MIT's HardFlow Enforces Constraints Only on the Final Output and Reaches a 1.00 Safety Rate

MIT researchers published HardFlow in IEEE Transactions on Pattern Analysis and Machine Intelligence on September 14, 2026, a method that reformulates sampling from pretrained flow-matching models as a trajectory optimization problem and records zero constraint violations across robotic manipulation, maze navigation, PDE control, and face editing. HardFlow was the only method to reach a safety rate of 1.00 over 50 trials on the robotic manipulation task, where the best of nine baselines, Projection-Late, stopped at 0.76. ASAP works only from the numbers in arXiv:2511.08425 v3 and the MIT News release to lay out where this method diverges from projection-based sampling.

HardFlow stops pinning intermediate samples to the constraint set and enforces the constraint only at the terminal step

Flow-matching and diffusion models learn to turn random noise into data, and pretrained models such as Stable Diffusion and FLUX are now widely available. The difficulty appears in domains where an almost-correct answer is useless. A robot path that almost avoids a human co-worker is a path that hits them.

The prevailing remedy is projection-based sampling, which repeatedly forces the model's intermediate samples into the feasible region at every sampling step. The paper implements three variants of this family, Projection-All, Projection-Late, and Projection-Relaxed. Lead author Zeyang Li said that what ultimately matters for constraint satisfaction is the model's final output, since the internal process is discarded, and that not requiring every intermediate step to satisfy the constraints gives the model more freedom to find high-quality solutions that remain feasible in the end.

HardFlow rewrites the problem as trajectory optimization from numerical optimal control. It steers the sampling trajectory toward a goal while requiring constraints to hold exactly at the terminal time. Optimizing across a network of hundreds of layers is intractable as stated, so the researchers exploited the structure of flow-matching models and adopted model predictive control techniques to decompose the problem into a sequence of single-step subproblems and convert it into a solvable surrogate. The paper also provides a control-theoretic bound on the approximation error between that surrogate and the ideal formulation.

Moving to a trajectory optimization view lets two more objectives live in the same framework: an integral cost that minimizes distribution shift and a terminal objective that raises sample quality. Senior author Navid Azizan said the promise of generative AI is its ability to explore a rich space of possibilities while the real world places boundaries on which possibilities are acceptable, and that the approach preserves generative power while enforcing the nonnegotiable requirements of safety-critical applications. In implementation, HardFlow solves the optimization only during the second half of the sampling steps, because posterior estimates are less accurate early on. The nonlinear programs are solved with the open-source solver IPOPT.

Robotic manipulation is where one method took both a 1.00 safety rate and the shortest path

The robotic manipulation task is the D3IL benchmark, in which an end-effector reaches a target region while weaving around six pillars, with IPOPT solving the inner programs for every method. The researchers added test-time obstacles that conflict with many trajectories in the training data, and they folded dynamics constraints, fitted from the training data by least squares, into the hard constraints alongside obstacle avoidance. The trajectory horizon is 16, the replanning horizon is 8, sampling uses 10 discretization steps, and results are averaged over 50 trials.

Table II reports safety rate, mean steps on safe trials, and the time to sample one trajectory. HardFlow recorded a safety rate of 1.00, 52.5 steps, and 0.190 seconds. The unconstrained original model scored 0.06, 58.7 steps, and 0.060 seconds. Within the projection family, Projection-Late was highest at 0.76, Projection-All reached 0.46, and Projection-Relaxed fell to 0.10. The soft-constrained family did worse, with Gradient Guidance at 0.18 and OC-Flow at 0.14. Stacking gradient guidance on top of projection lowered safety further, to 0.40, 0.68, and 0.04 for the three combinations.

Reading the step counts alongside changes the picture. Every one of the nine methods other than HardFlow produced longer paths than the original, and the longest, Projection-All with Gradient Guidance, took 70.6 steps. HardFlow alone moved from 58.7 steps down to 52.5. Its 0.190-second sampling time also beat Projection-All at 0.349 seconds and Gradient Guidance at 0.992 seconds.

Maze navigation, the Burgers equation, and face editing each reach the same conclusion by a different route

Maze navigation uses the Maze2D environment from D4RL, where a force-actuated ball travels to a goal position, again measured over 50 trials. HardFlow recorded a safety rate of 1.00, 0.0 violating timesteps, and a D4RL normalized score of 1.620. The second-safest method, Gradient Guidance at 0.88, produced the lowest score of 1.11 and took 6.666 seconds against HardFlow's 4.09 seconds. Both Projection-Relaxed variants scored 0.00 on safety, and the unconstrained original recorded 0.02 with 49 violating timesteps.

PDE control generates solutions and controls for the one-dimensional Burgers equation on a grid of 10 time steps and 128 spatial points, with time-varying bounds on the state. Four other methods joined HardFlow in driving all three safety metrics to zero here. HardFlow's advantage lies elsewhere: among the five perfect methods it used the lowest control energy at 0.28 and the shortest computation time at 8.3 seconds. Projection-All spent 0.53 in energy and 13.6 seconds for the same zero.

Text-guided face editing applies five prompts to 200 images sampled at random from the CelebA-HQ validation set, using the CLIP score as cost and an LPIPS bound of 0.06 as the hard constraint. HardFlow alone satisfied the constraint on 100 percent of prompts and images. OC-Flow satisfied 3.3 percent and Gradient Guidance 0 percent. The computation gap is widest here, at 51.294 seconds for HardFlow against 158.302 seconds for OC-Flow and 131.819 seconds for Gradient Guidance. HardFlow's CLIP score of 0.317 trails OC-Flow's 0.322, but OC-Flow earned that score by over-editing far enough to alter identity and break the constraint.

The real signal in these numbers is the shorter path, not the perfect safety rate

The interpretation from here is ASAP's. A figure of 100 percent is common in constraint-satisfaction research, because enforcing constraints hard enough secures safety while quality collapses. Table II shows the archetype: Projection-All raised safety from 0.06 to 0.46 while stretching the path from 58.7 steps to 67.2. It traded quality for safety.

HardFlow's 52.5 steps mean it declined that trade. It reaches the target faster than a model that considers no constraints at all, with zero collisions. That outcome is possible because the paper puts constraint satisfaction and cost minimization into the same optimization problem. Projection methods see only the constraint, so nothing in their structure rewards a shorter trajectory.

Three points deserve caution. First, HardFlow was the sole perfect performer on robotic manipulation, maze navigation, and face editing, while five methods tied at zero on PDE control. Second, the overhead varies by task: roughly 3.2 times the original on robotic manipulation, and faster than every baseline on face editing. Third, all experiments ran on a single desktop with an Intel Core Ultra 9 285K and an NVIDIA GeForce RTX 5090, at 50 trials per task. That is research-scale validation, not a deployment record.

How the projection baselines failed is the most reusable part of this paper

Two appendix experiments speak to practice more directly than the main tables. The first compares post-processing. The researchers sampled a batch of 64 trajectories from the nominal model, discarded infeasible ones, and picked the cheapest feasible one, and separately optimized only the final sample to meet the constraints. Both fell well short of HardFlow, and the second failure mode matters most. Optimizing only the final sample yields planned trajectories that satisfy the constraints but are physically inconsistent, so the robot cannot reliably execute them and the realized safety rate drops. Feasibility on paper and feasibility on the floor are different quantities.

The second is the metric hacking observed in face editing. Projection-Relaxed combined with Gradient Guidance drove LPIPS down to 0.026 when the requirement was only to stay below 0.06. It paid for that with the lowest CLIP score of the group at 0.296, and the paper names the pattern directly: numerical scores appear acceptable even though the outputs are visually degraded. Mistaking an upper-bound constraint for a minimization target is a transferable failure for any team scoring models against ceiling-type metrics.

The third is the comparison with SafeFlowMatcher. That concurrent work, built on control barrier functions, matched HardFlow's perfect safety in the maze but failed to produce safe solutions on robotic manipulation. The paper attributes this to multiple nonconvex obstacles producing a feasible set too complex for CBF-based correction, which records in the authors' own text that a safety method's performance turns on the geometry of the problem.

The immediately usable condition for engineering teams is that no retraining is required

HardFlow's relevance to robotics and manufacturing comes from being a deployment-time technique. The MIT release describes it as an adaptable, plug-and-play method applied to pretrained generative models without retraining them. For organizations that adopt public flow-matching models because training their own is out of reach, that condition decides whether adoption is possible at all.

The paper also shows where the integration work actually sits. A user must supply two things, a constraint function and a cost function. In the manipulation experiment the researchers modeled the state transition as a linear system and fitted its coefficients from training data by least squares to build the dynamics constraints. The difficulty of adoption is therefore not the algorithm but writing down one's own equipment dynamics and safety rules in a solvable form.

The cost profile is predictable in advance. HardFlow spent 0.190 seconds per replanning call in the manipulation setup, with a replanning horizon of 8 steps. In the heavier face-editing setup, where sampling uses 100 discretization steps, HardFlow was instead the fastest of all, because projecting a neural-network-computed constraint at every step becomes computationally prohibitive. The heavier the constraint, the larger the relative advantage of enforcing it only at the end.

Three questions remain: tuning sensitivity, scale, and how to read the publication date

The first unanswered item is dependence on the regularization weight. The sensitivity study in Appendix Table IX reports that the safety rate holds at 1.00 when the optimal-control regularization weight lies between 0.5 and 10 times the reference value, while values of 0 or 0.1 times degrade performance substantially and larger values make the method conservative enough to lengthen the trajectory. The activation-schedule study runs parallel: applying control across all, early, or middle segments achieves perfect safety, while activating too late degrades it sharply. Perfect safety arrives on top of a tuned configuration.

The second is scale. The authors themselves list large-scale text-to-image generation and vision-based, contact-rich manipulation as future work. The current image experiments live in the CelebA-HQ face domain and the robot tasks are two-dimensional. No curve is given for how cost grows as the constraint function becomes more complex under a structure that calls IPOPT at every sampling step in the second half.

The third concerns timing. The arXiv v1 of this work appeared on November 11, 2025, v3 followed on April 26, 2026, and TPAMI publication together with the MIT News release landed on September 14, 2026. This is a method that has been public for more than ten months clearing peer review, not a discovery made this week. News freshness and idea freshness are separate readings, and in that interval concurrent work such as SafeFlowMatcher already entered the paper as an appendix baseline.

HardFlow's contribution is therefore not the figure of 100 percent but the demonstration, across four domains, that giving up quality to gain safety was never mandatory. Changing only when the constraint is enforced made the robot arrive sooner and kept the edited faces recognizable.

Source: Zeyang Li, Kaveh Alim, Navid Azizan, "HardFlow: Hard-Constrained Sampling for Flow-Matching Models via Trajectory Optimization" (arXiv:2511.08425 v3; IEEE Transactions on Pattern Analysis and Machine Intelligence, published September 14, 2026) · MIT News, "New method enables AI for safety-critical situations" (September 14, 2026)