mlsanityData to 7 Oct 2026

Diffusion Guided Adversarial State Perturbations in Reinforcement Learning

arXiv 2511.07701 ↗First posted 10 Nov 2025cs.LG cs.AIcited by 0

Not on the map. Why?

Abstract (arXiv)

Reinforcement learning (RL) systems, while achieving remarkable success across various domains, are vulnerable to adversarial attacks. This is especially a concern in vision-based environments where minor manipulations of high-dimensional image inputs can easily mislead the agent's behavior. To this end, various defenses have been proposed recently, with state-of-the-art approaches achieving robust performance even under large state perturbations. However, after closer investigation, we found that the effectiveness of the current defenses is due to a fundamental weakness of the existing lp norm-constrained attacks, which can barely alter the semantics of image input even under a relatively large perturbation budget. In this work, we propose SHIFT, a novel policy-agnostic diffusion-based state perturbation attack to go beyond this limitation. Our attack is able to generate perturbed states that are semantically different from the true states while remaining realistic and history-aligned to avoid detection. Evaluations show that our attack effectively breaks existing defenses, including the most sophisticated ones, significantly outperforming existing attacks while being more perceptually stealthy. The results highlight the vulnerability of RL agents to semantics-aware adversarial perturbations, indicating the importance of developing more robust policies.

Key facts. No citing papers in the map yet (data through 7 Oct 2026). Builds on 51 of its 68 references that are in the map. First posted on arXiv 10 Nov 2025.

Builds on

51 of 68 references.

References · 51

  1. 2020Denoising Diffusion Probabilistic Modelscited by 20,851
  2. 2018The Unreasonable Effectiveness of Deep Features as a Perceptual Metriccited by 11,029
  3. 2020Score-Based Generative Modeling through Stochastic Differential Equationscited by 8,964
  4. 2021Diffusion Models Beat GANs on Image Synthesiscited by 8,185
  5. 2022Classifier-Free Diffusion Guidancecited by 5,717
  6. 2022Elucidating the Design Space of Diffusion-Based Generative Modelscited by 2,994
  7. 2022Planning with Diffusion for Flexible Behavior Synthesiscited by 1,023
  8. 2023Training Diffusion Models with Reinforcement Learningcited by 939
  9. 2020Deep Reinforcement Learning for Autonomous Driving: A Surveycited by 698
  10. 2022Diffusion Policies as an Expressive Policy Class for Offline Reinforcement Learningcited by 543
  11. 2017AirSim: High-Fidelity Visual and Physical Simulation for Autonomous Vehiclescited by 517
  12. 2022Is Conditional Generative Modeling all you need for Decision-Making?cited by 504
38 more
  1. 2023Universal Guidance for Diffusion Modelscited by 426
  2. 2023DIRE for Diffusion-Generated Image Detectioncited by 386
  3. 2017Adversarial Attacks on Neural Network Policiescited by 314
  4. 2024Diffusion for World Modeling: Visual Details Matter in Ataricited by 285
  5. 2020Robust Deep Reinforcement Learning against Adversarial Perturbations on State Observationscited by 235
  6. 2019Adversarial Policies: Attacking Deep Reinforcement Learningcited by 209
  7. 2018Spatially Transformed Adversarial Examplescited by 195
  8. 2023Efficient Diffusion Policies for Offline Reinforcement Learningcited by 151
  9. 2018Constructing Unrestricted Adversarial Examples with Generative Modelscited by 135
  10. 2021Robust Reinforcement Learning on State Observations with Learned Optimal Adversarycited by 133
  11. 2023Diffusion Model is an Effective Planner and Data Synthesizer for Multi-Task Reinforcement Learningcited by 114
  12. 2023Diffusion Models for Imperceptible and Transferable Adversarial Attackcited by 93
  13. 2019Wasserstein Adversarial Examples via Projected Sinkhorn Iterationscited by 89
  14. 2020Adaptive Reward-Poisoning Attacks against Reinforcement Learningcited by 86
  15. 2017Exploring the Landscape of Spatial Robustnesscited by 81
  16. 2023Diffusion-Based Adversarial Sample Generation for Improved Stealthiness and Controllabilitycited by 66
  17. 2020Challenges and Countermeasures for Adversarial Attacks on Deep Reinforcement Learningcited by 61
  18. 2021Who Is the Strongest Enemy? Towards Optimal and Efficient Evasion Attacks in Deep RLcited by 54
  19. 2018ViZDoom Competitions: Playing Doom from Pixelscited by 50
  20. 2019Deceptive Reinforcement Learning Under Adversarial Manipulations on Cost Signalscited by 50
  21. 2022Rethinking Lipschitz Neural Networks and Certified Robustness: A Boolean Function Perspectivecited by 48
  22. 2023AdvDiff: Generating Unrestricted Adversarial Examples using Diffusion Modelscited by 46
  23. 2022Efficient Adversarial Training without Attacking: Worst-Case-Aware Robust Reinforcement Learningcited by 42
  24. 2024Efficient Generation of Targeted and Transferable Adversarial Examples for Vision-Language Models Via Diffusion Modelscited by 36
  25. 2023Robust Multi-Agent Reinforcement Learning with State Uncertaintycited by 35
  26. 2023DiffProtect: Generate Adversarial Examples with Diffusion Models for Facial Privacy Protectioncited by 34
  27. 2020Stealing Deep Reinforcement Learning Models for Fun and Profitcited by 24
  28. 2023Adversarial Robust Deep Reinforcement Learning Requires Redefining Robustnesscited by 18
  29. 2023Elucidating The Design Space of Classifier-Guided Diffusion Generationcited by 18
  30. 2023Reinforcement Learning with Foundation Priors: Let the Embodied Agent Efficiently Learn on Its Owncited by 16
  31. 2022Illusory Attacks: Information-Theoretic Detectability Matters in Adversarial Attackscited by 12
  32. 2022Defending Observation Attacks in Deep Reinforcement Learning via Detection and Denoisingcited by 8
  33. 2024Beyond Worst-case Attacks: Robust RL with Adaptive Defense via Non-dominated Policiescited by 8
  34. 2023Improve Robustness of Reinforcement Learning against Observation Perturbations via l_∞ Lipschitz Policy Networkscited by 7
  35. 2023Detecting Adversarial Directions in Deep Reinforcement Learning to Make Robust Decisionscited by 6
  36. 2021Balancing detectability and performance of attacks on the control channel of Markov Decision Processescited by 4
  37. 2024Towards Optimal Adversarial Robust Q-learning with Bellman Infinity-errorcited by 4
  38. 2024Belief-Enriched Pessimistic Q-Learning against Adversarial State Perturbationscited by 2

50 most cited of 51 All 51 (JSON)

Built on by

Not cited yet.