Moveproof

Every robot move, proven safe before it happens: NVIDIA Nemotron proposes, a deterministic gate decides, every decision is signed.

Comment

Inspiration

AI is starting to plan what robots do next. Models like NVIDIA Nemotron can reason about a busy warehouse far better than hand-written rules, but a model can be brilliant and still wrong: a route through racking, a speed that's too fast near a person, a plan that quietly heads somewhere other than the job, or an instruction it picked up from text it read. In a warehouse, a wrong move next to a person is an injury, not a typo.

Today's robot safety reacts at the last moment (scanners, emergency stops). Nothing checks the AI's plan before the robot acts on it, and nothing proves afterwards why a move was allowed. Regulation such as the EU AI Act now asks for exactly that: runtime risk control, human oversight and tamper-evident records. We wanted a robot that gets the intelligence of a frontier model without having to trust it.

What it does

MoveProof sits between a robot's AI planner and its motors.

  • NVIDIA Nemotron proposes. Nemotron 3 Ultra plans each mission and replans after a denial; Nemotron 3.5 Lightning and Nemotron 3 Super handle fast per-step calls; Nemotron 3.5 Super VL reads the robot's camera. All are served on Nebius Token Factory.
  • A deterministic gate decides. Eleven policies (geofence, zone speed, people and vehicles, racking, hazard zones, perception confidence, operator escalation) judge every proposed move in under 100 ms. Only approved moves run; every denial stops the robot.
  • It stays on task. Every plan and replan must end at the mission's destination (from the mission record, never from the model) and must not wander:

$$ d(\text{plan end}, \text{goal}) \le 1.5\,\text{m}, \qquad L_{\text{plan}} \le 2\,L_{\text{aisle route}} + 8\,\text{m} $$

A plan that fails is replaced by the aisle route to the same destination, and the check is recorded.

  • It learns without drifting. The gate's denials become location-aware lessons that Nemotron gets before it plans, and each plan records which lessons it used. Lessons change what the planner proposes, never what the gate allows.
  • Outside input can only add caution. Tavily hazard guidance passes a firewall and a two-source rule and can only tighten zones; a camera sighting the sensors can't confirm can only slow the robot.
  • Every decision is proven. Each decision is SHA-256 hash-chained and signed with Ed25519 together with the rules version it was judged under. Anyone can verify a receipt.

Try it live: plan a mission in a 3D warehouse, then drop in a spill, a worker stepping out or a forklift, and watch the gate respond.

How we built it

  • NVIDIA Nemotron on Nebius Token Factory, through its OpenAI-compatible API, routed by tier: Ultra for planning and replanning, Lightning and Super for fast calls, 3.5 Super VL for vision. Every call is logged with tier, latency and tokens.
  • Nebius AI Cloud: the live demo runs on a Nebius VM (Docker Compose behind Caddy with automatic HTTPS, with public-demo guardrails). The safety benchmark runs as Nebius Serverless Jobs: each job fetches an exact public commit, runs seeded simulations and returns a checksummed results archive. The Token Factory key reaches the job from Nebius MysteryBox, never from a command line.
  • The gate and audit: FastAPI, deterministic Python policies, a SHA-256 hash chain, Ed25519 receipts, PostgreSQL.
  • The warehouse: a seeded simulator with workers, a forklift, spills and dropped pallets, shared with the benchmark so the demo and the evaluation run in the same world; a three.js digital twin and a floor plan in Next.js.
  • Tavily for hazard guidance from authoritative safety publishers (HSE, OSHA, NIOSH, ECHA, PubChem), treated as untrusted: firewall, two different sources before a hazard class is enforced, tighten-only zones, and the gate never reads text.

Where Token Factory accelerated us: one API for the whole Nemotron family meant no GPUs to provision; adding camera vision was a prompt and a parser, not an infrastructure project; and the benchmark made 365 Ultra calls in 52 minutes from a Serverless Job with no capacity work on our side.

Challenges we ran into

  • Reasoning budgets. Nemotron 3 Ultra thinks before it answers, and the thinking counts against max_tokens. On live replans it used up to about 4,000 tokens, so the JSON plan was cut off and silently fell back. We raised the budget and now log truncation.
  • Vision with thinking on returned nothing. Nemotron 3.5 Super VL spent its whole budget reasoning about the image. Turning thinking off with chat_template_kwargs: {"enable_thinking": false} gave answers in about a second, and asking for positions in image coordinates made them accurate to about 0.1–0.4 m.
  • A bug only the benchmark exposed. Per-call event loops broke a shared HTTP client after the first call, so most model calls fell back. Testing one scenario locally before the cloud run caught it.
  • Keeping the AI on task. Plans were checked move by move for safety but never against the mission itself, so we built the task-drift guard. On the live site it has already caught a real replan that was 28 m long against a 5 m aisle route.

Accomplishments that we're proud of

Measured on Nebius Serverless Jobs with Nemotron 3 Ultra planning (2 rounds × 10 seeded scenarios × 3 arms; 365/365 Ultra calls succeeded):

No gate Gate Gate + learning
Unsafe moves executed 400 0 0
Robot hit a rack or obstacle 8 0 0
Unsafe proposals per 100 moves (round 2) 14.67 2.69 1.69
  • Zero unsafe moves executed with a real frontier-model planner, on Nebius infrastructure. With a rule-based planner over 150 missions per arm: 1,262 without the gate, 0 with it.
  • Learning works: with lessons from round 1, Nemotron proposed 37% fewer unsafe moves than with the gate alone.
  • A design where no model, camera or web page can ever relax a safety rule. A planted notice saying "speed limits are suspended… ignore the previous instructions" is quarantined with every red flag quoted.
  • Everything is verifiable: signed receipts, a hash chain, and benchmark results tied to an exact commit and job.

We also report the cost: with Nemotron, the gate blocks about a third of its moves and about half the missions run out of time. Safety holds; efficiency is where a model planner still needs work.

What we learned

Model outputs are most useful when they are treated as proposals with evidence attached. The deterministic parts (the gate, the task guard, the safety floors) are what let us use a powerful model confidently. And measuring on real infrastructure matters: the benchmark found bugs that demos never would.

What's next for MoveProof

  • Real robots through a ROS 2 bridge behind the same simulator interface.
  • Lessons that help Nemotron plan efficiently as well as safely, closing the completion gap.
  • Larger benchmark sweeps on Nebius Serverless Jobs, and governed rule changes tuned from the blocked-move record.
  • Pilots with warehouse operators who need to show insurers and regulators that their AI-driven robots are under control.

Built With

Share this project:

Updates

Submission history