Model Evaluation | David Fernandez

Comparative Analysis of Patch Attack on VLM-Based Autonomous Driving Architectures

Mon, 22 Jun 2026 00:00:00 +0000

01 · The Problem

Cars are starting to use VLMs to make driving decisions, but no one has tested how well they hold up against a printed patch on a roadside billboard. And because each model answers in its own format, there was no fair way to compare them.

02 · The Framework

One shared translation step turns each model’s answer into the same kind of signal. That lets one black-box attack and one scoring method work on every model, all tested in the CARLA driving simulator.

03 · The Finding

All three models fail: the attack works 73 to 76% of the time (12 to 20 times more than normal) and holds for 6 to 8 frames. Each model fails in its own way.

Threat Model

An attacker can print a patch on existing road infrastructure, such as a roadside ad. They never see inside the model and never touch the car’s sensors.

Access

Send an image, read the text reply. Nothing about the model’s internals.

Surface

Existing roadside infrastructure, such as bus-shelter ad panels and billboards.

Patch Generation

About 6,000 quick tries per patch, with no access to the model’s internals.

Realizability

Limited to printable colors and smooth patterns, so it holds up as a real print.

The Attack in Action

The study runs two kinds of attack. One hides a real hazard, such as a pedestrian at a crosswalk. The other, shown here, forces an unsafe move on the highway.

Action Attack Highway: Hijacking the Decision 1024×512 patch · 85 km/h

Here the model still sees the road fine. The patch attacks the decision instead, nudging it to “turn right” straight into the concrete barrier.

Safe action

“Maintain speed / accelerate.”

Hijacked action

“Turn right to exit the highway.”

→ steers toward the barrier

The bigger 2 m × 1 m billboard patch can be seen from about 80 m away. It goes after the model’s choice of action, not its eyesight: the model still “sees” the road correctly.

Methodology

A repeating loop that lets one attack test three very different VLMs on equal terms.

NES Patch
Generation

CARLA
Simulation

VLM
Inference

Semantic
Homogenization

Multi-Dim.
Evaluation

Stage 01 · Black-Box NES

Tuning the patch without seeing inside the model

The attack only asks the model questions and watches its answers, so it never needs the model’s inner workings. Step by step, it nudges the patch until the answer matches a phrase the attacker picked.

// CLIP-space semantic similarity loss
L  =  1 − cos( egen ,  etarget )
// NES gradient estimate over N directions
∇θJ  ≈  (Nσ)−1 Σi J(θ+σεi) εi

N = 20 dirs · σ = 0.1 150 iters · ~6k queries EoT (K=5) · TV smoothing

Stage 04 · Semantic Homogenization

Turning three kinds of answers into one

The three models answer in different ways: plain sentences, structured data, and step-by-step reasoning. A frozen CLIP text encoder turns each answer into the same kind of signal, so one attack goal and one set of metrics fit all of them.

Stage 03 · Three designs, three different weak spots

Dolphins

cross-attention · CLIP ViT-L/14 + MPT-7B

Weak to

Being fooled about what it sees. Corrupted image features pass straight into the language model.

−71 pppedestrian
detection

OmniDrive (Omni-L)

MLP projection · multi-view

Weak to

Everything, evenly. Its fixed way of handling images leaves no safe distance.

82–91%ASR across
all distances

LeapVAD

dual-process · critical-object attention

Weak to

Bad reasoning. It spots objects best of the three, yet still gets talked into unsafe actions.

81.7%highway ASR
(highest)

Results

The weakness is serious, long-lasting, and shows up in every design. We measured it in four ways.

73–76%

combined attack
success rate

12–20×

increase over
benign baseline

6.2–7.8

consecutive frames
of failure

p<.001

GEE significance,
all architectures

A · Overall Attack Success (Table I)

Crosswalk Highway Benign baseline

Dolphinscombined 76.0%

Crosswalk

73.1

Highway

79.2

Baseline

3.8

OmniDrive (Omni-L)combined 73.5%

Crosswalk

71.8

Highway

75.6

Baseline

5.1

LeapVADcombined 75.0%

Crosswalk

68.4

Highway

81.7

Baseline

6.3

B · Distance-Dependent Efficacy (Fig. 3, crosswalk)

Dolphins Omni-L LeapVAD

Every model does poorly at the far and very near extremes, where the patch is either too small or too warped to work. They all peak in the 10 to 25 m range, exactly when the car has to decide whether to brake or steer. Omni-L stays the most vulnerable the whole way, while LeapVAD holds up best when the patch is close.

C · Temporal Persistence (Fig. 4, highway)

The failures last; they are not quick flickers. Each row shows ten frames, half a second apart, and each cell is one frame’s result. Runs of 6 to 8 bad frames outlast any defense that waits 3 to 5 frames before trusting a decision.

Attack succeeds (unsafe action) Attack fails (safe action)

Dolphins

7.4 frames

Omni-L

6.9 frames

LeapVAD

7.8 frames

F0F9 · 0.5 s intervals

D · Detection Collapse & Scene Corruption (Table II)

Under attack, the models mostly stop spotting pedestrians. They don’t go quiet, either. They keep describing the scene in smooth, confident language that is simply wrong.

Dolphins

92.3→21.2% −71pp

Omni-L

89.7→34.8% −55pp

LeapVAD

94.6→48.2% −46pp

bar shows benign detection (faded) → adversarial (red), pedestrian, crosswalk scenario

scene-description quality: BLEU-4 0.18–0.31 · semantic sim. 0.49–0.67

What the Comparison Answers

RQ1 · Spatial & Temporal

The attack works across the whole 10 to 25 m decision zone and lasts 6 to 8 frames in a row. This is not one-off noise a filter could catch.

RQ2 · Perception vs Behavior

They come apart. Even under attack, LeapVAD still spots 48% of pedestrians, yet it still acts unsafely. Seeing the object is not the same as making the right choice.

RQ3 · Scope of Corruption

It spreads. Low text-overlap and meaning scores show the patch throws off the model’s whole understanding of the scene, not just one label. The result is fluent but false descriptions.

Implications

Security

No design is safe on its own. All three approaches fail at 73 to 76%. The weakness comes from how today’s vision and language parts are joined together, not from one unlucky model.

Design

Each design trades one weakness for another. LeapVAD’s focus on key objects makes it better at seeing but easier to mislead in its reasoning. Omni-L’s fixed image handling leaves no safe distance. Safety has to be built into both the seeing and the deciding.

Defense

Defenses that wait and compare frames won’t save you. Failures run 6 to 8 frames, so a check that needs 3 to 5 matching frames still locks in the unsafe action before it can object.

All tests ran in the CARLA 0.9.14 driving simulator (Town04) with a single forward camera at 1920×1080, using real-world patch sizes (1 m² at the crosswalk, 2 m×1 m on the billboard). Attack Success Rate is the share of frames where the model picks the unsafe action, tested for statistical significance against normal driving. The line chart and frame strips above illustrate the paper’s Figures 3 and 4; the exact numbers are in the PDF.

Understanding Adversarial Transferability in Vision-Language Models for Autonomous Driving: A Cross-Architecture Analysis

Tue, 07 Apr 2026 00:00:00 +0000

01 · The Problem

Physical adversarial patches on road signs can manipulate VLM driving decisions. Attackers typically don't know which model a vehicle uses, yet that may not matter.

02 · The Method

Three VLMs (Dolphins, OmniDrive, LeapVAD) are evaluated with physically realizable patches in Crosswalk and Highway scenarios using Black-Box NES optimization.

03 · The Finding: Transferability

Patches optimised for one model remain 73–91% effective on others. Architectural diversity alone provides limited real-world protection.

Threat Model

Black-box attacker uses only physical patches on legitimate roadside infrastructure: no model internals, no gradients, no target knowledge required.

No patch · Drives safely

With patch · Manipulated

Methodology

Five-stage pipeline: black-box patch optimization → physical deployment → VLM inference → semantic homogenization → transfer evaluation

Patch
Generation

CARLA
Deployment

VLM
Inference

CLIP
Homogenization

Transfer
Evaluation

Phase 01 · Patch Generation

No gradients: NES converges in 6 000 queries

Patches are optimised via Natural Evolution Strategies using a CLIP-based semantic similarity loss over the VLM output command, with no access to model weights or gradients. Expectation over Transformation (EoT) bakes in physical robustness across viewing angles and lighting conditions.

// Semantic adversarial loss (CLIP text embedding space)
L(δ)  =  1 − cos( ET(f(x ⊕ Mδ)) ,  ET(f(x)) )
// NES gradient estimate & patch update
gk  =  (nσ)−1 ⋅ Σi εi ⋅ L(δk + σεi)
δk+1  =  clip( δk + α⋅gk ,  [0,1])

Zero gradient access 6 000 queries / model EoT physical robustness CARLA simulation

Adversarial patch δ* → deployed on simulated billboard

Phase 02 · CARLA Deployment

Patch rendered on a simulated billboard; VLM vehicles drive past it

The optimised patch δ* is placed on a roadside billboard inside the CARLA simulator. Ego-vehicles equipped with the target VLMs drive toward it under varied lighting and camera angles, producing the inference inputs for Phase 03.

S1 · Crosswalk: Bus Stop

Patch on shelter billboard at pedestrian crossing

S2 · Highway: Billboard

Patch on roadside billboard at highway speed

Patched driving frames → fed to all three VLM architectures

Phase 03 · VLM Inference

Three architectures receive the patched scene and produce driving decisions

❄ frozen 🔥 trained / fine-tuned patch entry point

Dolphins

OpenFlamingo-based · video VLM

CLIP shared

(a) Dolphins. Frozen CLIP ViT-L/14 features are compressed by a trained Perceiver Resampler and injected into the frozen MPT-7B decoder through interleaved gated cross-attention layers. The adversarial patch couples directly into the shared CLIP manifold.

OmniDrive

Omni-L & Omni-Q variants · multi-view 3D

Distinct encoder

(b) OmniDrive. Multi-view features from the MIM-distilled EVA-02-L encoder reach LLaMA2-7B through either a linear MLP projector (Omni-L) or a Q-Former3D with carrier and perception queries (Omni-Q). Its partially distinct feature manifold weakens incoming CLIP-optimised patches (TR 0.42–0.57).

LeapVAD

dual-process · cognitive driving

CLIP shared

(c) LeapVAD. A dual-process system: the fine-tuned Qwen-VL-7B scene VLM feeds an analytic GPT-4o reasoner (System-II) whose experience is distilled into a fast 1.8B heuristic driver (System-I), supported by top-k retrieval over 256-d contrastive scene tokens. Vision is grounded in the same CLIP manifold as Dolphins (TR 0.82–0.91).

Heterogeneous VLM outputs → shared CLIP text embedding space

★ Novel

Phase 04 · CLIP Homogenization

Architecture-agnostic evaluation via shared embedding space

VLMs generate heterogeneous outputs across different vocabularies and instruction formats. The key methodological contribution is projecting all outputs through a shared CLIP text embedding space, enabling direct cross-architecture semantic comparison. CLIP-family vision encoders create a shared visual attack surface, explaining the high bidirectional transfer between Dolphins and LeapVAD (0.82–0.91).

Why shared encoders create a shared attack surface

Dolphins (OpenFlamingo, Perceiver Resampler + cross-attention) and LeapVAD (Qwen-VL-7B) both ground vision in a CLIP-aligned InfoNCE contrastive manifold; patches that maximise cosine drift in this space transfer directly between them (0.82–0.91). OmniDrive’s EVA-02-L uses masked image reconstruction (MIM) that distills CLIP, producing a partially distinct feature manifold; its Q-Former connector (Omni-Q variant) further decouples spatial features during language alignment, routing adversarial signal through a different pathway, explaining the lower but still substantial cross-cluster transfer.

TRij

Transfer
rate

TSi

Outgoing
generalisation

Frame
ASR

Temporal
persistence

VSj

Incoming
susceptibility

CLIP embedding similarities → transfer matrix

Phase 05 · Transfer Evaluation

Two driving scenarios, each tested with patches from all three VLM architectures. Transfer rates show how well attacks generalise across unseen models.

Architecture Vulnerability Ranking

Dolphins: most vulnerable to incoming attacks · LeapVAD: most transferable patches · CLIP encoder drives strongest bidirectional transfer

Metric	Dolphins	OmniDrive	LeapVAD	Interpretation
Self-Attack ASR	76.0%	84.4%	71.7%	OmniDrive hardest to fool from outside, but optimised attacks on it succeed best
Vulnerability Score	0.82	0.810	0.814	Dolphins most affected by patches from other architectures
Transfer-Out Rate	0.792	0.772	0.882	LeapVAD patches generalise best across unseen architectures
Universal Patch ASR	64.3%	69.8%	63.5%	A single patch fools all three; OmniDrive most susceptible
CLIP Enc. ASR encoder-pathway	79.2%	81.5%	76.8%	Attack success rate routed through the shared CLIP encoder pathway; confirms encoder is the primary vulnerability driver

Implications

Security

Architectural diversity is not a sufficient defense. Patches optimised for one model remain 73–91% effective on others; an attacker with physical access to a roadside billboard needs no knowledge of which model the target vehicle runs.

Design

Shared CLIP encoders create a shared attack surface. Deploying models with distinct vision encoder families (CLIP vs. non-CLIP) would structurally limit transferability; EVA-02-L’s MIM training already reduces but does not eliminate cross-cluster transfer.

Defence

Temporal filtering and ensemble voting are insufficient. Attacks persist across 64–79% of frames in the critical decision window, long enough to corrupt decisions before any frame-level filter or multi-model vote can compensate.

Transfer rates evaluated via TR_ij = ASR_ij / ASR_ii, normalising cross-architecture success against same-model baseline. Diagonal entries (self-attacks) shown in gray. All experiments conducted in CARLA simulator with physically realizable patches. Scenarios: Crosswalk/Bus Stop and Highway/Billboard.

Small Language Models on the Edge for Real-World Agentic Systems in Industry

Mon, 01 Dec 2025 00:00:00 +0000

01 · The Problem

Large language models are hard to put to work inside a company: they cost a lot to run, they send private data to the cloud, and they stop working the moment the network does.

02 · The Approach

Run small models under 7B parameters on ordinary hardware, and make up for their smaller capacity with agentic architectures that plan, route, and check their own work.

03 · The Finding

On commodity hardware, Phi‑4 reaches C1‑level translation and a 0.883 summarization score, while local and in‑browser hosting answer 3–4× faster than the cloud.

Contribution 1 · A Bias-Resistant Benchmark

Grading a small model is subjective, so two rival graders must agree. Role-play makes them careful; consensus curbs single-judge bias.

Each open model is examined as a language-learning student, then graded by two frontier models playing rival instructors who must reach a single CEFR verdict.

The exam loop, step by step

1Set the exam

The Proctor agent draws a translation exercise, English to Afrikaans, from a fixed exam set.

2Student answers

Each SLM, cast as a student, returns a translation with no idea it is being scored.

3Collect the answer

The Proctor takes the answer back and keeps the grade hidden from the student.

4Hand to graders

The exercise and answer go to two grader agents, each a different frontier model.

5Discuss to consensus

Goddard (GPT-4) and Vorster (Claude) debate the work and agree one CEFR grade.

6Return the verdict

The agreed grade and written review flow back to the Proctor.

7Record the result

The Proctor logs a structured record: student, language pair, agreed CEFR grade, and a review summary, ready to compare across all seven models.

Contribution 2 · Planning a Small Model Can Follow

Asked to plan in one shot, a small model rambles. Split the job into three narrow steps and it stays on track.

a messy user request → three-phase pipeline → a valid, executable plan

1 Subtask identification

Break the request into small, single-purpose steps, so each one is simple enough for a small model to get right.

2 Dependency reasoning

Work out the order: which steps can run now and which must wait for another step’s output first.

3 Schema-constrained output

[
  { "step":1, "needs":[] },
  { "step":2, "needs":[1] }
]

Emit the plan as JSON locked to a fixed schema, so it always parses and can be run without hand-fixing.

Splitting reasoning from formatting is the key move: the model thinks in phases 1 and 2, then only has to fill in a rigid structure in phase 3, which is exactly where small models tend to slip.

What The Small Models Actually Did

Phi-4 led the field, matching advanced-level language work while running on ordinary hardware.

Phi-4 translation, on the CEFR scale (advanced)

0.883

Phi-4 summarization, G-Eval score

3–4×

faster to answer than a cloud service

open models under 7B params, benchmarked

Translation C1 · CEFR

English to Afrikaans, graded by the two rival examiners. Phi-4 reached C1, the advanced tier a proficient human speaker sits at.

Summarization 0.883 · G-Eval

Scored with G-Eval, an LLM-graded quality measure on a 0 to 1 scale. Phi-4’s 0.883 is close-to-frontier work from a sub-7B model.

Latency · running on the device vs. calling the cloud

Cloud API call

baseline

On-device
local & in-browser

3–4× faster

Hosted with WebLLM in the browser or run locally, the models answer 3 to 4 times faster than a round trip to a cloud API, with no per-call fee and no queue.

Where this unlocks deployment

Privacy-sensitive

Prompts and documents never leave the machine, so regulated data stays in-house.

Bandwidth-constrained

No large payloads to the cloud on every call, so it works over weak or metered links.

Air-gapped

Runs with no internet at all, for plants and sites that are offline by design.

Why It Matters

Data stays home

Because the model runs on the device, sensitive data never crosses the network. That opens up privacy-bound and fully offline settings the cloud can’t serve.

Scaffolding beats size

Agentic structure, decomposed planning and multi-agent grading, lets a sub-7B model do work that usually assumes a much larger cloud model.

Judging you can trust

Two rival graders that must agree is a reusable recipe for scoring open-ended output without leaning on a single, biased judge.

About this page

The diagrams above redraw the paper’s benchmarking and planning framework in this site’s style; the exam-loop figure follows the appendix’s evaluation walkthrough. Seven open models under 7B parameters were graded on translation and summarization by two frontier examiners (GPT-4 and Claude) on the CEFR scale, with Phi-4 the standout. Full method, prompts, and results are in the paper and the linked appendix repository.

WIP: From Detection to Explanation: Using LLMs for Adversarial Scenario Analysis in Vehicles

Fri, 01 Aug 2025 00:00:00 +0000

01 · The Gap

The deep networks in a self-driving car can flag that a scene looks wrong, but not why, and they cannot tell a harmless sensor glitch from a deliberate roadside attack.

02 · The Approach

Encode each scene in a compact domain-specific language and let an LLM reason step by step, checking it against the MUTCD traffic rule book. No labeled training data.

03 · The Finding

Gemini spots inconsistencies with 92.5% accuracy and, unlike the open models, explains each call by citing the exact regulation it breaks.

From Detection to Explanation

A perception model can tell you a scene looks wrong. It cannot tell you why, or whether someone made it that way.

Why Detection Alone Is Not Enough

Conventional deep neural networks answer a yes/no question and stop there. For safety review and security forensics, that answer is a dead end: it points at nothing you can fix, audit, or defend against.

What a DNN Gives You

anomaly  =  true
score    =  0.87
// which module? why? attack or glitch?
// no answer

the gap
this paper
closes

What Safety & Security Need

✓ Why the scene is inconsistent

✓ The exact rule it violates

✓ Benign glitch vs. deliberate attack

✓ A human-readable audit trail

The Hard Part: Glitch or Attack?

Both scenes below are a regulatory sign on a clear, sunny road. They look alike to a classifier. Only reasoning against the rule book separates a correct sign from one that should never be there.

STOP sign on a 65 mph highway Anomalous

An R1-1 Stop Sign sits on the shoulder of an open highway, in the high-speed travel area.

Verdict · violates the rule book

Stop signs belong at intersections and ramps, not mid-highway. MUTCD 2B.04, 2B.05

YIELD sign at a roundabout Benign

An R1-4 Yield Sign tells drivers to yield to circulating traffic on approach to a roundabout.

Verdict · fully compliant

Exactly the right control for a roundabout entry. MUTCD 2B.33, R4-03

What Existing Methods Miss

Prior approaches flag anomalies but stop short of a grounded, human-readable reason, and most need a pile of labeled examples first. Zero-shot LLM reasoning is built to do all four.

Approach	Detect	Explain	Cite rule	No labels
Statistical / threshold detectors	✓	✗	✗	✓
Supervised DNN classifiers	✓	✗	✗	✗
Hand-written rule engines	✓	◐	✓	◐
★ LLM zero-shot reasoning (ours)	✓	✓	✓	✓

✓ full ◐ partial / brittle ✗ none

The Framework

Turn each scene into structured text, reason over it against the rule book, and grade both the call and the explanation.

AutoSec-X · The Benchmark

GPT-4 drafts 40 driving scenarios anchored in the U.S. traffic-control manual, half with a genuine regulatory violation and half fully compliant. Each carries an expert-style ground-truth explanation that names the relevant MUTCD section, so a model is graded not just on the verdict, but on whether it reasons for the right reason.

40

MUTCD-grounded
scenarios

20 / 20

anomalous vs.
benign, balanced

31

distinct road
types & layouts

0

labeled examples
needed (zero-shot)

The Domain-Specific Language

Raw sensor data is distilled into eight human-readable descriptors. This compact, text-only encoding is what the LLM reasons over: small enough to fit any context window, explicit enough to check against a written rule.

Scene descriptors

RoadTypehighway, roundabout, school zone… Speedposted / travel speed (mph) LaneMarkingse.g. broken white, double yellow TrafficSignsMUTCD sign codes present TrafficControlDevicessignals, beacons, markers TimeOfDaylighting context Weatherclear, fog, rain, mist… Descriptionone-line natural-language summary

Encoded scenario · #1

RoadType: "Highway"
Speed: 65
LaneMarkings: ["Broken white line"]
TrafficSigns: ["R1-1: Stop Sign"]
Weather: "Sunny"
… stop sign in a 65 mph travel lane

▶ Ground truth: Inconsistency, MUTCD 2B.04, 2B.05

How the Reasoning Works

A single zero-shot chain-of-thought prompt walks the model through four steps. The MUTCD is the external authority; benign variation stays inside the rules, a manipulation steps outside them.

01

Parse the scene

Read the DSL fields and lay out what is actually present on the road.

02

Recall the rule

Retrieve the MUTCD guidance that governs this sign, marking, or context.

03

Compare & judge

Check the scene against the rule and decide: within bounds, or a violation?

04

Explain & cite

State the verdict with a written rationale and the exact MUTCD section.

Results

Nine LLMs, one benchmark. Detecting the problem turns out to be the easy half.

92.5%

best detection
accuracy (Gemini)

0.69

top explanation
similarity (SBERT)

9

LLMs benchmarked
across 4 families

0

labeled training
examples used

A · Detection Accuracy (40 scenarios)

Gemini Llama 3.2 Qwen 2.5

gemini-1.5-flash

92.5

gemini-2.0-flash-exp

87.5

gemini-1.5-pro

87.5

Llama-3.2-8B

87.5

gemini-1.5-flash-8b

82.5

Qwen2.5-7B

82.5

Qwen2.5-14B

82.5

Llama-3.2-1B

55.0

Llama-3.2-3B

50.0

On the binary anomalous-vs-benign call, the field bunches up: four models (including the open Llama-3.2-8B) reach 87.5% or better. Only the 1B and 3B models fall to coin-flip territory (50% on this balanced set). Detection, it turns out, is not where the models separate.

B · The Detection–Explanation Gap

Plotting getting the call right against explaining it well (semantic match to the expert answer) splits the field. Only the Gemini family lands in the top-right corner: right answer and a grounded reason. Qwen detects just as well yet its explanations barely resemble the rule-based ground truth.

C · Detection and Explanation, Side by Side

Model	Detect %	SBERT	ROUGE-1	BERTScore
★ gemini-1.5-flash	92.5	0.68	0.34	0.88
gemini-1.5-pro	87.5	0.69	0.33	0.88
gemini-2.0-flash-exp	87.5	0.68	0.32	0.88
gemini-1.5-flash-8b	82.5	0.67	0.31	0.88
Llama-3.2-8B	87.5	0.48	0.14	0.81
Qwen2.5-7B	82.5	0.28	0.15	0.81
Qwen2.5-14B	82.5	0.28	0.14	0.81
Llama-3.2-1B	55.0	0.62	0.22	0.84
Llama-3.2-3B	50.0	0.53	0.18	0.83

SBERT = sentence-embedding cosine similarity to the expert explanation; ROUGE-1 and BERTScore measure word- and meaning-level overlap. Red marks models that detect well but explain poorly.

D · The Practical Cost

The strongest reasoners are cloud-hosted and answer in under a second. Running a small model locally for privacy trades that away fast. Median time per scenario:

gemini-1.5-flash

0.8 s

Qwen2.5-14B

3.4 s

Llama-3.2-1B

41 s

Llama-3.2-3B

168 s

Local Llama times reflect commodity hardware without GPU acceleration; bars are on a shared linear scale, so the sub-second cloud models are barely visible next to a three-minute local run.

What This Establishes

01 · Detection is the easy half

Open models match Gemini on the yes/no call: several hit 87.5%. The models separate only when asked why.

02 · Grounding beats fluency

Gemini does not just answer: it names the MUTCD section, turning a verdict into an auditable rationale a reviewer can check.

03 · No labels required

Zero-shot chain-of-thought reaches 92.5% with no labeled examples, so the approach ports to new rules and scenarios cheaply.

Work in Progress · Honest Limits & Next Steps

Small set

AutoSec-X is 40 scenarios: a signal, not a verdict. The numbers show a clear direction, but scaling the benchmark up is the immediate next step before drawing firm conclusions.

Text-only

The DSL assumes the scene is already parsed. Reasoning happens over structured text, not raw pixels; feeding multimodal inputs to the model directly is explicit future work.

Synthetic

Scenarios are GPT-4-generated and MUTCD-grounded. They are internally consistent and rule-anchored, but real-world sensor logs remain the harder test still to come.

Where this line of work leads

This work-in-progress seeded the direction that matured into From Mirage to CLEAR, which scales MUTCD-grounded LLM reasoning to module-level fault attribution on tens of thousands of real scenes.

The framework was benchmarked across 9 LLMs spanning the Gemini, Llama 3.2, and Qwen 2.5 families over the 40-scenario AutoSec-X set, each queried with a single zero-shot chain-of-thought prompt. Detection is scored as accuracy on the balanced anomalous-vs-benign task; explanations are scored against expert ground-truth answers with ROUGE, BLEU, SBERT cosine, and BERTScore. The diagrams above rebuild the paper’s framework and results; exact tables are in the PDF.

Avoiding the Crash: A Vision-Language Model Evaluation of Critical Traffic Scenarios

Tue, 01 Apr 2025 00:00:00 +0000

01 · The Problem

AV systems rely on DNNs that require constant retraining. When outdated, they fail to recognize novel crash scenarios, causing preventable accidents.

02 · The Approach

Real-world dashcam crash footage is decomposed frame-by-frame. LLaVA-7B and MoE-LLaVA predict the safest driving action at each frame: brake, accelerate, or turn.

03 · The Metric: CPE

Crash Prevention Efficiency scores how early and how precisely a model detects the threat, measured against the point of no return (t_PNR) and crash point (t_x).

Frame-by-Frame VLM Analysis

MoE-LLaVA's real-time decision-making across two critical crash scenarios, from safe driving to the moment of impact.

Q1Can VLMs Overcome Human Drivers?

Red Light Violation·Dashcam · victim vehicle POV·VLMs detected threat 1.33 s earlier than humans

t₀ · StarttR · DetectiontPNR · No Returntx · Crash

Safe Zone

MoE-LLaVA

"You are driving at 8 mph approaching a four-way intersection."

VLM Detects Threat

MoE-LLaVA

"A car is approaching a crosswalk – exercise caution at the intersection."

Point of No Return

MoE-LLaVA

"Slow down – maintain a safe distance from the white car in front of you."

Crash Point

MoE-LLaVA

"You should slow down immediately – the situation ahead is critical."

Q2Can VLMs Overcome DNN-Based AV Systems?

Flipped Truck · Highway at Night·Tesla dashcam footage·VLMs detected hazard before braking initiated

t₀ · StarttR · DetectiontPNR · No Returntx · Crash

Safe Zone

MoE-LLaVA

"You are driving at 57 mph on a dark highway at night – maintain safe following distance."

VLM Detects Threat

MoE-LLaVA

"Be aware of potential obstacles or traffic conditions ahead on the highway."

Point of No Return

MoE-LLaVA

"There is a truck on the road in a precarious position – slow down to avoid a collision."

Crash Point

MoE-LLaVA

"Brake immediately – there is an obstruction across the full width of the road."

Timeline zones reflect each scenario's Crash Prevention Efficiency (CPE) intervals: the window between VLM detection (t_R), the point of no return (t_PNR), and impact (t_x). Frames extracted from real-world dashcam footage used in the study.

∫

Crash Prevention Efficiency (CPE)

A novel metric measuring how early and precisely a model acts relative to the Point of No Return (t_b).

Formula

CPE =

e^{−α(t_b−t_c)}EARLY if t_c < t_b

1ON-TIME if t_c = t_b

−e^{−β(t_c−t_b)}LATE if t_c > t_b

Variables

t_b= d/v, Point of No Return timet_c= t_d + t_r, Detection + reaction timeαScaling factor for early actionsβScaling factor for late actions; β > α

CPE vs. Detection Timing

Score & Interpretation

−1  very early+1  ideal−1  very late

Results highlight

LLaVA-7Bavg CPE0.42–0.82

MoE-LLaVAavg CPE0.40–0.85

AV Systemsavg CPE−0.13 to −0.002

David vs. Goliath: A Comparative Study of Different-Sized LLMs for Code Generation in the Domain of Automotive Scenario Generation

Wed, 01 Jan 2025 00:00:00 +0000