Research map / Adversarial robustness and security / Backdoor and poisoning
Adversarial Backdoor Attack by Naturalistic Data Poisoning on Trajectory Prediction in Autonomous Driving
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes a black-box, clean-label backdoor data-poisoning attack on trajectory prediction models for autonomous driving, using perturbed attacking-vehicle trajectories as triggers disguised by bi-level optimized lane transformations.
Problem
Trajectory prediction models in autonomous driving are vulnerable to attacks, but prior work only studied inference-time attacks; training-time backdoor poisoning of these models was unexplored.
Approach
Triggers are crafted by perturbing the trajectory of the closest attacking vehicle toward a malicious future, then made stealthy and clean-label by transforming the lane layout via a bi-level optimization solved with gradient alignment, with physically feasible constraints from a kinematic bicycle model.
Key results
- Attack reaches tASR up to ~93% on HiVT on Argoverse while tCA stays ~95%, indicating stealthiness.
- Attack succeeds with only 5% poisoning rate; gradient-based sample selection outperforms random by up to 19% tASR at small budgets.
- Gradient-shaping defence reduces tASR by at most ~6%, leaving over 70% tASR on both tested models.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Poison training data with disguised triggers | Trajectory prediction models on nuScenes · nuScenes validation | tASR | Helped |
| Poison training data with disguised triggers | Trajectory prediction models on Argoverse · Argoverse validation | tASR | Helped |
| Increase attacking vehicles from one to four (ablation) | Backdoor attack on HiVT · Argoverse validation | tASR: 91.11 -> 98.02 | Helped |
| Increase attacking vehicles from one to four (ablation) | Backdoor attack on HiVT · Argoverse validation | tCA: 95.30 -> 71.34 | Hurt |
| Increase poison rate from 5% to 50% (ablation) | Backdoor attack on HiVT · Argoverse validation | tASR: 91.1 -> 99.9 | Helped |
| Increase poison rate from 5% to 50% (ablation) | Backdoor attack on HiVT · Argoverse validation | tCA: 95.3 -> 50.0 | Hurt |
| Select poison samples by gradient rather than randomly (ablation) | Backdoor attack on HiVT · Argoverse validation, 5% poison rate | tASR: 86.12 -> 91.11 | Helped |
| Limit attacker training-data access to 50% (ablation) | Backdoor attack on HiVT · Argoverse validation | tASR: 91.11 -> 86.13 (-4.98) | Hurt |
| Limit attacker training-data access to 50% (ablation) | Backdoor attack on HiVT · Argoverse validation | tCA: 95.30 -> 83.28 (-12.02) | Hurt |
| Use a vector-map surrogate against raster-map victims (ablation) | Backdoor attack with PGP surrogate · nuScenes | tASR | Helped |
| Apply gradient clipping and noise (ablation) | Backdoor attack on HiVT · Argoverse validation | tASR: 91.11 -> 88.52 (-2.59) | Hurt |
| Apply gradient clipping and noise (ablation) | Backdoor attack on MMTrans. · Argoverse validation | tASR: 78.55 -> 73.98 (-4.57) | Hurt |
Surprising findings
- Higher prediction accuracy does not necessarily imply higher robustness: TNT, with the worst accuracy, retains better tCA than the more accurate MMTransformer.
Limitations
- Defence evaluation limited to one gradient-shaping method and two models on Argoverse.
- Assumes attacker can inject poisoned samples into the victim's training data.
Experimental setup
Datasets: nuScenes Argoverse
Benchmarks: nuScenes Argoverse
Metrics: ADE FDE tCA tASR
Baselines: clean model (no attack) random sample selection gradient shaping defence
Builds on: gradient alignment for data poisoning point transformation for lane manipulation adversarial trajectory perturbation with kinematic bicycle model
Closest papers by meaning
- Enduring, Efficient and Robust Trajectory Prediction Attack in Autonomous Driving via Optimization-Driven Multi-Frame Perturbation Framework (CVPR 2025 · similarity 0.88)
- Temporal Logic-Based Multi-Vehicle Backdoor Attacks against Offline RL Agents in End-to-end Autonomous Driving (NeurIPS 2025 · similarity 0.88)
- BadVLA: Towards Backdoor Attacks on Vision-Language-Action Models via Objective-Decoupled Optimization (NeurIPS 2025 · similarity 0.85)
- Demystifying Poisoning Backdoor Attacks from a Statistical Perspective (ICLR 2024 · similarity 0.85)
- Adversarial-Inspired Backdoor Defense via Bridging Backdoor and Adversarial Attacks (AAAI 2025 · similarity 0.85)
- SlowTrack: Increasing the Latency of Camera-Based Perception in Autonomous Driving Using Adversarial Examples (AAAI 2024 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.