Generating safety-critical scenarios, which are essential yet difficult to
collect at scale, offers an effective method to evaluate the robustness of
autonomous vehicles (AVs). Existing methods focus on optimizing adversariality
while preserving the naturalness of scenarios, aiming to achieve a balance
through data-driven approaches. However, without an appropriate upper bound for
adversariality, the scenarios might exhibit excessive adversariality,
potentially leading to unavoidable collisions. In this paper, we introduce
FREA, a novel safety-critical scenarios generation method that incorporates the
Largest Feasible Region (LFR) of AV as guidance to ensure the reasonableness of
the adversarial scenarios. Concretely, FREA initially pre-calculates the LFR of
AV from offline datasets. Subsequently, it learns a reasonable adversarial
policy that controls critical background vehicles (CBVs) in the scene to
generate adversarial yet AV-feasible scenarios by maximizing a novel
feasibility-dependent objective function. Extensive experiments illustrate that
FREA can effectively generate safety-critical scenarios, yielding considerable
near-miss events while ensuring AV's feasibility. Generalization analysis also
confirms the robustness of FREA in AV testing across various surrogate AV
methods and traffic environments.

FREA 是一种新的安全关键场景生成方法，它通过将 AV 的最大可行域作为引导，确保对抗性场景的合理性。FREA 能够有效地生成安全关键场景，并在保证 AV 的可行性的同时产生了相当多的近撞事件。广泛的实验也确认了 FREA 在各种代理 AV 方法和交通环境中进行 AV 测试的鲁棒性。

FREA: 可行性指导下合理对抗性生成安全关键场景

FREA: Feasibility-Guided Generation of Safety-Critical Scenarios with  Reasonable Adversariality

The malicious applications of deep forgery, represented by face swapping,
have introduced security threats such as misinformation dissemination and
identity fraud. While some research has proposed the use of robust watermarking
methods to trace the copyright of facial images for post-event traceability,
these methods cannot effectively prevent the generation of forgeries at the
source and curb their dissemination. To address this problem, we propose a
novel comprehensive active defense mechanism that combines traceability and
adversariality, called Dual Defense. Dual Defense invisibly embeds a single
robust watermark within the target face to actively respond to sudden cases of
malicious face swapping. It disrupts the output of the face swapping model
while maintaining the integrity of watermark information throughout the entire
dissemination process. This allows for watermark extraction at any stage of
image tracking for traceability. Specifically, we introduce a watermark
embedding network based on original-domain feature impersonation attack. This
network learns robust adversarial features of target facial images and embeds
watermarks, seeking a well-balanced trade-off between watermark invisibility,
adversariality, and traceability through perceptual adversarial encoding
strategies. Extensive experiments demonstrate that Dual Defense achieves
optimal overall defense success rates and exhibits promising universality in
anti-face swapping tasks and dataset generalization ability. It maintains
impressive adversariality and traceability in both original and robust
settings, surpassing current forgery defense methods that possess only one of
these capabilities, including CMUA-Watermark, Anti-Forgery, FakeTagger, or PGD
methods.

通过结合可追踪性和对抗性的新型全面主动防御机制 Dual Defense，将单一强大的水印隐式嵌入目标人脸，有效应对恶意人脸交换而引起的安全威胁，保持水印信息的完整性，具备优异的对抗性和可追踪性，并超越当前的防伪方法。