Margin-Aware Safety Violations

• Margin-aware safety violations are defined as quantitative measures of how close a system operates to an unsafe state rather than a simple pass/fail criterion.
• They integrate methods like safe reinforcement learning, barrier functions, and temporal logic to evaluate risk proximity and uncertainty in dynamic systems.
• Their application across robotics, control, and model alignment enables nuanced safety analysis by considering duration, recoverability, and structured failure chains.

Margin-aware safety violations are violations understood relative to a safety margin rather than only as binary constraint breaches. In reinforcement learning, “margin-aware safety requires not only avoiding explicit constraint violations (e.g., cost $c(s,a)>0$), but also respecting a safety margin $\delta$,” so that the policy remains “a comfortable distance away from constraints, ensuring safety under model errors or perturbations” (Bethell et al., 21 Oct 2025). Across control, robotics, verification, and model alignment, the same general idea appears under different observables: “distance to violation” via robustness semantics, the minimum normalized barrier value over a rollout, the number of random actions that can be tolerated before performance loss exceeds a threshold, or the probability that a trajectory will reach a violation within a finite horizon (Shi et al., 2024, Grushin et al., 2024, Dhodapkar et al., 28 Mar 2026). Margin-awareness therefore shifts safety analysis from pass/fail events to proximity, duration, uncertainty, temporal ordering, and recoverability.

1. Conceptual scope

Margin-aware safety violations arise when the relevant notion of failure is not exhausted by an instantaneous constraint crossing. In robotic manipulation, many failures are temporal: “a robot may touch a clean surface after contamination or release an object before it is fully inside an enclosure,” and SafeManip was introduced precisely to move beyond “task completion or per-state constraint violations” toward temporal safety properties over full executions (Huang et al., 12 May 2026). In AI agents, SafetyDrift defines violations that emerge when “individually safe actions” compound into unsafe sequences; the motivating example is that reading a confidential file, writing a summary, and emailing it externally yields a data leak although “no single step is unsafe” (Dhodapkar et al., 28 Mar 2026).

This perspective also appears in consequence-driven multimodal safety. OOD-MMSafe argues that many hazards are “not immediately evident in the query or image, but which could arise as a logical consequence of the model’s output when enacted in context,” and diagnoses “causal blindness” in frontier MLLMs under such hidden-hazard settings (Wen et al., 10 Mar 2026). In classical cyber-physical validation, SaSeVAL treats safety violations as downstream effects of security violations whose impact depends on “the architecture of the system under test” and “the traffic situation,” rather than as isolated software faults (Wolschke et al., 2021).

A plausible implication is that margin-aware safety violations are best viewed as structured failures on a boundary region: they include states that are still nominally safe but already too close to unsafe dynamics, unsafe temporal orderings that preserve per-step legality, and consequence chains that keep local actions innocuous while making the overall trajectory unrecoverable.

2. Formalizations of margins and violations

Several mathematical formalisms instantiate this boundary-region view. In safe RL, the standard margin-aware constraint is

$Q_C(s,a) + \delta \le d,$

and the Uncertain Safety Critic augments it to

$Q_C(s,a) + \beta \sigma_C(s,a) + \delta \le d,$

where $Q_C(s,a)$ is the estimated expected cost, $\sigma_C(s,a)$ is an uncertainty estimate, $\delta$ is the safety margin, and $\beta$ controls uncertainty-driven conservatism (Bethell et al., 21 Oct 2025).

In barrier-based control, the margin is often the residual to a force or state limit. For smoothed implicit contact dynamics, the barrier function is

$h_k := \gamma_{\max} - \gamma_k,$

and the robustified discrete-time CBF constraint is tightened to

$$\hat{h}_{k+1}(u_k) \ge (1-\alpha) h_k + \delta_\kappa,$$

so that bounded under-prediction of contact force is absorbed into a fixed robust margin (Lee et al., 20 May 2026). In multi-agent verification, the safety score of a rollout is defined by the worst normalized proximity to the safety boundary,

$\delta$0

so that violations become “graded” rather than binary (Margapuri et al., 24 Sep 2025).

Temporal-logic falsification uses quantitative robustness. For a trace $\delta$1 and STL property $\delta$2, negative robustness indicates violation and its magnitude measures “proximity to boundary (margin of violation),” which Synthify explicitly minimizes during falsification (Shi et al., 2024). In criticality-based RL monitoring, the margin is expressed in tolerated perturbation length. “True criticality” is

$\delta$3

and the $\delta$4-tolerance safety margin is

$\delta$5

which gives the maximum number of consecutive random actions that do not exceed a chosen loss tolerance (Grushin et al., 2024).

These formulations differ in state, output, and horizon, but they all encode the same operational distinction: the relevant object is a signed or probabilistic distance to failure, not merely the first time a constraint becomes negative.

3. Reinforcement learning and control

In safe RL, a central problem is the trade-off between conservatism and task performance. “Methods that tightly enforce safety often cripple task performance, while those that prioritize reward leave safety constraints frequently violated, producing diffuse cost landscapes that flatten gradients and stall policy improvement” (Bethell et al., 21 Oct 2025). USC addresses this by concentrating conservatism “in uncertain and costly regions while preserving sharp gradients in safe areas.” Its empirical result is that it “reduces safety violations by approximately 40% while maintaining competitive or higher rewards,” and “reduces the error between predicted and true cost gradients by approximately 83%” (Bethell et al., 21 Oct 2025).

Predictive safety filters operationalize margin-awareness through data concentration near the boundary. Boundary Sampling to Learn Predictive Safety Filters uses Pontryagin’s Maximum Principle to characterize “trajectories that barely avoid safety violations,” then focuses learning near the boundary of the backward reachable tube. The learned Control Barrier Value Function is used in a QP safety filter,

$\delta$6

subject to

$\delta$7

and the paper reports wall times “around 3ms,” faster convergence, reduced failure rates, and improved safe set reconstruction; in one automotive racing result, failure rate is reduced “from 0.66 to 0.3 with the same training budget in smaller networks” (Dallas et al., 14 Apr 2026).

Online motion generation exposes a related issue: low-fidelity planning models require safety margins large enough to absorb worst-case tracking error, but heuristic model tuning can be overly conservative. “Captivity-Escape Games as a Means for Safety in Online Motion Generation” inverts the usual procedure by adapting planning-model performance to a given margin, rather than computing a margin for a heuristically fixed planner. In the homicidal chauffeur example, the proposed method computes a TEB in “18.17 seconds” versus “313,000 seconds (87 hours!)” for FaSTrack at low speed, while matching the state-of-the-art boundary in one setting and avoiding grid-induced conservatism in another (Bohn et al., 2 Jun 2025).

Design-time data collection can also be made margin-aware. MPC-SafeGIL injects adversarial disturbances during expert demonstrations to drive the system toward “near-miss, recovery, and failure-avoidance behaviors.” On a quadrotor, the reported “simulation safety rate” is “73% for MPC-SafeGIL versus 41% for BC,” and the “real-world safety rate” is “9/12 successes for MPC-SafeGIL versus only 3/12 for BC” (Qiu et al., 5 Aug 2025). A plausible implication is that boundary-focused training and boundary-focused control are converging on a common principle: safety margins are most informative when learned, estimated, and enforced near states that are almost unsafe.

4. Temporal and consequence-driven violations

Temporal safety evaluation makes margin-awareness explicit at the level of event ordering. SafeManip defines reusable LTLf templates over finite executions and evaluates them by compiling each property into a DFA. Its property suite spans “collision and contact safety, grasp stability, release stability, cross-contamination, action onset, mechanism recovery, object containment, and enclosure access” (Huang et al., 12 May 2026). The framework measures “Violation Rate,” “Unsafe-State Exposure Rate,” and four rollout outcome types—“Success and safe,” “Success but unsafe,” “Fail but safe,” and “Fail and unsafe”—so that a rollout can be successful while still violating temporal safety (Huang et al., 12 May 2026).

SafetyDrift treats sequential violations probabilistically. It models safety trajectories as absorbing Markov chains over discrete risk levels $\delta$8 and computes finite-horizon risk through absorption analysis. Because of the monotonic state design, “every agent will eventually violate safety if left unsupervised,” so the actionable quantity is the probability of reaching $\delta$9 within a chosen horizon. Across “357 traces spanning 40 realistic tasks in four categories,” the paper finds that “points of no return” are sharply task dependent: in communication tasks, reaching even a mild risk state yields an “85% chance of violating safety within five steps,” while in technical tasks the probability stays “below 5% from any state.” Its monitor detects “94.7% of violations with 3.7 steps of advance warning at negligible computational cost,” and runs “over 60,000x faster” than per-step LLM judges (Dhodapkar et al., 28 Mar 2026).

OOD-MMSafe extends the same logic from temporal accumulation to hidden consequences in multimodal reasoning. The benchmark contains “455 curated query-image pairs” designed to evaluate identification of “latent hazards within context-dependent causal chains,” and reports a “highest 67.5% failure rate in high-capacity closed-source models” (Wen et al., 10 Mar 2026). CASPO then uses “the model’s intrinsic reasoning as a dynamic reference for token-level self-distillation rewards,” with

$Q_C(s,a) + \delta \le d,$0

and reduces the “failure ratio of risk identification to 7.3% for Qwen2.5-VL-7B and 5.7% for Qwen3-VL-4B while maintaining overall effectiveness” (Wen et al., 10 Mar 2026).

Robotic planning frameworks integrate these ideas at multiple layers. SAFER uses a Task Planning LLM, a Safety Agent, LLM-as-a-Judge, and CBF-based execution-time filtering. In simulation and hardware, it reports “up to 77.5% decrease in ASV” for DeepSeek-r1 and “up to 47% decrease in ASV” for GPT-4o, with “only a minor increase in average steps” (Khan et al., 19 Mar 2025).

5. Margin-aware alignment and confidence

In generative-model alignment, margin-awareness appears as a mechanism for suppressing unsafe outputs, but the literature distinguishes sharply between effective and ineffective uses of the margin. For diffusion models, MaPO removes dependence on a frozen reference model and directly maximizes the likelihood margin between chosen and rejected outputs. Its objective is

$Q_C(s,a) + \delta \le d,$1

with

$Q_C(s,a) + \delta \le d,$2

On Pick-Safety, MaPO is “preferred for safety 92% of the time over SFT” and “preferred 87% of the time over Diffusion-DPO” (Hong et al., 2024).

By contrast, “A Common Pitfall of Margin-based LLM Alignment: Gradient Entanglement” shows that margin-based objectives can be under-specified. The paper identifies two consequences as the margin increases: “The probability of dispreferred (e.g., unsafe) responses may increase,” and “The probability of preferred responses may decrease” (Yuan et al., 2024). In the DPO analysis,

$Q_C(s,a) + \delta \le d,$3

$Q_C(s,a) + \delta \le d,$4

so changes in preferred and dispreferred probabilities are coupled by the gradient inner product. The paper terms this effect “gradient entanglement” and proposes remedies including pairwise normalized gradient descent and sparsity-regularized token masking (Yuan et al., 2024).

Margin-awareness is also used for post-hoc confidence correction. SMART recalibrates logits using only the top-two logit gap

$Q_C(s,a) + \delta \le d,$5

with per-sample temperature $Q_C(s,a) + \delta \le d,$6. The paper argues that the logit gap is a “denoised, scalar signal directly tied to decision boundary uncertainty,” and reports that SMART achieves “state-of-the-art calibration performance even with substantially fewer parameters compared to existing parametric methods” (Guo et al., 30 Jun 2025). A plausible implication is that margin-aware safety is not only about preventing physical constraint violations; it also includes controlling when a model is dangerously overconfident near decision boundaries.

6. Verification, falsification, and certification

Verification frameworks increasingly use margin-aware quantities to certify not just nominal safety, but safety with graded uncertainty. In multi-agent systems, the hybrid framework based on $Q_C(s,a) + \delta \le d,$7-weighted CBFs combines deterministic admissibility with Monte Carlo validation and an empirical Bernstein PAC bound,

$Q_C(s,a) + \delta \le d,$8

where the event $Q_C(s,a) + \delta \le d,$9 is a margin-aware violation rather than a simple collision flag (Margapuri et al., 24 Sep 2025). The paper reports that empirical violation rates increase with disturbance bound, while the Bernstein bound achieves the target coverage and is sharper than Hoeffding- or scenario-based bounds (Margapuri et al., 24 Sep 2025).

For AI-enabled control systems, Synthify uses a two-phase falsification loop: it first synthesizes a proxy program, then uses an $Q_C(s,a) + \beta \sigma_C(s,a) + \delta \le d,$0-greedy strategy to choose sub-specifications from a conjunctive safety formula and applies Simulated Annealing to minimize robustness. On eight public systems, it achieves an “83.5% higher success rate in falsification compared to PSY-TaLiRo with the same budget of falsification trials,” and its discovered violations cover “137.7% more sub-specifications” (Shi et al., 2024).

SaSeVAL provides an architecture- and scenario-aware workflow for safety/security co-validation. It traces “safety goal → threat/attack scenario → test description,” uses STRIDE threat types to classify and map threats to attacks, and was applied to autonomous driving and keyless entry use cases to derive “23 attack descriptions” in one case and “27 safety-relevant attacks” in another (Wolschke et al., 2021). This suggests that in cyber-physical systems, margin-aware safety violations can arise from the interaction between operational context and attack surface, even when neither component alone is sufficient to explain the eventual unsafe outcome.

7. Recurrent tensions and open problems

A recurrent tension is whether stronger margins necessarily imply stronger conservatism. The evidence is mixed. USC explicitly targets “over-conservatism” and reports that it breaks “the prevailing trade-off between safety and performance” (Bethell et al., 21 Oct 2025). Yet in smoothed implicit contact dynamics, “constraint violations can be non-monotonic in $Q_C(s,a) + \beta \sigma_C(s,a) + \delta \le d,$1,” and “smaller $Q_C(s,a) + \beta \sigma_C(s,a) + \delta \le d,$2 reduces force-approximation error, but it does not necessarily improve safety performance” (Lee et al., 20 May 2026). In agent monitoring, SafetyDrift shows that category-aware models outperform aggregate monitors because “drift risk is highly task dependent” (Dhodapkar et al., 28 Mar 2026).

A second tension concerns whether margin-based optimization by itself is sufficient. In diffusion alignment, MaPO shows that widening the chosen–rejected margin can directly improve safety preferences (Hong et al., 2024). In language-model alignment, however, gradient entanglement shows that larger margins can coincide with worse suppression of unsafe responses (Yuan et al., 2024). OOD-MMSafe frames a related limitation as a “preference ceiling,” where static alignment leads to “format-centric failures rather than improved safety reasoning as model capacity grows” (Wen et al., 10 Mar 2026).

A third open problem is observability of the relevant boundary. SafeManip argues that longer-horizon and more complex tasks expose temporal safety failures that task-success metrics obscure (Huang et al., 12 May 2026). Criticality-based RL monitoring shows that “the lowest 5% of safety margins contain 47% of agent losses,” so sparse oversight targeted at small-margin states can be highly effective (Grushin et al., 2024). This suggests that future work will continue to focus on better boundary observables: uncertainty estimates, temporal logic monitors, causal-state abstractions, robustness semantics, and calibration signals that preserve class predictions while exposing boundary uncertainty.

Taken together, the literature treats margin-aware safety violations as a unifying analytic object across RL, control, robotics, alignment, and verification. The common thread is not a single metric, but a family of quantitatively grounded notions of “how close,” “for how long,” “under what uncertainty,” and “with what consequence” a system approaches unsafe behavior.