What Would Removing This Corruption Change? Failure Attribution for Vision-Language-Action Models

When a deployed vision-language-action (VLA) policy fails, fine-tuning it again for every new setting is costly, yet the person watching it can usually say what went wrong in one sentence. We ask what such a sentence can and cannot fix in a frozen policy. Labelling every failing LIBERO-90 task (out of distribution) for OpenVLA-OFT and pi0.5, we find that the failures sort into four modes and that only one, execution misalignment, where the policy reaches the right target but miscalibrates how far or how hard to move, is within reach of a sentence; the other three lack a target or a plan, not a magnitude. For this mode we define the narrowest human correction: one retrospective sentence per task, grounded by an LLM into an action dimension, direction, magnitude term, and time window, becomes a short bias on the frozen policy's actions, after which the policy completes the rest on its own, episode after episode. Re-executed on its task's failed rollouts, it recovers 65 of all 139 in-distribution and 33 of all 328 out-of-distribution failures in simulation; on a real xArm7 after the robot base is moved, it raises pick-and-place from 10/30 to 30/30 in each of two same-object conditions and from 2/30 to 24/30 with a new object, while two long-horizon tasks stay at 0/30 with and without correction, as the taxonomy predicts. A naively prompted VLM that watches the same failures and writes the same kind of correction recovers none in up to 10 attempts, suggesting that the value lies in the person's calibrated sense of magnitude and timing rather than in language itself. Videos: https://correctvla.github.io/

Vision-Language-Action (VLA) policies are typically adapted using successful demonstrations, which provide direct action supervision but rarely cover failure-prone states. Deployment failures expose these states, yet lack the corrective actions needed for conventional supervised learning. We propose FailPatch, a failure-driven residual patching framework that decouples action supervision from execution-reliability supervision. Successful demonstrations ground how the policy should act, while deployment trajectories indicate when its behavior becomes unreliable. We further observe that action hidden representations exhibit clear linear separability between reliable and failure-associated states while directly conditioning action generation. Building on these insights, FailPatch introduces a Null-gated Residual Expert Bank into the action hidden space of a frozen VLA policy. A unified Preserve--Redirect--Trust objective retains the original policy in reliable states, selects residual experts in failure-associated states and redirects representations from failure regions toward success-associated regions under bounded intervention. With only 0.52% trainable parameters, FailPatch improves success rates by 11.0 percentage points on four long-horizon RoboTwin tasks under clean evaluation, 9.5 percentage points under clean-to-random generalization, and 16.7 percentage points over the baseline across three real-world tasks. Project and code: https://github.com/yupeng-2003/FailPatch.

Understanding the safety risks of vision-language-action (VLA) models is essential for their deployment in the physical world. Existing safety research has mainly considered persistent perturbations that are applied continuously to observations throughout an episode. However, momentary observation corruption, in which observations are severely perturbed only briefly within an episode, remains an underexplored safety threat. To address this gap, this work investigates robustness to one-step perturbations applied at a single time step per episode. Our experiments reveal that these perturbations substantially degrade VLA performance and that their impact depends on the action chunk execution length. Based on them, we propose CARE, which dynamically selects the execution length based on consistency with the previously predicted action chunk. CARE improves robustness with low computational overhead while preserving clean performance by selecting shorter execution lengths only under perturbations.