CSF: Adding a Context-Aware Safety Filter Layer to Motion Generators

Text-driven whole-body motion generation models are rapidly being deployed in robotics, virtual humans, and embodied intelligence. Give one a prompt like "walk over and pick up the cup," and it will output a whole-body trajectory that can be tracked and executed. But these models have a long-overlooked blind spot: the same motion can have completely different safety implications in different contexts. A wave can be a greeting, or it can be a strike against the person in front of you; reaching out can be handing something over, or grabbing a dangerous object.

Existing safeguards fall into roughly three categories: checking input prompts, training classifiers on labeled motion data, or applying geometric constraints. Their shared flaw is that they do not incorporate scene context into the judgment, which means they cannot answer the question: "Is this motion safe in this context?"

The paper "CSF: Contextual Safety Filtering for Motion Generators" from a research team proposes a training-free safety filtering approach that attempts to fill this gap.

The Core Problem: Safety Is Not an Intrinsic Property of Motion

Traditional safety thinking tends to treat the motion itself as the object of judgment: certain poses are dangerous, certain speeds are too high, certain joint angles exceed limits. But the key point the CSF paper makes is that the semantics of a motion depend on the context.

For example: a robotic arm moving toward a cup and moving toward a person's head may be highly similar at the level of joint trajectories. Purely detecting geometric features of the trajectory cannot distinguish between these two cases. Similarly, prompt filtering does not help either — the user's input "reach out" is itself completely harmless; the danger comes from the context in which it is executed.

This leads to a more precise problem definition: given a natural language safety rule (such as "do not touch people"), how do you determine whether the motion currently produced by the generator violates that rule? CSF's answer is to "ground" the rule into the generator's own output space.

How CSF Works: Defining Safety Boundaries with Reference Trajectories

CSF's core mechanism is training-free — it does not require retraining the generator or labeled data. Its pipeline can be broken down into three layers:

Layer one: translate natural language safety rules into a form the generator can understand. The approach is to have the generator separately produce a "safe reference trajectory" and an "unsafe reference trajectory" — for example, for "do not touch people," construct one trajectory that stays away from the person and one that would collide with them.

Layer two: use these two sets of reference trajectories to define an affine safety value. This value is essentially a scalar function that measures how far the current motion is from the "safe side." It does not draw a hard boundary in geometric space; instead, it establishes a direction in the generator's own motion representation space.

Layer three: enforce this safety value using a safety reference tracking CBF-QP (Control Barrier Function Quadratic Program). The CBF defines the safe set, and the QP solves, at each step, the control input that both tracks the target motion and does not cross the safety boundary.

The elegance of this design is that the safety rule is "attached" externally to the generator's output. The generator's architecture does not need to be modified, and there is no need to retrain for each rule.

Control Barrier Function (CBF) is a tool from control theory used to guarantee system safety. Its core idea is to define a "safe set" for the system and use a scalar function to describe how far the system state is from the boundary of that safe set. When the system approaches the dangerous boundary, the CBF imposes constraints that force the system back into the safe region. Quadratic Programming (QP) is an optimization method used to find the solution that minimizes an objective function while satisfying a set of constraints. In CSF, the CBF-QP combination means: at each step, solve an optimization problem whose objective is "track the motion the generator originally intended to output as closely as possible," with the constraint being "do not cross the safety boundary defined by the CBF." The resulting control input preserves both the fluidity and intent of the motion and the safety guarantee. This "minimal intervention" design is exactly why CSF can retain 88%–100% of benign motions.

The word "affine" in affine safety value refers to the mathematical affine transformation — that is, a linear transformation plus a translation. Here, CSF uses safe reference trajectories and unsafe reference trajectories to construct a scalar function, and this function defines a "direction" in the generator's motion representation space: moving toward the safe side increases the value; moving toward the unsafe side decreases it. It is called "affine" because the computation of this safety value is affine with respect to the motion representation, which allows the subsequent CBF-QP solve to preserve convex optimization properties and thus efficiently obtain the global optimum at each step. Compared with drawing a hard boundary directly in geometric space, this kind of safety value defined in the generator's own representation space is more adaptable to different generators' internal representations and easier to integrate seamlessly with the generator's output.

Experimental Results: Up to 90% Reduction in Hazardous Event Rate

The paper validates CSF's generality on four pretrained generators with different architectures. This cross-architecture setup is crucial — it shows that CSF does not depend on one specific model structure, but can be inserted as a general filtering layer.

There are several notable points at the data level:

• In all explicit unsafe cases and scenario-triggered unsafe cases, CSF successfully activated the corresponding safety rule;
• The hazardous event rate was reduced by up to 90%;
• At the same time, 88%–100% of beneficial motions were retained.

The last metric is easy to overlook, but it is equally important. If a safety filter is excessively conservative and blocks all motions, the system becomes unusable. The 88%–100% benign motion retention rate shows that CSF's intervention is selective rather than one-size-fits-all.

The paper also conducted a complete system demonstration on a real-world Unitree G1 humanoid robot, covering scenarios such as human interaction and object interaction, and successfully prevented unsafe motions. Transfer from simulation to the real robot is a key test of whether such safety methods can be deployed.

Cross-architecture validation here means that CSF was applied separately to four pretrained motion generators with different structures — for example, possibly including Transformer-based, diffusion-based, and VAE-based architectures. These generators differ in motion representation, output form, and internal hierarchy. That CSF is effective across these different architectures shows that its safety filtering mechanism does not depend on a particular network structure or motion representation, but is general-purpose. This is very important for real deployment: embodied intelligence products may use a variety of different generators. If a safety solution can only adapt to one architecture, then every time the model changes, the safety module must be redesigned, which is extremely costly. CSF's cross-architecture generality means it can serve as a standardized safety layer inserted behind any generator.

The Significance and Boundaries of This Approach

The value of CSF is not just that it adds another safety module, but that it provides a new way of thinking: safety judgment can be built on the generator's own motion distribution, rather than on externally imposed geometric or semantic rules. This allows safety filtering to adapt to different generators, different rules, and different scenarios.

However, there are several boundary questions worth considering. The quality of the safety reference trajectories directly determines the reliability of the safety value — if the generator cannot produce distinguishable safe/unsafe trajectories for a given rule, the filtering effect will be compromised. In addition, the paper demonstrates activation rule by rule. When multiple rules are active simultaneously and conflict with each other (for example, "stay close to people" and "stay away from obstacles"), how to coordinate priorities is not discussed in the paper.

From an industry perspective, if this kind of "training-free external safety layer" matures, it will significantly reduce the compliance cost of embodied intelligence products. After all, retraining a large model to solve safety problems is far more expensive than adding a filtering layer at inference time. CSF currently demonstrates a proof of concept plus a real-robot demo. There is still an engineering gap to productization, but the direction is worth watching.

Unitree G1 is a humanoid robot released by Unitree Robotics. It is about 1.3 meters tall, has more than 23 degrees of freedom, and is mainly aimed at research, education, and lightweight service scenarios. G1 is characterized by strong mobility, relatively low cost, and a fairly complete open SDK, making it convenient for researchers to deploy and test various algorithms on it. In the CSF experiments, G1 was used to validate the safety filter's transfer from simulation to the real robot. Real-robot experiments are more challenging than simulation: sensor noise, actuator delay, changes in ground friction, and the unpredictability of human behavior all affect the accuracy of safety judgments. That CSF can successfully prevent unsafe motions on G1 shows that its safety value definition and CBF-QP solve remain effective under real physical conditions, which is an important step from paper to productization.

One-line Summary

CSF proposes a training-free safety filter that defines safety values from reference trajectories, reducing hazardous event rates by up to 90%.

Paragraph Summary

Existing text-driven whole-body motion generation models are rapidly being deployed in robotics, virtual humans, and embodied intelligence, but the safety implications of motions depend heavily on scene context. Traditional prompt filtering, labeled-data classification, and geometric constraints cannot handle this dependency. The paper "CSF: Contextual Safety Filtering for Motion Generators" proposes a training-free safety filtering approach: have the generator separately produce safe and unsafe reference trajectories, use them to define an affine safety value, and then enforce it at each step with safety reference tracking CBF-QP. The method was validated on four pretrained generators with different architectures, reducing the hazardous event rate by up to 90% while retaining 88%–100% of beneficial motions, and completed safety validation for human-robot and object interaction scenarios on a real Unitree G1 humanoid robot.