cs.CVOct 7, 2026
SaveIt Is Not Seeing the Hazard: A Frozen Vision-Language Safety Score Measures Its Caption Bank
Organizations: Iowa State University Ames, Iowa, USA
Abstract
Frozen vision-language models increasingly provide safety signals for reinforcement learning. Their use assumes that similarity to language describing danger indicates the hazard itself. Yet policy return and collision rate cannot reveal whether a score detects hazards or responds to correlated features of the scene. VLM-based methods have reported gains in driving and safe-RL benchmarks by converting image-text similarity into rewards, costs, or confidence weights. Such signals promise to reduce reliance on manually designed feedback. They may also reflect prompt structure, embedding geometry, or camera viewpoint, leaving their safety meaning unverified. To address this gap, we present a controlled evaluation of a frozen CLIP prompt-margin safety score. We apply the score to trajectories generated by policies that never receive it, match pre-contact observations to contact-free observations with comparable hazard geometry, and vary the captions, encoder, and camera view. Across three policies, 180 episodes, and 130 isolated contact onsets, the score decreases for about twenty steps before contact. Mechanism controls indicate that the score mainly tracks resemblance to the scene shared by its captions and changes with caption separation and camera view. A constant-confidence control retains the lower catastrophe-rate point estimate, so policy gains do not establish hazard perception.
Figures & tables
Figure 1: Measurement and main finding. The policy never observes the score. Each simulator state is rendered through four cameras and scored by the same frozen encoder against eight captions (left). The caption embeddings are closely aligned, and a contrast-free score along their shared direction retains of the effect (centre). Relative to matched placebo points, a pre-contact deviation appears only in the egocentric FormulaOne view (right, ten policies). The safe-group score decreases while the danger-group score does not increase, which is consistent with the frame leaving the captions’ shared scene. Further environments show that a different view may carry the signal (Section 5.3 ).
| environment | egocentric | chase | overhead near | overhead far |
|---|---|---|---|---|
| FormulaOne (10 policies) | ||||
| CarButton1 (506 onsets) | ||||
| PointGoal1 (156 onsets) |
Table 1: Pre-contact deviation under the same four camera views. No view is consistently informative across environments. marks intervals excluding zero.
| scorer | captions | safe group | danger group | margin | redraws |
|---|---|---|---|---|---|
| CLIP ViT-B/32 | 8-caption bank | 27.5/100% | |||
| CLIP ViT-L/14 | 8-caption bank | 100/100% | |||
| CLIP ViT-B/32 | 2 group labels | n/a | |||
| Qwen2-VL-7B | 2 group labels | 51/86.5% | |||
| Qwen2-VL-7B | 8-caption bank | 72/99% |
Table 2: Pre-contact deviation by scorer configuration across three passive-observer policies and 71 episodes in the egocentric view. All configurations use identical trajectories. marks intervals excluding zero. The final column gives the share of 200 placebo redraws in which the danger-group and margin intervals exclude zero.
Figure 2: Catastrophe rate for every seed over deterministic episodes. Diamonds and bars show arm means and bootstrap intervals over seeds. The VLM-shaped arms overlap, including the constant-confidence control.
Appendix figures & tables15 assets
Supplementary material from the paper’s appendix.
Appendix
Figure 3: What each scorer receives and returns. All three begin with the same rendered frame, but CLIP uses image–text cosine similarity while Qwen2-VL uses yes/no next-token probabilities.
Figure 4: One frame, as each encoder receives it. Left: the stored render, , the image the scorers were given. Middle: CLIP ViT-B/32’s input after its own preprocessing, with its grid of -pixel patches drawn on. Right: CLIP ViT-L/14’s input, patches of pixels. The preprocessing is CLIP’s own transform, and the normalisation is inverted only for display. These are patch-token counts; each model also adds one class token. We did not test patch granularity as a cause of anything. The difference this paper measures between these backbones is in their text spaces, where caption centroids sit at cosine against (Table 9 ). We make no claim that the two are connected.
| scorer | prompt set | what it varies |
|---|---|---|
| CLIP ViT-B/32 | eight-caption bank | the deployed configuration |
| CLIP ViT-L/14 | eight-caption bank | backbone, within the contrastive class |
| Qwen2-VL-7B | two group labels | model class and prompt set together |
| Qwen2-VL-7B | eight-caption bank | model class, prompt set held fixed |
| CLIP ViT-B/32 | two group labels | prompt set, encoder held fixed |
| CLIP ViT-B/32 | three rewrites of the positive group | what the captions claim |
Table 3: Which configuration reads which prompt set, and what varies against the deployed one.
| matching specification | matched | 95% CI | |
|---|---|---|---|
| none (raw) | n/a | n/a | |
| distance | 100% | ||
| distance bearing | 99% | ||
| distance | 99% | ||
| frontal distance | 99% | ||
| distance bearing | 98% |
Table 4: Pre-contact deviation of under nonparametric matching. Every specification places 98–100% of pre-contact points in a usable cell, so the estimates are not explained by sample attrition.
| deployed positive/negative grouping | |
| rank among all 70 partitions | 3 |
| permutation | |
| partitions with a stronger effect | 2 |
| mean over all 70 partitions | |
| common mode (mean of all eight captions, no contrast) | |
| as a fraction of the deployed margin | 73% |
Table 5: The deployed positive/negative partition ranks third among all 70 balanced partitions. Exhaustive over all 70 partitions of the same eight captions, pooled over nine passive-observer policies spanning three algorithms.
| stratum | 95% CI | Ep. | Redraws | |
|---|---|---|---|---|
| nearest hazard near ( ) | 38 | 10% | ||
| nearest hazard far ( ) | 44 | 100% | ||
| something within frontal cone | 67 | 100% | ||
| nothing within frontal cone | 8 | 99% |
Table 6: Moderation by hazard geometry, on the three passive-observer policies for which hazard geometry was logged beside the camera renders. A hazard detector would show the opposite ordering in both panels. Distance strata are the outer terciles of distance to the nearest hazard over the joined steps, which fall at and . Ep. : episodes contributing to the stratum, the bootstrap unit. Redraws : share of placebo redraws in which the interval excludes zero.
Figure 5: All ways of splitting the caption set into a positive and a negative group, scored identically. The deployed split (solid line) ranks third of the seventy ( ), and the distribution is centred below zero with a mean of , but it runs from to , so a sizeable minority of splits reverse sign. Removing the contrast entirely (dashed line) retains of the deployed split’s effect.
| arm | seeds | catastrophe | violation | |||
|---|---|---|---|---|---|---|
| baseline | no VLM at all | |||||
| deployed | CLIP, current frame | |||||
| constant | fixed at | |||||
| yoked | real trace, wrong episode |
Table 7: No performance difference is detected when the VLM confidence is replaced by a constant. One evaluation sweep, deterministic episodes per run, seed as the unit. The two placebo arms carry seeds and the two reference arms . scales only the reward bonus here, never the cost channel. The evaluation scenarios alias onto training scenarios (defect D1 of Appendix F ), identically across arms, so the between-arm differences stand while the absolute rates are optimistic.
Figure 6: Left: the measured signal on FormulaOne under CLIP ViT-B/32, per viewpoint, against lag from contact, relative to matched placebo points, over ten policies across three algorithms ( isolated onsets in episodes). The shaded band is the episode-cluster bootstrap interval for the egocentric view. Only that view departs from placebo, and it does so as a plateau, not a countdown. Right: the same effect stratified by hazard geometry at the pre-contact points, on the three passive-observer policies that carry hazard logs. The deviation is largest in the far stratum and in the one where nothing lies within a frontal cone, and the near stratum’s interval spans zero. A hazard detector would show the reverse ordering. We do not test the differences between strata.
| view | description | CV | 95% CI | |
|---|---|---|---|---|
| vision | first-person, head-mounted | 0.224 | ||
| track | chase camera following agent | 0.729 | ||
| fixednear | static overhead, near | 0.436 | ||
| fixedfar | static overhead, far | 0.661 |
Table 8: Pre-contact deviation by camera. Ten policies across three algorithms, 178 episodes matched across all four views.
| encoder | within | within | across | centroids | residual | 2 labels |
|---|---|---|---|---|---|---|
| CLIP ViT-B/32 | 0.883 | 0.898 | 0.883 | 0.962 | 0.274 | 0.846 |
| CLIP ViT-L/14 | 0.808 | 0.845 | 0.794 | 0.913 | 0.408 | 0.817 |
Table 9: Caption-bank geometry in each encoder’s text space.
| caption set | example | band effect [95% CI] | corr. |
|---|---|---|---|
| deployed safe | “centered on the track and driving safely” | 1.000 | |
| deployed danger | “about to crash into the barrier” | 0.897 | |
| negated safe | “not centered … and not driving safely” | 0.951 | |
| absurd | “the racecar is made of cheese” | 0.742 | |
| off-topic | “a bowl of fruit on a wooden table” |
Table 10: Pre-contact deviation by caption set, and each set’s mean within-episode correlation with the deployed positive group.
| scorer | captions | danger group | margin |
|---|---|---|---|
| CLIP ViT-B/32 | 8-caption bank | 27.5% | 100% |
| CLIP ViT-L/14 | 8-caption bank | 100% | 100% |
| Qwen2-VL-7B | 2 group labels | 51% | 86.5% |
| Qwen2-VL-7B | 8-caption bank | 72% | 99% |
Table 11: Stability over placebo redraws: median [min, max] estimate and the share of draws whose interval excludes zero.
Figure 7: The captions, and the frames they were scored against. Top: the eight captions verbatim, and how each scorer consumes them. Middle: the egocentric frames the scores are computed from, at four lags before contact and at contact. Bottom: a detached overhead view of the same five instants, which no score sees. We include it so a reader can tell what is happening in the world. The barrier fills the view as the track recedes. The frame is leaving the scene the captions describe, which is what Section 4 says the score reads. These images come from a render of the replayed trajectory, so that they stay legible when enlarged. The scorers were given the render of the identical simulator state, which CLIP resizes to (Appendix C.1 ).
Figure 8: What each scorer reported on those frames. Top row: the safe and danger group scores over the approach shown in Figure 7 , -scored within episode. Bottom row: the same quantities averaged over the of isolated contacts in the three matched policies that have a complete to window. Its bands are bootstrapped over onsets and are illustrative. Inferential results in the tables use episode-cluster bootstraps. All three scorers read the same eight captions on the same frames. Over exactly these frames ViT-B/32’s two group scores are nearly one series (correlation across the plotted window) and both fall, while ViT-L/14’s danger group separates from its safe group ( ). The two traces in each panel are -scored separately, so a near-unit correlation still leaves visible differences in amplitude.