mlsanityData to 7 Oct 2026

Illusory Attacks: Information-Theoretic Detectability Matters in Adversarial Attacks

arXiv 2207.10170 ↗First posted 20 Jul 2022cs.AIcited by 12

Not on the map. Why?

Abstract (arXiv)

Autonomous agents deployed in the real world need to be robust against adversarial attacks on sensory inputs. Robustifying agent policies requires anticipating the strongest attacks possible. We demonstrate that existing observation-space attacks on reinforcement learning agents have a common weakness: while effective, their lack of information-theoretic detectability constraints makes them detectable using automated means or human inspection. Detectability is undesirable to adversaries as it may trigger security escalations. We introduce ε-illusory, a novel form of adversarial attack on sequential decision-makers that is both effective and of ε-bounded statistical detectability. We propose a novel dual ascent algorithm to learn such attacks end-to-end. Compared to existing attacks, we empirically find ε-illusory to be significantly harder to detect with automated methods, and a small study with human participants (IRB approval under reference R84123/RE001) suggests they are similarly harder to detect for humans. Our findings suggest the need for better anomaly detectors, as well as effective hardware- and system-level defenses. The project website can be found at https://tinyurl.com/illusory-attacks.

Key facts. Cited by 12 papers in the map (data through 7 Oct 2026). Builds on 51 of its 103 references that are in the map. First posted on arXiv 20 Jul 2022.

Builds on

51 of 103 references.

References · 51

  1. 2017Proximal Policy Optimization Algorithmscited by 14,441
  2. 2015Faster R-CNN: Towards Real-Time Object Detection with Region Proposal Networkscited by 9,617
  3. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  4. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  5. 2013Intriguing properties of neural networkscited by 5,114
  6. 2018Soft Actor-Critic: Off-Policy Maximum Entropy Deep Reinforcement Learning with a Stochastic Actorcited by 4,635
  7. 2016Variational Inference: A Review for Statisticianscited by 1,466
  8. 2018PointRCNN: 3D Object Proposal Generation and Detection from Point Cloudcited by 939
  9. 2017Constrained Policy Optimizationcited by 928
  10. 2018Robustness May Be at Odds with Accuracycited by 873
  11. 2020Image Segmentation Using Deep Learning: A Surveycited by 659
  12. 2017Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networkscited by 484
38 more
  1. 2018Reward Constrained Policy Optimizationcited by 397
  2. 2017Mitigating Adversarial Effects Through Randomizationcited by 382
  3. 2018Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Modelscited by 362
  4. 2020Emergent Complexity and Zero-shot Transfer via Unsupervised Environment Designcited by 260
  5. 2020Robust Deep Reinforcement Learning against Adversarial Perturbations on State Observationscited by 235
  6. 2018ShapeShifter: Robust Physical Adversarial Attack on Faster R-CNN Object Detectorcited by 159
  7. 2019Adversarial Sensor Attack on LiDAR-based Perception in Autonomous Drivingcited by 151
  8. 2020Physically Realizable Adversarial Examples for LiDAR Object Detectioncited by 137
  9. 2021Robust Reinforcement Learning on State Observations with Learned Optimal Adversarycited by 133
  10. 2020Adversarial Camouflage: Hiding Physical-World Attacks with Natural Stylescited by 126
  11. 2019Variational Bayesian Optimal Experimental Designcited by 116
  12. 2021Invisible for both Camera and LiDAR: Security of Multi-Sensor Fusion based Perception in Autonomous Driving Under Physical-World Attackscited by 101
  13. 2020Towards Robust LiDAR-based Perception in Autonomous Driving: General Black-box Adversarial Sensor Attack and Countermeasurescited by 95
  14. 2017On Nesting Monte Carlo Estimatorscited by 82
  15. 2018Shield: Fast, Practical Defense and Vaccination for Deep Learning using JPEG Compressioncited by 74
  16. 2020Robust Deep Reinforcement Learning through Adversarial Losscited by 73
  17. 2022A Unified Approach to Reinforcement Learning, Quantal Response Equilibria, and Two-Player Zero-Sum Gamescited by 64
  18. 2020Stealthy and Efficient Adversarial Attacks against Deep Reinforcement Learningcited by 62
  19. 2020Challenges and Countermeasures for Adversarial Attacks on Deep Reinforcement Learningcited by 61
  20. 2021Who Is the Strongest Enemy? Towards Optimal and Efficient Evasion Attacks in Deep RLcited by 54
  21. 2019Deceptive Reinforcement Learning Under Adversarial Manipulations on Cost Signalscited by 50
  22. 2021CROP: Certifying Robust Policies for Reinforcement Learning through Functional Smoothingcited by 41
  23. 2021Policy Smoothing for Provably Robust Reinforcement Learningcited by 39
  24. 2019Rethinking Formal Models of Partially Observable Multiagent Decision Makingcited by 35
  25. 2018Adversarial Perturbations Against Real-Time Video Classification Systemscited by 32
  26. 2022ESCHER: Eschewing Importance Sampling in Games by Computing a History Value Function to Estimate Regretcited by 24
  27. 2020Certifiable Robustness to Adversarial State Uncertainty in Deep Reinforcement Learningcited by 23
  28. 2021Bayesian Sequential Optimal Experimental Design for Nonlinear Models Using Policy Gradient Reinforcement Learningcited by 22
  29. 2015Nested Sequential Monte Carlo Methodscited by 19
  30. 2017Detecting Adversarial Attacks on Neural Network Policies with Visual Foresightcited by 17
  31. 2021Towards Universal Physical Attacks On Cascaded Camera-Lidar 3D Object Detection Modelscited by 14
  32. 2021Understanding Adversarial Attacks on Observations in Deep Reinforcement Learningcited by 13
  33. 2019CopyCAT: Taking Control of Neural Policies with Constant Attackscited by 12
  34. 2016Nonparametric General Reinforcement Learningcited by 10
  35. 2020Neural Joint Entropy Estimationcited by 8
  36. 2021Balancing detectability and performance of attacks on the control channel of Markov Decision Processescited by 4
  37. 2021Detecting and Identifying Optical Signal Attacks on Autonomous Driving Systemscited by 4
  38. 2022Feasible Adversarial Robust Reinforcement Learning for Underspecified Environmentscited by 4

50 most cited of 51 All 51 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 3; 2025: 6; 2026: 3.

12 papers.

  1. 2024Secret Collusion among AI Agents: Multi-Agent Deception via Steganographycited by 107
  2. 2025Open Challenges in Multi-Agent Security: Towards Secure Systems of Interacting AI Agentscited by 66
  3. 2024Unelicitable Backdoors in Language Models via Cryptographic Transformer Circuitscited by 3
  4. 2026A Note on the Strategic Confinement Problemcited by 1
  5. 2024Robust off-policy Reinforcement Learning via Soft Constrained Adversarycited by 0
  6. 2025Off-Policy Actor-Critic for Adversarial Observation Robustness: Virtual Alternative Training via Symmetric Policy Evaluationcited by 0
  7. 2025Adversarial Reinforcement Learning Framework for ESP Cheater Simulationcited by 0
  8. 2025Provably Invincible Adversarial Attacks on Reinforcement Learning Systems: A Rate-Distortion Information-Theoretic Approachcited by 0
  9. 2025Diffusion Guided Adversarial State Perturbations in Reinforcement Learningcited by 0
  10. 2025On the Tension Between Optimality and Adversarial Robustness in Policy Optimizationcited by 0
  11. 2026CIVA: Critic-Induced Value-Subspace Attacks on Visual World-Model Agentscited by 0
  12. 2026Stealth Is a Relation, Not a Property: How Event Representations Create Blind Spots for Timing Attacks in Event-Based Perceptioncited by 0