Yusuf Guenena Robotics · Autonomous systems

I build the reliability layer for learned robots.

I study how robot-learning systems fail, and build the detection, recovery and evidence infrastructure they need to run outside controlled demos.

Explore the work Résumé

01 Research thesis

A learned policy is competent until the world stops matching its training set.

Nothing in the system announces the moment it does. That is the whole problem. The model keeps producing confident, well-formed output on inputs it has never seen, the exported uncertainty stays inside its nominal band, and every downstream consumer keeps trusting it. I build the detection, arbitration, evidence and deployment infrastructure that closes that gap.

Silent failure Illustrative, not measured
Real error rises under distribution shift while exported uncertainty stays flat An illustrative diagram. As distribution shift increases, the real error of a learned policy climbs steeply, while the uncertainty the model exports stays close to its nominal value. The gap between the two is the region in which the system fails without saying so. TRAINING DISTRIBUTION ENDS REAL ERROR EXPORTED UNCERTAINTY DISTRIBUTION SHIFT

The measured version of this is in the supercombo teardown below: eight of ten output readouts collapse while zero percent of shifted frames exceed the model's nominal uncertainty.

01

It fails silently

openpilot's shipped driving model loses 8 of 10 output readouts under simulated input, and its own exported uncertainty never leaves the nominal range. Nothing downstream could tell.

02

It fails off-camera

A GO2 locomotion policy that passed every simulation evaluation met a per-step slew saturation the first time it ran on real actuators. It took a month to root-cause, and the cause was in the training config all along.

03

It fails without a record

When a run does collapse, the interesting moment is usually seconds before anything visible happened, and by then nobody kept the state needed to find it.

02 The reliability stack

From a policy that cannot fail loudly, to a system that can.

Each stage is a real thing I have built, not a reference architecture. The repositories under each stage are the ones that implement it.

01

Policy

A learned controller runs on the robot. In training it was competent; nothing about it announces the edge of what it knows.

go2-phoenix

02

Distribution shift

The world stops matching the training set: new terrain, a degraded sensor, a lighting regime the renderer never produced.

supercombo-blindspot

03

Detection

Something watches the policy's own internals and topic timing for the signature of a controller operating outside its competence.

helixpolicy-health-monitor

04

Arbitration

A structured fault becomes a decision: keep going, degrade, or hand control to a fallback. Fail-closed, and audited either way.

helix

05

Evidence and recovery

Every fault, decision and recovery is recorded so the failure can be replayed, localized, and turned back into training signal.

BlackBoxRSashfall

03 Flagship work

Three projects carry the argument.

One builds the reliability layer, one proves the failure it exists to catch is real and invisible, and one carries a learned policy onto physical hardware. Each states its claim, its evidence, and the exact point where validation stops.

01 ROS 2 / GO2 + JETSON / C++

HELIX

The reliability layer itself: detect the fault, structure it, decide, and audit the decision.

HELIX watches ROS 2 topic timing and log patterns for the signature of a degrading system, converts raw symptoms into structured FaultEvents, diagnoses the likely cause, and audits the zero-velocity recovery command before anything is trusted to act on it. Exercised across eight GO2 and Jetson sessions.

Claim

A runtime layer can detect and structure live robot faults inside a real ROS 2 graph, fast enough to sit in the control path.

Evidence

1.16 ms mean callback-path latency, 96.5% TPR at 0% FPR on near-threshold synthetic anomalies, and 30 faults producing 14 audited recovery actions in one live GO2 session.

Status

Open Sensing verified on hardware. Physical actuation NOT proven: the recovery stream had no subscriber.

Case study Repository Demo

02 INDEPENDENT RESEARCH / openpilot

supercombo-blindspot

Evidence that I can prove a shipped autonomous system is blind, and prove it rigorously.

A parity-controlled teardown of the neural network that drives openpilot on public roads. I reproduced comma's own inference to within tolerance, then drove the model out of distribution and instrumented every output head, every exported uncertainty, and the 512-D recurrent state. The failure is real, total, and completely invisible at the model's interface.

Claim

A production L2 driving model can lose its perception entirely while every signal it exports still looks nominal.

Evidence

Parity on 1,159 frames within ±0.5 m/s²; 8/10 output readouts fall below 1% of real activity; 0% of shifted frames exceed the model's nominal uncertainty; an internal-state monitor recovers the failure at 2.41% held-out FPR.

Status

Open Verified in simulation on openpilot v0.9.7. Manuscript drafted, NOT submitted. Detector coverage is bounded: it largely misses photometric corruption.

Case study Repository Demo

03 SIM-TO-REAL / ISAAC LAB / UNITREE GO2

go2-phoenix

The deployment half: getting a learned policy onto a physical robot without lying about what happened.

Phoenix trains a GO2 locomotion policy in Isaac Lab, exports it through a parity-gated ONNX path, and runs it on the Jetson behind a fail-closed safety layer. The loop is explicitly about what happens after the first deployment: capture the hardware failure, replay it in sim under randomized physics, and fine-tune on that failure-seeded distribution.

Claim

A sim-trained locomotion policy can be carried to real hardware through a gated pipeline where every stage is verified rather than assumed.

Evidence

32/32 sim evaluations at 3.30% slew against a 5% gate; ONNX-torch parity to 4.77e-06; the deploy stack ran end-to-end on the physical GO2 and surfaced a saturation failure simulation had not.

Status

Open Sim-verified and deployed end-to-end. On-robot locomotion (Gate 7) still OPEN: no stand has cleared.

Case study Repository Demo

04 The platform

The robot is where the assumptions break.

Simulation is where a policy is allowed to be right. The robot is where it has to be. A GO2 locomotion policy of mine passed every evaluation in Isaac Lab and then met a per-step slew saturation the first time it drove real actuators, and the cause had been sitting in the training config the whole time.

So the platform is not a demo target. It is the instrument that decides which simulation results were real, and most of what is on this page exists because it disagreed with one.

Platform Unitree GO212 actuated joints, onboard camera, four-microphone array
Compute NVIDIA Jetson Orin NXCarried on the robot; every policy has to fit and run here
Middleware ROS 2Nodes, lifecycle, QoS, and the topic timing HELIX watches
Navigation Nav2 and SLAM ToolboxFull autonomy stack, exercised in Gazebo with CHAMP
Simulation NVIDIA Isaac LabWhere the locomotion policies are trained before they are trusted
Perception YOLOv8, RealSense D435iOnboard detection and depth for the language-grounded work
Policies Learned locomotionExported through a parity-gated ONNX path and run behind a fail-closed layer
Onboard camera, detections running on the robot
Spoken command to motion, on the physical robot
go2-phoenix Isaac Lab to Jetson, with every stage of the transfer gated rather than assumed. HELIX Runtime fault detection and audited recovery inside the live ROS 2 graph. go2-simple-workspace Spoken commands driving the physical robot through the Unitree motion API. come-here Hears the command, localizes the voice, turns, finds the person, walks to them.

05 Supporting work

Grouped by what it contributes.

Every row carries its own validation state. Nothing here is presented as hardware-proven unless it ran on hardware, and the two entries that were falsified stay on the page.

Detect

Runtime monitors

Localize

Post-hoc analysis

Validate

Benchmarks and harnesses

Deploy

GO2 and Jetson Orin NX

Perceive

Scene understanding

06 Written down

Research notes, with the bound on each result stated.

  1. Technical report · 14 pp

    Silent Collapse: A Distribution-Shift Teardown of a Production Driving Model

    A reproducible teardown of openpilot's shipped driving model under simulated input shift: eight of ten output readouts collapse while exported confidence stays flat, and a recurrent-state monitor catches the failure without retraining. Detector coverage is bounded, and the bound is reported.

    Manuscript drafted, not submitted PDF

Papers and public evidence Every claim on this site links to a repository you can clone and rerun, including the ones that failed.

07 Trajectory

Electrical engineering, then robots that had to work.

I started in electrical engineering, which is where I learned that a system is only as good as what it does when a component degrades. That instinct moved with me into robotics and intelligent control, and now into an M.S. in Robotics at Wayne State.

Most of my work runs on a Unitree GO2 with a Jetson Orin NX on its back, which is the fastest way I know to find out which simulation results were real.

My thesis applies the same instinct to quadruped guidance for blind and low-vision users, where following the wrong person is worse than not following at all. The long-term direction is straightforward: autonomous machines that stay dependable outside the conditions they were trained for.

More about me Research and claim ledger

Building robots that know when not to trust themselves.

I am interested in robot-learning reliability, autonomous-systems safety, sim-to-real deployment, research collaboration and PhD opportunities.

Email me Résumé GitHub LinkedIn