We thank the reviewer for the comprehensive feedback! We are grateful that the review acknowledged that our paper is a pioneer systematic study with comprehensive evaluation, insightful discovery, and well-organized presentation, and also that SAFE tackles a critical safety problem, provides formal control with theoretical guarantees, and demonstrates substantial gains over baselines!

W1, Q1: “One- or two-layer probes may underutilize richer representations; unclear how performance scales if future VLAs integrate deeper multi-layer feature fusion or cross-modal attention architectures.” “Try concatenating or aggregating embeddings from intermediate transformer layers?”

We thank the reviewer for bringing up this point! We maximized the simplicity and transferability when designing SAFE. By only taking feature vectors at the last layer, the proposed method can be easily integrated into any VLA models with minimal implementation changes and no finetuning on the VLAs themselves.

However, we do agree that fusing or aggregating deep features from multiple layers is a promising direction and can be beneficial for failure detection. Related works have shown potential in this direction. For example, [Ref1] proposed Truthfulness Separator Vector (TSV), which is injected in the LLM latent features in the middle of the transformer and is optimized to better separate the hallucinated and truthful responses in the final token feature space. We think a similar technique can also be developed for VLA failure detection. However, this would require a special design and implementation for each VLA model (as some VLA models output discrete tokens, and others use flow matching to output continuous actions, there may not be a single design that can be applied to all VLA architectures), reducing its transferability. We leave the development of such methods as a promising future work.

We also agree that simply using the latent feature from an intermediate transformer block may lead to better failure detection performance than the very last layer. As shown by [49] and [53], LLM latent features from different layers have different performance on hallucination detection, and the best one may not be the last layer. However, exactly which layer works the best depends on the model and requires extensive ablation experiments to find out. For example, as reported by [49], for the OPT-6.7B model, the 20th layer works the best, but for LLAMA2-7B, the 16th layer works the best. To locate the best layer, [49] has to perform a grid search over each LLM tested. On the contrary, in our setting, VLA users can avoid such grid search experiments and simply choose the final layer for failure detection. Therefore, we think that precisely finding the layer that works the best for VLA failure detection is outside the scope of this paper, but it would be very interesting to explore for future work.

[Ref1] Steer LLM Latents for Hallucination Detection, ICML 2025

W2: “The method’s robustness under radical domain shifts (e.g., navigation, aerial manipulation, or action-less video inputs)”

We thank the reviewer for mentioning this. SAFE only requires access to the latent features from VLA models and is broadly applicable to other domains as long as they use a white-box robot policy based on neural networks. In this work, we focus on robot manipulation tasks and VLA policies because dexterous manipulation is widely accepted to be one of the most challenging domains for VLAs, where diverse failure modes exist. We leave the application and the evaluation to other robot and non-robot (action-less video) domains for future work.

W3: “Adaptations of existing techniques; the primary novelty resides in their tailored application to VLA failure detection rather than introducing fundamentally new algorithms.”

We agree with the reviewer that SAFE is indeed adapted from existing techniques. However, we would also like to thank the reviewer for pointing out contributions in multiple aspects besides technical novelty, including (1) the first systematic study of multitask failure detection in VLA policies, (2) the insightful discovery of a task-agnostic “failure zone”, (3) comprehensive empirical evaluation across multiple settings, (4) formal control of false positives via functional conformal prediction, and (5) demonstrating substantial gains over baselines in a novel multitask setting.

W4: “Without investigating strategies for recovery or intervention once a failure is detected.”

Following prior works [8,17], we also primarily focus on detecting failures accurately and in a timely manner. As long as the failure is detected, the robot can either abort potentially dangerous actions or a human monitor can step in and take over control.

Designing a fallback policy or an automatic failure recovery algorithm is a challenging and open research problem. We think this is beyond the scope of this work, and is a promising future direction.

Q2.1: "How sensitive is the conformal threshold band to the choice of α in high-risk settings?”

Please refer to Figure 8 in the appendix for a comprehensive list of how TPR, TNR, and balanced accuracy change with $\alpha$. From Figure 8, we can observe that while the metrics do vary with the $\alpha$, choosing $\alpha=0.15$ (or in general, between 0.05 and 0.2) performs well across the board. We have also chosen $\alpha$ to be 0.15 for most qualitative results and analyses reported in the paper.

Q2.2: “Could α be adapted online based on task-specific risk profiles?”

Yes, the proposed method and baselines can be extended to online or adaptive conformal prediction (CP) [Ref1]. In such a framework, rollout results are observed one-by-one and compared to the prediction results, and the significance level $\alpha$ is adjusted if the prediction is wrong.

However, when VLA policies are deployed, they may constantly meet novel environments and customized task instructions, and may rarely repeat the same task. In such a case, it can be hard or even impractical to develop an adaptive CP band for each specific task. Therefore, in this work, we focus on the performance of failure detectors when they are directly deployed on a novel task, and have never seen or repeated the task before. In this setting, offline CP is more appropriate.

Nevertheless, we believe online CP is an interesting extension to our work, and we leave it as an important future work.

[Ref1] Adaptive conformal inference under distribution shift. NeurIPS 2021

Q3: “Extended to a multidimensional output (grasp vs. collision) for targeted recovery strategies?”

Yes, the proposed method can be extended to a multi-class classifier that categorizes failures into different types. However, this would require annotations on failure types and demands manual efforts. SAFE aims to detect failures with minimal annotation effort (only labels on failure vs success), and we leave the multidimensional output extension as a valuable future work.

Moreover, as described in Appendix Section B.3, sometimes the timing and type of failure can be ambiguous and hard to determine. Therefore, the multi-dimensional extension will be non-trivial and require extra considerations.

Thanks for the detailed responses. I remain positive about this work, recognizing its potential contributions to the field of embodied AI. As noted, the manuscript effectively addresses the challenge of failure detection, a persistent and complex issue in this domain. Although straightforward, the method introduces a nearly cost-free solution that could significantly enhance a variety of existing VLAs. The analysis and its outcomes provide valuable insights to society. However, while the method itself holds value, addressing additional aspects such as investigation into module design, feature selection, and types of failures is also crucial. These elements are essential for rounding out the research, potentially increasing the societal impact of the work.

We thank the reviewer for the insightful review! We appreciate that the reviewer points out that our method is generalizable across tasks, efficient at runtime, and capable of detecting failures early, and also that SAFE is simple to supervise, provides statistical control, and achieves strong performance without needing heavy computation!

W1: “Does not provide true uncertainty quantification … does not estimate calibrated probabilities of success... Detecting OOD states is fundamentally a different problem...”

SAFE does not aim to achieve uncertainty quantification (UQ) or OOD detection, but it does model the probability of failures and can detect failures of VLA policies.

These 3 techniques are closely connected but have subtle differences. Here, we provide a discussion about them.

Failure detection is the task of detecting failures when a robot is performing certain tasks. SAFE learns the likelihood of failure through training on a set of successful and failed rollouts. SAFE-LSTM is trained by BCE loss and outputs a normalized score indicating the probability of failure of VLA. The output of SAFE-MLP is not normalized and thus not a probability. However, output scores from both SAFE-LSTM and SAFE-MLP are calibrated through functional Conformal Prediction CP and can be used for failure detection with theoretical guarantees.

Uncertainty quantification measures a VLA’s uncertainty in its outputs and can be used as a proxy for failure detection. In our experiments, the token uncertainty baselines and sample consistency baselines are inspired by LLM/VLM literature and designed based on UQ. Methods in this category are typically training-free, but they only show limited success according to our experiments.

OOD detection-based failure detection methods treat successful rollouts as normal execution conditions and assume that deviations from this norm lead to a higher chance of failure. In our experiments, the embedding distribution-based baselines are designed to detect policy failure based on OOD detection. Methods in this category can work without failed rollouts. In our experiments, we adapted them to take in both successes and failures, and they showed strong performance. Please see Section 2.2 in our paper and also [8] for comprehensive discussions on these methods.

Uncertainty quantification (UQ) methods have been widely used for LLM/VLM hallucination detection (see section 2.3), and OOD detection-based methods have been shown to be effective for failure detection in robotics policies (see Section 2.2). Therefore, we think it’s appropriate to use them as baselines.

SAFE directly learns to detect failures from a history of observations and the language instruction specifying the desired task without using uncertainty or OOD detection as the proxy measurement. Experiments show that this direct learning regime used by SAFE is more effective and achieves better performance than other methods. We will add more discussion about this in the camera-ready version.

W2: “Failed states in certain tasks may be successful states in others.”

We want to clarify a potential misunderstanding around this point. Success and failure criteria are indicated in the given language instruction of the VLA policy. VLA models take in the language instruction together with observation, process them through a deep neural network, and aggregate the information in a high-level feature vector. These feature vectors have extracted the success criteria from the language input and can identify failures based on both the observations and the language instructions specifying the desired task. Our analysis and experiments show that SAFE can detect failures across different tasks, including unseen ones, even when the same states are visited.

W3, Q3: “Using latent representation from different pretrained models, e.g. Dino?”

In the following table, we ablate SAFE-MLP and SAFE-LSTM using DINOv2 features, CLIP features, DINOv2 and CLIP concatenated (DINOv2+CLIP), and the VLA last-layer features (VLA; our main method). DINOv2 and CLIP features are extracted from the observation images, and this experiment is conducted over the real-world Franka rollouts, following the same setting as reported in the paper. Numbers are ROC-AUC on the Seen and Unseen tasks.

The best performing method in the above table is the SAFE-MLP method based on VLA last-layer features, where VLA features outperform other feature types by a large margin. We think that this is because VLA feature space learns high-level information about the tasks, and thus can more easily distinguish failures from successes than general pretrained models. Similar findings were also reported in related works like [17].

Q1: “How important is the diversity of failure modes and tasks in training?”

We thank the reviewer for bringing this up. Yes, since SAFE learns to distinguish failures from successes from training rollouts, it is important to have good coverage of the diversity of failure modes and tasks in training. To quantify this effect, we conduct an experiment varying the number of seen tasks that are used in training. Note that different tasks typically also have different failure modes, and in this way, we are also ablating the diversity of failure modes.

In the following table, we report the failure detection ROC-AUC on the OpenVLA+LIBERO benchmark, trained on different numbers of tasks. While the number of seen tasks is ablated, all experiments use the same set of unseen tasks for evaluation, and performance on unseen tasks is comparable. All numbers are averaged over 3 random seeds. Experiments with 7 tasks for training match the setting reported in the paper. Training-free methods do not depend on training tasks and are not shown.

The above table shows that for most methods, with more tasks used for training, the performance on unseen tasks gets better. The proposed SAFE-MLP performs well in all settings and can also achieve good performance when fewer (3 or 5) tasks are used for training.

Q2-1: “How long does it take to collect a balanced set of successes and failures?”

The time used to collect a balanced set of real-world rollouts depends on the performance of the VLA model. During our data collection, we adjusted the environment setup and task difficulty with the target of achieving such a balance.

In total, by deploying the pretrained pi0-FAST model on a Franka robot, we collected 1307 rollouts with 420 successes and 887 failures, among them 390 successful and 390 failed ones are used for training and evaluation. Each rollout typically takes 40~60 seconds to collect, and the total collection time for the real-robot rollouts takes roughly 10 days.

Q2-2: “Necessary to use VLA rollouts? Can one use teleoperated demos?”

Yes, it’s possible to use teleoperated demos to train the failure detector. SAFE only requires the VLA’s internal features, which can be obtained by running inference over rollouts collected by human demonstration or another policy.

However, such “off-policy” rollout collection may contain different failure modes from VLA’s (i.e., VLA policies and human operators may fail in different ways), and therefore, the failure detectors trained on teleoperated rollouts may have worse performance when directly applied to the VLA (“on-policy”) rollouts.

Q4: “How would the failures detected be used to steer/control VLA behavior?”

Our work focuses on detecting failures accurately and in a timely manner, which enables either the robot to abort potentially dangerous actions or a human monitor to step in and take over control. How to learn a recovery policy or how to improve the VLAs themselves are important areas for future work. In this work, we focused on detecting failures of multitask VLAs reliably and in real-time, which is a crucial stepping stone towards autonomous recovery (e.g., with a fallback policy) and policy improvement (e.g., through interactive imitation learning).

We think it is possible to use the findings from this paper to further develop methods for steering or improving VLA behaviors. For example, we show that the embeddings for successful and failed rollouts are separated in the latent space, so it is possible to learn a steering vector that manipulates the latent activations of a VLA and changes its output actions, as done in [Ref1] and [Ref2]. However, different from the stylization or hallucination reduction tasks for LLMs, robot manipulation involves multistep closed-loop interaction between the policy and the environment, which greatly complicates the relationship between VLA outputs and task execution successes. Therefore, how to improve VLAs through activation steering is a challenging and open research question beyond the scope of our paper.

[Ref1] Inference-time intervention: Eliciting truthful answers from a language model. NeurIPS 2023

[Ref2] Adaptive activation steering: A tuning-free llm truthfulness improvement method for diverse hallucinations categories. ACM TheWebConf 2025

We appreciate the reviewer for acknowledging our response and adjusting the score! 

To clarify, SAFE only needs around 200 - 400 rollouts for training, and a large portion of collected rollouts are used for evaluation but not training. In the following table, we provide the detailed statistics on the rollouts collected for each benchmark and how they are split into training and evaluation subsets. 

As SAFE is designed for multitask failure detection, it is trained on only a limited set of training tasks and rollouts and can generalize to new tasks without further collecting rollouts. While SAFE does require hundreds of rollouts from multiple tasks during training, when handling new tasks, SAFE becomes more efficient than existing task-specific failure detectors (like [8,17]) that require collecting rollouts for training and calibration for every new task encountered. 

Also note that in our setting, rollouts are collected by simply running VLA inference. This is a much easier task than collecting demonstration rollouts for training a robot policy, where the latter requires a human to carefully perform the task manually by demonstration or teleoperation. But in our setting, the human only needs to reset the environment, hit a button to make the VLA run and then label the rollout as success or failure.

We thank the reviewer for a careful and constructive review! We appreciate that the reviewer found our method unified, efficient, and generalizable to unseen tasks, and acknowledged that SAFE shows strong empirical results and can detect failures during early stages!

W1: “Evaluates the failure detector on two simulation environments, while the real-world experiments only evaluate the p0 checkpoint on the Franka Emika Panda Robot, which is quite limited.”

We provide an additional set of real-world experiments as follows, where the OpenVLA model trained on the “Open-X Magic Soup++" dataset is deployed on a real WidowX robot arm in our lab. In this experiment, we collected a total of 532 rollouts on the following 8 tasks, with 244 successes and 288 failures. Each task has roughly the same number of rollouts.

• Lift AAA Battery
• Lift Eggplant,
• Lift Red Bottle
• Lift Blue Cup
• Put Blue Cup on Plate
• Put the Red Bottle into Pot
• Put the Carrot on Plate
• Put the Red Block into the Pot

The failure detection ROC-AUC of different methods is reported in the following table. This experiment follows the same evaluation protocol as the OpenVLA+LIBERO experiment reported in the paper. All numbers are averaged over 3 random seeds. 6 of the 8 tasks are in the Seen subset, and the remaining 2 are in the Unseen subset.

This table shows that SAFE-MLP achieves the best failure detection results on both seen and unseen task splits on the real-world OpenVLA+WidowX setup, with a significant margin over baselines. This complements the real-world experiments we had on the Franka robot and shows the generalizability of the proposed SAFE method.

W2, Q1: “The last-layer features might not be a meta representation space for other diverse VLA architectures such as octo; The generalizability of the proposed technique to other VLAs is unknown.” “How does SAFE generalize to other VLAs beyond pi0?”

We note that we have already tested SAFE and baselines on 3 VLA architectures, OpenVLA, pi0, and pi0-FAST. These 3 VLAs use different backbone VLMs (LLAMA2+DINOv2+SigLIP, and PaliGemma), tokenization schemes (per-dimension binning, flow matching, and frequency-space tokenization), and evaluation benchmarks (LIBERO, SimplerEnv, and real-world Franka). We believe these experiments have demonstrated the generalizability of SAFE over different VLAs.

We are grateful for the reviewer’s suggestion and, in the interest of completeness, we have also included experimental results on the Octo VLA on the SimplerEnv benchmark. In this experiment, we use Octo-small as we found that Octo-small has a higher success rate (Avg success rate = 15.3%) than Octo-base (Avg success rate = 12.7%) on SimplerEnv. We would like to note that Octo is not among the most performant VLAs available in the literature: probably because the Octo model is relatively small (27M or 93M parameters) and did not use VLM as initialization, its performance is significantly lower than $\pi_0^*$ (Avg success rate 71.6%) on this benchmark.

Out of 23 tasks provided in SimplerEnv, Octo-small has a 0% success rate on 7 of them, and we only use 12 tasks that have success rates > 5% for this experiment. 9 out of 12 tasks are seen, and the other 3 are unseen. Each task has 100 rollouts. The following numbers are ROC-AUC averaged over 3 random seeds, as done for other experiments in the paper.

From the above table, we can see that Octo embedding space also shows a great potential for failure detection, as the embedding distribution baselines and SAFE all achieve high performance. Although SAFE-LSTM does not achieve the very top performance, it’s very close to the best method, with a gap of only 2 to 3 percent.

W3, Q3: “Practical deployment constraints, such as computational overhead or integration into existing robot stacks.”

Computational overhead: SAFE uses a 1-2 layer MLP or LSTM and poses a minimal (<1%) computational overhead at runtime. For example, SAFE-LSTM has 2.3 million parameters and an inference time of 0.73 ms. This is negligible compared to large VLA models. For instance, pi0 has 3.3 billion parameters and an inference time of 149 ms. We will include this information in the updated paper.

Integration requirements and deployment constraints: SAFE only requires access to the latent features of VLA models and is compatible with any white-box robot policies based on neural networks. However, SAFE does require deploying the policy and collecting successful and failed rollouts to train the failure detector before it can detect failures.

Q2: More qualitative examples of the failure modes in real-world settings.

Unfortunately, NeurIPS does not allow us to provide PDFs, videos, or external links during rebuttal. We will include more qualitative examples for the camera-ready version.

Instead, we went through all the failure rollouts collected from our real-world experiments, and provided a textual summarization of failure reasons as follows (sorted by frequency):

• Grasping failure
• Placing failure
• Frozen action (where the predicted action becomes 0 and the robot stops moving.)
• Unstable action (where the robot seems to be moving randomly without executing the task.)
• Time up
• Press failure (The robot fails to press a button.)
• Collision with other objects / disrupting the environment.
• Go for the wrong object (The robot approaches or picks up the wrong object.)
• Push failure (The robot fails to push an opening drawer or an opening door.)