pith. sign in

arxiv: 2606.28716 · v1 · pith:ZJZKPXWPnew · submitted 2026-06-27 · 💻 cs.AI

TrajRS: Towards Certified Robustness in Pedestrian Trajectory Prediction

Liang Zhang , Gaojie Jin , Yao Shi , Quanzhi Li , Cheng-Chao Huang , David N. Jansen , Lijun Zhang This is my paper

Pith reviewed 2026-06-30 09:57 UTC · model grok-4.3

classification 💻 cs.AI
keywords certified robustnessrandomized smoothingtrajectory predictionpedestrian trajectoryadversarial robustnessautonomous drivingTrajRS
0
0 comments X

The pith

TrajRS extends randomized smoothing to give certified robust radii for trajectory predictors.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper seeks to move trajectory prediction for autonomous driving from heuristic defenses to verifiable safety guarantees. It adapts the randomized smoothing method into a scheme called TrajRS that computes a certified radius within which the smoothed predictor remains robust. The work supplies formal definitions of robustness both for the single optimal prediction and for every possible prediction, then shows how the smoothing procedure can be applied while retaining the original certification guarantees. A reader would care because adversarial attacks on path forecasts can produce dangerous driving decisions, and certified radii offer a concrete, checkable bound rather than empirical robustness claims.

Core claim

The central claim is that randomized smoothing can be extended to trajectory predictors via TrajRS to produce a certified robust radius for smoothed models. The extension preserves certification under two tailored robustness notions: robustness for the optimal prediction and robustness for all possible predictions. Experiments confirm that the method yields such radii for all smoothed pedestrian trajectory predictors examined in the study.

What carries the argument

TrajRS, the adaptation of randomized smoothing that supplies certified robust radii for trajectory predictors under the paper's definitions of robustness for the optimal prediction and for all predictions.

If this is right

  • Smoothed trajectory predictors receive explicit, provable radii of robustness against input perturbations.
  • The certification applies separately to the single best prediction and to the full set of possible predictions.
  • Heuristic defenses are replaced by a method that supplies verifiable safety assurances for pedestrian trajectory models.
  • The approach is shown to work across the smoothed predictors tested in the experiments.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • If the radii prove tight in practice, autonomous driving stacks could incorporate TrajRS as a safety filter before path execution.
  • The same smoothing technique might transfer to other sequential prediction tasks such as vehicle or drone trajectories.
  • Tighter bounds or faster certification could be obtained by combining TrajRS with domain-specific noise distributions for trajectory data.

Load-bearing premise

Randomized smoothing can be directly extended to trajectory prediction models while preserving its certification guarantees under the paper's new robustness definitions for optimal and all predictions.

What would settle it

A concrete adversarial perturbation larger than the reported certified radius that nevertheless changes the output of the smoothed trajectory predictor under either the optimal-prediction or all-predictions robustness definition.

read the original abstract

The robustness of trajectory prediction models is crucial for developing safe autonomous driving systems. Adversarial attacks on trajectory prediction can significantly impair the accuracy of predicted trajectories, leading to hazardous driving behaviors. While heuristic defense strategies have been implemented to enhance the robustness of trajectory prediction models, these measures often fail against more sophisticated, targeted adversarial attacks. Hence, there is a pressing need to establish verifiable safety assurances for trajectory prediction models. In this paper, we extend the traditional Randomized Smoothing framework to "TrajRS", which provides a certified robust radius for smoothed trajectory predictors. We clarify and expand the formal definitions of robustness in trajectory prediction and tailor the practical TrajRS scheme specifically to "robustness for the optimal prediction" and "robustness for all possible predictions". An extensive set of experiments demonstrates that TrajRS effectively achieves robustness certification for all smoothed pedestrian trajectory predictors in this work.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Referee Report

2 major / 2 minor

Summary. The paper extends randomized smoothing to TrajRS for certified robustness in pedestrian trajectory prediction. It introduces two robustness definitions (for the optimal prediction and for all possible predictions), tailors the smoothing procedure to each, and reports experiments showing that TrajRS certifies radii for the smoothed predictors tested.

Significance. If the certification bounds are correctly derived, the work would supply the first formal, verifiable safety radii for trajectory predictors, addressing a clear gap between heuristic defenses and the safety requirements of autonomous driving. The empirical evaluation across multiple predictors strengthens the practical relevance.

major comments (2)
  1. [§4] §4 (Certification for robustness for all possible predictions): the manuscript must derive an explicit lower bound on the measure of outputs that remain inside the ε-ball under the chosen noise distribution; the standard Neyman-Pearson argument for discrete top-label certification does not transfer automatically to continuous trajectory sequences, and this step is load-bearing for the central claim.
  2. [Definition 3] Definition 3 (robustness for all possible predictions): the formal statement requires that every plausible output trajectory (not merely the mode) stays within ε; the paper should state whether the certified radius is obtained by a single global bound or by a per-trajectory analysis, and how the probability is computed in the continuous case.
minor comments (2)
  1. [Experiments] The experimental section should report the exact noise variance schedule and the number of Monte-Carlo samples used to estimate the certified radii for each robustness notion.
  2. [Preliminaries] Notation for the trajectory output space (continuous sequences) should be introduced once and used consistently when contrasting the two robustness definitions.

Simulated Author's Rebuttal

2 responses · 0 unresolved

We thank the referee for the detailed and constructive comments. The points raised highlight important aspects of the continuous-output certification that we will clarify. We respond to each major comment below.

read point-by-point responses

  1. Referee: [§4] §4 (Certification for robustness for all possible predictions): the manuscript must derive an explicit lower bound on the measure of outputs that remain inside the ε-ball under the chosen noise distribution; the standard Neyman-Pearson argument for discrete top-label certification does not transfer automatically to continuous trajectory sequences, and this step is load-bearing for the central claim.

    Authors: We agree that the discrete Neyman-Pearson lemma does not transfer directly and that an explicit lower bound is required. In §4 we adapt the smoothing argument to the continuous trajectory space by bounding the measure of outputs inside the ε-ball via the Gaussian noise density and a concentration inequality (Hoeffding-type) on the Monte-Carlo estimate of that measure. The current text presents the final radius expression but does not isolate the lower-bound derivation as a standalone lemma. We will add this explicit derivation, including the precise statement of the bound and the conditions under which it holds, to the revised §4. revision: yes

  2. Referee: [Definition 3] Definition 3 (robustness for all possible predictions): the formal statement requires that every plausible output trajectory (not merely the mode) stays within ε; the paper should state whether the certified radius is obtained by a single global bound or by a per-trajectory analysis, and how the probability is computed in the continuous case.

    Authors: Definition 3 indeed requires the property to hold for every plausible output. The radius for this notion is obtained by a per-trajectory analysis: for each sampled trajectory we estimate (via Monte-Carlo) the probability that a noisy output remains inside its own ε-ball, then take the worst-case radius over the sampled set. In the continuous setting this probability is approximated by sampling from the smoothed distribution; we supply a concentration bound on the estimation error. The manuscript states the definition but does not explicitly contrast the per-trajectory procedure with a global bound. We will add a clarifying paragraph immediately after Definition 3 that describes the per-trajectory computation and the Monte-Carlo procedure used in the continuous case. revision: yes

Circularity Check

0 steps flagged

No circularity: TrajRS extends standard randomized smoothing via new definitions without reducing to fitted inputs or self-citations

full rationale

The paper's central claim is an extension of the established randomized smoothing framework (Neyman-Pearson style certification under isotropic noise) to continuous trajectory outputs by introducing two new robustness definitions and tailoring the practical scheme. The abstract and description provide no equations or steps that equate the certified radius to a fitted parameter by construction, nor any load-bearing self-citation chain. The derivation is presented as building on external RS results with independent tailoring for the new output space, making the certification claim self-contained against external benchmarks rather than tautological.

Axiom & Free-Parameter Ledger

0 free parameters · 0 axioms · 0 invented entities

No details available from abstract to populate free parameters, axioms, or invented entities.

pith-pipeline@v0.9.1-grok · 5693 in / 990 out tokens · 28102 ms · 2026-06-30T09:57:53.978437+00:00 · methodology

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

37 extracted references · 3 canonical work pages · 1 internal anchor

  1. [1]

    Non- probability sampling network for stochastic human trajectory prediction,

    Inhwan Bae, Jin-Hwi Park, and Hae-Gon Jeon, “Non- probability sampling network for stochastic human trajectory prediction,” inCVPR, 2022, pp. 6477–6487

    2022

  2. [2]

    Social-stgcnn: A social spatio-temporal graph convolutional neural network for human trajectory prediction,

    Abduallah Mohamed, Kun Qian, Mohamed Elhoseiny, et al., “Social-stgcnn: A social spatio-temporal graph convolutional neural network for human trajectory prediction,” inCVPR, 2020, pp. 14424–14432

    2020

  3. [3]

    Socialmoif: Multi- order intention fusion for pedestrian trajectory prediction,

    Kai Chen, Xiaodong Zhao, Yujie Huang, Guoyu Fang, Xiao Song, Ruiping Wang, and Ziyuan Wang, “Socialmoif: Multi- order intention fusion for pedestrian trajectory prediction,” in CVPR, 2025, pp. 22465–22475

    2025

  4. [4]

    Moflow: One-step flow matching for human trajectory fore- casting via implicit maximum likelihood estimation based dis- tillation,

    Yuxiang Fu, Qi Yan, Lele Wang, Ke Li, and Renjie Liao, “Moflow: One-step flow matching for human trajectory fore- casting via implicit maximum likelihood estimation based dis- tillation,” inCVPR, 2025, pp. 17282–17293

    2025

  5. [5]

    Multi-modal knowledge distillation-based human trajectory forecasting,

    Jaewoo Jeong, Seohee Lee, Daehee Park, Giwon Lee, and Kuk- Jin Yoon, “Multi-modal knowledge distillation-based human trajectory forecasting,” inCVPR, 2025, pp. 24222–24233

    2025

  6. [6]

    Tsc-net: Prediction of pedestrian trajectories by trajectory-scene-cell classification,

    Bo Hu and Tat-Jen Cham, “Tsc-net: Prediction of pedestrian trajectories by trajectory-scene-cell classification,” inICLR, 2025

    2025

  7. [7]

    Interac- tive adjustment for human trajectory prediction with individual feedback,

    Jianhua Sun, Yuxuan Li, Liang Chai, and Cewu Lu, “Interac- tive adjustment for human trajectory prediction with individual feedback,” inICLR, 2025

    2025

  8. [8]

    Enduring, efficient and robust trajec- tory prediction attack in autonomous driving via optimization- driven multi-frame perturbation framework,

    Yi Yu, Weizhen Han, Libing Wu, Bingyi Liu, Enshu Wang, and Zhuangzhuang Zhang, “Enduring, efficient and robust trajec- tory prediction attack in autonomous driving via optimization- driven multi-frame perturbation framework,” inCVPR, 2025, pp. 17229–17238

    2025

  9. [9]

    Robustness of trajectory prediction models under map-based attacks,

    Zhihao Zheng, Xiaowen Ying, Zhen Yao, et al., “Robustness of trajectory prediction models under map-based attacks,” in WACV, 2023, pp. 4541–4550

    2023

  10. [10]

    Ad- vdo: Realistic adversarial attacks for trajectory prediction,

    Yulong Cao, Chaowei Xiao, Anima Anandkumar, et al., “Ad- vdo: Realistic adversarial attacks for trajectory prediction,” in ECCV, 2022, pp. 36–52

    2022

  11. [11]

    On adver- sarial robustness of trajectory prediction for autonomous vehi- cles,

    Qingzhao Zhang, Shengtuo Hu, Jiachen Sun, et al., “On adver- sarial robustness of trajectory prediction for autonomous vehi- cles,” inCVPR, 2022, pp. 15159–15168

    2022

  12. [12]

    Semi- supervised semantics-guided adversarial training for robust tra- jectory prediction,

    Ruochen Jiao, Xiangguo Liu, Takami Sato, et al., “Semi- supervised semantics-guided adversarial training for robust tra- jectory prediction,” inICCV, 2023, pp. 8207–8217

    2023

  13. [13]

    Obfus- cated gradients give a false sense of security: Circumventing defenses to adversarial examples,

    Anish Athalye, Nicholas Carlini, and David Wagner, “Obfus- cated gradients give a false sense of security: Circumventing defenses to adversarial examples,” inICML, 2018, pp. 274– 283

    2018

  14. [14]

    Certified robustness to adversarial examples with differential privacy,

    Mathias Lecuyer, Vaggelis Atlidakis, Roxana Geambasu, et al., “Certified robustness to adversarial examples with differential privacy,” in2019 IEEE Symposium on Security and Privacy (SP), 2019, pp. 656–672

    2019

  15. [15]

    Certified adversarial robustness via randomized smoothing,

    Jeremy Cohen, Elan Rosenfeld, and Zico Kolter, “Certified adversarial robustness via randomized smoothing,” inICML, 2019, pp. 1310–1320

    2019

  16. [16]

    Certified ad- versarial robustness with additive noise,

    Bai Li, Changyou Chen, Wenlin Wang, et al., “Certified ad- versarial robustness with additive noise,”Advances in neural information processing systems, 2019

    2019

  17. [17]

    Robustness certification for structured prediction with general inputs via safe region modeling in the semimetric output space,

    Huaqing Shao, Lanjun Wang, and Junchi Yan, “Robustness certification for structured prediction with general inputs via safe region modeling in the semimetric output space,” inKDD, 2023, pp. 2010–2022

    2023

  18. [18]

    Reconcile certi- fied robustness and accuracy for dnn-based smoothed majority vote classifier,

    Gaojie Jin, Xinping Yi, and Xiaowei Huang, “Reconcile certi- fied robustness and accuracy for dnn-based smoothed majority vote classifier,”arXiv preprint arXiv:2509.25979, 2025

    work page arXiv 2025

  19. [19]

    S 2O: Enhancing adversarial training with second- order statistics of weights,

    Gaojie Jin, Xinping Yi, Wei Huang, Sven Schewe, and Xiaowei Huang, “S 2O: Enhancing adversarial training with second- order statistics of weights,”IEEE Transactions on Pattern Analysis and Machine Intelligence, 2025

    2025

  20. [20]

    Clucert: Certifying llm robustness via clustering-guided denoising smoothing,

    Zixia Wang, Gaojie Jin, Jia Hu, and Ronghui Mu, “Clucert: Certifying llm robustness via clustering-guided denoising smoothing,”arXiv preprint arXiv:2512.08967, 2025

    work page arXiv 2025

  21. [21]

    Trajpac: Towards robustness verification of pedestrian trajectory predic- tion models,

    Liang Zhang, Nathaniel Xu, Pengfei Yang, et al., “Trajpac: Towards robustness verification of pedestrian trajectory predic- tion models,” inICCV, 2023, pp. 8327–8339

    2023

  22. [22]

    Certified human trajectory prediction,

    Mohammadhossein Bahari, Saeed Saadatnejad, Amirhossein Askari Farsangi, et al., “Certified human trajectory prediction,” inCVPR, 2025

    2025

  23. [23]

    Trajectron++: Dynamically-feasible trajectory forecasting with heterogeneous data,

    Tim Salzmann, Boris Ivanovic, Punarjay Chakravarty, et al., “Trajectron++: Dynamically-feasible trajectory forecasting with heterogeneous data,” inECCV, 2020, pp. 683–700

    2020

  24. [24]

    Stochastic trajectory prediction via motion indeterminacy diffusion,

    Tianpei Gu, Guangyi Chen, Junlong Li, et al., “Stochastic trajectory prediction via motion indeterminacy diffusion,” in CVPR, 2022, pp. 17113–17122

    2022

  25. [25]

    Socially-aware large-scale crowd forecasting,

    Alexandre Alahi, Vignesh Ramanathan, and Li Fei-Fei, “Socially-aware large-scale crowd forecasting,” inCVPR, 2014, pp. 2203–2210

    2014

  26. [26]

    Social lstm: Human trajectory prediction in crowded spaces,

    Alexandre Alahi, Kratarth Goel, Vignesh Ramanathan, et al., “Social lstm: Human trajectory prediction in crowded spaces,” inCVPR, 2016, pp. 961–971

    2016

  27. [27]

    Social gan: Socially acceptable trajectories with generative adversarial net- works,

    Agrim Gupta, Justin Johnson, Li Fei-Fei, et al., “Social gan: Socially acceptable trajectories with generative adversarial net- works,” inCVPR, 2018, pp. 2255–2264

    2018

  28. [28]

    Condi- tional generative neural system for probabilistic trajectory pre- diction,

    Jiachen Li, Hengbo Ma, and Masayoshi Tomizuka, “Condi- tional generative neural system for probabilistic trajectory pre- diction,” inIROS, 2019, pp. 6150–6156

    2019

  29. [29]

    Agentformer: Agent-aware transformers for socio-temporal multi-agent fore- casting,

    Ye Yuan, Xinshuo Weng, Yanglan Ou, et al., “Agentformer: Agent-aware transformers for socio-temporal multi-agent fore- casting,” inICCV, 2021, pp. 9813–9823

    2021

  30. [30]

    Computational complex- ity between k-means and k-medoids clustering algorithms for normal and uniform distributions of data points,

    T Velmurugan and T Santhanam, “Computational complex- ity between k-means and k-medoids clustering algorithms for normal and uniform distributions of data points,”Journal of computer science, p. 363, 2010

    2010

  31. [31]

    You’ll never walk alone: Modeling social be- havior for multi-target tracking,

    Stefano Pellegrini, Andreas Ess, Konrad Schindler, and Luc Van Gool, “You’ll never walk alone: Modeling social be- havior for multi-target tracking,” inICCV, 2009, pp. 261–268

    2009

  32. [32]

    Crowds by example,

    Alon Lerner, Yiorgos Chrysanthou, and Dani Lischinski, “Crowds by example,” inComputer graphics forum, 2007, pp. 655–664

    2007

  33. [33]

    Learning social etiquette: Human trajectory understanding in crowded scenes,

    Alexandre Robicquet, Amir Sadeghian, Alexandre Alahi, et al., “Learning social etiquette: Human trajectory understanding in crowded scenes,” inECCV, 2016, pp. 549–565

    2016

  34. [34]

    Remember intentions: retrospective-memory-based trajectory prediction,

    Chenxin Xu, Weibo Mao, Wenjun Zhang, et al., “Remember intentions: retrospective-memory-based trajectory prediction,” inCVPR, 2022, pp. 6488–6497

    2022

  35. [35]

    So- phie: An attentive gan for predicting paths compliant to social and physical constraints,

    Amir Sadeghian, Vineet Kosaraju, Ali Sadeghian, et al., “So- phie: An attentive gan for predicting paths compliant to social and physical constraints,” inCVPR, 2019, pp. 1349–1358

    2019

  36. [36]

    Covernet: Multimodal behavior prediction using tra- jectory sets,

    Tung Phan-Minh, Elena Corina Grigore, Freddy A Boulton, et al., “Covernet: Multimodal behavior prediction using tra- jectory sets,” inCVPR, 2020, pp. 14074–14083

    2020

  37. [37]

    Towards Deep Learning Models Resistant to Adversarial Attacks

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, et al., “Towards deep learning models resistant to adversarial attacks,”arXiv preprint arXiv:1706.06083, 2017

    work page internal anchor Pith review Pith/arXiv arXiv 2017