# Does Adding a Safety Filter to VLA Models Actually Work at Scale?

A new safety filtering framework from Caltech researchers lifts collision avoidance rates for the π0.5 [vision-language-action model](https://humanoidintel.ai/glossary/vision-language-action-model) from 23.1% to 91.2% on the SafeLIBERO benchmark — without any retraining of the underlying policy. That 68-percentage-point jump, reported today in arXiv preprint 2609.22462 by Meg Wilkinson, Emily Fourney, Joel W. Burdick, and Aaron D. Ames, is the most concrete published evidence yet that formal safety methods can be retrofitted onto large learned manipulation policies at deployment time.

The framework, called Vision-Language-Poisson-Safe Actions (VLPSA), wraps any VLA policy in a Control Barrier Function-based safety filter synthesized online from perception data. Critically, it does not require access to the policy's weights, training data, or internal representations — making it architecture-agnostic. The authors also report that VLPSA surpasses the task success rate of the base π0.5 policy on SafeLIBERO, meaning the safety filter does not come at a productivity cost on this benchmark.

Real-world validation was conducted on a Franka FR3 manipulator operating in cluttered scenes with dynamic obstacles and human interference, demonstrating real-time full-body safety during manipulation tasks.

---

## The Core Problem: VLA Policies Have No Collision Guarantees

The deployment gap for [Physical Intelligence (π)](https://humanoidintel.ai/companies/physical-intelligence)'s π0.5 and comparable VLA models is well understood inside the field: these models generalize impressively across tasks but provide zero formal safety guarantees. A policy trained on thousands of demonstration trajectories has learned to avoid obstacles statistically — but "statistically safe" is not the same as "certifiably safe," and the distribution shift problem means performance degrades in novel cluttered environments.

This is not a minor operational concern. For humanoid and manipulation platforms deployed in facilities with human co-workers, insurance underwriters and regulatory bodies need collision avoidance guarantees that probabilistic policies cannot provide. The gap between "usually doesn't hit things" and "will not hit things" is where commercial deployment stalls.

The VLPSA paper attacks this gap directly using Control Barrier Functions (CBFs), a mathematical tool from nonlinear control theory that enforces hard safety constraints on a system's state trajectory. The novelty here is not CBFs themselves — those have been used in robotics for years — but the synthesis pipeline that generates Poisson Safety Functions (PSFs) online from real-time perception data and composes them into a CBF-QP (Quadratic Program) safety filter fast enough for real-time operation.

---

## How VLPSA Works: Poisson Functions, Dual Resolution, and Full-Body Coverage

The technical architecture has three distinct components worth understanding separately.

**Poisson Safety Function synthesis:** Rather than pre-computing signed distance fields or relying on known environment geometry, VLPSA synthesizes PSFs online from perception data. This is what enables operation outside of training distributions — the safety representation is built fresh from what the robot's sensors actually see, not from a map that was valid during training.

**Dual-resolution Boolean CBF composition:** Real-time deployment creates a fundamental tension between spatial resolution and computational cost. The authors resolve this by combining two resolutions of the PSF using Boolean CBF compositions. Coarse resolution handles global scene geometry efficiently; fine resolution is applied where it matters most — in critical task regions where the manipulator or grasped object is near workspace boundaries or obstacles.

**Full-body and grasped-object coverage:** This is the detail that separates VLPSA from simpler end-effector-only safety approaches. The CBF-QP filter is enforced over the full kinematic chain and — notably — any object grasped by the robot, which is treated as an extension of the final link. This matters enormously for [dexterous manipulation](https://humanoidintel.ai/glossary/dexterous-manipulation) tasks where a long or irregularly shaped object in the gripper creates collision geometry that a link-only filter would miss entirely.

---

## Benchmark Results: SafeLIBERO Performance

The numbers on SafeLIBERO are striking. The base π0.5 policy achieves 23.1% collision avoidance — meaning it hits something in roughly three out of four trials. VLPSA brings that to 91.2%, and the authors report VLPSA also exceeds the base policy's task success rate on the same benchmark.

**A note of analytical caution:** SafeLIBERO is a specific benchmark, and benchmark performance does not always transfer linearly to uncontrolled deployment. The paper does include real-hardware validation on a Franka FR3 with dynamic obstacles and human interference, which strengthens the case considerably — but the FR3 is a 7-DOF fixed-base manipulator, not a full humanoid. Extrapolating these results to a mobile bipedal platform with whole-body dynamics and a moving base adds substantial complexity that remains untested in this work. The real-time constraint on a humanoid with significantly more [degrees of freedom](https://humanoidintel.ai/glossary/degrees-of-freedom) will stress the CBF-QP solver in ways a fixed manipulator never encounters.

The comparison against "safety-filtering baselines" is also worth scrutinizing: the paper reports VLPSA achieves the highest collision avoidance rate among evaluated methods, but the specific baselines compared are not detailed in the abstract. Understanding which methods they outperformed — and by what margins — matters for contextualizing this claim.

---

## Industry Trajectory: Why This Architecture Matters for Humanoids

The broader significance of VLPSA is architectural, not just numerical. The humanoid industry is converging on a [sim-to-real transfer](https://humanoidintel.ai/glossary/sim-to-real-transfer) + VLA stack as the dominant paradigm for general manipulation. Companies from [Figure AI](https://humanoidintel.ai/companies/figure-ai) to [Agility Robotics](https://humanoidintel.ai/companies/agility-robotics) to [Skild AI](https://humanoidintel.ai/companies/skild-ai) are building or integrating large learned policies. None of those policies ship with formal collision certificates.

If the VLPSA approach generalizes — and the architecture-agnostic, no-retraining property makes it commercially plausible — it slots into the deployment stack as a safety shim between the VLA policy and motor commands. That's an attractive position: you don't need to convince the policy provider to retrain, you don't need access to weights, and you can update the safety layer independently as the operating environment changes.

The grasped-object extension to the kinematic chain is particularly relevant for humanoid [whole-body control](https://humanoidintel.ai/glossary/whole-body-control) frameworks. When a humanoid carries a tool or payload, its effective collision geometry changes dynamically in ways that most current safety systems ignore.

The remaining open question is compute budget. CBF-QPs are fast, but synthesizing PSFs online from perception data at the update rates required for a fast-moving humanoid in a dynamic environment is a harder problem than doing so for a slow fixed-base arm. The next critical validation step is porting this framework to a full bipedal platform and measuring latency under worst-case scene complexity.

---

## Key Takeaways

- **VLPSA lifts π0.5 collision avoidance from 23.1% to 91.2%** on SafeLIBERO without any policy retraining — a 68-percentage-point improvement.
- **The framework is architecture-agnostic** — it wraps any VLA policy as a deployment-time safety filter, requiring no access to weights or training data.
- **Full-body and grasped-object coverage** is enforced via CBF-QP, addressing a gap that end-effector-only safety methods miss.
- **Real-hardware validation on a Franka FR3** with dynamic obstacles and human interference demonstrates real-time viability for fixed-base manipulation.
- **The key open question is humanoid scalability** — FR3 results do not automatically transfer to mobile bipedal platforms with higher DOF counts and whole-body dynamics.
- **Authors:** Meg Wilkinson, Emily Fourney, Joel W. Burdick, Aaron D. Ames (Caltech).

---

## Frequently Asked Questions

**What is VLPSA and what does it do?**
VLPSA (Vision-Language-Poisson-Safe Actions) is a safety filtering framework that wraps VLA manipulation policies to enforce collision avoidance at deployment time. It synthesizes Poisson Safety Functions from real-time perception data and enforces them as Control Barrier Functions over the robot's full kinematic chain, including any grasped object, without requiring policy retraining.

**How much does VLPSA improve collision avoidance?**
On the SafeLIBERO benchmark, VLPSA raises the collision avoidance rate of the base π0.5 policy from 23.1% to 91.2%. The paper also reports that VLPSA surpasses the base policy's task success rate on the same benchmark.

**Does VLPSA require retraining the VLA model?**
No. VLPSA is designed explicitly as a training-free safety filter. It operates as a layer between the VLA policy's action outputs and motor commands, making it applicable to any VLA architecture without access to weights or training data.

**Has VLPSA been tested on a humanoid robot?**
Not in this paper. Real-hardware validation was conducted on a Franka FR3, a 7-DOF fixed-base manipulator. Generalizing the approach to a full bipedal humanoid with whole-body dynamics represents a significant unsolved engineering challenge.

**Why does grasped-object coverage matter for manipulation safety?**
When a robot grasps an object, that object becomes part of the effective collision geometry. A safety filter that only tracks the robot's links will miss collisions caused by the held object. VLPSA treats any grasped object as an extension of the final robot link, covering this case explicitly.

**What is a Control Barrier Function (CBF) in this context?**
A CBF is a mathematical construct from nonlinear control theory that enforces hard constraints on a system's state — in this case, ensuring the robot's full-body geometry stays outside a collision set. The CBF is enforced by solving a Quadratic Program (QP) that modifies the VLA policy's commanded actions minimally while guaranteeing safety.