On Adversarial Robustness of Trajectory Prediction for Autonomous Vehicles

Abstract: Trajectory prediction is a critical component for autonomous vehicles (AVs) to perform safe planning and navigation. However, few studies have analyzed the adversarial robustness of trajectory prediction or investigated whether the worst-case prediction can still lead to safe planning. To bridge this gap, we study the adversarial robustness of trajectory prediction models by proposing a new adversarial attack that perturbs normal vehicle trajectories to maximize the prediction error. Our experiments on three models and three datasets show that the adversarial prediction increases the prediction error by more than 150%. Our case studies show that if an adversary drives a vehicle close to the target AV following the adversarial trajectory, the AV may make an inaccurate prediction and even make unsafe driving decisions. We also explore possible mitigation techniques via data augmentation and trajectory smoothing. The implementation is open source at https://github.com/zqzqz/AdvTrajectoryPrediction.

• The paper presents an adversarial attack framework that perturbs realistic vehicle trajectories to evaluate prediction model robustness.
• The experiments show that adversarial attacks boost prediction errors by over 150%, highlighting critical safety risks.
• The study proposes mitigation strategies such as data augmentation and trajectory smoothing that reduce error impacts by 28%.

On Adversarial Robustness of Trajectory Prediction for Autonomous Vehicles: An Expert Overview

The paper "On Adversarial Robustness of Trajectory Prediction for Autonomous Vehicles" addresses an underexplored area in autonomous vehicle (AV) technology—specifically, the susceptibility of trajectory prediction models to adversarial attacks. Trajectory prediction is pivotal for AVs as it informs planning and navigation by forecasting the future positions of moving objects like other vehicles and pedestrians. The authors identify a significant gap in existing research which focuses predominantly on prediction accuracy while neglecting robustness against adversarial manipulations.

The Study and its Contributions

This study introduces a novel adversarial attack designed to evaluate the robustness of trajectory prediction models. This attack slightly perturbs normal vehicle trajectories with the goal of maximizing prediction errors. The authors implement this methodology across three datasets (Apolloscape, NGSIM, and nuScenes) and three models (GRIP++, FQA, and Trajectron++). The pivotal contributions of this research can be summarized as follows:

1. Adversarial Attack Design and Evaluation: The authors propose both white-box and black-box attack frameworks that consider the realistic constraints of vehicular trajectories, such as physical feasibility and natural driving behaviors.
2. Comprehensive Empirical Analyses: The experiments reveal that adversarial perturbations can elevate the prediction error by over 150%, highlighting significant vulnerabilities that can lead to unsafe AV behaviors.
3. Mitigation Strategies: The study explores mitigation techniques to counter adversarial influences, suggesting data augmentation and trajectory smoothing as viable approaches to reduce prediction errors under attack by 28%.

Key Findings and Implications

The experiments underscore that adversarially perturbed trajectories often maintain physical plausibility, bypassing detection due to their natural appearance. The study notes a stark increase in Average Displacement Error (ADE) and Final Displacement Error (FDE) across all tested models, with notable increments in specific lateral and longitudinal deviation scenarios that pose substantial risks, such as inducing hard brakes or veering off-course.

The study suggests implementing auxiliary features like semantic maps to enhance the resilience of prediction models. It also advocates for incorporating driving rules to improve model robustness. While data augmentation and trajectory smoothing prove beneficial, the paper acknowledges that current mitigation strategies can adversely affect normal prediction performance, thus pointing towards an ongoing trade-off in defense design.

Future Directions

The paper opens several avenues for future research. Firstly, a deeper integration of context-aware features such as high-definition maps and dynamic traffic rules could fortify prediction models. Furthermore, developing more nuanced detection systems for adversarial trajectories without impacting standard operations remains a critical challenge. Investigating alternative architectures that inherently possess greater adversarial robustness could lead to substantial advancements in the reliable deployment of AV systems.

In conclusion, this paper significantly enriches the discourse surrounding adversarial robustness in AV trajectory prediction. It exposes critical vulnerabilities and suggests feasible routes towards bolstering model defenses, playing a crucial role in ensuring the safety and efficacy of autonomous driving technologies.