2022/11/22 by Yinbo Yu, Jiajia Liu, Yu, Yinbo +1 · 1 citation
Computer Science · #Adversarial Robustness in Machine Learning #Adversary #Algorithm #Artificial Intelligence (cs.AI) #Artificial intelligence #Computer science #Computer security #Cryptography and Security (cs.CR) #Deep learning #FOS: Computer and information sciences #Key (lock) #Machine Learning (cs.LG) #Machine learning #Perception #Reinforcement learning #State (computer science) #Trojan
paper · pdf · doi:10.48550/arxiv.2211.14440
published in arXiv (Cornell University) (Cornell University)
openalex publication_date 2022/11/22 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28
Deep reinforcement learning (DRL) is one of the most popular algorithms to realize an autonomous driving (AD) system. The key success factor of DRL is that it embraces the perception capability of deep neural networks which, however, have been proven vulnerable to Trojan attacks. Trojan attacks have been widely explored in supervised learning (SL) tasks (e.g., image classification), but rarely in sequential decision-making tasks solved by DRL. Hence, in this paper, we explore Trojan attacks on DRL for AD tasks. First, we propose a spatio-temporal DRL algorithm based on the recurrent neural network and attention mechanism to prove that capturing spatio-temporal traffic features is the key factor to the effectiveness and safety of a DRL-augment AD system. We then design a spatial-temporal Trojan attack on DRL policies, where the trigger is hidden in a sequence of spatial and temporal traffic features, rather than a single instant state used in existing Trojan on SL and DRL tasks. With our Trojan, the adversary acts as a surrounding normal vehicle and can trigger attacks via specific spatial-temporal driving behaviors, rather than physical or wireless access. Through extensive experiments, we show that while capturing spatio-temporal traffic features can improve the performance of DRL for different AD tasks, they suffer from Trojan attacks since our designed Trojan shows high stealthy (various spatio-temporal trigger patterns), effective (less than 3.1% performance variance rate and more than 98.5% attack success rate), and sustainable to existing advanced defenses.