SafeRelBench: A Spatial-Relation-Aware Benchmark for Process-Level Safety in VLM-Driven Embodied Agents

🕒 Published (v1): 2026-07-16 03:59 UTC · Source: Arxiv · link

Why this paper was selected

Process-level spatial-relation safety benchmark for VLM embodied agents; fills eval gap for robot planners

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

💬 Ask ChatGPT✦ Ask Claude

TL;DR

SafeRelBench is a 507-sample executable benchmark that evaluates whether VLM-driven embodied agents respect spatial-relational safety preconditions (support, containment, proximity) before executing risk-prone actions, not merely whether they complete tasks. Evaluating seven frontier VLMs reveals a consistent and large gap between task success rate (SR) and safety success rate (SSR) once spatial relations are introduced, whereas matched non-spatial controls show near-parity. The core finding is that current agents can reach goals while violating the ordering constraints that keep execution safe.

Problem

Existing embodied safety benchmarks assess static hazard recognition, unsafe-instruction refusal, or final-state safety, leaving a complementary failure mode unstudied: an agent may pursue a benign instruction, select individually valid actions, yet violate process-level safety because a spatial relation (e.g., an object supported by another) makes the next action premature. No prior benchmark explicitly tests whether safety preconditions induced by object relations are satisfied before the corresponding risk-prone action executes.

Method

SafeRelBench is constructed via a three-stage pipeline:

1. Safety tip generation — GPT-5 generates household safety principles from simulated indoor scenes (e.g., "avoid liquids near electronics").
2. Scenario construction — Tips are mapped to Behavior-1K BDDL manipulation tasks; scenarios are filtered for semantic relevance to supporting, containment, or proximity relations, then verified by human review and online scene sampling.
3. Safety goal generation — Each scenario receives BDDL-style execution goals, process-level safety goals, and termination-level safety goals.

A formal safety criterion requires that for every safety condition \(g \in G_\text{safe}\) with trigger \(R(g) = a_\text{risk}\), the sequence \(\alpha = \langle a_1, \ldots, a_K \rangle\) must satisfy:

\[s_K \models G_\text{task} \;\wedge\; \forall g \in G_\text{safe},\; \forall k: a_k = R(g) \Rightarrow \text{Satisfied}(g, s_{k-1}).\]

A rule-based evaluator checks simulator states against this criterion, reporting SR, SSR (joint task+safety success), and SRec (safety recall conditioned on task success). Seven agents (Qwen2.5-32B/72B, Qwen3-8B/32B, GPT-5.4, Gemini-3.1-pro, Claude-sonnet-4-6) are evaluated under three prompt variants: BASE, RISK-AWARE (scenario-specific safety tips + preventive reasoning), and ACTION-GROUNDED (additionally grounds each tip to a concrete mitigation action).

Key Contributions

• Formal definition of spatial-relation-aware process-level safety for embodied agents, where correctness depends on relational preconditions being satisfied before risk-prone actions
• SafeRelBench: 507 executable samples (248 spatial-relation, 259 matched non-spatial controls) covering 9 relation-specific risk types across 3 spatial-relation categories (supporting, containment, proximity), with BDDL-style process-level safety annotations
• Systematic evaluation of 7 open- and closed-source VLM agents with prompt-variant ablation, showing task success and process-level safety are orthogonal dimensions under relational settings

Results

• Without spatial relations: SR 0.83–0.94, SSR up to 0.91 across all models
• With spatial relations: SR drops to 0.52–0.73, SSR drops sharply to 0.16–0.40
• Qwen2.5-72B: SR 0.94 → 0.65, SSR 0.91 → 0.33 when spatial relations introduced
• GPT-5.4: SR 0.93 → 0.73, SSR 0.65 → 0.40
• Claude-4.6: SR 1.00 → 0.53, SSR 1.00 → 0.38 on proximity tasks specifically
• Non-spatial controls for proximity yield near-perfect SSR (e.g., Claude-4.6: 1.00), confirming failures are relation-induced rather than general task difficulty
• ACTION-GROUNDED prompting improves SSR/SRec for some models but can degrade SR (task-completion trade-off); gains are model-dependent and non-monotonic; no prompt variant fully resolves relational safety failures

Limitations

• Confined to simulated household manipulation (Behavior-1K/iGibson); does not capture perception noise, actuation uncertainty, human presence, or hardware-specific constraints
• Spatial-relation taxonomy (\(R_\text{sp}\)) covers three relation types; other physically relevant relations (e.g., occlusion, kinematic linkage) are not addressed
• Safety tips generated by an LLM (GPT-5) may not cover all real-world safety knowledge
• 507 samples is relatively small, and action diversity is skewed toward PLACE_ON_TOP

Relevance to Agentic AI / LLM Agents

SafeRelBench exposes a fundamental limitation of LLM/VLM reasoning in agentic settings: models that score well on instruction following and final-state task completion can still systematically fail at the ordering and precondition reasoning that safe multi-step execution demands. This is directly relevant to the growing use of VLMs as the planning backbone for robotic and household agents, where intermediate-step safety is non-negotiable. The benchmark's process-level evaluation paradigm — checking preconditions at the moment of risk-prone actions rather than at episode end — points toward a necessary expansion of agentic evaluation beyond outcome-only metrics. The prompt ablation also demonstrates that simply injecting safety context into the system prompt is insufficient, suggesting future agents will need more structured mechanisms (e.g., explicit state-tracking, constraint-aware planners) to handle relational safety.