脱轨：利用违反安全的对抗扰动劫持生成式端到端驾驶规划器的评分头
Off the Rails: Hijacking the Scoring Head in Generative End-to-End Driving Planners with Safety-Violating Adversarial Perturbations
AI总结：
针对生成式端到端自动驾驶规划器中评分头的攻击面，提出Derail对抗框架，通过安全违规目标扰动使轨迹选择从安全候选翻转为不安全候选，评分下降39-80%，碰撞率高达50%。
摘要：
生成模型最近在端到端自动驾驶中迅速被采用，基于扩散的去噪和基于词汇的检索成为主导的轨迹解码范式。尽管架构多样，当前的生成式AD规划器共享一个共同的推理模式：一组固定的候选轨迹（锚点、词汇条目或提议查询）由一个或多个学习到的头根据鸟瞰图特征进行评分，得分最高的候选被返回为最终轨迹。在这种设计下，评分头是感知与运动命令之间的唯一屏障，其竞争候选之间的决策边界通常很小。我们引入了Derail，一个利用这一评分头攻击面的对抗框架。在各种生成式规划器上评估，Derail将轨迹选择从安全候选翻转为不安全候选，评分下降39-80%，碰撞率高达50%，始终优于通用的损失最大化和特征散度攻击。我们的分析表明，违反安全的目标支配着对生成式AD规划器的攻击有效性，并且评分头推理模式本身是一个值得明确防御考虑的反复出现的攻击面。
英文摘要：
Generative models have recently seen rapid adoption in End-to-End (E2E) autonomous driving (AD), with diffusion-based denoising and vocabulary-based retrieval becoming the dominant trajectory-decoding paradigms. Despite their architectural diversity, current generative AD planners share a common inference pattern: a fixed set of candidate trajectories (anchors, vocabulary entries, or proposal queries) is scored by one or more learned heads conditioned on the Bird's-Eye-View (BEV) features, and the highest-scored candidate is returned as the final trajectory. Under this design, the scoring head is the only barrier between perception and the motion command, and its decision margins between competing candidates are often small. We introduce \textsc{Derail}, an adversarial framework that exploits this scoring-head attack surface. Evaluated on various generative planners, \textsc{Derail} flips the trajectory selection from a safe to an unsafe candidate, with score drops of $39$--$80\%$ and collision rates of up to $50\%$, consistently outperforming generic loss-maximization and feature-divergence attacks. Our analysis suggests that safety-violating objectives govern attack effectiveness against generative AD planners, and that the scoring-head inference pattern itself is a recurring attack surface worth explicit defensive consideration.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
