IEEE ICRA 2026 · 机器人 · RoboticsIEEE ICRA 2026 · Robotics
PACS：扩散策略的路径一致性安全过滤PACS: Path-Consistent Safety Filtering for Diffusion Policies
From Demonstrations to Safe Deployment: Path-Consistent Safety Filtering for Diffusion Policies
Ralf Römer, Julian Balletshofer, Jakob Thumm, Marco Pavone, Angela P. Schoellig, Matthias Althoff · TU Munich / Stanford / University of Toronto
Diffusion Policy 凭借大规模演示数据学习复杂操作行为，但本身缺乏安全保证。PACS（Path-Consistent Safety Filtering）通过在动作序列生成的轨迹上执行"路径一致性刹车"，在保持训练分布一致性的同时，借助集合可达性分析为动态环境提供形式化安全保证，无需修改策略网络本身。Diffusion Policy learns complex manipulation behaviors from large-scale demonstration data, but by itself offers no safety guarantee. PACS (Path-Consistent Safety Filtering) executes "path-consistent braking" along the trajectory generated from the action sequence; while preserving consistency with the training distribution, it uses set-based reachability analysis to provide formal safety guarantees in dynamic environments, without modifying the policy network itself.
Diffusion Policy 在复杂操作任务上表现出色，但由于其随机采样特性，无法保证安全行为，必须依赖外部安全机制。现有反应式安全过滤器（如 Control Barrier Functions，CBF）在阻止危险动作的同时，会将机器人推入训练分布之外的状态，导致后续行为不可预测、任务失败。Diffusion Policy performs strongly on complex manipulation tasks, but because of its stochastic sampling nature it cannot guarantee safe behavior and must rely on external safety mechanisms. Existing reactive safety filters (such as Control Barrier Functions, CBF) block unsafe actions, but at the same time push the robot into states outside the training distribution, making subsequent behavior unpredictable and causing task failure.
图1：动态环境部署场景可视化。当人类进入机器人工作空间时，扩散策略生成的动作可能导致碰撞。PACS 在检测到安全威胁时执行路径一致性刹车，维持训练分布一致性，而反应式方法（CBF）则会突然改变运动方向，导致分布外状态。Figure 1: Visualization of the dynamic-environment deployment scenario. When a human enters the robot workspace, the actions generated by the diffusion policy may lead to a collision. Upon detecting a safety threat, PACS performs path-consistent braking and maintains consistency with the training distribution, whereas the reactive method (CBF) abruptly changes the direction of motion and thus induces out-of-distribution states.
69%仿真平均任务成功率（PACS PFL）Average task success rate in simulation (PACS PFL)
4%CBF 仿真平均成功率（对比）CBF average success rate in simulation (comparison)
80%真实硬件平均安全任务成功率Average safe task success rate on real hardware
PACS 的核心思想是：不直接修改单步动作，而是将扩散策略生成的整个 action chunk 转化为平滑的预期轨迹，并始终将其与刹车停止轨迹拼接，通过集合可达性分析实时验证整段轨迹的安全性。若通过验证则执行预期运动，否则切换到刹车停止——整个过程保持轨迹与训练分布的一致性。The core idea of PACS is not to modify single-step actions directly, but to convert the entire action chunk generated by the diffusion policy into a smooth intended trajectory, always concatenated with a braking-to-stop trajectory, and to verify the safety of the whole trajectory in real time through set-based reachability analysis. If verification succeeds, the intended motion is executed; otherwise the system switches to braking to a stop — throughout, the trajectory remains consistent with the training distribution.
图2：PACS 系统架构概览。① 扩散策略生成 action chunk；② 预期轨迹规划器将 action chunk 转换为满足运动学约束的平滑轨迹；③ 集合可达性分析器以 1 kHz 频率实时验证安全约束；④ 监控轨迹由预期段与刹车段拼接而成，并根据验证结果选择执行哪一段。Figure 2: Overview of the PACS system architecture. ① The diffusion policy generates an action chunk; ② the intended trajectory planner converts the action chunk into a smooth trajectory satisfying kinematic constraints; ③ the set-based reachability analyzer verifies safety constraints in real time at 1 kHz; ④ the monitored trajectory is composed of the intended segment concatenated with the braking segment, and the verification result determines which segment is executed.
将 action chunk 中的路径点序列转化为时间最优、满足运动学与动力学约束的平滑轨迹。关键设计在于轨迹始终经过所有 action 路径点，确保机器人沿扩散策略"意图"的路径运动，而非被外力偏转至未见状态。这种设计使得在遇到障碍物时可以通过降速（而非改变方向）来保证安全，从而避免分布漂移。The sequence of waypoints in the action chunk is converted into a time-optimal smooth trajectory that satisfies kinematic and dynamic constraints. The key design point is that the trajectory always passes through all action waypoints, ensuring the robot moves along the path "intended" by the diffusion policy rather than being deflected by external forces into unseen states. This design makes it possible to guarantee safety by slowing down (instead of changing direction) when an obstacle is encountered, thereby avoiding distribution drift.
在运行时以 1 kHz 的频率，对机器人末端执行器的可达集合进行计算，同时考虑测量误差与动态障碍物（如运动中的人手）的不确定运动范围。若预期轨迹的可达集合与障碍物占位集合存在交集，则系统立即切换到预先计算好的刹车轨迹，保证碰撞前机器人可以完全停止。At runtime, the reachable set of the robot end effector is computed at 1 kHz, while accounting for measurement error and for the uncertain range of motion of dynamic obstacles (such as a moving human hand). If the reachable set of the intended trajectory intersects the occupancy set of an obstacle, the system immediately switches to the precomputed braking trajectory, guaranteeing that the robot can come to a full stop before any collision.
预期轨迹与刹车轨迹始终拼接为完整的"监控轨迹"：正常执行时跟随预期段；一旦可达性检验失败，无缝切换到刹车段。等待障碍物离开后，系统可以从当前状态重新请求扩散策略生成新的 action chunk，继续任务，整个过程对策略网络完全透明。The intended trajectory and the braking trajectory are always concatenated into a complete "monitored trajectory": under normal execution the intended segment is followed; as soon as the reachability check fails, the system switches seamlessly to the braking segment. After waiting for the obstacle to leave, the system can request a new action chunk from the diffusion policy starting from the current state and continue the task; the whole process is fully transparent to the policy network.
Action Chunk 优势Advantages of the Action Chunk
相比逐步执行单个 action 的方法，利用完整 action chunk 规划轨迹可提升 28% 的任务成功率。多步动作序列提供了更多的时间裕量来执行路径一致性刹车。Compared with methods that execute single actions step by step, planning the trajectory from the complete action chunk raises the task success rate by 28%. A multi-step action sequence provides more temporal margin for performing path-consistent braking.
与 CBF 的本质区别Essential Difference from CBF
CBF 等反应式方法通过修改每个时刻的动作来规避障碍，导致机器人进入训练时从未出现的状态。PACS 从不修改方向，只在原有路径上减速或停止，保持训练分布内。Reactive methods such as CBF avoid obstacles by modifying the action at every time step, which drives the robot into states never encountered during training. PACS never modifies the direction; it only decelerates or stops along the original path, staying within the training distribution.
03实验（Experiments）Experiments
实验在两个层次展开：① 仿真环境使用 RoboMimic 基准（Lift、Can、Square 三个任务），每种配置 100 次 rollout，引入随机进入工作空间的动态障碍物球体；② 真实硬件使用 Franka FR3 机械臂，在三个人机交互任务（分类、交接、喂食）上各执行 30 次 rollout。Experiments are carried out at two levels: ① in simulation, the RoboMimic benchmark is used (three tasks: Lift, Can and Square) with 100 rollouts per configuration and a dynamic spherical obstacle that randomly enters the workspace; ② on real hardware, a Franka FR3 arm executes 30 rollouts on each of three human-robot interaction tasks (sorting, handover and feeding).
真实硬件 Sorting（分类）任务：机器人需在人手进入工作空间时安全停止，并在人手离开后继续完成物品分类。Real-hardware Sorting task: the robot must stop safely when a human hand enters the workspace, and resume sorting the objects after the hand leaves.真实硬件 Handover（交接）任务：机器人将物品递给人类，需实时感知人手位置并保证交互安全。Real-hardware Handover task: the robot hands an object to a human, which requires real-time perception of the hand position and guaranteed interaction safety.
真实硬件 Feeding（喂食）任务：机器人将食物送至人嘴边，此场景中安全违规率在 Filter OFF 时高达 85%，PACS 将其降至 0%。Real-hardware Feeding task: the robot brings food to the person's mouth; in this scenario the safety violation rate reaches 85% with Filter OFF, and PACS reduces it to 0%.
消融实验（Ablation Study）Ablation Study
对比 action chunk（多步）与 single-action（单步）版本的 PACS：使用单步动作时，SSM 变体平均成功率为 0.41，PFL 变体为 0.44；使用完整 action chunk 后，成功率分别提升至 0.69 和 0.72，提升幅度达 28%。这证实了将完整动作序列转化为时间轨迹是保持任务成功率的关键设计决策。Comparing the action-chunk (multi-step) and single-action (single-step) versions of PACS: with single-step actions, the average success rate is 0.41 for the SSM variant and 0.44 for the PFL variant; with the complete action chunk, the success rates rise to 0.69 and 0.72 respectively, an improvement of 28%. This confirms that converting the complete action sequence into a timed trajectory is the key design decision for preserving task success rate.
04局限性（Limitations）Limitations
注：以下局限性部分由作者在论文结论中明确指出，部分由方法设计推断得出。Note: Some of the limitations below are explicitly stated by the authors in the conclusion of the paper, while others are inferred from the design of the method.
仅支持动态障碍物，暂不支持半静态障碍物的在线重规划Only dynamic obstacles are supported; online replanning for (semi-)static obstacles is not yet available
论文明确指出："Handling (semi-)static obstacles via constraint-aware online replanning is an interesting avenue for future work."当前 PACS 设计主要针对动态进入工作空间的物体（如人手），对于已在场景中静止存在的障碍物，需要在线轨迹重规划能力，这留待未来工作解决。The paper states explicitly: "Handling (semi-)static obstacles via constraint-aware online replanning is an interesting avenue for future work." The current PACS design mainly targets objects that dynamically enter the workspace (such as a human hand); for obstacles that already rest in the scene, online trajectory replanning is required, which is left to future work.
路径一致性假设依赖观测中不含显式速度信息The path-consistency assumption relies on observations containing no explicit velocity information
PACS 的安全降速策略（在原有路径上减速而非改变方向）成立的前提是：扩散策略的观测输入中不包含末端执行器的显式速度。若策略被训练成依赖速度观测，则降速可能仍导致分布偏移，需要额外处理。The safe deceleration strategy of PACS (slowing down along the original path instead of changing direction) holds under the premise that the observation input of the diffusion policy does not contain the explicit velocity of the end effector. If the policy were trained to depend on velocity observations, decelerating could still cause distribution shift and would require additional treatment.
安全保证依赖障碍物运动模型的准确性Safety guarantees depend on the accuracy of the obstacle motion model
集合可达性分析对动态障碍物（如人手）的运动采用保守的包络假设。若实际运动超出预设的不确定性范围，安全保证可能失效。此外，感知系统的延迟和误差也会影响实时安全验证的可靠性。The set-based reachability analysis adopts a conservative envelope assumption for the motion of dynamic obstacles (such as a human hand). If the actual motion exceeds the preset uncertainty range, the safety guarantee may fail. In addition, latency and error in the perception system also affect the reliability of real-time safety verification.
