Permissive Safety Through Trusted Inference: Verifiable Belief-Space Neural Safety Filters for Assured Interactive Robotics

When robots interact with humans, they often become too cautious. This uncertainty leads to "freezing" behaviors. An autonomous vehicle or warehouse bot might stop moving entirely to avoid a perceived risk. This paper proposes a way to prove a robot is safe by focusing only on situations where the robot's "guesses" about human behavior are likely to be correct. This allows the robot to be more helpful without being dangerous.

The Problem

Current safety filters in interactive robotics usually fall into two camps. They are either too conservative or they lack formal guarantees. Traditional filters operate purely in physical space. They calculate distances to obstacles and react to them. Because they treat human intent as a static, worst-case unknown, they assume the human might do anything at any time. This forces the robot into an overly defensive posture. This kills task efficiency.

Recent advancements like Belief-Space Safety Filters (BELIEFSF) attempt to fix this. They reason in "information space" (an augmented state space including both physical and belief states). Instead of just looking at where a pedestrian is, the robot maintains a belief state. This is a probability distribution over possible human intents. By predicting how its own actions will reduce this uncertainty, the robot can act more decisively. However, there is a catch. If the robot's runtime inference (the process of updating its belief) is wrong, the safety filter is compromised. Providing formal, high-probability safety guarantees is difficult. You must account for both the errors in the neural safety filter and the errors in the inference module.

How It Works

The authors address this by proposing the Joint Inference–Safety Test (JIST). The core architectural shift is moving away from verifying the entire state space. Instead, they focus on a "trusted inference region."

The process works in three distinct stages:

1. Defining the Trusted Region: The researchers introduce an inference score function $h_L(z)$. This function evaluates the quality of the robot's runtime inference. For example, it might use a classifier to predict if the robot's current belief accurately contains the opponent's actual control actions. The "trusted inference region" $\Omega_{\delta|h}$ is the subset of the safe set where the robot's inference is expected to be reliable .

2. Inference-Aware Verification: Standard Conformal Prediction (CP) is a distribution-free method that provides safety guarantees by checking how many failures occur in random samples. The authors use JIST instead. JIST performs offline verification by specifically sampling initial states from the trusted inference region. This ensures the safety certificate is built on the assumption that the robot's inference is working correctly.
3. Safe Deployment: During online operation, the robot checks if its current information state is within the verified trusted region. If it is, the robot proceeds with the belief-space safety filter. If the state moves into an untrustworthy region, the system triggers a REJECT or FALLBACK command . This might mean handing control back to a human.

Numbers

The authors evaluated this using a simulated 18-dimensional vehicle-pedestrian interaction benchmark. In this scenario, an autonomous vehicle navigates around pedestrians with uncertain intentions.

The results show a significant reduction in conservativeness. The paper reports that when using a standard baseline (DIRECTCP), the robot had to use a much larger, more restrictive safe set to maintain the same level of safety. In contrast, JIST achieved a certified safety coverage ($1-\epsilon$) of 99.21% with a safe set level of $\delta = 0.1$. The baseline only reached 97.34% .

This means JIST provides a tighter safety guarantee for the same level of operational freedom.

More importantly for real-world utility, JIST significantly lowers the rejection rate. The authors show that for a fixed safety requirement, JIST results in far fewer instances where the robot refuses to move compared to the DIRECTCP baseline .

Essentially, the robot can stay "in the game" longer. It is not penalized for inference errors that occur in regions it has already identified as untrustworthy.

What's Missing

While the results are promising, there are gaps that a production engineer should note:

• The Score Function Dependency: The framework relies on a reliable inference score function $h_L(z)$. If your score function is poorly calibrated, the "trusted region" is inaccurate. This would invalidate the safety guarantees. Defining this score for complex, multi-modal models is a significant challenge.
• Distributional vs. Worst-Case Guarantees: The safety guarantees provided by Conformal Prediction are distributional. They hold with respect to the specific distribution of trajectories seen during verification. If an opponent behaves in a way that causes a major distribution shift, the guarantees may not hold.
• High-Dimensional Complexity: The authors use an 18D system. However, they note that grid-based analysis scales poorly. While they use neural approximations to bypass this, the reliability of these approximations in very high dimensions is not fully addressed.

Should You Prototype This

Yes, if you are building interactive robots that currently suffer from "frozen robot syndrome."

If your deployment is plagued by over-conservativeness, this approach offers a mathematically grounded way to loosen the reins. The logic is sound. Stop trying to prove the robot is safe everywhere. Start proving it is safe where its sensors and models actually work.

However, do not jump in if you haven't characterized your inference error. You need a way to quantify "I am confused" (the $h_L$ score) before you can use JIST. If you can produce that signal, this framework allows you to move from a "blind" safety filter to an "informed" one. Code is reportedly available; see the paper for the canonical link.

Figures from the paper