🤖 machine learning

BOKBO (Best of K Bad Options): Calibrated Abstention for VLA Policies

This paper introduces BOKBO, the first conformal abstention layer for K-sample VLA inference that provides finite-sample distribution-free guarantees on executed-violation rates by addressing structural failures in existing nonconformity scores and correcting methodological pitfalls in force thresholding, thereby significantly improving safety calibration and task success across diverse benchmarks and distribution shifts.

Original authors: Anya Singh, Cabrel Happi, Jai Relan, Varun Nair, Vidyut Baradwaj

Published 2026-06-01

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Anya Singh, Cabrel Happi, Jai Relan, Varun Nair, Vidyut Baradwaj

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are teaching a robot to perform delicate tasks, like pouring ketchup or spreading butter. To make the robot safer and more reliable, engineers use a trick called K-Sample Scaling. Instead of asking the robot to make just one move, they ask it to imagine K different possible moves (say, 8 different ways to pour the ketchup) and then pick the "best" one to actually do.

The problem is: What if all 8 imagined moves are dangerous?

Current methods have a blind spot. They assume that if you generate enough options, at least one will be safe. If all 8 are bad, the robot picks the "least bad" one and executes it anyway, causing a crash or a spill. It's like asking a chef to pick the best of 8 rotten apples; they'll still pick one, and you'll get a rotten salad.

This paper introduces BOKBO (Best of K Bad Options), a new safety layer designed to fix this. Here is how it works, using simple analogies:

1. The "Safety Gatekeeper" (Conformal Abstention)

Think of BOKBO as a strict safety gatekeeper standing in front of the robot.

The Old Way: The gatekeeper looks at the 8 options, picks the "best" one, and lets it through. If all 8 are bad, the gatekeeper lets the worst one through anyway.
The BOKBO Way: The gatekeeper has a special rule: "If I can't guarantee that the chosen move is safe, I will stop the robot entirely."
The Result: The robot might not do the task sometimes (it "abstains"), but when it does act, you have a mathematical guarantee that the chance of a safety violation is extremely low (less than 5% in their tests).

2. The "Broken Compass" (Why Old Methods Failed)

The researchers discovered why previous safety checks failed. They tried using two "free" signals that the robot already generates:

Confidence: How sure the robot feels about its move.
Disagreement: How different the 8 options are from each other.

The Analogy: Imagine you are trying to guess the weather.

The Mistake: The researchers realized that the "Disagreement" signal wasn't actually measuring how unsure the robot was about the weather. Instead, it was just measuring how much the researchers shook the dice before rolling them.
The Reality: In their setup, the robot generates 8 options by adding random "noise" (shaking the dice). The more noise they added, the more the options disagreed. The robot's "disagreement" score was just a thermometer for the noise level, not a detector for danger. It was like a smoke alarm that only goes off if you spray perfume near it, but stays silent when there is an actual fire.

3. The "Smart Detective" (The Learned Predictor)

Since the robot's own internal signals were lying (or rather, measuring the wrong thing), the researchers built a small, separate AI detective (a "Learned Violation Predictor").

This detective looks at the robot's options and the visual scene (using a camera).
It was trained specifically to spot danger, ignoring the "noise" the robot was generating.
The Result: This detective could actually tell the difference between a safe move and a dangerous one, allowing the safety gatekeeper to make the right call.

4. The "Custom Fit" vs. "One Size Fits All"

The paper also found that safety isn't the same for every task.

The Problem: A "global" safety rule (like "don't push harder than 50 Newtons") is too strict for soft tasks (like handling a tomato) and too loose for hard tasks (like handling a heavy bottle). It caused false alarms or missed dangers.
The Fix (Mondrian): BOKBO creates a custom safety rule for each specific task. It learns exactly how hard a human expert pushes when handling ketchup versus butter, and sets the safety limit accordingly. This makes the system much more reliable.

5. The "Simulation Reality Check"

The researchers tested this in a high-fidelity computer simulation (MuJoCo).

They found that BOKBO successfully stopped the robot from making dangerous moves in 86% of test cases while still letting the robot complete the task 70% of the time.
Without BOKBO, the robot would have failed safely (by stopping) less often, but when it did act, it would have made mistakes 8.6% of the time. With BOKBO, that mistake rate dropped to roughly 3%.

Summary

The paper argues that simply asking a robot to "try a few things and pick the best" isn't enough if you don't have a way to say "None of these are safe."

Old Method: "Pick the best of the bad options." (Silent failure).
BOKBO: "If none of the options are safe, stop." (Safe failure).
Key Insight: You can't trust the robot's own "confidence" or "disagreement" scores when you are artificially adding noise to generate options. You need a dedicated "detective" to look for actual danger.

The paper concludes that this approach works well in simulation and provides a mathematical guarantee of safety, but it notes that testing on real physical robots is the next necessary step.

Technical Summary: BOKBO — Best of K Bad Options

Problem Statement
Test-time scaling for Vision-Language-Action (VLA) policies has become a standard reliability technique, where $K$ candidate action chunks are sampled and the "best" is selected by a verifier or scorer. However, this paradigm relies on a critical, often unmet assumption: that among $K$ candidates, at least one is safe and task-completing. When all $K$ candidates are unsafe, the system executes the "verifier-best" candidate regardless of absolute quality, leading to "silent failure" with no warning mechanism. Existing methods lack a formal mechanism to detect these "all-unsafe" cells or to abstain from execution with safety guarantees. Furthermore, prior work has assumed that "free" signals (signals available without extra inference cost, such as base-policy confidence or $K$ -sample disagreement) correlate with policy uncertainty; this paper demonstrates that this assumption fails catastrophically under perturbation-based sampling.

Methodology: BOKBO
The authors introduce BOKBO (Best of K Bad Options), the first conformal abstention layer designed specifically for $K$ -sample VLA inference. BOKBO decides whether to execute or abstain based on a calibrated score, providing finite-sample, distribution-free upper bounds on the rate of unsafe executions among non-abstained decisions.

Conformal Risk Control (CRC): The method applies CRC to the $K$ -sample setting. It trains a predictor to estimate the probability of a safety violation ( $v=1$ ) and calibrates a threshold $\hat{\tau}$ on a held-out calibration set. The system executes only if the predictor score $s_\theta \le \hat{\tau}$ .
Nonconformity Scores: The paper evaluates three scoring mechanisms:
1. VLA Confidence Proxy: The base-policy log-probability of the chosen chunk.
2. $K$ -Sample Disagreement: The maximum pairwise $L_2$ distance among candidates.
3. Learned Violation Predictor: A small MLP trained on semantic visual features (DINOv2), proprioceptive state, and task identity to predict violations directly.
Mondrian Calibration: To address heterogeneity in violation rates across different tasks, the authors implement a Mondrian (per-task) variant of CRC. This ensures that the safety bound holds conditionally for each specific task, rather than just marginally across the entire dataset.
Safety Labeling: A critical methodological correction involves defining safety labels. The authors identify that globally-set force thresholds (e.g., 50N) inflate violation rates by 5 $\times$ because they exceed expert-typical manipulation forces for many tasks. They propose per-task expert-calibrated thresholds defined as $\max(50\text{N}, p99(\text{expert max force}) + 10\text{N})$ .

Key Findings and Diagnostic Analysis
The paper's most significant diagnostic finding is the structural failure of "free" signals under perturbation-based $K$ -sampling.

Perturbation vs. Uncertainty: Under action-space Gaussian perturbation (where candidates are generated as $a_k = a_0 + \sigma\xi_k$ ), both the VLA confidence proxy and $K$ -sample disagreement correlate at 0.98 with the noise hyperparameter $\sigma$ , but at the noise floor (Spearman $\approx -0.05$ ) with actual safety violations.
Mechanism: These signals measure the magnitude of the injected perturbation, not the policy's internal uncertainty.
Boundary Condition: The authors test token-level temperature sampling (which generates diversity from policy stochasticity rather than injected noise). Under this mechanism, the correlation between free signals and the sampling hyperparameter drops (from 0.98 to 0.41), and the signals regain some safety information. However, the learned predictor remains superior in both regimes.

Experimental Results
Experiments were conducted on OpenVLA-OFT and $\pi_0$ -FAST backbones, fine-tuned on the LIBERO suite (specifically libero_object_temp_x0.1 and libero_spatial_temp_x0.1).

Safety Guarantees: At a target violation rate $\epsilon = 0.05$ , the conditional CRC bound holds on 86% of bootstrap splits for libero_object and 83% for libero_spatial.
Performance: With the learned predictor, BOKBO achieves 78% coverage and 70% net task success on libero_object, recovering 87% of the oracle safety improvement.
Mondrian Variant: The per-task variant raises the minimum per-task conditional hold from 0.71 (global) to 0.93, significantly improving reliability on high-risk tasks like "ketchup" and "milk."
Distribution Shift: The bounds hold under four within-suite distribution shifts (temperature, object, and cross-suite shifts) but degrade when the action-noise level $\sigma$ shifts outside the calibrated range.
Architecture Specificity: The learned predictor is policy-specific; a predictor trained on OpenVLA-OFT data fails when applied directly to $\pi_0$ -FAST (conditional hold drops to 0.42), necessitating backbone-specific calibration.

Significance and Claims
The paper claims three primary contributions:

Formal Guarantees: BOKBO provides the first formal, finite-sample, distribution-free abstention guarantee for $K$ -sample VLA inference, enabling systems to refuse unsafe actions rather than silently failing.
Structural Diagnosis: The work exposes a fundamental flaw in relying on "free" signals for safety in perturbation-based sampling. It clarifies that such signals track the perturbation mechanism rather than policy uncertainty, a distinction that is critical for designing reliable robot controllers.
Methodological Correction: The paper corrects a pitfall in safety evaluation by demonstrating that global force thresholds are insufficient for manipulation tasks, proposing a per-task expert calibration method that yields realistic violation rates.

Limitations
The authors note that all experiments are currently conducted in MuJoCo simulation. Real-world deployment requires validating the transfer of per-task force thresholds to physical robots and integrating runtime force monitoring. Additionally, the method requires per-task expert demonstrations (25 per task) for calibration and is currently limited to the LIBERO family of benchmarks and specific VLA backbones.