Model Predictive Shielding (MPS)

• Model Predictive Shielding (MPS) is a safety filter that uses predictive control to verify if a nominal action keeps the system recoverable for a trusted backup transition.
• It employs a model-based evaluation of system dynamics to certify safe switching by checking if the next state remains within recoverable and invariant sets.
• Extensions like RMPS, DMPS, and MAMPS adapt MPS for stochastic systems, safe reinforcement learning, and multi-agent scenarios, balancing conservatism with task performance.

Searching arXiv for recent and foundational papers on Model Predictive Shielding. Model Predictive Shielding (MPS) is a backup-based safety filter for autonomous control and reinforcement learning in which a nominal, potentially unsafe policy is monitored online and overridden whenever safety cannot be certified. In its canonical form, MPS uses a model of the dynamics to test whether executing the nominal action for a short interval still leaves the system in a recoverable state, meaning that a backup policy can thereafter drive the system into a safe invariant or controlled-invariant set without violating safety constraints. The method was introduced for deterministic nonlinear dynamics (Bastani, 2019), extended to stochastic nonlinear systems through robust tube-based NMPC and statistical guarantees (Li et al., 2019), generalized to multi-agent and task-aware settings (Zhang et al., 2019, Banerjee et al., 2024), and later situated within a unified theory of backup-based safety filters that also includes Backup CBF and gatekeeper (Kim et al., 2 Apr 2026).

1. Core formulation and safety objective

The original MPS formulation addresses reinforcement learning with known nonlinear dynamics and a designated safe set $\mathcal{X}_{\text{safe}}$. It distinguishes a learned policy $\hat{\pi}$, which may optimize task reward but need not be safe, from a backup policy $\pi_{\text{backup}}$, which is trusted to maintain or recover safety. The shield acts online: at state $x$, it evaluates the hypothetical next state

$x' = f(x,\hat{\pi}(x)),$

and permits the learned action only if $x'$ is recoverable under the backup policy within a finite horizon $N$ (Bastani, 2019).

This recoverability notion is central. The original formulation separates three sets. The safe set $\mathcal{X}_{\text{safe}}$ contains states satisfying the safety specification. The invariant set $\mathcal{X}_{\text{inv}}$ contains states from which the backup policy guarantees infinite-horizon safety. The recoverable set consists of states from which the backup policy can drive the system safely into $\mathcal{X}_{\text{inv}}$ within $\hat{\pi}$0 steps. The shielded policy is therefore

$\hat{\pi}$1

The safety guarantee follows an inductive structure. If the current state is recoverable, then either the learned action is accepted only when the next state remains recoverable, or the backup action is applied and preserves recoverability by construction. The paper states that the trajectory generated by $\hat{\pi}$2 from any initial state $\hat{\pi}$3 is always safe (Bastani, 2019).

The backup policy in the deterministic formulation is itself composite. It combines an equilibrium policy $\hat{\pi}$4, used inside $\hat{\pi}$5, with a recovery policy $\hat{\pi}$6, used outside it: $\hat{\pi}$7 For the cart-pole example, the equilibrium policy is based on LQR around the upright equilibrium, with an invariant region computed via sum-of-squares optimization, while both the learned policy and the recovery policy are trained via RL (Bastani, 2019).

2. Backup-policy abstraction and candidate-trajectory validity

A later comparative review places MPS inside a general backup-based safety-filter abstraction. In that abstraction, a nominal policy $\hat{\pi}$8, a backup policy $\hat{\pi}$9, a safe set $\pi_{\text{backup}}$0, and a terminal controlled-invariant set $\pi_{\text{backup}}$1 are given. The filter operates at discrete update times $\pi_{\text{backup}}$2 with update interval $\pi_{\text{backup}}$3. MPS certifies a candidate trajectory that follows $\pi_{\text{backup}}$4 for one update interval and then switches to $\pi_{\text{backup}}$5 for a backup horizon $\pi_{\text{backup}}$6 (Kim et al., 2 Apr 2026).

Using the notation of that review, the candidate trajectory is

$\pi_{\text{backup}}$7

with the MPS specialization $\pi_{\text{backup}}$8. The validity indicator is

$\pi_{\text{backup}}$9

The resulting decision rule is binary: $x$0

This abstraction makes two structural features explicit. First, MPS is a digital guard: it either allows the nominal controller unchanged for the next interval or replaces it with the backup. Second, its acceptance region can be written as the filter-inactive set

$x$1

namely the states from which one interval of nominal execution can be safely extended by backup to the terminal set $x$2 (Kim et al., 2 Apr 2026).

The same review shows that MPS is a special case of gatekeeper. Gatekeeper searches over feasible switching times $x$3, whereas MPS fixes $x$4. The inclusion

$x$5

formalizes the fact that any state accepted by MPS is accepted by gatekeeper, but not conversely (Kim et al., 2 Apr 2026).

3. Robust MPS for stochastic nonlinear dynamics

The robust extension, termed Robust Model Predictive Shielding (RMPS), addresses stochastic nonlinear systems

$x$6

where $x$7 is a zero-mean random disturbance with known distribution (Li et al., 2019). The objective shifts from deterministic invariance to high-probability safety: keep trajectories within $x$8 with quantifiable confidence despite stochastic disturbances.

RMPS retains the shielding logic but replaces the deterministic backup controller with a tube-based robust NMPC controller. For a current state $x$9, it finds a nearby equilibrium $x' = f(x,\hat{\pi}(x)),$0, computes a nominal reference trajectory $x' = f(x,\hat{\pi}(x)),$1 to that equilibrium over a horizon $x' = f(x,\hat{\pi}(x)),$2, and then solves a receding-horizon NMPC tracking problem with tightened constraints. Once the system reaches a pre-computed invariant set $x' = f(x,\hat{\pi}(x)),$3 around $x' = f(x,\hat{\pi}(x)),$4, a local controller such as LQR keeps it safely inside $x' = f(x,\hat{\pi}(x)),$5 (Li et al., 2019).

The key technical complication is tube estimation under nonlinear stochastic dynamics. Analytical reachable-set computation is treated as intractable, so RMPS uses Monte Carlo sampling. Starting from a state $x' = f(x,\hat{\pi}(x)),$6, it simulates the backup controller under sampled disturbances, records the resulting trajectories, and at each time $x' = f(x,\hat{\pi}(x)),$7 fits a box $x' = f(x,\hat{\pi}(x)),$8 covering the sampled states. Statistical learning theory then yields a PAC-style coverage guarantee: if $x' = f(x,\hat{\pi}(x)),$9 i.i.d. samples are used, the box $x'$0 covering all samples satisfies

$x'$1

with probability at least $x'$2, provided

$x'$3

where $x'$4 is the state dimension (Li et al., 2019). A union bound over $x'$5 timesteps yields a trajectory-level bound with failure probability at most $x'$6 and confidence at least $x'$7.

A state is deemed robustly recoverable if the overapproximated tube $x'$8 remains inside the safe set for all $x'$9, and the terminal set reaches $N$0 under the corresponding tightened conditions (Li et al., 2019). Theorem 1 states that if the current state is robustly recoverable and the shield algorithm verifies this property at every step, then the next state is also robustly recoverable with similar probability, with confidence at least $N$1.

The empirical evaluation reported in the paper uses cart-pole and a non-holonomic particle with random obstacles. RMPS is reported to achieve perfect (probability $N$2) safety in all tested environments, while unshielded learned policies often violate safety, non-robust shielding fails in stochastic settings, and a comparably robust linearized MPC-based shield is less effective in nonlinear or non-holonomic domains (Li et al., 2019). The paper also emphasizes that this does not imply trajectory safety with probability $N$3 in the presence of arbitrary stochastic perturbations; rather, the violation probability can be made arbitrarily small by adjusting $N$4 and the sample size.

4. Reinforcement learning, task-aware recovery, and multi-agent extensions

Within safe reinforcement learning, standard MPS is characterized as a dual-policy composition: a learned policy is used whenever its immediate consequence is recoverable, and a backup policy is used otherwise. This gives safety during both training and deployment, but it also exposes a structural limitation: the backup policy is typically task-oblivious and conservative, for example always braking or stopping, so shield interventions can substantially hinder task progress (Banerjee et al., 2024).

Dynamic Model Predictive Shielding (DMPS) addresses that limitation by replacing the static backup with a dynamically planned safe recovery sequence. When an unsafe nominal action is detected, a local planner searches for actions that keep the agent within recoverable states while maximizing a finite-horizon objective

$N$5

subject to transition constraints and recoverability at each step (Banerjee et al., 2024). The planner uses the learned Q-function to estimate long-term returns beyond its explicit horizon, while the neural policy learns from the recovery plans proposed by the planner. The paper states that DMPS preserves provable safety during and after training and yields a recovery regret that decreases exponentially with planning horizon depth: $N$6 Across 13 continuous, high-dimensional environments, DMPS is reported to reduce shield interventions by 76% relative to MPS on average and to achieve up to 29% higher reward after convergence (Banerjee et al., 2024).

A distinct extension is MAMPS, which generalizes MPS to multi-agent systems. Instead of switching all agents simultaneously to backup, MAMPS assigns each agent either its learned policy or its backup policy via a binary mask $N$7, choosing a configuration that maximizes the number of agents using learned control while preserving joint recoverability (Zhang et al., 2019). Since brute-force search over $N$8 masks is infeasible, the method uses a greedy iterative procedure. The paper proves that the MAMPS policy is safe and reports that both MAMPS and naive MPS ensure safety in all tested scenarios, while MAMPS is substantially less conservative; in more challenging cases such as four-agent environments, it outperforms naive MPS by up to an order of magnitude in performance metrics related to goal achievement (Zhang et al., 2019).

A concise comparison of representative variants is given below.

Variant	Setting	Distinguishing feature
MPS	Deterministic nonlinear systems	One-step nominal action certified by backup recoverability
RMPS	Stochastic nonlinear systems	Tube-based robust NMPC with statistical tube guarantees
DMPS	Safe RL	Dynamic planned recovery using a local planner and learned $N$9-function
MAMPS	Multi-agent RL	Per-agent switching to learned or backup policy

5. Integration with sampling-based predictive control and trajectory generation

The shielding idea has also been integrated into sampling-based MPC and trajectory-generation pipelines. In Shield-MPPI, the underlying controller is Model Predictive Path Integral control, and the shield is realized through Control Barrier Functions (CBFs) in a two-layer architecture (Yin et al., 2023). The first layer augments the rollout cost of every sampled trajectory with a barrier penalty

$\mathcal{X}_{\text{safe}}$0

which downweights unsafe trajectories in the MPPI update. The second layer is an online local shield that performs a short-horizon nonlinear optimization over the candidate control sequence whenever sampled trajectories still violate the CBF condition (Yin et al., 2023). On the AutoRally autonomous racing platform, the paper reports that Shield-MPPI can remain safe and performant with only $\mathcal{X}_{\text{safe}}$1 samples on CPUs, runs at $\mathcal{X}_{\text{safe}}$2, and yields markedly lower crash rates than several robust MPC baselines; for example, the reported crash rates are $\mathcal{X}_{\text{safe}}$3 for Shield-MPPI, $\mathcal{X}_{\text{safe}}$4 for CS-SMPC, $\mathcal{X}_{\text{safe}}$5 for RA-MPPI, $\mathcal{X}_{\text{safe}}$6 for PT-MPPI, and $\mathcal{X}_{\text{safe}}$7 for standard MPPI (Yin et al., 2023).

Safe Model Predictive Diffusion extends shielding into diffusion-based kinodynamic planning. There, every candidate trajectory generated during denoising is passed through a shielded rollout that checks, at each time step, whether the nominal control can be followed while retaining the ability to switch to a precomputed backup policy for $\mathcal{X}_{\text{safe}}$8 steps and return to a controlled-invariant set $\mathcal{X}_{\text{safe}}$9 without leaving the safe set $\mathcal{X}_{\text{inv}}$0 (Kim et al., 6 Dec 2025). The paper states that this procedure is applied to every sample at every denoising step and that Theorem 1 guarantees the resulting executed trajectory remains in $\mathcal{X}_{\text{inv}}$1 for all time. A central consequence is that feasibility and safety are enforced during, rather than after, trajectory generation (Kim et al., 6 Dec 2025).

A related but not identical line uses shielding heuristics rather than classical backup-policy MPS. Belief-space stochastic MPPI introduces a CBF-inspired heuristic in belief space to satisfy chance constraints in nonlinear stochastic control. Safety is enforced through a discrete-time condition

$\mathcal{X}_{\text{inv}}$2

implemented as a penalty in the running cost of a Monte Carlo MPPI controller operating on belief states (Yin et al., 2024). This suggests a broader migration of shielding ideas from runtime override mechanisms toward embedded safety terms in predictive optimization.

6. Conservatism, scope, and terminological boundaries

A recurring issue in the MPS literature is conservatism. The unified review argues that the key source is structural: safety is often evaluated through the feasibility of a backup maneuver rather than through the nominal policy’s own continued safe execution (Kim et al., 2 Apr 2026). In Backup CBF, this appears as a myopic check of immediate backup feasibility. In MPS, the lookahead is extended by one discrete update interval, but the switching time is fixed to $\mathcal{X}_{\text{inv}}$3. If backup is not feasible after that short interval, the nominal policy is overridden even when a longer nominal segment might have remained safe and made backup feasible later. Gatekeeper mitigates this by searching over switching times $\mathcal{X}_{\text{inv}}$4, and the inclusion $\mathcal{X}_{\text{inv}}$5 formalizes the resulting reduction in conservatism (Kim et al., 2 Apr 2026).

Another boundary concerns the meaning of safety guarantees. In deterministic MPS, the guarantee is set invariance under known dynamics and a correctly designed backup policy (Bastani, 2019). In RMPS, the guarantee becomes high-probability safety under stochastic disturbances with known distribution, and the framework explicitly does not claim probability-$\mathcal{X}_{\text{inv}}$6 safety under arbitrary disturbance realizations (Li et al., 2019). In probabilistic MDP shielding more broadly, strong safety and strong permissiveness cannot in general both be preserved when the safety requirement is itself probabilistic; the relevant paper proves that no shield can achieve both for $\mathcal{X}_{\text{inv}}$7 and develops optimistic, pessimistic, offline, and online constructions with different trade-offs (Heck et al., 11 May 2026). Although that work is formulated for probabilistic shielding in MDPs rather than continuous-control MPS specifically, it clarifies an important limit of shield design under stochasticity.

A terminological misconception also arises from acronym reuse. In sequence modeling, “MPS” can denote the “Minimal Predictive Sufficiency State Space Model,” a framework for selective state space models derived from a predictive sufficiency principle (Wang et al., 5 Aug 2025). That usage is unrelated to Model Predictive Shielding. Within control and safe RL, by contrast, MPS consistently refers to a runtime safety filter organized around nominal control, a backup policy, recoverability, and predictive certification of safe switching (Bastani, 2019, Kim et al., 2 Apr 2026).

Taken together, the literature presents MPS not as a single algorithmic instantiation but as a family of backup-policy safety filters. Its canonical ingredients are a nominal controller, a backup policy, a safe set, and an online predictive test of recoverability. Its main fault line is the trade-off between permissiveness and conservatism. Its principal advances have come from richer backup synthesis under stochasticity, task-aware planning during recovery, decentralized switching in multi-agent systems, and tighter integration with sampling-based or generative planners (Li et al., 2019, Banerjee et al., 2024, Zhang et al., 2019, Kim et al., 6 Dec 2025).