ForesightSafety-VLA: A Unified Diagnostic Safety Benchmark for Vision-Language-Action Models

Mingyang Lyu^a,b,c,e,*, Yinqian Sun^a,*, Yiyang Jia^a, Sicheng Shen^a,e, Moquan Sha^a, Huangrui Li^e, Feifei Zhao^a,e,b,c,†, and Yi Zeng^d,c,b,a,†

^a Brain-inspired Cognitive AI Lab, Institute of Automation, Chinese Academy of Sciences, Beijing, China
^b Beijing Key Laboratory of Safe AI and Superalignment, China
^c Beijing Institute of AI Safety and Governance, China
^d Gaoling School of AI, Renmin University of China, Beijing, China
^e University of Chinese Academy of Sciences (UCAS), Beijing, China
^* Co-first authors   ^† Co-corresponding authors

Accepted to the 2026 IEEE/RSJ International Conference on Intelligent Robots and Systems (IROS 2026).
arXiv:2606.27079

English | 简体中文

TL;DR A safety-first benchmark for VLA policies in RoboTwin: 66 safety-augmented scenarios, a 13-category taxonomy, controlled variation of scene structure, language and vision, and process-level metrics (cumulative safety cost and risk exposure time) that separate safe from unsafe success and failure.

_{Paper Fig. 1. Left: the 13-category safety taxonomy. Right: structure (L0-L2), language (W0-W4) and visual (V0-V4) variation.}

• Safety built into the scenarios. 66 base scenarios composed from RoboTwin assets by hazard injection, constraint tightening and temporal-precondition insertion, instantiating five physical safety suites.
• A 13-category taxonomy across Safe-Core (physical interaction), Safe-Lang (instructions) and Safe-Vis (perception). Language and visual categories are applied as evaluation-time overlays on the same scenarios.
• Process-level metrics. A dual-threshold monitor scores every simulation step; episodes are split into safe success, unsafe success, safe failure and unsafe failure, with cumulative safety cost (CC), risk exposure time (RET) and the safety-adjusted success rate (SASR).
• Diagnosis by source. One-factor sweeps over structure, language and vision show which dimension degrades safety.

Taxonomy (paper Table I).

Scenarios. 66 RoboTwin task classes (envs/safe_*.py); the list, suite labels and monitored channels are in docs/SCENARIOS.md.

Diagnostic dimensions. Structure L0-L2 (clutter, clearance), language W0-W4 (canonical, paraphrase, compositional, ambiguous/unsafe request, injection), vision V0-V4 (lighting, appearance, viewpoint + noise / occlusion, adversarial patch; cumulative, rendered observations only).

Metrics (paper Sec. IV). For every active channel k the monitor computes a signed margin q_k(s_t) (larger is safer) with a hard threshold at 0 and a soft threshold ε_k > 0:

_{Structure levels L0-L2 and visual levels V0-V4 on the paper's lift-pot renders (frames from paper Fig. 1).}

_{Paper Fig. 5 replayed over time: the task is completed, but the boundary channel crosses the hard boundary and the heat channel stays in the soft buffer (RET/T of 0.62 for any active risk, Table IV).}

Numbers from the paper: mean over 50 episodes per model-task-setting across 3 seeds, L0/W0/V0.

Table II. Aggregate results. Higher SSR and SASR are better; lower USR, UFR and CC are better.

Table III. Per Safe-Core suite, strongest vs. weakest completed baseline.

Paper Fig. 3. SSR vs. CC over measured model runs; bubble size is USR.	Paper Fig. 4. SSR (solid) and CC (dashed) as severity increases on a 10-scenario subset.

Findings stated in the paper: no evaluated baseline is fully safe; weaker baselines fail more dangerously rather than more conservatively (unsafe share of successes 12.5% for OpenVLA-oft vs. 37.5% for ACT); Thermal/Energy is the hardest suite and Temporal Sequence the easiest; structure and visual variation degrade safety more than ordinary language variation, while adversarial language (W3-W4) remains harmful.

The benchmark runs inside RoboTwin 2.0 (Linux, NVIDIA GPU, Vulkan). Install it as RoboTwin does:

git clone https://github.com/tuotuoLyu/ForesightSafety-VLA.git
cd ForesightSafety-VLA
conda create -n foresight python=3.10 -y && conda activate foresight
bash script/_install.sh            # RoboTwin dependencies (SAPIEN, mplib, CuRobo, pytorch3d, ...)
bash script/_download_assets.sh    # RoboTwin embodiments, objects and textures
bash script/foresight/fetch_policies.sh ACT DP RDT openvla-oft   # baselines you need (see docs/BASELINES.md)

See the RoboTwin installation guide for system requirements. The foresight_safety package itself only needs NumPy.

1. CPU smoke run (no simulator, no GPU). Audits the 66-scenario task pack, byte-compiles the code, runs the monitor, writer and report on scripted rollouts in a fake scene and applies the L/W/V variations.

python3 tools/smoke_cpu.py
python3 -m unittest discover -s tests -t .

2. Collect demonstrations, train, evaluate.

bash script/foresight/collect_all.sh 0                                  # expert demonstrations, 66 scenarios
bash script/foresight/train_baselines.sh ACT 0 0 40                     # per-scenario ACT, 40 demonstrations
bash script/foresight/eval_safety.sh ACT safe_lift_pot_thermal safe_lift_pot_thermal safe_lift_pot_thermal \
    L0 W0 V0 0 -- --ckpt_dir policy/ACT/act_ckpt/act-safe_lift_pot_thermal/safe_lift_pot_thermal-40 --temporal_agg true

Each evaluation writes foresight_episodes.jsonl, foresight_episodes.csv and foresight_summary.json (SSR/USR/SFR/UFR, CC, RET, SASR, per-channel exposure) under eval_result/. Change L0 W0 V0 to run a diagnostic setting, for example L2 W0 V0 or L0 W4 V0.

3. Full protocol and report.

bash script/foresight/run_benchmark.sh ACT "{config}" 0 -- \
    --ckpt_dir "policy/ACT/act_ckpt/act-{task}/{config}-40" --temporal_agg true
python3 -m foresight_safety.report eval_result --out eval_result/foresight_report

run_benchmark.sh evaluates all 66 scenarios at L0/W0/V0 and sweeps L, W and V on the 10-scenario diagnostic subset. Useful overrides of script/eval_policy.py: --num_episodes (50), --seeds ([0, 1, 2]), --warmup_episodes (2), --safety_lambda (1.0), --embodiment (aloha-agilex, franka-panda, ur5-wsg, piper, ARX-X5), --foresight_keep_trace True (per-step margins for process plots). Other baselines: docs/BASELINES.md.

docs/PAPER_ALIGNMENT.md maps every equation, definition and protocol choice of the paper to the code and its default, including the values the paper does not specify. docs/UPSTREAM_CHANGES.md lists every change relative to RoboTwin.

@inproceedings{lyu2026foresightsafety,
  title     = {ForesightSafety-VLA: A Unified Diagnostic Safety Benchmark for Vision-Language-Action Models},
  author    = {Lyu, Mingyang and Sun, Yinqian and Jia, Yiyang and Shen, Sicheng and Sha, Moquan and Li, Huangrui and Zhao, Feifei and Zeng, Yi},
  booktitle = {2026 IEEE/RSJ International Conference on Intelligent Robots and Systems (IROS)},
  year      = {2026},
  eprint        = {2606.27079},
  archivePrefix = {arXiv}
}

ForesightSafety-VLA is built on RoboTwin and the SAPIEN simulator, and evaluates the RoboTwin integrations of ACT, Diffusion Policy, DP3, RDT, OpenVLA-OFT, openpi (Pi0, Pi0.5), DexVLA, TinyVLA and LLaVA-VLA. We thank their authors. This study is supported by the National Natural Science Foundation of China (Grant No. 62576341 and No. 32441109), the Beijing Natural Science Foundation (Grant No. 4252052), and the funding from Institute of Automation, Chinese Academy of Sciences (Grant No. E411230101).

MIT, see LICENSE. RoboTwin-derived files keep RoboTwin's MIT licence (LICENSE-RoboTwin); fetched baselines keep their own licences (THIRD_PARTY.md).