{"id":"da3f0095-f47a-4459-aa01-20009b46e1ca","arxiv_id":"2608.07751","paper_version":1,"verdict":"UNVERDICTED","confidence":"LOW","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"CoCoNav combines horizon-specific conformal PI calibration with a relax-then-verify MPC planner to provide runtime-certified crowd navigation.","lead":"CoCoNav is a robot navigation system that uses online conformal prediction to keep safety bounds up to date and a relax-then-verify planner to keep the navigation solver from failing. It aims to balance collision avoidance, task success, and navigation speed in crowded spaces, and reports simulations plus quadruped experiments.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The certificate's safety rests on the conformal PI controller's coverage under distribution shift; the abstract's 'long-run' guarantee may fail in bursts, leaving the verification unsafe.","rationale":"The reader already identified the distribution-shift assumption as the weakest point, and the abstract-only evidence does not allow us to verify it. My stress-test sharpens that concern by distinguishing long-run marginal coverage from the finite-horizon, per-interval coverage needed to certify collision avoidance. This distinction matters because a time-averaged guarantee permits bursts of violations that could cause a collision during an episode. Since no full text is available, I cannot confirm the attack; if the paper's proof includes finite-time violation bounds or a valid non-stationarity assumption, the attack would not land. The verdict stays UNVERDICTED pending full text; no adjustment is needed.","tokens_in":741,"tokens_out":3601,"duration_ms":39223,"concrete_test":"Obtain the full text and examine the theorem giving the PI controller's coverage. Identify whether it relies on a bounded-drift or bounded-total-variation assumption and whether it limits the maximum number of consecutive violations. Then run the simulator (or a synthetic test) with a piecewise-constant pedestrian model: target crossing speed doubles at t = 50 s while the planner continues to use the previously calibrated bound. Measure the empirical coverage in the 10 s after the shift. If coverage drops materially below the nominal level or the certificate erroneously validates a trajectory with a predicted collision, the long-run guarantee is insufficient for the claimed safety. If the controller's integral action recovers coverage quickly and the verification catches the violation, the concern is resolved.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is that certified trajectories are safe. That claim chains on the conformal PI controller: the calibrated error bounds must cover the actual pedestrian-trajectory prediction errors at execution time. The abstract promises 'long-run empirical coverage,' which is a time-averaged property. Standard online conformal guarantees under non-exchangeable data (e.g., Gibbs–Candès, conformal PID) require explicit restrictions on the rate or pattern of distribution shift, and even then they control average coverage rather than per-interval failure. A sustained or abrupt behavior change can create a burst of undercoverage: for the whole burst the error bounds are too small, so the relax-then-verify certificate may certify trajectories that genuinely collide. The abstract states neither the required drift assumptions nor a finite-horizon coverage bound. If such assumptions are absent from the full proof, the safety certificate does not logically follow from the described algorithm. This is the weakest link because every downstream comparison to baselines is informative only if the certificate actually guarantees the claimed risk level.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"This abstract-only review assesses CoCoNav, a crowd-navigation framework that pairs a horizon-specific conformal proportional--integral controller (which adapts trajectory-error bounds to regulate long-run empirical coverage) with a relax-then-verify planner: soft-constrained MPC generates nominal trajectories, and a separate verification step certifies these trajectories, together with contingency maneuvers, against the calibrated bounds. The authors claim that this preserves MPC feasibility while providing runtime-certified safety, and report favorable results in simulations and quadruped experiments. Because the full text is not available, the assessment is limited to the claims and definitions presented in the abstract.","tokens_in":943,"tokens_out":2612,"duration_ms":27935,"significance":"If the central claims are substantiated, the paper addresses a real and recognized problem: balancing collision avoidance, task success, and navigation efficiency under uncertain and shifting pedestrian behavior without sacrificing MPC feasibility. The separation of planning and certification is an elegant structural idea, and the use of online conformal calibration to avoid restrictive error models is a promising direction. The inclusion of both simulation and quadruped experiments is also a strength in principle. However, the abstract alone does not provide enough evidence to assess whether the safety certificate is mathematically valid or whether the experimental claims are statistically supported.","major_comments":[{"comment":"The safety certificate's validity rests on the conformal PI controller's 'long-run empirical coverage' of trajectory prediction errors under shifting pedestrian behavior. The abstract asserts this property but states no assumptions on the pattern or rate of distribution shift; without assumptions such as bounded total variation or a finite-horizon error bound, a burst of undercoverage can occur and the certificate may certify genuinely unsafe trajectories. The full text must state the exact coverage guarantee and its conditions.","section":"Abstract"},{"comment":"The claim that 'Simulations and quadruped experiments show that CoCoNav achieves a favorable balance' is not testable from the abstract, which reports no quantitative metrics, error bars, or statistical comparisons against baselines. A journal submission should report numeric collision rates, success rates, navigation times, and confidence intervals, together with baseline comparisons, to support this claim.","section":"Abstract"},{"comment":"The phrase 'certifying them, together with contingency maneuvers, against the calibrated bounds' is underspecified: the certificate is meaningful only if the contingency maneuvers are dynamically feasible within the robot's actuation limits and within the relevant time horizon, and if the verified set is a true reachability or safety guarantee. The abstract does not state what the verification step actually computes (e.g., forward reachable sets, invariant sets, or braking distances), so the safety-preservation property of 'relax-then-verify' is not yet established.","section":"Abstract"}],"minor_comments":[{"comment":"The term 'long-run empirical coverage' should be defined precisely (e.g., coverage over a moving window, the length of the window, and whether it is an average over time or over all pedestrians).","section":"Abstract"},{"comment":"The phrase 'horizon-specific conformal proportional--integral controller' is dense; a brief explanation of how the PI gains affect the coverage adaptation would improve readability.","section":"Abstract"},{"comment":"The expression 'relax-then-verify' is suggestive but not self-explanatory; the abstract should clarify the relationship between the soft-constrained nominal trajectory and the certified trajectory (e.g., whether the verified trajectory is a modification of the nominal one).","section":"Abstract"}],"recommendation":"major_revision","confidential_remarks":"This review is based solely on the abstract, as the full text was not made available. The central proposal is interesting and potentially publishable, but the abstract omits the statistical assumptions needed for the safety certificate and reports experimental results without quantitative support. I recommend a major revision that supplies the missing coverage theorem with explicit drift assumptions, a precise description of the verification procedure, and a full experimental evaluation with error bars and statistical tests. If the full text already contains these elements, the revision should make them visible in the abstract."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: this is a promising combination — online conformal calibration feeding a relax-then-verify planner — and the abstract reads like the authors know the MPC-infeasibility problem from the inside. But with only the abstract in front of me, the safety claim rests on a chain I cannot inspect, and the weakest link is the conformal PI controller's coverage guarantee under shifting pedestrian behavior.\n\nWhat's actually new: the horizon-specific conformal PI controller, which tunes trajectory-error bounds online to regulate long-run coverage, is a sensible adaptation of the conformal-PID literature to prediction-error bounds in crowd navigation. Separating the nominal MPC (soft constraints, so always feasible) from the certification step is a sound way around the 'hard uncertainty sets make MPC infeasible' problem. That decomposition deserves to be taken seriously even before the numbers are checked.\n\nThe paper also sets its claims at a reasonable height: simulations and a quadruped experiment against several baselines, with the stated result being a 'favorable balance' rather than outright domination. That phrasing is honest.\n\nSoft spots, in proportion. The one that matters is the one the stress test flagged: the planner certifies trajectories against calibrated error bounds, and if those bounds hold in a long-run average sense but under-cover in bursts, a 'certified' trajectory can be unsafe exactly when pedestrian behavior shifts suddenly. The abstract says 'long-run empirical coverage' — that is an average property. Standard online conformal guarantees under non-exchangeable data come with drift assumptions and still control mean coverage rather than per-interval failure. If the full proof only establishes long-run coverage, the safety certificate is weaker than the word 'safe' suggests. This is a question for the authors, not a demonstrated flaw: I cannot see the full paper.\n\nThe other soft spot is that the abstract carries no quantitative results, error bars, or statistical comparisons, so the experimental claims are uncheckable from what I have. That is a normal limitation of an abstract, but it means I am not endorsing the results.\n\nWho is this for: robotics people working on safe MPC or on conformal prediction in control, and anyone who thinks seriously about what 'certificate' can mean when the environment is not exchangeable.\n\nRecommendation: send it to peer review. The idea is coherent, the problem is real, and the combination is new enough to earn a referee's hour. The referee should chase the coverage-under-shift assumption first, then ask for experiment tables with error bars and a baseline-by-baseline breakdown.","headline":"CoCoNav is a promising, novel combination of online conformal calibration and relax-then-verify MPC that deserves referee time, but the safety certificate's coverage-under-shift assumption is the thing to scrutinize.","tokens_in":1434,"tokens_out":3247,"would_cite":false,"duration_ms":30671,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"CoCoNav separates planning from safety certification to keep robot navigation safe and feasible.","keywords":["crowd navigation","conformal prediction","model predictive control","safety certificate","distribution shift","uncertainty quantification","quadruped robot"],"falsifier":"Deploy CoCoNav in a crowd and then introduce a sudden, persistent change in pedestrian motion, for example all pedestrians abruptly adopt a new avoidance rule or double their walking speed. Record the empirical coverage of the trajectory-error bounds over a long horizon: if the coverage rate drops substantially below the target and stays there, or if a collision occurs that the certificate should have ruled out, then the coverage-regulation claim is falsified.","tokens_in":551,"feed_emoji":"🤖","tokens_out":3158,"duration_ms":31153,"temperature":0.7,"pith_summary":"This paper proposes a crowd-navigation framework, CoCoNav, that aims to make robot navigation safe in crowded spaces without sacrificing feasibility or efficiency. It claims that by separating the planning problem from the safety-certification problem, a robot can always generate a nominal trajectory because soft-constrained MPC is always feasible, while a separate verification step certifies that trajectory and its contingency maneuvers against statistically calibrated prediction-error bounds. The calibration is performed online by a horizon-specific conformal proportional-integral controller that adjusts error bounds so their long-run empirical coverage stays at a target level. Simulations and quadruped experiments are presented as evidence that this approach achieves a favorable balance among collision avoidance, task success, and navigation efficiency.","feed_headline":"Relax-then-verify keeps robot navigation safe and feasible","feed_subtitle":"A conformal controller calibrates prediction-error bounds online, so trajectories are certified before the robot moves.","key_machinery":"The central mechanism is a two-stage relax-then-verify planning loop. Stage one uses soft-constrained MPC to generate nominal trajectories without hard safety constraints, so the solver always has a feasible solution. Stage two certifies the nominal trajectory and contingency maneuvers against calibrated trajectory-error bounds before execution. The bounds come from a horizon-specific conformal proportional-integral controller, which is a feedback loop that treats the empirical coverage of prediction errors as the controlled variable and adjusts quantile-based conformal bounds for each horizon to track a target coverage level. This decouples the planner's feasibility problem from the statistical validity problem, allowing safety certification to remain meaningful even as pedestrian behavior changes.","core_discovery":"The central claim is that a robot can navigate through crowds safely even when pedestrian-motion predictions are unreliable, by making the safety guarantee a separate statistical object rather than a hard constraint in the optimizer. The planner uses soft-constrained MPC to generate nominal trajectories, so the optimization remains feasible; before execution, a verifier checks the nominal trajectory and its contingency maneuvers against error bounds produced by an online conformal PI controller. The controller dynamically widens or narrows the bounds per horizon to keep the empirical coverage of trajectory predictions at the desired long-run rate, which lets the framework respond to shifting prediction errors. The claimed result is a favorable balance among collision avoidance, task success, and navigation efficiency in simulations and quadruped experiments.","pith_inferences":["This framework suggests a general template: first generate candidate trajectories with an unconstrained or soft-constrained optimizer, then filter them through a statistical safety certificate before execution, which could apply well beyond crowd navigation.","A natural testable extension is to apply the horizon-specific conformal PI controller to other prediction tasks, such as human motion forecasting in shared autonomy, and check whether the coverage regulation property persists.","Separating planning from certification opens the door to using planners that are not differentiable or not based on MPC, since the certificate is agnostic to how the candidate trajectory was produced."],"forward_implications":["Robot navigation can remain safe even when the pedestrian prediction model is misspecified, because the error bounds are calibrated to observed data rather than assumed in advance.","MPC solver feasibility no longer competes with safety: because constraints are soft during planning and safety is verified separately, a trajectory can always be found even in dense crowds.","Long-run coverage regulation lets the framework adapt to shifting prediction errors, avoiding both over-conservative bounds that make navigation sluggish and over-confident bounds that risk collisions.","The relax-then-verify design can be reused in other safety-critical planning problems where hard constraint tightening would make the optimization infeasible."],"supporting_citations":[],"fun_headline_variants":["CoCoNav: certifying crowd navigation on the fly","Separate safety from optimization in crowd navigation","Relax-then-verify: safe and feasible crowd navigation","Conformal control tunes safety bounds for robot navigation","Adaptive error bounds let robots navigate crowds safely"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that the online conformal coverage controller maintains its long-run coverage guarantee even when pedestrian behavior shifts, which requires unstated assumptions about how quickly or smoothly the prediction-error distribution can change.","fun_headline_variants_meta":{"raw":{"variants":["CoCoNav: certifying crowd navigation on the fly","Separate safety from optimization in crowd navigation","Relax-then-verify: safe and feasible crowd navigation","Conformal control tunes safety bounds for robot navigation","Adaptive error bounds let robots navigate crowds safely"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000522,"raw_usage":{"total_tokens":2477,"prompt_tokens":849,"completion_tokens":1628,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":465,"completion_tokens_details":{"reasoning_tokens":1553}},"tokens_in":465,"tokens_out":1628,"duration_ms":11334,"temperature":1.0,"reasoning_tokens":1553,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T00:19:23.299031+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Deploy CoCoNav in a crowd and then introduce a sudden, persistent change in pedestrian motion, for example all pedestrians abruptly adopt a new avoidance rule or double their walking speed. Record the empirical coverage of the trajectory-error bounds over a long horizon: if the coverage rate drops substantially below the target and stays there, or if a collision occurs that the certificate should have ruled out, then the coverage-regulation claim is falsified.","supporting_citations":[],"review_version":1}