Expected Safety Impact (ESI)

• Expected Safety Impact (ESI) is a metric that quantifies how interventions change safety outcomes by comparing expected harm, crash risk, or unsafe-set volume relative to a baseline.
• It is applied across domains such as autonomous vehicles, model-based safety engineering, and LLM safety, using both surrogate and direct measures to assess risk mitigation.
• ESI formulations use probabilistic assessments, scenario-based expectations, and safe-set degradation metrics to inform design decisions and prioritize safety enhancements.

Expected Safety Impact (ESI) denotes an expected-value view of safety change: it quantifies how much a system, intervention, controller, security mechanism, or model parameter alters expected harm, crash risk, unsafe-set volume, or another safety outcome relative to a baseline. The term is explicit in recent LLM research, but closely related constructions appear earlier in model-based safety engineering, autonomous-vehicle safety reviews, safety-security validation, cyber-physical attack analysis, and virtual traffic-safety assessment. Taken together, these works suggest that ESI is best understood as a family of formally related quantities rather than a single standardized scalar (Dobi et al., 2015, Nascimento et al., 2019, Qi et al., 9 Apr 2026).

1. Core formulations

A common operationalization treats ESI as a baseline difference on a safety metric $S$. In the autonomous-vehicle safety review, a workable quantitative definition is

$$\mathrm{ESI}_{abs} = \mathbb{E}[S_{\text{baseline}}] - \mathbb{E}[S_{\text{AI}}], \qquad \mathrm{ESI}_{rel} = \frac{\mathbb{E}[S_{\text{baseline}}] - \mathbb{E}[S_{\text{AI}}]}{\mathbb{E}[S_{\text{baseline}}]}.$$

There, $S$ may be a direct safety endpoint such as crashes per $100$M VMT, fatalities, injuries, near-misses, or hazardous events, but it is often proxied by component-level quantities such as false-negative and false-positive rates in perception, time-to-collision, minimum-risk-maneuver success, or attack-detection miss rate. The same review also notes a classifier-linked decomposition

$$\mathrm{Risk} \approx p(\mathrm{FN})\cdot C_{\text{miss}} + p(\mathrm{FP})\cdot C_{\text{false alarm}},$$

and a decision-theoretic form

$$\text{Choose } a \text{ to minimize } \mathbb{E}[\mathrm{Loss}(a\mid x)] = \int \ell(a,x)\, dP(x),$$

which tie ESI to expected loss minimization (Nascimento et al., 2019).

A second formulation treats ESI as an expectation over a scenario distribution. In virtual safety assessment of pre-crash systems, the scenario space is discrete and ESI is written directly as

$$\mathrm{ESI}(g) = \mathbb{E}_{x\sim p}[g(x)] = \sum_{x\in X} g(x)p(x),$$

where $g(x)$ can be impact-speed reduction, injury-risk reduction, or crash-avoidance contribution. In safety-security validation, the same structure appears at scenario level as

$$\mathrm{ESI}(s) = \sum_{i\in \mathcal{A}(s)} P(\text{attack } i \mid s)\cdot \mathrm{Impact}(i,s),$$

with impact derived from HARA safety ratings and attack feasibility derived from TARA-like reasoning. These formulations differ in domain, but both encode expected safety consequence under a weighted scenario set (Yang et al., 2 Mar 2025, Wolschke et al., 2021).

A third formulation measures degradation of a safe operating domain. In cyber-physical systems under attack, safety is characterized by maximal admissible invariant sets, and impact is quantified by

$$I_1 = \frac{\mu_{\mathrm{vol}}(S^0)-\mu_{\mathrm{vol}}(S_{V_G})}{\mu_{\mathrm{vol}}(S^0)}, \qquad I_2 = 1-\mu_{\mathrm{Mink}}(S^0,S_{V_G}),$$

where $$\mathrm{ESI}_{abs} = \mathbb{E}[S_{\text{baseline}}] - \mathbb{E}[S_{\text{AI}}], \qquad \mathrm{ESI}_{rel} = \frac{\mathbb{E}[S_{\text{baseline}}] - \mathbb{E}[S_{\text{AI}}]}{\mathbb{E}[S_{\text{baseline}}]}.$$0 is the nominal maximal safe set and $$\mathrm{ESI}_{abs} = \mathbb{E}[S_{\text{baseline}}] - \mathbb{E}[S_{\text{AI}}], \qquad \mathrm{ESI}_{rel} = \frac{\mathbb{E}[S_{\text{baseline}}] - \mathbb{E}[S_{\text{AI}}]}{\mathbb{E}[S_{\text{baseline}}]}.$$1 is the maximal safe set under attack. In that framework, $$\mathrm{ESI}_{abs} = \mathbb{E}[S_{\text{baseline}}] - \mathbb{E}[S_{\text{AI}}], \qquad \mathrm{ESI}_{rel} = \frac{\mathbb{E}[S_{\text{baseline}}] - \mathbb{E}[S_{\text{AI}}]}{\mathbb{E}[S_{\text{baseline}}]}.$$2 is a normalized, volume-based ESI and $$\mathrm{ESI}_{abs} = \mathbb{E}[S_{\text{baseline}}] - \mathbb{E}[S_{\text{AI}}], \qquad \mathrm{ESI}_{rel} = \frac{\mathbb{E}[S_{\text{baseline}}] - \mathbb{E}[S_{\text{AI}}]}{\mathbb{E}[S_{\text{baseline}}]}.$$3 is a shape-sensitive counterpart (Vlahakis et al., 2022).

2. Safety-engineering and autonomous-vehicle foundations

A model-based precursor to later ESI formulations appears in hazard and impact analysis for safety-critical control systems. Hazards are defined at the physical interface between system and environment, impacts are modeled as outcomes such as collision with a standing vehicle, collision with an object, or injury of persons, and the workflow proceeds from faults to hazards to impacts through relational inference. The resulting expected-impact form is

$$\mathrm{ESI}_{abs} = \mathbb{E}[S_{\text{baseline}}] - \mathbb{E}[S_{\text{AI}}], \qquad \mathrm{ESI}_{rel} = \frac{\mathbb{E}[S_{\text{baseline}}] - \mathbb{E}[S_{\text{AI}}]}{\mathbb{E}[S_{\text{baseline}}]}.$$4

optionally refined into scenario-conditioned likelihoods $$\mathrm{ESI}_{abs} = \mathbb{E}[S_{\text{baseline}}] - \mathbb{E}[S_{\text{AI}}], \qquad \mathrm{ESI}_{rel} = \frac{\mathbb{E}[S_{\text{baseline}}] - \mathbb{E}[S_{\text{AI}}]}{\mathbb{E}[S_{\text{baseline}}]}.$$5, severity-weighted aggregation, and controllability adjustments derived from ISO 26262-style exposure, severity, and controllability factors. In that tradition, ESI is not merely a post hoc score; it is a quantitative layer on top of reusable hazard models, state-machine specifications, and automated FMEA-style inference (Dobi et al., 2015).

In autonomous driving, ESI emerges more explicitly as an overview target. A systematic literature review spanning 4,870 retrieved papers and 59 included studies classified the literature into six categories and found that 81% of selected studies coded AI as decreasing safety risk, while 19% coded it as increasing safety risk. The positive group was concentrated in sensors and perception, navigation and control, fault prevention, conceptual models, and human factors; the negative group concentrated in fault forecasting, ethics and policies, and dependability and trust. The review’s AV system model separates machine perception, machine control, machine actuators, the human in the loop, the vehicle platform, and the environment, with a system boundary around these components. Within that model, ESI is frequently inferred from surrogate subsystem measures rather than direct crash statistics, because many studies report detection accuracy, error rates, decision robustness, or uncertainty propagation rather than collision outcomes (Nascimento et al., 2019).

The same review shows why subsystem-level ESI can be positive while system-level ESI remains uncertain. It reports, for example, 95% turn-signal detection accuracy, 94% pedestrian-direction validation accuracy, 8.51% road-detection error for a 3D LIDAR + HOG + SVM system, and a reduction in spoofed-beacon miss rate from 24% with a Kalman filter to 11% with a particle filter, corresponding to an $$\mathrm{ESI}_{abs} = \mathbb{E}[S_{\text{baseline}}] - \mathbb{E}[S_{\text{AI}}], \qquad \mathrm{ESI}_{rel} = \frac{\mathbb{E}[S_{\text{baseline}}] - \mathbb{E}[S_{\text{AI}}]}{\mathbb{E}[S_{\text{baseline}}]}.$$6 of about 54% for missed-attack reduction. At the same time, it identifies domain shift, night and severe-weather degradation, fusion misassociation, computational constraints, verification and certification gaps for non-deterministic systems, ethical-policy uncertainty, and human-takeover failures as mechanisms that can make aggregate ESI neutral or negative if left unresolved. The review therefore frames long-run positive ESI as contingent on a “serious safety agenda” comprising safety envelopes, redundancy, explainability, fault forecasting, human-machine collaboration, and certification support (Nascimento et al., 2019).

3. Scenario-based estimation, test-track scoring, and perception-level safety

Virtual safety assessment turns ESI into a numerical integration problem over a large scenario space. For pre-crash systems, one study parameterizes each scenario by prototype event $$\mathrm{ESI}_{abs} = \mathbb{E}[S_{\text{baseline}}] - \mathbb{E}[S_{\text{AI}}], \qquad \mathrm{ESI}_{rel} = \frac{\mathbb{E}[S_{\text{baseline}}] - \mathbb{E}[S_{\text{AI}}]}{\mathbb{E}[S_{\text{baseline}}]}.$$7, off-road glance duration $$\mathrm{ESI}_{abs} = \mathbb{E}[S_{\text{baseline}}] - \mathbb{E}[S_{\text{AI}}], \qquad \mathrm{ESI}_{rel} = \frac{\mathbb{E}[S_{\text{baseline}}] - \mathbb{E}[S_{\text{AI}}]}{\mathbb{E}[S_{\text{baseline}}]}.$$8, and maximum deceleration $$\mathrm{ESI}_{abs} = \mathbb{E}[S_{\text{baseline}}] - \mathbb{E}[S_{\text{AI}}], \qquad \mathrm{ESI}_{rel} = \frac{\mathbb{E}[S_{\text{baseline}}] - \mathbb{E}[S_{\text{AI}}]}{\mathbb{E}[S_{\text{baseline}}]}.$$9, yielding 44,220 baseline scenarios with matched AEB runs. Safety impact functions are defined as

$S$0

so that ESI becomes the expectation of impact-speed reduction, injury-risk reduction, or crash avoidance over the scenario distribution. Because complete enumeration is expensive, the paper evaluates importance sampling, active sampling, adaptive sample space reduction (ASSR), stratification, and batch sampling. ASSR reduces RMSE by up to 90% when integrated into active sampling, stratification improves both importance sampling and active sampling, and when ASSR and/or stratification are used, importance sampling performs on par with active sampling (Yang et al., 2 Mar 2025).

Test-track assessment introduces a different but closely related pair of safety-impact measures. In a 2023 proving-ground campaign with twelve mass-produced vehicles and one prototype, the scoring system is split into Frequency Score (FS), interpreted as predicted reduction in real-world collision frequency, and Mitigation Power Score (MPS), interpreted as predicted reduction in collision impact energy or power. At scenario level,

$S$1

and

$S$2

Group-level scores are relevance-weighted by scenario weights derived from US and EU accident statistics. The authors do not collapse FS and MPS into a single scalar, although they note that a user-chosen convex combination could be defined. In the reported results, the prototype outperformed mass-produced vehicles on average by at least about 27% in EU FS and 20% in US FS, and by about 34% in EU MPS and 32% in US MPS. The same paper also introduces a realism metric based on a Laplace approximation around learned behavior-model parameters; the reported realism-score mean is 0.002354 with standard deviation 0.001221, and all tested scenarios were judged highly realistic (Lillo et al., 2024).

Perception-specific safety metrics show a deterministic ESI-like construction at scenario level. A 2025 perception paper defines detection safety and tracking safety as

$S$3

and combines them as

$S$4

with distance-aware IoU scaling, collision-relevance weighting based on RSS safety distances and collision severity, and a perception-time penalty based on the relation between weighted detection delay and ego braking time. The collision-relevance factor $S$5 can take the value 0 if a safety-critical, undetected vulnerable road user corresponds to a predicted impact with high probability of fatality; in that case the scenario score collapses to 0. Conceptually, this makes $S$6 an ESI-like quantity: it increases when missed detections, delayed detections, or poor localization occur for objects whose failure consequences are large (Volk et al., 16 Dec 2025).

4. Traffic operations, cooperative driving, and before-after interventions

In traffic-operations studies, ESI is often a before-after reduction in surrogate conflict counts. A microsimulation study of a V2I Road Hazard Warning system with EEBL-based gap control defines

$S$7

The near-crash warning distance is

$S$8

which evaluates to about 158.7 m under the study parameters. Using critical conflict count as the safety metric, the study reports 5 threshold-exceeding events at 0% penetration and 2 at 100% penetration, yielding an absolute ESI of 3 avoided severe near-misses and a relative ESI of 60%. The same study reports declining TIT and crash counts as penetration increases, together with higher average network speed and shorter upstream queues (Porfyri et al., 2020).

For tightly coupled connected and automated vehicle platoons, ESI is tied to emergency-braking exposure under communication loss. A stochastic MPC framework with Model-Based Communication and Gaussian Process Regression defines safety through hard spacing constraints, emergency-braking mode activation when $S$9, bounded acceleration, and bounded input-rate change. Under ideal communication, a predecessor-following topology with $100$0 s operated without emergency braking. Under packet loss, increasing the information-flow topology from one-look-ahead to nine-look-ahead reduced the total emergency-braking duration across a 10-vehicle platoon by 30% at packet error rate 0.6. The paper explicitly treats this reduction in emergency-braking duration as the main reported safety gain (Razzaghpour et al., 2022).

Before-after road-safety intervention studies yield another ESI operationalization through extreme-value theory. For Leading Pedestrian Interval treatment, the lower tail of Post-Encroachment Time is modeled with a POT-GPD, and the treatment effect enters the GPD scale parameter as $100$1, with $100$2 before and $100$3 after treatment. Negative $100$4 implies a thinner lower tail and therefore a reduction in very small PET values. At treated sites, the reported logistic Markov-chain model yields large modeled reductions in conditional near-miss probability: for PET $100$5 s, reductions are approximately 84% to 99% across the reported treated examples, and for PET $100$6 s, approximately 62% to 90%. By contrast, a control-like site with $100$7 credible interval covering 0 shows only about 3.6% reduction at 2 s and 9.9% at 1 s. In this setting, ESI is an expected reduction in lower-tail conflict probability rather than a direct crash count (Hewett et al., 2023).

5. Security, assurance, and safe-set degradation

Safety-security co-engineering introduces ESI at the interface between threat analysis and functional safety. SaSeVAL defines “safety impact” as the consequence on functional safety when a cybersecurity violation occurs, explicitly tying threats to safety goals from ISO 26262 HARA and identifying the traffic situations with highest expected impact. Its scenario-level formalization is

$100$8

with impact linked to severity, exposure, controllability, and countermeasure effectiveness. The workflow proceeds through threat identification, safety-concern identification, and attack-description generation, while maintaining explicit traceability from safety goals to threats to attacks. In reported use cases, the method yielded 23 attack descriptions linked to safety goals for RSU-OBU communication and 27 safety-impacting attacks plus 2 privacy-related attacks for a BLE keyless opener, emphasizing that ESI can be used to prioritize testing depth and identify highest-impact traffic situations (Wolschke et al., 2021).

A more formal safe-set interpretation appears in constrained switching models of cyber-physical systems under stealthy attack. There, the closed-loop plant, estimator, attack channels, detector acceptance region, and switching logic are embedded in a constrained switching system whose admissible attack set is state-dependent. Safety is defined asymptotically through maximal admissible invariant multi-sets; nominal and attacked maximal safe sets satisfy $100$9. The two impact metrics

$$\mathrm{Risk} \approx p(\mathrm{FN})\cdot C_{\text{miss}} + p(\mathrm{FP})\cdot C_{\text{false alarm}},$$0

then quantify degradation of safety under attack. In that framework, tighter residual-acceptance regions reduce the admissible stealthy-attack set, enlarge the attacked maximal safe set, and lower ESI; looser detector regions do the opposite. The paper’s two-tank example shows monotonic increase of both impact metrics with attacker dwell time and larger degradation for actuator attacks than for sensor attacks (Vlahakis et al., 2022).

These security-oriented formulations broaden ESI beyond “safety improvement” alone. They treat ESI as a quantity that can increase under attack, decrease under mitigation, or shift across scenarios as architecture, countermeasures, and exposure assumptions change. In this sense, ESI is not intrinsically beneficial or adverse; it is a signed or directional measure whose interpretation depends on the chosen baseline and safety quantity (Wolschke et al., 2021, Vlahakis et al., 2022).

6. LLM safety, terminology, and methodological issues

The most explicit recent use of the term appears in LLM safety. One paper defines an expected safety value

$$\mathrm{Risk} \approx p(\mathrm{FN})\cdot C_{\text{miss}} + p(\mathrm{FP})\cdot C_{\text{false alarm}},$$1

and then defines per-parameter Expected Safety Impact as

$$\mathrm{Risk} \approx p(\mathrm{FN})\cdot C_{\text{miss}} + p(\mathrm{FP})\cdot C_{\text{false alarm}},$$2

The gradient is estimated with a differentiable safety judge, Gumbel-Softmax token relaxation, and a tokenizer-projection matrix. This ESI reveals architecture-dependent concentration of safety-critical parameters: in dense models, many lie in value matrices and MLPs in middle layers, whereas in MoE models they shift to late-layer MLPs. The same paper proposes Safety Enhancement Tuning (SET), which updates only the top safety-critical parameters, and Safety Preserving Adaptation (SPA), which freezes them during task fine-tuning. Reported results include attack-success-rate reductions of over 50% with only a 100-iteration update on 1% of model weights for SET, and safety degradation limited within 1% after a 1,000-iteration instruction fine-tuning for SPA (Qi et al., 9 Apr 2026).

A related LLM paper reframes safety evaluation itself around expected harm:

$$\mathrm{Risk} \approx p(\mathrm{FN})\cdot C_{\text{miss}} + p(\mathrm{FP})\cdot C_{\text{false alarm}},$$3

with the safety-centric instantiation

$$\mathrm{Risk} \approx p(\mathrm{FN})\cdot C_{\text{miss}} + p(\mathrm{FP})\cdot C_{\text{false alarm}},$$4

Here execution likelihood is modeled as a decreasing function of execution cost, and usefulness can be used as an actionability gate. The central empirical claim is “Inverse Risk Calibration”: models refuse high-cost, low-likelihood threats more strongly than low-cost, high-likelihood threats. Exploiting that miscalibration with cost-based decomposition increases attack success rate by up to $$\mathrm{Risk} \approx p(\mathrm{FN})\cdot C_{\text{miss}} + p(\mathrm{FP})\cdot C_{\text{false alarm}},$$5, while linear probing suggests that models encode severity but do not form a distinguishable internal representation of execution cost (Chen et al., 2 Feb 2026).

The acronym is not globally stable. In a crash-severity study comparing SAE Level 2 and Level 4 automation, ESI denotes an Expected Injury Severity Index rather than Expected Safety Impact, defined as

$$\mathrm{Risk} \approx p(\mathrm{FN})\cdot C_{\text{miss}} + p(\mathrm{FP})\cdot C_{\text{false alarm}},$$6

Using weights $$\mathrm{Risk} \approx p(\mathrm{FN})\cdot C_{\text{miss}} + p(\mathrm{FP})\cdot C_{\text{false alarm}},$$7 for no injury, minor injury, and moderate/severe injury, the study reports baseline sample values of about 0.23 for the ADAS crashes and 0.50 for the ADS crashes, while cautioning that the operating environments differ sharply and that the result should not be treated as a direct performance ranking. This acronym reuse is important because it shows that “ESI” can name distinct but structurally related expected-value constructs even within transportation safety (Ding et al., 2023).

Across domains, several methodological issues recur. First, many studies infer ESI from surrogate measures rather than direct harm endpoints; the autonomous-vehicle review explicitly states that confidence is moderate at component level and lower at system and certification levels because many studies lack direct crash or incident metrics (Nascimento et al., 2019). Second, ESI depends strongly on scenario weighting, exposure modeling, and countermeasure assumptions, whether through $$\mathrm{Risk} \approx p(\mathrm{FN})\cdot C_{\text{miss}} + p(\mathrm{FP})\cdot C_{\text{false alarm}},$$8 in virtual assessment, $$\mathrm{Risk} \approx p(\mathrm{FN})\cdot C_{\text{miss}} + p(\mathrm{FP})\cdot C_{\text{false alarm}},$$9 in test-track aggregation, HARA/TARA mappings in safety-security analysis, or execution-likelihood calibration in LLM safety (Yang et al., 2 Mar 2025, Lillo et al., 2024, Wolschke et al., 2021, Chen et al., 2 Feb 2026). Third, the most useful interpretation is usually comparative: ESI becomes informative when the baseline, operational design domain, scenario distribution, and severity model are all made explicit.