Safety-critical task planning in robotic systems remains challenging: classical planners suffer from poor scalability, Reinforcement Learning (RL)-based methods generalize poorly, and base Large Language Models (LLMs) cannot guarantee safety. To address this gap, we propose safety-generalizable large language models, named SafeGen-LLM. SafeGen-LLM can not only enhance the safety satisfaction of task plans but also generalize well to novel safety properties in various domains. We first construct a multi-domain Planning Domain Definition Language 3 (PDDL3) benchmark with explicit safety constraints. Then, we introduce a two-stage post-training framework: Supervised Fine-Tuning (SFT) on a constraint-compliant planning dataset to learn planning syntax and semantics, and Group Relative Policy Optimization (GRPO) guided by fine-grained reward machines derived from formal verification to enforce safety alignment and by curriculum learning to better handle complex tasks. Extensive experiments show that SafeGen-LLM achieves strong safety generalization and outperforms frontier proprietary baselines across multi-domain planning tasks and multiple input formats (e.g., PDDLs and natural language).
Figures & tables
Fig. 1 : Overview of the proposed SafeGen-LLM framework. Stage I performs SFT on formally verified, safety-constrained plans. Stage II applies GRPO using fine-grained reward signals derived from formal verification to enforce safety alignment.
Domain
Description
Safety Constraints
Blocksworld
The agent must rearrange stacked blocks into a desired configuration using pick-and-place actions.
Blocks must be stacked in a safe and stable order, e.g., a supporting block must be positioned before the blocks it supports.
Ferry
The agent controls a ferry that transports cars between locations.
The ferry must never be overloaded, and cars must safely reach their destinations before the ferry departs or returns.
Grippers
A robot with two grippers must pick up and deliver all objects to a target room.
Robots (or manipulators) must avoid operating simultaneously in the same narrow room, and certain grippers may be restricted for safety-critical objects.
Spanner
A worker must collect spanners and tighten all nuts across connected locations.
Bolts must be tightened in a safe sequence (e.g., foundation nuts before upper ones), and access to shared tools (e.g., entering the tool shed) is limited to prevent unsafe congestion.
TABLE I : Brief introduction of the domains and their safety constraints.
Fig. 2 : Pipeline for dataset construction.
Fig. 3 : Three-way benchmark comparison: GPT-5.2 vs OPTIC vs Fast Downward. Green squares = success, red circles = failure.
Fig. 4 : Error type distribution across training stages (Pretrained → SFT → GRPO) for Mistral-7B in the Blocksworld domain.
Domain
Success Plans
Plan Format Error
Precondition Violation
Safety Constraint Violation
Goal Not Satisfied
PT
SFT
GRPO
PT
SFT
GRPO
PT
SFT
GRPO
PT
SFT
GRPO
PT
SFT
GRPO
Qwen3-14B
Blocksworld
2.0
70.0
88.0
90.0
0.0
0.0
6.0
24.0
12.0
0.0
2.0
0.0
2.0
4.0
0.0
Ferry
0.0
86.0
96.0
10.0
0.0
0.0
90.0
4.0
4.0
0.0
10.0
0.0
0.0
0.0
0.0
Grippers
2.0
92.0
98.0
0.0
0.0
0.0
46.0
4.0
0.0
46.0
4.0
2.0
6.0
0.0
0.0
Spanner
0.0
100.0
100.0
2.0
0.0
0.0
98.0
0.0
0.0
0.0
0.0
0.0
0.0
0.0
0.0
TABLE II : Error Type Percentages by Domain Across Training Stages
Domain
Success ↑
Format Error
Precondition Violation
Safety Constraint Violation
Goal Not Satisfied
PDDL3
NL
JSON
PDDL3
NL
JSON
PDDL3
NL
JSON
PDDL3
NL
JSON
PDDL3
NL
JSON
Blocksworld
88.0
74.0
80.0
0.0
0.0
0.0
12.0
18.0
8.0
0.0
8.0
8.0
0.0
0.0
4.0
Ferry
96.0
90.0
96.0
0.0
0.0
0.0
4.0
6.0
2.0
0.0
4.0
2.0
0.0
0.0
0.0
Grippers
98.0
82.0
98.0
0.0
0.0
0.0
0.0
14.0
2.0
2.0
4.0
0.0
0.0
0.0
0.0
Spanner
100.0
90.0
96.0
0.0
2.0
0.0
0.0
8.0
4.0
0.0
0.0
0.0
0.0
0.0
0.0
Average
95.5
84.0
92.5
0.0
0.5
0.0
4.0
11.5
4.0
0.5
4.0
2.5
0.0
0.0
1.0
TABLE III : Performance comparison: Symbolic (PDDL3) vs Natural Language vs JSON input. All values in %.
Fig. 5 : Cross-model success rate comparison across four domains.
Model
Blocksworld
Ferry
Grippers
Spanner
Avg.
Success Rate (%) ↑
Pretrained
50.0
0.0
50.0
0.0
25.0
GRPO
94.0
98.0
98.0
100.0
97.5
Avg. Retries ↓
Pretrained
3.50
5.00
3.00
5.00
4.13
GRPO
1.36
1.12
1.14
1.00
1.16
TABLE IV : Comparison of Planning Success Rates and Retry Counts with SafePilot.
Fig. 6 : Real-world validation in Blocksworld: (a) simulation case study comparing a classical solver (unsafe) with our safety-aware planner (safe); (b) physical deployment on a robot arm.
Hyperparameter
SFT
GRPO
Learning rate
2×10−4
1×10−5
LR scheduler
Cosine
Cosine
Batch size
4
8
Gradient accumulation
2
4
Effective batch size
8
32
Training duration
3 epochs
1,000 steps
TABLE V : Training hyperparameters for SFT and GRPO.
Category
Reward range
Success ( c5 )
+1.0 (fixed)
Goal not satisfied ( c4 )
[−0.4,−0.1]
Precondition violation ( c3 )
[−0.6,−0.3]
Safety violation ( c2 )
[−0.9,−0.6]
Format error ( c1 )
−1.0 (fixed)
TABLE VI : Reward intervals for each validation category.
Phase
Progress
Easy
Medium
Hard
Early
0–30%
70%
25%
5%
Mid
30–70%
40%
40%
20%
Late
70–100%
20%
40%
40%
TABLE VII : Curriculum schedule: sampling probabilities by training phase.
Domain
Train
Test
Problem size range
Blocksworld
500
50
3–6 blocks
Ferry
500
50
3–4 locations, 2–3 cars
Grippers
500
50
1 robot, 3–4 rooms, 3 objects
Spanner
500
50
2–3 spanners, 2 nuts, 3–4 locations
Total
2,000
200
—
TABLE VIII : Dataset statistics and problem size ranges per domain.
Parameter
Local
API
Temperature
0.6
default
Top- p
0.9
default
Max new tokens
1,024
default
Max sequence length
5,000
—
Quantization
4-bit
—
Timeout per problem
—
300s
TABLE IX : Evaluation parameters for local and API-based models.
Large language models are increasingly used as planners for robotic systems, yet how safely they plan remains an open question. To evaluate safe planning systematically, we introduce DESPITE, a benchmark of 12,279 tasks spanning physical and normative dangers with fully deterministic validation. Across 23 models, even near-perfect planning ability does not ensure safety: the best-planning model fails to produce a valid plan on only 0.4% of tasks but produces dangerous plans on 28.3%. Among 18 open-source models from 3B to 671B parameters, planning ability improves substantially with scale (0.4-99.3%) while safety awareness remains relatively flat (38-57%). We identify a multiplicative relationship between these two capacities, showing that larger models complete more tasks safely primarily through improved planning, not through better danger avoidance. Three proprietary reasoning models reach notably higher safety awareness (71-81%), while non-reasoning proprietary models and open-source reasoning models remain below 57%. As planning ability approaches saturation for frontier models, improving safety awareness becomes a central challenge for deploying language-model planners in robotic systems.
Tao Zhang, Kaixian Qu, Zhibin Li +4
ETH Zurich, Zurich, Switzerland. · University College London, London, United Kingdom. · Stanford University, Stanford, California, United States. +2
Large Reasoning Language Models (LRLMs) enable multi-step reasoning for robotic task planning, but continued reasoning can overwrite valid intermediate plans or leave constraint violations unresolved, reducing planning reliability and wasting inference-time computation. We develop an inference-time monitor that exposes and verifies intermediate plans without disrupting the original decoding trajectory. Building on this monitor, we propose SafeInferCom, a formal verifier-guided framework that preserves valid intermediate plans and directs error correction during generation. Experiments across multiple LRLMs and planning domains reveal reasoning-response inconsistency and limited self-correction under one-shot inference. SafeInferCom improves planning success and accelerates error correction relative to one-shot inference. When combined with iterative refinement, it further improves success while reducing token usage compared with refinement alone. We additionally evaluate SafeInferCom in VirtualHome and provide a real-world robotic-arm demonstration.
Weizhe Xu, Jialiang Fan, Mengyu Liu +1
University of Notre Dame · Washington State University
Large Language Models (LLMs) have recently shown strong promise for robotic task planning, particularly through automatic planning domain generation. However, prior approaches largely treat generated planning domains as planning utilities, which are brittle under imperfect logical states and perception noise, overlooking their potential as scalable sources of reasoning supervision and structured reward signals. At the same time, reasoning LLMs depend on chain-of-thought (CoT) supervision that is expensive to collect for robotic tasks, and reinforcement learning (RL) faces challenges in reward engineering. We propose Self-CriTeach, an LLM self-teaching and self-critiquing framework in which an LLM autonomously generates symbolic planning domains that serve a dual role: (1) enabling large-scale generation of robotic planning problem-plan pairs, and (2) providing structured reward functions. First, the self-written domains enable large-scale generation of symbolic task plans, which are automatically transformed into extended CoT trajectories for supervised fine-tuning. Second, the self-written domains are reused as structured reward functions, providing dense feedback for reinforcement learning without manual reward engineering. This unified training pipeline yields a planning-enhanced LLM with higher planning success rates, stronger cross-task generalization, reduced inference cost, and resistance to imperfect logical states. GitHub Page: https://markli1hoshipu.github.io/Plan_LLM/
Jinbang Huang, Zhiyuan Li, Yuanzhao Hu +4
Huawei Noah’s Ark Lab · University of Toronto · University of British Columbia +1