Robust Multi-Agent Reinforcement Learning via Adversarial Regularization: Theoretical Foundation and Stable Algorithms

Multi-Agent Reinforcement Learning (MARL) has shown promising results across several domains. Despite this promise, MARL policies often lack robustness and are therefore sensitive to small changes in their environment. This presents a serious concern for the real world deployment of MARL algorithms, where the testing environment may slightly differ from the training environment. In this work we show that we can gain robustness by controlling a policy's Lipschitz constant, and under mild conditions, establish the existence of a Lipschitz and close-to-optimal policy. Based on these insights, we propose a new robust MARL framework, ERNIE, that promotes the Lipschitz continuity of the policies with respect to the state observations and actions by adversarial regularization. The ERNIE framework provides robustness against noisy observations, changing transition dynamics, and malicious actions of agents. However, ERNIE's adversarial regularization may introduce some training instability. To reduce this instability, we reformulate adversarial regularization as a Stackelberg game. We demonstrate the effectiveness of the proposed framework with extensive experiments in traffic light control and particle environments. In addition, we extend ERNIE to mean-field MARL with a formulation based on distributionally robust optimization that outperforms its non-robust counterpart and is of independent interest. Our code is available at https://github.com/abukharin3/ERNIE.

Paper

Similar papers

Peer review

Reviewer YAu46/10 · confidence 2/52023-06-22

Summary

The paper proposes a training objective Lipschitz regularization for obtaining adversarial robustness in cooperative multi-agent RL. To overcome training instablities, the paper reframes the regularization as a Stackleberg game. The paper also shows how the method can be applied to Mean-field approximations of some MARL training algorithms and carries out two experiments on the traffic and the multi-agent Particle Environments.

Strengths

- Nice background on connecting Lipschitz continuity with robustness with respect to different variables of game and policy. - Overall solid method aiming to overcome the instability of adversarial training in the context of MARL.

Weaknesses

I believe the clarity of the experiments section could be significantly improved. The figures are barely legible due to the small (font) size. Moreover, the figure caption could be improved, e.g., does "Evaluation curves" refer to "Learning curves" as in the episode reward over the training? Moreover, what does "Baseline-Gaussian" refer to?

Questions

The method seems to be focused on Cooperative Markov Games. Can you elaborate on whether, how, or why the method would apply to other multi-agent games (competitive or other objectives, etc.)? How does ERNIE compare to direct applications on Eq (2) and (3) in the training process?

Rating

6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.

Confidence

2: You are willing to defend your assessment, but it is quite likely that you did not understand the central parts of the submission or that you are unfamiliar with some pieces of related work. Math/other details were not carefully checked.

Soundness

3 good

Presentation

3 good

Contribution

3 good

Limitations

Readability of the figures could be improved

Reviewer fpJY5/10 · confidence 4/52023-07-05

Summary

The paper introduces a robust Multi-Agent Reinforcement Learning (MARL) framework called ERNIE (adversarially Regularized multi-ageNt reInforcement lEarning). The goal of ERNIE is to address the issue of policy robustness in MARL algorithms. The key contributions of the paper are as follows: 1. Robust MARL Framework: The authors propose ERNIE, which promotes the Lipschitz continuity of policies through adversarial regularization. This regularization enhances robustness against noisy observations, changing transition dynamics, and malicious actions of agents. 2. Lipschitz Control: ERNIE controls the Lipschitz constant of policies, allowing them to be more resilient to variations in the environment. This control is achieved by leveraging adversarial regularization, which encourages Lipschitz continuity with respect to state observations and actions. 3. Training Stability: The paper addresses the training instability that adversarial regularization can introduce by reformulating it as a Stackelberg game. This reformulation provides a more stable training process, making the optimization problem smoother for the defender (policy). 4. Experimental Evaluation: The authors extensively evaluate the effectiveness of ERNIE in traffic light control and particle environments. The experiments demonstrate that ERNIE improves robustness and performance compared to non-robust MARL approaches. 5. Extension to Mean-field MARL: ERNIE is extended to mean-field MARL, a strategy to scale up MARL algorithms. 6. Theoretical Insights: The paper provides theoretical insights into the smoothness and robustness of policies in MARL. It shows that in environments with smooth transition and reward functions, policies' value functions are also smooth. The authors prove the existence of smooth and close-to-optimal policies in such environments and establish that policy robustness is proportional to its Lipschitz constant.

Strengths

**Originality**: The theoretical insights into the smoothness of environments and robustness of policies look interesting to me. By assuming the smoothness of environments, we can get some good properties of robustness. This idea is very interesting to me. However, this idea is very similar to the paper [1]“****Deep Reinforcement Learning with Robust and Smooth Policy****”. [1] Shen, Q., Li, Y., Jiang, H., Wang, Z., & Zhao, T. (2020, November). Deep reinforcement learning with robust and smooth policy. In *International Conference on Machine Learning* (pp. 8707-8718). PMLR. **Quality**: The paper is very informative. I can see the authors have a lot to show readers in the paper: the theoretical results, the proposed framework, how to solve the problem efficiently, and how to adopt the proposed framework to large-scale multi-agent systems. **Clarity**: The paper appears to be clear in its presentation of the problem, the proposed solution, and the results of the experiments. The authors provide a theoretical motivation for their algorithm, explaining how Lipschitzness (smoothness) serves as a natural way to gain robustness while reducing the policy search space. The extension of ERNIE to mean-field MARL is also clearly explained. **Significance**: I believe this paper's theoretical analysis of how smoothness helps in training robust policies would help future researchers in the field of robust MARL to develop better solutions to the robustness issues.

Weaknesses

**Confusing Writing**: I found the paper sometimes inconsistent in motivation, methods, and experiments, which makes me confused about what problem this paper tries to solve. In the abstract, the authors point out that we need to consider real-to-sim gaps in the deployment of MARL algorithms, I quote the original sentence there “This presents a serious concern for the real world deployment of MARL algorithms, where the testing environment may slightly differ from the training environment.” But later, the authors claim that their proposed method is robust to perturbations on observations and actions. I also quote the original sentences as follows: “Based on these insights, we propose a new robust MARL framework, ERNIE, that promotes the Lipschitz continuity of the policies with respect to the state observations and actions by adversarial regularization.” and “In particular, we develop an adversarial regularizer to minimize the discrepancy between each policy’s output given a perturbed observation and a non- perturbed observation.” When I dive into the methodology of this paper, I found most of the contexts are about **Robustness against observation noise with smooth policies** and **Robustness against Malicious Actions.** We can see that the abstract and some texts in the introduction mislead readers about what kind of robustness this paper tries to achieve in MARL. **Evaluations on Simple Games**: The evaluation of the proposed methods is conducted on specific tasks such as traffic light control and particle environment tasks. While these tasks are complex, they may not fully reveal insights into how the smoothness of environments affects the robustness of policies. I would suggest running experiments on some simple matrix games or small-scale multi-agent toy examples [1] to better study how smoothness is connected to robustness. [1] Hu J, Wellman MP. Nash Q-learning for general-sum stochastic games. Journal of machine learning research. 2003;4(Nov):1039-69. **Lack of Comparison with Robust MARL Methods:** This paper claims that the proposed method is robust to perturbed actions and observations. Considering there are some existing works about robust MARL considering adversarial-purebred observations [1, 2, 3] and perturbed actions [4], should the authors compare the proposed method with at least one of these robust MARL methods? [1] Han S, Su S, He S, Han S, Yang H, Miao F. What is the solution for state adversarial multi-agent reinforcement learning?. arXiv preprint arXiv:2212.02705. 2022 Dec 6. [2] He S, Han S, Su S, Han S, Zou S, Miao F. Robust Multi-Agent Reinforcement Learning with State Uncertainty. Transactions on Machine Learning Research. 2023 Mar 10. [3] Zhou Z, Liu G, Zhou M. A Robust Mean-Field Actor-Critic Reinforcement Learning Against Adversarial Perturbations on Agent States. IEEE Transactions on Neural Networks and Learning Systems. 2023 Jun 5. [4] Li, S., Guo, J., Xiu, J., Yu, X., Wang, J., Liu, A., ... & Liu, X. (2023). Byzantine Robust Cooperative Multi-Agent Reinforcement Learning as a Bayesian Game. *arXiv preprint arXiv:2305.12872*. **Writing Suggestions:** The mean-field MARL part does not tightly connect to the main text of this paper. Would it be better to make it a remark instead of a subsection? Besides, the organization of this paper makes me confused, for example, Robustness against observation noise with smooth policies (a paragraph) and Robustness against Malicious Actions (a subsection) are placed on different layers of this paper. Should they be on similar layers? As a paper studying robust MARL, in the related work, this paper uses more text to discuss robust RL works than robust MARL. The literature review of robust MARL is not comprehensive.

Questions

It would be great if the authors can resolve my concerns in the weakness box and the Originality concerns in the strength box. I will decide my final score after the rebuttal phase according to the authors' responses.

Rating

5: Borderline accept: Technically solid paper where reasons to accept outweigh reasons to reject, e.g., limited evaluation. Please use sparingly.

Confidence

4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.

Soundness

3 good

Presentation

2 fair

Contribution

2 fair

Limitations

NAN

Reviewer J2jx6/10 · confidence 3/52023-07-07

Summary

Robust RL is attracting great attention, and lately there has been great advancements both in theory and empirically. However, there is only limited work in robust multi-agent reinforcement learning. Under some assumptions, the paper shows the existence of policies with nice properties. Building upon this, the authors propose a training framework that includes adversarial perturbation on observation in order to increase robustness of the learned policy.

Strengths

The main ideas behind this formulation are quite intuitive. The paper also contains insightful theoretical component to support such intuition. The algorithm is shown to be promising in simulations.

Weaknesses

See limitations.

Questions

1. I find that calling lipschitzness smoothness quite confusing. In particular, in Definition 3.1, the "smoothness" is actually defined as the reward and dynamics being $L_r,L_{\mathbb{P}}$-Lipschitz. Subsequently, in the writing, there are many places where the authors interchange the smoothness and lipschitzness, e.g., line 187-188. As far as I know, more commonly smoothness is about the gradient of a function being Lipschitz. Is there a strong reason for this particular choice of words? 1. This recent work [1] considers a Markov game with state perturbation adversaries. How does it compare to your work? [1] Sihong He, Songyang Han, Sanbao Su, Shuo Han, Shaofeng Zou, and Fei Miao. Robust multi-agent reinforcement learning with state uncertainty. Transactions on Machine Learning Research, 2023. 1. What will be the main difficulty in extending ERNIE to continuous state and action setting? 1. The main idea of making the learned policy Lipschitz is somewhat similar to the idea of smoothening the decision boundary. I would like to think this as the robustness in the "average" case rather than the worst case. Is there any work in the MARL literature that considers the worst case robustness?

Rating

6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.

Confidence

3: You are fairly confident in your assessment. It is possible that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work. Math/other details were not carefully checked.

Soundness

3 good

Presentation

3 good

Contribution

2 fair

Limitations

1. In the paper survey section regarding the single-agent robust RL, I think the authors should include another important line of work: robust Markov decision process (RMDP). This distributionally robust reinforcement learning (DR-RL) framework provides a principled way to achieve robustness against perturbations in models. For example, [1,2] are considered to be the seminal theoretical works that established the framework. In this line of work, some works do not require expert knowledge of the underlying simulator. [3] is an offline DR-RL work that can even handle continous state and action empirically. [4,5] are policy gradient methods for DR-RL, and they also do not need prior expert knowledge. On line 191-193, two DR-RL papers are included as reference but I think the authors should include some in the paper survey section as well. [1] Garud N Iyengar. Robust dynamic programming. Mathematics of Operations Research, 30(2):257–280, 2005. [2] Arnab Nilim and Laurent El Ghaoui. Robust control of Markov decision processes with uncertain transition matrices. Operations Research, 53(5):780–798, 2005. [3] Panaganti, K., Xu, Z., Kalathil, D., & Ghavamzadeh, M. (2022). Robust reinforcement learning using offline data. Advances in neural information processing systems, 35, 32211-32224. [4] Wang, Yue, and Shaofeng Zou. "Policy gradient method for robust reinforcement learning." International Conference on Machine Learning. PMLR, 2022. [5] Navdeep Kumar, Esther Derman, Matthieu Geist, Kfir Levy, and Shie Mannor. Policy gradient for s-rectangular robust Markov decision processes. ArXiv preprint, abs/2301.13589, 2023. URL https://arxiv.org/abs/2301.13589. 1. Although the authors hint that the algorithm can tackle perturbations in dynamics/transition models, this is mainly an empirical claim with no theory to corroborate. 1. Lipschitz assumptions on reward and model are quite strong in my opinion. This is very unlikely to be true or verifiable in larger systems. Hence, the generalizability of the proposed method is limited.

Reviewer NyS95/10 · confidence 3/52023-07-10

Summary

This paper proposes to develop a robust MARL framework based on Lipschitz smoothness of the learned policy (smooth policies). The authors prove the existence of smooth and nearly-optimal policies and propose a framework (ERNIE) to learn robust MARL policy. Experiments are conducted on the two environment: Traffic light control and particle environment.

Strengths

Robust MARL is an important problem to be addressed

Weaknesses

There seems to be many contents squeezed in this paper: theory, framework, connection to game theory (stacklebeg training) and evaluations. It will be nice to have an overview and outline at the end of Intro. 1. This paper also aims to tackle a wide range of threat models if I understand correctly: state perturbation, transition perturbations etc. But why some experiments are evaluating action perturbations? 2. As discussed in Lin 140-141, transition dynamics governed by physical laws (e.g. MuJoCo environment) are of interest. But why in the Experiments, the authors did not show the result of MARL MujoCo Benchmark? 3. Is the ERNIE framework primiarily designed to tackle the threat model of state-perturbation? See Eq 2 of ERNIE regularizer. How can it be used to tackle the transition perturbation threat model? 4. The result in Theorem 3.1 is natural when everything is smooth.

Questions

1. Is the description of Line 48 correct? Is the robustness proprotional to Lipschitz constant or inverse proportional? 2. It is proved that a smooth and close-to-optimal policy exists in smooth enviornment (Line 47-48), but is it guaranteed to obtain such a close-to-optimal policy? and how? 3. Line 215-216 - the boldface and captilaized words does not correspond to ERNIE. 4. Fig 3: the ERNIE's result in Fig 3 seem to be not good, only (a) seem to be outperforming baselines. 5. It's still not clear to me how can the proposed framework be extended beyond smooth environment. Please provide a few example environments that is practically non-smooth and how this framework might be extended? =================== increase rating from 4 to 5 in the post-rebuttal.

Rating

5: Borderline accept: Technically solid paper where reasons to accept outweigh reasons to reject, e.g., limited evaluation. Please use sparingly.

Confidence

3: You are fairly confident in your assessment. It is possible that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work. Math/other details were not carefully checked.

Soundness

2 fair

Presentation

2 fair

Contribution

3 good

Limitations

The authors have a paragraph discussing potential future work of the method, but not necessarily the limitation.

Reviewer mUHD6/10 · confidence 4/52023-07-14

Summary

This paper proposes a method to train robust policies in a multi-agent reinforcement learning setting via adversarial regularization. The authors showed that robust policies can be achieved by enforcing Lipschitz continuity with respect to states for robustness to noisy states and with respect to actions for noisy action by other potential agents. To enforce the Lipschitz continuity, the authors proposes an adversarial regularization term that can be added to conventional RL training objectives, which minimizes the maximum distance between the policy under a perturbed state/action and the policy under the original state/action. The authors also reformulated the minimax problem into a Stackelberg game, which further stabilize the training process. Finally, the authors also extended their adversarial regularization to the setting of mean-field MARL, which enables the training of large-scale robust marl agents. Experiments and results were provided for several MARL benchmarks.

Strengths

The paper presents a well-written study on a novel approach to train robust multi-agent RL policies. While the core idea of using adversarial regularization may not be entirely novel, its application to multi-agent systems and its extension to mean-field RL is an interesting, albeit expected direction of development. The authors also provided relatively comprehensive experimental results, and the discussions and remarks effectively addressed most of my major questions that I thought of when reviewing the paper. In terms of significance, I believe that this work will further the development of robust MARL systems.

Weaknesses

Overall, I believe the paper could benefit further if the authors could also provide additional experiments in the extension to mean-field MARL where the authors also apply the regularizer to the action to validate their claims for the sake of completeness of experiments. In addition to that, it will also be beneficial if the authors would also provide the run time comparisons for the traffic flow environments on top of the MPE environments for completeness. Finally, if I am understand correctly, both of the experiments are employed a reward structure that is continuous and smooth. It will be more convincing if the authors could also demonstrate the effectiveness of their proposed framework on an environment with an approximately smooth vs non-smooth reward structure.

Questions

I do not have any major questions that requires clarification. Minor comments/questions: "Wang et al. [16] consider robustness against uncertain transition dynamics, but their algorithm is not applied to deep MARL.". This sentence really fall under the subsection of robust RL rather than robust MARL then. In the supplementary material: Figure 6: What does STELLA represent? I am assuming its a typo.

Rating

6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.

Confidence

4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.

Soundness

3 good

Presentation

3 good

Contribution

3 good

Limitations

Yes

Reviewer mUHD2023-08-11

Acknowledgement of rebuttal

I would like to thank the authors for the additional results and clarifications and I acknowledge that I have read the rebuttal. I have no further questions

Authorsrebuttal2023-08-14

Follow up on Rebuttal

Dear Reviewer fpJY, Thank you again for your insightful comments! We believe that by addressing your concerns about originality, the writing, simple environments, and comparisons with other robust MARL works, we have greatly strengthened our work. As the discussion period is almost halfway over, we kindly inquire if you have any follow-up questions or comments. If we have addressed your concerns, we would really appreciate it if you would consider raising your score.

Reviewer fpJY2023-08-15

Thank you for your response

I appreciate the authors' thorough response and the inclusion of additional experiments. With my concerns addressed, I'm now inclined to give a rating of 5 (the original rating is 4). I also kindly request the authors to incorporate the supplementary experiment results and other details into the camera-ready version.

Authorsrebuttal2023-08-15

Thank you for the discussion

Dear Reviewer fpJY, Thank you for the engaging discussion. We will be sure to incorporate the supplementary experimental results and other details into the camera-ready version.

Reviewer NyS92023-08-15

Acknowledgement of rebuttal

I thank the authors for the detailed response and additional experiments. I have no other concerns and will increase my rating to 5. The authors please do include the additional experiment results and setup in the camera-ready version, as well as fixing all the inaccurate/incorrect descriptions in the revision to improve the quality of current manuscript.

Authorsrebuttal2023-08-15

Thank you for the discussion

Dear Reviewer NyS9, Thank you again for the discussion and comments! We will add the additional results to the camera-ready version. We will also fix all inaccurate/incorrect descriptions.

Authorsrebuttal2023-08-15

Follow up on Rebuttal

Dear Reviewer J2jx, Thank you again for your insightful comments! We believe that by addressing your concerns on related works (in particular RMDP), clarifying our writing, and discussing some issues with extending ERNIE to continuous actions, our paper is stronger. We would also like to note that we have added a baseline algorithm similar to [1] in our response to Reviewer fpJY's review. We find that ERNIE is either competitive with this baseline or can outperform it in the particle environments. As the discussion period is almost halfway over, we kindly inquire if you have any follow-up questions or comments. If we have addressed your concerns, we would really appreciate it if you would consider raising your score.

Reviewer J2jx2023-08-16

I thank the authors for their spirited rebuttal. I especially appreciate the detailed response to my questions. I have read the additional simulation results and the responses to other reviewers' questions. I have decided to raise my rating.

Authorsrebuttal2023-08-16

Thank you for the discussion

Dear Reviewer J2jx, Thank you for the engaging discussion and willingness to raise your score! We will be sure to include the related literature you mentioned in the next version of the paper, as well as our discussion of ERNIE's limitations.

Program Chairsdecision2023-09-21

Decision

Accept (poster)

© 2026 NYSGPT2525 LLC