Paper accepted in IEEE Access: “AVATAR”
The planner, the module that decides how an autonomous vehicle moves, operates in complex multi-agent traffic. While adversarial machine learning has revealed numerous vulnerabilities in perception and trajectory prediction modules, attacks targeting the planning module itself have received little attention.
In this work, we propose AVATAR, an adversarial trajectory attack in which a single surrounding vehicle, controlled by a reinforcement learning agent, drives in a broadly rule-compliant manner while steering the ego vehicle’s planner toward unsafe decisions. Evaluated in the Waymax closed-loop simulator built on the Waymo Open Motion Dataset, against four victim planners (rule-based, reinforcement-learning-based, imitation-learning-based, and world-model-based), collision-targeted attacks reduce the average safety score, where 1.0 indicates no collision, from 1.0 to 0.27. We further propose a defense framework that combines a planner-agnostic residual-based anomaly detector with a conservative fallback planner, restoring the average safety score from 0.27 to 0.94.
[Paper]
Jiadong Liu, Tatsuya Mori, “Adversarial Trajectory Attack Targeting Autonomous Driving Planners with Residual-based Defense,” IEEE Access, to appear, 2026.