Failure Prediction at Runtime for Generative Robot Policies
Authors: Ralf Römer
Adrian Kobras
Luca Worbis
Angela P. Schoellig
Venue: NeurIPS 2025 poster ()
Keywords: Imitation Learning
Diffusion Policies
Robotics
Safety
Generative Models
Primary area: reinforcement_learning
TL;DR: We propose FIPER, a framework to predict failures of generative imitation learning policies by detecting consecutive OOD observations and high action uncertainty, achieving more accurate and faster detection than prior approaches.

Abstract: Imitation learning (IL) with generative models, such as diffusion and flow matching, has enabled robots to perform complex, long-horizon tasks. However, distribution shifts from unseen environments or compounding action errors can still cause unpredictable and unsafe behavior, leading to task failure. Therefore, early failure prediction during runtime is essential for deploying robots in human-centered and safety-critical environments. We propose FIPER, a general framework for Failure Prediction at Runtime for generative IL policies that does not require failure data. FIPER identifies two key indicators of impending failure: (i) out-of-distribution (OOD) observations detected via random network distillation in the policy’s embedding space, and (ii) high uncertainty in generated actions measured by a novel action-chunk entropy score. Both failure prediction scores are calibrated using a small set of successful rollouts via conformal prediction. A failure alarm is triggered when both indicators, aggregated over short time windows, exceed their thresholds. We evaluate FIPER across five simulation and real-world environments involving diverse failure modes. Our results demonstrate that FIPER better distinguishes actual failures from benign OOD situations and predicts failures more accurately and earlier than existing methods. We thus consider this work an important step towards more interpretable and safer generative robot policies. Code, data, and videos are available at [tum-lsy.github.io/fiper_website](https://tum-lsy.github.io/fiper_website).

Failure Prediction at Runtime for Generative Robot Policies
Ralf Römer
Adrian Kobras
Luca Worbis'
Angela P. Schoellig 1.2.
Technical University Munich, Germany; Learning Systems and Robotics Lab;
Munich Institute of Robotics and Machine Intelligence (MIRMI)
2 Robotics Institute Germany
Munich Center for Machine Learning
ralf.roemer@tum..
Abstract
Imitation learning (IL) with generative models, such diffusson and flow matching. has enabled robots to perform complex, long-horizon tasks. However, distribution shifts from unseen environments compounding action errors can still cause unpredictable and unsafe behavior, leading to task failure. Therefore, early failure prediction during runtime is essential for deploying robots in and safety-critica environments. We propose FIPER, a general framework for Failure Prediction Runtime for generative II. policies that does require failure data. FIPER identifies two key indicators of impending failure: (i) out-of- distribution (OOD) observations detected via random network distillation in the policy's ' embedding space, and (ii) high uncertainty generated actions measured by novel action-chunk entropy score. Both failure prediction scores are calibrated using small set of successful rollouts via conformal prediction. A failure alarm is triggered when both indicators, aggregated over short time windows, exceed their thresholds. We evaluate FIPER across five simulation and real-world environ- ments involving diverse failure modes. Our results demonstrate that FIPER better distinguishes actual failures from benign OOD situations and predicts failures more accurately and earlier than existing methods. We thus consider this work an important step towards more interpretable and safer generative robot policies. Code, data, and videos are available tum-lsy. www.llyyggituu..oooooo _eepsstee
Introduction
Imitation learning (IL) for robotics usually involves high-dimensional, diverse, and multimodal data [69, 39]. Recent advances in generative modeling. such as diffusion models [64, 25] and flow matching [40], have led significant progress in IL algorithms, substantially expanding the range of complex, long-horizon tasks that robots can perform [11, 78. 56, 6, 5]. Despite these improvements, generative IL policies remain imperfect even when trained data [39, 50]: Unexpected visual or state shifts and compounding errors in action predictions cause erratic or unsafe behavior, ultimately leading to task failure [37, 42, 75). In human- centered and safety-critical settings, it is therefore crucial to predict such failures as early as possible during runtime enable timely intervention [44] safe fallbacks [8]
large-scale robot
ask human experts to demonstrate the task [74]. However, failure prediction is difficult because it cannot be treated as typical classification problem for two main reasons: First, is often not possible to generate examples of failures [18, 42], as this would endanger the robot and its environment. Second, the
EEqua contribution.
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

Score Learning & Calibration
Observations
Policy Deployment
RND-OE
Spore
Observation Score
RND-OE
Generative Policy m{A(O)
Threshold
OOD
Policy
Fallure Predicted?
&
ACE Action-Based Score
Successful Rollouts
Score
Fallure
FIPER Fajure Prediction at Runtime
Warning
ACE
High
Low
Action Chunks
Threshold
Figure 1: FIPER can predict task failures of generative robot policies during runtime without using any failure data. FIPER detects two key signals indicative of impending failure: (i) consecutive out-of-distributton (OOD) observations via random network distillation the policy's observation embedding space (RND-OE) and (ii) persistently high uncertainty in generated actions via action- chunk entropy (ACE). Both scores are calibrated based on a few successful rollouts and aggregated over sliding window. If both submodules issue a warning, then FIPER predicts failure. Its task- agnostic design enables FIPER to issue accurate and early failure warnings diverse environments.
range of potential failure modes during closed-loop operation in complex, real-world environments is vast [1. 75], meaning that creating labeled data is not a viable option.
Existing approaches for anticipating and detecting policy failures fall into two broad categories: Those that look for out-of-distribuut
(OOD) observations or actions [37, 75, 22] and those that externaly monitor the robot's behavior or progress using ision-language models (VLMs) [1. 17]. Both approaches have drawbacks: Pure OOD detectors trigger on any novel situation, even the policy can generalize to it. At the same time, VLMMbased methods only raise alarms after errors manifest, providing no foresight about impending failure. Most closely related to our work, Xu et al. [75] propose using a scalar uncertainty score derived from the policy inputs. However, future behavior is determined by the actions of the policy, observation-only methods can miss early warning signs present in the action distribution. In summary, current approaches either isolate observations and actions, depend on failure-mode labels, or issue alerts too late for intervention.
To address these limitations, we propose Failure Prediction at Runtime (FIPER), lightweight frame- work for predicting failures of generative robot policies that requires no examples of failures. FIPER is built our insight that actual failures coincide with two indicators: (i) successive deviations of the observations from the patterns expected in successful rollouts and (ii) prolonged high uncertainty in the stochastic actions generated by the policy. We propose measuring (i) by leveraging random network distillation (RND) [9] in the policy's observation embedding space and (ii) based on the entropy in the observation-condiiooned action chunk distributions. We statistically calibrate our observation- and action- based uncertainty scores on a small set of successful rollouts using conformal prediction [3]. At runtime, FIPER raises an alarm when both scores, aggregated over short time windows, exceed their respective thresholds. This design, illustrated in Figure 1, enables FIPER to predict failures accurately and at an early stage with low rate of false alarms. We evaluate FIPER for widespread diffusion- and flow-based IL policies across diverse simulation and real-world environments that exhibit various types of failures. In comparison to state-of-thee -hrtth-art baselines, our proposed scores can better distinguish actual failures from OOD situations, and FIPER achieves the highest accuracy and lowest detection time across all environments. Our findings suggest that FIPER is a promising step towards more interpretable and safer deployment of generative robot policies.
2 Related Work
Generative Policies for IL: IL is an effective method to teach a robot new tasks by training policy directly on expert demonstrations [55, 77, 45], but has historically suffered from compounding errors due to (covariate) distribution shifts [58, 59] as well as limited ability to capture multimodal expert behavior [38, 31]. Recent progress in II [78, 79, 28, 2, 52, 11] can be mainly attributed to the development of powerful generative modeling techniques [34, 64, 65, 40] and the availability of high-quality demonstration data [32, 50, 10). Generative diffusion models [64, 25, 65] in particular

---

excel at capturing the nigh-dimensional, multimodal distributions commonly encountered in human demonstration data [69]. Diffusion Policy [11] first demonstrated the potential of using a diffusion model conditioned on visual observations for receding horizon control in complex manipulation tasks. Further studies have extended this approach to additional input modalities like language or touch [56, 24], improved robustness [71], or incorporated multi-task capabilities [72]. Recently, generative models using flow matching [40] instead of diffusion have demonstrated faster inference and improved trajectory smoothness for IL policies [6. 7, 26, 5J. To improve generalization, recent work has also trained IL policies on large-scale, cross-embodiment data [50], with the option to fine-tune them for particular robot or task [33, 68, 6, 43). Despite the impressive capabilities of generative IL policies, they inherit the fundamental properties of IL, often behaving unpredictably and failing when deployed beyond their training distribution [35].
Uncertainty Quantification and OOD Detection: Detecting OOD samples is key challenge across various subfields of machine learning [76, 60, 63], with numerous methods proposed to address it. Some approaches rely on a priori access to OOD data [23, 16, 42, 70], which is, however, often unavailable or not comprehensive enough [53]. Another line of work directly measures epistemic uncertainty [27], using model calibration [20], ensembling methods [36, 49, 46, 61] or Monte-Carlo dropout (MC) [19, 49, 13], which can then be used to detect OOD cases. Random network distillation (RND) [9], originally proposed to incentivize exploration in reinforcement learning (RL), has been shown to outperform both deep ensembles and MC dropout [12). Prior work has adopted RND to uncertainty quantification [12] and confidence estimation in offiine RL [22]. Other approaches use the reconstruction eπror or latent embeddings of autoencoders [57, 73, 30, 47, 51] or directly measure deviations in the observation or embedding space [67, 62. 51] detect dissimilarity from the training distribution. Our method combines RND in the observation embedding space with novel entropy- score, which is conceptually related to Bayesian methods [19] and to the idea that sampling batch instead of a single action can be used to detect failures [1].
Failure Detection for IL Policies: Reliable handling and detection of policy failures is crucial
to ensure safe deployment of robots, especially in human-cent centered environments [54, 42]. OOD detection alone is insufficient for recognizing failures in IL, the policy might be able generalize in some novel situations. The failure prediction problem is also complicated by the closed-loop operation and multimodal behavior of generative policies, which can generate very different actions for the same observation [1]. Agia et al. [1] propose addressing this challenge by combining a cumulative temporal consistency score that quantifies the divergence between the overlapping components of two consecutive action distributions, with a VLM to detect task progression failures. Using VLMs for monitoring policies and reasoning about failures has also been proposed in other works [17], but these approaches are inherently slow and unable to predict failures early. Liu et al. [42] train failure detector on image embeddings of visual world model and identify OOD states using clustering. Still, their method relies on failure examples similar to other works [18). ReDiffuser [22] uses an RND model trained on trajectories to estimate the reliability of sampled decisions and select the most reliable one. However, ReDiffuser is tailored to state-based policies and cannot account for high-dimensional visual inputs. Lee et al. [37] use the loss of a diffusion policy to predict failures, but their approach is not directly applicable to other generative models, such as flow matching. FAIL-Deteet [75] fits a flow matching model to the distribution of observation embeddings and detects policy failures by quantifying the likelihood of observations under the learned distribution. Existing methods [1, 75, 42, 22] have in common that they aim to detect failures either only from the policy inputs or outputs. In contrast, FIPER takes both into account, allowing us better distinguish actual failures from benign OOD situations that the policy can handle.
3 Problem Setup
We consider a robotic system performing a given task, which we model as a Markov decision pro- cess (MDP) with observation 0₂ E O and action a& A at timestep A = 0, 1..... We assume finite horizon T' for the MDP, but the task can also be completed in fewer than T timesteps. A generative IL policy лt (AAO) is trained to match the
action distribution in demon- stration dataset D. At each policy timestep t = 0, h, .h..... the learned policy generates a chunk (sequence) of H future actions A, (arjt: ... , a++ (1)) I x(-(O, conditioned on observation
history O (o, Cor-T.ti....... o:) of length Th > 1. The first h <. H actions ac: are applied
3

---

to the system before re-planning at timestep t + h. This general policy formulation encompasses common, state-of-the-an IL methods [11, 78] and sisionlanguage-actinn models (VLAs) [6. 33).
Depending on the initial condition Op, the stochastic transitions, and the stochastic actions generated by the policy, the system may succeed or fail to complete the task within T timesteps. Our goal is to detect as accurately and early as possible situations for which the policy, when executed for the remaining timesteps up to T, would design a failure predictor F()) that takes the trajectory Ti (Oo, Ao, On, An..... O2, Ar) up to the current timestep t input and predicts the final rollout outcome F(T.)) E {0, 13. If at any time t, F(Ta) = 1, the rollout is flagged as Fail with detection time t.
succeed in completing the task. For this, we aim to
4 Methodology
We design FIPER to detect two characteristics of policy failures: Consecutive OOD observations and high uncertainty in the conditional action distributions. These failure indications are handled by two submodules, whose outputs are combined in the overall failure predictor F()). We do not rely on failure data and use only few successful ID policy rollouts for training and calibration.
4.1 Detecting OOD Observations via Random Network Distillation (RND-OE)
Generative II. policies have demonstrated some generaliza- tion capabilities [11, 78], but they still often struggle in situations that deviate substantially from their training distribution [39]. To predict policy failures based observations. we therefore aim to detect if O differs from ID situations in a way that is likely to negatively affect the policy's performance. For this purpose.
RND-OE Predictor fo
Policy Encoder
OO,D(OO)
Embed-
Target
Observations O
ding O
ID
OOD
RND-OE recognizes failure-prone out-of- distribution (OOD) situations using random network dis- tillation (RND) in the policy's observation embedding space.
Figure
adopt RND [9], novelty detector first proposed for exploration in reinforcement learning. RND consists of two neural networks with mn-dimensional outputs, a randomly initialized target network (-) and predictor network fa(:) parameterized by 0. The target network is frozen, and the predictor network is trained to match the outputs of the target network on ID data. We apply RND the policy inputs and train the predictor on ID success data DID ~ qx to minimize the loss
[(() A.),,D [S))D(O.)].
where
(O,) (O,) gl22) (1)
Intuitively. the predictor and target networks produce similar outputs for observations they have seen before, but their outputs diverge on novel, unseen data. We reuse and freeze the observation encoder h--) of the policy in both networks, which has two benefits: First, we can detect anomalies directly in the policy's 's embedding space, which are more indicative of failures than OOD raw observations. Second, using the pre-trained feature extractor h(-) allows us to train the RND model even from a small dataset DID. Due to this design, we refer to 5RND (O:) as RND observation embedding (RND-OE) score. To ensure the predictor fo is expressive enough to approximate the target network well on the ID dataset, we design fo to be slightly larger than (see Appendix A.2). After training, can (R,) to measure how much observation embedding O; hOO)). which action generation is effectively conditioned on, deviates from the patterns in successful ID rollouts. This idea is visualized in Figure 2.
Recent II. policies [11, 78] can often handle brief and less severe OOD situations, especially when trained on massive data [39]. However, multiple consecutive OOD observations are likely to cause compounding errors action predictions [4] from which the policy cannot recover. For this reason, we construct our observation-Bee based failure prediction score (T((T.) by aggregating the RND-OE score SAND O.) over a sliding time window of size wo as
min (wo 1,1/h)
no (Tx)))
Σ
SRND (0 (c-kh) (RnD(O,) + SRND(O +....
(2)
S Elo times

---

0
(a) Low uncertainty
(b) High uncertainty
(c) Low uncertainty
(d) Consecutive low uncertainty
Figure 3: (a) to (c) In imitation learning from multimodal demonstrations, uncertainty in generated actions is reflected in entropy rather than variance. (d) Our action-chunk entropy (ACE) score designed to handle observation-depente
action multimodality,, whereas STAC [I] typically associates timesteps at which the policy decides on behavior mode with high uncertainty.
If (T:)) exceeds a threshold yo,r at any policy timestep f, the recent observations indicate imminent task failure, i.e., our observation bassee failure predictor is given by
(O(T:)) = (no (T:,) > rO,+).
We will discuss the calculation and calibration of the threshold To,, Section 4.3.
4.2 Detecting High Action Uncertainty via Action-Chunk Entropy (ACE)
While we can infer current OOD situations from the observations, the future system evolution ultimately determined by the actions that are generated by the policy and applied to the system. To improve model interpretability, which is especially important in decision-making systems [20], we aim to capture uncertainty at an intent level. To this end, we leverage the conditional action distribution π (A]O,) = TAA = Oz) at the current observation O, to predict failures. Data for IL often contains action multimodality, with the number of modes generally being observation-dependen and unknown [29, 69]. Thus, a generative IL policy can generate very different (e.g.. in an L2 sense) actions for the same observation in generated actions tells us little about uncertainty, as illustrated in Figure 3 (a) to (c). However, observe that action multimodality in IL is usually of discrete nature. For example, robot can first pick up object A, B or C, grasp objects from the side or above, and avoid obstacles left or right. Therefore, each generated action should clearly correspond to one of the abservation-dependent modes for successful task completion.
successful rollout. For this reason, merely measuring the variance
In principle, sharpness of the modes of +(A(O,) can be quantified by the en- tropy Eo,, (A) = -A Pa [A,[O, log (d) However, the likelihood Pa (Ar is un- policies म, so we need approximate Eo.(A). For this, we sam-
known for diffusion- or (BB)) of B action chunks A (a.j....... -a+# (-),;)) ple a batch A, = -AA (A!".....,A!"
(5)
j= I,..., B, at each policy timestep t. Since the dimensionality of A, E AA grows exponen- tially with the action chunk length H. directly approximating Fo, (A) would require excessively large batch size B. exceeding the parallelization capabilities of common GPUs. As we aim for failure prediction during runtime, reduce computational complexity by treating the prediction timesteps / through i + H- - 1 separately and define the action-chunk entropy (ACE) score as
H-1
SACE = Σ
((a
(B) E+ilp
1=0
Here, Éi) measures the entropy of an action prediction step t+i based on the actions sampled for that timestep. We adopt a dimension-win binning approach calculate É(-), which we found to be more computationally efficient, robust, and easier to tune than other methods [14, 1] (see Appendix A.1 for details). Similar to the observation based score (2), we aggregate (4) over a sliding window of a policy timesteps and define our action-based failure predictor (.(.) with a threshold YA,t, i.e.,
min (MEA 1,t/h)
T/ (Ta)
Σ
9ACE(A = (ACE(AA) + SACE(AI-N) +
(5)
O=
SwA times
FA(T.)) = ((TA(TI)) > YA.)).
(6)
5

---

4.3 Observation- AND ration-Based Failure Prediction with FIPER
Not all OOD observations lead to failure, and there may be temporary high (aleatoric) uncertainty in the generated actions even in successful rollouts, for example, due to the suboptimality and diversity of demonstrations. To obtain robust predictions specifically about task failure, we flag a rollout as Fail if and only if both failure predictors (3) and (6) raise warning, i.e., FIPER combines their outputs with a logical conjunction as
F(T:)) = FO(T,) A FA(T.) = ((TO(T:)) > No,, A (A(T:)) > YA..).
(7)
To calibrate the two thresholds fo, and 7A,,t in (7), we can leverage conformal prediction (CP) [3] for functional data [15]. For this, we use a calibration dataset D. = { ~ 4- of M i.idd successful 41;)- Since the uncertainty scores (2) and (5) vary considerably during each rollout. often being smallest at thresholds to be varying. We compute you and YA. in a similar way and, therefore, focus on the former here for brevity. As proposed by Diquigiovanni et al. [15], we split D. into two disjoint parts and use them to separately calculate the time-varying mean Jo,, and band-width (5) of the score signals no (T.)).
policy rollouts T' = (O), Ab. Oj, .i....,,
O, design their respective
5 controls the proportion of signals staying in |μO,1 bo, (o,, Mo.1 + bo. (6)] for the entire time (see Appendix A.3 for more details). Since no 2 0 by design, we only require an upper viry-ng threshold %0. = fo,tt + bo, to enforce desired upper bound on the probability of raising false alarms with (3) (similarly for (6)). As (T+) and TA (T+)) are not independent, our combined predictor (7) satisfies the same bound.
h.,,,.... .., i 1,..., M. Thereby,
......,......
Proposition 1. Set E 10, and define the thresholds TOO and V, as described above. Then, the probability that the failure predictor (7) of FIPER flags a new successful ID rollout T ~ 9s of length T < T as Fail any policy timestep & T satisfies the upper bound
P(3t ho,h..... T") s.t. F(T::) = 1) S 8.
(8)
A more rigorous formulation of Proposition and a proof are given in Appendix A.4. We can view d as a design parameter, with a larger value increasing sensitivity to failures at the expense of more false alarms. Proposition quantifies the ability of FIPER recognize successes such, not failures. To derive such result, we would have to assume the availability of failure data, which we explicitly do not do for the reasons above. addition to the threshold definition above, which we refer as one-sided CP band, we also investigate two alternatives: A CP constant threshold y0, To defined as the - 8 quantile of the set of conformity scores { {max, no (T:) (T:)) JM and a simpler time-varying threshold no. defined as the 1 8 quantile of {mo (T:) ) J.M Proposition 1 also applies to the CP constant but not to the time-varying threshold.
Remark I (Rollout data). The training data for RND-OE, PID. and the calibration data D. are sampled from the same distribution 4r but would need to be disjoint for Proposition to hold rigorously. However, setting Did = De worked well in our experiments, so we collect only one rollout dataset.
5 Experiments
We conduct extensive experiments across diverse set of environments, mainly aimed at answering the following research questions: Q1) How well can our proposed scores distinguish failures from mere OOD situations? Q2) Does FIPER benefit from combining observation- and an action-based failure predictor? Q3) Can FIPER predict failures more accurately and earlier than existing methods?
Environments. We consider three popular benchmark environments, SORTING [29]. STACK- ING [29] and PUSITT [11], and two real-world tasks, PRETZEL and PUSIICIAIR [1]. These en- vironments differ in terms of robot embodiment, observation and action space, degree of action multimodality, and task duration, thus representing a diverse set of failure modes. We briefly explain the environments and how we create OOD scenarios to induce policy failures in the following:
SORTING: A Franka robot needs to push two blocks on a table into their color-matching boxes. OOD: We change the dimensions of the blocks and the positions of the target boxes.
STACKING: A Franka robot needs to stack three blocks
target area. The task is multimodal,
as there are six possible block arrangements. OOD: We vary the block sizes and target location.
PUSHT: The agent must push planar T-shaped object into a target configuration. OOD: We use the data from Sentinel [1], which includes variations in the shape and dimensions of the T-object.

---

PRETZEL: A Franka robot needs to fold a rope into a pretzel-like shape. OOD: We vary the rope's iitiill configuration and rotate it around its own axis, which changes the bending behavior. target position. OOD: We use the data from Sentinel [1], which includes variations of the initial chair pose.
PUSHCHAIR: A mobile manipulator needs to push a chair
Implementation. Our IL policies take one or two RGB images and the robot's proprioceptive information as inputs. We consider different generative modeling techniques and policy backbones: For PUSITT PRETZEL, and PUSHCHAIR, we use denoising diffusion [25] with a temporal U-Net [1]] backbone, and for SORTING and STACKING, we use flow matching [40] with transformer backbone from ACT [78]. As image encoder, we use ResNet- 18 [21] due to its demonstrated effectiveness for feature extraction in robotics [11, I. 80, 29]. We compute the ACE score in the Cartesian space of predicted end-effector positions to obtain task-relevant and interpretable uncertainty information in a computationally efficient way. For RND-OE, we use an MLP with 6 (4) layers for the predictor (target) network. Further details on model architectures, hyperparameters, and training are provided in Appendix B.
Baselines. We consider four state-of-the-art baselines for recognizing failures of IL policies. For all methods that involve offline training or clustering, we use the same ID success data DID.
PCA-kmeans [42] computes and clusters the principal components of the observation embeddings in DiD. During runtime, the distance of the same principal components of Of to the nearest cluster center calculated detect OOD observations.
logpZO [75] learns the distribution of observation embeddings via flow matching. For new observation, starting from Of, the ODE is solved backwards via the learned vector field to obtain a latent noise sample Zo, and || Zoo 11 is used as uncertainty score.
STAC [1] calculates the divergence between the temporally overlapping components of the action chunk distributions at two consecutive policy timesteps to detect temporally inconsistent behavior. RND-A closely adapted from He et al. [22] and learns a confidence function using RND that measures the reliability of generated actions for successful task completion.
Metrics. We label successful rollouts as negative and failed ones as positive and define the true- positive-rate (TPR) and true-negative-rate (TNR) in the standard way. To account for imbalances in the numbers of successes and failures, we report the balanced accuracy Ace (TPR- + TNR). The normalized detection time DT = min; {4] F(T:t) rollouts correctly flagged Fail. We mark the DT if the TPR or TNR is below 0.4. In these cases, failures are either rarely detected or almost all rollouts are immediately flagged as Fail. Accuracy and DT are standard metrics in prior work [1, 75]. but they are not ideal for evaluating failure prediction, which should be accurate and fast. Always waiting until the last rollout timestep before making a "prediction" on the outcome likely results in high accuracy, but is not suitable for predicting failures before they occur. Conversely, simply flagging each rollout as Fail in the first timestep would yield a perfect DT. Therefore, we propose timestep-wise accuracy (TWA) as novel evaluation metric for failure prediction methods. TWA differs from accuracy in that a true positive is assigned a value 1 DT instead of 1, rewarding earlier correct failure predictions more strongly.
T3/T E [o, 1] is calculated only for failed
Evaluation Protocol. We use M = 50 successful rollouts for the three simulation environments and M 10 for the two world tasks to train the learning-based failure predictors and calibrate the thresholds. Since there is generally no "best" quantile value for calibration (see Appendix C.4), we average all results over 1 - E (0.9, 0091,.... 0.99). We treat the window size and threshold type (CP band, CP constant or varying as method-specific hyperparameters. Thus, we use the value W A E (I,...,55 50} and threshold type that achieve the highest TWA across all environments, which we argue represents the best tradeoff between prediction accuracy, low DT, and robustness.
6 Results and Discussion
Our proposed scores can distinguish failures from OOD. Although they are often correlated, accurate failure prediction requires differentiating between OOD situations to which the policy can generalize and actual failures. To evaluate the effectiveness of our proposed observation- and action-based uncertainty scores in making this distinction, we divide rollouts into four categories, depending their outcome and whether we have introduced OOD scenarios (see Section 5). We
7

---

Observation- based scores
Action-based scores
1.5
1.25
Score (Or..A)
Threkoll %
1
0.75
0.5
0.25
0
CCAA-kmeass
logpZO
RND-OE (ours)
RND-A
STAC
ACE (ours)
Success ID 4 Success OOD I. Fail ID f Fail OOD 1 Fail Success
Figure 4: Our proposed scores (1) and (4) can distinguish failures from benign outto--disttibuttion (OOD) situations that the policy can generalize to. We group the rollouts into four categories along two axes: Success vs. Fail, and in-distribution (ID) vs. OOD. Robust failure prediction requires distinguishing Success OOD from Fail ID. We report the mean values across all tasks and five seeds, with the bars indicating the 25/75% quantiles.
Table I: FIPER achieves superior failure prediction performance than the baselines. We highlight the best and underline the second-best value in each row. Detection times (DT) in brackets have corresponding TPR or TNR below 0.4, both of which indicate poor discrimination between successes and failures. We report the mean and standard deviation across five seeds.
Task
Metric
PCA-kmeans [42]
logpZ0 [75)
RND-A [22)
STAC [1]
RND-OE (ours)
ACE (ours)
FIPER (ours)
TWA
0.49=0.00
0.54
0.55
0.46
0,52
0.54
0.54=0.00
SORTING
Acc.
0.56
0.67 +0.00
0.62
0.48+0000
0.59 0.59
0.65 0.65
0.66
DT
(0.15*00.00)
0.48 00.01
0.34
t0.46+
(0.17
0.30 0.30 +0000
0.32 70.00
TWA
0.66 0.66 0.00
0.000
0,50
0.59 00
0.62
0.62
0.62
STACKING
Acc.
0.75-0.00
0.69
0,5640001
0.66200000
0,70
0,73
0,73
DT
0.19
0.49
(0.44+0.01)
(0.38+0.00)
0.16
0.27
0,28 10.00
TWA
0 0.00
0.52
0.52
0.58 00
0
0.56 2.56+0.00 $0.00
0.55=00.00
PUSHT
T
0.58
0.55 +0.00
0.50
0.71 +0.00
0.55
0.71 +0.00
0.71 -0.00
DT
(0.11=0.00)
(0.26=0.00g
(0.2040000)
0.524
(0.0220.00)
0.31
0,32
TWA
0.64
0.58 t0.00
0.51 t..0
0.51 0.51
0.55
0.75
0.68 00000
PRETZEL
Acc. 1
0.65=0.00
0.65
0.53+0.00
0.67
0,72=0002
0.82
=0.00
DT
(0.01+0.00)
0.24
+0.52+
0.44+0.00
0.44+0.02
0.13
0.33 0.307
TWA 1
0.50 000
0,78 0,78
0.71 4..00
0.73
0,74
0.69
0.83 0.83=0.02
PUSHCHAIR
Acc. T
0.50
0.92
0.82
0.8g
0.80
0.80
0.96 0.96
DT
(0.00=0.00)
0.26 0.26220.0
0.21 0.21
0.30 00
0.11 0.11
0.23400.00
0.27
TWA
0.57=0.00 000
0.60
0.5640002
0.5740
0,5940.04
0.6240.00
0.65
Average
Acc. 7
0.61=0.00
0.69 0.69
0.62
0.68
0.67=0.05
0.74
0.78 0.78=0.00
DT
(0.09 (0.09+0.00)
0.35
0.34
0.42
0.18=0.08
0.25+0.00
0.30 0.30-0.02
expect the uncertainty scores to increase in the following order: Success ID < Success OOD < Fail ID < Fail OOD. In particular, the gap between Success OOD and Fail ID provides information about a score's ability to distinguish between OOD and failure, which affects the robustness of any failure predictor method using the score. We provide the average scores, divided by the respective CP band threshold, across all tasks in Figure 4. RND-OE and ACE show clear separation between Success OOD and Fail ID. Compared to the other observation- based methods, PCA-kmeans and logpZO, our RND-OE score yields larger differennc between the mean values for Success OOD and Fail ID. The same holds for our ACE score compared to RND-A and STAC. However, the gap between Fail and Success is generally smaller for the action-based scores, indicating that failures are harder to detect from the policy outputs than from the inputs. In the following, we investigate whether the results regarding fingl-ttmmstte, uncertainty scores transfer to failure prediction performance.
FIPER predicts failures more accurately and earlier. We benchmark FIPER against four base- lines and also include our individual observation- and action-based failure predictors (3) and (6). Table I summarizes the results of our evaluation. A more detailed version, including TPR and TNR, is

---

Timestep-wisc Acc. (TWA) f
Accuracy 1
Detection time (DT)
0.6
0.8
0.6
0.7
0.5
0.6
0.5
0.2
0.4
STAC
RND-OE
FIPER
STAC
RND-OE
FIPER
STAC
RND-OE FIPER
15
w cumulative (w -> oQ)
Figure 5: We compare our approach of aggregating uncertainty over a sliding window to accumulating scores over all past timesteps [1]. The latter method detects failure rollouts very late, mostly due to their greater length, whereas our approach threshold definition for all methods, following STAC [1]. normalize DT by the maximum episode length and average the results across five seeds, with the bars indicating the standard deviation.
predict failures earlier. We use the same CP constant
Timestep-wise Ace. (TWA)
Accuracy
TNR
Detection time (DT)
0.6
0.8
0.5
0.6
0.7
0.4
0.4
0.5
0.3
0.2
0.5
0.4
0.4
0.2
0
logn70
FIPER
logpZO
FIPER
logn70
FIPER
logpZOO
FIPER
15
Figure 6: We compare our approach of aggregating uncertainty over a sliding window to making a decision based only the current timestep, proposed for logpZO [75]. Our method is much more robust to isolated OOD timesteps and greatly reduces false alarms (higher TNR) while only slightly increasing DT and improving overall accuracy. This comparison methods. We normalize DT by the maximum episode length and average the results across five seeds, with the bars indicating the standard deviation.
time-varying threshold for all
provided in Appendix C.2. FIPER obtains the highest TWA of 0.65 and accuracy of 0.78, and a lower DT of 0.30 than the basclines. Our two individual failure-predictun predictors, RND-OE and ACE, can achieve faster failure prediction when used alone, albeit with a lower TWA and accuracy. An overall TPR of 0.92 indicates that FIPER can predict different types of failures across diverse environments with high reliability. Compared to STAC, which also considers the distribution of generated actions, ACE predicts failures much more accurately, especially in the SORTING, STACKING, and PRETZEL environments that involve high degree of action multimodality (see Figure 3 (d)). Among the observation based methods, RND-OE achieves by far the lowest DT while performing better than PCA-kmeans and comparable to logpZO in terms of TWA and accuracy. PCA-kmeans largely unable to distinguish OOD from failure, achieving a TNR of only 0.24, which shows that a larger difference between the average scores in Success and Fail rollouts (see Figure. 4) does necessarily correlate with superior failure prediction performance. The baseline comparison demonstrates that FIPER represents the best combination of the desired properties of failure predictor, i.c., high accuracy and early warnings.
Aggregating uncertainty scores over multiple timesteps robustly predicts failures. The two prior works most similar to ours either accumulate scores over all previous timesteps [1] or only use data from the current timestep [75]. We compare both approaches our proposed method of aggregating scores over sliding window. As the use of cumulative scores was proposed along with STAC [1], we use this baseline the first comparison. The results shown Figure demonstrate that score accumulation can increase accuracy, but at the cost of much slower detection. In fact, we observe that cumulative uncertainty scores perform much better on tasks with a large difference duration between successful and failed rollouts. Thus, conclude that this approach recognizes

---

Table 2: Impact of the logical combination of the individual observation- and basiod failure
predictors (3) and (6) of FIPER and the threshold calculation. The logical conjunction yields higher TWA and accuracy, showing that most failures are characterized by OOD observations and high entropy in generated actions. We report the mean and standard deviation across five seeds.
Operator
Threshold
TWA 1
Acc.
DT
TPR 1
TNR 1
band
0.62
0.78
0.47 000
0.72 01
0.84
AND
CP constant
0.61
0,73 03
0.454.0.00 po
0.59
0.8720.00
tine-varying
0.68
0,78
0,30
0,92
0.6540.01
CP
0.54
0.58 03
(0.08 aog.t00.0.
)
0.98 02
0.18+0.05
OR
constant
0.59
0.68+00.00
0.20 +-
0,93
0.43+0.12
time varying
0.51
0.53400.01
(0.0240.01) 01)
1.00
0.054..002
failure rollouts primarily due to their greater length, which naturally leads to a higher cumulative score. In comparison, considering only the most recent timesteps enables us actually predict failures and raise a warning early. This capability is especially important in safety-critice scenarios such as surgical assistance or collaborative assembly, even if results in more false alarms. We also investigate using single-timestep score (i.e., w = 1), as proposed for logpZO by FAIL-Detect [75]. As shown in Figure 6, this leads to a very low TNR, i.e., flagging most successful rollouts as Fail, while only slightly reducing DT. The overall failure prediction performance, as measured by TWA, improves when using a sliding window. Note that Figures and are not intended as a comparison of different failure prediction scores (e.g., STAC vs. RND-OE), as we fix the window size and threshold type. In summary, the results underline that aggregating uncertainty scores over the most recent timesteps is crucial for predicting failures at an early stage and distinguishing them from successes.
Failures manifest in observations and actions. FIPER predicts a failure if and only if both the observation- and action- based scores exceed their thresholds. We ablate the two design decisions of logical combination and threshold type, and report the results in Table 2. The logical conjunction (AND) yields higher TWA and accuracy, primarily due to its much higher TNR compared to OR. Intuitively, waiting for both scores to exceed their threshold increases the robustness to OOD success cases. Yet, we find that this more conservative approach can nonetheless predict 92% of all failures. This supports our claim that policy failure is associated with simultaneous OOD observations and high entropy in generated actions. As variation of FIPER, the use of logical disjunction of our two failure predictors provides a powerful alternative when the primary goal is to achieve very low DT and high TPR. This may be particularly desirable if failures could directly endanger people cause damage to expensive items. Morcover, we observe that the threshold type has a significant impact on performance. The CP band and CP constant thresholds achieve very high TNR in accordance with Proposition 1. The time-varying threshold yields the highest TWA for FIPER, while the inherently more sensitive OR ablation should be used with the more conservative CP constant threshold.
Conclusions and Limitations
The design of FIPER is motivated by the insight that actual task failures of generative diffusion- and flow-based policies are associated with successive OOD observations and high- -igeeraceyyy conditional action distributions. Our experiments across diverse environments and tasks demonstrate that our proposed observation- and action-based uncertainty scores can distinguish OOD from failure situations, and that FIPER can predict failures more accurately and earlier than existing methods. FIPER makes no assumptions about specific failure modes and requires no failure data, enabling its use in diverse numan--cnteree environments where interpretable and safe robot behavior is critical.
While we use only a few successful rollouts for calibration, the need to collect them and train an RND-OE model that is separate from the policy still a limitation of our approach. FIPER requires little runtime computation in our considered environments, but this could change with a very high- dimensional action space (e.g.. for humanoid robots). We consider only single-task based IL policies in this work. Adapting FIPER to recent large-scale VLAs [33, 6, 5]. additional input modalities or reinforcement learning with generative policies represent interesting avenues for future work. Since our approach to failure prediction does not rely on access to the training data of the policy and operates directly in the observation embedding space, we expect it to work well for such potential extensions as well.
10

---

Acknowledgements
Ralf Römer gratefully acknowledges the support of the research group Co'VeY Ve funded by the German Research Foundation under grant GRK 2428. This work has been supported by the Robotics Institute Germany, funded by BMFTR grant 16ME0997K.
References
[1] Christopher Agia, Rohan Sinha, Jingyun Yang, Zi-ang Cao, Rika Antonova, Marco Pavone, and Jeannette Bohg. Unpacking failure modes of generative policies: Runtime monitoring of consistency and progress. In Conference on Robot Learning (CoRL), 2024.
[2] Anurag Ajay, Yilun Du, Abhi Gupta, Joshua Tenenbaum, Tommi Jaakkola, and Pulkit Agrawal. conditional generative modeling all you need for decision- making? In International Confer- ence on Learning Representations (ICLR), 2023.
[3] Anastasios N Angelopoulos, Stephen Bates, et al. Conformal prediction: A gentle introduction. Foundations and Trends@ in Machine Learning, 16(4):494-51, 2023.
[4] Suneel Belkhale, Yuchen Cui, and Dorsa Sadigh. Data quality in imitation learning. Conference on Neural Information Processing Systems (NeurIPS), 36:80375-883399 20233
[5] Johan Bjorek, Fernando Castañeda, Nikita Cherniadev, Xingye Da, Runyu Ding, Linxi Fan, Yu Fang, Dieter Fox, Fengyuan Hu, Spencer Huang, et al. Gr00t nl: An open foundation model for generalist humanoid robots. arXiv preprint 25..::2500.147344 2025.
[6] Kevin Black, Noah Brown, Danny Driess, Adnan Esmail, Michael Equi, Chelsea Finn, Niccolo Fusai, Lachy Groom, Karol Hausman, Brian Ichter, et al. TO: A vision- language-action flow model for general robot control. In Robotis: Science and Systems (RSS), 2025.
[7] Max Braun, Noémie Jaquier, Leonel Rozo, and Tamim Asfour. Riemannian flow matching policy for robot motion learning. In JEEE/RSJ International Conference on Intelligent Robots and Systems (IROS), pages 5144-5151, IEEE, 2024.
[8] Lukas Brunke, Melissa Greeff, Adam W Hall, Zhaocong Yuan, Siqi Zhou, Jacopo Panerati, and Angela P Schoellig. Safe learning in robotics: From learning-based control to safe reinforcement learning. Annual Review of Control, Robotics, and Autonomous Systems, 5(1):41 1 1-444, 2022.
[9] Yuri Burda, Harrison Edwards, Amos Storkey, and Oleg Klimov. Exploration by random network distillation. In International Conference on Learning Representations (ICLR), pages 1-17, 2019.
[10] Federico Ceola, Lorenzo Natale, Niko Sünderhauf, and Krishan Rana. Lhmanip: A dataset for long-horizon language-grounded manipulation tasks cluttered tabletop environments. arXiv preprint arXiv:2312. 12036, 2023.
[11) Cheng Chi, Siyuan Feng, Yilun Du, Zhenjia Xu, Eric Cousineau, Benjamin Burchfiel, and Shuran Song. Diffusion policy: Visuomotor policy learning via action diffusion. In Robotics: Science and Systems (RSS), 2023.
[12) Kamil Ciosek, Vincent Fortuin, Ryota Tomioka, Katja Hofmann, and Richard Turner. Conserva- tive uncertainty estimation by fitting prior networks. In International Conference on Learning Representations (ICLR), 2019.
[13] Yuchen Cui, David Isele, Scott Niekum, and Kikuo Fujimura. Uncertainty-awe data aggre- gation for deep imitation learning. In International Conference on Robotics and Automation (ICRA), pages 761-767. IEEE, 2019.
[14] Sylvain Delattre and Nicolas Fournier. On the kozachenko-Lconenko entropy estimator. Journal of Statistical Planning and Inference, 185:69 99, 2017.
[15] Jacopo Diquigiovanni, Matteo Fontana, Simone Vantini, et al. The importance of being band: Finite-sample exact distribution- free prediction sets for functional data. STATISTICA SINICA, 1:1-41, 2024.
11

---

[16] Andrija Djurisic, Nebojsa Bozanic, Arjun Ashok, and Rosanne Liu. Extremely simple ac- tivation shaping for -fd---i-iitiittionn detection. In International Conference on Learning Representations (ICI.R), 2023.
[17] Jiafei Duan, Wilbert Pumacay, Nishanth Kumar, Yi Ru Wang. Shulin Tian, Wentao Yuan, Ranjay Krishna, Dieter Fox, Ajay Mandlekar, and Yijie Guo. Aha: A vision-language-mode for detecting and reasoning over failures robotic manipulation. In International Conference on Learning Representations (ICLR), 2025.
[18] Alec Farid, David Snyder, Allen Z. Ren, and Anirudha Majumdar. Failure prediction with statistical guarantees for vision-basse based rohot control. In Robotics: Science and Systems (RSS). IEEE, 2022.
[19] Yarin Gal and Zoubin Ghahramani. Dropout as a bayesian approximation: Representing model uncertainty in deep learning. In International Conference on Machine Learning (ICML), pages 1050-1059. PMLR, 2016.
[20] Chuan Guo, Geoff Pleiss, Yu Sun, and Kilian Q Weinberger. On calibration of modern neural networks. In International Conference on Machine Learning (ICML), pages 1321-1330. PMLR, 2017.
[21] Kaiming He, Xiangyu Zhang. Shaoqing Ren, and Jian Sun. Deep residual learning for im- age recognition. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 770-778, 2016.
[22] Nantian He, Shaohui Li, Zhi Li, Yu Liu, and You He. Rediffuser: Reliable decision-making using diffuser with confidence estimation. In International Conference Machine Learning (ICML), 2024.
[23] Dan Hendrycks, Mantas Mazeika, and Thomas Dietterich. Deep anomaly detection with outlier exposure. arXiv preprint 18X2:0/8/2204606,, 2018
[24] Carolina Higuera, Akash Sharma, Chaithanya Krishna Bodduluri, Taosha Fan, Patrick Lancaster, Mrinal Kalakrishnan, Michael Kaess, Byron Boots, Mike Lambeta, Tingfan Wu, et al. Sparsh: Self-supervised touch representations for vision-based tactile sensing. In Conference on Robot Learning (CoRL), 2024.
[25] Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. Confer- ence on Neural Information Processing Systems (NeurIPS), 33:6840-6851, 2020.
[26] Xixi Hu, Qiang Liu, Xingchao Liu, and Bo Liu. Adaflow: Imitation learning with variance- adaptive flow-based policies. Conference on Neural Information Processing Systems (NeurIPS), 37:138836-188858 2024.
[27] Eyke Hüllermeier and Willem Waegeman. Aleatoric and epistemic uncertainty in machine learning: An introduction to concepts and methods. Machine Learning, 110(3):457-506, 2021.
[28] Michael Janner, Yilun Du, Joshua B Tenenbaum, and Sergey Levine. Planning with diffusion for flexible behavior synthesis. In International Conference on Machine Learning (ICML), 2022.
[29] Xiaogang Jia, Denis Blessing, Xinkai Jiang. Moritz Reuss, Atalay Donat, Rudolf Lioutikov, and Gerhard Neumann. Towards diverse behaviors: A benchmark for imitation learning with human demonstrations. In International Conference Learning Representations (ICLR), 2024.
[30] Philipp Joppich, Sebastian Dorn, Oliver De Candido, Jakob Knollmüller, and Wolfgang Utschick. Classification and uncertainty quantification of corrupted data using supervised autoencoders. In Physical Sciences Forum, volume 5, page 12. MDPI, 2022.
[31] Liyiming Ke, Sanjiban Choudhury, Matt Barnes, Wen Sun, Gilwoo Lee, and Siddhartha Srini- vasa. Imitation learning as f-divergence minimization. In Workshop on the Algorithmic Foundations of Robotics (WAFR), pages 313-329, 2021.
12

---

[32] Alexander Khazatsky, Karl Pertsch, Suraj Nair. Ashwin Balakrishna, Sudeep Dasari, Siddharth Karamcheti, Soroush Nasiriany, Mohan Kumar Srirama, Lawrence Yunliang Chen, Kirsty Ellis. et al. Droid: A large-scale in-the-wild robot manipulation dataset. In Robotics: Science and Systems, 2024.
[33] Moo Jin Kim, Karl Pertsch, Siddharth Karamcheti, Ted Xiao, Ashwin Balakrishna, Suraj Nair, Rafael Rafailov, Ethan Foster, Grace Lam, Pannag Sanketi, et al. Open An open-source vision-language-action model. In Conference on Robot Learning (CoRL), 2024.
[34] Diederik P Kingma and Max Welling. Auto-encoding variational bayes. In International Conference on Learning Representations (ICLR), 2014.
[35] Pang Wei Koh, Shiori Sagawa, Henrik Marklund, Sang Michael Xie, Marvin Zhang, Akshay Balsubramani, Weihua Hu, Michihiro Yasumaga, Richard Lanas Phillips, Irena Gao, et al. Wilds: A benchmark of in-the-wild distribution shifts. In International Conference on Machine Learning (ICML), pages 5637-5664. PMLR, 2021.
[36] Balaji Lakshminarayanan, Alexander Pritzel, and Charles Blundell. Simple and scalable predictive uncertainty estimation using deep ensembles. Conference on Neural Information Processing Systems (NeurIPS), 30, 2017.
[37] Sung-Word Lee, Xuhui Kang, and Yen-Ling Kuo. Diff-Dagger: Uncertainty estimation with diffusion policy for robotic manipulation. In IEEE International Conference on Robotics and Automation (ICRA), pages 4845 4852, 2025.
[38] Yunzhu Li, Jiaming Song, and Stefano Ermon. Infogail: Interpretable imitation learning from visual demonstrations. Conference on Neural Information Processing Systems (NeurIPS), 30, 2017.
[39] Fanqi Lin, Yingdong Hu, Pingyue Sheng, Chuan Wen, Jiacheng You, and Yang Gao. Data scaling laws in imitation learning for robotic manipulation. International Conference on Learning Representations (ICLR), 2025.
[40] Yaron Lipman, Ricky TQ Chen, Heli Ben- Ben-Hamu, Maximilian Nickel, and Matthew Le. Flow matching for generative modeling. In International Conference on Learning Representations (ICLR), 2023.
[41] Yaron Lipman, Marton Havasi, Peter Holderrieth, Neta Shaul, Matt Le, Brian Karrer, Ricky TQ Chen, David Lopez-Pazz Heli Ben- Hamu, and Itai Gat. Flow matching guide and code. arXiv preprint 2rXiv:24/2.06666 2024.
[42] Huihan Liu, Yu Zhang, Vaarij Betala, Evan Zhang, James Liu, Crystal Ding, and Yuke Zhu. Multi-task interactive robot fleet learning with visual world models. In Conference on Robot Learning (CoRL), 2024.
[43] Songming L Liu, Lingxuan Wu, Bangguo Li, Hengkai Tan, Huayu Chen, Zhengyi Wang, Ke Xu, Hang Su, and Jun Zhu RDT-lb: diffusion foundation model for bimanual manipulation. In International Conference on Learning Representations (ICLR), 2025.
[44] Zeyi Liu, Arpit Bahety, and Shuran Song. Reflect: Summarizing robot experiences for failure explanation and correction. In Conference on Robot Learning (CoRL), pages 3468-3484 3484,, 2023.
[45] Ajay Mandlekar, Danfei Xu, Josiah Wong, Soroush Nasiriany, Chen Wang, Rohun Kulkarni, Li Fei-Fei, Silvio Savarese, Yuke Zhu, and Roberto Martín-Martin. What matters in learning from offline human demonstrations for robot manipulation. arXiv preprint 1rXhv:2108.03298 2021.
[46] Kunal Menda, Katherine bayesian approach safe imitation learning. In IEEF/RSJ International Conference Intelligent Robots and Systems (IROS), pages 5041-5048. IEEE, 2019.
and Mykel J Kochenderfer. Ensembledagger:
[47] Marion Neumeier, Sebastian Dorn, Michael Botsch, and Wolfgang Utschick. Reliable trajectory prediction and uncertainty quantification with conditioned diffusion models. In Proceedings of the IEEF/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 3461-3470, 2024.
13

---

[48] Alexander Quinn Nichol and Prafulla Dhariwal. Improved denoising diffusion probabilistic models. In International Conference on Machine Learning (ICML). pages 8162-8171, 2021.
[49] Farzad Nozarian, Christian Müller, and Philipp Slusallek. Uncertainty quantification and calibration of imitation learning policy in autonomous driving. In International Workshop the Foundations of Trustworthy Al Integrating Learning, Optimization and Reasoning (TAILOR), pages 146-162. Springer, 2020.
[50] Abby O'Neill, Abdul Rehman, Abhiram Maddukuri, Abhishek Gupta, Abhishek Padalkar, Abraham Lee, Acorn Pooley, Agrim Gupta, Ajay Mandlekar, Ajinkya Jain, et al. Open embodiment: Robotic learning datasets and rt-x models: Open x-embodiment collaboration 0. In International Conference Robolics and Automation (ICRA), pages 6892-6903. IEEE,
2024.
[51] Guansong Pang, Chunhua Shen, Longbing Cao, and Anton Van Den Hengel. Deep learning for anomaly detection: A review. ACM Computing Surveys (CSUR), 54(2):1-38, 2021.
[52] Tim Pearce, Tabish Rashid, Anssi Kanervisto, Dave Bignell, Mingfei Sun, Raluca Georgescu, Sergio Valcarcel Macua, Shan Zheng Tan, Ida Momennejad, Katja Hofmann, et al. Imitating hu- man behaviour with diffusion models. In International Conference on Learning Representations (ICLR), 2023.
[53] Wilbert Pumacay, Ishika Singh, Jiafei Duan, Ranjay Krishna, Jesse Thomason, and Dieter Fox. The COLOSSEUM: A benchmark for evaluating generalization for robotic manipulation. In Robotics: Science and Systems (RSS). 2024.
[54] Quazi Marufur Rahman, Peter Corke, and Feras Dayoub, Run-time monitoring of machine learning for robotic perception: A survey of emerging trends. IEEE Access, 9:20067-20075. 2021.
[55] Rouhollah Rahmatizadeh, Pooya Abolghasemi, Ladislau Bölöni, and Sergey Levine. Vision- based
manipulation for inexpensive robots using end-to-end learning from demon- stration. In International Conference on Robotics and Automation (ICRA), pages
IEEE, 2018
[56] Moritz Reuss and Rudolf Lioutikov. Multimodal diffusion transformer for learning from play. In 2nd Workshop Language and Robot Learning: Language Grounding, 2023.
[57] Charles Richter and Nicholas Roy. Safe visual navigation via deep learning and novelty detection. In Proceedings of Robotics: Science and Systems (RSS), 2017.
[58] Stéphane Ross and Drew Bagnell. Efficient reductions for imitation learning. In International Conference on Artificial Intelligence and Statistics (AISTATS), pages 661-668, 2010.
[59] Stéphane Ross, Geoffrey Gordon, and Drew Bagnell. A reduction of imitation learning and structured prediction to no-regret online learning. In International Conference on Artificial Intelligence and Statistics (AISTATS), pages 627-635,
[60] Lukas Ruff, Jacob R Kauffmann, Robert A Vandermeulen, Grégoire Montavon, Wojeiech Samek, Marius Kloft, Thomas G Dietterich, and Klaus-Robert Müller. A unifying review of deep and shallow anomaly detection. Proceedings of the IEEE, 109(5):75--755, 2021.
[61] Ralf Römer, Armin Lederer, Samuel Tesfazgi, and Sandra Hirche. Vision-based uncertainty- aware motion planning based on probabilistic semantic segmentation. IEEE Robotics and Automation Letters, 8(11)7825--8822 2023.
[62] Rohan Sinha, Amine Elhafsi, Christopher Agia, Matthew Foutter, Edward Schmerling, and Marco Pavone. Real-time anomaly detection and reactive planning with large language models. In Robotics: Science and Systems (RSS), 2024.
[63] Rohan Sinha, Apoorva Sharma, Somrita Banerjee, Thomas Lew, Rachel Luo, Spencer M Richards, Yixiao Sun, Edward Schmerling, and Marco Pavone. system-level view on out-of- distribution data in robotics. arXiv preprint 221.:2221...4222 2022.
14

---

[64] Jascha Sohl-Dicksterd Eric Weiss, Niru Maheswaranathan, and Surya Ganguli. Deep unsuper- vised learning using nonequilibrium thermodynamics. In International Conference on Machine Learning (ICML), pages 2256-2265. pmir, 2015.
[65] Jiaming Song. Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. In International Conference on Learning Representations (ICLR), 2021.
[66] Yang Song, Jascha Sohl-Dickstein, Diederik P Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. Score- based generative modeling through stochastic differential equations. In International Conference on Learning Representations (ICLR), 2021.
[67] Yiyou Sun, Yifei Ming, Xiaojin Zhu, and Yixuan Li. nearest neighbors. In International Conference on Machine Learning (ICML), pages 20827- 20840. PMLR, 2022.
detection with deep
[68] Octo Model Team, Dibya Ghosh, Homer Walke, Karl Pertsch, Kevin Black, Oier Mees, Sudeep Dasari, Joey Hejna, Tobias Kreiman, Charles Xu, et al. Octo: An open-source generalist robot policy. Robotics: Science and Systems (RSS), 2024.
[69] Julen Urain, Ajay Mandlekar, Yilun Du, Mahi Shafiullah, Danfei Xu, Katerina Fragkiadaki, Georgia Chalvatzaki, and Jan Peters. Deep generative models in robotics: A survey learning from multimodal demonstrations. arXiv preprint arXiv:2408. 240.00000 2024.
[70] Apoorv Vyas, Nataraj Jammalamadaka, Xia Zhu, Dipankar Das, Bharat Kaul, and Theodore L Willke. Out-of-distribution detection using an ensemble of self supervised leave-out classifiers. In Proceedings of the European Conference on Computer Vision (ECCV), pages 550-564, 2018.
[71] Dian Wang, Stephen Hart, David Surovik, Tarik Kelestemur, Haojie Huang, Haibo Zhao, Mark Yeatman, Jiuguang Wang, Robin Walters, and Robert Platt. Equivariant diffusion policy. In Conference on Robot Learning (CoRL), 2024.
[72] Yixiao Wang. Yifei Zhang, Mingxiao Huo, Ran Tian, Xiang Zhang, Yichen Xie, Chenfeng Xu, Pengliang Ji, Wei Zhan, Mingyu Ding, et al. Sparse diffusion policy: A sparse, reusable, and flexible policy for robot learning. Conference on Robot Learning (CoRL), 2024.
[73] Josiah Wong, Albert Tung, Andrey Kurenkov, Ajay Mandlekar, Li Fei-Fei, Silvio Savarese, and Roberto Martín-Martin. Error-aware imitation learning from telcoperation data for mobile manipulation. In Conference on Robot Learning (CoRL), pages 1367-1378. PMLR, 2022.
[74] Philipp Wu, Yide Shentu, Qiayuan Liao, Ding Jin, Menglong Guo, Koushil Sreenath, Xingyu Lin, and Pieter Abbeel. Robocopilot: Human-ing in- tn-the-loop interactive imitation learning for robot manipulation. arXiv preprint arXiv:2503.0777,, 2025.
[75] Chen Xu, Tony Khuong Nguyen, Emma Dixon, Christopher Rodriguez, Patrick Miller, Robert Lee. Paarth Shah, Rares Ambrus, Haruki Nishimura, and Masha Itkina. Can we detect failures without failure data? Uncertainty-aware runtime failure detection for imitation learning policies. In Robotics:
Science and Systems (RSS), 2025.
[76] Jingkang Yang, Kaiyang Zhou, Yixuan Li, and Ziwei Liu. Generalized out-of-distribution detection: A survey. International Journal of Computer Vision (IJCV), 132(12)55635-5662, 2024.
[77] Tianhao Zhang, Zoe McCarthy, Owen Jow, Dennis Lee, Xi Chen, Ken Goldberg, and Pieter Abbeel. Deep imitation learning for complex manipulation tasks from virtual reality teleopera- tion. International Conference on Robotics and Automation (ICRA), pages 5628-5635. IEEE, 2018.
[78] Tony Zhao, Vikash Kumar, Sergey Levine, and Chelsea Finn. Learning fine-grained bimanual manipulation with low-cost hardware. In Robotics: Science and Systems (RSS), 2023.
[79] Tony Z. Zhao, Jonathan Tompson, Danny Driess, Pete Florence, Kamyar Ghasemipour, Chelsea Finn, and Ayzaan Wahid. Aloha unleashed: simple recipe for robot dexterity. In Robotics: Science and Systems (RSS), 2024.
15

---

[80] Yifeng Zhu, Abhishek Joshi, Peter Stone, and Yuke Zhu. Viola: Imitation learning for vision- based manipulation with object proposal priors. In Conference on Robot Learning (CoRL). pages 1199-1210. PMLR, 2023.
16

---

Appendix
Table of Contents
A Method Details
18
A.1 Action-Chuud Entropy (ACE)
18
A.2 Random Network Distillation with Observation Embeddings (RND-OE)
19
A.3 Conformal Prediction
Logical Combination
21
B Additional Experimental Details
22
B.1
Environment Details
22
B.2
Discussion on other Tasks
24
B.3
Policy Details
24
B.4 Metrics
................................
25
B.5 Baselines
26
Compute Resources
26
C Extended Results
26
C.I. Uncertainty Scores
26
C.2 Extended Bascline Comparison
27
C,3 Impact of the Window Size for Score Aggregation
28
C44 Impact of the Threshold Computation
29
Discussion of Action-Based Scores
31
C.6 Discussion of Observation- Based Scores
32
D Limitations
32
17

---

A
Method Details
Below, we have summarized the most important mathematical symbols used in this work.
T: Maximum episode length
k 0, , T: Timestep
Og: Robot observation
ag: Robot action
Th: Observation history length
H: Action chunk length
h: Action execution steps
t = 0,4...., T: Policy timestep
O₂: Observation history
A₁ Action chunk
A₁ Batch of action chunks
B: Action-chunk batch size
π OA) Generative IL policy
Txt Trajectory of observation-action pairs up to policy timestep
OO): Trainable RND predictor network
gO,): Frozen RND target network
BaND(O,)) RND observation embedding (RND-OE) score
E-)) Entropy of an action prediction step
SACE SACE(A,) (A,): Action-chunk entropy (ACE) score
Wo: Window size for aggregating SRND (O,)
WA: Window size for aggregating SACE (A.)
(T():): Observation-base. failure prediction score at policy timestep
T (T):: Action-based failure prediction score at policy timestep
70, Threshold for (Tx)
7A.+ Threshold for (T:)
De: Calibration dataset
M: Number of calibration rollouts
Ja: Distribution of ID successful policy rollouts
6: Desired FPR
A.1 Action-Chunk Entropy (ACE)
To estimate uncertainty in generated actions, we sample batch of B action chunks
A, (A
(P)).
A ( = t a 111 a(. Or),
())
(9)
policy timestep and compute the action-chunk entropy (ACE) score
H-1
SACE (ACE(AA)=
Σ (1) -.. ((1)))
(10)
where E(()) measures the entropy of an action prediction step + based on the ac- (
tions -- EACER, j= l...., B, sampled for that timestep. For the following expla- ()) T
nation of the calculation of â(.), we use the notation a a a (4..11......
(f) -]) - ..t.:.....HH..) (.ti.)
18

---

for brevity. Let {Ai....,A. ANdt be the set of action chunks in the calibration dataset De. where Ant (ants.... ant+ H-1) n ..... No. Offline, we calculate the maximum range of actions as
R
max ant+id net Ne) SE H-1
min antti,d Re(1....Na (E(....HH1)
(11)
for each dimension d = I,..., cell size factor. For a new action batch (9), each action dimension d is partitioned into
.....,D D and define the fixed cell size as aRd, where a E (0,1) )) is called
(a B) Utii - mlnneell....... a LHid
(1)
N2
(12)
aRd
bins for each step i = O,..., H - in the prediction horizon. This induces N w"=IIe -I=II=- N bin cells, which we denote by Ct c IR c = ,,, We then build timestep-wise histograms for the B actions sampled for each timestep f i over these cells, yielding the probabilities p T where n j atd E col is the number of actions for timestep t + i that are contained cell C.. Finally, the action entropy for each timestep in (10) is given by
Ni
( (1)
B (11
Σ pe log, P'c
(13)
Our approach of treating timesteps separately leverages the fact that actions sampled for the same timestep tend to lie closer together, significantly reducing the total number of bins. Thus, compared to computing single histogram over all timesteps, we require a much smaller action batch size to obtain a sufficiently accurate estimate of action entropy.
We calculate the ACE score in the Cartesian space using predicted end-effector positions. This is possible for any manipulation task (and even for locomotion or navigation) by using forward kinematics, even if the policy outputs joint angles or velocities. We adopt this approach not only for computational reasons but also obtain interpretable uncertainty scores in the same 3D space where the task is performed. High uncertainty in Cartesian space means that the policy is unsure about the correct path to take (c.g., where to grasp an object). In contrast, entropy in, for example. joint velocities, does not necessarily correspond to task-relevant uncertainty. We also experimented with computing the ACE score using other action representations, such full 6D poses, but did not observe improvements in performance.
A.2 Random Network Distillation with Ohservation Embeddings (RND-OE)
An RND model [9] detects OOD situations by training predictor network fo(-) -) to match the outputs of frozen target network g-) on ID data. Both networks receive the same inputs, and after training, the outputs of the predictor and target networks typically differ more significantly for inputs that deviate from the training distribution than for those that align with it. Our RND-OE model utilizes the observation embeddings from the encoder module of generative policy input and is trained on a calibration dataset that exclusively consists of a few ID successful policy rollouts. Thereby, we employ multi-layer fully connected neural network architecture for both the target and predictor networks of the RND-OL OË model. Both networks take observation embeddings as input and output an m-dimensional feature vector. The target network g comprises four fully connected layers with dimensions dim(( - 1024 - 2048 - 4096 - m. each followed by a LeakyReLU activation function except for the last one. Its weights are randomly initialized and frozen before training. The predictor network fo mirrors the target network's 's first three layers but includes two additional fully connected layers with ReLU activation and decreasing dimensions, i.e., dim(O*) - 1024 2048 + 4096 + 2048 + 1024- m. The RND score is calculated as the pairwise distance between the outputs of the predictor and the target network. We use the same network architecture across all environments, and only the input dimension dim( (O) parameters for the RND-OE models are given in Table 3.
dim(O") varies between the environments. The training
A.3 Conformal Prediction
For clarity, we restate the conformal prediction (CP) problem we consider for failure prediction the following. We assume the availability of a calibration dataset D. [
Jizi qx of M independent
19

---

Table Training parameters of the RND-OE model.
Parameter
Value
Batch size
256
Epochs
250
Learning rate Learning rate scheduler Optimizer
1 10
cosine
Adam
Optimizer weight decay
1 10
Optimizer epsilon
10
Train/validation split
0.9/0.1
and identically distributed (i.i.d) successful policy rollouts and define I = -1,.... M.) successful rollout T = (O,, Ao. O₁, Ap.... OT', AT ~ from the same distribution, we aim for upper bound on the probability that this rollout incorrectly flagged Fail, i.c.
J. For new
P(3t E ,
T"} s.t. nTT:)) > m) S 6,
(14)
where (TTTt)) and "t are the score function and corresponding threshold of the failure predic- tor F(+x) I (TT(T:) > (t)) (see Sections 4.1 and 4.2). To achieve this, the threshold 7t needs to be defined using a suitable nonconformity measure. A simple (but conservative) approach is to consider the maximum failure prediction score over an entire calibration rollout
M(-') max (TT())
İEI.
(15)
Theorem (Adapted from [3], Theorem D.1). Let 7
..... T and T be i.i.d.. Then, defining
[i I :]((')))))))))) < 31
[[M + 1)(1 5)1
inf
3:
(16)
M
M
as the empirical [M++1008)] quantile of (((TT)::EE)) ensures that M
P(ñ(T) 21
(17)
Proposition 2 (Bounded FPR with CP constant threshold). Suppose the calibration roll-
outs T ...., T T'. and the test rollout T are i.i.d., and let be defined according to (16), Then, setting 7/2 7 ensures that (14) holds.
Proof. The definition of the nonconformity score (15) implies that
((() max (0O,, Ag.... A₁) 2 Ao.......... Ap.... O., A.) n((T)), W ho.h........ ...,....T7 T'}.
(18)
Therefore,
P(St {0, (o......, T') s.t. n(TTe) > m)) < P (0,h...., s.t. i((T) 7)
(19)
P(ñ(T) >7)
(20)
P(π(T) S7)
(21)
S 6,
(22)
where we have used = 7 in (20) and Theorem I in (22).
We can obtain tighter of thresholds by defining CP band, as described by Diquigiovanni et al. [15]. For clarity, we define (t) m)(T)) and v/t) = (TTx). We split the set I into two disjoint parts, I₁ and Iz, of sizes M, and M2 M Mr. respectively. The first set used to calculate the sample functional mean as
M
p(t)= = Mi
t= 0.1, 1.......,T
(23)
1
20

---

The maximum deviation from the mean for a calibration rollout i E I2, scaled by modulation function s(t) such as, for example, s(t) 1/T. given by
(t) p(t)
R = max
(24)
s(1)
Theorem 2 (Adapted from [15], Appendix A.3). Let L' ..... TM and t be iid. and let p(() be the
sample functional mean defined according to (23). Then, defining k2 as the empirical 1 8 quantile of {Rī : E I2} guarantees that
P(n(t) E [w((t) k2 (t), k ((),,,, vt) 8.
(25)
For more information on the construction of alternative modulation functions s(l), refer Diquigio- vanni et al. [15].
Proposition (Bounded FPR with one-sided CP band). Suppose the calibration roll- outs T T'...., TM and the test rollout T are ii.d., and let j(t) and k- be defined according to (23)
and Theorem 2, respectively. Then, setting 7t- = p(t) + ks s(t) ensures that (14) holds.
Proof. Theorem 2 implies that
1 - 8 Σ P(n(t) e [u(t) - k2s s(t) +ss(t)), Vt)
(26)
I P(n((() E p(() + s()), VI)
(27)
=P(((() S p(() + (()((), Vt)
(28)
Moreover, rewrite the probability term in (14)
P(36 E (0,h, , s.t. (T))) > 74) - P(I(T=)) S n: VI)
(29)
Substituting (TT:))) = rt( and y = ((t) + k st)) and plugging (28) into (29) directly yields (14), which concludes the proof.
Remark 2.
In addition to the oie-sided CP band described above, we have also tested a simpler time-varying threshold 7/- = c(t) + x(1 - (t) where X(-) is the inverse cumulative distribution function of the univariate Gaussian, and (4) is the standard deviation of (1x(1): ; E I2} with respect to (((). This threshold definition treats the rollout timesteps independently and avoids taking the maximum over 1, in (15) and (24), resulting in a more sensitive failure predictor that is more likely to raise warnings, albeit at the cost of an increase in false alarms. performance comparison of all three threshold definitions is provided in Figure 12.
A.4 Logical Combination
FIPER combines the outputs of the observation-base failure predictor (3) and the action-based failure predictor (6) with a logical conjunction (AND). Consequently, a rollout is only flagged as Fail if both predictors exceed their respective thresholds, ensuring high robustness against benign OOD situations that the policy can handle. If both thresholds Yo., and VA, are separately calibrated according to Proposition 2 or Proposition 3, FIPER satisfies the same upper bound on the FPR as the individual failure predictors.
Proposition (Proposition I extended). Set 8 E (0, 1), and define the thresholds " and 7A for the failure prediction scores no(T.)) and (A(T:)) using conformal prediction according to Propositions 2 or 3. Then, the probability that the failure predictor (7) of FIPER incorrectly flags a new successful ID rollout Ix of length 1 < T as Fail at any policy timestep s T" satisfies the upper bound
P(3t E ( (O,h,..., .T)...T.. s.t. F(T.)) 1) 5.
(30)
Proof. For each timestep /. E {0,
we have
P(F(T.)) = ((Fo(T.) = 11 Fa(Ta) =1)
(31)
= ([1FA(Ta)1))(((A4)) {P(FA(Ta)= = 1).
= FA(T)) =)
(32)
(33)
The result directly follows from the fact that P(3I E ( definition of YA,
s.t. FA(T.)) = 1) < by
L
21

---

As natural alternative to the logical conjunction, we have also investigated logical disjunction (OR) of the two outputs. This variant can predict all failures, but it often triggers false alarms, as shown in Table 2. Since FIPER also achieves a high TPR of 0.92 with the logical AND, combined with a much lower rate of false alarms and higher TWA, we argue that the logical conjunction of the observation- and aation-basede failure predictor is the better choice for accurate and robust failure prediction. As an alternative to combining the detector outputs, we have also investigated a weighted combination of the normalized scores (1) and (4). However, this approach would add an additional (task-dependent) hyperparameter and did not show superior performance in our experiments.
B
Additional Experimental Details
B.1
Environment Details
Table 4: Details about our environments and datasets.
Environment
SORTING
STACKING
PUSHT
PRETZEL
PUSHCHAIR
Type
sim
sim
sim
real-world
real-world
dim(o)
[2, 96, 96]
[2, 3, 96, 96]
[3. 512, 512]
[3, 240, 320]
270, 480]
dim(O'
128
128
512
dim((a)
2
8
3
dim(s)
3
8
2
5
13
# Calibration rollouts
50
50
50
10
10
# Test rollouts
400
800
300
20
# Test rollouts (ID)
100
200
150
# Test rollouts (OOD)
300
600
150
20
20
Success rate (ID)
0.89
0.60
0.40
Success rate (OOD)
0.57
0.36
0.29
0.5
0.67
Avg. episode length
47
79
Max. episode length
75
120
38
70
22
This section provides an overview of the environments we use to evaluate our failure prediction framework. We summarize the details about the environments and datasets in Table 4. For PUSIIT and PUSHCHAIR, we use the publicly available rollout datasets from Agia et al. []], which are released under MIT License.
B.1.1 Simulation Environments
The three simulation tasks, SORTING, STACKING, and PUSHT, are visualized in Figure 7.
SORTING: In this task, Franka robot must push two blocks into their corresponding color- matching target boxes on a tabletop. The visual observations are obtained from a wrist camera and a third-person camera. To induce more policy failures in our test data, vary the dimensions of the blocks and the positions of the target boxes. rollout is considered successful if the policy manages to place both blocks in their respective boxes within the maximum episode length. If one of the blocks falls from the table but does not land inside its corresponding box, it is impossible for the policy correct this mistake; therefore, end the rollout prematurely.
STACKING: Franka robot trained to stack three colored blocks a target area, using joint velocities and gripper commands as actions. Similar to SORTING, two RGB images are used as visual inputs. The overall complexity of this task leads to a very low success rate of the complete task (referred to as STACKING-3 in D3IL [29]), especially when introducing OOD scenarios. Therefore, we only consider the simpler STACKING- task for testing, which is successfully completed if one of the three blocks has been placed into the target area (see Figure 7). This allows us to include OOD situations by varying the dimensions of the blocks and the location of the target area, while still achieving sufficiently high success rate to evaluate failure prediction. This task exhibits strong action multimodality, and failures often occur when the robot is unable to grasp a block.
PUSHT: A planar T-shaped object needs to be pushed into target configuration. We use the rollout data from Agia et al. [1], which includes variations of the scale and dimensions of the T-object. rollout is considered successful if the policy manages to push the "T" into the goal area with at least
22

---

Sorting
Stacking
Success
Start
End
Start
End
Start
End
Failure Warring
Start
Start
Start
Figure 7: Overview of the simulation tasks with exemplary successful and failed rollouts.
Pretzel
PushChair
Success
Start
End
Failure Warning
Start
Figure Overview the real-world tasks with exemplary successful and failed rollouts.
90% overlap. Since the policy has learned to approach the "T" from different directions, this task exhibits strong action multimodality. Failures for this task can occur when the policy is unable to properly move the "T" due its changed size, or if it gets stuck in a suboptimal pose, where the "T" somewhat overlaps with the target area but in an incorrect orientation (see failure case in Figure 7).
B.1.2 Real-Word Weal-World Tasks
Figure depicts the two real-world tasks considered in this work, namely Pretzel and PUSHCHAIR.
PRETZEL: In this task, a Franka robot needs form rope into the shape of pretzel. A successfully formed pretzel comprises three intersections of the rope that divide the area into three distinct parts when looking from above, as shown in the successful rollout Figure We count rollout as successful if the robot manages to form correct pretzel within 70 policy inference timesteps, otherwise, is considered failure. The maximum episode length thereby determined by the longest successful rollout in our test set. To invoke more policy failures in our test data, vary the rope's initial position and apply rotations about its axis. Because the rope's material anisotropic, axial rotations can change its bending behavior. In that case, once the robot places the rope onto the table, the rope does not remain in this configuration but moves back toward its original pose (see failure warning in Figure 8). Unlike variations of the initial conditions, this OOD behavior can not be detected from the initial observation images, but only becomes apparent after multiple timesteps when one end of the rope has been placed. In our experiments, vertical and horizontal position perturbations lead to and 2 failures, respectively, and axial rotations induce an additional failures.
A single-arm mobile manipulator needs to push chair to target position underneath table. We use the data from Agia et al. [1], which includes variations of the initial chair pose. Failures occur when the chair rotates substantially about the vertical axis, which can happen, for example, if the robot does not push against the center of the backrest (see Figure 8).
PUSHCHAII:
23

---

Table Implementation details for our generative IL policies based on flow matching (FM) [40] and denoising diffusion probabilistic models (DDPM) [25]. The policy hyperparameters for PushT and
PushChair are taken from Agia al. [1].
Task
Sorting
Stacking
PushTT
Pretzel
PushChair
Generative modeling technique Backbone
FM
DDPM
DDPM
DDPM
ACT [78]
ACT [78]
U-Net [11]
U-Net [11]
U-Net [11]
Observation history length Th
5
I
1
Action chunk length H
8
16
16
16
Action execution steps
Action batch size B Integration steps
32
32
256
30
256
16
16
100
100
100
Training epochs Training batch size
20
20
2000
100
2000
256
256
256
64
256
Optimizer
Adam W
Adam W
Adam
AdamW x 10
Adam W
Learning rate
5 x 10
5 x 10
3 x 10-5
3 10
B.2
Discussion other Tasks
While we focus on manipulation in our experiments, we believe that FIPER is also directly applicable to other tasks, such as navigation and locomotion, provided that two conditions are met:
There is clear definition of "task failure". This might not be as obvious for some locomotion tasks, such tracking desired reference base velocity, which do not have the same episodic character as typical manipulation and navigation tasks. Intuitively, task failure is well-defined if there is maximum episode length and clear objective that should be achieved within that time frame. For locomotion, this objective could be defined, for example, as staying within certain tolerance around the reference speed.
The actions can be represented in or transformed to Cartesian space. This is not strict requirement, but we think it is highly beneficial for the reasons mentioned Appendix A. It applies to navigation, where the entropy can be computed for the base positions predicted from the action chunks. For locomotion, one possible approach would to compute the action entropy for the positions of each foot individually and then combine these scores by averaging or taking the maximum.
B.3
Policy Details
Given a demonstration dataset D = {(A,, Oo), (11, of observation-action chunk pairs sampled from an unknown expert policy (A)O), we aim learn an IL policy π (AlO) that approxi- mates the conditional action expert distribution much as possible, i.e., n (A(O) q( OA))). We consider II. policies based on the two most popular generative modeling techniques, diffusion and flow matching, and denote their learnable parameters by sb. Details on the implementation of our policies are provided in Table 5. For SORTING and STACKING, we combine flow matching with transformer backbone. For PUSHT,, PRETZEL, and PUSICIAII,, we combine diffusion with CNN backbone. We have made this choice independently of the tasks' characteristics to evaluate our method's performance for different policy formulations and architectures.
B.3.1 Diffusion Policy
Denoising diffusion probabilistic models (DDPM) [25] introduce latent variables A AQ...., AR where A = A, and construct forward diffusion Markov process
(A (A"IA"1,,0,1 0,r) = ( 1,I1)
(34)
where r 1, l..... R is the diffusion time step, and $1.R is pre-defined noise schedule, such as the cosine noise schedule [48]. The noise schedule is chosen such that (A") z I). The objective is to reverse the forward process by a learnable denoising (backward) process
[A", A", Orr) A,, = N (up (A" 0,
(35)
24

---

where o² = 3r I-a. with a, = IT - 3.). This can be achieved by learning to predict the Gaussian noise added A via the surrogate training loss
-
LDP( R1) O)-,D, - (va, v1- 0,)) (36)
After training, a new action sequence conditioned on an observation O, can be gener- ated by first sampling A NN I) and then iterating over the learned denoising pro- cess (35) with pe (A", O,,r)) -ें A in A (-)),)).
Br vi-a, co (A', for R...., 1, resulting
B.3.2 Flow Matching Policy
Denoising diffusion can be viewed as solving stochastic differential equation (SDE) [66]. In contrast, flow matching [40] aims learn the straight velocity field of an ordinary differential equation (ODE) that transports samples from a simple base distribution-typican unknown target distribution. To be more consistent with Appendix B. slightly deviate from the notation commonly used in the flow matching literature and denote samples from the source and target distribution by A q1 = (0, I) and A go (A((), respectively, instead of the other way around. A flow d d. (A) u, (Φ. (A)) determined by velocity field u, induces probability path ys from gi to go A Φ, (A') ~ qs. Instead of directly approximating the unknown velocity field ug flow matching is trained by conditioning on target sample A 90 via the conditional flow matching loss
standard Gaussian to the
( = E.- (0. [0. ()t.))))))))-----.....)))) O)-D, A²) u1 (A', ... Us [12]
(37)
There are different ways to define the conditional velocity field u. (A'IA") [41]. We sim-
ple linear interpolation A = (1 - A) + sA with us (A" A A A which allows simplifying the loss to
(bb = E. (0. O)~D.A'~N(0.)) 1 (4 0,8) (A A²) |
(38)
After training, we can generate new action chunk A q0110) by sampling A ~ N I) and numerically integrating the ODE with the learned velocity field, for example, through a simple Euler integration
A 2-66 A +dUU (A
(39)
with [1/58] steps.
B.4 Metrics
We denote the number of failed rollouts (positives) by #P and the number of successful rollouts (negatives) by #N. The number of true positives, i.c., failed rollouts correctly flagged as Fail by the failure predictor, is denoted by #TP. Similarly, #FP, #TN, and #FN are the numbers of false positives, true negatives, and false negatives, respectively. It holds that #TP + #FN = #P and #FP + #TN- #N. The accuracy and balanced accuracy are given by
ACCURACY = #TP + #TN
#P #N
TTP #P
#TN #N
BALANCED ACCURACY =
We introduce novel metric to measure the two desired capabilities failure predictor, raising failure warning correctly and early, with single scalar. Denoting the detection times of true positives by t, i l,..., # #TP, we define the (balanced) wwsestee-wiss--cccuee
(TWA) as
E, (1-1-177) 4/7) + #TN
TWA-
(40)
#P + #N
1
Σ,( - L/T)
#TN
BALANCED TWA-
(41)
2
#P
#N
25

---

Our idea behind this metric (and the reason for its name) is as follows: When considering failed episode of length T' which correctly flagged as Fail at time t, the failure predictor is correct about the final rollout outcome only at timesteps /, ........ T. Thus, the proportion of timesteps for which the prediction correct is given by T
T-t
T
To avoid bias from imbalanced datasets with an unequal number of failed and successful rollouts, we report the balanced accuracy and balanced TWA throughout this work, omitting "balanced" for brevity.
B.5 Baselines
PCA-kmeans: Liu et al. [42] train a failure detector on image embeddings visual world model, assuming the availability of failure trajectories. Using Principal Component Analysis (PCA) to reduce the embedding dimension and k-means clustering to calculate 64 centroids, failure situations are detected based the distance to the closest centroid. For our experiments, we reimplement the method for the policy embedding space and compute the clusters from successful rollouts.
logpZO: Xu al. [75] propose failure detection approach based learning the distribution of observation embeddings via flow matching. For a new observation O,, the ODE is solved warkw starting from Of via the learned velocity field, yielding latent noise sample Zo, The dissimilarity score is determined from the likelihood of Zo, under the Gaussian source distribution and given by [o 112. We reimplement this approach as baseline, adopting a U-Net architecture proposed by the authors.
STAC: Agia al. [1] propose measuring the cumulative statistical temporal action consistency (STAC) to detect policy failures. STAC calculates the divergence between the temporally overlapping components of the action distributions at two consecutive policy timesteps using the maximum mean discrepancy (MMD) with radial basis function (RBF) kernel. We directly adopt STAC as baseline, using some of the code released by the authors under an MIT License. Through our experiments, we observe that STAC struggles with observation-dependeer most of our tasks exhibit. The reason for this is that the temporally overlapping parts of the action sequence batches directly before and after committing behavior mode are often very different because their generation conditioned on different observations, as visualized Figure d).
action multimodality, characteristic that
RND-A:
He et [22] use RND trained on trajectories learn confidence score that measures the reliability of generated actions for successful task completion. We adapt this approach to action chunks, adopting some of the code released by the authors under an MIT License, and calibrate the resulting uncertainty scores to predict policy failures.
Several recent works have proposed using VLMs to externally monitor robot and reason about erroneous behavior [1, 17]. However, because these methods lack information about the policy's 's input and output distribution, they are inherently unsuitable for predicting failures early before they occur, which is one of the main objectives of this work. For this reason, we do not use VLM-based approaches as baselines.
B.6 Compute Resources
We conduct all experiments on workstation with 64 GB of RAM, an NVIDIA GeForce RTX 4090 GPU, and an Intel Core 19-285 K CPU. Evaluating FIPER and the baselines for all tasks, window sizes, and quantile values takes about one hour per seed. We note that computing the ACE score and running generative (vision-based) policies could be challenging on some mobile platforms with limited computational resources.
C Extended Results
C.1 Uncertainty Scores
As a supplement to Figure 4, we show the distribution of uncertainty scores for the four rollout categories Success ID, Success OOD, Fail ID, and Fail OOD, in Figure 9, Here, we consider only
26

---

PCAkkmanns
1ogp20
2.5
2.5
Score s10, 421 1.00.4///Teee TTrrcho
Score stO, 500,4) TTrchod
2.0-
2.0-
Meaat: Boss
2000
Moon: 1,000
0.3
Madh:
Wcah: 0,598
0.5
Nelm: 9.110
Success
Success
RND-A
2.5
Score siO, Thresea
Stonesio, Ad Thrcchals
22.0
1.5
1-41
1.0
Moani 0.776
Mean: 9.7
Meat: 1,00
1.0
Nomn: 3/916
Meah.00894
Mewti 1000
Success
Success 0O0
Fall
Success GOD
GOD
Rellout Type
Rallout Type
2.5
Scate st2 Aol miechhldd
Score sC, Ag) TTrrcshld
2.0
2.0
1.5
3.5-
Menn: 2.800
Mean:
Moan:
Mean: 6 531
0.0 Success
Success GOD
Pail
Pall DOD
0.0
Success
Success GOD
Tail BD
Fall DOD
Eype
Type
Figure 9: Distribution of the uncertainty scores s sOO,, At), normalized by the corresponding CP band threshold "r for different types of rollouts. We divide all values by the mean for Fail OOD for better comparability. The top and bottom horizontal lines correspond to the 90% and 10% quantiles, respectively.
the three simulation tasks, as there is no distinction between ID and OOD rollouts for the real-world tasks (see Table RND-OE shows clearer distinction between successful OOD rollouts and failed ID rollouts than the other observation-bant high RND-OE scores occur much more frequently in failure rollouts than in successful rollouts, regardless of ID or OOD. The data for the ACE score has outliers because the time-varying threshold sometimes takes very small values, which makes it difficult to visually interpret the distribution. Nonetheless, high values occur much more frequently for Fail ID than Success OOD rollouts, and our action-based failure predictor alone achieves the second-highest accuracy, which underlines strengths of ACE to distinguish failed from successful rollouts. Moreover, our proposed approach of aggregating uncertainty scores over a sliding window increases the robustness against such outliers in the calibration rollouts.
scores, PCA-kmeans and logpZO, mainly because
C.2 Extended Baseline Comparison
Table 6 is an extended version of Table 1, additionally including the TPR and TNR. To avoid selecting window size w that is more beneficial for some methods but less so for others, use the value of w that yields the highest TWA across all tasks. This "best" window size is also reported in Table 6. The results show that no baseline achieves TPR and TNR greater than 0.4 for all environments, while the lowest value with FIPER is TNR of 0.44 for the PUSHT environment. This highlights that FIPER can predict failures and recognize OOD situations that lead success more robustly than existing approaches. Compared to our two primary baselines, STAC and logpZO, which are both designed specifically for failure detection. FIPER achieves a notably higher overall TPR, while same time not suffering from low TNR like PCA-kmeans. Importantly, FIPER's 'ss strong performance evident across a diverse set of environments, rather than being limited particular type of robot embodiment or task.
27

---

Table We compare FIPER and its individual failure predictors (3) and (6) to four sfate-of-the- baselines for OOD and failure detection. We highlight the best and underline the second- best value in each row. Detection times (DT) in brackets have corresponding TPR or TNR below 0.4, both of which indicate poor discrimination between successes and failures. We report the mean and standard deviation across five seeds. This table is an extension of Table
Metric
[42]
logpZ0 [75]
RND-A (22)
STAC
RND-OE
ACE
FIPER
Best w Bost threshold
40
15
45
25/50
timo-var.
constant
constant
constant
CP constant
time-var
TWA 1
0.492:0.00
0.54
0.55
0.46#00.00
0.52
0.54 00
0.54=0.000 0.00
Acc.
0.56++0.00
0.67
0.62#0.01
0.4g
0.59
0.65 0.00000
0.66 16600000
SORTING
(0.15:40.00)
0.48400.0
0,3420.03
(0.46-0-000)
(0.17490.33)
0.30
0.32=0.00
TPR
0.9340.000 oo
0.5740.00
0,4320.08
0.09
0.92
0,76
0,75400.00
TNR
f
0.20
0.77
0.810.088
0,86
0.26+0000
0.54+00.00
0,57#0.00
00.00
0.58
0.50
4.5900000
0.62 +0.04
0.62+00.0
0.62=00.0
Acc.
0.75
0.69
0.56
0.66 70.00
0.70
0.73 773000.00
0,73 +0.00
STACKING
DT
0.19::0.00
0.49:00.00
[0.44
(0.38:20.00)
0.16 0.16
0.274:0000
0,28-0000
TPR
1.00:0.00
0.48
0,27
0,3540.00
0.98 0g.20.02
0.84000.00
0.84
TNR f
0.51 to.00
0.90
0.85+0.02
0.96 0.960
0.42 0.42
0.61 16.00..0o
0.62 0.000
TWA
0.53$0.00
0.52
0.52#0.01
0.58+0.00
0.54
0.56+0000
0.55
Acc.
0.58 0.58
0.55
0.55
0.71 +0.00
0.55 +0.01
0.71
0,71 00000
PUSHT
DT
(0.11
o0)
(0.264.0.00 0.0)
(0.20=0.02)
0,52
(0.02 o0)
0.31 2.000.00 0.00
0.32
TPR
1.0
0.17
0.31=0.03
0.49#t0.00
0.80 04
0.99
0.98#00.0
TNR f
0.17+0.00
0.9300.00
0.80=0.02
00000
+0.00
0.43
0.44
TWA f
0.64
0.58+0.0s
0,51+0.05
0,51 +0.00
0.55
0.75+0.00
0.68
0.68
Acc. T
0.65 0.65 to.00
0.68
0.53
0.67
0.72
0.82:00.00
0.85
0.8500000
PRETZEL
DT 4
(0.01 t0.00
0.24.0.04
00.52220356
0.44
0.44
0.13
0.33
TPR
1.004..00
0.5449.05
0,1320.12
0.09 40.00
0.774.0.12
1.00
1.00
INR
0.3 0.00
t9.0s
0.92
0.64
0.67
0..000..o
0.70
TWA T
0.30
0.78
0.71=0.05
0.73 0.73
0.74 0.74
0.69
0.83 0.83=0.02
Acc.
2..00
0.92400022
0.8229.05
0.8g
0.80
0.80 0.0
0.96 0.96
PUSHCHAIR
4
(0.00 00)
0.26 es
0.2140.02
0,30
0.11 4:0
0.23 co
0,27#00.00
TPR
10040.00
1.000.00
1,00=0.00
1.00=0.00
0.98 400
1.0
1.00=0000
TNR f
0.00 00.00
0.83 0.83+0.03
0.64
0.75 +0.00
0.61
0.600
0,93 0,93
TWA f
0.00
0.60
0.002
0.57 +0.00
0.59
0.63+00.00
0.65 0.60-0001
0.61 t0000
0.69:00.01
0.62
0.68 20.00000
0.67
0.7400.00
0.78 0.78
Average
DT
00009:0.00)
0.35
0,3420.0a
0.42400000
0.18
0.2540.00
0,30
TPR
0.9940.00 oo
0.55
0.43
0,52
0.89
0.9240.00
0.92
TNR 1
0.24 to.00
0.84 b0.02
0.80
0.83 0.8320000
0.45
0.56
0.65 0.68
C.3 Impact of the Window Size for Score Aggregation
Complementary to our discussion in Section 6, we provide more detailed results about our proposed approach of aggregating uncertainty scores over a sliding window of length w. Figure shows the im- pact of w for different threshold definitions, averaged across quantiles 1 - å E {0.9, 0.91.... 0.99}. For FIPER, we set wo wA w in this analysis for simplicity. Using w 1, i.e., considering only the current observation and/or action [75], leads to low failure prediction accuracy. Increasing the window size improves accuracy, but mostly at the expense of slower detection. In general, we observe that the optimal window size with respect to TWA varies significantly across different failure prediction methods and threshold types. This supports our approach of reporting the main results in Tables and 6 for the window size that achieves the highest TWA across all tasks for the respective method.
It mainly depends on the task whether decrease in DT justifies a drop in accuracy. In domains where rapid response to imminent failures crucial, such as autonomous surgical assistance or collaborative assembly lines, earlier failure warnings may be highly desirable, even if they mean more false alarms. Conversely, in a logistics scenario, misplacement of objects is often not dangerous, whereas every incorrect failure warning would have to be checked manually by a human and would thus be costly. In this case, a more conservative aggregation over a longer window may better balance operational efficiency and failure prevention.
28

---

Threshold:
Threshold: band
Threshold:
Threshold: band
0.70
1.0
0.80
0.65
0.8
0.75
0.60
Accurryy
0.70
Dct. Time
TWA
0.65
0.60
0.50
0.55
0.50
0.1
0.40
12545 7
12345
20300 50
345
20.30
12345
50
Window
Window
Window
Window
Threshold: CP constant
Threshald: constant
Threshold: CP constant
Threshold: constant
0.70
0.85
0.7
1.0
0.80
0.6-
0.75
0.5
0.60
0.70
0.6-
TWA
0.55
0.50
0.60
0.45
0.2
0.50
0.40
50
12345
20
Window size W
Window
Window size W
Window
Threshold: timewarying
Threshold: time-arriin
Threshold: time-varying
Threshold: time-warying
0.70
0.85
0.7
1.0
0.8
0.75
0.5
TWW4
0.60
Arcurey
Time
0.4
0.6-
0.55
0.65
0.3
0.60
0.55
0.2-
0.45
0.2
0.50
12345 7 9 11 20:30 50
0.45
12345
11 20:30 50
12345 7
11 20:30
12345
11 2030
50
Window size W
Window size W
Window size W
Window size
AND-OE
+ FIPER
Figure 10: Impact of the sliding window size w for three threshold types. The results are averaged across five seeds, with the bars indicating the standard deviation.
C.4 Impact of the Threshold Computation
The performance of failure predictor is affected by the definition of its threshold, in particular, by (i) the type of threshold and (ii) the design parameter 5 for calibration, which controls the desired FPR. We have conducted multiple ablation studies to analyze the impact of these factors.
C.4.1 Quantiles
We average our results over of quantiles 1 5 E (0.9, ... 0.99), arguing that there is no "best" quantile value for calibration, and because we want to avoid cherry-picking a specific quantile that is more favorable the performance of one method than others. In Figure 11, we show the impact of different quantile values 1 - 8 on TWA, DT. TPR, and TNR, using an exemplary window size of w 15 for all methods. We observe that 1 directly affects both TPR and TNR. This is expected, as the quantile value effectively controls the threshold at which rollout is flagged as Fail. Consequently, increasing 1 leads fewer predicted failures, which decreases TPR and increases TNR. These two effects largely cancel out in terms of overall accuracy and TWA, leading us to the above claim that there is no "best" quantile.
False Positive Rate (FPR) As discussed in Appendix A.3, the hyperparameter 8 (0, 1) effectively controls the FPR on the calibration rollouts. As shown in Figure 11, the CP constant threshold and one-sided CP band defined in Propositions and lead to very high TNR but fairly low TPR. In contrast, our simpler tare-narying threshold yields much higher TPR at the cost of raising false
29

---

Threshold: band
Threshold:
Threshold:
0.70
1.0
0.65
0.8
0.8
0.8
0.60
Timee
0.6
1PR
0.50
0.2
0.40
0.90
0.94
0.30
0.90
0.94
0.0
Quantlic
Quantile
Quantile
Quantilc
Threshold: CP constant
Threshald: constant
Threshold: CP constant
Threshold: constant
0.70
1.0
1.0
0.8
0.60
Det Time
0.6
0.6
0.6-
0.55
0.50
0.45
0.2
0.2
0.2
0.40
0.90
0.04
Quantile
Quantile
Quantile
Quantile
Threshold: timewarying
Threshold: time-aarying
Threshold: time-waying
Threshold: time-aryinn
0.70
1.0
1.0
0.8
0.60
0.6
0.6
0.6
TWW
0.55
0.4
0.45
0.2
0.2
0.2
0.30
0.92 0.94 0.96 0.96
0.0
0.90
0.32
0.94
0.96
0.98
0.0
0.90
0.32
0.94
0.96 0.98
0.0
0.90
0.92
0.94 0.96
0.98
Quartile 1-
Quantile
Quantile 1
Quantile 1-8
+
Figure 11: Impact of the quantile value 1 - 8 used for calibration for three threshold types. The results are reported for sliding window size of w 15 and averaged across five seeds, with the bars indicating the standard deviation.
alarms more frequently. Which threshold type is most suitable, therefore, depends on whether recognizing all failures avoiding false alarms has higher priority. The fact that neither constant threshold nor a one-sided CP band achieves the desired FPR exactly matches the results reported in prior works [1, 75] and stems from the fact that Propositions and only hold for ID rollouts, whereas we also evaluate on OOD scenarios. We hypothesize that strictly separating the rollouts used for training the failure predictors from those used for calibration, as well using a larger calibration dataset, could mitigate this issue.
C.4.2 Threshold Type
For our main results in Tables and 6, we report the results with the best-performing threshold definition (CP band, CP constant, time-varying) for each method. While no single threshold type consistently outperforms the others across all methods, we perform direct comparison in Figure 12 and analyze the results below.
CP-based thresholds detect rather than predict failures. Since the CP band and CP constant thresholds are defined such that the probability of raising false alarm is upper-bounded, their values y are higher than those the time-varying threshold that calculated timestep-wise. Con- sequently, the CP-based thresholds yield much higher TNR but also predict failures much later. FIPER achieves the highest TWA values overall with our time-varying threshold and a larger window size. While accuracy may be more important than early detection in some cases, argue that
30

---

Accuracy
RND-OE
0.6-
0.80
0.65
0.5
0.8
0.60
0.70
Dct. Time
0.44
TWA
0.65
0.60
0.50
0.2-
0.35
0.50
0.1
0.40
12545
12345
20.00 50
17
345
20.30
12345
50
Window
Window
Window
Window
TWA
ACE -Accrracy
ACE- Det. Time
ACE-
0.70
0.85
1.0
0.0-
0.80
0.75
0.5
0.60
AcCura
20700
Det. Time
0.6-
TWA
0.50
0.60
0.2-
0.45
0.50
0.1
0.2
0.40
Window size
Windo
Window size W
Window
FIPER -WW
FIPER - Accuracy
FIPER Det. Time
FIPER TNR
0.70
0.85
1.0
0.6-
0.75
0.60
Accuracy
2-070
Det Time
0.44
0.6-
TWAA
0.55
0.65
0.3
TNRR
0.60
0.2
0.55
0.45
0.2
0.50
12345 7
20:30
50
12345
11 20:30 50
3.3.45
7
11 20:30
12345
11
20'0 50
Window size W
Window size W
Window size W
Window size
constant
timevaayling
Figure 12: Impact of the threshold type used by the failure predictors. The results are averaged across five seeds, with the bars indicating the standard deviation.
the conservative nature of CP-based thresholds is more suitable for failure detection rather than prediction.
Constant thresholds are less accurate for FIPER The CP band and time-varying thresholds yield higher TWA and accuracy for FIPER. We attribute this to the fact that these threshold types effectively compare the failure prediction score timestep t against the scores in the calibration dataset for the same timestep. Consequently, they are more sensitive to temporal anomalies in the score values, which stem, for example, from the robot failing grasp an object. However, the higher TNR of the constant threshold shows that the CP band and time-varying threshold raise false alarms more frequently in generalization scenarios, where the policy may solve subtasks in varying order or with inconsistent timing.
C.5 Discussion of Action-Basee Scores
We briefly compare our secion-bbsed failure predictor, ACE, specifically against the two baselines that also operate on the policy output, RND-A and STAC. The results in Table 6 demonstrate that ACE achieves higher TWA and accuracy and lower DT than RND-A and STAC. This demonstrates the superiority of our proposed ACE score for quantifying task-relevant uncertainty from the generated actions. STAC [1], a recent baseline, notably achieves TPR below 0.5 in the SORTING, STACKING, and PUSHT environments that are characterized by strong action multimodality. In comparison, our entropy-based score can predict between 76% and 99% of all failures for these tasks. ACE is specifically designed to capture the uncertainty inherent in multimodal action distributions, and
31

---

it outperforms STAC's temporal consistency score in our experiments. Figure 3 illustrates the conceptual advantage of measuring entropy instead of temporal consistency in the action distributions in tasks that involve action multimodality.
C.6 Discussion of Observation-Basse Scores
RND-OE yields a clearer separation between successful and failed rollouts than the observation- based baselines, PCA-kmeans and logpZO, shown in Figures 4 and 9. Moreover, RND-OE can predict failures more rapidly and achieves the lowest DT overall. This can be especially beneficial in scenarios involving humans, where high sensitivity to different kinds of failures is crucial. In comparison, PCA-kmeans suffers from a low overall TNR, effectively labeling most rollouts as failures (see Table 6). Although logpZO can match the accuracy and TWA of RND-OE (Table 6), our RND-OE score achieves much lower DT, highlighting its advantages for predicting failures before they occur. We find that the design of FIPER benefits from the high sensitivity of RND-OE because rollout is only flagged as Fail if there is also high action uncertainty.
We also considered RND models that take the raw observation images rather than embeddings as input, which is closer to the original version of RND proposed by Burda et al. [9]. However, operating directly in the embedding space of the policy performed significantly better, and argue that this approach offers two key advantages: First, because the observation encoder is trained end-to-end with the policy, the embeddings naturally filter out details in the observations that are irrelevant the policy and, thus, for reasoning about task failure. Conversely, performing OOD detection directly on raw images can yield a high FPR in real-world tasks, as the RND model cannot separate visual noise from policy-relevant features that are indicative of failure. Second, since all common IL policies have an observation encoding module, directly using this pre-trained feature extractor generally allows us to RND-OE -E from smaller rollout dataset, reducing data collection effort.
D Limitations
This section summarizes what we consider to be the main limitations of this work.
The failure prediction accuracy might still be insufficient for certain applications. Although FIPER outperforms state-of-the -hrtthrrrt baselines across various tasks, its overall failure prediction accuracy for the best TWA is only 78%, highlighting the difficulty of early failure prediction in the absence of failure data. This accuracy may still be too low for certain applications, such as a robot operating in an assembly line, where true policy failures need to he recognized early and reliably, but false alarms are costly, Possible ways improve the failure prediction accuracy could be increasing the number of calibration rollouts or using the training data of the policy.
The inclusion of historical data could be further improved. FIPER considers historical data solely through the aggregation of past uncertainty scores using a sliding window, without incorporating this historical context into the actual calculation of uncertainty scores. We hypothesize that the history of previous observations and action predictions could contain early warning signs indicative of policy failures, potentially enhancing the ability of FIPER to anticipate them.
RND-OE needs to be trained. We outline the benefits of using RND-OE compared to other seervatton-embeddinn based methods in Appendix C.6. However, having to train an RND-OE model that is separate from the policy is still a limitation of our approach.
We only test RND-OE with image-based observation embeddings. In our experiments, we only use vision-based IL policies as they do not require specialized sensors. Therefore, although we expect FIPER work well in principle for additional input modalities, such as language, touch audío, this remains an untested hypothesis for the time being.
Time-varying thresholds can be restrictive. Time-varying thresholds can be disadvantageous for two reasons. First, they implicitly assume that the temporal sequence of events in a successful rollout always similar. However, this may not be the case, for example, if the policy manages to grasp an object only in the second attempt, temporally shifting the trajectory from its expected pattern.
32

---

Therefore, if the training data contains multiple temporally distinct ways of completing the task, constant threshold may be more suitable. Second, time- varying threshold can only be calculated for timesteps that are represented sufficiently often in the calibration dataset. Thii can be problem if rollouts have different lengths and may require padding.
Aleatoric uncertainty could impact ACE. If there is high variability (aleatoric uncertainty) in the demonstration data, this is generally reflected by the learned action distribution of the policy, this case, the variability within generated action chunk batches can be high even for successful calibration rollouts, potentially leading to larger threshold, which may result in a lower TPR. We think that disentangling aleatoric from epistemic uncertainty for generative policies remains an interesting avenue for future research.
33

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: We benchmark our proposed method against four state-of ttate-of-the-ar baselines and evaluate performance across diverse set of five environments, both in simulation and the real world, as summarized in Section 5. Moreover, we provide a detailed discussion of our claims based on the experimental results in Section representing a clear and accurate reflection on the paper's contributions and scope stated in the abstract and introduction.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
is fine to include aspirational goals as motivation as long as is clear that these goals are not attained by the paper.
2. Limitations
Question:
Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification: Section 7 discusses several limitations of our work, such as the need to collect successful rollouts, and we provide a more detailed discussion in Appendix D.
Guidelines:
The answer NA means that the paper has limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g.. independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on a few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low or images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed not penalize honesty concerning limitations.
3. Theory assumptions and proofs
34

---

Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [Yes]
Justification: We provide assumptions and proofs for Proposition in Appendix A.
Guidelines:
The answer NA means that the paper does not include theoretical results. All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced in the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but they appear in the suppiemental material, the authors are encouraged to provide short proof sketch provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results the paper to the extent that affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided not)?
Answer: [Yes]
Justification: We clearly and fully describe the details of our proposed method in Sections and and Appendix A. We also release the code and data to facilitate replication of our results.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution a novel architecture, describing the architecture fully might suffice, or if the contribution is specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how replicate the results, access hosted model (e.g.. in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily new algorithm, the paper should make it clear how to reproduce that algorithm.
(b) the contribution is primarily a new model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution is a new model (e.g., a large language model), then there should either be way access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (c.g., to registered users), but it should possible for other researchers to have some path to reproducing verifying the results.
35

---

5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, described in supplemental material?
Answer: [Yes]
Justification: We provide links to the code, data, and instructions reproduce experi- mental results on the project website:
htt.ubb.oooiprreewstttt.. website.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nips.. cc/
ceapbbmmssiooPoooooyy. for more details.
While we encourage the release of code and data, we understand that this might not be possible, so "No" an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https: / /nips.cc..cccoo wttpc//pccppppcccccecoo gtt////dde/////// CCodeSubmission weisnnoliccyyo for more details.
The authors should provide instructions on data access and preparation, including how access the raw data, preprocessed data, intermediate data, and generated data,
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification:
We specify all relevant training and test details Appendix
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, or as supplemental material.
7. Experiment statistical significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer: [Yes]
Justification: In line with similar works, we report accuracy and average detection time as key metrics for evaluating the quality of fallure prediction. We report the mean and standard deviation of the results across five random seeds. Moreover, we average our results across set of quantile values further strengthen the statistical significance.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by emor bars, confi- dence intervals, or statistical significance tests, least for the experiments that support the main claims of the paper.
36

---

The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g.. Normally distributed errors).
It should be clear whether the error bar is the standard deviation or the standard error of the mean.
OK to report 1-sigma error bars, but one should state The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that out of range (e.g. negative error rates).
If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures tables in the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed reproduce the experiments?
Question:
Answer: [Yes]
Justification: We provide the relevant information on compute resources and execution times in Appendix B.6.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't 't make it into the paper).
9. Code of ethics
Question: Does the research conducted the paper conform, in every respect, with the NeurlPS Code of Ethics pettpa:/nneurigee htt.e/rreeee.cpbbiiihhhheeeeeeee
Answer: [Yes]
Justification: The research conducted in this paper conforms with the NeurIPS Code of Ethics in every respect.
Guidelines:
The answer NA means that the authors have not reviewed the NeurlPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (c.g.. if there special consid- eration due to laws or regulations in their jurisdiction..
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
We discuss the potential of our method to improve safety and interpretability of robots operating alongside humans in the introduction and conclusion. We think that our work, which is aimed predicting failures so that we can then avoid them, has no negative
Justification:
impacts society.
37

---

Guidelines:
The answer NA means that there no societal impact of the work performed.
If the authors answer NA or No. they should explain why their work has no societal impact why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility of ML).
Safeguards
Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Answer: [NA]
Justification: Our released algorithms and data do not have a high risk for misuse.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [Yes]
Justification: We cite all original papers for the models, methods, and data we use in Section 5. We respect all licenses and terms of use, which are mentioned in Appendix B.5.
Guidelines:
The answer NA means that the paper does not existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset used and, possible, include URL.
The name of the license (c.g., CC-BY 4.0) should be included for each asset.
38

---

For scraped data from a particular source (e.g., website). the copyright and terms of service of that souree should be provided.
assets are released, the license, copyright information, and terms use in the package should be provided. For popular datasets, paperswi thcode. com comdaatasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
If this information is not available online, the authors are encouraged to reach out to the asset's s creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
Justification:
Our provided code and datasets are accompanied by documentation.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/moodl as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given participants and screenshots, if applicable, as well as details about compensation (if any)?
Answer: [NA]
Justification: Our paper does not involve crowdsourcing or research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According to the NeurlPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals equivalent for research with human subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification:
Our paper does not involve research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsoureing nor research with human subjects.
39

---

Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if' applicable), such as the institution conducting the review.
16. Declaration of LLM usage
Does the paper describe the usage of LLMs if is an important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, or formatting purposes and does not impact the core methodology, scientific rigorousness, originality of the research, declaration is not required.
Question:
Answer: [NA]
Justification: The core methods development this work do not involve LLMs as any important, original, non-standard components.
Guidelines:
The answer NA means that the core method development in this research does not involve LLMs as any important, original, non-standard components.
Please refer to our LLM policy (https: /top:://neeeee httprrrppp.cc/mmmeeeeeec//////// wctpc//eeeenncc//22///////////// for what should or should not be described.
40


Reviews:
[{"review_id": "AjEqbjSi63", "reviewer": "Reviewer_Hb4p", "summary": "This paper focuses on the problem of detecting failure for generative imitation learning policies. Their method, FIPER, combines the idea of action and observation failure likelihoods to both consider the policy being in unseen states but also taking suboptimal actions. The insight is that without considering both of these failure modes, the failure detector cannot both let the policy run when it generalizes, but also catch it when it is going to fail. The also enable their method by not requiring access to the training data, and instead they calibrate their method by using a small amount of online data. The contribution of their paper is in the insight that both action and observation information is required to effectively detect failures, and their specific detection method FIPER and an analysis of their method.", "questions": "So in general, I think your paper is good. If you could address the concerns I have below mostly with the empirical section I will gladly raise my score as I feel you're approaching an important problem with an interesting method.\n\nSo I think you are doing a different sort of uncertainty (at an intent level) but it might be good to mention in section 4.2 that another reason you are doing so is the motivation in this paper: https://arxiv.org/abs/1706.04599 since I think that might be relevant.\n\nI'd appreciate in the related works if for Uncertainty Quantification and OOD Detection you specifically stated how your work slots in with this other work. it seems that you are using some combination of previous OOD Detection methods but which of the works that you state are you building off of?\n\nSmall but line 106, why does ReDiffuser not perform optimally? Breaks the flow a bit.\n\nI understand that generative policies produce good results, but is this method specific to generative policies? If no, why limit experiments to generative policies, if yes why so?\n\nI don't think 4.1 is particularly clear. The description of RND makes sense, but 146-154 isn't particularly clear. The questions I have specifically after reading are: It seems that G(.) (the encoder) and g(.) the target network are different, but using a capital G to me implies an instantiation of the target network g. I think it could also benefit from a sentence saying something like \"Intuitively, on observations the predictor and target network have seen, they produce similar output, and on novel data, they produce a wide range of results\". Maybe this point is obvious but I think it would help clarity.\n\n192 - is this iff a typo or do you mean \"if and only if\" - If it is the full phrase might want to type it out.\n\n238 implementation/Figure 3 - I found it very easy to miss that you call your metrics RND-OE and ACE before this. Possibly in the subsection headings you should define these. Something like \"Detecting OOD Policy Observations - (RND-OE)\". I'm sure there are cleaner ways but it confused me at first. \n\nFigure 3 - You should put 95% confidence intervals here, also note the number of trials on the caption. I also found it difficult to quickly determine what all of your labels mean, the Success ID, Success OOD, Fail ID and Fail OOD. I think defining these in the caption especially for figure understanding is important and would improve clarity. Also you sort of say this but making it clear that the most important metric to see here is the gap between Success OOD and Fail ID. Also, the OOD Success and Fail makes sense to me after reading the text but I can't quite figure out what \"ID\" is in the plots. It would be best if. you can make this clearer.\n\n276 - Probably not important information for main text.\n\nTable 1 - Should have confidence intervals an all these numbers. What does underlined numbers mean? Parens means a poor discrimination but I don't understand the underline.\n\nFigure 4 - This plot can probably be improved. First there are no confidence intervals so it is very difficult to tell if your method has statistical significance. As well, what are all the y axis metrics? Accuracy makes sense, but what is detection time? Percent of episode? From what I can tell here, ACE and FIPER seem to be pretty similar.\n\nFrom Figure 4, without confidence intervals it seems like your method is basically the same as the ACE component of your method, so what is the full FIPER method really giving you as opposed to ACE?\n\nFrom Figure 5, without CIs, your method seems almost exactly the same as logpZO. What would RND-OE look like in the Figure 4 comparison? Since it is doing pretty well in this task but would it completely fail with the other window sizes? I'm just a little confused why there is two separate plots here that seem to have similar data. I'd appreciate in the text a clarification about what the difference is.", "limitations": "yes", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 2, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Overall feedback: I think this is an interesting research direction. The method proposed is FIPER which uses a dual metric (both input and action dependent) to determine when a failure is going to happen with limited online data. There result seems to perform well but it is difficult to say without confidence intervals if their method is truly significantly better. The general description of their method makes sense with some comments I provide below. I think that the empirical section isn't super clear, and could use improvements. If the authors are able to make that section more clear (see specific feedback) and it shows their method is strong that would push this paper into an accept since it is an interesting idea and approach, but right now it is a little difficult to tell good (if any) their result truly is.\n\nHigh level feedback:\n\nQuality: The quality of this paper seems to be reasonable for a NeurIPS paper. I think that in general, the authors have an interesting problem, and describe it decently. Their analysis seems appropriate for the paper, they touch on interesting baselines and provide an interesting ablation. The biggest weakness here is in the empirical section. I don't believe they provide the statistical information to truly asses their results. As well, their descriptions of the tests they run are a bit unclear. I'll provide more feedback below that I think could raise the quality of the empirical section below.\n\nClarity: The clarity of this paper is ok. I did struggle to understand sections, specifically in the method description, and it took me a few passes to grasp what the authors meant. I'll also provide feedback on this below. I think in general the writing quality was reasonable, I just think parts of the text could use some refining.\n\nSignificance: I think the significance of this work is good. From what I can tell, their novelty of using both types of failure detectors in one method is a novel and interesting insight. I believe this is a strength of the work.\n\nOriginality: This specific subfield is not my expertise but it seems as if the originality of this paper is good and similar to the significance.", "was_revised": true, "final_justification": "Authors in their rebuttal addressed my concerns with the empirical section of their paper. I am updating my score to reflect these improvements as they were the main area of issue for the paper.", "rebuttal": "Thank you very much for your detailed and constructive feedback and for appreciating the relevance of our work. We first answer your main technical questions:\n- **Restriction to generative policies:** In principle, our method directly applies to any stochastic policy that can sample actions (from which we can compute the action-based ACE score) conditioned on high-dimensional inputs (observation-based RND-OE score). However, the design of our ACE score is motivated by two characteristics that are particularly prevalent in modern generative policies: 1) multimodal action distributions and 2) the use of action chunking, i.e., generating a sequence of actions together to encourage temporal consistency. Both 1) and 2) make it harder to detect high uncertainty from the conditional action distribution $p(A|O)$ compared to, for example, a conventional behavior cloning policy that samples a single-timestep action from a Gaussian with learned mean and variance. Since generative policy formulations have demonstrated superior performance in recent studies (e.g., X. Jia et al., \"X-IL: Exploring the Design Space of Imitation Learning Policies\", 2025), we have focused on this type of policy in our experiments and used the two most expressive formulations, diffusion and flow matching.\n- **Figure 3**: We agree that this figure would benefit from confidence intervals. Due to limited space, we originally did not include these in the main paper, but provided the distributions of the uncertainty scores, including the 90\\% and 10\\% quantiles, in Figure 8 in Appendix C.1. These more detailed results support the finding that our two scores excel at distinguishing Success OOD from Fail ID rollouts, and we have added this data to Figure 3, using some of the additional space for the final manuscript. \n\n  We have also followed your suggestion to add the number of seeds (5) and an explanation of the four categories to the caption: \n\n  *\"We group the rollouts into four categories along two axes: Success vs. Fail and in-distribution (ID) vs. out-of-distribution (OOD). Robust failure prediction requires distinguishing Success OOD from Fail ID. Our proposed scores (1) and (4) can best make this distinction.\"*\n\n- **Table 1**: Since our ACE score and the baselines PCA-kmeans and STAC are deterministic, their performance is independent of the random seed. However, we understand that reporting confidence intervals for the other methods would strengthen our empirical evaluation. We have updated Tables 1 and 6 accordingly and summarize the overall results with confidence intervals for five seeds in the following table:\n| Metric       | PCA-kmeans    | logpZO         | RND-A         | STAC          | RND-OE (ours)        | ACE (ours)       | FIPER (ours)        |\n|--------------|---------------|----------------|---------------|---------------|---------------|---------------|----------------|\n| TWA ↑        | 0.57 ± 0      | 0.60 ± 0.016   | 0.56 ± 0.023  | 0.56 ± 0      | 0.58 ± 0.037  | 0.61 ± 0      | **0.62 ± 0.010** |\n| Acc. ↑       | 0.62 ± 0      | 0.69 ± 0.021   | 0.67 ± 0.038  | 0.64 ± 0      | 0.65 ± 0.045  | 0.73 ± 0      | **0.75 ± 0.010** |\n| DT ↓         | (0.11 ± 0)      | 0.34 ± 0.021   | 0.46 ± 0.032  | 0.41 ± 0      | **0.17 ± 0.018** | 0.45 ± 0      | 0.29 ± 0.015   |\n\n  Here, we put detection time (DT) values in brackets if the method discriminates poorly between successes and failures (TPR or TNR below 0.4), similar to the paper. The results underscore that FIPER consistently achieves higher accuracy than the baselines. The low DT of FIPER is only surpassed by its own submodule RND-OE, which is very sensitive to failures but achieves lower accuracy when used alone. \n\n  Besides, underlined numbers in Tables 1 and 6 indicate the second best value in each row, and we added a sentence to the captions to make this clearer. \n- **Figures 4 and 5:** Their main purpose is to compare our approach of aggregating uncertainty over a moving window against a) accumulating scores over all previous timesteps [1] (Figure 4) and b) considering only the current timestep [72] (Figure 5). In these comparisons, we include the respective failure prediction score baseline (action-based STAC [1] for Figure 4 and observation-based logpZO [72] for Figure 5), FIPER, and the submodule of FIPER most similar to the respective baseline (ACE for Figure 4 and RND-OE for Figure 5). Moreover, to stay as close as possible to the setup of these two related works, we use a constant threshold in Figure 4 and a time-varying threshold in Figure 5. Thus, there is no overlap between the data in the two figures, but we understand that this was not entirely clear from the captions. To improve clarity, we have changed the colors in Figure 5 to be different from those in Figure 4, highlighted the threshold type in the captions using an italic font, and expanded the description of the two figures in lines 306 to 322.\n\n  As you suggested, we have also added confidence intervals to Figures 4 and 5. Similar to the table included above, FIPER again performs very consistently across random seeds (within $\\\\pm 0.015$ for each metric). Thus, the main messages of the figures, i.e., the benefits (fast and robust failure prediction) of aggregating uncertainty over a moving time window, remain unchanged. Importantly, Figures 4 and 5 are not intended as a comparison of different failure prediction scores (e.g., logpZO vs. FIPER). Instead, the main baseline comparison is provided in Table 1 (and an extended version in Table 6). There, we report each method with the best-performing window size $w$ to avoid unfair cherry-picking of $w$ that might favor one particular method. \n\n  As an additional note, the y-axis metrics in Figures 4 and 5 refer to timestep-wise accuracy (TWA), our novel metric for assessing failure prediction performance with a single score, accuracy, and detection time. We normalize detection times by the maximum episode length in all our experiments. Since this information, as well as the meaning of TWA, is hard to spot in the \"Metrics\" paragraph, we have added those details to all relevant figure captions.\n\nWe have also addressed the other issues you raised and made additional changes to the paper to strengthen the discussion of related works and further improve clarity:\n- **ReDiffuser:** This method is designed to increase the reliability of decisions (future trajectories) sampled from a diffusion model. ReDiffuser is tailored to state-based policies and cannot take high-dimensional visual inputs into account, in contrast to our method. The baseline RND-A in our experiments is closely adapted from ReDiffuser, and our results (see, e.g., the table above) show that FIPER substantially outperforms RND-A in terms of accuracy and detection time. As you suggested, we have added a sentence in line 107 to improve the text flow:\n\n  *\"However, ReDiffuser is tailored to state-based policies and not designed to take high-dimensional visual inputs into account.\"*\n\n- **Additional reference**: We agree that the motivation in the mentioned paper (Guo et al., \"On Calibration of Modern Neural Networks\", 2017) is highly relevant to our work. We have added the reference to the discussion of related work and included a sentence after line 165 in Section 4.2: \n\n  *\"To improve model interpretability, which is especially important in decision-making systems [here], we aim to capture uncertainty at an intent level.\"*\n\n- **Related Work:** We agree with you that emphasizing more how our method relates to other work would add clarity. Our proposed approach comprises two modules, the observation-based RND-OE score and the action chunk-based ACE score. RND-OE builds on random network distillation (RND) [9], which has previously been used to incentivize exploration in reinforcement learning [9], quantify uncertainty [12], and to estimate the reliability of sampled trajectories [21]. The main novelty compared to prior work is that we adopt RND in the *embedding* space of *vision-based* policies and with the specific goal of predicting policy failures. The ACE score is a novel concept, but it has some connections to Bayesian methods [19] and the idea that sampling a batch of actions instead of a single one can be used to detect failures [1]. However, STAC [1] is very different from our approach, as it compares marginal action distributions at consecutive timesteps. The differences between ACE and STAC are also visualized in Figure 2, and we find that ACE performs superior in our experiments, especially for high action multimodality (lines 296 to 299). \n\n  To make these connections to related works clearer, we have added the following after line 93 in the \"Uncertainty Quantification and OOD Detection'' paragraph of the related work section: \n\n  *\"Our method combines RND in the observation embedding space with a novel entropy-based score, which conceptually has some connections to the idea that sampling a batch instead of a single action can be used to detect failures [1], as well as to Bayesian methods [19].\"*\n\n- We have improved Section 4.1 by denoting the encoder by $\\\\boldsymbol{h}(\\\\cdot)$ instead of $\\\\boldsymbol{G}(\\\\cdot)$ to avoid confusion with the target network $\\\\boldsymbol{g}(\\\\cdot)$ and by adding the following below equation (1): \n\n  *\"Intuitively, on observations the predictor and target networks have seen, they produce similar outputs; on novel data, however, their outputs differ.\"*\n\n- We typed out \"iff\" as \"if and only if\" in line 192.\n- We added *\"(RND-OE)\"* and *\"(ACE)\"* to the headings of Sections 4.1 and 4.2, respectively, to improve readability of the figures and tables that contain these abbreviations.\n- We removed the comment on compute resources in line 276 from the main text, as these details are also provided in Appendix B.5.\n\nWe hope to have addressed all your questions and concerns. Please let us know if any further clarification is needed."}, {"review_id": "YTvzr2gm31", "reviewer": "Reviewer_ZrcY", "summary": "The paper presents a new method for failure prediction in imitation learning with generative models, called Failure Prediction at Runtime (FIPER). FIPER is based on predicting failure by looking both for consecutive out-of-distribution (OOD) observations and highly uncertain actions at the same time. OOD observations are detected with a novel method that leverages Random Network Distillation (RND), an existing reinforcement learning approach that measures observation novelty for exploration purposes. The paper also introduces timestep-wise accuracy (TWA), a new metric for evaluating failure prediction that encourages both accurate and timely predictions. FIPER is empirically evaluated on several relevant domains, generally demonstrating its capability to detect failures more accurately and faster w.r.t. the considered baselines.", "questions": "What is the motivation behind not conducting experiments that include humans (possibly simulated, or recorded from a dataset)? While I understand that the inclusion of these might be out of the scope of the paper, discussing what might change in these scenarios (e.g. different trade-offs between false positive rate and prediction time, which might favor different methods) would be highly beneficial.\n\nIn the discussion on the results relative to the \"sliding window\" experiments (306-322 and figure 4), it is not clear whether the reported gain in detection time is relevant, and whether it is enough to warrant the reported drop in accuracy. More in general, expanding the discussion with examples of when this difference might be relevant (and desirable, given the associated significant drop in accuracy) would be highly beneficial in solidifying this discussion.\n\nIf these concerns were addressed appropriately, I would raise the significance score by 1 and consider raising the overall rating.", "limitations": "Yes, the authors have successfully highlighted the limitations, except for those presented within the questions.", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 4, "significance": 2, "originality": 3, "strengths_and_weaknesses": "Quality: the methodology is technically sound: the relevance of the introduced metrics is empirically demonstrated, and experiments on FIPER support the claims, even though the discussion of some results could be improved.\n\nClarity: the presentation and organization of the content (method, experiments, related work, etc.) is a very strong point of this contribution. The organization is sensible and predictable, and the presentation is concise and exhaustive, both in text and in figures and tables. The paper is also easily readable to scientific audiences which are not familiar with its specific field of research. \n\nSignificance: the presented results are significant and mostly relevant: while FIPER is shown to produce more timely and accurate predictions on the considered environments, scenarios that include humans are not discussed (nor studied empirically, but this might be out of the scope of the paper), even though these are mentioned as highly relevant in the introduction. As a minor point, the discussion of the \"sliding window\" experiments could also be better motivated.\n\nOriginality: the paper presents good but not outstanding originality, which mainly lies in: (1) the idea of combining both OOD detection and action uncertainty to better handle false positives, which in itself seems simple, yet it would be highly impactful to future work; (2) a novel way to use RND, originally developed to solve exploration problems, to detect OOD observations; (3) a new metric to evaluate failure prediction methods.", "was_revised": true, "final_justification": "The paper is sound and the authors seem to have clarified most concerns from all the reviewers.", "rebuttal": "We thank you for your valuable and constructive feedback and sincerely appreciate your recognition of the clarity of our work. We have answered your questions below:\n- **Experiments including humans:** The main motivation behind our work is to increase the interpretability and safety of generative policies. These aspects are important not only in human-centered environments, but especially there. We nevertheless decided against including humans in our real-world and simulated experiments. Our reasoning was as follows: Such experiments are significantly more challenging to conduct in a fair and repeatable manner, as human behavior inevitably exhibits a certain degree of unpredictability. This could only be avoided by simulating non-autonomous humans (e.g., executing fixed pre-recorded motions), but then the sole added value would be the occurrence of a new type of potential failure, namely, collisions with humans. However, rather than collision avoidance, our primary goal is to enable robots to predict more generally if they will fail at their *learned task* due to OOD situations and high action uncertainty, such that policy execution can be stopped, and the robots can ask humans for help. We have emphasized this aspect more clearly in the introduction by rewriting lines 31 to 33 as follows:  \n\n   *\"In human-centered and safety-critical settings, it is therefore crucial to predict such failures as early as possible during runtime to enable timely intervention [43] or safe fallbacks [8] or to ask human experts to demonstrate the task.\"* \n \n  In summary, we think that conducting failure prediction experiments involving humans would be a very interesting direction for future research, but we wanted to focus more on improving and evaluating the fundamental capabilities to predict policy failures accurately and early in this work. \n\n  In our opinion, experiments involving humans would not require significant changes to the methodology, but probably a slight adjustment of the metrics. Accuracy and our new timestep-wise-accuracy (TWA) metric (defined in Appendix B.3) weigh true positives and true negatives equally. However, if failures involve breaking expensive items or moving erratically and endangering humans, false negatives (i.e., not detecting failures) are far worse than false positives. For such scenarios, we would propose adding a weighting factor $\\\\alpha \\\\geq 0$ to the calculations of balanced accuracy and TWA, for example, changing (41) to \n  $$\n  \\\\text{BALANCED TWA} = \\\\frac{1}{1+\\\\alpha} \\\\left(\\\\frac{\\\\sum_i (1-t_i/T)}{\\\\#\\\\mathrm{P}} + \\\\alpha\\\\frac{\\\\#\\\\mathrm{TN}}{\\\\#\\\\mathrm{N}}\\\\right).\n  $$\n  Then, a small value $\\\\alpha \\\\in [0,1]$ could be used if unrecognized failures are more costly than false alarms.\n  If the primary objectives in a human-centered task are to detect all failures and as quickly as possible (even at the cost of many false alarms), our two scores can be combined with a logical OR instead of AND, as shown by the results reported in Table 2. The OR variant achieves lower overall accuracy but can detect 100% of failures. Moreover, the uncertainty score that best satisfies these alternative objectives is our RND-OE score with a small window size $w$ and a small quantile value $1-\\\\delta$, as can be seen from Figures 9, 10, and 11 in the Appendix. We have added these discussion points to the paper as follows: \n  -  Lines 334 to 337: *\"As a variation of FIPER, the use of a logical disjunction (OR) of our two failure predictors provides a powerful alternative when the primary goal is to achieve very low DT and high TPR. This may be particularly desirable if failures could directly endanger people or cause damage to expensive items.\"*\n  - Lines 985 to 986: *\"RND-OE yields a clearer separation between successful and failed rollouts (see Figures 3 and 8) and detects failures more rapidly with both time-varying (Figure 9) and constant (Figure 10) thresholds. This is especially beneficial in scenarios that involve humans, where high sensitivity to different kinds of failures is paramount.\"*\n- **Moving window discussion**: The tradeoff between detection time and accuracy shown in Figure 4 is an important empirical finding of our work, and we appreciate the reviewer's suggestion to expand the discussion of this tradeoff. The observed higher accuracy of cumulative scores mainly stems from the fact that they rarely raise false alarms, since successful rollouts are usually shorter than failed ones, leaving fewer timesteps to aggregate a large cumulative score that exceeds the threshold. For the same reason, the detection time is also much higher for cumulative scores. In our opinion, it mainly depends on the task whether a decrease in detection time (here: -47\\% and -26\\%) justifies a drop in accuracy (here: -25\\% and -17\\%). In domains where rapid response to imminent failures is crucial, such as autonomous surgical assistance or collaborative assembly lines, earlier failure warnings may be highly desirable, even if they mean more false alarms. Conversely, in a logistics scenario, misplacement of objects is often not dangerous, whereas every incorrect failure warning would have to be checked manually by a human and would thus be costly. In this case, a more conservative aggregation over a longer window may better balance operational efficiency and failure prevention. We would like to point out that our moving window method includes the cumulative ($w\\\\geq \\\\text{episode length}$) and single-timestep ($w=1$) approaches used in prior works [1, 72] as special cases, and the window size can be chosen based on the characteristics of the task with FIPER. We have added a longer paragraph similar to the above discussion to Appendix C.3 and expanded lines 315 to 317 in the main paper as follows:  \n\n  *\"In comparison, considering only the most recent timesteps with FIPER enables us to actually predict failures and raise a warning early. This is important, for example, in safety-critical scenarios like surgical assistance or collaborative assembly, even if it causes more false alarms.\"*\n\nWe hope we have addressed your questions and would be happy to elaborate further if needed."}, {"review_id": "4W01DTOnLY", "reviewer": "Reviewer_Hshp", "summary": "This paper proposes FIPER, a framework for predicting task failures of generative robot policies at runtime without requiring any failure data. FIPER identifies two key indicators of impending failure: 1) consecutive OOD observations in the policy's embedding space and 2) persistently high entropy in the generated action distributions. These scores are aggregated over short time windows and statistically calibrated using conformal prediction on a small set of successful rollouts. FIPER raises an alarm only when both scores exceed their calibrated thresholds simultaneously (logical AND), ensuring robustness. Evaluated across five diverse simulation and real-world robotic tasks with various generative policies, FIPER enables earlier, more accurate failure warnings, enhancing safety and interpretability for robots in human-centered environments.", "questions": "1. The paper treats consecutive OOD observations and persistently high action entropy as independent indicators of policy failures (Section 4.3), but their frequent co-occurrence in failures (Fig. 3) suggests a potential causal link: could OOD observations induce high-entropy actions? Specifically: Is there evidence that OOD inputs directly cause the policy’s action distribution to become high-entropy ? If not, could FIPER miss failures where these indicators decouple—e.g.,\n- OOD without high entropy (policy handles novelty confidently but still fails)?\n- High entropy without OOD (policy acts erratically in-distribution)?\n\n\n2. In the current experiment, how are failure situations handled after the failure prediction at runtime. Can appropriate interventions be made on the robot's state after failure prediction to further improve the success rate of the task?\n3. The experiments only involve Franka and manipulators. Will the same excellent performance be achieved in other tasks, such as robot locomotion tasks?", "limitations": "yes", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 4, "originality": 2, "strengths_and_weaknesses": "Strengths\n1. **No Failure Data Required**:\n  - Trains solely on successful demonstrations, eliminating risky data collection for failure scenarios.\n2. **Dual-Signal Detection**:\n  - Combines temporal OOD observations (via RND-OE) and persistent action uncertainty (via ACE), reducing false alarms and enabling early failure prediction.\n\n\nWeaknesses\n1. **Action Space Scalability**:\nThe binning approach used in calculating the ACE score may face challenges with high-dimensional actions, though this has not been tested.\n2. **Threshold Sensitivity**:\nAlthough the paper proposes range conformal prediction to calibrate thresholds, threshold adjustment must be re-performed for different tasks. Moreover, the method presented is highly sensitive to thresholds—during the threshold calibration phase, any errors in threshold calculation caused by uneven data distribution could significantly impact the algorithm’s results.", "was_revised": true, "final_justification": "The authors have addressed my concerns in their rebuttal. This algorithm can identify potential risks during the operation of the policy, and in the future, combining with recovery algorithms, it will be able to achieve more extensive applications. \n\nI adjust my score to 4.", "rebuttal": "Thank you very much for your valuable feedback and for recognizing the significance of our work. We have responded to the mentioned weaknesses and your questions below:\n- **Action space scalability:** We agree with you that the computational cost of the ACE score, in principle, increases with the action dimension. However, we calculate the ACE score in the Cartesian space using end-effector positions (see also Appendix A.1). This can be done for any manipulation task (and even for locomotion or navigation, see \"Other tasks\" below), even if the policy outputs joint angles or velocities, by using forward kinematics. We use this approach not only for computational reasons but also to obtain interpretable uncertainty scores in the same 3D space in which the task is performed. High uncertainty in Cartesian space means that the policy is unsure about the correct path to take (e.g., where to grasp an object), whereas entropy in, for example, joint velocities, does not necessarily correspond to task-relevant uncertainty.\nWe also experimented with computing the ACE score using other action representations, such as full 6D poses, but did not observe improved performance. \n\n  For bimanual manipulation, the ACE score can be computed for each end-effector individually with our framework, and the values are then combined by averaging or taking the maximum. In fact, we evaluated the ACE score in this way on the bimanual manipulation data from C. Agia et al., \"Unpacking Failure Modes of Generative Policies: Runtime Monitoring of Consistency and Progress\", 2024 [1] and observed very good performance, but we could not include these experiments in our final submission, as the dataset does not contain the observation embeddings required for our RND-OE score and the PCA-kmeans and logpZO baselines. \n\n  Due to the ACE score computation in Cartesian space, we think that our method can handle common higher-dimensional action spaces well, and deploying FIPER for humanoids or quadruped locomotion would be an interesting direction for future work. We have added a sentence to the implementation details in line 243 to better emphasize this aspect of our method in the main text:  \n\n  *\"We compute the ACE score in the Cartesian space of predicted end-effector positions to obtain interpretable and task-relevant action uncertainty estimates and to ensure computational efficiency.\"*\n\n  Additionally, we have expanded lines 679 to 681 in Appendix A.1 into a separate paragraph and included the points just discussed.\n\n- **Threshold sensitivity:** We agree with you that the need to calibrate the threshold for each task is a limitation, which our method has in common with related works [1, 72]. In our opinion, this calibration step can hardly be avoided because the learned policy itself and, thus, the distribution of the failure prediction scores, depends on the underlying task-specific data distribution. However, we have observed that constant thresholds are less sensitive to subtask sequence shifts compared to time-varying thresholds. We have emphasized this insight more clearly in the extended discussion on limitations in Appendix D by adding the following to line 1027:\n\n  *\"Therefore, if the training data contains multiple temporally distinct ways of completing the task, we consider a constant threshold to be more suitable.\"*\n\n- **Dependence of OOD observations and high action entropy:** As the action generation is conditioned on the observation, the occurrences of OOD observations and persistently high action entropy are generally not independent, and we do not make this assumption. Rather, our approach is based on the following insight: Failures of imitation learning policies represent a deviation from the distribution of successful demonstrations, which can be caused by unseen initial conditions or compounding errors, potentially due to the stochasticity of generative policies. However, many OOD situations do not result in task failure because the policy can recover from them, which is shown by the low true-negative-rate (TNR) of 50\\% (see Table 6) of using our observation-based RND-OE score alone. For this reason, FIPER flags a rollout as Fail only if there is *additionally* high action entropy, which indicates the policy is also highly uncertain about the correct actions to take given the current OOD observation. This AND-combination of the two failure indications achieves the highest accuracy and can detect 87\\% of all failures in our experiments (Table 6), demonstrating that most failures exhibit both indications. Using OR instead of AND can also detect all of the rare failure cases in which the two indications decouple, achieving a TPR of 100\\% (Table 2), but this also means raising many false alarms. Hence, we consider the logical disjunction to be only preferable for tasks that require very high sensitivity to failures, such as assistive surgery, where every failure can have catastrophic consequences. To better highlight this aspect in the main paper, we have expanded lines 334 to 337 as follows: \n\n  *\"As a variation of FIPER, the use of a logical disjunction (OR) of our two failure predictors provides a powerful alternative when the primary goal is to achieve very low DT and high TPR. This may be particularly desirable if failures could directly endanger people or cause damage to expensive items.\"*\n\n- **Handling of failures after prediction:** The main focus of our work is to predict policy failures accurately and early. To be able to evaluate and fairly compare different failure prediction methods, we use pre-recorded policy rollout data where we know the ground-truth final outcome (Fail or Success). However, the key motivation behind our work is to allow for intervention before a failure occurs or becomes irrecoverable. We think that carrying out such interventions during runtime after a failure warning is raised and, for example, using this data to fine-tune the policy, is a very interesting and natural direction for future work.\n\n- **Other tasks:** Our experiments involve three tasks with Franka manipulators, one mobile manipulation task with a different platform [1], and the PushT simulation task. We focus on manipulation, as we think this has recently been the largest application area of vision-based generative imitation learning policies. Nonetheless, we think that FIPER is also directly applicable to other tasks, such as navigation and locomotion, provided that two conditions are met:\n  - There is a clear definition of \"task failure\". This might not be as obvious for some locomotion tasks, such as tracking a desired reference base velocity, which do not have the same episodic character as typical manipulation and navigation tasks. Intuitively, \"task failure\" is well defined in the sense of our work if there is a maximum episode length and a clear objective that should be achieved within that time frame. For locomotion, this objective could be defined, for example, as staying within a certain tolerance around the reference speed.\n  - The actions can be represented in or transformed to Cartesian space. This is not a strict requirement, but we think it is highly beneficial for the reasons mentioned above under \"Action space scalability\". It applies to navigation, where the entropy can be computed for the base positions predicted from the action chunks. For locomotion, we would propose computing the action entropy for the positions of each foot individually and then combining these scores by averaging or taking the maximum, similar to bimanual manipulation (see \"Action space scalability\" above). \n\n  We have included this discussion in Appendix B.1.2 by adding a paragraph after the description of the real-world environments.\n\nWe sincerely thank you for your insightful comments and hope our clarifications resolve your concerns. We would be happy to provide further details if needed."}, {"review_id": "sFiBzqcyII", "reviewer": "Reviewer_a998", "summary": "The paper introduces FIPER, a framework for predicting failures at runtime in generative imitation learning policies without requiring failure examples. Existing failure detection approaches either trigger false alarms (via out-of-distribution detection) or react too late (via external monitoring). FIPER addresses these limitations by combining two signals: sequences of out-of-distribution observations and sustained high action uncertainty. These signals are calibrated on successful rollouts, and conformal prediction is applied to offer statistical guarantees. The method is evaluated across five simulated and real-world domains, demonstrating earlier and more accurate failure prediction than baselines. This work enhances the safety and interpretability of deploying generative IL policies in real-world robotics.", "questions": "1. Could you elaborate on Equation 4? Specifically, how is the estimated entropy computed, and why is this approach considered more efficient? These details are essential to support your method but are unclear in the main text. (Note: I later found the explanation in the appendix—consider adding a reference in the main paper for clarity.)\n\n2. In Equation 7, have you explored alternative ways to combine the two criteria, such as using weighted combinations? It would be helpful to understand whether other formulations were considered.\n\n3. How is the threshold δ chosen, and how does its variation impact performance? Some discussion or sensitivity analysis would strengthen the empirical justification.\n\n4. Why do you consider different generative modeling techniques and policy backbones for different tasks?", "limitations": "yes", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths:\n\n1. The paper is clearly written and easy to follow.\n2. The proposed method is theoretically well-grounded and clearly explained.\n3. The method demonstrates strong empirical performance.\n4. The authors conduct extensive experiments across diverse settings.\n\nWeaknesses:\nThe paper's organization could be improved by more clearly referencing the appendix. Much of the theoretical content is deferred there, leaving some explanations in the main text vague.", "was_revised": true, "final_justification": "From my perspective, this work is practical and holds value for many real-world applications. However, in its original submission, it missed some key points. My initial concerns focused primarily on:\n\n- Improving the clarity and readability of the paper\n\n- Refining experimental details and ablation studies to support plausibility\n\nIn the authors' rebuttal, these concerns were thoughtfully addressed. I’m pleased to see that the planned revisions for the camera-ready version incorporate these improvements. Based on the resolved issues and the authors’ responsiveness, I will maintain my original score recommendation.", "rebuttal": "We are grateful for your comments and feedback and appreciate your recognition of our method's performance. We have responded to your questions below:\n- **References to the Appendix:** As you suggested, we have included a reference to the detailed explanation of the entropy computation in Appendix A.1 below Equation 4. Moreover, we have added references to the other methodological and theoretical details in Appendix A.2, A.3, and A.4 to the corresponding passages in Section 4 and believe these changes significantly improve the organization of the methodology section.\n- **Alternative ways of combining detector outputs:** Besides logically combining the detector outputs, we have also tried a weighted combination of the normalized scores (i.e., the score at timestep $t$ divided by the corresponding threshold). This approach would allow selecting the influence of the individual scores in the final output, but the weighting factor would represent an additional (task-specific) hyperparameter. We wanted to avoid further increasing the number of hyperparameters to ensure generalizability of our results across tasks and environments, and to not increase the amount of tuning required. For this reason, and because the weighted combination did not perform better in our experiments, we have not included this variant in our final results. We added this information in two sentences after line 742 in Appendix A.4. Lastly, we would like to highlight that we compare the logical AND combination of the detector outputs to an OR combination in Table 2 and find the latter to be a viable alternative when aiming primarily for high sensitivity and low detection time.\n- **Choice and impact of $\\\\delta$:** The value of $\\delta$, or equivalently the quantile value $1-\\\\delta$, is a crucial parameter, since the score thresholds are defined using conformal prediction such that the false-positive-rate on the calibration rollouts is $\\\\leq \\\\delta$. Due to space limitations in the main paper, the analysis of the impact of $1-\\\\delta$ is included in Appendix C.4.2 in Figure 11. The results show that a lower value of $1-\\\\delta$ increases the sensitivity to failures but also increases the rate of false alarms. It may depend on the task whether false negatives or false positives are more costly, and the TWA plots on the left of Figure 11 show there is no single \"best\" value for $\\\\delta$ when aiming for both accurate and early failure prediction. Therefore, and to conduct a fair comparison of the different methods instead of cherry-picking $\\\\delta$, we report all our main results averaged across $1-\\\\delta \\in \\\\{0.9,0.91,...,0.99\\\\}$. To better justify this evaluation strategy in the main paper, we have added a reference to Appendix C.4.2 to the description of our evaluation protocol in line 273.\n- **Policy design:** In our experiments, we wanted to test our method for the two most popular generative modeling techniques (flow matching and diffusion) and policy backbones (transformers and CNNs). We chose to use flow matching with a transformer backbone for two of the tasks and diffusion with a CNN backbone for the other three tasks (instead of evaluating all possible combinations of generative models and backbones for each task) to keep the computational effort feasible for us. For the PushT and PushChair tasks, we use the datasets from prior work [1], so the choice of using a CNN-based diffusion policy for these tasks had already been made by those authors. To clarify these points, we have expanded the paragraph in lines 794 to 798 in Appendix B.2 and, in particular, added the following: \n\n  *\"We combine flow matching with a transformer backbone for the Sorting and Stacking tasks and combine diffusion with a CNN backbone for the other three tasks. This choice was made to evaluate our method's performance for different policy formulations and architectures, and we have made it independently of the tasks' characteristics.\"*\n\nWe hope this response addresses your questions. Please let us know if you would like us to provide further details."}]

Author rebuttal:

Meta-review: This paper studies the problem of failure prediction when executing an imitation learning policy. The key idea is to synergistically consider both sequences of out-of-distribution observations and sustained high action uncertainty. Sufficient empirical experiments are provided to support the effectiveness of the proposed method. The reviewers agree that the studied problem is important, the proposed method is novel, and the empirical improvements are significant. I, therefore, recommend accept.
Decision: Accept (poster)