Pith. sign in

REVIEW 5 major objections 4 minor 46 references

Adversarial Attacks on Reinforcement Learning-based Medical Questionnaire Systems: Input-level Perturbation Strategies and Medical Constraint Validation

T0 review · 5 major / 4 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper claims that RL-based medical questionnaire systems are vulnerable to adversarial input perturbations even when those perturbations must pass a 247-rule medical constraint framework.

desk verdict Plausible qualitative point, but the headline clinical-plausibility claim is not supported by the reported validation statistics. read the letter →

arxiv 2508.05677 v1 pith:XYAF67UC submitted 2025-08-05 cs.CR cs.AIcs.LG

Peizhuo Liu This is my paper
classification cs.CRcs.AIcs.LG
keywords adversarialattacksreinforcementlearningmedicalquestionnaireMarkovdecisionprocessconstraintsNHISmortalitypredictionwhite-box
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper attempts to establish that reinforcement-learning-based adaptive medical questionnaire systems, which ask patients questions and then issue a diagnosis, can be manipulated by white-box adversarial attacks even when the altered answers must remain clinically plausible under a strict medical constraint framework. It reports attack success rates between 33.08% (FGSM) and 64.70% (AutoAttack) against the AdaptiveFS system predicting 4-year mortality from the NHIS dataset, with a claimed 97.6% success rate in generating clinically plausible adversarial samples. If true, the result matters because it suggests a patient's answers could be changed within medically reasonable ranges and still flip the system's risk classification, potentially leading to delayed or incorrect treatment.

What carries the argument

The central object is the adversarial perturbation problem posed as maximizing the loss toward a target label subject to an $\ell_p$ bound and a medical feasibility constraint set $C_{\text{medical}}$, where $C_{\text{medical}}$ is defined by 247 rules across physiological bounds, feature correlations, and conditional constraints (e.g., diabetic patients must have elevated glucose). The constraint satisfaction algorithm projects perturbed features back into the feasible region; this projection is what supposedly makes the adversarial examples clinically plausible while preserving attack effectiveness.

What would settle it

Re-run the attack pipeline and, for each of the 1,000 test samples, check whether the final adversarial example after constraint projection satisfies all 247 constraints when applied to the actual 50 features listed in Appendix D; if the per-sample pass rate is substantially below 97.6%, or if constraints such as glucose-for-diabetics and blood-pressure bounds reference features absent from the feature table, the claim of clinically plausible attacks is not established.

Watch

Extended reading notes

Core claim

On its own terms, the paper's central discovery is that the AdaptiveFS RL questionnaire system, a DQN-plus-Guesser architecture trained on NHIS data for binary 4-year mortality prediction, can be reliably attacked by six white-box methods (FGSM, PGD, BIM, DeepFool, C&W, AutoAttack) across seven perturbation magnitudes, and that a constraint-satisfaction-based medical validation layer of 247 rules does not prevent these attacks. The paper argues that the medically plausible adversarial examples produced by this pipeline reveal a systemic vulnerability in RL-based medical questionnaire systems, not just a weakness of this particular model.

Load-bearing premise

The claim collapses if the 247-rule medical constraint framework does not actually validate each perturbed sample on the features that were perturbed; the paper reports configuration-level pass rates rather than per-sample pass rates.

Editorial extensions

If this is right

  • If the paper is correct, RL-based medical questionnaire systems cannot be assumed safe merely because inputs are validated against clinical rules.
  • Deployment of such systems should include adversarial robustness testing and input-level detection mechanisms beyond basic plausibility checks.
  • The 247-rule constraint framework could serve as a shared benchmark for generating and evaluating clinically plausible adversarial examples in tabular medical AI.
  • The monotonic increase of success rate with perturbation strength implies that even moderate, hard-to-detect changes can shift diagnoses, so regulators may need to specify allowable perturbation budgets.
  • The white-box results motivate follow-up work on whether black-box transfer attacks achieve similar success rates against questionnaire systems.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper reports constraint compliance at the configuration level (42/42 configurations, 97.6% of bounds checks) rather than per-sample pass rates; if per-sample validation yields lower compliance, the 33-65% success rates may not all come from genuinely clinically plausible inputs.
  • Several constraints described in Section 3.3 and Appendix A, such as glucose bounds for diabetics and systolic blood pressure limits, reference features that are not among the 50 NHIS features listed in Appendix D, so those particular rules may be vacuous in the actual experiments.
  • The same attack-and-constraint recipe could transfer to other adaptive testing domains (educational testing, mental-health screeners) where a 'plausibility' layer replaces medical constraints, so the vulnerability may be broader than clinical questionnaires.
  • A stronger test of the paper's claim would be to have clinicians blind-rate the perturbed samples for plausibility, since automated constraint checking may miss semantic implausibilities.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 4 minor

Summary. This manuscript evaluates six white-box adversarial attack methods against a re-implemented AdaptiveFS RL-based medical questionnaire system for NHIS 4-year mortality prediction. The attack is formalized in Eq. (5) as maximizing the loss subject to an epsilon norm bound and a medical constraint set C_medical. The authors introduce a 247-rule medical constraint framework, report attack success rates between 33.08% (FGSM) and 64.70% (AutoAttack), and conclude that the system remains vulnerable under strict medical constraints.

Significance. If the central claim were properly supported, the paper would fill a genuine gap in the adversarial-robustness literature by moving from medical image classifiers to RL-driven questionnaire systems and by attempting to enforce clinical plausibility during attack generation. The explicit constrained optimization formulation and the use of standard attack libraries are strengths, and the quantitative claim of label flips on a re-implemented AdaptiveFS baseline is a plausible direction. However, the load-bearing evidence for clinical plausibility is configuration-level rather than sample-level, several constraints reference variables outside the actual feature set, and no random-perturbation control is included; at present the headline conclusion is not established.

major comments (5)
  1. [Section 6.2; Abstract] The reported 97.6% clinical-plausibility rate is a configuration-level statistic: 41 of 42 configurations passed the physiological-bounds check, not 97.6% of individual adversarial samples. Because each configuration uses 1,000 attack samples and ASR is reported as a per-configuration aggregate (Tables 2 and 3), this count does not show that the samples whose labels were flipped actually satisfy the medical constraints. Please report per-sample pass rates for each method and epsilon, and ideally the joint rate "attack succeeds and all constraints hold."
  2. [Section 3.3.1 and 3.3.3; Appendix D, Table 9] The constraint set cannot be evaluated on the actual attack vector as described. Eq. (11) imposes age-dependent systolic blood-pressure bounds and Eq. (16) imposes a diabetic-glucose rule, but the 50 features in Table 9, which Appendix D states are the complete set on which all perturbations and validations were applied, include neither blood pressure nor glucose. Either the constraints were checked on variables outside the model input (so they cannot constrain x+delta in Eq. (5)), or the feature set is incomplete. The revision must align the constraint vocabulary with the actual feature set and verify satisfaction on the perturbed samples.
  3. [Section 5.2 and 6.5; Eq. (5)] No random-perturbation baseline is provided. With epsilon values up to 2.0 in the normalized [-1,1] feature space, many perturbations are large enough to move a feature across nearly its full range (Section 4.4 even gives the example of age changing from 20 to 60 at epsilon=2.0). Without a random or non-adversarial perturbation control at matched epsilon and with the same C_medical projection, the reported label-flip rates cannot be attributed to gradient-based adversarial direction. Add such a baseline and report the per-epsilon delta in ASR relative to it.
  4. [Section 3.3.4 and 6.2; Algorithm 2] Algorithm 2 is asserted to converge to a clinically plausible vector while preserving the adversarial effect, but this is not demonstrated. The projection and consistency-propagation steps in Algorithm 2, and the fallback "minimize the distance to the original perturbed vector subject to the constraints," can in principle produce a vector that is no longer adversarial. The paper reports only the final ASR after the full pipeline. Please report, per configuration, the ASR before and after constraint satisfaction, or at least the per-sample joint success of "label flip and all constraints satisfied."
  5. [Section 6.6; Tables 3 and 4] The observation counts in the statistical analysis are inconsistent with the stated experimental design. Section 5.3 defines 42 configurations (6 methods x 7 epsilon values), but Table 3(a) sums to 105 observations (AutoAttack N=7, C&W N=14, others N=21) and Table 3(b) sums to 105 (ART 42, Foolbox 35, Custom 28). The ANOVA in Table 4 uses F(5,99), corresponding to 105 observations. The manuscript must reconcile these numbers and state explicitly how implementation libraries enter the sample; otherwise the ANOVA and post-hoc tests are not auditable.
minor comments (4)
  1. [Abstract vs. Section 8] The abstract says six attack methods, while Section 8 says "7 distinct major attack strategies" and Table 2 lists six; please correct the count.
  2. [Table 3] The AutoAttack row in Table 3(a) has a formatting error ("Auto764.70").
  3. [Table 8] Table 8 lists both PGD (L∞) and PGD (L2), but the text and Table 2 describe a single PGD row; clarify which norm is used in the reported results.
  4. [Section 6.3] Section 6.3 refers to "our comprehensive statistical analysis (detailed in Section 5.5)", but the paper has no Section 5.5; the statistical methods are explained only later in Section 6.6.

Circularity Check

0 steps flagged · score 0.0 of 10

No circular derivation: attack success rates are measured against an external reimplementation of AdaptiveFS, and the medical constraints are hand-authored rules rather than parameters fitted to the results.

full rationale

The paper's central empirical quantities are the attack success rates (33.08–64.70%) computed by applying standard white-box attacks to a re-implemented AdaptiveFS model on NHIS data. These are measured outcomes, not quantities derived from fitted parameters. The medical constraint framework in Section 3.3 is a set of hand-written rules derived from cited clinical standards; although Section 6.2 reports constraint-compliance at the configuration level (42/42, 41/42, etc.) and some constraints in Eqs. 11–16 refer to features (systolic blood pressure, glucose) absent from the 50-feature input list in Table 9, that is a reproducibility and validity limitation, not a circular reduction. No load-bearing conclusion depends on a self-citation: reference [2] (AdaptiveFS) is external prior work, and no 'uniqueness' or 'ansatz' is imported from the present author's own prior publications. The 97.6% 'clinical plausibility' figure is an internal consistency metric that checks the framework's own constraints, but the headline vulnerability claim stands or falls on the ASR measurements and the faithfulness of the constraint implementation, neither of which is circular.

Assumptions & free parameters 1 free parameters · 5 assumptions · 0 invented entities

The central claims rest on the NHIS proxy dataset, a private re-implementation of AdaptiveFS, an underspecified constraint solver, and standard attack math. The only hand-chosen numbers that materially affect the headline plausibility rate are the medical constraint thresholds; the epsilon sweep is an independent variable rather than a fitted parameter.

free parameters (1)
  • Medical constraint thresholds = Examples: SBP upper bounds 140/150/160 mmHg by age; diabetic glucose lower bound 140 mg/dL; BMI clamp to 22.5 in…
    Hand-chosen rule thresholds in Section 3.3 and Appendix A. The reported 97.6% plausibility rate depends directly on how permissive these bounds are, and the thresholds are not derived from the NHIS data or from a formal clinical standard with uncertainty.
assumptions (5)
  • domain assumption NHIS self-reported survey responses and 50 XGBoost-selected features are a sufficient proxy for real clinical questionnaire data.
    Stated as a limitation in Section 7.4.1 (population survey, simplified feature space, single task); the whole evaluation is built on this proxy.
  • domain assumption The author's re-implementation of AdaptiveFS is faithful to the original model and representative of deployed RL questionnaire systems.
    No code or checkpoints are released; the baseline accuracy and AUC are reported but no comparison against the original model's outputs is shown (Section 5.1).
  • ad hoc to paper Algorithm 2's projection and consistency propagation converge to a clinically plausible vector while preserving the adversarial effect.
    The CSP solver is described in Section 3.3.4, but its correctness, termination guarantees, and effect on attack success are not formally analyzed; validation is only reported per configuration.
  • domain assumption Perturbing the continuous normalized feature vector is a valid model of an attacker changing patient answers, despite many features being categorical or ordinal.
    The paper applies Lp-bounded perturbations to x in R^d and then projects onto constraints; it never specifies how one-hot categorical variables are perturbed or rounded (Section 3.2, Algorithm 1).
  • standard math The standard white-box attack formulations and their convergence properties, e.g. Eq. 8 for PGD, are correct and applicable to the Guesser network.
    The paper relies on textbook attack derivations from Goodfellow, Madry, Carlini and Wagner; these are standard results.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Adversarial Attacks on Reinforcement Learning-based Medical Questionnaire Systems: Input-level Perturbation Strategies and Medical Constraint Validation." pith.science (2026). https://pith.science/paper/XYAF67UC

@misc{pith2026250805677,
  author       = {Pith},
  title        = {Pith review of: Adversarial Attacks on Reinforcement Learning-based Medical Questionnaire Systems: Input-level Perturbation Strategies and Medical Constraint Validation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/XYAF67UC}},
  note         = {Machine review of arXiv:2508.05677}
}
read the original abstract

RL-based medical questionnaire systems have shown great potential in medical scenarios. However, their safety and robustness remain unresolved. This study performs a comprehensive evaluation on adversarial attack methods to identify and analyze their potential vulnerabilities. We formulate the diagnosis process as a Markov Decision Process (MDP), where the state is the patient responses and unasked questions, and the action is either to ask a question or to make a diagnosis. We implemented six prevailing major attack methods, including the Fast Gradient Signed Method (FGSM), Projected Gradient Descent (PGD), Carlini & Wagner Attack (C&W) attack, Basic Iterative Method (BIM), DeepFool, and AutoAttack, with seven epsilon values each. To ensure the generated adversarial examples remain clinically plausible, we developed a comprehensive medical validation framework consisting of 247 medical constraints, including physiological bounds, symptom correlations, and conditional medical constraints. We achieved a 97.6% success rate in generating clinically plausible adversarial samples. We performed our experiment on the National Health Interview Survey (NHIS) dataset (https://www.cdc.gov/nchs/nhis/), which consists of 182,630 samples, to predict the participant's 4-year mortality rate. We evaluated our attacks on the AdaptiveFS framework proposed in arXiv:2004.00994. Our results show that adversarial attacks could significantly impact the diagnostic accuracy, with attack success rates ranging from 33.08% (FGSM) to 64.70% (AutoAttack). Our work has demonstrated that even under strict medical constraints on the input, such RL-based medical questionnaire systems still show significant vulnerabilities.

Figures

Figures reproduced from arXiv: 2508.05677 by the authors.

Figure 1
Figure 1. Attack success rate heatmap. The x-axis represents epsilon values, and the y-axis represents attack methods. Color depth indicates success rate, with darker colors representing higher success rates. AutoAttack achieves the highest success rates across all epsilon values (up to 91.09%), while FGSM provides the most computationally efficient attacks [PITH_FULL_IMAGE:figures/full_fig_p013_1.png] view at source ↗
Figure 2
Figure 2. Attack success rate vs. epsilon values across different methods. The plot shows how attack effectiveness increases with perturbation magnitude. AutoAttack demonstrates consistently superior performance across all epsilon values, while FGSM shows the most linear and predictable scaling pattern. The monotonic increase confirms the vulnerability of the RL-based medical questionnaire system to larger perturbations. 13 … view at source ↗
Figure 3
Figure 3. Visualization of statistical analysis 6.7. Computational Efficiency Analysis The computational efficiency differences among various attack methods are significant, we present the computational time comparison in table 7: 16 [PITH_FULL_IMAGE:figures/full_fig_p016_3.png] view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: Computational time comparison across different attack methods. The results reveal a clear trade-off between computational efficiency and attack effectiveness. more practical. Another key limitation in generating medical adversarial attack examples proposed by Finlayson…

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

46 extracted references · 37 canonical work pages

  1. [1]

    National health interview survey,

    National Center for Health Statistics, “National health interview survey,”Centers for Disease Control and Prevention, 2022

    work page 2022

  2. [2]

    Learning to Ask Medical Questions using Reinforcement Learning,

    U. Shaham, T. Zahavy, C. Caraballo, S. Mahajan, D. Massey, and H. Krumholz, “Learning to Ask Medical Questions using Reinforcement Learning,” 2020. Version Number: 2

    work page 2020

  3. [3]

    E. J. Topol,High-performance medicine: the convergence of human and artificial intelligence. Nature Medicine, 2019

    work page 2019

  4. [4]

    A survey on deep learning in medical image analysis,

    G. Litjens, T. Kooi, B. E. Bejnordi, A. A. A. Setio, F. Ciompi, M. Ghafoorian, J. A. van der Laak, B. Van Ginneken, and C. I. S´ anchez, “A survey on deep learning in medical image analysis,”Medical Image Analysis, vol. 42, pp. 60–88, 2017

    work page 2017

  5. [5]

    An overview of clinical decision support systems: benefits, risks, and strategies for success,

    R. T. Sutton, D. Pincock, D. C. Baumgart, D. C. Sadowski, R. N. Fedorak, and K. I. Kroeker, “An overview of clinical decision support systems: benefits, risks, and strategies for success,”NPJ Digital Medicine, vol. 3, 2020

    work page 2020

  6. [6]

    An adaptive testing item selection strategy via a deep reinforcement learning approach,

    P. Wang, H. Liu, and M. Xu, “An adaptive testing item selection strategy via a deep reinforcement learning approach,”Behavior Research Methods, vol. 56, pp. 8695–8714, 2024

    work page 2024

  7. [7]

    R. S. Sutton and A. G. Barto,Reinforcement learning: An introduction. MIT press, 2018

    2018

  8. [8]

    Bellman,A Markovian decision process

    R. Bellman,A Markovian decision process. Indiana University Mathematics Journal, 1957

    work page 1957

Show all 46 references
  1. [9]

    M. L. Puterman,Markov decision processes: discrete stochastic dynamic programming. John Wiley & Sons, 2014

    2014

  2. [10]

    Adversarial attacks on medical machine learning,

    S. G. Finlayson, J. D. Bowers, J. Ito, J. L. Zittrain, A. L. Beam, and I. S. Kohane, “Adversarial attacks on medical machine learning,”Science, vol. 363, no. 6433, pp. 1287–1289, 2019

    2019

  3. [11]

    A marauder’s map of security and privacy in machine learning,

    N. Papernot, “A marauder’s map of security and privacy in machine learning,”CoRR, vol. abs/1811.01134, 2018

    2018 arXiv

  4. [12]

    Evasion attacks against machine learning at test time,

    B. Biggio, I. Corona, D. Maiorca, B. Nelson, N. ˇSrndic, P. Laskov, G. Giacinto, and F. Roli, “Evasion attacks against machine learning at test time,”Machine Learning and Knowledge Discovery in Databases, pp. 387–402, 2013

    2013

  5. [13]

    The security of machine learning,

    M. Barreno, B. Nelson, A. D. Joseph, and J. D. Tygar, “The security of machine learning,”Machine Learning, vol. 81, no. 2, pp. 121–148, 2010

    2010

  6. [14]

    Concrete problems in ai safety,

    D. Amodei, C. Olah, J. Steinhardt, P. Christiano, J. Schulman, and D. Man´ e, “Concrete problems in ai safety,”arXiv preprint arXiv:1606.06565, 2016

    2016 arXiv

  7. [15]

    Russell,Human compatible: Artificial intelligence and the problem of control

    S. Russell,Human compatible: Artificial intelligence and the problem of control. Viking, 2019

    2019

  8. [16]

    COM(2021) 206 final

    European Commission, “Regulation of the european parliament and of the council laying down harmonised rules on artificial intelligence (artificial intelligence act) and amending certain union legislative acts,” 2021. COM(2021) 206 final

    2021

  9. [17]

    LOINC: Logical observation identifiers names and codes

    Regenstrief Institute, “LOINC: Logical observation identifiers names and codes.” https://loinc.org,

  10. [18]

    SNOMED CT: Systematized nomenclature of medicine clinical terms

    SNOMED International, “SNOMED CT: Systematized nomenclature of medicine clinical terms.” https://www.snomed.org, 2024. International clinical terminology standard. 28 Adversarial Attacks on RL Questionnaire Systems P. Liu

    2024

  11. [19]

    ICD-11: International classification of diseases 11th revision

    World Health Organization, “ICD-11: International classification of diseases 11th revision.” https: //icd.who.int, 2024. WHO diagnostic coding standard

    2024

  12. [20]

    Standards of care in diabetes-2025,

    American Diabetes Association Professional Practice Committee, “Standards of care in diabetes-2025,” Diabetes Care, vol. 48, no. Supplement 1, pp. S1–S204, 2025

    2025

  13. [21]

    Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks,

    F. Croce and M. Hein, “Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks,” 2020

    2020

  14. [22]

    Intriguing properties of neural networks,

    C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus, “Intriguing properties of neural networks,”arXiv preprint arXiv:1312.6199, 2013

    2013 arXiv

  15. [23]

    Explaining and harnessing adversarial examples,

    I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,”arXiv preprint arXiv:1412.6572, 2014

    2014 arXiv

  16. [24]

    Towards deep learning models resistant to adversarial attacks,

    A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” inInternational Conference on Learning Representations, 2018

    2018

  17. [25]

    Practical black-box attacks against machine learning,

    N. Papernot, P. McDaniel, I. Goodfellow, S. Jha, Z. B. Celik, and A. Swami, “Practical black-box attacks against machine learning,” inProceedings of the 2017 ACM Asia Conference on Computer and Communications Security (ASIACCS ’17), (Abu Dhabi, United Arab Emirates), pp. 506–5...

    2017

  18. [26]

    Delving into transferable adversarial examples and black-box attacks,

    Y. Liu, X. Chen, C. Liu, and D. Song, “Delving into transferable adversarial examples and black-box attacks,” in5th International Conference on Learning Representations, ICLR 2017, Toulon, France, April 24-26, 2017, Conference Track Proceedings, OpenReview.net, 2017

    2017

  19. [27]

    Black-box adversarial attacks with limited queries and information,

    A. Ilyas, L. Engstrom, A. Athalye, and J. Lin, “Black-box adversarial attacks with limited queries and information,” inProceedings of the 35th International Conference on Machine Learning(J. Dy and A. Krause, eds.), vol. 80 ofProceedings of Machine Learning Research, pp. 2137–...

    2018

  20. [28]

    Autozoom: autoencoder-based zeroth order optimization method for attacking black-box neural networks,

    C.-C. Tu, P. Ting, P.-Y. Chen, S. Liu, H. Zhang, J. Yi, C.-J. Hsieh, and S.-M. Cheng, “Autozoom: autoencoder-based zeroth order optimization method for attacking black-box neural networks,” in Proceedings of the Thirty-Third AAAI Conference on Artificial Intelligence and Thirt...

    2019

  21. [29]

    Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models,

    P.-Y. Chen, H. Zhang, Y. Sharma, J. Yi, and C.-J. Hsieh, “Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models,” inProceedings of the 10th ACM workshop on artificial intelligence and security, pp. 15–26, 2017

    2017

  22. [30]

    Adversarial attacks on neural network policies,

    S. H. Huang, N. Papernot, I. J. Goodfellow, Y. Duan, and P. Abbeel, “Adversarial attacks on neural network policies,”CoRR, vol. abs/1702.02284, 2017

    2017 arXiv

  23. [31]

    Tactics of adversarial attack on deep reinforcement learning agents,

    Y.-C. Lin, Z.-W. Hong, Y.-H. Liao, M.-L. Shih, M.-Y. Liu, and M. Sun, “Tactics of adversarial attack on deep reinforcement learning agents,”arXiv preprint arXiv:1703.06748, 2017

    2017 arXiv

  24. [32]

    Adversarial policies: Attacking deep reinforcement learning,

    A. Gleave, M. Dennis, N. Kant, C. Wild, S. Levine, and S. Russell, “Adversarial policies: Attacking deep reinforcement learning,”CoRR, vol. abs/1905.10615, 2020

    1905 arXiv

  25. [33]

    Blackbox attacks on reinforcement learning agents using approximated temporal information

    Y. Zhao, I. Shumailov, H. Cui, X. Gao, R. Mullins, and R. Anderson, “Blackbox attacks on reinforcement learning agents using approximated temporal information.” arXiv:1909.02918, 2019. arXiv preprint. 29 Adversarial Attacks on RL Questionnaire Systems P. Liu

    1909 arXiv

  26. [34]

    Robust reinforcement learning via adversarial training with langevin dynamics,

    P. Kamalaruban, Y.-T. Huang, Y.-P. Hsieh, P. Rolland, C. Shi, and V. Cevher, “Robust reinforcement learning via adversarial training with langevin dynamics,” inAdvances in Neural Information Processing Systems 33 (NeurIPS 2020), pp. 8127–8138, 2020

    2020

  27. [35]

    Bayesian learning via stochastic gradient langevin dynamics,

    M. Welling and Y. W. Teh, “Bayesian learning via stochastic gradient langevin dynamics,” in Proceedings of the 28th international conference on machine learning (ICML-11), pp. 681–688, 2011

    2011

  28. [36]

    Understanding deep learning requires rethinking generalization,

    C. Zhang, S. Bengio, M. Hardt, B. Recht, and O. Vinyals, “Understanding deep learning requires rethinking generalization,”Communications of the ACM, vol. 64, no. 3, pp. 107–115, 2021. Originally published in ICLR 2017

    2021

  29. [37]

    Understanding adversarial attacks on deep learning based medical image analysis systems,

    X. Ma, Y. Niu, L. Gu, Y. Wang, Y. Zhao, J. Bailey, and F. Lu, “Understanding adversarial attacks on deep learning based medical image analysis systems,”Pattern Recognition, vol. 110, p. 107332, 2020

    2020

  30. [38]

    Impact of adversarial examples on deep learning models for biomedical image segmentation,

    U. Ozbulak, Y. Aytar, and H. K. Ekenel, “Impact of adversarial examples on deep learning models for biomedical image segmentation,”Medical Image Analysis, vol. 65, p. 101768, 2019

    2019

  31. [39]

    A hierarchical feature constraint to camouflage medical adversarial attacks,

    Q. Yao, Z. He, Y. Lin, K. Ma, Y. Zheng, and S. K. Zhou, “A hierarchical feature constraint to camouflage medical adversarial attacks,” inMedical Image Computing and Computer Assisted Intervention–MICCAI 2021, pp. 36–47, Springer, 2021

    2021

  32. [40]

    Stabilized medical image attack,

    X. Qi, T. Xie, Y. Li, R. Zeman, V. Srikumar, and P.-Y. Chen, “Stabilized medical image attack,” arXiv preprint arXiv:2103.09531, 2021

    2021 arXiv

  33. [41]

    Towards evaluating the robustness of neural networks,

    N. Carlini and D. Wagner, “Towards evaluating the robustness of neural networks,” in2017 ieee symposium on security and privacy (sp), pp. 39–57, IEEE, 2017

    2017

  34. [42]

    Human-level control through deep reinforcement learning,

    V. Mnih, K. Kavukcuoglu, D. Silver, A. A. Rusu, J. Veness, M. G. Bellemare, A. Graves, M. Riedmiller, A. K. Fidjeland, G. Ostrovski,et al., “Human-level control through deep reinforcement learning,” Nature, vol. 518, no. 7540, pp. 529–533, 2015

    2015

  35. [43]

    Self-improving reactive agents based on reinforcement learning, planning and teaching,

    L.-J. Lin, “Self-improving reactive agents based on reinforcement learning, planning and teaching,” Machine Learning, vol. 8, no. 3-4, pp. 293–321, 1992

    1992

  36. [44]

    Understanding the difficulty of training deep feedforward neural networks,

    X. Glorot and Y. Bengio, “Understanding the difficulty of training deep feedforward neural networks,” inProceedings of the thirteenth international conference on artificial intelligence and statistics, pp. 249–256, JMLR Workshop and Conference Proceedings, 2010

    2010

  37. [45]

    Evaluating the robustness of neural networks: An extreme value theory approach,

    N. Carlini, A. Athalye, N. Papernot, W. Brendel, J. Rauber, D. Tsipras, I. Goodfellow, A. Madry, and A. Kurakin, “Evaluating the robustness of neural networks: An extreme value theory approach,” arXiv preprint arXiv:1905.03493, 2019. 30

    1905 arXiv

  38. [2024]

    Laboratory data coding standard

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.