Risk-aware diffusion model for generating extreme weather scenarios and safety evaluation in autonomous driving

RADM framework

The RADM proposed in this article is capable of generating weather samples that comply with physical laws, exhibit diverse distributions, and present significant challenges. By introducing a multi-round risk feedback mechanism and a task-oriented optimization strategy, the model achieves adaptive migration of the generation distribution toward high-risk regions, as illustrated in Fig. 1. The experimental design adopts a phased validation approach. First, the model uses historical meteorological observation data and geographic information features to perform initial sampling in the high-dimensional meteorological parameter space, generating a candidate set of weather samples. Subsequently, this sample set is imported into the SafeBench simulation platform and tested in conjunction with the autonomous driving decision-making system, with quantitative recording of key performance indicators such as collision probability and path completion rate. The risk assessment module employs the analytic hierarchy process (AHP) to quantitatively evaluate the risk of candidate samples and implements a sample screening strategy based on risk scores, prioritizing the retention of high-risk weather scenarios for model optimization. During the iterative optimization process, the model dynamically adjusts the sampling distribution to gradually enhance the coverage of high-risk regions. After several rounds of optimization, the model can stably generate a representative and diverse set of high-risk weather samples. This sample set effectively supports the safety assessment and robustness verification of different autonomous driving strategies under complex weather conditions.

Data preparation and processing

To support automatic generation and systematic evaluation of high-risk weather scenarios, a standardized meteorological dataset was constructed on the SafeBench platform. The raw data originate from the China National Meteorological Data Centre (CMA) and are collected from historical measurement records of several meteorological observation stations, ensuring strong physical consistency and realistic representativeness. We selected 13 key meteorological factors from the public interface, including barometric pressure, sea level pressure, maximum barometric pressure, minimum barometric pressure, maximum wind speed, wind direction of maximum wind speed, 2-min average wind speed, 2-min average wind direction, air temperature, maximum temperature, minimum temperature, relative humidity, and precipitation over the past 3 h.

To meet the input requirements for model generation, all variables were normalized and standardized after collection, and converted into structured training samples, which ultimately constitute the input distribution for the diffusion model. On the simulation platform, these data are organized into the yaml format, supporting automatic loading and scenario injection of diverse weather combinations across multiple experimental rounds. This effectively improves the flexibility and reproducibility of high-risk test scenarios.

Different weather conditions have direct and measurable effects on the perception, planning, and control modules of autonomous driving systems. In CARLA and SafeBench, these effects are expressed through physically based environmental parameters that influence the sensing quality and vehicle–road interaction. Heavy precipitation and high surface wetness reduce tire–road friction, increasing braking distance and causing instability during high-speed maneuvers. Fog and low visibility degrade LiDAR returns and camera contrast, leading to incomplete object detection and delayed hazard recognition. Extreme cloudiness and low sun altitude introduce illumination inconsistencies and glare, which further increase perception uncertainty. Strong winds result in lateral disturbances that affect vehicle stability and steering control. These environment-induced perturbations propagate through the perception and prediction modules and ultimately alter the vehicle’s downstream decisions, increasing the likelihood of unsafe behaviors such as late braking, lane deviation, or collision. This physical-decision coupling provides the foundation for risk evaluation in RADM and ensures that the generated weather samples meaningfully influence autonomous driving behavior.

Although CARLA does not implement fully physics-accurate camera or LiDAR sensor models, its environmental rendering and vehicle–road interaction models have been widely validated for autonomous-driving research. Prior works based on CARLA and SafeBench demonstrate that variations in weather parameters—such as precipitation, fog density, cloudiness, and surface wetness—produce consistent and measurable changes in perception quality, visibility range, and vehicle stability. These effects are sufficient to alter the downstream behaviour of autonomous agents, including object-detection reliability, braking timing, lane-keeping performance, and collision likelihood. Therefore, RADM does not rely on high-fidelity replication of real sensor physics. Instead, it leverages CARLA’s behaviour-level sensitivity to environmental changes, which provides a reliable and widely adopted proxy for evaluating how extreme weather conditions influence autonomous-driving decisions at the control and planning levels. This design is aligned with standard practice in existing scenario-generation benchmarks such as SafeBench.

Design of training objectives

Specifically, given the driving environment $M$, the policy under test $\pi$, and the initial state trajectory ${\mathbf{x}}_{0:T}$, the test scenario can be modelled as follows:

(1) $$\begin{array}{c}S=\left(M,{\left\{{\mathbf{x}}_t,{\mathbf{u}}_t\right\}}_{t=0}^T\right)\end{array}.$$

Here, ${\mathbf{x}}_t$ and ${\mathbf{u}}_t$ denote the joint state and action of all vehicles at time $t$, respectively. The state is typically parameterized by vehicle position, speed, and heading, while the action is characterized by steering angle and acceleration.

In conventional autonomous driving systems, the control objective is typically to minimize an overall cost function $C$, such as collision rate, path deviation, or ride comfort. In this study, our optimization objective is instead to maximize this function by generating high-risk weather parameters $\mathbf{w}$ that increase the probability of failure for the system under test. This task can be formally defined as follows:

(2) $$\begin{array}{c}{\mathbf{w}}^{\ast }=\arg \underset{\mathbf{w}}{max}C\left(\mathbf{w},M,\pi \right)\end{array}.$$

That is, it is to proactively search for weather configurations ${\mathbf{w}}^{\ast }$ that significantly enhance the risk of the system under a specific map $M$ and autopilot strategy $\pi$.

RADM diffusion generation and training

Our diffusion framework follows the denoising diffusion probabilistic model (DDPM) proposed by Ho, Jain & Abbeel (2020), which models data generation as a Markov chain that gradually perturbs samples with Gaussian noise and then learns to reverse this process to recover the clean data distribution. Building upon this foundation, the diffusion generative network in RADM is designed to learn the mapping from Gaussian noise to weather configuration vectors through iterative denoising. The model extends the standard DDPM by introducing risk-guided conditioning and multi-round feedback adaptation, allowing it to bias the reverse diffusion process toward safety-critical weather configurations rather than reconstructing neutral samples.

In the forward diffusion stage, the model gradually adds noise to the original weather vectors through a Markov process, and the perturbation at each step is described by the following equation:

(3) $$\begin{array}{c}{\mathbf{w}}_t=\sqrt{{{\alpha }^{-}}_t}{\mathbf{w}}_0+\sqrt{1-{{\alpha }^{-}}_t}ϵ,ϵ\sim N\left(0,I\right)\end{array}.$$

Here, ${{\alpha }^{-}}_t={\prod }_{s=1}^t\left(1-{\beta }_s\right)$ is the cumulative noise scheduling parameter and ${\mathbf{w}}_0$ is 13-dimensional meteorological feature vectors. As $t$ increases, the weather features are smoothly mapped into Gaussian space, which enables the model to comprehensively explore the weather space.

The core generative capability of the model lies in its conditional U-Net structure. In the reverse (backpropagation) phase, the U-Net receives the noise-perturbed weather features ${\mathbf{w}}_t$, time steps t, and context conditions $h$ as inputs, and predicts the noise terms $ϵ$ required for denoising. The network’s optimization objective is to minimize the denoising error:

(4) $$\begin{array}{c}{\mathcal{L}}_{\mathrm{M}\mathrm{S}\mathrm{E}}={\mathbb{E}}_{{\mathbf{w}}_0,t,ϵ}\left[\parallel ϵ-{ϵ}_{\theta }\left({\mathbf{w}}_t,t,h\right){\parallel }^2\right].\end{array}$$

In each round of reverse sampling, the model is recursively fed into the denoising network using the noise prediction ${ϵ}^{k-1}$ from the previous step and the current intermediate state ${\mathbf{w}}^{k-1}$, achieving gradual correction and approximation of the target distribution. Each input ${ϵ}^{k-1}$ determines the generation path of the current weather sample until it ultimately converges to a high-risk weather sample, as illustrated in Fig. 1. The recursive process can be described as follows:

(5) $$\begin{array}{c}{\mathbf{w}}^k=\mathrm{D}\mathrm{e}\mathrm{n}\mathrm{o}\mathrm{i}\mathrm{s}\mathrm{i}\mathrm{n}\mathrm{g}\mathrm{S}\mathrm{t}\mathrm{e}\mathrm{p}\left({\mathbf{w}}^{k-1},{ϵ}^{k-1},h\right)\end{array}.$$

Here, ${ϵ}^{k-1}$ is the predicted noise from the previous iteration, and $h$ represents the condition information. The process iterates until $k=0$, yielding the final weather sample.

The U-Net employs a typical symmetric “encoder-decoder” structure, which continuously downsamples features during encoding and retains local information through skip connections. To enhance higher-order representations in weather generation, the U-Net introduces a query-key-value (QKV) attention mechanism at multiple scales, whose core operations are as follows:

(6) $$\begin{array}{c}Attention\left(Q,K,V\right)=softmax\left({\displaystyle \frac{Q{K}^{\mathrm{\top }}}{\sqrt{d_k}}}\right)V\end{array}.$$

Here, QKV are obtained from network features through linear transformation, and the attention weights accurately capture dependencies between different weather features. In addition, to improve the model’s adaptability to historical information and scene conditions, the U-Net layers employ an Adaptive Normalization (AdaGN) mechanism, which transforms the condition information h into scaling and bias parameters injected into the network as follows:

(7) $$\begin{array}{c}AdaGN\left(\mathbf{z},h\right)=\gamma \left(h\right)\cdot {\displaystyle \frac{\mathbf{z}-\mu \left(\mathbf{z}\right)}{\sigma \left(\mathbf{z}\right)}+\beta \left(h\right)}\end{array}.$$

In this way, each step of feature mapping is adaptively informed by environmental and historical context, thereby improving the modeling of extreme weather conditions.

All generated samples undergo physical feasibility checks and interval CLIP operations at the output stage to ensure that weather parameters do not exceed actual simulation boundaries. The introduction of a physical consistency regularization term allows the network to continuously suppress physically implausible outputs during generation. The regularization loss is formulated as follows:

(8) $$\begin{array}{c}{L}_{\mathrm{p}\mathrm{h}\mathrm{y}\mathrm{s}}=\sum _j{\lambda }_j\cdot max\left(0,\left|{\hat{w}}_0^{\left(j\right)}-w_{\mathrm{p}\mathrm{h}\mathrm{y}\mathrm{s}}^{\left(j\right)}\right|-{\delta }_j\right)\end{array}.$$

Here, ${\lambda }_j$ is the regularization weight for each meteorological variable, $w_{\mathrm{p}\mathrm{h}\mathrm{y}\mathrm{s}}^{\left(j\right)}$ denotes the physical boundary, and ${\delta }_j$ represents the allowed tolerance range.

The training objective of RADM is to jointly optimize the denoising reconstruction error, the physical regularization term, and the subsequent risk reward term through an overall loss function:

(9) $$\begin{array}{c}{\mathcal{L}}_{\mathrm{t}\mathrm{o}\mathrm{t}\mathrm{a}\mathrm{l}}={\mathcal{L}}_{\mathrm{M}\mathrm{S}\mathrm{E}}+\alpha {\mathcal{L}}_{\mathrm{p}\mathrm{h}\mathrm{y}\mathrm{s}}-\gamma E\left[r_{\mathrm{r}\mathrm{i}\mathrm{s}\mathrm{k}}\right]\end{array}.$$

In the early stage of training, the model initially focuses on denoising and physical regularization optimization, followed by the gradual introduction of a high-risk reward term that drives the sampling distribution to continuously and adaptively cluster toward extreme regions. All final generated samples are inverted and output as Risky-weather, entering the subsequent simulation and feedback closed loop. As shown in Fig. 1, the model structure and simulation evaluation process form a complete automated closed loop.

It is important to clarify that the CARLA simulator is not embedded in the gradient update process of the diffusion model. Instead, RADM is built on the SafeBench platform, which provides a modular and asynchronous simulation architecture with four nodes—Agent, Scenario, Evaluation, and Ego Vehicle. In this framework, CARLA runs only within the Evaluation Node, where it executes autonomous driving tests and records safety metrics such as collision rate, completion ratio, and red-light violations for each generated weather configuration. The simulator functions as an independent evaluation module, separated from the diffusion model’s training loop. The diffusion model and the risk assessment network are trained using the simulation results after each generation round, ensuring that CARLA is called only once per round rather than for every diffusion step. This design avoids real-time coupling between simulation and optimization, allowing RADM to maintain high physical fidelity while keeping the computational cost practical—about 3 h per feedback round on an NVIDIA RTX 4090.

Through the integrated use of a deep U-Net architecture, attention mechanisms, and conditional normalization, RADM demonstrates excellent capability in modeling and generating extreme scenarios, providing strong technical support for extreme testing and safety assessment of autonomous driving systems.

Risk feedback mechanism and high-risk sampling

In the closed loop of RADM generation, multiple rounds of risk feedback and high-risk sampling mechanisms jointly construct a dynamic and adaptive optimization process. Each round of diffusion-generated weather samples is rigorously tested on the simulation platform and receives corresponding safety feedback. For each set of weather parameters generated by the model, ${\left\{{\mathbf{w}}_0^{\left(i\right)}\right\}}_{i=1}^N$, we use the CARLA+SafeBench simulation environment to conduct comprehensive autonomous driving tests and record risk indicators such as collision rate and failure frequency, denoted as $R\left({\mathbf{w}}_0^{\left(i\right)}\right)$.

The overall risk score is computed as a weighted combination of two normalized indicators obtained from SafeBench–CARLA: the collision rate ( $r_{\mathrm{c}\mathrm{o}\mathrm{l}}$) and the route completion ratio ( $r_{\mathrm{c}\mathrm{o}\mathrm{m}\mathrm{p}}$):

(10) $$\begin{array}{c}R\left(\mathrm{w}{0}^{\left(\mathrm{i}\right)}\right)=\alpha \mathrm{r}\mathrm{c}\mathrm{o}{\mathrm{l}}^{\left(\mathrm{i}\right)}+\left(1-\mathrm{\alpha }\right)\left(1-{\mathrm{r}}_{\mathrm{c}\mathrm{o}\mathrm{m}\mathrm{p}}^{\left(\mathrm{i}\right)}\right)\end{array}$$where $\mathrm{\alpha }=0.6$ balances safety violations and task completion. These statistics are stored offline and later used as supervised labels for training the risk assessment network. This ensures that CARLA simulation is executed only once per feedback round, rather than being embedded inside the gradient loop of diffusion training.

These feedback signals not only provide realistic safety information for subsequent risk modeling, but also serve as the foundation for reward guidance during training. As shown at the bottom of Fig. 1, simulation feedback and high-risk screening together drive multiple rounds of closed-loop optimization.

To efficiently estimate the safety risk of generated weather conditions during the refinement process, RADM employs a data-driven risk prediction model implemented using a random forest regressor rather than a neural network–based predictor. The model is trained offline on previously collected weather–risk pairs $\left(w_0^{\left(i\right)},R\left(w_0^{\left(i\right)}\right)\right)$, where the risk values are obtained from SafeBench simulations. The random forest consists of 100 decision trees, allowing it to capture nonlinear interactions among meteorological variables such as precipitation, humidity, fog density, wind speed, and temperature-derived features represented in the weather vector. Owing to its ensemble structure, the model does not rely on gradient-based optimisation or epoch-driven training; instead, it is fitted directly using scikit-learn’s bootstrapped sampling and feature-subspace splitting strategy.

Once trained, the random forest serves as a fast surrogate risk evaluator that assigns an estimated risk score to any newly generated weather vector, eliminating the need to run CARLA simulations during the diffusion training loop. Let ${\mathcal{F}}_{\mathcal{R}\mathcal{F}}$ denote the random forest predictor. For each generated weather sample $w_0^{\left(i\right)}$, the predicted risk is computed as

(11) $$\begin{array}{c}{r}_{\mathrm{r}\mathrm{i}\mathrm{s}\mathrm{k}}^{\left(i\right)}={\mathcal{F}}_{\mathcal{R}\mathcal{F}}\left(w_0^{\left(i\right)}\right).\end{array}$$

These predicted scores enable efficient prioritisation of high-risk candidates. During each refinement round, all generated samples are ranked according to ${\mathcal{F}}_{\mathcal{R}\mathcal{F}}\left(w_0^{\left(i\right)}\right)$, and the most hazardous subset is selected for full CARLA evaluation. Formally, the Top-K selection among the generated batch is written as

(12) $$\begin{array}{c}{S}_{\mathrm{t}\mathrm{o}\mathrm{p}-K}=argtop{\left\{r_{\mathrm{r}\mathrm{i}\mathrm{s}\mathrm{k}}^{\left(i\right)}\right\}}_{i=1}^N\end{array}.$$

The average predicted risk of the batch defines the risk-aware reward signal used in training,

(13) $$\begin{array}{c}{R}_{\mathrm{r}\mathrm{i}\mathrm{s}\mathrm{k}}={\displaystyle \frac{1}{N}\sum _{i=1}^N{r}_{\mathrm{r}\mathrm{i}\mathrm{s}\mathrm{k}}^{\left(i\right)}}\end{array}$$which encourages the generator to explore weather configurations associated with higher estimated danger. By combining predicted risk scores for rapid screening and simulation-derived risk values for accurate supervision, RADM achieves efficient high-risk sampling without requiring real-time simulator calls at every generative step.

This reward is incorporated as a negative term in the RADM joint loss function, with its influence controlled by the weight parameter $\gamma$:

(14) $$\begin{array}{c}{\mathcal{L}}_{\mathrm{t}\mathrm{o}\mathrm{t}\mathrm{a}\mathrm{l}}={\mathcal{L}}_{\mathrm{M}\mathrm{S}\mathrm{E}}+\alpha {\mathcal{L}}_{\mathrm{p}\mathrm{h}\mathrm{y}\mathrm{s}}-\gamma E\left[r_{\mathrm{r}\mathrm{i}\mathrm{s}\mathrm{k}}\right]\end{array}.$$

This combination of simulation feedback and neural network risk prediction greatly improves the efficiency and generalization of high-risk sampling, enabling RADM to directly batch-screen and reward-guide extreme weather scenarios without requiring real-time simulation at every step.

In successive feedback loops, RADM is continually reinforced by new high-risk samples, and its predictive capability is synergistically enhanced along with its sampling ability, enabling the system to adaptively evolve toward increasingly challenging weather distributions. This close integration of theoretical modeling and engineering implementation provides a solid technical foundation for the efficient mining and safety verification of extreme autonomous driving scenarios.

The implementation of RADM is based on PyTorch, and the diffusion generative model adopts a lightweight SimpleMLP architecture. At each diffusion step, the noisy sample and the normalised time step are concatenated and passed through a two-layer fully connected network with ReLU activations to predict the additive Gaussian noise. The model is trained for 100 epochs using the Adam optimiser with an initial learning rate of 1 × 10⁻³, a batch size of 64, and a linear beta schedule containing 1,000 diffusion steps, following the standard DDPM training procedure. This configuration provides stable optimisation across different timestamps and ensures that the noise predictor converges reliably. All experiments are conducted on a workstation equipped with an NVIDIA RTX 4090 GPU. The training pipeline supports iterative refinement through repeated cycles of weather-sample generation, simulation evaluation, and distribution updating, enabling the model to gradually focus on weather patterns associated with higher levels of safety risk while maintaining computational efficiency.

Risk assessment

A trained risk prediction model is employed to assess the potential collision probability of each generated sample, and a probability distribution is plotted to evaluate the aggressiveness of the scenarios. Whether the generated samples exhibit “sufficient aggressiveness” is a core metric for evaluating adversarial weather scene generation. Therefore, based on the predicted collision probabilities, we first conduct a statistical analysis of the risk scores of samples generated by different models.

We constructed a dedicated risk assessment network with an output range of [0, 1], representing the intensity of collision risk induced by each weather configuration. Figure 2 illustrates the risk score distributions for the Baseline, DDPM, and RADM models under this metric.

The results in Fig. 2 show that the Baseline model’s risk distribution is concentrated in the [0.0, 0.3] range, with a very low proportion of high-risk samples. The DDPM model exhibits an expanded risk range due to the introduction of noise perturbations, but most samples remain in the medium-to-low risk range. In contrast, RADM demonstrates a dense concentration in the high-risk interval (0.6–1.0), with a pronounced right tail, indicating a significantly stronger capability to sample high-risk scenarios compared to the other models.

Furthermore, we group and compare the risk statistical characteristics of the samples generated by the three models from multiple perspectives. The detailed statistical comparisons are reported in Table 1.

When comparing the key metrics mentioned above, it is clear that the RADM model significantly outperforms both Baseline and DDPM across several risky statistical metrics. Firstly, the mean and median risks of the RADM-generated samples are notably higher, indicating that the overall sampling distribution is more concentrated in high-risk areas. Additionally, the proportion of samples from high-risk areas (>0.6) and ultra-high-risk areas (>0.8) reaches 85.2% and 72.3%, respectively, which is much higher than the comparative models, greatly enhancing the coverage of extreme events. Moreover, RADM’s top 10% high-risk mean and the P90 quartile points approach an upper limit close to 1.0, reflecting its elevated extremity in the right-tail distribution. In contrast, the majority of Baseline and DDPM samples are distributed in the low-risk range, making it difficult to generate effective high-risk, long-tail scenarios. Overall, the RADM model not only significantly increases the generation probability and density of high-risk weather samples but also demonstrates stronger targeted risk-sampling capabilities, providing a more challenging scenario base for the safety limit tests of autonomous driving systems.

Diversity and physical distribution coverage analysis

In the task of generating scenarios for autonomous driving tests, in addition to focusing on the ability to generate high-risk weather samples, the diversity and physical plausibility of the scenarios are also key criteria for assessing the generation model. Diverse weather distributions ensure that the autonomous driving system can expose potential weaknesses across the entire test space, preventing the model from falling into a narrow or overfitting region, thus enhancing the comprehensiveness and persuasiveness of the evaluation.

To this end, in this section, we select three key physical attributes—wind speed maximum $\mathrm{V}\mathrm{\_}\mathrm{m}\mathrm{a}\mathrm{x}$, precipitation, and relative humidity (RHU)—and compare the coverage and distribution characteristics of the samples generated by Baseline, DDPM, and RADM using 3D point cloud distribution visualization. As shown in Fig. 3, the sample distribution of Baseline is clearly clustered in a narrow range of low wind speed, low precipitation, and high humidity, lacking the ability to sample extreme weather conditions. Although DDPM generates a broader range of diversified weather, there is still a significant gap in the region of high wind, strong precipitation, and extreme humidity. In contrast, RADM greatly enhances the spatial dispersion and coverage of physical parameters. The point clouds are widely distributed in high wind speed, high precipitation, and varied humidity regions, with a significant increase in boundary samples.

In order to facilitate the visual comparison of the multi-dimensional indicators, Table 2 adopts the format of block grouping:

Comparing the key physical attributes in Table 2, it is evident that the RADM model significantly outperforms both Baseline and DDPM in core metrics such as mean wind speed, maximum wind speed, maximum precipitation, and humidity coverage. The mean extreme wind speed (35.1 m/s), maximum wind speed (51.8 m/s), and extreme precipitation (33.6 mm/h) generated by RADM are at least 30% higher than those produced by the comparative models. Additionally, the high Top10% value further reflects RADM’s stronger coverage in the boundary region. Meanwhile, the humidity distribution shows a lower minimum value and the highest variance, indicating that RADM generates samples with the greatest physical diversity and extremity. These results suggest that RADM offers a broader distribution range and more challenging scenarios for testing of autonomous driving systems.

Visualization of generated weather scenarios

To visually analyze the realism and diversity of the weather scenarios generated by RADM, we present representative screenshots captured in SafeBench–CARLA, as shown in Fig. 4. The results illustrate a broad spectrum of environmental conditions—from clear noon and light fog at dawn to heavy fog at dusk, hard rain at noon, glare rain at sunset, and night scenes with heavy rain and fog—demonstrating the model’s ability to generate diverse yet physically consistent weather states. Each scenario is rendered directly from the weather parameters produced by RADM through the SafeBench interface. The visualization confirms that RADM produces smooth and realistic transitions across multiple meteorological dimensions such as rainfall intensity, fog density, illumination, and visibility, while maintaining coherent lighting and atmospheric effects. In particular, the heavy-rain and night-fog scenes exemplify safety-critical conditions that substantially increase collision likelihood in downstream autonomous-driving evaluations, validating the effectiveness of RADM for high-risk scenario generation.

Assessment of policy migration and generalisation capability

In order to systematically evaluate the generalisation ability of the proposed model under multiple autonomous driving strategies, this article examines the magnitude of collision risk enhancement of Baseline, DDPM and RADM under three mainstream reinforcement learning planners, namely TD3, SAC and PPO. The three strategies represent the typical decision characteristics of deterministic, entropy regularity and trust domain optimisation, respectively, and differ in their robustness and response mechanisms for high-risk scenarios, and thus have a direct impact on the ability of each type of generative model to induce collisions.

The experimental results are shown in Fig. 5. It can be observed that the samples generated by Baseline have limited collision enhancement for all kinds of strategies and weak generalisation ability; DDPM, as unguided diffusion generation, has some breakthroughs but it is difficult to obtain simultaneous enhancement among multiple strategies. In contrast, RADM significantly improves the level of collision rate under all three mainstream strategies, and the distribution of risk enhancement is balanced, indicating that its generation scenario is more universally offensive to different agent-policy. This advantage suggests that RADM can not only provide a worst-case test for a single autonomous driving algorithm, but also be used for multi-model cross-evaluation, which lays the foundation for diverse robustness tests of autonomous driving scenarios.

Comparing the key physical attributes in Table 3, it can be seen that the RADM model significantly outperforms Baseline and DDPM in core metrics such as mean wind speed, maximum wind speed, maximum precipitation, and humidity coverage, etc. The RADM-generated mean extreme wind speed (35.1 m/s), maximum wind speed (51.8 m/s), and extreme precipitation (33.6 mm/h) are at least 30% or more higher than the comparative models. 30% or more, and the high Top10% value also reflects its stronger coverage in the boundary region. Meanwhile, the humidity distribution has a lower minimum value and the largest variance, proving that RADM generates the most physically diverse and extreme samples. This result suggests that RADM is able to bring a greater distribution range and challenge for robustness testing of automated driving systems.

Test effectiveness analysis

Test effectiveness is a critical criterion for evaluating the practical value of adversarial scenario generation. In the context of extreme weather sample generation, it is not sufficient to simply increase test difficulty or collision risk. It is equally essential to demonstrate that the generated scenarios can expose system weaknesses while maintaining stable and valid evaluation. To this end, this section systematically assesses the test effectiveness of RADM and baseline models, considering metrics such as path completion rate, incompletion rate, average speed, and lane departure. This approach ensures that improvements in risk exposure are accompanied by scenarios that remain physically feasible and operationally accessible, thereby supporting credible and meaningful testing outcomes.

The experimental results are presented in Table 4. RADM ensures the successful completion of most test tasks while significantly improving the collision rate and sample diversity. The small differences in path completion rates across the three models suggest that, even in high-risk weather scenarios, the autonomous driving system can still handle the generated scenarios effectively without frequently leading to simulation anomalies or “cheating” phenomena. Meanwhile, changes in lane departure and other indicators remain within a reasonable range, indicating that while the extreme samples increase the challenge for agent control, the overall driving behavior still maintains physical feasibility and system stability.

Further, Table 5 presents a comparison of the performance of the strategies from different models under both standard and extreme storm scenarios. It is evident that RADM generates higher collision rates and lower average speeds under extreme weather, indicating that it increases the test stress while maintaining the underlying rationality and usability of the scenario. The similar performance of the models under standard scenarios further supports the ability of the generated models to balance challenging conditions with realistic constraints.

RADM effectively ensures the test effectiveness of the generated scenarios while enhancing their high risk and diversity. Consequently, it can provide robust and reliable extreme weather samples for large-scale autonomous driving simulation tests.