Skip to content

SafeVLA: Towards Safety Alignment of Vision-Language-Action Model via Constrained Learning

🕒 Published (v1): 2025-01-01 · Source: NeurIPS · Venue: NeurIPS 2025 · link

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

💬 Ask ChatGPT✦ Ask Claude

TL;DR

SafeVLA proposes an Integrated Safety Approach (ISA) for aligning Vision-Language-Action Models (VLAs) using the Constrained Markov Decision Process (CMDP) framework and Lagrangian-based safe reinforcement learning. Applied to mobile manipulation tasks, ISA reduces cumulative safety violations by 83.58% over the strongest RL baseline while improving task success rate by 3.85%. The authors also introduce Safety-CHORES, a procedurally generated benchmark designed to surface safety-critical failure modes in long-horizon embodied tasks.

Problem

Existing LLM/VLM safety methods (RLHF, content moderation, reward shaping) target abstract, intention-level harms and cannot be directly applied to VLAs, which face concrete physical hazards (collisions, destabilizing objects, interaction with dangerous equipment). Prior VLA training via imitation learning or task-performance RL lacks any formal mechanism for explicitly enforcing safety constraints, leaving an open gap between model capability and safe real-world deployment.

Method

ISA integrates four interconnected stages within an adapted CMDP tuple (S, A, P, r, C, L, μ, γ):

  1. Modeling safety: Tasks are formally specified as tᵢ = (eᵢ, xᵢ, qᵢ, G, Φ, Ψ) where Φ is a set of state-action safety predicates (e.g., ϕ_corner, ϕ_dangerous_equipment) and Ψ is a set of trajectory-level predicates (e.g., ψ_blind_spot, ψ_fragile_collection, ψ_critical_point). Predicates are defined compositionally using state/action conditions and temporal structure.

  2. Eliciting risks: 150K procedurally generated indoor scenes (ProcTHOR) and 800K 3D assets (Objaverse) are used in AI2THOR to systematically expose five classes of safety-critical components (corners, blind spots, fragile collections, critical points, dangerous equipment) across three task categories (Safety-ObjNav, Safety-PickUp, Safety-Fetch).

  3. Constraining policies: Safety predicates are converted to cost signals. The constrained optimization is solved via Lagrangian relaxation as a min-max problem: min_θ max_{λ≥0} [−Jᵣ(θ) + Σᵢ λᵢ Jcᵢ(θ)], with dynamic Lagrange multipliers λᵢ updated interleaved with policy parameters θ. Safety is prioritized before task performance.

  4. Safety assurance: Evaluation covers test-time safety on held-out scenes, long-tail safety (statistical tail of cost distribution), and extreme failure safety (forced SR≈0 scenarios to isolate inherent safety behavior).

Key Contributions

  • ISA framework: First systematic exploration of explicitly integrating safety constraints into VLAs via SafeRL/CMDP.
  • Safety-CHORES benchmark: Novel testbed with five safety-critical component classes embedded in long-horizon mobile manipulation tasks across procedurally generated scenes.
  • CMDP-based constrained VLA training: Lagrangian dual formulation with dynamic multipliers for safety-performance trade-off.
  • Empirical validation: 83.58% reduction in cumulative cost with +3.85% SR over SOTA RL fine-tuning baseline, plus OOD robustness and sim-to-real transfer demonstrations.
  • Generalizability: ISA shown effective across multiple VLA architectures (EmbCLIP, Embodied-Codebook, DINOv2 variants).

Results

  • vs. FLaRe (IL+RL) on Safety-CHORES: cumulative cost (CC) reduced 83.58% on average; SR improved +3.85%
  • Safety-ObjNav: SR 0.865 vs 0.822; CC 1.854 vs 12.356
  • Safety-PickUp: SR 0.928 vs 0.912; CC 0.372 vs 7.076
  • Safety-Fetch: SR 0.637 vs 0.605; CC 8.084 vs 43.364
  • Long-tail safety: ISA eliminates trajectories with CC > 10; maximum unsafe severity reduced to 1/35th of FLaRe
  • Extreme failure (SR≈0): ISA CC = 2.20 vs FLaRe CC = 71.68 (32×) and SPOC CC = 14.63 (7×)
  • OOD perturbations (color, lighting, material): average SR drop of −0.027; CC increase modest and contained vs unaligned baselines
  • Dynamic vs. fixed Lagrange multipliers: dynamic multipliers strictly dominate all fixed-penalty baselines at equivalent cost limits
  • Ablation (no risk elicitation): CC rises to 5.01 vs 1.854 and SR drops from 0.865 to 0.645, worse than FLaRe-RS

Limitations

  • Real-world validation is restricted to a single task (Safety-PickUp) on one hardware platform; broader sim-to-real generalization is unverified.
  • Credit assignment for trajectory-level safety predicates (ψ) is coarse—cost attributed only to the final step of a violating segment—and is acknowledged as unresolved future work.
  • Cost threshold báµ¢ is set empirically as a fraction of baseline converged cost; no principled method for absolute threshold selection is offered.
  • Training is compute-intensive (15–25M environment steps per task), limiting accessibility.
  • Safety-CHORES is confined to indoor mobile manipulation in AI2THOR; generalization to other embodiments or outdoor environments is not evaluated.

Relevance to Vision-Language Models

SafeVLA directly extends VLM safety research to the embodied, action-grounded setting, demonstrating that safety alignment techniques developed for language and vision models require fundamental redesign when physical consequences are involved. The CMDP/Lagrangian approach provides a principled alternative to reward shaping that is architecturally agnostic and applicable across VLA backbones, which is relevant to any VLM-grounded policy system. The work highlights a critical gap: even state-of-the-art VLMs fine-tuned for robotics lack explicit safety guarantees, and content-level alignment does not transfer to physical-world constraint satisfaction. Safety-CHORES establishes a much-needed evaluation standard for VLA safety alongside task performance, filling a benchmark gap parallel to what adversarial and alignment benchmarks did for VLMs in the language domain.