What Would Removing This Corruption Change? Failure Attribution for Vision-Language-Action Models

Abstract

Vision-language-action (VLA) models are sensitive to visual corruptions, but knowing that a corruption is typically harmful does not establish whether removing it would benefit the current episode. Furthermore, when several corruptions co-occur, deciding what to correct requires understanding which ones contribute to failure risk and how much their removal would help. We define this problem as failure attribution. Detecting corruption presence alone cannot answer this question, as corruptions can be present but relatively harmless, while directly measuring removal benefits requires costly paired policy rollouts with and without the corruption present. To address this, we introduce a factorized risk model that learns separate representations of the scene and corruptions, allowing us to estimate removal benefits through latent intervention from the current image and task instruction, without paired clean images or additional counterfactual rollouts. We evaluate our approach on OpenVLA and \pi_{0.5} in simulation and \pi_{0.5}-DROID on a Franka robot. Our method outperforms monolithic and vision-language-model (VLM) baselines, including achieving approximately 3x lower attribution error than frontier VLMs. We also demonstrate our method adapts to execution context and corruption intensity, and can be used for online failure monitoring on hardware.

†

I Introduction

Vision-Language-Action (VLA) models [1, 2, 3] have emerged as generalist robotic policies capable of performing manipulation tasks directly from images and natural language instructions. However, their reliance on visual input makes them sensitive to visual corruptions [4]. For example, viewpoint changes and sensor noise have considerable impact on OpenVLA’s performance, reducing success rate from 76.5% to 1.1% and 19.3%, respectively [4]. These effects motivate knowing how each corruption influences a policy during execution. A straightforward approach is to estimate average failure rates for each corruption combination based on historical data. However, these averages assign the same prediction to episodes with the same corruption combination, regardless of corruption intensity or the current scene context. Knowing that a corruption is harmful on average therefore does not establish whether removing it would reduce failure risk in the current episode.

When several corruptions co-occur, this problem is compounded: we need to determine which corruptions contribute to the current failure risk and which would offer the greatest benefit if removed. We call this failure attribution: quantifying each corruption’s contribution by asking, “How much would failure risk decrease if this corruption were removed?” Answering this question can guide whether and how to correct an execution failure.

However, failure attribution presents two challenges. First, corruption presence alone does not establish its effect on performance. A corruption may be clearly visible yet have little impact on a particular policy, so detecting it does not indicate whether correcting it would help. Prior works address neighboring problems, including improving robustness through corruption-inclusive training [4, 5] or input restoration [6], and predicting failure through online monitoring [7, 8, 9, 10]. However, these approaches do not directly answer the attribution question of how much removing each corruption would reduce failure risk.

Second, directly measuring this removal benefit requires intervention: executing the policy repeatedly with and without each corruption from the same underlying state. Because a corruption’s effect depends on which others remain present, exhaustively characterizing these interactions requires covering a large majority of combinations, rather than just single corruptions. Such comparisons are expensive in simulation and difficult to reproduce during deployment, where repeated failed executions can also put hardware at risk. We therefore seek to estimate removal effects from the available observation, without executing these counterfactual rollouts.

To address these challenges, we introduce a factorized risk model that estimates each corruption’s contribution to failure risk from the current image and task instruction alone. The model learns separate latent representations of the scene and corruptions. By intervening on the corruption latent while holding the scene latent fixed, it estimates how failure risk would change if a corruption were removed (Figure 3), without modifying the physical scene or rerunning the policy.

We evaluate the model on OpenVLA and \pi_{0.5} in simulation and \pi_{0.5}-DROID on hardware. Our experiments validate that our approach accurately estimates per-corruption attributions, captures interactions between co-occurring corruptions, and learns sensitivity to scene context and corruption intensity. Under co-occurring corruptions, it achieves approximately 3x lower attribution error than frontier VLMs. Hardware experiments demonstrate our approach can be used for online monitoring () as corruptions change during an episode. In summary, we:

1. Formulate failure attribution for VLA models as estimating the reduction in failure risk from removing individual visual corruptions.
2. Introduce a factorized risk model that estimates these removal effects through latent interventions, using only the current image and task instruction.
3. Evaluate the method on OpenVLA and \pi_{0.5} in simulation and \pi_{0.5}-DROID on hardware, demonstrating attribution under co-occurring corruptions, sensitivity to execution context and corruption intensity, and online failure monitoring.

II Related Work

Robustness Analysis

Prior works evaluate VLA robustness to visual and environmental disturbances through benchmarks such as LIBERO-Plus [4] and The Colosseum [11], as well as adversarial attacks [12]. Other approaches improve robustness through corruption-aware training [4, 5] or input restoration [6]. These works characterize or mitigate aggregate sensitivity, but do not attribute an observed failure to the responsible corruption, which is the gap this work addresses.

Failure Detection and Uncertainty Quantification

Online failure monitors use internal policy representations [7, 8], action consistency [9], failure-free training [10], out-of-distribution detection [13], or conformal prediction [14]. VLM-based methods provide post-hoc failure explanations [15, 16], while image-region attribution links reliance on nuisance features to poor performance [17]. These approaches predict whether failure is likely or identify generic visual cues, but do not quantify the counterfactual effect of removing a specific corruption. Our factorized latent model estimates this effect without paired counterfactual trajectories.

III Problem Statement

We consider a VLA policy that is rolled out for an episode of maximum length T. At step t\in\{0,\dots,T-1\}, the policy receives observation o_{t}=(\phi_{t},q_{t}) consisting of a camera image \phi_{t} and robot state q_{t}, along with an episode-wide task instruction \ell. The episode outcome provides a binary failure indicator y\in\{0,1\}, denoting whether the policy failed to complete the task within the allotted T steps, with y=1 indicating failure.

We consider K known visual corruption types, and let c_{t}\in\{0,1\}^{K} indicate which are present in \phi_{t}. We assume access to a dataset of N labeled episodes for this information, \mathcal{D}=\left\{\left(\{\phi_{t}^{(i)}\}_{t=0}^{T_{i}-1},\ell^{(i)},c^{(i)},y^{(i)}\right)\right\}_{i=1}^{N}. In this dataset, corruptions remain fixed within each episode, so we use c_{t}^{(i)}=c^{(i)}. We model the observed image as the corrupted version of a clean image \phi_{t}=\mathcal{T}(\phi_{t}^{\mathrm{clean}};c_{t}), where \phi_{t}^{\mathrm{clean}} is an unobserved clean image. Let s_{t}\coloneqq(\phi_{t}^{\mathrm{clean}},\ell) denote the corruption-free visual scene and task instruction. We define risk as r(c_{t};s_{t})\coloneqq P(y=1\mid c_{t},s_{t}), the probability of failure given this context and the corruption vector.

Our objective is to identify the present corruptions and estimate how much failure risk would decrease if each were removed while holding the scene, instruction, and remaining corruptions fixed. Let c_{t}^{\setminus k} denote c_{t} with its k-th entry set to zero. Then, we define the attribution to corruption k as the reduction in failure risk from removing it:

\Delta_{k}(c_{t};s_{t})=r(c_{t};s_{t})-r(c_{t}^{\setminus k};s_{t}).

Larger \Delta_{k} indicates greater removal benefit, with \Delta_{k}\approx r(c_{t};s_{t}) meaning that removing corruption k nearly eliminates the risk. Estimating \Delta_{k} is non-trivial, as it requires comparing risks with and without k while holding the scene fixed. However, deployment provides neither the clean scene nor corruption labels. We mitigate the need for paired counterfactual episodes using latent representations for corruptions and predicting r(c_{t};s_{t}), as we discuss next.

IV Methodology

To estimate attributions without paired counterfactuals, we learn separate representations of the scene (z_{s}) and corruptions (z_{c}), standing in for s_{t} and c_{t}, together with a failure predictor \hat{r}(z_{c};z_{s}) that approximates r(c_{t};s_{t}).

We approximate removal of corruption k through a latent intervention: zeroing the corresponding portion of z_{c}, yielding z_{c}^{\setminus k}. Holding z_{s} fixed, we estimate the per-corruption attribution as

\hat{\Delta}_{k}(\phi_{t},\ell)=\operatorname{ReLU}\!\left(\hat{r}(z_{c};z_{s})-\hat{r}(z_{c}^{\setminus k};z_{s})\right),

where the ReLU restricts the reported attribution to positive risk reductions. This replaces a comparison requiring an unobserved clean scene and an explicit corruption vector with a latent intervention. For this estimate to be meaningful, the representations must support interpreting a zeroed portion of z_{c} as corruption absence while preserving the underlying scene information in z_{s}. We next describe how these representations are constructed (Section IV-A) and how our training objectives encourage this alignment (Section IV-B). Figure 3 summarizes all the main components of our pipeline.

IV-A Encoding Scene and Corruption Information

A frozen text and image encoder maps the image and task instruction to features x_{t}=f(\phi_{t},\ell)\in\mathbb{R}^{D}. Separate encoders construct the scene and corruption representations. The scene encoder E_{s} receives projected features \tilde{x}_{t}, obtained from a fixed linear projection designed to remove linearly decodable corruption information (Section IV-B), and produces z_{s}=E_{s}(\tilde{x}_{t})\in\mathbb{R}^{d_{s}}. A corruption encoder E_{c} takes the original features x_{t} and outputs z_{c}=E_{c}(x_{t})\in\mathbb{R}^{Kd_{c}}. We use SigLIP encoder [18] for our experimental analysis but also report an ablation on an alternative model-based encoder in Section VI-E.

We partition z_{c} into K blocks, one per corruption type, z_{c}=(z_{c}^{(1)},\dots,z_{c}^{(K)}), with z_{c}^{(k)}\in\mathbb{R}^{d_{c}}. Each block has a linear presence head that estimates the corresponding corruption’s presence probability \hat{\rho}_{k}(\phi_{t},\ell)=\sigma\!\big(w_{k}^{\top}z_{c}^{(k)}+b_{k}\big). Although corruption labels remain fixed within each training episode, presence is predicted independently for each frame and can therefore vary during execution, as demonstrated in . A shared failure head takes both representations and outputs the estimated risk \hat{r}(z_{c};z_{s}).

The factorized model with separate encoders for scene and corruption, and compartmentalization of z_{c} by corruption type alleviates the need for pairwise counterfactual rollouts, and allows us to easily estimate Equation 2. The latent intervention in Equation 2 sets z_{c}^{(k)} to zero while leaving all other blocks and z_{s} unchanged. All K attribution estimates reuse the same representations, requiring only one encoding pass and K+1 failure-head evaluations.

IV-B Training Objectives for Disentangled Representations

The architecture alone does not ensure that latent interventions correspond to corruption removal. Each corruption block must encode its designated corruption, with z_{c}^{(k)}=0 representing its absence. Meanwhile, corruption information retained in z_{s} could allow the failure head to bypass z_{c}, weakening or suppressing the estimated attributions. We therefore combine objectives that enforce the structure of z_{c}, reduce corruption leakage into z_{s}, and train risk predictions before and after latent intervention.

Using the dataset \mathcal{D}, we jointly optimize the scene encoder E_{s}, corruption encoder E_{c}, presence heads, and failure head with the objectives below (also shown in Figure 3). The feature encoder and fitted projection remain fixed.

Presence loss

A binary cross-entropy loss between the estimated presence probabilities and presence labels

\mathcal{L}_{\mathrm{pres}}=\frac{1}{K}\sum_{k=1}^{K}\mathrm{BCE}\big(\hat{\rho}_{k},\,c_{t,k}\big),

where \mathrm{BCE}(p,q)\coloneqq-\,q\log p-(1-q)\log(1-p), binds block k to corruption k, so that z_{c} carries the information needed to recover the present corruptions.

Anchor loss

An anchor loss enforces that each block z_{c}^{(k)} goes to zero when corruption k is absent,

\mathcal{L}_{\mathrm{anch}}=\frac{1}{K}\sum_{k=1}^{K}\mathbb{E}\!\left[\,\big\|z_{c}^{(k)}\big\|_{2}^{2}\;\middle|\;c_{t,k}=0\,\right],

where the expectation is the average over training samples with c_{t,k}=0. This loss encourages zero to represent corruption absence, providing the reference value used by the latent intervention.

Nullspace projection

To remove linearly decodable corruption information from the scene branch, we fit an iterative null-space projection (INLP) [19] on the frozen SigLIP features x_{t}. Linear probes predicting c_{t} from x_{t} are trained and projected out iteratively until corruption information is no longer linearly decodable. The projected features \tilde{x}_{t} are passed to E_{s}, while x_{t} is directly passed to E_{c}.

Adversarial loss

To further discourage z_{s} from carrying information about c_{t}, we perform adversarial training. Let b_{t}=\mathbf{1}\{\sum_{k=1}^{K}c_{t,k}>0\} indicate whether any corruption is present. An adversarial discriminator D (a small MLP) is trained to predict b_{t} from z_{s} by minimizing \mathcal{L}_{D}=\mathrm{BCE}\big(D(z_{s}),\,b_{t}\big). The scene encoder is then trained against D with a confusion loss that drives its prediction to chance,

\mathcal{L}_{\mathrm{adv}}=\mathrm{BCE}\big(D(z_{s}),\tfrac{1}{2}\big).

The uniform target encourages the discriminator’s output toward \frac{1}{2}. Together with INLP, this objective discourages the scene representation from retaining corruption information that could bypass the intervention on z_{c}.

Failure loss

We jointly train the failure head and both encoders with a binary cross-entropy loss between the estimated risk and episode outcome, applied at every frame with the episode-wide label y:

\mathcal{L}_{\mathrm{fail}}=\mathrm{BCE}\big(\hat{r}(z_{c};z_{s}),\,y\big).

This loss is back-propagated to train both encoders and the failure head jointly.

Counterfactual consistency loss

We encourage post-intervention risk predictions to agree, on average, with predictions for observations in which the corresponding corruption is absent. For each corruption configuration c represented in the minibatch and each k with c_{k}=1, we compare the mean risk after intervening on corruption block k with the mean risk under c^{\setminus k}, provided that both combinations occur in the batch:

\mathcal{L}_{\mathrm{cons}}=\frac{1}{|\mathcal{P}|}\sum_{(c,k)\in\mathcal{P}}\left(\bar{r}_{c}^{\setminus k}-\operatorname{sg}\!\left[\bar{r}_{c^{\setminus k}}\right]\right)^{2}.

Here, \mathcal{P} is the set of valid combination-removal pairs (c,k) described above. Then, \bar{r}_{c}^{\setminus k} is the mean post-intervention risk for observations with corruption vector c, and \bar{r}_{c^{\setminus k}} is the mean risk without latent intervention for observations with corruption vector c^{\setminus k}. Both means are computed within the minibatch, and \operatorname{sg} stops gradients through the target.

The full training objective is then

\displaystyle\mathcal{L} \\ \displaystyle=\mathcal{L}_{\mathrm{fail}}+\lambda_{\mathrm{pres}}\mathcal{L}_{\mathrm{pres}}+\lambda_{\mathrm{anch}}\mathcal{L}_{\mathrm{anch}} \\ \displaystyle+\lambda_{\mathrm{adv}}\mathcal{L}_{\mathrm{adv}}+\lambda_{\mathrm{cons}}\mathcal{L}_{\mathrm{cons}}.

The discriminator D is updated separately using \mathcal{L}_{D} in alternation with the encoder and prediction-head updates. Together, these objectives train failure prediction and encourage the representation structure needed for latent interventions to approximate corruption removal. We evaluate their individual contributions in Section VI-D.

V Experiments

The central hypothesis of this paper is that attributing VLA failures to visual corruptions requires separating corruption from scene information, and that this factorization generalizes across policies, co-occurring corruptions, and hardware. We evaluate OpenVLA [1] and \pi_{0.5} [3] in simulation in the LIBERO [20] environment and pick-and-place tasks on a Franka robot using a DROID-fine-tuned \pi_{0.5} policy [21]. We compare against a monolithic presence-and-failure predictor, post-hoc VLM attribution, and a variant using internal policy features (SAFE [7]), and ablate the training objectives. We discuss the key results in Section VI, where we investigate whether corruption detection alone is sufficient for failure attribution, contribution of various components of our approach, and whether our attribution scheme captures co-occurring corruptions and learns different intensities of the same corruption. We also analyze how well the method transfers to hardware and online monitoring.

V-A Experimental Setup

V-A1 Simulation

We evaluate on the 10 LIBERO-Object tasks [20] (Figure 6, left) with six corruption categories from LIBERO-Plus [4]: light, table, view, object-add, Gaussian blur, and fog. We ran experiments on nominal images, all six individual corruptions, and 17 co-occurrence conditions: all 15 pairwise combinations, as well as two three-way combinations (fog and Gaussian blur, each with object-add and table). Episodes run for at most 280 steps. For each VLA, the dataset contains 2,500 episodes with 200 nominal and 100 per single- or multi-corruption condition.

V-A2 Hardware

We evaluate the \pi_{0.5}-DROID policy [3] on the DROID hardware platform [21] (Figure 6, right) on a Franka Emika Panda with a Robotiq 2F-85 gripper1. The task is “put the cube in the bowl” under four corruptions: physically reduced lighting and a distractor object, and synthetic Gaussian blur and fog applied to both camera streams. We test nominal and individual-corruption conditions, plus co-occurring blur and fog. Episodes are manually terminated and labeled as failures when the policy ceases making progress or risks collision. The dataset contains 150 episodes, with 25 per condition. The attribution model is trained solely on hardware episodes, whose corruption intensities differ from simulation.

V-A3 Evaluation Procedure

Within our datasets, we perform a 60/20/20 train/validation/test split on the episode level. Each episode is downsampled to 12 frames to reduce computational cost and give equal weight to episodes of different lengths. We retain the first frame, last frame, and ten evenly spaced middle frames. All metrics are reported as mean \pm standard deviation over five seeds. For attribution, the evaluation target is the empirical per-corruption attribution,

\bar{\Delta}_{k}(c)=\hat{P}(y=1\mid c)-\hat{P}(y=1\mid c^{\setminus k}),

where \hat{P}(y=1\mid c) is the empirical failure rate over test episodes under configuration c. For hardware, empirical attribution targets use all collected episodes, while predictions are evaluated on held-out episodes. We clip the resulting difference at zero, consistent with Equation 2. In simulation, rates are pooled across all 10 tasks and initial states. The resulting \bar{\Delta}_{k} serves as the configuration-level evaluation target for attribution, but does not cover variation in attribution across individual scenes.

We evaluate attribution on each held-out episode’s initial observation. We report attribution mean absolute error MAE, |\hat{\Delta}_{k}-\bar{\Delta}_{k}(c)|, over present corruptions, separately for single- and multi-corruption episodes. For multi-corruption failures, regret is reported, \bar{\Delta}_{k^{\ast}}(c)-\bar{\Delta}_{\hat{k}}(c), for \hat{k}=\arg\max_{k}\hat{\Delta}_{k}, and measures the cost of selecting \hat{k} instead of the optimal k^{\ast}. The predicted ranking used for regret is computed from pre-ReLU risk differences. Presence accuracy is averaged over corruptions at \hat{\rho}_{k}>0.5. VLM baselines are evaluated on the same observations, with their 0–10 responsibility scores rescaled to [0,1] as \hat{\Delta}.

We also evaluate single-frame failure prediction at different episode positions using ROC-AUC between predicted risk \hat{r} and the episode outcome y. At each position, nominal and corrupted test episodes are evaluated separately. ROC-AUC is computed for each training seed and reported as mean \pm standard deviation.

V-A4 Training Details

We use the AdamW [22] optimizer with learning rate 2\times 10^{-3} and weight decay 10^{-4}. The failure head also has a small L_{2} penalty (10^{-3}) on its weights, which regularizes the head early in training. We train for 200 epochs with batch size 256 over 5 seeds. The attributor is a two-latent MLP over 1161-d SigLIP image-and-text features (1152-d image features concatenated with a 9-d PCA projection of the task embedding), with a 32-d scene latent z_{s}, a corruption latent z_{c} of K four-dimensional blocks, and presence/failure/adversary heads of hidden width 128. The loss-term weights are \lambda_{\mathrm{pres}}=1, \lambda_{\mathrm{anch}}=0.1, \lambda_{\mathrm{cons}}=3, and \lambda_{\mathrm{adv}} ramped linearly from 0 to 20 over the first 40 epochs. The loss weights balance the prediction and representation objectives. We selected them through individual sweeps using OpenVLA validation metrics and used the same weights for both simulation policies and the hardware experiments.

V-A5 Baselines

We compare against a monolithic, non-factorized baseline, Monolithic, that first predicts corruption logits from SigLIP features x_{t} and subsequently predicts failure using x_{t} and the corruption logits. We also evaluate few-shot attribution with VLM (Terra), VLM (Sol), and VLM (Opus 5) (GPT-5.6 Terra, GPT-5.6 Sol, and Claude Opus 5, respectively). Each VLM receives the query frame, one successful and one failed example per corruption, and a nominal pair, then identifies present corruptions and assigns each a 0–10 responsibility score. Finally, Ours (SAFE) replaces the SigLIP input of our full method, Ours (SigLIP), with internal policy features extracted following [7], holding the remaining architecture and training procedure fixed.

We include an Oracle reference using ground-truth corruption labels and empirical failure rates for each corruption combination. It computes attributions as the clipped risk reduction from removing each corruption. Since these rates also define the empirical attribution targets, it achieves zero MAE and regret by construction. The oracle reveals whether our model captures execution context and corruption intensity beyond combination-level average failure rates.

VI Results

Below we discuss the key results from our experimental analysis using several research questions.

VI-A Is corruption detection sufficient for failure attribution?

We first ask whether accurate corruption detection is sufficient for failure attribution. Corruption presence is easy to predict; our model achieves 99.4\% and 99.3\% accuracy on OpenVLA and \pi_{0.5} in simulation, respectively, while the monolithic and stronger VLM baselines exceed 90\%. However, accurate detection does not ensure accurate estimates of a corruption’s effect on policy performance.

As shown in Table I, our method achieves lower single- and multi-corruption attribution MAE than the monolithic and VLM baselines. Ours (SigLIP) obtains single-/multi-corruption MAE of 0.095/0.101 for OpenVLA and 0.019/0.064 for \pi_{0.5}.

Despite high presence accuracy, the VLMs’ policy-agnostic scores yield substantially higher MAE and regret, showing that detecting degradation is not the same as estimating its policy-specific effect. Figure 4 visualizes the difference between predicted and empirical per-corruption attribution across corruption conditions: our per-condition estimates track the empirical attributions closely (MAE 0.09 and 0.05 for OpenVLA and \pi_{0.5}), while the VLM’s scores are poorly calibrated with them (MAE 0.30 and 0.32).

VI-B Does our proposed attribution scheme capture co-occurring corruptions and their interactions?

Table I shows that our method remains accurate under co-occurring corruptions, with multi-corruption MAE remaining low (0.101 for OpenVLA and 0.064 for \pi_{0.5}). It also achieves the lowest regret on both policies: 0.011 versus 0.098 for the strongest VLM on OpenVLA, and 0.005 versus 0.026 on \pi_{0.5}. Thus, our selected corrections have a small average loss in removal benefit.

Our method also captures interactions because the failure head jointly models the full corruption latent z_{c}. As Figure 5 shows, OpenVLA exhibits strong non-additivity when either corruption alone can cause failure. For light+view, removing either alone has little effect (light: 0.04, view: 0.19), whereas removing both reduces risk by 0.86, close to the empirical 0.85. Conversely, pairs involving the largely inert object-add show no compounding effect. In contrast, \pi_{0.5}, which is primarily sensitive to blur, exhibits mostly additive interactions. Thus, the model recovers policy-specific interaction structure rather than imposing it.

VI-C Does the model capture variations in failure risk and attribution beyond corruption presence?

We evaluate whether the model captures execution context and corruption intensity beyond corruption presence alone. Because the Oracle assigns identical predictions to all observations of a given corruption combination, any per-episode or per-intensity variation our model recovers reflects information beyond configuration-level rates.

First, Table II reports failure-prediction ROC-AUC at different episode positions within held-out OpenVLA episodes. On nominal episodes the Oracle is at chance (0.500), while our model rises from 0.510 at the initial frame to 0.723 at the final frame; on corrupted episodes it ranges from 0.917 to 0.932, exceeding the Oracle’s 0.862 everywhere. Discrimination strengthens later in the episode, as the image gives clearer evidence of the outcome.

For intensity, we evaluate the same trained model on six ordered fog levels (five unseen in training, spanning within and beyond the training range) applied to matched held-out scenes. Since fog presence is unchanged across the sweep, the Oracle is constant, whereas our fog attribution varies with intensity (Figure 7), capturing variation the Oracle cannot express. Together, these show the model conditions on execution context and intensity, not just corruption presence.

VI-D How do various components enable accurate counterfactuals?

The Monolithic baseline in Table I illustrates the bypass problem motivating our factorization: the failure head can use corruption information already present in SigLIP features without relying on the explicit corruption logits, eliminating the ability for counterfactual intervention. Our model instead encourages corruption information to pass through z_{c}. Ablations on the loss terms on OpenVLA (Table III) show that removing presence loss (\mathcal{L}_{\mathrm{pres}}) reduces detection from 99.4\% to 49.3\% and raises single-corruption MAE to 0.370. Removing counterfactual consistency loss (\mathcal{L}_{\mathrm{cons}}) increases MAE (0.092 to 0.132) and increases regret (0.010 to 0.016), confirming its role in aligning masked predictions with corruption-absent observations. Removing the anchor loss (\mathcal{L}_{\mathrm{anch}}) leaves MAE largely unchanged (0.092 to 0.089) but sharply increases the absent-block norm from 0.31 to 30.3 and regret to 0.040, showing that zero no longer represents absence reliably.

The adversarial loss (\mathcal{L}_{\mathrm{adv}}) and INLP primarily prevent corruption leakage through z_{s}. Removing either increases probe AUC from 75.1 to 99.8 or 82.6, respectively, with limited effect on MAE. Thus, consistency and anchoring ensure accurate counterfactuals, while adversarial training and INLP preserve latent disentanglement.

VI-E Are input representations or internal policy features more effective for attribution?

We compare SigLIP image-and-text features with internal policy features extracted following SAFE [7], using the same attribution framework. SigLIP matches or improves on internal features across the board (Table I). For OpenVLA, SigLIP yields lower single-corruption MAE (0.095 versus 0.104), lower multi-corruption MAE (0.101 versus 0.117), and lower regret (0.011 versus 0.029). The same holds for \pi_{0.5}: 0.019/0.064 MAE with SigLIP versus 0.048/0.075 with internal features, and lower regret (0.005 versus 0.028).

SigLIP yields the lowest error across both policies without requiring access to policy internals, enabling attribution for black-box policies. Its shared feature space also supports novel-corruption detection. We fit class-conditional Gaussians with shared covariance over the SigLIP features and score each frame by its Mahalanobis distance [23] to the nearest class. In a leave-one-corruption-out evaluation, this separates the held-out novel corruption from in-distribution frames with mean AUROC 0.88.

VI-F Does the method transfer to hardware and online monitoring?

We evaluate on the DROID hardware platform [21] using the pretrained \pi_{0.5}-DROID checkpoint and an attribution model trained only on hardware episodes. As shown in Table IV, predicted attributions are 0.96, 0.56, 0.27, and 0.03 for light, fog, blur, and object-add, respectively, compared with empirical attributions of 0.96, 0.56, 0.24, and 0.04. The model identifies near-darkness as most damaging and object-add as nearly harmless. The VLM assigns object-add a substantially larger score (0.35). The model supports online monitoring: \hat{r} signals early-stopping, while \hat{\Delta}_{k} identifies the responsible corruptions. In , \hat{r} remains low for a distractor, increases with blur and fog, and approaches 1.00 for near-darkness. Thus, the model tracks corruption contributions online and can halt execution before failure.

VII Discussion and Conclusion

In this work, we introduced a counterfactual method for attributing VLA failures to visual corruptions. By disentangling scene and corruption latents and jointly predicting failure from both, we estimate each corruption’s attribution, \hat{\Delta}_{k}, from a single observation without clean-image pairs or additional rollouts. Experiments with OpenVLA and \pi_{0.5} in LIBERO and \pi_{0.5}-DROID on hardware show that detection alone is insufficient for attribution: VLM baselines rely on policy-agnostic visual priors, whereas our estimates recover policy-specific attribution rankings, capture interactions among co-occurring corruptions, and support online hardware monitoring.

Our method is limited to known corruptions with training-time presence labels. Future work could extend attribution to unseen corruptions and collect larger datasets for task- and state-specific analysis. Integrating attribution with automated recovery is another promising direction for preventing deployment failures.

References

1. [1] M. J. Kim, K. Pertsch, S. Karamcheti, T. Xiao, A. Balakrishna, S. Nair, et al. (2024) OpenVLA: an open-source vision-language-action model. In Conference on Robot Learning (CoRL),
2. [2] K. Black, N. Brown, D. Driess, A. Esmail, M. Equi, C. Finn, et al. (2024) \pi_{0}: A vision-language-action flow model for general robot control. arXiv preprint arXiv:2410.24164.
3. [3] Physical Intelligence, K. Black, N. Brown, J. Darpinian, K. Dhabalia, D. Driess, et al. (2025) \pi_{0.5}: A vision-language-action model with open-world generalization. arXiv preprint arXiv:2504.16054.
4. [4] S. Fei, S. Wang, J. Shi, Z. Dai, J. Cai, P. Qian, et al. (2026) LIBERO-Plus: a progressive robustness benchmark for visual-language-action models. In Conference on Computer Vision and Pattern Recognition (CVPR),
5. [5] Y. Xie, Y. Yan, Y. Zhao, H. Wang, and Y. Jin (2026) STRONG-VLA: decoupled robustness learning for vision-language-action models under multimodal perturbations. arXiv preprint arXiv:2604.10055.
6. [6] D. Y. G. Orjuela, L. Scappatura, V. D. Gennaro, R. A. Izzo, G. Bardaro, and M. Matteucci (2026) Improving robustness of vision-language-action models by restoring corrupted visual inputs. arXiv preprint arXiv:2602.01158.
7. [7] Q. Gu, Y. Ju, S. Sun, I. Gilitschenski, H. Nishimura, M. Itkina, and F. Shkurti (2025) SAFE: multitask failure detection for vision-language-action models. In Advances in Neural Information Processing Systems (NeurIPS),
8. [8] W. Li, X. Su, D. Niu, Y. Cao, H. Xu, Z. Qu, et al. (2026) Sentinel-VLA: a metacognitive VLA model with active status monitoring for dynamic reasoning and error recovery. In International Conference on Machine Learning (ICML),
9. [9] C. Agia, R. Sinha, J. Yang, Z. Cao, R. Antonova, M. Pavone, and J. Bohg (2024) Unpacking failure modes of generative policies: runtime monitoring of consistency and progress. In Conference on Robot Learning (CoRL),
10. [10] C. Xu, T. K. Nguyen, E. Dixon, C. Rodriguez, P. Miller, R. Lee, et al. (2025) Can we detect failures without failure data? uncertainty-aware runtime failure detection for imitation learning policies. In Robotics: Science and Systems (RSS),
11. [11] W. Pumacay, I. Singh, J. Duan, R. Krishna, J. Thomason, and D. Fox (2024) THE COLOSSEUM: a benchmark for evaluating generalization for robotic manipulation. In Robotics: Science and Systems (RSS),
12. [12] T. Wang, C. Han, J. C. Liang, W. Yang, D. Liu, L. X. Zhang, et al. (2025) Exploring the adversarial vulnerabilities of vision-language-action models in robotics. In IEEE/CVF International Conference on Computer Vision (ICCV),
13. [13] R. Sinha, A. Sharma, S. Banerjee, T. Lew, R. Luo, S. M. Richards, et al. (2022) A system-level view on out-of-distribution data in robotics. arXiv preprint arXiv:2212.14020.
14. [14] A. Z. Ren, A. Dixit, A. Bodrova, S. Singh, S. Tu, N. Brown, et al. (2023) Robots that ask for help: uncertainty alignment for large language model planners. In Conference on Robot Learning (CoRL),
15. [15] Z. Liu, A. Bahety, and S. Song (2023) REFLECT: summarizing robot experiences for failure explanation and correction. In Conference on Robot Learning (CoRL),
16. [16] J. Duan, W. Pumacay, N. Kumar, Y. R. Wang, S. Tian, W. Yuan, et al. (2025) AHA: a vision-language-model for detecting and reasoning over failures in robotic manipulation. In International Conference on Learning Representations (ICLR),
17. [17] H. Zhang, M. Xu, A. Dhafer, S. Yue, H. Dong, and Z. D. Hao (2026) Embodied interpretability: linking causal understanding to generalization in vision-language-action models. In International Conference on Machine Learning (ICML),
18. [18] X. Zhai, B. Mustafa, A. Kolesnikov, and L. Beyer (2023) Sigmoid loss for language image pre-training. In IEEE/CVF International Conference on Computer Vision (ICCV),
19. [19] S. Ravfogel, Y. Elazar, H. Gonen, M. Twiton, and Y. Goldberg (2020) Null it out: guarding protected attributes by iterative nullspace projection. In Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics,
20. [20] B. Liu, Y. Zhu, C. Gao, Y. Feng, Q. Liu, Y. Zhu, and P. Stone (2023) LIBERO: benchmarking knowledge transfer for lifelong robot learning. In Advances in Neural Information Processing Systems (NeurIPS),
21. [21] A. Khazatsky, K. Pertsch, S. Nair, A. Balakrishna, S. Dasari, S. Karamcheti, et al. (2024) DROID: a large-scale in-the-wild robot manipulation dataset. In Robotics: Science and Systems (RSS),
22. [22] I. Loshchilov and F. Hutter (2019) Decoupled weight decay regularization. In International Conference on Learning Representations (ICLR),
23. [23] K. Lee, K. Lee, H. Lee, and J. Shin (2018) A simple unified framework for detecting out-of-distribution samples and adversarial attacks. In Advances in Neural Information Processing Systems (NeurIPS),