SafeBranch Pairs Safe Forks from Identical States, Raising IS-Bench Safe Success Rate from 0.031 to 0.281

Embodied agents may complete a task while leaving a stove on, contaminating food, or touching an electrical outlet with wet hands. SafeBranch’s central observation is that safety is usually not an average property of an entire trajectory; rather, it is determined by a small number of “safety-critical steps.” Conventional SFT only demonstrates safe trajectories without identifying which action should be avoided in the same state, while trajectory-level DPO entangles safety signals with differences such as path length and task progress.

The new method first allows a base VLM agent to execute tasks autonomously. After a violation occurs, a GPT-4o critic identifies the decision point that caused the hazard, either prospectively or retrospectively. The environment then rolls back to that state, and the original agent generates a safe alternative action with a brief corrective prompt. The system subsequently removes the prompt and reattaches the safe and unsafe outputs to the exact same context, forming a branch pair. After a judge filters out samples that are not executable, depend on additional information, or fail to preserve task progress, BranchPO increases the probability of the safe branch relative to the hazardous branch.

Experiments using Qwen3-VL-8B as the actor show that the safe success rate in the original IS-Bench environment rose from 0.031 to 0.281, while the standard task success rate fell from 0.656 to 0.594. This indicates a substantial safety gain, though not without some cost to task utility. Across two out-of-distribution variants, BranchPO achieved safe success rates of 0.355 and 0.469, respectively. When transferred across simulators to SafetyALFRED, overall accuracy across five hazard categories increased from 0.274 to 0.438. At deployment, the model no longer required a critic, step-by-step self-verification, or lookahead search.

The engineering value of this work lies in shifting expensive safety judgments to the data-construction stage and directly converting sparse causal decision points into preference samples. However, SafeBranch has not yet been released as a standalone library, and all results come from simulated environments. Although IS-Bench provides 161 scenarios and 388 risk types, it still cannot cover the perception errors, control latency, and physical damage encountered by real-world robots. The next step is to determine whether branch pairs can be constructed using a smaller or formal critic, and whether safety and task completion rates can still be maintained on physical VLA controllers.