Pith. sign in

REVIEW 5 major objections 6 minor 1 cited by

Less is More: A Stealthy and Efficient Adversarial Attack Method for DRL-based Autonomous Driving Policies

T0 review · 5 major / 6 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A PPO-trained adversary can crash DRL-based autonomous driving policies in about three bounded attacks, achieving over 90% collision rate in most tested cases.

desk verdict Promising sparse-attack idea undermined by a black-box threat model that contradicts the FGSM/PGD mechanism actually used; worth reviewing, but needs major revision. read the letter →

arxiv 2412.03051 v1 pith:LQFI2OYS submitted 2024-12-04 cs.LG cs.AI

Junchao Fan , Xuyang Lei , Xiaolin Chang , Jelena Mišić , Vojislav B. Mišić This is my paper · ORCID
classification cs.LGcs.AI
keywords adversarialattackdeepreinforcementlearningautonomousdrivingproximalpolicyoptimizationcollisionrateefficiencytrajectoryclippingSUMOsimulation
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that a deep-reinforcement-learning-based autonomous driving policy can be reliably crashed by an adversary that attacks only a few critical moments, not every frame. The authors train the adversary with PPO to solve a mixed-integer optimization problem: choose when to inject a bounded perturbation and which action to lure the victim into taking. In an unprotected left-turn simulation, the trained adversary reaches a collision rate above 90% with an average of about three attacks per episode across PPO, SAC, TD3, and FNI-RL victims, and improves attack efficiency by at least 130% relative to attacking at every time step. If correct, this means sparse, bounded, well-timed perturbations are enough to cause safety violations, which changes what robustness testing and defense for DRL driving policies should focus on.

What carries the argument

The load-bearing machinery is the learned attack policy $\pi^{adv}_{\theta}$ that maps the augmented observation $(s_t, n_t, a_t)$ to a switch $p_t \in [-1,1]$ and a lure action $a'_t$; the switch gates whether FGSM or PGD produces a bounded perturbation $\delta_t$ to push the victim's argmax action toward $a'_t$. Trajectory clipping truncates the episode when the remaining attack budget $n_t$ hits zero. This converts the combinatorial when-to-attack problem into a continuous RL problem solved with PPO, avoiding hand-designed critical-moment thresholds.

What would settle it

Measure, over many episodes, the fraction of launched attacks in which the victim's post-perturbation action equals the lure action, under the paper's black-box setting and with the perturbation bound made explicit. If that fraction is near chance, or if the collision rate falls below 90% when the bound is enforced exactly as in Eq. (2c), the central claim is not supported.

Watch

Extended reading notes

Core claim

The paper's central claim is that the attack problem—maximize safety violations subject to a cap on the total number of attacks and a bound on each perturbation—can be decomposed into two learned subpolicies, when-to-attack and how-to-attack, and solved by a single PPO-based adversary. The adversary's observation augments the victim's state with the remaining attack budget and the victim's unperturbed action; its output is a switch value and a lure action. When the switch fires, a bounded perturbation generated by FGSM or PGD is added to the victim's observation to steer the victim toward the lure action. The reward is simply whether a collision occurs, and trajectory clipping ends the episode when the attack budget is exhausted to balance sample distribution. In the SUMO unprotected left-turn scenario the method reports collision rates of roughly 90% or higher with an average of about three attacks, matching or approaching the idealized action-modification attack while using far fewer perturbation steps than the unlimited-attack baseline.

Load-bearing premise

The attack only works if a small, bounded perturbation to the victim's observation can reliably change the victim's chosen action to the adversary's intended lure action, even though the adversary never sees the victim's policy or gradients; the paper does not specify how FGSM/PGD are applied under that black-box constraint or what the perturbation bound is.

Editorial extensions

If this is right

  • Robustness evaluation for DRL driving policies should include budgeted sparse attacks; dense attacks appear to be both less efficient and less representative of critical-moment risk.
  • The vulnerability reported across PPO, SAC, TD3, and FNI-RL victims indicates the attack targets a structural property of learned driving policies, not a quirk of one training algorithm.
  • The proposed attack-efficiency metric, which combines collision rate with the average number of attacks, gives a concrete way to compare stealthy attacks; on this metric the sparse attack beats unlimited attacks by at least 130% in every reported setting.
  • Because the method relies on standard FGSM and PGD perturbation generators, its success implies that even simple bounded perturbations suffice when the timing is learned; better generators should raise the ceiling further.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A natural next test is whether the learned when-to-attack policy transfers to other intersections or victim policies; the paper reports only the unprotected left-turn scenario with three traffic densities.
  • The unspecified perturbation bound in Eq. (2c) is a reproducibility gap; reporting it would let others check whether the attack's stealth claim holds at a fixed bound.
  • Because the adversary needs the victim's original action in its observation, a practical deployment would require observing or estimating that action; an extension could use a learned estimator and measure the drop in collision rate.
  • The average of about three attacks suggests a lower-bound experiment: training with caps of one or two attacks would reveal how close the method is to the minimum number of interventions needed.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 6 minor

Summary. The paper proposes a DRL-based adversary that learns both when to attack and how to attack a DRL-based autonomous driving policy. The attack problem is modeled as a mixed-integer optimization and solved with PPO, where the adversary selects critical moments and generates lure actions. The method is evaluated in an unprotected left-turn scenario in SUMO against PPO, SAC, TD3, and FNI-RL policies. The reported results show collision rates of around 90% with an average of about three attacks per episode, and the paper claims large improvements in a newly proposed attack efficiency metric over unlimited-attack and random-attack baselines. The central claims are that sparse, bounded perturbations at critical moments can cause safety violations, and that the adversary learns this without domain knowledge.

Significance. If substantiated, the paper addresses an important and timely problem: demonstrating that sparse, stealthy perturbations can cause collisions in DRL-based driving policies. The idea of learning when to attack via a high-level policy, rather than attacking every step, is a sensible direction and could inform robustness evaluations. The paper also introduces an attack efficiency metric, which may be useful for comparing sparse attacks. However, the significance is currently undermined by a fundamental mismatch between the stated black-box threat model and the gradient-based perturbation generation, and by several unsupported quantitative claims. The work has potential to be a useful contribution after major revisions.

major comments (5)
  1. [Section III.C and Section V.D] The threat model states that the adversary has no knowledge of the architecture, parameters, or gradients of the victim policy (Section III.C), yet Section V.D states that perturbations are generated with FGSM and PGD, both of which require gradients of the victim policy or of a substitute model. No surrogate training, gradient estimation scheme, or query-based method is described anywhere, and Algorithm 1 line 8 merely calls an undefined function PerturbationGenerate(s_t, a_t, a'_t). This makes the reported collision rates non-reproducible from the text and contradicts the black-box claim. Please specify the exact perturbation generation mechanism, including how gradients are obtained under the stated threat model, and if a surrogate model is used, report its transfer performance to the actual victim policies.
  2. [Eq. (2c)] The perturbation bound ε in Eq. (2c) is never specified in the paper. Since boundedness of perturbations is a central claim for the stealthiness of the attack, the paper must report the value or the procedure for setting ε. Without this, the reader cannot verify that the perturbations are indeed bounded as claimed.
  3. [Section V.F2, Table I] The paper claims that compared to UA and RA, the proposed method achieves an average improvement of 160.47% and 654.48% in AE, respectively. These numbers are not derivable from the data in Table I. For example, averaging the AE values in Table I across all victim agents and both perturbation methods gives approximately 0.38 for UA and 0.82 for the proposed method, which is an improvement of about 114%, not 160%. Please provide the exact calculation formula or correct the reported percentages.
  4. [Section I.B and Section V] The contributions section states that 'we validate the contributions of each component through ablation studies,' but no ablation results appear anywhere in Section V. The paper does not report any experiment that isolates the effect of the introduced attack-related information or the trajectory clipping method. Please either add the ablation experiments and their results, or remove the claim from the contributions.
  5. [Eq. (11), Section V.E] The newly introduced attack efficiency metric AE = CR * exp(-k*ANA) uses k = 0.05 with no justification. The paper's main efficiency claims (e.g., 'more than 130% improvement') are based on this metric, so the arbitrary choice of k is load-bearing. Please provide a sensitivity analysis over k or a principled derivation for the selected value.
minor comments (6)
  1. [Algorithm 1] The algorithm has inconsistent line numbering: line 3 is missing, and the line numbers after line 15 are out of sequence. Also, line 8's PerturbationGenerate is not defined in the text, which is particularly important given the black-box threat model.
  2. [Abstract and Section V.F1] The phrase 'within three attacks' is ambiguous. Table I shows average ANA sometimes exceeding 3 (e.g., FNI-RL flow1 PGD has ANA 3.67 in Table III). Please clarify whether the claim refers to the average or the median, and specify which experimental conditions support the '90% within three attacks' statement.
  3. [Section V.E, Table I] No confidence intervals or standard errors are reported for the collision rate (CR). Since CR is a binomial proportion over 100 episodes, a 95% confidence interval would be a simple addition and would help assess the reliability of the headline numbers.
  4. [Section I.A and Section V] The paper repeatedly uses 'stealthy' as a key property, but the only evidence provided is a reduction in the number of attack steps. No analysis of detectability, defense mechanisms, or perceptual similarity of perturbations is given. Consider softening the claim or adding a direct detectability experiment.
  5. [Section II.B] The related work mentions Mo et al. [20], which uses a pre-constructed database of universal perturbations to achieve 100% lure action success. Since the proposed method does not compare against this baseline, and the perturbation generation is a key difference, it would be informative to include such a comparison or discuss why it is not applicable.
  6. [Section III.B, Eq. (2)] The equations in Section III.B have garbled symbols in the provided text (e.g., the reward function and the constraint sets are not clearly defined). Please ensure all variables and sets are properly typeset and defined, as this makes the formal problem statement difficult to follow.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: the attack-training pipeline is evaluated on the same collision objective it optimizes, which is standard reinforcement learning practice, and the only self-citation is not load-bearing.

full rationale

The central derivation chain is not circular. The adversary is a PPO policy trained to maximize a binary collision reward, and it is then evaluated on collision rate; this is training/evaluation alignment, not a case where the evaluation quantity is fitted into the training input or defined in terms of the output. The how-to-attack subproblem is underspecified relative to the stated black-box threat model (FGSM and PGD require gradients, while Section III.C says the adversary has no access to gradients), but that is an implementation and reproducibility gap, not a circular reduction. The custom attack-efficiency metric AE = CR * e^{-k*ANA} in Eq. (11) is a self-defined evaluation measure with an arbitrary k=0.05, and the reported efficiency improvement over the unlimited-attack baseline is partly a mathematical consequence of the metric's exponential penalty on attack count; however, the paper also directly reports ANA and CR, and the efficiency comparison is a metric-design choice rather than a derivation that assumes its own conclusion. The only self-citation is reference [36], used to support the choice of PPO as a state-of-the-art on-policy algorithm; this citation is not load-bearing because PPO is independently established by the original PPO paper [21] and the attack results do not rest on this citation. No circular step meets the required evidence bar of exhibiting a specific equation or definition that reduces a claimed result to its own input.

Assumptions & free parameters 2 free parameters · 3 assumptions · 0 invented entities

The paper introduces no new physical or conceptual entities. Its central claims rest on the effectiveness of gradient-based perturbation generation under a black-box threat model, the realism of the SUMO scenario, and the representativeness of the trained victim policies. The attack efficiency metric contributes an arbitrary weight as a free parameter.

free parameters (2)
  • k (attack efficiency weight) = 0.05
    Introduced in Eq. (11) to balance collision rate and attack count in AE=CR*e^{-k*ANA}; set to 0.05 with no sensitivity analysis. The reported 130%+ efficiency improvements are sensitive to this choice.
  • epsilon (perturbation magnitude bound) = unspecified
    Eq. (2c) defines a threshold for each perturbation to reduce detectability, but the paper never reports its value in the experiments, making the attack success and stealth claims unreproducible.
assumptions (3)
  • ad hoc to paper Gradient-based FGSM/PGD perturbation generation is compatible with the stated black-box threat model.
    Algorithm 1 calls PerturbationGenerate using FGSM/PGD, but Section III.C says the adversary has no access to the victim's gradients. No surrogate model is described, so this compatibility is assumed without support.
  • domain assumption The SUMO unprotected left-turn simulation with LC2013 lane-changing and arrival probability p faithfully represents DRL-based autonomous driving decision problems.
    All validation is in this single scenario (Section V.A); the paper claims general applicability beyond it.
  • domain assumption Victim policies trained with Stable Baselines3 (PPO, SAC, TD3, FNI-RL) for 12,000 steps are representative of DRL-based autonomous driving policies.
    Section V.D describes training; the paper uses these victims as the target set for the attack.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Less is More: A Stealthy and Efficient Adversarial Attack Method for DRL-based Autonomous Driving Policies." pith.science (2026). https://pith.science/paper/LQFI2OYS

@misc{pith2026241203051,
  author       = {Pith},
  title        = {Pith review of: Less is More: A Stealthy and Efficient Adversarial Attack Method for DRL-based Autonomous Driving Policies},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/LQFI2OYS}},
  note         = {Machine review of arXiv:2412.03051}
}
read the original abstract

Despite significant advancements in deep reinforcement learning (DRL)-based autonomous driving policies, these policies still exhibit vulnerability to adversarial attacks. This vulnerability poses a formidable challenge to the practical deployment of these policies in autonomous driving. Designing effective adversarial attacks is an indispensable prerequisite for enhancing the robustness of these policies. In view of this, we present a novel stealthy and efficient adversarial attack method for DRL-based autonomous driving policies. Specifically, we introduce a DRL-based adversary designed to trigger safety violations (e.g., collisions) by injecting adversarial samples at critical moments. We model the attack as a mixed-integer optimization problem and formulate it as a Markov decision process. Then, we train the adversary to learn the optimal policy for attacking at critical moments without domain knowledge. Furthermore, we introduce attack-related information and a trajectory clipping method to enhance the learning capability of the adversary. Finally, we validate our method in an unprotected left-turn scenario across different traffic densities. The experimental results show that our method achieves more than 90% collision rate within three attacks in most cases. Furthermore, our method achieves more than 130% improvement in attack efficiency compared to the unlimited attack method.

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Robust Driving Control for Autonomous Vehicles: An Intelligent General-sum Constrained Adversarial Reinforcement Learning Approach

    cs.LG 2025-10 conditional novelty 4.0 of 10

    IGCARL trains an autonomous driving policy against a DRL-based adversary that plans multi-step collision-oriented observation attacks, with Lagrangian constraints that preserve clean-environment behavior, and reports ...

Reference graph

Works this paper leans on

42 extracted references · 15 canonical work pages · cited by 1 Pith paper

  1. [1]

    What might be the economic implications of autonomous vehicles?

    “What might be the economic implications of autonomous vehicles?” Economics Observatory. Accessed: Dec. 3, 2024. [Online]. Available: https://www.economicsobservatory.com/what-might-be-the-economic- implications-of-autonomous-vehicles

    work page 2024

  2. [2]

    Learning naturalistic driving environment with statistical realism,

    X. Yan, Z. Zou, S. Feng, H. Zhu, H. Sun, a nd H. X. Liu, “Learning naturalistic driving environment with statistical realism,” Nature Commun., vol. 14, no. 1, p. 2037, Apr. 2023, doi: 10.1038/s41467 -023- 37677-5

    doi:10.1038/s41467 2023

  3. [4]

    Trustworthy safety improvement for autonomous driving using reinforcement learning,

    Z. Cao, S. Xu, X . Jiao, H. Peng, and D. Yang, “Trustworthy safety improvement for autonomous driving using reinforcement learning,” Transp. Res. C: Emerg. Technol. , vol. 138, p. 103656, May 2022, doi: 10.1016/j.trc.2022.103656

    arXiv 2022

  4. [5]

    Towards Robust Decision-Making for Autonomous Driving on Highway,

    K. Yang, X. Tang, S. Qiu, S. Jin, Z. Wei, and H. Wang, “Towards Robust Decision-Making for Autonomous Driving on Highway,” IEEE Trans. Veh. Technol. , vol. 72, no. 9, pp. 11251 –11263, Sep. 2023, doi: 10.1109/TVT.2023.3268500

    arXiv 2023

  5. [6]

    Deep Reinforcement Learning Based Decision -Making Strategy of Autonomous Vehicle in Highway Uncertain Driving Environments,

    H. Deng, Y. Zhao, Q. Wang, and A. -T. Nguyen, “Deep Reinforcement Learning Based Decision -Making Strategy of Autonomous Vehicle in Highway Uncertain Driving Environments,” Automot. Innov., vol. 6, no. 3, pp. 438–452, Aug. 2023, doi: 10.1007/s42154-023-00231-6

    work page doi:10.1007/s42154-023-00231-6 2023

  6. [7]

    Deep multi -agent reinforcement learning for highway on -ramp merging in mixed traffic,

    D. Chen, M. R. Hajidavalloo, Z. Li, K. Chen, Y. Wang, L. Jiang, and Y. Wang, “Deep multi -agent reinforcement learning for highway on -ramp merging in mixed traffic,” IEEE Trans. Intell. Transp. Syst., vol. 24, no. 11, pp. 11623-11638, Nov. 2023, doi: 10.1109/TITS.2023.3285442

    work page arXiv 2023

  7. [8]

    Reinforcement Learning -Based Multi-Lane Cooperative Control for On -Ramp Merging in Mixed - Autonomy Traffic,

    L. Liu, X. Li, Y. Li, J. Li, and Z. Liu, “Reinforcement Learning -Based Multi-Lane Cooperative Control for On -Ramp Merging in Mixed - Autonomy Traffic,” IEEE Internet Things J. , pp. 1 –1, 2024, doi: 10.1109/JIOT.2024.3447039

    arXiv 2024

  8. [9]

    On -Ramp Merging for Highway Autonomous Driving: An Application of a New Safety Indicator in Deep Reinforcement Learning,

    G. Li, W . Zhou, S. Lin, S. Li, and X. Qu, “On -Ramp Merging for Highway Autonomous Driving: An Application of a New Safety Indicator in Deep Reinforcement Learning,” Automot. Innov., vol. 6, no. 3, pp. 453–465, Aug. 2023, doi: 10.1007/s42154-023-00235-2

    work page doi:10.1007/s42154-023-00235-2 2023

Show all 42 references
  1. [10]

    Ensemble Quantile Networks: Uncertainty-Aware Reinforcement Learning with Applications in Autonomous Driving,

    C.-J. Hoel , K. Wolff, and L. Laine, “Ensemble Quantile Networks: Uncertainty-Aware Reinforcement Learning with Applications in Autonomous Driving,” IEEE Trans. Intell. Transp. Syst., vol. 24, no. 6, pp. 6030–6041, Jun. 2023, doi: 10.1109/TITS.2023.3251376

    2023

  2. [11]

    Predictive trajectory planning for autonomous vehicles at intersections using reinforcement learning,

    E. Zhang, R. Zhang, and N. Masoud, “Predictive trajectory planning for autonomous vehicles at intersections using reinforcement learning,” Transp. Res. C: Emerg. Technol. , vol. 149 , p. 104063, Apr. 2023, doi: 10.1016/j.trc.2023.104063

    2023

  3. [12]

    Seeing is not Believing: Robust Reinforcement Learning against Spurious Correlation ,

    W. Ding, L. Shi, Y. Chi, and D. Zhao, “Seeing is not Believing: Robust Reinforcement Learning against Spurious Correlation ,” in Proc. Adv. Neural Inf. Process. Syst., vol. 36, 2024

    2024

  4. [13]

    Targeted Attack on Deep RL-based Autonomous Driving with Learned Visual Patterns,

    P. Buddareddygari, T. Zhang, Y. Yang, and Y. Ren, “Targeted Attack on Deep RL-based Autonomous Driving with Learned Visual Patterns,” in Proc. IEEE Int. Conf. Robot. Automat. (ICRA), May 2022, pp. 10571 – 10577. doi: 10.1109/ICRA46639.2022.9811574

    2022

  5. [14]

    Adversarial Deep Reinforcement Learning for Improving the Robustness of Multi -agent Autonomous Driving Policies,

    A. Sharif and D. Marijan, “Adversarial Deep Reinforcement Learning for Improving the Robustness of Multi -agent Autonomous Driving Policies,” in Proc. 29th Asia –Pacific Softw. Eng. Conf. (APSEC) , Dec. 2022, pp. 61–70. doi: 10.1109/APSEC57359.2022.00018

    2022

  6. [15]

    Deep learning adversarial attacks and defenses in autonomous vehicles: a systematic literature review from a safety perspective,

    A. D. M. Ibrahum, M. Hussain, and J. -E. Hong, “Deep learning adversarial attacks and defenses in autonomous vehicles: a systematic literature review from a safety perspective,” Artif. Intell. Rev. , vol. 58, no. 1, p. 28, Nov. 2024, doi: 10.1007/s10462-024-11014-8

    2024 doi

  7. [16]

    X. He, W. Huang, and C. Lv, “Trustworthy autonomous driving via defense-aware robust reinforcement learning against worst -case > REPLACE THIS LINE WITH YOUR MANUSCRIPT ID NUMBER (DOUBLE-CLICK HERE TO EDIT) < observational perturbations,” Transp. Res. C: Emerg. Technol., vol. ...

    2024

  8. [17]

    Tactics of Adversarial Attack on Deep Reinforcement Learning Agents,

    Y.-C. Lin, Z.-W. Hong, Y.-H. Liao, M.-L. Shih, M.-Y. Liu, and M. Sun, “Tactics of Adversarial Attack on Deep Reinforcement Learning Agents,” in Proc. 26th Int. Joint Conf. Artif. Intell., 2017, pp. 3756-3762

    2017

  9. [18]

    ATS -O2A: A state-based adversarial attack strategy on deep reinforcement learning,

    X. Li, Y. Li, Z. Feng, Z. Wang, and Q. Pan, “ATS -O2A: A state-based adversarial attack strategy on deep reinforcement learning,” Comput. Secur., vol. 129, p. 103259, Jun. 2023, doi: 10.1016/j.cose.2023.103259

    2023

  10. [19]

    Stealthy and Efficient Adversa rial Attacks against Deep Reinforcement Learning,

    J. Sun et al., “Stealthy and Efficient Adversa rial Attacks against Deep Reinforcement Learning,” in Proc. AAAI Conf. Artif. Intell., vol. 34, no. 04, Art. no. 04, Apr. 2020, doi: 10.1609/aaai.v34i04.6047

    2020 doi

  11. [20]

    Attacking Deep Reinforcement Learning with Decoupled Adversarial Policy,

    K. Mo, W. Tang, J. Li, and X. Yuan, “Attacking Deep Reinforcement Learning with Decoupled Adversarial Policy,” IEEE Trans. Dependable Secure Comput., pp. 1–1, Jan. 2022, doi: 10.1109/TDSC.2022.3143566

    2022

  12. [21]

    Proximal Policy Optimization Algorithms,

    J. Schulman, F. Wolski, P. Dhariwal, A. Radford, and O. Klimov , “Proximal Policy Optimization Algorithms,” Aug. 28, 2017, arXiv: arXiv:1707.06347

    2017 arXiv

  13. [22]

    Microscopic Traffic Simulation using SUMO,

    P. A. Lopez et al., “Microscopic Traffic Simulation using SUMO,” in Proc. 21st Int. Conf. Intell. Transp. Syst. (ITSC) , Nov. 2018, pp. 2575 –

    2018

  14. [23]

    Recent advances in reinforcement learning-based autonomous driving behavior planning: A survey,

    J. Wu, C. Huang, H. Huang, C. Lv, Y. Wang, and F. -Y. Wang, “Recent advances in reinforcement learning-based autonomous driving behavior planning: A survey,” Transp. Res. C: Emerg. Technol. , vol. 164, p. 104654, Jul. 2024, doi: 10.1016/j.trc.2024.104654

    2024

  15. [24]

    Efficient Deep Reinforcement Learning with Imitative Expert Priors for Autonomous Driving,

    Z. Huang, J. Wu, and C. Lv, “Efficient Deep Reinforcement Learning with Imitative Expert Priors for Autonomous Driving,” IEEE Trans. Neural Networks Learn. Syst., vol. 34, no. 10, pp. 7391–7403, Oct. 2023, doi: 10.1109/TNNLS.2022.3142822

    2023

  16. [25]

    Boosting Offline Reinforcement Learning for Autonomous Driving with Hierarchical Latent Skills,

    Z. Li, F. N ie, Q. Sun, F. Da, and H. Zhao, “Boosting Offline Reinforcement Learning for Autonomous Driving with Hierarchical Latent Skills,” in Proc. IEEE Int. Conf. Robot. Automat. (ICRA), May 2024, pp. 18362–18369. doi: 10.1109/ICRA57147.2024.10611197

    2024

  17. [26]

    Event-Triggered Model Predictive Control With Deep Reinforcement Learning for Autonomous Driving,

    F. Dang, D. Chen, J. Chen, and Z. Li, “Event-Triggered Model Predictive Control With Deep Reinforcement Learning for Autonomous Driving,” IEEE Trans. Intell. Veh. , vol. 9, no. 1, pp. 459 –468, Jan. 2024, doi: 10.1109/TIV.2023.3329785

    2024

  18. [27]

    End-to-end Autonomous Driving: Challenges and Frontiers,

    L. Chen, P. Wu, K. Chitta, B. Jaeger, A. Geiger, and H. Li, “End-to-end Autonomous Driving: Challenges and Frontiers,” IEEE Trans. Pattern Anal. Mach. Intell., pp. 1–20, 2024, doi: 10.1109/TPAMI.2024.3435937

    2024

  19. [28]

    An Analysis of Adversarial Attacks and Defenses on Autonomous Driving Models,

    Y. Deng, X. Zheng, T. Zhang, C. Chen, G. Lou, and M. Kim, “An Analysis of Adversarial Attacks and Defenses on Autonomous Driving Models,” in Proc. IEEE Int. Conf. Pervasive Comput. Commun. (PerCom), Mar. 2020, pp. 1 –10. doi: 10.1109/PerCom45495.2020.9127389

    2020

  20. [29]

    Robust Decision Making for Autonomous Vehicles at Highway On -Ramps: A Constrained Adversarial Reinforcement Learning Approach,

    X. He, B. Lou, H. Yang, and C. Lv, “Robust Decision Making for Autonomous Vehicles at Highway On -Ramps: A Constrained Adversarial Reinforcement Learning Approach,” IEEE Trans. Intell. Transp. Syst. , vol. 24, no. 4, pp. 4103 –4113, Apr. 2023, doi: 10.1109/TITS.2022.3229518

    2023

  21. [30]

    Explainable Deep Adversaria l Reinforcement Learning Approach for Robust Autonomous Driving,

    C. Wang and N. Aouf, “Explainable Deep Adversaria l Reinforcement Learning Approach for Robust Autonomous Driving,” IEEE Trans. Intell. Veh., pp. 1–13, 2024, doi: 10.1109/TIV.2024.3379367

    2024

  22. [31]

    Adversarial Stress Test for Autonomous Vehicle Via Series Reinforcement Learning Tasks With Reward Shaping,

    X. Cai, X. Bai, Z. Cui, P. Hang, H. Yu, and Y. Ren, “Adversarial Stress Test for Autonomous Vehicle Via Series Reinforcement Learning Tasks With Reward Shaping,” IEEE Trans. Intell. Veh. , pp. 1 –16, 2024, doi: 10.1109/TIV.2024.3418887

    2024

  23. [32]

    CRASH: Challenging Reinforcement-Learning Based Adversarial Scenarios for Safety Hardening,

    A. Kulkarni, S. Zhang, and M. Behl , “CRASH: Challenging Reinforcement-Learning Based Adversarial Scenarios for Safety Hardening,” Nov. 26, 2024, arXiv: arXiv:2411.16996. doi: 10.48550/arXiv.2411.16996

    2024 doi arXiv

  24. [33]

    Robust Lane Change Decision Making for Autonomous Veh icles: An Observation Adversarial Reinforcement Learning Approach,

    X. He, H. Yang, Z. Hu, and C. Lv, “Robust Lane Change Decision Making for Autonomous Veh icles: An Observation Adversarial Reinforcement Learning Approach,” IEEE Trans. Intell. Veh., vol. 8, no. 1, pp. 184–193, Jan. 2023, doi: 10.1109/TIV.2022.3165178

    2023

  25. [34]

    Improved Robustness and Safety for Auton omous Vehicle Control with Adversarial Reinforcement Learning,

    X. Ma, K. Driggs -Campbell, and M. J. Kochenderfer, “Improved Robustness and Safety for Auton omous Vehicle Control with Adversarial Reinforcement Learning,” in Proc. IEEE Intell. Veh. Symp. (IV), Jun. 2018, pp. 1665–1671. doi: 10.1109/IVS.2018.8500450

    2018

  26. [35]

    Stealthy Black- Box Attack With Dynamic Threshold Against MARL -Based Traffic Signal Control System,

    Y. Ren, H. Zhang, L. Du, Z. Zhang, J. Zhang, and H. Li, “Stealthy Black- Box Attack With Dynamic Threshold Against MARL -Based Traffic Signal Control System,” IEEE Trans. Ind. Inf., pp. 1 –11, 2024, doi: 10.1109/TII.2024.3413356

    2024

  27. [36]

    Energy- Constrained Safe Path Planning for UAV -Assisted Data C ollection of Mobile IoT Devices,

    J. Fan, X. Chang, J. Mišić, V. B. Mišić, T. Yang, and Y. Gong, “Energy- Constrained Safe Path Planning for UAV -Assisted Data C ollection of Mobile IoT Devices,” IEEE Internet Things J. , pp. 1 –1, 2024, doi: 10.1109/JIOT.2024.3448537

    2024

  28. [37]

    Soft Actor-Critic: Off- Policy Maximum Entropy Deep Reinforcement Learning with a Stochastic Actor,

    T. Haarnoja, A. Zhou, P. Abbeel, and S. Levine, “Soft Actor-Critic: Off- Policy Maximum Entropy Deep Reinforcement Learning with a Stochastic Actor,” in Proc. Int. Conf. Mach. Learn., Jul. 2018, pp. 1861– 1870

    2018

  29. [38]

    Addressing Function Approximation Error in Actor-Critic Methods,

    S. Fujimoto, H. Hoof, and D. Meger, “Addressing Function Approximation Error in Actor-Critic Methods,” in Proc. 35th Int. Conf. Mach. Learn. (ICML), Jul. 2018, pp. 1587–1596

    2018

  30. [39]

    Fear -Neuro-Inspired Reinforcement Learning for Safe Autonomous Driving,

    X. He et al., “Fear -Neuro-Inspired Reinforcement Learning for Safe Autonomous Driving,” IEEE Trans. Pattern Anal. Mach. Intell., vol. 46, no. 1, pp. 267–279, Jan. 2024, doi: 10.1109/TPAMI.2023.3322426

    2024

  31. [40]

    Stable -baselines3: Reliable reinforcement learning implementations,

    A. Raffin, A. Hill, A. Gleave, A. Kanervisto, M. Ernestus, and N. Dormann, “Stable -baselines3: Reliable reinforcement learning implementations,” J. Mach. Learn. Res., vol. 22, no. 268, pp. 1–8, 2021

    2021

  32. [41]

    Explaining and Harnessing Adversarial Examples,

    I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and Harnessing Adversarial Examples,” in Proc. Int. Conf. Learn. Representations, Mar. 2015, pp. 1-11

    2015

  33. [42]

    Towards Deep Learning Models Resistant to Adversarial Attacks,

    A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards Deep Learning Models Resistant to Adversarial Attacks,” in Proc. Int. Conf. Learn. Representations, 2018

    2018

  34. [2582]

    doi: 10.1109/ITSC.2018.8569938

    2018

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.