Paper deep dive

Adversarially Robust Geometric Safety Certificates for Nonholonomic Robots Against Maneuvering Obstacles

Chandan Kumar Sah, Bazeela Banday, Jishnu Keshavan

Year: 2026Venue: arXiv preprintArea: cs.ROType: PreprintEmbeddings: 118

Intelligence

Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 91%

Last extracted: 9/30/2026, 6:28:00 AM

Summary

This paper proposes Adversarially Robust Dynamic Parabolic Control Barrier Functions (AR-DPCBF) for nonholonomic robots to ensure safe navigation against maneuvering obstacles. The method exploits a structural property of line-of-sight (LoS) certificates where robot and obstacle actions share a common geometric gain, allowing the worst-case differential game to be reduced to a comparison of maneuvering capabilities. This results in a closed-form contraction of certificate parameters to guarantee forward invariance. The framework includes a sliding-window estimator for unknown obstacle capabilities and soft/buffered variants for dense environments.

Entities (8)

AR-DPCBF · method · 98%Control Barrier Function · concept · 95%Kinematic Bicycle Model · model · 92%Line-of-Sight · concept · 90%Maneuvering Obstacle · entity · 90%Nonholonomic Robot · entity · 90%Sliding-Window Estimator · method · 88%Differential Game · concept · 85%

Relation Signals (6)

AR-DPCBF → isa → Control Barrier Function

confidence 95% · Instantiated on the parabolic certificate, the construction yields Adversarially Robust Dynamic Parabolic Control Barrier Functions (AR-DPCBF)

AR-DPCBF → handles → Maneuvering Obstacle

confidence 92% · We propose an adversarially robust geometric certificate that accounts for the worst-case effect of admissible obstacle maneuvers

AR-DPCBF → appliesto → Nonholonomic Robot

confidence 90% · Adversarially Robust Geometric Safety Certificates for Nonholonomic Robots

AR-DPCBF → uses → Line-of-Sight

confidence 90% · The construction exploits a structural property of line-of-sight (LoS) certificates

AR-DPCBF → assumesdynamics → Kinematic Bicycle Model

confidence 88% · under kinematic bicycle dynamics with bounded inputs.

Sliding-Window Estimator → supports → AR-DPCBF

confidence 85% · When the obstacle capability is unknown, a sliding-window estimator supplies a high-probability upper bound, allowing the guarantee to be retained

Cypher Suggestions (0)

No Cypher suggestions yet.

Abstract

Abstract:Safe navigation against obstacles that can actively maneuver within bounded capabilities remains challenging: robust control barrier function methods typically treat obstacle actions as generic disturbances, while differential-game approaches are computationally expensive for online navigation. We propose an adversarially robust geometric certificate that accounts for the worst-case effect of admissible obstacle maneuvers directly in the safe-set geometry through a closed-form contraction of the certificate parameters. The construction exploits a structural property of line-of-sight (LoS) certificates: the robot and obstacle actions enter the certificate through a common state-dependent geometric gain. This gain cancels in the worst-case comparison, reducing the differential game to a direct comparison between obstacle maneuvering capability and the weaker of the robot's longitudinal and steering authorities. Instantiated on the parabolic certificate, the construction yields Adversarially Robust Dynamic Parabolic Control Barrier Functions (AR-DPCBF), for which we establish sufficient conditions for forward invariance of the contracted safe set against all admissible obstacle maneuvers under kinematic bicycle dynamics with bounded inputs. When the obstacle capability is unknown, a sliding-window estimator supplies a high-probability upper bound, allowing the guarantee to be retained with the corresponding coverage probability. We further formulate soft and buffered variants to recover feasibility in dense environments. Simulations across obstacle capabilities, densities, and capability mismatch show substantial reductions in barrier violations and collisions and demonstrate that pointwise robustification of the barrier derivative cannot substitute for contraction of its geometry.

PDF

Open source PDF →Open local PDF →

Trouble viewing inline? Open PDF directly →

Full Text

115,048 characters extracted from source content.

Expand or collapse full text

Adversarially Robust Geometric Safety Certificates for Nonholonomic Robots Against Maneuvering Obstacles Thanks: The authors are with the Department of Mechanical Engineering, Indian Institute of Science, Bangalore, Karnataka 560012, India (email: chandanks@iisc.ac.in, bazeelab@iisc.ac.in, kjishnu@iisc.ac.in). [Author names omitted for blind review] Chandan Kumar Sah Bazeela Banday Jishnu Keshavan Abstract Safe navigation against obstacles that can actively maneuver within bounded capabilities remains challenging: robust control barrier function methods typically treat obstacle actions as generic disturbances, while differential-game approaches are computationally expensive for online navigation. We propose an adversarially robust geometric certificate that accounts for the worst-case effect of admissible obstacle maneuvers directly in the safe-set geometry through a closed-form contraction of the certificate parameters. The construction exploits a structural property of line-of-sight (LoS) certificates: the robot and obstacle actions enter the certificate through a common state-dependent geometric gain. This gain cancels in the worst-case comparison, reducing the differential game to a direct comparison between obstacle maneuvering capability and the weaker of the robot’s longitudinal and steering authorities. Instantiated on the parabolic certificate, the construction yields Adversarially Robust Dynamic Parabolic Control Barrier Functions (AR-DPCBF), for which we establish sufficient conditions for forward invariance of the contracted safe set against all admissible obstacle maneuvers under kinematic bicycle dynamics with bounded inputs. When the obstacle capability is unknown, a sliding-window estimator supplies a high-probability upper bound, allowing the guarantee to be retained with the corresponding coverage probability. We further formulate soft and buffered variants to recover feasibility in dense environments. Simulations across obstacle capabilities, densities, and capability mismatch show substantial reductions in barrier violations and collisions and demonstrate that pointwise robustification of the barrier derivative cannot substitute for contraction of its geometry. [Project page] [Code] Index Terms: Control barrier functions, dynamic obstacle avoidance, differential games, adversarial robustness. I Introduction Safe navigation in dynamic environments requires a robot to remain collision-free despite uncertainty in the future motion of the surrounding obstacles. When obstacles maneuver within bounded acceleration and turning capabilities, safety acquires an adversarial character: the robot must maintain a valid safety certificate against every admissible obstacle action. The difficulty is accentuated for nonholonomic robots, whose limited steering authority couples collision avoidance to the robot–obstacle relative geometry and to the heading dynamics [1, 2]. Control Barrier Functions (CBFs) [3] provide a computationally efficient way to enforce forward-invariance requirements. For nonholonomic systems, however, control inputs affect position through the vehicle heading, causing distance-based safety constraints to have a higher relative degree. High-Order CBFs [4, 5] recover explicit input dependence by repeated differentiation, but the resulting constraints can become conservative or jointly infeasible when multiple obstacles are considered. This has motivated approaches that reason directly about relative motion. Velocity Obstacle (VO) methods characterize relative velocities that inevitably lead to collision [6]. Collision-cone CBFs incorporate this geometry into safety-critical control [7]. Meanwhile, Dynamic Parabolic CBFs (DPCBFs) [8] reduce conservatism using a state-dependent parabolic boundary in the LoS relative-velocity frame. These geometric certificates are defined in terms of relative velocity and clearance and are evaluated using the obstacle’s instantaneous velocity. The premise is restrictive precisely when obstacles maneuver. An accelerating or turning obstacle changes the relative velocity after certification, so the certificate can be invalidated while the constraint the controller enforces remains satisfied and feasible. This failure is silent and it is a loss of soundness rather than of margin. Robust CBF formulations account for bounded disturbances and modeling uncertainty. Worst-case constructions tighten the barrier condition by the largest admissible disturbance effect [9, 10, 11, 12]; input-to-state-safe and parameterized formulations trade a quantified set inflation against disturbance magnitude [13, 14, 15]; and observer-based schemes reduce conservatism by estimating the disturbance online [16, 17, 18]. Closest to the present setting, robust barriers of high relative degree have been designed for unknown moving obstacles [19]. Treating obstacle maneuvers as generic disturbances, however, places the margin on the barrier derivative without reflecting how acceleration and turning act on the relative motion, so the resulting margins need not preserve the relative-motion geometry on which the certificate rests. Differential-game methods provide a principled formulation of this worst-case problem. The set of states from which an obstacle can force a collision can be characterized through Hamilton-Jacobi-Isaacs (HJI) reachability [20, 21]. However, the computational complexity of HJI methods grows rapidly with state dimension, making repeated online computation difficult for multi-obstacle navigation. The notion of an Inevitable Collision State (ICS) [22] provides a corresponding characterization of states that must be excluded under adversarial obstacle behavior. These approaches therefore motivate a tractable approximation of the adversarial safe set that retains explicit worst-case reasoning without requiring online solution of a full differential game. In this paper, we characterize the adversarial safe set geometrically. Modeling the obstacle as an agent with bounded acceleration and turning rate, we show that its entire set of admissible maneuvers acts on a LoS certificate via a single scalar capability, and that the robot’s acceleration and steering act on the same certificate via the same geometric factor. The worst-case comparison, therefore, reduces to an inequality between the maneuvering capability of the obstacle and the actuation authority of the robot. This reduction also identifies where robustness must be introduced. Rather than robustifying the instantaneous barrier rate, we preserve the worst-case margin in the barrier geometry by contracting its parameters, yielding an inner approximation of the adversarial safe set. We show that pointwise robustification constrains the instantaneous barrier rate, whereas contraction excludes states from which any admissible control cannot maintain the certificate. Instantiating the construction on the parabolic barrier family yields AR-DPCBF, for which we establish forward invariance of the contracted safe set with respect to all admissible obstacle maneuvers for a kinematic bicycle model subject to input constraints. The framework also addresses uncertainty in the obstacle’s capability. We develop an online sliding-window estimator that provides a high-probability upper bound on the true obstacle capability, allowing the estimated capability to be incorporated into the adversarial barrier while retaining the safety guarantee of the known-capability formulation. Since the contracted adversarial safe set can reduce QP feasibility in dense environments, we additionally introduce soft and buffered AR-DPCBF formulations that retain the nominal DPCBF constraint while penalizing violations of the adversarial condition, providing different safety-feasibility trade-offs. The main contributions of the paper are as follows. 1. We identify a silent failure mode of LoS-frame geometric safety certificates under maneuvering obstacles and formulate the corresponding adversarial CBF condition over the obstacle’s structured capability set. 2. We show that for LoS certificates that are affine in longitudinal and quadratic in lateral relative velocity, the robot and obstacle actions share a common geometric gain. Its cancellation reduces the adversarial condition to a comparison between obstacle-maneuvering capability and robot actuation authority, thereby yielding sufficient conditions for forward invariance. 3. We introduce a closed-form contraction of the certificate parameters that reserves the worst-case margin in the safe-set geometry. The resulting AR-DPCBF is shown to be strictly stronger than pointwise robustification. 4. We develop a sliding-window estimator that provides a high-probability upper bound on the unknown obstacle’s capability, enabling an adversarial certificate without prior knowledge of its capability. 5. We formulate hard, soft, and buffered variants to retain feasibility in dense environments, and evaluate them against other baselines using paired Monte Carlo trials. The remainder of the paper is organized as follows. Section I introduces the problem formulation and preliminaries. Sections I and IV develop the proposed AR-DPCBF framework and establish its theoretical guarantees. Section IV-G extends the framework to account for unknown obstacle capabilities via online capability estimation, while Section V presents soft-constrained variants. Section VI evaluates the proposed approach through simulation studies, and Section VII concludes the paper. I Background and Problem Statement I-A Control Barrier Functions Consider the control-affine system ˙=⁡()+⁡(), x= f( x)+ g( x) u, (1) where ∈⊂ℝn x ^n, ∈⊂ℝm u ^m, and , f, g are locally Lipschitz. Let h:ℝn→ℝh:R^n be continuously differentiable and define the safe set =∈∣h⁡()≥0.C=\ x h( x)≥ 0\. (2) Definition 1 (Control Barrier Function [3]). A continuously differentiable function h:ℝn→ℝh:R^n is a control barrier function (CBF) for (1) if there exists ψ∈∞ψ _∞ (a continuous, strictly increasing function with ψ⁡(0)=0ψ(0)=0) such that sup∈[Lh()+Lh()]≥−ψ⁡(h⁡())∀∈, _ u [L_ fh( x)+L_ gh( x)\, u ]≥-ψ(h( x)) ∀ x , (3) where Lh=∇h()⊤()L_ fh=∇ h( x) f( x) and Lh=∇h()⊤()L_ gh=∇ h( x) g( x) denote Lie derivatives. Given a CBF h, define the set of safe control inputs cbf()=∈∣Lh()+Lh()≥−ψ⁡(h⁡()).K_cbf( x)= \ u L_ fh( x)+L_ gh( x)\, u≥-ψ(h( x)) \. (4) Any locally Lipschitz controller =⁡()∈cbf() u= π( x) _cbf( x) renders C forward invariant: ⁡(0)∈⇒⁡(t)∈for all t≥0. x(0) \; \; x(t) all t≥ 0. In practice, the safe control is computed at each time step by solving the CBF-QP ∗ u^* =arg⁡min∈⁡‖−ref‖2 = _ u \| u- u_ref\|^2 (5) subject to to Lh()+Lh()≥−ψ⁡(h⁡()). L_ fh( x)+L_ gh( x)\, u≥-ψ\! (h( x) ). which minimally deviates from a reference control ref u_ref while enforcing the CBF constraint. I-B Kinematic Bicycle Model The robot is modeled as a kinematic bicycle [23], a standard approximation for nonholonomic vehicles at low-to-moderate speeds. The state is =[x,y,θ,v]⊤ x=[x,y,θ,v] , comprising the CoM position (x,y)(x,y), heading θ, and forward speed v (Fig. 1a). Under the small-slip approximations tan⁡β≈β β≈β and sin⁡β≈β β≈β, the dynamics take the control-affine form (1), ⁡()=[vcos⁡θvsin⁡θ00],⁡()=[0−vsin⁡θ0vcos⁡θ0v/ℓr10],=[aβ], f( x)= bmatrixv θ\\ v θ\\ 0\\ 0 bmatrix,\; g( x)= bmatrix0&-v θ\\ 0&v θ\\ 0&v/ _r\\ 1&0 bmatrix,\; u= bmatrixa\\ β bmatrix, (6) where a is the longitudinal acceleration, β the slip-angle input, and ℓr _r the rear-axle-to-CoM distance. The admissible control set is =(a,β)||a|≤amax,|β|≤βmax,U= \(a,β)\; |\;|a|≤ a_ ,\;|β|≤ _ \, (7) where amax,βmax>0a_ , _ >0 denote upper bounds on the magnitudes of the longitudinal acceleration and slip angle, respectively. It is convenient to separate the two components of the robot velocity. Writing ^rob=[cos⁡θ,sin⁡θ]⊤ e_rob=[ θ, θ] for the heading direction and ^rob⟂ e _rob for its counterclockwise normal, (6) gives ˙=v^rob+vβ^rob⟂, p=v\, e_rob+\;vβ\, e _rob, with rob:=v^rob v_rob:=v\, e_rob. So the center-of-mass velocity is the sum of the no-slip velocity rob v_rob and a lateral component generated by the slip-angle input. Fig. 1: Kinematic bicycle model and line-of-sight (LoS) relative-motion geometry. (a) Kinematic bicycle model with state =[x,y,θ,v]⊤ x=[x,y,θ,v] and control input =[a,β]⊤ u=[a,β] . (b) Robot-obstacle relative parameters expressed in the LoS frame. I-C DPCBF Review The DPCBF [8] instantiates the CBF condition (3) for dynamic obstacle avoidance by constructing a parabolic barrier in the Line-of-Sight (LoS) relative-velocity frame. LoS-frame geometry Figure 1 illustrates the coordinate transformation. The robot and obstacle positions and velocities, ,rob p, v_rob and obs,obs p_obs, v_obs, respectively, define the relative quantities rel=obs−,rel=obs−rob. p_rel= p_obs- p, v_rel= v_obs- v_rob. (8) The barrier constructed below depends on the obstacle state as well as on the robot state. Accordingly, X denotes the joint robot-obstacle state space and, with a slight abuse of notation, x denotes the joint state (x,y,θ,v,xobs,yobs,θobs,vobs)(x,y,θ,v,x_obs,y_obs, _obs,v_obs) whenever it appears as the argument of d, λ, μ, h or h∗h^*; the robot dynamics (6) act on its first four components and the obstacle dynamics (13) on the remaining four. Lie derivatives are taken with respect to (6), the obstacle inputs entering as the disturbance of Definition 4. The LoS frame (Fig. 1b) is obtained by rotating the global frame so that its x~ x-axis aligns with rel p_rel. The corresponding LoS angle is, α=atan2⁡(prel,y,prel,x),α=atan2(p_rel,y,p_rel,x), with a rotation matrix ⁡(α)=[cos⁡α−sin⁡αsin⁡αcos⁡α]. R(α)= bmatrix α&- α\\ α& α bmatrix. (9) The relative velocity in the LoS-frame is ~rel=⁡(−α)rel v_rel= R(-α) v_rel, with components (v~rel,x,v~rel,y)( v_rel,x, v_rel,y). The tangential clearance from the combined safety circle of radius r=rrob+robsr=r_rob+r_obs is d⁡()=‖rel‖2−r2.d( x)= \| p_rel\|^2-r^2. (10) DPCBF candidate The DPCBF barrier function [8] is h⁡()=v~rel,x+λ⁡()v~rel,y2+μ⁡(),h( x)= v_rel,x+λ( x) v_rel,y^2+μ( x), (11) with state-dependent parameters λ⁡()=kλd⁡()‖rel‖,μ⁡()=kμd(),λ( x)=k_λ d( x)\| v_rel\|, μ( x)=k_μd( x), (12) for tunable gains kλ,kμ>0k_λ,k_μ>0. The zero level set h=0\h=0\ defines a parabola in the LoS-frame velocity space: states with h⁡()≥0h( x)≥ 0 are safe, whereas those with h⁡()<0h( x)<0 are unsafe. I-D Obstacle Capability Set and Adversarial CBF We model the obstacle as a controlled agent whose Maneuvering authority is bounded by a capability set, defined as, Definition 2 (Obstacle Capability Set). We model each obstacle as a kinematic agent whose motion is governed by unicycle-like dynamics, with longitudinal acceleration aobsa_obs and angular rate ωobs _obs as inputs. The obstacle state (xobs,yobs,θobs,vobs)(x_obs,y_obs, _obs,v_obs) evolves as x˙obs x_obs =vobscosθobs, =v_obs _obs, y˙obs y_obs =vobssinθobs, =v_obs _obs, (13) θ˙obs θ_obs =ωobs, = _obs, v˙obs v_obs =aobs. =a_obs. The obstacle’s Maneuvering authority is bounded by the capability set ℱ=(aobs,ωobs)∈ℝ2||aobs|≤aobs,max,|ωobs|≤ωobs,max.F= \(a_obs, _obs) ^2\; |\; aligned |a_obs|&≤ a_obs,max,\\ | _obs|&≤ _obs,max aligned \. (14) where aobs,max,ωobs,max≥0a_obs,max, _obs,max≥ 0 are known upper bounds on the obstacle’s translational acceleration and turning rate, respectively. The obstacle speed vobs(t)∈[0,vobs,max]v_obs(t)∈[0,v_obs,max] for all t, where vobs,maxv_obs,max is a physical speed limit. Remark 1. The rectangular shape of ℱF decouples the two authority axes and is the key structural property that allows the supremum in Section IV to separate into independent bounds on |P⁡(ϕ)||P(φ)| and |Q⁡(ϕ)||Q(φ)|, yielding closed-form adversarial parameters. The extension to a more physically realistic Kamm circle constraint aobs2+(vobsωobs)2≤κKamm2a_obs^2+(v_obs _obs)^2≤ _Kamm^2 would require solving a trust-region problem. Definition 3 (Inevitable Collision State [22]). A state x is an inevitable collision state (ICS) if, for every robot control rob:[0,∞)→ u_rob:[0,∞) , there exists a disturbance trajectory (aobs(t),ωobs(t))∈ℱ(a_obs(t), _obs(t)) such that ‖⁡(t)−obs(t)‖<r\| p(t)- p_obs(t)\|<r for some t>0t>0. The set of all ICS is ℐ⊂I . Remark 2. In Definition 3, the obstacle may choose its maneuver knowing the robot’s entire control signal. This is the open-loop form of the ICS. It gives the obstacle at least as much power as the nonanticipative strategies used in differential games [20, 24], since every such strategy yields an admissible disturbance trajectory once the robot control is fixed. We seek a barrier function whose zero super-level set excludes the ICS region. To make this precise, let h∗:→ℝh^*:X be a function to be designed and define: ∗:=∈∣h∗()≥0.C^*\;:=\;\ x h^*( x)≥ 0\. Exactly characterizing ℐI requires solving a HJI PDE, which is computationally intractable in general. In particular, choosing h∗h^* so that ∗=∖ℐC^*=X exactly is not tractable. Our approach instead constructs ∗C^* as a conservative inner approximation, ∗⊆∖ℐC^* , via a parabolic ansatz whose parameters are chosen to satisfy Nagumo’s condition against all ℱF-admissible obstacle maneuvers. Definition 4 (Adversarial CBF (A-CBF)). Let h∗:→ℝh^*:X be continuously differentiable with ∇h∗()≠0∇ h^*( x)≠ 0 on ∂∗=h∗=0 ^*=\h^*=0\, and let ℬ⊆∂∗B ^*. Then h∗h^* is an adversarial control barrier function for (6) with respect to ℱF on ℬB if, for all ∈ℬ x and all (aobs,ωobs)∈ℱ(a_obs, _obs) , there exists ∈ u satisfying h˙∗(,,aobs,ωobs)≥ 0, h^*( x, u,a_obs, _obs)\;≥\;0, (15) where h˙∗ h^* is evaluated along the robot dynamics (6) and the obstacle dynamics (13), and is therefore a function of the robot input and of the obstacle input alike. Condition (15) is the boundary (Nagumo) form of the standard CBF condition (3), and is equivalent to requiring h˙∗≥0 h^*≥ 0 at x for every admissible obstacle input and some admissible robot input. The implemented controller enforces the relaxed inequality h˙∗≥−ψ⁡(h∗) h^*≥-ψ(h^*), which coincides with (15) on ∂∗ ^*. Remark 3. The standard CBF condition (3) is a single-agent maximization, sup∈(Lh+Lh)≥−ψ⁡(h), _ u (L_ fh+L_ gh\, u )≥-ψ(h), where the robot is the only decision maker and the obstacle dynamics is fixed. In contrast, the A-CBF condition (15) introduces a universal quantification over the obstacle capability set, ∀(aobs,ωobs)∈ℱ,∃∈,∀\,(a_ obs, _ obs) ,\;∃\, u , such that the barrier inequality holds. Thus, the safety certificate is required to hold for every admissible obstacle maneuver rather than a single nominal obstacle model. This yields the minimax logical structure characteristic of differential games. I-E LoS-Frame Relative Dynamics A key step in the adversarial formulation is transferring the robot-obstacle interaction to the LoS frame. The following lemma derives the LoS-frame relative dynamics exactly and isolates the frame-rotation terms. Lemma 1. Under the robot model (6) and obstacle dynamics (13), the LoS-frame relative velocity evolves exactly as v~˙rel,x v_rel,x =aobscosθ~obs−vobsωobssinθ~obs =a_obs θ_obs-v_obs _obs θ_obs −acos⁡θ~+v2ℓrβsin⁡θ~+Rx, -a θ+ v^2 _r\,β θ+R_x, (16) v~˙rel,y v_rel,y =aobssinθ~obs+vobsωobscosθ~obs =a_obs θ_obs+v_obs _obs θ_obs −asin⁡θ~−v2ℓrβcos⁡θ~+Ry, -a θ- v^2 _r\,β θ+R_y, (17) where θ~=θ−α θ=θ-α and θ~obs=θobs−α θ_obs= _obs-α are the robot and obstacle headings in the LoS frame, respectively, and the frame-rotation terms admit the exact closed form: Rx=α˙v~rel,y,Ry=−α˙v~rel,x,R_x= α\, v_rel,y, R_y=- α\, v_rel,x, (18) with α˙=rel×˙rel‖rel‖2=rel×rel‖rel‖2⏟α˙0−vβ(rel×^rob⟂)‖rel‖2⏟α˙slip, α= p_rel× p_rel\| p_rel\|^2= p_rel× v_rel\| p_rel\|^2_ α_0\; -\; vβ\,( p_rel× e _rob)\| p_rel\|^2_ α_slip, (19) where ˙rel=rel−vβ^rob⟂ p_rel= v_rel-vβ\, e _rob follows from (6). Consequently, |Rx|,|Ry|≤‖rel‖(‖rel‖+v|β|)‖rel‖≤CR‖rel‖,|R_x|,\,|R_y|\;≤\; \| v_rel\| (\| v_rel\|+v\,|β| )\| p_rel\|\;≤\; C_R\| p_rel\|, (20) with CR:=vrel,max(vrel,max+vmaxβmax)C_R:=v_rel,max (v_rel,max+v_ _ ), and the rotation terms vanish as ‖rel‖→∞\| p_rel\|→∞. Proof. Frame rotation. Differentiating ~rel=⁡(−α)rel v_rel= R(-α) v_rel gives ~˙rel=⁡(−α)˙rel+˙(−α)rel v_rel= R(-α) v_rel+ R(-α) v_rel. Since dφ(φ)=(φ) dd R( )= J\, R( ) with =[0−110] J= bmatrix0&-1\\ 1&0 bmatrix the 90∘90 counterclockwise rotation generator, ˙(−α)=−α˙(−α) R(-α)=- α\, J\, R(-α), and hence, ˙(−α)rel=−α˙~rel=α˙[v~rel,y−v~rel,x]⊤, R(-α) v_rel=- α\, J\, v_rel= α bmatrix v_rel,y&- v_rel,x bmatrix , which is (18). Since α=atan2⁡(prel,y,prel,x)α=atan2(p_rel,y,p_rel,x), α˙=(rel×˙rel)/‖rel‖2 α=( p_rel× p_rel)/\| p_rel\|^2. Substituting ˙rel=rel−vβ^rob⟂ p_rel= v_rel-vβ\, e _rob yields (19). Translational accelerations. The obstacle velocity is obs=vobs^obs v_obs=v_obs e_obs with ^˙obs=θ˙obs^obs⟂ e_obs= θ_obs e _obs, so by (13), ˙obs=aobs^obs+vobsωobs^obs⟂ v_obs=a_obs e_obs+v_obs _obs e _obs. Similarly, the no-slip robot velocity rob=v^rob v_rob=v\, e_rob satisfies, ˙rob=v˙^rob+vθ˙^rob⟂=a^rob+v2ℓrβ^rob⟂, v_rob= v\, e_rob+v\, θ\, e _rob=a\, e_rob+ v^2 _r\,β\, e _rob, using v˙=a v=a and θ˙=(v/ℓr)β θ=(v/ _r)β from (6). Using ⁡(−α) R(-α), ⁡(−α)^obs=[cos⁡θ~obssin⁡θ~obs],⁡(−α)^obs⟂=[−sin⁡θ~obscos⁡θ~obs], R(-α) e_obs= bmatrix θ_obs\\ θ_obs bmatrix, R(-α) e _obs= bmatrix- θ_obs\\ - θ_obs bmatrix, and analogously for ^rob,^rob⟂ e_rob, e _rob with θ~ θ. Substituting ˙rel=˙obs−˙rob v_rel= v_obs- v_rob and separating the x~ x- and y~ y-components yields (16)–(17). Residual bound. From (18), |Rx|,|Ry|≤|α˙|‖rel‖|R_x|,|R_y|≤| α|\,\| v_rel\|, and from (19), |α˙|≤‖˙rel‖/‖rel‖≤(‖rel‖+v|β|)/‖rel‖| α|≤\| p_rel\|/\| p_rel\|≤(\| v_rel\|+v|β|)/\| p_rel\|, giving (20). ∎ I Adversarially Robust Barrier Parameters This section constructs the adversarial barrier h∗h^* and establishes that its safe set is a subset of the nominal DPCBF safe set, thus inheriting the collision-avoidance guarantee of [8]. I-A Setup and the maneuver gap We build on the DPCBF formulation. Under the no-slip assumption (β=0β=0), differentiating the clearance d⁡()=‖rel‖2−r2d( x)= \| p_rel\|^2-r^2 along the robot dynamics gives d˙0=rel⊤rel/d=‖rel‖v~rel,x/d, d_0= p_rel^\! v_rel/d=\| p_rel\|\, v_rel,x/d, (21) so the clearance rate and longitudinal LoS velocity v~rel,x v_rel,x have the same sign. To account for maneuvering obstacles, we contract the nominal DPCBF barrier (11) to reserve a margin against worst-case admissible maneuvers. The following subsections derive the contraction from obstacle capability and establish the resulting safety guarantee. I-B Standing assumptions Assumption 1. The obstacle inputs lie in the rectangle ℱ=(aobs,ωobs):|aobs|≤aobs,max,|ωobs|≤ωobs,maxF=\(a_obs, _obs):|a_obs|≤ a_obs,max,\,| _obs|≤ _obs,max\, and, per Definition 2, vobs≤vobs,maxv_obs≤ v_obs,max. Since ˙obs=aobs^obs+vobsωobs^obs⟂ v_obs=a_obs e_obs+v_obs _obs e_obs , the scalar, obstacle capability, κ:=aobs,max+vobs,maxωobs,max[ms−2]κ:=a_obs,max+v_obs,max _obs,max [m\,s^-2] (22) bounds ∥˙obs∥ v_obs over ℱF. It is the single number summarizing how hard the obstacle can maneuver. Assumption 2. The robot holds a forward speed v∈[vmin,vmax]v∈[v_ ,v_ ] with vmin>0v_ >0, and its inputs =(a,β) u=(a,β) obey |a|≤amax|a|≤ a_ , |β|≤βmax|β|≤ _ , i.e. ∈ u . The lower bound vmin>0v_ >0 is essential because the bicycle’s steering authority scales as v2/ℓrv^2/ _r and vanishes at rest, so a stationary robot cannot steer to defend the barrier. Assumption 3. Let vrel,min>0v_rel,min>0 and dmax>rd_ >r be design parameters and define the engagement envelope Ω:=∈:d()≤dmax,∥rel∥≥vrel,min. := \ x \;:\;d( x)≤ d_ ,\;\; v_rel ≥ v_rel,min \. (23) The parameters vrel,minv_rel,min and dmaxd_ are design parameters specified in Corollary 4 and Lemma 14 (Appendix B). Assumption 4 (DPCBF clearance property [8]). For every t≥0t≥ 0 and every closed-loop trajectory with d⁡(0)>rd(0)>r satisfying h⁡(⁡(τ))≥0h( x(τ))≥ 0 for all τ∈[0,t]τ∈[0,t], the clearance satisfies d⁡(τ)≥rd(τ)≥ r for all τ∈[0,t]τ∈[0,t]. Proposition 2. Under Assumptions 1-3: vrel,min≤∥rel∥≤vrel,max,2r≤∥rel∥≤pmax,v_rel,min≤ v_rel ≤ v_rel,max,\; 2\,r≤ p_rel ≤ p_ , throughout, ℬ:=∂∗∩Ω∩d≥r,B:= ^*∩ ∩\d≥ r\, where, vrel,max:=vmax+vobs,max,pmax:=dmax2+r2.v_rel,max:=v_ +v_obs,max,\;p_ := d_ ^2+r^2. Consequently, every denominator appearing below is uniformly bounded away from zero on ℬB, and ℬB is compact. Proof. The bounds follow directly from Assumptions 1-3, the triangle inequality, and the identity ∥rel∥2=d2+r2 p_rel ^2=d^2+r^2. Compactness of ℬB is immediate from its definition as a closed subset of a compact set. ∎ Remark 4. The engagement envelope Ω specifies the domain over which the adversarial certificate is established. It is not enforced as a state constraint by the QP. If ∥rel∥<vrel,min v_rel <v_rel,min, the parameter λ=kλd/∥rel∥λ=k_λd/ v_rel becomes ill-conditioned, and the certificate we establish later (Theorem 10) no longer applies, as in the nominal DPCBF formulation [8]. Fig. 2: Adversarial contraction of the safe-set boundary in the line-of-sight velocity frame. Dashed: DPCBF h=0\h=0\; solid: AR-DPCBF h∗=0\h^*=0\. The safe set lies to the right. Since λ∗≤λ^*≤λ and μ∗≤μ^*≤μ, h∗≥0⊆h≥0\h^*≥ 0\ \h≥ 0\. (a) Increasing κ increases contraction, recovering DPCBF at κ=0κ=0. (b) Lower ‖rel‖\| v_rel\| increases contraction through the 1/‖rel‖1/\| v_rel\| reaction-time scaling. (c) Contraction increases with clearance d. I-C The contracted parameters Motivated by the maneuver gap identified above, we derive contracted barrier parameters that allocate part of the nominal DPCBF certificate as a robustness margin against worst-case admissible obstacle maneuvers. Theorem 3. Let γ>0γ>0 be a dimensionless design gain and amaxa_ the reference acceleration of Assumption 2. Define λ∗() λ^*( x) =kλd∥rel∥−Δλ, = k_λd v_rel - λ, Δλ λ =κγamax∥rel∥≥0, = κγ\,a_ \, v_rel \ ≥ 0, (24) μ∗() μ^*( x) =kμd−Δμ, =k_μd- μ, Δμ μ =κdγ∥rel∥≥0, = κ\,dγ\, v_rel \ ≥ 0, (25) and the adversarial barrier, h∗()=v~rel,x+λ∗v~rel,y2+μ∗. h^*( x)= v_rel,x+λ^* v_rel,y^2+μ^*. (26) Writing the discarded margin as the buffer b⁡():=Δλv~rel,y2+Δμ≥0,h∗=h−b,b( x):= λ\, v_rel,y^2+ μ\ ≥ 0, h^*=h-b, (27) the construction has three properties: (i) Contraction. λ∗≤λ^*≤λ and μ∗≤μ^*≤μ, with b increasing in κ; thus the unsafe set h∗<0=h<b\h^*<0\=\h<b\ grows as the obstacle becomes more capable. (i) Recovery. At κ=0κ=0, b≡0b≡ 0 and h∗≡h^*≡ h: the nominal DPCBF is recovered exactly. (i) Validity floor. λ∗≥0λ^*≥ 0 and μ∗≥0μ^*≥ 0 hold iff κ≤γamaxkλdκ≤γ a_ k_λd and κ≤γkμ∥rel∥κ≤γ k_μ v_rel . Past these the parabola would invert and no certificate of this form exists at (d,∥rel∥)(d, v_rel ). Proof. All three claims follow directly from (24)-(25). Since κ,d,γ,amax,∥rel∥κ,d,γ,a_ , v_rel are all positive, Δλ λ and Δμ μ are non-negative and strictly increasing in κ. Subtracting them gives λ∗≤λ^*≤λ, μ∗≤μ^*≤μ, which is (i). Substituting into h∗=v~rel,x+λ∗v~rel,y2+μ∗h^*= v_rel,x+λ^* v_rel,y^2+μ^* and comparing with (11) yields h∗=h−(Δλv~rel,y2+Δμ)=h−bh^*=h-( λ\, v_rel,y^2+ μ)=h-b, and b≥0b≥ 0 because both increments are; hence h∗<0=h<b\h^*<0\=\h<b\, which contains h<0\h<0\ and expands as b (equivalently κ) grows. Setting κ=0κ=0 makes both increments vanish, so b≡0b≡ 0 and h∗≡h^*≡ h, proving (i). For (i), λ∗≥0⇔kλd/∥rel∥≥κ/(γamax∥rel∥)⇔κ≤γamaxkλdλ^*≥ 0 k_λd/ v_rel ≥κ/(γ a_ v_rel ) κ≤γ a_ k_λd, and likewise μ∗≥0⇔κ≤γkμ∥rel∥μ^*≥ 0 κ≤γ k_μ v_rel . ∎ Corollary 4. On Ω∩d≥r ∩\d≥ r\ we have d≥rd≥ r and ∥rel∥≥vrel,min v_rel ≥ v_rel,min. Hence, by Theorem 3(i), the floor λ∗,μ∗≥0λ^*,μ^*≥ 0 holds throughout Ω∩d≥r ∩\d≥ r\ if and only if κ≤γamaxkλr,κ≤γkμvrel,min.κ≤γ\,a_ k_λ\,r, κ≤γ k_μv_rel,min. (28) Conditions (28) ensure that the reserved margin does not exhaust the barrier. Fig. 2 visualizes the contraction of the AR-DPCBF safe set in the LoS velocity frame. The adversarial boundary hj∗=0\h_j^*=0\ lies to the right of the nominal DPCBF boundary hj=0\h_j=0\, yielding the contracted safe set hj∗≥0⊆hj≥0\h_j^*≥ 0\ \h_j≥ 0\. The three panels illustrate the dependence predicted by Theorem 3: the contraction increases with obstacle capability κ (a), decreases with increasing relative speed ‖rel‖\| v_rel\| owing to the 1/‖rel‖1/\| v_rel\| reaction-time scaling (b), and becomes more pronounced as the clearance d decreases (c). When κ=0κ=0, the AR-DPCBF boundary coincides with the nominal DPCBF boundary, recovering the original certificate exactly. I-D Sizing the buffer The contractions in (24)-(25) follow from bounding the effect of admissible obstacle maneuvers. Consider a head-on encounter (v~rel,y=0 v_rel,y=0), for which the nominal DPCBF permits a maximum closing speed of μ. The corresponding time-to-contact is τc=d/∥rel∥ _c=d/ v_rel . By Assumption 1, the obstacle can change its velocity by at most κτcκ _c over this interval. Conservatively assigning this change to the closing-speed component gives Δμ=κτcγ=κdγ∥rel∥, μ= κ _cγ= κ dγ v_rel , where γ≥1γ≥ 1 controls the conservatism of the contraction. The contraction Δλ λ is derived analogously, preserving the same O⁡(1/∥rel∥)O(1/ v_rel ) reaction-time scaling while matching the DPCBF curvature to the maneuver-inflated collision cone of [8, § I]. I-E Safety inheritance The role of this margin is structural: it ensures that invariance of h∗h^* implies invariance of h, thereby transferring the safety guarantee. Proposition 5. With b≥0b≥ 0 from (27), h∗≥0⊆h≥0\h^*≥ 0\ \h≥ 0\. Hence if the robot keeps h∗(⁡(t))≥0h^*( x(t))≥ 0 for all t∈[0,t1]t∈[0,t_1], then under Assumption 4 the clearance satisfies d⁡(t)≥rd(t)≥ r. Proof. Since b≥0b≥ 0, we have h∗=h−b≤h^*=h-b≤ h pointwise, so h∗()≥0h^*( x)≥ 0 implies h⁡()≥0h( x)≥ 0, i.e., h∗≥0⊆h≥0\h^*≥ 0\ \h≥ 0\. Now suppose the closed loop maintains h∗(⁡(t))≥0h^*( x(t))≥ 0 on [0,t1][0,t_1]. By the inclusion, the same trajectory satisfies h⁡(⁡(t))≥0h( x(t))≥ 0 on [0,t1][0,t_1]. Assumption 4 applied to this trajectory then yields d⁡(t)≥rd(t)≥ r on [0,t1][0,t_1]. ∎ IV Validity of the Adversarial Certificate We prove that h∗h^* satisfies the adversarial CBF condition for the bicycle model (6) throughout the certified engagement envelope Ω . Consequently, ∗C^* is forward invariant over Ω by a standard first-violation argument, and Proposition 5 guarantees collision avoidance. IV-A The exact derivative Differentiating h∗h^* (26) along the dynamics gives, h˙∗=v~˙rel,x+2λ∗v~rel,yv~˙rel,y⏟velocity channel+λ˙∗v~rel,y2+μ˙∗⏟parameter channel. h^*= v_rel,x+2λ^* v_rel,y\, v_rel,y_velocity channel+ λ^* v_rel,y^2+ μ^*_parameter channel. (29) The velocity channel is governed by the exact LoS relative-velocity dynamics of Lemma 1, whereas the parameter channel describes the evolution of the state-dependent barrier parameters. Note that the parameters λ∗λ^* and μ∗μ^* depend on the state only through the clearance d and the relative speed ∥rel∥ v_rel . Lemma 6. Let ˙rob|ctrl=a^rob+v2ℓrβ^rob⟂ v_rob|ctrl=a\, e_rob+ v^2 _rβ\, e_rob denote the input-generated acceleration of the no-slip robot velocity. Then the parameter channel of (29) admits the exact decomposition λ˙∗v~rel,y2+μ˙∗=A⁡()d˙+B⁡()∥rel∥˙, λ^* v_rel,y^2+ μ^*=A( x)\, d+B( x)\, v_rel , (30) where A⁡() A( x) =v~rel,y2∂dλ∗+∂dμ∗=kλv~rel,y2∥rel∥+(kμ−κγ∥rel∥), = v_rel,y^2 _dλ^*+ _dμ^*= k_λ v_rel,y^2 v_rel + (k_μ- κγ v_rel ), (31) B⁡() B( x) =v~rel,y2∂∥rel∥λ∗+∂∥rel∥μ∗=−σ⁡()∥rel∥, = v_rel,y^2 _ v_rel λ^*+ _ v_rel μ^*=-σ( x)\, v_rel , (32) where,σ⁡()=λ∗v~rel,y2∥rel∥2−κdγ∥rel∥3.where,\;σ( x)= λ^* v_rel,y^2 v_rel ^2- κ dγ v_rel ^3. (33) Also,B⁡()∥rel∥˙ ,\;B( x)\, v_rel =−σ()rel⋅(˙obs−˙rob|ctrl), =-σ( x)\, v_rel\!·\! ( v_obs- v_rob|ctrl ), (34) d˙ d =rel⋅reld−vβ(rel⋅^rob⟂)d. = p_rel\!·\! v_reld- vβ\,( p_rel\!·\! e_rob )d. (35) Proof. Since λ∗λ^* and μ∗μ^* depend on the state only through the two scalars d and ∥rel∥ v_rel , the chain rule gives λ˙∗=∂dλ∗d˙+∂∥rel∥λ∗∥rel∥˙ λ^*= _dλ^*\, d+ _ v_rel λ^*\, v_rel and similarly for μ∗μ^*. Collecting the d˙ d and ∥rel∥˙ v_rel coefficients of λ˙∗v~rel,y2+μ˙∗ λ^* v_rel,y^2+ μ^* yields (30), with A⁡()=v~rel,y2∂dλ∗+∂dμ∗A( x)= v_rel,y^2 _dλ^*+ _dμ^* and B⁡()=v~rel,y2∂∥rel∥λ∗+∂∥rel∥μ∗B( x)= v_rel,y^2 _ v_rel λ^*+ _ v_rel μ^*. Since h∗=v~rel,x+λ∗v~rel,y2+μ∗h^*= v_rel,x+λ^* v_rel,y^2+μ^* and v~rel,x v_rel,x is independent of d, A⁡()=v~rel,y2∂dλ∗+∂dμ∗A( x)= v_rel,y^2 _dλ^*+ _dμ^* is exactly ∂h∗/∂d∂ h^*/∂ d. Using ∂dλ∗=kλ/∥rel∥ _dλ^*=k_λ/ v_rel and ∂dμ∗=kμ−κ/(γ⁡∥rel∥) _dμ^*=k_μ-κ/(γ v_rel ) gives (31). To compute B, write λ∗=[kλd−κ/(γamax)]∥rel∥−1λ^*=[k_λd-κ/(γ a_ )] v_rel ^-1. Since the bracket is independent of ∥rel∥ v_rel , ∂∥rel∥λ∗=−λ∗/∥rel∥ _ v_rel λ^*=-λ^*/ v_rel . Similarly, μ∗=kμd−(κd/γ)∥rel∥−1μ^*=k_μd-(κ d/γ) v_rel ^-1 gives ∂∥rel∥μ∗=κd/(γ∥rel∥2) _ v_rel μ^*=κ d/(γ v_rel ^2). Therefore B B =−λ∗v~rel,y2∥rel∥+κdγ∥rel∥2 =- λ^* v_rel,y^2 v_rel + κ dγ v_rel ^2 =−∥rel∥(λ∗v~rel,y2∥rel∥2−κdγ∥rel∥3)=−σ⁡∥rel∥, =- v_rel ( λ^* v_rel,y^2 v_rel ^2- κ dγ v_rel ^3 )=-σ v_rel , which is precisely (32), with σ defined by (33). We now identify the acceleration-dependent terms. Since ∥rel∥ v_rel is the magnitude of the relative velocity, differentiating the scalar norm gives ∥rel∥˙=rel⊤˙rel/∥rel∥=rel⊤(˙obs−˙rob|ctrl)/∥rel∥ v_rel = v_rel^\! v_rel/ v_rel = v_rel^\! ( v_obs- v_rob|ctrl)/ v_rel . Substituting B=−σ∥rel∥B=-σ v_rel gives (34). Thus, all acceleration dependence of the parameter channel enters through the scalar σ⁡()σ( x). The clearance rate d˙ d, by contrast, depends only on positions and velocities. From ˙rel=rel−vβrob⟂ p_rel= v_rel-vβ\, e_rob and d˙=rel⊤˙rel/d d= p_rel^\! p_rel/d, we obtain (35). The first term is d˙0 d_0 (21), while the second is a steering-slip correction proportional to β. ∎ Remark 5. Setting ˙obs= v_obs= 0 eliminates the term −σ⁡(rel⋅˙obs)-σ( v_rel\!·\! v_obs) from (34), recovering the constant-velocity derivation of [8]. Since this term is first-order in the obstacle maneuver authority κ (cf. (33)), it represents the first-order coupling between obstacle acceleration and barrier dynamics. IV-B Grouping the derivative by source Equation (29) is organized by mechanism, whereas the worst-case analysis requires grouping terms by their source. Substituting Lemmas 1 and 6, and decomposing α˙ α and d˙ d into no-slip and slip components, each term can be assigned to the obstacle inputs, robot inputs, neither, or the slip velocity vβ^rob⟂vβ e_rob . Collecting these terms yields the exact identity h˙∗=∗()⏟drift+′()⊤⏟control+[h˙∗]obsfull⏟obstacle+ρ⁡(,)⏟slip residual, h^*= D^*( x)_drift+ C ( x)^\! \, u_control+ [ h^*]^full_obs_obstacle+ ρ( x, u)_slip residual, (36) whose four terms are as follows. Obstacle term. The obstacle inputs enter through the LoS dynamics (16)–(17) and through the term −σrel⋅˙obs-σ\, v_rel\!·\! v_obs of (34). Expressing rel⋅^obs v_rel\!·\! e_obs and rel⋅^obs⟂ v_rel\!·\! e_obs in the LoS frame gives [h˙∗]obsfull [ h^*]^full_obs =aobsP(θ~obs)+vobsωobsQ(θ~obs), =a_obsP( θ_obs)+v_obs _obsQ( θ_obs), (37) P⁡(ϕ) P(φ) =(1−σv~rel,x)cos⁡ϕ+(2λ∗−σ)v~rel,ysin⁡ϕ, =(1-σ v_rel,x) φ+(2λ^*-σ) v_rel,y φ, (38) Q⁡(ϕ) Q(φ) =(2λ∗−σ)v~rel,ycos⁡ϕ−(1−σv~rel,x)sin⁡ϕ, =(2λ^*-σ) v_rel,y φ-(1-σ v_rel,x) φ, (39) where θ~obs θ_obs is the obstacle heading in the LoS frame. Control term. The robot inputs enter through the LoS dynamics and through the term +σrel⋅˙rob|ctrl+σ\, v_rel\!·\! v_rob|ctrl of (34), giving the principal control term ′()⊤=Ca′a+Cβ′β C ( x)^\! u=C_a a+C_β β, with ′():=(Ca′,Cβ′)⊤ C ( x):=(C_a ,C_β ) and Ca′ C_a =−cos⁡θ~−2λ∗v~rel,ysin⁡θ~⏟Ca+σ⁡(rel⋅^rob), = - θ-2λ^* v_rel,y θ_C_a+σ( v_rel\!·\! e_rob), (40) ℓrv2Cβ′ _rv^2C_β =sin⁡θ~−2λ∗v~rel,ycos⁡θ~⏟(ℓr/v2)Cβ+σ⁡(rel⋅^rob⟂), = θ-2λ^* v_rel,y θ_( _r/v^2)C_β+σ( v_rel\!·\! e_rob ), (41) where the factor v2/ℓrv^2/ _r comes from θ˙=(v/ℓr)β θ=(v/ _r)β. In the multi-obstacle setting of Section V, j′() C_j ( x) denotes (40)-(41) evaluated at the relative state of obstacle j. Drift term. With both inputs set to zero, ∥rel∥˙=0 v_rel =0 and only the no-slip clearance and LoS rates survive. The frame-rotation terms of Lemma 1 combine as Rx+2λ∗v~rel,yRy=α˙v~rel,y(1−2λ∗v~rel,x)R_x+2λ^* v_rel,yR_y= α\, v_rel,y(1-2λ^* v_rel,x), so ∗()=A⁡()d˙0+α˙0v~rel,y(1−2λ∗v~rel,x),D^*( x)=A( x)\, d_0+ α_0\, v_rel,y\! (1-2λ^* v_rel,x ), (42) where d˙0=∥rel∥v~rel,x/d d_0= p_rel v_rel,x/d is the no-slip clearance rate (21) and α˙0=(rel×rel)/∥rel∥2 α_0=( p_rel× v_rel)/ p_rel ^2 the no-slip LoS angular rate. Slip residual. The lateral slip velocity vβ^rob⟂vβ e_rob perturbs the clearance and LoS rates by d˙slip=−vβ(rel⊤^rob⟂)/d d_slip=-vβ( p_rel^\! e_rob )/d and α˙slip=−vβ(rel×^rob⟂)/∥rel∥2 α_slip=-vβ( p_rel× e_rob )/ p_rel ^2. These enter h˙∗ h^* through the same coefficients as the drift: ρ⁡(,)=A⁡()d˙slip+α˙slipv~rel,y(1−2λ∗v~rel,x).ρ( x, u)=A( x)\, d_slip+ α_slip\, v_rel,y\,(1-2λ^* v_rel,x). (43) Both d˙slip d_slip and α˙slip α_slip are proportional to β, so h˙∗ h^* is affine in u with β-coefficient Cβ′+∂βρC_β + _βρ. The principal term ′()⊤ C ( x)^\! u is therefore not the full Lie derivative Lh∗L_ gh^* u; the two differ by ∂βρβ _βρ\,β. Since ρ contributes only a small geometric correction, we do not exploit it as control authority: it is bounded in Section IV-F and treated as a disturbance, which is conservative because it discards authority the robot in fact possesses. IV-C Worst-Case Obstacle Contribution The obstacle term (37) is a combination of the two functions P and Q of the obstacle’s LoS heading, weighted by the two obstacle inputs. Both P and Q are sinusoids with the same amplitude (1−σv~rel,x)2+(2λ∗−σ)2v~rel,y2 (1-σ v_rel,x)^2+(2λ^*-σ)^2 v_rel,y^2. Because ℱF is a rectangle, the worst (aobs,ωobs)(a_obs, _obs) separates, and supϕ|Acos⁡ϕ+Bsin⁡ϕ|=A2+B2 _φ|A φ+B φ|= A^2+B^2 gives the clean bound supℱ,θ~obs(−[h˙∗]obsfull)≤κΛ(),where _F, θ_obs (-[ h^*]^full_obs )≤κ\, ( x),\;where Λ⁡():=(1−σv~rel,x)2+(2λ∗−σ)2v~rel,y2. ( x):= (1-σ v_rel,x)^2+(2λ^*-σ)^2 v_rel,y^2. (44) Thus, Λ⁡() ( x) is the geometric gain through which the obstacle acts on h˙∗ h^*. Whatever the obstacle chooses to do, its effect on h˙∗ h^* is at most its scalar capability κ scaled by Λ⁡() ( x), a quantity fixed by the current geometry alone. Λ is large where the barrier is sensitive to the relative velocity and small where it is nearly flat. A bound of the form κΛκ would be of little use if Λ could vanish, because the robot’s own authority is scaled by the same factor (Lemma 7). At such a state, neither agent could affect the barrier, rendering the comparison vacuous. Lemma 14 in Appendix B rules out this degeneracy by establishing Λmin>0 _ >0 on ℬB. IV-D Control Authority We now bound the control term ′()⊤=Ca′a+Cβ′β C ( x)^\! u=C_a a+C_β β, with coefficients (40)-(41). The decisive fact is that the robot’s gain has the same amplitude Λ as the obstacle’s. Lemma 7. Robot and obstacle share Λ i.e., Ca′2+(ℓrv2Cβ′)2=Λ()2C_a 2+ ( _rv^2C_β )^2= ( x)^2. Proof. Let C¯a:=Ca C_a:=C_a and C¯β:=(ℓr/v2)Cβ C_β:=( _r/v^2)C_β, and define s:=rel⊤robs:= v_rel^\! e_rob and q:=rel⊤rob⟂q:= v_rel^\! e_rob . Then s2+q2=∥rel∥2s^2+q^2= v_rel ^2 and, from (40)-(41), Ca′=C¯a+σsC_a = C_a+σ s and (ℓr/v2)Cβ′=C¯β+σq( _r/v^2)C_β = C_β+σ q. Expanding the squared norm gives Ca′2+(ℓrv2Cβ′)2=(C¯a2+C¯β2)+2σ(C¯as+C¯βq)+σ2∥rel∥2.C_a 2+ ( _rv^2C_β )^2=( C_a^2+ C_β^2)+2σ( C_as+ C_βq)+σ^2 v_rel ^2. The first group simplifies directly from the definitions of C¯a C_a and C¯β C_β: C¯a2+C¯β2=1+4(λ∗)2v~rel,y2. C_a^2+ C_β^2=1+4(λ^*)^2 v_rel,y^2. For the cross-term, writing rob=[cos⁡θ~,sin⁡θ~]⊤ e_rob=[ θ, θ] and rob⟂=[−sin⁡θ~,cos⁡θ~]⊤ e_rob =[- θ, θ] , the mixed sin⁡θ~cos⁡θ~ θ θ terms cancel, yielding C¯as+C¯βq=−(v~rel,x+2λ∗v~rel,y2). C_as+ C_βq=-( v_rel,x+2λ^* v_rel,y^2). Substituting these identities and using ∥rel∥2=v~rel,x2+v~rel,y2 v_rel ^2= v_rel,x^2+ v_rel,y^2 gives Ca′2+(ℓrv2Cβ′)2=1+4(λ∗)2v~rel,y2−2σ(v~rel,x+2λ∗v~rel,y2) C_a 2+ ( _rv^2C_β )^2=1+4(λ^*)^2 v_rel,y^2-2σ( v_rel,x+2λ^* v_rel,y^2) +σ2(v~rel,x2+v~rel,y2). +σ^2( v_rel,x^2+ v_rel,y^2). Regrouping terms yields, (1−σv~rel,x)2+(2λ∗−σ)2v~rel,y2=Λ2,(1-σ v_rel,x)^2+(2λ^*-σ)^2 v_rel,y^2= ^2, where the last equality follows from (44). ∎ The common gain Λ therefore cancels from the adversarial comparison, reducing the problem from optimization over obstacle strategies to the scalar comparison cminc_ versus κ. Note that this conclusion holds for any certificate that is affine in v~rel,x v_rel,x, quadratic in v~rel,y v_rel,y, and whose parameters depend on the state only through d and ∥rel∥ v_rel , with σ defined by the corresponding partial derivatives in (33). Proposition 8. Let cmin:=min⁡amax,vmin2βmax/ℓrc_ := \a_ ,\,v_ ^2 _ / _r\. Then the robot’s maximal effect on h˙∗ h^* is Φ⁡():=sup∈′()⊤=|Ca′|amax+|Cβ′|βmax≥cminΛ(). ( x):= _ u C ( x)^\! u=|C_a |a_ +|C_β | _ \ ≥\ c_ \, ( x). (45) Proof. Since Lgh∗=Ca′a+Cβ′βL_gh^*\, u=C_a a+C_β β is linear in the bounded inputs, its maximum is attained by choosing a and β at their respective bounds with signs matching those of Ca′C_a and Cβ′C_β . Thus, sup∈Lgh∗=|Ca′|amax+|Cβ′|βmax. _ u L_gh^*\, u=|C_a |a_ +|C_β | _ . Factor the steering term as |Cβ′|βmax=v2ℓrβmax⋅ℓrv2|Cβ′||C_β | _ = v^2 _r _ · _rv^2|C_β |. Using the elementary inequality c1A+c2B≥min⁡(c1,c2)(A+B)c_1A+c_2B≥ (c_1,c_2)(A+B) for A,B≥0A,B≥ 0 with c1=amaxc_1=a_ , c2=v2ℓrβmaxc_2= v^2 _r _ , and noting v2ℓrβmax≥vmin2βmax/ℓr v^2 _r _ ≥ v_ ^2 _ / _r, Φ≥cmin(|Ca′|+ℓrv2|Cβ′|)≥cminCa′2+(ℓrv2Cβ′)2=cminΛ, ≥ c_ (|C_a |+ _rv^2|C_β | )≥ c_ C_a 2+ ( _rv^2C_β )^2=c_ , where we use |X|+|Y|≥X2+Y2|X|+|Y|≥ X^2+Y^2 and Lemma 7. At v=0v=0, cmin=0c_ =0, hence Assumption 2 requires vmin>0v_ >0. ∎ The obstacle and control contributions admit complementary bounds with the common factor Λ . The remaining terms in h˙∗ h^* (36) are independent of both obstacle maneuvers and control inputs. IV-E Establishing a Positive Drift Margin The drift (42) is what happens to h∗h^* when neither agent acts i.e., the barrier still moves, because the clearance and the LoS angle keep evolving. The next lemma records that this motion cannot be arbitrarily adverse on ℬB, and gives an explicit bound in terms of the problem constants. Lemma 9. Under Assumptions 1-4 and the bounds of Proposition 2, the autonomous drift ∗D^* attains a finite infimum on ℬ=∂∗∩Ω∩d≥rB= ^*∩ ∩\d≥ r\, min:=infx∈ℬ∗()>−∞,D_ := _x D^*( x)>-∞, (46) and satisfies the explicit lower bound min≥−¯D_ ≥- D, where ¯=Mdpmaxvrel,maxdmin+Mαvrel,maxpmin, D=M_d\, p_ v_rel,maxd_ +M_α\, v_rel,maxp_ , (47) with Md=kλvrel,max+kμ+κ/(γvrel,min)M_d=k_λv_rel,max+k_μ+κ/(γ v_rel,min) bounding |A||A|, Mα=vrel,max(1+2λmax∗vrel,max)M_α=v_rel,max(1+2λ^*_ v_rel,max) bounding |v~rel,y(1−2λ∗v~rel,x)|| v_rel,y(1-2λ^* v_rel,x)|, λmax∗=kλdmax/vrel,minλ^*_ =k_λd_ /v_rel,min, dmin=rd_ =r, pmin=2rp_ = 2\,r, pmax=dmax2+r2p_ = d_ ^2+r^2, and vrel,max=vmax+vobs,maxv_rel,max=v_ +v_obs,max. Proof. Existence. By Proposition 2 the set ℬB is compact and on it d≥rd≥ r, ∥rel∥≥2r p_rel ≥ 2\,r and ∥rel∥≥vrel,min v_rel ≥ v_rel,min bound every denominator in (42) away from zero, so ∗D^* is continuous on ℬB. A continuous function on a non-empty compact set attains its minimum, so the infimum minD_ is finite. Explicit bound. We bound each term of (42). From (21), |d˙0|=∥rel∥|v~rel,x|/d≤pmaxvrel,max/dmin| d_0|= p_rel | v_rel,x|/d≤ p_ v_rel,max/d_ , and |A|≤kλvrel,max+|kμ−κ/(γ⁡∥rel∥)|≤Md|A|≤ k_λv_rel,max+|k_μ-κ/(γ v_rel )|≤ M_d, so the clearance drift is at most Mdpmaxvrel,max/dminM_d\,p_ v_rel,max/d_ . For the rotation, |α˙0|=|rel×rel|/∥rel∥2≤∥rel∥/∥rel∥≤vrel,max/pmin| α_0|=| p_rel× v_rel|/ p_rel ^2≤ v_rel / p_rel ≤ v_rel,max/p_ , and |v~rel,y(1−2λ∗v~rel,x)|≤Mα| v_rel,y(1-2λ^* v_rel,x)|≤ M_α, so the rotation drift is at most Mαvrel,max/pminM_αv_rel,max/p_ . Adding the two gives |∗|≤¯|D^*|≤ D, hence min≥−¯D_ ≥- D. ∎ IV-F Bounding the Slip Residual The slip residual (43) is the price of the small-slip model. It is a fixed overhead proportional to vmaxβmaxv_ _ and vanishes as the slip limit does. To bound (43), we use |rel⊤rob⟂|≤‖rel‖| p_rel^\! e_rob |≤\| p_rel\|, |rel×rob⟂|≤‖rel‖| p_rel× e_rob |≤\| p_rel\|, v≤vmaxv≤ v_ , |β|≤βmax|β|≤ _ , d≥dmind≥ d_ , ‖rel‖≤pmax\| p_rel\|≤ p_ , ‖rel‖≥pmin\| p_rel\|≥ p_ , |A⁡()|≤Md|A( x)|≤ M_d, and |v~rel,y(1−2λ∗v~rel,x)|≤Mα| v_rel,y(1-2λ^* v_rel,x)|≤ M_α, we obtain |d˙slip|≤vmaxβmaxpmax/dmin| d_slip|≤ v_ _ p_ /d_ and |α˙slip|≤vmaxβmax/pmin| α_slip|≤ v_ _ /p_ . Substitution into (43) gives |ρ⁡(,)|≤ε:=vmaxβmax(Mdpmaxdmin+Mαpmin).|ρ( x, u)|≤ :=v_ _ (M_d p_ d_ + M_αp_ ). (48) Combining the obstacle bound (44), the drift bound (46), and the residual bound (48) with (36) yields h˙∗≥min+′()⊤−κΛ()−ε, h^* _ + C ( x)^\! u-κ ( x)- , (49) for every ∈ℬ x , every obstacle in ℱF, and every admissible control ∈ u . IV-G Sufficient Condition for Safety The preceding analysis establishes a sufficient condition for the feasibility of the runtime safety program at every boundary state within the certified engagement envelope, thereby yielding a conditional forward-invariance guarantee. Theorem 10. Suppose Assumptions 1-4 hold, let the design parameters satisfy (28) and (67), and let minD_ (Lemma 9), ε (48), and Λmin>0 _ >0 (Lemma 14) be the corresponding constants over ℬ=∂∗∩Ω∩d≥rB= ^*∩ ∩\d≥ r\. Assume ψ∈∞ψ _∞ is locally Lipschitz. If the robot out-authorizes the obstacle, κ<cminκ<c_ , and (cmin−κ)Λmin≥ε−min,i.e.cmin≥κ+ε−minΛmin, \ (c_ -κ)\, _ \ ≥\ -D_ \ \,,i.e.\;c_ ≥κ+ -D_ _ , (50) then the following hold. (i) A-CBF property. h∗h^* satisfies the A-CBF condition of Definition 4 at every ∈ℬ x . (i) Feasibility on ℬB. For a single obstacle, the constraint set of the runtime program (60) is non-empty at every ∈ℬ x . (i) Conditional invariance. Suppose in addition that the closed-loop solution is well defined and that the runtime program remains feasible along it, so that h˙∗≥−ψ⁡(h∗) h^*≥-ψ(h^*) is enforced on [0,t1][0,t_1]. Then for every initial condition ⁡(0)∈int⁡∗ x(0) ^* with d⁡(0)>rd(0)>r and every obstacle strategy in ℱF, and for all t1≥0t_1≥ 0 such that ⁡(τ)∈Ω x(τ)∈ for all τ∈[0,t1]τ∈[0,t_1], h∗(⁡(t1))≥0andd⁡(t1)≥r.h^*( x(t_1))≥ 0 d(t_1)≥ r. (51) Equivalently, the closed-loop trajectory cannot leave ∗C^* through ∂∗ ^* while in Ω ; any exit from ∗∩ΩC^*∩ occurs through ∂Ω∂ . Proof. (i) For any ∈ℬ=∂∗∩Ω∩d≥r x = ^*∩ ∩\d≥ r\, (49), together with the bounds of Lemma 9, Proposition 8, and (44), gives sup∈infℱh˙∗ _ u _F h^* ≥min+cminΛ()−κΛ()−ε _ +c_ ( x)-κ ( x)- =(cmin−κ)Λ()−(ε−min) =(c_ -κ)\, ( x)-( -D_ ) ≥(cmin−κ)Λmin−(ε−min)≥ 0. ≥(c_ -κ)\, _ -( -D_ )\ ≥\ 0. (52) The third line uses Λ⁡()≥Λmin ( x)≥ _ and cmin>κc_ >κ, while the last inequality is precisely (50). This establishes the A-CBF condition of Definition 4. (i) At ∈ℬ x we have h∗=0h^*=0 and hence ψ⁡(h∗)=0ψ(h^*)=0, so the constraint in (60) reads ′()⊤≥κΛ()+ε−∗() C ( x)^\! u≥κ ( x)+ -D^*( x). By Proposition 8, sup∈′()⊤≥cminΛ() _ u C ( x)^\! u≥ c_ ( x), while ∗()≥minD^*( x) _ and Λ⁡()≥Λmin ( x)≥ _ give cminΛ−κΛ≥(cmin−κ)Λmin≥ε−min≥ε−∗()c_ -κ ≥(c_ -κ) _ ≥ -D_ ≥ -D^*( x). Hence the supremizing input satisfies the constraint and the feasible set is non-empty. (i) By hypothesis the closed loop enforces h˙∗≥−ψ⁡(h∗) h^*≥-ψ(h^*) on [0,t1][0,t_1]. Since ψ∈∞ψ _∞ is locally Lipschitz, the comparison lemma yields h∗(⁡(t))≥z⁡(t)h^*( x(t))≥ z(t), where z˙=−ψ⁡(z) z=-ψ(z) and z⁡(0)=h∗(⁡(0))>0z(0)=h^*( x(0))>0; the solution z remains strictly positive for every finite time, so h∗((t))>0h^*( x(t))>0 on [0,t1][0,t_1]. Proposition 5 together with Assumption 4 then yields d⁡(t)≥rd(t)≥ r on [0,t1][0,t_1], which is (51). Consequently the trajectory cannot cross ∂∗ ^* while it remains in Ω , so any exit from ∗∩ΩC^*∩ must occur through ∂Ω∂ . ∎ Remark 6. Part (i) is established on ℬB only, because Λmin _ and minD_ are boundary constants: Λmin _ relies on the boundary condition h∗=0h^*=0 (Lemma 14). Feasibility in the interior of ∗C^*, and for Nobs>1N_obs>1, where the intersection of the per-obstacle constraint sets may be empty, is therefore not implied by (50) and enters (i) as a hypothesis. This is precisely the gap addressed by the soft and buffered formulations of Section V. Corollary 11. Let the hypotheses of Theorem 10 hold and let Ω∞:=(0)∈∗∩Ω:(t)∈Ω∀t≥0 _∞:= \ x(0) ^*∩ \;:\; x(t)∈ \ \ ∀ t≥ 0 \ denote the initial states whose closed-loop trajectory remains in the engagement envelope. If in addition d⁡(0)>rd(0)>r, then Ω∞⊆∖ℐ, _∞\ \ X , (53) that is, no state of Ω∞ _∞ is an inevitable collision state. Proof. Definition 3 declares ⁡(0) x(0) an ICS only if every robot control admits an ℱF-admissible disturbance trajectory producing ‖⁡(t)−obs(t)‖<r\| p(t)- p_obs(t)\|<r for some t>0t>0. It therefore suffices to exhibit one admissible control that avoids this for all disturbances. Take the closed-loop control of Theorem 10, which is admissible by construction since ∈ u . For ⁡(0)∈Ω∞ x(0)∈ _∞ the trajectory remains in Ω for all t≥0t≥ 0, so (51) applies with arbitrary t1t_1 and yields d⁡(t)≥rd(t)≥ r, i.e. ‖⁡(t)−obs(t)‖≥r\| p(t)- p_obs(t)\|≥ r, for every t≥0t≥ 0 and every obstacle strategy in ℱF. Hence ⁡(0)∉ℐ x(0) . ∎ Theorem 10 requires the capability bounds aobs,maxa_obs,max, ωobs,max _obs,max, and vobs,maxv_obs,max to be known. In practice, they must be estimated online from noisy observations. This section provides a sliding-window estimator and shows that, with high probability, the estimated bounds dominate the true ones, so the conservative barrier built from them inherits the safety guarantee of Theorem 10. IV-H Sliding-Window Estimator From a sliding window of NwN_w observations at times t−NwΔt,…,t-N_w t,…,t, define the running maxima a^obs,max(t) a_obs,max(t) =maxk∈window⁡|vobs(tk)−vobs(tk−1)|Δt, = _k v_obs(t_k)-v_obs(t_k-1) t, (54) ω^obs,max(t) ω_obs,max(t) =maxk∈window⁡|wrap(θobs(tk)−θobs(tk−1))|Δt, = _k ( _obs(t_k)- _obs(t_k-1) ) t, (55) v^obs,max(t) v_obs,max(t) =maxk∈window⁡|vobs(tk)|, = _k v_obs(t_k) , (56) Here wrap⁡(⋅)wrap(·) maps an angle difference to (−π,π](-π,π], which is required because headings are measured modulo 2π2π. Each finite difference in (54)-(55) estimates the corresponding rate averaged over one sampling interval. Consequently, in the noiseless case, the running maxima equal the largest interval-averaged acceleration, turning rate, and sampled speed observed over the window, and therefore never underestimate these realized interval-averaged quantities. Intra-sample peaks of shorter duration, however, may exceed the corresponding averages. Assumption 5 relates these averaged maxima to the capability bounds, while the margins εa _a, εω _ω, and εv _v compensate for sensor uncertainty. a~obs,max a_obs,max =a^obs,max+εa,ω~obs,max=ω^obs,max+εω, = a_obs,max+ _a,\; ω_obs,max= ω_obs,max+ _ω, (57) v~obs,max v_obs,max =v^obs,max+εv. = v_obs,max+ _v. The estimator can only certify the capability that the obstacle reveals. Linking the realized window maxima to the capability bounds of Definition 2, therefore, requires an exposure assumption. Assumption 5. Within each estimation window, the obstacle realizes its capability at the sampling resolution: the interval-averaged longitudinal acceleration and turning rate attain aobs,maxa_obs,max and ωobs,max _obs,max, respectively, over at least one sampling interval, and the sampled speed attains vobs,maxv_obs,max at least once. Thus, the bounds in Theorem 10 are interpreted as realized interval-averaged capabilities. Maneuvers shorter than one sampling interval are certified only through their interval averages. IV-I Robustness Guarantee Proposition 12. Suppose the measurements vobsv_obs and θobs _obs are corrupted by independent zero-mean sub-Gaussian noise with proxy parameters σv _v and σθ _θ, respectively, and that Assumption 5 holds. For any δ∈(0,1)δ∈(0,1), define εa _a =2σvΔtη, = 2 _v t\,η, εω _ω =2σθΔtη, = 2 _θ t\,η, εv _v =σvη, = _v\,η, (58) where, η:=2ln⁡(3Nw/δ).η:= 2 \! (3N_w/δ ). Then, at any fixed estimator update, with probability at least 1−δ1-δ, a~obs,max=a^obs,max+εa≥aobs,max,ω~obs,max=ω^obs,max+εω≥ωobs,max,v~obs,max=v^obs,max+εv≥vobs,max, a_obs,max= a_obs,max+ _a≥ a_obs,max, ω_obs,max= ω_obs,max+ _ω≥ _obs,max, v_obs,max= v_obs,max+ _v≥ v_obs,max, and therefore, κ~=a~obs,max+v~obs,maxω~obs,max≥κ. κ= a_obs,max+ v_obs,max ω_obs,max≥κ. Consequently, the AR-DPCBF constructed from κ~ κ defines a conservative barrier satisfying h~∗≤h∗≤h,~∗⊆∗⊆. h^*≤ h^*≤ h,\; C^* ^* . Hence, with probability at least 1−δ1-δ, (i) every controller maintaining h~∗≥0 h^*≥ 0 also maintains h∗≥0h^*≥ 0 and h≥0h≥ 0; and (i) if κ~ κ satisfies the hypotheses of Theorem 10, then h~∗ h^* is a valid A-CBF for the true obstacle. Proof. We first establish high-probability coverage of the obstacle capabilities. Each acceleration estimate in (54) is the difference of two independent sub-Gaussian measurements and therefore has sub-Gaussian proxy sa=2σv/Δt.s_a= 2 _v/ t. Writing the k-th differenced sample as dk+nkd_k+n_k, Assumption 5 guarantees an index k⋆k satisfying dk⋆=aobs,maxd_k =a_obs,max. Hence, Pr⁡(a^obs,max<aobs,max−εa) \! ( a_obs,max<a_obs,max- _a ) ≤Pr⁡(maxk⁡(−nk)>εa) ≤ \! ( _k(-n_k)> _a ) ≤Nwexp⁡(−εa22sa2)=δ3, ≤ N_w \! (- _a^22s_a^2 )= δ3, (59) where the last equality follows from (58). Therefore, Pr⁡(a~obs,max≥aobs,max)≥1−(δ/3). ( a_obs,max≥a_obs,max)≥ 1-(δ/3). The same argument applies to ω^obs,max ω_obs,max with sω=2σθ/Δts_ω= 2 _θ/ t, while the speed estimate requires no differencing and uses proxy σv _v, yielding Pr⁡(ω~obs,max≥ωobs,max)≥1−δ/3 ( ω_obs,max≥ _obs,max)≥ 1-δ/3 and Pr⁡(v~obs,max≥vobs,max)≥1−δ/3. ( v_obs,max≥ v_obs,max)≥ 1-δ/3. A union bound gives the required results. On this event, κ~=a~obs,max+v~obs,maxω~obs,max≥κ κ= a_obs,max+ v_obs,max ω_obs,max≥κ follows immediately. Since the contractions Δλ λ and Δμ μ of Theorem 3 are monotone increasing in κ, κ~≥κ⟹Δλ~≥Δλ,Δμ~≥Δμ,⟹λ~∗≤λ∗,μ~∗≤μ∗,⟹h~∗≤h∗,~∗⊆∗, κ≥κ λ≥ λ,\; μ≥ μ, λ^*≤λ^*,\; μ^*≤μ^*, h^*≤ h^*,\; C^* ^*, which together with Proposition 5 proves Part (i). For Part (i), the true disturbance set satisfies ℱ⊆ℱ~F F. Hence, if the inflated capability κ~ κ satisfies the hypotheses of Theorem 10, then that theorem certifies invariance of ~∗ C^* against every disturbance in ℱ~ F, and therefore against the true obstacle. The result follows by combining this guarantee with the coverage event, whose probability is at least 1−δ1-δ. ∎ V Controller Formulation and Variants This section presents the certified adversarial controller as a single QP, along with two soft variants that trade formal guarantees for feasibility. V-A Base AR-DPCBF Quadratic Program For each obstacle j, let κj _j denote a conservative upper bound on its maneuvering capability. Using κj _j, the contracted DPCBF parameters (λj∗,μj∗)( _j^*, _j^*) are computed according to Theorem 3, yielding the adversarial barrier, hj∗()=v~rel,xj+λj∗(v~rel,yj)2+μj∗h_j^*( x)= v_ rel,x^\,j+ _j^* ( v_ rel,y^\,j )^2+ _j^*. The control input is obtained by, ∗ u^* =arg⁡min∈⁡‖−ref‖2 = _ u \;\| u- u_ ref\|^2 (60) s.t. j′()⊤≥κjΛj()+ερ−Dj∗()−ψ⁡(hj∗()), C_j ( x)^\! u≥ _j _j( x)+ _ρ-D_j^*( x)-ψ\! (h_j^*( x) ), j=1,…,Nobs, j=1,…,N_ obs, where Λj() _j( x) and Dj∗()D_j^*( x) are given by (44) and (42), respectively, and ερ:=ε _ρ:= is the residual bound (48). The resulting optimization is a convex quadratic program with two decision variables and NobsN_ obs linear constraints, referred to as the Hard AR-DPCBF. When the obstacle capability is unknown, κj _j is replaced by the online estimate κ~j=a~obs,maxj+v~obs,maxjω~obs,maxj κ_j= a_obs,max^\,j+ v_obs,max^\,j ω_obs,max^\,j, computed by the estimator of Section IV-G. By Proposition 12, this substitution preserves the safety guarantee with probability at least 1−δ1-δ. Algorithm 1 summarizes the resulting control cycle, which is common to all three AR-DPCBF variants and differs only in the optimization problem solved at the final step. Algorithm 1 AR-DPCBF control cycle 0: Robot state x, obstacle observations (obsj,vobsj,θobsj)j=1Nobs\( p_obs^j,v_obs^j, _obs^j)\_j=1^N_obs, reference ref u_ref, variant V∈Hard,Soft,BufferV∈\ Hard, Soft, Buffer\ 0: Control ∗=(a∗,β∗) u^*=(a^*,β^*) 1: for j=1,…,Nobsj=1,…,N_obs do 2: Update the capability estimate κ~j κ_j using the sliding window and confidence margins 3: Compute the LoS relative state and contracted parameters (λj∗,μj∗)( _j^*, _j^*) 4: Construct the contracted barrier hj∗h_j^* 5: end for 6: if V=HardV= Hard then 7: ∗← u^*← solve (60) adversarial constraint enforced 8: else if V=SoftV= Soft then 9: ∗← u^*← solve (62) adversarial residual penalized 10: else 11: ∗← u^*← solve (64) buffered penalty, width εb _b 12: end if 13: return ∗ u^* Remark 7. Lines 3-4 of Algorithm 1 are O⁡(1)O(1) arithmetic per obstacle. The sliding-window update (line 2) is O⁡(Nw)O(N_w) per obstacle, giving O⁡(NobsNw)O(N_obsN_w) for the estimator. The QP (lines 6-12) has NobsN_obs linear constraints in two decision variables and is solvable in O⁡(Nobs)O(N_obs) with warm-starting. The total per-cycle cost is therefore O⁡(NobsNw)O(N_obsN_w), identical in order to the DPCBF controller. V-B Conservatism of Hard AR-DPCBF Since λj∗≤λj _j^*≤ _j and μj∗≤μj _j^*≤ _j, with the contraction increasing monotonically with κj _j (Theorem 3), the adversarial safe set hj∗≥0\h_j^*≥ 0\ is a strict subset of the nominal DPCBF safe set whenever κj>0 _j>0. Consequently, the robust constraint in (60) is more restrictive than its DPCBF counterpart. Let cbf,j∗()K_cbf,j^*( x) denote the corresponding admissible-input set for obstacle j. In dense multi-obstacle environments, the intersection ⋂jcbf,j∗() _jK_cbf,j^*( x) may become empty, rendering (60) infeasible. In contrast, the nominal DPCBF remains feasible by construction because it neglects adversarial obstacle maneuvers. This conservatism motivates the soft AR-DPCBF formulations presented next, which preserve adversarial awareness while recovering feasibility whenever the hard formulation becomes infeasible. V-C Soft AR-DPCBF Since hard AR-DPCBF is likely to become infeasible, we therefore retain the nominal DPCBF constraint as a hard safety constraint and relax only the adversarial condition by penalizing its residual in the objective. For each obstacle, define the robust residual gj(,):=j′()⊤+Dj∗()−κjΛj()−ερ+ψ⁡(hj∗()),g_j( x, u):= C_j ( x)^\! u+D_j^*( x)- _j _j( x)- _ρ+ψ\! (h_j^*( x) ), (61) which is affine in u and satisfies gj(,)≥0g_j( x, u)≥ 0 if and only if the adversarial CBF constraint in (60) holds. Definition 5 (Soft AR-DPCBF). The Soft AR-DPCBF controller solves ∗=arg⁡min∈⁡‖−ref‖2+w∑j=1Nobsmax⁡(0,−gj(,))2 u^*= _ u \;\| u- u_ ref\|^2+w _j=1^N_ obs \! (0,-g_j( x, u) )^2 s.t.Lfhj()+Lghj()≥−ψ⁡(hj()),∀j, .t.\;L_fh_j( x)+L_gh_j( x)\, u≥-ψ\! (h_j( x) ), ∀ j, (62) where hjh_j is the nominal DPCBF barrier and w>0w>0 is the penalty weight. Remark 8. Soft AR-DPCBF does not satisfy the A-CBF condition of Definition 4, since violations of the adversarial constraint are permitted. Moreover, the penalty is inactive whenever gj(,)>0g_j( x, u)>0, providing no incentive to increase the adversarial margin before the constraint becomes active. This motivates the proactive formulation introduced next. V-D Buffer Soft AR-DPCBF To enable proactive control, we replace the one-sided quadratic penalty with a buffered Huber penalty that becomes active before the certified adversarial margin is exhausted. Definition 6 (Buffer Soft AR-DPCBF). For a buffer width εb>0 _b>0, define ϕ⁡(s,εb)=0,s>εb,(εb−s)2/(2εb),0<s≤εb,−s+(εb/2),s≤0.φ(s; _b)= cases0,&s> _b,\\[2.0pt] ( _b-s)^2/(2 _b),&0<s≤ _b,\\[8.0pt] -s+( _b/2),&s≤ 0. cases (63) The function ϕ⁡(⋅,εb)φ(·; _b) is continuously differentiable on ℝR. The Buffer Soft AR-DPCBF controller solves ∗=arg⁡min∈ u^*= _ u \; ‖−ref‖2+w∑j=1Nobsϕ⁡(gj(,),εb) \| u- u_ ref\|^2+w _j=1^N_ obsφ\! (g_j( x, u); _b ) (64) s.t. Lfhj()+Lghj()≥−ψ⁡(hj()),∀j, L_fh_j( x)+L_gh_j( x)\, u≥-ψ\! (h_j( x) ), ∀ j, where gjg_j is the robust residual (61), hjh_j is the nominal DPCBF barrier, w>0w>0 is the penalty weight, and εb>0 _b>0 is the buffer width. Remark 9. The buffered penalty has three operating regions. For gj>εbg_j> _b, the penalty is inactive, and the controller coincides with the nominal DPCBF. Within the buffer, 0<gj≤εb0<g_j≤ _b, the quadratic branch provides a nonzero steering signal before the adversarial condition is violated, encouraging proactive recovery of the certified margin. For gj≤0g_j≤ 0, the linear branch limits the restoring effort, improving numerical conditioning while continuing to penalize violations. As εb→0 _b→ 0, (64) reduces to the Soft AR-DPCBF formulation. Proposition 13. The feasible sets of both the Soft (62) and Buffer AR-DPCBF (64) coincide with that of the nominal DPCBF controller. Consequently, both formulations are feasible whenever the nominal DPCBF QP is feasible. Proof. In both formulations, the adversarial robustness term appears only in the objective, while the constraints are identical to those of the nominal DPCBF controller. Hence the feasible set is unchanged. ∎ Fig. 3: Illustration of the silent-failure mechanism under maneuvering obstacles. (a) The nominal DPCBF certificate is violated, resulting in collision. (b) Silent failure: although the QP satisfies the nominal CBF constraint based on the assumed obstacle dynamics, the actual barrier derivative h˙ h falls below −ψ⁡(h)-ψ(h) due to the unmodeled obstacle maneuver; shaded regions indicate time intervals during which the nominal CBF condition is satisfied while the corresponding true condition is violated. (c) Under the same scenario, Buffer AR-DPCBF maintains both h and h∗h^* positive throughout the trajectory. TABLE I: Simulation parameters inherited from [8, Table I]. Bold entries are specific to the adversarial extension. Parameter Value Source / Reason ℓr _r 0.200.20 m Rear-axle length amaxa_ 5.05.0 m s-2 Longitudinal acceleration limit βmax _ 0.280.28 rad Slip-angle limit vmaxv_ 3.53.5 m s-1 Maximum speed vdesv_des 2.52.5 m s-1 Cruise reference speed r 1.01.0 m Combined safety radius RsenseR_sense 1515 m Sensing radius kλk_λ 0.1440.144 DPCBF gain kμk_μ 0.5050.505 DPCBF gain v_ 1.0 1.0 m s-1 Positive speed floor required for steering authority (Assumption 2); gives cmin=1.40c_ =1.40 γ 3.0 3.0 Pre-emption gain w 10.0 10.0 Penalty weight for soft variants _b 0.3 0.3 Buffer width (Buffer AR-DPCBF) VI Results We evaluate the proposed AR-DPCBF framework through a series of simulation studies designed to validate the theoretical guarantees, characterize its robustness to adversarial obstacle maneuvers, and assess its practical performance. VI-A Simulation Setup Platform and scenario The robot is the kinematic bicycle (6) with the parameters of Table I. The adversarial extension requires a positive speed floor because steering authority scales as v2/ℓrv^2/ _r and vanishes at rest. We set vmin=1.0v_ =1.0 m s-1, giving cmin=min⁡amax,vmin2βmax/ℓr=1.40c_ = \a_ ,v_ ^2 _ / _r\=1.40. The robot navigates from (2,12)(2,12) to a goal at x=50x=50 m through N obstacles in a 62×2462× 24 m arena, integrating at Δt=0.06 t=0.06 s with RK4 over a 4040 s horizon. The representative operating point is N=10N=10, nadv=5n_adv=5, κ=0.98κ=0.98 m s-2 (split as aobs,max=0.5a_obs,max=0.5, ωobs,max=0.4 _obs,max=0.4, vobs,nom=1.2v_obs,nom=1.2), comfortably inside the validity envelope κ<cminκ<c_ . Obstacle behavior model All obstacles are unicycle agents with radii sampled from ⁡(0.1,0.7)U(0.1,0.7) m. At each control step the nadvn_adv obstacles currently closest to the robot are designated adversarial, assigned capability κ=κmaxκ= _ , and controlled to minimize the instantaneous barrier rate. The designation is recomputed every cycle, so obstacles switch roles as the robot advances. The remaining (N−nadv)(N-n_adv) obstacles execute smooth motions with bounded accelerations and turn rates drawn from the same capability set ℱF. Every obstacle therefore violates DPCBF’s constant-velocity premise, while only the nearest nadvn_adv actively pursue the worst-case interaction. Baselines Besides DPCBF and the three AR variants (Hard, Soft, Buffer), we compare against a robust-CBF baseline, R-DPCBF, which receives the identical capability set ℱF but applies it pointwise to the barrier rate instead of contracting the barrier parameters. Its construction is given in Appendix A. Metrics Barrier violation, the event mint⁡h⁡(⁡(t))<0 _th( x(t))<0, is the primary metric. It is exactly the silent-failure event of Remark 5 and is detectable even when no collision occurs. Collision is the geometric event d⁡(t)<0d(t)<0, and QP infeasibility the per-cycle rate at which a controller’s safety program admits no input, normalized by executed steps. The adversary-count and capability sweeps use nseed=100n_seed=100 seeds per condition, the remaining sweeps nseed=25n_seed=25-5050 as stated per figure. Uncertainty is 95%95\% bootstrap CIs (40004000 resamples). All controllers see identical seeds and scenarios, so paired comparisons use the exact two-sided McNemar test on discordant pairs. VI-B Breakdown of the Nominal Safety Certificate Anatomy of a silent failure Figure 3 isolates the failure mechanism on a deterministic scenario (N=10N=10, nadv=5n_adv=5). DPCBF loses the safety certificate (mint⁡h=−3.53 _th=-3.53) and collides (Fig. 3(a)). The failure is silent: although the QP satisfies its nominal CBF constraint on 92%92\% of control cycles, the true barrier rate falls below −ψ⁡(h)-ψ(h) on 6.9%6.9\% of them because of the uncompensated disturbance Δ⁡(t) (t) (Fig. 3(b)). Thus, the controller continues enforcing the nominal safety condition even though the true certificate has already been violated, rather than becoming infeasible. On the identical scenario, Buffer AR-DPCBF maintains both barriers positive throughout (mint⁡h=0.64 _th=0.64, mint⁡h∗=0.18 _th^*=0.18) and preserves a minimum clearance of 0.930.93 m (Fig. 3(c)). Fig. 4: Buffer Soft AR-DPCBF navigation timelapse (mint⁡h∗=+0.21 _th^*=+0.21). The unsafe sets are drawn with their exact h=0\h=0\ (orange) and h∗=0\h^*=0\ (green) boundaries; the green set is the uniformly wider adversarial widening. The proactive buffer keeps the robot outside the contracted set throughout. Qualitative navigation Figure 4 shows Buffer AR-DPCBF traversing a dense field with the exact h=0\h=0\ and h∗=0\h^*=0\ boundaries drawn. The contracted set is the uniformly wider adversarial widening of Theorem 3, and the proactive buffer keeps the robot outside it for the entire run (mint⁡h∗=+0.21 _th^*=+0.21). Soft AR-DPCBF on a comparable scenario also reaches the goal with h>0h>0 throughout, but briefly enters the contracted set (mint⁡h∗=−0.08 _th^*=-0.08) because its penalty activates only once h∗<0h^*<0. The two variants, therefore, differ in when they respond. Adversarial fraction Figure 5 sweeps nadv∈0,…,15n_adv∈\0,…,15\ at fixed obstacle count N=15N=15, isolating the effect of adversarial intent because every obstacle maneuvers. Even at nadv=0n_adv=0, DPCBF violates its certificate in 54%54\% of trials despite only 10%10\% collisions, exposing the silent-failure mode caused by unmodeled obstacle maneuvers. As nadvn_adv increases, DPCBF violations rapidly saturate while collisions rise steadily, showing that the nominal certificate degrades under adversarial behavior. In contrast, all AR-DPCBF variants consistently reduce both metrics, preserving the ordering Buffer<Soft<Hard<DPCBFBuffer<Soft<Hard<DPCBF across the entire sweep. Hard AR-DPCBF closely matches the pointwise-robustified baseline R-DPCBF, demonstrating that robustifying the barrier derivative alone cannot replace contraction of the barrier geometry. Although enforcing the contracted barrier exactly reduces feasibility at high adversarial fractions, the soft variants recover near-nominal feasibility while retaining most of the robustness benefit. Goal attainment remains above 99%99\% for all methods, confirming that improved safety is achieved without sacrificing task completion. Fig. 5: Safety versus adversarial fraction at high density (N=15N=15, κ=0.98κ=0.98, n=100n=100, 95%95\% bootstrap CIs). (a) barrier violation, the silent-failure metric; (b) collision, its downstream consequence; (c) QP feasibility. The gap between (a) and (b) for DPCBF is the signature of the silent failure: the certificate is lost far more often than contact occurs. Statistical significance A paired evaluation over the six densest scenarios (N=15N=15, nadv∈5,7,9,11,13,15n_adv∈\5,7,9,11,13,15\; 600600 paired trials) confirms that the safety improvements observed in Fig. 5 are systematic rather than scenario-dependent. Relative to DPCBF, every AR variant reduces both collisions and barrier violations, with Buffer achieving the largest reduction, followed by Soft, Hard, and R-DPCBF. Exact two-sided McNemar tests show that all pairwise differences are statistically significant (p<10−3p<10^-3), except Hard versus R-DPCBF on barrier violations (p=0.041p=0.041), reflecting their similar performance. More importantly, the comparisons against DPCBF satisfies an even stronger property: across all 600600 paired trials, no AR variant violates the barrier on a seed where DPCBF remains safe. Thus, the improvement is not merely statistical but a strict containment relation. VI-C Robustness Across Adversary Capability We next evaluate performance under changes in the adversary’s maneuvering capability. Specifically, we examine robustness under increasing obstacle capability, sensitivity to capability misestimation, and the tightness of the theoretical feasibility condition, thereby assessing both the practical robustness and the validity of the proposed analysis. Robustness to Increasing Obstacle Capability Figure 6 fixes nadv=5n_adv=5 and sweeps the obstacle capability κ∈[0,cmin]κ∈[0,c_ ] (N=10N=10, nseed=100n_seed=100). At κ=0κ=0, the adversarial contraction vanishes (h∗≡h^*≡ h), and DPCBF, Hard AR-DPCBF, and R-DPCBF produce identical outcomes on every seed, exactly as predicted by Theorem 3(i). As κ increases, DPCBF rapidly loses both its safety certificate and collision avoidance performance. Hard AR-DPCBF and R-DPCBF substantially reduce barrier violations and collisions relative to DPCBF, and exhibit comparable robustness, consistent with both controllers accounting for the same capability set ℱF. The soft AR-DPCBF variants consistently outperform both, yielding the ordering Buffer<Soft<Hard≈R-DPCBF<DPCBFBuffer<Soft<\Hard -DPCBF\<DPCBF throughout the sweep. The primary distinction is feasibility (Fig. 6c). R-DPCBF retains near-nominal feasible-step rates comparable to DPCBF and the soft variants by reverting to the nominal DPCBF program whenever its pointwise robust constraint becomes infeasible. In contrast, Hard AR-DPCBF progressively loses feasible QP solutions as κ increases because it enforces the contracted barrier as a hard constraint. Consequently, while both Hard AR-DPCBF and R-DPCBF achieve similar robustness, the soft variants combine near-nominal feasibility with robustness gains beyond those attainable by R-DPCBF’s pointwise treatment of the adversary. Fig. 6: Safety versus adversary capability κ (N=10N=10, nadv=5n_adv=5, nseed=100n_seed=100, 95%95\% bootstrap CIs). (a) violation, (b) collision, (c) QP feasibility. DPCBF, Hard AR and R-DPCBF coincide exactly at κ=0κ=0 (Theorem 3(i)). The dotted line is the validity limit κ=cmin=1.40κ=c_ =1.40. Robustness to Capability Misestimation Figure 7 fixes the capability assumed by the controller at κasm=0.98 _ asm=0.98 and varies the obstacle’s true capability, κtrue∈[0.3,2.0] _ true∈[0.3,2.0] (nseed=25n_seed=25), thereby isolating the effect of capability misestimation. When κtrue<κasm _ true< _ asm, the controller is conservative, but its safety performance is essentially unchanged. As κtrue>κasm _ true> _ asm, the obstacle becomes increasingly more capable than assumed, yet Buffer AR-DPCBF degrades gradually rather than exhibiting a failure threshold, substantially outperforming DPCBF even when the true capability exceeds the assumed value by more than a factor of two. Soft AR-DPCBF follows the same trend but loses robustness more rapidly. Thus, capability underestimation results in graceful degradation rather than abrupt loss of safety. Fig. 7: Robustness to capability mismatch (nseed=25n_seed=25). (a) violation, (b) collision versus true capability κtrue _true, with the controller assuming κasm=0.98 _asm=0.98 m s-2 except for the matched Buffer baseline κasm=κtrue _asm= _true). Green: over-provisioned; red: under-provisioned. The feasibility condition is sound but conservative Theorem 10 guarantees maintainability of the adversarial certificate whenever cmin>κc_ >κ. To assess the tightness of this condition, we evaluate the worst-case Nagumo condition sup∈Uinfℱh˙∗≥0 _ u∈ U _F h^*≥ 0 at sampled boundary states (h∗=0h^*=0) with a single matched adversary, thereby isolating certificate maintainability from multi-obstacle interactions and closed-loop effects. Figure 8(b) shows that every sampled state within the certified region is maintainable, with no counterexamples, confirming the soundness of Theorem 10. However, the empirical maintainability boundary lies well beyond the theoretical one: the transition, where roughly half of the sampled boundary states become unmaintainable, occurs near cmin≈0.4c_ ≈ 0.4-0.90.9 even for κ up to 2.52.5. The conservatism, therefore, arises from the worst-case bounds (Λmin,Dmin)( _ ,D_ ) and the 1/γ1/γ barrier contraction rather than from the underlying geometry. Together with Fig. 7, these results show that the certificate remains maintainable well beyond its guaranteed region, while the closed-loop controller degrades gracefully once the guarantee no longer applies. Fig. 8: (a) Pooled collision (solid) and barrier-violation (hatched) rates across six dense conditions (N=15N=15, 600600 paired trials). (b) Empirical validation of Theorem 10: colour indicates the fraction of boundary states satisfying the worst-case Nagumo condition. The region above the dashed line, cmin=κc_ =κ, is certified as uniformly maintainable, while the empirical feasibility cliff occurs beyond this threshold. VI-D Mechanistic and Practical Validation This section examines the practical cost of its added robustness and its extension to unknown obstacle capabilities via online estimation. Necessity of Barrier Contraction R-DPCBF isolates the role of barrier contraction by using the same capability set ℱF as AR-DPCBF while applying robustness only to the instantaneous barrier derivative. Across all experiments, it consistently outperforms DPCBF but remains well below the soft AR-DPCBF variants, demonstrating that pointwise robustification alone cannot recover the robustness achieved by contracting the barrier geometry. The distinction is structural rather than numerical: pointwise worst-case guarantees h˙≥0 h≥ 0 only at the current state, whereas barrier contraction reserves safety margin over the entire engagement, preventing the system from entering states in which no admissible control can maintain the certificate. This is precisely the mechanism established by Theorem 3. R-DPCBF nevertheless illustrates an important trade-off. Because it leaves the nominal barrier unchanged, it preserves a larger feasible control set and achieves lower computational overhead than Hard AR-DPCBF. However, this efficiency comes at the expense of robustness: its collision performance plateaus as obstacle aggressiveness increases, whereas the contracted soft barriers continue to improve safety. Thus, the limitation of pointwise robustification is not computational efficiency but the absence of an anticipatory margin, highlighting barrier contraction as the essential ingredient for adversarial robustness. The Price of Robustness Figure 9 illustrates the trade-off between safety and efficiency by plotting collision rate against path overhead for nadv=5n_adv=5 and nadv=15n_adv=15. As expected, increased robustness incurs additional path length because larger safety margins require more conservative trajectories. However, the increase in overhead is modest relative to the reduction in collisions, with Buffer providing the best safety-efficiency trade-off. Increasing the adversarial fraction shifts the frontier primarily toward higher path overhead while leaving collision rates largely unchanged, indicating that denser adversarial environments increase the cost of safe navigation more than they reduce controller effectiveness. Goal attainment remains essentially unchanged across all controllers. Fig. 9: Safety-performance frontier at N=15N=15 for nadv=5n_adv=5 (left) and nadv=15n_adv=15 (right), nseed=100n_seed=100. Path overhead is computed on the paired subset of seeds on which every controller is collision-free. Sliding-Window Capability Estimation The preceding experiments assume a known obstacle capability. Figure 10 instead estimates κ online with the sliding-window estimator of Section IV-H, supplying the estimate to the controller each cycle and comparing against an oracle using the true value. Across all noise levels, the estimated-capability controller keeps violations and collisions below 17%17\% and 7%7\%, respectively, substantially outperforming DPCBF (93%93\%, 43%43\%) and matching or exceeding the oracle. The improvement arises because the estimator upper-bounds the true capability with empirical coverage P⁡(κ~≥κ)=0.95P( κ≥κ)=0.95-0.990.99, adding conservatism under measurement uncertainty; as noise decreases, the margin vanishes and the estimator approaches the oracle, consistent with Proposition 12. The estimator is, therefore, a practical mechanism for deploying AR-DPCBF when obstacle capabilities are unknown. Fig. 10: Closed-loop safety with the online-estimated capability (Section IV-H, Proposition 12; Soft AR-DPCBF, nseed=30n_seed=30). (a) violation and (b) collision versus sensor noise, with DPCBF and oracle-κ as references; (c) the estimate κ~ κ over-covers the true κ with coverage P[κ~≥κ]≥0.95P[ κ≥κ]≥ 0.95. VII Conclusion We identified a structural limitation of CBF-based dynamic obstacle avoidance: under the common constant-velocity assumption, the safety certificate can remain satisfied even as maneuvering obstacles violate it. To address this, we proposed AR-DPCBF, which models obstacles as bounded-authority adversaries and reserves a certified safety margin through a state-dependent contraction of the DPCBF certificate. Exploiting the structure of the LoS dynamics yields a closed-form adversarial barrier, explicit feasibility conditions relating robot and obstacle capabilities, and practical controller formulations that recover feasibility in dense environments and accommodate unknown obstacles capabilities through online estimation. Extensive simulations validate the proposed framework across varying adversarial fractions, obstacle capabilities, and capability mismatch, demonstrating consistent elimination of the silent-failure mode of nominal DPCBF. Comparisons with a pointwise robust baseline further establish that contracting the barrier geometry, rather than merely robustifying its instantaneous derivative, is the essential mechanism for anticipatory safety against maneuvering obstacles. Future work includes deriving controllers that jointly guarantee safety and feasibility, extending the framework to richer vehicle and obstacle dynamics. References [1] A. Haraldsen, M. S. Wiig, A. D. Ames, and K. Y. Pettersen (2024) Safety-critical control of nonholonomic vehicles in dynamic environments using velocity obstacles. In 2024 American Control Conference (ACC), p. 3152–3159. Cited by: §I. [2] J. Huang, J. Zeng, X. Chi, K. Sreenath, Z. Liu, and H. Su (2025) Dynamic collision avoidance using velocity obstacle-based control barrier functions. IEEE Transactions on Control Systems Technology 33 (5), p. 1601–1615. Cited by: §I. [3] A. D. Ames, X. Xu, J. W. Grizzle, and P. Tabuada (2017) Control barrier function based quadratic programs for safety critical systems. IEEE Transactions on Automatic Control 62 (8), p. 3861–3876. External Links: Document Cited by: §I, Definition 1. [4] W. Xiao and C. Belta (2019) Control barrier functions for systems with high relative degree. In Proc. IEEE 58th Conf. on Decision and Control (CDC), p. 474–479. External Links: Document Cited by: §I. [5] W. Xiao and C. Belta (2022) High-order control barrier functions. IEEE Transactions on Automatic Control 67 (7), p. 3655–3662. External Links: Document Cited by: §I. [6] P. Fiorini and Z. Shiller (1998) Motion planning in dynamic environments using velocity obstacles. The International Journal of Robotics Research 17 (7), p. 760–772. External Links: Document Cited by: §I. [7] B. G. Goswami, M. Tayal, K. Rajgopal, P. Jagtap, and S. Kolathaya (2024) Collision cone control barrier functions: experimental validation on UGVs for kinematic obstacle avoidance. In Proc. American Control Conference (ACC), p. 325–331. External Links: Document Cited by: §I. [8] H. K. Park, T. Kim, and D. Panagou (2026) Beyond collision cones: dynamic obstacle avoidance for nonholonomic robots via dynamic parabolic control barrier functions. In IEEE International Conference on Robotics and Automation (ICRA), Cited by: §I, §I-C, §I-C, §I-D, §I, TABLE I, TABLE I, Assumption 4, Remark 4, Remark 5. [9] M. Jankovic (2018) Robust control barrier functions for constrained stabilization of nonlinear systems. Automatica 96, p. 359–367. External Links: Document Cited by: §I. [10] X. Xu, P. Tabuada, J. W. Grizzle, and A. D. Ames (2015) Robustness of control barrier functions for safety critical control. IFAC-PapersOnLine 48 (27), p. 54–61. External Links: Document Cited by: §I. [11] Q. Nguyen and K. Sreenath (2022) Robust safety-critical control for dynamic robotics. IEEE Transactions on Automatic Control 67 (3), p. 1073–1088. Cited by: §I. [12] J. Breeden and D. Panagou (2023) Robust control barrier functions under high relative degree and input constraints for satellite trajectories. Automatica 155, p. 111109. Cited by: §I. [13] S. Kolathaya and A. D. Ames (2019) Input-to-state safety with control barrier functions. IEEE Control Systems Letters 3 (1), p. 108–113. Cited by: §I. [14] A. Alan, A. J. Taylor, C. R. He, A. D. Ames, and G. Orosz (2023) Control barrier functions and input-to-state safety with application to automated vehicles. IEEE Transactions on Control Systems Technology 31 (6), p. 2744–2759. Cited by: §I. [15] A. Alan, T. G. Molnar, A. D. Ames, and G. Orosz (2023) Parameterized barrier functions to guarantee safety under uncertainty. IEEE Control Systems Letters 7, p. 2077–2082. External Links: Document Cited by: §I. [16] E. Daş and R. M. Murray (2022) Robust safe control synthesis with disturbance observer-based control barrier functions. In 2022 IEEE 61st conference on decision and control (CDC), p. 5566–5573. Cited by: §I. [17] E. Daş and J. W. Burdick (2025) Robust control barrier functions using uncertainty estimation with application to mobile robots. IEEE Transactions on Automatic Control 70 (7), p. 4766–4773. Cited by: §I. [18] Y. S. Quan, J. Zhou, E. Frisk, and C. C. Chung (2025) Observer-based environment robust control barrier functions for safety-critical control with dynamic obstacles. IEEE Control Systems Letters. Cited by: §I. [19] K. H. Kim, M. Diagne, and M. Krstić (2025) Robust control barrier function design for high relative degree systems: application to unknown moving obstacle collision avoidance. In 2025 American Control Conference (ACC), p. 355–360. Cited by: §I. [20] I. M. Mitchell, A. M. Bayen, and C. J. Tomlin (2005) A time-dependent hamilton-jacobi formulation of reachable sets for continuous dynamic games. IEEE Transactions on automatic control 50 (7), p. 947–957. Cited by: §I, Remark 2. [21] S. Bansal, M. Chen, S. Herbert, and C. J. Tomlin (2017) Hamilton-Jacobi reachability: a brief overview and recent advances. In Proc. IEEE 56th Conf. on Decision and Control (CDC), p. 2242–2253. External Links: Document Cited by: §I. [22] T. Fraichard and H. Asama (2004) Inevitable collision states — a step towards safer robots?. Advanced Robotics 18 (10), p. 1001–1024. External Links: Document Cited by: §I, Definition 3. [23] P. Polack, F. Altché, B. d’Andréa-Novel, and A. de La Fortelle (2017) The kinematic bicycle model: a consistent model for planning feasible trajectories for autonomous vehicles?. In 2017 IEEE intelligent vehicles symposium (IV), p. 812–818. Cited by: §I-B. [24] J. J. Choi, D. Lee, K. Sreenath, C. J. Tomlin, and S. L. Herbert (2021) Robust control barrier–value functions for safety-critical control. In 2021 60th IEEE Conference on Decision and Control (CDC), p. 6814–6821. Cited by: Remark 2. Appendix A Pointwise Robustification Baseline (R-DPCBF) As a baseline, we consider a robustified version of DPCBF that accounts for bounded obstacle maneuvers directly in the barrier-rate constraint. The controller assumes the same obstacle capability set ℱF as AR-DPCBF but treats the unknown obstacle inputs as a disturbance acting on h˙ h. Since the DPCBF barrier h depends on the relative velocity, it has relative degree one with respect to the obstacle inputs. Its time derivative can therefore be decomposed as h˙ h =Lh+Lh+(∇oh)⊤o+Δ⁡(,ao,ωo), =L_ fh+L_ gh\, u+( _ p_oh) v_o+ ( x,a_o, _o), (65) where Δ⁡(,ao,ωo)=(∂h/∂o)ao+(∂h/∂θo)ωo. ( x,a_o, _o)=(∂ h/∂ v_o)a_o+(∂ h/∂ _o) _o. For (ao,ωo)∈ℱ(a_o, _o) , the disturbance satisfies Δ⁡(,ao,ωo)≥−m⁡() ( x,a_o, _o)≥-m( x), where m⁡()=aobs,max‖∇oh‖+ωobs,max|∂θoh|.m( x)=a_obs,max\| _ v_oh\|+ _obs,max| _ _oh|. Substituting into h˙+ψ⁡(h)≥0 h+ψ(h)≥ 0 yields, Lh+Lh+(∇oh)⊤o−m⁡()≥−ψ⁡(h),L_ fh+L_ gh\, u+( _ p_oh) v_o-m( x)≥-ψ(h), (66) which guarantees h˙≥−ψ⁡(h) h≥-ψ(h) for every admissible obstacle input. Since m⁡()m( x) depends only on the state, (66) remains affine in the control input. The resulting controller therefore retains the same quadratic-program structure as DPCBF. Appendix B Additional Theoretical Proofs Lemma 14. Suppose (28) holds, so that λ∗,μ∗≥0λ^*,μ^*≥ 0 on ℬ=∂∗∩Ω∩d≥rB= ^*∩ ∩\d≥ r\ (Corollary 4). Let Σ+:=(kμdmax)2/(4vrel,min2) ^+:=(k_μd_ )^2/(4v_rel,min^2). If kμdmax<2vrel,min,k_μ\,d_ <2\,v_rel,min, (67) then Λ⁡()≥1−Σ+>0 ( x)≥ 1- ^+>0 for every ∈ℬ x , so Λmin:=infℬΛ≥1−Σ+>0 _ := _B ≥ 1- ^+>0. Proof. From (44) and the inequality a2+b2≥|a| a^2+b^2≥|a|, we have Λ≥|1−σv~rel,x| ≥|1-σ v_rel,x|. It therefore suffices to obtain an upper bound on σv~rel,xσ v_rel,x. From (25), κd/(γ⁡∥rel∥)=kμd−μ∗κ d/(γ v_rel )=k_μd-μ^*. Substituting this into (33) and multiplying by ∥rel∥2 v_rel ^2 gives σ∥rel∥2=λ∗v~rel,y2+μ∗−kμd.σ v_rel ^2=λ^* v_rel,y^2+μ^*-k_μd. On ∂∗ ^*, the boundary condition h∗=v~rel,x+λ∗v~rel,y2+μ∗=0h^*= v_rel,x+λ^* v_rel,y^2+μ^*=0 implies λ∗v~rel,y2+μ∗=−v~rel,xλ^* v_rel,y^2+μ^*=- v_rel,x, and hence σ∥rel∥2=−v~rel,x−kμd.σ v_rel ^2=- v_rel,x-k_μd. Since λ∗,μ∗≥0λ^*,μ^*≥ 0 on ℬB, the boundary condition also gives v~rel,x=−(λ∗v~rel,y2+μ∗)≤0 v_rel,x=-(λ^* v_rel,y^2+μ^*)≤ 0. Multiplying by v~rel,x/∥rel∥2 v_rel,x/ v_rel ^2 and introducing χ:=v~rel,x/∥rel∥χ:= v_rel,x/ v_rel , we obtain σv~rel,x=−χ2−(kμd/∥rel∥)χ,σ v_rel,x=-χ^2-(k_μd/ v_rel )χ, with χ∈[−1,0]χ∈[-1,0] because |v~rel,x|≤∥rel∥| v_rel,x|≤ v_rel and v~rel,x≤0 v_rel,x≤ 0. The right-hand side is a concave quadratic in χ with stationary point χ∗=−kμd/(2∥rel∥)χ^*=-k_μd/(2 v_rel ). Moreover, on ℬB we have d≤dmaxd≤ d_ and ∥rel∥≥vrel,min v_rel ≥ v_rel,min, so kμd2∥rel∥≤kμdmax2vrel,min<1 k_μd2 v_rel ≤ k_μd_ 2v_rel,min<1 by (67), hence χ∗∈(−1,0)χ^*∈(-1,0) and the maximum of the quadratic over [−1,0][-1,0] is attained at χ∗χ^*. Evaluating the quadratic at χ∗χ^* yields σv~rel,x≤14(kμd∥rel∥)2≤14(kμdmaxvrel,min)2=Σ+.σ v_rel,x≤ 14 ( k_μd v_rel )^2≤ 14 ( k_μd_ v_rel,min )^2= ^+. Under (67), Σ+<1 ^+<1, and therefore 1−σv~rel,x≥1−Σ+>01-σ v_rel,x≥ 1- ^+>0. Consequently, Λ≥|1−σv~rel,x|=1−σv~rel,x≥1−Σ+. ≥|1-σ v_rel,x|=1-σ v_rel,x≥ 1- ^+. Taking the infimum over ℬB yields Λmin=infℬΛ≥1−Σ+>0 _ = _B ≥ 1- ^+>0. ∎

Instant research discovery