aiqbench analysis
This research introduces a novel adversarial attack paradigm where reinforcement learning agents leverage past experiences to iteratively refine their strategies, significantly outperforming traditional stateless optimization methods. By framing adversarial sample generation as a Markov Decision Process, the study demonstrates a measurable increase in attack success rates and query efficiency on image classification benchmarks. For security practitioners, this highlights a critical new threat vector where RL-trained agents can scale attacks more effectively against machine learning models.
Adversarial Agents: Black-Box Evasion Attacks with Reinforcement Learning
arXiv:2503.01734v3 Announce Type: replace-cross Abstract: Attacks on machine learning models have been extensively studied through stateless optimization. In this paper, we demonstrate how a reinforcement learning (RL) agent can learn a new class of attack algorithms that generate adversarial samples. Unlike traditional adversarial machine learning (AML) methods that craft adversarial samples independently, our RL-based approach retains and exploits past attack experience to improve the effectiveness and efficiency of future attacks. We formulate adversarial sample generation as a Markov Decision Process and evaluate RL's ability to (a) learn effective and efficient attack strategies and (b) compete with state-of-the-art AML. On two image classification benchmarks, our agent increases attack success rate by up to 13.2% and decreases the average number of victim model queries per attack by up to 16.9% from the start to the end of training. In a head-to-head comparison with state-of-the-art image attacks, our approach enables an adversary to generate adversarial samples with 17% more success on unseen inputs post-training. From a security perspective, this work demonstrates a powerful new attack vector that uses RL to train agents that attack ML models efficiently and at scale.
Abstract:Attacks on machine learning models have been extensively studied through stateless optimization. In this paper, we demonstrate how a reinforcement learning (RL) agent can learn a new class of attack algorithms that generate adversarial samples. Unlike traditional adversarial machine learning (AML) methods that craft adversarial samples independently, our RL-based approach retains and exploits past attack experience to improve the effectiveness and efficiency of future attacks. We formulate adversarial sample generation as a Markov Decision Process and evaluate RL's ability to (a) learn effective and efficient attack strategies and (b) compete with state-of-the-art AML. On two image classification benchmarks, our agent increases attack success rate by up to 13.2% and decreases the average number of victim model queries per attack by up to 16.9% from the start to the end of training. In a head-to-head comparison with state-of-the-art image attacks, our approach enables an adversary to generate adversarial samples with 17% more success on unseen inputs post-training. From a security perspective, this work demonstrates a powerful new attack vector that uses RL to train agents that attack ML models efficiently and at scale.
Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI)
arXiv:2503.01734 [cs.CR]
(or arXiv:2503.01734v3 [cs.CR] for this version)
Full text under the publisher's open licence · 197 words
Related coverage
Continual learning might make your blocking monitors nearly useless
AI Alignment Forum · Sep 24, 2026
SEBA: Sample-Efficient Black-Box Attacks on Visual Reinforcement Learning
arXiv · Sep 2, 2026
Adversarial RL for Port-Scan Evasion: Attacker Feature Visibility in Edge-Deployed IDS
arXiv · Oct 8, 2026
Do Agents Dream of False Memories? Black-box Visual Attacks on Long-term Memory in Multimodal AI Agents
arXiv · Jul 20, 2026