RoboDriveVLM: A Novel Benchmark and Baseline towards Robust Vision-Language Models for Autonomous Driving

AI summary

Overview

Research area: End-to-end autonomous driving powered by vision-language models (VLMs), with a focus on robustness benchmarking and multimodal fusion.

Technical level: Advanced. The paper assumes familiarity with VLMs, Bird's Eye View (BEV) projection of LiDAR and radar point clouds, token-level decoding, and test-time adaptation (TTA).

Scope: The paper introduces RoboDriveBench, a corruption-robustness benchmark for end-to-end trajectory prediction, and RoboDriveVLM, a LiDAR-radar-camera VLM baseline with a cross-modal knowledge distillation TTA method.

What This Paper Is About

VLMs are increasingly used to make driving decisions directly from scene understanding, but the authors argue these systems carry risks that existing autonomous driving robustness benchmarks do not measure, because those benchmarks were not designed around VLM-specific failure modes such as malformed text output or corrupted language prompts. The paper builds a benchmark that injects both sensor-level and prompt-level corruption into the nuScenes validation set, then proposes a multimodal model and a test-time adaptation scheme intended to survive those corruptions.

Key Contributions

1. RoboDriveBench, described as the first robustness benchmark focused on end-to-end trajectory prediction for VLM-based autonomous driving. It covers 11 simulated corruption types — 6 sensor corruptions (dark, brightness, fog, snow, rain, motion blur) and 5 prompt corruptions (bit errors, transmission corruption, command overwrite, conversational interference, malicious attacks). Each corruption type contains 250 unique driving scenarios and 5,689 frames, giving 64,559 total trajectory prediction cases per evaluation.
2. Two new evaluation metrics, Mean Corruption L2-norm (MCL2) and Mean Corruption Collision (MCC), which extend the standard L2 error and collision rate by adding a penalty term equal to the ratio of invalid predictions to total test samples, so that VLMs producing unparseable trajectories are penalized rather than silently excluded.
3. RoboDriveVLM, a VLM-based end-to-end framework that maps LiDAR and radar point clouds into Bird's Eye View images and concatenates them with six-view camera images and system prompts into a single fused input. The paper offers both a camera-only variant (RoboDriveVLM*) and a full multimodal variant.
4. A test-time adaptation (TTA) method based on cross-modal knowledge distillation, which selects the token sequence with the highest joint likelihood across LiDAR, camera, and all-modality outputs, and uses that sequence as supervision to update the model during inference without labels.

Main Findings

• Language-driven models are relatively robust to sensor corruption, but not to prompt corruption. Under the six sensor corruptions, VLM-based systems kept MCL2 and MCC mostly within the 100–200% range, whereas UniAD and VAD-Base reached an MCC of 907.69% and 281.82% respectively under motion blur, revealing a safety weakness despite their low trajectory errors.
• Camera-only RoboDriveVLM sets the clean-scene L2 baseline.* Its clean average L2 is 0.43, compared with 0.66 for UniAD, 0.72 for VAD-Base, 0.69 for DriveVLM, and 0.95 for OpenEMMA.
• Adding LiDAR and radar improves accuracy across corrupted scenarios. The full RoboDriveVLM reaches the lowest AvgL2 and avg_col values across all sensor corruption settings (for example, clean average L2 of 0.39 versus 0.43 for the camera-only variant).
• TTA trades a little trajectory error for large collision-rate gains. The authors state the TTA method performs slightly worse than the baseline on L2, but attains the best collision performance across all weather corruption scenarios, with MCC reaching 100% or close to it in multiple scenarios (for example, 92.86% under brightness and snow, 100.00% under fog and rain).
• Bit errors are severely damaging to chain-of-thought models. For DriveVLM, bit error corruption raised AvgL2 from 0.29 to 1.83, with MCL2 of 264.18% and MCC of 202.85%.
• Short-dialogue models are vulnerable to word-level transmission corruption. RoboDriveVLM's MCC surged to 598.18% and MCL2 to 344.07% under transmission corruption, which the authors attribute to loss of critical words changing the global semantics of the prompt.
• TTA substantially reduces prompt-corruption damage. Under transmission corruption, TTA reduced RoboDriveVLM's AvgL2 from 1.35 to 0.67 and MCL2 from 344.07% to 171.06%. Under malicious attacks, it cut invalid outputs from 2,916 to 32 and improved MCL2 from 150.95% to 99.69%.
• Malicious attacks defeat every tested VLM system. No VLM-based system showed effective defense; invalid output counts reached 673 for DriveVLM and over 2,000 for the other systems. DriveVLM's lower count is attributed to its long-dialogue mechanism partially absorbing single-instance injections.
• Command overwrite and conversational interference cause fewer problems than expected, with one exception. Most models showed no significant MCC or MCL2 increase, but OpenEMMA produced 2,919 invalid outputs — over half the dataset — which the authors link to its lack of explicit task instructions.
• Low MCC values can be misleading. The paper notes that MCC values below 100% can occur because severely corrupted samples are excluded from AvgL2 and collision rate calculations when the model emits entirely invalid control commands.
• Overall ranking under prompt corruption. RoboDriveVLM-TTA is reported as best on AvgL2-Prompt (0.474) and AvgCol-Prompt (0.22).

Methodology in Plain English

The benchmark is built by taking the nuScenes validation set and applying controlled corruptions. Sensor corruption is applied to images and LiDAR point clouds using established libraries: imgaug for snow, rain, fog and motion blur, and automold for brightness and darkness, with three severity levels per corruption (LiDAR has no darkness corruption because LiDAR is unaffected by darkness). LiDAR snow and rain follow the LISA simulation method, LiDAR fog uses a meteorological optical range parameter, and LiDAR brightness and motion are simulated with Gaussian noise on the points and on the ego-pose rotation and translation matrices.

Prompt corruption is applied to the language input: bit errors are simulated with character-level insertion, deletion, reordering and duplication; transmission corruption with word-level deletion at light, moderate and severe levels; command overwrite with a corpus of 50+ imperative utterances sourced from GPT-4.0, including benign and risk-inducing commands; conversational interference with ambiguous in-cabin dialogues generated by GPT-4; and malicious attacks with minimal prompt manipulations intended to hijack outputs.

For evaluation, the authors modify two standard metrics. MCL2 is the ratio of average L2 under corruption to average L2 in clean conditions, multiplied by one plus the fraction of invalid predictions. MCC applies the same structure to the collision rate. The L2 and collision values are measured over a 3-second horizon.

The model, RoboDriveVLM, takes four input types: radar point clouds, LiDAR point clouds (both as K points with 4 channels), front-view images from three camera perspectives, and system prompts. LiDAR and radar points are projected into a common coordinate system, ground points are filtered, and each is converted to a BEV image; LiDAR Z-values are stored as image channels to preserve height, and radar velocities become connecting lines on the radar BEV image. The fused input concatenates the LiDAR BEV image, the radar BEV image, and the camera images with their associated prompt segments. A VLM produces a token sequence, which a tokenizer decoder turns into trajectory points.

The TTA method exploits the fact that LiDAR and camera branches can each generate full trajectories independently. For a given scene, the model produces token sequences from LiDAR alone, camera alone, and all modalities combined. The sequence with the highest joint probability under the chain rule is chosen as the most reliable output, and its token-level probability distribution is used as supervision to update the model across 32 randomly sampled test instances in an offline manner.

Experiments use LLaVA-Interleave as the base VLM, fine-tuned for two epochs on nuScenes with a learning rate of 2e-4, on eight A6000 GPUs with batch size 1, and greedy decoding with a 512-token output limit. DriveVLM and OpenEMMA were reimplemented from their papers: DriveVLM uses a 2-second historical trajectory and three consecutive historical frames with multi-turn chain-of-thought; OpenEMMA uses a 5-second history of speed and curvature plus a single front-view image and outputs speed and curvature that are integrated into a trajectory.

Why This Matters

Impact on research. The paper argues that existing robustness benchmarks ignore the failure modes unique to VLMs, particularly invalid text output and prompt-level interference. By introducing a penalty for invalid predictions, MCL2 and MCC change how robustness is scored: a model that fails to produce a parseable trajectory can no longer avoid being counted, which the authors show is a common occurrence (up to 2,916 invalid outputs for one model under malicious attacks).

Real-world applications:

• Autonomous driving systems that accept natural-language commands from passengers or remote operators, where a corrupted or overwritten instruction could override traffic rules.
• Edge deployment of quantized VLMs, where bit-level and character-level text corruption is more likely.
• Vehicle-to-everything and CAN bus communication, where packet loss can delete entire words from a prompt.
• Multimodal sensor fusion vehicle platforms carrying camera, LiDAR and radar, where a degraded sensor can be compensated by an intact one.

Industry relevance. The results indicate that VLM-based driving systems remain fragile to cheap prompt perturbations and that simple malicious injections are enough to produce unsafe or nonsensical outputs. The paper argues this lowers the barrier for successful attacks, making prompt robustness a security concern rather than only an accuracy concern. The reported gains from adding LiDAR and radar, and from cross-modal distillation at test time, also point to a practical route for improving robustness without retraining on labeled corrupted data.

Future Directions

• Defending against malicious prompt attacks. No tested VLM system, including RoboDriveVLM, demonstrated effective defense; TTA only reduced the number of invalid outputs rather than eliminating them.
• Replacing or maintaining chain-of-thought reasoning under corruption. The paper shows long-dialogue CoT accumulates errors under bit errors, while short-dialogue models break under word deletions. A middle ground or a corruption-aware prompting scheme is an open question.
• Extending the benchmark beyond trajectory prediction and nuScenes. The benchmark currently targets the nuScenes trajectory prediction task; whether the same corruption taxonomy transfers to other driving tasks and datasets is untested.
• Verifying the invalid-output problem in real deployments. The analysis suggests low MCC values can arise because severely corrupted samples are excluded when a model emits invalid commands. A more principled treatment of invalid predictions, or a metric that captures them without distorting the collision ratio, remains unresolved.

Target Audience

Researchers and engineers working on VLM-based end-to-end autonomous driving, robustness and adversarial-robustness benchmarking, multimodal sensor fusion, and test-time adaptation. The paper is also relevant to safety and security teams evaluating whether language-driven driving systems can be trusted with real-world inputs, and to benchmark designers interested in metrics that account for generative model failure modes.

Authors’ abstract

Current Vision-Language Model (VLM)-based end-to-end autonomous driving systems often leverage large language models to generate driving decisions directly based on their understanding of the current scene. However, such systems introduce multiple risks in real-world driving scenarios. To evaluate whether VLMs are truly viable for autonomous driving, we introduce RoboDriveBench, the first robustness benchmark focused on end-to-end trajectory prediction tasks. This benchmark systematically evaluates two critical categories of real-world challenges for VLM-based end-to-end autonomous driving systems through 11 simulated scenarios encompassing various corruption types, including 6 scenarios of sensor corruption caused by environmental variations, along with 5 cases of prompt corruption resulting from human intervention and data transmission failures. Each corruption type includes 250 unique driving scenarios and 5,689 frames, resulting in 64,559 total trajectory prediction cases per evaluation. To overcome these real-world challenges, we propose a novel VLM-based autonomous driving framework called RoboDriveVLM, which enhances robustness by mapping more multimodal data-e.g., lidar and radar-into a unified latent space. Furthermore, we introduce a new Test-Time Adaptation (TTA) method based on cross-modal knowledge distillation to improve the robustness of VLM-based autonomous driving systems. Through extensive experiments, our work highlights the limitations of current VLM-based end-to-end autonomous driving systems and provides a more reliable solution for real-world deployment. Source code and datasets will be released.