Understanding Adversarial Attacks on Observations in Deep Reinforcement Learning

Abstract

Recent works demonstrate that deep reinforcement learning (DRL) models are vulnerable to adversarial attacks which can decrease the victim's total reward by manipulating the observations. Compared with adversarial attacks in supervised learning, it is much more challenging to deceive a DRL model since the adversary has to infer the environmental dynamics. To address this issue, we reformulate the problem of adversarial attacks in function space and separate the previous gradient based attacks into several subspace. Following the analysis of the function space, we design a generic two-stage framework in the subspace where the adversary lures the agent to a target trajectory or a deceptive policy. In the first stage, we train a deceptive policy by hacking the environment, and discover a set of trajectories routing to the lowest reward. The adversary then misleads the victim to imitate the deceptive policy by perturbing the observations. Our method provides a tighter theoretical upper bound for the attacked agent's performance than the existing approaches. Extensive experiments demonstrate the superiority of our method and we achieve the state-of-the-art performance on both Atari and MuJoCo environments.Preprint. Under review.

Consistent Attack: Universal Adversarial Perturbation on Embodied Vision Navigation

“…Extensive experimental results illustrate that our Consistent Attack can significantly reduce the performance of existing Embodied Vision Navigation policies on Habitat [Savva et al, 2019], which shows the effectiveness of our method and the vulnerability of existing Embodied Vision Navigation policies. In summary, our contributions are…”

“…Since the agent in Embodied Vision Navigation needs to interact with the environment [Beattie et al, 2016;Kolve et al, 2017;Savva et al, 2019] actively, its security are even more important compared with the traditional AI task, e.g., image classification. For example, in the PointGoal navigation task [Anderson et al, 2018] in Habitat, i.e., the agent tries to find a path to reach the destination, the agent might be in danger when having collisions in this scenario [Savva et al, 2019]. In this paper, we mainly focus on the security of the agent [Savva et al, 2019] in the PointGoal task in Habitat, which is a common and popular baseline in Embodied AI.…”

“…For example, in the PointGoal navigation task [Anderson et al, 2018] in Habitat, i.e., the agent tries to find a path to reach the destination, the agent might be in danger when having collisions in this scenario [Savva et al, 2019]. In this paper, we mainly focus on the security of the agent [Savva et al, 2019] in the PointGoal task in Habitat, which is a common and popular baseline in Embodied AI.…”

“…[Zhang et al, 2020b] proposed a framework named state-adversarial Markov decision process (SA-MDP) for analyzing the adversarial disturbance on state observation in reinforcement learning (RL). Recently, [Qiaoben et al, 2021] summarized existing adversarial attack methods on observations in RL and proposed a novel two-stage adversarial attack method. However, these adversarial attack methods generate different disturbances at each timestep, which are impracticable on Embodied Vision Navigation.…”

GSmooth: Certified Robustness against Semantic Transformations via Generalized Randomized Smoothing

“…formations (Engstrom et al, 2019;Hendrycks & Dietterich, 2019), which can limit their applications in various securitysensitive tasks. For example, a small adversarial patch on the road markings can mislead the autonomous driving system (Jing et al, 2021;Qiaoben et al, 2021), which raises severe safety concerns. Compared with the p -norm bounded adversarial examples, semantic transformations can occur more naturally in real-world scenarios and are often unrestricted, including image rotation, translation, blur, weather, etc., most of which are common corruptions (Hendrycks & Dietterich, 2019).…”