PaperlayerView exact revision on arXiv

Source-linked AI summary

SafeVLA-Bench: A Benchmark for the Success-Safety Gap in Vision-Language-Action Models

Jialiang Fan, Weizhe Xu, Zijun Wang, Oleg Sokolsky, Insup Lee, Fanxin Kong

arXiv:2606.00773v3cs.RO

TL;DR

Binary success on VLA manipulation benchmarks can miss unsafe execution, and Boolean safety verdicts do not show how severe violations are. SafeVLA-Bench adds task-aware post-hoc safety scoring and a bounded worst-violation metric to existing benchmarks. High success coexists with unsafe rollouts across LIBERO and RoboCasa-365.

  • Problem

    VLA benchmarks primarily assess binary task success, which does not capture whether a successful manipulation rollout also satisfies safety requirements or how deeply it violates them.

    Source: §1 · p. 1

  • Method

    SafeVLA-Bench applies task-aware STL safety specifications post hoc to unchanged benchmark rollouts and reports safety, success-but-unsafe rate, and bounded worst-violation depth.

    Source: §1 · p. 2

  • Results

    Fifteen LIBERO policies above 90% mean success still have 18–28% unsafe rollouts, while 38–56% of successful RoboCasa-365 rollouts violate an active clause.

    Source: §1 · p. 3

  • Takeaways & Limitations

    In a LIBERO-Spatial post-training case study, DPO using benchmark safety labels raises π0.5’s safety rate from 85.0% to 90.8%.

    Source: §1 · p. 3

    Measurement precision is bounded by simulator fidelity, and absolute violation rates depend on externally anchored thresholds that are not calibrated per object or task.

    Source: §5 · p. 9

Abstract

from arXiv · show

Vision-language-action (VLA) benchmarks measure whether a policy completes a requested manipulation task, but binary success can hide safety violations along the trajectory: a policy may reach the goal while applying excessive contact, disturbing bystander objects, destabilizing a held object, or entering robot self-contact. We present SafeVLA-Bench, a post-hoc safety-evaluation framework for existing simulator-based VLA benchmarks that reveals violations missed by success-only evaluation. It encodes task-aware safety requirements as Signal Temporal Logic (STL) invariants with quantitative robustness semantics. Alongside native success, it reports the safety rate and the success-but-unsafe rate (SBU) used in prior safety evaluations, and introduces the Violation Severity Index (VSI), a bounded worst-violation depth score. We instantiate SafeVLA-Bench on LIBERO and RoboCasa-365, evaluating twenty-seven policy-benchmark entries across tabletop and kitchen manipulation tasks. High task success does not imply safe execution: the fifteen tabletop policies above 90% mean success still have 18-28% unsafe-episode rates, and 38-56% of successful RoboCasa-365 rollouts violate at least one active safety clause. A post-training case study further shows that SafeVLA-Bench can be used to improve policy safety. Project page: https://safevla.org

1 INTRODUCTION

Binary task success on existing VLA benchmarks does not establish that a rollout was safe, and Boolean safety verdicts do not convey violation magnitude. SafeVLA-Bench adds task-aware quantitative evaluation to unchanged benchmark rollouts, showing unsafe execution even among high-success policies.

Motivation

  • LIBERO and RoboCasa primarily measure whether a policy reaches its goal, so binary success can miss unsafe contact, disturbed objects, spills, and other trajectory violations.Existing Boolean verdicts also treat a 201 N contact against a 200 N ceiling like a 500 N impact, leaving violation severity unmeasured.Source: §1 · p. 1

Contribution

  • SafeVLA-Bench scores unchanged LIBERO and RoboCasa-365 rollouts post hoc, preserving native success-rate comparability without policy fine-tuning.It reports safety and success-but-unsafe rate alongside task success, and uses quantitative STL robustness to calculate a bounded Violation Severity Index for worst-violation depth.Source: §1 · pp. 1–3

Results

  • Fifteen LIBERO policies above 90% mean success still leave 18–28% of rollouts unsafe, while 38–56% of successful RoboCasa-365 rollouts violate an active clause.Within a LIBERO-Spatial post-training case study, DPO using benchmark safety labels raises π0.5’s safety rate from 85.0% to 90.8%.Source: §1 · p. 3

2 RELATED WORK

Prior VLA evaluation largely ranks policies by binary goal completion, while recent safety work varies in task design, monitoring signals, and whether it measures severity. SafeVLA-Bench combines task-aware post-hoc scoring on unchanged host tasks with normalized worst-violation depth.

2.1 VLA MODELS AND EVALUATION

  • Standard VLA leaderboards primarily rank binary goal completion, with trajectory-level safety generally absent as a model-ranking metric.ManiSkill-HAB and OmniGuide are noted exceptions, using a coarse collision-force ceiling and a binary collision flag, respectively.Source: §2.1 · p. 3

2.2 SAFETY BENCHMARKS AND EVALUATION LAYERS

  • Safety benchmarks span purpose-built tasks, native-task monitoring, and damage models, with signals ranging from Boolean verdicts to continuous costs or severity.SafeVLA-Bench distinguishes itself by scoring unchanged host tasks from native simulator state and normalizing worst-violation depth across heterogeneous specification units.Source: §2.2 · p. 3
  • SafeVLA-Bench combines task-aware post-hoc scoring on unchanged LIBERO and RoboCasa-365 rollouts with clause-normalized worst-violation depth and broad policy coverage.The related-work discussion notes that separating success from safety and reporting continuous severity have precedents; its stated combination is the post-hoc setting and normalized worst-violation measure.Source: §2.2 · pp. 3–4

3 SAFEVLA-BENCH

SafeVLA-Bench scores trajectories from existing benchmark protocols using task-aware STL specifications and separate completion, safety, and severity metrics. Its applicability registry selects relevant clauses, while its Violation Severity Index summarizes the worst normalized violation per rollout.

3 SAFEVLA-BENCH

  • A host-side instrumentation layer, task-aware STL specification library, and metric suite score existing LIBERO and RoboCasa-365 trajectories post hoc while preserving native success-rate comparability.Policies use each benchmark’s original rollout protocol; the framework standardizes extracted safety signals and scores the resulting trajectories.Source: §3 · p. 4

3.1 SAFETY SPECIFICATION LIBRARY

  • The specification library organizes eight scored constraint families into scene interaction, object handling, and execution, using observable predicates and externally anchored thresholds.These simulator-side proxies are not hardware-safety certification thresholds; examples include 200 N contact ceilings, 5 mm bystander displacement, and 15° held-object tilt.Source: §3.1 · p. 4

3.2 TASK-AWARE CLAUSE APPLICABILITY

  • A shared tag–rule registry activates only clauses applicable to each task, avoiding false positives when a clause conflicts with the task objective.For four LIBERO tasks combining mechanisms, a tag invalidating a clause in one component excludes it for the whole episode, which can miss violations in phases where it otherwise applies.Source: §3.2 · p. 5

3.3 SAFETY METRICS

  • SR measures host-task success, Safety measures applicable-clause compliance, and SBU counts unsafe successes among all rollouts.Safety is not certified physical safety, and these outcome rates indicate whether a violation occurred rather than its depth.Source: §3.3 · p. 5
  • VSI maps each violated continuous clause to a bounded normalized depth and reports the worst applicable depth per rollout, averaged across rollouts.The score is specification-conditioned rather than an absolute real-world risk certificate; the scored binary self-collision predicate saturates as an actuation sentinel, not a calibrated physical depth.Source: §3.3 · pp. 5–6

4 EXPERIMENTAL RESULTS

Across LIBERO and RoboCasa-365, high task success often coexists with unsafe execution, and safety measures reorder policy comparisons. The experiments also examine task structure, threshold robustness, violation duration, and label-based post-training.

4.1 EXPERIMENTAL SETUP

  • The evaluation covers 24 distinct policies in 27 policy–benchmark entries, with fixed episode seeds within sequences and unpaired comparisons across RoboCasa-365 seed groups.LIBERO model–suite cells use 200 episodes; RoboCasa-365 uses 50 episodes per task, and continuous metrics use episode-level bootstrap intervals.Source: §4.1 · p. 6

4.2 MAIN BENCHMARK RESULTS

  • 18–28% of rollouts remain unsafe among fifteen LIBERO policies above 90% mean success, while RoboCasa-365 P[U | S] ranges from 38.0% to 55.8%.The reported results cover LIBERO's four suites and RoboCasa-365's 18 task families.Source: §4.2 · p. 6, Table 3 · p. 7, Table 4 · p. 7
  • At 24.8 points higher SR, GR00T-N1.7 is less safe than OpenVLA-7B; on RoboCasa-365, SR rises from 43.1% to 81.9% while Safety stays within 48.9–52.0%.In LIBERO, π0.5 ranks ninth by mean SR but eleventh by Safety, while InternVLA-M1 ties for second in Safety; RoboCasa comparisons here are within the independent-seed group.Source: §4.2 · pp. 6–7

4.3 FOUR FINDINGS

  • Within-suite SR and Safety association is weaker than between-suite association (Kendall τ=+0.34 versus +0.58), and the top-SR policy is also top in Safety in only two of five suites.Figure 3 shows higher mean SBU for RoboCasa-365 than LIBERO (25.1% vs. 17.9%), but more LIBERO cases in the ve=1 bin (7.1% vs. 4.5%).Source: §4.3 · pp. 7–8, Figure 3 · p. 8
  • Of 58 tasks with at least three roster policies succeeding, 26 have SI > 0, 15 have SI ≥20%, and four exceed 50%.The highest listed task rate is 100% for RoboCasa-365 PickPlaceDrawerToCounter; SI alone does not establish that a violation is unavoidable.Source: §4.3 · p. 8
  • Across six moderate threshold variants, mean Kendall τb to the default policy ordering is 0.84, and the top policy is unchanged in 72 of 90 suite×variant×metric cells.VSI is the most stable of the three metrics under moderate variants; two 10× relaxations reduce average agreement to τb=0.53 while changing the measurand.Source: §4.3 · p. 8
  • Force-ceiling violations have median longest runs of one control step on LIBERO and four on RoboCasa-365, while bystander displacement and held-object tilt persist for median runs of 42–47 and 24–57 steps.Force exposure is under 2% of steps; traces localize violations by step and clause, while VSI records severity.Source: §4.3 · pp. 8–9

4.4 SAFEVLA-BENCH FOR POST-TRAINING

  • DPO using benchmark safety labels improves Safety, SBU, and VSI across all three training seeds, with a small decrease in mean SR.The case study constructs 607 preference pairs from successful rollouts sharing the same initial state and evaluates on 200 test episodes with disjoint initial states.Source: §4.4 · p. 9

5 DISCUSSION AND LIMITATIONS

The discussion argues that unsafe paths remain unpenalized and safety can distinguish policies even when success is near ceiling. The appendices illustrate unsafe successes, break down violations, and test sensitivity to measurement duration and thresholds.

5 DISCUSSION AND LIMITATIONS

  • When success saturates, safety still separates policies, and a post-training study shows benchmark safety labels can improve a near-perfect policy.The discussion notes that preference pairs can both succeed, so success-based signals cannot express the safety preference.Source: §5 · p. 9
  • The measurements are bounded by simulator fidelity and externally set thresholds, so absolute violation rates depend on the chosen thresholds.The authors report 4 unsafe successes among 26 successful hardware-pilot rollouts; porting requires recalibrating thresholds and declaring exposed signals, not respecifying STL clauses.Source: §5 · pp. 9–10

A.1 PER-SUITE LIBERO RESULTS

  • Table 6 breaks the four-suite LIBERO means down by suite, with 200 rollouts per row.Source: Table 6 · p. 15

A.2 QUALITATIVE SUCCESSFUL-BUT-UNSAFE EXAMPLES

  • Successful-but-unsafe examples show violations at a red-bordered moment before the rollout ends in task success.The robustness traces localize the violating clause and step; force excursions can end within one control step, while bystander displacement can persist to episode end.Source: Figure 4 · p. 16, Figure 5 · p. 17

A.3 OUTCOME COMPOSITION PER SUITE

  • Figure 6 divides each policy-suite cell into four success-by-safety outcomes, while Figure 3 partitions unsafe successes by worst-clause depth.Safety is scored on failed rollouts too; conditioning Safety on episodes with contact changes it by at most 3.8 points in any cell.Source: §A.3 · p. 17, Figure 6 · p. 18

A.4 PER-SPEC VIOLATION BREAKDOWN

  • Per-spec violation rates are marginal and may overlap; their episode-level union, rather than their sum, equals 1−Safety.The SBU composition tables instead report each specification’s share of the spec-violation count among unsafe successes.Source: §A.4 · p. 18, Table 7 · p. 19, Table 8 · p. 20

A.5 VIOLATION EXPOSURE: HOW LONG A VIOLATION LASTS

  • Force violations are brief, while bystander displacement and held-object tilt tend to persist across many control steps.Median force exposure is under 2% of steps, with longest runs of one to four steps; bystander displacement has median exposure of 20–31% and median runs of 42–47 steps.Source: §A.5 · pp. 20–21, Table 10 · p. 21

A.6 THRESHOLD SENSITIVITY

  • Under six moderate threshold variants, mean ranking agreement is τb = 0.84 and the top policy is unchanged in 72 of 90 cells; only 10× variants reduce agreement to τb = 0.53.The duration test removes 64% of LIBERO and 30% of RoboCasa-365 force violations, but unsafe episodes remain in both suites.Source: §A.6 · pp. 21–22, Table 12 · p. 22, Table 13 · p. 23

A.8 PER-TASK SR AND SAFETY WITH WILSON 95% CI

This appendix supplies an example per-task aggregation and descriptions of unsafe-success composition tables; the provided passages do not report their cell values.

A.8 PER-TASK SR AND SAFETY WITH WILSON 95% CI

  • The per-task records group evaluation by task and report Wilson 95% confidence intervals for success and safety counts.Source: §A.8 · p. 23
  • The OpenVLA-7B LIBERO-Spatial block is an example of per-task aggregation, with 20 rollouts per task.The full per-task table is slated for the code release.Source: §A.8 · p. 23, Table 17 · p. 26
  • The LIBERO and RoboCasa-365 tables allocate each unsafe success’s spec-violation count across the clauses it violates.An episode violating multiple clauses contributes once to each clause’s share, so rows with unsafe successes sum to 100%.Source: Table 14 · p. 24, Table 15 · p. 25, Table 16 · p. 25

B MINIMAL PORTABLE INTERFACE EXAMPLE

A portable host interface lets SafeVLA-Bench score archived trajectories without reimplementing its metrics. The example separates trajectory signals, task semantics, benchmark capabilities, and specification rules.

B MINIMAL PORTABLE INTERFACE EXAMPLE

  • A new host needs an offline adapter that emits a normalized trajectory, task-tag record, and specification-registry record; scoring consumes safety signals, not replay observations or model traces.The minimum interface allows host-specific raw fields, while missing signal families deactivate dependent specifications rather than counting as zero violations.Source: B MINIMAL PORTABLE INTERFACE EXAMPLE · p. 27, Table 18 · p. 27
  • The trajectory record contains per-step state, contact, and torque fields sufficient to evaluate force, displacement, tilt, torque, and self-collision clauses.The example includes episode metadata, body roles, positions, orientations, and contact records.Source: B MINIMAL PORTABLE INTERFACE EXAMPLE · p. 27
  • Contact-pair roles and force magnitudes let portable clauses select robot–furniture, target–furniture, or robot–robot interactions.Source: B MINIMAL PORTABLE INTERFACE EXAMPLE · pp. 27–28
  • Task tags encode manipulation semantics, object tags encode properties such as spillability, and benchmark capability tags indicate available signals.A specification is active only when all required tags are present and no invalidating tag is present.Source: B MINIMAL PORTABLE INTERFACE EXAMPLE · p. 28
  • The scoring loop resolves tags, filters the registry, derives signals, evaluates STL robustness, and computes safety, SBU, and VSI per episode.Inactive or structurally unavailable specifications have null robustness and are skipped by VSI.Source: B MINIMAL PORTABLE INTERFACE EXAMPLE · p. 29

C STL SPECIFICATION-LIBRARY DETAILS

The appendix details the STL semantics, signals, thresholds, and applicability rules behind SafeVLA-Bench’s scored specifications. It also records which candidate clauses remain report-only or excluded.

C STL SPECIFICATION-LIBRARY DETAILS

  • For each contact-instrumented host, the appendix defines episode, contact-set, force, position, and transport-gate notation used by the specification library.Contact forces are linear wrench magnitudes, and scored force clauses use per-step maxima over selected role-pair sets.Source: C STL SPECIFICATION-LIBRARY DETAILS · p. 30

C.3 SIGNAL-EXTRACTION FORMULAS

C.1 CANONICAL SAFE-TIER LIBRARY

  • The eight scored constraint families form the safety conjunction only when the per-task registry marks them applicable.Thresholds are fixed before policy evaluation; examples include a 200 N contact-force proxy, 5 mm bystander displacement, and 15° held-object tilt during transport.Source: §C.1 · pp. 30–31, Table 20 · p. 30, Table 21 · p. 31

C.2 VSI NORMALIZATION CONSTANTS

  • VSI clips continuous violation depth linearly at a per-spec severe magnitude, then uses the worst applicable depth for the rollout.Binary hard-stop self-collision contributes a depth of 1 when violated.Source: §C.2 · p. 31, Table 22 · p. 32

C.4 PER-AXIS SAFE-TIER DETAILS

  • The scored axes cover unwanted scene contact and displacement, held-object tilt and slip, and robot-side torque or self-contact events.Main thresholds define the primary metrics; alternate tiers are reserved for sensitivity analysis.Source: §C.4 · p. 33, Table 25 · p. 34

C.5 APPLICABILITY RULES

  • A specification contributes only when its required signal and semantic tags are present and no invalidating tag applies.The registry is intended to avoid scoring absent referents or penalizing behavior required by the task; the appendix gives false-positive examples.Source: §C.5 · pp. 34–35, Table 27 · p. 35

C.6 REPORT-ONLY AND EXCLUDED CLAUSES

  • Some predicates remain report-only or excluded because they are redundant, lack portable signals, or lack context to express household safety risk.Examples include binary any-touch collision predicates, gripper-command chatter, workspace bounds, and smoothness clauses.Source: §C.6 · pp. 35–36

D REPRESENTATIVE PER-TASK APPLICABILITY ENTRIES

Task templates select active safety specifications, with benchmark signal and object-property tags refining the per-task set. Across suites, the mean active count ranges from 4.4 to 5.2.

D REPRESENTATIVE PER-TASK APPLICABILITY ENTRIES

E STATISTICAL METHODOLOGY

The paper uses interval methods suited to different outcome types, provides formulas for reconstructing success-by-safety counts, and checks engagement and initially unsafe episodes.

E STATISTICAL METHODOLOGY

  • Success and per-specification violation proportions use Wilson score 95% intervals, chosen over Clopper–Pearson for tighter intervals that remain stable near 0 or 1.Source: E STATISTICAL METHODOLOGY · p. 38
  • Continuous metrics, including mean ρmin, peak contact force, VSI, and VSI|U, use episode-level non-parametric bootstrap 95% intervals with 10,000 resamples.The implementation uses percentile bootstrap intervals with a fixed seed and does not Studentize because clause thresholds and severe anchors are fixed.Source: E STATISTICAL METHODOLOGY · p. 38
  • The 2 × 2 success-by-safety table is reconstructed from n, SR, Safety, and SBU, with success–unsafe equal to SBU and the other cells derived by subtraction.Source: E STATISTICAL METHODOLOGY · p. 38
  • Across 22,500 roster episodes, 70 of 81 cells had no never-engaged episodes, and the maximum never-engaged share was 7.2%.Seventeen episodes violated a clause at t=0; the listed initial-state cases affect at most 0.5 Safety points per cell and remain in the tables.Source: E STATISTICAL METHODOLOGY · p. 38

F EXTENSIBILITY CASE STUDY: ADDING A CONSTRAINT END-TO-END

Adding a constraint to stored LIBERO trajectories required little implementation and replay cost, and the tested contact-torque constraint flagged episodes not usually caught by existing clauses. Its threshold lacked defensible provenance, so it remained outside the scored tier.

F EXTENSIBILITY CASE STUDY: ADDING A CONSTRAINT END-TO-END

  • The added constraint bounds peak external contact torque on any robot body, targeting prying and twisting loads that a linear force bound may not capture.LIBERO already records the signal, so no instrumentation change or re-evaluation was needed.Source: F EXTENSIBILITY CASE STUDY: ADDING A… · p. 39
  • Adding the constraint changed seven files by +87/ −5 lines, with roughly 35 lines of executable code or registry data.Source: F EXTENSIBILITY CASE STUDY: ADDING A… · p. 39, Table 30 · p. 39
  • Evaluating the new constraint with the existing specifications over 600 LIBERO-Spatial episodes took 1.3 seconds of single-core CPU replay, with no GPU, simulator, or policy rollout.The marginal cost is independent of evaluation cost when the required signal is already recorded.Source: F EXTENSIBILITY CASE STUDY: ADDING A… · p. 39
  • The new contact-torque constraint had a 4.0–6.5% violation rate across three models, while episode-level agreement with each scored constraint stayed at or below 0.49.On continuous robustness values, its correlation with peak contact force was 0.85–0.89; both signals derive from the same contact wrench, but flagged episodes differ.Source: F EXTENSIBILITY CASE STUDY: ADDING A… · p. 39, Table 31 · p. 39
  • The 87 threshold lacks defensible provenance because the arm’s per-joint datasheet limit does not transfer to a per-body contact wrench, so the constraint is excluded from Φsafe and headline numbers.The threshold issue, not implementation, kept the extension in the candidate tier.Source: F EXTENSIBILITY CASE STUDY: ADDING A… · p. 40
  • Signals not already recorded, such as human proximity or thermal exposure, can require new instrumentation and re-evaluation; validating signal meaning and threshold provenance gates promotion.Source: F EXTENSIBILITY CASE STUDY: ADDING A… · p. 40

G SIGNAL TRANSFERABILITY: SIMULATOR SOURCES AND PHYSICAL-PLATFORM MEASUREMENT

The transferability analysis maps simulator signals to hardware measurement needs, while a small SO-101 pilot finds successful rollouts that violate scored safety criteria. The pilot uses video labels and does not compute STL robustness or VSI.

G SIGNAL TRANSFERABILITY: SIMULATOR SOURCES AND PHYSICAL-PLATFORM MEASUREMENT

  • The signal interface uses named per-step scalar values populated by a host adapter, separating the specification library from any particular simulator API.The appendix maps signal production in two simulator hosts to the measurement a physical platform would need.Source: G SIGNAL TRANSFERABILITY: SIMULATOR… · p. 41
  • Across nine signals covering eight scored constraint families, three are graded Direct, five Recalibrate, and one Added sensor; none is unmeasurable on hardware in principle.The map describes measurement porting cost, not hardware behavior.Source: G SIGNAL TRANSFERABILITY: SIMULATOR… · p. 42, Table 32 · p. 42
  • Hardware contact-force estimates cover the robot-plus-payload chain rather than all scene contacts, while non-target displacement needs external tracking or omission of that family.Wrench estimators also provide resultant rather than per-pair peaks, making force-role attribution approximate; the STL clause form remains unchanged.Source: G SIGNAL TRANSFERABILITY: SIMULATOR… · pp. 42–43
  • Physical instantiation requires declaring available signals and recalibrating thresholds against platform sensing; the STL clauses and SBU/VSI definitions remain unchanged.Source: G SIGNAL TRANSFERABILITY: SIMULATOR… · p. 43

G.1 HARDWARE PILOT ON AN SO-101 ARM

  • The hardware pilot scores non-target displacement and stable grasp from synchronized front and wrist video, using binary labels rather than calibrated violation depth.The pilot does not run per-step STL scoring or compute VSI; force-family scoring would require calibrated wrench sensing.Source: §G.1 · pp. 43–44
  • Of 26 successful SO-101 pilot rollouts, 4 violated a scored clause, yet all four still ended with the target in the box.The pilot comprised 40 rollouts of one policy on one arm; one unsafe success also displaced a non-target object.Source: Table 33 · p. 43, §G.1 · p. 44

H SAFETY-AWARE POST-TRAINING DETAILS

This appendix describes the LIBERO-Spatial post-training setup and compares safety changes across fine-tuning methods. Task-balanced DPO improves overall safety in all three seeds, while results remain limited to one policy and suite.

Evaluation protocol

  • The base policy achieves SR 99.5% and Safety 85.0% on the 200-episode test split used for post-training comparisons.The split uses 10 validation, 20 test, and 20 training states per each of ten LIBERO-Spatial tasks; all policies share test episodes and environment and noise seeds.Source: H SAFETY-AWARE POST-TRAINING DETAILS · p. 45

Safety labels and preference pairs

  • Of 1,577 successful training rollouts, 202 (12.8%) violate a safety clause, almost always through non-target-object displacement exceeding 5 mm.The 607 preference pairs come from unsafe successes sharing an initial state with a safe success; paired samples complete the same task.Source: H SAFETY-AWARE POST-TRAINING DETAILS · p. 45

Training setup and comparison methods

  • The comparison includes filtered SFT, task-focused SFT, advantage-conditioned SFT, and DPO with uniform or task-balanced pair sampling.Training rollouts and test episodes use the same STL specifications and scorer; task-balanced sampling draws a task uniformly before selecting a pair.Source: H SAFETY-AWARE POST-TRAINING DETAILS · pp. 45–46

Flow-matching DPO

  • DPO preferences compare safe and unsafe successes from the same initial state using flow-matching loss, with an added SFT term on the safe success.The flow-matching loss averages regression loss over uniformly sampled frames; chunks beyond an episode are padded with its final action.Source: H SAFETY-AWARE POST-TRAINING DETAILS · p. 45

Results discussion

  • None of the tested SFT methods matches task-balanced DPO’s mean safety performance; task-focused SFT reduces unsafe successes on task 5 but increases them on task 6.Advantage-conditioned SFT has higher VSI than the base policy, while its good and bad prompts differ by only two SBU points.Source: H SAFETY-AWARE POST-TRAINING DETAILS · p. 46
  • All three task-balanced DPO seeds improve overall safety and reduce unsafe successes on tasks 1, 5, and 6, though improvement magnitude and task success vary.The comparison between uniform and task-balanced DPO cannot be attributed to task balancing alone because sampling, training duration, and batch composition change together.Source: H SAFETY-AWARE POST-TRAINING DETAILS · p. 46

Scope and limitations

  • The post-training study covers one policy and one suite, with violations dominated by non-target-object displacement; transfer to other violation types or suites remains untested.Training and testing use disjoint initial states from the same ten tasks.Source: H SAFETY-AWARE POST-TRAINING DETAILS · p. 46
Loading 2606.00773v3…