Search papers, labs, and topics across Lattice.
This paper introduces \textsc{Derail}, an adversarial framework that targets the scoring head of generative end-to-end autonomous driving planners, exploiting its vulnerability to induce unsafe trajectory selections. By evaluating various generative planners, the authors demonstrate that \textsc{Derail} can significantly flip the trajectory choice from safe to unsafe, achieving score drops of 39-80% and collision rates of up to 50%. The findings highlight the critical need for defensive measures against adversarial perturbations that exploit the inherent design of current generative AD systems.
Adversarial attacks can flip the trajectory selection in generative driving planners, leading to a staggering 50% increase in collision rates.
Generative models have recently seen rapid adoption in End-to-End (E2E) autonomous driving (AD), with diffusion-based denoising and vocabulary-based retrieval becoming the dominant trajectory-decoding paradigms. Despite their architectural diversity, current generative AD planners share a common inference pattern: a fixed set of candidate trajectories (anchors, vocabulary entries, or proposal queries) is scored by one or more learned heads conditioned on the Bird's-Eye-View (BEV) features, and the highest-scored candidate is returned as the final trajectory. Under this design, the scoring head is the only barrier between perception and the motion command, and its decision margins between competing candidates are often small. We introduce \textsc{Derail}, an adversarial framework that exploits this scoring-head attack surface. Evaluated on various generative planners, \textsc{Derail} flips the trajectory selection from a safe to an unsafe candidate, with score drops of $39$--$80\%$ and collision rates of up to $50\%$, consistently outperforming generic loss-maximization and feature-divergence attacks. Our analysis suggests that safety-violating objectives govern attack effectiveness against generative AD planners, and that the scoring-head inference pattern itself is a recurring attack surface worth explicit defensive consideration.
