Safety State in Safety-Critical Systems

• Safety State is an evolving property of a system’s state, defined through invariant sets, barrier functions, and temporal representations that guide safe operations.
• It unifies diverse domains such as nonlinear control, safe reinforcement learning, and conversational AI by encoding safety into state augmentation frameworks.
• The approach enhances robustness by integrating disturbance bounds, uncertainty quantification, and dynamic safety filtering to ensure consistent safety performance.

Safety State denotes a state-centric formulation of safety in which safety is expressed not only as a property of actions or outcomes, but as a property of the evolving state itself, often after augmentation by barrier, budget, uncertainty, or history variables. In control-theoretic work, Safety State typically means maintaining the system state inside a safe set such as $\mathcal{C}=\{x\mid h(x)\ge 0\}$, or inside a disturbance-enlarged set $\mathcal{C}_d=\{x\mid h(x)+\gamma(\|d\|)\ge 0\}$ under bounded disturbances (Romdlony et al., 2017, Kolathaya et al., 2018). In safe reinforcement learning, it can denote either a one-dimensional Safety State $z_t$ tracking remaining safety budget or a sequence-level state window $S_{t-L:t}$ whose anomaly score defines instantaneous risk (Sootla et al., 2022, Kweider et al., 2024). In multi-turn language-model safety, it is formalized as a conversational state $s_t=(H_t,z_t)$ evolving under autoregressive conditioning, while in multimodal interfaces it appears as a session-level “contaminated” or “violation” state inferred from persistent refusals after a policy trigger (Li et al., 15 Mar 2026, DeVilling, 18 Dec 2025). Across these settings, the common theme is that safety is modeled as an evolving state variable or state set with explicit transition structure, rather than as an isolated binary event.

1. Core meanings across domains

The literature uses Safety State in several technically distinct but structurally related senses. In nonlinear control and robotics, the basic object is a safe set defined by a continuously differentiable barrier function, with safety identified with forward invariance. In safe RL, safety is made Markov by augmenting the observation with a scalar budget state or by replacing pointwise state judgments with short temporal windows. In language-model safety, dialogue history becomes a state transition operator, and safety depends on how internal or observable conversational state evolves across turns. In driver-behavior modeling, safety state is not binary but a latent mixture over a defensive state and a neutral state, summarized by a continuous probability of being in the defensive state (Romdlony et al., 2017, Sootla et al., 2022, Li et al., 15 Mar 2026, Al-Haideri et al., 24 Jun 2025).

Domain	Safety state representation	Safety criterion
Nonlinear control	$\mathcal{C}=\{x\mid h(x)\ge 0\}$ or $\mathcal{C}_d=\{x\mid h(x)+\gamma(\|d\|)\ge 0\}$	Forward invariance
Safe RL	$$z_t=\gamma_l^{-t}\left(d-\sum_{k=0}^{t-1}\gamma_l^k c_k\right)$$	$z_t\ge 0$ or $\mathbb{E}[z_T]\ge 0$
Sequence-aware RL	$\mathcal{C}_d=\{x\mid h(x)+\gamma(\|d\|)\ge 0\}$0	Low anomaly score / low risk
Multi-turn LLMs	$\mathcal{C}_d=\{x\mid h(x)+\gamma(\|d\|)\ge 0\}$1	Avoid crossing refusal/compliance boundary
Multimodal interfaces	Session state $\mathcal{C}_d=\{x\mid h(x)+\gamma(\|d\|)\ge 0\}$2	No persistent modality-specific over-refusal
Driver behavior	$\mathcal{C}_d=\{x\mid h(x)+\gamma(\|d\|)\ge 0\}$3	Higher value indicates stronger defensive response

This variety does not erase a shared formal structure. Safety State consistently couples a state descriptor with an update law and a safety predicate. A plausible implication is that disparate safety methods can often be compared through three questions: what state is being tracked, how it evolves, and what invariant or thresholded condition defines safety.

2. Safe sets, barrier states, and input-to-state safety

The control-theoretic lineage defines Safety State through safe sets and barrier conditions. For control-affine systems $\mathcal{C}_d=\{x\mid h(x)+\gamma(\|d\|)\ge 0\}$4, the standard safe set is $\mathcal{C}_d=\{x\mid h(x)+\gamma(\|d\|)\ge 0\}$5, and a control barrier function satisfies

$\mathcal{C}_d=\{x\mid h(x)+\gamma(\|d\|)\ge 0\}$6

which renders $\mathcal{C}_d=\{x\mid h(x)+\gamma(\|d\|)\ge 0\}$7 forward invariant under suitable control inputs (Kolathaya et al., 2018). Under disturbances, input-to-state safety enlarges the certified set to

$\mathcal{C}_d=\{x\mid h(x)+\gamma(\|d\|)\ge 0\}$8

so that safety means remaining inside or close to the nominal safe set with deviation bounded by disturbance magnitude (Romdlony et al., 2017, Kolathaya et al., 2018).

Later work sharpens this disturbance-aware view. Event-triggered safety-critical control treats sampling-induced measurement error as an input and uses Input-to-State Safe Barrier Functions to guarantee both safety and a uniform lower bound on inter-event times, because naive stabilization-style triggers can fail to produce a minimum interevent time near the boundary (Taylor et al., 2020). In humanoid whole-body control, Safety State is defined as keeping the robot state inside a prescribed safe set despite bounded disturbances arising from model mismatch, imperfect tracking, or external perturbations. The resulting framework combines a kinematic-level whole-body controller, an ISSf-CBF safety filter, and a dynamic-level whole-body controller, with kinematic constraints enforced through inequalities of the form

$\mathcal{C}_d=\{x\mid h(x)+\gamma(\|d\|)\ge 0\}$9

so that input-to-state safety is synthesized at reduced order and then conservatively transferred to full-order humanoid dynamics (Lee et al., 25 May 2026).

A distinct but related formulation appears in barrier-state theory. There, the barrier value itself is embedded as a dynamical subsystem. Given a barrier function $z_t$0 and safety function $z_t$1, the barrier variable is $z_t$2, and the barrier state $z_t$3 evolves according to a safety embedded system

$z_t$4

The central claim is that stabilizing the augmented system guarantees safe stabilization of the original one, because boundedness of the barrier state is equivalent to boundedness of the barrier value and hence to forward invariance of the safe set (Almubarak et al., 2023). This shifts safety design from directly enforcing a constrained inequality to stabilizing an unconstrained augmented system.

3. Safety state augmentation in reinforcement learning

In model-free safe RL, Safety State is explicitly introduced as an augmented state variable encoding remaining budget. Simmer defines

$z_t$5

with Markov update

$z_t$6

Here $z_t$7 means the cumulative discounted cost up to time $z_t$8 is within budget, while $z_t$9 indicates how far the trajectory is past the budget. This lets the policy condition on $S_{t-L:t}$0, so that the agent can act more conservatively when $S_{t-L:t}$1 is small and more aggressively when $S_{t-L:t}$2 is large (Sootla et al., 2022).

The same paper uses the scalar Safety State to unify two constraint types. For average-cost constraints, $S_{t-L:t}$3 is equivalent to $S_{t-L:t}$4. For probability-one constraints, requiring $S_{t-L:t}$5 for all $S_{t-L:t}$6 almost surely is equivalent to enforcing the discounted cost budget almost surely. In practice, the probability-one case is implemented through reward shaping,

$S_{t-L:t}$7

and through Simmer schedules that adapt the initial budget $S_{t-L:t}$8 across epochs with PI or Q-learning style outer-loop updates (Sootla et al., 2022).

AnoSeqs extends the notion of Safety State from scalar budget variables to short temporal windows of raw states. A safe state is defined as a state that does not violate predefined safety constraints and does not lead to agent damage or premature episode termination, but the key object is the safe state sequence: a contiguous window of states conforming to the distribution of safe trajectories observed in a source environment. Sequence windows are written as

$S_{t-L:t}$9

A transformer autoencoder reconstructs safe sequences, and the anomaly score is derived from reconstruction error,

$s_t=(H_t,z_t)$0

with instantaneous risk estimate $s_t=(H_t,z_t)$1. The RL objective is then reshaped as

$s_t=(H_t,z_t)$2

This reorients optimization toward risk-averse behavior without relying on explicit constraints or shields (Kweider et al., 2024).

The contrast between these two RL lines is conceptually important. Simmer makes safety observable by augmenting the Markov state with a budget variable. AnoSeqs makes safety temporal by replacing pointwise state judgments with anomalous trajectory windows. This suggests two complementary meanings of Safety State in RL: a state that carries explicit safety resources, and a state representation that is only informative when embedded in temporal context.

4. Conversational and multimodal safety states

In multi-turn language-model interaction, Safety State is formalized as a dynamic, state-dependent property of dialogue trajectories rather than a property of isolated prompts. STAR models a $s_t=(H_t,z_t)$3-turn dialogue through

$s_t=(H_t,z_t)$4

and introduces an analytical internal state $s_t=(H_t,z_t)$5 so that the conversational safety state is

$s_t=(H_t,z_t)$6

A judge function $s_t=(H_t,z_t)$7 supplies the operational safety indicator $s_t=(H_t,z_t)$8, and the paper defines a safety boundary

$s_t=(H_t,z_t)$9

with collapse time

$\mathcal{C}=\{x\mid h(x)\ge 0\}$0

Within this framework, safety failures arise from structured contextual state evolution, including monotonic drift away from refusal-related representations and abrupt phase transitions induced by role-conditioned context (Li et al., 15 Mar 2026).

STAR’s state-oriented design uses two stages. State initialization softens the initial query while preserving semantics,

$\mathcal{C}=\{x\mid h(x)\ge 0\}$1

constructs a role $\mathcal{C}=\{x\mid h(x)\ge 0\}$2, and forms prompts as

$\mathcal{C}=\{x\mid h(x)\ge 0\}$3

State evolution then adapts $\mathcal{C}=\{x\mid h(x)\ge 0\}$4 and curates history by replacing refusal responses with benign surrogates when necessary. The mechanistic result is a two-phase latent trajectory: a large displacement from refusal to compliance region, followed by smaller stabilized movements within compliance (Li et al., 15 Mar 2026).

A related but behaviorally narrower use of Safety State appears in multimodal interface studies. “The Violation State” documents a session-level condition in which an initial watermark-removal refusal contaminates the conversation. The paper defines a session state $\mathcal{C}=\{x\mid h(x)\ge 0\}$5 and reports that after an image-edit violation, image-generation requests are almost always refused for the remainder of the conversation, whereas text-only requests continue to succeed. The state is modality-specific, shows no detectable decay over $\mathcal{C}=\{x\mid h(x)\ge 0\}$6–$\mathcal{C}=\{x\mid h(x)\ge 0\}$7 minutes, is not reset by rate-limit interruptions, and can be reset only by starting a new conversation (DeVilling, 18 Dec 2025).

These two strands share a path-dependent view of safety. In STAR, dialogue history is a causal state operator that can drive a system across a refusal/compliance boundary. In the multimodal interface study, conversation history appears to trigger persistent session-scoped restrictions. A plausible implication is that safety evaluation for language systems cannot be reduced to prompt-level robustness alone when autoregressive conditioning or session memory induces state persistence.

5. State uncertainty, input limits, and safety filtering

A major line of work treats Safety State as a robustly maintained state set under estimation error, disturbance, and actuator limits. Output-feedback backup CBFs start from the fact that only an estimate $\mathcal{C}=\{x\mid h(x)\ge 0\}$8 is available, with estimation error bounded by

$\mathcal{C}=\{x\mid h(x)\ge 0\}$9

Because the true backup flow cannot be computed exactly from the unknown initial state, the method constructs an uncertainty envelope around an estimated backup flow. In the open-loop construction, the envelope radius is

$\mathcal{C}_d=\{x\mid h(x)+\gamma(\|d\|)\ge 0\}$0

and safety is enforced by tightening barrier constraints so that if the estimated trajectory is safe with margin, then every true trajectory in the envelope is also safe. The resulting O-bCBF formulation guarantees that there always exists a feasible control input that can guarantee the safety of the true state, even in the presence of input constraints (Wijk et al., 21 Apr 2026).

Robust Control Barrier Functions address state uncertainty differently. Instead of requiring a known uncertainty bound in the controller, they add a robustifying term to the barrier inequality,

$\mathcal{C}_d=\{x\mid h(x)+\gamma(\|d\|)\ge 0\}$1

with a robustness function $\mathcal{C}_d=\{x\mid h(x)+\gamma(\|d\|)\ge 0\}$2 satisfying structural conditions that imply invariance of the original safe set for small uncertainty and invariance of an inflated set for larger uncertainty. Under a Lipschitz controller $\mathcal{C}_d=\{x\mid h(x)+\gamma(\|d\|)\ge 0\}$3, the inflated set takes the form

$\mathcal{C}_d=\{x\mid h(x)+\gamma(\|d\|)\ge 0\}$4

so safety degrades gracefully with uncertainty magnitude without requiring that magnitude during controller synthesis (Nanayakkara et al., 24 Aug 2025).

Tunable input-to-state safety makes the safety margin itself state dependent. For the control-affine system $\mathcal{C}_d=\{x\mid h(x)+\gamma(\|d\|)\ge 0\}$5, the TISSf-CBF inequality is

$\mathcal{C}_d=\{x\mid h(x)+\gamma(\|d\|)\ge 0\}$6

where $\mathcal{C}_d=\{x\mid h(x)+\gamma(\|d\|)\ge 0\}$7 and $\mathcal{C}_d=\{x\mid h(x)+\gamma(\|d\|)\ge 0\}$8. This defines a state-dependent half-space in input space. Compatibility with a compact convex input set $\mathcal{C}_d=\{x\mid h(x)+\gamma(\|d\|)\ge 0\}$9 is characterized by the support function certificate

$$z_t=\gamma_l^{-t}\left(d-\sum_{k=0}^{t-1}\gamma_l^k c_k\right)$$0

or equivalently

$$z_t=\gamma_l^{-t}\left(d-\sum_{k=0}^{t-1}\gamma_l^k c_k\right)$$1

The paper then derives tractable conditions for norm-bounded, polyhedral, and box input sets, and an offline LP-based covering procedure for choosing an admissible exponential tuning family $$z_t=\gamma_l^{-t}\left(d-\sum_{k=0}^{t-1}\gamma_l^k c_k\right)$$2 (Li et al., 8 Mar 2026).

Performance-preserving safety filters add another layer. Curvature-guided safety filtering retains the usual one-step admissible set

$$z_t=\gamma_l^{-t}\left(d-\sum_{k=0}^{t-1}\gamma_l^k c_k\right)$$3

but replaces Euclidean projection by a Hessian-weighted projection

$$z_t=\gamma_l^{-t}\left(d-\sum_{k=0}^{t-1}\gamma_l^k c_k\right)$$4

Under Hessian Lipschitz continuity and local negative definiteness assumptions, the method gives a uniform near-optimality bound,

$$z_t=\gamma_l^{-t}\left(d-\sum_{k=0}^{t-1}\gamma_l^k c_k\right)$$5

and a sufficient condition under which the weighted projection outperforms Euclidean projection in long-term value while preserving convexity of the online QP (Lin et al., 13 Feb 2026).

For unmatched uncertainties, input-to-state safe backstepping extends safety synthesis beyond matched disturbance models. Using Optimal Decay CBFs, it replaces the usual robustness term based on $$z_t=\gamma_l^{-t}\left(d-\sum_{k=0}^{t-1}\gamma_l^k c_k\right)$$6 with one based on $$z_t=\gamma_l^{-t}\left(d-\sum_{k=0}^{t-1}\gamma_l^k c_k\right)$$7, thereby making the safety condition direction selective with respect to disturbance channels. The resulting OD-ISSf-CBF controller enforces

$$z_t=\gamma_l^{-t}\left(d-\sum_{k=0}^{t-1}\gamma_l^k c_k\right)$$8

and yields an ISSf inflation

$$z_t=\gamma_l^{-t}\left(d-\sum_{k=0}^{t-1}\gamma_l^k c_k\right)$$9

for strict-feedback and dual-relative-degree systems with unmatched disturbances (Cohen et al., 3 Feb 2026).

6. Empirical patterns, limitations, and unresolved questions

Empirical studies show that Safety State formulations can materially change system behavior. In safe RL, Simmer reduces Safety Gym cost rates relative to PID-Lagrangian while preserving competitive returns; for example, on PointGoal1 the reported cost-rate is $z_t\ge 0$0 for Simmer PID-Lagrangian versus $z_t\ge 0$1 for PID-L, and on CarPush1 it is $z_t\ge 0$2 versus $z_t\ge 0$3 (Sootla et al., 2022). AnoSeqs reports lower episodic cost in Safety Ant Run, from $z_t\ge 0$4 with TD3 to $z_t\ge 0$5, and in Safety MetaDrive from $z_t\ge 0$6 to $z_t\ge 0$7, with environment-dependent trade-offs in reward (Kweider et al., 2024).

In LLMs, the multi-turn state perspective reveals large gaps between static and trajectory-level evaluation. Under STAR on HarmBench, reported safety failure rates are $z_t\ge 0$8 for GPT-4o, $z_t\ge 0$9 for Claude 3.5 Sonnet, $\mathbb{E}[z_T]\ge 0$0 for Gemini 2.0-Flash, $\mathbb{E}[z_T]\ge 0$1 for LLaMA-3-8B-IT, and $\mathbb{E}[z_T]\ge 0$2 for LLaMA-3-70B-IT. Ablations show that removing dialogue history accumulation causes the largest drop, $\mathbb{E}[z_T]\ge 0$3, indicating that autoregressive history is the critical driver of safety collapse (Li et al., 15 Mar 2026). In multimodal interface experiments, contaminated sessions show $\mathbb{E}[z_T]\ge 0$4 image-generation refusals, or $\mathbb{E}[z_T]\ge 0$5, versus $\mathbb{E}[z_T]\ge 0$6 in controls, with Fisher’s exact $\mathbb{E}[z_T]\ge 0$7, while all text-only prompts succeed, demonstrating modality-specific persistence rather than general session failure (DeVilling, 18 Dec 2025).

In robotics and control, state-based safety certificates can eliminate concrete violations under modeled conditions. In humanoid simulation with $\mathbb{E}[z_T]\ge 0$8 link-mass mismatch, hand penetration of the torso exceeds $\mathbb{E}[z_T]\ge 0$9 cm and foot penetration exceeds $\mathcal{C}_d=\{x\mid h(x)+\gamma(\|d\|)\ge 0\}$00 cm without CBF protection, whereas the ISSf-CBF filter keeps signed-distance barriers strictly positive. The same study reports zero collision for $\mathcal{C}_d=\{x\mid h(x)+\gamma(\|d\|)\ge 0\}$01 and $\mathcal{C}_d=\{x\mid h(x)+\gamma(\|d\|)\ge 0\}$02, while large $\mathcal{C}_d=\{x\mid h(x)+\gamma(\|d\|)\ge 0\}$03 produces jitter near boundaries and insufficient disturbance compensation can still permit penetration (Lee et al., 25 May 2026). Curvature-guided safety filtering reports that both Euclidean and Hessian-weighted projections maintain safety in the quadrotor task, but the weighted projection yields tighter tracking near obstacles and positive instantaneous $\mathcal{C}_d=\{x\mid h(x)+\gamma(\|d\|)\ge 0\}$04, with per-step solve times comparable to Euclidean projection (Lin et al., 13 Feb 2026).

Other domains use Safety State as a latent behavioral variable rather than an invariant set. In the dual-state driver model, the probability of being in a defensive state is estimated from a latent class DCM, with aggregate class probabilities $\mathcal{C}_d=\{x\mid h(x)+\gamma(\|d\|)\ge 0\}$05 and $\mathcal{C}_d=\{x\mid h(x)+\gamma(\|d\|)\ge 0\}$06. The dual-state model improves fit over a single-state MNL from mean log-likelihood $\mathcal{C}_d=\{x\mid h(x)+\gamma(\|d\|)\ge 0\}$07 to $\mathcal{C}_d=\{x\mid h(x)+\gamma(\|d\|)\ge 0\}$08, with AIC decreasing from $\mathcal{C}_d=\{x\mid h(x)+\gamma(\|d\|)\ge 0\}$09 to $\mathcal{C}_d=\{x\mid h(x)+\gamma(\|d\|)\ge 0\}$10 and BIC from $\mathcal{C}_d=\{x\mid h(x)+\gamma(\|d\|)\ge 0\}$11 to $\mathcal{C}_d=\{x\mid h(x)+\gamma(\|d\|)\ge 0\}$12 (Al-Haideri et al., 24 Jun 2025). This supports a view of safety state as a continuous severity dimension rather than a binary label.

The limitations are correspondingly varied. AnoSeqs does not provide formal convergence or safety guarantees and depends on source-to-target transfer plus anomaly scores that correlate with unsafety (Kweider et al., 2024). STAR is explicitly a diagnostic lens rather than an exhaustive generator of trajectories, and longer-horizon or multimodal extensions remain open (Li et al., 15 Mar 2026). The multimodal persistence study is limited to a single model and interface and presents behavioral observations rather than architectural claims (DeVilling, 18 Dec 2025). O-bCBFs and TISSf require estimator bounds, Lipschitz or one-sided Lipschitz constants, or support-function computations, and their guarantees become conservative when these bounds are conservative (Wijk et al., 21 Apr 2026, Li et al., 8 Mar 2026). Robust CBFs can require inflated safe sets under large uncertainty, and state-action CBFs trade universal approximation power for convex online filtering (Nanayakkara et al., 24 Aug 2025, He et al., 2023).

Taken together, the literature presents Safety State not as a single definition but as a recurring design pattern: safety is encoded into a state variable, state set, state trajectory, or latent state probability, and control or policy synthesis is organized around keeping that object within a certified region or away from a failure boundary. This suggests that future work will continue to move from prompt-level, action-level, or instantaneous safety criteria toward trajectory-level and stateful safety models whenever path dependence, disturbance accumulation, or hidden context materially affect failure modes.