针对深度强化学习导航的物理对抗攻击方法  

Physical Adversarial Attacks Against Navigation Based on Deep Reinforcement Learning

作　　者：桓琦 谢小权[1] 郭敏 曾颖明[1] HUAN Qi;XIE Xiaoquan;GUO Min;ZENG Yingming(Institute 706,Second Academy of China Aerospace Science and Industry Corporation,Beijing 100854)

机构地区：[1]中国航天科工集团第二研究院706所,北京100854

出　　处：《信息安全研究》2022年第3期212-222,共11页Journal of Information Security Research

基　　金：国家重点研发计划项目(2018YFC0831405)。

摘　　要：针对基于深度强化学习(deep reinforcement learning, DRL)的激光导航系统的安全性进行研究,首次提出了对抗地图的概念,并在此基础上提出了一种物理对抗攻击方法.该方法使用对抗样本生成算法计算激光测距传感器上的对抗扰动,然后修改原始地图实现这些扰动,得到对抗地图.对抗地图可以在某个特定区域诱导智能体偏离最优路径,最终使机器人导航失败.在物理仿真实验中,对比了智能体在多个原始地图和对抗地图的导航结果,证明了对抗地图攻击方法的有效性,指出了目前DRL技术应用在导航系统上存在的安全隐患.In this paper, the security of deep reinforcement learning(DRL) based laser navigation system is studied, and the concept of adversarial map and a physical attack method based on it is proposed for the first time. The method uses the adversarial example generation algorithm to calculate the noise on the laser sensor, and then modifies the original map to realize these noises and get the adversarial map. The adversarial map can induce the agent to deviate from the optimal path in a particular area and finally makes the robot navigation fail. In the physical simulation experiment, this paper compares the navigation results of an agent in multiple original maps and adversarial maps, proves the effectiveness of the countermeasure map attack method, and points out the hidden security dangers of the current application of DRL technology in the navigation system.

关 键 词：深度强化学习 自主导航 对抗攻击 对抗样本 深度学习 

分 类 号：TP18[自动化与计算机技术—控制理论与控制工程] TP309[自动化与计算机技术—控制科学与工程]