Blackbox Attacks on Reinforcement Learning Agents Using Approximated Temporal Information
Blackbox Attacks on Reinforcement Learning Agents Using Approximated Temporal Information
复制标题
使用近似时间信息对强化学习代理进行黑盒攻击
DOI：
--
复制
发表时间：
2019
期刊：
影响因子：
--
通讯作者：
Ross Anderson
中科院分区：
文献类型：
--
作者：
Yiren Zhao;Ilia Shumailov;Han Cui;Xitong Gao;R. Mullins;Ross Anderson
最近关于强化学习（RL）的研究表明，经过训练的代理很容易受到恶意制作的对抗样本的攻击。在这项工作中，我们将展示如何将这些样本从白盒和灰盒攻击推广到强大的黑盒情况下，攻击者不知道代理，他们的训练参数或训练方法。我们使用序列到序列模型来预测一个受过训练的代理将做出的单个动作或一系列未来动作。首先，我们证明了我们的近似模型，基于代理的时间序列信息，一致地预测RL代理的未来行动，在广泛的游戏和RL算法的黑盒设置中具有高精度。其次，我们发现，尽管对抗性样本可以从序列到序列模型转移到我们的RL代理，但它们的表现往往只略优于随机高斯噪声。第三，我们提出了对抗样本在RL代理的黑盒攻击中的新用途：它们可以用于触发经过训练的代理在特定的时间延迟后行为不端。这可能使攻击者能够使用RL代理控制的设备作为定时炸弹。
Recent research on reinforcement learning (RL) has suggested that trained agents are vulnerable to maliciously-crafted adversarial samples. In this work, we show how such samples can be generalised from White-box and Grey-box attacks to a strong Black-box case, where the attacker has no knowledge of the agents, their training parameters or their training methods. We use sequence-to-sequence models to predict a single action or a sequence of future actions that a trained agent will make. First, we show that our approximation model, based on time-series information from the agent, consistently predicts RL agents’ future actions with high accuracy in a Black-box setup on a wide range of games and RL algorithms. Second, we find that although adversarial samples are transferable from the sequence-to-sequence model to our RL agents, they often outperform Random Gaussian Noise only marginally. Third, we propose a novel use for adversarial samples in Black-box attacks of RL agents: they can be used to trigger a trained agent to misbehave after a specific time delay. This potentially enables an attacker to use devices controlled by RL agents as time bombs.
影响因子：
12
作者：
Andrew Bagnell;March
通讯作者：
Andrew Bagnell;March
影响因子：
11.2
作者：
Pereira, Andre Luis S.;do Nascirnento, Diego M.;Rosa, Morsyleide de F.
通讯作者：
Rosa, Morsyleide de F.