BarrierFormer: Transformer-Guided Predictive Barrier Enforcement for Safe Robot Control

The agent has no prior knowledge of obstacle locations and perceives its environment through $n_\text{rays}$ evenly-spaced LiDAR rays within a fixed sensing radius $R$. A single observation is therefore insufficient to characterize the safety of the current state: the agent may be currently safe but on a trajectory toward an obstacle that has not yet entered its sensing range. BarrierFormer enforces the barrier condition over a predicted rollout rather than pointwise at the current state.

• Problem setting: The agent follows $x_{t+1} = f(x_t) + g(x_t) u_t$ but observes only its own state, the goal-relative position, and radius-limited LiDAR returns. The policy sees just the observation-action history $\mathcal{H}_t$ of length $K$, and must reach the goal while keeping $d(p_t, R_j) \geq r$ for every obstacle.
• Why pointwise CBFs fall short: The condition $h(F(x,u)) - h(x) + \alpha(h(x)) \geq 0$ constrains a single transition, so satisfying it at every step can still drive the system into a state where no safe action remains. BarrierFormer instead enforces $h_\phi(\hat{x}_{t+k+1}) \geq (1-\gamma)\, h_\phi(\hat{x}_{t+k})$ across a horizon $k = 0, \ldots, H-1$.
• Step 1 — Autoregressive rollout: A GPT-2-style causal transformer encodes $\mathcal{H}_t$ into a latent $z_t$ feeding two heads: an actor head that outputs a residual correction to a nominal controller $\mu_\text{nom}$, and a dynamics head that predicts a state increment. Iterating the two generates the predictive rollout — standing in for the model that MPC would require.
• Step 2 — Barrier critic: A critic $h_\phi$ maps each predicted observation to a barrier value, which is what makes it usable under partial observability. Per-step violations are aggregated across the horizon by a smooth log-sum-exp of the worst case.
• SQP safety teacher: A sequential quadratic program computes the minimal correction to $\mu_\text{nom}$ that satisfies every horizon barrier constraint. Only its first action is kept, as the supervision target for the actor head. It runs during training only.
• Data labeling: Because a collision-free state can still be doomed, a state is labeled safe only if it and the next $T_\text{label} = 32$ states are all collision-free; states in collision are labeled unsafe, and the rest stay unlabeled.
• Training and deployment: All components train jointly under actor, dynamics, and barrier losses. At deployment, Step 2 is gone: the transformer maps history straight to actions — no SQP, no rollout, no online optimization, no model.

The predictive horizon, visualized. The left panel shows the full workspace: the agent (blue) executes the trajectory in solid blue toward the goal (green star), while the orange dashed line is the $H = 6$ step plan predicted by the transformer at that instant. The right panel zooms in on the agent, showing its LiDAR rays and the numbered steps of that predicted plan. This rollout is what the barrier critic evaluates during training — and it is precisely what a myopic, single-step CBF never looks at.

Double Integrator, $4 \times 4$ workspace, 12 obstacles.

BarrierFormer on the training distribution ($l = 4$ workspace, 8 obstacles). The agent perceives obstacles only through LiDAR rays within its sensing radius $R = 0.5$ and has no prior knowledge of obstacle locations. Safety is enforced purely by the policy parameters — no safety filter, no online optimization, and no model at inference.

We evaluate BarrierFormer on three dynamical systems: one linear (Double Integrator, DI) and two nonlinear (Dubins Car, DC and Crazyflie, CF). The safety rate is the fraction of episodes in which the robot never collides with an obstacle; the reaching rate is the fraction in which it reaches its goal; the success rate requires both. All results are reported as mean $\pm$ std over 3 random seeds $\times$ 32 environments. We compare against four baselines spanning three model-free paradigms and one model-based paradigm: CBF-RL (RL-based), CoBL-Diffusion (diffusion-based), ConBaT (transformer-based), and MPC (model-based). All baselines are re-implemented in our framework using the same dynamics, observation model, and obstacle configurations.

Performance comparison in terms of safety rate (Safe), goal reaching rate (Reach), and per-step computational time (Time). Ours (Dyn-Head) generates predictive rollouts with the learned dynamics head, while Ours (Sim) uses the true simulator during training. Among model-free methods, Ours (Dyn-Head) achieves the best balance between safety and goal-reaching with competitive inference time. Among model-based methods, Ours (Sim) matches MPC while reducing per-step inference time by over three orders of magnitude.

^† Inference time is not reported for CoBL-Diffusion, as diffusion-based planners require iterative denoising at inference, resulting in slow inference speeds. CoBL-Diffusion achieves a higher safety rate on CF but at the cost of a near-zero reaching rate, consistent with the local trap problem where CBF-guided gradient projection during denoising prevents the planner from making progress toward the goal.

Zero-shot generalization across increased obstacle density $\rho$, defined as $N_\text{obs}/l^2$ for DI and DC and $N_\text{obs}/l^3$ for CF. The DI and DC models are trained with area size $l = 4$ and $N_\text{obs} = 8$, and the CF model with $l = 3$ and $N_\text{obs} = 6$; no retraining is performed. Both variants maintain competitive safety and success rates as the workspace scales, suggesting that the learned barrier critic generalizes to unseen obstacle configurations and larger environments.

Mean ± std over 32 environments and 3 seeds, 1024 timesteps.

Zero-shot generalization to larger and denser environments across two axes of out-of-distribution difficulty: obstacle density $\rho \in \{0.50, 0.75, 1.00\}$ and workspace size $l \in \{4, 6\}$ for DI and DC, and $l \in \{3, 4\}$ for CF. Rows are the dynamics (DI, DC, CF); columns are safety, reaching, and success rate. Each (seed, episode) instance is initialized at the highest density and lower-density variants are derived from the same instance by removing a random subset of obstacles, so that density is the sole varying factor.

Every clip below comes from a policy trained only on a $4 \times 4$ workspace with 8 obstacles. Nothing is retrained or fine-tuned. Moving left to right increases obstacle density $\rho = N_\text{obs}/l^2$; moving down enlarges the workspace, which lengthens the path to the goal and increases exposure to obstacles over the episode. Episodes run for 1024 control steps. The $8 \times 8$ rows go beyond the $l \in \{4, 6\}$ range reported in Table 2 and Fig. 2 above.

Effect of the predictive horizon $H$ on Double Integrator, with history length fixed at $K = 12$. The $H = 1$ setting corresponds to pointwise barrier supervision without multi-step predictive lookahead, and gives the lowest safety rate. Increasing the horizon from $H = 1$ to $H = 6$ improves safety from $83.33\%$ to $95.83\%$, showing the benefit of enforcing barrier constraints over predicted rollouts rather than only at the next step. Increasing $H$ further does not consistently help at fixed history length, because longer rollouts accumulate dynamics-head prediction error and introduce more linearized barrier constraints in the SQP subproblem. We therefore use $H = 6$ with $K = 12$ in the main experiments.

Mean ± std over 32 environments and 3 seeds.

Freezing the transformer backbone and dynamics head after Phase 1. The frozen variant trains only the actor head and barrier critic in Phase 2, while Ours denotes the full training setup. The frozen dynamics head accumulates prediction error as the actor diverges from the pretraining distribution, and because attention is also frozen, the latent $z_t$ cannot adapt to the shifting action distribution — yielding inaccurate rollouts for barrier constraint evaluation. This motivates joint online training of all components.

Mean ± std over 32 environments and 3 seeds. Best mean values are bolded.

Robustness to dynamics perturbations on Double Integrator. All policies are trained on the unperturbed dynamics and evaluated without retraining, under a parametric velocity mismatch $\dot{p} = \alpha v$ and state-wise scaled process noise $\dot{x} = f(x,u) + w$, $w \sim \mathcal{N}(0, \Sigma_\sigma)$. Safety remains high across all tested $\alpha$; the lower reaching rate at $\alpha = 0.8$ is expected, since the robot moves more slowly and more often hits the episode time limit. Additive process noise is more challenging: safety stays above $92\%$ for moderate noise but degrades as the disturbance grows. The longer-history variant ($K = 32$, $H = 18$) tolerates larger noise better than the default. These are empirical robustness tests, not formal robust safety guarantees.

Rates reported as percentages over 3 seeds and 32 environments.