Adversarial attacks on learning-based multi-modal trajectory predictors have already been demonstrated. However, there are still open questions about the effects of perturbations on inputs other than state histories, and how these attacks impact downstream planning and control. In this paper, we conduct a sensitivity analysis on two trajectory prediction models, Trajectron++ and AgentFormer. The analysis reveals that between all inputs, almost all of the perturbation sensitivities for both models lie only within the most recent position and velocity states. We additionally demonstrate that, despite dominant sensitivity on state history perturbations, an undetectable image map perturbation made with the Fast Gradient Sign Method can induce large prediction error increases in both models, revealing that these trajectory predictors are, in fact, susceptible to image-based attacks. Using an optimization-based planner and example perturbations crafted from sensitivity results, we show how these attacks can cause a vehicle to come to a sudden stop from moderate driving speeds.

翻译：针对基于学习的多模态轨迹预测器的对抗攻击已有研究验证，但关于状态历史之外输入扰动的影响，以及这些攻击如何影响下游规划与控制的问题仍有待探索。本文对Trajectron++和AgentFormer两种轨迹预测模型进行了敏感性分析。分析表明，在所有输入参数中，两种模型几乎全部的扰动敏感性仅集中在最近时刻的位置和速度状态上。此外，尽管状态历史扰动占主导敏感性，但采用快速梯度符号法构建的不可察觉图像地图扰动仍能导致两种模型产生显著预测误差，证实这些轨迹预测器确实易受基于图像的攻击。通过基于优化的规划器与基于敏感性结果构建的示例扰动，我们展示了此类攻击如何使车辆从正常行驶速度骤然停止。