本文由 AI 分析生成
建立時間： 2026-08-18 來源： https://arxiv.org/abs/2503.03480
Summary
SafeVLA proposes an Integrated Safety Approach (ISA) for Vision-Language-Action models: systematically model safety requirements, actively elicit diverse unsafe behaviors, apply constrained RL (CMDP) during VLA fine-tuning, and evaluate with safety-targeted tests. On the Safety-CHORES benchmark (long-horizon mobile manipulation), SafeVLA reduces cumulative safety violations by 83.58% while improving task success rate by 3.85% compared to state-of-the-art (NeurIPS 2025 Spotlight).
SafeVLA 將 CMDP 安全約束學習應用於 VLA 大型模型微調，透過系統性需求建模、主動生成不安全行為樣本、約束 RL 訓練三步驟，在長時域移動操控任務上大幅降低安全違規（-83.58%），同時提升任務成功率（+3.85%），是 PKU-Alignment 繼 SafeDreamer 後的 VLA 安全對齊研究。
Prerequisites
- CMDP (Constrained MDP) — the core safety formulation; cost signal is separate from reward and must stay below a budget during training.
- VLA (Vision-Language-Action) models — reader needs to understand VLA architecture (language instruction → visual observation → action token prediction) to see how CMDP constraints integrate at the policy level.
- SafeRL / Lagrangian optimization — SafeVLA applies the same dual-variable approach as SafeDreamer but in a foundation model fine-tuning context.
Core Idea
Existing VLA models are trained purely to maximize task success; safety is not a training objective. SafeVLA reframes VLA fine-tuning as a CMDP: the VLA learns to maximize task reward while keeping a cumulative safety cost (unsafe state visitation, constraint violations) below a threshold. The novelty is the “elicitation” step — rather than hoping the training distribution covers dangerous scenarios, SafeVLA actively generates diverse failure modes and includes them in training. This ensures the cost signal is informative across the full space of unsafe behaviors, not just the vanilla safe distribution.
Results
| Task / Benchmark | SafeVLA | Prior SOTA | Delta |
|---|---|---|---|
| Cumulative safety violations (Safety-CHORES) | −83.58% | Baseline | Major reduction |
| Task success rate | +3.85% | Prior SOTA | Improvement |
Limitations
- Author-stated: Benchmark limited to Safety-CHORES; generalization to other VLA architectures and task domains untested.
- Unstated: The unsafe behavior elicitation step requires a simulation environment capable of generating diverse failures — expensive to set up for novel real-world tasks. Also, CMDP training at VLA scale is computationally demanding.
Reproducibility
- Code: PKU-Alignment group (SafeDreamer code is public; SafeVLA availability not stated in clipping)
- Datasets: Safety-CHORES benchmark (long-horizon mobile manipulation)
- Compute: VLA-scale fine-tuning; substantial GPU requirements
Insights
SafeVLA is architecturally significant because it moves safety from a post-hoc filter to a training-time objective for VLA models. The elicitation step is particularly important: most safety failures in real deployment come from adversarial or edge-case distributions not in the nominal training set. Actively generating these failure modes during training is analogous to adversarial training in computer vision.
The fact that task success rate improves alongside safety suggests the safety constraints act as a regularizer that prevents the VLA from taking risky shortcut behaviors that sometimes work but often fail.
Connections
- safedreamer-safe-reinforcement-learning-world-models — predecessor from same group (SafeRL with world models → SafeRL with VLAs)
- llm-vlm-controlled-robotics-vulnerability — complementary: VLM adversarial vulnerability is an orthogonal safety problem SafeVLA doesn’t address
- world-models-robot-safety — broader safety survey context
- hitl-hri-survey-2024-2026 — HRI safety considerations
Raw Excerpt
“SafeVLA achieves 83.58% reduction in cumulative safety violations vs. state-of-the-art, with +3.85% task success rate improvement.”