Projection-Based Safety Filters

• Projection-Based Safety Filters are modular control architectures that project a nominal control input onto a safe set defined by state-dependent constraints.
• They implement various formulations including CBF-QP, HJ reachability, and predictive MPC-style filters to intervene minimally and maintain system safety.
• Recent advances modify the projection operator using uncertainty quantification and offline computations to ensure smooth, scalable, and performance-aware safety interventions.

Projection-based safety filters are modular control architectures that receive a nominal control command from a planner, learning-based controller, or human operator and replace it only when necessary by the closest control that satisfies a specified safety condition. In the canonical formulation, the filtered action is obtained by solving a constrained optimization problem, typically a QP, that projects the nominal input onto a state-dependent safe action set; if the nominal input is already safe, the filter acts as the identity map (Hsu et al., 2023). Across the recent literature, this paradigm appears in CBF-QP controllers, HJ reachability-based action filters, predictive MPC-style filters, probabilistic filters under model uncertainty, and several newer variants that alter the projection metric, avoid generic optimization, or embed the safeguard inside RL pipelines (Hsu et al., 2023).

1. Canonical optimization problem and core semantics

The basic projection-based filter at time $t$ is written as

$$u^*(t) = \arg\min_{u \in \mathcal{U}_{\text{safe}}(x(t))} \|u-u_{\text{nom}}(t)\|^2,$$

where $x(t)$ is the current state, $u_{\text{nom}}(t)$ is the candidate input, and $\mathcal{U}_{\text{safe}}(x(t))$ is the set of inputs that preserve the safe set or satisfy a one-step safety condition (Hsu et al., 2023). In unified formulations, the safety constraints may be written explicitly through system dynamics,

$$x^+(t)=f(x(t),u), \qquad x^+(t)\in \mathcal{X}_{\text{safe}}, \qquad u\in\mathcal{U},$$

so the optimization projects onto an implicitly defined feasible action set (Hsu et al., 2023).

For control-affine systems, standard and high-order CBF conditions typically induce affine inequalities in the control input,

$A(x)u \le b(x),$

and the projection becomes a Euclidean projection onto a polyhedral feasible set,

$$u_{\rm safe}=\arg\min_u \frac{1}{2}\|u-u_{\rm nom}\|_2^2 \quad \text{subject to} \quad A(x)u\le b(x)$$

(Goel, 6 Jun 2026). This representation is central because it makes explicit that the filter’s intervention is geometrically a nearest-point computation in control space.

A recurrent semantic claim in the literature is “minimal intervention”: the filter alters the nominal action only when necessary, and then only by the minimum amount required by the chosen objective (Hsu et al., 2023). A common misconception is that this local minimality implies globally desirable behavior. The inverse-optimality analysis shows that standard CBF-QP filters are pointwise minimizers of control effort at a given state vector, hence myopically optimal, but not infinite-horizon optimal in general (Krstic, 2021).

2. Safe sets, certificates, and the unified modular structure

Most projection-based filters are organized around three ingredients: a nominal controller, a safety certificate defining admissibility, and a projection operator. In CBF-based designs, the safe set is usually

$\mathcal{S}=\{x \mid h(x)\ge 0\},$

with safety enforced by inequalities on the time derivative of $h$ or its discrete-time analogue (Kumar et al., 2021). In HJ reachability-based filtering, the certificate is a value function $$u^*(t) = \arg\min_{u \in \mathcal{U}_{\text{safe}}(x(t))} \|u-u_{\text{nom}}(t)\|^2,$$0, and the admissible control set is the maximal set of controls that keeps the trajectory inside a backward reachable tube or outside an unsafe region (Borquez et al., 2023).

The unified review emphasizes that apparently disparate safety filters share a common modular structure: each constructs a feasible control set from a safety certificate and then chooses an element of that set by optimizing a proximity objective, possibly augmented with robustness, soft constraints, or prediction (Hsu et al., 2023). This suggests that “projection-based” is broader than one-step Euclidean CBF-QP filtering. HJ-based smooth least restrictive filters and smooth blending filters still instantiate the same core idea, but with a reachable-set-derived feasible set and a projection operator defined on that set (Borquez et al., 2023).

A second misconception is that projection-based filters are necessarily reactive and pointwise. Predictive safety filters explicitly project not onto an instantaneous safe input set but onto a set of input sequences that ensure recursive state and input constraint satisfaction over a horizon, using MPC machinery (Didier et al., 2024). Likewise, layered architectures can stack a predictive filter and a high-rate real-time CBF-QP filter, preserving the projection paradigm while separating long-horizon optimality from instantaneous robustness (Yamaguchi et al., 27 Feb 2026).

3. Principal constructions

The dominant instantiation remains the CBF-QP safety filter. Given a desired control $$u^*(t) = \arg\min_{u \in \mathcal{U}_{\text{safe}}(x(t))} \|u-u_{\text{nom}}(t)\|^2,$$1, the filter solves

$$u^*(t) = \arg\min_{u \in \mathcal{U}_{\text{safe}}(x(t))} \|u-u_{\text{nom}}(t)\|^2,$$2

subject to CBF constraints, often affine in $$u^*(t) = \arg\min_{u \in \mathcal{U}_{\text{safe}}(x(t))} \|u-u_{\text{nom}}(t)\|^2,$$3 for control-affine dynamics (Chen et al., 2024). In probabilistic settings, the safe set itself is uncertainty-aware: ProBF models the projection of residual dynamics onto the CBF derivative using Gaussian processes and computes the closest input satisfying a high-probability safety constraint, with a convex QCQP reformulation (Kumar et al., 2021).

HJ reachability produces a different but closely related construction. Rather than encoding safety through a barrier derivative, it characterizes the maximal safe or live control set directly from the reachability value function. Filters then differ by how aggressively they restrict that maximal set: the least restrictive filter switches to an HJ controller only on the boundary, smooth least restrictive filtering projects the nominal input onto the full safe/live set on the boundary, and smooth blending enforces a CBF-like inequality involving $$u^*(t) = \arg\min_{u \in \mathcal{U}_{\text{safe}}(x(t))} \|u-u_{\text{nom}}(t)\|^2,$$4 at every step (Borquez et al., 2023).

Predictive filters generalize projection from single actions to finite-horizon sequences. One line of work uses MPC-like optimization to project potentially unsafe inputs onto the set of sequences that guarantee recursive feasibility; a further extension enforces decrease of an implicit Lyapunov function defined on an extended state consisting of the system state and a warmstart input sequence, thereby obtaining robust asymptotic stability with respect to a predefined disturbance set (Didier et al., 2024). A multistage version couples a predictive safety filter based on a PSF-derived CBF with an instantaneous velocity-level CBF-QP, yielding formal safety guarantees for the full-order system under tracking assumptions (Yamaguchi et al., 27 Feb 2026).

More recent work alters the projection operator itself. “Exact Optimization-Free Safety Filters for Control Barrier Functions” derives conditions under which the Euclidean projection can be computed exactly without solving a QP, by correcting only the affine inequalities violated by the nominal control and checking explicit primal and dual feasibility conditions; the structural condition is expressed through the Gram matrix of violated constraint normals (Goel, 6 Jun 2026). “Curvature-Guided Safety Filters” replaces the Euclidean norm by a state-dependent weighted norm derived from the negative Hessian of the action-value function,

$$u^*(t) = \arg\min_{u \in \mathcal{U}_{\text{safe}}(x(t))} \|u-u_{\text{nom}}(t)\|^2,$$5

preserving convexity when $$u^*(t) = \arg\min_{u \in \mathcal{U}_{\text{safe}}(x(t))} \|u-u_{\text{nom}}(t)\|^2,$$6 and establishing bounds on the performance gap relative to the safe value-optimal action (Lin et al., 13 Feb 2026).

Construction	Projection set or constraint source	Characteristic feature
CBF-QP	Barrier inequality	Minimal Euclidean intervention
HJ filtering	Reachability-derived safe/live controls	Explicit safe control set geometry
Predictive filter	Horizon-feasible input sequences	Recursive feasibility and stability
Optimization-free CBF filter	Violated affine inequalities	Exactness certified online
Curvature-guided filter	Safe set with Hessian-weighted norm	Value-sensitive correction

4. Feasibility, conservatism, smoothness, and computation

Feasibility is the first structural limitation. Projection-based filters require the safe input set to be nonempty; otherwise the optimization has no admissible solution (Hsu et al., 2023). In CBF formulations, this issue is usually handled through careful barrier design, backup policies, or robustification; in probabilistic variants, it may surface as explicit infeasibility warnings when no action satisfies the desired confidence level (Kumar et al., 2021).

Conservatism is the second recurring concern. The review literature identifies model dependence and conservative safe sets as longstanding issues, especially when filters are used to safeguard data-driven or end-to-end policies (Hsu et al., 2023). A data-driven response appears in “From Raw Data to Safety: Reducing Conservatism by Set Expansion,” which proposes online and offline sample-based methods to expand the safe set of a purely Data-Driven Safety Filter based on Willems’ lemma, systematically handling unknown and time-delay LTI systems using only one single batch of data, and reporting notably large input-output safe sets even with an extremely short prediction horizon (Bajelani et al., 2024).

Smoothness is an independent axis. HJ filtering can produce abrupt switching and bang-bang behavior, motivating smooth least restrictive and smooth blending variants that trade computation for smoother interventions (Borquez et al., 2023). A different approach is to avoid online projection entirely: an ellipsoidal set-theoretic robust safety filter computes an RCI ellipsoid and backup controller offline and then uses a smooth mixing strategy based on distance to the invariant-set boundary, thereby contrasting with classical projection-based filters that solve online QPs (Pordal et al., 26 Oct 2025). This suggests that smoothness and computational tractability can also be pursued by moving complexity offline rather than refining the projection online.

Scalability has become a salient issue in perception-driven robotics. SAFER-Splat demonstrates that CBF-based projection can be scaled to maps with hundreds of thousands of Gaussian primitives while operating at $$u^*(t) = \arg\min_{u \in \mathcal{U}_{\text{safe}}(x(t))} \|u-u_{\text{nom}}(t)\|^2,$$7 Hz during online Splat training, with over $$u^*(t) = \arg\min_{u \in \mathcal{U}_{\text{safe}}(x(t))} \|u-u_{\text{nom}}(t)\|^2,$$8 constraint reduction through pruning and reported performance $$u^*(t) = \arg\min_{u \in \mathcal{U}_{\text{safe}}(x(t))} \|u-u_{\text{nom}}(t)\|^2,$$9-$x(t)$0 faster, safer, and less conservative than competing NeRF-based methods (Chen et al., 2024). The result is significant because it shows that projection-based filtering is not confined to low-dimensional handcrafted obstacle models.

5. Learning-enabled control and reinforcement learning

In learning-enabled control, projection-based filters are often positioned as a safety layer on top of an otherwise unconstrained policy. Their appeal lies in modularity, but their interaction with learning dynamics is subtle. In probabilistic barrier filtering, uncertainty in residual dynamics is modeled directly in the safety constraint, so intervention increases in regions of high epistemic uncertainty; the resulting projection is therefore intentionally more conservative where the learned model is less certain (Kumar et al., 2021).

In RL, projection-based safeguards can be integrated either as part of the environment or as part of the policy. The distinction is formalized as safe environment RL (SE-RL), where the environment projects unsafe actions before execution, and safe policy RL (SP-RL), where the safeguard is embedded in the policy through differentiable optimization layers (Markgraf et al., 16 Sep 2025). Although both realize the same basic projection operator,

$x(t)$1

their learning behavior differs because of action aliasing (Markgraf et al., 16 Sep 2025).

Action aliasing occurs when multiple unsafe actions are projected to the same safe action. In SE-RL, this effect is implicitly absorbed by the critic; in SP-RL, it appears directly as rank-deficient Jacobians during backpropagation through the safeguard, creating a zero-gradient problem (Markgraf et al., 16 Sep 2025). This weakens the common assumption that differentiability of the projection layer is automatically advantageous. The cited analysis further reports that action aliasing is more detrimental for SP-RL than for SE-RL, though penalty-based improvements can allow SP-RL to match or outperform improved SE-RL in some environments (Markgraf et al., 16 Sep 2025).

A related line of work uses value information not for policy training but to redesign the projection metric itself. Hessian-guided weighted projection biases corrections toward action directions with larger value sensitivity while remaining convex, and a data-driven fitted $x(t)$2-iteration procedure is proposed to estimate the weighting matrix for black-box controllers (Lin et al., 13 Feb 2026). This suggests a broader shift from purely geometric minimal intervention toward performance-aware minimal intervention.

6. Inverse optimality, inference, and decentralized extensions

The infinite-horizon interpretation of projection-based safety filters remains contested. “Inverse Optimal Safety Filters” shows that standard CBF-QP filters minimize deviation from the nominal control only instantaneously. It then constructs entire families of inverse-optimal filters for systems affine in control and disturbances by scaling the standard QP correction,

$x(t)$3

thereby favoring safety over alertness relative to the standard QP and linking the resulting filters to HJI-based infinite-horizon objectives (Krstic, 2021). This suggests that local Euclidean projection is only one point in a broader optimality landscape.

Projection-based filters have also become objects of inference rather than merely mechanisms of intervention. “Inverse Safety Filtering” exploits the KKT structure of CBF-QP safety filters to infer active constraints from observed safety-filtered actions of other agents. Under sufficient conditions involving active constraints, sufficient actuation, and barrier sensitivity, the paper proves convergence of the inferred constraint parameters and couples the inference rule with a decentralized planning method that preserves safety when the constraint activation distance is sufficiently large (Nguyen et al., 3 Apr 2026). In this setting, the geometry of the projection map becomes an implicit communication channel.

More broadly, these developments indicate that projection-based safety filters now function simultaneously as controllers, wrappers for learning systems, computational objects with exactness and scalability questions, and informational structures whose KKT multipliers and correction directions can be interpreted, optimized, or inverted. A plausible implication is that future work will continue to hybridize projection with prediction, uncertainty quantification, and offline set synthesis rather than treating the per-step Euclidean QP as the definitive endpoint of the paradigm.