MPC-SafeGIL: Safety-Aware Imitation Learning

• MPC-SafeGIL is a safety-aware imitation learning method that injects adversarial disturbances into expert demonstrations to expose recovery behaviors.
• It employs sampling-based MPC (MPPI) to approximate worst-case disturbances, enabling scalable application to high-dimensional and black-box systems.
• Empirical evaluations in quadruped, autonomous racing, and quadrotor experiments demonstrate significant safety and performance improvements over standard methods.

MPC-SafeGIL is a design-time method for safety-aware imitation learning that injects adversarial disturbances during expert demonstrations so that the training distribution includes safety-critical and near-failure states (Qiu et al., 5 Aug 2025). Rather than treating safety only as a deployment-time intervention problem, it uses sampling-based Model Predictive Control (MPC), specifically Model Predictive Path Integral (MPPI), to approximate worst-case disturbances that push the system toward unsafe regions while the expert recovers. The resulting demonstrations expose the learner to recovery behaviors that are typically absent in standard behavior-cloning datasets, and the method is presented as scalable to high-dimensional and black-box dynamical systems. Its evaluation includes quadruped locomotion, visuomotor navigation, and real-world quadrotor experiments, where both safety and task performance improve relative to standard imitation-learning baselines (Qiu et al., 5 Aug 2025).

1. Problem formulation and motivation

The starting point for MPC-SafeGIL is a standard limitation of imitation learning: policies trained from expert demonstrations can incur safety violations at deployment because of covariate shift, learning error, and unforeseen disturbances (Qiu et al., 5 Aug 2025). In the formulation used by the method, the system dynamics are written as

$x_{t+1} = f(x_t, u_t),$

with state $x \in \mathbb{R}^{n_x}$ and control $u \in \mathbb{R}^{n_u}$. Safety is encoded through a failure set

$\mathcal{L} = \{ x : l(x) \leq 0 \},$

and the objective is to learn a policy $\pi_\theta$ that imitates an expert $\pi^*$ while avoiding entry into $\mathcal{L}$ during deployment (Qiu et al., 5 Aug 2025).

This problem setting differentiates MPC-SafeGIL from two familiar safety strategies. The first is deployment-time mitigation, such as safety filters based on Control Barrier Functions or reachability analysis, which intervene when a learned policy is about to violate a safety constraint. The second is design-time data aggregation or augmentation, such as DAgger, GAIL, or generic disturbance injection, which may address covariate shift but do not treat safety as a first-class objective during data collection or policy optimization (Qiu et al., 5 Aug 2025). The paper positions SafeGIL as a closer antecedent because it also injects adversarial disturbances, but notes that its Hamilton-Jacobi reachability machinery does not scale beyond moderate state dimensionality and requires analytical models (Qiu et al., 5 Aug 2025).

A central premise of MPC-SafeGIL is therefore that safety-relevant robustness can be improved by changing the demonstration distribution itself. This suggests a view of safe imitation learning in which the key intervention is not only runtime constraint enforcement, but also deliberate exposure of the expert to off-nominal states during data generation.

2. Guided expert demonstrations

The core mechanism is adversarial disturbance injection into expert rollouts. Test-time policy errors are abstracted as state-dependent disturbances $d(x)$ that push the system toward unsafe regions. The guided expert policy is defined as

$\pi^G(x) = \pi^*(x) + d^*(x),$

where $d^*(x)$ is the worst-case disturbance selected for the current state (Qiu et al., 5 Aug 2025).

In the data-collection loop, the expert does not merely demonstrate nominal behavior. At each time step, MPC-SafeGIL computes an adversarial disturbance, perturbs the expert’s executed control, advances the dynamics under the perturbed action, and stores the pair $x \in \mathbb{R}^{n_x}$0 in the dataset. In the pseudocode summarized in the paper, the stored supervision target is the unperturbed expert action, while the transition dynamics reflect the guided control $x \in \mathbb{R}^{n_x}$1 (Qiu et al., 5 Aug 2025). This arrangement is intended to generate demonstrations containing corrective maneuvers and recovery behaviors without replacing the expert target with the adversarially perturbed command itself.

The method is explicitly framed as a design-time approach. A common misconception is to interpret it as an online safety filter. The paper instead describes it as integrating safety considerations directly into data collection, so that the learned policy encounters risky states and corresponding expert recoveries before deployment (Qiu et al., 5 Aug 2025).

3. Robust optimal control reduction and MPPI disturbance synthesis

The adversarial disturbance is obtained from a robust optimal control problem. The paper writes the disturbance-computation problem as

$x \in \mathbb{R}^{n_x}$2

with cost

$x \in \mathbb{R}^{n_x}$3

and bounds $x \in \mathbb{R}^{n_x}$4, $x \in \mathbb{R}^{n_x}$5 (Qiu et al., 5 Aug 2025). The disturbance perturbs the control input directly, and the objective is to drive the rollout toward the closest failure.

For tractability, especially in high-dimensional settings and under control-affine dynamics, the paper reduces the max-min problem to a single-player optimal control problem: $x \in \mathbb{R}^{n_x}$6 where $x \in \mathbb{R}^{n_x}$7 (Qiu et al., 5 Aug 2025). The equivalence of this reduction under control-affine dynamics is stated to be proved in the appendix of the paper.

The resulting single-player problem is solved with MPPI. MPPI samples $x \in \mathbb{R}^{n_x}$8 control sequences $x \in \mathbb{R}^{n_x}$9 of horizon length $u \in \mathbb{R}^{n_u}$0, simulates the dynamics forward, evaluates the objective $u \in \mathbb{R}^{n_u}$1, selects the top $u \in \mathbb{R}^{n_u}$2 sequences, and aggregates them with a softmax weighting: $u \in \mathbb{R}^{n_u}$3 Under control-affine dynamics, the disturbance is then extracted from the sign of the first optimized control: $u \in \mathbb{R}^{n_u}$4 This procedure is the source of the method’s claim to scalability: it replaces exact Hamilton-Jacobi reachability with sampling-based MPC and is described as applicable to black-box and high-dimensional systems (Qiu et al., 5 Aug 2025).

4. Methodological position relative to prior imitation-learning and safety approaches

MPC-SafeGIL is distinguished in the paper from standard imitation-learning pipelines by the explicit use of adversarial, safety-directed disturbance injection during demonstration collection. The distinctions summarized in the paper are as follows.

Approach	Safety as objective in data collection	Dynamics/scalability characterization
BC and common imitation	No	No disturbance strategy
DAgger/data augmentation	Indirect (by error reduction)	Random/directed exposure
GAIL	No	Learned via discriminator
SafeGIL (HJ reachability)	Yes	Requires analytical dynamics; limited $u \in \mathbb{R}^{n_u}$5D
MPC-SafeGIL	Yes (explicit in data collection)	Approx. optimal disturbance via MPPI; no analytical dynamics

Within that comparison, the most important contrast is with SafeGIL. SafeGIL uses Hamilton-Jacobi reachability to expose the expert to dangerous states, whereas MPC-SafeGIL approximates worst-case disturbances with MPPI and does not require analytical access to the system dynamics (Qiu et al., 5 Aug 2025). The paper also contrasts the method with deployment-time safety filters: combining MPC-SafeGIL with an online safety filter can further improve safety, but MPC-SafeGIL’s own contribution is to increase the inherent safety of the learned policy through demonstration design rather than through mandatory runtime overrides (Qiu et al., 5 Aug 2025).

A second misconception addressed by the empirical results is that arbitrary noise injection is sufficient. The paper reports that adversarial MPC-guided noise outperformed random noise and DART, which indicates that the disturbance distribution matters, not merely the presence of perturbations (Qiu et al., 5 Aug 2025).

5. Empirical evaluation

The evaluation spans simulation studies and real-world experiments and is organized around domains where safety failures are operationally salient (Qiu et al., 5 Aug 2025). In simulation, the method is tested on quadruped navigation in Isaac Gym and on F1Tenth autonomous racing. In hardware, it is evaluated on a Crazyflie quadrotor navigating cluttered indoor environments using only 8 ToF sensors (Qiu et al., 5 Aug 2025).

In quadruped navigation, the task is to reach a goal through clutter with LiDAR perception using a hierarchical controller. The paper reports that MPC-SafeGIL produced much lower collision rates than vanilla BC, particularly in the low-data regime. With 80 demonstrations, the collision rate was reported as approximately $u \in \mathbb{R}^{n_u}$6, whereas BC was much higher (Qiu et al., 5 Aug 2025). GAIL achieved low collision rates but struggled with goal-reaching because it became overly conservative, while MPC-SafeGIL maintained both low collisions and high success rates. The same study reports that adversarial MPC noise injection outperformed random noise and DART, and that increasing the disturbance bound improved robustness only up to a point, after which learning degraded because the perturbations became overly adversarial (Qiu et al., 5 Aug 2025).

In F1Tenth autonomous racing, the learned policy is visuomotor and LiDAR-based, and the task is to avoid curbs while completing laps at high speed. The paper states that MPC-SafeGIL outperformed BC, DAgger, and random-noise methods on both average distance and collision rate, with the advantage especially pronounced in the low-data regime (Qiu et al., 5 Aug 2025). It further reports that combining MPC-SafeGIL with a test-time MPC safety filter improved safety again, but that the learned policy’s inherent safety remained superior to the baselines even without that additional intervention. On an unseen racetrack, MPC-SafeGIL achieved the longest average distance before collision, which is presented as evidence of robustness under distribution shift (Qiu et al., 5 Aug 2025).

In the quadrotor study, the policy is transferred from simulation to real hardware. In simulation, MPC-SafeGIL achieved approximately $u \in \mathbb{R}^{n_u}$7 safe trajectories compared with BC’s $u \in \mathbb{R}^{n_u}$8 (Qiu et al., 5 Aug 2025). On real hardware, the method maintained a stable safety rate, with $u \in \mathbb{R}^{n_u}$9 runs succeeding, whereas BC degraded to $\mathcal{L} = \{ x : l(x) \leq 0 \},$0 (Qiu et al., 5 Aug 2025). The qualitative explanation given in the paper is that MPC-SafeGIL learned recovery maneuvers such as retreat, reorient, and resume, which were largely absent from BC datasets because nominal demonstrations rarely visited risky states. The paper also states that the method succeeded in heavily cluttered and dynamic environments with moving obstacles, whereas BC policies failed (Qiu et al., 5 Aug 2025).

6. Interpretation, scope, and relation to adjacent MPC-based safety research

MPC-SafeGIL occupies a distinct position within the broader use of MPC for safety-aware learning. Some recent work uses MPC as an online mechanism for enforcing constraints after a policy has been proposed, as in DeepSafeMPC for safe multi-agent reinforcement learning, where a learned centralized dynamics model supports safety-constrained MPC refinement at execution time (Wang et al., 2024). Other work uses MPC structure to obtain efficient controllers with explicit stability and constraint-satisfaction guarantees through learned value functions, as in softened and tightened MPC value-function approximation for embedded implementation (Chatzikiriakos et al., 2024). MPC-SafeGIL differs from both directions because its MPC component is deployed during expert data collection to shape the training distribution rather than primarily to refine online actions or compress an MPC policy into a deployable surrogate (Qiu et al., 5 Aug 2025).

This positioning clarifies both the scope and the limitations of the method. It is not presented as a complete replacement for deployment-time safety mechanisms; the paper explicitly reports that combining it with an online safety filter can further improve safety (Qiu et al., 5 Aug 2025). Nor is it described as exact worst-case reachability analysis; its disturbances are approximate and are obtained through MPPI sampling rather than through Hamilton-Jacobi computation (Qiu et al., 5 Aug 2025). A plausible implication is that MPC-SafeGIL is most naturally understood as a distribution-shaping procedure for safety-critical imitation learning: it changes what the expert sees during training so that the learner later encounters fewer genuinely novel failure modes.

The paper’s central claim is therefore narrower than absolute safety certification but broader than ordinary robustness augmentation. It proposes that safety can be materially improved by collecting demonstrations under systematically chosen adversarial perturbations, and it supports that claim with simulation and real-robot evidence across locomotion, racing, and navigation tasks (Qiu et al., 5 Aug 2025).