Black-box attacks in deep reinforcement learning typically involve training substitute policies to imitate the behavior of target policies, crafting adversarial examples, and using these transferable adversarial examples to attack target policies. Previous works primarily study the transferability on non-targeted setting. However, recent studies show defects that lead to the difficulty in generating transferable targeted examples: noise curing. To address the above issues, we introduce a novel approach for targeted attacks that effectively generates more transferable adversarial examples. Our proposed method utilizes the Poincaré distance as a similarity metric, which allows for self-adaptive gradient magnitudes during iterative attacks and helps alleviate issues related to noise curing. Furthermore, we incorporate metric learning into the targeted attack process to steer adversarial examples away from the true action and enhance the transferability of targeted adversarial examples.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Black-Box Target Adversarial Examples Against Deep Reinforcement Learning

  • ZongHeng Zhao,
  • Chao Yi

摘要

Black-box attacks in deep reinforcement learning typically involve training substitute policies to imitate the behavior of target policies, crafting adversarial examples, and using these transferable adversarial examples to attack target policies. Previous works primarily study the transferability on non-targeted setting. However, recent studies show defects that lead to the difficulty in generating transferable targeted examples: noise curing. To address the above issues, we introduce a novel approach for targeted attacks that effectively generates more transferable adversarial examples. Our proposed method utilizes the Poincaré distance as a similarity metric, which allows for self-adaptive gradient magnitudes during iterative attacks and helps alleviate issues related to noise curing. Furthermore, we incorporate metric learning into the targeted attack process to steer adversarial examples away from the true action and enhance the transferability of targeted adversarial examples.