{"id":"111b0b9d-db59-4251-851a-8693544b57df","arxiv_id":"2607.07420","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":6,"one_line_summary":"Robot safety should treat \"may I start a social interaction at all\" as a separate authorization layer, implemented with staged non-verbal probes and a gate before any first word or reach.","lead":"A workshop paper argues that generalist robots need a third safety layer: deciding whether to take the first hard-to-undo social action at all, such as greeting someone on a phone, and demonstrates a probe–authorize–speak gating loop on a doorway humanoid. A generalist reader might care because a robot's first word or grasp is currently gated by engagement scores that confuse noticing someone with being allowed to address them.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Gate's probe evidence is drawn from the same ambiguous perception stack as e_t; without outcome measures, Fig. 2's delay may be just a delayed threshold, not authorization.","rationale":"The paper argues that engagement scores are ambiguous and that initiation authorization is a separate layer; the minimal condition for this to be more than relabeling is that the gate's extra condition (stage>=2) adds safety-relevant information not already in e_t. I could not find evidence for that in the text: Table III's cues overlap with the perception features in Step 1, Algorithm 1 does not define how 'stage' is updated, and the only demonstration is one replayed trace with no outcome labels. The paper's own open questions include the absence of an agreed 'too soon' metric, so Delta_init cannot carry the safety claim. This is a weakness in the empirical demonstration, not a logical contradiction; the conceptual layer could be valid. A matched-delay control in the proposed user study would settle whether the probes are the active ingredient. This partially aligns with the reader's weakest assumption but sharpens it: the issue is not only perception noise, but whether the stage variable is functionally independent and whether any outcome validates the delay. Since the reader already issued CONDITIONAL, my recommendation is UNCHANGED.","tokens_in":5986,"tokens_out":8175,"duration_ms":84531,"concrete_test":"Run the proposed Section III-B between-subjects doorway study (phone-call vs open-to-interaction scripts) with four conditions: PAS, direct-init, passive-wait, and a matched-delay control where speech is released only after a fixed 7-second delay with no staged probes. Measure the rate of first-word interruptions (e.g., first word while participant is on the phone) and Likert awkwardness. If PAS does not beat matched-delay on these outcomes, then the Fig. 2 delay is just delay, not authorization; if it does, the probe stage is the active safety ingredient.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The load-bearing condition for the central claim is that PAS's gate uses information beyond the engagement signal it criticizes. Algorithm 1 (lines 5–6) requires e_t >= tau(rho) and probe level >= 2, but Table III keys probe levels to 'brief eye contact,' 'sustained attention,' and 'stays nearby several seconds' — precisely the gaze/approach/dwell signals that Step 1 fuses into e_t (Section III-A). The paper gives no perception-error model and no ablation showing the stage variable is not statistically redundant with e_t history. Without that, Fig. 2's 3s-to-10s delay could be a hand-picked consequence of the stage>=2 rule, not evidence of a separate authorization layer. The paper's own Section IV-B admits 'we do not yet agree on how to score whether a robot spoke or acted too soon,' undercutting Delta_init as a safety metric; a larger or smaller margin at the first word is not outcome-validated. The conceptual contribution may be right, but the empirical content does not yet rule out 'delayed threshold with extra state' as an alternative explanation.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper argues that generalist-robot safety has a missing layer, 'initiation authorization': deciding whether the robot may take its first hard-to-undo social action (a greeting, a grasp, stepping into someone's space) while the situation is still ambiguous. It distinguishes this from physical safety and from social-interaction safety during ongoing contact, and positions it against post-plan VLA guardrails and preference alignment. The paper proposes PAS (probe–authorize–speak): low-cost nonverbal probes that never emit speech, an authorization gate with threshold τ(ρ) set by a deployer-tunable bold/conservative dial ρ, and a logged margin Δinit at the first word. It describes a 10 Hz implementation on a PAL Robotics ARI humanoid, shows one replayed doorway trace comparing PAS with a direct-threshold policy, and proposes a between-subjects three-condition user study with subjective endpoints and logged Δinit. The authors are explicit that the user study is proposed, not run, and Section IV-B candidly lists unresolved questions about metrics and standards.","tokens_in":6213,"tokens_out":3483,"duration_ms":39094,"significance":"If the conceptual claim survives scrutiny, the paper offers a useful reframing: a collision-free, aligned, high-engagement policy can still fail at the first hard-to-undo act. The proposed PAS layer is concrete and testable, and the notion of a deploy-time dial ρ for boldness/conservatism is practically relevant and avoids treating a fixed engagement threshold as universal. The authors deserve credit for honest scoping: they do not claim to have run a user study, they explicitly flag the absence of agreed metrics for 'acted too soon,' and they identify the boundary between initiation and foundation-model generation as an open problem. However, the paper's load-bearing empirical element is a single replayed trace with no outcome measures, no error model, and no ablation, and the current wording overstates what that trace proves. The contribution is best read as a position/framework paper with a preliminary illustration, not as an established safety result.","major_comments":[{"comment":"The sentence 'the delay reflects structural authorization rather than a change in the engagement signal' is not supported by the evidence shown. Figure 2 plots one logged e_t trace with no error bars, no statement of how the trace was selected, no outcome measures, and no sensitivity analysis over τ(ρ) or θ. Direct-init is presented with 'threshold = 0.50', apparently the same value as τ(ρ), but the relationship between θ and τ(ρ) is not defined. A single hand-picked trace cannot rule out the alternative that PAS is simply a delayed threshold. The claim should be softened to 'illustrative' unless multiple traces, a selection protocol, and ablations are provided.","section":"§III-A, Fig. 2"},{"comment":"The gate condition e_t ≥ τ(ρ) ∧ stage ≥ 2 is supposed to add evidence beyond the engagement score that the paper criticizes in §I. But Table III keys probe stages to 'brief eye contact', 'sustained attention', and 'stays nearby several seconds' — precisely the gaze, approach, and dwell cues that Step 1 fuses into e_t. The paper gives no perception-error model and no ablation showing that the probe-stage variable is not statistically redundant with e_t history. Without that, PAS may reduce to a delayed threshold with extra state, not a separate authorization layer. The authors should either add an ablation (e.g., compare e_t-only gating with e_t ∧ stage gating on several traces) or clearly frame the stage mechanism as a heuristic whose information independence remains to be established.","section":"§III-A, Algorithm 1 lines 5–6 and Table III"},{"comment":"Δinit is introduced as a safety-relevant margin and used to compare PAS and direct-init in Fig. 2, yet the paper itself states 'we do not yet agree on how to score whether a robot spoke or acted too soon.' Without evidence that Δinit correlates with user-reported awkwardness, interruption, or task success, a larger or smaller first-word margin is not an outcome-validated safety metric. The proposed study includes subjective endpoints, but the current text presents Δinit as if it measured authorization quality. Figure 2 should be explicitly labeled as a proposed logging format and an illustrative trace, pending validation.","section":"§IV-B(a) and Fig. 2"}],"minor_comments":[{"comment":"The 'passive-wait' condition is described as 'probes + gate with conservative ρ', but it is unclear how ρ differs from the default and why it is called 'passive' if it still uses probes. Please define the dial settings and clarify the intended contrast.","section":"§III-B, Table IV"},{"comment":"The caption and axes label both policies with 'threshold = 0.50', but (a) should be τ(ρ) and (b) should be θ. State explicitly whether θ and τ(ρ) take the same numeric value and whether that is required for a fair comparison.","section":"Fig. 2"},{"comment":"The input line 'frame, stage, ρ' treats 'stage' as an input, while the text describes probe level as a state that evolves with person cues. Clarify whether stage is maintained internally or passed in. Also, line 6 says 'a_t ← speak' but the surrounding text says 'the gate releases the first word'; make explicit that this is a one-shot first-word event, not a per-cycle speech action.","section":"§III-A, Algorithm 1"},{"comment":"There is a formatting artifact 'inRethinking What It Means to be Safe for Generalist Robots Workshopat' — missing spacing. Please correct in the final version.","section":"Abstract and running header"}],"recommendation":"major_revision","confidential_remarks":"This is essentially a workshop position paper, and the conceptual contribution is worth discussing. My recommendation of major revision is driven by the gap between the paper's strong mechanistic language ('the delay reflects structural authorization') and the evidence: one replay trace, no error model, no ablation, and an unvalidated metric. These are fixable within the manuscript's scope by reframing the empirical claims as illustrative and adding a concrete validation plan or preliminary ablation. The self-citations are not excessive and do not affect my assessment."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"You should know this one for the idea, not the data. The conceptual contribution is real: initiation authorization as a third safety layer, distinct from physical shields and post-plan guardrails, with a concrete protocol (PAS), a deploy-time dial (ρ), and a loggable margin (Δinit). That framing is genuinely new relative to the cited engagement and proactive-HRI literature, which mostly asks how to initiate, not whether to initiate at all. The paper is also honest: the user study is explicitly proposed, not run, and the contributions are carefully worded as a framework plus illustration.\n\nWhat it does well is scope. It maps the problem, distinguishes it from VLA guardrails and dialogue alignment, and gives a testable protocol. The three conditions in Table IV are sensible, and the open questions in §IV-B are the right ones. The writing is clear and the related work is on-target.\n\nThe soft spot is exactly what the stress-test flags. The gate condition is e_t ≥ τ(ρ) AND stage ≥ 2, but the probe stages are keyed to gaze, attention, and proximity cues — the same perception stack that produces e_t. There is no ablation showing that the stage variable is statistically or functionally independent of e_t history, and no perception-error model. So the 3-to-10 second delay in Fig. 2 could be a hand-picked consequence of requiring a coarser threshold, not evidence of a separate authorization layer. The paper's own claim that “the delay reflects structural authorization rather than a change in the engagement signal” is not supported by a single replayed trace with no outcome measures. That said, the paper never overclaims — it calls this an illustration — so the concern is about the strength of the evidence, not the integrity of the work.\n\nThe other real weakness is Δinit. The paper admits in §IV-B that “we do not yet agree on how to score whether a robot spoke or acted too soon.” If that is true, a margin at the first word is not yet a safety metric; it is just a logged quantity. That is fine as a proposal, but it undercuts the implied claim that PAS is safer on the trace.\n\nWho is this for? HRI safety people and anyone building social-robot deployment stacks. It is a workshop-level contribution, but a legitimate one. I would send it to peer review — the idea deserves referee time, and the authors have given a clear evaluation template. The right outcome would be a revised version that either frames Fig. 2 as an illustrative trace or adds the missing ablation and perception detail. I would not cite it yet, but I would point people to it as the clearest statement of the initiation-authorization problem I have seen.","headline":"A coherent, honestly scoped position paper that names a real gap in robot safety; the empirical illustration is thin, but the framework deserves a serious look.","tokens_in":6807,"tokens_out":1724,"would_cite":false,"duration_ms":19796,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Robots need a go-ahead before their first greeting, grasp, or step into someone's space—not just safe motion and aligned dialogue.","keywords":["initiation authorization","generalist-robot safety","human-robot interaction","engagement score","probe-authorize-speak","social safety","first-action gating","VLA guardrails"],"falsifier":"Run a scripted doorway trial with participants on phones, mid-conversation, and clearly open; compare PAS to direct-init. If PAS first-words occur as often or as early as direct-init for phone users, or if probe-stage detections misclassify phone use as sustained attention at similar rates, the claimed structural delay is not safer initiation.","tokens_in":1177,"feed_emoji":"🚦","tokens_out":1159,"duration_ms":35652,"temperature":0.7,"pith_summary":"This paper argues that generalist-robot safety is missing a distinct layer: initiation authorization, the decision of whether the robot may take its first hard-to-undo social action at all. It claims that today's stacks often treat a high engagement score or a confident vision-language-action rollout as permission to act, which can lead to mistimed greetings, uninvited reaches, or speaking to someone on a phone. The paper implements PAS (probe–authorize–speak), a gate that uses reversible nonverbal probes and a threshold before releasing the first word, and shows on a logged trace that this delays first speech from about three seconds to about ten seconds. If the claim holds, first acts become controllable, measurable, and tunable without retraining the underlying model stack.","feed_headline":"Robots need a go-ahead before their first greeting","feed_subtitle":"A new safety layer would stop a high engagement score from acting as consent to speak or reach.","key_machinery":"The load-bearing object is the PAS authorization gate (Algorithm 1): only the gate can trigger the robot's first word, and it does so only when e_t ≥ τ(ρ) and probe level ≥ 2. The probe module is structurally prevented from speaking, the threshold τ(ρ) is a deploy-time bold/conservative dial rather than a trained constant, and the system logs Δ_init = e_t − τ(ρ) at the first word. This gate is what turns initiation from a passive threshold into a separate, tweakable safety decision.","core_discovery":"The paper's central claim is that initiation authorization—whether the robot may start at all—is a third safety layer, separate from physical shields and post-plan VLA guardrails. It states that 'a collision-free, well-aligned, high-engagement policy can still open with the wrong first word.' The mechanism is PAS: staged probes that never emit speech, an authorization gate that releases the first word only when the engagement score e_t meets a venue-tuned threshold τ(ρ) and the probe level is at least 2, and a logged margin Δ_init at the moment of the first word. Replaying one logged doorway trace, the paper reports first speech at approximately 10 seconds under PAS versus approximately 3 se","pith_inferences":["The paper's advantage over direct-init depends on staged probe cues being detectable more reliably than the engagement score itself; since the probes reuse the same perception stack, the paper does not yet establish this.","A natural extension is to gate manipulation VLAs with a reversible 'reach probe' before allowing a grasp, which would test whether initiation authorization transfers beyond speech.","In multi-party scenes initiation authorization also becomes a selection problem—deciding whom to address is itself a safety decision.","If adopted, a minimal reporting standard could emerge: every first-act event should include Δ_init and whether the addressee was the intended person, making 'acting too soon' a checkable quantity."],"forward_implications":["First hard-to-undo acts become gateable, loggable, and tunable without retraining the VLA or dialogue stack.","Post-plan guardrails and preference alignment run too late: they check a plan already in motion, not whether the robot should start in the first place.","The margin at the first word (Δ_init) and the rate of wrong-person or wrong-time initiations become measurable safety endpoints.","A per-venue and per-user bold/conservative dial ρ could let the same stack act cautiously in a clinic and more readily at home.","The proposed three-condition doorway study would directly compare PAS, direct-init, and a conservative passive-wait policy on logged traces and user ratings."],"fun_headline_variants":["Before greeting, robots need explicit authorization","A third safety layer: should robots initiate at all?","PAS: probe, authorize, then speak—robots need consent","Robots need a go-ahead before first social action"],"cache_read_input_tokens":7936,"weakest_assumption_plain":"The gate's benefit rests on the assumption that staged probe cues—brief eye contact, sustained attention, staying nearby—can be read reliably from the same perception stack that already produces ambiguous engagement scores; if those cues are just as noisy, PAS only delays the same mistakes.","fun_headline_variants_meta":{"raw":{"variants":["Before greeting, robots need explicit authorization","A third safety layer: should robots initiate at all?","PAS: probe, authorize, then speak—robots need consent","Robots need a go-ahead before first social action"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000186,"raw_usage":{"total_tokens":1132,"prompt_tokens":686,"completion_tokens":446,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":430,"completion_tokens_details":{"reasoning_tokens":380}},"tokens_in":430,"tokens_out":446,"duration_ms":4110,"temperature":1.0,"reasoning_tokens":380,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-02T08:02:32.416283+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run a scripted doorway trial with participants on phones, mid-conversation, and clearly open; compare PAS to direct-init. If PAS first-words occur as often or as early as direct-init for phone users, or if probe-stage detections misclassify phone use as sustained attention at similar rates, the claimed structural delay is not safer initiation.","supporting_citations":[],"review_version":2}