PaperlayerView exact revision on arXiv

Source-linked AI summary

SafeBench: A Benchmarking Platform for Safety Evaluation of Autonomous Vehicles

Chejian Xu, Wenhao Ding, Weijie Lyu, Zuxin Liu, Shuai Wang, Yihan He, Hanjiang Hu, Ding Zhao, Bo Li

arXiv:2206.09682v4cs.RO

TL;DR

Safety evaluation for autonomous driving is difficult because critical scenarios are rare and existing evaluation approaches vary, limiting direct comparisons. SafeBench unifies scenarios, generation methods, routes, metrics, and AD algorithms; its evaluation finds trade-offs between benign and safety-critical settings and differences across algorithms and testing choices.

  • Problem

    Safety-critical autonomous-driving evaluation is difficult because critical scenarios are rare and existing platforms vary in scenarios, generation methods, metrics, and inputs.

    Source: §1 · p. 2

  • Method

    SafeBench unifies safety-critical scenarios, generation algorithms, routes, environments, evaluation metrics, and four reinforcement-learning AD algorithms with varied input types.

    Source: §1 · p. 2

  • Results

    Evaluations find trade-offs between AD algorithm performance in benign and safety-critical scenarios, with outcomes also varying by scenario, generation algorithm, and metric.

    Source: §1 · pp. 2–3

  • Takeaways & Limitations

    The authors conclude that high-quality safety-critical scenarios are necessary for testing and recommend combining scenarios and generation algorithms for effective evaluation.

    Source: §1 · p. 2

    SafeBench's simulation cannot exactly reflect real-world conditions, and the current version evaluates only reinforcement-learning-based AD algorithms.

    Source: §5 · p. 10

Abstract

from arXiv · show

As shown by recent studies, machine intelligence-enabled systems are vulnerable to test cases resulting from either adversarial manipulation or natural distribution shifts. This has raised great concerns about deploying machine learning algorithms for real-world applications, especially in safety-critical domains such as autonomous driving (AD). On the other hand, traditional AD testing on naturalistic scenarios requires hundreds of millions of driving miles due to the high dimensionality and rareness of the safety-critical scenarios in the real world. As a result, several approaches for autonomous driving evaluation have been explored, which are usually, however, based on different simulation platforms, types of safety-critical scenarios, scenario generation algorithms, and driving route variations. Thus, despite a large amount of effort in autonomous driving testing, it is still challenging to compare and understand the effectiveness and efficiency of different testing scenario generation algorithms and testing mechanisms under similar conditions. In this paper, we aim to provide the first unified platform SafeBench to integrate different types of safety-critical testing scenarios, scenario generation algorithms, and other variations such as driving routes and environments. Meanwhile, we implement 4 deep reinforcement learning-based AD algorithms with 4 types of input (e.g., bird's-eye view, camera) to perform fair comparisons on SafeBench. We find our generated testing scenarios are indeed more challenging and observe the trade-off between the performance of AD agents under benign and safety-critical testing scenarios. We believe our unified platform SafeBench for large-scale and effective autonomous driving testing will motivate the development of new testing scenario generation and safe AD algorithms. SafeBench is available at https://safebench.github.io.

1 Introduction

SafeBench addresses the difficulty of evaluating autonomous-driving safety across rare critical scenarios and incompatible testing platforms. It unifies scenarios, generation methods, routes, metrics, and AD algorithms, and its evaluations reveal performance trade-offs and differences across settings.

1 Introduction

  • Safety-critical scenarios are rare, making naturalistic evaluation costly, while differing evaluation designs make fair comparisons difficult.The paper reports that such scenarios may be found only once every 30,000 miles, and that traditional testing requires millions of miles.Source: §1 · p. 2
  • Evaluation reveals benign-versus-safety-critical trade-offs, scenario-dependent transferability, generator-dependent effectiveness, and metric-dependent advantages among AD algorithms.The authors conclude that testing with high-quality safety-critical scenarios is necessary and recommend combining scenarios and generation algorithms.Source: §1 · p. 2
  • SafeBench evaluates 2,352 scenarios, with four generation algorithms and ten driving routes per safety-critical scenario, using ten metrics.The platform also implements four reinforcement-learning AD algorithms with four input types, from low-dimensional states to visual inputs.Source: §1 · p. 2
  • Its modular design allows modules to be replaced, added, or removed, and its scenario set can be extended with new templates and generation methods.The platform integrates 2,352 tests intended to cover known real-world safety-critical scenarios.Source: §1 · p. 2
  • The benchmark reports safety, functionality, and etiquette metrics, provides a leaderboard for four AD algorithms, and supports integration with other simulators and devices.The authors also report different algorithm performance under controllable settings and efficient testing once an AD algorithm is trained.Source: §1 · p. 3

2 Related work

Prior AD evaluation approaches differ in how they generate scenarios and in their testing platforms and configurations. SafeBench brings varied scenario-generation approaches into a unified setting for comparison.

2 Related work

  • Prior approaches use data-driven sampling [46], adversarial agents [49], or domain knowledge such as traffic rules [51] to generate scenarios.The paper focuses mainly on adversarial and knowledge-based methods, which have shown efficient and effective results in particular environments and settings.Source: §2 · p. 3
  • Different platforms, AD algorithms, and sensor configurations make it difficult to compare scenario effectiveness, generation algorithms, and AD safety directly.The paper proposes SafeBench as a unified platform for comparing scenarios generated with different algorithms across environments and configurations.Source: §2 · p. 3
  • Software-testing approaches identify safety violations at the software level and could also be integrated into SafeBench.Source: §2 · p. 3
  • The authors report that few existing evaluation platforms consider safety-critical scenarios and that their scenario counts are limited.They summarize and compare existing platforms in Table 1.Source: §2 · p. 3

3 SafeBench: benchmarking platform for safety evaluation

SafeBench combines a modular simulator-based platform with safety-critical scenarios, multiple scenario-generation methods, route variants, and evaluation metrics. This section describes its components, testing setup, generation approaches, and scoring scheme.

3.1 Platform structure

  • SafeBench runs in Docker on Carla, uses ROS for module communication, and has Ego Vehicle, Agent, Scenario, and Evaluation nodes.The Ego Vehicle configures sensors, a planner, and vehicle appearance; the Agent manages AD algorithms and control signals; the Scenario node organizes traffic and road conditions; and Evaluation summarizes results.Source: §3.1 · p. 4

3.2 Safety-critical testing scenarios

  • The benchmark defines eight representative pre-crash scenarios and ten routes per safety-critical scenario, varying lanes, surroundings, scenes, and road signs.In each scenario, the ego vehicle follows a predefined route, reacts to emergencies, follows traffic rules, and avoids potential accidents.Source: §3.2 · pp. 4–5, Figure 2 · p. 5

3.3 Safety-critical scenario generation algorithms

  • For each route, SafeBench uses four generation algorithms from adversary-based and knowledge-based categories to create testing samples.Source: §3.3 · p. 5

3.3.1 Adversary-based generation

  • Learning-to-collide optimizes cyclist initial poses, while AdvSim perturbs surrounding-vehicle trajectories; both are adapted across scenarios or route variants.Learning-to-collide uses REINFORCE; AdvSim uses a kinematic bicycle model and Bayesian optimization.Source: §3.3.1 · p. 5

3.3.2 Knowledge-based generation

  • Carla Scenario Generator uses rules and grid search, while Adversarial Trajectory Optimization uses domain constraints and PSO-based optimization.These knowledge-based methods incorporate traffic rules and physical laws that adversarial generation can violate.Source: §3.3.2 · p. 5

3.4 Evaluation metrics

  • Ten metrics cover safety violations, route following and completion, time, acceleration, yaw velocity, and lane invasion across three evaluation levels, then form a weighted overall score.The levels are safety, functionality, and etiquette.Source: §3.4 · pp. 5–6

4 Benchmark evaluation on SafeBench

SafeBench benchmarks autonomous-driving agents across generated safety-critical scenarios, benign scenarios, and multiple evaluation dimensions. The results show a gap between benign and safety-critical performance, while diagnostic and perception evaluations reveal differences among agents and models.

4.1 AD algorithms tested on SafeBench

  • PPO, SAC, DDPG, and TD3 were evaluated with four observation designs, including 4D state, bird’s-eye view, and front-camera inputs.The basic 4D observation includes waypoint distance, longitudinal speed, angular speed, and a front-vehicle detection signal.Source: §4.1 · pp. 6–7

4.2 Driving scenarios for testing

  • Four scenario generators produced 3,140 scenarios; selection retained 2,352 that caused collisions for at least two agents, and the analysis found differences in collision rate and transferability.AT had a 73.4% collision rate before selection and 81.1% after selection; CS had the highest selection rate, at 85.5%.Source: §4.2 · p. 7, Table 2 · p. 8

4.3 Benchmark results

  • TD3’s overall score falls from 0.830 on benign scenarios to 0.518 on safety-critical scenarios; PPO leads on safety-critical tests, while SAC leads on benign tests.The benchmark reports a performance trade-off between benign and safety-critical scenarios.Source: Table 3 · p. 8, §4.3 · p. 8
  • Across safety, functionality, and etiquette metrics, different agents lead on different measures, while PPO has the best weighted overall score.PPO has the lowest collision and out-of-road rates; TD3 leads in route-following stability, while SAC and DDPG lead on different etiquette metrics.Source: §4.3 · p. 9, Table 4 · p. 9

4.4 Robustness Evaluation: Physical semantic attacks against AD algorithms

  • On benign data, SECOND performs better; on adversarial data, CLOCs has higher average precision and a smaller performance drop than SECOND.SECOND uses LiDAR point clouds, while CLOCs uses both LiDAR point clouds and camera images.Source: Table 6 · p. 10, §4.4 · p. 10
  • All four point-cloud segmentation models are attackable, with varying IoU results across the three adversarial attacks.Source: Table 5 · p. 9, §4.4 · p. 10

5 Conclusion

SafeBench evaluates AD agents across safety-critical scenarios and reports substantial performance drops compared with benign scenarios. The authors identify simulation fidelity and the current RL-only evaluation scope as limitations.

5 Conclusion

  • Across safety-critical scenarios, AD algorithms show a large performance drop compared with benign scenarios.SafeBench evaluates 8 safety-critical scenarios using 10 metrics from 3 levels and provides diagnostic reports for each agent.Source: §5 · p. 10
  • SafeBench is presented as a unified platform for evaluating and analyzing AD algorithms across safety-critical scenarios generated by different methods.The authors aim for its benchmark and findings to help identify weaknesses and develop safer AD algorithms and more effective scenario-generation methods.Source: §5 · p. 10
  • Simulation in SafeBench cannot exactly reflect real-world conditions, so on-track testing is necessary before deployment.The current version evaluates only RL-based AD algorithms; evaluating more diverse and commercial systems is identified as future work.Source: §5 · p. 10

Checklist

The checklist reports that the paper addresses claim accuracy, scope, limitations, and societal impacts, and documents experiment reproducibility and asset information.

Checklist

  • The checklist reports that the paper addresses whether its main claims accurately reflect the paper and whether its contributions, scope, and limitations are described.The cited responses are marked Yes, with the limitations discussion referenced in Section 5.Source: Checklist · p. 16
  • The checklist reports that potential negative societal impacts and ethics guidelines are addressed.The negative-impacts response points to Appendix A.12.Source: Checklist · p. 16
  • For experiments, the checklist reports code, data, and reproduction instructions, training details, and compute information, while error bars are marked not applicable.The responses point to the project website and Appendix A.6.Source: Checklist · p. 16
  • The checklist reports asset attribution and licensing information, and marks consent and participant-related items not applicable.The asset license is referenced on the project website; the personal-information response points to Appendix A.7.Source: Checklist · p. 16

A.1 SafeBench statistics

SafeBench scenario statistics distinguish the generated cases from the subset selected for AD evaluation.

A.1 SafeBench statistics

  • 3, 140 testing scenarios were generated using four scenario-generation algorithms.The statistics are reported before and after scenario selection.Source: §A.1 · p. 17
  • 2, 352 scenarios were selected from the generated set for AD evaluation.Selection retains scenarios with high transferability across AD algorithms.Source: §A.1 · p. 17
  • Table 8 reports scenario statistics for each generation algorithm, both before and after selection.Source: §A.1 · p. 17

A.2 SafeBench design details

SafeBench uses four customizable components that communicate through ROS and runs on a Docker image built around CARLA.

A.2 SafeBench design details

  • SafeBench has ego vehicle, agent, scenario, and evaluation components that communicate through ROS services.The modules are described as flexible for user customization.Source: §A.2 · p. 17
  • The Docker image uses Ubuntu 20.04, CARLA 0.9.11, and ROS Noetic.CARLA is used for traffic simulation and ROS for communication.Source: §A.2 · p. 17
  • The scenario node incorporates Scenario Runner, while the agent node uses an RL agent built on Gym Carla.Gym Carla supports OpenAI Gym-style interaction between the agent and CARLA.Source: §A.2 · p. 17

A.3 Definition of scenarios and examples of route variants

SafeBench defines eight safety-critical traffic scenarios and pairs them with benign counterparts for comparison. It also incorporates route variants.

A.3 Definition of scenarios and examples of route variants

  • SafeBench defines eight traffic scenarios and provides detailed definitions and screenshots for them.Source: §A.3 · p. 17
  • Eight benign counterparts keep everything the same except that other vehicles are auto-piloted, enabling comparison with safety-critical scenarios.Source: §A.3 · p. 17
  • The evaluation incorporates route variants and provides examples of them.Source: §A.3 · p. 17

A.4 Evaluation metrics

The evaluation calculates metric expectations over scenarios, with a special setting for route-following stability. Overall-score weights prioritize safety over functionality and etiquette.

A.4 Evaluation metrics

  • Route-following stability uses xmax = 5 before its expectation is calculated.Source: §A.4 · p. 17
  • Other metrics are calculated as expectations over the scenario distribution P.Source: §A.4 · p. 17
  • CR receives five times the weight of other safety metrics; functionality weights are half the safety weights, and etiquette weights are one-fifth.Source: §A.4 · p. 17

A.5 Implementation details of AD algorithms

SafeBench evaluates trained driving agents across generated scenarios, route variants, and input types. The appendix reports performance gaps and trade-offs, alongside implementation details, complexity considerations, and potential misuse.

A.5 Implementation details of AD algorithms

  • RL agents share a seven-item weighted reward, bounded acceleration and steering mapped to clipped Carla throttle and brake, and a [256, 256] MLP with end-to-end image encoders.Source: §A.5 · pp. 17–19

A.6 Training details of AD algorithms

  • All four RL agents train in Carla town03; a separately seeded SAC model with 4D input also serves as the scenario-generation surrogate.Source: §A.6 · pp. 20–21

A.7 Detailed scenario generation results

A.8 Full benchmark results

  • Across input types, benign and safety-critical scores differ; with 4D+Cam, SAC scores better on benign scenarios, while PPO scores higher on safety-critical scenarios, and PPO with 4D+BEV achieves the best SafeBench OS.Source: §A.8 · p. 21, Table 12 · p. 23

A.9 Full diagnostic report

A.10 Robustness evaluation examples and visualizations

A.11 Complexity analysis

  • Scenario-generation complexity depends on the black-box search method, while AD-side complexity depends on surrogate robustness; stronger RL models may need more optimization steps.Source: §A.11 · p. 24

A.12 Potential negative societal impacts.

  • The platform covers eight safety-critical scenarios with ten variations each; open code and data may also be leveraged for real-world attacks.Source: §A.12 · p. 25
Loading 2206.09682v4…