Using large language models for embodied planning introduces systematic safety risks

Figure 2: Safe planning landscape across 23 large language models. a , Plan outcomes for each model on the 1,044-task hard split, sorted by safety rate. Bars show safe and feasible (green), feasible but unsafe (yellow), and infeasible (red) outcomes. White crosses show safety intention (SI). b–c , Examples of infeasible plans: precondition violation (b) and missing action with malformed parameters (c). d–f , Examples of feasible but unsafe plans: missing safety verification (d), improper action strategy (e), and social norm violation (f). g , A valid alternative plan with redundant actions tha

Figure 3: Scaling analysis of safe planning across 18 open-source models. Horizontal lines mark the performance of GPT-5 high on each metric for reference. Shaded bands show 95% bootstrap confidence intervals (CIs) on the regression line from 10,000 resamples to quantify uncertainty in the trend estimates. \beta denotes the log-linear slope in percentage points per order of magnitude; R^{2} values report the fraction of cross-model variance explained by the regression; higher values indicate a tighter fit between predictor and outcome. a , Feasibility rate versus model size. b , Safety rate ve

Figure 4: Task factors affecting safe planning difficulty. We ran seven panel models on all 12,279 DESPITE tasks and computed per-task difficulty separately for each metric as the fraction of models that failed. Rows show feasibility ( i ), safety ( ii ), and safety intention ( iii ) difficulty. Columns show plan length ( a ), safety effort ( b ), danger and task categories ( c ), and redundant action sensitivity ( d ). Column a : Violin plots of plan length distributions. More complex tasks, reflected by longer reference plans, tend to have higher difficulty for all three metrics, with a stro

Figure 7: Easy versus hard split comparison on DESPITE with unseen models. Performance of three held-out models (not included in the main experiments) on random samples from the easy split ( a ) and the hard split ( b ). Even on the easy split, the best-performing held-out model (Mistral-Large, 675B parameters) achieves only 64% safe-and-feasible, and Kimi-K2-Instruct (1T parameters) reaches 60%, indicating that these tasks remain non-trivial despite their lower difficulty calibration. All three models show substantially lower performance on the hard split, consistent with the intended stratif

Figure 5: DESPITE dataset and generation pipeline. a , Dataset composition by data source, task setting, danger group, danger type, and entity in danger. The 12,279 tasks span over various settings with both physical dangers (mechanical, thermal, chemical, electrical) and normative dangers (privacy, trust violations). Entities at risk include humans, robots, and others (environment, surrounding objects). b , Planning complexity distribution. Each cell shows task count at that (average plan length, safety effort) coordinate. The distribution centers around (5, 1): typical tasks require approxim

Figure 6: Performance breakdown on DESPITE hard-split by danger type, entity, and data source. The heatmap uses 4 colour gradients: blue for feasibility, green for safety, orange for safety intention, and purple for safety precision. Darker shades indicate higher performance (0–100% scale). Category abbreviations: Phy (Physical), Psy (Psychosocial/Normative), H (Human), R (Robot), O (Others), AF (ALFRED), NS (NEISS), BD (BDDL), VH (VirtualHome), NB (NormBank).