Advancing Robustness in Deep Reinforcement Learning with an Ensemble Defense Approach

Adithya Mohan; Daniel Cremers; Dominik R\"o{\ss}le; Torsten Sch\"on

REVIEW 4 major objections 5 minor 41 references

Advancing Robustness in Deep Reinforcement Learning with an Ensemble Defense Approach

T0 review · 4 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper claims that averaging three inference-time filters—random noise, an autoencoder, and PCA—over the observed state restores most of a DQN driving agent's performance under FGSM attacks, without touching the trained policy.

desk verdict A modest, clean evaluation of a known ensemble-defense idea, whose headline robustness numbers rest on a non-adaptive FGSM attack; the adaptive-attack gap is what stands between this and a credible robustness claim. read the letter →

arxiv 2507.17070 v1 pith:5O5OVFRG submitted 2025-07-22 cs.LG cs.AI

Adithya Mohan , Dominik Rö{ss}le , Daniel Cremers , Torsten Schön This is my paper · ORCID

classification cs.LGcs.AI

keywords ensembledefenseadversarialrobustnessdeepreinforcementlearningautonomousdrivingFGSMattackinference-timefilteringDQNstateperturbation

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper sets out to show that a fixed deep reinforcement learning agent, of the kind used for autonomous driving, can be made substantially more robust to adversarial state perturbations at inference time, with no retraining. The proposed mechanism is to pass each observed state through three different filters—random noise injection, autoencoder reconstruction, and PCA projection—and feed the policy the arithmetic mean of their outputs. In simulated highway and merge driving tasks, this ensemble recovers a large share of the reward lost to fast-gradient-sign-method (FGSM) attacks and brings the collision rate well below that of the undefended agent or any single filter used alone. The paper reports a mean reward of 18.38 in the highway scenario, up from 5.87 under attack, and a collision rate cut from 0.50 to 0.09. The authors also acknowledge that the attack does not adapt to the filters, which places a bound on how far the claimed robustness generalizes.

What carries the argument

The load-bearing mechanism is the simple arithmetic average of three filtered state copies, $\hat{s} = (s_{\mathrm{random}} + s_{\mathrm{autoencoder}} + s_{\mathrm{PCA}})/3$, computed at every timestep and then passed to the unchanged policy. Each filter is derived from nominal data: random noise dithers the input with uniform noise, a shallow autoencoder is trained to reconstruct clean observations, and PCA projects the state onto a lower-dimensional subspace that suppresses noise. The paper's argument is that these transformations fail on different perturbation patterns, so their average lands closer to the clean state than any single output, allowing the pretrained DQN to select correct actions. This fusion is what distinguishes the ensemble from each defense evaluated alone.

What would settle it

Run the same 100-episode evaluation but compute the FGSM perturbation by differentiating the policy's loss through the entire ensemble pipeline, including the averaged filters, at the same epsilon; if the ensemble's mean reward drops back to near the 5.87 attack-only level, then the claimed robustness does not survive an adaptive white-box adversary.

Watch

Extended reading notes

Core claim

The central claim is that an ensemble of three independent, inference-time input transformations—random noise, autoencoder denoising, and PCA reconstruction—yields a filtered state whose average makes a pretrained DQN policy resilient to FGSM state perturbations. In the highway scenario, the ensemble achieves a mean reward of 18.38 against an FGSM attack that drops the undefended agent to 5.87, recovering more than 60% of the clean baseline's 30.63 and reducing the mean collision rate from 0.50 to 0.09. In the merge scenario, the ensemble nearly matches the no-attack baseline (11.49 versus 11.93) with a collision rate of 0.02. Each standalone defense improves only marginally, with rewards between 6.57 and 8.07 depending on scenario, which is why the paper's point is that the averaging step combines complementary capabilities. The architecture is modular, operates entirely at inference, and leaves the policy untouched.

Load-bearing premise

The attack is computed against the raw policy and the unfiltered state while the action is chosen from the filtered state, so the defense is tested only against an adversary that ignores the ensemble; an attacker who knew the filters and optimized perturbations through them could erase the reported gains.

Editorial extensions

If this is right

If the claim holds, a deployed driving policy can be hardened against gradient-based state perturbations by wrapping its observation input with three cheap filters, with no retraining.
The results imply that averaging diverse filter outputs yields more stable safety behavior than any single filter, as reflected in both mean reward and the variance of collision rates.
Because the defense never touches the policy network, it should transfer to other reinforcement learning algorithms and driving scenarios without modification.
The persistent gap between the ensemble and the clean baseline in the highway case indicates that filtering consensus mitigates but does not eliminate the effect of continuous adversarial perturbation.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

A natural next test, not run in the paper, would be an adaptive white-box attacker who differentiates through the averaging filter; the reported mean reward could drop substantially under such an attack.
The ensemble might be strengthened by weighting each filter dynamically according to estimated input corruption, a direction the paper lists as future work but does not test.
Because the merge scenario is simpler and the ensemble nearly matches the baseline, the framework's benefit may shrink as task complexity grows, which the highway numbers already begin to show.
Testing the ensemble against stronger attacks such as projected gradient descent would indicate whether the improvement is specific to FGSM or generalizes to other perturbation methods.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Quick take: this is a clean, small empirical study of a known idea—averaging three inference-time filters (random noise, autoencoder, PCA) in front of a fixed DQN policy—in Highway-env. The measured gains are large and internally consistent, but the robustness claim is built on a non-adaptive FGSM attack, so the headline numbers should not be read as evidence about real-world robustness.

What's new: the specific combination in this DRL domain is not in the cited literature, and the paper reports careful measurements in two scenarios (highway and merge) with reward and collision stats, including standard deviations. The setup is honest: the filters are trained on clean data, the ensemble weights are fixed equal averages, and the policy is untouched. That is a legitimate and modular evaluation.

The soft spots are real, and one is load-bearing. Algorithm 1 computes the FGSM perturbation from the gradient w.r.t. the raw state (line 5) but chooses actions from the filtered state (line 9). So the defense is never evaluated against an attacker that knows the filters exist. Since the autoencoder and PCA are deterministic and differentiable, a white-box adversary can compute gradients through the whole pipeline; the literature on obfuscated gradients suggests the margins would shrink or vanish. The paper does flag that only FGSM is tested and lists PGD/CW as future work, but the conclusion still talks about "real-world utility," which is a step too far.

Smaller issues: no attack magnitude (epsilon) or noise bound (eta) is reported, no PCA dimension, no multiple seeds or significance tests, and no code. The comparison set is also thin—adversarial training is discussed in the intro but never run as a baseline. The "novel" claim is overstrong; Strauss et al. already studied ensemble averaging as a defense in classification, and the paper cites it.

None of this makes the paper worthless. The direction of the results is plausible, the evaluation is honest within its scope, and the non-adaptive limitation is openly acknowledged in the conclusion. For a reader working on DRL robustness, this is a useful sanity check that simple filtered ensembling can help against a naive FGSM attacker. It is also a good teaching example of why adaptive attacks matter.

I would send it to peer review—the question is testable and the gap is fixable—but I would not accept it without an adaptive attack evaluation and full disclosure of hyperparameters and seeds. As a published note it would be fine; as a "robustness" paper it needs more.

Referee Report

4 major / 5 minor

Summary. This manuscript proposes an inference-time ensemble defense for deep reinforcement learning, combining random noise injection, autoencoder reconstruction, and PCA projection with equal-weight averaging before passing the filtered observation to a fixed DQN policy. Experiments in Highway-env highway and merge scenarios under FGSM state perturbations report that the ensemble improves mean reward and reduces collision rate relative to each standalone filter and to no defense. The paper claims that the ensemble is modular, requires no policy retraining, and is the first ensemble-defense application to DRL for autonomous driving.

Significance. If the results survive a stronger evaluation, the contribution is practically useful: a zero-retraining, three-filter average that recovers much of the clean-policy performance would be an attractive plug-in defense. The design is not circular: the autoencoder and PCA are fit on clean observations, the ensemble weights are fixed equal averages, and no hyperparameter is reported as tuned to the final tables. The central evidence, however, is currently limited to a single non-adaptive FGSM threat model, no reported attack magnitude, and no seed-level variability, so the significance is conditional on the requested revisions.

major comments (4)

[Algorithm 1 (lines 5 and 9-10)] The attack is non-adaptive: the FGSM perturbation is computed from the gradient of the loss with respect to the raw state s, while the action is selected from the filtered state s_hat. Since the autoencoder and PCA projections are deterministic and differentiable, a white-box attacker who differentiates through the full ensemble of Eq. (3) can craft perturbations that survive filtering; the headline numbers in Tables I and II therefore do not yet establish robustness under a threat model that knows the defense. Please add adaptive attacks (e.g., PGD through the ensemble, or at least transfer attacks from an ensemble-differentiating surrogate) and, if they reduce the gain, temper the real-world robustness claims in Section V.
[Section III (Eqs. (1)-(2))] The attack magnitude epsilon in Eq. (1) and the random-noise bound eta in Eq. (2) are never given numerical values, and the PCA retained dimensionality or explained variance in Section III.B.3 is also unspecified. All quantitative claims depend on these hyperparameters; without them the experiments are not reproducible and the results could be specific to one favorable perturbation scale. Please report all hyperparameter values and the PCA configuration.
[Section IV (Tables I and II)] All results are from 100 episodes with fixed random seeds, as stated in Section III, so the reported standard deviations measure episode-level rather than seed-level variability. No significance test or confidence interval is provided for the comparison of ensemble against standalone defenses, despite the wording 'significantly enhances' in the abstract. Please report results over multiple environment seeds with mean and standard deviation across seeds, and include a paired test or confidence intervals for the ensemble-versus-standalone differences.
[Sections II.B and IV] The evaluation compares the ensemble only against the three preprocessing filters that make it up. Established DRL robustness baselines discussed in Section II.B, such as adversarial training, robust policy optimization, and RADIAL, are not included, although they set the standard in this literature. Adding at least one trained-baseline comparison is needed to support the claim that the ensemble 'outperforms all standalone defense strategies' in any broader sense.

minor comments (5)

[Figure 4] The caption describes a violin plot of collision rates 'across different scenarios', but the x-axis lists defense names rather than scenarios; clarify the axes and what the distributions represent.
[Section III.A.1 and Algorithm 1] Equation (1) writes the loss argument as J(pi_theta, s, a), while Algorithm 1 line 5 writes grad_s J(pi_theta, s); make the argument list consistent.
[Section III.B.2] The autoencoder architecture is described only by layer sizes; the latent dimension together with training epochs, optimizer, and learning rate are missing and should be reported for reproducibility.
[Figure 1 caption] The perturbed observation is labeled with the scalar epsilon, which is confusing because epsilon is the attack magnitude in Eq. (1); use a distinct notation for the perturbed state.
[References] Reference [7] is given as 'Eykholt et al.' without the full author list, and several other references abbreviate authors; please standardize the bibliography style.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the ensemble defense is evaluated against a fixed non-adaptive FGSM attack, and no component is fitted to the reported reward or collision metrics.

full rationale

The paper's central claim is that an inference-time ensemble of Random Noise, Autoencoder, and PCA filtering improves robustness of a fixed DQN policy under FGSM state perturbations. Walking the derivation chain, no step reduces to its own inputs. The DQN policy is trained on clean observations and then frozen; the autoencoder and PCA are trained offline on 5000 clean observations; the ensemble weights are fixed equal averages in Eq. (3); and no hyperparameter or module is reported as tuned against the final reward or collision-rate tables. The attack in Algorithm 1 is computed from the gradient of the loss with respect to the raw state s (line 5), while action selection uses the filtered state (lines 9-10), so the defense is evaluated only against a non-adaptive adversary. This is a genuine threat-model limitation, and it is even acknowledged in the conclusion's statement that the current setup focuses solely on FGSM state perturbations, but it is not circularity: the measured improvement does not follow by construction from any fitted quantity. The only self-citations are reference [11], cited for background on adversarial examples, and reference [40], cited for the discrete meta-action set; neither is load-bearing for the robustness result. There is also no imported uniqueness theorem, no ansatz smuggled in via citation, and no renaming of a known result. The evaluation is self-contained against the stated non-adaptive threat model, so the appropriate circularity finding is none.

Assumptions & free parameters 5 free parameters · 4 assumptions · 0 invented entities

The empirical claim rests on a simulator proxy, the non-adaptive FGSM threat model, and unreported hyperparameters; no new entities are introduced.

free parameters (5)

epsilon (FGSM attack magnitude)
Used in Eq. 1 to create the perturbation; no numeric value is reported, yet it controls attack strength and the measured improvements.
eta (random noise bound)
Used in Eq. 2; described only as a small positive constant, with no value reported.
PCA retained components
Number of principal components used for projection and reconstruction is not reported; this determines how much signal is preserved.
ensemble weights = 1/3, 1/3, 1/3
Fixed equal weights for averaging in Eq. 3; chosen by hand and not ablated.
autoencoder weights = trained on 5000 clean observations
Model parameters fit offline to clean rollouts; no validation split or training hyperparameters are reported.

assumptions (4)

domain assumption Highway-env is a valid proxy for real autonomous driving robustness
Used throughout; all conclusions about safety-critical driving dependence are drawn from this simulator.
domain assumption FGSM state perturbation is the only necessary threat model
Section V explicitly limits the study to FGSM; generalization to PGD, CW, or black-box attacks is left to future work.
domain assumption Fixed seeds and 100 episodes per scenario give statistically reliable comparisons
Section III fixes seeds and evaluates over 100 episodes; no multiple-seed runs or significance tests are provided.
standard math Averaging outputs of three preprocessing filters is a valid way to combine defenses
Eq. 3; the paper does not prove when averaging improves over the best component, relying on the empirical result.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Advancing Robustness in Deep Reinforcement Learning with an Ensemble Defense Approach." pith.science (2026). https://pith.science/paper/5O5OVFRG

@misc{pith2026250717070,
  author       = {Pith},
  title        = {Pith review of: Advancing Robustness in Deep Reinforcement Learning with an Ensemble Defense Approach},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/5O5OVFRG}},
  note         = {Machine review of arXiv:2507.17070}
}

read the original abstract

Recent advancements in Deep Reinforcement Learning (DRL) have demonstrated its applicability across various domains, including robotics, healthcare, energy optimization, and autonomous driving. However, a critical question remains: How robust are DRL models when exposed to adversarial attacks? While existing defense mechanisms such as adversarial training and distillation enhance the resilience of DRL models, there remains a significant research gap regarding the integration of multiple defenses in autonomous driving scenarios specifically. This paper addresses this gap by proposing a novel ensemble-based defense architecture to mitigate adversarial attacks in autonomous driving. Our evaluation demonstrates that the proposed architecture significantly enhances the robustness of DRL models. Compared to the baseline under FGSM attacks, our ensemble method improves the mean reward from 5.87 to 18.38 (over 213% increase) and reduces the mean collision rate from 0.50 to 0.09 (an 82% decrease) in the highway scenario and merge scenario, outperforming all standalone defense strategies.

Figures

Figures reproduced from arXiv: 2507.17070 by the authors.

**Figure 2.** Simple Moving Average (SMA) of rewards during DQN training [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗

**Figure 3.** SMA of Rewards across 100 episodes under various adversarial [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗

Figures from the paper (1 more)

**Figure 4.** Figure 4: Violin plot illustrating the distribution of collision rates across [PITH_FULL_IMAGE:figures/full_fig_p004_4.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

41 extracted references · 37 canonical work pages

[1]

Challenges and countermeasures for adversarial at- tacks on deep reinforcement learning,

I. Ilahi, M. Usama, J. Qadir, M. U. Janjua, A. Al-Fuqaha, D. T. Hoang, and D. Niyato, “Challenges and countermeasures for adversarial at- tacks on deep reinforcement learning,” IEEE Transactions on Artificial Intelligence, vol. 3, no. 2, pp. 90–109, Apr. 2022

work page 2022
[2]

A survey on adversarial attacks and defenses in reinforcement learning,

C. Feng, L. Xu, Y . Wang, and J. Wu, “A survey on adversarial attacks and defenses in reinforcement learning,” Artificial Intelligence Review, vol. 55, no. 4, pp. 2689–2711, 2021

work page 2021
[3]

Anti-plane surface waves in media with surface structure: discrete vs. continuum model

T.-T. Nguyen, T. L. Nguyen, and S. Nahavandi, “Deep reinforcement learning: An overview,” arXiv preprint arXiv:1906.07006 , 2019

work page Pith review arXiv 1906
[4]

A review of applications of artificial intelligence and blockchain in the energy sector,

J. Lin, S. H. M. Ahmad, A. Khattak, and J. Wang, “A review of applications of artificial intelligence and blockchain in the energy sector,” Energies, vol. 13, no. 14, p. 3652, 2020

work page 2020
[5]

Adversarial attacks on neural network policies,

S. Huang, N. Papernot, I. Goodfellow, Y . Duan, and P. Abbeel, “Adversarial attacks on neural network policies,” in Workshop on artificial intelligence safety 2017 (AISafety 2017) . PMLR, 2017, pp. 1–8

work page 2017
[6]

Comment on "Relation between scattering amplitude and Bethe-Salpeter wave function in quantum field theory"

V . Behzadan and A. Munir, “Whatever does not kill deep reinforce- ment learning, makes it stronger,” arXiv preprint arXiv:1711.09344 , 2017

work page Pith review arXiv 2017
[7]

Robust physical-world attacks on deep learning visual classification,

K. Eykholt et al. , “Robust physical-world attacks on deep learning visual classification,” in Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR) , 2018

work page 2018
[8]

Explaining and harness- ing adversarial examples,

I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harness- ing adversarial examples,” in International Conference on Learning Representations (ICLR), 2015

work page 2015

Show all 41 references

[9]

Ensemble methods as a defense to adversarial perturbations against deep neural networks,

T. Strauss, M. Hanselmann, A. Junginger, and H. Ulmer, “Ensemble methods as a defense to adversarial perturbations against deep neural networks,” arXiv preprint arXiv:1709.03423 , 2017

2017 arXiv
[10]

An environment for autonomous driving decision- making,

E. Leurent, “An environment for autonomous driving decision- making,” https://github.com/eleurent/highway-env, 2018

2018
[11]

Perceiver hopfield pooling for dynamic multi-modal and multi-instance fusion,

D. R ¨oßle, D. Cremers, and T. Sch ¨on, “Perceiver hopfield pooling for dynamic multi-modal and multi-instance fusion,” in Artificial Neural Networks and Machine Learning – ICANN 2022 . Cham: Springer International Publishing, 2022, pp. 599–610

2022
[12]

A survey on attacks and their coun- termeasures in deep learning: Applications in deep neural networks, federated, transfer, and deep reinforcement learning,

H. Ali, D. Chen, M. Harrington, N. Salazar, M. Al Ameedi, A. Khan, A. R. Butt, and J.-H. Cho, “A survey on attacks and their coun- termeasures in deep learning: Applications in deep neural networks, federated, transfer, and deep reinforcement learning,” IEEE Access , vol. 11, ...

2023
[13]

Gradient band-based adversarial training for generalized attack immunity of a3c path finding,

T. Chen, W. Niu, Y . Xiang, X. Bai, J. Liu, Z. Han, and G. Li, “Gradient band-based adversarial training for generalized attack immunity of a3c path finding,” arXiv preprint arXiv:1807.06752 , 2018

2018 arXiv
[14]

Adversarial attacks on neural network policies,

S. Huang, N. Papernot, I. Goodfellow, Y . Duan, and P. Abbeel, “Adversarial attacks on neural network policies,” in Proc. ICLR, 2017, pp. 1–10

2017
[15]

Vulnerability of deep reinforcement learning to policy induction attacks,

V . Behzadan and A. Munir, “Vulnerability of deep reinforcement learning to policy induction attacks,” in Proc. Int. Conf. Mach. Learn. Data Mining Pattern Recognit. , 2017, pp. 262–275

2017
[16]

Delving into adversarial attacks on deep policies,

J. Kos and D. Song, “Delving into adversarial attacks on deep policies,” in Proc. 34th Int. Conf. Mach. Learn. , vol. 70, 2017, pp. 1944–1953

2017
[17]

A malicious attack on the machine learning policy of a robotic system,

G. Clark, M. Doran, and W. Glisson, “A malicious attack on the machine learning policy of a robotic system,” in Proc. 17th IEEE Int. Conf. Trust, Secur. Privacy Comput. Commun./12th IEEE Int. Conf. Big Data Sci. Eng. , 2018, pp. 516–521

2018
[18]

Copycat: Taking control of neural policies with constant attacks,

L. Hussenot, M. Geist, and O. Pietquin, “Copycat: Taking control of neural policies with constant attacks,” in Int. Found. Auton. Agents Multiagent Syst., Auckland, New Zealand, 2019

2019
[19]

Acadia: Efficient and robust adversarial attacks against deep reinforcement learning,

H. Ali, M. A. Ameedi, A. Swami, R. Ning, J. Li, H. Wu, and J.- H. Cho, “Acadia: Efficient and robust adversarial attacks against deep reinforcement learning,” in Proc. IEEE Conf. Commun. Netw. Secur. (CNS), 2022, pp. 1–9

2022
[20]

Adversarial attacks in consensus-based multi-agent reinforcement learning,

M. Figura, K. C. Kosaraju, and V . Gupta, “Adversarial attacks in consensus-based multi-agent reinforcement learning,” in Proc. Amer. Control Conf. (ACC), 2021, pp. 3050–3055

2021
[21]

Tactics of adversarial attack on deep reinforcement learning agents,

Y .-C. Lin, Z.-W. Hong, Y .-H. Liao, M.-L. Shih, M.-Y . Liu, and M. Sun, “Tactics of adversarial attack on deep reinforcement learning agents,” in Proc. 26th Int. Joint Conf. Artif. Intell. , 2017, pp. 3756–3762

2017
[22]

Sequential attacks on agents for long-term adversarial goals,

E. Tretschk, S. J. Oh, and M. Fritz, “Sequential attacks on agents for long-term adversarial goals,” in Proc. ACM Comput. Sci. Cars Symp. , 2018, pp. 1–9

2018
[23]

Trojdrl: Trojan at- tacks on deep reinforcement learning agents,

K. Panagiota, W. Kacper, S. Jha, and L. Wenchao, “Trojdrl: Trojan at- tacks on deep reinforcement learning agents,” in Proc. 57th ACM/IEEE Design Automat. Conf. (DAC) , 2020, pp. 1–17

2020
[24]

Stealthy and efficient adversarial attacks against deep reinforcement learning,

J. Sun, T. Zhang, X. Xie, L. Ma, Y . Zheng, K. Chen, and Y . Liu, “Stealthy and efficient adversarial attacks against deep reinforcement learning,” in Proc. AAAI Conf. Artif. Intell. , vol. 34, 2020, pp. 5883– 5891

2020
[25]

Provably efficient black-box action poisoning attacks against reinforcement learning,

G. Liu and L. Lai, “Provably efficient black-box action poisoning attacks against reinforcement learning,” in Proc. Adv. Neural Inf. Process. Syst., vol. 34, 2021, pp. 12 400–12 410

2021
[26]

Strategically-timed state- observation attacks on deep reinforcement learning agents,

Q. Ye, X. Zhou, C. Ying, and J. Zhu, “Strategically-timed state- observation attacks on deep reinforcement learning agents,” in Proc. Int. Conf. Mach. Learn. (ICML) , 2021, pp. 1–10

2021
[27]

Robust deep reinforcement learning with adversarial attacks,

A. Pattanaik, Z. Tang, S. Liu, G. Bommannan, and G. Chowdhary, “Robust deep reinforcement learning with adversarial attacks,” inProc. 17th Int. Conf. Auto. Agents MultiAgent Syst. , 2018, pp. 2040–2042

2018
[28]

Deep reinforcement learning with robust and smooth policy,

Q. Shen, Y . Li, H. Jiang, Z. Wang, and T. Zhao, “Deep reinforcement learning with robust and smooth policy,” inProc. 37th Int. Conf. Mach. Learn., 2020, pp. 8707–8718

2020
[29]

Robust reinforce- ment learning on state observations with learned optimal adversary,

H. Zhang, H. Chen, D. S. Boning, and C.-J. Hsieh, “Robust reinforce- ment learning on state observations with learned optimal adversary,” in Proc. Int. Conf. Learn. Represent. , 2021, pp. 1–16

2021
[30]

Action robust reinforcement learning and applications in continuous control,

C. Tessler, Y . Efroni, and S. Mannor, “Action robust reinforcement learning and applications in continuous control,” in Proc. Int. Conf. Mach. Learn., 2019, pp. 6215–6224

2019
[31]

Detecting adversar- ial attacks on neural network policies with visual foresight,

Y .-C. Lin, M.-Y . Liu, M. Sun, and J.-B. Huang, “Detecting adversar- ial attacks on neural network policies with visual foresight,” arXiv preprint arXiv:1710.00814, 2017

2017 arXiv
[32]

A pca-based model to predict adversarial examples on q-learning of path finding,

Y . Xiang, W. Niu, J. Liu, T. Chen, and Z. Han, “A pca-based model to predict adversarial examples on q-learning of path finding,” in Proc. IEEE 3rd Int. Conf. Data Sci. Cyberspace (DSC) , 2018, pp. 773–780

2018
[33]

Optimal attacks on reinforcement learning policies,

A. Russo and A. Proutiere, “Optimal attacks on reinforcement learning policies,” arXiv preprint arXiv:1907.13548 , 2019

1907 arXiv
[34]

Robust deep reinforcement learning against adversarial perturbations on state observations,

H. Zhang, H. Chen, C. Xiao, B. Li, M. Liu, D. Boning, and C.-J. Hsieh, “Robust deep reinforcement learning against adversarial perturbations on state observations,” in Proc. Adv. Neural Inf. Process. Syst. (NIPS), vol. 33, 2020, pp. 21 024–21 037

2020
[35]

Online ro- bustness training for deep reinforcement learning,

M. Fischer, M. Mirman, S. Stalder, and M. Vechev, “Online ro- bustness training for deep reinforcement learning,” arXiv preprint arXiv:1911.00887, 2019

1911 arXiv
[36]

Rl-vaegan: Adversarial defense for reinforcement learning agents via style transfer,

Y . Hu and S. Sun, “Rl-vaegan: Adversarial defense for reinforcement learning agents via style transfer,” Knowl.-Based Syst. , vol. 221, p. 106967, 2021

2021
[37]

Certified adversarial robustness for deep reinforcement learning,

B. L ¨utjens, M. Everett, and J. P. How, “Certified adversarial robustness for deep reinforcement learning,” in Proc. Conf. Robot Learn. , 2020, pp. 1328–1337

2020
[38]

Robust deep reinforcement learning through adversarial loss,

T. Oikarinen, W. Zhang, A. Megretski, L. Daniel, and T.-W. Weng, “Robust deep reinforcement learning through adversarial loss,” in Proc. Adv. Neural Inf. Process. Syst., vol. 34, 2021, pp. 26 156–26 167

2021
[39]

Adversarial attacks and defense in deep reinforcement learning (DRL)-based traffic signal controllers,

A. Haydari, M. Zhang, and C.-N. Chuah, “Adversarial attacks and defense in deep reinforcement learning (DRL)-based traffic signal controllers,” IEEE Open J. Intell. Transp. Syst. , vol. 2, pp. 402–416, 2021

2021
[40]

The evolution of criticality in deep reinforcement learning,

C. Karpenahalli Ramakrishna, A. Mohan, Z. Zeinaly, and L. Belzner, “The evolution of criticality in deep reinforcement learning,” in Pro- ceedings of the 17th International Conference on Agents and Artificial Intelligence. SCITEPRESS - Science and Technology Publications, 2025...

2025
[41]

Stable-Baselines3: Reliable reinforcement learning im- plementations,

A. Raffin, A. Hill, A. Gleave, A. Kanervisto, M. Ernestus, and N. Dormann, “Stable-Baselines3: Reliable reinforcement learning im- plementations,” J. Mach. Learn. Res. , vol. 22, no. 268, pp. 1–8, 2021

2021

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.

[1] [1]

Challenges and countermeasures for adversarial at- tacks on deep reinforcement learning,

I. Ilahi, M. Usama, J. Qadir, M. U. Janjua, A. Al-Fuqaha, D. T. Hoang, and D. Niyato, “Challenges and countermeasures for adversarial at- tacks on deep reinforcement learning,” IEEE Transactions on Artificial Intelligence, vol. 3, no. 2, pp. 90–109, Apr. 2022

work page 2022

[2] [2]

A survey on adversarial attacks and defenses in reinforcement learning,

C. Feng, L. Xu, Y . Wang, and J. Wu, “A survey on adversarial attacks and defenses in reinforcement learning,” Artificial Intelligence Review, vol. 55, no. 4, pp. 2689–2711, 2021

work page 2021

[3] [3]

Anti-plane surface waves in media with surface structure: discrete vs. continuum model

T.-T. Nguyen, T. L. Nguyen, and S. Nahavandi, “Deep reinforcement learning: An overview,” arXiv preprint arXiv:1906.07006 , 2019

work page Pith review arXiv 1906

[4] [4]

A review of applications of artificial intelligence and blockchain in the energy sector,

J. Lin, S. H. M. Ahmad, A. Khattak, and J. Wang, “A review of applications of artificial intelligence and blockchain in the energy sector,” Energies, vol. 13, no. 14, p. 3652, 2020

work page 2020

[5] [5]

Adversarial attacks on neural network policies,

S. Huang, N. Papernot, I. Goodfellow, Y . Duan, and P. Abbeel, “Adversarial attacks on neural network policies,” in Workshop on artificial intelligence safety 2017 (AISafety 2017) . PMLR, 2017, pp. 1–8

work page 2017

[6] [6]

Comment on "Relation between scattering amplitude and Bethe-Salpeter wave function in quantum field theory"

V . Behzadan and A. Munir, “Whatever does not kill deep reinforce- ment learning, makes it stronger,” arXiv preprint arXiv:1711.09344 , 2017

work page Pith review arXiv 2017

[7] [7]

Robust physical-world attacks on deep learning visual classification,

K. Eykholt et al. , “Robust physical-world attacks on deep learning visual classification,” in Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR) , 2018

work page 2018

[8] [8]

Explaining and harness- ing adversarial examples,

I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harness- ing adversarial examples,” in International Conference on Learning Representations (ICLR), 2015

work page 2015