Stealthy and Efficient Adversarial Attacks against Deep Reinforcement Learning

By Jianwen Sun, Tianwei Zhang, Xiaofei Xie, Lei Ma, Yan Zheng, Kangjie Chen, Yang Liu. 2020

149 citations recorded by the source corpus.

Adversarial attacks against conventional Deep Learning (DL) systems and algorithms have been widely studied, and various defenses were proposed. However, the possibility and feasibility of such attacks against Deep Reinforcement Learning (DRL) are less explored. As DRL has achieved great success in various complex tasks, designing effective adversarial attacks is an indispensable prerequisite towards building robust DRL algorithms. In this paper, we introduce two novel adversarial attack techniques to stealthily and efficiently attack the DRL agents. These two techniques enable an adversary to inject adversarial samples in a minimal set of critical moments while causing the most severe damage to the agent. The first technique is the critical point attack: the adversary builds a model to predict the future environmental states and agent's actions, assesses the damage of each possible attack strategy, and selects the optimal one. The second technique is the antagonist attack: the adversary automatically learns a domain-agnostic model to discover the critical moments of attacking the agent in an episode. Experimental results demonstrate the effectiveness of our techniques. Specifically, to successfully attack the DRL agent, our critical point technique only requires 1 (TORCS) or 2 (Atari Pong and Breakout) steps, and the antagonist technique needs fewer than 5 steps (4 Mujoco tasks), which are significant improvements over state-of-the-art methods.

Subfields: Artificial Intelligence, Electrical and Electronic Engineering, Hardware and Architecture, Reinforcement Learning, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

1. Gauthier Gidel
2. Simon Lacoste-Julien
3. Pascal Vincent
4. William L. Hamilton
5. Hugo Berard
6. Yoshua Bengio
7. Avishek Joey Bose
8. Vijay Janappa Reddi

In Electrical and Electronic Engineering

1. Simon Lacoste-Julien
2. Pascal Vincent
3. Vijay Janappa Reddi
4. Avishek Joey Bose
5. Thanh Thi Nguyen
6. William L. Hamilton
7. Gauthier Gidel

In Hardware and Architecture

1. Simon Lacoste-Julien
2. Vijay Janappa Reddi
3. Avishek Joey Bose
4. William L. Hamilton

In Reinforcement Learning

1. Simon Lacoste-Julien
2. Pascal Vincent
3. Vijay Janappa Reddi
4. Avishek Joey Bose
5. Thanh Thi Nguyen
6. Hugo Berard
7. William L. Hamilton
8. Gauthier Gidel

In Safety, Robustness & Interpretability

1. Simon Lacoste-Julien
2. Pascal Vincent
3. Avishek Joey Bose
4. Thanh Thi Nguyen
5. William L. Hamilton
6. Gauthier Gidel
7. Suhang Wang
8. Enyan Dai

Citations in the corpus

• Online Adversarial Attacks (2021, background): “To the best of our knowledge, the only existing approaches that craft adversarial examples on streaming data [Gong et al., 2019a, Lin et al., 2017, Sun et al., 2020] require multiple passes through a data stream and thus cannot be applied in a realistic online setting where an adversary is forced…”
• A Survey on Metaverse: Fundamentals, Security, and Privacy (2022, background): “In the literature, by taking adversarial samples as part of training data, various efforts have been done to resist adversarial samples via virtual adversarial learning [73], adversarial representation learning [74], adversarial reinforcement learning [75], adversarial transfer learning [76], and so”
• Deep Reinforcement Learning for Cyber Security (2019, background): “various adversarial cyber environments are worth comprehensive investigations as they can be a solution to battle against the increasingly complex offensive AI systems [188]–[190].”