Evaluating randomized smoothing as a defense against adversarial attacks in trajectory prediction

Julian F. Schumann; Eduardo Figueiredo; Frederik Baymler Mathiesen; Luca Laurenti; Jens Kober; Arkady Zgonnikov

cs.LGMar 11, 2026

Evaluating randomized smoothing as a defense against adversarial attacks in trajectory prediction

Authors: Julian F. Schumann, Eduardo Figueiredo, Frederik Baymler Mathiesen, Luca Laurenti, Jens Kober, Arkady Zgonnikov

Organizations: Department of Cognitive Robotics, TU Delft, Delft, Netherlands · Delft Center for Systems and Control, TU Delft, Delft, Netherlands

Abstract

Accurate and robust trajectory prediction is essential for safe and efficient autonomous driving, yet recent work has shown that even state-of-the-art prediction models are highly vulnerable to inputs being mildly perturbed by adversarial attacks. Although model vulnerabilities to such attacks have been studied, work on effective countermeasures remains limited. In this work, we develop and evaluate a new defense mechanism for trajectory prediction models based on randomized smoothing -- an approach previously applied successfully in other domains. We evaluate its ability to improve model robustness through a series of experiments that test different strategies of randomized smoothing. We show that our approach can consistently improve prediction robustness of multiple base trajectory prediction models in various datasets without compromising accuracy in non-adversarial settings. Our results demonstrate that randomized smoothing offers a simple and computationally inexpensive technique for mitigating adversarial attacks in trajectory prediction.

Figures & tables

Fig. 1: An overview of randomized smoothing applied to trajectory prediction. a) In a benign scenario, it can be expected that a well-trained trajectory prediction model

\mathds{P}

can make predictions which align with the ground truth. b) However, if the target agent, for which predictions are made, uses an adversarial attack, the prediction quality can deteriorate even in state-of-the-art models [ 36 , 35 ] . c) Randomized smoothing can be used to overcome this issue. Instead of the actual past observations of the adversarial agent, the model is applied to multiple randomly perturbed versions of these observations. The final prediction is then built by averaging those separate model predictions.

Smoothing approach			$d_{\max}$ [ $m$ ]
Applied	Goal	$\sigma$ [ $m$ ]	(0.0)	0.25	0.5	1.0
No Smoothing		(0.0)	0.473	0.663	0.844	2.057
eval	pos ( 5 )	0.25	0.471	0.637	0.833	2.020
		0.5	0.546	0.761	0.902	2.063
		1.0	0.676	0.850	1.015	2.123
	ctrl ( 7 )	0.25	0.637	0.749	0.762	2.563

TABLE I: Average displacement error (in meters

m

) on L-GAP for Trajectron++ . The bold values shows the best result in each column.

Smoothing approach			$d_{\max}$ [ $m$ ]
Applied	Goal	$\sigma$ [ $m$ ]	(0.0)	0.25	0.5	1.0
No Smoothing		(0.0)	1.169	1.867	2.262	2.952
eval	pos ( 5 )	0.25	1.420	1.617	1.958	2.723
		0.5	1.937	1.901	2.005	2.532
		1.0	6.576	6.210	5.996	5.716
	ctrl ( 7 )	0.25	1.164	1.509	1.558	1.428

TABLE II: Average displacement error (in meters

m

) on L-GAP for ADAPT . The bold values shows the best result in each column.

Smoothing approach			$d_{\max}$ [ $m$ ]
Applied	Goal	$\sigma$ [ $m$ ]	(0.0)	0.25	0.5	1.0
No Smoothing		(0.0)	0.116	4.989	5.562	6.335
eval	pos ( 5 )	0.25	0.341	1.405	1.610	2.708
		0.5	0.520	1.430	1.697	2.708
		1.0	0.614	1.467	1.872	2.766
	ctrl ( 7 )	0.25	0.533	2.822	3.025	4.880

TABLE III: Average displacement error (in meters

m

) on rounD for Trajectron++ . The bold values shows the best result in each column.

Smoothing approach			$d_{\max}$ [ $m$ ]
Applied	Goal	$\sigma$ [ $m$ ]	(0.0)	0.25	0.5	1.0
No Smoothing		(0.0)	0.537	0.655	0.654	0.747
eval	pos ( 5 )	0.25	1.504	1.582	1.563	1.644
		0.5	2.308	2.343	2.347	2.383
		1.0	3.541	3.554	3.563	3.565
	ctrl ( 7 )	0.25	0.494	0.541	0.552	0.569

TABLE IV: Average displacement error (in meters

m

) on rounD for ADAPT . The bold values shows the best result in each column.

Probabilistic Trajectory Prediction

See all 17 papers

TrajRS: Towards Certified Robustness in Pedestrian Trajectory Prediction
Jun 27, 2026Liang Zhang, Gaojie Jin, Yao Shi +4Randomized Smoothing Pedestrian Trajectory Prediction
Key Laboratory of System Software (Chinese Academy of Sciences) and State Key Laboratory of Computer Science, Institute of Software, Chinese Academy of Sciences, China · University of Chinese Academy of Sciences, China · Hangzhou Institute for Advanced Study, UCAS, China +1
DTP-Attack: A decision-based black-box adversarial attack on trajectory prediction
Mar 27, 2026Jiaxiang Li, Jun Yan, Daniel Watzenig +1Black-Box Adversarial Attacks Adversarial Robustness
College of Electronics and Information Engineering, Tongji University, Shanghai 201804, China. · Graz University of Technology and the Virtual Vehicle Research, Graz 8010, Austria.
Clustered Randomized Smoothing for Stochastic Prediction Functions
Aug 12, 2026Eduardo Figueiredo, Frederik Mathiesen, Julian Schumann +3Multimodal Robustness Randomized Smoothing
Delft Center for Systems and Control, Delft University of Technology · Cognitive Robotics, Delft University of Technology · University of Stuttgart +1

Jun 27, 2026J/K move · Enter open · S save

TrajRS: Towards Certified Robustness in Pedestrian Trajectory Prediction

Liang Zhang, Gaojie Jin, Yao Shi, Quanzhi Li+3

Key Laboratory of System Software (Chinese Academy of Sciences) and State Key Laboratory of Computer Science, Institute of Software, Chinese Academy of Sciences, China · University of Chinese Academy of Sciences, China · Hangzhou Institute for Advanced Study, UCAS, China+1

Randomized Smoothing Pedestrian Trajectory Prediction Adversarial Robustness Certified Robustness Trajectory Prediction

Open paper AskPDF arXiv

The robustness of trajectory prediction models is crucial for developing safe autonomous driving systems. Adversarial attacks on trajectory prediction can significantly impair the accuracy of predicted trajectories, leading to hazardous driving behaviors. While heuristic defense strategies have been implemented to enhance the robustness of trajectory prediction models, these measures often fail against more sophisticated, targeted adversarial attacks. Hence, there is a pressing need to establish verifiable safety assurances for trajectory prediction models. In this paper, we extend the traditional Randomized Smoothing framework to "TrajRS", which provides a certified robust radius for smoothed trajectory predictors. We clarify and expand the formal definitions of robustness in trajectory prediction and tailor the practical TrajRS scheme specifically to "robustness for the optimal prediction" and "robustness for all possible predictions". An extensive set of experiments demonstrates that TrajRS effectively achieves robustness certification for all smoothed pedestrian trajectory predictors in this work.

Abstract

Probabilistic Trajectory Prediction

Explore similar work

TrajRS: Towards Certified Robustness in Pedestrian Trajectory Prediction

DTP-Attack: A decision-based black-box adversarial attack on trajectory prediction

Clustered Randomized Smoothing for Stochastic Prediction Functions