In recent years, whenever autonomous driving comes up, “safety” is almost impossible to avoid.
The media asks about it. Regulators ask about it. Even friends, in casual conversations, will instinctively ask: Is this thing actually safe now?
And every time I try to answer that question, I find myself sensing that something is slightly off.
Because whether it is the way the question is framed or the way it is answered, we almost always fall back on the language of the traditional driving world—has there been an accident, who was responsible, was it full liability, was there a violation.
These questions are not wrong in themselves. But behind them lies an assumption that is rarely examined seriously:
we implicitly assume that autonomous driving is simply “another kind of driver.”
The deeper I get involved in this field, the more I believe that this assumption itself deserves to be challenged.
Autonomous driving is not a more obedient, more focused, less fatigued human driver.
It is a fundamentally different system, with entirely different ways of sensing, reacting, and making decisions. It does not have “attention” in the human sense, nor emotions, and it certainly does not become slower on a hot afternoon because its mind is elsewhere.
If the underlying capability model has already changed so completely, yet we continue to rely on definitions of accidents and safety standards inherited from the old world, then what we are discussing may not actually be autonomous driving safety at all.
Accident Definitions Are, by Nature, Tailored for Humans
In today’s traffic systems, the definition of an accident is almost entirely built around the idea of “best effort.”
Human drivers make mistakes—this is a long-accepted reality in law, regulation, and society. As a result, accident analysis naturally focuses on questions such as who actively caused the incident and who should bear responsibility.
This framework works well because it is designed for humans.
When a driver fails due to limited visibility, delayed reaction, or misjudgment, “I did my best” is often considered a reasonable explanation.
Autonomous driving, however, does not enjoy this kind of physiological leniency.
It does not get tired or distracted. It can monitor multiple directions simultaneously and make decisions at millisecond scale. More importantly, it can continuously learn from data, transforming past experience into foresight about future risk.
Given these capabilities, if we only require autonomous systems to “avoid actively causing accidents,” we are, in effect, deliberately lowering our expectations.
The safety bar for autonomous driving should not stop at “no accidents.”
It should be about whether the system can perceive risk earlier than humans, and whether it can neutralize danger before an accident even materializes.
When a System Can Avoid Risk, Are “Passive Accidents” Still Accidents?
On real roads, there is a category of incidents that happens every day.
A vehicle suddenly changes lanes illegally. A pedestrian runs a red light. A motorcycle cuts in at high speed from a blind spot. A driver in the adjacent lane drifts while looking at a phone.
In the human driving framework, these are typically considered “passive accidents.”
The fault lies with the other party, and you are deemed to have done your best. The accident is treated as unavoidable.
But once a system has significantly stronger perception and prediction capabilities, the very notion of “unavoidable” deserves to be re-examined.
If an autonomous vehicle can identify abnormal behavior patterns in advance, adjust speed and spatial strategy proactively, and dissolve risk before a dangerous maneuver actually occurs, then a sharper question inevitably follows:
If an accident could have been avoided by an autonomous system—even if the fault lies with someone else—should it still count as an autonomous-driving accident?
From an engineering perspective, I increasingly find myself arriving at an answer that may be uncomfortable, but is closer to reality:
yes.
Not in the legal sense of liability, but in the sense of system capability.
In the future, the true measure of an autonomous system will not be how few mistakes it makes, but how many mistakes—especially those made by others—it successfully prevents.
Particularly those risks that human drivers have long accepted as unavoidable, but that higher-capability systems could realistically eliminate.
If autonomous driving fails to demonstrate a clear safety advantage over humans in these scenarios, then its fundamental value proposition itself becomes questionable.
Why End-to-End Foundation Models Are Closer to True Safety Redundancy
At this point, the discussion inevitably turns to technology paths.
Different autonomous-driving architectures are not equally capable when it comes to preventing these so-called “passive accidents.”
The modular architecture represented by Waymo—perception, prediction, planning—is the culmination of more than a decade of engineering practice. Each module can be validated independently, yielding systems that are stable, controllable, and comparatively easy to certify.
This approach has solved a critically important problem:
whether autonomous vehicles can operate reliably in the real world.
But modular systems also have inherent limitations. As information flows between modules, it is inevitably simplified, truncated, or amplified by error. In complex, chaotic, and highly uncertain environments, such systems often react only after an action has already begun, rather than understanding the deeper risk structure embedded in the scene.
End-to-end foundation models offer a different possibility.
They are not merely black boxes formed by merging modules together. Instead, perception, understanding, and decision-making share a single world model and are optimized under a unified objective. These systems do not only recognize what is happening—they are better at anticipating what is likely to happen next, and even what should be prevented from happening at all.
An end-to-end model that observes a motorcycle approaching from behind in an unstable manner may not need to wait for a clearly defined cut-in maneuver before adjusting speed and spatial margins.
Such behavior is not about complying with a specific rule; it is about preventing an accident.
And this is precisely the capability required to eliminate “passive accidents.”
Over a long time horizon, I believe end-to-end models have greater potential to drive accident rates down to levels that humans simply cannot reach. Modular systems brought autonomous driving to the starting line; end-to-end systems may determine how far it ultimately goes.
Which brings us back to the original question: what does it really mean for autonomous driving to be safe?
If I had to summarize my view in a single sentence, it would be this:
Autonomous-driving accidents should not be defined solely by “who is at fault,” but by whether the system had the capability to prevent the event in the first place.
Only when autonomous systems begin to systematically eliminate those accidents that even the most diligent human drivers cannot avoid can we truly say that we have entered the era of autonomous driving.
The mission of technology has never been to replicate humans,
but to remove human vulnerability from the system.