AI safety and alignment form a huge part of product design for frontier language models. More than just avoiding offensive or illegal outputs, alignment is the process by which raw language models, trained on Internet text, are made useful and reliable for modern long-running agentic workflows.
The interesting question is how safety applies to robotics models once they get capable enough. To answer it, we first need to define safety, then map language-model failures onto robotics models.
What the heck is AI safety?
When ChatGPT launched in late 2022, it was just a simple interface to the raw outputs of an LLM that had been fine-tuned to hold conversations. As early LLMs were trained purely on the internet and the richest online conversations tended to be vicious arguments, these models would frequently argue with, attack, or gaslight the user. This proved to be an awful user experience; not only do people dislike being attacked in general, but being criticized in fluent and creative English by a computer program was unexpected and jarring.
Three issues, in particular, became deal-breakers in the United States, and because most models distill their alignment data from one of the two big US frontier labs, these became issues by proxy in other countries:
- LLMs can produce factually incorrect information
- LLMs can produce instructions for violence or harm
- LLMs can produce controversial content
Factually incorrect information exposes the LLM’s creator to risk since, unlike for site hosts or ISPs, there is no statutory veil protecting chatbot providers from liabilities and no real reason why there should ever be one. This is doubly important for violence, where there is an implicit requirement in most countries that corporations with the resources and technology to do so have a responsibility to reasonably protect the public from the harmful effects of their products.
Finally, there is controversial content, and this is perhaps the most controversial part of alignment. In the US, controversy is not illegal and generally not litigable. However, our lawmakers are explicitly granted unlimited regulatory powers over interstate commerce, which have been liberally exercised on everything from securities to sofas. Controversy provides ample ammunition for competitors to act on in their quest for regulatory capture; hence, at the current stage there is a silent agreement that anything remotely questionable be scrubbed from the outputs of the model.
As the industry shifted from chatbots to agents, the practical and narrative aspects of safety shifted as well. Suddenly, factually incorrect outputs went from a civil liability to a product disaster: in an agent, hallucinations might include mangled or misformatted tool calls that cause real damage to real systems when run. Controversy fell by the wayside; to this day, I’ve yet to meet a single person offended by Claude Code (and it helps that most of the natural language output is hidden from the user). “Instructions for harm” became “outright harm” in the form of malicious cyberattacks, which to this day remain a hot topic with no real solution.
The point we’re trying to make here is (1) safety started as and remains a commercial problem, shielding the model’s creators from civil and regulatory risk, and (2) for autonomous systems, the alignment work that goes into making these systems reliable also falls under the traditional safety umbrella. This dichotomy becomes ever more important for physical systems, where the risks are much higher, and autonomy is mandatory.
Safe physical AI
Let’s clear one thing up: no robot is safe. A somewhat top-heavy appliance weighing 50+ kg, powered by lithium batteries, and capable of a peak power output of several horsepower is never to be trifled with. This actually makes the model design easier, since the inherent hazards of the machine, with or without AI, force best practices and physical de-risking. While soft limits, such as not accelerating into flesh at high speed, remain helpful, there is a fundamental expectation, as with any machinery, that bugs in software could cause dangerous movement.
Keeping in mind that aligning VLAs is not the same as aligning LLMs (VLAs are closer to image generation models than language models, and image models are aligned by holding out inappropriate data during pretraining), we can break down the various “unsafe” situations.
Factually incorrect information → Physically inappropriate actions
The tolerance here is even stricter than for agents, namely, zero. Unlike digital systems, there is no way to sandbox a physical system and no way to recover from or roll back to a good state from a damaged one. Even simple errors, like a small position error causing the arm to attempt to push through a table, compound over time and quickly cause hardware to disintegrate.
It isn’t really clear how to deal with this zero tolerance for errors. Current deployments seem to sidestep it by focusing on box folding or laundry, which are soft-contact tasks that are recoverable if done in a work cell. Certainly, causing spills in a commercial kitchen or breaking parts during manufacturing would be unacceptable.
While this class of failure remains the top bottleneck to physical AI deployment, it seems to be mostly an engineering limitation as opposed to a human decision.
Instructions for violence → Physical violence
This is the class most readers are here for, especially as kinematics models get more sophisticated.
A big part of this can and should be implemented via deterministic means: mobile robots should be geofenced to their owner’s property when possible, deterministic soft stops for robots that interact with customers, etc. For most near-term deployments, these are sufficient to keep the machines (and the users) out of trouble, and you would want these anyway — no one wants their delivery robot being prompt-injected to wander out the door.
Looking forward a bit, there are a couple of deployment scenarios that are worth inspecting. The first is mobile robots in public spaces. Either through bugs or prompt injection, these robots are at risk of injuring humans; for privately owned, publicly accessible spaces, there is clear precedent that these injuries are handled by traditional insurance/litigation routes, but for publicly owned public spaces, the answer is likely to simply forbid large autonomous machines from being present without a suitable variance. This leaves the edge case of autonomous machines transporting themselves to point of use; unfortunately, the mild efficiency tradeoff seems to be not worth the potential public nuisance, so we expect this to be quickly dealt with at the local regulatory level as well.
Finally, there is the case of autonomous robots being used to commit actual crimes — think robot burglars, thugs, and vandals. Fortunately, this falls cleanly into existing regulatory frameworks: it seems pretty clear that if you use a tool to commit a crime, you, not the tool or its manufacturers, are guilty of that crime.
In short, this ends up being far less of an issue than it appears at first glance. Existing laws and regulations are well-equipped to regulate hazardous heavy machinery, regardless of their software stack, and the penalties for causing damage in the real world are severe enough to act as a deterrent for all but the most determined troublemakers (who will cause trouble regardless of autonomy).
Accidental violence
While insurance is happy to handle the situation where your robot slaps someone else in the face, it can’t really remedy the loss of reputation, and if the robot slaps you in the face, there is very little you can do to remedy the situation for yourself.
This path is the one that looks like traditional AI alignment the most. When training image/video generation models (which are the closest thing we have right now, architecturally, to VLAs), the strategy is to hold out pretraining data that could be problematic, erring on the side of caution. This includes IPs from known-litigious companies, celebrity likenesses, objectionable/violent content, nudity, etc. This tremendously impacts the revenue base for these models (and once in a while, a rogue company will breach these self-imposed restrictions) but, by and large, has done wonders to quell mainstream protest against generative models.
Paralleling this strategy, we expect, or at least hope, that teams training VLAs hold out objectionable data from the pretraining dataset. Punching, kicking, and throwing don’t have a lot of revenue-generating mainstream use cases, and it seems unlikely that this data will wind up in the dataset by accident. Sharp tools are a bit of a class of their own: they have a lot of legitimate use (and cutting and chopping will likely be some of the first deployed use cases), but knowing how to handle knives and scissors seems to open up room for nasty accidents. The current sentiment seems to be not to train on sharps (not the least of which is that the researchers have a strong sense of self-preservation), but this will probably change in the near future.
Controversial content → Controversial content
This is unlikely to be an issue, except at the very early stages where there is a bit of a shock factor from offensive gestures that detractors can take advantage of. I do expect this to be a lively topic as the industry first matures, at least in the United States, where there is a fair amount of resistance to automation for economic reasons.
Two ways to get kicked
Every few months a clip goes around of a humanoid kicking the person holding the controller, and every headline calls it an attack. It isn’t one. Either something went wrong, in which case the fix is the boring deterministic stuff (soft stops, safety controllers, not standing inside the reach of a 50 kg machine), or a motion the robot was trained to perform surfaced at the wrong moment, in which case the fix is to not have trained it in the first place. Neither is a machine deciding to hurt someone.
In short, safety for physical AI looks a lot like safety for LLMs, minus the philosophy. Most of it is a commercial problem that tort law, insurance, and machinery regulations already know how to handle. The hard engineering problem is zero tolerance for physically inappropriate actions. The one piece that actually resembles alignment is deciding what never goes into the pretraining set, and that decision gets made on purpose, or it gets made on a security camera.
