We are thrilled to announce that our journal paper entitled “Adversarial Trajectory Attack Targeting Autonomous Driving Planners with Residual-based Defense” has been accepted for publication in IEEE Access. Congratulations Liu-kun!

In this work, we propose AVATAR, an adversarial trajectory attack in which a single surrounding vehicle, controlled by a reinforcement learning agent, generates dynamically feasible, smooth, and broadly rule-compliant trajectories that steer the ego vehicle’s planner toward unsafe decisions. Evaluated in the Waymax closed-loop simulator against four victim planners (rule-based, RL-based, imitation-learning-based, and world-model-based), collision-targeted attacks drop the average safety score from 1.0 to 0.27. We further propose a defense framework that combines a planner-agnostic residual-based anomaly detector with a conservative fallback planner, restoring the average safety score to 0.94 with no collisions observed in benign runs.

Jiadong Liu and Tatsuya Mori, "Adversarial Trajectory Attack Targeting Autonomous Driving Planners with Residual-based Defense." IEEE Access, to appear, 2026.