CAT: Closed-loop Adversarial Training for Safe End-to-End Driving
The CAT framework employs environment augmentation and probabilistic decomposition for efficient closed-loop adversarial training, significantly improving autonomous driving safety.
Key Findings
Methodology
This paper introduces the CAT (Closed-loop Adversarial Training) framework, integrating environment augmentation with Bayesian probabilistic decomposition to generate safety-critical scenarios dynamically. It leverages a pre-trained deep traffic prediction model (DenseTNT) to forecast multi-modal traffic trajectories. The core innovation lies in decomposing the joint distribution of traffic scenarios into traffic prior, ego vehicle response, and collision likelihood, enabling efficient adversarial scenario generation. During training, multiple candidate opponent trajectories are sampled, and the most collision-prone scenario is selected for environment reset. The driving policy is optimized via reinforcement learning or imitation learning in a closed-loop manner, continuously challenging the agent with adversarial scenarios to improve robustness.
Key Results
- In MetaDrive experiments, CAT achieved a 91% success rate in generating adversarial scenarios, outperforming STRIVE's 85%, while maintaining a low average generation time of 0.66 seconds per scene compared to STRIVE's 153 seconds. Post-training, the RL agent's collision rate decreased by 15%, and route completion increased by 4%, demonstrating enhanced safety and efficiency.
- Across 500 real-world scenarios, the trained policy showed a significant reduction in crash rates and an increase in successful navigation, validating the effectiveness of environment-augmented adversarial training. The approach also maintained high scene realism and diversity, crucial for practical deployment.
- Compared to existing methods, CAT balances high attack success with computational efficiency, making large-scale, real-time closed-loop training feasible, thus addressing a key bottleneck in autonomous driving safety research.
Significance
This work advances the field by providing a scalable, efficient method for generating safety-critical scenarios that challenge autonomous driving policies in a realistic manner. By integrating environment augmentation with probabilistic scene decomposition, it addresses the core challenge of simulating rare but critical traffic events. The approach enhances the robustness of autonomous systems, paving the way for safer deployment in complex, unpredictable real-world environments. Its compatibility with various end-to-end learning strategies makes it a versatile tool for industry and academia, fostering safer autonomous vehicle development.
Technical Contribution
The primary technical contribution is the novel probabilistic scene decomposition framework that enables efficient adversarial scenario generation. By leveraging deep traffic prediction models and Bayesian factorization, the method reduces computational costs significantly compared to prior gradient-based or static sampling approaches. The integration of environment augmentation with closed-loop RL training creates a robust adversarial learning pipeline, capable of producing diverse, realistic, and safety-critical traffic scenarios in real time. This framework broadens the scope of environment-aware adversarial training, offering theoretical guarantees on scenario plausibility and attack effectiveness.
Novelty
This study is the first to apply Bayesian probabilistic decomposition for real-time, scalable adversarial scenario generation in autonomous driving. Unlike previous static or gradient-based methods, CAT dynamically generates safety-critical traffic scenarios by combining traffic prior models with reactive ego behavior, all within a closed-loop training pipeline. This approach significantly reduces computational overhead while maintaining high scenario fidelity, representing a major step forward in environment augmentation techniques for autonomous vehicle safety.
Limitations
- The approach depends on the accuracy of the pre-trained traffic prediction model; inaccuracies in traffic forecasting may lead to less realistic adversarial scenarios, especially in highly unpredictable traffic conditions.
- Current focus is primarily on two-vehicle collision scenarios; extending to multi-vehicle interactions remains challenging and computationally demanding.
- The Bayesian factorization, while efficient, involves approximations that may introduce bias in highly complex or dense traffic environments, potentially limiting scenario diversity.
Future Work
Future research will explore integrating multi-modal sensor data to improve scenario realism, extending adversarial generation to multi-agent interactions, and developing adaptive algorithms for even larger-scale real-time training. Additionally, efforts will be made to enhance the robustness of traffic prediction models and incorporate more complex traffic behaviors, aiming to further close the gap between simulation and real-world deployment.
AI Executive Summary
Autonomous driving has made remarkable progress, yet safety remains a critical challenge. Existing training methods often rely on static datasets, which fail to encompass the rare but dangerous traffic scenarios that can lead to accidents. This gap limits the robustness of autonomous systems in unpredictable real-world environments. To address this, the present study introduces the CAT (Closed-loop Adversarial Training) framework, a novel approach that dynamically generates safety-critical traffic scenarios during training. By combining environment augmentation with Bayesian probabilistic decomposition, CAT efficiently produces realistic adversarial scenes that challenge the driving policy, forcing it to learn safer behaviors.
The core of this approach involves leveraging a deep traffic prediction model, DenseTNT, to forecast multi-modal traffic trajectories. These predictions are then decomposed into three components: traffic prior, ego vehicle response, and collision likelihood. This decomposition allows the system to efficiently identify and generate the most dangerous scenarios in real time, significantly reducing computational costs compared to previous gradient-based or static sampling methods. During training, multiple candidate opponent trajectories are sampled, and the most collision-prone scenario is selected to reset the simulation environment, creating a closed-loop adversarial learning process.
Experimental validation in the MetaDrive simulator, using 500 real-world traffic scenarios, demonstrates the effectiveness of CAT. The generated adversarial scenarios achieved a 91% success rate, outperforming prior methods such as STRIVE. The trained RL agent exhibited a 15% reduction in collision rate and a 4% increase in route completion on test scenarios, confirming the method's ability to improve safety robustness. The approach balances high scenario realism with computational efficiency, making large-scale, real-time training feasible.
This work offers a significant step toward safer autonomous vehicles by enabling continuous, environment-aware adversarial training. Its broad applicability and efficiency suggest promising future directions, including multi-agent scenario generation and integration with multi-sensor data, ultimately fostering the development of more reliable autonomous driving systems.
Deep Dive
Abstract
Driving safety is a top priority for autonomous vehicles. Orthogonal to prior work handling accident-prone traffic events by algorithm designs at the policy level, we investigate a Closed-loop Adversarial Training (CAT) framework for safe end-to-end driving in this paper through the lens of environment augmentation. CAT aims to continuously improve the safety of driving agents by training the agent on safety-critical scenarios that are dynamically generated over time. A novel resampling technique is developed to turn log-replay real-world driving scenarios into safety-critical ones via probabilistic factorization, where the adversarial traffic generation is modeled as the multiplication of standard motion prediction sub-problems. Consequently, CAT can launch more efficient physical attacks compared to existing safety-critical scenario generation methods and yields a significantly less computational cost in the iterative learning pipeline. We incorporate CAT into the MetaDrive simulator and validate our approach on hundreds of driving scenarios imported from real-world driving datasets. Experimental results demonstrate that CAT can effectively generate adversarial scenarios countering the agent being trained. After training, the agent can achieve superior driving safety in both log-replay and safety-critical traffic scenarios on the held-out test set. Code and data are available at https://metadriverse.github.io/cat.