SafetyFlow: Multi-Domain Safety Frameworks

• SafetyFlow is a polysemous term defining distinct flow-based safety systems in autonomous driving, LLM safety, humanoid control, and agent protocols.
• Implementations range from continuous-time normalizing flow models for anomaly detection to automated multi-agent pipelines for benchmark construction.
• Each variant integrates generative modeling with structured safety filters or barrier methods to enhance reliability in high-stakes control and multi-agent environments.

Searching arXiv for papers using the term “SafetyFlow” and closely related variants to ground the article in the literature. arxiv_search query: "SafetyFlow OR SAFEFLOW OR Deep-Flow OR SafeFlowMatcher" SafetyFlow is a recurrent designation in recent arXiv literature rather than a single standardized framework. The name has been applied to technically distinct systems in autonomous driving, LLM safety benchmarking, humanoid control, and trustworthy autonomous agents. In one usage, SafetyFlow, also called Deep-Flow, is an unsupervised continuous-time normalizing-flow framework for detecting safety-critical anomalies in Level 4 autonomous driving (Guillen-Perez, 19 Feb 2026). In another, it is the first end-to-end, fully automated agent-flow system for constructing LLM safety benchmarks (Zhu et al., 21 Aug 2025). A third usage denotes a text-driven humanoid whole-body control framework based on Physics-Guided Rectified Flow Matching and a 3-Stage Safety Gate (Cho et al., 25 Mar 2026). A fourth, styled SAFEFLOW, denotes a protocol-level framework for trustworthy and transactional autonomous agent systems with formal information-flow control and transactional execution (Li et al., 9 Jun 2025). The shared nomenclature reflects a broader convergence around flow-based modeling, safety filtering, and structured runtime control, but the underlying objectives, mathematical formalisms, and evaluation criteria differ substantially.

1. Terminological scope and principal variants

In the available literature, “SafetyFlow” is best understood as a polysemous research label. The term names at least four primary systems, while closely related work uses neighboring titles such as Safe Flow Matching, SafeFlowMatcher, Safe Flow Q-Learning, RiskFlow, and VESFlow. This suggests that the common lexical element “flow” refers less to a single framework than to a family of methodologies involving continuous-time transport, conditional flow matching, rectified flow, or agent-flow orchestration.

Variant	Domain	Core formulation
SafetyFlow / Deep-Flow (Guillen-Perez, 19 Feb 2026)	Autonomous driving	OT-CFM with a low-rank spectral PCA bottleneck for anomaly detection
SafetyFlow (Zhu et al., 21 Aug 2025)	LLM safety benchmarking	Seven-agent linear “agent-flow” for automated benchmark construction
SafeFlow (Cho et al., 25 Mar 2026)	Humanoid control	Physics-Guided Rectified Flow Matching with a 3-Stage Safety Gate
SAFEFLOW (Li et al., 9 Jun 2025)	Autonomous agents	IFC, WAL, rollback, and secure scheduling

The most important conceptual distinction is that some SafetyFlow systems are generative models over trajectories or actions, whereas others are orchestration or protocol layers over symbolic or tool-using agents. Confusing these strands leads to a common misconception: despite the shared name, there is no single canonical SafetyFlow architecture.

2. Continuous anomaly detection in autonomous driving

In autonomous driving, SafetyFlow, also called Deep-Flow, is presented as an unsupervised, continuous-time normalizing-flow framework for detecting safety-critical anomalies in Level 4 autonomous driving. Its central object is a time-dependent vector field $v_\theta(z,t,C)$ defined over whitened PCA coefficients $z \in \mathbb{R}^k$ of a trajectory, with latent dynamics

$\frac{dz_t}{dt} = v_\theta(z_t,t,C),$

where $C$ encodes the spatio-temporal scene and goal. The method uses Optimal Transport Conditional Flow Matching, with linear OT geodesic

$$\psi_t(z_0,z_1) = (1-(1-\sigma_{\min})t)z_0 + tz_1,$$

$\sigma_{\min}=10^{-4}$, and target velocity

$u_t = z_1 - (1-\sigma_{\min})z_0.$

Training minimizes the mean-squared mismatch between $v_\theta(\psi_t(z_0,z_1),t,C)$ and this OT target velocity. The trajectory representation is constrained to a low-rank spectral manifold through a PCA bottleneck

$z = W^{-1}B^T(x-\mu),$

with $k=12$ capturing $z \in \mathbb{R}^k$0 of variance and filtering out high-frequency jitter. Because $z \in \mathbb{R}^k$1 is small, the Jacobian trace is computed exactly via automatic differentiation rather than Hutchinson’s estimator, enabling deterministic log-likelihood estimation through

$z \in \mathbb{R}^k$2

Inference uses a fixed-step RK4 integrator with $z \in \mathbb{R}^k$3 steps and $z \in \mathbb{R}^k$4 variance, and the anomaly score is the negative log-likelihood $z \in \mathbb{R}^k$5 (Guillen-Perez, 19 Feb 2026).

The architecture couples an Early Fusion Transformer Encoder with a lane-aware goal skip-connection and a residual MLP flow head. The encoder tokenizes dynamic agent histories and vectorized map polylines into $z \in \mathbb{R}^k$6-dim embeddings, concatenates a learned goal embedding $z \in \mathbb{R}^k$7, and processes them with a 4-layer Pre-Norm Transformer with 8 heads. The goal embedding bypasses the Transformer body and is concatenated directly to the Transformer output before the flow head, preserving intent at multi-modal junctions. To emphasize rare, high-energy maneuvers, training weights each sample by a product of path tortuosity and jerk energy,

$z \in \mathbb{R}^k$8

and combines the weighted CFM loss with a Euclidean grounding term using $z \in \mathbb{R}^k$9.

On the Waymo Open Motion Dataset, the framework achieves an AUC-ROC of $\frac{dz_t}{dt} = v_\theta(z_t,t,C),$0 against a heuristic golden set of safety-critical events. The reported analysis draws a distinction between kinematic danger and semantic non-compliance. Kinematic anomalies include extreme accelerations $\frac{dz_t}{dt} = v_\theta(z_t,t,C),$1 or yaw rates $\frac{dz_t}{dt} = v_\theta(z_t,t,C),$2, whereas semantic anomalies such as illegal U-turns, lane-boundary violations, and corner cutting may be kinematically benign but remain far from the learned expert manifold. The paper reports an empirical “Safety Ceiling” at log-likelihood $\frac{dz_t}{dt} = v_\theta(z_t,t,C),$3, with nominal driving separated into a high-certainty mode at $\frac{dz_t}{dt} = v_\theta(z_t,t,C),$4 for trivial maneuvers and a high-entropy mode at $\frac{dz_t}{dt} = v_\theta(z_t,t,C),$5 for complex urban interactions, while anomalies appear around $\frac{dz_t}{dt} = v_\theta(z_t,t,C),$6. This suggests a statistically defined safety gate rather than a hand-authored rule set.

3. Automated LLM safety benchmark construction

In the LLM literature, SafetyFlow denotes an end-to-end, fully automated “agent-flow” system for constructing safety benchmarks. The system organizes benchmark construction as a linear pipeline of seven specialized agents that pass a standardized JSON prompt-response bundle from stage to stage. These agents run under the smolagents framework inside lightweight Docker containers, with each agent restricted to a predefined set of tools and a fixed compute-and-time budget. The seven agents are the Ingestion Agent, Categorization Agent, Generation Agent, Augmentation Agent, Deduplication Agent, Filtration Agent, and Dynamic Evaluation Agent. Their functions range from extracting raw harmful text from a data pool of 2 million entries, through three-level taxonomy assignment and synthetic prompt generation, to multilingual augmentation, near-duplicate removal, filtration of benign or trivially blocked prompts, and final dynamic difficulty calibration (Zhu et al., 21 Aug 2025).

The tool layer includes fetch-data, prompt-encoder, call-faiss, call-LLM, translator, rewriter, uncensored-model, judger, and final-answer. Deduplication computes embeddings with Qwen3-Embedding-0.6B and removes prompt pairs with cosine similarity at least $\frac{dz_t}{dt} = v_\theta(z_t,t,C),$7. The taxonomy merges SaladBench, AirBench, and DoNotAnswer, yielding 7 dimensions, 51 categories, and 265 subcategories. Augmentation produces the original prompt plus 8 translations and up to 3 paraphrases, and the dynamic evaluation stage injects controllable difficulty through CodeAttack, encrypted-comm, tense-attack, stochastic augmentations, word substitutions, and context additions. The complete construction pipeline runs without human intervention in 93.95 hours, approximately four days.

The resulting benchmark, SafetyFlowBench, contains 23,446 prompts. The reported dimension counts are Bias: 3,017; Toxicity: 7,552; Malicious Use: 5,977; Child Sexual: 1,069; Human Rights: 2,286; Socioeconomic: 1,183; and Information Safety: 2,362. Average prompt length is approximately 19.6 words. The benchmark is evaluated on 49 recent LLMs using GuardReasoner as the harmful/nonharmful classifier, with manual inspections on a random 1,000 samples showing at least 95% consistency. Quantitatively, the paper reports a worst Safety Rate of 61.94% for GLM-Z1-32B, top Safety Rates of 95.31% for Claude-4-Sonnet, 94.77% for Phi-4-Mini, and 92.35% for o3, and $\frac{dz_t}{dt} = v_\theta(z_t,t,C),$8. Compared with S-Eval, SaladBench, and AirBench, which each have more than 30% duplicates, SafetyFlowBench is reported as below 10% redundancy. Total API spend is reported as below \$\frac{dz_t}{dt} = v_\theta(z_t,t,C),$910,000 typical for manual generation and annotation.

The significance of this SafetyFlow variant lies in workflow automation rather than continuous-time generative modeling. Here, “flow” names a controlled sequential agent pipeline, not an ODE-defined transport process. A plausible implication is that the nomenclature was chosen to emphasize staged orchestration and reproducibility rather than probability-flow dynamics.

4. Flow-based safety in robot motion planning and humanoid control

A separate strand uses SafeFlow for robot control and planning. In text-driven humanoid control, SafeFlow combines Physics-Guided Rectified Flow Matching in a VAE latent space with a 3-Stage Safety Gate. The generator learns a velocity field $C$0 over latent variables interpolated as $C$1, with rectified flow-matching loss

$C$2

Sampling is steered by a differentiable cost over decoded motion, including a joint-limit barrier, self-collision barrier, smoothness, and CoM stability. Reflow distillation then reduces the number of function evaluations from approximately $C$3 to $C$4, cutting motion-generation latency from approximately $C$5 to approximately $C$6. Deployment uses three safety checks: Stage 1 semantic OOD detection with squared Mahalanobis distance in CLIP embedding space; Stage 2 directional sensitivity discrepancy

$C$7

and Stage 3 hard kinematic constraints on position, velocity, and acceleration. On the Unitree G1, the reported progression from baseline to the full system reduces joint-limit violation rate from 43.1% to 3.1%, self-collision rate from 11.1% to 1.4%, and improves success rate from 80.6% to 98.5%, while the total loop remains approximately $C$8 or approximately $C$9 (Cho et al., 25 Mar 2026).

Related motion-planning work applies flow models with barrier-based safety enforcement. “Safe Flow Matching: Robot Motion Planning with Control Barrier Functions” introduces Flow Matching Barrier Functions and a training-free, test-time quadratic-program correction ensuring that planned trajectories remain within safe regions across the planning horizon (Dai et al., 11 Apr 2025). “SafeFlowMatcher” couples flow matching with control barrier functions through a two-phase prediction-correction integrator, proves forward invariance of a robust safe set and finite-time convergence to the safe set, and reports Maze2D results with barrier safety at or above zero, 0% trap rate, score approximately 1.632, curvature approximately 4.71, and runtime approximately 4.7 ms (Yang et al., 29 Sep 2025).

These systems share a common design pattern: the base flow model is responsible for expressivity and multimodality, while safety is imposed either through differentiable physics costs, barrier certificates, or hierarchical runtime gating. This suggests a division between generative competence and certified intervention rather than an attempt to encode all safety directly into the generative prior.

5. SAFEFLOW as a protocol for trustworthy autonomous agents

In another usage, SAFEFLOW is not a generative model but a protocol-level framework for trustworthy and transactional LLM/VLM-based agents. Its formal core is a lattice-based information-flow control model that associates each object $$\psi_t(z_0,z_1) = (1-(1-\sigma_{\min})t)z_0 + tz_1,$$0 with a label

$$\psi_t(z_0,z_1) = (1-(1-\sigma_{\min})t)z_0 + tz_1,$$1

where $$\psi_t(z_0,z_1) = (1-(1-\sigma_{\min})t)z_0 + tz_1,$$2 is provenance, $$\psi_t(z_0,z_1) = (1-(1-\sigma_{\min})t)z_0 + tz_1,$$3 is integrity, and $$\psi_t(z_0,z_1) = (1-(1-\sigma_{\min})t)z_0 + tz_1,$$4 is confidentiality. The framework defines a product lattice over integrity and confidentiality, join and meet operators, and explicit enforcement rules corresponding to “no read up” and “no write down” for confidentiality and “no read down” and “no write up” for integrity. An adversarial tool output labeled $$\psi_t(z_0,z_1) = (1-(1-\sigma_{\min})t)z_0 + tz_1,$$5 cannot be used to modify a high-integrity decision record labeled $$\psi_t(z_0,z_1) = (1-(1-\sigma_{\min})t)z_0 + tz_1,$$6, thereby preventing contamination of high-integrity decisions by low-integrity inputs (Li et al., 9 Jun 2025).

SAFEFLOW augments IFC with transactional execution. Each agent step or tool call is treated as a transaction with ACID properties. A write-ahead log stores tuples of the form

$$\psi_t(z_0,z_1) = (1-(1-\sigma_{\min})t)z_0 + tz_1,$$7

and recovery applies new_value for complete records and old_value for incomplete ones. Concurrency control uses strict two-phase locking and a task-aware priority scheme over $$\psi_t(z_0,z_1) = (1-(1-\sigma_{\min})t)z_0 + tz_1,$$8, with deadlocks resolved by aborting lower-priority transactions and rolling them back. The framework also maintains provenance- and confidentiality-tagged caches, whose labels are joins of contributing inputs.

Evaluation is conducted on SAFEFLOWBENCH, comprising MTST with 332 adversarial webpage/app/OS scenarios and CART with 25 multi-agent concurrency scenarios. In MTST, GPT-4o improves from 20.5% $$\psi_t(z_0,z_1) = (1-(1-\sigma_{\min})t)z_0 + tz_1,$$9, 66.9% $\sigma_{\min}=10^{-4}$0, and 12.7% $\sigma_{\min}=10^{-4}$1 in the vanilla setting to 97.9%, 0.0%, and 2.1% with SAFEFLOW; Gemini 2.5 Flash improves from 22.0%, 67.8%, and 10.2% to 99.1%, 0.0%, and 0.9%. In CART, GPT-4o moves from 1/5, 0/13, 0/6, and 0/1 on 2-agent to 5-agent cases to 5/5, 11/13, 6/6, and 1/1 with SAFEFLOW, while Gemini 2.5 improves from 3/5, 2/13, 0/6, and 0/1 to 5/5, 13/13, 6/6, and 1/1. The reported overhead is below 20% latency increase.

This SAFEFLOW variant occupies a distinct conceptual niche. It addresses prompt injection, adversarial multimodal inputs, state consistency, and concurrency correctness through runtime enforcement and logging. Here, “flow” refers to information flow across agents, tools, and environments, not to probability flow in a latent space.

6. Related uses, common structure, and research context

The broader literature contains several adjacent systems that clarify the semantic range of SafetyFlow-like nomenclature. In perception, the c-flow credibility metric for safety-critical pedestrian detection has also been described as SafetyFlow. It computes a scalar in $\sigma_{\min}=10^{-4}$2 from optical-flow consistency within a sliding window of pedestrian boxes, using

$\sigma_{\min}=10^{-4}$3

with $\sigma_{\min}=10^{-4}$4 the summed residual from linear regression on median horizontal optical flow and $\sigma_{\min}=10^{-4}$5 the recent change in box diagonal. On Argoverse 1.1, with RetinaNet and RAFT, $\sigma_{\min}=10^{-4}$6 identifies 88% of all false negatives in $\sigma_{\min}=10^{-4}$7 while mis-flagging only 1% of true positives, and raising the threshold to 0.3 catches 100% of false negatives at a 2% true-positive false-alarm rate (Lyssenko et al., 2024).

Other nearby work extends the safety-flow pattern into additional domains. RiskFlow performs safety-critical traffic scenario generation by transporting Gaussian action sequences into future accelerations and yaw-rate commands in a single forward pass, then applying output-space adversarial and map-feasibility guidance in closed-loop nuScenes evaluation (Lan et al., 4 Jun 2026). VESFlow and VESFlow+ target safe few-step text-to-image generation by editing the learned marginal velocity toward a safe-conditional posterior; on the 4-step MeanFlow model, VESFlow+ reduces NudeNet attack success rate to 6.3% on Ring-A-Bell and 6.8% on MMA-Diffusion while preserving benign-prompt fidelity (Choi et al., 22 Jun 2026). Safe Flow Q-Learning combines a reachability-inspired safety value function with a one-step flow policy for offline safe RL and reports 2.5$\sigma_{\min}=10^{-4}$8 lower inference latency than diffusion baselines in safety-critical control settings (Tayal et al., 16 Mar 2026).

Across these variants, one recurring structure is visible. A learned flow, velocity field, or staged process supplies expressive generation or scalable automation; a separate safety layer then enforces admissibility through exact likelihood thresholds, barrier-function constraints, Mahalanobis or Jacobian-based risk scores, transactional IFC, or output-space guidance. Another recurring pattern is computational asymmetry: expensive safety-aware procedures are often shifted offline through PCA bottlenecks, Reflow distillation, one-step actors, Dockerized agent orchestration, or prompt-level risk filtering. This suggests that “SafetyFlow” functions less as a unified doctrine than as a naming convention for systems that combine flow-like dynamics or workflow sequencing with explicit safety gates.