Key result
Untargeted TrojDRL attacks circumvent existing actor-critic algorithm defenses by poisoning ~0.025% of training data.
TrojDRL demonstrates that deep reinforcement learning agents are vulnerable to untargeted backdoor attacks with minimal training data poisoning.
Alerts practitioners to backdoor risks in deployed DRL agents; leaves open development of minimal-poisoning defenses for actor-critic methods.
We present TrojDRL, a tool for exploring and evaluating backdoor attacks on deep reinforcement learning agents. TrojDRL exploits the sequential nature of deep reinforcement learning (DRL) and considers different gradations of threat models. We show that untargeted attacks on state-of-the-art actor-critic algorithms can circumvent existing defenses built on the assumption of backdoors being targeted. We evaluated TrojDRL on a broad set of DRL benchmarks and showed that the attacks require only poisoning as little as 0.025% of the training data. Compared with existing works of backdoor attacks on classification models, TrojDRL provides a first step towards understanding the vulnerability of DRL agents.
No takes yet. Share an insight, caveat, or question.
Kiourti et al. (2020) studied Deep reinforcement learning agents. TrojDRL (backdoor attacks) vs. Existing defenses was evaluated on Vulnerability to backdoor attacks. Untargeted backdoor attacks using TrojDRL can circumvent existing defenses on state-of-the-art actor-critic algorithms by poisoning as little as 0.025% of the training data.
Synapse has enriched 5 closely related papers on similar clinical questions. Consider them for comparative context: