Runtime Safety Filtering for Learned Small UAS Separation Policies under GNSS Degradation

Abstract: Learning-based separation assurance for small Unmanned Aircraft Systems (sUAS) achieves near-zero collision rates in simulation, but assumes accurate position and velocity information from Global Navigation Satellite Systems (GNSS). This assumption fails in urban environments, where multipath propagation, signal blockage, and intentional interference degrade navigation integrity. This raises a fundamental architectural question for deploying learned separation policies under GNSS degradation: should runtime safety mechanisms filter the policy's actions or its observations? This work evaluates both approaches for multi-agent sUAS separation under adversarial GNSS degradation. Both architectures first estimate a worst-case traffic state consistent with bounded observation uncertainty, then diverge: action filtering constrains policy outputs via discrete-time control barrier functions evaluated at the worst-case state, while observation filtering presents the worst-case state directly to the policy as corrected input. Experimental results show that action filtering provides negligible safety improvement, while observation filtering reduces near mid-air collisions by 90% and remains robust to the barrier function's tradeoff between separation distance and closing rate. These results suggest that, for policies with learned safety behaviors, preserving the policy's decision authority outperforms overriding its actions with hand-designed constraints.

• The paper demonstrates that observation filtering reduces NMAC events by up to 90% and improves minimum separation compared to action filtering.
• It employs worst-case state estimation with control barrier functions to correct policy observations in real time under GNSS degradation.
• The study reveals that while action filtering retains formal safety guarantees, observation filtering leverages learned multi-step deconfliction for superior empirical safety.

Runtime Safety Filtering for Learned sUAS Separation Policies under GNSS Degradation

Introduction

The proliferation of small Unmanned Aircraft Systems (sUAS) in urban airspace necessitates reliable, scalable separation assurance mechanisms to prevent mid-air collisions in autonomous, high-density traffic. While multi-agent reinforcement learning (MARL)-based separation policies have demonstrated efficacy under nominal perception, their robust deployment is fundamentally challenged by the pervasive degradation of Global Navigation Satellite Systems (GNSS) inherent to urban environments. Signal multipath, blockage, and intentional interference induce errors in position and velocity estimation, leading to unsafe control decisions during tactical deconfliction. This paper rigorously investigates two runtime safety architectures for post-training deployment of learned sUAS separation policies under adversarial GNSS degradation: action filtering via control barrier functions (CBFs) and observation filtering via worst-case state correction (2607.10014).

A central architectural question addressed is whether safety should be enforced by filtering policy actions (action-space intervention) or by correcting policy observations (observation-space intervention), especially for policies with internalized safety properties.

Figure 1: High-density en route urban airspace sUAS traffic scenario from BlueSky Air Traffic Simulator, illustrating dense multi-route geometry with realistic traffic flows.

Problem Formulation and Degradation Model

The sUAS separation assurance scenario is defined in a multi-agent setting, with each agent controlling ground speed through discrete actions (decelerate, hold, accelerate) to maintain the mandated $D_{\text{safe}}=100$ m horizontal separation. Policy learning employs PPO under the assumption of accurate observations. However, at runtime, GNSS degradation is modeled using a deterministic $R$-contamination framework, where the observed state $o$ is formed as a convex combination of the ground-truth state $s$ and an adversarial perturbation $\xi$ constrained by $\|\xi - s\|_\infty \le \kappa$.

Figure 2: Deterministic GNSS degradation model: observation as an $R$-weighted interpolation between the true state and adversarial perturbation, yielding worst-case uncertainty sets.

The key design parameter $R$ quantifies the severity of navigation degradation; increasing $R$ broadens the state uncertainty set available to adversarial perturbations.

Runtime Safety Filtering Approaches

Both action and observation filtering architectures rely on robust worst-case state estimation; that is, given an observed state and assumed upper-bound $R_{\max}$, the most dangerous traffic configuration (minimizing the CBF safety margin) is computed within the bounded uncertainty set. The difference lies in their respective points of intervention:

• Action Filtering: The policy's action is overridden if it fails the discrete-time CBF safety constraint when evaluated on the worst-case estimated state. Among all admissible actions, the one closest to the policy output is selected. Infeasible actions are replaced by the least constraint-violating alternative.
• Observation Filtering: The observation presented to the policy is replaced by the worst-case true state estimate, and the policy output is executed without modification.

While both methods have negligible computational overhead and require no retraining, they can diverge significantly in safety, operational effectiveness, and design robustness.

Experimental Results

Comprehensive empirical evaluation in high-density BlueSky simulation environments investigates NMAC rates, minimum achieved separations, and sensitivity to CBF parameterization across varying GNSS degradation levels and design parameters.

Action Filtering

Results demonstrate that action filtering yields negligible safety enhancement across all tested $R$0 values. NMAC counts and minimum separations remain comparable to the unfiltered policy, even for aggressive uncertainty bounding.

Figure 3: Safety performance of action filtering across observation degradation levels. NMAC rates and minimum separation are statistically unaffected by filter activation.

Action filter override rates increase with $R$1—approaching 100% intervention at high pessimism—yet safety outcomes do not improve; infeasibility is rare due to the discrete action space.

Figure 4: (Left) Action override rates increase with conservative $R$2, (Right) Infeasibility remains negligible, confirming always-available safe actions in the discrete set.

Observation Filtering

Observation filtering yields a robust and significant reduction in NMAC events: using $R$3, the average NMAC rate drops by 90%, with the minimum separation margin increasing from 250 m to 375 m. The effectiveness of observation filtering is robust to the velocity weighting parameter $R$4; the method exhibits insensitivity across orders of magnitude.

Figure 5: Observation filtering substantially reduces NMAC events and improves separation, robustly across increasing GNSS degradation.

At high $R$5, conservative bias leads to unnecessary slow-downs and marginal safety improvements at the cost of decreased efficiency under zero degradation. Under-specifying $R$6 results in under-conservatism and residual collisions.

Comparative Analysis

Direct comparison indicates that observation filtering consistently and substantially outperforms both action filtering and nominal operation.

Figure 6: Observation filtering (yellow) dramatically outperforms both nominal (purple) and action filtering (green) policies at moderate uncertainty bounds.

Furthermore, sensitivity analysis with respect to the barrier's closing-rate weight $R$7 reveals action filtering is highly susceptible to mis-specification: larger $R$8 degrades safety, often underperforming the nominal policy due to disruption of coordinated, learned maneuver sequences. Observation filtering remains invariant to $R$9 due to the dominance of geometric correction in the input.

Figure 7: Action filtering is sensitive to $o$0—increasing $o$1 degrades safety; at high values the filter disrupts multi-step learned maneuvers.

Figure 8: Observation filtering performance is invariant to $o$2, supporting robust use across a range of anticipation horizons.

Theoretical and Practical Implications

The key empirical finding is that, for learned controllers exhibiting internalized, multi-step tactical deconfliction behaviors, observation filtering outperforms action filtering—even when both rely on identical worst-case state estimates. This asymmetry is explained by the mismatch in safety reasoning: CBFs encode single-step constraints, whereas the policy's reward-driven optimization encapsulates multi-step conflict resolution. Action filtering truncates or disrupts such strategies by enforcing primitive constraints, whereas observation filtering provides the policy with a conservative view of the state space, leveraging its full learned capacity.

Importantly, action filtering does retain formal forward-invariance guarantees, crucial in certification contexts demanding explicit control contracts irrespective of empirical performance. However, empirical separation assurance in uncertain, adversarial environments with learned controllers is better served by observation-space correction—provided the policy's implicit response model is trustworthy and not violated.

These findings suggest a general principle for augmenting learned controllers: in domains where safety behaviors are productively internalized during policy learning, observation filtering maximally preserves performance.

Limitations and Future Directions

Key limitations include the assumption of heading accuracy and the operational calibration challenge for $o$3. An adversary controlling heading observations is not addressed; future work should integrate heading uncertainty and cross-validated sensor fusion. While the current architecture treats the barrier function as hand-designed, extension to learned CBFs—jointly optimized with policy learning and robust to adversarial uncertainty—is anticipated to further improve performance. Benchmarking against other runtime safety paradigms, such as Hamilton-Jacobi reachability and learned recovery zones, remains for future investigation.

Conclusion

Empirical evidence decisively demonstrates that observation-space correction via worst-case filtering substantially reduces mid-air collisions in urban sUAS separation tasks under GNSS degradation, outperforming action-space constraint filtering, provided policies have internalized relevant safety behaviors during learning. These results have immediate ramifications for runtime safety architecture design in multi-agent autonomous systems operating under adversarial perception error. For certification-driven domains requiring explicit safety contracts, action filtering remains valuable. For empirical performance, observation filtering is the dominant paradigm, robust to filter parameterization and adaptive to learned conflict resolution strategies (2607.10014).