SPARK Humanoid Safety Filters

• SPARK Humanoid Safety Filters are plug-in modules that modify nominal robot actions to prevent collisions in dynamic environments.
• They form part of a modular benchmark framework that integrates diverse filtering approaches to balance task performance with safety.
• Evaluations use metrics like collision counts, goal-tracking errors, and robustness tests under noise, crowding, and sensor latency.

Searching arXiv for the SPARK benchmark paper and directly related work on SPARK safety filters. {"query":"ti:\"SPARK: A Modular Benchmark for Humanoid Robot Safety\" OR (Sun et al., 5 Feb 2025)","max_results":5,"sort_by":"submittedDate","sort_order":"descending"} Searching for the adversarial stress-testing paper on SPARK humanoid safety filters. {"query":"ti:\"Adversarial Stress Testing of SPARK Humanoid Safety Filters\" OR (Ghosh et al., 18 May 2026)","max_results":5,"sort_by":"submittedDate","sort_order":"descending"} Searching for recent arXiv papers on humanoid safety filters closely related to SPARK-style runtime filtering. {"query":"(\"Safety-Critical Whole-Body Control for Humanoid Robots via Input-to-State Safe Control Barrier Functions\" OR (Lee et al., 25 May 2026)) OR (\"Learning Safe-Stoppability Monitors for Humanoid Robots\" OR (Sun et al., 24 Mar 2026)) OR (\"Geometry-Aware Predictive Safety Filters on Humanoids\" OR (Bena et al., 15 Aug 2025)) OR (\"SafeHumanoid\" AND humanoid safety)","max_results":10,"sort_by":"submittedDate","sort_order":"descending"} SPARK Humanoid Safety Filters are the safety-filter modules used within the Safe Protective and Assistive Robot Kit (SPARK), a modular benchmark for humanoid robot safety designed for humanoid autonomy and teleoperation. SPARK is described as a toolbox that comes with state-of-the-art safe control algorithms in a modular and composable robot control framework; users can easily configure safety criteria and sensitivity levels to optimize the balance between safety and performance; and the framework provides a simulation benchmark that compares safety approaches in a variety of environments, tasks, and robot models, while also allowing quick deployment of synthesized safe controllers on real robots, including a Unitree G1 humanoid robot and hardware setups based on Apple Vision Pro (AVP) or a Motion Capture System (Sun et al., 5 Feb 2025). In the benchmark literature, a SPARK safety filter is the plug-in module that takes a nominal action and modifies it when collision constraints might be violated, so that safety is evaluated as a runtime intervention layer rather than as an isolated planner or estimator (Ghosh et al., 18 May 2026).

1. Benchmark scope and architectural role

SPARK is introduced as a comprehensive benchmark intended to ensure safety in humanoid autonomy and teleoperation, motivated by the fact that humanoid robots pose significant safety risks due to their physical capabilities of interacting with complex environments and by the additional complexity created by humanoid physical structures (Sun et al., 5 Feb 2025). The framework is explicitly modular and composable. It is presented simultaneously as a benchmark, a toolbox, and a deployment path: simulation experiments compare safety approaches across environments, tasks, and robot models, while case studies demonstrate deployment on a Unitree G1 humanoid robot.

Within that architecture, the safety filter is the layer that mediates between a nominal controller and the robot. In the SPARK replication and stress-testing literature, SPARK provides a standardized Unitree G1 humanoid model in MuJoCo, a task/obstacle configuration, a nominal controller, and a plug-in safety filter module that takes the nominal action and modifies it when collision constraints might be violated (Ghosh et al., 18 May 2026). This definition is narrower than a generic “safe controller”: the filter is not the task policy itself, but the mechanism that certifies, reshapes, or overrides nominal control to enforce safety.

This architectural choice makes SPARK a comparative platform rather than a single algorithm. A plausible implication is that “SPARK Humanoid Safety Filters” refers less to one specific control law than to a family of runtime safety mechanisms that share a common interface and can therefore be benchmarked under identical humanoid dynamics, tasks, and sensing assumptions.

2. Formalization in the replicated G1 benchmark case

The most explicit public characterization of SPARK safety filters appears in the replicated benchmark case G1SportMode_D1_WG_SO_v1, referred to as case D1. In that setting, the robot is a Unitree G1 humanoid in SportMode; the dynamics are “first-order dynamics,” meaning that the control input is interpreted as a velocity-level command; the task is whole-body goal (WG) tracking; and the environment contains static obstacles (SO) represented by spherical volumes around the robot (Ghosh et al., 18 May 2026). The main task metric in that study is arm-to-goal distance (dist_goal_arm).

The common control structure is written conceptually as

$$u_t^{\mathrm{safe}} = \mathcal{F}(x_t, u_t^{\mathrm{nom}}, \text{pairwise-info}_t),$$

where the filter receives the state estimate, the nominal control, and pairwise robot–obstacle distance information. SPARK exposes a high-dimensional set of pairwise distances

$d_{i,j}^{\mathrm{env}}(t),$

the distance between robot collision volume $i$ and obstacle $j$ at timestep $t$. A generic safety set is

$$\mathcal{S} = \{ x \mid d_{i,j}(x) \ge 0 \;\; \forall i,j \},$$

so negative distance denotes collision (Ghosh et al., 18 May 2026).

For evaluation, the replicated benchmark compresses the pairwise distance tensor into the minimum environment-distance trace

$$d_{\min}^{\mathrm{env}}(t) = \min_{i,j} d_{i,j}^{\mathrm{env}}(t),$$

and defines the environment-collision step count

$$C_{\mathrm{env}} = \sum_{t=1}^{T} \mathbb{I}\left[d_{\min}^{\mathrm{env}}(t) < 0\right].$$

Task inefficiency is measured by

$$G_{\mathrm{mean}} = \frac{1}{T} \sum_{t=1}^{T} d_{\mathrm{goal}}(t),$$

with final goal distance also reported in some experiments (Ghosh et al., 18 May 2026). These metrics make the safety–performance trade-off explicit: $C_{\mathrm{env}}$ measures step-wise safety failure, while $d_{i,j}^{\mathrm{env}}(t),$0 and final goal distance measure task completion quality.

A common misconception is that benchmark safety can be reduced to a single score. The D1 evaluation instead uses minimum-distance traces, collision-step counts, and goal-tracking metrics together. This indicates that SPARK safety filters are assessed not only by whether they avoid penetration, but also by how much they distort the nominal whole-body task.

3. Filter families and nominal trade-offs

The replicated SPARK study evaluates six safety filters shipped with SPARK: RSSA (Robust Safe Set Algorithm), RSSS (Robust Sliding-Mode-based Safe Set), SSA (Safe Set Algorithm), CBF (Control Barrier Function–based safety filter), PFM (Potential Field Method), and SMA (Sliding-Mode Algorithm) (Ghosh et al., 18 May 2026). The paper emphasizes behavioral comparison rather than re-derivation, and treats the implementations as black-box safety modules built on Wei & Liu’s unified view of energy-based safety filters.

Their qualitative mechanisms differ. PFM adds repulsive components to $d_{i,j}^{\mathrm{env}}(t),$1 based on distance gradients. CBF solves a small QP to minimally modify $d_{i,j}^{\mathrm{env}}(t),$2 while enforcing discrete-time CBF inequalities derived from distances. SSA and RSSA enforce a safe set defined via a safety index. SMA and RSSS use a sliding surface derived from the safety index, applying a high-gain correction near the boundary (Ghosh et al., 18 May 2026). In all cases, the filters must handle multiple simultaneous robot–environment distance constraints on a high-DOF humanoid.

In the nominal D1 case, no method dominates both goal tracking and collision avoidance. PFM achieves the best goal tracking and minimally deviates from the arm goal, but also has the highest collision steps. SMA yields the lowest environment collision steps and is therefore the safest in terms of $d_{i,j}^{\mathrm{env}}(t),$3, but sacrifices some tracking performance relative to PFM. SSA, RSSA, and RSSS occupy a middle ground: not as close to the goal as PFM, and not as collision-free as SMA. CBF shows intermediate behavior; the study also reports repeated “No Solution” messages for some methods, suggesting feasibility issues of the safety QPs under hard constraints (Ghosh et al., 18 May 2026).

This nominal ranking is important but incomplete. It shows that the phrase “SPARK safety filter” does not denote a single conservative bias. Some filters are aggressively task-preserving, some are strongly conservative, and some are explicitly balanced. That diversity is part of the benchmark’s purpose.

4. Robustness under crowding, noisy distances, and delayed information

The stress-testing study extends D1 with adversarial but controlled perturbations at the perception layer by monkey-patching compute_pairwise_info, so the true MuJoCo state is unchanged while the safety filter’s inputs are corrupted (Ghosh et al., 18 May 2026). Three perturbation families are used: obstacle crowding, Gaussian noise on perceived distances, and delayed obstacle information.

Under obstacle crowding, the number of obstacles is increased to 5, 15, and 30 while keeping the rest of D1 fixed. At 5 obstacles, CBF, PFM, SMA, and SSS have 0 collision steps, with final goal distances 0.046, 0.062, 0.048, and 0.047 respectively, while SSA already records 166 collision steps with final goal distance 0.047. At 15 obstacles, CBF has the fewest collision steps, 35, with goal 0.060; PFM rises to 258 collisions and 0.079 goal; SMA to 168 and 0.050; SSS to 164 and 0.058; SSA to 314 and 0.050. At 30 obstacles, SMA has the fewest collision steps, 96, with goal 0.068; CBF rises to 106 and 0.091; SSS to 136 and 0.093; SSA to 294 and 0.074; and PFM collapses to 646 collision steps with goal 0.143 (Ghosh et al., 18 May 2026). The safest method therefore changes with density: CBF is best at 15 obstacles, while SMA is best at 30.

Under perception noise, perceived distances are perturbed as

$d_{i,j}^{\mathrm{env}}(t),$4

with $d_{i,j}^{\mathrm{env}}(t),$5 varied from $d_{i,j}^{\mathrm{env}}(t),$6 to $d_{i,j}^{\mathrm{env}}(t),$7. PFM shows sharp degradation in both collision steps and goal error. CBF and SSS degrade more gradually. SMA exhibits moderate safety degradation, while SSA remains relatively safer than PFM in terms of collisions after nominal, though it still degrades (Ghosh et al., 18 May 2026). This is consistent with the observation that filters relying directly on raw distance values can become brittle under noisy distances.

Under sensor latency, the filter receives delayed pairwise information

$d_{i,j}^{\mathrm{env}}(t),$8

At high latency, collision counts become more similar across filters, but the ranking changes in a non-intuitive way: PFM has the lowest collision count in that experiment, while SSA has the highest. The diagnostic plot for SSA at high latency shows $d_{i,j}^{\mathrm{env}}(t),$9 crossing into negative values multiple times and arm–goal distances indicating difficulties in reaching and maintaining the goal (Ghosh et al., 18 May 2026).

The study’s central conclusion is that nominal SPARK benchmark scores are necessary but not sufficient. Safety behavior can change under obstacle crowding, noisy distance estimates, and delayed obstacle information, so evaluation beyond nominal performance is required to expose failure modes before deployment.

5. Broader interpretations: parameter-level, supervisory, and stoppability filters

The expression “humanoid safety filter” has broadened beyond collision-avoidance projection of a nominal action. SafeHumanoid is an explicit example of a parameter-level safety filter for a Unitree G1 upper body: an egocentric RGB frame is processed by Molmo-7B with a fixed JSON schema prompt, embedded with all-MiniLM-L6-v2, matched by FAISS exact nearest-neighbor search against a curated database of 16 validated scenarios, and mapped to 28 joint-level gains and a nominal speed $i$0; the system then gates stiffness, damping, and speed rather than modifying the path, and falls back to a conservative profile when retrieval is ambiguous or communication fails (Mahmoud et al., 28 Nov 2025). The framework reports $i$1, $i$2, uses 1–2 Hz egocentric updates, and has end-to-end inference latency up to 1.4 s. It therefore implements a safety filter at the execution-envelope level, but it does not provide online formal guarantees.

SafeFall reinterprets safety filtering as a fail-safe supervisory mode rather than a constraint-preserving wrapper. It runs a GRU-based fall predictor at 50 Hz and keeps a reinforcement-learning protective policy dormant until an “imminent, unavoidable” fall is predicted; once triggered, control is switched from the nominal controller to the SafeFall policy, which commands joint position targets via PD at 200 Hz. On a full-scale Unitree G1 humanoid, the method reduced peak contact forces by 68.3\%, peak joint torques by 78.4\%, and eliminated 99.3\% of collisions with vulnerable components (Meng et al., 23 Nov 2025). This is not a classical minimal-modification filter; it is a learned fallback controller.

PRISM formalizes emergency stopping for humanoids as a policy-dependent safe-stoppability problem. It defines a stoppability value function

$i$3

and the $i$4-safe-stoppable set

$i$5

A learned neural monitor $i$6 then decides whether nominal execution can continue or the fallback controller must be triggered. The framework is simulation-driven, uses SPARK as a digital twin for labeling, and demonstrates sim-to-real transfer on a humanoid platform (Sun et al., 24 Mar 2026).

Taken together, these examples show that “SPARK Humanoid Safety Filters” now denotes a family of runtime safety mechanisms that includes collision-avoidance filters, parameter-level envelope schedulers, emergency-stop monitors, and learned fallback supervisors. This suggests a shift from a single barrier layer toward hierarchical safety stacks.

6. Whole-body, predictive, and semantic extensions

A second line of work extends humanoid safety filters from benchmarked collision avoidance to whole-body control and predictive navigation. Safety-Critical Whole-Body Control for Humanoid Robots via Input-to-State Safe Control Barrier Functions introduces a three-layer architecture consisting of a kinematic-level whole-body controller (KinWBC), an ISSf-CBF safety filter, and a dynamic-level whole-body controller (DynWBC). KinWBC generates nominal joint-motion references from prioritized tasks; the ISSf-CBF filter minimally modifies these references to satisfy kinematic safety constraints under bounded disturbances; and DynWBC tracks the filtered references while enforcing full-body dynamic feasibility and contact stability. The framework runs at 2 kHz on the humanoid TOCABI and reports improved safety margins under model mismatch during locomotion, teleoperation, and single-leg balancing with hand control (Lee et al., 25 May 2026). In that formulation, safety constraints are imposed on a whole-body kinematic model, but their parameters are conservatively tuned so that the resulting kinematic safety guarantees can be transferred to full-order humanoid dynamics under unknown disturbances.

A predictive geometric extension is provided by Poisson safety functions and CBF-constrained MPC. Dynamic Safety in Complex Environments synthesizes safe sets from local occupancy maps by solving Poisson’s equation with Dirichlet boundary conditions and a smooth guidance vector field, then uses the resulting safety function in CBF-based safety filtering; the method is demonstrated on quadruped and humanoid robots and reports Poisson solve times of 0.2–0.3 ms for residual $i$7 on an RTX 4070 GPU, with safety-function updates at approximately 10 Hz (Bahati et al., 11 May 2025). Geometry-Aware Predictive Safety Filters on Humanoids extends that line to a nonlinear MPC safety filter over the reduced-order humanoid state $i$8 and input $i$9, using Minkowski set operations to account for robot geometry and a time-parameterized Poisson safety function $j$0 to impose discrete-time CBF constraints along the prediction horizon (Bena et al., 15 Aug 2025). The result is a predictive safety filter that can rotate the humanoid to exploit anisotropic geometry, for example while traversing narrow corridors.

A further extension is semantic. Semantically Safe Robot Manipulation builds a semantic map of the 3D environment, uses LLMs to infer semantically unsafe conditions, represents semantic context as $j$1, and maps those conditions into a CBF certification problem that combines semantic spatial constraints, behavior-dependent class-$j$2 functions, and pose costs (Brunke et al., 2024). Although that work is not a humanoid benchmark paper, it addresses a limitation shared by many SPARK-style filters: purely geometric collision-avoidance constraints are often semantically blind.

The main controversy in this broader literature concerns what counts as a “safety guarantee.” SPARK’s filter family includes heuristic PFM, QP-based CBF, safe-set, and sliding-mode methods; related humanoid work adds semi-formal parameter schedulers, learned monitors, ISSf-CBF whole-body controllers, and predictive Poisson-CBF MPC. This suggests that “humanoid safety filter” is now best understood as a layered runtime-assurance abstraction rather than a single theorem-bearing controller. The benchmarked evidence nonetheless supports one stable conclusion: nominal performance alone does not characterize safety, and robust deployment requires explicit evaluation of safety–performance trade-offs, sensing imperfections, dynamics mismatch, and fallback behavior (Ghosh et al., 18 May 2026).