Robust Deep Reinforcement Learning against Adversarial Perturbations on State Observations
arXiv:2003.08938
Abstract
A deep reinforcement learning (DRL) agent observes its states through observations, which may contain natural measurement errors or adversarial noises. Since the observations deviate from the true states, they can mislead the agent into making suboptimal actions. Several works have shown this vulnerability via adversarial attacks, but existing approaches on improving the robustness of DRL under this setting have limited success and lack for theoretical principles. We show that naively applying existing techniques on improving robustness for classification tasks, like adversarial training, is ineffective for many RL tasks. We propose the state-adversarial Markov decision process (SA-MDP) to study the fundamental properties of this problem, and develop a theoretically principled policy regularization which can be applied to a large family of DRL algorithms, including proximal policy optimization (PPO), deep deterministic policy gradient (DDPG) and deep Q networks (DQN), for both discrete and continuous action control problems. We significantly improve the robustness of PPO, DDPG and DQN agents under a suite of strong white box adversarial attacks, including new attacks of our own. Additionally, we find that a robust policy noticeably improves DRL performance even without an adversary in a number of environments. Our code is available at https://github.com/chenhongge/StateAdvDRL.
arXiv commentHuan Zhang and Hongge Chen contributed equally
References in corpus (38)
- Continuous control with deep reinforcement learning
- Trust Region Policy Optimization
- Addressing Function Approximation Error in Actor-Critic Methods
- Prioritized Experience Replay
- Dueling Network Architectures for Deep Reinforcement Learning
- Dota 2 with Large Scale Deep Reinforcement Learning
- Theoretically Principled Trade-off between Robustness and Accuracy
- Provable defenses against adversarial examples via the convex outer adversarial polytope
- Solving Rubik's Cube with a Robot Hand
- Robust Adversarial Reinforcement Learning
- Safe, Multi-Agent, Reinforcement Learning for Autonomous Driving
- Distributional Smoothing with Virtual Adversarial Training
- Deep Reinforcement Learning that Matters
- Efficient Neural Network Robustness Certification with General Activation Functions
- Distributed Distributional Deterministic Policy Gradients
- Continuous Deep Q-Learning with Model-based Acceleration
- On the Effectiveness of Interval Bound Propagation for Training Verifiably Robust Models
- Efficient Formal Safety Analysis of Neural Networks
- A Dual Approach to Scalable Verification of Deep Networks
- Virtual to Real Reinforcement Learning for Autonomous Driving
- Non-convex learning via Stochastic Gradient Langevin Dynamics: a nonasymptotic analysis
- Implementation Matters in Deep Policy Gradients: A Case Study on PPO and TRPO
- A Convex Relaxation Barrier to Tight Robustness Verification of Neural Networks
- Delving into adversarial attacks on deep policies
- Action Robust Reinforcement Learning and Applications in Continuous Control
- A Hitting Time Analysis of Stochastic Gradient Langevin Dynamics
- Characterizing Attacks on Deep Reinforcement Learning
- Certified Adversarial Robustness for Deep Reinforcement Learning
- Rigorous Agent Evaluation: An Adversarial Approach to Uncover Catastrophic Failures
- Robust Reinforcement Learning for Continuous Control with Model Misspecification
- Whatever Does Not Kill Deep Reinforcement Learning, Makes It Stronger
- Online Robust Policy Learning in the Presence of Unknown Adversaries
- Adversary A3C for Robust Reinforcement Learning
- Optimal Attacks on Reinforcement Learning Policies
- Deep Robust Kalman Filter
- Learning Robust Options
- Online Robustness Training for Deep Reinforcement Learning
- Gradient Band-based Adversarial Training for Generalized Attack Immunity of A3C Path Finding