Local Environment Poisoning Attacks on Federated Reinforcement Learning

TL;DR

This paper investigates the vulnerability of federated reinforcement learning to poisoning attacks, proposing a general framework that effectively degrades system performance across various environments and algorithms.

Contribution

It introduces a novel poisoning framework for federated reinforcement learning, extending to actor-critic methods, and demonstrates its effectiveness through extensive experiments.

Findings

Poisoning can significantly reduce RL system performance.

The proposed method outperforms baseline poisoning techniques.

Federated RL systems are vulnerable to targeted poisoning attacks.

Abstract

Federated learning (FL) has become a popular tool for solving traditional Reinforcement Learning (RL) tasks. The multi-agent structure addresses the major concern of data-hungry in traditional RL, while the federated mechanism protects the data privacy of individual agents. However, the federated mechanism also exposes the system to poisoning by malicious agents that can mislead the trained policy. Despite the advantage brought by FL, the vulnerability of Federated Reinforcement Learning (FRL) has not been well-studied before. In this work, we propose a general framework to characterize FRL poisoning as an optimization problem and design a poisoning protocol that can be applied to policy-based FRL. Our framework can also be extended to FRL with actor-critic as a local RL algorithm by training a pair of private and public critics. We provably show that our method can strictly hurt the global objective. We verify our poisoning effectiveness by conducting extensive experiments targeting mainstream RL algorithms and over various RL OpenAI Gym environments covering a wide range of difficulty levels. Within these experiments, we compare clean and baseline poisoning methods against our proposed framework. The results show that the proposed framework is successful in poisoning FRL systems and reducing performance across various environments and does so more effectively than baseline methods. Our work provides new insights into the vulnerability of FL in RL training and poses new challenges for designing robust FRL algorithms