No Free Checker: A Survey of Verifiers for Robot Policies
Abstract
The survey examines robot policy verifiers across availability and credibility, finding that increased accessibility reduces trustworthiness, and proposes metrics to validate verifiers.
A verifier for robot policies reads a candidate behavior and returns a score for how well it did, used both to evaluate vision-language-action policies and to train them. Verifiers range from success detectors and reward models to runtime monitors, safety filters, and temporal-logic specifications. We survey roughly 150 verifiers and compare them along two properties. Availability is how much a verdict costs, how early in a rollout the verdict arrives, and how often a verdict can be asked for. Availability rises as verdicts get cheaper, earlier, and denser. Credibility is how much a high score tells us about the task. Credibility falls as the judgment becomes gameable and self-serving. We group the verifiers by who supplies the judgment: human verifiers, rule-based and formal verifiers, learned and pretrained verifiers, and model-intrinsic verifiers. Across the four families, we find that credibility falls as availability rises. Regardless of who supplies the judgment, there is no free checker. We then examine what validates a verifier itself, and how much a high score tells us. Three measures appear in the literature: agreement with human labels, the performance of the policy it trains, and behavior under reward hacking. We close with nine metrics that make a verifier claim checkable, and coordinates for the verifiers still to be built.
Community
TL;DR Robot learning now runs on verifier scores. A score decides which demos are kept, which action is executed, and what the policy is rewarded for. We read ~150 verifiers and put them on two axes.
- Availability: what a verdict costs, how early in a rollout it arrives, and how often you can ask for one.
- Credibility: how much a high score tells you about the task.
Grouped by who supplies the judgment (human, rule-based and formal, learned and pretrained, model-intrinsic), credibility falls as availability rises. Regardless of who judges, there is no free checker.
We also ask what validates a verifier itself. Three measures appear in the literature: agreement with human labels, the performance of the policy it trains, and behavior under reward hacking. Every agreement rate and downstream gain we collected was measured on candidates that were never adversarially searched, which is exactly the regime a training reward and a runtime gate live in.
The survey closes with nine metrics that make a verifier claim comparable across papers, six for a score used to select and three for a score optimized against.
📋 Paper list, kept updated: https://github.com/ZJUSCL/Awesome-Robot-Verifier
Missing work, wrong placement, or a metric you think is unreportable in practice: issues and PRs welcome.
The availability/credibility tradeoff is the cleanest statement of this problem I have read, and it has a direct consequence for how attack results on robot policies get published.
Almost every published VLA attack result uses a cheap rule-based verifier: some envelope or keep-out predicate over simulator state. By your axes, that is maximum availability and therefore minimum credibility, and the papers do not report it that way. They report a single attack success rate as if the verifier were exact.
The missing number is what the verifier does when nothing is attacking. In our runs, a default keep-out predicate fires on 2 of 50 benign rollouts. So a headline 44/50 is 44/50 against a floor of 2/50, and part of that floor is the policy failing and part is the predicate reading a pose it should not. Without publishing it, a reader cannot tell which.
Reading your survey, I think the honest rule for anyone using a high-availability verifier is: publish the verifier's own false-positive rate on a matched no-attack control at the same task and seed, and never subtract it. That is a reporting convention rather than a verification advance, so it sits alongside your taxonomy rather than inside it.
One question. Among the ~150 verifiers you surveyed, did any of them report their own false-positive rate on a benign control as standard practice, or is it absent across the board? That is the thing I could not establish from the outside.
Get this paper in your agent:
hf papers read 2609.09250 Don't have the latest CLI?
curl -LsSf https://hf.co/cli/install.sh | bash Models citing this paper 0
No model linking this paper
Datasets citing this paper 0
No dataset linking this paper
Spaces citing this paper 0
No Space linking this paper
Collections including this paper 0
No Collection including this paper