Provably Safe Generative Sampling with Constricting Barrier Functions
Authors: Darshan Gadginmath, Ahmed Allibhoy, Fabio Pasqualetti
Organizations: Mitsubishi Electric Research Laboratories Cambridge, Massachusetts · Electrical Engineering and Computer Science University of California, Irvine
Flow-based generative models, such as diffusion models and flow matching models, have achieved remarkable success in learning complex data distributions. However, a critical gap remains for their deployment in safety-critical domains: the lack of formal guarantees that generated samples will satisfy hard constraints. We propose a safety filtering framework that acts as an online shield for any pre-trained generative model. Our key insight is to cooperate with the generative process rather than override it. We define a constricting safety tube that is relaxed at the initial noise distribution and progressively tightens to the target safe set at the final data distribution, mirroring the coarse-to-fine structure of the generative process itself. By characterizing this tube via Control Barrier Functions (CBFs), we synthesize a feedback control input through a convex Quadratic Program (QP) at each sampling step. As the tube is loosest when noise is high and intervention is cheapest in terms of control energy, most constraint enforcement occurs when it least disrupts the model's learned structure. We prove that this mechanism guarantees safe sampling in discrete-time. The minimum-norm control synthesized at each step minimizes the per-step contribution to the KL divergence between the safe and original distributions. Across all experiments, we observe 100% constraint satisfaction. Our framework applies to any pre-trained flow-based sampling scheme requiring no retraining or architectural modifications. We validate the approach across constrained image generation, physically-consistent trajectory sampling, and safe robotic manipulation policies, achieving 100% constraint satisfaction while preserving semantic fidelity.
Figures & tables
Figure 1: Constrained generative sampling with a constricting safety tube. The flow-based sampling process transforms noise sample x(T) into data x(0) . Unconstrained sampling process can produce unsafe samples that violate constraints, landing outside the required safe set. Our control barrier function-guided sampling augments the generative dynamics with feedback control inputs u that maintain the sample within the constricting safety tube C~(t) (green region) throughout the sampling process, guaranteeing safe samples and minimal perturbation of the learned sampling process.
Figure 2: Lorenz system trajectory generation with CBF guidance. (a) Phase portrait showing the true ODE solution (dashed black). Our CBF-guided diffusion model (blue) closely tracks the true dynamics, while unconstrained sampling (red) produces physically inconsistent trajectories. (b) Evolution of the constricting barrier h~(x,t) (green) and relaxation ϵ(x(T),t) (blue) during sampling. The constriction goes from ϵ0≈16 to 0, accommodating the large initial physics violation. The barrier remains non-negative throughout, verifying reverse invariance. (c) Control effort ∥u∥2 over sampling time, concentrated at the onset of sampling when the initial noise sample must be corrected, then rapidly diminishing as the trajectory becomes physics-consistent.
Figure 3: Spatially constrained image generation with DDPM-bedroom-256. (a) Reference window patch ( 50×70 pixels). (b) Generated image with 50 sampling steps. (c) Generated image with 200 sampling steps. Both (b) and (c) preserve the reference window exactly at the specified location while generating bedroom context. Higher sampling steps improve generation quality in unconstrained regions, but constraint satisfaction is guaranteed in both cases.
Figure 4: Regional color intensity constraints. Images are enforced with color values in the lower third. (a) Moderate intensity: The target pixel color is black, and the spatial mask v(p) goes from 0.5→0 , allowing the diffusion model to produce clean furniture. (b) Projection: Projection-based constraint enforcement ( Zampini et al., 2025 ) , constraints are the same as in (a), with the target pixel color black in the bottom one-third of the image. Projection causes intense constraint enforcement, which leads to loss of semantic information. (c) Low intensity: Target color is brown, and the spatial mask v(p) goes from 0.2 at the bottom to 0 at the lower-third boundary, producing a semantically meaningful image of a room with a brown carpet.
Figure 5: Final samples comparing sampling with an unconstrained model versus four constriction schedules on the window-location constraint of Section 5.2.1 under identical initial noise. All four schedules preserve the reference window patch. The schedules differ in where along the sampling horizon the control effort is concentrated. See Table 1 for quantitative comparison.
Schedule
maxklin.errk
FID mask
KID mask(×10−2)
Vendi mask
QP time (ms)
Vanilla (no CBF)
–
–
–
7.35
–
Linear
7.42
47.09
1.01±0.19
6.62
33.45
Exponential, λ=1.5
10.04
47.22
1.03±0.19
6.64
32.16
Exponential, λ=3
5.81
47.22
1.04±0.19
6.66
33.62
Polynomial, p=3
22.69
47.20
1.04±0.19
6.65
33.21
Table 1: Quantitative comparison of constriction schedules on the location and content constraint, K=200 sampling steps. maxklin.errk is the largest per-step deviation between the realized barrier and its linear prediction (lower is better, characterizes discrete-time error). FID mask and KID mask are computed between 500 schedule samples and 500 vanilla samples on the unconstrained region only (lower indicates closer to vanilla). Vendi mask is intra-set diversity on the unconstrained region (higher is more diverse, vanilla reference is 7.35 ). QP time is the average per-step computation time for the QP.
Figure 6: Smooth action generation for Push-T robotic manipulation. (a) The Push-T environment: a planar robot arm must push the T-shaped block (gray) to the target pose (green). (b) End-effector trajectories for a representative episode. Unconstrained Diffusion Policy (DP, dotted red) exhibits sharp directional changes during pushing. DP-DDIM (dashed blue) produces more erratic motion due to fewer sampling steps. Our CBF-guided sampling (solid black) generates a smooth trajectory that satisfies the smoothness constraint at every step while achieving the same task reward.
Metric
DP
DP-DDIM
CBF-guided
Mean reward
0.92
0.90
0.92
Smoothness violation
14
19
0
Sampling steps K
100
10
100
Mean inference time (ms)
47.05
4.57
62.91
Table 2: Comparison on Push-T with smoothness constraints over 100 episodes
Appendix figures & tables4 assets
Supplementary material from the paper’s appendix.
Appendix
Figure 7: Spatial and content constrained generation with red pillow reference. (Left) Reference patch ( 50×50 pixels) containing two red pillows with white background. (Middle) Generated image with 50 sampling steps. (Right) Generated image with 200 sampling steps. Both preserve the pillows exactly while generating bedroom context. The white boundary pixels in the reference influence the surrounding color palette, resulting in light-toned ambient environments.
Figure 8: newDisjunctive two-window constraint, a non-convex safe set {match windowA}∪{match windowB} . Window choice A is given in Figure 3 (a), and window choice B is the right image. The constraint is applied at a fixed patch location (as in Section 5.2.1 ), only the random seed varies. The framework selects a reference window based on the initial noise, with no manual choice, and renders the selected window to within tolerance. Different seeds select different windows, confirming both basins of the non-convex set are individually reachable. Both reference windows are in-distribution for the pre-trained bedroom model, so the selected window integrates naturally into the surrounding scene.
Figure 9: Effect of the control cutoff (single fixed seed, linear constriction, spatial localization constraint of Section 5.2.1 ). Control is applied while t>toff and disabled for t≤toff . Sampling runs in reverse time from t=T to t=0 , so a small toff keeps control active for almost the entire trajectory. (a) Unguided sampling: an unrelated scene with no patch. (b) toff=0.05 : full fidelity, including the fine lines inside glass window, indistinguishable from always-on control. (c) toff=0.3 : coarse content and placement preserved, but the finer glass details are lost. (d) toff=0.6 : the window’s coarse characteristics persist but the constraint is substantially violated. (e) toff=0.9 : the constraint vanishes and the model reclaims the region. Control applied later in sampling enforces progressively finer scales of the constraint.
Figure 10: Constrained image generation with latent diffusion models with prompt “high-quality image of a rustic bedroom”. The constraint is to produce the reference window in Figure 3 (a) in the top right corner, same as in Section 5.2 .1. We see that the model responds to the constraint by producing a visually distinct region at the target location, but the reference patch is not preserved with pixel-level fidelity due to the VAE decoder’s non-invertibility.
Constrained generative modeling is fundamental to applications such as robotic control and autonomous driving, where models must respect physical laws and safety-critical constraints. In real-world settings, these constraints rarely take the form of simple linear inequalities, but instead complex feasible regions that resemble road maps or other structured spatial domains. We propose a constrained generation framework that generates samples directly within such feasible regions while preserving realism. Our method fine-tunes a pretrained generative model to enforce constraints while maintaining generative fidelity. Experimentally, our method exhibits characteristics distinct from existing fine-tuning and training-free constrained baselines, revealing a new compromise between constraint satisfaction and sampling quality.
Xiaoxuan Liang, Saeid Naderiparizi, Yunpeng Liu +2
Safety mechanisms for diffusion and flow models have recently been developed along two distinct paths. In robot planning, control barrier functions are employed to guide generative trajectories away from obstacles at every denoising step by explicitly imposing geometric constraints. In parallel, recent data-driven, negative guidance approaches have been shown to suppress harmful content and promote diversity in generated samples. However, they rely on heuristics without clearly stating when safety guidance is actually necessary. In this paper, we first introduce a unified probabilistic framework using a Maximum Mean Discrepancy (MMD) potential for image generation tasks that recasts both Shielded Diffusion and Safe Denoiser as instances of our energy-based negative guidance against unsafe data samples. Furthermore, we leverage control-barrier functions analysis to justify the existence of a critical time window in which negative guidance must be strong; outside of this window, the guidance should decay to zero to ensure safe and high-quality generation. We evaluate our unified framework on several realistic safe generation scenarios, confirming that negative guidance should be applied in the early stages of the denoising process for successful safe generation.
Mingyu Kim, Young-Heon Kim, Mijung Park
Kookmin University · University of British Columbia
While flow-based generative models have demonstrated strong performance across a wide range of domains, deploying them in safety-critical physical systems remains challenging due to strict constraint requirements. Existing approaches typically enforce safety through post-hoc corrections, which incur substantial computational overhead and may distort the learned distribution. We propose PolyFlow, a polytope-constrained flow matching framework that embeds constraints directly into the model and flow dynamics. PolyFlow introduces a discrete-time flow formulation and a projection-free architecture, which eliminate the discretization error and guarantee strict satisfaction of arbitrary polyhedral constraints, without the need for expensive iterative solvers. Experimental results show that PolyFlow achieves zero constraint violation while maintaining high distributional fidelity across a range of planning and control tasks. Compared to state-of-the-art constrained generation baselines, PolyFlow significantly reduces inference latency and demonstrates a favorable trade-off between safety, efficiency, and generative quality. Code is available on https://github.com/MJianM/PolyFlow.
Jianming Ma, Qiyue Yang, Yang Zhang +4
Shanghai Jiao Tong University, Shanghai, China · Shanghai Innovation Institute, Shanghai, China