Real-time Adversarial Perturbations against Deep Reinforcement Learning Policies: Attacks and Defenses
Deep reinforcement learning (DRL) is vulnerable to adversarial perturbations. Adversaries can mislead the policies of DRL agents by perturbing the state of the environment observed by the agents. Existing attacks are feasible in principle, but face challenges in practice, either by being too slow to fool DRL policies in real time or by modifying past observations stored in the agent's memory. We show that Universal Adversarial Perturbations (UAP), independent of the individual inputs to which they are applied, can fool DRL policies effectively and in real time. We introduce three attack variants leveraging UAP. Via an extensive evaluation using three Atari 2600 games, we show that our attacks are effective, as they fully degrade the performance of three different DRL agents (up to 100%, even when the $l_\infty$ bound on the perturbation is as small as 0.01). It is faster than the frame rate (60 Hz) of image capture and considerably faster than prior attacks ($\approx 1.8$ms). Our attack technique is also efficient, incurring an online computational cost of $\approx 0.027$ms. Using two tasks involving robotic movement, we confirm that our results generalize to complex DRL tasks. Furthermore, we demonstrate that the effectiveness of known defenses diminishes against universal perturbations. We introduce an effective technique that detects all known adversarial perturbations against DRL policies, including all universal perturbations presented in this paper.
Code (1)
Tasks
Atari GamesDeep Reinforcement Learningreinforcement-learningReinforcement Learning (RL)Similar Papers 제목 키워드 기반
Whatever Does Not Kill Deep Reinforcement Learning, Makes It Stronger
Recent developments have established the vulnerability of deep Reinforcement Learning (RL) to policy manipulation attacks via adversarial perturbations. In this paper, we investigate the robustness and resilience of deep…
Deep Reinforcement Learningreinforcement-learningReinforcement LearningReinforcement Learning (RL)RoMFAC: A robust mean-field actor-critic reinforcement learning against adversarial perturbations on states
Multi-agent deep reinforcement learning makes optimal decisions dependent on system states observed by agents, but any uncertainty on the observations may mislead agents to take wrong actions. The Mean-Field Actor-Critic…
Deep Reinforcement Learningreinforcement-learningReinforcement LearningReinforcement Learning (RL)Mitigating Adversarial Perturbations for Deep Reinforcement Learning via Vector Quantization
Recent studies reveal that well-performing reinforcement learning (RL) agents in training often lack resilience against adversarial perturbations during deployment. This highlights the importance of building a robust age…
Deep Reinforcement LearningQuantizationreinforcement-learningReinforcement Learning+1Robustness Evaluation of Offline Reinforcement Learning for Robot Control Against Action Perturbations
Offline reinforcement learning, which learns solely from datasets without environmental interaction, has gained attention. This approach, similar to traditional online deep reinforcement learning, is particularly promisi…
Deep Reinforcement LearningOpenAI Gymreinforcement-learningReinforcement LearningTowards Robust Deep Reinforcement Learning against Environmental State Perturbation
Adversarial attacks and robustness in Deep Reinforcement Learning (DRL) have been widely studied in various threat models; however, few consider environmental state perturbations, which are natural in embodied scenarios.…
Deep Reinforcement Learningreinforcement-learningReinforcement Learning