functionEQUATIONwhere | • | refers to the cardinality of a set, and then updateEQUATIONAt iteration k, TVSAFEOPT selects a decision x k within the union of potential maximizers (7) and expanders (9) x k = arg maxEQUATIONwith w k from (5) . The objective of the greedy selection process in (10) is to take the most uncertain decision among the expanders G k and the maximizers M k . The decision x k is then applied to the system and after making observations of the reward and safety functions, y k := (y 0 k , y 1 k , . . . , y m k ), we add (x k , y k ) to the training samples.At any iteration, we can obtain an estimate for the current best decisions from xk = arg maxEQUATIONwhich returns the maximizer of the lower bound of the reward function within the current safe set.Algorithm 1 TVSAFEOPT 1: Input: Sample set X GP priors for f , c i Lipschitz constants L x and {L(t)} t∈N,t<T Safe set seed S 0 2: C 0 (x, i) ← [L(0), ∞), for all x ∈ S 0 , i ∈ I c 3: C 0 (x, i) ← R, for all x ∈ X \S 0 , i ∈ I c 4: C 0 (x, 0) ← R 5: Query a point x 0 ∈ S 0 , y i 0 ← h(x 0 , 0, i) + ε i 0 , i ∈ I 6: D 0 = {(x 0 , y 0 )} 7: for k = 1, 2, • • • , T do 8: Calculate Q k (x, i) as in (3), ∀x ∈ X , ∀i ∈ I 9: C k (x, i) ← (C k-1 (x, i) ⊕ [-L(t -1), L(t -1)]) ∩ Q k (x, i) 10: S k ← ∩ i∈Ic ∪ x∈St-1 {x ′ ∈ X | l k (x, i) -L x d(x, x ′ ) -L(t) ≥ 0} 11: if S k = ∅ then 12: break 13: end if 14: M k ← {x ∈ S k | u k (x, 0) ≥ max x ′ ∈S k l k (x ′ , 0)} 15: G k ← {x ∈ S k | e k (x) > 0} with e k (x) from (8) 16: x k ← arg max x∈G k ∪M k ,i∈I w k (x, i) 17: y i k ← h(x k , t, i) + ε i k , i ∈ I 18: D k = D k-1 ∪ {(x k , y k )} 19: end for 2.In many safety critical real world applications, such as nuclear power plant operations, medical devices calibration, automated emergency response systems, the reward function is stationary most of the time. The problems are stationary until some changes happen and become stationary again when the systems reach new equilibria [34] . However, ensuring optimality is non-trivial even when the problem becomes stationary. Suppose the auxiliary function (2) becomes stationary in a time intervalEQUATION)We first define the largest safe set expanded from a set S subject to a measurement error a within • a single time step:R a (S) := S ∪ {x ∈ X | ∀i ∈ I c , ∃x ′ i ∈ S, s.t. ci (x ′ i ) -L x d(x, x ′ i ) -a ≥ 0} • n time steps: R n a (S) := R a (R a . . . R a (R a n times (S)) . . . )• arbitrary time steps:Ra (S) := lim n→∞ R n a (S)We also define Lt as an upper bound of the sum of all time Lipschitz constants, that is,T -1 τ =0 L(τ ) ≤ Lt .We find it reasonable that a tight upper bound Lt can be provided when the underlying system slowly switches to the new stationarity condition.Given these definitions, we are now in the position to provide optimality guarantees for TVSAFEOPT.In particular, we aim at comparing the found reward value f (x k ) with the optimal reward value within the largest safe set obtained in ideal conditions with no measurement error, R0 (S 0 ). We also aim at providing TVSAFEOPT with an upper bound on the iterations needed to find a near-optimal solution. The following theorem states the optimality guarantee of TVSAFEOPT.Theorem 2.6. Let Assumptions 2.1 -2.3 hold, let γ h k be defined as in (12) and, for any δ ∈ (0, 1), let (11) , and, for any ϵ > 0, let k * (ϵ, δ) be the smallest positive integer satisfying√ β k = B + σ 2 γ h k•|I| + 1 + ln(1/δ) . Define xk as ink * β k * γ h k * ≥ b 1 R0 (S 0 ) + 1 ϵ 2 ,where b 1 = 8/ log 1 + σ -2 . Then, the TVSAFEOPT algorithm, applied to (13) , guarantees that, with probability at least 1 -δ, there exists k ≤ k * such thatf (x k ) ≥ max x∈ Rϵ+ Lt (S0) f (x) -ϵ.The proof consists in showing a decaying upper bound of uncertainty w k (x, i) ≤ ϵ and exploiting local stationarity of ( 13) to provide bounds on the expansion of the safe set S k . Details can be found in Appendix C. The ratio between the number of unsafe decisions in the safe sets and the cardinality of the safe sets, (c): The ratio between the number of safe decisions in the safe sets and the cardinality of the ground truth safe regions. TVSAFEOPT robustly shrinks its safe sets based on its observations and thus maintains much less violations in its safe sets than SAFEOPT and approximate optimization, at the cost of covering less of the ground truth safe region.3 ExperimentsQuestion: Does the paper discuss the limitations of the work performed by the authors?Answer: [Yes]Justification: The paper contains a separate section on limitations, see Section 4Guidelines:• The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper. • The authors are encouraged to create a separate "Limitations" section in their paper.• The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be. • The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on a few datasets or with a few runs. In general, empirical results often depend on implicit assumptions, which should be articulated. • The authors should reflect on the factors that influence the performance of the approach.For example, a facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or a speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon. • The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size. • If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness. • While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an important role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations. 
synthetic example: 
 We first illustrate TVSAFEOPT on a synthetic two-dimensional time-varying optimization problemmax x,y -e x 2 -log(1 + y 2 ) + 0.01t s.t. x + 0.5 -0.5 1 -cos 2π 50 t cos π 6 2 + y -0.3 -0.5 1 -cos 2π 50 t sin π 6 2 ≤ 1.Figure 1 compares the safe sets computed by TVSAFEOPT, ETSAFEOPT, and SAFEOPT at t = 30, t = 100 and t = 170. All algorithms start from the same singleton initial safe set S 0 = {(-0.5, 0.0)}. Implementation details are described in Appendix A. Figure 1 illustrates that the safe sets computed by TVSAFEOPT are contained in the ground truth safe regions while those computed by SAFEOPT and ETSAFEOPT have multiple violations. Due to the dependence on time of the example (Figure 3 ), the initial safe set becomes unsafe at t = 30, and t = 170. Taking the possible changes in time into consideration, TVSAFEOPT correctly identifies the possible unsafety of the initial safe set. In contrast, SAFEOPT always consider the initial safe set to be safe. Meanwhile, ETSAFEOPT correctly identifies the lack of safety of the initial safe set at t = 30, but fails at t = 170. This is because the event trigger is naturally insensitive to continuous changes. This toy example indicates that, in contrast to SAFEOPT and ETSAFEOPT, TVSAFEOPT safely adapts to the time changes of the optimization problem.In this example, TVSAFEOPT and ETSAFEOPT overall find better reward function values than SAFEOPT, see Figure 3 . The reward function value found by TVSAFEOPT is close to the optimal values when the reward function changes slowly, which supports Theorem 2.6.Quantitative metrics are listed in Table 2 . Taking SAFEOPT as a baseline, TVSAFEOPT and ETSAFEOPT achieves less violations, lower cumulative regret at the cost of covering less part of the safe region. Furthermore, TVSAFEOPT has little violations, and achieves larger coverage ratio than ETSAFEOPT. Meanwhile, its cumulative regret is just slightly higher than that of ETSAFEOPT.We show the performance of the proposed algorithm in a compressor station with three identical compressors operating in parallel at the time-varying compressor head H t with time-varying power consumption at time t (adapted from [35] , details in Appendix A.3) EQUATIONEQUATIONEQUATIONEQUATIONwhere the objective ( 14) corresponds to the power to run the station with N compressors, here N = 3, affected by individual degradation d it , i = 1, l . . . , N . The station must also satisfy time-varying demand M t in (15) . In practice, it is common to linearly approximate ( 16)-( 17) with respect to the compressor head H t (dashed lines in Figure 4 ) [36] .We compare the performance of TVSAFEOPT, SAFEOPT, and approximate optimization.ETSAFEOPT is not applicable to this case study because the magnitude of changes in the demand M t , compressor head H t , and degradation d it keeps triggering the event trigger and thus the maintained safe set becomes empty very quickly. Implementation details are described in Appendix A. Figure 2 compares the number of unsafe decisions in the safe sets calculated by TVSAFEOPT, SAFEOPT, and approximate optimization. We see that, by considering the uncertainty with respect to the decision variables, SAFEOPT maintains fewer unsafe decisions in its safe sets than the approximate optimization. However, SAFEOPT tends to expand its safe sets regardless of external changes. TVSAFEOPT further improves this based on SAFEOPT by taking into consideration the time-varying safety functions. TVSAFEOPT robustly shrinks its safe sets based on its observations and thus maintains much less violations in its safe sets than SAFEOPT (70.4%) and approximate optimization (96.8%). It achieves this at the cost of covering less of the ground truth safe region than SAFEOPT (39.3%) and Approximate Optimization (61.0%).The right-hand side of Figure 3 shows that TVSAFEOPT preserves safety at the expense of optimality.In the compressor case study, TVSAFEOPT overall finds lower reward function values than SAFEOPT and approximate optimization, which is consistent with the fact that it covers a lower fraction of the 14)), with error bars, with respect to the optimal values (black). In the synthetic example, TVSAFEOPT finds better reward function values than SAFEOPT, and similar to these of ETSAFEOPT. In the compressor case study, TVSAFEOPT finds lower reward function values than SAFEOPT, but guarantees fewer violations (Table 2 and 3 ) than either SAFEOPT or Approximate Optimization.ground truth safe regions and the reward function changes significantly between iterations. Because of its strong focus on safety, TVSAFEOPT deviates more from the ground truth. The cumulative regret of TVSAFEOPT is above the one of SAFEOPT by 42.1%, and the one of approximate optimization by 178.3%. This illustrates the trade-off between safety and optimality in the presence of strong uncertainties due to the varying reward and safety constraints. Quantitative metrics using Approximate Optimization as the baseline are listed in Table 3 .Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?Answer: [Yes]Justification: The paper provides the necessary assumptions in Section 2.1, the definitions in Section 2, and proofs in Appendices B and C.Guidelines:• The answer NA means that the paper does not include theoretical results.• All the theorems, formulas, and proofs in the paper should be numbered and crossreferenced. • All assumptions should be clearly stated or referenced in the statement of any theorems.• The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch to provide intuition. • Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material. • Theorems and Lemmas that the proof relies upon should be properly referenced. 
safety guarantee: 
 To provide safety guarantees, we need the confidence intervals in (3) to contain the safety functions with high probability for all iterations. Note that the parameter β k in (3) tunes the tightness of the confidence interval. The following lemma guides us to make a proper choice for β k : This choice depends on the information capacity γ h k associated with the kernel κ, namely is the maximal mutual information [33] we can obtain from the GP model of h through k noisy measurements ĥX k at data pointsEQUATION)Lemma 2.4. Assume that h(x, t, i) has RKHS norm associated with κ bounded by B > 0 and that measurements are perturbed by σ-sub-Gaussian noise. Let the variable γ h k be defined as in (12) . For any δ ∈ (0, 1), let√ β k = B + σ 2 γ h k•|I| + 1 + ln(1/δ), then the following holds for all decisions x ∈ X , function indices i ∈ I, and iterations k ≥ 1 jointly with probability at least 1 -δ:|h(x, t, i) -µ k-1 (x, i)| ≤ β k σ k-1 (x, i).Proof. This lemma is a straightforward consequence of Lemma 1 of [16] , a contextual extension of Lemma 4.1 of [8] . We can prove it by selecting time as the context and picking {t} t≥1,t∈N as the context sequence. Lemma 2.4 indicates that, by selecting β k properly, the confidence intervals Q k will w.h.p. contain the reward function and the safety functions. Due to this, they can be leveraged to provide theoretical guarantees for safety and optimality.The following theorem provides a sufficient condition for safety of TVSAFEOPT. Theorem 2.5. Let Assumptions 2.1 -2.3 hold, and let γ h k be defined as in (12) . For any δ ∈ (0, 1),let √ β k = B + σ 2 γ h k•|I| + 1 + ln(1/δ), then TVSAFEOPT guarantees that with probability at least 1 -δ, for all i ∈ I c and for all t ≥ 0, and x ∈ S k it holds c i (x, t) ≥ 0.The proof builds on Lemma 2.4 to show first that for all t ≥ 0, for all i ∈ I and for all x ∈ X , then h(x, t, i) ∈ C k (x, i) with high probability. Then using the recursive definition of the safe set from (6), we obtain w.h.p. c i (x, t) ≥ l k (x ′ , i) -L x d(x, x ′ ) -L(t) ≥ 0, which concludes the proof. For details we refer the reader to Appendix B.Limitations The compressor case study demonstrated that TVSAFEOPT ensures safety at the expense of optimality if the stationarity assumption is not satisfied. The assumption about the local stationarity of the optimization problem (1) is thus the main limitation. Even though TVSAFEOPT demonstrates good empirical performance with respect to safety even when the problem is non-stationary, theoretical guarantee for its near-optimality in the non-stationary case warrant further investigation.The need for obtaining the Lipschitz constants with respect to both x and t in order to compute the safe set S k in (6) may prove limiting in real applications. To overcome this limitation, we propose practical modifications in Appendix A.1.Conclusions We propose TVSAFEOPT algorithm, which extends SAFEOPT to handle time-varying optimization problems. In conclusion, TVSAFEOPT outperforms SAFEOPT in terms of adaptation to changes in time and maintains fewer unsafe decisions in its safe sets for time-varying problems. This is at the cost of covering less of the ground truth safe regions and may lead to poorer performance in terms of optimality.We prove the safety guarantee for TVSAFEOPT in the general time-varying setting and prove its near-optimality guarantee for the case in which the optimization problem becomes stationary. The two theoretical results together guarantee that TVSAFEOPT is capable of safely transferring safety of the decisions into the future and, based on the transferred safe sets, it will find the near-optimal decision when the reward function stops changing. We show that TVSAFEOPT performs well in practice for the most general settings where both the reward function and the safety constraint are time-varying, both on synthetic data and for real case study on a gas compressor.for writing, revisions, and the compressor case study. Alisa Rupenyan acknowledges also support from the Johann Jakob Rieter foundation.Experiments are conducted on an Intel i7-11370H CPU using Python 3.8.5. The implementation utilizes the following libraries: GPy 1.12.0, NumPy 1.22.0, and Matplotlib 3.5.0.In practice, Lipschitz constants are difficult to estimate. Thus, here we provide a Lipschitz-constantfree version of TVSAFEOPT algorithm by modifying ( 6) and (8) .The safe set is updated as all decisions with non-negative lower confidence bounds for the safety functions at the current iteration k, that is,EQUATIONFurthermore, the expanders are intuitively defined as decisions within the current safe set such that, by evaluating any of the decisions, at least one decision outside the current safe set will be considered as safe, that is,G k = {x ∈ S k | e k (x) > 0}, where e k (x) denotes the number of decisions outside S k that will be considered safe when evaluating x. Instead of using Lipschitz constants, we define e k (x) using lower bound of auxiliary GP similar to the method by Berkenkamp et al. [37] ek (x) = x ′ ∈ D\S k | ∃i ∈ I c : l k,(x,u k (x,i)) (x ′ , k + 1, i) ≥ 0 ,where l k,(x,u k (x,i)) (x ′ , k + 1, i) denotes the lower bound of the function values at x and t = k + 1 if x is evaluated at the k-th iteration and the upper bound is observed.The search space is X = [-2, 2] 2 , uniformly quantized into 100 × 100 points. Both algorithms start with the singleton initial safe set {(-0.5, 0.0)}. The measurements are perturbed by i.i.d. Gaussian noise N (0, 0.01 2 ).The reward function is formulated as: f (x, t) = -e x 2 -log(1 + y 2 ) + 0.01t;The safety function is formulated as: c 1 (x, t) = 1 -x + 0.5 -0.5 1 -cos 2π 50 t cos π The hyperparameters of GPs in the synthetic case study are modelled as follows,• TVSAFEOPT: The reward function and the safety function are modeled by independent GPs with zero mean and spatio-temporal kernel κ((x, t), (x′ , t ′ )) = exp - ∥x-x ′ ∥ 2 2 2σ 2 1 • exp -( t-t ′ ) 2 2σ 2 2, where σ 1 ≡ 1.0, σ 2 = 25.0 for f , and σ 2 = 15.0 for c 1 .• SAFEOPT: The reward function and the safety function are modeled by independent GPs with zero mean and 2d Gaussian kernel κ(x,EQUATION, where σ 3 ≡ 1.0.• ETSAFEOPT: Hyperparameters for GPs are the same as SAFEOPT. Besides, we choose the sentivity of the event trigger δ as 0.01.Centrifugal compressors are often used in gas transport networks to deliver the required amount of gas by boosting the pressure in the pipelines. Organised as compressor stations with N units, the compressors are often operated to minimise their power consumption P while satisfying the demand M t and operating constraints, capturing how compressor head H t depends on the mass flow through the compressor [38, 39] :• mi = mi-157.4 34.37 , Ht = Ht-1.016e5 3.210e4 , α 1 = 1.979e7, α 2 = 5.274e6, α 3 = 5.375e6, α 4 = 6.055e5, α 5 = 5.718e5, α 6 = 3.319e5• Ht = Ht-1.235e53.764e4 , β 1 = -1.953, β 2 = 16.86, β 3 = 118.1 • Ht = Ht-6.152e4, γ 1 = -1.516, γ 2 = -11.12, γ 3 = 116.9• Ht = Ht-8.706e4 5.289e4 , δ 1 = 73.21, δ 2 = 183.7 • Ht = Ht-1.572e52.044e4 , σ 1 = -7.260, σ 2 = -29.65, σ 3 = 204.4The compressor case study has been adapted from [35] . The data for the demand, compressor head, and degradation for the three compressors were obtained from [40] (Creative Commons Attribution NonCommercial Licence).Individual characteristics of compressors in ( 16)-( 17) are called compressor maps (Figure 4 ). The operating area for a compressor is defined by minimal and maximal speed of the compressor and its mechanical properties. The operating area can be obtained from compressors maps delivered by the manufacturer of the compressor, or estimated during the operation [41] . However, estimation would require collecting datapoints close to the boundary of the operating area, which may be unavailable due to safety consideration [42, 43] . Using safe learning has the potential to improve the operation of the station because it enables safe exploration of the unknown operating area of individual compressors.Max. speed app.Choke app.Min. speed app.Surge app.Figure 4 : Ground truth (solid) and linear approximation (dashed) of the operating area from compressor maps, adapted from [44, 35] . For a given compressor head at time t (dotted horizontal line for H t = 120000 J kg -1 ), the mass flow m it through the i-th compressor is required to be between minimum speed (red) and surge (blue) lines, and maximum speed (violet) and choke (yellow) lines Furthermore, varying operating conditions and demand often lead to compressor degradation d it (Figure 5 ), over time increasing power consumption ( 14) of the entire compressor station [45] .Capturing the time-varying aspect of compressor degradation is a subject of research (e.g. [46] [47] [48] ) but limited availability of measured degradation data presents a challenge [49] .For convenience, the optimization variables are scaled by a factor K = 200, that is, x = (m 1 , m 2 , m 3 )/K. The search space is X = [50.0/K, 250.0/K] 3 , uniformly quantized into 60 × 60 × 60 points. Both algorithms start with the singleton initial safe set {(M 0 , M 0 .M 0 )/3K}. The measurements are perturbed by i.i.d. Gaussian noise N (0, 0.01 2 ).The reward function is formulated as:f (x, t) = - 3 i=1 1 (1 -d it ) • 10 7 α 1 + α 2 mi + α 3 Ht + α 4 m2 i + α 5 mi Ht + α 6 H2 tThe safety functions are formulated as c i (x, t) ≥ 0, i = 1, . . . , 7, with: •• c 1 (x, t) = x 1 -L tc 2 (x, t) = U t -x 1 • c 3 (x, t) = x 2 -L t • c 4 (x, t) = U t -x 2 • c 5 (x, t) = x 3 -L t • c 6 (x, t) = U t -x 3 • c 7 (x, t) = x 1 + x 2 + x 3 -0.67M t /K, where L t = max{β 1 H2 t + β 2 Ht + β 3 , γ 1 H2 t + γ 2 Ht + γ 3 }/K, U t = min{δ 1 Ht + δ 2 , σ 1 H2 t + σ 2 Ht + σ 3 }/K.The hyperparameters of GPs in the compressor case study are modelled as follows,• TVSAFEOPT: The reward function and the safety functions are modeled by independent GPs with zero mean and spatio-temporal kernel κ((x, t), (x′ , t ′ )) = exp - ∥x-x ′ ∥ 2 2 2σ 2 1 • exp -( t-t ′ ) 2 2σ 2 2, where σ 1 ≡ 1.0, σ 2 = 80.0 for f and c 1 -c 6 , and σ 2 = 70.0 for c 7 .• SAFEOPT: The reward function and the safety functions are modeled by independent GPs with zero mean and 3d Gaussian kernel κ(x,x ′ ) = exp - ∥x-x ′ ∥ 2 2 2σ 2 3, where σ 3 ≡ 1.0.As for approximate optimization, the r.h.s. of ( 16) -( 17) are linearly approximated as follows:• Surge line:β 1 H2 t + β 2 Ht + β 3 ≈ 4.481e -4 • H t + 59.76 • Min. speed line: γ 1 H2 t + γ 2 Ht + γ 3 ≈ -1.333e -3 • H t + 193.3 • Choke line: δ 1 Ht + δ 2 ≈ 1.611e -3 • H t + 46.77 • Max. speed line: σ 1 H2 t + σ 2 Ht + σ 3 ≈ -1.667e -3 • H t + 461.7The proof of near optimality consists in two parts: i) bounding the uncertainty and ii) bounding the expansion of the safe set.We first derive a decaying upper bound of uncertainty for TVSAFEOPT. In this way we can ensure the uncertainty of the reward function and safety functions to drop below a desired threshold. Lemma C.1. Define b 1 := 8/ log 1 + σ -2 ∈ R, and γ h k as in (12) . For any k > k 0 ≥ 1, there exists k ′ ∈ (k 0 , k], such that the following holds for all i ∈ I: Corollary C.2. Given b 1 := 8/ log 1 + σ -2 ∈ R, take T k as the smallest positive integer satisfyingEQUATIONEQUATIONT k β k+T k γ h k+T k ≥ b1 ϵ 2 . Then, there exists k ′ ∈ (k, k + T k ], such that for any x ∈ G k ′ ∪ M k ′ ,and for all i ∈ I it holds that w k ′ (x, i) ≤ ϵ.All following lemmas hold for any δ ∈ (0, 1), ϵ > 0 and S 0 , such that ∅ ⊊ S 0 ⊆ X .To facilitate the theoretical analysis, we define ∀x ∈ X , ∀i ∈ I:EQUATIONRemember that, from (4), we can derive ∀x ∈ X , ∀i ∈ I:EQUATIONTherefore, lk can be viewed as updating l k with L(t) ≡ 0. With a slight abuse of notation, we omit arguments x and i when not ambiguous.Lemma C.3. The following holds for any k ≥ 1, ∀x ∈ X , ∀i ∈ I:(i) l k (x, i) ≥ l k-1 (x, i) -L(t -1) (ii) lk (x, i) ≥ lk-1 (x, i) (iii) l k (x, i) ≤ lk (x, i) (iv) lk (x, i) -Lt ≤ l k (x, i)Proof.(i) Direct consequence of (20) .(ii) Direct consequence of (19) .(iii) We proceed by induction. Suppose l τ ≤ lτ , then l τ -L(τ ) ≤ lτ , thus according to (20) ,l τ +1 = max{l τ -L(τ ), µ τ -β 1/2 τ +1 σ τ } ≤ max{ lτ , µ τ -β 1/2 τ +1 σ τ } = lτ+1 , from which it follows l k (x, i) ≤ lk (x, i).(iv) We proceed by induction. Suppose l τ ≥ lτ -τ -1 k=0 L(k). If µ τ -β 1/2 τ +1 σ τ > lτ , then l τ +1 (20) = µ τ -β 1/2 τ +1 σ τ (19) = lτ+1 ≥ lτ+1 - τ k=0 L(k). If µ τ -β 1/2 τ +1 σ τ < l τ -L(τ ), then l τ +1 (20) = l τ -L(τ ) ≥ lτ - τ -1 k=0 L(k) -L(τ ) = lτ+1 - τ k=0 L(k). Otherwise, l τ +1 (20) = µ τ -β 1/2 τ +1 σ τ ≥ l τ -L(τ ) ≥ lτ - τ -1 k=0 L(k) -L(τ ) = lτ+1 - τ k=0 L(k). To summarize, l k ≥ lk - t-1 k=0 L(k) ≥ lk -LtLemma C.3 allows us to define auxiliary safe sets based on lk such that they are contained in S k . Furthermore, due to the monotonicity of lk , we can prove the auxiliary safe sets never shrink, which will play a fundamental role in studying their convergence property and provide near-optimality guarantee of TVSAFEOPT.Based on (19) , we further define:S k := {x ∈ X | ∀i ∈ I c , ∃x ′ i ∈ S t-1 , s.t. lk (x ′ i , i) -L x d(x, x ′ i ) ≥ 0} S k := {x ∈ X | ∀i ∈ I c , ∃x ′ i ∈ S t-1 , s.t. lk (x ′ i , i) -L x d(x, x ′ i ) -Lt ≥ 0} S 0 = S 0 = S 0 Remember S k = {x ∈ X | ∀i ∈ I c , ∃x ′ i ∈ S t-1 , s.t. l k (x ′ i , i) -L x d(x, x ′ i ) -L(t) ≥ 0}. Thus, S k = S k = S k if and only if L(t) ≡ 0.The following lemma proves that S k never shrinks, and that S k and S k are a subset and a superset for S k , respectively. Lemma C.4. The following holds for any t ≥ 1: (ii) We proceed by induction. Suppose S τ ⊆ S τ ⊆ S τ .(i) S t-1 ⊆ S k (ii) S k ⊆ S k ⊆ S kFor all x ∈ S τ +1 , and for all i ∈ I c , there existsx ′ i ∈ S τ ⊆ S τ , s.t. lτ (x ′ i , i)-L x d(x, x ′ i ) ≥ l τ (x ′ i , i) -L x d(x, x ′ i ) -L(τ ) ≥ 0, hence x ∈ S τ +1as well. Therefore, S τ ⊆ S τ ∀τ . For all x ∈ S τ +1 , and for all i ∈ I c , there existsx ′ i ∈ S τ ⊆ S τ , s.t. l τ (x ′ i , i)-L x d(x, x ′ i )- L(τ ) ≥ lτ (x ′ i , i) - τ -1 k=0 L(k) -L x d(x, x ′ i ) -L(τ ) = lτ (x ′ i , i) -L x d(x, x ′ i ) - τ k=0 L(k) ≥ lτ (x ′ i , i) -L x d(x, x ′ i ) -Lt ≥ 0, thus x ∈ S τ +1. Therefore, S τ ⊆ S τ , ∀τ . From which we conclude S τ ⊆ S τ ⊆ S τ , ∀τ .Note: Where needed in the following lemmas, we assume b 1 and T k are defined as in Lemma C.1 and Corollary C.2 Lemma C.5 (Lemma 7.4 in [8] ).For any k ≥ 1, a > 0, if Ra (S 0 ) \S k ̸ = ∅, then R a (S k ) \S k ̸ = ∅.The following lemma provides a sufficient condition for the expansion of the auxiliary safe set S k . Lemma C.6. For any t ≥ 1, if RL t+ϵ (S 0 )\S k ̸ = ∅, then, with probability at least 1 -δ, it holds that S k+T k ⊋ S k .Similar to the proof of [8, Lemma 7.5] . By Lemma C.5, we get that, RL t+ϵ (S k ) \S k ̸ = ∅. Equivalently, ∃x ∈ RL t+ϵ (S k ) \S k which implies that, for all i ∈ I c , We will first show that ∃k ∃z i ∈ S k : ci (z i ) -L x d(z i , x) -Lt -ϵ ≥ 0′ ∈ (k, k + T k ], s.t. f (x k ′ ) ≥ f (x * k ′ ) -ϵ. Assume, to the contrary, that ∀k ′ ∈ (k, k + T k ], f (x k ′ ) < f (x * k ′ ) -ϵ Then, we have, ∃k ′ ∈ (k, k + T k ] l t ′ (x * k ′ , 0) (d) ≤ l k ′ (x k ′ , 0) (e) ≤ f (x k ′ ) < f (x * k ′ ) -ϵ (f ) ≤ l k ′ (x * k ′ , 0),* k ′ ∈ M k ′ Finally, RL t +ϵ (S 0 ) ⊆ S k ′ ⊆ S k ′ , by Lemma C.6 and Lemma C.4 (ii). Therefore, ∃ k ′ ∈ (k, k + T k ] such that max x∈ R Lt +ϵ (S0) f (x) -ϵ ≤ max x∈S k ′ f (x) -ϵ = f (x * k ′ ) -ϵ ≤ f (x k ′ ) C.3In this work, we focus on safety critical systems where satisfying the safety constraints has highest priority over finding the optima. Through pessimistically considering change with time in the decisionmaking process, TVSAFEOPT emphasizes safety in non-stationary conditions at the inevitable expense of optimality. In practice, such sacrifice on optimality can be alleviated by tighter bound of rate of change.Besides, in the case where safety can be to some extent comprised, which is beyond the focus of this work, constrained BO and its time-varying extension would be a more suitable method to apply. We refer the readers to [50, 51] for further information.Explicit considering time can be viewed roughly as adding dimension by 1, Therefore, TVSAFEOPT achieves time adaptation without adding much computational cost. With the increase in dimensionality of the problem, safety constraints might arise across multiple dimensions, from multiple directions at the price of optimality. As our approach is suitable for safety critical conditions, the focus is put on maintaining safety under change, therefore safety considerations "dictate" the optima. Additionally, in practice, the safety functions are modeled independently with a GP, and thus the computational cost scales linearly with the number of constraints.Question: Does the paper fully disclose all the information needed to reproduce the main experimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?Answer: [Yes] Justification: The paper provides the necessary information in Section 3 and the background details are in Appendix A. In particular, the modifications necessary for practical implementation of the proposed algorithm, for example regarding the Lipschitz constants, are provided in Appendix A.1 and the hyperparameters for the examples are in Appendix A.2 and Appendix A.3.• The answer NA means that the paper does not include experiments.• If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not. • If the contribution is a dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable. • Depending on the contribution, reproducibility can be accomplished in various ways.For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed. • While NeurIPS does not require releasing code, the conference does require all submissions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. (d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reproducibility.In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results. 
open access to data and code: 
 Question: Does the paper provide open access to the data and code, with sufficient instructions to faithfully reproduce the main experimental results, as described in supplemental material?Answer: [Yes]Justification: The paper provides the details necessary to reproduce the simulational results in Appendix A. The code accompanying the paper is currently under review and will appear shortly at https://www.research-collection.ethz.ch/.Guidelines:• The answer NA means that paper does not include experiments requiring code. • Providing as much information as possible in supplemental material (appended to the paper) is recommended, but including URLs to data and code is permitted. 
experimental setting/details: 
 Question: Does the paper specify all the training and test details (e.g., data splits, hyperparameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?Answer: [Yes]Justification: The paper provides the necessary information in Section 3 and the background details are in Appendix A. In particular, the modifications necessary for practical implementation of the proposed algorithm, for example regarding the Lipschitz constants, are provided in Appendix A.1 and the hyperparameters for the examples are in Appendix A.2 and Appendix A.3.Guidelines:• The answer NA means that the paper does not include experiments.• The experimental setting should be presented in the core of the paper to a level of detail that is necessary to appreciate the results and make sense of them. • The full details can be provided either with the code, in appendix, or as supplemental material. 
experiment statistical significance: 
 Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?• If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswithcode.com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of a dataset. • For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided. • If this information is not available online, the authors are encouraged to reach out to the asset's creators. 
new assets: 
 Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?Answer: [NA]Justification: The paper does not introduce additional assets.Guidelines:• The answer NA means that the paper does not release new assets.• Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc. • The paper should discuss whether and how consent was obtained from people whose asset is used. • At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file. 
crowdsourcing and research with human subjects: 
 Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?Answer: [NA]Justification: The paper uses neither crowdsourcing nor human subjects.Guidelines:• The answer NA means that the paper does not involve crowdsourcing nor research with human subjects. • Including this information in the supplemental material is fine, but if the main contribution of the paper involves human subjects, then as much detail as possible should be included in the main paper. • According to the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector. 
institutional review board (irb) approvals or equivalent for research with human subjects: 
 Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?Answer: [NA]Justification: The paper does not use human subjects.Guidelines:• The answer NA means that the paper does not involve crowdsourcing nor research with human subjects. • Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper. 
 
 Appendix:  


Decision: This paper extends the SafeOpt algorithm for online safe optimization when the safety-critical system is time-varying. The authors provide theoretical analysis on safe optimization with a spatio-temporal kernel, together with synthetic experiments and a realistic case study with gas compressors.

The meta-reviewer agrees with all reviewers that the paper has reached the bar for NeurIPS. The AC would recommend the authors to improve the paper towards a camera-ready version based on the rebuttals and discussions.

Reviews: review: paper_summary: paper_summary: The paper introduces the TVSAFEOPT algorithm, which is based on Gaussian processes with spatio-temporal kernels, designed specifically for optimizing time-varying rewards under time-varying safety constraints. The algorithm provides formal safety guarantees in a general time-varying setting, ensuring safety even when exploring non-stationary safe regions. It robustly subtracts safety margins to prevent unsafe decisions, adapting in real-time to changing environments. Furthermore, they provide optimality guarantees for locally stationary optimization problems, ensuring near-optimal solutions when the optimization problem becomes stationary.
strength_weakness: strength_weakness: They extend the Safeopt algorithm from literature. However, it is clear on what are the additional contributions and difference between these two different approaches.
questions: questions: -
limitations: limitations: -
paper_summary: paper_summary: This paper presents a safe Bayesian optimization algorithm TVSAFEOPT with a spatial-temporal kernel and time Lipschitz constants, which improves on SAFEOPT with time-varying reward and safety constraints. The optimality guarantee is proved for the stationary case and the safety guarantee for more general settings. The method is tested on a synthetic problem and gas compressors.
strength_weakness: strength_weakness: 1. More discussion on how to make a tradeoff between optimality and safety is encouraged. 
2. Will this conservatism in safety become too large in high-dimensional problems?
2. The method to choose the proper initial safe set and kernel parameters is unclear.
questions: questions: 1. How to find an initial safe set for complex problems?
2. How to find the kernel parameter for each task?
2. What is the computational complexity compared to other BO baselines?
limitations: limitations: The societal impact is discussed.
paper_summary: paper_summary: The authors propose a time-varying extension of SAFEOPT to overcome the problems of time-varying rewards under time-varying safety constraints.

Under stationarity conditions, optimality guarantees are provided and the numerical simluation shows a (favorable) comparison to the SAFEOPT.
strength_weakness: strength_weakness: 1. *Some delineation to related work seems rather vague and requires stronger justification.* An example for TVSBO: the time-variable and temporal aspect of the kernel can just as well be interpreted as context using existing results. Perhaps a table would help here to highlight key aspects. 

2. *Lack of real-world data experiments and comparison to related work.* To support the downsides of existing approaches, an empirical comparison to existing TVSBO approaches mentioned in the related work section would be needed.

3. The *empirical results could be more convincing* by adding a variety of initial safe sets and revised plots. The current plots/results are hard to parse. 

4. It would be beneficial if the *theoretical/technical challenge of extending safety to the time-varying case were more detailed*. This would streamline the presentation and help in assessing the impact of the contribution.
questions: questions: 1. *In the Appendix, a spatio-temporal SE kernel is introduced. How is this construction different from using an SE-ARD kernel with a composite variable $z = [x^T,t]^T$?* If I am not mistaken, for the SE-ARD kernel there would be no different than defining a single kernel with $z$. 

2. It is mentioned that the Lipschitz constants are to be known beforehand. However, while commonly assumed, *how do you get a hold of an RKHS norm bound $B$ (related to Assumption 2.1) to compute the UCB?* 

3. *Could you provide Figure 1 sooner in the manuscript?* It would be super helpful to see this central illustration already on page 2.
limitations: limitations: 1. Practicality of the safety guarantee: requiring many Lipschitz constants for both for space and time while also requiring an RKHS norm bound.

2. Theoretical and empirical impact: Lack of comparisons to TVSBO approaches makes the implications of the contribution unclear both theoretically and empirically.

Comments: title: Response to authors
Reviewer Reply for Submission20789 by Reviewer yo4J
comment: Thanks for the clarifications. I would like to maintain my score
Thank you for the rebuttal. Based on the responses I am comfortable with my current score for this paper.
I thank the authors for the rebuttal and the answers to my questions and concerns, and also appreciate them including a table for related work.

Since I was already on the positive side in my initial review, so I prefer to keep my overall score with an increases in parts of evaluation.
Dear Program chairs,

It looks like our uploaded pdf and general answer is not visible to the reviewers. Could this be the case, and is it possible to make it visible?
I also saw this in other rebuttals which I am reviewing where there is a reference to a pdf but no pdf uploaded.

Thank you for your help.