Paper deep dive
Learning from Runtime Feedback through Failure-Bank Self-Evolution for Vision-Language-Action Models
Mingyue Cui, Zheyuan Liu, Yihan Zhu, Zheyuan Zhang, Meng Jiang
Intelligence
Status: not_run | Model: - | Prompt: - | Confidence: 0%
Entities (0)
Relation Signals (0)
No relation signals yet.
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Vision-language-action (VLA) models generalize broadly across robotic manipulation tasks, but complex environments require balancing task success with unintended contact. Runtime shields can correct individual actions, but they leave the underlying policy unchanged, so repeated disagreements may create a persistent policy-shield mismatch that blocks task progress. To address this challenge, we introduce FailBank, a four-stage self-evolving framework that converts runtime feedback into persistent policy improvement. During collection, a fixed CBF-based safety module serves as an observe-only teacher, producing counterfactual corrections while the policy remains in control. Outcome-aware admission then converts useful proposals into corrective targets and retains successful uncorrected actions as quiet anchors for guarded LoRA updates. We evaluate FailBank on the VLA-Arena benchmark across two difficulty levels and two VLA backbones. Compared with the base policies, FailBank improves the joint success-cost operating point. Across the two backbones, FailBank improves task success rate by 8.5 and 6.9 percentage points, while reducing policy-induced cumulative cost by 35.6\% and 23.8\%, respectively. Compared with runtime shielding, FailBank raises task success rate by 25.4 and 9.5 percentage points, while maintaining comparable policy-induced cumulative cost. These results show that runtime feedback can serve as persistent policy supervision rather than only as a temporary action constraint.
Tags
Links
- Source: https://arxiv.org/abs/2609.39820v1
- Canonical: https://arxiv.org/abs/2609.39820v1
Trouble viewing inline? Open PDF directly →
Full Text
127,845 characters extracted from source content.
Expand or collapse full text
LEARNING FROM RUNTIME FEEDBACK THROUGH FAILURE-BANK SELF-EVOLUTION FOR VISION-LANGUAGE-ACTION MODELS A PREPRINT Mingyue Cui ∗ Zheyuan Liu ∗ Yihan ZhuZheyuan ZhangMeng Jiang University of Notre Dame mcui3, zliu29@nd.edu ABSTRACT Vision-language-action (VLA) models generalize broadly across robotic manipulation tasks, but complex environments require balancing task success with unintended contact. Runtime shields can correct individual actions, but they leave the underlying policy unchanged, so repeated disagreements may create a persistent policy–shield mismatch that blocks task progress. To address this challenge, we introduce FAILBANK, a four-stage self-evolving framework that converts runtime feedback into persistent policy improvement. During collection, a fixed CBF-based safety module serves as an observe-only teacher, producing counterfactual corrections while the policy remains in control. Outcome-aware admission then converts useful proposals into corrective targets and retains successful uncorrected actions as quiet anchors for guarded LoRA updates. We evaluate FAILBANK on the VLA-Arena benchmark across two difficulty levels and two VLA backbones. Compared with the base policies, FAILBANK improves the joint success–cost operating point. Across the two backbones, FAILBANK improves task success rate by 8.5 and 6.9 percentage points, while reducing policy- induced cumulative cost by 35.6% and 23.8%, respectively. Compared with runtime shielding, FAILBANK raises task success rate by 25.4 and 9.5 percentage points, while maintaining comparable policy-induced cumulative cost. These results show that runtime feedback can serve as persistent policy supervision rather than only as a temporary action constraint. 1 1 Introduction Vision-language-action (VLA) models connect visual observations and language instructions to continuous robot control, allowing a single policy to address many manipulation tasks without task-specific controllers (Black et al., 2024; Physical Intelligence et al., 2025). However, deploying such general policies in complex scenes requires balancing task completion with unintended contact. Real-world scenes can contain lookalike objects and nearby protected items, so the policy must identify the target, execute a precise action sequence, and avoid disturbing irrelevant objects. Task success and cumulative cost must therefore be evaluated jointly, since improving task success may increase contact, while overly conservative behavior may avoid contact at the cost of task completion. Recent works use runtime shields, failure monitoring, and constrained learning to improve robot safety (Hu et al., 2025; Zhang et al., 2025; Gu et al., 2025; Lyu et al., 2026; English et al., 2026). A representative example of runtime shielding is AEGIS (Hu et al., 2025), which uses visual grounding and a control barrier function (CBF) to correct unsafe actions before execution. However, this protection is only temporary, as the shield changes the robot command while the nominal policy remains fixed. The same action disagreement can therefore recur over consecutive control steps and produce repeated interventions that may push the robot into unfamiliar states. More importantly, repeated intervention reveals a deeper limitation of runtime shielding, which can correct individual actions but cannot resolve the persistent policy–shield mismatch. In a difficult scene, such as a narrow grasp surrounded * Equal contribution. 1 Code is available at Mingyuee88/FailBank. arXiv:2609.39820v1 [cs.RO] 30 Sep 2026 Failure-Bank Self-Evolution for Vision-Language-Action ModelsA PREPRINT by protected objects, projection may reduce immediate cost yet repeatedly redirect a capable policy until the episode times out. Strengthening the shielding does not remove the policy–shield mismatch because the nominal policy continues to generate the same class of action. Nevertheless, the teacher proposal provides a candidate counterfactual target for how the policy could move under the shield’s local geometric model. This observation leads to our central question: Can runtime evidence be converted into learning records that enable self-evolving policy updates and improve future policy behavior? Answering this question requires more than logging interventions, as the system must observe the policy’s failure distribution, distinguish useful pre-contact corrections from invalid actions, preserve successful behavior against drift, and prevent adapter updates from degrading the original action distribution. To address this challenge, we propose FAILBANK, a four-stage self-evolving framework that uses a fixed CBF teacher during collection. In Stage 1, the policy executes nominal actions while the teacher logs counterfactual proposals. Stage 2 selects outcome-aware learning records and retains successful uncorrected actions as quiet anchors. Stage 3 accumulates the admitted records in the training bank. Finally, Stage 4 fits a fresh LoRA adapter and accepts it only if its held-out flow loss and first-action drift remain within fixed limits. The accepted policy then carries this evidence into future rollouts and requires only RGB observations and proprioception at deployment. We evaluate FAILBANK on VLA-Arena’s static-obstacle suite across two difficulty levels and two VLA backbones, with higher levels indicating greater task difficulty. The learned updates consistently improve the joint success–cost operating point, increasing task success while reducing policy-induced cumulative cost. These gains extend to harder tasks where shielding may sharply reduce success. Our contributions are •We identify persistent policy–shield mismatch as a key limitation of action-only runtime protection and introduce an observe-only interface that collects counterfactual teacher proposals on the policy’s own rollout distribution without altering execution. • We propose a four-stage self-evolving framework with outcome-aware records, an accumulated failure bank, and a guarded LoRA update. •Extensive experiments across multiple difficulty levels and VLA backbones show that FAILBANK improves task success rate by 8.5 and 6.9 percentage points and reduces policy-induced cumulative cost by 35.6% and 23.8% over the base policy, while achieving SR gains of 25.4 and 9.5 percentage points over AEGIS across the two backbones at comparable cost. 2 Motivation Policy–shield mismatch. Runtime shielding can correct individual actions without updating the nominal policy (Ames et al., 2017; Hu et al., 2025). When policy and shield repeatedly mismatch, the resulting corrections may reduce local cost while impairing task progress. Figure 2 illustrates this mismatch on a harder task trajectory, where repeated shielding eventually prevents task completion. This motivates us to use runtime corrections as supervision for updating the policy, rather than applying them only during execution. Shield collapse. Runtime shielding keeps the VLA policy fixed, so repeated action disagreement can persist and eventually block task progress, especially on harder tasks. Figure 1 illustrates this issue across three diagnostic regimes, ranging from effective shielding to a policy bottleneck and shield collapse. Across all three, FAILBANK maintains higher success while further reducingCC policy , motivating the use of runtime corrections as policy supervision rather than only action-time protection. A shield-collapse trajectory. Figure 2 visualizes the policy–shield mismatch on a harder Level 2 onion task. The nominal policy continues to approach the target onion, while AEGIS repeatedly redirects the gripper away from nearby hazard bottles to reduce safety cost. Because the target lies in the same constrained region, these corrections also pull the gripper away from the onion, preventing task completion and eventually causing a timeout. FAILBANK instead learns from this runtime feedback and completes the same task successfully. Additional trajectory and stacking analyses are reported in Appendix F.2. 3 Related Work We provide an overview of current research on generalist VLA policies and evaluation, runtime safety mechanisms, and learning-based safety adaptation. A more detailed discussion of related work is provided in Appendix A. 2 Failure-Bank Self-Evolution for Vision-Language-Action ModelsA PREPRINT BaseAEGISFailBank 0 50 100 SR (%) ↑ 89.3 88.0 95.1 BaseAEGISFailBank 0 50 100 C policy ↓ 33.9 11.2 16.6 BaseAEGISFailBank 8.0 7.3 34.2 BaseAEGISFailBank 65.9 89.3 61.9 BaseAEGISFailBank 74.0 28.7 84.9 BaseAEGISFailBank 53.1 21.2 38.5 Shield effective L2 Mango Policy bottleneck L2 Apple Shield collapse L2 Tomato Figure 1: Representative Level-2 static-obstacle results on VLA-Arena. Top: task success rate (SR,↑better); bottom: policy- induced cumulative cost (C policy ,↓better). AEGIS reduces cost while largely preserving success on Mango, fails to improve success on Apple, and sharply reduces success on Tomato. FAILBANK achieves the highest success rate across all three tasks while reducing policy-induced cost relative to Base. Figure 2: A shield-collapse trajectory on the Level 2 onion task. AEGIS repeatedly intervenes near the bottles and eventually times out. FAILBANK uses observe-only CBF supervision and successfully places the onion in the bowl. Vision-language-action policies and evaluation. Generalist VLA models combine vision-language representations with robot control.π 0 uses flow matching for continuous action generation, whileπ 0.5 extends this family toward broader generalization (Black et al., 2024; Physical Intelligence et al., 2025). VLA-Arena evaluates such policies across controlled safety, distractor, extrapolation, and long-horizon settings (Zhang et al., 2026). We use its official task definitions and metrics. Runtime safety mechanisms. Control barrier functions (CBF) provide a principled mechanism for constraining nominal controls (Ames et al., 2017). AEGIS combines CBF projection with visual grounding as a plug-and-play VLA safety layer (Hu et al., 2025), while constrained flow matching incorporates safety guidance during action generation (English et al., 2026). FAILBANK instead uses runtime corrections as supervision for future policy behavior. 3 Failure-Bank Self-Evolution for Vision-Language-Action ModelsA PREPRINT 01 Observe & Label02 Admit & Weight 03 Accumulate 04 Update Simulator rollout t Step Records oₜ,ℓ,aₜ,ãₜ Triggermetadata Valid records Dₖ CBF-triggered Quietanchor Target= aₜ Past bank Bₖ₋₁ Bank Bₖ Bₖ₋₁∪Dₖ Fresh LoRA Fit Frozen Basepolicy •푭풍풐풘풍풐풔≤흉 풍풐풔 ×풃풂풔풆 •푨풄풕풊풐풏풅풓풊풇풕≤흉 풅풓풊풇풕 Fail Next round: Collect new rollouts with accepted πₖ B = 0 A = 풩(0,σ²) r + Candidate πₖ LoRAΔₖ AcceptedPolicy πₖ₋₁ t-1t+1 Trainon푩 풌 풕풓풂풊풏 Observationoₜ RGB + state Instructionℓ “Pickupthelemon” Observe-only CBF teacher Noexecution Execute nominalaₜ aₜ Privileged geometry gₜ After rollout: attach outcome Targetcorrupts thestrategy Invalidrecords Accept πₖ Pass Keep πₖ₋₁ Label Correction ãₜ Real Execution ContactNominal Target = ãₜoraₜ weight λ q Admit Drop Held-out guard (풱) Score weight ηᵢ 푩 풌 풕풓풂풊풏 w>0 Figure 3: The four-stage FAILBANK loop. Stage 1 collects policy-controlled rollouts while logging CBF proposals without altering execution. Stage 2 discards invalid records and filters valid records into CBF-triggered corrections and quiet anchors, assigning their targets and weights. Stage 3 accumulates the valid records in the training bank. Stage 4 fits a fresh LoRA adapter and accepts the candidate policy only if it passes the held-out guard. The accepted policy is then used to collect rollouts in the next round. Learning-based safety adaptation. SafeVLA integrates safety through constrained learning (Zhang et al., 2025), while SAFE detects failures from internal VLA representations (Gu et al., 2025). Privileged supervision and low-rank adaptation provide additional foundations for transferring training-time information into a deployable policy (Chen et al., 2020; Hu et al., 2022). FAILBANK builds on these ideas by converting outcome-screened runtime feedback into learning records for guarded, iterative policy updates. 4 Method 4.1 Problem setting and overview We denote the original policy byπ base and the accepted policy collecting in roundkbyπ k−1 . Unlike runtime shielding, FAILBANK keeps execution under the current policy and uses proposals from a fixed CBF teacher as counterfactual supervision. Based on rollout outcomes, it selects corrective records and successful actions as quiet anchors, then accumulates them in a failure bank. Each round fits a fresh LoRA adapter fromπ base , accepting it only if it passes a held-out guard. The accepted policy collects the next round and is deployed without the teacher or privileged geometry. Figure 3 summarizes the four-stage loop from observe-only annotation to a guarded policy update. 4.2 Stage 1: Observe and Label The first stage preserves the policy’s own rollout distribution while collecting counterfactual supervision. At each control step,π k−1 producesa t , and the observe-only teacher independently proposes ̃a t = S(a t ,g t )using privileged scene geometryg t . The teacher changes only the translational channels and records whether the projection was triggered through z t ∈0, 1. The environment always executes the nominal action, a env t = a t .(1) Because the proposal is not executed, the episode outcome remains attributable to π k−1 . Each step record stores the observation reference, instruction, nominal action, teacher proposal, trigger indicator, and metadata needed to audit the projection. After the rollout, we attach the episode outcome to these records, producing outcome-augmented evidence that Stage 2 uses to determine which records should be retained and how they should be used for learning. To isolate the learning signal from perception errors, our observe-only teacher uses privileged simulator geometry during collection. This information is not required at deployment, while the runtime-shield baseline requires geometry through visual grounding. Appendix E.1 details the interfaces, and Appendix C.5 reports the matched learning-signal attribution controls. 4 Failure-Bank Self-Evolution for Vision-Language-Action ModelsA PREPRINT 4.3 Stage 2: Admit and Weight The second stage converts rollout evidence into weighted training recordsD k based on rollout outcomes and correction timing. Each admitted record is assigned a first-action targety i . When a teacher correction is retained, the teacher proposal serves as the target, while successful uncorrected actions withz i = 0are retained as quiet anchors and use the nominal action instead. Target assignment is independent of trigger provenance, so a CBF-triggered record may retain z i = 1even when its target is the nominal action. Such a record is not considered a quiet anchor. Records that fail the admission checks are discarded. Each admitted record is weighted by trigger provenance, w i = η i , z i = 1, λ q , z i = 0. (2) For CBF-triggered records,η i is determined from the subsequent rollout: safety, task progress, and recovery increase the score, whereas repeated triggers, short-horizon cost, and barrier violations dexrease it. A validity check and fixed thresholds map the resulting score toη i ∈0, 0.25, 0.60, 1.00. Because the teacher proposal is not executed,η i reflects the training utility of the record rather than the causal effect of the correction. Quiet anchors receive the predefined weight λ q . Appendix E.1.3 gives the complete admission, lead-time, and weighting rules, while Appendix E.4 reports theλ q values used in our experiments. 4.4 Stage 3: Accumulate Stage 3 integrates the newly admitted recordsD k with evidence retained from previous rounds. To keep the held-out guard separate from training, episodes are split into training and validation folds before Stage 2 admission, with a fixed held-out batchVdrawn from the validation fold and kept disjoint fromB train k . The accumulated training bank is then updated as B train k =B train k−1 ∪D k .(3) The bank carries earlier records into subsequent rounds. Bank composition and construction audits are reported in Appendix E.2 and Appendix E.5, respectively. 4.5 Stage 4: Update Stage 4 turns the accumulated evidence inB train k into a guarded policy update. At each round, we fit a fresh LoRA adapter from the same base checkpoint. For recordi, letℓ flow i,0 (π,y i )denote the first-action flow-matching loss against its assigned target y i . We optimize L(π) = P i∈B train k w i ℓ flow i,0 (π,y i ) max 1, P i∈B train k w i .(4) The resulting candidate is then evaluated on the fixed held-out batchVusing full-chunk flow loss and first-action drift from the original base policy, ̄ L V (π) = 1 |V|H X i∈V H−1 X h=0 ℓ flow i,h (π), D V (π) = 1 |V|d X i∈V a (π) i,0 − a (base) i,0 1 .(5) The candidate is accepted only if ̄ L V (π k ) ̄ L V (π base ) ≤ τ loss , D V (π k )≤ τ drift .(6) These constraints limit held-out loss degradation and first-action drift without using benchmark SR or C for model selection. If the candidate fails, the adapter is discarded andπ k−1 remains the collecting policy, whileB train k is retained. If it passes, the acceptedπ k becomes the collecting policy for the next round and is deployed without the teacher or privileged geometry. Appendix E.4 gives the training recipe, while Appendix E.7 reports the guard limits and diagnostics. 5 Failure-Bank Self-Evolution for Vision-Language-Action ModelsA PREPRINT 5 Experiments We evaluate FAILBANK through four research questions: (1) Can runtime feedback improve task success while reducing policy-induced cost? (2) Does the learned policy generalize across states, tasks, levels, and backbones? (3) How do observe-only collection and learning signals affect policy updates? (4) How does iterative self-evolution affect the success–cost operating point? 5.1 Experimental setup Benchmark and task coverage. VLA-Arena organizes manipulation tasks into Safety, Distractor, Extrapolation, and Long-Horizon categories (Zhang et al., 2026). We evaluate its static-obstacle safety suite, with five tasks at each of three difficulty levels. The released Arena checkpoints are finetuned on Level 0 demonstrations, so we use Levels 1 and 2 to study improvement beyond that source difficulty. We collect on Level 1 mango, test all five Level 1 tasks, and test all five harder Level 2 tasks without Level 2 update data. Appendix B.7 lists the tasks, objects, splits, and coverage. Evaluation metrics. We report success rate (SR), cumulative cost (C), policy-induced cumulative cost (C policy ) and the base-relative score (BRS). SR is the percentage of trials that satisfy the task-completion predicate within the episode limit. C is VLA-Arena’s official benchmark metric, computed as the trial-average sum of per-step costs. We additionally reportCC policy , which removes the cost already present in the initial state from official C. To compare joint improvements in success and cost, we define the base-relative score (BRS) as BRS = exp − 1 2 1− SR 1− SR base + C policy C policy,base (7) where SR is expressed as a fraction. BRS equally weights the failure rate and policy-induced cost, normalized by their respective task-specific base values. The base policy scorese −1 , while a policy with zero failure and zero policy-induced cost scores 1. Appendix B.2 provides the exact calculations. VLA backbones. Our main experiments use the Arena-finetunedπ 0.5 checkpoint, withπ 0 providing a second flow- matching backbone for cross-backbone evaluation (Black et al., 2024; Physical Intelligence et al., 2025). We audited all 29 models on the Arena leaderboard, of which 10 provide Arena-finetuned weights. Among these models, only π 0.5 andπ 0 combine a continuous flow-matching action head with measurable baseline headroom, both of which are required by our update and guard. Appendix B.6 documents this selection and the attempted extensions. Baselines. We use the Arena-finetunedπ 0.5 flow-matching VLA as our main base policy. We compare against the base policy and AEGIS, a CBF-based runtime shield with GLM-4.5V perception, to distinguish persistent policy adaptation from runtime action correction. We further repeat the Base–AEGIS–FAILBANK comparison onπ 0 for cross-backbone evaluation. All methods are evaluated under matched initial states, task definitions, and evaluation conditions. 5.2 Main results RQ1 Can runtime feedback improve task success while reducing policy-induced cost? To answer RQ1, we compare Base, AEGIS, and FAILBANK on the complete Level 1 and Level 2 static-obstacle suites across both backbones. Table 1 reports the task-level SR and cost results, while Figure 4 visualizes the change of each method relative to its corresponding base policy. Compared with the base policies, FAILBANK improves both SR andCC policy on both backbones. As shown in Table 1, the unweighted mean SR across the ten tasks increases from 66.0% to 74.5% onπ 0.5 and from 47.5% to 54.4% on π 0 , corresponding to gains of approximately 8.5 and 6.9 percentage points, respectively. MeanCC policy decreases from 47.76 to 30.76 onπ 0.5 and from 10.62 to 8.09 onπ 0 , giving relative reductions of 35.6% and 23.8% over the base policies. Compared with AEGIS runtime shielding, FAILBANK increases mean SR from 49.1% to 74.5% on π 0.5 and from 44.9% to 54.4% onπ 0 , yielding gains of 25.4 and 9.5 percentage points, respectively. Across the ten tasks, FAILBANK achieves meanCC policy of 30.76 onπ 0.5 and 8.09 onπ 0 , compared with 29.01 and 6.27 for AEGIS, respectively. Thus, FAILBANK improves both success and cost relative to the base policies, while its advantage over AEGIS is higher task success at an additional policy-induced cost. Figure 4 makes this joint improvement more explicit. Under the criterion of higher SR and lowerCC policy than base policy, FAILBANK achieves joint improvements in SR andCC policy on 8 task–backbone pairs, compared with 3 for AEGIS. AEGIS more often moves left toward lower cost but also downward toward lower success, particularly on harder tasks. In contrast, FAILBANK improves both objectives on a larger share of tasks. This pattern is also reflected in aggregate BRS, where FAILBANK scores higher than AEGIS on both backbones. 6 Failure-Bank Self-Evolution for Vision-Language-Action ModelsA PREPRINT −100−10−10110 ΔC policy (method − base) −80 −60 −40 −20 0 20 40 ΔSR (%) better on both FailBank · π 0.5 · Level 1 FailBank · π 0.5 · Level 2 AEGIS · π 0.5 · Level 1 AEGIS · π 0.5 · Level 2 FailBank · π 0 · Level 1 FailBank · π 0 · Level 2 AEGIS · π 0 · Level 1 AEGIS · π 0 · Level 2 Figure 4: Success–cost trade-off relative to the base policy. Circles and diamonds denoteπ 0.5 andπ 0 , blue and orange denote FAILBANK and AEGIS, and shade indicates difficulty level. Upward movement means higher success, and leftward movement means lower policy-induced cost. Thus, the shaded upper-left quadrant is better on both. FAILBANK places more points in this joint-improvement region, while AEGIS more often moves left but downward. Table 1: Static-obstacle results across two backbones. Collection happens in Level 1 Mango task while other tasks are unseen during rollout collection. SR is task success rate (%). C is official cumulative cost.C policy is policy-induced cost. Best SR, C policy and BRS values are in bold. π 0.5 π 0 BaseAEGISFAILBANKBaseAEGISFAILBANK Level TaskSR↑ C↓ C policy ↓SR↑ C↓ C policy ↓SR↑ C↓ C policy ↓SR↑ C↓ C policy ↓SR↑ C↓ C policy ↓SR↑ C↓ C policy ↓ 1 Apple90.0 9.120.1282.0 8.200.0090.3 9.210.2154.0 5.400.0082.0 8.200.0059.0 5.900.00 Lemon83.0 44.0735.8778.0 7.810.0181.0 25.9817.8866.0 6.600.0080.0 8.000.0084.0 8.400.00 Mango77.0 74.0866.3868.0 21.0814.2893.7 23.1213.7692.0 11.342.1482.0 9.401.2093.0 12.393.09 Onion 72.0 33.8827.1844.0 9.124.7190.0 31.6323.5028.0 18.3416.7430.0 3.000.0024.0 12.0210.32 Tomato85.0 45.3137.0194.0 17.397.9993.3 34.2825.0456.0 5.600.0044.0 4.400.0084.0 8.460.06 2 Apple8.0 67.5165.897.3 90.7389.2634.2 68.7561.900.0 66.3166.310.0 54.6354.620.3 50.2950.22 Lemon0.0 158.14158.130.0 141.51141.510.0 110.14110.122.0 14.0913.6910.7 7.395.260.3 4.534.46 Mango89.3 51.4133.9388.0 28.7511.1595.1 35.2416.6195.3 22.473.6794.7 19.610.6794.7 24.415.80 Onion81.3 16.330.0671.30.270.00082.7 16.540.00430.7 6.130.0006.7 1.340.00725.3 5.070.000 Tomato74.0 67.8753.0728.7 26.9321.2084.9 55.4438.5550.7 13.753.6119.3 4.810.9579.3 22.676.93 BRS↑0.3680.3500.4980.3680.4410.443 5.3 Generalization across states, tasks, levels, and backbones RQ2 Does the learned policy generalize across states, tasks, levels, and backbones? To answer RQ2, we test whether the learned behavior extends beyond the Level 1 mango collection data. We consider held-out states, unseen tasks, and the harder Level 2 setting, and repeat the update onπ 0 to test a second backbone. Table 1 reports results across both backbones and difficulty levels, while Appendix B.8 details the evaluation splits. On held-out initial states of the Level 1 mango task, FAILBANK raisesπ 0.5 SR from71.1%to93.3%, showing improvement beyond the collection states. Across the four unseen Level 1 tasks, mean SR increases from82.5%to 88.7%, extending the gains beyond the collection task. The improvements also carry over to the harder Level 2 setting, where mean SR rises from 50.5% to 59.4% without any Level 2 rollouts entering the main update bank. 7 Failure-Bank Self-Evolution for Vision-Language-Action ModelsA PREPRINT SuccessFailure Shield in loop Success Failure Observe-only 328 51 Observe- only Shield in loop 0 1500 3000 Failure records 1,500 2,700 88.9% Policy failure Shield-induced 050100 SR (%) Base Correction-only + quiet anchor 65 89 89 02040 C policy 38.61 20.88 16.52 (a) Paired outcomes(b) Failure provenance(c) Task success(d) Policy-induced C Figure 5: Ablations of the collection interface and learning signals. (a) Paired episode outcomes under observe-only and shield-in-loop collection on Level 1 mango task. Rows show observe-only outcomes, while columns show outcomes when shield corrections are executed. (b) Failure records produced on the same task by the two collection modes, separated by policy failures and shield-induced failures. (c–d) Comparison of Base, training on CBF-triggered records (Correction-only), and training with additional successful uncorrected actions (+ quiet anchors), reporting SR and C policy on Level 1 onion task, respectively. To test a second backbone, we apply the same update procedure toπ 0 . Its mean SR increases from51.0%to62.7% across the four unseen Level 1 tasks and from35.7%to40.0%on Level 2. Together, these results provide evidence of transfer across states, tasks, difficulty levels, and VLA backbones. Complete paired tests and task-specific results are reported in Appendix G.1. 6 Discussion We next examine the contribution of each learning component and how iterative self-evolution affects policy updating performance. 6.1 Collection interface and learning signals RQ3 How do observe-only collection and learning signals affect policy updates? To answer RQ3, we remove the key collection and learning components of FAILBANK in turn and examine how each affects the resulting update. Stage 1 ablation: Shield-in-loop collection. Executing the shield changes the rollout distribution from which learning records are collected. As shown in Figure 5(a), executing the shield turns eight otherwise successful policy rollouts into failures while rescuing only five failures, reducing successful episodes from 40 to 37 out of 46. More importantly, Panel (b) shows that 88.9% of the failure records collected with the shield in the loop originate from these shield-induced failures rather than failures of the nominal policy. These records therefore reflect failures induced by the collection process rather than failures of the policy on its original rollout distribution. Observe-only collection avoids this shift and better preserves the failure distribution of the policy being updated. Stage 2 ablation: Removing quiet anchors. Quiet anchors preserve successful policy actions that require no CBF correction, helping prevent the update from overfitting to corrective records and drifting away from already effective behavior. Panels (c) and (d) of Figure 5 isolate this effect by comparing an update trained only on CBF-triggered records with one that additionally includes quiet anchors. The correction-only update raises SR from65%to89%and reduces C policy from38.61to20.88. Adding quiet anchors preserves the same89%SR while further reducingCC policy to 16.52. These results suggest that corrective records drive most of the task-success improvement, while quiet anchors help preserve successful behavior and further reduce safety cost. Further analyses of collection outcomes, failure-record provenance, and learning-signal controls are provided in Appendices C.1, C.2, and C.5. 8 Failure-Bank Self-Evolution for Vision-Language-Action ModelsA PREPRINT 6.2 Number of Accumulated Self-Evolution Rounds RQ4 How does iterative self-evolution affect the success–cost operating point? Base 0 R1 3.7k R2 6.5k R3 15.7k R4 19.1k R5 22.7k Round / bank records 60 70 80 90 SR (%) SRPolicy-induced C 0 10 20 30 40 Policy-induced C Figure 6: Self-evolution across accumulated rounds on Level 1 onion task. The failure bank grows from3.7k records at R1 to22.7k at R5. SR peaks at R2, whereasCC policy reaches its minimum at R3. Later rounds fluctuate while remaining improved over base policy on both axes. We study five accumulated self-evolution rounds on the static-obstacle Level 1 onion task. As the accumulated failure bank grows from3.7k records at Round 1 to22.7k at Round 5, Figure 6 shows a clear evolution of the SR– C policy operating point. The first two rounds improve both objectives relative to Base. Specifically, SR peaks at Round 2, whileCC policy continues to decrease and reaches its minimum at Round 3. The two objectives there- fore reach their best values at different rounds. In later rounds, SR decreases and then partially recovers, while policy-induced C rebounds from its Round 3 minimum and continues to fluctuate. Thus, additional runtime feed- back continues to reshape the learned policy rather than monotonically improving either objective. Importantly, all five rounds remain above Base in SR and below Base in policy-induced C, indicating that the learned improvement persists as the balance between the two objectives changes. 6.3 Limitations Our current implementation targets continuous flow-matching policies, while other action formulations require adapted supervision and guard objectives. We also focus on static obstacles, since dynamic scenes additionally require temporal obstacle prediction and teacher corrections for moving hazards. These extensions concern the form of the teacher and update interface, rather than our central focus on converting runtime feedback into persistent policy improvement. 7 Conclusion FAILBANK turns observe-only runtime feedback into outcome-aware learning records for persistent policy improvement. By accumulating these records across rounds and applying guarded LoRA updates, the framework transfers runtime corrections into the underlying policy without requiring a shield at deployment. Across two flow-matching backbones, FAILBANK improves the joint success–cost operating point and generalizes beyond the collection setting. These results suggest that runtime safety feedback can serve not only as a temporary intervention mechanism, but also as supervision for improving future policy behavior. References Joshua Achiam, David Held, Aviv Tamar, and Pieter Abbeel. Constrained policy optimization, 2017. URLhttps://arxiv. org/abs/1705.10528. Aaron D. Ames, Xiangru Xu, Jessy W. Grizzle, and Paulo Tabuada. Control barrier function based quadratic programs for safety critical systems. IEEE Transactions on Automatic Control, 62(8):3861–3876, 2017. Kevin Black, Noah Brown, Danny Driess, Adnan Esmail, Michael Equi, Chelsea Finn, Niccolo Fusai, Lachy Groom, Karol Hausman, Brian Ichter, et al. π 0 : A vision-language-action flow model for general robot control. arXiv preprint arXiv:2410.24164, 2024. Anthony Brohan, Noah Brown, Justice Carbajal, Yevgen Chebotar, Xi Chen, Krzysztof Choromanski, Tianli Ding, Danny Driess, Avinava Dubey, Chelsea Finn, Pete Florence, Chuyuan Fu, Montse Gonzalez Arenas, Keerthana Gopalakrishnan, Kehang Han, Karol Hausman, Alexander Herzog, Jasmine Hsu, Brian Ichter, Alex Irpan, Nikhil Joshi, Ryan Julian, Dmitry Kalashnikov, Yuheng Kuang, Isabel Leal, Lisa Lee, Tsang-Wei Edward Lee, Sergey Levine, Yao Lu, Henryk Michalewski, Igor Mordatch, Karl Pertsch, Kanishka Rao, Krista Reymann, Michael Ryoo, Grecia Salazar, Pannag Sanketi, Pierre Sermanet, Jaspiar Singh, Anikait Singh, Radu Soricut, Huong Tran, Vincent Vanhoucke, Quan Vuong, Ayzaan Wahid, Stefan Welker, Paul Wohlhart, Jialin Wu, Fei Xia, Ted Xiao, Peng Xu, Sichun Xu, Tianhe Yu, and Brianna Zitkovich. Rt-2: Vision-language-action models transfer web knowledge to robotic control, 2023a. URL https://arxiv.org/abs/2307.15818. Anthony Brohan, Noah Brown, Justice Carbajal, Yevgen Chebotar, Joseph Dabis, Chelsea Finn, Keerthana Gopalakrishnan, Karol Hausman, Alex Herzog, Jasmine Hsu, Julian Ibarz, Brian Ichter, Alex Irpan, Tomas Jackson, Sally Jesmonth, Nikhil J Joshi, Ryan Julian, Dmitry Kalashnikov, Yuheng Kuang, Isabel Leal, Kuang-Huei Lee, Sergey Levine, Yao Lu, Utsav Malla, Deeksha Manjunath, Igor Mordatch, Ofir Nachum, Carolina Parada, Jodilyn Peralta, Emily Perez, Karl Pertsch, Jornell Quiambao, Kanishka Rao, Michael Ryoo, Grecia Salazar, Pannag Sanketi, Kevin Sayed, Jaspiar Singh, Sumedh Sontakke, Austin Stone, Clayton Tan, 9 Failure-Bank Self-Evolution for Vision-Language-Action ModelsA PREPRINT Huong Tran, Vincent Vanhoucke, Steve Vega, Quan Vuong, Fei Xia, Ted Xiao, Peng Xu, Sichun Xu, Tianhe Yu, and Brianna Zitkovich. Rt-1: Robotics transformer for real-world control at scale, 2023b. URLhttps://arxiv.org/abs/2212. 06817. Qingwen Bu, Yanting Yang, Jisong Cai, Shenyuan Gao, Guanghui Ren, Maoqing Yao, Ping Luo, and Hongyang Li. Univla: Learning to act anywhere with task-centric latent actions, 2025. URL https://arxiv.org/abs/2505.06111. Carlos Celemin, Rodrigo P ́ erez-Dattari, Eugenio Chisari, Giovanni Franzese, Leandro de Souza Rosa, Ravi Prakash, Zlatan Ajanovi ́ c, Marta Ferraz, Abhinav Valada, and Jens Kober. Interactive imitation learning in robotics: A survey, 2022. URL https://arxiv.org/abs/2211.00600. Dian Chen, Brady Zhou, Vladlen Koltun, and Philipp Kr ̈ ahenb ̈ uhl. Learning by cheating. In Conference on Robot Learning, volume 100 of Proceedings of Machine Learning Research, p. 66–75, 2020. Cheng Chi, Zhenjia Xu, Siyuan Feng, Eric Cousineau, Yilun Du, Benjamin Burchfiel, Russ Tedrake, and Shuran Song. Diffusion policy: Visuomotor policy learning via action diffusion, 2024. URL https://arxiv.org/abs/2303.04137. Embodiment Collaboration, Abby O’Neill, Abdul Rehman, Abhinav Gupta, Abhiram Maddukuri, Abhishek Gupta, Abhishek Padalkar, Abraham Lee, Acorn Pooley, Agrim Gupta, Ajay Mandlekar, Ajinkya Jain, Albert Tung, Alex Bewley, Alex Herzog, Alex Irpan, Alexander Khazatsky, Anant Rai, Anchit Gupta, Andrew Wang, Andrey Kolobov, Anikait Singh, Animesh Garg, Aniruddha Kembhavi, Annie Xie, Anthony Brohan, Antonin Raffin, Archit Sharma, Arefeh Yavary, Arhan Jain, Ashwin Balakrishna, Ayzaan Wahid, Ben Burgess-Limerick, Beomjoon Kim, Bernhard Sch ̈ olkopf, Blake Wulfe, Brian Ichter, Cewu Lu, Charles Xu, Charlotte Le, Chelsea Finn, Chen Wang, Chenfeng Xu, Cheng Chi, Chenguang Huang, Christine Chan, Christopher Agia, Chuer Pan, Chuyuan Fu, Coline Devin, Danfei Xu, Daniel Morton, Danny Driess, Daphne Chen, Deepak Pathak, Dhruv Shah, Dieter B ̈ uchler, Dinesh Jayaraman, Dmitry Kalashnikov, Dorsa Sadigh, Edward Johns, Ethan Foster, Fangchen Liu, Federico Ceola, Fei Xia, Feiyu Zhao, Felipe Vieira Frujeri, Freek Stulp, Gaoyue Zhou, Gaurav S. Sukhatme, Gautam Salhotra, Ge Yan, Gilbert Feng, Giulio Schiavi, Glen Berseth, Gregory Kahn, Guangwen Yang, Guanzhi Wang, Hao Su, Hao-Shu Fang, Haochen Shi, Henghui Bao, Heni Ben Amor, Henrik I Christensen, Hiroki Furuta, Homanga Bharadhwaj, Homer Walke, Hongjie Fang, Huy Ha, Igor Mordatch, Ilija Radosavovic, Isabel Leal, Jacky Liang, Jad Abou-Chakra, Jaehyung Kim, Jaimyn Drake, Jan Peters, Jan Schneider, Jasmine Hsu, Jay Vakil, Jeannette Bohg, Jeffrey Bingham, Jeffrey Wu, Jensen Gao, Jiaheng Hu, Jiajun Wu, Jialin Wu, Jiankai Sun, Jianlan Luo, Jiayuan Gu, Jie Tan, Jihoon Oh, Jimmy Wu, Jingpei Lu, Jingyun Yang, Jitendra Malik, Jo ̃ ao Silv ́ erio, Joey Hejna, Jonathan Booher, Jonathan Tompson, Jonathan Yang, Jordi Salvador, Joseph J. Lim, Junhyek Han, Kaiyuan Wang, Kanishka Rao, Karl Pertsch, Karol Hausman, Keegan Go, Keerthana Gopalakrishnan, Ken Goldberg, Kendra Byrne, Kenneth Oslund, Kento Kawaharazuka, Kevin Black, Kevin Lin, Kevin Zhang, Kiana Ehsani, Kiran Lekkala, Kirsty Ellis, Krishan Rana, Krishnan Srinivasan, Kuan Fang, Kunal Pratap Singh, Kuo-Hao Zeng, Kyle Hatch, Kyle Hsu, Laurent Itti, Lawrence Yunliang Chen, Lerrel Pinto, Li Fei-Fei, Liam Tan, Linxi ”Jim” Fan, Lionel Ott, Lisa Lee, Luca Weihs, Magnum Chen, Marion Lepert, Marius Memmel, Masayoshi Tomizuka, Masha Itkina, Mateo Guaman Castro, Max Spero, Maximilian Du, Michael Ahn, Michael C. Yip, Mingtong Zhang, Mingyu Ding, Minho Heo, Mohan Kumar Srirama, Mohit Sharma, Moo Jin Kim, Muhammad Zubair Irshad, Naoaki Kanazawa, Nicklas Hansen, Nicolas Heess, Nikhil J Joshi, Niko Suenderhauf, Ning Liu, Norman Di Palo, Nur Muhammad Mahi Shafiullah, Oier Mees, Oliver Kroemer, Osbert Bastani, Pannag R Sanketi, Patrick ”Tree” Miller, Patrick Yin, Paul Wohlhart, Peng Xu, Peter David Fagan, Peter Mitrano, Pierre Sermanet, Pieter Abbeel, Priya Sundaresan, Qiuyu Chen, Quan Vuong, Rafael Rafailov, Ran Tian, Ria Doshi, Roberto Mart ́ ın-Mart ́ ın, Rohan Baijal, Rosario Scalise, Rose Hendrix, Roy Lin, Runjia Qian, Ruohan Zhang, Russell Mendonca, Rutav Shah, Ryan Hoque, Ryan Julian, Samuel Bustamante, Sean Kirmani, Sergey Levine, Shan Lin, Sherry Moore, Shikhar Bahl, Shivin Dass, Shubham Sonawani, Shubham Tulsiani, Shuran Song, Sichun Xu, Siddhant Haldar, Siddharth Karamcheti, Simeon Adebola, Simon Guist, Soroush Nasiriany, Stefan Schaal, Stefan Welker, Stephen Tian, Subramanian Ramamoorthy, Sudeep Dasari, Suneel Belkhale, Sungjae Park, Suraj Nair, Suvir Mirchandani, Takayuki Osa, Tanmay Gupta, Tatsuya Harada, Tatsuya Matsushima, Ted Xiao, Thomas Kollar, Tianhe Yu, Tianli Ding, Todor Davchev, Tony Z. Zhao, Travis Armstrong, Trevor Darrell, Trinity Chung, Vidhi Jain, Vikash Kumar, Vincent Vanhoucke, Vitor Guizilini, Wei Zhan, Wenxuan Zhou, Wolfram Burgard, Xi Chen, Xiangyu Chen, Xiaolong Wang, Xinghao Zhu, Xinyang Geng, Xiyuan Liu, Xu Liangwei, Xuanlin Li, Yansong Pang, Yao Lu, Yecheng Jason Ma, Yejin Kim, Yevgen Chebotar, Yifan Zhou, Yifeng Zhu, Yilin Wu, Ying Xu, Yixuan Wang, Yonatan Bisk, Yongqiang Dou, Yoonyoung Cho, Youngwoon Lee, Yuchen Cui, Yue Cao, Yueh-Hua Wu, Yujin Tang, Yuke Zhu, Yunchu Zhang, Yunfan Jiang, Yunshuang Li, Yunzhu Li, Yusuke Iwasawa, Yutaka Matsuo, Zehan Ma, Zhuo Xu, Zichen Jeff Cui, Zichen Zhang, Zipeng Fu, and Zipeng Lin. Open x-embodiment: Robotic learning datasets and rt-x models, 2025. URL https://arxiv.org/abs/2310.08864. William English, Hao Zheng, and Rickard Ewetz. Neuro-symbolic safety guidance for vision-language-action models via constrained flow matching. arXiv preprint arXiv:2607.01378, 2026. Qiao Gu, Yuanliang Ju, Shengxiang Sun, Igor Gilitschenski, Haruki Nishimura, Masha Itkina, and Florian Shkurti. SAFE: Multitask failure detection for vision-language-action models. In Advances in Neural Information Processing Systems, 2025. Edward J. Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. LoRA: Low-rank adaptation of large language models. In International Conference on Learning Representations, 2022. Songqiao Hu, Zeyi Liu, Shuang Liu, Jun Cen, Zihan Meng, Shihefeng Wang, Xiang Li, and Xiao He. VLSA: Vision-language-action models with plug-and-play safety constraint layer. arXiv preprint arXiv:2512.11891, 2025. 10 Failure-Bank Self-Evolution for Vision-Language-Action ModelsA PREPRINT Michael Kelly, Chelsea Sidrane, Katherine Driggs-Campbell, and Mykel J. Kochenderfer. Hg-dagger: Interactive imitation learning with human experts, 2019. URL https://arxiv.org/abs/1810.02890. Moo Jin Kim, Karl Pertsch, Siddharth Karamcheti, Ted Xiao, Ashwin Balakrishna, Suraj Nair, Rafael Rafailov, Ethan Foster, Grace Lam, Pannag Sanketi, Quan Vuong, Thomas Kollar, Benjamin Burchfiel, Russ Tedrake, Dorsa Sadigh, Sergey Levine, Percy Liang, and Chelsea Finn. Openvla: An open-source vision-language-action model, 2024. URLhttps://arxiv.org/abs/ 2406.09246. Qixiu Li, Yaobo Liang, Zeyu Wang, Lin Luo, Xi Chen, Mozheng Liao, Fangyun Wei, Yu Deng, Sicheng Xu, Yizhong Zhang, Xiaofan Wang, Bei Liu, Jianlong Fu, Jianmin Bao, Dong Chen, Yuanchun Shi, Jiaolong Yang, and Baining Guo. Cogact: A foundational vision-language-action model for synergizing cognition and action in robotic manipulation, 2024a. URL https://arxiv.org/abs/2411.19650. Quanyi Li, Zhenghao Peng, and Bolei Zhou. Efficient learning of safe driving policy via human-ai copilot optimization, 2022. URL https://arxiv.org/abs/2202.10341. Xuanlin Li, Kyle Hsu, Jiayuan Gu, Karl Pertsch, Oier Mees, Homer Rich Walke, Chuyuan Fu, Ishikaa Lunawat, Isabel Sieh, Sean Kirmani, Sergey Levine, Jiajun Wu, Chelsea Finn, Hao Su, Quan Vuong, and Ted Xiao. Evaluating real-world robot manipulation policies in simulation, 2024b. URL https://arxiv.org/abs/2405.05941. Bo Liu, Yifeng Zhu, Chongkai Gao, Yihao Feng, Qiang Liu, Yuke Zhu, and Peter Stone. Libero: Benchmarking knowledge transfer for lifelong robot learning, 2023a. URL https://arxiv.org/abs/2306.03310. Huihan Liu, Shivin Dass, Roberto Mart ́ ın-Mart ́ ın, and Yuke Zhu. Model-based runtime monitoring with interactive imitation learning, 2023b. URL https://arxiv.org/abs/2310.17552. Jiaming Liu, Mengzhen Liu, Zhenyu Wang, Pengju An, Xiaoqi Li, Kaichen Zhou, Senqiao Yang, Renrui Zhang, Yandong Guo, and Shanghang Zhang. Robomamba: Efficient vision-language-action model for robotic reasoning and manipulation, 2024. URL https://arxiv.org/abs/2406.04339. Puze Liu, Kuo Zhang, Davide Tateo, Snehal Jauhri, Zhiyuan Hu, Jan Peters, and Georgia Chalvatzaki. Safe reinforcement learning of dynamic high-dimensional robotic tasks: Navigation, manipulation, interaction, 2023c. URLhttps://arxiv.org/abs/ 2209.13308. Mingyang Lyu, Yinqian Sun, Yiyang Jia, Sicheng Shen, Moquan Sha, Huangrui Li, Feifei Zhao, and Yi Zeng. ForesightSafety-VLA: A unified diagnostic safety benchmark for vision-language-action models. arXiv preprint arXiv:2606.27079, 2026. Ajay Mandlekar, Danfei Xu, Roberto Mart ́ ın-Mart ́ ın, Yuke Zhu, Li Fei-Fei, and Silvio Savarese. Human-in-the-loop imitation learning using remote teleoperation, 2020. URL https://arxiv.org/abs/2012.06733. Oier Mees, Lukas Hermann, Erick Rosete-Beas, and Wolfram Burgard. Calvin: A benchmark for language-conditioned policy learning for long-horizon robot manipulation tasks, 2022. URL https://arxiv.org/abs/2112.03227. Soroush Nasiriany, Abhiram Maddukuri, Lance Zhang, Adeet Parikh, Aaron Lo, Abhishek Joshi, Ajay Mandlekar, and Yuke Zhu. Robocasa: Large-scale simulation of everyday tasks for generalist robots, 2024. URLhttps://arxiv.org/abs/2406. 02523. Karl Pertsch, Kyle Stachowicz, Brian Ichter, Danny Driess, Suraj Nair, Quan Vuong, Oier Mees, Chelsea Finn, and Sergey Levine. Fast: Efficient action tokenization for vision-language-action models, 2025. URLhttps://arxiv.org/abs/2501. 09747. Physical Intelligence, Kevin Black, Noah Brown, James Darpinian, Karan Dhabalia, Danny Driess, Adnan Esmail, Michael Equi, Chelsea Finn, Niccolo Fusai, et al.π 0.5 : A vision-language-action model with open-world generalization. arXiv preprint arXiv:2504.16054, 2025. Stephane Ross, Geoffrey J. Gordon, and J. Andrew Bagnell. A reduction of imitation learning and structured prediction to no-regret online learning, 2011. URL https://arxiv.org/abs/1011.0686. Mustafa Shukor, Dana Aubakirova, Francesco Capuano, Pepijn Kooijmans, Steven Palma, Adil Zouitine, Michel Aractingi, Caroline Pascal, Martino Russi, Andres Marafioti, Simon Alibert, Matthieu Cord, Thomas Wolf, and Remi Cadene. Smolvla: A vision- language-action model for affordable and efficient robotics, 2025. URL https://arxiv.org/abs/2506.01844. Tom Silver, Kelsey Allen, Josh Tenenbaum, and Leslie Kaelbling. Residual policy learning, 2019. URLhttps://arxiv.org/ abs/1812.06298. Octo Model Team, Dibya Ghosh, Homer Walke, Karl Pertsch, Kevin Black, Oier Mees, Sudeep Dasari, Joey Hejna, Tobias Kreiman, Charles Xu, Jianlan Luo, You Liang Tan, Lawrence Yunliang Chen, Pannag Sanketi, Quan Vuong, Ted Xiao, Dorsa Sadigh, Chelsea Finn, and Sergey Levine. Octo: An open-source generalist robot policy, 2024. URLhttps://arxiv.org/abs/ 2405.12213. 11 Failure-Bank Self-Evolution for Vision-Language-Action ModelsA PREPRINT Brijen Thananjeyan, Ashwin Balakrishna, Suraj Nair, Michael Luo, Krishnan Srinivasan, Minho Hwang, Joseph E. Gonzalez, Julian Ibarz, Chelsea Finn, and Ken Goldberg. Recovery rl: Safe reinforcement learning with learned recovery zones, 2021. URL https://arxiv.org/abs/2010.15920. Jakob Thumm and Matthias Althoff. Provably safe deep reinforcement learning for robotic manipulation in human environments, 2022. URL https://arxiv.org/abs/2205.06311. Junjie Wen, Yichen Zhu, Jinming Li, Minjie Zhu, Kun Wu, Zhiyuan Xu, Ning Liu, Ran Cheng, Chaomin Shen, Yaxin Peng, Feifei Feng, and Jian Tang. Tinyvla: Towards fast, data-efficient vision-language-action models for robotic manipulation, 2025. URL https://arxiv.org/abs/2409.12514. Borong Zhang, Yuhao Zhang, Jiaming Ji, Yingshan Lei, Yishuai Cai, Josef Dai, Yuanpei Chen, and Yaodong Yang. SafeVLA: Towards safety alignment of vision-language-action model via constrained learning. arXiv preprint arXiv:2503.03480, 2025. Borong Zhang, Jiahao Li, Jiachen Shen, Yuhao Zhang, Yishuai Cai, et al. VLA-arena: An open-source framework for benchmarking vision-language-action models. In International Conference on Machine Learning, 2026. Tony Z. Zhao, Vikash Kumar, Sergey Levine, and Chelsea Finn. Learning fine-grained bimanual manipulation with low-cost hardware, 2023. URL https://arxiv.org/abs/2304.13705. 12 Failure-Bank Self-Evolution for Vision-Language-Action ModelsA PREPRINT Appendix Outline ADetailed Related Work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 A.1Generalist Vision-Language-Action Policies. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 A.2Runtime Shields and Constrained Action Generation . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 A.3Safety Alignment and Failure Monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 A.4Safety Benchmarks and Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 A.5Runtime Feedback as Policy Supervision . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 BVLA-Arena Scope and Task Coverage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 B.1Benchmark Hierarchy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 B.2Evaluation Metrics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 B.3Complete Per-Task Results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 B.4Base-Relative Score: Definition and Limitations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 B.5Training and Evaluation Levels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 B.6Backbone Scope . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 B.7Task Coverage and Names . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 B.8Generalization Across States, Tasks, and Levels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 B.9Scope Boundary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 B.9.1Hazard-Avoidance Validity and Headroom . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 B.10 Dynamic-Obstacle Stress Tests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 CCollection and Failure-Bank Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 C.1Collection-Mode Outcome Counts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 C.2Failure-Record Provenance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 C.3Pre-Contact Correction Signal . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 C.4Adapter-Level Collection Ablation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 C.5Attribution Controls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 C.6Privileged Teacher Executed In Loop. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 DDeployment Boundary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 D.1Deployment Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 EAdditional Training and Self-Evolution Diagnostics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 E.1Implementation and Training Details . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 E.1.1Barrier Teacher . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 E.1.2Outcome-Aware Record Weight . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 E.1.3Record Admission . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 E.2Bank and Evaluation Ledger . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 E.3Host Matching and Hardware Confounding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 E.4Update Recipes and Training Budgets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 E.5Bank-Construction Audit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 E.6Constraint-Activation Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 E.7Held-Out Guard Diagnostics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 E.7.1Guard-Threshold Sensitivity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 E.7.2Training Duration and Guard Conservatism. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 E.7.3Quiet Anchors and Chunk Supervision . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 E.7.4Record and Teacher Threshold Sensitivity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 E.7.5Rejected-Update Diagnostics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 E.8Diagnostics of the Dynamic-Obstacle Null Result. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 FCompletion Timing and Cost Distributions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 F.1Behavior Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 F.2Policy–Shield Coordination and Collapse . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 F.3Completion Timing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 F.4Policy-Induced C Distributions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 F.5Completion-Coupled Cost on Onion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 13 Failure-Bank Self-Evolution for Vision-Language-Action ModelsA PREPRINT GDetailed Statistical Results and Archive Eligibility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 G.1Out-of-Sample Breadth and Ablation Tests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 G.1.1 Effect Sizes with Bootstrap Intervals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 G.2Offset-Paired Level 2 Statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 G.3Archive Eligibility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 A Detailed Related Work A.1 Generalist Vision-Language-Action Policies Scalable robot-policy pretraining began to connect large, heterogeneous robot datasets with transformer policies. RT-1 demonstrated real-world control at scale, while RT-2 transferred visual-language knowledge into robotic actions (Brohan et al., 2023b;a). Open X-Embodiment broadened this direction through cross-embodiment data and RT-X models (Collaboration et al., 2025). Octo and OpenVLA further provided open generalist policies for manipulation (Team et al., 2024; Kim et al., 2024). The broader design space includes efficient state-space architectures, compact policies, cognition–action decoupling, tokenized actions, and latent actions (Liu et al., 2024; Wen et al., 2025; Li et al., 2024a; Pertsch et al., 2025; Shukor et al., 2025; Bu et al., 2025). Diffusion Policy and Action Chunking with Transformers provide related precedents for continuous generative control and chunked imitation learning (Chi et al., 2024; Zhao et al., 2023). π 0 uses flow matching for continuous action generation (Black et al., 2024), whileπ 0.5 extends this family toward broader open-world generalization (Physical Intelligence et al., 2025). These models provide the flow-matching policy backbones studied in our experiments. FAILBANK does not modify their action-generation architecture. It studies how runtime evidence becomes persistent supervision for the underlying policy. A.2 Runtime Shields and Constrained Action Generation Control barrier functions, abbreviated as CBFs, define safety constraints over system states and commonly use a quadratic program to project a nominal control onto a constraint-satisfying action (Ames et al., 2017). AEGIS applies this pattern to VLA control by grounding protected objects and applying CBF-based projection before execution (Hu et al., 2025). Neuro-symbolic safety guidance instead incorporates constraints directly into flow-matching action generation (English et al., 2026). Beyond VLA control, constrained policy optimization incorporates constraints into policy learning, and Recovery RL separates task behavior from a learned recovery policy (Achiam et al., 2017; Thananjeyan et al., 2021). Safety layers have also been studied for robotic manipulation in human environments and for dynamic high-dimensional robot tasks (Thumm & Althoff, 2022; Liu et al., 2023c). These approaches establish constraint enforcement during either policy learning or action execution. FAILBANK uses the corrective signal differently. The CBF projection acts only as an observe-only teacher during collection. The nominal policy controls the rollout, while the counterfactual correction is recorded but not executed. The retained feedback is then used to update the policy for subsequent rollouts and shield-free deployment. A.3 Safety Alignment and Failure Monitoring A complementary line of work incorporates safety into policy learning or detects unsafe behavior during execution. SafeVLA combines risk elicitation with constrained reinforcement learning to align task behavior and safety objectives (Zhang et al., 2025). SAFE learns multitask failure detectors from internal VLA representations and supports runtime responses to predicted failures (Gu et al., 2025). Model-based runtime monitoring has also been coupled with interactive imitation learning so that execution-time signals inform subsequent policy improvement (Liu et al., 2023b). FAILBANK learns from corrections already produced by a safety teacher. Teacher proposals and rollout outcomes form explicit learning records. Successful uncorrected actions provide quiet anchors, and the adapter guard bounds held-out flow-loss degradation and first-action drift. A.4 Safety Benchmarks and Evaluation Robot-learning benchmarks measure complementary aspects of generalization.CALVIN evaluates language- conditioned long-horizon manipulation, LIBERO studies knowledge transfer in lifelong learning, SimplerEnv evaluates real-world robot policies in simulation, and RoboCasa provides large-scale simulation of everyday tasks (Mees et al., 2022; Liu et al., 2023a; Li et al., 2024b; Nasiriany et al., 2024). VLA-Arena adds controlled Safety, Distractor, Extrapolation, and Long-Horizon categories with hierarchical difficulty levels and official success and cumulative-cost 14 Failure-Bank Self-Evolution for Vision-Language-Action ModelsA PREPRINT metrics (Zhang et al., 2026). ForesightSafety-VLA complements endpoint metrics with a diagnostic taxonomy of safety failures across the VLA pipeline (Lyu et al., 2026). Together, these efforts motivate evaluating task completion together with safety-related behavior rather than success alone. Our experiments retain VLA-Arena’s official task definitions, success predicates, and C aggregation. We report policy-induced C as a labelled diagnostic decomposition of benchmark C because some Arena instances contain cost already present in the recorded initial state. Appendix B.2 provides the exact definitions. A.5 Runtime Feedback as Policy Supervision DAgger established the principle of collecting corrective labels on the learner’s own state distribution (Ross et al., 2011). Interactive imitation learning extends this idea through intermittent expert feedback, including intervention-based HG-DAgger and remote-teleoperation correction (Celemin et al., 2022; Kelly et al., 2019; Mandlekar et al., 2020). Human–AI copilot methods similarly use intervention to improve a task policy, while residual policy learning represents corrections as a learned addition to an existing controller (Li et al., 2022; Silver et al., 2019). Privileged learning allows a teacher to use information unavailable to the deployed student (Chen et al., 2020). In our setting, privileged simulator geometry is available to the collection-time teacher, while the deployed policy receives only RGB observations and proprioception. Low-rank adaptation provides a parameter-efficient mechanism for updating the frozen VLA backbone (Hu et al., 2022). These established components form the four-stage FAILBANK loop: observe and label, admit and weight, accumulate, and update. Policy-controlled rollouts expose the current behavior distribution. Outcome-aware selection converts counterfactual corrections into provenance-bearing learning records. The failure bank retains records across collection rounds, and a held-out guard determines whether a candidate policy update is accepted. The loop uses runtime safety feedback to supervise future policy behavior. B VLA-Arena Scope and Task Coverage B.1 Benchmark Hierarchy VLA-Arena contains 170 tasks in 11 suites spanning Safety, Distractor, Extrapolation, and Long-Horizon categories. Each of the five Safety suites has five tasks at each of three hierarchical levels. L0 contains basic tasks with clear objectives, L1 introduces intermediate complexity, and L2 contains the most challenging scenarios. We use the official task definitions, success conditions, and C aggregation without modifying their semantics. B.2 Evaluation Metrics The equations below define SR, official C, and its policy-induced decomposition. BRS uses Equation 7, with SR expressed as a fraction. Appendix B.4 explains its normalization, undefined-denominator cases, and uncertainty estimates. LetNbe the number of evaluation trials,s n ∈0, 1the benchmark success indicator for trialn, andT n its number of executed control steps, capped at 300. Letc n,t be VLA-Arena’s benchmark C at stept, and letc init n be the cost attributed to the recorded initial state. We compute SR = 100 N N X n=1 s n ,C = 1 N N X n=1 T n X t=1 c n,t ,(8) and the diagnostic decomposition C policy = 1 N N X n=1 T n X t=1 c n,t − c init n ! , C init = 1 N N X n=1 c init n , C = C init + C policy . (9) Failures, timeouts, and zero-cost trials all remain in the denominatorN. Reported task-level values are arithmetic means over the stated matched initial states. When a protocol repeats sampler-advance conditions for the same initial state, those repeats are first averaged within that state before a paired test. Policy-induced C is labelled as a diagnostic decomposition and never replaces the official benchmark metric. 15 Failure-Bank Self-Evolution for Vision-Language-Action ModelsA PREPRINT B.3 Complete Per-Task Results Table 2 reports all five static-obstacle tasks at both levels for each backbone. Official SR and C are shown alongside the diagnostic policy-induced cost and BRS. Guard-rejected training orders are excluded from the reported FAILBANK mean, as specified in the caption. Table 2: VLA-Arena static-obstacle results across two backbones. Cost cells report officialCCfollowed by diagnosticCC policy . BRS summarizes base-relative failure and policy-induced cost. Dashes denote undefined BRS when the base policy-induced cost is zero. FAILBANK averages three training orders onπ 0.5 and the two of three that pass the training guard onπ 0 . L1-T2 is the collection task. L2-T1 is a floor task on both backbones, and so is L2-T0 on π 0 . BaseAEGISFAILBANK Backbone Level TaskSR↑ C / C policy ↓ BRS↑ SR↑ C / C policy ↓ BRS↑ SR↑ C / C policy ↓ BRS↑ Safety / Static obstacles: pick the named object and place it in the bowl or plate π 0.5 1T0 Apple90.09.12 / 0.12 0.368 82.08.20 / 0.00 0.407 90.39.21 / 0.21 0.261 T1 Lemon83.044.07 / 35.87 0.368 78.07.81 / 0.01 0.524 81.025.98 / 17.88 0.446 T2 Mango77.074.08 / 66.38 0.368 68.021.08 / 14.28 0.448 93.723.12 / 13.76 0.786 T3 Onion72.033.88 / 27.18 0.368 44.09.12 / 4.71 0.337 90.031.63 / 23.50 0.543 T4 Tomato 85.045.31 / 37.01 0.368 94.017.39 / 7.99 0.735 93.334.28 / 25.04 0.571 2T0 Apple8.067.51 / 65.89 0.3687.390.73 / 89.26 0.307 34.268.75 / 61.90 0.437 T1 Lemon0.0158.14 / 158.13 0.3680.0141.51 / 141.51 0.3880.0110.14 / 110.12 0.428 T2 Mango89.351.41 / 33.93 0.368 88.028.75 / 11.15 0.483 95.135.24 / 16.61 0.623 T3 Onion81.316.33 / 0.067 0.3681.30.27 / 0.000 0.071 82.716.54 / 0.004 0.608 T4 Tomato 74.067.87 / 53.07 0.368 28.726.93 / 21.20 0.208 84.955.44 / 38.55 0.520 π 0 1T0 Apple54.05.40 / 0.00– 82.08.20 / 0.00– 59.05.90 / 0.00– T1 Lemon66.06.60 / 0.00– 80.08.00 / 0.00– 84.08.40 / 0.00– T2 Mango92.011.34 / 2.14 0.368 82.09.40 / 1.20 0.245 93.012.39 / 3.09 0.314 T3 Onion28.018.34 / 16.74 0.368 30.03.00 / 0.00 0.615 24.012.02 / 10.32 0.433 T4 Tomato 56.05.60 / 0.00– 44.04.40 / 0.00– 84.08.46 / 0.06– 2T0 Apple0.066.31 / 66.31 0.3680.054.63 / 54.62 0.4020.350.29 / 50.22 0.416 T1 Lemon2.014.09 / 13.69 0.368 10.77.39 / 5.26 0.5230.34.53 / 4.46 0.511 T2 Mango95.322.47 / 3.67 0.368 94.719.61 / 0.67 0.515 94.724.41 / 5.80 0.256 T3 Onion30.76.13 / 0.000–6.71.34 / 0.007– 25.35.07 / 0.000– T4 Tomato 50.713.75 / 3.61 0.368 19.34.81 / 0.95 0.387 79.322.67 / 6.93 0.311 B.4 Base-Relative Score: Definition and Limitations Equation 7 combines two dimensionless quantities. The first is the method-to-base failure-rate ratio, and the second is the method-to-base policy-induced C ratio. The two terms receive equal weight, so there is no fitted trade-off parameter. The base score ise −1 ≈ 0.368, and an ideal policy with no failure and no policy-induced contact scores 1. BRS is a base-relative summary score. It is not a collision-avoidance guarantee or a standalone safety metric. Table 3 reports 2,000 offset-level bootstrap samples. The three methods share the same resampled offsets, andπ 0.5 FAILBANK first averages its three training orders within each offset on both levels. Confidence intervals therefore quantify uncertainty in each task-specific score rather than treating repeated sampler conditions as independent trials. The score was selected after inspecting L1-T0–T4 and L2-T0, T2, and T3. L2-T1 and L2-T4 were evaluated afterward and provide checks on tasks whose outcomes were not used to select the score definition. Using the three-order mean on both levels, FAILBANK attains higher BRS than AEGIS on seven of tenπ 0.5 tasks, including both held-out tasks. AEGIS scores higher on L1-T0, L1-T1, and L1-T4. Small base denominators makeBRSunstable. L1-T0 has a base failure rate of10%and base policy-induced C of 0.12, which yields a wide interval for FAILBANK. L2-T3 has base policy-induced C of only 0.067, and only 1,273 of 2,000 bootstrap resamples have a nonzero cost denominator; BRS is undefined in the remaining resamples. On L2-T1, every method has zero SR, soBRSis determined entirely by C. BRS should therefore be interpreted alongside SR, official C, and policy-induced C, with its denominator sensitivity made explicit. Theπ 0 comparison was evaluated after the definition of BRS was fixed, so it also tests the score without backbone- specific retuning. The base policy-induced C is zero on L1-T0, L1-T1, L1-T4, and L2-T3. We retain dashes for 16 Failure-Bank Self-Evolution for Vision-Language-Action ModelsA PREPRINT Table 3: Per-task BRS with 95% bootstrap intervals. L2-T1 and L2-T4 were evaluated after the score was defined. TaskBaseAEGIS [95% CI] FAILBANK [95% CI] L1-T0 Apple0.368 0.407 [0.109, 0.707]0.261 [0.004, 0.535] L1-T1 Lemon0.368 0.524 [0.299, 0.723]0.446 [0.250, 0.619] L1-T2 Mango0.368 0.448 [0.268, 0.613]0.786 [0.657, 0.888] L1-T3 Onion0.368 0.337 [0.199, 0.459]0.543 [0.427, 0.649] L1-T4 Tomato 0.368 0.735 [0.493, 0.926]0.571 [0.341, 0.754] L2-T0 Apple0.368 0.307 [0.243, 0.363]0.437 [0.374, 0.492] L2-T1 Lemon0.368 0.388 [0.366, 0.408]0.428 [0.401, 0.452] L2-T2 Mango0.368 0.483 [0.173, 0.731]0.623 [0.359, 0.789] L2-T3 Onion0.368 0.071 [0.019, 0.147]0.608 [0.494, 0.711] L2-T4 Tomato 0.368 0.208 [0.113, 0.302]0.520 [0.416, 0.618] these undefined scores rather than substituting C or adding a denominator offset. Table 4 reports the AEGIS intervals from the completed cross-backbone comparison. These values should be read alongside the task success rates, not as evidence of universal method dominance. Table 4: AEGIS BRS on π 0 tasks with defined normalization. TaskBase BRSAEGIS BRS [95% CI] L1-T2 Mango0.3680.245 [0.009, 0.607] L1-T3 Onion0.3680.615 [0.564, 0.663] L2-T0 Apple0.3680.402 [0.350, 0.446] L2-T1 Lemon0.3680.523 [0.438, 0.609] L2-T2 Mango0.3680.515 [0.209, 0.766] L2-T4 Tomato0.3680.387 [0.271, 0.502] Across ten tasks, BRS computed from unweighted mean SR and policy-induced C is 0.498 forπ 0.5 FAILBANK, with a bootstrap interval from 0.469 to 0.529. AEGIS scores 0.350, with an interval from 0.319 to 0.382. Onπ 0 , the corresponding scores are 0.443 and 0.441, with intervals from 0.402 to 0.476 and from 0.401 to 0.475. The bootstrap probability that FAILBANK scores higher than AEGIS is 0.55. The intervals overlap and do not support a BRS advantage onπ 0 . Aggregate BRS uses suite-level mean denominators. Per-task BRS retains dashes where the task-specific base denominator is zero. Neither comparison establishes that FAILBANK is safer than AEGIS. B.5 Training and Evaluation Levels All arms inherit the Arena-published VLA checkpoints finetuned on L0 demonstrations. Level 0 is therefore the source difficulty represented in the released checkpoints rather than a held-out test of feedback-driven improvement. We use Level 1 to measure adaptation beyond that source and Level 2 to test transfer to the hardest benchmark difficulty. FAILBANK then performs a distinct self-evolution stage. Two observe-only rounds are collected on 47 L1 static-obstacle T2 cells and merged into the main round-2 bank. No L2 rollout enters this bank, so every L2 result is zero-shot with respect to the main policy-update data. A separate state-holdout protocol trains on L1-T2 offsets 0–31 and evaluates 32–49. Its existing adapter and base are evaluated on the same GPU host. On the 18 unseen initial states, the host-matched comparison gives93.3%SR for FAILBANK and71.1%for base. The policy-induced C difference is not supported by the paired test. B.6 Backbone Scope We audited the complete VLA-Arena leaderboard before selecting the reported backbones. The audit covered 29 listed models, of which 10 released Arena-finetuned checkpoints. A candidate had to satisfy three conditions. Each candidate required an available Arena checkpoint, a continuous flow-matching loss compatible with first-action supervision and the guard, and usable baseline task behavior with measurable headroom. Table 5 records the resulting scope. Rows that group model variants account for all 10 released checkpoints. The architectural boundary is clearest forπ 0 -FAST (Pertsch et al., 2025). Its Arena checkpoint loads successfully and its baseline is not saturated, with 91 of 150 audited cells remaining improvable. However, its parameter tree has 32 leaves instead of the 50 leaves inπ 0 and contains none of the continuous action-expert parameters used by our update. 17 Failure-Bank Self-Evolution for Vision-Language-Action ModelsA PREPRINT Table 5: Audit of Arena-finetuned backbone candidates. Inapplicable models are architectural exclusions rather than negative method results. ModelArena L1 SR Action interfaceScope decision π 0.5 -FFT0.64Flow matchingMain backbone with complete matched evaluation π 0 / π 0 -FFT0.74 / 0.76Flow matchingSecond backbone with complete matched evaluation π 0 -FAST / -FFT0.40 / 0.60FAST tokensInapplicable because the chunk-level continuous action loss is absent OpenVLA0.60Discrete autoregressiveInapplicable to the current loss and guard OpenVLA-OFT0.20Discrete autoregressiveInapplicable to the current loss and guard UniVLA0.42Autoregressive latent action Inapplicable to the current loss and guard SmolVLA0.00Flow matchingExcluded because the Arena baseline has no viable L1 task behavior LangForce0.72DiffusionOutside the shared openpi training and serving stack Its loss reduces the token axis to one scalar per batch element. The present supervision requires a loss indexed by action-chunk step. The attempted update therefore stops at the first loss-shape check before an adapter or evaluation result is produced. OpenVLA and UniVLA are excluded for the same objective-level incompatibility (Kim et al., 2024; Bu et al., 2025). SmolVLA exposes a flow-matching interface, but its released Arena checkpoint has zero L1 success and uses a different in-process serving path (Shukor et al., 2025). Transferring the recipe fromπ 0.5 toπ 0 also required a stronger quiet-record regularizer. Theπ 0 update passed the fixed guard at a quiet-anchor weight of 0.5, whereas weights from 0 to 0.3 did not. Extending supervision from the first action to 10 or 50 chunk steps reduced the guard loss ratio but did not improve five-task success, indicating that guard passage alone was not sufficient. The reported method comparison is therefore restricted to the two backbones with a complete matched update-and-evaluation chain. The completedπ 0 comparison adds AEGIS on all five Level 1 tasks. Each task uses 50 initial states. The comparison also evaluates base, AEGIS, and the guarded adapter on all five Level 2 tasks. Each Level 2 task uses 50 states with three sampler conditions. The 3,500 added evaluation cells pass the host and architecture checks, and all 1,000 AEGIS cells report successful perception. The restored adapter checkpoint matches the audited source checkpoint in every cell. Level 1 base and adapter references share qa-l40s-004 with the added AEGIS arm, while Level 2 comparisons use their matched task hosts. This audit establishes comparison provenance, not an attribution of gains to shield corrections. The π 0 Level 2 apple and lemon rows satisfy the registered floor criterion and are reported without method conclusions. B.7 Task Coverage and Names Table 6 distinguishes matched method comparisons, held-out evaluations, and exploratory base-only probes. Task indices are interpreted within their suite and difficulty level. Table 6: Complete ledger of reported and exploratory task coverage. Base-only checks are not method comparisons. EvidenceSuite / levelTasksProtocol Main staticstatic obstacles / L1T0–T4base, AEGIS, FAILBANK, 50 states State holdoutstatic obstacles / L1T2train 32 states, test 18 unseen states Zero-shot staticstatic obstacles / L2T0–T4base, AEGIS, 3 FAILBANK orders Static roundsstatic obstacles / L1T3base and R1–R5, 50 states Dynamic stress test dynamic obstacles / L1T3, T4base and learned policies, 18 states Dynamic roundsdynamic obstacles / L2T0base and R1–R3, 50 states Backbone transferstatic obstacles / L1, L2T0–T4 π 0 base / AEGIS / FAILBANK Exploratory checks 3 other Safety suites / L2 all T0–T4 base only, 20 states Static-obstacle task indices T0–T4 manipulate apple, lemon, mango, onion, and tomato, respectively, placing the named object in a bowl or plate while avoiding a protected external object. Dynamic-obstacle T0 picks and places an apple. T1–T4 push lemon, onion, peach, and tomato, respectively, while an obstacle can move through the workspace. Thus “hard apple,” “mango,” and “onion” in the main text are task names within a fixed suite and level, not new metrics. The original Level 2 evaluation used T0, T2, and T3 to diagnose AEGIS obstacle selection under heterogeneous, earlier-tested scene configurations. It was not designed as a coverage sample. Before reading the remaining outcomes, we added T1 and T4 under the same 50-offset, three-condition protocol and registered the decision rule. T4 reproduces the zero-shot transfer gain in two of three training orders with no significant regression in any order. T1 satisfies the registered floor criterion because base and all three updated policies obtain zero SR, so we report it for coverage without drawing a method conclusion. 18 Failure-Bank Self-Evolution for Vision-Language-Action ModelsA PREPRINT B.8 Generalization Across States, Tasks, and Levels Table 7 separates unseen initial states, tasks, and difficulty levels. The state-holdout adapter trains on L1-T2 initial-state offsets 0–31 and is evaluated on offsets 32–49. The main cross-task and Level 2 evaluations use the L1-T2 collection bank described in Appendix B.5. No Level 2 rollout enters that bank. Table 7: Three widening generalization radii. Only L1-T2 rollouts enter the self-evolution bank. Split details are given above. RadiusTraining exposureEvaluationResult Unseen statesL1-T2 training statesheld-out L1-T2 statesSR 71.1%→ 93.3% Unseen tasksL1-T2 onlyother Level 1 tasks on π 0.5 mean SR and paired test in Table 25 Unseen levelLevel 1 onlyLevel 2 T0–T4apple/tomato gains, mango/onion preserved, lemon floor B.9 Scope Boundary Our complete three-arm method evaluation uses the static-obstacle suite. VLA-Arena has eleven task categories. They comprise five Safety, two Distractor, three Extrapolation, and one Long-Horizon category, in addition to five original LIBERO suites. All five Safety suites define a cost predicate, but their constraints differ substantially. Static Distractor, all three Extrapolation categories, Long Horizon, and the five LIBERO suites contain no benchmark cost predicate. Dynamic Distractor has contact costs but was not evaluated. Its moving hazards share the snapshot-geometry issue examined in the dynamic stress tests. Table 8 preserves the complete category audit. Table 8: Evaluation-scope audit from BDDL predicates and measured probes. The count column gives the number of tasks with a cost predicate followed by the number of tasks inspected. A missing cost predicate provides no benchmark cost axis. It is not a negative method result. CategorySuiteCost semanticsCountMeasured evidenceEvaluation status SafetyStatic obstaclesFall and contact with protected external bodies 10/15Complete matched three-arm resultsMain method comparison SafetyDynamic obstacles Contact with moving bodies and fall 15/15 Base L1-T0 SR 95%, dynamic transfer fails Negative stress test SafetyCautious grasp Part-level gripper distance to target itself 15/15 Base SR 0/100.Oracle hazard set empty Floor and unrepresented con- straint SafetyState preservationContainment predicates10/15Base SR 66/100. Zero action rewrites in 196 AEGIS chunks Incompatible avoidance se- mantics SafetyHazard avoidanceSurface-distance dwell cost near stove/candle and fall 15/15Initial objects in cost region 42–50/50. VLM misidentifies both preliminary va- lidity cells Teacher pilot and AEGIS va- lidity gate fail DistractorStatic distractorsNo cost predicate0/15BDDL auditNo benchmark cost axis DistractorDynamic distractorsContact with moving toys10/15 Not evaluated. Motion lasts 50–75 steps, 0.5–0.65 m travel Unevaluated moving-hazard suite Extrapolation Preposition combinations / task workflows / unseen ob- jects No cost predicate0/45BDDL audit, 15 tasks per categoryNo benchmark cost axis Long HorizonLong horizonNo cost predicate0/20BDDL auditNo benchmark cost axis LIBERO Spatial / object / goal / 10 / 90 No cost predicate0/130BDDL auditNo benchmark cost axis An external-body contact-avoidance teacher represents the static/dynamic obstacle constraints. Cautious Grasp instead constrains the manipulated object’s parts, and State Preservation constrains containment. The latter’s extracted “hazard” is the water itself, so repelling it does not preserve containment. Hazard Avoidance counts dwell time in a region occupied by the task’s starting object and often its destination. Among the obstacle suites, the tested dynamic baseline has little headroom and the method fails to transfer. These observations motivate the static-obstacle comparison. They do not establish that the method works in every static scene or fails on every untested suite. C is compared only within the same suite and cost semantics. B.9.1 Hazard-Avoidance Validity and Headroom Hazard Avoidance charges each step for an object or gripper lying within a fixed surface distance of a stove or candle. Fall is evaluated at episode end. The object already lies in the cost region in 42–50 of 50 initial states per task, and several destination containers lie there as well. A repelling barrier therefore conflicts with grasping or placing the object. The lift-gated withdrawal-teacher pilot leaves L2-T0 SR unchanged at 48.0%. It reduces L2-T4 SR from 48.0% to 19 Failure-Bank Self-Evolution for Vision-Language-Action ModelsA PREPRINT 8.0%. The paired test gives ap-value of0.002. Its lower L2-T4 cost reflects failed completion, not safer successful manipulation. It fails the preregistered two-task gate, so no FAILBANK update is trained for this suite. The completed base evaluation covers both backbones, two levels, and all five tasks per level. This design covers 20 base-policy task arms and 1,000 initial-state offsets. These base-only results do not constitute a paired method comparison. Ten arms have base SR of at most5%. AEGIS is checked only in two preliminary validity cells,π 0 L1-T0 for the candle task and L1-T1 for the stove task. Both have successful perception status and nonempty cropped point clouds. The point clouds contain 626 and 4,243 points, respectively. The shield activates constraints on 9 and 31 steps, with no infeasible QP, but GLM-4.5V identifies the obstacle as “black wine bottle” in both cells. This fails the preregistered semantic gate requiring stove or candle identification. AEGIS is therefore not run in a full comparison on this suite. This is a grounding failure rather than a failed perception crop. Table 9 reports the base results without implying a method comparison. Hazard-Avoidance cost values are not pooled with static-obstacle costs. Table 9: Hazard-Avoidance base-policy headroom. The evaluation includes all 20 base-policy task arms and 50 offsets per arm. C is the archived official cost; the final column reports the archived policy-induced cost. These columns use different scales and cannot be interpreted as the additive decomposition in Equation 9. Cost-unit reconciliation is required before comparing them. LevelTaskπ 0.5 baseπ 0 base SRCCLogged policy costSRCCLogged policy cost L1T09.016.75334.94.015.99319.7 T10.021.55430.62.016.68333.2 T262.08.09161.82.011.12222.3 T334.015.79315.6 12.020.36406.8 T40.020.67413.5 0.022.40448.0 L2T038.714.20284.00.717.58350.7 T114.019.91397.80.018.39366.9 T221.314.41288.00.719.83396.1 T348.716.51330.3 0.722.67453.3 T440.011.61232.2 76.012.70254.1 B.10 Dynamic-Obstacle Stress Tests A base-only L1-T0 probe reaches 95% SR, with zero policy-induced C on 19 of 20 cells, providing evidence of limited baseline headroom. We test whether the static L1-T2 update transfers to dynamic obstacles. On 18 matched L1-T3 states, base and the main adapter reach55.6%and72.2%SR, but the paired result is inconclusive. On L1-T4 both reach5.6%SR. Pooled across the two tasks, the main adapter records 6 improvements, 3 regressions, and 27 ties. The paired test gives a p-value of 0.5078. These results do not establish transfer from the static teacher to dynamic tasks. A separate diagnostic adapter trained on dynamic L2-T0 data reaches72.2%on L1-T3 and16.7%on L1-T4. Neither task-level comparison is supported by the paired tests, so these rows are not included in the paper’s generalization pool. The controlled L2-T0 round study is also null against base. Matching the first round to the later 700-step budget leaves it at86.0%SR, significantly above round two at70.0%. The comparison contains 10 improvements and 2 regressions, and the paired test gives ap-value of0.0386. The decline persists after matching the update budget, so a budget difference alone does not explain it. At the short horizons consumed by the dynamic barrier, first-order extrapolation error is only10–29%of the oracle hazard radius even with simulator-truth velocity. This diagnostic indicates limited prediction headroom at the measured horizons when simulator-truth velocity is available. It does not test learned perception or longer-horizon planning, which the current barrier interface does not consume. C Collection and Failure-Bank Analysis C.1 Collection-Mode Outcome Counts Figure 7 compares observe-only and shield-in-loop collection on the same Level 1 mango initial states. Across the 46 paired cells, 32 succeed under both collection modes, five failures are rescued by steering, eight successes become failures under steering, and one cell fails under both. The comparison shows that executing the shield changes the trajectory outcomes from which learning records are collected. 20 Failure-Bank Self-Evolution for Vision-Language-Action ModelsA PREPRINT SuccessFailure Shield in loop Success Failure Observe-only 328 51 (a) Paired outcomes Observe- only Shield in loop 0 1500 3000 Failure records 1,500 2,700 88.9% (b) Failure-record origins Fails observe-onlySucceeds observe-only Observe- only Shield in loop 0 250 500 Early pre-contact records 430 163 (c) Pre-contact signal Figure 7: Observe-only versus shield-in-loop collection on Level 1 mango. Panel a shows paired episode outcomes, with observe-only outcomes in rows and shield-in-loop outcomes in columns. Panel b groups failure records by paired episode outcome. Panel c counts stored early pre-contact records before outcome-aware admission. C.2 Failure-Record Provenance Observe-only and shield-in-loop collection produce 5,801 and 7,728 training-fold records, respectively. The in-loop bank is therefore larger, but its additional records do not necessarily correspond to failures of the base policy. Of the 2,700 failure records in the shield-in-loop bank, 2,400 come from the eight initial states that succeed without steering but fail when the shield is executed. These are failures of the shielded system rather than failures encountered under the policy’s original state distribution. These records constitute88.9%of the 2,700 failure records, not of the full 7,728-record training fold. This record-weighted percentage is neither the fraction of episodes that fail nor an adapter-level effect size. C.3 Pre-Contact Correction Signal Steering also changes the stage at which useful correction records are observed. Early pre-contact records decrease from 430 under observe-only collection to 163 with the shield in the loop, a reduction of approximately62%, as shown in Figure 7c. The lead-time counts describe the stored bank before outcome-aware record admission and therefore should not be interpreted as the number of admitted corrective targets. The provenance and pre-contact analyses explain why observe-only collection retains evidence from trajectories controlled by the policy being updated. C.4 Adapter-Level Collection Ablation The two first-round banks are collected from the same policy checkpoint and trained with the same 800-step recipe with zero quiet-anchor weight. The observe-only bank contains 3,657 training records and passes the held-out guard. Its adapter raises Level 2 apple SR from8.0%to34.0%. The in-loop bank contains 5,099 records but no candidate checkpoint satisfies both guard conditions, so no deployable adapter is retained. This comparison uses one training order, and its held-out batches differ in size. The observe-only batch contains 300 records, whereas the in-loop batch contains 112 records. Table 10: Collection-mode training outcome under the main update recipe. CollectionTrain recordsGuard recordsGuard decisionApple SR Observe-only3,657300pass34.0 Shield in loop5,099112rejectunavailable C.5 Attribution Controls Only 709 of the 6,535 main-bank training targets carry a nonzero shield residual. SFT0 replaces those residuals with zero, SHAM randomizes their direction while preserving magnitude, and SFTPOS trains only on successful episodes. 21 Failure-Bank Self-Evolution for Vision-Language-Action ModelsA PREPRINT All other aligned fields remain unchanged for SFT0 and SHAM. Table 11 shows that FAILBANK outperforms SHAM and SFTPOS in every training order. It outperforms SFT0 in two orders, while the third is inconclusive. Averaging the three training orders within each offset gives ap-value of0.0011against SFT0, ap-value of0.0029against SHAM, and a p-value below 0.0001 against SFTPOS. Table 11: Level 2 apple SR attribution controls over three training orders. Update targetSeed 1Seed 2Order 3Mean Base8.08.08.08.0 SFTPOS4.010.710.78.4 SFT018.014.725.319.3 SHAM26.016.018.020.0 FAILBANK36.031.335.334.2 Table 12: Level 1 attribution controls for one training order. Each cell reports SR followed by policy-induced C over 50 offsets under two sampler conditions. TaskBaseFAILBANKSFT0SHAMSFTPOS L1-T1 Lemon83.0 / 35.87 83.0 / 12.8084.0 / 5.6694.0 / 7.75 81.0 / 29.01 L1-T4 Tomato 85.0 / 37.01 90.0 / 31.24 86.0 / 33.51 82.0 / 40.61 81.0 / 51.27 The null updates themselves improve over base on Level 2 apple. SFT0 accounts for 11.3 of the full 26.2-point gain and SHAM for 12.0 points. On Level 1 T1, SHAM reaches94.0%SR versus83.0%for FAILBANK and achieves a comparable cost reduction. On T4, the aligned comparisons are inconclusive. The evidence therefore supports partial attribution on the hard apple task, not a universal claim that shield residuals alone cause the gain. An earlier attribution sweep used a different 2,830-record recipe and stopped after 25–50 of 400 planned steps. It had no same-host base arm and predates the cost-decomposition fix, so only its SR is interpretable. The ordering of the method and SHAM reversed across seeds, and cross-task transfer was inconclusive. We report this audit to distinguish the current matched controls from exploratory development results. C.6 Privileged Teacher Executed In Loop To separate projection effects from perception errors, we execute the same privileged-geometry CBF used to label records. Table 13 reports 50 offsets under three sampler conditions per task. The shield-in-loop arm collapses onion to zero success, reduces apple to zero, and sharply degrades mango while increasing its cost. Its outcome differs from the matched base in70%,87%, and82%of apple, mango, and onion cells, respectively, showing that the two arms produced different outcomes. Table 13: Executing the privileged CBF teacher as a shield. Cost cells report C followed by policy-induced C. TaskMethodSRCCCC policy AppleBase8.067.5165.89 AEGIS7.390.7389.26 Teacher in loop0.067.0267.01 MangoBase89.351.4133.93 AEGIS88.028.7511.15 Teacher in loop50.7107.6397.50 OnionBase81.316.330.07 AEGIS1.30.270.00 Teacher in loop0.00.000.00 The logged correction and trigger counters remain zero on this execution path, so they cannot verify whether individual projections were executed. We instead use the pre-registered matched-outcome divergence check. The privileged teacher is not better than AEGIS on any of the three tasks. Collapse also occurs with privileged geometry, so these runs do not require perception errors to explain the loss of task completion. The inactive counters do not directly verify individual projections. 22 Failure-Bank Self-Evolution for Vision-Language-Action ModelsA PREPRINT D Deployment Boundary D.1 Deployment Requirements Table 14: Deployment requirements. Privileged object geometry is an offline teacher input for FAILBANK and is absent at evaluation. MethodUpdated VLAShieldObject geometryQP/steps/step Base policynononono0.362 AEGISnoyesyesyes0.449 FAILBANKLoRAnonono0.346 The distinction in Table 14 is between information available during learning and components required after the update. FAILBANK uses privileged object geometry only to construct counterfactual teacher targets during collection. Once the guarded LoRA adapter is accepted, deployment requires only the updated VLA policy. It does not use a runtime shield, privileged geometry, a quadratic program, a retrieval system, a memory lookup, or a test-time update. The latency audit uses the first ten Level 2 apple offsets, one concurrent run per arm, and reports the median total wall clock divided by executed steps. It includes policy-server startup and checkpoint restoration, so it supports only a matched relative comparison. The observed median for folded FAILBANK is close to base. AEGIS adds approximately24%and serves a 202 GB vision–language model in addition to its per-step QP. This wall-clock audit does not establish isolated inference latency or a speedup from adaptation. E Additional Training and Self-Evolution Diagnostics E.1 Implementation and Training Details Table 15 lists the shared training configuration. LoRA is inserted into the PaliGemma backbone and the flow-matching action expert, while all non-LoRA parameters remain frozen. The main adapter uses training-order seed 0, and the three Level 2 replicates use seeds 1–3. Table 15: Policy-update hyperparameters. ComponentSetting PaliGemma 2B LoRArank 16, α = 16 300M action-expert LoRArank 32, α = 32 Trainable parametersLoRA A/B factors only OptimizerAdamW, gradient clipping 1.0 Learning-rate schedulecosine, 20-step warmup, peak 3×10 −5 400-step decay, final 3×10 −6 Batch size32 Action horizon10 for π 0.5 and 50 for π 0 Replanning / episode limitevery step / 300 control steps Main update800 steps, λ q = 0 Round-curve family800 steps, λ q = 0.2 Cross-backbone π 0 800 steps, λ q = 0.5 E.1.1 Barrier Teacher The teacher models protected objectjas an ellipsoid with centerc j and positive-definite shape matrixP j . The center and end-effector position x are three-dimensional, and P j is a 3× 3 matrix. The barrier is h j (x) = (x− c j ) ⊤ P −1 j (x− c j )− 1.(10) For nominal translation u∈R 3 and candidate translation v ∈R 3 , the teacher solves ̃u = arg min v 1 2 ∥v− u∥ 2 2 s.t. ̇ h j (x,v) + 3h j (x)≥ 0 ∀j.(11) The end-effector radius is 0.03, protected-object inflation is 0.04, and the additional margin is 0.02. The safety-region detector uses near and release thresholds 0.205 and 0.307, with minimum approach speed 0.0027 m per step. The default record-labeling implementation uses privileged geometry. AEGIS instead calls GLM-4.5V once per episode to identify obstacles and then performs the QP projection at every control step. 23 Failure-Bank Self-Evolution for Vision-Language-Action ModelsA PREPRINT E.1.2 Outcome-Aware Record Weight For a triggered, feasible record with finite action and nonzero correction, the outcome-aware score is q i = 0.40s i + 0.30r i + 0.20R i + 0.10(1− ρ i )(12) − 0.30C i − 0.20F i ,(13) clipped to the range from zero to one. Heres i is normalized one-step forward safety,r i is progress preservation,R i indicates observed recovery,ρ i is the subsequent repeated-trigger rate,C i indicates four-step cost, andF i indicates a four-step barrier-floor violation. The gate additionally requires a nonnegative one-step barrier or observed recovery. Records that fail the gate or score below 0.25 receive zero weight. Scores of at least 0.25 but below 0.45 receive weight 0.25. Scores of at least 0.45 but below 0.70 receive weight 0.60, and scores of at least 0.70 receive weight 1.00. E.1.3 Record Admission The static L1-T2 risk threshold is 0.1087. Records are assigned to five lead-time bins. Early pre-contact records occur more than 30 steps before crossing. Mid pre-contact records occur 15–30 steps before crossing, and emergency records occur 0–15 steps before crossing. The remaining bins are post-crossing and no-risk. Emergency and post-crossing corrections are discarded. On failed trajectories, only early pre-contact correction records are retained. Successful actions without a triggered correction provide quiet anchors. A pre-training audit rejects failure targets identical to the nominal action. The builder runs in the early- and mid-stage mode, while failed trajectories remain restricted to early pre-contact records. Admitted CBF-triggered records receive the outcome-aware weights specified in Appendix E.1.2. Quiet anchors receive the per-record weight specified by the update recipe in Appendix E.4. E.2 Bank and Evaluation Ledger Table 16: Learning-record banks used by the reported experiments. CBF-triggered and quiet counts refer to records with and without a triggered correction in the filtered training fold. They are not counts of corrective and nominal targets. BankCollection suiteTrain recordsCBF-triggered / quietValidation foldUsed by Main static two-roundstatic L1-T26,5352,863 / 3,672600main tables, L2, R2 ablations Pre-filter static poolstatic L1-T212,3434,485 / 7,858600audit only State holdoutstatic L1-T24,0061,799 / 2,207600unseen-state evaluation Static R1–R5static L1-T23,657 / 6,535 / 15,707 / 19,051 / 22,732–round curve Dynamic diagnostic R1dynamic L2-T03,192642 / 2,550139dynamic L1 stress test Dynamic diagnostic R2dynamic L2-T09,8981,818 / 8,080266dynamic round analysis π 0 transferstatic L1-T22,875747 / 2,128–Table 2 The main static two-round bank contains 3,657 records from the first collection round and 2,878 from the second. These are data-collection rounds, while every reported main policy is fitted afresh from the same original base. Runtime logs, not directory arm names, determine the effective checkpoint and method used by each result. E.3 Host Matching and Hardware Confounding A historical audit split 150π 0 baseline cells across two hosts. A total of 124 cells achieved66.9%SR on one host, and 26 achieved96.2%on the other. These were different offset subsets, not paired replays. The 29.3-point gap does not isolate a causal hardware effect. Every comparison in the paper is pinned to one hostname, and a runtime assertion rejects a cell from an incompatible host. E.4 Update Recipes and Training Budgets The mainπ 0.5 update uses 800 optimization steps with zero quiet-anchor weight. The static round-curve family uses the same budget with quiet-anchor weight 0.2. The cross-backboneπ 0 update uses 800 steps with quiet-anchor weight 0.5. Table 15 lists the shared configuration. The main round-2 training fold contains 2,863 triggered and 3,672 quiet records, or 6,535 total. The 12,343-record pool is the pre-filter set and is not used directly for training. A quiet-anchor weight of 0.2 applies to each record. Multiplying the quiet-record count by this weight and dividing by the triggered-record count gives a nominal ratio of 0.257. The value 0.2 therefore does not specify the weight of the quiet class as a whole. Stored outcome-aware record weights further determine the actual denominator in Equation 4. 24 Failure-Bank Self-Evolution for Vision-Language-Action ModelsA PREPRINT On the 9,898-record dynamic two-round bank, 700 update steps pass with a held-out full-chunk flow-loss ratio of 1.0985, whereas 800 steps fail at 1.1016. The main 6,535-record static bank passes at 800 steps with ratio 1.0065. Increasing quiet weight can restore the ratio while inflating triggered loss by up to48×. These checks motivate the guarded update rather than treating additional optimization as uniformly beneficial. E.5 Bank-Construction Audit An earlier round-three construction retained only 3,364 new-round records, whereas the rebuilt union contains 15,707 records. We exclude the replacement-bank run from the accumulated curve. The rebuilt adapter passes the held-out guard with a flow-loss ratio of 0.9993, but this training-side observation does not isolate a task-performance benefit of retaining history. In the review-time size control, the round-2-only bank is rejected while a size-matched accumulated bank passes. Once the guard is disabled for diagnosis, however, their Level 2 apple SR values are 38.7 and 41.3 and are not significantly different. The first-round, size-matched accumulated, and full accumulated adapters likewise reach 34.0, 41.3, and 36.0 SR on that task without supported pairwise differences. The only supported benefit is lower L1-T1 policy-induced C for the size-matched accumulated bank than for the first-round bank, 10.61 versus 24.00. We therefore treat accumulation as a record-retention mechanism and do not claim that a larger bank improves success. The controlled multi-round result uses only reconstructed accumulated banks. E.6 Constraint-Activation Analysis Observe-only activation measures how often a proposed action triggers the constraint without changing the trajectory. On 50 dynamic offsets, activation rises from17.74%at base to19.47%after round one and the paired test gives a p-value of0.0328. Activation then falls to16.04%and14.36%after rounds two and three. Round three is19%below base. The paired directions include 40 decreases and 10 increases, and the paired test gives ap-value below10 −4 . Contact-step, success, and cost changes against base remain null. The direction is task-dependent. Mango activation decreases in all three training orders. Each order has 36 lower and 14 higher offsets, and each paired test gives ap-value of0.0026. Onion activation increases in two orders, with ap-value of 0.0153 and a p-value of 0.0066. Apple shows mixed changes. Figure 8a–b shows all four tasks, including the adverse round-one dynamic change. All comparisons are observe-only. None uses the steering AEGIS arm’s non-comparable counters. E.7 Held-Out Guard Diagnostics The acceptance thresholds are fixed empirical optimization guardrails. They are not theoretical CBF constants or statistically calibrated confidence bounds. The flow-loss ratio limit is 1.10, permitting at most a10%increase in full-chunk held-out loss relative to the original base policy. The first-action drift limit is 0.05, measured as the mean absolute difference per coordinate. Exceeding either value rejects the adapter. Task SR and C are not used for adapter acceptance, and the experiments do not identify these thresholds as optimal. The round-2 validation fold has 474 quiet and 126 CBF-triggered records, and the round-3 validation fold has 526 and 164. The guard evaluates a fixed held-out batchVdrawn from the corresponding fold rather than averaging over the full fold. Equation 5 therefore reports full-chunk flow loss onV . Training manifests contain 3,657, 6,535, 15,707, 19,051, and 22,732 records over the five static rounds. Held-out records are excluded from these counts. Quiet records constitute 56–62% of each bank, as shown in Figure 8c. All five adapters pass both acceptance conditions. Flow-loss ratios range from 0.9649 to 1.0363, and first-action drift ranges from 0.00514 to 0.00946. The flow-loss ratios remain below 1.10, and the first-action drifts remain below 0.05. These are checks on a mixed held-out batch, not on unseen task outcomes. In particular, the lowest flow-loss ratio occurs at round four, when evaluation cost reverses. Bank growth and guard acceptance alone do not establish which round best balances task success and cost. Table 17 collects the review-time bank decisions. Values not included in the audited result summaries are marked unavailable rather than reconstructed from training artifacts. The in-loop and replacement-only banks are not promoted because they fail at least one guard condition. E.7.1 Guard-Threshold Sensitivity The thresholds retain the implementation defaults rather than values fitted to task SR or C. A retrospective audit covers 113 archived validation entries, comprising 75 metrics entries and 38 log entries. It includes repeated representations of 25 Failure-Bank Self-Evolution for Vision-Language-Action ModelsA PREPRINT AppleMangoOnion 0 20 40 Constraint activation (%) (a) Static: task-dependent response BaseOrder 1Order 2Order 3 BaseR1R2R3 0 10 20 Constraint activation (%) 17.7 19.5 16.0 14.4 (b) Dynamic: fewer activations 12345 Accumulated round 0 10 20 Training records (thousands) (c) What accumulates in the bank? TriggeredQuiet 12345 Accumulated round 0.95 1.00 1.05 1.10 Held-out flow-loss ratio Acceptance limit (d) All rounds pass the guard Figure 8: Training and self-evolution diagnostics. Panels a and b show observe-only constraint activation for static tasks and dynamic rounds. Panel c separates accumulated training records by trigger provenance. Panel d shows held-out full-chunk flow-loss ratios relative to base. The dashed line marks the acceptance limit. Activation is a diagnostic, not a task-success or cost metric. Table 17: Training-guard decisions for the bank-construction study. All rows use 800 update steps and one training seed. A dash denotes an unreported diagnostic, not a zero value. BankRecords Flow-loss ratio First-action drift Triggered loss Decision Observe-only round 13,6570.972– accept Shield-in-loop round 15,0991.1370.0129– reject Round 2 only2,8781.1110.0053– reject Accumulated, size matched2,8781.008– accept Accumulated, full6,5351.00650.00949– accept the same optimization run and development settings, so the counts in Table 18 describe archive entries, not independent training trials. Flow-loss ratios have median 1.000, 90th percentile 1.102, and maximum 1.580. First-action drift reaches at most 0.0160. No archived entry exceeds the adopted drift limit of 0.05, so this limit does not affect any observed decision. Table 18: Acceptance counts under alternative guard thresholds. τ loss τ drift = 0.010.020.050.10 1.0587898989 1.1096100100100 1.15100108108108 1.20100109109109 1.30101110110110 At the adopted loss limit, tightening the drift limit to 0.01 changes four archive decisions, including the acceptedπ 0 quiet-regularized update. Limits of 0.02, 0.05, and 0.10 give identical decisions in this archive, so the flow check is the binding constraint in the observed range. Tightening the loss limit to 1.05 flips eleven archived entries, corresponding to 26 Failure-Bank Self-Evolution for Vision-Language-Action ModelsA PREPRINT seven distinct training runs. These include two main replicated updates with ratios 1.0975 and 1.0739 and the original acceptedπ 0 update with ratio 1.0829. Relaxing the loss limit to 1.15 or 1.20 accepts eight or nine additional entries, respectively. These include the in-loop and replacement-only banks, theπ 0 update with quiet-anchor weight 0.3, and the 4,800-step duration diagnostic. Conversely, relaxing it to 1.15 admits the shield-in-loop update whose Level 2 apple result is worse than the accepted observe-only update. The replacement-only diagnostic is not worse despite slightly exceeding 1.10, so these observations support an empirical, conservative guardrail rather than an optimal or calibrated threshold. The sensitivity audit does not change the thresholds used for the reported method. E.7.2 Training Duration and Guard Conservatism To test whether the held-out full-chunk flow-loss ratio predicts task degradation within the main recipe, we disable the guard and vary the update duration while keeping the bank, base checkpoint, data order, and quiet weight fixed. The cosine learning-rate schedule retains a 400-step decay period, so all subsequent updates use the minimum learning rate of3× 10 −6 . The 1,000 new evaluation cells pass checkpoint and host checks. Each task shares its host with the base and 800-step reference. The L2 apple runs use qa-l40s-004, and the L1 tomato runs use qa-l40s-005. Table 19: Training duration with the acceptance guard disabled. L2 AppleL1 Tomato StepsFlow-loss ratioFirst-action driftSR C policy SR C policy Base–8.065.8985.037.01 4001.00420.008332.061.7188.036.65 8001.00730.009636.065.7390.031.24 1,6001.01650.010846.756.9285.035.71 2,4001.03410.012154.043.0190.029.38 4,8001.11030.015055.342.6188.035.70 No tested duration produces significantly lower SR than the 800-step reference. On L2 apple, the 2,400-step update is better under the registered paired test, which gives ap-value of0.0046. The 400-, 1,600-, and 4,800-step comparisons are inconclusive, withp-values of 0.56, 0.16, and 0.060, respectively. All SR and policy-induced C comparisons on L1 tomato are inconclusive. The 4,800-step adapter is the only point exceeding the adopted loss limit of 1.10, yet its apple SR is among the highest observed. The guard is therefore conservative over the measured flow range of 1.004–1.110 rather than a validated predictor of task degradation. This diagnostic does not establish behavior at ratios above 1.2. It also does not change the main 800-step recipe. Selecting 2,400 steps after inspecting this evaluation set would require an independent held-out test. Guard-disabled checkpoints are diagnostic variants, not accepted main-method results. E.7.3 Quiet Anchors and Chunk Supervision Herekdenotes the number of action-chunk steps supervised during the update. The main recipe supervises the first action, and the multi-step diagnostics supervise the first 10 or all 50 actions. The controlledπ 0.5 quiet-anchor ablation uses the same round-2 bank, base checkpoint, update budget, and matched L1-T3 evaluation. Changingλ q from 0 to 0.2 preserves mean SR at89.0%while reducing policy-induced C from 20.88 to 16.52. The paired test gives ap-value of0.0039. Under this fixed recipe, quiet-anchor weighting reduces measured cost without an additional mean SR gain. The weight acts during training. Theπ 0 quiet weight is selected by the held-out guard rather than by task evaluation. Table 20 reports all five evaluations used for that choice and the two multi-step follow-ups. The accepted setting has substantially higher triggered loss than the accepted π 0.5 updates, whose values range from 0.003 to 0.03. Passing the guard does not by itself establish a useful task update. Table 21 shows that supervising more of the 50-step chunk allows the update to pass without quiet-anchor weighting, yet neither multi-step variant improves pooled SR over base. Both remain below the accepted adapter trained with first-action supervision and quiet-anchor weight 0.5. E.7.4 Record and Teacher Threshold Sensitivity The projection triggerz t is determined by the CBF correction, not by the distance-based risk threshold. The latter determines lead-time staging and record admission. The safety-region detector thresholds in Appendix E.1 likewise do not define triggered or quiet labels. We perturb the default admission risk cutoff of 0.1087 by±20%. The perturbed values are approximately 0.087 and 0.130. We perturb the temporal stage boundaries of 30 and 15 steps by±20%and 27 Failure-Bank Self-Evolution for Vision-Language-Action ModelsA PREPRINT Table 20: Held-out guard search and multi-step follow-ups forπ 0 . The flow-ratio limit is 1.10. Multi-step triggered losses were not reported in the audited summary and are marked unavailable. Steps λ q Flow-loss ratioTriggered lossDecision 8000.01.4770.185reject 5000.01.5130.171reject 4000.01.5800.170reject 8000.31.1100.199reject 8000.51.0830.178accept 800, k = 100.01.017–accept 800, k = 500.01.000–accept Table 21:π 0 multi-step supervision ablation. Values are SR over 50 matched offsets per task. The pooled row reports mean SR followed by mean policy-induced C. TaskBase k = 1,λ q = 0.5 k = 10,λ q = 0 k = 50,λ q = 0 L1-T054.058.034.030.0 L1-T166.084.060.062.0 L1-T292.096.094.090.0 L1-T328.026.024.014.0 L1-T456.088.078.078.0 Pooled SR and policy-induced C59.2 / 3.7870.4 / 2.0958.0 / 2.2354.8 / 2.94 theη-bin boundaries by±0.05. The default reconstruction exactly reproduces the 6,535-record main bank and its 709 genuinely corrected targets, with no record-set discrepancy. Table 22: Record and teacher threshold sensitivity. PerturbationBank size Corrected targets Affected share, % ∆ weight mass, % Default6,5357090.00.0 Risk cutoff×0.87,68345721.9+19.3 Risk cutoff×1.24,8921,29335.6−31.0 Stage boundaries 24 / 126,6267441.4+1.9 Stage boundaries 36 / 186,4596821.2−1.2 η bins−0.056,53570919.2+26.3 η bins +0.056,53570910.3−14.9 Affected percentages use the default training bank as the reference. Weight mass is the sum of triggered-record weights. The predeclared descriptive criterion treats at most10%affected records as low sensitivity. Temporal boundaries meet this criterion, while risk andη-bin thresholds do not. Changes to theηbins preserve the record set but alter its effective weights. Thus, the bank is not globally insensitive to threshold choices. These are CPU-side reconstruction diagnostics without policy retraining and do not establish corresponding SR or C changes. E.7.5 Rejected-Update Diagnostics For diagnosis only, we retrain the two rejected bank variants after disabling the guard while leaving all other settings unchanged. These checkpoints were rejected under the main acceptance rule and are evaluated only as diagnostic variants. Table 23 shows that the shield-in-loop update is worse than its accepted observe-only counterpart on Level 2 apple, while the rejected round-2-only update does not differ significantly from the size-matched accumulated update. The latter result shows that a guard rejection is a training-side decision rather than evidence that accumulation improves task success. E.8 Diagnostics of the Dynamic-Obstacle Null Result Across consecutive banks, dynamic failure profiles are at least as stable as static ones. The mean correction-direction cosine is 0.814 for dynamic banks and 0.747 for static banks. After controlling for episode phase, the teacher triggers 28 Failure-Bank Self-Evolution for Vision-Language-Action ModelsA PREPRINT Table 23: Non-deployable diagnostics with the acceptance guard disabled. Each cell reports SR followed by policy-induced C. Bold labels mark rejected variants, not preferred results. TaskBase Observe-only R1 In-loop R1 Accumulated matchedR2 only Full accumulated L2-T0 Apple8.0 / 65.8934.0 / 59.97 18.0 / 57.6841.3 / 48.07 38.7 / 56.5936.0 / 65.73 L1-T1 Lemon 83.0 / 35.8785.0 / 24.0093.0 / 3.2489.0 / 10.6187.0 / 8.5183.0 / 12.80 L1-T4 Tomato 85.0 / 37.0189.0 / 30.57 87.0 / 30.5587.0 / 38.53 89.0 / 31.2390.0 / 31.24 more often on steps with benchmark cost than on steps without benchmark cost. The corresponding rates are28.6% and 11.8%. Correction-direction similarity and cost-step trigger rates do not support failure-mode churn or sparse triggering as explanations for the dynamic null. Triggering on cost steps does not establish that the unexecuted correction would prevent cost. They also reinforce that intermediate quantities such as activation frequency or teacher coverage are diagnostics rather than substitutes for matched task-level success and cost. F Completion Timing and Cost Distributions F.1 Behavior Overview Figure 9 compares completion timing and policy-induced cost distributions on Level 2 apple, mango, and onion. Both analyses retain all evaluated trials, including failures. These diagnostics describe where mean SR and C conceal differences in timing or cost distribution. 0100200300 Executed control steps 0 25 50 75 100 All trials completed (%) (a) Apple → bowl 0100200300 Executed control steps (b) Mango → bowl 0100200300 Executed control steps (c) Onion → bowl 0100200300 Policy-induced C threshold 0 25 50 75 100 Trials above threshold (%) (d) Cost tail 0100200300 Policy-induced C threshold (e) Cost tail 0100200300 Policy-induced C threshold (f) Cost tail BaseAEGISFailBank Figure 9: Completion timing and policy-induced C distributions on Level 2 apple, mango, and onion. Panels a–c show the fraction of all trials completed by each executed control-step count. Panels d–f show the fraction whose policy-induced C exceeds each threshold. Blue shading spans three training orders and is not a confidence interval. 29 Failure-Bank Self-Evolution for Vision-Language-Action ModelsA PREPRINT F.2 Policy–Shield Coordination and Collapse Re-attaching AEGIS tests whether the learned policy and runtime shield are naturally compositional. If they were, the stacked system would retain the learned success gain while lowering cost. Table 24 instead shows that the stacked system follows the shield’s behavior on both tested tasks. Table 24: Stacking AEGIS onto the learned policy. Each cell reports SR followed by C over 150 matched cells. TaskBaseAEGISFAILBANK FAILBANK + AEGIS L2-T2 Mango 89.3 / 51.41 88.0 / 28.75 94.0 / 36.7886.0 / 19.78 L2-T3 Onion81.3 / 16.331.3 / 0.27 84.7 / 16.932.7 / 0.53 On mango, stacking lowers cost but decreases SR from94.0%to86.0%. On onion, stacking reduces SR from84.7% to2.7%, with nearly all cells abstaining. On both tasks, the paired test does not detect an SR difference between the stacked system and AEGIS alone. The learned behavior therefore does not preserve task progress once the shield again controls execution. Figure 2 presents one matched Level 2 onion replay. AEGIS executes 80 CBF projections over 300 controller steps, including continuous intervention from environment steps 40 to 88. Repeated redirection prevents a successful grasp, and the episode times out at environment step 309. The shield-free FAILBANK trajectory enters the same intervention- prone region. Its CBF runs only in observe-only mode and flags 33 of 180 controller steps, so none of those corrections is executed. The policy grasps and places the onion at environment step 189 with zero policy-induced C. Controller counts exclude the first ten environment steps before frame logging, which explains the two step-number conventions in the figure. This replay illustrates the mechanism, not its frequency. The same collapse appears without a perception module. When the privileged CBF teacher is moved from observe-only annotation into the execution loop, onion reaches0%SR over 150 trials. Apple falls from8.0%to0%, while mango falls from89.3%to50.7%and its policy-induced C rises from 33.93 to 97.50. These runs show that the loss of task completion also occurs with privileged geometry, independently of AEGIS grounding errors. Full results and configuration-validity checks appear in Appendix C.6. F.3 Completion Timing We reconstruct completion curves from the recorded success flag and executed control-step count, including failures in the denominator. The curves therefore do not condition on a different successful subset for each method. By 200 steps, FAILBANK completes17.3%of apple trials versus4.0%for base, and93.8%of mango trials versus 88.7%. Onion reverses this timing pattern. FAILBANK completes33.3%by that point versus46.7%for base, despite similar final SR. The update therefore does not uniformly speed up execution. These curves are descriptive rather than additional significance tests at selected time thresholds. F.4 Policy-Induced C Distributions The apple curves cross. Policy-induced C exceeds 100 in24.7%of base trials,37.3%with AEGIS, and18.0%with FAILBANK, but the fraction with zero policy-induced C falls from 36.0% for base to 6.7% for FAILBANK. Thus, the update reduces the frequency of very costly apple trials while making nonzero cost more common. It does not dominate the distribution. On mango, the fraction above 100 falls from11.3%to4.7%. The full threshold curves expose this dependence without promoting a selected threshold to an additional benchmark metric. F.5 Completion-Coupled Cost on Onion C is 16.33 for base, 0.27 for AEGIS, and 16.54 for FAILBANK. The respective policy-induced C means are 0.067, 0, and 0.004. At least 99.3% of trials in every arm have zero policy-induced C. Almost all of the C difference therefore belongs to the benchmark’s initial-state/completion-coupled component. The nearly flat policy-induced cost tail shows that AEGIS sacrifices completion on a task where the logged policy-induced cost was already rare. Neither the C gap nor the activation-rate gap establishes a substantial contact-reduction benefit on this task. 30 Failure-Bank Self-Evolution for Vision-Language-Action ModelsA PREPRINT G Detailed Statistical Results and Archive Eligibility G.1 Out-of-Sample Breadth and Ablation Tests The primary cross-task pool contains static L1-T0, T1, T3, and T4, excluding the T2 collection task. We report the disjoint T2 state holdout separately. The all-five-task diagnostic includes the in-sample T2 evaluation and is labeled as such. Table 25 places paired counts outside the main narrative, together with the learning-signal tests used in Section 6.1. Table 25: Detailed paired tests for breadth and learning-signal ablations. Favorable means higher SR or lower policy-induced C. Individual L1 task rows and legacy cost rows use the earlier no-curriculum configuration. Pooled SR rows use training-order means. Unreported tie counts are marked unavailable. AnalysisComparisonFavorable / adverse / tie p-value BreadthStatic L1-T0 SR7 / 7 / 361.0000 Static L1-T1 SR12 / 10 / 280.8320 Static L1-T3 SR17 / 2 / 310.0007 Static L1-T4 SR11 / 7 / 320.4810 Four unseen L1, SR 82.5%→ 88.7%51 / 45 / 1040.61 Four unseen tasks, legacy policy-induced C71 / 53 / 760.1265 Static L1-T2 state-holdout SR10 / 1 / 70.0117 All five tasks, pooled SR69 / 50 / –0.099 All five tasks, legacy policy-induced C101 / 70 / 790.0215 π 0.5 meanTen tasks, SR 66.0%→ 74.5%161 / 89 / – < 0.0001 L2 five tasks, SR 50.5%→ 59.4%92 / 39 / – < 0.0001 π 0 meanTen tasks, SR 47.5%→ 54.4%121 / 81 / –0.0059 Four unseen L1, SR 51.0%→ 62.7%61 / 36 / –0.014 L1 five tasks, SR 59.2%→ 68.8%64 / 40 / –0.024 L2 five tasks, SR 35.7%→ 40.0%57 / 41 / –0.13 Learning signal Failure-only SR relative to base21 / 2 / 270.0001 Quiet-record policy-induced C27 / 9 / 140.0039 AEGIS reduces Level 2 SR relative to base on both backbones. The corresponding rates are 25.1% versus 50.5% on π 0.5 and 26.3% versus 35.7% onπ 0 . Both paired tests give ap-value below0.001. Comparing FAILBANK with AEGIS over Level 2 gives 144 favorable versus 16 adverse SR directions onπ 0.5 and 84 versus 29 onπ 0 . Both paired tests give a p-value below 0.0001. Across the four unseen Level 1 tasks,π 0.5 mean SR increases from82.5%to88.7%, but its 51 wins, 45 losses, and 104 ties do not support consistent improvement across initial states. The paired test gives ap-value of0.61. Onion carries the gain, with90.0%SR versus72.0%and ap-value of0.0026. Collection-task mango also improves, with ap-value of0.011. The full Level 1 mean is likewise not significant, with ap-value of0.099. Mean Level 1 cost is descriptively lower, but the four-task mean-based cost test is null, with ap-value of0.44. Historical no-curriculum cost counts in Table 25 are retained for provenance and do not establish significance for the current mean recipe. Onπ 0 , the reported mean uses training-order seeds 0 and 2. Seed 1 is rejected without retraining or relaxing the guard. Its flow ratio is 1.2214 and its first-action drift is 0.0089. Seeds 0 and 2 pass with ratios 1.0829 and 1.0171 and drifts 0.0122 and 0.0091. The Level 2 SR gain is not significant, with ap-value of0.13. Tomato improves from50.7%to 79.3%, with ap-value of0.0002, but its policy-induced C rises from 3.61 to 6.93, with ap-value of0.0026. Seed 2 regresses on onion from30.7%to18.0%, with ap-value of0.024. Ten-task C tests are null on both backbones. The tests give ap-value of0.085onπ 0.5 and ap-value of0.13onπ 0 . Theπ 0.5 pooled Level 2 cost reduction has ap-value of0.011and is driven mainly by floor-task lemon. Excluding that task yields ap-value of0.42. These results do not establish uniformly lower cost or general Level 2 transfer on π 0 . G.1.1 Effect Sizes with Bootstrap Intervals Table 26 reports learned-minus-base differences. Within each task, we average training orders within initial state, resample initial states 5,000 times, and average tasks equally. The primary significance test remains the preregistered paired sign test. The positive mean-gain intervals forπ 0.5 Level 1 across either four or five tasks andπ 0 Level 2 do not change their null sign-test conclusions. The sign test evaluates the balance of improvement and regression directions across matched 31 Failure-Bank Self-Evolution for Vision-Language-Action ModelsA PREPRINT Table 26: Effect sizes with 95% bootstrap intervals. SR changes are percentage points. Intervals resample initial states only and exclude variation across training orders. The non-floor L2 row is post hoc. Backbone SetSign-test p ∆SR95% CI ∆C policy 95% CI π 0.5 L1 unseen four0.61+6.2 [2.0, 10.5]-8.39[-15.21, -1.97] L1 all five0.099+8.3 [4.5, 12.3]-17.24 [-24.22, -10.61] L2 all five< 0.0001+8.8 [6.2, 11.6]-16.78[-24.16, -9.40] All ten< 0.0001+8.6 [6.2, 10.9]-17.01 [-22.19, -12.00] π 0 L1 unseen four0.014 +11.8 [5.0, 18.8]-1.59[-3.95, 0.53] L1 all five0.024+9.6 [3.8, 15.6]-1.08[-2.97, 0.62] L2 all five0.13+4.3[0.8, 7.9]-3.97[-7.71, -0.40] L2 non-floor three–+7.6 [1.6, 13.3]+1.82[1.04, 2.64] All ten0.0059+6.9 [3.6, 10.4]-2.53[-4.63, -0.53] initial states. The bootstrap estimates uncertainty in the mean difference. Thus, a positive mean can coexist with inconsistent per-state improvements, as onπ 0.5 Level 1 where onion carries much of the gain. These intervals exclude training-order variance and can understate recipe-level uncertainty. Removing theπ 0 Level 2 floor tasks reveals increased cost, mainly on tomato.π 0 Level 1 cost intervals include zero. Rounded task averages and bootstrap effect sizes can differ slightly at the reported precision. G.2 Offset-Paired Level 2 Statistics Each training order is compared against the same base on 50 initial states. For each state, we average its three sampler- advance conditions before taking the direction of the difference. Counts are ordered as higher, lower, and equal. They refer to the learned-minus-base direction, so higher is favorable for SR but not for activation. Allp-values below are two-sided exact sign-test values. Across the 24 planned Level 2 tests, the Bonferroni-adjusted threshold is0.00208. The apple SR comparisons remain supported under this threshold. The mango and onion activation comparisons do not. A null result is not an equivalence test. Table 27: Repeated sampler conditions are averaged, not counted as independent samples. SR is success rate. Activation is the observe-only constraint-flag rate. TaskTraining SR higher / lower / equal SR p-value Activation higher / lower / equal Activation p-value order Apple128 / 2 / 208.68×10 −7 32 / 18 / 00.0649 224 / 3 / 234.92×10 −5 22 / 26 / 20.6655 329 / 3 / 182.56×10 −6 30 / 20 / 00.2026 Mango18 / 4 / 380.387714 / 36 / 00.0026 210 / 3 / 370.092314 / 36 / 00.0026 310 / 7 / 330.629114 / 36 / 00.0026 Onion113 / 9 / 280.523534 / 16 / 00.0153 210 / 10 / 301.000035 / 15 / 00.0066 311 / 10 / 291.000028 / 22 / 00.4799 The two Level 2 tasks added for coverage were governed by a separate pre-registered readout. Table 28 gives the complete result. Tomato satisfies the transfer criterion because two training orders improve SR significantly and none is significantly worse than base. Lemon satisfies the floor criterion because all methods obtain zero SR, so its cost differences are descriptive only. Pooling all five Level 2 tasks gives mean SR59.4%for FAILBANK and50.5%for base. The pooled policy-induced C difference is driven by lemon. After removing that floor task, policy-induced C is 29.27 for FAILBANK and 38.24 for base, and the paired difference is not significant. The paired test gives a p-value of 0.4159. Table 29 reports the corresponding cost comparisons. “Favorable” means that the learned policy has lower cost than its matched reference. The three FAILBANK columns are the training orders. The AEGIS column compares the runtime shield with its matched base. 32 Failure-Bank Self-Evolution for Vision-Language-Action ModelsA PREPRINT Table 28: Pre-registered Level 2 completion experiment. Each training-order comparison uses 50 matched offsets under three sampler conditions. FAILBANK mean is the average of the three orders. TaskArmSRCC C policy SR test relative to base L2-T1 LemonBase0.0 158.14158.13– AEGIS0.0 141.51141.51– FAILBANK mean0.0 110.14110.12floor L2-T4 Tomato Base74.067.8753.07– AEGIS28.726.9321.20p < 0.0001 FAILBANK order 1 84.059.0542.39p = 0.0872 FAILBANK order 2 85.355.4338.49p = 0.0043 FAILBANK order 3 85.351.8334.77p = 0.0294 FAILBANK mean84.955.4438.55p = 0.0139 Table 29: Offset-paired Level 2 cost tests.C policy removes the benchmark’s initial-state component. C follows the benchmark definition. TaskCostFAILBANK-1FAILBANK-2FAILBANK-3AEGIS AppleCC policy 25/25/0, 1.00025/25/0, 1.00027/23/0, 0.67219/27/4, 0.302 C22/28/0, 0.48023/27/0, 0.67226/24/0, 0.88818/27/5, 0.230 Mango C policy 28/20/2, 0.31234/16/0, 0.01528/20/2, 0.31242/8/0, 1.2×10 −6 C29/19/2, 0.193 35/15/0, 0.006629/21/0, 0.32242/8/0, 1.2×10 −6 Onion C policy 1/0/49, 1.0001/1/48, 1.0001/0/49, 1.0001/0/49, 1.000 C9/13/28, 0.524 11/11/28, 1.000 10/11/29, 1.000 49/0/1, 3.6×10 −15 Each cell gives favorable/adverse/tie counts followed by the two-sided exact sign-testp-value. A comma separates the counts from the p-value. G.3 Archive Eligibility The review batch adds 4,315 provenance-checked result cells. Every included comparison matches the intended host and effective checkpoint. We exclude host-inconsistent cells, replacement-only banks, obsolete correction branches, and artifacts whose runtime audit block does not identify the intended arm. Observe-only telemetry remains diagnostic and does not alter SR or C. A release archive should include per-cell result files, adapter audit blocks, training and bank manifests, and recovery logs needed to reconstruct each reported aggregate. 33