SAFE: Multitask Failure Detection for Vision-Language-Action Models
Authors: Qiao Gu
Yuanliang Ju
Shengxiang Sun
Igor Gilitschenski
Haruki Nishimura
Masha Itkina
Florian Shkurti
Venue: NeurIPS 2025 poster ()
Keywords: Failure Detection
Vision-Language-Action Models
Conformal Prediction
Primary area: reinforcement_learning

Abstract: While vision-language-action models (VLAs) have shown promising robotic behaviors across a diverse set of manipulation tasks, they achieve limited success rates when deployed on novel tasks out of the box. To allow these policies to safely interact with their environments, we need a failure detector that gives a timely alert such that the robot can stop, backtrack, or ask for help. However, existing failure detectors are trained and tested only on one or a few specific tasks, while generalist VLAs require the detector to generalize and detect failures also in unseen tasks and novel environments. In this paper, we introduce the multitask failure detection problem and propose SAFE, a failure detector for generalist robot policies such as VLAs. We analyze the VLA feature space and find that VLAs have sufficient high-level knowledge about task success and failure, which is generic across different tasks. Based on this insight, we design SAFE to learn from VLA internal features and predict a single scalar indicating the likelihood of task failure. SAFE is trained on both successful and failed rollouts and is evaluated on unseen tasks. SAFE is compatible with different policy architectures. We test it on OpenVLA, $\pi_0$, and $\pi_0$-FAST in both simulated and real-world environments extensively. We compare SAFE with diverse baselines and show that SAFE achieves state-of-the-art failure detection performance and the best trade-off between accuracy and detection time using conformal prediction. More qualitative results and code can be found at the project webpage: https://vla-safe.github.io/

SAFE: Multitask Failure Detection for Vision-Language-Actionn Models
Qiao Gu
Yuanliang Ju Ju3.2,3 12.3 Shengxiang Sun 1.2 Igor Gilitschenskil.22
Haruki Nishimura
Masha Itkina Florian Shkurti
University of Toronto (UofT), 2 UofT Robotics Institute,
3 Vector Institute, "Toyota Research Institute (TRI)
9 gudmail wwwlllluutoooto..m
Abstract
While vision-language-attinn models (VLAs) have shown promising robotic be- haviors across diverse set manipulation tasks, they achieve limited success rates when deployed novel tasks out of the box. To allow these policies to safely interact with their environments, we need a failure detector that gives a timely alert such that the robot can stop, backtrack, or ask for help. However, existing failure detectors are trained and tested only on one or a few specific tasks, while generalist VLAs require the detector to generalize and detect failures also in unseen tasks and novel environments. problem and propose SAFE, failure detector for generalist robot policies such VLAs. We analyze the VLA feature space and find that VLAs have sufficient high- level knowledge about task success and failure, which is generic across different tasks. Based on this insight, we design SAFE to learn from VIA internal features and predict single scalar indicating the likelihood of task failure. SAFE is trained on both successful and failed rollouts, and is evaluated on unseen tasks. SAFE is compatible with different policy architectures. We To-FAST in both simulated and real-world environments extensively. We compare SAFE with diverse baselines and show that SAFE achieves state-of-the-arr failure detection performance and favorable trade-off between accuracy and detection time using conformal prediction. More qualitative results and code can be found the project webpage: https://vla-safe, http:///llaaae..giuub..oo/
this paper, we introduce the multitask failure detection
on OpenVLA, To. and
1 Introduction
Recently, scaling up robot manipulation datasets has enabled the development large vision- language-action (VLA) models, which generalist manipulation policies that can follow language instructions and accomplish a wide range of tasks (166.. However, when VL.As are directly deployed unseen tasks without collecting additional demonstrations and finetuning the model, they still suffer from limited success rates and a wide range of failure modes. This has been demonstrated by evaluations in recent work (2 4 7 while VLAs achieve success rates of 80-90% their performance on unseen tasks drops to 30-60% out of the box. Therefore, to safely and reliably deploy VLA policies in the real world, it important to promptly detect their potential failures.
seen tasks,
Most existing failure detection methods train a separate failure detector for each task, and evaluate the detector only that task [8-17]. While these methods work well for specialist policies, they do not suit generalists like VLAs. VLAS are designed to accomplish diverse tasks and may frequently encounter novel task instructions and unseen environments during deployment. In such cases, is impractical to exhaustively collect rollouts and train a failure detector for every new task. Some recent works introduce mask-generic failure detectors, but they either require sampling multiple actions [18
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

or need to query a large VLM [19 20], which poses significant inference overhead for VLAs in the real world. This motivates the need for an efficient and multitask failure detector that can generalize to unseen tasks zero-shot and detect failures in timely manner during the on-policy rollout of the VI.A.
In this paper, we focus on the multitask failure detection problem. This setting evaluates the failure detection performance
VLA policy without collecting rollouts or finetuning the failure detector on unseen tasks. To our knowledge, such multitask failure detection capabilities for VLAs have not been shown in the literature. To tackle this problem, we study the internal features of VLAs and find that they capture high-level knowledge about task success and failure. As shown in Fig, [ failed rollouts occupy distinct region ("failure zone") in the VLA feature space, and this separation remains consistent across different tasks.
Based on this insight, we introduce SAFE, ScAlable Failure Estimation method that scales across diverse tasks for generalist policies like VLAs. SAFE takes in a VLA's internal features and regresses them single scalar indicating the likelihood of failure. By training on successful and failed rollouts of multiple tasks, SAFE learns to identify task-generic representations for failure detection. To determine the threshold for failure detection, we adopt the functional conformal prediction (CP) g 21 framework and calibrate the prediction band on the seen tasks. We conduct failure detection experiments on OpenVLA [2] my 4 and FAST [5]. in both simulation and the real world. For
evaluation, we adapt diverse baseline failure detection methods from both the LLM literature [22 [23 and the robot learning literature 8 18 onto VLAs. SAFE and baselines are evaluated on both training (Seen) tasks and set of held-out (Unseen) tasks. Experiments show that SAFE outperforms other existing baselines and achieves the best trade-off between accuracy and timeliness for failure detection. The contributions of our paper can be summarized as follows:
We analyze the VLA feature space and show that, across different task instructions and environments, the internal features of the VLA distinctly separate successful and failed rollouts.
We propose SAFE, a multitask failure detector designed for generalist robot policies. By operating on latent features, training multiple tasks, and using conformal prediction methods, SAFE shows generalization capabilities in detecting failures on unseen tasks.
We evaluate SAFE and diverse baselines on several recent large VLA models in both simulation and the real world. Experiments show that SAFE outperforms baselines and achieves state-of-the-art (SOTA) performance.
2 Related Work
2.1 Vision-Languuge-AAtiion Models
Recent advances in large-scale machine learning and the availability of extensive robot demonstration datasets have paved the way for VLA models 4 6 7 24 25). These generalist robotic policies initialized from pretrained large-scale VLMs 28 and thus inherit the ability to understand diverse semantic concepts from both images and language. They are augmented with an action head that produces continuous control signals, through per-step binning 1 2 24 diffusion networks [3] 29 30), or frequency-space tokenization [5) These VLAS are then trained on vast robotic datasets covering a wide array of tasks (3 As result, VLAs can successfully perform familiar tasks in new environments and even tackle previously unseen tasks when provided with novel language instructions. Nevertheless, significant variability in real-world deployments and the challenging domain gaps between training and testing environments continue to hinder VLA performance. Most state-of-the-arr VLA models achieve success rates between 30% and 60% when evaluated out-of-the- box on real robots with unseen task instructions 22 4 BT These limitations
highlight the need for robust multitask failure detection methods tailored to generalist VLA models.
2.2 Failure Detection Robot Manipulation
Monitoring failures is critical when deploying robotic policies in real-world environments, as even minor errors can result in hazardous conditions [34 The literature on failure detection robot
learning can be broadly divided into unsupervised out-of-distribution (OOD) detection ( [7] and

---

supervised failure detection 12 16 37 OOD detection baaee methods treat successful executions as the in-domain baseline and consider any deviation from this norm as a failure. However, the assumption that any unseen scenario constitutes a failure is overly restrictive for generalist VI.As, which may frequently encounter unseen tasks at test time. These unseen tasks are likely different from the in-domain training data but should not be simply treated as failures. Our proposed method, SAFE, falls within the supervised failure detection category, leveraging both successful and failed rollouts to train failure classifier. Unlike existing methods that train and calibrate separate classifiers per task, SAFE uses single unified failure detector and works effectively on generalist policies like VLAs. Some recent works have explored multitask failure detection by designing action consistency scores 18 or instruction finetuning& instrungton-fieetuiingg a VLM [9 20]. but they require either sampling multiple actions or querying a large VLM, which poses significant overhead for controlling robots in real time.
Recently, FAll--Detect R conducted systematic evaluation of various failure detection methods, including OOD detection-based approaches (9 38 39], smoothness- based techniques [40], and consistency-baset -based strategies
[18] Their experiments indicate that the best performance was achieved by LogpZO, which learns a proxy for the likelihood of the data in the observation embedding space using flow matching [8]. However, their evaluation is limited to only single-task policies, and our evaluation in the multitask setting shows that their best-performing LogpZO method suffers from overfitting to the training tasks.
2.3 Uncertainty Quantification for LLM
Although LLMs and VLMs have demonstrated remarkable understanding and generative capabilities across various tasks, they are prone to producing hallucinated responses 441 Numerous methods have been developed for uncertainty quantification (UQ) in LLMs/VLMs. Token-level uncertainty quantification methods estimate uncertainty by analyzing the probability distribution over each generated token to assess the likelihood of an entire response 44). Semantic-sinilarity methods generate multiple responses to the same query and evaluate their semantic alignment (2 47 48]
higher variance among responses typically signals low confidence. Since vision- language-action models (VLAs) share the generative nature and transformer architecture of LLMs/VLMs, we adapt these UQ methods to VLAs as promising baselines and evaluate their performance failure detection. Note that these UQ baselines are used as a proxy for failure detection, assuming that when a policy becomes uncertain about its actions, it will have higher probability of failing the task. Recent research has also explored the internal latent space of LLMs for hallucination detection (5) These methods train classifier internal latent features to distinguish between truthful and hallucinated outputs, paralleling supervised failure detection techniques in robotics. This approach has proven to be simple, efficient, and effective for UQ in LLMs. In our study, investigate its application to large VL.A policies and observe promising performance in robotic tasks.
3 Problem Formulation
This work aims to detect when a robot policy fails during task execution. Specifically, we develop a multi-task failure detector that performs well when generalist VLAs encounter novel tasks at inference time. At timestep f, a VLA is given an input observation og, consisting of RGB images, natural lan- guage instruction, and current robot state, and outputs a control signal A, = [ar, ar41, -1-- which is a chunk of actions for the next H timesteps. The first H' (H' < H) actions in A, are executed, and then the VLA replans new action sequence At+ at time + H' We denote the internal embedding vector within the VLA model at time L as ey- Some VLASs I 2 series of m tokens W,- [w?..... w before converting them into the actual action vector. To train and evaluate failure detection models, we run the VLA on different tasks in simulation or the with time duration
4 5) also decode
real world, collect the rollout trajectory т; = {(O,,, e,, W,, 1 T = nH', and annotate each rollout with a failure label (3/- 1 if the robot fails to accomplish the task and y 0 if the robot succeeds). Note that for training, we only use the trajectory annotation yı, and do not require knowing the exact timestep when the policy starts to fail. A failure detector receives the rollout information up to time and predicts failure score 8t, indicating the likelihood of task execution failure at time L. If 8, exceeds threshold o,, failure flag is raised, and then either the task execution aborted or a human monitor will step and take over the control. In this work, we use conformal prediction [58) to calibrate the threshold 6,
3

---

Different tasks
Same "fallure zone
Successtul
t=7
(e) t-SNE of policy latent features, colored by task success
(b) t-SNE of policy latent features, colored by task ID.
Successful rollout: "Tur on the stove and put the maka it'
Failed rollout:
"Turn on the stove and put the maka pot an it"
Failure
Successful failed rollouts
Occurs
Figure The internal features of a VLA capture high-level information about task success and failure. When the VLA is failing, the features, even those from different tasks, fall into the same "failure zone". This motivates SAFE, an efficient multitask failure detector that is based on VLA internal features and can generalize to unseen tasks. Plot (a) visualizes the latent features of To- ---FAST on LIBERO-10 (56] using t-SNE [57]. For successful rollouts, features are colored in blue. For failed rollouts, features follow blue-to-red gradient based on timestep progression, with red corresponding to later timesteps that often coincide with failure. Plot (b) visualizes the same set of t-SNE features, colored by task IDD. In (c), show two example rollouts over time and mark their corresponding projected features in (a) and (b).
In experiments, we split all tasks into seen and unseen subsets, where rollouts from seen tasks are used for training Denin and validation Deval-wen. and all rollouts from unseen tasks Deval-unseen are reserved for testing the cross-task generalization ability of failure detectors. Failure detectors are trained on Diiin and evaluated on Deval-seen for hyperparameter tuning and in-domain performance, and tested on Deval-unsecn for out-of- distiiittinttonn generalization.
4 Method
4.1 Visual Analysis on VLA Latent Space
VLAs process multi-modal inputs and extract rich semantic information in their internal feature space. We hypothesize that these features also capture the high-level and abstract knowledge about task execution success/failure, by separating features from successful/filled rollouts into different regions. We study this hypothesis by visualizing the VLA features in Fig. [ where we plot the internal features from T--FA FAAT((() when running the LIBERO- benchmark [56]. Fig. T[a) demonstrates that when the VLA is failing, its internal features are grouped in the same region in the feature space ("failure zone"). Comparing Fig. a and Fig. [[bb, we can further see that although the features are extracted from different tasks with various instructions, objects and environments, when the VLA fails, its features fall in the same "failure zone". Fig. (T) further illustrates how VLA's features evolve in the feature space when VLA progresses temporally. From Fig. Cc.
see that failure rollout initially stays out of the "failure zone" when progresses normally, and when the robot mistakenly drops the pot in the middle of execution and starts to fail, steps into the "failure zone". On the contrary, for the successful rollout, its features always stay out of the "failure zone".
This visual analysis shows that the VLA's internal features for succeeding and failing task executions are well separated in the feature space, and this separation is general across different tasks. Further- more, during task exccution, the features reflect how well the VLA performs the current tasks in

---

1. Extract Latent features from VLA models
Learning the failure predictor, SAFE
Calibrate failure detection threshold and deploy
Action:
SAFE-MLP
Pradiction from call arlan rollouts
Failure detection
threshold
Auntiinnl
contoral
Threshaldh
Decoder
$3
8T
predictoo
Wathh
VLA Model
Cc
Meanjl
Timet
Encoder
fellunas relloul
SAFE-LSTM
LSTM
LSTM
LSTM
LSTM
Observation
Instruction
Figure 2:
The proposed failure detector, SAFE, has three major components: (1) SAFE extracts the latent feature from the last layer of a VLA model; (2) SAFE sequentially processes the latent feature and predicts failure score, using MLP an LSTM backbone; and (3) SAFE determines a time-varying threshold using functional conformal prediction (CP) on hold-out calibration set. If the predicted score exceeds the threshold during testing, SAFE confidently detects a failure.
timely manner. Inspired by this observation, we design SAFE, which uses the internal features of VLAs for failure detection. overview of the proposed method is shown in Fig. 2
4.2 Failure Detection by Feature Probing
We design SAFE to learn the abstract information from the VLA's internal features and determine whether the task execution failing. We extract the VLA's hidden state vectors from the final layer, before being decoded to token logits 2 [ or a velocity field [4. We ablate different ways to aggregate the internal features into a single embedding vector e, and select the best one based on Deval-seen performance. Please refer to Appendix for details on VLA feature extraction.
The failure detector f(eu:) takes input the VLA's features eu: fee..... e, up the current timestep I, and is trained to predict 8t. We explore the two backbone designs for SAFE: a multi-layer perceptron (JMLP) and LSTM [59] (fLSTM). Both models designed to be simple (only two layers), to avoid overfitting and improve generalization ability on unseen tasks. For fMLP, we use an MLP g(-) to project e, into a single scalar for each timestep independently and accumulate the outputs as the failure score, i.c. fMLP(e0.a) = Er=I..., a (g(e))) )), where (-)) is a sigmoid function and therefore < s, < tt To train the MLP model, we apply an L1 loss on all timesteps push up the scores for failed rollouts and push down those for successful ones. Specifically, LMIP E, ly; E.(1 -x) )-)) + +1 y1) Σ. st], where index iterates over all data points in Dimin-
For fLSTM, use LSTM model to sequentially process the input stream of VLA's features Co.: and project the hidden state vector of LSTM into a scalar score. Specifically, (est)( = o (LSTM((e::)
where sigmoid function o--) is applied to normalize the output score s.t. 0 8; < 1. To train the LSTM model, we apply a binary cross entropy loss on all timesteps, i.c. LISIM Σ, E, [y log(s:) (1 y.) log(1 =s]]]
4.3 Threshold Selection by Conformal Prediction
When the predicted failure score s, exceeds the time-varying threshold o, we raise a failure flag. To determine 5, in principled way, we adopt the functional conformal prediction (CP) framework [21]. Functional CP constructs a time-varying prediction band by leveraging the distribution of s; observed in successful rollouts within calibration set. Under the exchangeability assumption [60] and given
user-specified significance level a, the CP band guarantees that, for a new successful rollout, its s will lie within this band all times with probability 1 a. Conversely, if the score of test rollout exceeds the band at time f, we can declare a failure with nominal confidence a.
Formally, given a time series of any scalar score and a user-specified significance level E (0, 1), functional CP gives a distribution-fres prediction band C.. Following Xu et al. [ we adopt the one-sided time-varying CP band formulation, where Ca. is a set of intervals [lower,, upper,] :
5

---

Table 1: Failure detection results on simulation benchmarks, measured by area under ROC (ROC- AUC). "-" indicates that the failure detection method does not apply. Entries with gray background indicate the failure detection methods that sample 10 actions per inference timestep, while others use only action. The first and second best-performing methods are colored in red and orange, respectively. Results are averaged over random seeds with different splits of seen and unseen tasks. SAFE achieves the highest averaged ROC-AUC over all simulation benchmarks.
Renchmark
VLA Model
OpenVLA LIBERO
No. FAST
LIBERO
LIBERO
50 SimplerFav Unseen
Average
Eval Task Split
Seen
Unseen
Seen
Unseen
Seen
Unseen
Seen
Seen
Unseen
Max prob.
50.25
53.83
61.32
69.44
55.79
61.64
'Token Usc.
Avg prob.
44,05
51.58
52.46
58.04
48.26
54.81
Max entropy
52.94
$3.09
46.69
62.96
49.81
58.03
Avg entropy
45.27
50.03
50.93
58.63
48.10
54.33
Mahalanobis dist.
62.03
58.85
93.56
83.79
77.12
74.31
88.42
$2.84
80.28
67.45
Fuclidean dist. R-NN
66.00
55.23
92.04
84.12
75.64
70.73
89.73
68.41
80.85
69.62
Embed, Distr.
Cosine dist. K-NN
PCA-KMeans 9
57.18
67.09
69.45
55.10
68.46
92.09
57.12
84.64
75.76
64,92
60.35
70.31
66 88
90.19
71.32
61.19
81.28
64.36
58.44
73.93
RND 33
52.57
46.88
88.67
81.57
71.92
69.44
85.07
65.89
74, 56
65.99 95
Logp70 8
61.57
52.91
91.52
83.07
76.80
73.23
88.79
74.66
79.67
70.97
Action tital var.
62.76
65.43
76.95
74L50
77.20
75.18
68.41
67. 94
71.33
70.76
Trans. total var.
55.33
58.99
78.21
80.03
63.27
55.90
62.41
Sample Consist.
Rot. total var.
47.85
$5.30
80.87
77.29
52.94
61.06
58.07
62.10
59.93
63.94
Gripper
61.84
64.48
76.82
74.42
77.19
69.16
69.29
71.25
Cluster eatrupy
50.16
51.44
80.22
80.53
76.19
72.12
68.25
73.66
68.71
69.44
Action Consist.
STAC-Single
STAC [8
85,46
83.07
85.31
81.16
68.46
69.39
47.91
68.71
62.21
70.40
63,45
74.21
73.65
SAFE' (Ours)
SAFE-LSTM
SAFE-MLP
72.68
70.24
72.47
73.47
90.06
92.98
84,48
80.44
73,50
76.98
71.09
73.27
89.50
88.85
84.82
80.11
81.43
82.26
77.04
78.00
1, ....., T) where lower, oo and upper, = Me he, with a time-varying mean (4r and bandwidth
he This band is calibrated on successful rollouts in Doval-sen- Under mild assumptions [61 62], for any new successful rollout, s, < fe + he holds for all this gives a guarantee that the false positive rate of the failure detector (a failure flag is raised at any time during successful rollout) is at most a. We use upper, as the failure flag threshold 5,, and more
. I' with probability 1 a. Intuitively.
details about functional CP can be found in Appendix.
5
Experiments
5.1 Evaluation Benchmarks
LIBERO [56 The LIBERO benchmark has been widely adopted for evaluating VLA models in simulation 6. Among the LIBERO task suites, the LIBERO- 10 suite consists 10 long-horizon tasks with diverse objects. layouts, and instructions. and is considered the most challenging one. Therefore, we use LIBERO-10 in our experiments and test Open VL. 2 To 4 and Fo-T (5) on it. We adopt the model checkpoints that are finetuned on the LIBERO benchmark and released by their authors. In experiments, 3 out of 10 tasks are randomly picked and reserved as unseen tasks.
SimplerEnv [63]: SimplerEnv provides a high-fidelity simulation environment for manipulation policies, which are replicas of the demonstration data from RT-series [T] 7 31 and BridgeData
V2 [33] On SimplerEnv, we test pretrained Ty models from a reproduction (64, which we denote as T6 in this paper. We train and evaluate the failure detection methods on the Google Robot embodiment [1] and on the WidowX embodiment (33), respectively. We exclude the "pick up coke" task because TH rarely fails on (success rate at 98%). This leaves 4 tasks for each embodiment, among which 3 tasks are seen and 1 task is unseen.
We deploy the FO--AAT-DOOID checkpoint 4 5 on a Franka Emika Panda Robot. This checkpoint has been finetuned on the DROID dataset 332. and we do not further collect demonstrations or finetune the VLA model. We design 13 tasks and collect 30 successful and 30 failed rollouts for each task. The real-robot setup and example rollouts are visualized in Fig. 3 In experiments, tasks out of 13 are randomly selected as unseen tasks.
Real-world Franka Experiments:
Real-world WidowX Experiments: We also deploy the Open VLA model pretrained on the "Open-X Magic Soup++" dataset (2) WidowX robot manipulator in our lab. With this setup, collected

---

pick place
pick up place cup"
ZED Camera
AAA battery"
WidowX 250 Robot
carrot plate"
Figure 3: Illustration of real-world experiment setup (left) and example rollouts collected (right).
total of 532 rollouts on the 8 lifting and pick-and-place tasks, including 244 successful and 288 failed rollouts. this experiment, 2 tasks out of 8 are randomly selected as unseen tasks.
5.2 Uncertainty Quantification Baselines
Estimating uncertainty in generated responses has been widely used to detect truthfulness or halluci- nation LLMs [22] 23 43 65). For VLAs, uncertainty in the generated actions may indicate lack of ability to solve the given task, and thus correlates with task failures. Therefore, first adapt the UQ methods from the LLM literature to VLAs and use them as failure detection baselines.
Token uncertainty-basee methods aggregate the predictive uncertainty from each generated token. These methods are efficient, as they only require a single forward inference. Given the generated tokens W, [w!..... w.'). we denote the probability of sampling the token w p; and the entropy over the distribution of the 7th token H,. We adopt the token-based uncertainty estimation methods used by Huang al. (22) as follows:
Token max prob.: max; logg:);
Token avg prob.: - - L. lggp; "
Token max entropy: max; H;: Token avg entropy: m Σ, H,
Sample consistency- -ased methods estimate uncertainty as the inconsistency within multiple gen- For VLA models, the output actions are continuous vectors, and we can measure inconsistency by their variance. Specifically, at time f, given K sampled actions A {A} k= K. measure the uncertainty the total variation over the total var. = trace(cov(A.)). Similarly, we also compute variation for the translational (trans. total var.), rotational (rot. total var.), and gripper control (gripper total var.) components of A..
erated sentences [22 23 65
vectors: action
Furthermore, inspired by semantic entropy 23
we define cluster entropy as integer set, containing A clus-
entropy(cluster( J=m,,,... )), where cluster(-) generates ter labels for the & actions and entropy(-) measures the entropy of the integer set. UQ methods based on sample consistency shown perform better for L.MM 222 23) but they necessitate multiple inferences, which may not be practical for large VLAs that control robots in real time.
5.3 Failure Detection Baselines
compare to baselines that directly use distances the feature space as failure scores. Specifically, instead of training neural network, all VI.A embeddings from D are stored the two feature sets, Pance and Fran, containing all VLA embeddings from successful and failed rollouts, respectively. During evaluation D Doval-soon and D Devll-mscco- failure scores
Embedding Distance:

---

LIBERO
1.0
Method
Bolanced Acares
0.8
B3lncdd ACCUIDSY
Max prob
Avg
Max entropy
0.7
0.7
entropy
Mahalannbis
Euclidean dist. NN
Cosine dist. K-NN
0.5
PCA-KMeane
RND
Ta UBBRRO
ng SimplerEnw
LogpZo
Action total van
0.8-
0.83
Trans, total var
Salroad Salmiad Acorss)
0.75
0.7
0.73
Gripper total var.
0.45
Cluster entropy
0.63
STAC-Single
0.35
SAFE IFEELLTMM
0.5
0.30
0.43
GT Aug Fall Time
Detection
Average Time NNomalized
Figure 4: In all simulation experiments, the proposed SAFE-LSTM and SAFE-MLP perform better than or on par with the best baselines. The plots show the variation of balanced accuracy (bal-acc) with respect to average detection time (T-det) on 'D eval-unseen- under different significance levels a used for functional CP. Good failure detection methods should detect policy failures both accurately (high bal-acc) and proactively (lower T-det), and thus place curves towards the top left in each plot. Note that baselines in gray require multiple action samples.
computed as 8t = d(e,, Esuce) d(e,, Emat). where d(-,-) measures the distance between a single vector and a set vectors. Intuitively, if e, is far from Fsace and close to Frm, it's more likely to fail. Following recent works [TO] 18 66). we ablate different types of distance, including Mahalanobis distance, and Euclidean and Cosine distance averaged over l--eerest Neighbors of et. We also compare to the PCA- KMeans distance measure from Liu et al. [9.
Learned OOD Detector: Following Xu et al. 8 we adopt LogpZO, the best-performing method, and RND 339 strong baseline, for OOD detection-based failure detectors. Both methods use neural network food (.) to model the embedding distribution from successful rollouts and return an OOD score for new embedding. We adapt them to learn from both successful and failed rollouts by training two models, f (.) and ffall (000()))
(-), on Exuce and Erai respectively. Similar to embedding distance baselines, the failure score is computed 8 food (e,) f (ex).
(e))
Action Consistency: STAC 18 detects policy failures by measuring the statistical distance on the overlapping segment of two consecutive predicted action chunks. As it requires sampling multiple actions from the policy ( ([18) uses 256 actions), it compromises real-time operation for real robots, because unlike relatively small diffusion policy networks, large VLAs are not optimized for parallel inference] Therefore, we only test STAC in the simulation experiments with 10 sampled actions. We also adopt STAC-Single, real-time version of STAC, which computes action inconsistency using only one sample from each inference timestep. Since OpenVI.A only outputs one-step immediate action (H- 1). STAC and STAC-single do not apply
5.4 Evaluation Protocol
We consider two types of evaluation. The first type evaluates how well 8, separates the successful and failed rollouts across all possible selections of 6, Following the evaluation protocol widely adopted in the LLM UQ literature [22 49 53 68), we use the area under the ROC curve (ROC-AUC) metric. Furthermore, because failure flag is raised whenever s, exceeds 8, successful rollout (ground truth negative) becomes a false positive whenever s; dG, and remains true negative only if s, S ö, for all time. Therefore, we consider the max-so-far score 8, max,=1,...ff and compute the ROC-AUC metric based on Sr, the maximum failure score throughout the entire rollout.
wo is 152% slower and To-FAST is 221% slower to generate 10 action samples compared to I sample, tested on single NVIDIA RTX 3090 GPU, with vmap optimization and JiT compilation in Jax [67]. For comparison, SAFE methods only add negligible overhead (<lms, or <1% of the inference time of and -ASFTT

---

0.8
0.8
0.8
Sooee
9.6
0.5
02-
0.2
100
200
300
400
530
100
200
300
420
500
10
20
30
50
Time step
Tire stlep
Time step
(8) FAST. "Pick up book end place in bock compartment of caddy"
(b) OpenVLA. "Put elohabet
(c) Kg. "Put the carrot on the plate"
and tomato seuce basket"
Figure 5: Failures detected by SAFE-LSTM align well with the actual robot failures, as shown in the corresponding camera observations from simulation experiments. The blue-shaded areas show the functional CP band C. Once failure scores exceed Ca. a failure flag is raised. In (a), the T--FATT policy misses the insertion, and its actions become unstable after that. In (b) and (c), Open VLA and To miss the grasp but still proceed to the placing action, causing failure detection. Note that these tasks are not seen when training SAFE-LSTM.
The second type of evaluation utilizes 6, upper, calibrated by functional CP in Section 4.3 By set- ting the significance level a, we get a decisive positive/negative detection for each rollout. Following related works 18), consider the following metrics: true positive rate (TPR), false positive rate (FPR), balanced accuracy (bal-acc), and averaged detection time (T-det), where Bal-Acc TPR+TNR T-det is the relative timestep where 8, > 6, for the first time (if 8; never exceeds 6,, T-det becomes 1), averaged over all ground truth failed rollouts.
6 Results
6.1
How well do failure detectors distinguish failures from successes?
In Table and Fig. 6 (a), we report the ROC-AUC metric based on ST, in simulation and real- world experiments, respectively. With higher ROC-AUC metric, failure detector achieves higher accuracy averaged over all possible thresholds. The tables show that Token Unc. methods have poor performance, which is aligned with findings in the LLM literature 22, 23 On the other hand, the Sample Consist. and STAC [8] methods, which require multiple action samples, perform better and even achieve the best performance on unseen tasks in - LIBERO (STAC) and To LIBERO (Gripper total var.). However, as these methods require multiple action samples, they cause significant overhead for VLA models and thus are not currently practical for real robots. Embed. Distr, methods perform well, achieving the best performance two simulation benchmarks (wo and To-FAST) and are the second best in the real world. This demonstrates that VLA's internal features are informative about task execution success/failure. The proposed SAFE methods perform better or par with the best basclines, consistently in all settings. Averaged across simulation benchmarks, SAFE-MLP and SAFE-LSTM have similar performance, both outperforming the best bascline by 4-5% unseen tasks, while still achieving the best performance experiments, on both To -.-FFTFFraakka and Open VLA+ Widow rollouts, SAFE-MLP achieves the best performance and SAFE-LSTM performs closely with the best baseline (Mahala. dist. and Euclid. k-NN). Comparing SAFE with Embed. Distr. methods, we attribute the success of SAFE to its stronger ability extract high-level abstract information from raw feature vectors through learned neural networks.
tasks. For the real-robot
6.2 What is the trade-off between detection accuracy and time using functional CP?
In Fig. we use Deval-seen to calibrate the functional CP band Ca and evaluate on Deval-unsen- By varying the user-specified we can adjust the conservativeness of the failure detectors and obtain trade-off between accuracy (bal-acc) and detection time (T-det). A good failure detector should detect failures both accurately (higher bal-acc) and promptly (lower T-det), and thus have the curve rise toward the top-left corner in the plots of Fig. As we can see from Fig. Al the proposed SAFE-MLP and SAFE-LSTA perform the best Open + and Simmpleerrn benchmarks, and

---

<c-FAST Franka
WidowX
Method
Max poob.
53.74
48.59
50.77
54,25
Avg proh
$1.60
47.30
45.34
44.36
Max entopy
59.23
53.50
51.88
49.19
430
286
66
46.08
47.72
53.84
(b) "prik ap sarcke and place in rup" plateeus after task success
(0) "put cup the aginigle position
Mihala, dist.
53.93
70.00
platonus after tisk success
J-NN
Cosine E-NN
80:23
59.51
74.76
65.88
PCA-KMeans
49.98
51.05
75.62
47.22
RND
62.00
25,83
66.68
47.67
LoggZO
52.24
62.94
51.32
STAC-Sing'e
SAFE-LSTM
SAF-MLP
86.76
64.16
89.11
88.42
(d) "por both carror and bull to the bows"
(e) "pucck up lintle and put it on plate" Knite drupped after picked up
(a) Failure Delection ROC-AUC
Policy
Figure 6: SAFE-MLP achieves the best failure detection performance real-world experiments with both To -AST Franka and OpenVLA WidowX. Plot (a) presents quantitative results, while (b-e) show qualitative examples from SAFE-MLP on the real robot. ROC-AUC values are averaged over five random seeds with different task splits.
on par with the best baseline on the other two benchmarks. We also manually annotate the ground truth (GT) failure timesteps (when a human thinks that failure happens or intervention is needed) for failed rollouts, and plot them as blue vertical lines in Fig- M Comparing SAFE's performance with the GT fail time, we can see that SAFE can detect failures with high accuracy in the early stages of rollouts and potentially before the failure happens. This early detection allows early intervention for policy failures before they get stuck execution or cause harm to the real-world environment.
6.3 What failure modes are detected, and do they align with human judgment?
In Fig. 5 and Fig. b-d)), we visualize rollouts with the failure scores detected by SAFE. Fig. 5 demonstrates common failure modes in simulation, including imprecise insertion, oscillatory motions, and missed grasps. Two successful rollouts on the real robot are shown in 6[b-c, where failure scores stop increasing after task completion. For the failed rollouts, the failure flag raised after the policy is frozen (Fig. (11) or the object slips out of the gripper (Fig. 6o). This aligns well with human intuition. Please refer Appendix for video illustrations.
6.4 How efficient and practical is to deploy SAFE?
SAFE uses 1-2 layer MLP or LSTM and poses a minimal (less than 1%) computational overhead runtime, For example, SAFE-LSTM contains 2.3 million parameters and introduces an additional 0.73 ms inference time. This negligible compared to large VLA models. For instance, piO has 3.3 billion parameters and an inference time of 149 ms. SAFE only requires access to the latent features of VLA models and compatible with any white-box robot policies based on neural networks. However, SAFE does require deploying the policy and collecting successful and failed rollouts to train the failure detector before it can detect failures.
7 Conclusion
In this paper, introduce the multitask failure detection problem for generalist VLA policies, where failure detectors are trained only on seen tasks and evaluated on unseen tasks. We analyze VLA's internal feature space and find that the internal features are separated for successful and failed rollouts. Based on this observation, we propose SAFE. a simple and efficient failure detection method by operating the VLA's internal features. SAFE is evaluated on multiple VLAs in both simulation and the real world, and compared with diverse baselines. Experiments show that SAFE achieves SOTA results in failure detection, and aligns with human intuition.
Most recent VLAs have shown capabilities handling diverse modalities, controlling diverse embodiments, and learning latent actions from non-robotic action-less video data 69 77 This paper only considers multitask failure detection for manipulation tasks, and is not clear how well the failure detectors generalize across embodiments, sim2real or to action-less videos. Besides, SAFE only uses features from the last layer, and how to effectively aggregate information across multiple layers of VLA remains open question for future work.
Limitations:
10

---

Acknowledgments and Disclosure of Funding
The authors were partially supported by the Toyota Research Institute (TRI) and NSERC Discovery Grant. The authors thank Blerim Abdullai, Sebastian Aegidius, Jasper Gerigk, Ruthrash Hari, and Wei-Cheng Tseng for helpful discussions and feedback. The authors also thank the anonymous reviewers and area chairs for their constructive feedback.
References
[1] Authony Brohan, Noah Brown, Justice Carbajal, Yevgen Chebotar, Joseph Dabis, Chelsea Finn, Keerthana Gopalakrishnan, Karol Hausman, Alex Herzog, Jasmine Hsu, et al. Rt-1: Robotics transformer for real-world control at scale. arXiv preprint arXiv:2212.0688 2022.
[2] Moo Jin Kim, Karl Pertsch, Siddharth Karamcheti, Ted Xiao, Ashwin Balakrishna, Suraj Nair, Rafael Rafailov, Ethan P Foster, Pannag R Sanketi, Quan Vuong, Thomas Kollar, Benjamin Burchfiel, Russ Tedrake, Dorsa Sadigh, Sergey Levine, Percy Liang, and Chelsea Finn. Open- VLA: An open-source vision-languaae-actiinn model. In Pulkit Agrawal, Oliver Kroemer, and Wolfram Burgard, editors, Proceedings The 8th Conference on Robot Learning, volume 270 of Proceedings of Machine Learning Research, pages
PMLR, 06-09 Nov 2025.
[3] Octo Model Team, Dibya Ghosh, Homer Walke, Karl Pertsch, Kevin Black, Oier Mees, Sudeep Dasari, Joey Hejna, Charles Xu, Jianlan Luo, Tobias Kreiman, You Liang Tan, Lawrence Yun- liang Chen, Pannag Sanketi, Quan Vuong, Ted Xiao, Dorsa Sadigh, Chelsea Finn, and Sergey Levine. Octo: An open-source generalist robot policy. In Proceedings of Robotics: Science and Systems, Delft, Netherlands, 2024.
[4] Kevin Black, Noah Brown, Danny Driess, Adnan Esmail, Michael Equi Chelsea Finn, Niccolo Fusai, Lachy Groom, Karol Hausman, Brian Ichter, et al. To: A vision- aasion-language-attnn flow model for general robot control. arXiv preprint arXiv:2410.24166 2024.
[5] Karl Pertsch, Kyle Stachowicz, Brian Ichter, Danny Driess, Suraj Nair, Quan Vuong, Oier Mees, Chelsea Finn, and Sergey Levine. FAST: Efficient action tokenization for vision-language-action models. arXiv preprint arXiv:2501.09744 2025.
[6] Moo Jin Kim, Chelsea Finn, and Percy Liang. Fine-tuning vision-language-action models: Optimizing speed and success. arXiv preprint arXiv:2502.19645, 2025.
[7] Anthony Brohan, Noah Brown, Justice Carbajal, Yevgen Chebotar, Xi Chen, Krzysztof Choro- manski, Tianli Ding, Danny Driess, Avinava Dubey, Chelsea Finn, et al. RT-2: Vision-language- action models transfer web knowledge to robotic control. arXiv preprint 1.XXiv23077.1811 2023.
[8] Chen Xu, Tony Khuong Nguyen, Emma Dixon, Christopher Rodriguez, Patrick Miller, Robert Lee, Paarth Shah, Rares Ambrus, Haruki Nishimura, and Masha Itkina. Can we detect failures without failure data? uncertainty-awarc runtime failure detection for imitation learning policies. arXiv preprint arXiv:2503.0m 08558, 2025.
[9] Huihan Liu, Yu Zhang, Vaarij Betala, Evan Zhang, James Liu, Crystal Ding, and Yuke Zhu. Multi-task interactive robot fleet learning with visual world models. In 8th Annual Conference on Robot Learning (CoRL), 2024.
[10] Rohan Sinha, Amine Elhafsi, Christopher Agia, Matthew Foutter, Ed Schmerling, and Marco Pavone. Real-time anomaly detection and reactive planning with large language models. In Robotics:
Science and Systems, 2024.
[11] Josiah Wong, Albert Tung, Andrey Kurenkov, Ajay Mandlekar, Li Fei-Fei, Silvio Savarese, and Roberto Martín-Martín. Error-aware imitation learning from teleoperation data for mobile manipulation. In Aleksandra Faust, David Hsu, and Gerhard Neumann, editors, Proceedings of the 5th Conference on Robot Learning, volume 164 of Proceedings of Machine Learning Research, pages 1367-1378. PMLR, 08-11 Nov 2022.

---

[12] Huihan Liu, Shivin Dass, Roberto Martín-Martín, and Yuke Zhu. Model- runtime moni- toring with interactive imitation learning. In 2024 JEEE International Conference on Roboties and Automation (ICRA), pages 4154 4161. IEFE, 2024.
[13] Cem Gokmen, Daniel Ho, and Mohi Khansari. Asking for help: Failure prediction in behavioral cloning through value approximation. In IEEE International Conference on Robotics and Automation (ICRA), pages 5821-5828. IEEE, 2023.
[14] Annie Xie, Fahim Tajwar, Archit Sharma, and Chelsea Finn. When to ask for help: Proactive interventions in autonomous reinforcement learning, Advances in Neural Information Processing Systems, 35:16918 --99180,--,,,,,--11101 2022.
[15] Rohan Sinha, Edward Schmerling, and Marco Pavone. Closing the loop runtime monitors with sallback-safe mpc. In Conference on Decision and Control (CDC), pages 6533-6540. IEEE, 2023.
[16] Alec Farid, David Snyder, Allen Z. Ren, and Anirudha Majumdar. Failure prediction with statistical guarantees for vision-based robot control. In Robotics: Science and Systems, 2022.
[17] Anirudha Majumdar, Mohit Sharma, Dmitry Kalashnikov, Sumeet Singh, Pierre Sermanet, and Vikas Sindhwani. Predictive red teaming: Breaking policies without breaking robots. arXiv preprint arXiv:2502.06557. 2025.
[18] Christopher Agia, Rohan Sinha, Jingyun Yang, Ziang Cao, Rika Antonova, Marco Pavone, and Jeannette Bohg. Unpacking failure modes of generative policies: Runtime monitoring of consistency and progress. In Proceedings The 8th Conference on Robot Learning, volume 270 of Proceedings of Machine Learning Research, pages 689-723. PMLR, 2025.
[19] Jiafei Duan, Wilbert Pumacay, Nishanth Kumar, Yi Ru Wang. Shulin Tian, Wentao Yuan, Ranjay Krishna, Dieter Fox, Ajay Mandlekar, and Yijie Guo. AHA: A vision-language-mon for detecting and reasoning over failures in robotic manipulation. arXiv preprint arXivv2410.00331,, 2024.
[20] Yuqing Du, Ksenia Konyushkova, Misha Denil, Akhil Raju, Jessica Landon, Felix Hill, Nando de Freitas, and Serkan Cabi. Vision- language models as success detectors. In Conference on Lifelong Learning Agents, pages 120-136. PMLR, 2023.
[21] Jacopo Diquigiovanni, Matteo Fontana, Simone Vantini, et al. The importance of being band: Finite-sample exact distribution-fri -fre prediction sets for functional data. STATISTICA SINICA. 1:1-41, 2024.
[22] Yuheng Huang, Jiayang Song, Zhijie Wang. Shengming Zhao, Huaming Chen, Felix Juefei-Xu, and Lei Ma. Look before you leap: An exploratory study of uncertainty measurement for large language models. arXiv preprint arXiv:2307.10236. 2023.
[23] Lorenz Kuhn, Yarin Gal, and Sebastian Farquhar. Semantic uncertainty: Linguistic invariances for uncertainty estimation in natural language generation. In The Eleventh International Conference on Learning Representations, ICLR, 2023.
[24] Haoyu Zhen, Xiaowen Qiu, Peihao Chen, Jincheng Yang, Xin Yan, Yilun Du, Yining Hong, and Chuang Gan. 3D-VI VLA: A 3d vision-language-action generative world model. arXiv preprint arXiv:2403.09631, 2024.
[25] Xinghang Li, Minghuan Liu, Hanbo Zhang, Cunjun Yu, Jie Xu, Hongtao Wu, Chilam Cheang, Ya Jing, Weinan Zhang, Huaping Liu, Hang Li, and Tao Kong. Vision-language foundation models as effective robot imitators. In The Twelfth International Conference on Learning Representations, ICLR, 2024.
[26] Aaron Grattafiori, Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Alex Vaughan, et al. The llama 3 herd of models. arXiv preprint arXiv:2407.21783, 2024.
12

---

[27] Lucas Beyer, Andreas Steiner, André Susano Pinto, Alexander Kolesnikov, Xiao Wang, Daniel Salz, Maxim Neumann, Ibrahim Alabdulmohsin, Michael Tschannen, Emanuele Bugliarello, et al. Paligemma: A versatile 3b vim for transfer. arXiv preprint arXiv:2407.07726, 2024.
[28] Siddharth Karamcheti, Suraj Nair, Ashwin Balakrishna, Percy Liang, Thomas Kollar. and Dorsa Sadigh. Prismatic VL.Ms: Investigating the design space of visually-condttioned language models. In International Conference on Machine Learning, pages 23123-23144 PMIR, 2024.
[29] Cheng Chi. Siyuan Feng, Yilun Du, Zhenjia Xu, Eric Cousineau, Benjamin Burchfiel, and Shuran Song. Diffusion policy: Visuomotor policy learning via action diffusion. Kostas Bekris, Kris Hauser, Sylvia I.. Herbert, and Jingjin Yu, editors, Robotics: Science and Systems, 2023.
[30] Junjie Wen, Yichen Zhu, Jinming Li, Minjie Zhu, Zhibin Tang, Kun Wu, Zhiyuan Xu, Ning Liu, Ran Cheng. Chaomin Shen, al. VLA: Towards fast, data-efficient caiionllnguage-action models for robotic manipulation. IEEE Robotics and Automation Letters, 2025.
[31] Open X-Embodiment Collaboration. Open x-embodiment: Robotic learning datasets and RT-X models. In 2024 IEEE International Conference on Robotics and Automation (ICRA), pages 6892,6903, 2024. doi: 10.1109//RRA57141 2ANCCRAA7714.2024..00 14617777.
[32] Alexander Khazatsky, Karl Pertsch, Suraj Nair, Ashwin Balakrishna, Sudeep Dasari, et al. DROID: A large-scale in-the-wild wild robot manipulation dataset. In Robotics: Science and Systems, 2024.
[33] Homer Rich Walke, Kevin Black, Tony Zhao, Quan Vuong, Chongyi Zheng, Philippe Hansen- Estruch, Andre Wang He, Vivek Myers, Moo Jin Kim, Max Du, et al. Bridgedata v2: A dataset for robot learning at scale. In Conference on Robot Learning, pages 1723-1736. PMLR, 2023.
[34] Rohan Sinha, Apoorva Sharma, Somrita Banerjee, Thomas Lew, Rachel Luo, Spencer M Richards, Yixiao Sun, Edward Schmerling, and Marco Pavone. A system-level view on out-of- distribution data in robotics. arXiv preprint arXiv: 14020, 2022.
[35] Rajesh Natarajan, Santosh Reddy, Subash Chandra Bose, HL Gururaj, Francesco Flammini, and Shanmugapriya Velmurugan. Fault detection and state estimation in robotic automatic control using machine learning. Array, 19: 100298, 2023.
[36] Quazi Marufur Rahman, Peter Corke, and Feras Dayoub. Run-time monitoring of machine learning for robotic perception: A survey emerging trends. IEEE Access, 9:20067-20075, 2021.
[37] Trevor Ablett, Filip Marić, and Jonathan Kelly. Fighting failures with fire: Failure identification to reduce expert burden in intervention-bant learning. arXiv preprint arXiv:2007.00245 2020.
[38] Chen Xu, Xiuyuan Cheng, and Yao Xie. Normalizing flow neural networks by jko scheme. Advances in Neural Information Processing Systems, 36:47379-47405 2023.
[39] Nantian He, Shaohui Li, Zhi Li, Yu Liu, and You He. ReDiffuser: Reliable decision-making using diffuser with confidence estimation. In International Conference on Machine Learning, pages 17921-17933. PMLR, 2024.
[40] Sivakumar Balasubramanian, Alejandro Melendez-Calderon. Agnes Roby-Brami, and Eti- enne Burdet. On the analysis of movement smoothness. Journal of neuroengineering and rehabilitation, 12:1-11, 2015.
[41] Miao Xiong, Zhiyuan Hu, Xinyang Lu, Yifei Li, Jie Fu, Junxian He, and Bryan Hooi, Can Ilms express their uncertainty? an empirical evaluation of confidence elicitation in lms.. In The Twelfth International Conference on Learning Representations, ICLR, 2024.
[42] Ziwei Ji, Nayeon Lee, Rita Frieske, Tiezheng Yu, Dan Su, Yan Xu, Etsuko Ishii, Yejin Bang, Andrea Madotto, and Pascale Fung. Survey of hallucination in natural language generation. ACM Comput. Surv., 55(12):248.1-248388 2023.
13

---

[43] Ola Shorinwa, Zhiting Mei, Justin Lidard, Allen Z Ren, and Anirudha Majumdar. A survey on uncertainty quantification of large language models: Taxonomy, open research challenges, and future directions. arXiv preprint arXiv:2412.05566 2024.
[44] Chen Ling, Xujiang Zhao, Wei Cheng, Yanchi Liu, Yiyou Sun, Xuchao Zhang, Mika Oishi, Takao Osaki, Katsushi Matsuda, Jie Ji, Guangji Bai, Liang Zhao, and Haifeng Chen. Uncertainty decomposition and quantification for in-context learning of large language models. In 2024 Annual Conference of the North American Chapter of the Association for Computational Linguistics, 2024. URL https://pppenrrriee..eeeeeeeeeee wtt..nn/ooorummmdddgggbbli
[45] Yijun Xiao and William Yang Wang. On hallucination and predictive uncertainty in conditional language generation. In Proceedings of the 16th Conference of the European Chapter of the Association for Computational Linguisties: Main Volume, pages 2734-2744 2021.
[46] Andrey Malinin and Mark J. F. Gales. Uncertainty estimation in autoregressive structured prediction. In 9th International Conference on Learning Representations, ICIR, 2021.
[47] Zhen Lin, Shubhendu Trivedi, and Jimeng Sun. Generating with confidence: Uncertainty quantification for black-box large language models. Trans. Mach. Learn. Res., 2024, 2024.
URI. htttps:/ http://www.eeeeoooommmddddaaaaa.
[48] Jiuhai Chen and Jonas Mueller. Quantifying uncertainty in answers from any language model and enhancing their trustworthiness. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 5186-5200 2024.
[49] Amos Azaria and Tom Mitchell. The internal state of an Ilm knows when it's lying. In Findings of the Association for Computational Linguistics: EMNLP 2023, pages 967-976, 2023.
[50] Kenneth Li, Oam Patel, Fernanda Viégas, Hanspeter Pfister, and Martin Wattenberg. Inference- time intervention: Eliciting truthful answers from a language model. Advances in Neural Information Processing Systems, 15:41451-411500 2023.
[51] Collin Burns, Haotian Ye, Dan Klein, and Jacob Steinhardt. Discovering latent knowledge in language models without supervision. In The Eleventh International Conference on Learning Representations, ICLR, 2023.
[52] Xuefeng Du, Chaowei Xiao, and Sharon Li. HaloScope: Harnessing unlabeled 11m generations for hallucination detection, Advances in Neural Information Processing Systems, 37:102948- 102972, 2024.
[53] Jannik Kossen, Jiatong Han, Muhammed Razzak, Lisa Schut, Shreshth Malik, and Yarin Gal. Semantic entropy probes: Robust and cheap hallucination detection in llms. arXiv preprins vrXiv:2406.15921 2024.
[54] Chao Chen, Kai Liu, Ze Chen, Yi Gu, Yue Wu, Mingyuan Tao, Zhihang Fu, and Jieping Ye. INSIDE: Ilms' internal states retain the power of hallucination detection. In The Twelfth International Conference on Learning Representations, ICLR, 2024.
[55] Seongheon Park, Xuefeng Du, Min-Hsuan Yeh, Haobo Wang, and Yixuan Li. How to steer 11m latents for hallucination detection? arXiv preprint arXiv:2503.01917 2025.
[56] Bo Liu, Yifeng Zhu, Chongkai Gao, Yihao Feng. Qiang Liu, Yuke Zhu, and Peter Stone. Libero: Benchmarking knowledge transfer for lifelong robot learning. Advances in Neural Information Processing Systems, 36:44776 447991 2023.
[57] Laurens Van der Maaten and Geoffrey Hinton. Visualizing data using t-sne. Journal of machine learning research, (11). 2008
[58] Anastasios N Angelopoulos and Stephen Bates. A gentle introduction to conformal prediction and distribution-free uncertainty quantification. arXiv preprint 1, 2021.
[59] Sepp Hochreiter and Jürgen Schmidhuber. Long short-term memory. Neural computation, 98): 1735-1780, 1997.
14

---

[60] Vladimir Vovk, Alexander Gammerman, and Glenn Shafer. Algorithmic learning in a random world, volume 29. Springer, 2005.
[61] Chen Xu and Yao Xie. Conformal prediction for time series. IEEE Transactions Pattern Analysis and Machine Intelligence, 45(10): 2023, doi: 10.1109/TPAM.2003. 3272339.
[62] Chen Xu and Yao Xie. Sequential predictive conformal inference for time series. In International Conference Machine Learning, pages 38707-38727. PMLR, 2023.
[63] Xuanlin Li, Kyle Hsu, Jiayuan Gu, Oier Mees, Karl Pertsch, Homer Rich Walke, Chuyuan Fu, Ishikaa Lunawat, Isabel Sieh, Sean Kirmani, et al. Evaluating real-world robot manipulation policies in simulation. In 8th Annual Conference on Robot Learning. 2024.
[64] Allen Ren. open-pi-zero: Re-implenentaation of piO vision-languagg-actionn (vla) model from physical intelligence. httts:///iithup: com / a 0.1.1, released January 27, 2025. Accessed April 6, 2025.
2025. Version
[65] Yashvir S Grewal, Edwin V Bonilla, and Thang D Bui. Improving uncertainty quantification in large language models via semantic embeddings. arXiv preprint arXiv:2410.22683, 2024.
[66] Julia Nitsch, Masha Itkina, Ransalu Senanayake, Juan Nieto. Max Schmidt, Roland Siegwart, Mykel Kochenderfer, and Cesar Cadena. Out-of-distributie detection for automotive per- ception. In IEEE International Intelligent Transportation Systems Conference (ITSC), pages 2938-2943. IEEE, 2021.
[67] James Bradbury, Roy Frostig, Peter Hawkins, Matthew James Johnson, Chris Leary, Dougal Maclaurin, George Necula, Adam Paszke, Jake VanderPlas, Skye Wanderman-Miln and Qiao Zhang. JAX: composable transformations of Python+NumPy programs, 2018. URL
http://gith:: cttcchub.comjjaaa com/jax-ml/jan
[68] Mingjian Jiang, Yangjun Ruan, Prasanna Sattigeri, Salim Roukos, and Tatsunori Hashimoto. Graph-based uncertainty metrics for long-form language model outputs. arXiv preprint arXiv:2410.20783, 2024.
[69] Physical Intelligence, Kevin Black, Noah Brown, James Darpinian, Karan Dhabalia, Danny Driess, Adnan Esmail. Michael Equi, Chelsea Finn, Niccolo Fusai, et al. To.s: a vision- language-action model with open-world generalization. arXiv preprint arXiv:2504.16054 2025.
[70] Johan Bjorck, Fernando Castañeda, Nikita Cherniadev, Xingye Da, Runyu Ding, Linxi Fan, Yu Fang. Dieter Fox, Fengyuan Hu, Spencer Huang, al. GROOT NI: An open foundation model for generalist humanoid robots. arXiv preprint arXiv:2503. 2025.
[71] Yaron Lipman, Ricky T. Q. Chen, Heli Ben-Hamu, Maximilian Nickel, and Matthew Le. Flow matching for generative modeling. In The Eleventh International Conference on Learning Representations, ICLR, 2023.
[72] Joe H Ward Jr. Hierarchical grouping to optimize an objective function. Journal of the American statistical association, 58(301):236 244, 1963.
[73] Arthur Gretton, Karsten M Borgwardt, Malte J Rasch, Bernhard Schölkopf, and Alexander Smola. A kernel two-sample test. The Journal of Machine Learning Research, 13(1):723-773 2012.
[74] Diederik P. Kingma and Jimmy Ba. Adam: A method for stochastic optimization. In Yoshua Bengio and Yann LeCun, editors, International Conference Learning Representations, ICLR, 2015.
[75] Isaac Gibbs and Emmanuel Candes. Adaptive conformal inference under distribution shift. Advances in Neural Information Processing Systems, 34: 14:1666-1672, 2021.
(76] Tianlong Wang, Xianfeng Jiao, Yinghao Zhu, Zhongzhi Chen, Yifan He, Xu Chu, Junyi Gao, Yasha Wang, and Liantao Ma. Adaptive activation steering: A funing-free 1lm truthfulness improvement method for diverse hallucinations categories. In Proceedings of the ACM on Web Conference 2025, pages 2562-2578. 2025.
15

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
We introduce the multitask failure detection problem and propose SAFE, efficient and scalable failure detector by exploiting the VLA's internal features. We have verified the claims with extensive simulated and real experimenst in Section
Justification:
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
is fine to include aspirational goals as motivation as long as is clear that these goals not attained by the paper.
2. Limitations
Question:
Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification:
We discuss the limitations of this work Section 7
Guidelines:
The answer NA means that the paper has limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (c.g.. independence assumptions, noiseless settings, model sell-speciiiatiinn asymptotic approximations only holding locally). ). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low or images are taken in low lighting. Or speech-to-tex, system might not be used reliably to provide closed captions for online lectures because it fails handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and faimesss.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community, Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
16

---

Answer:
[NA]
Justification:
This paper does not introduce new theoretical results.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced in the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Answer: [Yes]
Justification: We provide all implementation details about robot rollout generation, model architectures, training, and evaluation in Section 4, Section Appendix. Additionally, the source code for this paper has been released at http:://gihubb.co//lassstttt
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution a specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility instructions for how to replicate the results, access to a hosted model (e.g.. in the case of large language model), releasing of a model checkpoint, other means that appropriate to the research performed.
also be provided via detailed
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make it clear how to reproduce that algorithm.
(b) the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) If the contribution is a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reprodueibility may be tricky in some cases, in which authors are welcome to describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers have some path reproducing or verifying the results.
5. Open access to data and code
17

---

Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, as described in supplemental material?
Question:
Answer: [Yes]
The source code for this paper has been released at https://gituuh.com//aa safe/SAFE]
Justification:
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nnis.cc
aublicc/uudees/Codeuubbss caspssioooolyyyy for more details.
While encourage the release of code and data, understand that this might not be possible, so "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurlPS code and data submission guidelines (https
/ //nips. wttp:cppwccc..cieeeeeeeoeeppeeee
www.sssoiicgyyy for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the proposed method and baselines. only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended the paper) is recommended, but including URLs to data and code is permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: We provide implementation details, to our best effort, about robot rollout gen- eration, model architectures, training, and evaluation in Section 4 Section 5]d Appendix.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented the core the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, appendix, as supplemental material.
7. Experiment statistical significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer: [Yes]
Justification: All quantitative results are averaged over or 5 random seeds. The error bars are reported Appendix.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by emor bars, confi- dence intervals, or statistical significance tests, least for the experiments that support the main claims of the paper.
18

---

The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g.. Normally distributed errors).
It should be clear whether the error bar is the standard deviation or the standard error of the mean.
is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that out of range (e.g. negative error rates).
If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification:
We detail the compute resources in Appendix.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary failed experiments that didn't make into the paper).
9. Code of ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurlPS Code of Ethics
Answer:
[Yes]
Justification: This work conforms with the NeurlPS Code of Ethics.
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No. they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., there a special consid- eration due to laws regulations in their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification:
We discuss the potential societal impact in Appendix
Guidelines:
The answer NA means that there no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact why the paper does not address societal impact.
19

---

Examples of negative societal impacts include potential malicious unintended uses (e.g., disinformation, generating fake profiles, surveillance), faireess considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification:
We believe the proposed method does not have high risk for misuse.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Are the creators or original owners of assets (e.g.. code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [Yes]
Justification: All sources and licences have been accredited to the best of our knowledge. We provide the license information in Appendix.
Guidelines:
The answer NA means that the paper does use existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (e.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
20

---

If assets are released, the license, copyright information, and terms of use in the thcode. has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
package should be provided. For popular datasets, paperswi
batasets.papersstt
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided. If this information is available online, the authors encouraged to reach out the asset's s creators.
13. New assets
Question: Are assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
Justification: Releasing assets is not the main contribution of the paper, but we have released the source code along with appropriate documentation.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/mooel as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsoureing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification:
This paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then much detail as possible should be included the main paper.
According to the NeurlPS Code of Ethics, workers involved in data collection, curation, other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification:
This paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does involve crowdsourcing nor research with human subjects.
Depending the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
21

---

We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors adhere the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
16. Declaration of LLM usage
Does the paper describe the usage of LLMs if it is an important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, formatting purposes and does not impact the core methodology, scientific rigorousness, or originality of the research, declaration is not required.
Question:
Answer: [NA]
Justification: The core method development in this research does involve LLMs as any important, original, or non-standard components.
Guidelines:
The answer NA means that the core method development in this research does not involve LLMs as any important, original, non-standard components.
Please refer to our LLM for what should or should not be described.
22

---

Appendix
A Potential Societal Impact
This work advances the safety and reliability of VLAs through multitask failure detection, which can reduce unintended behaviors during robot deployment. However, the proposed framework could be misused in surveillance or fully autonomous systems with limited human oversight. Additionally, biases privacy issues may arise from training data collected during robot interactions. These risks can be mitigated through responsible data handling, transparency in model release, and maintaining human oversight in downstream applications.
B Experiment Details
B.1 Vision-Language-Attion Models
We conduct experiments on 3 state-of-the-an large VLA models: Open 12, To and To-
FAST [5. Given the internal feature vectors E E R Rnxdd produced by VLA model, where dimension n corresponds to different token positions, diffusion steps, etc. and d the feature dimension, we aggregate E into single fixed dimeediiens feature vector E R before inputting to the proposed SAFE models. In this paper, we consider and ablate the following ways feature aggregation:
First: take the first vector along the dimension n, e = E1;
Last: take the last vector along the dimension nI, e = En:
Mean: take average over the dimension n,, e 1 5 Fl;;
First&Last: concatenate the first and the last vector, e concat( Eo, E,) R2dd"
Both OpenVLA and To- FASTA first predict a sequence of discrete tokens and then convert them into continuous actions. We take feature vectors before being decoded into the output tokens from the last transformer block E E Raxd', and therefore corresponds to the number of generated tokens. We ablate the aggregation method along this dimension and denote the aggregation method ag9luken- For To FAST, additionally ablate using the feature vectors before ("encoded") and after ("pre-logits") the final RMS normalization layer as E.
Differently, To (and TT) outputs action vectors by flow matching 71. and we take the feature vectors before being projected into the velocity field. Suppose To predict an action chunk of horizon H and performs & flow matching steps, the internal features become E E R xkxd and we perform the aggregation process along the H dimension and the dimension separately to get the final embedding vector E gdd, The aggregation methods are denoted as agghori and aggainf along these two dimensions, respectively.
For all VLA models, we ablate different methods of aggregating the hidden features E into a single feature vector and select the best method according to Deval-senn performance. The detailed ablation results are shown in Appendix|BA. B.8
VLe and zū use MIT License; and FFAT use Apache-2.0 license.
B.2 SAFE Failure Detector
SAFE-LSTM uses an LSTM model with 1 layer and a hidden dimension of 256, and an additional linear layer is used to project the hidden states of LSTM into single scalar st SAFE-MLP uses multi-layer perceptron with 2 layers and a hidden dimension of 256. Since successes and failures from the generated rollouts are imbalanced, the losses on positive (failed) and negative (successful) rollouts are weighted by their inverse class frequency. We also apply an 1.2 regularization loss on the model weights to reduce overfitting, and this loss weighted by Arg and optimized together with the failure score learning loss LLSTM or LMLP. Areg determined by grid search.
23

---

B.3 Failure Detection Baselines
For the cluster entropy baseline, we use agglomerative clustering with the ward linkage criterion 72 The distance threshold is denoted as ò and decided by grid search.
For the STAC baseline [8]. we use the Maximum Mean Discrepancy (MMD) distance measure with radial basis function kernels, which was reported to have the best performance by [8]] The bandwidth of the RBF kernel is 1.
For all baselines except for RND 39 and Logp20 [] we ablate one version that only considers the failure score computed from the current timestep ("cumsum-false") and another that uses the cumulative sum (cumsum) of the failure scores over time ("cumsum=True"),
For RND and LogpZO, accumulate scores. (8), RND and LogpZO are trained to model the distribution of (encoded) observations o, and predicted actions Aç. In this work, we adapt them to model the distribution of VLA's internal embeddings e,.
the original implementation provided by the authors and do not
Note that as (and TT)) does not output discrete tokens. token uncertainty-based baselines do not apply. And for OLe H H' and thus the STAC [8] and STAC-Single do not apply.
B.4 Conformal Prediction
We follow [8 21 for CP band construction. Please refer to Section. B the Appendix of [8] for detailed formulation. Specifically, in our experiments, the adaptive modulation function (Equation in the Appendix of (8), which models the non-extreme behaviors of the functional data.
B.5 Benchmark Details
We adopt the LIBERO-10 task suite, which contains the most diverse set of objects, environments, and instructions among the 4 LIBERO task suites, and therefore LIBERO-10 is considered the most challenging task suite. LIBERO-10 contains 10 tasks with 50 rollouts in each task. We use the initial conditions for all rollouts specified and provided by the autho To test VLA models on LIBERO, we adopt the trained model weights provided by the respective authors and do not further finetune them. On LIBERO-10. VLe achieves a success rate of 53. 7%, To- achieves 60.2%, and achieves 85.2%. For evaluation, 3 out of 10 tasks are unseen, and within seen tasks, 60% of rollouts are used for Drain and the remaining 40% for Deval-seen-
LIBERO [56]:
Note that the LIBERO simulator stops the rollout execution when the robot finishes the task (con- sidered success) or a maximum rollout length is reached (considered failure). Therefore, in the generated rollouts, failed ones always have the maximum length, but successful ones are shorter. This could result in unfair advantage for some of the compared failure detectors (if failure detector simply learns to count the time elapsed, i.c., 8t t, it will achieve perfect failure detection since failed rollouts have a fixed and longer duration). To ensure a fair comparison, for evaluation in Table [ we compute the minimum rollout length for each task and use that as T for that task. The failure detection performance (in ROC-AUC) is then determined based on sy, where T is the same for all successful and failed rollouts within each task.
LIBERO benchmark uses the MIT license.
SimplerEnv carefully identifies and reduces the domain gap between the simulation and the real-world demonstration data, and provides simulated environments that highly resemble the demonstration data from RT-series I (TT (with the Google Robot embodiment) and BridgeData V2 B3 (with the WidowX embodiment). They show that models pretrained real-world datasets can also accomplish similar tasks in SimplerEnv without finetuning, and their performance in simulation matches that in the real world.
SimplerEnv 633:
On this benchmark, we adopt the pretrained model checkpoints of ş 64 Note that सğ model checkpoints are trained separately on the Google Robot embodiment and the WidowX embodiment, which results in two model checkpoints that have different internal feature spaces. Therefore, all
butps//githubb.om//iffloooo Robot http://w.......ooooooooooooooooe
24

---

Table List of tasks used in zi
SimplerEny benchmark.
Embodiment
Task ID
Environment Name
T6
Success Rate (%)
Google Robol
1
google_robot_move _erve___ee____
77
Google Robol
2
google_robot_open, drawer
50
Google Robot
3
google_rabot_close_
drawer
80
Google Robot
4
http:b/t._ppaeeepppeeeeee.eeeeee tor_draeer
40
WidowX
vidooz__carrot_on__laats
44
WidowX
vicoos_pur.eggplaattii.....
88
WidowX
vidovs__spoo__on_tos
79
WidowX
widowx_stack_cube
43
Table 3: List of tasks used in the real-world Franka experiments. Rollout Length T
Task
Instruction
close the door
300
close the drawer
200
3
pick up the ball and place it in the bowl
400
pick up the knife and put it on the plate
350
5
pick up the lid and place it the pot
400
6
pick up the lid from the pot and place it on the table
400
pick up the marker and place it in the cup
400
8
place the green block the yellow block
350
place the pink cup to the right of the blue cup
300
10
press the button
200
11
put both the carrot and the ball in the bowl
500
12
put the cup to the upright position
500
13
unfold the cloth
500
failure detectors are trained and evaluated on each embodiment separately as well. All reported evaluation metrics computed separately for each embodiment and then averaged. In Table 2 list the tasks used for failure detection on SimplerEnv. We generate 100 rollouts for each task with random initial configurations, and the success rates of mo on each task also listed in Table A rollout stops after the maximum number of allowed timesteps have passed, regardless of task success failure. Within each embodiment, out of 4 tasks is unseen, and within the seen tasks, 66% of the rollouts are in rrain and the remaining 33% in Deval-soen-
SimplerEnv benchmark uses the MIT license.
Real-world experiments with Franka robot: In Table we list the tasks used in the real-world experiments. For each task, we set a number of timesteps T allowed for one rollout, and all rollouts of the same task are terminated after the same T timesteps regardless of task success or failure. Fig. 7 we further visualize some example successful and failed rollouts from the real-world experiments.
Real-world experiments with WidowX robot: the "Open-X Magic Soup++" dataset on a real WidowX robot arm in our lab. In this experiment, we collected total of 532 rollouts on the following 8 tasks (listed in Table 4 with 244 successes and 288 failures, Each task has roughly the same number of rollouts.
We also tested the Open VLA model pretrained on
B.6 Benchmark Statisties
we summarize the statistics on the number of tasks and rollouts collected for each benchmark and how they are split into training and evaluation subsets. We note that as SAFE is designed for multitask failure detection, it is trained on only a limited set of training tasks and rollouts and can generalize to new tasks without further collecting rollouts. While SAFE does require hundreds of rollouts from multiple tasks during training, when handling new tasks, SAFE becomes more efficient than existing task-specific failure detectors (like 18 that require collecting rollouts for training and calibration for every new task encountered.
In the Table 5
25

---

Table 4: List of tasks used the real-world experiments.
Task
Instruction
Lift AAA Battery
Lift Eggplant
3
Lift Red Bottle
Lift Blue Cup
Put Blue Cup on Plate
Put the Red Bottle into Pot
Put the Carrot on Plate
Put the Red Block into the Pot
Benchmark
Number of Tasks
Number rollouts
Seen
Unseen
Total
Train
Eval Seen
Eval Unseen
Total
LIBERO
7
3
10
210
140
150
500
Th SimplerEnv, Google Robot
2
2
198
102
100
400
SimplerEnv, WidowX To
2
2
4
198
102
100
400
Octo SimplerEny
9
3
594
306
300
1200
Real Franka
10
3
13
450
150
180
780
Real WidowX
6
2
8
250
133
149
532
Table 5: Benchmark statistics for how tasks and rollouts are split into different subsets. Note that
as we preformed multiple runs with different random seeds for all experiments, each run will use different set of tasks for seen and unseen subsets.
B.7 Training Details
We use Adam optimizer 74 with 31 determined by grid search. The SAFE models are trained for 1000 epochs with batch size 512. Note that each rollout is considered one data point and thus batch size of 512 translates training (at most) 512 rollouts in each iteration. All training and evaluation are done on a single NVIDIA 100 40GB GPU. Since SAFE uses small networks (MLP LSTM with I or 2 layers), the typical training time for one model is less than one minute.
0.9, 81 0.999, 10 and learning rate (Ir)
B.8 Hyperparameter Tuning
To determine the hyperparameters for the proposed SAFE and baselines, perform grid search over them and select the ones with the highest failure detection performance (ROC-AUC) on the Deval-seen split. In Table Table and Table report the hyperparameters have searched over and the values with the best performance. Note that for the real-world experiments, we fix the e, be the "pre-logits" with "Mean" aggregation.
C Additional Results
C.1 Feature Visualization and Analysis
We perform the feature analysis similar to Section 4. and Fig. 1 on other benchmarks and show the plots in Fig. g Note that in this feature analysis process, the t-SNE algorithm was performed on the VLA's embeddings without any learning. Therefore, the feature dimension reduction process is unsupervised and does not know about task successes or failures.
Comparing the plots in Fig. I and Fig. 8 we can see that the embedding spaces from VLAs are different from each other, which corresponds to the different failure patterns presented by the VLAs. For FAST (Fig. [ and on LIBERO (Fig. 8 and b), when task execution fails, the embeddings fall into the same region ("failure zone"). This corresponds to the major failure mode of FAST trained on the LIBERO dataset, where the predicted actions A, become unstable and the robot arms move to weird configurations and out the observation frame. For Open VLA on LIBERO (Fig. & and d). observe that for most failed rollouts, the robot freezes or shakes around certain
26

---

configurations during the middle of task execution. Such failed rollouts result in features very close to each other, which corresponds to small blobs of red dots in Fig. D8
Despite the different appearances of the embedding spaces from the above benchmarks, their success- ful and failed rollouts separable in the feature space. This is aligned with the high performance of the proposed SAFE and the embedding- based baseline methods. Moreover, although the embeddings of the failed rollouts from Open are spread over the space and do not form a unified "failure zone", SAFE is still able to learn to separate task failures from successes (possibly by extracting the correlations that are not visualized by t-SNE) and generalize well to unseen tasks, as reported in [
However, the visualized embeddings of To-FAST on the real Franka robot (Fig. &b and f) are different, where embeddings from successful and failed rollouts are not easily separable through the t-SNE visualization. We hypothesize that because the tasks used for real-world experiments are more diverse, their failures do not have a unified semantic meaning, and thus the embeddings are not clearly separated in the visualization. This explains the limited performance of all failure detection methods as reported by Fig. 6 where ROC-AUC is at most 64 on Deval-unsenn- Nevertheless, SAFE-MLP still outperforms all baselines on both seen and unseen splits in this evaluation.
C.2 Conformal Prediction Results
We use functional CP 8 21 to determine the time-varying thresholds & for failure detection. By varying the significance level a used in functional CP, we can adjust the conservativeness of failure detection and get different performance. In Fig. 9 we plot the change of TNR (True Negative Rate), TPR (True Positive Rate) and Bal-acc (Balanced Accuracy, INR+ w.r., a. From Fig. 9 we can observe that while the metrics do vary with the a, choosing and 0.2) performs well across the board. We have also chosen a to be 0.15 for most qualitative results and analyses reported in the paper.
0.15 (or in general, between 0.05
Note that we calibrate the CP bands on successful rollouts (negative data points), and thus if the assumptions used in CP (8, are sampled i.i.d.) hold, the TNR rate is lower bounded by and close to 1 a (the gray dashed line in the TNR plots in Fig. 99) 21.. However, as the multitask failure detection problem requires detecting failures on tasks that are not in the training or the calibration sets, we need to calibrate CP bands on Desal-seen and then evaluate them on Deval-unseen- Therefore, the i..d assumption may not hold, and TNR may deviate from the gray dashed line.
From Fig. 9 we can see that on VL and ग +SimplerEnv benchmarks, the TNR curves obtaindd by SAFE are close to the gray dashed line - a, while those on the other benchmarks are lower than - a. A similar phenomenon is also observed for the baseline methods: none of the TNR curves obtained from the baselines consistently conform to the 1 curve across all benchmarks. We attribute this to the challenging nature of the multitask failure detection problem, where the failure scores for calibration and evaluation may not come from the same distribution. Nevertheless, we still adopt the functional CP as principled method to determine the vare-ng failure detection threshold 6,. Moreover, from Fig. 9 we can see that SAFE can achieve higher TPR and result in fewer false negatives compared to the baselines. This is crucial for safect--ritti environments, where a missing failure (false negative) can be much more catastrophic than a false alarm (false positive).
C.3 Failure Detection Time
As mentioned in Section 6.2 we mamually label when the failure happens for the failed rollouts. The labeling process is based on video recordings after all rollouts are collected and no interventions were done during the task execution. While the exact times of failure are clear for some failure modes (e.g. dangerous actions, breaking objects), they can be ambiguous and hard annotate for other failure modes. For example, policy may freeze in the middle of task execution, and after that either recovering from it or getting stuck indefinitely can be possible. In another case, a policy may repeatedly try grasping the object but keep missing the grasp until timeout, and it's hard to determine a single point of failure. To handle such cases, we instruct the human annotators to pick the time where they think intervention is needed and they should take over control to prevent an execution failure. In practice, for the above ambiguous failure modes, we annotate the failures after the policy gets stuck by a few seconds or re-tries the grasping action a few times. For some rollouts that look
27

---

Table 6: Performance on the OpenVLAA+IIERR benchmark using different numbers of training tasks.
Training Tasks
3
Eval Task Split
Seen
Unseen
Scen
Unseen
Seen
Unseen
Seen
Unseen
Mahalanobis
40.21
52.75
58.00
52.31
57.68
50.78
62.03
58.85
Euclid. K-NN
49.74
63.76
61.66
67.02
59.14
67.11
66.00
55.23
Cosine. K-NN
53.27
60.76
65.39
65.64
67.46
70.57
67.09
69.45
PCA-KMeans
60.39
40.58
61.18
52.87
61.50
53.06
57.18
55.10
RND
29.29
50.32
54.46
47.39
56.71
49.15
52.57
46.88
LogpZO
61.75
56.17
52.89
50.49
65.99
56,60
61.57
52.91
SAFE-LSTM,
50.88
$2.25
68 85.85
63.31
70.70
66.31
70.24
72.47
SAFE-MLP
54.34
63.76
67.86
67.03
69.32
68.17
72.68
73.47
very plausible but not succeed due to the time limit, the failure time annotated as the end the rollout. Note that annotate only the failed rollouts and not the successful ones, though they may also show subtle signs failure in the middle.
In Fig. 10 we compare the times of failure detected by the proposed SAFE-MLP model and human annotator. From Fig. I0 we can see that for both my and FA-FAST models, SAFE-MLP can detect failures before they happen (as identified by a human). When used for mo - deployed on LIBERO, SAFE-MLP forecast failures well in advance and even predict 40% of the failures after the first timestep.
Furthermore, from Fig. 10p and Fig. TOc. we the plots. This means that the human annotator does not think these rollouts are failures until the very last moment, where the VLA model probably on the right track and fails only due timeout. We think such failures are also hard for failure detectors to detect, and it explains the low performance of all failure detectors on these benchmarks.
that the blue curves jump up the right edge of
C.4 Result Variance
In Table we report the standard deviation for all results in Table I and Fig. left.. Note that for the repeated runs, not only are they using different random seeds, also the tasks are split differently into the seen and the unseen subsets. Since different tasks have different difficulties for failure detection, it normal see large standard deviations in Table From Table we can see that the proposed SAFE methods achieve high averaged performance with relatively low standard deviations compared to the baselines, across all evaluation benchmarks. This signifies the strong and also stable performance of SAFE.
D Additional Ablation Studies
D.1 Number of Training Tasks
As SAFE learns to distinguish failures from successes from training rollouts, the diversity of failure modes and the number of tasks in the training data have an effect on the failure detection performance. To quantify this effect, conduct experiment varying the number of seen tasks that used in training. Note that different tasks typically also have different failure modes, and in this way, we are also ablating the diversity of failure modes.
In Table we report the failure detection ROC-AUC on the OpenVLA+LIBERO benchmark, trained on different numbers of tasks. While the number of seen tasks is ablated, all experiments use the same set of unseen tasks for evaluation, and performance on unseen tasks is comparable. All numbers averaged over 3 random seeds. Experiments with 7 tasks for training match the setting reported in the paper. Training- free methods do not depend on training tasks and are not shown.
Table shows that for most methods, with more tasks used for training, the performance on unseen tasks gets better. The proposed SAFE-MIPP performs well in all settings and can also achieve good performance when fewer (3 or 5) tasks are used for training.
28

---

Table 7: Comparison of model performance across different visual encoders and architectures.
Method
LSTM
MLP
Eval Task Split
Seen
Unseen
Seen
Unseen
DINOv2
76.93
56.96
76.20
59,46
CLIP
76.77
52.71
77.88
59.77
DINOv2+CLIP
77.09
59.65
76.36
58.43
VLA (Ours)
77.27
58.70
86.76
64.16
D.2 Features from Foundation Models
In Table 7 we ablate SAFE-MLP and SAFE-LSTM using DINOv2 features, CLIP features, DINOv2 and CLIP concatenated 2 and the VLA last-layer features (VLA; main method). DINOv2 and CLIP features are extracted from the observation images, and this experiment is conducted over the real-world Franka rollouts, following the same setting as reported in the paper. Numbers are averaged ROC-AUC on the Seen and Unseen tasks.
The best performing method in the above table is the SAFE-MLP method based on VLA last-layer features, where VLA features outperform other feature types by large margin. We think that this is because VLA feature space learns high-level information about the tasks, and thus can more easily distinguish failures from successes than general pretrained models. Similar findings were also reported in related works like [18].
E
Additional Discussions
E.1
Comparing Failure Detection, Uncertainty Quantification and OOD Detection
Failure detection, uncertainty quantification and OOD detection are three closely connected concepts with subtle differences. SAFE learns model the probability of failures and detect failures of VLA policies, but achieves this not through uncertainty quantification (UQ) or OOD detection. Here, we provide detailed discussion comparing these three concepts.
Failure detection is the task of detecting failures when robot is performing certain tasks. SAFE learns the likelihood of failure through training on set of successful and failed rollouts, SAFE-LSTM trained by BCE loss and outputs a normalized score indicating the probability of failure of VLA. The output of SAFE-MLP is not normalized and thus not probability. However, output scores from both SAFE-LSTM and SAFE-MLPP are calibrated through functional Conformal Prediction CP and can be used for failure detection with theoretical guarantees.
Uncertainty quantification (UQ) measures a VLA's uncertainty its outputs and can be used as a proxy for failure detection. In our experiments, the token uncertainty baselines and sample consistency baselines are inspired by LLM/VLM literature and designed based on UQ. Methods in this category are typically training-free, but they only show limited success according to our experiments.
OOD detection-based failure detection methods treat successful rollouts as normal execution condi- tions and assume that deviations from this norm lead higher chance of failure. In our experiments, the embedding distribution-hast
haselines are designed to detect policy failure based on OOD detec- tion. Methods in this category can work without failed rollouts. In our experiments, we adapted them to take in both successes and failures, and they showed strong performance. Please see Section 2.2 in our paper and also [ for more comprehensive discussions on these methods.
Uncertainty quantification methods have been widely used for LLM/VLM hallucination detection (see Section 2.3 and OOD detection- methods have been shown be effective for failure detection robotics policies (see Section 2.2 Therefore, we think it's appropriate to use them as baselines.
Different from existing works based on UQ or OOD detection, SAFE directly learns to detect failures from a history of observations and the language instruction specifying the desired task without using
29

---

uncertainty or OOD detection as the proxy measurement. Experiments show that this direct learning regime used by SAFE is more effective and achieves better performance than other methods.
F Potential Future Works
F.1 Extending Beyond the Last-layer features
In this paper, we maximize the simplicity and transferability when designing SAFE. By only taking feature vectors the last layer, the proposed method can be easily integrated into any VLA models with minimal implementation changes and no finetuning on the VLAs themselves.
Further fusing or aggregating deep features from multiple layers can also benefit failure detection and is a promising future direction. Related works have shown potential in this direction. For example, [55 proposed Truthfulness Separator Vector (TSV), which is injected in the LLM latent features in the middle of the transformer and is optimized to better separate the hallucinated and truthful responses in the final token feature space. We think a similar technique can also be developed for VLA failure detection. However, this would require a special design and implementation for each VLA model (as some VIA models output discrete tokens, and others use flow matching to output continuous actions, there may not be a single design that can be applied to all VIA architectures), reducing its transferability. We leave the development of such methods as a promising future work.
Using the latent feature from an intermediate transformer block may also be promising future direction. As shown by 449 and (53). LLM latent features from different layers have different performance on hallucination detection, and the best one may not be the last layer. However, exactly which layer works the best may depend on the model and require extensive ablation experiments to find out. For example, as reported by [49], for the OPT-6.7B model, the 20th layer works the best, but for LLAMA2-7B, the 16th layer works the best. To locate the best layer, 49] has perform a grid search over each LLM tested. On the contrary. in our setting, VLA users can avoid such grid search experiments and simply choose the final layer for failure detection. Therefore, we think that precisely finding the layer that works the best for VLA failure detection is outside the scope of this paper, but it would be very interesting to explore for future work.
F.2 Adaptive Thresholding by Online Conformal Prediction
The proposed SAFE and basclines can be extended to online adaptive conformal prediction (CP) (75). In such a framework, rollout results are observed one-by-one and compared to the prediction results, and the significance level a is adjusted for each individual task if the prediction is wrong. However, when VLA policies are deployed, they may constantly meet novel environments and customized task instructions, and may rarely repeat the same task. In such a case, it may be less pratical to develop adaptive CP band for each specific task. Therefore, in this work, we focus on the performance of failure detectors when they are directly deployed or repeated the task before. In this setting, offline CP is more appropriate. Nevertheless, we believe online CP is an interesting extension our work, and we leave as an important future work.
novel task, and have never seen
F.3 Using Detected Failures for Behavior Improvement
SAFE focuses detecting failures accurately and in timely manner, which enables either the robot to abort potentially dangerous actions or human monitor to step and take over control. How to learn recovery policy or how to improve the VI.As themselves are important areas for future work. In this work, we focused on detecting failures of multitask VLAs reliably and in real-time, which is crucial stepping stone towards autonomous recovery (e.g., with fallback policy) and policy improvement (c.g., through interactive imitation learning).
We think it is possible to use the findings from this paper to further develop methods for steering or improving VLA behaviors. For example, we show that the embeddings for successful and failed rollouts are separated in the latent space, so it is possible to learn a steering vector that manipulates the latent activations of a VLA and changes its output actions, as done in (50) and 76). However, different from the stylization or hallucination reduction tasks for LLMs, robot manipulation involves multistep closed-loop interaction between the policy and the environment, which greatly complicates
the relationship between VLA outputs and task exccution successes. Therefore, how to improve
30

---

Table Mean and standard deviation of failure detection ROC-AUC on all benchmarks. This table complements the results from Table 1 and Fig. leett.
VLA Mudel
OpenVLA LIBERO
To-FAST LIBERO
To LIBERO
Tu- FAST
Benchmack Eval Task Split
Simpler
Real Franka
Seen
Unseen
Seen
Unseen
Seen
Unseen
Seen
Unseen
Seen
Unseen
Max proh
50.2542:1
53.83
61. 51
69.4
53.74:334
48.599300
prob.
44,05112
11.58
52.46a544
58, Diiase
51 60.60a
47.30ssom
entrogy
52.04
53.09.00
59
53.50ga1s
entrupy
45.27
50.67338
46.08
Mabahnobis dist.
62.003a..1
93.56a238
83.79
77.12
11.31=124
8k.42
75.34:249
33.93ame
Enciidean dist. E-NN
66 00
55
92.04
84.12 1aawe
75.64
70.73
89.73a3u
68. 22
80 80.35
60.2755m
Cosine dist. & &-N
67.09a224
69.45
92.09
84.6
75.76as.11
70.31
90.19
71.32
80.23
59,51ss20
(CA--Means
[
57.18s2M
55.10
68.45540
27.12
61.921136
60.35amms
66 66.88
19
51.91=439
19.86
RND [30
52.571456
46.88
88.67
81.57
71592470
69.44.1930
85,77440
65.89
62
45,831510
LogoZ0
83.07.012
73.23
24.66
64.43-133
52.24:300
Action tocal vaz
12.76ziee
65.13=13
76.95amm
1.300:111
72200a3e
75.18
Trans, Intal var.
58 43
78.21
80.05
40 38
54.71
63.274747
55,90k190s
Rot. total var.
47.85
55.
55.30g
80.874500
77.29 27.29
32
61.0621000
5k.07am44
62. 10
Glipper roeal
61
64 14.48
76.822710
74,42 14
77. 19
75.19
69. 16
69.
69.29
Cluster
80.16
51.Mat
27
80.53eses
76.19
22.12
68.25evu
73.66
STAC
=7.9
62.2 21002
STAC-Single
854666
11.16
68.46a5
69. 29.39
70.40
45.74.144
3801
SAPE-INTM
12.47555
92.88370
21.09
8X.8566e
RI. Tainns
38.7014
SAFE-MLP
72,68423
73
90,06a230
80, 20.442
73
73.27amu
89,50s429
84.82sx12
86 36.76224
64.1
VLAs through activation steering is challenging and open research question beyond the scope of our paper.
Table 9: Grid-searched and best-performing hyperparameters (in bold text) for Open LII
(left) and Fo-FAST+LIBERO (right).
Method
HParams
Values
Max prob.
cumsum
True False
Avg prob.
True False
Max entrapy
cumsum
Thue False
Aug entropy
True False
Method
HParams
Values
Mahalanohis dist.
aggas
First Last Mean
Mux prob.
cumsum
True False
Feat
Encoded Pre-logits
Avg proh.
cumsum
True False
cumsum
Thue False
Max entropy
cumsum
True False
Fuclidean dist. N--NN
0,90aa
First Mean
Avg entmpy
cumsum
True False
Feat
Eacoded Pre-logits
Mahalanobis
agyukee
First Last Mean
cumsum
True False
cumsum
True False
&
5 10
Eaclidean dist. R-NN
0g90kkz
First Mean
Cosine dist. A:-NN
aggain
First Last Mean
cunsum
True False
Feat
Eacoded Pre-logits True False
1
oumsum
Cosine dist. k-NN
ogghikee
First Last Mcan
5
cumsum
True False
PCA-KMeans
aggasm
First Last Mean
Feal
Encuded logits True False
PCA-KMeans
agShkkes
First Last Mean
cumsum
cumsum
True False
clusters
32 64
clusters
16 32 64
dim
32 64 128
dim
32 64 128
RND
First Last Mean
RND
agShike
First Last Mean
Feat
Eacoded Pre-Iogits
Logp20
agghske
First Last Mean
LogpZO
aggwkm
First Last Mean
Action total var.
cumsum
True False
Feat
Eacuded Pre-Ingits
Trans, total var.
True False
Action total var.
cumsum
True False
Roi. total var.
cumsum
True False
Trans. total var.
cumsum
False
Gripper total
True False
Rot, total var.
cumsum
Thue False
Cluster eatropy
cumsum
True False
Gripper total var.
cumsum
True False
0.01
Cluster entropy
cumsum
Thue False
SAFE-LSTM
a.gghakee
First Last Mean
0.01 0.05 0.1 0.2 125
le.4 3e-4 le-3
STAC STAC-Single SAFF-LSTM
True False
Areg
lc-3 lo-2 lo-1
cumsum
True False
SAFE-MLP
oggiskzz
First Last Moan
ag9aka
First Mean
1e-4 1e-3
Feat
Encoded Pre-logits
Areg
10-3 1e-2 to-1
Ir
3e-5 1c-4 3e-4 1o-3
Areg
le-3 le-2 le-1
SAFE
aggisn
First Last Mean Encuded Pre-Ingits
Feal
Ir
3e-5 1o-4 3e-4 1c-3
Xreg
lc-3 1e-2 le-1
31

---

Table 10: Grid-searched and best-performing hyperparameters (in bold text) for xo +LIERO (left)
and Th
+SmpplerEny (right).
Method
HPurams
Values
Method
HParams
Values
Mahalanobis dist.
First First&Last
aggai
First Last First&Last
Mahalaaobis dist.
agStu
First Last Moan First&Last
First Last Mean First&Lasst
Euelidean dist. I--N
cumsum
cumsum
aggan
First Last First&Last
First Last First&Lastt
True False
Eaclidean dist. I-NN
cumsum
cumsum
aggtesi
agsur
Trae False
Tiue False
First Last Mean Lirt
First
First&
1 10
Cosine dist. N-NN
ag
First Last First&Last
Cosine dist. A-NN
First Last Mean Firtt&Last
"gSar
First Last First&ll. aast
aggan
First&Lasst
True False
cumsum
True False
k
1.5 10
PCA-KMeans
gg
Fars&&Last
PCA-KMeans
agStu
First Last Yean Firstel last
First Last Last
First Last Mean Lirt Tiue False
cumsum
clusters
16 32 64
clusters
16 32
dim
32 64 128
RND
ugt0bmm
First Last First&Last
RND
First Last Mean First&Last
aggan
First Last First&Last
aggan
First Last Moan First&Last
LogpZO
aggam
First Last First&Last
LogpZO
First Last Mean First&Last
eggen
First Last FirstRl ast
ag9an
First
First&laast
Action
True False
Action total
cumsum
True False
Trans. total var. var.
cumsum
True False
Trans. total var.
cumsum
True False
cumsum
False
Rot. total var.
cumsum
True False
Gripper total var.
cumsum
True False
Gripper total var.
cumsum
Trxe False
Cluster entropy
cumsum
False
Cluster entropy
cumsum
True False
0.01 0,05 0.1 0.2
0.05 0.1 1.5
STAC
cumsum
True False
STAC STAC-Single
cumsum
True False
STAC-Single SAFE-ISTM
False
cumsum
True False
First Last First&I ast
SAFE-LSTM
0ythum
First Last Mean First&Last
agSart
Firt&Last
aggai
First Last Mean First&Last
Ir
le-5 3e-5 le-4 3e-4 1e-3
Ir
1o-4 3c-4 le-3
Area
lo-2
Arey
le-3
SAPE-MPP
First Last Mean Firs&Last
SAFE-MLP
aggam
First Last Fist&Last
First Lust Firtt&Last
le-5 3e-5 le-4 3e-4 1o-3
Ir
aggan
le-4 3e-4 le.3
First&Last
Areg
1e-3 lo-2 1e-1
Aveg
le-3
Table 11: Grid-searched and best-performing hyperparameters (in bold text) for F0-FAST on real- world rollouts.
Method
HParams
Values
Max prob.
True False
Avg prob.
camsum
True False
entropy
Avg entropy
cumsumi
True False
Mahalanohis dist.
cumsum
True Falee
Euclidean dist, R-NN
True False
1 10
Cosine dist. N-NN
1 10
PCA-KMeans
True False clusters
cumsum
16 32
dim
32 64 128
Single SAFE-LSTM
1c-4 36-4 1e-3 36:3
Aveg
le:3 le-2 le:l
SAPE-MLP
le.4 36-4 le.3 3e.3
Area
1e4 lo-2 lo-1
32

---

"place the green block on the yellow block'
Success Criteria:
Pick up the green block and place on top of the yellow
Failed Reason:
The robot struggle the green block in Frame 22 then doesn't place it on the yellow block in Frame (4).
up
"put the cup to the upright position'
Success Criteria:
Grasp the edge or handle cup lying horizontally on the table, then rotating place upright.
Failed Reason:
In Frame 3.. it grasp the cup's edge but slip, and in Frame ()), struggle pick up again.
'unfold
Success Criteria: Pick up folded cloth unfold spreading flat on the lable.
Failed Reason:
The robot can't grasp the comer the cloth in Frame (2:34) and gets stuck.
"close the door'
Success Criteria:
Close the door by pushing until it is fully shut tightly, ensuring no gap remains.
Falled Reason:
In Frame (4) the doar latch does not engage, leaving the door not fully shut.
"pick up the marker place it the cup'
Success Criteria:
Pick up the marker from the table and place inside the cup, ensuring stays
Failed Reason:
The robot can't up the marker then gets stuck in Frame 232
Figure 7: Example successful and failed rollouts from real-world experiments.
33

---

(a) To +LIBEO,, colored by task success
(b) ToBEIR, colored by task ID
(c) SeenVLA+LIBERO colored by task success
(d) OpenVLA+LIBERO, colored by task ID
(e) TT-FFATT+Fraaa, colored by task success
Fa-FAST+Franka, colored task ID
Figure 8: t-SNE plots of VLA's internal features, from different evaluation benchmarks.
34

---

OpenVLA LIBERO
OpenVLA UIBERD
OpenVLA UIBRRO
0.9
TN0: Tue Neggttie RaW
Balanci Accursey
0.8
0.8
2..6
0.7
0.4
0.4
0.8
0.5
3.0
0.0
0.1
3.2
0.3
0.4
0.5
0.0
0.1
0.2
0.3
0.4
0.5
0.0
0.1
0.2
0.3
0.4
0.5
Sigifconcc Level
Slarificancee Level
Significance Leve
nn-FAST LIBERO
my-FAST LIBERO
Ps-FAST LIBERO
1.0
TNR Thue Neggahee Pante
0.8
0..
0.9
0.44
0.4
0.7
0.5
0.0
3.0
0.2
0.5
Method
Signficncce Level 2
Slanificance Level
Significacce Level
No LIBERO
LIBERO
Rn LIBERD
Aug prob
Max entropy
TIME Thue Negettew Rudte
Balarc: Balnnced Accoreyy
0.8
0.8-
23.
Euclidean dist KNN
Cosine dist. I-hN
PCAvKMeant
0.6
0.4
2.4
LogoZO
0.5
Aztion total var.
Trans, total var.
0.0
3.0
Grppeer
0.2
0.5
Cluster entropy STAC
Signficance Level
Sigréficance
Significance
STACsing
I66 SimplerEnv
SimplerEnv
nt SimplerEnv
3.0
Bakecc Baterced Accurcyy
0.8
TMQ: Thue bagettre Batte
0.8
03.
0.4
2.4
0.5
0.4
6.0
3.0
SgnFiccnce
Stonificancc
Significance
n,-FAST Franka
Ri-FAST Franka
m--FAST Franka
Balaac Batenced Acarssy
IND Thue begeite Batt
0.8
Postooe Rark
2.8
0.55
0.4
2.4
0.50
6.0
2.0
Signfccnce
Stonificance
Significance
Figure 9: Additional failure detection results using obtained by functional CP. These plots show TNR (left column), TPR (middle column), and Bal-acc (right column) w.r.t. the significance level a, for each evaluation benchmark. These plots are obtained with random seed=
35

---

1.0
TP
TP
Cumulative fallures
0.8
GT Positives
Detected fallure time (relative)
0.8
FN
(proportion)
0.6
0.6
0.4
0.4
0.2
0.2
0.0
0.5
0.0
0.2
0.4
0,6
0.8
1.0
GT failure time (relative)
Time (relative)
(a) no LIBERO benchmark.
1.0
TP
Detected failure time (relative)
Cumulative fallures
0.8
FN
(proportion)
0.2
GT Positives
0.0
0.0
0.5
0.0
0.2
0.4
0.6
0.8
1.0
GT failure time (relative)
Time (relative)
(b) FAST on LIBERO benchmark.
1.0
TP
1.0
GT Positives
Detected fallure time (relat relative)
Cumulative fallures
0.8
0.8
(proportion)
0.6
0.6
TP
FN
0.4
0.4
0.2
0.0
0.0
0.0
0.5
1.0
0.0
0.6 Time (relative)
0.4
0.8
1.0
GT failure time (relative)
(c) FA-F on the real Franka robot.
Figure 10: Comparison between detected and ground truth (GT) failure w.r.t time. On the left column, we plot the cumulative number of true failures (true positives) detected by SAFE-MLP (red) and human annotator (blue), w.r.t. elapsed time in each rollout. The right column shows the time of failures detected by SAFE-MLP (y-axis) and human annotator (x-axis) for each rollout, where failures missed by the detector (false negatives) are plotted in blue crosses. Experiments are done with seed O and functional CP with significance level a = 0.15.
36


Reviews:
[{"review_id": "SdSPnXh61Z", "reviewer": "Reviewer_bqvs", "summary": "The paper introduces SAFE, a multitask failure detector for generalist VLA policies, which leverages internal policy features to predict failures across diverse tasks and environments; SAFE demonstrates good performance and strong generalization on both simulated and real-world benchmarks.", "questions": "1. How does SAFE generalize to other VLAs beyond pi0?\n2. Can you provide more qualitative examples of the failure modes in real-world settings?\n3. What are the real-time computational requirements for SAFE on real-world settings?", "limitations": "Yes.", "rating": 4, "confidence": 2, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 3, "significance": 2, "originality": 2, "strengths_and_weaknesses": "Strengths: \n\n+ This paper proposes a unified, efficient failure detector for VLA models that generalizes to unseen tasks without task-specific tuning.\n\n+ The authors have demonstrated strong empirical results and showed the proposed models can detect failure during early stages on a range of VLA architectures and real-world experiments.\n\nWeakness: \n\n+ This paper primarily evaluates the failure detector on two simulation environments, while the real-world experiments only evaluate the p0 checkpoint on the Franka Emika Panda Robot, which is quite limited.\n\n+ SAFE only leverages the last-layer features for error detection, which might not be a meta representation space for other diverse VLA architectures such as octo; The generalizability of the proposed technique to other VLAs is unknown.\n\n+ The authors provide limited discussion of practical deployment constraints, such as computational overhead or integration into existing robot stacks.", "was_revised": true, "final_justification": "The rebuttal adds new results and clarifications that address most of my concerns, particularly w.r.t. broader real-world validation, additional architectures, and computational overhead. Minor questions remain about deployment in diverse settings, but the main weaknesses have been resolved.", "rebuttal": "&nbsp;\n\nWe thank the reviewer for a careful and constructive review! We appreciate that the reviewer found our method **unified, efficient, and generalizable to unseen tasks**, and acknowledged that SAFE shows **strong empirical results and can detect failures during early stages**! \n\n&nbsp;\n\n# W1: “Evaluates the failure detector on two simulation environments, while the real-world experiments only evaluate the p0 checkpoint on the Franka Emika Panda Robot, which is quite limited.” \n\nWe provide an additional set of real-world experiments as follows, where the OpenVLA model trained on the “Open-X Magic Soup++\" dataset is deployed on a real WidowX robot arm in our lab. In this experiment, we collected a total of 532 rollouts on the following 8 tasks, with 244 successes and 288 failures. Each task has roughly the same number of rollouts. \n\n- Lift AAA Battery\n- Lift Eggplant,\n- Lift Red Bottle\n- Lift Blue Cup\n- Put Blue Cup on Plate\n- Put the Red Bottle into Pot\n- Put the Carrot on Plate\n- Put the Red Block into the Pot\n\nThe failure detection ROC-AUC of different methods is reported in the following table. This experiment follows the same evaluation protocol as the OpenVLA+LIBERO experiment reported in the paper. All numbers are averaged over 3 random seeds. 6 of the 8 tasks are in the Seen subset, and the remaining 2 are in the Unseen subset. \n\n| Method | Seen | Unseen |\n|-|-|-|\n| Max prob. | 50.77 | 54.25 |\n| Avg prob. | 48.94 | 44.36 |\n| Max entropy | 51.88 | 49.19 |\n| Avg entropy | 47.72 | 53.84 |\n| Mahalanobis dist. | 82.37 | 70.00 |\n| Euclid. dist. kNN | 72.01 | 53.64 |\n| Cosine dist. kNN | 74.76 | 65.88 |\n| PCA-KMeans | 75.62 | 47.22 |\n| RND | 66.68 | 47.67 |\n| LogpZO | 62.94 | 51.32 |\n| SAFE-LSTM | 84.29 | 71.80 |\n| SAFE-MLP | 89.11 | 88.42 |\n\nThis table shows that SAFE-MLP achieves the best failure detection results on both seen and unseen task splits on the real-world OpenVLA+WidowX setup, with a significant margin over baselines. This complements the real-world experiments we had on the Franka robot and shows the generalizability of the proposed SAFE method. \n\n\n# W2, Q1: “The last-layer features might not be a meta representation space for other diverse VLA architectures such as octo; The generalizability of the proposed technique to other VLAs is unknown.” “How does SAFE generalize to other VLAs beyond pi0?” \n\nWe note that we have already tested SAFE and baselines on 3 VLA architectures, OpenVLA, pi0, and pi0-FAST. These 3 VLAs use different backbone VLMs (LLAMA2+DINOv2+SigLIP, and PaliGemma), tokenization schemes (per-dimension binning, flow matching, and frequency-space tokenization), and evaluation benchmarks (LIBERO, SimplerEnv, and real-world Franka). We believe these experiments have demonstrated the generalizability of SAFE over different VLAs. \n\nWe are grateful for the reviewer’s suggestion and, in the interest of completeness, we have also included experimental results on the Octo VLA on the SimplerEnv benchmark. In this experiment, we use Octo-small as we found that Octo-small has a higher success rate (Avg success rate = 15.3%) than Octo-base (Avg success rate = 12.7%) on SimplerEnv. We would like to note that Octo is not among the most performant VLAs available in the literature: probably because the Octo model is relatively small (27M or 93M parameters) and did not use VLM as initialization, its performance is significantly lower than $\\pi_0^*$ (Avg success rate 71.6%) on this benchmark. \n\nOut of 23 tasks provided in SimplerEnv, Octo-small has a 0% success rate on 7 of them, and we only use 12 tasks that have success rates > 5% for this experiment. 9 out of 12 tasks are seen, and the other 3 are unseen. Each task has 100 rollouts. The following numbers are ROC-AUC averaged over 3 random seeds, as done for other experiments in the paper. \n\n| Method | seen | unseen |\n|-|-|-|\n| Mahalanobis dist. | 92.08 | 88.92 |\n| Euclidean dist. k-NN | 89.00 | 87.80 |\n| Cosine dist. k-NN | 89.90 | 87.48 |\n| PCA-KMeans | 73.12 | 75.07 |\n| RND | 86.23 | 78.49 |\n| LogpZO | 88.46 | 71.12 |\n| Action total var. | 54.41 | 60.16 |\n| Trans. total var. | 49.85 | 61.27 |\n| Rot. total var. | 52.19 | 60.80 |\n| Gripper total var. | 54.06 | 59.04 |\n| Cluster Entropy | 50.00 | 50.00 |\n| STAC | 47.69 | 38.50 |\n| STAC-Single | 54.81 | 62.96 |\n| SAFE-MLP (Ours) | 89.93 | 83.44 |\n| SAFE-LSTM (Ours) | 90.15 | 85.29 |\n\nFrom the above table, we can see that Octo embedding space also shows a great potential for failure detection, as the embedding distribution baselines and SAFE all achieve high performance. Although SAFE-LSTM does not achieve the very top performance, it’s very close to the best method, with a gap of only 2 to 3 percent. \n\n\n# W3, Q3: “Practical deployment constraints, such as computational overhead or integration into existing robot stacks.” \n\n**Computational overhead**: SAFE uses a 1-2 layer MLP or LSTM and poses a minimal (<1%) computational overhead at runtime. For example, SAFE-LSTM has 2.3 million parameters and an inference time of 0.73 ms. This is negligible compared to large VLA models. For instance, pi0 has 3.3 billion parameters and an inference time of 149 ms. We will include this information in the updated paper. \n\n**Integration requirements and deployment constraints**: SAFE only requires access to the latent features of VLA models and is compatible with any white-box robot policies based on neural networks. However, SAFE does require deploying the policy and collecting successful and failed rollouts to train the failure detector before it can detect failures. \n\n\n# Q2: More qualitative examples of the failure modes in real-world settings. \n\nUnfortunately, NeurIPS does not allow us to provide PDFs, videos, or external links during rebuttal. We will include more qualitative examples for the camera-ready version. \n\nInstead, we went through all the failure rollouts collected from our real-world experiments, and provided a textual summarization of failure reasons as follows (sorted by frequency): \n\n- Grasping failure\n- Placing failure\n- Frozen action (where the predicted action becomes 0 and the robot stops moving.)\n- Unstable action (where the robot seems to be moving randomly without executing the task.)\n- Time up\n- Press failure (The robot fails to press a button.)\n- Collision with other objects / disrupting the environment. \n- Go for the wrong object (The robot approaches or picks up the wrong object.)\n- Push failure (The robot fails to push an opening drawer or an opening door.)"}, {"review_id": "ahvutsgx5V", "reviewer": "Reviewer_XCVQ", "summary": "This paper introduces SAFE, a lightweight failure detection method for vision-language-action (VLA) models. SAFE uses internal latent features to estimate failure likelihood in real time, even before visible errors occur. It outputs a single scalar score and applies conformal prediction to set calibrated thresholds. The authors evaluate SAFE on both simulated and real-world tasks, showing that it generalizes well to unseen tasks.", "questions": "- How important is the diversity of failure modes and tasks in the training data for SAFE to generalize well?\n- How long does it take to collect a balanced set of successes and failures? Is it necessary to use VLA rollouts? Or can one use tele-operated successful and failed demos to achieve the same?\n- Have you compared with learning the score using other latent representations other than VLAs?\n- How would the failures detected be used to steer/control VLA behavior?", "limitations": "yes", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 2, "originality": 2, "strengths_and_weaknesses": "Failure detection is an important topic for realworld robotics applications. The proposed method is generalizable across tasks, efficient at runtime, and capable of detecting failures early, even before they are externally visible as shown in the experiments. It does not require per-timestep annotations, making it simple to supervise. SAFE’s use of conformal prediction provides statistical control over false positives. It achieves strong performance in both simulation and real-world settings, using minimal supervision and without relying on heavy computation.\n\nHowever, the proposed supervised method does not provide true uncertainty quantification; it learns to detect patterns distinguishing success and failures but does not estimate calibrated probabilities of success of the VLA. Detecting OOD states is fundamentally a different problem than detecting failure states conditioned on a task. Failed states in certain tasks may be successful states in other tasks (e.g. opening vs closing a door), while both tasks may present in the training data. Instead of comparing with uncertainty quantification baselines, it would be more useful to test learning failure detectors using latent representation from different pretrained models, e.g. how does Dino features work vs VLA features? Does the proposed method work across different VLA embeddings?", "was_revised": true, "final_justification": "The approach is technically sound and the experiments are thorough. The only concern is that this approach may not be very practical due to the number of rollouts required is very high (~1000 trajectories). This also introduces a chicken-and-egg problem in which one needs to roll out these policies to collect large quantities of failed trajectories before you can quantify safety and eventually prevent policies act in risky manner.", "rebuttal": "&nbsp;\n\nWe thank the reviewer for the insightful review! We appreciate that the reviewer points out that our method is **generalizable across tasks, efficient at runtime, and capable of detecting failures early**, and also that SAFE is **simple to supervise, provides statistical control, and achieves strong performance without needing heavy computation**! \n\n&nbsp;\n\n\n# W1: “Does not provide true uncertainty quantification … does not estimate calibrated probabilities of success... Detecting OOD states is fundamentally a different problem...”\n\nSAFE does not aim to achieve uncertainty quantification (UQ) or OOD detection, but it does model the probability of failures and can detect failures of VLA policies. \n\nThese 3 techniques are closely connected but have subtle differences. Here, we provide a discussion about them. \n\n**Failure detection** is the task of detecting failures when a robot is performing certain tasks. SAFE learns the likelihood of failure through training on a set of successful and failed rollouts. SAFE-LSTM is trained by BCE loss and outputs a normalized score indicating the probability of failure of VLA. The output of SAFE-MLP is not normalized and thus not a probability. However, output scores from both SAFE-LSTM and SAFE-MLP are calibrated through functional Conformal Prediction CP and can be used for failure detection with theoretical guarantees. \n\n**Uncertainty quantification** measures a VLA’s uncertainty in its outputs and can be used as a proxy for failure detection. In our experiments, the token uncertainty baselines and sample consistency baselines are inspired by LLM/VLM literature and designed based on UQ. Methods in this category are typically training-free, but they only show limited success according to our experiments. \n\n**OOD detection**-based failure detection methods treat successful rollouts as normal execution conditions and assume that deviations from this norm lead to a higher chance of failure. In our experiments, the embedding distribution-based baselines are designed to detect policy failure based on OOD detection. Methods in this category can work without failed rollouts. In our experiments, we adapted them to take in both successes and failures, and they showed strong performance. Please see Section 2.2 in our paper and also [8] for comprehensive discussions on these methods. \n\nUncertainty quantification (UQ) methods have been widely used for LLM/VLM hallucination detection (see section 2.3), and OOD detection-based methods have been shown to be effective for failure detection in robotics policies (see Section 2.2). Therefore, we think it’s appropriate to use them as baselines. \n\nSAFE directly learns to detect failures from a history of observations and the language instruction specifying the desired task without using uncertainty or OOD detection as the proxy measurement. Experiments show that this direct learning regime used by SAFE is more effective and achieves better performance than other methods. We will add more discussion about this in the camera-ready version. \n\n# W2: “Failed states in certain tasks may be successful states in others.”\n\nWe want to clarify a potential misunderstanding around this point. Success and failure criteria are indicated in the given language instruction of the VLA policy. VLA models take in the language instruction together with observation, process them through a deep neural network, and aggregate the information in a high-level feature vector. These feature vectors have extracted the success criteria from the language input and can identify failures based on both the observations and the language instructions specifying the desired task. Our analysis and experiments show that SAFE can detect failures across different tasks, including unseen ones, even when the same states are visited.\n\n\n# W3, Q3: “Using latent representation from different pretrained models, e.g. Dino?”\n\nIn the following table, we ablate SAFE-MLP and SAFE-LSTM using DINOv2 features, CLIP features, DINOv2 and CLIP concatenated (DINOv2+CLIP), and the VLA last-layer features (VLA; our main method). DINOv2 and CLIP features are extracted from the observation images, and this experiment is conducted over the real-world Franka rollouts, following the same setting as reported in the paper. Numbers are ROC-AUC on the Seen and Unseen tasks. \n\n| Method | LSTM| LSTM |MLP |MLP |\n|-|-|-|-|-|\n| Eval Task Split|Seen|Unseen|Seen|Unseen|\n| DINOv2|76.93|56.96|76.20|59.46|\n| CLIP|76.77|52.71|77.88|59.77|\n| DINOv2+CLIP|77.09|59.65|76.36|58.43|\n| VLA|77.27|58.70|86.76|64.16|\n\nThe best performing method in the above table is the SAFE-MLP method based on VLA last-layer features, where VLA features outperform other feature types by a large margin. We think that this is because VLA feature space learns high-level information about the tasks, and thus can more easily distinguish failures from successes than general pretrained models. Similar findings were also reported in related works like [17]. \n\n# Q1: “How important is the diversity of failure modes and tasks in training?”\n\nWe thank the reviewer for bringing this up. Yes, since SAFE learns to distinguish failures from successes from training rollouts, it is important to have good coverage of the diversity of failure modes and tasks in training. To quantify this effect, we conduct an experiment varying the number of seen tasks that are used in training. Note that different tasks typically also have different failure modes, and in this way, we are also ablating the diversity of failure modes. \n\nIn the following table, we report the failure detection ROC-AUC on the OpenVLA+LIBERO benchmark, trained on different numbers of tasks. While the number of seen tasks is ablated, all experiments use the same set of unseen tasks for evaluation, and performance on unseen tasks is comparable. All numbers are averaged over 3 random seeds. Experiments with 7 tasks for training match the setting reported in the paper. Training-free methods do not depend on training tasks and are not shown. \n\n| # Training Tasks|1|1|3|3|5|5|7|7|\n|-|-|-|-|-|-|-|-|-|\n| Eval Task Split|Seen|Unseen|Seen|Unseen|Seen|Unseen|Seen|Unseen|\n| Mahalanobis|40.21| 52.75| 58.00| 52.31| 57.68| 50.78| 62.03| 58.85|\n| Euclid.kNN|49.74| 63.76| 61.66| 67.02| 59.14| 67.11| 66.00| 55.23|\n| Cosine.kNN|53.27| 60.76| 65.39| 65.64| 67.46| 70.57| 67.09| 69.45|\n| PCA-KMeans|60.39| 40.58| 61.18| 52.87| 61.50| 53.06| 57.18| 55.10|\n| RND|29.29| 50.32| 54.46| 47.39| 56.71| 49.15| 52.57| 46.88|\n| LogpZO|61.75| 56.17| 52.89| 50.49| 65.99| 56.60| 61.57| 52.91|\n| SAFE-LSTM|50.88| 52.25| 68.85| 63.31| 70.70| 66.31| 70.24| 72.47|\n| SAFE-MLP|54.34| 63.76| 67.86| 67.03| 69.32| 68.17| 72.68| 73.47|\n\nThe above table shows that for most methods, with more tasks used for training, the performance on unseen tasks gets better. The proposed SAFE-MLP performs well in all settings and can also achieve good performance when fewer (3 or 5) tasks are used for training. \n\n# Q2-1: “How long does it take to collect a balanced set of successes and failures?”\n\nThe time used to collect a balanced set of real-world rollouts depends on the performance of the VLA model. During our data collection, we adjusted the environment setup and task difficulty with the target of achieving such a balance. \n\nIn total, by deploying the pretrained pi0-FAST model on a Franka robot, we collected 1307 rollouts with 420 successes and 887 failures, among them 390 successful and 390 failed ones are used for training and evaluation. Each rollout typically takes 40~60 seconds to collect, and the total collection time for the real-robot rollouts takes roughly 10 days. \n\n# Q2-2: “Necessary to use VLA rollouts? Can one use teleoperated demos?”\n\nYes, it’s possible to use teleoperated demos to train the failure detector. SAFE only requires the VLA’s internal features, which can be obtained by running inference over rollouts collected by human demonstration or another policy. \n\nHowever, such “off-policy” rollout collection may contain different failure modes from VLA’s (i.e., VLA policies and human operators may fail in different ways), and therefore, the failure detectors trained on teleoperated rollouts may have worse performance when directly applied to the VLA (“on-policy”) rollouts. \n\n# Q4: “How would the failures detected be used to steer/control VLA behavior?”\n\nOur work focuses on detecting failures accurately and in a timely manner, which enables either the robot to abort potentially dangerous actions or a human monitor to step in and take over control. How to learn a recovery policy or how to improve the VLAs themselves are important areas for future work. In this work, we focused on detecting failures of multitask VLAs reliably and in real-time, which is a crucial stepping stone towards autonomous recovery (e.g., with a fallback policy) and policy improvement (e.g., through interactive imitation learning). \n\nWe think it is possible to use the findings from this paper to further develop methods for steering or improving VLA behaviors. For example, we show that the embeddings for successful and failed rollouts are separated in the latent space, so it is possible to learn a steering vector that manipulates the latent activations of a VLA and changes its output actions, as done in [Ref1] and [Ref2]. However, different from the stylization or hallucination reduction tasks for LLMs, robot manipulation involves multistep closed-loop interaction between the policy and the environment, which greatly complicates the relationship between VLA outputs and task execution successes. Therefore, how to improve VLAs through activation steering is a challenging and open research question beyond the scope of our paper. \n\n[Ref1] Inference-time intervention: Eliciting truthful answers from a language model. NeurIPS 2023\n\n[Ref2] Adaptive activation steering: A tuning-free llm truthfulness improvement method for diverse hallucinations categories. ACM TheWebConf 2025"}, {"review_id": "QVvPD9yUXa", "reviewer": "Reviewer_st8r", "summary": "This paper tackles the problem of **multitask failure detection** for large vision-language-action (VLA) robot policies deployed zero-shot on novel tasks. The authors observe via t-SNE that final-layer embeddings from successful and failed rollouts cluster into distinct regions (“failure zone”) regardless of task. Motivated by this, they propose **SAFE** (ScAlable Failure Estimation):\n\n1. **Feature Extraction**: At each timestep, extract the VLA’s final-layer latent vector.\n2. **Lightweight Probe Training**: Train a small MLP or an LSTM over features from multiple seen tasks to regress a scalar failure score st.\n3. **Threshold Calibration**: Use functional conformal prediction on successful seen-task rollouts to derive a time-varying threshold δt that guarantees the false-positive rate does not exceed a user-specified α.\n\nThey evaluate SAFE on three VLA models (OpenVLA, π₀, π₀–FAST) across two simulation benchmarks (LIBERO-10, SimplerEnv) and a real Franka Panda setup. SAFE outperforms diverse baselines—token- and sample-based uncertainty, embedding-distance and OOD detectors, and action-consistency methods—achieving state-of-the-art ROC-AUC on unseen tasks and the best trade-off between detection speed and accuracy.", "questions": "1. Have the author try concatenating or aggregating embeddings from intermediate transformer layers, rather than only the final layer, to detect failures even earlier?\n\n2.  How sensitive is the conformal threshold band to the choice of α in high-risk settings? Could α be adapted online based on task-specific risk profiles?\n\n3. Can the scalar failure score be extended to a multi-dimensional output (e.g., grasp failure vs. collision) to support targeted recovery strategies?", "limitations": "Yes.", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 4, "significance": 4, "originality": 3, "strengths_and_weaknesses": "**Strengths**\n\n- Comprehensive empirical evaluation across multiple VLA models, tasks, and both simulation and real-robot settings, with multiple random seeds and error bars ensuring statistical confidence.\n- Formal control of false positives via functional conformal prediction, providing theoretical guarantees.\n- Well-organized presentation, clear diagrams, and consistent notation.\n- Tackles a critical safety problem for zero-shot deployment of generalist VLAs in a novel multi-task setting, demonstrating substantial gains over both specialist and generic uncertainty-based baselines.\n- First systematic study of multitask failure detection in VLA policies, with the insightful discovery of a task-agnostic “failure zone” in the embedding space.\n\n**Weaknesses**\n\n- The reliance on simple one- or two-layer probes may underutilize richer representations; unclear how performance scales if future VLAs integrate deeper multi-layer feature fusion or cross-modal attention architectures.\n- Experiments focus exclusively on manipulation tasks and final-layer embeddings; the method’s robustness under radical domain shifts (e.g., navigation, aerial manipulation, or action-less video inputs) and when aggregating mid-level features remains untested.\n- Core components (feature probing, conformal calibration) are adaptations of existing techniques; the primary novelty resides in their tailored application to VLA failure detection rather than introducing fundamentally new algorithms.\n- Focuses solely on early failure prediction without investigating strategies for recovery or intervention once a failure is detected.", "was_revised": true, "final_justification": "I remain positive about this work, recognizing its potential contributions to the field of embodied AI. As noted, the manuscript effectively addresses the challenge of failure detection, a persistent and complex issue in this domain. Although straightforward, the method introduces a nearly cost-free solution that could significantly enhance a variety of existing VLAs. The analysis and its outcomes provide valuable insights to society. However, while the method itself holds value, addressing additional aspects such as investigation into module design, feature selection, and types of failures is also crucial. These elements are essential for rounding out the research, potentially increasing the societal impact of the work.", "rebuttal": "&nbsp;\n\nWe thank the reviewer for the comprehensive feedback! We are grateful that the review acknowledged that our paper is a **pioneer systematic study with comprehensive evaluation, insightful discovery, and well-organized presentation**, and also that SAFE tackles a **critical safety problem, provides formal control with theoretical guarantees, and demonstrates substantial gains over baselines**! \n\n&nbsp;\n\n# W1, Q1: “One- or two-layer probes may underutilize richer representations; unclear how performance scales if future VLAs integrate deeper multi-layer feature fusion or cross-modal attention architectures.” “Try concatenating or aggregating embeddings from intermediate transformer layers?”\n\nWe thank the reviewer for bringing up this point! We maximized the simplicity and transferability when designing SAFE. By only taking feature vectors at the last layer, the proposed method can be easily integrated into any VLA models with minimal implementation changes and no finetuning on the VLAs themselves. \n\nHowever, we do agree that fusing or aggregating deep features from multiple layers is a promising direction and can be beneficial for failure detection. Related works have shown potential in this direction. For example, [Ref1] proposed Truthfulness Separator Vector (TSV), which is injected in the LLM latent features in the middle of the transformer and is optimized to better separate the hallucinated and truthful responses in the final token feature space. We think a similar technique can also be developed for VLA failure detection. However, this would require a special design and implementation for each VLA model (as some VLA models output discrete tokens, and others use flow matching to output continuous actions, there may not be a single design that can be applied to all VLA architectures), reducing its transferability. We leave the development of such methods as a promising future work. \n\nWe also agree that simply using the latent feature from an intermediate transformer block may lead to better failure detection performance than the very last layer. As shown by [49] and [53], LLM latent features from different layers have different performance on hallucination detection, and the best one may not be the last layer. However, exactly which layer works the best depends on the model and requires extensive ablation experiments to find out. For example, as reported by [49], for the OPT-6.7B model, the 20th layer works the best, but for LLAMA2-7B, the 16th layer works the best. To locate the best layer, [49] has to perform a grid search over each LLM tested. On the contrary, in our setting, VLA users can avoid such grid search experiments and simply choose the final layer for failure detection. Therefore, we think that precisely finding the layer that works the best for VLA failure detection is outside the scope of this paper, but it would be very interesting to explore for future work. \n\n[Ref1] Steer LLM Latents for Hallucination Detection, ICML 2025\n\n\n# W2: “The method’s robustness under radical domain shifts (e.g., navigation, aerial manipulation, or action-less video inputs)”\n\nWe thank the reviewer for mentioning this. SAFE only requires access to the latent features from VLA models and is broadly applicable to other domains as long as they use a white-box robot policy based on neural networks. In this work, we focus on robot manipulation tasks and VLA policies because dexterous manipulation is widely accepted to be one of the most challenging domains for VLAs, where diverse failure modes exist. We leave the application and the evaluation to other robot and non-robot (action-less video) domains for future work. \n\n\n# W3: “Adaptations of existing techniques; the primary novelty resides in their tailored application to VLA failure detection rather than introducing fundamentally new algorithms.”\n\nWe agree with the reviewer that SAFE is indeed adapted from existing techniques. However, we would also like to thank the reviewer for pointing out contributions in multiple aspects besides technical novelty, including (1) the first systematic study of multitask failure detection in VLA policies, (2) the insightful discovery of a task-agnostic “failure zone”, (3) comprehensive empirical evaluation across multiple settings, (4) formal control of false positives via functional conformal prediction, and (5) demonstrating substantial gains over baselines in a novel multitask setting. \n\n\n# W4: “Without investigating strategies for recovery or intervention once a failure is detected.” \n\nFollowing prior works [8,17], we also primarily focus on detecting failures accurately and in a timely manner. As long as the failure is detected, the robot can either abort potentially dangerous actions or a human monitor can step in and take over control. \n\nDesigning a fallback policy or an automatic failure recovery algorithm is a challenging and open research problem. We think this is beyond the scope of this work, and is a promising future direction. \n\n\n# Q2.1: \"How sensitive is the conformal threshold band to the choice of α in high-risk settings?”\n\nPlease refer to Figure 8 in the appendix for a comprehensive list of how TPR, TNR, and balanced accuracy change with $\\alpha$. From Figure 8, we can observe that while the metrics do vary with the $\\alpha$, choosing $\\alpha=0.15$ (or in general, between 0.05 and 0.2) performs well across the board. We have also chosen $\\alpha$ to be 0.15 for most qualitative results and analyses reported in the paper. \n\n\n# Q2.2: “Could α be adapted online based on task-specific risk profiles?”\n\nYes, the proposed method and baselines can be extended to online or adaptive conformal prediction (CP) [Ref1]. In such a framework, rollout results are observed one-by-one and compared to the prediction results, and the significance level $\\alpha$ is adjusted if the prediction is wrong. \n\nHowever, when VLA policies are deployed, they may constantly meet novel environments and customized task instructions, and may rarely repeat the same task. In such a case, it can be hard or even impractical to develop an adaptive CP band for each specific task. Therefore, in this work, we focus on the performance of failure detectors when they are directly deployed on a novel task, and have never seen or repeated the task before. In this setting, offline CP is more appropriate. \n\nNevertheless, we believe online CP is an interesting extension to our work, and we leave it as an important future work. \n\n[Ref1] Adaptive conformal inference under distribution shift. NeurIPS 2021\n\n\n# Q3: “Extended to a multidimensional output (grasp vs. collision) for targeted recovery strategies?”\n\nYes, the proposed method can be extended to a multi-class classifier that categorizes failures into different types. However, this would require annotations on failure types and demands manual efforts. SAFE aims to detect failures with minimal annotation effort (only labels on failure vs success), and we leave the multidimensional output extension as a valuable future work. \n\nMoreover, as described in Appendix Section B.3, sometimes the timing and type of failure can be ambiguous and hard to determine. Therefore, the multi-dimensional extension will be non-trivial and require extra considerations."}]

Author rebuttal:

Meta-review: This paper introduces SAFE, a lightweight and generalizable failure detection framework for VLA policies. The work tackles an important and underexplored safety challenge. The work also has strong empirical results across multiple VLAs, simulation benchmarks, and real-world robot deployments. There are some remaining concerns about the limited scope of real-world validation, reliance on final-layer features, the large number of rollouts needed for training.
Decision: Accept (poster)