SafeFlow: Real-Time Text-Driven Humanoid Whole-Body Control via Physics-Guided Rectified Flow and Selective Safety Gating

Hanbyel Cho, Sang-Hun Kim, Jeonguk Kang, Donghan Koo

Physical AI Lab, RX, Samsung Electronics

arXiv Preprint

SafeFlow enables real-time text-driven humanoid control by generating physically executable reference motions via physics-guided flow matching. Alongside, a 3-Stage Safety Gate filters unsafe commands to trigger a safe fallback, ensuring robust and safe deployment on real hardware.

TL;DR: SafeFlow is a real-time text-driven humanoid whole-body control framework that combines physics-guided rectified flow matching for executable motion generation with a 3-Stage Safety Gate for robust deployment under open-ended and out-of-distribution text inputs.

Abstract

Recent advances in real-time interactive text-driven motion generation have enabled humanoids to perform diverse behaviors. However, kinematics-only generators often exhibit physical hallucinations, producing motion trajectories that are physically infeasible to track with a downstream motion tracking controller or unsafe for real-world deployment. These failures often arise from the lack of explicit physics-aware objectives for real-robot execution and become more severe under out-of-distribution (OOD) user inputs. Hence, we propose SafeFlow, a text-driven humanoid whole-body control framework that combines physics-guided motion generation with a 3-Stage Safety Gate driven by explicit risk indicators. SafeFlow adopts a two-level architecture. At the high level, we generate motion trajectories using Physics-Guided Rectified Flow Matching in a VAE latent space to improve real-robot executability, and further accelerate sampling via Reflow to reduce the number of function evaluations (NFE) for real-time control. The 3-Stage Safety Gate enables selective execution by detecting semantic OOD prompts using a Mahalanobis score in text-embedding space, filtering unstable generations via a directional sensitivity discrepancy metric, and enforcing final hard kinematic constraints such as joint and velocity limits before passing the generated trajectory to a low-level motion tracking controller. Extensive experiments on the Unitree G1 demonstrate that SafeFlow outperforms diffusion- and retargeting-based baselines in success rate, physical compliance, and inference speed while preserving motion diversity, with consistent gains across three downstream tracking controllers.

Real-Robot Deployment

Real-Robot Comparison: TextOp vs SafeFlow

We quantify hardware tracking fidelity by replaying each method's reference on the Unitree G1 using the exact same downstream tracking controller. For three commands (five 10s trials per cell), we measure E_dof from the joint encoders against each method's own reference (23 non-wrist joints). All trials completed without falls or operator intervention.

By providing physically executable reference motions, SafeFlow tracks significantly more accurately on every command (16–52% lower E_dof) compared to the kinematics-only baseline (TextOp).

TextOp: 9.0° → SafeFlow: 4.4° (−51%)

TextOp: 9.3° → SafeFlow: 6.1° (−34%)

TextOp: 17.5° → SafeFlow: 14.6° (−17%)

Command	TextOp E_dof (°)	SafeFlow E_dof (°)
"Wave hands"	9.0 ± 0.2	4.4 ± 0.1
"Squat down"	9.3 ± 0.4	6.1 ± 0.2
"Boxing"	17.5 ± 0.8	14.6 ± 0.2

Joint-Limit Infeasibility on Real Hardware ("Squat down", right knee): TextOp's reference commands the knee 10–20° beyond the hardware limit for the entire hold phase, which the robot cannot track; SafeFlow's reference stays within limits and is tracked closely. On this command, 18.0% of TextOp's commanded joint samples lie outside the G1's hardware limits, and tracking error on those samples is 3.2× that of in-limit samples (21.4° vs. 6.7°).

Full Supplementary Video

Full Overview: This supplementary video demonstrates the complete SafeFlow pipeline, including various tracking behaviors, robust text-conditioned generation, and safety fallback mechanisms on the Unitree G1.

Key Contributions

SafeFlow Framework

A real-time text-driven humanoid whole-body control framework that couples physics-guided generation with deployment-time selective execution for robustness under unconstrained prompts.

Physics-Guided Rectified Flow + Reflow

Physics-guided rectified flow matching in a VAE latent space with reflow distillation reduces sampling to a single function evaluation (NFE=1, 92.6 Hz generator-only; ~67.7 Hz with full safety pipeline) while significantly improving the physical feasibility and real-robot executability of generated motions.

Training-Free 3-Stage Safety Gate

Proactively blocks unsafe behaviors under OOD prompts via Mahalanobis semantic OOD filtering, directional sensitivity discrepancy metric for generation instability, and hard kinematic screening.

Motivation

Failure Cases of a Kinematics-Only Generator: Feasible motion for a simple prompt (a); joint limit violations (b) and self-collisions (c) under in-distribution commands; structural collapse under OOD prompts (d)—motivating physics-guided generation and runtime safety gating.

Method

Overview of SafeFlow: Top (Deployment, Online): A 3-Stage Safety Gate hierarchically filters OOD semantics, generation instability, and kinematic violations. A reflow-accelerated high-level motion generator provides physically feasible reference motions. If accepted, these are executed by the downstream motion tracking controller; otherwise, a safe fallback is triggered. Bottom (Training, Offline): The motion generator is trained via VAE latent learning and physics-guided flow matching with reflow distillation (NFE=1). The motion tracking controller is trained in simulation via RL.

Results

Physical Executability & Cross-Tracker Tracking Fidelity

SafeFlow improves generator compliance and downstream tracking fidelity across three independent trackers. Joint limit violations drop from 43.14% to 3.08%, and success rate reaches 98.6–99.1% across all trackers (vs. 74.6–81.3% for TextOp).

Method	Generator-Only		Base Tracker			SONIC			MOSAIC
Method	JV ↓	SC ↓	Succ. ↑	E_mpjpe ↓	E_dof ↓	Succ. ↑	E_mpjpe ↓	E_dof ↓	Succ. ↑	E_mpjpe ↓	E_dof ↓
MDM+GMR (offline)	0.79%†	30.48%	87.3%	45.2	4.96	92.6%	40.3	8.97	89.0%	44.3	7.53
TextOp (Baseline)	43.14%	11.05%	80.6%	82.5	5.94	81.3%	45.9	8.36	74.6%	49.3	8.38
+critic-align (RobotMDM-style)	24.08%	12.94%	87.6%	92.2	5.28	84.5%	43.7	8.19	79.3%	47.1	7.68
SafeFlow (Flow)	12.75%	7.25%	92.8%	59.6	4.73	91.9%	34.4	6.42	90.2%	36.2	6.13
SafeFlow (+ Guid.)	6.32%	4.39%	97.9%	51.2	4.43	96.4%	30.8	5.77	97.1%	31.2	5.52
SafeFlow (+ Guid. & Reflow)	3.08%	1.42%	98.6%	44.0	4.32	99.1%	29.6	5.15	98.7%	27.6	5.00

Kinematic Feasibility and Tracking Stability: Despite generating dynamic motions (left), our full pipeline, SafeFlow (+Guid. & Reflow), stabilizes kinematic references and improves tracking. (a) Generator-only: SafeFlow suppresses erratic spikes in CoM velocity and joint acceleration. (b) System-level: SafeFlow mitigates torque chattering and joint velocity spikes, enabling hardware-safe tracking.

Deployment-Time Safety and Robustness

𝓡 Detects Failure-Prone References: Mean tracking MPJPE of 10-frame windows increases monotonically across shared absolute 𝓡 quintiles in both ID and OOD. Even ID prompts produce high-instability windows (ID Q5, 87.4 mm) exceeding low-𝓡 OOD windows (OOD Q1, 56.6 mm)—showing Stage 1 alone is insufficient and motivating the complementary Stage 2 filter.

Instability-Triggered Safe Fallback: When 𝓡 exceeds threshold, Stage 2 overrides the command with a standing prompt and interpolates to a nominal pose. Without Stage 2 the robot collapses on the unstable reference; with it, the robot remains stable and awaits the next prompt.

Real-Time Performance

Via reflow distillation, SafeFlow achieves real-time inference at ~67.7 Hz with the complete safety pipeline, adding only 3.98 ms overhead for the 3-Stage Safety Gate.

Pipeline Component	Added (ms) ↓	Latency (ms) ↓	Freq. (Hz) ↑
TextOp Generator (Baseline)	-	23.59	42.4
SafeFlow Generator (+ Guid.)	-	172.03	5.8
SafeFlow Generator (+ Guid. & Reflow)	-	10.80	92.6
+ Stage 1 (Semantic OOD)	0.006	10.81	92.5
+ Stage 2 (Generation Instability)	3.96	14.77	67.7
+ Stage 3 (Hard Kinematic Screen)	0.013	14.78	67.7

Deployment on Real Hardware

Real-Robot Deployment of SafeFlow on Unitree G1: The robot executes a continuous long-horizon command sequence with smooth transitions across diverse behaviors, including upper-body gestures ("wave hands", "punch") and whole-body actions ("squat down", "hop on left leg"). A high-risk prompt ("double backflip") is included. The 3-Stage Safety Gate filters the unsafe reference and triggers a standing fallback, allowing the robot to maintain balance and continue execution under subsequent prompts. This demonstrates sim-to-real transferability and deployment-time safety on hardware.

BibTeX

@misc{cho2026safeflowrealtimetextdrivenhumanoid,
      title={SafeFlow: Real-Time Text-Driven Humanoid Whole-Body Control via Physics-Guided Rectified Flow and Selective Safety Gating}, 
      author={Hanbyel Cho and Sang-Hun Kim and Jeonguk Kang and Donghan Koo},
      year={2026},
      eprint={2603.23983},
      archivePrefix={arXiv},
      primaryClass={cs.RO},
      url={https://arxiv.org/abs/2603.23983}, 
}