Source-linked AI summary
ActSafeGuard: Differentiable and Training-Aligned Constraint Enforcement for Flow-Matching Policies
Jianming Ma, Rongjun Jin, Xiaxi Si, Yang Zhang, Yiheng Li, Yue Gao
TL;DR
VLA and WAM policies may produce physically infeasible actions, while existing safety methods lack either deterministic per-step guarantees or alignment between training and execution. ActSafeGuard adds a differentiable ray-scaling constraint operator to flow-matching policies, achieving 100% step safety while preserving task success across evaluated backbones and tasks.
Problem
VLA and WAM actions can violate hard physical constraints, while existing approaches provide statistical safety or inference-only correction rather than deterministic, training-aligned enforcement.
Method
ActSafeGuard applies a differentiable analytical ray-scaling operator during both training and inference to integrate hard feasibility into flow-matching policy learning and generation.
Results
100% step safety rate is achieved while preserving task success rates across multiple foundation backbones and manipulation tasks.
Takeaways & Limitations
Training-aligned constraint enforcement provides a minimally invasive safeguard that maintains deterministic feasibility while retaining task competence and action-generation quality.
Takeaways & Limitations
The safety guarantee assumes the initial noise sample lies within the observation-dependent feasible region.
Abstract
from arXiv · showhide
Vision-Language-Action (VLA) and World-Action Models (WAMs) have demonstrated strong capabilities in general-purpose robotic manipulation, yet their generated actions may violate hard physical constraints and therefore be unsafe or infeasible for deployment. Existing safety approaches either optimize statistical safety objectives without deterministic per-step guarantees or correct unsafe actions only during inference, creating a mismatch between policy training and execution. We introduce ActSafeGuard, a differentiable and training-aligned safeguard layer for flow-matching based policies. ActSafeGuard integrates hard action feasibility into policy learning, not merely treating safety as an inference-time external component. Through an analytical ray-scaling operator design, ActSafeGuard enables boundary-aware gradients to guide the model to naturally learn constrained manifolds. Extensive experiments on multiple standard foundation backbones ($π_{0.5}$ and Fast-WAM) across various tasks demonstrate that ActSafeGuard consistently achieves a $100\%$ step safety rate while fully preserving or even boosting task success rates, providing a scalable and minimally invasive solution for safe embodied AI deployment.
Introduction
VLA and WAM policies can generate actions that violate hard physical constraints, while existing safeguards lack either deterministic per-step guarantees or training–inference alignment. ActSafeGuard integrates differentiable feasibility enforcement into flow-matching policies and achieves complete step safety while preserving task performance.
- Generated VLA and WAM actions may violate position, velocity, or workspace constraints, causing unsafe or infeasible execution.
- Existing training-time methods generally provide statistical or expectation-based safety, whereas inference-time corrections create training–inference mismatch.
- ActSafeGuard integrates hard action feasibility into both learning and generation for flow-matching policies.The same safeguard operates during training and inference, without adding a learnable network.
- An analytical ray-scaling operator rescales violating flow updates and provides boundary-aware gradients for constrained policy learning.
- 100% step safety rate is achieved while task success rates are preserved across evaluated foundation backbones and manipulation tasks.
Related Works
Prior approaches either optimize safety during training without deterministic per-step guarantees or enforce hard constraints only at inference. This separation can compromise execution capability, motivating training–inference-aligned safety for VLA and WAM policies.
- Safety is especially important for VLA and WAM policies deployed in open-ended environments because unconstrained physical actions may cause catastrophic failures.
- Training-time Constrained Policies: Training-time constrained policies improve safety awareness but typically optimize expected costs or soft penalties without deterministic per-step feasibility.
- Inference-time Safety Guards: Inference-time safeguards can enforce hard constraints during deployment but may introduce training–inference mismatch and compromise backbone execution capability.
- Balancing task performance with strict constraint satisfaction through a training–inference-aligned framework remains an open challenge.
Preliminary
The paper formulates language-conditioned manipulation as multimodal observation-to-action-chunk generation using a backbone and flow-matching action head. It models hard constraints as an observation-dependent convex polytope and seeks zero-violation execution throughout sampling.
- Policy Formulation: The policy maps multi-view images, proprioceptive states, and language instructions to future action chunks executed with receding horizon control.
- Flow-Matching Action Generation: Flow matching learns a velocity field conditioned on latent context and integrates it with an ODE solver to synthesize the final action chunk.
- Constrained Action Space: The feasible action region is modeled as a state-dependent convex polytope whose boundaries are determined by the observation-conditioned constraint matrix and vector.
- Constrained Action Space: The constrained action dimensions must remain within the feasible region throughout sampling to guarantee deterministic, zero-violation deployment.
Method
ActSafeGuard inserts a differentiable, parameter-free ray-scaling operator into discrete flow matching to enforce feasibility at every step while preserving the pretrained update direction. Starting from a feasible state, it guarantees feasible trajectories and supplies boundary-aware gradients for training.
- Core design: ActSafeGuard embeds a differentiable, parameter-free ray-scaling operator into discrete flow matching to enforce hard feasibility during learning and generation.The operator is applied to each flow update while retaining the pretrained action head’s directional prior.
- Safety guarantee: A feasible initial state and boundary-respecting constrained updates guarantee that every generated state remains within the closed feasible region.This is stated as the method’s safety guarantee across all inference steps.
- Ray scaling: ActSafeGuard computes a direction vector from the predicted velocity and adaptively scales its magnitude using the nearest constraint boundary.The ray-shooting operator finds the closest boundary intersection; feasible nominal updates remain unchanged, while boundary-crossing updates are shortened to that intersection.
- Ray scaling: The safe update reaches the boundary intersection when the nominal step would violate a constraint, while preserving the update direction.The boundary-limited update is written as xk+1 = xk + αdϕ = z ∈∂C.
- Differentiability: The operator is end-to-end differentiable, with closed-form gradients except at boundary corners handled by standard subgradient methods.This allows ActSafeGuard to be embedded directly into training loops.
- Training procedure: Training and inference use feasible initial noise, predicted velocities, safety scaling, and a discrete flow-matching loss within the ActSafeGuard procedure.Algorithm 1 summarizes the corresponding sequence of operations.
N x1
ActSafeGuard converts boundary-limited updates into boundary-sliding learning signals through an oblique projection in the local Jacobian. This preserves feasible tangential variations while eliminating first-order outward motion.
- Boundary sliding: The active-facet Jacobian acts as an oblique projection onto the facet’s tangent space along the ray direction.This projection characterizes the local response of the safe update in the boundary-limited regime.
- Boundary sliding: At a boundary, first-order changes in the safe update cannot move outward through the active constraint.The Jacobian preserves only variations that slide the boundary intersection along the feasible facet.
- Gradient-based correction: Because the ray-scaling operator remains differentiable, training gradients are reshaped toward re-orienting unsafe directions along the feasible boundary rather than merely truncating them.This distinguishes the mechanism from hard clipping or stop-gradient correction.
Experiments
Experiments test whether ActSafeGuard preserves task competence while enforcing hard constraints across static and dynamic manipulation settings, including simulation and real-robot deployment. Results show deterministic safety, strong task success, trajectory preservation, and a critical contribution from differentiable boundary-aware training.
- Performance Preservation (RQ1): 100% SSR is achieved by constrained methods in Table 1 across four tasks and both static PosCons and dynamic PosCons + VelCons settings.SSR is omitted from Table 1 because all constrained methods deterministically achieve 100% SSR.
- Why Are Hard Constraints Necessary?: 51.42% and 48.09% mean SSR for π0.5, versus 22.99% and 20.01% for Fast-WAM, show that feasible training data alone does not ensure deterministic safety.These values correspond to PosCons and PosCons + VelCons, respectively, for unconstrained baselines evaluated in-distribution.
- Performance Preservation (RQ1): ActSafeGuard preserves task success and action-generation quality better than post-hoc correction methods under hard constraints.Its boundary-aware gradients support flexible boundary-sliding corrections, yielding lower fitting errors and smoother trajectories than truncation or projection.
- Generalizability to Complex Constraints (RQ2): ActSafeGuard attains the highest mean SR under PosCons + VelCons while maintaining deterministic safety in the dynamic regime.The dynamic feasible region changes with the current state and couples multiple future actions through velocity bounds.
- Ablation on Differentiability (RQ3): 98.0% to 3.0% SR collapse on place shoe under PosCons + VelCons occurs when gradients through the safety scaling factor are removed.Both variants still enforce 100% SSR during inference, isolating the value of differentiability for learning useful constrained behavior.
- Real-Robot Deployment: 5/5 real-world successes for ActSafeGuard on guide the ball exceed the baseline’s 4/5, while both methods achieve 5/5 on pick green cube.ActSafeGuard strictly adheres to prescribed boundaries across all steps, whereas the unconstrained baseline violates the guide-the-ball corridor.
Conclusion
ActSafeGuard enforces hard action feasibility during flow-matching generation through a differentiable, training-aligned ray-scaling safeguard. Across simulation and real-robot tasks, it achieved deterministic step safety while maintaining task success and action-generation quality, though it relies on explicitly specified, tractable constraints.
- ActSafeGuard applies a parameter-free ray-scaling operator to each discrete flow update, enforcing hard action feasibility at every generation step.Its local Jacobian provides boundary-sliding gradients so the action head can adapt to feasible-set geometry.
- Across simulation and real-robot tasks, multiple constraint regimes, and two foundation backbones, ActSafeGuard achieved deterministic step safety while maintaining strong task success and action-generation quality.
- ActSafeGuard assumes feasible action spaces are represented by explicitly specified constraints with tractable ray-boundary intersections.The constraint set remains manually specified using task knowledge or demonstration statistics.