Feasibility-Aware Adversarial Scenario Generation
Abstract
Abstract— Safety validation of autonomous vehicles (AVs) demands rigorous evaluation against critical, low-probability traffic events that are exceedingly rare in naturalistic road driving. Adversarial scenario generation offers an effective, automated solution by learning reactive non-ego policies that actively challenge the ego planner in simulation. However, existing adversarial methods frequently optimize for collision rates at the expense of behavioral realism—generating unnatural, traffic-rule-violating maneuvers (such as abrupt wrong-way driving, boundary incursions, or severe right-of-way infractions) that undermine the credibility and validity of the evaluation test cases.
To resolve this limitation, this paper introduces a feasibility-aware framework for generating safety-critical driving scenarios while enforcing strict traffic-rule compliance for non-ego adversarial agents. Grounded in Hamilton-Jacobi reachability theory, our approach pre-trains a feasibility value network offline from naturalistic driving demonstrations to approximate the Largest Feasible Region (LFR) governed by drivable areas, speed limits, and right-of-way conventions. During online adversarial reinforcement learning, the learned feasibility function plays a dual role: it constrains non-ego agents toward rule-compliant actions via feasibility advantages, while rewarding adversarial behaviors that guide the ego AV into states from which subsequent rule violations or collisions are unavoidable.
We evaluate the framework in the CARLA simulator across diverse road topologies, including intersection negotiations and straight-lane urban corridors, against established adversarial generation baselines. The evaluation demonstrates that our data-driven feasibility network achieves high fidelity against ground-truth traffic-rule constraints, while our dual-feasibility policy effectively exposes ego planner vulnerabilities and achieves a 66.2% reduction in non-ego rule infractions.
Model Architecture & Methodology
Figure: Framework Overview. (1) Offline: Estimates the Largest Feasible Region ($\mathcal{S}_f^*$) under traffic rules from vectorized road maps and actor kinematics. (2) Online: Constrains non-ego adversaries to rule-compliant actions while rewarding maneuvers that drive the ego vehicle into unavoidable violation states.
1. Offline Feasibility Representation
To circumvent high-order analytical barrier certificates and avoid dangerous exploratory crashes in simulation, we learn the Largest Feasible Region (LFR) offline from naturalistic driving demonstrations $\mathcal{D} = \{\tau_k\}$. Local road topologies are encoded as vectorized semantic polylines $\mathcal{M} = \{v_1, \dots, v_N\}$ (lane centers, stop lines, road boundaries) and surrounding vehicles are parameterized as kinematic actor states $z_{\text{actor}}$. A PointNet-style encoder with symmetric max-pooling extracts a compact, permutation-invariant representation.
Given traffic rules governing drivable areas, speed limits, and right-of-way, we define a constraint margin function: $$h(s) = \begin{cases} -1, & \text{if } r(s) \le 0 \\ r(s), & \text{if } r(s) > 0 \end{cases}$$ The optimal state-value function $V_h^*(s) := \min_\pi \max_{t} h(s_t)$ and action-value function $Q_h^*(s, a)$ are learned via asymmetric expectile regression. The sub-zero level set defines the Largest Feasible Region: $$\mathcal{S}_f^* := \{s \mid V_h^*(s) \le 0\}$$ Any state where $V_h^*(s) \le 0$ guarantees the existence of a feasible control trajectory avoiding all rule infractions, whereas $V_h^*(s) > 0$ marks an unavoidable failure set.
2. Online Dual-Feasibility Adversarial Policy Learning
During online policy optimization (PPO) in CARLA, the pre-trained canonical feasibility network is queried from egocentric viewpoints to govern the Critical Background Vehicle (CBV) adversary:
- Non-Ego Rule Compliance: The adversarial policy advantage blends task reward advantage $A_r(s,a)$ and feasibility advantage $A_h^*(s,a) = Q_h^*(s,a) - V_h^*(s)$. If candidate actions risk violating traffic rules ($V_h^*(s') > 0$), $A_h^*$ penalizes the gradient update, strictly retaining the CBV within its Largest Feasible Region.
- Ego Infeasibility Reward Bonus: The adversary receives an explicit bonus reward $r_{\text{ego violation}}$ whenever its maneuver successfully transitions the ego vehicle into an infeasible state ($V_h^*(g^{\text{AV}}(s)) > 0$). This targets intrinsic planner deficiencies without resorting to suicidal or rule-breaking behaviors by the adversary.
Experimental Results
Fidelity of the Learned Feasibility Region
Validation of the data-driven feasibility value function against ground-truth traffic-rule constraint boundaries across challenging road layouts.
Intersection Scenario
(a) Learned Feasibility Region
(b) Ground-Truth Safety Region
Straight-Lanes Scenario
(a) Learned Feasibility Region
(b) Ground-Truth Safety Region
Purple bounding boxes indicate surrounding background vehicles; grey arrows denote candidate poses and velocity vectors of the central vehicle. Blue regions denote the safe/feasible set (Vh* ≤ 0) where a rule-compliant solution exists. Red regions denote the unavoidable failure set (Vh* > 0). The learned network closely reconstructs the intricate right-of-way priority boundaries at multi-lane crossings.
Quantitative Performance Across Traffic Rule Constraints
Evaluation of ego rule exposure vs. non-ego rule compliance aggregated across 70 simulation episodes in CARLA.
| Rule Category | Original FREA (Baseline) | Modified FREA (Ours) | Non-Ego Violation Reduction | ||
|---|---|---|---|---|---|
| Ego Violation ↑ | Non-Ego Violation ↓ | Ego Violation ↑ | Non-Ego Violation ↓ | ||
| Right-of-Way Rule | 0.148 ± 0.025 | 0.784 ± 0.146 | 0.138 ± 0.023 | 0.268 ± 0.053 | −65.8% |
| Drivable Region Rule | 0.000 ± 0.000 | 0.202 ± 0.046 | 0.000 ± 0.000 | 0.034 ± 0.012 | −83.2% |
| Max Speed Rule | 0.000 ± 0.000 | 0.292 ± 0.085 | 0.000 ± 0.000 | 0.143 ± 0.050 | −51.0% |
| Total Violation Score | 14.844 ± 2.513 | 80.721 ± 15.082 | 13.800 ± 2.367 | 27.309 ± 5.393 | −66.2% |
Note: Rule violations represent
rule_violation × frequency aggregated across 70
episodes. The total violation score is computed as: $100 \times
r_{\text{RoW}} + 10 \times r_{\text{driv}} + r_{\text{speed}}$.
While baseline adversarial methods induce rampant non-ego rule
infractions (score of 80.72) to force collisions, our
feasibility-aware framework reduces non-ego infractions by
66.2% (down to 27.31) while sustaining
near-identical adversarial stress on the ego planner (13.80 vs
14.84).
Qualitative Rollout Comparison
Side-by-side simulation rollouts in CARLA: Unconstrained baseline vs. our feasibility-aware policy.
Original FREA (Baseline)
Unconstrained adversary executes aggressive, rule-violating maneuvers (e.g. crossing lane boundaries and right-of-way infractions) to force collisions.
Feasibility-Aware (Ours)
Strictly maintains non-ego traffic-rule compliance while strategically guiding the ego autonomous vehicle into an unavoidable failure state.
Project Presentation
Interactive slide deck detailing the background, methodology, feasibility value formulation, and simulation benchmarks.
Open Presentation PDF (960×540)
