AgentFormer: Joint Multi-Agent Trajectory Forecasting

• The paper introduces AgentFormer, which jointly models temporal and social dynamics in multi-agent trajectory forecasting using a transformer architecture.
• It employs a sequence representation combined with an agent-aware attention mechanism and a CVAE to capture multi-modal future intents.
• Empirical results show superior performance over decoupled approaches, though the model exhibits vulnerabilities to adversarial input perturbations.

AgentFormer is a Transformer-based architecture designed for the joint forecasting of multiple interacting agent trajectories in dynamic environments. It addresses both the temporal evolution of individual agent states and their intricate social dependencies, enabling accurate and multi-modal prediction for platforms such as autonomous vehicles and pedestrian motion analysis. The innovation centers on a sequence modeling framework that incorporates agent identity through a novel attention mechanism and leverages conditional variational autoencoding to capture future intent uncertainties. Empirical results across standard benchmarks demonstrate superior performance over prior decoupled approaches. Recent analysis has further investigated AgentFormer’s robustness and susceptibility to adversarial input perturbations, revealing potential security risks for downstream planning systems.

1. Problem Formulation and Motivation

Multi-agent trajectory forecasting aims to predict the future positions of $N$ agents over a time horizon $T$, conditioned on their observed histories $X = \{X^t\}_{t=-H}^0$, where $X^t = (x_1^t, \ldots, x_N^t)$, $x_n^t \in \mathbb{R}^{d_s}$, and target futures $Y = \{Y^t\}_{t=1}^T$, $Y^t = (y_1^t, \ldots, y_N^t)$, $y_n^t \in \mathbb{R}^{d_p}$. Two interacting axes are central:

• Time dimension: modeling the influence of past agent states on future states.
• Social dimension: modeling how the state and intents of one agent affect others.

Traditional models typically separate these axes, applying a temporal model (e.g., LSTM or Transformer) per agent followed by a social module (e.g., GCN), or vice versa. This separation can obscure fine-grained, cross-agent, cross-time dependencies, such as one agent's sudden maneuver prompting another's evasive action at a different future time. AgentFormer addresses this by jointly modeling both axes through a flattened sequence representation of all agent trajectories and employs an attention mechanism that tracks agent identities to maintain permutation invariance (Yuan et al., 2021).

2. Sequence Representation and Agent-Aware Attention

The data is represented as a sequence $X_{seq}$ of length $L_p = N \times (H+1)$ by concatenating the time-indexed states of all agents: $$X_{seq} = (x_1^{-H},...,x_N^{-H},...,x_1^0,...,x_N^0)$$. Temporal encoding is achieved by augmenting each element $x_n^t$ with a sinusoidal timestamp $\tau_n^t \in \mathbb{R}^{d_\tau}$, projected with learnable matrices to a joint embedding space.

Agent identity is preserved using a mask applied at the attention stage, rather than fixed index-based embeddings. The attention mechanism separately computes intra-agent (“self”) and inter-agent (“other”) compatibility: $$\begin{align*} Q_{self} &= Q W_{self}^Q,\quad K_{self} = K W_{self}^K,\ Q_{other} &= Q W_{other}^Q, \quad K_{other}= K W_{other}^K,\ A &= M \circ (Q_{self} K_{self}^\top) + (1 - M) \circ (Q_{other} K_{other}^\top),\ \text{Att}(Q,K,V) &= \operatorname{softmax}\left(\frac{A}{\sqrt{d_k}}\right) V, \end{align*}$$ where $M_{ij} = 1$ if agent$(i)=$agent$(j)$ and $0$ otherwise. This mechanism enables token-wise, identity-aware attention across all agent-time pairs (Yuan et al., 2021).

3. Stochastic Trajectory Prediction and Training

To capture multi-modal futures, AgentFormer employs a Conditional Variational Autoencoder (CVAE) formulation with agent-specific latent intents $Z = \{z_1,...,z_N\}$, $z_n \in \mathbb{R}^{d_z}$: $$p_\theta(Y|X) = \int p_\theta(Y|Z,X) p_\theta(Z|X) dZ,$$ where $p_\theta(Z|X)$ is a diagonal Gaussian prior (with learnable parameters from $X$) and $q_\phi(Z|Y,X)$ is the variational posterior. Training minimizes the negative evidence lower bound (ELBO): $$\mathcal{L}_{elbo} = -\mathbb{E}_{q_\phi(Z|Y,X)}[\log p_\theta(Y|Z,X)] + \operatorname{KL}(q_\phi(Z|Y,X)\,||\,p_\theta(Z|X)),$$ with $p_\theta(Y|Z,X)$ modeled as a Gaussian with fixed variance. Both encoder/decoder and posterior inference are realized via stacks of agent-aware Transformer blocks. A “variety loss” (minimum-over-$K$ MSE) and sampler diversity penalty further encourage mode coverage. Network details include Transformer depths of two, $d_k=d_q=d_\tau=256$, transformer inner dimension $=512$, $8$ attention heads, and $d_z=32$ (Yuan et al., 2021).

4. Empirical Performance, Ablation, and Limitations

Evaluation is conducted on ETH/UCY (pedestrian) and nuScenes (autonomous driving) datasets with minADE$_K$ and minFDE$_K$ as metrics. AgentFormer achieves competitive or superior results relative to prior work:

Dataset	Metric	AgentFormer	Trajectron++
ETH/UCY (K=20)	ADE/FDE	0.23 m/0.39 m	0.19 m/0.41 m
nuScenes (K=5)	ADE$_5$	1.86 m	1.88 m
""	FDE$_5$	3.89 m	(not shown)

Ablation studies indicate that separating social and temporal modeling (e.g., GCN+LSTM), removing agent-aware attention (“w/o AA”), or discarding the joint latent (“w/o joint latent”) each produce 10–15% drops in performance and degrade long-horizon accuracy (Yuan et al., 2021).

Key limitations identified are the quadratic cost of full attention (with respect to $N\times T$ sequence length), which is mitigated by moderate $N,T$ in standard benchmarks, and slower inference due to an autoregressive decoding head.

5. Model Robustness and Adversarial Vulnerabilities

Recent sensitivity analysis demonstrates that AgentFormer is highly sensitive to perturbations, particularly in the most recent position and velocity inputs. The mean percent-error increase in ADE across all features is approximately 12,573%, dominated by these current state perturbations. Quartiles for sensitivity (using a Yeo–Johnson transformed scale to accommodate heavy tails) highlight the contrast:

Feature Type	Q₁ (25%)	Median (50%)	Q₃ (75%)
Past positions and velocities	~200%	~1,200%	~8,000%
Map image $C_t$	~5%	~20%	~135%

A notable finding is that pixel-level adversarial attacks on $C_t$—using Fast Gradient Sign Method (FGSM) with $\epsilon=0.01$—yield median ADE increases of ≈17.3% and up to ≈112% for $\epsilon=0.1$ (Gibson et al., 2024).

6. Implications for Safety, Planning, and Defense

FGSM-induced perturbations of the HD map can cause significant degradation in prediction quality—for example, increasing ADE from 0.097 m to 1.043 m (a 974% jump) in one scene, and up to 26.52 m in extreme cases. When AgentFormer’s impaired predictions are coupled to a trajectory optimization-based planner subject to minimum distance constraints, these errors cause downstream failures such as a sudden stop in autonomous vehicle motion—demonstrated by the planner’s inability to safely advance except by remaining stationary.

Recommended defenses against such vulnerabilities include adversarial training or certified defenses on map-CNN backbones, removing non-robust image features, cross-validating predicted trajectories with reachability or occupancy-grid constraints, and employing sensor fusion pipelines that do not expose raw map pixels directly to the prediction module (Gibson et al., 2024). This line of work highlights AgentFormer’s transformer-based latent-variable generator as a potential security-critical adversarial target.

7. Future Directions

Open challenges include the computational complexity associated with full sequence attention, the need for faster inference—potentially via sparse or non-autoregressive architectures—and enhanced adversarial robustness both at the input-processing and model level. Exploration of dynamic graph induction, rather than rule-based masking for agent connectivity, remains an open avenue for further improving socio-temporal modeling capacity. Comprehensive validation under a broader set of adversarial scenarios and unstructured environments is critical for deploying AgentFormer-like predictors in real-world, safety-critical systems (Yuan et al., 2021, Gibson et al., 2024).