cs.RODec 10, 2025
SaveSafe Learning for Contact-Rich Robot Tasks: A Survey from Classical Learning-Based Methods to Safe Foundation Models
Organizations: Human-Robot Interfaces and Interaction Lab, Istituto Italiano di Tecnologia, Genova, Italy. · Ph.D. program of national interest in Robotics and Intelligent Machines (DRIM), Universit`a di Genova, Genoa, Italy. · Edwardson School of Industrial Engineering, Purdue University, West Lafayette, IN, USA. · Humanoids and Human Centered Mechatronics Lab, Istituto Italiano di Tecnologia, Genova, Italy. ·
Abstract
Contact-rich tasks pose significant challenges for robotic systems due to inherent uncertainty, complex dynamics, and the high risk of damage during interaction. Recent advances in learning-based control have shown great potential in enabling robots to acquire and generalize complex manipulation skills in such environments, but ensuring safety, both during exploration and execution, remains a critical bottleneck for reliable real-world deployment. This survey provides a comprehensive overview of safe learning-based methods for robot contact-rich tasks. We categorize existing approaches into two main domains: safe exploration and safe execution. We review key techniques, including constrained reinforcement learning, risk-sensitive optimization, uncertainty-aware modeling, control barrier functions, and model predictive safety shields, and highlight how these methods incorporate prior knowledge, task structure, and online adaptation to balance safety and efficiency. A particular emphasis of this survey is on how these safe learning principles extend to and interact with emerging robotic foundation models, especially vision-language models (VLMs) and vision-language-action models (VLAs), which unify perception, language, and control for contact-rich manipulation. We discuss both the new safety opportunities enabled by VLM/VLA-based methods, such as language-level specification of constraints and multimodal grounding of safety signals, and the amplified risks and evaluation challenges they introduce. Finally, we outline current limitations and promising future directions toward deploying reliable, safety-aligned, and foundation-model-enabled robots in complex contact-rich environments. More details and materials are available at our \href{ https://github.com/jack-sherman01/Awesome-Learning4Safe-Contact-rich-tasks}{Project GitHub Repository}.
Figures & tables
Figure 1: Trend of research publications that include keywords related to both safety, contact-rich robotics and learning. Representative example works are shown: contact-rich tasks, safe control, and learning-based methods [ 32 , 33 ] . The count for 2025 is incomplete: it contains only the publications indexed up to our literature-search cut-off (August 2025), so the 2025 bar is not directly comparable with the complete years. Year-over-year comparisons should therefore be based on the complete years 2018–2024, and the trend should be read from the yearly counts rather than from a single overall growth percentage.
Figure 2: Schematic illustrations of four representative contact-rich tasks: surface grinding, peg-in-hole insertion, massaging, and non-prehensile pushing, highlighting the dominant contact configuration and force directions ( : normal contact force).
Figure 3: Structure of this survey. We introduce the background and definitions in the beginning of, and categorize existing methods from different perspectives, including task characteristics, sensing and policy modalities, data acquisition strategies, simulation environments and benchmarks, safety evaluation metrics, safety abstraction levels, and safety enforcement spaces. Our results consist of the discussion of open challenges and new perspectives.
Figure 4: Hexagonal ratings across six comparison axes (higher values indicate stronger relative performance on a 1–5 scale). (A1) Guarantee strength: 1 = empirical/heuristic only, 5 = hard safety (invariance/reachability-style). (A2) Model independence: 1 = requires an accurate known model, 5 = model-free / black-box / learned abstraction. (A3) Online efficiency: 1 = heavy online optimization, 5 = lightweight runtime (most computation offline). (A4) Conservatism / tunability: 1 = highly conservative with few tuning knobs, 5 = explicitly risk-tunable and typically less conservative in practice. (A5) Scalability / real-time viability: 1 = struggles in high-dimensional contact-rich or multi-agent settings, 5 = scales well and runs in real time. (A6) Data efficiency (safe learning): 1 = data-hungry, 5 = requires little data to ensure safety or supports efficient safe data collection. These ratings are an explicit, rubric-based relative synthesis, not benchmark measurements: the 1–5 anchors for each axis are defined in Table 1 , the per-method rationale and supporting evidence are given in Table 2 , and each score was assigned independently by two of the authors using that rubric and reconciled by discussion.
| Axis | Score 1 | Score 3 | Score 5 |
|---|---|---|---|
| A1 Guarantee strength | Empirical / heuristic only | Stability- or probability-based guarantee | Hard safety (set invariance / reachability) |
| A2 Model independence | Requires an accurate known model | Approximate or partially identified model | Model-free / black-box / learned abstraction |
| A3 Online efficiency | Heavy online optimization | Moderate per-step optimization (e.g., a QP) | Lightweight runtime (most computation offline) |
| A4 Conservatism / tunability | Highly conservative, few tuning knobs | Some tunable safety margins | Explicitly risk-tunable, less conservative in practice |
| A5 Scalability / real-time | Struggles in high-dimensional contact-rich or multi-agent settings | Moderate (limited horizon or contact count) | Scales well and runs in real time |
| A6 Data efficiency | Data-hungry | Moderate data requirement | Little data needed, or supports efficient safe data collection |
Table 1: Scoring rubric for the hexagonal ratings of Fig. 4 . For each axis we give the anchors for scores 1, 3, and 5 on the relative 1–5 scale; scores of 2 and 4 denote intermediate cases that interpolate between adjacent anchors. The ratings are an ordinal, relative synthesis across the cited studies, not absolute benchmark measurements.
| Method family | Rationale for its A1–A6 profile (with supporting references) |
|---|---|
| RTS (reachability-based safeguard) | Strong guarantee (A1: hard reachability invariance) and online efficiency (A3: reachable sets precomputed offline, lightweight online projection), and data-efficient (A6: model-based safety preserves RL learning); lower model independence (A2: needs a reasonably accurate model) and tunability (A4: few online knobs, conservative under mismatch) ( 59 , 106 , 107 ) . |
| MPS (model predictive shielding) | Strong guarantee (A1: forecasts and substitutes unsafe actions for zero violation) and adaptivity within the horizon (A4); lower online efficiency (A3: receding-horizon optimization each step) and model independence (A2: needs a predictive model) ( 108 , 123 ) . |
| CBF-QP safety filter | Strong guarantee (A1: forward invariance when assumptions hold) and good online efficiency (A3: a cheap per-step QP); can be conservative under uncertainty (A4 low for worst-case U-CBFs) and depends on an accurate model (A2 low) ( 94 , 95 , 96 ) . |
| Risk-tunable CBF | Like the CBF-QP filter but with explicit risk tuning (A4 high, less conservative) at a probabilistic rather than hard guarantee (A1 moderate); still an online QP (A3 moderate) ( 32 ) . |
| Lyapunov actor–critic (+ impedance) | Strong model independence (A2: largely model-free policy with an impedance layer) and lightweight execution after training (A3); guarantee is stability-based rather than hard invariance (A1 moderate) and effectiveness depends on training coverage (A6 lower) ( 117 , 119 , 124 ) . |
| Advantage-based intervention | Designed for safe exploration: supports efficient safe data collection (A6) and is model-free (A2 high); guarantee depends on a safe backup policy (A1 moderate) and conservatism is set by the intervention frequency (A4 moderate) ( 115 , 60 ) . |
Table 2: Per-method rationale for the hexagonal profiles in Fig. 4 , scored with the rubric of Table 1 . We give the qualitative justification and supporting references for each method family; the plotted 1–5 values themselves are shown in Fig. 4 . Two of the authors assigned scores independently using the rubric and reconciled disagreements by discussion.
Figure 5: We review the contact-rich tasks under four main categories indicated with separate colors. Each category is further divided into sub-categories. The categories are not mutually exclusive. Examples of some downstream tasks that belong to multiple categories are shown as rectangular nodes.
Figure 6: Data pyramid for safe policy learning in contact-rich manipulation. The pyramid is organized into three layers according to physical fidelity and safety relevance. (1) Real-world data: includes task execution logs, high-frequency proprioception (joint states, velocities, tactile and force–torque sensing ), contact-rich interaction episodes, and safe and unsafe or failure cases, which provide the most direct evidence about real physical contacts and safety-critical events. (2) Simulation: includes domain randomization (dynamics, appearance, noise), ground-truth physical quantities (forces, poses, contacts), physics engines (MuJoCo, PyBullet, Isaac Lab), procedural scene and task generation, and residual or learned dynamics models with sim-to-real adaptation, enabling large-scale exploration of contact scenarios under controllable yet imperfect dynamics. (3) Internet and shared datasets: includes web-scale language corpora (LLM data), generic vision datasets (web images and videos), large-scale robot logs with weak contact labels, manipulation datasets with limited contact or safety labels, and task-specific real-robot benchmarks with small scale, which are abundant but only indirectly capture contact-rich and safety-critical phenomena.
| Simulators | Deformable | GPU | Tasks | References |
|---|---|---|---|---|
| MuJoCo | ✓ | ✗ | Manipulation, Locomotion | [ 288 ] |
| MuJoCo XLA/MJX | ✓ | ✓ | Manipulation, Locomotion | [ 289 ] |
| Genesis | ✓ | ✓ | Soft-body, Articulated | [ 300 ] |
| PyBullet | ✓ | ✗ | Manipulation, Grasping | [ 290 ] |
| Isaac Gym | ✓ | ✓ | RL Training, Manipulation | [ 291 ] |
| Isaac Sim | ✓ | ✓ | Photorealistic, Digital Twin | [ 301 , 299 ] |
Table 5: Representative simulation platforms used in learning-based contact-rich robotics, compared in terms of deformable-object support, GPU acceleration, and primary task domains. The table covers general-purpose physics engines, GPU-accelerated robot-learning platforms, and task-specific environments for contact-rich tasks.
| Benchmarks | Scalable | Deformable | GPU | Tasks | References |
|---|---|---|---|---|---|
| RoboVerse | ✓ | ✓ | ✓ | Manipulation, RL Benchmarks | [ 77 ] |
| RoboCasa | ✓ | ✓ | ✓ | Household Tasks, Manipulation | [ 306 ] |
| RoboSuite | ✓ | ✓ | ✓ | Manipulation, RL Benchmarks | [ 307 ] |
| ManiSkill | ✓ | ✓ | ✓ | Manipulation, RL Benchmarks | [ 308 , 309 ] |
| Robot Air Hockey | ✓ | ✗ | ✓ | Air Hockey game | [ 310 ] |
| Meta-World | ✓ | ✗ | ✓ | Manipulation, RL Benchmarks | [ 311 ] |
Table 6: Representative benchmarks commonly used to evaluate learning-based, contact-rich robotic systems. The comparison emphasizes scalability, deformable-object support, GPU acceleration, and core task domains, spanning general manipulation, reinforcement learning, and safety-oriented assessment.
Figure 7: The metrics in the contact-rich safe learning literature can be categorized according to their objectives: Safety, task and efficiency. There are trade-offs between these objectives. The researchers aim to develop safe systems with a good trade-off for task success and efficiency. Some metrics, such as force, velocity and energy serve to measure multiple objectives.
Figure 8: Three levels of result analyses: Global (high-level), variational (mid-level), and exemplar (low-level).
Figure 9: The plan–parameterize–enforce (PPE) architecture used by recent safe VLA systems, instantiated with named modules. The plan stage (e.g., SafeVLA ( 24 ) ; safe robot foundation models ( 4 ) ) emits a task sketch and explicit safety rules; the parameterize stage exposes pose/force/impedance references; the enforce stage applies a certified CBF/reachability/MPC shield. Tactile-augmented variants (e.g., Tactile-VLA ( 365 ) ) feed contact/force signals back to the shield, which is the component that actually bounds interaction forces when upstream semantic grounding is wrong.
| Foundation-model mechanism | Classical safety principle it instantiates |
|---|---|
| Grounding language and rules into formal constraints | Constraint satisfaction & reachability |
| Semantic scene grounding (affordances, no-touch, fragile regions) | Semantic safety |
| Safety critics, refusal, risk-aware action filtering | Risk- & data-driven safety |
| Low-level shields under a VLA planner (CBF / reachability / MPC) | Stability & set invariance |
| Conservative default caps and compliant references | Physical-interaction safety: force, energy, passivity |
| Human-proximity / speed–separation / PPE rules | Human-centered & standard-driven safety |
Table 7: Mapping from foundation-model (VLM/VLA) safety mechanisms to the classical safety principles they instantiate
Figure 10: PRISMA-style flow of the systematic review, with the identification, de-duplication, screening, eligibility, and inclusion stages; the databases and the exact Boolean search string are given in the text.