Adversarial attacks on learning-based trajectory predictors have already been demonstrated. However, there are still open questions about the effects of perturbations on trajectory predictor inputs other than state histories, and how these attacks impact downstream planning and control. In this paper, we conduct a sensitivity analysis on two trajectory prediction models, Trajectron++ and AgentFormer. We observe that between all inputs, almost all of the perturbation sensitivities for Trajectron++ lie only within the most recent state history time point, while perturbation sensitivities for AgentFormer are spread across state histories over time. We additionally demonstrate that, despite dominant sensitivity on state history perturbations, an undetectable image map perturbation made with the Fast Gradient Sign Method can induce large prediction error increases in both models. Even though image maps may contribute slightly to the prediction output of both models, this result reveals that rather than being robust to adversarial image perturbations, trajectory predictors are susceptible to image attacks. Using an optimization-based planner and example perturbations crafted from sensitivity results, we show how this vulnerability can cause a vehicle to come to a sudden stop from moderate driving speeds.

翻译：对基于学习的轨迹预测器的对抗性攻击已被证实。然而，关于状态历史以外的轨迹预测器输入扰动效应，以及这些攻击如何影响下游规划与控制，仍存在未解问题。本文对Trajectron++和AgentFormer两种轨迹预测模型进行了敏感性分析。我们观察到，在全部输入中，Trajectron++几乎所有的扰动敏感性仅集中于最近的状态历史时间点，而AgentFormer的扰动敏感性则随时间分散于状态历史中。此外，我们进一步证明，尽管模型对状态历史扰动具有主导敏感性，但使用快速梯度符号法生成的无痕迹图像地图扰动仍可导致两种模型的预测误差显著增大。尽管图像地图对两种模型的预测输出贡献较小，但这一结果揭示轨迹预测器对图像攻击具有脆弱性，而非对图像对抗扰动具有鲁棒性。通过基于优化的规划器与基于敏感性结果构建的示例扰动，我们展示了这一脆弱性如何导致车辆从中等行驶速度突然急停。