Pith. sign in

REVIEW 6 major objections 6 minor 36 references

Interactive Adversarial Testing of Autonomous Vehicles with Adjustable Confrontation Intensity

T0 review · 6 major / 6 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A reinforcement-learned probe vehicle with a single confrontation-intensity dial can grade autonomous-driving policies by the pressure level at which they fail.

desk verdict Useful intensity dial for adversarial AV testing, but the DFR metric inverts right-of-way and makes the headline results an artifact of mislabeling. read the letter →

arxiv 2507.21814 v1 pith:NZVNLSO6 submitted 2025-07-29 cs.RO

Yicheng Guo , Chengkai Xu , Jiaqi Liu , Hao Zhang , Peng Hang , Jian Sun This is my paper
classification cs.RO
keywords autonomousvehiclesadversarialtestingreinforcementlearningconfrontationintensitymulti-headattentiondecisionfailureraterobustnessevaluationPOMDP
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that autonomous-vehicle decision-making can be tested the way an examiner tests a student: by trained "surrounding vehicles" that adapt to the vehicle under test and turn up the pressure on demand. Its central object is a single scalar confrontation factor $\alpha \in [0, \pi/2]$ embedded in both the examiner's observations and reward, so that one policy produces behavior ranging from polite self-interested driving to deliberate obstruction. If the claim holds, testing moves from static scenario suites to a graded, repeatable protocol that stratifies AV policies by the intensity at which they collapse. The experiments report precisely this stratification: rule-based, feedforward, and recurrent AV policies fail at different intensity levels, and the pattern repeats across intersection, highway, and merge scenarios.

What carries the argument

The load-bearing device is the scalar confrontation factor $\alpha \in [0, \pi/2]$, broadcast to all agents and embedded in the observation vector and in the reward blend $r(t) = \sin(\alpha)\,r_{\mathrm{adv}}(t) + \cos(\alpha)\,r_{\mathrm{eff}}(t) + \omega_p r_{\mathrm{penalty}}(t) + \omega_c r_{\mathrm{collision}}(t)$, which continuously trades adversarial effectiveness against efficiency so a single policy covers five graded intensity levels instead of requiring separate attack policies. The second mechanism is the multi-head scaled dot-product attention module in the policy network, which lets the examiner attend to the AV's position, velocity, and heading so its interventions are targeted and persistent. The evaluation triad of decision failure rate, confrontation success rate, and action entropy gives the framework its claim to be a measurement instrument rather than just an attack generator.

What would settle it

Re-run the intersection protocol against a deliberately conservative AV policy that always yields even when it holds right-of-way, and check whether the decision failure rate rises; a metric that measures genuine decision weakness should not penalize excessive caution. More directly, re-label episodes using an independent human or external judge of right-of-way and see whether the Q1–Q5 decision-failure trends survive the re-labeling.

Watch

Extended reading notes

Core claim

ExamPPO claims that adversarial strength can be a continuously adjustable, interpretable parameter rather than a binary attack setting, and that conditioning both the observation and the reward of the examiner vehicle on $\alpha$ yields a policy whose behavior scales smoothly with test difficulty. In the reported experiments, confrontation success and decision failure rates rise from near zero at the lowest intensity levels to 96$-$100% at the highest, while post-encroachment time falls sharply, and this graded pressure separates AV policies by robustness: the rule-based policy collapses from moderate intensity, the feedforward policy from high intensity, and the recurrent policy retains most of its task success through the middle levels. The multi-head attention module is credited with making the confrontation sustained and temporally coordinated rather than a one-off interference. The framework also claims cross-scenario generalization, with the same training recipe producing the graded trend in highway and merging scenarios without per-scenario retraining.

Load-bearing premise

The central claim rests on the labeling rule behind the decision failure rate: once the examiner vehicle has entered the conflict zone first, right-of-way belongs to it, and any AV that fails to yield is counted as having made a decision error, so if that interpretation is contested, safe defensive driving could be mislabeled as a failure.

Editorial extensions

If this is right

  • AV testing protocols could adopt graded intensity staging: start at a low confrontation level, raise it until the AV fails, and report the failure threshold as its robustness score.
  • Comparison across AV policies becomes quantitative, since the framework produced a clear ordering of robustness that matches intuitions about temporal memory helping decision-making.
  • A single examiner policy serves all intensity levels and multiple scenarios, reducing the per-scenario retraining cost in testing pipelines.
  • Because the collision reward flips sign at $\alpha = 3\pi/20$, the framework can separate contact-free adversarial probing from contact-inclusive stress testing within one policy family.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The $\alpha$-conditioning mechanism transfers naturally to other interactive testbeds such as pedestrians, cyclists, or multi-agent merges, since the intensity dial is agnostic to what the examiner vehicle is; what would need rebuilding is the reward shaping for the new interaction geometry.
  • The near-coincidence of DFR and CSR in many cells of the paper's tables suggests the two metrics often register the same event, so a severity-weighted failure metric (for example, time-to-collision at the moment of failure) would add information the current binary indicators do not provide.
  • A principled next step would be calibrating the $\alpha$ scale to legacy traffic-conflict severity bands so that the paper's Q-levels map onto standard safety metrics; the paper does not perform this mapping.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

6 major / 6 minor

Summary. The paper proposes ExamPPO, an interactive adversarial testing framework in which a reinforcement-learning-controlled Surrounding Vehicle (SV) probes an Autonomous Vehicle (AV) under test. A scalar confrontation factor α ∈ [0, π/2] is embedded in both the SV's observation and its reward, with a multi-head attention policy network, to produce graded, intensity-controllable adversarial behavior. The authors introduce three evaluation metrics—action entropy, confrontation success rate (CSR), and decision failure rate (DFR)—and report experiments in unsignalized intersection, highway, and ramp-merging scenarios against RPID, PPO, and RecurrentPPO AV policies. The central claims are that ExamPPO can continuously modulate adversarial intensity, expose AV decision-making weaknesses, and generalize across environments and AV strategies.

Significance. If the metric-validity concerns are resolved, the framework would be a practically useful benchmarking tool: it provides a clean POMDP formulation, an attention-augmented policy, graded intensity control, and a multi-scenario evaluation protocol. The paper's strengths include a three-seed training protocol, ablations (AdvDQN, ExamPPO-wo, ExamPPO), and tests across three AV decision policies and three road geometries. The proposed intensity-conditioned reward is simple and interpretable. However, the paper's quantitative core—the demonstration that ExamPPO 'exposes decision-making weaknesses'—rests on the DFR labeling rule and on the assumption that the reported trends are emergent rather than constructed by the reward design; both assumptions require substantial additional justification before the results can be accepted.

major comments (6)
  1. [§IV-B, Eq. (8)-(14); Table II] The monotonic intensity-to-failure trend in Table II is largely manufactured by the reward definition. In Eq. (8), α directly scales the adversarial reward through sin(α) and the efficiency reward through cos(α), and the collision reward in §IV-B switches from −1 to +1 at high α. Thus higher α mechanically pushes the SV toward more adversarial and more collision-prone behavior, so the smooth Q1–Q5 progression in CSR, DFR, and PET is a verification of the reward design rather than an emergent property of the learned policy. To support the claim of 'effective modulation,' the authors should include an ablation in which α is removed from the reward (or fixed reward weights are used) while keeping α in the observation, and show that intensity still scales the SV's behavior. Without this, the central demonstration of graded adversarial control is circular.
  2. [§IV-D, Eq. (18), Fig. 3] The DFR judgment rule is asserted rather than validated and is legally questionable for the stated scenario. The text states that when the SV 'executes an unprotected left turn and enters the conflict zone ahead of the AV,' the SV has right of way and a rational AV must yield. This reverses the usual priority rule for unprotected left turns, where the turning vehicle must yield to oncoming straight-through traffic; entering the conflict zone first does not by itself confer priority. Since DFR is the core metric behind the claims that ExamPPO 'expose[s] decision-making weaknesses' and that AV algorithms can be ranked by robustness (Tables I–III), this labeling is load-bearing. The authors need to justify their right-of-way interpretation with a traffic-code or RSS reference, or redefine DFR as a scenario-specific behavioral metric with an explicit, defensible rule. Otherwise, an AV that continues straight at Q4/Q5 may be behaving correctly and be misclassified as a decision failure.
  3. [§V-B; Tables I–III] The paper reports three random seeds (1000, 2000, 2025) but gives no per-seed results, error bars, confidence intervals, or statistical tests for any metric. For example, Table II reports point values such as DFR=100% for RPID at Q4 and DFR=98% at Q5, but the reader cannot tell whether these differences are stable across seeds or within sampling noise. The text repeatedly uses words like 'consistently' and 'stably' (e.g., §V-D), which are not supported by point estimates alone. Report the mean and spread over the three seeds, and ideally a significance test for the comparisons that drive the claims.
  4. [Algorithm 1; §V-B] The reward weights required by the algorithm—ωp, ωc, ωd, ωv, ωa, and ωblock—are never disclosed, and the distance-shaping parameters dmin and dmax in Eq. (10) are not specified. These quantities determine the relative importance of the adversarial sub-objectives and the collision/penalty trade-off, so their omission makes the experiments irreproducible and prevents the reader from assessing whether the reported behavior is sensitive to the chosen balance. Please provide the full set of weights and thresholds used in the experiments.
  5. [§III-B versus §IV-B] There is an internal tension between the stated goal that the SV's 'goal is not to cause collisions' (§III-B) and the reward design that grants +1 for collisions at high α (§IV-B). At Q4 and Q5 a large fraction of episodes end in collision (e.g., 96–100% collision rates in Table II), so the CSR and DFR values at these intensities are largely measuring the SV's ability to collide with the AV, not its ability to expose a distinct decision-making weakness. The authors should separate collision-free DFR/CSR from collision-based outcomes, or justify why rewarding collisions is consistent with the safety-oriented framing of the framework.
  6. [§IV-D, Eq. (17)] The confrontation success rate is defined as the fraction of episodes in which the AV is 'disrupted,' but the text never operationally defines what counts as disruption (e.g., a speed reduction below a threshold, a yield, or a collision). Without a predetermined, measurable criterion, the reported CSR values—96%, 98%, 100%—cannot be independently verified or reproduced. Please provide a concrete decision rule for labeling an episode as a successful confrontation.
minor comments (6)
  1. [§IV-D] The sentence 'despite having enough observations to detect the A V's intention' appears to refer to the SV's intention, not the AV's; please rephrase to avoid pronoun/referent confusion.
  2. [References, §IV-D] The RSS model is cited as reference [27], but reference [27] is an adversarial stress-test paper, not the RSS paper by Shalev-Shwartz et al. Please cite the original RSS source.
  3. [Table II] The table rows are difficult to read because numbers are not separated into clear columns (e.g., 'Q 1 2 0.593 0 2 25.206 98'). Use distinct columns for each metric.
  4. [Figure 3] Panel (b)'s caption says 'The SV yields or creates a safe gap for the A V to proceed, however, the A V unnecessarily decelerates,' which is contradictory: if the SV yields, the AV should not need to decelerate. Please clarify the intended scenario.
  5. [Throughout] There are inconsistent spacing and formatting issues such as 'A Vs' and 'A V' in close proximity (e.g., Abstract, Introduction). A copyedit pass would improve readability.
  6. [§IV-A, Eq. (6)] The notation 'pk ∈ 0, 1' should be written as 'pk ∈ {0, 1}' for clarity.

Circularity Check

2 steps flagged · score 6.0 of 10

The graded intensity-to-failure trend reduces to Eq. (8)'s sin/cos reward interpolation, and the DFR-based 'weakness exposure' verdict rests on a right-of-way rule imported from a self-cited, mislabeled reference; the learned-policy core remains non-tautological.

  1. self definitional [Section IV-B, Eq. (8); Section V-D, Table II]
    "The confrontation strength α modulates the emphasis on adversarial effectiveness and efficiency through its sine and cosine functions: higher values of α increase the weight of radv(t) via sin(α), promoting aggressive interaction, while reducing the influence of reff(t) via cos(α), thus enabling a smooth and continuous adjustment of SV behavior intensity."

    The monotonic Q1-to-Q5 rise in CSR and DFR in Table II is the expected readout of this interpolation. The adversarial component radv(t) explicitly rewards the exact events that CSR and DFR count: Eq. (11) rewards AV speeds below 0.5 m/s, Eq. (12) rewards hard braking within 6 m, and Eq. (13) rewards blocking the AV's forward path. Scaling sin(α) therefore scales the targeted outcome by construction, so the reported 'effectiveness of adversarial modulation' is a restatement of the reward design rather than an independent empirical discovery. The learned-policy component keeps the reduction partial.

  2. self citation load bearing [Section IV-D, Eqs. (17)-(18), reference [27]]
    "This metric draws on the Responsibility-Sensitive Safety (RSS) model [27], a widely accepted formalism that defines interpretable safety rules for autonomous vehicles based on legal norms and human driving principles. ... When the SV executes an unprotected left turn and enters the conflict zone ahead of the A V , it means that the SV has already got the right of the way and a rational A V should yield."

    Reference [27] is X. Cai et al., 'Adversarial stress test for autonomous vehicle via series reinforcement learning tasks with reward shaping,' co-authored by the current corresponding author P. Hang; it is not the RSS formalism. The right-of-way rule that turns non-yielding into N_fail in Eq. (18) is therefore imported from the authors' own prior work and labeled as an external standard. Since DFR is the quantitative core of the claim that ExamPPO 'expose[s] decision-making weaknesses,' the central evaluation reduces to this mislabeled self-citation rather than to an independent safety principle.

full rationale

The paper's engineering core is not definitional: the attention-augmented PPO policy must actually learn to realize the conditioning signal, and the cross-scenario and cross-AV rankings (RecurrentPPO > PPO > RPID) are not literally encoded in the reward equation. Those components keep the paper from being wholly circular. However, two load-bearing steps compromise the derivation. First, the smooth intensity-to-failure trend presented as the main validation of scalable evaluation is built into Eq. (8)'s sin/cos interpolation, because radv rewards exactly the slowing, hard-braking, and path-blocking events that CSR and DFR later count; Table II mostly reads back the objective. Second, the DFR metric used to expose AV weaknesses is justified by citing [27] as the RSS model, but [27] is a prior adversarial-testing paper co-authored by the current corresponding author and is not RSS. The rule that an AV must yield to a left-turning SV that entered the conflict zone first is asserted rather than derived from an external standard; if the conventional right-of-way rule (left turner yields to oncoming through traffic) applies, high DFR at high α may measure the SV's own induced conflict rather than AV error. These issues make the headline weakness-exposure claim partially self-definitional and dependent on a self-citation, so the score is 6 rather than 0-4. It is not 8-10 because the AV-robustness ordering, the attention ablation, and the generalization results are learned, external observations that do not reduce by construction to the reward formula.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The framework's conclusions rest on a large set of hand-set reward weights and shaping thresholds, none of which are reported in full, plus a contested right-of-way labeling rule for DFR, plus simulation-only evidence. The confrontation factor is a control input, but the reward weights that realize it are free parameters.

free parameters (4)
  • ω_p, ω_c (penalty and collision reward weights) = not reported
    Appear in Eq. 8 as ω_p·r_penalty + ω_c·r_collision; no values given, though they set the trade-off between realistic driving and risk-taking.
  • ω_d, ω_v, ω_a, ω_block (adversarial sub-reward weights) = not reported
    Appear in Eq. 9; no values or tuning procedure given.
  • dmin, dmax (distance shaping bounds) = not reported
    Used in Eq. 10 to shape the distance reward; the paper only says a scaled sigmoid with a logistic curve centered at the midpoint.
  • Hand-set shaping thresholds (vmin=1, vmax=8, speed bands 0.5/3.5, decel 1.5 m/s², distance 6 m, blocking 15 m… = specified in Eqs. 11-14 and in text
    These constants define when the SV is rewarded for slowing, braking, or blocking the AV; no sensitivity analysis or physical justification is given.
assumptions (5)
  • domain assumption The POMDP and reward design adequately capture realistic adversarial interaction for AV testing.
    Section III-A and IV-B; no real-world or high-fidelity validation is provided.
  • domain assumption The RSS right-of-way rule is the correct external standard, and SV-first-entry implies the AV must yield.
    Section IV-D and Figure 3; DFR is computed from this interpretation.
  • ad hoc to paper A positive collision reward at high α is compatible with the stated aim of evaluating safety without causing collisions.
    Section IV-B: r_collision = +1 for α > 3π/20; this contradicts the claim that the SV is not meant to cause collisions.
  • domain assumption The modified highway-env simulator is representative enough to support conclusions about AV decision robustness.
    Section V-A; no real-world testing is performed.
  • standard math PPO converges to a policy that is representative of the SV's optimal behavior under the specified reward.
    Section III-C; standard RL assumption, no convergence guarantees or training curves are shown beyond selected episodes.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Interactive Adversarial Testing of Autonomous Vehicles with Adjustable Confrontation Intensity." pith.science (2026). https://pith.science/paper/NZVNLSO6

@misc{pith2026250721814,
  author       = {Pith},
  title        = {Pith review of: Interactive Adversarial Testing of Autonomous Vehicles with Adjustable Confrontation Intensity},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/NZVNLSO6}},
  note         = {Machine review of arXiv:2507.21814}
}
read the original abstract

Scientific testing techniques are essential for ensuring the safe operation of autonomous vehicles (AVs), with high-risk, highly interactive scenarios being a primary focus. To address the limitations of existing testing methods, such as their heavy reliance on high-quality test data, weak interaction capabilities, and low adversarial robustness, this paper proposes ExamPPO, an interactive adversarial testing framework that enables scenario-adaptive and intensity-controllable evaluation of autonomous vehicles. The framework models the Surrounding Vehicle (SV) as an intelligent examiner, equipped with a multi-head attention-enhanced policy network, enabling context-sensitive and sustained behavioral interventions. A scalar confrontation factor is introduced to modulate the intensity of adversarial behaviors, allowing continuous, fine-grained adjustment of test difficulty. Coupled with structured evaluation metrics, ExamPPO systematically probes AV's robustness across diverse scenarios and strategies. Extensive experiments across multiple scenarios and AV strategies demonstrate that ExamPPO can effectively modulate adversarial behavior, expose decision-making weaknesses in tested AVs, and generalize across heterogeneous environments, thereby offering a unified and reproducible solution for evaluating the safety and intelligence of autonomous decision-making systems.

Figures

Figures reproduced from arXiv: 2507.21814 by the authors.

Figure 1
Figure 1. Overview of ExamPPO framework. This framework provides a structured and scalable way to evaluate AV [PITH_FULL_IMAGE:figures/full_fig_p005_1.png] view at source ↗
Figure 2
Figure 2. Cosine similarity between the AV’s heading vector and the relative position vector pointing from the AV to the SV. The other part of the reward function is described as follows. First, the efficiency reward ref f (t) is designed to encourage the SV to maintain reasonable forward motion and avoid stalling behaviors. It is calculated based on the current speed of the SV. When the SV’s speed falls below a minimum thres… view at source ↗
Figure 3
Figure 3. Illustration of AV decision outcomes under right-of-way conflict scenarios. (a) The SV enters the intersection [PITH_FULL_IMAGE:figures/full_fig_p008_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Progressive Evaluation Process of AV Robustness [PITH_FULL_IMAGE:figures/full_fig_p010_4.png]
Figure 5
Figure 5. Figure 5: Comparison of Decision Failure Rate and Con [PITH_FULL_IMAGE:figures/full_fig_p010_5.png]
Figure 7
Figure 7. Figure 7: Progressive Evolution of AV–SV Interactions Across Graded Confrontation Intensities. This figure illustrates [PITH_FULL_IMAGE:figures/full_fig_p012_7.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

36 extracted references · 30 canonical work pages

  1. [1]

    Autonomous driving system: A comprehensive survey,

    J. Zhao, W. Zhao, B. Deng, Z. Wang, F. Zhang, W. Zheng, W. Cao, J. Nan, Y . Lian, and A. F. Burke, “Autonomous driving system: A comprehensive survey,” Expert Systems with Applica- tions, vol. 242, p. 122836, 2024

    work page 2024

  2. [2]

    Milestones in autonomous driving and intelligent vehicles—part i: Control, computing system design, communication, hd map, testing, and human behaviors,

    L. Chen, Y . Li, C. Huang, Y . Xing, D. Tian, L. Li, Z. Hu, S. Teng, C. Lv, J. Wang et al. , “Milestones in autonomous driving and intelligent vehicles—part i: Control, computing system design, communication, hd map, testing, and human behaviors,” IEEE Transactions on Systems, Man, and Cybernetics: Systems, vol. 53, no. 9, pp. 5831–5847, 2023

    work page 2023

  3. [3]

    Toward human-vehicle collaboration: Review and perspectives on human-centered col- laborative automated driving,

    Y . Xing, C. Lv, D. Cao, and P. Hang, “Toward human-vehicle collaboration: Review and perspectives on human-centered col- laborative automated driving,” Transportation research part C: emerging technologies, vol. 128, p. 103199, 2021

    work page 2021

  4. [4]

    Towards learning-based planning: The nuplan benchmark for real-world autonomous driving,

    N. Karnchanachari, D. Geromichalos, K. S. Tan, N. Li, C. Erik- sen, S. Yaghoubi, N. Mehdipour, G. Bernasconi, W. K. Fong, Y . Guo et al. , “Towards learning-based planning: The nuplan benchmark for real-world autonomous driving,” in 2024 IEEE International Conference on Robotics and Automation (ICRA) . IEEE, 2024, pp. 629–636

    work page 2024

  5. [5]

    One thousand and one hours: Self-driving motion prediction dataset,

    J. Houston, G. Zuidhof, L. Bergamini, Y . Ye, L. Chen, A. Jain, S. Omari, V . Iglovikov, and P. Ondruska, “One thousand and one hours: Self-driving motion prediction dataset,” in Conference on Robot Learning. PMLR, 2021, pp. 409–418

    2021

  6. [6]

    Large scale interactive motion forecasting for autonomous driving: The waymo open motion dataset,

    S. Ettinger, S. Cheng, B. Caine, C. Liu, H. Zhao, S. Pradhan, Y . Chai, B. Sapp, C. R. Qi, Y . Zhouet al., “Large scale interactive motion forecasting for autonomous driving: The waymo open motion dataset,” in Proceedings of the IEEE/CVF International Conference on Computer Vision , 2021, pp. 9710–9719

    work page 2021

  7. [7]

    nuscenes: A multimodal dataset for autonomous driving,

    H. Caesar, V . Bankiti, A. H. Lang, S. V ora, V . E. Liong, Q. Xu, A. Krishnan, Y . Pan, G. Baldan, and O. Beijbom, “nuscenes: A multimodal dataset for autonomous driving,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2020, pp. 11 621–11 631

    2020

  8. [8]

    Scenecontrol: Diffusion for controllable traffic scene generation,

    J. Lu, K. Wong, C. Zhang, S. Suo, and R. Urtasun, “Scenecontrol: Diffusion for controllable traffic scene generation,” in 2024 IEEE International Conference on Robotics and Automation (ICRA) . IEEE, 2024, pp. 16 908–16 914

    work page 2024

Show all 36 references
  1. [9]

    Transfuser: Imitation with transformer-based sensor fusion for autonomous driving,

    K. Chitta, A. Prakash, B. Jaeger, Z. Yu, K. Renz, and A. Geiger, “Transfuser: Imitation with transformer-based sensor fusion for autonomous driving,” IEEE transactions on pattern analysis and machine intelligence, vol. 45, no. 11, pp. 12 878–12 895, 2022

    2022

  2. [10]

    Parting with misconceptions about learning-based vehicle motion planning,

    D. Dauner, M. Hallgarten, A. Geiger, and K. Chitta, “Parting with misconceptions about learning-based vehicle motion planning,” in Conference on Robot Learning . PMLR, 2023, pp. 1268– 1281

    2023

  3. [11]

    A survey on automated driving system testing: Landscapes and trends,

    S. Tang, Z. Zhang, Y . Zhang, J. Zhou, Y . Guo, S. Liu, S. Guo, Y .-F. Li, L. Ma, Y . Xue et al. , “A survey on automated driving system testing: Landscapes and trends,” ACM Transactions on Software Engineering and Methodology , vol. 32, no. 5, pp. 1– 62, 2023

    2023

  4. [12]

    Testing of autonomous driving systems: where are we and where should we go?

    G. Lou, Y . Deng, X. Zheng, M. Zhang, and T. Zhang, “Testing of autonomous driving systems: where are we and where should we go?” in Proceedings of the 30th ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering, 2022, pp. 31–43

    2022

  5. [13]

    Specification-based autonomous driving system testing,

    Y . Zhou, Y . Sun, Y . Tang, Y . Chen, J. Sun, C. M. Poskitt, Y . Liu, and Z. Yang, “Specification-based autonomous driving system testing,” IEEE Transactions on Software Engineering , vol. 49, no. 6, pp. 3391–3410, 2023

    2023

  6. [14]

    Target: Traffic rule-based test generation for autonomous driving systems,

    Y . Deng, Z. Tu, J. Yao, M. Zhang, T. Zhang, and X. Zheng, “Target: Traffic rule-based test generation for autonomous driving systems,” IEEE Transactions on Software Engineering , 2025

    2025

  7. [15]

    Causality-driven testing of autonomous driving systems,

    L. Giamattei, A. Guerriero, R. Pietrantuono, and S. Russo, “Causality-driven testing of autonomous driving systems,” ACM Transactions on Software Engineering and Methodology, vol. 33, no. 3, pp. 1–35, 2024

    2024

  8. [16]

    Parameter coverage for testing of autonomous driving systems under uncertainty,

    T. Laurent, S. Klikovits, P. Arcaini, F. Ishikawa, and A. Ven- tresque, “Parameter coverage for testing of autonomous driving systems under uncertainty,” ACM Transactions on Software En- gineering and Methodology , vol. 32, no. 3, pp. 1–31, 2023

    2023

  9. [17]

    Uncertainty-aware decision-making for autonomous driving at uncontrolled intersections,

    X. Tang, G. Zhong, S. Li, K. Yang, K. Shu, D. Cao, and X. Lin, “Uncertainty-aware decision-making for autonomous driving at uncontrolled intersections,” IEEE Transactions on Intelligent Transportation Systems, vol. 24, no. 9, pp. 9725–9735, 2023

    2023

  10. [18]

    Towards robust autonomous driving systems through adversarial test set generation,

    D. Unal, F. O. Catak, M. T. Houkan, M. Mudassir, and M. Ham- moudeh, “Towards robust autonomous driving systems through adversarial test set generation,” ISA transactions , vol. 132, pp. 69–79, 2023

    2023

  11. [19]

    Deepmaneuver: Adver- sarial test generation for trajectory manipulation of autonomous vehicles,

    M. von Stein, D. Shriver, and S. Elbaum, “Deepmaneuver: Adver- sarial test generation for trajectory manipulation of autonomous vehicles,” IEEE Transactions on Software Engineering , vol. 49, no. 10, pp. 4496–4509, 2023

    2023

  12. [20]

    Accelerated testing and evaluation for black-box autonomous driving systems via adaptive markov chain monte carlo,

    Y . Ji, Z. Xu, C. Zhao, K. Chen, and Y . Du, “Accelerated testing and evaluation for black-box autonomous driving systems via adaptive markov chain monte carlo,” IEEE Transactions on Intelligent Transportation Systems, 2025

    2025

  13. [21]

    Explainable deep adversarial reinforce- ment learning approach for robust autonomous driving,

    C. Wang and N. Aouf, “Explainable deep adversarial reinforce- ment learning approach for robust autonomous driving,” IEEE Transactions on Intelligent Vehicles, 2024

    2024

  14. [22]

    Deep learn- ing adversarial attacks and defenses in autonomous vehicles: a systematic literature review from a safety perspective,

    A. D. M. Ibrahum, M. Hussain, and J.-E. Hong, “Deep learn- ing adversarial attacks and defenses in autonomous vehicles: a systematic literature review from a safety perspective,” Artificial Intelligence Review, vol. 58, no. 1, pp. 1–53, 2025

    2025

  15. [23]

    Behavexplor: Behavior diversity guided testing for autonomous driving systems,

    M. Cheng, Y . Zhou, and X. Xie, “Behavexplor: Behavior diversity guided testing for autonomous driving systems,” in Proceedings of the 32nd ACM SIGSOFT International Symposium on Software Testing and Analysis, 2023, pp. 488–500

    2023

  16. [24]

    Towards human-centric autonomous driving: A fast-slow architecture in- tegrating large language model guidance with reinforcement learning,

    C. Xu, J. Liu, Y . Guo, Y . Zhang, P. Hang, and J. Sun, “Towards human-centric autonomous driving: A fast-slow architecture in- tegrating large language model guidance with reinforcement learning,” arXiv preprint arXiv:2505.06875 , 2025

    2025 arXiv

  17. [25]

    Event-triggered parallel control us- ing deep reinforcement learning with application to comfortable autonomous driving,

    J. Lu, L. Li, and F.-Y . Wang, “Event-triggered parallel control us- ing deep reinforcement learning with application to comfortable autonomous driving,” IEEE Transactions on Intelligent Vehicles , 2024

    2024

  18. [26]

    A survey on recent advancements in autonomous driving using deep reinforcement learning: Applications, challenges, and solutions,

    R. Zhao, Y . Li, Y . Fan, F. Gao, M. Tsukada, and Z. Gao, “A survey on recent advancements in autonomous driving using deep reinforcement learning: Applications, challenges, and solutions,” IEEE Transactions on Intelligent Transportation Systems , 2024

    2024

  19. [27]

    Adversarial stress test for autonomous vehicle via series reinforcement learn- 15 ing tasks with reward shaping,

    X. Cai, X. Bai, Z. Cui, P. Hang, H. Yu, and Y . Ren, “Adversarial stress test for autonomous vehicle via series reinforcement learn- 15 ing tasks with reward shaping,” IEEE Transactions on Intelligent Vehicles, 2024

    2024

  20. [28]

    Reinforcement learning for online testing of au- tonomous driving systems: a replication and extension study,

    L. Giamattei, M. Biagiola, R. Pietrantuono, S. Russo, and P. Tonella, “Reinforcement learning for online testing of au- tonomous driving systems: a replication and extension study,” Empirical Software Engineering , vol. 30, no. 1, p. 19, 2025

    2025

  21. [29]

    Adaptive testing environment generation for connected and automated vehicles with dense reinforcement learning,

    J. Yang, R. Bai, H. Ji, Y . Zhang, J. Hu, and S. Feng, “Adaptive testing environment generation for connected and automated vehicles with dense reinforcement learning,” IEEE Transactions on Intelligent Transportation Systems , 2025

    2025

  22. [30]

    Challenger: Affordable adversar- ial driving video generation,

    Z. Xu, B. Li, H.-a. Gao, M. Gao, Y . Chen, M. Liu, C. Yan, H. Zhao, S. Feng, and H. Zhao, “Challenger: Affordable adversar- ial driving video generation,” arXiv preprint arXiv:2505.15880 , 2025

    2025 arXiv

  23. [31]

    Seal: To- wards safe autonomous driving via skill-enabled adversary learning for closed-loop scenario generation,

    B. Stoler, I. Navarro, J. Francis, and J. Oh, “Seal: To- wards safe autonomous driving via skill-enabled adversary learning for closed-loop scenario generation,” arXiv preprint arXiv:2409.10320, 2024

    2024 arXiv

  24. [32]

    Partially observable markov decision processes,

    M. T. Spaan, “Partially observable markov decision processes,” in Reinforcement learning: State-of-the-art. Springer, 2012, pp. 387–414

    2012

  25. [33]

    Proximal policy optimization algorithms,

    J. Schulman, F. Wolski, P. Dhariwal, A. Radford, and O. Klimov, “Proximal policy optimization algorithms,” arXiv preprint arXiv:1707.06347, 2017

    2017 arXiv

  26. [34]

    An environment for autonomous driving decision-making,

    E. Leurent et al. , “An environment for autonomous driving decision-making,” 2018

    2018

  27. [35]

    Adversarial testing with reinforcement learning: A case study on autonomous driving,

    A. Doreste, M. Biagiola, and P. Tonella, “Adversarial testing with reinforcement learning: A case study on autonomous driving,” in 2024 IEEE Conference on Software Testing, Verification and Validation (ICST). IEEE, 2024, pp. 293–304

    2024

  28. [36]

    Trajectory optimization of connected and autonomous vehicles at a multilane freeway merging area,

    X. Hu and J. Sun, “Trajectory optimization of connected and autonomous vehicles at a multilane freeway merging area,” Transportation Research Part C: Emerging Technologies , vol. 101, pp. 111–125, 2019

    2019

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.