-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathindex.html
More file actions
363 lines (333 loc) · 20 KB
/
Copy pathindex.html
File metadata and controls
363 lines (333 loc) · 20 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
<title>TAIL-Safe — Task-Agnostic Safety Monitoring for Imitation Learning Policies</title>
<meta name="description" content="TAIL-Safe (RSS 2026) is a task-agnostic safety filter for imitation-learning policies. It learns a Lipschitz-continuous reach-avoid Q-function over a Gaussian-Splatting digital twin and recovers from failure on a real Franka.">
<meta property="og:title" content="TAIL-Safe — Task-Agnostic Safety Monitoring for Imitation Learning Policies (RSS 2026)">
<meta property="og:description" content="A reach-avoid safety filter for flow-matching and diffusion policies, with Lipschitz guarantees, evaluated on a Franka Emika robot.">
<meta property="og:image" content="assets/images/overall_diagram.png">
<meta property="og:type" content="website">
<link rel="stylesheet" href="assets/css/style.css">
<link rel="preconnect" href="https://fonts.googleapis.com">
<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
<link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&family=Source+Serif+4:opsz,wght@8..60,400;8..60,500;8..60,600;8..60,700&family=JetBrains+Mono:wght@400;500&display=swap" rel="stylesheet">
</head>
<body>
<!-- ====================== TITLE ====================== -->
<header class="titleblock">
<div class="wrap">
<div class="venue">Robotics: Science and Systems · 2026</div>
<h1>
TAIL-Safe: Task-Agnostic Safety Monitoring<br>for Imitation-Learning Policies
</h1>
<p class="authors">
<span class="a">Riad Ahmed</span><sup>1</sup>
·
<span class="a">Momotaz Begum</span><sup>1</sup>
</p>
<p class="affil"><sup>1</sup>Department of Computer Science, University of New Hampshire</p>
<div class="btnrow">
<a class="btn" href="paper/TAIL_Safe_camera_ready.pdf" target="_blank" rel="noopener">
<span class="ico">📄</span> Paper
</a>
<a class="btn outline" href="https://github.com/riadahmedunh/tail_safe" target="_blank" rel="noopener">
<span class="ico">⌨</span> Code
</a>
<a class="btn outline" href="#videos">
<span class="ico">▷</span> Videos
</a>
<a class="btn outline" href="#bibtex">
<span class="ico">❝</span> BibTeX
</a>
</div>
</div>
</header>
<!-- ====================== TEASER ====================== -->
<section id="teaser" style="padding-top:48px">
<div class="wrap">
<figure class="teaser">
<img src="assets/images/overall_diagram.png" alt="Overview of TAIL-Safe pipeline">
<figcaption>
<strong>Figure 1.</strong> A Gaussian-Splatting digital twin (left) is built from a five-minute capture and reconstructed offline.
Inside the twin we sweep an imitation-learning policy under perturbations, collecting safe and unsafe rollouts that train a Lipschitz reach-avoid <i>Q</i>-function and a fusion network over three short-horizon, task-agnostic criteria.
At deployment, TAIL-Safe sits between the policy and the robot: while the predicted safety value remains positive it forwards the policy action; when the value approaches zero it performs gradient ascent on <i>Q</i> to bring the system back into the empirical safe set.
</figcaption>
</figure>
</div>
</section>
<!-- ====================== ABSTRACT ====================== -->
<section id="abstract">
<div class="wrap">
<p class="section-kicker">Abstract</p>
<h2>An imitation-learning policy that knows when it is about to fail.</h2>
<p class="lede">
Modern visuomotor policies — flow-matching, diffusion, ACT — are remarkably capable on the trajectories they were trained on
and remarkably brittle outside of them. Field deployment requires more than higher accuracy: it requires the policy to <em class="term">recognize</em>
when it has wandered to a state from which the demonstrations no longer apply, and to do something sensible about it.
</p>
<p>
TAIL-Safe attaches a <em class="term">task-agnostic safety filter</em> to any deterministic imitation-learning policy. We train a Lipschitz-continuous,
reach-avoid <i>Q</i>-value function whose zero-superlevel set is an <em class="term">empirical control-invariant set</em> — the region of state-action
space from which the underlying policy reliably succeeds. The function is learned from rollouts inside a Gaussian-Splatting reconstruction of the
workspace, scored along three short-horizon criteria — <em class="term">visibility</em>, <em class="term">recognizability</em>, and
<em class="term">graspability</em> — that are agnostic to the manipulation task. At run time, when the nominal policy action would leave the safe set,
a Nagumo-inspired controller performs bounded gradient ascent on <i>Q</i> until the system re-enters it. On a Franka Emika robot, base flow-matching
policies that fail under modest perturbations finish their tasks consistently when guided by TAIL-Safe, and detected unsafe states are caught roughly
twenty milliseconds before failure on average.
</p>
</div>
</section>
<!-- ====================== METHOD ====================== -->
<section id="method">
<div class="wrap method-prose">
<p class="section-kicker">Method</p>
<h2>What can fail, where it can fail, and how to step away from the cliff.</h2>
<p>
A safety monitor is only useful if it can be trained without endangering the real robot, and if it generalises beyond the specific task it observed.
TAIL-Safe addresses both points by separating the learning problem from the task it ultimately protects.
</p>
<p>
<strong>A photo-real digital twin as a free safety simulator.</strong>
A short five-minute capture of the workspace is reconstructed into a Gaussian-Splatting scene; segmented object Gaussians are then rigidly
pose-updated from a wrist-mounted RGB-D stream at ten hertz. The twin gives us a renderable, physics-faithful environment in which we can
perturb the policy and harvest unsafe trajectories that we would never deliberately execute on a real arm.
</p>
<p>
<strong>Three task-agnostic criteria, instead of a hand-crafted reward.</strong>
At every step we score the state along three lightweight signals that remain meaningful across manipulation tasks:
<em class="term">visibility</em> (does the target lie in the wrist camera's field of view?),
<em class="term">recognizability</em> (does the rendered object embedding match the reference DINOv2 prototype, in Mahalanobis distance?), and
<em class="term">graspability</em> (do antipodal grasp candidates exist near the predicted end-effector pose?). A small fusion network — WeightNet —
learns when each criterion matters: visibility dominates during approach, graspability near contact, and so on.
</p>
<p>
<strong>A Lipschitz reach-avoid <i>Q</i>-function.</strong>
We then train a single state-action value function on rollouts collected in the twin, using a reach-avoid Bellman operator and an
energy-shaping loss that prevents the value landscape from flattening. Spectral-norm regularisation gives the network a Lipschitz constant
that is small enough to support a closed-form recovery step, but large enough to sharply separate safe from unsafe regions.
</p>
<p>
<strong>Recovery as gradient ascent on the safety landscape.</strong>
When the nominal action would push the system across the zero level-set of <i>Q</i>, we replace it with a bounded gradient-ascent step on the
same function — a discrete Nagumo-tangentiality update — and continue executing the policy from the corrected state. The loop runs at
350 Hz on a single GPU and converges in fewer than three iterations on average.
</p>
<div class="figpair">
<figure>
<div class="imgwrap"><img src="assets/images/weights.png" alt="Learned WeightNet weights"></div>
<figcaption><strong>Figure 2.</strong> Learned criterion weights along a pick-and-place trajectory. WeightNet shifts emphasis from visibility during the approach phase to graspability near contact, then rebalances at completion.</figcaption>
</figure>
<figure>
<div class="imgwrap"><img src="assets/images/trajectory_grid.png" alt="2D Q-value landscapes"></div>
<figcaption><strong>Figure 3.</strong> Two-dimensional slices of the learned <i>Q</i>-function around expert actions. The function forms a bounded "hill" of safety with a clean negative exterior, exactly the structure required for recovery.</figcaption>
</figure>
</div>
<figure class="fig-single">
<div class="imgwrap"><img src="assets/images/Landscape_value_sujosh.png" alt="3D safety landscape"></div>
<figcaption><strong>Figure 4.</strong> The three-dimensional value landscape over the workspace. The zero-superlevel set defines an empirical control-invariant safe set; crossing its boundary is a reliable predictor of imminent task failure.</figcaption>
</figure>
</div>
</section>
<!-- ====================== RESULTS ====================== -->
<section id="results">
<div class="wrap results-prose">
<p class="section-kicker">Experiments</p>
<h2>Real-robot results on a Franka Emika and 270 perturbed rollouts in the twin.</h2>
<p class="lede">
We evaluate TAIL-Safe on two physical manipulation tasks — Candy Pick and Pick-and-Place — and on a controlled set of perturbed rollouts inside the
Gaussian-Splatting twin. We protect a base flow-matching policy and ask three questions: does the safety filter <em class="term">predict</em> failure
before it happens, does the recovery controller <em class="term">restore</em> task progress, and does the protected policy <em class="term">complete</em>
tasks it would otherwise abandon?
</p>
<div class="headline">
<div class="h">
<div class="v">99.3%</div>
<div class="k">trajectory-level AUROC of the learned <i>Q</i>-function on held-out rollouts.</div>
</div>
<div class="h">
<div class="v">100%</div>
<div class="k">recovery success rate with energy-shaped training (vs. 20% without).</div>
</div>
<div class="h">
<div class="v">≈ 23 ms</div>
<div class="k">average detection latency before the underlying policy would have failed.</div>
</div>
</div>
<h3>Calibration of the safety predictor.</h3>
<p>
On 270 held-out rollouts in the twin, the trajectory-level AUROC of <i>Q</i> reaches 0.993, with a per-state AUROC of 0.962. WeightNet
separates safe and unsafe trajectories with effect size Cohen's <i>d</i> = 0.93, against 0.29 for an instantaneous heuristic.
Crucially, the empirically measured Lipschitz constant of the trained network is 2.31, comfortably below the theoretical bound of 2.5
enforced during training, which is what makes the closed-form recovery step well-posed.
</p>
<h3>Recovery on the real Franka.</h3>
<p>
We perturb the robot online either by physically pushing the end-effector or by injecting SpaceMouse commands. Without the filter, the base
flow-matching policy fails on every interrupted episode. With TAIL-Safe attached, the policy completes the task on every recoverable episode in our
study, with an average of 2.3 recovery iterations per intervention and no observable degradation in nominal task time.
</p>
<h3>Detection of out-of-distribution states.</h3>
<p>
We deliberately drive the policy into severe OOD configurations on the real arm: camera occlusion, large object displacement, scene additions not
present in any demonstration. In every such configuration the predicted <i>Q</i>-value crosses zero before the policy would have completed an unsafe
action, and the recovery controller is triggered.
</p>
<div class="tblwrap">
<table class="tbl">
<caption><strong>Table 1.</strong> Headline performance on the digital-twin evaluation set, averaged over 270 perturbed rollouts. Best row in <strong>bold</strong>.</caption>
<thead>
<tr><th>Method</th><th class="num">Traj. AUROC</th><th class="num">State AUROC</th><th class="num">Recovery</th><th class="num">Latency</th></tr>
</thead>
<tbody>
<tr><td>Equal-weight criteria</td><td class="num">0.437</td><td class="num">0.514</td><td class="num">—</td><td class="num">—</td></tr>
<tr><td>WeightNet only (no recovery)</td><td class="num">0.971</td><td class="num">0.928</td><td class="num">—</td><td class="num">—</td></tr>
<tr><td><i>Q</i>-function, no energy shaping</td><td class="num">0.984</td><td class="num">0.943</td><td class="num">20%</td><td class="num">15 ms</td></tr>
<tr class="best"><td>TAIL-Safe (full)</td><td class="num">0.993</td><td class="num">0.962</td><td class="num">100%</td><td class="num">23 ms</td></tr>
</tbody>
</table>
</div>
<div class="figpair">
<figure>
<div class="imgwrap"><img src="assets/images/recovery_real_robot.png" alt="Real-robot recovery sequence"></div>
<figcaption><strong>Figure 5.</strong> A representative real-robot recovery: the operator perturbs the end-effector mid-trajectory; the safety filter triggers, gradient ascent on <i>Q</i> brings the arm back into the safe set, and the policy resumes without an explicit reset.</figcaption>
</figure>
<figure>
<div class="imgwrap"><img src="assets/images/extreme_cases.png" alt="Extreme out-of-distribution cases"></div>
<figcaption><strong>Figure 6.</strong> Severe out-of-distribution scenes on the real arm. The base policy diverges; TAIL-Safe correctly flags these states as unsafe in real time and refuses to execute the nominal action.</figcaption>
</figure>
</div>
</div>
</section>
<!-- ====================== VIDEOS ====================== -->
<section id="videos">
<div class="wrap">
<p class="section-kicker">Videos</p>
<h2>How it looks on the robot.</h2>
<p class="lede">
A short overview is followed by real-robot recovery from human and teleoperated interruption, two extreme out-of-distribution scenes, and a small
set of rollouts collected entirely inside the Gaussian-Splatting twin that are used to train the safety predictor.
</p>
<div class="video-block">
<h3>System overview</h3>
<p class="desc">A compiled walkthrough of the pipeline — from digital-twin construction to closed-loop recovery on the real Franka.</p>
<div class="video-row">
<div class="vcard featured">
<video src="videos/TAIL_Safe_demo.mp4" controls preload="metadata" playsinline></video>
<div class="vmeta">
<h4>TAIL-Safe — full system demo</h4>
<p>End-to-end overview, from the Gaussian-Splatting capture to live recovery on the real arm.</p>
</div>
</div>
</div>
</div>
<div class="video-block">
<h3>Recovery from interruption (real Franka)</h3>
<p class="desc">The base policy is interrupted mid-task. The safety filter detects the unsafe state, the recovery controller steers the end-effector back into the safe set, and the policy resumes without an explicit reset.</p>
<div class="video-row">
<div class="vcard">
<video src="videos/realrobot_recovery_human_interruption.mp4" controls preload="metadata" playsinline></video>
<div class="vmeta">
<h4>Manual interruption by the operator</h4>
<p>The operator physically perturbs the end-effector; the protected policy completes the task.</p>
</div>
</div>
<div class="vcard">
<video src="videos/realrobot_recovery_spacemouse_interruption.mp4" controls preload="metadata" playsinline></video>
<div class="vmeta">
<h4>SpaceMouse teleoperation injected mid-trajectory</h4>
<p>The robot is pushed off-trajectory through teleoperation; TAIL-Safe brings it back.</p>
</div>
</div>
</div>
</div>
<div class="video-block">
<h3>Extreme out-of-distribution cases</h3>
<p class="desc">Configurations far outside the demonstration distribution. The base policy diverges; TAIL-Safe flags the unsafe state in real time.</p>
<div class="video-row">
<div class="vcard">
<video src="videos/extreme_fail_realrobot_0.mp4" controls preload="metadata" playsinline></video>
<div class="vmeta">
<h4>OOD scene A</h4>
<p>The base policy diverges; the safety predictor crosses zero before contact.</p>
</div>
</div>
<div class="vcard">
<video src="videos/extreme_fail_realrobot_2.mp4" controls preload="metadata" playsinline></video>
<div class="vmeta">
<h4>OOD scene B</h4>
<p>A second extreme configuration; the unsafe state is correctly flagged.</p>
</div>
</div>
</div>
</div>
<div class="video-block">
<h3>Data collection inside the Gaussian-Splatting twin</h3>
<p class="desc">Successful and intentionally failed rollouts collected inside the photo-real twin, used to train WeightNet and the reach-avoid <i>Q</i>-function. No physical robot is required for this stage.</p>
<div class="video-row">
<div class="vcard">
<video src="videos/simulation_success_pick_place_data_collection_in_GS.mp4?v=2" controls preload="metadata" playsinline muted></video>
<div class="vmeta">
<h4>Successful rollout 1</h4>
<p>Nominal pick-and-place inside the twin.</p>
</div>
</div>
<div class="vcard">
<video src="videos/simulation_success_pick_place_data_collection_in_GS_2.mp4?v=2" controls preload="metadata" playsinline muted></video>
<div class="vmeta">
<h4>Successful rollout 2</h4>
<p>±5 cm variation in object placement.</p>
</div>
</div>
<div class="vcard">
<video src="videos/simulation_success_pick_place_data_collection_in_GS_3.mp4?v=2" controls preload="metadata" playsinline muted></video>
<div class="vmeta">
<h4>Successful rollout 3</h4>
<p>±30° variation in object orientation.</p>
</div>
</div>
<div class="vcard">
<video src="videos/simulation_success_pick_place_data_collection_in_GS_failure.mp4?v=2" controls preload="metadata" playsinline muted></video>
<div class="vmeta">
<h4>Failure rollout (unsafe class)</h4>
<p>An intentionally failed trajectory used to label the unsafe region of state-action space.</p>
</div>
</div>
</div>
</div>
</div>
</section>
<!-- ====================== BIBTEX ====================== -->
<section id="bibtex">
<div class="wrap">
<p class="section-kicker">Citation</p>
<h2>If TAIL-Safe is useful in your work, please cite us.</h2>
<div class="bib" id="bibblock"><button class="copybtn" onclick="copyBib()">Copy</button>@inproceedings{ahmed2026tailsafe,
title = {{TAIL}-Safe: Task-Agnostic Safety Monitoring for Imitation Learning Policies},
author = {Ahmed, Riad and Begum, Momotaz},
booktitle = {Proceedings of Robotics: Science and Systems (RSS)},
year = {2026},
}</div>
</div>
</section>
<!-- ====================== FOOTER ====================== -->
<footer>
<div class="wrap">
<p>© 2026 Riad Ahmed and Momotaz Begum, University of New Hampshire.
Page source on <a href="https://github.com/riadahmedunh/tail_safe">GitHub</a>.</p>
</div>
</footer>
<script>
function copyBib(){
var el = document.getElementById('bibblock');
var t = el.innerText.replace(/^Copy\s*/,'').trim();
navigator.clipboard.writeText(t).then(function(){
var b = el.querySelector('.copybtn');
var o = b.innerText; b.innerText='Copied';
setTimeout(function(){b.innerText=o},1500);
});
}
</script>
</body>
</html>