arxiv: 2605.13751 · v1 · submitted 2026-05-13 · 💻 cs.RO · cs.SE· cs.SY· eess.SY

Recognition: unknown

Learning Responsibility-Attributed Adversarial Scenarios for Testing Autonomous Vehicles

Yizhuo Xiao , Haotian Yan , Ying Wang , Zhongpan Zhu , Yuxin Zhang , Xintao Yan , Mustafa Suphi Erden , Cheng Wang

Authors on Pith no claims yet

Pith reviewed 2026-05-14 19:23 UTC · model grok-4.3

classification 💻 cs.RO cs.SEcs.SYeess.SY

keywords adversarial scenario generationautonomous vehiclesresponsibility attributionsafety testingclosed-loop simulationcollision scenarios

0 comments

The pith

CARS framework generates collision scenarios for autonomous vehicle tests that carry clear responsibility attributions under standard driver models.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper presents CARS, a new simulation method that folds responsibility attribution into the generation of adversarial scenarios for testing self-driving cars. Standard adversarial techniques can produce collisions efficiently but leave open whether those collisions reflect real system defects or simply unavoidable traffic situations. CARS adds context-aware adversary selection and optimizes a generative policy inside closed-loop simulation so that the resulting collisions can be traced to specific faults under multiple regulation-defined careful and competent driver models. Experiments on benchmark datasets from different national traffic settings show that the method consistently yields physically feasible scenarios with high attribution success rates. This shifts testing from raw collision counts toward evidence that failures are avoidable and therefore diagnostic of the autonomous system itself.

Core claim

CARS integrates responsibility attribution directly into adversarial scenario generation through context-aware adversary selection combined with a generative adversarial policy that is optimized in closed-loop simulation, producing collision scenarios that are both physically feasible and diagnostically attributable under regulation-prescribed driver models.

What carries the argument

The CARS framework, which couples adversarial generation with normative responsibility assessment using context-aware selection and closed-loop policy optimization.

Load-bearing premise

Responsibility attribution under the chosen driver models remains stable and diagnostically meaningful even when the scenarios are produced by adversarial optimization inside closed-loop simulation.

What would settle it

Run the optimization on the same datasets and measure whether the generated scenarios show attribution rates that drop substantially below those obtained from non-optimized or randomly sampled collisions under the same driver models.

Figures

Figures reproduced from arXiv: 2605.13751 by Cheng Wang, Haotian Yan, Mustafa Suphi Erden, Xintao Yan, Ying Wang, Yizhuo Xiao, Yuxin Zhang, Zhongpan Zhu.

**Figure 2.** Figure 2: CARS responsibility-attributed adversarial scenario generation framework. [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗

**Figure 3.** Figure 3: Context-aware adv re-selection across datasets. a, nuScenes. b, AD4CHE. c, RounD. Each row shows three BEV snapshots from one rollout scenario at t=0, the adv switch frame, and the collision frame, with a heatmap strip beneath giving the per-step adversarial probability Padv(t) for exemplary candidates A1 (upper) and A2 (lower); darker red indicates higher probability. The tgt is shown in blue, the current… view at source ↗

**Figure 4.** Figure 4: Responsibility attribution and collision kinematics on CARS-generated nuScenes scenarios. [PITH_FULL_IMAGE:figures/full_fig_p006_4.png] view at source ↗

**Figure 5.** Figure 5: Baseline comparison on nuScenes. a, Severity-diversity entropy Hcrit per method (raw point estimate on the FSM-preventable subset; same values as [PITH_FULL_IMAGE:figures/full_fig_p007_5.png] view at source ↗

**Figure 6.** Figure 6: Cross-dataset generalization across nuScenes, AD4CHE, and RounD. [PITH_FULL_IMAGE:figures/full_fig_p009_6.png] view at source ↗

read the original abstract

Establishing trustworthy safety assurance for autonomous driving systems (ADSs) requires evidence that failures arise from avoidable system deficiencies rather than unavoidable traffic conflicts. Current adversarial simulation methods can efficiently expose collisions, but generally lack mechanisms to distinguish these fundamentally different failure modes. Here we present CARS (Context-Aware, Responsibility-attributed Scenario generation), a framework that integrates responsibility attribution directly into adversarial scenario generation. CARS combines context-aware adversary selection with a generative adversarial policy optimized in closed-loop simulation to construct collision scenarios that are both physically feasible and diagnostically attributable. Across benchmark datasets spanning heterogeneous national traffic environments, CARS consistently discovers feasible collision scenarios with high attribution rates under multiple regulation-prescribed careful and competent driver models. By coupling adversarial generation with normative responsibility assessment, CARS moves simulation testing beyond collision discovery toward the construction of interpretable, regulation-aligned safety evidence for scalable ADS validation.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Desk Editor's Note private letter to a colleague

CARS folds responsibility attribution into closed-loop adversarial scenario generation for AV testing, but the independence of that attribution from the optimization needs direct verification.

read the letter

The main point is that this paper offers a concrete way to generate collision scenarios in simulation where the crashes can be attributed to the autonomous vehicle under models of careful and competent drivers, rather than just any traffic conflict. It does this by combining context-aware adversary selection with a generative adversarial policy trained in closed loop, then scoring the outcomes against regulation-style responsibility rules. The reported results show high attribution rates across datasets from different national traffic settings, which moves the work past raw collision finding toward something regulators might actually use as evidence.

Referee Report

2 major / 2 minor

Summary. The paper introduces CARS, a framework that integrates responsibility attribution directly into adversarial scenario generation for autonomous driving systems. It combines context-aware adversary selection with a generative adversarial policy optimized in closed-loop simulation to produce physically feasible collision scenarios that are diagnostically attributable under multiple regulation-prescribed careful and competent driver models. The central empirical claim is that CARS consistently achieves high attribution rates across benchmark datasets spanning heterogeneous national traffic environments.

Significance. If the independence of the attribution procedure from the optimization process can be established, the work would offer a concrete advance in simulation-based safety validation by moving from raw collision discovery to the construction of interpretable, regulation-aligned evidence that distinguishes avoidable system deficiencies from unavoidable conflicts. The closed-loop optimization and multi-environment testing provide a practical foundation, though the absence of quantitative metrics in the available description limits assessment of effect sizes.

major comments (2)

[Abstract] The integration of responsibility attribution 'directly into' the generative adversarial policy (as stated in the abstract) raises a load-bearing concern about circularity: if any proxy for attribution enters the policy reward or selection criterion, the reported high attribution rates become tautological rather than diagnostic. The manuscript must explicitly define the reward function and demonstrate that attribution is computed independently and post hoc under the driver models.
[Abstract] The abstract asserts 'high attribution rates' and 'consistent' discovery across datasets but supplies no numerical values, baseline comparisons, ablation results on the attribution component, error bars, or statistical tests. Without these, the strength of the central claim cannot be evaluated and the cross-environment consistency assertion remains unsupported.

minor comments (2)

Specify the exact regulation-prescribed driver models (e.g., which national standards or mathematical formulations) and their implementation details in the closed-loop simulator.
Clarify whether the context-aware adversary selection operates before or after the generative policy optimization and how the two components interact.

Simulated Author's Rebuttal

2 responses · 0 unresolved

We thank the referee for their thoughtful review and valuable feedback on our manuscript. We address each major comment below and commit to revisions that clarify the methodology and strengthen the presentation of results.

read point-by-point responses

Referee: [Abstract] The integration of responsibility attribution 'directly into' the generative adversarial policy (as stated in the abstract) raises a load-bearing concern about circularity: if any proxy for attribution enters the policy reward or selection criterion, the reported high attribution rates become tautological rather than diagnostic. The manuscript must explicitly define the reward function and demonstrate that attribution is computed independently and post hoc under the driver models.

Authors: We thank the referee for highlighting this critical issue regarding potential circularity. The responsibility attribution is computed independently and post hoc using the regulation-prescribed driver models after the scenarios are generated by the adversarial policy. The reward function for the generative adversarial policy is based solely on achieving collisions while maintaining physical feasibility and context-aware constraints, without any direct incorporation of responsibility scores. In the revised manuscript, we will explicitly define the reward function in a dedicated subsection, provide pseudocode for the optimization process, and include a clear statement and diagram demonstrating the separation between the generation phase and the post-hoc attribution evaluation. This will eliminate any ambiguity about the independence of the procedures. revision: yes
Referee: [Abstract] The abstract asserts 'high attribution rates' and 'consistent' discovery across datasets but supplies no numerical values, baseline comparisons, ablation results on the attribution component, error bars, or statistical tests. Without these, the strength of the central claim cannot be evaluated and the cross-environment consistency assertion remains unsupported.

Authors: We agree that the abstract would benefit from more specific quantitative support to allow readers to assess the claims directly. The full manuscript contains detailed results with numerical attribution rates, baseline comparisons, ablations, error bars, and statistical tests across the benchmark datasets. In the revised abstract, we will include key numerical highlights, such as the average attribution rates achieved and consistency metrics, while referring to the main text for full details including ablations on the attribution component and statistical analyses. This will make the central empirical claims more evaluable. revision: yes

Circularity Check

1 steps flagged

Attribution rates are optimized into scenario generation, rendering high rates tautological by construction

specific steps

self definitional [Abstract]
"CARS combines context-aware adversary selection with a generative adversarial policy optimized in closed-loop simulation to construct collision scenarios that are both physically feasible and diagnostically attributable. Across benchmark datasets spanning heterogeneous national traffic environments, CARS consistently discovers feasible collision scenarios with high attribution rates under multiple regulation-prescribed careful and competent driver models."

The optimization is explicitly tasked with constructing diagnostically attributable scenarios; therefore the subsequent claim of high attribution rates is a direct consequence of the objective function rather than an independent verification that the scenarios remain attributable under the driver models.

full rationale

The paper defines CARS as optimizing a generative policy specifically to produce scenarios that are both feasible and diagnostically attributable. The central empirical claim of consistently high attribution rates therefore follows directly from the optimization objective rather than emerging independently from the discovered scenarios. This matches the self-definitional pattern: the output property is built into the search criterion. No equations or external benchmarks are shown that would separate the attribution signal from the policy reward, so the reported rates reduce to the design choice.

Axiom & Free-Parameter Ledger

1 free parameters · 1 axioms · 0 invented entities

Abstract-only view limits visibility; ledger populated from explicitly named components in the abstract. The driver models are treated as external inputs.

free parameters (1)

generative adversarial policy parameters
Optimized in closed-loop simulation; values not specified in abstract.

axioms (1)

domain assumption Regulation-prescribed careful and competent driver models accurately capture responsibility attribution
Invoked when claiming 'high attribution rates under multiple regulation-prescribed' models.

pith-pipeline@v0.9.0 · 5478 in / 1281 out tokens · 25841 ms · 2026-05-14T19:23:49.230357+00:00 · methodology

discussion (0)

Reference graph

Works this paper leans on

38 extracted references · 38 canonical work pages · 2 internal anchors

[1]

& Guo, F

Qian, C., Xu, J., Xing, X. & Guo, F. Test case sampling optimization for safety validation of automated driving systems.Nat. Commun.17, 3114 (2026)

work page 2026
[2]

& Paddock, S

Kalra, N. & Paddock, S. M. Driving to safety: How many miles of driving would it take to demonstrate autonomous vehicle reliability?Transp. Res. Part A Policy Pract.94, 182–193 (2016)

work page 2016
[3]

Feng, S.et al.Dense reinforcement learning for safety validation of autonomous vehicles.Nature 615, 620–627 (2023). 12

work page 2023
[4]

Liu, H. X. & Feng, S. Curse of rarity for autonomous vehicles.Nat. Commun.15, 4808 (2024)

work page 2024
[5]

& Liu, H

Feng, S., Yan, X., Sun, H., Feng, Y . & Liu, H. X. Intelligent driving intelligence test for autonomous vehicles with naturalistic and adversarial environment.Nat. Commun.12, 748 (2021)

work page 2021
[6]

Yan, X.et al.Learning naturalistic driving environment with statistical realism.Nat. Commun. 14, 2037 (2023)

work page 2037
[7]

Ding, W.et al.A survey on safety-critical driving scenario generation—a methodological perspective.IEEE Trans. Intell. Transp. Syst.24, 6971–6988 (2023)

work page 2023
[8]

UN regulation no

United Nations Economic Commission for Europe (UNECE). UN regulation no. 157 — uni- form provisions concerning the approval of vehicles with regard to Automated Lane Keeping Systems (ALKS). Tech. Rep., UNECE World Forum for Harmonization of Vehicle Regulations (WP.29) (2021). URLhttps://unece.org/transport/documents/2021/03/standards/ un-regulation-no-157...

work page 2021
[9]

IEEE Internet Things J.12, 1453–1470 (2024)

Tang, L.et al.Scenario-based accelerated testing for SOTIF in autonomous driving: a review. IEEE Internet Things J.12, 1453–1470 (2024)

work page 2024
[10]

& Mousavi, M

Song, Q., Bensoussan, A. & Mousavi, M. R. Synthetic vs. real: an analysis of critical scenarios for autonomous vehicle testing.Autom. Softw. Eng.32, 37 (2025)

work page 2025
[11]

Wu, X.et al.Make full use of testing information: An integrated accelerated testing and evaluation method for autonomous driving systems.Accid. Anal. Prev.224, 108280 (2026)

work page 2026
[12]

J., Fidler, S

Rempe, D., Philion, J., Guibas, L. J., Fidler, S. & Litany, O. Generating useful accident-prone driving scenarios via a learned traffic prior. InProc. IEEE/CVF Conf. Comput. Vis. Pattern Recognit., 17305–17315 (2022)

work page 2022
[13]

& Chandraker, M

Chang, W.-J., Pittaluga, F., Tomizuka, M., Zhan, W. & Chandraker, M. Safe-Sim: Safety-critical closed-loop traffic simulation with diffusion-controllable adversaries. InProc. Eur . Conf. Comput. Vis. (ECCV), 242–258 (Springer, 2024)

work page 2024
[14]

Xu, C., Petiushko, A., Zhao, D. & Li, B. DiffScene: Diffusion-based safety-critical scenario generation for autonomous vehicles. InProc. AAAI Conf. Artif. Intell., vol. 39, 8797–8805 (2025)

work page 2025
[15]

& Zhou, B

Zhang, L., Peng, Z., Li, Q. & Zhou, B. CAT: Closed-loop adversarial training for safe end-to- end driving. InConference on Robot Learning, vol. 229 ofProceedings of Machine Learning Research, 2357–2372 (PMLR, 2023)

work page 2023
[16]

& Yin, C

Xie, Y ., Zhang, Y ., Dai, K. & Yin, C. A real-time critical-scenario-generation framework for defect detection of autonomous driving system.IET Intell. Transp. Syst.18, 114–128 (2024)

work page 2024
[17]

Zhu, B.et al.Critical scenarios adversarial generation method for intelligent vehicles testing based on hierarchical reinforcement architecture.Accid. Anal. Prev.215, 108013 (2025)

work page 2025
[18]

Xiao, Y ., Erden, M. S. & Wang, C. Controllable latent diffusion for traffic simulation. Preprint at https://arxiv.org/abs/2503.11771(2025)

work page arXiv 2025
[19]

& Albrecht, S

Wang, C., Kong, L., Tamborski, M. & Albrecht, S. V . HAD-Gen: Human-like and diverse driving behavior modeling for controllable scenario generation.Accid. Anal. Prev.223, 108270 (2025)

work page 2025
[20]

Mattas, K.et al.Fuzzy surrogate safety metrics for real-time assessment of rear-end collision risk: a study based on empirical observations.Accid. Anal. Prev.148, 105794 (2020)

work page 2020
[21]

Application to motorway driving conditions.Accid

Mattas, K.et al.Driver models for the definition of safety requirements of automated vehicles in international regulations. Application to motorway driving conditions.Accid. Anal. Prev.174, 106743 (2022)

work page 2022
[22]

Automated driving safety evaluation framework ver

Japan Automobile Manufacturers Association. Automated driving safety evaluation framework ver. 1.0. Tech. Rep., Japan Automobile Manufacturers Association (JAMA) (2020). URL https://www.jama.or.jp/english/reports/framework.html. 13

work page 2020
[23]

On a Formal Model of Safe and Scalable Self-driving Cars

Shalev-Shwartz, S., Shammah, S. & Shashua, A. On a formal model of safe and scalable self-driving cars. Preprint athttps://arxiv.org/abs/1708.06374(2017)

work page internal anchor Pith review Pith/arXiv arXiv 2017
[24]

InProceedings of the 42nd International Conference on Machine Learning, vol

Chen, H.et al.Gaussian mixture flow matching models. InProceedings of the 42nd International Conference on Machine Learning, vol. 267 ofProceedings of Machine Learning Research, 9783– 9802 (PMLR, 2025)

work page 2025
[25]

J., Yin, Z., Lai, L., Lee, J

Kim, H. J., Yin, Z., Lai, L., Lee, J. & Ohn-Bar, E. Branchout: Capturing realistic multimodality in autonomous driving decisions. InProceedings of the 9th Conference on Robot Learning, vol. 305 ofProceedings of Machine Learning Research, 1940–1952 (PMLR, 2025)

work page 1940
[26]

& Levine, S

Black, K., Janner, M., Du, Y ., Kostrikov, I. & Levine, S. Training diffusion models with reinforcement learning. InInternational Conference on Learning Representations(2024)

work page 2024
[27]

In2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 11621–11631 (2020)

Caesar, H.et al.nuScenes: A multimodal dataset for autonomous driving. In2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 11621–11631 (2020)

work page 2020
[28]

Zhang, Y .et al.The AD4CHE dataset and its application in typical congestion scenarios of traffic jam pilot systems.IEEE Trans. Intell. V eh.8, 3312–3323 (2023)

work page 2023
[29]

& Eckstein, L

Krajewski, R., Moers, T., Bock, J., Vater, L. & Eckstein, L. The rounD dataset: A drone dataset of road user trajectories at roundabouts in Germany. In2020 IEEE 23rd International Conference on Intelligent Transportation Systems (ITSC), 1–6 (IEEE, 2020)

work page 2020
[30]

Zhong, Z.et al.Guided conditional diffusion for controllable traffic simulation. InProc. IEEE Int. Conf. Robot. Autom. (ICRA), 3560–3566 (IEEE, 2023)

work page 2023
[31]

Zheng, Y ., Xiao, Y ., Zhu, Z., Erden, M. S. & Wang, C. CADiffusion: Controllable adversarial diffusion for attacking lane detection of autonomous vehicles. InProc. IEEE Int. Conf. Intell. Transp. Syst. (ITSC), 4516–4522 (IEEE, 2025)

work page 2025
[32]

& Abbeel, P

Ho, J., Jain, A. & Abbeel, P. Denoising diffusion probabilistic models. InAdvances in Neural Information Processing Systems, vol. 33, 6840–6851 (2020)

work page 2020
[33]

Janner, M., Du, Y ., Tenenbaum, J. B. & Levine, S. Planning with diffusion for flexible behavior synthesis. InProceedings of the 39th International Conference on Machine Learning, vol. 162 ofProceedings of Machine Learning Research, 9902–9915 (PMLR, 2022)

work page 2022
[34]

In 2023 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 9644–9653 (2023)

Jiang, C.et al.MotionDiffuser: Controllable multi-agent motion prediction using diffusion. In 2023 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 9644–9653 (2023)

work page 2023
[35]

Proximal Policy Optimization Algorithms

Schulman, J., Wolski, F., Dhariwal, P., Radford, A. & Klimov, O. Proximal policy optimization algorithms. Preprint athttps://arxiv.org/abs/1707.06347(2017)

work page internal anchor Pith review Pith/arXiv arXiv 2017
[36]

Schulman, J., Moritz, P., Levine, S., Jordan, M. I. & Abbeel, P. High-dimensional continuous control using generalized advantage estimation. Preprint at https://arxiv.org/abs/1506. 02438(2015)

work page 2015
[37]

RX r=1 ∇θ logp θ(τ r−1 a |τ r a ,c)R(τ 0 a ,c) # .(S14) The clipped PPO surrogate loss is Lπ(θ) =−E

United Nations Economic Commission for Europe (UNECE). Proposal for a supplement to the 03 series of amendments to UN regulation no. 79 (steering equipment). Tech. Rep. ECE/TRANS/WP.29/GRV A/2020/7, UNECE World Forum for Harmonization of Ve- hicle Regulations (WP.29), Working Party on Automated/Autonomous and Connected Ve- hicles (GRV A) (2020). URL https...

work page 2020
[38]

K=8 achieves the highest single-seed utilization (Hnorm=0.82, highlighted in red) and is used throughout the paper

and the light envelope is the range across five independent seeds. K=8 achieves the highest single-seed utilization (Hnorm=0.82, highlighted in red) and is used throughout the paper. S9 Statistical Robustness across Random Seeds We repeat the closed-loop rollout with six additional seeds (seven seeds in total) using the same PPO-fine-tunedadvpolicy and th...

work page