mlsanityData to 7 Oct 2026

FLARE: Fingerprinting Deep Reinforcement Learning Agents using Universal Adversarial Masks

arXiv 2307.14751 ↗First posted 27 Jul 2023cs.LG cs.CRcited by 1

Not on the map. Why?

Abstract (arXiv)

We propose FLARE, the first fingerprinting mechanism to verify whether a suspected Deep Reinforcement Learning (DRL) policy is an illegitimate copy of another (victim) policy. We first show that it is possible to find non-transferable, universal adversarial masks, i.e., perturbations, to generate adversarial examples that can successfully transfer from a victim policy to its modified versions but not to independently trained policies. FLARE employs these masks as fingerprints to verify the true ownership of stolen DRL policies by measuring an action agreement value over states perturbed by such masks. Our empirical evaluations show that FLARE is effective (100% action agreement on stolen copies) and does not falsely accuse independent policies (no false positives). FLARE is also robust to model modification attacks and cannot be easily evaded by more informed adversaries without negatively impacting agent performance. We also show that not all universal adversarial masks are suitable candidates for fingerprints due to the inherent characteristics of DRL policies. The spatio-temporal dynamics of DRL problems and sequential decision-making process make characterizing the decision boundary of DRL policies more difficult, as well as searching for universal masks that capture the geometry of it.

Key facts. Cited by 1 paper in the map (data through 7 Oct 2026). Builds on 36 of its 50 references that are in the map. First posted on arXiv 27 Jul 2023.

Builds on

36 of 50 references.

References · 36

  1. 2017Proximal Policy Optimization Algorithmscited by 14,441
  2. 2016Asynchronous Methods for Deep Reinforcement Learningcited by 2,218
  3. 2015Learning both Weights and Connections for Efficient Neural Networkscited by 1,998
  4. 2016Universal adversarial perturbationscited by 774
  5. 2015Dueling Network Architectures for Deep Reinforcement Learningcited by 769
  6. 2018QT-Opt: Scalable Deep Reinforcement Learning for Vision-Based Robotic Manipulationcited by 730
  7. 2019Universal Adversarial Triggers for Attacking and Analyzing NLPcited by 709
  8. 2020Deep Reinforcement Learning for Autonomous Driving: A Surveycited by 698
  9. 2018Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooringcited by 334
  10. 2014CNN Features off-the-shelf: an Astounding Baseline for Recognitioncited by 316
  11. 2017Adversarial Attacks on Neural Network Policiescited by 314
  12. 2020Robust Deep Reinforcement Learning against Adversarial Perturbations on State Observationscited by 235
24 more
  1. 2019Adversarial Policies: Attacking Deep Reinforcement Learningcited by 209
  2. 2017The Space of Transferable Adversarial Examplescited by 156
  3. 2019DAWN: Dynamic Adversarial Watermarking of Neural Networkscited by 94
  4. 2019Deep Neural Network Fingerprinting by Conferrable Adversarial Examplescited by 90
  5. 2019Robust Reinforcement Learning for Continuous Control with Model Misspecificationcited by 76
  6. 2020Robust Deep Reinforcement Learning through Adversarial Losscited by 73
  7. 2016Graying the black box: Understanding DQNscited by 68
  8. 2019IPGuard: Protecting Intellectual Property of Deep Neural Networks via Fingerprinting the Classification Boundarycited by 68
  9. 2021SoK: How Robust is Image Classification Deep Neural Network Watermarking? (Extended Version)cited by 67
  10. 2022Fingerprinting Deep Neural Networks Globally via Universal Adversarial Perturbationscited by 58
  11. 2018Cache Telepathy: Leveraging Shared Resource Attacks to Learn DNN Architecturescited by 56
  12. 2017NAG: Network for Adversary Generationcited by 51
  13. 2021Are Vision Transformers Robust to Patch Perturbations?cited by 39
  14. 2019Characterizing Attacks on Deep Reinforcement Learningcited by 31
  15. 2020Stealing Deep Reinforcement Learning Models for Fun and Profitcited by 24
  16. 2018Towards Better Interpretability in Deep Q-Networkscited by 22
  17. 2017Transforming Cooling Optimization for Green Data Center via Deep Reinforcement Learningcited by 18
  18. 2017Detecting Adversarial Attacks on Neural Network Policies with Visual Foresightcited by 17
  19. 2019Snooping Attacks on Deep Reinforcement Learningcited by 17
  20. 2023False Claims against Model Ownership Resolutioncited by 17
  21. 2021Deep Reinforcement Learning Policies Learn Shared Adversarial Features Across MDPscited by 11
  22. 2021Real-time Adversarial Perturbations against Deep Reinforcement Learning Policies: Attacks and Defensescited by 9
  23. 2019Sequential Triggers for Watermarking of Deep Reinforcement Learning Policiescited by 7
  24. 2022Cracking White-box DNN Watermarks via Invariant Neuron Transformscited by 5

Built on by

Cited by year

Citing papers per year: 2025: 1.

1 paper.

  1. 2025FedPoP: Federated Learning Meets Proof of Participationcited by 1