PaperlayerView exact revision on arXiv

Source-linked AI summary

SAFE: Multitask Failure Detection for Vision-Language-Action Models

Qiao Gu, Yuanliang Ju, Shengxiang Sun, Igor Gilitschenski, Haruki Nishimura, Masha Itkina, Florian Shkurti

arXiv:2506.09937v2cs.ROcs.AI

TL;DR

Generalist VLAs often fail on unseen tasks, while existing failure detectors typically lack multitask zero-shot generalization. SAFE learns a scalar failure likelihood from VLA internal features and uses conformal prediction for timely thresholding, achieving state-of-the-art detection across multiple VLAs and environments.

  • Problem

    Existing failure detectors are usually task-specific, whereas generalist VLAs need failure detection that generalizes to unseen tasks and environments.

  • Method

    SAFE extracts final-layer VLA features, predicts a scalar failure likelihood from successful and failed rollouts, and calibrates a time-varying threshold with functional conformal prediction.

  • Results

    SAFE achieves state-of-the-art failure-detection performance and the best trade-off between accuracy and timeliness across multiple VLA models in simulation and the real world.

  • Takeaways & Limitations

    VLA internal features contain task-generic information separating successful and failed rollouts, supporting failure detection on unseen tasks.

  • Takeaways & Limitations

    The study considers manipulation tasks, and generalization across embodiments, sim2real, action-less videos, and multiple VLA layers remains unclear.

Abstract

from arXiv · show

While vision-language-action models (VLAs) have shown promising robotic behaviors across a diverse set of manipulation tasks, they achieve limited success rates when deployed on novel tasks out of the box. To allow these policies to safely interact with their environments, we need a failure detector that gives a timely alert such that the robot can stop, backtrack, or ask for help. However, existing failure detectors are trained and tested only on one or a few specific tasks, while generalist VLAs require the detector to generalize and detect failures also in unseen tasks and novel environments. In this paper, we introduce the multitask failure detection problem and propose SAFE, a failure detector for generalist robot policies such as VLAs. We analyze the VLA feature space and find that VLAs have sufficient high-level knowledge about task success and failure, which is generic across different tasks. Based on this insight, we design SAFE to learn from VLA internal features and predict a single scalar indicating the likelihood of task failure. SAFE is trained on both successful and failed rollouts and is evaluated on unseen tasks. SAFE is compatible with different policy architectures. We test it on OpenVLA, $π_0$, and $π_0$-FAST in both simulated and real-world environments extensively. We compare SAFE with diverse baselines and show that SAFE achieves state-of-the-art failure detection performance and the best trade-off between accuracy and detection time using conformal prediction. More qualitative results and code can be found at the project webpage: https://vla-safe.github.io/

1 Introduction

Generalist VLAs perform substantially worse on unseen tasks, motivating timely failure detection that generalizes across tasks without per-task retraining. SAFE addresses this gap by learning from VLA features and achieves strong multitask performance.

  • VLA success rates drop from 80–90% on seen tasks to 30–60% on unseen tasks out of the box.
  • Most existing detectors are trained and evaluated separately for each task, making them unsuitable for generalist VLAs facing novel instructions and environments.
  • Efficient failure detection must generalize zero-shot to unseen tasks and operate promptly during on-policy VLA rollouts.
  • Multitask failure detection trains on seen tasks and evaluates on unseen tasks, addressing a capability not previously shown for VLAs.
  • SAFE regresses VLA internal features to a scalar failure likelihood, trains on multiple successful and failed rollouts, and uses conformal prediction for thresholding.
  • Across diverse VLA models and simulated and real-world settings, SAFE outperforms baselines and offers the best accuracy–timeliness trade-off.

2 Related Work

Related work spans OOD and supervised failure detection for robots and uncertainty quantification for language and vision models. These approaches face challenges when generalist VLAs encounter valid but unseen tasks or require costly repeated inference.

  • VLA policies inherit semantic abilities from pretrained VLMs and use action heads based on binning, diffusion, or frequency-space tokenization.
  • OOD detectors treat successful executions as in-domain and deviations as failures, but unseen VLA tasks should not automatically be classified as failures.
  • Sample-consistency uncertainty methods can require multiple inferences, creating practical overhead for large VLAs operating robots in real time.
  • Prior failure-detection evaluations include OOD, smoothness-based, and consistency-based methods, but single-task evaluation limits evidence for multitask generalization.
  • LLM and VLM uncertainty methods estimate token-level likelihoods or semantic consistency across multiple generated responses.

3 Problem Formulation

The problem is to detect failures during VLA task execution using rollout information while testing cross-task generalization from seen to unseen tasks. The formulation represents each rollout with multimodal observations, internal embeddings, actions, and a trajectory-level outcome label.

  • At each timestep, the VLA receives images, language, and robot state, then outputs a chunk of future control actions.
  • A rollout trajectory records observations, internal embeddings, decoded tokens when available, and actions over its execution horizon.
  • Each rollout receives a trajectory-level label: failure is yi = 1 and success is yi = 0.
  • Feature visualizations show successful and failed executions separating in latent space, with failure features often forming a cross-task failure zone.
  • Training and validation use seen-task rollouts, while unseen-task rollouts are reserved to test cross-task generalization.

4 Method

SAFE probes VLA final-layer features with lightweight sequential predictors and uses functional conformal prediction to set time-varying failure thresholds. Its simulation evaluation uses ROC-AUC and reports the highest average score across benchmarks.

  • 4.1 Visual Analysis on VLA Latent Space: VLA features separate successful and failed executions across tasks and reflect execution quality during a rollout.
  • 4.2 Failure Detection by Feature Probing: SAFE extracts hidden state vectors from the VLA’s final layer before token-logit or velocity-field decoding.
  • 4.2 Failure Detection by Feature Probing: SAFE processes features up to timestep t with either a lightweight MLP or LSTM and predicts a scalar failure score st.
  • 4.2 Failure Detection by Feature Probing: The MLP is trained with timestep-wise L1 loss to raise scores for failed rollouts and lower them for successful rollouts.
  • 4.3 Threshold Selection by Conformal Prediction: Functional conformal prediction calibrates a time-varying upper threshold from successful rollouts, with false-positive rate at most α under stated assumptions.
  • 4.4 Evaluation: Simulation results use ROC-AUC, and SAFE achieves the highest averaged ROC-AUC across all simulation benchmarks.

5 Experiments

SAFE is evaluated across simulated and real-world VLA tasks, using diverse uncertainty, embedding-distance, and action-consistency baselines. Functional conformal prediction measures the accuracy–timeliness trade-off on unseen tasks.

  • Evaluation Benchmarks: Experiments evaluate OpenVLA, π0, and π0-FAST on LIBERO-10, SimplerEnv, and real-world Franka and WidowX manipulators.LIBERO-10 contains 10 long-horizon tasks; real-world evaluations include 13 Franka tasks and 8 WidowX tasks.
  • Evaluation Benchmarks: Real-world Franka experiments collect 30 successful and 30 failed rollouts for each of 13 tasks, with 3 tasks held out as unseen.The π0-FAST-DROID checkpoint is deployed without additional demonstrations or VLA finetuning.
  • Failure Detection Baselines: Baselines include token uncertainty, sample consistency, embedding distance, and action consistency, with STAC requiring multiple sampled actions.Token uncertainty uses one inference, while sample-consistency methods measure variation across generated actions.
  • Evaluation Protocol: Functional conformal prediction calibrates a failure band on seen data, varies significance level α, and evaluates accuracy–detection-time trade-offs on unseen data.Higher balanced accuracy and lower detection time correspond to curves nearer the top-left.
  • Evaluation Protocol: ROC-AUC evaluates separation across thresholds, while balanced accuracy and average detection time evaluate calibrated decisive detection.T-det is the relative timestep when the score first exceeds the calibrated threshold, averaged over failed rollouts.
  • Failure Detection Baselines: 152% slower π0 and 221% slower π0-FAST generation for 10 action samples contrasts with SAFE’s less-than-1% runtime overhead.The comparison uses 10 samples versus one sample on a single NVIDIA RTX 3090 GPU; SAFE adds less than 1 ms or 1% of inference time.

6 Results

SAFE consistently matches or exceeds strong baselines across simulation and real-world evaluations. Its conformal-prediction calibration supports early failure alerts, while qualitative examples align scores with observed failures.

  • Failure Detection Performance: SAFE methods perform better than or on par with the best baselines across all reported settings.SAFE-MLP and SAFE-LSTM have similar performance averaged across simulation benchmarks.
  • Accuracy–Time Trade-off: SAFE-MLP and SAFE-LSTM perform best on OpenVLA+LIBERO and π0+SimplerEnv, and remain on par with the best baseline on the other benchmarks.The comparison uses balanced accuracy against average detection time under functional conformal prediction.
  • Real-World Results: In real-world experiments, SAFE-MLP achieves the best failure-detection performance for both π0-FAST Franka and OpenVLA WidowX.Reported ROC-AUC values average five random seeds with different task splits.
  • Accuracy–Time Trade-off: SAFE detects failures accurately in early rollout stages and potentially before the manually annotated failure timestep.Early detection is presented as allowing intervention before execution becomes stuck or harms the environment.
  • Qualitative Analysis: Qualitative rollouts show scores stopping after successful completion and flags following freezing or object slippage in failed executions.Simulation examples include imprecise insertion, oscillatory motion, and missed grasps.
  • Efficiency: SAFE uses a 1–2 layer MLP or LSTM and adds less than 1% computational overhead at runtime.SAFE-LSTM has 2.3 million parameters and adds 0.73 ms compared with π0’s 3.3 billion parameters and 149 ms inference time.

7 Conclusion

SAFE frames multitask failure detection as a generalist-VLA problem and uses internal features to detect failures across unseen tasks. It is evaluated across multiple VLA architectures, while its scope remains limited to manipulation and last-layer features.

  • SAFE defines multitask failure detection as training on seen tasks and evaluating on unseen tasks for generalist VLA policies.
  • SAFE operates on VLA internal features to produce a failure score and generalize failure detection across tasks.
  • SAFE achieves state-of-the-art failure-detection results and is reported to align with human intuition.
  • The paper only studies manipulation tasks and last-layer features, leaving cross-embodiment, sim2real, action-less-video, and multi-layer generalization open.
  • Experiments evaluate SAFE on OpenVLA, π0, and π0-FAST across simulation and real-world settings.
  • The feature aggregation study considers first, last, mean, and first-and-last representations, with model-specific aggregation dimensions for token and flow-matching features.

B.5 Benchmark Details

The benchmarks cover simulated and real-world VLA deployments with task-specific rollout protocols. Evaluation controls for duration-related confounding in LIBERO and separates π0 evaluation by embodiment.

  • LIBERO-10 contains 10 tasks with 50 rollouts per task and is selected as the most diverse and challenging LIBERO suite.
  • In LIBERO, successful rollouts stop upon task completion while failed rollouts reach the maximum length, creating a potential time-counting confound.
  • The LIBERO evaluation uses each task’s minimum rollout length as a common T and computes ROC-AUC from sT for fair comparison.
  • SimplerEnv uses separate π0 checkpoints for Google Robot and WidowX embodiments, so detectors and metrics are evaluated separately before averaging.
  • Within each SimplerEnv embodiment, one of four tasks is unseen, while seen-task rollouts are split 66% for training and 33% for seen evaluation.
  • The real-world experiments include Franka rollouts with fixed task horizons and 532 WidowX rollouts across eight tasks, comprising 244 successes and 288 failures.

B.6 Benchmark Statistics

SAFE is trained on limited multitask rollout data and evaluated on new tasks without collecting additional rollouts. Hyperparameters are selected using seen-task validation performance.

  • SAFE trains on a limited set of tasks and rollouts, then generalizes to new tasks without further rollout collection.
  • Training still requires hundreds of rollouts from multiple tasks before deployment on new tasks.
  • Benchmark statistics vary across runs because different random seeds produce different seen and unseen task subsets.
  • SAFE uses small MLP or LSTM networks and trains for 1000 epochs with batch size 512 on a single NVIDIA A100 40GB GPU.
  • Hyperparameters are chosen by grid search using ROC-AUC on the Deval-seen split, with real-world experiments fixing pre-logits features and mean aggregation.

C.1 Feature Visualization and Analysis

VLA embeddings generally separate successful and failed rollouts, although their geometry and failure patterns differ by model, benchmark, and setting. SAFE can generalize despite failures not forming a single visible region, but performance is limited in one diverse real-world setting.

  • Unsupervised t-SNE is used to visualize VLA embeddings without learning from task success or failure labels.
  • For π0-FAST and π0 on LIBERO, failed rollouts often occupy a common failure zone associated with freezing or shaking during execution.
  • Successful and failed rollouts are separable across the analyzed embedding spaces despite differences among VLAs and benchmarks.
  • OpenVLA failures do not form one unified failure zone, yet SAFE can learn separations and generalize to unseen tasks.
  • On the real Franka π0-FAST evaluation, embeddings are not easily separable in t-SNE and ROC-AUC reaches at most 64 on Deval-unseen.
  • SAFE-MLP nevertheless outperforms all baselines on both seen and unseen splits in that real-world evaluation.

C.2 Conformal Prediction Results

Functional conformal prediction calibrates time-varying failure thresholds and allows the conservativeness of detection to be adjusted through α. SAFE performs well near α = 0.15, although its TNR alignment with theoretical expectations varies across benchmarks.

  • Threshold calibration: Functional CP determines time-varying failure thresholds δt and adjusts detection conservativeness through the significance level α.Higher or lower α values produce different performance trade-offs across TNR, TPR, and balanced accuracy.
  • Threshold calibration: Varying α changes TNR, TPR, and balanced accuracy, with α = 0.15—and generally 0.05–0.2—performing well across metrics.The paper uses α = 0.15 for most qualitative results and analyses.
  • Theoretical calibration: CP bands are calibrated on successful rollouts, theoretically lower-bounding TNR near 1 −α when the i.i.d. sampling assumptions hold.The multitask setting instead calibrates on seen tasks and evaluates on unseen tasks.
  • Benchmark behavior: SAFE’s TNR curves are close to 1 −α on the ) +SimplerEnv benchmarks but lower on three others, while baselines do not consistently match the bound.The authors attribute this variation to calibration and evaluation failure scores coming from different task distributions.
  • Detection timing: SAFE-MLP detects failures before human-annotated failure times for both π0 and π0-FAST, forecasting 40% of π0-FAST LIBERO failures after the first timestep.The comparison uses detection times from SAFE-MLP and a human annotator.
  • Detection timing: Failures occurring only at timeout are difficult for detectors to identify because human annotations place them at the rollout’s final moment.These cases contribute to low failure-detection performance across the evaluated benchmarks.

D.1 Number of Training Tasks

Using more diverse training tasks generally improves unseen-task failure detection, while SAFE-MLP remains effective with only three or five training tasks. VLA last-layer features are the strongest tested feature choice, and the method is designed for transferable integration across VLA architectures.

  • Number of training tasks: More training tasks generally improve unseen-task failure detection because they provide more diverse failure modes, while evaluation tasks remain fixed.The ablation varies the number of seen tasks and averages results over three random seeds.
  • Number of training tasks: SAFE-MLP performs well across training-set sizes and achieves good unseen-task performance with three or five training tasks.The seven-task condition matches the setting reported in the paper.
  • Feature choice: SAFE-MLP using VLA last-layer features outperforms versions using DINOv2, CLIP, or concatenated DINOv2+CLIP features by a large margin.The comparison reports averaged ROC-AUC on seen and unseen real-world Franka tasks.
  • Detection formulation: SAFE-MLP outputs an unnormalized score, whereas SAFE-LSTM outputs a normalized failure probability; both are calibrated through functional CP for detection guarantees.SAFE-LSTM is trained with BCE loss.
  • Detection formulation: SAFE directly learns failure scores from observations and task instructions rather than using uncertainty or OOD detection as proxy measurements.The paper reports that this direct-learning regime outperforms the alternative baseline families.
  • Transferability: Using only last-layer feature vectors enables integration with different VLA models without modifying or finetuning the VLAs themselves.The design prioritizes simplicity and transferability.
  • Transferability: Multi-layer feature fusion may improve detection but would require VLA-specific designs, reducing transferability across architectures.The authors leave such feature aggregation as future work.
  • Thresholding scope: Offline CP is used because deployed VLAs may encounter novel tasks and environments without repeating the same task, making task-specific adaptive bands less practical.Online CP is identified as an important future extension.

F.3 Using Detected Failures for Behavior Improvement

SAFE is positioned as a real-time failure detector that can support intervention and future behavior improvement. The paper links latent-space separation to possible activation steering, while leaving steering itself beyond scope.

  • SAFE’s timely failure alerts can let a robot abort dangerous actions or let a human take over control.
  • The authors suggest that separated successful and failed rollout embeddings could support a steering vector that changes VLA output actions.Activation steering for robot manipulation remains an open challenge beyond this paper’s scope.
  • Table 8 reports mean and standard deviation of failure-detection ROC-AUC across benchmarks, with SAFE achieving high average performance and relatively low standard deviations versus baselines.
  • Additional evaluations visualize successful and failed rollouts, latent feature embeddings, conformal-prediction metrics, and detected-versus-ground-truth failure times.
Loading 2506.09937v2…