HRI Safety: Beyond Physical Constraints
Sources: Session notes, 2026-07-07 Raw: HRI Safety Beyond Physical; HRI Safety Interaction-Centric; HRI Technical Dimensions Updated: 2026-08-12
Overview
Physical HRI safety (ISO/TS 15066 force/energy limits) is one axis of robot safety — the most studied, but not the most complete. A parallel taxonomy derived from world model safety research and HRI survey literature identifies five additional categories: algorithmic/decision-time safety, adversarial/security safety, alignment and human-factors safety, social/psychological safety, and perceptual/predictive safety. The HRI-specific categories add three more: communication and legibility, bidirectional uncertainty, shared control and authority handover.
Category 1: Physical Co-Presence Safety
The classic category: ISO/TS 15066 specifies force and pressure limits for contact between humans and cobots in manufacturing. The 2026 critical review argues that energy transfer — not instantaneous force — is the correct safety metric; current design approximations introduce unquantified performance penalties. The 2025 revision of ISO 10218-2 shifts safety from “a property of the robot” to “a property of the application.”
What makes this HRI-specific: Safety limits must track human body position, posture, and retreat capability in real time. The constraint is relational — it does not exist without a human present.
Scope gap: ISO/TS 15066 was designed for cobot assembly lines. 21+ DOF dexterous hands in contact-rich, unpredictable scenarios exceed what the standard handles.
Category 2: Algorithmic and Decision-Time Safety
Restricts the robot’s planned actions, not its physical output:
- Safe RL in latent space (SafeDreamer): Lagrangian relaxation on imagined rollouts in DreamerV3’s RSSM world model. Near-zero Safety-Gymnasium constraint violations. Safety holds only as well as the world model’s predictive fidelity.
- Uncertainty as safety signal (RWM-U): Ensemble disagreement penalizes transitions into states the world model doesn’t understand. Validated on real ANYmal quadruped and humanoid robots.
- Simulation-based safety probing: Pre-deployment policy evaluation using the world model as an offline oracle — adversarial scenario generation, OOD testing.
- VLA safety alignment (SafeVLA): CMDP-constrained RL reduces violations by 83.58% in benchmark evaluation.
Distinction from physical safety: These methods would apply even with no human present (autonomous vehicles, warehouse robots). They are “robot learning safety” that intersects HRI when humans are in the loop.
Category 3: Adversarial and Security Safety
Different threat model — not “robot is too forceful” but “someone is intentionally attacking the robot’s perception or decision pipeline”:
- World model as attack surface (Parmar 2026, arXiv:2604.01346): Data poisoning at training time; latent space corruption at inference causing the world model to predict safe paths through unsafe states; planning hallucination — the world model is confidently wrong because training data was systematically biased (ensemble agrees on the wrong prediction)
- VLM/LLM perceptual vulnerability: Simple input perturbations reduce task success by 14–22% (arXiv:2402.10340). If VLMs are used as safety filters, this weakness becomes a direct safety hole.
- Circular vulnerability: Using a VLM as safety oracle to check world model outputs — but VLMs are themselves attackable. No method currently addresses both layers simultaneously.
Category 4: Alignment and Human-Factors Safety
Between algorithmic and social safety; focuses on how humans are misled by system confidence:
- Reward hacking / deceptive alignment: Policies find paths the world model predicts as safe but that violate real-world constraints
- Automation bias: Operators over-trust world model predictions beyond their valid operating range
- Governance: NIST / EU AI Act compliance frameworks are identified as mitigation directions but lack technical specificity
Category 5: Social and Psychological Safety (HRI-Specific)
Not physical harm but psychological: “feeling unsafe” is a safety dimension in HRI contexts.
- Fear responses in humans span 7 dimensions including uncanny valley effect, privacy concerns, and technology unfamiliarity — especially pronounced in older adults interacting with social robots
- Trust appears in nearly every HRI survey but is rarely operationally defined; the field lacks a unified model of trust formation and breakdown
- What makes this HRI-specific: These risks do not exist without human-robot interaction; they cannot even be defined without a human present
Category 6: Communication and Legibility Safety (HRI-Specific)
Safety depends on whether the human can predict what the robot will do next:
- VAM-HRI 2024 #19 legibility optimization: Jointly optimizes workspace object placement and AR virtual obstacle projections to make human motions more predictable to the robot, which in turn makes the robot’s responses more predictable to the human — safety and fluency improve together
- VR nuclear sonification (VAM-HRI 2024 #2): Translates radiation, temperature, and flammable gas readings to sound in a VR nuclear facility simulation, allowing operators to perceive danger when visual channels are saturated
- The robot-to-human channel is systematically underbuilt compared to the human-to-robot channel (finding from arXiv:2312.00948 “Communicating Robot Learning”, cited in HITL surveys)
Category 7: Bidirectional Uncertainty Safety (HRI-Specific)
Safety failures occur not because the robot acted incorrectly, but because the robot acted on an uncertain guess rather than asking for clarification:
- Every major HRI survey identifies the bidirectionality gap: current systems are command-execution pipelines; robots cannot ask clarifying questions, signal uncertainty, or negotiate task completion
- What makes this HRI-specific: The failure mode requires a human to be present — the robot should be asking the human, not guessing
Category 8: Shared Control and Authority Handover Safety (HRI-Specific)
Risk emerges at the moment when control responsibility transitions between human and robot:
- VAM-HRI 2025 LLM shared control: LLM integrated into telepresence navigation pipeline; when LLM suggestions conflict with operator intent, authority resolution is the safety-critical question
- RoboCopilot: Human-in-the-loop imitation learning where every intervention is a training data point — the boundary between “human teaching” and “human overriding an unsafe action” is not clearly defined
Category 9: Operator Safety and Human Factors
Protects the human in the loop, not bystanders:
- Bimanual teleoperation doubles cognitive load and introduces harder retargeting problems — operator error risk increases
- VR operator identification via head/eye/hand tracking (VAM-HRI 2024 #4): only authorized operators should control robots
- MR training before real robot operation (VAM-HRI 2024 #20): training phase as safety mechanism
Open Questions
- Formal safety guarantees for Lagrangian constraints in world models: near-zero empirical violations vs. provable bounds?
- Can planning hallucination (confidently wrong, ensemble-consistent wrong predictions) be detected in practice?
- What is the right authority allocation model for LLM-assisted shared control when LLM suggestion and operator intent conflict?
- Multi-agent: all current methods are single-agent. How does human-robot-robot safety work when multiple robots share a space with multiple humans?