TrajRS: Towards Certified Robustness in Pedestrian Trajectory Prediction

# TrajRS: Towards Certified Robustness in Pedestrian Trajectory Prediction
Source: [https://arxiv.org/html/2606.28716](https://arxiv.org/html/2606.28716)
###### Abstract

The robustness of trajectory prediction models is crucial for developing safe autonomous driving systems\. Adversarial attacks on trajectory prediction can significantly impair the accuracy of predicted trajectories, leading to hazardous driving behaviors\. While heuristic defense strategies have been implemented to enhance the robustness of trajectory prediction models, these measures often fail against more sophisticated, targeted adversarial attacks\. Hence, there is a pressing need to establish verifiable safety assurances for trajectory prediction models\. In this paper, we extend the traditional Randomized Smoothing framework to “TrajRS”, which provides a certified robust radius for smoothed trajectory predictors\. We clarify and expand the formal definitions of robustness in trajectory prediction and tailor the practical TrajRS scheme specifically to “robustness for the optimal prediction” and “robustness for all possible predictions”\. An extensive set of experiments demonstrates that TrajRS effectively achieves robustness certification for all smoothed pedestrian trajectory predictors in this work\.

Index Terms—Robustness verification, trajectory prediction, autonomous driving

## 1Introduction

Trajectory prediction stands as a fundamental element in autonomous driving systems\. It is responsible for forecasting the future motion paths of nearby objects\[[4](https://arxiv.org/html/2606.28716#bib.bib34),[22](https://arxiv.org/html/2606.28716#bib.bib57)\]\. This is essential for the vehicle to plan its forthcoming driving maneuvers safely\. While prior research has achieved success in enhancing the accuracy of trajectory prediction\[[7](https://arxiv.org/html/2606.28716#bib.bib396),[9](https://arxiv.org/html/2606.28716#bib.bib395),[13](https://arxiv.org/html/2606.28716#bib.bib394),[12](https://arxiv.org/html/2606.28716#bib.bib393),[29](https://arxiv.org/html/2606.28716#bib.bib391)\], recent studies have uncovered a significant susceptibility to adversarial attacks\[[33](https://arxiv.org/html/2606.28716#bib.bib397),[37](https://arxiv.org/html/2606.28716#bib.bib106),[6](https://arxiv.org/html/2606.28716#bib.bib103)\]\. These attacks change historical trajectory data by minor perturbations, causing major mispredictions\. This can pose grave safety risks, as shown in the adversarial scenario of[Figure1](https://arxiv.org/html/2606.28716#S1.F1)\(top\): the autonomous vehicle wrongly predicts that a pedestrian will stay on the sidewalk\.

![Refer to caption](https://arxiv.org/html/2606.28716v1/x1.png)Fig\. 1:Two scenarios in trajectory prediction\. A pedestrian prepares to cross the street\. In the adversarial scenario\(top\),the vehicle is misled by a disturbed historical trajectory of the pedestrian, so it mispredicts that the pedestrian will not cross the road\. As a result, it maintains its speed, potentially causing an accident or necessitating emergency braking, endangering both the pedestrian and the vehicle\. In the certified scenario\(bottom\),however, any disturbances within a specified safety assurance range keep the vehicle’s prediction close to the correct future trajectory, ensuring safe traffic\.A few defense methods have been proposed to enhance the robustness of trajectory prediction models\[[36](https://arxiv.org/html/2606.28716#bib.bib102),[14](https://arxiv.org/html/2606.28716#bib.bib21)\]\. Despite these accomplishments, even models previously regarded as robust have ultimately succumbed to more potent adversarial attacks, as demonstrated among others by\[[3](https://arxiv.org/html/2606.28716#bib.bib199)\]\. This realization underscores the imperative need for methods that provide verifiable guarantees, ensuring the impregnability of the predictor against any attack within a specified perturbation radius\. This need is further amplified by the safety\-critical nature of trajectory predictors in autonomous driving\. It is only through rigorous verification that we can truly establish a safety guarantee for the model, as illustrated in the certified scenario of[Figure1](https://arxiv.org/html/2606.28716#S1.F1)\(bottom\)\.

To surmount the challenge, recent research\[[17](https://arxiv.org/html/2606.28716#bib.bib231),[8](https://arxiv.org/html/2606.28716#bib.bib152),[19](https://arxiv.org/html/2606.28716#bib.bib227)\]has introduced “randomized smoothing”\. This approach operates by adding smoothing noise to the input data and subsequently determining the most probable label through the smoothed classifier\. The key advantage is the ability to certify the robustness radius for the smoothed classifier\. Randomized smoothing stands apart from other methods due to its efficiency and model\-agnostic nature, making it adaptable to many varieties of models\[[28](https://arxiv.org/html/2606.28716#bib.bib22),[16](https://arxiv.org/html/2606.28716#bib.bib400),[15](https://arxiv.org/html/2606.28716#bib.bib401),[31](https://arxiv.org/html/2606.28716#bib.bib403)\]\.

In this study, inspired by randomized smoothing, we extend the current trajectory prediction model to a smoothed predictor with a certified robust radius, named “TrajRS”\. Achieving this enhancement involves navigating two primary challenges\. The first challenge pertains to the unique definition of robustness in trajectory prediction, which differs from that in image classification\. The second challenge arises from the stochastic outputs in trajectory, necessitating robustness guarantees for the entire output distribution\.

To effectively tackle these challenges, this study introduces two formal definitions of robustness for trajectory prediction\. The first, “robustness for all possible predictions”, considers the entire output distribution\. The second, “robustness for the optimal prediction”, concentrates on the optimal \(and deterministic\) predicted trajectory\. We have developed suitable randomized smoothing algorithms that implement these definitions using Monte Carlo sampling\. This approach is adept at offering robustness guarantees for the full output distribution with any given confidence and error rate\.

Compared with prior verification approaches, TrajRS closes two key gaps\. First, unlike TrajPAC\[[35](https://arxiv.org/html/2606.28716#bib.bib23)\]—which verifies the unchanged base model via a surrogate and can at best provide a lower bound on its robust radius—TrajRS smooths the predictor and yields a theoretically exact certified radius for the resulting smoothed model, while also improving robustness in practice\. Second, relative to the smoothing framework of Bahari et al\.\[[5](https://arxiv.org/html/2606.28716#bib.bib387)\], which certifies only the single best output mode, TrajRS further certifies the entire multimodal output distribution via the smoothed modelgAg\_\{A\}with controllable confidence levels and error rates\.

Overall, the primary contributions of our work are as follows:

- •We extend the Randomized Smoothing framework to TrajRS in[Section3\.1](https://arxiv.org/html/2606.28716#S3.SS1)and provide a certified robust radius for smoothed trajectory predictors\.
- •We extend the formal definitions of robustness to trajectory prediction in[Section2\.2](https://arxiv.org/html/2606.28716#S2.SS2)and customize the practical TrajRS scheme specifically to “robustness for the optimal prediction” and “robustness for all possible predictions” in[Section3\.2](https://arxiv.org/html/2606.28716#S3.SS2)\.
- •We evaluate the TrajRS scheme against four representative trajectory forecasting models on the ETH/UCY dataset and the Stanford Drone Dataset in[Section4](https://arxiv.org/html/2606.28716#S4)\. The experimental results demonstrate that TrajRS achieves effective robustness certification for all smoothed trajectory predictors in both types of robustness\.

## 2Problem Formulation

### 2\.1Trajectory Prediction

Let𝐱\(t\)∈ℝ2\\mathbf\{x\}^\{\(t\)\}\\in\\mathbb\{R\}^\{2\}be the spatial coordinate of an agent at timestamptt, where𝐱\(t\)=\(xh\(t\),xv\(t\)\)\\mathbf\{x\}^\{\(t\)\}=\(x^\{\(t\)\}\_\{h\},x^\{\(t\)\}\_\{v\}\),xh\(t\)x^\{\(t\)\}\_\{h\}represents the longitude andxv\(t\)x^\{\(t\)\}\_\{v\}means the latitude\. Suppose there areT=Tp\+TfT=T\_\{p\}\+T\_\{f\}timestamps, where the priorTpT\_\{p\}timestamps are situated in the past and the subsequentTfT\_\{f\}timestamps are positioned in the future\. The matrix𝐗i=\(𝐱i\(−Tp\+1\),𝐱i\(−Tp\+2\),…,𝐱i\(0\)\)∈ℝ2×Tp\\mathbf\{X\}\_\{i\}=\(\\mathbf\{x\}^\{\(\-T\_\{p\}\+1\)\}\_\{i\},\\mathbf\{x\}^\{\(\-T\_\{p\}\+2\)\}\_\{i\},\\ldots,\\mathbf\{x\}^\{\(0\)\}\_\{i\}\)\\in\\mathbb\{R\}^\{2\\times T\_\{p\}\}represents the past trajectory of theii\-th agent, vectorized asXiX\_\{i\}\. Consider𝐗0∈ℝ2×Tp\\mathbf\{X\}\_\{0\}\\in\\mathbb\{R\}^\{2\\times T\_\{p\}\}is the trajectory from the to\-be\-predicted agent and𝐘0=\(𝐱0\(1\),…,𝐱0\(Tf\)\)\\mathbf\{Y\}\_\{0\}=\(\\mathbf\{x\}^\{\(1\)\}\_\{0\},\\ldots,\\mathbf\{x\}^\{\(T\_\{f\}\)\}\_\{0\}\)is the ground truth of the future trajectory to be predicted, vectorized asY0Y\_\{0\}\. Let𝐗1,…,𝐗N\\mathbf\{X\}\_\{1\},\\ldots,\\mathbf\{X\}\_\{N\}be the past trajectories of theNNneighbouring agents\. The goal of trajectory prediction is to train a prediction modelf:ℝ2​Tp​\(N\+1\)→ℝ2​Tff:\\mathbb\{R\}^\{2T\_\{p\}\(N\+1\)\}\\to\\mathbb\{R\}^\{2T\_\{f\}\}, so thatf=arg⁡min𝑔​𝑙𝑜𝑠𝑠​\(g​\(𝒳\),Y0\)f=\\underset\{g\}\{\\arg\\min\}~\\mathit\{loss\}\(g\(\\mathcal\{X\}\),Y\_\{0\}\), where𝒳=Vec​\(𝐗0,…,𝐗N\)\\mathcal\{X\}=\\mathrm\{Vec\}\(\\mathbf\{X\}\_\{0\},\\ldots,\\mathbf\{X\}\_\{N\}\)\.Vec​\(⋅\)\\mathrm\{Vec\}\(\\cdot\)indicates the vectorization of the matrices\.

Recent trajectory prediction models\[[27](https://arxiv.org/html/2606.28716#bib.bib84),[10](https://arxiv.org/html/2606.28716#bib.bib60)\]utilize stochastic methods to capture future movements’ inherent multimodality, producing probabilistic outputs\. We assume a modelf​\(𝒳\)f\(\\mathcal\{X\}\)outputs a discrete probability distribution over trajectories inℝ2​Tf\\mathbb\{R\}^\{2T\_\{f\}\}, whereY^∈f​\(𝒳\)\\hat\{Y\}\\in f\(\\mathcal\{X\}\)represents one possible prediction\.

### 2\.2Robustness of Prediction Models

Building on “label robustness” from\[[35](https://arxiv.org/html/2606.28716#bib.bib23)\], we define “robustness for all possible predictions” as the ability of a model to generate safe predictions under perturbations across its entire output distribution, as illustrated in[Fig\.2](https://arxiv.org/html/2606.28716#S2.F2)\(bottom\)\.

![Refer to caption](https://arxiv.org/html/2606.28716v1/x2.png)Fig\. 2:Two types of robustness for predictions\. Robustness for the optimal prediction \(top\) concentrates on the robustness of the best\-of\-kkpredicted trajectory, which is also applicable to the most probable trajectory\. Robustness for all possible predictions \(bottom\) depicts the robustness of the entire output distribution\. Safe region indicates the area where the distance between the predicted trajectory and the ground truth does not exceed the safety thresholdss\. Note that the perturbations are also applied to the past trajectories of the neighbouring agents, but are omitted from the figure\.Given an input trajectory𝐗^∈ℝ2×Tp\\hat\{\\mathbf\{X\}\}\\in\\mathbb\{R\}^\{2\\times T\_\{p\}\}, we posit that any spatial coordinate𝐱\(t\)\\mathbf\{x\}^\{\(t\)\}of the trajectory may be perturbed within a closedL2L\_\{2\}\-norm ball centered at𝐱\(t\)\\mathbf\{x\}^\{\(t\)\}with radiusr\>0r\>0\. Consequently, we defineB​\(𝐗^,r\)B\(\\hat\{\\mathbf\{X\}\},r\)as the set of all perturbed trajectories derived from𝐗^\\hat\{\\mathbf\{X\}\}, mathematically represented as:B​\(𝐗^,r\)=\{𝐗∈ℝ2×Tp∣∥Vec​\(𝐗\)−Vec​\(𝐗^\)∥2≤r\}B\(\\hat\{\\mathbf\{X\}\},r\)=\\\{\\mathbf\{X\}\\in\\mathbb\{R\}^\{2\\times T\_\{p\}\}\\mid\\lVert\\mathrm\{Vec\}\(\\mathbf\{X\}\)\-\\mathrm\{Vec\}\(\\hat\{\\mathbf\{X\}\}\)\\rVert\_\{2\}\\leq r\\\}\.

###### Definition 1\(Robustness for All Possible Predictions\)\.

Given a set of past trajectories𝒳^=Vec​\(𝐗^0,𝐗^1,…,𝐗^N\)\\hat\{\\mathcal\{X\}\}=\\mathrm\{Vec\}\(\\hat\{\\mathbf\{X\}\}\_\{0\},\\hat\{\\mathbf\{X\}\}\_\{1\},\\ldots,\\linebreak\[0\]\\hat\{\\mathbf\{X\}\}\_\{N\}\)for a target agent and itsNNneighboring agents, andY0Y\_\{0\}as the ground truth future trajectory of the target agent\. For a given prediction modelff, an evaluation metricDD, and a safety thresholdss, modelffis defined to be*robust for all predictions*at𝒳^\\hat\{\\mathcal\{X\}\}with respect to a perturbation radiusr\>0r\>0if: for any𝒳=Vec​\(𝐗0,𝐗1,…,𝐗N\)\\mathcal\{X\}=\\mathrm\{Vec\}\(\\mathbf\{X\}\_\{0\},\\mathbf\{X\}\_\{1\},\\ldots,\\linebreak\[0\]\\mathbf\{X\}\_\{N\}\), where𝐗i∈B​\(𝐗^i,r\)\\mathbf\{X\}\_\{i\}\\in B\(\\hat\{\\mathbf\{X\}\}\_\{i\},r\)and anyY∈f​\(𝒳\)Y\\in f\(\\mathcal\{X\}\), it satisfiesD​\(Y,Y0\)≤sD\(Y,Y\_\{0\}\)\\leq s\.

We utilize Average Displacement Error \(ADE\) and Final Displacement Error \(FDE\)\[[2](https://arxiv.org/html/2606.28716#bib.bib148),[1](https://arxiv.org/html/2606.28716#bib.bib45),[11](https://arxiv.org/html/2606.28716#bib.bib73),[20](https://arxiv.org/html/2606.28716#bib.bib78)\]as the evaluation metricDD\.L2L\_\{2\}\-norm for the assessment of robustness provides an intuitive geometric interpretation of perturbations in trajectory space\.

However, this definition has its limitations\. Many recent methods\[[34](https://arxiv.org/html/2606.28716#bib.bib86)\]explicitly encourage the prediction of a diverse set of trajectories that span different directions\. For these models, the required safety distancessto validate robustness would be significantly larger\. Moreover, most adversarial robustness methods\[[6](https://arxiv.org/html/2606.28716#bib.bib103)\]focus on best\-of\-kkpredictions under attack, aligning with accuracy metrics commonly used in recent studies\[[2](https://arxiv.org/html/2606.28716#bib.bib148),[1](https://arxiv.org/html/2606.28716#bib.bib45),[11](https://arxiv.org/html/2606.28716#bib.bib73),[20](https://arxiv.org/html/2606.28716#bib.bib78)\]\.

In light of these considerations, we propose a second definition of robustness, as illustrated in[Fig\.2](https://arxiv.org/html/2606.28716#S2.F2)\(top\):

###### Definition 2\(Robustness for the Optimal Prediction\)\.

Given a set of past trajectories𝒳^=Vec​\(𝐗^0,𝐗^1,…,𝐗^N\)\\hat\{\\mathcal\{X\}\}=\\mathrm\{Vec\}\(\\hat\{\\mathbf\{X\}\}\_\{0\},\\hat\{\\mathbf\{X\}\}\_\{1\},\\ldots,\\linebreak\[0\]\\hat\{\\mathbf\{X\}\}\_\{N\}\)for a target agent and itsNNneighboring agents, andY0Y\_\{0\}as the ground truth of future trajectory for the target agent\. For a given prediction modelff, an evaluation metricDD, and a predefined safety thresholdss, modelffis defined to be*robust for the optimal prediction*at𝒳^\\hat\{\\mathcal\{X\}\}with respect to a perturbation radiusr\>0r\>0if: for any𝒳=Vec​\(𝐗0,𝐗1,…,𝐗N\)\\mathcal\{X\}=\\mathrm\{Vec\}\(\\mathbf\{X\}\_\{0\},\\mathbf\{X\}\_\{1\},\\ldots,\\linebreak\[0\]\\mathbf\{X\}\_\{N\}\), where𝐗i∈B​\(𝐗^i,r\)\\mathbf\{X\}\_\{i\}\\in B\(\\hat\{\\mathbf\{X\}\}\_\{i\},r\), the trajectoryYo​p​t=arg⁡minY∈f​\(𝒳\)​D​\(Y,Y0\)Y\_\{opt\}=\\underset\{Y\\in f\(\\mathcal\{X\}\)\}\{\\arg\\min\}~D\(Y,Y\_\{0\}\)satisfiesD​\(Yo​p​t,Y0\)≤sD\(Y\_\{opt\},Y\_\{0\}\)\\leq s\.

## 3Method

### 3\.1Smoothed Method and Robustness Guarantee

Randomized smoothing\[[8](https://arxiv.org/html/2606.28716#bib.bib152)\]is a black\-box technique that converts a base functionffinto a certifiably robust smoothed functionggby injecting Gaussian noise into the inputxxand returning the most likely output offf\. For the two robustness notions in[Sec\.2\.2](https://arxiv.org/html/2606.28716#S2.SS2), we define two smoothed modelsgOg\_\{O\}\(optimal prediction\) andgAg\_\{A\}\(all predictions\)\. Let𝒳=Vec​\(𝐗0,…,𝐗N\)\\mathcal\{X\}=\\mathrm\{Vec\}\(\\mathbf\{X\}\_\{0\},\\ldots,\\mathbf\{X\}\_\{N\}\),ε∼𝒩​\(0,σ2​I\)\\varepsilon\\sim\\mathcal\{N\}\(0,\\sigma^\{2\}I\), distance metricDD, ground truthY0Y\_\{0\}, and safety thresholdss\. Define the events

ℰO:D​\(Yopt,Y0\)≤s,Yopt=arg⁡minY∈f​\(𝒳\+ε\)⁡D​\(Y,Y0\),\\mathcal\{E\}\_\{O\}:\\;D\(Y\_\{\\mathrm\{opt\}\},Y\_\{0\}\)\\leq s,\\quad Y\_\{\\mathrm\{opt\}\}=\\arg\\min\_\{Y\\in f\(\\mathcal\{X\}\+\\varepsilon\)\}D\(Y,Y\_\{0\}\),ℰA:∀Y∈f​\(𝒳\+ε\),D​\(Y,Y0\)≤s\.\\mathcal\{E\}\_\{A\}:\\;\\forall\\,Y\\in f\(\\mathcal\{X\}\+\\varepsilon\),\\;D\(Y,Y\_\{0\}\)\\leq s\.Letpm=ℙ​\(ℰm\)p\_\{m\}=\\mathbb\{P\}\(\\mathcal\{E\}\_\{m\}\)form∈\{O,A\}m\\in\\\{O,A\\\}\. We set

gm​\(𝒳\)=\{1,if​pm≥12,0,otherwise\.g\_\{m\}\(\\mathcal\{X\}\)=\\begin\{cases\}1,&\\text\{if \}p\_\{m\}\\geq\\tfrac\{1\}\{2\},\\\\ 0,&\\text\{otherwise\.\}\\end\{cases\}\\vskip\-8\.53581pt\(1\)
###### Theorem 3\(Robustness Guarantee\)\.

Form∈\{O,A\}m\\in\\\{O,A\\\}, suppose there existsp¯m∈\(12,1\]\\underline\{p\}\_\{m\}\\in\(\\tfrac\{1\}\{2\},1\]such that:

pm=ℙ​\(ℰm\)≥p¯m\.p\_\{m\}=\\mathbb\{P\}\(\\mathcal\{E\}\_\{m\}\)\\geq\\underline\{p\}\_\{m\}\.\(2\)Then, for all perturbationsδ\\deltawith∥δ∥2≤Rm\\lVert\\delta\\rVert\_\{2\}\\leq R\_\{m\}, we havegm​\(𝒳\+δ\)=1g\_\{m\}\(\\mathcal\{X\}\+\\delta\)=1, where

Rm=σ​Φ−1​\(p¯m\),R\_\{m\}=\\sigma\\,\\Phi^\{\-1\}\(\\underline\{p\}\_\{m\}\),\(3\)andΦ−1\\Phi^\{\-1\}is the standard normal quantile\.

In practice we estimate a one\-sided lower confidence boundp¯m\\underline\{p\}\_\{m\}\(via binomial inference\), and all certificates remain valid whenpmp\_\{m\}is replaced by this lower bound\. We may find out that: leveraging randomized smoothing’s black\-box nature, our smoothing approach applies universally to prediction models, furnishing precise robustness guarantees\. Note that Gaussian noise is used during smoothing and influences how the certifiable robust radius is calculated \([Eq\.3](https://arxiv.org/html/2606.28716#S3.E3)\), but the resulting smoothed model is robust againstany perturbationwithin the certifiable robust radius, regardless of distribution\.

### 3\.2Practical Algorithm

We evaluategO​\(𝒳\)g\_\{O\}\(\\mathcal\{X\}\)andgA​\(𝒳\)g\_\{A\}\(\\mathcal\{X\}\)with a single Monte Carlo procedure that estimates a one\-sided\(1−α\)\(1\-\\alpha\)lower boundp¯\\underline\{p\}on the safety probability and maps it to a certified radiusR=σ​Φ−1​\(p¯\)R=\\sigma\\,\\Phi^\{\-1\}\(\\underline\{p\}\), as shown in[Algorithm1](https://arxiv.org/html/2606.28716#alg1)\. The two variants differ in \(i\) how the representative prediction is chosen and \(ii\) the certification statistic\.

Algorithm 1Evaluation & certification forgOg\_\{O\}andgAg\_\{A\}0:Past trajectories

𝒳=\(𝐗0,…,𝐗N\)\\mathcal\{X\}=\(\\mathbf\{X\}\_\{0\},\\ldots,\\mathbf\{X\}\_\{N\}\), ground\-truth

Y0Y\_\{0\}, safety threshold

ss; base predictor

ff; number of perturbations

nn; Gaussian noise std\.

σ\\sigma; significance

α\\alpha; evaluation metric

DD\(e\.g\., ADE\);mode

m∈\{𝖮,𝖠\}m\\\!\\in\\\!\\\{\\mathsf\{O\},\\mathsf\{A\}\\\}\.

0:If

m=𝖮m\{=\}\\mathsf\{O\}: best\-of\-

kksize

kk\. If

m=𝖠m\{=\}\\mathsf\{A\}: per\-input draws

npn\_\{p\}and target per\-input safety level

τ\\tau\(default

τ=0\.99\\tau\{=\}0\.99\)\.

0:Prediction

Y^\\widehat\{Y\}and certified radius

RR\(or “cannot certify”\)\.

0:

1:For

i=1:ni\{=\}1\{:\}n: sample

εi∼𝒩​\(0,σ2​I\)\\varepsilon\_\{i\}\\sim\\mathcal\{N\}\(0,\\sigma^\{2\}I\)and set

𝒳i=𝒳\+εi\\mathcal\{X\}\_\{i\}=\\mathcal\{X\}\+\\varepsilon\_\{i\}\.

2:If

m=𝖮m\{=\}\\mathsf\{O\}thengenerate

kkpredictions

\{Yi​j\}j=1k←f​\(𝒳i\)\\\{Y\_\{ij\}\\\}\_\{j=1\}^\{k\}\\leftarrow f\(\\mathcal\{X\}\_\{i\}\);else\(

m=𝖠m\{=\}\\mathsf\{A\}\) generate

npn\_\{p\}predictions

\{Yi​j\}j=1np←f​\(𝒳i\)\\\{Y\_\{ij\}\\\}\_\{j=1\}^\{n\_\{p\}\}\\leftarrow f\(\\mathcal\{X\}\_\{i\}\)\.

3:Let

𝒮=\{Yi​j\}\\mathcal\{S\}=\\\{Y\_\{ij\}\\\}over all

iiand

jj\.

4:Representative selection:

5:If

m=𝖮m\{=\}\\mathsf\{O\}: cluster

𝒮\\mathcal\{S\}into

kkgroups by K\-medoids \(K=

kk\); set

Y^\\widehat\{Y\}to the cluster medoid whose medoid is closest to

Y0Y\_\{0\}under

DD\(best\-of\-

kkamong medoids\)\.

6:If

m=𝖠m\{=\}\\mathsf\{A\}: compute the K\-medoids medoid of

𝒮\\mathcal\{S\}with K=

11and set

Y^\\widehat\{Y\}to this medoid\.

6:

7:If

m=𝖮m\{=\}\\mathsf\{O\}:

8:For each

ii, let

Yiopt=arg⁡minj⁡D​\(Yi​j,Y0\)Y^\{\\mathrm\{opt\}\}\_\{i\}=\\arg\\min\_\{j\}D\(Y\_\{ij\},Y\_\{0\}\); set

nsafe=∑i=1n𝕀​\(D​\(Yiopt,Y0\)≤s\)n\_\{\\mathrm\{safe\}\}=\\sum\_\{i=1\}^\{n\}\\mathbb\{I\}\\\!\\left\(D\(Y^\{\\mathrm\{opt\}\}\_\{i\},Y\_\{0\}\)\\leq s\\right\)\.

9:

p¯=LOWERCONFBOUND​\(nsafe,n,1−α\)\\underline\{p\}=\\mathrm\{LOWERCONFBOUND\}\(n\_\{\\mathrm\{safe\}\},n,1\{\-\}\\alpha\)\.

10:Else\(

m=𝖠m\{=\}\\mathsf\{A\}\):

11:For each

ii, let

ci=∑j𝕀​\(D​\(Yi​j,Y0\)≤s\)c\_\{i\}=\\sum\_\{j\}\\mathbb\{I\}\\\!\\left\(D\(Y\_\{ij\},Y\_\{0\}\)\\leq s\\right\)and

qi=LOWERCONFBOUND​\(ci,np,1−α\)q\_\{i\}=\\mathrm\{LOWERCONFBOUND\}\(c\_\{i\},\\,n\_\{p\},\\,1\{\-\}\\alpha\)\.

12:Mark

iisafe if

qi≥τq\_\{i\}\\geq\\tau; let

nsafe=∑i=1n𝕀​\(qi≥τ\)n\_\{\\mathrm\{safe\}\}=\\sum\_\{i=1\}^\{n\}\\mathbb\{I\}\(q\_\{i\}\\geq\\tau\); set

p¯=LOWERCONFBOUND​\(nsafe,n,1−α\)\\underline\{p\}=\\mathrm\{LOWERCONFBOUND\}\(n\_\{\\mathrm\{safe\}\},n,1\{\-\}\\alpha\)\.

13:If

p¯≤12\\underline\{p\}\\leq\\tfrac\{1\}\{2\}or

D​\(Y^,Y0\)\>sD\(\\widehat\{Y\},Y\_\{0\}\)\>sthenreturn “cannot certify”;elsereturn

Y^\\widehat\{Y\}and

R=σ​Φ−1​\(p¯\)R=\\sigma\\,\\Phi^\{\-1\}\(\\underline\{p\}\)\.

Notes\.We use K\-medoids for representative selection to remain robust to outliers and to avoid averaging artifacts that may distort physically plausible trajectories \(compared to K\-means\)\[[30](https://arxiv.org/html/2606.28716#bib.bib386)\]\.LOWERCONFBOUND\\mathrm\{LOWERCONFBOUND\}denotes a one\-sided\(1−α\)\(1\{\-\}\\alpha\)binomial lower confidence bound \(e\.g\., Clopper–Pearson\), andΦ−1\\Phi^\{\-1\}is the standard normal quantile\.

## 4Experiments

We evaluate TrajRS on two benchmarks: ETH/UCY\[[23](https://arxiv.org/html/2606.28716#bib.bib134),[18](https://arxiv.org/html/2606.28716#bib.bib135)\]and Stanford Drone Dataset \(SDD\)\[[25](https://arxiv.org/html/2606.28716#bib.bib150)\], using88past steps \(0\.40\.4s each\) to predict the next1212\[[27](https://arxiv.org/html/2606.28716#bib.bib84)\]\. Experiments cover four representative models: Trajectron\+\+\[[27](https://arxiv.org/html/2606.28716#bib.bib84)\], AgentFormer\[[34](https://arxiv.org/html/2606.28716#bib.bib86)\], MemoNet\[[32](https://arxiv.org/html/2606.28716#bib.bib90)\], and MID\[[10](https://arxiv.org/html/2606.28716#bib.bib60)\]\. The most commonly used evaluation metrics—Average Displacement Error \(ADE\) and Final Displacement Error \(FDE\)\[[2](https://arxiv.org/html/2606.28716#bib.bib148),[1](https://arxiv.org/html/2606.28716#bib.bib45),[11](https://arxiv.org/html/2606.28716#bib.bib73),[20](https://arxiv.org/html/2606.28716#bib.bib78)\]—are employed with a best\-of\-kkminimum ADE/FDE setting \(k=20k\{=\}20\)\[[11](https://arxiv.org/html/2606.28716#bib.bib73),[26](https://arxiv.org/html/2606.28716#bib.bib74),[27](https://arxiv.org/html/2606.28716#bib.bib84),[24](https://arxiv.org/html/2606.28716#bib.bib146)\]\. Due to space, we report ADE in the main text; across all settings, FDE exhibits the same trends as ADE\.

### 4\.1Robustness for the Optimal Prediction

We evaluate the pre\-trained models on a randomly selected subset of500500samples from both the ETH/UCY and SDD datasets, due to the time required for sampling\. To account for unit differences \(meters vs\. pixels\), we apply dataset\-specific noise levels:σ∈\{0\.1,0\.4,0\.7,1\.0\}\\sigma\\in\\\{0\.1,0\.4,0\.7,1\.0\\\}for ETH/UCY andσ∈\{1,4,7,10\}\\sigma\\in\\\{1,4,7,10\\\}for SDD, with safety thresholds ofs=2s=2\(ETH/UCY\) ands=50s=50\(SDD\)\. Each model usesn=104n=10^\{4\}Monte Carlo samples with significance levelα=0\.001\\alpha=0\.001\.

![Refer to caption](https://arxiv.org/html/2606.28716v1/x3.png)Fig\. 3:Certified safety rates \(ADE metric\) for smoothed MID, AgentFormer, Trajectron\+\+, and MemoNet on the ETH/UCY dataset, and smoothed MID and MemoNet on the SDD dataset\.ETH/UCYBase modelσ=0\.1\\sigma\{=\}0\.1σ=0\.4\\sigma\{=\}0\.4σ=0\.7\\sigma\{=\}0\.7σ=1\.0\\sigma\{=\}1\.0Traj\+\+0\.290\.280\.270\.270\.26AgentFormer0\.280\.140\.260\.350\.41MID0\.270\.210\.210\.220\.21MemoNet0\.210\.230\.390\.540\.59SDDBase modelσ=1\\sigma\{=\}1σ=4\\sigma\{=\}4σ=7\\sigma\{=\}7σ=10\\sigma\{=\}10MID5\.878\.567\.066\.175\.94MemoNet5\.586\.345\.976\.626\.75

Table 1:Quantitative prediction results for different base models and their smoothed models \(several noise levels\) on the ETH/UCY \(top\) and SDD \(bottom\) datasets with best\-of\-20 strategy in ADE metric\. Lower is better\.Prediction performance\.[Table1](https://arxiv.org/html/2606.28716#S4.T1)compares ADE of smoothed models at different noise levels with base models\. Moderate noise \(σ\\sigma\) slightly affects or even improves accuracy for Trajectron\+\+ and MID; larger noise degrades AgentFormer and MemoNet, reflecting an accuracy–robustness trade\-off\. The gains at low–medium noise likely stem from the clustering operation, which reduces the randomness of predictions that deviate significantly from the ground truth\.

Certification performance\.We define the Certified Safety Rate \(CSR\), analogous to certified accuracy\[[8](https://arxiv.org/html/2606.28716#bib.bib152)\], as the proportion of test samples safely predicted within a certifiably robustL2L\_\{2\}radiusrr:

CSR\(r\)=1n∑i=1n\[𝕀\(CR\(𝒳i\)\\displaystyle\\mathrm\{CSR\}\(r\)=\\frac\{1\}\{n\}\\sum\_\{i=1\}^\{n\}\[\\mathbb\{I\}\(\\mathrm\{CR\}\(\\mathcal\{X\}\_\{i\}\)⩾r\)𝕀\(D\(𝒳i\)⩽s\)\],\\displaystyle\\geqslant r\)\\mathbb\{I\}\(\\mathrm\{D\}\(\\mathcal\{X\}\_\{i\}\)\\leqslant s\)\],\(4\)𝒳i∈\(𝒳1,…,𝒳n\),\\displaystyle\\mathcal\{X\}\_\{i\}\\in\\left\(\\mathcal\{X\}\_\{1\},\\ldots,\\mathcal\{X\}\_\{n\}\\right\),whereCR​\(𝒳i\)\\mathrm\{CR\}\(\\mathcal\{X\}\_\{i\}\)is the certified radius of modelggin𝒳i\\mathcal\{X\}\_\{i\}andD\\mathrm\{D\}is the minimum ADE/FDE in\[[11](https://arxiv.org/html/2606.28716#bib.bib73),[26](https://arxiv.org/html/2606.28716#bib.bib74),[27](https://arxiv.org/html/2606.28716#bib.bib84),[24](https://arxiv.org/html/2606.28716#bib.bib146)\], with safety thresholdss\.

[Figure3](https://arxiv.org/html/2606.28716#S4.F3)shows CSR \(ADE\) curves that decline gradually with radiusrrand then drop sharply at the certification limit determined byσ\\sigmaandnn\[[8](https://arxiv.org/html/2606.28716#bib.bib152)\]\. We also apply PGD attacks\[[21](https://arxiv.org/html/2606.28716#bib.bib137)\]to estimate empirical CSR upper bounds for the original models, depicted as dashed black lines in[Figure3](https://arxiv.org/html/2606.28716#S4.F3)\(left\)\. Smoothed models remain above these bounds until the sharp drop\.

Conclusion 1:Smoothing a model does enhance its robustness in our case studies, measured as CSR\. It does not lead to a severe decline in prediction accuracy, measured as ADE/FDE\.

Each subplot in[Fig\.3](https://arxiv.org/html/2606.28716#S4.F3)illustrates that higher noise levels \(σ\\sigma\) lead to larger certifiable radii, with minor accuracy drops observed at smaller radii across different smoothed models\. Additional ablation studies on the parametersss,α\\alpha, andnnshow that varyingssdoes not affect the observed robustness–accuracy trade\-off or the advantage of smoothing\. CSR is largely insensitive toα\\alpha\. Largernnprimarily extends the maximal certifiable radius\. As for efficiency, TrajRS is competitive with mainstream verification methods like\[[35](https://arxiv.org/html/2606.28716#bib.bib23)\]\.

Conclusion 2:TrajRS demonstrates scalable verification of robustness in various prediction models, offering a flexible trade\-off between accuracy and robustness by adjusting noise levels\. The adaptability ensures it meets verification demands for varying confidence levels and safety thresholds in different scenarios\.

SceneIDSmoothed Models=2s=2s=3s=3s=4s=4s=5s=5Trajectron\+\+0\.730\.730\.730\.73hotel\(7550, 157\)AgentFormer\-0\.250\.480\.70MID0\.730\.730\.730\.73MemoNet\-0\.170\.380\.56SceneIDSmoothed Models=40s=40s=50s=50s=60s=60s=70s=70quad\_0\(84, 5\)MID4\.396\.607\.297\.29

Table 2:Certified robustness radii for various smoothed models \(ADE metric\) under the criterion of “robustness for all possible predictions” on samples from ETH/UCY \(top\) and SDD \(bottom\)\. A “\-” denotes the model’s inability to provide a certified robustness radius in the given context\.
### 4\.2Robustness for All Possible Predictions

Following the setup in\[[35](https://arxiv.org/html/2606.28716#bib.bib23)\], we selected specific trajectories from ETH/UCY \(Trajectron\+\+, MemoNet, MID, AgentFormer;σ=0\.3\\sigma=0\.3\) and SDD \(MID;σ=3\\sigma=3\), identified by \(frame ID, person ID\)\. We usedn=np=1000n=n\_\{p\}=1000and significance levelα=0\.001\\alpha=0\.001\.

[Table2](https://arxiv.org/html/2606.28716#S4.T2)summarizes ADE results across various safety thresholds\. TrajRS successfully provides certifiable robustness radii, which generally increase with higher safety thresholds until reaching theoretical limits determined by noise level \(σ\\sigma\) and sample size \(nn\)\. Conversely, lower safety thresholds present certification challenges due to the multimodal nature of predictions and may require larger sample sizes\. These results suggest that validating robustness for all possible predictions is more effectively conducted under scenarios with higher safety thresholds\.

Conclusion 3:When the required safety distance is not particularly small, our method is highly effective at verifying robustness for all possible predictions across different models, providing the corresponding robust radius for each model\.

## 5Conclusion

In this study, we extend the formal notion of robustness to trajectory prediction and propose TrajRS, a certifiable framework for smoothing\-based robust prediction\. TrajRS enhances robustness of existing models, offering certified guarantees under input perturbations\. Extensive experiments validate its effectiveness\. Future work will explore applying TrajRS to improve the robustness and safety of autonomous vehicles in real\-world scenarios\.

## References

- \[1\]\(2016\)Social lstm: human trajectory prediction in crowded spaces\.InCVPR,pp\. 961–971\.Cited by:[§2\.2](https://arxiv.org/html/2606.28716#S2.SS2.p3.2),[§2\.2](https://arxiv.org/html/2606.28716#S2.SS2.p4.2),[§4](https://arxiv.org/html/2606.28716#S4.p1.5)\.
- \[2\]A\. Alahi, V\. Ramanathan, and L\. Fei\-Fei\(2014\)Socially\-aware large\-scale crowd forecasting\.InCVPR,pp\. 2203–2210\.Cited by:[§2\.2](https://arxiv.org/html/2606.28716#S2.SS2.p3.2),[§2\.2](https://arxiv.org/html/2606.28716#S2.SS2.p4.2),[§4](https://arxiv.org/html/2606.28716#S4.p1.5)\.
- \[3\]A\. Athalye, N\. Carlini, and D\. Wagner\(2018\)Obfuscated gradients give a false sense of security: circumventing defenses to adversarial examples\.InICML,pp\. 274–283\.Cited by:[§1](https://arxiv.org/html/2606.28716#S1.p2.1)\.
- \[4\]I\. Bae, J\. Park, and H\. Jeon\(2022\)Non\-probability sampling network for stochastic human trajectory prediction\.InCVPR,pp\. 6477–6487\.Cited by:[§1](https://arxiv.org/html/2606.28716#S1.p1.1)\.
- \[5\]M\. Bahari, S\. Saadatnejad, A\. Askari Farsangi,et al\.\(2025\)Certified human trajectory prediction\.InCVPR,Cited by:[§1](https://arxiv.org/html/2606.28716#S1.p6.1)\.
- \[6\]Y\. Cao, C\. Xiao, A\. Anandkumar,et al\.\(2022\)Advdo: realistic adversarial attacks for trajectory prediction\.InECCV,pp\. 36–52\.Cited by:[§1](https://arxiv.org/html/2606.28716#S1.p1.1),[§2\.2](https://arxiv.org/html/2606.28716#S2.SS2.p4.2)\.
- \[7\]K\. Chen, X\. Zhao, Y\. Huang, G\. Fang, X\. Song, R\. Wang, and Z\. Wang\(2025\)SocialMOIF: multi\-order intention fusion for pedestrian trajectory prediction\.InCVPR,pp\. 22465–22475\.Cited by:[§1](https://arxiv.org/html/2606.28716#S1.p1.1)\.
- \[8\]J\. Cohen, E\. Rosenfeld, and Z\. Kolter\(2019\)Certified adversarial robustness via randomized smoothing\.InICML,pp\. 1310–1320\.Cited by:[§1](https://arxiv.org/html/2606.28716#S1.p3.1),[§3\.1](https://arxiv.org/html/2606.28716#S3.SS1.p1.11),[§4\.1](https://arxiv.org/html/2606.28716#S4.SS1.p3.2),[§4\.1](https://arxiv.org/html/2606.28716#S4.SS1.p5.3)\.
- \[9\]Y\. Fu, Q\. Yan, L\. Wang, K\. Li, and R\. Liao\(2025\)MoFlow: one\-step flow matching for human trajectory forecasting via implicit maximum likelihood estimation based distillation\.InCVPR,pp\. 17282–17293\.Cited by:[§1](https://arxiv.org/html/2606.28716#S1.p1.1)\.
- \[10\]T\. Gu, G\. Chen, J\. Li,et al\.\(2022\)Stochastic trajectory prediction via motion indeterminacy diffusion\.InCVPR,pp\. 17113–17122\.Cited by:[§2\.1](https://arxiv.org/html/2606.28716#S2.SS1.p2.3),[§4](https://arxiv.org/html/2606.28716#S4.p1.5)\.
- \[11\]A\. Gupta, J\. Johnson, L\. Fei\-Fei,et al\.\(2018\)Social gan: socially acceptable trajectories with generative adversarial networks\.InCVPR,pp\. 2255–2264\.Cited by:[§2\.2](https://arxiv.org/html/2606.28716#S2.SS2.p3.2),[§2\.2](https://arxiv.org/html/2606.28716#S2.SS2.p4.2),[§4\.1](https://arxiv.org/html/2606.28716#S4.SS1.p4.5),[§4](https://arxiv.org/html/2606.28716#S4.p1.5)\.
- \[12\]B\. Hu and T\. Cham\(2025\)TSC\-net: prediction of pedestrian trajectories by trajectory\-scene\-cell classification\.InICLR,Cited by:[§1](https://arxiv.org/html/2606.28716#S1.p1.1)\.
- \[13\]J\. Jeong, S\. Lee, D\. Park, G\. Lee, and K\. Yoon\(2025\)Multi\-modal knowledge distillation\-based human trajectory forecasting\.InCVPR,pp\. 24222–24233\.Cited by:[§1](https://arxiv.org/html/2606.28716#S1.p1.1)\.
- \[14\]R\. Jiao, X\. Liu, T\. Sato,et al\.\(2023\)Semi\-supervised semantics\-guided adversarial training for robust trajectory prediction\.InICCV,pp\. 8207–8217\.Cited by:[§1](https://arxiv.org/html/2606.28716#S1.p2.1)\.
- \[15\]G\. Jin, X\. Yi, W\. Huang, S\. Schewe, and X\. Huang\(2025\)S2O: enhancing adversarial training with second\-order statistics of weights\.IEEE Transactions on Pattern Analysis and Machine Intelligence\.Cited by:[§1](https://arxiv.org/html/2606.28716#S1.p3.1)\.
- \[16\]G\. Jin, X\. Yi, and X\. Huang\(2025\)Reconcile certified robustness and accuracy for dnn\-based smoothed majority vote classifier\.arXiv preprint arXiv:2509\.25979\.Cited by:[§1](https://arxiv.org/html/2606.28716#S1.p3.1)\.
- \[17\]M\. Lecuyer, V\. Atlidakis, R\. Geambasu,et al\.\(2019\)Certified robustness to adversarial examples with differential privacy\.In2019 IEEE Symposium on Security and Privacy \(SP\),pp\. 656–672\.Cited by:[§1](https://arxiv.org/html/2606.28716#S1.p3.1)\.
- \[18\]A\. Lerner, Y\. Chrysanthou, and D\. Lischinski\(2007\)Crowds by example\.InComputer graphics forum,pp\. 655–664\.Cited by:[§4](https://arxiv.org/html/2606.28716#S4.p1.5)\.
- \[19\]B\. Li, C\. Chen, W\. Wang,et al\.\(2019\)Certified adversarial robustness with additive noise\.Advances in neural information processing systems\.Cited by:[§1](https://arxiv.org/html/2606.28716#S1.p3.1)\.
- \[20\]J\. Li, H\. Ma, and M\. Tomizuka\(2019\)Conditional generative neural system for probabilistic trajectory prediction\.InIROS,pp\. 6150–6156\.Cited by:[§2\.2](https://arxiv.org/html/2606.28716#S2.SS2.p3.2),[§2\.2](https://arxiv.org/html/2606.28716#S2.SS2.p4.2),[§4](https://arxiv.org/html/2606.28716#S4.p1.5)\.
- \[21\]A\. Madry, A\. Makelov, L\. Schmidt,et al\.\(2017\)Towards deep learning models resistant to adversarial attacks\.arXiv preprint arXiv:1706\.06083\.Cited by:[§4\.1](https://arxiv.org/html/2606.28716#S4.SS1.p5.3)\.
- \[22\]A\. Mohamed, K\. Qian, M\. Elhoseiny,et al\.\(2020\)Social\-stgcnn: a social spatio\-temporal graph convolutional neural network for human trajectory prediction\.InCVPR,pp\. 14424–14432\.Cited by:[§1](https://arxiv.org/html/2606.28716#S1.p1.1)\.
- \[23\]S\. Pellegrini, A\. Ess, K\. Schindler, and L\. V\. Gool\(2009\)You’ll never walk alone: modeling social behavior for multi\-target tracking\.InICCV,pp\. 261–268\.Cited by:[§4](https://arxiv.org/html/2606.28716#S4.p1.5)\.
- \[24\]T\. Phan\-Minh, E\. C\. Grigore, F\. A\. Boulton,et al\.\(2020\)Covernet: multimodal behavior prediction using trajectory sets\.InCVPR,pp\. 14074–14083\.Cited by:[§4\.1](https://arxiv.org/html/2606.28716#S4.SS1.p4.5),[§4](https://arxiv.org/html/2606.28716#S4.p1.5)\.
- \[25\]A\. Robicquet, A\. Sadeghian, A\. Alahi,et al\.\(2016\)Learning social etiquette: human trajectory understanding in crowded scenes\.InECCV,pp\. 549–565\.Cited by:[§4](https://arxiv.org/html/2606.28716#S4.p1.5)\.
- \[26\]A\. Sadeghian, V\. Kosaraju, A\. Sadeghian,et al\.\(2019\)Sophie: an attentive gan for predicting paths compliant to social and physical constraints\.InCVPR,pp\. 1349–1358\.Cited by:[§4\.1](https://arxiv.org/html/2606.28716#S4.SS1.p4.5),[§4](https://arxiv.org/html/2606.28716#S4.p1.5)\.
- \[27\]T\. Salzmann, B\. Ivanovic, P\. Chakravarty,et al\.\(2020\)Trajectron\+\+: dynamically\-feasible trajectory forecasting with heterogeneous data\.InECCV,pp\. 683–700\.Cited by:[§2\.1](https://arxiv.org/html/2606.28716#S2.SS1.p2.3),[§4\.1](https://arxiv.org/html/2606.28716#S4.SS1.p4.5),[§4](https://arxiv.org/html/2606.28716#S4.p1.5)\.
- \[28\]H\. Shao, L\. Wang, and J\. Yan\(2023\)Robustness certification for structured prediction with general inputs via safe region modeling in the semimetric output space\.InKDD,pp\. 2010–2022\.Cited by:[§1](https://arxiv.org/html/2606.28716#S1.p3.1)\.
- \[29\]J\. Sun, Y\. Li, L\. Chai, and C\. Lu\(2025\)Interactive adjustment for human trajectory prediction with individual feedback\.InICLR,Cited by:[§1](https://arxiv.org/html/2606.28716#S1.p1.1)\.
- \[30\]T\. Velmurugan and T\. Santhanam\(2010\)Computational complexity between k\-means and k\-medoids clustering algorithms for normal and uniform distributions of data points\.Journal of computer science,pp\. 363\.Cited by:[§3\.2](https://arxiv.org/html/2606.28716#S3.SS2.p2.3)\.
- \[31\]Z\. Wang, G\. Jin, J\. Hu, and R\. Mu\(2025\)CluCERT: certifying llm robustness via clustering\-guided denoising smoothing\.arXiv preprint arXiv:2512\.08967\.Cited by:[§1](https://arxiv.org/html/2606.28716#S1.p3.1)\.
- \[32\]C\. Xu, W\. Mao, W\. Zhang,et al\.\(2022\)Remember intentions: retrospective\-memory\-based trajectory prediction\.InCVPR,pp\. 6488–6497\.Cited by:[§4](https://arxiv.org/html/2606.28716#S4.p1.5)\.
- \[33\]Y\. Yu, W\. Han, L\. Wu, B\. Liu, E\. Wang, and Z\. Zhang\(2025\)Enduring, efficient and robust trajectory prediction attack in autonomous driving via optimization\-driven multi\-frame perturbation framework\.InCVPR,pp\. 17229–17238\.Cited by:[§1](https://arxiv.org/html/2606.28716#S1.p1.1)\.
- \[34\]Y\. Yuan, X\. Weng, Y\. Ou,et al\.\(2021\)Agentformer: agent\-aware transformers for socio\-temporal multi\-agent forecasting\.InICCV,pp\. 9813–9823\.Cited by:[§2\.2](https://arxiv.org/html/2606.28716#S2.SS2.p4.2),[§4](https://arxiv.org/html/2606.28716#S4.p1.5)\.
- \[35\]L\. Zhang, N\. Xu, P\. Yang,et al\.\(2023\)TrajPAC: towards robustness verification of pedestrian trajectory prediction models\.InICCV,pp\. 8327–8339\.Cited by:[§1](https://arxiv.org/html/2606.28716#S1.p6.1),[§2\.2](https://arxiv.org/html/2606.28716#S2.SS2.p1.1),[§4\.1](https://arxiv.org/html/2606.28716#S4.SS1.p7.7),[§4\.2](https://arxiv.org/html/2606.28716#S4.SS2.p1.4)\.
- \[36\]Q\. Zhang, S\. Hu, J\. Sun,et al\.\(2022\)On adversarial robustness of trajectory prediction for autonomous vehicles\.InCVPR,pp\. 15159–15168\.Cited by:[§1](https://arxiv.org/html/2606.28716#S1.p2.1)\.
- \[37\]Z\. Zheng, X\. Ying, Z\. Yao,et al\.\(2023\)Robustness of trajectory prediction models under map\-based attacks\.InWACV,pp\. 4541–4550\.Cited by:[§1](https://arxiv.org/html/2606.28716#S1.p1.1)\.