Safe Vision Language Action Models via Barrier Enhanced Flow Matching

Author 1, Author 2, Author 3

The XXXXXXXX University
Submitted to IEEE Robotics and Automation Letters (RA-L)

Our framework modifies the Flow Matching denoising process within the model to inherently generate safe trajectories using a smooth Log-Sum-Exponential aggregate barrier.

Abstract

This article presents a modular inference framework that integrates Vision-Language-Action (VLA) foundation models with formal Control Barrier Function (CBF) safety guarantees. Unlike existing methods that apply external safety filters to a model's final output, our approach modifies the Flow Matching denoising process within the model to inherently generate safe trajectories. By employing a smooth Log-Sum-Exponential aggregate barrier, we enforce safety over entire action chunks without compromising the semantic intent of the generative model. We show that, within the proposed framework, the 2-Wasserstein distance between the generated distribution and the target distribution remains bounded. Our method eliminates the need for safety-specific datasets or costly model retraining, providing a versatile solution for safe VLAs. We validate the approach on two robotic manipulation platforms and a 2D navigation benchmark to verify that our framework achieves reliable safety without degrading the success rate of the baseline model.

Main Method in Nutshell

Rather than filtering a VLA's output after generation, which pushes trajectories out of the model's learned distribution, we embed safety constraints directly into the Flow Matching denoising loop. At each integration step, a Control Barrier Function (CBF) quadratic program adds a minimal corrective perturbation that steers the evolving action chunk toward the safe set. A smooth Log-Sum-Exponential aggregate captures safety across the entire chunk in a single, real-time-solvable constraint. The result is a plug-and-play safety layer that requires no retraining or safety-labeled data, while provably bounding the deviation from the original model's intent.

Hardware Verification on Manipulation Tasks

SO-101 (5-DoF) ‐ Pick and Place

To verify the reliability and efficacy of the framework we repeated the manipulation experiment on two robotic platforms and compared the baseline VLA performance against post-hoc filter (E2E) and our framework (Barrier Enhanced VLA). Each method is repeated at least 20 times and the measured safety rate and success rates are reported. Physical Intelligences PI-0 model is used as the baseline VLA for SO-101 robot (5 DoF + Gripper) and Quanser QArm (4 DoF + Gripper).

No Filter: PI-0

Baseline: E2E-CBF

Proposed: CBF-FM

QArm (4-DoF) ‐ Table Cleanup

No Filter: PI-0

Baseline: E2E-CBF

Proposed: CBF-FM

Performance metrics evaluated across 150+ hardware trials on two robotic platforms, comparing our proposed CBF-FM architecture against baseline models.

Platform	Metric	Base VLA	E2E CBF	CBF-FM (Ours)
SO-101 (5-DoF) Pick-and-Place	Safety Rate (%)	15.0%	68.2%	100.0%
SO-101 (5-DoF) Pick-and-Place	Success Rate (%)	75.0%	68.2%	77.4%
QArm (4-DoF) Table Cleanup	Safety Rate (%)	0.0%	70.0%	100.0%
QArm (4-DoF) Table Cleanup	Success Rate (%)	100.0%	75.0%	100.0%

*Trials included scenarios with objects placed inside and outside of unsafe collision zones. Violation of the safety is not critical to the robot's health and objective, so an unsafe rollout can still end-up being successful which is only a measure of task completion. Based on our experience, CBF-FM matches or exceeds baseline success rate while ensuring zero safety violations across both platforms.

Maze 2D Benchmark

Comparison of planning trajectories across 100 trials per method in a 2D maze with two unseen obstacles. Each column shows five representative rollouts for that method.

No Filter: FM

SafeDiffuser

SafeFlowMatcher

CBF-FM (Ours)

Method	BS1 (≥0)	BS2 (≥0)	Trap (%) ↓	Time (s) ↓	κ ↓	Accel. ↓
FM (no safety)	-0.762	-0.938	0	1.38	97.7±1.5	151.3±4.8
SafeDiffuser	-0.003	-0.003	69	14.41	68.2±90.3	124.5±34.2
SafeFlowMatcher	-0.3031	0.003	12	14.14	75.9±2.9	195.9±22.0
CBF-FM (Ours)	0.109	0.046	0	10.65	7.2±0.4	3.3±0.1

BS1/BS2: barrier safety score for each obstacle (positive = safe). κ: trajectory curvature. Accel.: mean trajectory acceleration. All methods achieve 100% success rate over 100 trials; safety and smoothness metrics differentiate performance.

Generative Model Error Bound and Safety Guarantees

We showed that the semantic intents of the flow matching model is not affected by our safety modifications and the error between the safely generated distribution and the target distribution is bounded in the sense of Wasserstein distance.

Comprehensive safety analysis is provided in the paper and forward invariance of action chunk is guranteed in the denoising time.

Aggregating the min operator (the CBF constraint of the QP) in one constraint reduced the solver time; the smoothness and minimal jerk action chunks are the outcome of velocity bound and smoothing term in cost function.

Joint Velocity Profiles — Effect of safety filter hypperparameters in the safety margin.

Trajectory Smoothing and Velocity Enforcement

Beyond collision avoidance, our formulation enables the direct optimization of the action chunk for physical feasibility. By incorporating a sparse finite-difference matrix D into the barrier function Quadratic Program (QP), we can:

Enforce Joint Velocity Limits: Hard constraints ensure that no joint command exceeds the physical limits of the SO-101 arm, preventing motor saturation.
Optimize for Smoothness: An additional cost term minimizes the difference between consecutive actions, significantly reducing jerky motions and improving the quality of the generated trajectory.

This integrated approach ensures that the "Safe VLA" trajectories are not only collision-free but also dynamically consistent and smooth for real-world execution.