We investigate whether automatic speech recognition (ASR) errors in user input can lead to unsafe outputs from Embodied AI (EAI) models. We find that ASR errors can lead to harmful instructions being accepted and executed by EAI models, thereby reducing safety. We simulate ASR errors and combine them with existing safety benchmarks (SafeAgentBench and POEX) to evaluate how different errors affect embodied AI safety. We find that some of them preserve semantic structure but increase harmful ambiguity, while others weaken the model refusal behaviour and allow unsafe plans to be generated and executed. We show that in some cases automatic correction of ASR errors can reduce the risk, but this is not always effective. Overall, we show that ASR errors lead to significant safety risks for embodied AI.
Figures & tables
Figure 1: Example unsafe executable policy induced by POEX adversarial suffixes ( Lu et al., 2024 ) .
Figure 2: Overall Research Design and Information Flow.
Figure 3: Examples of four ASR Error Types.
Figure 4: Examples of noise at different WER levels.
Error Type
AR (%)
ESR (%)
Safety Flips
Baseline (Clean)
55.33
35.33
—
Acoustic Substitution
60.00
38.67
14
Grammar Confusion
51.33
32.00
5
Punctuation Segmentation
52.00
30.67
11
Short Word Omission/Substitution
54.00
38.00
8
Noise Addition (Mild, WER 6%)
56.00
33.33
8
Table 1: Safety evaluation results under different ASR error types (for Qwen2.5-7B-Instruct)
Error Type
AR
ESR
Flips
Baseline (Clean)
55.33
35.33
—
Acoustic Substitution
60.00
38.67
14
Heavy Noise (WER 53%)
62.00
36.00
14
Acoustic Substitution (Corr.)
53.33
30.67
6
Heavy Noise (Corr.)
57.33
36.00
13
Table 2: POEX Correction Results
Cond.
Model
Eval.
Success
Fail
Rate
Clean
GPT-4o-mini
300
83
217
27.67%
Clean
GPT-4.1-mini
300
114
186
38.00%
Mixed ASR
GPT-4o-mini
300
70
230
23.33%
Mixed ASR
GPT-4.1-mini
300
107
193
35.67%
Table 3: SafeAgentBench Results Under Clean and Mixed ASR Conditions
General purpose language models are increasingly able to control robotic hardware. Understanding the capabilities and safety of these models when embodied is therefore increasingly important for understanding their societal impact and risks. To this end, we introduce Inspect Robots, a modular, open-source framework for developing and running evaluations of embodied agents. Inspect Robots pairs customizable, reusable abstractions for specifying physical evaluations and analyzing their results with infrastructure that automates evaluation setup, execution and termination. We demonstrate Inspect Robots by using it to evaluate the capabilities and safety of six policies based on frontier language models. Inspect Robots has seen significant early uptake, receiving nearly 100,000 downloads in the three months since its release.
Christopher Leet, Achu Menon, Sravanthi Machcha +12
Robocurve · University of Southern California · San Jose State University +7
In embodied AI, safety risk can be latent: a benign instruction and a safe scene become hazardous only when composed. Prior work has advanced embodied safety by varying visual contexts or evaluating execution-time dynamics, but the complementary axis of fixing the scene and varying only the instruction remains underexplored. We introduce GuardianBench, an instruction-contrastive benchmark grounded in international safety standards that isolates this latent contextual risk through 3,024 instruction-scene examples organized as same-scene Safe/Unsafe contrastive pairs across various hazard categories. Benchmarking state-of-the-art vision-language models (VLMs) reveals instruction-insensitive verdicts: models disproportionately approve both instructions under a given scene; across the primary models, average pair accuracy is only 24.1%. Our systematic rationale audit localizes the dominant failure: models fail to bind the instruction-relevant cues that differentiate safe from unsafe compositions. As a post-training case study, Verdict Log-Odds Supervision (VLOS), a lightweight verdict-level objective, substantially improves performance on open-weight backbones. Together, our latent contextual risk task formulation, standards-grounded contrastive benchmark construction, pair-level and rationale-level failure diagnosis, and benchmark-enabled verdict calibration establish GuardianBench as a controlled evaluation suite for exposing and improving safety reasoning over instruction-scene compositions under latent contextual risk.
Zhesheng Zhang, Jiahao Lu, Wei Liu +8
Shandong University · National University of Singapore · Nanjing University of Aeronautics and Astronautics +2
Multimodal Large Language Models are increasingly adopted as autonomous agents in interactive environments, yet their ability to proactively address safety hazards remains insufficient. We introduce SafetyALFRED, built upon the embodied agent benchmark ALFRED, augmented with six categories of real-world kitchen hazards. While existing safety evaluations focus on hazard recognition through disembodied question answering (QA) settings, we evaluate eleven state-of-the-art models from the Qwen, Gemma, and Gemini families on not only hazard recognition, but also active risk mitigation through embodied planning. Our experimental results reveal a significant alignment gap: while models can accurately recognize hazards in QA settings, average mitigation success rates for these hazards are low in comparison. Our findings demonstrate that static evaluations through QA are insufficient for physical safety, thus we advocate for a paradigm shift toward benchmarks that prioritize corrective actions in embodied contexts. We open-source our code and dataset under https://github.com/sled-group/SafetyALFRED.git