Style2Risk: A Closed-Loop Testing System for Safety Evaluation of Automated Vehicles Under Style-Conditioned Adversarial Interactions

Highlights

Please indicate how your work links to systems science via your contributions to systems practice, theory, and/or methodology.

• Style2Risk makes interaction style a controllable interface for closed-loop automated-vehicle testing by combining a style-conditioned behavior prior with bounded planner-directed residual actions.
• Its style–interaction–event archive distinguishes newly covered safety-critical regions from repeated discoveries under a common screening protocol.

What are the main findings and/or the implications of the main findings?

• In the 31,500-rollout mechanism-comparison campaign, Style2Risk raises protocol-valid safety-critical events from 110.0 to 258.0 per planner chunk and occupied archive cells from 28 to 33 relative to strict no-style.
• A common trajectory evaluator reports lower joint displacement error and collision rate for Style2Risk, supporting targeted testing without sacrificing motion quality in the evaluated setting.

Abstract

Closed-loop safety evaluation requires traffic agents that expose planner weaknesses without producing arbitrary behavior. Existing adversarial tests often couple behavior generation, risk search, and failure counting, limiting control over how interactions are created and whether repeated events constitute new evidence. Style2Risk uses interaction style as an explicit control interface. Assertiveness and courtesy condition a Gaussian behavior prior, while a bounded residual directs the controlled participant toward the tested planner. Protocol screens retain interactions that satisfy declared action and trajectory constraints, and a style–interaction–event archive separates discovery breadth from repeated observations. We evaluate seven configurations and three planners in 31,500 WOMD–Waymax rollouts. Relative to strict no-style, Style2Risk increases protocol-valid safety-critical events from 110.0 to 258.0 per 500-scenario planner chunk and expands occupied archive cells from 28 to 33. A common trajectory evaluator that does not call the generating prior reports a 1.343 m reduction in joint displacement error, a 0.163 increase in interaction consistency, and a 0.037 reduction in collision rate. A separate 26-scenario experiment assigns style from pre-rollout information and evaluates online archive guidance. The results support style-conditioned control as a practical mechanism for targeted closed-loop testing and explicit evidence accounting.

1. Introduction

Closed-loop safety evaluation tests an automated-vehicle (AV) planner through the feedback created by its own decisions. A traffic participant changes the planner’s next observation, the planner responds, and that response shapes the interaction that follows. This feedback is central to planner safety, yet safety-critical encounters are sparse in passive driving data [1]. Fleet-scale validation is therefore not only a data problem but also a systems problem: the simulator, controlled traffic behavior, AV planner, safety criteria, and failure analysis must operate as one testing loop [2].

The central challenge is to make this loop adversarial without losing control over the behavior being tested. Offline perturbation methods such as AdvSim [3], STRIVE [4], and KING [5] create difficult trajectories before execution, but the perturbed participant cannot adjust its behavior as the planner responds. Risk-seeking traffic policies such as NADE [6], D2RL [7], and CAT [8] introduce closed-loop reactivity, although the resulting interaction is controlled mainly through risk objectives and feasibility constraints. Imitation-based agents [9,10] provide a learned source of traffic motion, but they do not by themselves give the evaluator a direct handle for testing different negotiation styles. What is missing is an interpretable interface that changes how a participant negotiates with the AV while retaining a bounded mechanism for targeted planner probing.

Interaction style provides such an interface. In a merge, lane change, or gap-acceptance encounter, the same geometric conflict can unfold differently when the other participant maintains speed, accepts a smaller gap, yields earlier, or induces less braking from the AV. Style2Risk represents these tendencies through continuous assertiveness and courtesy indicators. The indicators describe an interaction rather than assigning a permanent identity to a driver, which makes them suitable as controllable test conditions.

Style2Risk turns this idea into a closed-loop adversarial interaction mechanism. A style-conditioned Gaussian behavior prior produces the controlled participant’s base delta-pose action. A bounded residual then adds a limited correction directed toward the tested planner. This decomposition gives each component a clear role: the prior controls the behavioral regime, while the residual supplies the planner-facing challenge. The composed action is returned through Waymax, so both agents continue to react throughout the rollout.

Targeted interaction generation also requires evidence that distinguishes breadth from repetition. Style2Risk applies declared action and trajectory screens before recording a safety-critical event. The resulting style–interaction–event archive reports which formal testing regions have been reached and how often later rollouts revisit them. A large event count can therefore be interpreted alongside occupied cells and duplicate concentration rather than being treated automatically as broad discovery.

The evaluation contains a 31,500-rollout WOMD–Waymax mechanism-comparison campaign across seven configurations and three planners. Relative to strict no-style, Style2Risk increases protocol-valid safety-critical events from 110.0 to 258.0 per 500-scenario planner chunk and expands the archive from 28 to 33 occupied cells. A common trajectory evaluator, applied independently of the generating behavior prior, reports lower joint displacement error, higher interaction consistency, and a lower collision rate for Style2Risk. Additional style-sensitivity and pre-rollout experiments test whether the control variables influence the executed policy and whether they can be prescribed without using future trajectory information.

The study makes three contributions:

• An interaction-style control interface for closed-loop AV testing. Assertiveness and courtesy condition the controlled participant before adversarial probing, and the style-sensitivity analysis verifies that both inputs affect the executed policy.
• A style-conditioned adversarial interaction mechanism that combines a learned behavior prior with a bounded planner-directed residual. This separation produces more protocol-valid safety-critical evidence than strict no-style while retaining explicit action constraints.
• A style–interaction–event archive that measures discovery breadth and repeated observations separately. The archive exposes a five-cell expansion in the main campaign and connects categorical coverage to realized trajectory characteristics.

Section 2 positions the work against closed-loop testing, behavior modeling, and coverage-based evaluation. Section 3 and Section 4 define the testing problem and Style2Risk mechanism. Section 5 and Section 6 describe the evaluation and results, followed by the discussion, limitations, and conclusions.

2. Related Work

Style2Risk draws on three lines of research: closed-loop adversarial testing, behaviorally grounded interaction control, and coverage-based safety evaluation. The relevant gap is not the absence of any one component. It is the lack of a common testing loop in which a supported behavior model, a bounded planner-facing intervention, validity screening, and discovery accounting have distinct and inspectable roles.

2.1. Closed-Loop and Adversarial AV Testing

Closed-loop evaluation returns agent actions to the simulator, allowing planning decisions and traffic responses to shape subsequent states [11,12]. WOMD provides large-scale traffic segments with agent trajectories, road geometry, and traffic-light states [13]. Waymax builds on these data with batched rollouts and configurable agent models [11]. WOSAC evaluates autoregressive simulation agents with distributional metrics over kinematics, inter-agent interactions, and map compliance [12]. Complementary datasets such as nuScenes and highD extend the available traffic domains [14,15]. Together, these resources make closed-loop evaluation practical, but they do not determine how a testing participant should challenge a planner.

Adversarial testing adds directed risk exploration to this feedback loop. Trajectory-optimization methods such as AdvSim [3], STRIVE [4], and KING [5] construct challenging perturbations before execution. This provides direct control over the scenario but limits online adaptation by the perturbed participant. NADE [6] and D2RL [7] direct background-agent maneuvers toward informative rare events. CAT [8] instead regenerates scenarios against the current policy during closed-loop adversarial training. In each case, the resulting operating point depends on how risk, feasibility, and naturalism are represented. Surveys of safety-critical scenario generation identify this balance as a recurring design problem [16,17]. Style2Risk approaches it as a separation-of-responsibilities problem: a learned prior supplies the base action, and a bounded residual supplies the planner-directed intervention.

2.2. Behavior Support and Interaction Control

Behavior models provide the support needed to keep a controlled participant within recognizable traffic patterns. TrafficSim [9], TrafficBots [10], and HAD-Gen [18] model heterogeneous agent behavior through learned or style-dependent representations. Interaction datasets likewise organize trajectories around local cooperative and adversarial encounters [19]. Style2Risk adopts this encounter-level granularity. It uses assertiveness and courtesy as explicit indicators rather than treating style only as an unobserved source of variation.

Feasibility-aware adversarial methods provide complementary mechanisms for constraining the test action. SaFeR combines a learned behavior prior with feasible-region constraints during safety-critical token resampling [20]. ScenePilot searches for solvable boundary-band scenarios through constrained multi-objective reinforcement learning [21]. These methods demonstrate that risk search and feasibility must be considered together. Style2Risk differs in where it places the control interface: interaction indicators condition the base distribution, while the residual remains a separate and bounded correction. This factorization allows the evaluation to compare changes in base behavior, residual probing, and screen outcomes within the same action interface.

2.3. Event Coverage and System Positioning

Aggregate event counts measure yield, not discovery breadth. Scenario libraries [22] and parameter-space coverage [23] organize tests by interpretable scenario properties. MAP-Elites offers a general archive mechanism for retaining solutions across user-defined behavior regions [24]. For AV testing, these ideas motivate an archive that records where accepted events occur and whether later events revisit the same region.

Style2Risk uses a 108-cell active archive indexed by interaction style, interaction type, and safety-critical event class. It reports occupied regions and duplicate concentration alongside valid-event yield. In the main campaign, the archive is built after rollout generation and the coverage-labeled residual uses fixed selection metadata. A separate experiment evaluates online occupancy feedback. This design distinguishes categorical breadth from repeated observations without treating every accepted event as a new failure type.

Table 1 uses five observable criteria from the cited method descriptions. Closed-loop interaction requires the generated agent to act on states updated by the tested system. A learned behavior prior is a trajectory-trained action distribution distinct from the risk objective. Feasibility/validity requires explicit action, dynamics, road, or post-rollout constraints. A safety-critical objective must directly target or score hazardous encounters, and diversity/archive output requires an explicit coverage, repertoire, or archive result. A dash means that the cited formulation does not make the capability a primary mechanism, not that the system could never be extended to include it. The comparison positions architectures rather than empirical performance across different benchmarks.

Table 1. Architectural positioning of representative simulation and scenario-generation methods. A filled circle (●) marks an explicit central mechanism, an open circle (∘) marks partial or indirect support, and a dash (–) indicates that the mechanism is not primary in the cited formulation. The table compares system design rather than empirical performance across different benchmarks.

Method	Closed-Loop Agent Interaction	Learned Behavior Prior	Explicit Feasibility or Validity Constraint	Safety-Critical Objective	Diversity or Archive Output
AdvSim [3]	–	∘	∘	•	–
STRIVE [4]	–	•	∘	•	∘
KING [5]	∘	–	•	•	–
NADE/D2RL [6,7]	•	•	∘	•	–
TrafficSim/TrafficBots [9,10]	•	•	∘	–	–
HAD-Gen [18]	•	•	∘	∘	•
CAT [8]	•	∘	∘	•	–
SaFeR [20]	∘	•	•	•	∘
ScenePilot [21]	∘	∘	•	•	∘
Style2Risk	•	•	•	•	•

3. Closed-Loop Testing System Formulation

3.1. Closed-Loop Test and Event Record

The testing system contains the tested planner, the controlled traffic agent, surrounding replay agents, scenario context, protocol screens, and the event archive:

$$\mathcal{T}=\{P_{\mathrm{AV}},A_{\mathrm{ctrl}},A_{\mathrm{replay}},\mathcal{M},\mathcal{V},\mathcal{C}\},$$

(1)

where $P_{\mathrm{AV}}$ is the tested AV planner and $A_{\mathrm{ctrl}}$ is the controlled traffic agent. The terms $A_{\mathrm{replay}}$, $\mathcal{M}$, $\mathcal{V}$, and $\mathcal{C}$ denote the replay agents, map and scenario context, protocol screens, and style–interaction–event archive, respectively. A rollout first produces an interactive trajectory. Safety-critical triggers are then screened and assigned to the archive:

$$\begin{array}{cc}& \mathrm{scenario}\mathrm{context}\to \mathrm{controlled}\mathrm{interaction}\to \mathrm{planner}\mathrm{response}\hfill \\ & \to \mathrm{raw}\text{safety-critical}\mathrm{trigger}\to \mathrm{protocol}\mathrm{screen}\to \mathrm{valid}\mathrm{event}\hfill \\ & \to \mathrm{archive}\mathrm{assignment}\to \{\mathrm{novel},\mathrm{duplicate}\}\to \mathrm{top}\text{-}K\mathrm{storage}.\hfill \end{array}$$

The chain separates raw triggers, protocol-valid safety-critical events, distinct archive cells, and stored exemplars. Non-duplication and storage capacity are applied after event validity. We use safety-critical event because TTC-based near misses are surrogate outcomes rather than confirmed AV failures.

A test begins from a WOMD traffic segment. The initial state $s_0$ contains the tested AV, one controlled traffic agent, surrounding replay agents, and vectorized map context $\mathcal{M}$. The map context includes lane centerlines, boundaries, traffic lights, and road topology. Each rollout uses $T=20$ steps with $\Delta t=0.1$ s, giving a 2.0 s closed-loop horizon after initialization. The controlled-agent action is a delta-pose vector

$$a_t={[\Delta x_t,\Delta y_t,\Delta {\psi }_t]}^{\top }\in {\mathbb{R}}^3,$$

(2)

where $\Delta x_t$ and $\Delta y_t$ are global-plane position increments in meters and $\Delta {\psi }_t$ is a yaw increment in radians for one integration step. At timestep t:

• The AV planner observes $s_t$ and produces action $a_t^{\mathrm{AV}}$;
• The controlled traffic agent produces the delta-pose action $a_t$;
• Replay agents follow pre-recorded trajectories;
• Waymax applies the planner and traffic-agent actions to produce $s_{t+1}$.

The resulting trajectory is $\tau =(s_0,a_0^{\mathrm{AV}},a_0,s_1,\dots ,s_T)$. Because the controlled action changes the next scene state observed by $P_{\mathrm{AV}}$, the planner and testing agent remain coupled throughout the rollout. The replay agents provide the surrounding logged context; the controlled participant and tested AV form the actively updated interaction pair.

3.2. Evaluation Outputs and Objective

A raw safety-critical candidate is produced from the saved closed-loop trajectory. The main detector first assigns collision when the minimum centre distance falls below the geometry-dependent overlap threshold. Otherwise, it assigns severe near miss when the minimum Time-to-Collision (TTC) is below 1.5 s. For each AV–agent pair, TTC is Euclidean separation divided by relative-speed magnitude at states with positive closing motion; the minimum over valid pairs and timesteps is used. The common evaluator and pre-rollout validation retain six multi-label triggers: collision; TTC < 1.5 s; nonnegative PET < 1.0 s; DRAC > 3.35 m/s²; either agent’s longitudinal acceleration ≤ −4.0 m/s²; and deadlock. Deadlock requires at least five terminal states, mean pair speed below 0.2 m/s over those states, and initial mean pair speed above 1.0 m/s. The prioritized primary class is collision, severe near miss, trajectory conflict (PET or DRAC), hard braking, then deadlock. Jerk and the saved Waymax off-road diagnostic enter the motion screen and are also reported separately.

The evaluation uses two complementary validity functions. The main campaign applies

$$I_{\mathrm{valid}}^{\mathrm{main}}\left(\tau \right)=I_{\mathrm{trig}}\left(\tau \right)I_{\mathrm{support}}\left(\tau \right)I_{\mathrm{geo}}\left(\tau \right).$$

(3)

Here, $I_{\mathrm{support}}$ contains the behavior prior’s self-NLL together with action, acceleration, jerk, clipping, and the saved Waymax off-road diagnostic. The geometric screen passes when the saved trajectory has no collision and its minimum pair distance is either unavailable or greater than 2.0 m. Because the self-NLL is relative to the behavior prior used by each configuration, this protocol measures internal support rather than providing a common motion-quality comparison. We therefore apply a second trajectory evaluator to all configurations:

$$I_{\mathrm{valid}}^{\mathrm{common}}\left(\tau \right)=I_{\mathrm{trig}}\left(\tau \right)I_{\mathrm{motion}}\left(\tau \right),$$

(4)

where $I_{\mathrm{motion}}$ applies the same trajectory, interaction, and action-constraint criteria to every configuration without calling either generating prior. The first protocol measures compliance with the implemented testing constraints, while the second compares trajectory quality on a common scale.

Each valid safety-critical event is assigned to one archive cell:

$$c\left(\tau \right)=\left[b\left(z_{\mathrm{assert}}^{\mathrm{arc}}\right),b\left(z_{\mathrm{courtesy}}^{\mathrm{arc}}\right),c_{\mathrm{interaction}},f_{\mathrm{event}}\right],$$

(5)

where $b(·)$ maps an archive style measurement to low, mid, or high. The main archive uses the prescribed interaction-style proxies, and its active event dimension contains collision and severe near miss. The common-evaluator archive additionally assigns cells from post-rollout realized style. The pre-rollout validation records intended and realized assignments separately; only intended style and pre-rollout context can affect online guidance. The interaction category covers unprotected intersection, merge, lane-change competition, following pressure, yield/gap acceptance, and other.

For either declared protocol, let $N_{\mathrm{valid}}={\sum }_{n=1}^N{I}_{\mathrm{valid}}\left({\tau }_n\right)$ and let ${\mathcal{C}}_{\mathrm{valid}}=\{c\left({\tau }_n\right):I_{\mathrm{valid}}\left({\tau }_n\right)=1\}$ be the set of occupied cells. For a stated rollout order, the first valid event assigned to a cell is a novel insertion and every later valid event in that cell is a duplicate. Thus, $N_{\mathrm{valid}}=N_{\mathrm{novel}}+N_{\mathrm{dup}}$, with $N_{\mathrm{novel}}=\left|{\mathcal{C}}_{\mathrm{valid}}\right|$. The duplicate rate is

$$r_{\mathrm{dup}}=\left\{\begin{array}{cc}1-{\displaystyle \frac{|{\mathcal{C}}_{\mathrm{valid}}|}{N_{\mathrm{valid}}}},\hfill & N_{\mathrm{valid}}>0,\hfill \\ 0,\hfill & N_{\mathrm{valid}}=0.\hfill \end{array}\right.$$

(6)

This definition keeps valid-event yield and archive breadth separate. A duplicate remains valid but does not increase the occupied-cell count. After all rollouts are generated, the implementation ranks events within each cell and stores at most $K=3$ exemplars. This post hoc capacity changes only the number of stored rows; it does not reject valid events or alter cell occupancy.

Effective Normalized Failure Discovery Rate (ENFDR) expresses occupied cells per evaluated scenario:

$$\mathrm{ENFDR}={\displaystyle \frac{|{\mathcal{C}}_{\mathrm{valid}}|}{N}},$$

(7)

where N is the number of unique scenarios in the stated evaluation unit. Campaign results also report the raw occupied-cell count, active-grid coverage $|{\mathcal{C}}_{\mathrm{valid}}|/|\mathcal{G}|$, and occupied cells per rollout. The main archive has $\left|\mathcal{G}\right|=108$ active cells. The online-guidance validation uses a 135-cell archive indexed by intended assertiveness, intended courtesy, pre-rollout context, and five primary event classes. Supporting outputs include $N_{\mathrm{valid}}$, $N_{\mathrm{dup}}$, $N_{\mathrm{stored}}$, capacity rejections, collision and trajectory diagnostics, and discovery-versus-budget curves.

4. The Style2Risk Closed-Loop Testing System

Style2Risk instantiates the controlled traffic agent in the evaluation loop. Its central design choice is to separate behavior generation from planner-directed probing. The style-conditioned prior supplies a base action supported by the learned model, and the bounded residual modifies that action under explicit trust-region constraints.

4.1. Overview: Controlled Agent in Closed-Loop Evaluation

Given a WOMD scenario, the selected traffic participant receives the map context, surrounding-agent state, and current AV planner state. It then produces one delta-pose action for the next simulation step. Figure 1 shows the complete data flow. Scenario and map inputs initialize the planner, replay agents, and controlled participant. The intended style vector conditions the behavior prior, and the residual modifies the proposed base action. Waymax executes the composed action and returns the next state to both interacting agents.

Figure 1. Style2Risk system overview. The main campaign prescribes a proxy from the logged two-agent segment once and holds it fixed during rollout; the separate validation assigns style from pre-rollout information. Style conditions both the Gaussian prior and the residual factor chain. Waymax returns the next scene state, and post-rollout internal screens and a common evaluator that does not call the generating prior produce event, motion, and archive evidence. Dashed feedback is used only in the online-guidance validation. Solid arrows denote the forward state/action flow, the dashed arrow denotes optional online-guidance feedback, and the panel colors distinguish scenario context, style indicators, behavior prior, residual control, and evidence evaluation.

The evaluation path begins after execution. Safety-surrogate triggers pass through the internal-support and geometric screens before the archive records valid events, occupied cells, and duplicate observations. In the main campaign, the coverage factor uses target metadata fixed before rollout and the archive summarizes the completed trajectories. The separate online-guidance experiment updates archive occupancy after each evaluated rollout and uses that state when constructing the next residual action.

4.2. Continuous Interaction-Style Indicators

The interaction-style vector provides the control interface for the testing agent:

$$z=[z_{\mathrm{assert}},z_{\mathrm{courtesy}}]\in {[0,1]}^2.$$

(8)

For each two-agent WOMD segment, the proxy labels are deterministic functions of trajectory measurements. Let $\Delta p$ be the second agent’s progress minus the first agent’s progress, and let $\Delta v$ be their mean-speed difference. We denote minimum separation by g and minimum positive TTC by $T_c$, setting $T_c=3$ s when unavailable. The remaining terms are induced deceleration $d_{\mathrm{ind}}$, maximum DRAC D, and nonnegative PET P. With ${\left[x\right]}_{+}=\max (0,x)$ and logistic function $\sigma (·)$, the implemented labels are

$$z_{\mathrm{assert}}=\sigma \left(0.7{\displaystyle \frac{\Delta p}{20}}+0.5{\displaystyle \frac{\Delta v}{8}}+0.6{\displaystyle \frac{{[20-g]}_{+}}{20}}+0.3{\displaystyle \frac{{[3-T_c]}_{+}}{3}}\right),$$

(9)

$$z_{\mathrm{courtesy}}=\sigma \left(0.8{\displaystyle \frac{{[g-5]}_{+}}{30}}-0.7{\displaystyle \frac{d_{\mathrm{ind}}}{5}}-0.4{\displaystyle \frac{D}{10}}+0.2{\displaystyle \frac{P}{5}}\right).$$

(10)

The denominators place the measurements on comparable numerical ranges, and the weights encode the intended signs and relative emphasis of the trajectory terms. They were set heuristically and fixed before the main campaign rather than optimized on its results. The resulting values describe local negotiation within an encounter and do not assign a persistent identity to either driver.

These indicators summarize local interaction tendencies in a specific encounter rather than human-labeled driving-style annotations. The style encoder $E_{\theta }$ maps the two normalized agent-trajectory sequences to a bounded two-dimensional estimate:

$$\widehat{z}=E_{\theta }({\tau }_i,{\tau }_j)=\left[{\widehat{z}}_{\mathrm{assert}},{\widehat{z}}_{\mathrm{courtesy}}\right]\in {[0,1]}^2.$$

(11)

Here, ${\tau }_i$ and ${\tau }_j$ are the two interacting-agent trajectories used to construct the training segment. Two sigmoid heads produce the assertiveness and courtesy proxy estimates.

The encoder receives two normalized trajectory sequences. Each timestep contains relative position, sine and cosine of heading, planar velocity, vehicle length, and width. A two-layer relational sequence encoder with attention enabled produces the two proxy estimates. Training minimizes the implemented proxy-prediction loss with Adam; rank correlation, monotonicity across binned labels, and early/late-window consistency are reported as evaluation diagnostics rather than separate training objectives. On the scenario-level validation partition, the predictions achieve Pearson correlations of 0.962 for assertiveness and 0.743 for courtesy against their deterministic trajectory-derived targets. These values measure internal label consistency, not independent validation of human driving style.

The trajectory-derived proxy, intended test style, encoder prediction, and realized rollout behavior serve different roles. Proxy construction and encoder training use the complete 91-state logged two-agent segment because the target describes the interaction as a whole. In the main campaign, the stored proxy is prescribed once at initialization and held fixed for all 20 steps; the encoder is not called during rollout. This experiment therefore tests how the controller responds to an offline interaction-style condition. The separate pre-rollout validation assigns style without using the logged future. In both protocols, realized speed, gap, and deceleration descriptors are computed only after execution.

4.3. Style-Conditioned Behavior Prior

The behavior prior supplies the controlled agent’s base delta-pose action. It models ${\pi }_{\mathrm{base}}(a_t\mid x_t,z)$ from an 18-dimensional pair-state feature $x_t$ and the intended interaction-style vector. The feature contains relative position, both headings, both planar velocities and speeds, relative velocity, pair distance, and vehicle dimensions. A multilayer perceptron encodes $x_t$, and Feature-wise Linear Modulation (FiLM) injects z through the hidden layers. Map data remain part of the Waymax scene and the saved Waymax off-road diagnostic but are not inputs to this action prior.

The output head is a diagonal Gaussian:

$${\pi }_{\mathrm{base}}\left(a_t\right|x_t,z)=\mathcal{N}\left(a_t;{\mu }_{\theta }(x_t,z),\mathrm{diag}{\sigma }_{\theta }^2(x_t,z)\right),$$

(12)

where separate heads predict the three-dimensional mean and log standard deviation. Rollouts execute the deterministic mean $a_t^{\mathrm{base}}={\mu }_{\theta }(x_t,z)$; the predicted variance supplies the internal base-policy NLL statistic used by the protocol screen.

The prior is trained via behavior cloning on WOMD segments:

$${\mathcal{L}}_{\mathrm{base}}=-{\mathbb{E}}_{(x_t,a_t^{*},z)\sim \mathcal{D}}\left[\log {\pi }_{\mathrm{base}}\left(a_t^{*}\right|x_t,z)\right],$$

(13)

where $a_t^{*}$ is the recorded next-step delta pose. The no-style branch removes the style input while retaining the same state features, hidden width, action head, and Gaussian NLL objective. A style-grid check evaluates the action mean at the nine configurations in ${\{0.2,0.5,0.8\}}^2$. The resulting base-action sensitivity of 0.26–0.30 shows that the intended indicator vector changes the prior output before residual probing.

4.4. Bounded Residual Action for Adversarial Interaction

The bounded residual converts the prior action into a planner-directed test action without replacing the behavior prior. Its coefficients were selected during method development and fixed before the 500-scenario campaign. The sensitivity analysis evaluates this design under alternative residual bounds.

The controlled-agent action is

$$a_t^{\mathrm{adv}}=\mathrm{clip}\left(a_t^{\mathrm{base}}+\Delta a_t^{\mathrm{res}},\mathcal{B}\right),$$

(14)

where $a_t^{\mathrm{base}}={\mu }_{\theta }(x_t,z)$ and $\mathcal{B}$ denotes the component and norm bounds applied by the rollout implementation. Both terms use the delta-pose action coordinates defined in Section 3, so the base action and correction remain identifiable at every step.

The residual magnitude is computed through a factor chain:

$${\rho }_t=\mathrm{clip}\left({\delta }_{\mathrm{base}}{\alpha }_{\mathrm{style}}\left(z\right){\alpha }_{\mathrm{attrib}}{\alpha }_{\mathrm{cover}}{\alpha }_{\mathrm{isolated}}{\alpha }_{\mathrm{transfer}},0,{\delta }_{xy}\right).$$

(15)

Let ${\tilde{\mathbf{d}}}_t$ be the weighted planar direction produced from the current pair geometry and ${\mathbf{d}}_t={\tilde{\mathbf{d}}}_t/{\parallel {\tilde{\mathbf{d}}}_t\parallel }_2$ when its norm is nonzero. Let ${\psi }_t$ be the controlled participant’s yaw. The residual is

$$\Delta a_t^{\mathrm{res}}=\left[\begin{array}{c}{\rho }_t{d}_{t,x}\\ {\rho }_t{d}_{t,y}\\ \mathrm{clip}\left(\mathrm{wrap}\left(\mathrm{atan}2(d_{t,y},d_{t,x})-{\psi }_t\right),-{\delta }_{\mathrm{yaw}},{\delta }_{\mathrm{yaw}}\right)\end{array}\right].$$

(16)

The scalar ${\delta }_{\mathrm{base}}=0.62{\delta }_{xy}$ preserves modulation headroom. The style factor changes residual magnitude with assertiveness and courtesy. The attribution and coverage factors use target metadata fixed before the campaign, rather than the current occupancy of an online archive. The direction ${\mathbf{d}}_t$ combines an AV-facing unit vector with a tangential component. The transfer factor is used only in the additional-signal variant.

The default implementation uses the following:

• ${\alpha }_{\mathrm{style}}\left(z\right)=\max (0.45,\min (1.05,0.60+0.32z_{\mathrm{assert}}-0.16z_{\mathrm{courtesy}}))$ modulates the residual magnitude by style.
• ${\alpha }_{\mathrm{attrib}}=1.20$ when targeting underexplored event categories, $0.38$ otherwise.
• ${\alpha }_{\mathrm{cover}}=1.25$ for empty formal cells, $1.02$ for empty pair cells, $0.58$ for occupied cells.
• ${\alpha }_{\mathrm{isolated}}=1.08$ when the frozen target metadata marks an isolated trigger, $1.00$ otherwise.
• ${\alpha }_{\mathrm{transfer}}=1.10$ when the pair-to-formal signal is present and $0.90$ otherwise in Style2Risk. The Style2Risk+ extension uses 1.12 and 0.92 together with the isolated-trigger signal.
• $\tilde{\mathbf{d}}=0.70\mathbf{u}+0.30\mathbf{t}$ when a severe-gap target is new in either the formal- or pair-level frozen metadata, and $0.18\mathbf{u}+0.82\mathbf{t}$ otherwise, where $\mathbf{u}$ is the unit vector toward the AV’s predicted position and $\mathbf{t}$ is the oriented perpendicular tangent. The implementation normalizes $\tilde{\mathbf{d}}$ before applying ${\rho }_t$.

The rollout implementation constrains both the residual and the composed action:

$${\parallel \Delta a_{xy}\parallel }_2\le {\delta }_{xy}=0.15\mathrm{m},$$

(17)

$$\left|{\Delta }_{\mathrm{yaw}}\right|\le {\delta }_{\mathrm{yaw}}=0.04\mathrm{rad},$$

(18)

$${\parallel a_{xy}^{\mathrm{base}}\parallel }_2\le 2.5\mathrm{m},$$

(19)

$${\parallel a_{xy}^{\mathrm{adv}}\parallel }_2\le 2.8\mathrm{m},\left|a_{\mathrm{yaw}}^{\mathrm{adv}}\right|\le 0.40\mathrm{rad}.$$

(20)

Here, $\Delta a_{xy}$ contains the two planar residual components. The base and composed actions are clipped to their stated step bounds during rollout, and every activation is counted. In the main protocol, $I_{\mathrm{support}}=1$ when five conditions hold: mean base-policy self-NLL is at most 20; controlled-agent acceleration and jerk are at most 12 m/s² and 150 m/s³; the saved Waymax off-road diagnostic does not activate; the residual bound holds; and no feasibility clip is activated. The self-NLL is $-\log {\pi }_{\mathrm{base}}({\mu }_{\theta }(x_t,z)\mid x_t,z)$ averaged over steps. The common trajectory evaluator removes this prior-relative term and applies the same motion and constraint screen to every method. Section 6.6 evaluates alternative residual bounds.

4.5. Style–Interaction–Event Archive

The style–interaction–event archive exposes the structure hidden by an aggregate event count. For the two event classes in the main campaign, the active archive $\mathcal{C}$ is a $3\times 3\times 6\times 2=108$-cell grid indexed by prescribed assertiveness, prescribed courtesy, interaction type, and event type. Every event that passes the trigger, internal-support, and geometric screens contributes to valid-event yield. Its cell assignment either occupies a new region or increments the duplicate count for a represented region.

The main runner generates all rollouts before constructing the archive. It ranks valid events within each cell and retains at most three exemplars, while the complete rollout rows remain available for event counting. Storage capacity therefore changes the retained examples but not event validity or occupied cells. The online-guidance experiment uses a distinct 135-cell archive, resets it for each planner, and updates it after each rollout so that occupancy can influence the next test action.

5. Experimental Design

5.1. Data and Platform

All configurations use WOMD v1.2.0 validation records and the same Waymax interface, rollout horizon, planners, and trajectory recorder. Dataset construction extracts 30,000 SDC–participant segments from 685 unique WOMD scenarios and assigns complete scenario IDs to 480 training, 99 validation, and 106 test scenarios. These partitions contain 20,785, 4690, and 4525 interaction segments, respectively. All pairs from a scenario remain in one partition. The style encoder and behavior prior use the training partition, and validation loss selects their checkpoints.

The main campaign selects one eligible SDC–participant pair from each of 500 scenarios in this pool. Here, 685 denotes unique scenario records, while 500 is the fixed evaluation subset. Both selected tracks remain valid from initialization through the 20-step rollout. The subset contains 349 training, 71 validation, and 80 test scenario IDs; its stratified selection also uses coverage statistics from an earlier baseline run. This common interaction-rich pool supports the mechanism comparison. Section 5.3 introduces a separate validation set with no model-development or prior-experiment overlap. The interaction-type distribution is given in Table 2.

Table 2. Interaction-type distribution of the main 500-scenario subset. Exactly one controlled SDC–participant pair is selected in each scenario.

Interaction Type	Scenarios/Controlled Pairs	Share
Following pressure	67	13.4%
Lane-change competition	131	26.2%
Merge	69	13.8%
Other	61	12.2%
Unprotected intersection	110	22.0%
Yield/gap acceptance	62	12.4%
Total	500	100.0%

Waymax executes 20 closed-loop steps at 0.1 s per step. Three fixed planners control the tested AV. Logged-trajectory reference follows the next recorded WOMD state. Reactive log-braking follows the log and reduces the next-step displacement when the controlled participant is ahead and within 12 m. Cautious gap-braking applies a stronger reduction when the participant is ahead and within 18 m. These planners are deterministic under the recorded scene state; the three seeds affect only stochastic residual variants.

5.2. Main Evaluation Campaign

The main campaign comprises 31,500 closed-loop rollouts: 500 selected scenarios, seven configurations, three planners, and stored seed labels 42, 43, and 44. Each configuration contributes 4500 rollout records. The deterministic configurations produce identical trajectories across the three seed labels. We therefore report planner-level results from the distinct executions and use scenarios, rather than repeated seed files, as the unit of uncertainty. All trajectory metrics are computed from the saved closed-loop trajectories using the definitions in Section 3.

5.3. Pre-Rollout Style and Online-Guidance Validation

The second experiment evaluates style prescription and archive guidance without using future trajectory information. It uses the 26 test scenarios that are absent from the encoder/prior training and validation partitions and from all earlier campaigns. Scenario order is fixed before execution. The controlled participant is selected from its object type and states available through initialization step 10; logged future states, failure outcomes, archive gaps, and earlier method results are not used.

Each scenario receives a prescribed style from a balanced $3\times 3$ grid with assertiveness and courtesy levels $\{0.2,0.5,0.8\}$. The intended style is fixed before rollout, while realized speed, gap, and deceleration descriptors are measured after execution. Four coefficient-matched configurations pair a no-style or style-conditioned prior with a uniform residual, then add style-modulated residual control without and with online archive guidance. This design isolates the effects of style conditioning, style-modulated probing, and occupancy-aware guidance in 312 rollouts.

For this validation, $B={\delta }_{xy}=0.15$ m is the planar residual budget. The uniform residual has magnitude $0.25B$ and normalized direction $\mathcal{N}(0.35\mathbf{u}+0.65\mathbf{t})$, where $\mathcal{N}\left(\mathbf{v}\right)=\mathbf{v}/{\parallel \mathbf{v}\parallel }_2$ for nonzero $\mathbf{v}$. The style residual has pre-clip magnitude

$$m_z=0.55B(0.25+0.75A)(1-0.35C)$$

(21)

and normalized direction $\mathcal{N}\left(\right(0.45+0.25A)\mathbf{u}+(0.55-0.25A\left)\mathbf{t}\right)$, where A and C are prescribed assertiveness and courtesy. The online-guidance configuration multiplies $m_z$ by 1.18 when its intended-style/pre-context target has not appeared among earlier protocol-valid events for that planner, and by 0.85 otherwise. The archive starts empty and is reset for each planner; it is updated only after the current rollout is evaluated. Its 135 cells are the product of three intended-assertiveness bins, three intended-courtesy bins, three pre-rollout context bins, and five prioritized primary-event classes. All four configurations use the same fixed evaluator, which does not call either behavior prior. It reports kinematic, collision, saved Waymax off-road, interaction-consistency, conflict-geometry, deceleration, and constraint-activation metrics.

5.4. Method Configurations

Seven mechanism variants compare how the implemented policy branches change the main campaign. Their residual modules use branch-specific coefficients and direction weights, so the sequence shows where performance changes occur but is not a coefficient-matched ablation. The four-configuration pre-rollout validation provides the factor-isolated comparison.

• Strict no-style: no style conditioning in the behavior prior or residual action; all residual factors are neutral.
• Style base + uniform reactive residual: a style-conditioned prior with a reactive residual that is not modulated by style.
• Style residual: the style-only magnitude and direction rule.
• Style + attribution: the style–attribution rule for severe-gap versus other targets.
• Style + coverage: the style–coverage rule using static formal/pair-gap metadata.
• Style2Risk: the proposed style–attribution–coverage configuration with pair-to-formal scaling.
• Style2Risk+: an extended configuration that adds isolated-trigger and strengthened pair-to-formal factors.

The strict no-style configuration uses a separately trained state-only Gaussian prior and a fixed low-strength residual. Configuration (2) restores the style-conditioned prior while retaining that residual. The remaining rows progressively add style modulation, attribution, coverage, and the optional additional signals. The residual factors and branch definitions are specified in Section 4.4 and Appendix A.

The development-stage matched comparison adds three same-interface controls on a 50-scenario subset for each planner. Let $B=0.15$ m, let $\mathcal{N}$ normalize a nonzero planar vector, and let d be pair distance. Their implemented residuals are

$${\rho }_{\mathrm{uniform}}=0.25B,{\mathbf{d}}_{\mathrm{uniform}}=\mathcal{N}(0.35\mathbf{u}+0.65\mathbf{t}),$$

(22)

$$\theta \sim \mathcal{U}[-\pi ,\pi ],r\sim \mathcal{U}[0.25,1],{\rho }_{\mathrm{random}}=rB,{\mathbf{d}}_{\mathrm{random}}={[\cos \theta ,\sin \theta ]}^{\top },$$

(23)

$$q=\mathrm{clip}\left(\right(12-d)/12,0,1),{\rho }_{\mathrm{risk}}=0.78B(0.70+0.30q),{\mathbf{d}}_{\mathrm{risk}}=\mathbf{u},$$

(24)

$${\rho }_{\mathrm{post}}=B,{\mathbf{d}}_{\mathrm{post}}=\mathcal{N}(0.88\mathbf{u}+0.12\mathbf{t}).$$

(25)

All controls use the common yaw bound. The post hoc control applies full-strength pressure before the after-rollout screen. This 50-scenario development subset is used to compare residual behavior under a matched interface; the 500-scenario campaign and the separate 26-scenario validation provide the main evidence.

5.5. Metrics

The evaluation reports raw triggers, protocol-valid events, novel and duplicate events, stored exemplars, occupied cells, collision outcomes, action and dynamics diagnostics, and style sensitivity. The internal-support pass rate contains the generating prior’s self-NLL and measures compliance with the main testing protocol. Motion quality is evaluated separately with the common trajectory evaluator. We retain the internal composite $\mathrm{ENFDR}\times r_{\mathrm{support}}\times r_{\mathrm{geo}}$ only as a compact summary of that protocol’s operating point.

ENFDR divides the number of distinct formal cells by the unique-scenario budget of the stated unit. In the main campaign, 33 cells give $33/500=0.066$. The same result is reported as 33 raw cells, $33/108=0.306$ active-grid coverage, and $33/4500=0.0073$ cells per stored method rollout. Campaign-level ENFDR and the 50-scenario development value are reported separately because they use different scenario budgets.

5.6. Statistical Analysis

The design is paired by scenario: every configuration is evaluated on the same selected scenes under each planner. We report planner-specific point estimates and treat the three planners as fixed tested systems rather than exchangeable replicates. Deterministic seed copies are collapsed before uncertainty analysis. For the headline contrasts, we average planner-specific method differences within each scenario and apply a scenario-level paired bootstrap and sign-permutation test. Archive unions are recomputed within 10,000 scenario-bootstrap samples. The Style2Risk-minus-strict archive gain is five cells with a 95% percentile interval of $[2,7]$. For online guidance, the one-cell point difference has an interval of $[0,1]$. Five hundred shuffled scenario orders quantify partial-budget discovery; the complete 500-scenario union is order-invariant.

5.7. Computational Scope

The campaign contains 63,000 s of simulated interaction (31,500 rollouts × 2.0 s). The experiments ran on NVIDIA Corporation (Santa Clara, CA, USA) A100-SXM4-80GB GPUs, with one JAX CUDA device assigned to each experiment chunk. Recorded chunk times total 88,318 s, or 24.53 A100 GPU-hours, corresponding to a coarse campaign average of 2.80 s per rollout. The common trajectory evaluator required 595.7 s and 1880.5 MiB (1.84 GiB) maximum resident CPU memory. At each step, the fixed-width behavior prior and constant-size residual factor chain have $O\left(1\right)$ cost with respect to campaign size. Archive assignment is $O\left(1\right)$ per event, followed by linear aggregation over rollout rows.

6. Results

The results test three questions. First, does style-conditioned interaction control produce more protocol-valid safety-critical evidence than no-style control? Second, does the additional yield extend archive coverage rather than only repeat represented events? Third, does the motion remain competitive under a trajectory evaluator shared by all configurations? Mechanism comparisons and the pre-rollout validation then examine where these effects arise.

6.1. Style2Risk Increases Valid-Event Yield and Archive Breadth

Style2Risk produces substantially more safety-critical events that satisfy the main testing protocol. Relative to strict no-style, the mean valid-event count rises from 110.0 to 258.0 per 500-scenario planner chunk. The internal-support pass rate rises from 0.386 to 0.901, and the geometric-screen pass rate rises from 0.951 to 0.987. The support rate measures compliance with the implemented behavior-prior and motion constraints; Section 6.2 evaluates motion quality with a common prior-independent protocol. Figure 2 and Table 3 summarize these campaign-level results.

Figure 2. Main comparison across strict no-style (NS), style base with a uniform residual (SB), Style2Risk (S2R), and Style2Risk+ (S2R+). The panels show complementary views of testing performance: archive breadth, protocol-valid event yield, and internal-support compliance.

Table 3. Main WOMD–Waymax campaign (31,500 stored rollouts). ENFDR and cells are campaign-union quantities normalized by 500 unique scenarios; Valid, Support, Geo., Duplicate, and Composite are means over the three distinct planners after deterministic seed copies are collapsed.

Method	ENFDR	Cells	Valid	Support	Geo.	Duplicate	Composite
Strict no-style	0.056	28	110.0	0.386	0.951	0.745	0.0205
Style base + uniform reactive residual	0.056	28	173.3	0.567	0.954	0.838	0.0303
Style2Risk	0.066	33	258.0	0.901	0.987	0.872	0.0587
Style2Risk+	0.066	33	256.7	0.898	0.987	0.871	0.0585

The additional yield is accompanied by a measurable expansion of formal discovery breadth. ENFDR increases from 0.056 to 0.066, and the campaign union grows from 28 to 33 occupied cells. These values correspond to 25.9% and 30.6% of the 108-cell active grid, or 0.0062 and 0.0073 occupied cells per 4500 rollout evaluations. The duplicate rate also rises from 0.745 to 0.872. Style2Risk therefore reaches new archive regions while continuing to revisit several exposed regions, which is precisely the distinction that aggregate event counts cannot show.

The style-conditioned prior already increases the mean valid-event count from 110.0 to 173.3 when paired with a uniform residual. Adding style-modulated probing, attribution, and coverage produces the 258.0-event result and the five-cell expansion. Style2Risk+ reaches the same 33-cell union with 256.7 valid events and a 0.898 internal-support pass rate. These results place the main transition in the style-conditioned and style-modulated branches rather than in the optional additional signals.

Table 4 summarizes the same result by event yield, protocol compliance, discovery breadth, and search concentration.

Table 4. Complementary testing outcomes for strict no-style and Style2Risk in the 500-scenario campaign. Planner-level quantities collapse identical deterministic executions.

Metric	Strict	Style2Risk	Definition
Valid events/planner chunk	110.0	258.0	Events passing the frozen protocol screens in 500 scenarios.
Internal-support pass rate	0.386	0.901	Configuration-specific prior support and trajectory checks.
Occupied active cells	28/108	33/108	Campaign union over style, interaction, and event categories.
Cells/unique scenarios	0.056	0.066	Occupied cells normalized by the 500 unique scenarios.
Cells/stored method rollouts	0.0062	0.0073	Same campaign union divided by 4500 stored rollouts.
Duplicate rate	0.745	0.872	Duplicates remain valid but do not expand the union.

6.2. Motion Quality Under a Common Trajectory Evaluator

Style2Risk retains stronger motion quality than strict no-style when both are assessed by the same trajectory evaluator. Across the 500 paired scenarios, joint ADE decreases by 1.343 m (95% paired-bootstrap CI $[1.199,1.488]$), joint speed MAE decreases by 1.464 m/s $[1.285,1.646]$, interaction consistency increases by 0.163 $[0.143,0.182]$, collision rate decreases by 0.037 $[0.021,0.055]$, and the common-evaluator pass rate increases by 0.587 $[0.537,0.637]$. Scenario-level sign-permutation tests give $p<0.0001$ for the headline contrasts. Table 5 reports the corresponding values for each tested planner.

Table 5. Motion quality under a common trajectory evaluator in the 500-scenario campaign. Panel (a) reports trajectory and interaction outcomes; Panel (b) reports motion extrema and a saved Waymax off-road diagnostic. All rows use the same frozen common trajectory evaluator.

(a) Trajectory and interaction outcomes
Method	Planner	Pass	Joint ADE (m)	Joint speed MAE (m/s)	Interaction consistency	Collision
Style2Risk	Logged reference	0.736	1.026	0.945	0.659	7/500
Style2Risk	Reactive	0.736	1.041	0.970	0.658	4/500
Style2Risk	Cautious	0.734	1.065	0.997	0.657	4/500
Strict no-style	Logged reference	0.148	2.355	2.396	0.496	25/500
Strict no-style	Reactive	0.148	2.383	2.438	0.495	23/500
Strict no-style	Cautious	0.148	2.421	2.468	0.495	23/500
(b) Motion extrema and saved diagnostic
Method	Planner	Mean max. $\left|a\right|$ (m/s2)		Mean max. $\left|j\right|$ (m/s3)	Saved Waymax off-road flag
Style2Risk	Logged reference	10.890		80.1	3/500
Style2Risk	Reactive	10.899		80.0	3/500
Style2Risk	Cautious	10.921		79.5	3/500
Strict no-style	Logged reference	24.582		197.7	3/500
Strict no-style	Reactive	24.601		197.3	3/500
Strict no-style	Cautious	24.548		196.6	3/500

Speed MAE is measured against the logged track. Acceleration and jerk are means of per-rollout absolute maxima. The saved Waymax flag is reported as a diagnostic, not as an independently reconstructed roadgraph metric or an official WOSAC off-road score.

The evaluator also reports displacement, final displacement, speed, acceleration, jerk, minimum distance, relative speed, conflict geometry, deceleration, and action-constraint activations. The saved Waymax off-road flag activates in 3/500 rollouts for both methods under every planner. We report it as a diagnostic, not as an independently reconstructed roadgraph metric or an official WOSAC off-road score; map-compliance scope is discussed in Section 8.

Table 6 uses realized post-rollout style for archive assignment. For every planner–method pair, protocol-valid events equal novel plus duplicate events, and they also equal stored plus capacity-rejected events. These counts complement the main 110/258 comparison because they use realized style and the common trajectory screen.

Table 6. Event accounting under the common trajectory screen and realized-style archive. Archive capacity controls exemplar storage while protocol-valid yield counts all events that pass the screen.

Method	Planner	Raw Triggers	Protocol-Valid	Novel/Cells	Duplicate Valid	Stream Stored	Capacity Rejected
Style2Risk	Logged reference	377	251	58	193	114	137
Style2Risk	Reactive	378	252	63	189	126	126
Style2Risk	Cautious	381	254	65	189	132	122
Strict no-style	Logged reference	446	67	30	37	52	15
Strict no-style	Reactive	446	67	31	36	55	12
Strict no-style	Cautious	448	67	33	34	58	9

The order-dependent discovery curves are shown in Figure 3.

Figure 3. Realized-style archive discovery versus rollout budget. Lines are means over 500 shuffled scenario orders; bands are 95% empirical intervals. The final union is order-invariant, whereas partial-budget discovery depends on order.

Style2Risk discovers archive regions faster than strict no-style in the early rollout budget. At 100 rollouts, it reaches 25.8 cells $[20.0,31.0]$ for the logged reference, 27.9 $[22.0,33.0]$ for the reactive planner, and 28.9 $[23.5,35.0]$ for the cautious planner. Strict no-style reaches 10.2 $[6.0,14.0]$, 10.8 $[6.0,16.0]$, and 11.1 $[6.0,17.0]$, respectively. At the full budget, the order-invariant unions are 58, 63, and 65 cells for Style2Risk, compared with 30, 31, and 33 for strict no-style.

6.3. Style-Interaction Archive Coverage and Concentration

Style2Risk reaches five formal cells that are absent under strict no-style. This increases active-grid coverage from 28 cells (25.9%) to 33 cells (30.6%). A 10,000-replicate scenario bootstrap gives a five-cell difference with a 95% percentile interval of $[2,7]$. Figure 4 locates the additional cells in the $3\times 3\times 6\times 2=108$-cell archive, and Table 7 connects each cell to its source scenario and realized conflict geometry.

Figure 4. Projection of the five archive cells reached by Style2Risk but not by strict no-style in the 500-scenario campaign. Each entry reports the number of additional cells in an assertiveness–courtesy bin and the corresponding interaction type. All five carry the original severe-near-miss label; three remain valid under the common trajectory protocol.

Table 7. Realized trajectory characteristics of the five formal cells reached by Style2Risk but not by strict no-style. Each row corresponds to one unique source scenario. The final column reports the result under the common trajectory protocol.

#	Style/Interaction	Min. Distance (m)	Relative Speed (m/s)	Conflict Angle (Rad)	Common-Protocol Result
1	high/high lane change	39.43	4.50	0.078	valid severe near miss
2	high/mid yield gap	30.63	11.14	2.156	valid severe near miss
3	low/low following	7.84	2.82	0.008	screen fail
4	low/low merge	3.10–3.16	5.18–6.45	0.082–0.204	valid severe near miss
5	mid/low intersection	22.67	17.46	3.065	screen fail

The five cells span all three assertiveness levels, two courtesy levels, and five interaction types. All five carry the severe-near-miss label assigned by the original archive, and each comes from a different source scenario. Under the common trajectory protocol, three source scenarios remain valid severe near misses and two fail the screen. The distance, relative-speed, and angle columns summarize the nominated controlled-participant–AV pair; they do not re-establish the original archive label by themselves. The five-cell result therefore represents broader formal style–interaction coverage, complemented by the independently screened outcomes and the realized-space analysis below.

Realized trajectory features provide a second view of diversity. Across the seven configurations at canonical seed 42, 4275 planner-level valid events arise from 332 unique scenarios. The physical representation combines minimum distance, relative speed and angle at conflict, both agents’ maximum deceleration, interaction-distance error, and relative-speed error. Style2Risk contributes 757 events from 255 scenarios and covers 25 physical clusters and 258 spatiotemporal clusters; strict no-style contributes 201 events from 67 scenarios, 22 physical clusters, and 70 spatiotemporal clusters. These summaries complement the categorical archive by describing realized motion and event location.

6.4. Contribution of Style-Conditioned Interaction Control

Style conditioning and style-modulated probing account for most of the observed transition. Replacing the state-only prior with the style-conditioned prior while retaining the uniform residual raises the mean valid-event count from 110.0 to 173.3 and the internal-support pass rate from 0.386 to 0.567, while the union remains at 28 cells. Adding the style residual produces the largest adjacent archive step: ENFDR rises by 0.008 and the union expands by four cells. Attribution and coverage then reach the 33-cell result used by Style2Risk. Because these mechanism variants retain their implemented branch coefficients, the sequence localizes the transition; the coefficient-matched validation in Section 6.5 isolates the contribution of online guidance. The mechanism sequence is shown in Figure 5 and summarized in Table 8.

Figure 5. Mechanism comparison across seven configurations: NS (no style), SB (style base), SR (style residual), SA (style with attribution), SC (style with coverage), Style2Risk (S2R), and Style2Risk+ (S2R+). The sequence shows how each design stage changes archive breadth and protocol compliance.

Table 8. Mechanism-variant comparison in the main campaign. Rows use their implemented branch coefficients; the separate pre-rollout experiment provides the coefficient-matched factor comparison.

Method	ENFDR	Cells	Valid	Support	Geo.	Composite
(1) Strict no-style	0.056	28	110.0	0.386	0.951	0.0205
(2) Style base + uniform reactive residual	0.056	28	173.3	0.567	0.954	0.0303
(3) Style residual	0.064	32	251.0	0.850	0.957	0.0521
(4) Style + attribution	0.066	33	255.3	0.885	0.985	0.0576
(5) Style + coverage	0.066	33	258.0	0.886	0.972	0.0568
(6) Style2Risk	0.066	33	258.0	0.901	0.987	0.0587
(7) Style2Risk+	0.066	33	256.7	0.898	0.987	0.0585

The same-interface controls support the role of style-conditioned probing. Figure 6 places the style-aware configurations at higher internal-support pass rates without reducing scenario-normalized occupancy, while Figure 7 shows nonzero sensitivity in both base and final action means. On the matched development subset, Style2Risk records ENFDR 0.527, 26.3 occupied cells, 33.3 valid events, and an internal composite of 0.499; the risk-only residual records 0.473, 23.7, 30.7, and 0.389. Figure 8 and Table 9 provide the full comparison.

Figure 6. Internal operating plane and attribution summary for the 500-scenario campaign. Configuration abbreviations follow Figure 5. The left panel relates archive discovery to internal-support compliance; the right panel separates events involving the controlled agent from other or joint events.

Figure 7. Style-input sensitivity and duplicate-rate analysis in the 500-scenario campaign. Sensitivity measures how strongly the controller responds to the supplied style input, while duplicate rate quantifies repeated valid events within already represented archive regions.

Figure 8. Internal operating points on the matched WOMD–Waymax development subset. The vertical coordinate is scenario-normalized archive occupancy, and the horizontal coordinate is the internal-support pass rate.

Table 9. Development-stage same-platform controls on the matched WOMD–Waymax subset. Values are means over three planners on the same 50 scenarios; deterministic seed copies are collapsed. Support and Composite are internal protocol quantities.

Method	ENFDR	Cells	Valid	Support	Geo.	Duplicate	Composite
Strict no-style	0.333	16.667	18.667	0.460	0.973	0.107	0.149
Style base + uniform reactive residual	0.400	20.000	25.000	0.660	0.980	0.200	0.259
Random bounded residual	0.0133	0.667	0.667	0.0133	1.000	0.0000	0.0003
Risk-only residual	0.473	23.667	30.667	0.880	0.933	0.228	0.389
Post hoc filtered risk residual	0.447	22.333	28.333	0.827	0.920	0.212	0.340
Style2Risk	0.527	26.333	33.333	0.947	1.000	0.210	0.499

All controls use the same scenarios, planner interface, rollout horizon, protocol screen, and aggregation code. The alternatives apply generic bounded residuals, distance-directed residuals without style conditioning, or full-strength risk pressure followed by post-rollout screening.

6.5. Pre-Rollout Style and Online Archive Guidance

The 26-scenario validation shows that the Style2Risk control variables can be assigned before rollout and that archive occupancy can be used online. All 312 rollouts completed without scenario replacement. The balanced design has mean intended assertiveness and courtesy of 0.488. Across the four configurations, realized assertiveness/courtesy changes from 0.557/0.435 for the no-style prior with uniform residual to 0.596/0.409 for the complete guidance configuration, showing that the prescribed input produces a measurable change in executed interaction behavior.

The point estimate is one additional occupied cell without an increase in event yield. Guidance-off and guidance-on each produce 14 protocol-valid events per planner, while occupancy changes from 12/135 (8.89%) to 13/135 (9.63%). The scenario-bootstrap interval for this point difference is $[0,1]$. Raw triggers, common-evaluator pass counts, valid-event counts, and collision counts remain unchanged. Table 10 reports the complete four-configuration comparison.

Table 10. Pre-rollout style and online-guidance validation on 26 held-out test scenarios. Each planner uses one deterministic execution and the same common trajectory evaluator.

Planner	Config.	Pass	Valid Events	Cells/135	Collisions	Joint ADE (m)	Interaction Consistency
Logged reference	NS + UR	22/26	16	12	0	0.832	0.706
Logged reference	SP + UR	17/26	12	10	2	1.487	0.641
Logged reference	SP + SR	18/26	14	12	7	1.610	0.604
Logged reference	S2R-G	18/26	14	13	7	1.645	0.601
Reactive	NS + UR	21/26	15	12	0	0.854	0.705
Reactive	SP + UR	17/26	12	10	2	1.528	0.640
Reactive	SP + SR	18/26	14	12	7	1.656	0.603
Reactive	S2R-G	18/26	14	13	7	1.695	0.600
Cautious	NS + UR	22/26	17	13	0	0.894	0.701
Cautious	SP + UR	17/26	12	9	0	1.594	0.635
Cautious	SP + SR	18/26	14	12	6	1.726	0.596
Cautious	S2R-G	18/26	14	13	6	1.772	0.593

NS + UR: no-style prior with uniform residual; SP + UR: style prior with uniform residual; SP + SR: style prior with style residual and guidance off; S2R-G: Style2Risk with online guidance.

The coefficient-matched transitions clarify the role of each component. Adding the style residual increases valid-event yield by 0.077 per scenario $[0.000,0.192]$ and expands the planner archive to 12 cells. The subsequent online-guidance step changes the discovery breadth rather than the event count, reaching 13 cells with the same 14-event yield. Its joint ADE changes by 0.040 m $[0.016,0.064]$, while interaction consistency changes by $-0.003$ $[-0.007,0.002]$. Table 10 reports the complete trajectory and collision measurements under the common evaluator.

The 312 rollouts require 919.0 s of sequential-equivalent planner time, corresponding to a coarse 2.95 s per rollout. This targeted validation supports pre-rollout style control and online archive use; the larger campaign remains the primary evaluation of event yield and archive breadth.

6.6. Sensitivity and Indicator Consistency

The method ordering is stable within the evaluated local sensitivity slice. Table 11 and Figure 9 compare conservative, default, and relaxed bounds on the reactive-planner seed-42 subset. A separate weighting sweep recomputes ENFDR from the archived cells without changing the rollout outcomes.

Table 11. Residual-bound sensitivity for the risk-only residual and Style2Risk configurations. Support and Composite are internal protocol quantities.

Profile	Method	${\mathit{\delta }}_{\mathbf{xy}}$ (m)	${\mathit{\delta }}_{\mathbf{yaw}}$ (Rad)	ENFDR	Cells	Valid	Support	Composite
conservative	Risk-only residual	0.100	0.0200	0.500	25	32	0.900	0.432
conservative	Style2Risk	0.100	0.0200	0.520	26	33	0.960	0.499
default	Risk-only residual	0.150	0.0400	0.480	24	31	0.880	0.397
default	Style2Risk	0.150	0.0400	0.520	26	33	0.940	0.489
relaxed	Risk-only residual	0.200	0.0600	0.480	24	29	0.840	0.363
relaxed	Style2Risk	0.200	0.0600	0.520	26	33	0.940	0.489

Figure 9. Residual-bound sensitivity for Style2Risk and the risk-only residual across conservative, default, and relaxed trust-region settings. The horizontal coordinate is the internal-support pass rate.

Across all three bound profiles, Style2Risk keeps ENFDR at 0.520 and occupies 26 cells; its internal-support pass rate ranges from 0.940 to 0.960. The risk-only residual reaches ENFDR values of 0.500, 0.480, and 0.480, while its support-screen pass rate decreases from 0.900 to 0.840 as the bound is relaxed. The weighting sweep gives the same ordering within this subset. For $w_{\mathrm{occupied}}=0.1,0.3,0.5,1.0$, Style2Risk obtains weighted ENFDR values of 0.026, 0.034, 0.041, and 0.060. The corresponding risk-only values are 0.021, 0.028, 0.036, and 0.053.

The indicator bins follow the ordering built into their trajectory-derived definitions. Table 12 and Table 13 compare speed maintenance, accepted gap, yielded gap, deceleration onset, and smoothness across the low, mid, and high bins.

Table 12. Assertiveness indicator behavior statistics.

Bin	n	Speed Maint.	Accepted Gap (m)	Mean $\mathbf{\Delta }\mathit{x}$ Proxy (m/Step)	Min TTC (s)
Low	153	0.529	30.532	−0.107	1.404
Mid	153	0.909	27.453	−0.149	1.708
High	144	1.222	27.340	−0.470	1.578

Table 13. Courtesy indicator behavior statistics.

Bin	n	Yielded Gap (m)	Decel. Onset	Smoothness	SDC $\mathbf{\Delta }\mathit{x}$ Response (m/Step)
Low	153	16.908	0.157	0.127	0.607
Mid	153	31.384	0.435	0.194	0.286
High	144	51.631	0.550	0.244	0.218

Higher assertiveness increases speed maintenance from 0.529 to 0.909 and 1.222, while accepted gap decreases from 30.5 m to 27.5 m and 27.3 m. The mean controlled-agent $\Delta x$ proxy becomes more negative across the three bins ($-0.107$, $-0.149$, and $-0.470$ m/step). Higher courtesy increases yielded gap from 16.9 m to 31.4 m and 51.6 m. Deceleration smoothness rises from 0.127 to 0.194 and 0.244, while the SDC $\Delta x$ response decreases from 0.607 to 0.286 and 0.218 m/step. These displacement-action proxies are not acceleration measurements. The trends are an internal consistency check because several reported quantities also contribute to the proxy construction.

7. Discussion

7.1. How Style Conditioning Increases Event Yield

Style2Risk gains most of its testing capacity before the optional guidance signals are added. The style-conditioned prior raises valid-event yield from 110.0 to 173.3 while using the same uniform residual, which shows that the behavioral starting point matters. Style-modulated probing then produces the largest adjacent archive change, reaching 251.0 valid events and 32 cells. Attribution and coverage complete the proposed configuration at 258.0 events and 33 cells. The sequence supports the central design: style controls the interaction regime, and the bounded residual turns that regime into targeted pressure on the planner.

The common trajectory evaluator strengthens this interpretation. Style2Risk lowers joint ADE by 1.343 m, increases interaction consistency by 0.163, and lowers collision rate by 0.037 relative to strict no-style. These comparisons use the same evaluator for both methods and do not depend on the behavior prior’s likelihood. Together with the nonzero base- and final-action sensitivity, they show that style conditioning changes the controller in a predictable way while retaining stronger motion quality under the common protocol.

7.2. The Archive Reveals Discovery Breadth and Repetition

Event yield and archive occupancy describe different properties of a testing campaign. Style2Risk more than doubles the mean protocol-valid event count, but the occupied-cell union grows by five cells. The accompanying increase in duplicate rate shows why both quantities are needed: the method reaches additional style–interaction regions and also returns frequently to already exposed regions. A raw event count would combine these two effects.

The added cells cover three assertiveness levels, two courtesy levels, and five interaction types. All five contain severe near misses, so their contribution is broader conditional coverage rather than additional event classes. Realized-space clustering provides a complementary view: Style2Risk covers more physical and spatiotemporal clusters than strict no-style, although those totals also grow with the number of events. Scenario lineage, formal cells, and realized trajectory features together give a more informative account of discovery than any one diversity measure alone.

7.3. Implications for Closed-Loop AV Testing

Style2Risk makes interaction style a test input rather than a label applied only after simulation. The pre-rollout validation shows that assertiveness and courtesy can be prescribed without future trajectory access and remain reflected in realized behavior. Online archive guidance then changes the occupied-cell point estimate from 12 to 13 per planner while leaving event yield fixed. This targeted experiment demonstrates how the same interface can support sequential coverage-aware testing, while the larger campaign provides the primary evidence on event yield and archive coverage.

The system also improves traceability. Each rollout preserves the style input, base action, residual action, screen decisions, event class, and archive address. Direct controlled-pair events can be separated from effects propagated through surrounding traffic. The controller requires fixed-width policy inference and a constant-size residual chain, and the 31,500-rollout campaign uses 24.53 A100 GPU-hours. These properties make Style2Risk suitable for controlled simulation campaigns in which the behavior being tested, the planner-facing intervention, and the resulting safety-critical evidence must remain distinguishable.

8. Limitations

The present evaluation uses WOMD records in Waymax and three fixed rule-based or trajectory-guided planners. The 500-scenario campaign is designed for controlled mechanism comparison on an interaction-rich pool. The separate 26-scenario validation evaluates the same design on previously unused scenarios and one rollout stream fixed before execution; its one-cell point difference is not a test of cross-order stability. Future work should test learned planning stacks, other simulators, and additional traffic domains.

The main campaign treats assertiveness and courtesy as prescribed conditions derived from complete logged interactions. The 26-scenario experiment complements this design by prescribing style entirely from pre-rollout information. Both studies use trajectory-derived interaction proxies rather than human driving-style annotations. Learning style from online observations and validating it against human judgments remain open directions.

The internal-support and common trajectory protocols answer different questions. The first evaluates the declared behavior-prior, action, and motion constraints. The second removes prior likelihood and compares trajectories under one shared evaluator. Adding an independently reconstructed roadgraph metric or official WOSAC off-road score, together with a counterfactual avoidability search, would broaden the physical validity assessment.

The experiments compare same-interface controls so that behavior-prior and residual mechanisms remain identifiable. Broader comparisons with external testing systems require a shared planner and simulator interface. The current sensitivity study covers residual and yaw bounds; a larger coefficient study could further characterize the style, attribution, coverage, and direction factors. The protocol and configuration choices used for the reported comparisons are specified in the main text and Appendix A.

9. Conclusions

Style2Risk introduces an interpretable style-conditioned adversarial interaction mechanism for closed-loop AV testing. Assertiveness and courtesy control a learned behavior prior, and a bounded residual converts that behavior into targeted pressure on the tested planner. A style–interaction–event archive then records where protocol-valid safety-critical events occur and whether later rollouts expand or repeat the represented regions.

In the 31,500-rollout WOMD–Waymax mechanism comparison, Style2Risk increases protocol-valid events from 110.0 to 258.0 per planner chunk and expands the formal archive from 28 to 33 occupied cells relative to strict no-style. Under a common trajectory evaluator, Style2Risk reduces joint displacement error by 1.343 m, improves interaction consistency by 0.163, and reduces collision rate by 0.037. The separate pre-rollout experiment further shows that style can be assigned without future trajectory access. In its fixed stream, online guidance produces a one-cell occupancy point difference without changing event yield.

These results support interaction style as a practical control variable for closed-loop safety testing in the evaluated setting. By separating behavior generation, bounded planner probing, and archive-based discovery analysis, Style2Risk produces targeted testing evidence whose behavioral condition, physical execution, and discovery structure remain visible. Extending this interface to learned planners and broader traffic domains offers a direct path toward more comprehensive interactive AV evaluation.