When Does Corruption Break the Plan? A Degradation-Tolerance Benchmark for Camera-Only End-to-End Driving

Haohua Que; Handong Yao

cs.ROAug 29, 2026

When Does Corruption Break the Plan? A Degradation-Tolerance Benchmark for Camera-Only End-to-End Driving

Authors: Haohua Que, Handong Yao

Organizations: College of Engineering, University of Georgia, Athens, Georgia, USA

Abstract

Camera-only end-to-end (E2E) driving models are nearing deployment, where the camera stream is degraded by blur, noise, low light, weather, frame loss, and memory faults. How much a policy tolerates before its driving breaks is unclear. Corruption-robustness benchmarks target detection or bird's-eye-view perception, not the planning output that drives the car. We present DriveDegrade, a benchmark for image-degradation tolerance in camera-only E2E driving. Sixteen corruption families at five severities are injected on the fly inside the image loader, one operator reaching fifteen policies, and we evaluate open-loop planning on nuScenes and NAVSIM plus a CARLA closed-loop anchor. First, mild degradation barely affects planning, and the families that break it have a clear threshold at mid severity. Second, fragility is corruption-dependent: blur, JPEG, and raindrop damage planning most, while weather and bit error are tolerated far into the range. Third, a flat curve is ambiguous, so we separate corruptions that degrade the image from those that remove it. A planner that reads its camera must lose accuracy when information is deleted, whatever it does under quality loss. On these two axes the planners separate sharply, quantifying the ego-status shortcut without mistaking indifference for robustness. A released vision-language-action planner is flat on both axes, and blinding all six of its cameras costs it only 11.5 percent.

Figures & tables

Figure 1: DriveDegrade overview. Surround-view camera streams are degraded on the fly inside the image loader over a five-level severity ladder. Six camera-input E2E planners are evaluated at the planning level, then summarized through tolerance curves, a vision-reliance diagnostic separating quality degradation from information removal, and safety/system metrics. The band beneath lists the nine further policies the identical injector reaches under their own protocols. All sixteen corruption families are specified in Appendix B .

benchmark	eval. level	img. corr.	policies	quality vs. removal
ImageNet-C [ 19 ]	class.	yes	–	no
Dong et al. [ 11 ]	3D det.	yes	–	no
RoboBEV [ 76 ]	BEV perc.	yes	–	no
Robo3D [ 33 ]	3D det./seg.	LiDAR	–	no
RoboDrive [ 34 ]	BEV/occ./depth	yes	–	no
Bench2Drive [ 26 ]	plan. (CL)	no	many	no

Table 1: DriveDegrade versus existing robustness and evaluation benchmarks. Perception benchmarks stop at perception; planning benchmarks do not corrupt the image. RobustE2E [ 29 ] and Bench2Drive-Robust [ 83 ] evaluate planning under perturbation and both report graded severities; Sec. 2 states their scope. eval. level is the scored output (BEV, bird’s-eye view; OL, open loop; CL, closed loop). img. corr. is whether the image itself is degraded (adv., adversarial; sys., system-level; partial, only some corruptions act on the image). policies counts evaluated E2E policies, “many” where a benchmark hosts an open leaderboard. Ours are six nuScenes planners, a world model, a vision-language-action (VLA) planner, five NAVSIM policies, and two CARLA agents; a camera+LiDAR reference and an image-blind floor are uncounted controls. quality vs. removal is whether a benchmark separates quality degradation from information removal (Sec. 4.2 ).

Figure 2: Per-corruption image-degradation tolerance. (A) The sixteen families on one nuScenes front-camera frame at S4, clean for reference; the bottom row is the four driving-specific families (Sec. 4.5 ). Frame dropout has no single-frame rendering. (B) L2-retention curves for all six planners, ordered by UniAD fragility. (C) S5 retention for every corruption and planner. Blur, JPEG, and noise damage planning most; weather and bit-error are tolerated. OpenDriveVLA (squares) sits in $[0.909,0.989]$ on all sixteen.

graded image degradation
corruption	UniAD	DiffDr	SpDrv	GenAD
motion blur	2.19	3.10	3.66	4.79
gaussian blur	2.47	3.96	4.09	$>$ 5
gaussian noise	3.38	3.69	4.29	3.65
jpeg	3.72	4.35	4.38	$>$ 5
downscale	3.64	$>$ 5	$>$ 5	$>$ 5

Table 2: Tolerance thresholds

s^{*}_{10}

on full nuScenes val: the severity at which L2 retention first falls below

0.90

, linearly interpolated (higher is more tolerant). “

>

5” means retention stays above

0.90

through S5, and bold marks the planner that breaks first on each row. VAD and LAW cross no threshold on any family, and fog and bit error break no planner, so those two columns and two rows are omitted. Thresholds mostly rise from left to right, in order of decreasing camera reliance, the ordering that Sec. 4.2 explains.

Figure 3: Mean L2 retention vs. severity. The slope indexes camera reliance: the full-stack and diffusion planners fall fastest, the vectorized and latent-world-model planners stay flat, an insensitivity to image quality that Table 3 separates from disregard of the camera. The six solid curves average the twelve core corruptions; OpenDriveVLA (dashed) has full ladders for four of them, and the ego-only MLP (dotted) is $1.000$ everywhere by construction. On those four families the six planners run $0.625$ to $0.980$ at S5, so OpenDriveVLA’s $0.932$ sits between VAD and LAW.

	clean	S5 retention $\uparrow$
model	L2 (m) $\downarrow$	mean	qual.	black.	drop.	gap
UniAD [ 23 ]	0.94	0.75	0.739	0.680	0.801	0.059
DiffusionDrive [ 43 ]	1.07	0.78	0.777	0.505	0.933	0.271
SparseDrive [ 67 ]	0.61	0.84	0.831	0.645	0.955	0.186
GenAD [ 84 ]	0.91	0.91	0.915	0.752	0.948	0.163
VAD [ 28 ]	0.97	0.97	0.969	0.923	0.999	0.047

Table 3: Vision reliance on two axes. S5 L2 retention under corruptions that degrade the image versus those that remove it. A planner ignoring its camera would sit at

1.00

in both columns; none of the six does. VAD and LAW are quality-immune yet still lose accuracy when a camera is removed, so their flat curves measure insensitivity to quality, not blindness. The VLA is the only entry with a negative gap. “gap” is quality minus blackout retention; bold marks the largest gap and the largest loss under blackout.

Figure 4: Cross-method qualitative. One nuScenes scene’s planned ego trajectory for five planners (rows) under the six most disruptive families at S5 (columns, ordered by UniAD’s endpoint shift): clean (solid) vs. corrupted (dashed), with the 3 s endpoint shift in meters. Drift scales with camera reliance: UniAD and SparseDrive swing widely under blur, noise, and JPEG while VAD stays almost straight. LAW is omitted because its stored outputs are aggregate metrics, not trajectory points.

Figure 5: Image evidence versus plan stability (UniAD, one scene). Each cell pairs the front camera with UniAD’s planned trajectory under one S5 corruption: clean, the three families that break the plan, and two that are tolerated. Blackout removes the image entirely yet the plan bends less than under blur, which is the asymmetry Sec. 4.2 measures. The full twelve-corruption montage with all six surround views is in Appendix I .

Figure 6: Comfort, VRU collision, and energy across planners. (A) Comfort: jerk relative to each planner’s clean baseline, mean over the twelve corruptions. UniAD degrades most ( $\sim$ $1.4\times$ at S5) while VAD barely changes, mirroring the L2 spectrum. Absolute jerk is not comparable across planners, so (A) is normalized per planner. (B) VRU collision rate: small ( $\sim$ $0.02$ – $0.25\%$ ) and roughly flat, a rare-event metric. (C) Energy proxy (bit-1 density) vs. S5 retention by corruption group (UniAD). “cl” = clean.

	EPDMS, navhard		PDMS, navtest
condition	ZTRS	GTRS	RAP	iPad	DrivoR	TF
clean (abs., $\times$ 100)	45.5	42.9	93.8	91.8	93.7	83.4
gauss. blur S3	0.958	1.002	1.000	0.990	0.998	0.994
gauss. blur S5	0.882	0.939	0.998	0.947	0.961	0.956
motion blur S3	0.943	0.963	1.001	0.990	0.986	0.991
motion blur S5	0.927	0.903	0.998	0.961	0.962	0.965

Table 4: NAVSIM under degradation , six policies and nine cells each: ZTRS [ 41 ] , GTRS-Aug [ 42 ] , RAP [ 14 ] , iPad [ 18 ] , DrivoR [ 32 ] , and TransFuser (TF) [ 8 ] . The clean row is the absolute score

\times 100

; the rest are retention (corrupted / clean, higher is better). ZTRS and GTRS score EPDMS on navhard_two_stage , the other four PDMS on navtest , so absolute values are not comparable across the rule. TF fuses camera with LiDAR; DrivoR is camera-only on DINOv2 ViT-S. Blackout S3 darkens the three rear cameras and is a null control. Bold: front-camera blackout costs every planner except TF between a quarter and two thirds of its score. Sub-scores are in Appendix D .

	SimLingo			TCP
condition	Town10	Town03	Town05	Town05
clean	100.0	92.5	90.0	68.8
gaussian blur S3	100.0	92.5	95.0	68.7
gaussian blur S5	90.2	72.0	85.0	55.1
motion blur S3	96.4	96.2	95.0	71.7
motion blur S5	94.7	92.5	87.0	68.2

Table 5: CARLA closed-loop Driving Score (DS) , higher is better. Top: the seven-cell slice on three towns for SimLingo [ 56 ] and, last column, TCP [ 75 ] on Town05. Bottom: SimLingo on the remaining Town10 corruptions and on the contamination families on Town03, as S3 / S5. Blackout S3 is the null control of Sec. 4.8 : SimLingo’s does not move, TCP’s moves four of twelve runs. DS conditions on completed scored runs; bold marks the front-camera blackout collapse.

Figure 7: CARLA closed-loop evidence and run status. (A) Complete-case DS on Town10; bands are $\pm 1$ std over scored runs. (B) Route-148 traces: solid blue is scored degradation, dashed orange incomplete, magenta incomplete blackout S5. The snow-S5 loop is excluded from the DS mean, which the identification bounds account for.

Appendix figures & tables5 assets

Supplementary material from the paper’s appendix.

Appendix

family	parameter	S1	S2	S3	S4	S5
gaussian blur	defocus $\sigma$ (px)	0.5	1	2	4	7
motion blur	kernel length (px)	3	7	11	17	25
gaussian noise	noise $\sigma$ (8-bit)	5	12	25	45	80
JPEG	encoder quality	50	30	20	12	6
color quant.	bits/channel	6	5	4	3	2
downscale	resize factor	0.75	0.5	0.33	0.25	0.15

Appendix

Table 6: Corruption specification. Each family is defined by one physical parameter whose value the severity ladder S1–S5 lists directly, so an ordinal threshold always reads back as a physical quantity. Endpoints follow one rule, fixed before any model was run: S1 is a condition a deployed camera meets routinely, S5 is where a human would call the view unusable, bracketing the knee rather than centering the ladder on it. Snow and camera blackout have no natural scalar: snow is an ordinal over an internal parameter set, and blackout ramps over camera identity (S5 = front camera). The first twelve families are the core set; the last four are the driving-specific additions. Emitted from the released injector by analysis/emit_spec_table.py .

graded image degradation
corruption	UniAD [ 23 ]	DiffDr	SpDrv	GenAD [ 84 ]
motion blur	3.80	4.08	4.83	$>$ 5
gaussian blur	3.36	4.31	4.48	$>$ 5
gaussian noise	4.57	$>$ 5	$>$ 5	$>$ 5
jpeg	4.54	$>$ 5	$>$ 5	$>$ 5
downscale	4.94	$>$ 5	$>$ 5	$>$ 5

Appendix

Table 7: Stricter tolerance thresholds

s^{*}_{25}

on full nuScenes val, linearly interpolated (higher is more tolerant). “

>

5” means retention stays above

0.75

through S5, and bold marks the planner that breaks first on each row. VAD and LAW cross no

s^{*}_{25}

threshold, and frame dropout, snow, low light, fog, bit error, and lens dirt break no planner at this level, so those columns and rows are omitted. DiffDr = DiffusionDrive [ 43 ] , SpDrv = SparseDrive [ 67 ] .

TransFuser (camera+LiDAR)
condition	PDMS	ret.	NC	DAC	TTC	EP
clean	0.834	1.000	0.978	0.921	0.928	0.786
jpeg S5	0.807	0.968	0.968	0.906	0.903	0.766
motion blur S5	0.805	0.965	0.968	0.911	0.905	0.755
gaussian blur S5	0.797	0.956	0.966	0.905	0.905	0.741
blackout S3 (rear)	0.834	1.000	0.978	0.921	0.928	0.786

Appendix

Table 8: PDMS sub-scores under degradation (NAVSIM navtest ,

12{,}146

12{,}147

scenes per cell), for TransFuser [ 8 ] , which fuses camera with LiDAR, and DrivoR [ 32 ] , camera-only on a DINOv2 ViT-S backbone. NC = no collision, DAC = drivable-area compliance, TTC = time-to-collision, EP = ego progress; all higher is better. Degradation lowers PDMS and every safety sub-score, so the effect is not an artifact of imitation L2.

corruption	S3	S5
gaussian blur	1.011	0.509
jpeg	0.841	0.373
motion blur	0.618	0.372
mud splash	0.881	0.457
lens dirt	0.634	0.578
occlusion	0.618	0.448

Appendix

Table 9: Epona, an autoregressive world model, on the same ladder (retention at

1

s, its native horizon;

150

scenes per cell). It shows the camera-reliant profile and reproduces the raindrop finding independently: raindrop is its most damaging family at both severities, worse at S3 than gaussian blur is at S5. Epona conditions on a single front camera, so blackout S3 darkens nothing it reads and its

1.000

is a protocol artifact rather than tolerance.

Figure 8: UniAD cross-corruption qualitative comparison on one nuScenes scene. Six surround-view images and the planned ego trajectory under each S5 corruption, clean for reference.

Autonomous Driving Benchmarks

Autonomous driving benchmarks evaluate how well vehicles perceive, predict, plan, and act safely across varied roads and conditions.

See all 141 papers

Bench2Drive-Robust: Benchmarking Closed-Loop Autonomous Driving under Deployment Perturbations
May 18, 2026Zhiyuan Zhang, Zhenghao Jin, Yanlun Peng +8Autonomous Driving Benchmarks End-to-End Autonomous Driving
Sch. of Computer Science & Sch. of Artificial Intelligence, Shanghai Jiao Tong University · Institute of Trustworthy Embodied AI (TEAI), Fudan University · Great Wall Motor +2
DRIVE-C: A Controlled Corruption Dataset for Autonomous Driving
May 10, 2026Shiva AherAutonomous Driving Datasets Autonomous Driving Benchmarks
Georgia Institute of Technology, Georgia, United States
Variance-Guided Spatial Attention Fusion for Robust End-to-End Driving under Asymmetric Sensor Degradation
Aug 25, 2026Weizhi Tao, Zengwang Jin, Xiao Wang +1End-to-End Autonomous Driving Multimodal Robustness
Department of Aeronautical and Aviation Engineering, The Hong Kong Polytechnic University, 999077, Hong Kong, China · School of Robotics, Anhui University, Hefei 230039, China; with the Anhui Provincial Engineering Research Center for Unmanned System and Intelligent Technology, Anhui University, Hefei 230039, China; and also with the Shenzhen Research Institute of Northwestern Polytechnical University, Shenzhen 518057, China · School of Robotics and Institute of Embodied Intelligence, Anhui University, Hefei 230039, China

May 18, 2026J/K move · Enter open · S save

Bench2Drive-Robust: Benchmarking Closed-Loop Autonomous Driving under Deployment Perturbations

Zhiyuan Zhang, Zhenghao Jin, Yanlun Peng, Xianda Guo+7

Sch. of Computer Science & Sch. of Artificial Intelligence, Shanghai Jiao Tong University · Institute of Trustworthy Embodied AI (TEAI), Fudan University · Great Wall Motor+2

Autonomous Driving Benchmarks End-to-End Autonomous Driving Autonomous Driving

Open paper AskPDF arXiv

Robustness is a critical requirement for deploying autonomous driving systems in the real world. Existing robustness benchmarks for autonomous driving have made important progress in studying the effects of image-level corruptions, such as adverse weather or camera degradation, on perception modules and open-loop planning outputs. However, deployment can also involve system-level imperfections, such as inference latency and ego-state estimation errors, which remain less studied in closed-loop E2E-AD evaluation. These imperfections can accumulate through the feedback loop and destabilize control. In this work, we present Bench2Drive-Robust, to our knowledge the first device-centric robustness benchmark for closed-loop end-to-end autonomous driving under realistic deployment perturbations. We systematically evaluate deployment-oriented perturbations arising from three major sources: camera-stream failures (frame drop, partial observation), ego-state estimation errors (GPS noise, and speed or odometry errors), and compute-induced control delay (model inference delay). We evaluate representative end-to-end driving methods and analyze their robustness under different perturbation severities. Our results show that these deployment-related perturbations can substantially degrade closed-loop driving performance, revealing robustness challenges that are not fully captured by conventional image-level corruption evaluations. By establishing a closed-loop evaluation protocol and demonstrating the substantial impact of these deployment-oriented perturbations, Bench2Drive-Robust defines practical robustness problems for end-to-end autonomous driving and encourages further research on deployment-aware robust driving systems.

Abstract

Autonomous Driving Benchmarks

Explore similar work

Bench2Drive-Robust: Benchmarking Closed-Loop Autonomous Driving under Deployment Perturbations

DRIVE-C: A Controlled Corruption Dataset for Autonomous Driving

Variance-Guided Spatial Attention Fusion for Robust End-to-End Driving under Asymmetric Sensor Degradation