Characterizing Attacks on Deep Reinforcement Learning

Abstract

Recent studies show that Deep Reinforcement Learning (DRL) models are vulnerable to adversarial attacks, which attack DRL models by adding small perturbations to the observations. However, some attacks assume full availability of the victim model, and some require a huge amount of computation, making them less feasible for real world applications. In this work, we make further explorations of the vulnerabilities of DRL by studying other aspects of attacks on DRL using realistic and efficient attacks. First, we adapt and propose efficient black-box attacks when we do not have access to DRL model parameters. Second, to address the high computational demands of existing attacks, we introduce efficient online sequential attacks that exploit temporal consistency across consecutive steps. Third, we explore the possibility of an attacker perturbing other aspects in the DRL setting, such as the environment dynamics. Finally, to account for imperfections in how an attacker would inject perturbations in the physical world, we devise a method for generating a robust physical perturbations to be printed. The attack is evaluated on a real-world robot under various conditions. We conduct extensive experiments both in simulation such as Atari games, robotics and autonomous driving, and on real-world robotics, to compare the effectiveness of the proposed attacks with baseline approaches. To the best of our knowledge, we are the first to apply adversarial attacks on DRL systems to physical robots.

AAMAS 2022, 13 pages, 6 figures

References in corpus (4)

• ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
• Robust Adversarial Reinforcement Learning
• Exploring the Space of Black-box Attacks on Deep Neural Networks
• How You Act Tells a Lot: Privacy-Leakage Attack on Deep Reinforcement Learning

Cited by in corpus (17)

• Invisible for both Camera and LiDAR: Security of Multi-Sensor Fusion based Perception in Autonomous Driving Under Physical-World Attacks
• Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoning
• Machine Learning for Security in Vehicular Networks: A Comprehensive Survey
• Robust Reinforcement Learning on State Observations with Learned Optimal Adversary
• Robust Deep Reinforcement Learning against Adversarial Perturbations on State Observations
• Network Environment Design for Autonomous Cyberdefense
• Who Is the Strongest Enemy? Towards Optimal and Efficient Evasion Attacks in Deep RL
• Adversarial Attacks on Reinforcement Learning based Energy Management Systems of Extended Range Electric Delivery Vehicles
• Network Defense is Not a Game
• Adversarial joint attacks on legged robots
• Understanding Adversarial Attacks on Observations in Deep Reinforcement Learning
• Stealing Deep Reinforcement Learning Models for Fun and Profit
• Generating Socially Acceptable Perturbations for Efficient Evaluation of Autonomous Vehicles
• Minimalistic Attacks: How Little it Takes to Fool a Deep Reinforcement Learning Policy
• Adversary Agnostic Robust Deep Reinforcement Learning
• Adversarial Body Shape Search for Legged Robots
• Adversarial Reinforcement Learning in Dynamic Channel Access and Power Control