BarrierFormer: Transformer-Guided Predictive Barrier Enforcement for Safe Robot Control

The agent has no prior knowledge of obstacle locations and perceives its environment through $n_\text{rays}$ evenly-spaced LiDAR rays within a fixed sensing radius $R$. A single observation is therefore insufficient to characterize the safety of the current state: the agent may be currently safe but on a trajectory toward an obstacle that has not yet entered its sensing range. BarrierFormer enforces the barrier condition over a predicted rollout rather than pointwise at the current state.

• Problem setting: The agent follows $\mathbf{x}_{t+1} = f(\mathbf{x}_t) + g(\mathbf{x}_t)\mathbf{u}_t$ but observes only $\mathbf{o}_t = o(\mathbf{x}_t) = (\mathbf{x}_t,\; \mathbf{p}_\text{goal} - \mathbf{p}_t,\; \mathbf{y}_{t,1}, \ldots, \mathbf{y}_{t,n_\text{rays}})$: its own state, the goal-relative position, and per-ray LiDAR features. The policy sees just the observation-action history $\mathcal{H}_t$ of length $T$, and must both stay safe, $d(\mathbf{p}_t, \mathcal{O}_i) \geq r$ for all $M$ obstacles, and reach the goal, $\inf_{t \geq 0} \|\mathbf{p}_t - \mathbf{p}_\text{goal}\| = 0$.
• Why pointwise CBFs fall short: The DTCBF condition $h(\mathbf{o}^+) - h(\mathbf{o}) \geq -\alpha(h(\mathbf{o}))$ constrains a single transition, so satisfying it at every step can still drive the system into a state where no safe action remains. BarrierFormer instead enforces $h(\mathbf{o}_{t+k+1}) \geq (1-\gamma)\, h(\mathbf{o}_{t+k})$ across a horizon $k = 0, \ldots, H-1$. Note the barrier is defined on observations, not full states.
• Step 1: Autoregressive rollout. A GPT-2-style causal transformer encodes $\mathcal{H}_t$ into a latent $\mathbf{z}_t$ feeding two heads: an action head that outputs a residual correction to a nominal controller $\mu_\text{nom}$, and a dynamics head that predicts a state increment. Each predicted state is mapped back through the observation model, $\hat{\mathbf{o}} = o(\hat{\mathbf{x}})$, using only obstacles encountered so far, not a global map. Iterating this generates the predictive rollout, standing in for the model that MPC would require.
• Step 2: Barrier critic. A critic $h_\phi$ maps each predicted observation to a barrier value, which is what makes it usable under partial observability. Per-step violations are aggregated across the horizon by a smooth log-sum-exp of the worst case.
• SQP safety teacher: A sequential quadratic program computes the minimal correction to $\mu_\text{nom}$ that satisfies every horizon barrier constraint. Only its first action is kept, as the supervision target for the action head. It runs during training only.
• Data labeling: Because a collision-free state can still be doomed, labels come from the states that follow an observation in the same stored rollout: an observation is safe only if its state and all subsequent $T_\text{label} = 32$ steps are collision-free, unsafe if the state is in collision, and otherwise left unlabelled.
• Training and deployment: All components train jointly under actor, dynamics, and barrier losses. At deployment, Step 2 is gone: the transformer maps history straight to actions, with no SQP, no rollout, no online optimization, and no model.

The predictive horizon, visualized. The left panel shows the full workspace: the agent (blue) executes the trajectory in solid blue toward the goal (green star), while the orange dashed line is the $H = 6$ step plan predicted by the transformer at that instant. The right panel zooms in on the agent, showing its LiDAR rays and the numbered steps of that predicted plan. This rollout is what the barrier critic evaluates during training, and it is precisely what a myopic, single-step CBF never looks at.

Double Integrator, $4 \times 4$ workspace, 12 obstacles.

BarrierFormer on the training distribution ($l = 4$ workspace, 8 obstacles). The agent perceives obstacles only through LiDAR rays within its sensing radius $R = 0.5$ and has no prior knowledge of obstacle locations. Safety is enforced purely by the policy parameters, with no safety filter, no online optimization, and no model at inference.

We evaluate BarrierFormer on three dynamical systems: one linear (Double Integrator, DI) and two nonlinear (Dubins Car, DC and Crazyflie, CF). The safety rate is the fraction of episodes in which the robot never collides with an obstacle; the reaching rate is the fraction in which it reaches its goal; the success rate requires both. All results are reported as mean $\pm$ std over 3 random seeds $\times$ 32 environments. We compare against four baselines spanning three model-free paradigms and one model-based paradigm: CBF-RL (RL-based), CoBL-Diffusion (diffusion-based), ConBaT (transformer-based), and MPC (model-based). All baselines are re-implemented in our framework using the same dynamics, observation model, and obstacle configurations.

Performance comparison in terms of safety rate (Safe), goal reaching rate (Reach), success rate (Success) and per-step computational time (Time). Ours (Dyn-Head) generates predictive rollouts with the learned dynamics head, while Ours (Sim) uses the true simulator during training. Among model-free methods, Ours (Dyn-Head) achieves the best balance between safety and goal-reaching with competitive inference time. Among model-based methods, Ours (Sim) matches MPC while reducing per-step inference time by over three orders of magnitude.

^† Inference time is not reported for CoBL-Diffusion, as diffusion-based planners require iterative denoising at inference, resulting in slow inference speeds. CoBL-Diffusion achieves a higher safety rate on CF but at the cost of a near-zero reaching rate, consistent with the local trap problem where CBF-guided gradient projection during denoising prevents the planner from making progress toward the goal.

Zero-shot generalization across obstacle densities and workspace sizes. Obstacle density is $\rho = M/l^{n_p}$, where $M$ is the number of obstacles and $n_p \in \{2,3\}$ is the dimension of the position space. Models are trained only at the smaller workspace and lowest density: $l = 4$ with $M = 8$ for DI and DC, giving $\rho = 0.50$, and $l = 3$ with $M = 6$ for Crazyflie, giving $\rho = 6/27 \approx 0.22$. They are then evaluated without retraining at $\rho \in \{0.50, 0.75, 1.00\}$ and $l \in \{4, 6\}$ (DI, DC) or $l \in \{3, 4\}$ (CF). Note that every Crazyflie column is therefore out of distribution in density: even the sparsest evaluated setting, $M = 13$ at $l = 3$, is more than twice the training density. To ensure a controlled, paired comparison, each instance is initialized at the highest density and lower-density variants are obtained by removing a random subset of obstacles while preserving the poses of all remaining ones, so density is the only factor that varies. Safety rates generally decrease with increasing density, as higher clutter reduces navigable space; at fixed density, performance generally decreases as the workspace grows, likely due to longer navigation paths and increased exposure to obstacles. Both variants retain substantial safety under these distribution shifts, with the largest drop when high density and a larger workspace are combined.
The same evaluation in numbers, at the training workspace size. The table below tabulates the smaller-workspace bars of Fig. 2 ($l = 4$ for DI and DC, $l = 3$ for CF) across the three densities, for both the Sim and Dyn-Head variants.

Mean ± std over 32 environments and 3 seeds, 1024 timesteps.

Every clip below comes from a policy trained only on a $4 \times 4$ workspace with 8 obstacles. Nothing is retrained or fine-tuned. Moving left to right increases obstacle density $\rho = M/l^{n_p}$; moving down enlarges the workspace, which lengthens the path to the goal and increases exposure to obstacles over the episode. Episodes run for 1024 control steps. The $8 \times 8$ rows go beyond the $l \in \{4, 6\}$ range reported in Fig. 2 above.

Effect of the predictive horizon $H$ on Double Integrator, with history length fixed at $T = 12$. The $H = 1$ setting corresponds to pointwise barrier supervision without multi-step predictive rollout, and gives the lowest safety rate. Increasing the horizon from $H = 1$ to $H = 6$ improves safety from $83.33\%$ to $95.83\%$, demonstrating the benefit of enforcing barrier constraints over predicted rollouts rather than only at the next step. Increasing $H$ further does not consistently help when the history length is fixed, because longer rollouts accumulate dynamics-head prediction error and introduce more linearized barrier constraints in the SQP subproblem. We therefore use $H = 6$ with $T = 12$ in the main experiments.

Mean ± std over 32 environments and 3 seeds.

Freezing the transformer backbone and dynamics head after Phase 1. The frozen variant trains only the action head and barrier critic in Phase 2, while Ours denotes the full training setup. The frozen dynamics head accumulates prediction error as the action head’s distribution shifts away from the pretraining distribution, and because the backbone is also frozen, the latent $\mathbf{z}_t$ cannot adapt, yielding inaccurate rollouts for barrier constraint evaluation. This motivates joint online training of all components.

Mean ± standard deviation across 3 seeds, with each seed evaluated on 32 environments. Best mean values are bolded.

Dynamics-head rollout accuracy. Because the dynamics head is a learned model, its accuracy depends on the coverage of the (state, action) pairs it saw during pretraining. Phase 1 therefore pretrains on trajectories from three different control policies (GCBF+, a QP safety controller, and the nominal LQR controller), giving a training distribution that spans learned safe actions, optimization-based corrections and nominal control. Each pretrained dynamics head is then evaluated on 50 independently generated episodes of 256 steps per input signal. The $H = 1$ column is the one-step RMSE; the rest report autoregressive rollout RMSE over the horizon. The upper block of each table is closed-loop controller inputs, the lower block synthetic open-loop signals never encountered during pretraining.

History length $T = 12$

History length $T = 32$

Increasing the history length to $T = 32$ consistently reduces prediction error on controller-based inputs through $H = 24$. At $H = 32$ the two are comparable on those inputs (mean RMSE $0.00321$ vs. $0.00341$), but the longer history helps clearly on unseen nonzero open-loop inputs, cutting their mean $H = 32$ RMSE from $0.00615$ to $0.00333$, about a $46\%$ reduction. The zero-action input is the exception, where both accumulate similar long-horizon error.

Robustness to dynamics perturbations on Double Integrator. All policies are trained on the unperturbed dynamics and evaluated without retraining, under a parametric velocity mismatch $\dot{\mathbf{p}} = \alpha_\text{vel}\mathbf{v}$ and state-wise scaled process noise $\dot{\mathbf{x}} = f(\mathbf{x},\mathbf{u}) + \mathbf{w}$, $\mathbf{w} \sim \mathcal{N}(\mathbf{0}, \boldsymbol{\Sigma}_w)$. Under velocity mismatch the safety rate stays high across all tested $\alpha_\text{vel}$; the lower reaching rate at $\alpha_\text{vel} = 0.8$ is expected, since the robot moves more slowly and more often hits the episode time limit before arriving. Additive process noise is more challenging: safety remains above $92\%$ for $\sigma \leq 0.0025$ but drops as the disturbance magnitude increases. These are empirical robustness tests, not formal robust safety guarantees.

Rates reported as percentages over 3 seeds with 32 environments per seed. For process noise, $\sigma_p = \sigma_v = \sigma$.