Pith. sign in

REVIEW 1 major objections 8 minor 131 references

Reviewed by Pith at T0; open to challenge.

T0 means a machine referee read the full paper against a public rubric. The mark states how deep the mechanical check went, never who wrote it. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · glm-5.2

Shadows and tire marks can crash self-driving cars

2026-07-08 23:59 UTC pith:LJUDG2GC

load-bearing objection Solid benchmark contribution for AD lane perception robustness; the sim-to-real gap is the main open question, and the ADVLM degradation numbers are small enough to warrant scrutiny. the 1 major comments →

arxiv 2607.05783 v1 pith:LJUDG2GC submitted 2026-07-07 cs.CV

Benchmarking the Robustness of Autonomous Driving to Environmental Illusions: A Lane Perception Perspective

Tianyuan Zhang , Xianglong Liu , Aishan Liu , Lu Wang , Yitong Zhang , Peng Yue , Mingchuan Zhang , Siyuan Liang
show 1 more author
Dacheng Tao
This is my paper
classification cs.CV
keywords autonomous drivinglane detectionenvironmental illusionsrobustness benchmarkvision-language modelsshadowsreflectionsCARLA simulator
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

This paper claims that naturally occurring visual patterns on roads — shadows, reflections, tire marks, road cracks, and traffic obstructions — function as 'environmental illusions' that systematically deceive the lane perception systems used in autonomous driving. The authors built a benchmark called LanEvil++ using the CARLA simulator, generating over 90,000 annotated images across 14 illusion types and 5 severity levels, plus nearly 42,000 visual question-answering pairs for vision-language driving models. They show that these illusions cause conventional lane detection models to lose 5.27% accuracy and 10.49% F1-score on average, with shadows being the single most disruptive factor (up to 7.20% accuracy drop). Vision-language driving models also degrade, losing 2.03% in GPT-score, with traffic obstructions causing the largest impact. In closed-loop simulation using OpenPilot and LMDrive, these illusions caused vehicles to make incorrect driving decisions leading to collisions. Real-world robot vehicle tests confirmed the threat, with success rates dropping from 80% to 22.5% (conventional models) and from 57.5% to 10% (vision-language models) when illusions were present. The authors also propose MIDA, a defense approach that mixes hard-example attention regions for visual models and applies prompt-based adversarial tuning for language models, recovering 4.23% robustness on lane detection and 3.82% on vision-language models.

Core claim

The central object is the 'environmental illusion' — a naturally occurring, non-adversarial visual pattern on roadways (shadows from guardrails, reflections from puddles, skid marks, repaired road segments) that structurally resembles lane markings closely enough to mislead perception models. The paper establishes that these illusions are not rare edge cases but systematic failure modes: every category of lane detection model tested (segmentation-based, keypoint-based, anchor-based, row-wise, parameter-based) and every vision-language driving model tested (DriveLM, Dolphins, Omni-L, Omni-Q) showed measurable degradation. The degradation scales with illusion severity, from roughly 2.5% at the

What carries the argument

The LanEvil++ benchmark (14 illusion types, 94 editable 3D CARLA scenes, 90,292 images, 1,596 video clips, 41,855 QA pairs) and MIDA (AAM++ for attention-region mixing in visual models, PAT++ for prompt-adversarial tuning in language models).

Load-bearing premise

The paper assumes that illusions generated in the CARLA simulator faithfully represent real-world visual deceptions in both visual statistics and severity. The authors acknowledge a 2–5% performance gap between simulated and real data, and their real-world validation uses small robot platforms at 0.2 m/s on a sand table — conditions far removed from full-size vehicles at highway speeds on public roads. If simulated illusions are systematically easier or harder than real ones,

What would settle it

If lane detection models trained on real-world driving datasets that already contain environmental illusions (e.g., CULane, BDD100K) show no performance difference between illusion-containing and illusion-free subsets, then the simulated illusions may be artifacts of the simulation pipeline rather than faithful representations of real-world visual deception.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • Lane perception systems deployed in production vehicles may need explicit evaluation against environmental illusions before deployment, as these patterns occur routinely on real roads.
  • The finding that shadows cause the largest degradation for conventional models while traffic obstructions cause the largest degradation for vision-language models suggests the two model families attend to different visual cues, which could inform architecture-specific defenses.
  • Combined illusions (e.g., shadow plus road damage) produce moderately worse degradation than single illusions but not catastrophically so, suggesting the effects are partially additive rather than multiplicative.
  • The MIDA defense approach, which requires no changes to model architecture and only modifies training data and prompts, could be integrated into existing training pipelines at low cost.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • If environmental illusions cause measurable degradation in simulation and small-scale robot tests, full-speed vehicles on public roads — where sensor height, speed, lighting variability, and road texture differ substantially from the test conditions — may experience different (potentially larger or smaller) degradation magnitudes that the benchmark cannot yet quantify.
  • The 2–5% F1-score domain gap between simulated and real-world data suggests that some illusion types may be systematically easier or harder in simulation, meaning the ranking of illusion severity (shadows as worst for LD models) may shift in real-world deployment.
  • If MIDA's gains come from exposing the model to hard examples during training, the approach may face diminishing returns on illusion types not represented in the training set, raising the question of whether a generalizable 'illusion resistance' can be achieved or whether defenses must remain illusion-type-specific.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

1 major / 8 minor

Summary. This paper introduces LanEvil++, a benchmark for evaluating the robustness of lane perception models—both conventional lane detection (LD) and vision-language model-based AD systems (ADVLMs)—against environmental illusions such as shadows, reflections, tire marks, and road damage. The benchmark is built using the CARLA simulator and comprises 94 3D scenes, 90,292 images, 1,596 video clips, and 41,855 QA pairs across 14 illusion types and 5 severity levels. The authors evaluate 7 LD models and 4 ADVLMs, reporting average degradation of 5.27% Accuracy and 10.49% F1-score for LD models and 2.03% GPT-score for ADVLMs. They also propose MIDA, a defense method combining attention-area mixing (AAM++) for LD models and prompt adversarial tuning (PAT++) for ADVLMs, achieving 4.23% and 3.82% improvements respectively. Closed-loop simulations with OpenPilot and LMDrive, plus small-scale real-world tests on JetBot and LIMO platforms, demonstrate safety-critical failures.

Significance. The paper addresses a genuine gap in the robustness evaluation literature: environmental illusions (shadows, reflections, tire marks) are common in real driving but underrepresented in existing benchmarks. The dataset scale (90K+ images, 1,596 clips, 41,855 QA pairs) and breadth (14 illusion types, 7 LD paradigms, 4 ADVLMs) are commendable. The closed-loop evaluations with OpenPilot and LMDrive add practical safety relevance beyond standard open-loop metrics. The MIDA defense is a reasonable baseline. The parameter sensitivity analysis (Table 7) and the non-illusion perturbation evaluation (Figs. 9e–9f) are welcome additions that address overfitting concerns. The dataset and code are partially released. However, the significance of the ADVLM findings is tempered by the small degradation magnitudes relative to the sim-to-real domain gap, and the real-world validation is limited to toy-scale platforms.

major comments (1)
  1. §5.3, Table 4: The average ADVLM degradation (2.03% GPT-score, 0.75% Language-score) is small in absolute terms. §5.5 reports a 2–5% F1-score domain gap between simulated and real-world data on clean images, and Table 8 reports a ~1.5% sim-to-real gap on clean images. For ADVLMs, the 2.03% GPT-score degradation is of the same order as the reported sim-to-real gap, raising the question of whether the illusion effect is distinguishable from domain-shift noise. The paper should either (a) provide statistical significance tests (e.g., confidence intervals or paired tests) showing the illusion-induced degradation exceeds the sim-to-real variance, or (b) explicitly qualify the ADVLM claims as relative comparisons within the simulation domain, noting that absolute magnitudes may not transfer. As stated, the abstract claim of 'substantial' degradation for ADVLMs is not adequately supported by a
minor comments (8)
  1. §3.1, Eq. (3): The notation uses angle brackets <S, X> for pairing static and dynamic elements, but the semantics of this pairing are unclear. Consider clarifying whether this denotes a tuple, a product, or some other structure.
  2. §4.1, Eq. (9): The blending operation ⊕ and the search function S_k are defined informally. A more precise specification (e.g., alpha blending formula, search criteria) would help reproducibility.
  3. Table 3: The 'Gap' column values are negative (representing drops), but the text refers to 'drops' and 'decreases' as positive numbers. This sign convention is consistent but could be confusing at first glance; a footnote would help.
  4. §5.5: The human perception study reports ACR scores of 3.89 (simulated) vs. 3.98 (real-world), but no variance or significance is reported. Given 100 participants, a paired test would strengthen the claim of 'comparable naturalness.'
  5. Fig. 9: The x-axis labels (1–14) for subfigures (a)–(d) are not mapped to illusion types in the figure itself; the reader must cross-reference with Table 3. Adding labels would improve readability.
  6. §6.1: The ASR metric is defined following [97] as lateral deviation > 0.285m within 2.5s, but the 92.31% figure for Road Damage is reported as 'in 92.31% of frames' rather than per-trial. Clarifying whether ASR is computed per-frame or per-trial would avoid ambiguity.
  7. The abstract states '94 high-fidelity, fully controllable 3D scenes' but Table 1 and §3.6 refer to '94 fundamental driving scenarios.' Consistent terminology would help.
  8. References [92]–[96] appear to have 2025–2026 dates, which is unusual for a July 2026 submission. Verify these are correctly attributed.

Simulated Author's Rebuttal

1 responses · 0 unresolved

We thank the referee for the careful reading and the constructive feedback. The referee raises a valid concern about the magnitude of ADVLM degradation relative to the sim-to-real domain gap. We address this point below and commit to revisions in the next version.

read point-by-point responses

  1. Referee: §5.3, Table 4: The average ADVLM degradation (2.03% GPT-score, 0.75% Language-score) is small in absolute terms. §5.5 reports a 2–5% F1-score domain gap between simulated and real-world data on clean images, and Table 8 reports a ~1.5% sim-to-real gap on clean images. For ADVLMs, the 2.03% GPT-score degradation is of the same order as the reported sim-to-real gap, raising the question of whether the illusion effect is distinguishable from domain-shift noise. The paper should either (a) provide statistical significance tests showing the illusion-induced degradation exceeds the sim-to-real variance, or (b) explicitly qualify the ADVLM claims as relative comparisons within the simulation domain, noting that absolute magnitudes may not transfer. As stated, the abstract claim of 'substantial' degradation for ADVLMs is not adequately supported.

    Authors: We agree with the referee that the 2.03% GPT-score degradation for ADVLMs is modest in absolute terms and that this magnitude is comparable to the sim-to-real domain gap reported in §5.5 and Table 8. We appreciate the referee flagging this, and we will revise the manuscript accordingly in two ways. First, we will qualify the ADVLM claims throughout the paper—including in the abstract—by replacing 'substantial' with more precise language such as 'measurable' or 'statistically significant but modest in absolute magnitude,' and by explicitly noting that these results represent relative comparisons within the simulation domain and that absolute magnitudes may not directly transfer to real-world deployment. Second, we will add paired statistical significance tests (bootstrap confidence intervals over the per-clip GPT-score differences between clean and perturbed conditions) to Table 4 to demonstrate that the illusion-induced degradation, while small, is systematic rather than attributable to random variance. We note that the experimental design is already paired—each perturbed clip has a corresponding clean clip from the same 3D scene—so the sim-to-real domain gap does not directly confound the within-domain illusion measurement. However, we acknowledge that the small absolute magnitude limits the practical significance of the ADVLM findings, and we will state this limitation explicitly. We also note that the LD model degradation (5.27% Accuracy, 10.49% F1-score) is substantially larger than the sim-to-real gap and is not subject to the same concern. For ADVLMs, the per-illusion-type breakdown (e.g., Traffic Obstruction causing 3.51% GPT-score drop) and the severity-level analysis (level-5 causing 9.11% GPT-score drop) provide additional evidence that the effect is real and, revision: yes

Circularity Check

0 steps flagged

No significant circularity found; the benchmark and defense method use separate train/test splits, and self-citations are contextual rather than load-bearing.

full rationale

The paper's derivation chain is largely self-contained. The LanEvil++ benchmark (Section 3) constructs simulated environmental illusions in CARLA and evaluates LD models and ADVLMs by comparing perturbed vs. clean performance on a held-out test set (Section 5.2–5.3). These measurements are not circular: they compare model outputs on controlled perturbations against clean baselines on data the models were not trained on. The MIDA defense method (Section 4) identifies 'hard examples' as 'images with accuracy below the dataset mean' (Section 4.1) and uses attention-area mixing to augment the training set. The training set (40,000 clean images) and test set (50,292 illusion images) are explicitly separate (Section 3.6), so the hard examples used for augmentation come from training data, not the evaluation data. The 4.23% improvement for LD models and 3.82% for ADVLMs (Section 5.4) are measured on the test set, which is disjoint from the training data used by MIDA. The self-citation to [28] (LanEvil, ACM MM 2024) is for context and comparison with the prior version; the current paper re-derives and extends the benchmark rather than importing unverified results as load-bearing premises. The AAM++ method is described in full detail (Eqs. 5–9) and does not depend on accepting claims from [28] on faith. The sim-to-real domain gap concern (Section 5.5) is an external-validity issue, not a circularity problem. No step in the derivation chain reduces to its own inputs by construction.

Axiom & Free-Parameter Ledger

8 free parameters · 4 axioms · 1 invented entities

The axiom ledger captures the key assumptions and parameters. The free parameters are primarily in the MIDA defense method, with several values unspecified in the main text. The CARLA fidelity assumption is the most load-bearing axiom.

free parameters (8)
  • T_HAA (high attention area threshold) = 0.6
    Threshold for binarizing attention maps in AAM++; selected via parameter sweep in Tab. 7a
  • T_LAA (low attention area threshold) = 0.4
    Threshold for low attention regions in AAM++; selected via parameter sweep in Tab. 7b
  • β (mixing ratio) = 0.5
    Controls blending of hard example attention areas into training images; selected via sweep in Tab. 7c
  • α (loss balancing coefficient) = 0.6
    Balances benign vs. hard example loss in PAT++; selected via sweep in Tab. 7d
  • σ (Gaussian blur std) = not specified
    Standard deviation for attention map blurring in Eq. 5; value not reported in main text
  • S (connected component size threshold) = not specified
    Minimum area for retained attention regions in Eq. 7; value not reported in main text
  • θ (overlap threshold) = not specified
    Threshold for acceptable overlap between attention regions and ground truth in Eq. 8; value not reported in main text
  • 5 severity levels per illusion type = 1-5
    Manually designed severity levels for each of 14 illusion types; parameter definitions deferred to Supplementary Materials
axioms (4)
  • domain assumption CARLA-simulated environmental illusions faithfully represent real-world visual deceptions in lane perception
    The entire benchmark and all quantitative conclusions depend on this assumption. Section 5.5 provides partial validation via domain gap analysis (2-5% F1-score gap) and human/ADVLM perception studies, but does not fully establish fidelity.
  • domain assumption Single-factor illusion perturbations are sufficient to evaluate robustness (combined illusions are secondary)
    Section 3.1 states 'our methodological focus centers on systematically designing single-factor changes.' The combined illusion study (Sec. 5.6) is a small-scale pilot with only 100 images per combination.
  • domain assumption GPT-4o can reliably generate and score VQA pairs for autonomous driving evaluation
    Section 3.5 uses GPT-4o for QA annotation, and Section 5.1 uses ChatGPT-based GPT score as an evaluation metric. The reliability of LLM-as-judge for AD tasks is assumed but not independently validated.
  • standard math Lateral deviation >0.285m within 2.5s constitutes a successful attack on AD systems
    Following [97] and AASHTO [127] policy; used as the ASR threshold in closed-loop evaluation (Sec. 6)
invented entities (1)
  • Environmental illusion (as a distinct corruption category) independent evidence
    purpose: Defines a new class of natural perturbations (shadows, reflections, tire marks, road damage) that are visually similar to lane markings
    The paper provides external grounding via FARS/CRSS and DfT crash databases (Sec. 3.2) showing these factors appear in real accident reports. Real-world case studies (Sec. 7) provide additional evidence. However, the specific 14-type taxonomy and 5-level severity scheme are designed by the authors without independent validation of completeness.

pith-pipeline@v1.1.0-glm · 32160 in / 5166 out tokens · 230162 ms · 2026-07-08T23:59:46.209602+00:00 · methodology

0 comments
read the original abstract

Environmental illusions (eg., shadows, reflections, and tire marks) are naturally existing yet overlooked phenomena in real-world driving environments. They can disturb visual perception, leading to misinterpretation of the scene and posing serious safety risks to autonomous driving (AD) systems. However, existing researches largely overlook these phenomena, leaving a critical gap. To address this issue, we study AD robustness through the lane perception perspective, a fundamental task supporting core functions like cruise control and lane centering. We focus on two representative models: conventional lane detection (LD) and vision-language model-based systems (ADVLMs). In this work, we introduce the first benchmark, LanEvil++, for evaluating the robustness of lane perception under environmental illusions. LanEvil++ encompasses 14 types of illusions and leverages the CARLA simulator to generate 94 high-fidelity, fully controllable 3D scenes, yielding a dataset of 90,292 annotated images, 1,596 video clips, and 41,855 visual question answering pairs. Extensive evaluations demonstrate that environmental illusions substantially degrade the performance of state-of-the-art LD methods. On average, LD models experience a 5.27% drop in Accuracy and a 10.49% decline in F1-score, while ADVLMs show a 2.03% reduction in GPT-score and a 0.75% drop in Language-score. Among all illusions, shadows emerge as the most disruptive factor, reducing accuracy by up to 7.20%. Furthermore, closed-loop simulations reveal that these illusions can lead to incorrect driving decisions. Complementary real-world case studies highlight safety-critical failures in actual traffic scenes. To enhance robustness, we propose the Multimodal Illusion Defense Approach (MIDA). MIDA achieves substantial gains under challenging conditions, boosting robustness by 4.23% on LD models and 3.82% on ADVLMs.

Figures

Figures reproduced from arXiv: 2607.05783 by Aishan Liu, Dacheng Tao, Lu Wang, Mingchuan Zhang, Peng Yue, Siyuan Liang, Tianyuan Zhang, Xianglong Liu, Yitong Zhang.

Figure 1
Figure 1. Figure 1: Illustration of naturally existing yet overlooked en [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: The framework of our LanEvil++ benchmark, which contains 14 specially-designed environmental illusion types from 4 categories, including road damage, traffic obstruction, reflection, and shadow. and risk significance. This analysis serves as the empirical foundation for the subsequent illusion design in Sec. 3.3, where these high-risk visual factors are systematically pa￾rameterized and synthesized under s… view at source ↗
Figure 3
Figure 3. Figure 3: Illustration of our scenario construction pipeline. [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: The statistics of LanEvil++ dataset. (a) The number of original and perturbed cases under four categories. (b) The number of original and perturbed clips under four cat￾egories. (c) The case distribution of four illusion categories. (d) The QA pair distribution of four illusion categories. TABLE 1: Detailed data properties of LanEvil++. (a) Scenario diversity Type Number Typical examples Scene 5 Urban, Hig… view at source ↗
Figure 5
Figure 5. Figure 5: Visualization of images from our LanEvil++ dataset under different environmental illusions. Scene Description <Question> What types of structures or elements are present along the sides of the road? <Answer> On the left side, there is a high chain-link fence, possibly for security, while the right side features a black barrier with pointed posts. In the background, there are buildings and trees on the left… view at source ↗
Figure 6
Figure 6. Figure 6: Structure and examples of the QA pairs in [PITH_FULL_IMAGE:figures/full_fig_p008_6.png] view at source ↗
Figure 8
Figure 8. Figure 8: Textual modality of MIDA: Prompt Adversarial [PITH_FULL_IMAGE:figures/full_fig_p009_8.png] view at source ↗
Figure 9
Figure 9. Figure 9: Evaluation of noise defense methods. For the first 4 subfigures, the x-axis denotes different types of illusions. The last 2 subfigures († ) report the performance of LaneATT and DriveLM under different non-illusion perturbations. and analysis: (1) training on either simulated or real-world datasets and then testing on another dataset; (2) conducting human perception and (3) conducting ADVLM perception stu… view at source ↗
Figure 10
Figure 10. Figure 10: The Tire Marks case causes OpenPilot to make incorrect decisions leading to collisions on the wall. deployed in real-world vehicles such as those from TOY￾OTA. Eight cases are selected from LanEvil++, covering two types under each illusion category. Each case is config￾ured with a defined starting point and direction to ensure traversal through the designated road sections. The eval￾uation pipeline is as … view at source ↗
Figure 11
Figure 11. Figure 11: The Rail case causes LMDrive to make incorrect decisions leading to collision on the road side. ing to the US traffic policy [127], a perturbation is considered successful if it causes the vehicle to deviate laterally by more than 0.285 meters within 2.5 seconds. As driving time progresses, we observe a significant increase in ASR across all types of illusions, indicating that the vehicle increasingly mak… view at source ↗
Figure 12
Figure 12. Figure 12: Consecutive images showing the LD model–driven [PITH_FULL_IMAGE:figures/full_fig_p015_12.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

131 extracted references · 131 canonical work pages · 28 internal anchors

  1. [1]

    Death of elaine herzberg,

    wiki, “Death of elaine herzberg,” https://en.wikipedia.org/ wiki/Death of Elaine Herzberg, 2018

    work page 2018

  2. [2]

    Ultra fast structure-aware deep lane detection,

    Z. Qin, H. Wang, and X. Li, “Ultra fast structure-aware deep lane detection,” inECCV, 2020

    work page 2020

  3. [3]

    Resa: Recurrent feature-shift aggregator for lane detection,

    T. Zheng, H. Fang, Y. Zhang, W. Tang, Z. Yang, H. Liu, and D. Cai, “Resa: Recurrent feature-shift aggregator for lane detection,” in AAAI, 2021

    work page 2021

  4. [4]

    Ultra fast deep lane detection with hybrid anchor driven ordinal classification,

    Z. Qin, P . Zhang, and X. Li, “Ultra fast deep lane detection with hybrid anchor driven ordinal classification,”IEEE TP AMI, 2022

    work page 2022

  5. [5]

    Recent progress in road and lane detection: a survey,

    A. B. Hillel, R. Lerner, D. Levi, and G. Raz, “Recent progress in road and lane detection: a survey,”MACH VISION APPL, 2014

    work page 2014

  6. [6]

    Spatial as deep: Spatial cnn for traffic scene understanding,

    X. Pan, J. Shi, P . Luo, X. Wang, and X. Tang, “Spatial as deep: Spatial cnn for traffic scene understanding,” inAAAI, 2018

    work page 2018

  7. [7]

    Drivelm: Driving with graph visual question answering,

    C. Sima, K. Renz, K. Chittaet al., “Drivelm: Driving with graph visual question answering,” inEuropean Conference on Computer Vision. Cham: Springer Nature Switzerland, 2024, pp. 256–274

    work page 2024

  8. [8]

    Benchmarking Neural Network Robustness to Common Corruptions and Perturbations

    D. Hendrycks and T. Dietterich, “Benchmarking neural network robustness to common corruptions and perturbations,”arXiv preprint arXiv:1903.12261, 2019

    work page internal anchor Pith review Pith/arXiv arXiv 1903

  9. [9]

    Benchmarking robustness of 3d object detection to common corruptions,

    Y. Dong, C. Kang, J. Zhang, Z. Zhu, Y. Wang, X. Yang, H. Su, X. Wei, and J. Zhu, “Benchmarking robustness of 3d object detection to common corruptions,” inCVPR, 2023

    work page 2023

  10. [10]

    Autonomous vehicle eval- uation: A comprehensive survey on modeling and simulation approaches,

    H. Alghodhaifi and S. Lakshmanan, “Autonomous vehicle eval- uation: A comprehensive survey on modeling and simulation approaches,”IEEE Access, 2021

    work page 2021

  11. [11]

    A systematic review of perception system and simulators for au- tonomous vehicles research,

    F. Rosique, P . J. Navarro, C. Fern ´andez, and A. Padilla, “A systematic review of perception system and simulators for au- tonomous vehicles research,”Sensors, 2019

    work page 2019

  12. [12]

    Formal scenario-based testing of autonomous vehicles: From simulation to the real world,

    D. J. Fremont, E. Kim, Y. V . Pant, S. A. Seshia, A. Acharya, X. Bruso, P . Wells, S. Lemke, Q. Lu, and S. Mehta, “Formal scenario-based testing of autonomous vehicles: From simulation to the real world,” inITSC, 2020. JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2021 16

    work page 2020

  13. [13]

    Metadrive: Composing diverse driving scenarios for general- izable reinforcement learning,

    Q. Li, Z. Peng, L. Feng, Q. Zhang, Z. Xue, and B. Zhou, “Metadrive: Composing diverse driving scenarios for general- izable reinforcement learning,”IEEE TP AMI, 2022

    work page 2022

  14. [14]

    Towards benchmarking and assessing visual naturalness of physical world adversarial attacks,

    S. Li, S. Zhang, G. Chen, D. Wang, P . Feng, J. Wang, A. Liu, X. Yi, and X. Liu, “Towards benchmarking and assessing visual naturalness of physical world adversarial attacks,” inCVPR, 2023

    work page 2023

  15. [15]

    Dual attention suppression attack: Generate adversarial camouflage in physical world,

    J. Wang, A. Liu, Z. Yin, S. Liu, S. Tang, and X. Liu, “Dual attention suppression attack: Generate adversarial camouflage in physical world,” inCVPR, 2021

    work page 2021

  16. [16]

    Playing for data: Ground truth from computer games,

    S. R. Richter, V . Vineet, S. Roth, and V . Koltun, “Playing for data: Ground truth from computer games,” inECCV, 2016

    work page 2016

  17. [17]

    Playing for bench- marks,

    S. R. Richter, Z. Hayder, and V . Koltun, “Playing for bench- marks,” inICCV, 2017

    work page 2017

  18. [18]

    The omnis- cape dataset,

    A. R. Sekkat, Y. Dupuis, P . Vasseur, and P . Honeine, “The omnis- cape dataset,” inICRA, 2020

    work page 2020

  19. [19]

    Carla: An open urban driving simulator,

    A. Dosovitskiy, G. Ros, F. Codevilla, A. Lopez, and V . Koltun, “Carla: An open urban driving simulator,” inCoRL, 2017

    work page 2017

  20. [20]

    openpilot,

    comma, “openpilot,” https://github.com/commaai/openpilot, 2017

    work page 2017

  21. [21]

    Lmdrive: Closed-loop end-to- end driving with large language models,

    H. Shao, Y. Hu, L. Wanget al., “Lmdrive: Closed-loop end-to- end driving with large language models,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2024, pp. 15 120–15 130

    work page 2024

  22. [22]

    BadCLIP: Dual-Embedding Guided Backdoor Attack on Multimodal Contrastive Learning

    S. Liang, M. Zhu, A. Liu, B. Wu, X. Cao, and E.-C. Chang, “Bad- clip: Dual-embedding guided backdoor attack on multimodal contrastive learning,”arXiv preprint arXiv:2311.12075, 2023

    work page internal anchor Pith review Pith/arXiv arXiv 2023

  23. [23]

    Pre-trained Trojan Attacks for Visual Recognition

    A. Liu, X. Zhang, Y. Xiao, Y. Zhou, S. Liang, J. Wang, X. Liu, X. Cao, and D. Tao, “Pre-trained trojan attacks for visual recogni- tion,”arXiv preprint arXiv:2312.15172, 2023

    work page internal anchor Pith review Pith/arXiv arXiv 2023

  24. [24]

    Does Few-shot Learning Suffer from Backdoor Attacks?

    X. Liu, X. Jia, J. Gu, Y. Xun, S. Liang, and X. Cao, “Does few-shot learning suffer from backdoor attacks?”arXiv preprint arXiv:2401.01377, 2023

    work page internal anchor Pith review Pith/arXiv arXiv 2023

  25. [25]

    Poisoned Forgery Face: Towards Backdoor Attacks on Face Forgery Detection

    J. Liang, S. Liang, A. Liu, X. Jia, J. Kuang, and X. Cao, “Poisoned forgery face: Towards backdoor attacks on face forgery detec- tion,”arXiv preprint arXiv:2402.11473, 2024

    work page internal anchor Pith review Pith/arXiv arXiv 2024

  26. [26]

    VL-Trojan: Multimodal Instruction Backdoor Attacks against Autoregressive Visual Language Models

    J. Liang, S. Liang, M. Luo, A. Liu, D. Han, E.-C. Chang, and X. Cao, “Vl-trojan: Multimodal instruction backdoor attacks against autoregressive visual language models,”arXiv preprint arXiv:2402.13851, 2024

    work page internal anchor Pith review Pith/arXiv arXiv 2024

  27. [27]

    Semantic Mirror Jailbreak: Genetic Algorithm Based Jailbreak Prompts Against Open-source LLMs

    X. Li, S. Liang, J. Zhang, H. Fang, A. Liu, and E.-C. Chang, “Semantic mirror jailbreak: Genetic algorithm based jailbreak prompts against open-source llms,”arXiv preprint arXiv:2402.14872, 2024

    work page internal anchor Pith review Pith/arXiv arXiv 2024

  28. [28]

    Lanevil: Benchmarking the robustness of lane detection to environmental illusions,

    T. Zhang, L. Wang, H. Li, Y. Xiao, S. Liang, A. Liu, X. Liu, and D. Tao, “Lanevil: Benchmarking the robustness of lane detection to environmental illusions,” inProceedings of the 32nd ACM Inter- national Conference on Multimedia, 2024, pp. 5403–5412

    work page 2024

  29. [29]

    Towards end-to-end lane detection: an instance segmentation approach,

    D. Neven, B. De Brabandere, S. Georgoulis, M. Proesmans, and L. Van Gool, “Towards end-to-end lane detection: an instance segmentation approach,” inIV, 2018

    work page 2018

  30. [30]

    Heatmap-based Vanishing Point boosts Lane Detection

    Y. Liu, M. Zeng, and Q. Meng, “Heatmap-based vanishing point boosts lane detection,”arXiv preprint arXiv:2007.15602, 2020

    work page internal anchor Pith review Pith/arXiv arXiv 2007

  31. [31]

    Key points estimation and point instance segmentation approach for lane detection,

    Y. Ko, Y. Lee, S. Azam, F. Munir, M. Jeon, and W. Pedrycz, “Key points estimation and point instance segmentation approach for lane detection,”IEEE Trans. Intell. Transp. Syst., 2021

    work page 2021

  32. [32]

    Focus on local: Detecting lane marker from bottom up via key point,

    Z. Qu, H. Jin, Y. Zhou, Z. Yang, and W. Zhang, “Focus on local: Detecting lane marker from bottom up via key point,” inCVPR, 2021

    work page 2021

  33. [33]

    A keypoint-based global association network for lane detec- tion,

    J. Wang, Y. Ma, S. Huang, T. Hui, F. Wang, C. Qian, and T. Zhang, “A keypoint-based global association network for lane detec- tion,” inCVPR, 2022

    work page 2022

  34. [34]

    Line-cnn: End-to-end traffic line detection with line proposal unit,

    X. Li, J. Li, X. Hu, and J. Yang, “Line-cnn: End-to-end traffic line detection with line proposal unit,”IEEE Trans. Intell. Transp. Syst., 2019

    work page 2019

  35. [35]

    Keep your eyes on the lane: Real-time attention-guided lane detection,

    L. Tabelini, R. Berriel, T. M. Paixao, C. Badue, A. F. De Souza, and T. Oliveira-Santos, “Keep your eyes on the lane: Real-time attention-guided lane detection,” inCVPR, 2021

    work page 2021

  36. [36]

    Structure Guided Lane Detection

    J. Su, C. Chen, K. Zhang, J. Luo, X. Wei, and X. Wei, “Structure guided lane detection,”arXiv preprint arXiv:2105.05403, 2021

    work page internal anchor Pith review Pith/arXiv arXiv 2021

  37. [37]

    Laneformer: Object-aware row-column transformers for lane detection,

    J. Han, X. Deng, X. Cai, Z. Yang, H. Xu, C. Xu, and X. Liang, “Laneformer: Object-aware row-column transformers for lane detection,” inAAAI, 2022

    work page 2022

  38. [38]

    Clrnet: Cross layer refinement network for lane detection,

    T. Zheng, Y. Huang, Y. Liu, W. Tang, Z. Yang, D. Cai, and X. He, “Clrnet: Cross layer refinement network for lane detection,” in CVPR, 2022

    work page 2022

  39. [39]

    End-to-end lane marker detection via row-wise classification,

    S. Yoo, H. S. Lee, H. Myeong, S. Yun, H. Park, J. Cho, and D. H. Kim, “End-to-end lane marker detection via row-wise classification,” inCVPR Workshop, 2020

    work page 2020

  40. [40]

    Inter-region affinity distillation for road marking segmentation,

    Y. Hou, Z. Ma, C. Liu, T.-W. Hui, and C. C. Loy, “Inter-region affinity distillation for road marking segmentation,” inCVPR, 2020

    work page 2020

  41. [41]

    Polylanenet: Lane estimation via deep polynomial regression,

    L. Tabelini, R. Berriel, T. M. Paixao, C. Badue, A. F. De Souza, and T. Oliveira-Santos, “Polylanenet: Lane estimation via deep polynomial regression,” inICPR, 2021

    work page 2021

  42. [42]

    End-to-end lane shape prediction with transformers,

    R. Liu, Z. Yuan, T. Liu, and Z. Xiong, “End-to-end lane shape prediction with transformers,” inWACV, 2021

    work page 2021

  43. [43]

    BSNet: Lane Detection via Draw B-spline Curves Nearby

    H. Chen, M. Wang, and Y. Liu, “Bsnet: Lane detection via draw b-spline curves nearby,”arXiv preprint arXiv:2301.06910, 2023

    work page internal anchor Pith review Pith/arXiv arXiv 2023

  44. [44]

    Rethinking efficient lane detection via curve modeling,

    Z. Feng, S. Guo, X. Tan, K. Xu, M. Wang, and L. Ma, “Rethinking efficient lane detection via curve modeling,” inCVPR, 2022

    work page 2022

  45. [45]

    Drive like a human: Rethink- ing autonomous driving with large language models,

    D. Fu, X. Li, L. Wenet al., “Drive like a human: Rethink- ing autonomous driving with large language models,” in2024 IEEE/CVF Winter Conference on Applications of Computer Vision Workshops (WACVW). IEEE, 2024, pp. 910–919

    work page 2024

  46. [46]

    Gpt-driver: Learning to drive with gpt,

    J. Mao, Y. Qian, J. Yeet al., “Gpt-driver: Learning to drive with gpt,” inNeurIPS 2023 Foundation Models for Decision Making Workshop, 2023

    work page 2023

  47. [47]

    A Language Agent for Autonomous Driving

    J. Mao, J. Ye, Y. Qianet al., “A language agent for autonomous driving,”arXiv preprint arXiv:2311.10813, 2023

    work page internal anchor Pith review Pith/arXiv arXiv 2023

  48. [48]

    Reason2drive: Towards inter- pretable and chain-based reasoning for autonomous driving,

    M. Nie, R. Peng, C. Wanget al., “Reason2drive: Towards inter- pretable and chain-based reasoning for autonomous driving,” in European Conference on Computer Vision. Cham: Springer Nature Switzerland, 2024, pp. 292–308

    work page 2024

  49. [49]

    LingoQA: Visual Question Answering for Autonomous Driving

    A. M. Marcu, L. Chen, J. H ¨unermannet al., “Lingoqa: video ques- tion answering for autonomous driving (2023),”arXiv preprint arXiv:2312.14115, 2023

    work page internal anchor Pith review Pith/arXiv arXiv 2023

  50. [50]

    Dolphins: Multimodal language model for driving,

    Y. Ma, Y. Cao, J. Sunet al., “Dolphins: Multimodal language model for driving,” inEuropean Conference on Computer Vision. Cham: Springer Nature Switzerland, 2024, pp. 403–420

    work page 2024

  51. [51]

    Driving with llms: Fusing object-level vector modality for explainable autonomous driving,

    L. Chen, O. Sinavski, J. H ¨unermannet al., “Driving with llms: Fusing object-level vector modality for explainable autonomous driving,” in2024 IEEE International Conference on Robotics and Automation (ICRA). IEEE, 2024, pp. 14 093–14 100

    work page 2024

  52. [52]

    Mtd-gpt: A multi-task decision- making gpt model for autonomous driving at unsignalized inter- sections,

    J. Liu, P . Hang, X. Qiet al., “Mtd-gpt: A multi-task decision- making gpt model for autonomous driving at unsignalized inter- sections,” in2023 IEEE 26th International Conference on Intelligent Transportation Systems (ITSC). IEEE, 2023, pp. 5154–5161

    work page 2023

  53. [53]

    doi:10.48550/arXiv.2312.09245 , abstract =

    W. Wang, J. Xie, C. Y. Huet al., “Drivemlm: Aligning multi- modal large language models with behavioral planning states for autonomous driving,”arXiv preprint arXiv:2312.09245, 2023

    work page arXiv 2023

  54. [54]

    Omnidrive: A holistic vision-language dataset for autonomous driving with counterfactual reasoning,

    S. Wang, Z. Yu, X. Jiang, S. Lan, M. Shi, N. Chang, J. Kautz, Y. Li, and J. M. Alvarez, “Omnidrive: A holistic vision-language dataset for autonomous driving with counterfactual reasoning,” inCVPR, 2025

    work page 2025

  55. [55]

    Drivegpt4: Interpretable end-to-end autonomous driving via large language model,

    Z. Xu, Y. Zhang, E. Xieet al., “Drivegpt4: Interpretable end-to-end autonomous driving via large language model,”IEEE Robotics and Automation Letters, 2024

    work page 2024

  56. [56]

    Robo3d: Towards robust and reliable 3d perception against corruptions,

    L. Kong, Y. Liu, X. Liet al., “Robo3d: Towards robust and reliable 3d perception against corruptions,” inProceedings of the IEEE/CVF International Conference on Computer Vision, 2023, pp. 19 994–20 006

    work page 2023

  57. [57]

    Robodepth: Robust out-of- distribution depth estimation under corruptions,

    L. Kong, S. Xie, H. Huet al., “Robodepth: Robust out-of- distribution depth estimation under corruptions,”Advances in Neural Information Processing Systems, vol. 36, pp. 21 298–21 342, 2023

    work page 2023

  58. [58]

    Benchmarking and improving bird’s eye view perception robustness in autonomous driving,

    S. Xie, L. Kong, W. Zhanget al., “Benchmarking and improving bird’s eye view perception robustness in autonomous driving,” IEEE Transactions on Pattern Analysis and Machine Intelligence, 2025

    work page 2025

  59. [59]

    Real time detection of lane markers in urban streets,

    M. Aly, “Real time detection of lane markers in urban streets,” in IV, 2008

    work page 2008

  60. [60]

    Vpgnet: Vanishing point guided network for lane and road marking detection and recognition,

    S. Lee, J. Kim, J. Shin Yoon, S. Shin, O. Bailo, N. Kim, T.-H. Lee, H. Seok Hong, S.-H. Han, and I. So Kweon, “Vpgnet: Vanishing point guided network for lane and road marking detection and recognition,” inICCV, 2017

    work page 2017

  61. [61]

    Tusimple benchmark,

    Tusimple, “Tusimple benchmark,” https://github.com/ TuSimple/tusimple-benchmark, 2017

    work page 2017

  62. [62]

    Bdd100k: A diverse driving dataset for heteroge- neous multitask learning,

    F. Yu, H. Chen, X. Wang, W. Xian, Y. Chen, F. Liu, V . Madhavan, and T. Darrell, “Bdd100k: A diverse driving dataset for heteroge- neous multitask learning,” inCVPR, 2020

    work page 2020

  63. [63]

    Unsupervised labeled lane markers using maps,

    K. Behrendt and R. Soussan, “Unsupervised labeled lane markers using maps,” inICCV Workshop, 2019. JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2021 17

    work page 2019

  64. [64]

    Curvelane-nas: Unifying lane-sensitive architecture search and adaptive point blending,

    H. Xu, S. Wang, X. Cai, W. Zhang, X. Liang, and Z. Li, “Curvelane-nas: Unifying lane-sensitive architecture search and adaptive point blending,” inECCV, 2020

    work page 2020

  65. [65]

    In- terpreting and improving adversarial robustness of deep neural networks with neuron sensitivity,

    C. Zhang, A. Liu, X. Liu, Y. Xu, H. Yu, Y. Ma, and T. Li, “In- terpreting and improving adversarial robustness of deep neural networks with neuron sensitivity,”IEEE TIP, 2021

    work page 2021

  66. [66]

    A comprehensive evaluation framework for deep model robustness,

    J. Guo, W. Bao, J. Wang, Y. Ma, X. Gao, G. Xiao, A. Liu, J. Dong, X. Liu, and W. Wu, “A comprehensive evaluation framework for deep model robustness,”PR, 2023

    work page 2023

  67. [67]

    Spatiotemporal attacks for embodied agents,

    A. Liu, T. Huang, X. Liu, Y. Xu, Y. Ma, X. Chen, S. J. Maybank, and D. Tao, “Spatiotemporal attacks for embodied agents,” inECCV, 2020

    work page 2020

  68. [68]

    Robustmq: benchmarking robustness of quantized models,

    Y. Xiao, A. Liu, T. Zhang, H. Qin, J. Guo, and X. Liu, “Robustmq: benchmarking robustness of quantized models,”Visual Intelli- gence, 2023

    work page 2023

  69. [69]

    Benchmarking the Robustness of Quantized Models

    Y. Xiao, T. Zhang, S. Liu, and H. Qin, “Benchmarking the robust- ness of quantized models,”arXiv preprint arXiv:2304.03968, 2023

    work page internal anchor Pith review Pith/arXiv arXiv 2023

  70. [70]

    Ex- ploring the relationship between architecture and adversarially robust generalization,

    A. Liu, S. Tang, S. Liang, R. Gong, B. Wu, X. Liu, and D. Tao, “Ex- ploring the relationship between architecture and adversarially robust generalization,” inCVPR, 2023

    work page 2023

  71. [71]

    Harnessing perceptual adversarial patches for crowd counting,

    S. Liu, J. Wang, A. Liu, Y. Li, Y. Gao, X. Liu, and D. Tao, “Harnessing perceptual adversarial patches for crowd counting,” inACM CCS, 2022

    work page 2022

  72. [72]

    Training robust deep neural networks via adversarial noise propagation,

    A. Liu, X. Liu, H. Yu, C. Zhang, Q. Liu, and D. Tao, “Training robust deep neural networks via adversarial noise propagation,” IEEE TIP, 2021

    work page 2021

  73. [73]

    Robustart: Benchmarking robustness on architecture design and training techniques,

    S. Tang, R. Gong, Y. Wang, A. Liu, J. Wang, X. Chen, F. Yu, X. Liu, D. Song, A. Yuilleet al., “Robustart: Benchmarking robustness on architecture design and training techniques,”ArXiv, 2021

    work page 2021

  74. [74]

    Benchmarking the Physical-world Adversarial Robustness of Vehicle Detection

    T. Zhang, Y. Xiao, X. Zhang, H. Li, and L. Wang, “Benchmarking the physical-world adversarial robustness of vehicle detection,” arXiv preprint arXiv:2304.05098, 2023

    work page internal anchor Pith review Pith/arXiv arXiv 2023

  75. [75]

    Exploring the physical-world adversarial robustness of vehicle detection,

    W. Jiang, T. Zhang, S. Liu, W. Ji, Z. Zhang, and G. Xiao, “Exploring the physical-world adversarial robustness of vehicle detection,”Electronics, 2023

    work page 2023

  76. [76]

    Towards Robust Physical-world Backdoor Attacks on Lane Detection

    X. Zhang, A. Liu, T. Zhang, S. Liang, and X. Liu, “Towards robust physical-world backdoor attacks on lane detection,”arXiv preprint arXiv:2405.05553, 2024

    work page internal anchor Pith review Pith/arXiv arXiv 2024

  77. [77]

    Attack end-to-end autonomous driving through module-wise noise,

    L. Wang, T. Zhang, Y. Han, M. Fang, T. Jin, and J. Kang, “Attack end-to-end autonomous driving through module-wise noise,” CVPR Workshop, 2024

    work page 2024

  78. [78]

    Enhancing the transferability of adversarial attacks with stealth preservation,

    X. Zhang, T. Zhang, Y. Zhang, and S. Liu, “Enhancing the transferability of adversarial attacks with stealth preservation,” CVPR Workshop, 2024

    work page 2024

  79. [79]

    Generate more imperceptible adversarial examples for object detection,

    S. Liang, X. Wei, and X. Cao, “Generate more imperceptible adversarial examples for object detection,” inICML, 2021

    work page 2021

  80. [80]

    Efficient adversarial attacks for visual object tracking,

    S. Liang, X. Wei, S. Yao, and X. Cao, “Efficient adversarial attacks for visual object tracking,” inECCV, 2020

    work page 2020

Showing first 80 references.