Real-world reinforcement learning has enabled contact-rich manipulation tasks to be trained directly on physical robots, but unsafe interactions during online learning remain a key barrier to practical deployment. We propose Safe Evidential Real-World Reinforcement Learning (SEVI), a framework for reliability-aware safety intervention during real-world policy learning. SEVI introduces an Evidential Safety Critic that estimates both future constraint-violation risk and epistemic uncertainty in a single forward pass. During online learning, SEVI evaluates each task-policy action before execution; if the action is predicted to be unsafe or the prediction is insufficiently supported by evidence, SEVI overrides it with an offline-trained recovery policy that guides the robot toward a lower-risk region. We evaluate SEVI on two simulated manipulation tasks and a real-world USB insertion task under in-distribution and distribution-shifted conditions. Across task-learning and safety-critic baselines, SEVI achieves the strongest trajectory-level safety prediction, the highest final task success, and the lowest unsafe-event counts. SEVI also reduces unsafe events by 13.4 to 57.1 percent relative to recovery-based safe RL while preserving low-latency execution-time filtering. The project page is available at: https://sevi-safe.github.io/
Figures & tables
Fig. 1: Illustration of SEVI on the real-world USB insertion task. When the task policy attempts an unsafe insertion, SEVI detects elevated safety risk or epistemic uncertainty and triggers the recovery policy. The recovery policy steers the robot toward a safer region before returning control to the task policy for continued online RL training.
Fig. 2: Overview of the SEVI framework . In offline training, failure and recovery demonstrations are used to train the Evidential Safety Critic and recovery policy. During the runtime pipeline, the ESC evaluates task-policy actions using predicted risk and epistemic uncertainty and switches to the recovery policy when needed. In online RL, RLPD updates the task policy using executed transitions from the RL buffer together with prior demonstrations from the demo buffer.
Fig. 3: Block Plucking example of SEVI task–recovery switching. An unsafe πtask action that could destabilize the stack (red) triggers πrec , which returns the robot to a safer configuration before task execution resumes successfully (green).
Fig. 4: Characterization of the Evidential Safety Critic. (a) Epistemic uncertainty under increasing training coverage in a fixed USB failure region; shading denotes ±1 standard deviation across three ESC trainings. (b) Detection efficiency of safety critics in simulation and hardware.
Task
Metric
SQRL
Dropout
Ensemble
SEVI(w/o Unc.)
SEVI
Block ID
BA ↑
.85±.01
.82±.03
.90±.03
.83±.04
.93±.03
TPR ↑
.77±.03
.74±.04
.86±.04
.80±.05
.92±.03
TNR ↑
.93±.03
.90±.03
.95±.02
.86±.04
.94±.04
Block OOD
BA ↑
.66±.03
.69±.01
.74±.05
.66±.03
.80±.02
TPR ↑
.61±.03
.54±.03
.63±.07
.61±.04
.73±.03
TNR ↑
.71±.03
.84±.03
.85±.04
.72±.03
.88±.03
TABLE I: Trajectory-level safety prediction under ID and OOD conditions. SEVI achieves the highest balanced accuracy across tasks with consistent TPR–TNR balance.
Simulation (Block Plucking)
Hardware (USB Insert)
Method
DT ↓
Lat. (ms) ↓
DT ↓
Lat. (ms) ↓
SQRL
0.37±0.03
1.00±0.08
0.28±0.02
2.40±0.15
Dropout
0.43±0.04
3.00±0.20
0.29±0.03
4.21±0.25
Ensemble
0.53±0.05
7.00±0.40
0.37±0.04
8.23±0.50
SEVI
0.29±0.02
1.00±0.05
0.26±0.02
2.60±0.10
TABLE II: Detection time (DT) and inference latency of the evaluated safety critics corresponding to Fig. 4 (b).
Set.
Metric
Dropout
Ensemble
SEVI
ID
AUROC ↑
0.68
0.88
0.92
APR ↑
0.74
0.87
0.96
ECE ↓
0.29
0.38
0.07
Brier ↓
0.29
0.28
0.04
OOD
AUROC ↑
0.62
0.89
0.94
APR ↑
0.25
0.21
0.39
TABLE III: Uncertainty estimation quality on the hardware task under ID and OOD conditions. SEVI provides stronger discrimination and calibration than baselines.
Fig. 5: Effect of recovery-gating criteria on closed-loop execution. Combining risk and uncertainty gives the best safety–performance trade-off across tasks.
Fig. 6: Learning curves from a single representative hardware training run on the USB insertion task, showing success rate, intervention rate, and cycle time for SQRL and SEVI during online training. SEVI reaches higher success while progressively reducing intervention rate and cycle time.
Recovery Behavior
Gating
Success ↑
Unsafe ↓
Hit-and-Recover
Risk only
0.64±0.03
32±4
Risk+Unc.
0.82±0.03
16±4
Stuck-and-Recover
Risk only
0.64±0.01
33±4
Risk+Unc.
0.83±0.03
15±5
TABLE IV: Effect of recovery behavior on USB Insertion task.
Method
Block Plucking
Transport Nut
USB Insertion
Succ. ↑
Unsafe ↓
Succ. ↑
Unsafe ↓
Succ. ↑
Unsafe ↓
SERL [ 2 ]
0.67±.02
270±7
0.52±.01
450±11
0.71±.03
56±7
SAC [ 15 ]
0.63±.01
298±5
0.49±.01
467±9
0.61±.03
49±4
SAC-C [ 10 ]
0.71±.03
281±3
0.55±.02
410±7
0.70±.04
37±6
SQRL [ 4 ]
0.75±.02
220±5
0.61±.01
358±5
0.68±.04
35±3
SEVI(w/o Unc.)
0.77±.03
234±5
0.63±.03
360±7
0.66±.04
32±5
TABLE V: Closed-loop task execution performance. Success is evaluated using the final policy, while unsafe events are counted throughout training.
Task
τrisk
τepi
Δ Success
Block Plucking
0.44
0.56
<8%
Transport Nut
0.61
0.64
<9%
USB Insertion
0.65
0.45
<5%
TABLE VI: Task-specific recovery-gating thresholds and sensitivity to ±20% threshold perturbation.
TABLE X: Repeated hardware evaluation on the USB Insertion task. Success is evaluated using the final policy, while unsafe events are counted throughout online training. Results are mean ± standard deviation over three independent 3-hour hardware training runs.
Recovery Behavior
Gating
Success ↑
Unsafe ↓
Hit-and-Recover
Risk only
0.64±0.03
32±4
Risk + Unc.
0.82±0.03
16±4
Stuck-and-Recover
Risk only
0.64±0.01
33±4
Risk + Unc.
0.83±0.03
15±5
TABLE XI: Closed-loop performance under two qualitatively distinct recovery behaviors on the USB Insertion task. Results are mean ± standard deviation over three independent evaluation runs.
We address safe sim-to-real transfer, in which an agent leverages an imperfect simulator and limited real-world interaction while ensuring safety throughout data collection in the real system. This problem arises in applications such as robotics and healthcare: simulators provide cheap data, but sim-to-real mismatch makes direct transfer unreliable, and collecting real-world data to correct this mismatch must itself be safe. Moreover, deployment objectives may vary across tasks, making it costly to collect new data for each reward function. We therefore formulate safe sim-to-real transfer as a reward-free safe reinforcement learning (RL) problem, in which data are collected once and reused to plan for arbitrary reward functions. We develop a computationally efficient algorithm that identifies where the simulator and real dynamics differ, uses certified simulator transitions where they are reliable, and estimates mismatched transitions from safely collected data. With high probability, every policy deployed during learning is feasible, and the collected data support the computation of a feasible and near-optimal policy for any reward function. When the simulator is uninformative, our algorithm recovers online reward-free safe RL while improving the best-known sample complexity by a factor of Θ(H/ξ2), where ξ is the safety margin of a baseline policy. When the simulator is accurate on most transitions, this improvement grows to Θ(H2∣\mcS∣∣\mcA∣/(ξ2∣\mcB∣)), where ∣\mcB∣ denotes the size of the sim-to-real mismatch region.
Safe exploration remains a fundamental challenge in reinforcement learning (RL), limiting the deployment of RL agents in the real world. We propose Sampling-Based Safe Reinforcement Learning (SBSRL), a model-based RL algorithm that maintains safety throughout the learning process by enforcing constraints jointly across a finite set of dynamics samples. This formulation approximates an intractable worst-case optimization over uncertain dynamics and enables practical safety guarantees in continuous domains. We further introduce an exploration strategy based on constraining epistemic uncertainty, eliminating the need for explicit exploration bonuses. Under regularity conditions, we derive high-probability guarantees of safety throughout learning and a finite-time sample complexity bound for recovering a near-optimal policy. Empirically, SBSRL achieves safe and efficient exploration both in simulation and in real robotic hardware, and readily extends to practical deep-ensemble implementations that scale to high-dimensional continuous control problems.
Vision-language-action (VLA) benchmarks measure whether a policy completes a requested manipulation task, but binary success can hide safety violations along the trajectory: a policy may reach the goal while applying excessive contact, disturbing bystander objects, destabilizing a held object, or entering robot self-contact. We present SafeVLA-Bench, a post-hoc safety-evaluation framework for existing simulator-based VLA benchmarks that reveals violations missed by success-only evaluation. It encodes task-aware safety requirements as Signal Temporal Logic (STL) invariants with quantitative robustness semantics. Alongside native success, it reports the safety rate and the success-but-unsafe rate (SBU) used in prior safety evaluations, and introduces the Violation Severity Index (VSI), a bounded worst-violation depth score. We instantiate SafeVLA-Bench on LIBERO and RoboCasa-365, evaluating twenty-seven policy-benchmark entries across tabletop and kitchen manipulation tasks. High task success does not imply safe execution: the fifteen tabletop policies above 90% mean success still have 18-28% unsafe-episode rates, and 38-56% of successful RoboCasa-365 rollouts violate at least one active safety clause. A post-training case study further shows that SafeVLA-Bench can be used to improve policy safety. Project page: https://safevla.org
Jialiang Fan, Weizhe Xu, Zijun Wang +3
University of Notre Dame · University of Pennsylvania