WIP: From Detection to Explanation: Using LLMs for Adversarial Scenario Analysis in Vehicles
David Fernandez
Key Contributions & Takeaways
- Proposes a framework that, instead of just flagging that a driving scene is anomalous, uses an LLM to explain why. Each scene is encoded in a compact domain-specific language and reasoned over against the MUTCD traffic-rule book with zero-shot chain-of-thought, using no labeled training data.
- Introduces AutoSec-X, a dataset of 40 MUTCD-grounded driving scenarios, balanced 20 anomalous / 20 benign, each paired with an expert explanation that names the regulation at stake, so a model is graded on its reasoning, not just its yes/no verdict.
- Detection saturates; explanation separates. Across 9 LLMs, several match on the binary call (87.5%+), but only the Gemini family pairs top detection (92.5%) with grounded explanations that cite the exact MUTCD section. Getting the answer right and explaining why turn out to be two different skills.
The deep networks in a self-driving car can flag that a scene looks wrong, but not why, and they cannot tell a harmless sensor glitch from a deliberate roadside attack.
Encode each scene in a compact domain-specific language and let an LLM reason step by step, checking it against the MUTCD traffic rule book. No labeled training data.
Gemini spots inconsistencies with 92.5% accuracy and, unlike the open models, explains each call by citing the exact regulation it breaks.
GPT-4 drafts 40 driving scenarios anchored in the U.S. traffic-control manual, half with a genuine regulatory violation and half fully compliant. Each carries an expert-style ground-truth explanation that names the relevant MUTCD section, so a model is graded not just on the verdict, but on whether it reasons for the right reason.
scenarios
benign, balanced
types & layouts
needed (zero-shot)
Raw sensor data is distilled into eight human-readable descriptors. This compact, text-only encoding is what the LLM reasons over: small enough to fit any context window, explicit enough to check against a written rule.
A single zero-shot chain-of-thought prompt walks the model through four steps. The MUTCD is the external authority; benign variation stays inside the rules, a manipulation steps outside them.
Read the DSL fields and lay out what is actually present on the road.
Retrieve the MUTCD guidance that governs this sign, marking, or context.
Check the scene against the rule and decide: within bounds, or a violation?
State the verdict with a written rationale and the exact MUTCD section.
accuracy (Gemini)
similarity (SBERT)
across 4 families
examples used
On the binary anomalous-vs-benign call, the field bunches up: four models (including the open Llama-3.2-8B) reach 87.5% or better. Only the 1B and 3B models fall to coin-flip territory (50% on this balanced set). Detection, it turns out, is not where the models separate.
Plotting getting the call right against explaining it well (semantic match to the expert answer) splits the field. Only the Gemini family lands in the top-right corner: right answer and a grounded reason. Qwen detects just as well yet its explanations barely resemble the rule-based ground truth.
| Model | Detect % | SBERT | ROUGE-1 | BERTScore |
|---|---|---|---|---|
| ★ gemini-1.5-flash | 92.5 | 0.68 | 0.34 | 0.88 |
| gemini-1.5-pro | 87.5 | 0.69 | 0.33 | 0.88 |
| gemini-2.0-flash-exp | 87.5 | 0.68 | 0.32 | 0.88 |
| gemini-1.5-flash-8b | 82.5 | 0.67 | 0.31 | 0.88 |
| Llama-3.2-8B | 87.5 | 0.48 | 0.14 | 0.81 |
| Qwen2.5-7B | 82.5 | 0.28 | 0.15 | 0.81 |
| Qwen2.5-14B | 82.5 | 0.28 | 0.14 | 0.81 |
| Llama-3.2-1B | 55.0 | 0.62 | 0.22 | 0.84 |
| Llama-3.2-3B | 50.0 | 0.53 | 0.18 | 0.83 |
SBERT = sentence-embedding cosine similarity to the expert explanation; ROUGE-1 and BERTScore measure word- and meaning-level overlap. Red marks models that detect well but explain poorly.
The strongest reasoners are cloud-hosted and answer in under a second. Running a small model locally for privacy trades that away fast. Median time per scenario:
Local Llama times reflect commodity hardware without GPU acceleration; bars are on a shared linear scale, so the sub-second cloud models are barely visible next to a three-minute local run.
Open models match Gemini on the yes/no call: several hit 87.5%. The models separate only when asked why.
Gemini does not just answer: it names the MUTCD section, turning a verdict into an auditable rationale a reviewer can check.
Zero-shot chain-of-thought reaches 92.5% with no labeled examples, so the approach ports to new rules and scenarios cheaply.
This work-in-progress seeded the direction that matured into From Mirage to CLEAR, which scales MUTCD-grounded LLM reasoning to module-level fault attribution on tens of thousands of real scenes.
The framework was benchmarked across 9 LLMs spanning the Gemini, Llama 3.2, and Qwen 2.5 families over the 40-scenario AutoSec-X set, each queried with a single zero-shot chain-of-thought prompt. Detection is scored as accuracy on the balanced anomalous-vs-benign task; explanations are scored against expert ground-truth answers with ROUGE, BLEU, SBERT cosine, and BERTScore. The diagrams above rebuild the paper’s framework and results; exact tables are in the PDF.
“Nine LLMs can all spot a rogue road sign. Only Gemini can tell you which regulation it breaks. Detecting the problem is the easy half; explaining it is where the models split.”
David Fernandez is a PhD candidate in Computer Science at Clemson University and an AI Researcher at BMW Group. His research focuses on safe, efficient, and explainable AI, spanning large language models, vision-language models, agentic systems, and adversarial robustness. His 10 papers include six first-authored studies on component-level explainability, zero-shot reasoning, and adversarial scenario analysis.
At BMW Group, he develops enterprise AI agents, automated prompt optimization, and defenses against multi-turn adversarial attacks. His work also includes edge AI for industrial agentic systems.
Through Clemson’s Virtual Prototyping of Ground Systems (VIPR-GS) program, he develops explainable reasoning and multimodal evaluation systems for the U.S. Army’s Next Generation Combat Vehicle program.