AI Insight
This study investigates black-box adversarial attacks on deep reinforcement learning systems, where attackers perturb observations using a surrogate model to fool an unknown victim agent. The researchers found that standard image-classification attack methods transfer poorly to reinforcement learning contexts, performing no better than random noise. They developed a trajectory-level attack method that optimizes sequences of perturbations over time horizons, which significantly outperformed existing per-step attacks across different model architectures and algorithms in experiments with DQN and DDQN agents on CartPole-v1.
Why it matters
This research exposes critical security vulnerabilities in deployed reinforcement learning systems, particularly those used in autonomous systems, robotics, and decision-making applications. Understanding how adversarial attacks transfer between different RL agents is essential for developing more robust defenses and ensuring the safety of real-world AI systems that may face malicious manipulation.
Understand the Science
⚠️ Preprint – Noch nicht peer-reviewed
Dieser Artikel wurde noch nicht von unabhängigen Experten begutachtet. Die Ergebnisse sind vorläufig und sollten mit Vorsicht interpretiert werden.
Abstract: Most adversarial attacks on deep reinforcement learning (DRL) assume white-box access to the victim policy, which rarely holds in practice. This paper studies transfer-based black-box attacks on DRL: the attacker crafts observation perturbations on a white-box surrogate agent and feeds them to an unknown victim. We formulate the attack as return minimization under a per-step perturbation budget. We first show that transplanting transferable image-classification attacks (FGSM, MI-FGSM, and NI-FGSM) with a per-step objective yields perturbations that transfer but are no stronger than random noise of the same budget. We then propose a trajectory-level attack that optimizes a sequence of perturbations over a receding horizon through a differentiable model of the environment and a temperature-smoothed surrogate policy, with the same optimizers. On CartPole-v1 with ten DQN and DDQN agents and 100 surrogate–victim pairs, the trajectory-level attack outperforms per-step attacks and random noise in the white-box, cross-model, and cross-algorithm settings.
Source: Boosting Transferable Adversarial Attacks against Deep Reinforcement Learning