Title: SafeVLA: Towards Safety Alignment of Vision-Language-Action Model via Constrained Learning
Venue: NeurIPS 2025
Accepted: yes
Keywords: Vision-Language-Action Models

Safety Alignment

Large-Scale Constrained Learning
Abstract: Vision-language-action models (VLAs) show potential as generalist robot policies. However, these models pose extreme safety challenges during real-world deployment, including the risk of harm to the environment, the robot itself, and humans. *How can safety constraints be explicitly integrated into VLAs?* We address this by exploring an integrated safety approach (ISA), systematically **modeling** safety requirements, then actively **eliciting** diverse unsafe behaviors, effectively **constraining** VLA policies via safe reinforcement learning, and rigorously **assuring** their safety through targeted evaluations. Leveraging the constrained Markov decision process (CMDP) paradigm, ISA optimizes VLAs from a min-max perspective against elicited safety risks. Thus, policies aligned through this comprehensive approach achieve the following key features: (I) effective **safety-performance trade-offs**, reducing the cumulative cost of safety violations by 83.58\% compared to the state-of-the-art method, while also maintaining task success rate (+3.85\%). (II) strong **safety assurance**, with the ability to mitigate long-tail risks and handle extreme failure scenarios. (III) robust **generalization** of learned safety behaviors to various out-of-distribution perturbations. The effectiveness is evaluated on long-horizon mobile manipulation tasks.


Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper aims to answer the following question: How can safety constraints be explicitly integrated into VLAs? To address this problem, the authors propose a method to model safety requirements, then elicit diverse unsafe behaviors systematically, effectively constrain VLA policies via safe reinforcement learning, and rigorously assure their safety through targeted evaluations. In their experimental evaluation, the proposed method achieves effective safety-performance trade-offs, including an 83.58% safety improvement compared to the SOTA method, while also maintaining task performance. The method also provides strong safety assurance that can mitigate long-tail risks and handle extreme failure cases, and is robust to various out-of-distribution perturbations.\n\nSTRENGTHS AND WEAKNESSES:\n**Strengths:**\n\n1.\tThe results show that ISA reduces the cumulative cost by a large margin while maintaining the same task success rate.\n\n2.\tUsing the techniques of Safe RL to fine-tune VLA policy seems an interesting and promising direction.\n\n3.\tThis paper not only provides a VLA policy trained with constraints, but also proposes comprehensive evaluations of safety, including test-time safety, long-tail safety, and extreme failure safety. \n\n**Weaknesses:**\n\n1.\tThe symbolic representation of safety constraints and components requires human design, which may not be scalable and may miss corner cases.\n\n2.\tThe proposed framework does not have a deep correlation with VLA models. For example, the safety considered in this paper does not involve the language description of the task. It looks like a very general safe RL framework to me. If that’s the case, the novelty of this paper is a little bit limited considering a large amount of existing research in the Safe RL area.\n\n3.\tLooks like the proposed method can only be trained with the data collected in the simulation. Then the authors need to show how to overcome the sim-to-real gap to deploy the method in real-world applications.\n\nQUESTIONS:\n1.\tThe abstract could be improved by adding what task the model solves and in terms of what metrics the improvement is.\n2.\tWhat do the different lines mean in Figure 1? Since this is a complex figure, annotations are necessary for illustration.\n3.\tThe authors define 5 types of safety-critical scenarios by “These components represent specific environmental substructures or situations that have a high potential to induce unsafe robot behaviors.” Is there any structural reason for this selection? Do these scenarios have good coverage in the indoor navigation task?\n\nLIMITATIONS:\nThere is a “Limitations and Future Work” section and an “Impact statement” section in the appendix.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 2, "ORIGINALITY": 2, "DATE": "2025-06-22"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nSafeVLA addresses the challenge of integrating explicit safety constraints into vision-language-action (VLA) robotic models without sacrificing task performance. The paper proposes an Integrated Safety Approach (ISA) that combines several components into a cohesive safety-alignment pipeline. The ISA models safety requirements within a constrained Markov decision process (CMDP) framework and constrains the VLA policy via safe reinforcement learning (using CMDP-based Lagrangian optimization), with targeted evaluations and stress-testing for additional safety assurances. The authors also introduce the Safety-CHORES Benchmark, designed to assess both task performance and safety in complex, realistic scenarios. The authors also claim the SafeVLA approach yields an 83.58% reduction in safety incidents (unsafe events) relative to the current state-of-the-art VLA method, while slightly improving task success (+3.85% success rate). Demonstrating that safe policies can be learnt without harming (and sometimes improving) task performance.\n\nSTRENGTHS AND WEAKNESSES:\n### Strengths\n- This paper appears to be the first integration of safe RL (CMDP) into the domain of VLAs.\n- The authors adoption of the CMDP framework and Lagrangian optimization is reasonably sound in this context.\n- The paper has no major issues with clarity, the empirical setup and evaluation framework are very comprehensive, clearly described and sound. \n- This work generally has the possibility to provide significant impact into fields such as LLM/VLM safety and Robotics.\n\n### Weaknesses\n- Contributions can be construed as incremental, the VLA training methodology is well established and the safe RL (CMDP) method is based on adaptive Lagrange multipliers using well established techniques for updating the dual variables (which can also be sensitive to initialization and unstable). The main contribution can thus be seen as a natural extension of these two methods.\n-  Many of the details are left in the appendix, while space constraints can be an issue, the second half of the paper reads mostly like bullet points with most details relegated to the appendix and limited discussion (this includes related work and limitations).\n- Some claims are overstated: `CMDP offers a formal approach' indeed this is more rigorous than simple fixed cost penalties, but the gauarntees achieved are not that strong (certainly not analagous to the hard guarantees that can be ontained from formal methods) most of the gains are empirical -- we have no formal guarantees on safety assurance, i.e., the method provides empirical safety assurance but not a formal guarantee.\n- Some lack of clarity re the cost thresholds and initial lagrange multipliers (see Questions).\n\nQUESTIONS:\n1. How exactly are the diverse unsafe behaviors generated and collected for use in ISA?\n2. The CMDP formulation includes safety cost limits (b_i for each cost). How were these limits determined or tuned? For instance, is 0% collision the target (hard constraint) or something like “at most X collisions per episode”?\n3. I could not find details on how the Lagrange multipliers are initially chosen or tuned, what value to you set the intial Langrange multipliers to? Did you witness instability or task failure in training for overly conservative intializations? Was the convergence of the Lagrange mutlipliers slow and the VLA failed to quickly reduce constraint violations?\n4. Does the approach assume that the only source of unsafe behavior is low-level execution? For instance, could there be misunderstandings of the instruction that lead to unsafe actions (like misinterpreting “pick up the knife” and doing something dangerous)?\n5. Would you consider experimenting with more sophisticated approaches from safe RL, e.g., augmented Lagrangian or even beyond CMDPs and expected cumulative cost constraints and thresholds?\n\nLIMITATIONS:\nThe authors explicitly include a section on limitations (Section G) where they acknowledge key weaknesses of the work. They note that while ISA was thoroughly evaluated in simulation, it has not been validated on real robots or in real-world environments due to practical constraints. This admission is important – it sets a realistic expectation that further testing is needed before claims of safety translate to physical deployment. Although this is reasonably well justified by the associated risk and expense of of collecting unsafe experiences in the real world. They also mention the need for dynamic constraints that adapt to changing environments, implying that their current model might not handle dynamic obstacles or evolving hazards as effectively.  Lastly, they state that in real-world settings, additional external safety measures (like emergency stops, physical guards, etc.) will be necessary -- basically admitting that their learned policy should be one layer of safety, not the sole protector. This holistic understanding is good to see; it shows the authors are not overclaiming that SafeVLA alone can solve all safety issues.\n\nOne minor gap in the limitations discussion is the lack of formal guarantees, which we identified earlier. While they don’t claim to have them, it might have been worth explicitly noting that their method does not guarantee absolute safety, only improves it empirically. \n\n### Societal impact\n\nThe authors provide an Impact Statement (Section H) where they address how their work might positively or negatively affect society. Generally I agree with their sentiment that hat improving the safety of AI systems in real-world applications is a direct aim of the work -- safer robots mean fewer accidents, which is clearly beneficial. Furthermore, the authors astutely identify a potential misuse: the techniques developed could theoretically be exploited to misalign a model deliberately, i.e., someone could try to train a VLA to be unsafe or to ignore certain safety constraints, by inverting the method. In other words, a bad actor might use the idea of constrained learning to optimize a robot for causing harm (by treating harmful outcomes as rewards).\n\nGenerally I find their discussion of limitations adequate, although it would be much better if lack of formal guarantees is better highlighted and discussed.", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 3, "CLARITY": 2, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-06-23"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper addresses the problem of aligning vision-language-action (VLA) models with safety constraints in robotic tasks. The authors propose an Integrated Safety Approach (ISA) that explicitly incorporates safety into VLA training via constrained MDP. The paper also introduces Safety-CHORES, a new benchmark of long-horizon tasks. Using this testbed, the authors show that their ISA-aligned policy achieves a 83.58% reduction in safety incidents compared to the best existing method, while actually slightly improving task success (+3.85%).\n\nSTRENGTHS AND WEAKNESSES:\nStrengths: \n\n1. The authors introduce systematic integration of safety constraints into VLA models using CMDP and SafeRL. This framing is innovative in the context of VLAs and addresses a vital gap for real-world deployment.\n\n2. The Safety-CHORES benchmark, a photo-realistic simulated benchmark explicitly designed for safety evaluation is a key contribution of the work.\n\n3. The proposed method achieves an 83.58% improvement in safety over baseline methods while maintaining task success rates.\n\n4. The proposed ISA demonstrates solid performance under out-of-distribution (OOD) conditions.\n\nWeaknesses: \n\n1. All experiments are limited to simulation, so it remains unclear how these safety gains would transfer to real robots with sensor noise, latency and unmodeled dynamics. The authors do mention this issue in the 'Limitations', but still lack of any real data/experiments significantly reduces the value of the paper. \n\n2. The approach also depends on hand-crafted predicates (corners, blind spots..etc), which may not capture the full range of hazards, especially dynamic or unanticipated ones, and would require manual extension to handle new risks. \n\n3. Similarly, assigning a single cost at the end of a violating trajectory is coarse and may obscure which earlier actions caused a failure, potentially hindering learning of precise safety behaviors. \n\n(see Questions for more detailed comments)\n\nQUESTIONS:\n1. Given the promising simulation results, what are the authors’ plans or thoughts on transferring ISA to a real robot? What do they see as the main obstacles for sim-to-real in this safety-critical context (e.g. perception noise, dynamic obstacles, hardware errors)? \n\n2. The paper hand-designs specific safety predicates for the tasks. How sensitive are the results to this choice of safety definitions? \n\n3. Balancing Safety and Task Completion: In extreme cases where a task goal might inherently conflict with safety constraints, how does the framework handle it? Is there a mechanism or plan to allow graded risk tolerance?\n\n4. The benchmarks used (Safety-CHORES, AI2THOR) are synthetic and specific. Can the authors discuss how well ISA generalizes to new environments, such as new room layouts or patterns that different from the training set?\n\n5. Some safety constraints may be triggered more frequently than others. It would be useful to analyze the fairness or balance of constraint violations across different safety types to ensure that rare but critical risks are not under-prioritized.\n\n6. When the language model misidentifies the goal object or confuses spatial relations (e.g., “left of the chair” vs. “on the chair”), do these semantic grounding errors lead to safety violations? How robust is ISA to such scenarios?\n\n7. SafeRL methods are typically known to be sample inefficient. How many episodes are required for ISA to converge compared to baseline models? Does the ISA framework exhibit higher sample complexity?\n\n8. The authors evaluate out-of-distribution (OOD) robustness using low-level visual perturbations (e.g., color, lighting, material). However, have they considered instructional OOD, such as the use of synonyms, rephrased commands, or changes in sentence structure? Would ISA still maintain safety in these scenarios?\n\nLIMITATIONS:\nYes, but the Limitation section is not placed in the main paper (it's currently placed in the SI)", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 5, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-07-01"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nIn this paper, the authors proposed to tackle the safety issue for vision-language-action (VLA) models. Specifically, they developed a four-component framework that formally models safety constraints using mathematical predicates, systematically elicits unsafe behaviors through diverse test scenarios, constrains policy learning using constrained Markov decision processes with Lagrangian optimization, and comprehensively evaluates safety performance across multiple dimensions. The authors translated abstract safety requirements into concrete cost functions within a CMDP framework, where safety violations are penalized through adaptive Lagrange multipliers that balance task performance with constraint satisfaction, while using trajectory-level and state-action predicates to capture both immediate and temporal safety patterns. In addition, the authors propose a new benchmark, called Safety-CHORES. This benchmark includes a variety of tasks such as navigation, pickup, and fetch, with different testing scenarios. \n\nThe proposed method outperforms all baselines with substantial reductions in cumulative safety costs while maintaining improved task success rates, demonstrating its effectiveness in achieving safety-performance trade-offs and showing robust generalization to out-of-distribution scenarios and extreme failure cases.\n\nSTRENGTHS AND WEAKNESSES:\nPros:\n- Overall, the paper is well-written and tackles an important problem that's been largely overlooked in the VLA literature - most existing work focuses on task performance but ignores safety constraints that are crucial for real-world deployment.\n- Safety-CHORES benchmark is a valuable contribution that fills a clear gap in evaluation infrastructure.\n- The CMDP formulation is mathematically rigorous, extending the standard tuple to include language instructions and properly defining the feasible policy set with explicit constraint bounds. \n- The experimental results demonstrate substantial safety improvements while maintaining task performance, and the statistical analysis using logistic regression and correlation tests (Table 3) provides proper evidance. \n\nCons:\n- The cost function design for trajectory-level predicates is overly simplistic - assigning cost=1 only to the final step of violating segments ignores the temporal dynamics and could lead to poor credit assignment, which the authors acknowledge but don't address.\n- It seems that the feasible policy definition in Eq. (1) uses expected cumulative costs but the actual implementation appears to use instantaneous costs Eq. (5) (in appendix) , creating a potential mismatch.\n\nQUESTIONS:\n- The constraint formulation treats all safety violations equally (binary 0/1 costs) rather than having severity-weighted penalties, which seems unrealistic since colliding with a fragile vase should arguably incur different costs than bumping a wall.\n- The Lagrangian method assumes convexity for convergence guarantees, but neural policy optimization is non-convex. \n- The evaluation is entirely simulation-based with no real-world validation, which is particularly concerning for safety research where sim-to-real gaps could have serious consequences. While I understand it's costly to conduct real-world experiments, it would be great if the authors could discuss more about this. \n- Seems the current evaluation is focused on average cost. The constraint satisfaction is only evaluated in expectation rather than providing stronger guarantees like worst-case bounds or probabilistic certificates that would be more appropriate for safety-critical applications.\n\nLIMITATIONS:\nThere is no negative societal impact.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-07-05"}