Off the Rails: Hijacking the Scoring Head in Generative End-to-End Driving Planners with Safety-Violating Adversarial Perturbations

Abstract: Generative models have recently seen rapid adoption in End-to-End (E2E) autonomous driving (AD), with diffusion-based denoising and vocabulary-based retrieval becoming the dominant trajectory-decoding paradigms. Despite their architectural diversity, current generative AD planners share a common inference pattern: a fixed set of candidate trajectories (anchors, vocabulary entries, or proposal queries) is scored by one or more learned heads conditioned on the Bird's-Eye-View (BEV) features, and the highest-scored candidate is returned as the final trajectory. Under this design, the scoring head is the only barrier between perception and the motion command, and its decision margins between competing candidates are often small. We introduce \textsc{Derail}, an adversarial framework that exploits this scoring-head attack surface. Evaluated on various generative planners, \textsc{Derail} flips the trajectory selection from a safe to an unsafe candidate, with score drops of $39$--$80\%$ and collision rates of up to $50\%$, consistently outperforming generic loss-maximization and feature-divergence attacks. Our analysis suggests that safety-violating objectives govern attack effectiveness against generative AD planners, and that the scoring-head inference pattern itself is a recurring attack surface worth explicit defensive consideration.

• The paper introduces Derail, a white-box attack that targets trajectory-scoring heads with behavior-aligned digital and physical perturbations, avoiding ground-truth labels or model-specific loss tuning.
• Derail achieved 100% attack success across DiffusionDrive and three GTRS planners, reducing PDMS by 39.8–80.1% and producing collision rates of 25.8–50.7% with an 8/255 digital perturbation budget.
• The findings show that learned candidate scoring without post-hoc safety filtering is a shared attack surface, while standard preprocessing defenses fail; explicit geometric or kinematic safety checks may be necessary.

The scoring-head attack surface

The paper's central claim is that current generative end-to-end (E2E) autonomous driving planners, despite being presented as architecturally distinct, share a single inference pattern that constitutes a recurring adversarial attack surface. The authors abstract this pattern into five stages: multi-view camera images are encoded into Bird's-Eye-View (BEV) features; a fixed candidate trajectory set is instantiated (KMeans anchors for DiffusionDrive, dense vocabularies of 4,096–16,384 entries for the GTRS variants); one or more learned heads score each candidate conditioned on the BEV features; the highest-scored candidate is selected; and no post-hoc geometric or kinematic safety filter is applied. Because stages one and three are fully differentiable and stage five is empty, the learned scoring head is the only barrier between perception and the executed motion command. The paper argues that decision margins between competing candidates are small enough that bounded input perturbations can flip selection from a safe to an unsafe candidate. This is framed as a design-enabled property: any planner that selects from a fixed candidate set via a neural scorer without downstream filtering inherits the same surface.

The authors position this against prior adversarial work on generative policies, notably DP-Attacker [2406.xxxx], which targets noise-prediction loss inside long denoising chains for robotic manipulation. They argue such objectives are misaligned with AD planners, which use very short denoising schedules (DiffusionDrive uses $K{=}2$ DDIM steps) and ultimately perform discrete candidate selection rather than continuous sample refinement. Prior E2E AD attacks targeting regression pipelines such as UniAD stop at perceptual degradation; the paper claims that attacks specifically targeting the scoring-head surface of generative AD planners had not been studied before.

The Derail attack

Derail is a white-box, ground-truth-free attack formulated over two modalities. Digital attacks apply an $\ell_\infty$-bounded additive perturbation ($\epsilon = 8/255$) to a single camera view via PGD with 20 iterations. Physical attacks optimize a universal $256 \times 256$ RGB patch composited onto nearby vehicles via differentiable stitching, using object-aware placement from projected 3D bounding boxes and Expectation over Transformations augmentation for viewpoint robustness.

The attack objective is a weighted sum of three behavior-level losses acting on a softmax-relaxed trajectory $$\hat{\boldsymbol{\tau}}_\beta = \sum_v \mathrm{softmax}(\beta \ell_v)\,\boldsymbol{\tau}^{(v)}$$, which preserves gradient flow through the non-differentiable argmax selection:

• Forward aggression maximizes longitudinal displacement while suppressing lateral correction, targeting collision and time-to-collision sub-metrics.
• Boundary push maximizes sustained and peak lateral deviation, targeting drivable-area compliance and driving direction.
• Sudden braking minimizes forward progress while amplifying inter-waypoint displacement discontinuities, targeting comfort and ego progress.

Each term is explicitly aligned with an axis of the NAVSIM PDM Score, and all are computed solely from model predictions, requiring no ground-truth labels. The same loss weights are used across all four evaluated models and both modalities, so the framework requires no per-model tuning. Optimization is inexpensive: digital perturbations take 1–2 seconds per frame on a single RTX 3060, and universal patch training takes roughly 10–15 minutes per log.

Analytic vulnerability model

An appendix develops Lipschitz-style bounds supporting the architectural argument. For diffusion-refined anchor decoders, trajectory deviation under a feature perturbation is bounded by a product of encoder sensitivity and a decoder amplification factor that compounds multiplicatively across denoising steps; if per-step amplification factors exceed unity, deviation grows exponentially in $K$. For vocabulary-based decoders, a margin condition shows that a feature perturbation exceeding half the score margin between the safe and nearest dangerous candidate suffices to flip selection, and dense vocabularies make the minimum such margin small. A unified bound composes these into $$\|\boldsymbol{\tau}_{\text{adv}} - \boldsymbol{\tau}_{\text{clean}}\|_2 \leq \mathcal{A}_{\mathcal{D}} L_{\mathcal{E}} \epsilon$$, with neither decoder family attenuating pixel-space perturbations below unity gain. The bounds are explicitly architecture-specific to the decoder families evaluated; whether other decoder families exhibit the same amplification is left as an open empirical question. The appendix also derives convergence guarantees for universal patch optimization under smoothness and bounded-variance assumptions.

Digital attack results

Evaluated on NAVSIM against DiffusionDrive, GTRS-DP, GTRS-Aug, and GTRS-Dense, Derail is the only method achieving 100% Attack Success Rate (ASR) on every model, with PDMS drops of 39.8–80.1% and collision rates of 25.8–50.7%. Representative results:

Model	Clean PDMS	Derail PDMS	Drop	CR (%)
DiffusionDrive	0.91	0.37	60.0%	38.4
GTRS-DP	0.78	0.16	80.1%	50.7
GTRS-Aug	0.83	0.22	72.9%	45.0
GTRS-Dense	0.83	0.50	39.8%	25.8

The most informative comparison is DP-Attacker, which shares the identical PGD loop and perturbation budget yet reaches only 16–34% score drops. Since budget and optimizer are held fixed, the gap isolates the objective as the causal variable. Gradient-alignment analysis confirms this directly: Derail's input gradients maintain mean cosine similarity of 0.354–0.502 with a reference collision-inducing gradient across scene tokens, whereas DP-Attacker's gradients are effectively orthogonal (mean −0.017 to −0.065). The Encoder Attack baseline is nearly ineffective on DiffusionDrive (−0.12% drop), indicating that even a truncated two-step DDIM chain gives the scoring head sufficient margin to recover from generic feature corruption. GTRS-Dense is the most resilient target, consistent with its multi-head safety aggregation, yet still suffers a 25.8% collision rate and the highest discomfort rate observed (43.3%).

Qualitatively, the three loss terms map onto distinct failure modes: aggression selects high-speed forward candidates ignoring lead agents, boundary push selects laterally displaced candidates at curves and intersections, and braking produces abrupt velocity profiles. Perturbed camera views remain visually near-identical to clean inputs.

Physical patch results

Universal patches achieve 100% ASR on all four models when trained and evaluated within a single driving log, raising collision rates from 16.7% to 33.3% on DiffusionDrive and GTRS-Dense and from 8.3% to 25.0% on GTRS-DP, while random-texture patches produce no systematic degradation — confirming that effectiveness requires targeted optimization. Notably, off-road and wrong-way rates remain at 0% under patch attacks, indicating physical patches primarily induce frontal collisions rather than broader trajectory failures. Across all logs, effectiveness diminishes substantially (e.g., DiffusionDrive drop falls to 13.4%, collision rate 13.6%), which the authors attribute to the difficulty of frame-independent generalization rather than robustness; GTRS-Dense's apparent resilience under patches coexists with substantial digital vulnerability. Even under this constrained threat model, DiffusionDrive's unsafe TTC rate rises from 4.9% to 22.8%.

Ablations and sensitivity

Component ablations show complementary roles: removing forward aggression causes the largest collision-rate reduction (e.g., GTRS-Dense: 48.7% → 17.7%), removing boundary push collapses off-road rates (GTRS-DP: 82.3% → 31.7%), and removing sudden braking occasionally yields marginally higher collision rates, revealing a mild tension between velocity-discontinuity induction and collision maximization. Sensitivity analysis shows monotonic gains saturating beyond roughly 20 PGD iterations and $\epsilon = 8/255$: collision rate plateaus around 54% at larger budgets while off-road and wrong-way rates continue growing modestly, suggesting the collision objective saturates at moderate budgets. Front-camera attacks dominate side-camera attacks (score drops of 46.6–73.8% versus 7.3–51.2%), consistent with the front view carrying disproportionate weight in the driving corridor representation.

Defenses and transferability

Three standard input-level preprocessing defenses — color jitter, spatial smoothing, and Gaussian noise — fail to reduce ASR below 100% for any model. Spatial smoothing provides partial recovery for DiffusionDrive (drop reduced from 57.8% to 33.0%) but is largely ineffective or mildly counterproductive for the GTRS family, indicating that input transformation is insufficient against this attack surface. Cross-model transferability is near-zero across architecturally distinct families but partially positive within the GTRS family, gated by shared backbone (VoVNet-99), resolution, and BEV modules; the authors attribute cross-family failure to divergent backbones, resolutions ($256\times1024$ versus $512\times2048$), and decoder structures, and outline ensemble optimization and input-diversity techniques as routes toward stronger transfer.

Limitations and open questions

The evaluation is confined to simulation on NAVSIM with a white-box attacker; black-box transferability is reported only as a diagnostic, and physical patch results degrade substantially outside their training distribution. The analytic bounds apply only to the two decoder families evaluated. The softmax relaxation used for gradient flow is a surrogate whose fidelity to the hard argmax selection is asserted rather than exhaustively validated. The paper also concedes trade-offs among its proposed defenses: constraining encoder Lipschitz constants, reducing refinement depth, or margin-maximizing training each risk degrading generation quality, while a non-learned geometric safety filter requires a reliable inference-time oracle. Whether such filtering can be made reliable without sacrificing planner expressiveness remains unresolved.

Conclusion

This paper identifies the learned scoring head over a fixed candidate set, unfiltered by any downstream safety check, as a shared and exploitable component of generative E2E driving planners. Its Derail attack demonstrates that safety-violating, behavior-aligned objectives — not generic loss or feature divergence — govern attack effectiveness against this class, achieving 100% ASR with collision rates up to 50.7% under imperceptible digital perturbations and meaningful degradation from physically realizable patches. The principal defensive implication drawn is that explicit, non-learned safety filtering between the scoring head and the executed trajectory deserves direct consideration in generative AD system design.