AEGIS: A Backup Reflex for Physical AI

# A Backup Reflex for Physical AI Calling a Stronger Policy Before Long-Horizon Failures Compound
Source: [https://arxiv.org/html/2606.06660](https://arxiv.org/html/2606.06660)
\(June 2026\)

###### Abstract

Long\-horizon robot manipulation tends to fail gradually: one bad step degrades the state, and the policy spirals into a basin from which it cannot recover\. The failure is visible before it happens\. A cheap probe on the policy’s own frozen activations predicts it early, while there is still time to act\. We introduceAEGIS\(Activation\-probe Early\-warning, Gated Inference Switching\): when the probe flags a step, control switches to a stronger separate policy, but only for the steps that need it\. The thesis is one sentence\. A robot policy can read its own activations as an early\-warning signal and call a stronger policy before failure compounds, recovering twice as many failures as matched\-budget escalation\.

On LIBERO\-Spatial, AEGIS recovers10\.1%10\.1\\%of the trajectories the weak policy alone loses, against4\.6%4\.6\\%for budget\-matched blind escalation and5\.1%5\.1\\%for a random\-trigger placebo \(one\-sided exact paired McNemar tests, Holm–Bonferroni adjusted over the three pre\-registered contrasts:\+5\.4\+5\.4pp over blind,p=8\.5×10−6p=8\.5\{\\times\}10^\{\-6\};\+5\.0\+5\.0pp over random,p=1\.0×10−4p=1\.0\{\\times\}10^\{\-4\}; paired\-trajectory bootstrap CIs exclude zero\)\. It does this while the stronger policy is active on only38%38\\%of steps \(its duty cycle\), so the lever is timing, not compute: the same selectivity that recovers tasks is what lets the stronger4\.144\.14B policy stay dormant most of the time\. The probe clears its precondition with an early\-window AUROC of0\.7640\.764\(95%95\\%CI\[0\.70,0\.84\]\[0\.70,0\.84\]\), read from the weak\-policy path over the first30%30\\%of trajectory steps before any handoff\. We pre\-register the full analysis plan, including a conditional recovered\-task\-rate estimand and explicit kill criteria, and confirm the result on700700common\-random\-number episodes per arm \(nA​\-fail=646n\_\{A\\text\{\-fail\}\}\{=\}646\)\.

## 1Introduction

A robot policy rarely fails all at once\. A long\-horizon manipulation failure is a slow spiral \(Fig\.[1](https://arxiv.org/html/2606.06660#S1.F1)\): one mistimed grasp nudges the arm off\-distribution, the next action compounds the error, and within a few steps the trajectory has crossed a point of no return\. The warning arrives long before the crash\. The policy’s own activations betray the coming failure while there is still time to act\. We call the missing response a*runtime authorization gap*: the absence of a layer that decides, at run time, what a policy is and is not allowed to do as evidence of impending failure mounts\. Two research programs now populate this gap\. Between them they leave one axis conspicuously empty\.

![Refer to caption](https://arxiv.org/html/2606.06660v1/figures/fig_failure_spiral.png)Figure 1:Why timing is the whole problem\.Schematic phase portrait of long\-horizon manipulation: under the weak policy alone, a perturbed trajectory spirals inward and compounds toward an unrecoverable failure basin \(shaded\)\. Recovery is only possible while the trajectory is still outside the point\-of\-no\-return ring \(dashed\)\. The AEGIS probe fires the gate within the early window \(≤30%\\leq 30\\%of trajectory steps, red points\) and hands control to the stronger policy, deflecting otherwise\-doomed trajectories back outward \(green\), recovering10\.1%10\.1\\%of episodes the weak policy alone fails \(confirmatoryn=700n\{=\}700\)\.*\(Schematic phase portrait; recovery rate is a measured value, Section[5](https://arxiv.org/html/2606.06660#S5)\.\)*The first program is*detect\-only*failure prediction: read a cheap signal from the policy and raise an alarm\. SAFE trains a probe on hidden states and predicts manipulation failure at AUROC7272–93%93\\%on LIBERO, then halts or calls a human\[[11](https://arxiv.org/html/2606.06660#bib.bib4)\]; FIPER, FAIL\-Detect, ReconVLA, and Sentinel raise conformal or consistency\-based alarms in the same spirit\[[21](https://arxiv.org/html/2606.06660#bib.bib5),[27](https://arxiv.org/html/2606.06660#bib.bib6),[8](https://arxiv.org/html/2606.06660#bib.bib7),[1](https://arxiv.org/html/2606.06660#bib.bib8)\]\. These methods own*prediction*; none of them*act*to recover, and none report a recovery metric\. The second program is*recover\-within\-the\-same\-policy*: when an alarm fires, do something with the policy you already have\. HELM augments and recovers within the same frozen policy\[[30](https://arxiv.org/html/2606.06660#bib.bib1)\]; Pre\-VLA resamples the same policy behind a warm\-up gate, recovering\+6\.83\+6\.83pp\[[24](https://arxiv.org/html/2606.06660#bib.bib2)\]; LiLo\-VLA retries and backtracks\[[29](https://arxiv.org/html/2606.06660#bib.bib10)\]; FailSafe and FPC\-VLA author corrective actions or strategies for the same motor stack\[[16](https://arxiv.org/html/2606.06660#bib.bib11),[28](https://arxiv.org/html/2606.06660#bib.bib12)\]\. These methods own*recovery*, but they resample, replan, or re\-prompt the*same*policy that is failing\.

Notice what a human supervisor would do\. Detect\-only methods see the spiral but cannot act\. Recover\-in\-policy methods act, but only by asking the same failing policy to try again\. Neither calls for help\. AEGIS does\. When the cheap policy is about to fail, call in a stronger one, but only for the steps that need it\. We call this mechanismAEGIS\(Activation\-probe Early\-warning, Gated Inference Switching\): a frozen\-VLA per\-step early\-warning probe whose flagged steps are escalated, with control switched mid\-trajectory, to a stronger*separate*policy, and the resulting recovery measured directly and defended with causal controls\. AEGIS is the outward counterpart to our companion memory gate AURA\-Mem\[[6](https://arxiv.org/html/2606.06660#bib.bib20)\], which gates writes*inward*at fixed compute; AEGIS switches in a stronger policy*outward*, and only on the steps a cheap signal flags\. To our knowledge, prior work has not yet evaluated this exact combination: early prediction from frozen internals, threshold\-triggered escalation to a stronger separate policy, a measured recovery metric, and causal controls that the gain is selectivity rather than spent compute\. We lay this out against the field in Table[1](https://arxiv.org/html/2606.06660#S2.T1)\.

Accurate prediction does not imply effective prevention\. In the language\-model setting, a probe at AUROC0\.940\.94can still*reduce*task success by2626pp when it triggers interventions that disrupt trajectories which would otherwise have succeeded\[[26](https://arxiv.org/html/2606.06660#bib.bib13)\], a cautionary result we import from the LLM domain rather than measure on our own policies\. So a method that escalates has to prove its gains come from*where*it escalates, not from the extra compute it spends\. A budget\-matched blind\-escalation control and a random\-trigger placebo isolate exactly that\.

We use*physical AI*in the narrow sense of embodied policies that map perception and language\-conditioned task context to robot actions\. The timing matters now because of how such policies will be deployed\. As they scale, deployment will look less like choosing one policy and more like scheduling a hierarchy of policies under latency and compute constraints\. A cheap policy drives most of the time; a frontier policy is too expensive to run constantly, because single\-stream robot decode is memory\-dominated and its cost is paid per active policy\[[7](https://arxiv.org/html/2606.06660#bib.bib21)\], and so gets called selectively\. The central question becomes: when does the cheap policy still deserve control, and when should a stronger one take over? AEGIS is a concrete answer to that question, and the controls below are what turn the answer into evidence\.

#### Contributions\.

- •A new runtime escalation problem\.When should a cheap robot policy call a stronger policy, before failure compounds rather than after it completes \(§[1](https://arxiv.org/html/2606.06660#S1), §[2](https://arxiv.org/html/2606.06660#S2)\)?
- •A concrete mechanism\.A frozen hidden\-state probe gates step\-level escalation to a stronger*separate*policy, with an early\-harm gate, a conformal trigger threshold, and a per\-episode budget cap \(§[3](https://arxiv.org/html/2606.06660#S3)\)\.
- •A causal test of selectivity\.Budget\-matched blind escalation and a random\-trigger control show the gain comes from*where*escalation happens, not from extra compute \(§[4](https://arxiv.org/html/2606.06660#S4), §[5](https://arxiv.org/html/2606.06660#S5)\)\.
- •A measured deployment tradeoff\.AEGIS recovers10\.1%10\.1\\%of weak\-policy failures while escalating on38%38\\%of steps, roughly doubling matched\-budget recovery \(Fig\.[2](https://arxiv.org/html/2606.06660#S1.F2), §[5](https://arxiv.org/html/2606.06660#S5)\)\.

![Refer to caption](https://arxiv.org/html/2606.06660v1/figures/fig_headline_bars.png)Figure 2:Timing doubles recovery at matched compute\.Conditional recovered\-task rate \(RTR\) on the weak\-policy\-failing subset of LIBERO\-Spatial \(confirmatoryn=700n\{=\}700;nA​\-fail=646n\_\{A\\text\{\-fail\}\}\{=\}646\)\. At a shared escalation budget \(about38%38\\%of steps\), AEGIS recovers10\.1%10\.1\\%of otherwise\-failed trajectories, roughly twice the budget\-matched blind \(4\.6%4\.6\\%\) and random\-trigger \(5\.1%5\.1\\%\) controls\. The always\-strong arm \(grey\) marks the recovery ceiling but pays roughly4\.6×4\.6\\timesthe compute\. Selectivity, not spend, is the active ingredient\.

## 2Related Work

We organize prior art along the two programs that flank the gap this paper fills: methods that*detect*impending failure but do not act on it, and methods that recover but only by resampling, replanning, or re\-prompting the same policy\. To our knowledge, prior work has not yet evaluated the combination of per\-step early failure prediction from frozen VLA internals, escalation to a stronger and separate policy, a measured recovery metric, and causal controls\. Detect\-only owns axis \(1\); recover\-within\-policy owns axis \(3\) but resamples or replans the same policy\. The axis of escalating flagged steps to a stronger separate policy is unoccupied\. Table[1](https://arxiv.org/html/2606.06660#S2.T1)makes the gap visual: AEGIS is the only entry that combines all four capabilities at once\.

Table 1:Where AEGIS sits relative to representative prior art\. Columns are the four capabilities that, taken together, define the unoccupied axis\.✓= yes,✗= no,∼\\sim= partial\. AEGIS is the only row with all four\. “Stronger*separate*policy” means the intervention runs a more capable distinct policy, not a resample, replan, or re\-prompt of the failing one\. Each mark reflects only what the cited paper reports: SAFE detects \(AUROC7272–93%93\\%on LIBERO\) and halts or defers \(§[2\.1](https://arxiv.org/html/2606.06660#S2.SS1)\); Pre\-VLA resamples the same policy for\+6\.83\+6\.83pp \(§[2\.2](https://arxiv.org/html/2606.06660#S2.SS2)\); HELM rolls back and replans within the same frozen policy \(§[2\.2](https://arxiv.org/html/2606.06660#S2.SS2)\); FailSafe conditions recovery actions and reports\+22\.6%\+22\.6\\%on ManiSkill \(§[2\.2](https://arxiv.org/html/2606.06660#S2.SS2)\)\. The escalation column is marked✓only when the recovery routes to a distinct stronger executor, which is why no prior row earns it\.### 2\.1Detect\-only failure prediction

Our signal’s closest twin is SAFE, which trains a probe on a manipulation policy’s hidden states and predicts eventual failure at AUROC7272–93%93\\%on LIBERO\[[11](https://arxiv.org/html/2606.06660#bib.bib4)\]\. We adopt the same family of cheap internal signal, a hidden\-state probe read from a frozen policy, and we report the same precondition quantity \(early\-window AUROC\)\. The difference is what happens after the alarm: SAFE halts or defers to a human, and reports no recovery\. We treat SAFE’s all\-steps AUROC as the reference for our early\-window \(≤30%\\leq 30\\%\) precondition and then go past it, escalating and measuring recovery\. Several methods raise a conformal alarm from different sources\. FIPER uses RND\-based out\-of\-distribution scores and action entropy\[[21](https://arxiv.org/html/2606.06660#bib.bib5)\]\. FAIL\-Detect uses a success\-only OOD detector with flow\-density scoring\[[27](https://arxiv.org/html/2606.06660#bib.bib6)\]\. ReconVLA places its alarm on action tokens\[[8](https://arxiv.org/html/2606.06660#bib.bib7)\]\. Sentinel fuses temporal action\-consistency with a vision\-language model for early warning\[[1](https://arxiv.org/html/2606.06660#bib.bib8)\]\. Pre\-VLA additionally exposes a validity head used for detection\[[24](https://arxiv.org/html/2606.06660#bib.bib2)\]\. Every method in this group*detects*: it predicts or flags, and then halts, defers, or resamples\. INSIGHT is a close detect\-and\-defer neighbor: token\-level uncertainty triggers a request for help rather than a separate stronger executor\[[13](https://arxiv.org/html/2606.06660#bib.bib3)\]\. None escalates to a stronger separate policy, and none reports a recovered\-task\-rate\. Casting this absence as a runtime\-authorization gap raises the bar on what a method must demonstrate to claim it closes the gap rather than merely measuring it\.

### 2\.2Recover\-within\-the\-same\-policy

The closest prior work overall is HELM, which recovers within the*same*frozen policy instead of escalating to a different one\[[30](https://arxiv.org/html/2606.06660#bib.bib1)\]\. HELM is both our nearest neighbor and a required foil: we re\-implement a rollback\-to\-checkpoint\-and\-replan recovery in the spirit of recover\-within\-the\-same\-policy methods as a budget\-matched baseline arm \(§[3](https://arxiv.org/html/2606.06660#S3)\) and require targeted escalation to beat it at matched compute\. The distinction is the policy class\. HELM never leaves the policy that is failing; we route to a stronger one\. Pre\-VLA resamples the same policy behind a real warm\-up horizonTwT\_\{w\}before it allows intervention, recovering\+6\.83\+6\.83pp\[[24](https://arxiv.org/html/2606.06660#bib.bib2)\]\. We adopt the idea of a warm\-up horizon as one motivation for our early\-harm gate while differentiating its mechanism: we gate escalation, not verification activation, and add a per\-episode budget cap\. LiLo\-VLA recovers on LIBERO\-Long by retrying and backtracking within a modular planner\-plus\-VLA stack\[[29](https://arxiv.org/html/2606.06660#bib.bib10)\]\. On a different benchmark, FailSafe conditions recovery actions on LLaVA\-OV and reports\+22\.6%\+22\.6\\%on ManiSkill, again as recovery actions inside the policy rather than escalation to a separate one\[[16](https://arxiv.org/html/2606.06660#bib.bib11)\]\. A VLM supervisor in FPC\-VLA*authors corrective strategies*for the same motor stack, not a stronger motor policy\[[28](https://arxiv.org/html/2606.06660#bib.bib12)\]\. Confidence\-Gated Robot Autonomy gates between acting and deferring on uncertainty\[[10](https://arxiv.org/html/2606.06660#bib.bib9)\]; deferring is not escalating, since there is no stronger executor that takes over\. Finally, FARL learns recovery via an RL post\-training world\-model safety critic with offline recovery, a training\-time regime distinct from our runtime, training\-free escalation\[[15](https://arxiv.org/html/2606.06660#bib.bib14)\]\. World\-model approaches learn to imagine or roll out future states for anticipation or replanning, whether as a unified VLA\-plus\-world\-model\[[5](https://arxiv.org/html/2606.06660#bib.bib15)\]or an RL post\-training safety critic\[[15](https://arxiv.org/html/2606.06660#bib.bib14)\]\. Our early\-warning signal instead reads directly from*frozen*VLA internals, with no learned dynamics model and no training\-time regime\. And our intervention escalates to a stronger separate policy rather than replanning against an imagined rollout, the recover\-within\-the\-same\-policy lane we use as a baseline through HELM and Pre\-VLA\[[30](https://arxiv.org/html/2606.06660#bib.bib1),[24](https://arxiv.org/html/2606.06660#bib.bib2)\]\.

### 2\.3Relation to the authors’ companion memory work, and theoretical anchors

This paper is the orthogonal inverse of our companion memory work, AURA\-Mem\[[6](https://arxiv.org/html/2606.06660#bib.bib20)\]\. AURA gates memory writes*inward*to save bandwidth at fixed success; AEGIS gates compute and policy*outward*to raise success at fixed memory\. The trigger semantics differ \(should I write versus will this trajectory fail and should I escalate\) and so does the metric\. AURA itself notes that it is a memory layer that does not by itself raise robot success, and this paper is the success\-raising counterpart\. Any action\-prediction complement we compute is retrained on the trajectory\-failure label, never on AURA’s write\-worthiness target\.

Our three causal controls and early\-harm gate are motivated by the intervention\-paradox result: accurate prediction does not imply effective prevention, and an AUROC\-0\.940\.94predictor can drive a−26\-26pp change in success because interventions that recover failing trajectories also disrupt trajectories that would have succeeded\[[26](https://arxiv.org/html/2606.06660#bib.bib13)\]\. This is the motivation, not a claim we make about our own numbers\. The compounding nature of the failures we target is the classicalO​\(ϵ​T2\)O\(\\epsilon T^\{2\}\)error\-accumulation intuition of DAgger\[[22](https://arxiv.org/html/2606.06660#bib.bib16)\]\. Our substrate is LIBERO\[[17](https://arxiv.org/html/2606.06660#bib.bib17)\]; our probe\-target backbone and the supporting quantization experiment use OpenVLA\-OFT\[[14](https://arxiv.org/html/2606.06660#bib.bib18)\]; RynnVLA\-002 is cited for context as a unified VLA\-plus\-world\-model backbone\[[5](https://arxiv.org/html/2606.06660#bib.bib15)\]\.

## 3Method

![Refer to caption](https://arxiv.org/html/2606.06660v1/figures/fig_architecture.png)Figure 3:AEGIS at run time\.The weak policy drives by default \(blue path\)\. A logistic\-regression probe \(the only trained component\) reads the weak policy’s frozen layer\-15 action\-expert activations and emits a per\-step risk score\. A gate \(conformal trigger\+\+early\-harm guard\+\+per\-episode budget cap\) turns that score into a binary escalation decision; on flagged steps, control switches at the next chunk boundary to a stronger*separate*frozen policy \(green path\), which runs only while flagged\. The emitted actionata\_\{t\}steps the environment and closes the loop back to the next observation \(bottom arrow\)\. Both policies stay frozen; nothing is fine\-tuned\.AEGIS has four parts \(Fig\.[3](https://arxiv.org/html/2606.06660#S3.F3)\): a cheap per\-step signal read from a frozen VLA \(§[3\.1](https://arxiv.org/html/2606.06660#S3.SS1)\), a conformal threshold that turns the signal into a trigger at a controlled false\-trigger rate \(§[3\.2](https://arxiv.org/html/2606.06660#S3.SS2)\), an early\-harm gate that suppresses premature and excessive escalation \(§[3\.2](https://arxiv.org/html/2606.06660#S3.SS2)\), and an escalation handoff that routes flagged steps to a stronger separate policy \(§[3\.3](https://arxiv.org/html/2606.06660#S3.SS3)\)\. Figure[4](https://arxiv.org/html/2606.06660#S3.F4)shows the gate logic on a single trajectory: the risk score rises, crosses the conformal threshold inside the early window, and hands control to the stronger policy at the next chunk boundary\. §[3\.4](https://arxiv.org/html/2606.06660#S3.SS4)then gives the causal\-identification argument that makes the resulting recovery a claim about the*selectivity*of the signal rather than about spending extra compute\.

![Refer to caption](https://arxiv.org/html/2606.06660v1/figures/fig_decision_timeline.png)Figure 4:How the gate decides\.Stylized per\-step view of one trajectory\. The probe’s risk scorests\_\{t\}\(indigo\) rises as failure approaches\. The early\-harm guard suppresses any escalation beforetmin=0\.20​Tt\_\{\\min\}\{=\}0\.20\\,T\(hatched\); the≤30%\\leq 30\\%band is the probe’s evaluation window where AUROC is read, not a runtime firing cutoff\. Whensts\_\{t\}crosses the conformal thresholdτ\\tau\(red\), control hands to the stronger policy at the next chunk boundary \(green\) and is held, deflecting the trajectory that the weak policy alone would have driven to failure \(dashed grey\)\. The trigger may also fire later than this example; late fires still act but count as early\-warning misses\. The same selectivity is what keeps the stronger policy dormant on the other steps\.#### Setup and notation\.

A deployed \(*weak*\) policyπw\\pi\_\{w\}executes a long\-horizon task as a trajectory ofTTcontrol steps; it emits actions in chunks of horizonHH, so stepttbelongs to chunkc​\(t\)=⌊t/H⌋c\(t\)=\\lfloor t/H\\rfloor\. The pre\-registration describedH=50H=50; the executed checkpoints integrate1010\-step action chunks, so the reported runs useH=10H=10to match the policies’ native granularity \(this deviation is logged in §[4\.1](https://arxiv.org/html/2606.06660#S4.SS1)and changes no estimand or contrast definition\)\. A stronger*separate*policyπs\\pi\_\{s\}is available but is not run by default\. At each stepttthe controller observes a cheap per\-step scorest∈ℝs\_\{t\}\\in\\mathbb\{R\}read fromπw\\pi\_\{w\}’s frozen internals \(§[3\.1](https://arxiv.org/html/2606.06660#S3.SS1)\), compares it to a calibrated, time\-varying thresholdδt\\delta\_\{t\}\(§[3\.2](https://arxiv.org/html/2606.06660#S3.SS2)\), and emits a binary escalation decision𝖾𝗌𝖼t∈\{0,1\}\\mathsf\{esc\}\_\{t\}\\in\\\{0,1\\\}subject to an early\-harm gate and a per\-episode budget cap\. When𝖾𝗌𝖼t=1\\mathsf\{esc\}\_\{t\}\{=\}1the next chunk boundary hands control toπs\\pi\_\{s\}\(§[3\.3](https://arxiv.org/html/2606.06660#S3.SS3)\)\. Bothπw\\pi\_\{w\}andπs\\pi\_\{s\}remain*frozen*: no policy weights are ever updated, and the only learned component is the probe head, whose parameters are disjoint from both policies\.

### 3\.1Cascade signal from frozen VLA internals

#### Primary signal: a hidden\-state failure probe\.

The primary signal is a probe read fromπw\\pi\_\{w\}’s frozen internal activations\. We place a forward hook on a fixed layer of the deployed policy and mean\-pool the captured activations over theHH\-token action chunk to obtain a fixed\-dimensional feature

𝐡t=mean​\-​poolj=1H⁡at,j\(ℓ\)∈ℝd,\\mathbf\{h\}\_\{t\}\\;=\\;\\operatorname\*\{mean\\text\{\-\}pool\}\_\{j=1\}^\{H\}\\,a^\{\(\\ell\)\}\_\{t,j\}\\;\\in\\;\\mathbb\{R\}^\{d\},whereat,j\(ℓ\)a^\{\(\\ell\)\}\_\{t,j\}is the layer\-ℓ\\ellactivation at tokenjjof the chunk at steptt\. The deployed policy is SmolVLA \(a450450M VLA\)\[[23](https://arxiv.org/html/2606.06660#bib.bib22)\]\. The probe reads the activations of the*action expert*\(the head that integrates flow\-matching action chunks\), not the vision encoder: we hook the output projection of the self\-attention block at action\-expert layerℓ=15\\ell=15, i\.e\.model\.vlm\_with\_expert\.lm\_expert\.layers\[15\]\.self\_attn\.o\_proj, which exposes a720720\-dimensional per\-token representation; mean\-pooling over the chunk gives𝐡t∈ℝ720\\mathbf\{h\}\_\{t\}\\in\\mathbb\{R\}^\{720\}\(d=720d=720\)\. This hook is read*live*during rollout \(the captured activations vary step\-to\-step, standard deviation\>0\.05\>0\.05, confirming the hook fires on the live forward pass rather than on a frozen cached feature\)\. An earlier implementation that hooked the vision encoder captured a feature that did not vary with the rollout and yielded chance\-level prediction \(AUROC0\.500\.50\); we identified this as a hook\-placement bug, moved the probe onto the live action\-expert path above, and report the bug and its correction in §[4\.1](https://arxiv.org/html/2606.06660#S4.SS1)\. The probe head is a two\-layer multilayer perceptrongθ:ℝd→\(0,1\)g\_\{\\theta\}:\\mathbb\{R\}^\{d\}\\\!\\to\\\!\(0,1\)\[[2](https://arxiv.org/html/2606.06660#bib.bib26)\]with architecture\[d→256→1\]\[d\\to 256\\to 1\]\(i\.e\.\[720→256→1\]\[720\\to 256\\to 1\]on the executed SmolVLA action\-expert path;\[4096→256→1\]\[4096\\to 256\\to 1\]when probing an OFT\-7B backbone in the supporting study\[[14](https://arxiv.org/html/2606.06660#bib.bib18)\]\), trained with a binary cross\-entropy objective and per\-class weights against the*eventual*trajectory outcome labely∈\{0,1\}y\\in\\\{0,1\\\}\(fail=1=1\)\. The per\-step probe score isstprobe=gθ​\(𝐡t\)s^\{\\mathrm\{probe\}\}\_\{t\}=g\_\{\\theta\}\(\\mathbf\{h\}\_\{t\}\)\.

#### Label, early window, and the trajectory\-split protocol\.

The labelyyis the trajectory’s eventual success/failure, so the probe is trained to*anticipate*failure rather than to react to it\. Two leakage\-control choices are made before any data is seen and are binding\. First, the probe is trained*only*on early steps,t≤0\.30​Tt\\leq 0\.30\\,T, so that prediction by the readout point cannot use information from the part of the trajectory the controller is trying to pre\-empt; AUROC is reported on this same early window\. Second, the train/validation/test split is performed at the*trajectory*level,70/15/1570/15/15, never at the step level: all early\-window steps of a given rollout fall entirely within one split, which prevents the temporally correlated steps of one trajectory from appearing in both training and test\. All probe fitting and AUROC scoring are done offline on logged rollouts, so the signal adds no rollout\-time cost beyond the forward hook\. The precondition target is early\-windowAUROC​\(0\.30​T\)≥0\.75\\mathrm\{AUROC\}\(0\.30\\,T\)\\geq 0\.75with a DeLong confidence interval; SAFE’s all\-steps AUROC of7272–93%93\\%is the reference, and we report the*early\-window*curve rather than an all\-steps number\[[11](https://arxiv.org/html/2606.06660#bib.bib4)\]\. That a linear or shallow probe on frozen VLA internals carries outcome\-relevant information is what we rely on here\. Our contribution is its use as an*early*, conformally\-thresholded*escalation*trigger with a recovered\-task\-rate readout and causal controls\.

![Refer to caption](https://arxiv.org/html/2606.06660v1/figures/fig_probe_pipeline.png)Figure 5:Offline probe build and calibration\.Everything in this figure happens*once, before deployment*, and changes nothing at rollout time\. A held\-out calibration set is rolled out under the frozen weak VLA; a forward hook captures layer\-15 action\-expert activations𝐡t\\mathbf\{h\}\_\{t\}\. The only trained component is a two\-layer MLP probe head\[720→256→1\]\[720\\to 256\\to 1\]fit to the eventual\-failure label on early\-window steps\. Split\-conformal calibration then turns the probe scores into a distribution\-free risk thresholdδt\\delta\_\{t\}\(target miscoverage\), and the resulting gate parameters \(conformal trigger, early\-harm guardtmint\_\{\\min\}, per\-episode budget capkmaxk\_\{\\max\}\) are frozen for deployment\. Both policies stay frozen throughout\.*\(Schematic of the offline pipeline; numerical hyperparameters are given in §[3\.2](https://arxiv.org/html/2606.06660#S3.SS2)\.\)*
#### Cheap complementary signals\.

Alongside the probe we compute three complementary scores from the same single logged rollout, all essentially free or cheap:

- •Chunk\-overlap deltaΔtchunk\\Delta^\{\\mathrm\{chunk\}\}\_\{t\}: theL2L\_\{2\}disagreement between the overlapping regions of consecutive action chunks,Δtchunk=∥at−at−1∥2\\Delta^\{\\mathrm\{chunk\}\}\_\{t\}=\\lVert a\_\{t\}\-a\_\{t\-1\}\\rVert\_\{2\}over the overlap\. Literally free from the logged actions\.
- •STAC varianceVartSTAC\\operatorname\*\{Var\}^\{\\mathrm\{STAC\}\}\_\{t\}: the temporal\-consistency variance of the action chunk\. Free\.
- •Flow\-matching sampling disagreementMADtK\\mathrm\{MAD\}^\{K\}\_\{t\}: we drawK=4K=4action chunks fromπw\\pi\_\{w\}with distinct flow\-matching noise seeds and take the mean absolute deviation across samples,MADtK=MAD\(\{at\(k\)\}k=1K\)\\mathrm\{MAD\}^\{K\}\_\{t\}=\\operatorname\*\{MAD\}\\big\(\\\{a^\{\(k\)\}\_\{t\}\\\}\_\{k=1\}^\{K\}\\big\)\. On SmolVLA/π0\.5\\pi\_\{0\.5\}this reuses a shared KV cache so only the small action expert re\-integrates; the added wall\-clock is reported as measured rather than pre\-claimed\.

The fused per\-step feature is𝐱t=\[stprobe,Δtchunk,VartSTAC,MADtK\]\\mathbf\{x\}\_\{t\}=\[\\,s^\{\\mathrm\{probe\}\}\_\{t\},\\,\\Delta^\{\\mathrm\{chunk\}\}\_\{t\},\\,\\operatorname\*\{Var\}^\{\\mathrm\{STAC\}\}\_\{t\},\\,\\mathrm\{MAD\}^\{K\}\_\{t\}\\,\], and the trigger scorests\_\{t\}used downstream is the probe output by default; fusion of the complements beyond the primary probe is exploratory and labelled as such\. We explicitly do*not*rely on token\-logit entropy or MC\-dropout as primary signals \(both sit near chance on these policies\), and we do not use a quantile\-spread head, which on theπ0\.5\\pi\_\{0\.5\}checkpoint is a normalization artifact rather than an uncertainty estimate\.

#### Differentiation experiment\.

On the*same*rollouts we also compute an action\-prediction\-surprise signal in the style of our companion memory work\[[6](https://arxiv.org/html/2606.06660#bib.bib20)\], retrained on the trajectory\-failure label, never on the write\-worthiness target\. The closest surprise proxy we log, the chunk\-overlap deltaΔchunk\\Delta^\{\\mathrm\{chunk\}\}, carries some early signal \(early\-window AUROC0\.630\.63\) but is materially weaker than the failure\-anticipatory probe \(0\.7380\.738conservative pilot,0\.7640\.764on the confirmatory run\)\. The surprise proxy is informative but dominated\. The differentiation from the companion memory work therefore does not rest on surprise being at chance\. It rests on*orthogonal trigger semantics*\(should I write to memory versus will this trajectory fail and should I escalate\) and an orthogonal metric \(write\-worthiness versus recovered\-task\-rate\), with the failure\-trained probe additionally being the stronger early predictor\. This is the empirical reason the probe is more than a relabelled action\-prediction signal\.

### 3\.2Conformal trigger threshold and early\-harm gate

#### Split\-conformal trigger threshold\.

The full offline build that produces this threshold and the gate parameters is summarized in Fig\.[5](https://arxiv.org/html/2606.06660#S3.F5)\. We convert the per\-step scorests\_\{t\}into a trigger with split\-conformal calibration\[[3](https://arxiv.org/html/2606.06660#bib.bib25)\]\. Using a held\-out calibration set of early\-window steps drawn from would\-not\-fail trajectories, we treatsts\_\{t\}as a nonconformity score and choose a time\-varying thresholdδt\\delta\_\{t\}as the appropriate empirical quantile of the calibration scores so that the per\-step false\-trigger rate is controlled at levelα=0\.10\\alpha=0\.10; concretely, withnncalibration scores the threshold is the⌈\(1−α\)​\(n\+1\)⌉\\lceil\(1\-\\alpha\)\(n\+1\)\\rceil\-th order statistic\. We use this as split\-conformal\-*style*quantile calibration to target a nominal per\-step false\-trigger rate, and we are deliberately careful about what it guarantees: because steps within a trajectory are correlated and the thresholdδt\\delta\_\{t\}varies with trajectory fraction, the finite\-sample coverage is marginal at the calibrated score level rather than a clean trajectory\-level distribution\-free guarantee, so we report the realized trigger rates empirically rather than leaning on the nominal level\. The raw escalation indicator is then

𝖾𝗌𝖼traw=1​\[st≥δt\]\.\\mathsf\{esc\}^\{\\mathrm\{raw\}\}\_\{t\}\\;=\\;\\mathbf\{1\}\\\!\\left\[\\,s\_\{t\}\\,\\geq\\,\\delta\_\{t\}\\,\\right\]\.We allowδt\\delta\_\{t\}to vary with trajectory fractiont/Tt/Tso that the false\-trigger rate is controlled across the early window rather than only on average\. We sweepα∈\[0\.01,0\.20\]\\alpha\\in\[0\.01,0\.20\]to trace the overhead/recovery tradeoff curve \(descriptive\)\.

#### Per\-stratum calibration\.

Marginal conformal coverage need not hold*conditionally*within a difficulty stratum\. We therefore calibrate one threshold per difficulty stratum \(the terciles of §[4](https://arxiv.org/html/2606.06660#S4)\) whenever the per\-stratum calibration set is large enough; where a stratum is too small to calibrate its own threshold without instability, we fall back to a shared threshold and explicitly disclaim that coverage is then marginal rather than conditional\. The choice between per\-stratum and shared calibration is decided on the pilot and reported, not chosen after seeing main\-run outcomes\.

#### Early\-harm gate and budget cap\.

An*early\-harm gate*suppresses any escalation beforetmin=max⁡\(0\.20​T,2\)t\_\{\\min\}=\\max\(0\.20\\,T,2\), and a per\-episode budget cap admits at mostKmax=⌈0\.05​T⌉K\_\{\\max\}=\\lceil 0\.05\\,T\\rceilescalations, ranked by signal within the budget\. The realized escalation decision is therefore

𝖾𝗌𝖼t=𝖾𝗌𝖼traw⋅𝟏​\[t≥tmin\]⋅𝟏​\[∑u≤t𝖾𝗌𝖼u≤Kmax\],\\mathsf\{esc\}\_\{t\}\\;=\\;\\mathsf\{esc\}^\{\\mathrm\{raw\}\}\_\{t\}\\cdot\\mathbf\{1\}\[\\,t\\geq t\_\{\\min\}\\,\]\\cdot\\mathbf\{1\}\\\!\\Big\[\\textstyle\\sum\_\{u\\leq t\}\\mathsf\{esc\}\_\{u\}\\leq K\_\{\\max\}\\Big\],with ties at the budget boundary broken by the largersus\_\{u\}\. The gate is motivated both by the intervention\-paradox finding\[[26](https://arxiv.org/html/2606.06660#bib.bib13)\]and by Pre\-VLA’s real warm\-up horizonTwT\_\{w\}\[[24](https://arxiv.org/html/2606.06660#bib.bib2)\]\. We differentiate our gate from Pre\-VLA’s on two counts: ours gates*escalation*\(handing control to a separate policy\) rather than verification activation within the same policy, and ours adds the explicit budget capKmaxK\_\{\\max\}that bounds the escalation tail and keeps “targeted” from collapsing into always\-strong\. We do not claim the gate is wholly novel\.

#### Trigger count versus duty cycle \(what the cap bounds\)\.

Three quantities must be kept distinct\. The budget capKmaxK\_\{\\max\}bounds the number of*gate fires*\(trigger events\) per episode, not the number of strong\-policy steps\. Because each fire hands control at the next chunk boundary and holds the stronger policy for at leastk=3k\{=\}3chunks of lengthH=10H\{=\}10before de\-escalation is considered, one fire activates the stronger policy for tens of steps\. The realized*duty cycle*, the fraction of executed steps on which the stronger policy is active, is therefore an emergent consequence of the fire pattern, the hold, and early task termination; on the confirmatory run it is0\.380\.38\(step\-weighted,n=700n\{=\}700\)\. The budget\-matched controls \(C, D; §[3\.3](https://arxiv.org/html/2606.06660#S3.SS3)\) are matched to B on this realized strong\-step budget and its temporal distribution, not merely on the trigger count, so a B\-over\-control win cannot be bought with extra stronger\-policy compute\. Finally, the≤30%\\leq 30\\%early window is the probe’s*evaluation/precondition*readout \(where we measure AUROC\), not a runtime upper cutoff on firing: at deployment the early\-harm guard suppresses switches beforetmin=0\.20​Tt\_\{\\min\}\{=\}0\.20\\,T, while the conformal trigger may fire later if the score crossesδt\\delta\_\{t\}, and such late fires are counted as misses for the early\-warning precondition even though the controller still acts on them\.

### 3\.3Escalation handoff and the four\-arm factorial

#### Chunk\-boundary handoff, hold, and hysteretic de\-escalation\.

Escalation is realized only at action\-chunk boundaries\. When a step clears the gate and budget \(𝖾𝗌𝖼t=1\\mathsf\{esc\}\_\{t\}\{=\}1\), control transfers fromπw\\pi\_\{w\}toπs\\pi\_\{s\}at the next chunk boundary \(H=10H=10on the executed checkpoints; §[4\.1](https://arxiv.org/html/2606.06660#S4.SS1)\), which keeps the switch aligned with the policies’ native action granularity and avoids cutting into a partially\-executed chunk\. Figure[6](https://arxiv.org/html/2606.06660#S3.F6)shows this gating per step across several episodes\. Once engaged,πs\\pi\_\{s\}is*held*for a minimum ofk=3k=3chunks before any return is considered, and de\-escalation back toπw\\pi\_\{w\}uses hysteresis: the controller returns to the weak policy only after the score has stayed below the \(lower\) de\-escalation threshold for the hold window, so the system does not chatter between policies on a borderline signal\. The two policies do not in general agree on the in\-flight action chunk, so a handoff risks a kinematic discontinuity\. Holding the handoff to chunk boundaries \(above\) is our first guard\. As a future extension we plan to condition the incoming policy’s first chunk on the committed tail of the outgoing chunk in the style of real\-time chunking \(RTC\) inpainting, so the executed trajectory is continuous in action space\. The executed pilot uses the chunk\-boundary handoff without RTC inpainting\.

![Refer to caption](https://arxiv.org/html/2606.06660v1/figures/fig_trajectory_strip.png)Figure 6:Selectivity, per step\.Each row is one episode; bar colour encodes the per\-step probe risk scorests\_\{t\}\(grey low, red high\), and red markers show the steps where the gate fires and control hands to the stronger policy\. AEGIS escalates only a small fraction of steps per episode \(∼38%\{\\sim\}38\\%in the confirmatoryn=700n\{=\}700run\) rather than running the stronger policy throughout; the figure also shows a late\-detection miss \(gate fires only past80%​T80\\%\\,T\) and a clean weak\-only success that is never escalated\.*\(Schematic risk profiles; the escalated\-step fraction is the measured confirmatoryn=700n\{=\}700value\.\)*
#### In\-process, single\-container design \(security rationale\)\.

Both policies are held warm in a*single*process inside one container, so a handoff is a function call rather than a network round\-trip\. This is partly a latency choice and partly a security one: we deliberately never instantiate the framework’s networkedPolicyServerpath, which is subject to a pickle\-deserialization remote\-code execution vulnerability \(CVE\-2026\-25874\)\. Keeping both frozen policies co\-resident in one container removes that attack surface entirely while letting the stronger policy stay warm \(it fits in∼9\.5\{\\sim\}9\.5GB of VRAM, so a single mid\-range accelerator suffices\)\. The weak/strong pair issmolvla\_libero\(450450M\) escalating topi05\_libero\_finetuned\(4\.144\.14B\)\[[20](https://arxiv.org/html/2606.06660#bib.bib23),[4](https://arxiv.org/html/2606.06660#bib.bib24)\]\. We write the per\-episode cost asCost​\(AEGIS\)≈Cw\+Cprobe\+ρ​Cs\\mathrm\{Cost\}\(\\text\{AEGIS\}\)\\approx C\_\{w\}\+C\_\{\\mathrm\{probe\}\}\+\\rho\\,C\_\{s\}versusCost​\(always\-strong\)=Cs\\mathrm\{Cost\}\(\\text\{always\-strong\}\)=C\_\{s\}, whereCw,CsC\_\{w\},C\_\{s\}are the per\-step weak and strong forward\-pass costs,CprobeC\_\{\\mathrm\{probe\}\}is the negligible small\-MLP probe read, andρ=0\.38\\rho\{=\}0\.38is the strong\-policy duty cycle\. The weak forward pass is retained across the episode to supply the probe score that governs triggering and hysteretic de\-escalation, soCwC\_\{w\}is paid throughout and the stronger policy runs in addition on theρ\\rhofraction of steps\. We report this as a parameter\-count\-anchored*schematic*\(Fig\.[14](https://arxiv.org/html/2606.06660#S6.F14)\), not measured wall\-clock, and we therefore speak of a*matched strong\-policy duty*between B and its controls rather than “the same compute\.” The design point is that selective escalation is cheaper than running the stronger policy on every step\.

#### The four experimental arms\.

We evaluate a four\-arm factorial, all paired by common random numbers and keyed by\(task,seed,arm\)\(\\text\{task\},\\text\{seed\},\\text\{arm\}\)via a Philox counter\-based generator so that every arm sees the identical\(task,seed,init\_state\)\(\\text\{task\},\\text\{seed\},\\text\{init\\\_state\}\)tuple and only the intervention policy varies:

A\. Weak\-onlythe weak policy runs the whole trajectory \(baseline floor\)\.

B\. Targetedsignal\-gated escalation of flagged steps to the stronger policy \(*the method*\)\.

C\. Budget\-matched\-blindthe same escalation*count*and the same step\-index\-fraction CDF as B \(conditioned on episode\-length bucket\), but with the escalated steps chosen*blind*of any signal, which isolates selectivity from raw compute\.

D\. Random\-trigger placebothe same per\-step fire rate as B, with steps chosen uniformly at random, which isolates the information in the signal\.

We additionally report analways\-strongceiling \(the stronger policy on the whole trajectory; an upper\-bound reference, not a primary contrast\)\. As required comparison baselines on the same rollouts we re\-implement a HELM\-style rollback\-to\-checkpoint plus goal\-conditioned replan\-and\-recover*within the weak policy*\(Rmax=3R\_\{\\max\}=3\), budget\-matched to B’s extra compute\[[30](https://arxiv.org/html/2606.06660#bib.bib1)\], and a SAFE\-style detect\-and\-halt with no recovery as the detection\-only reference\[[11](https://arxiv.org/html/2606.06660#bib.bib4)\]\. We follow the reporting conventions of the HELM and SAFE evaluations for comparability on LIBERO\[[30](https://arxiv.org/html/2606.06660#bib.bib1),[11](https://arxiv.org/html/2606.06660#bib.bib4)\]\.

#### A second strong policy, for generalization\.

To show that the effect is a property of escalating to a stronger*separate*policy and not of one lucky weak/strong pair, the main factorial repeats the targeted arm B with the escalation*target*swapped fromπ0\.5\\pi\_\{0\.5\}to NVIDIA’s GR00T N1\.x \(the official LIBERO checkpoint, run LeRobot\-native\), holding the deployed weak policy, signal, and threshold fixed\[[19](https://arxiv.org/html/2606.06660#bib.bib19)\]; GR00T is an escalation target only, never a signal source, and this generalization arm is a robustness result, not one of the make\-or\-break primary contrasts, which stay on theπ0\.5\\pi\_\{0\.5\}pair\.

### 3\.4Causal identification: controller vs\. difficulty proxy

The purpose of this paper is a*causal*claim, that escalating where the signal fires recovers tasks*because*of where it escalates, so we state the estimand, the identifying contrasts, and the condition under which the claim is falsified, all before any data exists\.

#### Estimand\.

The target estimand is the recovered\-task\-rate, conditional on the subset of trajectories the weak policy alone fails:

RTRB=Pr⁡\[task succeeds under arm​B\|weak\-only arm​A​fails on that​\(task,seed\)\]\.\\mathrm\{RTR\}\_\{B\}\\;=\\;\\Pr\\\!\\big\[\\,\\text\{task succeeds under arm \}B\\;\\big\|\\;\\text\{weak\-only arm \}A\\text\{ fails on that \}\(\\text\{task\},\\text\{seed\}\)\\,\\big\]\.The conditioning event is essential: a method that escalates can only*recover*a trajectory that would otherwise have failed, so the relevant population is theAA\-failing subset, not all episodes\. Because every arm is run under common random numbers on the same\(task,seed,init\_state\)\(\\text\{task\},\\text\{seed\},\\text\{init\\\_state\}\)tuple, “AAfails” is observed on the*same*trajectory whose arm\-BBoutcome we score, and the contrast of interest is the within\-pair difference in success on those discordant trajectories\.

#### WhyB\>AB\>Aalone does not identify the effect\.

ArmBBspends strictly more compute than armAA\(it runs the stronger policy on some steps\), and the steps it escalates are, by construction, the steps the signal finds alarming, which are also, on average, the harder steps\. A raw improvement ofBBoverAAis therefore consistent with at least two non\-causal explanations: \(i\) a*raw\-compute*artifact, in which any extra application of the stronger policy would help regardless of where it is placed; and \(ii\) a difficulty\-proxy artifact, in which the signal merely indexes which trajectories are hard and the apparent gain is a re\-description of difficulty rather than an effect of selective intervention\. The intervention\-paradox result makes the danger concrete: prediction accuracy alone licenses no claim about a controller\[[26](https://arxiv.org/html/2606.06660#bib.bib13)\]\. We therefore design two controls that hold the confounds fixed and vary only the thing we claim is causal:*where*the compute is spent\.

#### The two identifying controls\.

ArmCC\(budget\-matched\-blind\) escalates the*same number*of steps asBB, drawn so that its step\-index\-fraction CDF matchesBB’s within each episode\-length bucket, but chooses*which*steps blind of the signal\.CCthus equalizes total stronger\-policy compute and its temporal distribution; the only thing it removes is the signal’s selectivity\. A win ofBBoverCCcannot be explained by raw compute, because compute is held equal\. It can only be explained by escalating the*right*steps\. ArmDD\(random\-trigger placebo\) fires at the*same per\-step rate*asBBbut on uniformly random steps; it removes the information in the signal while preserving its intensity\. A win ofBBoverDDshows the trigger carries real predictive information rather than firing as a constant\-rate process\. Holding both contrasts*within difficulty strata*\(§[4](https://arxiv.org/html/2606.06660#S4)\) closes the difficulty\-proxy loophole: ifBBbeatsCCandDDeven inside the medium\-difficulty stratum where every arm faces comparably hard trajectories, the gain cannot be a re\-description of cross\-trajectory difficulty\. Probing studies that establish a separating signal typically rely on label\-shuffle and temporal controls rather than a budget\-matched and a rate\-matched intervention control, which is exactly why such evidence alone cannot make the causal selectivity claim we make here\.

#### Falsification \(the kill / null condition\)\.

The claim is falsified, and the paper is reported honestly as a characterization rather than a controller result, if either of the following holds\. \(K1\) The early\-window probe AUROC sits at chance, so there is no anticipatory signal to act on\. \(K2\) TheRTR\\mathrm\{RTR\}gain ofBBdoes*not*survive difficulty stratification*and*does not beatCC*and*does not beatDD, in which case the signal is a difficulty proxy rather than a controller, and we say so\. Two further pre\-committed conditions bound scope: \(K3\) if the escalation fraction exceeds50%50\\%, “targeted” has collapsed into always\-strong and the cost argument dies; and \(K4\) if prior art appears that also escalates flagged steps to a stronger*separate*policy with a recovery metric, the novelty axis is occupied and we reassess\. These conditions are named here, before data, so that the null that would sink the claim is not negotiable after the fact\.

## 4Experimental Design \(Pre\-Registered\)

*This analysis plan was frozen before any experimental result existed\.*Deviations discovered after seeing data are reported in the dedicated “Deviations from Pre\-Registration” subsection \(§[4\.1](https://arxiv.org/html/2606.06660#S4.SS1)\) below\.

#### Primary endpoint and conditional estimand\.

The headline is the recovered\-task\-rate,RTRB=Pr⁡\[task succeeds under B∣weak\-only arm A fails on that​\(task,seed\)\]\\mathrm\{RTR\}\_\{B\}=\\Pr\[\\,\\text\{task succeeds under B\}\\mid\\text\{weak\-only arm A fails on that \}\(\\text\{task\},\\text\{seed\}\)\\,\]\. This is conditional on the A\-failing subset, whose size is the number of A\-failures rather than the total episode count; we power on this conditional subset, not on aggregate episode count\. The unit of paired evidence is a*discordant pair*: a\(task,seed\)\(\\text\{task\},\\text\{seed\}\)tuple where two arms differ in success\. Common random numbers make A/B/C/D paired at the trajectory level: every arm sees the same\(task,seed,init\_state\)\(\\text\{task\},\\text\{seed\},\\text\{init\\\_state\}\)tuple, and only the intervention policy varies, which is what licenses the paired tests below\.

#### Primary contrasts and multiplicity\.

The primary family of exactly three contrasts is tested under Holm–Bonferroni\[[12](https://arxiv.org/html/2606.06660#bib.bib28)\]at family\-wiseα=0\.05\\alpha=0\.05: \(1\)B\>AB\>A\(recovery exists at all\), \(2\)B\>CB\>C\(beats budget\-matched\-blind spend, isolating selectivity from raw compute\), and \(3\)B\>DB\>D\(beats the random\-trigger placebo, isolating the information in the signal\)\. All three are*one\-sided*\(each hypothesis is directional,BBabove the named control\)\. Contrasts \(2\) and \(3\) use an exact paired McNemar test\[[18](https://arxiv.org/html/2606.06660#bib.bib27)\]on the discordant pairs of the conditional \(AA\-failing\) subset\. Contrast \(1\) is a special case: on theAA\-failing poolAAsucceeds on zero trajectories by construction, so theB\>AB\{\>\}Acomparison has noAA\-win discordant cell and the McNemar test reduces to an exact one\-sided binomial \(sign\) test on the count ofAA\-failing trajectories thatBBrecovers; we report it as such\. Each contrast is reported alongside a paired bootstrap\[[9](https://arxiv.org/html/2606.06660#bib.bib29)\]ofB=10,000B=10\{,\}000resamples that resamples*whole trajectories*, never individual steps, to give a95%95\\%confidence interval on theRTR\\mathrm\{RTR\}difference\. The method “wins” a contrast if and only if the Holm\-adjustedp<0\.05p<0\.05*and*the95%95\\%whole\-trajectory bootstrap CI excludes0in the predicted direction; both conditions are required\. The secondary contrastB\>HELM\-baselineB\>\\text\{HELM\-baseline\}\[[30](https://arxiv.org/html/2606.06660#bib.bib1)\]is a separate family controlled at BH\-FDR=0\.10=0\.10and is reported as secondary\. Marginal success rates use Wilson intervals and small cells use Clopper–Pearson; per\-task results are shown as forest plots with a pooled diamond\.

#### Within\-stratum requirement\.

Difficulty strata are terciles of weak\-only base success per task, frozen from a5050\-rollout pilot: easy \(top tercile\), medium \(middle, weak base success2020–70%70\\%, maximum recovery headroom\), and hard \(bottom tercile\)\. For the headline claim, the RTR gain of B over each control must be\>0\>0*within every*stratum that clears the discordant\-pair floor, with special attention to the medium stratum\. A win that exists only in the pooled estimate but vanishes or reverses inside a stratum is reported as*not*supporting the causal claim\.

#### Power and hard floors\.

The sample size derives from one effect and one power target\. The pre\-stated method\-relevant effect is a1010percentage\-point gap in conditionalRTR\\mathrm\{RTR\}betweenBBand the relevant control\. The power target is80%80\\%for theB\>CB\>Cgap, the hardest of the three primary contrasts \(B\>AB\>Ais easier andB\>DB\>Deasier still\)\. At80%80\\%McNemar power for a1010pp shift in discordant proportions, this requires on the order of250250–400400discordant/failing pairs, so we pre\-commit to a hard250250floor and a target of400400\. Weak chained\-LIBERO base success is estimated near0\.50\.5, so roughly half of episodes enter theAA\-failing subset\. Reaching that many failing pairs then implies on the order of700700–800800episodes per arm, and we pre\-commit to≥700\\geq 700episodes per headline arm for cellsA/B/C/DA/B/C/D\. A binding hard floor of≥20\\geq 20discordant pairs*per primary contrast per difficulty stratum*also applies\. Any stratum below that floor is reported with exact\-binomial / mid\-PPonly and is never cited as within\-stratum confirmation\. The5050\-rollout weak\-only pilot fixes the difficulty terciles, the base\-rate that converts the discordant\-pair target into the final episode count, and the conformal thresholds; the pilot’s numbers feed these counts but never*relax*any floor\. Episode counts are fixed in advance and there is no optional stopping on primarypp\-values\.

#### Kill criteria\.

We downgrade to a characterization paper if any of: \(K1\) early\-window probe AUROC sits at chance; \(K2\) the RTR gain does not survive stratification*and*does not beat C*and*does not beat D, in which case it is a difficulty thermometer, not a controller, and we publish that honestly; \(K3\) the chained escalation fraction exceeds50%50\\%, so “targeted” collapses into always\-strong and the budget claim dies; or \(K4\) a prior\-art paper appears that also escalates flagged steps to a stronger separate policy with a recovery metric\.

### 4\.1Deviations from Pre\-Registration

We log every departure of the executed pilot from the frozen plan, with the reason and the scope of its effect\.

Action\-chunk horizonHH:50→1050\\to 10\.The pre\-registration describedH=50H=50; the executed checkpoints emit and integrate action chunks ofn\_action\_steps=10=10, so we setH=10H=10to match the policies’ native granularity\. Effect: finer escalation granularity; no change to the estimand or to any contrast definition\.

Suite: LIBERO\-Spatial\.The main factorial runs on*LIBERO\-Spatial*\(10 tasks\), the regime selected on a four\-suite pilot sweep as the in\-band difficulty band where the weak policy fails often enough to leave recovery headroom \(weak base success≈0\.33\\approx 0\.33, strong ceiling≈0\.95\\approx 0\.95, recovery headroom≈1\.0\\approx 1\.0\)\. The pre\-registration named LIBERO\-Long and chained\-LIBERO as candidate long\-horizon suites; the pilot sweep showed those bands either out of the2020–70%70\\%weak\-failure window or with lower headroom, so we committed to LIBERO\-Spatial for the confirmatory factorial\. Extending the same protocol to chained, long\-horizon suites is the natural next step \(future work\)\.

Probe source: vision\-encoder hook \(bug\)→\\tolive action\-expert layer 15o\_proj\(d=720d\{=\}720\)\.An initial implementation hooked a vision\-encoder layer and captured a feature that did not vary with the rollout, yielding chance\-level prediction \(AUROC0\.500\.50\)\. We diagnosed this as a hook\-placement bug \(the captured tensor was a frozen cached feature, not a live activation\), and moved the probe to the action expert’s self\-attention output projection at layer 15, read live during rollout\. All reported AUROC numbers use the corrected live probe\. This is a bug fix, not a post\-hoc head search: the layer was fixed before scoring and the std\-over\-steps\>0\.05\>0\.05check guards against re\-introducing a frozen feature\.

Two\-stage evidence: gate pilot then confirmatory factorial\.The pre\-registration pre\-commits to≥700\\geq 700episodes per arm and a discordant\-pair floor for the within\-stratum analysis\. The go/no\-go gate \(Phase\-D\) was powered at5656common\-random\-number keys per arm \(4141in the A\-failing conditional subset\); its confidence intervals are wide*by design*\. The confirmatory factorial reported in the main results scales the same protocol on LIBERO\-Spatial to≥700\\geq 700episodes per arm across the full10×7010\\times 70task\-by\-seed grid and the full arm set \(A weak\-only, B targeted cascade, C budget\-matched\-blind, D random\-trigger, HELM same\-policy rollback, always\-strong ceiling, and the GR00T N1\.7 cross\-family generalization arm\), supplying the within\-stratum confirmation at the pre\-registered floor\.

The abstract and method report the LIBERO\-Spatial confirmatory factorial as the headline evidence, with the Phase\-D gate retained as the pre\-committed go/no\-go decision that justified scaling to the full run\.

## 5Results

The headline result is the confirmatory factorial on LIBERO\-Spatial \(Table[2](https://arxiv.org/html/2606.06660#S5.T2)\): the full10×7010\\times 70task×\\timesseed grid at≥700\\geq 700common\-random\-number episodes per arm, with the within\-stratum confirmation at the pre\-registered discordant\-pair floor\. A small Phase\-D go/no\-go pilot \(n=56n=56keys per arm\) established directionality and triggered this pre\-registered run; we do not use it for the headline claim, and its plots sit in Appendix[A](https://arxiv.org/html/2606.06660#A1)\. Beyond the four primary arms \(A, B, C, D\), the factorial collects the HELM same\-policy rollback arm \(re\-running the*same*weak policy on flagged steps\), the always\-strong recovery ceiling, and the GR00T N1\.7 arm that escalates to a different policy family to test cross\-family generalization\. The run reported here is complete: all700700cells carry the five core arms \(A,B,C,DA,B,C,D, always\-strong\) under a single\-host pairing constraint, with HELM observed on692692cells and GR00T on all700700\. Figure[7](https://arxiv.org/html/2606.06660#S5.F7)first shows, on two real common\-random\-number keys, what the controller actually does: the weak policy alone fails while AEGIS fires the gate early and recovers the same task\.

![Refer to caption](https://arxiv.org/html/2606.06660v1/figures/fig_rollout_filmstrip.png)Figure 7:What the controller does, on two real episodes\.Each panel is one common\-random\-number key \(same task, same seed, same initial state\) run under two arms\.*Top rows \(Weak, arm A\):*the deployed weak policy alone; per\-step probe risk \(sts\_\{t\}\) climbs and the trajectory ends in failure\.*Bottom rows \(AEGIS, arm B\):*on the identical key, the gate fires \(▼\\blacktriangledown\) in the early window and control hands to the stronger policy \(dark, outlined steps\), recovering the task\. Bars encode the per\-step probe score from the loggedsignal\_trace; strong\-policy steps come from the loggedsource\_is\_strongmask, and gate\-fire positions from the recorded hand\-off steps\.*\(Real confirmatoryn=700n\{=\}700rollout data; the NPZ logs carry per\-step scores and policy\-source masks but not RGB frames, so steps are shown as a risk\-coloured strip rather than rendered images\.\)*![Refer to caption](https://arxiv.org/html/2606.06660v1/figures/fig_causal_quadrant.png)Figure 8:Selectivity, not spend, is the lever\.Each arm is placed by relative compute cost \(horizontal; weak\-policy baseline=1\.0=1\.0\) against recovered\-task rate \(vertical, confirmatoryn=700n\{=\}700data\)\. The budget\-matched controls C and D sit in the same cost bracket as AEGIS \(B\) but far below it, while always\-strong reaches near\-ceiling recovery only at≈4\.6×\\approx 4\.6\\timesthe compute\. At the shared, near\-baseline compute budget, AEGIS recovers the most of any arm in that bracket; spending more compute \(HELM, GR00T, always\-strong\) buys more recovery, so the claim is selectivity at a fixed budget, not raw dominance over the higher\-compute arms\.*\(RTR values are measured confirmatoryn=700n\{=\}700data; the compute axis uses schematic relative units anchored to parameter counts\.\)*Table 2:Confirmatory factorialon LIBERO\-Spatial: recovered\-task\-rate \(RTR\) and marginal success by arm, with paired contrasts \(≥700\\geq 700episodes per arm; full10×7010\\times 70task×\\timesseed common\-random\-number grid; horizonH=10H=10\)\. RTR is conditional on the weak\-only \(A\) failing subset\.pp\-values are Holm\-adjusted over the three primary contrasts \(B\>\{\>\}A, B\>\{\>\}C, B\>\{\>\}D\) using one\-sided exact paired tests on the conditional \(AA\-failing\) pool; the always\-strong arm bounds the recovery ceiling\. The discordant column gives \(B\-win : arm\-win\) pairs entering each exact test: forB\>AB\{\>\}Athe arm\-win cell is zero by construction \(§[4](https://arxiv.org/html/2606.06660#S4)\), so that test is a one\-sided binomial onBB’s recoveries;B\>CB\{\>\}CandB\>DB\{\>\}Dare McNemar on their discordant pairs\. The two secondary reference arms \(HELM, GR00T\) report the unadjusted exactppon the same pool; they are reference foils, not primary contrasts, and B is expected to sit below them\.Table 3:Recovery versus disruptionon the confirmatory grid \(n=700n\{=\}700;5454trajectories the weak policy alone succeeds on,646646it fails\)\. Because escalation can also derail a trajectory that would have succeeded\[[26](https://arxiv.org/html/2606.06660#bib.bib13)\], we account for both effects of each arm against the weak\-only outcome\. Selectivity shows up as the recover\-to\-disrupt ratio: AEGIS recovers the most failures while disrupting the fewest successes; blind escalation disrupts the most for the least recovery\. Counts derive from the same paired discordant cells as Table[2](https://arxiv.org/html/2606.06660#S5.T2)\(B’s disruption count equals theB\>AB\{\>\}Aarm\-win cell\)\.![Refer to caption](https://arxiv.org/html/2606.06660v1/x1.png)Figure 9:Per\-task recovered\-task rate, conditioned on the A\-failing subset\.Confirmatory factorial \(n=700n\{=\}700CRN cells\): for each of the1010LIBERO\-Spatial tasks, conditional RTR for arms B \(targeted\), C \(budget\-matched\-blind\), and D \(random\-trigger\), with Wilson95%95\\%intervals\. The bottom POOLED row shows the across\-task pooled diamonds \(targeted B near0\.100\.10, the budget\-matched controls C and D near0\.050\.05\)\. All three primary contrasts \(B\>AB\{\>\}A,B\>CB\{\>\}C,B\>DB\{\>\}D\) clear Holm\-adjusted significance on the pooled estimate\. The per\-stratum \(easy/medium/hard\) version of these contrasts appears in Fig\.[12](https://arxiv.org/html/2606.06660#S5.F12)at the pre\-registered≥20\\geq 20\-discordant\-pair floor\.![Refer to caption](https://arxiv.org/html/2606.06660v1/figures/fig_early_auroc.png)Figure 10:Early\-window \(t≤0\.30​Tt\\leq 0\.30\\,T\) failure\-prediction performance of the hidden\-state probe on the Phase\-D pilot \(leave\-one\-out out\-of\-fold;2828success /8484failure episodes\)\.*Left:*ROC of the live action\-expert probe, early\-window AUROC=0\.738=0\.738\(the confirmatory run re\-estimates this at0\.7640\.764overn=2,792n\{=\}2\{,\}792episodes, clearing the≥0\.75\\geq 0\.75main\-run precondition; Fig\.[11](https://arxiv.org/html/2606.06660#S5.F11)\)\.*Right:*the probe versus three surprise/disagreement complements on the same rollouts; the probe is the only signal clearing the0\.700\.70pilot bar\.![Refer to caption](https://arxiv.org/html/2606.06660v1/figures/fig_auroc_timeline.png)Figure 11:The probe is sharpest at the gate readout\.Failure\-prediction AUROC of the hidden\-state probe as a function of the trajectory fraction the probe is allowed to read, computed onn=2,792n\{=\}2\{,\}792episodes across1010tasks \(every point and band is data, not a schematic\)\. The headline early\-window number is read from the*weak\-policy path before any handoff*, so the label \(eventual failure under the weak policy\) and the signal are not intervention\-contaminated\. Discrimination peaks at the30%30\\%gate\-readout mark \(highlighted point: early\-window AUROC=0\.764=0\.764,95%95\\%cluster\-bootstrap CI\[0\.70,0\.84\]\[0\.70,0\.84\], clearing the pre\-registered0\.750\.75precondition\)\. The decline to the right is diagnostic only: it shows what happens when the read window is extended past the point where AEGIS would have handed off, mixing in post\-switch steps; we do not use those extended windows for the precondition\. That the signal is most discriminative exactly in the window the gate reads, rather than monotonically improving with more steps, is the early\-warning signature the controller exploits\. Bands are95%95\\%cluster\-bootstrap confidence intervals resampling tasks\.![Refer to caption](https://arxiv.org/html/2606.06660v1/x2.png)Figure 12:Conditional recovered\-task rate \(RTR\) by difficulty stratum on the confirmatory factorial run \(n=700n\{=\}700CRN cells;nA​\-fail=646n\_\{A\\text\{\-fail\}\}\{=\}646\)\. Point estimates favor targeted escalation \(B\) over budget\-matched\-blind \(C\) and random\-trigger \(D\) in all three terciles; the advantage is largest on EASY tasks \(where a single well\-timed escalation suffices\) and compresses on HARD tasks, where theB−CB\{\-\}Cinterval touches zero \(even the strong policy has thin recoverable margin there\)\. Bars are bootstrap means with95%95\\%percentile CIs \(nboot=10,000n\_\{\\text\{boot\}\}\{=\}10\{,\}000\)\.#### Confirmatory result \(n=700n\{=\}700\)\.

The full10×7010\\times 70factorial completed atn=700n\{=\}700single\-host common\-random\-number cells \(nA​\-fail=646n\_\{A\\text\{\-fail\}\}\{=\}646\); Table[2](https://arxiv.org/html/2606.06660#S5.T2)reports it\. All three primary contrasts clear the pre\-registered bar under Holm correction\. Arm B lifts the conditional recovered\-task rate from0\.0000\.000\(weak\-only\) to0\.1010\.101, beating budget\-matched\-blind \(C, RTR0\.0460\.046;B−C=\+0\.054B\{\-\}C=\+0\.054, exact\-McNemarp=8\.5×10−6p=8\.5\{\\times\}10^\{\-6\}\) and random\-trigger \(D, RTR0\.0510\.051;B−D=\+0\.050B\{\-\}D=\+0\.050,p=1\.0×10−4p=1\.0\{\\times\}10^\{\-4\}\)\. Every paired\-bootstrap interval excludes zero \(nboot=10,000n\_\{\\text\{boot\}\}\{=\}10\{,\}000\)\. At matched cost the controls sit far below the targeted arm in the recovery\-versus\-compute plane \(Fig\.[8](https://arxiv.org/html/2606.06660#S5.F8)\)\. The selectivity signature survives stratification \(Fig\.[12](https://arxiv.org/html/2606.06660#S5.F12)\):B\>DB\>Dholds in all three difficulty terciles andB\>CB\>Cholds in the EASY and MEDIUM bands, with the HARD\-bandB−CB\{\-\}Cinterval just touching zero, the expected attenuation where even the strong policy retains little recoverable margin\. The advantage also holds task by task \(Fig\.[9](https://arxiv.org/html/2606.06660#S5.F9)\)\. The stronger policy is active on only38%38\\%of steps \(its duty cycle, step\-weighted,n=700n\{=\}700grid\) yet B roughly doubles the recovery of blind or random escalation at matched strong\-policy duty\. The selectivity is also visible in the harm accounting \(Table[3](https://arxiv.org/html/2606.06660#S5.T3)\): B recovers6565of646646weak\-policy failures while disrupting only1010of5454weak\-policy successes, a recover\-to\-disrupt ratio of6\.56\.5, against1\.81\.8for blind escalation and3\.33\.3for the random trigger\. As designed, the cascade does not beat the full reference policies on raw recovery: HELM \(RTR0\.1550\.155\) and the cross\-family GR00T N1\.7 arm \(RTR0\.1550\.155\) both run a strong policy from the first flagged step and sit above B, while always\-strong bounds the ceiling at0\.3190\.319on the same pool\. That is the intended trade: at a fraction of the duty cycle, targeted escalation extracts twice the recovery of the matched\-budget controls \(Fig\.[14](https://arxiv.org/html/2606.06660#S6.F14)\), without claiming to out\-recover an always\-on strong policy\.

#### The pilot, demoted\.

The Phase\-D pilot was a pre\-committed go/no\-go check, not a headline\. It established the direction and rough magnitude of the effect onn=56n=56keys per arm and authorized the confirmatory run; all three primary contrasts cleared their pilot bars there as well\. We report it for completeness in Appendix[A](https://arxiv.org/html/2606.06660#A1)and base no claim on it\. Its larger conditional rates reflect the small, easier pilot pool, not a stronger effect than the confirmatory10\.1%10\.1\\%\.

### 5\.1Robustness to simulator non\-determinism

The headline analysis uses one single\-host common\-random\-number draw per \(task, seed\) cell\. Because the LIBERO/MuJoCo\[[25](https://arxiv.org/html/2606.06660#bib.bib30)\]rollout is not bit\-identical across hosts,212212of the700700cells were re\-rolled on more than one completion node and can carry a different success bit per draw, which lets us ask a question the point estimate alone cannot answer: would the conclusion survive if a different available draw had defined each cell? We resample,2,0002\{,\}000times, one available single\-host\-complete draw per cell, rebuild the full700700\-pair table, and recompute the three primary RTR gaps \(Fig\.[13](https://arxiv.org/html/2606.06660#S5.F13)\)\. All three contrasts remain strictly positive in*every*one of the2,0002\{,\}000redraws: the smallest gap observed anywhere in the resampling is\+0\.003\+0\.003forB−CB\{\-\}Cand\+0\.010\+0\.010forB−DB\{\-\}D, and the directional result never reverses\. The median resampled gaps run below the single\-draw headline \(B−CB\{\-\}Cmedian0\.0250\.025versus0\.0540\.054;B−DB\{\-\}Dmedian0\.0270\.027versus0\.0500\.050\)\. The mechanism is specific\. When a redraw flips a borderline cell’s weak\-arm \(A\) outcome to a success, that cell leaves the A\-failing conditional pool, and those borderline cells are exactly the ones targeted escalation is most likely to recover, so dropping them deflates the measured gap\. The robustness statement is therefore that the*sign and significance*of the selectivity advantage are invariant to which non\-deterministic draw is used, while its*magnitude*is a conservative function of pool composition; we report the single\-host draw as the headline and this resampling envelope as its sensitivity band\.

![Refer to caption](https://arxiv.org/html/2606.06660v1/figures/fig_robustness.png)Figure 13:Replicate\-resampling robustness of the primary contrasts\.For each \(task, seed\) cell rolled out on more than one host \(212212of700700\), the simulator is not bit\-identical, so the success bit can differ across draws\. Resampling which available single\-host\-complete draw defines each cell \(2,0002\{,\}000iterations\) yields the plotted distribution of the three primary RTR gaps\. Diamonds are the single\-host headline estimates; circles and bars are the replicate median and95%95\\%interval\. Every distribution stays strictly above zero \(direction never reverses\); the magnitude shrinks under adversarial redraws because flipping a borderline cell’s weak\-arm outcome removes it from the A\-failing pool \(§[5\.1](https://arxiv.org/html/2606.06660#S5.SS1)\)\.

## 6Discussion

The causal contrasts separate a controller from a difficulty proxy\. The result they license is the one that matters for deployment: the recovered fraction is bought by timing, not by spending\. A difficulty proxy that merely indexes which trajectories are hard would still beat the weak\-only floor, because escalating on hard steps recovers some of them by brute compute\. The budget\-matched\-blind control \(C\) and the rate\-matched random control \(D\) spend that same stronger\-policy compute without the probe’s timing, and they leave most of the headroom on the table\. So the gap between B and those controls is the part of the recovery that cannot be explained by extra compute alone\. That is what makes the signal a controller rather than a passive readout, and it is the property an operator actually needs: the stronger policy earns its cost only on the steps where it changes the outcome\.

The within\-stratum test is what closes the remaining loophole\. Inside a fixed difficulty band every arm faces comparably hard trajectories, so a difficulty proxy can no longer masquerade as a controller\. Then=700n\{=\}700run holds there too:B\>DB\>Din all three terciles andB\>CB\>Cin the EASY and MEDIUM bands, with only the HARD\-bandB−CB\{\-\}Cinterval touching zero \(Fig\.[12](https://arxiv.org/html/2606.06660#S5.F12)\)\. The pilot and the confirmatory run agree on sign and on the ordering of the controls, and the attenuation from pilot to full run is the regression toward a better\-estimated value we would expect, not a reversal\. Figure[14](https://arxiv.org/html/2606.06660#S6.F14)places the recovery against the always\-strong ceiling and the budget\-matched controls on a recovery\-versus\-compute plane\.

![Refer to caption](https://arxiv.org/html/2606.06660v1/figures/fig_cost_wedge.png)Figure 14:Why not just always run the stronger policy\.Per\-step compute cost across one episode\.*Left:*always\-strong pays the stronger policy’s per\-step cost on every step\.*Right:*AEGIS pays the stronger\-policy cost only on the small escalated fraction and runs the cheap weak policy \(plus probe overhead\) elsewhere, so it spends about44%44\\%of the always\-strong compute, a56%56\\%saving at the confirmatory escalation rate\. The recovery this compute buys, and the comparison with the budget\-matched controls C and D that spend the same extra compute without selectivity, is shown on the recovery\-versus\-compute plane of Fig\.[8](https://arxiv.org/html/2606.06660#S5.F8)\.*\(Escalated fraction \(38%38\\%of steps\) is from the confirmatoryn=700n\{=\}700run; the compute axis is schematic relative units anchored to the4\.144\.14B/0\.450\.45B parameter\-count ratio\.\)*In a narrow sense this is a form of runtime*metacognition*: a policy carrying a cheap internal read\-out of its own impending failure and acting on it before the failure compounds\. We use the term only as a framing for the self\-monitoring loop\. Every claim is grounded in the measured recovered\-task\-rate, not in any introspective interpretation of the probe\. Framed against the runtime authorization gap we identify, AEGIS supplies the missing*authorize\-an\-escalation*layer: the probe decides, step by step, when the deployed policy has earned the right to keep driving and when control should pass to a stronger executor\. And it does so under the discipline the intervention\-paradox result demands\[[26](https://arxiv.org/html/2606.06660#bib.bib13)\]: because an accurate predictor can still*reduce*success when its interventions disrupt trajectories that would have succeeded, we never argue from predictive AUROC to utility, and we let the budget\- and rate\-matched controls, not the ROC curve, carry the causal claim\.

#### Scope discipline and a world\-model future extension\.

We deliberately isolate one claim \(a frozen\-probe early\-warning signal plus escalation to a stronger separate policy, defended with causal controls\), and we hold a learned world model out of scope here\. A world model is a natural future extension: a richer escalation trigger, or a way to choose which stronger policy to escalate to and what to escalate with\[[5](https://arxiv.org/html/2606.06660#bib.bib15),[15](https://arxiv.org/html/2606.06660#bib.bib14)\]\. Introducing one now would entangle the present causal contrast with a learned dynamics model, which is exactly what this study is designed to keep separate\.

## 7Limitations

#### Effect size and remaining headroom\.

The headline numbers come from the confirmatoryn=700n\{=\}700common\-random\-number factorial \(646646A\-failing\), which clears the pre\-registered≥700\\geq 700\-episode floor and the kill criteria \(K1–K3\)\. The recovered\-task rate gain over the controls is real but modest \(\+0\.054\+0\.054over budget\-matched\-blind,\+0\.050\+0\.050over random\-trigger\), and the HARD\-bandB−CB\{\-\}Cinterval touches zero, so the within\-stratum claim rests on the EASY and MEDIUM bands for theB\>CB\>Ccontrast\. The exploratory5656\-key Phase\-D pilot \(4141A\-failing\) that authorized scaling reported a larger effect; the full run attenuated it, which we report rather than hide\.

#### Scope: a controlled causal question, with named next tests\.

This paper isolates one question under controlled paired rollouts: does a failure signal choose better escalation moments than matched\-budget controls? It answers that question on LIBERO\[[17](https://arxiv.org/html/2606.06660#bib.bib17)\]with one weak/strong pair \(smolvla\_libero→\\topi05\_libero\_finetuned\)\. Real\-hardware transfer, where perception noise and contact dynamics differ, and broader policy\-pair coverage are the next tests, not assumptions hidden inside the claim\. We already take one step on the second axis: the GR00T N1\.7 generalization arm escalates to a different policy family and recovers at the same rate as HELM \(RTR0\.1550\.155\) on the confirmatory run, consistent with the effect being a property of escalating to a stronger separate policy rather than of this one pair\. A second benchmark suite and a small real\-robot demonstration are the highest\-value additions, and they extend the claim rather than underpin it\.

#### Conformal coverage and stratified calibration\.

The trigger threshold is calibrated to a target false\-trigger rate, but conformal guarantees are marginal; if per\-stratum calibration is under\-powered the realized coverage may drift from the nominal level within a stratum; the confirmatoryn=700n\{=\}700run reports the within\-stratum analysis at the pre\-registered discordant\-pair floor, but per\-stratum conformal coverage remains marginal rather than conditional where a stratum was too small to calibrate its own threshold\.

#### Descriptive, not identified, hazard\.

Any hazard\-rate or time\-to\-failure curve we report is descriptive of when the probe becomes informative; it is not a causal identification of the failure onset, and we do not use it to make claims beyond the pre\-registered estimand\.

#### Signal fusion is exploratory; overhead does not transfer for free\.

The primary signal is the single hidden\-state probe; the surprise/disagreement complements \(chunk\_delta,stac\_var, disagreement\) are reported as exploratory context, not as a tuned fused detector\. Finally, the escalation overhead is*measured*for this weak/strong pair against a profiled baseline; because it scales with the escalated fraction times the relative per\-step cost of the stronger policy, it does not transfer to a different pair without re\-profiling, and we never quote it as a pair\-independent constant\.

## 8Conclusion

A deployed policy that is about to fail does not have to keep driving\. AEGIS reads a cheap per\-step early\-warning probe off a frozen VLA’s internals and, on only the steps it flags, hands control to a stronger separate policy\. That is a runtime decision the prior literature had no layer for: detect\-only methods see the failure coming but cannot act, and recover\-in\-policy methods act only by asking the same failing policy to try again\.

The evidence holds up where it counts\. On the confirmatoryn=700n\{=\}700factorial the gain survives the controls built to break it: against a budget\-matched\-blind control and a random\-trigger placebo, both of which spend the same extra compute, selective escalation still adds\+0\.054\+0\.054and\+0\.050\+0\.050in conditional recovered\-task\-rate\. The recovery is bought by timing, not by spending\. The early\-window failure\-prediction AUROC of0\.7640\.764is the precondition that makes this cheaper than running the stronger policy on every step, and we keep it as a precondition rather than a headline, since accurate prediction does not imply effective prevention\. The within\-stratum requirement, the always\-strong ceiling, the HELM baseline, and the second\-strong\-policy generalization arm all came through\.

The thesis is one sentence: a robot policy can read its own activations as an early\-warning signal and call a stronger policy before failure compounds, recovering twice as many failures as matched\-budget escalation\. A frozen policy can call for backup at the step where it still matters, and pay for that backup only when it helps\. AEGIS makes that runtime decision, and the controls show the decision is what does the work\.

## Data, code, and pre\-registration availability

All artifacts are public\. The trained early\-warning probe and gate configuration, together with the frozen pre\-registration \(analysis plan, primary contrasts, within\-stratum floor, and kill criteria, registered before data collection\) and the probe\-training, conformal\-calibration, and four\-arm common\-random\-number rollout code, are released as the model repository[https://huggingface\.co/kaikaku/aegis](https://huggingface.co/kaikaku/aegis)\. The per\-cell rollout logs \(per\-step probe\-score traces, policy\-source masks, and per\-\(task, seed, arm\) outcomes\) that reproduce Tables[2](https://arxiv.org/html/2606.06660#S5.T2)–[3](https://arxiv.org/html/2606.06660#S5.T3)and the confirmatory figures are released as the dataset[https://huggingface\.co/datasets/kaikaku/aegis\-rollouts](https://huggingface.co/datasets/kaikaku/aegis-rollouts)\. An interactive demonstration is available at the Space[https://huggingface\.co/spaces/kaikaku/aegis\-demo](https://huggingface.co/spaces/kaikaku/aegis-demo)\. The analysis scripts recompute the recovered\-task\-rate, the exact paired McNemar and binomial tests, the paired\-trajectory bootstrap, and the early\-window AUROC directly from the logged traces\.

## Appendix APhase\-D pilot \(exploratory go/no\-go\)

The Phase\-D pilot was the pre\-committed go/no\-go check that authorized the confirmatory run; we report it here and base no headline claim on it\. Its conditional recovered\-task rates are larger than the confirmatoryn=700n\{=\}700values because the5656\-key pilot pool is small and skews easier, so a single well\-timed escalation recovers a larger fraction of it\. The direction and ordering of the arms match the confirmatory run\.

Table 4:Recovered\-task\-rate \(RTR\) and marginal success by arm on thePhase\-D pilot\(n=56n=56CRN keys/arm;4141are A\-failing and define the conditional estimand; horizonH=10H=10\)\. RTR is conditional on the weak\-only \(A\) failing subset\.pp\-values are Holm\-adjusted over the three primary contrasts using the exact McNemar test on paired discordant keys\. The secondary baseline rows \(always\-strong, HELM\) carry the completedn=700n\{=\}700confirmatory values; the full confirmatory grid is Table[2](https://arxiv.org/html/2606.06660#S5.T2)\. SAFE is detect\-only and has no recovery estimand\.*Exploratory; not used for the headline claim\.*![Refer to caption](https://arxiv.org/html/2606.06660v1/figures/fig_rtr_narrative.png)Figure 15:Recovered\-task rate across arms \(Phase\-D pilot, exploratory\)\.RTR=Pr⁡\[success∣arm, A\-failing episode\]=\\Pr\[\\text\{success\}\\mid\\text\{arm, A\-failing episode\}\], with Wilson95%95\\%intervals on the5656\-key pilot\. Targeted escalation \(B\) recovers65\.9%65\.9\\%of the pilot episodes the weak policy alone fails; the compute\-matched controls, blind escalation \(C,14\.6%14\.6\\%\) and the random\-trigger placebo \(D,17\.1%17\.1\\%\), spend the*same*strong\-policy budget yet recover far less \(Δ​RTRB−C=\+0\.512\\Delta\\mathrm\{RTR\}\_\{B\-C\}=\+0\.512, exact McNemarp=5\.7×10−6p=5\.7\\times 10^\{\-6\}\)\. This pilot established directionality only; the headline claim is the confirmatoryn=700n\{=\}700result \(Fig\.[2](https://arxiv.org/html/2606.06660#S1.F2), Table[2](https://arxiv.org/html/2606.06660#S5.T2)\)\.
## References

- \[1\]C\. Agia, R\. Sinha, J\. Yang, Z\. Cao, R\. Antonova, M\. Pavone, and J\. Bohg\(2024\)Unpacking Failure Modes of Generative Policies: Runtime Monitoring of Consistency and Progress\.External Links:2410\.04640,[Link](https://arxiv.org/abs/2410.04640)Cited by:[§1](https://arxiv.org/html/2606.06660#S1.p2.3),[§2\.1](https://arxiv.org/html/2606.06660#S2.SS1.p1.3),[Table 1](https://arxiv.org/html/2606.06660#S2.T1.13.3.2)\.
- \[2\]G\. Alain and Y\. Bengio\(2016\)Understanding Intermediate Layers Using Linear Classifier Probes\.External Links:1610\.01644,[Link](https://arxiv.org/abs/1610.01644)Cited by:[§3\.1](https://arxiv.org/html/2606.06660#S3.SS1.SSS0.Px1.p1.20)\.
- \[3\]A\. N\. Angelopoulos and S\. Bates\(2021\)A Gentle Introduction to Conformal Prediction and Distribution\-Free Uncertainty Quantification\.External Links:2107\.07511,[Link](https://arxiv.org/abs/2107.07511)Cited by:[§3\.2](https://arxiv.org/html/2606.06660#S3.SS2.SSS0.Px1.p1.7)\.
- \[4\]K\. Black, N\. Brown, D\. Driess, A\. Esmail, M\. Equi, C\. Finn, N\. Fusai, L\. Groom, K\. Hausman, B\. Ichter, S\. Jakubczak, T\. Jones, L\. Ke, S\. Levine, A\. Li\-Bell, M\. Mothukuri, S\. Nair, K\. Pertsch, L\. X\. Shi, J\. Tanner, Q\. Vuong, A\. Walling, H\. Wang, and U\. Zhilinsky\(2024\)π0\\pi\_\{0\}: A Vision\-Language\-Action Flow Model for General Robot Control\.External Links:2410\.24164,[Link](https://arxiv.org/abs/2410.24164)Cited by:[§3\.3](https://arxiv.org/html/2606.06660#S3.SS3.SSS0.Px2.p1.10)\.
- \[5\]J\. Cen, S\. Huang, Y\. Yuan, K\. Li, H\. Yuan, C\. Yu, Y\. Jiang, J\. Guo, X\. Li, H\. Luo, F\. Wang, D\. Zhao, and H\. Chen\(2025\)RynnVLA\-002: A Unified Vision\-Language\-Action and World Model\.External Links:2511\.17502,[Link](https://arxiv.org/abs/2511.17502)Cited by:[§2\.2](https://arxiv.org/html/2606.06660#S2.SS2.p1.3),[§2\.3](https://arxiv.org/html/2606.06660#S2.SS3.p2.3),[§6](https://arxiv.org/html/2606.06660#S6.SS0.SSS0.Px1.p1.1)\.
- \[6\]J\. Chen\(2026\)AURA: Action\-Gated Memory for Robot Policies at Constant VRAM\.External Links:2606\.02775,[Link](https://arxiv.org/abs/2606.02775)Cited by:[§1](https://arxiv.org/html/2606.06660#S1.p3.1),[§2\.3](https://arxiv.org/html/2606.06660#S2.SS3.p1.1),[§3\.1](https://arxiv.org/html/2606.06660#S3.SS1.SSS0.Px4.p1.4)\.
- \[7\]J\. Chen\(2026\)Memory\-Bound but Not Bandwidth\-Limited: The Physical AI Inference Gap in Batch\-1 LLM Decode\.External Links:2605\.30571,[Link](https://arxiv.org/abs/2605.30571)Cited by:[§1](https://arxiv.org/html/2606.06660#S1.p5.1)\.
- \[8\]L\. Chen, Z\. Lyu, and W\. J\. Beksi\(2026\)ReconVLA: An Uncertainty\-Guided and Failure\-Aware Vision\-Language\-Action Framework for Robotic Control\.External Links:2604\.16677,[Link](https://arxiv.org/abs/2604.16677)Cited by:[§1](https://arxiv.org/html/2606.06660#S1.p2.3),[§2\.1](https://arxiv.org/html/2606.06660#S2.SS1.p1.3)\.
- \[9\]B\. Efron and R\. J\. Tibshirani\(1993\)An Introduction to the Bootstrap\.Chapman and Hall/CRC,New York\.External Links:[Link](https://doi.org/10.1201/9780429246593)Cited by:[§4](https://arxiv.org/html/2606.06660#S4.SS0.SSS0.Px2.p1.20)\.
- \[10\]J\. A\. Gaus, J\. P\.F\. Charaja, and D\. Haeufle\(2026\)Confidence\-Gated Robot Autonomy: When Does Uncertainty Actually Help?\.External Links:2605\.18045,[Link](https://arxiv.org/abs/2605.18045)Cited by:[§2\.2](https://arxiv.org/html/2606.06660#S2.SS2.p1.3)\.
- \[11\]Q\. Gu, Y\. Ju, S\. Sun, I\. Gilitschenski, H\. Nishimura, M\. Itkina, and F\. Shkurti\(2025\)SAFE: Multitask Failure Detection for Vision\-Language\-Action Models\.External Links:2506\.09937,[Link](https://arxiv.org/abs/2506.09937)Cited by:[§1](https://arxiv.org/html/2606.06660#S1.p2.3),[§2\.1](https://arxiv.org/html/2606.06660#S2.SS1.p1.3),[Table 1](https://arxiv.org/html/2606.06660#S2.T1.16.9.3.1),[§3\.1](https://arxiv.org/html/2606.06660#S3.SS1.SSS0.Px2.p1.6),[§3\.3](https://arxiv.org/html/2606.06660#S3.SS3.SSS0.Px3.p1.3)\.
- \[12\]S\. Holm\(1979\)A Simple Sequentially Rejective Multiple Test Procedure\.Scandinavian Journal of Statistics6\(2\),pp\. 65–70\.External Links:[Link](https://www.jstor.org/stable/4615733)Cited by:[§4](https://arxiv.org/html/2606.06660#S4.SS0.SSS0.Px2.p1.20)\.
- \[13\]U\. B\. Karli, Z\. Shangguan, and T\. Fitzgerald\(2025\)INSIGHT: INference\-time Sequence Introspection for Generating Help Triggers in Vision\-Language\-Action Models\.External Links:2510\.01389,[Link](https://arxiv.org/abs/2510.01389)Cited by:[§2\.1](https://arxiv.org/html/2606.06660#S2.SS1.p1.3),[Table 1](https://arxiv.org/html/2606.06660#S2.T1.14.4.2)\.
- \[14\]M\. J\. Kim, C\. Finn, and P\. Liang\(2025\)Fine\-Tuning Vision\-Language\-Action Models: Optimizing Speed and Success\.External Links:2502\.19645,[Link](https://arxiv.org/abs/2502.19645)Cited by:[§2\.3](https://arxiv.org/html/2606.06660#S2.SS3.p2.3),[§3\.1](https://arxiv.org/html/2606.06660#S3.SS1.SSS0.Px1.p1.20)\.
- \[15\]H\. Li, K\. Lei, S\. Zang, K\. Hu, Y\. Liang, B\. An, X\. Li, and H\. Xu\(2026\)Failure\-Aware RL: Reliable Offline\-to\-Online Reinforcement Learning with Self\-Recovery for Real\-World Manipulation\.External Links:2601\.07821,[Link](https://arxiv.org/abs/2601.07821)Cited by:[§2\.2](https://arxiv.org/html/2606.06660#S2.SS2.p1.3),[§6](https://arxiv.org/html/2606.06660#S6.SS0.SSS0.Px1.p1.1)\.
- \[16\]Z\. Lin, J\. Duan, H\. Fang, D\. Fox, R\. Krishna, C\. Tan, and B\. Wen\(2025\)FailSafe: Reasoning and Recovery from Failures in Vision\-Language\-Action Models\.External Links:2510\.01642,[Link](https://arxiv.org/abs/2510.01642)Cited by:[§1](https://arxiv.org/html/2606.06660#S1.p2.3),[§2\.2](https://arxiv.org/html/2606.06660#S2.SS2.p1.3),[Table 1](https://arxiv.org/html/2606.06660#S2.T1.16.11.5.1)\.
- \[17\]B\. Liu, Y\. Zhu, C\. Gao, Y\. Feng, Q\. Liu, Y\. Zhu, and P\. Stone\(2023\)LIBERO: Benchmarking Knowledge Transfer for Lifelong Robot Learning\.External Links:2306\.03310,[Link](https://arxiv.org/abs/2306.03310)Cited by:[§2\.3](https://arxiv.org/html/2606.06660#S2.SS3.p2.3),[§7](https://arxiv.org/html/2606.06660#S7.SS0.SSS0.Px2.p1.2)\.
- \[18\]Q\. McNemar\(1947\)Note on the Sampling Error of the Difference between Correlated Proportions or Percentages\.Psychometrika12\(2\),pp\. 153–157\.External Links:[Link](https://doi.org/10.1007/BF02295996)Cited by:[§4](https://arxiv.org/html/2606.06660#S4.SS0.SSS0.Px2.p1.20)\.
- \[19\]NVIDIA, J\. Bjorck, F\. Castañeda, N\. Cherniadev, X\. Da, R\. Ding, L\. Fan, Y\. Fang, D\. Fox, F\. Hu, S\. Huang, J\. Jang, Z\. Jiang, J\. Kautz, K\. Kundalia, L\. Lao, Z\. Li, Z\. Lin, K\. Lin, G\. Liu, E\. Llontop, L\. Magne, A\. Mandlekar, A\. Narayan, S\. Nasiriany, S\. Reed, Y\. L\. Tan, G\. Wang, Z\. Wang, J\. Wang, Q\. Wang, J\. Xiang, Y\. Xie, Y\. Xu, Z\. Xu, S\. Ye, Z\. Yu, A\. Zhang, H\. Zhang, Y\. Zhao, R\. Zheng, and Y\. Zhu\(2025\)GR00T N1: An Open Foundation Model for Generalist Humanoid Robots\.External Links:2503\.14734,[Link](https://arxiv.org/abs/2503.14734)Cited by:[§3\.3](https://arxiv.org/html/2606.06660#S3.SS3.SSS0.Px4.p1.2)\.
- \[20\]Physical Intelligence, K\. Black, N\. Brown, J\. Darpinian, K\. Dhabalia, D\. Driess, A\. Esmail, M\. Equi, C\. Finn, N\. Fusai, M\. Y\. Galliker, D\. Ghosh, L\. Groom, K\. Hausman, B\. Ichter, S\. Jakubczak, T\. Jones, L\. Ke, D\. LeBlanc, S\. Levine, A\. Li\-Bell, M\. Mothukuri, S\. Nair, K\. Pertsch, A\. Z\. Ren, L\. X\. Shi, L\. Smith, J\. T\. Springenberg, K\. Stachowicz, J\. Tanner, Q\. Vuong, H\. Walke, A\. Walling, H\. Wang, L\. Yu, and U\. Zhilinsky\(2025\)π0\.5\\pi\_\{0\.5\}: a Vision\-Language\-Action Model with Open\-World Generalization\.External Links:2504\.16054,[Link](https://arxiv.org/abs/2504.16054)Cited by:[§3\.3](https://arxiv.org/html/2606.06660#S3.SS3.SSS0.Px2.p1.10)\.
- \[21\]R\. Römer, A\. Kobras, L\. Worbis, and A\. P\. Schoellig\(2025\)Failure Prediction at Runtime for Generative Robot Policies\.External Links:2510\.09459,[Link](https://arxiv.org/abs/2510.09459)Cited by:[§1](https://arxiv.org/html/2606.06660#S1.p2.3),[§2\.1](https://arxiv.org/html/2606.06660#S2.SS1.p1.3),[Table 1](https://arxiv.org/html/2606.06660#S2.T1.12.2.2)\.
- \[22\]S\. Ross, G\. J\. Gordon, and J\. A\. Bagnell\(2011\)A Reduction of Imitation Learning and Structured Prediction to No\-Regret Online Learning\.InProceedings of the 14th International Conference on Artificial Intelligence and Statistics \(AISTATS\),External Links:1011\.0686,[Link](https://arxiv.org/abs/1011.0686)Cited by:[§2\.3](https://arxiv.org/html/2606.06660#S2.SS3.p2.3)\.
- \[23\]M\. Shukor, D\. Aubakirova, F\. Capuano, P\. Kooijmans, S\. Palma, A\. Zouitine, M\. Aractingi, C\. Pascal, M\. Russi, A\. Marafioti, S\. Alibert, M\. Cord, T\. Wolf, and R\. Cadene\(2025\)SmolVLA: A Vision\-Language\-Action Model for Affordable and Efficient Robotics\.External Links:2506\.01844,[Link](https://arxiv.org/abs/2506.01844)Cited by:[§3\.1](https://arxiv.org/html/2606.06660#S3.SS1.SSS0.Px1.p1.20)\.
- \[24\]Z\. Sun, Y\. Guo, H\. Sun, L\. Wang, W\. Lu, J\. Ji, S\. Ji, J\. Xiong, and Z\. Meng\(2026\)Pre\-VLA: Preemptive Runtime Verification for Reliable Vision\-Language\-Action and World\-Model Rollouts\.External Links:2605\.22446,[Link](https://arxiv.org/abs/2605.22446)Cited by:[§1](https://arxiv.org/html/2606.06660#S1.p2.3),[§2\.1](https://arxiv.org/html/2606.06660#S2.SS1.p1.3),[§2\.2](https://arxiv.org/html/2606.06660#S2.SS2.p1.3),[Table 1](https://arxiv.org/html/2606.06660#S2.T1.16.6.2),[§3\.2](https://arxiv.org/html/2606.06660#S3.SS2.SSS0.Px3.p1.5)\.
- \[25\]E\. Todorov, T\. Erez, and Y\. Tassa\(2012\)MuJoCo: A Physics Engine for Model\-Based Control\.In2012 IEEE/RSJ International Conference on Intelligent Robots and Systems \(IROS\),pp\. 5026–5033\.External Links:[Link](https://doi.org/10.1109/IROS.2012.6386109)Cited by:[§5\.1](https://arxiv.org/html/2606.06660#S5.SS1.p1.15)\.
- \[26\]R\. Vasudev, M\. Russak, D\. Bikel, and W\. Alshikh\(2026\)The Intervention Paradox: Accurate Failure Prediction in Agents Does Not Imply Effective Failure Prevention\.External Links:2602\.03338,[Link](https://arxiv.org/abs/2602.03338)Cited by:[§1](https://arxiv.org/html/2606.06660#S1.p4.2),[§2\.3](https://arxiv.org/html/2606.06660#S2.SS3.p2.3),[§3\.2](https://arxiv.org/html/2606.06660#S3.SS2.SSS0.Px3.p1.5),[§3\.4](https://arxiv.org/html/2606.06660#S3.SS4.SSS0.Px2.p1.4),[Table 3](https://arxiv.org/html/2606.06660#S5.T3),[§6](https://arxiv.org/html/2606.06660#S6.p3.1)\.
- \[27\]C\. Xu, T\. K\. Nguyen, E\. Dixon, C\. Rodriguez, P\. Miller, R\. Lee, P\. Shah, R\. Ambrus, H\. Nishimura, and M\. Itkina\(2025\)Can We Detect Failures Without Failure Data? Uncertainty\-Aware Runtime Failure Detection for Imitation Learning Policies\.External Links:2503\.08558,[Link](https://arxiv.org/abs/2503.08558)Cited by:[§1](https://arxiv.org/html/2606.06660#S1.p2.3),[§2\.1](https://arxiv.org/html/2606.06660#S2.SS1.p1.3),[Table 1](https://arxiv.org/html/2606.06660#S2.T1.12.2.2)\.
- \[28\]Y\. Yang, Z\. Duan, T\. Xie, F\. Cao, P\. Shen, P\. Song, P\. Jin, G\. Sun, S\. Xu, Y\. You, and J\. Liu\(2025\)FPC\-VLA: A Vision\-Language\-Action Framework with a Supervisor for Failure Prediction and Correction\.External Links:2509\.04018,[Link](https://arxiv.org/abs/2509.04018)Cited by:[§1](https://arxiv.org/html/2606.06660#S1.p2.3),[§2\.2](https://arxiv.org/html/2606.06660#S2.SS2.p1.3),[Table 1](https://arxiv.org/html/2606.06660#S2.T1.16.11.5.1)\.
- \[29\]Y\. Yang, S\. Cheng, Y\. Fang, H\. Bharadhwaj, M\. Ding, G\. Bertasius, and D\. Szafir\(2026\)LiLo\-VLA: Compositional Long\-Horizon Manipulation via Linked Object\-Centric Policies\.External Links:2602\.21531,[Link](https://arxiv.org/abs/2602.21531)Cited by:[§1](https://arxiv.org/html/2606.06660#S1.p2.3),[§2\.2](https://arxiv.org/html/2606.06660#S2.SS2.p1.3),[Table 1](https://arxiv.org/html/2606.06660#S2.T1.16.10.4.1)\.
- \[30\]Z\. Zeng, F\. Ding, H\. Yang, and X\. Li\(2026\)HELM: Harness\-Enhanced Long\-horizon Memory for Vision\-Language\-Action Manipulation\.External Links:2604\.18791,[Link](https://arxiv.org/abs/2604.18791)Cited by:[§1](https://arxiv.org/html/2606.06660#S1.p2.3),[§2\.2](https://arxiv.org/html/2606.06660#S2.SS2.p1.3),[Table 1](https://arxiv.org/html/2606.06660#S2.T1.15.5.2),[§3\.3](https://arxiv.org/html/2606.06660#S3.SS3.SSS0.Px3.p1.3),[§4](https://arxiv.org/html/2606.06660#S4.SS0.SSS0.Px2.p1.20)\.