LabGuard: Grounding Natural-Language Laboratory Rules into Runtime Guards for Embodied Laboratory Agents

# Grounding Natural-Language Laboratory Rules into Runtime Guards for Embodied Laboratory Agents
Source: [https://arxiv.org/html/2606.31045](https://arxiv.org/html/2606.31045)
Jingpu Yang1,Fengxian Ji1,211footnotemark:1,Zhengzhao Lai311footnotemark:1,Zhexuan Cui3, Guangxian Ouyang3,Qian Jiang3,Fan Zhang2,Min Peng1, Qianqian Xie1,Preslav Nakov2,Zhuohan Xie222footnotemark:2 1Wuhan University2MBZUAI3Northeastern University \{fengxian\.ji, fan\.zhang, preslav\.nakov, zhuohan\.xie\}@mbzuai\.ac\.ae zhengzhaolai@cuhk\.edu\.cn, jingpuyang290@gmail\.com, kasakura@outlook\.com \{pengm, xieq\}@whu\.edu\.cn,\{202316187, 202219047\}@stu\.neuq\.edu\.cn

###### Abstract

Scientific embodied agents are increasingly capable of carrying out laboratory procedures, but executing these procedures safely in dynamic laboratory environments remains challenging\. Current safety approaches often overlook the intermediate step of transforming laboratory natural language, including safety rules, manuals, protocols, and standard operating procedures, into machine\-checkable runtime constraints\. We introduceLabGuard, Laboratory Guard, a language\-to\-execution safety suite that grounds natural\-language laboratory rules into executable specifications and deploys them as runtime guards\. LabGuard includes three core components:LabGuard\-IR, which defines a typed executable representation;LabGuard\-Bench, which provides 812 supervised annotations expanded from 203 seed laboratory rules; andLabGuard\-Grounder, which maps natural\-language laboratory rules into LabGuard\-IR\. The resulting IR instances are handled by theLabGuard Pipeline, which compiles them into runtime monitors and applies them at the controller boundary\. Experiments show that LabGuard generalizes to unseen laboratory\-rule sources, achieves 79\.4 task\-scope F1, and reduces unsafe events from 39\.5% to 23\.8% after monitor compilation\. In LabUtopia, its runtime monitors integrate with ACT, keeping interventions below 0\.5% while preserving task success\.

LabGuard: Grounding Natural\-Language Laboratory Rules into Runtime Guards for Embodied Laboratory Agents

Jingpu Yang1††thanks:Equal contribution\., Fengxian Ji1,211footnotemark:1, Zhengzhao Lai311footnotemark:1, Zhexuan Cui3,Guangxian Ouyang3,Qian Jiang3,Fan Zhang2,Min Peng1,Qianqian Xie1††thanks:Corresponding author\.,Preslav Nakov2,Zhuohan Xie222footnotemark:21Wuhan University2MBZUAI3Northeastern University\{fengxian\.ji, fan\.zhang, preslav\.nakov, zhuohan\.xie\}@mbzuai\.ac\.aezhengzhaolai@cuhk\.edu\.cn, jingpuyang290@gmail\.com, kasakura@outlook\.com\{pengm, xieq\}@whu\.edu\.cn,\{202316187, 202219047\}@stu\.neuq\.edu\.cn

## 1Introduction

With the rapid development of foundation models, Vision\-Language\-Action \(VLA\) models, imitation\-learning policies, and related techniques, embodied agents are moving beyond simple manipulation skills toward the execution of complex laboratory procedures\. Specifically, VLA models\(Brohanet al\.,[2023](https://arxiv.org/html/2606.31045#bib.bib10); Kimet al\.,[2024](https://arxiv.org/html/2606.31045#bib.bib11); Blacket al\.,[2026](https://arxiv.org/html/2606.31045#bib.bib12)\)enhance robots’ ability to generate actions from multimodal inputs; imitation\-learning policies, such as ACT\(Zhaoet al\.,[2023](https://arxiv.org/html/2606.31045#bib.bib8)\)and Diffusion Policy\(Chiet al\.,[2024](https://arxiv.org/html/2606.31045#bib.bib9)\), improve the learning and execution of laboratory manipulation skills; and laboratory simulation platforms and robotic chemistry systems, such as LabUtopia\(Liet al\.,[2026](https://arxiv.org/html/2606.31045#bib.bib1)\), RoboChemist\(Zhanget al\.,[2025](https://arxiv.org/html/2606.31045#bib.bib24)\), and Organa\(Darvishet al\.,[2025](https://arxiv.org/html/2606.31045#bib.bib25); Jiet al\.,[2026b](https://arxiv.org/html/2606.31045#bib.bib37); Laiet al\.,[2025](https://arxiv.org/html/2606.31045#bib.bib42); Luoet al\.,[2026](https://arxiv.org/html/2606.31045#bib.bib29); Yanget al\.,[2024a](https://arxiv.org/html/2606.31045#bib.bib44),[2025](https://arxiv.org/html/2606.31045#bib.bib45),[2026b](https://arxiv.org/html/2606.31045#bib.bib46); Cuiet al\.,[2026](https://arxiv.org/html/2606.31045#bib.bib47)\), further establish scientific laboratories as an important evaluation setting for embodied agents\. However, in laboratory environments, task success does not necessarily imply safe execution, since agents must also follow safety knowledge expressed in natural\-language rules, manuals, protocols, and standard operating procedures, covering chemical compatibility, equipment usage, procedural ordering, and risk intervention\.

Existing safety research for laboratory embodied agents falls into three lines\. First, safety benchmarks test hazard recognition, risk assessment, unsafe\-instruction refusal, and safety\-aware planning, including LabSafety Bench, LABSHIELD, SafeAgentBench, VESTABENCH, and Safe\-BeAl\(Zhouet al\.,[2024](https://arxiv.org/html/2606.31045#bib.bib26); Sunet al\.,[2026](https://arxiv.org/html/2606.31045#bib.bib30); Yinet al\.,[2025](https://arxiv.org/html/2606.31045#bib.bib7); Sadhuet al\.,[2025](https://arxiv.org/html/2606.31045#bib.bib31); Huanget al\.,[2025](https://arxiv.org/html/2606.31045#bib.bib32); Yanget al\.,[2024b](https://arxiv.org/html/2606.31045#bib.bib43)\)\. Second, decision\-level methods improve planners or policies through safety\-aware reasoning, alignment, and constrained learning, such as planning agents, risk\-cognition modules, preference alignment, and constrained VLA optimization\(Khanet al\.,[2025](https://arxiv.org/html/2606.31045#bib.bib33); Yanget al\.,[2025](https://arxiv.org/html/2606.31045#bib.bib45)\)\. Third, runtime enforcement methods use guardrails, executable predicates, code\-based monitors, or control constraints to block, replan, or restrict unsafe actions during execution\(Wanget al\.,[2025b](https://arxiv.org/html/2606.31045#bib.bib34),[a](https://arxiv.org/html/2606.31045#bib.bib35); Ameset al\.,[2019](https://arxiv.org/html/2606.31045#bib.bib36); Jiet al\.,[2026a](https://arxiv.org/html/2606.31045#bib.bib38)\)\. However, these works often assume safety information is already formalized\. In laboratories, safety knowledge often appears as natural language, including SOPs, manuals, chemical\-handling rules, and protocol instructions\. How to ground such text into executable monitor specifications for controller\-side checking remains under\-characterized\.

The challenge is not simply to convert text into structured fields, but to make human\-readable laboratory safety knowledge enter the robot control loop\. This requires a representable, learnable, and executable path from laboratory natural language to controller\-side intervention, which raises three key questions\. First, how should laboratory safety language be represented so that rules can be activated and checked by a controller? Second, how can models ground diverse sources, including SOPs, manuals, protocols, and chemical safety statements, into a typed executable representation? Third, how can the grounded representation be compiled into runtime monitors that check live laboratory state before robot actions and pass, modify, or block actions when necessary?

![Refer to caption](https://arxiv.org/html/2606.31045v1/figures/figure1.png)Figure 1:LabGuard Overview\. Natural\-language laboratory rules are grounded into LabGuard\-IR, compiled into executable runtime monitors, and applied at the controller boundary during embodied laboratory execution\.To address this problem, we proposeLabGuard, a language\-to\-execution safety suite that transforms laboratory natural language into executable runtime guards for embodied laboratory agents\. LabGuard includes three core components for executable representation, supervised annotation, and laboratory\-language grounding\. First,LabGuard\-IRdefines a typed executable representation, specifying the fields needed for runtime monitoring, including constraint type, entity binding, action scope, state predicates, severity, and intervention mode\. Second,LabGuard\-Benchprovides 812 supervised annotations for training and evaluation, enabling systematic assessment of how well models recover executable fields from laboratory natural language\. Third,LabGuard\-Groundermaps natural\-language laboratory rules into LabGuard\-IR, turning human\-readable safety knowledge into structured specifications that can be compiled\. The resulting IR instances are then handled by theLabGuard Pipeline, which compiles them into executable runtime monitors and executes these monitors at the controller boundary, where proposed actions can be passed, modified, or blocked according to the live laboratory state\. Experiments show that LabGuard generalizes to unseen laboratory\-rule sources with 79\.4 task\-scope F1 and reduces unsafe events from 39\.5% to 23\.8% after monitor compilation\. In LabUtopia, its ACT\-integrated monitors keep interventions below 0\.5% while preserving task success\.

Our contributions follow the representable, learnable, and executable path introduced above\. First, we proposeLabGuard\-IR, a typed representation that makes laboratory safety language controller\-usable by capturing constraint type, entity binding, action scope, state predicates, severity, and intervention mode\. Second, we constructLabGuard\-Bench, which provides 812 supervised annotations expanded from 203 seed laboratory rules, and introduceLabGuard\-Grounder, which maps natural\-language laboratory rules into LabGuard\-IR\. Third, we develop and evaluate theLabGuard Pipeline, which compiles grounded IR instances into runtime monitors and integrates them with LabUtopia \+ ACT control to test hazard reduction, task preservation, and intervention overhead\.

## 2Related Work

LLM\-based Embodied Agent Safety\.Recent work on LLM\-based embodied agent safety studies how agents recognize unsafe goals, refuse hazardous instructions, assess risk, or generate safety\-aware plans\(Yinet al\.,[2025](https://arxiv.org/html/2606.31045#bib.bib7); Yinget al\.,[2025](https://arxiv.org/html/2606.31045#bib.bib3); Zhanget al\.,[2026a](https://arxiv.org/html/2606.31045#bib.bib2)\)\. These studies typically evaluate safety at the instruction or planning level, where the model is asked to judge whether a goal, instruction, or proposed plan is safe before execution\. Related methods further improve decision\-level safety through safety\-aware reasoning, alignment, constrained learning, or risk\-aware planning modules\(Zhanget al\.,[2026a](https://arxiv.org/html/2606.31045#bib.bib2)\)\.

Runtime Assurance and Safety Filters for Robotics\.Runtime assurance and safety\-filtering methods aim to restrict unsafe behavior during execution by monitoring states, filtering actions, or enforcing formal constraints at the controller boundary\. Classical approaches include control barrier functions and related safety filters that constrain robot actions with respect to predefined safe sets\(Ameset al\.,[2019](https://arxiv.org/html/2606.31045#bib.bib36); Morton and Pavone,[2025](https://arxiv.org/html/2606.31045#bib.bib13); Zhanget al\.,[2026d](https://arxiv.org/html/2606.31045#bib.bib39),[c](https://arxiv.org/html/2606.31045#bib.bib40); Songet al\.,[2026](https://arxiv.org/html/2606.31045#bib.bib49); Yanget al\.,[2026a](https://arxiv.org/html/2606.31045#bib.bib48)\)\. Recent embodied\-agent systems also use executable predicates, code\-based monitors, visual monitors, or guardrail modules to inspect plans and actions before execution\(Zhouet al\.,[2025](https://arxiv.org/html/2606.31045#bib.bib5); Wanget al\.,[2025b](https://arxiv.org/html/2606.31045#bib.bib34),[a](https://arxiv.org/html/2606.31045#bib.bib35)\)\.

Natural Language Interfaces to Executable Systems\.Semantic parsing maps natural language to executable formal representations such as SQL queries, robot commands, logical forms, and API calls\(Zelle and Mooney,[1996](https://arxiv.org/html/2606.31045#bib.bib14); Zettlemoyer and Collins,[2005](https://arxiv.org/html/2606.31045#bib.bib15); Tellexet al\.,[2011](https://arxiv.org/html/2606.31045#bib.bib16); Matuszeket al\.,[2013](https://arxiv.org/html/2606.31045#bib.bib17)\)\. In scientific domains, prior work has extracted structured actions, materials, and experimental operations from synthesis procedures or laboratory protocols\(Mysoreet al\.,[2019](https://arxiv.org/html/2606.31045#bib.bib18); Vaucheret al\.,[2020](https://arxiv.org/html/2606.31045#bib.bib19)\)\. Recent structured generation methods further improve output validity through lexical constraints, neural logic decoding, grammar\-based parsing, and schema\-constrained generation\(Hokamp and Liu,[2017](https://arxiv.org/html/2606.31045#bib.bib20); Luet al\.,[2022](https://arxiv.org/html/2606.31045#bib.bib21); Scholaket al\.,[2021](https://arxiv.org/html/2606.31045#bib.bib22); Shinet al\.,[2021](https://arxiv.org/html/2606.31045#bib.bib23); Zhanget al\.,[2026b](https://arxiv.org/html/2606.31045#bib.bib41)\)\.

Table 1:Example LabGuard\-IR grounding\. Colored spans in the laboratory rule correspond to the executable fields used to compile a runtime monitor\.
## 3LabGuard

### 3\.1Problem Formulation

Laboratory safety knowledge is often written in natural language for human practitioners, including SOPs, safety manuals, chemical handling rules, and protocol instructions, whereas runtime robot controllers require machine\-checkable monitor specifications that can be activated, evaluated, and enforced during execution\. As illustrated in Figure[1](https://arxiv.org/html/2606.31045#S1.F1), this requires converting textual safety rules, such as chemical\-incompatibility instructions, into typed executable specifications that can be checked against the current laboratory state and controller\-proposed actions\. We formalize this as a laboratory\-language\-to\-monitor transformation problem:

Gθ​\(r\)=z,E​\(compile⁡\(z\),st,at\)=vt\.G\_\{\\theta\}\(r\)=z,\\quad E\(\\operatorname\{compile\}\(z\),s\_\{t\},a\_\{t\}\)=v\_\{t\}\.\(1\)Here,rrdenotes a natural\-language laboratory rule,GθG\_\{\\theta\}denotes the grounding model,zzdenotes the predicted executable safety specification,sts\_\{t\}denotes the live laboratory state,ata\_\{t\}denotes the controller\-proposed action, andvt∈\{pass,modify,block\}v\_\{t\}\\in\\\{\\text\{pass\},\\text\{modify\},\\text\{block\}\\\}denotes the runtime safety verdict\. Thus, the goal is not to generate a textual explanation of a safety rule, but to recover the structured execution semantics needed by a runtime monitor\.

### 3\.2LabGuard\-IR

We define LabGuard\-IR as the typed executable representation used as the target of laboratory\-language grounding and the input to runtime monitor compilation\. It is designed to capture the execution semantics needed for controller\-side safety checking, rather than only describing a rule in natural language\. Given a natural\-language laboratory ruler∈ℛr\\in\\mathcal\{R\}, LabGuard\-IR represents the grounded executable specification as

z=\(t^,S^,p^,T^,v^,i^\)\.z=\(\\hat\{t\},\\hat\{S\},\\hat\{p\},\\hat\{T\},\\hat\{v\},\\hat\{i\}\)\.\(2\)Here,t^\\hat\{t\}denotes the constraint type,S^\\hat\{S\}denotes the substance or entity set,p^\\hat\{p\}denotes the state or action predicate,T^\\hat\{T\}denotes the action scope,v^\\hat\{v\}denotes the severity level, andi^\\hat\{i\}denotes the intervention mode\. Table[1](https://arxiv.org/html/2606.31045#S2.T1)provides a field\-level example of this representation, corresponding to the typed executable view in Figure[1](https://arxiv.org/html/2606.31045#S1.F1)\(b\)\.

These fields jointly make the grounded rule executable:

∙\\bullett^\\hat\{t\}selects the safety logic to apply, such as incompatibility, temperature, equipment, or sequence checking\.

∙\\bulletS^\\hat\{S\}links textual mentions to concrete laboratory entities that can be tracked in the environment\.

∙\\bulletp^\\hat\{p\}defines the condition evaluated against the live state or proposed action\.

∙\\bulletT^\\hat\{T\}activates the rule only for relevant controller actions\.

∙\\bulletv^,i^\\hat\{v\},\\hat\{i\}determine the response once a violation is detected, such as logging, modification, or blocking\.

### 3\.3LabGuard\-Bench

LabGuard\-Bench is a supervised benchmark for training and evaluating laboratory\-language grounding, where each natural\-language safety rule is aligned to an executable schema: constraint type, canonical substances, formal predicate, robot\-task tags, severity, and intervention mode, so each annotation can be compiled into a runtime monitor\. The corpus contains203 seed canonical rulesfrom four sources: laboratory safety manuals \(71\), PubChem GHS statements \(62\), expert\-authored controller\-facing rules \(50\), and chemical safety references \(20\), stratified by difficulty \(easy 71, medium 105, hard 27\)\. Seeds are expanded via paraphrase augmentation into812 labeled examples\. The 15 constraint types group into four families: material compatibility, physical/quantitative handling, process/equipment checks, and environment/PPE/waste\. Every seed rule and paraphrase was independently reviewed by all five annotators with simple majority adjudication \(≥\\geq3 of 5\)\. Agreement distribution and review protocol are in Appendix[D](https://arxiv.org/html/2606.31045#A4)\.

### 3\.4LabGuard\-Grounder

LabGuard\-Grounder is the trainable component that maps natural\-language laboratory rules into the LabGuard\-IR defined in Eq\.[2](https://arxiv.org/html/2606.31045#S3.E2)\. Given a supervised example\(ri,zi\)\(r\_\{i\},z\_\{i\}\)from LabGuard\-Bench, whererir\_\{i\}is a natural\-language laboratory rule andziz\_\{i\}is the annotated executable specification, the grounder predictsz^i=Gθ​\(ri\)\\hat\{z\}\_\{i\}=G\_\{\\theta\}\(r\_\{i\}\)\. The predicted IR instancez^i\\hat\{z\}\_\{i\}follows the same schema as LabGuard\-IR and is later passed to the compiler if it satisfies schema validation\.

In our implementation, each IR instanceziz\_\{i\}is serialized as a structured text sequence, and the grounder is trained with supervised sequence generation\. The objective is the negative log\-likelihood of the gold IR sequence:

ℒground=−∑i=1N∑m=1\|zi\|log⁡Pθ​\(zi,m∣ri,zi,<m\)\.\\mathcal\{L\}\_\{\\mathrm\{ground\}\}=\-\\sum\_\{i=1\}^\{N\}\\sum\_\{m=1\}^\{\|z\_\{i\}\|\}\\log P\_\{\\theta\}\(z\_\{i,m\}\\mid r\_\{i\},z\_\{i,<m\}\)\.

\(3\)This objective trains the model to recover the executable fields required for downstream monitor compilation, including constraint type, substance or entity binding, state predicate, action scope, severity, and intervention mode\.

At inference time,z^i\\hat\{z\}\_\{i\}is validated against the LabGuard\-IR schema for required fields, categorical values, registry\-resolved substances, and compiler\-acceptable predicates\. Valid IR instances are passed to the compiler, while invalid outputs are rejected or flagged\. We implement the grounder with a LoRA fine\-tuned language model and evaluate a hybrid variant with rule\-based normalization for schema\-sensitive fields such as substance mentions\. Detailed training hyperparameters are provided in Appendix[H](https://arxiv.org/html/2606.31045#A8)\.

![Refer to caption](https://arxiv.org/html/2606.31045v1/x1.png)Figure 2:LabGuard Pipeline\. Given a LabGuard\-IR instance predicted by LabGuard\-Grounder, the pipeline first compiles it into an executable runtime monitor and then executes the monitor at the controller boundary\.

## 4LabGuard Pipeline

Given a LabGuard\-IR instance predicted by LabGuard\-Grounder, the LabGuard Pipeline turns the structured representation into runtime safety behavior\. The pipeline consists of two stages: monitor compilation and runtime monitor execution\.

### 4\.1Monitor Compilation

We instantiate thecompile⁡\(⋅\)\\operatorname\{compile\}\(\\cdot\)step introduced in Section[3\.1](https://arxiv.org/html/2606.31045#S3.SS1)\. Given a grounded LabGuard\-IR instancez^\\hat\{z\}predicted by LabGuard\-Grounder, the compiler lowers it into an executable runtime monitor:

ρ=compile⁡\(z^\)=\(fcheck,ϕscope,θ,v^,i^\)\.\\rho=\\operatorname\{compile\}\(\\hat\{z\}\)=\(f\_\{\\mathrm\{check\}\},\\phi\_\{\\mathrm\{scope\}\},\\theta,\\hat\{v\},\\hat\{i\}\)\.\(4\)Here,fcheckf\_\{\\mathrm\{check\}\}is a state\-action check function,ϕscope\\phi\_\{\\mathrm\{scope\}\}determines when the monitor is active,θ\\thetastores monitor parameters,v^\\hat\{v\}is the severity level, andi^\\hat\{i\}is the intervention mode\.

The compiler constructs these monitor components from LabGuard\-IR fields\. The constraint type selectsfcheckf\_\{\\mathrm\{check\}\}from a typed monitor library, e\.g\., mappingchemical​\_​incompatibility\\mathrm\{chemical\\\_incompatibility\}toMaterialCompatibilityCheck\\operatorname\{MaterialCompatibilityCheck\}\. The action scope instantiatesϕscope\\phi\_\{\\mathrm\{scope\}\}so that the monitor is activated only for relevant controller actions\. The substance/entity set and predicate populateθ\\thetawith registry\-resolved substances, numeric thresholds, spatial bounds, or other check parameters\. The severity and intervention fields determine the logging priority and the runtime response once a violation is detected\.

Before producing a monitor, the compiler validates schema conformance, resolves registry entries, and checks whether the IR instance can be lowered to an implemented monitor\. IR instances that fail these checks are rejected rather than executed\. All accepted monitors expose the same interface, allowing heterogeneous constraint types to be activated and evaluated by the same runtime execution loop\.

### 4\.2Runtime Contract Execution

LabGuard executes compiled monitors at the controller boundary and is agnostic to the underlying policy\. At each control step, a base controllerπ\\piproposes a raw actionatraw=π​\(ot\)a\_\{t\}^\{\\mathrm\{raw\}\}=\\pi\(o\_\{t\}\), and the runtime executor uses the live laboratory statests\_\{t\}to check whether this action satisfies the compiled monitors\. Here,sts\_\{t\}denotes the live laboratory state, including per\-container substance, volume, temperature, capacity, and robot kinematic state\.

The executor first activates the monitors whose action scopes match the proposed action:

ℛt=\{ρ∣ϕscopeρ​\(atraw\)=true\}\.\\mathcal\{R\}\_\{t\}=\\\{\\rho\\mid\\phi\_\{\\mathrm\{scope\}\}^\{\\rho\}\(a\_\{t\}^\{\\mathrm\{raw\}\}\)=\\mathrm\{true\}\\\}\.\(5\)Each active monitor then evaluates its check function against\(st,atraw\)\(s\_\{t\},a\_\{t\}^\{\\mathrm\{raw\}\}\)and produces a verdict according to its intervention mode\. Given the raw action, live state, and active monitor set, the safety filter returns the executable action:

atsafe=SafeFilter⁡\(atraw,st,ℛt\)\.a\_\{t\}^\{\\mathrm\{safe\}\}=\\operatorname\{SafeFilter\}\(a\_\{t\}^\{\\mathrm\{raw\}\},s\_\{t\},\\mathcal\{R\}\_\{t\}\)\.\(6\)The safety filter may pass the raw action unchanged, modify it, or block it before execution; all interventions and violations are logged for analysis\.

In our implementation,SafeFilter\\operatorname\{SafeFilter\}combines chemistry\-state\-aware semantic checks, a barrier\-style action filter, and risk scoring\. The semantic checks evaluate IR predicates over live container states, including incompatibility, overflow, temperature, sequencing, PPE, and waste handling; the action filter enforces workspace, joint\-margin, and velocity bounds; and the risk scorer flags high\-risk steps from velocity, proximity, chemical\-hazard, and uncertainty signals\. Full details are provided in Appendix[B](https://arxiv.org/html/2606.31045#A2)\.

## 5Experimental

Table 2:Laboratory\-language grounding and compiled\-monitor runtime outcomes under held\-out settings\. Grounding columns \(Tag F1, Pred Soft, Pred EM\) are evaluated on each held\-out test set Appendix[A](https://arxiv.org/html/2606.31045#A1); runtime columns \(Unsafe Event, False Interv\., Task Success\) aggregate LabUtopia L1–L4 episodes after monitor compilation Appendix[F](https://arxiv.org/html/2606.31045#A6)\.### 5\.1Experimental Setup

#### Benchmarks and evaluation settings\.

We evaluate LabGuard across three stages, using both our constructed benchmarks and existing runtime environments\. For laboratory\-language grounding, we use LabGuard\-Bench under source\-held\-out, random 80/20, and chemistry\-held\-out settings\. For compiled\-monitor replay, we construct a 100\-scenario stress replay set with 70 unsafe scenarios and 30 safe\-control scenarios across 7 hazard categories\. For runtime monitor execution, we use LabUtopia Levels 1–4 with ACT as the base policy\. We additionally use a controlled pour scenario for module ablation\. Full benchmark and setting details are provided in Appendix[A](https://arxiv.org/html/2606.31045#A1), with runtime tasks and stress construction described in Appendix[F](https://arxiv.org/html/2606.31045#A6)and Appendix[G](https://arxiv.org/html/2606.31045#A7)\.

#### Metrics\.

For laboratory\-language grounding, we report Type Accuracy, Substance F1, Task Tag F1, Predicate Soft Match, Predicate Canonical EM, Schema Valid, and Compile Ready\. For compiled\-monitor replay, we report check\-function accuracy, task\-scope F1, parameter recovery, catch rate, precision, and F1 on unsafe and safe\-control scenarios\. For runtime monitor execution, we report Success Rate \(SR\), Violation Rate \(VR\), Intervention Rate \(IR\), Collision Rate \(CR\), mean Risk, Episode Length \(EL\), and Task Completion Time \(TCT\)\. Detailed metric definitions are provided in Appendix[C](https://arxiv.org/html/2606.31045#A3)\.

#### Baselines\.

For laboratory\-language grounding, we compare against a Regex baseline, prompted LLMs, LoRA fine\-tuned models, and our hybrid grounding variant\. For compiled\-monitor replay, we compare monitors compiled from different grounding outputs, including Regex, LoRA, Hybrid, and gold labels / monitors compiled from gold labels\. For runtime monitor execution, we compare Base, which uses ACT\(Zhaoet al\.,[2023](https://arxiv.org/html/2606.31045#bib.bib8)\)without the safety layer, against different runtime module configurations\. Full implementation details are provided in Appendix[H](https://arxiv.org/html/2606.31045#A8)\.

### 5\.2Laboratory\-Language Grounding

We first evaluate whether LabGuard can ground natural\-language laboratory rules into executable IR instances under distribution shift\. Table[2](https://arxiv.org/html/2606.31045#S5.T2)reports source held\-out and chemistry\-held\-out results, while the random 80/20 split is reported in Appendix[E](https://arxiv.org/html/2606.31045#A5)as an in\-distribution upper bound\. LabGuard\-Hybrid achieves the strongest performance, reaching 79\.4 task\-scope F1 under source\-held\-out evaluation and 91\.8 under chemistry\-held\-out evaluation\. This indicates that LabGuard can still recover when safety rules should be activated even when source families or chemistry categories change\.

LabGuard\-Hybrid is effective because it combines learned task\-scope prediction with rule\-based substance normalization\. The learned component handles variation in laboratory\-rule wording, while the rule\-based component reduces substance\-resolution errors that can prevent IR instances from compiling correctly\. Although exact predicate recovery remains challenging, the grounded IR instances reduce unsafe events from 39\.5% to 23\.8% after monitor compilation under source\-held\-out evaluation\. This suggests that accurate activation scope and reliable substance binding carry much of the downstream safety signal by routing proposed actions to the correct runtime checks\.

### 5\.3Compiled\-Monitor Replay

![Refer to caption](https://arxiv.org/html/2606.31045v1/x2.png)Figure 3:Per\-task success rate \(Base vs\. Full LabGuard\) across L1–L4\. Mean SR over 3 seeds×\\times10 episodes \(error bars: seed std\), with IR and VR under Full and right\-handΔ\\Deltavalues reporting Full−\-Base\.We next evaluate whether grounded IR instances can be compiled into deterministic monitors that prevent unsafe outcomes in offline replay\. The stress set contains 70 unsafe scenarios across 7 hazard categories and 30 safe\-control scenarios; among the unsafe cases, 54 are in\-schema and executable by the current monitor library, while 16 require additional monitor types such as exothermic\-reaction tracking\. Gold IR labels catch all 54 in\-schema unsafe scenarios, and LoRA and LabGuard\-Hybrid approach this oracle bound, with remaining gaps mainly caused by grounding errors rather than monitor\-compilation failures Appendix[G](https://arxiv.org/html/2606.31045#A7)\. The 16 out\-of\-schema cases are missed by all configurations, including gold, indicating a schema\-coverage boundary rather than a translation failure\. Table[4](https://arxiv.org/html/2606.31045#S5.T4)further shows that source\-held\-out grounding preserves the relative ordering of methods after compilation, although cross\-source degradation remains non\-trivial\.

Table 3:Stress\-benchmark results under compiled\-monitor replay\. Outcome\-level catch, precision over the combined unsafe \+ safe\-control pool, and their F1\.Table 4:Source\-held\-out propagation to stress benchmark\. Same 70/30 pool as Table[3](https://arxiv.org/html/2606.31045#S5.T3), re\-grounded with source\-held\-out LoRA\.We analyze how grounding errors propagate through the LabGuard pipeline and affect downstream execution\. Grounding errors mainly concentrate in formal predicate composition, while task\-scope grounding remains the most transferable signal under source shifts Table[4](https://arxiv.org/html/2606.31045#S5.T4)\. This pattern reflects three factors: schema complexity from 15 heterogeneous constraint types, sparse supervision with only 3–5 paraphrases per canonical rule, and metric limitations where token\-level Soft Match may miss semantically equivalent predicates such as “temp\>\>80” and “80<<temp”\. Executable equivalence testing is left to future work Appendix[I](https://arxiv.org/html/2606.31045#A9)\)·\.

The compiled pipeline remains effective because runtime safety depends heavily on correct task\-scope routing\. Once the system identifies when a rule should fire, deterministic check functions and registry\-resolved substances recover much of the remaining execution semantics\. LabGuard\-Hybrid further reduces substance\-extraction failures by using regex fallback for the substance slot\. This explains why models with modest predicate scores can still yield measurable safety improvements after compilation\.

### 5\.4Runtime Monitor Execution

The final stage closes the loop: compiled monitors must attach to learned controllers in a live simulator without degrading task success\. We evaluate LabGuard on LabUtopia Levels 1–4 \(per\-task list in Appendix[F](https://arxiv.org/html/2606.31045#A6); full numbers in Appendix[F](https://arxiv.org/html/2606.31045#A6)\) to demonstrate runtime feasibility and bound the overhead of compiled\-monitor execution\. The focus is on whether the safety layer can integrate with ACT policies without task\-success loss; main\-runtime VR/Unsafe Event are assurance\-layer\-logged \(Appendix[C](https://arxiv.org/html/2606.31045#A3)\), while an outcome\-level oracle independent of the wrapper is applied only to the controlled pour ablation \(Table[5](https://arxiv.org/html/2606.31045#S5.T5)\)\.

Figure[3](https://arxiv.org/html/2606.31045#S5.F3)shows the safety layer is essentially a no\-op on tasks already at ceiling and is associated with the largest task\-success gains on safety\-relevant operations\. Intervention rates stay≤0\.5%\\leq 0\.5\\%across tasks, and assurance\-layer\-logged violations remain in the0\.20\.2–0\.60\.6range\. This pattern confirms that compiled monitors do not introduce spurious interventions or degrade controller performance, completing the path from laboratory language to runtime monitoring without controller\-side friction\.

### 5\.5Runtime Module Ablation

We isolate the contribution of each runtime module using a controlled*pour*stress scenario that deliberately triggers unsafe behavior under a weak base policy\. This offline\-rescored ablation uses an outcome\-level oracle independent of the runtime assurance layer, and Table[5](https://arxiv.org/html/2606.31045#S5.T5)reports success rate \(SR\), intervention rate \(IR\), violation rate \(VR\), risk score, collision rate \(CR\), episode length \(EL\), and total cycle time \(TCT\)\. Full LabGuard improves SR from 10% to 40% and reduces logged violations from 2\.8 to 0\.6 per episode\. Among individual modules, the Action Filter contributes the largest gain, raising SR to 30% and reducing VR to 0\.9, while Planning and Semantic modules provide complementary violation reductions\. Risk Scoring alone does not improve SR, but provides discriminative risk information for future adaptive interventions\. Overall, the ablation shows that runtime safety comes from the combination of task\-scope routing, chemistry\-state\-aware checks, and kinematic filtering rather than any single module\.

Table 5:Module\-level ablation on the controlled*pour*stress scenario\. SR, IR, VR, Risk, CR, EL, TCT for each module in isolation and the full system\.

## 6Conclusion

We presented LabGuard, a language\-to\-execution safety suite that transforms laboratory natural language into typed executable specifications and runtime guards for controller\-side intervention in simulation\. By separating laboratory\-language grounding, monitor compilation, and runtime execution, LabGuard provides an auditable path from human\-readable laboratory safety knowledge to executable monitors\. Through LabGuard\-Bench and a three\-stage evaluation protocol, we show that laboratory\-language grounding and monitor compilation can link language\-level safety rules to runtime robot behavior within a schema\-scoped setting\. Future work should expand the monitor schema, improve cross\-source predicate grounding, and evaluate stronger safety guarantees beyond simulation\.

## Limitations

Our work is limited by its simulation\-only evaluation\. All runtime experiments and stress tests are conducted in the LabUtopia virtual environment, so the results show that LabGuard can connect laboratory natural language to runtime monitors in simulation, but they do not establish real\-world laboratory safety\. Physical deployment would require additional validation with real robot dynamics, sensing noise, calibration errors, and institutional safety procedures\. A second limitation is broader policy coverage\. We use ACT as the main learned controller in LabUtopia, which is sufficient to test whether compiled monitors can be inserted at the controller boundary\. Future work can evaluate the same runtime\-contract layer with more VLA models and manipulation policies to study how the safety layer behaves across different embodied agents\.

## Ethics Statement

This work is conducted entirely in simulation and does not involve deployment on physical laboratory hardware or interaction with real hazardous chemicals\. As a result, the experiments do not create direct real\-world safety risks during evaluation\. At the same time, the paper studies safeguards for scientific robotics, so we intentionally avoid overstating claims to reduce the risk of misleading conclusions about real\-world laboratory safety\.

## References

- A\. D\. Ames, S\. Coogan, M\. Egerstedt, G\. Notomista, K\. Sreenath, and P\. Tabuada \(2019\)Control Barrier Functions: Theory and Applications\.InEuropean Control Conference,External Links:[Link](https://doi.org/10.23919/ECC.2019.8796030)Cited by:[§1](https://arxiv.org/html/2606.31045#S1.p2.1),[§2](https://arxiv.org/html/2606.31045#S2.p2.1)\.
- K\. Black, N\. Brown, D\. Driess, A\. Esmail, M\. Equi, C\. Finn, N\. Fusai, L\. Groom, K\. Hausman, B\. Ichter, S\. Jakubczak, T\. Jones, L\. Ke, S\. Levine, A\. Li\-Bell, M\. Mothukuri, S\. Nair, K\. Pertsch, L\. X\. Shi, J\. Tanner, Q\. Vuong, A\. Walling, H\. Wang, and U\. Zhilinsky \(2026\)π0\\pi\_\{0\}: A Vision\-Language\-Action Flow Model for General Robot Control\.External Links:[Link](https://arxiv.org/abs/2410.24164)Cited by:[§1](https://arxiv.org/html/2606.31045#S1.p1.1)\.
- A\. Brohan, N\. Brown, J\. Carbajal, Y\. Chebotar, X\. Chen, K\. Choromanski, T\. Ding, D\. Driess, A\. Dubey, C\. Finn, P\. Florence, C\. Fu, M\. G\. Arenas, K\. Gopalakrishnan, K\. Han, K\. Hausman, A\. Herzog, J\. Hsu, B\. Ichter, A\. Irpan, N\. Joshi, R\. Julian, D\. Kalashnikov, Y\. Kuang, I\. Leal, L\. Lee, T\. E\. Lee, S\. Levine, Y\. Lu, H\. Michalewski, I\. Mordatch, K\. Pertsch, K\. Rao, K\. Reymann, M\. Ryoo, G\. Salazar, P\. Sanketi, P\. Sermanet, J\. Singh, A\. Singh, R\. Soricut, H\. Tran, V\. Vanhoucke, Q\. Vuong, A\. Wahid, S\. Welker, P\. Wohlhart, J\. Wu, F\. Xia, T\. Xiao, P\. Xu, S\. Xu, T\. Yu, and B\. Zitkovich \(2023\)RT\-2: Vision\-Language\-Action Models Transfer Web Knowledge to Robotic Control\.External Links:[Link](https://arxiv.org/abs/2307.15818)Cited by:[§1](https://arxiv.org/html/2606.31045#S1.p1.1)\.
- C\. Chi, Z\. Xu, S\. Feng, E\. Cousineau, Y\. Du, B\. Burchfiel, R\. Tedrake, and S\. Song \(2024\)Diffusion Policy: Visuomotor Policy Learning via Action Diffusion\.External Links:[Link](https://doi.org/10.1177/02783649241273668)Cited by:[§1](https://arxiv.org/html/2606.31045#S1.p1.1)\.
- M\. Cui, J\. Yang, F\. Ji, Q\. Jiang, Z\. Shi, J\. Wang, Z\. Song, F\. Koto, and X\. Chen \(2026\)TextAlign: Preference Alignment for Text Rendering with Hierarchical Rewards\.External Links:[Link](https://arxiv.org/abs/2605.19320)Cited by:[§1](https://arxiv.org/html/2606.31045#S1.p1.1)\.
- K\. Darvish, M\. Skreta, Y\. Zhao, N\. Yoshikawa, S\. Som, M\. Bogdanovic, Y\. Cao, H\. Hao, H\. Xu, A\. Aspuru\-Guzik, A\. Garg, and F\. Shkurti \(2025\)ORGANA: A Robotic Assistant for Automated Chemistry Experimentation and Characterization\.External Links:[Link](https://doi.org/10.1016/j.matt.2024.10.015)Cited by:[§1](https://arxiv.org/html/2606.31045#S1.p1.1)\.
- C\. Hokamp and Q\. Liu \(2017\)Lexically Constrained Decoding for Sequence Generation Using Grid Beam Search\.InAnnual Meeting of the Association for Computational Linguistics,External Links:[Link](https://aclanthology.org/P17-1141/)Cited by:[§2](https://arxiv.org/html/2606.31045#S2.p3.1)\.
- Y\. Huang, L\. Ding, Z\. Tang, T\. Wang, X\. Lin, W\. Zhang, M\. Ma, and Y\. Zhang \(2025\)A Framework for Benchmarking and Aligning Task\-Planning Safety in LLM\-Based Embodied Agents\.External Links:[Link](https://arxiv.org/abs/2504.14650)Cited by:[§1](https://arxiv.org/html/2606.31045#S1.p2.1)\.
- F\. Ji, J\. Yang, Z\. Song, L\. Gao, J\. Liang, Z\. Chen, J\. Zhang, and X\. Chen \(2026a\)ServImage: An Image Generation and Editing Benchmark from Real\-World Commercial Imaging Services\.External Links:[Link](https://arxiv.org/abs/2604.24023)Cited by:[§1](https://arxiv.org/html/2606.31045#S1.p2.1)\.
- F\. Ji, J\. Yang, Z\. Song, Y\. Wang, Z\. Cui, Y\. Li, Q\. Jiang, and X\. Chen \(2026b\)FineState\-Bench: Benchmarking State\-Conditioned Grounding for Fine\-Grained GUI State Setting\.External Links:[Link](https://arxiv.org/abs/2604.27974)Cited by:[§1](https://arxiv.org/html/2606.31045#S1.p1.1)\.
- A\. A\. Khan, M\. Andrev, M\. A\. Murtaza, S\. Aguilera, R\. Zhang, J\. Ding, S\. Hutchinson, and A\. Anwar \(2025\)Safety Aware Task Planning via Large Language Models in Robotics\.InIEEE/RSJ International Conference on Intelligent Robots and Systems,External Links:[Link](https://doi.org/10.1109/iros60139.2025.11246041)Cited by:[§1](https://arxiv.org/html/2606.31045#S1.p2.1)\.
- M\. J\. Kim, K\. Pertsch, S\. Karamcheti, T\. Xiao, A\. Balakrishna, S\. Nair, R\. Rafailov, E\. P\. Foster, P\. R\. Sanketi, Q\. Vuong, T\. Kollar, B\. Burchfiel, R\. Tedrake, D\. Sadigh, S\. Levine, P\. Liang, and C\. Finn \(2024\)OpenVLA: An Open\-Source Vision\-Language\-Action Model\.In8th Annual Conference on Robot Learning,External Links:[Link](https://openreview.net/forum?id=ZMnD6QZAE6)Cited by:[§1](https://arxiv.org/html/2606.31045#S1.p1.1)\.
- Z\. Lai, Y\. Zheng, Z\. Cai, H\. Lyu, J\. Yang, H\. Liang, Y\. Hu, and B\. Wang \(2025\)Can Multimodal LLMs See Materials Clearly? A Multimodal Benchmark on Materials Characterization\.External Links:[Link](https://arxiv.org/abs/2509.09307)Cited by:[§1](https://arxiv.org/html/2606.31045#S1.p1.1)\.
- R\. Li, Z\. Hu, W\. Qu, J\. Zhang, Z\. Yin, S\. Zhang, X\. Huang, H\. Wang, T\. Wang, J\. Pang, W\. Ouyang, L\. BAI, W\. Zuo, L\. DUAN, D\. Zhou, and S\. TANG \(2026\)LabUtopia: High\-Fidelity Simulation and Hierarchical Benchmark for Scientific Embodied Agents\.InThe Thirty\-ninth Annual Conference on Neural Information Processing Systems Datasets and Benchmarks Track,External Links:[Link](https://openreview.net/forum?id=AIOq1vWSgK)Cited by:[§1](https://arxiv.org/html/2606.31045#S1.p1.1)\.
- X\. Lu, S\. Welleck, P\. Liber, H\. Hajishirzi, and Y\. Choi \(2022\)NeuroLogic A\*esque Decoding: Constrained Text Generation with Lookahead Heuristics\.InNorth American Chapter of the Association for Computational Linguistics,External Links:[Link](https://aclanthology.org/2022.naacl-main.57/)Cited by:[§2](https://arxiv.org/html/2606.31045#S2.p3.1)\.
- H\. Luo, Z\. Lai, J\. Xu, Y\. Li, T\. P\. Hin, Y\. Zhang, and C\. Liu \(2026\)From Natural Language to Executable Option Strategies via Large Language Models\.External Links:[Link](https://arxiv.org/abs/2603.16434)Cited by:[§1](https://arxiv.org/html/2606.31045#S1.p1.1)\.
- C\. Matuszek, E\. Herbst, L\. Zettlemoyer, and D\. Fox \(2013\)Learning to Parse Natural Language Commands to a Robot Control System\.InInternational Symposium on Experimental Robotics,External Links:[Link](https://doi.org/10.1007/978-3-319-00065-7_28)Cited by:[§2](https://arxiv.org/html/2606.31045#S2.p3.1)\.
- D\. Morton and M\. Pavone \(2025\)Safe, Task\-Consistent Manipulation with Operational Space Control Barrier Functions\.InIEEE/RSJ International Conference on Intelligent Robots and Systems,External Links:[Link](https://doi.org/10.1109/iros60139.2025.11246389)Cited by:[§2](https://arxiv.org/html/2606.31045#S2.p2.1)\.
- S\. Mysore, Z\. Jensen, E\. Kim, K\. Huang, H\. Chang, E\. Strubell, J\. Flanigan, A\. McCallum, and E\. Olivetti \(2019\)The Materials Science Procedural Text Corpus: Annotating Materials Synthesis Procedures with Shallow Semantics\.InProceedings of the 13th Linguistic Annotation Workshop,External Links:[Link](https://aclanthology.org/W19-4007/)Cited by:[§2](https://arxiv.org/html/2606.31045#S2.p3.1)\.
- T\. Sadhu, Y\. Chen, and A\. Pesaranghader \(2025\)VESTABENCH: An Embodied Benchmark for Safe Long\-Horizon Planning Under Multi\-Constraint and Adversarial Settings\.InConference on Empirical Methods in Natural Language Processing Industry Track,External Links:[Link](https://aclanthology.org/2025.emnlp-industry.149/)Cited by:[§1](https://arxiv.org/html/2606.31045#S1.p2.1)\.
- T\. Scholak, N\. Schucher, and D\. Bahdanau \(2021\)PICARD: Parsing Incrementally for Constrained Auto\-Regressive Decoding from Language Models\.InConference on Empirical Methods in Natural Language Processing,External Links:[Link](https://aclanthology.org/2021.emnlp-main.779/)Cited by:[§2](https://arxiv.org/html/2606.31045#S2.p3.1)\.
- R\. Shin, C\. H\. Lin, S\. Thomson, C\. Chen, S\. Roy, E\. A\. Platanios, A\. Pauls, D\. Klein, J\. Eisner, and B\. Van Durme \(2021\)Constrained Language Models Yield Few\-Shot Semantic Parsers\.InConference on Empirical Methods in Natural Language Processing,External Links:[Link](https://aclanthology.org/2021.emnlp-main.608/)Cited by:[§2](https://arxiv.org/html/2606.31045#S2.p3.1)\.
- Z\. Song, G\. Ouyang, M\. Li, Y\. Ji, C\. Wang, Z\. Xu, Z\. Zhang, X\. Zhang, Q\. Jiang, F\. Ji, Z\. Chen, Z\. Li, and X\. Chen \(2026\)ManipLVM\-R1: Reinforcement Learning for Reasoning in Embodied Manipulation with Large Vision\-Language Models\.InAAAI Conference on Artificial Intelligence,External Links:[Link](https://doi.org/10.1609/aaai.v40i22.38922)Cited by:[§2](https://arxiv.org/html/2606.31045#S2.p2.1)\.
- Q\. Sun, X\. Chi, Y\. Rui, Y\. Li, K\. Ge, J\. Li, S\. Han, and S\. Zhang \(2026\)LABSHIELD: A Multimodal Benchmark for Safety\-Critical Reasoning and Planning in Scientific Laboratories\.External Links:[Link](https://arxiv.org/abs/2603.11987)Cited by:[§1](https://arxiv.org/html/2606.31045#S1.p2.1)\.
- S\. Tellex, T\. Kollar, S\. Dickerson, M\. R\. Walter, A\. G\. Banerjee, S\. Teller, and N\. Roy \(2011\)Understanding Natural Language Commands for Robotic Navigation and Mobile Manipulation\.InTwenty\-Fifth AAAI Conference on Artificial Intelligence,External Links:[Link](https://doi.org/10.1609/aaai.v25i1.7979)Cited by:[§2](https://arxiv.org/html/2606.31045#S2.p3.1)\.
- A\. C\. Vaucher, F\. Zipoli, J\. Geluykens, V\. H\. Nair, P\. Schwaller, and T\. Laino \(2020\)Automated Extraction of Chemical Synthesis Actions from Experimental Procedures\.External Links:[Link](https://doi.org/10.1038/s41467-020-17266-6)Cited by:[§2](https://arxiv.org/html/2606.31045#S2.p3.1)\.
- H\. Wang, C\. M\. Poskitt, and J\. Sun \(2025a\)AgentSpec: Customizable Runtime Enforcement for Safe and Reliable LLM Agents\.External Links:[Link](https://arxiv.org/abs/2503.18666)Cited by:[§1](https://arxiv.org/html/2606.31045#S1.p2.1),[§2](https://arxiv.org/html/2606.31045#S2.p2.1)\.
- L\. Wang, Z\. Ying, X\. Yang, Q\. Zou, Z\. Yin, T\. Li, J\. Yang, Y\. Yang, A\. Liu, and X\. Liu \(2025b\)RoboSafe: Safeguarding Embodied Agents via Executable Safety Logic\.External Links:[Link](https://arxiv.org/abs/2512.21220)Cited by:[§1](https://arxiv.org/html/2606.31045#S1.p2.1),[§2](https://arxiv.org/html/2606.31045#S2.p2.1)\.
- J\. Yang, M\. Cui, H\. Zhang, F\. Ji, Z\. Lai, and Y\. Wang \(2025\)Agent\-Based Anti\-Jamming Techniques for UAV Communications in Adversarial Environments: A Comprehensive Survey\.External Links:[Link](https://arxiv.org/abs/2508.11687)Cited by:[§1](https://arxiv.org/html/2606.31045#S1.p1.1),[§1](https://arxiv.org/html/2606.31045#S1.p2.1)\.
- J\. Yang, Z\. Han, M\. Xiang, H\. Wang, Y\. Huang, and M\. Fang \(2024a\)Asynchronous and Segmented Bidirectional Encoding for NMT\.External Links:[Link](https://arxiv.org/abs/2402.14849)Cited by:[§1](https://arxiv.org/html/2606.31045#S1.p1.1)\.
- J\. Yang, F\. Ji, Z\. Lai, J\. Wu, M\. Cui, and Y\. Wang \(2026a\)Zero\-Parameter Geometric Gating for Temporally Stable Low\-Altitude UAV Video Semantic Segmentation\.External Links:[Link](https://arxiv.org/abs/2606.09162)Cited by:[§2](https://arxiv.org/html/2606.31045#S2.p2.1)\.
- J\. Yang, H\. Wang, Q\. Zhao, Z\. Shi, Z\. Song, and M\. Fang \(2024b\)Efficient Reinforcement Learning via Decoupling Exploration and Utilization\.InAdvanced Intelligent Computing Technology and Applications,External Links:[Link](https://doi.org/10.1007/978-981-97-5581-3_32)Cited by:[§1](https://arxiv.org/html/2606.31045#S1.p2.1)\.
- J\. Yang, H\. Zhang, F\. Ji, Y\. Wang, M\. Wang, Y\. Luo, and W\. Ding \(2026b\)Frequency Point Game Environment for UAVs via Expert Knowledge and Large Language Model\.External Links:[Link](https://doi.org/10.3390/drones10020147)Cited by:[§1](https://arxiv.org/html/2606.31045#S1.p1.1)\.
- S\. Yin, X\. Pang, Y\. Ding, M\. Chen, Y\. Bi, Y\. Xiong, W\. Huang, Z\. Xiang, J\. Shao, and S\. Chen \(2025\)SafeAgentBench: A Benchmark for Safe Task Planning of Embodied LLM Agents\.External Links:[Link](https://arxiv.org/abs/2412.13178)Cited by:[§1](https://arxiv.org/html/2606.31045#S1.p2.1),[§2](https://arxiv.org/html/2606.31045#S2.p1.1)\.
- Z\. Ying, L\. Wang, Y\. Xiao, J\. Wang, Y\. Ma, J\. Guo, Z\. Yin, M\. Zhang, A\. Liu, and X\. Liu \(2025\)AGENTSAFE: Benchmarking the Safety of Embodied Agents on Hazardous Instructions\.External Links:[Link](https://arxiv.org/abs/2506.14697)Cited by:[§2](https://arxiv.org/html/2606.31045#S2.p1.1)\.
- J\. M\. Zelle and R\. J\. Mooney \(1996\)Learning to Parse Database Queries Using Inductive Logic Programming\.InProceedings of the Thirteenth National Conference on Artificial Intelligence and Eighth Innovative Applications of Artificial Intelligence Conference, AAAI 96, IAAI 96, Portland, Oregon, USA, August 4\-8, 1996, Volume 2,External Links:[Link](http://www.aaai.org/Library/AAAI/1996/aaai96-156.php)Cited by:[§2](https://arxiv.org/html/2606.31045#S2.p3.1)\.
- L\. S\. Zettlemoyer and M\. Collins \(2005\)Learning to Map Sentences to Logical Form: Structured Classification with Probabilistic Categorial Grammars\.InUAI ’05, Proceedings of the 21st Conference in Uncertainty in Artificial Intelligence, Edinburgh, Scotland, July 26\-29, 2005,External Links:[Link](https://dblp.org/rec/conf/uai/ZettlemoyerC05.html)Cited by:[§2](https://arxiv.org/html/2606.31045#S2.p3.1)\.
- B\. Zhang, Y\. Zhang, J\. Ji, Y\. Lei, J\. Dai, Y\. Chen, and Y\. Yang \(2026a\)SafeVLA: Towards Safety Alignment of Vision\-Language\-Action Model via Constrained Learning\.InThe Thirty\-ninth Annual Conference on Neural Information Processing Systems,External Links:[Link](https://openreview.net/forum?id=dt940loCBT)Cited by:[§2](https://arxiv.org/html/2606.31045#S2.p1.1)\.
- F\. Zhang, Z\. Li, S\. Peng, and Y\. Chen \(2026b\)When Alpha Disappears: A One\-Switch Benchmark for Decision\-Time Leakage in Financial Backtests\.External Links:[Link](https://arxiv.org/abs/2605.23959)Cited by:[§2](https://arxiv.org/html/2606.31045#S2.p3.1)\.
- F\. Zhang, J\. Luo, Z\. Zhang, S\. Huang, Z\. Liu, and Y\. Chen \(2026c\)Beyond Visual Realism: Toward Reliable Financial Time Series Generation\.External Links:[Link](https://arxiv.org/abs/2601.12990)Cited by:[§2](https://arxiv.org/html/2606.31045#S2.p2.1)\.
- F\. Zhang, M\. Song, R\. Elbadry, Y\. Chen, S\. Wang, Y\. Zhou, X\. Zheng, Y\. He, Y\. Dai, G\. Georgiev,et al\.\(2026d\)FinReporting: An Agentic Workflow for Localized Reporting of Cross\-Jurisdiction Financial Disclosures\.External Links:[Link](https://arxiv.org/abs/2604.05966)Cited by:[§2](https://arxiv.org/html/2606.31045#S2.p2.1)\.
- Z\. Zhang, C\. Yue, H\. Xu, M\. Liao, X\. Qi, H\. Gao, Z\. Wang, and H\. Zhao \(2025\)RoboChemist: Long\-Horizon and Safety\-Compliant Robotic Chemical Experimentation\.External Links:[Link](https://arxiv.org/abs/2509.08820)Cited by:[§1](https://arxiv.org/html/2606.31045#S1.p1.1)\.
- T\. Z\. Zhao, V\. Kumar, S\. Levine, and C\. Finn \(2023\)Learning Fine\-Grained Bimanual Manipulation with Low\-Cost Hardware\.InRobotics: Science and Systems,External Links:[Link](https://doi.org/10.15607/rss.2023.xix.016)Cited by:[§1](https://arxiv.org/html/2606.31045#S1.p1.1),[§5\.1](https://arxiv.org/html/2606.31045#S5.SS1.SSS0.Px3.p1.1)\.
- E\. Zhou, Q\. Su, C\. Chi, Z\. Zhang, Z\. Wang, T\. Huang, L\. Sheng, and H\. Wang \(2025\)Code\-as\-Monitor: Constraint\-Aware Visual Programming for Reactive and Proactive Robotic Failure Detection\.InarXiv preprint arXiv:2412\.04455,External Links:[Link](https://arxiv.org/abs/2412.04455)Cited by:[§2](https://arxiv.org/html/2606.31045#S2.p2.1)\.
- Y\. Zhou, J\. Yang, K\. Guo, P\. Chen, T\. Gao, W\. Geyer, N\. Moniz, N\. V\. Chawla, and X\. Zhang \(2024\)LabSafety Bench: Benchmarking LLMs on Safety Issues in Scientific Labs\.External Links:[Link](https://arxiv.org/abs/2410.14182)Cited by:[§1](https://arxiv.org/html/2606.31045#S1.p2.1)\.

## Appendix AEvaluation Matrix

Table[6](https://arxiv.org/html/2606.31045#A1.T6)summarizes the evaluation settings used in the main paper\. We separate three kinds of evidence: laboratory\-language grounding on held\-out labels, offline replay of compiled monitors on scripted safety scenarios, and live LabUtopia execution with ACT\. “Offline replay” means that compiled monitors are evaluated on scripted state traces; “live runtime” means that the safety layer runs inside the controller loop\. This distinction is important because the stress benchmark uses outcome\-level replay, whereas the L1–L4 runtime results report events logged by the active assurance layer\.

Table 6:Evaluation matrix\. Summary of the grounding, offline replay, and live\-runtime protocols used in the paper\.
## Appendix BRuntime Safety Module Details

This appendix gives additional implementation details for the runtime monitor execution modules summarized in Section[5\.4](https://arxiv.org/html/2606.31045#S5.SS4)\. The modules operate after laboratory\-language grounding and monitor compilation\. No language model is invoked inside the controller loop\.

### B\.1Compiled Monitor Target

Given a grounded LabGuard\-IR instance,

z^=\(t^,S^,p^,T^,v^,i^\),\\hat\{z\}=\(\\hat\{t\},\\hat\{S\},\\hat\{p\},\\hat\{T\},\\hat\{v\},\\hat\{i\}\),the compiler lowers it into a runtime monitor,

ρ=compile​\(z^\)=\(fcheck,ϕscope,θ,v^,i^\)\.\\rho=\\mathrm\{compile\}\(\\hat\{z\}\)=\(f\_\{\\mathrm\{check\}\},\\phi\_\{\\mathrm\{scope\}\},\\theta,\\hat\{v\},\\hat\{i\}\)\.Here,fcheckf\_\{\\mathrm\{check\}\}is the state\-action check function,ϕscope\\phi\_\{\\mathrm\{scope\}\}determines whether the monitor is active for a proposed action,θ\\thetastores monitor parameters,v^\\hat\{v\}is the severity level, andi^\\hat\{i\}is the intervention mode\. The scope predicate is instantiated from the action\-scope field:

ϕscope​\(a\)=𝟏​\[tag​\(a\)∈T^\]\.\\phi\_\{\\mathrm\{scope\}\}\(a\)=\\mathbf\{1\}\[\\mathrm\{tag\}\(a\)\\in\\hat\{T\}\]\.The constraint typet^\\hat\{t\}selects a monitor class from the typed monitor library, whileS^\\hat\{S\}andp^\\hat\{p\}populateθ\\thetawith registry\-resolved substances, thresholds, spatial bounds, or other check parameters\.

For material\-compatibility specifications, the monitor uses an incompatibility table over registered substances\. For two substancescac\_\{a\}andcbc\_\{b\}, the lookup is

compat​\(ca,cb\)=\{1,cb∉inc​\(ca\)∧ca∉inc​\(cb\),0,otherwise,\\mathrm\{compat\}\(c\_\{a\},c\_\{b\}\)=\\begin\{cases\}1,&c\_\{b\}\\notin\\mathrm\{inc\}\(c\_\{a\}\)\\wedge c\_\{a\}\\notin\\mathrm\{inc\}\(c\_\{b\}\),\\\\ 0,&\\mathrm\{otherwise\},\\end\{cases\}\(7\)whereinc​\(⋅\)\\mathrm\{inc\}\(\\cdot\)denotes the incompatible\-substance list in the runtime registry\. This lookup is intentionally simple\. Violations are triggered by explicit registry entries and task\-conditioned monitor templates, not by a symbolic planner or reaction simulator\.

### B\.2Chemistry\-State\-Aware Semantic Checks

The runtime assurance layer maintains a live laboratory state containing registered containers, their substance identities, volumes, temperatures, capacities, and the robot kinematic state\. Active monitors evaluate their predicates against this state and the controller\-proposed action\.

For transfer\-like actions, the monitor inspects the source container, destination container, transferred substance, destination contents, and planned transfer volume\. The supported checks include incompatible mixing, destination overflow, temperature\-threshold violations, sequencing preconditions, PPE\-related preconditions, and waste\-handling constraints\. If a violation is detected, the monitor returns a verdict according to its intervention mode\. The action may be blocked or modified before execution, and the intervention is logged for analysis\. If no violation is detected, the state update is committed so that later monitors operate on the updated container state\.

### B\.3Geometric and Kinematic Bounds

The runtime layer also applies lightweight geometric and kinematic validation\. These checks enforce fixed workspace bounds, conservative joint margins, and per\-joint velocity limits\. The workspace constraint is applied componentwise:

pmin,k≤pe​e,k≤pmax,k,k∈\{x,y,z\},p\_\{\\min,k\}\\leq p\_\{ee,k\}\\leq p\_\{\\max,k\},\\qquad k\\in\\\{x,y,z\\\},\(8\)wherepe​ep\_\{ee\}is the end\-effector position\. The action\-side velocity constraint is

\|q˙j\|≤α​q˙j,max,α=0\.8\.\|\\dot\{q\}\_\{j\}\|\\leq\\alpha\\dot\{q\}\_\{j,\\max\},\\qquad\\alpha=0\.8\.\(9\)These bounds are fixed in the current implementation and are used as conservative runtime safeguards rather than learned safety constraints\.

### B\.4Barrier\-Style Action Filter

The action filter uses barrier\-style margins around joint limits together with velocity clamping\. For jointjj, the margins are

hj\+​\(q\)\\displaystyle h\_\{j\}^\{\+\}\(q\)=qj,max−qj−δ,\\displaystyle=q\_\{j,\\max\}\-q\_\{j\}\-\\delta,\(10\)hj−​\(q\)\\displaystyle h\_\{j\}^\{\-\}\(q\)=qj−qj,min−δ,\\displaystyle=q\_\{j\}\-q\_\{j,\\min\}\-\\delta,\(11\)whereδ\\deltais a fixed safety margin\. These quantities are used to steer target positions away from joint boundaries and to clamp velocities\. Although the design is inspired by control\-barrier constraints, the implementation does not solve a quadratic program and does not claim the guarantees of a full optimization\-based CBF controller\.

### B\.5Risk Scoring and Logging

The risk scorer aggregates velocity, proximity, chemical hazard, and uncertainty with fixed hand\-designed weights:

ρt=0\.25​ρv\+0\.25​ρp\+0\.30​ρc\+0\.20​ρu\.\\rho\_\{t\}=0\.25\\rho\_\{v\}\+0\.25\\rho\_\{p\}\+0\.30\\rho\_\{c\}\+0\.20\\rho\_\{u\}\.\(12\)The coefficients are fixed heuristics rather than learned parameters\. When chemistry\-state\-aware checks are enabled, the chemical termρc\\rho\_\{c\}is computed from the live container state, including substance identities, volumes, fill fractions, and temperature\-related signals\. High\-risk steps are logged for analysis, and threshold exceedances can produce safety events according to the active monitor configuration\. In the current implementation, risk scoring is primarily diagnostic: it flags high\-risk states and supports intervention analysis, but it does not by itself provide a formal safety guarantee or restore simulator state\.

## Appendix CRuntime Metric Definitions

We report runtime metrics under two scoring modes\. For L1–L4 LabUtopia runs, safety events are logged by the runtime assurance layer when that layer is active\. For the controlled*pour*ablation, we additionally rescore each trajectory with an offline compiled\-monitor checker, so that the Base policy, which has no active safety layer, can be compared with the safety\-module variants\.

#### Success Rate\.

SR is the fraction of episodes that complete the task\. Higher SR indicates better task performance\.

#### Violation Rate\.

VR is the average number of safety violations per episode\. In the L1–L4 runtime table, VR counts violations logged by the active assurance layer\. In the controlled*pour*ablation, VR is computed by replaying each trajectory through the same compiled\-monitor checker\. This offline scoring makes the Base row comparable to rows with an active safety layer\.

#### Intervention Rate\.

IR is the fraction of controller steps in which the safety layer blocks, modifies, or replaces the proposed action\. It measures how often the runtime layer changes controller behavior\. Lower IR is preferable when safety outcomes are comparable\.

#### Unsafe Events and False Interventions\.

Unsafe Event is reported for runtime\-style summaries as the percentage of episodes in which the scoring protocol observes an unsafe outcome\. In offline replay settings, the analogous outcome\-level quantities are reported as catch, precision, and F1\. False Intervention measures interventions on safe\-control cases or safe execution segments, and is reported only when such safe\-control labels are available\.

#### Risk, Collision, and Runtime Cost\.

Risk is the mean heuristic risk score from the runtime scorer\. CR is the average number of collision events per episode in the controlled ablation\. EL is the episode length in control steps, and TCT is the total cycle time\. These quantities are reported in the controlled ablation to describe side effects of each runtime module\.

## Appendix DLabGuard\-Bench Construction Protocol

### D\.1Annotation Protocol

The corpus starts from 203 seed rules from four source families described in Section[3\.3](https://arxiv.org/html/2606.31045#S3.SS3)\. Each seed is labeled with constraint type, canonical substances, predicate, task tags, severity, and intervention mode\. Paraphrases inherit the seed label only after review for semantic equivalence\.

Five annotators with chemistry or robotics background reviewed the seed labels and paraphrases\. Final labels use simple majority agreement\. Items without majority agreement are revised before inclusion\. This protocol is intended to keep paraphrase augmentation from adding or removing safety constraints\.

We keep source\-family metadata for each item and do not rely on verbatim source text in the released labels\. Table[7](https://arxiv.org/html/2606.31045#A4.T7)reports the final distribution over the 15 constraint types\. The counts sum to 812 examples\. Per\-source seed counts are 71 lab\-manual rules, 62 PubChem GHS statements, 50 expert\-authored controller\-facing rules, and 20 chemical\-safety reference rules\.

Table 7:Per\-constraint\-type distributionacross the 812\-example LabGuard\-Bench corpus\.For source\-held\-out evaluation, all seed rules and paraphrases from the held\-out source family are removed from training\. Chemical names and constraint types can still appear across folds because they belong to the shared schema and registry\. The split is therefore designed to test source phrasing and rule\-structure shift, not unseen chemistry vocabulary alone\.

Table 8:Source families in LabGuard\-Bench\. Each family contributes rules that map to one or more implemented monitor types\.

## Appendix EGrounding Split Details

The random 80/20 split uses seed 42 over the 812\-example LabGuard\-Bench corpus\. It can share source family, vocabulary, and paraphrase neighbors between train and test, so we treat it as an in\-distribution upper bound\. The source\-held\-out split is the main cross\-source protocol for laboratory\-language grounding\.

Table 9:Random 80/20 laboratory\-language grounding results\. This split is used as an in\-distribution upper bound for representative grounding baselines\.### E\.1Source\-Held\-Out Per\-Fold Breakdown

Table[10](https://arxiv.org/html/2606.31045#A5.T10)reports the four folds used in the source\-held\-out protocol\. The main table reports the corresponding mean and standard deviation\.

Table 10:Per\-fold source\-held\-out results\. The averages are reported in Table[2](https://arxiv.org/html/2606.31045#S5.T2)\.

## Appendix FRuntime Evaluation Details

The ACT base policy follows the standard ACT setup used in the main runtime experiments\. It uses two RGB camera views at256×256256\{\\times\}256resolution and robot state, and each task model is trained from roughly 50 scripted demonstrations\. This small demonstration budget is one reason the runtime results have high variance on long\-horizon or safety\-sensitive tasks\.

We evaluate on LabUtopia Levels 1–4\. Level 1 includes pick, place, press, shake, stir, open, close, and pour\. Level 2 includes HeatLiquid, PourLiquid, ShakeBeaker, and TransportBeaker\. Level 3 uses OOD versions of press and HeatLiquid\. Level 4 uses CleanBeaker\. Each task is evaluated with 3 random seeds and 10 episodes per seed\. Table[11](https://arxiv.org/html/2606.31045#A6.T11)gives the per\-task results\.

Table 11:Full per\-task runtime results across L1–L4 tasks\. We report success rate \(SR, mean±\\pmstd over 3 seeds\),Δ\\DeltaSR \(Full LabGuard minus Base\), intervention rate \(IR\), and*assurance\-layer\-logged*violations per episode \(VR; see Appendix[C](https://arxiv.org/html/2606.31045#A3)for VR semantics\) under Full LabGuard, with a qualitative note column summarizing per\-task behavior\.
## Appendix GReplay and Stress Benchmark Details

Table[12](https://arxiv.org/html/2606.31045#A7.T12)reports replay diagnostics on 41 held\-out rules and 80 scripted scenarios\. These diagnostics use random\-split grounding checkpoints, so they should be read as an in\-distribution replay setting rather than the source\-held\-out operating point\.

Table 12:Compiled\-monitor replay diagnostics\. We report check\-function accuracy, task\-scope F1, compile readiness, unsafe\-scenario catch rate, precision, and aggregate safety score for monitors compiled from each grounding output\.The stress benchmark contains 70 unsafe scenarios and 30 safe\-control scenarios\. The unsafe cases cover seven categories with 10 scenarios each\. Table[13](https://arxiv.org/html/2606.31045#A7.T13)reports true positives for unsafe categories and false positives for safe controls\.

Table 13:Stress benchmark per\-category breakdown\. Unsafe rows report true positives out of 10\. The safe\-control row reports false positives out of 30\.Stress scenarios are constructed to match the categories used in Table[3](https://arxiv.org/html/2606.31045#S5.T3)\. Safe controls preserve surface features of unsafe cases while removing the violation\. The replay evaluator runs compiled monitors on scripted state traces and records whether the unsafe outcome is caught\.

Table 14:Stress benchmark category definitions and counts\.
## Appendix HImplementation Details

The LoRA laboratory\-language grounding module uses Qwen3\-8B as the base model\. We train with rankr=16r\{=\}16, alphaα=32\\alpha\{=\}32, target modulesq\_proj,k\_proj,v\_proj, ando\_proj, 3 epochs, batch size 8, AdamW, learning rate2×10−42\{\\times\}10^\{\-4\}, fp16 precision, and gradient accumulation of 4 steps\. Decoding is greedy with temperature 0 and a maximum of 512 new tokens\.

The regex baseline uses keyword scoring for the 15 constraint types, a curated chemical\-name dictionary for substance extraction, template rules for task tags, and template instantiation for predicates\. It has no learned component\.

## Appendix IFuture Predicate Evaluation Protocols

Current token\-level metrics do not fully capture executable semantic equivalence\. Future evaluations should compare predicates after normalization or by execution\.

### I\.1Canonical AST Exact Match

Predicates can be normalized before comparison\.

- •Reorder commutative operands:\[HCl,H2​SO4\]≡\[H2​SO4,HCl\]\[\\mathrm\{HCl\},\\mathrm\{H\_\{2\}SO\_\{4\}\}\]\\equiv\[\\mathrm\{H\_\{2\}SO\_\{4\}\},\\mathrm\{HCl\}\]
- •Normalize comparison direction:temp\>80≡80<temp\\textit\{temp\}\>80\\equiv 80<\\textit\{temp\}
- •Standardize variable names:temperature​\(beaker\)≡temp​\(container\)\\mathrm\{temperature\}\(\\mathrm\{beaker\}\)\\equiv\\mathrm\{temp\}\(\\mathrm\{container\}\)

### I\.2Executable Equivalence Testing

Synthetic states can be used to compare predicate truth values\.

```
states = generate_test_states(
    rule_context)
for state in states:
    assert (eval(gold_pred, state)
        == eval(pred_pred, state))
```

### I\.3Slot\-Level Recovery

Slot\-level recovery can separately measure substances, numeric thresholds, operators, scope tags, and directionality\. This would show which predicate fields cause grounding failures\.