Adversarial Attacks on Neural Network Policies

TL;DR

This paper demonstrates that neural network policies in reinforcement learning are vulnerable to adversarial attacks, which can significantly impair performance with minimal input perturbations, across various tasks and training methods.

Contribution

It extends adversarial attack analysis from computer vision to reinforcement learning policies, highlighting their vulnerability and characterizing attack effectiveness in different settings.

Findings

Adversarial attacks cause significant performance drops in RL policies.

Small, imperceptible input perturbations can deceive policies.

Vulnerability persists across different tasks and training algorithms.

Abstract

Machine learning classifiers are known to be vulnerable to inputs maliciously constructed by adversaries to force misclassification. Such adversarial examples have been extensively studied in the context of computer vision applications. In this work, we show adversarial attacks are also effective when targeting neural network policies in reinforcement learning. Specifically, we show existing adversarial example crafting techniques can be used to significantly degrade test-time performance of trained policies. Our threat model considers adversaries capable of introducing small perturbations to the raw input of the policy. We characterize the degree of vulnerability across tasks and training algorithms, for a subclass of adversarial-example attacks in white-box and black-box settings. Regardless of the learned task or training algorithm, we observe a significant drop in performance, even with small adversarial perturbations that do not interfere with human perception. Videos are available at http://rll.berkeley.edu/adversarial.