Why a Safe Prompt Is Not Enough for a Humanoid Robot

Can a filter stop a text-generated humanoid motion from striking a person while leaving the same motion intact when it is aimed at training equipment? Contextual Safety Filtering shows one way to do that without retraining the motion generator: use the scene to activate natural-language rules, turn safe and unsafe reference motions into constraints, and redirect the generated reference before a whole-body controller tracks it.

That is a useful safety filter, but it is not a safety certificate. The authors report up to a 90% reduction in their danger-event measure across four motion generators and demonstrate the pipeline on a Unitree G1. Their rules cover six concepts, their detector supplies the scene labels, and their real-robot evidence is a set of qualitative trials rather than a reliability study. The result is best understood as a modular guard for one layer of a humanoid stack—not proof that the entire robot will behave safely.

The unsafe part may not be in the prompt

A prompt checker can catch an explicit instruction such as “punch a person”. It cannot resolve every case from text alone. “Punch the pillar” sounds benign, but the generated strike becomes dangerous if a person stands where the pillar was expected. Conversely, banning every punching motion would also discard legitimate training or performance motions.

CSF separates those questions. Each rule names an unsafe behaviour and a protected entity, while a semantic context gate decides whether the rule applies to the current command or detected scene. The paper's gate uses the motion generator's text encoder to compare the command and detected entity labels with the rule descriptions. A rule becomes active if either the prompt or the scene implicates its protected entity.

This is not open-ended moral reasoning. It is rule selection over a declared list. If perception misses the person, the entity label is wrong, or no rule covers the hazard, the filter has no basis for intervening. The method makes context part of motion filtering; it does not make context perfectly observable.

The closest article on this site is the analysis of Humanoid-GPT's motion tracker. That work asks whether a Unitree G1 can follow diverse supplied references. CSF asks the next, distinct question: what should happen when a trackable reference is inappropriate for the entity currently in front of the robot?

The filter sits between generation and tracking

The system has several boundaries that should not be collapsed into one “safe robot” claim:

That decomposition matters for both evaluation and data logging. A correct gate can still feed an ineffective filter. A well-filtered reference can still be tracked badly. A physical hazard can also exist outside the semantic rule set, such as a fall, joint overload, or collision caused by a poor state estimate.

Safe and unsafe references define a direction

For every active rule, the frozen generator produces two examples. One is an unsafe reference made from the rule description; the other is a benign version of the requested motion. Their difference defines a direction in the generator's motion representation.

The current estimate is projected relative to that direction. A negative semantic margin means the estimate lies on the unsafe side; zero or above belongs to the paper's constructed safe set. Because the margin is affine, several active rules become a small collection of half-space constraints.

CSF enforces those constraints with a control barrier function quadratic program, or CBF-QP. At its minimum-intervention setting, the optimisation makes the smallest Euclidean correction needed to satisfy the active margins and leaves compliant estimates unchanged. Increasing the tracking weight pulls the result farther towards the selected safe reference.

The distinction between mathematical and physical safety is essential. The paper proves feasibility, invariance, and contraction properties for its affine semantic margins under the stated optimisation. Those properties do not prove that a generated humanoid motion avoids every real hazard. The “safe set” is only as meaningful as the rules, reference motions, representation, perception, thresholds, and tracker wrapped around it.

Representation decides how costly intervention becomes

The authors attach the same rules, gate, and optimisation idea to four pretrained generators: Kimodo-G1, ECHO, MotionHiFlow, and ARDY. These expose different internal estimates—motion features, a variational-autoencoder latent, or autoregressive hybrid tokens—so the same semantic distinction is not equally clean in each space.

Kimodo's motion-feature representation supports a minimum-norm correction. MotionHiFlow's latent margin separates the concepts less clearly and needs a stronger pull towards the safe reference. ECHO and ARDY fall between those cases. This is an important deployment lesson: a filter can be architecturally portable without being behaviourally identical.

When root channels are separable, CSF excludes them. That prevents the optimiser from satisfying “do not punch a person” by translating the entire character away instead of changing the unsafe pose, but it also limits the response. The paper lists root-trajectory filtering and locomotion redirection as future work.

What the 2,688-clip benchmark measures

The benchmark uses 28 unsafe–benign command pairs across six concepts: four involving person-directed violence and one each protecting a child and an animal. Three random seeds are evaluated in allowed and protected scenes, with and without CSF. That produces 672 clips per generator and 2,688 clips overall, split evenly between filtered and unfiltered outputs.

The danger metric is deliberately separate from the semantic margin used by the filter. It detects persistent bursts of fast, extended end-effector motion above a threshold fixed at the 95th percentile of unfiltered benign motion. The reported danger ratio divides the filtered event rate by the unfiltered rate. A ratio of 0.1 therefore means a 90% relative reduction under that detector, not that 90% of injuries were prevented.

Three backbones reach a residual danger ratio of 0.1, while ECHO reaches 0.2. The gate selects the intended rule in every explicit and scene-triggered unsafe case in this benchmark. For benign motions, 88–100% either pass through or move closer to the selected safe counterpart. All four filters suppress more detected danger per unit of discarded motion than the paper's standing-pose baseline.

These are paired, author-run tests with a purpose-built motion heuristic. They establish a useful safety–preservation trade-off inside the benchmark, but they do not measure injury severity, miss rates under natural scenes, detector uncertainty, or performance across an unbounded vocabulary of unsafe behaviour.

The small QP is not always the expensive part

On the authors' RTX 4090, the rule-space dual takes 0.01–0.18 milliseconds for one to six active rules; a complete filter call takes 0.3–1.2 milliseconds. For ECHO, MotionHiFlow, and ARDY, generating and caching the references costs 0.6–0.9 seconds once, with per-sample overhead ranging from immeasurable in the fastest case to 19%.

Kimodo behaves differently because it reconstructs step-matched references during sampling. Filtering increases generation of a four-second motion from 1.61 to 7.60 seconds even though the QP itself accounts for only 0.14 seconds. The bottleneck is producing comparable semantic references, not solving the compact optimisation.

That difference matters when choosing what to log. A useful latency record should separate scene detection, text encoding, reference generation, each QP call, motion generation, runtime-shield response, tracker inference, and actuator execution. A single end-to-end average would hide whether a scene change can be handled before the unsafe part of the motion begins.

The runtime shield edits only the future

Generation-time filtering cannot anticipate every scene change. In the hardware demonstration, the G1 begins an object-directed punch or kick, then a person enters view. The updated entity list activates the person-protection rule. The runtime shield preserves the already executed prefix, finds the first violating future window, and blends the remaining reference into a safe continuation after a short response buffer.

The authors also show explicit person-directed commands being redirected, a deceptive object-directed command being blocked when a person is detected, and the object-directed motion passing when only the object is present. ARDY supplies the reference and a pretrained SONIC whole-body controller tracks it; both remain unchanged between nominal and filtered cases.

The paper does not report a large-sample hardware success rate, detection stress test, or independent replication. The clips demonstrate that the complete pipeline can work in the shown conditions. They do not establish a quantified probability of safe operation around people.

A filtered-motion dataset needs both versions

For a robot-data team, the most valuable artefact is not only the final safe-looking clip. Each intervention creates a paired record of what the generator proposed, what the safety layer changed, and what the robot executed. Preserve:

• the original command, safe rewrite, unsafe rule text, protected entity, and rule-set version;
• raw detector outputs, confidences, timestamps, and the scene entities selected by the gate;
• generator name, checkpoint, random seed, representation, unfiltered reference, safe reference, and unsafe references;
• active margins before and after filtering, QP settings, residuals, solver status, and intervention magnitude;
• runtime cursor, response buffer, splice window, filtered continuation, and latency for every stage;
• tracker input, commanded joint targets, measured robot state, contacts, aborts, near misses, and final outcome.

Without the unfiltered proposal and active-rule record, a filtered episode hides the behaviour the system prevented. Without measured execution, it is only evidence about reference generation. Those distinctions are as important here as separating a retargeted motion from the physical trajectory that followed it.

The code is public; the safety case is not complete

The authors' Apache-2.0 repository releases the filter, four generator integrations, and an interactive demo. Third-party generators and weights retain their own licences, and the documented setup requires an NVIDIA GPU with 24 GB plus access to the Llama 3 text encoder. That is a meaningful reproducibility release, but reproducing a motion benchmark is not the same as validating a deployment.

A production safety case would still need hazard analysis, perception validation, false-negative testing, platform limits, emergency stopping, fault handling, human-factors review, and trials appropriate to the environment. CSF's present rule set is narrow; its root trajectory is not redirected; its safe continuation comes from a selected reference rather than a live replan; and its guarantees apply to a semantic half-space rather than all robot dynamics and contacts.

The practical result is nevertheless sharper than “add a safety prompt”. A prompt is only one observation of intent. CSF makes the scene select the rule, makes the motion generator expose a contrasting safe reference, and makes an optimisation layer change the uncommitted motion. The next step is not to call that complete safety. It is to measure each remaining boundary—perception, rules, reference quality, timing, tracking, and physical outcome—without losing the paired evidence that shows when and why the filter intervened.