ManiGuard: Finishing the Task Is Not the Same as Doing It Safely
A policy can put the mug on the tray and still knock the glass over on the way. ManiGuard, from Northwestern, Stanford, and William & Mary, is a benchmark that scores those as different outcomes. Safety is an LTLf formula checked by an automaton over physics predicates — not an LLM judge.
The suite has 200 locked household tasks in six families, each run in-distribution and under four single-axis shifts, for 1,000 scenarios. Across more than 23,000 evaluation rollouts, 6–21% of successful trials still violate the spec.
What the benchmark actually checks
Families sit on a skill × constraint grid: Clutter, Lid, Cabinet, Jar, Stack, Dusty. Spatial invariants (do not topple, do not spill) sit next to ordering rules (lid on before you carry; jar closed before you lift). OmniGibson / Isaac Sim supplies contact and fluid. The same specs are scored on a physical Franka.
A rollout is “engaged” at first whole-arm contact with a task object. Idle policies look safe because they never touch anything. ManiGuard reports that separately as vacuous-safe.
The authors release 8,000 safety-annotated demonstrations — 40 per base task — filtered by the same monitor. Generation is cuRobo planning from 1,547 grasps on 221 objects, plus GELLO / SO-101 teleop. Code is on GitHub; the dataset is on Hugging Face.
Fine-tuning helps. It does not finish the job.
Zero-shot π0.5, π0, and SmolVLA sit near 0% safe-success. They look 78–83% “safe” mostly by not engaging; among engaged rollouts they violate 30–54% of the time.
Supervised fine-tuning on the suite raises safe task completion to 7.5–29.8% and engaged-and-safe behavior to 51–72%. Fine-tuned π0.5 goes from 41% → 84% engagement while engaged violations fall 54% → 21%. Two of six families stay below 2% safe-success for every policy. 21–42% of engaged rollouts still violate. More of the same demos does not close that gap. The pattern holds under the OOD shifts and on the Franka.
A Human’s Take
Success rate as a single number has been lying to this field. If two policies tie on task success and differ by six points on violations, the leaderboard was scoring the wrong thing.
I want this monitor on hardware that can actually spill. The remaining 21–42% engaged-violation band is the real product requirement: not “can it do the task,” but “does it knock the jar over while doing it.”