Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

DTP-Attack: A decision-based black-box adversarial attack on trajectory prediction

Jiaxiang Li, Jun Yan, Daniel Watzenig, Huilin Yin

Abstract

Trajectory prediction systems are critical for autonomous vehicle safety, yet remain vulnerable to adversarial attacks that can cause catastrophic traffic behavior misinterpretations. Existing attack methods require white-box access with gradient information and rely on rigid physical constraints, limiting real-world applicability. We propose DTP-Attack, a decision-based black-box adversarial attack framework tailored for trajectory prediction systems. Our method operates exclusively on binary decision outputs without requiring model internals or gradients, making it practical for real-world scenarios. DTP-Attack employs a novel boundary walking algorithm that navigates adversarial regions without fixed constraints, naturally maintaining trajectory realism through proximity preservation. Unlike existing approaches, our method supports both intention misclassification attacks and prediction accuracy degradation. Extensive evaluation on nuScenes and Apolloscape datasets across state-of-the-art models including Trajectron++ and Grip++ demonstrates superior performance. DTP-Attack achieves 41 - 81% attack success rates for intention misclassification attacks that manipulate perceived driving maneuvers with perturbations below 0.45 m, and increases prediction errors by 1.9 - 4.2 for accuracy degradation. Our method consistently outperforms existing black-box approaches while maintaining high controllability and reliability across diverse scenarios. These results reveal fundamental vulnerabilities in current trajectory prediction systems, highlighting urgent needs for robust defenses in safety-critical autonomous driving applications.

DTP-Attack: A decision-based black-box adversarial attack on trajectory prediction

Abstract

Trajectory prediction systems are critical for autonomous vehicle safety, yet remain vulnerable to adversarial attacks that can cause catastrophic traffic behavior misinterpretations. Existing attack methods require white-box access with gradient information and rely on rigid physical constraints, limiting real-world applicability. We propose DTP-Attack, a decision-based black-box adversarial attack framework tailored for trajectory prediction systems. Our method operates exclusively on binary decision outputs without requiring model internals or gradients, making it practical for real-world scenarios. DTP-Attack employs a novel boundary walking algorithm that navigates adversarial regions without fixed constraints, naturally maintaining trajectory realism through proximity preservation. Unlike existing approaches, our method supports both intention misclassification attacks and prediction accuracy degradation. Extensive evaluation on nuScenes and Apolloscape datasets across state-of-the-art models including Trajectron++ and Grip++ demonstrates superior performance. DTP-Attack achieves 41 - 81% attack success rates for intention misclassification attacks that manipulate perceived driving maneuvers with perturbations below 0.45 m, and increases prediction errors by 1.9 - 4.2 for accuracy degradation. Our method consistently outperforms existing black-box approaches while maintaining high controllability and reliability across diverse scenarios. These results reveal fundamental vulnerabilities in current trajectory prediction systems, highlighting urgent needs for robust defenses in safety-critical autonomous driving applications.

Paper Structure

This paper contains 17 sections, 9 equations, 6 figures, 2 tables, 1 algorithm.

Table of Contents

  1. Introduction
  2. Related Work
  3. Trajectory Prediction in Autonomous Driving
  4. Adversarial Attacks on Trajectory Prediction
  5. Problem Formulation
  6. Trajectory Prediction Formulation
  7. Adversarial Attack Formulation
  8. Adversarial Trajectory Generation
  9. Attack Objectives
  10. Adversarial Criteria
  11. Adversarial Optimization Process
  12. Experiments
  13. Experiment Set-up
  14. Main Results
  15. Comparative Analysis
  16. ...and 2 more sections

Figures (6)

  • Figure 1: Two types of adversarial attacks on trajectory prediction. (a) Intention misclassification. (b) Prediction accuracy degradation.
  • Figure 2: Conceptual comparison of score-based (left) vs. decision-based (right) adversarial attack optimization landscapes.
  • Figure 3: A decision-based black-box adversarial attack on trajectory prediction (DTP-Attack) methodology overview.
  • Figure 4: Comparative analysis of decision-based vs. score-based adversarial attacks on trajectory prediction models.
  • Figure 5: Progressive trajectory refinement in DTP-Attack boundary walking algorithm.
  • ...and 1 more figures