NavSafe-$\infty$: Benchmarking Closed-Loop Driving Safety in Photorealistic Environments

NavSafe-$\infty$：在照片级真实环境中评测闭环驾驶安全

Yuxin Bao       Hongwei Ruan 1 1 footnotemark: 1       Luobin Wang      Seth Z. Zhao 2 2 footnotemark: 2       Ziyang Leng † † thanks: Equal Contribution; Order by Last Name. † † thanks: Corresponding authors: luw015@ucsd.edu and sethzhao506@g.ucla.edu .    Zihan Zhang      Yu Zeng      Rowan McAllister      Henrik Christensen      Bolei Zhou Affiliation:  UCLA     UCSD     Toyota Research Institute https://navsafe-vail.github.io/

Abstract

摘要

End-to-end (E2E) driving policies have advanced rapidly on open-loop (OL) benchmarks, yet OL evaluation cannot reveal whether a policy can withstand compounding errors, recover from failures, or interact safely with surrounding actors. We introduce NavSafe-$\infty$, a photorealistic closed-loop (CL) benchmark comprising 280 scenarios spanning 28 event types, each with success and failure criteria defined within a structured traffic-safety taxonomy, yielding category-level capability scores for Traffic Crashes, Vulnerable Road User Crashes, Traffic Violations, and Traffic Incidents. After evaluating 20 E2E policies, we find that OL gains do not reliably transfer to CL safety. Analysis of two common remedies reveals that (1) passive demonstration perturbation helps mainly when CL rollouts stay near their perturbed training states, and (2) OL reinforcement-learning fine-tuning exhibits reward hacking by trading safety margin for ego progress, which CL feedback amplifies into compounding safety-critical errors. Together, these results demonstrate the blind spot of OL benchmarks indicating CL safety success. The benchmark and an extensible toolbox for customizable event curation and policy diagnosis will be open-sourced to facilitate future research.

端到端（E2E）驾驶策略在开环（OL）基准上进步很快，但开环评测无法揭示策略能否承受误差累积、从失败中恢复，或与周围参与者安全交互。我们提出 NavSafe-$\infty$，一个照片级真实的闭环（CL）基准，含 280 个场景、覆盖 28 类事件；每类事件在结构化交通安全分类下定义成功与失败条件，并给出交通事故、弱势道路使用者碰撞、交通违规与交通事件四类能力分数。在评估 20 个 E2E 策略后，我们发现开环收益并不能可靠转化为闭环安全。对两种常见补救手段的分析表明：（1）被动示范扰动主要在闭环 rollout 仍靠近其扰动训练状态时有效；（2）开环强化学习微调会出现奖励投机，用安全余量换自车进度，闭环反馈再把这种错误放大为累积的安全关键失误。合在一起，这些结果暴露了开环基准对闭环安全成功的盲区。基准与可扩展工具箱（用于可定制事件编排与策略诊断）将开源，以推动后续研究。

Figure 1: Motivations. End-to-end (E2E) driving policies with comparable open-loop (OL) predictive driver model scores (PDMS) diverge under closed-loop (CL) execution, yielding different safety outcomes and Driving Scores (DS), which reveals the OL-to-CL evaluation gap in E2E driving.

图 1：动机。开环预测驾驶员模型分数（PDMS）相近的端到端（E2E）驾驶策略，在闭环（CL）执行下会分化，产生不同的安全结果与 Driving Score（DS），揭示了 E2E 驾驶中开环到闭环的评测鸿沟。

1 Introduction

1 引言

Real-world driving safety depends on how a policy resolves safety-critical situations through continuous interaction: in closed-loop (CL) driving, a policy’s actions reshape its future observations and the surrounding dynamics, so the same scenario can lead to divergent outcomes. Open-loop (OL) evaluation on static logged states cannot capture these interaction sequences or the compounding errors they cause. Yet recent end-to-end (E2E) driving policies are evaluated primarily on OL benchmarks such as nuScenes and NAVSIM (Caesar et al., 2020; Dauner et al., 2024; Cao et al., 2025), where safety metrics score predicted trajectories without sequential policy–environment feedback. Figure 1 illustrates this OL-to-CL evaluation gap: policies with similar OL scores yield different CL safety outcomes in the same scenario. Thus, the community still has limited insight into the reliability of current E2E policies confronting safety-critical events.

真实世界驾驶安全取决于策略如何通过持续交互化解安全关键局面：在闭环（CL）驾驶中，策略的动作会重塑未来观测与周围动态，同一场景因而可能走向不同结局。在静态日志状态上的开环（OL）评测无法捕捉这些交互序列及其造成的误差累积。然而近期端到端（E2E）驾驶策略主要在 nuScenes、NAVSIM 等开环基准上评测（Caesar et al., 2020；Dauner et al., 2024；Cao et al., 2025），安全指标只给预测轨迹打分，没有策略—环境的序贯反馈。图 1 说明这一开环到闭环鸿沟：开环分数相近的策略，在同一场景下闭环安全结果却不同。因此，社区对当前 E2E 策略面对安全关键事件时的可靠性仍缺乏洞察。

In this paper, we aim to understand whether existing driving policies can reliably navigate long-horizon CL scenarios across sequences of safety-relevant events. To systematically evaluate these capabilities across diverse, safety-relevant interactions, we introduce NavSafe-$\infty$, a photorealistic CL benchmark that evaluates policies against event-specific objectives derived from real-world traffic-safety events (Liu et al., 2026).

本文旨在理解：现有驾驶策略能否在长视野闭环场景中，可靠穿越一连串与安全相关的事件。为在多样、与安全相关的交互上系统评估这些能力，我们提出 NavSafe-$\infty$——一个照片级真实的闭环基准，依据真实世界交通安全事件导出的事件级目标来评测策略（Liu et al., 2026）。

Each event specifies success and failure conditions that are evaluated over the executed CL rollout. For example, a red-light event requires the ego to remain behind the stop line for the prescribed interval, recognizing compliant stopping as successful task completion rather than route completion. Through event-level evaluation, NavSafe-$\infty$ enables identification of specific safety failures and assessment of whether gains in OL performance translate into improved CL safety.

每个事件都规定了成功与失败条件，并在执行的闭环 rollout 上评估。例如，红灯事件要求自车在规定时间内保持在停止线后，把合规停车视为成功完成任务，而不是路线完成。通过事件级评测，NavSafe-$\infty$ 能够定位具体安全失败，并评估开环表现的提升是否转化为更好的闭环安全。

To assess policy behavior in CL, we conduct a fine-grained analysis across the NavSafe-$\infty$ safety taxonomy. Our results show that strong OL performance does not reliably transfer to CL safety: high-ranking policies on OL benchmarks remain vulnerable across multiple safety-critical event types when operating in policy-induced states. We further examine whether common mitigation practices for narrowing the OL-to-CL gap, such as passive demonstration perturbation (Karkus et al., 2025; Tian et al., 2026) and reinforcement learning (RL) fine-tuning (RLFT) methods, alleviate these failures. Notably, we find that 1) perturbation (training on states perturbed independently of the policy) helps mainly when CL rollouts stay close to those states and 2) RLFT exhibits signs of reward hacking in the OL PDM score (PDMS) (Dauner et al., 2024), while CL feedback can amplify the resulting errors and degrade CL performance. These findings shed light on how future methods should be developed to improve CL driving safety.

为评估闭环中的策略行为，我们沿 NavSafe-$\infty$ 安全分类做细粒度分析。结果表明，强开环表现并不能可靠转化为闭环安全：开环榜上排名靠前的策略，在策略诱导状态下仍对多类安全关键事件脆弱。我们进一步考察缩小开环—闭环差距的常见缓解做法，如被动示范扰动（Karkus et al., 2025；Tian et al., 2026）与强化学习微调（RLFT）。值得注意的是：（1）扰动（在与策略无关地构造的状态上训练）主要在闭环 rollout 靠近这些状态时有帮助；（2）RLFT 在开环 PDM 分数（PDMS）（Dauner et al., 2024）上出现奖励投机迹象，而闭环反馈会放大由此产生的错误并损害闭环表现。这些发现有助于指引未来方法如何提升闭环驾驶安全。

Our contributions are threefold. 1) NavSafe-$\infty$ Benchmark: we present a photorealistic CL benchmark that evaluates driving safety at the event level, grounded in a real-world traffic-safety taxonomy, and validate its rendering fidelity with perceptual and policy-oriented metrics so that policy behavior is evaluated with limited visual distortion (Section 3.3). 2) Analysis: we show that OL performance does not reliably translate into CL safety, localize the resulting failure patterns across policies, and diagnose why perturbation and RLFT yield inconsistent CL gains. 3) NavSafe-$\infty$ Toolbox: we design an extensible toolbox for customizable scenario curation and policy diagnosis under controlled changes to ego and environment states, enabling the community to extend NavSafe-$\infty$ with new safety-critical events and diagnostic protocols. Together, the benchmark and toolbox provide a reliable and extensible testbed for studying various CL driving behaviors.

我们的贡献有三。1）NavSafe-$\infty$ 基准：提出照片级真实的闭环基准，在事件级评估驾驶安全，根植于真实世界交通安全分类，并用感知与策略导向指标验证渲染保真度，使策略行为在有限视觉失真下被评估（第 3.3 节）。2）分析：表明开环表现不能可靠转化为闭环安全，把失败模式定位到各类策略，并诊断扰动与 RLFT 为何带来不一致的闭环收益。3）NavSafe-$\infty$ 工具箱：设计可扩展工具箱，用于可定制场景编排，以及在自车与环境状态受控变化下做策略诊断，使社区能用新的安全关键事件与诊断协议扩展 NavSafe-$\infty$。基准与工具箱一起，为研究多种闭环驾驶行为提供可靠、可扩展的试验台。

2 Related Work

2 相关工作

2.1 End-to-End Driving Benchmarks

2.1 端到端驾驶基准

Open-Loop Benchmarks. OL benchmarks offer a low-cost, scalable proxy on real sensor observations. nuScenes (Caesar et al., 2020) scores trajectories against recorded futures; NAVSIM (Dauner et al., 2024; Cao et al., 2025) replaces displacement error with collision- and compliance-based planning scores; WOMD-Reasoning (Li et al., 2025a) and nuReasoning (Huang et al., 2026b) add reasoning question-answer pairs. Yet the policy never sees the consequences of its own actions, hiding compounding error, failure recovery, and reactive traffic, and OL rankings only loosely track CL performance (Zhao et al., 2026a; Wang et al., 2026b).

开环基准。开环基准在真实传感器观测上提供低成本、可扩展的代理。nuScenes（Caesar et al., 2020）对照记录的未来给轨迹打分；NAVSIM（Dauner et al., 2024；Cao et al., 2025）用基于碰撞与合规的规划分数取代位移误差；WOMD-Reasoning（Li et al., 2025a）与 nuReasoning（Huang et al., 2026b）加入推理问答对。但策略看不到自身动作的后果，从而掩盖误差累积、失败恢复与反应式交通，开环排名对闭环表现也只松散相关（Zhao et al., 2026a；Wang et al., 2026b）。

Closed-Loop Benchmarks. CL benchmarks execute policies through sequential feedback. CARLA-based (Dosovitskiy et al., 2017) Bench2Drive (Jia et al., 2024), HiDrive (Xia et al., 2026b), and Fail2Drive (Gerstenecker et al., 2026) provide structured behavioral evaluation, with the first two reporting per-ability results, but game-engine rendering leaves a domain gap for real-sensor policies. HUGSIM (Zhou et al., 2026a), WorldEngine (Li et al., 2026a), and AlpaSim (NVIDIA et al., 2025) narrow this gap with 3DGS reconstruction (Kerbl et al., 2023; NVIDIA, 2026b), and DriveArena (Yang et al., 2025) and AlpaSim with generative rendering (OmniDreams (Basant et al., 2026)), yet they mainly report aggregate scores on their own scenarios. Moreover, existing ability categories follow driving maneuvers rather than real-world safety events, and success is typically generic route completion. NavSafe-$\infty$ instead combines photorealistic CL with taxonomy-grounded events, event-specific success criteria, and category-level Ability Scores.

闭环基准。闭环基准通过序贯反馈执行策略。基于 CARLA（Dosovitskiy et al., 2017）的 Bench2Drive（Jia et al., 2024）、HiDrive（Xia et al., 2026b）与 Fail2Drive（Gerstenecker et al., 2026）提供结构化行为评测，前两者报告分能力结果，但游戏引擎渲染对真实传感器策略仍有域差距。HUGSIM（Zhou et al., 2026a）、WorldEngine（Li et al., 2026a）与 AlpaSim（NVIDIA et al., 2025）用 3DGS 重建缩小差距（Kerbl et al., 2023；NVIDIA, 2026b），DriveArena（Yang et al., 2025）与 AlpaSim 再用生成式渲染（OmniDreams，Basant et al., 2026），但它们主要在自有场景上报告汇总分数。此外，现有能力分类多跟驾驶机动而非真实安全事件走，成功通常是泛化的路线完成。NavSafe-$\infty$ 则把照片级闭环与分类学扎根的事件、事件特定成功标准以及类别级 Ability Score 结合起来。

2.2 End-to-End Driving Policies

2.2 端到端驾驶策略

We introduce the following driving policy training paradigms that are covered in this paper:

本文涵盖如下驾驶策略训练范式：

Imitation learning-based pretraining. Most E2E and vision–language–action (VLA) policies are trained offline through imitation learning (IL) or supervised fine-tuning (SFT): LTF (Dauner et al., 2024), DiffusionDrive (Liao et al., 2025), and DrivoR (Kirby et al., 2026) learn trajectories from fixed demonstrations; RAP (Feng et al., 2026) augments them with rasterized counterfactual views; SparseDriveV2 (Sun et al., 2026) and GTRS (Li et al., 2025b) score a vocabulary factorized into paths and velocity profiles; VLA policies align vision, language, and action (Zhou et al., 2025). All inherit behavior cloning’s covariate shift: training never covers the state distribution the policy induces at test time.

基于模仿学习的预训练。多数 E2E 与视觉—语言—动作（VLA）策略通过模仿学习（IL）或监督微调（SFT）离线训练：LTF（Dauner et al., 2024）、DiffusionDrive（Liao et al., 2025）与 DrivoR（Kirby et al., 2026）从固定示范学习轨迹；RAP（Feng et al., 2026）用栅格化反事实视图增强；SparseDriveV2（Sun et al., 2026）与 GTRS（Li et al., 2025b）对路径与速度剖面分解的词表打分；VLA 策略对齐视觉、语言与动作（Zhou et al., 2025）。它们都继承行为克隆的协变量偏移：训练从未覆盖测试时策略自身诱导的状态分布。

Reinforcement learning-based post-training. RL optimizes a driving reward atop an imitation-pretrained policy: ReCogDrive (Li et al., 2026d), MTDrive (Li et al., 2026b), and AutoVLA (Zhou et al., 2025) do so over offline observations. Staying offline confines reward to logged states and leaves reward-exploiting policies uncorrected by the environment.

基于强化学习的后训练。RL 在模仿预训练策略之上优化驾驶奖励：ReCogDrive（Li et al., 2026d）、MTDrive（Li et al., 2026b）与 AutoVLA（Zhou et al., 2025）在离线观测上这样做。保持离线会把奖励限制在日志状态，使奖励投机策略得不到环境纠正。

Passive demonstration perturbation methods. To synthesize states absent from logs, SimScale (Tian et al., 2026) perturbs ego trajectories in reconstructed reactive scenes and co-trains with pseudo-expert supervision. BeyondDrive (Wang et al., 2026a) mines expert-proximate unsafe trajectories as negatives.

被动示范扰动方法。为合成日志中缺失的状态，SimScale（Tian et al., 2026）在重建的反应式场景中扰动自车轨迹，并用伪专家监督联合训练。BeyondDrive（Wang et al., 2026a）挖掘靠近专家的不安全轨迹作为负样本。

World-model-based policies. These policies learn future prediction alongside planning: DriveLaW (Xia et al., 2026a) conditions a flow-matching planner on video-diffusion latents, DriveVLA–W0 (Li et al., 2026c) adds future-image prediction as auxiliary supervision to a VLA policy, and SimWAM (Zhao et al., 2026b) co-trains an action expert with a video expert dropped at inference.

基于世界模型的策略。这类策略在规划之外学习未来预测：DriveLaW（Xia et al., 2026a）用视频扩散隐变量条件化流匹配规划器；DriveVLA–W0（Li et al., 2026c）给 VLA 策略加未来图像预测作辅助监督；SimWAM（Zhao et al., 2026b）联合训练动作专家与推理时丢弃的视频专家。

Figure 2: Representative NavSafe-$\infty$ events. Appendix A.2 shows the remaining 16 event types.

图 2：代表性 NavSafe-$\infty$ 事件。附录 A.2 展示其余 16 类事件。

3 NavSafe-$\infty$ Benchmark

3 NavSafe-$\infty$ 基准

NavSafe-$\infty$ is a photorealistic CL benchmark comprising 280 event-based scenarios organized into 28 event types adapted from RoadSafe365 (Liu et al., 2026). These event types span four categories: Traffic Crashes (TC), Vulnerable Road User Crashes (VRUC), Traffic Violations (TV), and Traffic Incidents (TI). Figure 2 shows representative scenarios from each category. Section 3.1 presents the event-based benchmark design, Section 3.2 defines the evaluation protocol and metrics, and Section 3.3 evaluates rendering fidelity and policy-relevant visual alignment.

NavSafe-$\infty$ 是照片级真实的闭环基准，含 280 个事件型场景，归入改编自 RoadSafe365（Liu et al., 2026）的 28 类事件。这些事件类型跨越四类：交通事故（TC）、弱势道路使用者碰撞（VRUC）、交通违规（TV）与交通事件（TI）。图 2 展示各类代表场景。第 3.1 节介绍基于事件的基准设计，第 3.2 节定义评测协议与指标，第 3.3 节评估渲染保真度与策略相关的视觉对齐。

3.1 Event-Based Benchmark Design

3.1 基于事件的基准设计

Design Principles. Long-horizon driving requires a policy to resolve a sequence of local interactions and traffic-rule decisions. A single route-level score aggregates behavior across these events, making it difficult to assess specific safety capabilities. Prior work further shows that long-route evaluation can produce high-variance aggregate scores (Jia et al., 2024). NavSafe-$\infty$ therefore evaluates bounded, event-centered scenarios, enabling granular capability assessment while preserving CL feedback within each event. Figure 3 illustrates how this design preserves both properties: each bounded event isolates a specific safety capability while retaining policy-environment feedback throughout the rollout.

设计原则。长视野驾驶要求策略化解一连串局部交互与交规决策。单一路线级分数会把这些事件上的行为汇总，难以评估具体安全能力。已有工作还表明长路线评测会产生高方差汇总分数（Jia et al., 2024）。因此 NavSafe-$\infty$ 评估有界、以事件为中心的场景，在保留每个事件内闭环反馈的同时做细粒度能力评估。图 3 说明该设计如何同时保留这两点：每个有界事件隔离一种具体安全能力，并在整个 rollout 中保持策略—环境反馈。

Figure 3: NavSafe-$\infty$ Closed-Loop Simulation Process. NavSafe-$\infty$ loads a bounded, event-specific reconstruction. At each step, the renderer produces camera observations from the current ego and actor states; the policy’s plan advances the simulator, yielding the next observation.

图 3：NavSafe-$\infty$ 闭环仿真流程。NavSafe-$\infty$ 加载有界、事件特定的重建。每一步，渲染器根据当前自车与参与者状态生成相机观测；策略的规划推进仿真器，得到下一帧观测。

Event Definition. We define an event as a bounded traffic interaction or rule-governed situation with explicit task and safety requirements. Each scenario instantiates an event type through a specified initial scene, relevant road users or traffic controls, and termination conditions. Figure 2 demonstrates some representative examples including responding to a braking lead vehicle, yielding to a crossing pedestrian, holding behind a red-light stop line, and navigating a work-zone obstruction. The required behavior determines how success is evaluated: a red-light event requires a compliant hold for the prescribed interval, whereas a work-zone event requires completing the prescribed bypass without disallowed infractions. Appendices A.1 and D.2 list the inclusion criteria of all 28 event types and their success and termination rules.

事件定义。我们把事件定义为有显式任务与安全要求的有界交通交互或规则约束情境。每个场景通过指定初始场面、相关道路使用者或交通控制以及终止条件，实例化一类事件。图 2 给出若干代表例子：响应制动前车、让行横穿行人、在红灯停止线后保持、绕行施工区障碍。所需行为决定成功如何评估：红灯事件要求在规定时间内合规保持，施工区事件则要求按规定完成绕行且无禁止违规。附录 A.1 与 D.2 列出全部 28 类事件的纳入标准及其成功与终止规则。

Task Setting. Following Zhao et al. (2026a), we formulate E2E CL driving as a finite-horizon partially observable Markov decision process traversing through each scenario $e$ of event type $\ell$, namely $\mathcal{M}_{e}=(\mathcal{S},\mathcal{A},\mathcal{O},P_{e},\Omega_{\kappa},\rho_{e},R_{\ell},H_{e})$, with transition $P_{e}$, initial-state distribution $\rho_{e}$, sparse terminal success reward $R_{\ell}$, and horizon $H_{e}$. Two properties distinguish this formulation. First, the emission model $\Omega_{\kappa}(o_{t}\mid s_{t})$ provides configurable camera observations: because each scene is reconstructed as a 3DGS representation, the same scenario can be rendered as single-view, multi-view, or any other camera rig $\kappa$ by changing only the camera intrinsics and extrinsics, without re-collecting data. Second, the dynamic state $s_{t}$ is fully controllable, including editing traffic elements and prescribing the behaviors of surrounding vehicles. The objective is to complete the event-specific task while maintaining safe execution throughout the CL interaction.

任务设定。遵循 Zhao et al.（2026a），我们把 E2E 闭环驾驶表述为穿越每个事件类型 $\ell$ 的场景 $e$ 的有限视野部分可观测马尔可夫决策过程，即 $\mathcal{M}_{e}=(\mathcal{S},\mathcal{A},\mathcal{O},P_{e},\Omega_{\kappa},\rho_{e},R_{\ell},H_{e})$，含转移 $P_{e}$、初始状态分布 $\rho_{e}$、稀疏终端成功奖励 $R_{\ell}$ 与视野 $H_{e}$。该表述有两点特别之处。第一，发射模型 $\Omega_{\kappa}(o_{t}\mid s_{t})$ 提供可配置相机观测：因每场景重建为 3DGS 表示，只需改相机内外参即可把同一场景渲染为单视角、多视角或其他相机配置 $\kappa$，无需重新采集。第二，动态状态 $s_{t}$ 完全可控，包括编辑交通要素并规定周围车辆行为。目标是在完成事件特定任务的同时，在整个闭环交互中保持安全执行。

3.2 Evaluation Protocol and Metrics

3.2 评测协议与指标

Appendix D provides the full evaluation protocol, while Appendix H reports runtime and resource requirements.

附录 D 给出完整评测协议，附录 H 报告运行时与资源需求。

We report Driving Score (DS), Success Rate (SR), Driving Efficiency (DE), and Comfort, following established CL driving evaluation protocols (Jia et al., 2024; Caesar et al., 2021). For each event, DS is computed by multiplying Event Progress (EP) by penalties for recorded infractions and scaling the result to $[0,100]$. It therefore rewards event progress while penalizing unsafe or non-compliant behavior. SR is the percentage of events that satisfy their event-type-specific success criteria within the time budget without a disallowed infraction. DE measures ego speed relative to surrounding traffic, while Comfort measures compliance with predefined bounds on acceleration, jerk, yaw rate, and yaw acceleration. We additionally report an Ability Score for each benchmark category (TC, VRUC, TV, and TI), defined as the unweighted mean of the event-type-level SRs within that category.

我们报告 Driving Score（DS）、Success Rate（SR）、Driving Efficiency（DE） 与 Comfort，遵循既有闭环驾驶评测协议（Jia et al., 2024；Caesar et al., 2021）。对每个事件，DS 由 Event Progress（EP） 乘以已记录违规的惩罚，再缩放到 $[0,100]$。因此它奖励事件进度，同时惩罚不安全或不合规行为。SR 是在时限内满足事件类型特定成功标准且无禁止违规的事件百分比。DE 衡量自车相对周围交通的速度，Comfort 衡量加速度、加加速度、横摆角速度与横摆角加速度是否落在预定界限内。我们还为每个基准类别（TC、VRUC、TV、TI）报告 Ability Score，定义为该类内事件类型级 SR 的等权平均。

Generative Renderer	Venue	FID$\downarrow$	FVD$\downarrow$	$\mathrm{FD}_{\pi}\downarrow$	$\mathrm{FD}_{\pi}^{k}\downarrow$
DrivoR	DD	LTF	RAP	SDv2
DriveArena (Yang et al., 2025)	ICCV 2025	27.14	814.81	18.55	12.88	33.96	7.61	27.10	11.18
DreamStream (Leng et al., 2026)	CoRL 2026	11.53	176.83	6.27	5.51	11.06	2.89	6.67	5.24
NavSafe-$\infty$	–	4.95	45.34	2.45	2.26	5.01	1.07	1.67	2.26

Table 1: Quantitative visual fidelity comparison across generative renderers. All metrics compare rendered observations with the corresponding recorded clips. DD refers to DiffusionDrive (Liao et al., 2025); SDv2 refers to SparseDriveV2 (Sun et al., 2026).

生成式渲染器	Venue	FID$\downarrow$	FVD$\downarrow$	$\mathrm{FD}_{\pi}\downarrow$	$\mathrm{FD}_{\pi}^{k}\downarrow$
DrivoR	DD	LTF	RAP	SDv2
DriveArena (Yang et al., 2025)	ICCV 2025	27.14	814.81	18.55	12.88	33.96	7.61	27.10	11.18
DreamStream (Leng et al., 2026)	CoRL 2026	11.53	176.83	6.27	5.51	11.06	2.89	6.67	5.24
NavSafe-$\infty$	–	4.95	45.34	2.45	2.26	5.01	1.07	1.67	2.26

表 1：生成式渲染器的定量视觉保真度比较。所有指标对照对应录制片段比较渲染观测。DD 指 DiffusionDrive（Liao et al., 2025）；SDv2 指 SparseDriveV2（Sun et al., 2026）。

3.3 Rendering Fidelity and Policy-Relevant Visual Alignment

3.3 渲染保真度与策略相关视觉对齐

Observations are rendered from 3DGS reconstructions (NVIDIA, 2026b) and refined by the diffusion-based DiffusionHarmonizer (Zhang et al., 2026) (Appendix C). To assess the visual fidelity of the reconstructed observations, we compare rendered frames against the corresponding real camera frames from the source logs. We report FID and FVD (Heusel et al., 2017; Unterthiner et al., 2018) for frame-level and video-level (temporal) distribution gaps, and the policy-oriented $\mathrm{FD}_{\pi}$ (Leng et al., 2026), which is the Fréchet distance between policy features of real and rendered frames, averaged over five E2E policies ($\mathrm{FD}_{\pi}^{k}$ per policy; details in Appendix C.4).

观测由 3DGS 重建渲染（NVIDIA, 2026b），并由基于扩散的 DiffusionHarmonizer（Zhang et al., 2026）精炼（附录 C）。为评估重建观测的视觉保真度，我们将渲染帧与源日志中对应的真实相机帧比较。报告帧级与视频级（时间）分布差距的 FID 与 FVD（Heusel et al., 2017；Unterthiner et al., 2018），以及策略导向的 $\mathrm{FD}_{\pi}$（Leng et al., 2026）——真实与渲染帧策略特征之间的 Fréchet 距离，对五个 E2E 策略取平均（每策略 $\mathrm{FD}_{\pi}^{k}$；细节见附录 C.4）。

As shown in Table 1 and Figure 4, NavSafe-$\infty$ achieves better rendering quality than existing generative renderers on all three metrics.

如表 1 与图 4 所示，NavSafe-$\infty$ 在全部三项指标上优于现有生成式渲染器。

Figure 4: Rendering quality on a long-horizon scenario. Left: First-person views at $t\in\{0,5,10,15\}$s. Right: Top-down bird’s-eye view. DriveArena shows temporal inconsistency and DreamStream exhibits cumulative drift, whereas NavSafe-$\infty$ stays temporally consistent.

图 4：长视野场景上的渲染质量。左：$t\in\{0,5,10,15\}$s 的第一人称视角。右：俯视鸟瞰。DriveArena 出现时间不一致，DreamStream 出现累积漂移，而 NavSafe-$\infty$ 保持时间一致。

4 Experiments

4 实验

We organize our experiments around three research questions: (1) How closely is performance on the OL benchmark NAVSIM (Dauner et al., 2024) associated with success in safety-critical events under CL execution? (2) What failure mechanisms underlie representative unsafe CL outcomes across mainstream E2E policy paradigms? (3) Why do post-IL methods such as perturbation and RLFT yield inconsistent CL gains across policies?

我们围绕三个研究问题组织实验：**（1）开环基准 NAVSIM（Dauner et al., 2024）上的表现，与闭环执行下安全关键事件成功的关联有多紧？（2）主流 E2E 策略范式中，代表性不安全闭环结果背后的失败机制是什么？（3）**为何扰动与 RLFT 等后 IL 方法在不同策略上带来不一致的闭环收益？

4.1 NavSafe-$\infty$ Leaderboard

4.1 NavSafe-$\infty$ 排行榜

We evaluate policies using four global CL metrics and four category-specific ability scores (Table 2). Appendix F.1 gives the complete leaderboard.

我们用四个全局闭环指标与四个类别特定能力分数评估策略（表 2）。附录 F.1 给出完整排行榜。

Policy	Venue	Closed-loop metrics	Closed-loop ability scores
DS	SR	DE	Comf.	TC	VRUC	TV	TI
Human Driver Reference	–	100.00$\pm$0.00	100.00$\pm$0.00	316.52$\pm$0.42	75.15$\pm$1.89	100.00$\pm$0.00	100.00$\pm$0.00	100.00$\pm$0.00	100.00$\pm$0.00
Privileged reference
PDM-Closed (Dauner et al., 2023)	CoRL 2023	90.17$\pm$1.00	81.31$\pm$1.03	305.27$\pm$8.57	82.49$\pm$1.39	88.67$\pm$1.53	72.50$\pm$0.00	84.24$\pm$1.39	57.78$\pm$1.92
IL-based Methods
LTF (Dauner et al., 2024)	NeurIPS 2024	53.04$\pm$1.92	27.74$\pm$1.76	163.71$\pm$0.11	97.81$\pm$0.15	31.67$\pm$0.58	25.00$\pm$7.50	28.48$\pm$1.89	15.56$\pm$1.92
DiffusionDrive (Liao et al., 2025)	CVPR 2025	44.77$\pm$0.75	20.95$\pm$0.55	165.08$\pm$1.84	97.68$\pm$0.56	21.33$\pm$1.15	11.67$\pm$1.44	23.64$\pm$0.00	22.22$\pm$1.92
DrivoR (Kirby et al., 2026)	CVPR 2026	64.74$\pm$1.60	50.71$\pm$0.71	188.02$\pm$1.07	87.92$\pm$1.25	58.67$\pm$2.52	31.67$\pm$5.77	52.42$\pm$2.62	43.33$\pm$0.00
RAP (Feng et al., 2026)	ICLR 2026	47.70$\pm$0.66	27.26$\pm$0.41	220.78$\pm$3.77	48.38$\pm$0.60	32.33$\pm$1.15	14.17$\pm$6.29	28.79$\pm$0.52	22.22$\pm$3.85
SparseDriveV2 (Sun et al., 2026)	ECCV 2026	65.26$\pm$1.72	48.81$\pm$3.04	167.99$\pm$1.01	93.41$\pm$0.43	54.00$\pm$0.00	43.33$\pm$8.04	48.18$\pm$4.17	41.11$\pm$3.85
GTRS-Dense–V2-99 (Li et al., 2025b)	arXiv 2025	64.27$\pm$0.76	49.52$\pm$1.15	163.88$\pm$0.87	95.90$\pm$0.63	52.00$\pm$1.73	40.00$\pm$2.50	54.24$\pm$0.52	36.67$\pm$0.00
ReCogDrive–2B–IL (Li et al., 2026d)	ICLR 2026	48.98$\pm$0.95	28.21$\pm$1.43	166.94$\pm$3.15	97.58$\pm$0.11	30.00$\pm$1.00	16.67$\pm$3.82	31.21$\pm$0.52	26.67$\pm$3.33
MTDrive–SFT (Li et al., 2026b)	arXiv 2026	48.78$\pm$0.88	31.79$\pm$1.43	173.77$\pm$0.76	94.51$\pm$1.25	30.33$\pm$1.15	15.00$\pm$6.61	35.76$\pm$1.39	44.44$\pm$1.92
RLFT-based Methods
ReCogDrive–2B–RL (Li et al., 2026d)	ICLR 2026	53.64$\pm$1.42	30.95$\pm$2.06	173.96$\pm$1.90	85.10$\pm$0.49	35.33$\pm$2.31	18.33$\pm$6.29	32.42$\pm$1.39	27.78$\pm$5.09
MTDrive–mtGRPO (Li et al., 2026b)	arXiv 2026	55.86$\pm$0.50	40.60$\pm$0.90	277.62$\pm$3.17	93.94$\pm$0.41	40.33$\pm$2.89	16.67$\pm$1.44	46.36$\pm$0.91	52.22$\pm$3.85
AutoVLA (Zhou et al., 2025)	NeurIPS 2025	51.05$\pm$0.80	29.52$\pm$2.43	186.02$\pm$0.58	65.37$\pm$0.47	33.00$\pm$2.65	15.00$\pm$4.33	29.70$\pm$2.92	36.67$\pm$8.82
Passive Demonstration Perturbation Methods
DiffusionDrive (SimScale) (Tian et al., 2026)	CVPR 2026	52.19$\pm$2.05	35.24$\pm$2.38	189.66$\pm$4.28	96.92$\pm$0.34	38.33$\pm$1.15	18.33$\pm$7.22	36.67$\pm$5.01	42.22$\pm$3.85
DrivoR (SimScale, 134k) (Tian et al., 2026)	CVPR 2026	57.66$\pm$1.32	42.50$\pm$0.36	176.73$\pm$0.92	85.88$\pm$0.39	44.00$\pm$1.00	17.50$\pm$2.50	48.18$\pm$2.41	50.00$\pm$0.00
LTF (SimScale) (Tian et al., 2026)	CVPR 2026	52.65$\pm$0.88	34.05$\pm$0.21	192.09$\pm$0.85	97.41$\pm$0.48	35.00$\pm$1.73	17.50$\pm$2.50	38.48$\pm$0.52	36.67$\pm$0.00
GTRS-Dense–V2-99 (SimScale) (Tian et al., 2026)	CVPR 2026	73.54$\pm$0.84	61.79$\pm$1.56	141.50$\pm$1.30	87.69$\pm$1.66	69.33$\pm$0.58	50.00$\pm$2.50	64.24$\pm$1.89	43.33$\pm$3.33
DiffusionDrive (BeyondDrive) (Wang et al., 2026a)	ECCV 2026	46.61$\pm$0.07	21.79$\pm$0.94	172.79$\pm$1.26	97.24$\pm$0.19	22.67$\pm$1.53	10.00$\pm$0.00	25.15$\pm$1.39	22.22$\pm$1.92
World-Model-based Methods
SimWAM (Zhao et al., 2026b)	arXiv 2026	57.53$\pm$2.72	37.50$\pm$1.56	160.54$\pm$1.64	97.19$\pm$0.27	41.33$\pm$0.58	26.67$\pm$7.22	40.61$\pm$0.52	27.78$\pm$5.09

Table 2: NavSafe-$\infty$ leaderboard. Among learned policies, blue, green, and yellow backgrounds denote the first-, second-, and third-highest point estimates in each column, respectively. $\pm$ is the sample standard deviation across the three per-seed estimates.

策略	Venue	闭环指标	闭环能力分数
DS	SR	DE	Comf.	TC	VRUC	TV	TI
人类驾驶员参考	–	100.00$\pm$0.00	100.00$\pm$0.00	316.52$\pm$0.42	75.15$\pm$1.89	100.00$\pm$0.00	100.00$\pm$0.00	100.00$\pm$0.00	100.00$\pm$0.00
特权参考
PDM-Closed (Dauner et al., 2023)	CoRL 2023	90.17$\pm$1.00	81.31$\pm$1.03	305.27$\pm$8.57	82.49$\pm$1.39	88.67$\pm$1.53	72.50$\pm$0.00	84.24$\pm$1.39	57.78$\pm$1.92
基于 IL 的方法
LTF (Dauner et al., 2024)	NeurIPS 2024	53.04$\pm$1.92	27.74$\pm$1.76	163.71$\pm$0.11	97.81$\pm$0.15	31.67$\pm$0.58	25.00$\pm$7.50	28.48$\pm$1.89	15.56$\pm$1.92
DiffusionDrive (Liao et al., 2025)	CVPR 2025	44.77$\pm$0.75	20.95$\pm$0.55	165.08$\pm$1.84	97.68$\pm$0.56	21.33$\pm$1.15	11.67$\pm$1.44	23.64$\pm$0.00	22.22$\pm$1.92
DrivoR (Kirby et al., 2026)	CVPR 2026	64.74$\pm$1.60	50.71$\pm$0.71	188.02$\pm$1.07	87.92$\pm$1.25	58.67$\pm$2.52	31.67$\pm$5.77	52.42$\pm$2.62	43.33$\pm$0.00
RAP (Feng et al., 2026)	ICLR 2026	47.70$\pm$0.66	27.26$\pm$0.41	220.78$\pm$3.77	48.38$\pm$0.60	32.33$\pm$1.15	14.17$\pm$6.29	28.79$\pm$0.52	22.22$\pm$3.85
SparseDriveV2 (Sun et al., 2026)	ECCV 2026	65.26$\pm$1.72	48.81$\pm$3.04	167.99$\pm$1.01	93.41$\pm$0.43	54.00$\pm$0.00	43.33$\pm$8.04	48.18$\pm$4.17	41.11$\pm$3.85
GTRS-Dense–V2-99 (Li et al., 2025b)	arXiv 2025	64.27$\pm$0.76	49.52$\pm$1.15	163.88$\pm$0.87	95.90$\pm$0.63	52.00$\pm$1.73	40.00$\pm$2.50	54.24$\pm$0.52	36.67$\pm$0.00
ReCogDrive–2B–IL (Li et al., 2026d)	ICLR 2026	48.98$\pm$0.95	28.21$\pm$1.43	166.94$\pm$3.15	97.58$\pm$0.11	30.00$\pm$1.00	16.67$\pm$3.82	31.21$\pm$0.52	26.67$\pm$3.33
MTDrive–SFT (Li et al., 2026b)	arXiv 2026	48.78$\pm$0.88	31.79$\pm$1.43	173.77$\pm$0.76	94.51$\pm$1.25	30.33$\pm$1.15	15.00$\pm$6.61	35.76$\pm$1.39	44.44$\pm$1.92
基于 RLFT 的方法
ReCogDrive–2B–RL (Li et al., 2026d)	ICLR 2026	53.64$\pm$1.42	30.95$\pm$2.06	173.96$\pm$1.90	85.10$\pm$0.49	35.33$\pm$2.31	18.33$\pm$6.29	32.42$\pm$1.39	27.78$\pm$5.09
MTDrive–mtGRPO (Li et al., 2026b)	arXiv 2026	55.86$\pm$0.50	40.60$\pm$0.90	277.62$\pm$3.17	93.94$\pm$0.41	40.33$\pm$2.89	16.67$\pm$1.44	46.36$\pm$0.91	52.22$\pm$3.85
AutoVLA (Zhou et al., 2025)	NeurIPS 2025	51.05$\pm$0.80	29.52$\pm$2.43	186.02$\pm$0.58	65.37$\pm$0.47	33.00$\pm$2.65	15.00$\pm$4.33	29.70$\pm$2.92	36.67$\pm$8.82
被动示范扰动方法
DiffusionDrive (SimScale) (Tian et al., 2026)	CVPR 2026	52.19$\pm$2.05	35.24$\pm$2.38	189.66$\pm$4.28	96.92$\pm$0.34	38.33$\pm$1.15	18.33$\pm$7.22	36.67$\pm$5.01	42.22$\pm$3.85
DrivoR (SimScale, 134k) (Tian et al., 2026)	CVPR 2026	57.66$\pm$1.32	42.50$\pm$0.36	176.73$\pm$0.92	85.88$\pm$0.39	44.00$\pm$1.00	17.50$\pm$2.50	48.18$\pm$2.41	50.00$\pm$0.00
LTF (SimScale) (Tian et al., 2026)	CVPR 2026	52.65$\pm$0.88	34.05$\pm$0.21	192.09$\pm$0.85	97.41$\pm$0.48	35.00$\pm$1.73	17.50$\pm$2.50	38.48$\pm$0.52	36.67$\pm$0.00
GTRS-Dense–V2-99 (SimScale) (Tian et al., 2026)	CVPR 2026	73.54$\pm$0.84	61.79$\pm$1.56	141.50$\pm$1.30	87.69$\pm$1.66	69.33$\pm$0.58	50.00$\pm$2.50	64.24$\pm$1.89	43.33$\pm$3.33
DiffusionDrive (BeyondDrive) (Wang et al., 2026a)	ECCV 2026	46.61$\pm$0.07	21.79$\pm$0.94	172.79$\pm$1.26	97.24$\pm$0.19	22.67$\pm$1.53	10.00$\pm$0.00	25.15$\pm$1.39	22.22$\pm$1.92
基于世界模型的方法
SimWAM (Zhao et al., 2026b)	arXiv 2026	57.53$\pm$2.72	37.50$\pm$1.56	160.54$\pm$1.64	97.19$\pm$0.27	41.33$\pm$0.58	26.67$\pm$7.22	40.61$\pm$0.52	27.78$\pm$5.09

表 2：NavSafe-$\infty$ 排行榜。在学习型策略中，蓝、绿、黄背景分别表示各列第一、第二、第三高的点估计。$\pm$ 为三个种子估计的样本标准差。

The leaderboard reveals two important insights. First, strong OL performance does not ensure CL safety. Despite approaching human-level performance on the NAVSIM leaderboard (Figure 14), the evaluated policies exhibit a pronounced CL safety gap: even the strongest learned policy trails the privileged PDM-Closed reference by $19.5$ percentage points in SR. Second, safety performance varies substantially across event types, and no learning-based policy leads all four categories. The same training intervention can affect policies differently: SimScale raises DiffusionDrive’s SR but lowers DrivoR’s (Table 2). A single OL or aggregate CL score therefore cannot reveal how a policy behaves across the states and safety events encountered during interaction.

排行榜揭示两点重要洞察。第一，强开环表现不能保证闭环安全。尽管在 NAVSIM 排行榜上接近人类水平（图 14），所评策略仍存在明显的闭环安全差距：即便最强的学习型策略，在 SR 上仍落后特权参考 PDM-Closed 达 $19.5$ 个百分点。第二，安全表现跨事件类型差异很大，没有一个学习型策略在全部四类上领先。同一训练干预对不同策略影响也不同：SimScale 提高 DiffusionDrive 的 SR，却降低 DrivoR 的 SR（表 2）。因此，单一开环或汇总闭环分数无法揭示策略在交互中遇到的状态与安全事件上如何表现。

4.2 Failure Investigations

4.2 失败调查

We further conduct case studies to investigate failure modes across representative E2E policy paradigms. We analyze one diagnostic case from each of the four NavSafe-$\infty$ categories, designed to probe distinct safety capabilities. This analysis localizes unsafe CL outcomes to specific breakdowns in planning, scoring, prediction, and reasoning. Case details are in Appendix F.3.

我们进一步做案例研究，调查代表性 E2E 策略范式的失败模式。从 NavSafe-$\infty$ 四个类别各取一个诊断案例，分别探测不同安全能力。该分析把不安全闭环结果定位到规划、打分、预测与推理中的具体断裂。案例细节见附录 F.3。

Figure 5: Left: Planning Failure. LTF detects crossing traffic at $29\,\mathrm{m}$, but continues accelerating and brakes too late to avoid a collision. Right: Scoring Failure. DrivoR executes its top-ranked trajectory and collides with the lead vehicle, while a safe stopping trajectory is ranked 43rd.

图 5：左：规划失败。LTF 在 $29\,\mathrm{m}$ 处检测到横穿交通，却继续加速，制动过晚以至碰撞。右：打分失败。DrivoR 执行排名第一的轨迹并与前车碰撞，而一条安全停车轨迹排在第 43。

Planning Failure: Causal confusion in hazard-conditioned planning. The I-3 General Incident event in the Traffic Incidents (TI) category requires a prompt response to an unexpected crossing conflict. Although LTF consistently detects the crossing vehicles, its longitudinal plan resembles nominal car following and delays decisive braking until the collision becomes unavoidable (Figure 5, left). This behavior is consistent with causal confusion in offline behavior cloning: the policy perceives the hazard, yet its plan remains governed by correlations associated with routine car following rather than by the detected crossing conflict.

规划失败：危险条件规划中的因果混淆。交通事件（TI）类中的 I-3 一般事件要求对意外横穿冲突迅速响应。尽管 LTF 一贯检测到横穿车辆，其纵向规划却类似名义跟车，把果断制动拖到碰撞不可避免（图 5，左）。这与离线行为克隆中的因果混淆一致：策略感知到危险，但规划仍受常规跟车相关关系支配，而非由检测到的横穿冲突支配。

Scoring Failure: Trajectory scoring gap prevents safe planning. The V-1 Red-Light/Stop-Sign event in the Traffic Violations (TV) category requires the policy to stop at the applicable traffic control. DrivoR’s candidate set contains a collision-free stopping trajectory, yet the learned scorer assigns a higher value to the collision-bound proposal (Figure 5, right). The available safe proposal localizes the observed failure to trajectory ranking rather than candidate generation. DrivoR learns its scoring function from trajectory-level oracle labels evaluated at logged states. The observed misranking exposes an OL–CL generalization gap in which the learned safety ordering does not transfer to the policy-induced state encountered during rollout.

打分失败：轨迹打分差距阻碍安全规划。交通违规（TV）类中的 V-1 红灯/停车标志事件要求策略在适用交通控制处停车。DrivoR 的候选集中含一条无碰撞停车轨迹，但学到的打分器却给会碰撞的提案更高分（图 5，右）。可用的安全提案把观察到的失败定位到轨迹排序而非候选生成。DrivoR 在日志状态上用轨迹级 oracle 标签学习打分函数。观察到的错排暴露了开环—闭环泛化差距：学到的安全排序不能迁移到 rollout 中遇到的策略诱导状态。

Prediction Failure: Latent prediction errors can undermine planning in world-model-based policies. The C-7 Head-On event in the Traffic Crashes (TC) category requires the policy to maintain sufficient clearance from oncoming traffic in a constrained corridor. For this diagnostic, we re-enable and decode a future frame with SimWAM’s retained video expert from the same CL observation. SimWAM omits the oncoming vehicle from its future prediction and plans through the region it occupies (Figure 6, left). This coupled failure exposes a breakdown in action-relevant actor persistence, as the model drops a safety-critical actor from its predicted world state. Latent prediction errors can undermine world-model-based planning by removing safety-critical constraints from the representation used for trajectory generation under CL execution.

预测失败：隐式预测错误可破坏基于世界模型的规划。交通事故（TC）类中的 C-7 迎面事件要求策略在受限走廊内与对向交通保持足够间隙。在该诊断中，我们重新启用并用同一闭环观测解码 SimWAM 保留的视频专家未来帧。SimWAM 在未来预测中漏掉了对向车辆，并规划穿过其所占区域（图 6，左）。这种耦合失败暴露了与动作相关的参与者持续性断裂：模型从预测世界状态中丢掉了安全关键参与者。隐式预测错误可通过从轨迹生成所用表示中移除安全关键约束，破坏基于世界模型的规划。

Figure 6: Left: Prediction Failure. SimWAM omits the oncoming vehicle visible in the rendered observation; the policy plans through the space it occupies and collides. Right: Reasoning Failure. At the same instant, two policy-induced states reached by different rollouts both identify the crossing pedestrians and call for a stop, but only State 1 plans to stop; State 2 accelerates and collides.

图 6：左：预测失败。SimWAM 漏掉渲染观测中可见的对向车辆；策略规划穿过其所占空间并碰撞。右：推理失败。在同一时刻，由不同 rollout 到达的两个策略诱导状态都识别出横穿行人并要求停车，但只有状态 1 规划停车；状态 2 加速并碰撞。

Reasoning Failure: Reasoning–action alignment is unstable across policy-induced states for VLA policies. The R-1 Pedestrian-Involved event in the Vulnerable Road User Crashes (VRUC) category requires the policy to stop or yield to pedestrians crossing the ego path. At the same instant, in two rollouts that differ only in the evaluation seed, AutoVLA correctly calls for stopping in two policy-induced states, but only one decoded trajectory realizes that decision (Figure 6, right). The matched comparison isolates a state-conditioned failure of reasoning–action grounding, whereby the reasoning remains invariant while the resulting plans diverge across policy-induced states.

推理失败：VLA 策略在策略诱导状态间的推理—动作对齐不稳定。弱势道路使用者碰撞（VRUC）类中的 R-1 行人相关事件要求策略对横穿自车路径的行人停车或让行。在同一时刻，仅评测种子不同的两次 rollout 中，AutoVLA 在两个策略诱导状态上都正确要求停车，但只有一条解码轨迹落实了该决定（图 6，右）。配对比较隔离了推理—动作落地的状态条件失败：推理保持不变，而所得规划跨策略诱导状态分化。

4.3 Understanding the Limits of Passive Demonstration Perturbation and RLFT in Closed-Loop

4.3 理解被动示范扰动与 RLFT 在闭环中的局限

Passive demonstration perturbation and RLFT are two widely adopted remedies that go beyond imitation learning to improve CL performance (Karkus et al., 2025). Perturbation enhances IL by further training the policy on states constructed independently of its own rollouts. We show that this approach helps mainly when the policy’s CL rollouts remain close to these perturbed states. RLFT for E2E driving, on the other hand, typically optimizes an OL proxy reward against a frozen logged future. As a result, OL reward hacking, such as trading safety margin for progress, can carry over to CL execution and compound over repeated replanning steps.

被动示范扰动与 RLFT 是超越模仿学习以改进闭环表现的两种广泛采用的补救（Karkus et al., 2025）。扰动通过在与策略自身 rollout 无关地构造的状态上继续训练来增强 IL。我们表明，该方法主要在策略的闭环 rollout 仍靠近这些扰动状态时有帮助。另一方面，E2E 驾驶的 RLFT 通常在冻结的日志未来上优化开环代理奖励。因此，开环奖励投机——例如用安全余量换进度——会带到闭环执行，并在反复重规划中累积。

Figure 7: Effect of perturbation on CL rollouts. State shifts and Monte Carlo return changes show that perturbation helps when CL rollout states remain covered and hurts otherwise (Appendix F.4).

图 7：扰动对闭环 rollout 的影响。状态偏移与蒙特卡洛回报变化表明：当闭环 rollout 状态仍被覆盖时扰动有帮助，否则有害（附录 F.4）。

Perturbation effectiveness hinges on CL rollout distribution coverage. Such methods (Tian et al., 2026) extend the logged demonstrations $\mathcal{D}^{\text{log}}$ with $\mathcal{D}^{\text{aug}}$, pairing observations of perturbed ego states $s^{\text{aug}}$ with verified expert recovery trajectories $a^{\text{aug}}$:

扰动有效性取决于闭环 rollout 分布覆盖。此类方法（Tian et al., 2026）用 $\mathcal{D}^{\text{aug}}$ 扩展日志示范 $\mathcal{D}^{\text{log}}$，把扰动自车状态 $s^{\text{aug}}$ 的观测与经验证的专家恢复轨迹 $a^{\text{aug}}$ 配对：

$$\min_{\theta}\;\mathbb{E}_{(s,a)\sim\mathcal{D}^{\text{log}}\cup\,{\mathcal{D}^{\text{aug}}}}\!\left[\ell\big(a,\pi_{\theta}(\cdot\mid s)\big)\right]. \tag{1}$$

This improves CL performance when rollouts remain near the perturbation support, but this depends on the learned trajectory proposal, which the objective does not directly constrain. In practice, the outcome varies across policies (Figure 7). For anchor-based methods such as DiffusionDrive (Liao et al., 2025) and GTRS (Li et al., 2025b), trajectory candidates remain close to expert trajectories and are largely unaffected by training on perturbed states. Training mainly improves the scorer, keeping selected rollouts closer to the perturbed state distribution. For query-based DrivoR and LTF, training on $\mathcal{D}^{\text{aug}}$ improves OL scores on expert states, yet CL visitation still drifts away from the support of $\mathcal{D}^{\text{aug}}$. This limitation arises because $\mathcal{D}^{\text{aug}}$ is constructed independently of the policy and thus does not capture the policy visitation distribution, which only emerges in CL execution.

当 rollout 仍靠近扰动支撑时，这能改进闭环表现，但取决于所学轨迹提案——目标并不直接约束它。实践中结果因策略而异（图 7）。对 DiffusionDrive（Liao et al., 2025）、GTRS（Li et al., 2025b）等基于锚点的方法，轨迹候选仍靠近专家轨迹，受扰动状态训练影响有限。训练主要改进打分器，使所选 rollout 更靠近扰动状态分布。对基于查询的 DrivoR 与 LTF，在 $\mathcal{D}^{\text{aug}}$ 上训练能提高专家状态上的开环分数，但闭环访问仍会漂离 $\mathcal{D}^{\text{aug}}$ 的支撑。这一局限源于 $\mathcal{D}^{\text{aug}}$ 的构造独立于策略，因而捕获不到只在闭环执行中出现的策略访问分布。

OL reward hacking transfers and compounds in CL execution. Most existing RLFT methods (Li et al., 2026d; Li et al., 2026b) optimize an OL objective on states visited by the expert, scoring each sampled trajectory once with a proxy reward $R^{\prime}$, such as PDMS (Dauner et al., 2024), against a frozen logged future:

开环奖励投机会迁移并在闭环执行中放大。多数现有 RLFT 方法（Li et al., 2026d；Li et al., 2026b）在专家访问的状态上优化开环目标，用代理奖励 $R^{\prime}$（如 PDMS，Dauner et al., 2024）对照冻结的日志未来对每条采样轨迹打一次分：

$$\max_{\theta}\;\mathbb{E}_{s^{\text{log}}\sim\mathcal{D}^{\text{log}},\;a\sim\pi_{\theta}(\cdot\mid s^{\text{log}})}\!\left[R^{\prime}\big(s^{\text{log}},a\big)\right]. \tag{2}$$

Because $R^{\prime}$ rewards progress directly but constrains safety margin only weakly, the policy can raise $R^{\prime}$ by trading margin for progress. This exploitation carries over to CL, raising the per-step risk of a safety-critical error; in safety-critical scenarios, such errors compound over the rollout and lower the CL return. The two RLFT policies we evaluate illustrate both regimes (Figure 8; Appendix F.5). RLFT as applied in ReCogDrive leaves the safety-related sub-scores largely intact, so its OL gains transfer to CL. RLFT as applied in MTDrive instead raises PDMS mainly through higher progress at the cost of lower safety scores, causing a sharp drop in CL DS under safety-critical scenarios.

因为 $R^{\prime}$ 直接奖励进度、对安全余量约束很弱，策略可通过用余量换进度抬高 $R^{\prime}$。这种投机会带到闭环，提高每步出现安全关键错误的风险；在安全关键场景中，此类错误会在 rollout 中累积并降低闭环回报。我们评估的两个 RLFT 策略说明了两种情形（图 8；附录 F.5）。ReCogDrive 中的 RLFT 大体保持安全相关子分数，因而开环收益能转入闭环。MTDrive 中的 RLFT 则主要通过更高进度、以更低安全分数为代价抬高 PDMS，导致安全关键场景下闭环 DS 急剧下降。

Figure 8: RLFT reward exploitation from OL to CL. (a) OL RLFT reward hacking trades safety for progress. (b) The trade-off persists in nominal CL planning. (c) In safety-critical scenarios, the resulting collisions terminate rollouts early and amplify the degradation in CL performance. EP: Ego Progress in (a), Event Progress in (b) and (c); NC: no at-fault collision; TTC: time to collision; DS: driving score; CFR: collision-free rate; MC: minimum clearance.

图 8：从开环到闭环的 RLFT 奖励利用。（a）开环 RLFT 奖励投机用安全换进度。（b）该权衡在名义闭环规划中持续。（c）在安全关键场景中，由此产生的碰撞提前终止 rollout，放大闭环表现下降。EP：（a）中为自车进度，（b）（c）中为事件进度；NC：无责任碰撞；TTC：碰撞时间；DS：驾驶分数；CFR：无碰撞率；MC：最小间隙。

5 NavSafe-$\infty$ Toolbox

5 NavSafe-$\infty$ 工具箱

To facilitate further research on CL policy behavior, we provide an extensible NavSafe-$\infty$ toolbox that enables researchers to (1) build photorealistic CL environments from additional real-world driving logs, (2) create controlled tests for user-defined safety events, and (3) examine how new policies behave under off-nominal states and evolving traffic interactions.

为推动闭环策略行为研究，我们提供可扩展的 NavSafe-$\infty$ 工具箱，使研究者能够 （1） 从额外真实驾驶日志构建照片级闭环环境，（2） 为用户定义的安全事件创建受控测试，（3） 考察新策略在非名义状态与演化交通交互下的行为。

(1) Photorealistic environment construction. The environment-construction tool converts real-world driving logs (Caesar et al., 2021; Sun et al., 2020) into interactive simulation environments. It maps calibrated sensor streams, ego poses, actor tracks, traffic-light states, and map context into a unified simulation representation, and reconstructs the corresponding visual scene as a 3DGS environment (NVIDIA, 2026b; Huang et al., 2026a).

（1）照片级环境构建。环境构建工具把真实驾驶日志（Caesar et al., 2021；Sun et al., 2020）转为交互式仿真环境。它把标定传感器流、自车位姿、参与者轨迹、红绿灯状态与地图上下文映射到统一仿真表示，并把对应视觉场景重建为 3DGS 环境（NVIDIA, 2026b；Huang et al., 2026a）。

(2) Customizable scenarios. The event-design tool provides an asset zoo of vehicles, vulnerable road users, traffic-control devices, and roadside hazards, plus 3DGS assets generated from a reference image (Cao et al., 2026). Assets are inserted into a reconstructed scene with user-specified size, pose, and a static, scripted, or reactive behavior, enabling researchers to create events absent from the log and controlled variants that change one factor at a time.

（2）可定制场景。事件设计工具提供车辆、弱势道路使用者、交通控制设备与路边危险的资产库，以及由参考图像生成的 3DGS 资产（Cao et al., 2026）。资产按用户指定尺寸、位姿与静态、脚本或反应式行为插入重建场景，使研究者能创造日志中缺失的事件，以及一次只改一个因素的受控变体。

(3) Closed-loop policy diagnosis. The diagnosis tool records policy-induced ego and environment states in a rollout archive, from which controlled counterfactual evaluations can be initialized. Ego-state interventions alter the vehicle’s pose or motion state, whereas environment-state interventions modify the behavior of surrounding actors, such as through lead-vehicle braking or cut-in maneuvers. These controlled replays reveal whether policy improvements persist as CL rollouts move beyond the states represented in logged or perturbed demonstrations.

（3）闭环策略诊断。诊断工具把策略诱导的自车与环境状态记入 rollout 档案，并可从中初始化受控反事实评估。自车状态干预改变车辆位姿或运动状态；环境状态干预修改周围参与者行为，例如前车制动或切入。这些受控重放揭示：当闭环 rollout 移出日志或扰动示范所代表的状态时，策略改进是否仍然成立。

6 Limitations

6 局限

Sim2Real Interpretation.

Although photorealistic rendering narrows the visual-domain gap, the simulator cannot fully capture sensor noise, reconstruction artifacts, contact dynamics, or human driving behavior. Consequently, failures may arise from simulator mismatch, while successful rollouts may benefit from simplified agent responses. The results of NavSafe-$\infty$ should therefore be interpreted as controlled evidence within the evaluated simulation setting rather than as direct estimates of real-world crash risk.

仿真到现实的解读。

尽管照片级渲染缩小了视觉域差距，仿真器仍不能完整捕捉传感器噪声、重建伪影、接触动力学或人类驾驶行为。因此，失败可能来自仿真器失配，而成功的 rollout 也可能受益于简化的智能体响应。NavSafe-$\infty$ 的结果应解读为所评仿真设定内的受控证据，而非真实世界碰撞风险的直接估计。

Scenario Evaluation Coverage.

Our benchmark primarily focuses on dense urban driving scenarios (Dauner et al., 2024; Caesar et al., 2021), with highway, rural, adverse-weather, and nighttime conditions comparatively underrepresented. Expanding NavSafe-$\infty$ to a broader range of driving environments and conditions is an important direction for future evaluation.

场景评测覆盖。

我们的基准主要聚焦密集城市驾驶场景（Dauner et al., 2024；Caesar et al., 2021），高速、乡村、恶劣天气与夜间条件相对不足。把 NavSafe-$\infty$ 扩展到更广驾驶环境与条件，是未来评测的重要方向。

7 Conclusion

7 结论

E2E driving safety must be assessed through policy-induced interactions. NavSafe-$\infty$ enables it through photorealistic and event-level CL evaluation, revealing specific behavioral failures that non-reactive evaluations can obscure. Our results show that strong OL performance does not reliably translate into CL safety. The analysis attributes these failures to causal confusion, scorer bottlenecks, latent dynamic discrepancy, and reasoning-action misalignment. Common post-IL remedies do not reliably resolve these failures. Passive demonstration perturbation helps mainly when CL rollouts remain near the perturbed support, while reward hacking on expert states with RLFT carries over to CL and compounds through feedback. NavSafe-$\infty$ will be actively maintained to facilitate future research on CL driving.

E2E 驾驶安全必须通过策略诱导的交互来评估。NavSafe-$\infty$ 借助照片级、事件级闭环评测实现这一点，揭示非反应式评测可能掩盖的具体行为失败。结果表明，强开环表现不能可靠转化为闭环安全。分析把这些失败归因于因果混淆、打分器瓶颈、隐动态差异与推理—动作错位。常见后 IL 补救并不能可靠解决这些失败。被动示范扰动主要在闭环 rollout 仍靠近扰动支撑时有帮助，而在专家状态上的 RLFT 奖励投机会带到闭环并经反馈放大。NavSafe-$\infty$ 将持续维护，以推动闭环驾驶的后续研究。

AI Use Statement

AI 使用声明

In this work, we used generative AI tools for manuscript editing and assistance with software development and debugging. We did not use generative AI tools to formulate scientific claims, design the evaluation methodology, or interpret experimental results. We manually reviewed and tested AI-assisted code for correctness, and reviewed all AI-assisted work. We take responsibility for the final content of this work, including text, claims, or artifacts produced with the aid of generative AI.

本工作使用生成式 AI 工具协助稿件编辑以及软件开发与调试。我们未用生成式 AI 工具提出科学主张、设计评测方法或解释实验结果。我们人工审阅并测试了 AI 辅助代码的正确性，并审阅了全部 AI 辅助工作。我们对最终内容负责，包括在生成式 AI 协助下产生的文本、主张或工件。

Ethics Statement

伦理声明

This work evaluates autonomous-driving policies entirely in simulation and does not deploy vehicles on public roads or collect new data from road users. The benchmark uses publicly released driving logs, third-party model checkpoints, and NVIDIA NRE/NuRec artifacts under their respective licenses and access conditions; photographs used to construct animal and prohibitory-sign assets were captured by the authors. The Human Driver Reference was produced under an IRB-approved protocol by three participants, each of whom completed all 280 scenarios under one assigned seed using a game controller. All participants provided written informed consent, and separate consent was obtained for publication of the evaluation-setup photograph. No sensitive personal data are reported. The human results establish that the evaluated scenario–seed cells are solvable under the specified interface; they are not intended to characterize population-level human driving performance or between-driver variability. Finally, NavSafe-$\infty$ is intended for controlled research evaluation: simulation scores should not be interpreted as certification of deployment readiness or as estimates of real-world crash risk.

本工作完全在仿真中评估自动驾驶策略，不在公共道路部署车辆，也不从道路使用者新采集数据。基准使用公开发布的驾驶日志、第三方模型检查点以及 NVIDIA NRE/NuRec 工件，各自遵循其许可与访问条件；用于构建动物与禁令标志资产的照片由作者拍摄。人类驾驶员参考在 IRB 批准协议下由三名参与者完成，每人用游戏手柄在一个指定种子下跑完全部 280 个场景。所有参与者提供书面知情同意，评测装置照片的发表亦另行取得同意。不报告敏感个人数据。人类结果用以证明所评场景—种子单元在指定接口下可解；无意刻画人群层面人类驾驶表现或驾驶员间变异。最后，NavSafe-$\infty$ 面向受控研究评测：仿真分数不应解读为部署就绪认证或真实世界碰撞风险估计。

Reproducibility Statement

可复现性声明

Appendices A–H document the benchmark taxonomy and scenario provenance, asset construction, scene reconstruction and rendering, evaluation protocol and metrics, evaluated checkpoints and policy adapters, diagnostic experiments, toolbox implementation, and runtime requirements. Every policy is evaluated on the same 280 scenarios under fixed seeds 0, 1, and 1024, with means and sample standard deviations reported across seeds. Each evaluation records its resolved configuration, checkpoint identifier, requested trajectory, state trace, infractions, and terminal reason, allowing metrics to be recomputed from saved traces. Upon publication, we will release the simulator code, benchmark recipes and manifests, policy adapters, evaluation configurations, and scripts needed to reproduce the reported tables. Third-party datasets, model weights, and NVIDIA NRE/NuRec components remain subject to their original licenses and access requirements.

附录 A–H 记录基准分类与场景来源、资产构建、场景重建与渲染、评测协议与指标、所评检查点与策略适配器、诊断实验、工具箱实现以及运行时需求。每个策略在全部 280 个场景上、固定种子 0、1、1024 下评测，并报告跨种子的均值与样本标准差。每次评测记录解析后的配置、检查点标识、请求轨迹、状态轨迹、违规与终止原因，使指标可从保存轨迹重算。发表时我们将发布复现报告表格所需的仿真器代码、基准配方与清单、策略适配器、评测配置与脚本。第三方数据集、模型权重与 NVIDIA NRE/NuRec 组件仍受其原许可与访问要求约束。

References

参考文献

Basant et al. (2026) A. Basant, A. Kar, D. Paschalidou, F. Wei, F. Ferroni, G. G. Cobo, H. Turki, H. Ling, J. Seo, J. Lucas, J. Z. Wu, J. Wang, J. Lorraine, J. Gao, K. He, K. Tothova, K. Xie, M. Tyszkiewicz, Q. Wu, R. de Lutio, R. Li, S. Fidler, S. W. Kim, T. Shen, T. Cao, T. Pfaff, W. Lew, X. Wu, X. Ren, Y. Lu, Y. Zhang, Z. Gojcic, and Z. Wang NVIDIA OmniDreams: real-time generative world model for closed-loop autonomous vehicle simulation . arXiv preprint arXiv:2606.03159 . External Links: 2606.03159 , Document Cited by: §2.1 .

Caesar et al. (2020) H. Caesar, V. Bankiti, A. H. Lang, S. Vora, V. E. Liong, Q. Xu, A. Krishnan, Y. Pan, G. Baldan, and O. Beijbom nuScenes: a multimodal dataset for autonomous driving . In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pp. 11618–11628 . External Links: Document Cited by: §1 , §2.1 .

Caesar et al. (2021) H. Caesar, J. Kabzan, K. S. Tan, W. K. Fong, E. Wolff, A. Lang, L. Fletcher, O. Beijbom, and S. Omari nuPlan: a closed-loop ML-based planning benchmark for autonomous vehicles . arXiv preprint arXiv:2106.11810 . External Links: 2106.11810 , Document Cited by: §A.1 , §C.1 , §D.3 , §3.2 , §5 , §6 .

Cao et al. (2026) T. Cao, J. Ren, Y. Zhang, J. Seo, J. Huang, S. Solanki, H. Zhang, M. Guo, H. Turki, M. Li, Y. Zhu, S. Zhang, Z. Gojcic, S. Fidler, and K. Yin Asset Harvester: extracting 3D assets from autonomous driving logs for simulation . arXiv preprint arXiv:2604.18468 . External Links: 2604.18468 , Document Cited by: §B.1 , §5 .

Cao et al. (2025) W. Cao, M. Hallgarten, T. Li, D. Dauner, X. Gu, C. Wang, Y. Miron, M. Aiello, H. Li, I. Gilitschenski, B. Ivanovic, M. Pavone, A. Geiger, and K. Chitta Pseudo-simulation for autonomous driving . In Proceedings of the 9th Conference on Robot Learning , Proceedings of Machine Learning Research , Vol. 305 , pp. 4709–4722 . External Links: Link Cited by: §1 , §2.1 .

Carreira and Zisserman (2017) J. Carreira and A. Zisserman Quo vadis, action recognition? A new model and the Kinetics dataset . In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition , Cited by: §C.4 .

Dauner et al. (2023) D. Dauner, M. Hallgarten, A. Geiger, and K. Chitta Parting with misconceptions about learning-based vehicle motion planning . In Proceedings of the 7th Conference on Robot Learning , Proceedings of Machine Learning Research , Vol. 229 , pp. 1268–1281 . External Links: Link Cited by: §E.1 , Table 7 , Table 2 .

Dauner et al. (2024) D. Dauner, M. Hallgarten, T. Li, X. Weng, Z. Huang, Z. Yang, H. Li, I. Gilitschenski, B. Ivanovic, M. Pavone, A. Geiger, and K. Chitta NAVSIM: data-driven non-reactive autonomous vehicle simulation and benchmarking . In Advances in Neural Information Processing Systems , Vol. 37 , pp. 28706–28719 . External Links: Document Cited by: §C.4 , §D.2 , 1st item , Table 7 , §1 , §1 , §2.1 , §2.2 , §4.3 , Table 2 , §4 , §6 .

Dosovitskiy et al. (2017) A. Dosovitskiy, G. Ros, F. Codevilla, A. Lopez, and V. Koltun CARLA: an open urban driving simulator . In Proceedings of the 1st Annual Conference on Robot Learning , Proceedings of Machine Learning Research , Vol. 78 , pp. 1–16 . Cited by: §D.3 , §2.1 .

Feng et al. (2026) L. Feng, Y. Gao, E. Zablocki, Q. Li, W. Li, S. Liu, M. Cord, and A. Alahi RAP: 3D rasterization augmented end-to-end planning . In International Conference on Learning Representations , External Links: 2510.04333 , Link Cited by: Table 7 , §2.2 , Table 2 .

Gerstenecker et al. (2026) S. Gerstenecker, A. Geiger, and K. Renz Fail2Drive: benchmarking closed-loop driving generalization . arXiv preprint arXiv:2604.08535 . External Links: 2604.08535 , Document Cited by: §2.1 .

Heusel et al. (2017) M. Heusel, H. Ramsauer, T. Unterthiner, B. Nessler, and S. Hochreiter GANs trained by a two time-scale update rule converge to a local Nash equilibrium . In Advances in Neural Information Processing Systems , Vol. 30 . External Links: Link Cited by: §C.4 , §3.3 .

Huang et al. (2026a) J. Huang, J. Ren, M. Tyszkiewicz, B. Haefner, M. Shelley, X. Kang, S. W. Kim, N. Xu, Q. Wu, J. M. Esturo, S. Huang, N. Schneider, L. Leal-Taixé, Z. Gojcic, and S. Fidler Instant NuRec: feed-forward 3D Gaussian reconstruction for driving scene simulation . arXiv preprint arXiv:2607.14203 . External Links: 2607.14203 , Document Cited by: §C.2 , §5 .

Huang et al. (2026b) Z. Huang, J. Liu, R. Song, Z. Zhou, R. Yang, Y. Zhang, T. Cai, H. Zhang, M. Gao, V. Xu, J. Chen, Y. Shen, Y. Guo, T. X. Qi, and J. Ma nuReasoning: a reasoning-centric dataset and benchmark for long-tail autonomous driving . arXiv preprint arXiv:2605.31572 . External Links: 2605.31572 , Link Cited by: §2.1 .

Jia et al. (2024) X. Jia, Z. Yang, Q. Li, Z. Zhang, and J. Yan Bench2Drive: towards multi-ability benchmarking of closed-loop end-to-end autonomous driving . In Advances in Neural Information Processing Systems , Vol. 37 , pp. 819–844 . External Links: Document Cited by: §D.3 , §2.1 , §3.1 , §3.2 .

Karkus et al. (2025) P. Karkus, M. Igl, Y. Chen, K. Chitta, J. Packer, B. Douillard, R. Tian, A. Naumann, G. Garcia-Cobo, S. Tan, A. Degirmenci, A. Popov, N. Smolyanskiy, U. Muller, B. Ivanovic, and M. Pavone Beyond behavior cloning in autonomous driving: a survey of closed-loop training techniques . Note: TechRxiv preprint External Links: Document , Link Cited by: §1 , §4.3 .

Kerbl et al. (2023) B. Kerbl, G. Kopanas, T. Leimkühler, and G. Drettakis 3D Gaussian splatting for real-time radiance field rendering . ACM Transactions on Graphics 42 ( 4 ), pp. 139:1–139:14 . External Links: Document Cited by: §2.1 .

Kirby et al. (2026) E. Kirby, A. Boulch, Y. Xu, Y. Yin, G. Puy, É. Zablocki, A. Bursuc, S. Gidaris, R. Marlet, F. Bartoccioni, A. Cao, N. Samet, T. Vu, and M. Cord Driving on registers . In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pp. 32058–32069 . External Links: Link Cited by: 1st item , Table 7 , §2.2 , Table 2 .

Lee and Park (2020) Y. Lee and J. Park CenterMask: real-time anchor-free instance segmentation . In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pp. 13906–13915 . Cited by: Table 6 .

Leng et al. (2026) Z. Leng, S. Mo, S. Z. Zhao, H. Cai, Y. Zeng, R. McAllister, and B. Zhou DreamStream: towards policy-oriented generative simulation for end-to-end driving . In 10th Annual Conference on Robot Learning , Cited by: §C.4 , §C.4 , §3.3 , Table 1 .

Li et al. (2022) Q. Li, Z. Peng, L. Feng, Q. Zhang, Z. Xue, and B. Zhou MetaDrive: composing diverse driving scenarios for generalizable reinforcement learning . IEEE Transactions on Pattern Analysis and Machine Intelligence . Cited by: §D.1 .

Li et al. (2026a) T. Li, L. Chen, C. Wang, H. Liu, K. Chitta, Z. Yang, Y. Lu, N. Ye, Y. Qiu, Y. Wang, L. Zou, J. Peng, J. Pan, Z. Su, A. Bursuc, S. E. Li, A. Geiger, P. Su, and H. Li World Engine: towards the era of post-training for autonomous driving . arXiv preprint arXiv:2606.19836 . External Links: 2606.19836 , Document Cited by: §2.1 .

Li et al. (2026b) X. Li, M. Guo, C. Xu, B. Li, W. Zhu, Y. Zou, R. Chen, and Z. Wang MTDrive: multi-turn interactive reinforcement learning for autonomous driving . arXiv preprint arXiv:2601.22930 . External Links: 2601.22930 , Document Cited by: Table 7 , Table 7 , §2.2 , §4.3 , Table 2 , Table 2 .

Li et al. (2025a) Y. Li, C. Fan, C. Ge, S. Z. Zhao, C. Li, C. Xu, H. Yao, M. Tomizuka, B. Zhou, C. Tang, M. Ding, and W. Zhan WOMD-reasoning: a large-scale dataset for interaction reasoning in driving . In Proceedings of the 42nd International Conference on Machine Learning , Proceedings of Machine Learning Research , Vol. 267 , pp. 34288–34311 . Cited by: §2.1 .

Li et al. (2026c) Y. Li, S. Shang, W. Liu, B. Zhan, H. Wang, Y. Wang, Y. Chen, X. Wang, Y. An, C. Tang, L. Hou, L. Fan, and Z. Zhang DriveVLA-W0: world models amplify data scaling law in autonomous driving . In International Conference on Learning Representations , External Links: 2510.12796 , Document Cited by: Table 7 , §2.2 .

Li et al. (2026d) Y. Li, K. Xiong, X. Guo, F. Li, S. Yan, G. Xu, L. Zhou, L. Chen, H. Sun, B. Wang, K. Ma, G. Chen, H. Ye, W. Liu, and X. Wang ReCogDrive: a reinforced cognitive framework for end-to-end autonomous driving . In International Conference on Learning Representations , External Links: 2506.08052 , Document Cited by: Table 7 , Table 7 , §2.2 , §4.3 , Table 2 , Table 2 .

Li et al. (2025b) Z. Li, W. Yao, Z. Wang, X. Sun, J. Chen, N. Chang, M. Shen, Z. Wu, S. Lan, and J. M. Alvarez Generalized trajectory scoring for end-to-end multimodal planning . arXiv preprint arXiv:2506.06664 . Cited by: 2nd item , Table 7 , §2.2 , §4.3 , Table 2 .

Liao et al. (2025) B. Liao, S. Chen, H. Yin, B. Jiang, C. Wang, S. Yan, X. Zhang, X. Li, Y. Zhang, Q. Zhang, and X. Wang DiffusionDrive: truncated diffusion model for end-to-end autonomous driving . In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pp. 12037–12047 . External Links: Document Cited by: 3rd item , Table 7 , §2.2 , Table 1 , §4.3 , Table 2 .

Liu et al. (2026) X. Liu, D. C. Jacob, Y. Liu, X. Du, M. Ye, B. Zhou, and P. He Understanding real-world traffic safety through RoadSafe365 benchmark . arXiv preprint arXiv:2602.07212 . External Links: 2602.07212 , Document Cited by: §A.1 , §1 , §3 .

Maia Polo et al. (2024) F. Maia Polo, L. Weber, L. Choshen, Y. Sun, G. Xu, and M. Yurochkin TinyBenchmarks: evaluating LLMs with fewer examples . In Proceedings of the 41st International Conference on Machine Learning , Proceedings of Machine Learning Research , Vol. 235 , pp. 34303–34326 . External Links: Link Cited by: §F.5 .

NVIDIA et al. (2025) NVIDIA, Y. Cao, R. de Lutio, S. Fidler, G. G. Cobo, Z. Gojcic, M. Igl, B. Ivanovic, P. Karkus, J. M. Esturo, M. Pavone, A. Smith, E. Tanimura, M. Tyszkiewicz, M. Watson, Q. Wu, and L. Zhang AlpaSim: a modular, lightweight, and data-driven research simulator for autonomous driving . Note: Open-source software External Links: Link Cited by: §2.1 .

NVIDIA (2026a) NVIDIA Isaac Sim . Note: https://developer.nvidia.com/isaac/sim Cited by: §G.1 .

NVIDIA (2026b) NVIDIA Neural reconstruction and 3D Gaussian splatting with NVIDIA Omniverse NuRec . Note: https://developer.nvidia.com/omniverse/nurec Accessed: 2026-07-23 Cited by: §C.2 , §2.1 , §3.3 , §5 .

Parmar et al. (2022) G. Parmar, R. Zhang, and J. Zhu On aliased resizing and surprising subtleties in GAN evaluation . In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pp. 11410–11420 . Cited by: §C.4 .

Rempe et al. (2026) D. Rempe, M. Petrovich, Y. Yuan, H. Zhang, X. B. Peng, Y. Jiang, T. Wang, U. Iqbal, D. Minor, M. de Ruyter, J. Li, C. Tessler, E. Lim, E. Jeong, S. Wu, E. Hassani, M. Huang, J. Yu, C. Chung, L. Song, O. Dionne, J. Kautz, S. Yuen, and S. Fidler Kimodo: scaling controllable human motion generation . arXiv preprint arXiv:2603.15546 . Cited by: §B.1 .

Saito et al. (2026) J. Saito, J. Li, M. de Ruyter, M. Guerrero, E. Lim, E. Hassani, R. Blanco Ribera, H. Moon, M. Dadela, M. Di Lucca, Q. Wang, X. Li, S. Wu, C. Chung, Y. Seol, J. Kautz, S. Yuen, and U. Iqbal SOMA: unifying parametric human body models . arXiv preprint arXiv:2603.16858 . Cited by: §B.1 .

Sun et al. (2020) P. Sun, H. Kretzschmar, X. Dotiwalla, A. Chouard, V. Patnaik, P. Tsui, J. Guo, Y. Zhou, Y. Chai, B. Caine, V. Vasudevan, W. Han, J. Ngiam, H. Zhao, A. Timofeev, S. Ettinger, M. Krivokon, A. Gao, A. Joshi, Y. Zhang, J. Shlens, Z. Chen, and D. Anguelov Scalability in perception for autonomous driving: Waymo Open Dataset . In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pp. 2446–2454 . Cited by: §G.1 , §5 .

Sun et al. (2026) W. Sun, X. Lin, K. Chen, Z. Pei, X. Li, Y. Shi, and S. Zheng SparseDriveV2: scoring is all you need for end-to-end autonomous driving . In European Conference on Computer Vision , External Links: 2603.29163 , Document Cited by: 2nd item , Table 7 , §2.2 , Table 1 , Table 2 .

Szegedy et al. (2016) C. Szegedy, V. Vanhoucke, S. Ioffe, J. Shlens, and Z. Wojna Rethinking the Inception architecture for computer vision . In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition , pp. 2818–2826 . Cited by: §C.4 .

Team Wan et al. (2025) Team Wan, A. Wang, B. Ai, B. Wen, C. Mao, et al. Wan: open and advanced large-scale video generative models . arXiv preprint arXiv:2503.20314 . Cited by: §C.4 .

Tian et al. (2026) H. Tian, T. Li, H. Liu, J. Yang, Y. Qiu, G. Li, J. Wang, Y. Gao, Z. Zhang, L. Wang, H. Ye, T. Tan, L. Chen, and H. Li SimScale: learning to drive via real-world simulation at scale . In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pp. 36365–36374 . External Links: 2511.23369 , Document Cited by: §F.4 , Table 7 , Table 7 , Table 7 , Table 7 , §1 , §2.2 , §4.3 , Table 2 , Table 2 , Table 2 , Table 2 .

Treiber et al. (2000) M. Treiber, A. Hennecke, and D. Helbing Congested traffic states in empirical observations and microscopic simulations . Physical Review E 62 ( 2 ), pp. 1805–1824 . External Links: Document Cited by: §D.1 .

Unterthiner et al. (2018) T. Unterthiner, S. van Steenkiste, K. Kurach, R. Marinier, M. Michalski, and S. Gelly Towards accurate generative models of video: a new metric and challenges . arXiv preprint arXiv:1812.01717 . External Links: 1812.01717 , Link Cited by: §C.4 , §3.3 .

Wang et al. (2026a) J. Wang, Z. Hua, X. Liu, Z. Xing, H. Tian, K. Ma, H. Ye, G. Chen, L. Chen, and Q. Zhang Beyond imitation: learning safe end-to-end autonomous driving from hard negatives . In European Conference on Computer Vision , External Links: 2605.19771 , Document , Link Cited by: Table 7 , §2.2 , Table 2 .

Wang et al. (2025) L. Wang, H. Yu, C. Yu, S. Gao, and H. Christensen Controllable motion generation via diffusion modal coupling . arXiv preprint arXiv:2503.02353 . Cited by: 3rd item .

Wang et al. (2024) X. Wang, X. Zhang, Z. Luo, Q. Sun, Y. Cui, J. Wang, F. Zhang, Y. Wang, Z. Li, Q. Yu, et al. Emu3: next-token prediction is all you need . arXiv preprint arXiv:2409.18869 . Cited by: Table 6 .

Wang et al. (2026b) Y. Wang, A. Jiang, S. Wang, Y. Heng, H. Yang, Y. Chen, and H. Sun Do open-loop metrics predict closed-loop driving? a cross-benchmark correlation study of NAVSIM and Bench2Drive . arXiv preprint arXiv:2605.00066 . External Links: 2605.00066 , Document Cited by: §2.1 .

Xia et al. (2026a) T. Xia, Y. Li, L. Zhou, J. Yao, K. Xiong, H. Sun, B. Wang, K. Ma, G. Chen, H. Ye, W. Liu, and X. Wang DriveLaW: unifying planning and video generation in a latent driving world . In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , External Links: 2512.23421 , Document Cited by: Table 7 , §2.2 .

Xia et al. (2026b) Z. Xia, G. Zhu, G. Tang, W. Chen, and Y. Wang HiDrive: a closed-loop benchmark for high-level autonomous driving . arXiv preprint arXiv:2605.09972 . Cited by: §2.1 .

Yang et al. (2026) R. Yang, M. Wang, Y. Chen, T. Guo, Y. Xu, C. Cui, Z. Yang, Y. Zhang, Z. Wang, Y. Fu, and L. Su Post-training in end-to-end autonomous driving . arXiv preprint arXiv:2607.08072 . Cited by: §E.1 .

Yang et al. (2025) X. Yang, L. Wen, T. Wei, Y. Ma, J. Mei, X. Li, W. Lei, D. Fu, P. Cai, M. Dou, L. He, Y. Liu, B. Shi, and Y. Qiao DriveArena: a closed-loop generative simulation platform for autonomous driving . In Proceedings of the IEEE/CVF International Conference on Computer Vision , pp. 26933–26943 . External Links: Document Cited by: §C.4 , §2.1 , Table 1 .

Zhang et al. (2026) Y. Zhang, K. Tóthová, Z. Wang, K. Yin, H. Turki, R. de Lutio, Y. Chang, O. Litany, S. Fidler, and Z. Gojcic DiffusionHarmonizer: bridging neural reconstruction and photorealistic simulation with online diffusion enhancer . In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , External Links: 2602.24096 , Link Cited by: §C.3 , §3.3 .

Zhao et al. (2026a) S. Z. Zhao, L. Wang, H. Ruan, Y. Bao, Y. Chen, Z. Leng, A. Ravichandran, H. He, Z. Zhou, X. Han, A. Peri, Z. Huang, P. Desai, H. Christensen, J. Ma, and B. Zhou BridgeSim: unveiling the OL-CL gap in end-to-end autonomous driving . arXiv preprint arXiv:2604.10856 . External Links: 2604.10856 , Document Cited by: §2.1 , §3.1 .

Zhao et al. (2026b) Z. Zhao, X. Zhou, T. Xu, Z. Sun, K. Zhou, H. Li, D. Liang, and X. Bai SimWAM: a simple world action model for end-to-end autonomous driving . arXiv preprint arXiv:2608.07468 . External Links: 2608.07468 , Link Cited by: Table 7 , Table 7 , §2.2 , Table 2 .

Zhou et al. (2026a) H. Zhou, L. Lin, J. Wang, Y. Lu, D. Bai, B. Liu, Y. Wang, A. Geiger, and Y. Liao HUGSIM: a real-time, photo-realistic and closed-loop simulator for autonomous driving . IEEE Transactions on Pattern Analysis and Machine Intelligence 48 ( 4 ), pp. 4673–4691 . External Links: Document Cited by: §2.1 .

Zhou et al. (2025) Z. Zhou, T. Cai, S. Z. Zhao, Y. Zhang, Z. Huang, B. Zhou, and J. Ma AutoVLA: a vision-language-action model for end-to-end autonomous driving with adaptive reasoning and reinforcement fine-tuning . In Advances in Neural Information Processing Systems , D. Belgrave, C. Zhang, H. Lin, R. Pascanu, P. Koniusz, M. Ghassemi, and N. Chen (Eds.) , Vol. 38 , pp. 27920–27956 . External Links: Link Cited by: 4th item , Table 7 , §2.2 , §2.2 , Table 2 .

Zhou et al. (2026b) Z. Zhou, R. Yang, X. Qi, Y. Guo, S. X. Chen, T. Feng, K. Pistunova, Y. Shen, L. Su, and J. Ma SpanVLA: efficient action bridging and learning from negative-recovery samples for vision-language-action model . arXiv preprint arXiv:2604.19710 . Cited by: 3rd item .

Zuffi et al. (2017) S. Zuffi, A. Kanazawa, D. W. Jacobs, and M. J. Black 3D menagerie: modeling the 3D shape and pose of animals . In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR) , Cited by: §B.1 .

Appendix

附录

The appendix is organized as follows.

附录组织如下。

• • Appendix A: Scenario taxonomy, coverage, and scenario gallery (Section 3.1).
• • Appendix B: Asset library used for scenario interventions.
• • Appendix C: Dataset source, photorealistic reconstruction, and rendering fidelity (Section 3.3).
• • Appendix D: Closed-loop protocol, event contracts, metrics, and benchmark quality controls (Section 3.2).
• • Appendix E: Evaluated policies and the human driver reference (Table 2).
• • Appendix F: OL–CL comparison and full leaderboard, case-selection protocol for the failure investigations, and diagnostic settings (Sections 4.1, 4.2, and 4.3).
• • Appendix G: Toolbox implementation (Section 5).
• • Appendix H: Runtime and resource requirements.

• • 附录 A：场景分类、覆盖与场景图库（第 3.1 节）。
• • 附录 B：场景干预所用资产库。
• • 附录 C：数据来源、照片级重建与渲染保真度（第 3.3 节）。
• • 附录 D：闭环协议、事件契约、指标与基准质量控制（第 3.2 节）。
• • 附录 E：所评策略与人类驾驶员参考（表 2）。
• • 附录 F：开环—闭环比较与完整排行榜、失败调查的案例选择协议，以及诊断设定（第 4.1、4.2、4.3 节）。
• • 附录 G：工具箱实现（第 5 节）。
• • 附录 H：运行时与资源需求。

Appendix A NavSafe-$\infty$ Scenario Taxonomy and Gallery

附录 A NavSafe-$\infty$ 场景分类与图库

This appendix supplements Section 3.1 with detailed operational criteria, nuPlan screening labels, scenario-construction routes, and per-event scenario counts. Together with Figure 2, the additional examples provide one rendered scenario for each of the 28 event types.

本附录补充第 3.1 节：详细操作纳入标准、nuPlan 筛选标签、场景构造路径，以及各类事件的场景数量。与图 2 一起，额外例子为 28 类事件各提供一个渲染场景。

A.1 Taxonomy Definitions and Scenario Coverage

A.1 分类定义与场景覆盖

Each of the 280 scenarios belongs to exactly one of 28 event types adapted from RoadSafe365 (Liu et al., 2026) (Table 3). An event type is defined by its operational inclusion criterion, which specifies the event that must occur within the evaluated window. nuPlan scenario labels (Caesar et al., 2021) are used only to retrieve candidate windows and do not determine membership.

280 个场景各属于改编自 RoadSafe365（Liu et al., 2026）的 28 类事件之一（表 3）。事件类型由其操作纳入标准定义，该标准规定评测窗口内必须发生的事件。nuPlan 场景标签（Caesar et al., 2021）仅用于检索候选窗口，不决定归属。

Scenarios are obtained through one of two routes. For 19 direct event types, nuPlan scenario labels expose the defining event, and scenarios are retrieved from the logs. For the remaining nine recipe event types (C-7, C-10, V-8, V-10, V-11, R-2, R-3, R-4, and I-3), no label retrieves the event reliably, so every scenario is constructed from a versioned recipe (Appendix G.2). A recipe either retains the host log unchanged or applies an intervention, namely a controlled actor, asset, or traffic-control edit to a compatible log.

场景通过两条路径之一获得。对 19 类直接事件，nuPlan 场景标签暴露定义性事件，场景从日志检索。对其余九类配方事件（C-7、C-10、V-8、V-10、V-11、R-2、R-3、R-4 与 I-3），没有标签能可靠检索该事件，因此每个场景都从宿主场景构造：插入、替换或移除参与者，并在需要时改写交通控制，使定义性事件在评测窗口内发生。

Each event type contains ten scenarios. The 19 direct event types contribute 190 natural scenarios. The nine recipe event types contribute 90 scenarios, of which 62 are intervened and 28 replay the host log unchanged (all 20 scenarios of C-10 and V-11, and the natural scenarios of C-7, V-10, and R-2). The benchmark therefore contains 218 natural and 62 intervened scenarios. The benchmark manifest records the source log token, event type, provenance, recipe identifier, and event contract of every scenario.

每类事件含十个场景。19 类直接事件贡献 190 个自然场景。九类配方事件贡献 90 个场景，其中 62 个经干预，28 个原样回放宿主日志（C-10 与 V-11 的全部 20 个场景，以及 C-7、V-10、R-2 的自然场景）。因此基准含 218 个自然场景与 62 个干预场景。

Event type	Operational inclusion criterion	nuPlan screening labels	Coverage route	$N$ (nat./int.)
Traffic Crashes
C-1 Rear-End	Same-lane longitudinal conflict in which inadequate headway or braking can produce front-to-rear contact.	stopping_with_lead; behind_long_vehicle; near_long_vehicle; stopping_at_traffic_light_with_lead; stopping_at_stop_sign_with_lead; stationary_at_traffic_light_with_lead; accelerating_at_traffic_light_with_lead.	Direct.	10/0
C-2 Angle/T-Bone	Crossing paths create a lateral-impact conflict at an intersection or access point.	crossed_by_vehicle; starting_protected_cross_turn.	Direct.	10/0
C-3 Sideswipe	Overlapping lateral motion between adjacent vehicles creates same-direction side-contact risk.	changing_lane_with_lead; changing_lane_with_trail; near_high_speed_vehicle.	Direct.	10/0
C-4 Multi-Vehicle	At least four interacting vehicles permit a primary conflict to propagate into secondary braking or collision risk.	near_multiple_vehicles.	Direct.	10/0
C-5 Intersection	The safety-critical conflict and required maneuver occur within an intersection footprint.	traversing_intersection; on_intersection; starting_left_turn; starting_right_turn; starting_low_speed_turn; starting_high_speed_turn; starting_protected_noncross_turn.	Direct.	10/0
C-6 Roadway Departure	Ego must re-enter the through lane from a curbside or pickup/drop-off position.	traversing_pickup_dropoff; on_pickup_dropoff.	Direct.	10/0
C-7 Head-On	Opposing traffic competes for insufficient longitudinal or lateral clearance in a shared corridor.	traversing_narrow_lane.	Recipe: natural log plus targeted oncoming actor.	2/8
C-8 Pull-Over	Ego must leave the through lane into a curbside or parking position, where the low-speed lateral transition creates contact risk with objects or road users near the boundary.	on_carpark.	Direct.	10/0
C-9 Single-Vehicle	No other traffic participant is present in the ego’s conflict region, so any safety event arises from the ego’s own control, the surface, or a fixed object.	None.	Direct.	10/0
C-10 Wrong-Way Crash	Ego enters a lane assigned to the opposite direction of travel, so oncoming traffic produces a head-on conflict.	None.	Recipe: natural road geometry.	10/0
Traffic Violations
V-1 Red-Light/Stop-Sign	A traffic light or stop sign governs ego entry at a control line.	traversing_traffic_light_intersection; on_traffic_light_intersection; on_stopline_traffic_light; starting_straight_traffic_light_intersection_traversal; stopping_at_traffic_light_without_lead; stationary_at_traffic_light_without_lead; accelerating_at_traffic_light; accelerating_at_traffic_light_without_lead; on_stopline_stop_sign; starting_straight_stop_sign_intersection_traversal; stopping_at_stop_sign_without_lead; stopping_at_stop_sign_no_crosswalk; accelerating_at_stop_sign; accelerating_at_stop_sign_no_crosswalk.	Direct.	10/0
V-2 Failure to Yield	Ego must reject or accept a gap under an explicit right-of-way obligation.	starting_unprotected_cross_turn; starting_unprotected_noncross_turn; on_all_way_stop_intersection.	Direct.	10/0
V-3 Unsafe Lane Change	A lane transfer or pass is unsafe because of clearance, boundary, signaling, or maneuver-completion constraints.	changing_lane; changing_lane_to_left; changing_lane_to_right.	Direct.	10/0
V-4 Reckless/Aggressive	Ego action exceeds a preregistered kinematic or interaction-risk envelope without necessity.	high_lateral_acceleration; high_magnitude_jerk.	Direct.	10/0
V-5 Speeding	Ego speed violates the applicable posted or scenario-specific limit.	high_magnitude_speed; medium_magnitude_speed; low_magnitude_speed.	Direct.	10/0
V-6 Tailgating	Ego follows a lead below the declared time-headway or stopping-distance threshold.	following_lane_with_lead; following_lane_with_slow_lead.	Direct.	10/0
V-7 Lane Maintenance	Uncommanded lateral drift crosses or persistently approaches the lane or drivable-corridor boundary.	following_lane_without_lead.	Direct.	10/0
V-8 Illegal Turn	A turn is geometrically feasible but prohibited by the applicable control or lane rule.	starting_u_turn.	Recipe: prohibitory-sign intervention.	0/10
V-9 Blocking Intersection	Ego enters without downstream clearance or remains stopped in a conflict area without necessity.	stationary; stationary_in_traffic.	Direct.	10/0
V-10 Unsafe Merge	Ego enters a traffic stream without the declared longitudinal and lateral safety margins.	None.	Recipe: natural log plus targeted merge actor.	3/7
V-11 Wrong-Way Driving	Ego traverses a lane against its lawful direction even without a collision.	None.	Recipe: natural road geometry.	10/0
Vulnerable Road User Crashes
R-1 Pedestrian-Involved	A pedestrian occupies, approaches, or is occluded near the ego’s potential path and requires yielding or clearance.	waiting_for_pedestrian_to_cross; near_pedestrian_on_crosswalk; near_pedestrian_on_crosswalk_with_ego; near_multiple_pedestrians; behind_pedestrian_on_driveable; behind_pedestrian_on_pickup_dropoff; near_pedestrian_at_pickup_dropoff; traversing_crosswalk; on_stopline_crosswalk; stopping_at_crosswalk; stationary_at_crosswalk; accelerating_at_crosswalk.	Direct.	10/0
R-2 Bicycle-Involved	A cyclist is followed, crossed, passed, or encountered in a shared conflict region.	behind_bike; crossed_by_bike; near_multiple_bikes.	Recipe: natural log plus targeted cyclist actor.	3/7
R-3 Micromobility-Involved	A micromobility device or other atypical road user, such as a delivery robot, enters shared space.	None.	Recipe: targeted micromobility actor.	0/10
R-4 Animal-Involved	An animal enters or approaches the drivable corridor without traffic-rule-compliant behavior.	None.	Recipe: targeted animal actor.	0/10
Traffic Incidents
I-1 Obstruction/Hazard	An unmapped static object obstructs the nominal path and requires stopping or a bounded avoidance maneuver.	near_trafficcone_on_driveable; near_barrier_on_driveable.	Direct.	10/0
I-2 Work Zone	Temporary signs, barriers, or workers alter the valid corridor relative to the base map.	near_construction_zone_sign.	Direct.	10/0
I-3 General Incident	A preregistered safety event not represented by another event type requires a specific fallback response.	None.	Recipe: targeted incident.	0/10

Table 3: Operational taxonomy, nuPlan screening labels, and coverage route. Direct event types are taken from unmodified nuPlan logs (screened by scenario type where one applies); Recipe event types are constructed from versioned recipes.

事件类型	操作纳入标准	nuPlan 筛选标签	覆盖路径	$N$ (自然/干预)
交通事故
C-1 Rear-End	Same-lane longitudinal conflict in which inadequate headway or braking can produce front-to-rear contact.	stopping_with_lead; behind_long_vehicle; near_long_vehicle; stopping_at_traffic_light_with_lead; stopping_at_stop_sign_with_lead; stationary_at_traffic_light_with_lead; accelerating_at_traffic_light_with_lead.	Direct.	10/0
C-2 Angle/T-Bone	Crossing paths create a lateral-impact conflict at an intersection or access point.	crossed_by_vehicle; starting_protected_cross_turn.	Direct.	10/0
C-3 Sideswipe	Overlapping lateral motion between adjacent vehicles creates same-direction side-contact risk.	changing_lane_with_lead; changing_lane_with_trail; near_high_speed_vehicle.	Direct.	10/0
C-4 Multi-Vehicle	At least four interacting vehicles permit a primary conflict to propagate into secondary braking or collision risk.	near_multiple_vehicles.	Direct.	10/0
C-5 Intersection	The safety-critical conflict and required maneuver occur within an intersection footprint.	traversing_intersection; on_intersection; starting_left_turn; starting_right_turn; starting_low_speed_turn; starting_high_speed_turn; starting_protected_noncross_turn.	Direct.	10/0
C-6 Roadway Departure	Ego must re-enter the through lane from a curbside or pickup/drop-off position.	traversing_pickup_dropoff; on_pickup_dropoff.	Direct.	10/0
C-7 Head-On	Opposing traffic competes for insufficient longitudinal or lateral clearance in a shared corridor.	traversing_narrow_lane.	Recipe: natural log plus targeted oncoming actor.	2/8
C-8 Pull-Over	Ego must leave the through lane into a curbside or parking position, where the low-speed lateral transition creates contact risk with objects or road users near the boundary.	on_carpark.	Direct.	10/0
C-9 Single-Vehicle	No other traffic participant is present in the ego’s conflict region, so any safety event arises from the ego’s own control, the surface, or a fixed object.	None.	Direct.	10/0
C-10 Wrong-Way Crash	Ego enters a lane assigned to the opposite direction of travel, so oncoming traffic produces a head-on conflict.	None.	Recipe: natural road geometry.	10/0
交通违规
V-1 Red-Light/Stop-Sign	A traffic light or stop sign governs ego entry at a control line.	traversing_traffic_light_intersection; on_traffic_light_intersection; on_stopline_traffic_light; starting_straight_traffic_light_intersection_traversal; stopping_at_traffic_light_without_lead; stationary_at_traffic_light_without_lead; accelerating_at_traffic_light; accelerating_at_traffic_light_without_lead; on_stopline_stop_sign; starting_straight_stop_sign_intersection_traversal; stopping_at_stop_sign_without_lead; stopping_at_stop_sign_no_crosswalk; accelerating_at_stop_sign; accelerating_at_stop_sign_no_crosswalk.	Direct.	10/0
V-2 Failure to Yield	Ego must reject or accept a gap under an explicit right-of-way obligation.	starting_unprotected_cross_turn; starting_unprotected_noncross_turn; on_all_way_stop_intersection.	Direct.	10/0
V-3 Unsafe Lane Change	A lane transfer or pass is unsafe because of clearance, boundary, signaling, or maneuver-completion constraints.	changing_lane; changing_lane_to_left; changing_lane_to_right.	Direct.	10/0
V-4 Reckless/Aggressive	Ego action exceeds a preregistered kinematic or interaction-risk envelope without necessity.	high_lateral_acceleration; high_magnitude_jerk.	Direct.	10/0
V-5 Speeding	Ego speed violates the applicable posted or scenario-specific limit.	high_magnitude_speed; medium_magnitude_speed; low_magnitude_speed.	Direct.	10/0
V-6 Tailgating	Ego follows a lead below the declared time-headway or stopping-distance threshold.	following_lane_with_lead; following_lane_with_slow_lead.	Direct.	10/0
V-7 Lane Maintenance	Uncommanded lateral drift crosses or persistently approaches the lane or drivable-corridor boundary.	following_lane_without_lead.	Direct.	10/0
V-8 Illegal Turn	A turn is geometrically feasible but prohibited by the applicable control or lane rule.	starting_u_turn.	Recipe: prohibitory-sign intervention.	0/10
V-9 Blocking Intersection	Ego enters without downstream clearance or remains stopped in a conflict area without necessity.	stationary; stationary_in_traffic.	Direct.	10/0
V-10 Unsafe Merge	Ego enters a traffic stream without the declared longitudinal and lateral safety margins.	None.	Recipe: natural log plus targeted merge actor.	3/7
V-11 Wrong-Way Driving	Ego traverses a lane against its lawful direction even without a collision.	None.	Recipe: natural road geometry.	10/0
弱势道路使用者碰撞
R-1 Pedestrian-Involved	A pedestrian occupies, approaches, or is occluded near the ego’s potential path and requires yielding or clearance.	waiting_for_pedestrian_to_cross; near_pedestrian_on_crosswalk; near_pedestrian_on_crosswalk_with_ego; near_multiple_pedestrians; behind_pedestrian_on_driveable; behind_pedestrian_on_pickup_dropoff; near_pedestrian_at_pickup_dropoff; traversing_crosswalk; on_stopline_crosswalk; stopping_at_crosswalk; stationary_at_crosswalk; accelerating_at_crosswalk.	Direct.	10/0
R-2 Bicycle-Involved	A cyclist is followed, crossed, passed, or encountered in a shared conflict region.	behind_bike; crossed_by_bike; near_multiple_bikes.	Recipe: natural log plus targeted cyclist actor.	3/7
R-3 Micromobility-Involved	A micromobility device or other atypical road user, such as a delivery robot, enters shared space.	None.	Recipe: targeted micromobility actor.	0/10
R-4 Animal-Involved	An animal enters or approaches the drivable corridor without traffic-rule-compliant behavior.	None.	Recipe: targeted animal actor.	0/10
交通事件
I-1 Obstruction/Hazard	An unmapped static object obstructs the nominal path and requires stopping or a bounded avoidance maneuver.	near_trafficcone_on_driveable; near_barrier_on_driveable.	Direct.	10/0
I-2 Work Zone	Temporary signs, barriers, or workers alter the valid corridor relative to the base map.	near_construction_zone_sign.	Direct.	10/0
I-3 General Incident	A preregistered safety event not represented by another event type requires a specific fallback response.	None.	Recipe: targeted incident.	0/10

表 3：28 类事件的操作纳入标准、nuPlan 筛选标签、覆盖路径，以及自然/干预场景数。直接路径从日志检索；配方路径通过资产干预构造定义性事件。

A.2 Canonical Scenario for Each Event Type

A.2 每类事件的规范场景

Figure 9 complements the 12 event types visualized in Figure 2 by showing one scenario for each of the remaining 16 event types. Together, the two figures cover all 28 taxonomy leaves. The gallery highlights the diversity of road layouts, traffic participants, and traffic controls, while Table 3 specifies the operational inclusion criterion, nuPlan screening labels, coverage route, and natural/intervened scenario counts for each event type.

图 9 补充图 2 中可视化的 12 类事件，为其余 16 类各展示一个场景。两图合起来覆盖全部 28 个分类叶节点。图库突出道路布局、交通参与者与交通控制的多样性，而表 3 规定操作纳入标准、nuPlan 筛选标签与覆盖路径。

Figure 9: Additional NavSafe-$\infty$ scenario examples. Complementing the 12 event types shown in Figure 2, this figure presents one scenario for each of the remaining 16 event types; together, the two figures cover all 28 taxonomy leaves. Each panel shows a rendered front-camera observation at event onset under seed 0 using a common crop. The displayed scenarios were fixed before rendering and were not selected based on rendering quality or policy outcome.

图 9：额外的 NavSafe-$\infty$ 场景示例。在图 2 所示 12 类之外，本图为其余 16 类各展示一个场景；两图合起来覆盖全部 28 个分类叶节点。每格为种子 0、统一裁剪下事件起始时的渲染前视相机观测。

Figure 10: Additional NavSafe-$\infty$ scenario examples (continued).

图 10：**额外的 NavSafe-$\infty$ 场景示例（续）。

Appendix B NavSafe-$\infty$ Asset Library

附录 B NavSafe-$\infty$ 资产库

Intervened scenarios insert actors and objects that are absent from the host log. This appendix describes how these assets are constructed and lists the asset library. Dynamic actors follow a frozen pose track or a declared controller, and static objects are placed at a fixed pose (Appendix G.2).

干预场景会插入宿主日志中不存在的参与者与物体。本附录说明这些资产如何构建，并列出资产库。动态参与者跟随冻结位姿轨迹或声明的控制器，静态物体放在固定位姿（附录 G.2）。

B.1 Asset Construction

B.1 资产构建

All assets are 3DGS models generated with Asset Harvester (Cao et al., 2026). Given segmented images of an object, Asset Harvester synthesizes 16 consistent views with a multi-view diffusion model (SparseViewDiT) and lifts them to 3D Gaussians (TokenGS). Because unobserved views are generated, an asset approximates rather than reproduces the geometry and texture of its source object. The assets differ only in the source of the input images.

全部资产均为用 Asset Harvester（Cao et al., 2026）生成的 3DGS 模型。给定物体的分割图像，Asset Harvester 用多视角扩散模型（SparseViewDiT）合成 16 个一致视角，再提升为 3D 高斯（TokenGS）。因未观测视角是生成的，资产近似而非复现几何与外观；对基准而言，关键的是可识别类别线索与尺度，而非照片级身份匹配。

Vehicles from the source logs. We build a pipeline on Asset Harvester that converts vehicles in the nuPlan logs. Each scenario is processed as its four 5 s clips. In each clip, vehicle tracks are projected into the calibrated cameras using their 3D bounding boxes; observations that are invalid, too small, or heavily occluded are discarded, and the remaining ones are cropped and segmented. We retain cars, trucks, buses, and trailers with at least two valid observations and a net displacement of at least 2 m over the 20 s scenario, and keep at most ten per scenario, ranked by their closest observation distance. Parked vehicles are excluded because the scene reconstruction already observes them from multiple viewpoints. A track that appears in several clips is converted once, from the clip in which it is observed at the closest range. Each generated asset is rotated to the NuRec coordinate convention, and assets that are empty or whose dimension ratios deviate from the source bounding box by more than 35% are discarded. A retained asset replaces the reconstructed appearance of its source track so that the vehicle can be rendered from viewpoints not observed in the log. The asset is scaled to the bounding box of the track, and the identity and motion of the track are unchanged.

来自源日志的车辆。我们在 Asset Harvester 上搭建流水线，转换 nuPlan 日志中的车辆。每个场景按其四个 5 秒片段处理。在每个片段中，用三维包围盒把车辆轨迹投影到标定相机；无效、过小或严重遮挡的观测丢弃，其余裁剪并分割。我们保留在 20 秒场景中至少有两次有效观测、净位移至少 2 米的轿车、卡车、巴士与挂车，每场景最多保留十辆，按最近观测距离排序。已停放车辆排除在外，因为场景重建已从多视角观察到它们。出现在多个片段中的轨迹只转换一次，取最近距离观测所在片段。生成的每个资产旋转到 NuRec 坐标约定；空资产或尺寸比相对源包围盒偏离超过 35% 的资产丢弃。保留的资产替换其源轨迹的重建外观，使车辆能从日志未观测到的视角渲染。资产缩放到轨迹包围盒，轨迹的身份与运动保持不变。

Standalone assets. Pedestrians, cyclists, delivery robots, and additional vehicles are converted from single nuPlan camera frames, and animals and prohibitory signs from photographs taken by the authors. Each image is converted with the single-image mode of Asset Harvester, which segments the object with its built-in segmentation model and estimates the camera viewpoint before multi-view generation and lifting. Unlike in-log vehicles, these assets are not bound to a track and can be inserted into any scenario.

独立资产。行人、骑行者、配送机器人与额外车辆由单帧 nuPlan 相机图像转换；动物与禁令标志则来自作者拍摄的照片。每张图像用 Asset Harvester 的单图模式转换：内置分割模型分割物体并估计尺度，再合成多视角并提升为 3DGS。所得资产放入资产库，供配方事件按名称引用。

Gait animation. Inserted pedestrians and animals are static 3DGS assets, and the NuRec render interface accepts only one rigid pose per actor per frame. To keep them from sliding across the road in a frozen posture, we bake limb motion into the geometry as a small bank of copies, each frozen at a different phase of one gait cycle. For pedestrians, we fit the SOMA body model (Saito et al., 2026) to the asset’s Gaussians, starting from walking poses and refining with Chamfer distance. We then bind each Gaussian to the skeleton with skinning weights taken from the nearest body surface and pose the body at $K$ evenly spaced frames of a Kimodo (Rempe et al., 2026) walking motion. For animals, we use the SMAL model (Zuffi et al., 2017) with a procedurally generated trot, solving the knee angle at each frame to keep the stance foot planted. Forward travel and heading drift are removed from every phase, so each copy carries only limb motion and the trajectory still comes from the simulator. At render time, every phase is registered as a separate track. Each frame, phase $\lfloor dK/s\rfloor\bmod K$ is placed at the actor pose and the others are moved out of view, where $d$ is the distance the actor has traveled and $s$ is the stride measured from the baked cycle. Selecting phases by distance rather than by time keeps the feet planted at whatever speed the actor policy chooses. Physics, collision checking, and metrics still see a single track per actor, so the gait affects rendering only. Because each phase occupies render-server GPU memory, the benchmark uses three phases for pedestrians and five for animals.

步态动画。插入的行人与动物是静态 3DGS 资产，而 NuRec 渲染接口每帧每参与者只接受一个刚体位姿。为避免它们以冻结姿势在路面上滑行，我们把肢体运动烘焙进几何，做成一小套副本，每个冻结在一个步态周期的不同相位。对行人，我们用 SOMA 人体模型（Saito et al., 2026）拟合资产的高斯，从行走姿势出发并用 Chamfer 距离精炼；再把每个高斯以最近体表蒙皮权重绑定到骨架，并在 Kimodo（Rempe et al., 2026）行走动作的 $K$ 个均匀间隔帧上摆姿。对动物，我们用 SMAL 模型（Zuffi et al., 2017）配合程序生成的小跑，每帧求解膝角以保持支撑脚着地。每个相位去掉前向位移与航向漂移，使副本只携带肢体运动，轨迹仍来自仿真器。渲染时每个相位登记为独立轨迹。每帧把相位 $\lfloor dK/s\rfloor\bmod K$ 放到参与者位姿，其余移出视野，其中 $d$ 为已行驶距离，$s$ 为从烘焙周期测得的步幅。按距离而非时间选相位，可在策略选择的任意速度下保持脚着地。物理、碰撞检测与指标仍把每个参与者看成单条轨迹，因此步态只影响渲染。因每个相位占用渲染服务器 GPU 内存，基准对行人用三个相位，对动物用五个。

B.2 Asset Inventory

B.2 资产清单

Table 4 lists the asset library by category, source, and the event types that use it. Figures 11 and 12 show the assets rendered in isolation.

表 4 按类别、来源与使用它的事件类型列出资产库。图 11 与 12 展示单独渲染的资产。

Category	# Assets	Source	Used by event types
Pedestrians	5	nuPlan (frame)	R-3
Cyclists	4	nuPlan (frame)	R-2
Delivery robots	2	nuPlan (frame)	R-3
Animals	4	Photo	R-4
Vehicles	6	nuPlan (frame)	C-7, V-10, I-3
Vehicles	up to 10 per scenario	nuPlan (track)	All
Prohibitory signs	2	Photo	V-8

Table 4: NavSafe-$\infty$ asset inventory. nuPlan (track): converted from the vehicle tracks of the source logs; nuPlan (frame): converted from single nuPlan camera frames; Photo: converted from photographs taken by the authors.

类别	资产数	来源	用于事件类型
Pedestrians	5	nuPlan (frame)	R-3
Cyclists	4	nuPlan (frame)	R-2
Delivery robots	2	nuPlan (frame)	R-3
Animals	4	Photo	R-4
Vehicles	6	nuPlan (frame)	C-7, V-10, I-3
Vehicles	up to 10 per scenario	nuPlan (track)	All
Prohibitory signs	2	Photo	V-8

表 4：按类别、来源与使用事件类型划分的资产库。

Figure 11: Deformable assets animated with walking gaits: (a) pedestrians and (b) animals.

图 11：用行走步态动画化的可变形资产：（a）行人与（b）动物。

Figure 12: Rigid assets: (a) cyclists and delivery robots, (b) vehicles converted from single nuPlan frames, (c) vehicles converted from the vehicle tracks of the source logs (five examples), and (d) prohibitory signs.

图 12：刚体资产：（a）骑行者与配送机器人，（b）由单帧 nuPlan 图像转换的车辆，（c）由源日志车辆轨迹转换的车辆（五例），（d）禁令标志。

Appendix C Dataset Source and Photorealistic Reconstruction

附录 C 数据来源与照片级重建

This appendix supplements Section 3.3. It describes how each scenario is reconstructed and rendered, and how the fidelity comparison in Table 1 is conducted.

本附录补充第 3.3 节。说明每个场景如何重建与渲染，以及表 1 的保真度比较如何进行。

C.1 Source Logs and Evaluation Bundles

C.1 源日志与评测包

Each scenario is a 20 s window from the nuPlan test split (Caesar et al., 2021). Windows are drawn only from the 147 test logs that provide full-rate camera images, since the remaining test logs contain 2 Hz images that are too sparse for reconstruction. For every window, the manifest stores the nuPlan scenario token, source log and map, start and end timestamps, event type, recipe hash, and whether an edit is active. Each scenario is packaged as a self-contained bundle containing synchronized ego state, tracked boxes, traffic-light states, route and map context, reconstruction metadata, and referenced assets. Simulation and scoring read this symbolic state, whereas the policy receives only rendered sensor data and navigation inputs.

每个场景是 nuPlan 测试划分中的 20 秒窗口（Caesar et al., 2021）。窗口仅取自提供全帧率相机图像的 147 条测试日志，其余测试日志为 2 Hz 图像，对重建过稀。对每个窗口，清单存储 nuPlan 场景 token、源日志与地图、起止时间戳、事件类型、配方哈希，以及编辑是否激活。每个场景打包为自包含包，含同步自车状态、跟踪框、红绿灯状态、路线与地图上下文、重建元数据与引用资产。仿真与计分读取该符号状态，而策略只接收渲染传感器数据与导航输入。

C.2 Four-Segment NuRec Reconstruction

C.2 四片段 NuRec 重建

Each scenario is reconstructed as four independently trained 5 s NuRec models (NVIDIA, 2026b; Huang et al., 2026a) rather than as one model over the full window: a single 20 s model spreads the same Gaussian budget over four times as many frames and a correspondingly larger scene extent, which in our preliminary experiments visibly blurred static structure. Reconstruction uses the NRE 26.04 container (nvcr.io/nvidia/nre/nre-ga@sha256:6e0caa70a9148490552520c3dde9ee665c8d094ca10b814601cb8bb306567c90) with the car2sim_6cam configuration. Each segment is trained on five calibrated nuPlan cameras (F0, B0, L0, L1, and R0), using every fourth frame. The top LiDAR initializes the road Gaussians but provides no training rays, since LiDAR supervision yielded only a marginal improvement in visual fidelity at a substantially longer training time. In addition to the background, road, and dynamic-object layers of car2sim_6cam, we add a layer for static boxed objects (parked vehicles, cones, barriers, and signs), so that every annotated object, moving or static, is a separate node that can be moved, removed, or replaced at render time. To support novel-view rendering of moving vehicles, up to ten of the nearest valid in-log vehicles per scenario are further replaced with assets from the NavSafe-$\infty$ asset library (Appendix B). Each segment is optimized for 160k iterations with at most 5M Gaussians per segment; Gaussian addition and relocation stop at 140k iterations, and the learning rate follows a step-wise cosine annealing schedule over all 160k iterations.

每个场景重建为四个独立训练的 5 秒 NuRec 模型（NVIDIA, 2026b；Huang et al., 2026a），而不是覆盖整个窗口的单一模型：单个 20 秒模型把同样的高斯预算摊到四倍帧数与相应更大的场景范围，在我们的初步实验中会明显模糊静态结构。重建使用 NRE 26.04 容器与 car2sim_6cam 配置。每个片段在五个标定 nuPlan 相机（F0、B0、L0、L1、R0）上训练，每隔四帧取一帧。顶部激光雷达初始化道路高斯但不提供训练射线，因为激光雷达监督对视觉保真度提升有限、训练时间却明显更长。在 car2sim_6cam 的背景、道路与动态物体层之外，我们增加静态装箱物体层（停放车辆、锥桶、护栏与标志），使每个标注物体——运动或静止——都成为可在渲染时移动、移除或替换的独立节点。为支持运动车辆的新视角渲染，每场景最多十辆最近的有效日志内车辆进一步替换为 NavSafe-$\infty$ 资产库中的资产（附录 B）。每个片段优化 160k 次迭代，每片段最多 5M 高斯；高斯添加与重定位在 140k 次停止，学习率在全部 160k 次上按分步余弦退火。

At render time, each segment is placed in the shared log frame by a stored translation from its local reconstruction frame. Because a segment covers only the road that the logged ego traverses within its 5 s window, segments are selected by position rather than by simulation time: at each frame, the ego position is matched to the nearest pose on the logged ego trajectory, and the timestamp of that pose determines both the segment to render (the one whose window contains it) and the time at which it is queried. The ego thus enters the next segment when it reaches the corresponding location on the road, regardless of its speed relative to the logged ego, and the switch is made without blending. Because boundaries follow the log rather than event timing, a switch may fall within an event window; such switches are not excluded from evaluation.

渲染时，每个片段通过从其局部重建坐标系到共享日志坐标系的存储平移被放入共享日志帧。因片段只覆盖日志自车在其 5 秒窗口内驶过的道路，片段按位置而非仿真时间选择：每一帧，把自车位置匹配到日志自车轨迹上最近的位姿，该位姿的时间戳同时决定渲染哪个片段（窗口包含它的那个）以及查询时刻。因此，不论相对日志自车的速度如何，自车到达道路对应位置时进入下一片段，切换不做混合。因边界跟随日志而非事件时序，切换可能落在事件窗口内；此类切换不从评测中排除。

C.3 Rendering and Harmonizer

C.3 渲染与协调器

The renderer serves all four segments and renders each camera at its native resolution ($1920\times 1080$). Because each scene is a 3DGS reconstruction, any camera rig $\kappa$ can be rendered by changing its intrinsics and extrinsics (Section 3.1), including cameras that were not used for training. Each policy adapter selects, crops, resizes, and normalizes the cameras used by its policy: ReCogDrive, MTDrive, SimWAM, DriveLaW, and DriveVLA–W0 use F0; LTF, DiffusionDrive, SparseDriveV2, and GTRS use F0, L0, and R0; DrivoR and RAP use F0, L0, R0, and B0; and AutoVLA uses F0, L1, and R1. DiffusionHarmonizer (Zhang et al., 2026) post-processes every rendered frame independently, without temporal conditioning, to reduce reconstruction artifacts and the appearance mismatch of inserted assets.

渲染器服务全部四个片段，并按各相机原生分辨率（$1920\times 1080$）渲染。因每场景是 3DGS 重建，任意相机配置 $\kappa$ 都可通过改内外参渲染（第 3.1 节），包括训练未用到的相机。每个策略适配器选择、裁剪、缩放并归一化其策略所用相机：ReCogDrive、MTDrive、SimWAM、DriveLaW 与 DriveVLA–W0 用 F0；LTF、DiffusionDrive、SparseDriveV2 与 GTRS 用 F0、L0、R0；DrivoR 与 RAP 用 F0、L0、R0、B0；AutoVLA 用 F0、L1、R1。DiffusionHarmonizer（Zhang et al., 2026）独立后处理每一渲染帧、无时间条件，以减少重建伪影与插入资产的外观不匹配。

C.4 Rendering-Fidelity Evaluation

C.4 渲染保真度评估

Evaluation set. All renderers are evaluated on the front camera (CAM_F0) over 392 reconstructed 20 s scenarios, which include the 280 benchmark scenarios, and each rendered frame is compared with the recorded frame of the same timestamp. FID and FVD use the 15,680 frames sampled at 2 Hz, and $\mathrm{FD}_{\pi}$ uses the 4,163 NAVSIM navtest tokens (Dauner et al., 2024) among them, since each policy requires a complete NAVSIM scene as input. NavSafe-$\infty$ renders along the logged ego trajectory at $1920\times 1080$ with the Harmonizer enabled, as in closed-loop evaluation. DriveArena (Yang et al., 2025) generates each frame at $400\times 224$ with its WorldDreamer checkpoint, conditioned on the BEV layout, a text caption, and the previously generated frame; the reference frame is reset at the start of each scenario, and the three logs in DriveArena’s training split are excluded. DreamStream (Leng et al., 2026) generates frames at $1280\times 704$ with its Wan 2.2 (Team Wan et al., 2025) (5B) autoregressive video model, conditioned on the logged first frame, per-frame traffic layouts (the projected HD map and 3D agent boxes), and a text prompt. FVD uses the 1,568 clips formed by these frames.

评测集。所有渲染器在前视相机（CAM_F0）上、392 个重建的 20 秒场景评测，其中包括 280 个基准场景；每个渲染帧与同一时间戳的录制帧比较。FID 与 FVD 使用按 2 Hz 采样的 15,680 帧，$\mathrm{FD}_{\pi}$ 使用其中 4,163 个 NAVSIM navtest token（Dauner et al., 2024），因为每个策略需要完整 NAVSIM 场景作为输入。NavSafe-$\infty$ 沿日志自车轨迹以 $1920\times 1080$ 渲染并启用 Harmonizer，与闭环评测一致。DriveArena（Yang et al., 2025）用其 WorldDreamer 检查点按 $400\times 224$ 生成每帧，条件为 BEV 布局、文本标题与前一生成帧；参考帧在每场景开始时重置，并排除 DriveArena 训练划分中的三条日志。DreamStream（Leng et al., 2026）用其 Wan 2.2（Team Wan et al., 2025）（5B）自回归视频模型按 $1280\times 704$ 生成帧，条件为日志首帧、逐帧交通布局（投影 HD 地图与 3D 智能体框）与文本提示。FVD 使用由这些帧构成的 1,568 条剪辑。

Metrics. FID (Heusel et al., 2017) uses Inception-v3 (Szegedy et al., 2016) features (clean-fid (Parmar et al., 2022)) on individual frames, with the recorded frames resized to the resolution of each renderer: $1920\times 1080$ for NavSafe-$\infty$ and DreamStream, whose frames are upsampled from $1280\times 704$, and $400\times 224$ for DriveArena. FVD (Unterthiner et al., 2018) uses I3D (Carreira and Zisserman, 2017) features on clips of 16 consecutive 2 Hz frames with a stride of 8, resized to $224\times 224$. For policy $k$ with scene-context encoder $\phi_{k}$, let $(\mu_{r},\Sigma_{r})$ and $(\mu_{g},\Sigma_{g})$ be the mean and covariance of $\phi_{k}$ features on recorded and rendered frames. Following Leng et al. (2026),

指标。FID（Heusel et al., 2017）在单帧上使用 Inception-v3（Szegedy et al., 2016）特征（clean-fid，Parmar et al., 2022），录制帧缩放到各渲染器分辨率：NavSafe-$\infty$ 与 DreamStream 为 $1920\times 1080$（后者从 $1280\times 704$ 上采样），DriveArena 为 $400\times 224$。FVD（Unterthiner et al., 2018）在步长为 8、缩放到 $224\times 224$ 的 16 帧连续 2 Hz 剪辑上使用 I3D（Carreira and Zisserman, 2017）特征。对带场景上下文编码器 $\phi_{k}$ 的策略 $k$，令 $(\mu_{r},\Sigma_{r})$ 与 $(\mu_{g},\Sigma_{g})$ 分别为录制与渲染帧上 $\phi_{k}$ 特征的均值与协方差。遵循 Leng et al.（2026），

$$\mathrm{FD}_{\pi}^{k}=\frac{\lVert\mu_{r}-\mu_{g}\rVert_{2}^{2}+\operatorname{Tr}\!\big(\Sigma_{r}+\Sigma_{g}-2(\Sigma_{r}\Sigma_{g})^{1/2}\big)}{\operatorname{Tr}(\Sigma_{r})},\qquad\mathrm{FD}_{\pi}=\frac{1}{K}\sum_{k=1}^{K}\mathrm{FD}_{\pi}^{k},$$

with $K=5$ policies (DrivoR, DiffusionDrive, LTF, RAP, and SparseDriveV2). $\phi_{k}$ is the scene-context feature that each policy passes to its planning head, and Table 1 reports $\mathrm{FD}_{\pi}$ multiplied by 100. Because FID and FVD depend on the sample size, all renderers are scored on the same frames and clips.

其中 $K=5$ 个策略（DrivoR、DiffusionDrive、LTF、RAP 与 SparseDriveV2）。$\phi_{k}$ 是每个策略传给其规划头的场景上下文特征，表 1 报告的 $\mathrm{FD}_{\pi}$ 乘以 100。因 FID 与 FVD 依赖样本量，所有渲染器在相同帧与剪辑上计分。

Appendix D Evaluation Protocol and Metrics

附录 D 评测协议与指标

This appendix supplements Sections 3.1 and 3.2. It specifies how an episode is executed, when it terminates, and how its trace is scored.

本附录补充第 3.1 与 3.2 节。规定回合如何执行、何时终止，以及轨迹如何计分。

D.1 Closed-Loop Protocol

D.1 闭环协议

Timing and warm-up. The simulator advances at 10 Hz. Each episode begins with a log-replay warm-up of 20 frames (2 s) for direct scenarios and 8 frames (0.8 s) for recipe scenarios, after which every frame is closed loop. The shorter warm-up of recipe scenarios is fixed by the recipe, because the placement of each inserted actor is solved relative to the hand-off frame. Every policy receives the same warm-up on a given scenario.

时序与预热。仿真器以 10 Hz 推进。每个回合以日志回放预热开始：直接场景 20 帧（2 秒），配方场景 8 帧（0.8 秒），之后每帧均为闭环。配方场景更短的预热由配方固定，因为每个插入参与者的放置相对预热结束时的自车位姿求解。

Ego control. The policy replans every five frames (2 Hz). A shared tuned-LQR lateral controller with a kinematic bicycle model executes each predicted trajectory, so all policies are evaluated through the same plant.

自车控制。策略每五帧重规划一次（2 Hz）。共享的调参 LQR 横向控制器配合运动学自行车模型执行每条预测轨迹，因此所有策略通过同一被控对象评测。

Semi-reactive traffic. Surrounding traffic runs in a semi-reactive mode ported from MetaDrive’s reactive scenario traffic (Li et al., 2022). Every vehicle starts in log replay, and a moving vehicle is handed, one-way, to the Intelligent Driver Model (IDM) (Treiber et al., 2000) once it is oriented within 90° of the ego, lies more than 1 m behind and within 15 m laterally of the ego, and has at least 5 m of logged track remaining. Unlike MetaDrive, which tests these conditions only when a vehicle spawns, we re-test them every frame, so a vehicle that the ego overtakes becomes reactive once it falls behind. Once a vehicle’s logged track is exhausted, these conditions no longer apply and it is handed to IDM unconditionally. Only following vehicles are therefore made reactive: vehicles ahead of the ego, pedestrians, cyclists, and static objects replay their logs, and recipe-controlled actors retain their authored behaviors. IDM uses MetaDrive’s constants (10 m minimum gap, 1.5 s time headway, and 20 m lead-vehicle search range), evaluated in MetaDrive’s km/h speed convention.

半反应式交通。周围交通以移植自 MetaDrive 反应式场景交通（Li et al., 2022）的半反应式模式运行。每辆车从日志回放起步；一旦运动车辆朝向与自车夹角在 90° 内、位于自车后方超过 1 米且横向在 15 米内、并至少还剩 5 米日志轨迹，就单向移交给智能驾驶员模型（IDM）（Treiber et al., 2000）。与 MetaDrive 仅在车辆生成时检测这些条件不同，我们每帧重新检测，因此被自车超越后落到后方的车辆会变为反应式。一旦车辆的日志轨迹耗尽，这些条件不再适用，无条件交给 IDM。因此只有跟随车辆变为反应式：自车前方的车辆、行人、骑行者与静态物体回放日志，配方控制的参与者保留其编写行为。IDM 使用 MetaDrive 常数（最小间隙 10 米、车头时距 1.5 秒、前车搜索范围 20 米），并按 MetaDrive 的 km/h 速度约定评估。

Seeds. Each policy is evaluated on all 280 scenarios under seeds 0, 1, and 1024. The seed initializes the Python, NumPy, and PyTorch random number generators before the environment and the policy are constructed. Because the simulator retains minor nondeterminism, results can differ across seeds even for deterministic policies.

种子。每个策略在全部 280 个场景上、种子 0、1、1024 下评测。种子控制半反应式交通的随机性与（若适用）策略采样。报告跨三个种子的均值与样本标准差。

D.2 Event Contracts and Termination Rules

D.2 事件契约与终止规则

For route-reaching tasks, the goal is reached when the ego is simultaneously within a 10 m radius of the target and has at most $\max(2\,\mathrm{m},0.01L_{i})$ of route arc remaining, where $L_{i}$ is the route length of scenario $i$; arc progress is tracked by a monotone cursor, so leaving and rejoining the route does not retro-credit un-driven stretches. The same predicate is evaluated live and post hoc, so the two cannot disagree. An episode ends at its first terminal event: any contact, 0.5 s continuously outside the drivable surface, more than 6 m of wrong-way travel, running a red light, an illegal turn, or 5 s below 0.1 m/s (deadlock). The deadlock counter is suspended while the ego holds lawfully at a signal or stop line. Following NAVSIM (Dauner et al., 2024), a collision is charged to the ego only if the ego is moving and the other agent lies ahead of it; rear-end contacts by following agents and contacts while the ego is stationary terminate the episode without being charged. Every episode has a time budget of 60 s; an episode that reaches neither the goal nor another terminal event ends when the budget expires. Because the episode ends at the goal, and an ego that strays far from the logged path typically leaves the drivable surface and is terminated, rollouts remain close to the reconstructed region. Episodes interrupted by simulator or renderer failures are rerun rather than scored as policy failures.

对到达路线类任务，当自车同时落在目标 10 米半径内、且剩余路线弧长至多为 $\max(2\,\mathrm{m},0.01L_{i})$（$L_{i}$ 为场景 $i$ 的路线长度）时，视为到达目标；弧进度由单调游标跟踪，因此离开再回到路线不会追溯补偿未驶过的路段。同一谓词在线与事后评估，二者不会分歧。回合在首次终止事件时结束：任何接触、连续 0.5 秒离开可行驶表面、错误方向行驶超过 6 米、闯红灯、非法转弯，或低于 0.1 m/s 持续 5 秒（死锁）。自车在信号灯或停止线合法保持时，死锁计数器暂停。遵循 NAVSIM（Dauner et al., 2024），仅当自车在运动且对方位于其前方时，碰撞才记为自车责任；跟随车辆造成的追尾以及自车静止时的接触会终止回合但不记责。每回合时限 60 秒；既未达目标也未触发其他终止事件的回合在时限到期时结束。因回合在目标处结束，且大幅偏离日志路径的自车通常会离开可行驶表面而被终止，rollout 保持靠近重建区域。因仿真器或渲染器故障中断的回合重跑，而不记为策略失败。

For most event types, the contract uses the termination rule above, measures Event Progress (EP) as monotone progress along the logged route (100 on goal completion), and counts an episode as successful when it reaches the goal with no evaluated infraction. Four of the 28 event types modify this contract, listed in Table 5; V-1 appears as two rows because its traffic-light and stop-sign precursors take different contracts.

对多数事件类型，契约使用上述终止规则，把事件进度（EP）度量为沿日志路线的单调进度（到达目标为 100），并在无被评估违规到达目标时计为成功。28 类中有四类修改该契约，列于表 5；V-1 因红绿灯与停车标志前驱采用不同契约而占两行。

Event type	Modification
C-3 Sideswipe	When the ego is assigned a lane change, success additionally requires a lane transition with at least 0.5 m lateral offset held for five frames.
V-1 Red-Light	The goal and deadlock terminals are suspended. Crossing the stop line fails the episode; holding for the full window succeeds. EP is the fraction of the window held before crossing.
V-1 Stop-Sign	Success additionally requires 3 s below 0.3 m/s before the stop line when the approach is observed.
V-8 Illegal Turn	The goal terminal is suspended and the outside-route-lanes infraction is waived, since the logged route is the prohibited turn and a compliant policy must leave it. Entering the prohibited exit lane fails the episode; clearing the intersection without entering the prohibited lane succeeds.
I-2 Work Zone	Wrong-way travel is neither a terminal nor an infraction, since the prescribed bypass uses the opposing lane.

Table 5: Event types whose contract differs from the default.

事件类型	修改
C-3 Sideswipe	When the ego is assigned a lane change, success additionally requires a lane transition with at least 0.5 m lateral offset held for five frames.
V-1 Red-Light	The goal and deadlock terminals are suspended. Crossing the stop line fails the episode; holding for the full window succeeds. EP is the fraction of the window held before crossing.
V-1 Stop-Sign	Success additionally requires 3 s below 0.3 m/s before the stop line when the approach is observed.
V-8 Illegal Turn	The goal terminal is suspended and the outside-route-lanes infraction is waived, since the logged route is the prohibited turn and a compliant policy must leave it. Entering the prohibited exit lane fails the episode; clearing the intersection without entering the prohibited lane succeeds.
I-2 Work Zone	Wrong-way travel is neither a terminal nor an infraction, since the prescribed bypass uses the opposing lane.

表 5：相对默认契约的事件类型特定修改。

D.3 Metrics and Aggregation

D.3 指标与汇总

All metrics are computed from the saved closed-loop trace. For scenario $i$ and seed $s$,

所有指标由保存的闭环轨迹计算。对场景 $i$ 与种子 $s$，

$$\mathrm{DS}_{i,s}=\mathrm{EP}_{i,s}\,(0.50)^{n_{\mathrm{ped}}}(0.60)^{n_{\mathrm{veh}}}(0.65)^{n_{\mathrm{layout}}}(0.70)^{n_{\mathrm{red}}+n_{\mathrm{timeout}}+n_{\mathrm{yield}}}(0.80)^{n_{\mathrm{stop}}}\left(1-\frac{p_{\mathrm{outside}}}{100}\right),$$

where $n_{\mathrm{ped}}$, $n_{\mathrm{veh}}$, and $n_{\mathrm{layout}}$ count at-fault collisions with pedestrians, vehicles, and static objects; $n_{\mathrm{red}}$, $n_{\mathrm{timeout}}$, and $n_{\mathrm{yield}}$ count red-light violations, scenario timeouts, and failures to yield to an emergency vehicle; $n_{\mathrm{stop}}$ counts stop-sign violations; and $p_{\mathrm{outside}}$ is the percentage of driven distance outside the drivable area, excluding the first 0.5 m of each excursion. The coefficients follow CARLA (Dosovitskiy et al., 2017) Leaderboard 2.0 and Bench2Drive (Jia et al., 2024). An episode succeeds ($S_{i,s}=1$) if it satisfies its event contract: it completes the event and incurs no infraction other than a minimum-speed infraction. A timeout therefore counts as a failure, as does any nonzero $p_{\mathrm{outside}}$. SR is the percentage of successful episodes, $\mathrm{SR}_{s}=\frac{100}{N}\sum_{i}S_{i,s}$, over the $N=280$ scenarios.

其中 $n_{\mathrm{ped}}$、$n_{\mathrm{veh}}$ 与 $n_{\mathrm{layout}}$ 统计对行人、车辆与静态物体的有责碰撞；$n_{\mathrm{red}}$、$n_{\mathrm{timeout}}$ 与 $n_{\mathrm{yield}}$ 统计闯红灯、场景超时与未给紧急车辆让行；$n_{\mathrm{stop}}$ 统计闯停车标志；$p_{\mathrm{outside}}$ 为可行驶区域外行驶距离百分比，排除每次越界的前 0.5 米。系数遵循 CARLA（Dosovitskiy et al., 2017）Leaderboard 2.0 与 Bench2Drive（Jia et al., 2024）。若回合满足其事件契约——完成事件且除最低速度违规外无其他违规——则成功（$S_{i,s}=1$）。因此超时计为失败，任一非零 $p_{\mathrm{outside}}$ 亦然。SR 为成功回合百分比，$\mathrm{SR}_{s}=\frac{100}{N}\sum_{i}S_{i,s}$，对 $N=280$ 个场景。

DE is the mean ratio, in percent, between the ego speed and the mean speed of background vehicles at 20 route checkpoints spaced at 5% of the route. It is undefined, and excluded from the average, when the ego reaches no checkpoint or the median background speed is below 1.5 m/s, since the ratio is then dominated by queued traffic. Individual checkpoints whose ratio exceeds 1000% are additionally discarded before averaging. Comfort is the percentage of non-overlapping 2 s windows in which the smoothed longitudinal and lateral acceleration, jerk, yaw rate, and yaw acceleration all stay within the nuPlan comfort bounds (Caesar et al., 2021).

DE 是自车速度与背景车辆平均速度之比的均值（百分数），在沿路线按 5% 间距布置的 20 个检查点上计算。当自车未到达任何检查点或背景速度中位数低于 1.5 m/s 时，该指标无定义并排除出平均，因为比值会被排队交通主导。比值超过 1000% 的单个检查点在平均前额外丢弃。Comfort 是非重叠 2 秒窗口中、平滑后的纵向与横向加速度、加加速度、横摆角速度与横摆角加速度全部落在 nuPlan 舒适界限（Caesar et al., 2021）内的百分比。

DS, SR, and Comfort are averaged over the 280 scenarios, and DE over the scenarios where it is defined. The Ability Score of a category is the unweighted mean of the success rates of its event types. We report the mean and the sample standard deviation of each metric over the three seeds.

DS、SR 与 Comfort 对 280 个场景取平均，DE 对可定义该指标的场景取平均。类别 Ability Score 是该类别内事件类型级 SR 的等权平均。

D.4 Benchmark Quality Controls and Scope

D.4 基准质量控制与范围

Every benchmark cell is solvable under the specified evaluation interface: three participants, each assigned one evaluation seed, collectively complete all 840 scenario–seed cells in the Human Driver Reference (Appendix E.2). All scenarios are drawn from the nuPlan test logs underlying the NAVSIM navtest and navhard splits, which share no logs or scenes with the NAVSIM training split navtrain. Each evaluation records the resolved configuration, seed, state trace, infractions, and terminal reason, together with the checkpoint checksum for policy runs, allowing every reported score to be recomputed from its saved trace. These controls make the evaluation auditable while limiting its conclusions to bounded, taxonomy-defined events within the simulator.

每个基准单元在指定评测接口下可解：三名参与者各分配一个评测种子，在人类驾驶员参考中共同完成全部 840 个场景—种子单元（附录 E.2）。所有场景取自支撑 NAVSIM navtest 与 navhard 划分的 nuPlan 测试日志，与 NAVSIM 训练划分 navtrain 无共享日志或场景。每次评测记录解析后的配置、种子、状态轨迹、违规与终止原因，以及对策略运行的检查点校验和，使每个报告分数都可从保存轨迹重算。这些控制使评测可审计，同时把结论限制在仿真器内有界、分类定义的事件上。

Appendix E Evaluated Policies and Human Reference

附录 E 所评策略与人类参考

This appendix supplements Table 2 with the identity and inputs of each evaluated policy and the construction of the Human Driver Reference.

本附录补充表 2：每个所评策略的身份与输入，以及人类驾驶员参考的构造。

E.1 Evaluated Policies and Checkpoints

E.1 所评策略与检查点

Table 6 lists the 20 learned policies, which are described in Section 2.2, and the privileged reference PDM-Closed (Dauner et al., 2023), a rule-based planner that reads ground-truth simulator state and selects among rolled-out proposals. By how they generate the ego trajectory, the 20 learned policies fall into four families:

表 6 列出第 2.2 节所述的 20 个学习型策略，以及特权参考 PDM-Closed（Dauner et al., 2023）——读取仿真器真值状态并在 rollout 提案中选择的基于规则规划器。按生成自车轨迹的方式，20 个学习型策略分为四族：

• • Regression, which predicts one or several trajectories from learned queries (Dauner et al., 2024; Kirby et al., 2026): LTF, LTF (SimScale), DrivoR, DrivoR (SimScale, 134k), and RAP.
• • Vocabulary selection, which scores a fixed set of candidate trajectories (Li et al., 2025b; Sun et al., 2026): SparseDriveV2, GTRS-Dense–V2-99, and GTRS-Dense–V2-99 (SimScale).
• • Diffusion or flow matching, which generates trajectories by iteratively denoising sampled motions (Wang et al., 2025; Liao et al., 2025), including VLA backbones with diffusion or flow-matching action heads (Zhou et al., 2026b): DiffusionDrive, DiffusionDrive (SimScale), DiffusionDrive (BeyondDrive), ReCogDrive–2B–IL, ReCogDrive–2B–RL, DriveLaW, DriveVLA–W0, SimWAM, and SimWAM–RL. DiffusionDrive denoises from 20 anchors obtained by $k$-means clustering of training trajectories, using only two denoising steps, so its outputs remain close to these anchors; Section 4.3 therefore treats it as anchor-based.
• • Autoregressive token decoding (Zhou et al., 2025): AutoVLA, MTDrive–SFT, and MTDrive–mtGRPO.

• • 回归：从学习查询预测一条或若干轨迹（Dauner et al., 2024；Kirby et al., 2026）：LTF、LTF（SimScale）、DrivoR、DrivoR（SimScale, 134k）与 RAP。
• • 词表选择：对固定候选轨迹集打分（Li et al., 2025b；Sun et al., 2026）：SparseDriveV2、GTRS-Dense–V2-99 与 GTRS-Dense–V2-99（SimScale）。
• • 扩散或流匹配：通过对采样运动迭代去噪生成轨迹（Wang et al., 2025；Liao et al., 2025），包括带扩散或流匹配动作头的 VLA 骨干（Zhou et al., 2026b）：DiffusionDrive、DiffusionDrive（SimScale）、DiffusionDrive（BeyondDrive）、ReCogDrive–2B–IL、ReCogDrive–2B–RL、DriveLaW、DriveVLA–W0、SimWAM 与 SimWAM–RL。DiffusionDrive 从对训练轨迹 $k$-means 得到的 20 个锚点去噪，仅用两步，因此输出仍靠近这些锚点；第 4.3 节因而把它当作基于锚点。
• • 自回归词元解码（Zhou et al., 2025）：AutoVLA、MTDrive–SFT 与 MTDrive–mtGRPO。

Released weights are evaluated without retraining, and each adapter preserves the policy’s declared sensor inputs, normalization, and trajectory parameterization (camera preprocessing in Appendix C.3; adapter interface in Appendix G.3). The evaluation manifest pins the model revision, checkpoint checksum, adapter revision, sensor configuration, inference parameters, and controller configuration of every row. Conclusions about a post-training intervention (Yang et al., 2026), such as RL fine-tuning or demonstration perturbation, are drawn only from checkpoint pairs that share the same architecture and differ in that intervention (e.g., ReCogDrive–2B–IL and ReCogDrive–2B–RL, or DiffusionDrive and DiffusionDrive (SimScale)); other comparisons are descriptive. All checkpoints are also mirrored in the NavSafe-$\infty$ model zoo.

发布权重不经重训即评测，每个适配器保留策略声明的传感器输入、归一化与轨迹参数化（相机预处理见附录 C.3；适配器接口见附录 G.3）。评测清单固定每行的模型修订、检查点校验和、适配器修订、传感器配置、推理参数与控制器配置。关于后训练干预（Yang et al., 2026）——如 RL 微调或示范扰动——的结论，仅从共享同一架构、仅在该干预上不同的检查点对得出（例如 ReCogDrive–2B–IL 与 ReCogDrive–2B–RL，或 DiffusionDrive 与 DiffusionDrive（SimScale））；其他比较属描述性。所有检查点亦镜像于 NavSafe-$\infty$ 模型库。

Policy	Group	Inputs	Description	NAVSIM
PDM-Closed	Privileged	Simulator state	Rule-based planner that scores rolled-out proposals using ground-truth scene state.	Rule-based
LTF	IL	F0/L0/R0	NAVSIM Latent TransFuser baseline that regresses an ego trajectory from logged demonstrations.	v1
DiffusionDrive	IL	F0/L0/R0	Truncated diffusion planner that generates multimodal ego trajectories.	v1
DrivoR	IL	F0/L0/R0/B0	Register-based planner trained on logged NAVSIM demonstrations.	v1
RAP	IL	F0/L0/R0/B0	Planner trained with rasterized counterfactual recovery and cross-agent views and raster-to-real alignment.	v1*†*
SparseDriveV2	IL	F0/L0/R0	Vocabulary-based planner that scores factorized paths and velocity profiles in a coarse-to-fine manner.	v1
GTRS-Dense–V2-99	IL	F0/L0/R0	Dense-vocabulary trajectory scorer; V2-99 denotes its VoVNet-99 (Lee and Park, 2020) image backbone. Scores 16,384 candidate trajectories with per-metric EPDMS heads.	v2
ReCogDrive–2B–IL	IL	F0	2B-parameter VLA with a diffusion trajectory planner, before reward-based post-training.	v1
MTDrive–SFT	IL	F0	Supervised VLA stage used as the initialization for MTDrive’s multi-turn reward post-training.	v1
ReCogDrive–2B–RL	RLFT	F0	ReCogDrive–2B–IL after DiffGRPO reward-based post-training.	v1
MTDrive–mtGRPO	RLFT	F0	MTDrive–SFT after multi-turn group-relative reward optimization on offline scenes.	v1
SimWAM–RL	RLFT	F0	SimWAM action expert after flow-based group-relative post-training.	v1
AutoVLA	RLFT	F0/L1/R1	VLA with adaptive reasoning and reinforcement fine-tuning; only the final released stage is evaluated.	v1*†*
DiffusionDrive (SimScale)	Perturbation	F0/L0/R0	DiffusionDrive co-trained on real logs and SimScale perturbed scenes with pseudo-expert supervision.	v1
DrivoR (SimScale, 134k)	Perturbation	F0/L0/R0/B0	DrivoR trained on 103k real and 134k SimScale samples for 30 epochs.	v1
LTF (SimScale)	Perturbation	F0/L0/R0	LTF co-trained on real logs and SimScale perturbed scenes.	v1
GTRS-Dense–V2-99 (SimScale)	Perturbation	F0/L0/R0	GTRS-Dense co-trained on real logs and SimScale perturbed scenes.	v2
DiffusionDrive (BeyondDrive)	Perturbation	F0/L0/R0	DiffusionDrive trained with expert-proximate unsafe trajectories as negatives under BeyondDrive’s repulsive objective.	v1
DriveLaW	World model	F0	Diffusion planner conditioned on latent features of a jointly trained video world model.	v1
DriveVLA–W0	World model	F0	Emu3 (Wang et al., 2024) visual-token backbone with the released flow-matching action expert.	v1
SimWAM	World model	F0	Action-diffusion policy co-trained with a video expert whose isolated attention mask makes the action head independent of future frames, so the video branch is dropped at inference.	v1

Table 6: Evaluated policies, grouped as in Table 7. Inputs list the rendered cameras (F0: front; B0: rear; L0/R0 and L1/R1: left/right). The last column gives the NAVSIM version each released checkpoint was trained for. Every post-training pair is version-matched, so an intervention is never confounded with a change of training split. All policies are executed through the same controller at the same replan rate, so the parameterization affects only how far ahead each model plans, not how its output is tracked. *†*RAP predicts 10 poses over 5 s at 2 Hz and AutoVLA predicts 10 poses; both retain the v1 metric heads.

策略	组别	输入	描述	NAVSIM
PDM-Closed	Privileged	Simulator state	Rule-based planner that scores rolled-out proposals using ground-truth scene state.	Rule-based
LTF	IL	F0/L0/R0	NAVSIM Latent TransFuser baseline that regresses an ego trajectory from logged demonstrations.	v1
DiffusionDrive	IL	F0/L0/R0	Truncated diffusion planner that generates multimodal ego trajectories.	v1
DrivoR	IL	F0/L0/R0/B0	Register-based planner trained on logged NAVSIM demonstrations.	v1
RAP	IL	F0/L0/R0/B0	Planner trained with rasterized counterfactual recovery and cross-agent views and raster-to-real alignment.	v1*†*
SparseDriveV2	IL	F0/L0/R0	Vocabulary-based planner that scores factorized paths and velocity profiles in a coarse-to-fine manner.	v1
GTRS-Dense–V2-99	IL	F0/L0/R0	Dense-vocabulary trajectory scorer; V2-99 denotes its VoVNet-99 (Lee and Park, 2020) image backbone. Scores 16,384 candidate trajectories with per-metric EPDMS heads.	v2
ReCogDrive–2B–IL	IL	F0	2B-parameter VLA with a diffusion trajectory planner, before reward-based post-training.	v1
MTDrive–SFT	IL	F0	Supervised VLA stage used as the initialization for MTDrive’s multi-turn reward post-training.	v1
ReCogDrive–2B–RL	RLFT	F0	ReCogDrive–2B–IL after DiffGRPO reward-based post-training.	v1
MTDrive–mtGRPO	RLFT	F0	MTDrive–SFT after multi-turn group-relative reward optimization on offline scenes.	v1
SimWAM–RL	RLFT	F0	SimWAM action expert after flow-based group-relative post-training.	v1
AutoVLA	RLFT	F0/L1/R1	VLA with adaptive reasoning and reinforcement fine-tuning; only the final released stage is evaluated.	v1*†*
DiffusionDrive (SimScale)	Perturbation	F0/L0/R0	DiffusionDrive co-trained on real logs and SimScale perturbed scenes with pseudo-expert supervision.	v1
DrivoR (SimScale, 134k)	Perturbation	F0/L0/R0/B0	DrivoR trained on 103k real and 134k SimScale samples for 30 epochs.	v1
LTF (SimScale)	Perturbation	F0/L0/R0	LTF co-trained on real logs and SimScale perturbed scenes.	v1
GTRS-Dense–V2-99 (SimScale)	Perturbation	F0/L0/R0	GTRS-Dense co-trained on real logs and SimScale perturbed scenes.	v2
DiffusionDrive (BeyondDrive)	Perturbation	F0/L0/R0	DiffusionDrive trained with expert-proximate unsafe trajectories as negatives under BeyondDrive’s repulsive objective.	v1
DriveLaW	World model	F0	Diffusion planner conditioned on latent features of a jointly trained video world model.	v1
DriveVLA–W0	World model	F0	Emu3 (Wang et al., 2024) visual-token backbone with the released flow-matching action expert.	v1
SimWAM	World model	F0	Action-diffusion policy co-trained with a video expert whose isolated attention mask makes the action head independent of future frames, so the video branch is dropped at inference.	v1

表 6：所评策略、组别、传感器输入、简述与 NAVSIM 协议版本。发布权重不经重训；适配器保留各策略声明的输入与轨迹参数化。

E.2 Human Driver Reference

E.2 人类驾驶员参考

Human participants. We recruited three volunteer university students aged 20–30. All participants held valid driver’s licenses and reported prior video-gaming experience. The study was conducted under an IRB-approved protocol, and each participant provided written informed consent before participation. Before the recorded evaluation, participants were briefed on the experimental procedure, the rendered front-camera display with overlaid ground-truth route waypoints, and the game-controller interface (Figure 13). Each participant then completed a familiarization session in the simulator.

人类参与者。我们招募三名 20–30 岁的志愿大学生。所有参与者持有效驾照，并报告有电子游戏经验。研究在 IRB 批准协议下进行，每人参与前提供书面知情同意。正式评测前，向参与者说明实验流程、叠加真值路线航点的渲染前视显示，以及游戏手柄接口（图 13）。随后每人完成一次仿真器熟悉环节。

Evaluation procedure. Each participant was assigned one of the three evaluation seeds (0, 1, or 1024) and drove all 280 scenarios for that seed, yielding 840 fully human-controlled scenario–seed cells. Participants were instructed to prioritize collision avoidance and compliance with traffic rules while following the displayed route. They observed only the rendered front-camera view and had no access to privileged simulator state, bird’s-eye-view observations, future actor trajectories, or the logged ego trajectory. Human commands were issued through a gamepad and executed by the same controller and bicycle model used for policy outputs; vehicle dynamics, traffic evolution, event contracts, termination rules, and scoring were identical to those used in the policy evaluations. The Human Driver Reference establishes scenario solvability under the specified interface rather than population-level human performance or between-driver variability.

评测程序。每名参与者分配三个评测种子（0、1 或 1024）之一，并驾驶该种子下全部 280 个场景，共得 840 个完全由人类控制的场景—种子单元。指示参与者在跟随显示路线的同时优先避撞并遵守交规。他们只观察渲染前视，无法访问特权仿真器状态、鸟瞰观测、未来参与者轨迹或日志自车轨迹。人类指令经游戏手柄发出，并由与策略输出相同的控制器与自行车模型执行；车辆动力学、交通演化、事件契约、终止规则与计分与策略评测完全一致。人类驾驶员参考用以在指定接口下建立场景可解性，而非刻画人群层面人类表现或驾驶员间变异。

Figure 13: Human-reference evaluation setup. The rendered front-camera view with overlaid ground-truth route waypoints and the gamepad used for human-controlled rollouts.

图 13：人类参考评测装置。叠加真值路线航点的渲染前视，以及人类控制 rollout 所用的游戏手柄。

Appendix F Additional Experimental Results

附录 F 额外实验结果

This appendix supplements Section 4 with the OL–CL comparison and complete leaderboard for Section 4.1, the case-selection protocol for the failure investigations in Section 4.2, and the diagnostic setting for Section 4.3.

本附录补充第 4 节：第 4.1 节的开环—闭环比较与完整排行榜、第 4.2 节失败调查的案例选择协议，以及第 4.3 节的诊断设定。

F.1 Full Leaderboard

F.1 完整排行榜

Table 7 extends Table 2 with three policies omitted for space: SimWAM–RL, DriveLaW, and DriveVLA–W0. All other rows are identical to Table 2. Rankings are recomputed over the 20 learned policies.

表 7 在表 2 基础上补上因篇幅省略的三个策略：SimWAM–RL、DriveLaW 与 DriveVLA–W0。其余行与表 2 相同。排名在 20 个学习型策略上重算。

Policy	Venue	Closed-loop metrics	Closed-loop ability scores
DS	SR	DE	Comf.	TC	VRUC	TV	TI
Human Driver Reference§	–	100.00$\pm$0.00	100.00$\pm$0.00	316.52$\pm$0.42	75.15$\pm$1.89	100.00$\pm$0.00	100.00$\pm$0.00	100.00$\pm$0.00	100.00$\pm$0.00
Privileged reference
PDM-Closed*⋆* (Dauner et al., 2023)	CoRL 2023	90.17$\pm$1.00	81.31$\pm$1.03	305.27$\pm$8.57	82.49$\pm$1.39	88.67$\pm$1.53	72.50$\pm$0.00	84.24$\pm$1.39	57.78$\pm$1.92
IL-based Methods
LTF (Dauner et al., 2024)	NeurIPS 2024	53.04$\pm$1.92	27.74$\pm$1.76	163.71$\pm$0.11	97.81$\pm$0.15	31.67$\pm$0.58	25.00$\pm$7.50	28.48$\pm$1.89	15.56$\pm$1.92
DiffusionDrive (Liao et al., 2025)	CVPR 2025	44.77$\pm$0.75	20.95$\pm$0.55	165.08$\pm$1.84	97.68$\pm$0.56	21.33$\pm$1.15	11.67$\pm$1.44	23.64$\pm$0.00	22.22$\pm$1.92
DrivoR (Kirby et al., 2026)	CVPR 2026	64.74$\pm$1.60	50.71$\pm$0.71	188.02$\pm$1.07	87.92$\pm$1.25	58.67$\pm$2.52	31.67$\pm$5.77	52.42$\pm$2.62	43.33$\pm$0.00
RAP (Feng et al., 2026)	ICLR 2026	47.70$\pm$0.66	27.26$\pm$0.41	220.78$\pm$3.77	48.38$\pm$0.60	32.33$\pm$1.15	14.17$\pm$6.29	28.79$\pm$0.52	22.22$\pm$3.85
SparseDriveV2 (Sun et al., 2026)	ECCV 2026	65.26$\pm$1.72	48.81$\pm$3.04	167.99$\pm$1.01	93.41$\pm$0.43	54.00$\pm$0.00	43.33$\pm$8.04	48.18$\pm$4.17	41.11$\pm$3.85
GTRS-Dense–V2-99 (Li et al., 2025b)	arXiv 2025	64.27$\pm$0.76	49.52$\pm$1.15	163.88$\pm$0.87	95.90$\pm$0.63	52.00$\pm$1.73	40.00$\pm$2.50	54.24$\pm$0.52	36.67$\pm$0.00
ReCogDrive–2B–IL (Li et al., 2026d)	ICLR 2026	48.98$\pm$0.95	28.21$\pm$1.43	166.94$\pm$3.15	97.58$\pm$0.11	30.00$\pm$1.00	16.67$\pm$3.82	31.21$\pm$0.52	26.67$\pm$3.33
MTDrive–SFT (Li et al., 2026b)	arXiv 2026	48.78$\pm$0.88	31.79$\pm$1.43	173.77$\pm$0.76	94.51$\pm$1.25	30.33$\pm$1.15	15.00$\pm$6.61	35.76$\pm$1.39	44.44$\pm$1.92
RLFT-based Methods
ReCogDrive–2B–RL (Li et al., 2026d)	ICLR 2026	53.64$\pm$1.42	30.95$\pm$2.06	173.96$\pm$1.90	85.10$\pm$0.49	35.33$\pm$2.31	18.33$\pm$6.29	32.42$\pm$1.39	27.78$\pm$5.09
MTDrive–mtGRPO (Li et al., 2026b)	arXiv 2026	55.86$\pm$0.50	40.60$\pm$0.90	277.62$\pm$3.17	93.94$\pm$0.41	40.33$\pm$2.89	16.67$\pm$1.44	46.36$\pm$0.91	52.22$\pm$3.85
SimWAM–RL (Zhao et al., 2026b)	arXiv 2026	55.41$\pm$1.72	29.76$\pm$2.86	173.08$\pm$2.41	78.62$\pm$0.68	35.67$\pm$3.06	22.50$\pm$4.33	28.48$\pm$1.89	24.44$\pm$5.09
AutoVLA (Zhou et al., 2025)	NeurIPS 2025	51.05$\pm$0.80	29.52$\pm$2.43	186.02$\pm$0.58	65.37$\pm$0.47	33.00$\pm$2.65	15.00$\pm$4.33	29.70$\pm$2.92	36.67$\pm$8.82
Passive Demonstration Perturbation Methods
DiffusionDrive (SimScale) (Tian et al., 2026)	CVPR 2026	52.19$\pm$2.05	35.24$\pm$2.38	189.66$\pm$4.28	96.92$\pm$0.34	38.33$\pm$1.15	18.33$\pm$7.22	36.67$\pm$5.01	42.22$\pm$3.85
DrivoR (SimScale, 134k) (Tian et al., 2026)	CVPR 2026	57.66$\pm$1.32	42.50$\pm$0.36	176.73$\pm$0.92	85.88$\pm$0.39	44.00$\pm$1.00	17.50$\pm$2.50	48.18$\pm$2.41	50.00$\pm$0.00
LTF (SimScale) (Tian et al., 2026)	CVPR 2026	52.65$\pm$0.88	34.05$\pm$0.21	192.09$\pm$0.85	97.41$\pm$0.48	35.00$\pm$1.73	17.50$\pm$2.50	38.48$\pm$0.52	36.67$\pm$0.00
GTRS-Dense–V2-99 (SimScale) (Tian et al., 2026)	CVPR 2026	73.54$\pm$0.84	61.79$\pm$1.56	141.50$\pm$1.30	87.69$\pm$1.66	69.33$\pm$0.58	50.00$\pm$2.50	64.24$\pm$1.89	43.33$\pm$3.33
DiffusionDrive (BeyondDrive) (Wang et al., 2026a)	ECCV 2026	46.61$\pm$0.07	21.79$\pm$0.94	172.79$\pm$1.26	97.24$\pm$0.19	22.67$\pm$1.53	10.00$\pm$0.00	25.15$\pm$1.39	22.22$\pm$1.92
World-Model-based Methods
DriveLaW (Xia et al., 2026a)	CVPR 2026	34.68$\pm$0.25	1.90$\pm$0.21	175.50$\pm$1.32	95.27$\pm$0.01	1.00$\pm$0.00	2.50$\pm$0.00	2.12$\pm$0.52	3.33$\pm$0.00
DriveVLA–W0 (Li et al., 2026c)	ICLR 2026	45.06$\pm$0.64	27.98$\pm$1.80	256.31$\pm$1.01	62.74$\pm$1.14	26.67$\pm$2.31	7.50$\pm$0.00	33.94$\pm$2.29	37.78$\pm$1.92
SimWAM (Zhao et al., 2026b)	arXiv 2026	57.53$\pm$2.72	37.50$\pm$1.56	160.54$\pm$1.64	97.19$\pm$0.27	41.33$\pm$0.58	26.67$\pm$7.22	40.61$\pm$0.52	27.78$\pm$5.09

Table 7: Full NavSafe-$\infty$ leaderboard, including the world-model-based policies omitted from Table 2. Among the 20 learned policies, blue, green, and yellow backgrounds denote the first-, second-, and third-highest point estimates in each column, respectively. Values are means over the same 280 scenarios and seeds 0, 1, and 1024; $\pm$ is the sample standard deviation across the per-seed estimates. Because every event type contributes exactly ten scenarios, per-seed category scores fall on a discrete grid with steps of $10/10$, $10/11$, $10/4$, and $10/3$ points for TC, TV, VRUC, and TI, respectively, and SR equals the event-type-weighted mean of the four ability scores. § indicates a human controller using NuRec front-camera observations; ⋆ denotes a privileged, non-learned reference. Rankings are recomputed over all learned policies; DriveVLA–W0 enters the top three in DE, displacing LTF (SimScale), and DE is the only column whose highlighting differs from Table 2.