SafeCoop: Unravelling Full Stack Safety in Agentic Collaborative Driving

TL;DR

SafeCoop tackles full-stack safety for language-driven agentic collaborative driving by introducing a three-layer defense pipeline (Firewall, LPC, MSC) and an Agentic Transformation Function to maintain SE($3$)-consistent cross-agent language. It formalizes four adversarial attack surfaces (CD, RI, CS, MCF) and demonstrates, via closed-loop CARLA experiments across $32$ scenarios, that the defense can recover substantial driving safety and achieve robust malicious-detection performance (up to $67.32\%$ F1). The work provides concrete defense mechanisms, ablation insights, and cross-MLLM evaluations, illustrating the practical viability and remaining challenges of secure, language-based V2X collaboration. Overall, SafeCoop advances safe, secure, and trustworthy agentic communication for transportation systems and establishes reproducible benchmarks for future research.

Abstract

Collaborative driving systems leverage vehicle-to-everything (V2X) communication across multiple agents to enhance driving safety and efficiency. Traditional V2X systems take raw sensor data, neural features, or perception results as communication media, which face persistent challenges, including high bandwidth demands, semantic loss, and interoperability issues. Recent advances investigate natural language as a promising medium, which can provide semantic richness, decision-level reasoning, and human-machine interoperability at significantly lower bandwidth. Despite great promise, this paradigm shift also introduces new vulnerabilities within language communication, including message loss, hallucinations, semantic manipulation, and adversarial attacks. In this work, we present the first systematic study of full-stack safety and security issues in natural-language-based collaborative driving. Specifically, we develop a comprehensive taxonomy of attack strategies, including connection disruption, relay/replay interference, content spoofing, and multi-connection forgery. To mitigate these risks, we introduce an agentic defense pipeline, which we call SafeCoop, that integrates a semantic firewall, language-perception consistency checks, and multi-source consensus, enabled by an agentic transformation function for cross-frame spatial alignment. We systematically evaluate SafeCoop in closed-loop CARLA simulation across 32 critical scenarios, achieving 69.15% driving score improvement under malicious attacks and up to 67.32% F1 score for malicious detection. This study provides guidance for advancing research on safe, secure, and trustworthy language-driven collaboration in transportation systems. Our project page is https://xiangbogaobarry.github.io/SafeCoop.

Figures (3)

• Figure 1: We study full-stack safety for agentic collaborative driving (to be explained in \ref{['sec:lcd']}, via identifying four key attack surfaces and introducing an agentic defense pipeline which substantially recovers performance under malicious conditions, as shown in the bar chart. The bottom part provides a conceptual illustration of an attack on agentic collaborative driving scenarios, highlighting how malicious attacks emerge and how SafeCoop agents are designed to counter them.
• Figure 2: Adversarial Threats in Collaborative Driving.
• Figure 3: Agentic Defense for Collaborative Driving