Caltech’s CSF paper filters text-to-motion generators on a Unitree G1

What did arXiv list on 8 October?

The export API record for 2610.12467 lists published and updated timestamps of 2026-10-08T17:59:50Z for v1. Primary category is cs.RO with a cs.LG cross-list. Authors are Lizhi Yang, Yiling Hou, Yao Tang, Junheng Li, Daniel Weng, Blake Werner, and Aaron D. Ames. The comment line points to https://lzyang2000.github.io/csf/.

The abstract’s problem statement is specific: text-conditioned motion generators can produce trackable whole-body motion without knowing when the same action is unsafe because of who or what is in the scene. Prompt filters, labeled motion datasets, and pure geometry miss that contextual shift. CSF is offered as a training-free answer that still uses the generator’s own outputs as references.

For another 8 October robot-reasoning recipe that is still paper-plus-site without a code drop, see Arc robot reasoning. For Meta FAIR’s latent world-model preprint whose GitHub tree is now live, see RoboJEPA.

How does CSF filter a frozen generator?

The project page splits the system into three parts. Rules and live context decide which constraints apply—for example “do not punch a person”—so a punch toward a box can pass until a person is detected. During generation, the frozen model also produces an unsafe reference for each active rule and a safe version of the command; their difference defines an affine margin. A small CBF-QP nudges the current estimate to the safe side at every sampling step.

During execution, a shield watches the unfinished part of a motion if the scene changes. Completed frames stay; the remainder is spliced onto a safe continuation for the tracking controller. That is how the authors separate generation-time filtering from runtime redirection.

The same rules, gate, and QP are said to run on four pretrained generators with different samplers: Kimodo (DDIM diffusion), ARDY (windowed autoregressive diffusion), ECHO (diffusion with DPM-Solver), and MotionHiFlow (flow matching in a VAE latent). Architecture diversity is the paper’s generalization claim; we did not re-run those samplers.

The interactive demo description on the project page is useful for intuition: Kimodo builds a four-second clip over 100 sampling steps, and CSF can intervene at every step while margins for active rules are shown before and after the QP. Unticking “Person in scene” makes filtered and unfiltered rows match except when the command itself names a person. That is the authors’ teaching UI, not a benchmark harness we executed.

What does the Unitree G1 section actually show?

The project page says ARDY generates the reference, CSF filters it, and a pretrained SONIC policy tracks it on the robot. A spoken command and camera perception supply the prompt and the scene. Clips contrast explicit unsafe commands, deceptive commands with a person in view, benign punches at a pillar, and a runtime case where a person walks in mid-motion.

Those videos are author demonstrations linked from the paper site. They are evidence of what the authors chose to show, not an independent hardware audit. Crowd-facing Unitree product photos elsewhere on the web are not the Caltech lab setup.

Infrastructure-level agent containment is a different stack. For NVIDIA’s OpenShell framing, see NVIDIA Open Agent Safety Platform. For sandboxed coding agents on AWS, see Strands Box.

The page’s spoken-command examples include “Walk slowly and punch at a person,” a deceptive “punch at a pillar” with a person in view, and a benign pillar-only case. The semantic gate is doing the work of mapping language plus vision onto which rule margins exist. If your stack lacks a comparable entity detector, you cannot paste the QP alone onto a blind motion sampler and expect the same behavior.

What are the practical limits?

CSF still depends on perception to know which entities are present and on the generator’s ability to produce meaningful safe and unsafe references. If the scene gate mislabels a person as a pillar, the wrong margin set activates. If the safe reference is a poor alternative motion, the QP may preserve legality while changing task success.

The method is aimed at text-conditioned whole-body motion generators, not at arbitrary robot foundation models or language-only agents. Teams should not read the 90% danger-event line as a certified functional-safety number for industrial cells.

Code availability was not a separate dated software release in the pages we opened; the paper points to the project site and describes recorded demos from released code. Confirm the repository state before planning a replication.

Compare CSF to prompt blacklists carefully. A blacklist that bans the word “punch” also blocks punching a box. CSF’s pitch is to keep task-relevant motions when the protected entity is absent. That only helps if your evaluation set includes both benign and unsafe scenes for the same verb—exactly the split the authors emphasize.

What should a robotics team do with this paper?

If you already ship a frozen text-to-motion stack, CSF’s checklist is concrete: write natural-language rules that name protected entities, verify that your perception stream can trigger those rules, and test generation-time filtering plus a mid-execution shield on the same unsafe verbs with and without a person in frame.

Keep author percentages in the authors’ column until you log danger events on your own generator and embodiment. Compare against prompt-only blocks and pure geometric keep-out zones so you know whether contextual margins buy anything on your scenes.

This article is an evidence review of the arXiv abs/HTML pages, the export API timestamp, and the project site opened on 10 October 2026. We did not train, filter, or teleoperate a humanoid.