Caging the Neural Network: How Aptiv Thinks About Safe Self-Driving

Iagnemma, president of Aptiv Autonomous Mobility, introduces Aptiv as a company that was formerly Delphi Technologies and, before that, part of General Motors. It spun out about 14 months before the talk and is a tier 1 automotive supplier whose job is to industrialize software and hardware so it can run for hundreds of thousands of miles without failing. Aptiv has about 156,000 employees and roughly $13 billion in revenue, and his autonomous driving group is around 700 people.

He traces his own path from DARPA Urban Challenge-era cars with blade servers in the trunk, through a golf-cart shuttle project in Singapore, to founding nuTonomy and putting cars on the road in 2015. The team joined Aptiv in 2017, in part because, as scientists, they lacked a clear idea of how to industrialize the technology and make it reliable, robust and safe.

In Las Vegas the group operates a 130,000-square-foot garage with about 75 cars, thirty of them on the Lyft network, where riders can opt in to an autonomous ride. The cars run 20 hours a day, seven days a week. So far they have given over 30,000 rides to more than 50,000 passengers, driven over a million miles there, and hold a 4.95 average star rating, which Iagnemma treats as a signal of ride quality, comfort and perceived safety.

A sped-up Singapore run illustrates daily challenges: obstacles in the face of oncoming traffic, road users who don't follow the rules, ubiquitous construction and people signalling intentions that have to be inferred. For a human these are routine, he says, but for an autonomous vehicle they are table stakes.

Iagnemma says the field once thought a single learned black box could go from pixels to actuator commands, and that he never believed it. Learning is still very useful, but the question is whether you can convince yourself that such a system is safe. He frames safety on two axes: technical safety, meaning it meets its intended function, validation and regulatory requirements, and perceived safety, meaning riders and regulators actually believe it is safe.

Trust requires validating three things: the data, the implementation and the algorithm. Data can be unrepresentative or poorly annotated, the implementation can run on poor hardware or contain bugs such as buffer overruns, and the algorithm approximates a complicated function whose important cases are exactly the rare ones. His argument is that each is a place where "garbage in, garbage out" can occur.

Validation is hard for several reasons. The underlying function isn't known in closed form, and crashes are statistically rare, so the RAND estimate he cites says 275 million miles without a crash would be needed for a 95% confidence claim of a lower fatality rate than humans. He wonders about close calls as a proxy for accidents, and notes that regulation is still to be written and there is no consensus on the safety target.

A further problem is continuous development. If you validate one build of code, does a one-line change, possibly to the most important line, force you to start over? The same question applies when moving from one city to a similar but not identical city, and he says this keeps many people up at night.

On data, Iagnemma points to completeness and bias: if you plan to operate 24 hours a day but train only on daytime data, you will have problems. Annotation is another overlooked risk, since labelling is usually outsourced to a third party that must catch the interesting items and ignore the uninteresting ones. What looks like low-hanging fruit is actually a key part of trusting the data.

For algorithms, he highlights invariance and stability: small perturbations should not cause wild responses. He mentions adversarial examples like a turtle classified as a machine gun after imperceptible noise, and says that for driving, a stop sign with a piece of duct tape in one corner shouldn't turn into a yield sign.

Interpretability may not be a nice-to-have but a requirement from regulators. After a crash, you might have to explain why a deep-learning trajectory generator produced a given trajectory, ideally even to a lay jury. He says research is active but it is unclear when or if this will be possible.

Iagnemma says this need not be bleak, because there are many tools if a neural network is used as a sub-module within a broader safety argument rather than as a holistic driver. He mentions functional safety and SOTIF, safety of the intended functionality, which ask whether the overall function does what it is meant to and meets its specifications. These questions must be answered even when neural networks are involved.

He describes an architecture he calls caging the learning. A powerful neural trajectory proposer runs on high-performance compute that may not be automotive grade and has potential failure modes. Underneath it sits a safety system about which very rigorous claims can be made, so that the learned element is wrapped by something verifiable.

He closes with a remark from one of his engineers that engineering is inching closer to the natural sciences. The field is building immensely complex function approximators that nobody fully understands, then investigating their properties by poking at them in different situations.

Beijbom, who leads machine learning at Aptiv autonomy, sets the scene with a comic about how building a bird classifier used to be a PhD project, then traces the deep learning revolution through classification, detection (Ross Girshick's work) and the single-shot multibox detector. Their own image network runs at 200 Hz on a single GPU with no tracking or temporal smoothing. He explains that perception has many pipeline stages, and while he's tempted to optimize end to end, he focuses on a deep learning kernel for the lidar part, with a well-defined input and output that can be verified given the right data.

The goal is to take a point cloud and output 3D bounding boxes in world coordinates. PointPillars is a new point cloud encoder: it translates the cloud into a canvas that a standard 2D architecture can process. Everything after the encoder looks like an SSD-style detector, with a 2D convolutional backbone and detection head. A pillar is a vertical column of points, and the encoder produces a fixed-size pseudo-image with C channels.

He compares approaches. Earlier methods split pillars into voxels and extracted hand-engineered features. VoxelNet removed the feature engineering by applying a PointNet per voxel, but then needed a slow 3D convolution and ran at around 5 Hz. PointPillars skips voxels and sends all points in a pillar through a single, simplified PointNet layer, stacked into a dense tensor so it becomes a 1x1 2D convolution; the encoder takes 1.3 milliseconds.

On the KITTI benchmark, the method had the highest aggregate performance among published methods at the time of submission, including some that fused lidar and vision, while running at a little over 60 Hz. Failures included a person with a stand read as a bicycle and a child on a bicycle that was missed, and one apparent annotation error. Deployed on Aptiv's full 360-degree sensor suite, it runs frame by frame, and accumulating multiple point clouds lets it estimate velocity.

Beijbom introduces nuScenes, a dataset of 1,000 twenty-second scenes collected on Aptiv's development vehicles with the full automotive sensor suite, registered and synced in a 360-degree view. It includes over a million 3D bounding boxes and is free for research, with a 100-scene teaser available and the full release due in about a month. He argues the field is driven by benchmarks and that KITTI, while groundbreaking, lacks a full 3D view and radar.

The annotations live in world coordinates rather than being tied to one sensor, so lidar sweeps can be projected into camera images, for example colored by distance. The taxonomy covers several kinds of pedestrians and vehicles, static objects like barriers and cones, and attributes. An audience member asks whether the dataset is enough to guarantee generalization.

Both speakers answer that it is purely an academic effort and a small subset of Aptiv's data. Iagnemma says the industry has driven roughly 12 to 14 million autonomous miles across hundreds of code builds, far short of hundreds of millions on a single build. The safety case will therefore combine simulation, regression testing on data like this, and on-road driving, and a single dataset can't cover motion planning, decision-making and localization.

On 5G, Iagnemma says fleet connectivity needs are relaxed, but teleoperation, where a remote human helps a confused car, may need high bandwidth, low latency and high reliability. He sees 5G as very nice to have but designs the system not to rely on it, since infrastructure arrives on its own timeline.

Asked about moving between countries, he describes his co-founder's "rule books", a structure for the decision-making engine that lets rules be reprioritized, reassigned or reweighted rather than hand-recoded, which matters when switching from right-hand to left-hand driving. Sites span Boston, Pittsburgh, Las Vegas and Singapore, which he describes as near-ideal except for constant construction zones. Market choice also weighs infrastructure, driving patterns, density, regulation and economics, and Beijbom adds that a service can limit routes or hours, such as not accepting rides at night.

On whether a third-party body, as in nuclear power, should validate self-driving code, Iagnemma says he wouldn't be surprised either way. The automotive industry has largely self-certified, with strong incentives to be safe, and the federal government has moved quickly but carefully, with a third version of draft guidance from the Department of Transportation released that summer.

Beijbom answers a question on snow by saying a model needs training data for the conditions it will be deployed in, but lidar is easy to augment. To handle something rare like a piano on the road, one can build a realistic point cloud from a 3D model. Training also copies and pastes objects from other lidar sweeps into the current one, which he admits sounds absurd but found really useful.