Pith. sign in

REVIEW 6 major objections 5 minor 2 cited by

Adversarial Generation and Collaborative Evolution of Safety-Critical Scenarios for Autonomous Vehicles

T0 review · 6 major / 5 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read ScenGE, a two-stage scenario generator, reports that its adversarial driving scenarios produce a 31.96% higher average collision rate across multiple reinforcement-learning agents than state-of-the-art baselines, and that training on these

desk verdict Useful, well-engineered AV scenario generation work; simulation results are credible, but the real-world validation is uncontrolled and the headline numbers lack variance estimates. read the letter →

arxiv 2508.14527 v2 pith:OUSTIPOO submitted 2025-08-20 cs.CV

Jiangfan Liu , Yongkang Guo , Fangzhi Zhong , Tianyuan Zhang , Zonglei Jing , Siyuan Liang , Jiakai Wang , Mingchuan Zhang
show 2 more authors
Aishan Liu Xianglong Liu
This is my paper
classification cs.CV
keywords safety-criticalscenariogenerationautonomousdrivingsafetyadversarialtestinglargelanguagemodelsretrieval-augmentedmulti-agenttrajectoryoptimizationreinforcementlearningsim-to-realtransfer
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper proposes ScenGE, a two-stage pipeline for generating safety-critical driving scenarios. Given only a text description of an ordinary scene, the first stage uses a large language model grounded in structured driving knowledge to invent a single adversarial agent and turns the description into executable simulation code. The second stage coordinates nearby background vehicles, chosen through an attention-based collaborator graph, and optimizes their trajectories to shrink the ego vehicle's escape space and block its line of sight. Across several reinforcement-learning driving agents and eight base scenarios, the generated scenarios produced a substantially higher collision rate (on average +31.96% over strong baselines), and adversarial training on them improved downstream robustness, with supporting real-world and human-evaluation evidence.

What carries the argument

The adversarial collaborator graph: a frame-wise attention matrix whose queries are the ego and adversarial trajectories and whose keys are background trajectories, with a temporal mask and decay bias to identify the top-k influential background vehicles and their most relevant keyframes. The selected trajectory segments are then perturbed by gradient steps on a three-term loss — proximity to the ego, alignment with the ego–adversary line of sight, and kinematic smoothness — with updates projected back to a feasible space to preserve realism.

What would settle it

Run the generated scenarios against a production-grade autonomous driving stack (full sensor suite and planner, not a reinforcement-learning policy) in a closed-course test with matched benign baselines; if collision and near-miss rates are not substantially above baseline, the simulator-based proxy that anchors the evaluation would be falsified.

Watch

Extended reading notes

Core claim

ScenGE's central claim is that novel safety-critical scenarios for autonomous vehicles can be produced by chaining two complementary mechanisms: knowledge-grounded large-language-model reasoning to propose a plausible adversarial threat, and collaborative trajectory optimization of background traffic to amplify that threat. The load-bearing mechanism is the adversarial collaborator graph, an attention-derived ranking of which background vehicles most influence the ego vehicle and the adversary; optimizing the top-ranked vehicles' trajectories under a loss that rewards proximity, line-of-sight occlusion, and smoothness turns a single-agent threat into a coordinated dilemma. The framework repo

Load-bearing premise

The claim that these scenarios reveal real safety flaws rests on the assumption that collision rate and overall score measured in a configurable urban simulator with three reinforcement-learning agents are a valid proxy for how a production autonomous vehicle would behave on real roads.

Editorial extensions

If this is right

  • Scenario catalogs can be expanded from finite rule templates to open-ended combinations of semantic adversarial intent and coordinated background motion, exposing failure modes that predefined threat patterns miss.
  • The generated scenarios can serve as adversarial training data that lowers collision rates of reinforcement-learning driving policies and improves trajectory-following on real-world image sequences.
  • The two-stage recipe is modular enough to port to different simulators and to test against driving policies beyond the initially evaluated reinforcement-learning agents, including language-model-based drivers.
  • The scenarios induce failures without relying on simple rule violations, which means they can stress planning and perception blind spots that compliance-only testing would not reach.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The attention-based collaborator selection is not driving-specific; the same 'invent a threat, amplify it through coordinated agents' pattern could transfer to other multi-agent safety domains such as warehouse robotics, air traffic, or pedestrian crowds, though the paper does not test this.
  • The gains from grounding the language model in structured driving knowledge suggest that scenario diversity is bounded by that knowledge base; a broader or continuously updated source, including near-miss reports, might reveal still more failure modes than the current taxonomy-derived set.
  • If the real-world tests were repeated with a full production perception stack and controlled baselines, the reported pedestrian and left-turn failure rates would be a sharper test of whether simulator-generated threats transfer to real vehicles; the paper leaves that comparison open.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

6 major / 5 minor

Summary. The paper proposes ScenGE, a two-stage framework for generating safety-critical driving scenarios. Stage 1 (Meta-Scenario Generation) uses an LLM with retrieval-augmented grounding over driving regulations, license-test questions, and NHTSA pre-crash typologies to produce a single adversarial agent, instantiated as Scenic code in CARLA. Stage 2 (Complex Scenario Evolution) builds an adversarial collaborator graph from an attention matrix, selects key background vehicles, and perturbs their trajectory segments via a gradient-based objective intended to reduce the ego's maneuvering space and create occlusions. The paper reports SafeBench/CARLA evaluations on PPO, SAC, and TD3, with a higher average collision rate (0.820) and lower overall score than baselines; it also reports ablations, generalization to LMDrive and MetaDrive, adversarial training experiments, human evaluation, and real-vehicle tests.

Significance. If the simulation results are reproducible and the objective is correctly specified, ScenGE is a potentially useful contribution: it combines LLM-driven semantic novelty with multi-agent trajectory optimization, and it demonstrates transfer to another simulator and to a vision-language driving policy. The adversarial-training results, once metric directions are clarified, would add practical value. However, the central quantitative claims currently rest on load-bearing issues: the optimization objective in Eqs. (3.3)-(3.4) is internally inconsistent; the headline +31.96% cannot be recovered from Table 1; no variance or seed information supports the main comparisons; and the real-world experiments are uncontrolled. These issues are addressable in a revision, but they prevent acceptance as written.

major comments (6)
  1. [Sec. 3.3, Eqs. (3.3)-(3.4)] The objective is written as an arg max of L, but all three terms are described as penalties or minimizers: L_ego 'minimizes the Euclidean distance,' L_smooth 'penalizes second-order differences,' and L_occ 'minimizes the normalized perpendicular distance.' With positive λ1..λ3 and an arg max, the optimization as written would push background vehicles away from the ego, encourage non-smooth trajectories, and misalign the occlusion term. Either the signs or the arg max are wrong. Since this is the core trajectory-perturbation module, please correct the formulation and state the actually implemented objective.
  2. [Abstract/Introduction vs. Table 1] The paper claims '+31.96% collision cases on average' over SoTA baselines. From Table 1, Ours CR=0.820 vs. ChatScene=0.751 is a 9.2% relative increase, and vs. the average of all listed baselines (0.500) it is about 63.9%. No definition reproduces 31.96%. Please specify the exact baseline set and calculation used for the headline number.
  3. [Sec. 4.1 and Sec. 4.3] All headline metrics in Tables 1 and 2 are point estimates with no seeds, error bars, or statistical tests. The final configuration ('Best Config' in Fig. 3) is selected from an ablation scatter on the same CR/OS metrics used for the main result. This selection, combined with the missing variance information, makes it difficult to assess whether the reported 82.0% CR and the +31.96% claim are significant. Please report mean±std over multiple seeds and clarify whether the final configuration was chosen before or independently of the main evaluation.
  4. [Sec. 4.6] The real-world experiments are uncontrolled: the same vehicle is not tested on matched benign scenes, the autonomy stack and sensor configuration are undisclosed, and n=15 per scenario. The 73.3% and 60% failure rates therefore cannot be attributed to ScenGE; they may simply characterize the test vehicle's general limitations. The text's claim of 'definitive, physical-world evidence' is not supported by the described protocol. Please add control conditions or substantially soften the claim to a demonstration that the scenario types are physically executable.
  5. [Sec. 3.3, Eq. (3.2)] The attention formulation is under-specified. The dimensions of τ_ego, τ_adv, and (τ_1,...,τ_N) are not defined; no normalization such as softmax is specified; the forms of M_m and M_d are not given; and 'log M_d' with γ=0.8 is unclear. Since the collaborator graph and keyframe selection depend on this matrix, please provide the full formulas and dimensions.
  6. [Sec. 4.5, Table 4] The table header repeats 'OS↓' from the adversarial-effectiveness tables, but the text interprets a higher OS (0.947) as an improvement ('increasing the OS by 94.7%'). If OS is the AV overall score in the robustness evaluation, its direction is reversed relative to Tables 1-2; if it is the same OS, the reported improvement is contradicted. Please clarify the metric direction and also provide the pre-training baseline needed to compute the claimed 3.1% CR reduction and 94.7% OS increase.
minor comments (5)
  1. [Sec. 3.2] The retrieval function f_R is described only as selecting relevant entries from D. Please specify the retrieval implementation (e.g., embedding similarity, keyword matching) and the number of retrieved entries used in the prompt.
  2. [Sec. 3.3] The notation '∥·∥⊥' for the perpendicular distance in Eq. (3.4) is nonstandard; please define it explicitly. Also, the definition of τ̃_ego and τ̃_adv in the objective is missing—are these the ego/adversary segments within the same temporal window as τ̃_i*?
  3. [Sec. 4.4] The MetaDrive generalization result is only shown qualitatively in Fig. 4. Please report the collision rate or another quantitative metric for the MetaDrive experiments.
  4. [Sec. 4.7] The human evaluation reports very high plausibility (4.765/5) and perceived risk (4.934/5) but gives no confidence intervals, inter-rater agreement, or comparison with non-adversarial baseline videos. Adding these would strengthen the realism claim.
  5. [Throughout] The notation 'SCEN GE' is typeset inconsistently (sometimes 'SCEN GE', sometimes 'SCENGE', sometimes 'ScenGE'). Also, in Table 4 the direction arrow on CR is '↑' although lower values are better for the trained agent; please harmonize the metric-direction annotations.

Circularity Check

0 steps flagged · score 2.0 of 10

No derivation-reducing circularity: collision rates are measured in closed-loop simulation, not derived from the objective; however, the headline 82.0% is the best of several ablation settings selected on the same evaluation metric, and the real-world validation lacks a control condition.

full rationale

The central claim that ScenGE generates more safety-critical scenarios is not an identity between the method's objective and the reported outcome. The trajectory-perturbation loss (Eq. 3.4) is a hand-designed combination of proximity, line-of-sight alignment, and smoothness terms, but the collision rate and overall score are obtained by running external RL agents (PPO, SAC, TD3) in CARLA under SafeBench metrics and averaging over 800 scenarios. The reported CR/OS are therefore measured outcomes, not quantities read off the objective function. No load-bearing self-citation or imported uniqueness theorem is used: the baselines (LC, AS, CS, AT, ChatScene) are external, the benchmark is SafeBench, and the NHTSA pre-crash typology is an independent public source. The main caveats are statistical selection and missing control rather than circularity. First, Sec. 4.3 states that 'Perturbing 4 agents performs best with CR 82%' and 'Perturbing 60% of the segment achieves the best result with CR 82%', and Fig. 3 labels this as 'Best Config'; the headline 82.0% in Tab. 1 is thus the maximum over several ablation settings evaluated on the same eight-scenario test set. This mildly inflates the reported effect through selection on the evaluation metric, but it does not make the collision rate equivalent to the loss by construction. Second, Sec. 4.6 claims 'definitive, physical-world evidence' from real-vehicle tests that 'recreated and repeated two challenging scenarios' but reports no benign control condition and does not disclose the autonomy stack; failure rates of 73.3% and 60% could reflect the test vehicle's general limitations rather than the specific scenarios. This is a threat to external validity, not a circular derivation. Overall, the simulation-based central result remains self-contained and independently measurable, so the circularity score is low.

Assumptions & free parameters 5 free parameters · 4 assumptions · 0 invented entities

The central result depends on a small set of hand-tuned hyperparameters and on two domain assumptions: that geometric proximity/occlusion captures adversarial threat, and that CARLA+SafeBench metrics transfer to real roads. No new physical or conceptual entities are introduced.

free parameters (5)
  • lambda1, lambda2, lambda3 (loss weights) = 0.3, 0.2, 0.5
    Hand-chosen weights for closeness, occlusion, and smoothness terms in Eq. (3.4); ablations show sensitivity.
  • gamma (temporal decay) = 0.8
    Decay factor for attention matrix in Eq. (3.2); hand-set.
  • N (background vehicles) = 10
    Number of background vehicles; a design choice.
  • K (collaborator count) = 4
    Number of vehicles selected for perturbation; chosen as best in ablation (2, 4, 6).
  • perturbation ratio = 60%
    Fraction of trajectory segment perturbed; chosen as best in ablation (50%, 60%, 70%).
assumptions (4)
  • domain assumption The geometric objective L in Eq. (3.4) operationally defines 'threat': reducing distance to ego and aligning with the ego-adversary line-of-sight makes scenarios harder.
    This is the core modeling assumption of Complex Scenario Evolution; it is not derived from any first-principles model of driving risk.
  • domain assumption The knowledge base (27 regulations, 100 exam questions, 14 pre-crash typologies) is sufficient to ensure the LLM generates plausible and safety-critical behaviors.
    The adequacy of this small curated set is taken for granted in Sec. 3.2.
  • domain assumption CARLA's physics and SafeBench metrics (CR, OS) are valid proxies for real-world AV safety.
    The headline results are entirely from this simulation environment; the real-world validation is limited and on an undisclosed stack.
  • standard math Trajectories can be treated as vectors for the attention and cross-product computations in Eqs. (3.2) and (3.4).
    The paper uses dot products and cross products over trajectory sequences without defining the vector space or temporal alignment precisely.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Adversarial Generation and Collaborative Evolution of Safety-Critical Scenarios for Autonomous Vehicles." pith.science (2026). https://pith.science/paper/OUSTIPOO

@misc{pith2026250814527,
  author       = {Pith},
  title        = {Pith review of: Adversarial Generation and Collaborative Evolution of Safety-Critical Scenarios for Autonomous Vehicles},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/OUSTIPOO}},
  note         = {Machine review of arXiv:2508.14527}
}
read the original abstract

The generation of safety-critical scenarios in simulation has become increasingly crucial for safety evaluation in autonomous vehicles prior to road deployment in society. However, current approaches largely rely on predefined threat patterns or rule-based strategies, which limit their ability to expose diverse and unforeseen failure modes. To overcome these, we propose ScenGE, a framework that can generate plentiful safety-critical scenarios by reasoning novel adversarial cases and then amplifying them with complex traffic flows. Given a simple prompt of a benign scene, it first performs Meta-Scenario Generation, where a large language model, grounded in structured driving knowledge, infers an adversarial agent whose behavior poses a threat that is both plausible and deliberately challenging. This meta-scenario is then specified in executable code for precise in-simulator control. Subsequently, Complex Scenario Evolution uses background vehicles to amplify the core threat introduced by Meta-Scenario. It builds an adversarial collaborator graph to identify key agent trajectories for optimization. These perturbations are designed to simultaneously reduce the ego vehicle's maneuvering space and create critical occlusions. Extensive experiments conducted on multiple reinforcement learning based AV models show that ScenGE uncovers more severe collision cases (+31.96%) on average than SoTA baselines. Additionally, our ScenGE can be applied to large model based AV systems and deployed on different simulators; we further observe that adversarial training on our scenarios improves the model robustness. Finally, we validate our framework through real-world vehicle tests and human evaluation, confirming that the generated scenarios are both plausible and critical. We hope our paper can build up a critical step towards building public trust and ensuring their safe deployment.

Discussion (0). Sign in to comment.

Forward citations

Cited by 2 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. NSF-HRPT: Neural Semantic Field meets Hierarchical Risk Perception Tree for Safety-Critical Scenario Assessment

    cs.AI 2026-08 conditional novelty 6.0 of 10

    A simulator-trained neural semantic field plus a hierarchical risk tree estimates per-agent collision risk and time-to-collision from monocular video, with foundation-model features used to close the sim-to-real gap w...

  2. GuardAD: Safeguarding Autonomous Driving MLLMs via Markovian Safety Logic

    cs.AI 2026-05 unverdicted novelty 6.0 of 10

    GuardAD reduces accident rates by 32% in autonomous driving MLLMs by using n-th order Markovian logic to infer latent hazards and revise actions.

Reference graph

Works this paper leans on

63 extracted references · 48 canonical work pages · cited by 2 Pith papers

  1. [1]

    nuscenes: A multimodal dataset for autonomous driving

    Holger Caesar, Varun Bankiti, Alex H Lang, Sourabh V ora, Venice Erin Liong, Qiang Xu, Anush Krishnan, Yu Pan, Giancarlo Baldan, and Oscar Beijbom. nuscenes: A multimodal dataset for autonomous driving. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 11621–11631, 2020

    2020

  2. [2]

    Text2scenario: Text-driven scenario generation for autonomous driving test

    Xuan Cai, Xuesong Bai, Zhiyong Cui, Danmu Xie, Daocheng Fu, Haiyang Yu, and Yilong Ren. Text2scenario: Text-driven scenario generation for autonomous driving test. arXiv preprint arXiv:2503.02911, 2025

    arXiv 2025

  3. [3]

    Advdo: Realistic adversarial attacks for trajectory prediction

    Yulong Cao, Chaowei Xiao, Anima Anandkumar, Danfei Xu, and Marco Pavone. Advdo: Realistic adversarial attacks for trajectory prediction. In European Conference on Computer Vision, pages 36–52. Springer, 2022

    work page 2022

  4. [4]

    Adversarial evaluation of autonomous vehicles in lane-change scenarios

    Baiming Chen, Xiang Chen, Qiong Wu, and Liang Li. Adversarial evaluation of autonomous vehicles in lane-change scenarios. IEEE transactions on intelligent transportation systems , 23(8):10333–10342, 2021

    work page 2021

  5. [5]

    Carla Scenario Runner

    Scenario Runner Contributors. Carla Scenario Runner. https://github.com/ carla-simulator/scenario_runner, 2019

    work page 2019

  6. [6]

    Learning to collide: An adaptive safety-critical scenarios generating method

    Wenhao Ding, Baiming Chen, Minjun Xu, and Ding Zhao. Learning to collide: An adaptive safety-critical scenarios generating method. In 2020 IEEE/RSJ International Conference on Intelligent Robots and Systems (IROS), pages 2243–2250. IEEE, 2020

    work page 2020

  7. [7]

    A survey on in-context learning

    Qingxiu Dong, Lei Li, Damai Dai, Ce Zheng, Jingyuan Ma, Rui Li, Heming Xia, Jingjing Xu, Zhiyong Wu, Tianyu Liu, Baobao Chang, Xu Sun, Lei Li, and Zhifang Sui. A survey on in-context learning. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pages 1107–1128, Miami, Florida, USA, 2024. Association for Computational...

    work page 2024

  8. [8]

    CARLA: An open urban driving simulator

    Alexey Dosovitskiy, German Ros, Felipe Codevilla, Antonio Lopez, and Vladlen Koltun. CARLA: An open urban driving simulator. In Proceedings of the 1st Annual Conference on Robot Learning, pages 1–16, 2017

    work page 2017

Show all 63 references
  1. [9]

    Trafficgen: Learning to generate diverse and realistic traffic scenarios

    Lan Feng, Quanyi Li, Zhenghao Peng, Shuhan Tan, and Bolei Zhou. Trafficgen: Learning to generate diverse and realistic traffic scenarios. In 2023 IEEE international conference on robotics and automation (ICRA), pages 3567–3575. IEEE, 2023

    2023

  2. [10]

    Dense reinforcement learning for safety validation of autonomous vehicles

    Shuo Feng, Haowei Sun, Xintao Yan, Haojie Zhu, Zhengxia Zou, Shengyin Shen, and Henry X Liu. Dense reinforcement learning for safety validation of autonomous vehicles. Nature, 615(7953):620–627, 2023

    2023

  3. [11]

    Scenic: a language for scenario specification and scene generation

    Daniel J Fremont, Tommaso Dreossi, Shromona Ghosh, Xiangyu Yue, Alberto L Sangiovanni- Vincentelli, and Sanjit A Seshia. Scenic: a language for scenario specification and scene generation. In Proceedings of the 40th ACM SIGPLAN Conference on Programming Language Design and Imp...

    2019

  4. [12]

    Scenic: A language for scenario specification and data generation

    Daniel J Fremont, Edward Kim, Tommaso Dreossi, Shromona Ghosh, Xiangyu Yue, Alberto L Sangiovanni-Vincentelli, and Sanjit A Seshia. Scenic: A language for scenario specification and data generation. Machine Learning, pages 1–45, 2022

    2022

  5. [13]

    Addressing function approximation error in actor-critic methods

    Scott Fujimoto, Herke van Hoof, and David Meger. Addressing function approximation error in actor-critic methods. In Proceedings of the 35th International Conference on Machine Learning, volume 80, pages 1587–1596, 2018

    2018

  6. [14]

    MagicDrive: Street view generation with diverse 3d geometry control

    Ruiyuan Gao, Kai Chen, Enze Xie, Lanqing Hong, Zhenguo Li, Dit-Yan Yeung, and Qiang Xu. MagicDrive: Street view generation with diverse 3d geometry control. In International Conference on Learning Representations, 2024

    2024

  7. [15]

    A comprehensive evaluation framework for deep model robustness

    Jun Guo, Wei Bao, Jiakai Wang, Yuqing Ma, Xinghai Gao, Gang Xiao, Aishan Liu, Jian Dong, Xianglong Liu, and Wenjun Wu. A comprehensive evaluation framework for deep model robustness. Pattern Recognition, 2023. 11

    2023

  8. [16]

    Soft actor-critic: Off-policy maximum entropy deep reinforcement learning with a stochastic actor

    Tuomas Haarnoja, Aurick Zhou, Pieter Abbeel, and Sergey Levine. Soft actor-critic: Off-policy maximum entropy deep reinforcement learning with a stochastic actor. In Proceedings of the 35th International Conference on Machine Learning, volume 80, pages 1861–1870, 2018

    2018

  9. [17]

    Planning-oriented autonomous driving

    Yihan Hu, Jiazhi Yang, Li Chen, Keyu Li, Chonghao Sima, Xizhou Zhu, Siqi Chai, Senyao Du, Tianwei Lin, Wenhai Wang, Lewei Lu, Xiaosong Jia, Qiang Liu, Jifeng Dai, Yu Qiao, and Hongyang Li. Planning-oriented autonomous driving. In Proceedings of the IEEE/CVF Conference on Compu...

    2023

  10. [18]

    Metadrive: Com- posing diverse driving scenarios for generalizable reinforcement learning

    Quanyi Li, Zhenghao Peng, Zhenghai Xue, Qihang Zhang, and Bolei Zhou. Metadrive: Com- posing diverse driving scenarios for generalizable reinforcement learning. arXiv preprint arXiv:2109.12674, 2021

    2021 arXiv

  11. [19]

    Chatsumo: Large language model for automating traffic scenario generation in simulation of urban mobility

    Shuyang Li, Talha Azfar, and Ruimin Ke. Chatsumo: Large language model for automating traffic scenario generation in simulation of urban mobility. IEEE Transactions on Intelligent Vehicles, 2024

    2024

  12. [20]

    Bevformer: Learning bird’s-eye-view representation from multi-camera images via spatiotemporal transformers

    Zhiqi Li, Wenhai Wang, Hongyang Li, Enze Xie, Chonghao Sima, Tong Lu, Yu Qiao, and Jifeng Dai. Bevformer: Learning bird’s-eye-view representation from multi-camera images via spatiotemporal transformers. In European Conference on Computer Vision, pages 36–52. Springer, 2022

    2022

  13. [21]

    A large-scale multiple-objective method for black-box attack against object detection

    Siyuan Liang, Longkang Li, Yanbo Fan, Xiaojun Jia, Jingzhi Li, Baoyuan Wu, and Xiaochun Cao. A large-scale multiple-objective method for black-box attack against object detection. In European Conference on Computer Vision, 2022

    2022

  14. [22]

    Revisiting backdoor attacks against large vision-language models from domain shift

    Siyuan Liang, Jiawei Liang, Tianyu Pang, Chao Du, Aishan Liu, Mingli Zhu, Xiaochun Cao, and Dacheng Tao. Revisiting backdoor attacks against large vision-language models from domain shift. In Proceedings of the Computer Vision and Pattern Recognition Conference , pages 9477–9486, 2025

    2025

  15. [23]

    Object detectors in the open environment: Challenges, solutions, and outlook

    Siyuan Liang, Wei Wang, Ruoyu Chen, Aishan Liu, Boxi Wu, Ee-Chien Chang, Xiaochun Cao, and Dacheng Tao. Object detectors in the open environment: Challenges, solutions, and outlook. arXiv preprint arXiv:2403.16271, 2024

    2024 arXiv

  16. [24]

    Efficient adversarial attacks for visual object tracking

    Siyuan Liang, Xingxing Wei, Siyuan Yao, and Xiaochun Cao. Efficient adversarial attacks for visual object tracking. In Computer Vision–ECCV 2020: 16th European Conference, Glasgow, UK, August 23–28, 2020, Proceedings, Part XXVI 16, 2020

    2020

  17. [25]

    Parallel rect- angle flip attack: A query-based black-box attack against object detection

    Siyuan Liang, Baoyuan Wu, Yanbo Fan, Xingxing Wei, and Xiaochun Cao. Parallel rect- angle flip attack: A query-based black-box attack against object detection. arXiv preprint arXiv:2201.08970, 2022

    2022 arXiv

  18. [26]

    Badclip: Dual-embedding guided backdoor attack on multimodal contrastive learning

    Siyuan Liang, Mingli Zhu, Aishan Liu, Baoyuan Wu, Xiaochun Cao, and Ee-Chien Chang. Badclip: Dual-embedding guided backdoor attack on multimodal contrastive learning. arXiv preprint arXiv:2311.12075, 2023

    2023 arXiv

  19. [27]

    X-adv: Physical adversarial object attacks against x-ray prohibited item detection

    Aishan Liu, Jun Guo, Jiakai Wang, Siyuan Liang, Renshuai Tao, Wenbo Zhou, Cong Liu, Xianglong Liu, and Dacheng Tao. X-adv: Physical adversarial object attacks against x-ray prohibited item detection. In USENIX Security Symposium, 2023

    2023

  20. [28]

    Spatiotemporal attacks for embodied agents

    Aishan Liu, Tairan Huang, Xianglong Liu, Yitao Xu, Yuqing Ma, Xinyun Chen, Stephen J Maybank, and Dacheng Tao. Spatiotemporal attacks for embodied agents. In ECCV, 2020

    2020

  21. [29]

    Perceptual-sensitive gan for generating adversarial patches

    Aishan Liu, Xianglong Liu, Jiaxin Fan, Yuqing Ma, Anlan Zhang, Huiyuan Xie, and Dacheng Tao. Perceptual-sensitive gan for generating adversarial patches. In AAAI, 2019

    2019

  22. [30]

    Training robust deep neural networks via adversarial noise propagation

    Aishan Liu, Xianglong Liu, Hang Yu, Chongzhi Zhang, Qiang Liu, and Dacheng Tao. Training robust deep neural networks via adversarial noise propagation. TIP, 2021

    2021

  23. [31]

    Towards defending multiple lp-norm bounded adversarial perturbations via gated batch normalization

    Aishan Liu, Shiyu Tang, Xinyun Chen, Lei Huang, Haotong Qin, Xianglong Liu, and Dacheng Tao. Towards defending multiple lp-norm bounded adversarial perturbations via gated batch normalization. International Journal of Computer Vision, 2023. 12

    2023

  24. [32]

    Exploring the relationship between architecture and adversarially robust generalization

    Aishan Liu, Shiyu Tang, Siyuan Liang, Ruihao Gong, Boxi Wu, Xianglong Liu, and Dacheng Tao. Exploring the relationship between architecture and adversarially robust generalization. In CVPR, 2023

    2023

  25. [33]

    Bias- based universal adversarial patch attack for automatic check-out

    Aishan Liu, Jiakai Wang, Xianglong Liu, Bowen Cao, Chongzhi Zhang, and Hang Yu. Bias- based universal adversarial patch attack for automatic check-out. In ECCV, 2020

    2020

  26. [34]

    Natural reflection backdoor attack on vision language model for autonomous driving

    Ming Liu, Siyuan Liang, Koushik Howlader, Liwen Wang, Dacheng Tao, and Wensheng Zhang. Natural reflection backdoor attack on vision language model for autonomous driving. arXiv preprint arXiv:2505.06413, 2025

    2025 arXiv

  27. [35]

    Harnessing perceptual adversarial patches for crowd counting

    Shunchang Liu, Jiakai Wang, Aishan Liu, Yingwei Li, Yijie Gao, Xianglong Liu, and Dacheng Tao. Harnessing perceptual adversarial patches for crowd counting. In ACM CCS, 2022

    2022

  28. [36]

    Multimodal large language model driven scenario testing for autonomous vehicles

    Qiujing Lu, Xuanhan Wang, Yiwei Jiang, Guangming Zhao, Mingyue Ma, and Shuo Feng. Multimodal large language model driven scenario testing for autonomous vehicles. arXiv preprint arXiv:2409.06450, 2024

    2024 arXiv

  29. [37]

    Dolphins: Multimodal language model for driving

    Yingzi Ma, Yulong Cao, Jiachen Sun, Marco Pavone, and Chaowei Xiao. Dolphins: Multimodal language model for driving. In European Conference on Computer Vision, pages 403–420. Springer, 2024

    2024

  30. [38]

    Pre-crash scenario typology for crash avoidance research

    Wassim G Najm, John D Smith, Mikio Yanagisawa, et al. Pre-crash scenario typology for crash avoidance research. Technical report, United States. National Highway Traffic Safety Administration, 2007

    2007

  31. [39]

    Generating useful accident-prone driving scenarios via a learned traffic prior

    Davis Rempe, Jonah Philion, Leonidas J Guibas, Sanja Fidler, and Or Litany. Generating useful accident-prone driving scenarios via a learned traffic prior. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 17305–17315, 2022

    2022

  32. [40]

    Proximal policy optimization algorithms

    John Schulman, Filip Wolski, Prafulla Dhariwal, Alec Radford, and Oleg Klimov. Proximal policy optimization algorithms. arXiv preprint arXiv:1707.06347, 2017

    2017 arXiv

  33. [41]

    Lmdrive: Closed-loop end-to-end driving with large language models

    Hao Shao, Yuxuan Hu, Letian Wang, Guanglu Song, Steven L Waslander, Yu Liu, and Hong- sheng Li. Lmdrive: Closed-loop end-to-end driving with large language models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 15120–15130, 2024

    2024

  34. [42]

    Trafficsim: Learning to simulate realistic multi-agent behaviors

    Simon Suo, Sebastian Regalado, Sergio Casas, and Raquel Urtasun. Trafficsim: Learning to simulate realistic multi-agent behaviors. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 10400–10409, 2021

    2021

  35. [43]

    Scenegen: Learning to generate realistic traffic scenes

    Shuhan Tan, Kelvin Wong, Shenlong Wang, Sivabalan Manivasagam, Mengye Ren, and Raquel Urtasun. Scenegen: Learning to generate realistic traffic scenes. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 892–901, 2021

    2021

  36. [44]

    Robustart: Benchmarking robustness on architecture design and training techniques

    Shiyu Tang, Ruihao Gong, Yan Wang, Aishan Liu, Jiakai Wang, Xinyun Chen, Fengwei Yu, Xianglong Liu, Dawn Song, Alan Yuille, et al. Robustart: Benchmarking robustness on architecture design and training techniques. ArXiv, 2021

    2021

  37. [45]

    Carla autonomous driving leaderboard

    CARLA team. Carla autonomous driving leaderboard. https://leaderboard.carla.org/,

  38. [46]

    Qwq-32b: Embracing the power of reinforcement learning, March 2025

    Qwen Team. Qwq-32b: Embracing the power of reinforcement learning, March 2025

    2025

  39. [47]

    Lmm-enhanced safety-critical scenario generation for autonomous driving system testing from non-accident traffic videos

    Haoxiang Tian, Xingshuo Han, Guoquan Wu, Yuan Zhou, Shuo Li, Jun Wei, Dan Ye, Wei Wang, and Tianwei Zhang. Lmm-enhanced safety-critical scenario generation for autonomous driving system testing from non-accident traffic videos. arXiv preprint arXiv:2406.10857, 2024

    2024 arXiv

  40. [48]

    Dual attention suppression attack: Generate adversarial camouflage in physical world

    Jiakai Wang, Aishan Liu, Zixin Yin, Shunchang Liu, Shiyu Tang, and Xianglong Liu. Dual attention suppression attack: Generate adversarial camouflage in physical world. In CVPR, 2021. 13

    2021

  41. [49]

    Advsim: Generating safety-critical scenarios for self- driving vehicles

    Jingkang Wang, Ava Pun, James Tu, Sivabalan Manivasagam, Abbas Sadat, Sergio Casas, Mengye Ren, and Raquel Urtasun. Advsim: Generating safety-critical scenarios for self- driving vehicles. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pa...

    2021

  42. [50]

    Drive- dreamer: Towards real-world-drive world models for autonomous driving

    Xiaofeng Wang, Zheng Zhu, Guan Huang, Xinze Chen, Jiagang Zhu, and Jiwen Lu. Drive- dreamer: Towards real-world-drive world models for autonomous driving. In European Confer- ence on Computer Vision, pages 55–72. Springer, 2024

    2024

  43. [51]

    Driving into the future: Multiview visual forecasting and planning with world model for autonomous driving

    Yuqi Wang, Jiawei He, Lue Fan, Hongxin Li, Yuntao Chen, and Zhaoxiang Zhang. Driving into the future: Multiview visual forecasting and planning with world model for autonomous driving. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages...

    2024

  44. [52]

    Limsim: A long-term interactive multi-scenario traffic simulator

    Licheng Wen, Daocheng Fu, Song Mao, Pinlong Cai, Min Dou, Yikang Li, and Yu Qiao. Limsim: A long-term interactive multi-scenario traffic simulator. In 2023 IEEE 26th International Conference on Intelligent Transportation Systems (ITSC), pages 1255–1262. IEEE, 2023

    2023

  45. [53]

    Retrieval-augmented generation for natural language processing: A survey

    Shangyu Wu, Ying Xiong, Yufei Cui, Haolun Wu, Can Chen, Ye Yuan, Lianming Huang, Xue Liu, Tei-Wei Kuo, Nan Guan, et al. Retrieval-augmented generation for natural language processing: A survey. arXiv preprint arXiv:2407.13193, 2024

    2024 arXiv

  46. [54]

    V2xp-asg: Generating adversarial scenes for vehicle-to-everything perception

    Hao Xiang, Runsheng Xu, Xin Xia, Zhaoliang Zheng, Bolei Zhou, and Jiaqi Ma. V2xp-asg: Generating adversarial scenes for vehicle-to-everything perception. In 2023 IEEE International Conference on Robotics and Automation (ICRA), pages 3584–3591. IEEE, 2023

    2023

  47. [55]

    Safebench: A benchmarking platform for safety evaluation of autonomous vehicles

    Chejian Xu, Wenhao Ding, Weijie Lyu, Zuxin Liu, Shuai Wang, Yihan He, Hanjiang Hu, Ding Zhao, and Bo Li. Safebench: A benchmarking platform for safety evaluation of autonomous vehicles. Advances in Neural Information Processing Systems, 35:25667–25682, 2022

    2022

  48. [56]

    Diffscene: Diffusion-based safety- critical scenario generation for autonomous vehicles

    Chejian Xu, Aleksandr Petiushko, Ding Zhao, and Bo Li. Diffscene: Diffusion-based safety- critical scenario generation for autonomous vehicles. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 39, pages 8797–8805, 2025

    2025

  49. [57]

    Interpreting and improving adversarial robustness of deep neural networks with neuron sensitivity

    Chongzhi Zhang, Aishan Liu, Xianglong Liu, Yitao Xu, Hang Yu, Yuqing Ma, and Tianlin Li. Interpreting and improving adversarial robustness of deep neural networks with neuron sensitivity. IEEE Transactions on Image Processing, 2021

    2021

  50. [58]

    Chatscene: Knowledge-enabled safety-critical scenario generation for autonomous vehicles

    Jiawei Zhang, Chejian Xu, and Bo Li. Chatscene: Knowledge-enabled safety-critical scenario generation for autonomous vehicles. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 15459–15469, 2024

    2024

  51. [59]

    On adversarial robustness of trajectory prediction for autonomous vehicles

    Qingzhao Zhang, Shengtuo Hu, Jiachen Sun, Qi Alfred Chen, and Z Morley Mao. On adversarial robustness of trajectory prediction for autonomous vehicles. arXiv preprint arXiv:2201.05057, 2022

    2022 arXiv

  52. [60]

    Chat2scenario: Scenario extraction from dataset through utilization of large language model

    Yongqi Zhao, Wenbo Xiao, Tomislav Mihalj, Jia Hu, and Arno Eichberger. Chat2scenario: Scenario extraction from dataset through utilization of large language model. In 2024 IEEE Intelligent Vehicles Symposium (IV), pages 559–566. IEEE, 2024

    2024

  53. [61]

    Occworld: Learning a 3d occupancy world model for autonomous driving

    Wenzhao Zheng, Weiliang Chen, Yuanhui Huang, Borui Zhang, Yueqi Duan, and Jiwen Lu. Occworld: Learning a 3d occupancy world model for autonomous driving. In European Conference on Computer Vision, pages 55–72. Springer, 2025

    2025

  54. [62]

    Language-guided traffic simulation via scene-level diffusion

    Ziyuan Zhong, Davis Rempe, Yuxiao Chen, Boris Ivanovic, Yulong Cao, Danfei Xu, Marco Pavone, and Baishakhi Ray. Language-guided traffic simulation via scene-level diffusion. In Conference on Robot Learning, pages 144–177. PMLR, 2023. 14

    2023

  55. [2020]

    Accessed: 2021-02-11

    2021

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.