---
title: Projection-Based Safety Filters
url: https://www.emergentmind.com/topics/projection-based-safety-filters
type: topic
---

# Projection-Based Safety Filters

Projection-based safety filters are modular control architectures that receive a nominal control command from a planner, learning-based controller, or human operator and replace it only when necessary by the closest control that satisfies a specified safety condition. In the canonical formulation, the filtered action is obtained by solving a constrained optimization problem, typically a QP, that projects the nominal input onto a state-dependent safe action set; if the nominal input is already safe, the filter acts as the identity map [2309.05837]. Across the recent literature, this paradigm appears in CBF-QP controllers, HJ reachability-based action filters, predictive MPC-style filters, probabilistic filters under model uncertainty, and several newer variants that alter the projection metric, avoid generic optimization, or embed the safeguard inside RL pipelines [2309.05837].

## 1. Canonical optimization problem and core semantics

The basic projection-based filter at time \(t\) is written as
\[
u^*(t) = \arg\min_{u \in \mathcal{U}_{\text{safe}}(x(t))} \|u-u_{\text{nom}}(t)\|^2,
\]
where \(x(t)\) is the current state, \(u_{\text{nom}}(t)\) is the candidate input, and \(\mathcal{U}_{\text{safe}}(x(t))\) is the set of inputs that preserve the safe set or satisfy a one-step safety condition [2309.05837]. In unified formulations, the safety constraints may be written explicitly through system dynamics,
\[
x^+(t)=f(x(t),u), \qquad x^+(t)\in \mathcal{X}_{\text{safe}}, \qquad u\in\mathcal{U},
\]
so the optimization projects onto an implicitly defined feasible action set [2309.05837].

For control-affine systems, standard and high-order CBF conditions typically induce affine inequalities in the control input,
\[
A(x)u \le b(x),
\]
and the projection becomes a Euclidean projection onto a polyhedral feasible set,
\[
u_{\rm safe}=\arg\min_u \frac{1}{2}\|u-u_{\rm nom}\|_2^2 \quad \text{subject to} \quad A(x)u\le b(x)
\]
[2606.08255]. This representation is central because it makes explicit that the filter’s intervention is geometrically a nearest-point computation in control space.

A recurrent semantic claim in the literature is “minimal intervention”: the filter alters the nominal action only when necessary, and then only by the minimum amount required by the chosen objective [2309.05837]. A common misconception is that this local minimality implies globally desirable behavior. The inverse-optimality analysis shows that standard CBF-QP filters are pointwise minimizers of control effort at a given state vector, hence myopically optimal, but not infinite-horizon optimal in general [2112.08225].

## 2. Safe sets, certificates, and the unified modular structure

Most projection-based filters are organized around three ingredients: a nominal controller, a safety certificate defining admissibility, and a projection operator. In CBF-based designs, the safe set is usually
\[
\mathcal{S}=\{x \mid h(x)\ge 0\},
\]
with safety enforced by inequalities on the time derivative of \(h\) or its discrete-time analogue [2112.12210]. In HJ reachability-based filtering, the certificate is a value function \(V\), and the admissible control set is the maximal set of controls that keeps the trajectory inside a backward reachable tube or outside an unsafe region [2312.15347].

The unified review emphasizes that apparently disparate safety filters share a common modular structure: each constructs a feasible control set from a safety certificate and then chooses an element of that set by optimizing a proximity objective, possibly augmented with robustness, soft constraints, or prediction [2309.05837]. This suggests that “projection-based” is broader than one-step Euclidean CBF-QP filtering. HJ-based smooth least restrictive filters and smooth blending filters still instantiate the same core idea, but with a reachable-set-derived feasible set and a projection operator defined on that set [2312.15347].

A second misconception is that projection-based filters are necessarily reactive and pointwise. Predictive safety filters explicitly project not onto an instantaneous safe input set but onto a set of input sequences that ensure recursive state and input constraint satisfaction over a horizon, using MPC machinery [2401.11183]. Likewise, layered architectures can stack a predictive filter and a high-rate real-time CBF-QP filter, preserving the projection paradigm while separating long-horizon optimality from instantaneous robustness [2603.00338].

## 3. Principal constructions

The dominant instantiation remains the CBF-QP safety filter. Given a desired control \(\bar u\), the filter solves
\[
u^*=\arg\min_u \|u-\bar u\|_2^2
\]
subject to CBF constraints, often affine in \(u\) for control-affine dynamics [2409.09868]. In probabilistic settings, the safe set itself is uncertainty-aware: ProBF models the projection of residual dynamics onto the CBF derivative using Gaussian processes and computes the closest input satisfying a high-probability safety constraint, with a convex QCQP reformulation [2112.12210].

HJ reachability produces a different but closely related construction. Rather than encoding safety through a barrier derivative, it characterizes the maximal safe or live control set directly from the reachability value function. Filters then differ by how aggressively they restrict that maximal set: the least restrictive filter switches to an HJ controller only on the boundary, smooth least restrictive filtering projects the nominal input onto the full safe/live set on the boundary, and smooth blending enforces a CBF-like inequality involving \(-\gamma V(x,t)\) at every step [2312.15347].

Predictive filters generalize projection from single actions to finite-horizon sequences. One line of work uses MPC-like optimization to project potentially unsafe inputs onto the set of sequences that guarantee recursive feasibility; a further extension enforces decrease of an implicit Lyapunov function defined on an extended state consisting of the system state and a warmstart input sequence, thereby obtaining robust asymptotic stability with respect to a predefined disturbance set [2401.11183]. A multistage version couples a predictive safety filter based on a PSF-derived CBF with an instantaneous velocity-level CBF-QP, yielding formal safety guarantees for the full-order system under tracking assumptions [2603.00338].

More recent work alters the projection operator itself. “Exact Optimization-Free Safety Filters for Control Barrier Functions” derives conditions under which the Euclidean projection can be computed exactly without solving a QP, by correcting only the affine inequalities violated by the nominal control and checking explicit primal and dual feasibility conditions; the structural condition is expressed through the Gram matrix of violated constraint normals [2606.08255]. “Curvature-Guided Safety Filters” replaces the Euclidean norm by a state-dependent weighted norm derived from the negative Hessian of the action-value function,
\[
u_W=\arg\min_{u\in\mathcal{U}(x)} \|u-u_{\text{ref}}\|_{W(x)}^2,
\]
preserving convexity when \(W(x)\succ 0\) and establishing bounds on the performance gap relative to the safe value-optimal action [2602.12603].

| Construction | Projection set or constraint source | Characteristic feature |
|---|---|---|
| CBF-QP | Barrier inequality | Minimal Euclidean intervention |
| HJ filtering | Reachability-derived safe/live controls | Explicit safe control set geometry |
| Predictive filter | Horizon-feasible input sequences | Recursive feasibility and stability |
| Optimization-free CBF filter | Violated affine inequalities | Exactness certified online |
| Curvature-guided filter | Safe set with Hessian-weighted norm | Value-sensitive correction |

## 4. Feasibility, conservatism, smoothness, and computation

Feasibility is the first structural limitation. Projection-based filters require the safe input set to be nonempty; otherwise the optimization has no admissible solution [2309.05837]. In CBF formulations, this issue is usually handled through careful barrier design, backup policies, or robustification; in probabilistic variants, it may surface as explicit infeasibility warnings when no action satisfies the desired confidence level [2112.12210].

Conservatism is the second recurring concern. The review literature identifies model dependence and conservative safe sets as longstanding issues, especially when filters are used to safeguard data-driven or end-to-end policies [2309.05837]. A data-driven response appears in “From Raw Data to Safety: Reducing Conservatism by Set Expansion,” which proposes online and offline sample-based methods to expand the safe set of a purely Data-Driven Safety Filter based on Willems’ lemma, systematically handling unknown and time-delay LTI systems using only one single batch of data, and reporting notably large input-output safe sets even with an extremely short prediction horizon [2403.15883].

Smoothness is an independent axis. HJ filtering can produce abrupt switching and bang-bang behavior, motivating smooth least restrictive and smooth blending variants that trade computation for smoother interventions [2312.15347]. A different approach is to avoid online projection entirely: an ellipsoidal set-theoretic robust safety filter computes an RCI ellipsoid and backup controller offline and then uses a smooth mixing strategy based on distance to the invariant-set boundary, thereby contrasting with classical projection-based filters that solve online QPs [2510.22790]. This suggests that smoothness and computational tractability can also be pursued by moving complexity offline rather than refining the projection online.

Scalability has become a salient issue in perception-driven robotics. SAFER-Splat demonstrates that CBF-based projection can be scaled to maps with hundreds of thousands of Gaussian primitives while operating at \(15\) Hz during online Splat training, with over \(99.9\%\) constraint reduction through pruning and reported performance \(20\)-\(50\times\) faster, safer, and less conservative than competing NeRF-based methods [2409.09868]. The result is significant because it shows that projection-based filtering is not confined to low-dimensional handcrafted obstacle models.

## 5. Learning-enabled control and reinforcement learning

In learning-enabled control, projection-based filters are often positioned as a safety layer on top of an otherwise unconstrained policy. Their appeal lies in modularity, but their interaction with learning dynamics is subtle. In probabilistic barrier filtering, uncertainty in residual dynamics is modeled directly in the safety constraint, so intervention increases in regions of high epistemic uncertainty; the resulting projection is therefore intentionally more conservative where the learned model is less certain [2112.12210].

In RL, projection-based safeguards can be integrated either as part of the environment or as part of the policy. The distinction is formalized as safe environment RL (SE-RL), where the environment projects unsafe actions before execution, and safe policy RL (SP-RL), where the safeguard is embedded in the policy through differentiable optimization layers [2509.12833]. Although both realize the same basic projection operator,
\[
\Phi(x,u)=\arg\min_{\tilde u\in\mathcal{U}} \frac{1}{2}\|\tilde u-u\|_2^2
\quad \text{s.t.} \quad s(x,\tilde u)\le 0,
\]
their learning behavior differs because of action aliasing [2509.12833].

Action aliasing occurs when multiple unsafe actions are projected to the same safe action. In SE-RL, this effect is implicitly absorbed by the critic; in SP-RL, it appears directly as rank-deficient Jacobians during backpropagation through the safeguard, creating a zero-gradient problem [2509.12833]. This weakens the common assumption that differentiability of the projection layer is automatically advantageous. The cited analysis further reports that action aliasing is more detrimental for SP-RL than for SE-RL, though penalty-based improvements can allow SP-RL to match or outperform improved SE-RL in some environments [2509.12833].

A related line of work uses value information not for policy training but to redesign the projection metric itself. Hessian-guided weighted projection biases corrections toward action directions with larger value sensitivity while remaining convex, and a data-driven fitted \(Q\)-iteration procedure is proposed to estimate the weighting matrix for black-box controllers [2602.12603]. This suggests a broader shift from purely geometric minimal intervention toward performance-aware minimal intervention.

## 6. Inverse optimality, inference, and decentralized extensions

The infinite-horizon interpretation of projection-based safety filters remains contested. “Inverse Optimal Safety Filters” shows that standard CBF-QP filters minimize deviation from the nominal control only instantaneously. It then constructs entire families of inverse-optimal filters for systems affine in control and disturbances by scaling the standard QP correction,
\[
u=u_0+\beta\,\bar u_{\rm QP}, \qquad \beta\ge 2,
\]
thereby favoring safety over alertness relative to the standard QP and linking the resulting filters to HJI-based infinite-horizon objectives [2112.08225]. This suggests that local Euclidean projection is only one point in a broader optimality landscape.

Projection-based filters have also become objects of inference rather than merely mechanisms of intervention. “Inverse Safety Filtering” exploits the KKT structure of CBF-QP safety filters to infer active constraints from observed safety-filtered actions of other agents. Under sufficient conditions involving active constraints, sufficient actuation, and barrier sensitivity, the paper proves convergence of the inferred constraint parameters and couples the inference rule with a decentralized planning method that preserves safety when the constraint activation distance is sufficiently large [2604.02687]. In this setting, the geometry of the projection map becomes an implicit communication channel.

More broadly, these developments indicate that projection-based safety filters now function simultaneously as controllers, wrappers for learning systems, computational objects with exactness and scalability questions, and informational structures whose KKT multipliers and correction directions can be interpreted, optimized, or inverted. A plausible implication is that future work will continue to hybridize projection with prediction, uncertainty quantification, and offline set synthesis rather than treating the per-step Euclidean QP as the definitive endpoint of the paradigm.

Source: https://www.emergentmind.com/topics/projection-based-safety-filters