Paper deep dive
Herding End-to-End Autonomous Driving via Neuro-Symbolic Safety Guards
Simón Patiño Idarraga, Erick Silva, Rehana Yasmin, Ali Shoker
Intelligence
Status: not_run | Model: - | Prompt: - | Confidence: 0%
Entities (0)
Relation Signals (0)
No relation signals yet.
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Modern end-to-end driving agents can achieve high average performance yet still violate basic traffic rules that a human driver would never miss. The reason is structural: they learn statistical patterns rather than the physical conditions that guarantee safe driving, leaving their decision-making process opaque and safety constraints unenforced. We introduce a neuro-symbolic safety guard, a lightweight module that attaches to the final command interface of an already-trained agent. Immediately before a command reaches the vehicle, it checks the command against explicit safety rules and, only when necessary, replaces it with the nearest safe alternative. Each intervention is directly executable and traceable to the rule that triggered it, while the guard itself requires no retraining and adds no learned component. Evaluated on the long-tail benchmarks Fail2Drive and Bench2Drive using the state-of-the-art TransFuser v6 (TFv6) as a case study, the guard improves Success Rate by 15% and reduces safety-critical collisions by up to 53%, while preserving the original Driving Score.
Tags
Links
- Source: https://arxiv.org/abs/2608.11451v1
- Canonical: https://arxiv.org/abs/2608.11451v1
Trouble viewing inline? Open PDF directly →
Full Text
44,791 characters extracted from source content.
Expand or collapse full text
Herding End-to-End Autonomous Driving via Neuro-Symbolic Safety Guards Simón Patiño Idarraga Erick Silva Rehana Yasmin Ali Shoker Abstract Modern end-to-end driving agents can achieve high average performance yet still violate basic traffic rules that a human driver would never miss. The reason is structural: they learn statistical patterns rather than the physical conditions that guarantee safe driving, leaving their decision-making process opaque and safety constraints unenforced. We introduce a neuro-symbolic safety guard, a lightweight module that attaches to the final command interface of an already-trained agent. Immediately before a command reaches the vehicle, it checks the command against explicit safety rules and, only when necessary, replaces it with the nearest safe alternative. Each intervention is directly executable and traceable to the rule that triggered it, while the guard itself requires no retraining and adds no learned component. Evaluated on the long-tail benchmarks Fail2Drive and Bench2Drive using the state-of-the-art TransFuser v6 (TFv6) as a case study, the guard improves Success Rate by %15\% and reduces safety-critical collisions by up to %53\%, while preserving the original Driving Score. 1 Introduction A modern driving agent can earn a strong benchmark score and still run a red light, brake too late behind a lead vehicle, or enter a pedestrian crossing unsafely. For autonomous driving, these rare failures matter more than average competence: they are the sparse but high-consequence events that decide whether a system is trusted at deployment, and each one erodes public confidence, intensifies regulatory scrutiny, and slows adoption (Zhang et al. 2024; Koopman 2024; Wang et al. 2025b). The cost is not hypothetical: the 2023 Cruise robotaxi pedestrian-dragging incident shows how a single mishandled interaction can stall an entire deployment program. Even the strongest learned agents remain brittle exactly here. The core problem we address is that these agents fail on situations a human would find obvious. Studies of end-to-end driving models show that they often rely on statistical patterns in their training data rather than the basic traffic facts that actually govern safety, hence, competence on familiar routes does not carry over to rare ones (Jaeger, Chitta, and Geiger 2023; Gerstenecker, Geiger, and Renz 2026a). Crucially, the safety requirement violated in these cases is not hidden or subtle: it can be stated as a simple physical condition on how the vehicle may move. What is missing is therefore not just a better learned model, but a way to enforce such conditions on the commands the car finally executes. Figure 1: How the safety guard works, in three steps (left to right). Perception: the scene is read and a risky situation is identified. Symbolic Rule Calculation: the relevant traffic-safety rules are activated. Command Correction: the guard adjusts the driving command. In each right-hand plot the two axes are the actual controls sent to the car, the longitudinal command u (throttle/brake) and the steering command s; the shaded region is the set of commands the active rules allow (green, C). The driving agent’s original command (blue, Unsafe) falls outside this safe region, therefore the guard moves it to the nearest allowed command (red, Corrected). We address this gap with a neuro-symbolic safety guard: a module that is attaches to the final command interface of a trained driving agent (Figure 1). The learned agent proposes its driving command, but before that command reaches the vehicle the guard checks it against a set of explicit traffic-safety rules and, only when the proposal is unsafe, replaces it with the closest safe alternative. Because nothing is retrained and no learned component is added, the same guard attaches to any end-to-end model that exposes its scene signals, leaving the agent itself entirely intact. We instantiate it on a state-of-the-art agent as a case study, but the guard itself is architecture-independent. Moreover, the traffic-safety rules are not ad hoc: each is derived in closed form from an established safety or vehicle-dynamics model and reduces to a single bound on throttle, brake, or steering, with the derivations given in Section 3. Because every correction is triggered by an explicit rule, one can always identify why the guard intervened, making it deterministic, modular, and auditable. We present three major contributions in this paper: 1. A neuro-symbolic safety guard for end-to-end driving. We attach the guard to the command interface of a frozen neural agent, where it operates in three stages: it reads the scene signals the network already exposes, reasons over them with explicit rules, and restricts the command to the safe set they define. Both systems then contribute at execution time, the network supplying learned flexibility and the rules the guarantees it cannot state. Unlike safe-RL shielding, which constrains actions during training, or rule-based planners, which replace the controller outright, the guard leaves the policy intact. 2. A set of grounded traffic-safety rules. We derive five rules in closed form from established models, responsibility-sensitive safety for longitudinal margins and the kinematic bicycle model for cornering, each reduced to one bound on throttle, brake, or steering. Every correction is therefore verifiable against a physical criterion rather than a tuned heuristic. 3. Measured robustness and safety gains. We compare the same frozen agent with and without the guard on the Fail2Drive long tail. Task success rises by 15%, safety-critical collisions fall by up to 53%, and the competence lost on unfamiliar scenes is nearly halved, at an unchanged Driving Score and without retraining. The remainder of the paper positions the guard against related work (Section 2), derives the traffic-safety rules and the guard that enforces them (Section 3), and reports the evaluation (Section 4). 2 Related Work End-to-end driving and closed-loop benchmarks. End-to-end driving has progressed from conditional imitation learning (Codevilla et al. 2018) through trajectory-guided methods (Wu et al. 2022; Wang et al. 2025a) to multi-modal transformer stacks (Zhang et al. 2022; Shao et al. 2022; Prakash, Chitta, and Geiger 2021; Nguyen et al. 2026). Evaluation has shifted in parallel from aggregate route scores to targeted safety and generalization analysis (Jia et al. 2024; Xu et al. 2022; Jaeger, Chitta, and Geiger 2023; Gerstenecker, Geiger, and Renz 2026a). The unresolved challenge is that benchmark gains do not readily translate to reliable behavior in rare, high-consequence failures. Constrained action correction. Safe-reinforcement-learning methods project actions onto feasible sets during training (Alshiekh et al. 2018; Dalal et al. 2018; Pham, De Magistris, and Tachibana 2018), and convex-optimization layers provide the theoretical substrate (Amos and Kolter 2017; Agrawal et al. 2019). Rule-based driving planners such as PDM-Lite replace the learned controller entirely (Beißwenger 2024). Our guard differs on both counts: it corrects only the final action of a fully trained policy, leaving the perception-and-planning backbone frozen. Neuro-symbolic methods. Neuro-symbolic approaches couple neural perception with symbolic reasoning (Sarker et al. 2021; Bhuyan et al. 2024). The taxonomy of Kautz 2022, reproduced in both surveys, distinguishes patterns by where the two components meet: the Neuro→ pattern is a cascade from a neural system into a symbolic reasoner, in which a neural module first produces a proposal and a downstream symbolic module then constrains or interprets it. Most driving instantiations embed symbolic knowledge during training (Sharifi, Yildirim, and Fallah 2026; Albilani 2024). We instead deploy the Neuro→ pattern as an execution-time safety guard over a frozen policy, evaluated directly under closed-loop distribution shift. 3 Method Our method inserts a neuro-symbolic safety guard between a frozen end-to-end driving stack and the final actuation interface (Figure 2). The learned policy still performs perception, planning, and nominal control; the guard does not choose routes or replace the planner. Its role is narrower: it prevents the vehicle from executing a command that would move it toward an unrecoverable and dangerous state. The guard has three parts, and this section is organized around them: the setup fixing notation for its two inputs (§3.1); the safety rules turning a driving situation into concrete limits on the command (§3.2); and the guard itself, which replaces a proposal breaking any active rule with the closest command satisfying all of them, and changes nothing otherwise (§3.3). Figure 2: The neuro-symbolic safety guard in three stages, wrapping a frozen end-to-end stack (bottom) that emits its nominal command x0x_0 as usual. (i) Read: the same forward pass exposes a structured scene (o)=(,,,)S(o)=(K,B,V,W), the detections, BEV features, target velocity, and waypoints already computed inside the network. (i) Reason: the safety rules read this scene and each returns one limit on a control axis, assembled into the bound vector act(o)g_act(o). (i) Restrict: these bounds define the feasible region (o)C(o) onto which the guard projects x0x_0, solving argminx∈(o)12‖x−x0‖22 *argmin_x (o) 12\|x-x_0\|_2^2 for the executed command x∗x^*. Only the final command is constrained; the agent is never retrained. 3.1 Setup: What the Guard Reads Control space. We represent the executed vehicle command as a two-dimensional control vector, x=[u,s]⊤,u=τ−β,x∈=[−1,1]2,x=[u,\,s] , u=τ-β, x =[-1,1]^2, (1) where u is the signed longitudinal command, s is the steering command, τ∈[0,1]τ∈[0,1] is throttle, β∈[0,1]β∈[0,1] is brake, and U is the admissible control set; positive u accelerates and negative u brakes. Throttle and brake are mutually exclusive on a road vehicle, therefore, collapsing them into the single signed scalar u=τ−βu=τ-β loses no actuation authority while turning every longitudinal safety condition into one upper bound on u. Neural backbone and nominal proposal. Let O denote the observation space and o∈o a single multi-sensor observation (the synchronized camera, LiDAR, and radar inputs at one time step). The backbone is an end-to-end driving policy πθ:→ _θ:O with learned parameters θ, mapping the observation o to a nominal control proposal x0=πθ(o)=[u0,s0]⊤,x_0= _θ(o)=[\,u_0,\;s_0\,] , (2) where x0x_0 is the command the learned stack would execute without intervention. We reuse this policy unchanged: it already solves perception, prediction, and planning at competitive accuracy, and the guard needs only its output and a few intermediate signals. In our experiments πθ _θ is TFv6, a multi-modal imitation-learning agent that fuses camera, LiDAR, and radar through a transformer backbone and predicts both the waypoint path and the target velocity (Nguyen et al. 2026). Structured scene state. The guard needs to see the scene, and modern end-to-end stacks already show it: to stay trainable and debuggable, most expose interpretable outputs in the same inference pass that yields the command (Shao et al. 2022; Wang et al. 2025a; Wang et al. 2025b). We reuse four of them (the scene block feeding the guard in Figure 2), (o)=(,,,),S(o)=(K,B,V,W), (3) CenterNet-style object detections K (position, class, confidence (Zhou, Wang, and Krähenbühl 2019)), a bird’s-eye-view (BEV) semantic map B, radar returns V (radial velocity and range), and the policy’s own planned waypoints W. Each encodes traffic facts the policy computes but never enforces on its command. Because no single signal is complete, we read each only for what it measures reliably and fuse rather than substitute: detections give class but not velocity, radar gives velocity but not class, and the two together give both. This dependence on exposed signals costs us little: where a stack lacks them, the heads can be added without touching the policy, and post-incident analysis of real robotaxi deployments argues for exactly this kind of conservative, inspectable decision-making. But exposing the scene is not enforcing it, and that step is our contribution. With the scene in symbolic form, we turn to the rules that read it (§3.2) and the guard that acts on it (§3.3). 3.2 The Traffic-Safety Rules This subsection presents the safety rules. A rule is not a single equation but a procedure: it takes an established safety principle, applies it to the scene signals of §3.1, and reduces the result to one number, a limit on one control axis. We use five such rules, one per entry of the bound vector as follows: act(o)=[gcoll(o)⏟R1,gspeed(o)⏟R2,gred(o)⏟R3,gped(o)⏟R4,glat(o)⏟R5]⊤g_act(o)= [ g_coll(o)_R1,\, g_speed(o)_R2,\, g_red(o)_R3,\, g_ped(o)_R4,\, g_lat(o)_R5 ] (4) This vector is the rule set, written numerically: each g∙(o)g_ (o) is the limit that rule imposes in the current scene. The four longitudinal limits share the interval [umin,umax]=[−1,1][u_min,u_max]=[-1,1] of the command u they constrain (11 full throttle, −1-1 full brake); the fifth (glatg_lat) limits steering. Table 1 states when each rule fires and how it changes the command; assembling this vector is the reason stage of Figure 2, and the guard (§3.3) enforces all five at once. Rule (bound) Description Longitudinal rules (limit u) R1. Planned-Path Collision Safeguard (gcollg_coll) Prevents the vehicle from following its intended waypoint path into a solid obstacle. The rule first suppresses forward acceleration and escalates to braking when the remaining gap becomes unsafe. R2. Speed-Limit Compliance (gspeedg_speed) Keeps the vehicle inside the urban speed envelope by reducing positive longitudinal command and, if necessary, requesting mild braking until the speed returns to a safe legal range. R3. Red-Light Stop Compliance (gredg_red) Forces the command toward a full stop when a red light is active and the remaining distance no longer supports safe continuation through the intersection. R4. Pedestrian Right-of-Way Protection (gpedg_ped) Enforces early yielding whenever a pedestrian occupies, or is about to enter, the forward crossing corridor in front of the ego vehicle. Lateral rule (limits s) R5. Speed-Conditioned Steering Stability (glatg_lat) Shrinks the admissible steering range as speed increases, keeping the executed command within a safe lateral-acceleration envelope. Table 1: The five safety rules. Each row is one rule: the entry it fills in the bound vector act(o)g_act(o) of Eq. (4), the driving situation it covers, and the correction it can impose. The first four constrain longitudinal motion (u); the last constrains steering (s). Together these five span the dominant ways an urban command turns unsafe: an obstacle on the planned path, excess speed, a red light, a pedestrian, and loss of control in a fast turn. They share one construction principle: ground an established physical or safety model directly in the commands the car executes. The same procedure therefore extends cleanly to hazards beyond these five. R1 turns the Responsibility-Sensitive Safety stopping distance (Shalev-Shwartz, Shammah, and Shashua 2017) into a throttle-and-brake bound; R5 turns the bicycle model of vehicle dynamics into a steering bound that holds before the tires lose grip. Planned-Path Collision Safeguard (R1, COLL). COLL is the central rule, preventing the vehicle from driving into obstacles on the path the policy intends to follow: vehicles, stopped obstacles, oncoming traffic, and out-of-distribution objects such as animals or debris. Its defining choice is to be path-relative rather than box-relative, asking whether an obstacle lies on the planned trajectory rather than inside a fixed window ahead. A fixed forward box brakes needlessly for parked cars at the kerb and for oncoming traffic on curves; gating on the planned path removes these false positives while still catching obstacles the ego is driving toward. COLL computes its bound in four steps. Step 1 (planned path). We form the path polyline from the predicted waypoints (W) by TFv6, (o)=[(0,0),1,…,T],P(o)= [(0,0),\,w_1,\,…,\,w_T ], (5) in ego coordinates, where =[1,…,T]⊤W=[w_1,…,w_T] and T is the prediction horizon. Step 2 (on-path gate). An obstacle at position p is treated as a threat only if it lies within a corridor around this path, d(,(o))≤ω(o),d\! (p,\,P(o) )≤ω(o), (6) where d(⋅,(o))d(·,P(o)) is point-to-polyline distance and ω(o)ω(o) is the corridor half-width. The corridor is wide enough to cover the intended path; when the waypoints show a sustained lateral excursion, that is, the policy is planning around the obstacle, it tightens, and the guard defers to that evasive maneuver instead of blocking it indefinitely. Step 3 (two perception channels). Two complementary detectors share the gate, following the fuse-not-substitute discipline of §3.1. Channel A is class-aware, starting from camera detections and using radar only to fuse longitudinal velocity onto an associated object. Channel B uses radar as a class-agnostic solid-object detector, catching out-of-distribution hazards no learned class covers. The shared path gate is what makes a class-agnostic sensor safe to brake on, since off-path clutter is filtered as in Channel A. COLL takes the more conservative bound. Step 4 (safe distance to bound). For the gated obstacle we require an RSS-style stopping margin (Pek and Althoff 2021), dsafe=vego22aego−vobs22aobs+vegoδbrake,vobs≥0,vclosing22aego+vclosingδbrake,vobs<0,d_safe= cases v_ego^22\,a_ego- v_obs^22\,a_obs+v_ego\, _brake,&v_obs≥ 0,\\[6.45831pt] v_closing^22\,a_ego+v_closing\, _brake,&v_obs<0, cases (7) where vegov_ego and vobsv_obs are ego and obstacle speeds, vclosing=vego−vobsv_closing=v_ego-v_obs is closing speed, aegoa_ego and aobsa_obs are conservative braking rates, and δbrake _brake is the actuation delay. Both cases are physical: when the obstacle moves with traffic (vobs≥0v_obs≥ 0) the ego must cover its own braking distance less the distance the obstacle clears, plus a reaction term; when it approaches (vobs<0v_obs<0) only closing speed matters, as its motion cannot be credited. Converting dsafed_safe into the largest speed still permitting braking within the remaining gap gives gcoll(o)g_coll(o); a close-range emergency cap dominates when the gap becomes critical, and positive throttle is blocked whenever an on-path obstacle is present and not clearly pulling away. The remaining four rules. The other four rules (R2–R5) share a single pattern: convert a scene-measured distance into the fastest speed from which the car can still stop, then clip the command to it. For a hazard at buffered range d under braking abrakea_brake, the induced longitudinal bound is vstop v_stop =2abrakemax(d, 0), = 2\,a_brake\, (d,\,0), g∙(o) g_ (o) =clip(vstop−vrefvcomfort,umin,umax). =clip\! ( v_stop-v_refv_comfort,\,u_min,\,u_max ). (8) Here vstopv_stop is the safe speed: the highest speed from which the car can still brake to a full stop within the available distance d, obtained from the constant-deceleration stopping relation v2=2abrakedv^2=2\,a_brake\,d. The bound then measures the current speed vrefv_ref against this budget: when vrefv_ref exceeds vstopv_stop the term is negative and the command is braked, and when it is below the rule stays slack; vcomfortv_comfort normalizes this speed error into the control range [umin,umax][u_min,u_max]. The four rules instantiate this template through their choice of d and vrefv_ref, plus one rule-specific guard (Table 1). Red-light (R3) is representative: d is the buffered distance to the stop line, vref=vegov_ref=v_ego, and the bound is weighted by the cue confidence Peff,tlP_eff,tl (BEV-semantic primary, detector fallback); a low-confidence light yields a graded restriction rather than an abrupt stop. The others follow with the natural substitutions: worst-case closing speed for a pedestrian, the urban ceiling for the speed limit, and for R5 the bicycle-model cap smax=max(Alat,maxL/(gsvego2),sfloor)s_max= \! (A_lat,maxL/(g_sv_ego^2),\,s_floor ), binding only when a raw command would imply loss of control. 3.3 The Safety Guard We can now state the guard compactly. At each time step it maps the policy’s proposal and the current scene to a corrected command x∗x^* in three moves, the read, reason, and restrict stages of Figure 2: (i) read: (i) read: x0=πθ(o), x_0= _θ(o), (9) (i) reason: (i) reason: g(o)=ℛ((o)), g(o)=R (S(o) ), (i) restrict: (i) restrict: x∗=Π(o)(x0), x^*= _C(o)(x_0), where the policy proposes x0x_0 (§3.1), the rules (ℛR) turn the scene (o)S(o) into the bound vector g(o)g(o) (§3.2), and Π projects the proposal onto the feasible set (o)C(o) the rules define. The rest of this subsection makes the “restrict” step precise. It solves a scene-dependent correction problem: given the nominal proposal x0x_0 and the current observation o, return the closest admissible command x∗x^*. The observation defines the feasible control set (o)=x∈:x≤g(o),C(o)\,=\,\x :Dx≤ g(o)\, (10) where the command is the two-axis control x=[u,s]⊤∈x=[u,s] (longitudinal u, steering s), g(o)g(o) is the scene-conditioned bound vector assembled from the active rules and actuator limits, and D is the fixed constraint-structure matrix that maps each active rule to the control axis it limits. Each rule thus contributes one affine constraint, and together they define the feasible set. The executed command is the Euclidean projection of the nominal proposal x0x_0 onto this set, i.e., the quadratic program (QP) x∗=argminx∈(o)12‖x−x0‖22.x^*= *argmin_x (o) 12\|x-x_0\|_2^2. (11) When several rules over-constrain the command, the most restrictive admissible bound wins, resolving the conflict in favor of safety. 3.4 Why the Guard Can Be Trusted Algorithm 1 instantiates the three stages of Eq. (9) on the single backbone forward pass that produces x0x_0, adding only lightweight, bounded computation that runs at control rate. Algorithm 1 Neuro-Symbolic Safety Guard (one time step) 0: Observation o; nominal proposal x0=[u0,s0]⊤x_0=[u_0,\,s_0] from πθ(o) _θ(o); ego speed vegov_ego 0: Executed command x∗=[u∗,s∗]⊤x^*=[u^*,s^*] 1: Extract the structured scene state (,,,)(K,B,V,W) from the same forward pass that produced x0x_0 2: Build the planned-path polyline (o)P(o) from W and test whether the waypoints indicate bypass intent 3: Compute the planned-path collision bound gcollg_coll from the path-gated camera and radar channels; update the short-horizon coast / recovery logic if a confirmed obstacle briefly disappears 4: Compute the speed-limit, red-light, and pedestrian bounds gspeedg_speed, gredg_red, gpedg_ped 5: Compute the steering-stability bound glat←smax(vego)g_lat← s_max(v_ego) 6: Assemble the scene-conditioned bound vector g(o)g(o) from these rule outputs and the actuator limits 7: Solve the projection (QP) x∗←argminx∈(o)12‖x−x0‖22x^*← _x (o) 12\|x-x_0\|_2^2, with (o)=x∈:x≤g(o)C(o)=\x :Dx≤ g(o)\ 8: return x∗x^* The guard earns trust from how it is built rather than from tuning. It preserves good driving: because x∗x^* is the closest admissible command to x0x_0, the guard moves as little as the active rules require and leaves an already-safe proposal untouched. Its corrections are safe by construction: every longitudinal bound is a brake-feasible speed derived from scene geometry (Eqs. (7), (8)), preserving a kinematically feasible stopping condition rather than a tuned threshold; this holds conditional on perception reporting the hazard correctly, a limit we quantify in §4.2. And every correction is auditable: a given scene always yields the same correction (Algorithm 1), traceable to the single rule that caused it. 4 Experiments 4.1 Evaluation Design To separate real driving skill from pattern-matching on familiar scenes, we re-stage the same hazard with different assets and layouts (a distribution shift): a capable policy still copes, whereas an overfit one degrades, with unsafe decisions concentrated in these shifted scenes. This motivates two hypotheses. (H1) On the generalization split, the guard reduces safety-critical failures (collisions with vehicles, pedestrians, and static obstacles). (H2) It achieves this while preserving task competence, without trading safety for mobility. We deliberately do not measure perception quality, ride comfort, or sample efficiency: the guard trains no weights and does not touch perception, hence we hold it fixed and vary only the final action interface, keeping the comparison a clean attribution to the guard. Benchmark. We evaluate on Fail2Drive (Gerstenecker, Geiger, and Renz 2026a), a CARLA v2 benchmark of 200 short routes in Town13 (mean length 219219 m) covering 17 rare-hazard scenario classes. Its routes come in 100 matched pairs, and this pairing defines the two splits used throughout the paper. The in-distribution split stages each hazard with the familiar objects and layouts an agent encounters in training. The generalization split stages the same hazard on the same road, changing only the appearance and arrangement of the objects involved; the situation is unfamiliar while the driving task is identical. Because the pair differs in nothing else, the drop from the first split to the second measures how much of an agent’s competence was memorized rather than learned. This suits our claim better than aggregate suites such as Bench2Drive (which we also run as a competence check) or the standard CARLA Leaderboard, which reward average competence on familiar routes rather than safety under rare shifts, and better than open-loop datasets, which cannot expose closed-loop failures at all. Baselines. Our primary comparison is paired: the same TFv6 policy with and without the guard (denoted NS, our neuro-symbolic safety guard) on the same released weights, under Fail2Drive’s fixed protocol, ensuring the measured change is attributable to the guard rather than to a different model or training run. We additionally report the public Fail2Drive leaderboard (Gerstenecker, Geiger, and Renz 2026b) (Table 2) to confirm that the backbone is a genuinely state-of-the-art starting point rather than a weak strawman. As a secondary check, we run the same paired comparison on Bench2Drive, reported briefly in §4.2 as it only confirms preserved competence. Metrics. The evaluation rests on three metrics, kept identical to the benchmark’s for direct comparability. Driving Score (DS) measures route progress, scaled down by every infraction; Success Rate (SR) is the stricter fraction of routes completed cleanly. Their Harmonic Mean, HM=2DS⋅SR/(DS+SR)HM=2\,DS·SR/(DS+SR), is our primary criterion: it follows the weaker of the two, and cannot be lifted either by rushing through routes while colliding or by crawling too cautiously to arrive. Two further analyses complete the evaluation: the in-distribution-to-shift generalization drop (which H1 and H2 target) and a per-infraction breakdown that separates a prudent stop from a dangerous contact (Section 4.2). Setting. All variants run in closed loop in the open-source CARLA simulator (Dosovitskiy et al. 2017) (0.9.15, Leaderboard 2.0) on a shared GPU cluster, in inference only: we train and fine-tune nothing, leaving backbone weights identical across conditions and the guard as the only moving part. We follow Fail2Drive’s fixed protocol without modification (three seeds over the 100 paired routes of each split), leaving neither variant tuned to the benchmark. 4.2 Results and Analysis Method DS↑ SR↑ HM↑ Δ ↑ Learned sensor-based agents AlignDrive (Wu et al. 2026) 68.6 62.7 65.5 −12.9-12.9 TF++ (Jaeger, Chitta, and Geiger 2023) 75.4 61.1 67.5 −16.5-16.5 TFv6 (Nguyen et al. 2026) 79.5 70.7 74.8 −18.4-18.4 BevAD (Holtz et al. 2026) 82.3 68.7 74.9 −12.2-12.2 BridgeDrive (Liu et al. 2026) 81.9 75.0 78.3 −16.1-16.1 TFv6 + NS (ours) 80.0 81.3 80.6 −9.8-9.8 Privileged-state / expert agents (ceiling) PlanT 2.0 (Gerstenecker, Geiger, and Renz 2025) 73.3 58.0 64.8 −25.0-25.0 PDM-Lite-F2D (Gerstenecker, Geiger, and Renz 2026a) 94.0 95.3 94.6 −1.8-1.8 Table 2: Fail2Drive generalization split: leading entries, ordered by HM. Rows cite the paper introducing each method; all baseline scores are as recorded on the public leaderboard under the benchmark’s fixed protocol. Δ is the relative HM drop from the in-distribution split, i.e. the competence an agent loses when the scene becomes unfamiliar; less negative is better. Bold marks the best learned entry per column; privileged agents are a reference ceiling, not competitors. In-Distribution Generalization DS SR HM DS SR HM TFv6 90.2 93.3 91.7 79.5 70.7 74.8 TFv6 + NS 86.7 92.3 89.4 80.0 81.3 80.6 Δ (%) −3.9-3.9 −1.1-1.1 −2.5-2.5 +0.6+0.6 +15.0+15.0 +7.8+7.8 Table 3: Paired comparison of the same frozen TFv6 policy without and with the guard, on both splits. The TFv6 row is its public-leaderboard entry; TFv6 + NS is our run on identical weights; every difference is the guard’s. The Δ row is the relative change the guard produces within each split. Bold marks improvement on the generalization split. Figure 3: Per-infraction comparison (TFv6 vs. TFv6 + NS). Table 2 places the guarded policy against the field, and Table 3 isolates what the guard alone changes. Read together, they point in opposite directions, and that contrast is the main result. On the in-distribution split the guard costs 2.5%2.5\% HM; on the generalization split it gains 7.8%7.8\%. A layer that helped on both splits would simply be a better policy, and one that hurt on both would be a worse one. Helping only where the driving is unfamiliar is what a safety constraint should do: it acts when the policy is about to err and stays inactive when the policy is right. Hypothesis 1 (H1): safety improves where it matters. On the generalization split, the guard lifts every metric of the frozen policy it wraps: SR by 10.610.6 points (+15.0%+15.0\%) and HM by 5.85.8 (+7.8%+7.8\%), without lowering Driving Score (Table 3). More informative than the scores themselves is how much each agent loses between the two splits, the Δ column of Table 2. Fail2Drive reports an average loss of 16.3%16.3\% across the models it surveys; TFv6 alone loses 18.4%18.4\%, and the guard reduces this to 9.8%9.8\%, the smallest loss of any learned agent and second only to a privileged expert that reads ground-truth simulator state. A small loss is easy to obtain by scoring poorly on both splits, and must be read together with the starting score: AlignDrive and BevAD lose less than TFv6 (−12.9%-12.9\% and −12.2%-12.2\%), but start at in-distribution HM of 75.275.2 and 85.385.3 against TFv6’s 91.791.7. The guarded policy is the only entry that starts high and loses little. Hypothesis 2 (H2): nominal competence is largely preserved. On the in-distribution split, the guard costs 3.53.5 DS, 1.01.0 SR and 2.32.3 HM (Table 3). This cost is expected, and its direction is fixed by the design: the guard can only narrow the set of allowed commands, never widen it (§3.3). Where the policy already drives well no rule should fire, and a rule that fires anyway can only remove progress the policy would have made safely. This split therefore measures how often the guard intervenes unnecessarily, and 2.5%2.5\% HM is the price of the conservative safety margins in Eq. (7). Bench2Drive shows the same pattern on scenarios the agent knows well (DS →8994.5\!→\!89, SR →94.8%99.0\!→\!94.8\%), indicating that the cost follows how often hazards occur rather than anything specific to Fail2Drive. What the guard trades. Figure 3 shows the mechanism behind both splits. Collisions fall in every category: pedestrian collisions from 6.3%6.3\% of routes to 3.0%3.0\%, layout collisions from 15.0%15.0\% to 7.7%7.7\%, and vehicle collisions from 4.7%4.7\% to 3.3%3.3\%. What increases instead is lost time: min-speed infractions from 72.3%72.3\% to 92.0%92.0\%, and timeouts by 55–88 points. Because the guard can only slow the car, every intervention is paid for in delay. This is also why DS and SR move so differently (+0.6%+0.6\% against +15.0%+15.0\%): Driving Score penalizes a collision and a stalled route alike, and trading one for the other leaves it nearly unchanged, whereas Success Rate depends on whether a route fails at all, and the trade removes far more failures than it creates. Implication for evaluation. A safety guard being penalized by the dominant metric reflects a limitation of the metric, rather than a weakness of the guard. Because existing benchmarks reward progress along the route, a vehicle that crashes after travelling farther can outscore one that waited for a gap that never opened. Our results give this a number: the same intervention reads as a 0.6%0.6\% improvement under DS and a 15.0%15.0\% improvement under SR. We therefore report the harmonic mean throughout, and suggest that long-tail benchmarks treat a cautious stop and a collision as categorically different outcomes, not differently weighted infractions. Figure 4: Guard successes (a) and (b) and limitations (c). Each right panel plots the nominal command (blue cross), the corrected command (red star), and the feasible set (green). Qualitative reach and limit. Figure 4 shows both regimes directly. In (a) and (b) the policy accelerates toward an unfamiliar object and into a painted wall it reads as open road. These are exactly the failures the guard should catch: the obstacle is physically present even when the network does not recognize what it is, and the class-agnostic radar channel fires where the camera channel does not. Case (c) marks the limit. When the planner routes into the oncoming lane, no allowed command remains and the guard stops the car, taking a timeout instead of a collision. This is where the added timeouts come from: the guard can block an unsafe command, but it cannot invent a safe trajectory the planner never proposed, and it acts only on what perception reports. 5 Conclusion A neuro-symbolic safety guard lets a trained driver keep everything it learned while obeying what physics and traffic law require. Attached at the final command interface, it turns what the agent sees into auditable limits on throttle, brake and steering. On the Fail2Drive long tail it raises Success Rate by 15%15\% and cuts safety-critical collisions by up to 53%53\% without lowering Driving Score. It attains the highest Harmonic Mean of any learned agent, and loses the least when the scene becomes unfamiliar. Because the guard reads only signals a modern stack already exposes and never alters its weights, the same construction attaches to any end-to-end agent without retraining. These results argue for judging an agent not by the distance it covers but by the conditions its commands are guaranteed to satisfy. References Agrawal et al. (2019) Agrawal, A.; Amos, B.; Barratt, S.; Boyd, S.; Diamond, S.; and Kolter, J. Z. 2019. Differentiable Convex Optimization Layers. In Advances in Neural Information Processing Systems (NeurIPS), volume 32. Albilani (2024) Albilani, M. 2024. Neuro-symbolic Deep Reinforcement Learning for Safe Urban Driving Using Low-Cost Sensors. Ph.D. thesis, Institut Polytechnique de Paris. Alshiekh et al. (2018) Alshiekh, M.; Bloem, R.; Ehlers, R.; Könighofer, B.; Niekum, S.; and Topcu, U. 2018. Safe Reinforcement Learning via Shielding. In Proceedings of the AAAI Conference on Artificial Intelligence. Amos and Kolter (2017) Amos, B.; and Kolter, J. Z. 2017. OptNet: Differentiable Optimization as a Layer in Neural Networks. In Proceedings of the 34th International Conference on Machine Learning (ICML), 136–145. Beißwenger (2024) Beißwenger, J. 2024. PDM-Lite: A Rule-Based Planner for CARLA Leaderboard 2.0. Research project report, University of Tübingen. Bhuyan et al. (2024) Bhuyan, B. P.; Ramdane-Cherif, A.; Tomar, R.; and Singh, T. P. 2024. Neuro-symbolic artificial intelligence: a survey. Neural Computing and Applications, 36: 12809–12844. Codevilla et al. (2018) Codevilla, F.; Müller, M.; López, A.; Koltun, V.; and Dosovitskiy, A. 2018. End-to-End Driving via Conditional Imitation Learning. In Proceedings of the IEEE International Conference on Robotics and Automation (ICRA), 4693–4700. Dalal et al. (2018) Dalal, G.; Dvijotham, K.; Vecerik, M.; Hester, T.; Paduraru, C.; and Tassa, Y. 2018. Safe Exploration in Continuous Action Spaces. arXiv:1801.08757. Dosovitskiy et al. (2017) Dosovitskiy, A.; Ros, G.; Codevilla, F.; López, A.; and Koltun, V. 2017. CARLA: An Open Urban Driving Simulator. In Proceedings of the Conference on Robot Learning (CoRL), volume 78 of Proceedings of Machine Learning Research, 1–16. Gerstenecker, Geiger, and Renz (2025) Gerstenecker, S.; Geiger, A.; and Renz, K. 2025. PlanT 2.0: Exposing Biases and Structural Flaws in Closed-Loop Driving. arXiv:2511.07292. Gerstenecker, Geiger, and Renz (2026a) Gerstenecker, S.; Geiger, A.; and Renz, K. 2026a. Fail2Drive: Benchmarking Closed-Loop Driving Generalization. arXiv:2604.08535. Gerstenecker, Geiger, and Renz (2026b) Gerstenecker, S.; Geiger, A.; and Renz, K. 2026b. Fail2Drive Public Leaderboard. https://github.com/SimonGer/fail2drive_leaderboard. Accessed 26 July 2026. Holtz et al. (2026) Holtz, D.; Hanselmann, N.; Doll, S.; Cordts, M.; and Schiele, B. 2026. What Matters for Scalable and Robust Learning in End-to-End Driving Planners? In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) Findings, 931–941. ArXiv:2603.15185. Jaeger, Chitta, and Geiger (2023) Jaeger, B.; Chitta, K.; and Geiger, A. 2023. Hidden Biases of End-to-End Driving Models. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), 8240–8249. Jia et al. (2024) Jia, X.; Yang, Z.; Li, Q.; Zhang, Z.; and Yan, J. 2024. Bench2Drive: Towards Multi-Ability Benchmarking of Closed-Loop End-to-End Autonomous Driving. In Advances in Neural Information Processing Systems (NeurIPS), volume 37. Kautz (2022) Kautz, H. 2022. The third AI summer: AAAI Robert S. Engelmore Memorial Lecture. AI Magazine, 43(1): 105–125. Koopman (2024) Koopman, P. 2024. Lessons From the Cruise Robotaxi Pedestrian Dragging Mishap. IEEE Reliability Magazine. Liu et al. (2026) Liu, S.; Chen, W.; Li, W.; Wang, Z.; Yang, L.; Huang, J.; Zhang, Y.; Huang, Z.; Cheng, Z.; and Yang, H. 2026. BridgeDrive: Diffusion Bridge Policy for Closed-Loop Trajectory Planning in Autonomous Driving. In Proceedings of the International Conference on Learning Representations (ICLR). ArXiv:2509.23589. Nguyen et al. (2026) Nguyen, L.; Fauth, M.; Jaeger, B.; Dauner, D.; Igl, M.; Geiger, A.; and Chitta, K. 2026. LEAD: Minimizing Learner–Expert Asymmetry in End-to-End Driving. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). ArXiv:2512.20563. Pek and Althoff (2021) Pek, C.; and Althoff, M. 2021. Fail-Safe Motion Planning for Online Verification of Autonomous Vehicles Using Convex Optimization. IEEE Transactions on Robotics, 37(3): 798–814. Pham, De Magistris, and Tachibana (2018) Pham, T.-H.; De Magistris, G.; and Tachibana, R. 2018. OptLayer – Practical Constrained Optimization for Deep Reinforcement Learning in the Real World. In Proceedings of the IEEE International Conference on Robotics and Automation (ICRA). Prakash, Chitta, and Geiger (2021) Prakash, A.; Chitta, K.; and Geiger, A. 2021. Multi-Modal Fusion Transformer for End-to-End Autonomous Driving. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 7077–7087. Sarker et al. (2021) Sarker, M. K.; Zhou, L.; Eberhart, A.; and Hitzler, P. 2021. Neuro-Symbolic Artificial Intelligence: Current Trends. AI Communications, 34(3): 197–209. Shalev-Shwartz, Shammah, and Shashua (2017) Shalev-Shwartz, S.; Shammah, S.; and Shashua, A. 2017. On a Formal Model of Safe and Scalable Self-Driving Cars. arXiv:1708.06374. Shao et al. (2022) Shao, H.; Wang, L.; Chen, R.; Li, H.; and Liu, Y. 2022. Safety-Enhanced Autonomous Driving Using Interpretable Sensor Fusion Transformer. In Proceedings of the Conference on Robot Learning (CoRL), volume 205 of Proceedings of Machine Learning Research. Sharifi, Yildirim, and Fallah (2026) Sharifi, I.; Yildirim, M.; and Fallah, S. 2026. Toward Safe Autonomous Highway Driving Policies using a Neuro-Symbolic Deep Reinforcement Learning Approach. Transportation Research Record, 2680(1): 416–431. Wang et al. (2025a) Wang, D.; Li, Y.; Chen, W.; Jiang, X.; Mu, Y.; and Li, D. 2025a. PA-TCP: Interpretable End-to-End Autonomous Driving through Parallel Adaptive Attention Mechanism and State Representation. In Proceedings of the IEEE Intelligent Vehicles Symposium (IV). Wang et al. (2025b) Wang, Y.; Luo, W.; Bai, J.; Cao, Y.; Che, T.; Ivanovic, B.; Pavone, M.; et al. 2025b. Alpamayo-R1: Bridging Reasoning and Action Prediction for Generalizable Autonomous Driving in the Long Tail. NVIDIA technical report, arXiv:2511.00088. Wu et al. (2022) Wu, P.; Jia, X.; Chen, L.; Yan, J.; Li, H.; and Qiao, Y. 2022. Trajectory-guided Control Prediction for End-to-end Autonomous Driving: A Simple yet Strong Baseline. In Advances in Neural Information Processing Systems (NeurIPS), volume 35. Wu et al. (2026) Wu, Y.; Zhang, H.; He, F.; Wu, R.; Shan, Y.; Qiu, C.; Gao, L.; Ke, W.; and Zhang, T. 2026. AlignDrive: Aligned Lateral-Longitudinal Planning for End-to-End Autonomous Driving. arXiv:2601.01762. Xu et al. (2022) Xu, C.; Ding, W.; Lyu, W.; Liu, Z.; Wang, S.; He, Y.; Hu, H.; Zhao, D.; and Li, B. 2022. SafeBench: A Benchmarking Platform for Safety Evaluation of Autonomous Vehicles. In Advances in Neural Information Processing Systems (NeurIPS), volume 35. Zhang et al. (2022) Zhang, Q.; Tang, M.; Geng, R.; Chen, F.; Xin, R.; and Wang, L. 2022. MMFN: Multi-Modal-Fusion-Net for End-to-End Driving. In Proceedings of the IEEE/RSJ International Conference on Intelligent Robots and Systems (IROS). Zhang et al. (2024) Zhang, Q.; Wallbridge, C. D.; Jones, D. M.; and Morgan, P. L. 2024. Public perception of autonomous vehicle capability determines judgment of blame and trust in road traffic accidents. Transportation Research Part A: Policy and Practice, 179: 103887. Zhou, Wang, and Krähenbühl (2019) Zhou, X.; Wang, D.; and Krähenbühl, P. 2019. Objects as Points. arXiv:1904.07850.