REVIEW 4 major objections 5 minor 27 references
A recurrent probabilistic model trained only on simulation data detects safety-relevant out-of-distribution states in a 50 Hz humanoid controller, outperforming prior detectors at a fixed 0.5% episode-level false-positive rate and localizin
Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →
T0 review · deepseek-v4-flash
2026-08-03 05:38 UTC pith:QEAGP2I3
load-bearing objection A solid, re-implementable OOD monitor with a strong simulation study, undermined by mismatched hardware headline numbers and a calibration rule that doesn't deliver the advertised false-positive guarantee. the 4 major comments →
RAPT: Model-Predictive Out-of-Distribution Detection and Failure Diagnosis for Sim-to-Real Humanoid Deployment
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
Core claim
The central claim is that a probabilistic recurrent autoencoder trained only on nominal simulation trajectories, evaluated online via per-dimension Gaussian negative log-likelihood, can detect out-of-distribution states under extremely low false-positive budgets and also localize when and where execution departs from nominal behavior. The method treats reconstruction likelihood not as a binary anomaly flag but as a continuous calibrated measure of sim-to-real gap, adapted to the target domain by a brief calibration run that sets max-plus-k-sigma thresholds on both per-dimension and global mean NLL, plus a hyper-rectangle range gate. On four simulation tasks, the hybrid detector achieves the
What carries the argument
RAPT (Recurrent Anomaly Probabilistic Trajectory Model): a self-supervised recurrent probabilistic trajectory model. A residual MLP encoder maps each observation to a 256-dimensional latent, a GRU bridges temporal context, and a probabilistic decoder outputs a diagonal Gaussian over observations, trained by maximizing likelihood of nominal simulated data. The anomaly signal is per-dimension negative log-likelihood, calibrated with a max-plus-k-sigma rule (k=5 per dimension, k=3 on the global mean) during a brief real-domain calibration episode, and OR-combined with a deterministic bounding-box range gate. For diagnosis, integrated gradients through time on the NLL produce a spatio-temporal s
Load-bearing premise
The brief real-domain calibration episode is representative of all future nominal operation: the max-plus-k-sigma thresholds are derived from the maxima of those calibration residuals, and the sim-to-real gap is assumed to be mostly static and removable by this calibration.
What would settle it
Run the calibration phase on one surface (e.g., a foam mat) and deploy on a different but nominal surface (e.g., concrete) with the same policy; if the detector triggers a safety stop on many steps of purely nominal walking, the static-shift calibration assumption is refuted. Alternatively, use a second humanoid unit of the same model and see whether thresholds calibrated on one unit transfer to the other without false positives.
If this is right
- RAPT can serve as an online safety trigger for humanoid controllers: inference runs in 1.63 ms (within the 20 ms control budget), enabling safe stops, controlled falls, and recovery behaviors without modifying the underlying policy.
- Because likelihood is decomposed per dimension, RAPT indicates which sensors or joints deviate, narrowing debugging and enabling verification of sim-to-real consistency beyond success metrics.
- The calibration procedure removes static domain shift, so a simulation-trained detector transfers to hardware with acceptable false-positive rates after a brief nominal run.
- Zero-shot language-model diagnosis using only proprioceptive saliency reaches 75% top-1 accuracy, letting operators distinguish terrain, sensor, and actuator failure modes without retraining or hand-labeled data.
- The hybrid detector remains sensitive to anomalies that do not violate explicit state bounds, complementing the range gate and catching silent configuration errors such as under-tuned PD gains.
Where Pith is reading between the lines
- The brittle point is the calibration episode: the max-plus-k-sigma thresholds are maxima over a single nominal run. Stress-testing by calibrating on one surface and deploying on another nominal surface would reveal whether false positives stay at zero; the paper does not do this, so the transfer guarantee is narrower than stated.
- Because RAPT produces per-dimension NLL, the same signal could be used online for policy adaptation or as a feature for model-predictive safety filtering, not just as a binary trigger. The paper mentions policy switching as future work but does not demonstrate it.
- The hybrid gate is a logical OR, meaning the range detector's blind spots (anomalies within nominal bounds) are inherited; a learned fusion of the two signals might reduce false positives further while keeping sensitivity.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. RAPT is a self-supervised, 50 Hz deployment monitor for humanoid robots. It learns a recurrent probabilistic reconstruction model from nominal simulation data and detects OOD states using per-dimension NLL thresholds (max + kσ) plus a deterministic range gate. The paper further proposes a post-hoc diagnostic pipeline that combines BPTT-based temporal saliency with an LLM for semantic failure classification. The method is evaluated on four Isaac Lab tasks (4096 environments, 5 seeds, 15 OOD categories) against several baselines, and on a Unitree G1 in 27 real-world trials. The central claims are a 37% TPR improvement over the strongest baseline at 0.5% episode-level FPR in simulation, an 89% TPR across 78 hardware trials (abstract) or 75% recall on 24 anomalous trials (Table III), and 75% root-cause diagnosis accuracy on 16 real failures.
Significance. If the results hold, RAPT addresses a practically important gap: detecting sim-to-real silent failures at high control frequency with low false-positive rates, and providing interpretable failure feedback. The simulation protocol is a clear strength — 4096 parallel environments, 5 seeds, 15 OOD categories, and comparisons to four baselines on identical logs. The public release of code, datasets, and deployment code is also valuable. However, the headline quantitative claims are internally inconsistent: the abstract's 89% TPR/78 trials is not supported by the body's 24 anomalous trials/27 total trials, and the '37% improvement' is not traceable to the reported Safety Scores. Moreover, the max+kσ calibration does not provide a statistical guarantee at the advertised 0.5% FPR, and the hardware false-positive evidence rests on only 3 nominal trials. These are load-bearing issues for the central contribution; the underlying method is plausible but the current manuscript overstates the strength of the evidence.
major comments (4)
- [Abstract; §IV.D; Table III] The numbers do not agree. The abstract states '89% TPR across 78 trials', but §IV.D reports 24 OOD trials, and Table III reports N=27 total trials (24 anomalous, 3 nominal) with Hybrid recall 18/24 = 75%. The abstract's '37% improvement' is also not traceable: Table I gives RAPT Hybrid Safety Score 0.72 vs LSTM-VAE Hybrid 0.38, an absolute 34 percentage points and a relative ~89% improvement, not 37%. The Introduction's '12.5% TPR improvement' is likewise not consistent with Table III (Hybrid recall 75% vs LSTM 50%, or vs RAPT-only 67%). These inconsistencies affect the paper's headline claims and must be resolved.
- [§III.C.1; Eqs. (6)–(8)] The max+kσ calibration is not a calibrated low-FPR procedure. The thresholds are order statistics (the maximum over a short calibration period) plus kσ, with k=5 per dimension over ~140 dimensions and k=3 on the mean. For heavy-tailed per-dimension NLL (the text itself notes joint velocities are heavy-tailed), the maximum is unstable, and no multiple-testing or tail-probability control is provided. Therefore the 0.5% episode-level FPR operating point is not statistically guaranteed by the method; it is an empirical value for one calibration set. The Discussion (Section VI) explicitly concedes that the calibration 'does not explicitly model the nominal distribution of each observation dimension' and 'may lead to false negatives.' This is load-bearing for the central low-FP claim. Please either provide a calibration scheme with finite-sample FPR control (e.g., conformal or Bonferroni-style
- [§IV.D; Table III] The real-world false-positive evidence is statistically insufficient. The paper reports zero false positives during nominal operation, but this is based on only 3 nominal trials. With n=3, a true per-trial FPR as high as 50% would still yield zero observed false positives with probability 12.5%. Combined with the fact that all experiments are on a single G1 platform over short-term deployments, the headline 'low false positives on hardware' is not established. The Discussion acknowledges 'a modest number of trials' and 'restricted subset of OOD events'; this limitation should be reflected in the abstract and conclusion, not only in the limitations paragraph.
- [§IV.E; Table I] The metric 'Safety Score (TPR @ 0.5% FPR)' and 'episode-level FPR' are not defined in the main text. How is an episode defined for FPR computation? Is a false positive counted if any gate fires at any timestep? How is the 0.5% operating point chosen from the scored outputs? Without this, the headline comparison is not reproducible. Please provide explicit definitions and, ideally, the full FPR/TPR curves or the method used to set the threshold to the 0.5% operating point.
minor comments (5)
- [§IV.B] The '15 OOD categories' are not enumerated in the main text; they are only referenced to the supplementary material. A brief table or list would make the simulation protocol self-contained.
- [§V.A; Table I] The Hybrid column for RAPT (0.72) is lower than Model Only (0.75), which is counterintuitive. The text says this is caused by range-detector false positives, but the caption of Table I does not explain it. Please add an explicit note or discuss the mechanism more clearly.
- [Fig. 3] The terms 'safety margin', 'worst-case margin', and the threshold line are not defined in the figure or caption. Define these quantities and their relation to Eqs. (6)–(8).
- [Introduction; Abstract] The '12.5% TPR improvement' in the Introduction is not consistent with any ratio in Table III. Please recalculate and unify the numbers with the abstract and results.
- [Throughout] Minor typos and formatting: 'V AE' with a stray space, inconsistent dashes in '50Hz' vs '50 Hz', the unitree_rl_lab reference lacks a URL, and some equations (e.g., Eq. (6)) use symbols like σ_global that are not explicitly defined. A careful proofread would help.
Circularity Check
No significant circularity: RAPT is trained and threshold-calibrated on nominal data only, with OOD and real-world trials held out; the max+kσ calibration is statistically fragile but not a by-construction reduction.
full rationale
Walking the derivation chain: RAPT is trained only on nominal simulation observations (Sec. III-B); the max+kσ thresholds (Eqs. 6–8) and the range gate are calibrated on a nominal episode, with no OOD labels used to fit the detector. The reported Safety Score and TPR are computed on 4096-environment simulation evaluations with 15 injected OOD categories and on separate real-world trials (Secs. IV-B, IV-D, V). Although the max-plus-kσ rule makes the detector trivially silent on the calibration data itself, and the hardware zero-FP claim rests on only 3 nominal trials, this is a statistical/external-validity limitation rather than an equation-level reduction of the claimed prediction to fitted inputs; the paper itself admits in Sec. VI that the calibration 'does not explicitly model the nominal distribution of each observation dimension' and may yield false negatives. The Taguchi ablation (Table II) uses the Safety Score as a model-selection criterion, but this is ordinary architecture selection, not a forecast of the same data used as the selection target, and the final scores are on held-out OOD protocols. Self-citations [15] and [16] provide the policy-training algorithm and throwing-task definition; they are not invoked to justify the detector's anomaly-detection principle or to rule out alternatives, so no load-bearing self-citation chain exists. The abstract/summary numerical inconsistencies (89% vs Table III's 75% recall) are reporting/correctness concerns, not circularity. No step reduces a 'first-principles' claim to its inputs by construction.
Axiom & Free-Parameter Ledger
free parameters (6)
- Local threshold multiplier k_local =
5
- Global threshold multiplier k_global =
3
- Range-detector margin delta =
0.05 sim / 0.2 hardware
- Latent bottleneck dimension d_latent =
192
- Denoising noise sigma_noise =
0.01
- Saliency history window H =
200 timesteps
axioms (5)
- domain assumption Nominal simulation data collected from expert policies is representative of real nominal operation up to a static domain shift removable by max+kσ calibration.
- domain assumption All safety-relevant OOD events cause either elevated NLL in at least one observation dimension or violation of the calibrated hyper-rectangle bounds.
- domain assumption Per-dimension NLL residuals are heavy-tailed enough that max+kσ thresholds are more robust than high-percentile thresholds, and the global mean NLL is approximately Gaussian.
- ad hoc to paper The GRU latent bridge with zero initialization and online hidden-state propagation captures temporal dependencies relevant to OOD detection.
- domain assumption Integrated Gradients through BPTT yields meaningful spatio-temporal saliency that an LLM can translate into semantic root causes.
read the original abstract
Deploying learned control policies is risky because policies that appear robust in simulation can confidently enter out-of-distribution (OOD) states after Sim-to-Real transfer, causing silent failures and potential hardware damage. Existing anomaly detectors often fail to meet the requirements of high-rate control, extremely low false-positive rates, and interpretable failure feedback. We present \textbf{RAPT} (Recurrent Anomaly Probabilistic Trajectory Model), a lightweight, self-supervised $50$\,Hz deployment monitor that learns nominal execution from large-scale simulation and produces calibrated, per-dimension predictive-deviation signals online. RAPT enables OOD detection under strict false-positive constraints while localizing \emph{when and where} real execution departs from nominal behavior. For post-hoc diagnosis, RAPT combines temporal saliency, joint-kinematic summaries, and LLM-based semantic reasoning to classify likely failure causes in a zero-shot setting. In simulation across four Isaac Lab tasks, RAPT improves TPR by $37\%$ over the strongest baseline at $0.5\%$ episode-level FPR; on hardware, it achieves $89\%$ TPR across $78$ trials with fewer false positives than high-frequency-compatible baselines, and reaches $75\%$ semantic failure diagnosis accuracy across $21$ categories on a challenging OOD subset. Project website, code, and videos: https://humphreymunn.github.io/RAPT/.
Figures
Reference graph
Works this paper leans on
-
[1]
Safe reinforcement learning via shielding
Mohammed Alshiekh, Roderick Bloem, R ¨udiger Ehlers, Bettina K¨onighofer, Scott Niekum, and Ufuk Topcu. Safe reinforcement learning via shielding. InProceedings of the AAAI Conference on Artificial Intelligence, vol- ume 32, 2018
2018
-
[2]
Safe model-based reinforcement learning with stability guarantees
Felix Berkenkamp, Matteo Turchetta, Angela Schoellig, and Andreas Krause. Safe model-based reinforcement learning with stability guarantees. InAdvances in neural information processing systems, volume 30, 2017
2017
-
[3]
Safe learning in robotics: From learning-based control to safe reinforcement learning.Annual Review of Control, Robotics, and Autonomous Systems, 5:411–444, 2022
Lukas Brunke, Melissa Greeff, Adam W Hall, Zhao- cong Yuan, Siqi Zhou, Jacopo Panerati, and Angela P Schoellig. Safe learning in robotics: From learning-based control to safe reinforcement learning.Annual Review of Control, Robotics, and Autonomous Systems, 5:411–444, 2022
2022
-
[4]
End-to-end safe reinforcement learning through barrier functions for safety-critical continuous control tasks
Richard Cheng, G ´abor Orosz, Richard M Murray, and Joel W Burdick. End-to-end safe reinforcement learning through barrier functions for safety-critical continuous control tasks. InProceedings of the AAAI Conference on Artificial Intelligence, volume 33, pages 3387–3395, 2019
2019
-
[5]
Lyapunov-based safe policy optimization for continuous control.arXiv preprint arXiv:1901.10031, 2019
Yinlam Chow, Ofir Nachum, Aleksandra Faust, Edgar Duenez-Guzman, and Mohammad Ghavamzadeh. Lyapunov-based safe policy optimization for continuous control.arXiv preprint arXiv:1901.10031, 2019
Pith/arXiv arXiv 1901
-
[6]
Pronav: Propriocep- tive traversability estimation for legged robot navigation in outdoor environments.IEEE Robotics and Automation Letters, 9(8):7190–7197, 2024
Mohamed Elnoor, Adarsh Jagan Sathyamoorthy, Kasun Weerakoon, and Dinesh Manocha. Pronav: Propriocep- tive traversability estimation for legged robot navigation in outdoor environments.IEEE Robotics and Automation Letters, 9(8):7190–7197, 2024
2024
-
[7]
Recurrent world models facilitate policy evolution.Advances in neural information processing systems, 31, 2018
David Ha and J ¨urgen Schmidhuber. Recurrent world models facilitate policy evolution.Advances in neural information processing systems, 31, 2018
2018
-
[8]
Out-of-distribution detection for reinforcement learning agents with proba- bilistic dynamics models
Tom Haider, Karsten Roscher, Felippe Schmoeller da Roza, and Stephan G ¨unnemann. Out-of-distribution detection for reinforcement learning agents with proba- bilistic dynamics models. InProceedings of the 2023 International Conference on Autonomous Agents and Multiagent Systems, pages 851–859, 2023
2023
-
[9]
Can you trust your agent? the effect of out-of-distribution detection on the safety of reinforcement learning systems
Tom Haider, Karsten Roscher, Benjamin Herd, Felippe Schmoeller Roza, and Simon Burton. Can you trust your agent? the effect of out-of-distribution detection on the safety of reinforcement learning systems. In Proceedings of the 39th ACM/SIGAPP Symposium on Applied Computing, pages 1569–1578, 2024
2024
-
[10]
Model-free robot anomaly detection
Rachel Hornung, Holger Urbanek, Julian Klodmann, Christian Osendorfer, and Patrick Van Der Smagt. Model-free robot anomaly detection. In2014 IEEE/RSJ International Conference on Intelligent Robots and Sys- tems, pages 3676–3683. IEEE, 2014
2014
-
[11]
Reaching in clutter with whole-arm tactile sensing.The International Journal of Robotics Research, 32(4):458–482, 2013
Advait Jain, Marc D Killpack, Aaron Edsinger, and Charles C Kemp. Reaching in clutter with whole-arm tactile sensing.The International Journal of Robotics Research, 32(4):458–482, 2013
2013
-
[12]
Rethinking out-of-distribution (ood) detection: Masked image modeling is all you need
Jingyao Li, Pengguang Chen, Zexin He, Shaozuo Yu, Shu Liu, and Jiaya Jia. Rethinking out-of-distribution (ood) detection: Masked image modeling is all you need. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 11578– 11589, 2023
2023
-
[13]
Isola- tion forest
Fei Tony Liu, Kai Ming Ting, and Zhi-Hua Zhou. Isola- tion forest. In2008 eighth ieee international conference on data mining, pages 413–422. IEEE, 2008
2008
-
[14]
Aaqib Parvez Mohammed and Matias Valdenegro-Toro. Benchmark for out-of-distribution detection in deep re- inforcement learning.arXiv preprint arXiv:2112.02694, 2021
Pith/arXiv arXiv 2021
-
[15]
Humphrey Munn, Brendan Tidd, Peter B ¨ohm, Marcus Gallagher, and David Howard. Scalable multi-objective robot reinforcement learning through gradient conflict resolution.arXiv:2509.14816, 2025
arXiv 2025
-
[16]
Whole-body dynamic throwing with legged manipulators
Humphrey Munn, Brendan Tidd, Peter B ¨ohm, Marcus Gallagher, and David Howard. Whole-body dynamic throwing with legged manipulators. InProceedings of the 27th Australasian Conference on Robotics and Automation (ACRA), Perth, Australia, December 2025. Available at arXiv:2410.05681
Pith/arXiv arXiv 2025
-
[17]
Deep dynamics models for learning dex- terous manipulation
Anusha Nagabandi, Kurt Konolige, Sergey Levine, and Vikash Kumar. Deep dynamics models for learning dex- terous manipulation. InConference on Robot Learning (CoRL), pages 1101–1112. PMLR, 2020
2020
-
[18]
Do deep generative models know what they don’t know?arXiv preprint arXiv:1810.09136, 2018
Eric Nalisnick, Akihiro Matsukawa, Yee Whye Teh, Dilan Gorur, and Balaji Lakshminarayanan. Do deep generative models know what they don’t know?arXiv preprint arXiv:1810.09136, 2018
Pith/arXiv arXiv 2018
-
[19]
Linas Nasvytis, Kai Sandbrink, Jakob Foerster, Tim Franzmeyer, and Christian Schroeder de Witt. Rethinking out-of-distribution detection for reinforcement learning: Advancing methods for evaluation and detection.arXiv preprint arXiv:2404.07099, 2024
Pith/arXiv arXiv 2024
-
[20]
Variational inference mpc for bayesian model-based reinforcement learning
Masashi Okada and Tadahiro Taniguchi. Variational inference mpc for bayesian model-based reinforcement learning. InConference on robot learning, pages 258–
-
[21]
A multimodal anomaly detector for robot-assisted feed- ing using an lstm-based variational autoencoder.IEEE Robotics and Automation Letters, 3(3):1544–1551, 2018
Daehyung Park, Yuuna Hoshi, and Charles C Kemp. A multimodal anomaly detector for robot-assisted feed- ing using an lstm-based variational autoencoder.IEEE Robotics and Automation Letters, 3(3):1544–1551, 2018
2018
-
[22]
Guaranteeing out-of-distribution detec- tion in deep rl via transition estimation
Mohit Prashant, Arvind Easwaran, Suman Das, and Michael Yuhas. Guaranteeing out-of-distribution detec- tion in deep rl via transition estimation. InProceedings of the AAAI Conference on Artificial Intelligence, vol- ume 39, pages 12452–12460, 2025
2025
-
[23]
Deep one-class classification
Lukas Ruff, Robert Vandermeulen, Nico Goernitz, Lu- cas Deecke, Shoaib Ahmed Siddiqui, Alexander Binder, Emmanuel M ¨uller, and Marius Kloft. Deep one-class classification. InInternational conference on machine learning, pages 4393–4402. PMLR, 2018
2018
-
[24]
Abdellah Zakaria Sellam, Ilyes Benaissa, Abdelma- lik Taleb-Ahmed, Luigi Patrono, and Cosimo Dis- tante. Mamba adaptive anomaly transformer with as- sociation discrepancy for time series.arXiv preprint arXiv:2502.07858, 2025
Pith/arXiv arXiv 2025
-
[25]
unitree rl lab: Reinforcement learning implementation for unitree robots based on isaaclab
Unitree Robotics. unitree rl lab: Reinforcement learning implementation for unitree robots based on isaaclab. https://github.com/unitreerobotics/unitree rl lab, 2024
2024
-
[26]
Extracting and composing robust features with denoising autoencoders
Pascal Vincent, Hugo Larochelle, Yoshua Bengio, and Pierre-Antoine Manzagol. Extracting and composing robust features with denoising autoencoders. InProceed- ings of the 25th International Conference on Machine Learning, pages 1096–1103, 2008
2008
-
[27]
Patchad: A lightweight patch-based mlp-mixer for time series anomaly detection.IEEE Transactions on Big Data, 2025
Zhijie Zhong, Zhiwen Yu, Yiyuan Yang, Weizheng Wang, Kaixiang Yang, and CL Philip Chen. Patchad: A lightweight patch-based mlp-mixer for time series anomaly detection.IEEE Transactions on Big Data, 2025
2025
discussion (0)
Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.