Targeted Attack on Deep RL-based Autonomous Driving with Learned Visual Patterns
Targeted Attack on Deep RL-based Autonomous Driving with Learned Visual Patterns
复制标题
DOI：
10.1109/icra46639.2022.9811574
复制
发表时间：
2021-09
期刊：
影响因子：
--
通讯作者：
Prasanth Buddareddygari;Travis Zhang;Yezhou Yang;Yi Ren-
中科院分区：
文献类型：
--
作者：
Prasanth Buddareddygari;Travis Zhang;Yezhou Yang;Yi Ren-
近期研究表明，通过深度强化学习获得的控制策略在面对对抗性攻击时很脆弱，这引发了人们对将此类模型应用于自动驾驶等对风险敏感任务的担忧。这些演示中的威胁模型仅限于（1）通过实时操纵智能体的观测进行有针对性的攻击，以及（2）通过操纵物理环境进行无针对性的攻击。前者假定在任何时候都能完全获取智能体的状态/观测，而后者无法控制攻击结果。本文研究了通过放置在环境中物理对象上的视觉学习模式进行有针对性攻击的可行性，这是一种结合了现有威胁模型实用性和有效性的威胁模型。通过分析，我们证明当存在对抗性物体时，预训练的策略可能在一个时间窗口内被劫持，例如执行非预期的自动泊车。为了实现攻击，我们采用一个假设，即攻击者能够了解环境和智能体的动态。最后，我们通过实验展示了所提出的攻击在不同驾驶场景中的有效性，进行了位置鲁棒性测试，并研究了攻击强度与其有效性之间的权衡。代码可在https://github.com/ASU - APG/Targeted - Physical - Adversarial - Attacks - on - AD获取。
Recent studies demonstrated the vulnerability of control policies learned through deep reinforcement learning against adversarial attacks, raising concerns about the application of such models to risk-sensitive tasks such as autonomous driving. Threat models for these demonstrations are limited to (1) targeted attacks through real-time manipulation of the agent's observation, and (2) untargeted attacks through manipulation of the physical environment. The former assumes full access to the agent's states/observations at all times, while the latter has no control over attack outcomes. This paper investigates the feasibility of targeted attacks through visually learned patterns placed on physical objects in the environment, a threat model that combines the practicality and effectiveness of the existing ones. Through analysis, we demonstrate that a pre-trained policy can be hijacked within a time window, e.g., performing an unintended self-parking, when an adversarial object is present. To enable the attack, we adopt an assumption that the dynamics of both the environment and the agent can be learned by the attacker. Lastly, we empirically show the effectiveness of the proposed attack on different driving scenarios, perform a location robustness test, and study the tradeoff between the attack strength and its effectiveness Code is available at https://github.com/ASU-APG/ Targeted-Physical-Adversarial-Attacks-on-AD