Adversarial Attack against Deep Reinforcement Learning with Static Reward Impact Map

Abstract

Security problems of deep reinforcement learning draw much attention recently. Previous works on adversary attack mainly focus on preventing the targeted agent from choosing the most desirable action at each step, which may not reduce the cumulative reward effectively. In this paper, we first investigate how changing features affect the cumulative reward achieved by an agent. The static reward impact map is introduced to quantify the influence on the reward of each feature experimentally. By focusing on tasks with the static reward impact map, an adversarial attack method against deep reinforcement learning aiming to minimize the cumulative reward is proposed. Features with the large reward impact are perturbed in crafting an adversarial sample. Deep Q-network is selected to demonstrate the performance of our attack method in the experiments. The results indicate that our proposed method achieves better performance than the existing one-time attack method and the random attack in terms of the cumulative reward and the successful attack rate under both white-box and black-box settings.

Lab Members

Patrick Chan

Associate Professor, Vice Dean

Patrick Chan works on machine learning, deep learning, image processing, adversarial learning, and secure machine learning.