Imagine you're a goalkeeper. The traditional approach to safety is to assume every shot is a perfect top-corner screamer and position yourself accordingly — you'd never leave the center of the goal, and you'd be terrible at actually playing football. LEAP asks a different question: how many perfect passes, through-balls, and crosses does the opposing team need to string together before they score? If the answer is 'a lot,' you're probably safe even if you don't defend against the absolute worst-case scenario. That reframing — from worst-case magnitude to cumulative adversarial effort — is the core mechanism of this paper. The committed claim: LEAP (Least-Effort Adversarial Potentials) is a new certificate for safety-critical control that quantifies robustness not by the size of the worst disturbance the system can withstand at any instant, but by the total effort a disturbance must expend over time to cause a safety violation. The authors show LEAP functions as a control barrier function (CBF) for undisturbed systems and extends naturally to a safety filter robust against disturbances with bounded cumulative effort. The construction uses on-policy deep reinforcement learning — specifically, training an adversary to find the cheapest path to failure. This sits in a long-running fight within the safe control community between conservatism and practicality. Classical robust CBFs assume a worst-case disturbance at every timestep, which quickly becomes infeasible for high-dimensional systems or tight input constraints — the controller spends all its authority fighting phantoms. Hamilton-Jacobi reachability analysis gives exact answers but scales exponentially. Learning-based CBFs have emerged as a middle path, but most still inherit the worst-case-per-step framing. LEAP's contribution is changing the question itself: instead of 'can I survive the worst instant,' it asks 'how much total adversarial budget is needed to break me?' This is structurally closer to how real disturbances behave — wind gusts are correlated and finite, not adversarial optimizers resetting each timestep. The architecture is a value-function-style neural network trained via on-policy RL. The adversary (disturbance) tries to reach the unsafe set with minimum cumulative cost, while the defender (controller) tries to maximize that cost. The resulting value function — the LEAP — encodes a smooth robustness landscape over the state space. The safety filter derived from LEAP is a quadratic program that modifies a nominal controller minimally to maintain the LEAP certificate. This is computationally tractable at runtime, unlike HJ reachability which requires solving a PDE offline over the full state space. Integrity is mixed but honestly positioned. The simulation validation covers multi-agent scenarios — double integrators with 4-8 agents, and a 36-dimensional 6-agent system — where classical robust CBFs either fail or are too conservative. The hardware experiments on a Unitree Go2 quadruped and Crazyflie quadrotors are the strongest evidence: real actuator delays, sensor noise, and unmodeled dynamics are exactly the kind of bounded-cumulative-effort disturbances LEAP is designed for. However, the RL training is same-team (no independent replication), and there's no comparison against HJ reachability at the scales where HJ is still tractable — a missed opportunity to calibrate the approximation error. The milestone question is concrete: the paper demonstrates systems up to 36 state dimensions with 6 agents. The next meaningful threshold is roughly 100+ state dimensions (10-15 interacting agents or a single high-DoF manipulator), where the method's scalability advantage over HJ becomes decisive and industrial deployment becomes plausible. The gap is probably 2-3 years, contingent on RL training stability at scale and formal guarantees tightening. The obvious unrun experiment is a head-to-head against HJ reachability on a system small enough for HJ to be exact — say, a single quadrotor in 12 dimensions. This would let us measure how much safety margin LEAP trades away for scalability. The authors likely didn't run it because (a) the comparison would show LEAP is approximate where HJ is exact, muddying the narrative, and (b) the whole point is that HJ doesn't scale, so demonstrating LEAP where HJ works undermines the motivation. But it's the experiment that would most build trust.
