Off the Rails: Hijacking the Scoring Head in Generative End-to-End Driving Planners with Safety-Violating Adversarial Perturbations

2026-06-29

AI Summary

This work addresses a critical vulnerability in generative end-to-end autonomous driving planners, where the scoring head—serving as the sole decision boundary between perception and control—is susceptible to adversarial manipulation. The authors propose Derail, a novel adversarial attack framework that, for the first time, systematically exploits this common weakness by perturbing bird’s-eye-view features to specifically manipulate trajectory scores assigned by the scoring head, optimizing directly for safety violations. Experiments across both diffusion-based and retrieval-based trajectory decoding architectures demonstrate that Derail achieves score reversals in 39%–80% of cases across diverse planners and induces collision rates as high as 50%, substantially outperforming general-purpose adversarial methods. These findings underscore the inherent safety risks posed by the scoring head mechanism in current planning systems.

Abstract

Generative models have recently seen rapid adoption in End-to-End (E2E) autonomous driving (AD), with diffusion-based denoising and vocabulary-based retrieval becoming the dominant trajectory-decoding paradigms. Despite their architectural diversity, current generative AD planners share a common inference pattern: a fixed set of candidate trajectories (anchors, vocabulary entries, or proposal queries) is scored by one or more learned heads conditioned on the Bird's-Eye-View (BEV) features, and the highest-scored candidate is returned as the final trajectory. Under this design, the scoring head is the only barrier between perception and the motion command, and its decision margins between competing candidates are often small. We introduce \textsc{Derail}, an adversarial framework that exploits this scoring-head attack surface. Evaluated on various generative planners, \textsc{Derail} flips the trajectory selection from a safe to an unsafe candidate, with score drops of $39$--$80\%$ and collision rates of up to $50\%$, consistently outperforming generic loss-maximization and feature-divergence attacks. Our analysis suggests that safety-violating objectives govern attack effectiveness against generative AD planners, and that the scoring-head inference pattern itself is a recurring attack surface worth explicit defensive consideration.

Problem

• adversarial perturbations
• generative driving planners
• scoring head
• safety violation
• autonomous driving

Innovation

• adversarial perturbations
• scoring head
• generative planning
• end-to-end driving
• safety violation