Source-linked AI summary
Structured Representation Probing for Risk Anticipation in End-to-End Autonomous Driving
Jiawei Liang, Tianrui Lou, Le Yang, Xianghao Jiao, Wei Wang, Xiaochun Cao
TL;DR
Failure anticipation asks whether a driving policy’s current internal state contains evidence of a hard failure before it occurs, complementing signals from observable behavior. SRP reads actor, ego, and map representations from a frozen policy and combines source-specific risk readouts into a generic warning. Across three policies, it improves frame-level PR-AUC and ROC-AUC over evaluated runtime baselines.
Problem
Failure anticipation asks whether information available at the current policy step predicts a hard failure within a short future window, while internal representations provide evidence complementary to observable behavior.
Source: §I · p. 1Method
SRP reads actor, ego, and map representations from a frozen policy, learning source-specific risk directions and pooling element scores into a generic warning with event-window and auxiliary event-type supervision.
Source: §I · p. 1Results
Across DriveTransformer, UniAD, and VAD, SRP achieves higher frame-level PR-AUC and ROC-AUC than evaluated runtime baselines; DriveTransformer ROC-AUC is 0.833 versus 0.715 for temporal consistency.
Source: §I · pp. 1–2Takeaways & Limitations
The findings support using a driving policy’s internal computation for failure anticipation without updating the policy or adding a separate perception and planning stack.
Source: §VI · p. 11
Abstract
from arXiv · showhide
End-to-end driving policies form structured internal representations of traffic, ego behavior, and road constraints. These representations offer a monitoring interface for anticipating failures, complementing risk signals from trajectories, controls, and manually designed features. We introduce the Structured Representation Probe (SRP), a lightweight monitor that reads actor, ego, and map representations from a frozen policy. SRP learns a separate linear risk direction for each source and aggregates element scores through cardinality-normalized log-mean-exp pooling, retaining sensitivity to salient evidence while reducing dependence on token count. Event-window supervision links the readout to upcoming hard failures, and auxiliary event type heads jointly train the source directions across failure modes. Online alerting uses a single generic score without modifying the driving policy. Bench2Drive experiments on DriveTransformer, UniAD, and VAD show higher frame-level PR-AUC and ROC-AUC than the evaluated runtime baselines. On DriveTransformer at a horizon of 2 seconds, ROC-AUC reaches 0.833 versus 0.715 for temporal consistency, with 2.67% readout runtime overhead. The trained probes also retain the ability to distinguish impending failures on new routes.
I. INTRODUCTION
SRP reads structured representations from a frozen driving policy to anticipate failures, complementing monitors based on observable behavior. Across three policies, it improves frame-level discrimination over evaluated runtime baselines.
I. INTRODUCTION
- Failure anticipation asks whether current policy-step information predicts a hard failure within a short future window, complementing monitors of trajectories, control stability, and rule compliance.Actor, ego, and map evidence may carry distinct signals, while sparse evidence and representation-set size pose aggregation challenges.Source: §I · p. 1
- SRP learns separate linear risk directions for actor, ego, and map representations, pooling element scores with cardinality-normalized log-mean-exp and auxiliary event-type supervision into one generic warning.Event-window labels link the readout to upcoming failures, while online alerting uses the generic score.Source: §I · pp. 1–2
- Across DriveTransformer, UniAD, and VAD, SRP achieves higher frame-level PR-AUC and ROC-AUC than evaluated runtime baselines; DriveTransformer ROC-AUC is 0.833 versus 0.715 for temporal consistency.SRP also achieves the highest penalized lead time across all three policies and retains discrimination on new test routes.Source: §I · pp. 1–2
II. RELATED WORK
- Prior work studies driving architectures, failure monitors, and representation analysis; SRP instead probes whether structured driving representations expose evidence of future hard failures for online warning.The related work spans linear probes, unit and concept analysis, representation similarity, and control tasks.Source: §II · p. 2
III. METHOD
SRP attaches a lightweight readout to a frozen driving policy’s structured representation interface. It keeps actor, ego, and map evidence distinct while producing a generic warning score for online alerting.
III. METHOD
- SRP assigns separate risk directions to actor, ego, and map sources, then uses cardinality-normalized log-mean-exp pooling to combine element evidence into a generic warning.The framework trains with event-window labels and auxiliary event-type heads, but online alerting uses only the generic score.Source: §III · p. 2, Figure 2 · p. 3
A. Monitoring Formulation
- A fixed exporter reads a frozen policy’s internal representations, which SRP maps to a scalar warning score without modifying the policy.Auxiliary event-type heads jointly supervise training and provide diagnostic scores for corresponding event labels.Source: A. Monitoring Formulation · p. 2
B. Structured Driving Evidence
- The evidence interface separates actor interactions, ego motion and planning, and map geometry and semantic constraints; its source roles can be instantiated across driving models.These sources support assessing traffic conflicts, unsafe or unstable plans, and maneuver compatibility with road layout and rules.Source: B. Structured Driving Evidence · pp. 2–3
C. Risk Scoring by Source
SRP pools source-specific risk evidence into a generic warning score and uses event-type heads to provide auxiliary supervision. Event-window labels connect the readout to upcoming hard failures, while online alerting uses the generic score.
C. Risk Scoring by Source
- Cardinality-normalized log-mean-exp pooling retains sensitivity to high-risk elements while reducing dependence on the number of representation elements.It is permutation invariant and behaves like a smooth maximum; repeating the same collection of logits leaves the normalized score unchanged.Source: C. Risk Scoring by Source · pp. 3–4
- Generic inference pools evidence across sources into one warning score, while auxiliary event-type heads predict failure types from pooled source scores.The auxiliary heads are linear readouts whose loss trains the shared source directions and whose outputs provide event-label diagnostics.Source: C. Risk Scoring by Source · p. 4
- Generic and event-type labels mark frames within anticipation window W before target failures, with positive frames formed from the union of event windows.Dynamic collisions include vehicle and pedestrian collisions; static collisions cover static objects; rule violations include red-light and stop-sign infractions and route deviations.Source: C. Risk Scoring by Source · p. 4
- Training uses weighted binary cross-entropy, with class weights addressing rare positive event-window frames and λ controlling the mean event-type supervision strength.The training procedure normalizes source features, projects them onto separate risk directions, pools source and generic scores, then updates probe parameters using the weighted loss.Source: C. Risk Scoring by Source · p. 4
- Online inference compares the generic score rt with a validation-selected threshold and issues an alert when the score meets or exceeds it.Source and auxiliary event-type scores are optional diagnostics; alerting uses only rt.Source: C. Risk Scoring by Source · p. 4
IV. EXPERIMENTS
The experiments compare SRP with runtime baselines, analyze anticipation windows, event types, and probe ablations, then assess transfer and readout cost.
IV. EXPERIMENTS
- The evaluation sequence covers runtime-baseline comparisons, anticipation windows, event types, probe ablations, transfer under diagnostic and fixed-threshold protocols, and readout cost.Source: §IV · p. 4
A. Experimental Setup
The experiments use Bench2Drive closed-loop routes and three frozen driving policies, pairing policy representations with failures recorded during their own executions. The setup specifies route splits, training and evaluation protocols, and frame- and event-level metrics.
A. Experimental Setup
- Bench2Drive supplies 220 closed-loop CARLA routes across towns and weather, with each policy run on the same routes and its online representations paired with its own recorded hard failures.Source: A. Experimental Setup · p. 4
- The evaluation covers DriveTransformer, UniAD, and VAD with frozen policies and exporters mapping representations to a shared actor, ego, and map interface.Training, validation, and test splits contain 132, 44, and 44 routes, with no routes shared between splits.Source: A. Experimental Setup · pp. 4–5
- Temporal Consistency summarizes recent ego-plan and control changes, Task-Aware Risk samples alternative traffic configurations, and TRFD compares planning costs in nominal and alternative scenes.Source: A. Experimental Setup · p. 5
- At 20 Hz, penalized lead time uses the earliest alert strictly before an event within the evaluation window, while RF, RE, and pLead use a threshold maximizing frame recall under a 5% frame-level FPR.The diagnostic evaluation threshold is distinct from the validation-selected threshold saved for deployment.Source: A. Experimental Setup · p. 5
B. Main Benchmark Results
SRP improves frame discrimination across DriveTransformer, UniAD, and VAD, while its event-level warning gains vary by policy. Figure 3 visualizes the separation of positive and negative event-window logits in relation to alert thresholds.
B. Main Benchmark Results
- SRP leads PR-AUC, ROC-AUC, and RF across all three policies, and achieves the highest pLead across all three; it also has the highest event recall on UniAD.On DriveTransformer, ROC-AUC is 0.833 for SRP versus 0.715 for temporal consistency, and pLead is 0.701 versus 0.633 seconds while event recall is similar (0.497 versus 0.505). On VAD, SRP has the highest pLead at 1.229 seconds, while Task-Aware Risk has the highest event recall (0.739).Source: B. Main Benchmark Results · p. 5
- Positive event-window logits shift higher than negative logits for all three policies, though the distributions overlap; mean thresholds show this separation relative to the 5% FPR alert region.Source: B. Main Benchmark Results · p. 5, Figure 3 · p. 5
- In the illustrated routes, generic scores rise gradually for a red-light violation and vehicle collision, but more sharply near a static collision, remaining at 0.97 and 0.93 at R1 and R2.Source: B. Main Benchmark Results · p. 5
C. Window Sensitivity
The section separates the effect of changing the evaluation horizon from changing the training horizon. Longer evaluation windows improve some metrics but alter the anticipation task, while training-window effects vary by policy and metric.
Evaluation horizon
- On DriveTransformer, extending evaluation from one to three seconds raises PR-AUC from 0.176 to 0.315 and pLead from 0.376 to 0.984 seconds.The probe is fixed; Table II varies the evaluation window while training uses Wtrain = 40.Source: C. Window Sensitivity · pp. 5–6, Table I · p. 6
- Longer evaluation windows raise PR-AUC and pLead across all three policies, while ROC-AUC decreases and frame recall changes little or declines.Longer windows label more preceding frames positive and credit alerts farther from the event, so these comparisons represent different anticipation tasks.Source: C. Window Sensitivity · pp. 5–6
Training horizon
- Training-window effects vary by policy: DriveTransformer declines at the longest tested window, UniAD generally peaks near two seconds, and VAD’s PR-AUC and ROC-AUC remain nearly constant.Event recall and pLead also vary at the low-FPR operating point depending on which selected events receive alerts; there is no uniform benefit from longer training supervision.Source: C. Window Sensitivity · p. 6
D. Event and Qualitative Analysis
Event-type performance differs across policies, while generic and event-specific scores often rise toward failures. Source-score profiles also differ by event context, and generic warnings lead more in static-collision and rule-violation groups than in dynamic-collision groups.
Event-type performance
- On VAD, static collisions have the highest event recall (0.867), while rule violations have the longest pLead (1.671 seconds).The event label with the highest auxiliary-head recall differs by policy: rule violations lead on DriveTransformer, while static collisions lead on UniAD and VAD.Source: D. Event and Qualitative Analysis · p. 6, Table III · p. 8
Temporal warning profiles
- Generic scores generally rise toward target events, gradually for dynamic collisions and more sharply for static collisions.For dynamic collisions, auxiliary-head and generic curves track closely; for static collisions, DriveTransformer’s auxiliary score stays substantially below its rising generic score.Source: D. Event and Qualitative Analysis · pp. 6–7, Figure 6 · p. 8
Source profiles
- Actor and ego scores rise in both collision groups, while map scores change modestly; for rule violations, map scores rise markedly and approach ego scores near the event.The source profiles average across policies in the figure’s bottom row, with policy-specific readouts above.Source: D. Event and Qualitative Analysis · p. 7, Figure 6 · p. 8
Generic warning lead time
- Generic warnings have longer mean pLead in route groups containing static collisions or rule violations than in groups containing dynamic collisions.The static–dynamic gap is larger for DriveTransformer and UniAD than for VAD; these generic-score route groups differ from auxiliary-head evaluation against individual event labels.Source: D. Event and Qualitative Analysis · p. 7
E. Ablation Studies
The ablations find complementary contributions from representation sources, auxiliary event supervision, readout structure, and pooling. Ego representations provide substantial warning evidence, while the full source set and LME pooling perform best on selected frame-discrimination and warning-lead measures.
Source selection
- Using all three sources gives the highest PR-AUC and ROC-AUC among retrained variants, while ego-only pLead is close to the full probe’s (0.704 versus 0.701 seconds).Removing ego causes the largest decline among two-source variants, reducing event recall from 0.497 to 0.310.Source: E. Ablation Studies · p. 8, Table IV · p. 9
Auxiliary supervision
- With the source set held fixed, adding auxiliary event supervision raises generic-warning PR-AUC from 0.224 to 0.261 and pLead from 0.561 to 0.701 seconds.Source: E. Ablation Studies · pp. 8–9
Source deletion at inference
- On the new Bench2Drive evaluation set, ego deletion reduces fixed-probe PR-AUC from 0.363 to 0.217 and event recall from 0.681 to 0.411.Actor deletion has a smaller effect, while map deletion leaves frame ranking nearly unchanged; this inference-time deletion experiment uses the complete probe with parameters fixed.Source: E. Ablation Studies · p. 9, Table V · p. 9
Readout design
- SRP achieves the highest mean PR-AUC and pLead among the compared readout designs, at 0.261 and 0.701 seconds.The comparison includes Flat-LME, Pooled-Linear, and Pooled-MLP, using the same policy representations.Source: E. Ablation Studies · p. 9, Figure 9 · p. 9
Pooling
- LME pooling has the highest mean PR-AUC and pLead among the tested pooling choices, improving them from 0.251 to 0.261 and from 0.664 to 0.701 seconds versus mean pooling.The pooling comparison retrains SRP with mean, max, or LME aggregation in both pooling branches.Source: E. Ablation Studies · pp. 9–10, Figure 9 · p. 9
Temperature sensitivity
- The default temperature τ = 1 gives the highest mean PR-AUC, with pLead close to τ = 0.25 (0.701 versus 0.704 seconds).Mean PR-AUC and pLead remain similar for τ = 1, 2, and 4, while τ = 0.5 yields lower pLead.Source: E. Ablation Studies · p. 10, Figure 10 · p. 10
F. Generalization
Probes trained on original routes retain frame-level discrimination on new Bench2Drive and CARLA Leaderboard 2.0 routes. Event coverage varies more across policies on LB2, and fixed source-validation thresholds yield varying observed false-positive rates.
Diagnostic transfer
- Probes trained on original routes retain frame-level discrimination, with ROC-AUC ranging from 0.807 to 0.923 on new Bench2Drive routes and from 0.769 to 0.878 on LB2.The transfer evaluation keeps policy, probe parameters, and training feature statistics fixed; each target uses a separately selected diagnostic threshold under the same 5% frame-level FPR rule.Source: F. Generalization · p. 10
- Event recall on LB2 ranges from 0.444 to 0.765, versus 0.681 to 0.793 on new Bench2Drive routes; UniAD’s LB2 PR-AUC is higher but its event recall is lower.For UniAD, PR-AUC is 0.380 versus 0.324, while event recall is 0.444 versus 0.705; on LB2, VAD leads ROC-AUC, event recall, and pLead.Source: F. Generalization · p. 10
Fixed-threshold transfer
- With source-validation thresholds held fixed, observed FPR ranges from 2.66% to 6.36% on new Bench2Drive routes and from 2.78% to 5.56% on LB2.Mean pLead exceeds one second in all settings except UniAD on LB2, where it is 0.728 seconds.Source: F. Generalization · p. 10, Table VII · p. 10
G. Deployment Cost
SRP improves frame discrimination over evaluated runtime monitors across three policies, with modest readout overhead. The discussion qualifies source scores as diagnostics and notes that real-world deployment requires further validation.
G. Deployment Cost
- 0.20%–2.67% of policy runtime is used to compute the generic score, and SRP uses 0.8K–2.3K probe parameters.DriveTransformer has the lowest FLOP count but the longest measured readout time at 6.47 ms.Source: G. Deployment Cost · p. 10
V. DISCUSSION
- SRP improves frame discrimination over evaluated runtime monitors across three policies; tested readouts show metric-dependent trade-offs, with SRP leading mean PR-AUC and pLead.The discussion also identifies warning quality as dependent on both available evidence and its aggregation.Source: §V · p. 11
- Source scores are diagnostics rather than additive alarm decompositions, and causal attribution requires additional intervention analysis.Auxiliary heads organize learned evidence by event label.Source: §V · p. 11
- Evaluation establishes warning performance in simulation; real-driving deployment requires validation in the intended operational design domain, including downstream alert responses.Safety certification requires separate validation.Source: §V · p. 11
VI. CONCLUSION
- Across evaluated policies, SRP improves warning lead over runtime baselines, retains discrimination on new routes, and adds modest readout overhead.The monitor reads a frozen policy without updating it or adding a separate perception and planning stack.Source: §VI · p. 11