RoboSafe: Safeguarding Embodied Agents via Executable Safety Logic
On the map: LLM agents and tool use → Agent threats, guardrails and governance
Abstract (arXiv)
Embodied agents powered by vision-language models (VLMs) are increasingly capable of executing complex real-world tasks, yet they remain vulnerable to hazardous instructions that may trigger unsafe behaviors. Runtime safety guardrails, which intercept hazardous actions during task execution, offer a promising solution due to their flexibility. However, existing defenses often rely on static rule filters or prompt-level control, which struggle to address implicit risks arising in dynamic, temporally dependent, and context-rich environments. To address this, we propose RoboSafe, a hybrid reasoning runtime safeguard for embodied agents through executable predicate-based safety logic. RoboSafe integrates two complementary reasoning processes on a Hybrid Long-Short Safety Memory. We first propose a Backward Reflective Reasoning module that continuously revisits recent trajectories in short-term memory to infer temporal safety predicates and proactively triggers replanning when violations are detected. We then propose a Forward Predictive Reasoning module that anticipates upcoming risks by generating context-aware safety predicates from the long-term safety memory and the agent's multimodal observations. Together, these components form an adaptive, verifiable safety logic that is both interpretable and executable as code. Extensive experiments across multiple agents demonstrate that RoboSafe substantially reduces hazardous actions (-36.8% risk occurrence) compared with leading baselines, while maintaining near-original task performance. Real-world evaluations on physical robotic arms further confirm its practicality. Code will be released upon acceptance.
Key facts. Cited by 14 papers in the map (data through 14 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 32 of its 39 references that are in the map. First posted on arXiv 24 Dec 2025.
Builds on
32 of 39 references.
Closest ancestors · 5
Same direction, newest first
- 2025ProbGuard: Proactive Runtime Monitoring for LLM Agent Safety via Probabilistic Prediction1 Aug
- 2025Manipulating Multimodal Agents via Cross-Modal Prompt Injection19 Apr
- 2025AgentSpec: Customizable Runtime Enforcement for Safe and Reliable LLM Agents24 Mar
- 2024SafeAgentBench: A Benchmark for Safe Task Planning of Embodied LLM Agents17 Dec
- 2024BadRobot: Jailbreaking Embodied LLM Agents in the Physical World16 Jul
Other references · 27
- 2023GPT-4 Technical Reportcited by 18,396
- 2025Qwen3 Technical Reportcited by 8,820
- 2022ReAct: Synergizing Reasoning and Acting in Language Modelscited by 8,695
- 2025DeepSeek-R1: Incentivizing Reasoning Capability in LLMs via Reinforcement Learningcited by 6,330
- 2024GPT-4o System Cardcited by 4,588
- 2023Reflexion: Language Agents with Verbal Reinforcement Learningcited by 4,276
- 2025Gemini 2.5: Pushing the Frontier with Advanced Reasoning, Multimodality, Long Context, and Next Generation Agentic Capabilitiescited by 3,796
- 2022Code as Policies: Language Model Programs for Embodied Controlcited by 1,210
- 2023HuggingGPT: Solving AI Tasks with ChatGPT and its Friends in Hugging Facecited by 1,190
- 2017AI2-THOR: An Interactive 3D Environment for Visual AIcited by 869
- 2022ProgPrompt: Generating Situated Robot Task Plans using Large Language Modelscited by 611
- 2022LLM-Planner: Few-Shot Grounded Planning for Embodied Agents with Large Language Modelscited by 462
15 more
- 2023DriveMLM: Aligning Multi-Modal Large Language Models with Behavioral Planning States for Autonomous Drivingcited by 233
- 2023Dolphins: Multimodal Language Model for Drivingcited by 124
- 2023Instruct2Act: Mapping Multi-modality Instructions to Robotic Actions with Large Language Modelcited by 116
- 2024Jailbreak Vision Language Models via Bi-Modal Adversarial Promptcited by 109
- 2024VLM-AD: End-to-End Autonomous Driving through Vision-Language Model Supervisioncited by 86
- 2023Octopus: Embodied Vision-Language Programmer from Environmental Feedbackcited by 73
- 2024SafeBench: A Safety Evaluation Framework for Multimodal Large Language Modelscited by 69
- 2023MP5: A Multi-modal Open-ended Embodied System in Minecraft via Active Perceptioncited by 67
- 2024Code-as-Monitor: Constraint-aware Visual Programming for Reactive and Proactive Robotic Failure Detectioncited by 63
- 2023Pre-trained Trojan Attacks for Visual Recognitioncited by 39
- 2025RoboFactory: Exploring Embodied Agent Collaboration with Compositional Constraintscited by 31
- 2024Easier Said Than Done: Unpacking Intent-Behavior Gap in Jailbreaking LLM-Based Robotscited by 15
- 2024Multi-Modal Grounded Planning and Efficient Replanning For Learning Embodied Agents with A Few Examplescited by 10
- 2025BFA: Best-Feature-Aware Fusion for Multi-View Fine-grained Manipulationcited by 10
- 2025Detoxifying Large Language Models via Autoregressive Reward Guided Representation Editingcited by 10
Built on by
Citing papers per year: 2026: 14.
14 papers.
Sort:
By area:
- 2026From Question Answering to Task Completion: A Survey on Agent System and Harness Designcited by 12
- 2026Safety in Embodied AI: A Survey of Risks, Attacks, and Defensescited by 7
- 2026HomeGuard: VLM-based Embodied Safeguard for Identifying Contextual Risk in Household Taskcited by 5
- 2026Pre-VLA: Preemptive Runtime Verification for Reliable Vision-Language-Action and World-Model Rolloutscited by 5
- 2026Tex3D: Objects as Attack Surfaces via Adversarial 3D Textures for Vision-Language-Action Modelscited by 3
- 2026LabGuard: Grounding Natural-Language Laboratory Rules into Runtime Guards for Embodied Laboratory Agentscited by 2
- 2026Position: A Three-Layer Probabilistic Assume-Guarantee Architecture Is Structurally Required for Safe LLM Agent Deploymentcited by 1
- 2026Safe Embodied AI for Long-horizon Tasks: A Cross-layer Analysis of Robotic Manipulationcited by 1
- 2026Self-Evolving Just-In-Time Memory for Proactive Embodied Safetycited by 1
- 2026Device Context Protocol: A Compact, Safety-First Architecture for LLM-Driven Control of Constrained Devicescited by 0
- 2026Security of Foundation-Model-Powered Embodied Agents: Attack Surfaces, Attacks, Defenses, and Evaluationcited by 0
- 2026Safe Task Planning with Long-Term Graph Memory for Embodied Agentscited by 0
- 2026Benchmarking Jailbreak Guardrails for Embodied Agents5 Oct 2026
- 2026Safe Task Planning with Long-Term Graph Memory for Embodied Agents8 Sep 2026
- 2026Security and Privacy in Large-Model-Driven Embodied Agents: Attacks, Defenses, and Future Directions19 Aug 2026
- 2026Security of Foundation-Model-Powered Embodied Agents: Attack Surfaces, Attacks, Defenses, and Evaluation17 Aug 2026
- 2026LabGuard: Grounding Natural-Language Laboratory Rules into Runtime Guards for Embodied Laboratory Agents30 Jun 2026
- 2026Self-Evolving Just-In-Time Memory for Proactive Embodied Safety26 Jun 2026
- 2026From Question Answering to Task Completion: A Survey on Agent System and Harness Design14 Jun 2026
- 2026Safe Embodied AI for Long-horizon Tasks: A Cross-layer Analysis of Robotic Manipulation4 Jun 2026
- 2026Device Context Protocol: A Compact, Safety-First Architecture for LLM-Driven Control of Constrained Devices24 May 2026
- 2026Pre-VLA: Preemptive Runtime Verification for Reliable Vision-Language-Action and World-Model Rollouts21 May 2026
- 2026Position: A Three-Layer Probabilistic Assume-Guarantee Architecture Is Structurally Required for Safe LLM Agent Deployment18 May 2026
- 2026Tex3D: Objects as Attack Surfaces via Adversarial 3D Textures for Vision-Language-Action Models2 Apr 2026
- 2026From Question Answering to Task Completion: A Survey on Agent System and Harness Designcited by 12
- 2026Position: A Three-Layer Probabilistic Assume-Guarantee Architecture Is Structurally Required for Safe LLM Agent Deploymentcited by 1
- 2026Security of Foundation-Model-Powered Embodied Agents: Attack Surfaces, Attacks, Defenses, and Evaluationcited by 0
- 2026Security and Privacy in Large-Model-Driven Embodied Agents: Attacks, Defenses, and Future Directionscited by 0
- 2026Benchmarking Jailbreak Guardrails for Embodied Agentscited by 0
- 2026Benchmarking Jailbreak Guardrails for Embodied Agents5 Oct 2026
- 2026Security and Privacy in Large-Model-Driven Embodied Agents: Attacks, Defenses, and Future Directions19 Aug 2026
- 2026Security of Foundation-Model-Powered Embodied Agents: Attack Surfaces, Attacks, Defenses, and Evaluation17 Aug 2026
- 2026From Question Answering to Task Completion: A Survey on Agent System and Harness Design14 Jun 2026
- 2026Position: A Three-Layer Probabilistic Assume-Guarantee Architecture Is Structurally Required for Safe LLM Agent Deployment18 May 2026
- 2026Tex3D: Objects as Attack Surfaces via Adversarial 3D Textures for Vision-Language-Action Modelscited by 3
- 2026LabGuard: Grounding Natural-Language Laboratory Rules into Runtime Guards for Embodied Laboratory Agentscited by 2
- 2026Safe Embodied AI for Long-horizon Tasks: A Cross-layer Analysis of Robotic Manipulationcited by 1
- 2026Device Context Protocol: A Compact, Safety-First Architecture for LLM-Driven Control of Constrained Devicescited by 0
- 2026LabGuard: Grounding Natural-Language Laboratory Rules into Runtime Guards for Embodied Laboratory Agents30 Jun 2026
- 2026Safe Embodied AI for Long-horizon Tasks: A Cross-layer Analysis of Robotic Manipulation4 Jun 2026
- 2026Device Context Protocol: A Compact, Safety-First Architecture for LLM-Driven Control of Constrained Devices24 May 2026
- 2026Tex3D: Objects as Attack Surfaces via Adversarial 3D Textures for Vision-Language-Action Models2 Apr 2026
Similar, not cited
Close in wording, no citation either way
- 2025SafeMind: Benchmarking and Mitigating Safety Risks in Embodied LLM Agents
- 2026EMBGuard: Constructing Hazard-Aware Guardrails for Safe Planning in Embodied Agents
- 2025SENTINEL: A Multi-Level Formal Framework for Safety Evaluation of Foundation Model-based Embodied Agents
- 2026SafeRelBench: A Spatial-Relation-Aware Benchmark for Process-Level Safety in VLM-Driven Embodied Agents
- 2026PlanGuard: A Guardrail for Multi-Step Plan Safety in Embodied Agents
- 2026SafeBranch: Branch-Pair Safety Alignment for Embodied Agents
- 2025AGENTSAFE: Benchmarking the Safety of Embodied Agents on Hazardous Instructions
- 2026Contextual Safety Reasoning and Grounding for Open-World Robots