Confidence without correctness

Background for the general reader — the setting, the stakes, and what is new here

Modern robot policies are trained on their own experience. A robot attempts a task many times, and each attempt has to be labeled: did it succeed or not? At scale, a human cannot label every rollout, so a learned model is put in the labeling seat. That model's verdicts become the training signal for the next, better policy.

This is the loop that matters. When the learned judge is right, the loop improves. When it is wrong in the cautious direction, flagging a success as a failure, the cost is a discarded good example: wasteful, but visible and self-correcting. When it is wrong in the confident direction, certifying a failure as a success, the cost is different in kind. A mislabeled failure is silently poured into the training set as if it were a thing to imitate. Nothing downstream flags it, because everything downstream trusts the label. A judge that occasionally cries wolf can be tuned. A judge that occasionally waves through a failure at high confidence poisons the well and leaves no fingerprint.

That the learned judges in this seat are imperfect is already established. An independent benchmark, RoboTwin 2.0, reports a vision-language success detector at precision 0.208 on curated execution sequences ^[4]. Google's own Gemini Robotics-ER, the model examined here, is marketed for exactly this function, "progress estimation" among its named capabilities ^[3]. So the reliability gap is not in dispute. What has been missing is a precise account of why a judge that can clearly describe a scene still misjudges it, and whether anything cheaper than a better model can recover the lost signal.

This paper supplies both, on public data, under a self-audited protocol. It makes one diagnostic claim and one constructive claim, and it is careful to be nothing more:

Terms used in this paper

success judge

a learned model asked to output whether a commanded task succeeded, typically with a confidence value.

collateral motion

an object that was supposed to stay still moving during the task. A common, easy-to-miss failure.

preservation complement

everything in the scene that the task did not command to change, and therefore must be checked for having stayed put.

registration

aligning two frames so the camera's own small shifts are removed before anything is called "motion."

role-local support

counting the actual visible pixels belonging to one named object, rather than trusting a box drawn around it.

abstain

the instrument's third output, beside pass and fail: "my evidence here is not valid, so I decline to rule." Not a guess.

calibration / validation split

freezing a threshold on one set of no-motion pairs, then testing it on a held-out set never used to set it.

The corpus. All public-data results use Language-Table ^[1], a Google release of a robot arm pushing eight colored blocks on a smooth board, with human-selected behavior endpoints. It was chosen because its planar, line-of-sight layout gives an object-measuring instrument a clear view. Its labels are hindsight descriptions of what happened, not contracts about what had to stay fixed, a distinction that bounds the claims in Section V.

A judge whose confidence carries no information about its correctness

The starting observation is not that a learned model makes mistakes. It is that its confidence does not change when it is mistaken. In a task-success setting, that is the dangerous shape: a wrong verdict that looks exactly as certain as a right one gives a downstream pipeline nothing to filter on.

The judge is Gemini Robotics-ER ^[3]. It is shown a before and after frame and asked, in neutral language, whether the commanded manipulation succeeded while everything else stayed put. Across two prospectively frozen layouts, with collateral moves as small as one centimeter and on both textured and smooth surfaces, it returned confident false passes at a single repeated confidence value.

Two details make this more than ordinary unreliability. First, in the replicated set the model named the object it then certified as unchanged: it reported the moved bowl in the scene and still passed the layout. The error is not a failure to perceive the object; it survives perception. Second, the confidence is flat. It sits at 0.95 on the passes it should have failed and 0.95 elsewhere. A number that does not move cannot be a filter.

An older, unrelated capture shows the same shape in a different modality: on a legacy real-frame subset the same class of judge scored 17 of 27, with ten flat printouts certified as real three-dimensional objects. Different scene, different failure trigger, same decoupling of stated certainty from physical fact.

Where the signal lives, and why a smooth representation cannot hold it

The interesting question is not that the judge is wrong but why it is wrong while still describing the scene correctly. The answer, made measurable on Language-Table, is that the learned representation is smooth exactly where the physical evidence is fine-grained. The change that decides success is below the resolution the representation preserves.

The clean case is a single episode, labeled P18. The robot pusher completes its commanded move and, in doing so, gradually uncovers a second block it had been occluding. Two instruments watch the same pixels.

Language-Table episode P18 · six frames · green = learned boxes, magenta = robot/actor

Scale that from one episode to a set and the effect becomes a coverage collapse. Handed frozen no-motion pairs, the judge validates every row and calls all eight objects "clear" in every pair. Yet its boxes are so quantized that any honest metric threshold built from them is degenerate: a zero-percent area-change threshold, a held-out control that false-alarms at a tenth of a pixel. Applied without tuning, the learned surface returns zero usable verdicts across five episodes. Categorical coverage is total; metric coverage is nothing.

This reframes the received wisdom. The familiar statement is "vision-language models are unreliable judges of physical success." The sharper, testable statement is: the learned representation acts as a low-pass filter over the physical nuisance channel, and task success lives in that channel. The model is not blind to the object. It is smooth where the object's story is written in fine strokes. Its boxes remain genuinely useful for binding a name to a region. They cannot certify their own metric support, and they should not be asked to.

A measurement that distinguishes "changed" from "became visible," and refuses when it cannot

If the learned representation discards the deciding evidence, the remedy is not a better-prompted judge. It is a second, independent measurement over the raw pixels that never delegates its metric authority to the model, and that says nothing when its own evidence is invalid.

The arrangement keeps each part in its lane. The learned model does what it is good at, naming objects and pointing to roughly where they are. A system-owned policy, not the model, states what the task permits to change. An independent measurement audits everything else. A validity layer decides whether that measurement can be trusted at all. Missing or compromised evidence produces an abstention, never a learned guess.

The measurement itself is deliberately ordinary: standard feature-based image registration and color-component pixel counting, no bespoke geometry and no learned metric. That is a design choice, not a limitation. An effect that shows up under textbook computer vision is not an artifact of some exotic operator. The exact operations are given in Methods.

The discipline is where the result lives. Return to P18. A naive difference sees the uncovered block move and would call it a 7.11 px collateral violation, a false fail. But the same measurement sees that the block's visible support is growing as it is revealed, not translating. A prospectively frozen support-stability gate reads that growth and returns abstain, not a verdict. The instrument distinguishes an object that changed from an object that merely became visible. That distinction is the whole game, and the learned judge never makes it.

The abstention is disciplined, not evasive. Its threshold is calibrated before it meets the task episodes: on a fresh corpus shard, on natural no-motion pairs split into calibration and validation ahead of measurement. The held-out result is zero false alarms in six validation pairs at a 0.911 px maximum, under a calibration ceiling of 1.264 px. The gate earns the right to speak by first proving it stays quiet when nothing moves.

Language-Table episode P10 · before / after · a same-color role split

A denser version of the same measurement recovers coverage without surrendering the discipline. Sealed before it ran, with a 1.225 px centroid and 7.06% support threshold, it clears all six held-out controls and returns two clean preservation passes, zero fails, three abstentions, and it still abstains on P18. That is the shape you want: coverage rising while the hard case stays correctly unresolved. The authority that decides admissibility is the independent measurement's own validity, never the model's confidence and never the persistence of a learned box.

Pre-registration, blind cross-checks, and a self-caught leak

The claims above rest on few episodes. What makes them trustworthy rather than anecdotal is that the discipline meant to prevent self-deception was run against the author, out loud, and it caught something.

Three practices carry the weight. Every threshold is frozen with a hash of the protocol, the code, the input, and the policy before the measurement it governs, so no number can be quietly retuned once the answer is visible. A blind second model, given a neutral packet with the answer key withheld, was used to cross-check visibility: the two instruments agreed on 293 of 336 object-window decisions (87.2%), and where they disagreed the disagreement was asymmetric, which argued for the conservative reading rather than promoting either model's estimate to ground truth.

The most telling event is a correction the project made against itself. A hash-group audit of the no-motion calibration set found two pairs that were byte-identical to calibration pairs and had leaked across the calibration/validation boundary. The denominators were corrected from 16/7 to 15 unique calibration and 6 unique validation pairs, a convenient "coincidental equal maximum" explanation was withdrawn, and the thresholds and task results were re-checked and held. A record that finds its own leak and reports the corrected, slightly less tidy numbers is a record that was not reverse-engineered from its conclusion.

The edges named as edges, with the experiment that would break each finding

The contribution is a documented, mechanistically explained failure mode of a learned success judge, plus an independent measurement that recovers the evidence the judge discards, shown on public data under adversarial self-audit. It is deliberately not more than that. Four boundaries define where it currently stops.

• One model family. Falsifier  Run the same neutral verification prompt on two or three other frontier judges. If their confidence tracks correctness, or they do not false-pass named violations, the decoupling is a Gemini property, not a property of learned judges.
• Existence-proof scale. Falsifier  The representational low-pass is shown cleanly on a handful of episodes. A prevalence study, stratified by role separation, occlusion / reveal, collateral motion, illumination, and same-color overlap, would show whether the effect is common or a curated rarity.
• Preservation complement, not task goal. Falsifier  Language-Table descriptions are hindsight labels, not preservation contracts. The passes here certify only that protected objects were measured unchanged, never that the commanded goal was achieved. A corpus carrying both a stated goal and a stated preservation contract would test both halves at once.
• Offline, single-frame pairs. Falsifier  Nothing here is a runtime-assurance claim. On real robot trajectories the endpoint evidence is often withheld by the arm itself ^[2]; occlusion may be recoverable from another moment or view, opaque containment is a modality limit, and both must be accounted for explicitly rather than passed.

None of these require a new idea. Each requires more subjects, or a corpus with a different property, applied to the instrument as it already stands. That is the honest state of the work: a finding on firm ground, with its next four experiments already named, and none of them a rescue.

The exact pipeline, and an explicit inventory of what is not in it

Every measurement in this paper is produced by standard computer-vision primitives. There is no learned metric, and no bespoke geometric operator. A reader should be able to reconstruct the pipeline from a general vision library and the description below.

The only learned component is the grounding model. Gemini Robotics-ER returns, per object, a name-bound bounding box and a visibility label (clear, partial, or occluded). It supplies identity and a rough location. It is never asked for, and never trusted with, a metric quantity.

The verdict audits only the preservation complement, the target object set aside, and the tests run in a fixed order. The ordering is the mechanism, not an implementation detail:

1. any complement object not measured in both endpoints → abstain;
2. else any complement object whose support change exceeds the support threshold → abstain (it is being revealed or occluded, not reliably measurable: the P18 gate);
3. else any complement object whose registered displacement exceeds the motion threshold → fail;
4. else → pass.

The support-stability test runs before the motion test. That single ordering is what converts a reveal into an abstention instead of a false fail. The protocol, code, input manifest, and policy are hashed and frozen before each measurement is run.

Each headline figure and the primary result file it comes from

No figure in this paper is a summary estimate. Each traces to a single frozen result file in the lab record, listed below. Every entry was re-checked against its source file before publication.

Files are named for reference only; the lab record is the authority for exact context and denominators. Rows highlighted are the three figures a skeptic is most likely to test first: the representational mismatch, the held-out false-alarm rate, and the leak the audit caught in its own calibration set.

Every citation below was checked against its primary source before inclusion

1. C. Lynch, A. Wahid, J. Tompson, T. Ding, J. Betker, R. Baruch, T. Armstrong, P. Florence. Interactive Language: Talking to Robots in Real Time. arXiv:2210.06407, 2022. Source of the Language-Table dataset and simulator. arxiv.org/abs/2210.06407 verified
2. A. Khazatsky et al. DROID: A Large-Scale In-The-Wild Robot Manipulation Dataset. arXiv:2403.12945, 2024. The real-trajectory corpus referenced as the offline boundary. arxiv.org/abs/2403.12945 verified
3. Google DeepMind. Gemini Robotics-ER (embodied-reasoning vision-language model). Named capabilities include spatial understanding and progress estimation. ai.google.dev/gemini-api/docs/robotics-overview verified
4. T. Chen et al. RoboTwin 2.0: A Scalable Data Generator and Benchmark with Strong Domain Randomization for Robust Bimanual Robotic Manipulation. arXiv:2506.18088, 2025. Reports a VLM success detector at precision 0.208 on curated execution sequences. arxiv.org/abs/2506.18088 verified

^† On the two P18 figures. The same reveal is measured at two pipeline stages. The learned-surface evaluation reports the change as a fraction of the object's extent: box +2.4% against visible support +67.7%. The support-stability gate reports it as a raw pixel count over its frame window: 161 → 499 px (a later dense-support pass reads 161 → 673 px). All three agree in direction and magnitude class; they differ because the frame window and the measurement method differ. A reader cross-referencing the lab record should expect the count and the percentage to describe the same event, not two events.