Real Time Counterfactual Generation Trend Attack for Rear-End Collision Risk Prediction

Rear-End Collision Risk Prediction

As shown in Equation 1, the rear-end collision risk prediction can be formulated as a regression problem, where X ∈ R O × C represents the historical observation features, and Y ∈ R 1 × P represents the predicted rear-end collision risk sequence. Where C represents the number of input features, and O and P represent the length of the observation and prediction windows, respectively, f represents the risk-mapping relationship learned by the model from X to Y, and Θ represents the model parameter.

Y = f ( X ; Θ )

(1)

Referencing previous research in car-following behavior modeling ( 42 ), the leading vehicle velocity (Pre_v), leading vehicle acceleration (Pre_a), following vehicle velocity (Fol_v), following vehicle acceleration (Fol_a), car-following distance (Distance), and rear-end collision risk are selected as inputs. Meanwhile, the safety margin (SM) was applied to quantify rear-end collision risk ( 43 ), and experiments demonstrated its superior performance in quantifying forward collision risk compared with other SSMs ( 44 ). The SM calculation follows Equation 2, where V _n and V_n−1 represent the following and preceding vehicle velocities, respectively, D _n represents the car-following distance, and g represents the gravitational acceleration (9.8 m/s²). Higher SM values indicate greater operational margin during hazardous situations, thereby enhancing driving safety. Considering input information redundancy and the prediction timeliness, both O and P are set to 4 s ( 37 ).

SM n ( t ) = 1 − { 0 . 15 V n ( t ) D n ( t ) + [ V n ( t ) + V n − 1 ( t ) ] [ V n ( t ) − V n − 1 ( t ) ] 1 . 5 g * D n ( t ) }

(2)

This study adopts deep learning-based data-driven models to construct a mapping relationship from a historical sequence of six input features to a future rear-end collision risk sequence. Although there is inevitably a correlation between input features, data-driven models possess the nonlinear fitting capability to capture interactive relationships among multiple features. Therefore, data-driven prediction models omit the feature correlation analysis, avoiding the potential dilemma of feature selection.

CGTA Framework

Because of the AV system’s potential vulnerability, attackers can steal information from prediction models. By analyzing the input–output mapping relationship f, they can achieve intended attack objectives using input tampering. The CGTA framework primarily consists of three steps: (1) model stealing; (2) feature analysis; and (3) counterfactual generation.

Identification of Key Feature Region

SHAP is widely used to interpret data-driven models ( 45 ). The gradient interpreter within SHAP serves as a feature attribution tool for differentiable models, effectively capturing the marginal contributions of inputs to predictions via gradient information while mitigating single-reference-value bias using background distribution sampling ( 46 ).

Assuming a data set with N samples, an SHAP value matrix S ∈ R N × C × O × P can be obtained after considering all input features, input time steps, and output time steps. Taking absolute values of this matrix and averaging across the sample and prediction time step dimensions yields an importance distribution Matrix I ∈ R C × O for all features at each input time step. Within Matrix I, higher SHAP values indicate greater importance of the observed time step feature for prediction outcomes. Given a designated modification time step l and feature number k, the identification algorithm for KFR is shown in Algorithm 1, and it consists of two steps: (1) for each feature, identify the l consecutive time steps with the highest cumulative feature importance scores by sliding an l-length window across all time steps. Record each feature’s most critical time step interval and their total importance; and (2) sort feature indices in descending importance order, select the top k features by importance ranking, and return their important feature set F and critical time step set T.

OPEN IN VIEWER

Algorithm 1: Key feature regions retrieval
1: Input: I, I, k
2: Output: Critical time step set T, critical feature set F
3: Initialize score set CS ∈ R 1 × 6 , start set SS ∈ R 1 × 6
4: for each feature f ∈ {1, 2, …, 6} do
5: max_score = 0, best_start = 0
6: fort=1 to O-l do
7:  current_score = sum (I[f, t:t+l])
8:  if current_score > max_score then
9:   max_score = current_score
10:   best_start = t
11:  end if
12: end for
13: CS [f] = max_score, SS[f] = best_start: best_start+l
14: end for
15: top_indices = indices sorted by CS in descending order
16: F = {top_indices [1], …, top_indices [k]}
17: T = {SS [top_indices [1]], …, SS [top_indices [k]]}

Notably, the KFR refers to the input region that significantly affects the output, regardless of the direction of influence. Based on identifying the KFR, the optimization algorithm can adaptively adjust the inputs within it. Although the SHAP value can indicate the direction of the input’s influence on the output, the complex risk-mapping relationship may lead to inconsistent signs of SHAP values for the same input region across different samples. The offset between positive and negative SHAP values can impede the identification of the KFR. Therefore, this study only employs the absolute SHAP value in the KFR identification process.

Counterfactual Generation Trend Attack

AV’s control algorithm typically operates based on fuzzy risk trends rather than detailed risk trajectories ( 32 , 39 ). Simultaneously, unlike previous studies that meticulously optimized outputs at each time step by modifying all features ( 9 ), CGTA achieves targeted trend attack by modifying only input features within KFR.

Assuming the KFR retrieval algorithm identifies the time steps m to n in the feature i as KFR, the optimization objective becomes obtaining an output sequence Y ~ that conforms to the trend attack direction by tampering with input x ~ i = [ x i , 1 , … , x ~ i , m , x ~ i , m + 1 , … , x ~ i , n , … ] . The solution to the tampered sequence x ~ i is formulated as a nonlinear optimization problem, with the objective function given by Equation 3. The objective function contains two loss terms: (1) constrains the magnitude of predicted sequence outputs. Since the objective function is minimized, α takes negative values to increase attacks, causing the optimization algorithm to increase Y ~ . In contrast, α takes positive values to decrease attacks; and (2) constrains the magnitude of modifications within KFR, with α and β serving as adjustable weights.

min L = α ∑ t = 1 P Y ~ t + β ∑ t = m n ( x ~ i , t − x i , t ) 2

(3)

As shown in Equation 4, the gradient descent-based algorithm is applied to optimize X ~ i , where lr represents the learning rate and ∇ L ( X ~ i , m : n k ) represents the objective function’s gradient. The optimization algorithm adjusts input values within KFR iteratively, gradually steering them toward the direction of the objective function to achieve targeted input tampering.

X ~ i , m : n k + 1 = X ~ i , m : n k − lr ∇ L ( X ~ i , m : n k )

(4)

Model Distillation

Model distillation is employed to extract the risk-mapping knowledge of the prediction model when the internal model parameter is inaccessible in PKS. Model distillation is a classical deep learning technique for model compression, aiming to train a smaller student model f_s to learn the teacher model’s mapping knowledge f _t while preserving comparable performance ( 47 ). Assuming attackers can obtain sufficient input–output data after invading the autonomous driving system, the student model is trained to fit these data, extracting as much knowledge as possible from the risk prediction model.

Attackers may lack access to ground truth labels during student model training; therefore, the training loss depends on the discrepancy between student and teacher model predictions (Equation 5), where y i T represents the teacher model’s output at time step i and y i S represents the student model’s output at time step i . Although the absence of ground truth labels may impair the student model performance, the student model can still capture approximate knowledge on feature importance and influence directions from the teacher model. Feature analysis and counterfactual generation are then performed based on f_s to generate corresponding optimized inputs.

L = 1 N ∑ i = 1 N ( y i T − y i S ) 2

(5)

Prediction Models

To evaluate the effectiveness of CGTA, three mainstream prediction models are applied for attack experiments.

Mixed Driving Data Set and Car-Following Samples

Because of the advantages in sample size, duration length, and data quality, this study selects Lyft Level-5 for rear-end collision risk prediction research ( 50 ). Lyft Level-5 contains approximately 170,000 scenes, each lasting about 25 s at a 10 Hz, which satisfies the requirements for real time driving risk prediction. The data set documents the position and motion information of the AV and its surrounding vehicles. Based on constraints on lateral distance, heading angle, and velocity, Li et al. extracted various car-following pairs from Lyft Level-5 ( 51 ). Meanwhile, they adopted techniques such as imputation, Kalman filtering, and wavelet denoising to process the raw data and published the processed data (https://github.com/RomainLITUD/Car-Following-Dataset-HV-versus-AV). To compress data and eliminate data-recording bias, car-following samples extracted by Li et al. were further processed: (1) the mean filtering is applied to compress and smooth data to 5 Hz, referring to the trajectory data processing paradigm ( 52 ); (2) the thresholds for acceleration ([−8, 5] m/s²), jerk ([−15, 15] m/s³), and distance (> 7 m) are applied to filter samples ( 53 ). Finally, 4,701 AV–HV samples were selected from Lyft Level-5.

Experiments Setting

The data processing and model construction were implemented using Python 3.11 and PyTorch 2.2.1 framework on an Intel Core i7-14700KF CPU and NVIDIA GeForce RTX 4070 Ti SUPER GPU. Samples were divided into training, validation, and test sets at an 8:1:1 ratio. All models were trained for 100 epochs, with mean squared error used as the training loss, and Adam optimized network parameters. The model parameters from the epoch with the minimum validation loss were saved during training, and the final performance was evaluated on the test set. Grid search was applied to optimize the training parameters, with learning rates [0.01, 0.005, 0.001] and batch sizes [128, 256, 512]. Model structural parameters were configured referencing previous research.

LSTM served as the student model in model distillation, trained using the teacher model’s inputs and corresponding outputs from the training and validation sets. The LSTM parameter settings are consistent with those in LSTM–CNN. Training environments for the student model followed the aforementioned parameter configurations.

For attack algorithm parameters: the KFR retrieval time step l = 7 and feature number k = 2. Optimization epochs = 30, α  = −1 or 1, β = 200, solver = Adam, learning rate = 0.01. The l and k parameters regulate the range of modification for input variables. Although tampering with additional input features may enhance the attack’s strength, the distinct discrepancy between the original and tampered input variables will undermine its stealthiness. The parameter β controls the tampering degree of inputs, and an increase in β limits the magnitude of input modifications, improving attack stealthiness to a certain extent. In contrast, reducing β can make it easier to optimize the input toward the target attack direction. Meanwhile, the CGTA is a framework based on real time optimization. Theoretically, increasing the optimization epoch can facilitate targeted optimization of input variables; however, this will prolong the optimization duration and compromise attack timeliness. The effects of these parameters will be analyzed in the discussion section.

Evaluation Metrics

As shown in Equation 6, the root mean square error (RMSE) was applied to evaluate the precision of rear-end collision risk prediction. Where y _i , _real and y _i , _pre represent the ground truth and predicted risk values at the ith output time step, respectively, and P represents the prediction time steps. Higher RMSE values indicate greater deviation between predicted and actual sequences, indicating poorer performance. The mean percentage error (MPE) provides an intuitive assessment of the direction and magnitude of prediction bias relative to ground truth (Equation 7), directly reflecting CGTA effectiveness.

RMSE = 1 P ∑ i = 1 P ( y i , pre − y i , real ) 2

(6)

MPE = 1 P ∑ i = 1 P ( y i , pre − y i , real ) | y i , real |

(7)

Attack Effect in FKS

The KFR retrieval results are shown in Figure 2, a–c. Preceding and following vehicle accelerations consistently emerge as the two most important features across all models. For TsLeNet and LSTM–CNN, critical time steps are from 14 to 20, while Bi-LSTM-MA exhibits critical time steps from 10 to 16. Although the SHAP value distribution shows that the acceleration changes of the preceding and following vehicles play a dominant role in the prediction results, this does not necessarily mean that other features can be excluded from the input. Given the model’s feature requirement, LSTM models with six and two input features (the accelerations of the preceding and following vehicles) were applied to further analyze the influence of the features on prediction performance. The results show that the RMSE of the LSTM with six input features is 0.015, whereas that of the LSTM with two input features is 0.029. In fact, there exist obvious correlations among the input features. For instance, acceleration can derived from the velocity, and the SM can be calculated from other input features. Data-driven models can capture feature–temporal interactions and their mapping patterns with prediction during training, omitting the traditional procedures of correlation analysis and feature elimination.

OPEN IN VIEWER

Figure 2.

Retrieval results of KFR: (a) TsLeNet; (b) LSTM–CNN; and (c) Bi-LSTM-MA.

The GCTA was applied to the risk prediction models, and the prediction results are presented in Table 1. Three principal findings can be obtained from the results.

Spearman correlation analysis reveals that RMSE and MPE exhibit a strong correlation, with a correlation coefficient of 1 (p < 0.01). This correlation pattern confirms the alignment in evaluation metrics. The MPE can simultaneously represent the attack direction and intensity; subsequent sections primarily utilize the MPE for discussion.

OPEN IN VIEWER

Table 1.

Prediction Results under Different Attack States

Attack	Metric	TsLeNet	LSTM–CNN	Bi-LSTM-MA
Increase	RMSE	0.2511	0.5863	0.0334
	MPE	0.2353	0.5475	0.0287
Decrease	RMSE	0.4920	0.9427	0.0397
	MPE	−0.4744	−0.8662	−0.0329
Non	RMSE	0.0140	0.0146	0.0149
	MPE	0.0009	0.0009	0.0004

Note: RMSE = root mean square error; MPE = mean percentage error; TsLeNet = Time-series LeNet; LSTM–CNN = Long Short-Term Memory–Convolutional Neural Networks; Bi-LSTM-MA = Bi-directional LSTM with Multi-head Attention.

OPEN IN VIEWER

Figure 3.

Prediction case: (a) risk prediction value and (b) input feature.

OPEN IN VIEWER

Figure 4.

Average MPE in each time step.

Sensitivity Analysis of CGTA Parameters

There are many adjustable parameters in the CGTA framework, mainly including the training epochs and the constraint weight β in the optimization algorithm, and the modified time step l and feature number k in KFR retrieval. Concurrently, experimental results reveal significant variations in model resilience against attacks. This section further examines the influence of parameter and model architecture on attack effectiveness.

Training Epochs and β

Figure 5, a and b , shows attack effects for TsLeNet across different training epochs and β value combinations. Elevating β values drives optimization toward the second loss term, strengthening feature modification constraints and limiting attack effectiveness. Distinct curve separation emerges across β values, with the MPE magnitude decreasing systematically as β increases. Meanwhile, the trend in attack effectiveness across varying training epochs is modulated by β values. When β = 0, the MPE magnitude grows nearly linearly with increasing training epochs. Increase and decrease attacks generate MPE values of 0.1754 and −0.2927 under 10 training epochs with β = 0, whereas 50 training epochs significantly raise the MPE to 0.3956 and −0.8460. This phenomenon arises because β = 0 imposes no constraints on perturbation magnitude within the CGTA framework, allowing inputs to be iteratively optimized toward the attack objective without restriction. In contrast, when β > 200, additional training epochs have a minimal effect on attack effectiveness and may even trigger adverse optimization effects. For instance, in the increase attack with β = 1,000, the MPE progressively declines as the number of training epochs increases from 10 to 20, and further from 20 to 30. In practice, attackers can leverage the β parameter to control the attack process. For models demonstrating robust adversarial resistance (e.g., Bi-LSTM-MA), setting β = 0 is advisable to maximize attack effect. In contrast, for models with weaker resistance (e.g., TsLeNet and LSTM–CNN), using higher β values limits attack effectiveness within a controllable range.

OPEN IN VIEWER

Figure 5.

Attack effects under different β and training epochs: (a) increase attack and (b) decrease attack.

Figure 6 shows the variation in Loss terms 1 and 2 during optimization for an attack sample under β = 200 and β = 1,000 conditions. When β = 200, the optimization algorithm imposes weaker constraints on the magnitude of input modifications. Loss 1 stabilizes after decreasing to approximately −80, while Loss 2 reaches its peak around the 25th optimization epoch before declining. These trends occur because during initial optimization epochs, the difference between tampered and original input sequences is minimal, causing the solver to prioritize reducing Loss 1 while relaxing constraints on Loss 2. As optimization progresses, greater feature modification magnitudes direct the algorithm to focus more on Loss 2, leading to its subsequent decrease. When β = 1,000, Loss 1 decreases and Loss 2 increases during the initial optimization phases. However, Loss 1 ultimately stabilizes around −60, whereas Loss 2 is significantly lower than β = 200. Concurrently, Loss 2 decline initiates earlier at approximately epoch 15, and this reduction drives an increase in Loss 1, demonstrating the effectiveness of β in controlling loss terms.

OPEN IN VIEWER

Figure 6.

Training loss change under different β values.

Optimization timeliness is critical for real time cyberattacks. Although increasing training epochs under a loose β constraint can improve attack effectiveness, it also increases computational time. Since perception data enters prediction models as real time streams, optimized inputs lose practicality if optimization requires excessive time. Frames per second (FPS) measures the samples the optimization algorithm can process per second, with higher FPS indicating superior timeliness. Figure 7 shows the FPS during input optimization across prediction models at different training epochs. The average FPS reached 69 under 10 training epochs, while it gradually degrades to 15 when training epochs increase to 50. Although FPS degrade significantly with the increase in training epochs, the 15 FPS still exceeds the data record frequency, which ensures the real-time efficiency of the CGTA.

OPEN IN VIEWER

Figure 7.

FPS under different training epochs.

Parameters of KFR Retrieval

KFR retrieval achieves parametric control over the attack region by identifying the significance of input features, encompassing both the number of features k and the span of temporal steps l. To validate the efficacy of KFR retrieval and assess the effect of parameter variations on attack performance, five distinct feature perturbation regions were designed based on the TsLeNet: (1) R0 (time steps 14–20 of preceding and following vehicle velocities); (2) KFR1 (k = 1, l = 7); (3) KFR2 (k = 2, l = 7, the default configuration); (4) KFR3 (k = 2, l = 20); and (5) KFR4 (k = 6, l = 20). As indicated by the KFR retrieval results (Figure 2a), preceding and following vehicle velocities exhibit relatively low importance. Therefore, comparing R0 with KFR2 (both covering two features and seven time steps) serves to verify whether KFR retrieval can accurately pinpoint effective attack regions. Furthermore, the parameter scope expands progressively from KFR1 to KFR4.

With training epochs fixed at 30, the attack outcomes under varying β values (0, 400, 1,000) are shown in Figure 8. Notably, even when the attack region size is identical, the attack effectiveness of R0 is substantially inferior to that of KFR2, particularly under a constrained β setting. Under increase and decrease attacks, R0 yields average MPE values of 0.0434 and −0.0668, respectively. In contrast, KFR2 achieves significantly higher magnitudes of 0.1544 and −0.2493. When β = 1,000, the MPE for the increase attack based on R0 drops to 0.0175, whereas KFR 2 still attains 0.1134. Similarly, in the decrease attack with β = 1,000, the MPE amplitude in KFR2 is 7.61 times greater than that of R0. These results demonstrate that KFR retrieval effectively identifies critical attack regions, where input perturbations more efficiently facilitate the attainment of attack objectives.

OPEN IN VIEWER

Figure 8.

Validation and effect of KFR retrieval: (a) increase attack and (b) decrease attack.

As the feature modification region expands from KFR1 to KFR4, the attack performance of both increase attack and decrease attack enhanced, which aligns with the consensus that a wider input feature modification range corresponds to stronger attack performance. The benefits of increasing the number of modified features (comparing KFR1 and KFR2) and extending the temporal span (comparing KFR2 and KFR3) are empirically validated. Furthermore, the β parameter modulates the influence of KFR retrieval settings on attack performance. For instance, when β = 400 and β = 1,000, the attack effectiveness shows a slight increase as KFR expands. However, when β = 0, modifying all input features yields a significant boost in MPE. This observation further corroborates previous findings that higher β values constrain both the magnitude of attack effects and their growth potential.

Model Structure

As previously discussed, this resistance in Bi-LSTM-MA is probably because of the MHA, which performs global fusion of sequential information. This section constructs TsLeNet with Multi-head Attention (TsLeNet-MA), LSTM-CNN with Multi-head Attention (LSTM–CNN–MA), and Bi-LSTM, analyzing the effect of MHA on attack effectiveness. TsLeNet-MA replaces the SE block in TsLeNet with an MHA module. LSTM–CNN–MA applies MHA separately to the LSTM and CNN outputs. Bi-LSTM removes MHA from Bi-LSTM-MA.

The KFR for TsLeNet-MA and LSTM–CNN–MA covers time steps 14–20 for leading and following vehicle accelerations, while Bi-LSTM’s KFR spans time steps 13–19 for the same features. Figure 9 shows the RMSE and MPE values predicted by each model under non-attack and increase attack conditions (k = 2, l = 7, and training epochs = 30). Although incorporating MHA has a negligible effect on prediction results in non-attack scenarios, it significantly enhances the model’s resistance against CGTA. Compared with models without MHA, LSTM–CNN–MA, Bi-LSTM-MA, and TsLeNet-MA reduce the MPE by 86.1%, 41.69%, and 74.94% under increase attack, respectively, while the differences in RMSE under non-attack do not exceed 1.3%.

OPEN IN VIEWER

Figure 9.

Influence of model structure on prediction results.

Attack Effect in PKS

The student model of TsLeNet was trained via model distillation, achieving a prediction RMSE of 0.0149, which is 6.43% higher than the 0.0140 RMSE of the original teacher model, because of unavoidable information loss during model distillation. Under the PKS attack targeting TsLeNet within KFR2, the KFR identified by the student model matches that in FKS. The attack effectiveness across different combinations of training epochs and β values is shown in Figure 10, a and b . First, CGTA successfully achieves its directional objectives even under the PKS condition. In increase attacks, the MPE is from 0.0634 to 0.2461, while in decrease attacks it is from −0.2753 to −0.0738. Second, the attack performance under PKS is markedly inferior to that under FKS. For increase attacks, the absolute average MPE values under PKS at β values of 0, 400, and 1,000 decreased by 23.23%, 51.48%, and 42.10%, respectively, compared with FKS. These degradations are even more pronounced in decrease attacks, reaching 51.11%, 71.56%, and 65.97%, respectively.

OPEN IN VIEWER

Figure 10.

Attack results in TsLeNet under PKS and FKS: (a) increase attack and (b) decrease attack.

Simultaneously, the β parameter continues to exert a regulatory influence on attacks under the PKS scenario. When β = 0, the MPE under PKS strengthens as training epochs increase, although this gain is less pronounced compared to the FKS scenario. However, when β = 400 and β = 1,000, constraints on the magnitude of input perturbations hinder the optimization of inputs toward the attack objective. For instance, when the number of training epochs increases from 10 to 20 with β = 400, the absolute values of MPE decrease in both attacks in PKS.

The Bi-LSTM-MA demonstrates superior attack resistance in FKS, and its performance in PKS was also analyzed. For the Bi-LSTM-MA student model, the KFR2 was identified as time steps 14–20 for the acceleration of both the preceding and following vehicles. The results of the increase attack are shown in Figure 11. Consistent with the findings for TsLeNet, the MPE under PKS in Bi-LSTM-MA is significantly inferior to that under FKS, except under the extreme constraint of β = 1,000. Furthermore, Bi-LSTM-MA exhibits robust resistance to attacks across various parameter settings. Of note, even under PKS conditions with β = 0 and 50 training epochs, the MPE for Bi-LSTM-MA was 0.0421, substantially lower than the 0.2461 observed for TsLeNet under the same scenario. To further investigate the boundaries of Bi-LSTM-MA’s resistance, increase attacks were tested under more aggressive conditions: 50 training epochs and an expanded KFR4 region. The results showed MPE values of 0.1066 for FKS and 0.1000 for PKS, indicating that the model maintains strong defensive capabilities even under broader feature modifications and extended training iterations.

OPEN IN VIEWER

Figure 11.

Increase attack in Bi-LSTM-MA under PKS and FKS.

To further analyze the effect of model distillation and differences in attack resistance on input tampering, Equation 8 was applied to calculate the Input Feature Differences (IFD) between the original and tampered inputs within the KFR, where x ^t represents the features tampered by CGTA, x⁰ represents the original input features, c represents the index of the identified KFR features, and o represents the time step. Setting the attack region to KFR2 with β = 0, the IFD in increase attack is shown in Figure 12. In TsLeNet, the IFD under FKS consistently exceeds that under PKS across all training epochs. This indicates that the magnitude of feature tampering is smaller in PKS than in FKS, aligning with the consensus that larger perturbations yield more significant attack effects. Notably, while Bi-LSTM-MA exhibits a higher MPE under FKS compared to PKS (as shown in Figure 11), its IFD under PKS is markedly higher than under FKS. This counterintuitive result is primarily attributed to the architecture of the student model used in this study, which is based on LSTM and lacks attack resistance modules such as MHA. Therefore, when applying CGTA to the student model, the input features undergo more extensive tampering. However, since the risk prediction mapping knowledge acquired by the student model is less comprehensive and differs from that of the teacher model, the adversarial perturbations optimized by the student model do not fully translate their effect to the actually deployed teacher model. The RMSE of the Bi-LSTM-MA student model reached 0.0152, which is 2.01% higher than the teacher model’s 0.0149.

IFD = 1 co ∑ i = 1 c ∑ j = 1 o ( x i , j t − x i , j 0 ) 2

(8)

The aforementioned results indicate that TsLeNet exhibits higher MPE than Bi-LSTM-MA under both FKS and PKS increase attacks, and its prediction accuracy and IFD are higher than those of Bi-LSTM-MA. These findings reveal that substantial input optimization targeting high-precision models is pivotal for achieving attack objectives.

OPEN IN VIEWER

Figure 12.

Input feature differences (IFD) under increase attack.

Generalization of CGTA

To further validate the generalization performance of the CGTA framework, attack experiments were conducted on the Argoverse 2 data set and the time headway (THW) rear-end collision risk metric. First, the Argoverse 2 data set is widely adopted in autonomous driving research. Its motion forecasting subset consists of 250,000 scenarios, each approximately 11 s duration with a recording frequency of 10 Hz ( 55 ). Zhou et al. extracted car-following samples from this data set and made the experimental data publicly available ( 56 ) (https://github.com/CATS-Lab/Filed-Experiment-Data-ULTra-AV). Following the data processing pipeline established by Li et al. ( 51 ), Kalman filtering was applied to the velocity data and wavelet denoising to the acceleration data provided by Zhou et al., and subsequently aggregated the data to 5 Hz. After filtering for scenarios with durations less than 10 s that satisfied the aforementioned acceleration and jerk constraints, 6,925 car-following samples were identified. Second, the THW is widely used as a rear-end collision risk metric in practice ( 57 ). The calculation of THW is shown in Equation 10, where D _n represents the car-following distance and V _n represents the velocity of the following vehicle. Referring to the defined rear-end collision risk prediction modeling paradigm, the SM in the original inputs and outputs was replaced with the THW.

THW ( t ) = D n ( t ) V n ( t )

(10)

The increase attack results for TsLeNet and Bi-LSTM-MA on the Lyft Level-5 and Argoverse 2 data sets are shown in Figure 14. The CGTA demonstrates targeted attack efficacy in THW prediction on both data sets, especially in RPC1 and RPC3 without β constraints. In these scenarios, the MPE distribution of attacked samples deviates significantly from the original samples and remains predominantly positive. The Kolmogorov–Smirnov (K–S) test was applied to quantify the divergence between the MPE distributions of attacked and original samples. The differences in MPE distribution were significant across all models and PCRs. Except for the RPC2 and RPC4 of Bi-LSTM-MA on Argoverse 2, all K–S tests’D values were greater than 0.1. Therefore, it can be statistically determined that CGTA can achieve the target attack effect and validate its generalization capability.

OPEN IN VIEWER

Figure 14.

Attack effectiveness of THW prediction on different datasets: (a) TsLeNet in Lyft Level-5; (b) Bi-LSTM-MA in Lyft Level-5; (c) TsLeNet in Argoverse 2; and (d) Bi-LSTM-MA in Argoverse 2.

The attack’s efficacy on Argoverse 2 significantly surpasses that on Lyft Level-5, and the analysis of predictions on original inputs reveals substantially higher prediction errors on Argoverse 2 than on Lyft Level-5. The TsLeNet achieves RMSE values of 0.1042 and 0.3496 on Lyft Level-5 and Argoverse 2, respectively, while Bi-LSTM-MA yields 0.1168 and 0.4168. These discrepancies primarily stem from differences in scene heterogeneity and data quality between the data sets.

Of note, the SOD of the preceding vehicle acceleration is higher than that of the following vehicle. This is mainly because all the following vehicles in this study are AVs, and their motion data is derived from internal system logs. In contrast, the acquisition of preceding vehicle data relies on perception algorithms, and the perception accuracy is susceptible to complex factors such as environmental conditions and algorithm stability. The discrepancy in data acquisition naturally leads to greater perturbation in the motion information of preceding vehicles than of following vehicles.

SOD = 1 n − 2 ∑ i = 2 n − 1 ( x i + 1 − 2 x i + x i − 1 ) 2

(11)

Mitigation Strategies for CGTA

Analysis of the attack process and experimental results suggests three main mitigation strategies against cyberattacks: (1) incorporate global feature fusion mechanisms in models. While MHA implementation shows a slight effect on prediction precision under non-attack conditions, it significantly reduces the MPE compared with CGTA. Therefore, integrating global attention mechanisms such as MHA at appropriate positions during the design of the prediction model can enhance the model’s inherent robustness against attacks; (2) strengthen privacy protection for models and input variables information. Although the distillation-based optimization strategy achieves the attack direction, the overall attack effect remains substantially inferior to FKS. Concurrently, verifying the physical relationships among input variables may effectively detect attacks. Without understanding variable semantics, attackers cannot maintain physical consistency between tampered inputs; and (3) monitor time elapsed from perception data generation to model input. Although previous analyses confirm CGTA’s timeliness, its input optimization inherently requires repeated prediction model calls, and increasing the number of training epochs also extends perception-to-input latency.