Paper deep dive
ActFovea: Runtime Safeguarding for VLA Policies via Spatiotemporal Visual-Action Consistency
Wenda Yu, Tianshi Wang, Fengling Li, Xin Li, Jingjing Li, Lei Zhu
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 90%
Last extracted: 8/3/2026, 2:42:27 AM
Summary
ActFovea is a runtime safeguarding framework for Vision-Language-Action (VLA) policies that detects and mitigates failures caused by spatiotemporal inconsistencies between visual observations, robot states, and executed actions. It uses action-conditioned foveation to focus on relevant visual areas and evaluates consistency to determine if recovery is possible. If recovery is feasible, it constructs candidate observations and verifies actions; otherwise, it triggers a safe-failure procedure. Evaluated on the LIBERO suite with the pi0 policy, ActFovea significantly improves success rates under visual overlays, delays, and action drift while preserving clean performance.
Entities (11)
Relation Signals (9)
ActFovea → protects → VLA Policies
confidence 95% · ActFovea is a plug-and-play safeguarding framework that detects and mitigates such failures... without retraining or modifying the underlying VLA policy.
ActFovea → evaluatedon → LIBERO
confidence 92% · In closed-loop evaluations of $π_0$ across multiple LIBERO suites, ActFovea increases success
ActFovea → uses → Action-Conditioned Foveation
confidence 92% · ActFovea uses robot kinematics... to construct action-conditioned foveated regions
pi0 → isevaluatedwith → ActFovea
confidence 90% · In closed-loop evaluations of $π_0$ across multiple LIBERO suites, ActFovea increases success
ActFovea → mitigates → Visual Delay
confidence 90% · It further improves success under... visual delay by... 9.8 percentage points
ActFovea → mitigates → Action Drift
confidence 90% · It further improves success under action drift... by 7.0... percentage points
ActFovea → mitigates → Localized Visual Overlays
confidence 90% · ActFovea increases success under localized visual overlays from 49.3% to 90.3%
ActFovea → handles → Frozen-Observation Replay
confidence 88% · Under frozen-observation replay, ActFovea triggers timely safe failure in all trials
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Vision-language-action (VLA) policies achieve strong performance in robotic manipulation but remain vulnerable to runtime disturbances that break the temporal alignment among visual observations, robot states, and executed actions. We introduce ActFovea, a plug-and-play safeguarding framework that detects and mitigates such failures without retraining or modifying the underlying VLA policy. ActFovea uses robot kinematics, proprioceptive states, and recent actions to construct action-conditioned foveated regions that retain contact-relevant areas and predicted motion corridors while suppressing task-irrelevant visual content. It detects runtime risks by evaluating whether visual motion and observation freshness remain consistent with geometric, proprioceptive, and action transitions. For recoverable disturbances, ActFovea constructs disturbance-specific candidate observations and accepts a recovery only after verifying the resulting action chunk. When stale or replayed observations make reliable recovery impossible, it invokes a bounded safe-failure procedure. In closed-loop evaluations of $\pi_0$ across multiple LIBERO suites, ActFovea increases success under localized visual overlays from 49.3\% to 90.3\%, closing 93.7\% of the gap to clean performance. It further improves success under action drift and visual delay by 7.0 and 9.8 percentage points, respectively, while preserving clean-task performance. Under frozen-observation replay, ActFovea triggers timely safe failure in all trials, with no unprotected failures. These results demonstrate that spatiotemporal visual-action consistency provides an effective basis for runtime safeguarding of VLA policies.
Tags
Links
- Source: https://arxiv.org/abs/2607.29169v1
- Canonical: https://arxiv.org/abs/2607.29169v1
Trouble viewing inline? Open PDF directly →
Full Text
40,889 characters extracted from source content.
Expand or collapse full text
ActFovea: Runtime Safeguarding for VLA Policies via Spatiotemporal Visual-Action Consistency Wenda Yu1, Tianshi Wang1, Fengling Li2, Xin Li3, Jingjing Li4, Lei Zhu1 Abstract Vision-language-action (VLA) policies achieve strong performance in robotic manipulation but remain vulnerable to runtime disturbances that break the temporal alignment among visual observations, robot states, and executed actions. We introduce ActFovea, a plug-and-play safeguarding framework that detects and mitigates such failures without retraining or modifying the underlying VLA policy. ActFovea uses robot kinematics, proprioceptive states, and recent actions to construct action-conditioned foveated regions that retain contact-relevant areas and predicted motion corridors while suppressing task-irrelevant visual content. It detects runtime risks by evaluating whether visual motion and observation freshness remain consistent with geometric, proprioceptive, and action transitions. For recoverable disturbances, ActFovea constructs disturbance-specific candidate observations and accepts a recovery only after verifying the resulting action chunk. When stale or replayed observations make reliable recovery impossible, it invokes a bounded safe-failure procedure. In closed-loop evaluations of π0 _0 across multiple LIBERO suites, ActFovea increases success under localized visual overlays from 49.3% to 90.3%, closing 93.7% of the gap to clean performance. It further improves success under action drift and visual delay by 7.0 and 9.8 percentage points, respectively, while preserving clean-task performance. Under frozen-observation replay, ActFovea triggers timely safe failure in all trials, with no unprotected failures. These results demonstrate that spatiotemporal visual-action consistency provides an effective basis for runtime safeguarding of VLA policies. Introduction Vision-language-action, or VLA, policies map visual observations and language instructions directly to robot actions, offering a scalable approach to general-purpose manipulation (Brohan et al. 2023; Kim et al. 2024; Black et al. 2024). Many current VLA policies predict action chunks, allowing multiple controls to be executed before the policy conditions on a new observation (Zhao et al. 2023). This design amortizes inference and promotes temporally coherent motion, but it also makes reliable control depend on continued alignment among visual observations, robot proprioception, and executed actions. When this alignment is broken, the policy may act on visual evidence that no longer corresponds to the robot’s current physical state. Figure 1 illustrates how the disturbances considered in this work disrupt different components of this closed-loop relationship. Recent studies have revealed vulnerabilities across these components. Visual attacks can modify task-relevant image evidence (Lu et al. 2025a, b), while SilentDrift exposes smooth intra-chunk action deviations (Xu et al. 2026) and FreezeVLA shows that adversarial observations can induce persistent inaction (Wang et al. 2025). Existing runtime safeguards provide complementary but largely specialized forms of protection. Control-barrier layers enforce explicit geometric constraints, while observation interventions reduce sensitivity to visual distractors (Hu et al. 2025; Hancock et al. 2024). Figure 1: Four runtime disturbances that violate spatiotemporal visual-action consistency. Localized overlays corrupt spatial evidence, visual-feedback delay misaligns observations with the current robot state, action-chunk drift causes trajectories to lose state support, and frozen-observation replay eliminates fresh visual grounding. These advances leave a deployment gap. A VLA policy may encounter spatial corruption, temporal misalignment, and action-trajectory drift during the same task, whereas existing safeguards typically target a particular disturbance family or apply a predetermined runtime constraint. A uniformly conservative response can unnecessarily suppress valid behavior, while treating every anomaly as recoverable can prolong control after reliable perceptual grounding has been lost. Runtime safeguarding must determine not only whether the closed loop has become inconsistent, but also whether a justified recovery remains possible. Making this distinction is difficult because the expected visual transition depends on the current action, robot state, and task phase. A nearly static image may reflect either a legitimate pause or stale feedback, while a smooth action chunk may still deviate from the motion supported by the observed scene. These ambiguities must be resolved without access to reward signals, simulator object states, segmentation annotations, or prior knowledge of the disturbance type. The observable structure is spatiotemporal visual-action consistency: visual observations, proprioceptive transitions, and candidate actions should jointly describe a coherent physical evolution of the robot and its environment. Based on this principle, we introduce ActFovea, a plug-and-play runtime safeguarding framework for VLA policies. ActFovea combines robot kinematics, proprioceptive transitions, visual history, and previous actions to construct action-conditioned foveated regions that preserve expected contact areas and predicted motion corridors. Unlike image-centered foveation, its visual support follows the anticipated interaction rather than the geometric center of the image. A consistency monitor identifies the active runtime risk and determines whether the available evidence is sufficient for recovery. For recoverable disturbances, ActFovea constructs a disturbance-conditioned bank of candidate observations and verifies the action chunk induced by each candidate before execution. When observations remain stale or replayed, ActFovea disables recovery and invokes a bounded motion-suppression procedure for safe failure. The underlying VLA policy remains frozen throughout. Across 40 LIBERO tasks with π0 _0, ActFovea recovers 93.7% of the success-rate loss induced by localized visual overlays, improves performance under visual-feedback delay and smooth action-chunk drift, and preserves performance under undisturbed conditions. Under frozen-observation replay, it triggers timely safe failure in all evaluated trials, with no unprotected failures. Runtime comparisons and component ablations further quantify the contributions of disturbance-conditioned observation recovery and action-chunk verification across different forms of inconsistency. In summary, our main contributions are as follows: • We formulate spatial corruption, temporal misalignment, action-trajectory drift, and observation replay as violations of spatiotemporal visual-action consistency jointly grounded in visual evidence, proprioceptive transitions, and action history. • We develop a plug-and-play runtime safeguard that combines action-conditioned foveation, disturbance-conditioned observation recovery, action-chunk verification, and recoverability-aware safe failure without retraining or modifying the underlying VLA policy. • We conduct controlled closed-loop evaluations across 40 LIBERO tasks, showing recovery from localized visual overlays, visual delay, and action drift, preserved clean performance, and timely safe failure under frozen-observation replay, supported by runtime comparisons and component ablations. Figure 2: Overview of ActFovea. Action-conditioned foveation constructs interaction-centered preserve regions and consistency evidence from runtime observations, robot state, and action history. Recoverable spatial, temporal, and action-side inconsistencies enter a shared candidate, verification, and bounded-execution path. Confirmed frozen-observation replay instead bypasses recovery and triggers safe failure. Related Work VLA Robustness under Runtime Disturbances Vision-language-action policies couple visual and linguistic representations to robot control, enabling instruction-conditioned behavior across objects, tasks, and embodiments. Early systems such as RT-2 cast actions as tokens, while OpenVLA and Octo provide open generalist policies trained on diverse robot data, and π0 _0 generates continuous actions through flow matching (Brohan et al. 2023; Kim et al. 2024; Octo Model Team et al. 2024; Black et al. 2024). Many contemporary policies predict action chunks rather than isolated controls, following the broader action-chunking paradigm introduced for visuomotor imitation learning (Zhao et al. 2023). Chunking amortizes policy inference and supports coherent motion, but it also places multiple executed controls between successive perceptual updates. Reliable deployment therefore depends not only on single-frame perception or individual actions, but also on their temporal alignment with the evolving robot state. Recent security studies expose failures along each part of this closed loop. Attacks span prompt-induced control hijacking, sparse or transferable visual perturbations, and physical variations or sensor interference, while AttackVLA systematizes adversarial and backdoor evaluation across the VLA lifecycle (Jones et al. 2025; Zhang et al. 2025b; Lu et al. 2025a; Liu et al. 2025; Lu et al. 2025b; Li et al. 2025). Backdoor studies further demonstrate persistent trigger-conditioned control deviations that preserve clean behavior (Zhou et al. 2025). SilentDrift identifies the intra-chunk accumulation of smooth action deviations, and FreezeVLA shows that adversarial observations can induce persistent inaction (Xu et al. 2026; Wang et al. 2025). Although their threat models and adversary capabilities differ, these results reveal a common deployment failure: visual content, observation timing, proprioceptive evolution, and action trajectories can cease to describe the same physical transition. This literature primarily constructs or benchmarks individual attacks. ActFovea addresses the complementary defense problem, using representative visual, temporal, and action-space disturbances to study whether their shared spatiotemporal inconsistency can be detected and managed online. Runtime Safeguarding for Embodied Policies One line of work improves safety or robustness during training. SafeVLA formulates VLA alignment through constrained learning, whereas Phantom Menace uses adversarial training to improve robustness to physical sensor attacks (Zhang et al. 2025a; Lu et al. 2025b). Such approaches can internalize safety preferences or perturbation robustness when training data, optimization budgets, and parameter access are available. ActFovea considers a complementary deployment setting: the pretrained policy remains frozen, and safeguarding is performed through its observation-action interface. Inference-time methods avoid retraining but enforce different runtime contracts. VLSA places a control-barrier-function layer after a VLA to enforce explicit collision constraints (Hu et al. 2025). BYOVLA instead probes a policy’s action sensitivity to image regions and minimally edits task-irrelevant visual distractors (Hancock et al. 2024). These approaches demonstrate the value of plug-and-play control and observation interventions, but respectively focus on geometric hazards and visual distractors. ActFovea targets loss of consistency across visual observations, robot state, and action chunks. It combines action-conditioned foveation with threat-conditioned observation candidates, verifies the resulting action chunks, and invokes bounded motion suppression when fresh evidence cannot be recovered. Thus, the contribution is a unified runtime safeguarding loop rather than a separate detector or correction rule for each disturbance. Method Overview and Threat Model We consider a frozen VLA policy π deployed in a closed-loop manipulation system. At query t, the observation oto_t contains RGB images Itvv∈\I_t^v\_v , available end-effector and joint/proprioceptive states, and an observation timestamp. Conditioned on oto_t and language instruction l, the policy predicts At=π(ot,l)=[at,0,…,at,H−1],A_t=π(o_t,l)=[a_t,0,…,a_t,H-1], (1) where H is the chunk horizon. A prefix of length ht≤Hh_t≤ H is committed before replanning. ActFovea interacts with π through its observation-action interface and keeps the policy parameters frozen. It observes each action chunk before execution and maintains short histories of visual observations, proprioceptive states, and executed actions. Disturbances introduced after this interface are outside our threat model. We study disturbances along three axes of the closed-loop transition. Spatial visual inconsistency is instantiated by a persistent localized visual overlay that alpha-blends a fixed pattern into the camera streams after an initial clean interval. Temporal visual inconsistency includes both multi-view visual feedback delay, which pairs an earlier image with current proprioception, and frozen-observation replay, which repeatedly supplies the same stale frame while the robot state evolves. Action-trajectory inconsistency is instantiated by smooth drift applied to the motion dimensions of a policy-generated chunk before ActFovea verifies it. These disturbances do not share an attack generator; they share the failure signature that visual content, proprioceptive transitions, and action evolution no longer support one coherent physical transition. Figure 2 summarizes the pipeline. ActFovea uses robot kinematics and action history as a reference for expected visual change and action evolution. It first constructs foveated observations and measures visual-action consistency. A deterministic router infers the disturbance type and recoverability state from runtime evidence without access to the injected disturbance label. Under the bounded settings considered here, finite delay, localized overlays, and pre-execution action drift may retain sufficient evidence for guarded recovery, whereas persistent replay becomes unrecoverable once stale-frame evidence activates the hold latch. Action-Conditioned Foveation and Consistency Monitoring ActFovea operationalizes this principle by defining the fovea as a dynamically updated preserve region anchored to projected contact and motion. Its location follows robot kinematics and action history, so the high-fidelity region moves with the predicted interaction rather than remaining fixed in image coordinates. For each enabled camera v, ActFovea estimates a projected contact center ctvc_t^v and a short motion corridor Γtv _t^v. With calibrated joints, current and action-extrapolated configurations are mapped by forward kinematics to gripper pinch centers and projected through the camera model. When strict projection is unavailable, the implementation uses constant-velocity Cartesian extrapolation or the previous tracked center together with an image-plane direction inferred from joint changes, velocity, and the previous action. Let Mc,tvM_c,t^v be a disk of radius rcr_c centered at ctvc_t^v, and let MΓ,tvM_ ,t^v be the radius-rΓr_ corridor around the projected polyline Γtv _t^v. The task-relevant preserve mask is Mtv=Dilate(Mc,tv∨MΓ,tv,rm),M_t^v=Dilate(M_c,t^v M_ ,t^v,r_m), (2) where rmr_m is a safety margin. Its complement defines the editable background mask. The implementation applies exponential moving-average smoothing and thresholding to obtain B¯tv B_t^v. Denoting background normalization, Gaussian smoothing, and color-grayscale mixing by ℰE, the filtered image is I~tv=(1−αB¯tv)⊙Itv+αB¯tv⊙ℰ(Itv), I_t^v=(1-α B_t^v) I_t^v+α B_t^v (I_t^v), (3) where α is a bounded edit strength. This operation preserves the contact neighborhood and motion corridor while desensitizing the surrounding background. The same reference supports consistency monitoring. An observed center c^tv c_t^v is estimated from local template matching, motion centroids, and appearance centroids. Geometric consistency decays with the distance between c^tv c_t^v and the projected contact center, while support from the projected corridor contributes to task consistency. Dynamic consistency combines directional and magnitude agreement between predicted and observed image displacement. Temporal evidence combines timestamp health, expected-but-missing local motion, lag estimated by short-history matching, and global replay similarity. Additional components measure motion relevance inside MtvM_t^v and action-proprioception agreement. The implementation forms a fixed weighted mean of the available component scores, contracts low-confidence estimates toward 0.50.5, and aggregates valid cameras using health-dependent weights. Let rtr_t denote one minus the camera-weighted consistency and let r¯t r_t be its exponential moving average. The final risk is Rt=clip(βr¯t+(1−β)rt+ptcam+ptlag+ptcal,0,1),R_t=clip (β r_t+(1-β)r_t+p_t^cam+p_t^lag+p_t^cal,0,1 ), (4) where β and the component weights are fixed implementation constants. Here, ptlagp_t^lag captures estimated lag, while ptcamp_t^cam and ptcalp_t^cal are auxiliary sensor-health penalties for unavailable camera evidence and calibration inconsistency. A deterministic router combines the resulting evidence with temporal persistence: direct lag supports temporal delay, dynamic and proprioceptive disagreement supports action drift, and strong stale/replay evidence with an active hold latch yields an unrecoverable freeze-like state. Weak or conflicting evidence is routed to consistent or unknown states. The shared monitor produces a common risk state that can be strengthened by threat-conditioned evidence. For the evaluated localized overlay, ActFovea proposes a novel bounded region directly from the runtime images and accepts it as spatial evidence only when its onset, position, and extent remain stable across time and, when available, camera views. This evidence updates the same recoverability state used by the router. A temporary hold prevents uncertain observations from reaching the policy while the evidence is confirmed. Scenario Undisturbed SR Disturbed SR Gain ↑ NRR ↑ Base VLA ActFovea Base VLA ActFovea Action Drift 92.7 93.0 83.1 90.1 +7.0+7.0 73.1 Visual Delay 92.6 93.2 76.2 86.0 +9.8+9.8 59.8 Visual Overlay 93.0 93.8 49.3 90.3 +41.0+41.0 93.7 Table 1: Main recovery results averaged over the four LIBERO suites. Success Rate and NRR are reported in percent, and Gain is reported in percentage points. Each row uses its corresponding undisturbed controls. Consistency-Guided Recovery and Action Verification Threat typing determines what evidence should be corrected, but every instantiated candidate rejoins the same policy-verifier path. For recoverable or borderline evidence, the candidate bank retains raw and foveated observations and conditionally adds a temporally stabilized candidate for finite visual lag. The raw path avoids unnecessary modification under uncertain detections, and the foveated path uses Eq. (3). For finite visual delay, ActFovea translates the observation toward the kinematic reference using the observed-to-predicted center bias, with a gain that increases with estimated lag and decreasing freshness. Wrist-camera translations are attenuated. This deterministic image translation is instantiated only when the corresponding temporal evidence is present. Action-chunk drift generally retains trustworthy visual input and is therefore handled primarily through action verification and bounded execution rather than image reconstruction. Confirmed localized overlays activate a spatial restoration operator within the same candidate bank. The last clean reference is aligned to the current image using the median dense optical flow outside the detected box. Given the overlaid region PtvP_t^v, overlay pattern estimate Q^tv Q_t^v, and observation-derived blending estimate α^tv α_t^v, the clean region is reconstructed as X^tv=clip(Ptv−α^tvQ^tv1−α^tv,0,255). X_t^v=clip\! ( P_t^v- α_t^v Q_t^v1- α_t^v,0,255 ). (5) The first detected overlaid frame is paired with the most recent reference retained from the clean initialization buffer after background alignment. Their relationship provides the image-derived estimates Q^tv Q_t^v and α^tv α_t^v. Gaussian feathering blends the reconstructed region at its boundary. A repair is admitted only if every detected view is reconstructed. The weakest-view quality combines detection confidence, clipping ratio, and boundary continuity, and it must pass the admission threshold. The highest-priority candidate is queried first. Search expands when suspicious evidence and initial verification justify additional policy calls. Expansion is suppressed for clean-like, low-risk ambiguous, and unrecoverable evidence; an unrecoverable hold may directly emit a guard chunk. For each evaluated candidate, the verifier excludes the final gripper dimension and measures first-action direction, endpoint direction, motion magnitude, smoothness, horizon, and chunk drift. Let uku_k collect the corresponding agreement scores and complements of normalized penalties. The verification score is Vk=clip(w⊤uk+bk,0,1),V_k=clip(w u_k+b_k,0,1), (6) where w is a fixed nonnegative weight vector and bkb_k is a threat-conditioned bonus. Chunk drift combines the lateral-to-total displacement ratio, endpoint-direction disagreement, and path curvature. Selection maximizes a utility combining VkV_k, execution mode, candidate priority, and small threat-dependent preferences. When an overlay repair passes the admission gate, candidate expansion compares the raw and deblended observations. If their first three motion actions agree in direction and root-mean-square deviation, the raw action is retained. Otherwise, the repaired action is selected only when reconstruction evidence is strong and its verification score remains consistent with the raw action. The raw action remains the conservative fallback. During confirmed overlay recovery, the selected chunk also passes a configured per-policy action envelope before final verification, while the gripper command remains unchanged. All selection rules are fixed at inference time, and ActFovea adds neither a training objective nor parameter optimization. Figure 3: Representative runtime decision traces under visual delay and frozen-observation replay. Finite delay preserves recoverable temporal evidence and supports adaptive replanning, while persistent replay exhausts fresh visual evidence, shortens execution, and terminates in safe failure. Method Success Rate (%) ↑ Undisturbed Action Drift Visual Delay Visual Overlay Base VLA 93.0 83.1 76.2 49.3 Action Clip/Smoothing 82.2 70.4 70.2 30.9 Fixed Short Horizon 91.7 89.9 70.7 32.4 Timestamp-Only Hold 93.1 84.9 0.0 48.5 ActFovea 93.8 90.1 86.0 90.3 Table 2: Success rates for training-free runtime methods. Risk-Adaptive Execution and Safe Failure Execution uses two-stage arbitration. First, the consistency monitor determines whether to preserve execution, damp motion, shorten the executable horizon, or hold, producing a monitor scale λtmon _t^mon and horizon htmonh_t^mon. Second, action verification chooses normal execution, short-horizon execution, servo recovery, or safe failure, with optional caps λtver _t^ver and htverh_t^ver. The combined decision is a^t,imot a_t,i^mot =λtmonλtverat,i⋆,mot,i<ht, = _t^mon _t^vera_t,i ,mot, i<h_t, (7) ht h_t =min(htmon,htver), = (h_t^mon,h_t^ver), where an absent verifier cap denotes unit scale and the full chunk horizon. Monitor-level holding and verifier-level safe failure override the remaining modes and set motion to zero. When neither stage intervenes, the full chunk is preserved, while motion damping, short-horizon execution, and servo recovery reduce motion magnitude, horizon, or both. Recoverable execution preserves the gripper dimension, while holding carries forward the previous gripper command. The runtime client re-queries the policy after hth_t actions. Finite visual delay preserves an ordered history that can support temporal alignment, whereas persistent frozen-observation replay does not. When stale content persists despite image-plane alignment, ActFovea switches from recovery to conservative execution. It latches hold after immediate strong replay evidence or a configurable stale streak and releases it after sufficient fresh evidence. Hold-triggering or high-risk fail-closed responses may prepend one clipped reverse action before filling the remaining chunk with holds. Here, safe failure denotes conservative motion suppression. Formal collision-avoidance guarantees lie outside the scope of this mechanism. Experiments Experimental Setup Benchmark and Protocol. We evaluate ActFovea with the frozen LIBERO (Liu et al. 2023) checkpoint of π0 _0 on four ten-task suites: LIBERO-Spatial, LIBERO-Object, LIBERO-Goal, and LIBERO-10. Each task uses 50 episodes, yielding 2,000 episodes per method-scenario cell. All comparisons use the same checkpoint and matched task and execution configurations; ActFovea is applied only at inference time. Disturbances. Smooth Action-Chunk Drift uses task-family-specific phase templates to perturb the motion part of an action chunk over a phase-conditioned window. Multi-View Visual Feedback Delay holds both exterior and wrist views three frames behind the current proprioceptive state. Persistent Localized Visual Overlay blends fixed localized checker patterns into both camera streams after a short clean warm-up. Frozen-Observation Replay reuses its trigger frame in both views until termination. ActFovea receives only the resulting observations and standard runtime inputs; disturbance labels and generator parameters are not provided. Metrics. We report task success rate (SR), absolute defense gain in percentage points, and normalized recovery rate (NRR): Gain =SD+AF−SD, =S_D+AF-S_D, (8) NRR =SD+AF−SDSC−SD×100%. = S_D+AF-S_DS_C-S_D× 00\%. Here SCS_C, SDS_D, and SD+AFS_D+AF denote Base clean, Base disturbed, and ActFovea disturbed success. For frozen-observation replay, each episode is assigned to Task Success, Timely Safe Failure, or Unprotected Failure. Timely Safe Failure denotes reaching the terminal safe-failure state within the detection and action budgets, with all safe-failure actions inside the executor bound; Unprotected Failure covers the remaining unsuccessful episodes. Recovery across Spatial, Temporal, and Action Disruptions We first ask whether the same safeguarding loop transfers across spatial visual corruption, finite temporal misalignment, and action-trajectory drift. Table 1 shows consistent recovery across all three disturbance axes. Persistent visual overlays produce the largest controlled loss, reducing Base VLA success from 93.0% to 49.3%. ActFovea restores success to 90.3%, a gain of 41.0 percentage points that recovers 93.7% of the induced loss. Under finite visual delay, ActFovea raises success from 76.2% to 86.0%, a gain of 9.8 points that recovers 59.8% of the performance loss caused by the delay. Under action drift, it raises success from 83.1% to 90.1%, a gain of 7.0 points that recovers 73.1% of the disturbance-induced performance loss. Across all three evaluations, ActFovea preserves performance under undisturbed operation. Figure 3 further contrasts the runtime decisions induced by finite delay and persistent replay. Delay retains intermittent freshness and bounded lag estimates, allowing recovery and adaptive replanning. Persistent replay instead removes fresh evidence, drives the response from recovery to an unrecoverable state, and reduces the executable horizon before safe failure. Method Task Success Timely Safe Failure Unprotected Failure Base VLA 3.05 0.00 96.95 Timestamp-Only Hold 0.00 0.00 100.00 w/o Hold/Safe-Fail 0.65 0.00 99.35 ActFovea 0.00 100.00 0.00 Table 3: Outcome rates under frozen-observation replay, showing whether each method completes the task, reaches timely safe failure, or remains unprotected. Variant Action Drift Visual Delay Visual Overlay Success Rate Gain Success Rate Gain Success Rate Gain w/o Threat Typing 87.5 +4.4+4.4 80.5 +4.3+4.3 41.7 −7.6-7.6 w/o Recovery Bank 87.5 +4.4+4.4 84.0 +7.8+7.8 16.0 −33.3-33.3 w/o Candidate Expansion 90.6 +7.5+7.5 85.4 +9.2+9.2 17.6 −31.7-31.7 w/o Action Verification 81.9 −1.2-1.2 78.5 +2.3+2.3 92.1 +42.8+42.8 Full ActFovea 90.1 +7.0+7.0 86.0 +9.8+9.8 90.3 +41.0+41.0 Table 4: Component ablations under the three recoverable disturbances. Success Rate is measured under the indicated disturbance. Every Gain is computed relative to the corresponding disturbed Base VLA result in Table 1. Training-Free Runtime Comparisons The comparison methods isolate common explanations for runtime robustness. Action Clip/Smoothing applies a fixed bounded-smoothing rule to the motion dimensions while leaving the gripper command unchanged. Fixed Short Horizon replans after a shortened action prefix. Timestamp-Only Hold suspends execution using frame-age and repeated-image evidence and releases after fresh observations return. Table 2 shows that Fixed Short Horizon reaches 89.9% under action drift, closely approaching ActFovea’s 90.1% and confirming that frequent replanning is well suited to this disturbance. Its fixed response does not transfer across inconsistency types: visual-delay and visual-overlay success are 70.7% and 32.4%. Action Clip/Smoothing reduces undisturbed success to 82.2% and remains below the corresponding Base VLA result under all three disturbances. Timestamp-Only Hold preserves undisturbed behavior and reaches 48.5% under the visual overlay, but continuous visual delay keeps its timestamp rule active and reduces success to zero. ActFovea is the only evaluated runtime method that preserves undisturbed performance while improving all three recoverable disturbances. Its advantage therefore comes from threat-conditioned recovery and verification rather than a single conservative action rule. Bounded Safe Failure under Frozen-Observation Replay We next test the temporal recoverability boundary. Finite visual delay retains an ordered history, whereas persistent replay removes the fresh evidence required for task recovery. The target in the latter case is therefore a bounded terminal outcome rather than task completion. As Table 3 shows, ActFovea prioritizes a bounded terminal outcome over task completion when fresh evidence is unavailable. All 2,000 frozen-replay episodes reach timely safe failure, with no task successes or unprotected failures. Safe fail occurs immediately after replay detection; only 2.0 bounded action steps are executed afterward, with a mean cumulative action-space motion norm of 0.326 and no action-bound violations. Without Hold/Safe-Fail, the controller continues for 259.2 actions after detection and accumulates a motion norm of 241.98. The full executor therefore reduces post-detection action count by 99.23% and cumulative motion by 99.87%. Timestamp-Only Hold spends 96.55% of frozen-replay queries holding but never converts that state into terminal safe failure. This distinction explains why sustained zero motion alone is not equivalent to a bounded failure protocol. Mechanism Analysis Figure 4 illustrates the spatial mechanism across approach, grasp, and place phases. The dynamic fovea follows the contact-critical region while extending along predicted motion. A contact-only region omits this motion corridor, whereas a static region cannot adapt its spatial support as the interaction evolves. Table 4 presents a common success-rate and gain view across the three recoverable disturbances, using the disturbed Base VLA results in Table 1 as a shared reference. Full ActFovea provides gains of 7.0 points under Action Drift and 9.8 points under Visual Delay. Bypassing action verification reduces these gains to −1.2-1.2 and +2.3+2.3 points, respectively, showing that trajectory validation is the main mechanism that turns temporal and action-side candidates into reliable recovery. Threat typing is especially important for Visual Delay, where routing all evidence to the unknown state reduces the gain to 4.3 points. Under Visual Overlay, removing threat typing, the recovery bank, or candidate expansion changes the full-system gain of 41.0 points to −7.6-7.6, −33.3-33.3, and −31.7-31.7 points, whereas the variant without action verification retains a 42.8-point gain. Spatial recovery therefore relies primarily on locating the corrupted region and constructing a usable observation alternative, while action verification provides the shared conservative acceptance gate. The resulting division of labor allows one pipeline to support spatial, temporal, and action-side disruptions without applying every intervention uniformly. Figure 4: Qualitative foveation comparison across task phases. Dynamic ActFovea tracks the contact-critical region and predicted motion, whereas contact-only and static regions omit motion support or phase-dependent adaptation. Conclusion We presented ActFovea, a policy-interface-based runtime safeguard that treats spatial corruption, temporal misalignment, and action-trajectory drift as violations of spatiotemporal visual-action consistency. Action-conditioned foveation preserves interaction-relevant evidence, the consistency monitor determines whether recovery remains justified, and disturbance-conditioned candidate observations are verified before bounded execution, while the underlying VLA policy remains frozen throughout. When fresh perceptual grounding is lost, the same safeguarding loop transitions from recovery to safe failure. Across multiple LIBERO tasks with π0 _0, ActFovea restores visual-overlay success from 49.3% to 90.3%, improves visual-delay and action-drift success by 9.8 and 7.0 percentage points, and preserves performance under undisturbed operation. Under frozen-observation replay, all evaluated episodes reach timely safe failure with no unprotected failures. Ablations reveal complementary roles: observation recovery enables spatial restoration, while action verification is central to temporal and action-side recovery. These results support spatiotemporal visual-action consistency as a practical basis for training-free runtime VLA safeguarding. References K. Black, N. Brown, D. Driess, A. Esmail, M. Equi, C. Finn, N. Fusai, L. Groom, K. Hausman, B. Ichter, S. Jakubczak, T. Jones, L. Ke, S. Levine, A. Li-Bell, M. Mothukuri, S. Nair, K. Pertsch, L. X. Shi, J. Tanner, Q. Vuong, A. Walling, H. Wang, and U. Zhilinsky (2024) π0 _0: a vision-language-action flow model for general robot control. External Links: 2410.24164, Link Cited by: Introduction, VLA Robustness under Runtime Disturbances. A. Brohan, N. Brown, J. Carbajal, Y. Chebotar, X. Chen, K. Choromanski, T. Ding, D. Driess, A. Dubey, C. Finn, P. Florence, C. Fu, M. G. Arenas, K. Gopalakrishnan, K. Han, K. Hausman, A. Herzog, J. Hsu, B. Ichter, A. Irpan, N. Joshi, R. Julian, D. Kalashnikov, Y. Kuang, I. Leal, L. Lee, T. E. Lee, S. Levine, Y. Lu, H. Michalewski, I. Mordatch, K. Pertsch, K. Rao, K. Reymann, M. Ryoo, G. Salazar, P. Sanketi, P. Sermanet, J. Singh, A. Singh, R. Soricut, H. Tran, V. Vanhoucke, Q. Vuong, A. Wahid, S. Welker, P. Wohlhart, J. Wu, F. Xia, T. Xiao, P. Xu, S. Xu, T. Yu, and B. Zitkovich (2023) RT-2: vision-language-action models transfer web knowledge to robotic control. External Links: 2307.15818, Link Cited by: Introduction, VLA Robustness under Runtime Disturbances. A. J. Hancock, A. Z. Ren, and A. Majumdar (2024) Run-time observation interventions make vision-language-action models more visually robust. External Links: 2410.01971, Link Cited by: Introduction, Runtime Safeguarding for Embodied Policies. S. Hu, Z. Liu, S. Liu, J. Cen, Z. Meng, S. Wang, X. Li, and X. He (2025) VLSA: vision-language-action models with plug-and-play safety constraint layer. External Links: 2512.11891, Link Cited by: Introduction, Runtime Safeguarding for Embodied Policies. E. K. Jones, A. Robey, A. Zou, Z. Ravichandran, G. J. Pappas, H. Hassani, M. Fredrikson, and J. Z. Kolter (2025) Adversarial attacks on robotic vision language action models. External Links: 2506.03350, Link Cited by: VLA Robustness under Runtime Disturbances. M. J. Kim, K. Pertsch, S. Karamcheti, T. Xiao, A. Balakrishna, S. Nair, R. Rafailov, E. Foster, G. Lam, P. Sanketi, Q. Vuong, T. Kollar, B. Burchfiel, R. Tedrake, D. Sadigh, S. Levine, P. Liang, and C. Finn (2024) OpenVLA: an open-source vision-language-action model. External Links: 2406.09246, Link Cited by: Introduction, VLA Robustness under Runtime Disturbances. J. Li, Y. Zhao, X. Zheng, Z. Xu, Y. Li, X. Ma, and Y. Jiang (2025) AttackVLA: benchmarking adversarial and backdoor attacks on vision-language-action models. External Links: 2511.12149, Link Cited by: VLA Robustness under Runtime Disturbances. B. Liu, Y. Zhu, C. Gao, Y. Feng, Q. Liu, Y. Zhu, and P. Stone (2023) LIBERO: benchmarking knowledge transfer for lifelong robot learning. In Advances in Neural Information Processing Systems, Vol. 36. External Links: Document, Link Cited by: Benchmark and Protocol.. H. Liu, S. Ruan, J. Long, J. Wu, J. Hou, H. Tang, T. Jiang, W. Zhou, and W. Yao (2025) Eva-VLA: evaluating vision-language-action models’ robustness under real-world physical variations. External Links: 2509.18953, Link Cited by: VLA Robustness under Runtime Disturbances. H. Lu, Y. Yu, Y. Yang, C. Yi, Q. Zhang, B. Shen, A. C. Kot, and X. Jiang (2025a) When robots obey the patch: universal transferable patch attacks on vision-language-action models. External Links: 2511.21192, Link Cited by: Introduction, VLA Robustness under Runtime Disturbances. X. Lu, J. Chen, S. Xiao, Z. Jin, Z. Chen, H. Yu, B. Qian, R. Zhou, X. Ji, and W. Xu (2025b) Phantom menace: exploring and enhancing the robustness of VLA models against physical sensor attacks. External Links: 2511.10008, Link Cited by: Introduction, VLA Robustness under Runtime Disturbances, Runtime Safeguarding for Embodied Policies. Octo Model Team, D. Ghosh, H. Walke, K. Pertsch, K. Black, O. Mees, S. Dasari, J. Hejna, T. Kreiman, C. Xu, J. Luo, Y. L. Tan, L. Y. Chen, P. Sanketi, Q. Vuong, T. Xiao, D. Sadigh, C. Finn, and S. Levine (2024) Octo: an open-source generalist robot policy. External Links: 2405.12213, Link Cited by: VLA Robustness under Runtime Disturbances. X. Wang, J. Li, Z. Weng, Y. Wang, Y. Gao, T. Pang, C. Du, Y. Teng, Y. Wang, Z. Wu, X. Ma, and Y. Jiang (2025) FreezeVLA: action-freezing attacks against vision-language-action models. External Links: 2509.19870, Link Cited by: Introduction, VLA Robustness under Runtime Disturbances. B. Xu, Y. Shang, B. Wang, and E. Ferrara (2026) SilentDrift: exploiting action chunking for stealthy backdoor attacks on vision-language-action models. External Links: 2601.14323, Link Cited by: Introduction, VLA Robustness under Runtime Disturbances. B. Zhang, Y. Zhang, J. Ji, Y. Lei, Y. Cai, J. Dai, Y. Chen, and Y. Yang (2025a) SafeVLA: towards safety alignment of vision-language-action model via constrained learning. External Links: 2503.03480, Link Cited by: Runtime Safeguarding for Embodied Policies. N. Zhang, W. Tao, X. Xiao, Q. Sun, Y. Zheng, W. Mo, P. Wang, and N. Zhang (2025b) Attention-guided patch-wise sparse adversarial attacks on vision-language-action models. External Links: 2511.21663, Link Cited by: VLA Robustness under Runtime Disturbances. T. Z. Zhao, V. Kumar, S. Levine, and C. Finn (2023) Learning fine-grained bimanual manipulation with low-cost hardware. External Links: 2304.13705, Link Cited by: Introduction, VLA Robustness under Runtime Disturbances. X. Zhou, G. Tie, G. Zhang, H. Wang, P. Zhou, and L. Sun (2025) BadVLA: towards backdoor attacks on vision-language-action models via objective-decoupled optimization. External Links: 2505.16640, Link Cited by: VLA Robustness under Runtime Disturbances.