Confrontation trajectory prediction method, readable storage medium, electronic equipment and vehicle

Abstract

The invention discloses a confrontation trajectory prediction method, a readable storage medium, electronic equipment and a vehicle, and belongs to the field of automatic driving. The prediction method comprises the following steps: constructing a trajectory prediction model; inputting a historical track, a real track and environment context information; track features are obtained through feature extraction and a space-time attention mechanism; constructing a confrontation model of the explicit space; mapping the track features to a submerged space; disturbance is carried out on the submerged vectors, and the submerged vectors are regularized to specific distribution; and mapping the latent vector to the explicit space, and generating a confrontation trajectory of the target driving vehicle. The readable storage medium stores a program of the method. A program including the method is stored in the electronic equipment. The vehicle comprises the intelligent system for executing the method. According to the method, the explicit space and the implicit space are emphasized for multi-space collaborative optimization, the pertinence and the real concealment of attacks are remarkably improved, the prediction precision is improved, and then the target driving vehicle track can resist surrounding vehicles and cope with complex vehicle conditions.

Description

Technical Field

[0001] The present application belongs to the field of autonomous driving technology, and in particular relates to an adversarial trajectory prediction method, a readable storage medium, an electronic device, and a vehicle. Background Art

[0002] In autonomous driving systems, the trajectory prediction module is crucial. It accurately predicts the future trajectories of nearby road users, providing support for planning and navigation. Accurately predicting the future trajectories of nearby road users is crucial for autonomous vehicles.

[0003] With the continuous development of basic model technologies such as large models, the basic models of autonomous driving trajectory prediction have also shown remarkable results. However, these neural network-based prediction methods are vulnerable to adversarial attacks, which seriously challenges the reliability and security of trajectory prediction.

[0004] Therefore, an improved adversarial trajectory prediction method is expected. Summary of the Invention

[0005] Deep learning models are often vulnerable to adversarial attacks. In the field of autonomous vehicles, many studies have investigated the impact of attacks on perception modules. In recent years, adversarial attacks against trajectory prediction models have received widespread attention. Zhang et al. first proposed a search-based attack method, which validates model robustness by imposing hard constraints (such as velocity and acceleration) and clearly defines the threat that adversarial attacks pose to prediction security. Cao et al. designed a "deterministic attack" against probabilistic generative models, eliminating randomness in the attack by replacing random sampling with maximum likelihood samples, significantly improving the effectiveness of attacks against conditional Gaussian prior models. Cao et al. further constructed a two-stage framework, first densifying sparse trajectory points to calculate dynamic parameters, and then generating adversarial trajectories that comply with kinematic constraints through PGD, enhancing the physical plausibility of the attack. Tan et al. proposed the TA4TP targeted attack method, which quantifies prediction bias through an objective function to accurately misdirect specific driving behaviors (such as lane changes and steering).

[0006] In recent years, data-driven trajectory prediction models have made significant progress using deep neural networks, achieving impressive performance on motion prediction benchmarks. However, these deep neural network-based trajectory models are vulnerable to adversarial attacks, which can cause attackers to mislead model predictions through perturbations, posing safety risks. Therefore, research on the robustness of trajectory prediction models is urgent. Ideal adversarial trajectories must be both stealthy and aggressive. Stealthiness requires them to adhere to physical laws and be consistent with current road and environmental conditions; aggressiveness means they can significantly mislead the target vehicle's trajectory prediction module, forcing it to perform safe maneuvers such as emergency braking or lane changes. With the rapid development of deep neural networks, trajectory prediction technologies based on deep learning have become a research hotspot in the field of autonomous driving. These methods significantly improve prediction accuracy by taking the agent's historical spatial coordinates as input and incorporating multi-dimensional information such as map semantic features, physical motion constraints, and inter-agent interactions. VectorNet, a hierarchical graph neural network architecture, aggregates spatial information from vectorized map features and trajectories through local subgraphs. It then models high-level semantic relationships using a global interaction graph and introduces a node completion task to enhance contextual understanding. This approach achieves higher performance on the Argoverse dataset with lower model parameters. The TNT framework innovatively decomposes trajectory prediction into three stages: discrete target prediction, conditional trajectory generation, and trajectory score selection. It captures multimodal intentions through explicit target modeling, avoiding the uninterpretability and sampling dependence of traditional latent variable models, and surpasses previous methods in both vehicle and pedestrian trajectory prediction tasks.

[0007] These methods, based on explicit spatial perturbations, generate adversarial trajectories that do not conform to real-world rules and often rely on subsequent smoothing of the constraint space to ensure stealth. These artificially designed constraint spaces are difficult to model complex real-world rules, resulting in a trade-off between aggressiveness and stealth.

[0008] Furthermore, existing optimization objectives typically use Euclidean distance or lateral deviation to quantify the difference between predictions and ground truth. However, since AVs and TAs often reside in different lanes, this absolute distance, regardless of direction, may not accurately assess trajectory effectiveness. Although some models perform well on standard test sets, existing research shows that when faced with adversarial attacks, the model's prediction accuracy can still significantly degrade due to input perturbations, making existing autonomous driving models vulnerable to adversarial environments.

[0009] This application aims to at least to some extent solve the technical problem that the current autonomous driving model has a significant decrease in prediction accuracy when facing adversarial attacks. To this end, this application provides an adversarial trajectory prediction method, a readable storage medium, an electronic device and a vehicle, emphasizing multi-space collaborative optimization of explicit space and implicit space, significantly improving the targeting and realistic concealment of the attack, and improving the prediction accuracy, so that the target driving vehicle trajectory can be used to counter surrounding vehicles and cope with complex vehicle conditions.

[0010] It should be noted that:

[0011] The display space in this article refers to a space that represents objects, roads, lanes, and other elements in a scene through an explicit geometric model or data structure. In this representation, the position, shape, and posture of objects are directly represented and stored.

[0012] Example of explicit space: In map-based autonomous driving systems, maps typically explicitly store road information, including lane location, width, and curvature, as well as the locations of traffic signs and lights. This information is directly used by the autonomous vehicle's perception and planning modules to determine the vehicle's path and decision-making. Furthermore, some lidar-based object detection algorithms also explicitly detect and track objects in the scene, determining their position in space by directly measuring their distance and angle.

[0013] The implicit space described in this article is a space that implicitly represents scene information through mathematical functions or neural networks. In this representation, the elements in the space are not directly represented, but inferred or generated through the output of the function.

[0014] Implicit space example: Some deep learning-based image semantic segmentation algorithms can segment input images into different categories, such as roads, vehicles, pedestrians, etc. These algorithms typically use neural networks to learn features in the image and map them into different category spaces, rather than directly representing the position and shape of objects. In addition, some generative models such as variational autoencoders (VAE) or generative adversarial networks (GANs) can also learn implicit representations of images or scenes, generating new images or scenes by sampling and transforming vectors in the implicit space. In autonomous driving, the representation of the implicit space can be used for tasks such as scene understanding, prediction, and decision-making. For example, by learning a large number of driving scene images and corresponding driving behavior data, the model can find features and patterns related to safe driving in the implicit space, thereby making reasonable driving decisions.

[0015] In a first aspect, an embodiment of the present application provides an adversarial trajectory prediction method, which includes:

[0016] Build a trajectory prediction model and input the historical trajectories of surrounding vehicles, the actual trajectories of the target driving vehicle and surrounding vehicles, and environmental context information into the trajectory prediction model;

[0017] In the trajectory prediction model, which has been fed with the historical trajectories of surrounding vehicles, the actual trajectories of the target driving vehicle and surrounding vehicles, and environmental context information, feature extraction and spatiotemporal attention mechanism are used to obtain trajectory features that integrate lane context and spatiotemporal context.

[0018] Based on the path planning logic of the target driving vehicle, an explicit space adversarial model is constructed;

[0019] Mapping trajectory features to virtual space based on adversarial autoencoders, and using virtual space as latent space;

[0020] Implement semantic-level perturbations on latent vectors in different orthogonal modes in the latent space and regularize the latent vectors to a specific distribution;

[0021] The regularized latent vector is mapped back to the adversarial model in the explicit space to generate the adversarial trajectory of the target driving vehicle.

[0022] In some embodiments, obtaining trajectory features that fuse lane context and spatiotemporal context through feature extraction and spatiotemporal attention mechanism includes: using one-dimensional dilated convolution to obtain an embedded representation of the target driving vehicle trajectory, extracting the geometric structure features of the lane line and the spatiotemporal dynamic features of the historical trajectories of surrounding vehicles, modeling the interaction between the lane and the target driving vehicle and surrounding vehicles through a graph network, fusing the dynamic features of the lane context and spatiotemporal context, and outputting trajectory features.

[0023] In some embodiments, an explicit space adversarial model is constructed based on the path planning logic of the target driving vehicle, including: defining an interactive risk field for safe driving of the target driving vehicle; selecting a point on the center line of the lane in front of the target driving vehicle as the risk centroid of the interactive risk field to represent the core threat area of ​​the field; using the trajectory of the target driving vehicle after spatiotemporal interaction as input, constructing a reconstructed trajectory of the target driving vehicle when the trajectories of surrounding vehicles invade the interactive risk field.

[0024] In some embodiments, mapping trajectory features to a latent space based on an adversarial autoencoder involves mapping high-dimensional semantic features to a low-dimensional latent space and decoupling them into latent vector features under different orthogonal modes.

[0025] In some embodiments, the high-dimensional semantic features include:

[0026] Longitudinal features, presented as a one-dimensional vector, reflect the dynamic interaction of the target driving vehicle in the longitudinal direction by modeling the time interval when the target driving vehicle passes a given point, and obey a one-dimensional log-normal distribution;

[0027] The lateral features, which use three-dimensional vectors to model the steering intentions of the target driving vehicle, such as moving forward, turning left / left, or turning right / right, follow a categorical distribution; the remaining semantic features follow a Gaussian distribution.

[0028] In some embodiments, semantic-level perturbations are performed on latent vectors in different orthogonal modes in the latent space, and the latent vectors are regularized to a specific distribution, including: selecting corresponding orthogonal basis vectors according to the attack target; applying perturbations along the selected directions; calculating the divergence between the latent vector distribution after perturbation and the target distribution, and determining the latent vector distribution by minimizing the divergence.

[0029] In some embodiments, mapping the regularized latent vector back to the adversarial model in the explicit space to generate the adversarial trajectory of the target driving vehicle includes: taking the semantically perturbed latent vector as input; converting the perturbed latent vector into an explicit trajectory coordinate sequence in the explicit space through a decoder; and performing physical rule constraint verification on the coordinate sequence to obtain the adversarial trajectory.

[0030] In a second aspect, an embodiment of the present application provides a readable storage medium, which stores a terminal program. When the terminal program is executed, it performs the above-mentioned adversarial trajectory prediction method.

[0031] In a third aspect, an embodiment of the present application provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable in the processor, wherein the computer program comprises steps corresponding to the above-mentioned adversarial trajectory prediction method.

[0032] In a fourth aspect, an embodiment of the present application provides a vehicle, comprising a vehicle body and an intelligent system built into the vehicle body, wherein the intelligent system has a built-in program corresponding to executing the above-mentioned vehicle trajectory planning method.

[0033] It can be seen from the above technical solution that the beneficial effects of this application are:

[0034] 1. The adversarial trajectory prediction method of the present application, after constructing the trajectory prediction model, prepares relatively complete data through historical trajectories, real trajectories and environmental contexts, so as to couple multimodal data. By constructing an adversarial model of explicit space, it is possible to utilize the sensitivity of the drivable area of ​​modeling AV path planning (such as lane change decision points, following safety distance), directly generate adversarial trajectories for its decision-making vulnerabilities, map trajectory features to latent space based on the adversarial autoencoder, and then construct a threat model based on the adversarial autoencoder architecture. By applying semantic-level perturbations, the latent vectors under different orthogonal modes in the latent space can be semantically perturbed, so that the generated adversarial trajectory is aligned with the real trajectory distribution, and the trajectory can be described more accurately for prediction. This introduces an adversarial mechanism, significantly improving the pertinence and real concealment of the attack. By mapping the latent vector back to the explicit space, an adversarial trajectory that meets the adversarial threat is generated, significantly improving the pertinence and effectiveness of the attack. In this way, the present application emphasizes the multi-space collaborative optimization of explicit space and implicit space, significantly improving the pertinence and real concealment of the attack, improving the prediction accuracy, and then the target driving vehicle trajectory can be used to confront surrounding vehicles and cope with complex vehicle conditions.

[0035] 2. The readable storage medium of the present application compiles the above-mentioned adversarial trajectory prediction method into machine code for solidified storage, which facilitates the loading of the trajectory planning method, achieves zero parsing delay through direct memory mapping technology, and realizes lightweight encapsulation and rapid deployment of the generation algorithm of the above-mentioned adversarial trajectory prediction method.

[0036] 3. The electronic device of the present application, by configuring the trajectory planning method therein, facilitates the expanded application of the trajectory planning method and can conveniently load the trajectory planning technology into a vehicle.

[0037] 4. The vehicle of the present application, after being equipped with an intelligent system including the above-mentioned trajectory planning method, can cope with complex vehicle conditions, providing an important theoretical basis for building a safer autonomous driving system and improving the safety testing efficiency of the vehicle's autonomous driving. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following will briefly introduce the drawings required for the description of the embodiments. Obviously, the drawings described below are some embodiments of the present application. For those skilled in the art, other embodiments and drawings can be obtained based on these drawings without inventive work. The block diagrams shown in the drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities can be implemented in software, or in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0039] Figure 1 Schematic diagrams of two embodiments of the counter-attack scenario in the counter-trajectory prediction method of the present invention are shown;

[0040] Figure 2 A flow chart of the anti-trajectory prediction method of the present invention is provided;

[0041] Figure 3 A schematic diagram of an embodiment of the present invention's counter-attack method against trajectory prediction is shown;

[0042] Figure 4 shows a sampling example of adversarial attacks against the trajectory prediction method of the present invention;

[0043] Figure 5 The DTW statistical histogram of the constructed trajectory in the adversarial trajectory prediction method of the present invention is shown;

[0044] Figure 6 A schematic diagram of the present invention showing the virtual-reality fusion platform verification of the trajectory obtained by the adversarial trajectory prediction method. DETAILED DESCRIPTION

[0045] The following will be combined with the accompanying drawings corresponding to the specific embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. The following detailed description of the embodiments of the present application provided in the accompanying drawings is not intended to limit the scope of the present application for protection. The described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, various different configurations can be arranged and designed. All other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0046] The present application is described below with reference to specific embodiments and with reference to the accompanying drawings:

[0047] Figure 1 Figures (a) and (b) illustrate two exemplary embodiments of adversarial attack scenarios in the adversarial trajectory prediction method of the present invention. (a) illustrates two major drawbacks of existing methods: first, poorly concealed adversarial trajectories (red trajectories) are easily identified by the system as dangerous driving behavior; second, overly simplified optimization objectives lead to poor attack effectiveness (blue trajectories in (a)). (b) illustrates the advantages of this method: the generated adversarial trajectories conform to real-world rules and are highly concealed (purple trajectories), and can effectively prompt victim vehicles to take safety responses (blue trajectories in (b)).

[0048] In order to avoid unnecessary ambiguity of the present invention, description of other information in the drawings is omitted.

[0049] Figure 2The adversarial trajectory prediction method 200 provided in the embodiment of the first aspect of the present application is used.

[0050] like Figure 2 As shown, at step S201, a trajectory prediction model is constructed, and the historical trajectories of surrounding vehicles, the actual trajectories of the target driving vehicle and surrounding vehicles, and environmental context information are input into the trajectory prediction model.

[0051] In autonomous driving systems, trajectory modeling is central to achieving accurate path planning and safe driving. This requires a combination of multi-source data fusion, dynamic interaction modeling, and trajectory optimization algorithms. This step is currently available and is implemented in five steps: data preprocessing, model architecture design, path planning, control optimization, and simulation verification. For example, in highway scenarios, a two-dimensional coordinate system is constructed to calculate the distance and angle costs between nodes, and the optimal path is selected by dynamically adjusting weight coefficients. In complex urban scenarios, LSTM is used to predict multimodal trajectory distributions, and the decision network is optimized using trajectory scores and cross-entropy loss.

[0052] It is worth noting that the above steps do not constitute a limitation of the present invention. Common trajectory prediction model construction methods in the field of autonomous driving are applicable to the trajectory prediction model construction method of the present invention.

[0053] Please refer to Figure 3 ,The historical trajectories of surrounding vehicles, the real trajectories of the target driving vehicle AV and surrounding vehicles TA, and the environmental context information are used as input parameters and input into the constructed trajectory prediction model.

[0054] Next, go to step S202.

[0055] In step S202, in the trajectory prediction model that has input the historical trajectories of surrounding vehicles, the actual trajectories of the target driving vehicle and surrounding vehicles, and the environmental context information, the trajectory features that integrate the lane context and the spatiotemporal context are obtained through feature extraction and spatiotemporal attention mechanism.

[0056] like Figure 3 As shown in the figure, a spatiotemporal attention perception module can be used to perform spatiotemporal interaction on the input historical trajectory to obtain the complex real-world rules, obtain the semantic representation of the spatiotemporal context of the trajectory, and obtain the trajectory features. The framework input of the trajectory is: in For TA's historical trajectory, denote the true values ​​of the future trajectories of AV and TA vehicles, respectively. The model deeply captures the spatiotemporal correlations of real vehicle trajectories. The generated adversarial trajectories closely match real traffic conditions, significantly improving their stealth and making them difficult for detection systems to detect. The surrounding vehicles (TA) serve as attacking vehicles, and the target vehicle (AV) serves as the victim vehicle.

[0057] Through feature extraction and spatiotemporal attention mechanism, trajectory features that integrate lane context and spatiotemporal context are obtained.

[0058] Specifically, the spatiotemporal perception module is used to transform the time series characteristics and spatial geometric relationships of the physical world into a computable dynamic model to support the decision-making and control of intelligent systems. The spatiotemporal attention perception module is introduced to encode the characteristics of real-world vehicle trajectories, aiming to help the model understand the spatiotemporal context and physical reality rules contained in the trajectory. The spatiotemporal perception module is a deep learning architecture based on a multi-head self-attention mechanism and spatiotemporal gating units. It achieves collaborative modeling of time series and spatial topology through a dynamic weight matrix. Its core uses three-dimensional convolution or spatiotemporal graph attention network (ST-GAT) to perform spatiotemporal alignment of multimodal sensor data (such as lidar point clouds and video frame sequences). Multi-head self-attention heads are used to capture spatiotemporal correlations of different granularities. At the same time, a gated recurrent unit (GRU) is introduced to regulate the attention weight update rate to enhance the ability to respond to emergencies.

[0059] Next, go to step S203.

[0060] In step S203 , an explicit space adversarial model is constructed based on the path planning logic of the target driving vehicle.

[0061] Specifically, if Figure 3 As shown, the path planning logic based on the target driving vehicle is a decision-making process that generates feasible trajectories that meet safety, efficiency and dynamic constraints for the autonomous driving system through multimodal environment modeling and dynamic optimization algorithms. Constructing an adversarial model in explicit space is to model the dynamic environment as a resolvable geometric structure, synthesize adversarial obstacle distribution or threat path, and evaluate the feasibility of the trajectory. In the explicit space, the concept of interactive risk field based on the area where autonomous vehicles (AVs) can operate is introduced, aiming to guide the future trajectories of surrounding vehicles (TA) into this field, further enhancing the effectiveness of the attack. The innovative introduction of the concept of AV interactive risk field guides the target driving vehicle TA into this area, effectively interfering with the AV prediction module and significantly improving the impact of adversarial attacks on the autonomous driving system.

[0062] Next, go to step S204.

[0063] In step S204, the trajectory features are mapped to a virtual space based on an adversarial autoencoder, and the virtual space is used as a latent space.

[0064] Specifically, if Figure 3As shown, this adversarial autoencoder constructs a threat model by mapping high-level semantic features into a decoupled latent space in the implicit space. Trajectory features, which contain information about real-world rules and lane environments, are then mapped into the latent space. The encoder then extracts the spatiotemporal features of the trajectory using a spatiotemporal convolutional network and a long short-term memory network. The encoder then maps the trajectory into the latent space. The adversarial game between the two forces the latent space distribution to align with the target distribution while preserving the semantic characteristics of the trajectory. Within the decoupled latent space, semantic-level perturbations targeting different orthogonal patterns are performed, enabling precise targeting and targeted attacks, greatly enhancing attack effectiveness.

[0065] Next, go to step S205.

[0066] In step S205 , semantic-level perturbations are performed on the latent vectors in different orthogonal modes in the latent space, and the latent vectors are regularized to a specific distribution.

[0067] like Figure 3 As shown, step S205 significantly improves the targeting and concealment of the attack. For example, an adversarial autoencoder or diffusion model is used to decompose the latent vector into an orthogonal basis, and specific noise distributions are applied along different orthogonal basis directions. The divergence loss between the perturbed latent vector and the target distribution is calculated, and finally, compliance with physical laws is ensured. With the help of the adversarial autoencoder (AAE) architecture, the decoupled latent variables are subjected to distribution regularization, which ensures that the generated trajectory is highly consistent with reality in terms of physical logic and environmental rules.

[0068] Next, go to step S206.

[0069] At step S206, the decoder maps the perturbed latent vector back to the explicit space to generate the adversarial trajectory of the target driving vehicle.

[0070] The adversarial trajectory prediction method proposed in this paper innovatively reframes the adversarial trajectory generation task as a historical vehicle trajectory reconstruction task with specific constraints, thereby proposing a novel trajectory attack method. The decoder is a key module that maps the multimodal features extracted by the encoder into specific driving behavior or environmental understanding outputs. Its core function is to achieve end-to-end decision-making through spatiotemporal modeling and multi-task collaboration. Based on the decoder, this method performs multi-dimensional optimization in both explicit and implicit spaces, significantly improving the effectiveness and practical concealment of the adversarial attack.

[0071] Relatively speaking, existing research mostly generates adversarial trajectories by designing complex constraint spaces (such as adding dynamics, kinematics, and other constraints) and more aggressive optimization objectives. Existing attack methods often focus on the constraint space and objective function design or selection of the service threat model, and generate adversarial trajectories by perturbing and further optimizing in the explicit space, but ignore the threat model and rarely explore the potential of the threat model itself. After building the trajectory prediction model, the present application prepares relatively complete data through historical trajectories, real trajectories and environmental contexts to facilitate multimodal data coupling. By constructing an adversarial model in explicit space, it is possible to utilize the sensitivity of the drivable area of ​​modeling AV path planning (such as lane change decision points and safe distance from the vehicle) to directly generate adversarial trajectories for its decision-making vulnerabilities. Based on the adversarial autoencoder, the trajectory features are mapped to the latent space, and then a threat model based on the adversarial autoencoder architecture is constructed. By applying semantic-level perturbations, the latent vectors in different orthogonal modes in the latent space can be semantically perturbed, so that the generated adversarial trajectory is aligned with the real trajectory distribution, which can more accurately describe the trajectory for prediction. This introduces an adversarial mechanism, significantly improving the pertinence and real concealment of the attack. By mapping the latent vector back to the explicit space, an adversarial trajectory that meets the adversarial threat is generated, significantly improving the pertinence and effectiveness of the attack. In this way, the present application emphasizes the multi-space collaborative optimization of explicit space and implicit space, significantly improving the pertinence and real concealment of the attack, and improving the prediction accuracy. The trajectory of the target driving vehicle can be used to counter the surrounding vehicles and cope with complex vehicle conditions.

[0072] In some implementations, the trajectory prediction task aims to predict the future trajectory of each agent in a scene based on historical trajectory data and relevant environmental information. Specifically defined as follows:

[0073] Given N agents in a scene, the H historical trajectories of each agent i at time t are The true value of the future trajectory after L time steps in Represents the state of agent i at time τ, including information such as position, speed, and heading. At the same time, it provides the environmental context information of the scene The goal of the trajectory prediction model is to predict the state sequence of each agent i in the next L time steps, that is, the future trajectory

[0074] Mathematically, the trajectory prediction model can be expressed as a function in , is the contextual information of the scene, is the predicted future trajectory. The model minimizes the error between the predicted trajectory and the true future trajectory by learning the mapping relationship between historical trajectory and context information, that is,

[0075] The threat model describes how an adversary can perturb input data and mislead the trajectory prediction model to produce incorrect outputs. The specific definitions are as follows:

[0076] The attacker's goal is to cause the trajectory prediction model to produce incorrect future trajectory predictions by altering the input data. The attacker has access to the target model's input data and applies a small perturbation δ to it to generate adversarial examples. In a white-box attack scenario, the attacker accesses the target model's parameters and internal structure and uses gradient information to optimize the perturbation. In a black-box attack scenario, the attacker generates adversarial examples by simply querying the target model's output.

[0077] Mathematically, the attacker’s optimization goal is to maximize the prediction error:

[0078]

[0079] in, is the loss function, which measures the predicted trajectory and the real future trajectory , δ is the perturbation imposed by the attacker, which satisfies the constraints (such as L-norm restriction) to ensure the concealment of the adversarial sample.

[0080] In some embodiments, obtaining trajectory features that fuse lane context and spatiotemporal context through feature extraction and spatiotemporal attention mechanism includes: using one-dimensional dilated convolution to obtain an embedded representation of the target driving vehicle trajectory, extracting the geometric structure features of the lane line and the spatiotemporal dynamic features of the historical trajectories of surrounding vehicles, modeling the interaction between the lane and the target driving vehicle and surrounding vehicles through a graph network, fusing the dynamic features of the lane context and spatiotemporal context, and outputting trajectory features.

[0081] Compared with the reconstruction task in the image field, the adversarial trajectory generation task used for attack trajectory prediction modules in the field of autonomous driving is more complex. In real-world scenarios, the vehicle's sequential trajectory must not only have spatiotemporal coherence and potential logic, but will also be significantly affected by the road environment. These features are highly coupled, and the use of a single feature model cannot fully express the spatiotemporal information corresponding to the vehicle. It is crucial to clarify which historical trajectory spatiotemporal features have a significant impact on future trajectory prediction. Based on this, this application innovatively introduces a spatiotemporal context interaction perception module, aiming to provide the threat model with high-quality trajectory features that integrate spatiotemporal and environmental context. This module mainly consists of two parts: a feature extractor and spatiotemporal perception attention. Feature extractor f eUsing one-dimensional dilated convolutions, we obtain an embedded representation of the target vehicle's trajectory. We then model the interactions between lanes, the target vehicle, and surrounding vehicles using a graph network. Subsequently, we utilize a spatiotemporal attention mechanism to highlight the mutual influence between past and future trajectories in each real vehicle trajectory sequence, helping the threat model more effectively capture spatiotemporal relationships within the trajectory sequence. The mathematical representation of this module is as follows:

[0082]

[0083] in, is the interactive representation of lane context output by the feature extractor, X ST is the output after spatiotemporal interaction, Attn[a, b, c] is the spatiotemporal attention, a is the query, b is the key, and c is the value.

[0084] In some embodiments, an explicit space adversarial model is constructed, including: defining an interactive risk field for safe driving of a target driving vehicle; selecting a point on the centerline of the lane in front of the target driving vehicle as the risk centroid of the interactive risk field to represent the core threat area of ​​the field; and using the trajectory of the target driving vehicle after spatiotemporal interaction as input to construct a reconstructed trajectory of the target driving vehicle when the trajectories of surrounding vehicles invade the interactive risk field.

[0085] Currently, traditional methods for optimizing the target of countermeasure attacks mostly use Euclidean distance or lateral deviation, but such simple evaluation methods are difficult to accurately measure the effectiveness of the attack. To solve this problem, this application innovatively introduces the concept of interactive risk field Ω based on the target driving vehicle AV's safe and feasible operation. Figure 2 As can be seen, when the trajectories of surrounding vehicles enter the AV's risk field Ω, the AV's original drivable area is occupied and compressed, forcing it to take safe actions such as emergency braking and lane changes. Therefore, the generated adversarial attack is expected to effectively mislead the AV, causing it to misjudge that other surrounding vehicles are about to enter its Ω field, thereby making it take incorrect safety actions. To simplify the risk field modeling process, a point on the centerline of the lane in front of the AV is used as the risk centroid to represent the risk field concept.

[0086] The adversarial model drives the vehicle trajectory X with the goal of spatial and temporal interaction. ST Input, output is a confrontation trajectory that takes into account both aggressiveness and concealment After the adversarial trajectory acts on the victim model, the predicted trajectory of the attack is obtained At the explicit space level, the following optimization objectives are defined:

[0087]

[0088] in, is the regression loss for trajectory reconstruction, It is an optional constraint space used to further conform to the real rules. is the attack loss, and its core role is to ensure the effectiveness of the attack. L is the total future time step, ω t is the weight coefficient that gradually decays with time step t, r and They correspond to the risk centroid and predicted trajectory point at the current time step, respectively. EL-Attack uses Adversarial Autoencoder (AAE) to build threat models, emphasizing multi-space coordinated optimization in both explicit and implicit spaces.

[0089] Through such a design, the interactive risk field Ω is fully utilized in the explicit space, the effect of the adversarial attack is enhanced, and the overall attack strategy is optimized.

[0090] In some embodiments, mapping trajectory features to a latent space based on an adversarial autoencoder involves mapping high-dimensional semantic features to a low-dimensional latent space and decoupling them into latent vector features under different orthogonal modes.

[0091] To effectively process the target vehicle trajectory characteristics that contain rich spatiotemporal context and complex real-world rules after interaction, similar to [SSAT], this application innovatively introduces the concept of latent space and builds a threat model based on the Adversarial Autoencoder (AAE) architecture. This architecture consists of the following core modules:

[0092] The encoder is responsible for mapping high-dimensional semantic features to a low-dimensional latent space and decoupling them into latent vector features in different orthogonal modes. In some embodiments, the high-dimensional semantic features include:

[0093] Longitudinal feature z lon , presented as a one-dimensional vector, reflects the dynamic interaction of the target driving vehicle in the longitudinal direction by modeling the time interval when the target driving vehicle passes a given point, and obeys a one-dimensional log-normal distribution;

[0094] lateral feature z lat , the steering intentions of the target driving vehicle to move forward, turn left / left, and turn right / right are modeled with three-dimensional vectors, following the classification distribution; the remaining semantic features that are difficult to model explicitly are represented by zguass and follow the Gaussian distribution.

[0095] In some embodiments, semantic-level perturbations are performed on latent vectors in different orthogonal modes, and the latent vectors are regularized to a specific distribution as follows: corresponding orthogonal basis vectors are selected according to the attack target; perturbations are applied along the selected directions; the divergence between the latent vector distribution after perturbation and the target distribution is calculated, and the latent vector distribution is determined by minimizing the divergence.

[0096] The key innovation in the latent space is the ability to perform semantic-level perturbations on the latent vectors in different orthogonal modes, thereby precisely misleading the AV's trajectory prediction module. For example, perturbing the longitudinal features can interfere with the prediction module's prediction of the AV's vehicle speed and following distance. The perturbation process is implemented using the following mathematical expression:

[0097] z lon =z lon +∈ log , z guass =z lon +∈ guass , z lat =z lat +∈ cat (5)

[0098] Among them, ∈ log ,∈ guass ,∈ cat are sampled from lognormal, Gaussian and categorical distributions respectively.

[0099] In some embodiments, mapping the perturbed latent vector back to the explicit space to generate an adversarial trajectory of the target driving vehicle includes: taking the semantically perturbed latent vector as input; converting the perturbed latent vector into an explicit trajectory coordinate sequence through a decoder; and performing physical rule constraint verification on the coordinate sequence to obtain the adversarial trajectory.

[0100] The discriminator is used to identify and normalize the perturbed latent vector to a specific distribution, ensuring that the generated adversarial trajectory conforms to the physical laws of the real world and maintains a high degree of concealment. The implicit space optimization is defined as follows:

[0101]

[0102] Where m is the number of decoupled latent vectors, z is the latent vector, S is the sampling of the distribution corresponding to a certain latent vector, E and D represent the encoder and discriminator.

[0103] In a second aspect, embodiments of the present application provide a readable storage medium storing a terminal program that, when executed, performs the aforementioned adversarial trajectory prediction method. The readable storage medium compiles the aforementioned adversarial trajectory prediction method into machine code for fixed storage, facilitating the loading of the trajectory planning method. Direct memory mapping technology achieves zero parsing latency, enabling lightweight packaging and rapid deployment of the generation algorithm for the aforementioned adversarial trajectory prediction method.

[0104] On the third aspect, the embodiments of the present application provide an electronic device, which can be a desktop computer, a notebook, an industrial computer, a PDA, a tablet computer or other mobile terminal, as well as a computer device such as a cloud server. It is not limited to which operating system is installed. The electronic device includes a memory, a processor, and a computer program stored in the memory and executable in the processor. The computer program includes the steps corresponding to the above-mentioned countermeasure trajectory prediction method. It should be understood that the apparatus of each embodiment of the present application can be implemented based on a memory and a processor, each memory is used to store the above-mentioned modules, and the processor performs the interaction, call or execution tasks between the above-mentioned modules, so that the electronic device can realize the countermeasure trajectory prediction function. By configuring the trajectory planning method in the electronic device, it is convenient for the expanded application of the trajectory planning method and the trajectory planning technology can be easily loaded into a vehicle.

[0105] Fourthly, embodiments of the present application provide a vehicle comprising a vehicle body and an intelligent system embedded within the vehicle body, wherein the intelligent system includes a program for executing the aforementioned vehicle trajectory planning method. Equipped with an intelligent system including the aforementioned trajectory planning method, the vehicle can handle complex driving conditions, providing an important theoretical basis for building a safer autonomous driving system and improving the efficiency of safety testing for autonomous driving.

[0106] This application was experimentally verified, demonstrating the improved effectiveness of EL-Attack compared to similar methods, the physical realism of the adversarial trajectories generated by this method, and the performance of adversarial samples on real target vehicles. The following details the experimental setup and results, as well as an analysis of the experimental results. The specific process and results are as follows:

[0107] 1. Training setting: The framework proposed in this application is based on the encoder-decoder architecture, and the feature extractor adopts the improved Lane-GCN. During the training phase, the Argoverse dataset is used for parameter regression, and the latent space modeling in the model adopts a semi-supervised training method, because the explicit semantic labels are extracted or calculated from the dataset based on the current state. At the same time, the model as a whole adopts unsupervised learning, because the results caused by the carefully designed historical trajectory actually come from the reasoning of the victim trajectory prediction model. Before the model generates a carefully designed historical trajectory, the optimization target cannot be obtained directly. In the overall model optimization process, this application sets a dynamically decaying learning rate optimizer, and when selecting TA vehicles, it directly utilizes the AGENT type vehicles provided in the Argoverse dataset.

[0108] 2. Victim model: The victim models include VectorNet, TNT and Traj-LLM, and are pre-trained on the Argoverse dataset. VectorNet and TNT represent two important paradigms in trajectory prediction: graph-based interaction modeling and target-driven prediction generation, respectively. VectorNet provides a powerful tool for the field of trajectory prediction with its efficient geometric modeling and complex interaction understanding capabilities; while TNT significantly improves the accuracy and reliability of trajectory prediction through a target-driven multimodal prediction strategy. Previous work, Traj-LLM, leverages the powerful semantic understanding capabilities of large language models and introduces sparse context coding and lane perception probability learning, thereby improving scene recognition and interaction modeling capabilities in trajectory prediction. The baseline algorithms include Search, Search*, AdvDO, and SA-Attack, which are all verified trajectory prediction attack methods. In the method of this application, the input of the baseline algorithm is preprocessed based on the characteristics of the victim model.

[0109] 3. Evaluation indicators: In order to comprehensively evaluate the effectiveness and characteristics of adversarial attack methods on trajectory prediction models, this study defines three key evaluation indicators: Success Rate (SR), Violation Rate (VR), and Dangerous Appearance Rate (DAR), and conducts a systematic evaluation from three aspects: attack success rate, physical feasibility of trajectory, and concealment. In addition, the average displacement error (Average Displacement Error), final displacement error (FDE), and off-road rate (ORR) are used to evaluate the accuracy and security of the victim model's predicted trajectory. In addition to the effectiveness evaluation, the dynamic time warping (DTW) method is also used to evaluate the physical world reality of the carefully designed historical trajectory.

[0110] The following anti-attack experiments and analysis:

[0111] 1. Attack Effectiveness: In terms of attack effectiveness, this application designed a comparative experiment, and the experimental data is summarized in Table 1. This application used the proposed method, combined with the TNT and VectorNet trajectory prediction models, to conduct 250 validation tests against baseline methods. The attack effectiveness experiment design consists of two parts: the first part verifies the adversarial attack against the highly robust trajectory prediction models VectorNet and TNT, and the second part evaluates the attack effectiveness of the proposed model against Traj-LLM, a state-of-the-art trajectory prediction algorithm based on a pre-trained large language model. Analysis of the experimental results shows that the proposed method achieves near-optimal performance in metrics such as ADE, FDE, and SR. This is attributed to the proposed method's full utilization of the relationship between AV and TA and the potential adversarial value of learning negative samples to promote the generation of adversarial behavior. This results in a more significant deviation between the pathpoints generated by the trajectory prediction model and the original trajectory using carefully designed historical trajectories. Since TNT, as an upgraded algorithm of VectorNet, has a lower probability of generating negative samples, the changes in the ADE metric of its predicted trajectories are relatively small. When conducting adversarial attacks against TNT, although the proposed algorithm is slightly inferior in FDE, it is significantly better than AdvDO in ADE, and this feature also makes the ORR performance lower. However, due to the significant attack effect on the ADE indicator, the method of this application also shows better performance on the SR indicator, which shows that the algorithm as a whole can cause more prediction errors, not just limited to boundary violations. In terms of DAR and VR indicators, except for the simple and crude Search algorithm, all other attack methods basically ensure the appearance of illegal trajectories, which reflects the consensus of each algorithm in following basic rules. Comprehensive analysis of the attack effects of the two robust trajectory prediction models shows that the proposed methods all achieve the highest attack success rate. This shows that the proposed method has significant attack effectiveness. Although it performs slightly worse in FDE and ORR, this also reflects its more conservative attack strategy, making it more difficult to be countered by third-party defense mechanisms.

[0112] Table 1 Comparative experiments against attacks

[0113]

[0114] The embodiment of the present application also uses the proposed algorithm to attack the latest trajectory prediction model Traj-LLM based on a large language model. Experimental data show that the attack effect is significant. The Traj-LLM model has a complex structure and contains multiple robust modules for mining potential information. Although the attack method is effective, its attack success rate and the impact index on trajectory anomalies are lower than those of attacks on VectorNet and TNT. This shows that the pre-trained large language model and attention fusion mechanism can indeed deeply explore the potential laws of trajectory prediction; at the same time, the good attack success rate and significantly improved FDE and ADE indicators further verify the effectiveness of the proposed method.

[0115] 2. Reality in the physical world: To ensure that the carefully designed historical trajectory will not be eliminated by countermeasures, it must be realistic in the physical world. Specifically, the carefully designed trajectory should be executable by the vehicle and conform to the laws of real trajectories in the physical world. Sample from multiple trajectories generated by the proposed model, observe the visualization results of the carefully designed trajectory, and analyze the differences between it and the reference sample (such as Figure 4 The figure shows the impact of adversarial trajectories (green dots) generated by an attacker vehicle (sample on the right) using constructed historical trajectories (red dots) on the target vehicle's victim trajectory prediction model (sample on the left). The blue dots and yellow-green dots represent the original historical trajectory and a benign future trajectory, respectively. An example is shown, including the original trajectory of the vehicle attacked by the trajectory prediction model, as well as a trajectory mispredicted using carefully crafted historical trajectories. In this process, the newly generated predicted trajectory significantly interferes with the target vehicle's drivable area; during driving, the target vehicle's trajectory prediction task inevitably prompts it to make collision-avoidance trajectory adjustments.

[0116] In addition, in order to further verify the physical reality of the carefully designed trajectory, based on the carefully designed trajectory in the case shown in the figure, DTW quantitative indicators were used to perform statistics on 1000 original benign trajectory samples. The statistical results are as follows: Figure 5 As shown in the figure, the horizontal axis represents the DTW statistical interval, and the vertical axis corresponds to the proportion of samples in each interval. From the analysis of experimental data, it can be seen that the trajectory samples with DTW values ​​in the interval of (0, 3] only account for 0.1%, which shows that the carefully designed historical trajectories generated by the proposed method are not completely separated from the reference of benign trajectories; these approximate samples prove the practical feasibility of the generated trajectories. At the same time, the proportion of samples in the interval of DTW values ​​of (3, 10] is sufficient, which further proves that the distribution of sample trajectories has the practical feasibility of the physical world. Among them, the benign trajectories come from the Argoverse dataset, which is based on real vehicle collection, so its reference samples are realistic and reliable, while the existence of samples in other intervals shows that the dataset has rich sample diversity.

[0117] 3. Verification of the virtual-real platform: In this section, this application uses a virtual-real platform for simulation and real vehicle testing. Specifically, the Autoware system of the experimental target driving vehicle is equipped with a robust TNT trajectory prediction model. Due to the limitation of the number of actual target driving vehicles, an attack target driving vehicle is set in the simulation environment of the virtual-real system, and the target driving vehicle in the simulation platform performs the trajectory prediction task synchronously. The sampling diagram of the verification process is shown in the figure below. Figure 6 As shown in the figure, the verification was completed on a virtual-reality fusion platform including four typical scenarios: curves, intersections, straight roads and T-junctions. In each group of diagrams, the upper left and lower right sub-diagrams respectively present the bird's-eye view of the simulation platform and the real vehicle platform, while the lower left and upper right sub-diagrams correspond to the first-person perspective and third-person observation perspective of the target driving vehicle in the simulation environment.

[0118] During the experiment, the present application selected four common scenarios in human driving and adjusted the way the system collects driving data based on the input of the trajectory prediction model. In the curve scenario, the attack vehicle TA led to an erroneous trajectory prediction through a carefully designed historical trajectory, which in turn caused the target driving vehicle to make illegal trajectory planning behaviors based on the observation and trajectory prediction model of the Internet of Vehicles, resulting in the safety framework restricting its actions and eventually stopping its movement. At the intersection, the erroneous trajectory generated by the attack vehicle TA significantly interfered with the driving area of ​​the target driving vehicle, causing it to misjudge the presence of other surrounding vehicles in the near distance ahead. In the straight road scenario, the erroneous trajectory prediction of the attack vehicle TA was almost a U-turn, and the target driving vehicle urgently took the safety measure of an emergency stop to avoid danger. In the T-intersection scenario, the incoming attack vehicle TA made an erroneous lane change trajectory prediction, causing the safe driving area of ​​the target driving vehicle to almost disappear.

[0119] The effectiveness of this method was verified in a virtual-reality platform across scenarios such as straight roads, curves, and intersections, demonstrating its real-world transferability. The attacker vehicle (TA)'s carefully designed historical trajectory effectively reduces the target vehicle's erroneous trajectory predictions, thereby achieving the goal of autonomous driving safety testing.

[0120] This application systematically studies the security vulnerabilities of autonomous driving trajectory prediction models. By constructing a spatiotemporal attention perception module to extract trajectory semantic features and combining it with an adversarial autoencoder architecture to design a threat model, this application method introduces interactive risk field constraints on the target driving vehicle's drivable area in the explicit space, and achieves semantic-level perturbations of decoupled latent variables in the implicit space. Experimental results show that EL-Attack demonstrates significant advantages on both the Argoverse dataset and the virtual-reality combined test platform: compared with the attack method with the highest success rate among the four types of benchmark attack methods, the attack success rate of this method is increased by 11.2%. The generated adversarial trajectory not only maintains physical feasibility, but also can accurately induce the target vehicle to enter the dangerous area. This study reveals the vulnerability of trajectory prediction models to multi-space coordinated attacks and provides an important theoretical basis for building safer autonomous driving systems.

[0121] In the description of this application, reference to the terms "some embodiments", "optional embodiments", "examples", "specific examples", "optional examples" or "optional embodiments" and the like means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of this application, but does not mean that these embodiments illustrate and describe all possible forms of the invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any suitable manner in any one or more embodiments or examples. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification.

[0122] In addition, the technical solutions between the various embodiments can be combined with each other, but this must be based on the fact that they can be implemented by ordinary technicians in this field. Although the embodiments of the present application have been shown and described, these embodiments can be changed, modified, replaced, and modified in various ways without departing from the principles and purpose of the present application. Ordinary technicians in this field can understand that various other specific changes and combinations of embodiments made based on the technical inspiration disclosed in this application without departing from the essence of the present application are still within the scope of protection defined by the claims of the present invention and their equivalent technical solutions.

[0123] At the same time, the technical solutions between the various embodiments can be combined with each other, but they must be based on the ability of ordinary technicians in this field to implement them. When the combination of technical solutions is mutually contradictory or cannot be implemented, it should be deemed that such a combination of technical solutions does not exist and is not within the scope of protection required by this application.

Claims

1. A method for predicting adversarial trajectories, characterized in that: include: Build a trajectory prediction model and input the historical trajectories of surrounding vehicles, the actual trajectories of the target driving vehicle and surrounding vehicles, and environmental context information into the trajectory prediction model; In the trajectory prediction model, which has been fed with the historical trajectories of surrounding vehicles, the actual trajectories of the target driving vehicle and surrounding vehicles, and environmental context information, feature extraction and spatiotemporal attention mechanism are used to obtain trajectory features that integrate lane context and spatiotemporal context. Based on the path planning logic of the target driving vehicle, an explicit space adversarial model is constructed; Mapping the trajectory features to a virtual space based on an adversarial autoencoder, and using the virtual space as a latent space; Performing semantic-level perturbations on latent vectors in different orthogonal modes in the latent space and regularizing the latent vectors to a specific distribution; The regularized latent vector is mapped back to the adversarial model in the explicit space to generate an adversarial trajectory of the target driving vehicle.

2. The adversarial trajectory prediction method according to claim 1, characterized in that The method of obtaining trajectory features that fuse lane context and spatiotemporal context through feature extraction and spatiotemporal attention mechanism includes: using one-dimensional dilated convolution to obtain an embedded representation of the target driving vehicle trajectory, extracting the geometric structural features of the lane lines and the spatiotemporal dynamic features of the historical trajectories of surrounding vehicles, modeling the interaction between the lane and the target driving vehicle and surrounding vehicles through a graph network, fusing the dynamic features of the lane context and spatiotemporal context, and outputting the trajectory features of the target driving vehicle.

3. The adversarial trajectory prediction method according to claim 2, characterized in that: The path planning logic based on the target driving vehicle is used to construct an explicit space adversarial model, including: Define the interactive risk field for the safe driving of the target driving vehicle; select a point on the centerline of the lane in front of the target driving vehicle as the risk centroid of the interactive risk field to represent the core threat area of ​​the field; use the trajectory of the target driving vehicle after spatiotemporal interaction as input to construct the reconstructed trajectory of the target driving vehicle when the trajectories of surrounding vehicles invade the interactive risk field.

4. The adversarial trajectory prediction method according to claim 1, characterized in that The mapping of trajectory features to latent space based on the adversarial autoencoder is as follows: mapping high-dimensional semantic features to low-dimensional latent space and decoupling them into latent vector features under different orthogonal modes.

5. The adversarial trajectory prediction method according to claim 4, characterized in that: The high-dimensional semantic features include: Longitudinal features, presented as a one-dimensional vector, reflect the dynamic interaction of the target driving vehicle in the longitudinal direction by modeling the time interval when the target driving vehicle passes a given point, and obey a one-dimensional log-normal distribution; The lateral features, which use three-dimensional vectors to model the steering intentions of the target driving vehicle, such as moving forward, turning left / left, or turning right / right, follow a categorical distribution; the remaining semantic features follow a Gaussian distribution.

6. The adversarial trajectory prediction method according to claim 1, characterized in that: The method implements semantic-level perturbations on latent vectors in different orthogonal modes in the latent space and regularizes the latent vectors to a specific distribution, including: Select the corresponding orthogonal basis vector according to the attack target; Apply a perturbation along the chosen direction; The divergence between the perturbed latent vector distribution and the target distribution is calculated, and the latent vector distribution is determined by minimizing the divergence.

7. The adversarial trajectory prediction method according to claim 1, characterized in that: The regularized latent vector is mapped back to the adversarial model in the explicit space to generate the adversarial trajectory of the target driving vehicle, including: Take the semantically perturbed latent vector as input; The perturbation latent vector is converted into an explicit trajectory coordinate sequence in the explicit space through the decoder; Verify the physical rule constraints on the coordinate sequence and obtain the adversarial trajectory.

8. A readable storage medium storing a terminal program, characterized in that: When the terminal program is executed, the adversarial trajectory prediction method according to any one of claims 1 to 7 is performed.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable in the processor, wherein: The computer program includes steps corresponding to the adversarial trajectory prediction method according to any one of claims 1 to 7.

10. A vehicle comprising a vehicle body and an intelligent system built into the vehicle body, characterized in that: The intelligent system has a built-in program for executing the vehicle trajectory planning method described in any one of claims 1-7.

Images