ShieldVLA: Feasibility-Aware Safety Alignment for Vision-Language-Action Models

Manan Tayal; Akshay Nambi

cs.ROSep 2, 2026

ShieldVLA: Feasibility-Aware Safety Alignment for Vision-Language-Action Models

Authors: Manan Tayal, Akshay Nambi

Organizations: Indian Institute of Science (IISc) · Microsoft Research

Abstract

Vision-Language-Action (VLA) models demonstrate strong generalization in robotic manipulation and navigation, but existing fine-tuning methods provide limited safety guarantees. Current approaches primarily rely on Lagrangian optimization that enforces safety through soft penalties on expected cumulative cost, often resulting in residual constraint violations or overly conservative behavior. Moreover, learning safety in visual domains is challenging due to the absence of dense per-step safety annotations. We propose ShieldVLA, a safety-aligned fine-tuning framework for VLA models based on Hamilton-Jacobi (HJ) reachability. ShieldVLA learns a model-free approximation of the HJ reachability value function directly from visual observations to estimate the safe operating region. The learned safety critic gates policy optimization by separating reward maximization within feasible regions from recovery near unsafe states, avoiding persistent reward-cost trade-offs. To enable scalable supervision in visual environments, we introduce rubric-based VLM safety scores that convert semantic safety feedback into structured critic targets without requiring manual cost labels. Across five navigation and manipulation benchmarks spanning multiple VLA backbones, ShieldVLA reduces cumulative safety cost by 57% on average and improves task success rate by +0.13 over SafeVLA.

Figures & tables

Figure 1: Overview of ShieldVLA. The framework decomposes safe VLA fine-tuning into three decoupled stages. (Left) A frozen VLM scores each observation against a structured safety rubric, producing a continuous safety margin $\ell(o)$ . (Middle) A safety critic $Q^{\mathrm{s}}(o,a)$ is trained online via the Hamilton–Jacobi safety Bellman operator on a shared replay buffer $\mathcal{D}$ . (Right) The critic gates the VLA policy update: feasible states ( $Q^{\mathrm{s}}>\delta$ ) receive the unmodified PPO reward gradient; infeasible states receive a deterministic policy gradient that maximizes safety value via $\mathcal{L}_{\text{safety}}=-Q^{\mathrm{s}}_{\phi}$ . The trained policy $\pi_{\theta}$ is deployed as a single VLA with no runtime shield.

Rubric	What it asks the VLM	$w_{k}$
Proximity	How close is the nearest obstacle?	5
Heading	Is the robot moving toward an obstacle?	4
Contact	Is the robot in contact with an obstacle now?	5
Occlusion	How occluded is the relevant obstacle?	2
Clearance	How much room is there to manoeuvre?	3

Table 1: Default Dubins-VL / TurtleBot-Nav rubric set (

K=5

\rho_{\max}=19

). Each rubric is scored independently in

[0,1]

and the per-frame raw severity is the weighted sum.

Figure 2: Environments: (a) shows the egocentric and top views of the TurtleBot 4 in TurtleBot-Nav, (b) shows the front and side views of the Franka FR3 in Franka-Reach, with its cylindrical obstacle, (c) shows the egocentric and top view of the Stretch RE1 robot used by Safety-CHORES Nav and Safety-CHORES Fetch.

	Dubins-VL		TurtleBot-Nav		S-CHORES Nav		S-CHORES Fetch		Franka-Reach
Method	SR $\uparrow$	CSC $\downarrow$	SR $\uparrow$	CSC $\downarrow$	SR $\uparrow$	CSC $\downarrow$	SR $\uparrow$	CSC $\downarrow$	SR $\uparrow$	CSC $\downarrow$
Unconstrained VLA	0.08	45.7	0.30	22.2	0.45	13.2	0.15	14.1	0.10	45.0
SafeVLA ( Zhang et al., 2025a )	0.22	2.66	0.34	14.6	0.59	1.82	0.34	8.98	0.34	13.4
VisionCBF ( Tayal et al., 2025a )	0.18	1.31	0.38	12.1	0.24	1.22	0.18	6.34	0.29	6.8
HJ (GT cost)	0.38	1.13	–	–	–	–	–	–	–	–
ShieldVLA (Ours)	0.32	1.3	0.54	6.90	0.68	1.44	0.49	5.50	0.45	3.50

Table 2: Main results across all benchmarks (200 evaluation episodes). Higher SR and lower CSC are better. Green indicates best performance per column.

Metric	Dubins-VL	TurtleBot-Nav	S-CHORES Nav	S-CHORES Fetch	Franka-Reach
SR $\uparrow$	$0.32\pm 0.05$	$0.54\pm 0.05$	$0.68\pm 0.03$	$0.49\pm 0.04$	$0.45\pm 0.03$
CSC $\downarrow$	$1.30\pm 0.43$	$6.90\pm 0.43$	$1.44\pm 0.23$	$5.50\pm 0.58$	$3.50\pm 0.74$

Table 3: Multi-seed validation of ShieldVLA across all five environments. Mean

\pm

std over 3 training seeds, 200 evaluation episodes per seed.

	TurtleBot-Nav		Safety-CHORES Nav		Safety-CHORES Fetch		Franka-Reach
Cost signal	SR $\uparrow$	CSC $\downarrow$	SR $\uparrow$	CSC $\downarrow$	SR $\uparrow$	CSC $\downarrow$	SR $\uparrow$	CSC $\downarrow$
Binary	0.31	2.80	0.65	1.60	0.60	7.14	0.25	1.20
VLM Rubric	0.54	6.90	0.68	1.44	0.49	5.50	0.45	3.50

Table 4: Cost-signal ablation : ShieldVLA with VLM rubric costs vs with binary collision indicators (

\ell\in\{+1,-5\}

). Same critic architecture and gating in both. Best per-environment in bold .

Critic use	SR $\uparrow$	CSC $\downarrow$
Lagrangian penalty	0.33	7.80
ShieldVLA gating	0.54	6.90

Table 5: Gating-mechanism ablation on TurtleBot-Nav. Same HJ critic and VLM rubric in both rows; only the policy update differs.

	TurtleBot-Nav				Safety-CHORES Nav				Safety-CHORES Fetch
	SafeVLA		Ours		SafeVLA		Ours		SafeVLA		Ours
Condition	SR	CSC	SR	CSC	SR	CSC	SR	CSC	SR	CSC	SR	CSC
In-dist	0.34	14.6	0.54	6.9	0.59	1.82	0.68	1.44	0.34	8.98	0.49	5.50
+Color	0.29	22.6	0.51	7.8	0.54	3.42	0.70	1.17	0.31	15.1	0.45	6.20
+Light	0.30	22.7	0.59	5.7	0.59	2.33	0.64	0.91	0.32	8.33	0.45	6.33
+All	0.30	22.7	0.51	10.7	0.56	3.27	0.70	0.77	0.30	12.66	0.45	7.18

Table 6: OOD robustness under visual perturbations. Best CSC per (environment, condition) in bold . Avg.

\Delta

rows are reported in the text.

Appendix figures & tables9 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 3: Learned safety critic $Q^{\mathrm{s}}$ on Dubins-VL at different heading angles. Positive values (blue) indicate the feasible region where a safe policy exists; negative values (red) indicate the infeasible region. The safe set contracts near obstacles and for headings directed toward them, consistent with HJ reachability theory.

	$\delta=0.00$	$\delta=0.05$	$\delta=0.10$	$\delta=0.15$	$\delta=0.20$
SR $\uparrow$	0.42	0.46	0.43	0.41	0.37
CSC $\downarrow$	4.24	0.82	0.57	0.08	0.0

Appendix

Table 7: Effect of the safety-gate threshold

\delta

on Dubins-VL. Same trained safety critic and VLM rubric in every row; only

\delta

changes. Mean over 200 evaluation episodes. Default

\delta=0.2

corresponds to the Dubins-VL row of Table 2 .

	5-rubric (base)	7-rubric (post-RTD)
Qwen3-VL-2B	0.500 (mode collapse)	0.550
Qwen3-VL-8B	0.512	0.608

Appendix

Table 8: Pre-contact tail AUROC on TurtleBot-Nav stratified poses. Mode collapse: the 2B scorer emits identical per-rubric scores on a given frame. The 8B scorer breaks this, and RTD criteria contribute only once the scorer can evaluate them independently.

Scorer	CSC $\downarrow$	SR $\uparrow$
Unshielded BC (no critic)	–	$\approx$ 0.30
ShieldVLA, Qwen3-VL-2B	7.59	0.56
ShieldVLA, Qwen3-VL-8B	6.90	0.54

Appendix

Table 9: TurtleBot-Nav ID results (trained ShieldVLA,

\delta=0

). The 8B scorer matches the 2B scorer on SR while incurring lower cumulative safety cost (CSC) at no extra training cost.

	Qwen3-VL-2B		Qwen3-VL-8B
Condition	CSC $\downarrow$	SR $\uparrow$	CSC $\downarrow$	SR $\uparrow$
In-Dist	7.59	0.56	6.90	0.54
+Color	8.52	0.47	7.80	0.51
+Light	7.60	0.51	5.70	0.59
+All	11.90	0.48	10.70	0.54

Appendix

Table 10: TurtleBot-Nav OOD results aggregated over the held-out variants (trained ShieldVLA,

\delta=0

). +Color aggregates {Purple, Teal, DarkGreen}; +Light aggregates {Dim, Warm}; +All averages all five OOD variants (Section 5.5 ). The 8B scorer dominates the 2B scorer on both CSC and SR across every family.

Scorer	Per-frame AUROC	Spearman ( $\rho$ , log 1+ cost)
Qwen3-VL-2B	0.539	+0.094
Qwen3-VL-8B	0.548	+0.272

Appendix

Table 11: Per-frame VLM cost quality on Safety-CHORES Nav. The 8B scorer achieves substantially higher Spearman correlation with episode safety cost, confirming the severity is monotonically informative.

Votes	Weight	Criterion	Definition
23	4	Obstruction	Path forward obstructed by furniture / clutter / walls
15	4	Obstacle_Proximity	Distance to nearest obstacle in immediate vicinity

Appendix

Table 12: RTD-proposed criteria on Safety-CHORES Nav. These mirror the TurtleBot-Nav criteria ( Obstacle_Overlap , Obstacle_Edge_Proximity ), confirming RTD generalises across platforms.

Environment	Training Steps	Wall-Clock Time	GPU-Hours
Dubins-VL	2M	$\sim$ 0.5h	4
TurtleBot-Nav (HJ critic)	12M	$\sim$ 8h	64
Safety-CHORES Nav	15M	$\sim$ 50h	400
Safety-CHORES Fetch	25M	$\sim$ 85h	700
Franka-Reach	15M	$\sim$ 24h	192
VLM labelling (8B, per env)	–	$\sim$ 26 min	8

Appendix

Table 13: Compute budget per environment.

Safety critic
Hyperparameter	Dubins-VL	TurtleBot-Nav	S-CHORES Nav	S-CHORES Fetch	Franka-Reach
Discount factor $\gamma$	0.99	0.95	0.99	0.99	0.99
Safety critic LR $\eta_{Q}$	3e-4	3e-4	1e-4	1e-4	1e-4
Target update rate $\tau$	0.005	0.001	0.005	0.005	0.005
Replay buffer size	200K	500K	500K	500K	500K
Critic hidden dims	[256, 256]	[512, 512]	[512, 512]	[512, 256]	[512, 256]

Appendix

Table 14: Hyperparameters used across all experiments. “S-CHORES Nav/Fetch” abbreviates Safety-CHORES Nav/Fetch.

Vision-Language-Action Models

Vision-language-action models turn visual observations and natural-language instructions into actions for robots and other embodied agents.

See all 1,154 papers

SafeVLA-Bench: A Benchmark for the Success-Safety Gap in Vision-Language-Action Models
May 30, 2026Jialiang Fan, Weizhe Xu, Zijun Wang +3Robot Safety Robotic Manipulation
University of Notre Dame · University of Pennsylvania
VLSA: Vision-Language-Action Models with Plug-and-Play Safety Constraint Layer
Dec 9, 2025Songqiao Hu, Zeyi Liu, Shuang Liu +5Robot Safety Vision-Language-Action Models
Department of Automation, Tsinghua University, Beijing 100084, China. · Institute for Embodied Intelligence and Robotics, Tsinghua University, Beijing 100084, China. · 3TetraBOT. +1
Your Model Already Knows: Attention-Guided Safety Filter for Vision-Language-Action Models
Jun 8, 2026Seongbin Park, Fan Zhang, Baharan Mirzasoleiman +2Robot Safety Safety Filtering
University of California Los Angeles United States

May 30, 2026J/K move · Enter open · S save

SafeVLA-Bench: A Benchmark for the Success-Safety Gap in Vision-Language-Action Models

Jialiang Fan, Weizhe Xu, Zijun Wang, Fanxin Kong+2

University of Notre Dame · University of Pennsylvania

Robot Safety Robotic Manipulation Vision-Language-Action Models Robot Manipulation Benchmarks AI Agent Safety Benchmarks Safety Evaluation of VLA Models

Open paper AskPDF arXiv

Vision-language-action (VLA) benchmarks measure whether a policy completes a requested manipulation task, but binary success can hide safety violations along the trajectory: a policy may reach the goal while applying excessive contact, disturbing bystander objects, destabilizing a held object, or entering robot self-contact. We present SafeVLA-Bench, a post-hoc safety-evaluation framework for existing simulator-based VLA benchmarks that reveals violations missed by success-only evaluation. It encodes task-aware safety requirements as Signal Temporal Logic (STL) invariants with quantitative robustness semantics. Alongside native success, it reports the safety rate and the success-but-unsafe rate (SBU) used in prior safety evaluations, and introduces the Violation Severity Index (VSI), a bounded worst-violation depth score. We instantiate SafeVLA-Bench on LIBERO and RoboCasa-365, evaluating twenty-seven policy-benchmark entries across tabletop and kitchen manipulation tasks. High task success does not imply safe execution: the fifteen tabletop policies above 90% mean success still have 18-28% unsafe-episode rates, and 38-56% of successful RoboCasa-365 rollouts violate at least one active safety clause. A post-training case study further shows that SafeVLA-Bench can be used to improve policy safety. Project page: https://safevla.org

Abstract

Vision-Language-Action Models

Explore similar work

SafeVLA-Bench: A Benchmark for the Success-Safety Gap in Vision-Language-Action Models

VLSA: Vision-Language-Action Models with Plug-and-Play Safety Constraint Layer

Your Model Already Knows: Attention-Guided Safety Filter for Vision-Language-Action Models