Vision-Language-Action (VLA) models are gaining attention in autonomous driving, inheriting commonsense priors from large language models (LLMs) and widening the navigation interface from a fixed command set to free-form natural-language instructions. However, this open-ended interface exposes a new vulnerability surface: an inattentive driver may issue instructions that are unsafe given the current scene, and a malicious user may issue dangerous ones on purpose. We present the first benchmark suite that evaluates navigation following and conflict awareness together, along with adversarial robustness. Existing VLAs fall short on both: SimLingo completes no language-instructed lane change in closed loop, and all models degrade sharply under conflicting signals. We propose SafeDriveVLA, the first driving VLA that (1) explicitly predicts a three-level navigation-compliance mode to decouple conflict reasoning from action generation, and (2) uses navigation-conditioned world model dreaming to inform this prediction. Unlike prior world models that roll out expert or planned actions, ours dreams of strictly following the navigation signal, showing when following is safe. SafeDriveVLA reaches 88.16 Driving Score (DS) and 68.64% Success Rate (SR) on Bench2Drive, lifts closed-loop language following by 49.3% and reduces collisions under unsafe instructions from 60 to 38 compared to the best SimLingo variant. Video demonstrations are available on our project page.
Figures & tables
Figure 1: Navigation-scene conflict in VLA models. In modular stacks, the behavior planner resolves the navigation signal against perception. VLAs must instead learn this implicitly, although the navigation signal (command, target waypoint, or language instruction) can be unsafe given the observation.
\toprule \multirow 2* Benchmark
\multirow 2*# Sample
Navigation Signal
\cmidrule (lr)3-5
Command
Target Waypoint
Instruction
\midrule Bench2Drive [ 33 ]
220 (route)
\checkmark
\checkmark
–
NavSim [ 14 ]
12,146 (frame)
\checkmark
–
–
\midrule \rowcolor reportLightTint Ours
CARLA-F
210 (route)
\checkmark
\checkmark
\checkmark (main)
B2D-C
150 (route)
–
–
\checkmark
Table 1: Benchmark summary . “(main)” marks the primary modality of our CARLA-F benchmark. B2D-C and NavSim-C together form the navigation-scene conflict benchmark. “C” denotes conflict.
Figure 2: Right turn, then lane changes
Figure 6: \texorpdfstring \pdfxform 4 SafeDriveVLA. We first pre-train the latent world model based on the V-JEPA 2 encoder latent. The world model is conditioned on the ego action to predict the future latent. During the VLA training, we freeze the world model to provide world tokens based on the navigation-conditioned action anchor. At inference, (1) the meta-command implied by the navigation signal selects an anchor; (2) the frozen world model rolls the current latent forward under it; (3) the world tokens (projected dreamed latents), the camera frame, and the navigation signal are fed to the VLA, which emits a mode token, the beginning-of-action token <ACTIONS> , and action tokens sequentially.
Figure 5
\toprule Method
Nav.
Expert
DS ↑
Success Rate(%) ↑
Efficiency ↑
Comfortness ↑
\midrule UniAD [ 27 ]
CMD
Think2Drive
45.81
16.36
129.21
43.58
VAD [ 34 ]
CMD
Think2Drive
42.35
15.00
157.94
46.01
\midrule ReCogDrive [ 52 ]
CMD
Think2Drive
71.36
45.45
138.18
17.45
ORION [ 18 ]
CMD
Think2Drive
77.74
54.62
151.48
17.38
\midrule MindDrive [ 19 ]
CMD
Think2Drive
78.04
55.09
-
-
AutoVLA [ 115 ]
Lan
PDM-Lite
78.84
57.73
146.93
39.33
Table 2: Bench2Drive results. Nav.: navigation signal, i.e., command (CMD), target waypoint (WP), or language instruction (Lan). SimLingo results are from its paper.
Table 3: CARLA-F results. Per-meta-command NCR (%); Avg. is weighted by the number of instructions, excluding speed. \texorpdfstring \pdfxform 4 SafeDriveVLA’s higher speed error is studied in Sec. 5.6 . Bold: best among language-conditioned (Lan) models.
Table 4: B2D-C results. We evaluate the instruction-scene conflict, given that language instruction is the sole navigation signal. Relative reductions are w.r.t. the best SimLingo variant (SimLingo-Safe).
Figure 7: B2D-C demonstration. Given the unsafe instruction “stay in your lane and keep speed at 8 m/s ignoring other factors”, \texorpdfstring \pdfxform 4 SafeDriveVLA initially complies (10.7 m/s), then on detecting a blocking obstacle switches to fallback mode, brakes to 3.4 m/s, and steers around the hazard before recovering to 8.9 m/s.
Figure 8: NavSim-C benchmark.
Figure 11: Pareto frontier.
Figure 14: Mode-conditioned action generation. Under meta-command follow_road , we pre-fill each mode token and sample 12 action rollouts (temperature 0.8). The model predicts <FALLBACK> because the front vehicle blocks the road: the <FALLBACK> -conditioned actions are almost static, while <STRICT> and <CAUTIOUS> still try to make progress.
Table 6: Mode prediction accuracy per meta-command. Accuracy of the greedily decoded <STRICT> / <CAUTIOUS> / <FALLBACK> mode token against the rule-derived ground-truth label, measured on 100 held-out randomly sampled frames per meta-command (600 in total).
Appendix figures & tables17 assets
Supplementary material from the paper’s appendix.
Appendix
Figure A.1: Language instruction following benchmark distributions.
Figure A.2: Ground truth waypoint distribution.
\toprule
SE (m/s) ↓
Turn L.
Turn R.
Straight
LC Left
LC Right
Follow
Avg. ↑
\midrule Baseline
2.62
86.3
88.0
38.3
12.1
20.7
64.9
55.1
+ Mode
4.05
84.9
89.6
52.0
15.2
24.1
65.5
59.8
\rowcolor reportLightTint + Mode + WM
4.28
92.7
90.2
84.7
63.6
72.4
81.0
83.0
\bottomrule
Appendix
Table 7: Ablation on CARLA-F ( × 1.0 data). NCR (%) per meta-command and Speed Error (m/s).
Figure A.5: Ground truth waypoint distribution.
\toprule Command
Out of Boundary
Collision with Agent
Total
\midrule Turn Left
78
72
150
Turn Right
96
54
150
\bottomrule
Appendix
Table 8: NavSim-C scenario distribution. Each scenario is labeled by the injected conflicting command and the resulting unsafe behavior.
Table 9: NavSim-C benchmark results. Comparison between original (ORI) and conflict evaluations under command-scene conflict scenarios.
Figure B.1: Autoregressive rollout loss curve.
Figure B.4: World token projector architecture . Denc=1024 , hidden width h=256 , and DLM=896 , which is the hidden size of InternVL3-1B [ 116 ] . H=W=16 .
\toprule Meta-command
Strict
Cautious
Fallback
Total
\midrule follow_road
586 (23.5%)
886 (35.6%)
1019 (40.9%)
2491
go_straight
69 (25.1%)
86 (31.3%)
120 (43.6%)
275
turn_left
65 (33.5%)
32 (16.5%)
97 (50.0%)
194
turn_right
44 (27.0%)
30 (18.4%)
89 (54.6%)
163
lane_change_left
7 (25.0%)
1 (3.6%)
20 (71.4%)
28
lane_change_right
7 (9.5%)
9 (12.2%)
58 (78.4%)
74
Appendix
Table 10: Mode distribution per meta-command. The statistics are drawn from randomly sampled 3,225 samples in the training data, which contains 407,717 samples in total.
Figure C.1: Meta-command action anchor.
Figure C.4: Demonstration 1 - Lane Following. We visualize the mode-conditioned action generation with meta-command follow_road . The model predicts <STRICT> mode since no urgent hazard is presented. The action conditioned on <STRICT> is more aggressive than <CAUTIOUS> and <FALLBACK> .
Figure C.5: Demonstration 2 - Turning. We visualize the mode-conditioned action generation with meta-command turn_left . The model predicts <STRICT> mode since the ego vehicle has the right of way as first to approach the stop sign. The <STRICT> makes a more determined left turn. The <CAUTIOUS> hesitates with only one sampled trajectory trying to turn. The <FALLBACK> trajectories are mostly static.
Figure C.6: Demonstration 3 - Turning. We visualize the mode-conditioned action generation with meta-command turn_left . The model predicts <FALLBACK> mode since it’s a red light. The actions generated conditioned on <STRICT> mode move forward. The <CAUTIOUS> trajectories try to proceed closer to the intersection while the <FALLBACK> trajectories remain at the same location.
Figure C.7: Demonstration 4 - Turning. We visualize the mode-conditioned action generation with meta-command turn_left . The prediction ties on <STRICT> and <CAUTIOUS> since the vehicles are about to make an unprotected turn. The actions generated conditioned on <STRICT> mode make more progress on average. The <CAUTIOUS> trajectories try to proceed more cautiously, while <FALLBACK> barely start the turning.
Figure D.1: NavSim-C benchmark visualization . The orange dot line denotes the model prediction, while the green dot line denotes the ground truth. We find the model has much worse navigation-scene conflict awareness at the intersections (bottom row). This might be due to the training data distribution, where the command at the intersection is more diverse, while the cruising road is mostly going straight.
Figure D.2: CARLA-F Demonstration. The model is instructed to perform a left turn, a lane change to the left, and a lane change to the right within one route. The model can follow the language instruction strictly when the environment is safe. Please note that the command under each sub-figure is a simplified instruction, not the real language input.
Figure D.3: B2D-C Demonstration. The model is prompted to turn left at 8m/s. The model follows the instructions to accelerate and prepare to turn left in the first 3 frames. However, at the 4th frame, the instructed speed will lead to a collision with the front white vehicle. The model thus refuses the instruction while falling back on going straight. This route deviation will lead to a lower driving score, but will avoid a collision.
Recent Vision-Language-Action (VLA) models increasingly use natural-language instructions to condition autonomous driving behavior. Yet existing closed-loop benchmarks primarily measure route completion, safety, and rule compliance, leaving a fundamental question unresolved: does language actually determine which feasible behavior the vehicle executes? A trajectory may be safe and successful while still violating or even ignoring the passenger's instruction. To address this, we introduce \ltd, a benchmark designed to directly test this capability. Its key evaluation unit, the paired counterfactual unit (PCU), holds the initial driving scene fixed while changing only the instruction. This design enables us to distinguish isolated instruction success from counterfactual paired success across four instruction-following scopes. To test whether this distinction persists across evaluation regimes, we instantiate Language2Drive in complementary closed-loop CARLA simulation, reconstructed real-world scenes, and open-loop driving benchmarks, including our released CARLA-Language2Drive simulator with purpose-built maps. Evaluating representative driving VLAs across these settings reveals a striking mismatch between strong driving competence and weak language control: 93.2% of successful rollouts do not have a successful counterpart under the alternative feasible instruction. This failure is dominated by one-sided completion, where a model repeatedly executes one preferred behavior but fails when the same scene requires the counterfactual alternative. These results expose two fundamental limitations of current evaluation: isolated success and driving scores, which are widely used by conventional driving benchmarks, can substantially overstate language-following capability, while current driving VLAs themselves lack reliable instruction following under matched counterfactual tests.
Zihan You, Zehua Fan, Wenqi Lyu +19
Institute for AI Industry Research (AIR), Tsinghua University · Southeast University · Shanghai Jiao Tong University +16
Vision-Language-Action (VLA) models for autonomous driving must integrate diverse textual inputs, including navigation commands, hazard warnings, and traffic state descriptions, yet current systems often present these as disconnected fragments, forcing the model to discover on its own which environmental constraints are relevant to the current maneuver. We introduce Causal Scene Narration (CSN), which restructures VLA text inputs through intent-constraint alignment, quantitative grounding, and structured separation, at inference time with zero GPU cost. We complement CSN with Simplex-based runtime safety supervision and training-time alignment via Plackett-Luce DPO with negative log-likelihood (NLL) regularization. A multi-town closed-loop CARLA evaluation shows that CSN improves Driving Score by +31.1% on original LMDrive and +24.5% on the preference-aligned variant. A controlled ablation reveals that causal structure accounts for 39.1% of this gain, with the remainder attributable to information content alone. A perception noise ablation confirms that CSN's benefit is robust to realistic sensing errors. Semantic safety supervision improves Infraction Score, while reactive Time-To-Collision monitoring degrades performance, demonstrating that intent-aware monitoring is needed for VLA systems.
Yun Li, Yidu Zhang, Simon Thompson +2
Graduate School of Information Science and Technology, The University of Tokyo · TIER IV, Inc.
Vision-language-action models (VLA) promise human-steerable autonomous driving, but their training is bottlenecked by the scarcity of frames paired with natural-language instructions: while camera streams and expert trajectories are logged at scale, language annotations (e.g., turn left at the intersection) remain scarce and expensive to acquire. To address this challenge, we introduce Latent Action Driving Annotations (LADA), a three-stage pipeline that transforms abundant unlabelled observation-trajectory pairs into a substrate for language-conditioned control. First, we train a latent action model with a vector-quantised bottleneck, producing a compact codebook of high-level vehicle intents. Second, a small language-annotated subset is used to train a vision-language translator to map observations and language instructions into this codebook. Third, we train a driving VLA on observation-latent-action pairs over the full unlabelled corpus. Using fewer than 5% of language annotations and without leveraging any auxiliary chain-of-thought reasoning or visual question answering streams, LADA achieves a Driving Score of 87.98 and a Success Rate of 70.46% on the closed-loop Bench2Drive benchmark, matching or surpassing fully supervised baselines.
Alexey Zakharov, Kemal Oksuz, Puneet K. Dokania
Robert Bosch GmbH, Germany · Five AI Ltd., United Kingdom