mlsanityData to 14 Oct 2026

Real-time Adversarial Perturbations against Deep Reinforcement Learning Policies: Attacks and Defenses

arXiv 2106.08746 ↗First posted 16 Jun 2021cs.LG cs.AI cs.CRcited by 9

Not on the map. Why?

Abstract (arXiv)

Deep reinforcement learning (DRL) is vulnerable to adversarial perturbations. Adversaries can mislead the policies of DRL agents by perturbing the state of the environment observed by the agents. Existing attacks are feasible in principle, but face challenges in practice, either by being too slow to fool DRL policies in real time or by modifying past observations stored in the agent's memory. We show that Universal Adversarial Perturbations (UAP), independent of the individual inputs to which they are applied, can fool DRL policies effectively and in real time. We introduce three attack variants leveraging UAP. Via an extensive evaluation using three Atari 2600 games, we show that our attacks are effective, as they fully degrade the performance of three different DRL agents (up to 100%, even when the l_∞ bound on the perturbation is as small as 0.01). It is faster than the frame rate (60 Hz) of image capture and considerably faster than prior attacks (≈ 1.8ms). Our attack technique is also efficient, incurring an online computational cost of ≈ 0.027ms. Using two tasks involving robotic movement, we confirm that our results generalize to complex DRL tasks. Furthermore, we demonstrate that the effectiveness of known defenses diminishes against universal perturbations. We introduce an effective technique that detects all known adversarial perturbations against DRL policies, including all universal perturbations presented in this paper.

Key facts. Cited by 9 papers in the map (data through 14 Oct 2026). Builds on 32 of its 45 references that are in the map. First posted on arXiv 16 Jun 2021.

Builds on

32 of 45 references.

References · 32

  1. 2017Proximal Policy Optimization Algorithmscited by 15,215
  2. 2014ImageNet Large Scale Visual Recognition Challengecited by 8,498
  3. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  4. 2013Intriguing properties of neural networkscited by 5,155
  5. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,998
  6. 2016Asynchronous Methods for Deep Reinforcement Learningcited by 2,258
  7. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,318
  8. 2018DeepMind Control Suitecited by 956
  9. 2015The Limitations of Deep Learning in Adversarial Settingscited by 790
  10. 2016Universal adversarial perturbationscited by 784
  11. 2020On Adaptive Attacks to Adversarial Example Defensescited by 555
  12. 2017Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methodscited by 546
20 more
  1. 2017Adversarial Attacks on Neural Network Policiescited by 320
  2. 2017MagNet: a Two-Pronged Defense against Adversarial Examplescited by 269
  3. 2020Robust Deep Reinforcement Learning against Adversarial Perturbations on State Observationscited by 238
  4. 2019Adversarial Policies: Attacking Deep Reinforcement Learningcited by 214
  5. 2017Tactics of Adversarial Attack on Deep Reinforcement Learning Agentscited by 166
  6. 2015Accelerating Very Deep Convolutional Networks for Classification and Detectioncited by 109
  7. 2017Delving into adversarial attacks on deep policiescited by 104
  8. 2017Vulnerability of Deep Reinforcement Learning to Policy Induction Attackscited by 91
  9. 2020Robust Deep Reinforcement Learning through Adversarial Losscited by 75
  10. 2017Fast Feature Fool: A data independent approach to universal adversarial perturbationscited by 66
  11. 2020Stealthy and Efficient Adversarial Attacks against Deep Reinforcement Learningcited by 63
  12. 2017NAG: Network for Adversary Generationcited by 51
  13. 2017Whatever Does Not Kill Deep Reinforcement Learning, Makes It Strongercited by 35
  14. 2019Characterizing Attacks on Deep Reinforcement Learningcited by 31
  15. 2018Procedural Noise Adversarial Examples for Black-Box Attacks on Deep Convolutional Networkscited by 21
  16. 2017Detecting Adversarial Attacks on Neural Network Policies with Visual Foresightcited by 17
  17. 2019Snooping Attacks on Deep Reinforcement Learningcited by 17
  18. 2018Sequential Attacks on Agents for Long-Term Adversarial Goalscited by 16
  19. 2019Blackbox Attacks on Reinforcement Learning Agents Using Approximated Temporal Informationcited by 13
  20. 2019CopyCAT: Taking Control of Neural Policies with Constant Attackscited by 12

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2022: 2; 2023: 2; 2024: 0; 2025: 4; 2026: 1.

9 papers.

  1. 2022Robust Adversarial Attacks Detection based on Explainable Deep Reinforcement Learning For UAV Guidance and Planningcited by 13
  2. 2023SoK: Adversarial Machine Learning Attacks and Defences in Multi-Agent Reinforcement Learningcited by 3
  3. 2022Security of Deep Reinforcement Learning for Autonomous Driving: A Surveycited by 2
  4. 2023FLARE: Fingerprinting Deep Reinforcement Learning Agents using Universal Adversarial Maskscited by 2
  5. 2025Enhancing Security in Deep Reinforcement Learning: A Comprehensive Survey on Adversarial Attacks and Defensescited by 2
  6. 2025Towards Robust Deep Reinforcement Learning against Environmental State Perturbationcited by 0
  7. 2025Policy Disruption in Reinforcement Learning:Adversarial Attack with Large Language Models and Critical State Identificationcited by 0
  8. 2025Distributed Detection of Adversarial Attacks in Multi-Agent Reinforcement Learning with Continuous Action Spacecited by 0
  9. 2026CIVA: Critic-Induced Value-Subspace Attacks on Visual World-Model Agentscited by 0