SafeCF–SSM: Certifying, Not Closing, the Physical–Latent Problem in Adaptive Latent-Space Control

SafeCF-SSM is a control-law-agnostic safety layer for latent-space MPC under distributional shift. It routes one predictive-mismatch signal to both the online adaptation rate and the per-channel safety margin, and turns the resulting physical-latent gap into a checkable realizability condition — certifying each constrained channel, or explicitly declaring it uncertifiable, rather than assuming the gap away.

---

What Is the Problem?

Latent-space MPC approaches adapt to distributional shift but certify safety in latent space only. When the decoder has approximation error \(\varepsilon_{\mathrm{dec}}\geq 0\), a plan admissible in \(z_t\) may still violate the constraint on \(x_t\) — the physical-latent problem. When the latent dimension \(k\) is below the number of safety-relevant physical channels \(n_s\), no decoder map \(\mathbb{R}^{n_s}\!\to\!\mathbb{R}^{k}\) can be injective, so some decoder error is structurally unavoidable; which channel absorbs it is a codec choice, not a training failure. SafeCF-SSM does not assume a better decoder closes this gap — it measures it, per channel, and checks whether it is small enough to certify.

Matters worsen under distributional shift: as the encoder \(\phi_{\vartheta_t}\) adapts online, the gap can grow without bound if representation reorganization is left unregulated. Existing approaches either assume the representation is frozen after training or bound decoder error with a global Lipschitz constant that is vacuous for a deep network of any size.

Three Coupled Mechanisms

SafeCF-SSM addresses the problem through three dedicated components, each satisfying one requirement of the problem statement:

• SSM Latent Model: provides latent state \(z_t\) and predictive uncertainty \(\Sigma_t\) via a trained nonlinear encoder–decoder pair and online belief filtering, enabling uncertainty-aware BMPC planning without a hand-specified observation model.
• BMPC with Adaptive Tightening: enforces physical safety via the unified margin \(\beta_{i,t}=\max\bigl(L_{g,i}\sigma_i\sqrt{2\mathcal{S}_{t-1}},\, L_{g,i}\,r_{i,t}(\delta_i)\bigr)+L_{g,i}\,\varepsilon_{\mathrm{dec},i}\), where \(r_{i,t}(\delta_i)\) is a calibrated confidence radius of the belief (Assumption 3) and \(\varepsilon_{\mathrm{dec},i}\) is the channel-wise decoder error (Assumption 4). No Lipschitz constant of the decoder appears — only of the constraint function \(\mathcal{G}_i\) — which is what makes the margin numerically evaluable. Together these give a checkable realizability condition: a channel is certifiable exactly when \(\varepsilon_{\mathrm{dec},i}+r_{i,t}(\delta_i) < b_i\); a channel that fails this test admits no certificate under the given codec, for any control law.
• Surprise-driven CF Adaptation: bounds encoder reorganization \(\|\phi_{\vartheta_{t+1}}-\phi_{\vartheta_t}\| \leq L_\phi\eta_{\max}L_\Delta=:\varepsilon_{\mathrm{cf}}\) via the surprise-gated step size \(\eta_t=\eta_{\max}/(1+\sqrt{\mathcal{S}_t})\); the same \(\mathcal{S}_t\) that widens \(\beta_{i,t}\) also shrinks the adaptation step, precisely when the model is least trustworthy.

The Dual Role of \(\mathcal{S}_t\)

The predictive surprise \(\mathcal{S}_t:=-\log p_{\vartheta_t}(z^{\mathrm{meas}}_{t+1}\mid z_t,u_t)\) is large when the latent transition model is mismatched with the newest measurement and small when consistent with it. The same signal \(\mathcal{S}_t\) that tightens \(\beta_{i,t}\) in the BMPC layer also moderates \(\eta_t=\eta_{\max}/(1+\sqrt{\mathcal{S}_t})\), bounding \(\|\phi_{\vartheta_{t+1}}-\phi_{\vartheta_t}\|\) so that the margin absorbs exactly the perturbation the update can induce — keeping the certificate valid while the representation continues to adapt, rather than shrinking the gap itself.

Main Theoretical Guarantees

• Theorem 1 (Surprise-Gated Parameter Drift — G1): \(\|\vartheta_{t+1}-\vartheta_t\|\leq\eta_{\max}L_\Delta/ (1+\sqrt{\mathcal{S}_t})\), with the induced model and encoder perturbation shrinking at the same rate. The uniform bound \(\mathrm{CFI}_t:=\|\phi_{\vartheta_{t+1}}-\phi_{\vartheta_t}\|/ \varepsilon_{\mathrm{cf}}\leq1\) follows as a corollary of the design choice \(\eta_{\max}\leq\varepsilon_{\mathrm{cf}}/(L_\phi L_\Delta)\), not as an independent guarantee — the substantive content is that the perturbation the safety margin must absorb shrinks precisely when the model is least trustworthy.
• Recursive feasibility & ISS: not claimed here as an original result. A receding-horizon instantiation of the certificate inherits these properties from standard robust-MPC arguments; SafeCF-SSM's own contribution and experiments concern the certificate/monitor layer itself, which is analyzed and validated directly.
• Proposition 1 + Corollaries 1–2 (Physical Safety & Realizability — G2): if \(\beta_{i,t}\geq L_{g,i}(r_{i,t}(\delta_i)+ \varepsilon_{\mathrm{dec},i})\) then \(\mathbb{P}(\mathcal{G}_i(x_{t+1},u_t)\leq0)\geq1-\delta_i\) (Prop. 1); for a box constraint this is achievable if and only if \(\varepsilon_{\mathrm{dec},i}+r_{i,t}(\delta_i) < b_i\) (Cor. 1, realizability) — a channel violating this bound admits no certificate under the given codec, irrespective of the control law. A probabilistic relaxation of the decoder-accuracy assumption (Cor. 2) gives \(\mathbb{P}\geq1-\delta_i-\alpha_i\), the version used in every reported experiment. This is a checkable, per-channel realizability condition that needs no Lipschitz constant of the decoder and holds while the representation continues to adapt.

Core Insight

Unlike prior latent-MPC work that establishes drift and feasibility guarantees in latent space only, assuming a fixed and exact representation, SafeCF-SSM does not assume the physical–latent gap can be closed. It makes the gap measurable through a per-channel realizability test that remains valid while the representation is re-identified online — certifying a channel, or explicitly declaring it uncertifiable, instead of assuming decoder accuracy away.

---

Simulation Study: 3D Quadrotor under Rotor Failure

Can SafeCF-SSM certify safety, and correctly refuse to certify it, when a rotor partially fails mid-flight?

The quadrotor is a controlled testbed, not a target application: the latent bottleneck \(k=6<n_s=8\) yields a measurable physical–latent problem, and the rotor fault a known distributional shift, isolating the phenomenon the theory addresses. A 3D quadrotor (\(n=12\) states, \(m=4\) inputs) undergoes rotor-1 efficiency loss \(\rho_t:1.0\to0.6\) at \(t_s=35\,\text{s}\), inducing yaw-torque asymmetry and lateral drift; from \(t=150\,\text{s}\) the altitude reference also descends \(2.0\to0.8\,\text{m}\) over \(30\,\text{s}\) and is then held, so the certificate must survive a commanded manoeuvre, not just a fixed set-point. The dynamics are: \[ \dot{v} = \tfrac{1}{M}R(\phi,\theta,\psi) \begin{bmatrix}0\\0\\T_t\end{bmatrix}\!-ge_3, \qquad \dot{\omega} = J^{-1}(\tau - \omega\times J\omega), \] where \(T_t=\rho_t T_1+T_2+T_3+T_4\) and \(\tau=[\ell(T_2-T_4),\,\ell(T_3-\rho_t T_1),\, c_\tau(\rho_t T_1-T_2+T_3-T_4)]^\top\). The safety-relevant channels are \(s_t=[p_z,\phi,\theta,v_x,v_y,v_z,p,q]^\top\) (\(n_s=8\)); \(p_x,p_y,\psi,r\) are unconstrained and handled by the standard cascade outer loop. SafeCF-SSM identifies \(\hat\rho_t\) online via the generic update rule \[ \hat\vartheta_{t+1} = (1-\eta_t)\hat\vartheta_t + \eta_t\hat\vartheta_t^\star, \quad \hat\vartheta_t^\star\in\arg\min_\vartheta \bigl\|z^{\mathrm{meas}}_{t+1}-f_\vartheta(z_t,u_t)\bigr\|^2, \quad \eta_t = \frac{\eta_{\max}}{1+\sqrt{\mathcal{S}_t}}, \] with safety enforced via the adaptive margin \(\beta_{i,t}\) above.

Parameter	Value	Parameter	Value
\(M\)	\(1.0\,\text{kg}\)	\(\ell\)	\(0.2\,\text{m}\)
\(I_{xx},I_{yy}\)	\(0.01\,\text{kg\,m}^2\)	\(c_\tau\)	\(0.1\)
\(I_{zz}\)	\(0.02\,\text{kg\,m}^2\)	\(\rho_1\to\rho_2\)	\(1.0\to0.6\) at \(t_s=35\,\text{s}\)
\(\sigma_w,\sigma_v\)	\(0.05,\,0.10\)	Encoder/decoder	\(k=6<n_s=8<n=12\)
Safety: \(p_z\)	\(\geq0.3\,\text{m}\)	Safety: \(|p_z-p_z^{\rm ref}|\)	\(\leq0.25\,\text{m}\)
Safety: \(|\phi|\)	\(\leq15^\circ\)	Safety: \(|\theta|\)	\(\leq20^\circ\)

The encoder, decoder, and \(\rho\)-aware transition map are trained feedforward networks (\(8\to96\to64\to6\), \(6\to64\to96\to8\), \(11\to96\to64\to6\); \(\tanh\), residual transition), trained jointly on \(7\times10^4\) transitions with a reconstruction loss weighted toward the constrained channels — not an EKF or a hand-designed observer.

Across \(10\) seeds (\(205\,\text{s}\) horizon), SafeCF-SSM holds \(99.5\%\) of post-failure steps inside the certified safe set versus \(46.6\%\) for a fixed-model predictive safety-filter (PSF) baseline, blind to the fault — its worst seed beats PSF's best seed. During the \(2\,\text{s}\) detection window immediately after the fault, SafeCF-SSM is briefly worse than PSF (\(52.5\%\) vs.\ \(77.5\%\)): no causal law can react before an innovation reveals the fault, and that window is exactly the interval the surprise-gated margin is built to cover — \(\mathcal{S}_t\) peaks there, so the margin is widest precisely when it is needed. After detection the two diverge sharply: \(99.6\%\) vs.\ \(47.3\%\). Throughout, \(\mathrm{CFI}_t\leq1\) holds for every run (observed max \(0.138\)), and the true efficiency loss \(\rho=0.6\) is recovered from latent innovations alone (\(\rho^\star=0.600\)), converging within \(5\,\text{s}\) and holding \(0.58\)–\(0.62\) through the commanded descent.

The same test also produces a negative result: under this codec, the altitude channel fails the realizability condition — its belief radius (\(0.31\,\text{m}\)) alone exceeds the residual corridor (\(0.06\,\text{m}\)) left after decoder-error tightening — and is declared uncertifiable for any control law, not merely for BMPC. Attitude (roll, pitch) remains certifiable, though conservatively (\(|\hat\theta|\leq13.2^\circ\) against the \(20^\circ\) specification), the price of \(k<n_s\). This is the kind of conclusion a purely empirical controller comparison cannot produce.

Property / Metric	Result
Genuine latent bottleneck, \(k<n_s\)	\(6 < 8\) ✓
False certificates, \(\theta\,/\,\phi\,/\,p_z\) (before → after tightening)	\(17\to7\)\,/\,\(30\to1\)\,/\,\(67\to2\) ✓
Residual rate vs.\ budget \(\alpha_i\)	\(\leq1.7\times10^{-4}\) vs.\ \(10^{-2}\) ✓
Certifiable channel	\(\theta,\phi\) ✓;  \(p_z\) ✗ (empty set)
\(\rho\) identified from latent innovations	\(\arg\min=0.600\) ✓
Post-failure occupancy, SafeCF–SSM vs.\ PSF	\(99.5\%\) vs.\ \(46.6\%\)
Detection transient / sustained, SafeCF–SSM	\(52.5\%\) / \(99.6\%\)
Detection transient / sustained, PSF	\(77.5\%\) / \(47.3\%\)

Full per-channel breakdown, enforcement ablation, and the conservatism–authority trade-off across \(\alpha_i\) are reported in the manuscript (Table I).

Reproducibility

Julia source code for the quadrotor benchmark is publicly available:

• safecf_ssm_quad3d_[150526].jl — 3D quadrotor benchmark (\(n=12\) states, \(k=6<n_s=8\), partial rotor failure, Figs. 2–4, Table I)

---