aiqbench analysis
This research addresses the critical vulnerability of deep reinforcement learning systems to black-box adversarial attacks by developing transfer-based methods that bypass the need for direct access to victim policies. The authors demonstrate that a novel trajectory-level optimization approach significantly outperforms standard image-classification transfers and random noise in destabilizing DRL agents across different algorithms. This work is essential for improving the robustness of autonomous agents operating in environments where model internals are hidden from attackers.
Boosting Transferable Adversarial Attacks against Deep Reinforcement Learning
arXiv:2610.06083v1 Announce Type: cross Abstract: Most adversarial attacks on deep reinforcement learning (DRL) assume white-box access to the victim policy, which rarely holds in practice. This paper studies transfer-based black-box attacks on DRL: the attacker crafts observation perturbations on a white-box surrogate agent and feeds them to an unknown victim. We formulate the attack as return minimization under a per-step perturbation budget. We first show that transplanting transferable image-classification attacks (FGSM, MI-FGSM, and NI-FGSM) with a per-step objective yields perturbations that transfer but are no stronger than random noise of the same budget. We then propose a trajectory-level attack that optimizes a sequence of perturbations over a receding horizon through a differentiable model of the environment and a temperature-smoothed surrogate policy, with the same optimizers. On CartPole-v1 with ten DQN and DDQN agents and 100 surrogate--victim pairs, the trajectory-level attack outperforms per-step attacks and random noise in the white-box, cross-model, and cross-algorithm settings.
Abstract:Most adversarial attacks on deep reinforcement learning (DRL) assume white-box access to the victim policy, which rarely holds in practice. This paper studies transfer-based black-box attacks on DRL: the attacker crafts observation perturbations on a white-box surrogate agent and feeds them to an unknown victim. We formulate the attack as return minimization under a per-step perturbation budget. We first show that transplanting transferable image-classification attacks (FGSM, MI-FGSM, and NI-FGSM) with a per-step objective yields perturbations that transfer but are no stronger than random noise of the same budget. We then propose a trajectory-level attack that optimizes a sequence of perturbations over a receding horizon through a differentiable model of the environment and a temperature-smoothed surrogate policy, with the same optimizers. On CartPole-v1 with ten DQN and DDQN agents and 100 surrogate--victim pairs, the trajectory-level attack outperforms per-step attacks and random noise in the white-box, cross-model, and cross-algorithm settings.
Machine Learning (cs.LG); Artificial Intelligence (cs.AI)
arXiv:2610.06083 [cs.LG]
(or arXiv:2610.06083v1 [cs.LG] for this version)
https://doi.org/10.48550/arXiv.2610.06083 Focus to learn more arXiv-issued DOI via DataCite (pending registration)
arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.
Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.
Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.
Full text under the publisher's open licence · 245 words
Related coverage
[AINews] Reality Checks on AI News (Yegge shuts down Gas Town, Databricks’ +60% Astra cost)
Latent Space · Sep 17, 2026
Reinforcement Learning Disrupts Gradient-Based Adversarial Optimization
arXiv · Jun 12, 2026
News
Quantum Computing Report · Jul 25, 2026
The Three Filters: Why Almost Every Plan to Survive ASI Fails Miserably
LessWrong · Jun 10, 2026