DTP-Attack: A decision-based black-box adversarial attack on trajectory prediction

TL;DR

This paper introduces DTP-Attack, a practical decision-based black-box adversarial attack method for trajectory prediction systems that does not require model internals, demonstrating significant vulnerabilities in autonomous vehicle safety models.

Contribution

The paper presents a novel boundary walking algorithm enabling black-box attacks on trajectory prediction without gradient access, supporting both intention misclassification and prediction degradation.

Findings

Achieves 41-81% success rate in intention misclassification with perturbations below 0.45 m.

Increases prediction errors by 1.9-4.2 times for degradation tasks.

Outperforms existing black-box attack methods across multiple datasets and models.

Abstract

Trajectory prediction systems are critical for autonomous vehicle safety, yet remain vulnerable to adversarial attacks that can cause catastrophic traffic behavior misinterpretations. Existing attack methods require white-box access with gradient information and rely on rigid physical constraints, limiting real-world applicability. We propose DTP-Attack, a decision-based black-box adversarial attack framework tailored for trajectory prediction systems. Our method operates exclusively on binary decision outputs without requiring model internals or gradients, making it practical for real-world scenarios. DTP-Attack employs a novel boundary walking algorithm that navigates adversarial regions without fixed constraints, naturally maintaining trajectory realism through proximity preservation. Unlike existing approaches, our method supports both intention misclassification attacks and prediction accuracy degradation. Extensive evaluation on nuScenes and Apolloscape datasets across state-of-the-art models including Trajectron++ and Grip++ demonstrates superior performance. DTP-Attack achieves 41 - 81% attack success rates for intention misclassification attacks that manipulate perceived driving maneuvers with perturbations below 0.45 m, and increases prediction errors by 1.9 - 4.2 for accuracy degradation. Our method consistently outperforms existing black-box approaches while maintaining high controllability and reliability across diverse scenarios. These results reveal fundamental vulnerabilities in current trajectory prediction systems, highlighting urgent needs for robust defenses in safety-critical autonomous driving applications.