What condition must injury-minimising programming satisfy for the deontological defence of it to work?

It must actually reduce the risk of every single individual — the argument only holds if nobody's risk goes up so that others' can come down.

The defence built from the vaccination analogy has a precondition, and it is a demanding one. If such a programming both (a) leads to the smallest number of casualties and (b) reduces the risk of each and every individual, that is a good reason to design autonomous cars accordingly.

Both halves are needed. Condition (a) alone is plain consequentialism and is exactly what the deontological objection targets. It is (b) that defeats the instrumentalisation charge, because it is what makes each person also an end of the rule rather than merely a means to a better aggregate.

Which turns the ethical question into an empirical one: can a programming aimed at injury minimisation actually deliver that? The next several cards are the paper's attempt to answer it — and the answer is a qualified no, because an injury-minimising rule systematically reallocates risk from more vulnerable people to less vulnerable ones, and the less vulnerable are an identifiable group.

Tip: Whenever a policy is defended as "better for everyone in expectation", the load-bearing word is everyone. Ask who the rule makes worse off than the status quo — if there is such a group, the argument has to be redone.

Go deeper:

• Wikipedia: Externality — the general shape of »better in aggregate, worse for an identifiable group«, and what economics does about it.