When and How Severely: Scenario-Specific Safety Envelopes for Driving VLAs
For safety certification of autonomous driving systems, the paper shows that current aggregate safety thresholds are insufficient and a scenario-specific two-dimensional envelope is needed.
The paper evaluates Alpamayo R1, a 10B-parameter driving VLA, on 15,968 (clip, attack) pairs and finds that a single aggregate safe threshold (e.g., σ≤50 under 15% ADE) masks scenario-specific variation: some scenarios tolerate σ=70, while STOP_SIGNAL has 4× the high-severity (C4/C5) share of LANE_KEEPING despite tolerating larger σ. The authors propose a two-dimensional safety envelope for SOTIF ODD specification.
Safety certification of Vision-Language-Action (VLA) driving planners under ISO 21448 (SOTIF) rests on an Operational Design Domain (ODD) specification that answers two complementary questions: when does the planner start to fail, and how severely does it fail once it does? We evaluate Alpamayo R1, a 10B-parameter open-weight driving VLA, on 15,968 (clip, attack) pairs. We find a conservative-aggregate gap: an aggregate safe threshold of $σ\leq 50$ under a 15% average displacement error (ADE) budget masks well-sampled scenarios that tolerate the top of the tested grid ($σ= 70$). A Gaussian Mixture Model (GMM) on the changed-explanation subset identifies six discrete severity bands (BIC-optimal $k{=}6$), so two perturbation conditions with the same mean error can differ materially in their share of high-severity (C4/C5) failures. Joining the two analyses on the same corpus surfaces a finding neither yields in isolation: the scenarios with the loosest noise thresholds are not those with the lowest high-severity rate: STOP_SIGNAL concentrates roughly $4\times$ the C4/C5 share of LANE_KEEPING despite tolerating a larger $σ$. A deployable SOTIF ODD specification for driving VLAs therefore requires a two-dimensional safety envelope, not a single aggregate value per hazard.