Pith. sign in

REVIEW 3 major objections 5 minor 1 cited by

UnDREAM claims a framework that optimizes adversarial textures end-to-end inside photorealistic 3D simulation by routing gradients through a differentiable twin scene.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-04 09:07 UTC pith:YPAXGDNG

load-bearing objection Useful new simulation-to-differentiable-rendering bridge, but the 'end-to-end' label outruns the evidence: gradients come from a Mitsuba twin whose agreement with Unreal is never quantitatively checked. the 3 major comments →

arxiv 2510.16923 v3 pith:YPAXGDNG submitted 2025-10-19 cs.CR cs.AIcs.LG

UNDREAM: Bridging Differentiable Rendering and Photorealistic Simulation for End-to-end Adversarial Attacks

Mansi Phute , Matthew Hull , Haoran Wang , Alec Helbling , ShengYun Peng , Willian Lunardi , Martin Andreoni , Wenke Lee
show 1 more author
Duen Horng Chau
This is my paper
classification cs.CR cs.AIcs.LG
keywords adversarial attacksdifferentiable renderingphotorealistic simulation3D object texturesend-to-end optimizationobject detection robustnessautonomous driving
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper introduces UnDREAM, a framework that couples a photorealistic, non-differentiable simulator with a differentiable renderer so adversarial perturbations on arbitrary 3D objects can be optimized with real gradients instead of 2D patches superimposed afterward. The simulator produces the images the victim model sees; a twin scene in the differentiable renderer reproduces the object-camera geometry and lets image-loss gradients flow back to the texture. The updated texture is then reinserted into the simulator, closing an end-to-end optimization loop. If this works as described, it lets attacks be designed and evaluated under weather, lighting, camera motion, and object animation, which existing pipelines approximate or ignore.

Core claim

The paper's central claim is that the non-differentiability of photorealistic simulation need not block gradient-based attacks. UnDREAM automatically converts a simulator scene—including camera and object poses, rotation conventions, and units—into a differentiable renderer scene for every frame. Each attack iteration renders images in the simulator, computes the victim model's loss, backpropagates through the differentiable twin to update the adversarial texture, and writes the updated texture back into the simulator. The authors demonstrate this on classification and object detection with PGD and Auto-PGD, reducing accuracy and mAP dramatically, and show that the optimized texture changes

What carries the argument

The load-bearing component is the twin-scene bridge: an automatic transformation of each simulator frame into a differentiable scene with the adversarial texture attached as a differentiable texture. The transformation reconciles the coordinate systems, rotation conventions, and units between the two renderers, so that gradients computed in the differentiable scene can be attributed to texture pixels that appear in the simulator's image. This is what lets the optimizer update the texture as it actually appears under the simulator's lighting, materials, and motion, without requiring the simulator itself to be differentiable.

Load-bearing premise

The loss is computed from the photorealistic simulator's images, but gradients are backpropagated through a separate differentiable re-rendering of the same scene, so the two renderings must match closely enough that texture updates truly improve the simulator's output.

What would settle it

Take a fixed texture and a fixed frame, render it in the simulator and in the differentiable twin, and compare the two images pixel by pixel under several lighting and weather conditions; any substantial mismatch means the gradient path is optimizing a different rendering than the one the victim model sees. A tighter test would measure whether a texture gradient computed through the differentiable renderer points in the same direction as a finite-difference perturbation of the texture in the simulator.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • Adversarial attacks can be optimized directly inside scenes with weather, lighting, moving cameras, and animated objects, instead of superimposing patches onto pre-rendered frames.
  • Any 3D object with a UV mapping—sphere, bin, car, umbrella—can serve as an attack surface, removing the restriction to 2D rectangular patches.
  • Switching between attack algorithms reduces to changing a single line that updates the texture, making the pipeline easy to extend to PGD, Auto-PGD, or other gradient-based attacks.
  • Because the texture is embedded in the scene rather than pasted per frame, attacks are temporally consistent across consecutive frames, which matters for tracking and video-based evaluation.
  • The same loop can be turned around to evaluate defenses under realistic, high-fidelity conditions, giving a unified testbed for attacks and countermeasures.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • If the twin-scene gradient flow is accurate enough, the same bridge could be used for non-adversarial inverse problems such as designing textures or materials to match a target appearance under simulated weather and lighting.
  • Since the differentiable renderer supports differentiation with respect to scene parameters beyond textures, the framework could extend to optimizing object pose, camera path, or lighting rather than only the adversarial texture.
  • A decisive but unperformed check is comparing a texture gradient computed through the twin renderer against a finite-difference perturbation in the simulator itself; the paper's white-texture verification alone does not rule out divergence under weather or material effects.
  • The framework could plausibly generate physically varying adversarial training data, where perturbations are optimized in simulation before being used to robustify detectors.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper presents UnDREAM, a software framework that couples Unreal Engine 5 (UE5) photorealistic simulation with Mitsuba differentiable rendering. The framework converts UE5 LevelSequence scenes into Mitsuba XML scenes through coordinate/scale/rotation transforms, then runs an adversarial attack loop: render frames in UE5, compute a victim model's loss, backpropagate the loss through the Mitsuba twin scene, and update the 3D object texture before re-inserting it into UE5. The paper claims this is the first framework to enable end-to-end optimization of adversarial perturbations on arbitrary 3D objects inside photorealistic simulation. Experiments demonstrate PGD and Auto-PGD attacks on DETR-ResNet-50 for classification and detection tasks in park/city environments under different lighting and weather conditions, with a small set of objects (sphere, bin, car, umbrella).

Significance. If the central claim holds, UnDREAM is a useful open-source systems contribution: it lowers the barrier to optimizing 3D adversarial textures in a high-fidelity simulator, and the single-line attack integration is a practical advantage. The paper ships code and assets, which is commendable. However, the load-bearing 'end-to-end' claim depends on an unvalidated proxy-gradient assumption: the loss is scored on UE5 renderings while gradients are backpropagated through a separately constructed Mitsuba scene. The manuscript provides only a white-texture visual check for the twin scene and no quantitative alignment evidence. Until that is supplied, the framework is better described as a surrogate-gradient pipeline than an end-to-end differentiable simulation pipeline.

major comments (3)
  1. [§3.2, Algorithm 1; §3.1.2 step 4] The central claim of end-to-end optimization is undercut by an unvalidated proxy gradient. In Algorithm 1, lines 3–5 compute the loss on Unreal-rendered frames, but lines 7–9 backpropagate through the Mitsuba twin scene. For this to be a true end-to-end optimization, the Mitsuba rendering must be a faithful differentiable analogue of the Unreal rendering under the same lighting, weather, material, and post-processing conditions. The only validation described is a plain-white-texture visual check (§3.1.2 step 4), which can confirm geometry/coordinate conversion but not appearance or gradient fidelity. Appendix A documents only coordinate/rotation/scale conversion, not conversion of lights, weather, or materials. No image-level or gradient-level comparison between UE5 and Mitsuba is reported. Please add quantitative alignment experiments (e.g., pixel-wise error or gradient cosine similarit
  2. [§4.3, Table 3] The attack evaluation is presented as a single demonstration: one person walking in a park, one victim model (DETR-ResNet-50), and no indication of the number of frames, scenes, or random seeds. The 100% benign accuracy/mAP in Table 3 suggests a small or possibly single-frame evaluation set. For a framework whose contribution is to enable systematic evaluation of adversarial attacks, please report results across multiple scenes, sequences, and seeds, with mean and standard deviation. Also clarify the attack budget: what norm and bound do the values 0.78 and 1.00 refer to, and how is the budget applied to a detection mAP metric? Without this information, the quantitative claim in §4.3 is not reproducible.
  3. [§1, §4] The paper argues that existing pipelines optimize textures outside simulation and therefore fail under environmental interactions, but no experiment compares UnDREAM against such baselines. To support the claim that in-simulation optimization 'preserves lighting, perspective, and physical material interactions' and leads to better threat modeling, the manuscript should include a quantitative comparison with at least one prior approach (e.g., a 2D patch superimposed on UE5 frames, or a texture optimized in Mitsuba alone and then transferred to UE5). Such baselines are essential to show that the UnDREAM pipeline provides an actual improvement in attack effectiveness or transferability rather than merely a convenient implementation.
minor comments (5)
  1. [Contribution 2 (§1)] The sentence 'UnDREAM eliminates the need for calculating the bounds of the adversarial object across This leads to better alignment' is incomplete. Please revise.
  2. [Algorithm 1] The notation and control flow are unclear. Line 3 uses x_{i-n} without defining the index range, and the 'RENDERING JOB FINISH CALLBACK' procedure appears nested inside the for loop. Clarify the asynchronous rendering semantics and the relationship between attack iterations and rendering jobs.
  3. [Table 1] The 'only framework' claim in the caption and text is a strong novelty claim. Please define the comparison scope more precisely, and consider citing or discussing prior differentiable-simulation bridges if any exist, to avoid overclaiming.
  4. [§2.2] The statement that 'Mitsuba, due to its differentiable ray tracing method, has increased photorealism compared to alternatives such as PyTorch3D' is not substantiated. Rephrase as an architectural difference or provide a citation.
  5. [§7] Typo: 'hte free assets' should be 'the free assets'. The reproducibility statement is otherwise a strength.

Circularity Check

0 steps flagged

No significant circularity found; the framework is evaluated against external victim models, and the proxy-gradient concern is a validation issue, not circularity.

full rationale

I walked the paper's claimed derivation chain. UnDREAM's core loop (Algorithm 1) computes a loss from an external victim model's predictions (M(x)) on Unreal-rendered images, then updates textures via gradients propagated through a separately constructed Mitsuba scene ($3.2, Algorithm 1 lines 3–9). This is not circular: no parameter is fitted to a target quantity and then renamed as a prediction. The reported attack results in Table 3 are measured against an external model (DETR-ResNet-50) using standard attacks (PGD, Auto-PGD), so the headline results do not reduce to the framework's own assumptions. The 'first/only framework' claims in the abstract and Table 1 are comparative novelty claims, not derived predictions; no uniqueness theorem or load-bearing result is imported from prior self-citations. The self-citations (e.g., Hull et al. 2024) appear only in related-work context and are not load-bearing. The main weakness—that gradients are computed through a Mitsuba twin validated only by a white-texture visual check ($3.1.2 step 4)—is a real correctness/validation gap about whether the surrogate gradients match Unreal's rendering, but it is not a circularity: the derivation does not assume what it claims to establish. Accordingly, no circular step is identified.

Axiom & Free-Parameter Ledger

0 free parameters · 4 axioms · 0 invented entities

The central claim rests on the engineering assumptions that the Unreal-to-Mitsuba conversion is geometrically faithful and that gradients from the Mitsuba twin transfer to Unreal-rendered images. Neither is quantitatively validated. No fitted free parameters or invented entities are introduced; the attack budgets and model choices are experimental settings, not fitted claims.

axioms (4)
  • domain assumption Unreal Engine rendering is non-differentiable and Mitsuba can serve as a differentiable surrogate of the same scene.
    Motivates the entire bridge; see §2.1 and §3 'Selection of simulation platform' and 'Selection of differentiable renderer'.
  • domain assumption Coordinate, scale, handedness, and rotation conversions (§3.1.2, Table 4) preserve object-camera geometry and UV texture mapping between Unreal and Mitsuba.
    No quantitative validation that converted XML scenes render identically to Unreal; only a white-texture check is mentioned in §3.1.2.
  • ad hoc to paper Backpropagating the loss gradient through the Mitsuba twin scene yields texture updates that reduce the loss on Unreal-rendered images.
    Algorithm 1 lines 6-11: gradients computed from Unreal images are passed to the differentiable renderer; this equivalence is assumed, not demonstrated.
  • domain assumption Victim models (DETR-ResNet-50, YOLO variants) are treated as fixed white-box models with known gradients.
    Used in §4.3; standard assumption in white-box adversarial attack evaluation.

pith-pipeline@v1.3.0-alltime-deepseek · 9652 in / 9059 out tokens · 78526 ms · 2026-08-04T09:07:54.332042+00:00 · methodology

0 comments
read the original abstract

Deep learning models deployed in safety critical applications like autonomous driving use simulations to test their robustness against adversarial attacks in realistic conditions. However, these simulations are non-differentiable, forcing researchers to create attacks that do not integrate simulation environmental factors, reducing attack success. To address this limitation, we introduce UNDREAM, the first software framework that bridges the gap between photorealistic simulators and differentiable renderers to enable end-to-end optimization of adversarial perturbations on any 3D objects. UNDREAM enables manipulation of the environment by offering complete control over weather, lighting, backgrounds, camera angles, trajectories, and realistic human and object movements, thereby allowing the creation of diverse scenes. We showcase a wide array of distinct physically plausible adversarial objects that UNDREAM enables researchers to swiftly explore in different configurable environments. This combination of photorealistic simulation and differentiable optimization opens new avenues for advancing research of physical adversarial attacks.

Figures

Figures reproduced from arXiv: 2510.16923 by Alec Helbling, Duen Horng Chau, Haoran Wang, Mansi Phute, Martin Andreoni, Matthew Hull, ShengYun Peng, Wenke Lee, Willian Lunardi.

Figure 1
Figure 1. Figure 1: UnDREAM is the first software framework bridging differentiable rendering and photore [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Existing attack pipelines create adversarial attacks outside of simulation without account [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: The end-to-end UnDREAM optimization pipeline. In each iteration, the adversarial texture [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: (a) UV layout and object mesh in the UV editor display in Unreal Engine 5. Each segment from the UV map corresponds to a part on the object. (b) Optimized object (sphere) shown from the side. Only the part of the texture that is visible in the camera view is optimized [PITH_FULL_IMAGE:figures/full_fig_p007_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: UnDREAM enables optimization of 3D objects of arbitrary shapes. If the object is very [PITH_FULL_IMAGE:figures/full_fig_p007_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: The same scene rendered under different lighting and weather conditions using Un [PITH_FULL_IMAGE:figures/full_fig_p009_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: Niagara system interface used to create and configure the rain effect in the environment. [PITH_FULL_IMAGE:figures/full_fig_p013_7.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. ALLUDE: A Unified Evaluation System for Configurable Attacks in Differentiable Environments

    cs.CV 2026-07 conditional novelty 6.0

    A configurable, cross-platform simulator-based evaluation platform shows that object class and camera trajectory, not weather or detector choice, dominate whether 3D adversarial patch attacks succeed, and that all tes...

Reference graph

Works this paper leans on

20 extracted references · 1 canonical work pages · cited by 1 Pith paper

  1. [2]

    Samuli Laine, Janne Hellsten, Tero Karras, Yeongho Seol, Jaakko Lehtinen, and Timo Aila

    URLhttps://doi.org/ 10.1007/978-3-031-72986-7_2. Samuli Laine, Janne Hellsten, Tero Karras, Yeongho Seol, Jaakko Lehtinen, and Timo Aila. Modular primitives for high-performance differentiable rendering,

    work page doi:10.1007/978-3-031-72986-7_2

  2. [6]

    Sahil Khose, Anisha Pal, Aayushi Agarwal, Deepanshi, Judy Hoffman, and Prithvijit Chattopad- hyay

    URL https://arxiv.org/abs/1711.07566. Sahil Khose, Anisha Pal, Aayushi Agarwal, Deepanshi, Judy Hoffman, and Prithvijit Chattopad- hyay. Skyscenes: A synthetic dataset for aerial scene understanding. InComputer Vision – ECCV 2024: 18th European Conference, pp. 19–35, Berlin, Heidelberg,

    Pith/arXiv arXiv 2024

  3. [11]

    URLhttps://arxiv.org/abs/1810. 10438. 10 Johannes Meier, Luca Scalerandi, Oussema Dhaouadi, Jacques Kaiser, Nikita Araslanov, and Daniel Cremers. Carla drone: monocular 3d object detection from a different perspective. InDAGM German Conference on Pattern Recognition, pp. 137–152. Springer, 2024a. Johannes Meier, Luca Scalerandi, Oussema Dhaouadi, Jacques ...

    Pith/arXiv arXiv

  4. [12]

    Adversarial robustness toolbox v1

    Maria-Irina Nicolae, Mathieu Sinn, Minh Ngoc Tran, Beat Buesser, Ambrish Rawat, Martin Wis- tuba, Valentina Zantedeschi, Nathalie Baracaldo, Bryant Chen, Heiko Ludwig, et al. Adversarial robustness toolbox v1. 0.0.arXiv preprint arXiv:1807.01069,

    Pith/arXiv arXiv

  5. [13]

    Nikhila Ravi, Jeremy Reizenstein, David Novotny, Taylor Gordon, Wan-Yen Lo, Justin John- son, and Georgia Gkioxari

    doi: 10.1109/W ACV .2018.00168. Nikhila Ravi, Jeremy Reizenstein, David Novotny, Taylor Gordon, Wan-Yen Lo, Justin John- son, and Georgia Gkioxari. Accelerating 3d deep learning with pytorch3d.arXiv preprint arXiv:2007.08501,

    arXiv 2018

  6. [14]

    Syndrone–multi-modal uav dataset for urban scenarios.arXiv preprint arXiv:2308.10491,

    Giulia Rizzoli, Francesco Barbato, Matteo Caligiuri, and Pietro Zanuttigh. Syndrone–multi-modal uav dataset for urban scenarios.arXiv preprint arXiv:2308.10491,

    Pith/arXiv arXiv

  7. [15]

    Wenshan Wang, Delong Zhu, Xiangwei Wang, Yaoyu Hu, Yuheng Qiu, Chen Wang, Yafei Hu, Ashish Kapoor, and Sebastian Scherer

    URLhttps://arxiv.org/abs/ 1705.05065. Wenshan Wang, Delong Zhu, Xiangwei Wang, Yaoyu Hu, Yuheng Qiu, Chen Wang, Yafei Hu, Ashish Kapoor, and Sebastian Scherer. Tartanair: A dataset to push the limits of visual slam. In 2020 IEEE/RSJ International Conference on Intelligent Robots and Systems (IROS), pp. 4909– 4916,

    Pith/arXiv arXiv 2020

  8. [16]

    Hui Wei, Hao Tang, Xuemei Jia, Zhixiang Wang, Hanxun Yu, Zhubo Li, Shin’ichi Satoh, Luc Van Gool, and Zheng Wang

    doi: 10.1109/IROS45743.2020.9341801. Hui Wei, Hao Tang, Xuemei Jia, Zhixiang Wang, Hanxun Yu, Zhubo Li, Shin’ichi Satoh, Luc Van Gool, and Zheng Wang. Physical adversarial attack meets computer vision: A decade survey. IEEE Transactions on Pattern Analysis and Machine Intelligence, 46(12):9797–9817,

    arXiv 2020

  9. [17]

    Physical adversarial attack on vehicle detector in the carla simulator.arXiv preprint arXiv:2007.16118,

    Tong Wu, Xuefei Ning, Wenshuo Li, Ranran Huang, Huazhong Yang, and Yu Wang. Physical adversarial attack on vehicle detector in the carla simulator.arXiv preprint arXiv:2007.16118,

    Pith/arXiv arXiv 2007

  10. [18]

    Imperceptible adversarial examples in the physical world.arXiv preprint arXiv:2411.16622,

    Weilin Xu, Sebastian Szyller, Cory Cornelius, Luis Murillo Rojas, Marius Arvinte, Alvaro Ve- lasquez, Jason Martin, and Nageen Himayat. Imperceptible adversarial examples in the physical world.arXiv preprint arXiv:2411.16622,

    Pith/arXiv arXiv

  11. [19]

    Visual adversarial attack on vision-language models for autonomous driving.arXiv preprint arXiv:2411.18275,

    Tianyuan Zhang, Lu Wang, Xinwei Zhang, Yitong Zhang, Boyi Jia, Siyuan Liang, Shengshan Hu, Qiang Fu, Aishan Liu, and Xianglong Liu. Visual adversarial attack on vision-language models for autonomous driving.arXiv preprint arXiv:2411.18275,

    Pith/arXiv arXiv

  12. [20]

    Rauca: A novel physical adversarial attack on ve- hicle detectors via robust and accurate camouflage generation.arXiv preprint arXiv:2402.15853,

    Jiawei Zhou, Linye Lyu, Daojing He, and Yu Li. Rauca: A novel physical adversarial attack on ve- hicle detectors via robust and accurate camouflage generation.arXiv preprint arXiv:2402.15853,

    Pith/arXiv arXiv

  13. [2017]

    Unreal Engine

    URLhttps://arxiv.org/abs/1711.03938. Unreal Engine. Lumen Global Illumination and Reflections in Unreal Engine — Un- real Engine 5.6 Documentation — Epic Developer Community — dev.epicgames.com. https://dev.epicgames.com/documentation/en-us/unreal-engine/ lumen-global-illumination-and-reflections-in-unreal-engine. [Ac- cessed 20-09-2025]. Unreal Engine. U...

    Pith/arXiv arXiv 2025

  14. [2018]

    Wenxiao Cai, Ke Jin, Jinyan Hou, Cong Guo, Letian Wu, and Wankou Yang

    URLhttps://arxiv.org/abs/1707.07397. Wenxiao Cai, Ke Jin, Jinyan Hou, Cong Guo, Letian Wu, and Wankou Yang. Vdd: Varied drone dataset for semantic segmentation,

    Pith/arXiv arXiv

  15. [2019]

    Zhanhao Hu, Wenda Chu, Xiaopei Zhu, Hui Zhang, Bo Zhang, and Xiaolin Hu

    doi: 10.1109/CVPRW.2019.00081. Zhanhao Hu, Wenda Chu, Xiaopei Zhu, Hui Zhang, Bo Zhang, and Xiaolin Hu. Physically realizable natural-looking clothing textures evade person detectors via 3d modeling. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 16975–16984,

    arXiv 2019

  16. [2020]

    Yang Li, Wenyi Tan, Tingrui Wang, Xinkai Liang, and Quan Pan

    URLhttps://arxiv.org/ abs/2011.03277. Yang Li, Wenyi Tan, Tingrui Wang, Xinkai Liang, and Quan Pan. Flexible physical camouflage generation based on a differential approach.arXiv preprint arXiv:2402.13575,

    Pith/arXiv arXiv 2011

  17. [2022]

    URLhttps://arxiv.org/abs/2107. 04286. Matthew M. Loper and Michael J. Black. Opendr: An approximate differentiable renderer. In David Fleet, Tomas Pajdla, Bernt Schiele, and Tinne Tuytelaars (eds.),Computer Vision – ECCV 2014, pp. 154–169, Cham,

    2014

  18. [2023]

    Renderbender: A survey on adversarial attacks using differentiable rendering.arXiv preprint arXiv:2411.09749,

    Matthew Hull, Haoran Wang, Matthew Lau, Alec Helbling, Mansi Phute, Chao Zhang, Zsolt Kira, Willian Lunardi, Martin Andreoni, Wenke Lee, et al. Renderbender: A survey on adversarial attacks using differentiable rendering.arXiv preprint arXiv:2411.09749,

    Pith/arXiv arXiv

  19. [2024]

    ISBN 978-3-031-72985-0

    Springer-Verlag. ISBN 978-3-031-72985-0. doi: 10.1007/978-3-031-72986-7

    doi:10.1007/978-3-031-72986-7

  20. [2025]

    Alexey Dosovitskiy, German Ros, Felipe Codevilla, Antonio Lopez, and Vladlen Koltun

    URLhttps://arxiv.org/abs/2305.13608. Alexey Dosovitskiy, German Ros, Felipe Codevilla, Antonio Lopez, and Vladlen Koltun. Carla: An open urban driving simulator,

    Pith/arXiv arXiv