Adversarial joint attacks on legged robots
Adversarial joint attacks on legged robots
复制标题
DOI：
10.1109/smc53654.2022.9945546
复制
发表时间：
2022-05
期刊：
影响因子：
--
通讯作者：
Takuto Otomo;Hiroshi Kera;K. Kawamoto
中科院分区：
文献类型：
--
作者：
Takuto Otomo;Hiroshi Kera;K. Kawamoto
我们解决了对通过深度强化学习训练的腿部机器人关节处的致动器的对抗性攻击。对联合攻击的脆弱性会显著影响腿部机器人的安全性和健壮性。在这项研究中，我们证明了对执行器的力矩控制信号的对抗性扰动可以显著减少机器人的奖励并导致机器人行走不稳定。为了发现对抗性扭矩扰动，我们开发了黑盒对抗性攻击，其中对手不能访问通过深度强化学习训练的神经网络。无论深度强化学习的体系结构和算法如何，黑盒攻击都可以应用于腿部机器人。对于黑盒对抗性攻击，我们采用了三种搜索方法：随机搜索、差分进化和数值梯度下降方法。在OpenAI健身房环境下，对四足机器人Ant-v2和两足机器人人形v2进行了实验，发现在三种方法中，差分进化方法可以有效地找到最强的扭矩扰动。此外，我们还认识到四足机器人Ant-v2容易受到对抗性扰动的影响，而两足机器人人形v2对扰动具有很强的鲁棒性。因此，联合攻击可用于机器人行走不稳定性的主动诊断。
We address adversarial attacks on the actuators at the joints of legged robots trained by deep reinforcement learning. The vulnerability to the joint attacks can significantly impact the safety and robustness of legged robots. In this study, we demonstrate that the adversarial perturbations to the torque control signals of the actuators can significantly reduce the rewards and cause walking instability in robots. To find the adversarial torque perturbations, we develop black-box adversarial attacks, where the adversary cannot access the neural networks trained by deep reinforcement learning. The black box attack can be applied to legged robots regardless of the architecture and algorithms of deep reinforcement learning. We employ three search methods for the black-box adversarial attacks: random search, differential evolution, and numerical gradient descent methods. In experiments with the quadruped robot Ant-v2 and the bipedal robot Humanoid-v2, in OpenAI Gym environments, we find that differential evolution can efficiently find the strongest torque perturbations among the three methods. In addition, we realize that the quadruped robot Ant-v2 is vulnerable to the adversarial perturbations, whereas the bipedal robot Humanoid-v2 is robust to the perturbations. Consequently, the joint attacks can be used for proactive diagnosis of robot walking instability.