Pith. sign in

REVIEW 3 major objections 6 minor 41 references

Towards Robust Deep Reinforcement Learning against Environmental State Perturbation

T0 review · 3 major / 6 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper introduces environmental state perturbation—static, reachable changes to the initial environment—and shows that a two-stage supervised-then-adversarial training procedure restores robustness and even improves clean-environment…

desk verdict The paper defines a genuinely new threat model for RL robustness, but its headline defense result is undermined by a possible train/eval overlap that the manuscript never rules out. read the letter →

arxiv 2506.08961 v1 pith:RHYKOEIX submitted 2025-06-10 cs.LG cs.AI

Chenxu Wang , Huaping Liu This is my paper · ORCID
classification cs.LGcs.AI
keywords environmentalstateperturbationdeepreinforcementlearningadversarialattackrobusttrainingOvercookedsupervisedkickstarting
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper introduces a new way to attack deep reinforcement learning agents: instead of perturbing the agent's observations, an adversary changes the initial environmental state, for example placing an onion or a dish on a different counter, within a semantic budget while keeping the change static and reachable in the real environment. The authors claim that even such seemingly harmless rearrangements can drive mainstream agents' rewards down to near zero, and that existing robust reinforcement learning defenses aimed at $L_p$-norm perturbations do not transfer to this setting. They then propose BAT, a two-stage defense: first a supervised kick-starting stage that teaches the policy to keep acting sensibly on perturbed states, then adversarial fine-tuning with reinforcement learning on a mixture of standard and perturbed initial states. In Overcooked layouts the defense improves robustness under attack and also raises scores in the clean environment.

What carries the argument

The machinery is an embodied MDP whose state is split into an agent state $s^a$ and an environmental state $s^e$, plus a semantic distance $D(s^e, \hat{s}^e)$ defined as the minimum number of reachable unit perturbations that transform one layout into the other. The attack is carried by a first-order surrogate objective $J(\hat{s}_0^e)$ that evaluates how much a proposed initial environmental change would shift the policy's probability of its original optimal action, computed from trajectories collected in the standard environment. The defense is carried by the two-stage BAT pipeline: supervised kick-starting, which uses KL divergence, temperature-$T$ distillation labels, and a slackened value loss to keep the policy's behavior close to the original on perturbed states; and adversarial fine-tuning, which continues reinforcement learning from the kick-started policy under a mixed distribution of initial states. Assumption 1, that a successful initial perturbation is not washed out over time, is the bridge that lets both the attack and the defense treat the perturbation as a time-invariant offset.

What would settle it

Measure, in any of the tested layouts, the actual deviation between perturbed and standard environmental states along trajectories; if the deviation shrinks below its initial value while the attack still reduces reward, the paper's time-invariance assumption is false.

Watch

Extended reading notes

Core claim

On the paper's own terms, the central discovery is that a non-targeted, first-order attack on the initial environmental state reliably degrades trained policies, and that robustness can be restored by a two-phase training procedure. The attack maximizes the negative likelihood of the original optimal actions under estimated perturbed states, using the first-order approximation $J(\hat{s}_0^e) = \sum_{(s_t^a, s_t^e, a_t^*) \in \tau} \frac{\partial \pi(a_t^*|s_t^a, s_t^e)}{\partial s_t^e} \cdot (s_0^e - \hat{s}_0^e)$ along collected trajectories, with the perturbation assumed time-invariant. The defense, BAT, first minimizes a loss combining KL divergence between the original and kick-started policies, a softened temperature-$T$ distillation term on perturbed states, and a value-proximity term, then fine-tunes with reinforcement learning on a distribution that mixes the standard initial state with adversarial and random reachable perturbed states. The experiments show reward drops to near zero for Self-Play and Fictitious Co-play agents under attack, while BAT improves both attacked and unattacked scores, outperforming extra training, diversified starts, and a representative robust-DRL baseline.

Load-bearing premise

If a successful initial perturbation gets washed out by the environment's dynamics over time, so that the agent eventually sees normal states, then the attack objective and the defense's kick-starting both lose their foundation.

Editorial extensions

If this is right

  • A saboteur who can only move objects within the training layout can drive mainstream policies' scores near zero, and even random reachable moves hurt clearly.
  • Training with diversified initial states helps but leaves large attack gaps; BAT is stronger and also improves unperturbed scores.
  • Existing robustness methods designed for $L_p$-norm observation perturbations do not transfer to this threat model.
  • Because BAT is a post-processing stage, it can be applied after standard reinforcement learning training without changing the primary algorithm.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the effect is general, placing or moving task-irrelevant objects in real robot deployments should be treated as an attack vector even without an adversary, since the paper's threat model turns a domain gap into a measurable quantity.
  • The attack's first-order objective ignores chain reactions in the environment, so in domains with stronger dynamics a trajectory-rollout attack would be a natural next test to see whether true attack strength is under- or over-estimated.
  • BAT's clean-environment gain suggests the supervised stage acts as a skill-preserving regularizer; one testable extension is ablating the distillation temperature to see whether the boost comes from label smoothing rather than the adversarial examples themselves.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper introduces a threat model for deep reinforcement learning in which an adversary perturbs only the initial environmental state, under a semantic reachability budget, rather than per-step observations. It proposes a non-targeted white-box attack that scores candidate unit perturbations with a first-order objective over fixed trajectories, and a two-phase defense, BAT, that combines supervised kickstarting with adversarial fine-tuning. The experiments in the Overcooked environment cover six layouts, two agent types (SP and FCP), and five seeds, showing that the attack lowers rewards substantially and that BAT improves robustness more than existing baselines, with additional gains in clean-environment performance.

Significance. If the central claims hold, the paper makes a useful contribution: it identifies an underexplored and practically motivated threat model, provides a concrete attack algorithm, and demonstrates a defense that is empirically effective across a nontrivial set of layouts and agent types. The study is careful in several respects: it reports standard errors, uses multiple seeds, compares against random and transfer attacks, and includes diversified-start and RADIAL baselines. This level of empirical grounding is a strength. The main caveat is that the defense is evaluated against the same heuristic attack that generated its training data; without additional evaluation against fresh or adaptive attacks, the quantitative robustness claim is narrower than the max-min formulation in Eq. (2) suggests.

major comments (3)
  1. [V-C, Table I] The paper does not rule out overlap between the adversarial states used to train BAT and those used in the 'Our attack' evaluation rows of Table I. Section V-C says the perturbed initial states for training consist of the top 5 outputs of the attack algorithm plus 5 random states, while the attack algorithm in Section V-B outputs k=10 states; the defense evaluation uses the same attack algorithm, and no statement is made that fresh attack states are generated for defended agents or that training states are held out. If the evaluated states coincide with the training states, the large improvements in the 'Our attack' rows could be due to memorization of those specific states rather than to robustness over the feasible set in Eq. (2). The authors should specify the exact generation/evaluation protocol, and, ideally, evaluate on newly generated attack states and on a stronger or adaptive adversary. This point is load-bearing for the headline defense claim.
  2. [III, Assumption 1] Assumption 1 is unproven and is load-bearing for both the attack and the defense. It is used to justify the time-invariant form of the attack objective in Eq. (4) and the supervised kickstarting loss in Eq. (7), which relies on estimated perturbed states. The paper does not provide empirical evidence that for successful attacks |ŝe_t − se_t| remains at least as large as the initial perturbation over time; if the environment dynamics overwrite or dissipate the perturbation, the proposed objective and defense lose their theoretical grounding. The authors should measure the evolution of the perturbation norm along successful attack trajectories and report whether Assumption 1 holds, or at least discuss the sensitivity of the results to its violation.
  3. [IV-A, Eq. (4)] The attack objective in Eq. (4) is a first-order approximation that linearizes the effect of the initial perturbation on the policy outputs along the original, unperturbed trajectories, explicitly ignoring trajectory feedback. The text acknowledges that a chain reaction is neglected, but the assumption that perturbations 'seldom interfere with the original trajectories' is not directly verified. Since a successful attack changes future states and actions, the estimated J(ŝe_0) may not correlate with actual reward degradation on trajectories different from the ones used to construct the attack. The paper should validate J against true reward reduction (e.g., by reporting correlation on held-out states) or compare with a trajectory-aware attack variant; this would also help interpret the transfer results in Figure 4 and the defense outcomes in Table I.
minor comments (6)
  1. [V-C.1] The sentence 'keeping the total computational cost of defense close to the original training process..' contains a doubled period; it should be a single period.
  2. [Table I] Several entries in Table I are missing spaces between adjacent values, e.g., '459.7±14.3373.3±24.5' and '352.8±4.5335.9±23.4'; this makes the table harder to read and should be fixed in the camera-ready version.
  3. [V-C.1] The selection of 'the top 5 outputs of our attack algorithm' is not fully specified: it is unclear whether 'top' is by the estimated objective J, whether the selection is done per agent, and whether the same top-5 set is reused for all layouts. A precise description of the selection procedure is needed for reproducibility.
  4. [III] In the paragraph defining the reinforcement learning setup, 'under the initial agent states e_t and the initial environmental state se_0' appears to contain a typo; it should probably read 'under the initial agent state s^a_0'.
  5. [V-B.1] The random baselines use k=40 states while the attack uses k=10 states; the comparison is understandable, but the difference in the number of states should be explicitly discussed when interpreting averages over states, since averaging over a different number of candidate states affects the comparison.
  6. [V-A] The semantic distance D is defined only for the Overcooked domain; the paper would benefit from a short discussion of how D could be instantiated in other embodied environments, since the generality of the threat model is part of the claimed contribution.

Circularity Check

1 steps flagged · score 6.0 of 10

Defense is trained on the top-5 outputs of the authors' own attack and then evaluated under that same attack, so part of the reported robustness under 'Our attack' may measure memorization rather than generalization to the feasible set.

  1. fitted input called prediction [Section V-C.1 (Defense experimental setup); Section IV-B (fine-tuning distribution); Table I 'Our attack' rows]
    "We empirically select the top 5 outputs of our attack algorithm and sample 5 random initial states to form the set of perturbed initial states. / Typically, the initial state distribution S e 0 consists of the original initial state and the perturbed initial states used in kick-starting."

    BAT's supervised kick-starting and fine-tuning use the top 5 adversarial initial states produced by the paper's own attack algorithm (plus 5 random states). The 'Our attack' evaluation in Table I uses the same attack algorithm, whose k=10 outputs are selected in the same way and are not stated to be regenerated or to exclude the states seen in training. Since the attack enumerates unit perturbations for the victim agent, the top-5 training states are effectively part of the evaluation set. The large 'Our attack' gains can therefore be explained by fitting to those specific states, not by robustness over the feasible set in Eq. (2). This is a fitted-input-called-prediction pattern: the defense is calibrated on the adversary's outputs and then credited with resisting that same adversary.

full rationale

The paper is an empirical attack/defense study with no formal derivation that reduces to its inputs; the attack and defense formulations in Sections III-IV are self-contained. I found no load-bearing self-citations: the authors cite standard prior work (PPO, FCP, Overcooked, RADIAL) and do not rely on any uniqueness theorem from their own papers. The only circular element is experimental: the defense is trained on the top-5 outputs of the authors' own attack, and Table I's 'Our attack' evaluation appears to use the same attack outputs with no stated exclusion of training states, so the headline robustness numbers may partly measure memorization. This is a partial circularity because random-start and clean-environment results provide independent signal and because the attack itself is genuinely evaluated against random baselines. The absence of code/data makes the overlap impossible to rule out. Overall score 6: one of the central advance's supporting predictions reduces, in part, to the training inputs.

Assumptions & free parameters 6 free parameters · 4 assumptions · 0 invented entities

The central claims rest on one stated invariance assumption about perturbation persistence, a time-invariance approximation for the attack objective, and several hand-set hyperparameters. No code or data are provided, so the ledger cannot be checked against released artifacts.

free parameters (6)
  • softmax temperature T = 1.5
    Set by hand in Section V-C1; controls the softened teacher distribution in Eq. (6) and thus the supervised kickstarting target.
  • value-proximity threshold alpha = 0.05
    Hand-selected; controls how much the disturbed-state value may deviate from the original value in Eq. (7).
  • loss weight beta = 1
    Weights the disturbed-state loss L_p against the original-state loss L_o in Eqs. (5) and (7).
  • perturbation budget epsilon = 3
    Defines the threat model; no sensitivity analysis, so the defense may be tuned to this magnitude.
  • frequency filter threshold p_freq = not reported
    Used to filter out perturbations observed in collected trajectories (Section V-B1); value never given.
  • number of adversarial states k / top-5 selection = 10 for attack, top 5 for defense
    The defense training set uses the top 5 attack outputs plus 5 random states; results may depend on this choice.
assumptions (4)
  • domain assumption Assumption 1: for successful attacks, |ŝe_t − se_t| ≥ |ŝe_0 − se_0|
    Stated in Section III and used to justify time-invariant treatment of perturbations in Eq. (4) and the defense's supervised loss; not proven.
  • domain assumption The initial perturbation difference is time-invariant (ŝe_t − se_t ≈ ŝe_0 − se_0)
    Invoked after Eq. (4) to estimate perturbed states; may fail when the agent or environment reacts and changes object positions.
  • domain assumption Environmental perturbations cause capability generalization failure rather than goal misgeneralization and seldom interfere with original trajectories
    Section IV-A; motivates the non-targeted attack objective in Eq. (3).
  • domain assumption The policy uses a Softmax output layer
    Section III; the BAT supervised loss relies on temperature-softened Softmax in Eq. (6).

how reviews work

0 comments
Cite this review

Pith. "Pith review of Towards Robust Deep Reinforcement Learning against Environmental State Perturbation." pith.science (2026). https://pith.science/paper/RHYKOEIX

@misc{pith2026250608961,
  author       = {Pith},
  title        = {Pith review of: Towards Robust Deep Reinforcement Learning against Environmental State Perturbation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/RHYKOEIX}},
  note         = {Machine review of arXiv:2506.08961}
}
read the original abstract

Adversarial attacks and robustness in Deep Reinforcement Learning (DRL) have been widely studied in various threat models; however, few consider environmental state perturbations, which are natural in embodied scenarios. To improve the robustness of DRL agents, we formulate the problem of environmental state perturbation, introducing a preliminary non-targeted attack method as a calibration adversary, and then propose a defense framework, named Boosted Adversarial Training (BAT), which first tunes the agents via supervised learning to avoid catastrophic failure and subsequently adversarially trains the agent with reinforcement learning. Extensive experimental results substantiate the vulnerability of mainstream agents under environmental state perturbations and the effectiveness of our proposed attack. The defense results demonstrate that while existing robust reinforcement learning algorithms may not be suitable, our BAT framework can significantly enhance the robustness of agents against environmental state perturbations across various situations.

Figures

Figures reproduced from arXiv: 2506.08961 by the authors.

Figure 1
Figure 1. An illustration of environmental state perturbation, [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. An illustration of the entire procedure of our BAT framework, which utilizes adversarial perturbations to adaptive [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Illustration of the icons and layouts in the Overcooked environment. [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: The mean scores and standard error across agents for SP and FCP. [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]
Figure 5
Figure 5. Figure 5: Environmental state perturbations generated by all [PITH_FULL_IMAGE:figures/full_fig_p006_5.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

41 extracted references · 33 canonical work pages

  1. [1]

    Robust deep reinforcement learning against adversarial perturbations on state observations,

    H. Zhang, H. Chen, C. Xiao, B. Li, M. Liu, D. Boning, and C.-J. Hsieh, “Robust deep reinforcement learning against adversarial perturbations on state observations,”Advances in Neural Information Processing Systems, vol. 33, pp. 21 024–21 037, 2020

    work page 2020

  2. [2]

    Robust deep reinforcement learning through adversarial loss,

    T. Oikarinen, W. Zhang, A. Megretski, L. Daniel, and T.-W. Weng, “Robust deep reinforcement learning through adversarial loss,” in Advances in Neural Information Processing Systems, 2021

    work page 2021

  3. [3]

    Robust reinforcement learning on state observations with learned optimal adversary,

    H. Zhang, H. Chen, D. Boning, and C.-J. Hsieh, “Robust reinforcement learning on state observations with learned optimal adversary,” in International Conference on Learning Representation (ICLR), 2021

    2021

  4. [4]

    Efficient adversarial training without attacking: Worst-case-aware robust reinforcement learning,

    Y . Liang, Y . Sun, R. Zheng, and F. Huang, “Efficient adversarial training without attacking: Worst-case-aware robust reinforcement learning,” inAdvances in Neural Information Processing Systems, 2022

    work page 2022

  5. [5]

    Spa- tiotemporally constrained action space attacks on deep reinforcement learning agents,

    X. Y . Lee, S. Ghadai, K. L. Tan, C. Hegde, and S. Sarkar, “Spa- tiotemporally constrained action space attacks on deep reinforcement learning agents,” inProceedings of the AAAI conference on artificial intelligence, vol. 34, no. 04, 2020, pp. 4577–4584

    work page 2020

  6. [6]

    Ad- versarial poisoning attacks on reinforcement learning-driven energy pricing,

    S. Gunn, D. Jang, O. Paradise, L. Spangher, and C. J. Spanos, “Ad- versarial poisoning attacks on reinforcement learning-driven energy pricing,” inProceedings of the 9th ACM International Conference on Systems for Energy-Efficient Buildings, Cities, and Transportation, 2022, pp. 262–265

    work page 2022

  7. [7]

    Trojdrl: Trojan attacks on deep reinforcement learning agents. in proc. 57th acm/ieee design automation conference (dac), 2020, march 2020,

    K. Panagiota, W. Kacper, S. Jha, and L. Wenchao, “Trojdrl: Trojan attacks on deep reinforcement learning agents. in proc. 57th acm/ieee design automation conference (dac), 2020, march 2020,” inProc. 57th ACM/IEEE Design Automation Conference (DAC), 2020, 2020

    work page 2020

  8. [8]

    Adversarial policies: Attacking deep reinforcement learning,

    A. Gleave, M. Dennis, C. Wild, N. Kant, S. Levine, and S. Russell, “Adversarial policies: Attacking deep reinforcement learning,” inIn- ternational Conference on Learning Representations, 2020

    work page 2020

Show all 41 references
  1. [9]

    On the robustness of cooperative multi-agent reinforcement learning,

    J. Lin, K. Dzeparoska, S. Q. Zhang, A. Leon-Garcia, and N. Papernot, “On the robustness of cooperative multi-agent reinforcement learning,” in2020 IEEE Security and Privacy Workshops (SPW). IEEE, 2020, pp. 62–68

    2020

  2. [10]

    Towards comprehensive testing on the robustness of cooperative multi-agent reinforcement learning,

    J. Guo, Y . Chen, Y . Hao, Z. Yin, Y . Yu, and S. Li, “Towards comprehensive testing on the robustness of cooperative multi-agent reinforcement learning,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2022, pp. 115–122

    2022

  3. [11]

    On the utility of learning about humans for human-ai coordination,

    M. Carroll, R. Shah, M. K. Ho, T. Griffiths, S. Seshia, P. Abbeel, and A. Dragan, “On the utility of learning about humans for human-ai coordination,” inAdvances in neural information processing systems, vol. 32, 2019

    2019

  4. [12]

    Collaborating with humans without human data,

    D. Strouse, K. R. McKee, M. Botvinick, E. Hughes, and R. Everett, “Collaborating with humans without human data,” inAdvances in Neural Information Processing Systems, vol. 34, 2021, pp. 14 502– 14 515

    2021

  5. [13]

    Coordination with humans via strategy matching,

    M. Zhao, R. Simmons, and H. Admoni, “Coordination with humans via strategy matching,” in2022 IEEE/RSJ International Conference on Intelligent Robots and Systems (IROS). IEEE, 2022, pp. 9116–9123

    2022

  6. [14]

    Learning zero-shot cooperation with humans, assuming humans are biased,

    C. Yu, J. Gao, W. Liu, B. Xu, H. Tang, J. Yang, Y . Wang, and Y . Wu, “Learning zero-shot cooperation with humans, assuming humans are biased,” inInternational Conference on Learning Representations, 2023

    2023

  7. [15]

    An efficient end-to-end training approach for zero-shot human-ai coordination,

    X. Yan, J. Guo, X. Lou, J. Wang, H. Zhang, and Y . Du, “An efficient end-to-end training approach for zero-shot human-ai coordination,” in NeurIPS 2023, 2023

    2023

  8. [16]

    Intriguing properties of neural networks,

    C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Good- fellow, and R. Fergus, “Intriguing properties of neural networks,” in International Conference on Learning Representations, ICLR, 2014

    2014

  9. [17]

    One pixel attack for fooling deep neural networks,

    J. Su, D. V . Vargas, and K. Sakurai, “One pixel attack for fooling deep neural networks,”IEEE Transactions on Evolutionary Computation, vol. 23, no. 5, pp. 828–841, 2019

    2019

  10. [18]

    Adversarial attacks on neural network policies,

    S. Huang, N. Papernot, I. Goodfellow, Y . Duan, and P. Abbeel, “Adversarial attacks on neural network policies,”arXiv preprint arXiv:1702.02284, 2017

    2017 arXiv

  11. [19]

    Vulnerability of deep reinforcement learning to policy induction attacks,

    V . Behzadan and A. Munir, “Vulnerability of deep reinforcement learning to policy induction attacks,” inInternational Conference on Machine Learning and Data Mining in Pattern Recognition. Springer, 2017, pp. 262–275

    2017

  12. [20]

    Tactics of adversarial attack on deep reinforcement learning agents,

    Y .-C. Lin, Z.-W. Hong, Y .-H. Liao, M.-L. Shih, M.-Y . Liu, and M. Sun, “Tactics of adversarial attack on deep reinforcement learning agents,” inProceedings of the 26th International Joint Conference on Artificial Intelligence, 2017, pp. 3756–3762

    2017

  13. [21]

    Toward evaluating robustness of deep reinforce- ment learning with continuous control,

    T.-W. Weng, K. D. Dvijotham, J. Uesato, K. Xiao, S. Gowal, R. Stan- forth, and P. Kohli, “Toward evaluating robustness of deep reinforce- ment learning with continuous control,” inInternational Conference on Learning Representations, 2020

    2020

  14. [22]

    Real-time adversarial perturbations against deep reinforcement learning policies: attacks and defenses,

    B. G. Tekgul, S. Wang, S. Marchal, and N. Asokan, “Real-time adversarial perturbations against deep reinforcement learning policies: attacks and defenses,” inEuropean Symposium on Research in Com- puter Security. Springer, 2022, pp. 384–404

    2022

  15. [23]

    Targeted attack on deep rl-based autonomous driving with learned visual patterns,

    P. Buddareddygari, T. Zhang, Y . Yang, and Y . Ren, “Targeted attack on deep rl-based autonomous driving with learned visual patterns,” in 2022 International Conference on Robotics and Automation (ICRA). IEEE, 2022, pp. 10 571–10 577

    2022

  16. [24]

    Improving robustness of deep reinforcement learning agents: Environment attack based on the critic network,

    L. Schott, H. Hajri, and S. Lamprier, “Improving robustness of deep reinforcement learning agents: Environment attack based on the critic network,” in2022 International Joint Conference on Neural Networks (IJCNN). IEEE, 2022, pp. 1–8

    2022

  17. [25]

    Characterizing attacks on deep reinforcement learning,

    X. Pan, C. Xiao, W. He, S. Yang, J. Peng, M. Sun, M. Liu, B. Li, and D. Song, “Characterizing attacks on deep reinforcement learning,” inProceedings of the 21st International Conference on Autonomous Agents and Multiagent Systems, 2022, pp. 1010–1018

    2022

  18. [26]

    Rigorous agent evaluation: An adversarial approach to uncover catastrophic failures,

    J. Uesato, A. Kumar, C. Szepesvari, T. Erez, A. Ruderman, K. An- derson, N. Heess, P. Kohliet al., “Rigorous agent evaluation: An adversarial approach to uncover catastrophic failures,” inInternational Conference on Learning Representations, 2019

    2019

  19. [27]

    Scalable initial state interdiction for factored mdps,

    S. Panda and Y . V orobeychik, “Scalable initial state interdiction for factored mdps,” inInternational Joint Conference on Artificial Intelligence, 2018

    2018

  20. [28]

    Robust adversar- ial reinforcement learning,

    L. Pinto, J. Davidson, R. Sukthankar, and A. Gupta, “Robust adversar- ial reinforcement learning,” inInternational Conference on Machine Learning. PMLR, 2017, pp. 2817–2826

    2017

  21. [29]

    Robust deep reinforcement learning with adversarial attacks,

    A. Pattanaik, Z. Tang, S. Liu, G. Bommannan, and G. Chowdhary, “Robust deep reinforcement learning with adversarial attacks,” in Proceedings of the 17th International Conference on Autonomous Agents and MultiAgent Systems, 2018, pp. 2040–2042

    2018

  22. [30]

    Robust deep reinforcement learning through bootstrapped opportunistic curriculum,

    J. Wu and Y . V orobeychik, “Robust deep reinforcement learning through bootstrapped opportunistic curriculum,” inInternational Con- ference on Machine Learning. PMLR, 2022, pp. 24 177–24 211

    2022

  23. [31]

    Online ro- bustness training for deep reinforcement learning,

    M. Fischer, M. Mirman, S. Stalder, and M. Vechev, “Online ro- bustness training for deep reinforcement learning,”arXiv preprint arXiv:1911.00887, 2019

    1911 arXiv

  24. [32]

    Certified adversarial robustness for deep reinforcement learning,

    B. L ¨utjens, M. Everett, and J. P. How, “Certified adversarial robustness for deep reinforcement learning,” inConference on Robot Learning. PMLR, 2020, pp. 1328–1337

    2020

  25. [33]

    Certifiable robustness to adversarial state uncertainty in deep reinforcement learning,

    M. Everett, B. L ¨utjens, and J. P. How, “Certifiable robustness to adversarial state uncertainty in deep reinforcement learning,”IEEE Transactions on Neural Networks and Learning Systems, 2021

    2021

  26. [34]

    Goal misgeneralization in deep reinforcement learning,

    L. L. Di Langosco, J. Koch, L. D. Sharkey, J. Pfau, and D. Krueger, “Goal misgeneralization in deep reinforcement learning,” inInterna- tional Conference on Machine Learning. PMLR, 2022, pp. 12 004– 12 019

    2022

  27. [35]

    Distilling the knowledge in a neural network,

    G. Hinton, O. Vinyals, and J. Dean, “Distilling the knowledge in a neural network,”arXiv preprint arXiv:1503.02531, 2015

    2015 arXiv

  28. [36]

    Distillation as a defense to adversarial perturbations against deep neural networks,

    N. Papernot, P. McDaniel, X. Wu, S. Jha, and A. Swami, “Distillation as a defense to adversarial perturbations against deep neural networks,” in2016 IEEE symposium on security and privacy (SP). IEEE, 2016, pp. 582–597

    2016

  29. [37]

    Mujoco: A physics engine for model-based control,

    E. Todorov, T. Erez, and Y . Tassa, “Mujoco: A physics engine for model-based control,” in2012 IEEE/RSJ international conference on intelligent robots and systems. IEEE, 2012, pp. 5026–5033

    2012

  30. [38]

    Leveraging procedu- ral generation to benchmark reinforcement learning,

    K. Cobbe, C. Hesse, J. Hilton, and J. Schulman, “Leveraging procedu- ral generation to benchmark reinforcement learning,” inInternational conference on machine learning. PMLR, 2020, pp. 2048–2056

    2020

  31. [39]

    Proximal policy optimization algorithms,

    J. Schulman, F. Wolski, P. Dhariwal, A. Radford, and O. Klimov, “Proximal policy optimization algorithms,”arXiv preprint arXiv:1707.06347, 2017

    2017 arXiv

  32. [40]

    Optimal behavior prior: Data- efficient human models for improved human-ai collaboration,

    M. Yang, M. Carroll, and A. Dragan, “Optimal behavior prior: Data- efficient human models for improved human-ai collaboration,”arXiv preprint arXiv:2211.01602, 2022

    2022 arXiv

  33. [41]

    A dissection of overfitting and generalization in continuous reinforcement learning,

    A. Zhang, N. Ballas, and J. Pineau, “A dissection of overfitting and generalization in continuous reinforcement learning,”arXiv preprint arXiv:1806.07937, 2018. 8

    2018 arXiv

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.