A local agentic AI framework generates edge-case scenarios for safety assurance

How to automatically generate concrete edge scenarios at the boundary of the operational design domain (ODD) of autonomous systems in a local, controllable computing environment, while leaving traceable safety assurance evidence.

• Motivating scenario: The authors state that after human oversight of safety-critical autonomous systems is reduced, qualified personnel can no longer be relied on to handle anomalies, and the system must be argued to autonomously meet operational, safety, and regulatory requirements under expected conditions. The open environment may be underspecified or even unknown at design time, so unknown and unsafe situations are more likely to occur.
• Existing shortcomings: The authors state that many recent language-model scenario generation approaches rely on human-in-the-loop or rules, limiting long-tail diversity. Monte Carlo does not target edge cases; formal and statistical models require behavior models that are difficult to capture; evolutionary search requires extensive configuration and trial and error; reinforcement learning lacks language-model world knowledge and requires many training rounds. Several LM pipelines also require accident data, failure logs, known errors, or manual editing.
• The authors' setting: Edge cases are statistical outliers that are rarely encountered and lie at the ODD boundary, and are not mutually exclusive with typical or critical scenarios. ISO 21448 Clause 7 requires identifying trigger conditions that expose functional gaps; Clauses 9–11 address verification strategies, known scenario spaces, and confirming unknown scenario spaces through simulation and other means. PAS 8800 requires generating synthetic edge scenarios but does not specify an implementation mechanism.
• The authors' proposed framework: A local agent closed loop on a laptop. A generation LM writes system requirements, system description, environment description, and task description into a JSON spatial layout; another LM critiques it against domain criteria and then revises it; simulation metrics determine whether to exploit existing layouts or explore new ones. The metrics and scenario text are then used to localize trigger conditions as goal structuring notation (GSN) evidence. The authors state that no prior knowledge of functional gaps is needed, and it can run on consumer-grade hardware.

Section 2 of the paper organizes related work by standards, simulation, and generation methods, and Section 5 additionally gives two random baselines.

Standards and assurance frameworks

• ISO 26262 and ISO 21448: The authors state that ISO 26262 targets deterministic software and pre-specified boundaries and does not address performance gaps in AI high-dimensional inputs. SOTIF divides regions by known/unknown and safe/unsafe; verification focuses on region 2 (known and unsafe), confirmation focuses on region 3 (unknown and unsafe), and it requires identifying triggering conditions.
• PAS 8800: A normative safety framework for AI in road vehicles. The authors state that it specifies safety goals that must be achieved but not the implementation mechanisms, so how to verify, quantify, and traceably confirm remains a methodological gap; and it requires using synthetic edge scenarios to check data gaps, model gaps, nondeterministic behavior, and generalization boundaries.
• STAMP/STPA and SACE: STPA can produce a large number of scenarios, and the authors state that only a small fraction of them are edge cases. Tsuji et al. (2020) use statistical model checking to search for critical scenarios, but the UML and statistical templates are customized per application and not easily generalizable. SACE uses scenarios in risk discovery, boundary testing, and simulation forensics, and the authors state that it gives little operational guidance on how to do scenario coverage. The authors believe this paper can supplement the targeted edge cases that STAMP/STPA lack.

Simulation testing

• Platform differences: The paper discusses Gazebo, Unreal-based CARLA, and Unity-3D, and cites that low-fidelity simulation can also find navigation defects (Sotiropoulos et al., 2017). The authors relay that Platt and Ricks (2022) state Unity-3D is superior to Gazebo in scalability, visuals, and real-time LiDAR. The experiments use Unity-3D ML-Agents and decouple from the specific simulator using JSON.

Scenario generation

• Sampling, formalization, and search: De Gelder and Paardekooper (2017) sample from a parameterized representation using Monte Carlo, and the authors state this is random search and not aligned with edge cases. Fuzzy logic combined with a labeled ODD yields a parameterized model (Proma et al., 2026). Formal scenarios such as SCENIC can be executed in simulation; statistical models biased toward critical scenarios require full-domain behavior models that are difficult to capture. Evolutionary and genetic algorithms are used to generate obstacle-avoidance failure scenarios (e.g., Khatiri et al., 2025), and the authors state they rely on random mutation, many configurations, and trial and error.
• Reinforcement learning and LM pipelines: Reinforcement learning that adjusts scenarios dynamically based on observations is used to find edge and high-risk interactions (Pandy et al., 2025; Karunakaran et al., 2023). The authors state that RL lacks LM world knowledge and requires many training episodes and complex rewards. LM work includes visual scenarios, adversarial behavior simulation, generation from accident reports, SERA retrieving existing scenarios from failure logs (Xia et al., 2025), ODD text to CARLA (Danso and Büker, 2025), and PlannerForge, which converts user descriptions to JSON and then edits (Gao et al., 2026). The shortcomings the authors name: they often require ready-made data, known errors, or pre-specified critical scenarios, and some require a small amount of manual adjustment.

Baselines and evaluation environment

• Random_1 and Random_5: Python random numbers place assets, tile values are not repeated, and position conflicts are resampled. Random_1 uses 1–20 tiles and 1–10 obstacles; Random_5 uses 1–20 tiles and 5–10 obstacles. The evaluation environment is an adapted Unity-3D Sorter arena, and the paper does not call it a separately named public benchmark.

The authors position the framework as a fully automatic closed loop: it does not presuppose errors, functional gaps, or critical examples, connects the environment, system, requirements, and task description directly to generation, and incorporates simulation feedback into dynamic adjustment.

本地智能体闭环把ODD和任务说明转成模式严格的JSON空间布局，经第二套LM批评修订后在仿真中计分，再决定加深已有布局或换一批新布局。

问题设定与编码

• 领域本体分为环境描述、系统描述、系统需求，另加任务描述，均以YAML知识库进入上下文提示词。作者称其提供空间范围、约束、数据模式和任务目标。
• 功能、逻辑、具体是三层抽象。具体场景从逻辑分布抽样。式1把一个场景写成 θ_JSON={(p_o1,r_o1,d_o1),…,(v_tn,p_tn)}，即各障碍的位置、朝向、尺寸，以及地砖取值和位置。
• 安全保证记为g(AS)，例子包括最小障碍间隙、错误访问上限和完成时间。TC(θ_JSON)=1表示仿真时段内某时刻这些保证被违反，否则为0。作者在Table 3中假设超时也是安全风险，因为机器人可能卡住并振荡。
• JSON另含场景名、文本描述和起点。提示用TypeScript接口描述模式并要求JSON输出；作者称较小LM这样更容易写出简短可读的JSON。Pydantic检查类型，并可修补缺括号等简单语法错误，也可抓住凭空增加的字段。

生成、批评与两条回路

• 生成LM为ollama:qwen3-coder:30b，批评LM为ollama:nemotron3:33b，经Ollama在本地调用；AISuite用更换一行字符串切换模型。作者称按编码和推理能力挑选二者，并因单独用Qwen自评时观察到确认偏差而拆开角色。
• Figure 2–3的流程是：知识库进入生成LM，草稿做语法校验，批评LM按领域准则评论，生成LM修订，再校验并写入历史；然后逐个进入仿真、收集指标，并决定利用或探索。think、act、observe、update、continue用于初稿、利用和探索。作者称这是把思维链拆成逐步块。
• 一次向生成LM要4个场景。作者称这是该实验里仍能得到无错误JSON的最大批量。温度取0.7，依据是查看不同温度下各8个场景；作者称温度再高会引入幻觉。
• 利用：判定存在功能缺口时，让生成LM在同一接口上改写当前场景。探索：用短FIFO保存近期场景的文本描述而非完整JSON，要求新场景不同于历史。作者称小模型上下文放不下全部历史。Listing 1的判定是：successScore不超过45，或crash_count大于24，或avg_ratio_tiles_visited小于0.75，则利用，否则探索。论文未说明这三个变量名与Table 2指标的逐项对应。

仿真中的被测策略

• 实验改编Unity-3D ML-Agents的Sorter：圆形房间，机器人从中心出发，按编号顺序访问周边地砖并避开障碍。作者称JSON接口使框架不绑定某一种仿真器。
• 机器人用7束LiDAR，只能感知局部；作者把运行域视为部分可观察马尔可夫决策过程。每步移动惩罚-2/5000，倒车再罚-1/5000，正确的下一地砖+1，走错地砖或碰撞-1。到达最高编号地砖为成功，5000步为超时，走错地砖则终止。奖励数值由试错确定。
• 场内另有5个边长1.0的固定障碍。每个场景JSON指定1–10个随机障碍，尺度[1.0, 3.0]，以及1–20块随机编号和位置的地砖。
• 被测“brain”用近端策略优化（PPO）。训练采用增量课程学习：从最多2块地砖开始，每课增加2块直至20，并配5个固定障碍和5个边长1.0的随机障碍。用平均最终奖励决定是否进入下一课。训练15 million个epoch，8个场地并行。测试前这一策略即被当作要暴露功能缺口的导航策略。

与安全论证的对应

• 顶层主张G1是系统级避免与设施碰撞。Figure 6把智能体场景测试分解到通过的测试、JSON场景运行、指标、仿真失败与碰撞日志、区域3到区域2的边缘案例，以及危害发现报告。
• 作者用场景文本做受主题分析启发的归类，再与指标对照，把布局描述映射到触发条件和功能缺口。知识库被写成不可协商约束，但作者称LM仍可能忽略规格，因此同时使用批评—修订和模式校验。附录给出环境、系统、需求、任务和两种JSON的完整规格。

Experimental Setup

• Tested policy: Curriculum-learned PPO Sorter brain, 7-beam LiDAR. Training is 15 million epochs, 8 arenas in parallel. The paper does not report multiple training seeds.
• Generation-side models: ollama:qwen3-coder:30b generates JSON, ollama:nemotron3:33b critiques. Temperature 0.7. Success is determined by simulation rule metrics, no separate LLM judge.
• Baselines: Table 1's Random_1 (1–20 tiles, 1–10 obstacles) and Random_5 (1–20 tiles, 5–10 obstacles). All three output JSON per Listing 5. Random baselines use Python random numbers, tile values are non-repeating, and resample on position conflicts.
• Scale: Each method has 512 scenarios total, 8 in parallel per batch in Unity, 50 episodes per scenario, totaling 25,600 episodes. 50 runs account for randomness in the PPO stochastic policy and environment.
• Arena and hardware: Circular Sorter, with 5 fixed obstacles of side length 1.0; scenario obstacles have scale [1.0, 3.0]. Laptop is Ubuntu 22.04, Intel i9, 32GB RAM, GeForce RTX 4080.
• Metrics: Table 2, including success, timeout, wrong tile, average path, ideal path, regret, proportion of tiles visited, cumulative reward, action distribution entropy, action transition entropy, and collision count. Closed-loop decisions use only the three thresholds in Listing 1.

Main Results

Figure 9 directly labels the proportions of the three methods on stacked bars. Figure 8 compares success counts over 50 repetitions; the text does not print specific boxplot values.

Swipe horizontally to read the table

Method	Success	Timeout	Wrong Tile
Random_1	82.0%	8.2%	9.7%
Random_5	79.6%	10.9%	9.4%
Agentic	70.5%	15.0%	14.5%

• The authors state the lower success proportion indicates Agentic finds more critical scenarios that timeout or hit wrong tiles. The contribution list's "higher edge case yield and hazard discovery rate" does not give an additional overall percentage.
• The authors state in Figure 10 Agentic's final reward interquartile range is higher, but with more negative-reward outliers; Random_5 has one very low outlier (yellow circle), and they believe random methods may also happen to find edge cases. The text does not give these quartile values.
• The authors state regret is similar across the three methods; Agentic's mean and lower quartile are slightly higher, random methods have occasional outliers (Figure 11). The text also does not give specific regret quartiles.

Lowest and Highest Reward Scenarios

Section 6.2 lists the three lowest-reward scenarios and the one highest-reward scenario, with metrics from 50 episodes each.

Swipe horizontally to read the table

Scenario	Average Reward	Average Path	Collisions	Timeout	Wrong Tile
θJSON1	-105.8	3802	89	15	7
θJSON2	-42.9	2674	144	2	5
θJSON3	-40.2	2536	6	4	10
θJSON4	19.6	1118	0	0	0

• The authors classify the texts of θJSON1 and θJSON2 as dense obstacles near the start, and map this theme to low reward, long paths, multiple collisions, and timeout or wrong tile.
• θJSON3 is described as obstacle density varying with progress, with density decreasing near the center. θJSON4 is described as a peripheral loop plus route blocking; the authors state such layouts are less challenging.
• Table 3 maps "dense obstacles near start" to search space saturation and planning oscillation, and blocked tile passages to insufficient perception. This is the authors' categorization, not another set of measured gaps.

Coverage, Collisions, and Action Entropy

• The authors state in Figure 12 Agentic has more tile-visit failures: upper quartile below 1.0, lower mean, more outliers; its minimum is higher than Random_5's minimum. The text does not give these quartile values.
• The authors state in Figure 13 Agentic causes more collisions, and in Figure 14 the average path lower quartile, mean, and upper quartile are all higher, with larger interquartile range. Action distribution entropy lower and upper quartiles are lower (Figure 15); transition entropy interquartile range is similar to Random_1, with Random_5's lower and upper quartiles higher (Figure 16). These comparisons have no summary numbers.
• The authors state Figure 17 shows Agentic targets a subset of scenarios, placing obstacles mostly in 8 cardinal directions, with patterns like circles, T-junctions, blocking lines, blocking arcs, and diamonds, some visible in Figure 7. The authors state it generally takes the allowed maximum of 10 obstacles and 20 tiles, but still uses all values and positions; Figure 22 shows longer ideal paths and wider interquartile range. The authors conclude it complements rather than replaces random generation.

Other Ablations and Analyses

• Removing environment description: obstacles with scale 4.0 appear, exceeding the [1.0, 3.0] in the knowledge base (Section 4.2).
• Removing system description: obstacles are placed at the start (x=0.0, z=0.0) (Section 4.2).
• Single-LM self-evaluation: the authors observed confirmation bias when using only Qwen for critique, so switched to Nemotron; no quantitative comparison.
• Batch size: 4 scenarios per prompt; the authors state more causes Qwen JSON errors. Temperature comparison was 8 scenarios per setting, then chose 0.7.
• Out-of-spec: Figure 18 shows some generated scenarios have obstacle counts exceeding 10, despite the prompt specifying 1–10 (Section 7.3).
• Negative observations: the authors state that when not more successful, Agentic's cumulative reward quartiles are higher, and observed exploitation sometimes makes critical layouts easier to reach the goal (Section 7.3). The paper does not report how many times exploitation and exploration each occurred.

Limitations and Future Directions Noted by the Authors

• Model capability: Smaller LMs are more task-dependent, with shorter context windows and task horizons. The authors suggest selecting models per task and using software guardrails to handle out-of-distribution errors, rather than adding more steps to prompts (Section 7.3).
• Specification not followed: Despite prompt limits of 1–10 obstacles, more than 10 were generated. The authors suggest handling this in Pydantic validation, e.g., returning to the generation step or randomly keeping 10 (Section 7.3).
• Reward and exploitation: The interquartile range of final cumulative reward is higher than both random methods, coinciding with more unsuccessful scenarios. The authors propose further investigation and call this a prototype; visual inspection also shows exploitation sometimes makes key layouts easier to reach the goal (Section 7.3).
• Simulation to field: The authors acknowledge the gap between simulation and open real environments. Unity-3D has high fidelity but is not a full digital twin. The authors state that JSON is platform-agnostic and scenarios can be arranged in the field according to the same specification (Section 7.3).
• No absolute coverage metric: The authors state the framework aims to discover unknown and unsafe scenarios, so there is no absolute coverage metric; they suggest trying other LMs to exploit training and structural differences to increase output variety (Section 7.3).
• Planned extensions: Filter metrics that better support forensics; feed discovered scenarios back into curriculum learning for retesting; collect replay logs previously unsaved due to disk usage; feed more metrics and logs into exploitation/exploration decisions; switch to a different Unity-3D environment; extend to dynamic obstacles and movable waypoints; transfer JSON layouts to hardware-in-the-loop and check whether patterns need expansion (Section 8.1).

Experimental Coverage

• Generation methods are Agentic, Random_1, Random_5, each with 512 scenarios and 50 episodes per scenario, totaling 25,600 episodes per method (Section 5.2).
• The navigation policy under test is a PPO Sorter brain trained with incremental curriculum learning over 15 million epochs; the simulation environment is an adapted circular Sorter, with static obstacles and floor tiles in the experiments (Sections 3.3, 5.1, 8.1).
• Generation and critique models are ollama:qwen3-coder:30b and ollama:nemotron3:33b; the runtime environment is a laptop with a GeForce RTX 4080 (Sections 3.1–3.2).
• Exported metrics are the full set in Table 2; closed-loop uses only the three conditions in Listing 1. Knowledge base ablation removes environment description and system description sequentially (Sections 4.2, 5.3).
• The paper does not report counts of exploitation and exploration triggers, generation queries, wall-clock time, or statistical tests for differences among the three methods; it also states that replay logs were not collected this time (Sections 6–7, 8.1).

The authors built a local agentic closed loop that runs on a laptop to generate edge scenarios for safety arguments of autonomous systems, rather than releasing a new public test set.

• Difficulty addressed: The ODD parameter space is large with nonlinear relationships, and complete sets of concrete edge scenarios cannot be done manually. Random sampling does not align with triggering conditions as per ISO 21448; the authors believe several LM pipelines still require human-in-the-loop, known failures, or existing scenario libraries.
• Approach: Environment, system, requirements, and task descriptions are written as a YAML knowledge base. qwen3-coder:30b generates 4 JSON layouts at a time, nemotron3:33b critiques, then the generation model revises, and Pydantic checks syntax. A PPO robot in Unity-3D uses 7-beam LiDAR to visit tiles in order. Three thresholds in Listing 1 decide whether to rewrite the current scenario or generate different layouts based on recent text history. Scenario texts are then used with metrics by the authors to record unknown unsafe situations from region 3 as region 2.
• Main comparison: Three methods each with 512 scenarios, 50 runs per scenario. In Figure 9, Agentic's Success, Timeout, Wrong Tile are 70.5%, 15.0%, 14.5%; Random_1 are 82.0%, 8.2%, 9.7%; Random_5 are 79.6%, 10.9%, 9.4%. The authors state this indicates Agentic finds more incomplete scenarios.
• Cases and exceptions: The lowest-reward θJSON1 has average reward -105.8, 89 collisions; θJSON2 has 144 collisions. The highest-reward θJSON4 is 19.6, with collisions, timeouts, and wrong tiles all 0. The authors state heatmaps show Agentic concentrates more on specific obstacle patterns, with narrower coverage than random, thus suitable to complement random testing. Meanwhile, the interquartile range of final rewards is higher than random methods, which the authors suggest needs further investigation; exploitation sometimes also makes difficult scenarios easier.
• Authors' conclusion: The authors state JSON layouts plus simulation metrics can serve as reproducible evidence in GSN, and enable smaller teams to do targeted scenario testing on consumer hardware. The authors call the current system a prototype and plan to continue testing with replay logs, curriculum learning retests, dynamic objects, and hardware-in-the-loop.