# Latent Safety Filters: When a Lossy Encoder Admits a Transferable Certificate

arXiv: https://arxiv.org/abs/2610.04297 · HTML: https://mlsanity.com/paper/2610.04297/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 22 of its 27 references that are in the map.
- First posted on arXiv 3 Oct 2026.

## Builds on (most cited first, 22 of 22)

- [DINOv2: Learning Robust Visual Features without Supervision](https://mlsanity.com/paper/2304.07193/) (2023)
- [Control Barrier Functions: Theory and Applications](https://mlsanity.com/paper/1903.11199/) (2019)
- [Generalizing Safety Beyond Collision-Avoidance via Latent-Space Reachability Analysis](https://mlsanity.com/paper/2502.00935/) (2025)
- [Guaranteeing Safety of Learned Perception Modules via Measurement-Robust Control Barrier Functions](https://mlsanity.com/paper/2010.16001/) (2020)
- [Uncertainty-aware Latent Safety Filters for Avoiding Out-of-Distribution Failures](https://mlsanity.com/paper/2505.00779/) (2025)
- [Safe Output Feedback Motion Planning from Images via Learned Perception Modules and Contraction Theory](https://mlsanity.com/paper/2206.06553/) (2022)
- [In-Distribution Barrier Functions: Self-Supervised Policy Filters that Avoid Out-of-Distribution States](https://mlsanity.com/paper/2301.12012/) (2023)
- [Input-to-State Safety With Control Barrier Functions](https://mlsanity.com/paper/1803.03035/) (2018)
- [How to Train Your Latent Control Barrier Function: Smooth Safety Filtering Under Hard-to-Model Constraints](https://mlsanity.com/paper/2511.18606/) (2025)
- [Measurement-Robust Control Barrier Functions: Certainty in Safety with Uncertainty in State](https://mlsanity.com/paper/2104.14030/) (2021)
- [Data-driven reduced order models using invariant foliations, manifolds and autoencoders](https://mlsanity.com/paper/2206.12269/) (2022)
- [Safety-Critical Control for Autonomous Systems: Control Barrier Functions via Reduced-Order Models](https://mlsanity.com/paper/2403.09865/) (2024)
- [AnySafe: Adapting Latent Safety Filters at Runtime via Safety Constraint Parameterization in the Latent Space](https://mlsanity.com/paper/2509.19555/) (2025)
- [Latent Representations for Control Design with Provable Stability and Safety Guarantees](https://mlsanity.com/paper/2505.23210/) (2025)
- [Designing Latent Safety Filters using Pre-Trained Vision Models](https://mlsanity.com/paper/2509.14758/) (2025)
- [Safe and Robust Observer-Controller Synthesis using Control Barrier Functions](https://mlsanity.com/paper/2211.14364/) (2022)
- [When are safety filters safe? On minimum phase conditions of control barrier functions](https://mlsanity.com/paper/2508.07684/) (2025)
- [How Well Do Latent World Models Understand Partially Observable Safety Constraints?](https://mlsanity.com/paper/2510.06492/) (2025)
- [Verification of Unknown Dynamical Systems via Autoencoder Latent Space](https://mlsanity.com/paper/2512.13593/) (2025)
- [On transferring safety certificates across dynamical systems](https://mlsanity.com/paper/2602.03987/) (2026)
- [Reduced-order Control and Geometric Structure of Learned Lagrangian Latent Dynamics](https://mlsanity.com/paper/2602.08963/) (2026)
- [From Points to Sets: Set-Based Safety Verification in the Latent Space](https://mlsanity.com/paper/2604.05799/) (2026)

## Abstract (arXiv)

Latent safety filters certify safety on a learned low-dimensional representation of the state, enabling constraints that resist analytic description. Because the encoder is lossy, a filter can report safe while the physical state is unsafe, with no detectable model error. Existing transfer conditions leave the effect of discarded safety information implicit. We ask when a lossy encoder admits a safety certificate that transfers to the physical system, and show the answer is governed by the detectability of the discarded safety-relevant dynamics. We construct a system whose latent model is exact and whose latent signals always report safe, while the physical state becomes arbitrarily unsafe. For this system no certificate exists and no monitor downstream of the encoder can detect the failure. When the discarded dynamics contract, a latent barrier certifies true safety up to two explicit margins, one for the latent-model error and one for the variation of safety across states the encoder cannot distinguish. In the linear case and under boundedness and non-degeneracy conditions, every calibrated barrier transfers with a finite margin when the safety-relevant subspace is detectable, and none does otherwise. On learned cartpole encoders, the model error does not indicate for which representations the estimated bound is non-vacuous, while the second margin does.