💻 computer science

MANIGUARD: A Benchmark and Data Suite for Specification-Grounded Safety Evaluation and Improvement of Robotic Manipulation

This paper introduces ManiGuard, a comprehensive benchmark and data suite that rigorously evaluates and improves the safety of robotic manipulation policies by decoupling safety specifications from task success, utilizing formal runtime monitoring to reveal that while fine-tuning enhances safety, significant gaps persist even with increased data and distribution shifts.

Original authors: Yiyan Peng, Philip Wang, Simon Sinong Zhan, Yiqi Lyu, Zhenyang Ni, Jixin Yan, Fiorelli Wong, Ruochen Jiao, Hang Yin, Xinyu Cao, Huajie Shao, Manling Li, Ruohan Zhang, Qi Zhu

Published 2026-08-19

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Yiyan Peng, Philip Wang, Simon Sinong Zhan, Yiqi Lyu, Zhenyang Ni, Jixin Yan, Fiorelli Wong, Ruochen Jiao, Hang Yin, Xinyu Cao, Huajie Shao, Manling Li, Ruohan Zhang, Qi Zhu

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Robots are learning to do our chores, moving from simple, repetitive motions to complex tasks like clearing a table or organizing a kitchen. This progress relies on "foundation models," a type of artificial intelligence that learns from vast amounts of data to understand language, vision, and movement all at once. These systems are getting better at finishing a job, but a critical question remains: can they do it without causing harm? In the real world, a robot that successfully puts a cup in a cabinet might also knock over a vase, spill a drink, or break a fragile object while getting there. For robots to move from research labs into our homes, we need to know not just if they succeed, but if they succeed safely. This requires a way to measure safety that is as precise as the measure of success, checking every move against a clear set of rules rather than just looking at the final result.

A team of researchers has introduced a new framework called ManiGuard to answer this question. They built a rigorous testing ground that treats safety as a separate, non-negotiable goal, independent of whether the robot finishes the task. Instead of relying on human observers to guess if a robot was safe, or on AI judges that might be biased, the researchers used a formal, mathematical system to define safety rules. They translated these rules into a set of logical constraints, such as "the jar must remain closed until it is lifted" or "do not touch the food while cleaning the pot." As the robot moves in a high-fidelity simulation, a digital monitor checks every single step against these rules in real time. If the robot bumps into something it shouldn't or drops an object, the system flags the violation immediately, regardless of whether the robot eventually completed its main job.

The researchers organized two hundred different household tasks into six categories, ranging from simple pick-and-place actions to complex, multi-step chores involving drawers and stacked dishes. For each task, they created a specific safety rule that was orthogonal to the goal, meaning a robot could technically finish the task while still breaking the safety rule. They then tested several advanced AI policies on these tasks, first without any special training and then after training them on a new dataset. This dataset was unique because it was built using the same safety monitor; the researchers collected thousands of demonstrations where robots successfully completed tasks without ever violating a safety rule, creating a library of "safe" behavior for the AI to learn from.

The results revealed a stark reality about current robotic intelligence. When tested without training, the robots rarely engaged with the tasks at all, often choosing to do nothing rather than risk a mistake. When they did act, they were frequently unsafe. Even after training on the safe demonstrations, the robots improved significantly, but a large gap remained. The researchers found that between six and twenty-one percent of the successful tasks were actually unsafe; the robots reached their goals but violated safety rules along the way. Furthermore, two robots with nearly identical success rates could have vastly different safety records, proving that finishing a job does not guarantee doing it safely.

Training the robots on the new safety-annotated data helped, raising the rate of safe task completion from near zero to between seven and thirty percent. However, the researchers discovered that simply adding more of the same safe demonstrations did not solve the problem. When the robots faced slight changes in the environment, such as a different background or a moved object, their safety performance dropped. Some tasks, particularly those involving drawers or delicate stacking, remained extremely difficult, with safe success rates staying below two percent for every policy tested. The study also showed that while the simulation results generally predicted which robots were safer, the exact frequency of accidents did not always match what happened on a physical robot, suggesting that simulation is a useful guide but not a perfect crystal ball.

Ultimately, the work demonstrates that safety is a distinct challenge that cannot be solved by just making robots better at finishing tasks. The researchers showed that current AI models do not yet fully understand the physical constraints of the world or the specific safety rules they are given. While fine-tuning on carefully curated, safe data helps, it is not a silver bullet. The persistent failures, even after training, indicate that future progress will require new methods to teach robots not just what to do, but how to do it without breaking the rules of the physical world. The ManiGuard framework provides the tools to measure this progress rigorously, offering a clear path forward for developing robots that are not just capable, but truly safe.

Technical Summary: ManiGuard

Problem Statement

Foundation-model policies for robotic manipulation have demonstrated rapid progress in task success and generalization across diverse scenes and embodiments. However, rigorous evaluation of whether these systems succeed safely remains lacking. Existing benchmarks primarily measure task completion or rely on learned classifiers and Large Language Models (LLMs) to judge safety, which often fail to capture contact-rich, trajectory-level physical hazards. Furthermore, current safety evaluations often conflate task success with safety, failing to recognize that a policy can complete a task while violating safety constraints (e.g., spilling, tipping, or colliding) or appear safe simply by remaining inert. The paper argues that physical safety failures in nominal, open-world scenarios require physics-grounded, specification-driven evaluation that is orthogonal to task success.

Methodology

The authors introduce ManiGuard, a specification-grounded framework comprising a benchmark suite (ManiGuard-Bench) and a paired data generation pipeline.

1. ManiGuard-Bench

Task Design: The benchmark organizes 200 locked base tasks across six contact-rich household manipulation families (Clutter, Cabinet, Lid, Stack, Jar, Dusty). These are structured along a skill × constraint taxonomy, combining three skill levels (pick-and-place, articulated-object interaction, long-horizon) with two formal constraint classes (spatial invariants and temporal ordering).
Safety Orthogonality: Crucially, safety is specified independently of task success. A policy can succeed unsafely, fail safely, or satisfy both.
Formal Specifications: Safety requirements are defined as Linear Temporal Logic on finite traces (LTLf) formulas over physics-grounded predicates (e.g., dropped, spilled, intact, upright). These are compiled into Deterministic Finite Automata (DFA) that act as runtime monitors.
Evaluation Protocol:
- Runtime Monitoring: Instead of learned judges, the DFA monitors consume simulator states step-by-step to emit categorical safety labels (safe/violation).
- Distribution Shifts: Each base task is evaluated under one in-distribution (ID) condition and four single-axis out-of-distribution (OOD) perturbations: target appearance, instruction language, object location, and environment background. The safety specification $\phi$ remains fixed across all shifts.
- Metrics: The framework defines four outcome classes: Safe-Success (SSR), Unsafe-Success, Safe-Unsuccess, and Unsafe-Unsuccess. It introduces Engagement-Aware metrics (e.g., Safe | Eng.) to distinguish policies that are safe because they act safely versus those that are safe because they never engage with the task.
- Sim-to-Real: Evaluation is performed in Isaac Sim/OmniGibson with PhysX-based contact and fluid dynamics, and validated on a physical Franka Panda platform under matched conditions.

2. Safety-Annotated Trajectory Generation Pipeline

To support improvement (fine-tuning), the authors provide a pipeline to generate safety-annotated demonstrations:

Dual Sources: Trajectories are generated via an automated cuRobo motion planner and human teleoperation (using GELLO or SO-101 leader arms).
Unified Annotation: Both sources share the same execution substrate and are filtered/annotated by the same LTLf runtime monitor used for evaluation.
Output: Only trajectories that complete the task and satisfy the safety specification are retained. This yields 8,000 safety-annotated demonstrations (40 per base task) in a joint-native LeRobot format.

Key Contributions

ManiGuard-Bench: A safety-centric benchmark with 200 tasks organized by a skill × constraint taxonomy, featuring LTLf specifications checked by automaton-based runtime monitors. It includes 1,000 locked evaluation scenarios (ID + 4 OOD axes) and extends to physical robot evaluation.
Safety-Annotated Data Suite: A trajectory-generation pipeline producing 8,000 demonstrations where safety is guaranteed by construction via the same monitor used for evaluation. This enables supervised fine-tuning (SFT) for safety-aware behavior.
Systematic Evaluation of Failure Modes: A large-scale benchmarking study (23,000+ rollouts) of zero-shot and fine-tuned Vision-Language-Action (VLA) models, identifying consistent failure modes and the limitations of current scaling approaches.

Experimental Results

The authors evaluated state-of-the-art VLAs ( $\pi_0$ , $\pi_{0.5}$ , GR00T N1.6, SmolVLA) on ManiGuard-Bench:

Safety vs. Success: Task success does not imply safety. Between 6–21% of successful rollouts from fine-tuned policies violated safety specifications. Conversely, zero-shot policies appeared "safe" (77–83% safe rate) largely due to vacuous safety (never engaging with the task), with actual engaged-and-safe rates as low as 16%.
Impact of Fine-Tuning: Fine-tuning on the safety-annotated suite substantially improved safety. Safe task completion (SSR) rose from near zero to 7.5–29.8%, and engaged-and-safe behavior increased from 16–40% to 51–72%.
Persistent Gaps: Despite fine-tuning, a substantial safety gap remains:
- 21–42% of engaged rollouts still violated specifications.
- Two task families (Cabinet, Dusty) remained below 2% safe success for all policies.
- Safety performance degraded under single-axis distribution shifts (e.g., object appearance or language changes), even when the safety specification $\phi$ was fixed.
- Simply scaling the number of demonstrations (8 to 40) did not close the gap for difficult contact-rich tasks (e.g., Cabinet), suggesting a need for different data types rather than just more data.
Sim-to-Real: Simulated and physical results showed strong correlation in task success and safe success rankings ( $r \approx 0.88–0.91$ ), but weak correlation in violation rates ( $r \approx 0.09$ ). However, specific unsafe behaviors (e.g., knocking objects over) were observed in both domains.

Significance and Claims

The paper claims that ManiGuard provides a rigorous, specification-grounded interface for evaluating and improving robotic safety. Its primary significance lies in:

Decoupling Safety from Success: Demonstrating that safety must be evaluated as a first-class objective independent of task completion.
Actionable Diagnostics: The use of automaton monitors allows for per-step, per-constraint violation reporting, making safety failures actionable for data collection and training rather than just aggregate metrics.
Limitations of Current Scaling: The results suggest that current foundation models do not yet robustly ground their behavior in stated safety constraints or physical configurations. Scaling the same type of demonstrations does not automatically resolve safety gaps in contact-rich, long-horizon tasks.
Foundation for Future Work: By releasing the benchmark, specification library, and trajectory-generation pipeline, the authors aim to support future research into specification-aware data collection, constraint-aware learning, and more comprehensive safety evaluation.

The authors maintain a modest tone regarding real-world deployment, noting that their physical evaluation is an initial study of sim-to-real transfer with approximate scene matching, and that the current taxonomy does not exhaust all possible manipulation tasks or hazards.