Adversarial Trajectory Planning

• Adversarial trajectory planning is a framework for designing motion plans that explicitly account for worst-case uncertainties using min–max formulations and game-theoretic models.
• It employs techniques like adversarial learning, distributionally robust MPC, and sensor fusion to mitigate risks and ensure reliability in dynamic, multi-agent environments.
• The approach secures autonomous systems by integrating rigorous mathematical guarantees with practical defenses against stealthy and adaptive adversarial attacks.

Adversarial trajectory planning is the design, analysis, or manipulation of motion plans and predictive models under worst-case, deceptive, or actively malicious uncertainty. While classical trajectory planning assumes either benign stochastic disturbances or static obstacles, adversarial frameworks explicitly account for agents or environments that anticipate, manipulate, or disrupt the planning process to cause failures, degrade system performance, or reveal vulnerabilities. Adversarial trajectory planning spans core areas such as robust optimal control, game theory, adversarial machine learning, and formal verification, and is central to the safety, reliability, and security of autonomous robots and vehicles deployed in contested or multi-agent settings.

1. Mathematical Foundations and Formalizations

Adversarial trajectory planning can be characterized by its explicit min–max (or max–min) mathematical structure, in which a planner (agent) seeks an optimal motion sequence, while an adversary simultaneously chooses disturbances, environmental changes, or attacks to maximize disruption, induce unsafe behavior, or reveal critical brittleness.

Common formulations include:

• Zero-sum games over path distributions: The planner defines a (possibly stochastic) strategy over feasible paths in a graph or continuous domain, while the adversary selects actions (e.g., ambush locations, spoofed sensor readings, obstacles) to maximize risk or detection error. This yields a linear program or saddle-point QP for mixed-strategy computation (Boidot et al., 2012, Virga et al., 2018).
• Min–max optimal control: The agent chooses an input sequence $(u_0, \ldots, u_{T-1})$ to minimize a cost $J$, while the adversary selects disturbances or uncertainty transitions from a constrained set to maximize $J$. Distributionally robust variants constrain adversarial behavior to a known ambiguity set (e.g., p-Wasserstein ball) (Jesawada et al., 26 Mar 2025).
• Adversarial learning on data-driven cost surfaces: A learned discriminator $D_\theta$ separates natural from artificial trajectories and defines intrinsic costs; the planner solves for trajectories indistinguishable from real ones, creating a min–max adversarial learning loop embedded within classical sampling-based planners such as RRT* (Virga et al., 2018).
• Game-theoretic safety analysis: For systems where collisions or unsafe conditions are catastrophic, adversarial disturbances (such as unknown road curvature) are modeled as worst-case players in a reach-avoid or safety game, with viability theory and discriminating domains providing guarantees (Liniger et al., 2020, 1711.02540).

These mathematically rigorous frameworks enable guarantees on safety, robustness, and performance even in the face of strong, possibly strategic, uncertainty.

2. Adversarial Attacks on Trajectory Prediction and Perception

A major research area focuses on exploiting vulnerabilities in data-driven trajectory prediction and perception modules, especially those based on deep neural networks (DNNs). Adversarial trajectory attacks craft small, carefully optimized perturbations to agent histories, sensor readings, or ego-motion estimates to induce maximal prediction errors, force unsafe plans, or cause critical detection failures:

• Input-trajectory attacks: By optimizing perturbations to the observed state histories (e.g., $1$m-bounded changes to past positions), adversaries can cause learned predictors to generate highly erroneous or even user-chosen targeted paths—a phenomenon demonstrated against models like Grip++ and Trajectron++ with ADE/FDE degradation exceeding 100% (Zhang et al., 2022, Tan et al., 2022, Yin et al., 2024).
• Physically-constrained and stealthy attacks: Attack algorithms enforce feasibility and naturalness by bounding kinematic derivatives (velocity, acceleration, jerk) and spatial deviations to ensure resultant trajectories remain realistic—thus bypassing naive statistical anomaly detectors and remaining stealthy in traffic scenes (Tan et al., 2022, Yin et al., 2024).
• Perception-side attacks via ego-trajectory spoofing: In LiDAR-based systems, small adversarial perturbations to the vehicle's estimated trajectory (e.g., via GNSS spoofing) can distort motion-compensated point clouds and blind 3D object detection networks, with backdoor effects transferable across detector architectures. Smoothness is enforced by polynomial parameterization of trajectory perturbations (Li et al., 2021).
• Targeted adversarial attacks: Extensions such as TA4TP solve constrained nonlinear programs to force predictors to output user-specified target futures, subject to lane-keeping, collision avoidance, and dynamic feasibility, exposing the brittleness of state-of-the-art forecasting models (Tan et al., 2022).

Empirical findings highlight both the significant increase in prediction error, miss rate, and downstream unsafe AV maneuvers, as well as the partial effectiveness of data augmentation, input smoothing, and adversarial training defenses (Zhang et al., 2022).

3. Game-Theoretic Approaches and Safe Planning under Active Adversaries

Game-theoretic adversarial trajectory planning extends classical control by considering other agents or the environment as explicit strategic adversaries:

• Worst-case scenario generators for vehicle safety testing: Online feedback control policies synthesize principal other vehicle (POV) behaviors that adapt in real time to the subject vehicle (SV), forcing safety-critical outcomes (e.g., collisions, imminent braking) by solving minimax quadratic programs or receding-horizon tracking problems. The anchor–template hierarchy enables real-vehicle closed-loop execution (Capito et al., 2020).
• Hamilton–Jacobi reachability and sequential trajectory planning: In multi-vehicle systems, the problem of provable safety against adversarial intruders is solved by decomposing the high-dimensional reach-avoid game into a sequence of single-agent backward reachable sets (BRS) and forward reachable sets (FRS), leveraging spatial separation and buffer regions. The number of vehicles requiring online replanning is bounded by a user-defined parameter, ensuring scalability (1711.02540).
• Objective-space planning and intent inference: Abstractions into low-dimensional objective spaces (e.g., aggressiveness, defensiveness) and the use of counterfactual regret minimization (CFR) with function approximation support aggressive racing and multi-agent gaming with interpretable, generalizable adversarial strategies (Zheng et al., 2022).

These frameworks enable efficient computation of robust motion plans, adaptive online attacks/defenses, and strong safety or capture guarantees even with multiple adversarial agents or unknown disturbances.

4. Robustness, Distributional Ambiguity, and Certifiable Guarantees

Distributionally robust trajectory planning incorporates structured uncertainty sets to explicitly guarantee safety and performance under adversarial model mismatch:

• Distributionally robust model-predictive control (DR-MPC): Algorithms such as DR-PETS augment ensemble-based model learning (PETS) with robust optimization over Wasserstein balls in model space. Using convex duality and gradient-norm regularization, planning is performed with certificates against adversarial parameter perturbations—guaranteeing bounded degradation in cost or reward even under worst-case plausible model shifts (Jesawada et al., 26 Mar 2025).
• Viability and discriminating kernels: Adversarial road models define safe sets in curvilinear coordinates using viability theory and discriminating domains, with exact or neural-approximated terminal constraints ensuring that the planning agent remains within the provably controlled invariant set for any allowable adversarial disturbance (such as road curvature) (Liniger et al., 2020).

Empirical studies demonstrate that these robustification procedures can preserve or even enhance system functionality under adversarial or worst-case variations, as evidenced in control of cart-pole and pendulum systems, short-horizon autonomous driving, and anti-jamming UAV missions (Jesawada et al., 26 Mar 2025, Liniger et al., 2020, Krayani et al., 5 Dec 2025).

5. Security, Sensor Fusion, and Defensible Trajectory Design

The interplay between adversarial trajectory planning and system security is highlighted by studies on sensor spoofing and multi-sensor fusion:

• Undetectable spoofing and secure trajectories: In settings where the adversary can spoof certain sensor channels (e.g., GNSS), but not others (e.g., RSSI), explicit geometric and algebraic conditions characterize the existence of stealthy attacks, as well as the class of secure control laws (maximal radial thrust) that guarantee any deviation is either impossible or detectable (Liu et al., 2019). Secure trajectories may be suboptimal and severely limit reachable states, but offer provable defense.
• Sensor fusion for attack detection: Attacks on perception can be mitigated by monitoring residuals between IMU/odometry and GNSS estimation, cross-verifying LiDAR SLAM poses, or systematically checking trajectory smoothness and consistency (Li et al., 2021). Certified detectors are constructed by bounding worst-case perturbations and training neural networks to recognize deskewing-induced artifacts.

These results elucidate both the avenues for stealthy, physically plausible adversarial manipulation and the system- and algorithm-level defenses needed to achieve robustness in cyber-physical systems.

6. Research Trends, Benchmarks, and Open Problems

Adversarial trajectory planning continues to evolve, with key trends and emerging research lines including:

• Incremental adversarial learning: Joint adversarial training of planners and discriminators, as in incremental adversarial learning on RRT*, yields trajectories with implicit, data-driven behaviors (e.g., human likeness, collision avoidance) that generalize beyond explicit cost functions (Virga et al., 2018).
• Stochastic planning under repeated interaction: Mixed-strategy planners computed via LPs with high entropy are maximally deceptive in repeated adversarial settings (e.g., ambush games), bounding the upper tail risk of detection or loss, in contrast to deterministic planners whose risk accumulates over time (Boidot et al., 2012).
• Hierarchical anti-jamming and active inference: Bayesian active inference frameworks embed symbolic, motion, and signal models hierarchically, enabling UAVs to infer jammer locations and adapt trajectories without prior knowledge, maintaining near-expert efficiency and low mission cost (Krayani et al., 5 Dec 2025).
• Practical benchmarks and transfer to real systems: The most advanced frameworks have been validated in photo-realistic simulators (CARLA), physical mini-vehicle racing, and public datasets (nuScenes, Apolloscape), with results consistently exposing vulnerabilities in current planning and perception stacks while illuminating the potential for robustification.

Open challenges remain in scaling these methods to high-dimensional, long-horizon tasks; developing efficient, certifiable defenses for learned models; and integrating intent prediction and multi-agent reasoning into adversarial planning frameworks.

---

Comparative Summary Table: Representative Approaches

Approach / Reference	Adversary Type / Attack Surface	Guarantee/Goal	Methodology
(Boidot et al., 2012)	Mixed strategy ambusher (graph env.)	Min–max risk over path distr.	LP, high-entropy solutions
(Virga et al., 2018)	Implicit behavior discriminator	Human-like / safe trajectories	GAN-inspired adversarial learning with RRT*
(Tan et al., 2022)	Targeted input attack (DNN predictor)	Target DNN to predict desired path	Constrained nonlinear opt.
(Capito et al., 2020)	Adaptive POVs vs. subject vehicle	Safety-critical scenario generation	Min–max receding horizon QP
(Liniger et al., 2020)	Road model as adversary (curvature)	Safe sets, short-horizon robust driving	Viability/discriminating kernel
(1711.02540)	Adversarial intruder (multi-agent)	Multi-agent collision avoidance	Sequential reachability & buffer regions
(Jesawada et al., 26 Mar 2025)	Model perturbation in PETS MPC	Worst-case cert. against ambiguity	Duality-based robustification

Adversarial trajectory planning constitutes a core pillar of reliable autonomy, bridging robust optimization, learning, and security to address safety and resilience under adversarial risk. The field continues to unify rigorous mathematical guarantees with practical, data-driven, and scalable defense and attack strategies across a growing spectrum of safety-critical domains.