Safe robotic task planning requires planners that can reliably achieve task goals while satisfying safety constraints. Classical planners search over explicit symbolic task representations and can provide formal guarantees with respect to encoded safety constraints, but require rigid input formats. Their computational cost also increases rapidly with the search space. In contrast, large language models (LLMs) offer flexible task interfaces and strong generalization capabilities, but they are large, power-hungry, and pre-trained with little robot-specific safety data and knowledge. Thus, they can be difficult to deploy locally on robotic systems with limited resources. To address these limitations, we present SLoSa, a neuro-symbolic compression and fine-tuning framework for training foundation-model-based robotic task planners with Small size, Low power demand, and Safety awareness. The framework first constructs a safety-aware dataset using classical planners, an advanced teacher LLM, and formal verifiers, followed by two training stages: supervised fine-tuning and reinforcement learning (RL) fine-tuning guided by a verification-based reward machine to enforce safety alignment. We evaluate SLoSa across four Planning Domain Definition Language (PDDL) domains, two household simulation environments, local edge platforms, and a desktop robotic arm. Across the PDDL tasks, verifier-guided post-training raises the success rate of compact 4B-14B planners to 70.5-76.0%, while INT4 deployment on a Jetson Orin requires 17.85-26.41 W of average power. Results in household simulators and on the physical robot further demonstrate the applicability of SLoSa across diverse robotic task settings.
Figures & tables
Fig. 1: Overview of SLoSa. Classical planners, teacher models, and a formal verifier construct safety-aware data. Student LLMs are trained by SFT and then refined by GRPO with verifier-based rewards.
Pattern
PDDL3 construct
Robotic interpretation
Ordering safety
sometime-before
A required event must precede another event.
Staging safety
sometime , sometime-before
The robot must pass through a safe intermediate state.
Resource restriction
always , not
Unsafe, reserved, or faulty resources cannot be used.
Mandatory inspection
sometime
The robot must visit a checkpoint or complete an inspection.
TABLE I: Safety patterns used to construct behavior-changing constraints.
Model
Stage
Success ↑
Goal fail ↓
Safety violation ↓
Precondition violation ↓
Format error ↓
GPT-5.6 Sol
Direct
26.5
0.0
0.5
73.0
0.0
Claude Sonnet 5
Direct
31.0
3.5
0.0
55.5
10.0
Qwen3-4B
PT
0.0
1.5
0.0
0.0
98.5
SFT
59.0
1.5
0.5
36.5
2.5
GRPO
70.5
1.5
0.5
25.0
2.5
Llama-8B
PT
0.0
5.0
0.0
70.0
25.0
TABLE II: PDDL planning outcomes across post-training stages. Values are percentages over the current 200-instance test set; outcome columns are mutually exclusive. GPT and Claude models are evaluated by direct prompting, whereas the compact models are shown across their available post-training stages.
Fig. 2: Domain and input-format analysis of Qwen3-4B. Panel (a) compares the GRPO-refined model across PDDL, structured natural language (SNL), and narrative natural language (NNL) inputs. Panel (b) shows the distribution of outcomes for PT, SFT, and GRPO in each domain.
Data
Success (95% CI) ↑
Goal reach ↑
Cond. safety violation ↓
U-SFT
3.5% [1.7, 7.0]
17.5%
80.0%
OC-SFT
53.0% [46.1, 59.8]
56.0%
5.4%
BC-SFT
59.0% [52.1, 65.6]
59.5%
0.8%
TABLE III: Positive-only safety-aware data ablation on Qwen3-4B. Brackets report bootstrap 95% confidence intervals for success.
Benchmark
PT
SFT
GRPO
VirtualHome-Safe
0.0%
74.5%
80.5%
ALFWorld-FO-Safe
0.0%
76.0%
85.0%
TABLE IV: Success (%) of separately trained Qwen3-4B planners on two household benchmarks. SFT and GRPO use benchmark-specific training data; each checkpoint generates one complete plan without intermediate feedback.
Fig. 3: Representative safety-constrained planning problems in two embodied simulators. In each panel, the upper sequence shows the original baseline plan, which completes the task but violates the added safety constraint, whereas the lower sequence shows a safety-satisfying plan for the same task. The red box highlights the critical steps that cause the constraint violation. In panel (a), the task is to place the salmon in the refrigerator, with the refrigerator required to be opened before the salmon is picked up. In panel (b), the task is to place the clock and laptop on the table, with the laptop required to be placed before the clock. The examples assess high-level symbolic safety compliance rather than physical collision safety.
Hardware
Model
P50 (s)
P90 (s)
Tok./s
Peak mem. (GB)
Avg. power (W)
Energy/ plan (J)
RTX 4080
Qwen3-4B
6.65
8.66
11.73
3.80
71.16
464.75
Llama-8B
6.01
7.77
13.19
5.91
88.14
516.70
Qwen3-14B
8.03
11.11
9.77
11.22
122.90
983.78
Jetson Orin
Qwen3-4B
18.28
23.53
4.30
3.89
17.85
316.33
Llama-8B
15.88
20.01
5.01
6.06
23.14
355.18
Qwen3-14B
22.00
30.04
3.55
11.50
26.41
581.14
TABLE V: INT4 local-inference efficiency on an RTX 4080 and a Jetson Orin. Latency includes generation and parsing, whereas throughput measures generation only. Energy per accepted plan divides the measured inference energy, including inter-request overhead, by the number of plans. Model loading, warmup, and validation energy are excluded.
Fig. 4: Runtime scalability on 41 Blocksworld instances with 10–50 blocks. Fast Downward and OPTIC show highly variable search times, while GPT-5.6 Sol maintains comparatively stable generation time. Markers distinguish valid plans from invalid/no-plan outcomes, and the dashed line denotes the 300-s timeout.
Model
Final succ. ↑
Gain ↑
Avg. iter. ↓
Avg. tokens ↓
PT
0.5%
+0.5 pp
2.995
5185.81
SFT
68.0%
+6.0 pp
1.735
2179.52
GRPO
77.5%
+3.5 pp
1.500
1782.87
TABLE VI: Verification-guided inference with SafePilot over the 200-instance test set and at most three rounds. Improvement is measured relative to first-pass success before repair. The iteration count includes the initial generation.
Metric
SFT
Full GRPO
Verifier-accepted plans (/30)
17
19
Verifier-rejected plans (/30)
13
11
Successful executions (/30)
13
14
Low-level failures (/30)
4
5
TABLE VII: Blocksworld results on the desktop robotic arm. Each planner is evaluated on 30 planning trials; only verifier-accepted plans are executed on the robot.
Fig. 5: Representative Blocksworld execution with the desktop robotic arm. From left to right: the initial state, a failed physical outcome caused by block-placement error, and a successful goal state. The physical failure results from limited manipulation precision rather than a violation of the encoded symbolic constraints.
Safety-critical task planning in robotic systems remains challenging: classical planners suffer from poor scalability, Reinforcement Learning (RL)-based methods generalize poorly, and base Large Language Models (LLMs) cannot guarantee safety. To address this gap, we propose safety-generalizable large language models, named SafeGen-LLM. SafeGen-LLM can not only enhance the safety satisfaction of task plans but also generalize well to novel safety properties in various domains. We first construct a multi-domain Planning Domain Definition Language 3 (PDDL3) benchmark with explicit safety constraints. Then, we introduce a two-stage post-training framework: Supervised Fine-Tuning (SFT) on a constraint-compliant planning dataset to learn planning syntax and semantics, and Group Relative Policy Optimization (GRPO) guided by fine-grained reward machines derived from formal verification to enforce safety alignment and by curriculum learning to better handle complex tasks. Extensive experiments show that SafeGen-LLM achieves strong safety generalization and outperforms frontier proprietary baselines across multi-domain planning tasks and multiple input formats (e.g., PDDLs and natural language).
Jialiang Fan, Weizhe Xu, Mengyu Liu +3
University of Notre Dame · Washington State University · University of Pennsylvania
Large language models are increasingly used as planners for robotic systems, yet how safely they plan remains an open question. To evaluate safe planning systematically, we introduce DESPITE, a benchmark of 12,279 tasks spanning physical and normative dangers with fully deterministic validation. Across 23 models, even near-perfect planning ability does not ensure safety: the best-planning model fails to produce a valid plan on only 0.4% of tasks but produces dangerous plans on 28.3%. Among 18 open-source models from 3B to 671B parameters, planning ability improves substantially with scale (0.4-99.3%) while safety awareness remains relatively flat (38-57%). We identify a multiplicative relationship between these two capacities, showing that larger models complete more tasks safely primarily through improved planning, not through better danger avoidance. Three proprietary reasoning models reach notably higher safety awareness (71-81%), while non-reasoning proprietary models and open-source reasoning models remain below 57%. As planning ability approaches saturation for frontier models, improving safety awareness becomes a central challenge for deploying language-model planners in robotic systems.
Tao Zhang, Kaixian Qu, Zhibin Li +4
ETH Zurich, Zurich, Switzerland. · University College London, London, United Kingdom. · Stanford University, Stanford, California, United States. +2
Recent advances in large language models (LLMs) provide robots with contextual reasoning abilities to comprehend human instructions. Yet, current LLM-enabled robots typically depend on cloud-based models or high-performance computing infrastructure, which limit their deployment on robots under unreliable internet environments or with constrained computational resources, such as UAVs and small ground vehicles. Thus, deploying fine-tuned small language models (SLMs) that support onboard deployment offers a promising alternative. This paper introduces Ro-SLM, a framework that enables reliable SLM-driven robot operation by distilling LLMs' knowledge and reasoning. Ro-SLM starts from dataset synthesis by leveraging LLMs to generate diverse task instructions, produce corresponding ground truth code with minimal human assistance, and augment instructions into real-world application scenarios. Ro-SLM is then fine-tuned with the dataset, in which LLM serves as a reward function to guide the training. Extensive experiments on UAV operation tasks demonstrate that Ro-SLM improves the performance of SLM from being incapable of supporting robotic task planning and code generation to achieving performance that approaches LLM.
Wenhao Wang, Yanyan Li, Long Jiao +1
Department of Computer & Information Science, University of Massachusetts Dartmouth · Department of Computer Science & Engineering, California State University San Marcos