There is no kind of penalty. There is only one exceptional case, in which if they try to double sign a block, it has never happened, but if it does, some of the Rose is slashed, even a portion of users delegating. It is quite unlikely that will happen. If validator tries double sign, he gets removed, and delegators lose 100 rose.