Robust Deep Reinforcement Learning against Adversarial Perturbations on State Observations
By Huan Zhang, Hongge Chen, Chaowei Xiao, Bo Li, Mingyan D. Liu, Duane S. Boning, Cho-Jui Hsieh. Neural Information Processing Systems, 2020
405 citations recorded by the source corpus.
A deep reinforcement learning (DRL) agent observes its states through observations, whichmay contain natural measurement errors or adversarial noises. Since the observations deviatefrom the true states, they can mislead the agent into making suboptimal actions. Several workshave shown this vulnerability via adversarial attacks, but existing approaches on improving therobustness of DRL under this setting have limited success and lack for theoretical principles. Weshow that naively applying existing techniques on improving robustness for classification tasks,like adversarial training, are ineffective for many RL tasks. We propose the state-adversarialMarkov decision process (SA-MDP) to study the fundamental properties of this problem, anddevelop a theoretically principled policy regularization which can be applied to a large familyof DRL algorithms, including proximal policy optimization (PPO), deep deterministic policygradient (DDPG) and deep Q networks (DQN), for both discrete and continuous action controlproblems. We significantly improve the robustness of PPO, DDPG and DQN agents under asuite of strong white box adversarial attacks, including new attacks of our own. Additionally, wefind that a robust policy noticeably improves DRL performance even without an adversary in anumber of environments. Our code is available at this https URL
Subfields: Artificial Intelligence
View Paper: https://www.semanticscholar.org/paper/9bb3d04c94a09e92375ae5377ab5187e1af3f6aa
How researchers see this paper
The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.
In Artificial Intelligence
- Cho-Jui Hsieh
- Huan Zhang
- Ajmal Saeed Mian
- Mubarak Shah
- Shiqi Wang
- Naveed Akhtar
- Navid Kardan
- Suman Sekhar Jana
Citations in the corpus
- Advances in adversarial attacks and defenses in computer vision: A survey (2021, methodology): “[226] showed that directly applying robustification methods, e.”
- Beta-CROWN: Efficient Bound Propagation with Per-neuron Split Constraints for Neural Network Robustness Verification (2021, background): “The main benefit of CROWN is its efficiency: CROWN can be efficiently implemented on machine learning accelerators such as GPUs (Xu et al., 2020) and TPUs (Zhang et al., 2020), and it can be a few magnitudes faster than an LP verifier which is hard to parallelize on GPUs.”