Pith. sign in

REVIEW 5 major objections 6 minor 41 references

ARMOR: Robust Reinforcement Learning-based Control for UAVs under Physical Attacks

T0 review · 5 major / 6 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read ARMOR claims that a student LSTM can learn an attack-robust latent state from sensor history alone, letting one PPO policy finish 88% of missions with zero crashes under simulated physical sensor attacks.

desk verdict A competent simulation-level combination of privileged VAE teacher and history-based LSTM student for attack-resilient UAV control; the 88% success claim is real in PyBullet but does not yet establish physical-attack resilience, and the paper needs artifacts, hyperparameters, and intervals before it is referee-ready. read the letter →

arxiv 2506.22423 v2 pith:XDK2IHFF submitted 2025-06-27 cs.LG cs.CRcs.RO

Pritam Dash , Ethan Chan , Nathan P. Lawrence , Karthik Pattabiraman This is my paper · ORCID
classification cs.LGcs.CRcs.RO
keywords reinforcementlearningUAVcontrolphysicalattackssensorspoofinglatentstaterepresentationteacher-studentvariationalautoencoderadversarialrobustness
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that a UAV controller can remain safe under physical sensor attacks without privileged attack information. Its recipe is to first train a teacher variational encoder on sensor data plus attack metadata, use that attack-aware latent to train a PPO policy, and then train a student LSTM encoder to reproduce the same latent from historical sensor readings only. If this distillation works, the policy can be deployed with no knowledge of which sensor is attacked, at what intensity, or for how long. The reported payoff is an average 88% mission success rate, zero crashes across five simulated attack types, and notably better zero-shot generalization to unseen attack types than standard adversarial training.

What carries the argument

The load-bearing mechanism is a two-stage teacher-student latent encoder with a single shared PPO policy. The teacher is a multi-head variational autoencoder that takes the observable UAV state together with privileged attack metadata and outputs a latent vector (mean and variance), a predicted attack type, and a reconstruction; the attack-classification head pushes the latent to separate attack-specific patterns, and the variance gives the policy an uncertainty signal. The student is an LSTM-based temporal variational autoencoder that reads a sliding window of past sensor states and is trained to match the teacher's latent and the policy's actions, plus an attack-type loss. A single policy trained on the teacher latent is reused unchanged with the student latent at deployment, so robustness transfers without iterative adversarial training.

What would settle it

Run the ARMOR policy on a physical quadrotor under real GPS spoofing and acoustic gyroscope attacks; if mission success drops toward the baseline's level or crashes appear, the central claim fails. A cheaper partial test is to evaluate the trained policy on attack traces recorded from real sensor-spoofing experiments instead of simulator-generated bias signals.

Watch

Extended reading notes

Core claim

ARMOR's central claim is that a control policy does not need to see raw, attack-corrupted sensor values or privileged attack information at deployment. If a teacher encoder is first trained with attack metadata (which sensor is attacked, bias intensity, duration) to produce an attack-aware latent state, a student temporal encoder can be trained by supervised distillation to reproduce that latent from a sliding window of past sensor readings alone. Then the same PPO policy, trained once on the teacher latent, operates online on the student latent. The paper argues this yields an average 88% mission success rate and zero crashes under five simulated physical attack types, and better zero-shot generalization than adversarial training when the policy is tested on attack types it never saw in training.

Load-bearing premise

The results assume the simulated attacks used for training and evaluation faithfully match real physical attacks on UAV sensors, because the same attack-generation simulator produced both sets and no hardware experiments are reported.

Editorial extensions

If this is right

  • If ARMOR is correct, online deployment requires only onboard sensor history, not privileged attack metadata, so the controller can be used where attack information is unavailable.
  • Because there is no iterative adversary, ARMOR reaches the same reward roughly twice as fast as RARL under adversarial conditions, cutting training cost.
  • Policies trained on one sensor attack (GPS or gyroscope) transfer zero-shot to other sensor attacks, with success rates of 50-70% versus 0-5% for RARL, though multi-sensor attacks still degrade performance.
  • The same policy can be driven by the teacher or student latent without retraining, simplifying the path from simulation to deployment.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Whether this generalizes beyond quadrotors is open; the encoder is sensor-history-based, so the same two-stage recipe likely transfers to ground or underwater robots, but the paper does not demonstrate this.
  • The student's latent may implicitly encode which sensor has drifted, not just the true state; an ablation that reads the attack-type head's accuracy under unseen attacks could test this directly.
  • A decisive next test is hardware: real GPS spoofing and acoustic gyroscope attacks may have temporal signatures the simulator does not capture, and window length would then become the key hyperparameter.
  • The reported robustness could partly come from the variance channel carrying an uncertainty signal; removing that channel would isolate its contribution.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 6 minor

Summary. The paper proposes ARMOR, a two-stage RL framework for UAV control under physical sensor attacks. In Stage I, a teacher VAE encoder is trained with privileged attack information (target sensor, bias intensity, attack duration), and its latent representation is used to train a PPO control policy. In Stage II, a student LSTM-based encoder is trained to approximate the teacher's latent states from historical onboard sensor data only, and the same policy is reused at deployment. Experiments in the PyBullet-based gym-pybullet environment with RAVAGE-generated attacks on five sensor types report that ARMOR achieves 88% mission success, zero crashes, lower state drift than HRP and RARL, and better zero-shot generalization to unseen attack types, while also reducing training cost by avoiding iterative adversarial training.

Significance. The central idea is attractive and timely: replacing iterative adversarial training with a teacher-student latent representation that transfers attack awareness from privileged training to deployment-time history-based inference. The student encoder genuinely does not receive attack labels, and the zero-shot evaluations on unseen sensor types are a thoughtful test of representation transfer. If the empirical claims hold, ARMOR is a useful training-efficient alternative to RARL. However, the evaluation is conducted entirely in one simulator with attacks generated by the authors' own tool, and the headline success/crash numbers are reported without confidence intervals or episode counts. These gaps make the current evidence weaker than the paper's conclusions imply, although the approach itself appears internally coherent and worth revising.

major comments (5)
  1. [Section V, Table III (also Tables IV-V)] Success and crash rates are reported as single percentages without confidence intervals, error bars, or the number of evaluation episodes per sensor and condition. The only statement about multiple seeds appears for the training curves in Figure 3. Because the headline comparison is ARMOR at 88% versus RARL at 83%, and the crash rates are 0% versus 0% in several rows, the reader cannot determine whether these differences are statistically meaningful. Please report the number of episodes per condition and provide confidence intervals or per-seed ranges for all tables.
  2. [Sections V and VI, Tables II-V] All attacks are generated by RAVAGE, the authors' own tool, for both training and evaluation, and the zero-shot attacks in Tables IV and V are still drawn from the same bias families and parameter ranges listed in Table II. This makes the 'unseen attack' claims internal to a single simulation attack model. To support the title's 'under Physical Attacks' claim and the conclusion that ARMOR 'ensures UAV safety', the manuscript needs either an evaluation against an independent attack model or a physical testbed, or a clear scoping of all conclusions to RAVAGE-modeled simulated attacks.
  3. [Section IV-B and Section V-A] The action space is defined inconsistently: Table I lists the action as 'position and attitude control commands - x, y, z axes', while Section V states that the action is a = (T1, T2, T3, T4), the four rotor thrusts used in Eq. (4). This discrepancy affects the MDP formulation, the reward function, and reproducibility. Please reconcile the two definitions and state the exact action vector used in training and deployment.
  4. [Section V-A and Figure 3(b)] The text says the Student Encoder policy achieves 'similar convergence' in adversarial conditions, but Stage II trains only the student encoder and reuses the Stage-I policy, so it is unclear what RL training curve is being plotted for the Student Encoder policy. Please clarify whether the policy is trained at all in Stage II, and if it is not, report the student encoder's supervised-learning loss curve instead of an RL reward curve.
  5. [Section IV-A, Eq. (2) and Section V-A] The reward weights lambda, alpha, beta, and gamma, the teacher and student loss weights, the latent dimension, the LSTM window size N, the hidden layer sizes, and the PPO hyperparameters are not reported. Since these parameters directly determine the learned behavior and the reported 88%/0% results, their omission prevents independent replication and weakens the empirical contribution.
minor comments (6)
  1. [Section IV-A, Eq. (2)] The reward function weights lambda, alpha, beta, and gamma are never given numerical values; please state them and describe how they were selected.
  2. [Section IV-A, Eq. (1) and Section IV-B, Eq. (3)] The auxiliary losses Laux and Lattack are not defined; please specify whether they are cross-entropy losses and how the attack-type prediction is supervised.
  3. [Section IV-B and Table I] The student history window is written as H = {ot-n, ..., ot-1} in Table I but as H := {ot-N, ..., ot-1} in the text; please use consistent notation and report the value of N.
  4. [Section IV] The text says the approach is 'inspired by Chen et al. [16]', but reference [16] is the Lee et al. quadrupedal locomotion paper; please correct the citation.
  5. [Section III-B and Section V] The symbol epsilon is used both as the safety threshold for the trajectory deviation Delta_pt <= epsilon for all t and as the mission-success tolerance |pT - g| <= epsilon = 5 m; please clarify whether these are intended to be the same quantity.
  6. [Section VI] The phrase 'ensuring UAV safety' is too strong given the simulation-only evaluation and the absence of formal safety guarantees; consider replacing it with 'improving safety in simulation' or adding explicit caveats.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: ARMOR's teacher–student distillation is explicit supervised learning, and the zero-shot results are empirical measurements rather than constructional identities.

full rationale

ARMOR's pipeline is an explicit teacher–student distillation rather than a first-principles derivation: the teacher VAE is trained with privileged attack descriptors x_t (Eq. 1), and the student is trained by Eq. 3 to regress to the teacher's latent from a history window. This makes the student a supervised approximation of the teacher by construction, but the paper states this openly instead of presenting it as an independent prediction. The central empirical claims — 88% mission success, zero crashes, and zero-shot generalization on unseen sensors — are not forced by the losses: in the zero-shot tables the training regime withholds an entire attack family, and the reported 50–70% success rates could plausibly have been zero if the representation did not transfer; they are measurements, not identities. I find no equation in which an output metric is fed back as an input or in which a fitted parameter is renamed as a prediction. The main weakness is external validity: both training and evaluation attacks are generated by RAVAGE [34], a tool by the same first author, so the “physical attacks” evaluated are only as realistic as that simulator's bias/duration model. That is a validation limitation and a self-citation, but it is not circular because RAVAGE does not encode ARMOR's success and the comparison against RARL/HRP is an external benchmark.

Assumptions & free parameters 6 free parameters · 5 assumptions · 0 invented entities

The paper contributes no new physical entities or constants. Its central claim depends on many unstated hyperparameters and on the fidelity of the authors' own RAVAGE simulator; these are the hidden costs of the reported results.

free parameters (6)
  • Reward shaping weights lambda, alpha, beta, gamma = not reported
    Equation 2 defines the reward with four unstated coefficients; these shape the learned policy's safety and performance trade-off and were presumably chosen by hand.
  • Teacher loss weights = not reported
    Equation 1 sums reconstruction, KL, and auxiliary attack classification losses with no stated weighting.
  • Student loss weights = not reported
    Equation 3 sums latent-matching, action-matching, and attack-classification terms with no stated weighting.
  • Latent dimension and LSTM window size N = not reported
    The capacity of the VAE and LSTM and the length of history H are not specified, affecting what the student can infer.
  • Mission success threshold epsilon and goal radius = epsilon = 5 m, goal radius = 0.1 m
    These evaluation constants define success; 5 m is a large tolerance relative to the 0.1 m goal sphere and can make success easier.
  • Attack bias ranges and durations = Table II values
    These define the training and test attack distributions; they are not fit to data but are chosen by the authors' simulator.
assumptions (5)
  • domain assumption RAVAGE simulates realistic physical attacks
    Section V states attacks are simulated with RAVAGE [34]; the realism of this tool is the basis for all attack scenarios.
  • domain assumption Quadcopter dynamics in Equation 4 with PyBullet are an adequate model
    Section V uses gym-pybullet with the given rigid-body equations; no hardware validation is provided.
  • domain assumption Privileged information X_t is available and exact during training
    Section IV-A defines st = <ot, xt> with simulator-extracted attack details; this information is only available in simulation.
  • standard math PPO converges to a near-optimal policy under the shaped reward
    Section IV-A uses PPO; no convergence guarantees are given, so policy performance rests on standard RL practice.
  • standard math VAE reparameterization and LSTM temporal modeling capture attack signatures
    Sections IV-A and IV-B rely on standard VAE and LSTM machinery to produce and match latent states.

how reviews work

0 comments
Cite this review

Pith. "Pith review of ARMOR: Robust Reinforcement Learning-based Control for UAVs under Physical Attacks." pith.science (2026). https://pith.science/paper/XDK2IHFF

@misc{pith2026250622423,
  author       = {Pith},
  title        = {Pith review of: ARMOR: Robust Reinforcement Learning-based Control for UAVs under Physical Attacks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/XDK2IHFF}},
  note         = {Machine review of arXiv:2506.22423}
}
read the original abstract

Unmanned Aerial Vehicles (UAVs) depend on onboard sensors for perception, navigation, and control. However, these sensors are susceptible to physical attacks, such as GPS spoofing, that can corrupt state estimates and lead to unsafe behavior. While reinforcement learning (RL) offers adaptive control capabilities, existing safe RL methods are ineffective against such attacks. We present ARMOR (Adaptive Robust Manipulation-Optimized State Representations), an attack-resilient, model-free RL controller that enables robust UAV operation under adversarial sensor manipulation. Instead of relying on raw sensor observations, ARMOR learns a robust latent representation of the UAV's physical state via a two-stage training framework. In the first stage, a teacher encoder, trained with privileged attack information, generates attack-aware latent states for RL policy training. In the second stage, a student encoder is trained via supervised learning to approximate the teacher's latent states using only historical sensor data, enabling real-world deployment without privileged information. Our experiments show that ARMOR outperforms conventional methods, ensuring UAV safety. Additionally, ARMOR improves generalization to unseen attacks and reduces training cost by eliminating the need for iterative adversarial training.

Figures

Figures reproduced from arXiv: 2506.22423 by the authors.

Figure 1
Figure 1. Left: Without an attack-resilient control policy, a UAV subjected to physical attacks deviates significantly from its planned trajectory, leading to mission failure. Right: Our goal is to design attack attack-resilient control policy that enables the UAV to remain on course despite the attacks. fundamentally different threat model. They can cause the controller to execute unsafe actions under the illusion that they … view at source ↗
Figure 2
Figure 2. Overview of ARMOR’s two-staged training approach. First, a teacher encoder is trained with privileged information that includes attack information—target sensor, corrupted states, attack duration, etc. The control policy is trained jointly with the teacher encoder. Second, a student encoder is trained to approximate the teacher encoder via supervised learning. The student encoder does not have access to privileged i… view at source ↗
Figure 4
Figure 4. Control performance under GPS spoofing attack. [PITH_FULL_IMAGE:figures/full_fig_p006_4.png] view at source ↗
Figures from the paper (2 more)
Figure 3
Figure 3. Figure 3: Training performance comparison. Left: Nominal conditions, all methods achieve similar final performance. Right: Adversarial conditions, both the Teacher and Student encoder policies significantly accelerate learning compared to RARL. The Student Encoder policy enables…
Figure 5
Figure 5. Figure 5: Position and attitude errors under GPS (left) and gy [PITH_FULL_IMAGE:figures/full_fig_p006_5.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

41 extracted references · 29 canonical work pages

  1. [1]

    Industry 4.0 technologies assessment: A sustainability perspective,

    C. Bai, P. Dallasega, G. Orzes, and J. Sarkis, “Industry 4.0 technologies assessment: A sustainability perspective,” International journal of production economics, vol. 229, p. 107776, 2020

    work page 2020

  2. [2]

    Assessing the spoofing threat: Development of a portable GPS civilian spoofer,

    T. E. Humphreys, “Assessing the spoofing threat: Development of a portable GPS civilian spoofer,” in In Proceedings of the Institute of Navigation GNSS (ION GNSS , 2008

    work page 2008

  3. [3]

    Rocking drones with intentional sound noise on gyroscopic sensors,

    Y . Son, H. Shin, D. Kim, Y . Park, J. Noh, K. Choi, J. Choi, and Y . Kim, “Rocking drones with intentional sound noise on gyroscopic sensors,” in 24th USENIX Security Symposium (USENIX Security 15) . Washington, D.C.: USENIX Association, 2015, pp. 881–896

    work page 2015

  4. [4]

    Con- trolling UA Vs with sensor input spoofing attacks,

    D. Davidson, H. Wu, R. Jellinek, V . Singh, and T. Ristenpart, “Con- trolling UA Vs with sensor input spoofing attacks,” in 10th USENIX Workshop on Offensive Technologies (WOOT 16) . Austin, TX: USENIX Association, 2016

    work page 2016

  5. [5]

    Control of a quadrotor with reinforcement learning,

    J. Hwangbo, I. Sa, R. Siegwart, and M. Hutter, “Control of a quadrotor with reinforcement learning,” IEEE Robotics and Automation Letters , vol. 2, no. 4, pp. 2096–2103, 2017

    2017

  6. [6]

    Safe reinforcement learning via shielding,

    M. Alshiekh, R. Bloem, R. Ehlers, B. K ¨onighofer, S. Niekum, and U. Topcu, “Safe reinforcement learning via shielding,” in Proceedings of the AAAI conference on artificial intelligence , vol. 32, no. 1, 2018

    2018

  7. [7]

    End-to-end safe reinforcement learning through barrier functions for safety-critical continuous control tasks,

    R. Cheng, G. Orosz, R. M. Murray, and J. W. Burdick, “End-to-end safe reinforcement learning through barrier functions for safety-critical continuous control tasks,” in Proceedings of the AAAI conference on artificial intelligence, vol. 33, no. 01, 2019, pp. 3387–3395

    work page 2019

  8. [8]

    Robust adversar- ial reinforcement learning,

    L. Pinto, J. Davidson, R. Sukthankar, and A. Gupta, “Robust adversar- ial reinforcement learning,” in International Conference on Machine Learning. PMLR, 2017, pp. 2817–2826

    2017

Show all 41 references
  1. [9]

    Robust deep reinforcement learning against adversarial perturbations on state observations,

    H. Zhang, H. Chen, C. Xiao, B. Li, M. Liu, D. Boning, and C.-J. Hsieh, “Robust deep reinforcement learning against adversarial perturbations on state observations,” Advances in Neural Information Processing Systems, vol. 33, pp. 21 024–21 037, 2020

    2020

  2. [10]

    Challenges and countermeasures for adversarial at- tacks on deep reinforcement learning,

    I. Ilahi, M. Usama, J. Qadir, M. U. Janjua, A. Al-Fuqaha, D. T. Hoang, and D. Niyato, “Challenges and countermeasures for adversarial at- tacks on deep reinforcement learning,” IEEE Transactions on Artificial Intelligence, vol. 3, no. 2, pp. 90–109, 2021

    2021

  3. [11]

    SpecGuard: Specification aware recovery for robotic autonomous vehicles from physical at- tacks,

    P. Dash, E. Chan, and K. Pattabiraman, “SpecGuard: Specification aware recovery for robotic autonomous vehicles from physical at- tacks,” in Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security , ser. CCS ’24, New York, NY , USA, 2024, p. 1849–1863

    2024

  4. [12]

    Auto-Encoding Variational Bayes,

    D. P. Kingma and M. Welling, “Auto-Encoding Variational Bayes,”

  5. [13]

    Learning predictive representations for deformable objects using contrastive estimation,

    W. Yan, A. Vangipuram, P. Abbeel, and L. Pinto, “Learning predictive representations for deformable objects using contrastive estimation,” in Conference on Robot Learning . PMLR, 2021, pp. 564–574

    2021

  6. [14]

    A framework for efficient robotic manipulation,

    A. Zhan, R. Zhao, L. Pinto, P. Abbeel, and M. Laskin, “A framework for efficient robotic manipulation,” in Deep RL Workshop NeurIPS 2021, 2021

    2021

  7. [15]

    PuV AE: A variational autoencoder to purify adversarial examples,

    U. Hwang, J. Park, H. Jang, S. Yoon, and N. I. Cho, “PuV AE: A variational autoencoder to purify adversarial examples,” IEEE Access, vol. 7, pp. 126 582–126 593, 2019

    2019

  8. [16]

    Learning quadrupedal locomotion over challenging terrain,

    J. Lee, J. Hwangbo, L. Wellhausen, V . Koltun, and M. Hutter, “Learning quadrupedal locomotion over challenging terrain,” Science robotics, vol. 5, no. 47, p. eabc5986, 2020

    2020

  9. [17]

    Safe learning in robotics: From learning-based control to safe reinforcement learning,

    L. Brunke, M. Greeff, A. W. Hall, Z. Yuan, S. Zhou, J. Panerati, and A. P. Schoellig, “Safe learning in robotics: From learning-based control to safe reinforcement learning,” Annual Review of Control, Robotics, and Autonomous Systems , vol. 5, pp. 411–444, 2022

    2022

  10. [18]

    Learning resilient behaviors for navigation under uncertainty,

    T. Fan, P. Long, W. Liu, J. Pan, R. Yang, and D. Manocha, “Learning resilient behaviors for navigation under uncertainty,” in 2020 IEEE International Conference on Robotics and Automation (ICRA) , 2020, pp. 5299–5305

    2020

  11. [19]

    A reinforcement learning-based control strategy for robust interaction of robotic systems with uncertain environments,

    D. Sacerdoti, F. Benzi, and C. Secchi, “A reinforcement learning-based control strategy for robust interaction of robotic systems with uncertain environments,” in 2024 IEEE International Conference on Robotics and Automation (ICRA) , 2024, pp. 5788–5794

    2024

  12. [20]

    Safe multi-agent reinforcement learning for behavior- based cooperative navigation,

    M. Dawood, S. Pan, N. Dengler, S. Zhou, A. P. Schoellig, and M. Bennewitz, “Safe multi-agent reinforcement learning for behavior- based cooperative navigation,” IEEE Robotics and Automation Letters, 2025

    2025

  13. [21]

    Safe offline reinforcement learning using trajectory-level diffusion models,

    R. R ¨omer, L. Brunke, M. Schuck, and A. P. Schoellig, “Safe offline reinforcement learning using trajectory-level diffusion models,” in ICRA 2024 Workshop—Back to the Future: Robot Learning Going Probabilistic, 2024

    2024

  14. [22]

    Semantically safe robot manipulation: From semantic scene understanding to motion safeguards,

    L. Brunke, Y . Zhang, R. R ¨omer, J. Naimer, N. Staykov, S. Zhou, and A. P. Schoellig, “Semantically safe robot manipulation: From semantic scene understanding to motion safeguards,” IEEE Robotics and Automation Letters , 2025

    2025

  15. [23]

    Multi-robot collision avoidance under uncertainty with probabilistic safety barrier certificates,

    W. Luo, W. Sun, and A. Kapoor, “Multi-robot collision avoidance under uncertainty with probabilistic safety barrier certificates,” in Pro- ceedings of the 34th International Conference on Neural Information Processing Systems , ser. NIPS ’20. Red Hook, NY , USA: Curran Associa...

    2020

  16. [24]

    Learning to be safe: Deep RL with a safety critic,

    K. Srinivasan, B. Eysenbach, S. Ha, J. Tan, and C. Finn, “Learning to be safe: Deep RL with a safety critic,” 2020. [Online]. Available: https://arxiv.org/abs/2010.14603

    2020 arXiv

  17. [25]

    Robust model-free reinforce- ment learning with multi-objective Bayesian optimization,

    M. Turchetta, A. Krause, and S. Trimpe, “Robust model-free reinforce- ment learning with multi-objective Bayesian optimization,” in 2020 IEEE international conference on robotics and automation (ICRA) . IEEE, 2020, pp. 10 702–10 708

    2020

  18. [26]

    Robust deep reinforcement learning with adversarial attacks,

    A. Pattanaik, Z. Tang, S. Liu, G. Bommannan, and G. Chowdhary, “Robust deep reinforcement learning with adversarial attacks,” arXiv preprint arXiv:1712.03632, 2017

    2017 arXiv

  19. [27]

    Injected and delivered: Fabricating implicit control over actuation systems by spoofing inertial sensors,

    Y . Tu, Z. Lin, I. Lee, and X. Hei, “Injected and delivered: Fabricating implicit control over actuation systems by spoofing inertial sensors,” in 27th USENIX Security Symposium (USENIX Security 18) . Baltimore, MD: USENIX Association, Aug. 2018, pp. 1545–1562

    2018

  20. [28]

    Paralyzing drones via emi signal injection on sensory communication channels

    J.-H. Jang, M. Cho, J. Kim, D. Kim, and Y . Kim, “Paralyzing drones via emi signal injection on sensory communication channels.” in NDSS, 2023

    2023

  21. [29]

    Out of control: Stealthy attacks against robotic vehicles protected by control-based techniques,

    P. Dash, M. Karimibiuki, and K. Pattabiraman, “Out of control: Stealthy attacks against robotic vehicles protected by control-based techniques,” in Proceedings of the 35th Annual Computer Security Applications Conference , ser. ACSAC ’19. New York, NY , USA: ACM, 2019, pp. 660–672

    2019

  22. [30]

    PID- piper: Recovering robotic vehicles from physical attacks,

    P. Dash, G. Li, Z. Chen, M. Karimibiuki, and K. Pattabiraman, “PID- piper: Recovering robotic vehicles from physical attacks,” in 2021 51st Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN) . IEEE, 2021, pp. 26–38

    2021

  23. [31]

    R. S. Sutton and A. G. Barto, Reinforcement Learning: An Intro- duction, second edition ed., ser. Adaptive Computation and Machine Learning Series. Cambridge, Massachusetts: The MIT Press, 2018

    2018

  24. [32]

    Proximal policy optimization algorithms,

    J. Schulman, F. Wolski, P. Dhariwal, A. Radford, and O. Klimov, “Proximal policy optimization algorithms,” arXiv preprint arXiv:1707.06347, 2017

    2017 arXiv

  25. [33]

    A systematic study of physical sensor attack hardness,

    H. Kim, R. Bandyopadhyay, M. O. Ozmen, Z. B. Celik, A. Bianchi, Y . Kim, and D. Xu, “A systematic study of physical sensor attack hardness,” in 2024 IEEE Symposium on Security and Privacy (SP) . IEEE Computer Society, 2024, pp. 143–143

    2024

  26. [34]

    Ravage: Robotic autonomous vehicles’ attack genaration engine,

    P. Dash and K. Pattabiraman, “Ravage: Robotic autonomous vehicles’ attack genaration engine,” in 2025 55th Annual IEEE/IFIP Inter- national Conference on Dependable Systems and Networks (DSN) . IEEE, 2025

    2025

  27. [35]

    Learning to fly—a gym environment with pybullet physics for reinforcement learning of multi-agent quadcopter control,

    J. Panerati, H. Zheng, S. Zhou, J. Xu, A. Prorok, and A. P. Schoellig, “Learning to fly—a gym environment with pybullet physics for reinforcement learning of multi-agent quadcopter control,” in 2021 IEEE/RSJ International Conference on Intelligent Robots and Systems (IROS). IE...

    2021

  28. [36]

    Openai gym,

    G. Brockman, V . Cheung, L. Pettersson, J. Schneider, J. Schul- man, J. Tang, and W. Zaremba, “Openai gym,” arXiv preprint arXiv:1606.01540, 2016

    2016 arXiv

  29. [37]

    Safe-control-gym: A unified benchmark suite for safe learning-based control and reinforcement learning in robotics,

    Z. Yuan, A. W. Hall, S. Zhou, L. Brunke, M. Greeff, J. Panerati, and A. P. Schoellig, “Safe-control-gym: A unified benchmark suite for safe learning-based control and reinforcement learning in robotics,” IEEE Robotics and Automation Letters , vol. 7, no. 4, pp. 11 142–11 149, 2022

    2022

  30. [38]

    Learn-to-recover: Retrofitting UA Vs with reinforcement learning-assisted flight control under cyber- physical attacks,

    F. Fei, Z. Tu, D. Xu, and X. Deng, “Learn-to-recover: Retrofitting UA Vs with reinforcement learning-assisted flight control under cyber- physical attacks,” in 2020 IEEE International Conference on Robotics and Automation (ICRA) . IEEE, 2020, pp. 7358–7364

    2020

  31. [39]

    Risk averse robust adversarial reinforcement learning,

    X. Pan, D. Seita, Y . Gao, and J. Canny, “Risk averse robust adversarial reinforcement learning,” in 2019 International Conference on Robotics and Automation (ICRA) . IEEE, 2019, pp. 8522–8528

    2019

  32. [40]

    Adversarial policy training against deep reinforcement learning,

    X. Wu, W. Guo, H. Wei, and X. Xing, “Adversarial policy training against deep reinforcement learning,” in 30th USENIX Security Sym- posium (USENIX Security 21) , 2021, pp. 1883–1900

    2021

  33. [2022]

    Available: http://arxiv.org/abs/1312.6114

    [Online]. Available: http://arxiv.org/abs/1312.6114

    arXiv

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.