REVIEW 3 major objections 5 minor 2 cited by
DualGuard MPPI: Safe and Performant Optimal Control by Combining Sampling-Based MPC and Hamilton-Jacobi Reachability
T0 review · 3 major / 5 minor · reviewed 2026-08-09 · deepseek-v4-flash
Pith's one-line read DualGuard-MPPI integrates Hamilton-Jacobi reachability filters into both the sampling and execution stages of MPPI, making every sampled rollout provably safe while improving performance.
desk verdict Clean algorithm and strong experiments, but the discrete-time safety guarantee is oversold. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The key machinery is the least restrictive filter (LRF) built from a time-converged Hamilton-Jacobi reachability value function. The value function satisfies a Hamilton-Jacobi-Isaacs variational inequality, and its sub-zero level set is the backward reachable tube (BRT): the set of states from which a failure is unavoidable despite best control. The LRF switches between a nominal control and the reachability safe control exactly when the value function is zero, which keeps the value non-negative and the state inside the safe set. DualGuard-MPPI applies this LRF at every step of every sampled rollout during MPPI's forward simulation, and once more to the output control sequence, which is what makes every generated sample provably safe and prevents a multimodal mixture of safe but divergent maneuvers from averaging into an unsafe command.
What would settle it
Run DualGuard-MPPI with a value function computed on a grid matching the control period, and inject the worst-case disturbance from the dynamics model (for the RC car, $d_x,d_y=\pm0.1$ m/s) starting from a state just inside the safe set; if any filtered rollout or executed trajectory reaches a state with value function $\leq 0$ or enters the failure set, the paper's claim that all samples are provably safe is falsified, while a sweep of such adversarial initial states that always keeps $V(x)>0$ would support the claim.
Extended reading notes
Core claim
The paper's central claim is that safety constraints can be moved from the cost function into the sampling process itself, and that doing so is both safer and more performant. DualGuard-MPPI computes the Hamilton-Jacobi backward reachable tube of the failure set offline, giving a value function whose sub-zero level set marks states from which entering the failure set is unavoidable under worst-case disturbance. During each MPPI iteration, every sampled control sequence is passed through a least restrictive filter at every horizon step, so the simulated rollout is safe by construction; the filtered perturbation, not the raw sample, is used in the information-theoretic update. The resulting optimal control sequence is filtered once more before execution. Because all K samples are safe, none are discarded for safety reasons, effective sampling variance drops, and the remaining computation is spent optimizing performance. The paper reports zero safety violations and lower normalized cost across 100 random episodes in two simulation domains, and higher lap speed on a hardware RC car, relative to penalty-based, BRT-penalty, LRF-only, and Shield-MPPI baselines.
Load-bearing premise
The safety guarantee rests on the assumption that the discrete-time safety check, made with a numerically computed map of unsafe states, acts often enough that the real system, with its estimation errors and disturbances, can never reach an unsafe state between two checks.
Editorial extensions
If this is right
- DualGuard-MPPI achieves zero safety violations in all tested domains while maintaining or improving success rate and cost relative to penalty-based MPPI and single-layer LRF baselines.
- Because every sample is safe, the method sustains high performance with far fewer samples: with 60 samples it keeps a 96% success rate in the planar navigation domain, versus at most 70% for the closest baseline.
- Safety penalty terms can be removed from the MPPI cost function, eliminating the need to tune safety-related weights.
- The second filtering stage resolves the multimodality failure mode in which averaging two safe swerves (left and right around an obstacle) would produce a straight, unsafe command.
- The full algorithm runs on an RC car at 50 Hz with 1000 parallel rollouts, staying within the 20 ms control budget.
Reading between the lines
- The same two-filter architecture could be applied to other sampling-based optimal controllers that aggregate weighted trajectories, if they have access to a similar value-function representation of the safe set.
- If the offline BRT computation is replaced by online or learning-based reachability updates, the framework could extend to changing environments, though the safety guarantee would then inherit the approximation error of the updated value function.
- The hardware results suggest that the in-sampling filter (not the output filter) provides most of the performance gain; a controlled ablation separating the two stages would quantify each stage's contribution.
- A formal account of how the value-function grid resolution, control period, and disturbance bound interact would turn the empirical safety margin into a tunable design parameter, allowing users to trade conservatism for agility.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper proposes DualGuard-MPPI, a sampling-based model predictive control method that integrates Hamilton-Jacobi reachability analysis into the MPPI sampling procedure. An offline-computed backward reachable tube and value function are used to build a least-restrictive safety filter, which is applied both to each sampled rollout during the MPPI update and to the final control sequence at execution. The authors claim that this architecture ensures all generated samples are provably safe, eliminates the need for safety penalty tuning, improves sample efficiency, and outperforms penalty-based and single-filter MPPI baselines. The method is evaluated in two simulation domains (planar navigation and quadrotor navigation) and on a hardware RC car, with results reported over 100 episodes per simulation setting and a multiple-lap hardware run.
Significance. If the safety guarantee is made rigorous or appropriately qualified, the paper makes a useful contribution: it demonstrates a practical way to combine a least-restrictive filter with MPPI so that all samples contribute to the performance objective rather than being discarded as unsafe. The multimodality motivation for an output filtering stage is well presented, and the empirical evaluation is comparatively thorough: 100-episode simulations with standard errors and paired t-tests, three experimental settings, and a hardware demonstration. The performance improvements over penalty-based and single-layer-filter baselines are consistent and generally statistically significant. The main weakness is that the core safety guarantee is inherited from prior work [6] and is not re-derived or verified for the discrete-time, numerically approximated implementation used in the algorithm, which is a load-bearing issue for the paper's central claim.
major comments (3)
- [§IV-A, eq. (11)] The central safety claim is not established for the implemented discrete-time filter. The LRF guarantee in eq. (11) is a continuous-time statement: applying u_safe when V(x)=0 keeps the trajectory in the safe set. In Alg. 1, however, the filter is evaluated only at discrete instants along each rollout and at execution. For a nonzero interval Δt, V(x_j)>0 at the start of an interval does not prevent the state from crossing V=0 and entering the failure set before the next evaluation. The paper does not provide a margin ε (e.g., switching when V(x)≤ε) or a discrete-time invariance argument, nor does it analyze how the numerical approximation error in V(x) from the LevelSetToolbox is absorbed. Consequently, the statements 'ensures that all generated samples are provably safe' (abstract) and 'guaranteed to maintain safety' (§IV-A) are stronger than what the implementation supports. This gap is load-bearing for the main contribution, so it should be addressed by adding a margin analysis, a discrete-time certificate, or by explicitly qualifying the safety guarantee to the continuous-time idealization.
- [§V-B, eq. (13)] The quadrotor experiment uses zero-mean Gaussian noise to simulate actuation errors, but the reachability-based guarantee requires bounded disturbances, as stated in §II and used in the BRT computation (eqs. (6)–(8)). If the Gaussian noise is unbounded, or if the BRT was computed with a different disturbance model than the one used in the simulation, the 'provably safe' claim does not apply to this experiment. The authors should either include the noise as a bounded disturbance in the reachability computation and report the bound, or state that the guarantee holds only for the nominal noiseless dynamics and that the Gaussian noise is an additional empirical robustness check.
- [§IV-B] The description of the output filtering stage is ambiguous with respect to the MPPI update rule. The text states that the filtered control perturbations Δk_j are used in the update rule (3), but (3) is defined in terms of the original random perturbations δk_j. If the filtered perturbations are substituted, the information-theoretic justification of the MPPI update no longer applies, and the effects on the optimality of the resulting controller should be discussed. In addition, the output LRF is applied only to the first control u*_0; since this filter is evaluated at a discrete instant, the same inter-sample safety issue raised for the rollouts applies to the executed trajectory as well.
minor comments (5)
- [§V-A, Table I] The sentence 'all methods with an output LRF avoid collisions as expected' reports an empirical observation over 100 episodes; this should be phrased as an empirical result, not as evidence for the theoretical guarantee.
- [Alg. 1] The pseudocode for Alg. 1 is referenced but does not appear in the manuscript; please include it or a more detailed algorithmic description, since the distinction between filtering at rollout time and at output time is central to the paper.
- [§V, RelCost metric] RelCost is normalized to the proposed method's mean cost and computed only over trajectories that are common and safe for both methods; the number of common episodes is not reported, which makes the magnitude of the reported differences harder to interpret.
- [§V, eqs. (12) and (16)] The running-cost expressions mix a continuous-time formulation in eq. (1) with discrete-time sums in eqs. (12) and (16); the discretization used in the implementation should be stated explicitly.
- [Throughout] The phrase 'provably safe' is used in the abstract and contributions; consider replacing it with a more qualified statement such as 'safe when the continuous-time LRF with the numerically computed value function is available' to avoid overclaiming in light of the discrete-time implementation.
Circularity Check
No significant circularity: the safety guarantee is imported from peer-reviewed prior work, and the performance gains are empirical, not derived from an equation containing the result.
full rationale
The central safety claim is 'provably safe' via the least-restrictive filter of eq. (11), whose guarantee is delegated to the authors' earlier T-RO paper: 'We refer the reader to [6] for details on this filtering technique and proof of the safety guarantees' (Sec. III-C). This is a self-citation with overlapping authorship, but it is not circular: [6] is a peer-reviewed, externally verifiable treatment of HJ reachability filtering that does not assume the present DualGuard-MPPI algorithm or its empirical results. The MPPI update rule in eq. (3) combines filtered rollouts, and no parameter is fitted to the reported outcomes and then renamed a prediction. The reported performance improvement is an empirical comparison against independent baselines (Shield MPPI, penalty methods) on common metrics, not a formula that contains its own conclusion. The paper's Sec. VII limits the approach to precomputed BRTs and explicit dynamics; it does not analyze the discrete-time effect of evaluating eq. (11) only at sampled instants or the numerical error of the LevelSetToolbox value function. That is a robustness/correctness gap in the strength of the word 'provably' but not a circular derivation, since no claim reduces by construction to its own inputs. Therefore the circularity score is low.
Assumptions & free parameters
free parameters (3)
- MPPI temperature lambda
- Cost weights Q and m
- Sampling covariance/noise variance
assumptions (4)
- ad hoc to paper The HJ value function V(x) computed numerically via the LevelSetToolbox accurately represents the BRT and supports the LRF guarantee for the real system.
- ad hoc to paper The continuous-time LRF in eq. (11), when applied at discrete time steps with zero-order hold, preserves the invariance guarantee.
- domain assumption The system dynamics are uniformly continuous in u and d, bounded, and Lipschitz in x, ensuring existence and uniqueness of trajectories.
- domain assumption Control and disturbance signals are piecewise continuous.
Cite this review
Pith. "Pith review of DualGuard MPPI: Safe and Performant Optimal Control by Combining Sampling-Based MPC and Hamilton-Jacobi Reachability." pith.science (2026). https://pith.science/paper/CC6OKAMN
@misc{pith2026250201924,
author = {Pith},
title = {Pith review of: DualGuard MPPI: Safe and Performant Optimal Control by Combining Sampling-Based MPC and Hamilton-Jacobi Reachability},
year = {2026},
howpublished = {\url{https://pith.science/paper/CC6OKAMN}},
note = {Machine review of arXiv:2502.01924}
}
read the original abstract
Designing controllers that are both safe and performant is inherently challenging. This co-optimization can be formulated as a constrained optimal control problem, where the cost function represents the performance criterion and safety is specified as a constraint. While sampling-based methods, such as Model Predictive Path Integral (MPPI) control, have shown great promise in tackling complex optimal control problems, they often struggle to enforce safety constraints. To address this limitation, we propose DualGuard-MPPI, a novel framework for solving safety-constrained optimal control problems. Our approach integrates Hamilton-Jacobi reachability analysis within the MPPI sampling process to ensure that all generated samples are provably safe for the system. On the one hand, this integration allows DualGuard-MPPI to enforce strict safety constraints; at the same time, it facilitates a more effective exploration of the environment with the same number of samples, reducing the effective sampling variance and leading to better performance optimization. Through several simulations and hardware experiments, we demonstrate that the proposed approach achieves much higher performance compared to existing MPPI methods, without compromising safety.
Figures
Figures from the paper (4 more)
Forward citations
Cited by 2 Pith papers
-
Learn from What We HAVE: History-Aware VErifier that Reasons about Past Interactions Online
A history-aware verifier that scores candidate actions using past interactions cuts failure rates in ambiguous robot manipulation tasks compared to using the generator alone.
-
X-ray and radio polarimetry of the neutron star low mass X-ray binary GX 13+1
X-ray and radio polarimetry of GX 13+1 support a disk plus boundary or spreading layer geometry, with tentative polarization swings between dip and non-dip states.
Reference graph
Works this paper leans on
-
[6]
On safety and liveness filtering using hamilton–jacobi reachability analysis,
J. Borquez, K. Chakraborty, H. Wang, and S. Bansal, “On safety and liveness filtering using hamilton–jacobi reachability analysis,” IEEE Transactions on Robotics , vol. 40, pp. 4235–4251, 2024
2024
-
[1]
A gen- eral hamilton-jacobi framework for non-linear state-constrained control problems,
Altarovici, Albert, Bokanowski, Olivier, and Zidani, Hasnaa, “A gen- eral hamilton-jacobi framework for non-linear state-constrained control problems,” ESAIM: COCV, 2013
work page 2013
-
[2]
Cooptimizing safety and perfor- mance with a control-constrained formulation,
H. Wang, A. Dhande, and S. Bansal, “Cooptimizing safety and perfor- mance with a control-constrained formulation,” IEEE Control Systems Letters, vol. 8, pp. 2739–2744, 2024
work page 2024
-
[3]
Review on model pre- dictive control: An engineering perspective,
M. Schwenzer, M. Ay, T. Bergs, and D. Abel, “Review on model pre- dictive control: An engineering perspective,” The International Journal of Advanced Manufacturing Technology , 2021
work page 2021
-
[4]
Borrelli, A
F. Borrelli, A. Bemporad, and M. Morari, Predictive control for linear and hybrid systems . Cambridge University Press, 2017
2017
-
[5]
Information-theoretic model predictive control: Theory and applications to autonomous driving,
G. Williams, P. Drews, B. Goldfain, J. M. Rehg, and E. A. Theodorou, “Information-theoretic model predictive control: Theory and applications to autonomous driving,” IEEE Transactions on Robotics , 2018
work page 2018
-
[7]
Control barrier function based quadratic programs for safety critical systems,
A. D. Ames, X. Xu, J. W. Grizzle, and P. Tabuada, “Control barrier function based quadratic programs for safety critical systems,” IEEE Transactions on Automatic Control , 2016
work page 2016
-
[8]
Model predictive path integral control: From theory to parallel computation,
G. Williams, A. Aldrich, and E. A. Theodorou, “Model predictive path integral control: From theory to parallel computation,” Journal of Guidance, Control, and Dynamics , 2017
work page 2017
Show all 37 references
-
[9]
Shield mppi: A compu- tationally efficient robust mpc method using control barrier functions,
J. Yin, C. Dawson, C. Fan, and P. Tsiotras, “Shield mppi: A compu- tationally efficient robust mpc method using control barrier functions,” IEEE Robotics and Automation Letters , 2023
2023
-
[10]
A predictive safety filter for learning-based control of constrained nonlinear dynamical systems,
K. P. Wabersich and M. N. Zeilinger, “A predictive safety filter for learning-based control of constrained nonlinear dynamical systems,” Automatica, vol. 129, 2021
2021
-
[11]
Safe importance sampling in model predictive path integral control,
M. Gandhi, H. Almubarak, and E. Theodorou, “Safe importance sampling in model predictive path integral control,” arXiv preprint arXiv:2303.03441, 2023
2023 arXiv
-
[12]
Safe optimal control using stochastic barrier functions and deep forward-backward sdes,
M. Pereira, Z. Wang, I. Exarchos, and E. Theodorou, “Safe optimal control using stochastic barrier functions and deep forward-backward sdes,” in Conference on Robot Learning . PMLR, 2021
2021
-
[13]
A model predictive path integral method for fast, proactive, and uncertainty-aware uav planning in cluttered environments,
J. Higgins, N. Mohammad, and N. Bezzo, “A model predictive path integral method for fast, proactive, and uncertainty-aware uav planning in cluttered environments,” in 2023 IEEE/RSJ International Conference on Intelligent Robots and Systems (IROS) . IEEE, 2023
2023
-
[14]
Toward efficient mppi trajectory generation with unscented guidance: U-mppi control strategy,
I. S. Mohamed, J. Xu, G. S. Sukhatme, and L. Liu, “Toward efficient mppi trajectory generation with unscented guidance: U-mppi control strategy,” IEEE Transactions on Robotics , 2025
2025
-
[15]
Enhancing feasibility and safety of nonlinear model predictive control with discrete-time control barrier functions,
J. Zeng, Z. Li, and K. Sreenath, “Enhancing feasibility and safety of nonlinear model predictive control with discrete-time control barrier functions,” in IEEE Conference on Decision and Control , 2021
2021
-
[16]
Sharp: Shielding-aware robust planning for safe and efficient human-robot interaction,
H. Hu, K. Nakamura, and J. F. Fisac, “Sharp: Shielding-aware robust planning for safe and efficient human-robot interaction,” IEEE Robotics and Automation Letters , 2022
2022
-
[17]
Active uncertainty reduction for safe and efficient interaction planning: A shielding-aware dual control approach,
H. Hu, D. Isele, S. Bae, and J. F. Fisac, “Active uncertainty reduction for safe and efficient interaction planning: A shielding-aware dual control approach,” International Journal of Robotics Research , 2024
2024
-
[18]
Reducing safety interventions in provably safe reinforcement learning,
J. Thumm, G. Pelat, and M. Althoff, “Reducing safety interventions in provably safe reinforcement learning,” in 2023 IEEE/RSJ International Conference on Intelligent Robots and Systems (IROS) , 2023
2023
-
[19]
Safety filtering while training: Improving the performance and sample efficiency of reinforce- ment learning agents,
F. P. Bejarano, L. Brunke, and A. P. Schoellig, “Safety filtering while training: Improving the performance and sample efficiency of reinforce- ment learning agents,” IEEE Robotics and Automation Letters , 2025
2025
-
[20]
E. A. Coddington and N. Levinson, Theory of ordinary differential equations. Tata McGraw-Hill Education, 1955
1955
-
[21]
F. M. Callier and C. A. Desoer, Linear system theory. Springer Science & Business Media, 2012
2012
-
[22]
Hamilton-Jacobi Reachability: A brief overview and recent advances,
S. Bansal, M. Chen, S. Herbert, and C. J. Tomlin, “Hamilton-Jacobi Reachability: A brief overview and recent advances,” in IEEE Confer- ence on Decision and Control (CDC) , 2017
2017
-
[23]
On reachability and minimum cost optimal control,
J. Lygeros, “On reachability and minimum cost optimal control,” Auto- matica, vol. 40, no. 6, pp. 917–927, 2004
2004
-
[24]
A time-dependent Hamilton- Jacobi formulation of reachable sets for continuous dynamic games,
I. Mitchell, A. Bayen, and C. J. Tomlin, “A time-dependent Hamilton- Jacobi formulation of reachable sets for continuous dynamic games,” IEEE Transactions on Automatic Control (TAC) , 2005
2005
-
[25]
A toolbox of level set methods,
I. Mitchell, “A toolbox of level set methods,” http://www. cs. ubc. ca/mitchell/ToolboxLS/toolboxLS. pdf, Tech. Rep. TR-2004-09 , 2004
2004
-
[26]
hj reachability: Hamilton-jacobi reachability analysis in jax,
E. Schmerling and M. Pavone, “hj reachability: Hamilton-jacobi reachability analysis in jax,” 2023. [Online]. Available: https: //github.com/StanfordASL/hj reachability
2023
-
[27]
DeepReach: A deep learning approach to high-dimensional reachability,
S. Bansal and C. J. Tomlin, “DeepReach: A deep learning approach to high-dimensional reachability,” in IEEE International Conference on Robotics and Automation (ICRA) , 2021
2021
-
[28]
Bridging hamilton-jacobi safety analysis and reinforcement learning,
J. F. Fisac, N. F. Lugovoy, V . Rubies-Royo, S. Ghosh, and C. J. Tomlin, “Bridging hamilton-jacobi safety analysis and reinforcement learning,” in IEEE International Conference on Robotics and Automation , 2019
2019
-
[29]
Gpu-enabled parallel trajectory op- timization framework for safe motion planning of autonomous vehicles,
Y . Lee, K. H. Choi, and K.-S. Kim, “Gpu-enabled parallel trajectory op- timization framework for safe motion planning of autonomous vehicles,” IEEE Robotics and Automation Letters , 2024
2024
-
[30]
Model predictive path integral methods with reach-avoid tasks and control barrier functions,
H. Parwana, M. Black, G. Fainekos, B. Hoxha, H. Okamoto, and D. Prokhorov, “Model predictive path integral methods with reach-avoid tasks and control barrier functions,” arXiv preprint arXiv:2407.13693 , 2024
2024 arXiv
-
[31]
Rapa-planner: Robust and efficient motion planning for quadrotors based on parallel ra-mppi,
X. Zhang, J. Lu, Y . Hui, H. Shen, L. Xu, and B. Tian, “Rapa-planner: Robust and efficient motion planning for quadrotors based on parallel ra-mppi,” IEEE Transactions on Industrial Electronics , 2024
2024
-
[32]
Robust control barrier–value functions for safety-critical control,
J. J. Choi, D. Lee, K. Sreenath, C. J. Tomlin, and S. L. Herbert, “Robust control barrier–value functions for safety-critical control,” in 2021 60th IEEE Conference on Decision and Control (CDC) , 2021
2021
-
[33]
JAX: composable transformations of Python+NumPy programs,
J. B. et al., “JAX: composable transformations of Python+NumPy programs,” 2018. [Online]. Available: http://github.com/google/jax
2018
-
[34]
An efficient reachability-based framework for provably safe autonomous navigation in unknown environments,
A. Bajcsy, S. Bansal, E. Bronstein, V . Tolani, and C. J. Tomlin, “An efficient reachability-based framework for provably safe autonomous navigation in unknown environments,” in 2019 IEEE 58th Conference on Decision and Control (CDC) , 2019, pp. 1758–1765
2019
-
[35]
Parameter-conditioned reach- able sets for updating safety assurances online,
J. Borquez, K. Nakamura, and S. Bansal, “Parameter-conditioned reach- able sets for updating safety assurances online,” in 2023 IEEE Interna- tional Conference on Robotics and Automation (ICRA) , 2023
2023
-
[36]
Reachability analysis for black-box dynamical systems,
V . K. Chilakamarri, Z. Feng, and S. Bansal, “Reachability analysis for black-box dynamical systems,” 2024. [Online]. Available: https: //arxiv.org/abs/2410.07796
2024 arXiv
-
[37]
Safety and liveness guarantees through reach-avoid reinforcement learning,
K.-C. Hsu, V . Rubies-Royo, C. Tomlin, and J. Fisac, “Safety and liveness guarantees through reach-avoid reinforcement learning,” in Robotics: Science and Systems XVII , ser. RSS2021, 2021
2021
Reviewed August 9, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.