# Generator-Independent Runtime Assurance under Partial Observation

arXiv: https://arxiv.org/abs/2609.06036 · HTML: https://mlsanity.com/paper/2609.06036/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 9 of its 23 references that are in the map.
- First posted on arXiv 5 Sep 2026.

## Builds on (most cited first, 9 of 9)

- [Safe Reinforcement Learning via Shielding](https://mlsanity.com/paper/1708.08611/) (2017)
- [Control Barrier Functions: Theory and Applications](https://mlsanity.com/paper/1903.11199/) (2019)
- [Time-uniform, nonparametric, nonasymptotic confidence sequences](https://mlsanity.com/paper/1810.08240/) (2018)
- [Run Time Assurance for Safety-Critical Systems: An Introduction to Safety Filtering Approaches for Complex Control Systems](https://mlsanity.com/paper/2110.03506/) (2021)
- [Learning Robust Output Control Barrier Functions from Safe Expert Demonstrations](https://mlsanity.com/paper/2111.09971/) (2021)
- [Risk-aware Control for Robots with Non-Gaussian Belief Spaces](https://mlsanity.com/paper/2309.12857/) (2023)
- [Bridging the Gap: Applying Assurance Arguments to MIL-HDBK-516C Certification of a Neural Network Control System with ASIF Run Time Assurance Architecture](https://mlsanity.com/paper/2303.15568/) (2023)
- [Safety-critical Control Under Partial Observability: Reach-Avoid POMDP meets Belief Space Control](https://mlsanity.com/paper/2603.10572/) (2026)
- [Permissive Safety Through Trusted Inference: Verifiable Belief-Space Neural Safety Filters for Assured Interactive Robotics](https://mlsanity.com/paper/2606.02562/) (2026)

## Abstract (arXiv)

Proposal-based controllers---learned policies, language-model planners, and other black-box generators---are increasingly deployed behind runtime verification gates. We ask when the closed-loop safety guarantee decouples from the generator. The prevailing per-candidate certification pattern does not compose: under retry or best-of-k selection a per-candidate false-admission level α can inflate to 1-(1-α)k. Our main theorem shows that simultaneous setwise soundness---certifying a set of admissible proposals containing no nonviable action---is necessary and sufficient for generator-independent admission soundness, the worst case over all generators of executing a nonviable proposal equalling the probability of setwise failure; together with a design-time certificate and a no-bypass rule it is sufficient for contract safety, with violation bound Gamma+sumtvarepsilont+η invariant under arbitrary, even adversarial, replacement of the generator. A second theorem bounds every admission mechanism under partial observation: for a fixed probing and admission policy, if two state hypotheses whose information laws lie within total-variation distance δ require different safe decisions, then abar+β+δ≥1. A sequential risk ledger makes the guarantee implementable with time-uniform confidence tubes, and shows that deterministic admission computations concentrate all statistical risk in state estimation. Simplex-style runtime assurance and control-barrier-function filtering are recovered as degenerate cases.