---
title: Data-Driven Safety Filter (DDSF)
url: https://www.emergentmind.com/topics/data-driven-safety-filter-ddsf
type: topic
---

# Data-Driven Safety Filter (DDSF)

A Data-Driven Safety Filter (DDSF) is a modular algorithmic mechanism that enforces safety constraints during the online execution of learning-based control systems. Unlike traditional safety filters that require explicit plant models or state estimators, DDSFs operate directly from system data—either collected offline (e.g., trajectories or excitation records) or online (via observed transitions)—and project arbitrarily proposed inputs onto a set of certifiably safe actions. Modern DDSF designs balance minimal conservatism against hard safety, accommodate unknown dynamics, time delays, or unmodeled disturbances, and can be implemented for both state-space and input-output (I/O) settings, including systems modeled by neural networks or unknown structured plants.

## 1. Conceptual Foundations and Classification

Contemporary DDSF methodologies are rooted in several foundational paradigms: Behavioral Systems Theory (BST), data-driven reachability and control barrier functions, robust MPC with data-derived (or learned) models, and direct state–action constraint certificates. The core theoretical property is recursive feasibility: if the filter is feasible at time $t_0$ and applied policies are followed, then constraint violations will not occur for $t \ge t_0$.

DDSFs can be classified by three principal axes:

- **Model dependency:** Some DDSFs utilize learned or GP/Bayesian models with quantified uncertainty [1812.05506], others adopt pure I/O data-driven representations with no explicit model [2309.00189], and recent direct approaches use learned certificates without ever predicting next-state [2505.15515].
- **Domain of operation:** State-space DDSFs exploit state measurements or estimates; I/O DDSFs require only past finite input and output histories.
- **Online computation:** Filter logic may require solving QP/SDP or LP programs per timestep or evaluating differentiable safety certificates (often neural network–implemented) in real time.

## 2. The Data-Driven Predictive Safety Filter: I/O Behavioral Perspective

One major DDSF design [2309.00189] is grounded in Behavioral System Theory, leveraging Willem's Fundamental Lemma for LTI systems of unknown parameters. It constructs block-Hankel matrices $H_L(u^d), H_L(y^d)$ from a single persistently exciting trajectory and solves, at each time step $t$, the program:

Minimize over $\alpha,\,\bar{u},\,\bar{y}$
\[
J = \|\bar{u}_0 - u_L(t)\|_R^2
\]
subject to:
- $[\bar{u}_{-T_{ini}\ldots N_p+T_{ini}-1};\,\bar{y}_{-T_{ini}\ldots N_p+T_{ini}-1}] = [H_L(u^d);\,H_L(y^d)]\,\alpha$
- Past input/output match measured history
- $(\bar{u}_k,\,\bar{y}_k)$ stay within prescribed convex constraint sets for $k=0\ldots N_p-1$
- Terminal invariance to a precomputed safe IO set

No state, model, or delay estimate is required. This DDSF is robust to unknown linear time delays (by increasing $T_{ini}$) and can be tuned via horizon $N_p$, terminal set size, and constraint tightening for disturbances. Recursive feasibility ensures infinite-time safety if feasibility holds at $t_0$ [2309.00189].

## 3. Neural Model-Based Convex DDSF

For systems where a neural network (NN) approximates plant dynamics, DDSFs are implemented by locally over-approximating NN outputs with affine bounds derived via LiRPA or CROWN relaxations [2308.08086]. The resulting time-varying, uncertain LTV system is passed to a robust SLS-based MPC, optimizing over causal feedback maps that guarantee satisfaction of state/input polyhedral constraints under bounded NN errors and disturbances:

\[
x_{k+1} = (A+ \tilde{A}_k)x_k + (B+\tilde{B}_k)u_k + \tilde{c}_k + \Delta_k(x_k,u_k) + w_k, \quad \Delta_k\in\mathcal{P}_k
\]
The DDSF solves a QP incorporating SLS affine constraints, soft robust constraints, and trust-region constraints to deliver per-step safety certificates if all internal slacks vanish. Empirical results on a pendulum system show that DDSF filtering strictly enforces state constraints that are routinely violated by baseline controllers, even under significant model errors [2308.08086].

## 4. Model-Free DDSF via State-Action Certificate Learning

Direct Data-Driven Safety Filters (3DSF) [2505.15515] decouple safety from model prediction by learning a State-Action Control Barrier Function (SACBF) $Q^B(x,u)$ from data. Rather than predicting next state, the filter enforces:

\[
\pi(x) = \arg\min_{u\in U} Q(x,u) \quad \text{s.t.} \quad Q^B(x,u)\le 0
\]
$Q^B(x,u)$ can be learned via (a) supervised regression on model-based or simulated transitions, (b) robust optimization with data from a safe expert, or (c) RL-based value iteration targeting the viability kernel. Safety and recursive feasibility of this DDSF are guaranteed under appropriate contractivity, and robustness to approximation errors is formalized via error-to-state safety (ESSf), wherein constraints are tightened in proportion to learning error. This approach is applicable to nonlinear, nonconvex, or high-dimensional systems, and can be computed efficiently on embedded hardware [2505.15515].

## 5. DDSF via Online Learning and Reachability-Based Filters

Recent advances have extended DDSFs to general black-box dynamical systems using neural network function approximators that learn both safety value functions and their derivatives [2601.21297]. This framework recasts the Hamilton-Jacobi (HJ) reachability PDE as a Bellman-style fixed-point operator and applies contraction-based losses to train a pair of networks $(v_\theta, \partial v_\varphi)$, which are embedded into a QP safety filter:

\[
u^* = \arg\min_{u\in\mathcal{U}} \|u - u_{\rm RL}\|^2 \quad \text{s.t.} \quad \partial v_\varphi(x,u) + \alpha v_\theta(x) \ge 0
\]
Safety is enforced as forward invariance of the $V(x)\ge 0$ set, which holds once the critics converge. The approach is empirically validated on continuous and hybrid systems, demonstrating low QP infeasibility (<0.23%) and superior safe-RL performance over baselines [2601.21297].

## 6. Design Principles, Limitations, and Empirical Evidence

DDSFs share a modular design: they monitor the safety of a candidate control input (from learning, human, or feedback policy), and when necessary, minimally modify it to ensure forward constraint satisfaction with respect to a data-consistent backup recovery plan or safety certificate. Key design principles and observed limitations include:

- **Data richness:** Offline datasets must be sufficiently exciting, rich, and (ideally) noise-free to accurately characterize feasible trajectories or guarantee persistency of excitation.
- **Computation:** Online QP solvers with dimensions scaling with trajectory length and number of constraints; modern implementations achieve millisecond-class response.
- **Conservatism vs. computational cost:** Larger prediction/backup horizons reduce conservatism but demand greater computational and data resources; data-based set expansion can enlarge safe sets while retaining nonconservativeness [2403.15883].
- **Robustness:** I/O–based DDSFs can accommodate unknown time delays directly within the Hankel representation; robustification is handled by constraint-tightening or error bounds derived from surrogate models or neural approximations [2309.00189, 2308.08086].
- **Empirical demonstration:** Across aerial robotics, ground vehicles, pendulum and higher-order systems, DDSFs consistently enforce safety constraints not enforced by nominal or learning-based controllers [2309.00189, 2308.08086, 2505.15515, 2601.21297].

## 7. Extensions and Research Directions

Active research areas for DDSFs include reduction of conservatism via explicit data-driven set expansion [2403.15883], construction of scalable filters for high-dimensional and hybrid systems, integration with deep reinforcement learning, and development of stochastic DDSFs robust to probabilistic disturbances [2601.21297]. Further, the synthesis of differentiable safety layers for nonlinear MPC approximations enables the deployment of DDSF methodologies in computationally constrained, high-speed robotic platforms with safety certifications inherited from classical optimization-based control [2409.13817].

In summary, the Data-Driven Safety Filter is a mathematically principled, computationally tractable, and highly flexible framework for enforcing safety in learning-based control. It achieves this by directly leveraging offline or online data—bypassing explicit model identification—while providing formal guarantee mechanisms under realistic regularity and excitation assumptions. Empirical studies across various domains confirm their effectiveness in constraint satisfaction, interpretability, and real-time applicability.

Source: https://www.emergentmind.com/topics/data-driven-safety-filter-ddsf