PaperlayerView exact revision on arXiv

Source-linked AI summary

CSF: Contextual Safety Filtering for Motion Generators

Lizhi Yang, Yiling Hou, Yao Tang, Junheng Li, Daniel Weng, Blake Werner, Aaron D. Ames

arXiv:2610.12467v1cs.ROcs.LG

TL;DR

Text-conditioned motion generators can produce trackable motions but do not determine whether an action is safe in its scene. CSF uses generator-produced safe and unsafe references with a scene-selected CBF-QP; across four generators it reduces residual danger by up to 90% while preserving benign motion, and it is demonstrated on a Unitree G1.

  • Problem

    Trackable motion can still be inappropriate for its scene because nearly the same body motion may target a ball or a nearby person.

    Source: §I · p. 1

  • Method

    CSF uses natural-language rules and frozen-generator safe and unsafe references to define scene-selected affine safety margins enforced by a safe-reference tracking CBF-QP.

    Source: §I · pp. 1–2

  • Results

    Across four pretrained generators, residual danger falls by up to 90%; 88 to 100% of benign clips pass through or reach the selected safe counterpart, and the system is deployed on a real-world Unitree G1.

    Source: A. Benchmark · p. 6, §V · p. 7

  • Takeaways & Limitations

    On the Unitree G1, the same rules block unsafe commands while preserving a benign object-directed skill and interrupting a strike when a person enters view.

    Source: §V · p. 7

    The filter intervenes on pose content but leaves the root trajectory to the generator because committed autoregressive windows are immutable and interventions propagate through history.

    Source: E. Application Across Generators · p. 5

Abstract

from arXiv · show

Text-conditioned motion generators produce trackable whole-body motion, but they have no notion of scene-dependent safety: the same action may target an object or a person. Existing safeguards either inspect the prompt, require labeled motion data, or enforce geometric constraints; therefore, they do not directly account for how scene context changes a motion's meaning. We introduce contextual safety filtering (CSF), a training-free filter that grounds natural-language safety rules in safe and unsafe reference trajectories produced by the generator. For each active rule, safe and unsafe reference trajectories define an affine safety value that a safe reference tracking CBF-QP enforces. Across four pretrained generators with different architectures, CSF activates the intended rules in all explicit and scene-triggered unsafe cases and reduces the danger-event rate by up to 90%, while preserving 88-100% of benign motions. We demonstrate the complete system on a real-world Unitree G1, where it successfully prevents unsafe motions in a variety of scenarios, including interactions with humans and objects.

I. INTRODUCTION

CSF addresses the gap between trackable motion and scene-dependent safety: the same action can be appropriate or unsafe depending on its target. It uses generator-produced references and natural-language rules to filter motion without training an auxiliary model.

I. INTRODUCTION

  • The same physically feasible, trackable motion may be permitted toward an object but unsafe toward a person, so safety must account for both motion and scene.A whole-body controller will track either reference; feasibility alone does not decide whether the action should be executed.Source: §I · p. 1
  • Prompt screens, separately trained classifiers, inference-time guidance, and geometric filters do not directly resolve whether an action is permitted in its scene.CSF instead specifies unsafe behavior with natural-language rules, without retraining an auxiliary model.Source: §I · p. 1
  • CSF grounds natural-language rules in unsafe and safe references from the frozen generator, then uses scene context to select affine margins enforced by a safe-reference tracking CBF-QP.The QP’s barrier-only solution is the minimum-norm correction; its tracking objective redirects the estimate toward the safe reference.Source: §I · p. 1
  • The CBF-QP is reported feasible and invariant at every step for any tracking strength, with minimum intervention and exact pass-through at γ = 0.The contribution also characterizes the deployed ridge residual.Source: §I · p. 2
  • CSF is evaluated across four pretrained generators and deployed with perception, generation, and tracking on a real-world Unitree G1.The runtime shield redirects an executing action when a person enters view.Source: §I · pp. 1–2

II. RELATED WORK

Prior work steers, screens, edits, or constrains generated motion, while CSF focuses on whether a requested action is appropriate in its scene. Its sampler interface filters the generator’s current output estimate without changing the prompt.

II. RELATED WORK

  • Prior approaches steer or select motions, edit generative models, or enforce geometric constraints; CSF instead applies scene-selected semantic rules to a frozen generator’s continuous motion.Prompt-only screening can miss adversarial text-to-motion outputs, and model editing can alter benign generations that share a representation with unsafe concepts.Source: §II · p. 2

A. Problem Setting

  • CSF assumes a frozen sampler exposes a current estimate that it refines toward its final motion, and corrects only estimates violating a scene-active rule.Other motions pass through without retraining or auxiliary models.Source: A. Problem Setting · p. 2
  • The output estimate is the sampler’s current prediction of its final motion; CSF filters that estimate in the sampler’s native update while leaving the prompt unchanged.The estimate’s representation varies by sampler, including diffusion, flow, and autoregressive forms.Source: A. Problem Setting · pp. 2–3

B. Semantic References and Margin

CSF builds rule-specific safe and unsafe references from a frozen generator and defines a semantic margin from an estimate’s displacement along the unsafe direction. A shared safe reference gives active rules a common feasible direction, while its selection determines where a correction leads.

B. Semantic References and Margin

  • Each rule pairs a protected entity and unsafe behavior with generator-produced unsafe and benign-command safe references, requiring neither embedding alignment nor paired data.Motion-space diffusion forms step-matched reference estimates; other paths generate references once and reuse them, and changing a rule regenerates its references without updating the generator.Source: B. Semantic References and Margin · p. 3
  • The semantic margin is the negative projection onto the unsafe direction: zero at the safe reference, with lower values placing estimates farther along that direction.Source: B. Semantic References and Margin · p. 3
  • Each rule’s margin defines a half-space; moving an estimate fraction α toward the shared safe reference scales margins by 1 −α and provides a common feasible direction for active rules.Source: B. Semantic References and Margin · p. 3
  • A text encoder selects the safe reference from a library of neutral actions, with neutral stand as fallback, because an unconditional mean would pull motion toward a static pose.Source: B. Semantic References and Margin · p. 3

C. Safe-Reference Tracking CBF-QP

CSF turns affine semantic margins into active-concept barrier constraints and filters each sampler estimate by balancing feasibility with tracking a safe reference.

C. Safe-Reference Tracking CBF-QP

  • The CBF-QP projects a safe-reference tracking target onto active affine barrier constraints, with ρt controlling margin contraction.The sampler uses the filtered estimate in its native update.Source: C. Safe-Reference Tracking CBF-QP · p. 3
  • For ρt > 0, the feasible set is nonempty and violations contract by 1−ρt; at ρt = 1, the estimate enters the safe set in one step.At γ = 0, the correction is minimum-norm and feasible proposals pass through unchanged.Source: C. Safe-Reference Tracking CBF-QP · p. 3
  • The dual solve has one variable per active concept, while the representation dimension enters only through batched inner products and reconstruction.Ridge relaxation stabilizes correlated active directions and introduces a controlled residual.Source: C. Safe-Reference Tracking CBF-QP · pp. 3–4
  • Figure 3 contrasts a shortest projection onto the margin at ρt = 1 with fractional gap contraction at a lower rate.The barrier-only QP illustration shows how the contraction rate changes the correction.Source: C. Safe-Reference Tracking CBF-QP · p. 3, Figure 3 · p. 4

D. Semantic Context Gate

The semantic context gate selects which protected-entity rules constrain the QP by combining command-based and scene-perception signals.

D. Semantic Context Gate

  • The prompt signal activates a rule when the command is closest to an unsafe description rather than a benign contrast.The generator text encoder makes the comparison without requiring a fixed vocabulary.Source: D. Semantic Context Gate · p. 4
  • The perception signal activates a rule when a detected entity label is closest to the entity that rule protects.For example, detecting a person can activate a rule for a command such as “punch the wall.”Source: D. Semantic Context Gate · p. 4
  • Either signal can activate a concept’s constraint, and with no active concepts the QP leaves the estimate unchanged.Source: D. Semantic Context Gate · p. 4

E. Application Across Generators

CSF adapts its filtering to each generator’s prediction space, including direct motion features, decoded latents, and autoregressive windows.

E. Application Across Generators

  • For direct motion-space predictions, CSF filters before each native sampler update and excludes root channels so correction targets unsafe pose content.With classifier-free guidance, the objective, constraint base point, and update share the same prediction space.Source: E. Application Across Generators · pp. 4–5
  • For compressed VAE latents, CSF can evaluate the margin after decoding and iteratively update through the pretrained decoder until the barrier is met or the iteration budget is exhausted.The latent-flow benchmark instead applies the QP directly in latent space with γ = 0.5.Source: E. Application Across Generators · p. 5
  • For autoregressive generators, CSF filters only pose content before committing each window because committed windows become immutable conditioning history.Native token requantization can change each margin by at most the requantization error in the filtered window.Source: E. Application Across Generators · p. 5

F. Runtime Safety Shield

The runtime shield applies the same rules to the unexecuted reference when context changes, preserving motion already executed.

F. Runtime Safety Shield

  • After a context change, the shield scans future windows under the active rules and selects the first violating unexecuted window.It splices after a short response buffer from the current execution cursor.Source: F. Runtime Safety Shield · p. 5
  • The splice aligns the safe continuation to the held state in heading and position, then blends it with the original reference over a fixed transition.Source: F. Runtime Safety Shield · p. 5
  • If no violating window exists, the shield leaves the reference unchanged; otherwise, the tracker continues on the edited reference after joint velocities are recomputed.Source: F. Runtime Safety Shield · p. 5

IV. EXPERIMENTS

CSF is applied without retraining to four pretrained motion generators through generator-specific output adapters. The shared rules cover person-directed violence, children, and animals, with each backbone supplying its own safety references.

IV. EXPERIMENTS

  • Four adapters connect CSF to Kimodo-G1, ECHO, MotionHiFlow, and ARDY while sharing the rules, margin, gate, and QP.The generators use different architectures, and separable root channels are excluded from filtering.Source: §IV · p. 5
  • The shared rule set covers six concepts: four for person-directed violence and one each for a child and an animal.Examples contrast striking a person with striking training equipment, and harming a child with caring for a child.Source: §IV · p. 5
  • Each backbone generates its own references, so exemplars and margin scales remain model-specific and are not compared across backbones.Source: §IV · p. 5

A. Benchmark

Across four backbones, CSF suppresses danger more efficiently than a standing-pose blend and selects the intended rule in explicit and scene-triggered unsafe cases while preserving benign motions.

A. Benchmark

  • The benchmark pairs 28 unsafe–benign commands across six concepts with three seeds in allowed and protected scenes, totaling 2,688 clips.Paired runs hold command and seed fixed while varying declared scene entities or filtering.Source: A. Benchmark · p. 5
  • Danger is scored independently of the semantic margin using persistent bursts of fast, extended effector motion above a threshold set from unfiltered benign clips.Each backbone is normalized to its own nofilter and standing endpoints.Source: A. Benchmark · p. 5
  • Residual danger is 0.1 of the unfiltered rate on three backbones and 0.2 on ECHO; all four suppress more danger per discarded benign motion than a standing-pose blend.Fig. 5 compares danger suppression against discarded motion on the left.Source: A. Benchmark · pp. 5–6, Figure 5 · p. 6
  • Preservation cost ranges from 0.21 on Kimodo to 0.64 on MotionHiFlow and follows concept separation in the prediction space.Kimodo’s margin supports minimum intervention, whereas MotionHiFlow’s nearly flat latent margin needs a stronger safe-reference pull.Source: A. Benchmark · p. 6
  • The gate selects the intended rule in every explicit and scene-triggered unsafe case across all four backbones, while remaining inactive in matched allowed scenes.The right side of Fig. 5 reports correct response rates by case.Source: A. Benchmark · p. 6, Figure 5 · p. 6
  • For benign motion, 88 to 100% of clips either pass through or reach the selected safe counterpart.Preservation counts corrections within the generator’s draw noise or movements closer to the safe counterpart.Source: A. Benchmark · p. 6, Figure 5 · p. 6

B. Inference-Time Cost

The QP solve is fast, but reference construction determines most architecture-dependent inference cost.

B. Inference-Time Cost

  • 0.01 to 0.18 ms is required for the rule-space dual with one to six active rules, while a complete filter call takes 0.3 to 1.2 ms.On one RTX 4090, ECHO, MotionHiFlow, and ARDY cache references after 0.6 to 0.9 s of one-time setup; Kimodo’s step-matched references increase four-second motion generation from 1.61 to 7.60 s.Source: B. Inference-Time Cost · p. 6
  • Reference construction, rather than the rule-space solve, determines most of the architecture-dependent cost.For Kimodo, the QP accounts for only 0.14 s of the increased generation time.Source: B. Inference-Time Cost · p. 6

C. Real-World Unitree G1 Deployment

On a Unitree G1, CSF blocks explicit and deceptive unsafe commands, preserves a benign object-directed skill, and redirects an executing action when a person enters view. Across the paper’s evaluations, the generator remains frozen, with future work targeting root-trajectory and longer-interaction handling.

C. Real-World Unitree G1 Deployment

  • CSF redirects explicit person-directed and deceptive pillar-directed strikes while preserving the requested punch when only the object is present.The ARDY pipeline uses camera perception and a pretrained SONIC tracker, with the generator and tracker unchanged between nominal and filtered trials.Source: C. Real-World Unitree G1 Deployment · pp. 6–7

D. Runtime Safety Shield on Hardware

  • When a person enters view during execution, the updated entity list activates the rule and redirects the remaining reference to a safe continuation.The robot preserves the executed portion but does not complete the strike.Source: D. Runtime Safety Shield on Hardware · p. 7

V. CONCLUSION

  • At γ = 0, the QP makes the smallest correction needed to satisfy active rules; increasing γ redirects the estimate toward the safe alternative.Source: §V · p. 7
  • Across four pretrained generators, residual danger falls by up to 90% with better preservation than a standing-pose blend.Correction cost follows concept separation in each prediction space.Source: §V · p. 7
  • Future work includes filtering the root trajectory and regenerating safe continuations for longer, evolving interactions.The paper identifies locomotion redirection as a further extension when a rule becomes active.Source: §V · p. 7

Related papers

Loading 2610.12467v1…