Mitigation of Policy Manipulation Attacks on Deep Q-Networks with Parameter-Space Noise

TL;DR

This paper introduces a method to defend deep Q-networks against policy manipulation attacks by adding noise to model parameters during training, which reduces adversarial transferability and enhances robustness against various attack types.

Contribution

The paper proposes a novel mitigation technique using parameter-space noise in deep reinforcement learning to defend against adversarial policy manipulation attacks.

Findings

Parameter-space noise reduces transferability of adversarial examples.

Technique effectively mitigates whitebox and blackbox attacks.

Improves robustness of deep Q-networks during training and testing.

Abstract

Recent developments have established the vulnerability of deep reinforcement learning to policy manipulation attacks via intentionally perturbed inputs, known as adversarial examples. In this work, we propose a technique for mitigation of such attacks based on addition of noise to the parameter space of deep reinforcement learners during training. We experimentally verify the effect of parameter-space noise in reducing the transferability of adversarial examples, and demonstrate the promising performance of this technique in mitigating the impact of whitebox and blackbox attacks at both test and training times.