arxiv:2608.17386

MANIGUARD: A Benchmark and Data Suite for Specification-Grounded Safety Evaluation and Improvement of Robotic Manipulation

Published on Aug 18

Authors:

Abstract

ManiGuard introduces a specification-grounded benchmark and pipeline to evaluate and improve safety in foundation-model robotic manipulation, revealing persistent safety gaps despite fine-tuning.

Generated by thinkingmachines/Inkling-Small

Foundation-model policies for robotic manipulation are advancing rapidly on task success, but rigorous evaluation of whether they succeed safely is still lacking. We introduce ManiGuard, a specification-grounded framework for evaluating and improving the safety of foundation-model manipulation, comprising the ManiGuard-Bench task suite and a paired safety-annotated trajectory-generation pipeline. ManiGuard-Bench organizes six contact-rich household task families into 200 locked base tasks along a skill times constraint taxonomy, with safety specified independently of task success. Each task is evaluated under one in-distribution and four single-axis out-of-distribution perturbations that hold the safety specification fixed, giving 1,000 locked scenarios. Every rollout is runtime-checked by LTL_f-grounded automaton monitors over physics-grounded predicates rather than learned classifiers or LLM judges, in simulation and on a physical Franka platform. The pipeline pairs an automated motion-planning generator with human teleoperation, annotated by the same per-step monitor, and directly supports safety-aware fine-tuning; we release 8,000 safety-annotated demonstrations, 40 per base task. Benchmarking zero-shot and fine-tuned VLAs across more than 23,000 rollouts, we find: (i) safety must be evaluated independently of task success, as 6-21% of successful rollouts violate the specification; (ii) fine-tuning on our suite raises safe task completion from near zero to 7.5-29.8% and engaged-and-safe behavior from 16-40% to 51-72%; but (iii) a gap remains that scaling demonstrations does not close, with 21-42% of engaged rollouts still violating, two of six families below 2% safe success for every policy, and these failures persisting under distribution shift and on hardware.

View arXiv page View PDF Add to collection

Community

Sattyam

5 days ago

The number in this paper that should travel further than the benchmark is the in-distribution one: 6 to 21 percent of successful rollouts violate the safety specification with nothing perturbed.

That is a benign floor, published, with 23,000 rollouts behind it, and it settles an argument that keeps recurring in the embodied attack literature. Almost every reported attack success rate in this area is quoted with no matched unperturbed arm. If the floor can sit at 21 percent on contact-rich household tasks, then a paper reporting a 40 percent violation rate under attack has reported a delta of unknown sign.

One question for the authors. Does the 6-to-21 range track task family, or does it track a small number of scenarios inside each family? We see the analogous split in our own runs: our benign predicate fires on 5 of 100 episodes and every firing lands on two of ten tasks, which turned out to be a boundary placed incorrectly rather than a policy that wanders. If yours is concentrated the same way, the LTLf monitors may be reading a predicate artifact on a handful of scenarios rather than a uniform base rate, and that distinction changes what the 1,000 locked scenarios mean.