SaFeR: Safety-Critical Scenario Generation for Autonomous Driving Test via Feasibility-Constrained Token Resampling

Jinlong Cui; Fenghua Liang; Guo Yang; Chengcheng Tang; Jianxun Cui

cs.ROMar 4, 2026

SaFeR: Safety-Critical Scenario Generation for Autonomous Driving Test via Feasibility-Constrained Token Resampling

Authors: Jinlong Cui, Fenghua Liang, Guo Yang, Chengcheng Tang, Jianxun Cui

Organizations: the School of Traffic and Transportation, Harbin Institute of Technology, Harbin, China and Chongqing Research Institute of HIT, Chongqing, China · the Chongqing Changan Automobile Company Ltd, Chongqing, China

Abstract

Safety-critical scenario generation is crucial for evaluating autonomous driving systems. However, existing approaches often struggle to balance three conflicting objectives: adversarial criticality, physical feasibility, and behavioral realism. To bridge this gap, we propose SaFeR: safety-critical scenario generation for autonomous driving test via feasibility-constrained token resampling. We first formulate traffic generation as a discrete next token prediction problem, employing a Transformer-based model as a realism prior to capture naturalistic driving distributions. To capture complex interactions while effectively mitigating attention noise, we propose a novel differential attention mechanism within the realism prior. Building on this prior, SaFeR implements a novel resampling strategy that induces adversarial behaviors within a high-probability trust region to maintain naturalism, while enforcing a feasibility constraint derived from the Largest Feasible Region (LFR). By approximating the LFR via offline reinforcement learning, SaFeR effectively prevents the generation of theoretically inevitable collisions. Closed-loop experiments on the Waymo Open Motion Dataset and nuPlan demonstrate that SaFeR significantly outperforms state-of-the-art baselines, achieving a higher solution rate and superior kinematic realism while maintaining strong adversarial effectiveness.

Figures & tables

Fig. 1: Overview of SaFeR. The strategy resamples adversarial tokens from distributions generated by realism prior, constrained by the Largest Feasible Region.

Fig. 2: Pipeline of SaFeR. The pipeline consists of two core components: (I) Realism Prior Modeling utilizes a Transformer-based NTP model to learn naturalistic motion distributions via motion tokenization and differential attention. (II) Safety-Critical Token Resampling synthesizes the scenario by optimizing for adversarial criticality within a realistic Trust Region, enforced by the Largest Feasible Region constraint to enhance feasibility.

Scenario Generation Model
Parameter	Symbol	Value
Attention layers	$L$	3
Attention Heads	$H$	8
Feasibility Value Network
Discount Factor	$\gamma$	0.99
Expectile Parameter	$\tau$	0.8

TABLE I: Hyperparameter Settings

Dataset	Method	Real. $\uparrow$	Kin. $\uparrow$	Inter. $\uparrow$	Map. $\uparrow$
WOMD	Diffusion [ 20 ]	0.7644	0.4771	0.8135	0.8653
	QCNet [ 3 ]	0.7013	0.4298	0.7150	0.8387
	GUMP [ 22 ]	0.7446	0.4737	0.7791	0.8551
	SMART [ 19 ]	0.7595	0.4749	0.8039	0.8652
	SaFeR(ours)	0.7730	0.4798	0.8254	0.8731
nuPlan	Diffusion [ 20 ]	0.6597	0.4151	0.7417	0.6939

TABLE II: General Scenario Quantitative results on WOMD and nuPlan.

Fig. 3: Visualization of the learned LFR of ego vehicle. The red area depicts the Infeasible Region ( $V_{h}^{*}>0$ ), representing the set of spatial configurations for the critical background vehicle that lead to unavoidable collisions given the specified velocity vectors. The green area denotes the Largest Feasible Region (LFR) ( $V_{h}^{*}\leq 0$ ), where a feasible evasion policy theoretically exists for the ego vehicle.

Fig. 4: Qualitative comparison between the raw scenario and safety-critical scenario generated by SaFeR. The critical background vehicle is controlled by SaFeR, while the ego vehicle is controlled by DiffusionPlanner [ 20 ] .

Dataset	Method	CR $\uparrow$	SR $\uparrow$	VJ $\downarrow$	AJ $\downarrow$
WOMD	ReGentS [ 8 ]	0.733	0.510	0.259	0.614
	FREA [ 15 ]	0.536	0.719	0.213	0.566
	SAFE-SIM [ 10 ]	0.616	0.549	0.197	0.508
	ADV-BMT [ 11 ]	0.915	0.324	0.251	0.603
	SaFeR(ours)	0.761	0.865	0.161	0.499
nuPlan	ReGentS [ 8 ]	0.617	0.534	0.291	0.627

TABLE III: Quantitative comparison of safety-critical scenario generation performance. Results are the average of 10 runs with varied seeds.

Setting	MDA	LFR	CR $\uparrow$	SR $\uparrow$	VJ $\downarrow$	AJ $\downarrow$
w/o MDA	-	✓	0.793	0.720	0.205	0.519
w/o LFR	✓	-	0.827	0.527	0.187	0.501
SaFeR	✓	✓	0.761	0.865	0.161	0.499

TABLE IV: Ablation Study on the Multi-Head Differential Attention(MDA) and Largest Feasible Region(LFR). All experiments are based on the WOMD dataset.

Fig. 5: The mean of Feasible Value Network $V_{h}$ during the training with multiple combinations of penalty constant $M$ and safety distance threshold $d_{th}$ .

Trust Region ( $n$ )	CR ( $\uparrow$ )	SR ( $\uparrow$ )	VJ ( $\downarrow$ )	AJ ( $\downarrow$ )
10	0.203	0.901	0.153	0.471
20 ∗	0.761	0.865	0.161	0.499
50	0.794	0.817	0.495	0.630
100	0.805	0.801	0.517	0.796

TABLE V: Ablation study on the Trust Region size (

n

). The setting used in our final method is marked with *.

Differential Attention

See all 10 papers

RiskFlow: Fast and Faithful Safety-Critical Traffic Scenario Generation
Jun 4, 2026Qi Lan, Yining Tang, Yu Shen +4Flow Matching Autonomous Driving Safety Evaluation
College of Mechanical and Vehicle Engineering Chongqing University, Chongqing, China
PCASim: Promptable Closed-loop Adversarial Simulation for Urban Traffic Environment
May 15, 2026Chuancheng Zhang, Zhenhao Wang, Kaizheng Li +3Autonomous Driving Safety Evaluation Synthetic Data Generation
Shenzhen Research Institute of Shandong University, Shenzhen, 518057, Guangdong, China · School of Airspace Science and Engineering, Shandong University, 264209 Weihai, China. · School of Computer Science and Technology, Shandong University of Finance and Economics, 250014, Jinan, China.
ScenePilot: Controllable Boundary-Driven Critical Scenario Generation for Autonomous Driving
May 20, 2026Qiyu Ruan, Yuxuan Wang, He Li +2Autonomous Driving Safety Evaluation Adversarial Scenario Generation
State Key Laboratory of Internet of Things for Smart City (SKL-IOTSC), University of Macau, Macau, China · Faculty of Science and Technology, University of Macau, Macau, China

Jun 4, 2026J/K move · Enter open · S save

RiskFlow: Fast and Faithful Safety-Critical Traffic Scenario Generation

Qi Lan, Yining Tang, Yu Shen, Yi Zhou+3

College of Mechanical and Vehicle Engineering Chongqing University, Chongqing, China

Flow Matching Autonomous Driving Safety Evaluation Generative Modeling Autonomous Driving Simulation Autonomous Driving Scenario Generation

Open paper AskPDF arXiv

Safety-critical traffic scenario generation is essential for evaluating autonomous driving systems under rare but high-risk interactions. Existing diffusion-based methods offer strong controllability in closed-loop generation, but their iterative denoising process is computationally expensive and may accumulate sampling and guidance errors over long rollouts, causing unrealistic motion artifacts such as jitter, abnormal acceleration, and off-road behavior. To address these issues, we propose RiskFlow, a closed-loop safety-critical multi-agent traffic generation framework that formulates future trajectory generation as transport in the action space. Instead of relying on iterative denoising, RiskFlow learns an average velocity field over a finite interval to transform Gaussian action sequences into future acceleration and yaw-rate commands with a single forward pass, using a JVP-based objective for efficient and stable training. At test time, RiskFlow applies output-space guidance to the generated actions, steering selected critical agents toward risky interactions while regularizing off-road behavior, and reconstructs physically feasible trajectories through vehicle dynamics. Experiments on nuScenes with tbsim closed-loop evaluation show that RiskFlow achieves a strong adversariality-realism trade-off across multi-agent and long-horizon settings. Compared with representative baselines, RiskFlow consistently improves realism while maintaining competitive safety-critical generation capability, and substantially reduces inference time for evaluation.

Abstract

Differential Attention

Explore similar work

RiskFlow: Fast and Faithful Safety-Critical Traffic Scenario Generation

PCASim: Promptable Closed-loop Adversarial Simulation for Urban Traffic Environment

ScenePilot: Controllable Boundary-Driven Critical Scenario Generation for Autonomous Driving