DTP-Attack: A Decision-Based Black-Box Adversarial Attack on Trajectory Prediction
Jiaxiang Li, Jun Yan, Daniel Watzenig, Huilin Yin
AI summary
Problem
Existing adversarial attacks on trajectory prediction require white-box access or rigid physical constraints, limiting real-world applicability and preventing effective intention misclassification.
Approach
DTP-Attack operates as a decision-based black-box framework that uses a boundary walking algorithm to navigate adversarial regions using only binary feedback, naturally preserving trajectory realism without explicit kinematic constraints.
Key results
- 41–81% success rate for intention misclassification with perturbations under 0.45 m
- 1.9–4.2× increase in prediction errors for accuracy degradation
- Consistently outperforms black-box baselines across Trajectron++ and Grip++ models
- Naturally maintains kinematic feasibility without manual physical constraints
Why it matters
Reveals fundamental vulnerabilities in safety-critical autonomous driving systems and highlights the urgent need for robust, real-world-adaptive defenses.
Abstract
Trajectory prediction systems are critical for au- tonomous vehicle safety, yet remain vulnerable to adversarial attacks that can cause catastrophic traffic behavior misinterpre- tations. Existing attack methods require white-box access with gradient information and rely on rigid physical constraints, limiting real-world applicability. We propose DTP-Attack, a decision-based black-box adversarial attack framework tailored for trajectory prediction systems. Our method operates ex- clusively on binary decision outputs without requiring model internals or gradients, making it practical for real-world scenar- ios. DTP-Attack employs a novel boundary walking algorithm that navigates adversarial regions without fixed constraints, naturally maintaining trajectory realism through proximity preservation. Unlike existing approaches, our method supports both intention misclassification attacks and prediction accuracy degradation. Extensive evaluation on nuScenes and Apolloscape datasets across state-of-the-art models including Trajectron++ and Grip++ demonstrates superior performance. DTP-Attack achieves 41−81% attack success rates for intention misclassifi- cation attacks that manipulate perceived driving maneuvers with perturbations below 0.45 m, and increases prediction errors by 1.9 −4.2× for accuracy degradation. Our method consistently outperforms existing black-box approaches while maintaining high controllability and reliability across diverse scenarios. These results reveal fundamental vulnerabilities in current trajectory prediction systems, highlighting urgent needs for robust defenses in safety-critical autonomous driving ap- plications. Our code is available at the repository: https: //github.com/eclipse-bot/DTP-Attack.