Adversarial Black-Box Attacks on Vision-based Deep Reinforcement Learning Agents

Abstract

Deep reinforcement learning (DRL) has had a profound impact in the field of robotic learning, especially in vision-based end-to-end applications. To ensure the robustness and stability of such robotic systems, their vulnerability to possible adversarial attacks must be explored. In this paper we demonstrate the first realistic black-box attack on vision-based DRL systems by adopting the concept of adversarial patches. Agents trained to perform object grasping based only on visual input are manipulated through their observation space. Different patch sizes and positions for attacks targeting DRL systems in simulation are evaluated, which prove to be decisive factors that greatly influence the effectiveness of adversarial patch attacks. Despite the fact that evaluated adversarial patches take up less than 2% of the images observed, the attacked DRL systems are heavily affected and show performance drop of up to 99 %. Our experiments and results in the simulation pave the way for more realistic adversarial attacks on DRL agents.