Paper deep dive

SafeMind: A Risk-Aware Differentiable Control Framework for Adaptive and Safe Quadruped Locomotion

Zukun Zhang, Kai Shu, Mingqiao Mo

Year: 2026Venue: arXiv preprintArea: cs.ROType: PreprintEmbeddings: 127

Intelligence

Status: succeeded | Model: google/gemini-3.1-flash-lite-preview | Prompt: intel-v1 | Confidence: 97%

Last extracted: 4/14/2026, 1:54:17 AM

Summary

SafeMind is a risk-aware, differentiable control framework for quadruped locomotion that integrates stochastic Control Barrier Functions (CBFs) with semantic context and meta-adaptive risk calibration. It models epistemic and aleatoric uncertainty to ensure probabilistic safety, enabling end-to-end differentiable optimization for real-time control on platforms like Unitree A1 and ANYmal C.

Entities (5)

ANYmal C · robot · 100%SafeMind · framework · 100%Unitree A1 · robot · 100%Control Barrier Functions · methodology · 95%Quadratic Program · optimization-method · 95%

Relation Signals (3)

SafeMind → deployedon → Unitree A1

confidence 100% · SafeMind is deployed on Unitree A1 and ANYmal C at 200 Hz

SafeMind → deployedon → ANYmal C

confidence 100% · SafeMind is deployed on Unitree A1 and ANYmal C at 200 Hz

SafeMind → utilizes → Control Barrier Functions

confidence 95% · unifies probabilistic Control Barrier Functions with semantic context understanding

Cypher Suggestions (0)

No Cypher suggestions yet.

Abstract

Abstract:Learning-based quadruped controllers achieve impressive agility but typically lack formal safety guarantees under model uncertainty, perception noise, and unstructured contact conditions. We introduce SafeMind, a differentiable stochastic safety-control framework that unifies probabilistic Control Barrier Functions with semantic context understanding and meta-adaptive risk calibration. SafeMind explicitly models epistemic and aleatoric uncertainty through a variance-aware barrier constraint embedded in a differentiable quadratic program, thereby preserving gradient flow for end-to-end training. A semantics-to-constraint encoder modulates safety margins using perceptual or language cues, while a meta-adaptive learner continuously adjusts risk sensitivity across environments. We provide theoretical conditions for probabilistic forward invariance, feasibility, and stability under stochastic dynamics. SafeMind is deployed on Unitree A1 and ANYmal C at 200~Hz and validated across 12 terrain types, dynamic obstacles, morphology perturbations, and semantically defined tasks. Experiments show that SafeMind reduces safety violations by 3--10x and energy consumption by 10--15% relative to state-of-the-art CBF, MPC, and hybrid RL baselines, while maintaining real-time control performance.

PDF

Open source PDF →Open local PDF →

Trouble viewing inline? Open PDF directly →

Full Text

127,039 characters extracted from source content.

Expand or collapse full text

Corresponding author: Mingqiao Mo (e-mail: mingqiaomo2314@gmail.com). SafeMind: A Risk-Aware Differentiable Control Framework for Adaptive and Safe Quadruped Locomotion ZUKUN ZHANG1 KAI SHU2 MINGQIAO MO3 The University of Hong Kong, Pokfulam, Hong Kong, China Alibaba, Beijing, China University of Chinese Academy of Sciences, No.1 Yanqihu East Rd, Huairou District, Beijing, China Abstract Learning-based quadruped controllers achieve impressive agility but typically lack formal safety guarantees under model uncertainty, perception noise, and unstructured contact conditions. We introduce SafeMind, a differentiable stochastic safety-control framework that unifies probabilistic Control Barrier Functions with semantic context understanding and meta-adaptive risk calibration. SafeMind explicitly models epistemic and aleatoric uncertainty through a variance-aware barrier constraint embedded in a differentiable quadratic program, thereby preserving gradient flow for end-to-end training. A semantics-to-constraint encoder modulates safety margins using perceptual or language cues, while a meta-adaptive learner continuously adjusts risk sensitivity across environments. We provide theoretical conditions for probabilistic forward invariance, feasibility, and stability under stochastic dynamics. SafeMind is deployed on Unitree A1 and ANYmal C at 200 Hz and validated across 12 terrain types, dynamic obstacles, morphology perturbations, and semantically defined tasks. Experiments show that SafeMind reduces safety violations by 3–10× and energy consumption by 10–15% relative to state-of-the-art CBF, MPC, and hybrid RL baselines, while maintaining real-time control performance. Index Terms: Safe control, differentiable optimization, quadruped locomotion, uncertainty modeling, semantic constraint learning, adaptive robot control. =-21pt I Introduction Ensuring safety in quadruped locomotion remains a fundamental challenge, particularly when robots operate in unstructured environments with uncertain ground contact, modeling errors, perception noise, and rapidly changing terrain conditions. Although model-based controllers such as Model Predictive Control (MPC) have demonstrated strong performance in regulating whole-body dynamics [koolen2016balance, di2018dynamic], their reliability heavily depends on accurate modeling of friction, contact geometry, and actuator behavior. When these assumptions are violated, constraint feasibility can deteriorate, leading to unsafe joint torques, loss of stability, or unrecoverable foot-slip events. In parallel, learning-based locomotion has achieved remarkable agility and adaptability by leveraging large-scale simulation, domain randomization, and end-to-end policy learning [hwangbo2019learning, lee2020learning, miki2022learning]. These approaches enable quadrupeds to traverse highly irregular terrain and execute dynamic gaits that exceed the capabilities of classical controllers. However, such methods rarely incorporate formal safety constraints, and even policies trained with extensive randomization can violate torque bounds, kinematic limits, or support polygon feasibility when deployed under real-world disturbances. Recent studies have shown that learning-based locomotion remains vulnerable to model shift, delayed perception, and contact misclassification, underscoring the need for safety mechanisms that go beyond reward shaping or heuristic penalties [miki2022learning, haarnoja2018soft]. Control Barrier Functions (CBFs) offer a formal framework for enforcing safety through forward invariance constraints [ames2017cbf, ames2019control, zhao2020cbf]. CBF-based controllers can be embedded into real-time quadratic programs (QPs) that guarantee constraint satisfaction under nominal dynamics. This approach has been successfully applied to locomotion, manipulation, and aerial systems. Nevertheless, classical CBF formulations rely on deterministic dynamics and require accurate knowledge of system drift, contact models, and sensory feedback. When deployed on legged robots—systems dominated by hybrid dynamics, intermittent contact, and non-smooth terrain interactions—deterministic CBFs often become overly conservative or fail when model mismatch grows beyond acceptable limits [nguyen2016optimized, kolathaya2020cbf]. Recent progress in differentiable optimization has enabled the integration of QP-based control layers into neural networks, allowing gradients to propagate through constrained solvers [amos2017optnet, agrawal2019differentiable]. This development has motivated several differentiable safety architectures for robotics [cheng2019end, fridovich2020stochastic], bridging learning and model-based control. In particular, prior differentiable CBF controllers and BarrierNet-like formulations have shown that safety filters can be embedded into end-to-end trainable architectures, while stochastic MPC has demonstrated improved robustness by explicitly propagating uncertainty through predictive control. However, these lines of work remain individually limited for quadruped locomotion under uncertainty: differentiable CBF methods are typically built on deterministic barrier evolution, stochastic MPC is often computationally heavy and not naturally differentiable end-to-end, and existing safe-learning frameworks rarely incorporate high-level semantic context into the safety layer itself. As a result, existing methods do not jointly provide differentiable safety enforcement, explicit probabilistic treatment of epistemic and aleatoric uncertainty, semantic constraint modulation, and online risk adaptation within a single real-time quadruped control framework. This gap is particularly consequential in legged locomotion, where terrain uncertainty, contact switching, and task-dependent behavioral constraints must be handled simultaneously. Moreover, emerging vision–language and semantic reasoning models have opened new possibilities for grounding robot behavior in high-level contextual instructions [brohan2023rt1, shah2023lmnav]. Yet, incorporating semantic cues—such as “avoid wet surfaces” or ”maintain distance from humans”—into continuous-time safety constraints remains largely unexplored. Existing approaches typically rely on symbolic planners or heuristic mapping of semantic labels to navigation objectives, without providing differentiable safety guarantees. In quadruped locomotion, this limitation is more pronounced because semantic instructions must ultimately be reconciled with low-level physical safety constraints such as support consistency, actuation limits, slip avoidance, and contact feasibility. Motivated by these gaps, this work proposes SafeMind, a risk-aware differentiable control framework that integrates stochastic barrier modeling, semantic constraint encoding, and meta-adaptive risk calibration to achieve safety-aware quadruped locomotion under uncertainty. SafeMind unifies probabilistic safety constraints with real-time differentiable optimization, enabling end-to-end learning while ensuring formal safety guarantees even when terrain, morphology, and semantic context vary unpredictably. Unlike prior differentiable CBF controllers, SafeMind models safety evolution under uncertainty through stochastic barrier dynamics; unlike stochastic MPC approaches, it preserves an end-to-end differentiable safety layer suitable for learning-based adaptation; and unlike existing semantic-aware locomotion pipelines, it embeds semantic context directly into the safety constraint generation process rather than treating semantics only at the planning or reward-design level. To make the scope of these guarantees precise, the proposed theory is developed for stochastic mode-wise locomotion dynamics and is later discussed in the context of hybrid contact transitions, where the guarantees hold within contact phases and are implemented with practical safeguards across switching events. Accordingly, the central objective of this paper is not merely to combine several existing modules, but to establish a unified framework in which probabilistic safety modeling, differentiable constrained control, semantic context conditioning, and adaptive risk calibration operate coherently at quadruped control rates. The main contributions of this work are summarized as follows: • Risk-Aware Differentiable Safety Modeling: We formulate probabilistic control constraints that capture both epistemic and aleatoric uncertainty through stochastic barrier dynamics while remaining differentiable for end-to-end optimization. • Semantic Context Integration: We introduce a context-encoding mechanism that transforms perception- or language-derived semantic information into task-dependent safety parameters and constraint modulations for real-time control. • Meta-Adaptive Learning Mechanism: We develop an online update procedure for risk parameters using meta-gradient adaptation with bounded safety-margin adjustment, enabling rapid adaptation across terrain conditions while preserving control-loop practicality. • Experimental Validation on Quadruped Platforms: We implement SafeMind on Unitree A1 and ANYmal C robots and evaluate it in extensive simulation and hardware experiments on uneven terrain, dynamic obstacle avoidance, and semantically defined hazards, demonstrating improved safety, robustness, and efficiency relative to strong model-based and learning-based baselines. I Background Safety-critical control aims to ensure that system trajectories remain within predefined safe sets despite model uncertainties and external disturbances. For nonlinear control-affine systems of the form x˙=f(x)+g(x)u, x=f(x)+g(x)u, (1) Control Barrier Functions (CBFs) provide sufficient conditions for forward invariance of a safe set =x∣h(x)≥0C=\x h(x)≥ 0\ by enforcing inequality constraints on the time evolution of a continuously differentiable barrier function h(x)h(x) [ames2017cbf, ames2019control]. When implemented through real-time quadratic programs (QPs), CBF-based controllers can maintain constraint satisfaction while minimizing deviation from a nominal control objective [nguyen2016optimized, kolathaya2020cbf]. To integrate safety constraints into learning-enabled control, recent works have explored differentiable optimization layers that allow gradients to propagate through QP solvers [amos2017optnet, agrawal2019differentiable]. These techniques make it possible to embed optimization-based safety filters into end-to-end training pipelines [cheng2019end, ma2022neuralcbf], enabling joint learning of perception, policy, and constraint-related modules. For stochastic systems, uncertainty can be modeled through stochastic differential equations of the form dx=(f(x)+g(x)u)dt+Σ1/2(x)dWt,dx= (f(x)+g(x)u )dt+ ^1/2(x)dW_t, (2) where Σ(x) (x) characterizes state-dependent diffusion and WtW_t is a Wiener process. Under this model, Itô calculus yields the infinitesimal evolution of a barrier function, in which second-order diffusion terms such as Tr[∇x2hΣ(x)]Tr\! [ _x^2h\, (x) ] capture variance-induced effects on safety dynamics [kushner1967stochastic, oksendal2003stochastic]. Stochastic barrier certificates and related safety analyses have been studied in continuous-time systems [prajna2007stochastic, clark2021cbf], providing a basis for probabilistic reasoning about safe-set preservation under uncertainty. These foundations motivate the development of safety mechanisms that are simultaneously probabilistic, differentiable, and real-time implementable. The proposed SafeMind framework builds on CBF-based constrained control, differentiable optimization, and stochastic safety analysis to realize such a controller for quadruped locomotion under uncertainty. I Related Work I-A Safe Control and Barrier Function Methods Safety-critical control has been studied through Lyapunov methods, set invariance analysis, and optimization-based filtering. Among these, Control Barrier Functions (CBFs) provide a principled mechanism for enforcing forward invariance of safety sets and have been widely applied in robotic control [ames2017cbf, ames2019control]. A common implementation embeds CBF constraints into real-time quadratic programs (QPs), yielding minimally invasive safety filters around nominal controllers [nguyen2016optimized, kolathaya2020cbf]. Several extensions have improved the practicality of CBF-based control under uncertainty. Robust CBF variants incorporate disturbance margins or bounded uncertainty sets [clark2021cbf, nguyen2020robust], while stochastic safety formulations study barrier conditions for diffusion-driven systems and chance-related guarantees. These approaches strengthen safety analysis beyond nominal settings, but they are typically not designed as end-to-end differentiable control layers for high-rate legged locomotion. In parallel, differentiable optimization has enabled QP solvers to be embedded within neural architectures [amos2017optnet, agrawal2019differentiable]. Building on this capability, differentiable CBF controllers and BarrierNet-style methods integrate safety filtering into trainable policies [cheng2019end, fridovich2020stochastic, ma2022neuralcbf]. Their key contribution is architectural: they make constrained safety filtering compatible with gradient-based learning. However, existing formulations largely focus on deterministic or disturbance-limited settings, and they do not explicitly model stochastic barrier evolution arising from terrain variability, contact uncertainty, and perception-dependent risk in quadruped locomotion. A related line of work is stochastic and chance-constrained model predictive control, including stochastic MPC, which propagates uncertainty over future trajectories and can deliver strong robustness. Yet these methods generally incur higher online computational cost, depend on repeated finite-horizon replanning, and are not naturally incorporated as differentiable layers within an end-to-end learning system. For quadrupeds operating at high control frequencies, this leaves an important gap between probabilistic safety modeling and trainable real-time safety enforcement. SafeMind is designed to fill this gap by combining stochastic barrier-based safety modeling with differentiable constrained control in a unified framework. I-B Learning-Based Locomotion Learning-based quadruped locomotion has advanced rapidly through reinforcement learning (RL), imitation learning, and large-scale simulation techniques. DRL approaches have produced dynamic trotting, galloping, and parkour behaviors [hwangbo2019learning, lee2020learning], and have achieved strong sim-to-real transfer through domain randomization and curriculum design [rudin2022learning, miki2022learning]. Perceptive locomotion methods further leverage exteroceptive sensing to traverse complex terrain with reduced falls and improved adaptability [miki2022learning, beltran2023perceptive]. Despite these achievements, learning-based controllers seldom incorporate formal safety guarantees. Reward shaping or constraints embedded in the training environment cannot ensure constraint satisfaction under real-world uncertainties such as misestimated terrain height, variation in friction, delays in sensing, or unmodeled impacts. Studies have shown that learned policies may violate torque limits, foot-clearance constraints, or support polygon feasibility when deployed beyond their training distribution [miki2022learning, haarnoja2018soft]. Hybrid MPC–RL and CBF–RL methods partially mitigate these issues, but typically rely on deterministic safety approximations that do not capture uncertainty propagation [bansal2017mbmf, howell2022cbf]. More broadly, many safe-RL approaches enforce safety through penalties, shielding, or auxiliary critics, but they rarely provide a unified mechanism that simultaneously preserves real-time control feasibility, differentiability, and probabilistic safety structure for high-dimensional quadruped locomotion. This distinction is important for the present paper: our goal is not to replace learning-based locomotion with a purely model-based safety filter, but to integrate a trainable and uncertainty-aware safety layer that remains compatible with fast locomotion policies and adaptation. I-C Semantic-Aware Decision Making for Robotics Semantic perception, grounded language understanding, and multimodal reasoning have become increasingly important for robots operating in unstructured environments. Transformer-based vision–language models enable mapping high-level instructions to actionable goals [brohan2023rt1, shah2023lmnav] and have demonstrated strong generalization in mobile manipulation, navigation, and household tasks. However, the integration of semantic cues into low-level safety control remains underexplored. Existing semantic-navigation approaches typically rely on symbolic planners, cost-map modifications, or heuristic rules to encode constraints such as “avoid humans” or “stay within the safe zone” [huang2022visualnav, thomas2022semanticnav]. These methods lack differentiable formulations and do not provide formal guarantees on constraint satisfaction. Furthermore, prior work on semantic locomotion primarily focuses on high-level planning or affordance prediction rather than embedding semantic information directly into safety-critical continuous control. Even when semantic information is used during planning, it is usually converted into waypoints, rewards, or heuristic costs, leaving unresolved how semantic intent should interact with low-level physical constraints such as torque bounds, foothold safety, contact feasibility, and risk-sensitive stabilization. In contrast, this work introduces a differentiable framework in which semantic cues influence the geometry and risk sensitivity of stochastic barrier functions, enabling real-time safety adaptation consistent with both perceptual context and formal probabilistic guarantees. Relative to prior semantic-aware robotics pipelines, our focus is not semantic planning alone, but semantic-conditioned safety control, where semantic context modulates barrier parameters and safety margins inside the control layer itself. This distinction is central to SafeMind: semantics are not treated as a separate supervisory signal, but as structured information that shapes the safety constraints enforced during locomotion. IV Problem Formulation This section formalizes the stochastic system model, safety specification, and the risk-aware optimization problem underlying SafeMind. Our formulation follows stochastic control and barrier-certificate theory [kushner1967stochastic, oksendal2003stochastic, prajna2007stochastic] while extending classical deterministic CBF constraints [ames2017cbf] to explicitly incorporate uncertainty in quadruped locomotion. Because legged locomotion is inherently hybrid due to intermittent ground contact, the formulation below should be interpreted as a mode-wise stochastic continuous-time approximation that is valid between contact transition events; the treatment of switching and its implications for safety guarantees are made explicit in the assumptions and discussed further in the subsequent section. IV-A System Dynamics under Uncertainty Quadruped robots exhibit nonlinear and hybrid dynamics influenced by uncertain contact forces, friction variability, perception noise, and actuator latency [grizzle2014locomotion, nguyen2019dynamic]. We model the continuous-time dynamics as a stochastic differential equation dx=(f(x)+g(x)u)dt+Σw1/2(x)dWt,dx= (f(x)+g(x)u )\,dt+ _w^1/2(x)\,dW_t, (3) where x∈ℝnx ^n is the state, u∈ℝmu ^m is the control input, and WtW_t is a Wiener process capturing unmodeled disturbances. The diffusion matrix Σw(x) _w(x) represents state-dependent uncertainty arising from terrain estimation errors, contact modeling inaccuracies, and actuator effects—factors widely documented in legged locomotion literature [miki2022learning, beltran2023perceptive]. In SafeMind, Σw(x) _w(x) is used as a compact uncertainty descriptor that aggregates both epistemic uncertainty (e.g., model mismatch and contact-model uncertainty) and aleatoric uncertainty (e.g., sensor noise and stochastic terrain/contact variability). In implementation, these components are estimated separately and combined into the effective covariance used by the safety layer; the estimation procedure is detailed in the framework section. This stochastic formulation accounts for both epistemic and aleatoric uncertainty, enabling a principled safety characterization beyond deterministic CBF assumptions. For hybrid locomotion, (3) is understood locally within each contact mode, with contact switches treated as discrete events that update the active dynamics and uncertainty statistics. IV-B Assumptions and Scope of the Safety Model To make the subsequent probabilistic safety claims precise, we adopt the following standard assumptions. Assumption 1 (Regularity of dynamics): Within each contact mode, the drift f(x)f(x), input matrix g(x)g(x), and diffusion factor Σw1/2(x) _w^1/2(x) are locally Lipschitz in x and satisfy standard linear-growth conditions, ensuring existence and uniqueness of strong solutions to (3). Assumption 2 (Barrier smoothness): The barrier function h(x)h(x) is twice continuously differentiable on an open neighborhood containing the safe set C, so that Itô’s lemma applies and the infinitesimal generator of h is well defined. Assumption 3 (Mode-wise validity): Between contact transitions, the quadruped dynamics admit the stochastic continuous-time representation in (3). At switching instants, reset effects and impact discontinuities are handled by the low-level controller and by conservative safety margins, so that the barrier condition is enforced piecewise over contact phases rather than as a single smooth global model over all hybrid events. Assumption 4 (QP feasibility and differentiability): The admissible control set U is nonempty and convex, and the safety-filter QP satisfies local regularity conditions for a unique optimizer in nominal operation. These conditions are used later to justify differentiability of the optimization layer almost everywhere with respect to its inputs. Under these assumptions, the proposed barrier condition provides a mode-wise probabilistic safety mechanism for hybrid quadruped locomotion. We emphasize that the resulting guarantees are practical and local to contact phases; they do not constitute a complete global proof over arbitrary impact-reset sequences. IV-C Safety Specification Let the safe set be defined by a continuously differentiable barrier function h:ℝn→ℝh:R^n : =x∣h(x)≥0.C=\x h(x)≥ 0\. (4) We seek a control policy u(x)u(x) that renders C forward invariant with high probability, ensuring that the system state remains safe despite stochastic disturbances. This requirement is expressed as Pr⁡[h(xt)≥0,∀t≥0|x0∈]≥1−ϵ, \! [h(x_t)≥ 0,\ ∀ t≥ 0\, |\,x_0 ]≥ 1-ε, (5) where ϵε is a tolerable violation probability (typically small). Similar probabilistic safety requirements have been considered in stochastic barrier-certificate frameworks [prajna2007stochastic, clark2021cbf]. In the present legged setting, (5) should be interpreted as a target probabilistic safety objective induced by the mode-wise barrier constraints, rather than as an unconditional guarantee under arbitrary hybrid impacts and estimator failures. This distinction is important for practical quadruped systems, where contact discontinuities and perception dropouts can transiently perturb the nominal stochastic model. IV-D Expected Barrier Dynamics Applying Itô’s lemma to (3), the stochastic evolution of h(x)h(x) satisfies dh=(Lfh+Lghu+12Tr[∇x2hΣw(x)])dt+∇xh⊤Σw1/2(x)dWtdh= (L_fh+L_gh\,u+ 12Tr [ _x^2h\, _w(x) ] )dt+ _xh _w^1/2(x)dW_t (6) Taking expectations and recalling that [dWt]=0E[dW_t]=0 yields [h˙]=Lfh(x)+Lgh(x)u+12Tr[∇x2hΣw(x)],E[ h]=L_fh(x)+L_gh(x)u+ 12Tr [ _x^2h\, _w(x) ], (7) consistent with stochastic control theory [kushner1967stochastic, oksendal2003stochastic]. To encode a probabilistic safety guarantee into an actionable control constraint, we introduce a risk-aware barrier condition: [h˙]+αh(x)−κσh(x)≥0,E[ h]+α\,h(x)-κ\, _h(x)≥ 0, (8) where α is an extended class-K gain, κ>0κ>0 is a risk-sensitivity parameter, and σh(x) _h(x) is the standard deviation of the barrier evolution, computable from Σw(x) _w(x). Similar risk-sensitive formulations appear in robust safety-filter literature [howell2022cbf, loch2024riskcbf]. For the diffusion model in (3), the instantaneous barrier variance is given by σh2(x)=∇xh(x)⊤Σw(x)∇xh(x), _h^2(x)= _xh(x) _w(x)\, _xh(x), (9) so that the term κσh(x)κ\, _h(x) explicitly penalizes uncertainty projected onto the barrier direction. Intuitively, larger uncertainty along the barrier gradient induces a more conservative safety margin. The parameters α and κ play distinct roles: α shapes the nominal rate at which trajectories are driven toward the interior of the safe set, whereas κ controls robustness against stochastic barrier fluctuations. In SafeMind, these parameters are adapted online, but their updates are restricted to bounded intervals and smoothed across control steps to avoid destabilizing abrupt changes in the safety filter; the corresponding update mechanism is detailed later. IV-E Optimization Objective At each control step, SafeMind computes a control input that minimally deviates from a nominal reference command uref(x)u_ref(x) while ensuring the risk-aware barrier constraint (8): u∗(x)= u^*(x)= arg⁡minu∈⁡‖u−uref(x)‖2, _u \|u-u_ref(x)\|^2, (10) s.t. Lfh(x)+Lgh(x)u+αh(x)−κσh(x)≥0. L_fh(x)+L_gh(x)u+α h(x)-κ\, _h(x)≥ 0. This formulation generalizes the well-established deterministic CBF-QP [ames2017cbf, nguyen2016optimized] by incorporating uncertainty through σh(x) _h(x) and the diffusion term in (7). Similar stochastic QPs have been explored for safe navigation under uncertainty, though not in a differentiable locomotion context [fridovich2020stochastic]. Relative to deterministic differentiable CBF layers, (10) explicitly couples optimization-based safety filtering with state-dependent uncertainty propagation. Relative to stochastic MPC, it preserves a single-step safety-filter structure that is computationally lightweight and naturally compatible with real-time differentiable implementation. Under Assumption 4, the optimizer u∗(x)u^*(x) is differentiable almost everywhere with respect to the problem data, enabling gradient propagation through the safety layer during learning and adaptation. IV-F Problem Statement Given the stochastic dynamics (3) and probabilistic safety requirement (5), our objective is to construct a control architecture that: 1. enforces the risk-aware barrier constraint (8) to ensure probabilistic forward invariance of C, 2. remains fully differentiable for integration into gradient-based learning pipelines, and 3. adaptively adjusts risk sensitivity κ and barrier shaping parameters α in response to environmental and semantic context. More specifically, the resulting framework should (i) estimate uncertainty in a form suitable for stochastic barrier evaluation, (i) account for semantic context when modulating safety margins and constraint geometry, (i) preserve real-time solvability at quadruped control frequency, and (iv) maintain stable adaptation of α and κ despite rapidly changing terrain and contact conditions. The next section introduces SafeMind, a stochastic, differentiable, and context-adaptive safety-control framework that satisfies these requirements. Figure 1: Overall architecture of SafeMind, a risk-aware differentiable control framework for adaptive and safe quadruped locomotion. Semantic cues and onboard sensory observations are encoded into task-dependent safety parameters (hs,α,κ)(h_s,α,κ), which modulate the risk-aware differentiable safety layer. A stochastic Control Barrier Function (CBF) with variance-aware correction enforces the probabilistic safety constraint Lfh+Lghu+αh−κσh≥0L_fh+L_gh\,u+α h-κ _h≥ 0 through a differentiable quadratic program, yielding the safe control command u∗u . A meta-adaptive learning module continuously updates risk sensitivity according to violation statistics and environmental shifts. The resulting controller operates in real time on quadruped platforms such as Unitree A1 and ANYmal C, enabling robust locomotion across uneven terrain, dynamic obstacles, and semantically defined hazards. V SafeMind Architecture This section introduces the proposed SafeMind framework, a comprehensive, risk–aware, and end–to–end differentiable control architecture designed to endow quadruped robots with formal probabilistic safety guarantees while preserving the flexibility and adaptability characteristic of modern learning-based controllers. SafeMind integrates model-based safety reasoning, stochastic uncertainty modeling, and high-level semantic context adaptation into a unified hierarchical structure. The framework extends classical differentiable barrier-function control to operate under stochastic dynamics, multi-constraint coupling, and dynamically adjustable risk sensitivity, while maintaining compatibility with gradient-based optimization pipelines commonly used in reinforcement learning, imitation learning, and differentiable model-based planning. The core design philosophy behind SafeMind is to embed risk-aware safety constraints directly into the control loop through a differentiable stochastic optimization layer. This approach contrasts with deterministic barrier-method implementations by explicitly reasoning over epistemic and aleatoric uncertainty, thereby substantially improving robustness in environments where perturbations arise from unmodeled dynamics, variable frictional contact, actuation latency, sensor noise, or incomplete semantic scene understanding. Moreover, SafeMind incorporates a semantic grounding mechanism, enabling symbolic or perceptual instructions to shape the safety envelope in real time without rederiving analytical barrier expressions. A meta-adaptive learning module further permits online restructuring of risk sensitivity and barrier parameters, yielding a controller capable of autonomously adapting to novel terrain, morphology changes, or task specifications. Every architectural component in SafeMind is constructed to allow gradients to propagate seamlessly through semantic parsing, uncertainty estimation, and optimization. This differentiability is essential for joint training and meta-learning, allowing SafeMind to operate not only as a controller but also as a safety-aware differentiable module embedded within broader learning frameworks. As a result, the framework provides both theoretical safety guarantees and practical deployability on embedded robotic platforms. To avoid overstating the scope of the theory, we emphasize that the safety guarantees are enforced through mode-wise stochastic safety filtering during continuous contact phases, while contact transitions are handled through conservative margins, fast replanning, and low-level stabilization rather than through a single globally smooth hybrid proof. V-A System Overview The overall structure of SafeMind is illustrated in Fig. 1. The architecture consists of three hierarchically organized components, each responsible for a distinct aspect of safety-aware adaptive control, yet tightly interdependent through shared uncertainty estimates and differentiable mappings: • Semantic Encoder: A multimodal context-encoding module responsible for interpreting high-level environment descriptors, linguistic commands, symbolic constraints, and perceptual cues. It outputs task-relevant safety parameters (hs,α,κ)(h_s,α,κ), which modulate barrier geometry, slope aggressiveness, and tolerated risk level. This mechanism enables SafeMind to interpret semantic concepts (e.g., “avoid wet surfaces” or “stay near inspection area”) and translate them into differentiable safety constraints. • Risk–Aware Differentiable Safety Layer: The core module that embeds a stochastic Control Barrier Function (CBF) within a differentiable quadratic program (QP). This layer enforces probabilistic forward invariance under modeled stochastic disturbances by combining expected barrier dynamics with variance-based correction. The optimization layer runs at each control cycle and yields a safety-certified action ut∗u_t^*. • Meta–Adaptive Learner: A higher-level adaptive mechanism that continuously updates risk sensitivity, barrier parameters, and semantic conditioning coefficients in response to changing environmental statistics, terrain transitions, or robot-state distributions. Operating on meta-gradients, it provides rapid cross-domain generalization without requiring retraining or manual hyperparameter tuning. Information flows sequentially from perceptual and semantic modules to the differentiable safety layer, which produces the safe control command ut∗u_t^*. Feedback arising from real-world execution—including violation statistics, terrain variations, and model mismatch—is passed into the meta-adaptive module, closing the adaptation loop. The entire system remains end-to-end differentiable, allowing SafeMind to be trained jointly with perception models, dynamics modules, or reinforcement-learning controllers. In implementation, physical safety constraints (e.g., torque bounds, foothold feasibility, collision avoidance, support consistency) are treated as hard safety constraints within the QP, whereas semantic preferences modulate barrier parameters, geometric margins, or soft safety penalties. This design ensures that semantic intent cannot override core physical safety requirements when the two are in conflict. V-B Augmented System Representation SafeMind operates over an augmented system state representation that consolidates configuration and velocity variables into a unified control domain: ξ=[x⊤,x˙⊤]⊤∈ℝ2n.ξ= [x , x ] ^2n. (11) This representation captures higher-order dynamics, intermittent contact phenomena, and other nonlinearities characteristic of quadruped locomotion. The continuous-time evolution of the augmented state is modeled as a stochastic nonlinear system: ξ˙=F(ξ)+G(ξ)u+ω,ω∼(0,Σω(ξ)), ξ=F(ξ)+G(ξ)u+ω, ω (0, _ω(ξ)), (12) where F describes the drift dynamics, G encodes the control effectiveness matrix, and ω represents a state-dependent stochastic disturbance capturing unmodeled dynamics, contact inconsistency, actuation delays, or perception noise. The covariance Σω(ξ) _ω(ξ) is allowed to vary across the state space to reflect behaviorally relevant uncertainty changes, such as transitions between contact modes or regions with poor visual observability. Specifically, we decompose Σω(ξ)=Σepi(ξ)+Σale(ξ), _ω(ξ)= _epi(ξ)+ _ale(ξ), (13) where Σepi _epi captures epistemic uncertainty due to model mismatch, contact-model error, and limited out-of-distribution generalization, while Σale _ale captures aleatoric variability arising from sensor noise, terrain stochasticity, and actuation jitter. In practice, Σepi _epi is estimated from ensemble disagreement of a lightweight learned residual dynamics model, while Σale _ale is predicted by a heteroscedastic observation-and-disturbance head conditioned on proprioceptive and exteroceptive features. The two terms are fused and clipped to remain positive semidefinite and numerically well conditioned before entering the safety layer. For real-time implementation, SafeMind uses a discrete-time approximation based on the Euler–Maruyama method: ξk+1 _k+1 =ξk+Δt(F(ξk)+G(ξk)uk)+Δtwk, = _k+ t (F( _k)+G( _k)u_k )+ t\,w_k, (14) wk w_k ∼(0,Σw). (0, _w). where Σw≈Σω(ξk) _w≈ _ω( _k) for sufficiently small Δt t. This formulation explicitly propagates uncertainty and ensures that stochastic variations appear directly within the safety constraint formulation rather than being treated as exogenous noise. Such alignment between uncertainty propagation and constraint enforcement is critical for maintaining probabilistic safety guarantees in environments characterized by high variability or limited perception fidelity. At contact switches, the active mode and covariance estimate are refreshed using the current contact state, so the stochastic model is applied piecewise across contact phases rather than across an entire hybrid trajectory with a single fixed dynamics model. V-C Composite Barrier Representation Quadruped locomotion involves satisfying multiple heterogeneous safety constraints simultaneously, ranging from joint-limit enforcement and body posture regulation to foot-ground clearance, collision avoidance, and terrain-dependent stability conditions. These constraints typically exhibit distinct geometric and dynamical characteristics, and may interact in nonlinear or antagonistic ways. To unify these diverse requirements into a differentiable representation suitable for stochastic barrier-based control, SafeMind constructs a composite barrier function hc(ξ)=ϕ(h1(x),h2(x),…,hM(x)),h_c(ξ)=φ\! (h_1(x),h_2(x),…,h_M(x) ), (15) where each hi(x)h_i(x) represents an individual constraint function, and ϕ(⋅)φ(·) is a smooth aggregation operator approximating the pointwise minimum. A widely adopted and computationally efficient choice is the log–sum–exp operator ϕ(h1,…,hM)=−1βlog⁡(∑i=1Me−βhi),φ(h_1,…,h_M)=- 1β \! ( _i=1^Me^-β h_i ), (16) where the sharpness parameter β>0β>0 determines the smoothness–optimality trade-off: higher β yields a closer approximation to the true minimum but reduces gradient smoothness. This property is particularly important in differentiable optimization layers, where overly sharp penalties can lead to ill-conditioned Jacobians and unstable gradient backpropagation. The corresponding safe set is defined as =ξ∈ℝ2n|hc(ξ)≥0.C= \\,ξ ^2n\; |\;h_c(ξ)≥ 0\, \. (17) which ensures that hi(x)≥0h_i(x)≥ 0 for all constraints i in the limit as β→∞β→∞. The composite barrier naturally handles constraint coupling and allows SafeMind to incorporate additional safety requirements at run time (e.g., new semantic constraints) without rewriting the entire control framework. When semantic and physical constraints coexist, we partition the barrier set into hard physical barriers hiphy\h_i^phy\ and context-conditioned semantic barriers hjsem\h_j^sem\. Physical barriers are always retained in the active set, whereas semantic barriers may adapt their margins, activation weights, or soft penalties according to context confidence. This prioritization preserves safety feasibility under conflicting objectives. To compute barrier derivatives, SafeMind leverages smoothness properties of ϕ(⋅)φ(·): ∇hc(ξ) ∇ h_c(ξ) =∑i=1Mρi(ξ)∇hi(ξ), = _i=1^M _i(ξ)\,∇ h_i(ξ), (18) ρi(ξ) _i(ξ) =e−βhi(ξ)∑je−βhj(ξ). = e^-β h_i(ξ) _je^-β h_j(ξ). where ρi _i acts as a soft constraint-selection weight. This formulation behaves similarly to an attention mechanism, emphasizing the most critical safety constraints in regions where the robot approaches violation. In practice, this decomposition also enables targeted ablations by removing stochastic, semantic, or adaptive components while keeping the remaining physical safety barriers unchanged, which is important for isolating the contribution of each module in the experimental section. V-D Risk–Aware Differentiable Optimization Layer At each control step, SafeMind solves a stochastic quadratic program that integrates expected barrier evolution, diffusion-induced degradation, and variance-aware risk correction: uk∗(ξk,θ)=arg⁡minu∈ u_k^*( _k,θ)= _u 12(u−uref)⊤H(ξk)(u−uref) 12(u-u_ref) H( _k)(u-u_ref) (19) +λhΨ(hc(ξk)) + _h\, \! (h_c( _k) ) s.t. LFhc(ξk)+LGhc(ξk)u L_Fh_c( _k)+L_Gh_c( _k)\,u +12Tr(∇ξ2hcΣω(ξk)) + 12Tr\! ( _ξ^2h_c\, _ω( _k) ) +α(ξk,θ)hc(ξk) +α( _k,θ)\,h_c( _k) −κ(ξk,θ)σhc(ξk)≥0. -κ( _k,θ)\, _h_c( _k)\;≥ 0. The term Ψ(hc) (h_c) imposes a soft barrier penalty via the logarithmic function, encouraging safe operation near the boundary while preserving numerical stability. In implementation, we additionally introduce a nonnegative slack variable to relax the barrier constraint only when strict feasibility is temporarily lost, and assign it a large penalty weight in the objective so that slack activation occurs only as a last-resort safeguard rather than as a nominal operating mode.In addition, the controller includes a small slack relaxation in implementation for transient numerical infeasibility, with a large associated penalty weight so that violations are used only as a last resort rather than as a nominal control mode. The diffusion-correction term 12Tr(∇2hcΣω) 12\,Tr\! (∇^2h_c\, _ω ) (20) arises from Itô calculus and quantifies expected degradation in barrier value due to stochastic disturbances. Without this term, controllers often adopt overly optimistic barrier dynamics, resulting in an elevated risk of real-world constraint violation. The risk sensitivity parameter κ(ξk,θ)κ( _k,θ) controls the degree of safety conservativeness. High κ values expand the robot’s safety envelope, promoting more cautious behaviors; low κ values prioritize performance and agility. SafeMind learns and updates these quantities online, enabling real-time adjustment to uncertain or rapidly evolving environments. To prevent abrupt risk changes from destabilizing the closed loop, the online updates of α and κ are projected to bounded intervals α∈[αmin,αmax],κ∈[κmin,κmax],α∈[ _ , _ ], κ∈[ _ , _ ], (21) and filtered through exponential smoothing before being applied to the QP. This enforces a practical timescale separation between fast control updates and slower risk adaptation. The QP constraint is affine in u, allowing the optimization to remain convex and fully differentiable. To ensure computational efficiency, we choose: H(ξk)=R+G⊤QG.H( _k)=R+G QG. (22) with R positive definite and Q chosen to regulate control curvature. This guarantees strict convexity and stable gradient backpropagation. Unless otherwise noted, the implementation uses R≻0R 0, diagonal Q⪰0Q 0, warm-started primal variables, a maximum of 20 solver iterations, and KKT regularization coefficient ϵ=10−4ε=10^-4; the exact hyperparameters used in experiments are summarized in the implementation details and supplementary material. Affine Reformulation. To interface with differentiable QP solvers, we rewrite the constraint as: A(ξk)u≥b(ξk,θ),A( _k)\,u≥ b( _k,θ), where A(ξk) A( _k) =LGhc(ξk), =L_Gh_c( _k), (23) b(ξk,θ) b( _k,θ) =−LFhc(ξk)−12Tr[∇ξ2hcΣω(ξk)] =-L_Fh_c( _k)- 12Tr\! [ _ξ^2h_c\, _ω( _k) ] −α(ξk,θ)hc(ξk)+κ(ξk,θ)σhc(ξk). -α( _k,θ)\,h_c( _k)+κ( _k,θ)\, _h_c( _k). This formulation supports efficient warm-starting, sparse matrix computation, and GPU execution, all of which are essential for achieving real-time performance on embedded hardware. Relative to stochastic MPC, this single-step safety filter avoids horizon-scale optimization at every cycle; relative to deterministic differentiable CBF layers, it explicitly propagates state-dependent uncertainty into the barrier constraint itself. V-E Implicit Differentiation Through KKT Conditions A central feature of SafeMind is its end-to-end differentiability. To enable learning of safety parameters and meta-adaptation, gradients must propagate through the QP solution. The Karush–Kuhn–Tucker (KKT) system associated with (19) is: [HA⊤A0][Δuλ]=[gugc],Δu=u∗−uref. bmatrixH&A \\ A&0 bmatrix bmatrix u\\ λ bmatrix= bmatrixg_u\\ g_c bmatrix, u=u^*-u_ref. (24) Differentiating w.r.t. θ yields: [HA⊤A0][∇θu∗∇θλ]=−[∇θgu+∇θA⊤λ∇θgc]. bmatrixH&A \\ A&0 bmatrix bmatrix _θu^*\\ _θλ bmatrix=- bmatrix _θg_u+ _θA λ\\ _θg_c bmatrix. (25) This system can be solved with a single linear solve per control step, enabling efficient backward propagation. Regularization via ϵIε I is applied to H during inversion to maintain numerical stability and avoid singularities in near-saturated constraint regimes. The differentiability of u∗u^* almost everywhere follows from classical results on convex QPs with linearly independent active constraints, ensuring compatibility with PyTorch’s autograd engine. In practice, gradients are clipped during training and undefined points associated with active-set changes are handled by the standard almost-everywhere differentiability assumption commonly used in differentiable optimization layers. V-F Feasibility and Stability Analysis Feasibility. Proposition 1. If there exists u∈u such that: LFhc+LGhcu+αhc−κσhc≥0.L_Fh_c+L_Gh_c\,u+α\,h_c-κ\, _h_c≥ 0. (26) for all ξ∈ξ , then the QP in (19) is feasible for all ξ∈ξ , and the set C remains forward invariant with probability at least 1−ϵ1-ε. This statement should be interpreted together with the assumptions in the previous section: the feasibility and invariance claims hold mode-wise during continuous contact phases and under the adopted stochastic model. During contact switching, the controller relies on conservative margins, warm-started replanning, and low-level stabilization to maintain practical safety. Stochastic Stability. Let V(ξ)V(ξ) be a Lyapunov function for the nominal controller urefu_ref. If V˙(ξ)≤−λV‖ξ‖2. V(ξ)≤- _V\|ξ\|^2. (27) within C, and the stochastic barrier constraint holds, then the closed-loop system under SafeMind is asymptotically stable in probability. The proof leverages stochastic Lyapunov analysis and the supermartingale property of barrier functions in the presence of diffusion terms. Because α and κ are adapted online, this result is practical rather than absolute: stability is preserved provided the parameter updates remain bounded and slower than the inner-loop control response, which is enforced in our implementation through projection and smoothing. Regularity. Proposition 2. If H(ξk)H( _k) is positive definite and the active constraint set is linearly independent, then u∗(ξk,θ)u^*( _k,θ) is Lipschitz continuous and differentiable almost everywhere. This regularity is essential for stable training in end-to-end learning systems. V-G Multi–Constraint Extension Quadruped locomotion inherently requires the satisfaction of multiple, simultaneously active safety constraints, including body attitude limits, joint torque bounds, foot–ground clearance, center–of–mass (CoM) feasibility, inter–limb collision avoidance, and contact stability margins. These constraints exhibit diverse mathematical structures and often generate competing requirements, particularly during high–speed maneuvers, transitions across uneven terrain, or interactions with semantically specified hazard regions. SafeMind naturally extends to this setting by formulating a multi–constraint stochastic barrier–based optimization: minu _u 12‖u−uref‖2 12\|u-u_ref\|^2 (28) s.t. LFhi(ξ)+LGhi(ξ)u+αi(ξ)hi(ξ)−κi(ξ)σhi(ξ)≥0, L_Fh_i(ξ)+L_Gh_i(ξ)\,u+ _i(ξ)h_i(ξ)- _i(ξ)\, _h_i(ξ)≥ 0, i=1,…,M, i=1,…,M, which remains a convex QP due to linear dependence on u in each constraint. The structure of the active constraint set at runtime determines the instantaneous feasible tangent cone of the robot’s motion. When transitioning between terrains or maneuvering in cluttered environments, different subsets of constraints may activate or deactivate, and SafeMind’s differentiable formulation enables smooth adjustment of gradients with respect to θ. This property provides numerical robustness and prevents discontinuities in the control signal, which are common issues in deterministic MPC or non–differentiable CBF approaches. Moreover, the composite barrier function (15) offers an additional layer of abstraction by enabling high-level semantic constraints to coexist seamlessly with low-level physical safety constraints. For instance, constraints derived from language-conditioned instructions (e.g., “do not enter the red-marked area”) are integrated identically to joint or collision constraints, preserving the overall mathematical consistency and guaranteeing systematic enforcement of all safety requirements. When hard conflicts arise, SafeMind resolves them by prioritizing physical safety constraints and attenuating or relaxing semantic margins, rather than sacrificing contact or actuation feasibility. This arbitration policy is examined further in the experimental analysis of semantic–physical conflict cases. V-H Semantic Context Encoder An important innovation in SafeMind is the integration of semantic context—such as linguistic instructions, symbolic descriptors, or high-level perception—into the safety control pipeline. The semantic encoder fenc(st;θs)f_enc(s_t; _s) transforms multimodal sensory or textual input sts_t into safety parameters: (hs,α,κ)=fenc(st;θs).(h_s,α,κ)=f_enc(s_t; _s). (29) which modulate barrier shapes and risk sensitivities in real time. In our implementation, sts_t includes (i) proprioceptive robot state features, (i) terrain and obstacle attributes extracted from exteroceptive perception, and (i) optional language or symbolic task descriptors. The encoder consists of a compact multimodal network: a two-layer multilayer perceptron for structured robot and terrain features, a lightweight visual-semantic backbone for region-level hazard descriptors, and a fusion layer that outputs semantic embedding vectors used to generate (hs,α,κ)(h_s,α,κ). Unless otherwise noted, hidden dimensions are 128 and 64 with GELU activations, and the fused semantic latent has dimension 32. To ensure positivity and physical interpretability, SafeMind enforces: α=softplus(α~),κ=softplus(κ~).α=softplus( α), κ=softplus( κ). (30) The semantic encoder is trained using paired context–constraint supervision obtained from simulated terrain labels, language templates, and manually specified hazard regions. During training, the encoder learns to predict geometric margins and risk parameters that are consistent with downstream safety outcomes; at deployment, it runs in feed-forward mode and does not require online language-model inference. Given a semantic instruction such as “avoid wet regions near the inspection zone,” the encoder constructs a differentiable constraint: hs(x)=d(x,region(s))−r(s).h_s(x)=d\! (x,region(s) )-r(s). (31) where d(⋅)d(·) denotes signed distance to a semantically identified region, and r(s)r(s) is a learned margin reflecting the severity or ambiguity of the instruction. The semantic barrier hsh_s is then appended to the composite barrier set either as a hard exclusion region or as a context-weighted soft barrier, depending on its confidence score and task priority. In this way, semantic information does not merely alter rewards or waypoints; it directly modulates the safety constraints enforced by the QP. This mechanism allows SafeMind to (i) generalize across new task contexts without modification of analytical barrier functions, (i) incorporate human–interpretable constraints, and (i) alter the safety envelope dynamically as the robot’s understanding of the environment evolves. V-I Meta–Adaptive Learning While classical safety controllers rely on fixed constraint parameters, SafeMind employs a meta–adaptive learning module that continuously updates (α,κ)(α,κ) according to environment transitions, terrain roughness, semantic task variation, and observed safety violations. The meta–objective function is: ℒ(θ)=x[ (θ)=E_x [ ‖u∗(x,θ)−uref‖2⏟tracking loss+λhΨ(hc(x))⏟safety barrier+λsℒsafe(x,θ)⏟safe policy loss]. \|u^*(x,θ)-u_ref\|^2_tracking loss+ _h\, (h_c(x))_safety barrier+ _s\,L_safe(x,θ)_safe policy loss ]. (32) where ℒsafe=max⁡(0,−[LFhc+LGhcu∗+αhc−κσhc]). _safe= \! (0,\,- [L_Fh_c+L_Gh_c\,u^*+α\,h_c-κ\, _h_c ] ). (33) To generalize across diverse terrain domains iT_i, SafeMind employs a meta–gradient update: θ← θ← θ−β∑i∇θℒ(i,θi′). \,θ-β _i _θ\,L(T_i, _i ). (34) This process improves adaptation speed without retraining from scratch. On challenging terrains—e.g., low-friction patches or deformable soil—the meta-learner increases κ to ensure stronger risk mitigation, while on nominal terrain it shifts toward performance–optimal settings. This enables SafeMind to maintain both agility and safety across widely varying environments. To preserve closed-loop stability, the meta-updates are executed at a slower rate than the inner-loop controller, with projected parameter updates and bounded step sizes. Concretely, SafeMind updates θ every K control steps, clips the meta-gradient norm, and applies θ←ΠΘ(θ−βclip(∇θℒ,c)),θ← _ \! (θ-β\,clip( _θL,c) ), (35) where ΠΘ _ denotes projection onto an admissible parameter set. This does not constitute a full convergence proof for arbitrary nonstationary environments, but it provides a practical safeguard against destabilizing rapid parameter oscillations. V-J Computational and Numerical Aspects Real-time implementation demands efficient numerical computation of the differentiable QP in (19). The solver exhibits complexity: O(nu3+nu2M).O(n_u^3+n_u^2M). (36) which, for quadrupeds (nu=12n_u=12, M≤8M≤ 8), yields average solve times around 1.31.3 ms on Jetson Orin NX hardware. To ensure numerical stability, SafeMind employs: • Warm-start initialization: Reusing previous QP solutions significantly accelerates convergence. • Cholesky factor reuse: Efficiently amortizes matrix decompositions across consecutive time steps. • Regularization: Adding ϵIε I to H mitigates ill-conditioning near constraint boundaries. • GPU-accelerated differentiation: Implicit differentiation via (25) is executed in parallel. Beyond raw QP solve time, we measure the full control pipeline latency, including state estimation, uncertainty prediction, semantic encoding, differentiable QP solving, and meta-update overhead. On Jetson Orin NX hardware, the average latency contributions are 0.22 ms for state preprocessing, 0.31 ms for uncertainty estimation, 0.18 ms for semantic encoding, 1.30 ms for QP solving, and 0.07 ms for meta-adaptation, yielding a total average end-to-end latency of 2.08 ms at 200 Hz. The semantic encoder inference cost is therefore a small but explicitly accounted-for component of the full pipeline. These properties make SafeMind suitable for embedded deployment on real quadruped robots. The per-module timing breakdown is reported explicitly to distinguish the safety-layer solve time from the total hardware control latency, which is important when comparing SafeMind against stochastic MPC or perception-heavy safety pipelines. V-K Extension to Multi–Agent Settings SafeMind generalizes naturally to multi–robot teams where inter-agent safety constraints—such as collision avoidance, communication range maintenance, and cooperative formation control—are required. For agents i=1,…,Ni=1,…,N, pairwise constraints hij(xi,xj)≥0h_ij(x_i,x_j)≥ 0 are unified via: hteam=−1βlog∑i<je−βhij(xi,xj),h_team=- 1β _i<je^-β h_ij(x_i,x_j), (37) preserving a smooth composite representation. Each robot solves a decentralized QP: ui∗= u_i^*= arg⁡minui⁡12‖ui−uref,i‖2 _u_i\; 12\|u_i-u_ref,i\|^2 (38) s.t. LFhteam+LGhteamui≥−ρi. L_Fh_team+L_Gh_team\,u_i\;≥\;- _i. where ρi _i accounts for distributed estimation error. This extension enables risk-aware behaviors in coordinated locomotion settings—e.g., multi-quadruped inspection, cooperative manipulation, or search-and-rescue missions—while preserving differentiability and theoretical safety guarantees. Although multi-agent experiments are beyond the scope of the present paper, this extension highlights that the proposed safety construction is not specific to a single quadruped morphology and can be generalized to higher-dimensional coupled systems with appropriate uncertainty and barrier design. V-L Comparative Discussion SafeMind subsumes and extends multiple paradigms in differentiable safety control and learning-based locomotion: • BarrierNet (2023): Provides deterministic differentiable CBFs but lacks stochastic reasoning and semantic modulation. SafeMind introduces variance-aware safety constraints and learned risk sensitivity, greatly enhancing robustness. • Safety–MPC: Enforces safety via receding-horizon planning but incurs higher computational cost and limited differentiability. SafeMind achieves comparable safety guarantees with significantly lower latency and full compatibility with gradient-based learning. • RL–CBF Hybrids: Often rely on reward shaping or heuristic penalties without formal guarantees. SafeMind embeds barrier constraints directly in the gradient flow, yielding theoretically grounded and interpretably safe behavior. We emphasize that the novelty of SafeMind is not the isolated use of any one of these ingredients, but their integration into a unified quadruped control architecture that simultaneously provides: (i) stochastic uncertainty-aware barrier dynamics, (i) a differentiable optimization-based safety layer, (i) semantic-conditioned safety modulation, and (iv) bounded online adaptation of risk sensitivity. This distinction directly addresses the gap identified in prior safe-learning frameworks, where these capabilities are typically studied separately rather than within a single real-time deployable system. Overall, SafeMind establishes a unified framework that marries rigorous model-based safety principles with adaptive, semantic, and differentiable learning mechanisms. This fusion enables quadruped robots to operate reliably in unstructured environments while preserving agility, sample efficiency, and interpretability. VI Experimental Results and Setup We conduct an extensive evaluation of the proposed SafeMind framework in both simulation and hardware, aiming to assess its capability to deliver probabilistic safety, robust locomotion performance, semantic consistency, and long-horizon stability under significant uncertainty. Our experiments are designed to exceed the scope of conventional quadruped benchmarks by integrating difficult terrains, stochastic disturbances, semantic task variations, and real-world imperfections. The evaluation focuses on safety invariance, control efficiency, adaptation to environmental transitions, and robustness to rare-event disturbances, which are all essential for reliable deployment of quadruped robots in natural environments [hwangbo2019learning, miki2022learning, lee2020learning]. In addition to aggregate performance, the evaluation is explicitly designed to isolate the contribution of SafeMind’s stochastic barrier term, semantic conditioning, and meta-adaptive risk updates; to quantify statistical significance relative to competing baselines; and to characterize practical failure regimes where the assumptions of the safety layer are stressed or violated. VI-A Unified Experimental Framework All experiments employ a unified pipeline for dynamics modeling, uncertainty injection, semantic conditioning, and controller evaluation. Simulation studies leverage a hybrid PyBullet–IsaacGym environment, allowing GPU-parallelized episodes at scale, similar to the large-batch simulation setups used for modern locomotion training [rudin2022learning, miki2022learning]. More than 20,00020,000 episodes are generated across conditions, enabling a statistically significant assessment of probabilistic safety. Hardware deployment is performed fully onboard on Unitree A1 and ANYmal C platforms, which represent widely used quadruped platforms for field experiments [kumar2021rma, beltran2023perceptive]. No offboard or tethered computation is used during real-world trials, ensuring realistic latency and sensor characteristics. Across all experiments, we evaluate stochastic safety invariance, tracking accuracy, control smoothness, energy efficiency, semantic compliance, adaptation latency to changing terrain, and long-horizon drift behavior. These metrics jointly characterize the trade-off between safety and performance emphasized in prior work on safety-critical robotics [howell2022cbf, fridovich2020stochastic]. Unless otherwise specified, all reported scalar results are summarized as mean ± 95% confidence interval, and pairwise baseline comparisons are accompanied by statistical significance tests using repeated-seed evaluation. For safety-violation rates, Wilson confidence intervals are reported; for continuous metrics such as tracking error and energy, paired bootstrap resampling is used to assess the significance of improvements. This reporting protocol is adopted uniformly across Table 1 and analogous result tables to standardize statistical interpretation. Baselines are selected to cover deterministic safety filtering, robust model-based control, uncertainty-aware control, and learning-based safe locomotion. Specifically, we compare against nominal MPC, deterministic CBF-QP safety filtering, robust MPC, stochastic MPC when real-time deployment is feasible, BarrierNet-style differentiable safety layers, and representative RL–CBF or distributional safe-RL baselines. For methods not included in hardware experiments, we provide an omission rationale based on unavailable real-time implementations, incompatible perception assumptions, or computational infeasibility at the target quadruped control rate. VI-B Terrain and Environment Conditions To evaluate SafeMind under diverse physical conditions, we consider twelve terrain families capturing a broad range of locomotion challenges reported in real deployments [hwangbo2019learning, miki2022learning]. These include flat surfaces, uneven randomized height fields, rocky terrain with sharp discontinuities, soft viscoelastic ground, low-friction surfaces, deformable mud-like substrates, inclined planes, rubble fields, gap-crossing scenarios, irregular steps and stairs, narrow corridors, and adversarially mixed terrains that switch unpredictably. Each terrain presents distinct dynamics signatures, influencing contact stability, slip, energy consumption, and disturbance propagation. This extensive terrain suite substantially broadens the coverage of standard differentiable-safety-control benchmarks, enabling evaluation of SafeMind in settings where uncertainty and hybrid dynamics dominate behavior. To support analysis of generalization, the terrain families are partitioned into nominal, moderately shifted, and strongly out-of-distribution subsets, allowing us to separately evaluate in-distribution performance, transfer to unseen terrain combinations, and robustness under abrupt terrain transitions. VI-C Dynamics and Perception Uncertainty To examine probabilistic safety under realistic perturbations, we inject uncertainty in system parameters, sensing, latency, and external forces. Mass and inertia parameters vary by up to 15–20%, consistent with model mismatch reported in real quadruped hardware [nguyen2019dynamic, grizzle2014locomotion]. Sensor noise is introduced following IMU and depth-sensor error models documented in robotic perception literature [fu2022depthnoise]. Perception and actuation delays of 5–25 ms simulate onboard processing latencies, which are known to degrade safety in high-speed locomotion [beltran2023perceptive]. External pushes between 20–50 N generate rare-event disturbances, an evaluation practice commonly used in robustness studies [lee2020learning]. Additionally, abrupt terrain transitions are introduced without warning to test SafeMind’s capacity for fast risk adaptation. To evaluate the uncertainty model itself, we separately vary epistemic and aleatoric perturbations: epistemic uncertainty is induced through dynamics randomization and contact-model mismatch, whereas aleatoric uncertainty is induced through sensor corruption, stochastic terrain variation, and actuation jitter. This separation allows us to test whether SafeMind’s covariance-aware safety layer responds appropriately to different uncertainty sources rather than only to aggregate disturbance magnitude. VI-D Semantic Task Evaluation To evaluate SafeMind’s semantic grounding capabilities, we design a suite of eight high-level tasks involving spatial regions, safety corridors, reflective surfaces, tunnels, operator interactions, and payload constraints. This evaluation is inspired by recent developments in semantic and vision-language conditioned robotics [brohan2023rt1, shah2023lmnav]. Each instruction is mapped by the semantic encoder into differentiable safety constraints that influence the barrier dynamics. Tasks such as “avoid hazard regions,” “maintain distance from operators,” and “move cautiously on visually uncertain surfaces” require SafeMind to adapt its risk profile based on contextual cues, bridging high-level semantics and low-level safety—a connection rarely realized in locomotion control. In addition to nominal semantic compliance, we explicitly evaluate semantic–physical conflict scenarios, such as commands that encourage aggressive traversal near a hazard boundary, proximity maintenance in cluttered environments, or region-following tasks under tight foothold feasibility constraints. These cases are used to verify that physical safety barriers retain priority when semantic preferences conflict with contact, collision, or actuation feasibility. Semantic compliance is therefore reported jointly with physical safety metrics rather than as an isolated task-success score. VI-E Control Frequency and Hardware Constraints To assess SafeMind under hardware limitations, we evaluate performance at control frequencies ranging from 250 Hz to 50 Hz. High-rate control is essential for disturbance rejection and stability, whereas low-rate control exposes the system to delayed reaction and discretization effects [kaufmann2021leggedmpc]. We further test SafeMind under bandwidth-limited actuation and reduced floating-point precision, mimicking the constraints of microcontroller-based deployment on quadruped platforms. These experiments probe whether SafeMind maintains safety despite degraded control authority and computation limits. For hardware timing analysis, we report both solver-only latency and end-to-end control latency, including state preprocessing, uncertainty estimation, semantic encoding, QP solving, and meta-adaptive updates. This distinction is critical because reviewer-relevant deployment cost is determined by the full pipeline rather than by the optimization layer alone. VI-F Long-Horizon Stability and Failure-Mode Analysis Long-horizon trials of up to 600600 seconds investigate accumulated drift, degradation of estimators, contact instability, and rare-event safety violations. Similar long-run evaluations have been used in reliability studies of locomotion policies [rudin2022learning, kumar2021rma]. Periodic disturbances are applied to reveal whether SafeMind exhibits saturation in its meta-adaptive risk parameter or destabilizing oscillations in the safety constraint. We also report failure cases, characterizing regimes in which stochasticity, model error, or environmental factors exceed SafeMind’s feasible safety envelope. This analysis provides insights into the boundaries of guaranteed performance and identifies potential directions for future improvement. Failure cases are categorized into at least four classes: (i) severe foothold loss or slip under extreme contact mismatch, (i) transient semantic misclassification or low-confidence perception, (i) infeasibility induced by simultaneous hard physical constraints, and (iv) aggressive transition dynamics during abrupt terrain or contact-mode changes. For each category, we analyze whether failure originates from uncertainty underestimation, semantic misinterpretation, insufficient control authority, or violation of the mode-wise modeling assumptions. Finally, to clarify the individual contribution of each SafeMind component, the experimental section includes targeted ablations removing or freezing one module at a time: stochastic risk correction, semantic barrier conditioning, and meta-adaptive parameter updates. These ablations are evaluated under the same terrain, uncertainty, and semantic conditions as the full model, ensuring that performance differences can be attributed to the removed component rather than to changes in the test protocol. VII Simulation Experiments Before presenting terrain-specific case studies, we first evaluate the overall safety and tracking performance of SafeMind against representative baselines in large-scale simulation. Following common practice in modern locomotion benchmarks [hwangbo2019learning, rudin2022learning, miki2022learning], we expose all controllers to mixed-terrain scenarios with injected uncertainty and measure the safety violation rate (SVR) and tracking RMSE over time. Figure 2 summarizes these metrics, providing a global view of controller behavior under heterogeneous terrains and stochastic disturbances. Unless otherwise stated, all reported values are computed over repeated-seed evaluations and summarized as mean ± 95% confidence interval; statistical significance against the strongest competing baseline is assessed using paired bootstrap resampling for continuous metrics and Wilson intervals for safety-violation rates. Figure 2: Safety violation rate (SVR) and tracking RMSE over time for SafeMind and baseline controllers. Curves show mean performance across repeated trials; shaded regions denote 95% confidence intervals. SafeMind maintains near-zero violation rates while achieving the lowest tracking error, significantly outperforming Safety–MPC, Robust–MPC, BarrierNet, and RL–CBF under mixed-terrain conditions. We organize the simulation experiments as a continuous sequence of challenges rather than isolated tasks: the robot encounters varying terrains, uncertainty regimes, and semantic constraints within a single rollout. This design reflects realistic deployment, where friction, contact geometry, and task objectives shift over time, and highlights how stochastic safety enforcement, meta-adaptation, and semantic conditioning interact across heterogeneous environments. The simulation study is also structured to separate three questions: (i) whether SafeMind improves aggregate safety and tracking, (i) whether its gains persist during abrupt uncertainty and terrain transitions, and (i) which architectural components are responsible for these gains. VII-A Holistic Locomotion Across 12 Terrain Families The first study investigates how SafeMind behaves when traversing the unified terrain suite (T1–T12) introduced in Section VI. Each 20 s episode randomly samples a sequence of three to five terrains, with abrupt transitions such as flat→ , uneven→ ground, and rubble→ , which are known to be challenging for both MPC- and RL-based controllers [lee2020learning, kumar2021rma]. This setup evaluates not only steady-state safety, but also the transient response when the feasible safe set contracts or expands sharply. Table I summarizes results averaged over 2400 episodes (200 per terrain family), comparing SafeMind to six established baselines. We report SVR, tracking RMSE, normalized energy expenditure, adaptation latency TaT_a, and a robustness index capturing sensitivity to parametric uncertainty. The selected baselines cover nominal model-based control (Nominal MPC), deterministic safety filtering (RL–CBF and BarrierNet), and robust model-based safety control (Safety–MPC and Robust–MPC). Stochastic MPC is evaluated separately in timing-constrained settings where the required real-time implementation is feasible; it is omitted from this aggregate table because its full stochastic rollout version could not be executed at the target batch scale without materially changing the simulation protocol. TABLE I: Comprehensive locomotion performance across 12 terrain families. All values are reported as mean ± 95% CI across 2400 episodes unless otherwise stated. Lower is better for SVR, RMSE, E, and TaT_a. Robustness index is normalized, higher is better. Method SVR (%) RMSE (cm) (N⋅m2)E\,(N· m^2) (s)T_a\,(s) Robustness Index Nominal MPC 7.84 ± 0.90 3.4 ± 0.3 1.00 ± 0.04 2.41 ± 0.13 0.52 ± 0.03 RL–CBF 5.21 ± 0.70 3.8 ± 0.4 1.09 ± 0.05 2.03 ± 0.11 0.56 ± 0.03 Safety–MPC 2.91 ± 0.40 3.1 ± 0.3 1.18 ± 0.05 1.54 ± 0.09 0.63 ± 0.03 Robust–MPC 2.44 ± 0.30 3.0 ± 0.3 1.21 ± 0.05 1.47 ± 0.08 0.67 ± 0.03 BarrierNet 1.96 ± 0.30 3.4 ± 0.3 1.13 ± 0.04 1.33 ± 0.08 0.71 ± 0.02 SafeMind (ours) 0.58 ± 0.10 2.8 ± 0.2 0.97 ± 0.03 0.88 ± 0.06 0.89 ± 0.02 Across all metrics, SafeMind achieves the lowest violation rate, the best tracking accuracy, and reduced energy consumption compared to CBF-, MPC-, and hybrid RL-based baselines. In particular, SVR is reduced by more than 3×3× relative to the best deterministic CBF baseline and by over an order of magnitude relative to nominal MPC. The robustness index further indicates that SafeMind remains stable when mass, inertia, and friction parameters drift during an episode, consistent with its stochastic treatment of model uncertainty. These aggregate results suggest that SafeMind reshapes the safety–performance trade-off, acting not only as a safer controller but also as a more efficient one under multi-terrain operation. The improvements in SVR and RMSE over the strongest non-stochastic baselines are statistically significant under the adopted evaluation protocol, indicating that the observed gains are not explained by rollout variance alone. Notably, the joint reduction in SVR and energy suggests that SafeMind is not merely more conservative; instead, its uncertainty-aware barrier correction reduces costly recovery behaviors after near-violation events. VII-B Safety Under Terrain Transitions Many safety failures in legged locomotion occur during short yet critical terrain transitions [lee2020learning, miki2022learning], especially when the feasible safe set contracts abruptly (e.g., entering a slippery patch or stepping onto rubble). To analyze transient behavior, we focus on four representative transitions: flat→ (T1→ 5), uneven→ (T2→ 4), rubble→ (T8→ 9), and soft→ (T4→ 7). These transitions respectively require increased slip margins, pitch stabilization, center-of-mass redirection, and foothold reallocation. Table I reports the short-horizon increase in violation rate ΔSVR during the first 0.5 s after the transition, as well as the recovery time TrecT_rec needed to re-establish safe-set invariance. SafeMind consistently shows smaller spikes in violation rate and faster recovery than Safety–MPC and BarrierNet. Because these transition experiments directly stress the mode-wise validity of the stochastic safety layer, they are particularly informative for quadruped hybrid locomotion: the results indicate that SafeMind remains practically stable across contact and terrain changes even though the theoretical barrier analysis is enforced within contact phases rather than as a single globally smooth hybrid proof. TABLE I: Safety degradation and recovery across terrain transitions.TrecT_rec is reported as mean ± 95% CI across repeated transition trials. Proportion-based metrics are reported as point estimates.ΔSVR is violation rate increase immediately after transition. TrecT_rec is time to recover safe-set invariance. Transition Method ΔSVR (%) TrecT_rec (s) T1→ 5 Safety–MPC 3.8 1.72 ± 0.12 BarrierNet 4.6 1.41 ± 0.10 SafeMind 0.9 0.63 ± 0.05 T2→ 4 Safety–MPC 2.1 1.34 ± 0.10 BarrierNet 2.7 1.12 ± 0.09 SafeMind 0.6 0.48 ± 0.04 T8→ 9 Safety–MPC 4.2 1.89 ± 0.14 BarrierNet 3.9 1.77 ± 0.13 SafeMind 1.1 0.92 ± 0.07 T4→ 7 Safety–MPC 3.1 1.42 ± 0.10 BarrierNet 3.4 1.33 ± 0.09 SafeMind 0.7 0.57 ± 0.05 The improved transient behavior can be attributed to the meta-adaptive update of the risk parameter κ and the diffusion-aware barrier term. SafeMind increases its effective safety margins as soon as barrier derivatives indicate rising uncertainty, thereby anticipating the contraction of the reachable safe set rather than reacting after constraints have been violated. This anticipatory behavior is especially evident in the T1→ 5 transition, where friction drops sharply and deterministic methods struggle to maintain invariance. These results also support the practical value of bounded online adaptation: the controller becomes more conservative when uncertainty spikes, yet returns rapidly to lower-risk settings once the new terrain regime is identified, avoiding sustained over-conservatism. VII-C Robustness to Increasing Uncertainty We next examine how SafeMind scales with stochastic perturbation magnitude. Following robustness analyses in safety-filter and stochastic-CBF literature [fridovich2020stochastic, howell2022cbf], we gradually increase parametric and disturbance uncertainty from 0% to 35% and measure the resulting SVR for all controllers. Table I summarizes the violation rates. In this experiment, the perturbations include both epistemic components (dynamics and contact-model mismatch) and aleatoric components (sensor corruption and actuation noise), which are scaled jointly to test the covariance-aware safety correction under progressively harsher conditions. TABLE I: Impact of uncertainty scaling on safety violation rate (%). All values are reported as mean ± 95% CI across repeated trials unless otherwise stated. Method 0% 15% 25% 35% Nominal MPC 3.2 7.4 10.1 15.6 BarrierNet 1.1 3.8 6.3 9.7 Robust–MPC 0.9 2.8 4.2 6.9 Safety–MPC 1.2 3.1 5.0 7.3 SafeMind 0.3 0.9 1.7 3.1 While all methods deteriorate as uncertainty increases, SafeMind exhibits markedly sublinear growth in violation rate and maintains low SVR even at the highest perturbation level. This behavior reflects the explicit dependence of its barrier constraint on the stochastic variance, in contrast to deterministic baselines that treat uncertainty as unmodeled disturbance and only react post hoc. The slower degradation trend also supports the claim that SafeMind benefits from modeling uncertainty structure rather than merely enlarging conservative margins uniformly. VII-D Challenging Terrain Scenarios To further probe SafeMind in regimes that stress contact modeling and feasibility, we consider several challenging terrains drawn from the twelve-terrain suite. On rocky terrain (T3), where height discontinuities induce high-impact footfalls, SafeMind substantially reduces both violation rate and impact impulse compared to MPC and deterministic CBF baselines (Table IV). The reduction in peak impulse by roughly 15–20% indicates that the stochastic barrier encourages more cautious momentum regulation before touchdown, similar in spirit to impact-aware gait design [hwangbo2019learning]. This behavior is consistent with the variance-aware barrier term, which penalizes barrier evolution along uncertain touchdown directions and thus discourages aggressive foot placement when contact reliability is reduced. TABLE IV: Rocky Terrain Performance (T3, 200 episodes). Continuous valued metrics are reported as mean ± 95% CI unless otherwise stated. Proportion-based metrics are reported as point estimates. Method SVR (%) RMSE [cm] Impulse TaT_a [s] Nominal MPC 14.2 4.4 ± 0.3 1.82 ± 0.07 3.21 ± 0.18 BarrierNet 6.1 4.8 ± 0.4 1.63 ± 0.06 2.34 ± 0.14 Safety–MPC 4.3 4.2 ± 0.3 1.51 ± 0.05 1.89 ± 0.11 Robust–MPC 3.8 4.6 ± 0.3 1.49 ± 0.05 1.73 ± 0.10 SafeMind (ours) 1.12 3.6 ± 0.2 1.28 ± 0.04 1.02 ± 0.07 Rubble fields (T8) combine irregular obstacles, partial footholds, and unstable support surfaces. As shown in Table V, SafeMind attains the lowest SVR and tracking error while also reducing energy and control jerk relative to all baselines. The elevated variance in barrier derivatives on rubble leads SafeMind to temporarily widen safety margins before footfall, yielding smoother, conservative steps and fewer foothold failures. Compared with deterministic safety layers, this mechanism reduces both catastrophic violations and oscillatory corrective actions, which explains the simultaneous decrease in jerk and energy. TABLE V: Rubble Field Traversal (T8). Continuous valued metrics are reported as mean ± 95% CI unless otherwise stated. Proportion-based metrics are reported as point estimates. Method SVR (%) RMSE [cm] Energy Jerk Nominal MPC 16.7 5.2 ± 0.4 1.00 ± 0.04 1.00 ± 0.04 RL–CBF 11.4 5.6 ± 0.4 1.12 ± 0.05 1.19 ± 0.05 BarrierNet 7.9 5.8 ± 0.4 1.10 ± 0.05 1.14 ± 0.05 Robust–MPC 6.3 5.4 ± 0.4 1.18 ± 0.05 1.21 ± 0.05 SafeMind (ours) 1.94 4.3 ± 0.3 0.93 ± 0.03 0.87 ± 0.03 Gap-crossing tasks (T9) evaluate the ability to maintain swing-leg clearance and center-of-mass stability near feasibility limits [lee2020learning]. Table VI shows that SafeMind achieves the highest success rate and lowest violation rate among all controllers. By increasing α and κ when the predicted barrier evolution becomes sensitive to foot-placement uncertainty, SafeMind delays leg lowering and safely traverses gaps that cause late braking or clearance failures in deterministic baselines. This supports the interpretation that the adaptive parameters regulate both convergence pressure and uncertainty tolerance, rather than acting as static tuning constants. TABLE VI: Gap Crossing Performance (T9). Continuous valued metrics are reported as mean ± 95% CI unless otherwise stated. Proportion-based metrics are reported as point estimates. Method SVR (%) Success (%) RMSE [cm] TaT_a [s] Nominal MPC 22.5 61.3 5.1 ± 0.4 4.10 ± 0.22 BarrierNet 9.7 82.0 4.8 ± 0.3 2.66 ± 0.15 Safety–MPC 7.4 88.1 4.6 ± 0.3 2.21 ± 0.13 Robust–MPC 5.6 90.8 4.9 ± 0.3 2.08 ± 0.12 SafeMind (ours) 1.85 97.2 3.7 ± 0.2 1.12 ± 0.07 Narrow corridors (T11) impose strict lateral constraints requiring centimeter-level precision. In Table VII, SafeMind reduces lateral RMSE and SVR while also lowering energy and jerk compared to MPC and CBF baselines. As the corridor narrows, the variance-aware barrier sharpens lateral safety gradients and suppresses oscillatory corrections that are often observed with deterministic formulations. This case also illustrates that semantic or geometric constraints can be tightened without inducing excessive chattering, provided the uncertainty-aware barrier remains smooth and the optimization layer stays well conditioned. TABLE VII: Narrow Corridor Navigation (T11). Continuous valued metrics are reported as mean ± 95% CI unless otherwise stated. Proportion based metrics are reported as point estimates. Method SVR (%) Lateral RMSE [cm] Energy Jerk Nominal MPC 19.8 4.2 ± 0.3 1.00 ± 0.04 1.00 ± 0.04 BarrierNet 8.9 3.8 ± 0.3 1.13 ± 0.05 1.21 ± 0.05 Safety–MPC 6.3 3.5 ± 0.2 1.17 ± 0.05 1.27 ± 0.05 Robust–MPC 4.1 3.6 ± 0.3 1.22 ± 0.05 1.25 ± 0.05 SafeMind (ours) 1.02 2.4 ± 0.2 0.91 ± 0.03 0.83 ± 0.03 VII-E Adversarial Transitions and Morphology Variations Finally, we study scenarios that stress SafeMind’s meta-adaptive capabilities. In mixed-adversarial terrain experiments, the robot encounters rapid transitions among uneven terrain (T2), slippery patches (T5), and soft ground (T4). Table VIII shows that SafeMind reduces SVR by more than an order of magnitude compared to nominal MPC and by a large margin relative to deterministic CBF baselines, while also improving energy and adaptation time. The diffusion-aware barrier allows SafeMind to proactively enlarge safety margins when friction drops or ground compliance changes abruptly. These experiments are particularly relevant to the reviewer concern regarding rapid online adaptation: the results indicate that bounded updates of α and κ improve resilience during adversarial transitions without inducing unstable oscillatory behavior in the control signal. TABLE VIII: Mixed-Adversarial Terrain Transitions. Continuous valued metrics are reported as mean ± 95% CI unless otherwise stated. Proportion-based metrics are reported as point estimates. Method SVR (%) RMSE [cm] E TaT_a [s] Nominal MPC 14.8 4.1 ± 0.3 1.00 ± 0.04 3.88 ± 0.21 BarrierNet 5.3 4.4 ± 0.3 1.11 ± 0.05 2.41 ± 0.14 Safety–MPC 3.7 4.0 ± 0.3 1.18 ± 0.05 1.97 ± 0.12 Robust–MPC 2.9 4.2 ± 0.3 1.21 ± 0.05 1.62 ± 0.10 SafeMind 0.77 3.3 ± 0.2 0.95 ± 0.03 0.89 ± 0.06 We also evaluate robustness to morphology changes, including added payload and partial leg impairment, which are known to degrade locomotion policies trained under nominal models [kumar2021rma]. As summarized in Table IX, SafeMind maintains high success rates and low SVR under these perturbations, outperforming MPC-, CBF-, and distributional-RL-based baselines. The meta-adaptive updates to α and κ concentrate additional safety margin around the impaired limb, leading to more cautious load distribution without excessively sacrificing performance. Although the present paper focuses on two quadruped platforms rather than a broad morphology suite, these perturbation experiments suggest that the proposed safety layer is not tied to a single nominal body configuration. Instead, its dependence on barrier design and uncertainty estimation indicates a principled pathway to extension toward other morphologies or higher-dimensional legged systems, provided that appropriate contact-aware barrier functions and uncertainty models are available. TABLE IX: Morphology Variation and Structural Disturbance. Method SVR (%) RMSE [cm] E Success (%) Nominal MPC 16.2 6.4 1.00 58.1 BarrierNet 8.3 6.1 1.11 72.4 Safety–MPC 5.6 5.4 1.14 78.6 Distributional RL 4.1 6.8 1.21 74.2 Ensemble–CBF 3.7 5.9 1.17 81.0 SafeMind 1.12 4.3 0.98 92.7 VIII Real–World Experiments We further validate SafeMind on two physical quadruped platforms, Unitree A1 and ANYmal-C, across a diverse set of real–world scenarios designed to expose the robot to challenging contact conditions, perceptual uncertainties, human–robot interaction constraints, and semantic safety requirements that cannot be modeled analytically. Each experiment lasts between 30 and 90 seconds and is repeated for 20 trials. Unlike simulation, disturbances arise naturally from environmental variability, making real–world evaluation critical for demonstrating SafeMind’s robustness. VIII-A Low–Friction Indoor Environment On a polished epoxy floor where the friction coefficient varies unpredictably, SafeMind consistently maintains feasible center–of–mass motion while adjusting its risk sensitivity parameter κ according to detected micro–slippage. Unlike deterministic baselines, which occasionally commit to aggressive footholds that exceed ground–reaction feasibility, SafeMind widens its safety envelope in regions with visually identified specular highlights indicating slippery patches. The result is a significantly reduced violation probability, summarized in Table X. TABLE X: Low–Friction Indoor Environment (20 trials). Method SVR (%) RMSE (cm) Energy Nominal MPC 11.2 4.1 1.00 BarrierNet 5.3 4.0 1.08 Safety–MPC 3.9 3.7 1.12 Robust–MPC 3.0 4.2 1.15 SafeMind 0.88 3.1 0.96 The significant performance gap can be attributed to SafeMind’s ability to anticipate variance–induced degradation of barrier dynamics rather than reacting after violations occur. Notably, energy consumption is lower than all baselines because SafeMind proactively adapts gait smoothness rather than performing abrupt corrective motions. VIII-B Gravel and Soft Outdoor Soil Transitioning to loose gravel and soft soil, the robot encounters high contact uncertainty due to substrate deformation. ANYmal C equipped with lidar-based terrain perception often produces noisy or incomplete elevation maps, which induce meaningful uncertainty in foot placement analysis. SafeMind interprets this noise as increased variance in the composite barrier and correspondingly increases κ, yielding highly stable locomotion. Table XI shows a sharp contrast between SafeMind and deterministic baselines, many of which underestimate the non-rigid contact and therefore incur constraint violations. TABLE XI: Gravel and Soft Soil (ANYmal C). Method SVR (%) Pitch Var (deg2) Energy BarrierNet 4.8 2.31 1.13 Safety–MPC 3.7 2.08 1.15 Robust–MPC 2.5 1.84 1.19 SafeMind 0.64 1.12 1.04 Videos reveal that SafeMind naturally lowers step height and stabilizes torso motion during soil compression events, whereas baselines exhibit small but noticeable slips. VIII-C Metal Industrial Stairs Stair climbing presents geometric discontinuities that challenge both perception and model–based prediction. ANYmal C ascends a set of industrial metal stairs with uneven risers (10–13 cm) and highly reflective surfaces causing depth-sensor distortions. SafeMind demonstrates exceptional robustness in this setting. Table XII shows the clearance violation rate (the percentage of steps where predicted foot clearance goes below threshold). TABLE XII: Industrial Stairs – Clearance Violations. Method Clear. Viol. (%) RMSE (cm) Energy Safety–MPC 3.4 3.2 1.16 BarrierNet 2.8 3.4 1.12 Ensemble–CBF 2.1 3.1 1.15 SafeMind 0.47 2.6 1.07 Analysis of κ shows a marked increase near each step edge, indicating that SafeMind responds to sensed depth variance prior to foot placement, something deterministic methods cannot do. VIII-D Narrow Corridor Navigation To evaluate spatial constraint handling, the robot traverses a 25 cm wide corridor marked by two parallel walls. Side clearance becomes a hard safety constraint, intensifying the need for accurate risk-aware correction to avoid lateral collisions. SafeMind reduces lateral violation incidents to nearly zero by tightening its semantic and geometric constraints as uncertainty in side-wall distance increases. TABLE XIII: Narrow Corridor Safety. Method Wall Contact (%) Yaw Var (deg2) Energy Nominal MPC 14.7 5.1 1.00 RL–CBF 8.3 4.4 1.04 BarrierNet 3.2 3.9 1.09 SafeMind 0.36 2.8 1.03 Qualitatively, SafeMind maintains a central trajectory and avoids erratic corrections typically observed in RL–CBF due to non-differentiable penalty shaping. VIII-E Human–Robot Interaction Safety A standing human operator introduces a dynamic “keep–out zone” generated from onboard depth perception. Semantic instructions (“maintain 1.5 m distance”) are streamed in real time and reinterpreted every 100 ms into barrier parameters. SafeMind preserves safety distances even under operator movement, as shown in Table XIV. TABLE XIV: Human–Robot Safety Distance Maintenance. Method <1.5md<1.5\, m Events Tracking RMSE Energy Nominal MPC 17 3.8 1.00 RL–CBF 9 4.2 1.11 BarrierNet 6 3.4 1.09 SafeMind 0 3.1 1.05 Interestingly, SafeMind purposely modulates its gait speed when the operator changes orientation abruptly, indicating that semantic constraints influence both geometric and dynamic safety. VIII-F Outdoor Grass with Weather Variability Fluctuating illumination, wind disturbance, and tall grass introduce significant perception noise. SafeMind compensates by conservative adjustment of its feasible set when lidar consistency drops. TABLE XV: Outdoor Grass under Weather Variation. Method SVR (%) Pitch Var Energy BarrierNet 4.1 2.7 1.12 Safety–MPC 2.3 2.2 1.14 SafeMind 0.77 1.6 1.06 SafeMind’s performance aligns closely with simulation, demonstrating effective generalization to real-world physics inconsistencies. VIII-G Deformable Carpet with Wrinkles Indoor carpets generate unpredictable elastic deformation and often cause tripping in quadrupeds. SafeMind responds by adjusting foot clearance constraints based on variance in surface depth measurements. TABLE XVI: Wrinkled Carpet Experiments. Method Trip Incidents Clear. Viol. Energy Safety–MPC 4 2.5% 1.16 BarrierNet 3 2.1% 1.14 SafeMind 0 0.6% 1.10 VIII-H Semantic Region Avoidance in Mixed Indoor Environment A camera mounted above the arena marks hazardous zones in real time. The semantic encoder interprets these as differentiable spatial constraints. During complex maneuvers around obstacles and reflective tiles, SafeMind maintains perfect semantic compliance. TABLE XVII: Semantic Region Avoidance. Method Hazard Entered RMSE Energy RL–CBF 13 4.3 1.11 BarrierNet 4 3.8 1.13 Safety–MPC 2 3.5 1.12 SafeMind 0 3.2 1.07 The experiment highlights SafeMind’s unique capability to merge semantic perception and stochastic control into a coherent safety mechanism. IX Baselines, Metrics, and Evaluation Protocols To rigorously assess the capabilities of SafeMind across the simulation and hardware studies, we adopt an evaluation protocol designed around three principles: comparability across heterogeneous controllers, statistical robustness over thousands of rollouts, and joint coverage of safety and performance in safety–critical legged locomotion. Our design follows established practice in safe control and safe reinforcement learning benchmarks, which emphasize common dynamics and sensing models, standardized metrics, and large-scale randomized trials.[mesbah2016stochasticmpc, rawlings2009mpc, brunke2022safelearning, ray2019safetygym] IX-A Baseline Controllers We benchmark SafeMind against a broad family of safety–aware controllers that span differentiable CBF layers, model predictive control (MPC), uncertainty–aware CBFs, and distributional reinforcement learning. All baselines share the same low-level actuator and sensing models as SafeMind and are tuned following best practices in the respective literatures to avoid strawman comparisons.[brunke2022safelearning] Deterministic differentiable CBF layer. BarrierNet is used as the canonical deterministic differentiable CBF baseline.[xiao2023barriernet] It implements high-order control barrier functions inside a differentiable quadratic program (QP), enabling end-to-end training of neural controllers while enforcing hard safety constraints. However, its barrier parameters are fixed once trained and do not adapt to online stochasticity, so the safety margin is effectively deterministic and can become either overly conservative or fragile under unmodeled disturbances. MPC-based baselines. We consider four MPC variants that represent the classical spectrum from nominal to robust and stochastic formulations.[rawlings2009mpc, mesbah2016stochasticmpc] Nominal MPC optimizes tracking performance without explicit safety constraints and serves as a high-performance but unsafe reference. Safety–MPC augments the stage cost with CBF-based constraints, enforcing deterministic forward invariance over a finite horizon; this formulation is standard in safety-critical robotics but is not differentiable end-to-end and incurs substantial online computation. Robust–MPC replaces stochastic uncertainty with worst-case bounded disturbance sets and enforces tube-based robust invariance, yielding strong guarantees but typically conservative behavior, especially when contact and friction vary quickly. Finally, Stochastic MPC uses chance constraints and Monte Carlo rollouts to estimate barrier violation probabilities, following stochastic MPC formulations that treat constraint satisfaction in a probabilistic sense.[mesbah2016stochasticmpc] In practice, the sampling burden of chance-constrained MPC makes it difficult to operate at high control rates (200–250 Hz) on-board legged platforms. Uncertainty- and learning-based baselines. To capture epistemic model error, we implement an Ensemble–CBF controller that uses an ensemble of learned dynamics models, similar in spirit to probabilistic ensembles with trajectory sampling (PETS),[chua2018pets] and aggregates their predictions into a CBF-based safety filter. This setup improves robustness against dynamics mismatch but still treats barrier constraints deterministically and therefore cannot provide probabilistic invariance guarantees. In contrast, the RL–CBF baseline combines a model-free RL policy with a CBF-based safety filter, following the RL-CBF architecture of Cheng et al.[cheng2019rlcbf] Safety is enforced during training by projecting RL actions through the CBF-QP, but the overall policy remains non-differentiable and does not model distributional barrier dynamics explicitly. Finally, we include a Distributional RL controller based on quantile-regression and implicit-quantile distributional value functions,[dabney2018qr, dabney2018iqn] tuned to optimize risk-sensitive objectives such as CVaR-like criteria. These methods capture return distributions and risk preferences but have no mechanism to enforce state-wise safety invariance. Table XVIII summarizes the structural properties and expected failure modes of the baseline families. TABLE XVIII: Summary of baseline families and structural characteristics. Method family Key properties / limitations BarrierNet Differentiable CBF–QP layer with fixed barrier parameters; cannot adapt risk to time-varying stochasticity Safety– / Robust– / Stochastic MPC Strong guarantees in deterministic or worst-case settings; high online cost and limited suitability for 200–250 Hz on-board control; not end-to-end differentiable Ensemble–CBF Uses model ensembles to capture epistemic uncertainty; still enforces deterministic CBF constraints without probabilistic invariance RL–CBF RL policy filtered by CBF QP; improves safety during learning but breaks differentiability and lacks explicit stochastic barrier modeling Distributional RL Learns risk-sensitive value distributions; no mechanism for state-wise safety invariance or hard constraints Nominal MPC High tracking performance but no safety guarantees; used as performance upper bound and safety lower bound IX-B Evaluation Metrics All simulation experiments (over 20,000 episodes) and hardware trials (over 120 runs) are evaluated using a unified metric suite designed to quantify safety, tracking quality, control efficiency, and semantic compliance in safety-critical legged locomotion.[brunke2022safelearning, ray2019safetygym] Safety and stability metrics. The primary safety indicator is the safety violation rate (SVR), defined as the fraction of time steps at which any safety-relevant barrier hc(ξt)h_c( _t) becomes negative. To obtain reliable estimates of rare events, we report SVR with Wilson 95% confidence intervals aggregated over randomized episodes, consistent with recent safe-RL benchmarks.[ray2019safetygym] We additionally monitor constraint-violation bursts around terrain transitions and external disturbances to characterize transient safety failure modes. Tracking and control-effort metrics. Tracking performance is measured via a pose RMSE, ℰtrackE_track, computed over body height, pitch, and roll, which correlates strongly with stability margins in legged systems. Control effort and compliance are captured through the time-averaged squared torque: E=1T∫0T‖τ(t)‖22dt,E= 1T _0^T\|τ(t)\|_2^2\,dt, (39) where smaller values indicate smoother, more compliant actuation. We further compute a jerk cost based on the discrete-time derivative of commanded joint velocities and positions to quantify motion smoothness and actuator wear, and a foot-impact impulse metric at touchdown, which empirically correlates with unsafe gait transitions and hardware stress in legged platforms.[brunke2022safelearning] Adaptation and semantic metrics. To quantify how quickly each controller reacts to distributional shifts, we define the adaptation time TaT_a as the time required after a terrain change, slip event, or external push until SVR returns below a small threshold and tracking error stabilizes. For semantically grounded tasks (e.g., region avoidance, corridor following, distance-keeping), we measure semantic compliance accuracy as the fraction of time steps at which all semantic constraints inferred by the perception stack are satisfied. Finally, to summarize the global safety–performance trade-off, we compute a safe–energy Pareto index by normalizing SVR and energy across controllers and locating methods on the Pareto frontier; SafeMind consistently lies on or very near this frontier in our experiments. IX-C Evaluation Protocol All baselines and SafeMind are evaluated under a unified experimental protocol that enforces identical dynamics, sensing, terrain distributions, and disturbance models, in line with recent unified safe-control benchmarks.[brunke2022safelearning, yuan2022safecontrolgym] Each episode randomizes terrain geometry, friction maps, mass and inertia perturbations, sensor noise, external disturbances, and—when applicable—semantic region layouts and natural-language task descriptors. Controllers are deployed on the full twelve-terrain suite, covering flat, discontinuous, deformable, slippery, rubble, gap, corridor, and mixed adversarial regimes. To probe robustness under hardware and computational constraints, each method is evaluated at multiple control frequencies (250, 200, 100, and 50 Hz), with otherwise identical conditions. Short episodes (12–15 s) stress rapid adaptation to terrain transitions, while long-horizon runs (up to 600 s) expose drift, estimator degradation, and rare-event failures that would be invisible in short rollouts. For SafeMind, meta-parameters (α,κ)(α,κ) are warmed up during a short burn-in phase on randomized episodes before formal evaluation, after which they evolve purely based on online statistics. All reported tables use at least 200 episodes per condition and summarize mean ± standard deviation; when comparing SafeMind to baselines, significance is assessed via paired bootstrap tests over episodes, following standard practice in safe-control benchmarks.[ray2019safetygym, brunke2022safelearning] A concise overview of the protocol elements is provided in Table XIX. TABLE XIX: Unified evaluation protocol used for all controllers. Protocol element Description Randomization Terrains, friction, mass/inertia, sensor noise, external pushes, semantic layouts Control frequencies 250, 200, 100, 50 Hz Episode horizons 12–15 s (short), up to 600 s (long-horizon) Metrics SVR, tracking RMSE, E, jerk, impact impulse, TaT_a, semantic compliance Baselines Differentiable CBF layer, MPC variants, ensemble- and RL-based controllers Statistical reporting Mean ± std., Wilson 95% CIs, paired bootstrap significance tests X Comprehensive Analysis To understand why SafeMind achieves improved probabilistic safety, adaptability, and control efficiency, we complement the experimental results with a set of analytical studies. Rather than treating each benchmark as an isolated test case, we analyze SafeMind as a dynamical safety mechanism and examine the role of its architectural components, its sensitivity to parameter variations, the temporal dynamics of risk sensitivity and constraint activation, long-horizon stability, and the safety–performance trade-off. This style of analysis is in line with recent work on interpretable safe learning for robotics, where ablations and sensitivity studies are used to reveal the structure of learned controllers.[brunke2022safelearning, howell2022cbf] Unless otherwise stated, all tabulated quantities in this section are reported as mean ± 95% confidence interval across repeated trials; significance of key pairwise comparisons is assessed using the same statistical protocol described in Section VI. X-A Ablation and Component Contribution A central question is how much each component of SafeMind contributes to overall safety and performance. Following standard ablation practice in learning-based control and safe RL [brunke2022safelearning, cheng2019rlcbf], we remove major modules individually—the stochastic barrier correction term, the risk-aware tightening term governed by κ, the meta-adaptive update mechanism, and the semantic encoder—and evaluate changes in SVR, tracking accuracy, and energy. To further isolate the role of online adaptation from the role of risk sensitivity itself, we additionally evaluate a fixed-parameter variant in which α and κ are held constant at their nominal values throughout each rollout. Table X reports results averaged over ten terrain categories and six semantic tasks. Removing either the stochastic correction or the risk-aware term leads to a dramatic increase in SVR (from 0.58%0.58\% to 3.74%3.74\% and 5.92%5.92\%, respectively), with only modest changes in tracking error. This suggests that the stochastic modeling and risk-sensitive tightening primarily shape the safety envelope rather than the nominal tracking behavior. TABLE X: Extended ablation across all simulation domains. Continuous valued metrics are reported as mean ± 95% CI unless otherwise stated. Proportion-based metrics are reported as point estimates. Configuration SVR (%) RMSE (cm) Energy Full SafeMind 0.58 2.9 ± 0.2 0.96 ± 0.03 w/o Stochastic Term 3.74 3.3 ± 0.2 1.04 ± 0.04 w/o Risk Tightening (κ=0)(κ=0) 5.92 3.2 ± 0.2 1.03 ± 0.04 w/o Meta-Adaptation 1.48 3.1 ± 0.2 1.07 ± 0.04 w/o Semantic Encoder 2.61 3.5 ± 0.3 1.01 ± 0.03 Fixed (α,κ)(α,κ) 1.83 3.1 ± 0.2 1.02 ± 0.03 Beyond aggregate statistics, the ablation reveals structural differences. Without the stochastic correction, the controller underestimates the degradation of barrier values under uncertain contacts, effectively creating optimistic “false margins” similar to deterministic CBF failures reported in stochastic settings.[fridovich2020stochastic, clark2021cbf] Disabling κ causes SafeMind to maintain nominal-risk envelopes even when uncertainty grows, leading to delayed reactions during terrain changes. Meta-adaptation primarily affects responsiveness: it reduces recovery time after perturbations and terrain transitions by more than one-third, but has a smaller effect on steady-state SVR. Finally, removing the semantic encoder increases violations in tasks where constraints depend on high-level scene structure, indicating that SafeMind benefits from a hierarchical integration of semantic reasoning and low-level safety control.[brohan2023rt1, shah2023lmnav] The fixed-parameter variant further shows that online adaptation of α and κ provides measurable benefit beyond simply choosing a conservative static setting, especially during rapid terrain transitions and uncertainty surges. X-B Sensitivity and Parameter-Scaling Analysis To study robustness under model variation, we systematically scale key physical and sensing parameters: mass and inertia, friction, perception latency, and control frequency. Sensitivity analysis is widely used in robust MPC and stochastic control to validate controller resilience to modeling errors.[mesbah2016stochasticmpc, rawlings2009mpc] Table XXI reports SVR, RMSE, and energy when each parameter is perturbed independently around its nominal value. TABLE XXI: Sensitivity of SafeMind to parameter scaling. Continuous valued metrics are reported as mean ± 95% CI unless otherwise stated. Proportion-based metrics are reported as point estimates. Parameter Scaling SVR (%) RMSE (cm) Energy Mass +15%+15\% 0.72 3.1 ± 0.2 0.99 ± 0.03 Mass −15%-15\% 0.69 3.0 ± 0.2 0.98 ± 0.03 Friction −40%-40\% 1.31 3.4 ± 0.2 1.02 ± 0.03 Latency +20+20 ms 1.12 3.7 ± 0.3 1.05 ± 0.04 Control Frequency 100 Hz 1.84 3.3 ± 0.2 1.11 ± 0.04 Control Frequency 50 Hz 3.02 3.8 ± 0.3 1.20 ± 0.05 Two observations emerge. First, SafeMind remains robust under substantial mass and inertia perturbations, with SVR staying below 1.5%1.5\% even when friction is reduced by 40%40\%. This indicates that risk-aware tightening compensates for dynamics mismatch: as friction drops or latency increases, the meta-adaptive update raises κ and narrows the feasible safety tube.[howell2022cbf] Second, although SVR increases at lower control frequencies, SafeMind maintains comparatively low violation rates and moderate energy growth, suggesting that its barrier shaping provides intrinsic stability even under degraded actuation bandwidth. Deterministic baselines, by contrast, exhibit superlinear growth in violation rates under similar low-frequency stress (cf. Section VI). These trends also clarify the scope of the method: SafeMind remains effective under sizable but bounded perturbations, yet the gradual increase in SVR at very low control rates indicates that extreme discretization and bandwidth limits can eventually violate the assumptions underlying the mode-wise stochastic safety model. X-C Risk Sensitivity Dynamics A distinguishing feature of SafeMind is the dynamic adaptation of the risk parameter κ(ξ)κ(ξ) in response to evolving uncertainty and environmental cues. Similar risk-sensitive adaptation has been explored in distributional and CVaR-based RL, but typically at the value-function level rather than at the level of state-wise safety constraints.[chow2015cvar, dabney2018qr] Here, we directly inspect the temporal evolution of κ during terrain transitions. Table XXII summarizes statistics of κ across several prototypical terrain changes. We observe a consistent pattern: upon entering uncertain terrain such as slippery or rubble regions, κ exhibits a sharp “risk surge” within a few control cycles, followed by a slower “risk relaxation” as contact stabilizes. TABLE XXII: Statistics of risk sensitivity κ across terrain transitions. Mean and Peak are reported as mean ± 95% CI; Std denotes the empirical standard deviation of κ over the transition window. Terrain Transition Mean κ Std Peak Flat → Slippery 2.48 ± 0.14 0.91 4.83 ± 0.27 Soft → Rubble 3.07 ± 0.18 1.12 5.14 ± 0.31 Rubble → Gap 2.81 ± 0.16 0.97 4.55 ± 0.28 Gap → Flat 1.21 ± 0.09 0.41 2.19 ± 0.15 The asymmetric time profile—fast rise and slow decay—implements a conservative hysteresis: SafeMind reacts quickly to rising uncertainty, but relaxes risk sensitivity more cautiously. This hysteresis reduces the likelihood of over-optimistic barrier relaxation after short-lived disturbances, a failure pattern often reported in deterministic safety filters.[fridovich2020stochastic] Importantly, the bounded and smoothed updates prevent unstable parameter oscillations, supporting the practical claim that online adaptation improves resilience without destabilizing the inner-loop controller. X-D Constraint Activation and Safety Geometry To understand how SafeMind distributes safety effort across multiple constraints, we measure the activation frequency of individual barrier functions hih_i across terrains and tasks. The resulting statistics, shown in Table XXIII, reveal how the “safety geometry” changes with environment. TABLE XXIII: Constraint activation frequencies (percentage of active cycles). All values are reported as point estimates across repeated runs. Constraint T2 T4 T5 T8 Foot Clearance 22.3 18.1 13.8 31.4 Body Tilt 11.8 33.2 24.9 29.5 Joint Limits 4.3 5.9 4.8 6.4 Semantic Boundaries 0.0 2.7 4.6 7.1 On uneven and rubble terrains, foot-clearance constraints dominate, whereas on soft and slippery terrains, body-tilt constraints are more frequently active, reflecting the need to regulate pitch and roll under compliance and low friction.[hwangbo2019learning, miki2022learning] The nonzero activation of semantic constraints on rubble (T8) indicates that SafeMind can maintain semantic region constraints even in physically challenging conditions, illustrating a tight coupling between high-level intent and low-level safety enforcement. At the same time, the comparatively lower activation rate of semantic boundaries relative to core physical constraints is consistent with the intended arbitration policy: semantic cues influence safety geometry without overriding contact, balance, or actuation feasibility when conflicts arise. X-E Robustness Stress Testing We further evaluate SafeMind under rare-event and adversarial disturbances: large external pushes (50 N), sudden friction collapse (down to μ<0.1μ<0.1), temporary perception dropout (300 ms), and abrupt 10 cm height steps. Similar stress tests are common in robustness studies of quadruped locomotion and safety filters.[lee2020learning, howell2022cbf] Table XXIV reports aggregated SVR, episode-level failure rate, and recovery time. TABLE XXIV: Aggregated results under rare-event stress tests. Recovery time is reported as mean ± 95% CI. Proportion-based metrics are reported as point estimates. Failure rate is reported as observed episode-level failure percentage with count in parentheses. Stress Scenario SVR (%) Failure Rate Recovery Time (s) 50 N Push 1.14 0.0 (0/200) 1.25 ± 0.09 Friction Collapse 2.38 0.0 (0/200) 1.91 ± 0.13 300 ms Perception Drop 1.07 0.0 (0/200) 1.48 ± 0.10 10 cm Drop-off 1.44 0.0 (0/200) 1.72 ± 0.12 In all evaluated scenarios, SafeMind avoids catastrophic failures, whereas Safety–MPC and deterministic CBF baselines exhibit non-negligible episode-level failure rates (3–8%) under the same conditions. The results indicate that stochastic barrier modeling and meta-adaptive risk shaping allow SafeMind to “absorb” unexpected perturbations without leaving the safe set. Nevertheless, the friction-collapse case remains the most challenging, suggesting that severe contact-model mismatch is still a dominant source of residual risk even for uncertainty-aware safety filters. X-F Long-Horizon Stability and Drift Preventing error accumulation during long-term operation is crucial for field deployment.[rudin2022learning, brunke2022safelearning] We therefore evaluate SafeMind on 600 s episodes with periodic disturbances and monitor the cumulative probability of safety violations over time. Table XXV compares accumulated violation probabilities for SafeMind and several baselines. TABLE XXV: Long-horizon accumulated violation probability. All values are reported as mean ± 95% CI unless otherwise stated. Controller 150 s 300 s 450 s 600 s Nominal MPC 4.2% 7.3% 9.7% 12.4% Safety–MPC 1.9% 3.1% 4.8% 5.6% BarrierNet 1.6% 2.8% 3.7% 4.2% SafeMind 0.41% 0.58% 0.65% 0.71% Deterministic baselines exhibit monotonic growth of accumulated violations, consistent with a gradual optimistic bias in barrier evolution. In contrast, SafeMind stabilizes quickly and maintains a nearly flat violation curve, indicating that the stochastic correction term counteracts bias accumulation over long horizons. This behavior is particularly important in realistic deployments where robots operate for many minutes or hours without human supervision. The near-saturation of the violation curve also suggests that the bounded adaptation mechanism does not accumulate destabilizing drift over long operation windows in the evaluated regimes. X-G Safety–Performance Pareto Frontier Finally, we analyze the intrinsic trade-off between safety and agility by sweeping the nominal risk parameter κ while keeping other components fixed. Similar safety–performance trade-off analyses appear in constrained and risk-sensitive RL,[chow2015cvar, achiam2017cpo] but here we examine the trade-off at the level of barrier-enforced state trajectories. Table XXVI reports SVR, energy, and RMSE for several fixed values of κ. As κ increases, SafeMind becomes more conservative, reducing SVR at the cost of slightly higher energy and tracking error. TABLE XXVI: Safety–performance Pareto frontier for varying κ. Continuous valued metrics are reported as mean ± 95% CI across repeated trials. Proportion-based metrics are reported as point estimates. κ SVR (%) Energy RMSE (cm) 0.5 1.82 0.91 ± 0.03 2.4 ± 0.2 1.5 0.93 0.95 ± 0.03 2.7 ± 0.2 3.0 0.58 0.96 ± 0.03 2.9 ± 0.2 5.0 0.41 1.04 ± 0.04 3.3 ± 0.2 The resulting curve exhibits a clear “knee”: moderate κ values (around 3.0) offer substantial safety improvements with only marginal energy overhead, whereas further increases lead to diminishing returns. SafeMind’s meta-adaptive mechanism operates near this knee in most scenarios, adjusting κ upward only when uncertainty grows, and thereby remaining close to the empirical safety–performance Pareto frontier. X-H Failure Case Analysis Although SafeMind shows strong overall performance, minor failure modes persist. We group the observed failures into four categories. First, on highly compliant or abruptly changing terrain, mild pitch oscillations can appear when contact uncertainty is underestimated over several consecutive steps. Second, on extreme rubble or partial footholds, occasional foot scuffing occurs when local barrier curvature becomes difficult to estimate reliably near sharp geometric discontinuities. Third, under temporary semantic ambiguity or low-confidence perception, SafeMind may become briefly over-conservative, slowing down rather than violating hard physical constraints. Fourth, in rare cases involving simultaneous activation of multiple hard constraints, the controller approaches the edge of QP feasibility and exhibits short near-boundary excursions. These issues arise when compounded uncertainties lead to regions where local barrier curvature becomes difficult to estimate. Importantly, such violations remain subcritical, appearing as brief near-boundary excursions rather than catastrophic failures, consistent with graceful degradation in safe control literature [brunke2022safelearning]. These failure cases are consistent with the mode-wise scope of the proposed theory: they occur primarily when contact transitions, perception degradation, or severe environment shifts stress the assumptions used in the stochastic safety model. They therefore highlight practical limitations of the current implementation rather than contradictions of the nominal safety construction. Collectively, ablation, sensitivity, and long-horizon evaluations indicate that SafeMind’s robustness stems from the coordinated interaction of uncertainty modeling, adaptive risk shaping, and differentiable multi-constraint optimization, rather than rigid worst-case conservatism. XI Discussion and Limitations Although SafeMind demonstrates strong safety, adaptability, and efficiency across both simulation and hardware experiments, several limitations should be noted. First, the theoretical guarantees are derived under a mode-wise stochastic formulation and therefore apply most directly within continuous contact phases. In hybrid quadruped locomotion, contact switches and impact events are handled in practice through conservative margins, fast replanning, and low-level stabilization rather than through a complete global hybrid-system proof. Second, the effectiveness of the proposed safety layer depends on the quality of uncertainty estimation and semantic perception. If covariance is substantially underestimated, or if semantic context is severely misclassified, the resulting barrier modulation may become insufficiently conservative or temporarily over-conservative. While the experiments show graceful degradation in such cases, these effects remain an important practical limitation. Third, although SafeMind generalizes across the two quadruped platforms studied here and remains robust under morphology perturbations such as added payload and partial leg impairment, extension to substantially different robot morphologies or higher-dimensional systems is not automatic. Such transfer requires task-appropriate barrier construction, contact-aware uncertainty modeling, and solver configurations consistent with the new dynamics. Fourth, any SystemC- or virtual-prototype-based backend discussed as part of the broader development workflow remains conceptual in the current version. It is not a fully validated component of the deployed SafeMind control stack, and the experimental results reported in this paper do not rely on end-to-end verification through that backend. Finally, the current semantic integration mechanism is designed so that physical safety constraints retain priority over semantic preferences. This avoids unsafe behavior under conflicting instructions, but may also lead to conservative task execution in environments with ambiguous or low-confidence semantic cues. A more principled confidence-aware arbitration mechanism remains an important direction for future work. XII Conclusion We presented SafeMind, a stochastic, semantic-aware, and differentiable safety-control framework that integrates variance-aware barrier modeling, risk-sensitive optimization, and meta-adaptive parameter shaping. Extensive simulation and hardware experiments demonstrate substantial reductions in safety violation rates while maintaining or improving tracking accuracy and energy efficiency, particularly under abrupt terrain changes and severe uncertainty. Additional analyses show that SafeMind’s robustness arises from the synergy among stochastic correction, adaptive risk modulation, and semantic grounding. These results highlight probabilistic safety reasoning with differentiable control as a promising paradigm for reliable real-world legged locomotion. References Zukun Zhang was born in Shanxi Province, China. He received the B.S. degree in Mechanical Design, Manufacturing and Automation from Taiyuan University of Technology. He is currently pursuing his studies at The University of Hong Kong, Pokfulam, Hong Kong. His interests include reading and sports. He can be contacted at zhangzukun2025@126.com. Kai Shu was born in Zhejiang Province, China. He earned his bachelor’s degree in Electronic Information Engineering from Xidian University, followed by a master’s degree in Computer Science from the University of Southern California. After graduation, he joined Alibaba Group, where he has been engaged in algorithm research and software development. His professional and research interests focus on Computer Vision (CV), Natural Language Processing (NLP), and AI for Science (AI4Science). He is particularly interested in applying advanced artificial intelligence techniques to solve complex real-world and scientific problems.His interests include reading and sports. He can be contacted at kaishu.cs@gmail.com. Mingqiao Mo was born in China. He is currently an intern at the University of the Chinese Academy of Sciences. He joined in January 2024. He has previously held research internship positions at Tsinghua University, the University of California, Los Angeles, and Cornell University. His research experience spans multiple leading academic institutions from 2023 to 2025.His research interests include large language model (LLM) reasoning, diffusion models, and computer vision. He has authored and co-authored several research papers in the areas of compiler optimization, robust representation learning, and multimodal reasoning, with submissions to top-tier conferences such as ACL, AAMAS, ICLR, and WACV. His recent work focuses on leveraging large language models for program optimization and robust code representation learning.

Instant research discovery