Route-Guided CBF-QP Repair for Safe Vision-Language-Action Models

Chan Park; Sunwoo Hong; Kirak Kim; Yoonjeong Park; Alexander W. Olson; Ali Pesaranghader

cs.AINov 1, 2026

Route-Guided CBF-QP Repair for Safe Vision-Language-Action Models

Authors: Chan Park, Sunwoo Hong, Kirak Kim, Yoonjeong Park, Alexander W. Olson, Ali Pesaranghader

Organizations: Sungkyunkwan University · University of Toronto · KAIST · LG Electronics, Toronto AI Lab

Abstract

Vision-language-action (VLA) models can generate task-oriented robot actions, but they do not guarantee safe execution in obstacle-rich manipulation scenes. Although CBF-QP safety filters can locally project unsafe actions into a safe set, such correction may push the robot away from the learned task trajectory and leave the VLA policy without a reliable recovery direction. We propose Route-Guided CBF-QP Repair, a post-hoc repair module that uses the short-horizon action chunk predicted by the VLA to detect blocked nominal trajectories and generate entry-exit-rejoin guidance around obstacles. The selected route is added to the CBF-QP objective as a soft guidance term, while the CBF safety constraint remains hard. On SafeLIBERO, our method improves collision avoidance, task success, and SafeSuccess compared with AEGIS. Our project page is available at GitHub.

Figures & tables

Fig. 1: Overview of Route-Guided CBF-QP Repair. The method uses the VLA action chunk to estimate a nominal future trajectory and detect obstacle-induced blockage. When the nominal trajectory is blocked, it generates an entry-exit-rejoin route around the obstacle and adds the selected route to the CBF-QP objective as soft guidance. The CBF constraint remains hard, so the repaired action preserves safety while following a recoverable route toward task completion.

Fig. 2: Qualitative comparison on SafeLIBERO. Task : pick up the chocolate pudding and place it in the basket. Top row : AEGIS (Success, Collision). Bottom row : Ours (Success, Collision-free).

Method	Metric	SafeLIBERO Suite				Average
		Spatial	Goal	Object	Long
AEGIS	CAR $\uparrow$ (%)	63.75	83.75	56.25	55.00	64.69
	TSR $\uparrow$ (%)	60.00	85.00	67.50	38.75	62.81
	SafeSuccess $\uparrow$ (%)	52.50	73.75	41.25	21.25	47.19
	ETS $\downarrow$	85.61	104.33	67.68	181.85	109.87
Route-Guided CBF-QP (Ours)	CAR $\uparrow$ (%)	66.25	81.25	76.25	52.50	69.06

TABLE I: Quantitative results on the SafeLIBERO benchmark.

Components				Average Performance
Path	Gate	Score	Rejoin	CAR (%)	TSR (%)	SafeSucc. (%)	ETS
$\times$	$\times$	$\times$	$\times$	64.69	62.81	47.19	109.87
$\checkmark$	$\checkmark$	$\checkmark$	$\times$	67.12	63.95	47.92	112.50
$\checkmark$	$\checkmark$	$\times$	$\checkmark$	65.88	63.10	48.15	114.12
$\checkmark$	$\checkmark$	$\checkmark$	$\checkmark$	69.06	65.00	49.69	118.45

TABLE II: Ablation study of route-guided CBF-QP components.

Safe Robot Manipulation

See all 28 papers

Your Model Already Knows: Attention-Guided Safety Filter for Vision-Language-Action Models
Jun 8, 2026Seongbin Park, Fan Zhang, Baharan Mirzasoleiman +2Robot Safety Safety Filtering
University of California Los Angeles United States
SafeLoop: Risk-Aware Rollback for Vision-Language-Action Manipulation
Sep 22, 2026Zeyu Lou, Tianran Zhang, Xinquan Yue +2Long-Horizon Robotic Manipulation Robot Safety
Nanjing University, Nanjing, China · The Hong Kong University of Science and Technology (Guangzhou), Guangdong, China · Beijing University of Technology, Beijing, China
VLPSA: Vision-Language-Poisson-Safe Actions for Full-Body Safety of Learned Policies
Sep 18, 2026Meg Wilkinson, Emily Fourney, Joel W. Burdick +1Robot Safety Robot Collision Avoidance
Department of Computing and Mathematical Sciences, California Institute of Technology, Pasadena, CA 91125, USA

Jun 8, 2026J/K move · Enter open · S save

Your Model Already Knows: Attention-Guided Safety Filter for Vision-Language-Action Models

Seongbin Park, Fan Zhang, Baharan Mirzasoleiman, Shahriar Talebi+1

University of California Los Angeles United States

Robot Safety Safety Filtering Vision-Language-Action Models Dynamic Obstacle Avoidance Robot Collision Avoidance

Open paper AskPDF arXiv

Vision-Language-Action (VLA) models have demonstrated impressive end-to-end performance across a variety of robotic manipulation tasks. However, these policies offer no guarantees against collisions with task-irrelevant objects in the scene. Existing safety filters sidestep this problem by querying a vision-language model (VLM) to identify obstacles and their locations. This, however, is too slow to run in the control loop and can only be invoked at episode initialization, leaving the filter unable to track moving obstacles. We discover that a small number of attention heads within a VLA model reliably localize the object the policy intends to approach. These heads can be exploited within a training-free safety framework that obtains the active target from the attention heads at every step, treats the remainder of the scene as obstacles, and feeds these into a Control Barrier Function (CBF) filter. Together with a lightweight real-time object tracker, this allows for collision avoidance for non-static obstacles. We evaluate our framework on SafeLIBERO, which we extend with moving obstacles. On the original static benchmark, our method performs comparably to an oracle that uses privileged simulator state to identify the target, emulating a VLM-based identification step run once at episode initialization. On the dynamic variant, where the oracle's init-time target assignment becomes stale, our method substantially outperforms it by 43%, on average. Our findings suggest that the perceptual signals needed for real-time safety filtering are already present within VLA policies and can be exploited without additional training or heavy auxiliary models.

Abstract

Safe Robot Manipulation

Explore similar work

Your Model Already Knows: Attention-Guided Safety Filter for Vision-Language-Action Models

SafeLoop: Risk-Aware Rollback for Vision-Language-Action Manipulation

VLPSA: Vision-Language-Poisson-Safe Actions for Full-Body Safety of Learned Policies