Belief-Space Safety Filter (BeliefSF)

• BeliefSF is a framework that filters candidate actions based on a complete belief state, ensuring safety under uncertainty and partial observability.
• It encompasses diverse formulations—including Gaussian, particle-based, and latent variable methods—using barrier functions, CVaR bounds, and probabilistic constraints.
• Synthesis mechanisms such as quadratic programs and planning-based filters provide safety guarantees, supported by both theoretical analysis and empirical performance metrics.

Belief-Space Safety Filter (BeliefSF) denotes a class of safety-filtering mechanisms that operate on a belief state rather than on a single estimated state. Across the literature, the belief may be a Gaussian belief $b=(\mu,\Sigma)$, a sample-based or particle-based belief, a posterior over a latent parameter $\theta$, or a belief over hidden human types. The common pattern is that a nominal control, policy, or candidate action is filtered, screened, or replaced so that the resulting closed-loop evolution remains inside a belief-space safe set or satisfies a belief-dependent risk constraint. Later work uses the term explicitly, while earlier work realizes the same structure through Belief Control Barrier Functions (BCBFs), risk-aware controllers for particle filters, probabilistically constrained belief-space planning, and value-based safety switching (Vahs et al., 2023, Vahs et al., 2023, Vahs et al., 11 Mar 2026, Hu, 1 Jun 2026).

1. Conceptual scope and lineage

BeliefSF emerged from the observation that safety-critical control under partial observability cannot be reduced to filtering the nominal control with respect to a point estimate alone. In the Gaussian-belief setting, BCBFs were introduced to leverage “all information provided by state estimators,” converting a state-space chance constraint into a barrier condition on the belief state (Vahs et al., 2023). In non-Gaussian settings, a risk-aware controller based on continuous-discrete particle filters defined belief dynamics explicitly and constructed safe sets in the underlying belief space; although that paper does not use the term “BeliefSF,” it states that its controller “filters the reference control $u_{\mathrm{ref}}$ in real time to ensure the belief remains in a safe set that implies bounded risk over the unknown state” (Vahs et al., 2023).

Subsequent work broadened the notion substantially. Sample-based BCBFs generalized the framework to arbitrary sample-based beliefs and incorporated concentration bounds on VaR and CVaR, including robustness to one-sided Kolmogorov–Smirnov distribution shift (Han et al., 5 Apr 2025). A layered reach-avoid POMDP architecture then used the term BeliefSF directly for a conformal-enhanced BCBF-based safety filter that operates at high rate alongside a lower-rate information-gathering controller (Vahs et al., 11 Mar 2026). In interactive robotics, value-based BeliefSF was cast in an information-space Hamilton–Jacobi framework, where the safe set is a superlevel set of a value function $V(z)$ over the joint information state $z=(x,b)$ and the filter explicitly depends on runtime inference over latent human parameters (Hu, 1 Jun 2026).

This suggests that BeliefSF is best understood as an umbrella construction rather than a single algorithm. The underlying safety certificate may be a CBF inequality, a CVaR bound, a probabilistic constraint in a belief tree, an expected residual-risk threshold, or a value-function superlevel condition. What remains invariant is the belief-dependent screening of control.

2. Belief representations and belief dynamics

The literature instantiates BeliefSF with several distinct belief models. In EKF-based formulations, the state belief is Gaussian,

$p(x(t))=\mathcal{N}(\mu(t),\Sigma(t)),$

with belief state $b=[\mu,\mathrm{vec}(\Sigma)]$. Continuous-time belief propagation follows

$$\dot \mu = f(\mu)+g(\mu)u,\qquad \dot \Sigma = A\Sigma+\Sigma A^\top + Q,$$

and discrete-time updates are provided by an EKF or, under state-dependent measurement noise, a GEKF (Vahs et al., 2023, Walia et al., 15 Oct 2025).

In particle-based formulations, the belief is represented by weighted particles,

$$p(x_t)\approx \sum_{i=1}^N w_t^{(i)}\delta(x_t-x_t^{(i)}),$$

and the stacked belief state is

$$b_t=[x_t^{(1)}\ \dots\ x_t^{(N)}]^\top \in \mathbb{R}^{Nn_x}.$$

For continuous-discrete particle filters, each particle evolves according to the stochastic dynamics, and the stacked belief evolves as

$\theta$0

followed by the discrete measurement update $\theta$1 (Vahs et al., 2023). Closely related sample-based BCBF work uses a stacked sample belief

$\theta$2

for partially observed environment state samples generated by a Bayesian filter such as a particle filter or EKF (Han et al., 5 Apr 2025).

Other BeliefSF variants use beliefs over latent variables rather than over the physical state. Risk-constrained belief-space MPPI maintains an online posterior $\theta$3 over a time-invariant latent parameter $\theta$4 and updates it by Bayes’ rule,

$\theta$5

with particle filtering used for inference (Enwerem et al., 4 Apr 2026). In interactive robotics, the joint information-space state is $\theta$6, where $\theta$7 is a belief over latent human type, and the closed-loop dynamics couple physical evolution and inference updates (Hu, 1 Jun 2026).

A further variant appears in automated driving, where ego localization uncertainty is modeled as a Gaussian belief $\theta$8 over 2D Cartesian position, and the belief-space quantity of interest is expected residual risk under this localization uncertainty rather than a barrier function (Karunainayagam et al., 12 May 2026).

3. Safety sets, risk functionals, and certification objects

BeliefSF does not impose a single canonical safety functional. In Gaussian BCBF formulations, a state-space half-space constraint $\theta$9 is lifted to the belief-space barrier

$u_{\mathrm{ref}}$0

so that the safe set is $u_{\mathrm{ref}}$1 (Vahs et al., 2023). In the GEKF extension, the same Gaussian-belief barrier is retained, but the discrete-update safety analysis uses the GEKF innovation covariance $u_{\mathrm{ref}}$2 to bound the probability of leaving the belief-safe set during measurement updates (Walia et al., 15 Oct 2025).

For non-Gaussian particle beliefs, safety is expressed through a lower confidence bound on tail risk. With $u_{\mathrm{ref}}$3 defining the state-space safe set $u_{\mathrm{ref}}$4, the particle-filter method defines

$u_{\mathrm{ref}}$5

and $u_{\mathrm{ref}}$6. If $u_{\mathrm{ref}}$7, then with confidence at least $u_{\mathrm{ref}}$8, the true $u_{\mathrm{ref}}$9 is nonnegative (Vahs et al., 2023). The sample-based BCBF framework uses the analogous lower-confidence object

$V(z)$0

with $V(z)$1 equal to VaR or CVaR, and extends it to a robust version $V(z)$2 under a one-sided KS distance bound $V(z)$3 (Han et al., 5 Apr 2025).

A different certificate appears in conformal BCBF BeliefSF. There, finite-horizon interval safety on $V(z)$4 is expressed via nonconformity scores

$V(z)$5

computed over continuous particle trajectories. Sorting these scores yields a conformal threshold, and if the threshold is nonpositive, then $V(z)$6 (Vahs et al., 11 Mar 2026).

Belief-dependent chance constraints also appear directly, without barrier reparameterization. In online belief-space planning, the central quantity is

$V(z)$7

with analogous constraints on propagated beliefs $V(z)$8. Unsafe actions are those for which the recursive probabilistic constraint fails in the current search tree (Zhitnikov et al., 2024).

In automated driving, the safety object is expected residual risk rather than a safe set: $V(z)$9 Candidate actions can then be filtered by constraints such as $z=(x,b)$0 or $z=(x,b)$1 (Karunainayagam et al., 12 May 2026).

4. Filter synthesis mechanisms

The most common BeliefSF synthesis is a quadratic program that minimally modifies a nominal input. In EKF-based BCBFs, the runtime filter solves

$z=(x,b)$2

or an ECBF analogue for higher relative degree constraints (Vahs et al., 2023). The PF-CVaR version uses the nonsmooth barrier $z=(x,b)$3 and enforces a nonsmooth stochastic CBF constraint inside a small QP over the control input dimension $z=(x,b)$4 (Vahs et al., 2023). Sample-based BCBFs likewise solve a single-constraint QP with $z=(x,b)$5 or $z=(x,b)$6 replacing $z=(x,b)$7, using automatic differentiation for gradients and Hessians (Han et al., 5 Apr 2025).

Conformal BeliefSF adopts a different decomposition. A nominal controller and a Belief Control Lyapunov Function information-gathering controller run at the observation rate, while the high-rate safety filter selects the top-$z=(x,b)$8 particles according to the conformal score and solves a QP with per-particle stochastic reciprocal CBF constraints. Safety has strict precedence and overrides the nominal or information-gathering action whenever necessary (Vahs et al., 11 Mar 2026).

Planning-based variants filter actions rather than instantaneous controls. In residual-risk filtering for automated driving, a discrete candidate set $z=(x,b)$9 is evaluated by Monte Carlo over ego-pose belief samples, unsafe candidates are discarded,

$p(x(t))=\mathcal{N}(\mu(t),\Sigma(t)),$0

and the optimal safe candidate is selected according to a task objective $p(x(t))=\mathcal{N}(\mu(t),\Sigma(t)),$1 (Karunainayagam et al., 12 May 2026). In probabilistically constrained MCTS, the filter is embedded into tree expansion: after a candidate action is selected by UCB or PUCT, propagated and posterior belief constraints are checked, and if violated the action is marked dangerous, pruned by CleanTree, and removed from the tree statistics (Zhitnikov et al., 2024).

BeliefSF also appears in sampling-based stochastic optimal control. Risk-constrained belief-space MPPI evaluates each candidate control sequence under multiple belief-particle rollouts, computes the empirical $p(x(t))=\mathcal{N}(\mu(t),\Sigma(t)),$2 of the trajectory-level safety-margin violation, and implements a “soft BeliefSF” through a penalty $p(x(t))=\mathcal{N}(\mu(t),\Sigma(t)),$3 in the candidate score (Enwerem et al., 4 Apr 2026). In neural value-based interactive robotics, the filter is a switching mechanism: the nominal policy is executed unless the learned belief-space value at the next state would fall below $p(x(t))=\mathcal{N}(\mu(t),\Sigma(t)),$4, in which case the controller switches to a learned safety fallback policy $p(x(t))=\mathcal{N}(\mu(t),\Sigma(t)),$5 that maintains $p(x(t))=\mathcal{N}(\mu(t),\Sigma(t)),$6 (Hu, 1 Jun 2026).

5. Guarantees and empirical performance

The theoretical guarantees follow the certificate used by each variant. For continuous-time BCBFs in Gaussian belief space, if the barrier inequality is enforced between measurements, forward invariance of the belief-safe set holds over each flow interval; additional jump analysis yields probabilistic guarantees across EKF updates, and an augmented safe set can guarantee $p(x(t))=\mathcal{N}(\mu(t),\Sigma(t)),$7 across measurement jumps (Vahs et al., 2023). PF-CVaR BeliefSF proves belief-space forward invariance under feasibility of the QP and the discrete-update assumption $p(x(t))=\mathcal{N}(\mu(t),\Sigma(t)),$8; combined with the CVaR concentration theorem, this implies that with probability at least $p(x(t))=\mathcal{N}(\mu(t),\Sigma(t)),$9, $b=[\mu,\mathrm{vec}(\Sigma)]$0 for all $b=[\mu,\mathrm{vec}(\Sigma)]$1 (Vahs et al., 2023). Sample-based BCBFs extend the guarantee to lower confidence bounds on VaR or CVaR and to one-sided KS-robust distribution shift (Han et al., 5 Apr 2025). Conformal BeliefSF proves interval safety $b=[\mu,\mathrm{vec}(\Sigma)]$2, and across $b=[\mu,\mathrm{vec}(\Sigma)]$3 intervals yields mission safety at least $b=[\mu,\mathrm{vec}(\Sigma)]$4 (Vahs et al., 11 Mar 2026). JIST verification for neural BeliefSF gives a finite-sample guarantee of the form

$b=[\mu,\mathrm{vec}(\Sigma)]$5

with probability at least $b=[\mu,\mathrm{vec}(\Sigma)]$6, provided the binomial tail inequality is satisfied on calibration rollouts sampled from the trusted inference region $b=[\mu,\mathrm{vec}(\Sigma)]$7 (Hu, 1 Jun 2026).

Reported empirical performance is consistently tied to reduced conservativeness relative to physical-space or mean-state baselines, but the exact mechanism differs by formulation. In Gaussian BCBF simulations of unicycle obstacle avoidance, the reported number of collisions over 100 trials was $b=[\mu,\mathrm{vec}(\Sigma)]$8 for BCBF with $b=[\mu,\mathrm{vec}(\Sigma)]$9, $$\dot \mu = f(\mu)+g(\mu)u,\qquad \dot \Sigma = A\Sigma+\Sigma A^\top + Q,$$0 for chance-constrained NMPC, and $$\dot \mu = f(\mu)+g(\mu)u,\qquad \dot \Sigma = A\Sigma+\Sigma A^\top + Q,$$1 for a stochastic CBF baseline; hardware quadrotor experiments reported $$\dot \mu = f(\mu)+g(\mu)u,\qquad \dot \Sigma = A\Sigma+\Sigma A^\top + Q,$$2 collision-free runs under changing sensing conditions (Vahs et al., 2023). In multimodal particle-filter simulations with $$\dot \mu = f(\mu)+g(\mu)u,\qquad \dot \Sigma = A\Sigma+\Sigma A^\top + Q,$$3 runs and $$\dot \mu = f(\mu)+g(\mu)u,\qquad \dot \Sigma = A\Sigma+\Sigma A^\top + Q,$$4, the reported collisions were $$\dot \mu = f(\mu)+g(\mu)u,\qquad \dot \Sigma = A\Sigma+\Sigma A^\top + Q,$$5 for $$\dot \mu = f(\mu)+g(\mu)u,\qquad \dot \Sigma = A\Sigma+\Sigma A^\top + Q,$$6-SCBF, $$\dot \mu = f(\mu)+g(\mu)u,\qquad \dot \Sigma = A\Sigma+\Sigma A^\top + Q,$$7 for ML-SCBF, $$\dot \mu = f(\mu)+g(\mu)u,\qquad \dot \Sigma = A\Sigma+\Sigma A^\top + Q,$$8 for BE-SCBF, $$\dot \mu = f(\mu)+g(\mu)u,\qquad \dot \Sigma = A\Sigma+\Sigma A^\top + Q,$$9 for the PF-CVaR method with $$p(x_t)\approx \sum_{i=1}^N w_t^{(i)}\delta(x_t-x_t^{(i)}),$$0, and $$p(x_t)\approx \sum_{i=1}^N w_t^{(i)}\delta(x_t-x_t^{(i)}),$$1 for $$p(x_t)\approx \sum_{i=1}^N w_t^{(i)}\delta(x_t-x_t^{(i)}),$$2 (Vahs et al., 2023). Sample-based BCBFs report real-time performance of approximately $$p(x_t)\approx \sum_{i=1}^N w_t^{(i)}\delta(x_t-x_t^{(i)}),$$3 kHz and note that $$p(x_t)\approx \sum_{i=1}^N w_t^{(i)}\delta(x_t-x_t^{(i)}),$$4 is safest but more conservative, whereas $$p(x_t)\approx \sum_{i=1}^N w_t^{(i)}\delta(x_t-x_t^{(i)}),$$5 provides the best balance in dynamic collision avoidance (Han et al., 5 Apr 2025). In risk-constrained belief-space MPPI for dexterous stowing, high risk aversion $$p(x_t)\approx \sum_{i=1}^N w_t^{(i)}\delta(x_t-x_t^{(i)}),$$6 achieved $$p(x_t)\approx \sum_{i=1}^N w_t^{(i)}\delta(x_t-x_t^{(i)}),$$7 success with zero contact violations, compared to $$p(x_t)\approx \sum_{i=1}^N w_t^{(i)}\delta(x_t-x_t^{(i)}),$$8 for a risk-neutral-like configuration and $$p(x_t)\approx \sum_{i=1}^N w_t^{(i)}\delta(x_t-x_t^{(i)}),$$9 for a chance-constrained baseline (Enwerem et al., 4 Apr 2026). In reach-avoid POMDP experiments, the layered BeliefSF architecture reported success rates of $$b_t=[x_t^{(1)}\ \dots\ x_t^{(N)}]^\top \in \mathbb{R}^{Nn_x}.$$0 in Constrained Lightdark and $$b_t=[x_t^{(1)}\ \dots\ x_t^{(N)}]^\top \in \mathbb{R}^{Nn_x}.$$1 in Constrained Antenna, while state-of-the-art constrained POMDP solvers were substantially lower in the same tables (Vahs et al., 11 Mar 2026). In the human-vehicle benchmark, BeliefSF achieved $$b_t=[x_t^{(1)}\ \dots\ x_t^{(N)}]^\top \in \mathbb{R}^{Nn_x}.$$2 safe rate and $$b_t=[x_t^{(1)}\ \dots\ x_t^{(N)}]^\top \in \mathbb{R}^{Nn_x}.$$3 completion, compared to $$b_t=[x_t^{(1)}\ \dots\ x_t^{(N)}]^\top \in \mathbb{R}^{Nn_x}.$$4 safe rate and $$b_t=[x_t^{(1)}\ \dots\ x_t^{(N)}]^\top \in \mathbb{R}^{Nn_x}.$$5 completion for a physical-space safety filter; with $$b_t=[x_t^{(1)}\ \dots\ x_t^{(N)}]^\top \in \mathbb{R}^{Nn_x}.$$6, $$b_t=[x_t^{(1)}\ \dots\ x_t^{(N)}]^\top \in \mathbb{R}^{Nn_x}.$$7, and $$b_t=[x_t^{(1)}\ \dots\ x_t^{(N)}]^\top \in \mathbb{R}^{Nn_x}.$$8, JIST improved certified coverage from $$b_t=[x_t^{(1)}\ \dots\ x_t^{(N)}]^\top \in \mathbb{R}^{Nn_x}.$$9 to $\theta$00 (Hu, 1 Jun 2026).

6. Assumptions, limitations, and current directions

The guarantees of BeliefSF are highly sensitive to the assumptions made by each formulation. Gaussian-belief BCBFs assume Gaussianity, first-order linearization, and EKF-style belief dynamics; the GEKF extension still assumes a unimodal Gaussian belief and validity of local linearization, even though it explicitly accommodates multiplicative state-dependent measurement noise (Vahs et al., 2023, Walia et al., 15 Oct 2025). PF-based formulations avoid Gaussian assumptions but rely on sample quality, sufficient particle count, and assumptions on discrete resampling; the non-Gaussian PF-CVaR analysis explicitly excludes rare extreme resampling outcomes that collapse the filter onto unsafe particles (Vahs et al., 2023). Sample-based BCBFs require i.i.d. samples from the belief and valid lower-tail concentration conditions; robustness is only certified up to the prescribed one-sided KS bound $\theta$01 (Han et al., 5 Apr 2025).

Planning and verification variants introduce additional assumptions. Probabilistically constrained MCTS assumes bounded rewards, a Regularity Hypothesis, and accurate model-based particle propagation; the anytime guarantee is relative to the currently expanded tree, not to the unexpanded belief space (Zhitnikov et al., 2024). Risk-constrained belief-space MPPI assumes a static latent parameter $\theta$02, known noise models, and a union-bound extension for repeated solves that is explicitly described as conservative (Enwerem et al., 4 Apr 2026). Belief-space residual-risk filtering in automated driving assumes Gaussian ego and object uncertainties, independence between ego and object uncertainties, a common planar frame, and omission of yaw uncertainty; sample sizes of $\theta$03–$\theta$04 are noted as a limitation for statistical stability at high uncertainty (Karunainayagam et al., 12 May 2026). Trusted-inference neural BeliefSF assumes exchangeability between calibration and deployment rollouts, and its verification power depends directly on the correctness of the inference reliability score $\theta$05 and the learned approximations $\theta$06 and $\theta$07 (Hu, 1 Jun 2026).

A plausible implication is that BeliefSF research is converging on two complementary directions rather than one. One direction seeks sharper online certificates for high-dimensional, non-Gaussian beliefs through particle methods, conformal prediction, and risk concentration. The other seeks scalable deployment through learned value functions, learned inference reliability scores, and neural approximations, followed by finite-sample certification. The term “BeliefSF” therefore denotes not merely safety filtering in belief coordinates, but a family of architectures in which runtime inference, uncertainty-aware certification, and minimal intervention are coupled by construction.