Adversarial Reinforcement Learning under Partial Observability in Autonomous Computer Network Defence
arXiv:1902.09062
Abstract
Recent studies have demonstrated that reinforcement learning (RL) agents are susceptible to adversarial manipulation, similar to vulnerabilities previously demonstrated in the supervised learning setting. While most existing work studies the problem in the context of computer vision or console games, this paper focuses on reinforcement learning in autonomous cyber defence under partial observability. We demonstrate that under the black-box setting, where the attacker has no direct access to the target RL model, causative attacks---attacks that target the training process---can poison RL agents even if the attacker only has partial observability of the environment. In addition, we propose an inversion defence method that aims to apply the opposite perturbation to that which an attacker might use to generate their adversarial samples. Our experimental results illustrate that the countermeasure can effectively reduce the impact of the causative attack, while not significantly affecting the training process in non-attack scenarios.
8 pages, 4 figures
References in corpus (22)
- Explaining and Harnessing Adversarial Examples
- Intriguing properties of neural networks
- Playing Atari with Deep Reinforcement Learning
- Ensemble Adversarial Training: Attacks and Defenses
- Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
- Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
- Adversarial Attacks on Neural Networks for Graph Data
- Poisoning Attacks against Support Vector Machines
- Detecting Adversarial Samples from Artifacts
- Adversarial Feature Selection against Evasion Attacks
- Keeping the Bad Guys Out: Protecting and Vaccinating Deep Learning with JPEG Compression
- Adversarial Attack on Graph Structured Data
- Robust Deep Reinforcement Learning with Adversarial Attacks
- Tactics of Adversarial Attack on Deep Reinforcement Learning Agents
- Blocking Transferability of Adversarial Examples in Black-Box Learning Systems
- Improving the Robustness of Deep Neural Networks via Stability Training
- Certified Defenses for Data Poisoning Attacks
- Adversarial Example Defenses: Ensembles of Weak Defenses are not Strong
- Curie: A method for protecting SVM Classifier from Poisoning Attack
- Detecting Adversarial Attacks on Neural Network Policies with Visual Foresight
- Online Robust Policy Learning in the Presence of Unknown Adversaries
- Adversarial Examples Detection in Deep Networks with Convolutional Filter Statistics