RiskFlow: Fast and Faithful Safety-Critical Traffic Scenario Generation Qi Lan1 , Yining Tang1 , Yu Shen1 , Yi Zhou1 , Yuhao Wei1 , Jie Li1∗ , Guofa Li1∗
arXiv:2606.06423v1 [cs.RO] 4 Jun 2026
1
College of Mechanical and Vehicle Engineering Chongqing University, Chongqing, China
Abstract Safety-critical traffic scenario generation is essential for evaluating autonomous driving systems under rare but high-risk interactions. Existing diffusion-based methods offer strong controllability in closed-loop generation, but their iterative denoising process is computationally expensive and may accumulate sampling and guidance errors over long rollouts, causing unrealistic motion artifacts such as jitter, abnormal acceleration, and off-road behavior. To address these issues, we propose RiskFlow, a closed-loop safety-critical multi-agent traffic generation framework that formulates future trajectory generation as transport in the action space. Instead of relying on iterative denoising, RiskFlow learns an average velocity field over a finite interval to transform Gaussian action sequences into future acceleration and yaw-rate commands with a single forward pass, using a JVP-based objective for efficient and stable training. At test time, RiskFlow applies output-space guidance to the generated actions, steering selected critical agents toward risky interactions while regularizing off-road behavior, and reconstructs physically feasible trajectories through vehicle dynamics. Experiments on nuScenes with tbsim closed-loop evaluation show that RiskFlow achieves a strong adversariality-realism trade-off across multi-agent and long-horizon settings. Compared with representative baselines, RiskFlow consistently improves realism while maintaining competitive safety-critical generation capability, and substantially reduces inference time for evaluation.
Introduction Autonomous driving systems should be evaluated not only in common traffic flows, but also in rare safety-critical situations such as collisions, forced cut-ins, emergency braking, and multi-vehicle merging. Collecting such events from real roads is costly and inefficient, since crashes and severe safety outcomes are sparse in natural driving logs and require enormous mileage to observe at scale (Kalra and Paddock 2016). Closed-loop safety-critical scenario generation has therefore become an important tool for stress-testing autonomous driving stacks under controllable and repeatable high-risk interactions (Ding et al. 2023). The key challenge is to balance adversariality and realism: generated scenarios should induce challenging interactions while respecting road topology, traffic semantics, vehicle dynamics, and multi-agent behavior. ∗
Corresponding author.
Otherwise, high collision rates may come from unrealistic jumps, excessive acceleration, or off-road artifacts, offering little value for real evaluation. Naturalistic traffic simulation improves closed-loop realism by learning interactive behavior models from large-scale datasets such as nuScenes (Caesar et al. 2020). Methods such as SimNet, TrafficSim, and BITS roll out data-driven multiagent behaviors that react to the evolving scene rather than replaying fixed trajectories (Bergamini et al. 2021; Suo et al. 2021; Xu et al. 2023). However, these simulators mainly reproduce ordinary traffic dynamics and long-horizon stability, rather than deliberately inducing adversarial events. Diffusion models have thus become popular for controllable scenario generation, with methods such as Scenario Diffusion (Pronovost et al. 2023), CTG (Zhong et al. 2023b), CTG++ (Zhong et al. 2023a), SAFE-SIM (Chang et al. 2024), and CCDiff (Lin et al. 2025) leveraging their multi-modal generative capacity and flexible test-time guidance to generate diverse traffic scenes under safety-critical objectives. Despite their effectiveness, diffusion-based methods have two key limitations. First, DDPM-style models require multistep noising and denoising (Ho, Jain, and Abbeel 2020), which must be repeated at every planning cycle in closedloop rollout. Sampling and guidance errors can therefore accumulate through vehicle dynamics, especially under strong collision guidance, leading to trajectory jitter, abnormal acceleration, shifted jerk distributions, or off-road behavior. Second, diffusion sampling is slow: even accelerated samplers such as DDIM (Song, Meng, and Ermon 2020) still require repeated model evaluations during closed-loop rollout across many scenes. Safety-critical generation therefore needs a mechanism that reduces both accumulated sampling error and inference cost. Motivated by this observation, we propose RiskFlow, a flow-based framework for closed-loop safety-critical traffic generation. Given the initial traffic state, map context, and multi-agent history, RiskFlow starts from random actions and generates future action sequences with a single MeanFlow forward pass in action space, then decodes them into trajectories using vehicle kinematics. To induce safety-critical events, RiskFlow applies test-time guidance directly to the output actions, steering key agents toward risky interactions while discouraging off-road behavior via map-aware regularization. By guiding final actions rather than repeatedly cor-
recting intermediate denoising states, RiskFlow can adjust key behaviors more directly and reduce trajectory distortion from accumulated sampling and guidance errors. Our main contributions are summarized as follows: • We propose RiskFlow, a closed-loop safety-critical traffic scenario generation framework. RiskFlow reformulates safety-critical trajectory generation as a one-step flow transport problem in the action space. The model directly learns an average velocity field over future acceleration and yaw-rate sequences, allowing random noise to be mapped into physically executable action sequences through a single forward pass. To improve training efficiency and stability, we further design a JVP-based objective that evaluates the velocity field at the diagonal boundary t=r and stops the boundary-velocity gradient. • We introduce test-time output-space guidance for singlepass generation. Instead of injecting guidance gradients along a multi-step denoising chain, RiskFlow directly refines the generated acceleration and yaw rate sequences using an adversarial interaction objective and a trajectorybased map regularization term, enabling safety-critical event generation while improving road feasibility. • Experiments on nuScenes closed-loop simulation show that RiskFlow achieves a strong adversariality-realism trade-off in both multi-agent and long-horizon generation, while substantially reducing inference cost compared with diffusion-based baselines.
Related Work Traffic behavior modeling and closed-loop simulation. Realistic traffic behavior modeling underpins closed-loop autonomous-driving evaluation, where generated agents must react to evolving scenes rather than replay logged trajectories. Learning-based simulators address this from complementary angles: SimNet models reactive responses to ego actions, TrafficSim learns socially consistent joint multi-agent policies, and BITS improves rollout stability and diversity via hierarchical intent and behavior modeling (Bergamini et al. 2021; Suo et al. 2021; Xu et al. 2023). In parallel, trajectory prediction models such as Scene Transformer (Ngiam et al. 2021), QCNet (Zhou et al. 2023), and Wayformer (Nayakanti et al. 2023) provide strong encoders for agent histories, map context, and interactions. Causal forecasting improves robustness under distribution shift (Liu et al. 2022), while counterfactual and intervention-based prediction reduce spurious social or environmental correlations (Chen et al. 2021; Ge, Song, and Huang 2023). However, these works mainly serve as realism priors, interaction encoders, or open-loop predictors, and do not directly offer an efficient mechanism for controllable closed-loop safety-critical generation that induces risky interactions while preserving road feasibility and physical realism. Diffusion-based controllable scenario generation. Score-based and DDPM diffusion models (Song and Ermon 2019; Ho, Jain, and Abbeel 2020) provide an iterative denoising framework whose sampling process can be steered by conditional guidance (Ho and Salimans 2022).
In traffic domains, this flexibility has been used at different levels: Scenario Diffusion (Pronovost et al. 2023) generates controllable map-conditioned scenes, MotionDiffuser (Jiang et al. 2023) guides multi-agent motion prediction with differentiable constraints, and SceneDiffuser (Jiang et al. 2024) supports simulation initialization and rollout. Safety-critical methods further use guidance to shape risky interactions: CTG (Zhong et al. 2023b) encodes rule-based objectives, CTG++ (Zhong et al. 2023a) conditions generation on language instructions, SAFE-SIM (Chang et al. 2024) and AdvDiffuser (Xie et al. 2024) guide adversarial agents, and CCDiff (Lin et al. 2025) composes causal interaction structures for closed-loop generation. Despite these advances, adversariality still depends on iterative denoising and repeated guidance across sampling steps or planning cycles, increasing inference cost and potentially amplifying guidance errors over long rollouts.
Method In this section, We propose RiskFlow, a flow-based framework for closed-loop safety-critical traffic generation. As shown in Figure 1, RiskFlow generates future action sequences from agent histories, rasterized maps, and safetyaware interaction relations, and reconstructs physically feasible trajectories through vehicle dynamics.
Problem Formulation Consider a traffic scene with N vehicle agents. For each agent i, given its historical states, surrounding agents, and scene context, the goal is to generate a future action sequence over L time steps: a1:L = {(αit , ωit )}L (1) i t=1 , where αit denotes longitudinal acceleration and ωit denotes yaw rate. The generated actions are integrated by a vehicle dynamics model to obtain future states: sti = (xti , yit , vit , ψit ),
(2)
where (xti , yit ) is the position, vit is the speed, and ψit is the heading angle. Rather than directly generating future positions, RiskFlow generates control actions and reconstructs trajectories through a vehicle dynamics rollout. This action-space formulation provides a natural interface for closed-loop execution and encourages kinematic consistency in the generated trajectories.
Safety-Aware Scene Context Encoding To model safety-critical multi-agent interactions, we construct pairwise interaction features for each ordered agent pair (i, j). Agent j is represented in the local coordinate frame of agent i. Let pti , ptj ∈ R2 denote the 2D positions of agents i and j at time t, and let ψit , ψjt denote their heading angles. The relative position is computed as ∆ptij = (Rit )⊤ (ptj − pti ), where Rit is the rotation matrix determined by ψit .
(3)
Gaussian Noise ϵ Agent History
History Encoder
Rasterized Map
Map Encoder
Causal Relations
Scene Context Feature s
Safety-Critical Scenarios
Ground-Truth Trajectory 𝑎∗
𝒛𝒕 = 𝟏 − 𝒕 𝜺 + 𝒕𝒂∗
JVP Correction 𝑉𝜃 = 𝑢𝜃 + 𝑡 − 𝑟
SceneTransformer
Relation Encoder
ⅆ𝑢𝜃 ⅆ𝑡
Dynamic Model
Temporal Attention
Safety-aware Interaction Metrics
Current Time r
Relative Distance Relative Velocity Time to Collision
Reference Time t
𝑢𝜃 𝑧𝑡 , 𝑡, 𝑟 Map Attention
Reconstructed Actions
𝜀 + 𝑉𝜃
Causal Mask Top-K Ranking
Social Attention 1
2
3
…K
Figure 1: Overview of RiskFlow. RiskFlow encodes agent histories, rasterized map context, and safety-aware interaction relations, then generates future actions with MeanFlow. At test time, TTC-based causal ranking selects the top-K critical agents for localized guidance. We represent the pairwise interaction feature as t t t etij = [∆xtij , ∆yij , cos ∆ψij , sin ∆ψij , t t t ∆vx,ij , ∆vy,ij , d˜tij , rij ],
(4)
where d˜tij is a size-aware normalized distance feature and t rij is a normalized TTC-based risk weight. The TTC risk is estimated from relative position, relative velocity, and vehicle extents. We compute directional collision times along the longitudinal and lateral axes and define TTCtij = max(τxt , τyt ).
(5)
The TTC value is clipped and normalized into a risk weight: τmax − clip(TTCtij , 0, τmax ) . (6) τmax t A larger rij indicates a higher short-term collision risk under the current relative motion. We use a SceneTransformer backbone to encode the multiagent scene context (Ngiam et al. 2021). The encoder takes agent histories, pairwise interaction features, and rasterized map context as inputs. Temporal attention captures the motion pattern of each agent over time, while social attention models interactions among agents. To inject safety-aware interaction information, we use the pairwise feature etij as an edge-conditioned bias in social attention. For agent i, the edge-aware social attention can be written as ⊤ N X qi kj + b(eij ) vj , (7) Attni = softmaxj √ d j=1 t rij =
where b(eij ) denotes an edge-conditioned interaction bias. This allows the encoder to condition multi-agent reasoning on relative distance, relative velocity, and TTC-based collision risk. Rasterized maps provide static road context for road-aware generation. For each agent-centric scene, a CNN map encoder extracts a local map feature mi = fmap (Ii ),
(8)
where Ii is the rasterized map centered at agent i. The map feature is fused with the agent history representation and safety-aware interaction features to form the conditional scene context: Ci = fctx hi , mi , {eij }N (9) j=1 . RiskFlow then conditions the action-space velocity field on this scene context.
MeanFlow Generation Instead of performing iterative reverse diffusion, RiskFlow adopts a MeanFlow formulation in the future action space (Geng et al. 2026). Let a∗ denote the ground-truth future action sequence and let ϵ ∼ N (0, I) be Gaussian noise with the same shape as the action sequence. During training, we construct a continuous interpolation between noise and data: zt = (1 − t)ϵ + ta∗ , t ∈ [0, 1]. (10) The model learns a context-conditioned MeanFlow vector field uθ (zt , t, r; C), where r ∈ [0, 1] is a reference time. We apply the JVP-based correction to improve one-step reconstruction: Vθ (zt , t, r; C) = uθ (zt , t, r; C) + (t − r)sg(u̇θ ),
(11)
where u̇θ is the stop-gradient Jacobian-vector product of the vector field along the flow direction (Geng et al. 2025). The reconstructed action sequence is obtained as â = ϵ + Vθ (zt , t, r; C).
(12)
We then convert the predicted action sequence into a physical trajectory through a unicycle dynamics model: τ̂ = Fdyn (â, s0 ),
(13)
where s0 = {s0i }N i=1 denotes the initial states of all agents at the beginning of the rollout. The dynamics model Fdyn recursively updates speed, heading, and position from the generated acceleration and yaw-rate commands.
The MeanFlow training objective is defined in the reconstructed trajectory space: h i 2 LMF = Ea∗ ,ϵ,t,r ∥Fdyn (â, s0 ) − τ ∗ ∥2 , (14) where τ ∗ is the ground-truth future trajectory. This objective trains the model to generate future actions that reconstruct dynamically consistent closed-loop trajectories.
Causal Ranking for Critical Agent Selection Safety-critical events are often triggered by a small subset of interacting agents. To focus intervention on the most relevant vehicles, we use a TTC-based causal ranking strategy to select critical controllable agents. We first build a TTC-based interaction graph from the safety-aware pairwise risk weights. Edges with risk weights above a threshold are treated as high-risk interactions. We then identify strongly interacting agent groups and assign each agent an importance score according to the accumulated risk of the groups it participates in. The controllable agent set is selected as Ac = TopK({ρi }N i=1 ),
(15)
where ρi denotes the TTC-based causal importance score of agent i. This ranking allows test-time guidance to concentrate on agents that are more likely to participate in high-risk interactions.
Output-Space Test-Time Guidance At inference time, RiskFlow first predicts a base action residual from one MeanFlow forward pass, ubase = uθ (ϵ, 0, 1; C), and obtains the corresponding base action as abase = ϵ + ubase . To generate challenging safety-critical interactions, we optimize the MeanFlow output residual directly at test time, initializing the optimization with the base (0) residual uopt = ubase . At guidance step k, the action and trajectory are obtained by (k)
a(k) = ϵ + uopt ,
τ (k) = Fdyn (a(k) , s0 ).
(16)
For the selected controllable agent set Ac , we define an adversarial interaction objective: Ladv =
Tg XX i∈Ac t=1
min ∥pti − ptj ∥2 .
j ∈A / c
(17)
Minimizing this objective encourages controllable agents to approach nearby non-controlled agents, thereby producing more challenging high-risk interactions. Optimizing only the adversarial interaction objective may generate collisions through unrealistic lateral shifts or offroad motion. To preserve road feasibility, we introduce a footprint-based map guidance term: Lmap =
Tg XX
ωt Φmap (ŝti ),
(18)
i∈Ac t=1
where Φmap penalizes vehicle footprint samples that leave the drivable region, and ωt is a temporal decay weight. This
term discourages off-road artifacts while allowing the adversarial objective to induce high-risk interactions. The final guidance objective is Lguide = λadv Ladv + λmap Lmap ,
(19)
where λadv and λmap control the strength of adversarial interaction guidance and map-feasibility guidance. To keep the intervention localized, we mask the gradient of the MeanFlow residual so that only agents in Ac are updated: (k+1)
uopt
(k)
= uopt − γMAc ⊙ ∇uopt Lguide . (K )
afinal = ϵ + uoptg .
(20) (21)
where MAc is a binary mask for controllable agents, γ is the guidance step size, and Kg is the number of guidance steps.
Experiments We evaluate RiskFlow on closed-loop safety-critical traffic scenario generation, focusing on two objectives: adversarial interactions and maintaining realistic, road-feasible trajectories.
Experimental Setup Dataset and simulation. We evaluate RiskFlow on nuScenes using tbsim as the closed-loop simulation platform(Caesar et al. 2020; Xu et al. 2023). Models are trained on the nuScenes training split and evaluated on 100 validation scenes with diverse road topologies and interaction patterns. Baselines. We compare our method with representative closed-loop traffic generation methods, including STRIVE, BITS, CTG, CTG++, and CCDiff(Rempe et al. 2022; Xu et al. 2023; Zhong et al. 2023b,a; Lin et al. 2025). All methods use the same initial scenes and safety-critical guidance objectives to ensure fair comparison.
Implementation Details We use a scene-centric multi-agent generator with a SceneTransformer interaction backbone and a ResNet-18 rasterized map encoder. Each scene is simulated at 10 Hz: the model observes 31 historical steps and predicts 52 future steps, which are decoded into trajectories through a dynamics model. RiskFlow is trained in the future action space by interpolating between Gaussian source actions and groundtruth action sequences, and learning the average velocity field that transports the source actions to the targets over sampled time pairs (t, r). The time pair (t, r) is sampled from a logitnormal distribution, with r = t sampled with probability 0.2, and the JVP stop-gradient correction is clipped to 0.03 with coefficient t−r. We train all models from scratch for 100,000 optimization steps on a single NVIDIA RTX 4090 GPU, using Adam with learning rate 1×10−4 , batch size 4, and EMA decay 0.995. The adversarial guidance weight is −50.0, the map guidance weight is 1.0, the guidance optimization uses 30 gradient steps, and the controllable-agent setting is varied over K ∈ {2, 3, 4, 5, 10, Full}.The main hyper-parameters used in our experiments are summarized in Table 1.
Table 1: Hyper-parameters of RiskFlow used in experiments. Parameter Name Step length History steps Generation steps Planning steps Adversarial guidance weight Guidance grad steps Ratio of r ̸= t (t, r) sampler Distance threshold
Value 0.1 s 31 52 5, 10, 20, 30, 40, 50 -50.0 30 0.8 Logit-normal 50 m
Evaluation Metrics In this part,we report five raw metrics. Scenario Collision Rate (SCR) is the fraction of 10-second closed-loop rollouts containing at least one agent-agent collision. Scenario Off-Road Rate (ORR) measures how often generated vehicles leave the drivable region. Average Displacement Error (ADE) and Final Displacement Error (FDE) measure the average and final position errors relative to reference trajectories. Kinematic Distribution Distance (KDD) evaluates the discrepancy between generated and real-driving distributions of longitudinal acceleration, lateral acceleration, and jerk. Higher SCR is better, while lower ORR, ADE, FDE, and KDD values are better. To summarize controllability and realism, we further report Controllability Score (CS) and Realism Score (RS) (Lin et al. 2025). Let M denote the set of evaluated methods. CS is the min-max normalized SCR: SCRi − minj∈M SCRj CSi = . (22) maxj∈M SCRj − minj∈M SCRj For each realism-related error metric m ∈ {ORR, ADE, FDE, KDD}, let m̄i denote its minmax normalized value across methods. RS is defined as 1 RSi = 1 − ORRi + ADEi + FDEi + KDDi . (23) 4 Higher CS and RS values indicate stronger controllability and better realism, respectively.
Multi-agent Scenario Generation We evaluate multi-agent scenario generation by varying the number of controllable agents from K = 2 to full-scene control. The left part of Table 2 reports CS and RS for multiagent scenario generation. As the number of controllable agents increases, preserving realistic behavior becomes increasingly challenging because stronger interventions can introduce off-road motion, larger trajectory deviations, and abnormal kinematic patterns. STRIVE achieves the highest CS across all settings, reaching 1.00 at K = 10. However, its RS decreases substantially from 0.62 at K = 2 to 0.13 under full control, suggesting that its high collision-generation capability comes at the cost of degraded realism. Other baselines exhibit a similar tradeoff. For example, CCDiff achieves competitive CS values at
Parameter Name Learning rate Optimizer Batch size Controllable agents Map guidance weight JVP clamp JVP correction coefficient TTC clipping threshold Map encoder
Value 1 × 10−4 Adam 4 2, 3, 4, 5, 10, Full 1.0 0.03 t−r 20 s ResNet-18
K = 5, K = 10, and full control, but its RS decreases from 0.76 to 0.39 as the number of controlled agents increases. In contrast, RiskFlow consistently achieves the best RS across all control settings, with values of 0.92, 0.85, 0.79, 0.75, 0.59, and 0.59 from K = 2 to full control. Notably, RiskFlow maintains an RS of 0.59 under full control, outperforming the second-best result of 0.52. While RiskFlow does not always maximize CS, it retains competitive controllability while substantially improving road feasibility, spatial accuracy, and kinematic realism. These results demonstrate a more favorable balance between adversariality and realism in complex multi-agent scenarios.
Long-horizon Closed-loop Generation We further evaluate closed-loop generation across rollout horizons from T = 1 s to T = 5 s. The right part of Table 2 reports CS and RS for long-horizion closed-loop generation. Longer rollout horizons are more challenging because prediction and guidance errors can accumulate through repeated closed-loop execution, resulting in trajectory drift, off-road motion, and abnormal kinematic behavior. RiskFlow achieves the highest RS at T = 1 s and matches the best result at T = 2 s and T = 3 s, with scores of 0.74, 0.71, and 0.57, respectively. At longer horizons, RiskFlow remains competitive, obtaining the second-best RS values of 0.49 and 0.54 at T = 4 s and T = 5 s. In comparison, STRIVE exhibits a substantial realism degradation as the horizon increases, with its RS decreasing from 0.48 to 0.32. RiskFlow also maintains competitive controllability across different horizons. It achieves the best CS at T = 2 s and matches the best score of 0.83 at T = 5 s. Although CCDiff obtains a higher CS at T = 3 s and T = 4 s, RiskFlow consistently preserves stronger realism under adversarial interventions. Overall, these results show that RiskFlow achieves a favorable balance between safety-critical event generation and behavioral realism over long closed-loop rollouts.
Qualitative Comparison Fig. 2 presents a qualitative comparison on Scene 0556 with K = 5 controllable agents and a planning interval of T = 0.5 s. This scene contains a challenging multi-agent interaction in which the generated vehicles must induce a safety-critical event while remaining consistent with the road geometry and
Table 2: Comparison of Controllability Score (CS) and Realism Score (RS). Left: Multi-agent Scenario Generation. Right: Long-horizon Closed-loop Generation. Blue indicates the best result, and black indicates the second-best result.
Multi-agent Scenario Generation
Long-horizon Closed-loop Generation
Method Metric K = 2 K = 3 K = 4 K = 5 K = 10 Full
Method Metric T = 1s T = 2s T = 3s T = 4s T = 5s
STRIVE
CS RS
0.70 0.62
0.70 0.49
0.87 0.39
0.87 0.33
1.00 0.17
0.91 0.13
STRIVE
CS RS
0.70 0.48
0.35 0.49
0.35 0.34
0.26 0.25
0.22 0.32
BITS
CS RS
0.22 0.77
0.22 0.69
0.17 0.66
0.26 0.59
0.17 0.55
0.35 0.47
BITS
CS RS
0.17 0.61
0.04 0.59
0.48 0.50
0.26 0.48
0.35 0.48
CTG
CS RS
0.43 0.78
0.39 0.73
0.57 0.68
0.39 0.65
0.48 0.51
0.57 0.48
CTG
CS RS
0.35 0.63
0.48 0.60
0.70 0.40
0.83 0.31
0.70 0.49
CTG++
CS RS
0.39 0.82
0.57 0.75
0.48 0.67
0.48 0.64
0.35 0.53
0.22 0.52
CTG++
CS RS
0.43 0.71
0.43 0.71
0.65 0.57
0.48 0.52
0.70 0.64
CCDiff
CS RS
0.30 0.76
0.48 0.65
0.43 0.61
0.57 0.56
0.70 0.42
0.78 0.39
CCDiff
CS RS
0.30 0.63
0.48 0.66
0.70 0.52
0.96 0.47
0.83 0.53
Ours
CS RS
0.26 0.92
0.30 0.85
0.43 0.79
0.57 0.75
0.35 0.59
0.35 0.59
Ours
CS RS
0.57 0.74
0.57 0.71
0.57 0.57
0.74 0.49
0.83 0.54
vehicle dynamics. CCDiff fails to produce the intended collision. Moreover, its guided trajectory deviates from the drivable region, suggesting that iterative guidance can introduce unrealistic motion artifacts during closed-loop execution.
Table 3: Inference speed comparison under K = 5 and T = 0.5s on 100 scenes using a single NVIDIA RTX 4090 GPU. Blue indicates the best result, and black indicates the secondbest result.
In contrast, RiskFlow successfully induces a collision through a road-aligned interaction. The generated vehicles approach the conflict region with smoother and more physically plausible trajectories. This example illustrates that RiskFlow can generate meaningful safety-critical events while better preserving road feasibility and behavioral realism under closed-loop guidance.
Method Total Time Avg. Time per Scene Runtime Ratio CTG++ CCDiff CTG Ours
30.27 h 6.25 h 2.77 h 1.35 h
18.16 min 3.75 min 1.66 min 48.6 s
22.42× 4.63× 2.05× 1.00×
Ablation Study Inference Speed Table 3 compares the inference efficiency of different safetycritical generation methods under the same setting, using K = 5 controllable agents, a planning interval of T = 0.5 s, and a single NVIDIA RTX 4090 GPU. RiskFlow completes the closed-loop evaluation of 100 scenes in only 1.35 hours, corresponding to an average runtime of 48.6 seconds per scene. In comparison, CTG++, CCDiff, and CTG require 30.27, 6.25, and 2.77 hours, respectively. RiskFlow therefore achieves 22.42×, 4.63×, and 2.05× speedups over CTG++, CCDiff, and CTG. The substantial efficiency improvement mainly comes from replacing repeated denoising steps with a single forward pass for action sequence generation. This advantage is particularly important for closed-loop evaluation, where trajectory generation must be repeatedly performed at each planning cycle across a large number of scenes.
Table 4 studies the effects of MeanFlow generation, adversarial guidance Ladv , and map guidance Lmap . Ablation on MeanFlow. MeanFlow mainly improves realism across different numbers of controllable agents. Without test-time guidance, replacing the baseline generator with MeanFlow increases RS from 0.69-0.31 to 0.90-0.57 as K varies from 2 to 10. Meanwhile, CS remains competitive, reaching the best scores at K = 3, K = 4, and K = 5. This indicates that single-pass action-space generation better preserves trajectory quality while maintaining safety-critical generation capability. Ablation on map guidance. Map guidance improves road feasibility and behavioral realism. Without MeanFlow, adding Lmap increases RS from 0.69-0.31 to 0.73-0.38. With MeanFlow, adding Lmap further improves RS from 0.90-0.57 to 0.93-0.61, achieving the best RS across all values of K. This shows that map guidance effectively regularizes generated trajectories toward road-feasible behavior. Ablation on adversarial guidance. Adversarial guid-
CCDiff
RiskFlow
Figure 2: Qualitative comparison on Scene 0556 with K = 5 and T = 0.5 s. CCDiff fails to generate a valid collision, while RiskFlow successfully induces a road-consistent collision. Table 4: Ablation study on MeanFlow, adversarial guidance, and map guidance. Blue indicates the best result, and black indicates the second-best result. MeanFlow Ladv Lmap Metric K = 2 K = 3 K = 4 K = 5 K = 10 CS RS
0.57 0.69
0.70 0.61
0.65 0.51
0.65 0.47
0.65 0.31
CS RS
0.00 0.68
0.13 0.60
0.13 0.51
0.00 0.45
0.09 0.31
✓
CS RS
0.30 0.73
0.48 0.62
0.30 0.58
0.39 0.52
0.48 0.38
✓
CS RS
0.30 0.76
0.48 0.65
0.43 0.61
0.57 0.56
0.70 0.42
CS RS
0.48 0.90
0.74 0.84
0.78 0.77
0.70 0.72
0.61 0.57
CS RS
0.30 0.90
0.35 0.83
0.52 0.77
0.52 0.72
0.35 0.57
✓
CS RS
0.22 0.93
0.26 0.86
0.39 0.80
0.48 0.76
0.30 0.61
✓
CS RS
0.26 0.92
0.30 0.85
0.43 0.79
0.57 0.75
0.35 0.59
✓
✓ ✓ ✓
✓
✓ ✓
✓
ance is designed to improve controllability by encouraging collision-prone interactions, but it introduces a realismcontrollability trade-off. When applied alone, Ladv does not consistently improve CS, suggesting that adversarial interaction objectives can be unstable without map regularization. However, when combined with Lmap , adding Ladv increases CS from 0.22-0.30 to 0.26-0.35 under MeanFlow generation, while RS only slightly decreases from 0.93-0.61 to 0.92-0.59. The full model therefore preserves high realism while improving the generation of safety-critical interactions under map constraints.
Conclusion We introduce RiskFlow, a closed-loop framework for safetycritical traffic scenario generation. Instead of relying on iterative denoising, RiskFlow learns to transport Gaussian action sequences to future acceleration and yaw-rate sequences with a single MeanFlow forward pass, and applies test-time guidance directly to the generated action residuals. Together with TTC-based critical-agent selection, vehicle-dynamics rollout, and map-aware regularization, this design enables localized adversarial interventions while preserving road feasibility and physical plausibility. Experiments on nuScenes closed-loop simulation demonstrate that RiskFlow achieves a favorable adversariality-realism trade-off across both multiagent and long-horizon settings: it maintains competitive safety-critical generation capability while consistently improving realism under stronger control. RiskFlow also substantially improves inference efficiency, reducing the cost of large-scale closed-loop evaluation by replacing repeated denoising with single-pass action generation. Ablation studies further show that action-space flow generation improves trajectory realism, while map guidance stabilizes adversarial interventions under road constraints. Overall, RiskFlow provides an efficient and physically grounded alternative for generating realistic safety-critical traffic scenarios in closedloop autonomous-driving evaluation.
References Bergamini, L.; Ye, Y.; Scheel, O.; Chen, L.; Hu, C.; Del Pero, L.; Osiński, B.; Grimmett, H.; and Ondruska, P. 2021. Simnet: Learning reactive self-driving simulations from realworld observations. In 2021 IEEE International Conference on Robotics and Automation (ICRA), 5119–5125. IEEE. Caesar, H.; Bankiti, V.; Lang, A. H.; Vora, S.; Liong, V. E.;
Xu, Q.; Krishnan, A.; Pan, Y.; Baldan, G.; and Beijbom, O. 2020. nuscenes: A multimodal dataset for autonomous driving. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 11621–11631. Chang, W.-J.; Pittaluga, F.; Tomizuka, M.; Zhan, W.; and Chandraker, M. 2024. Safe-sim: Safety-critical closed-loop traffic simulation with diffusion-controllable adversaries. In European conference on computer vision, 242–258. Springer. Chen, G.; Li, J.; Lu, J.; and Zhou, J. 2021. Human trajectory prediction via counterfactual analysis. In Proceedings of the IEEE/CVF international conference on computer vision, 9824–9833. Ding, W.; Xu, C.; Arief, M.; Lin, H.; Li, B.; and Zhao, D. 2023. A survey on safety-critical driving scenario generation—a methodological perspective. IEEE Transactions on Intelligent Transportation Systems, 24(7): 6971–6988. Ge, C.; Song, S.; and Huang, G. 2023. Causal intervention for human trajectory prediction with cross attention mechanism. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 37, 658–666. Geng, Z.; Deng, M.; Bai, X.; Kolter, Z.; and He, K. 2026. Mean flows for one-step generative modeling. Advances in Neural Information Processing Systems, 38: 75460–75482. Geng, Z.; Lu, Y.; Wu, Z.; Shechtman, E.; Kolter, J. Z.; and He, K. 2025. Improved mean flows: On the challenges of fastforward generative models. arXiv preprint arXiv:2512.02012. Ho, J.; Jain, A.; and Abbeel, P. 2020. Denoising diffusion probabilistic models. Advances in neural information processing systems, 33: 6840–6851. Ho, J.; and Salimans, T. 2022. Classifier-free diffusion guidance. arXiv preprint arXiv:2207.12598. Jiang, C.; Cornman, A.; Park, C.; Sapp, B.; Zhou, Y.; Anguelov, D.; et al. 2023. Motiondiffuser: Controllable multi-agent motion prediction using diffusion. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 9644–9653. Jiang, C. M.; Bai, Y.; Cornman, A.; Davis, C.; Huang, X.; Jeon, H.; Kulshrestha, S.; Lambert, J.; Li, S.; Zhou, X.; et al. 2024. Scenediffuser: Efficient and controllable driving simulation initialization and rollout. Advances in Neural Information Processing Systems, 37: 55729–55760. Kalra, N.; and Paddock, S. M. 2016. Driving to safety: How many miles of driving would it take to demonstrate autonomous vehicle reliability? Transportation research part A: policy and practice, 94: 182–193. Lin, H.; Huang, X.; Phan, T.; Hayden, D.; Zhang, H.; Zhao, D.; Srinivasa, S.; Wolff, E.; and Chen, H. 2025. Causal composition diffusion model for closed-loop traffic generation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 27542–27552. Liu, Y.; Cadei, R.; Schweizer, J.; Bahmani, S.; and Alahi, A. 2022. Towards robust and adaptive motion forecasting: A causal representation perspective. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 17081–17092.
Nayakanti, N.; Al-Rfou, R.; Zhou, A.; Goel, K.; Refaat, K. S.; and Sapp, B. 2023. Wayformer: Motion Forecasting via Simple & Efficient Attention Networks. In 2023 IEEE International Conference on Robotics and Automation (ICRA), 2980–2987. IEEE. Ngiam, J.; Caine, B.; Vasudevan, V.; Zhang, Z.; Chiang, H.T. L.; Ling, J.; Roelofs, R.; Bewley, A.; Liu, C.; Venugopal, A.; et al. 2021. Scene transformer: A unified architecture for predicting multiple agent trajectories. arXiv preprint arXiv:2106.08417. Pronovost, E.; Ganesina, M. R.; Hendy, N.; Wang, Z.; Morales, A.; Wang, K.; and Roy, N. 2023. Scenario diffusion: Controllable driving scenario generation with diffusion. Advances in Neural Information Processing Systems, 36: 68873–68894. Rempe, D.; Philion, J.; Guibas, L. J.; Fidler, S.; and Litany, O. 2022. Generating useful accident-prone driving scenarios via a learned traffic prior. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 17305– 17315. Song, J.; Meng, C.; and Ermon, S. 2020. Denoising diffusion implicit models. arXiv preprint arXiv:2010.02502. Song, Y.; and Ermon, S. 2019. Generative modeling by estimating gradients of the data distribution. Advances in neural information processing systems, 32. Suo, S.; Regalado, S.; Casas, S.; and Urtasun, R. 2021. Trafficsim: Learning to simulate realistic multi-agent behaviors. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 10400–10409. Xie, Y.; Guo, X.; Wang, C.; Liu, K.; and Chen, L. 2024. Advdiffuser: Generating adversarial safety-critical driving scenarios via guided diffusion. In 2024 IEEE/RSJ International Conference on Intelligent Robots and Systems (IROS), 9983–9989. IEEE. Xu, D.; Chen, Y.; Ivanovic, B.; and Pavone, M. 2023. BITS: Bi-level Imitation for Traffic Simulation. In 2023 IEEE International Conference on Robotics and Automation (ICRA), 2929–2936. IEEE. Zhong, Z.; Rempe, D.; Chen, Y.; Ivanovic, B.; Cao, Y.; Xu, D.; Pavone, M.; and Ray, B. 2023a. Language-guided traffic simulation via scene-level diffusion. In Conference on robot learning, 144–177. PMLR. Zhong, Z.; Rempe, D.; Xu, D.; Chen, Y.; Veer, S.; Che, T.; Ray, B.; and Pavone, M. 2023b. Guided conditional diffusion for controllable traffic simulation. In 2023 IEEE international conference on robotics and automation (ICRA), 3560–3566. IEEE. Zhou, Z.; Wang, J.; Li, Y.-H.; and Huang, Y.-K. 2023. Query-centric trajectory prediction. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 17863–17873.