ShieldVLA: Feasibility-Aware Safety Alignment for Vision-Language-Action Models
Manan Tayal, Akshay Nambi
Indian Institute of Science · Microsoft Research
Published September 2, 2026 · on the feed September 22, 2026 · ▲ 13 · arXiv 2609.13231
The abstract
Vision-Language-Action (VLA) models demonstrate strong generalization in robotic manipulation and navigation, but existing fine-tuning methods provide limited safety guarantees. Current approaches primarily rely on Lagrangian optimization that enforces safety through soft penalties on expected cumulative cost, often resulting in residual constraint violations or overly conservative behavior. Moreover, learning safety in visual domains is challenging due to the absence of dense per-step safety annotations. We propose ShieldVLA, a safety-aligned fine-tuning framework for VLA models based on Hamilton-Jacobi (HJ) reachability. ShieldVLA learns a model-free approximation of the HJ reachability value function directly from visual observations to estimate the safe operating region. The learned safety critic gates policy optimization by separating reward maximization within feasible regions from recovery near unsafe states, avoiding persistent reward-cost trade-offs. To enable scalable supervision in visual environments, we introduce rubric-based VLM safety scores that convert semantic safety feedback into structured critic targets without requiring manual cost labels. Across five navigation and manipulation benchmarks spanning multiple VLA backbones, ShieldVLA reduces cumulative safety cost by 57% on average and improves task success rate by +0.13 over SafeVLA.
The Brief
2:21A short podcast summary of the paper. Written and voiced by AI.
Transcript
ShieldVLA. Feasibility-Aware Safety Alignment for Vision-Language-Action Models. By Manan Tayal and one other, from the Indian Institute of Science and Microsoft Research. Published on the second of September. No code repository is linked to it.
Vision-language-action models generalize well in robotic manipulation and navigation, but the ways they are fine-tuned today offer limited guarantees about safety. Most current approaches rely on Lagrangian optimization, which enforces safety through soft penalties on the expected cumulative cost. The trouble with a soft penalty is that it can land on either side of the line: residual constraint violations in some cases, overly conservative behavior in others. There is a second obstacle specific to vision. Learning safety from images is hard because there are no dense, per-step safety annotations to learn from.
ShieldVLA builds safety-aligned fine-tuning on Hamilton-Jacobi reachability instead. From visual observations directly, it learns a model-free approximation of the reachability value function, and uses it to estimate the safe operating region. Rather than trading reward against cost everywhere, it asks where the robot can safely be.
That learned safety critic gates policy optimization. Inside feasible regions, the policy maximizes reward. Near unsafe states, it works on recovery instead. Separating the two is what avoids a persistent tug of war between reward and cost.
For supervision, the paper introduces rubric-based safety scores from a VLM. These convert semantic safety feedback into structured targets for the critic, so no one has to label costs by hand. That is the answer to the missing per-step annotations: the vision-language model supplies the signal at scale.
The evaluation spans five navigation and manipulation benchmarks and multiple VLA backbones. Against SafeVLA, ShieldVLA reduces cumulative safety cost by fifty-seven percent on average, and raises task success rate by zero point one three. The breadth matters as much as the averages. Five benchmarks covering both navigation and manipulation, and more than one backbone underneath, means the gain is not tied to a single model or a single kind of task.
Both numbers move in the direction a soft penalty would have forced a choice between. Cost goes down and success goes up together, which is what the design was aiming for by keeping reward-seeking and recovery in separate regions instead of blending them into one weighted objective.
Paper Quest · 7 chapters · about 40 min
Play this paper
Learn it by doing: make the calls the authors made, guess the result before you see it, and defend it in a viva graded on your own words. Chapter 1 is right here.
Chapter 1 🧩 · The problem
A robot that is good at its job can still wreck everything with one collision. Start there.
You are fine-tuning a robot policy that reads camera images and language instructions. It does its tasks well, but a single collision or a step into a hazardous zone can cause irreversible failure.
The road ahead
- 1 · The problem ~7 min A robot policy that acts from camera images must stay safe at all times, but the usual penalty fix leaks violations, breeds timidity, and needs labels nobody has.
- 2 · What came before ~3 min
- 3 · The key idea ~8 min Learn from images where safety can still be kept, use that to switch each update between pure reward and recovery, and get the safety signal from rubric-scored VLM judgments.
- 4 · Choose your own research ~3 min
- 5 · Build the method ~8 min Rubric-scored VLM ratings become calibrated margins, which train a reachability critic, which then gates each policy update between reward and recovery.
- 6 · The experiment ~6 min You’ll guess: Averaged over five navigation and manipulation benchmarks, by how much did ShieldVLA cut cumulative safety cost compared with SafeVLA?
- 7 · The viva ~5 min Three questions from the examiners, answered in your own words. Win it for the paper’s trophy.
Free, with Google or an email address. Your stars and progress are kept.